Repository navigation
evidence(OMN-15391): retire 14 narrative-only evidence checks across 11 OCC contracts via append-only supersession - #5481
Conversation
…end-only supersession 14 dod_evidence items across 11 OCC contracts carried a description that narrates a product proof their command cannot produce: every one of them ran `uv run pytest tests/test_evidence_admissibility.py -q`, which node_dod_verify resolves into the OCC checkout and which runs OCC's own OMN-15309 admissibility-predicate suite (76 tests, ~0.1s). It passes identically whether or not the fact it is filed under is true. Repaired with the sanctioned append-only idiom (#4528, `evidence_artifact: supersedes_dod_evidence:<id>`): originals are preserved byte-for-byte (0 deletions in contracts/), each superseded by a new item whose check binds the actual product fact at the merged commit, with a RED control at the merge commit's first parent where one applies. All 26 new product checks were EXECUTED (rc=0) and classify ADMISSIBLE under both the LIVE_PROBE and LIVE_PROBE|EXECUTED_HERMETIC vocabularies; falsifiability proven by mutation (marker, ref, and scope-list mutations each go RED). Collateral (required to land): the 9 pre-existing OMN-15382 Rule B per-item PR-binding violations inside the touched contracts are repaired by the same idiom and removed from .onex_ratchets/omn_15382_rule_b_baseline.yaml — the shrink-only direction the ratchet documents. Contract repair only. Ticket flips wait on OMN-15390 (node_dod_verify has zero contract-entry supersedes_dod_evidence handling, so the retired originals still execute in its tally). Refs: OMN-15391, OMN-15390, OMN-15382, OMN-15376, OMN-15309
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 21 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (16)
Comment |
…flight eligibility) occ-preflight/eligibility failed closed with reason=missing_contract, missing_contracts=["OMN-15391"], and the Receipt Gate failed for the same reason: this PR's own ticket had no contract in the pinned OCC evidence. The self-companion guard (OMN-15334) correctly suppresses autobind for OCC PRs, so the contract is authored here. Its dod_evidence carries only PUBLIC-repo checks (omnibase_infra#2537, omniclaude#1961, omnimarket#1944), each executed rc=0 and ADMISSIBLE under both predicate vocabularies, with an absence control at the merge commit's first parent. The private-repo omninode_infra checks are deliberately NOT restated here: they 404 under the compliance runner's repo-scoped github.token, and a check that cannot evaluate on the runner executing this contract would report RED for an authorization reason rather than a product one. That limit is stated in the contract itself. Refs: OMN-15391
ce7beb6 to
cd48d4e
Compare
1 participant
What this is (OMN-15391)
OMN-15391 measured 29
dod_evidencechecks across 13 OCC contracts whose description narrates aproof their command cannot produce. Every one of them carries the byte-identical check_value
uv run pytest tests/test_evidence_admissibility.py -q.node_dod_verify'sEvidenceCollector._infer_occ_cwdresolves that command into the OCC checkout, where it runs OCC'sown OMN-15309 admissibility-predicate suite (76 tests, ~0.1s, no database, no product repo). It
is EXECUTED, FALSIFIABLE and OUTSIDE-ITS-OWN-DIFF, so it classifies ADMISSIBLE and passes every gate
— while proving nothing about the ticket it is filed under.
This PR is the contract repair only, by the sanctioned append-only supersession idiom (#4528,
evidence_artifact: supersedes_dod_evidence:<id>). No original entry is rewritten or deleted:git diff origin/dev -- contracts/is 483 insertions / 0 deletions (the only 9 deleted lines inthe whole diff are the shrink-only ratchet entries described below).
14 of the 29 items are retired here, across 11 contracts. The remaining 15 are enumerated in
"Deferred, precisely" below — they are not silently truncated.
Dependency: this does NOT flip any ticket (OMN-15390)
node_dod_verifyhas zero contract-entrysupersedes_dod_evidencehandling (receipt-filesupersession is a different surface; measured by the peer lane on the OMN-14968 re-run, 16/22). Until
OMN-15390 lands, a retired original still executes and still counts in dod_verify's tally, so no
Done flip can rest on this PR. OCC's own gates (
contract_compliance_check._superseded_dod_ids,lint_contract_check_values._superseded_dod_ids) honour the idiom today, which is why the retirementis real for the CI surfaces and pending for the runner.
Admissibility bar met, per item
Every superseding check was authored to the OMN-14505/OMN-15309 predicate and then proven by
execution, not by argument:
the spec, once re-parsed from the committed YAML so the check that ran is the check that shipped).
