Repository navigation
docs(OMN-15535): guard-compatible binding checks for OMN-15535/15490/15493 (executor-compat correction) - #5760
Merged
jonahgabriel merged 2 commits intoJul 31, 2026
Conversation
jonahgabriel
enabled auto-merge (squash)
July 31, 2026 20:20
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 22 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (7)
Comment |
…15493 (ruling 2, executor-compat correction) Appends one supersession dod_evidence item + its receipt to each of the three contracts landed by #5756, replacing a binding check_value that node_dod_verify rejected pre-execution as INVALID_CHECK_VALUE_NOT_A_COMMAND. Root cause: the shape guard tokenizes with shlex.split, which is not $()-aware. The embedded jq program `.state + " " + (.mergeCommit.oid // "none")` closed the outer double quote, so the guard landed on the fragment `" + (.mergeCommit.oid // none)')"`, took its relative-script-path branch on the embedded slash, and returned INVALID without ever executing. A false RED, not a failed proof. Authored append-only, NOT as an in-place edit: merged dod_evidence entries are immutable (validator_occ_append_only) and their receipts pin the entry hash, so an in-place rewrite both trips the append-only gate and staleness-invalidates the receipt binding. Net diff is 144 insertions / 0 deletions; no pre-existing contract entry or receipt is touched. Semantics preserved: each replacement asserts BOTH state MERGED AND the exact merge SHA.
jonahgabriel
force-pushed
the
jonah/omn-15535-b3-guard-compat-binding-checks
branch
from
July 31, 2026 20:39
8ef616e to
46294ad
Compare
jonahgabriel
added a commit
that referenced
this pull request
Jul 31, 2026
… pr_ticket_mismatch repair) Adds the occ-self-bind-pr-5763 stamp both contracts were missing. Without it occ-preflight/eligibility and verify/verify fail with reason=pr_ticket_mismatch: every receipt in this PR binds OCC#5759, none binds #5763, and eligibility is evaluated per-PR not per-ticket-ever. The sibling repair PR #5760 carried the analogous occ-self-bind-pr-5760 and passed. Append-only: no pre-existing contract entry or receipt is modified.
jonahgabriel
added a commit
that referenced
this pull request
Jul 31, 2026
…239 (executor-compat correction) Remediation of the wave-2 OCC DoD-contract lane (OCC #5759). The four binding check_values that lane authored were rejected PRE-EXECUTION by node_dod_verify, so dod_verify returned status=failed on both tickets: OMN-15488 12 verified / 3 failed / 15 total, OMN-15239 9 verified / 1 failed / 10 total. The blocker moved from CONTRACT_MISSING to FAILED; the closeout was NOT unblocked. Root cause (not a flake, not a retry): evidence_collector._invalid_check_value_reason shape-guards a check_value before executing it by tokenizing with shlex.split(posix=True), which is not $()-aware. The embedded jq program `.state + " " + (.mergeCommit.oid // "none")` closed the outer double quote, so the guard judged the fragment `" + (.mergeCommit.oid // none)')"` as the command name, took its relative-script-path branch on the embedded slash, and returned INVALID_CHECK_VALUE_NOT_A_COMMAND without ever running the command. A false RED against a command that exits 0 in a real shell -- but a hard FAIL on the verdict. Fix: append one supersession item per defective binding, leading with a resolvable first token (`test`) and splitting the two-field query into two single-field queries so each --jq filter is a bare path expression with no quote characters. Semantics preserved exactly: BOTH state MERGED AND the exact merge SHA are asserted. Mirrors the merged OCC #5760 precedent for OMN-15535/15490/15493. Append-only, NOT an in-place edit: merged dod_evidence entries are immutable (validator_occ_append_only) and their receipts pin the entry hash. Net diff is 225 insertions / 0 deletions; no pre-existing entry or receipt is touched. Also appended: dod-omn15488-summary-correction-pr239-title, a falsifiable correction of a factual error in OMN-15488.yaml`s summary, which mislabels steel PR #239 as "Amendment 2". Its real title is "fix(OMN-15522): send programming response contract on delegation wire (r4)" and OMN-15535`s contract binds it for the stdout-tail/CLI-diagnostics fix. The SHA 4bae73ea and the "bound under OMN-15535" claim in that summary are correct and unchanged. Recorded as a check rather than PR-body prose so it cannot rot. Proof is the artifact that runs, not a bare shell surrogate. node_dod_verify was executed against these contracts: BEFORE: OMN-15488 failed (12/3/15), OMN-15239 failed (9/1/10) AFTER: OMN-15488 verified 17/17 (superseded 3), OMN-15239 verified 10/10 (superseded 1); exit 0 on both Re-run AFTER the yamlfmt reflow with identical results, and every appended receipt`s contract_entry_sha256 recomputed post-reflow and confirmed matching. Each new check_value was also RED-proven by SHA (or title) substitution: exit 1. Ticket: OMN-15488, OMN-15239
jonahgabriel
added a commit
that referenced
this pull request
Jul 31, 2026
… pr_ticket_mismatch repair) Adds the occ-self-bind-pr-5763 stamp both contracts were missing. Without it occ-preflight/eligibility and verify/verify fail with reason=pr_ticket_mismatch: every receipt in this PR binds OCC#5759, none binds #5763, and eligibility is evaluated per-PR not per-ticket-ever. The sibling repair PR #5760 carried the analogous occ-self-bind-pr-5760 and passed. Append-only: no pre-existing contract entry or receipt is modified.
