Repository navigation
evidence(OMN-14000): OCC companion for omnimarket #1631 ratchet batch-1 (handler_routing) - #3643
Conversation
…-1 (handler_routing) Adds central OCC evidence for OMN-14000 batch 1 so omnimarket PR #1631 can satisfy Receipt Gate: contracts/OMN-14000-batch1.yaml plus PASS receipts for the gate-verification delta (336->338 compliant) and the omnimarket PR binding.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 53 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThis PR modifies the omnimarket allowlist to remove several previously allowlisted handler entries, adds a new OMN-14000 contract YAML defining evidence requirements and DoD evidence, and introduces five drift receipt ChangesOMN-14000 allowlist burn-down and evidence
Estimated code review effort: 2 (Simple) | ~10 minutes Related PRs: PR Suggested labels: compliance, allowlist, drift-evidence Suggested reviewers: None identified from provided information. Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
The receipt-gate/occ-preflight resolve the pinned contract by exact filename match (contracts/OMN-14000.yaml), not a suffixed variant. Renamed from OMN-14000-batch1.yaml — content and hash unchanged.
… landed fix) omnimarket PR #1631 added nested handler{name,module} blocks to node_kb_adr_publisher and node_kreuzberg_parse_effect, clearing their missing_handler_routing violations. Independently re-scanned both handlers via cross_reference() with allowlisted_paths=frozenset() (ignoring the allowlist entirely): both now report zero violations, verdict=compliant. Dropped the two now-stale allowlist entries. Re-ran check-imperative-contracts --repo-root omnimarket --scan-freestanding before/after: compliant_count 180->182 (+2), allowlisted_count 256->254 (-2), new_violation_count 0->0 (unchanged, still green). This is a pure allowlist deletion (zero source-code change) tied directly to the already-landed batch-1 fix -- not a self-authored OCC evidence companion (OMN-14055 out of scope here; the DoD receipts under drift/dod_receipts/OMN-14000/ are untouched). Ref: OMN-14000
…ntries (slice-1 batch A) Zero-LLM stale-entry sweep per the phase-2 plan (docs/plans/2026-07-06-omn-14000-ratchet-burndown-phase2-plan.md Slice 1). Directly scanned every omnimarket node handler via cross_reference(node_dir, allowlisted_paths=frozenset()) -- i.e. ignoring the allowlist entirely -- and found 157 of the 260 current entries produce ZERO live violations today (the underlying missing_handler_routing debt was already fixed upstream by a prior handler_routing migration; the allowlist line was never pruned). This commit drops the first 40 of those 157 gate-confirmed-stale entries (file order, cap per phase-2 execution slice). No source code touched -- pure allowlist deletion. Verified before/after with the full gate: check-imperative-contracts --repo-root omnimarket --scan-freestanding compliant_count: 182 -> 222 (+40) allowlisted_count: 254 -> 214 (-40) new_violation_count: 0 -> 0 (unchanged, still green) Remaining ~117 gate-confirmed-stale entries are left for a follow-up slice (same method, not yet applied -- avoiding a mega-PR per the plan's guardrails). Ref: OMN-14000
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
contracts/OMN-14000.yaml (1)
60-69: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low value
dod-deploy-scopecheck re-runs a live SSH probe instead of verifying the receipt.Every other
dod_evidenceentry in this file verifies compliance by grepping the already-committed receipt file (grep -q '^status: PASS$' ... && grep -q '^field: value$' ...), which is reproducible offline.dod-deploy-scope'scheck_valueinstead re-executes a livessh jonah@100.109.203.94 "docker ps ..."command at verification time, making this one check dependent on Tailscale network/host reachability rather than the recorded receipt content — a different (and less reproducible) verification model than the rest of the contract.Based on retrieved learnings,
dod-deploy-*items are intentionally scoped for a deploy-gate keyword scanner and don't need full functional assertion, so this may be an accepted repo convention rather than a new issue — flagging for confirmation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@contracts/OMN-14000.yaml` around lines 60 - 69, The dod-deploy-scope check is the only dod_evidence entry that performs a live SSH/docker probe instead of validating the committed receipt, so update this entry to match the offline receipt-verification pattern used by the other checks. In the dod-deploy-scope block, replace the ssh jonah@100.109.203.94 docker ps command in checks.check_value with a grep-based assertion against the recorded receipt content, or confirm and document that this live probe is the intended repo convention before keeping it.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@contracts/OMN-14000.yaml`:
- Around line 60-69: The dod-deploy-scope check is the only dod_evidence entry
that performs a live SSH/docker probe instead of validating the committed
receipt, so update this entry to match the offline receipt-verification pattern
used by the other checks. In the dod-deploy-scope block, replace the ssh
jonah@100.109.203.94 docker ps command in checks.check_value with a grep-based
assertion against the recorded receipt content, or confirm and document that
this live probe is the intended repo convention before keeping it.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7dc3f795-f317-402c-a564-5437fc50fe5d
📒 Files selected for processing (7)
allowlists/omnimarket.yamlcontracts/OMN-14000.yamldrift/dod_receipts/OMN-14000/dod-deploy-scope/command.yamldrift/dod_receipts/OMN-14000/dod-gate-verified-batch1/command.yamldrift/dod_receipts/OMN-14000/dod-occ-pr-3643/command.yamldrift/dod_receipts/OMN-14000/dod-omnimarket-pr-1631/command.yamldrift/dod_receipts/OMN-14000/dod-omnimarket-pr-1641/command.yaml
💤 Files with no reviewable changes (1)
- allowlists/omnimarket.yaml
…tchet-batch1 # Conflicts: # tests/test_check_receipt_hardening.py
Merge commits are not allowed on this repository
Summary
Adds central OCC evidence for OMN-14000 batch 1 so omnimarket PR #1631 can satisfy Receipt Gate without bypassing.
Evidence
contracts/OMN-14000-batch1.yamldrift/dod_receipts/OMN-14000/dod-gate-verified-batch1/command.yamldrift/dod_receipts/OMN-14000/dod-omnimarket-pr-1631/command.yamlEvidence-Source: a1faccd
Evidence-Ticket: OMN-14000
Verification
uv run validate-yaml contracts/OMN-14000-batch1.yamlpassed.Runtime
No deploy, restart, docker compose command against .201, image build/push, Redpanda/MSK mutation, AWS mutation, SSH mutation, or live runtime/cluster mutation was performed.
Phase-2 addendum (2 additional commits, this session)
fix(OMN-14000): drop 2 gate-verified-stale allowlist entries (batch-1 landed fix)-- the two nodes fixed by omnimarket#1631 (node_kb_adr_publisher,node_kreuzberg_parse_effect) now report zero violations when re-scanned directly (cross_reference(..., allowlisted_paths=frozenset())), independent of the allowlist. Dropped their now-stale entries. This is a plain allowlist deletion tied to the already-landed code fix, not new "OCC evidence" (the DoD receipts above are untouched) -- so it does not trip OMN-14055's no-self-authored-evidence rule.fix(OMN-14000): drop 40 gate-verified-stale missing_handler_routing entries (slice-1 batch A)-- a broader zero-LLM stale-entry sweep (phase-2 plan Slice 1): 157 of the then-260 omnimarket allowlist entries were independently confirmed to produce zero live violations today (pre-existing debt already fixed upstream, allowlist never pruned). Dropped the first 40 (file order), cap per this execution slice; ~117 remain for a follow-up.Gate re-verified green after each commit:
check-imperative-contracts --repo-root omnimarket --scan-freestandingOMN-14000
Summary by CodeRabbit
Bug Fixes
Chores