fix(OMN-15689): supersede gamed #6051 receipt with independently-verified attestation by jonahgabriel · Pull Request #6060 · OmniNode-ai/onex_change_control

jonahgabriel · 2026-08-04T17:46:49Z

Cites OMN-15689.

Defect (round-3 DEFECT 4, filed against a receipt this agent did not author)

drift/dod_receipts/OMN-15689/dod-OmniNode-ai-onex_change_control-pr-6051/command.yaml records
runner=remediation-agent-omn-15689-round2 and verifier=occ-preflight-eligibility-validator with
status: PASS. occ-preflight-eligibility-validator names a CI component that performs no independent
verification of receipt content — it only matches receipt.pr_number to the live PR snapshot — chosen
specifically so the literal string differs from runner and dodges the Receipt Honesty Gate's Rule C
(SELF_ATTESTATION, verifier == runner text comparison) without any actual independent party
re-executing the probe. The receipt's probe_stdout also attests {"number":6051,"state":"OPEN"} for a
PR that is now MERGED. This is the exact gamed-receipt class the platform's honesty rules exist to catch,
and it is live on dev.

Live re-verification (this session)

$ gh pr view 6051 --repo OmniNode-ai/onex_change_control --json number,state,mergeCommit,mergedAt
{"mergeCommit":{"oid":"20a07e0854124eff3a1dedea38045752f79c6920"},"mergedAt":"2026-08-04T17:03:53Z","number":6051,"state":"MERGED"}

Change (append-only, mirrors the OMN-15422 #6049/#6052 supersession pattern)

Appends dod-OmniNode-ai-occ-pr-6051-superseded to contracts/OMN-15689.yaml with
evidence_artifact: "supersedes_dod_evidence:dod-OmniNode-ai-onex_change_control-pr-6051" and a
check_value that re-asserts the live PR state (number,state,mergeCommit,mergedAt). Adds the paired PASS
receipt at drift/dod_receipts/OMN-15689/dod-OmniNode-ai-occ-pr-6051-superseded/command.yaml with
runner=receipt-honesty-remediation-agent-omn-15689-round3 and verifier=verify:corrections-opus — a
genuinely distinct workflow lane that independently re-executes the same probe in its own verification
pass (a real second execution, not a renamed field), carrying fresh probe_stdout showing MERGED. No
existing content is modified or deleted — the gamed receipt and its contract entry stay verbatim above
for audit.

Local gates verified: check_receipt_honesty() returns zero violations on the new receipt; pre-commit
Receipt Honesty Gate (OMN-12791), Receipt Hardening Gate (OMN-13060), and
Evidence-Commit SHA Existence Gate (OMN-15111) all passed on this diff.

Note on the `.200` gate-run exception (rule 11a)

.200 (stickybeatz-studio) ssh is currently broken for agents (Permission denied). This change is
YAML-only (contract + receipt, no source), gated locally via pre-commit run --all-files per the stated
exception.

Evidence-Ticket: OMN-15689
Evidence-Source: OCC#6063

…fied attestation Cites OMN-15689.

Cites OMN-15689.

coderabbitai · 2026-08-04T17:46:58Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 11 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 59280875-9fbd-42ce-9855-bf98053d24dc

📥 Commits

Reviewing files that changed from the base of the PR and between c6ef45b and d2435b6.

📒 Files selected for processing (3)

contracts/OMN-15689.yaml
drift/dod_receipts/OMN-15689/dod-OmniNode-ai-occ-pr-6051-superseded/command.yaml
drift/dod_receipts/OMN-15689/occ-self-bind-pr-6060/command.yaml

_{Comment @coderabbitai help to get the list of available commands.}

Cites OMN-15689.

onexbot-occ-writer · 2026-08-04T17:47:36Z

OCC autobind stood down for OmniNode-ai/onex_change_control#6060 (OMN-15689): this PR (hand_authored) already carries evidence for that ticket, so no competing companion was minted (OMN-15247 defer-on-contention).

onexbot-occ-writer · 2026-08-04T17:47:54Z

OCC autobind stood down for OmniNode-ai/onex_change_control#6061 (OMN-15689): this PR (hand_authored) already carries evidence for that ticket, so no competing companion was minted (OMN-15247 defer-on-contention).

Cites OMN-15689.

occ-preflight/eligibility on OCC#6061 (run 30936850262) FAILED with reason=pr_ticket_mismatch: no PASS receipt for OMN-15689 bound to PR #6061 or its commit SHAs existed. Prior self-bind receipts bound only to #6046 and (on later dev history) #6060 — #6061's in-tree contract (invariant I3) had no entry for itself. Appends occ-self-bind-pr-6061 (contract dod_evidence entry + PASS receipt) following the exact occ-self-bind-pr-6046/6060 pattern. Append-only: does not touch the gate-dynamization content #6061 ships (ci.yml honesty-gate / append-only-gate / validate-validator-requirements.yml dynamic ref resolution) or any prior receipt. OMN-15689

* evidence: OCC companion pass 1 for #6060 * evidence: OCC companion self-bind for #6063 * evidence(OMN-15689): bind OCC companion to PR 6060 receipt * chore(OMN-15689): retrigger stale required checks for PR 6063 --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai> Co-authored-by: Jonah Gray <jonah@omninode.ai>

