Repository navigation
chore(OMN-9829): backfill dod_evidence on 20 contracts - #452
Closed
jonahgabriel wants to merge 1 commit into
Closed
jonahgabriel wants to merge 1 commit into
jonahgabriel wants to merge 1 commit into
Conversation
…rom evidence_requirements)
Audited all 4538 contract YAML files under onex_change_control/contracts/
against ModelTicketContract canonical shape:
* 4517 / 4538 already validate clean (have both evidence_requirements
AND dod_evidence side-by-side).
* 20 / 4538 (OMN-9829, OMN-9831..OMN-9850 except OMN-9837) had
evidence_requirements only and lacked dod_evidence. These passed
validate-yaml (because dod_evidence has default_factory=list) but
were SKIPPED by evidence_collector.collect() and produced no DoD
verification. Authored by a truncated plan_to_tickets run.
* 1 / 4538 (dogfood_scorecard.yaml) was a Bucket B schema declaration
mis-co-located with ticket DoD contracts. Moved to schemas/.
The "legacy kind-only shape" earlier plans presupposed does not exist
in this corpus. See scripts/migrate_dod_contracts.py for the audit
findings and synthesis logic. The 2026-04-27 plan and design docs in
docs/plans/2026-04-27-ticket-dod-contract-layering*.md are now marked
SUPERSEDED.
Patched ticket IDs:
OMN-9829, OMN-9831, OMN-9832, OMN-9833, OMN-9834, OMN-9835, OMN-9836,
OMN-9838, OMN-9839, OMN-9840, OMN-9841, OMN-9842, OMN-9843, OMN-9844,
OMN-9845, OMN-9846, OMN-9847, OMN-9848, OMN-9849, OMN-9850.
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (21)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
7 of 9 tasks
Contributor
Author
|
Superseded by #458 — contracts regenerated there with ticket-type-aware dod_evidence. |
auto-merge was automatically disabled
April 27, 2026 20:38
Pull request was closed
jonahgabriel
added a commit
that referenced
this pull request
May 23, 2026
, #452 (#1455) * contracts(OMN-11854): add OCC evidence for omninode_infra PRs #449, #451, #452 - contracts/OMN-11770.yaml — CI gate wiring (PR #449) - contracts/OMN-11854.yaml — prod deploy tag fix (PR #451) - contracts/OMN-10278.yaml — adds dod-omninode-infra-pr-452 for tag-based TF discovery (PR #452) - Receipt files for all three PRs * contracts(OMN-11854): update self-bound receipts with OCC PR #1455 number * contracts(OMN-11854): add missing commit_sha + contract_sha256 to self-bound receipts * contracts(OMN-11854): update OMN-10278 receipt from pr-452 to pr-456 (renamed branch) * contracts(OMN-11854): add PR #456 evidence to OMN-11854 contract Add dod-omninode-infra-pr-456 receipt and evidence item to OMN-11854 contract for omninode_infra PR #456 (tag-based network discovery). Update dod-occ-pr receipt with new contract_sha256. * contracts(OMN-11854): rename PR evidence from #456 to #457 (branch identity fix) PR #456 had wrong branch name (omn-10278 prefix); closed in favor of #457 with correct jonah/omn-11854-* branch for identity binding. Update contract, receipt dir, and contract_sha256 throughout. * contracts(OMN-11854): rename PR #451→#458 evidence (branch identity fix) PR #451 had branch jonah/fix-prod-deploy-tag (no OMN ticket); closed in favor of #458 with jonah/omn-11854-fix-prod-deploy-tag. Update contract, receipt dir, and contract_sha256 throughout. * contracts(OMN-11854): fix yamlfmt + unquote ticket_id in receipts yamlfmt reformats probe_stdout literal blocks; strip YAML quotes from ticket_id fields so the contract grep checks (^ticket_id: OMN-XXXX$) match the actual file content. * contracts(OMN-11854): apply yamlfmt to all branch-modified YAML files * contracts(OMN-11854): update contract_sha256 after yamlfmt reformat yamlfmt reformatted OMN-11854.yaml, changing its hash. Update all three OMN-11854 receipts with the new sha256:2848b28f... hash.
