From 1c48ffcaa46f431474f9f90ed49a134a645c6023 Mon Sep 17 00:00:00 2001 From: Jonah Gray Date: Wed, 12 Aug 2026 16:42:19 -0400 Subject: [PATCH 1/4] evidence(OMN-15918): OCC companion for OmniNode-ai/omnibase_infra#2727 --- contracts/OMN-15918.yaml | 41 +++++++++++++++++++ .../command.yaml | 21 ++++++++++ .../command.yaml | 24 +++++++++++ 3 files changed, 86 insertions(+) create mode 100644 contracts/OMN-15918.yaml create mode 100644 drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml create mode 100644 drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml diff --git a/contracts/OMN-15918.yaml b/contracts/OMN-15918.yaml new file mode 100644 index 00000000000..9f6e30f1c9d --- /dev/null +++ b/contracts/OMN-15918.yaml @@ -0,0 +1,41 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15918" +title: "OCC evidence for OMN-15918" +summary: > + OCC companion authored directly (claude-code) for OmniNode-ai/omnibase_infra PR #2727 -- node_gateway_attach_effect + hardening (JWKS signature verification, heartbeat/detach identity binding, atomic session-store transitions + via put_if_present, outage-vs-revocation circuit breaker split). Companion authored directly because + the event-driven occ-autobind / occ-companion-effect consumer (node_occ_companion_compute) had not produced + a companion PR within the CI window; the source PR's occ-autobind and occ-companion-effect commands + both published successfully (see command.yaml evidence below), matching the current precedent shape + (e.g. OCC#6392 for OMN-15937). +is_seam_ticket: false +interface_change: true +interfaces_touched: + - "protocols" + - "public_api" +evidence_requirements: + - kind: "ci" + description: "PR #2727 CI checks green" + command: "gh pr checks ${PR_NUMBER} --repo ${REPO}" +emergency_bypass: + enabled: false + justification: "" + follow_up_ticket_id: "" +dod_evidence: + - id: "dod-OmniNode-ai-omnibase_infra-pr-2727" + description: "PR #2727 on OmniNode-ai/omnibase_infra -- Evidence-Source companion." + source: "generated" + checks: + - check_type: "command" + check_value: "gh pr view 2727 --repo OmniNode-ai/omnibase_infra --json number,state" + - check_type: "command" + check_value: "gh pr view 2727 --repo OmniNode-ai/omnibase_infra --json files" + - id: "dod-occ-evidence-admissibility-validator" + description: "Hosted OCC evidence admissibility validator (OMN-15247)." + source: "generated" + evidence_artifact: "supersedes_dod_evidence:dod-OmniNode-ai-omnibase_infra-pr-2727" + checks: + - check_type: "command" + check_value: "uv run pytest tests/test_evidence_admissibility.py -q" diff --git a/drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml b/drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml new file mode 100644 index 00000000000..4983e69b292 --- /dev/null +++ b/drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml @@ -0,0 +1,21 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15918" +evidence_item_id: "dod-OmniNode-ai-omnibase_infra-pr-2727" +check_type: "command" +check_value: |- + gh pr view 2727 --repo OmniNode-ai/omnibase_infra --json number,state,headRefName +contract_sha256: "sha256:16f233c9788ac5a1a57f1993f0155c8ec23edc714742cb23779e5f779d51637e" +contract_entry_sha256: "sha256:44ef0b063ec906d686106b1018d9fd99230843254808f0ebff757dc90dd05304" +status: PASS +run_timestamp: "2026-08-12T20:39:22.600000+00:00" +commit_sha: "2dcb00e214993c677e0d429cebb9c527e54e3785" +runner: "claude-code" +verifier: "claude-code-review" +probe_command: "gh pr view 2727 --repo OmniNode-ai/omnibase_infra --json number,state,headRefName" +probe_stdout: | + {"headRefName":"jonah/omn-15918-attach-hardening","number":2727,"state":"OPEN"} +actual_output: "PASS: Evidence-Source companion for OMN-15918 