Repository navigation
evidence(OMN-14916): bind omninode_infra PR 825 - #6166
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 19 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThe change adds OMN-14916 evidence bindings and passing command receipts for infrastructure PR ChangesOMN-14916 evidence validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@contracts/OMN-14916.yaml`:
- Around line 72-84: Make every claimed evidence result executable: in
contracts/OMN-14916.yaml lines 72-84, add a pinned-head assertion verifying
SITE_URL=http://localhost:8080; in contracts/OMN-14916.yaml lines 85-92, add the
product file-scoped hook check or remove that claim; in
drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml
lines 17-27, record executable content and hook commands or remove those claims
from actual_output; and in
drift/dod_receipts/OMN-14916/dod-occ-evidence-validator-pr-825/command.yaml
lines 13-19, record the product hook command or remove the product-hook claim.
In
`@drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml`:
- Around line 1-2: Adopt one receipt filename contract consistently: for
drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml,
drift/dod_receipts/OMN-14916/dod-occ-evidence-validator-pr-825/command.yaml, and
drift/dod_receipts/OMN-14916/occ-self-bind-pr-6166/command.yaml, either rename
all three to their timestamp filenames and update the repository generator,
compliance guidance, consumers, tests, and supersession references, or retain
command.yaml and revise the coding guideline, generator, runtime sweep,
consumers, tests, and references to enforce that convention.
- Line 11: Rename all three receipt
files—drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml
(line 11),
drift/dod_receipts/OMN-14916/dod-occ-evidence-validator-pr-825/command.yaml
(line 7), and drift/dod_receipts/OMN-14916/occ-self-bind-pr-6166/command.yaml
(line 8)—to timestamped <run_timestamp>.yaml filenames under their existing
ticket/item directories. Preserve the existing ModelDodReceipt fields and
contract_entry_sha256 values; remove any unnecessary legacy contract_sha256
fields.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e3c917c4-9318-42d8-9a57-e99326c645e0
📒 Files selected for processing (4)
contracts/OMN-14916.yamldrift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yamldrift/dod_receipts/OMN-14916/dod-occ-evidence-validator-pr-825/command.yamldrift/dod_receipts/OMN-14916/occ-self-bind-pr-6166/command.yaml
| --- | ||
| schema_version: "1.0.0" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
find drift/dod_receipts/OMN-14916 -maxdepth 3 -type f -print | sort
rg -n -C 4 'command\.yaml|run_timestamp|receipt.*(path|filename)|supersedes' \
--glob '*.py' --glob '*.yaml' --glob '*.yml' --glob '*.md' .Repository: OmniNode-ai/onex_change_control
Length of output: 50388
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- target files ---'
find drift/dod_receipts/OMN-14916 -maxdepth 3 -type f -print | sort
printf '%s\n' '--- target receipt contents ---'
while IFS= read -r f; do
printf '\n### %s\n' "$f"
cat -n "$f"
done < <(find drift/dod_receipts/OMN-14916 -maxdepth 3 -type f -print | sort)
printf '%s\n' '--- resolver candidates ---'
rg -n -C 5 --glob '!drift/dod_receipts/**' \
'ModelDodReceipt|DodReceipt|dod_receipt|dod_receipts|receipt.*(path|filename)|filename.*receipt|run_timestamp|check_type' \
src tests scripts .github 2>/dev/null | head -n 1200 || true
printf '%s\n' '--- relevant filenames ---'
git ls-files | rg -i \
'(^|/)(receipt|dod|occ|model).*|dod.*(receipt|resolver)|receipt.*(resolver|cli)' | head -n 1000Repository: OmniNode-ai/onex_change_control
Length of output: 1364
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- target receipt contents ---'
find drift/dod_receipts/OMN-14916 -maxdepth 3 -type f -print | sort | while IFS= read -r f; do
printf '\n### %s\n' "$f"
cat -n "$f"
done
printf '%s\n' '--- repository top-level paths ---'
git ls-files | awk -F/ 'NF==1 {print}' | sort -u
printf '%s\n' '--- ModelDodReceipt and resolver references ---'
rg -n -C 5 --glob '!drift/dod_receipts/**' \
'ModelDodReceipt|DodReceipt|dod_receipt|dod_receipts|receipt.*(path|filename)|filename.*receipt|run_timestamp|check_type' \
. 2>/dev/null | head -n 1600 || true
printf '%s\n' '--- likely resolver files ---'
git ls-files | rg -i \
'receipt|dod|occ|resolver|evidence' | head -n 1600Repository: OmniNode-ai/onex_change_control
Length of output: 50388
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- Python references to command.yaml ---'
git grep -n -E 'command\.yaml|run_timestamp|dod_receipts|ModelDodReceipt|Receipt' -- '*.py' \
':!drift/dod_receipts/**' | head -n 2000 || true
printf '%s\n' '--- non-Python resolver references ---'
git grep -n -E 'command\.yaml|run_timestamp|dod_receipts|ModelDodReceipt|receipt.*(path|filename)|filename.*receipt' \
-- '*.sh' '*.bash' '*.toml' '*.yml' '*.yaml' '*.md' '*.json' \
':!drift/dod_receipts/**' ':!contracts/**' | head -n 2000 || true
printf '%s\n' '--- package and source directories ---'
git ls-files | awk -F/ 'NF > 1 {print $1}' | sort -u
printf '%s\n' '--- receipt-related Python files ---'
git ls-files '*.py' | rg -i 'receipt|dod|occ|evidence|resolver|scaffold' | head -n 1000Repository: OmniNode-ai/onex_change_control
Length of output: 50388
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- Python files containing command.yaml ---'
git grep -l -F 'command.yaml' -- '*.py' ':!.onex_ratchets/**' ':!drift/**' ':!contracts/**' | sort
printf '%s\n' '--- Exact Python command.yaml references ---'
for f in $(git grep -l -F 'command.yaml' -- '*.py' ':!.onex_ratchets/**' ':!drift/**' ':!contracts/**' | sort); do
printf '\n### %s\n' "$f"
git grep -n -C 5 -F 'command.yaml' -- "$f"
done
printf '%s\n' '--- OMN-14916 contract references ---'
git grep -n -C 3 'OMN-14916\|dod-OmniNode-ai-omninode_infra-pr-825\|dod-occ-evidence-validator-pr-825\|occ-self-bind-pr-6166' \
-- 'contracts/**' '.github/**' 'tests/**' ':!.onex_ratchets/**' | head -n 1000 || true
printf '%s\n' '--- receipt-related source/test paths ---'
git ls-files '*.py' | rg -i 'receipt|dod|occ|evidence|scaffold|resolver' | head -n 1200Repository: OmniNode-ai/onex_change_control
Length of output: 50387
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- OMN-14916 contract ---'
cat -n contracts/OMN-14916.yaml
printf '%s\n' '--- receipt path construction ---'
git grep -n -E 'def .*receipt|command\.yaml|receipt_path|receipt_file|glob\(.*receipt|rglob\(.*receipt' \
-- scripts/auto_scaffold_contract.py \
scripts/validation/check_receipt_hardening.py \
src/onex_change_control \
scripts/validation/check_dod_compliance.py \
tests/unit/scripts/test_check_dod_compliance.py \
tests/test_auto_scaffold_contract.py \
tests/test_check_receipt_hardening.py \
| head -n 1600
printf '%s\n' '--- relevant implementation sections ---'
for f in scripts/auto_scaffold_contract.py scripts/validation/check_receipt_hardening.py \
scripts/validation/check_dod_compliance.py \
src/onex_change_control/scripts/contract_compliance_check.py; do
if [ -f "$f" ]; then
printf '\n### %s\n' "$f"
grep -n -E 'def .*receipt|command\.yaml|receipt_path|receipt_file|glob|rglob' "$f" | head -n 300
fi
doneRepository: OmniNode-ai/onex_change_control
Length of output: 25382
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- runtime receipt path logic ---'
cat -n src/onex_change_control/handlers/handler_dod_sweep.py | sed -n '200,345p'
printf '%s\n' '--- receipt corpus scan patterns ---'
cat -n scripts/validation/check_receipt_hardening.py | sed -n '1120,1190p'
cat -n scripts/validation/check_receipt_hardening.py | sed -n '1325,1350p'
cat -n scripts/validation/check_receipt_hardening.py | sed -n '1575,1600p'
printf '%s\n' '--- OMN-14916 references to reviewed receipt paths ---'
git grep -n -E \
'dod-OmniNode-ai-omninode_infra-pr-825|dod-occ-evidence-validator-pr-825|occ-self-bind-pr-6166|OMN-14916' \
-- ':!drift/dod_receipts/OMN-14916/**' ':!.onex_ratchets/**' | head -n 600Repository: OmniNode-ai/onex_change_control
Length of output: 13758
Adopt one receipt filename contract before merging.
These receipts contain the required timestamps, but command.yaml violates the stated path rule. The repository generator, compliance guidance, and tests still hard-code command.yaml, while the runtime sweep accepts any YAML file.
Rename the three receipts to their timestamp filenames only after updating the generator, consumers, tests, and supersession references together. Otherwise, revise the coding guideline to allow command.yaml and enforce that convention consistently.
📍 Affects 3 files
drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml#L1-L2(this comment)drift/dod_receipts/OMN-14916/dod-occ-evidence-validator-pr-825/command.yaml#L1-L2drift/dod_receipts/OMN-14916/occ-self-bind-pr-6166/command.yaml#L1-L2
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml`
around lines 1 - 2, Adopt one receipt filename contract consistently: for
drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml,
drift/dod_receipts/OMN-14916/dod-occ-evidence-validator-pr-825/command.yaml, and
drift/dod_receipts/OMN-14916/occ-self-bind-pr-6166/command.yaml, either rename
all three to their timestamp filenames and update the repository generator,
compliance guidance, consumers, tests, and supersession references, or retain
command.yaml and revise the coding guideline, generator, runtime sweep,
consumers, tests, and references to enforce that convention.
Sources: Coding guidelines, Learnings
| 'if (.number == 825 and .state == "OPEN" and .headRefName == "jonah/omn-14916-infisical-site-url-tunnel" | ||
| and .headRefOid == "255fe8b723734477632f67f8f4f4107800409977" and ([.files[].path] | sort) == ["k8s/dev/infisical/config-cm.yaml"]) | ||
| then "true" else error("unexpected #825 state, head, or file set") end' | ||
| contract_entry_sha256: "sha256:05d1a6ded48048502fb0262f89a9fae1228cb7da3bada363b79c0b2a33a8f4d9" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
contract='contracts/OMN-14916.yaml'
receipts=(
'drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml'
'drift/dod_receipts/OMN-14916/dod-occ-evidence-validator-pr-825/command.yaml'
'drift/dod_receipts/OMN-14916/occ-self-bind-pr-6166/command.yaml'
)
LC_ALL=C shasum -a 256 "$contract"
for receipt in "${receipts[@]}"; do
printf '\n%s\n' "$receipt"
rg -n '^(contract_sha256|contract_entry_sha256):' "$receipt" || true
done
rg -n -C 5 'contract_entry_sha256|contract_sha256|canonical.*JSON|validator_receipt_gate' \
--glob '*.py' --glob '*.yaml' .Repository: OmniNode-ai/onex_change_control
Length of output: 214
🏁 Script executed:
#!/bin/bash
set -euo pipefail
contract='contracts/OMN-14916.yaml'
receipts=(
'drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml'
'drift/dod_receipts/OMN-14916/dod-occ-evidence-validator-pr-825/command.yaml'
'drift/dod_receipts/OMN-14916/occ-self-bind-pr-6166/command.yaml'
)
printf '%s\n' '== repository paths =='
git ls-files \
"$contract" \
'drift/dod_receipts/OMN-14916' \
'*validator_receipt_gate*' \
'*receipt*validator*' | sed -n '1,160p'
printf '\n%s\n' '== contract hash =='
sha256sum "$contract"
for receipt in "${receipts[@]}"; do
printf '\n== %s ==\n' "$receipt"
cat -n "$receipt"
done
printf '\n%s\n' '== relevant definitions and references =='
rg -n -C 8 \
'contract_entry_sha256|contract_sha256|canonical.?JSON|validator_receipt_gate|ModelDodReceipt' \
--glob '*.py' --glob '*.yaml' --glob '*.toml' --glob '*.md' . | sed -n '1,260p'Repository: OmniNode-ai/onex_change_control
