Repository navigation
test(OMN-17437): cross-branch invariant — governance-path exclusion must exist on every grant-PR base branch - #7938
jonahgabriel wants to merge 7 commits into
Conversation
|
No OCC evidence companion was minted for this PR. the product repo 'OmniNode-ai/onex_change_control' IS the OCC repo, so this PR is itself an OCC evidence record; no companion is authored for one (OMN-16440, specimens OCC#6927/#6958) Matched in the repo: To clear this: Nothing to do. An OCC evidence PR carries its own evidence in its own diff; the companion it was declined would have carried only a bare existence probe. Reported by |
|
OCC autobind stood down for |
…on must exist on every branch that serves grant-PR traffic Backmerge companion to the `main` hotfix. `dev` already carries the OMN-16117 exclusion and `scripts/ci/check_governance_paths.py`; what it lacked was any check that the OTHER base branch carries them too, which is precisely how OMN-16117 came to be installed on the branch grant PRs never target. Adds the same test file the `main` hotfix adds. Three per-branch invariants (the exclusion step exists, every arming step is gated on it, the checker module resolves and guards the grant file) plus a cross-branch check that applies the invariant to each branch in GRANT_PR_BASE_BRANCHES, reading the branch under edit from the worktree and the others from the git object store. Run from `dev` today the cross-branch leg correctly reports `ref main: no 'Check governance-path exclusion' step` — it turns green when the `main` hotfix lands. In OCC's `test` CI job the other branch is not resolvable (checkout is fetch-depth 1) so that leg skips there; the per-branch legs still run. Also lands contracts/OMN-17437.yaml so the ticket contract resolves on dev.
…tream}
Mirrors the same correction on the main hotfix: once a feature branch is
pushed, @{upstream} is the branch itself rather than its base, so the
cross-branch leg reported "no branch under edit" and then demanded the fix
already be on the ref. Ancestry answers it structurally.
78b626e to
65b3937
Compare
|
Claimed by codex-merge-sweep for supersession. Closing this human-authored PR because the required Human-Authored Privileged PR Gate refuses |
|
Closed by codex-merge-sweep after claim: superseded by the App-authored replacement required by Human-Authored Privileged PR Gate. Branch head patched at 0859d9f before re-dispatch. |
Pull request was closed
1 participant
Backmerge companion to the
mainhotfix for OMN-17437. Draft until themainhotfix lands — see "Why this is a draft" below.Why
devalready carries the OMN-16117 governance-path exclusion andscripts/ci/check_governance_paths.py. What no branch carried was a check that the other base branch has them too — which is exactly how OMN-16117 came to be installed on the branch grant PRs never target.Every merged prod-promotion grant PR — #7084, #7213, #7418, #7464, #7554, #7561, #7662, #7731 — targeted
main, notdev. Forpull_requestevents GitHub resolves the workflow from the PR's merge ref, so main-based grant PRs ran main's unprotected 165-line copy ofauto-merge.yml, which armsgh pr merge --auto --squashfor any PR authored byjonahgabriel— the identity agent sessions act under.What this adds
tests/ci/test_auto_merge_governance_exclusion.py, identical to the file themainhotfix adds:Check governance-path exclusionstep exists, every arming step is gated onsteps.governance_gate.outputs.exclude != 'true', andscripts/ci/check_governance_paths.pyresolves and guards the grant file;GRANT_PR_BASE_BRANCHES = ("main", "dev"). The branch under edit is read from the worktree (on an open PR the fix is in the tree, not yet on the ref); the others are read from the git object store.Plus
contracts/OMN-17437.yamlso the ticket contract resolves ondev.Why this is a draft
Run from
devagainst a full clone today, the cross-branch leg correctly fails:That is the test doing its job —
mainis genuinely unprotected until the hotfix lands. It turns green on merge. In OCC'stestCI job the other branch is not resolvable (actions/checkout@v6at the defaultfetch-depth: 1), so that leg skips there and the per-branch legs still run; the real cross-branch proof comes from any full clone, including every local pre-push run.DoD receipts are added before this leaves draft, once the
mainhotfix has landed and the contract's check commands pass on this branch too.Blast radius
Test-only plus one contract file. No workflow, no source, no governance file is touched on
dev. Nothing here can arm, merge, or authorize anything.