From 90c6cbffeef2b043cdad71929caa7a582609ce10 Mon Sep 17 00:00:00 2001 From: Jonah Gray Date: Sat, 11 Jul 2026 17:25:58 -0700 Subject: [PATCH 1/2] evidence(OMN-14397): add OCC receipts for infra pr 2265 Independent adversarial verification (round 2, post-remediation) of omnibase_infra PR #2265 head 3e5e86d890cc624860906f0fd32fdf5e23589084. Round 1 found a real DEFECT (DelegateTimeoutExceededError swallowed by run_receipt_mode's broad except Exception); round 2 remediation (BaseException base class) was independently reproduced RED->GREEN, along with a full audit of the call path for any remaining BaseException escape hazard. See contract dod_evidence for full detail. Refs OMN-14397 --- contracts/OMN-14397.yaml | 70 +++++++++++++++++++ .../command.yaml | 25 +++++++ .../command.yaml | 59 ++++++++++++++++ 3 files changed, 154 insertions(+) create mode 100644 contracts/OMN-14397.yaml create mode 100644 drift/dod_receipts/OMN-14397/dod-deploy-assessment-head-3e5e86d8/command.yaml create mode 100644 drift/dod_receipts/OMN-14397/dod-omnibase-infra-pr-2265-head-3e5e86d8/command.yaml diff --git a/contracts/OMN-14397.yaml b/contracts/OMN-14397.yaml new file mode 100644 index 00000000000..03c75bdb7af --- /dev/null +++ b/contracts/OMN-14397.yaml @@ -0,0 +1,70 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-14397" +title: "fix(OMN-14397): onex delegate correlation_id + hard SIGALRM timeout backstop" +summary: >- + omnibase_infra PR #2265 mints a fresh correlation_id per onex delegate invocation and adds a SIGALRM-based + hard timeout backstop so a hung Kafka-bus response listener stuck in non-cooperative blocking I/O no + longer outlives its own --timeout and requires a manual kill (observed on .201). Round-2 remediation + (commit 3e5e86d8) closes a defect found in independent verification: the backstop's DelegateTimeoutExceededError + now subclasses BaseException instead of RuntimeError so it cannot be silently swallowed by run_receipt_mode's + own broad except Exception around the exact call that hangs. +is_seam_ticket: true +interface_change: true +interfaces_touched: + - "public_api" +emergency_bypass: + enabled: false + justification: "" + follow_up_ticket_id: "" +dod_evidence: + - id: "dod-omnibase-infra-pr-2265-head-3e5e86d8" + description: >- + Independent adversarial verification of omnibase_infra PR #2265 at head 3e5e86d890cc624860906f0fd32fdf5e23589084 + (round 2, post-remediation). Round 1 found a real DEFECT: DelegateTimeoutExceededError(RuntimeError) + was silently swallowed by run_receipt_mode's broad except Exception around the exact call that hangs + (receipt_mode.py:509-526), so the documented clear-stderr / exit-1 contract never fired for the + real hang scenario. Round 2 remediation (BaseException base class) was independently reproduced: + reverting the base class back to RuntimeError produced the exact predicted RED signature (empty + stderr, the accidental-exit-code fingerprint); restoring BaseException produced clean GREEN. Empirically + confirmed no BaseException escape path exists anywhere on the call path (cli_delegate.py, receipt_mode.py, + and the venv-resolved omnibase_core runtime_local.py all audited for bare/broad except clauses), + that finally-block cleanup (signal.alarm(0) + handler restore) runs under BaseException unwind, + and that issubclass(DelegateTimeoutExceededError, Exception) is False. Also independently reproduced + the round-1 behavioral RED for both original fixes (correlation_id payload write, SIGALRM backstop) + via targeted reverts. Full tests/unit/cli/ suite: 335 passed, 15 pre-existing unrelated skips (missing + omnimarket module). ruff check, ruff format --check, and mypy clean on both touched files. + source: "manual" + status: "verified" + checks: + - check_type: "command" + check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-14397/dod-omnibase-infra-pr-2265-head-3e5e86d8/command.yaml + && grep -q '^pr_number: 2265$' drift/dod_receipts/OMN-14397/dod-omnibase-infra-pr-2265-head-3e5e86d8/command.yaml + && grep -q '3e5e86d890cc624860906f0fd32fdf5e23589084' drift/dod_receipts/OMN-14397/dod-omnibase-infra-pr-2265-head-3e5e86d8/command.yaml + - id: "dod-deploy-assessment-head-3e5e86d8" + description: >- + Deploy-surface assessment for omnibase_infra PR #2265 head 3e5e86d890cc624860906f0fd32fdf5e23589084: + the diff is limited to a single CLI module (src/omnibase_infra/cli/cli_delegate.py) and its focused + unit test (tests/unit/cli/test_cli_delegate.py). It does not register a new service deployment, + mutate runtime configuration, perform a deploy or restart, change topics, add a migration, or touch + .201. + source: "manual" + status: "verified" + checks: + - check_type: "command" + check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-14397/dod-deploy-assessment-head-3e5e86d8/command.yaml + && grep -qi 'no live deploy' drift/dod_receipts/OMN-14397/dod-deploy-assessment-head-3e5e86d8/command.yaml + - id: "dod-occ-self-commit" + description: >- + OCC self-binding: this onex_change_control branch carries the OMN-14397 central contract and PASS + receipts for omnibase_infra PR #2265 head 3e5e86d890cc624860906f0fd32fdf5e23589084. The receipt + binds the first evidence commit for occ-preflight eligibility before the OCC PR number exists. + source: "manual" + status: "verified" + checks: + - check_type: "command" + check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-14397/dod-occ-self-commit/command.yaml && grep + -q 'jonah/omn-14397-occ-pr2265' drift/dod_receipts/OMN-14397/dod-occ-self-commit/command.yaml diff --git a/drift/dod_receipts/OMN-14397/dod-deploy-assessment-head-3e5e86d8/command.yaml b/drift/dod_receipts/OMN-14397/dod-deploy-assessment-head-3e5e86d8/command.yaml new file mode 100644 index 00000000000..617578b3d7b --- /dev/null +++ b/drift/dod_receipts/OMN-14397/dod-deploy-assessment-head-3e5e86d8/command.yaml @@ -0,0 +1,25 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-14397" +evidence_item_id: "dod-deploy-assessment-head-3e5e86d8" +check_type: "command" +check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-14397/dod-deploy-assessment-head-3e5e86d8/command.yaml + && grep -qi 'no live deploy' drift/dod_receipts/OMN-14397/dod-deploy-assessment-head-3e5e86d8/command.yaml +status: PASS +run_timestamp: "2026-07-12T00:21:58Z" +commit_sha: "3e5e86d890cc624860906f0fd32fdf5e23589084" +runner: "fix-14397" +verifier: "verify-14397" +pr_number: 2265 +probe_command: "gh pr diff 2265 --repo OmniNode-ai/omnibase_infra --name-only" +probe_stdout: | + src/omnibase_infra/cli/cli_delegate.py + tests/unit/cli/test_cli_delegate.py +actual_output: >- + PASS: omnibase_infra#2265 head 3e5e86d890cc624860906f0fd32fdf5e23589084 changes only a single CLI module + (correlation_id minting + SIGALRM timeout backstop in the onex delegate command) and its focused unit + test. There was no live deploy, no restart, no .201 mutation, no topic mutation, and no migration. +exit_code: 0 +branch: "jonah/omn-14397-occ-pr2265" +contract_sha256: "sha256:f669deb201ecbf62af35e29cf1f04268f07da36de0bf65c882a3a206b1ce0fc7" diff --git a/drift/dod_receipts/OMN-14397/dod-omnibase-infra-pr-2265-head-3e5e86d8/command.yaml b/drift/dod_receipts/OMN-14397/dod-omnibase-infra-pr-2265-head-3e5e86d8/command.yaml new file mode 100644 index 00000000000..b5e5cbb3c04 --- /dev/null +++ b/drift/dod_receipts/OMN-14397/dod-omnibase-infra-pr-2265-head-3e5e86d8/command.yaml @@ -0,0 +1,59 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-14397" +evidence_item_id: "dod-omnibase-infra-pr-2265-head-3e5e86d8" +check_type: "command" +check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-14397/dod-omnibase-infra-pr-2265-head-3e5e86d8/command.yaml + && grep -q '^pr_number: 2265$' drift/dod_receipts/OMN-14397/dod-omnibase-infra-pr-2265-head-3e5e86d8/command.yaml + && grep -q '3e5e86d890cc624860906f0fd32fdf5e23589084' drift/dod_receipts/OMN-14397/dod-omnibase-infra-pr-2265-head-3e5e86d8/command.yaml +status: PASS +run_timestamp: "2026-07-12T00:21:58Z" +commit_sha: "3e5e86d890cc624860906f0fd32fdf5e23589084" +runner: "fix-14397" +verifier: "verify-14397" +pr_number: 2265 +probe_command: >- + uv run pytest tests/unit/cli/test_cli_delegate.py -v && uv run pytest tests/unit/cli/ -q && uv run ruff + check src/omnibase_infra/cli/cli_delegate.py tests/unit/cli/test_cli_delegate.py && uv run ruff format + --check src/omnibase_infra/cli/cli_delegate.py tests/unit/cli/test_cli_delegate.py && uv run mypy src/omnibase_infra/cli/cli_delegate.py +probe_stdout: | + round 1 behavioral RED->GREEN: reverted correlation_id payload write -> + test_two_runs_get_distinct_correlation_ids FAILED (KeyError: 'correlation_id'); restored -> GREEN. + reverted SIGALRM backstop (forced _hard_timeout no-op path) -> + test_hard_timeout_aborts_blocking_call