Repository navigation
fix(OMN-15740): repair non-falsifiable dod-deploy-assessment probe - #6236
Merged
jonahgabriel merged 3 commits intoAug 9, 2026
Merged
Conversation
The autobind-generated dod-deploy-assessment check_value (`gh pr diff 2689 --repo ... --name-only | grep -ciE '...'`) greps the PR diff text itself -- not falsifiable against deployed/pushed state, and rejected by the OMN-14443 deploy-gate falsifiability ratchet on the live 2026-08-08 run (job 93163248049): "no live-surface probe in command position -- the check's exit status cannot depend on the state of the deployed system." Replaced with a live fetch of the actually-pushed file content at PR #2689's rebased head (9fd87f4c1), asserting the OMN-15740 transform-seam wiring symbol is present: gh api "repos/OmniNode-ai/omnibase_infra/contents/ src/omnibase_infra/nodes/node_bus_forwarder_effect/services/ service_gateway_forwarder.py?ref=9fd87f4c1..." --jq .content | base64 -d | grep '_forward_outbound_handler = HandlerForwardOutbound' `_forward_outbound_handler = HandlerForwardOutbound(config)` does not exist on dev prior to OMN-15740 (verified: 0 occurrences), so this is a real, ticket-introduced symbol, not a pre-existing string a vacuous probe could coast on. contract_sha256/contract_entry_sha256 recomputed via omnibase_core.validation.validator_receipt_gate.compute_contract_sha256 /compute_contract_entry_sha256 (tool-computed, not hand-authored) and the receipt re-run PASS carries the real matched-line stdout (the Receipt Hardening Gate rejects an executable check_type with empty probe_stdout). Ticket: OMN-15740 Evidence-Ticket: OMN-15740 Evidence-Source: OCC#6208
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 21 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe deploy-scope evidence check now verifies pinned source content for the expected handler binding. The contract also records OCC companion PR 6236 with a passing self-bind receipt. ChangesOMN-15740 evidence verification
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…y gap occ-preflight/eligibility and Receipt Gate both FAIL on PR #6236 with reason=pr_ticket_mismatch: none of the three existing OMN-15740 receipts (dod-deploy-assessment, dod-occ-evidence-admissibility-validator, occ-self-bind-pr-6208) bind pr_number/commit_sha to #6236 -- they bind to omnibase_infra#2689 or the now-superseded OCC PR #6208. Adds a fourth dod_evidence entry + PASS receipt, occ-self-bind-pr-6236, following the established occ-self-bind-pr-<N> pattern, binding pr_number=6236 / commit_sha=ee7adcf82c89944bc8c34641b069fad2792c5be3. Locally re-ran validator_occ_merge_eligibility.validate_occ_merge_eligibility against this contract+receipts tree with pr-number=6236 and confirmed eligible=true (previously eligible=false, reason=pr_ticket_mismatch). Ticket: OMN-15740 Evidence-Ticket: OMN-15740
jonahgabriel
added
the
ci:ready
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@contracts/OMN-15740.yaml`:
- Around line 32-33: Update contracts/OMN-15740.yaml lines 32-33 to query PR
`#2689`’s current headRefOid and use that verified SHA when fetching the source,
asserting the fetched revision matches it. Regenerate
drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml lines 7-16 from
the verified PR head and record the same SHA there.
- Around line 32-33: Update the check_value command to validate executable
Python wiring rather than arbitrary text: anchor the grep pattern to a
line-shaped assignment containing the _forward_outbound_handler variable and
HandlerForwardOutbound constructor call, or parse the fetched source with ast.
Ensure comments and docstrings cannot satisfy the deployment gate.
- Around line 32-33: Update the PR `#2689` contract checks to validate that its
headRefOid matches the pinned revision 9fd87f4c155ed63b726ab59d513db4668529f3ac
before executing the source fetch in check_value. Preserve the existing
file-content assertion after this revision check.
- Around line 47-53: Update the OCC self-bind command in
contracts/OMN-15740.yaml (lines 47-53) and
drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml (lines 12-20) to
query headRefOid alongside number and state, enforce that headRefOid equals the
receipt commit_sha, and expose the head SHA in probe_stdout and actual_output or
validator output proving the comparison; then regenerate both contract hashes
with omnibase_core.validation.validator_receipt_gate.
