diff --git a/contracts/OMN-15422.yaml b/contracts/OMN-15422.yaml index 2b1118dd659..29c633402fd 100644 --- a/contracts/OMN-15422.yaml +++ b/contracts/OMN-15422.yaml @@ -89,6 +89,38 @@ dod_evidence: checks: - check_type: "command" check_value: "gh pr view 6049 --repo OmniNode-ai/onex_change_control --json number,state" + - id: "dod-omn-15422-repair-supersede-v2" + description: >- + Chained append-only repair of dod-OmniNode-ai-omnibase_infra-pr-2596-superseded (merged in #6049). + That carrier does NOT retire the failure it targets: its OWN id (dod-OmniNode-ai-omnibase_infra-pr-2596-superseded) + matches the autobind id-binding regex `^dod-(OmniNode-ai)-(repo)-pr-(\d+)(?:-.*)?$` (trailing `-superseded` + absorbed by the optional suffix group), and its own check_value (`gh api repos/OmniNode-ai/omnibase_infra/pulls/2596 + ...`) matches the hardcoded PR-path binding regex too — both independently bind it to OmniNode-ai/omnibase_infra#2596, + which is CLOSED and unmerged (confirmed live via `gh pr view 2596 --repo OmniNode-ai/omnibase_infra`: + state=CLOSED, merged_at=null). node_dod_verify's evidence_collector therefore auto-appends a ::pr-live-state + check to THAT CARRIER bound to #2596, which FAILS. Because the carrier's own result group then contains + a FAILED entry, `_supersession_is_in_effect` returns False, so the edge it declares (supersedes_dod_evidence: + dod-OmniNode-ai-omnibase_infra-pr-2596) never takes effect: the original #2596 entry is NOT marked + superseded and executes normally, ALSO failing its own auto-appended live-PR-state check. Net effect + of #6049 as merged: two FAILED pr-live-state entries where the intent was zero. This entry appends + a NEW supersession edge — evidence_artifact supersedes_dod_evidence:dod-OmniNode-ai-omnibase_infra-pr-2596-superseded + — targeting the BROKEN CARRIER itself, not the original #2596 entry. `_terminal_superseder` walks + the chain from the original target (dod-...-pr-2596) through its declared carrier (dod-...-pr-2596-superseded) + to THIS entry, so both upstream entries resolve to THIS entry's own result. This entry's id (`dod-omn-15422-...`) + does not match the `dod---pr-` autobind regex (owner segment is `omn`, not `OmniNode-ai`), + and its check_value below binds explicitly and only to the MERGED #2597 (same head commit 8e77577347ac8d5d99d0e8ecf0c930a69376013a + as #2596, mergeCommit 79df552112854f1a0ce41e2b065e42864c8053ee, confirmed live) — so its own auto-appended + live-PR-state check resolves against a merged PR and VERIFIES, satisfying the anti-laundering requirement + that a superseder prove something in its own right. The evidence content itself (scripts/ci/check_application_database_sql.py + at that ref, containing `def _is_non_deployable_sql_path`) remains bound and PASS-receipted separately + under dod-OmniNode-ai-omnibase_infra-pr-2597 — nothing here re-derives that content, only the PR-state + chain is repaired. + source: "manual" + status: "verified" + evidence_artifact: "supersedes_dod_evidence:dod-OmniNode-ai-omnibase_infra-pr-2596-superseded" + checks: + - check_type: "command" + check_value: "gh pr view 2597 --repo OmniNode-ai/omnibase_infra --json state --jq '.state == \"MERGED\"'" - id: "occ-self-bind-pr-6050" description: "Binds OMN-15422 to OCC companion PR #6050 (self-bind)." source: "manual" @@ -96,3 +128,10 @@ dod_evidence: checks: - check_type: "command" check_value: "gh pr view 6050 --repo OmniNode-ai/onex_change_control --json number,state" + - id: "occ-self-bind-pr-6052" + description: "Binds OMN-15422 to OCC companion PR #6052 (self-bind)." + source: "manual" + status: "verified" + checks: + - check_type: "command" + check_value: "gh pr view 6052 --repo OmniNode-ai/onex_change_control --json number,state" diff --git a/drift/dod_receipts/OMN-15422/dod-omn-15422-repair-supersede-v2/command.yaml b/drift/dod_receipts/OMN-15422/dod-omn-15422-repair-supersede-v2/command.yaml