Repository navigation
evidence(OMN-15655): OCC companion for OmniNode-ai/omninode_infra#819 - #6126
Conversation
Manual net-new evidence companion — the automated node_occ_companion_effect path fired (GHA publish job 31049690178 succeeded, event_id=e380482b at 2026-08-05T21:41:34Z, consumed on .201 omninode-runtime-effects) but the mint dispatcher failed downstream: SupersessionCheckBindingError at 21:41:42Z, preceded by "Secret resolution failed (configuration issue): GITHUB_TOKEN", boundary-swallowed (dlq_routed=false, dlq_enabled=False) — no completed/failed event, nothing stamped back onto #819. Confirmed live to be a currently-active, cross-PR outage (100% failure rate on node_occ_companion_effect across the 21:31Z/21:41Z/21:55Z window observed on .201), not specific to this PR. Automated retrigger not attempted given that live evidence. Appends four dod_evidence entries to the existing OMN-15655 contract, binding OmniNode-ai/omninode_infra#819 (round 4: re-pins the onex-dev runtime image + readiness composition doc to omnibase_infra dev@a853500a, the same source revision PR #818/OMN-15349 re-pins the migrate image to, restoring SINGLE_SOURCE_REV_BUNDLE). Self-bind entry to follow once this PR's number is known. OMN-15655
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 57 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe PR adds append-only OMN-15655 contract evidence and command receipts. The records bind OmniNode PR ChangesOMN-15655 verification evidence
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
The self-bind append commit mutated contracts/OMN-15655.yaml after these four receipts were minted, invalidating their whole-file contract_sha256 binding (occ-preflight/eligibility reason=contract_hash_mismatch). Rebind to the current contract hash. OMN-15655
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
drift/dod_receipts/OMN-15655/dod-node-pr819-runtime/command.yaml (1)
1-24: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winStore each receipt under its run-timestamp filename.
These files use
command.yaml. The required receipt location isdrift/dod_receipts/<TICKET>/<ITEM_ID>/<run_timestamp>.yaml. Rename each file to its recordedrun_timestampfilename so receipt discovery and validation use the required layout.
drift/dod_receipts/OMN-15655/dod-node-pr819-runtime/command.yaml#L1-L24: rename to the2026-08-05T22:05:00+00:00timestamp filename.drift/dod_receipts/OMN-15655/dod-node-pr819-composition/command.yaml#L1-L26: rename to the2026-08-05T22:05:00+00:00timestamp filename.drift/dod_receipts/OMN-15655/dod-node-pr819-ci/command.yaml#L1-L23: rename to the2026-08-05T22:05:00+00:00timestamp filename.drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-819/command.yaml#L1-L23: rename to the2026-08-05T22:05:00+00:00timestamp filename.drift/dod_receipts/OMN-15655/occ-self-bind-pr-6126/command.yaml#L1-L22: rename to the2026-08-05T22:10:00+00:00timestamp filename.drift/dod_receipts/OMN-15655/dod-node-pr819-ci-ad10ba9/command.yaml#L1-L22: rename to the2026-08-06T02:31:00+00:00timestamp filename.drift/dod_receipts/OMN-15655/dod-node-pr819-runtime-ad10ba9/command.yaml#L1-L22: rename to the2026-08-06T02:31:00+00:00timestamp filename.drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml#L1-L24: rename to the2026-08-06T02:31:00+00:00timestamp filename.As per coding guidelines, “Store DoD receipts only at
drift/dod_receipts/<TICKET>/<ITEM_ID>/<run_timestamp>.yaml.”🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@drift/dod_receipts/OMN-15655/dod-node-pr819-runtime/command.yaml` around lines 1 - 24, Rename each listed command.yaml receipt to its recorded run_timestamp filename while preserving its contents: drift/dod_receipts/OMN-15655/dod-node-pr819-runtime/command.yaml (1-24) to 2026-08-05T22:05:00+00:00.yaml; drift/dod_receipts/OMN-15655/dod-node-pr819-composition/command.yaml (1-26) to 2026-08-05T22:05:00+00:00.yaml; drift/dod_receipts/OMN-15655/dod-node-pr819-ci/command.yaml (1-23) to 2026-08-05T22:05:00+00:00.yaml; drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-819/command.yaml (1-23) to 2026-08-05T22:05:00+00:00.yaml; drift/dod_receipts/OMN-15655/occ-self-bind-pr-6126/command.yaml (1-22) to 2026-08-05T22:10:00+00:00.yaml; drift/dod_receipts/OMN-15655/dod-node-pr819-ci-ad10ba9/command.yaml (1-22), drift/dod_receipts/OMN-15655/dod-node-pr819-runtime-ad10ba9/command.yaml (1-22), and drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml (1-24) to 2026-08-06T02:31:00+00:00.yaml.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@contracts/OMN-15655.yaml`:
- Around line 397-399: Replace the grep count probe in contracts/OMN-15655.yaml
lines 397-399 with explicit assertions that the composition contains source_rev,
the runtime digest, and the migration digest; apply the same change to lines
445-448. Update
drift/dod_receipts/OMN-15655/dod-node-pr819-composition/command.yaml lines 6-17
and drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml
lines 6-16 to record the strengthened probes, then remint both receipts.
