Repository navigation
evidence(OMN-15655): OCC companion for OmniNode-ai/omninode_infra#813 - #6079
Merged
Merged
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughWalkthroughThe change adds eight DoD evidence entries for infrastructure PR 813 and OCC companion PR 6079. The evidence covers image pins, readiness composition, file scope, evidence admissibility, and superseded PR 811 readiness evidence. ChangesPR 813 evidence
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@contracts/OMN-15655.yaml`:
- Around line 221-223: Update the DoD commands in contracts/OMN-15655.yaml at
lines 221-223, 229-231, 237-239, and 244-245 so each asserts its stated
condition: require each digest/image reference count to equal 1, parse the YAML
and validate the source revision plus both digest fields, and compare sorted PR
paths with the exact required three-path set. Regenerate the affected
contract_entry_sha256 values and receipts.
In `@drift/dod_receipts/OMN-15655/dod-node-pr813-runtime/command.yaml`:
- Around line 1-23: Rename the receipt file from command.yaml to
2026-08-04T20:04:43Z.yaml in each affected directory:
drift/dod_receipts/OMN-15655/dod-node-pr813-runtime/command.yaml (lines 1-23),
drift/dod_receipts/OMN-15655/dod-node-pr813-migration/command.yaml (lines 1-23),
drift/dod_receipts/OMN-15655/dod-node-pr813-composition/command.yaml (lines
1-23), drift/dod_receipts/OMN-15655/dod-node-pr813-ci/command.yaml (lines 1-21),
and
drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-813/command.yaml
(lines 1-23); keep each receipt under its existing ticket and evidence-item
directory.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 72672bc2-a459-4824-ad24-373ea7304481
📒 Files selected for processing (6)
contracts/OMN-15655.yamldrift/dod_receipts/OMN-15655/dod-node-pr813-ci/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr813-composition/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr813-migration/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr813-runtime/command.yamldrift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-813/command.yaml
Comment on lines
+221
to
+223
| - check_type: "command" | ||
| check_value: |- | ||
| gh api 'repos/OmniNode-ai/omninode_infra/contents/k8s/onex-dev/runtime/kustomization.yaml?ref=627422691530f996fadfaecf378a410d11212401' --jq '.content' | base64 -d | grep -c 'sha256:8535742ee43968809e3efe7ed87a4cf7a9ff8621b22fe46f10e0860290dc1c7d' |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Make each DoD command assert its stated condition.
These commands can succeed without proving the described evidence. grep -c accepts duplicate pins. The composition pipeline succeeds with zero matches because wc -l is the final command. The scope command does not compare the returned paths.
contracts/OMN-15655.yaml#L221-L223: require the runtime digest count to equal1.contracts/OMN-15655.yaml#L229-L231: require the migration image reference count to equal1.contracts/OMN-15655.yaml#L237-L239: parse the YAML and assert the required source revision and both digest fields.contracts/OMN-15655.yaml#L244-L245: compare the sorted PR file paths to the required three-path set.
Regenerate the affected contract_entry_sha256 values and receipts after this change.
📍 Affects 1 file
contracts/OMN-15655.yaml#L221-L223(this comment)contracts/OMN-15655.yaml#L229-L231contracts/OMN-15655.yaml#L237-L239contracts/OMN-15655.yaml#L244-L245
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@contracts/OMN-15655.yaml` around lines 221 - 223, Update the DoD commands in
contracts/OMN-15655.yaml at lines 221-223, 229-231, 237-239, and 244-245 so each
asserts its stated condition: require each digest/image reference count to equal
1, parse the YAML and validate the source revision plus both digest fields, and
compare sorted PR paths with the exact required three-path set. Regenerate the
affected contract_entry_sha256 values and receipts.
