Repository navigation
chore(OMN-16205): prod-promotion grant PREP — onex-prod ingress swap + omniweb digest pin - #7084
Merged
Merged
Conversation
…+ omniweb digest pin PREP ONLY, opened by an agent session on 2026-08-25 per the operator's option-2 cutover ruling (docs/tracking/2026-08-24-cutover-options-brief.md, decision rows (a)/(b)). This PR is NOT to be merged by any agent — it becomes effective ONLY when a human operator lands it on onex_change_control@main on explicit operator word. Two grant entries under one promotion_batch_id, both same-digest authorizations (no new image content): - grant-5f94d77d...: runtime_lane=prod, image_digest sha256:13c96028... (omninode-runtime, the digest onex-prod is CURRENTLY running, ECR-verified ACTIVE under pinned-onex-prod-live-13c96028). Explicit scope statement: also authorizes the ingress-host swap action itself (app.omninode.ai / omninode.ai / www.omninode.ai: onex-dev -> onex-prod namespace on public cluster i-0e596e8b557e27785), which has no independent digest of its own and travels in the same deploy-onex-prod.yml run. - grant-a1257e52...: runtime_lane=prod, image_digest sha256:eef16942... (omniweb, what customers are currently served, ECR-verified ACTIVE under pinned-onex-prod-live-eef16942) — makes the onex-prod git pin match live, superseding the stale a5ce53bd pin that reintroduces OMN-15294. requested_by is deliberately not a YAML field (schema, see file header). Intended dispatcher: Daniyal (daniyalabbas96), verified admin permission on omninode_infra 2026-08-25 (gh api .../collaborators/daniyalabbas96/permission) -- write+ requirement satisfied. approved_by: jonahgabriel on both entries so approved_by != requested_by holds against omninode_infra's own validate_prod_promotion_grant.py anti-self-approval check (that k3s-lane consumer matches only on runtime_lane+image_digest, per its OMN-14209 scope decision -- a SEPARATE consumer of this file from the .201 compose-lane node_redeploy_orchestrator path). Doc-drift flagged for the approver: this repo's main branch has NOT absorbed OMN-14814 (commit f2b4941 is dev-only) -- the file header here still states "the approver MUST differ from the PR author," unlike dev's updated sole-CODEOWNER carve-out. Not resolved by this PR; noted for the operator's own judgment at merge time. expires_at is a ~30h PROPOSAL from PR-open; the approver may shorten it. Cross-reference: this promotion window must NOT overlap any OMN-16385 Keycloak DB migration -- separate comment posted on OMN-16385 asking its owner to confirm. No raw SSH/kubectl retag/recreate path used or implied. NO PROD MUTATION HAS OCCURRED OR IS AUTHORIZED BY THIS PR -- lands only the trust-anchor grant entries; the actual workflow_dispatch run is a separate, explicit, subsequent action per the operator's HARD SCOPE ruling (no dev->main promotion, no deploy dispatch, no ingress mutation, no window execution performed by any agent). hotfix-evidence: OCC-16205 backmerge: #6717 Evidence-Ticket: OMN-16205
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Adds contracts/OMN-16205.yaml and 4 drift/dod_receipts/OMN-16205/* receipts so validator_occ_merge_eligibility resolves this ticket as PR-bound. Fixes occ-preflight/eligibility, verify/verify (Receipt Gate), and call-reject-skip-token/occ-preflight/eligibility, which were all failing missing_contract (OCC self-change invariant I3 — a PR touching onex_change_control needs the ticket's contract + DoD receipts in-tree, same pattern OCC#6599/#7078 used). Three dod_evidence items document real, reproducible facts about this grant PR (grant registry values, local test/pre-commit validation, no-raw-deploy disclosure), plus occ-self-bind-pr-7084 binding the evidence to this PR by pr_number. Verified locally before push: - validator_occ_merge_eligibility: eligible=true, reason=eligible - validator_receipt_honesty: 0 violations, 4 receipts - uv run pytest tests/test_prod_promotion_grants.py -v: 18/18 passed - pre-commit run --files <new files>: all hooks passed No grant entries in grants/prod_promotion_grants.yaml touched. This PR remains draft; still requires the operator's own ready+merge as the approval act. Evidence-Ticket: OMN-16205