In `@drift/dod_receipts/OMN-15655/dod-node-pr819-ci-ad10ba9/command.yaml`:
- Around line 6-8: All three receipts must include a raw contract hash alongside
the existing canonical entry hash. Add contract_sha256 to
drift/dod_receipts/OMN-15655/dod-node-pr819-ci-ad10ba9/command.yaml lines 6-8,
drift/dod_receipts/OMN-15655/dod-node-pr819-runtime-ad10ba9/command.yaml lines
6-8, and
drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml
lines 6-8; generate it from the final contract file’s raw bytes using
omnibase_core.validation.validator_receipt_gate, while retaining
contract_entry_sha256 as the canonical-JSON per-entry hash.
In
`@drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-819/command.yaml`:
- Around line 6-9: Add a contract_entry_sha256 field to the receipt entry
alongside contract_sha256, using the canonical-JSON per-entry hash for
dod-occ-evidence-admissibility-validator-pr-819 generated by
omnibase_core.validation.validator_receipt_gate; preserve the existing raw
contract hash and PASS status.
---
Outside diff comments:
In `@drift/dod_receipts/OMN-15655/dod-node-pr819-runtime/command.yaml`:
- Around line 1-24: Rename each listed command.yaml receipt to its recorded
run_timestamp filename while preserving its contents:
drift/dod_receipts/OMN-15655/dod-node-pr819-runtime/command.yaml (1-24) to
2026-08-05T22:05:00+00:00.yaml;
drift/dod_receipts/OMN-15655/dod-node-pr819-composition/command.yaml (1-26) to
2026-08-05T22:05:00+00:00.yaml;
drift/dod_receipts/OMN-15655/dod-node-pr819-ci/command.yaml (1-23) to
2026-08-05T22:05:00+00:00.yaml;
drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-819/command.yaml
(1-23) to 2026-08-05T22:05:00+00:00.yaml;
drift/dod_receipts/OMN-15655/occ-self-bind-pr-6126/command.yaml (1-22) to
2026-08-05T22:10:00+00:00.yaml;
drift/dod_receipts/OMN-15655/dod-node-pr819-ci-ad10ba9/command.yaml (1-22),
drift/dod_receipts/OMN-15655/dod-node-pr819-runtime-ad10ba9/command.yaml (1-22),
and drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml
(1-24) to 2026-08-06T02:31:00+00:00.yaml.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7e2f87c8-ee31-4e37-ba15-c8f8e5232e62
📒 Files selected for processing (9)
contracts/OMN-15655.yamldrift/dod_receipts/OMN-15655/dod-node-pr819-ci-ad10ba9/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr819-ci/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr819-composition/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr819-runtime-ad10ba9/command.yamldrift/dod_receipts/OMN-15655/dod-node-pr819-runtime/command.yamldrift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-819/command.yamldrift/dod_receipts/OMN-15655/occ-self-bind-pr-6126/command.yaml
| - check_type: "command" | ||
| check_value: |- | ||
| gh api 'repos/OmniNode-ai/omninode_infra/contents/k8s/onex-dev/readiness/staging-composition.canonical-dev.v1.yaml?ref=7ad0aeec1ce907943a1c123890727c55326bea58' --jq .content | base64 -d | grep -E 'a853500ab3c74620acdba34b418f6bd087081153|sha256:b829c56f547340363be347391275cc847b1f465c18fa275836dd098989f7ecb7|sha256:64f519fe7907329e01bce38693f77f34a033ee9c33b8c91e22044248a3a7ec18' | wc -l |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Require all three composition bindings.
grep -E ... | wc -l returns success even when grep finds no match. It also accepts one matching value when the evidence claims three bindings. Replace this pipeline with explicit assertions for source_rev, the runtime digest, and the migration digest. Remint both receipts after changing the contract entries.
contracts/OMN-15655.yaml#L397-L399: assert all three required values.contracts/OMN-15655.yaml#L445-L448: apply the same assertion to the superseding entry.drift/dod_receipts/OMN-15655/dod-node-pr819-composition/command.yaml#L6-L17: record the strengthened original probe.drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml#L6-L16: record the strengthened superseding probe.
📍 Affects 3 files
contracts/OMN-15655.yaml#L397-L399(this comment)contracts/OMN-15655.yaml#L445-L448drift/dod_receipts/OMN-15655/dod-node-pr819-composition/command.yaml#L6-L17drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml#L6-L16
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@contracts/OMN-15655.yaml` around lines 397 - 399, Replace the grep count
probe in contracts/OMN-15655.yaml lines 397-399 with explicit assertions that
the composition contains source_rev, the runtime digest, and the migration
digest; apply the same change to lines 445-448. Update
drift/dod_receipts/OMN-15655/dod-node-pr819-composition/command.yaml lines 6-17
and drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml
lines 6-16 to record the strengthened probes, then remint both receipts.
| check_value: |- | ||
| gh pr view 819 --repo OmniNode-ai/omninode_infra --json number,state,baseRefName,headRefOid,files --jq 'if (.number == 819 and .state == "OPEN" and .baseRefName == "dev" and .headRefOid == "ad10ba96c60721fa26310f0ed882e407a5998efd" and ([.files[].path] | sort) == []) then "true" else error("unexpected #819 current head, base, or empty diff state") end' | ||
| contract_entry_sha256: "sha256:cb7d804c5ab2c96bf8767418a72ea7cd8aba00d8227b0fcbafad4bd3b79e74e8" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Add the raw contract hash to each superseding receipt.