Comment on lines
+1
to
+23
| --- | ||
| schema_version: "1.0.0" | ||
| ticket_id: "OMN-15655" | ||
| evidence_item_id: "dod-node-pr813-runtime" | ||
| check_type: "command" | ||
| check_value: |- | ||
| gh api 'repos/OmniNode-ai/omninode_infra/contents/k8s/onex-dev/runtime/kustomization.yaml?ref=627422691530f996fadfaecf378a410d11212401' --jq '.content' | base64 -d | grep -c 'sha256:8535742ee43968809e3efe7ed87a4cf7a9ff8621b22fe46f10e0860290dc1c7d' | ||
| contract_sha256: "sha256:ccb4ee488bae7792219596dd57552e879b62634bc38f8a16fdb67998bdadc7c8" | ||
| contract_entry_sha256: "sha256:48f656f52c87f577081c036f612b8d6e0cde2f21c2f75a59ef1411d86395cded" | ||
| status: PASS | ||
| run_timestamp: "2026-08-04T20:04:43Z" | ||
| commit_sha: "627422691530f996fadfaecf378a410d11212401" | ||
| runner: "codex-merge-sweep-0804" | ||
| verifier: "codex-occ-pr813-probe" | ||
| probe_command: |- | ||
| gh api 'repos/OmniNode-ai/omninode_infra/contents/k8s/onex-dev/runtime/kustomization.yaml?ref=627422691530f996fadfaecf378a410d11212401' --jq '.content' | base64 -d | grep -c 'sha256:8535742ee43968809e3efe7ed87a4cf7a9ff8621b22fe46f10e0860290dc1c7d' | ||
| probe_stdout: | | ||
| 1 | ||
| actual_output: "PASS: PR #813 runtime Kustomize file at head 627422691530f996fadfaecf378a410d11212401 | ||
| contains exactly one pin to runtime digest sha256:8535742ee43968809e3efe7ed87a4cf7a9ff8621b22fe46f10e0860290dc1c7d." | ||
| exit_code: 0 | ||
| pr_number: 813 | ||
| branch: "jonah/omn-15655-occ-node-pr813" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Use the required timestamp receipt filenames.
Each receipt is stored as command.yaml. Store each receipt as 2026-08-04T20:04:43Z.yaml under its existing ticket and evidence-item directory.
drift/dod_receipts/OMN-15655/dod-node-pr813-runtime/command.yaml#L1-L23: rename to the run-timestamp filename.drift/dod_receipts/OMN-15655/dod-node-pr813-migration/command.yaml#L1-L23: rename to the run-timestamp filename.drift/dod_receipts/OMN-15655/dod-node-pr813-composition/command.yaml#L1-L23: rename to the run-timestamp filename.drift/dod_receipts/OMN-15655/dod-node-pr813-ci/command.yaml#L1-L21: rename to the run-timestamp filename.drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-813/command.yaml#L1-L23: rename to the run-timestamp filename.
As per coding guidelines: Store DoD receipts only at drift/dod_receipts/<TICKET>/<ITEM_ID>/<run_timestamp>.yaml.
📍 Affects 5 files
drift/dod_receipts/OMN-15655/dod-node-pr813-runtime/command.yaml#L1-L23(this comment)drift/dod_receipts/OMN-15655/dod-node-pr813-migration/command.yaml#L1-L23drift/dod_receipts/OMN-15655/dod-node-pr813-composition/command.yaml#L1-L23drift/dod_receipts/OMN-15655/dod-node-pr813-ci/command.yaml#L1-L21drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-813/command.yaml#L1-L23
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@drift/dod_receipts/OMN-15655/dod-node-pr813-runtime/command.yaml` around
lines 1 - 23, Rename the receipt file from command.yaml to
2026-08-04T20:04:43Z.yaml in each affected directory:
drift/dod_receipts/OMN-15655/dod-node-pr813-runtime/command.yaml (lines 1-23),
drift/dod_receipts/OMN-15655/dod-node-pr813-migration/command.yaml (lines 1-23),
drift/dod_receipts/OMN-15655/dod-node-pr813-composition/command.yaml (lines
1-23), drift/dod_receipts/OMN-15655/dod-node-pr813-ci/command.yaml (lines 1-21),
and
drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-813/command.yaml
(lines 1-23); keep each receipt under its existing ticket and evidence-item
directory.
