Skip to content

fix(OMN-15335): supersede two ${PR_NUMBER}/${REPO} template-placeholder self-binds - #6602

Merged
jonahgabriel merged 8 commits into
devfrom
jonah/omn-15335-repair-self-bind-placeholders
Aug 23, 2026
Merged

jonahgabriel merged 8 commits into
devfrom
jonah/omn-15335-repair-self-bind-placeholders

Conversation

@jonahgabriel

Copy link
Copy Markdown
Contributor

Summary

occ-self-bind-pr-5364 and occ-self-bind-pr-5376 in contracts/OMN-15335.yaml carry
the same template-class defect fixed under OMN-14888 (D2 finding): check_value
literally gh pr view ${PR_NUMBER} --repo ${REPO} --json number,state, which the
CI harness substitutes only for whichever onex_change_control PR is currently
running the compliance gate — never for the specific OCC PR each entry's own id
names. The check can therefore never verify what it claims; it's a vacuous
self-referential tautology.

Fix

Append-only supersession (no merged bytes edited) with a hardcoded
merged-terminal-state predicate against each entry's real target:

Both confirmed live via gh pr view <N> --repo OmniNode-ai/onex_change_control --json state,mergedAt,mergeCommit
before this PR. Superseded entries stay verbatim above for audit.

Verification

Local dod_verify OMN-15335 --contract-path <this branch's contract.yaml>: 10/10
checks verified, 2 superseded, 0 failed. contract_entry_sha256 on both new
receipts computed via omnibase_core.validation.validator_receipt_gate.compute_contract_entry_sha256
against the committed contract. pre-commit clean.

Evidence-Ticket: OMN-15335

…er self-binds

occ-self-bind-pr-5364 and occ-self-bind-pr-5376 carry the same template-class
defect fixed under OMN-14888 (D2 finding): check_value literally
`gh pr view ${PR_NUMBER} --repo ${REPO} --json number,state`, which the CI
harness substitutes only for whichever onex_change_control PR is currently
running the compliance gate -- never for the specific OCC PR each entry's own
id names. The check can therefore never verify what it claims.

Repaired append-only with a hardcoded merged-terminal-state predicate against
each entry's real target (OCC#5364, OCC#5376), both confirmed live MERGED
with pinned merge commits. Superseded entries stay verbatim for audit.

OMN-15335
…essions

contract_entry_sha256 computed via
omnibase_core.validation.validator_receipt_gate.compute_contract_entry_sha256
against the committed contract (843bb99). Both predicates executed live
PASS before this commit.

OMN-15335
@coderabbitai

coderabbitai Bot commented Aug 17, 2026 •

Copy link
Copy Markdown

Warning

Review limit reached

Next included review available in 59 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 122 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 94783ca4-28d4-43bf-9164-e9901458d3b0

📥 Commits

Reviewing files that changed from the base of the PR and between 17b2de9 and e4e4778.

📒 Files selected for processing (7)
  • .onex_ratchets/omn_15382_rule_b_baseline.yaml
  • contracts/OMN-15335.yaml
  • drift/dod_receipts/OMN-15335/dod-OmniNode-ai-omninode_infra-pr-738-content/command.yaml
  • drift/dod_receipts/OMN-15335/occ-self-bind-pr-5364-content/command.yaml
  • drift/dod_receipts/OMN-15335/occ-self-bind-pr-5364-superseded/command.yaml
  • drift/dod_receipts/OMN-15335/occ-self-bind-pr-5376-content/command.yaml
  • drift/dod_receipts/OMN-15335/occ-self-bind-pr-5376-superseded/command.yaml

Comment @coderabbitai help to get the list of available commands.

@jonahgabriel
jonahgabriel enabled auto-merge (squash) August 17, 2026 12:05
@onexbot-occ-writer

Copy link
Copy Markdown
Contributor

OCC autobind stood down for OmniNode-ai/onex_change_control#6602 (OMN-15335): this PR (hand_authored) already carries evidence for that ticket, so no competing companion was minted (OMN-15247 defer-on-contention).

