Repository navigation
evidence(OMN-15472): add deploy source probe - #5762
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 6 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
Comment |
9b169fa to
e785295
Compare
e785295 to
1b836e9
Compare
…ppend-only supersession (OMN-14443 class) (#5768) * evidence(OMN-15472): supersede vacuous dod-deploy-assessment with a falsifiable merge-SHA-pinned source probe Append-only supersession. contracts/OMN-15472.yaml gains one new item, dod-deploy-assessment-falsifiable, carrying evidence_artifact: supersedes_dod_evidence:dod-deploy-assessment. No existing item is deleted or rewritten. The superseded item greps PR #1990 own merged --name-only file list. #1990 is MERGED, so that list is immutable and the check exits 0 unconditionally: it cannot be driven RED by any change to product source, deploy surface, or runtime. Unfalsifiable by construction (OMN-14443 class). OCC #5762 neutralised it additively by ADDING dod-deploy-source-probe but left the vacuous item live. Replacement: immutable-ref content probe at squash merge commit 46e5364db360da5dbb72f382ddfea93488fc01fa asserting _preserve_service_url is present both as a definition and at the registration create-path call site. Proven GREEN and proven RED on .200 against first parent 8e27c27ab810d06386511cfada0c5b167ef445ca (rc=1) and against a symbol-free path (rc=1). Executor shape: first shlex token is gh; zero command substitution (OMN-15597 caution / OMN-15535 INVALID_CHECK_VALUE_NOT_A_COMMAND class). Both legs end in grep -F > /dev/null on fully drained input, avoiding the grep -q SIGPIPE 141 hazard and the grep -c counting idiom. Idiom precedent: lane B3 OCC #5760 on contracts/OMN-15535.yaml (EvidenceCollector._resolve_supersessions, OMN-15382/OMN-15390). * evidence(OMN-15472): add PASS receipt for dod-deploy-assessment-falsifiable occ-preflight / eligibility and verify / verify both failed on missing_or_nonpass_receipts=[OMN-15472:dod-deploy-assessment-falsifiable:command] — a new dod_evidence item needs its own receipt under drift/dod_receipts/. Net-new file. contract_entry_sha256 computed with omnibase_core.validation.validator_receipt_gate.compute_contract_entry_sha256 against the committed contract, so it binds the entry (not the whole file) and leaves every prior entry hash untouched. Receipt records the real run on .200: check_value read back out of the contract and executed verbatim (exit 0 under bash -euo pipefail and plain bash -c), plus two RED legs — first parent 8e27c27a (rc=1) and a symbol-free path (rc=1). * evidence(OMN-15472, OMN-14443): self-bind stamps for OCC#5768 occ-preflight moved past missing_receipt to reason=pr_ticket_mismatch: "no PASS receipt for one or more tickets binds to PR #5768 or one of its commit SHAs: OMN-14443, OMN-15472". Eligibility extracts every cited ticket that has a contract in this repo; this PR cites OMN-14443 substantively (it retires a live instance of that ticket unfalsifiable-check class), so both tickets need a binding stamp. Two appended items, both binding stamps, neither adjudicating anything: occ-self-bind-pr-5768 on contracts/OMN-15472.yaml and on contracts/OMN-14443.yaml, plus their receipts. Mirrors occ-self-bind-pr-5760 (OMN-15535) and occ-self-bind-pr-4557 (OMN-14443). Append-only; no existing item touched.
Audit-trail disclosure — cross-reference from #5758 (posted post-merge, deliberately)Posted by session 1. What this PR did, and what it did not doThis PR added It did not retire the item it was neutralising. Retired by OCC #5768 (merged 2026-07-31T22:07:03Z, squash 2. Evidence-author separation for THIS PR is UNVERIFIABLE from live surfacesThis PR's author metadata reads So for #5762, whether implementer and evidence-author were separate cannot be verified, in either direction. Stated as an unresolved gap in the surfaces, not as an accusation about the work — the probe this PR added is sound and was independently re-executed. This comment is the durable record of the gap, since it is otherwise recorded nowhere. Separation is verifiable for #5768: Primary disclosure: #5758. — |
Adds a falsifiable deploy/source probe for OMN-15472 so omnimarket#1990 deploy-gate can evaluate a real immutable source surface instead of the generated file-count assessment.
Verification:
Refs OMN-15472