…ventory Migration Inventory Sync (a required check) was failing UNLISTED_FILE for two migration files that already exist on their source repos' main branches, unrelated to this PR's grant content — pre-existing cross-repo registry drift, confirmed absent from OCC main before this push: - omnibase_infra/docker/migrations/forward/100_create_gateway_link_health.sql (OMN-15570) -> omninode_internal.gateway_link_health table + gateway_link_health_status view. - omninode_infra/db/migrations/20260825_gateway_workflows_result_content.sql (OMN-16510) -> adds result_content to gateway_workflows. Registers both in migration_inventory.yaml with the tables they create/modify. This is a required, systemic check that was blocking every PR against main, not something specific to the grant content — fixing it in place rather than deferring, per repo policy against carrying pre-existing red checks. Verified locally: uv run check-migration-inventory --repos-root <omni_home clones> exits 0 (only a WARNING for a repo not cloned locally, unrelated); uv run pytest tests/unit/scripts/test_check_migration_inventory.py -q: 4/4 passed; pre-commit run --files <file>: all hooks passed. Evidence-Ticket: OMN-16205
Contributor
|
OCC autobind stood down for |
jonahgabriel
marked this pull request as ready for review
August 25, 2026 17:52
This was referenced Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PREP ONLY. Opened by an agent session on 2026-08-25 per the operator's
option-2 cutover ruling (
docs/tracking/2026-08-24-cutover-options-brief.md,decision rows (a)/(b)). This PR must NOT be merged by any agent — it
becomes effective only when a human operator lands it on
onex_change_control@mainas the explicit approval act.Two grant entries under one
promotion_batch_id(batch-ac0ff5ab-ac14-4907-9ae5-0a25a8a84bc6), both same-digest authorizations — no new image content:grant-5f94d77d-b4f0-4f64-a67f-a35cde0f9124sha256:13c96028...grant-a1257e52-dd17-4650-b42a-49444b83f634sha256:eef16942...k8s/onex-prod/omniweb/deployment.yamlto what customers are currently served, superseding the stalea5ce53bdpin that reintroduces OMN-15294Both digests confirmed ACTIVE in ECR via live
aws ecr describe-images(tagspinned-onex-prod-live-13c96028/pinned-onex-prod-live-eef16942).Requester / approver
requested_byis deliberately not a YAML field (schema, see file header). Intended dispatcher: Daniyal (daniyalabbas96) — verifiedadminpermission onomninode_infra2026-08-25 viagh api repos/OmniNode-ai/omninode_infra/collaborators/daniyalabbas96/permission(write+ requirement satisfied).approved_by: jonahgabrielon both entries, soapproved_by != requested_byholds againstomninode_infra/scripts/validate_prod_promotion_grant.py's anti-self-approval check — the k3s/EKS cloud-plane consumer for this grant (OMN-14209 scope decision: matches onlyruntime_lane+image_digest, notpromotion_batch_id). This is a separate consumer of this same trust-anchor file from the.201compose-lanenode_redeploy_orchestratorpath in the OMN-13418 plan.Doc-drift flagged for the approver
This repo's
mainbranch has not absorbed OMN-14814 (commitf2b49416fis dev-only) — the file header onmainstill reads "the approver MUST differ from the PR author," unlike dev's updated sole-CODEOWNER self-approval carve-out. Not resolved by this PR; flagging for the operator's own judgment at merge time.Why a hotfix/* PR, not a dev promotion PR
main-target-guardaccepts ahotfix/*PR carryinghotfix-evidence: OCC-<n>+backmerge: #<n>— precedented byhotfix/omn-15181-prod-grant-restart-20260817(#6599, same file/schema, same pattern).Cross-reference — Keycloak window
This promotion window must not overlap any OMN-16385 Keycloak DB migration. Separate comment posted on OMN-16385 asking its owner to confirm no such migration runs in the next 48h — see that ticket for current state (a config-prerequisite PR,
omninode_infra#962, merged to dev minutes before this PR was opened; the actual Keycloak DB-content migration +helm upgraderemain a separate, not-yet-executed manual step per that PR's own body).Test plan
uv run pytest tests/test_prod_promotion_grants.py -v— 18/18 passedpre-commit run --files grants/prod_promotion_grants.yaml— all hooks passed (yamlfmt reflowed thereasonblocks; content re-verified post-reflow)No raw SSH/kubectl retag/recreate path used or implied. NO PROD MUTATION HAS OCCURRED OR IS AUTHORIZED BY THIS PR — it lands only the trust-anchor grant entries. The actual
workflow_dispatchrun is a separate, explicit, subsequent action per the operator's HARD SCOPE ruling (no dev→main promotion, no deploy dispatch, no ingress mutation, no window execution performed by any agent).hotfix-evidence: OCC-16205
backmerge: #6717
Evidence-Ticket: OMN-16205