FAILED (DID NOT RAISE) and + test_run_delegate_aborts_hung_dispatch_within_bound FAILED (assert 0 == 1); restored -> GREEN. + round 2 behavioral RED->GREEN (post-remediation commit 3e5e86d8): reverted + DelegateTimeoutExceededError(BaseException) -> RuntimeError -> + test_run_delegate_aborts_hung_dispatch_despite_receipt_mode_broad_except FAILED + (AssertionError: timeout signal did not survive the broad except -- stderr: ''); restored -> GREEN. + empirically reproduced receipt_mode.py's real try/except-Exception shape around a blocking call under + the real _hard_timeout(1): the inner except Exception fired zero times post-fix; run_delegate's + DelegateTimeoutExceededError handler correctly caught it (propagated=True, elapsed=1.00s). + confirmed issubclass(DelegateTimeoutExceededError, Exception) is False and + issubclass(DelegateTimeoutExceededError, BaseException) is True. + confirmed finally-block integrity under BaseException unwind: signal.alarm(0) returned 0 (no dangling + alarm) and signal.getsignal(SIGALRM) matched the pre-existing handler after propagation. + grepped every except clause across cli_delegate.py, receipt_mode.py, and the venv-resolved + omnibase_core/runtime/runtime_local.py -- zero bare except: anywhere, no BaseException escape path. + tests/unit/cli/test_cli_delegate.py: 34 passed. + tests/unit/cli/ -q: 335 passed, 15 pre-existing unrelated skips (ModuleNotFoundError: omnimarket in + test_cli_skill.py). + ruff check: All checks passed! + ruff format --check: 2 files already formatted. + mypy: Success, no issues found in 1 source file. + gh pr checks 2265 at head 3e5e86d8: only non-green checks are the occ-preflight/eligibility cascade + (31 entries) plus the aggregating CI Summary, whose own job log shows + "strict-gate failures: ... occ-preflight / eligibility" as the sole completed/failure gate -- every + other strict gate is completed/skipped (cascade, not independent red). +actual_output: >- + PASS: omnibase_infra#2265 head 3e5e86d890cc624860906f0fd32fdf5e23589084 (round-2 remediated head) mints + a fresh correlation_id per onex delegate invocation and adds a SIGALRM-based hard timeout backstop whose + DelegateTimeoutExceededError subclasses BaseException so it cannot be swallowed by run_receipt_mode's + broad except Exception around the exact call that hangs. Both original fixes and the round-2 remediation + were independently reproduced via behavioral RED/GREEN reverts, not accepted from the implementer's + self-report. No BaseException escape path exists on the call path. No regressions in tests/unit/cli/. + CI is cascade-only red (occ-preflight), no independent failure. +exit_code: 0 +branch: "jonah/omn-14397-occ-pr2265" +contract_sha256: "sha256:f669deb201ecbf62af35e29cf1f04268f07da36de0bf65c882a3a206b1ce0fc7" From 6f016b0ee6b3bd0f0503084f215abeb054e81a8d Mon Sep 17 00:00:00 2001 From: Jonah Gray Date: Sat, 11 Jul 2026 17:26:41 -0700 Subject: [PATCH 2/2] evidence(OMN-14397): bind OCC companion commit Refs OMN-14397 --- .../dod-occ-self-commit/command.yaml | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 drift/dod_receipts/OMN-14397/dod-occ-self-commit/command.yaml diff --git a/drift/dod_receipts/OMN-14397/dod-occ-self-commit/command.yaml b/drift/dod_receipts/OMN-14397/dod-occ-self-commit/command.yaml new file mode 100644 index 00000000000..9d0e42e04d0 --- /dev/null +++ b/drift/dod_receipts/OMN-14397/dod-occ-self-commit/command.yaml @@ -0,0 +1,23 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-14397" +evidence_item_id: "dod-occ-self-commit" +check_type: "command" +check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-14397/dod-occ-self-commit/command.yaml && grep -q 'jonah/omn-14397-occ-pr2265' + drift/dod_receipts/OMN-14397/dod-occ-self-commit/command.yaml +status: PASS +run_timestamp: "2026-07-12T00:21:58Z" +commit_sha: "90c6cbffeef2b043cdad71929caa7a582609ce10" +runner: "fix-14397" +verifier: "verify-14397" +pr_number: 2265 +probe_command: "git rev-parse HEAD" +probe_stdout: | + 90c6cbffeef2b043cdad71929caa7a582609ce10 +actual_output: >- + PASS: the first OMN-14397 OCC evidence commit carries the central contract plus product/deploy PASS + receipts for omnibase_infra#2265 head 3e5e86d890cc624860906f0fd32fdf5e23589084. +exit_code: 0 +branch: "jonah/omn-14397-occ-pr2265" +contract_sha256: "sha256:f669deb201ecbf62af35e29cf1f04268f07da36de0bf65c882a3a206b1ce0fc7"