→ rc=1; pointing an absence-control at the merge commit instead of its first parent → rc=1;
dropping one file from a pinned PR file-scope list → rc=1.
drift/dod_receipts/,$CONTRACT_REPO_DIR, or acontracts/OMN-*.yaml.classify_evidence_itemreturns ADMISSIBLE for all 26 under both vocabularies(
LIVE_PROBE_COMMANDSandLIVE_PROBE_COMMANDS | EXECUTED_HERMETIC_COMMANDS).Where a claim could be bound to the merged commit and its first parent, both are carried: the pair
is fix-discriminating (revert the product change and the GREEN leg goes RED; leave it and the
absence leg goes RED).
Per-contract table — item → superseding command → executed result
RAW=-H 'Accept: application/vnd.github.raw', repo prefixrepos/OmniNode-ai/elided)contracts/OMN-14979.yamldod-occ-evidence-admissibility-validatordod-14979-infra746-bucket-rb15391gh api RAW 'omninode_infra/contents/aws/cluster-dev/push_validation_bundles_s3.tf?ref=ba51bcd33cd59affd02d8458efcce741d8abc839' | grep -q 'push_validation_bundle_reader'contracts/OMN-14979.yamlgh api RAW 'omninode_infra/contents/aws/cluster-dev/push_validation_bundles_s3.tf?ref=564e5dba61f396c1be2bbc26949be8e7aba85fb7' | grep -c 'push_validation_bundle_reader' | grep -qx 0contracts/OMN-14980.yamldod-occ-evidence-admissibility-validatordod-14980-infra751-writer-rb15391gh api RAW 'omninode_infra/contents/aws/cluster-dev/push_validation_bundles_s3.tf?ref=ae400c5cd21b21fa9f3e962a2229dd7abf2f10d6' | grep -q 'push_validation_bundle_writer'contracts/OMN-14980.yamlgh api RAW 'omninode_infra/contents/aws/cluster-dev/push_validation_bundles_s3.tf?ref=9e2fee7cfade59442404d7542d868875f7b40af8' | grep -c 'push_validation_bundle_writer' | grep -qx 0contracts/OMN-15299.yamldod-occ-evidence-admissibility-validatordod-15299-infra750-plangate-rb15391gh api RAW 'omninode_infra/contents/.github/workflows/terraform-plan.yml?ref=9e2fee7cfade59442404d7542d868875f7b40af8' | grep -q 'Assert the matrix root actually contains terraform'contracts/OMN-15299.yamlgh api RAW 'omninode_infra/contents/.github/workflows/terraform-plan.yml?ref=a9ca9f4ab6403a76266bad681f38f17ad2917eb1' | grep -c 'Assert the matrix root actually contains terraform' | grep -qx 0contracts/OMN-15362.yamldod-occ-evidence-admissibility-validatordod-15362-omniclaude1961-stamp-rb15391gh api RAW 'omniclaude/contents/.github/workflows/verifier-stamp-reusable.yml?ref=7009244192111177d172825bb8374308797a0413' | grep -q 'name: Verifier Stamp (reusable)'contracts/OMN-15362.yamlgh api RAW 'omniclaude/contents/.github/workflows/verifier-stamp-reusable.yml?ref=5703f123fe272a1214cca50d0fdd66e34180ed14' | grep -c 'name: Verifier Stamp (reusable)' | grep -qx 0contracts/OMN-15365.yamldod-occ-evidence-admissibility-validatordod-15365-infra747-fenced-rb15391gh api RAW 'omninode_infra/contents/docker/onex-api/workflow_contracts.py?ref=2af36af0fbd3e1c631495ea46c69b327081c7b2a' | grep -q 'declared but fenced'contracts/OMN-15365.yamlgh api RAW 'omninode_infra/contents/docker/onex-api/workflow_contracts.py?ref=ba51bcd33cd59affd02d8458efcce741d8abc839' | grep -c 'declared but fenced' | grep -qx 0contracts/OMN-15366.yamlomn-15366-admissibility-engine-still-greendod-15366-infra749-digest-rb15391gh api RAW 'omninode_infra/contents/k8s/onex-dev/runtime/kustomization.yaml?ref=a9ca9f4ab6403a76266bad681f38f17ad2917eb1' | grep -q 'sha256:48673cb7af04bc010b04eece5c5f6c8c71bbd5e004e99936fcec3508d95287b7'contracts/OMN-15366.yamlgh api RAW 'omninode_infra/contents/k8s/onex-dev/runtime/kustomization.yaml?ref=93ed78dd496d6149fedddfcc4468df06c317a18a' | grep -c 'sha256:48673cb7af04bc010b04eece5c5f6c8c71bbd5e004e99936fcec3508d95287b7' | grep -qx 