@jonahgabriel jonahgabriel added the ci:ready Full CI runs on this PR (OMN-15731 label-gated CI pilot) label Aug 18, 2026
@jonahgabriel

Copy link
Copy Markdown
Contributor Author

Parking (two-strike: root cause diagnosed, not rerun-fixable from this PR alone).

Root cause: Contract Compliance Check applies the OMN-15309 admissibility predicate, which rejects bare gh subcommands (e.g. gh pr view ...) in dod_evidence check_value — only gh api (and other content-bound verbs) are admissible. This contract's dod_evidence entries were authored before the generator fix landed (OMN-16160, Done 2026-08-20, PR omnimarket#2104 + onex_change_control#6683), so every entry is classified INERT: '0 checks PASS' / BLOCK: no hosted-and-local effective check exists.

This is systemic, not specific to this PR — confirmed the identical BLOCK shape on 6 open onex_change_control PRs from this same pre-fix window: #6717 (OMN-16205), #6649 (OMN-16159), #6608/#6603 (OMN-15332), #6602 (OMN-15335), #6688 (OMN-15669), plus this one. A single-ticket remediation precedent already exists and landed clean: OMN-16338 're-mint two OMN-16322 receipts... to admissible probe shapes' (Done). Re-minting requires re-authoring each contract's dod_evidence check_value to the gh api .../contents/<path>?ref=<sha> --jq .content | base64 -d buffered-read shape (OMN-15411 Rule E sigpipe-safe form) and running fresh, real, content-bound probes per evidence item — real verification work per ticket, out of scope for a mechanical CI rerun/rebase pass. Filing a follow-up ticket to batch this across the 6 affected PRs.

— occ-backlog-drive

…entries

contracts/OMN-15335.yaml's occ-self-bind-pr-5364 and occ-self-bind-pr-5376
chains were rebound to content-bound checks in this branch's earlier
commits (dcbacf4, 879843b), so the live OMN-15382 Rule B corpus scan
no longer reproduces them as violations. The frozen shrink-only baseline
(.onex_ratchets/omn_15382_rule_b_baseline.yaml) was not updated to match,
so test_rule_b_corpus_matches_frozen_baseline_exactly hard-failed with a
stale-entry AssertionError, cascading to Tests / CI Summary / reason-graph
/ tests+coverage (shadow) on CI run 32659225844 (job 97242723463).

Confirmed RED before this commit and GREEN after by running
tests/unit/scripts/test_lint_contract_check_values_corpus_baseline.py
locally (17/17 pass post-fix, including this test).

Evidence-Ticket: OMN-15335
Resolves the one real conflict in .onex_ratchets/omn_15382_rule_b_baseline.yaml:
dev's tip already dropped the OMN-15332::occ-self-bind-pr-5325 line (via
onex_change_control#6603, merged 6a4fff0)
while this branch drops the two adjacent OMN-15335 lines in the same
commit region. Kept both removals -- final baseline has none of the three
stale entries. Re-ran the full corpus baseline test suite after the merge
(17/17 pass), confirming dev's drift (workflow consolidation OMN-16260,
new contracts) introduced no new Rule A-G violations.
@onexbot-occ-writer

Copy link
Copy Markdown
Contributor

OCC autobind stood down for OmniNode-ai/omniclaude#2010 (OMN-16322): this PR (unknown) already carries evidence for that ticket, so no competing companion was minted (OMN-15247 defer-on-contention).

@jonahgabriel
jonahgabriel merged commit 3fac4f0 into dev Aug 23, 2026
103 of 105 checks passed
@jonahgabriel
jonahgabriel deleted the jonah/omn-15335-repair-self-bind-placeholders branch August 23, 2026 23:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci:ready Full CI runs on this PR (OMN-15731 label-gated CI pilot)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant