Repository navigation
evidence(OMN-15689): OCC companion for OmniNode-ai/onex_change_control#6045 - #6046
Merged
jonahgabriel merged 3 commits intoAug 4, 2026
Merged
Conversation
jonahgabriel
deleted the
auto/omninode-ai-onex_change_control-pr-6045-occ-autobind
branch
August 4, 2026 16:30
jonahgabriel
added a commit
that referenced
this pull request
Aug 4, 2026
…2, invariant I3) occ-preflight/eligibility failed on PR #6051 with reason pr_ticket_mismatch: no PASS receipt bound to PR #6051 or its commit SHAs for OMN-15689. The existing dod_evidence entries all cite PR #6045/#6046. Adds a new dod_evidence item (dod-OmniNode-ai-onex_change_control-pr-6051) plus a PASS receipt binding pr_number=6051, per invariant I3 (onex_change_control's own PRs carry their own contract + receipts in-tree). contract_sha256/contract_entry_sha256 computed via omnibase_core.validation.validator_receipt_gate.compute_contract_sha256 / compute_contract_entry_sha256 against the yamlfmt-stabilized contract bytes. verifier field names the deterministic CI validator (occ-preflight/eligibility, which structurally checks receipt.pr_number == snapshot.pr_number against live GitHub state) rather than the authoring agent, avoiding self-attestation.
jonahgabriel
added a commit
that referenced
this pull request
Aug 4, 2026
…1, round 2) (#6051) * fix(OMN-15689): resolve OCC self-checkout fallback ref dynamically (D1, round 2) The PENDING_MERGE grandfather path in call-receipt-gate.yml's "Check out onex_change_control" step fell back to a literal 'main' (twice, same line) instead of a dynamically resolved ref. AC(e) requires a grep for hardcoded branch refs across these gate files to return empty; this line was the sole surviving hit (confirmed live against origin/dev before this fix). This step is unreachable for onex_change_control's own PRs (invariant I3: the guard `github.repository != 'OmniNode-ai/onex_change_control'` is always false in this file), so the defect had zero live blast radius, but the literal was still present in source and failed the grep-based AC. Fix: add a "Resolve onex_change_control default branch (self-checkout fallback)" step that fetches OCC's own default branch via `gh api repos/OmniNode-ai/onex_change_control --jq '.default_branch'` at runtime, and use that resolved output in place of both 'main' literals. Verified: `grep -n "^\s*ref:" .github/workflows/call-receipt-gate.yml .github/workflows/call-occ-preflight.yml | grep -v "steps\.\|github\.event\."` returns empty (no hardcoded ref: literal outside a steps./github.event. expression). * evidence(OMN-15689): bind contract + PASS receipt to PR #6051 (round-2, invariant I3) occ-preflight/eligibility failed on PR #6051 with reason pr_ticket_mismatch: no PASS receipt bound to PR #6051 or its commit SHAs for OMN-15689. The existing dod_evidence entries all cite PR #6045/#6046. Adds a new dod_evidence item (dod-OmniNode-ai-onex_change_control-pr-6051) plus a PASS receipt binding pr_number=6051, per invariant I3 (onex_change_control's own PRs carry their own contract + receipts in-tree). contract_sha256/contract_entry_sha256 computed via omnibase_core.validation.validator_receipt_gate.compute_contract_sha256 / compute_contract_entry_sha256 against the yamlfmt-stabilized contract bytes. verifier field names the deterministic CI validator (occ-preflight/eligibility, which structurally checks receipt.pr_number == snapshot.pr_number against live GitHub state) rather than the authoring agent, avoiding self-attestation.
jonahgabriel
added a commit
that referenced
this pull request
Aug 4, 2026
occ-preflight/eligibility on OCC#6061 (run 30936850262) FAILED with reason=pr_ticket_mismatch: no PASS receipt for OMN-15689 bound to PR #6061 or its commit SHAs existed. Prior self-bind receipts bound only to #6046 and (on later dev history) #6060 — #6061's in-tree contract (invariant I3) had no entry for itself. Appends occ-self-bind-pr-6061 (contract dod_evidence entry + PASS receipt) following the exact occ-self-bind-pr-6046/6060 pattern. Append-only: does not touch the gate-dynamization content #6061 ships (ci.yml honesty-gate / append-only-gate / validate-validator-requirements.yml dynamic ref resolution) or any prior receipt. OMN-15689
jonahgabriel
added a commit
that referenced
this pull request
Aug 5, 2026
…lidator refs dynamically (AC(e) residual) (#6061) * fix(OMN-15689): derive Receipt Honesty Gate + OCC Append-Only Gate validator refs dynamically (AC(e) residual) R3a operator ruling (no hardcoded omnibase_core validator ref ANYWHERE — not @main, not @dev, not a literal SHA) already fixed call-receipt-gate.yml and call-occ-preflight.yml. This closes the remaining in-scope residual: ci.yml's honesty-gate (Receipt Honesty Gate, REQUIRED on main) and append-only-gate (OCC Append-Only Gate) jobs each checked out omnibase_core at a hardcoded commit SHA (d4884c590... / f873d8307...), the same live-skew risk the ruling fixed elsewhere — a validator fix merged to omnibase_core dev could not reach these in-repo gates until someone manually bumped the SHA, and the two pins could (and did) drift out of the "bump alongside" lockstep the old comment asked for. Both jobs now carry a "Resolve omnibase_core validator ref" step, reusing the exact pattern call-receipt-gate.yml established post-#6045 (steps.validator_ref.outputs.ref feeding the checkout ref, fail-closed with no fallback). ci.yml runs on more event types than the PR-only reusable callers, so the resolution step handles the full matrix: - pull_request -> github.event.pull_request.base.ref - merge_group -> github.event.merge_group.base_ref - push / workflow_dispatch -> github.ref_name (the branch pushed to, or the branch selected in the manual-dispatch UI) -- dynamically resolved, never a hardcoded literal. None of the four resolves -> the job fails closed before any omnibase_core checkout is attempted. Scope discipline: only these two in-repo gate-validator SHA pins were touched, per explicit dispatch instruction. 9 other hardcoded `uses:`/`ref:` pins exist across OCC workflows (3x omniclaude reusable @dev, 4x omnibase_core zone-filter@dev, 1x omnibase_core validate-docs.yml@main, 1x omnimarket merge-hold-gate@SHA) -- these are cross-repo REUSABLE-WORKFLOW `uses:` pins (GitHub accepts only a literal ref there, no expressions), a different mechanism class than the checkout+ref pattern used here. Not touched; inventory commented onto OMN-15689 for operator scoping. OMN-15689 * fix(OMN-15689): dynamically resolve validate-validator-requirements.yml omnibase_core ref Corrections-pass DEFECT 1: the AC(e) out-of-scope inventory omitted validate-validator-requirements.yml:44, a hardcoded literal-SHA checkout of OmniNode-ai/omnibase_core carrying a manual-bump comment — same repo, same validator-code class, same live-skew failure mode as the ci.yml:997/1062 pins this lane already fixed. Applies the identical steps.validator_ref.outputs.ref resolver pattern (PR base ref / merge group base ref / push-dispatch ref_name, fail-closed on none), no fallback literal. ci.yml:1329 (the OMNICLAUDE_PIN, a documented deliberate merged-commit pin backing the OMN-14505 predicate) is out of scope for this fix and is cited with its rationale in the amended Linear inventory instead. * fix(OMN-15689): bind OCC receipt to PR #6061 (pr_ticket_mismatch) occ-preflight/eligibility on OCC#6061 (run 30936850262) FAILED with reason=pr_ticket_mismatch: no PASS receipt for OMN-15689 bound to PR #6061 or its commit SHAs existed. Prior self-bind receipts bound only to #6046 and (on later dev history) #6060 — #6061's in-tree contract (invariant I3) had no entry for itself. Appends occ-self-bind-pr-6061 (contract dod_evidence entry + PASS receipt) following the exact occ-self-bind-pr-6046/6060 pattern. Append-only: does not touch the gate-dynamization content #6061 ships (ci.yml honesty-gate / append-only-gate / validate-validator-requirements.yml dynamic ref resolution) or any prior receipt. OMN-15689
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deterministic OCC evidence companion for #6045, authored by node_occ_companion_effect (RSD-3, OMN-14622) from the node_occ_companion_compute plan. Every byte is a pure function of the compute plan (attestation-oracle reproducible).