0contracts/OMN-15370.yamldod-occ-evidence-admissibility-validatordod-15370-infra748-devhost-rb15391gh api RAW 'omninode_infra/contents/k8s/onex-dev/omniweb/deployment.yaml?ref=93ed78dd496d6149fedddfcc4468df06c317a18a' | grep -q 'https://dev.api.omninode.ai'contracts/OMN-15370.yamlgh api RAW 'omninode_infra/contents/k8s/onex-dev/omniweb/deployment.yaml?ref=2af36af0fbd3e1c631495ea46c69b327081c7b2a' | grep -c 'https://dev.api.omninode.ai' | grep -qx 0contracts/OMN-15375.yamldod-occ-evidence-admissibility-validatordod-15375-infra752-noderole-rb15391gh api RAW 'omninode_infra/contents/aws/cluster-dev/push_validation_bundles_s3.tf?ref=75632308916fb4b759d2a5bb0f1307379986995f' | grep -q 'CORRECTED UNDER OMN-15375'contracts/OMN-15375.yamlgh api RAW 'omninode_infra/contents/aws/cluster-dev/push_validation_bundles_s3.tf?ref=ae400c5cd21b21fa9f3e962a2229dd7abf2f10d6' | grep -c 'CORRECTED UNDER OMN-15375' | grep -qx 0contracts/OMN-15376.yamldod-occ-evidence-admissibility-validatordod-15376-infra2537-baselines-rb15391gh api RAW 'omnibase_infra/contents/docker/migrations/forward/nodes/node_projection_baselines/0001_create_baselines_tables.sql?ref=78b8731103a019ea90eee3164b53e882a064fe34' | grep -q 'ALTER TABLE baselines_snapshots ADD COLUMN IF NOT EXISTS snapshot_id'contracts/OMN-15376.yamlgh api RAW 'omnibase_infra/contents/docker/migrations/forward/nodes/node_projection_baselines/0001_create_baselines_tables.sql?ref=11b460db23d40dd2ca7704d0c3e9fd89851af60c' | grep -c 'ALTER TABLE baselines_snapshots ADD COLUMN IF NOT EXISTS snapshot_id' | grep -qx 0contracts/OMN-15353.yamldod-infra760-ci-hosted-token-supersessiondod-15353-infra760-scope-rb15391gh api omninode_infra/pulls/760/files --paginate --jq '.[].filename' | sort | tr '\n' ',' | grep -qx 'docs/POST_DEPLOY_VERIFICATION.md,docs/SHIPPING_A_CHANGE.md,scripts/post-deploy-verify.sh,tests/scripts/test_post_deploy_verify_dashboard_auth_probe.py,'contracts/OMN-15353.yamldod-omn15353-redgreen-hosted-token-supersessiondod-15353-infra760-redgreen-rb15391gh api RAW 'omninode_infra/contents/tests/scripts/test_post_deploy_verify_dashboard_auth_probe.py?ref=c5e61311276829c7cf4fe5bb057713f6a35545bc' | grep -q 'def test_broken_shape_fails_closed'contracts/OMN-15353.yamlgh api RAW 'omninode_infra/contents/tests/scripts/test_post_deploy_verify_dashboard_auth_probe.py?ref=aa72b333d6df90bf2b576cd70e2f163c5eedf7f4' | grep -c 'def test_broken_shape_fails_closed' | grep -qx 0contracts/OMN-15383.yamldod-infra758-head-hosted-token-supersessiondod-15383-infra758-guard-rb15391gh api RAW 'omninode_infra/contents/scripts/repair-managed-postgres-ownership.sh?ref=3246e28ee14af41af8b844ddfa3b254e094d890b' | grep -q 'INCLUDE_PEER_OWNED'contracts/OMN-15383.yamlgh api RAW 'omninode_infra/contents/scripts/repair-managed-postgres-ownership.sh?ref=a0639ce48e12b0c0be069d4053299e1b29e1121e' | grep -c 'INCLUDE_PEER_OWNED' | grep -qx 0contracts/OMN-15383.yamldod-infra758-scope-hosted-token-supersessiondod-15383-infra758-scope-rb15391gh api omninode_infra/pulls/758/files --paginate --jq '.[].filename' | sort | tr '\n' ',' | grep -qx 'docs/rds-postgres-cutover.md,k8s/migrations/omnibase-infra-migrate.yaml,k8s/migrations/omniweb-migrate.yaml,scripts/repair-managed-postgres-ownership.sh,tests/scripts/test_omniweb_migration_schema_privilege.py,'contracts/OMN-15383.yamldod-omn-15383-red-green-hosted-token-supersessiondod-15383-infra758-redgreen-rb15391gh api RAW 'omninode_infra/contents/tests/scripts/test_omniweb_migration_schema_privilege.py?ref=3246e28ee14af41af8b844ddfa3b254e094d890b' | grep -q 'def test_the_fail_open_probe_is_gone'contracts/OMN-15383.yamlgh api RAW 'omninode_infra/contents/tests/scripts/test_omniweb_migration_schema_privilege.py?ref=a0639ce48e12b0c0be069d4053299e1b29e1121e' | grep -c 'def test_the_fail_open_probe_is_gone' | grep -qx 0contracts/OMN-14979.yamlocc-self-bind-pr-5408occ-self-bind-5408-lit-rb15391gh pr view 5408 --repo OmniNode-ai/onex_change_control --json number --jq '.number == 5408' | grep -qx trueCollateral repair (required to land, same idiom)
