Repository navigation
fix(OMN-15422): chained supersession repair for broken pr-2596 carrier - #6052
Conversation
onex_change_control#6049 merged a supersession carrier (dod-OmniNode-ai-omnibase_infra-pr-2596-superseded) whose own id and check_value bind to closed/unmerged infra#2596, so its own auto-appended ::pr-live-state check fails and the supersession never takes effect -- two FAILED entries instead of zero. This appends a chained repair entry (dod-omn-15422-repair-supersede-v2) that binds only to the MERGED infra#2597 and declares supersedes_dod_evidence:dod-...-pr-2596-superseded, so _terminal_superseder resolves both upstream entries to this one, which verifies in its own right.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 45 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe PR adds a verified manual supersession entry for OMN-15422 and a PASS command receipt. The entry repairs the chain through PR ChangesOMN-15422 evidence repair
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@contracts/OMN-15422.yaml`:
- Around line 120-123: Update the command checks at the entries corresponding to
PR 2597 and line 84 to pipe their jq output through grep -qx true, ensuring
false Boolean results fail the check; preserve the existing PR-state predicates.
Also add the required contract_entry_sha256 or legacy contract_sha256 binding
using omnibase_core.validation.validator_receipt_gate for this contract entry.
In `@drift/dod_receipts/OMN-15422/dod-omn-15422-repair-supersede-v2/command.yaml`:
- Around line 1-11: Move the receipt currently represented by command.yaml into
a file named 2026-08-04T16:58:16Z.yaml within the same
dod-omn-15422-repair-supersede-v2 directory, preserving the complete
ModelDodReceipt payload and removing the non-timestamped command.yaml layout.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: d517548f-5561-4296-adf3-5781752f8273
📒 Files selected for processing (2)
contracts/OMN-15422.yamldrift/dod_receipts/OMN-15422/dod-omn-15422-repair-supersede-v2/command.yaml
| evidence_artifact: "supersedes_dod_evidence:dod-OmniNode-ai-omnibase_infra-pr-2596-superseded" | ||
| checks: | ||
| - check_type: "command" | ||
| check_value: "gh pr view 6050 --repo OmniNode-ai/onex_change_control --json number,state" | ||
| check_value: "gh pr view 2597 --repo OmniNode-ai/omnibase_infra --json state --jq '.state == \"MERGED\"'" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
contract='contracts/OMN-15422.yaml'
rg -n -C 3 \
'dod-OmniNode-ai-omnibase_infra-pr-2596(-superseded)?|dod-omn-15422-repair-supersede-v2|supersedes_dod_evidence' \
"$contract"
rg -n -C 10 --glob '*.py' \
'^\s*def\s+_(terminal_superseder|supersession_is_in_effect)\b|::pr-live-state|\bevidence_collector\b' \
.Repository: OmniNode-ai/onex_change_control
Length of output: 4476
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Search for terminal_superseder and evidence_collector implementations
rg -n -A 15 'def.*_terminal_superseder|def.*_supersession_is_in_effect' --glob '*.py' .
# Search for evidence_collector function
rg -n -A 10 'def\s+evidence_collector|class.*evidence_collector' --glob '*.py' .
# Search for validator_receipt_gate usage with contract files
rg -n -B 5 -A 10 'validator_receipt_gate|contract.*sha256|contract_entry_sha256' --glob '*.py' .Repository: OmniNode-ai/onex_change_control
Length of output: 169
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check if PR 2597 is actually MERGED (to understand what the jq result should be)
# Also search for how jq Boolean outputs are interpreted
rg -n 'jq.*==|\.state|MERGED|command.*result' --glob '*.py' . | head -50
# Search for the dod_verify entry point and result interpretation
rg -n 'def\s+node_dod_verify|def\s+dod_verify|def.*resolve.*result' --glob '*.py' . | head -30Repository: OmniNode-ai/onex_change_control
Length of output: 5874
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Find Python files in source directories
find . -path ./tests -prune -o -type f -name '*.py' -print | grep -E 'src/|scripts/' | head -20
# Look for the main dod verification module
fd -e py 'dod|verify|evidence' src/ scripts/ 2>/dev/null | head -30Repository: OmniNode-ai/onex_change_control
Length of output: 1121
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Search for how command check results are interpreted as pass/fail