Length of output: 41665
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '== receipt hardening policy =='
sed -n '1,40p' scripts/validation/check_receipt_hardening.py
sed -n '520,700p' scripts/validation/check_receipt_hardening.py
printf '\n%s\n' '== receipt-hash implementation references =='
rg -n -C 12 \
'def compute_contract_(entry_)?sha256|compute_contract_entry_sha256|compute_contract_sha256|ContractEntryNotFoundError' \
scripts docs .github --glob '*.py' --glob '*.md' --glob '*.yaml' | sed -n '1,320p'
printf '\n%s\n' '== contract structure and target entries =='
rg -n -C 12 \
'dod-OmniNode-ai-omninode_infra-pr-825|dod-occ-evidence-validator-pr-825|occ-self-bind-pr-6166|dod_evidence|ticket_id|schema_version' \
contracts/OMN-14916.yaml | sed -n '1,360p'
printf '\n%s\n' '== nearby receipt policy documentation =='
sed -n '1,42p' docs/standards/receipt_hashing_and_supersession.md
sed -n '40,56p' CLAUDE.md
sed -n '440,465p' .pre-commit-config.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 30891
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '== dependency and local implementation availability =='
rg -n -C 5 'omnibase_core|validator_receipt_gate' pyproject.toml uv.lock requirements*.txt .github scripts tests 2>/dev/null | sed -n '1,260p'
find . -type f -path '*omnibase_core*' -o -type f -name '*validator_receipt_gate*' | sed -n '1,120p'
printf '\n%s\n' '== hash-related tests and examples =='
rg -n -C 10 \
'compute_contract_entry_sha256|contract_entry_sha256:|contract_sha256:|canonical.*JSON|sort_keys' \
tests scripts docs drift --glob '*.py' --glob '*.yaml' --glob '*.md' | sed -n '1,360p'
printf '\n%s\n' '== candidate canonical-entry hashes =='
python3 - <<'PY'
import hashlib
import json
from pathlib import Path
try:
import yaml
except Exception as exc:
raise SystemExit(f"PyYAML unavailable: {exc}")
contract_path = Path("contracts/OMN-14916.yaml")
data = yaml.safe_load(contract_path.read_text())
targets = {
"dod-OmniNode-ai-omninode_infra-pr-825":
"sha256:05d1a6ded48048502fb0262f89a9fae1228cb7da3bada363b79c0b2a33a8f4d9",
"dod-occ-evidence-validator-pr-825":
"sha256:3114317b55f62b47953794fa1213eddb7e87544d5b622266037154fc69b33c12",
"occ-self-bind-pr-6166":
"sha256:5e6e09142f52ff5b540b6f06655f3520dec7b1887aad49b951de8275092e2479",
}
entries = {item["id"]: item for item in data["dod_evidence"]}
for item_id, expected in targets.items():
item = entries[item_id]
candidates = {
"header+dod_evidence": {
"schema_version": data["schema_version"],
"ticket_id": data["ticket_id"],
"dod_evidence": item,
},
"header+entry": {
"schema_version": data["schema_version"],
"ticket_id": data["ticket_id"],
"entry": item,
},
"entry-only": item,
}
print(f"\n{item_id}")
print(f"expected: {expected}")
for name, payload in candidates.items():
raw = json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
digest = "sha256:" + hashlib.sha256(raw).hexdigest()
print(f"{name}: {digest} {'MATCH' if digest == expected else ''}")
PYRepository: OmniNode-ai/onex_change_control
Length of output: 21378
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import hashlib
import json
from pathlib import Path
import yaml
contract_path = Path("contracts/OMN-14916.yaml")
data = yaml.safe_load(contract_path.read_text())
targets = {
"dod-OmniNode-ai-omninode_infra-pr-825":