Source: Coding guidelines
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml (1)
1-24: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winUse timestamped filenames for both receipts.
Both files use
command.yaml, but the required path isdrift/dod_receipts/<TICKET>/<ITEM_ID>/<run_timestamp>.yaml.
drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml#L1-L24: rename the file using run timestamp2026-08-04T20:20:43Z.drift/dod_receipts/OMN-15655/occ-self-bind-pr-6079/command.yaml#L1-L21: rename the file using run timestamp2026-08-04T20:11:31Z.As per coding guidelines, DoD receipts must use the timestamped filename pattern.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml` around lines 1 - 24, Rename drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml to 2026-08-04T20:20:43Z.yaml, preserving its contents; likewise rename drift/dod_receipts/OMN-15655/occ-self-bind-pr-6079/command.yaml to 2026-08-04T20:11:31Z.yaml, so both receipts follow the required timestamped filename pattern.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml`:
- Around line 7-20: Update the probe_command for PR `#811` to parse the full
GitHub contents response, assert the response sha equals
fb65d3be0f4c5d51e5e3c5820c75df9bc023856a, and assert the response commit
identifies PR `#811`’s merged commit before decoding content. Preserve the
existing YAML assertions after decoding the validated content.
- Line 7: Update the receipt validation command in check_value and probe_command
to replace Python assert statements with explicit comparisons that report
mismatches and exit non-zero. Change receipt output to use a generated run
timestamp filename under the existing dod-node-pr811-repin-blob directory
instead of command.yaml.
In `@drift/dod_receipts/OMN-15655/occ-self-bind-pr-6079/command.yaml`:
- Around line 6-17: The OCC verification command and validation must enforce the
complete self-bind identity. Update the check around check_value, probe_command,
and probe_stdout to query number,state,headRefOid,headRefName, then require PR
6079, state OPEN, head SHA cfe33594b52e643c7b6624bd14db104e73017b8a, and branch
jonah/omn-15655-occ-node-pr813; update actual_output to include the matching
head SHA and branch.
---
Outside diff comments:
In `@drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml`:
- Around line 1-24: Rename
drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml to
2026-08-04T20:20:43Z.yaml, preserving its contents; likewise rename
drift/dod_receipts/OMN-15655/occ-self-bind-pr-6079/command.yaml to
2026-08-04T20:11:31Z.yaml, so both receipts follow the required timestamped
filename pattern.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a6f7ddce-cb7e-4017-94db-335cc7371294
📒 Files selected for processing (8)
contracts/OMN-15655.yamldrift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr813-ci/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr813-composition/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr813-migration/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr813-runtime/command.yamldrift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-813/command.yamldrift/dod_receipts/OMN-15655/occ-self-bind-pr-6079/command.yaml
🚧 Files skipped from review as they are similar to previous changes (6)
- drift/dod_receipts/OMN-15655/dod-node-pr813-runtime/command.yaml
- drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-813/command.yaml
- drift/dod_receipts/OMN-15655/dod-node-pr813-migration/command.yaml
- drift/dod_receipts/OMN-15655/dod-node-pr813-ci/command.yaml
- drift/dod_receipts/OMN-15655/dod-node-pr813-composition/command.yaml
- contracts/OMN-15655.yaml
| evidence_item_id: "dod-node-pr811-repin-blob" | ||
| check_type: "command" | ||
| check_value: |- | ||