new file mode 100644 index 00000000000..63ef3a9be9e --- /dev/null +++ b/drift/dod_receipts/OMN-15422/dod-omn-15422-repair-supersede-v2/command.yaml @@ -0,0 +1,40 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15422" +evidence_item_id: "dod-omn-15422-repair-supersede-v2" +check_type: "command" +check_value: |- + gh pr view 2597 --repo OmniNode-ai/omnibase_infra --json state --jq '.state == "MERGED"' +contract_sha256: "sha256:6f0326e4d0cd7162a98ceef84215af6131bb1285daae9188fda61e9ac1e398b5" +contract_entry_sha256: "sha256:3e3eac881a1a998b318c49c704708fff0d0b9af65834ad1d6b451e73f0c9209c" +status: PASS +run_timestamp: "2026-08-04T16:58:16Z" +commit_sha: "8e77577347ac8d5d99d0e8ecf0c930a69376013a" +runner: "jonah/omn-15422-repair-supersede-v2" +verifier: "jonah/omn-15422-repair-supersede-v2/occ-supersession-chain-repair-probe" +probe_command: |- + gh pr view 2597 --repo OmniNode-ai/omnibase_infra --json state --jq '.state == "MERGED"' +probe_stdout: | + true +actual_output: | + PASS, exit 0, executed verbatim as committed. This entry is the chained repair of the + supersession landed by onex_change_control#6049 (dod-OmniNode-ai-omnibase_infra-pr-2596-superseded), + which merged to dev with a defect: that carrier's own id and check_value both bind, via + node_dod_verify's evidence_collector autobind/hardcoded-PR-binding regexes, to + OmniNode-ai/omnibase_infra#2596 (CLOSED, unmerged), so its own auto-appended + ::pr-live-state check fails, `_supersession_is_in_effect` returns False, and the + supersession it declared never took effect — leaving TWO FAILED pr-live-state entries + (dod-OmniNode-ai-omnibase_infra-pr-2596 and dod-OmniNode-ai-omnibase_infra-pr-2596-superseded) + instead of zero. This entry declares evidence_artifact + supersedes_dod_evidence:dod-OmniNode-ai-omnibase_infra-pr-2596-superseded, chaining onto + the broken carrier so `_terminal_superseder` resolves BOTH upstream entries to this one. + Its own id (dod-omn-15422-repair-supersede-v2) does not match the + `dod---pr-` autobind regex, and its check_value binds only to the MERGED + #2597 (gh pr view 2597 --repo OmniNode-ai/omnibase_infra), confirmed live MERGED with + mergeCommit 79df552112854f1a0ce41e2b065e42864c8053ee — so this entry's own auto-appended + live-PR-state check VERIFIES, satisfying the anti-laundering requirement that a superseder + prove something in its own right. +exit_code: 0 +pr_number: 2597 +branch: "jonah/omn-15422-repair-supersede-v2" +no_source_change: true diff --git a/drift/dod_receipts/OMN-15422/occ-self-bind-pr-6052/command.yaml b/drift/dod_receipts/OMN-15422/occ-self-bind-pr-6052/command.yaml new file mode 100644 index 00000000000..5d45a8effe6 --- /dev/null +++ b/drift/dod_receipts/OMN-15422/occ-self-bind-pr-6052/command.yaml @@ -0,0 +1,26 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15422" +evidence_item_id: "occ-self-bind-pr-6052" +check_type: "command" +check_value: |- + gh pr view 6052 --repo OmniNode-ai/onex_change_control --json number,state +contract_sha256: "sha256:98bb52da0a2541dca4d260aec2988b7e33697e889a64fa7d6b5d3318abe387ad" +contract_entry_sha256: "sha256:7f134dad81f1272e6da5c2c2df53359f80b975ffe41a188a28215283167c966d" +status: PASS +run_timestamp: "2026-08-04T17:35:00Z" +commit_sha: "554e2a8ef4854b993f8bf94b8a9485dbeb36cfc4" +runner: "jonah/omn-15422-repair-supersede-v2" +verifier: "jonah/omn-15422-repair-supersede-v2/occ-self-bind-probe" +probe_command: |- + gh pr view 6052 --repo OmniNode-ai/onex_change_control --json number,state +probe_stdout: | + {"number":6052,"state":"OPEN"} +actual_output: | + PASS, exit 0. OCC self-bind stamp for OMN-15422 against OCC companion PR #6052, + the append-only repair PR that chains a supersession repair onto the broken + dod-OmniNode-ai-omnibase_infra-pr-2596-superseded carrier. Binding stamp only. +exit_code: 0 +pr_number: 6052 +branch: "jonah/omn-15422-repair-supersede-v2" +no_source_change: true