Repository navigation
evidence(OMN-18024): OCC companion for OmniNode-ai/omnibase_infra#3272 - #8559
Closed
jonahgabriel wants to merge 1 commit into
Closed
jonahgabriel wants to merge 1 commit into
jonahgabriel wants to merge 1 commit into
Conversation
Hand-authored because the autobind producer declined: it posted occ-autobind-no-red-derivable (OMN-15247) on #3272 -- no changed-file candidate could be proven RED against the merge base, and a PR-existence probe alone would be non-falsifiable evidence. The diff-derived behavior proof here IS falsifiable, and the falsification was measured rather than asserted: in a clean worktree checked out at #3272's first parent 0e23c66c5, tests/unit/topics/test_topic_provisioning_policy.py reports 6 failed, 28 passed, where the PR head reports 92 passed across all six modules. The exposure-gate receipt carries its own positive control: the SAME denylist file reports findings=0 exit 0 on the PR head and findings=42 exit 1 against an unmodified worktree at that parent. A zero-finding run alone is not evidence of absence. Every hash is tool-computed from the contract by omnibase_core's compute_contract_sha256 / compute_contract_entry_sha256, and each receipt was validated against ModelDodReceipt before emit; none was hand-typed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OCC companion for OmniNode-ai/omnibase_infra#3272 (ticket OMN-18024, child of epic OMN-17992 — public-repo hygiene, wave A item (b)).
Hand-authored because the autobind producer declined on the product PR with
occ-autobind-no-red-derivable(OMN-15247): it could not prove a changed-file candidate RED against the merge base, and emitting a PR-existence probe instead would have been non-falsifiable evidence.What is in this companion
contracts/OMN-18024.yamlplus four receipts underdrift/dod_receipts/OMN-18024/:dod-OmniNode-ai-omnibase_infra-pr-3272dod-OmniNode-ai-omnibase_infra-pr-3272-cidod-occ-diff-derived-behavior-proofdod-exposure-gate-with-positive-controlThe behavior proof is falsifiable, and the falsification was measured
Not asserted. In a clean worktree checked out at #3272's first parent
0e23c66c5,tests/unit/topics/test_topic_provisioning_policy.pyreports 6 failed, 28 passed. On the PR head61b3b0c9dthe same six modules report 92 passed. That is the RED the autobind could not derive, recorded here explicitly.The exposure gate carries its own positive control
check_exposed_identifiers.py --mode blocking --scope all, the same denylist file pointed at both trees:61b3b0c9d:entries=11 files_scanned=7125 findings=0, exit 00e23c66c5, unmodified worktree:entries=11 files_scanned=7138 findings=42, exit 1A zero-finding run alone is not evidence of absence. The red parent is what makes the green head evidence.
How the receipts were produced
Tool-generated, not hand-written. Bodies validated against
ModelDodReceiptbefore emit;contract_sha256fromomnibase_core.validation.validator_receipt_gate.compute_contract_sha256and everycontract_entry_sha256fromcompute_contract_entry_sha256, both read from the committed contract. No hash was typed by hand. Eachprobe_commandembeds arepos/OmniNode-ai/omnibase_infra/commits/<sha>reference so the commit-SHA existence gate can resolve the product commit in the repository it actually lives in; both compound probes were run as written.No gate was bypassed at any point: the receipt-hardening gate rejected an earlier revision of two of these receipts for exactly that unresolvable-commit reason, and the fix was to make the probe resolvable, not to weaken the check.