Repository navigation
chore(occ): add OMN-15336 evidence for market PR 2021 - #6148
Merged
Merged
Conversation
📝 WalkthroughWalkthroughThe PR adds verified evidence for OMN-15336, including PR ChangesOMN-15336 evidence
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
OCC autobind stood down for |
Contributor
|
OCC autobind stood down for |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
drift/dod_receipts/OMN-15336/dod-OmniNode-ai-omnimarket-pr-2021/command.yaml (1)
1-30: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winMove each receipt to its run-timestamp file name.
These files use
command.yaml. The required receipt path includes the receiptrun_timestampas the file name. The receipt gate can reject or skip these records when they do not use the required location.
drift/dod_receipts/OMN-15336/dod-OmniNode-ai-omnimarket-pr-2021/command.yaml#L1-L30: rename todrift/dod_receipts/OMN-15336/dod-OmniNode-ai-omnimarket-pr-2021/2026-08-06T00:54:40Z.yaml.drift/dod_receipts/OMN-15336/dod-occ-evidence-validator-pr-2021/command.yaml#L1-L21: rename todrift/dod_receipts/OMN-15336/dod-occ-evidence-validator-pr-2021/2026-08-06T00:54:40Z.yaml.drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml#L1-L25: rename todrift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/2026-08-06T00:56:38Z.yaml.drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yaml#L1-L25: rename todrift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/2026-08-06T00:56:38Z.yaml.drift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/command.yaml#L1-L19: rename todrift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/2026-08-06T00:59:49Z.yaml.As per coding guidelines, “Store DoD receipts only at
drift/dod_receipts/<TICKET>/<ITEM_ID>/<run_timestamp>.yaml.”🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@drift/dod_receipts/OMN-15336/dod-OmniNode-ai-omnimarket-pr-2021/command.yaml` around lines 1 - 30, Rename each receipt file to its run_timestamp-based YAML name, preserving its contents: drift/dod_receipts/OMN-15336/dod-OmniNode-ai-omnimarket-pr-2021/command.yaml to 2026-08-06T00:54:40Z.yaml; drift/dod_receipts/OMN-15336/dod-occ-evidence-validator-pr-2021/command.yaml to 2026-08-06T00:54:40Z.yaml; drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml and drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yaml to 2026-08-06T00:56:38Z.yaml; and drift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/command.yaml to 2026-08-06T00:59:49Z.yaml. Do not modify the receipt data.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@contracts/OMN-15336.yaml`:
- Around line 75-81: Make the OCC self-bind command fail closed in
contracts/OMN-15336.yaml lines 75-81 and
drift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/command.yaml lines 6-13 by
adding the same --jq assertion requiring PR number 6148, state OPEN, and branch
codex/omn-15336-occ-pr2021 to both check_value and probe_command. Then
regenerate contract_sha256 and contract_entry_sha256 using
omnibase_core.validation.validator_receipt_gate.
In `@drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml`:
- Around line 7-19: Bind the PR `#2532` receipt contract and command in
drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml to headRefOid
a81f91ac32fc11c5761e4746ecb08b02ae7fd693; bind the OCC receipt in
drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yaml to authoring
commit e3e234e0597fd6e935669c784e8c105a8c67e3af rather than the external SHA.
Store both receipts as <run_timestamp>.yaml files, preserve the
omnibase_core.ModelDodReceipt shape, update all contract and receipt commands
accordingly, and recompute each contract_entry_sha256.