Each receipt has contract_entry_sha256 but omits contract_sha256. Generate both values from the final contract bytes and the canonical evidence entry with omnibase_core.validation.validator_receipt_gate.
drift/dod_receipts/OMN-15655/dod-node-pr819-ci-ad10ba9/command.yaml#L6-L8: addcontract_sha256.drift/dod_receipts/OMN-15655/dod-node-pr819-runtime-ad10ba9/command.yaml#L6-L8: addcontract_sha256.drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml#L6-L8: addcontract_sha256.
As per coding guidelines, “Bind contract_sha256 to the SHA-256 hash of the contract file's raw bytes and contract_entry_sha256 to the canonical-JSON per-entry hash.”
📍 Affects 3 files
drift/dod_receipts/OMN-15655/dod-node-pr819-ci-ad10ba9/command.yaml#L6-L8(this comment)drift/dod_receipts/OMN-15655/dod-node-pr819-runtime-ad10ba9/command.yaml#L6-L8drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml#L6-L8
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@drift/dod_receipts/OMN-15655/dod-node-pr819-ci-ad10ba9/command.yaml` around
lines 6 - 8, All three receipts must include a raw contract hash alongside the
existing canonical entry hash. Add contract_sha256 to
drift/dod_receipts/OMN-15655/dod-node-pr819-ci-ad10ba9/command.yaml lines 6-8,
drift/dod_receipts/OMN-15655/dod-node-pr819-runtime-ad10ba9/command.yaml lines
6-8, and
drift/dod_receipts/OMN-15655/dod-node-pr819-composition-ad10ba9/command.yaml
lines 6-8; generate it from the final contract file’s raw bytes using
omnibase_core.validation.validator_receipt_gate, while retaining
contract_entry_sha256 as the canonical-JSON per-entry hash.
Source: Coding guidelines
| check_value: |- | ||
| uv run pytest tests/test_evidence_admissibility.py -q | ||
| contract_sha256: "sha256:9d40a6b289991ac8313d13a8001153ea6ff8f2416d1a1872b0c4b95751a84ab3" | ||
| status: PASS |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Add contract_entry_sha256 for this evidence item.
This receipt has only the whole-contract hash. Add the canonical-JSON hash for dod-occ-evidence-admissibility-validator-pr-819 with omnibase_core.validation.validator_receipt_gate.
As per coding guidelines, “Bind contract_sha256 to the SHA-256 hash of the contract file's raw bytes and contract_entry_sha256 to the canonical-JSON per-entry hash.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator-pr-819/command.yaml`
around lines 6 - 9, Add a contract_entry_sha256 field to the receipt entry
alongside contract_sha256, using the canonical-JSON per-entry hash for
dod-occ-evidence-admissibility-validator-pr-819 generated by
omnibase_core.validation.validator_receipt_gate; preserve the existing raw
contract hash and PASS status.
Source: Coding guidelines
1 participant
Manual net-new evidence companion for OmniNode-ai/omninode_infra#819 (OMN-15655, round 4).
The automated node_occ_companion_effect path fired for this PR (GHA
call-occ-companion-effect / occ-companion-effectjob 31049690178 succeeded, publishingonex.cmd.omnimarket.occ-companion-effect-requested.v1event_id=e380482b at 2026-08-05T21:41:34Z; the .201 dev-lane effects runtime consumed it immediately) but the mint dispatcher failed downstream:dispatcher.auto.node_occ_companion_effect.HandlerOccCompanionEffect...raisedSupersessionCheckBindingErrorat 21:41:42Z, immediately preceded bySecret resolution failed (configuration issue): GITHUB_TOKEN, and was boundary-swallowed (metric_name=boundary_swallow_observed dlq_routed=false dlq_enabled=False) — no completed/failed event, nothing stamped back onto #819.Live-verified this is a currently-active, cross-PR outage: every
node_occ_companion_effectattempt observed onomninode-runtime-effectsin the 21:31Z/21:41Z/21:55Z window (OCC#6122, this PR, omnibase_infra#2663) hit the sameGITHUB_TOKENsecret-resolution failure — 100% failure rate in that window. Automated retrigger was not attempted given that live evidence.Appends four
dod_evidenceentries to the existing OMN-15655 contract for #819 (round 4: re-pins the onex-dev runtime image + readiness composition doc to omnibase_infra dev@a853500a, the same source revision #818/OMN-15349 re-pins the migrate image to, restoring SINGLE_SOURCE_REV_BUNDLE).Evidence-Source: OmniNode-ai/omninode_infra#819 @ 7ad0aeec1ce907943a1c123890727c55326bea58
OMN-15655
Summary by CodeRabbit
Documentation
Tests