Skip to content

fix(OMN-15740): repair non-falsifiable dod-deploy-assessment probe #6236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jonahgabriel merged 3 commits into from
Aug 9, 2026
Merged

fix(OMN-15740): repair non-falsifiable dod-deploy-assessment probe #6236

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ee7adcf
fix(OMN-15740): repair non-falsifiable dod-deploy-assessment probe
jonahgabriel Aug 8, 2026
abba580
fix(OMN-15740): add occ-self-bind-pr-6236 receipt to close eligibilit…
jonahgabriel Aug 8, 2026
09f2549
fix(OMN-15740): supersede dod-deploy-assessment instead of editing it…
jonahgabriel Aug 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions contracts/OMN-15740.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,3 +43,21 @@ dod_evidence:
checks:
- check_type: "command"
check_value: "gh pr view 6208 --repo OmniNode-ai/onex_change_control --json number,state"
- id: "dod-deploy-assessment-falsifiable-repair"
description: "OMN-14443 ratchet repair: dod-deploy-assessment's original check_value greps the PR
diff text itself, which is non-falsifiable against deployed/pushed state. This entry supersedes
it with a live fetch of the actually-pushed file content at PR #2689's head, asserting the OMN-15740
transform-seam wiring symbol is present."
source: "generated"
evidence_artifact: "supersedes_dod_evidence:dod-deploy-assessment"
checks:
- check_type: "command"
check_value: "gh api \"repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_bus_forwarder_effect/services/service_gateway_forwarder.py?ref=9fd87f4c155ed63b726ab59d513db4668529f3ac\"
--jq .content | base64 -d | grep '_forward_outbound_handler = HandlerForwardOutbound'"
- id: "occ-self-bind-pr-6236"
description: "Binds OMN-15740 to OCC companion PR #6236 (self-bind) -- #6236 supersedes #6208's dod-deploy-assessment
repair and is the OCC PR the occ-preflight eligibility gate resolves against on this pass."
source: "generated"
checks:
- check_type: "command"
check_value: "gh pr view 6236 --repo OmniNode-ai/onex_change_control --json number,state"
Comment on lines +57 to +63

@coderabbitai coderabbitai Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- contract excerpt ---'
sed -n '35,65p' contracts/OMN-15740.yaml
printf '%s\n' '--- receipt excerpt ---'
sed -n '1,45p' drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml
printf '%s\n' '--- related symbols and receipts ---'
rg -n -S 'occ-self-bind-pr-6236|_receipt_bound_to_pr|headRefOid|commit_sha|occ-preflight|validator_occ_merge_eligibility' \
  contracts drift .github scripts 2>/dev/null | head -250
printf '%s\n' '--- tracked candidate files ---'
git ls-files | rg '(^|/)(contracts/OMN-15740\.yaml|drift/dod_receipts/OMN-15740/|.*occ.*eligibility.*|.*validator.*receipt.*)'

Repository: OmniNode-ai/onex_change_control

Length of output: 38463

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- contract hash and receipt-gate references ---'
rg -n -S 'contract_sha256|contract_entry_sha256|validator_receipt_gate|command.yaml|probe_stdout|actual_output' \
  contracts drift .github scripts pyproject.toml setup.cfg 2>/dev/null | head -300
printf '%s\n' '--- all OMN-15740 receipt directories ---'
find drift/dod_receipts/OMN-15740 -maxdepth 2 -type f -print 2>/dev/null | sort
printf '%s\n' '--- receipt fields for comparable PR bindings ---'
rg -l -S 'pr_number|headRefOid|probe_command:.*gh pr view|gh pr view .*--json' drift/dod_receipts contracts 2>/dev/null |
  while IFS= read -r f; do
    echo "### $f"
    rg -n -S -C 2 'pr_number|headRefOid|probe_command:.*gh pr view|gh pr view .*--json|commit_sha' "$f" | head -80
  done

Repository: OmniNode-ai/onex_change_control

Length of output: 161

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- OCC preflight binding logic ---'
sed -n '270,355p' .github/workflows/call-occ-preflight.yml
sed -n '500,585p' .github/workflows/call-occ-preflight.yml
printf '%s\n' '--- receipt gate binding logic ---'
sed -n '300,355p' .github/workflows/call-receipt-gate.yml
sed -n '760,810p' .github/workflows/call-receipt-gate.yml
printf '%s\n' '--- comparable self-bind contract and receipt ---'
sed -n '45,75p' contracts/OMN-15521.yaml
sed -n '1,35p' drift/dod_receipts/OMN-15740/occ-self-bind-pr-6208/command.yaml
printf '%s\n' '--- local validator implementation locations ---'
find . -type f \( -name 'validator_occ_merge_eligibility.py' -o -name '*receipt*gate*.py' \) -print

Repository: OmniNode-ai/onex_change_control

Length of output: 17134

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- OMN-15740 binding descriptions and checks ---'
rg -n -C 4 -S 'occ-self-bind-pr-(6208|6236)|pr_number|commit_sha' \
  contracts/OMN-15740.yaml \
  drift/dod_receipts/OMN-15740 \
  tests/unit/test_call_receipt_gate_workflow_omn10415.py \
  tests/unit/test_receipt_gate_regex.py
printf '%s\n' '--- validator binding references in repository text ---'
rg -n -C 3 -S '_receipt_bound_to_pr|receipt.*pr_number|pr_number.*commit_sha|headRefOid.*commit_sha|commit_sha.*headRefOid' \
  contracts tests scripts .github 2>/dev/null | head -220

Repository: OmniNode-ai/onex_change_control

Length of output: 30422

Make the OCC self-bind evidence prove the PR head binding.

