chore(OMN-16702): staging-namespace authorization for the public-cluster convergence + dev-valkey roll by jonahgabriel · Pull Request #7662 · OmniNode-ai/onex_change_control

jonahgabriel · 2026-08-30T10:23:09Z

Adds grants/staging_namespace_grants.yaml to main — the ref both gates resolve from — carrying one live authorization under the 2026-08-30 in-session operator ruling.

The ruling, quoted verbatim in the entry

"Amend doctrine: in-session operator 'go' counts" — operator, 2026-08-30T05:30:00Z, in-session.

operator_quote in the entry is that exact string, byte for byte. operator_quote_at is that timestamp.

Scope

namespaces: [dev, onex-dev] on cluster: omninode-k3s-system-public. That covers both halves of OMN-16702:

onex-dev — the k8s/onex-public convergence (include_onex_public), i.e. the omnidash session-store repoint to the authenticated data-plane Valkey.
dev — the dev-valkey --requirepass roll and its Infisical consumer.

approved_by: jonahgabriel equals the dispatcher on purpose. That is the relaxation the ruling granted, and it applies to this anchor only.

This file cannot authorize a prod runtime promotion — proven live against this exact file

$ validate_staging_namespace_grant.py --requested-by jonahgabriel \
      --namespaces dev,onex-dev --grants-file grants/staging_namespace_grants.yaml
[staging-auth] PASS (resolved): grant grant-00ba7b7e-… approved_by=jonahgabriel
  covers ['dev', 'onex-dev'] expires_at=2026-08-30T16:00:00Z
exit 0

$ … --namespaces onex-dev,onex-prod
[staging-auth] BLOCKED (scope_exceeded): run requests namespaces ['onex-prod']
  outside the staging-class allowlist ['dev', 'onex-dev']. This gate cannot
  authorize them; prod namespaces require the OMN-13418/OMN-14209
  prod-promotion grant. There is no override.

$ validate_prod_promotion_grant.py --target-digest sha256:aaaa… \
      --requested-by jonahgabriel --health-status healthy      # SAME actor
[prod-grant] BLOCKED (self_granted): grant … approved_by == requested_by
  ('jonahgabriel') — self-approval is rejected.
exit 1

The same actor that this staging authorization accepts is still refused for a PROD runtime promotion. Side by side, live, at the same moment.

The record is landed, not asserted

authorization_record: omni_home@e72943be6d7d27e69d00a017511a41fe3a7ac9a6 — verified an ancestor of omni_home@main (compare/main...<sha> → behind), and the quote appears twice in that commit's own diff (CLAUDE.md §2a and §12). The gate's UNRECORDED_QUOTE check therefore resolves against a landed durable record, not against this file's own claim.

Why a separate anchor, not a `scope:` field in `prod_promotion_grants.yaml`

A staging entry inside the prod anchor would brick prod promotion: omninode_infra's scripts/validate_prod_promotion_grant.py:168 raises ValueError for any entry missing image_digest / promotion_batch_id → MALFORMED → exit 1 for every prod promotion while the entry exists. And validate_prod_promotion_grants._validate_entry would reject scope/namespaces/operator_quote/… as unexpected fields. Two anchors, two validators, zero coupling.

Lifecycle

PRUNE this entry once consumed, or set consumed: true. Absolute expiry 2026-08-30T16:00:00Z. The anchor's at-rest state is entries: [], and an expired entry fails validate-staging-namespace-grants — the same prune discipline the prod anchor carries (cf. OMN-15010).

Note: the schema validator and its CI job land on dev via onex_change_control#7649 (merged). This PR puts the anchor and the live entry on main so the runtime gate can read them, following the same main-targeted pattern as #7464 / #7561 for prod grants.