"sha256:05d1a6ded48048502fb0262f89a9fae1228cb7da3bada363b79c0b2a33a8f4d9",
"dod-occ-evidence-validator-pr-825":
"sha256:3114317b55f62b47953794fa1213eddb7e87544d5b622266037154fc69b33c12",
"occ-self-bind-pr-6166":
"sha256:5e6e09142f52ff5b540b6f06655f3520dec7b1887aad49b951de8275092e2479",
}
entries = {item["id"]: item for item in data["dod_evidence"]}
for item_id, expected in targets.items():
item = entries[item_id]
print(f"\n{item_id}\nexpected: {expected}")
candidates = {
"header+dod_evidence": {
"schema_version": data["schema_version"],
"ticket_id": data["ticket_id"],
"dod_evidence": item,
},
"header+entry": {
"schema_version": data["schema_version"],
"ticket_id": data["ticket_id"],
"entry": item,
},
"entry-only": item,
}
for name, payload in candidates.items():
raw = json.dumps(
payload, sort_keys=True, separators=(",", ":"), ensure_ascii=False
).encode()
digest = "sha256:" + hashlib.sha256(raw).hexdigest()
marker = "MATCH" if digest == expected else ""
print(f"{name}: {digest} {marker}")
PY
printf '\n%s\n' '== pinned omnibase_core source metadata =='
sed -n '15,32p' pyproject.toml
sed -n '700,722p' uv.lockRepository: OmniNode-ai/onex_change_control
Length of output: 286
🌐 Web query:
omnibase_core 0.46.7 validator_receipt_gate compute_contract_entry_sha256 source
💡 Result:
In omnibase_core version 0.46.7, validator_receipt_gate is a module located within the library's validation framework [1]. It was previously named receipt_gate.py before being renamed in a refactor [1]. The function compute_contract_entry_sha256 is a utility within this module used for contract validation, specifically involving the computation of SHA256 hashes for contract entries [1]. This functionality is part of the broader ONEX (OmniNode eXecution) platform kernel, which manages node execution, contract models, and validation tooling [2][3]. The validation logic is integrated into CI/CD workflows and pre-commit checks to ensure architectural invariants, such as verifying contract consistency and evidence integrity [1][4][5]. The primary source for this code is the official OmniNode-ai/omnibase_core repository on GitHub [3].
Citations:
- 1: OmniNode-ai/omnibase_core@f91468b
- 2: https://pypi.org/project/omnibase_core/0.46.7/
- 3: https://github.com/OmniNode-ai/omnibase_core
- 4: fix(OMN-14130): bump omnibase-core 0.46.3->0.46.5 so occ-preflight runs the OMN-13888 grandfather validator omnibase_infra#2231
- 5: https://github.com/OmniNode-ai/omnimarket/blob/ad312f3c28a53332d8b15355321e13817c06bd95/.github/workflows/call-occ-attestation-observe.yml
🏁 Script executed:
#!/bin/bash
set -euo pipefail
url='https://raw.githubusercontent.com/OmniNode-ai/omnibase_core/0.46.7/src/omnibase_core/validation/validator_receipt_gate.py'
curl --fail --silent --show-error "$url" | sed -n '1,260p'Repository: OmniNode-ai/onex_change_control
Length of output: 220
🏁 Script executed:
#!/bin/bash
set -euo pipefail
commit='f91468b0e930b2853a3f0bf0ba82868cd9fd8d7b'
api="https://api.github.com/repos/OmniNode-ai/omnibase_core/git/trees/${commit}?recursive=1"
curl --fail --silent --show-error "$api" |
python3 -c '
import json, sys
tree = json.load(sys.stdin).get("tree", [])
for item in tree:
path = item.get("path", "")
if "receipt_gate" in path or "validator_receipt" in path:
print(path)
'Repository: OmniNode-ai/onex_change_control
Length of output: 824
🌐 Web query:
site:github.com/OmniNode-ai/omnibase_core "def compute_contract_entry_sha256"