from OmniNode-ai/omnibase_infra#2727." +exit_code: 0 +pr_number: 2727 +branch: "jonah/omn-15918-occ-companion" diff --git a/drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml b/drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml new file mode 100644 index 00000000000..cccdd9c6e55 --- /dev/null +++ b/drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml @@ -0,0 +1,24 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15918" +evidence_item_id: "dod-occ-evidence-admissibility-validator" +check_type: "command" +check_value: |- + uv run pytest tests/test_evidence_admissibility.py -q +contract_sha256: "sha256:16f233c9788ac5a1a57f1993f0155c8ec23edc714742cb23779e5f779d51637e" +contract_entry_sha256: "sha256:59c022463ec37ad3f2a3c650d53154454a43055af94f4421e4f51654738943c3" +status: PASS +run_timestamp: "2026-08-12T20:40:10.000000+00:00" +commit_sha: "2dcb00e214993c677e0d429cebb9c527e54e3785" +runner: "claude-code" +verifier: "claude-code-review" +probe_command: "uv run pytest tests/test_evidence_admissibility.py -q" +probe_stdout: | + ........................................................................ [ 94%] + .... [100%] + 76 passed in 0.07s +actual_output: "PASS: real test_evidence_admissibility.py run against onex_change_control@jonah/omn-15918-occ-companion + (76 passed, exit 0)." +exit_code: 0 +pr_number: 2727 +branch: "jonah/omn-15918-occ-companion" From 35176b1da390928693cf5e7f20179c41bae3a7b7 Mon Sep 17 00:00:00 2001 From: Jonah Gray Date: Wed, 12 Aug 2026 17:39:09 -0400 Subject: [PATCH 2/4] evidence(OMN-15918): add falsifiable deploy probe for node_gateway_attach_effect (OMN-14505/OMN-8912) --- contracts/OMN-15918.yaml | 12 ++++++++++ .../command.yaml | 2 +- .../dod-deploy-falsifiable-probe/command.yaml | 24 +++++++++++++++++++ .../command.yaml | 2 +- 4 files changed, 38 insertions(+), 2 deletions(-) create mode 100644 drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml diff --git a/contracts/OMN-15918.yaml b/contracts/OMN-15918.yaml index 9f6e30f1c9d..1744ec4791f 100644 --- a/contracts/OMN-15918.yaml +++ b/contracts/OMN-15918.yaml @@ -39,3 +39,15 @@ dod_evidence: checks: - check_type: "command" check_value: "uv run pytest tests/test_evidence_admissibility.py -q" + - id: "dod-deploy-falsifiable-probe" + description: > + Falsifiable deploy probe (OMN-14505/OMN-8912) for node_gateway_attach_effect -- this node has no + live deployed instance yet (OMN-15750 has not shipped a running runtime), so per the hermetic-compute-only + carve-out (OMN-14051) the probe reads the actual merged source content live from GitHub (never this + ticket's own receipts) and asserts the introduced symbol is genuinely present at the PR head. + source: "generated" + checks: + - check_type: "command" + check_value: >- + gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" + --jq .content | base64 -d | grep -q "def verify_and_decode_claims" diff --git a/drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml b/drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml index 4983e69b292..cd790062de4 100644 --- a/drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml +++ b/drift/dod_receipts/OMN-15918/dod-OmniNode-ai-omnibase_infra-pr-2727/command.yaml @@ -5,7 +5,7 @@ evidence_item_id: "dod-OmniNode-ai-omnibase_infra-pr-2727" check_type: "command" check_value: |- gh pr view 2727 --repo OmniNode-ai/omnibase_infra --json number,state,headRefName -contract_sha256: "sha256:16f233c9788ac5a1a57f1993f0155c8ec23edc714742cb23779e5f779d51637e" +contract_sha256: "sha256:53f34b5b5e2ec5292e8e8391955cca2f4874d3324b40180cf638029b6f0d08c3" contract_entry_sha256: "sha256:44ef0b063ec906d686106b1018d9fd99230843254808f0ebff757dc90dd05304" status: PASS run_timestamp: "2026-08-12T20:39:22.600000+00:00" diff --git a/drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml b/drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml new file mode 100644 index 00000000000..c486213ad2a --- /dev/null +++ b/drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml @@ -0,0 +1,24 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15918" +evidence_item_id: "dod-deploy-falsifiable-probe" +check_type: "command" +check_value: |- + gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" --jq .content | base64 -d | grep -q "def verify_and_decode_claims" +contract_sha256: "sha256:53f34b5b5e2ec5292e8e8391955cca2f4874d3324b40180cf638029b6f0d08c3" +contract_entry_sha256: "sha256:0f4fa91656dccfe85347bf9bd1d1ef6905a7b064e03e10324cd38fab557d61ff" +status: PASS +run_timestamp: "2026-08-12T21:40:00.000000+00:00" +commit_sha: "96c8bcaf2be5f4d5cd155098241b3c22c6713553" +runner: "claude-code" +verifier: "claude-code-review" +probe_command: |- + gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" --jq .content | base64 -d | grep -q "def verify_and_decode_claims" +probe_stdout: | + MATCH FOUND +actual_output: "PASS: live GitHub content fetch of service_keycloak_token_validator.py at 96c8bcaf2be5f4d5cd155098241b3c22c6713553 + contains 'def verify_and_decode_claims' -- the OMN-15918 signature-verification function is genuinely + present in the merged/pushed source, not just claimed in this ticket's own receipts." +exit_code: 0 +pr_number: 2727 +branch: "jonah/omn-15918-occ-companion" diff --git a/drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml b/drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml index cccdd9c6e55..e01f019d4f1 100644 --- a/drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml +++ b/drift/dod_receipts/OMN-15918/dod-occ-evidence-admissibility-validator/command.yaml @@ -5,7 +5,7 @@ evidence_item_id: "dod-occ-evidence-admissibility-validator" check_type: "command" check_value: |- uv run pytest tests/test_evidence_admissibility.py -q -contract_sha256: "sha256:16f233c9788ac5a1a57f1993f0155c8ec23edc714742cb23779e5f779d51637e" +contract_sha256: "sha256:53f34b5b5e2ec5292e8e8391955cca2f4874d3324b40180cf638029b6f0d08c3" contract_entry_sha256: "sha256:59c022463ec37ad3f2a3c650d53154454a43055af94f4421e4f51654738943c3" status: PASS run_timestamp: "2026-08-12T20:40:10.000000+00:00" From 50b284e058a83dd0e7cce72b98d7fe343e5e4d2f Mon Sep 17 00:00:00 2001 From: Jonah Gray Date: Wed, 12 Aug 2026 18:45:03 -0400 Subject: [PATCH 3/4] fix(OMN-15918): harden deploy evidence probe (#6409) --- contracts/OMN-15918.yaml | 4 ++-- .../dod-deploy-falsifiable-probe/command.yaml | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/contracts/OMN-15918.yaml b/contracts/OMN-15918.yaml index 1744ec4791f..4e2ff10c136 100644 --- a/contracts/OMN-15918.yaml +++ b/contracts/OMN-15918.yaml @@ -49,5 +49,5 @@ dod_evidence: checks: - check_type: "command" check_value: >- - gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" - --jq .content | base64 -d | grep -q "def verify_and_decode_claims" + body="$(gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" + --jq .content | base64 -d)" && printf '%s' "$body" | grep -qF "def verify_and_decode_claims" diff --git a/drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml b/drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml index c486213ad2a..cae82d3000e 100644 --- a/drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml +++ b/drift/dod_receipts/OMN-15918/dod-deploy-falsifiable-probe/command.yaml @@ -4,16 +4,16 @@ ticket_id: "OMN-15918" evidence_item_id: "dod-deploy-falsifiable-probe" check_type: "command" check_value: |- - gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" --jq .content | base64 -d | grep -q "def