---
Outside diff comments:
In
`@drift/dod_receipts/OMN-15336/dod-OmniNode-ai-omnimarket-pr-2021/command.yaml`:
- Around line 1-30: Rename each receipt file to its run_timestamp-based YAML
name, preserving its contents:
drift/dod_receipts/OMN-15336/dod-OmniNode-ai-omnimarket-pr-2021/command.yaml to
2026-08-06T00:54:40Z.yaml;
drift/dod_receipts/OMN-15336/dod-occ-evidence-validator-pr-2021/command.yaml to
2026-08-06T00:54:40Z.yaml;
drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml and
drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yaml to
2026-08-06T00:56:38Z.yaml; and
drift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/command.yaml to
2026-08-06T00:59:49Z.yaml. Do not modify the receipt data.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e5233da1-2e4c-445a-9ef7-f633b4054b80
📒 Files selected for processing (7)
.onex_ratchets/omn_15382_rule_b_baseline.yamlcontracts/OMN-15336.yamldrift/dod_receipts/OMN-15336/dod-OmniNode-ai-omnimarket-pr-2021/command.yamldrift/dod_receipts/OMN-15336/dod-occ-evidence-validator-pr-2021/command.yamldrift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yamldrift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yamldrift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/command.yaml
💤 Files with no reviewable changes (1)
- .onex_ratchets/omn_15382_rule_b_baseline.yaml
Comment on lines
+75
to
+81
| - id: "occ-self-bind-pr-6148" | ||
| description: "Binds OMN-15336 to OCC companion PR #6148 for omnimarket PR #2021." | ||
| source: "manual" | ||
| status: "verified" | ||
| checks: | ||
| - check_type: "command" | ||
| check_value: "gh pr view 6148 --repo OmniNode-ai/onex_change_control --json number,state,headRefName" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
gh pr view 6148 \
--repo OmniNode-ai/onex_change_control \
--json number,state,headRefName,headRefOid \
--jq '{number, state, headRefName, headRefOid}'
sed -n '75,81p' contracts/OMN-15336.yaml
sed -n '4,15p' drift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/command.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 1253
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- relevant files ---'
git ls-files 'contracts/OMN-15336.yaml' 'drift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/command.yaml' '*validator*' '*receipt*' | sed -n '1,120p'
printf '%s\n' '--- validator_receipt_gate references ---'
rg -n -S 'validator_receipt_gate|contract_entry_sha256|contract_sha256' . \
-g '!node_modules' -g '!dist' -g '!build' | sed -n '1,240p'
printf '%s\n' '--- contract and receipt context ---'
sed -n '65,90p' contracts/OMN-15336.yaml
sed -n '1,24p' drift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/command.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 42107
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- hashing and receipt requirements ---'
sed -n '1,90p' docs/standards/receipt_hashing_and_supersession.md
sed -n '35,58p' CLAUDE.md
sed -n '235,260p' scripts/validation/check_receipt_hardening.py
sed -n '720,768p' scripts/validation/check_receipt_hardening.py
printf '%s\n' '--- comparable fail-closed PR checks ---'
rg -n -U -S 'gh pr view .*--jq|unexpected .* identity|headRefName.*state' \
contracts drift/dod_receipts/OMN-15336 \
-g '*.yaml' | sed -n '1,180p'
printf '%s\n' '--- contract entry and receipt hash fields ---'
sed -n '1,20p' drift/dod_receipts/OMN-15336/dod-omnimarket-pr-2021/command.yaml
sed -n '1,20p' drift/dod_receipts/OMN-15336/occ-self-bind-pr-5386/command.yaml
sed -n '1,20p' drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 37340
Make the OCC self-bind check fail closed.
The current command does not assert PR number 6148, state OPEN, or branch codex/omn-15336-occ-pr2021. Add the same --jq assertion to check_value and probe_command in both referenced files. Regenerate contract_sha256 and contract_entry_sha256 with omnibase_core.validation.validator_receipt_gate.
📍 Affects 2 files
contracts/OMN-15336.yaml#L75-L81(this comment)drift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/command.yaml#L6-L13
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@contracts/OMN-15336.yaml` around lines 75 - 81, Make the OCC self-bind
command fail closed in contracts/OMN-15336.yaml lines 75-81 and
drift/dod_receipts/OMN-15336/occ-self-bind-pr-6148/command.yaml lines 6-13 by
adding the same --jq assertion requiring PR number 6148, state OPEN, and branch
codex/omn-15336-occ-pr2021 to both check_value and probe_command. Then
regenerate contract_sha256 and contract_entry_sha256 using
omnibase_core.validation.validator_receipt_gate.
