evidence(OMN-13670): add cryptography CVE floor receipt for expand-trivy-floors follow-up

[jonahgabriel]

Summary

• Extends the OMN-13670 contract with dod-crypto-floor and dod-occ-self-b evidence items
• Adds PASS receipts proving cryptography>=48.0.1 is declared in pyproject.toml on the follow-up hotfix branch (commit 3f8bffae007c562858a647498f7f6e8707cc1567)
• Clears GHSA-537c-gmf6-5ccf (HIGH: vulnerable OpenSSL bundled in cryptography wheels <48.0.1)
• This OCC PR is the Evidence-Source for omnibase_infra follow-up hotfix PR targeting main

Evidence-Ticket: OMN-13670
Evidence-Source: OCC#

Summary by CodeRabbit

• Bug Fixes

  • Added validation evidence showing the app now meets the required dependency floor for a known security issue, allowing the security gate to pass cleanly.

• Chores

  • Added a follow-up receipt to document that the evidence was successfully consumed and verified in a later review step.

[coderabbitai]

📝 Walkthrough

Walkthrough

Two new dod_evidence receipt entries (dod-crypto-floor and dod-occ-self-b) are added to contracts/OMN-13670.yaml, each backed by a new command.yaml drift receipt file asserting status: PASS for the cryptography CVE floor and self-binding checks.

Changes

OMN-13670 DoD Evidence Receipts

Layer / File(s)	Summary
Contract entries and drift receipt files contracts/OMN-13670.yaml, drift/dod_receipts/OMN-13670/dod-crypto-floor/command.yaml, drift/dod_receipts/OMN-13670/dod-occ-self-b/command.yaml	Adds two dod_evidence receipt references to the contract and introduces matching command.yaml files recording PASS status for the cryptography>=48.0.1 CVE floor check and the self-binding consumption receipt.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐇 A lock file checked, a version pinned with care,
The crypto floor is set, no CVE dare!
Two receipts filed, the contract complete,
The Trivy gate clears — hop hop, no defeat.
Evidence stamped, the rabbit is pleased! 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: adding a cryptography CVE floor evidence receipt for OMN-13670.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-13670b-crypto-floor

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@drift/dod_receipts/OMN-13670/dod-occ-self-b/command.yaml`:
- Around line 13-21: The self-binding receipt is using prose and an unresolved
placeholder instead of a real OCC PR query. Update the command in probe_command
to use the actual gh pr view lookup that produced the metadata in probe_stdout,
and replace OCC#<PR-number> in actual_output with the bound PR identifier/head
commit. Keep the receipt tied to the existing onex_change_control/OCC PR binding
flow so the PASS summary references concrete evidence.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ade70f02-5570-4cc0-8787-e2004a4000e3

📥 Commits

Reviewing files that changed from the base of the PR and between 68dbeb5 and 21b28e0.

📒 Files selected for processing (3)

• contracts/OMN-13670.yaml
• drift/dod_receipts/OMN-13670/dod-crypto-floor/command.yaml
• drift/dod_receipts/OMN-13670/dod-occ-self-b/command.yaml

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Bind this receipt to a real OCC PR query.

Line 13 is prose instead of the command that produced the PR metadata in Lines 15-17, and Line 20 still has the unresolved OCC#<PR-number> placeholder. That makes the self-binding receipt non-reproducible and leaves the evidence source unbound to a concrete OCC PR/head commit. Based on learnings, PR-binding DoD receipts should use gh pr view in probe_command and the PASS summary should reference the bound head commit.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@drift/dod_receipts/OMN-13670/dod-occ-self-b/command.yaml` around lines 13 -
21, The self-binding receipt is using prose and an unresolved placeholder
instead of a real OCC PR query. Update the command in probe_command to use the
actual gh pr view lookup that produced the metadata in probe_stdout, and replace
OCC#<PR-number> in actual_output with the bound PR identifier/head commit. Keep
the receipt tied to the existing onex_change_control/OCC PR binding flow so the
PASS summary references concrete evidence.

Source: Learnings

[jonahgabriel]

Closing as superseded by the repaired hotfix evidence path: OCC PR #3235 merged at 2026-06-28T05:30:58Z with merge commit e25345e, and downstream omnibase_infra#2131 merged at 2026-06-28T06:10:42Z.