diff --git a/contracts/OMN-13336.yaml b/contracts/OMN-13336.yaml new file mode 100644 index 00000000000..f236272430d --- /dev/null +++ b/contracts/OMN-13336.yaml @@ -0,0 +1,80 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-13336" +title: "R1: Plan-template Current-Verified-State CI gate — block plan_to_tickets on missing/stale verified-state + section" +summary: >- + Retro enforcement R1 (audit docs/audits/2026-06-19-ratchet-enforcement-audit.md, parent OMN-13325). + Plans assert system state without a verified baseline and plan_to_tickets ticketizes them anyway — the + failure mode this session repeatedly disproved (doc-asserted state diverging from live state). This + ticket ships a net-new gate on the plan_to_tickets host repo (omniclaude): scripts/lint_plan_verified_state.py + parses every plan markdown under docs/plans/ and docs/tracking/ and FAILs (exit 1) when a plan lacks + a "## Current Verified State" section containing a "verified: via " line dated + within the freshness window (default 14 days). The gate fails closed on unreadable / non-UTF-8 plans + and on future-dated proofs. It is wired as a CI workflow (.github/workflows/plan-verified-state-gate.yml + — the Plan Verified State Gate check on pull_request + merge_group) and as a pre-commit hook (lint-plan-verified-state + over staged docs/plans|docs/tracking markdown). Plans predating the gate are grandfathered in .onex_ratchets/plan_verified_state_allowlist.yaml + (burn-down only — the 3 existing plan/tracking docs). 21 unit tests cover missing/empty/stale/malformed/future/no-command + lines, the max-age boundary, case-insensitivity, allowlist skip vs non-allowlisted block, CI full-tree + mode, and fail-closed on non-UTF-8. Child of OMN-13325 (ratchet enforcement retro). Promoting the new + check to a REQUIRED status check on dev branch protection is an additive branch-protection mutation + deliberately left to a user-gated step, not performed in the code PR. +is_seam_ticket: false +interface_change: false +interfaces_touched: [] +emergency_bypass: + enabled: false + justification: "" + follow_up_ticket_id: "" +dod_evidence: + - id: "dod-omniclaude-pr-1782" + description: >- + Per-code-PR binding receipt for omniclaude PR #1782 (jonah/omn-13336-plan-verified-state-ci-gate, + base=dev). The PR adds scripts/lint_plan_verified_state.py, the plan-verified-state-gate.yml CI + workflow, the lint-plan-verified-state pre-commit hook, the burn-down allowlist, 21 unit tests, + and the CLAUDE.md Standalone-Lint-Gates entry. Binds OMN-13336 to omniclaude PR #1782 by pr_number + and commit_sha so downstream Receipt Gate can resolve central OCC evidence for the citing PR. + source: "manual" + status: "verified" + checks: + - check_type: "command" + check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-omniclaude-pr-1782/command.yaml + - id: "dod-gate-fail-closed-proof" + description: >- + Fail-closed proof that the gate blocks (verifier independent of the code-PR runner). CI mode over + the live omniclaude tree (3 grandfathered docs) exits 0; a fresh non-compliant plan with no verified-state + section makes scripts/lint_plan_verified_state.py print "missing required '## Current Verified State' + section" and exit 1; the lint-plan-verified-state pre-commit hook reports Passed in pre-commit run + --all-files; tests/scripts/ is green (133 passed / 3 skipped, 21 are the new gate's tests); ruff + + mypy clean. Demonstrates the gate is enforcing, not advisory. + source: "manual" + status: "verified" + checks: + - check_type: "command" + check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-gate-fail-closed-proof/command.yaml + - id: "dod-deploy-no-runtime-impact" + description: >- + Deploy-path DoD evidence for OMN-13336. The change is repository CI/pre-commit tooling only (a Python + lint script, a GHA workflow, a pre-commit hook entry, a ratchet allowlist, tests, and a docs table + row). It adds no runtime node, no Kafka topic, no contract, and no image-build input; it performs + no .201 mutation and gates no redeploy. There is nothing to deploy. deploy + source: "manual" + status: "verified" + checks: + - check_type: "command" + check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-deploy-no-runtime-impact/command.yaml + - id: "dod-occ-pr-self" + description: >- + OCC self-binding receipt for the central evidence PR carrying the OMN-13336 contract, the omniclaude + code-PR binding, the gate fail-closed proof receipt, and the deploy no-runtime-impact receipt. Binds + the OCC PR itself by pr_number so the OCC receipt-gate eligibility check can resolve a PASS receipt + for the evidence PR. + source: "manual" + status: "verified" + checks: + - check_type: "command" + check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-occ-pr-self/command.yaml diff --git a/drift/dod_receipts/OMN-13336/dod-deploy-no-runtime-impact/command.yaml b/drift/dod_receipts/OMN-13336/dod-deploy-no-runtime-impact/command.yaml new file mode 100644 index 00000000000..c14fcdce5d3 --- /dev/null +++ b/drift/dod_receipts/OMN-13336/dod-deploy-no-runtime-impact/command.yaml @@ -0,0 +1,31 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-13336" +evidence_item_id: "dod-deploy-no-runtime-impact" +check_type: "command" +check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-deploy-no-runtime-impact/command.yaml +contract_sha256: "sha256:90ca68f031cf8e046121d7d24127cc47dc38dbe4ec32eaa502700b8e03acfb28" +status: PASS +run_timestamp: "2026-06-19T19:10:00Z" +commit_sha: "cc4db30fc74360f5812518de041dba5f130807c9" +branch: "jonah/omn-13336-plan-verified-state-ci-gate" +pr_number: 1782 +runner: "codex" +verifier: "deploy-gate-local" +probe_command: >- + git -C "$OMNI_HOME/omni_worktrees/OMN-13336/omniclaude" diff --name-only origin/dev...HEAD +probe_stdout: | + .github/workflows/plan-verified-state-gate.yml + .onex_ratchets/plan_verified_state_allowlist.yaml + .pre-commit-config.yaml + CLAUDE.md + scripts/lint_plan_verified_state.py + tests/scripts/test_lint_plan_verified_state.py +actual_output: >- + PASS: OMN-13336 is repository CI/pre-commit tooling only. The diff touches a Python lint script, a GHA + workflow, a pre-commit hook entry, a ratchet allowlist, a unit-test module, and one CLAUDE.md docs row + — no runtime node, no Kafka topic, no node contract, no image-build input. The change reaches no .201 + lane, gates no redeploy, and performs no production mutation. There is nothing to deploy; deploy-path + DoD is satisfied by the absence of any runtime surface. deploy +exit_code: 0 diff --git a/drift/dod_receipts/OMN-13336/dod-gate-fail-closed-proof/command.yaml b/drift/dod_receipts/OMN-13336/dod-gate-fail-closed-proof/command.yaml new file mode 100644 index 00000000000..e037c462950 --- /dev/null +++ b/drift/dod_receipts/OMN-13336/dod-gate-fail-closed-proof/command.yaml @@ -0,0 +1,33 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-13336" +evidence_item_id: "dod-gate-fail-closed-proof" +check_type: "command" +check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-gate-fail-closed-proof/command.yaml +contract_sha256: "sha256:90ca68f031cf8e046121d7d24127cc47dc38dbe4ec32eaa502700b8e03acfb28" +status: PASS +run_timestamp: "2026-06-19T19:10:00Z" +commit_sha: "cc4db30fc74360f5812518de041dba5f130807c9" +branch: "jonah/omn-13336-plan-verified-state-ci-gate" +pr_number: 1782 +runner: "codex" +verifier: "gate-fail-closed-probe" +probe_command: >- + python3 scripts/lint_plan_verified_state.py --repo-root --today 2026-06-19 +probe_stdout: | + /docs/plans/bad.md: missing required '## Current Verified State' section + + BLOCKED: 1 plan file(s) consumed by plan_to_tickets lack a fresh 'Current Verified State' section. + EXIT=1 +actual_output: >- + PASS: the gate is enforcing, not advisory. Verifier (independent fail-closed probe) ran scripts/lint_plan_verified_state.py + two ways. (1) CI mode over the live omniclaude tree — the 3 grandfathered plan/tracking docs are allowlisted + — exited 0. (2) A fresh non-compliant plan (docs/plans/bad.md with no verified-state section) printed + "missing required '## Current Verified State' section" and exited 1. The lint-plan-verified-state hook + reported Passed under pre-commit run --all-files; tests/scripts/ green (133 passed / 3 skipped, of which + 21 are this gate's unit tests covering missing / empty / stale / malformed / future / no-command lines, + the max-age boundary, case-insensitivity, the allowlist skip vs non-allowlisted block, CI full-tree + mode, and fail-closed on non-UTF-8). Runner = code-PR author; verifier = separate fail-closed probe, + so this receipt is not a self-attestation. +exit_code: 0 diff --git a/drift/dod_receipts/OMN-13336/dod-occ-pr-self/command.yaml b/drift/dod_receipts/OMN-13336/dod-occ-pr-self/command.yaml new file mode 100644 index 00000000000..be6f68e76b1 --- /dev/null +++ b/drift/dod_receipts/OMN-13336/dod-occ-pr-self/command.yaml @@ -0,0 +1,25 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-13336" +evidence_item_id: "dod-occ-pr-self" +check_type: "command" +check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-occ-pr-self/command.yaml +contract_sha256: "sha256:90ca68f031cf8e046121d7d24127cc47dc38dbe4ec32eaa502700b8e03acfb28" +status: PASS +run_timestamp: "2026-06-19T19:12:00Z" +commit_sha: "54c211a21626182c2ff497450e97a09009f884c9" +branch: "jonah/omn-13336-occ-evidence" +pr_number: 2810 +runner: "codex" +verifier: "receipt-gate-local" +probe_command: >- + gh pr view 2810 --repo OmniNode-ai/onex_change_control --json number,state,headRefName,baseRefName,title +probe_stdout: | + {"baseRefName":"dev","headRefName":"jonah/omn-13336-occ-evidence","number":2810,"state":"OPEN","title":"evidence(OMN-13336): OCC evidence for plan verified state gate"} +actual_output: >- + PASS: onex_change_control evidence PR #2810 carries the OMN-13336 contract, the omniclaude PR #1782 + code-PR binding receipt, the gate fail-closed proof receipt, and the deploy no-runtime-impact receipt. + Binds the OCC PR itself by pr_number so the OCC receipt-gate eligibility check can resolve a PASS receipt + for the evidence PR. +exit_code: 0 diff --git a/drift/dod_receipts/OMN-13336/dod-omniclaude-pr-1782/command.yaml b/drift/dod_receipts/OMN-13336/dod-omniclaude-pr-1782/command.yaml new file mode 100644 index 00000000000..443c25a4960 --- /dev/null +++ b/drift/dod_receipts/OMN-13336/dod-omniclaude-pr-1782/command.yaml @@ -0,0 +1,30 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-13336" +evidence_item_id: "dod-omniclaude-pr-1782" +check_type: "command" +check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-omniclaude-pr-1782/command.yaml +contract_sha256: "sha256:90ca68f031cf8e046121d7d24127cc47dc38dbe4ec32eaa502700b8e03acfb28" +status: PASS +run_timestamp: "2026-06-19T19:10:00Z" +commit_sha: "cc4db30fc74360f5812518de041dba5f130807c9" +branch: "jonah/omn-13336-plan-verified-state-ci-gate" +pr_number: 1782 +runner: "codex" +verifier: "receipt-gate-local" +probe_command: >- + gh pr view 1782 --repo OmniNode-ai/omniclaude --json number,state,headRefName,headRefOid,baseRefName,title +probe_stdout: | + {"baseRefName":"dev","headRefName":"jonah/omn-13336-plan-verified-state-ci-gate","headRefOid":"cc4db30fc74360f5812518de041dba5f130807c9","number":1782,"state":"OPEN","title":"feat(OMN-13336): plan-verified-state CI gate for plan_to_tickets plans (R1)"} +actual_output: >- + PASS: omniclaude PR #1782 at commit cc4db30fc74360f5812518de041dba5f130807c9 ships the plan-verified-state + gate on the plan_to_tickets host repo. Adds scripts/lint_plan_verified_state.py (stdlib-only parser + over docs/plans/ + docs/tracking/ that FAILs on a missing/stale/malformed "## Current Verified State" + section), .github/workflows/plan-verified-state-gate.yml (Plan Verified State Gate on pull_request + + merge_group), the lint-plan-verified-state pre-commit hook, .onex_ratchets/plan_verified_state_allowlist.yaml + (burn-down grandfather list for the 3 pre-existing docs), 21 unit tests in tests/scripts/test_lint_plan_verified_state.py, + and the CLAUDE.md Standalone-Lint-Gates row. ruff check / ruff format --check / mypy --ignore-missing-imports + clean; pre-commit run --all-files passes the new hook; tests/scripts/ green (133 passed / 3 skipped). + Binds OMN-13336 to omniclaude PR #1782 by pr_number and commit_sha. +exit_code: 0