Skip to content

chore(OMN-16702): re-stage the staging-namespace authorization after the 16:00Z expiry #7731

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jonahgabriel merged 4 commits into from
Aug 30, 2026
Merged

chore(OMN-16702): re-stage the staging-namespace authorization after the 16:00Z expiry #7731

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
81e5065
chore(OMN-16702): re-stage the staging-namespace authorization after …
jonahgabriel Aug 30, 2026
81b2acf
chore(OMN-16702): OCC self-bind receipt for PR #7731
jonahgabriel Aug 30, 2026
0187827
chore(OMN-16702): prune six expired prod-promotion grants (OMN-13424 …
jonahgabriel Aug 30, 2026
996f84f
chore(OMN-16702): re-point the grant-values evidence item at the prun…
jonahgabriel Aug 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 24 additions & 16 deletions contracts/OMN-16702.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,27 +32,24 @@ emergency_bypass:
dod_evidence:
- id: "dod-prod-promotion-grant-values-omn16702"
description: >-
SUPERSEDED CONTENT, LIVE-RE-EXECUTED: this item originally asserted batch-af8142c0's four grant_ids.
That batch expired 2026-08-29T09:00:00Z unconsumed and was pruned by OCC#7554 (OMN-15010). PR #7561
re-stages the same four authorizations under a NEW promotion_batch_id batch-48e48b4c-68f5-4e1c-b12e-818dcf062dfd
with NEW grant_ids, per the operator's 2026-08-29 re-stage ruling — so this check now asserts the
CURRENT batch is present, not the expired one: grant-30d406bb-d6c7-455a-a371-2a706b892346 (omninode-runtime
sha256:13c96028…, the same-digest authorization the UNCONDITIONAL OMN-14209 runtime grant gate resolves
from k8s/onex-prod/runtime/kustomization.yaml — the only mechanically-required entry in the batch),
grant-7f32b169-c681-47a5-9380-8e04135842a4 (omnidash sha256:50601f9e…), grant-0bb17fe1-dcf7-4cfc-b41e-3a1b499762b1
(omnicloud/core sha256:b4c32554…) and grant-25d6751a-1188-47a3-9590-62bb48f15327 (valkey/valkey:8.0
sha256:53ae5378…, the dev/dev-valkey requirepass roll). Falsifiable against the repo checkout: the
grep chain fails on any base that lacks these entries, including onex_change_control@main pre-#7561.
SUPERSEDED CONTENT (2nd time), LIVE-RE-EXECUTED. This item first asserted batch-af8142c0's four
grant_ids; that batch expired 2026-08-29T09:00:00Z unconsumed and was pruned by OCC#7554 (OMN-15010),
and #7561 re-pointed it at batch-48e48b4c-68f5-4e1c-b12e-818dcf062dfd. That batch has now met the
SAME fate: grant-30d406bb / grant-7f32b169 / grant-0bb17fe1 / grant-25d6751a (and the two batch-404af076
entries beside them) all carried expires_at 2026-08-30T16:00:00Z and all expired UNCONSUMED — no
deploy-onex-prod.yml dispatch ran under any of them. OCC#7731 prunes all six, per the file's own
OMN-13424 at-rest lifecycle and TestGrantFileAtRest, which fails for every subsequent PR to main
while an expired entry sits in the file. This check therefore now asserts the PRUNED at-rest state
rather than a batch that no longer exists. Falsifiable against the repo checkout: the grep chain
fails on any base where entries is non-empty, including onex_change_control@main pre-#7731. No prod
authorization is created by this item; pruning only REMOVES authorization, and a future promotion
still needs a fresh CODEOWNERS-approved entry.
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -Fq 'grant-30d406bb-d6c7-455a-a371-2a706b892346' grants/prod_promotion_grants.yaml && grep
-Fq 'grant-7f32b169-c681-47a5-9380-8e04135842a4' grants/prod_promotion_grants.yaml && grep -Fq
'grant-0bb17fe1-dcf7-4cfc-b41e-3a1b499762b1' grants/prod_promotion_grants.yaml && grep -Fq 'grant-25d6751a-1188-47a3-9590-62bb48f15327'
grants/prod_promotion_grants.yaml && grep -Fq 'promotion_batch_id: batch-48e48b4c-68f5-4e1c-b12e-818dcf062dfd'
grants/prod_promotion_grants.yaml
grep -Fq 'entries: []' grants/prod_promotion_grants.yaml && grep -Fq 'PRUNED 2026-08-30' grants/prod_promotion_grants.yaml
- id: "dod-prod-promotion-grant-validation-omn16702"
description: >-
The repo's own grant-schema suite passes against the grant file carrying the four new OMN-16702
Expand Down Expand Up @@ -120,3 +117,14 @@ dod_evidence:
- check_type: "command"
check_value: >-
gh pr view ${PR_NUMBER} --repo OmniNode-ai/onex_change_control --json number,state,headRefName
- id: "occ-self-bind-pr-7731"
description: >-
OCC self-binding receipt for PR #7731, the in-repo evidence PR that RE-STAGES the staging-namespace
authorization on main after grant-00ba7b7e expired unconsumed at 2026-08-30T16:00:00Z. Binds OMN-16702
to the OCC PR by pr_number so eligibility can resolve a PASS receipt for the evidence PR itself.
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
gh pr view ${PR_NUMBER} --repo OmniNode-ai/onex_change_control --json number,state,headRefName
75 changes: 17 additions & 58 deletions drift/dod_receipts/OMN-16702/dod-prod-promotion-grant-values-omn16702/command.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,65 +3,24 @@ schema_version: "1.0.0"
ticket_id: "OMN-16702"
evidence_item_id: "dod-prod-promotion-grant-values-omn16702"
check_type: "command"
check_value: "grep -Fq 'grant-30d406bb-d6c7-455a-a371-2a706b892346' grants/prod_promotion_grants.yaml
&& grep -Fq 'grant-7f32b169-c681-47a5-9380-8e04135842a4' grants/prod_promotion_grants.yaml && grep -Fq
'grant-0bb17fe1-dcf7-4cfc-b41e-3a1b499762b1' grants/prod_promotion_grants.yaml && grep -Fq 'grant-25d6751a-1188-47a3-9590-62bb48f15327'
grants/prod_promotion_grants.yaml && grep -Fq 'promotion_batch_id: batch-48e48b4c-68f5-4e1c-b12e-818dcf062dfd'
check_value: "grep -Fq 'entries: []' grants/prod_promotion_grants.yaml && grep -Fq 'PRUNED 2026-08-30'
grants/prod_promotion_grants.yaml"
contract_sha256: "sha256:43ba77cfb7b5ef3e137ce52fe9b044fe0daa770ab812779a9e68ee76489347bb"
contract_entry_sha256: "sha256:688a9bd1e7aa87d55832dce70586e4a191a50098d730a9c99edf5c090010d3aa"
contract_sha256: "sha256:558244469ff5138f39d0d0764b8d3216cc6c4a6969c6d0f8db51c012649745fa"
contract_entry_sha256: "sha256:b98b9bc34c3aef2f84c0fe6f815d05c18ec0b5ca3b2941ae35d9439c106a6e5f"
status: PASS
run_timestamp: "2026-08-29T13:10:00Z"
commit_sha: "0a400514a4f489b5723aa5501c9f1e4c65112a15"
runner: "occ7561-grant-restage-lane"
verifier: "occ7561-grant-restage-verifier"
probe_command: "grep -E '^ - grant_id:|^ image_digest:|^ promotion_batch_id:|^ approved_by:|^
\ expires_at:' grants/prod_promotion_grants.yaml"
run_timestamp: "2026-08-30T18:05:00Z"
commit_sha: "0187827bab7a15ec00c2e6ec0f4ff1ea0b02a3f4"
runner: "occ7731-grant-restage-lane"
verifier: "occ7731-grant-restage-verifier"
probe_command: "python3 -c \"import yaml;print(yaml.safe_load(open('grants/prod_promotion_grants.yaml'))['entries'])\"
&& uv run pytest tests/test_prod_promotion_grants.py -q"
probe_stdout: |
- grant_id: grant-7ebd7674-9b25-466c-920d-a74a0f3efadb
image_digest: sha256:13c96028566b7f429fd46298304fb61c03c325b3e45f60638cce61c28185fcf6
promotion_batch_id: batch-404af076-32a6-449c-b60a-1e8848e3fe3c
approved_by: jonahgabriel
expires_at: "2026-08-30T16:00:00Z"
- grant_id: grant-7013b49e-f714-4ead-8910-e6ffda84df56
image_digest: sha256:bc95b9bc5a1860dd666ecea4e82e278ff4ddb2d08da5d280ba8472b7041309ab
promotion_batch_id: batch-404af076-32a6-449c-b60a-1e8848e3fe3c
approved_by: jonahgabriel
expires_at: "2026-08-30T16:00:00Z"
- grant_id: grant-30d406bb-d6c7-455a-a371-2a706b892346
image_digest: sha256:13c96028566b7f429fd46298304fb61c03c325b3e45f60638cce61c28185fcf6
promotion_batch_id: batch-48e48b4c-68f5-4e1c-b12e-818dcf062dfd
approved_by: jonahgabriel
expires_at: "2026-08-30T16:00:00Z"
- grant_id: grant-7f32b169-c681-47a5-9380-8e04135842a4
image_digest: sha256:50601f9e7c128724f09683d7a7e68aef8ef9bad7019dfbe44d2560b1ca3b9bdb
promotion_batch_id: batch-48e48b4c-68f5-4e1c-b12e-818dcf062dfd
approved_by: jonahgabriel
expires_at: "2026-08-30T16:00:00Z"
- grant_id: grant-0bb17fe1-dcf7-4cfc-b41e-3a1b499762b1
image_digest: sha256:b4c325545e1012aef53772d1a3f5a30eb9af3809b9a4036e28a156db906581bc
promotion_batch_id: batch-48e48b4c-68f5-4e1c-b12e-818dcf062dfd