Ticket: OMN-16702

hotfix-evidence: OCC-7649
backmerge: #7649

…ter convergence + dev-valkey roll Adds grants/staging_namespace_grants.yaml to main (the ref both gates resolve from) carrying ONE live authorization under the 2026-08-30 in-session operator ruling, quoted verbatim in the entry: "Amend doctrine: in-session operator 'go' counts" (2026-08-30T05:30:00Z) Scope, namespaces [dev, onex-dev] on omninode-k3s-system-public, covers BOTH halves of OMN-16702: the k8s/onex-public convergence (onex-dev) and the dev-valkey --requirepass roll with its Infisical consumer (dev). approved_by == the dispatcher on purpose. That is the relaxation the ruling granted and it applies to THIS anchor only. THIS FILE CANNOT AUTHORIZE A PROD RUNTIME PROMOTION. Proven live, all three directions, against this exact file before this commit: validate_staging_namespace_grant.py --requested-by jonahgabriel --namespaces dev,onex-dev --grants-file <this file> -> [staging-auth] PASS (resolved): grant grant-00ba7b7e... approved_by=jonahgabriel covers ['dev', 'onex-dev'] expires_at=2026-08-30T16:00:00Z (exit 0) ... --namespaces onex-dev,onex-prod -> [staging-auth] BLOCKED (scope_exceeded): run requests namespaces ['onex-prod'] outside the staging-class allowlist ['dev', 'onex-dev']. There is no override. validate_prod_promotion_grant.py --target-digest sha256:aaaa... --requested-by jonahgabriel --health-status healthy # SAME actor -> [prod-grant] BLOCKED (self_granted): approved_by == requested_by ('jonahgabriel') -- self-approval is rejected. (exit 1) The authorization_record omni_home@e72943be6d7d27e69d00a017511a41fe3a7ac9a6 is an ancestor of omni_home@main and its diff contains the quote verbatim (twice), so the gate's UNRECORDED_QUOTE check resolves against a landed record rather than against this file's own assertion. PRUNE after use, or set consumed: true. Absolute expiry 2026-08-30T16:00:00Z.

coderabbitai · 2026-08-30T10:23:18Z

Warning

Review limit reached

Next included review available in 29 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 136 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 45d25a94-d8c5-4547-892b-adc4fa0a1019

📥 Commits

Reviewing files that changed from the base of the PR and between 0fe967c and 3eced64.

📒 Files selected for processing (4)

contracts/OMN-16702.yaml
drift/dod_receipts/OMN-16702/occ-self-bind-pr-7662/command.yaml
grants/staging_namespace_grants.yaml
src/onex_change_control/boundaries/migration_inventory.yaml

_{Comment @coderabbitai help to get the list of available commands.}

occ-preflight/eligibility reported reason=missing_occ_self_bind on the staging-namespace grant PR: the OMN-16702 evidence on main verifies (receipts PASS, hashes bound) but nothing bound to this PR itself. check_value uses the canonical ${PR_NUMBER} placeholder -- main's lint-contract-check-values (OMN-9350) rejects a hardcoded integer PR number, which is stricter than the same hook on dev.

jonahgabriel · 2026-08-30T10:41:21Z

@coderabbitai review

coderabbitai · 2026-08-30T10:41:27Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

jonahgabriel

OMN-17146 verification trigger: re-exercising gate / CodeRabbit Thread Check on this PR now that omniclaude#2078 (merge 0452f946e) landed the no-op reusable on omniclaude main. This PR is the failure instance cited in OMN-17146 (run 33307000219, chmod: cannot access 'scripts/check-unresolved-threads.sh'). A GitHub re-run replays the original reusable resolution, so a fresh event is required to prove the fix; this review submission is that event.

jonahgabriel added 2 commits August 30, 2026 06:29

fix(OMN-16702): list new omnibase infra migrations

3eced64

jonahgabriel merged commit 37fc5f8 into main Aug 30, 2026
37 of 38 checks passed

jonahgabriel deleted the hotfix/omn-16702-staging-namespace-grant branch August 30, 2026 10:49

jonahgabriel commented Aug 30, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore(OMN-16702): staging-namespace authorization for the public-cluster convergence + dev-valkey roll - #7662

chore(OMN-16702): staging-namespace authorization for the public-cluster convergence + dev-valkey roll#7662
jonahgabriel merged 3 commits into
mainfrom
hotfix/omn-16702-staging-namespace-grant

jonahgabriel commented Aug 30, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 30, 2026 •

edited

Loading

Review limit reached

Uh oh!

jonahgabriel commented Aug 30, 2026

Uh oh!

coderabbitai Bot commented Aug 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

jonahgabriel left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jonahgabriel commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The ruling, quoted verbatim in the entry

Scope

This file cannot authorize a prod runtime promotion — proven live against this exact file

The record is landed, not asserted

Why a separate anchor, not a scope: field in prod_promotion_grants.yaml

Lifecycle

Uh oh!

coderabbitai Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

jonahgabriel commented Aug 30, 2026

Uh oh!

coderabbitai Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

jonahgabriel left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jonahgabriel commented Aug 30, 2026 •

edited

Loading

Why a separate anchor, not a `scope:` field in `prod_promotion_grants.yaml`

coderabbitai Bot commented Aug 30, 2026 •

edited

Loading

coderabbitai Bot commented Aug 30, 2026 •

edited

Loading