In `@drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml`:
- Around line 7-9: Rename both DoD receipt files to timestamp-based
<run_timestamp>.yaml names using their recorded timestamps: update
drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml and
drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml, and adjust any
path-based consumers to reference the new filenames.
- Around line 8-9: Update contract_sha256 in
drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml:8-9 to
sha256:9395e925bcf291a34d29e001cabdd3f1962893a14b8300166734458ac8509e47; leave
contract_entry_sha256 unchanged. The sibling site
drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml:8-9 requires no
direct change because its hashes are already correct.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 681208b8-de93-4ad8-8461-c114cd4fbdfc
📒 Files selected for processing (3)
contracts/OMN-15740.yamldrift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yamldrift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml
Comment on lines
+47
to
+53
| - id: "occ-self-bind-pr-6236" | ||
| description: "Binds OMN-15740 to OCC companion PR #6236 (self-bind) -- #6236 supersedes #6208's dod-deploy-assessment | ||
| repair and is the OCC PR the occ-preflight eligibility gate resolves against on this pass." | ||
| source: "generated" | ||
| checks: | ||
| - check_type: "command" | ||
| check_value: "gh pr view 6236 --repo OmniNode-ai/onex_change_control --json number,state" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- contract excerpt ---'
sed -n '35,65p' contracts/OMN-15740.yaml
printf '%s\n' '--- receipt excerpt ---'
sed -n '1,45p' drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml
printf '%s\n' '--- related symbols and receipts ---'
rg -n -S 'occ-self-bind-pr-6236|_receipt_bound_to_pr|headRefOid|commit_sha|occ-preflight|validator_occ_merge_eligibility' \
contracts drift .github scripts 2>/dev/null | head -250
printf '%s\n' '--- tracked candidate files ---'
git ls-files | rg '(^|/)(contracts/OMN-15740\.yaml|drift/dod_receipts/OMN-15740/|.*occ.*eligibility.*|.*validator.*receipt.*)'Repository: OmniNode-ai/onex_change_control
Length of output: 38463
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- contract hash and receipt-gate references ---'
rg -n -S 'contract_sha256|contract_entry_sha256|validator_receipt_gate|command.yaml|probe_stdout|actual_output' \
contracts drift .github scripts pyproject.toml setup.cfg 2>/dev/null | head -300
printf '%s\n' '--- all OMN-15740 receipt directories ---'
find drift/dod_receipts/OMN-15740 -maxdepth 2 -type f -print 2>/dev/null | sort
printf '%s\n' '--- receipt fields for comparable PR bindings ---'
rg -l -S 'pr_number|headRefOid|probe_command:.*gh pr view|gh pr view .*--json' drift/dod_receipts contracts 2>/dev/null |
while IFS= read -r f; do
echo "### $f"
rg -n -S -C 2 'pr_number|headRefOid|probe_command:.*gh pr view|gh pr view .*--json|commit_sha' "$f" | head -80
doneRepository: OmniNode-ai/onex_change_control
Length of output: 161
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- OCC preflight binding logic ---'
sed -n '270,355p' .github/workflows/call-occ-preflight.yml
sed -n '500,585p' .github/workflows/call-occ-preflight.yml
printf '%s\n' '--- receipt gate binding logic ---'
sed -n '300,355p' .github/workflows/call-receipt-gate.yml
sed -n '760,810p' .github/workflows/call-receipt-gate.yml
printf '%s\n' '--- comparable self-bind contract and receipt ---'
sed -n '45,75p' contracts/OMN-15521.yaml
sed -n '1,35p' drift/dod_receipts/OMN-15740/occ-self-bind-pr-6208/command.yaml
printf '%s\n' '--- local validator implementation locations ---'
find . -type f \( -name 'validator_occ_merge_eligibility.py' -o -name '*receipt*gate*.py' \) -printRepository: OmniNode-ai/onex_change_control
Length of output: 17134
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- OMN-15740 binding descriptions and checks ---'
rg -n -C 4 -S 'occ-self-bind-pr-(6208|6236)|pr_number|commit_sha' \
contracts/OMN-15740.yaml \
drift/dod_receipts/OMN-15740 \
tests/unit/test_call_receipt_gate_workflow_omn10415.py \
tests/unit/test_receipt_gate_regex.py
printf '%s\n' '--- validator binding references in repository text ---'
rg -n -C 3 -S '_receipt_bound_to_pr|receipt.*pr_number|pr_number.*commit_sha|headRefOid.*commit_sha|commit_sha.*headRefOid' \
contracts tests scripts .github 2>/dev/null | head -220Repository: OmniNode-ai/onex_change_control
Length of output: 30422
Make the OCC self-bind evidence prove the PR head binding.