rg -n 'check_type.*command|command.*check|result.*true|result.*false' --glob '*.py' src/ scripts/ | head -40
# Search for jq result handling and Boolean interpretation
rg -n 'jq.*true|jq.*false|\.json.*--jq|grep.*true|grep.*false' --glob '*.py' src/ scripts/ tests/ | head -30Repository: OmniNode-ai/onex_change_control
Length of output: 7908
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Look for files that handle contract validation and hashing
rg -n 'sha256|hash.*contract|validator_receipt_gate' --glob '*.py' src/ scripts/ | head -40
# Check the actual file structure
ls -la src/onex_change_control/ 2>/dev/null | head -20Repository: OmniNode-ai/onex_change_control
Length of output: 5846
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check how jq Boolean results should be handled in contract checks
rg -n -B 5 -A 5 "\.state.*==.*MERGED|--jq.*==.*grep" --glob '*.py' --glob '*.yaml' | head -100
# Look at the actual lint contract check values rules for jq assertions
cat scripts/lint_contract_check_values.py | sed -n '320,380p'Repository: OmniNode-ai/onex_change_control
Length of output: 169
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify what the jq result would be without grep
# This tests the actual behavior of the command in the contract
node - <<'JS'
// Test what jq outputs for a Boolean comparison
const { execSync } = require('child_process');
// Simulate: gh pr view 2597 --json state --jq '.state == "MERGED"'
// In reality, this would call GitHub API, but we can test jq behavior
// Example jq outputs:
const tests = [
{ state: "MERGED", expected: "true" },
{ state: "OPEN", expected: "false" }
];
console.log("jq Boolean output behavior:");
tests.forEach(t => {
const json = JSON.stringify(t.state);
// jq '.state == "MERGED"' outputs "true" or "false" as JSON string
console.log(`Input: ${t.state} => jq output: "${t.expected}" (exit code 0 in both cases)`);
});
console.log("\nWithout grep -qx true, both succeed (exit 0)");
console.log("With grep -qx true, only 'true' result exits 0");
JSRepository: OmniNode-ai/onex_change_control
Length of output: 415
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Search for the actual proper pattern that should be used
rg -n "jq.*==.*MERGED|jq.*state.*grep" --glob '*.yaml' --glob '*.py' contracts/ tests/ scripts/ | grep -i 'merged\|state' | head -20Repository: OmniNode-ai/onex_change_control
Length of output: 3233
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Compare the pattern in OMN-15422.yaml with proper patterns in other contracts
echo "=== OMN-15422.yaml line 123 (CURRENT - potentially broken) ==="
rg -n "jq '.state == " contracts/OMN-15422.yaml
echo ""
echo "=== Proper patterns from other contracts with jq Boolean assertions ==="
rg -n "jq.*==.*grep -" contracts/ | grep -E 'merged|MERGED|state.*true|state.*false' | head -5
echo ""
echo "=== Pattern analysis: jq Boolean output needs grep filtering ==="
# Show both good and bad patterns side by side
echo "CORRECT: gh pr view N --json state --jq .state | grep -qx MERGED"
echo "CORRECT: gh pr view N --json X --jq '.X == Y' | grep -qx true"
echo "BROKEN: gh pr view N --json state --jq '.state == \"MERGED\"' (no grep!)"Repository: OmniNode-ai/onex_change_control
Length of output: 1755
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify what happens when jq outputs true/false without grep
echo "=== Testing jq Boolean output behavior ==="
python3 - <<'PY'
import subprocess
import json
# Simulate jq behavior with gh pr view output
test_cases = [
{"state": "MERGED", "description": "PR is merged"},
{"state": "OPEN", "description": "PR is open"},
]
for case in test_cases:
state_val = case["state"]
desc = case["description"]
# Simulate: echo '{"state":"MERGED"}' | jq '.state == "MERGED"'
# Result: true or false (JSON boolean, printed as literal true/false string)
result = str(state_val == "MERGED").lower()
# The jq command exits 0 regardless
cmd_exit = 0
print(f"{desc}:")
print(f" jq '.state == \"MERGED\"' outputs: {result}")
print(f" Command exit code: {cmd_exit}")
print(f" Check passes? YES (exit 0 regardless of output)")
print()
print("ISSUE: Both true and false exit with code 0.")
print("FIX: Add '| grep -qx true' to enforce the Boolean result.")
