[jonahgabriel]

What

Retires the four dod_evidence entries on contracts/OMN-15488.yaml and contracts/OMN-15239.yaml that bind OCC PR #5763, which closed unmerged at 2026-07-31T21:42:59Z with its head branch deleted.

node_dod_verify derives a live-PR binding from each stamp (EvidenceCollector._resolve_pr_bindings tier 2) and appends a synthetic ::pr-live-state assertion that is VERIFIED only when the bound PR is MERGED with green required checks (_verify_live_pr, fail-closed). Against a PR that will never merge, those four assertions are permanently FAILED, and the entries are immutable — so dod_verify cannot PASS on either ticket, blocking the only sanctioned Done-flip path.

Reproduced against onex_change_control@origin/dev with default contract resolution, before this PR:

ticket	status	total	verified	failed	superseded
OMN-15488	failed	25	23	2	3
OMN-15239	failed	18	16	2	1

Both failures on both tickets:

dod-OmniNode-ai-onex_change_control-pr-5763::pr-live-state
occ-self-bind-pr-5763::pr-live-state
  OmniNode-ai/onex_change_control#5763: PR not merged (state=CLOSED);
  required checks not green (2: occ-preflight / eligibility, verify / verify)

How — append-only supersession, never an edit

OCC Append-Only Gate (validator_occ_append_only, OMN-13962) rejects rewriting a merged dod_evidence entry, and merged receipts pin the per-entry hash, so in-place removal is impossible and would staleness-invalidate those receipts. Four new items are appended, each carrying evidence_artifact: supersedes_dod_evidence:<dead-id>:

contract	new item	retires
OMN-15488	dod-omn15488-retire-autobind-stamp-occ5763	dod-OmniNode-ai-onex_change_control-pr-5763
OMN-15488	dod-omn15488-retire-selfbind-stamp-occ5763	occ-self-bind-pr-5763
OMN-15239	dod-omn15239-retire-autobind-stamp-occ5763	dod-OmniNode-ai-onex_change_control-pr-5763
OMN-15239	dod-omn15239-retire-selfbind-stamp-occ5763	occ-self-bind-pr-5763

The retired entries stay verbatim for audit and resolve to status=superseded at runtime.

Not laundering. _supersession_is_in_effect (OMN-15390) requires the superseder to VERIFY in its own right with nothing FAILED in its group; each new item carries falsifiable content and is proven RED three ways below. This removes a FALSE red — both tickets are bound to a merged OCC PR — and manufactures no green, because the retired stamps' own claim is re-asserted here against the carrier that actually merged.

Falsifiable replacement. Each new check pins BOTH the exact squash merge SHA AND state == MERGED of OCC #5767, the PR that actually carried the guard-compatible binding repair to dev:

test "$(gh pr view 5767 --repo OmniNode-ai/onex_change_control --json mergeCommit --jq .mergeCommit.oid)" = "c669b18c5144733668063f5ff8b988d10b32b7b4" && test "$(gh pr view 5767 --repo OmniNode-ai/onex_change_control --json state --jq .state)" = "MERGED"

--repo and the PR number sit in the SAME shell clause so the collector binds (OmniNode-ai/onex_change_control, 5767) at tier 2 and the appended live-state check probes the merged carrier rather than falling through to the receipt-carrier tier (OMN-15465 class). Executor shape mirrors the merged *-guardcompat precedent: test is the first shlex token and no $() contains an embedded quote character, so _invalid_check_value_reason (shlex.split(posix=True)) cannot mis-branch — the OMN-15535 INVALID_CHECK_VALUE_NOT_A_COMMAND class.

Attribution correction (recorded in the artifact, not only in prose)

A prior lane reported both #5763 stamps as automation-authored. That is wrong for one of them, and the correction is written into dod-omn154{88,239}-retire-selfbind-stamp-occ5763's description because the governance artifact is the durable surface:

• dod-OmniNode-ai-onex_change_control-pr-5763 — genuinely machine-authored, by autobind companion evidence(OMN-15239, OMN-15488): OCC companion for OmniNode-ai/onex_change_control#5763 #5764 (merged 21:28:48Z), 14 minutes before docs(OMN-15488): guard-compatible binding checks for OMN-15488/OMN-15239 (executor-compat correction) #5763 closed.
• occ-self-bind-pr-5763 — hand-authored by the wave-3 repair lane in da47c2e43c54118a452c59ba08c0bfbd6ee7b72e (21:38:11Z). docs(OMN-15488): guard-compatible binding checks for OMN-15488/OMN-15239 (executor-compat correction) #5763 closed 4m48s later; the same lane's next commit d6200e79b (21:50:06Z) recorded that closure verbatim while retaining the dead stamp, which reached dev inside docs(OMN-15488/OMN-15239): guard-compatible binding checks #5767 at 21:55:19Z. It had never merged when docs(OMN-15488): guard-compatible binding checks for OMN-15488/OMN-15239 (executor-compat correction) #5763 closed and was still freely removable — Codex's in-flight alternative 344b88ec4 (21:52:29Z) did exactly that. The failure was avoidable, not structural.