Source: Coding guidelines
Comment on lines
+7
to
+19
| gh pr view 2532 --repo OmniNode-ai/omnibase_infra --json number,state,headRefName --jq 'if (.number | ||
| == 2532 and .state == "MERGED" and .headRefName == "jonah/omn-15336-lab-compose-fence-parity") then | ||
| "true" else error("unexpected #2532 identity") end' | ||
| contract_entry_sha256: "sha256:931cdc4dc66184e7ff6a1c140f965c098ffe9ebb9401e66fc5716c2dd6a89b71" | ||
| status: PASS | ||
| run_timestamp: "2026-08-06T00:56:38Z" | ||
| commit_sha: "7bd1c1a9c39823834fe4e38dabc785887ecf524c" | ||
| runner: "codex-manual-merge-sweep" | ||
| verifier: "manual-occ-companion-repair" | ||
| probe_command: >- | ||
| gh pr view 2532 --repo OmniNode-ai/omnibase_infra --json number,state,headRefName --jq 'if (.number | ||
| == 2532 and .state == "MERGED" and .headRefName == "jonah/omn-15336-lab-compose-fence-parity") then | ||
| "true" else error("unexpected #2532 identity") end' |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "PR `#2532` subject head:"
gh pr view 2532 \
--repo OmniNode-ai/omnibase_infra \
--json headRefName,headRefOid,state \
--jq '{headRefName, headRefOid, state}'
echo "Current OCC receipt-authoring commit:"
git rev-parse HEAD
echo "Recorded values:"
awk '/^commit_sha:/{print FILENAME ": " $0}' \
drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml \
drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 664
🏁 Script executed:
#!/bin/bash
set -euo pipefail
files=(
drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml
drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yaml
)
for f in "${files[@]}"; do
echo "===== $f ====="
wc -l "$f"
cat -n "$f"
done
echo "===== nearby receipt files ====="
git ls-files 'drift/dod_receipts/**/*.yaml' | sed -n '1,120p'
echo "===== commit_sha patterns ====="
rg -n -C 3 'commit_sha:|contract_entry_sha256:|probe_command:' drift/dod_receipts -g '*.yaml' | sed -n '1,240p'
echo "===== receipt model references ====="
rg -n -C 3 'ModelDodReceipt|DodReceipt|contract_entry_sha256|receipt-authoring|receipt author' . \
-g '!node_modules' -g '!dist' -g '!build' | sed -n '1,260p'Repository: OmniNode-ai/onex_change_control
Length of output: 50389
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "===== receipt hardening rules ====="
sed -n '1,220p' scripts/validation/check_receipt_hardening.py
echo "===== canonical receipt guidance ====="
sed -n '25,65p' CLAUDE.md
sed -n '35,80p' scripts/check_dod_compliance.py
echo "===== target contract references ====="
rg -n -C 8 'dod-pr-2532-supersede-1|occ-pr-5386-supersede-1|OMN-15336|5386|2532' \
-g '*.yaml' -g '*.yml' -g '*.json' -g '*.toml' -g '*.py' . | sed -n '1,260p'
echo "===== narrow receipt path checks ====="
rg -n -C 5 'run_timestamp.*yaml|timestamp.*receipt|command\.yaml|receipt.*name|glob.*dod_receipts' \
scripts tests CLAUDE.md docs -g '*.py' -g '*.md' -g '*.yaml' -g '*.yml' | sed -n '1,260p'
echo "===== current commit identity ====="
git show -s --format='HEAD=%H%nparents=%P%nauthor=%an <%ae>%nauthor_date=%aI%nsubject=%s' HEADRepository: OmniNode-ai/onex_change_control
Length of output: 50389
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "===== OMN-15336 contract locations ====="
rg -n 'id: "(dod-pr-2532-supersede-1|occ-pr-5386-supersede-1|dod-OmniNode-ai-omnibase_infra-pr-2532|occ-self-bind-pr-5386|dod-OmniNode-ai-omnimarket-pr-2021)"' \
contracts/OMN-15336.yaml
echo "===== OMN-15336 contract excerpts ====="
python3 - <<'PY'
from pathlib import Path
p = Path("contracts/OMN-15336.yaml")
lines = p.read_text().splitlines()
needles = {
"dod-pr-2532-supersede-1",
"occ-pr-5386-supersede-1",
"dod-OmniNode-ai-omnibase_infra-pr-2532",
"occ-self-bind-pr-5386",
"dod-OmniNode-ai-omnimarket-pr-2021",
}
for i, line in enumerate(lines):
if any(n in line for n in needles):
start = max(0, i - 3)
end = min(len(lines), i + 18)
print(f"--- lines {start + 1}-{end} ---")
for j in range(start, end):
print(f"{j + 1}:{lines[j]}")
PY
echo "===== OCC PR `#5386` metadata ====="
gh pr view 5386 --repo OmniNode-ai/onex_change_control \
--json number,state,headRefName,headRefOid,baseRefName,mergeCommit \
--jq '{number,state,headRefName,headRefOid,baseRefName,mergeCommit}'
echo "===== current commit and changed paths ====="
git show -s --format='HEAD=%H%nparents=%P%nsubject=%s' HEAD
git diff-tree --no-commit-id --name-status -r HEAD -- \
drift/dod_receipts/OMN-15336 contracts/OMN-15336.yaml
echo "===== target files at HEAD ====="
for f in \
drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml \
drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yaml
do
git cat-file -e "HEAD:$f" && echo "$f exists at HEAD"
done
echo "===== candidate SHA object types ====="
for sha in \
7bd1c1a9c39823834fe4e38dabc785887ecf524c \
a81f91ac32fc11c5761e4746ecb08b02ae7fd693 \
a624d7c4a17f008b0c0a28259ebcb21e4be52457
do
printf '%s ' "$sha"
git cat-file -t "$sha" 2>/dev/null || echo "not-local"
doneRepository: OmniNode-ai/onex_change_control
Length of output: 10785
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "===== last commits touching target receipts ====="
for f in \
drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml \
drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yaml \
contracts/OMN-15336.yaml
do
echo "--- $f ---"
git log -1 --format='commit=%H%nparents=%P%nauthor=%an <%ae>%nauthor_date=%aI%ncommitter=%cn <%ce>%ncommit_date=%cI%nsubject=%s' -- "$f"
done
echo "===== local authoring assertions in receipts and contracts ====="
rg -n -C 4 'git (rev-parse|show)|HEAD|receipt.*commit|commit.*receipt|headRefOid|mergeCommit' \
drift/dod_receipts/OMN-15336 contracts/OMN-15336.yaml \
-g '*.yaml' | sed -n '1,260p'
echo "===== candidate commit objects ====="
for sha in \
a624d7c4a17f008b0c0a28259ebcb21e4be52457 \
84e13b80aa6ceb5af39062f7f2ddd394141a110f \
2a8b0aa222337d0a1ae34367cebbddbd293dab07
do
echo "--- $sha ---"
git show -s --format='%H%n%P%n%an <%ae>%n%aI%n%s' "$sha" 2>/dev/null || true
done
echo "===== remote resolution of relevant SHAs ====="
for sha in \
a624d7c4a17f008b0c0a28259ebcb21e4be52457 \
84e13b80aa6ceb5af39062f7f2ddd394141a110f \
2a8b0aa222337d0a1ae34367cebbddbd293dab07
do
printf '%s: ' "$sha"
gh api "repos/OmniNode-ai/onex_change_control/commits/$sha" --jq '.sha' 2>/dev/null || echo "unresolved"
doneRepository: OmniNode-ai/onex_change_control
Length of output: 6900
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "===== PR `#2532` head resolution ====="
gh api repos/OmniNode-ai/omnibase_infra/commits/a81f91ac32fc11c5761e4746ecb08b02ae7fd693 \
--jq '{sha: .sha, message: (.commit.message | split("\n")[0])}'
echo "===== OCC receipt-authoring commit resolution ====="
gh api repos/OmniNode-ai/onex_change_control/commits/e3e234e0597fd6e935669c784e8c105a8c67e3af \
--jq '{sha: .sha, message: (.commit.message | split("\n")[0])}'
echo "===== files introduced by the receipt-authoring commit ====="
git diff-tree --no-commit-id --name-status -r e3e234e0597fd6e935669c784e8c105a8c67e3af -- \
drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml \
drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 730
Bind each receipt to its subject commit and canonical path.
- For PR
#2532, usea81f91ac32fc11c5761e4746ecb08b02ae7fd693and assert thisheadRefOidin the contract and receipt commands. - For the OCC receipt, use authoring commit
e3e234e0597fd6e935669c784e8c105a8c67e3af. Do not use the external omnimarket SHA. - Store both receipts as
<run_timestamp>.yamlfiles and preserve theomnibase_core.ModelDodReceiptshape. - Recompute
contract_entry_sha256after updating the contract checks.
📍 Affects 2 files
drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml#L7-L19(this comment)drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yaml#L7-L19
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml` around
lines 7 - 19, Bind the PR `#2532` receipt contract and command in
drift/dod_receipts/OMN-15336/dod-pr-2532-supersede-1/command.yaml to headRefOid
a81f91ac32fc11c5761e4746ecb08b02ae7fd693; bind the OCC receipt in
drift/dod_receipts/OMN-15336/occ-pr-5386-supersede-1/command.yaml to authoring
commit e3e234e0597fd6e935669c784e8c105a8c67e3af rather than the external SHA.
Store both receipts as <run_timestamp>.yaml files, preserve the
omnibase_core.ModelDodReceipt shape, update all contract and receipt commands
accordingly, and recompute each contract_entry_sha256.
Source: Learnings
This was referenced Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
Summary by CodeRabbit
Documentation
Tests