This was referenced Jul 31, 2026
jonahgabriel
added a commit
that referenced
this pull request
Jul 31, 2026
* docs(OMN-15488): guard-compatible binding checks for OMN-15488/OMN-15239 (executor-compat correction) Remediation of the wave-2 OCC DoD-contract lane (OCC #5759). The four binding check_values that lane authored were rejected PRE-EXECUTION by node_dod_verify, so dod_verify returned status=failed on both tickets: OMN-15488 12 verified / 3 failed / 15 total, OMN-15239 9 verified / 1 failed / 10 total. The blocker moved from CONTRACT_MISSING to FAILED; the closeout was NOT unblocked. Root cause (not a flake, not a retry): evidence_collector._invalid_check_value_reason shape-guards a check_value before executing it by tokenizing with shlex.split(posix=True), which is not $()-aware. The embedded jq program `.state + " " + (.mergeCommit.oid // "none")` closed the outer double quote, so the guard judged the fragment `" + (.mergeCommit.oid // none)')"` as the command name, took its relative-script-path branch on the embedded slash, and returned INVALID_CHECK_VALUE_NOT_A_COMMAND without ever running the command. A false RED against a command that exits 0 in a real shell -- but a hard FAIL on the verdict. Fix: append one supersession item per defective binding, leading with a resolvable first token (`test`) and splitting the two-field query into two single-field queries so each --jq filter is a bare path expression with no quote characters. Semantics preserved exactly: BOTH state MERGED AND the exact merge SHA are asserted. Mirrors the merged OCC #5760 precedent for OMN-15535/15490/15493. Append-only, NOT an in-place edit: merged dod_evidence entries are immutable (validator_occ_append_only) and their receipts pin the entry hash. Net diff is 225 insertions / 0 deletions; no pre-existing entry or receipt is touched. Also appended: dod-omn15488-summary-correction-pr239-title, a falsifiable correction of a factual error in OMN-15488.yaml`s summary, which mislabels steel PR #239 as "Amendment 2". Its real title is "fix(OMN-15522): send programming response contract on delegation wire (r4)" and OMN-15535`s contract binds it for the stdout-tail/CLI-diagnostics fix. The SHA 4bae73ea and the "bound under OMN-15535" claim in that summary are correct and unchanged. Recorded as a check rather than PR-body prose so it cannot rot. Proof is the artifact that runs, not a bare shell surrogate. node_dod_verify was executed against these contracts: BEFORE: OMN-15488 failed (12/3/15), OMN-15239 failed (9/1/10) AFTER: OMN-15488 verified 17/17 (superseded 3), OMN-15239 verified 10/10 (superseded 1); exit 0 on both Re-run AFTER the yamlfmt reflow with identical results, and every appended receipt`s contract_entry_sha256 recomputed post-reflow and confirmed matching. Each new check_value was also RED-proven by SHA (or title) substitution: exit 1. Ticket: OMN-15488, OMN-15239 * docs(OMN-15488): bind OMN-15488/OMN-15239 to OCC #5763 (occ-preflight pr_ticket_mismatch repair) Adds the occ-self-bind-pr-5763 stamp both contracts were missing. Without it occ-preflight/eligibility and verify/verify fail with reason=pr_ticket_mismatch: every receipt in this PR binds OCC#5759, none binds #5763, and eligibility is evaluated per-PR not per-ticket-ever. The sibling repair PR #5760 carried the analogous occ-self-bind-pr-5760 and passed. Append-only: no pre-existing contract entry or receipt is modified. * docs(OMN-15488): bind OMN-15488/OMN-15239 to OCC #5767 (occ-preflight pr_ticket_mismatch, 3rd recurrence) occ-preflight eligibility is evaluated PER-PR: it requires a PASS receipt bound to this PR number or a head SHA. Every stamp on these tickets binds an earlier PR (#5756/#5759 merged; #5763 CLOSED UNMERGED 21:42:59Z, branch deleted), so #5767 failed occ-preflight and verify with reason=pr_ticket_mismatch. Appends occ-self-bind-pr-5767 entries + PASS receipts. Append-only: no pre-existing entry or receipt modified; entry hashes computed post-yamlfmt.