Evidence

• Append-only, measured: 156 insertions / 0 deletions, 2 files. Per-entry compute_contract_entry_sha256 recomputed for all 32 pre-existing entries → zero drift, both before and after the yamlfmt reflow.
• Real shape guard: imported _invalid_check_value_reason, _hardcoded_pr_bindings_in_value and EvidenceCollector._resolve_supersessions from omnimarket and ran them over both amended contracts. All four new check_values: guard=None, bindings=[(OmniNode-ai/onex_change_control, 5767)]. Supersession resolution: 5 targets on OMN-15488, 3 on OMN-15239, 0 malformed. The only invalid check_values remaining are the 4 pre-existing superseded originals, which are never executed.
• GREEN, verbatim from the committed contract: exit 0 under bash -euo pipefail and under plain bash -c.
• RED-proven three ways: all-zero merge SHA → rc=1; state pinned CLOSED → rc=1; identical shape aimed at the dead carrier docs(OMN-15488): guard-compatible binding checks for OMN-15488/OMN-15239 (executor-compat correction) #5763 → rc=1. The check discriminates the exact failure it exists to prevent.
• Live node_dod_verify against the amended contracts — see the post-push comment on this PR for the run.
• Gates: full pre-commit hook chain run on the .200 gate host (rule 11a), clean on the second pass after yamlfmt normalization. Pushed from .200, not this Mac.

Scope

Contracts + their receipts only. No source change, no status flip, no merge or --auto armed by the authoring lane.

Follow-up

The generic defect — a PR-bound dod_evidence stamp is authored before its PR is known to merge, and has no retirement path if that PR later closes unmerged (both producers; occ-preflight eligibility is per-PR, so it structurally requires minting a claim about an unresolved future) — is filed as OMN-15599 with falsifiable acceptance criteria, including a backfill census. Second occurrence of the class; the first was OMN-13906 (2026-07-15, #1845 on OMN-13899). This PR is a per-instance repair and does not close it.

Evidence-Ticket: OMN-15488
Evidence-Ticket: OMN-15239

Summary by CodeRabbit

• Documentation
  • Added audit records documenting the retirement of obsolete OCC #5763 evidence.
  • Recorded OCC #5767 as the verified replacement with its expected merged commit.
  • Preserved historical evidence through append-only supersession records and verification receipts.
  • Added passing verification results and metadata confirming the supersession status.

[coderabbitai]

📝 Walkthrough

Walkthrough

The contracts add append-only supersession records for obsolete OCC #5763 bindings. Four DOD receipts verify merged OCC #5767 at the expected commit and record PASS status, metadata, and supersession details.

Changes

OCC evidence supersession

Layer / File(s)	Summary
Contract supersession records contracts/OMN-15239.yaml, contracts/OMN-15488.yaml	The contracts retire generated and self-bound OCC #5763 evidence. They verify OCC #5767 by exact merge SHA and MERGED state.
DOD verification receipts drift/dod_receipts/OMN-15239/*, drift/dod_receipts/OMN-15488/*	The receipts record PASS checks, probe output, execution metadata, and append-only supersession details for the obsolete bindings.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• OmniNode-ai/onex_change_control#5763: Introduced the OCC #5763 bindings that this PR supersedes.
• OmniNode-ai/onex_change_control#5759: Modified the same contracts and related DOD receipts.
• OmniNode-ai/onex_change_control#3715: Added append-only supersession and rebinding evidence receipts.

Suggested labels: occ:machine-minted

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the affected evidence records, tickets, OCC #5763 binding stamps, and append-only supersession change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-15488-omn-15239-retire-dead-5763-stamps

---

_{Comment @coderabbitai help to get the list of available commands.}

[jonahgabriel]

Live node_dod_verify proof — RED before, GREEN after

Both runs use default production contract resolution (OCC_GOVERNANCE_REF, the documented operator override on the collector's own dev-worktree materialization path) — not --contract-path, so the real resolution path is exercised.