@main

…lidator refs dynamically (AC(e) residual) (#6061) * fix(OMN-15689): derive Receipt Honesty Gate + OCC Append-Only Gate validator refs dynamically (AC(e) residual) R3a operator ruling (no hardcoded omnibase_core validator ref ANYWHERE — not @main, not @dev, not a literal SHA) already fixed call-receipt-gate.yml and call-occ-preflight.yml. This closes the remaining in-scope residual: ci.yml's honesty-gate (Receipt Honesty Gate, REQUIRED on main) and append-only-gate (OCC Append-Only Gate) jobs each checked out omnibase_core at a hardcoded commit SHA (d4884c590... / f873d8307...), the same live-skew risk the ruling fixed elsewhere — a validator fix merged to omnibase_core dev could not reach these in-repo gates until someone manually bumped the SHA, and the two pins could (and did) drift out of the "bump alongside" lockstep the old comment asked for. Both jobs now carry a "Resolve omnibase_core validator ref" step, reusing the exact pattern call-receipt-gate.yml established post-#6045 (steps.validator_ref.outputs.ref feeding the checkout ref, fail-closed with no fallback). ci.yml runs on more event types than the PR-only reusable callers, so the resolution step handles the full matrix: - pull_request -> github.event.pull_request.base.ref - merge_group -> github.event.merge_group.base_ref - push / workflow_dispatch -> github.ref_name (the branch pushed to, or the branch selected in the manual-dispatch UI) -- dynamically resolved, never a hardcoded literal. None of the four resolves -> the job fails closed before any omnibase_core checkout is attempted. Scope discipline: only these two in-repo gate-validator SHA pins were touched, per explicit dispatch instruction. 9 other hardcoded `uses:`/`ref:` pins exist across OCC workflows (3x omniclaude reusable @dev, 4x omnibase_core zone-filter@dev, 1x omnibase_core validate-docs.yml@main, 1x omnimarket merge-hold-gate@SHA) -- these are cross-repo REUSABLE-WORKFLOW `uses:` pins (GitHub accepts only a literal ref there, no expressions), a different mechanism class than the checkout+ref pattern used here. Not touched; inventory commented onto OMN-15689 for operator scoping. OMN-15689 * fix(OMN-15689): dynamically resolve validate-validator-requirements.yml omnibase_core ref Corrections-pass DEFECT 1: the AC(e) out-of-scope inventory omitted validate-validator-requirements.yml:44, a hardcoded literal-SHA checkout of OmniNode-ai/omnibase_core carrying a manual-bump comment — same repo, same validator-code class, same live-skew failure mode as the ci.yml:997/1062 pins this lane already fixed. Applies the identical steps.validator_ref.outputs.ref resolver pattern (PR base ref / merge group base ref / push-dispatch ref_name, fail-closed on none), no fallback literal. ci.yml:1329 (the OMNICLAUDE_PIN, a documented deliberate merged-commit pin backing the OMN-14505 predicate) is out of scope for this fix and is cited with its rationale in the amended Linear inventory instead. * fix(OMN-15689): bind OCC receipt to PR #6061 (pr_ticket_mismatch) occ-preflight/eligibility on OCC#6061 (run 30936850262) FAILED with reason=pr_ticket_mismatch: no PASS receipt for OMN-15689 bound to PR #6061 or its commit SHAs existed. Prior self-bind receipts bound only to #6046 and (on later dev history) #6060 — #6061's in-tree contract (invariant I3) had no entry for itself. Appends occ-self-bind-pr-6061 (contract dod_evidence entry + PASS receipt) following the exact occ-self-bind-pr-6046/6060 pattern. Append-only: does not touch the gate-dynamization content #6061 ships (ci.yml honesty-gate / append-only-gate / validate-validator-requirements.yml dynamic ref resolution) or any prior receipt. OMN-15689

jonahgabriel added 2 commits August 4, 2026 13:45

fix(OMN-15689): supersede gamed #6051 receipt with independently-veri…

8903c95

…fied attestation Cites OMN-15689.

fix(OMN-15689): PASS receipt for supersession of gamed #6051 attestation

c14f64e

Cites OMN-15689.

fix(OMN-15689): occ-self-bind for PR #6060

14b04ae

Cites OMN-15689.

fix(OMN-15689): PASS receipt for occ-self-bind-pr-6060

d2435b6

Cites OMN-15689.

onexbot-occ-writer Bot mentioned this pull request Aug 4, 2026

evidence(OMN-15689): OCC companion for OmniNode-ai/onex_change_control#6060 #6063

Merged

jonahgabriel merged commit 960858b into dev Aug 4, 2026
68 of 69 checks passed

jonahgabriel deleted the jonah/omn-15689-receipt-honesty-correction branch August 4, 2026 18:02

Navigation Menu

Repository navigation

fix(OMN-15689): supersede gamed #6051 receipt with independently-verified attestation - #6060

fix(OMN-15689): supersede gamed #6051 receipt with independently-verified attestation#6060
jonahgabriel merged 4 commits into
devfrom
jonah/omn-15689-receipt-honesty-correction

jonahgabriel commented Aug 4, 2026 •

edited by onexbot-occ-writer Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

Review limit reached

Uh oh!

onexbot-occ-writer Bot commented Aug 4, 2026

Uh oh!

onexbot-occ-writer Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jonahgabriel commented Aug 4, 2026 • edited by onexbot-occ-writer Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Defect (round-3 DEFECT 4, filed against a receipt this agent did not author)

Live re-verification (this session)

Change (append-only, mirrors the OMN-15422 #6049/#6052 supersession pattern)

Note on the .200 gate-run exception (rule 11a)

Uh oh!

coderabbitai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

onexbot-occ-writer Bot commented Aug 4, 2026

Uh oh!

onexbot-occ-writer Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jonahgabriel commented Aug 4, 2026 •

edited by onexbot-occ-writer Bot

Loading

Note on the `.200` gate-run exception (rule 11a)

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading