Repository navigation
evidence(OMN-14135): OCC companion for omnibase_infra#2285 — handler dispatch-entrypoint gate - #4074
Conversation
…dispatch-entrypoint gate Evidence-Source: OmniNode-ai/omnibase_infra#2285 Evidence-Ticket: OMN-14135 Companion evidence for the fail-closed wiring-time guard OMN-14135 asks for. A handler can be contract-declared, auto-wired, boot clean and GREEN in CI while exposing NO dispatch entrypoint: _make_dispatch_callback resolves handle_async then handle, and finding neither binds _missing_handle, which raises on the FIRST real dispatch. Registration and routing do NOT imply executability, which is why the OMN-14488 route-coverage gates are structurally blind to it and why contract tests (which prove INGRESS, never DISPATCH) never saw it. HandlerA2ATask shipped this way; a census found 40 of 153 distinct contract-declared handlers have no entrypoint. Four product-observing evidence items, each pinned to PR head 29c92ef2 and each executed before being recorded: - runtime-predicate: the validator reuses the EXACT auto-wiring predicate (describes the runtime, not itself) - enforcement-ci-precommit: same validator wired as a required CI step AND a pre-commit hook (enforcement, not detection) - red-exists-but-wrong: HandlerA2ATask is NOT baselined and a test forbids ever baselining it; the ratchet also fails a FIXED handler left listed, so it cannot rot - non-vacuity: a collapsed scan fails closed, the predicate is proven to discriminate, and the test drives the SHIPPED validator rather than a re-implemented copy No check_value self-polls the companion PR; every one reads product content at the pinned product SHA.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 4 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (7)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…ket_mismatch fix) occ-preflight requires at least one PASS receipt per ticket to bind to the OCC PR under check (or one of its commit SHAs). All five receipts bound to product PR #2285, so eligibility failed with reason=pr_ticket_mismatch. The self-bind item is the one that is supposed to carry the OCC-side binding; the four product-observing items correctly stay bound to #2285 and keep reading product content at the pinned product SHA.
1 participant
Evidence-Source: OmniNode-ai/omnibase_infra#2285
Evidence-Ticket: OMN-14135
OCC evidence companion for omnibase_infra#2285 (OMN-14135).
What the product PR fixes
A handler can be contract-declared, auto-wired, instantiated, boot clean, and GREEN in CI — and still have NO dispatch entrypoint at all.
_make_dispatch_callbackresolveshandle_async, thenhandle; finding neither it binds_missing_handle, which raisesModelOnexErroron the first real dispatch.Registration and routing do NOT imply executability. The dispatcher still registers and the payload still routes to it, so contract validation, auto-wiring, boot, and the dispatch-selection oracle all stay green. That is exactly why the OMN-14488 route-coverage gates are structurally blind here (a
_missing_handle-bound dispatcher registers and routes normally, and that gate's fake handler has ahandle), and why contract tests never saw it — they prove INGRESS, never DISPATCH.HandlerA2ATaskshipped this way (OMN-14489/#2280, merged). It is not alone: a census found 40 of 153 distinct contract-declared handlers have no entrypoint.#2285 ships the fail-closed wiring-time guard the ticket asks for, wired as both a required CI step and a pre-commit hook.
Evidence items (4 product-observing + 1 self-bind)
All four product-observing
check_values read product content at the pinned product head29c92ef2viagh api .../contents/...?ref=<sha>. None self-polls this companion PR — nogh pr checks $PR_NUMBER. Each was executed before being recorded (two were found wrong on first run and corrected: one grep did not survive a ruff line-wrap, and one! grepwas matching the baseline's own header comment rather than a data row).dod-verify-2285-runtime-predicatecallable(handle_async) or callable(handle), same resolution order as_make_dispatch_callback) and names_missing_handle— it tests the DISPATCH BIND, so it describes the runtime rather than itself.dod-verify-2285-enforcement-ci-precommitci.ymllint job and as pre-commit hookhandler-dispatch-entrypoint. Enforcement, not detection. Deliberately not pytest-only — the change-aware selector could narrow a pytest gate away on the very PR that adds a bad handler.dod-verify-2285-red-exists-but-wrongHandlerA2ATaskhas no data row in the baseline, andtest_a2a_task_is_not_baselinedforbids ever granting it one; the ratchet additionally fails a FIXED handler left listed (stale = baseline - live), so the list can never rot.dod-verify-2285-non-vacuityMIN_EXPECTED_DECLARED_HANDLERS); the predicate is proven to discriminate (asubmit()-only class is rejected, def-Bhandle/handle_asyncaccepted); and the pytest gate imports the shipped validator and drives itsmain()rather than re-implementing the scan.dod-occ-self-commitRED proofs recorded in the receipts
Run against the shipped validator (
python -m omnibase_infra.validators.handler_dispatch_entrypoint), the exact command CI and pre-commit invoke — not a surrogate:HandlerA2ATaskreverted tosubmit()/watch()-only → exit 1, names the handlerHandlerLedgerProjectionde-baselined, source untouched → exit 1 under both its contractsThis is RED against EXISTS-but-WRONG, not against absence. No assertion in either PR is green because the system is broken — the gap is never encoded as a passing check.
Local validation
validate-yaml contracts/OMN-14135.yaml→ OKcheck_receipt_hardening.py→ 0 violations (all 5 receipts carrycontract_entry_sha256)pre-commitclean on all companion files