Touching these 11 contracts made pre-commit's
lint-contract-check-valuesfire on 9 pre-existingOMN-15382 Rule B (per-item PR-binding) violations already inside them — items whose id pins a PR
number while their check_value is the bare
${PR_NUMBER}placeholder the runner pre-substitutes withwhatever PR it is evaluating. They are repaired by the same append-only idiom and removed from
.onex_ratchets/omn_15382_rule_b_baseline.yaml— the shrink direction that ratchet documents("update the baseline file to match (shrink it) when you rebind a contract"). Baseline set-equality
holds:
test_rule_a/b_corpus_matches_frozen_baseline_exactlypass.contracts/OMN-14979.yamlocc-self-bind-pr-5408occ-self-bind-5408-lit-rb15391gh pr view 5408 --repo OmniNode-ai/onex_change_control --json number --jq '.number == 5408' | grep -qx truecontracts/OMN-14980.yamlocc-self-bind-pr-5415occ-self-bind-5415-lit-rb15391gh pr view 5415 --repo OmniNode-ai/onex_change_control --json number --jq '.number == 5415' | grep -qx truecontracts/OMN-15299.yamlocc-self-bind-pr-5414occ-self-bind-5414-lit-rb15391gh pr view 5414 --repo OmniNode-ai/onex_change_control --json number --jq '.number == 5414' | grep -qx truecontracts/OMN-15362.yamlocc-self-bind-pr-5473occ-self-bind-5473-lit-rb15391gh pr view 5473 --repo OmniNode-ai/onex_change_control --json number --jq '.number == 5473' | grep -qx truecontracts/OMN-15365.yamlocc-self-bind-pr-5407occ-self-bind-5407-lit-rb15391gh pr view 5407 --repo OmniNode-ai/onex_change_control --json number --jq '.number == 5407' | grep -qx truecontracts/OMN-15366.yamlocc-self-bind-pr-5413occ-self-bind-5413-lit-rb15391gh pr view 5413 --repo OmniNode-ai/onex_change_control --json number --jq '.number == 5413' | grep -qx truecontracts/OMN-15370.yamlocc-self-bind-pr-5411occ-self-bind-5411-lit-rb15391gh pr view 5411 --repo OmniNode-ai/onex_change_control --json number --jq '.number == 5411' | grep -qx truecontracts/OMN-15375.yamlocc-self-bind-pr-5418occ-self-bind-5418-lit-rb15391gh pr view 5418 --repo OmniNode-ai/onex_change_control --json number --jq '.number == 5418' | grep -qx truecontracts/OMN-14979.yamldod-OmniNode-ai-omnimarket-pr-1944-cidod-14979-market1944-scope-rb15391gh api omnimarket/pulls/1944/files --paginate --jq '.[].filename' | grep -qx 'src/omnimarket/nodes/node_push_validation_effect/models/model_push_validation_request.py'Honest limits, stated rather than hidden
OmniNode-ai/omninode_infra, which is private. These checks were executed here with across-repo-capable token (rc=0). Under OCC's hosted Contract Compliance job, whose
GH_TOKENisthe repo-scoped
github.token, the same endpoints return HTTP 404 and the checks go RED. That REDis fail-closed "cannot evaluate on this runner" — not a false claim about the product — and it
is deliberately preferred to the surrogate's vacuous GREEN. This reverses the note left in
contracts/OMN-15366.yaml("Do not re-add that form"), which removed the only real probes to keepa check green; that removal is the exact defect OMN-15391 names. The runner-side fix (export a
cross-repo token to the compliance step, as the same workflow already does for its checkout step)
is not made here — it would put an unverifiable secret on the critical path of every OCC
contract-compliance run. Each affected entry states this limit in its own description.
