fix(OMN-10789): add OCC contract and receipt for delegation compliance migration

[jonahgabriel]

Summary

• Adds contracts/OMN-10789.yaml with dod_evidence for the delegation_events compliance migration
• Adds drift/dod_receipts/OMN-10789/dod-unit-tests/command.yaml receipt bound to omniclaude PR chore(occ-deps): update rerun state after baa2c495 #1557
• Adds drift/dod_receipts/OMN-10789/dod-occ-pr-898/command.yaml self-binding receipt for this OCC PR

Unblocks receipt gate (verify / verify) on omniclaude PR #1557.

Evidence-Source: OCC#898
Evidence-Ticket: OMN-10789

OMN-10789

Summary by CodeRabbit

• Chores
  • Added a database migration that introduces two new integer columns to delegation events with sensible defaults to support compliance tracking.
• Tests
  • Added unit-test coverage validating migration, defaults, upsert/write behavior (7 passing tests) and CI validation receipts, plus an automated receipt for an associated PR verification.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e7caecf2-aaf2-4bdc-b2f3-672cbcd5acf4

📥 Commits

Reviewing files that changed from the base of the PR and between 98ee93f and 4c8d05b.

📒 Files selected for processing (2)

• contracts/OMN-10789.yaml
• drift/dod_receipts/OMN-10789/dod-occ-pr-898/command.yaml

✅ Files skipped from review due to trivial changes (1)

• drift/dod_receipts/OMN-10789/dod-occ-pr-898/command.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• contracts/OMN-10789.yaml

---

📝 Walkthrough

Walkthrough

A new change control contract for ticket OMN-10789 establishes database migration requirements for the delegation_events table, adding two integer columns (tokens_to_compliance and compliance_attempts) with configured defaults. The contract includes safety bypass policy and references a test receipt documenting seven passing unit tests that validate the migration behavior across fresh install, upgrade, and CRUD scenarios.

Changes

Migration Contract & Test Evidence

Layer / File(s)	Summary
Contract Definition contracts/OMN-10789.yaml	Contract metadata, schema version, and migration summary describing new INTEGER columns on delegation_events with defaults and stated test coverage.
Safety Policy contracts/OMN-10789.yaml	Emergency bypass setting configured as disabled with empty justification.
Proof of Compliance contracts/OMN-10789.yaml, drift/dod_receipts/OMN-10789/dod-unit-tests/command.yaml	DoD evidence references the unit test receipt; test receipt records PASS status from pytest tests/delegation/test_compliance_migration.py -v with 7 passing tests, exit code 0, and provenance metadata (timestamp, commit SHA, PR 1557).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~4 minutes

Poem

🐰 New columns hop into delegation_events,
Seven tests pass without a fuss or relent—
Contract sealed, bypass off, compliance in sight,
Migrations are smooth when test receipts shine bright! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding an OCC contract and receipt for the OMN-10789 delegation compliance migration, which directly aligns with the changeset content.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-10789-occ-evidence

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

contracts/OMN-10789.yaml (1)

23-25: ⚡ Quick win

Strengthen receipt validation to reduce false-positive gate passes.

At Line 23–25, the check only asserts PASS status and ticket_id. Consider also asserting evidence_item_id, check_type, and exit_code: 0 so stale/mismatched receipts can’t satisfy the gate accidentally.

Suggested hardening diff

-      - check_type: command
-        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-10789/dod-unit-tests/command.yaml
-          && grep -q '^ticket_id: OMN-10789$' drift/dod_receipts/OMN-10789/dod-unit-tests/command.yaml"
+      - check_type: command
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-10789/dod-unit-tests/command.yaml
+          && grep -q '^ticket_id: OMN-10789$' drift/dod_receipts/OMN-10789/dod-unit-tests/command.yaml
+          && grep -q '^evidence_item_id: dod-unit-tests$' drift/dod_receipts/OMN-10789/dod-unit-tests/command.yaml
+          && grep -q '^check_type: command$' drift/dod_receipts/OMN-10789/dod-unit-tests/command.yaml
+          && grep -q '^exit_code: 0$' drift/dod_receipts/OMN-10789/dod-unit-tests/command.yaml"

Based on learnings: in this repository, receipt files are the accepted proof artifacts, so strengthening receipt-field assertions improves proof integrity without changing the proof model.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@contracts/OMN-10789.yaml` around lines 23 - 25, Update the receipt validation
in the OMN-10789 check block (the check with check_type: command and its
check_value) to assert additional fields so stale/mismatched receipts can't
pass: extend the existing grep chain to also assert grep -q '^evidence_item_id:
<EXPECTED_ID>$' (use the correct expected evidence_item_id value), grep -q
'^check_type: command$' and grep -q '^exit_code: 0$' joined with &&, preserving
the same command.yaml path; ensure the new patterns match exact field names and
values and are added into the same check_value string.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@contracts/OMN-10789.yaml`:
- Around line 23-25: Update the receipt validation in the OMN-10789 check block
(the check with check_type: command and its check_value) to assert additional
fields so stale/mismatched receipts can't pass: extend the existing grep chain
to also assert grep -q '^evidence_item_id: <EXPECTED_ID>$' (use the correct
expected evidence_item_id value), grep -q '^check_type: command$' and grep -q
'^exit_code: 0$' joined with &&, preserving the same command.yaml path; ensure
the new patterns match exact field names and values and are added into the same
check_value string.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 67b1b1f3-4000-416b-a86f-2cc5be8236ef

📥 Commits

Reviewing files that changed from the base of the PR and between 2407011 and 98ee93f.

📒 Files selected for processing (2)

• contracts/OMN-10789.yaml
• drift/dod_receipts/OMN-10789/dod-unit-tests/command.yaml