| gh api 'repos/OmniNode-ai/omninode_infra/contents/k8s/onex-dev/readiness/staging-composition.canonical-dev.v1.yaml?ref=cf9f737c03ffb3e9940c17edc8865c9f0f061655' --jq .content | base64 -d | python3 -c 'import sys,yaml; doc=yaml.safe_load(sys.stdin.read()); assert doc["source_rev"]=="2e5ef7da5d08df9f1bcbe7eff58eed696c14d1e4"; assert doc["runtime"]["image"]["digest"]=="sha256:5507667152e2dc420fc4dd6bd337f8dbe2ecf592939572dc8f353efb10a05dd6"; assert doc["migrations"]["image"]["digest"]=="sha256:b1e2a561cc48aac49b36b6746f6d2df0afedb4bfa43aacb20f340e1eb4d2f0a2"; print("true")' |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
PYTHONOPTIMIZE=1 python3 -c 'assert False; print("true")'Repository: OmniNode-ai/onex_change_control
Length of output: 174
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- target receipt ---'
cat -n drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml
printf '%s\n' '--- receipt files in scope ---'
git ls-files 'drift/dod_receipts/OMN-15655/**'
printf '%s\n' '--- assert usage in target receipt ---'
rg -n -C 2 '\bassert\b|python3' drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 7033
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- optimization-related runner configuration ---'
rg -n -i 'PYTHONOPTIMIZE|python[[:space:]]+-O|python3[[:space:]]+-O|codex-merge-sweep-0804|runner:' \
.github drift README.md 2>/dev/null || true
printf '%s\n' '--- comparable command receipts using assert ---'
rg -n -B 2 -A 2 '\bassert\b' drift/dod_receipts/OMN-15655 --glob '*.yaml' || true
printf '%s\n' '--- explicit-failure behavior ---'
python3 - <<'PY'
import os
import subprocess
import sys
code = 'if False: raise AssertionError("must fail")\nprint("true")'
for env_value in (None, "1"):
env = os.environ.copy()
if env_value is None:
env.pop("PYTHONOPTIMIZE", None)
else:
env["PYTHONOPTIMIZE"] = env_value
result = subprocess.run(
[sys.executable, "-c", code],
env=env,
text=True,
capture_output=True,
)
print(f"PYTHONOPTIMIZE={env_value!r}: exit={result.returncode}, stdout={result.stdout.strip()!r}")
PYRepository: OmniNode-ai/onex_change_control
Length of output: 50388
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- target runner and probe fields ---'
sed -n '10,23p' drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml
printf '%s\n' '--- relevant optimization matches only ---'
rg -n -i 'PYTHONOPTIMIZE|python[[:space:]]+-O|python3[[:space:]]+-O' .github drift README.md 2>/dev/null | head -80 || true
printf '%s\n' '--- probe semantics with an invalid document ---'
python3 - <<'PY'
import os
import subprocess
import sys
code = (
'import yaml; '
'doc=yaml.safe_load("source_rev: wrong\\n"); '
'assert doc["source_rev"]=="expected"; '
'print("true")'
)
env = os.environ.copy()
env["PYTHONOPTIMIZE"] = "1"
result = subprocess.run(
[sys.executable, "-c", code],
env=env,
text=True,
capture_output=True,
)
print(f"optimized_exit={result.returncode}")
print(f"optimized_stdout={result.stdout.strip()!r}")
print(f"optimized_stderr={result.stderr.strip()!r}")
PYRepository: OmniNode-ai/onex_change_control
Length of output: 1515
Replace Python assert with explicit failures and use a timestamped receipt filename.
- Replace the
assertchecks incheck_valueandprobe_commandwith explicit comparisons that return a non-zero status. - Store the receipt at
drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/<run_timestamp>.yaml, notcommand.yaml.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml` at line
7, Update the receipt validation command in check_value and probe_command to
replace Python assert statements with explicit comparisons that report
mismatches and exit non-zero. Change receipt output to use a generated run
timestamp filename under the existing dod-node-pr811-repin-blob directory
instead of command.yaml.