jonahgabriel
added a commit
that referenced
this pull request
Jul 31, 2026
…ppend-only supersession (OMN-14443 class) (#5768) * evidence(OMN-15472): supersede vacuous dod-deploy-assessment with a falsifiable merge-SHA-pinned source probe Append-only supersession. contracts/OMN-15472.yaml gains one new item, dod-deploy-assessment-falsifiable, carrying evidence_artifact: supersedes_dod_evidence:dod-deploy-assessment. No existing item is deleted or rewritten. The superseded item greps PR #1990 own merged --name-only file list. #1990 is MERGED, so that list is immutable and the check exits 0 unconditionally: it cannot be driven RED by any change to product source, deploy surface, or runtime. Unfalsifiable by construction (OMN-14443 class). OCC #5762 neutralised it additively by ADDING dod-deploy-source-probe but left the vacuous item live. Replacement: immutable-ref content probe at squash merge commit 46e5364db360da5dbb72f382ddfea93488fc01fa asserting _preserve_service_url is present both as a definition and at the registration create-path call site. Proven GREEN and proven RED on .200 against first parent 8e27c27ab810d06386511cfada0c5b167ef445ca (rc=1) and against a symbol-free path (rc=1). Executor shape: first shlex token is gh; zero command substitution (OMN-15597 caution / OMN-15535 INVALID_CHECK_VALUE_NOT_A_COMMAND class). Both legs end in grep -F > /dev/null on fully drained input, avoiding the grep -q SIGPIPE 141 hazard and the grep -c counting idiom. Idiom precedent: lane B3 OCC #5760 on contracts/OMN-15535.yaml (EvidenceCollector._resolve_supersessions, OMN-15382/OMN-15390). * evidence(OMN-15472): add PASS receipt for dod-deploy-assessment-falsifiable occ-preflight / eligibility and verify / verify both failed on missing_or_nonpass_receipts=[OMN-15472:dod-deploy-assessment-falsifiable:command] — a new dod_evidence item needs its own receipt under drift/dod_receipts/. Net-new file. contract_entry_sha256 computed with omnibase_core.validation.validator_receipt_gate.compute_contract_entry_sha256 against the committed contract, so it binds the entry (not the whole file) and leaves every prior entry hash untouched. Receipt records the real run on .200: check_value read back out of the contract and executed verbatim (exit 0 under bash -euo pipefail and plain bash -c), plus two RED legs — first parent 8e27c27a (rc=1) and a symbol-free path (rc=1). * evidence(OMN-15472, OMN-14443): self-bind stamps for OCC#5768 occ-preflight moved past missing_receipt to reason=pr_ticket_mismatch: "no PASS receipt for one or more tickets binds to PR #5768 or one of its commit SHAs: OMN-14443, OMN-15472". Eligibility extracts every cited ticket that has a contract in this repo; this PR cites OMN-14443 substantively (it retires a live instance of that ticket unfalsifiable-check class), so both tickets need a binding stamp. Two appended items, both binding stamps, neither adjudicating anything: occ-self-bind-pr-5768 on contracts/OMN-15472.yaml and on contracts/OMN-14443.yaml, plus their receipts. Mirrors occ-self-bind-pr-5760 (OMN-15535) and occ-self-bind-pr-4557 (OMN-14443). Append-only; no existing item touched.
This was referenced Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Corrects the three binding-item
check_values landed by #5756 (merge9089ffa9) into a shape thedod_verifyevidence collector can actually execute — authored append-only, as one net-new supersessiondod_evidenceitem plus its receipt per contract.6 files, 144 insertions, 0 deletions. No pre-existing contract entry or receipt is modified.
Ticket: OMN-15535 (also covers OMN-15490, OMN-15493).