The contract and receipt query only number,state, which does not prove that commit_sha matches PR #6236. Query headRefOid and enforce equality with the receipt’s commit_sha. Include the head SHA in probe_stdout and actual_output, or record validator output that proves the comparison. Update both contract hashes with omnibase_core.validation.validator_receipt_gate.
📍 Affects 2 files
contracts/OMN-15740.yaml#L47-L53(this comment)drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml#L12-L20
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@contracts/OMN-15740.yaml` around lines 47 - 53, Update the OCC self-bind
command in contracts/OMN-15740.yaml (lines 47-53) and
drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml (lines 12-20) to
query headRefOid alongside number and state, enforce that headRefOid equals the
receipt commit_sha, and expose the head SHA in probe_stdout and actual_output or
validator output proving the comparison; then regenerate both contract hashes
with omnibase_core.validation.validator_receipt_gate.
Source: Learnings
Comment on lines
+7
to
+9
| gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_bus_forwarder_effect/services/service_gateway_forwarder.py?ref=9fd87f4c155ed63b726ab59d513db4668529f3ac" --jq .content | base64 -d | grep '_forward_outbound_handler = HandlerForwardOutbound' | ||
| contract_sha256: "sha256:d459b3d1ebf19d39f3f7e7c22154cdb508b16533ae3d6fddcde39a293e4b6df2" | ||
| contract_entry_sha256: "sha256:55b6fe9dc99c31dd84a0a97c7af3ecb08e732f456bf48202babebdbedcbd5043" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- receipt files ---'
git ls-files 'drift/dod_receipts/**'
printf '%s\n' '--- target receipt contents ---'
for f in \
drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml \
drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml
do
if [ -f "$f" ]; then
echo "### $f"
cat -n "$f"
else
echo "MISSING: $f"
fi
done
printf '%s\n' '--- references to target receipt paths and item identifiers ---'
rg -n --hidden \
-e 'dod-deploy-assessment' \
-e 'occ-self-bind-pr-6236' \
-e 'drift/dod_receipts/OMN-15740' \
-g '!node_modules' -g '!dist' -g '!build' .
printf '%s\n' '--- receipt-related schema/model references ---'
rg -n --hidden \
-e 'ModelDodReceipt' \
-e 'run_timestamp' \
-e 'dod_receipts' \
-g '!node_modules' -g '!dist' -g '!build' .Repository: OmniNode-ai/onex_change_control
Length of output: 50388
🏁 Script executed:
#!/bin/bash
set -e
targets=(
"drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml"
"drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml"
)
printf '%s\n' '--- target files ---'
for f in "${targets[@]}"; do
if [ -f "$f" ]; then
echo "### $f"
cat -n "$f"
else
echo "MISSING: $f"
fi
done
printf '%s\n' '--- OMN-15740 tracked paths ---'
git ls-files 'drift/dod_receipts/OMN-15740/**'
printf '%s\n' '--- exact OMN-15740 references outside the two target files ---'
rg -n --hidden \
-e 'dod-deploy-assessment' \
-e 'occ-self-bind-pr-6236' \
-e 'drift/dod_receipts/OMN-15740' \
-g '!drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml' \
-g '!drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml' \
-g '!node_modules' -g '!dist' -g '!build' . \
| head -200 || true
printf '%s\n' '--- local rules and validators ---'
rg -n --hidden \
-e 'run_timestamp.*yaml' \
-e '<run_timestamp>' \
-e 'ModelDodReceipt' \
-e 'receipt.*path' \
-e 'receipt.*filename' \
-g '!drift/dod_receipts/**' \
-g '!node_modules' -g '!dist' -g '!build' . \
| head -300 || trueRepository: OmniNode-ai/onex_change_control
Length of output: 50387
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- exact OMN-15740 references ---'
rg -n --hidden \
-e 'OMN-15740' \
-e 'occ-self-bind-pr-6236' \
-e 'dod-deploy-assessment' \
-g '!drift/dod_receipts/**' \
-g '!node_modules' -g '!dist' -g '!build' . \
| rg '15740|6236' || true
printf '%s\n' '--- canonical-path test ---'
sed -n '190,250p' tests/unit/scripts/test_check_dod_compliance.py
sed -n '245,280p' tests/test_check_receipt_hardening.py
printf '%s\n' '--- receipt checker implementation ---'
rg -n -C 8 \
-e 'Canonical:' \
-e 'run_timestamp' \
-e 'timestamp.less' \
-e 'timestamp.*receipt' \
-e 'check_receipt_file' \
scripts tests/unit tests \
| head -300
printf '%s\n' '--- relevant project documentation and configuration ---'
rg -n --hidden \
-e 'drift/dod_receipts/<TICKET>/<ITEM_ID>/<run_timestamp>.yaml' \
-e 'run_timestamp.*filename' \
-e 'timestamped receipt' \
-e 'timestamp.*receipt' \
-g '!drift/dod_receipts/**' \
-g '!node_modules' -g '!dist' -g '!build' \
README.md CONTRIBUTING.md docs scripts tests .github .onex_ratchets 2>/dev/null \
| head -300 || trueRepository: OmniNode-ai/onex_change_control
Length of output: 32543
🏁 Script executed:
#!/bin/bash
set -e
python3 - <<'PY'
from pathlib import Path
import re
root = Path(".")