The contract and receipt query only number,state, which does not prove that commit_sha matches PR #6236. Query headRefOid and enforce equality with the receipt’s commit_sha. Include the head SHA in probe_stdout and actual_output, or record validator output that proves the comparison. Update both contract hashes with omnibase_core.validation.validator_receipt_gate.

📍 Affects 2 files
  • contracts/OMN-15740.yaml#L47-L53 (this comment)
  • drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml#L12-L20
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@contracts/OMN-15740.yaml` around lines 47 - 53, Update the OCC self-bind
command in contracts/OMN-15740.yaml (lines 47-53) and
drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml (lines 12-20) to
query headRefOid alongside number and state, enforce that headRefOid equals the
receipt commit_sha, and expose the head SHA in probe_stdout and actual_output or
validator output proving the comparison; then regenerate both contract hashes
with omnibase_core.validation.validator_receipt_gate.

Source: Learnings

23 changes: 23 additions & 0 deletions drift/dod_receipts/OMN-15740/dod-deploy-assessment-falsifiable-repair/command.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
---
schema_version: "1.0.0"
ticket_id: "OMN-15740"
evidence_item_id: "dod-deploy-assessment-falsifiable-repair"
check_type: "command"
check_value: |-
gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_bus_forwarder_effect/services/service_gateway_forwarder.py?ref=9fd87f4c155ed63b726ab59d513db4668529f3ac" --jq .content | base64 -d | grep '_forward_outbound_handler = HandlerForwardOutbound'
contract_sha256: "sha256:930a9499319bfda367462c84dcb5aed727076985e4ec89425dfa5f640b729361"
contract_entry_sha256: "sha256:a2367c07cf047c16a29119b66e68380a05402025f8d78f6b3e97914585d44061"
status: PASS
run_timestamp: "2026-08-08T23:40:00.000000+00:00"
commit_sha: "9fd87f4c155ed63b726ab59d513db4668529f3ac"
runner: "reconciliation-lane-manual-repair"
verifier: "mergesweep-0808-p0dfix"
probe_command: |-
gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_bus_forwarder_effect/services/service_gateway_forwarder.py?ref=9fd87f4c155ed63b726ab59d513db4668529f3ac" --jq .content | base64 -d | grep '_forward_outbound_handler = HandlerForwardOutbound'
probe_stdout: |
self._forward_outbound_handler = HandlerForwardOutbound(config)
actual_output: |-
PASS: fetched the actually-pushed service_gateway_forwarder.py at PR #2689's rebased head (9fd87f4c1) and confirmed the OMN-15740 transform-seam wiring symbol (_forward_outbound_handler = HandlerForwardOutbound) is present. Supersedes dod-deploy-assessment (evidence_artifact: supersedes_dod_evidence:dod-deploy-assessment) rather than editing it in place, per the OCC Append-Only Gate -- the original entry's check_value greps the PR diff text itself, which is non-falsifiable against deployed/pushed state and was rejected by the OMN-14443 falsifiability ratchet on 2026-08-08 (job 93163248049). The original dod-deploy-assessment entry+receipt are left byte-identical to the merged dev version.
exit_code: 0
pr_number: 2689
branch: "jonah/omn-15740-fix-deploy-assessment-falsifiability"
24 changes: 24 additions & 0 deletions drift/dod_receipts/OMN-15740/occ-self-bind-pr-6236/command.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
---
schema_version: "1.0.0"
ticket_id: "OMN-15740"
evidence_item_id: "occ-self-bind-pr-6236"
check_type: "command"
check_value: |-
gh pr view 6236 --repo OmniNode-ai/onex_change_control --json number,state
contract_sha256: "sha256:930a9499319bfda367462c84dcb5aed727076985e4ec89425dfa5f640b729361"
contract_entry_sha256: "sha256:5e76a8d89a7d8f7ae366b36e86ec09722c2b3d17a1393d6e0b80366905030878"
status: PASS
run_timestamp: "2026-08-08T23:22:34.600000+00:00"
commit_sha: "ee7adcf82c89944bc8c34641b069fad2792c5be3"
runner: "reconciliation-lane-manual-repair"
verifier: "mergesweep-0808-p0dfix"
probe_command: "gh pr view 6236 --repo OmniNode-ai/onex_change_control --json number,state"
probe_stdout: |
{"number":6236,"state":"OPEN"}
actual_output: "PASS: OCC self-bind for OMN-15740 (OCC#6236). Prior receipts (dod-deploy-assessment/dod-occ-evidence-admissibility-validator/occ-self-bind-pr-6208)
all bind pr_number to #2689 or the superseded OCC PR #6208, none of which satisfy validator_occ_merge_eligibility._receipt_bound_to_pr
against PR #6236's own pr_number/commit_sha -- this receipt closes that gap so occ-preflight / eligibility
resolves ELIGIBLE for #6236."
exit_code: 0
pr_number: 6236
branch: "jonah/omn-15740-fix-deploy-assessment-falsifiability"
Loading