diff --git a/contracts/OMN-15918.yaml b/contracts/OMN-15918.yaml new file mode 100644 index 00000000000..c83799b3a02 --- /dev/null +++ b/contracts/OMN-15918.yaml @@ -0,0 +1,59 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15918" +title: "OCC evidence for OMN-15918" +summary: > + OCC companion authored directly (claude-code) for OmniNode-ai/omnibase_infra PR #2727 -- node_gateway_attach_effect + hardening (JWKS signature verification, heartbeat/detach identity binding, atomic session-store transitions + via put_if_present, outage-vs-revocation circuit breaker split). Companion authored directly because + the event-driven occ-autobind / occ-companion-effect consumer (node_occ_companion_compute) had not produced + a companion PR within the CI window; the source PR's occ-autobind and occ-companion-effect commands + both published successfully (see command.yaml evidence below), matching the current precedent shape + (e.g. OCC#6392 for OMN-15937). +is_seam_ticket: false +interface_change: true +interfaces_touched: + - "protocols" + - "public_api" +evidence_requirements: + - kind: "ci" + description: "PR #2727 CI checks green" + command: "gh pr checks ${PR_NUMBER} --repo ${REPO}" +emergency_bypass: + enabled: false + justification: "" + follow_up_ticket_id: "" +dod_evidence: + - id: "dod-OmniNode-ai-omnibase_infra-pr-2727" + description: "PR #2727 on OmniNode-ai/omnibase_infra -- Evidence-Source companion." + source: "generated" + checks: + - check_type: "command" + check_value: "gh pr view 2727 --repo OmniNode-ai/omnibase_infra --json number,state" + - check_type: "command" + check_value: "gh pr view 2727 --repo OmniNode-ai/omnibase_infra --json files" + - id: "dod-occ-evidence-admissibility-validator" + description: "Hosted OCC evidence admissibility validator (OMN-15247)." + source: "generated" + evidence_artifact: "supersedes_dod_evidence:dod-OmniNode-ai-omnibase_infra-pr-2727" + checks: + - check_type: "command" + check_value: "uv run pytest tests/test_evidence_admissibility.py -q" + - id: "dod-deploy-falsifiable-probe" + description: > + Falsifiable deploy probe (OMN-14505/OMN-8912) for node_gateway_attach_effect -- this node has no + live deployed instance yet (OMN-15750 has not shipped a running runtime), so per the hermetic-compute-only + carve-out (OMN-14051) the probe reads the actual merged source content live from GitHub (never this + ticket's own receipts) and asserts the introduced symbol is genuinely present at the PR head. + source: "generated" + checks: + - check_type: "command" + check_value: >- + body="$(gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" + --jq .content | base64 -d)" && printf '%s' "$body" | grep -qF "def verify_and_decode_claims" + - id: "occ-self-bind-pr-6396" + description: "OCC companion PR #6396 — self-bind for OMN-15918 (OMN-14650)." + source: "generated" + checks: + - check_type: "command" + check_value: "gh pr view 6396 --repo OmniNode-ai/onex_change_control --json number,state" diff --git a/drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml b/drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml new file mode 100644 index 00000000000..cd790062de4 --- /dev/null +++ b/drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml @@ -0,0 +1,21 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15918" +evidence_item_id: "dod-OmniNode-ai-omnibase_infra-pr-2727" +check_type: "command" +check_value: |- + gh pr view 2727 --repo OmniNode-ai/omnibase_infra --json number,state,headRefName +contract_sha256: "sha256:53f34b5b5e2ec5292e8e8391955cca2f4874d3324b40180cf638029b6f0d08c3" +contract_entry_sha256: "sha256:44ef0b063ec906d686106b1018d9fd99230843254808f0ebff757dc90dd05304" +status: PASS +run_timestamp: "2026-08-12T20:39:22.600000+00:00" +commit_sha: "2dcb00e214993c677e0d429cebb9c527e54e3785" +runner: "claude-code" +verifier: "claude-code-review" +probe_command: "gh pr view 2727 --repo OmniNode-ai/omnibase_infra --json number,state,headRefName" +probe_stdout: | + {"headRefName":"jonah/omn-15918-attach-hardening","number":2727,"state":"OPEN"} +actual_output: "PASS: Evidence-Source companion for OMN-15918 from OmniNode-ai/omnibase_infra#2727." +exit_code: 0 +pr_number: 