targets = [
Path("drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml"),
Path("drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml"),
]
timestamp_name = re.compile(
r"^\d{4}-\d{2}-\d{2}T[^/]+\.yaml$|^\d{8}T[^/]+\.yaml$"
)
for path in targets:
text = path.read_text()
match = re.search(r'(?m)^run_timestamp:\s*["\']?([^"\']+)["\']?\s*$', text)
timestamp = match.group(1) if match else None
print(f"{path}:")
print(f" exists={path.is_file()}")
print(f" filename={path.name}")
print(f" run_timestamp={timestamp}")
print(f" filename_matches_timestamp_shape={bool(timestamp_name.match(path.name))}")
print("exact path references:")
for needle in (
"drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml",
"drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml",
):
refs = []
for path in root.rglob("*"):
if not path.is_file() or ".git" in path.parts:
continue
try:
text = path.read_text(errors="ignore")
except OSError:
continue
if needle in text:
refs.append(str(path))
print(f" {needle}: {refs or 'none'}")
PY
printf '%s\n' '--- canonical location documentation ---'
sed -n '20,38p' docs/RECEIPT_LOCATIONS.md
sed -n '84,98p' docs/RECEIPT_LOCATIONS.md
printf '%s\n' '--- OMN-15740 contract evidence identifiers ---'
sed -n '20,55p' contracts/OMN-15740.yamlRepository: OmniNode-ai/onex_change_control
Length of output: 4090
Use timestamped filenames for both DoD receipts.
Rename them to <run_timestamp>.yaml using their recorded timestamps. Update any path-based consumers.
📍 Affects 2 files
drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml#L7-L9(this comment)drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml#L1-L7
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml` around lines
7 - 9, Rename both DoD receipt files to timestamp-based <run_timestamp>.yaml
names using their recorded timestamps: update
drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml and
drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml, and adjust any
path-based consumers to reference the new filenames.
