fix(OMN-15418): add-only honesty supersession — attestation framing + compose-file fact correction

contracts/OMN-15418.yaml

@@ -124,3 +124,57 @@ dod_evidence:
     checks:
       - check_type: "command"
         check_value: "gh pr view 5937 --repo OmniNode-ai/onex_change_control --json number,state,headRefName"
+  - id: "dod-deploy-assessment-merged-tree-attestation"
+    description: >-
+      Honesty supersession of dod-deploy-assessment-falsifiable, APPENDED add-only because that entry
+      and its receipt merged at 622c78f631bdc4110064dd41c10158430eb4ea04 (OCC #5937, 2026-08-02T05:43:46Z)
+      mid-remediation and are immutable under validator_occ_append_only. The probe body below is BYTE-IDENTICAL
+      to the superseded entry's: the defect was never the probe, it was two false statements made ABOUT
+      it, both corrected here. FALSE STATEMENT 1 (framing) — the superseded entry is named '-falsifiable'
+      and its prose says 'falsifiability was demonstrated rather than asserted', presenting it as escaping
+      the OMN-14443 unfalsifiable class. It does not escape that class. The probe greps file CONTENT at
+      an immutable 40-hex commit pin, so AT THAT PIN it exits 0 unconditionally and can never go RED there;
+      it is frozen-true forever, and no change to product source, deploy surface, or runtime can move
+      it. The rc=1-at-the-parent demonstration shows CONTENT DISCRIMINATION — the probe reads real bytes
+      rather than passing vacuously — which is a strictly weaker property than falsifiability at its own
+      pin, and the superseded prose conflated the two. FALSE STATEMENT 2 (fact) — the superseded prose
+      says 'PR #2548 changed 130 files and NOT ONE of them is a compose file'. That is false. #2548 ADDED
+      two compose files, docker/application-acl-proof/compose.yml and docker/domain-adapter-proof/compose.yml,
+      both with status 'added' (re-verified 2026-08-02 against the live 130-path file list). The TRUE,
+      narrower, and load-bearing fact — the one that actually makes the original generated dod-deploy-assessment
+      probe permanently RED — is that the single path that probe greps for, docker/docker-compose.e2e.yml,
+      is absent from those 130 paths. WHAT THIS ENTRY ASSERTS, with no stronger claim attached: a POINT-IN-TIME
+      ATTESTATION that the merged tree at PR #2548's squash merge commit 3863623e4844dc9b0db69ceb4e77942737fbca32
+      carries the OMN-15418 deliverable — the application-relation ownership validator definition AND
+      the exactly-one-owner enforcement call site the ticket exists to establish — both in src/omnibase_infra/validation/application_relation_ownership.py.
+      It is an immutable-ref attestation and it makes NO ongoing-falsifiability claim. Executor shape
+      (unchanged, re-verified 2026-08-02 under bash): first shlex token is gh, zero command substitution,
+      each leg terminates in grep -F redirected to /dev/null on fully drained input so neither leg meets
+      the base64 -d SIGPIPE tier-1 producer hazard that grep -q would introduce, and the ?ref= pin is
+      a 40-hex commit SHA rather than a deletable branch ref.
+    source: "manual"
+    status: "verified"
+    evidence_artifact: "supersedes_dod_evidence:dod-deploy-assessment-falsifiable"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api 'repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/validation/application_relation_ownership.py?ref=3863623e4844dc9b0db69ceb4e77942737fbca32' --jq .content | base64 -d | grep -F 'def validate_application_relation_ownership(' > /dev/null && gh api 'repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/validation/application_relation_ownership.py?ref=3863623e4844dc9b0db69ceb4e77942737fbca32' --jq .content | base64 -d | grep -F 'code=EnumApplicationRelationViolation.DUPLICATE_OWNER,' > /dev/null
+  - id: "occ-self-bind-pr-5945"
+    description: >-
+      Binding stamp, not substantive proof: binds OMN-15418 to OCC evidence PR #5945 — the add-only honesty
+      supersession PR that retires the dishonest FRAMING of dod-deploy-assessment-falsifiable (an immutable-ref
+      content probe presented as escaping the OMN-14443 unfalsifiable class) and corrects its FALSE compose-file
+      statement (#2548 ADDED docker/application-acl-proof/compose.yml and docker/domain-adapter-proof/compose.yml;
+      the true narrower fact is that docker/docker-compose.e2e.yml, the one path the dead generated probe
+      greps for, is absent from those 130 paths) — so occ-preflight eligibility can resolve a PASS receipt
+      for this ticket against THIS PR, per the OCC in-repo invariant that an OCC PR validates contracts
+      and receipts from its own checkout. The pre-existing occ-self-bind-pr-5635 and occ-self-bind-pr-5937
+      stamps bind the earlier autobind companion and the #5937 supersession PR; both are left untouched
+      and verbatim, since a ticket may be bound by more than one OCC PR over its life. This stamp adjudicates
+      nothing about the OMN-15418 work and flips no Linear status; the substantive evidence is dod-deploy-assessment-merged-tree-attestation
+      and occ-self-bind-pr-5635-merged. Mirrors the occ-self-bind-pr-5937 precedent one PR upstream.
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr view 5945 --repo OmniNode-ai/onex_change_control --json number,state,headRefName"

drift/dod_receipts/OMN-15418/dod-deploy-assessment-falsifiable/command.supersede.5945.yaml

@@ -0,0 +1,36 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-15418"
+evidence_item_id: "dod-deploy-assessment-falsifiable"
+check_type: "command"
+supersedes: "drift/dod_receipts/OMN-15418/dod-deploy-assessment-falsifiable/command.yaml"
+reason: |-
+  Honesty correction, add-only. The superseded receipt (merged in OCC #5937 at 622c78f631bdc4110064dd41c10158430eb4ea04) states two things that are false. (1) FACT — its actual_output says "#2548 changed 130 files and none is a compose file". #2548 ADDED two compose files, docker/application-acl-proof/compose.yml and docker/domain-adapter-proof/compose.yml, both status "added", re-verified 2026-08-02 against the live 130-path list. The true, narrower, load-bearing half is that docker/docker-compose.e2e.yml — the single path the dead generated dod-deploy-assessment probe greps for — is absent from those 130 paths. (2) FRAMING — its actual_output says "RED-proven in the same pass ... The check therefore discriminates", and the entry it binds is named "-falsifiable", together presenting the probe as escaping the OMN-14443 unfalsifiable class. It does not. The probe greps file content at an immutable 40-hex commit pin, so at that pin it exits 0 unconditionally and can never go RED there. The rc=1-at-the-first-parent result proves content DISCRIMINATION, which is real but strictly weaker than falsifiability at the probe's own pin; the superseded prose conflated the two. The merged base receipt is immutable under validator_occ_append_only and is left byte-for-byte intact; this net-new higher-token record carries the corrected text and re-binds the key. The check is UNCHANGED and re-run live — the defect was the claim about the probe, never the probe, so the bar is not weakened. At the contract level this entry is separately retired add-only by dod-deploy-assessment-merged-tree-attestation (OCC #5945).
+superseder: "chain-head-0802-honesty/occ-attestation-probe"
+created_at: "2026-08-02T06:10:50Z"
+replacement:
+  schema_version: "1.0.0"
+  ticket_id: "OMN-15418"
+  evidence_item_id: "dod-deploy-assessment-falsifiable"
+  check_type: "command"
+  check_value: |-
+    gh api 'repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/validation/application_relation_ownership.py?ref=3863623e4844dc9b0db69ceb4e77942737fbca32' --jq .content | base64 -d | grep -F 'def validate_application_relation_ownership(' > /dev/null && gh api 'repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/validation/application_relation_ownership.py?ref=3863623e4844dc9b0db69ceb4e77942737fbca32' --jq .content | base64 -d | grep -F 'code=EnumApplicationRelationViolation.DUPLICATE_OWNER,' > /dev/null
+  contract_entry_sha256: "sha256:3cf486a88d53ed838a9ca8d56b0306f45dac3305730e83f7ea49b1b412cc52d0"
+  status: PASS
+  run_timestamp: "2026-08-02T06:10:50Z"
+  commit_sha: "3863623e4844dc9b0db69ceb4e77942737fbca32"
+  runner: "chain-head-0802-honesty"
+  verifier: "chain-head-0802-honesty/occ-attestation-probe"
+  probe_command: |-
+    gh api 'repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/validation/application_relation_ownership.py?ref=3863623e4844dc9b0db69ceb4e77942737fbca32' --jq .content | base64 -d | grep -F 'def validate_application_relation_ownership('; gh api 'repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/validation/application_relation_ownership.py?ref=3863623e4844dc9b0db69ceb4e77942737fbca32' --jq .content | base64 -d | grep -F 'code=EnumApplicationRelationViolation.DUPLICATE_OWNER,'
+  probe_stdout: |
+    def validate_application_relation_ownership(
+                    code=EnumApplicationRelationViolation.DUPLICATE_OWNER,
+                        code=EnumApplicationRelationViolation.DUPLICATE_OWNER,
+                        code=EnumApplicationRelationViolation.DUPLICATE_OWNER,
+  actual_output: |
+    PASS under bash, exit 0, re-run live 2026-08-02T06:10:50Z with the committed check_value executed verbatim. SCOPE — this is a POINT-IN-TIME ATTESTATION against an immutable commit pin. It makes NO ongoing-falsifiability claim and it does not claim the check escapes the OMN-14443 unfalsifiable class; both claims appear in the receipt this record supersedes and both are withdrawn here. WHAT IT ATTESTS: the merged tree at PR OmniNode-ai/omnibase_infra#2548's squash merge commit 3863623e4844dc9b0db69ceb4e77942737fbca32 carries the OMN-15418 deliverable — the application-relation ownership validator definition and the exactly-one-owner enforcement call site — both in src/omnibase_infra/validation/application_relation_ownership.py. WHAT IT DOES NOT ATTEST: the probe greps content at a 40-hex commit pin, so at that pin it exits 0 unconditionally; it is frozen-true there and cannot go RED there. DISCRIMINATION, NOT FALSIFIABILITY: the probed file was ADDED by #2548 (858 additions, status "added") and returns HTTP 404 at that merge commit's first parent beebd1d636b9182b5ba80c7b68daf5ecfc7e76d3, so the identical probe repointed at the parent exits 1 (re-verified 2026-08-02). That proves the probe reads real bytes rather than passing vacuously; it does NOT prove the probe can go RED at its own pin. CORRECTED FACT: the superseded receipt says "#2548 changed 130 files and none is a compose file". False — #2548 ADDED docker/application-acl-proof/compose.yml and docker/domain-adapter-proof/compose.yml, both status "added". The accurate, narrower, load-bearing statement is that docker/docker-compose.e2e.yml, the single path the dead generated dod-deploy-assessment probe greps for, is absent from those 130 paths, which is why that probe exits 1 permanently. The merged base receipt is unedited and stays verbatim for audit. Executor shape: first shlex token is gh, zero command substitution, both legs terminate in grep -F redirected to /dev/null on fully drained input so neither meets the base64 -d SIGPIPE tier-1 producer hazard that grep -q would introduce; the ?ref= pin is a 40-hex commit SHA, not a deletable branch ref.
+  exit_code: 0
+  pr_number: 2548
+  branch: "jonah/omn-15418-honesty-supersession"
+  no_source_change: true

drift/dod_receipts/OMN-15418/dod-deploy-assessment-merged-tree-attestation/command.yaml

@@ -0,0 +1,26 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-15418"
+evidence_item_id: "dod-deploy-assessment-merged-tree-attestation"
+check_type: "command"
+check_value: |-
+  gh api 'repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/validation/application_relation_ownership.py?ref=3863623e4844dc9b0db69ceb4e77942737fbca32' --jq .content | base64 -d | grep -F 'def validate_application_relation_ownership(' > /dev/null && gh api 'repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/validation/application_relation_ownership.py?ref=3863623e4844dc9b0db69ceb4e77942737fbca32' --jq .content | base64 -d | grep -F 'code=EnumApplicationRelationViolation.DUPLICATE_OWNER,' > /dev/null
+contract_entry_sha256: "sha256:18c56f32b23e55675a6dd55ae63b1594d5e6c293e44d613a0fe60309d64bed76"
+status: PASS
+run_timestamp: "2026-08-02T06:05:16Z"
+commit_sha: "3863623e4844dc9b0db69ceb4e77942737fbca32"
+runner: "chain-head-0802-honesty"
+verifier: "chain-head-0802-honesty/occ-attestation-probe"
+probe_command: |-
+  gh api 'repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/validation/application_relation_ownership.py?ref=3863623e4844dc9b0db69ceb4e77942737fbca32' --jq .content | base64 -d | grep -F 'def validate_application_relation_ownership('; gh api 'repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/validation/application_relation_ownership.py?ref=3863623e4844dc9b0db69ceb4e77942737fbca32' --jq .content | base64 -d | grep -F 'code=EnumApplicationRelationViolation.DUPLICATE_OWNER,'
+probe_stdout: |
+  def validate_application_relation_ownership(
+                  code=EnumApplicationRelationViolation.DUPLICATE_OWNER,
+                      code=EnumApplicationRelationViolation.DUPLICATE_OWNER,
+                      code=EnumApplicationRelationViolation.DUPLICATE_OWNER,
+actual_output: |
+  PASS under bash 2026-08-02T06:05:16Z, exit 0, executed verbatim as committed. SCOPE — this receipt records a POINT-IN-TIME ATTESTATION against an immutable commit pin. It makes NO ongoing-falsifiability claim, and it does not claim the check escapes the OMN-14443 unfalsifiable class. WHAT IT ATTESTS: the merged tree at PR OmniNode-ai/omnibase_infra#2548's squash merge commit 3863623e4844dc9b0db69ceb4e77942737fbca32 carries the OMN-15418 deliverable — the application-relation ownership validator definition and the exactly-one-owner enforcement call site — both in src/omnibase_infra/validation/application_relation_ownership.py. WHAT IT DOES NOT ATTEST: because the probe greps content at a 40-hex commit pin, at that pin it exits 0 unconditionally; it is frozen-true there and cannot go RED there. DISCRIMINATION, NOT FALSIFIABILITY — the probed file was ADDED by #2548 (858 additions, status "added") and returns HTTP 404 at that merge commit's first parent beebd1d636b9182b5ba80c7b68daf5ecfc7e76d3, so the identical probe repointed at the parent exits 1 (re-verified 2026-08-02, PARENT_RC=1). That proves the probe measures real bytes rather than passing vacuously; it does NOT prove the probe can go RED at its own pin, and the entry this one supersedes conflated the two. THIS RECEIPT CORRECTS TWO FALSE STATEMENTS made in the merged dod-deploy-assessment-falsifiable entry and its receipt (both landed at 622c78f631bdc4110064dd41c10158430eb4ea04, OCC #5937, and both left byte-for-byte intact). FALSE 1 — that entry's id and prose ("falsifiability was demonstrated rather than asserted") assert an escape from the unfalsifiable class the immutable-ref shape cannot deliver; the corrected framing is the attestation framing above. FALSE 2 — that entry and its receipt state "#2548 changed 130 files and NOT ONE of them is a compose file". #2548 ADDED two compose files, docker/application-acl-proof/compose.yml and docker/domain-adapter-proof/compose.yml, both status "added"; re-verified 2026-08-02 against the live 130-path list from repos/OmniNode-ai/omnibase_infra/pulls/2548/files. The TRUE, narrower, load-bearing fact — the one that actually makes the original generated dod-deploy-assessment probe permanently RED — is that the single path that probe greps for, docker/docker-compose.e2e.yml, is absent from those 130 paths (grep -Fx over the live list returns rc=1). Retirement is append-only via evidence_artifact supersedes_dod_evidence:dod-deploy-assessment-falsifiable; the superseded entry and its receipt stay verbatim for audit and resolve to superseded at dod_verify runtime, with the chain dod-deploy-assessment -> dod-deploy-assessment-falsifiable -> this entry resolved by _terminal_superseder. Executor shape: first shlex token is gh, zero command substitution, both legs terminate in grep -F redirected to /dev/null on fully drained input so neither meets the base64 -d SIGPIPE tier-1 producer hazard that grep -q would introduce; the ?ref= pin is a 40-hex commit SHA, not a deletable branch ref.
+exit_code: 0
+pr_number: 2548
+branch: "jonah/omn-15418-honesty-supersession"
+no_source_change: true