2727 +branch: "jonah/omn-15918-occ-companion" diff --git a/drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml b/drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml new file mode 100644 index 00000000000..cae82d3000e --- /dev/null +++ b/drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml @@ -0,0 +1,24 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15918" +evidence_item_id: "dod-deploy-falsifiable-probe" +check_type: "command" +check_value: |- + body="$(gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" --jq .content | base64 -d)" && printf '%s' "$body" | grep -qF "def verify_and_decode_claims" +contract_sha256: "sha256:d0b732074ab5912d7c9ea9efc0f1be0463fd9668f63bd9abec263b6a66ed55d4" +contract_entry_sha256: "sha256:a41b70029fe308fdc9897559c24b2899ef90b44cac5dbc014643c5acbe7eed5a" +status: PASS +run_timestamp: "2026-08-12T22:33:19.000000+00:00" +commit_sha: "96c8bcaf2be5f4d5cd155098241b3c22c6713553" +runner: "claude-code" +verifier: "claude-code-review" +probe_command: |- + body="$(gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" --jq .content | base64 -d)" && printf '%s' "$body" | grep -qF "def verify_and_decode_claims" +probe_stdout: | + MATCH FOUND +actual_output: "PASS: live GitHub content fetch of service_keycloak_token_validator.py at 96c8bcaf2be5f4d5cd155098241b3c22c6713553 + contains 'def verify_and_decode_claims' -- the OMN-15918 signature-verification function is genuinely + present in the merged/pushed source, not just claimed in this ticket's own receipts." +exit_code: 0 +pr_number: 2727 +branch: "jonah/omn-15918-occ-companion" diff --git a/drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml b/drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml new file mode 100644 index 00000000000..e01f019d4f1 --- /dev/null +++ b/drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml @@ -0,0 +1,24 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15918" +evidence_item_id: "dod-occ-evidence-admissibility-validator" +check_type: "command" +check_value: |- + uv run pytest tests/test_evidence_admissibility.py -q +contract_sha256: "sha256:53f34b5b5e2ec5292e8e8391955cca2f4874d3324b40180cf638029b6f0d08c3" +contract_entry_sha256: "sha256:59c022463ec37ad3f2a3c650d53154454a43055af94f4421e4f51654738943c3" +status: PASS +run_timestamp: "2026-08-12T20:40:10.000000+00:00" +commit_sha: "2dcb00e214993c677e0d429cebb9c527e54e3785" +runner: "claude-code" +verifier: "claude-code-review" +probe_command: "uv run pytest tests/test_evidence_admissibility.py -q" +probe_stdout: | + ........................................................................ [ 94%] + .... [100%] + 76 passed in 0.07s +actual_output: "PASS: real test_evidence_admissibility.py run against onex_change_control@jonah/omn-15918-occ-companion + (76 passed, exit 0)." +exit_code: 0 +pr_number: 2727 +branch: "jonah/omn-15918-occ-companion" diff --git a/drift/dod_receipts/OMN-15918/occ-self-bind-pr-6396/command.yaml b/drift/dod_receipts/OMN-15918/occ-self-bind-pr-6396/command.yaml new file mode 100644 index 00000000000..34d8c7e5880 --- /dev/null +++ b/drift/dod_receipts/OMN-15918/occ-self-bind-pr-6396/command.yaml @@ -0,0 +1,23 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15918" +evidence_item_id: "occ-self-bind-pr-6396" +check_type: "command" +check_value: "gh pr view 6396 --repo OmniNode-ai/onex_change_control --json number,state" +contract_sha256: "sha256:03d91f21485bfbd428fca36a33d541fca56b646ace3e9c114805b76d4c702714" +contract_entry_sha256: "sha256:db4d1fa3aff3118f375d9ece8946a3862609ca6309f175054fa1da3db18fda3a" +status: PASS +run_timestamp: "2026-08-12T22:54:31Z" +commit_sha: "eed96c83bee26de6b585188955036cc2f71b7362" +runner: "codex" +verifier: "occ-eligibility-local-reproduction" +probe_command: "gh api repos/OmniNode-ai/onex_change_control/pulls/6396/files --paginate --jq '.[].sha'" +probe_stdout: | + 4e2ff10c136b54a14bd24ce46b43ac17781c3cb2 + cd790062de4c38032d814c9732448703d27d3aab + cae82d3000ea48c5e111525871c0f4a87563783f + e01f019d4f1775d6ec9595558c911640ff0db4bb +actual_output: "PASS: OCC self-bind for OMN-15918 (OCC#6396)." +exit_code: 0 +pr_number: 6396 +branch: "jonah/omn-15918-occ-companion"