💡 Result:
The term compute_contract_sha256 (frequently associated with compute_contract_entry_sha256 in related testing contexts) is a utility function found within the omnibase_core platform—the core kernel for the ONEX (OmniNode eXecution) architecture [1][2]. It is primarily used in the context of contract validation and integrity verification [3]. In the omnibase_core codebase, this function is responsible for calculating the SHA-256 hash of contract files (typically YAML-based) to ensure deterministic identification and validation [1][3]. This mechanism is critical for: 1. Contract Integrity: Ensuring that the contract being executed matches the expected, registered version [1]. 2. Validation: Supporting the validator_receipt_gate, which verifies contract receipts and identity bindings [3]. 3. Deterministic Identification: Enabling the system to uniquely identify contract definitions by their hash, which is essential for managing dynamic contract discovery and execution across different node types (Compute, Effect, Reducer, and Orchestrator) [1][4][5]. The function is typically located within the validation modules of the omnibase_core library, such as src/omnibase_core/validation/validator_receipt_gate.py [3]. It operates on the raw contract definition to generate a consistent fingerprint, which is then used by the infrastructure to enforce security policies and track contract lifecycles [1][5].
Citations:
- 1: https://github.com/OmniNode-ai/omnibase_core/blob/main/CHANGELOG.md
- 2: https://github.com/OmniNode-ai/omnibase_core/blob/main/README.md
- 3: OmniNode-ai/omnibase_core@f91468b
- 4: https://github.com/OmniNode-ai/omnibase_core/blob/main/docs/architecture/ONEX_FOUR_NODE_ARCHITECTURE.md
- 5: https://github.com/OmniNode-ai/omnibase_core/blob/main/.yaml-validation-allowlist.yaml
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ruby <<'RB'
require "yaml"
require "json"
require "digest"
contract = YAML.load_file("contracts/OMN-14916.yaml")
targets = {
"dod-OmniNode-ai-omninode_infra-pr-825" =>
"sha256:05d1a6ded48048502fb0262f89a9fae1228cb7da3bada363b79c0b2a33a8f4d9",
"dod-occ-evidence-validator-pr-825" =>
"sha256:3114317b55f62b47953794fa1213eddb7e87544d5b622266037154fc69b33c12",
"occ-self-bind-pr-6166" =>
"sha256:5e6e09142f52ff5b540b6f06655f3520dec7b1887aad49b951de8275092e2479"
}
entries = contract.fetch("dod_evidence").to_h { |item| [item.fetch("id"), item] }
targets.each do |id, expected|
item = entries.fetch(id)
puts "\n#{id}\nexpected: #{expected}"
candidates = {
"header+dod_evidence" => {
"schema_version" => contract.fetch("schema_version"),
"ticket_id" => contract.fetch("ticket_id"),
"dod_evidence" => item
},
"header+entry" => {
"schema_version" => contract.fetch("schema_version"),
"ticket_id" => contract.fetch("ticket_id"),
"entry" => item
},
"entry-only" => item
}
candidates.each do |name, payload|
canonical = JSON.generate(payload.sort.to_h) # recursive sorting below
canonical = JSON.generate(
JSON.parse(JSON.generate(payload), symbolize_names: false)
)
digest = "sha256:#{Digest::SHA256.hexdigest(canonical)}"
puts "#{name}: #{digest} #{digest == expected ? 'MATCH' : ''}"
end
end
RBRepository: OmniNode-ai/onex_change_control
Length of output: 1310
🏁 Script executed:
#!/bin/bash
set -euo pipefail