Root cause — a false RED, not a failing proof
node_dod_verify's_invalid_check_value_reason(omnimarket/.../node_dod_verify/services/evidence_collector.py, OMN-15382/OMN-15430) shape-checks acheck_valuebefore executing it: it tokenizes withshlex.split(..., posix=True), skips leadingVAR=VALassignments and shell control operators, then requires the first remaining token to resolve to an executable.The landed shape embedded a
jqprogram mixing both quote styles inside a double-quoted command substitution:shlexis not$()-aware. The" "inside the jq program closes the outer double quote, the parse desyncs, and the guard lands on the fragment:That fragment contains
/, so the guard takes its relative-script-path branch, finds no executable there, and returnsINVALID_CHECK_VALUE_NOT_A_COMMAND. The command is never run. It exits 0 in a real shell — this is a tokenizer/executor incompatibility, not a failed proof, and the binding fact never changed.Reproduced against the merged bytes at
9089ffa9: exactly 3 of 16 check_values INVALID, all three the binding items; every substantive AC check already VALID.Why append-only rather than an in-place edit
The first revision of this PR rewrote the three lines in place. That is structurally wrong for OCC and was correctly rejected by three independent gates, all on one root cause — a merged
dod_evidenceentry is immutable and its receipt pins the entry hash:OCC Append-Only Gate→APPEND_ONLY_VIOLATION/entry_editedon all threeocc-preflight / eligibilityandverify / verify→contract_hash_mismatch,stale_receipt_bindingsThe gate names the sanctioned path itself: "Corrections must be net-new add-only supersession files." So each contract now gets one appended item carrying
evidence_artifact: "supersedes_dod_evidence:<original-id>", which both consumers honour:contract_compliance_check._superseded_dod_idsresolves exactly{dod-omn15535-pr-239-merged-at-4bae73ea}etc.EvidenceCollector._resolve_supersessionsreturns the same set with zero malformed markers; a superseded item's checks are not executed and no::pr-live-statecheck is appended for it.The OMN-15390 ordering rule is satisfied (target declared earlier, superseder appended last — never forward, dangling, or self-referential), and the OMN-15390 anti-laundering condition is satisfied because the superseder carries a real executable check that passes, not an evidence-free marker.
Fix
Guard-compatible shape, semantics preserved — still asserts both
MERGEDand the exact merge SHA:Splitting the one two-field query into two single-field queries is what removes the string-concatenating jq program, leaving each
--jqfilter a bare path expression with no quote characters andtestas the first token.Pairs re-verified live via
ghimmediately before authoring — all three MATCH on both state and SHA:4bae73ea51a4f3d42d24ccdcaf68d9ab61d1a9a5sha256:bed43aae…e3dbd0171709d9cdd9fb80c4df6b85688a398803sha256:9f403f5f…d2a5d9aaeddbf71039d34820bb568e5c9d4561besha256:aefba368…Verified on the gate host (
.200) against the committed bytes, not retyped strings:check_valueread back out of the contract and run under the collector's own executor shapebash -o pipefail -c: all three exit 0.{"ok": true, "detail": "No append-only violations: existing entries and receipts unchanged."}for all three tickets.omnibase_core.validation.validator_receipt_gate.compute_contract_entry_sha256; the same function reproduces the pre-existing receipt hashsha256:ef67a08f…exactly, confirming the method.scripts/validation/check_receipt_hardening.pyon the three new receipts: rc=0.scripts/lint_contract_check_values.py: rc=0.dod_evidenceitems compare equal to their9089ffa9counterparts item-for-item, and all non-dod_evidencetop-level keys are unchanged, in all three contracts.git diff --numstatvs9089ffa9: 144 insertions, 0 deletions — zero minus-lines across contracts and receipts.yamlfmt(pre-commit) rewrapped the appended folded-scalar descriptions; because folded scalars join on whitespace the parsed values are unchanged, re-confirmed by recomputing all three entry hashes after the reformat and matching them against the receipts.Authorization
Same-session correction of these three binding
check_values is approved under ruling 2, recorded indocs/tracking/ROLLING_WORK_LEDGER.mdat2026-07-31T20:12:22Z— classified a correction, not a peer-evidence edit, with receipts required to stay untouched (they are; the three new receipt files are net-new).Peer session
fable-steel-0731was told via the same ledger line to drop these three tickets from its OCC-authoring wave.Related open PR (disclosed, not raced)
#5755 (
app/onexbot-occ-writer) touches the same three contract paths. It is a stale autobind companion for #5754, which was CLOSED at 19:47:21Z and superseded by #5756. It ismergeable: CONFLICTING/mergeStateStatus: DIRTYand would replace these enriched contracts with 39-line autobind stubs bound to a closed PR. It cannot land as-is. Flagged for the merge-queue owner; untouched here.Evidence-Ticket: OMN-15535
Evidence-Source: OCC#5761