Source: Coding guidelines
Comment on lines
+8
to
+9
| contract_sha256: "sha256:d459b3d1ebf19d39f3f7e7c22154cdb508b16533ae3d6fddcde39a293e4b6df2" | ||
| contract_entry_sha256: "sha256:55b6fe9dc99c31dd84a0a97c7af3ecb08e732f456bf48202babebdbedcbd5043" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- target files ---'
git ls-files 'drift/dod_receipts/OMN-15740/*/command.yaml' 'contracts/OMN-15740.yaml'
printf '%s\n' '--- receipt contents ---'
for f in drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml \
drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml \
contracts/OMN-15740.yaml; do
echo "### $f"
cat -n "$f"
done
printf '%s\n' '--- related hash logic and receipt schema references ---'
rg -n --glob '!node_modules' --glob '!dist' \
'contract_entry_sha256|contract_sha256|ModelDodReceipt|raw.bytes|canonical.*hash|entry.*hash' .Repository: OmniNode-ai/onex_change_control
Length of output: 50388
🏁 Script executed:
#!/bin/bash
set -e
files=(
drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml
drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml
contracts/OMN-15740.yaml
)
for f in "${files[@]}"; do
echo "### $f"
if [ -f "$f" ]; then
cat -n "$f"
else
echo "MISSING"
fi
done
echo '### raw contract SHA-256'
if [ -f contracts/OMN-15740.yaml ]; then
sha256sum contracts/OMN-15740.yaml
fi
echo '### focused repository references'
rg -n --glob '!drift/dod_receipts/**' --glob '!node_modules/**' --glob '!dist/**' \
'contract_entry_sha256|contract_sha256|ModelDodReceipt|canonical.*hash|entry.*hash|raw bytes|raw-byte' . \
| head -n 300Repository: OmniNode-ai/onex_change_control
Length of output: 42968
🏁 Script executed:
#!/bin/bash
set -e
echo '### hashing standard'
sed -n '1,110p' docs/standards/receipt_hashing_and_supersession.md
echo '### receipt hardening implementation'
sed -n '720,770p' scripts/validation/check_receipt_hardening.py
echo '### dependency and local hash implementations'
rg -n -C 5 \
'compute_contract_entry_sha256|HEADER_FIELDS|contract_entry_sha256' \
pyproject.toml uv.lock src scripts tests docs/standards \
| head -n 500
echo '### installed package candidates'
python3 - <<'PY'
import importlib.util
for name in ("omnibase_core", "yaml"):
print(name, bool(importlib.util.find_spec(name)))
PYRepository: OmniNode-ai/onex_change_control
Length of output: 39024
🏁 Script executed:
#!/bin/bash
set -e
echo '### dependency pin'
sed -n '1,45p' pyproject.toml
echo '### lockfile references'
rg -n -C 4 'name = "omnibase-core"|omnibase_core|omnibase-core' uv.lock | head -n 120
echo '### upstream hash implementation candidates'
for ref in main v0.46.5; do
url="https://raw.githubusercontent.com/OmniNode-ai/omnibase_core/${ref}/src/omnibase_core/validation/validator_receipt_gate.py"
echo "### $url"
curl -fsSL "$url" | rg -n -C 15 \
'def compute_contract_entry_sha256|HEADER_FIELDS|canonical|json.dumps|ContractEntryNotFoundError' \
|| true
doneRepository: OmniNode-ai/onex_change_control
Length of output: 46753
🏁 Script executed:
#!/bin/bash
set -e
command -v ruby
ruby -ryaml -rjson -e 'p YAML.safe_load(File.read("contracts/OMN-15740.yaml")).class'
ruby -ryaml -rjson <<'RUBY' | python3 - <<'PY'
require "yaml"
require "json"
contract = YAML.safe_load(File.binread("contracts/OMN-15740.yaml"))
receipts = {
"dod-deploy-assessment" => "sha256:55b6fe9dc99c31dd84a0a97c7af3ecb08e732f456bf48202babebdbedcbd5043",
"occ-self-bind-pr-6236" => "sha256:5e76a8d89a7d8f7ae366b36e86ec09722c2b3d17a1393d6e0b80366905030878"
}
puts JSON.generate({
"contract" => contract,
"receipts" => receipts
})
RUBY
import hashlib
import json
import sys
payload = json.load(sys.stdin)
contract = payload["contract"]
stored = payload["receipts"]
header = {key: contract.get(key) for key in ("ticket_id", "schema_version")}
for item_id, expected in stored.items():
entries = [item for item in contract["dod_evidence"] if item.get("id") == item_id]
if not entries:
print(f"{item_id}: MISSING")
continue
canonical = {"header": header, "entry": entries[0]}
blob = json.dumps(canonical, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
actual = "sha256:" + hashlib.sha256(blob.encode("utf-8")).hexdigest()
print(f"{item_id}:")
print(f" stored: {expected}")
print(f" computed: {actual}")
print(f" match: {actual == expected}")
PYRepository: OmniNode-ai/onex_change_control
Length of output: 799
🏁 Script executed:
#!/bin/bash
set -e
payload="$(ruby -ryaml -rjson <<'RUBY'
contract = YAML.safe_load(File.binread("contracts/OMN-15740.yaml"))
receipts = {
"dod-deploy-assessment" => "sha256:55b6fe9dc99c31dd84a0a97c7af3ecb08e732f456bf48202babebdbedcbd5043",
"occ-self-bind-pr-6236" => "sha256:5e76a8d89a7d8f7ae366b36e86ec09722c2b3d17a1393d6e0b80366905030878"
}
puts JSON.generate({"contract" => contract, "receipts" => receipts})
RUBY
)"
PAYLOAD="$payload" python3 - <<'PY'
import hashlib
import json
import os
payload = json.loads(os.environ["PAYLOAD"])
contract = payload["contract"]
stored = payload["receipts"]
header = {key: contract.get(key) for key in ("ticket_id", "schema_version")}
for item_id, expected in stored.items():
entries = [item for item in contract["dod_evidence"] if item.get("id") == item_id]
if not entries:
print(f"{item_id}: MISSING")
continue
canonical = {"header": header, "entry": entries[0]}
blob = json.dumps(
canonical, sort_keys=True, separators=(",", ":"), ensure_ascii=False
)
actual = "sha256:" + hashlib.sha256(blob.encode("utf-8")).hexdigest()
print(f"{item_id}:")
print(f" stored: {expected}")
print(f" computed: {actual}")
print(f" match: {actual == expected}")
PYRepository: OmniNode-ai/onex_change_control
Length of output: 585
Update the deploy-assessment contract hash
Set drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml:8 to sha256:9395e925bcf291a34d29e001cabdd3f1962893a14b8300166734458ac8509e47. The OCC receipt already has the correct raw-byte hash and per-entry hash.