PYRepository: OmniNode-ai/onex_change_control
Length of output: 570
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check if there are any other uses of jq with Boolean without grep in contracts
rg -n "jq.*==.*\"" contracts/ | grep -v "grep" | head -10Repository: OmniNode-ai/onex_change_control
Length of output: 1714
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check if dod-omn-15422-repair-supersede-v2 entry has contract_sha256 or contract_entry_sha256
rg -n -A 20 'id: "dod-omn-15422-repair-supersede-v2"' contracts/OMN-15422.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 2492
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify that line 84 in the same file uses the correct pattern
rg -n -B 2 -A 2 'line 84' contracts/OMN-15422.yaml || \
rg -n 'state.*closed.*merged.*grep' contracts/OMN-15422.yaml | head -5Repository: OmniNode-ai/onex_change_control
Length of output: 169
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Get the complete dod-omn-15422-repair-supersede-v2 entry
sed -n '92,125p' contracts/OMN-15422.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 3202
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check if PR 2597 is actually MERGED (verify the description claim)
# Also confirm the pattern used at line 84
sed -n '75,90p' contracts/OMN-15422.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 1025
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify that line 84's check also lacks grep (confirming the pattern is consistent but broken)
grep -n "\.state == " contracts/OMN-15422.yaml | head -5
# Check what the exact proper pattern should be by looking at successful examples
echo ""
echo "=== Correct pattern with grep filtering ==="
rg -n "jq.*==.*MERGED.*grep -qx true" contracts/ | head -2Repository: OmniNode-ai/onex_change_control
Length of output: 439
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify whether the contract file has any receipt entries with contract hash bindings
rg -n 'contract_sha256|contract_entry_sha256' contracts/OMN-15422.yaml
# If not found, check if other contract files typically have these
echo ""
echo "=== Checking other contract files for hash binding patterns ==="
rg -l 'contract_entry_sha256|contract_sha256' contracts/ | head -5Repository: OmniNode-ai/onex_change_control
Length of output: 169
Line 123 check_value lacks required grep filtering to enforce jq Boolean result; line 84 has the same issue. Additionally, entry lacks required contract_sha256 or contract_entry_sha256 binding.
The jq expression .state == "MERGED" outputs the JSON boolean true or false and exits with code 0 in both cases. Without piping to grep -qx true, the check passes regardless of PR state. Correct pattern: gh pr view 2597 --repo OmniNode-ai/omnibase_infra --json state --jq .state | grep -qx MERGED or --jq '.state == "MERGED"' | grep -qx true.
Line 84 has the same issue: .state == "closed" and .merged_at == null needs | grep -qx true appended.
Per coding guidelines, contracts/OMN-15422.yaml must bind contract_entry_sha256 (or legacy contract_sha256) using omnibase_core.validation.validator_receipt_gate. This entry has neither.
Current line 123
check_value: "gh pr view 2597 --repo OmniNode-ai/omnibase_infra --json state --jq '.state == \"MERGED\"'"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@contracts/OMN-15422.yaml` around lines 120 - 123, Update the command checks
at the entries corresponding to PR 2597 and line 84 to pipe their jq output
through grep -qx true, ensuring false Boolean results fail the check; preserve
the existing PR-state predicates. Also add the required contract_entry_sha256 or
legacy contract_sha256 binding using
omnibase_core.validation.validator_receipt_gate for this contract entry.
| --- | ||
| schema_version: "1.0.0" | ||
| ticket_id: "OMN-15422" | ||
| evidence_item_id: "dod-omn-15422-repair-supersede-v2" | ||
| check_type: "command" | ||
| check_value: |- | ||
| gh pr view 2597 --repo OmniNode-ai/omnibase_infra --json state --jq '.state == "MERGED"' | ||
| contract_sha256: "sha256:6f0326e4d0cd7162a98ceef84215af6131bb1285daae9188fda61e9ac1e398b5" | ||
| contract_entry_sha256: "sha256:3e3eac881a1a998b318c49c704708fff0d0b9af65834ad1d6b451e73f0c9209c" | ||
| status: PASS | ||
| run_timestamp: "2026-08-04T16:58:16Z" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Store this receipt at the required timestamped path.
command.yaml violates the required receipt layout. Move this file to drift/dod_receipts/OMN-15422/dod-omn-15422-repair-supersede-v2/2026-08-04T16:58:16Z.yaml. Preserve the same ModelDodReceipt payload.
As per coding guidelines, “Store DoD receipts only at drift/dod_receipts/<TICKET>/<ITEM_ID>/<run_timestamp>.yaml, using the omnibase_core.ModelDodReceipt shape.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@drift/dod_receipts/OMN-15422/dod-omn-15422-repair-supersede-v2/command.yaml`
around lines 1 - 11, Move the receipt currently represented by command.yaml into
a file named 2026-08-04T16:58:16Z.yaml within the same
dod-omn-15422-repair-supersede-v2 directory, preserving the complete
ModelDodReceipt payload and removing the non-timestamped command.yaml layout.