Comment on lines
+7
to
+20
| gh api 'repos/OmniNode-ai/omninode_infra/contents/k8s/onex-dev/readiness/staging-composition.canonical-dev.v1.yaml?ref=cf9f737c03ffb3e9940c17edc8865c9f0f061655' --jq .content | base64 -d | python3 -c 'import sys,yaml; doc=yaml.safe_load(sys.stdin.read()); assert doc["source_rev"]=="2e5ef7da5d08df9f1bcbe7eff58eed696c14d1e4"; assert doc["runtime"]["image"]["digest"]=="sha256:5507667152e2dc420fc4dd6bd337f8dbe2ecf592939572dc8f353efb10a05dd6"; assert doc["migrations"]["image"]["digest"]=="sha256:b1e2a561cc48aac49b36b6746f6d2df0afedb4bfa43aacb20f340e1eb4d2f0a2"; print("true")' | ||
| contract_sha256: "sha256:f3db45a0a18dd898120c70333c3a6f1709d8b9954cb9a17790f643df23f231d8" | ||
| contract_entry_sha256: "sha256:0cc567cc0b64076412c9ecd6a9b2847d067b2f1abb131b0da15249f4d5de3357" | ||
| status: PASS | ||
| run_timestamp: "2026-08-04T20:20:43Z" | ||
| commit_sha: "88a7327782598619515135443cf76e547c221c07" | ||
| runner: "codex-merge-sweep-0804" | ||
| verifier: "codex-occ-pr813-probe" | ||
| probe_command: |- | ||
| gh api 'repos/OmniNode-ai/omninode_infra/contents/k8s/onex-dev/readiness/staging-composition.canonical-dev.v1.yaml?ref=cf9f737c03ffb3e9940c17edc8865c9f0f061655' --jq .content | base64 -d | python3 -c 'import sys,yaml; doc=yaml.safe_load(sys.stdin.read()); assert doc["source_rev"]=="2e5ef7da5d08df9f1bcbe7eff58eed696c14d1e4"; assert doc["runtime"]["image"]["digest"]=="sha256:5507667152e2dc420fc4dd6bd337f8dbe2ecf592939572dc8f353efb10a05dd6"; assert doc["migrations"]["image"]["digest"]=="sha256:b1e2a561cc48aac49b36b6746f6d2df0afedb4bfa43aacb20f340e1eb4d2f0a2"; print("true")' | ||
| probe_stdout: | | ||
| true | ||
| actual_output: "PASS: immutable blob fb65d3be0f4c5d51e5e3c5820c75df9bc023856a contains the merged PR #811 | ||
| readiness composition source_rev and runtime/migration digests." |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
expected_commit=cf9f737c03ffb3e9940c17edc8865c9f0f061655
expected_blob=fb65d3be0f4c5d51e5e3c5820c75df9bc023856a
test "$(gh pr view 811 --repo OmniNode-ai/omninode_infra \
--json mergeCommit --jq '.mergeCommit.oid')" = "$expected_commit"
test "$(gh api \
"repos/OmniNode-ai/omninode_infra/contents/k8s/onex-dev/readiness/staging-composition.canonical-dev.v1.yaml?ref=$expected_commit" \
--jq '.sha')" = "$expected_blob"Repository: OmniNode-ai/onex_change_control
Length of output: 269
🏁 Script executed:
set -euo pipefail
printf '%s\n' '--- receipt file ---'
cat -n drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml
printf '%s\n' '--- related references ---'
rg -n -C 2 'PR.?811|pr.?811|cf9f737c03ffb3e9940c17edc8865c9f0f061655|fb65d3be0f4c5d51e5e3c5820c75df9bc023856a|omninode_infra' drift .github README.md 2>/dev/null || true
printf '%s\n' '--- external repository metadata ---'
for endpoint in \
'repos/OmniNode-ai/omninode_infra' \
'repos/OmniNode-ai/omninode_infra/pulls/811' \
'repos/OmniNode-ai/omninode_infra/commits/cf9f737c03ffb3e9940c17edc8865c9f0f061655' \
'repos/OmniNode-ai/omninode_infra/contents/k8s/onex-dev/readiness/staging-composition.canonical-dev.v1.yaml?ref=cf9f737c03ffb3e9940c17edc8865c9f0f061655'
do
printf '\n[%s]\n' "$endpoint"
gh api "$endpoint" --jq '{message,full_name,state,number,merged,merge_commit_sha,sha,type}' 2>&1 || true
doneRepository: OmniNode-ai/onex_change_control
Length of output: 50388
🏁 Script executed:
set -euo pipefail
log=/tmp/coderabbit-shell-logs/shell-output-Ds0hdg