📍 Affects 2 files
drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml#L8-L9(this comment)drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml#L8-L9
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml` around lines
8 - 9, Update contract_sha256 in
drift/dod_receipts/OMN-15740/dod-deploy-assessment/command.yaml:8-9 to
sha256:9395e925bcf291a34d29e001cabdd3f1962893a14b8300166734458ac8509e47; leave
contract_entry_sha256 unchanged. The sibling site
drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml:8-9 requires no
direct change because its hashes are already correct.
Source: Coding guidelines
… in place OCC Append-Only Gate FAILED on the prior commit: this PR's original diff edited the already-merged dod-deploy-assessment entry and its receipt in place (new check_value, new hashes) instead of adding a net-new superseding entry. Append-only forbids that regardless of whether the new content is itself correct. Reverts dod-deploy-assessment (contract entry + receipt) to be byte-identical to the merged dev version (verified: contract_entry_sha256 now matches dev's a394af56... exactly). Adds a new dod_evidence entry, dod-deploy-assessment-falsifiable-repair, with evidence_artifact: supersedes_dod_evidence:dod-deploy-assessment carrying the OMN-14443-compliant falsifiable check (live fetch of PR #2689's pushed file content) plus its own PASS receipt. Locally re-ran validator_occ_merge_eligibility against the full updated contract+receipts tree: eligible=true. Ticket: OMN-15740 Evidence-Ticket: OMN-15740
jonahgabriel
deleted the
jonah/omn-15740-fix-deploy-assessment-falsifiability
branch
August 9, 2026 00:14
This was referenced Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The autobind-generated
dod-deploy-assessmentcheck onOMN-15740.yaml(companion for OmniNode-ai/omnibase_infra#2689) usedgh pr diff 2689 --repo ... --name-only | grep -ciE '...', which greps the PR diff text itself — not falsifiable against deployed/pushed state. Rejected live by the OMN-14443 deploy-gate falsifiability ratchet on the current PR head (job https://github.com/OmniNode-ai/omnibase_infra/actions/runs/31281402028/job/93163248049):Fix
Replaced the check with a live fetch of the actually-pushed file content at PR #2689's current (rebased) head
9fd87f4c1, asserting the OMN-15740 transform-seam wiring symbol is present:Verified
_forward_outbound_handler = HandlerForwardOutbound(config)does not exist onomnibase_infradev (0 occurrences) — a real, ticket-introduced symbol, not a pre-existing string a vacuous probe could coast on.contract_sha256/contract_entry_sha256recomputed viaomnibase_core.validation.validator_receipt_gate.compute_contract_sha256/compute_contract_entry_sha256(tool-computed). Receipt re-run PASS carries the real matched-line stdout (Receipt Hardening Gate rejects an executablecheck_typewith emptyprobe_stdout).Evidence
pre-commit runon both changed files: all hooks passed, including Receipt Hardening Gate, Contract DoD-authoring hygiene, Canonical contract shape v1.Ticket: OMN-15740
Evidence-Ticket: OMN-15740
Evidence-Source: OCC#6208
Not merged by this lane — build + PR only, part of the OMN-15740/#2689 P0 reconciliation pass.
Summary by CodeRabbit
Bug Fixes
Chores