andywu42
pushed a commit
to andywu42/onex_change_control
that referenced
this pull request
Jun 10, 2026
…itution, ticket-type-aware migration (OmniNode-ai#458) * feat(OMN-10086): Contract Compliance Check runner — setup-uv, ${PR_NUMBER}/${REPO}/${TICKET_ID} substitution, ticket-type-aware migration PR OmniNode-ai#452 introduced 20 backfill dod_evidence contracts but the new Contract Compliance Check CI gate failed on its own contract because: 1. ``.github/workflows/ci.yml`` ``contract-compliance`` job lacked ``setup-uv`` — every ``uv run`` command in a check_value died with ``sh: 1: uv: not found``. 2. Migration script stamped literal ``gh pr checks`` (no ${PR_NUMBER} placeholder), so the runner had nothing to substitute and gh failed with ``could not determine current branch`` in detached-HEAD CI checkouts. 3. Migration was not ticket-type-aware — process tickets like OMN-9829 ("Bret initiates GitHub repo transfer") got stamped with ``uv run pytest`` even though they have no test surface. Changes ------- * ``.github/workflows/ci.yml`` — add ``./.github/actions/setup-uv`` step to the contract-compliance job; switch the runner invocation to ``uv run python ...`` so the project venv is on PATH. * ``scripts/ci/run_contract_compliance_check.py`` — accept and substitute ``${PR_NUMBER}``, ``${REPO}``, ``${TICKET_ID}`` (in addition to existing ``{pr}``/``{repo}`` braces), AND export them as env vars so authors can reference them in double-quoted shell strings too. Plumb ``ticket_id`` through ``_run_dod_checks`` and ``_run_single_check``. Refactor ``_check_command`` for cyclomatic-complexity compliance: split env building and pre-commit demotion into dedicated helpers. * ``scripts/migrate_dod_contracts.py`` — NEW permanent migration script with ticket-type classifier. Process/governance tickets emit a YAML-validity check + PR-cites-ticket check; code tickets keep ``uv run pytest`` + ``gh pr checks ${PR_NUMBER} --repo ${REPO}``. Also detects and re-migrates contracts carrying the legacy bare ``gh pr checks`` pattern. * ``contracts/OMN-9829..OMN-9850.yaml`` — regenerated with new classifier (all 20 are governance: repo transfer, branch protection, workflow lift, doc edits, public-publication gate, proof-of-life). Supersedes the contract regeneration in PR OmniNode-ai#452. * ``contracts/OMN-10086.yaml`` — contract for this PR. * ``schemas/dogfood_scorecard.yaml`` — moved from ``contracts/`` (carry- over from PR OmniNode-ai#452 to keep ``contracts/`` shape == OMN-*.yaml only). * ``tests/test_contract_compliance_check.py`` — new tests cover the ``${PR_NUMBER}``/${REPO}/${TICKET_ID} pre-substitution path and the unconditional env-var export. Updated the no-gh-in-cmd test for the new behavior (PR_NUMBER/REPO are exported even for non-gh commands; GH_REPO is still gh-gated). * ``tests/test_migrate_dod_contracts.py`` — NEW. 21 unit tests covering classifier, evidence dispatcher, needs_migration detector, file round-trip, and Pydantic-model validity of emitted evidence. * ``tests/integration/cross_repo/test_contract_introspection_parsing.py`` — fix pre-existing mypy ``unused-ignore`` (changed ``import-not-found`` → ``import-untyped``) in the same PR per ``feedback_no_pre_existing_excuse``. Verification ------------ * uv run pytest tests/ -v → 1220 passed, 13 skipped (env-conditional) * uv run mypy src/ tests/ → Success: no issues found in 289 source files * uv run ruff check src/ tests/ scripts/ → All checks passed * pre-commit run --all-files → all hooks pass (incl. yamlfmt, ruff, validate-yaml, dod-evidence-required, schema-purity) * uv run validate-yaml contracts/OMN-9829..9850.yaml, contracts/OMN-10086.yaml → 21/21 valid * Local dry-run of the runner against contracts/OMN-9829.yaml: dod-001 PASSes (YAML valid), dod-002 BLOCKs as expected when invoked against a non-existent PR; once landed on a real PR the gh-pr-view check passes. Supersedes OmniNode-ai#452 --------------- PR OmniNode-ai#452 will be closed once this PR's Contract Compliance Check is green. The 20 contracts it introduced are regenerated here with correctly templated dod_evidence appropriate to their ticket class. Related: OMN-10078 (omnimarket-side cwd field), OMN-10046 (dod_verify test_passes), OMN-10049 (Option D shell-prefix workaround), OMN-10061 (pre-commit dod_evidence guard). * fix(OMN-10086): broaden mypy ignore on omnibase_infra import for CI CI runs mypy without omnibase_infra installed (the test skips at runtime when the repo is absent), so the import resolves ``import-not-found`` instead of ``import-untyped`` that local mypy sees. Use multi-code ignore + ``unused-ignore`` so the same line is clean in both environments.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two related cleanups bundled per audit recommendation:
Backfill
dod_evidenceon 20 contracts (OMN-9829..OMN-9850). A truncatedplan_to_ticketsrun authored these contracts withevidence_requirementsonly — nodod_evidenceblock. They passedvalidate-yaml(becausedod_evidencehasdefault_factory=list) but were SKIPPED byevidence_collector.collect()and produced no DoD verification. The migration synthesizesdod_evidenceentries from the existingevidence_requirementsfor each.Move
dogfood_scorecard.yamlout of/contracts/. It was a Bucket B schema declaration mis-co-located with ticket DoD contracts. Moved toschemas/dogfood_scorecard.yaml. Searched for path references; only Python module imports exist (e.g.from onex_change_control.models.model_dogfood_scorecard import ...) — those are unaffected.Audit findings (from
scripts/migrate_dod_contracts.py)Audited all 4538 contract YAML files against
ModelTicketContractcanonical shape:evidence_requirementsANDdod_evidenceblocks present side-by-side.evidence_requirementsonly — patched in this PR.dogfood_scorecard.yaml) was a schema declaration — moved.The "legacy
kind-only shape" earlier plans presupposed does not exist in this corpus. The 2026-04-27 plan and design docs indocs/plans/2026-04-27-ticket-dod-contract-layering*.mdare now marked SUPERSEDED.Patched ticket IDs (20)
OMN-9829, OMN-9831, OMN-9832, OMN-9833, OMN-9834, OMN-9835, OMN-9836, OMN-9838, OMN-9839, OMN-9840, OMN-9841, OMN-9842, OMN-9843, OMN-9844, OMN-9845, OMN-9846, OMN-9847, OMN-9848, OMN-9849, OMN-9850.
DoD evidence
validate-yamlpasses for all 20 patched contracts (existing pre-commit hook ran during commit).dod_evidenceblock present and well-formed (id,description,source: generated,checkswithcheck_type: command).ok=4517 patched=20 skipped=1 error=0(skipped =dogfood_scorecard.yaml).contracts/dogfood_scorecard.yamlexist outside of the migration script's docstring.[skip-receipt-gate: chore migration — synthesizes evidence from existing fields, no behavior change]