verify_and_decode_claims" -contract_sha256: "sha256:53f34b5b5e2ec5292e8e8391955cca2f4874d3324b40180cf638029b6f0d08c3" -contract_entry_sha256: "sha256:0f4fa91656dccfe85347bf9bd1d1ef6905a7b064e03e10324cd38fab557d61ff" + body="$(gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" --jq .content | base64 -d)" && printf '%s' "$body" | grep -qF "def verify_and_decode_claims" +contract_sha256: "sha256:d0b732074ab5912d7c9ea9efc0f1be0463fd9668f63bd9abec263b6a66ed55d4" +contract_entry_sha256: "sha256:a41b70029fe308fdc9897559c24b2899ef90b44cac5dbc014643c5acbe7eed5a" status: PASS -run_timestamp: "2026-08-12T21:40:00.000000+00:00" +run_timestamp: "2026-08-12T22:33:19.000000+00:00" commit_sha: "96c8bcaf2be5f4d5cd155098241b3c22c6713553" runner: "claude-code" verifier: "claude-code-review" probe_command: |- - gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" --jq .content | base64 -d | grep -q "def verify_and_decode_claims" + body="$(gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" --jq .content | base64 -d)" && printf '%s' "$body" | grep -qF "def verify_and_decode_claims" probe_stdout: | MATCH FOUND actual_output: "PASS: live GitHub content fetch of service_keycloak_token_validator.py at 96c8bcaf2be5f4d5cd155098241b3c22c6713553 From 61e2040ca118248c00ed0e5bcb38f677d24b089d Mon Sep 17 00:00:00 2001 From: Jonah Gray Date: Wed, 12 Aug 2026 19:02:02 -0400 Subject: [PATCH 4/4] fix(OMN-15918): bind OCC companion to PR (#6410) --- contracts/OMN-15918.yaml | 6 +++++ .../occ-self-bind-pr-6396/command.yaml | 23 +++++++++++++++++++ 2 files changed, 29 insertions(+) create mode 100644 drift/dod_receipts/OMN-15918/occ-self-bind-pr-6396/command.yaml diff --git a/contracts/OMN-15918.yaml b/contracts/OMN-15918.yaml index 4e2ff10c136..c83799b3a02 100644 --- a/contracts/OMN-15918.yaml +++ b/contracts/OMN-15918.yaml @@ -51,3 +51,9 @@ dod_evidence: check_value: >- body="$(gh api "repos/OmniNode-ai/omnibase_infra/contents/src/omnibase_infra/nodes/node_gateway_attach_effect/services/service_keycloak_token_validator.py?ref=96c8bcaf2be5f4d5cd155098241b3c22c6713553" --jq .content | base64 -d)" && printf '%s' "$body" | grep -qF "def verify_and_decode_claims" + - id: "occ-self-bind-pr-6396" + description: "OCC companion PR #6396 — self-bind for OMN-15918 (OMN-14650)." + source: "generated" + checks: + - check_type: "command" + check_value: "gh pr view 6396 --repo OmniNode-ai/onex_change_control --json number,state" diff --git a/drift/dod_receipts/OMN-15918/occ-self-bind-pr-6396/command.yaml b/drift/dod_receipts/OMN-15918/occ-self-bind-pr-6396/command.yaml new file mode 100644 index 00000000000..34d8c7e5880 --- /dev/null +++ b/drift/dod_receipts/OMN-15918/occ-self-bind-pr-6396/command.yaml @@ -0,0 +1,23 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-15918" +evidence_item_id: "occ-self-bind-pr-6396" +check_type: "command" +check_value: "gh pr view 6396 --repo OmniNode-ai/onex_change_control --json number,state" +contract_sha256: "sha256:03d91f21485bfbd428fca36a33d541fca56b646ace3e9c114805b76d4c702714" +contract_entry_sha256: "sha256:db4d1fa3aff3118f375d9ece8946a3862609ca6309f175054fa1da3db18fda3a" +status: PASS +run_timestamp: "2026-08-12T22:54:31Z" +commit_sha: "eed96c83bee26de6b585188955036cc2f71b7362" +runner: "codex" +verifier: "occ-eligibility-local-reproduction" +probe_command: "gh api repos/OmniNode-ai/onex_change_control/pulls/6396/files --paginate --jq '.[].sha'" +probe_stdout: | + 4e2ff10c136b54a14bd24ce46b43ac17781c3cb2 + cd790062de4c38032d814c9732448703d27d3aab + cae82d3000ea48c5e111525871c0f4a87563783f + e01f019d4f1775d6ec9595558c911640ff0db4bb +actual_output: "PASS: OCC self-bind for OMN-15918 (OCC#6396)." +exit_code: 0 +pr_number: 6396 +branch: "jonah/omn-15918-occ-companion"