BEFORE (OCC_GOVERNANCE_REF=origin/dev, e96c44a32):

ticket	report.status	total	verified	failed	superseded
OMN-15488	FAIL	25	23	2	3
OMN-15239	FAIL	18	16	2	1

Both failures on both tickets:

dod-OmniNode-ai-onex_change_control-pr-5763::pr-live-state
occ-self-bind-pr-5763::pr-live-state
  OmniNode-ai/onex_change_control#5763: PR not merged (state=CLOSED);
  required checks not green (2: occ-preflight / eligibility, verify / verify)

AFTER (OCC_GOVERNANCE_REF = this branch at e8dea206876d1315b980cd25adc28011b28311f1):

ticket	report.status	total	verified	failed	superseded
OMN-15488	PASS	25	25	0	5
OMN-15239	PASS	18	18	0	3

The two dead stamps on each ticket now resolve to SUPERSEDED … not re-executed — preserved for audit, and each new item verifies in its own right:

verified | dod-omn15488-retire-autobind-stamp-occ5763                  OK (933ms)
verified | dod-omn15488-retire-autobind-stamp-occ5763::pr-live-state   #5767: MERGED; all 4 status check(s) green
verified | dod-omn15488-retire-selfbind-stamp-occ5763                  OK (920ms)
verified | dod-omn15488-retire-selfbind-stamp-occ5763::pr-live-state   #5767: MERGED; all 4 status check(s) green
verified | dod-omn15239-retire-autobind-stamp-occ5763                  OK (926ms)
verified | dod-omn15239-retire-autobind-stamp-occ5763::pr-live-state   #5767: MERGED; all 4 status check(s) green
verified | dod-omn15239-retire-selfbind-stamp-occ5763                  OK (926ms)
verified | dod-omn15239-retire-selfbind-stamp-occ5763::pr-live-state   #5767: MERGED; all 4 status check(s) green

The retirements take effect only because each superseder verifies (_supersession_is_in_effect, OMN-15390). A superseder with no passing check of its own would have left SUPERSESSION_NOT_IN_EFFECT and the original red — asserted, not assumed.

CI

43 pass / 0 fail / 17 skipping / 1 pending (tests+coverage shadow) on e8dea20687. Green includes OCC Append-Only Gate, Receipt Honesty Gate, Contract Substance Floor, occ-preflight / eligibility, verify / verify.

One real CI failure, root-caused rather than retried

occ-preflight and verify first failed with reason=missing_contract, missing_contracts=["OMN-15599"]. Not a flake: _extract_ticket_ids finds no Closes/Fixes/Resolves/Implements keyword in the body, falls back to the PR title, and the title carried (OMN-15599 class) — so eligibility demanded an OCC contract for a follow-up ticket that has no landed work and correctly has none. Fixed by removing that token from the title; both jobs had run against the old title (PR_EVENT_TITLE in the failing log confirms it) and do not re-run on an edited event, hence the empty re-trigger commit. OMN-15599 stays in the body prose, which is only scanned for closing keywords.

No self-bind contract entry for this PR — deliberate

occ-preflight eligibility is satisfied here by the receipts (pr_number: 5771), which validator_occ_merge_eligibility._receipt_bound_to_pr accepts directly. No occ-self-bind-pr-5771 contract entry was authored, because minting a permanent contract stamp for a PR that has not merged is precisely the pattern that produced the dead #5763 stamps this PR exists to retire. Confirmed working: the eligibility payload shows missing_or_nonpass_receipts: [] and no pr_ticket_mismatch — the only blocker was the title token above.

[jonahgabriel]

Self-correction on one stated figure, and terminal state.

The PR body says "156 insertions / 0 deletions, 2 files." That was accurate for the contracts commit at the time it was written, before the four receipts were added. The merged diff is 252 insertions / 0 deletions across 6 files (contracts/OMN-15488.yaml +78, contracts/OMN-15239.yaml +78, and 4 receipts at +24 each). Still zero deletions, still nothing outside those two contracts and their own receipt directories — the append-only claim is unchanged; only the count was stale.

Terminal state, verified live:

• Merged 2026-07-31T22:57:04Z, merge commit 9bc32186a2c21f5acc42cfb256fcffb6870c2e8a, exact-head e8dea206876d1315b980cd25adc28011b28311f1. Merged by the Codex merge controller (ledger 2026-07-31T22:57:02Z / 22:57:43Z), not by the authoring lane — autoMergeRequest was null throughout and this lane never merged, armed --auto, or rebased.
• Final CI on the merged head: 45 success / 17 skipped / 0 failure.
• node_dod_verify re-run against merged dev (9bc32186a) with default contract resolution — no OCC_GOVERNANCE_REF, no --contract-path:

ticket	report.status	total	verified	failed	skipped	superseded
OMN-15488	PASS	25	25	0	0	5
OMN-15239	PASS	18	18	0	0	3

Zero non-verified, non-superseded checks on either ticket. Both are now unblocked for dod_verify closeout.