printf '%s\n' '--- target receipt ---'
sed -n '1,80p' drift/dod_receipts/OMN-15655/OMN-15655/dod-node-pr811-repin-blob/command.yaml 2>/dev/null || \
sed -n '1,80p' drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml
printf '%s\n' '--- external API result markers ---'
rg -n -A 8 -B 2 '^--- external repository metadata ---|^\[repos/' "$log" | tail -n 120
printf '%s\n' '--- target-specific repository references ---'
rg -n -A 35 -B 5 'dod-node-pr811-repin-blob|cf9f737c03ffb3e9940c17edc8865c9f0f061655|fb65d3be0f4c5d51e5e3c5820c75df9bc023856a' "$log" | head -n 250Repository: OmniNode-ai/onex_change_control
Length of output: 21753
Bind the revision and blob to PR #811. The probe checks only .content. Add assertions for PR #811's merged commit and the contents response .sha == fb65d3be0f4c5d51e5e3c5820c75df9bc023856a before decoding the content.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@drift/dod_receipts/OMN-15655/dod-node-pr811-repin-blob/command.yaml` around
lines 7 - 20, Update the probe_command for PR `#811` to parse the full GitHub
contents response, assert the response sha equals
fb65d3be0f4c5d51e5e3c5820c75df9bc023856a, and assert the response commit
identifies PR `#811`’s merged commit before decoding content. Preserve the
existing YAML assertions after decoding the validated content.
Source: Learnings
Comment on lines
+6
to
+17
| check_value: "gh pr view 6079 --repo OmniNode-ai/onex_change_control --json number,state" | ||
| contract_sha256: "sha256:f3db45a0a18dd898120c70333c3a6f1709d8b9954cb9a17790f643df23f231d8" | ||
| contract_entry_sha256: "sha256:b1f885ae1edd658b1971509d1cb56ad0929934064970829d3b5f44b2c7324cc5" | ||
| status: PASS | ||
| run_timestamp: "2026-08-04T20:11:31Z" | ||
| commit_sha: "cfe33594b52e643c7b6624bd14db104e73017b8a" | ||
| runner: "codex-merge-sweep-0804" | ||
| verifier: "codex-occ-pr813-probe" | ||
| probe_command: "gh pr view 6079 --repo OmniNode-ai/onex_change_control --json number,state" | ||
| probe_stdout: | | ||
| {"number":6079,"state":"OPEN"} | ||
| actual_output: "PASS: OCC self-bind for OMN-15655 (OCC#6079)." |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target receipt ---'
cat -n drift/dod_receipts/OMN-15655/occ-self-bind-pr-6079/command.yaml
printf '%s\n' '--- nearby receipt files ---'
find drift/dod_receipts/OMN-15655 -maxdepth 3 -type f -print | sort
printf '%s\n' '--- receipt schema and self-bind references ---'
rg -n -S 'ModelDodReceipt|headRefOid|headRefName|occ-self-bind|self-bind|commit_sha|branch:' drift . \
-g '*.py' -g '*.yaml' -g '*.yml' -g '*.md' | head -250Repository: OmniNode-ai/onex_change_control
Length of output: 35122
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- OMN-15655 contract entries ---'
rg -n -A18 -B4 'occ-self-bind-pr-6079|6079|jonah/omn-15655-occ-node-pr813|cfe33594b52e643c7b6624bd14db104e73017b8a' \
contracts drift/dod_receipts/OMN-15655
printf '%s\n' '--- comparable self-bind receipt shapes ---'
for f in \
drift/dod_receipts/OMN-13710/dod-occ-self/command.yaml \
drift/dod_receipts/OMN-14835/occ-self-bind-pr-4459/command.yaml \
drift/dod_receipts/OMN-11994/dod-occ-pr-1601/command.yaml
do
if [ -f "$f" ]; then
echo "### $f"
cat -n "$f"
fi
done
printf '%s\n' '--- ModelDodReceipt definitions and receipt validators ---'
rg -n -A35 -B8 'class ModelDodReceipt|ModelDodReceipt' src tests \
-g '*.py' | head -300
printf '%s\n' '--- relevant coding guidance ---'