OMN-15383 red/green items), the replacement binds the discriminating test's presence in the
merged product tree and says so. No OCC contract check can re-execute a product repo's test
suite; that run is the product PR's own CI.
occ-self-bind-*-lit-rb15391stamps are stamps. They are Rule-B-clean literal bindings,not product proof: admissible under the runner vocabulary, not under
LIVE_PROBE_COMMANDS, andthey do not count toward the substance floor. Their descriptions say this outright.
Deferred, precisely (15 of the 29 + the corpus drift)
contracts/OMN-15382.yaml(dod-occ-evidence-admissibility-validator)fable-finish-0729claimed OMN-15382 at 13:02Z and landed OCC#5458 on this file; excluded to avoid a competing companion.contracts/OMN-14968.yaml(dod-occ-evidence-admissibility-validator)contracts/OMN-14968.yaml); a dod_verify re-run for OMN-14968 was in flight at claim time.contracts/OMN-15376.yamldod-omn-15376-execution-proof,-static-gate,-vendor-parityeach already carry a supersession. The 4th, missed there, is repaired here.contracts/OMN-14974.yamlomninode_infraclaims, so repairing them re-raises limit (1) on the most PR-active contract in OCC. Repairing a moving target one PR at a time is churn; this belongs with the OMN-15391 mechanism work (ticket AC2/AC3: surrogate denylist + shrink-only ratchet), not with a hand-authored batch.Live corpus drift for the record (scan at
origin/dev0f61da4, 2026-07-29): 97 occurrences ofthe surrogate command across 14 contracts, up from the ticket's 29 across 13 — 78 of them in
contracts/OMN-14974.yaml, pluscontracts/OMN-15362.yaml(1) which post-dates the ticket and isrepaired here. After this PR: 0 unsuperseded surrogate items remain in the 11 contracts it touches.
Gates (run on
.200/stickybeatz-studio, per rule 11a)Patch-transfer with sha256 verification: all 12 changed files verified byte-identical on
.200(
shasum -a 256 -c→ 12/12 OK) before any gate ran there; the branch was pushed from.200.uv run pre-commit run --files <12 changed files>→ all applicable hooks Passed (yamlfmt,validate-contract-yaml,
lint-contract-check-values, substance floor, DoD-authoring hygiene,dod-evidence-required, normalization-symmetry, pin-parity).
uv run pytest tests/unit/scripts/test_lint_contract_check_values_corpus_baseline.py tests/unit/scripts/test_lint_contract_check_values.py tests/test_evidence_admissibility.py tests/test_evidence_admissibility_parity.py tests/test_dod_evidence_schema.py tests/test_check_contract_substance_floor.py tests/test_check_contract_dod_authoring.py tests/test_contract_compliance_check.py -q→ 340 passed.Ticket
OMN-15391 (contract repair scope only). Related: OMN-15390 (runner supersession — the flip
dependency), OMN-15382 (Rule A/B lints + baselines this PR shrinks), OMN-15376 / OMN-15366 /
OMN-15353 / OMN-15383 (contracts repaired), OMN-15309 (the predicate every new check was classified
against), OMN-14505 (the source predicate).
dod_evidencefor OMN-15391 itself is the executed-and-recorded table above: 26 product checks +9 collateral checks, every one run with a real exit code, falsifiability proven by mutation.
No ticket is flipped by this PR.
Addendum — commit 2 (
contracts/OMN-15391.yaml)The first push failed exactly two checks, both fail-closed and both for the same root cause:
occ-preflight / eligibility→{"reason":"missing_contract","missing_contracts":["OMN-15391"]}, andverify / verify(Receipt Gate) downstream of it. This PR's own ticket had no contract in the pinnedOCC evidence, and the OMN-15334 self-companion guard correctly suppresses autobind for OCC PRs, so
the contract is authored in-PR (the same pattern OCC#5458 used for
contracts/OMN-15382.yaml).Its
dod_evidencecarries only public-repo checks — omnibase_infra#2537, omniclaude#1961,omnimarket#1944 — each executed rc=0, ADMISSIBLE under both vocabularies, each with an absence
control at the merge commit's first parent. The private-repo
omninode_infrachecks are deliberatelynot restated in this contract: the compliance runner executing it holds a repo-scoped token and would
report RED for an authorization reason rather than a product one. That limit is written into the
contract itself, not just here.
Self-authorship is a real limit and is named rather than hidden: the same lane authored the repair
and its contract. What that contract asserts, though, is not its own work — every check reads a
product repository at a pinned merge commit this lane did not write.