Source: Coding guidelines
…bes (#6112) * fix(OMN-15567): append-only supersession of 6 stale pr-live-state probes The OCC contract's dod_verify check_values hardcode gh-REST-style `.state == "open"` (lowercase) against 5 PRs that have since MERGED: omnibase_infra#2623 (bf070a94), omnibase_infra#2628 (aef0d202, two distinct entries at two different heads), and OCC companions #5939, #5960, #5964. The OMN-14637 auto-relax mechanism only re-anchors the uppercase `.state == "OPEN"` (gh pr view --json) idiom -- this lowercase gh-api-REST literal is a distinct, unhandled case, same class OMN-15422 hit (repair chain #6049/#6050/#6052). Adds 6 single-id append-only supersessions re-anchoring each stale assertion to the durable merged-terminal fact (state=closed, merged=true, exact merge_commit_sha), re-verified live 2026-08-05. Receipts land PENDING (this lane is the runner only; an independent identity must re-execute and flip to PASS before merge eligibility -- the OCC#6111 shape). OMN-15567 * evidence(OMN-15567): PENDING receipts for 6 stale pr-live-state supersessions Runner-authored PENDING receipts for the 6 append-only supersessions in contracts/OMN-15567.yaml. Each probe_stdout is byte-exact captured output of the committed check_value, re-run live 2026-08-05. status PENDING per the OCC#6111 shape -- this lane is the runner only; an independent identity must re-execute and flip to PASS before merge eligibility. OMN-15567 * evidence(OMN-15567): OCC self-bind for companion PR #6112 OMN-15567 * evidence(OMN-15567): PENDING receipt for OCC self-bind #6112 OMN-15567 * fix(OMN-15567): independently attest stale pr-state receipts * evidence(OMN-15567): independent opus attestation of 7 rebound receipts Re-executed all 7 declared check_value probes on .200 at 2026-08-05T18:10:50Z and byte-compared stdout against each receipt's recorded probe_stdout. All 7 matched exactly (rc=0): omn15567-repair-infra-2623-merged -> "true\n" omn15567-repair-infra-2628-open-check-merged -> "true\n" omn15567-repair-infra-2628-7d8e810f-merged -> "true\n" omn15567-repair-occ-5939-merged -> "true\n" omn15567-repair-occ-5960-merged -> "true\n" omn15567-repair-occ-5964-merged -> "true\n" occ-self-bind-pr-6112 -> {"number":6112,"state":"OPEN"} Also re-verified all 7 contract_entry_sha256 values against compute_contract_entry_sha256(contracts/OMN-15567.yaml) -- all match. Replaces the verifier string written by a concurrent lane ("codex:merge-sweep-20260805T1804Z", commit f53a9ea) with this session's identity, because this is the attestation backed by probe re-execution that this verifier actually performed. The prior value is preserved in git history; nothing is hidden. Receipt content (check_value/probe_stdout/hashes) unchanged. Verifier != runner (runner is the authoring branch), so this is a genuine independent flip, not self-attestation.
1 participant
Summary
OCC#6049 (merged 2026-08-04T16:41:34Z) appended
dod-OmniNode-ai-omnibase_infra-pr-2596-supersededintending to retire the failing pr-live-state check ondod-OmniNode-ai-omnibase_infra-pr-2596(infra#2596 is CLOSED/unmerged). Adversarial verification found the supersession did NOT take effect:_EVIDENCE_ID_BINDING_RE(^dod-(OmniNode-ai)-(repo)-pr-(\d+)(?:-.*)?$— the trailing-supersededis absorbed by the optional suffix group), binding it to infra#2596.gh api repos/OmniNode-ai/omnibase_infra/pulls/2596 ...) also matches_PR_PATH_URL_RE, independently binding it to infra#2596.node_dod_verify'sevidence_collectortherefore auto-appends a::pr-live-statecheck to the carrier itself, bound to CLOSED/unmerged evidence(OMN-13012): bind consume-leg-refresh receipt to infra code PR #1969 #2596 → FAILS._supersession_is_in_effectreturns False, so the declaredsupersedes_dod_evidence:dod-OmniNode-ai-omnibase_infra-pr-2596edge never fires. The original entry executes normally and also fails its own live-state check.Net effect of #6049 as merged: 2 FAILED pr-live-state entries, not 0 — dod_verify does not actually clear.
Fix
Append a new entry (
dod-omn-15422-repair-supersede-v2) declaringevidence_artifact: supersedes_dod_evidence:dod-OmniNode-ai-omnibase_infra-pr-2596-superseded— chaining onto the broken carrier itself, not the original target._terminal_supersederwalks the chain (dod-...-pr-2596→dod-...-pr-2596-superseded→ this entry), so both upstream entries resolve to this entry's verdict.This entry's own id does not match the autobind PR-binding regex (owner segment is
omn, notOmniNode-ai), and itscheck_valuebinds only to the MERGED infra#2597 (same head commit as #2596,8e77577347ac8d5d99d0e8ecf0c930a69376013a; mergeCommit79df552112854f1a0ce41e2b065e42864c8053ee). Its own auto-appended live-PR-state check therefore VERIFIES, satisfying the anti-laundering requirement (_supersession_is_in_effect) that a superseder prove something in its own right.Verified live:
Append-only — no existing entry edited or removed.
Evidence-Ticket: OMN-15422
Evidence-Source: OCC#6049
Summary by CodeRabbit