cat -n CLAUDE.md | sed -n '25,48p'Repository: OmniNode-ai/onex_change_control
Length of output: 44410
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json
import re
from pathlib import Path
receipt_path = Path("drift/dod_receipts/OMN-15655/occ-self-bind-pr-6079/command.yaml")
contract_path = Path("contracts/OMN-15655.yaml")
receipt = receipt_path.read_text()
contract = contract_path.read_text()
def scalar(name, text):
match = re.search(rf'^{re.escape(name)}:\s*["\']?(.*?)["\']?\s*$', text, re.MULTILINE)
if not match:
raise AssertionError(f"missing {name}")
return match.group(1)
check_value = scalar("check_value", receipt)
probe_command = scalar("probe_command", receipt)
probe_match = re.search(r"^ (\{.*\})$", receipt, re.MULTILINE)
if not probe_match:
raise AssertionError("missing probe_stdout JSON")
probe = json.loads(probe_match.group(1))
required = {
"number": 6079,
"state": "OPEN",
"headRefOid": "cfe33594b52e643c7b6624bd14db104e73017b8a",
"headRefName": "jonah/omn-15655-occ-node-pr813",
}
requested = set(re.search(r"--json ([^ ]+)", check_value).group(1).split(","))
assert check_value == probe_command
assert requested == {"number", "state"}
assert set(required) - set(probe) == {"headRefOid", "headRefName"}
assert probe["number"] == required["number"]
assert probe["state"] == required["state"]
assert scalar("commit_sha", receipt) == required["headRefOid"]
assert scalar("branch", receipt) == required["headRefName"]
entry = re.search(
r'- id: "occ-self-bind-pr-6079".*?check_value: "([^"]+)"',
contract,
re.DOTALL,
)
assert entry and entry.group(1) == check_value
print("PASS: receipt and contract use only number,state.")
print("PASS: commit_sha and branch are not present in probe_stdout.")
print("PASS: required headRefOid and headRefName checks are absent.")
PYRepository: OmniNode-ai/onex_change_control
Length of output: 341
Enforce the OCC self-bind identity.
Query number,state,headRefOid,headRefName and fail unless the result matches PR 6079, OPEN, commit cfe33594b52e643c7b6624bd14db104e73017b8a, and branch jonah/omn-15655-occ-node-pr813. Include the matching head SHA and branch in actual_output.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@drift/dod_receipts/OMN-15655/occ-self-bind-pr-6079/command.yaml` around lines
6 - 17, The OCC verification command and validation must enforce the complete
self-bind identity. Update the check around check_value, probe_command, and
probe_stdout to query number,state,headRefOid,headRefName, then require PR 6079,
state OPEN, head SHA cfe33594b52e643c7b6624bd14db104e73017b8a, and branch
jonah/omn-15655-occ-node-pr813; update actual_output to include the matching
head SHA and branch.
Source: Learnings
This was referenced Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OCC companion for OmniNode-ai/omninode_infra#813.\n\nEvidence added append-only under existing OMN-15655 contract:\n- runtime digest pin probe at PR head 627422691530f996fadfaecf378a410d11212401\n- migration image tag+digest probe at same PR head\n- readiness composition source_rev/digest bundle probe at same PR head\n- product diff-scope receipt for #813\n- PR-specific OCC evidence admissibility validator receipt\n\nLocal verification:\n- content probes: runtime=1, migration=1, composition=9\n- uv run pytest tests/test_evidence_admissibility.py -q: 76 passed\n- changed-file pre-commit: passed
Summary by CodeRabbit
Documentation
Tests