approved_by: jonahgabriel
expires_at: "2026-08-30T16:00:00Z"
- grant_id: grant-25d6751a-1188-47a3-9590-62bb48f15327
image_digest: sha256:53ae53785f9d46b820ed025077de0eec1ef53b31954194af1a67dee4a5c5e04f
promotion_batch_id: batch-48e48b4c-68f5-4e1c-b12e-818dcf062dfd
approved_by: jonahgabriel
expires_at: "2026-08-30T16:00:00Z"
actual_output: "PASS: grants/prod_promotion_grants.yaml on PR #7561 (hotfix/omn-16702-restage-batch-af8142c0,
base main) carries all four RE-STAGED OMN-16702 / OMN-16685 entries under promotion_batch_id batch-48e48b4c-68f5-4e1c-b12e-818dcf062dfd
— grant-30d406bb (omninode-runtime sha256:13c96028, the digest the UNCONDITIONAL OMN-14209 runtime grant
gate resolves from k8s/onex-prod/runtime/kustomization.yaml, a same-digest authorization and the ONLY
gate-read entry in the batch), grant-7f32b169 (omnidash sha256:50601f9e), grant-0bb17fe1 (omnicloud/core
sha256:b4c32554) and grant-25d6751a (valkey/valkey:8.0 sha256:53ae5378, the dev/dev-valkey requirepass
roll) — all approved_by jonahgabriel (a PROPOSAL the CODEOWNERS approver confirms or replaces at merge
time) with an absolute UTC expires_at of 2026-08-30T16:00:00Z, aligned with the still-live OMN-16799
cutover batch. The predecessor batch-af8142c0-f2bf-4d79-887a-e65d964c9da8 expired 2026-08-29T09:00:00Z
unconsumed and was pruned by OCC#7554 (OMN-15010); this receipt's check_value was updated from the original
PR #7464 shape to assert the current, re-staged batch rather than the expired one, per the operator's
2026-08-29 re-stage ruling. The five-clause grep chain exits 0 here and exits non-zero on onex_change_control@main
pre-#7561, which carries none of these four grant_ids. The probe output also shows the two carried-forward
OMN-16799 entries under batch-404af076, untouched by this PR."
[]
.................. [100%]
18 passed in 0.12s
actual_output: "PASS: all six expired prod-promotion grants (batch-404af076 x2, batch-48e48b4c x4, every
one expires_at 2026-08-30T16:00:00Z, none consumed) are pruned; grants/prod_promotion_grants.yaml is
back to its OMN-13424 at-rest state entries: []."
exit_code: 0
pr_number: 7561
branch: "hotfix/omn-16702-restage-batch-af8142c0"
pr_number: 7731
branch: "hotfix/omn-16702-restage-staging-grant"
21 changes: 21 additions & 0 deletions drift/dod_receipts/OMN-16702/occ-self-bind-pr-7731/command.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
---
schema_version: "1.0.0"
ticket_id: "OMN-16702"
evidence_item_id: "occ-self-bind-pr-7731"
check_type: "command"
check_value: "gh pr view ${PR_NUMBER} --repo OmniNode-ai/onex_change_control --json number,state,headRefName"
contract_sha256: "sha256:558244469ff5138f39d0d0764b8d3216cc6c4a6969c6d0f8db51c012649745fa"
contract_entry_sha256: "sha256:ca448ad195a61b0cffdb5d3eadb3cecdf9d5f1c2785c270fd0a8728d4cd5ce87"
status: PASS
run_timestamp: "2026-08-30T17:40:00Z"
commit_sha: "81e50658a7a7376ab2a738aa0f92d45d9adfb9a3"
runner: "local-git"
verifier: "occ-manual-companion"
probe_command: "gh api repos/OmniNode-ai/onex_change_control/pulls/7731/files --paginate --jq '.[].sha'"
probe_stdout: |
fe1d35fba9215db09d2f5d68d097c001baf88fc5
actual_output: "PASS: OCC self-bind for OMN-16702 (OCC#7731) — re-stage of the staging-namespace authorization
on main after grant-00ba7b7e expired unconsumed at 16:00Z."
exit_code: 0
pr_number: 7731
branch: "hotfix/omn-16702-restage-staging-grant"
Loading
Loading