wheel_url='https://files.pythonhosted.org/packages/38/21/4e02df34674e66308c4154dea2b1b7971f0635e475ebadda77ded36d2dc1/omnibase_core-0.46.7-py3-none-any.whl'
tmp_wheel="$(mktemp --suffix=.whl)"
trap 'rm -f "$tmp_wheel"' EXIT
curl --fail --silent --show-error --location "$wheel_url" -o "$tmp_wheel"
printf '%s\n' '== validator_receipt_gate module path =='
unzip -l "$tmp_wheel" | awk '/validator_receipt_gate|receipt_gate/ {print}'
printf '\n%s\n' '== hash implementation =='
entry_path="$(unzip -Z1 "$tmp_wheel" | grep 'validator_receipt_gate\.py$' | head -n 1)"
test -n "$entry_path"
unzip -p "$tmp_wheel" "$entry_path" |
rg -n -C 20 \
'def compute_contract_(entry_)?sha256|canonical|json.dumps|sha256|ContractEntryNotFoundError'Repository: OmniNode-ai/onex_change_control
Length of output: 23352
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ruby <<'RB'
require "yaml"
require "json"
require "digest"
def deep_sort(value)
case value
when Hash
value.keys.sort.each_with_object({}) do |key, result|
result[key] = deep_sort(value[key])
end
when Array
value.map { |item| deep_sort(item) }
else
value
end
end
contract = YAML.load_file("contracts/OMN-14916.yaml")
targets = {
"dod-OmniNode-ai-omninode_infra-pr-825" =>
"sha256:05d1a6ded48048502fb0262f89a9fae1228cb7da3bada363b79c0b2a33a8f4d9",
"dod-occ-evidence-validator-pr-825" =>
"sha256:3114317b55f62b47953794fa1213eddb7e87544d5b622266037154fc69b33c12",
"occ-self-bind-pr-6166" =>
"sha256:5e6e09142f52ff5b540b6f06655f3520dec7b1887aad49b951de8275092e2479"
}
entries = contract.fetch("dod_evidence").to_h { |item| [item.fetch("id"), item] }
targets.each do |id, expected|
item = entries.fetch(id)
canonical = {
"header" => {
"ticket_id" => contract.fetch("ticket_id"),
"schema_version" => contract.fetch("schema_version")
},
"entry" => item
}
blob = JSON.generate(deep_sort(canonical))
actual = "sha256:#{Digest::SHA256.hexdigest(blob)}"
puts "#{id}"
puts "expected: #{expected}"
puts "actual: #{actual}"
puts(actual == expected ? "MATCH" : "MISMATCH")
end
RBRepository: OmniNode-ai/onex_change_control
Length of output: 773
Use timestamped receipt filenames.
The three receipts use command.yaml, but the required path is drift/dod_receipts/<TICKET>/<ITEM_ID>/<run_timestamp>.yaml. Rename them and keep the existing ModelDodReceipt fields. The existing contract_entry_sha256 values are correct; contract_sha256 is a legacy fallback and is not required alongside them.
📍 Affects 3 files
drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml#L11-L11(this comment)drift/dod_receipts/OMN-14916/dod-occ-evidence-validator-pr-825/command.yaml#L7-L7drift/dod_receipts/OMN-14916/occ-self-bind-pr-6166/command.yaml#L8-L8
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml`
at line 11, Rename all three receipt
files—drift/dod_receipts/OMN-14916/dod-OmniNode-ai-omninode_infra-pr-825/command.yaml
(line 11),
drift/dod_receipts/OMN-14916/dod-occ-evidence-validator-pr-825/command.yaml
(line 7), and drift/dod_receipts/OMN-14916/occ-self-bind-pr-6166/command.yaml
(line 8)—to timestamped <run_timestamp>.yaml filenames under their existing
ticket/item directories. Preserve the existing ModelDodReceipt fields and
contract_entry_sha256 values; remove any unnecessary legacy contract_sha256
fields.
Sources: Coding guidelines, Learnings
jonahgabriel
added
the
ci:ready
1 participant
Summary
Verification
Evidence-Ticket: OMN-14916
Evidence-Source: manual-merge-sweep
Summary by CodeRabbit