evidence(OMN-15335): OCC companion for OmniNode-ai/omninode_infra#740

[jonahgabriel]

Deterministic OCC evidence companion for OmniNode-ai/omninode_infra#740, authored by node_occ_companion_effect (RSD-3, OMN-14622) from the node_occ_companion_compute plan. Every byte is a pure function of the compute plan (attestation-oracle reproducible).

Summary by CodeRabbit

• New Features

  • Added automated evidence tracking for the self-bind workflow.
  • Added verification records linking the change to associated pull requests.
  • Added successful command-check receipts confirming pull request state and branch details.

• Documentation

  • Expanded contract evidence with generated validation checks and execution metadata.

[coderabbitai]

📝 Walkthrough

Walkthrough

The OMN-15335 contract adds an OCC self-bind check for PR 5376. New command receipts record successful verification for PR 740 and supersede earlier receipts with replacement probe metadata and contract hashes.

Changes

Self-bind evidence

Layer / File(s)	Summary
Contract and initial self-bind receipt contracts/OMN-15335.yaml, drift/dod_receipts/OMN-15335/occ-self-bind-pr-5376/command.yaml	Adds the occ-self-bind-pr-5376 command check and records its successful probe of PR 5376.
PR 740 receipt rebinding drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-740/command.yaml, drift/dod_receipts/OMN-15335/.../command.supersede.740.yaml	Adds the PR 740 command receipt and superseding receipts with replacement probe results, execution metadata, branch details, and contract hashes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• OmniNode-ai/onex_change_control#3848: Adds superseding command receipts that rebind verification and contract hashes through replacement payloads.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding an OCC companion evidence set for OmniNode-ai/omninode_infra#740.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch auto/omninode-ai-omninode_infra-pr-740-occ-autobind

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-740/command.yaml`:
- Around line 8-9: Add the authoritative contract_entry_sha256 field to this
receipt alongside contract_sha256, using the appropriate contract-entry hash
value while preserving the existing status and legacy hash fields.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 423e8686-adf3-468c-a5ca-7ba9790b6716

📥 Commits

Reviewing files that changed from the base of the PR and between 74f89d5 and f2befde.

📒 Files selected for processing (6)

• contracts/OMN-15335.yaml
• drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-738-ci/command.supersede.740.yaml
• drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-738/command.supersede.740.yaml
• drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-740/command.yaml
• drift/dod_receipts/OMN-15335/occ-self-bind-pr-5364/command.supersede.740.yaml
• drift/dod_receipts/OMN-15335/occ-self-bind-pr-5376/command.yaml

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== target file ==\n'
git ls-files 'drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-740/*'
printf '\n== target file contents ==\n'
cat -n drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-740/command.yaml

printf '\n== nearby receipt files ==\n'
find drift/dod_receipts -maxdepth 4 -type f | sed 's#^\./##' | sort | tail -n 30

printf '\n== search for contract_entry_sha256 and receipt schema ==\n'
rg -n --hidden --glob '*.yaml' --glob '*.yml' 'contract_entry_sha256|contract_sha256|ModelDodReceipt|dod_receipts' drift .github . || true

Repository: OmniNode-ai/onex_change_control

Length of output: 50388

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '== target receipt ==\n'
cat -n drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-740/command.yaml

printf '\n== hardening validator references ==\n'
rg -n --hidden -g '!*node_modules*' -g '!*dist*' -g '!*build*' \
  'check_receipt_hardening|contract_entry_sha256|ModelDodReceipt|dod_receipts/.*/command\.yaml|run_timestamp' \
  scripts drift .github contracts . || true

printf '\n== candidate validator files ==\n'
fd -a 'check_receipt_hardening.py|validator_receipt_honesty.py|dod_receipt' scripts drift .github . || true

Repository: OmniNode-ai/onex_change_control

Length of output: 50388

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== target receipt =='
cat -n drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-740/command.yaml

echo
echo '== matching validator and docs =='
rg -n --hidden --glob 'scripts/**' --glob 'drift/**' --glob '.github/**' \
  'check_receipt_hardening|contract_entry_sha256|run_timestamp|ModelDodReceipt|dod_receipts/.*/\*|dod_receipts/.*/command\.yaml' \
  scripts drift .github 2>/dev/null | head -n 200

Repository: OmniNode-ai/onex_change_control

Length of output: 26736

---

Add contract_entry_sha256 to this receipt.

This July 28, 2026 receipt is in the post-2026-06-12 format, so contract_sha256 alone is the legacy binding; new receipts need the authoritative contract_entry_sha256 field.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-740/command.yaml`
around lines 8 - 9, Add the authoritative contract_entry_sha256 field to this
receipt alongside contract_sha256, using the appropriate contract-entry hash
value while preserving the existing status and legacy hash fields.

Sources: Coding guidelines, Learnings