Repository navigation
docs(OMN-10419): bind TODO audit follow-up receipt - #903
Merged
Merged
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
jonahgabriel
enabled auto-merge (squash)
May 10, 2026 06:04
jonahgabriel
added a commit
that referenced
this pull request
May 26, 2026
… batch (#1691) * contracts(OMN-12208..12231): add OCC evidence for Wave 2-6 stub nodes batch Add OCC contracts and DoD receipts for 10 omnimarket PRs (Wave 2-6 stub nodes): - OMN-12208 (#903): node_self_healing_dispatch_orchestrator — 20 tests - OMN-12211 (#908): node_pipeline_audit_orchestrator — 24 tests - OMN-12216 (#909): node_recall_compute — 18 tests - OMN-12222 (#910): Wave 5 contract_drift + verification_sweep — 42 tests - OMN-12219 (#911): node_decision_store_orchestrator — 10 tests - OMN-12218 (#912): node_runner_orchestrator — 13 tests - OMN-12217 (#913): node_observability_sink_effect — 14 tests - OMN-12228 (#914): Wave 6 design_to_plan Phase3 + generate_node — 21 tests - OMN-12231 (#915): Wave 6 6 COMPUTE stubs — 36 tests - OMN-12225 (#916): Wave 6 5 batch nodes — 50 tests Also adds hardcoded_topic to the adapter_occ_contract.py allowlist to baseline the pre-existing topic violation introduced in OMN-10278 (PR #885). * chore: update receipt commit_sha to post-trigger-CI PR heads
jonahgabriel
added a commit
that referenced
this pull request
Aug 17, 2026
…fra#915 The autobind writer never minted a companion for this product PR (verified live: no OCC PR, no branch, no contract entry references it), so the mirror PR has no Evidence-Source to cite and its receipt gate cannot resolve. Authored by hand on the shape the merged companion for #903 established. Appends two dod_evidence entries and their receipts, mirroring that template field-for-field: dod-OmniNode-ai-omninode_infra-pr-915 gh pr view 915 --json number,state dod-OmniNode-ai-omninode_infra-pr-915-ci gh pr view 915 --json files Both probes were executed live under `bash -o pipefail` by a mint script that writes no receipt for a non-zero exit; probe_stdout is the byte-exact capture, emitted as a literal block scalar so the yamlfmt v0.21.0 folded-scalar rewrite (OMN-15479) cannot touch it. Product head at authoring time is 6c9da542682b5c1d23772a397346fd2062ad5b7b; the recorded diff scope is the desired-clients mirror plus its secrets baseline. runner/verifier are this lane's own handles rather than the writer's (node_pr_lifecycle_fix_effect / occ-evidence-source-autobind) — this companion was not machine-minted and must not claim to have been. Append-only: no prior entry or receipt is edited. The existing receipts all carry contract_entry_sha256, which is immune to contract appends, so no rebind supersedes are needed. STILL REQUIRED before this can pass occ-preflight: the occ-self-bind-pr-<N> entry + receipt, which cannot exist until the PR number does. The eligibility validator resolves all six receipts as PASS and hash-bound and fails only on pr_ticket_mismatch for exactly that reason. The merged #903 companion landed the same way, as two commits. Local verification, all green: receipt hardening, receipt honesty, Evidence-Commit SHA existence, contract shape v1, substance floor, DoD-authoring hygiene, yamlfmt contamination (file + --corpus, 518/15 unchanged), supersession corpus ratchet (2344 = baseline), contract corpus ratchets A-E (17/17), full pre-commit over the changed files.
jonahgabriel
added a commit
that referenced
this pull request
Aug 17, 2026
…#6573) * evidence(OMN-10221): author OCC companion for OmniNode-ai/omninode_infra#915 The autobind writer never minted a companion for this product PR (verified live: no OCC PR, no branch, no contract entry references it), so the mirror PR has no Evidence-Source to cite and its receipt gate cannot resolve. Authored by hand on the shape the merged companion for #903 established. Appends two dod_evidence entries and their receipts, mirroring that template field-for-field: dod-OmniNode-ai-omninode_infra-pr-915 gh pr view 915 --json number,state dod-OmniNode-ai-omninode_infra-pr-915-ci gh pr view 915 --json files Both probes were executed live under `bash -o pipefail` by a mint script that writes no receipt for a non-zero exit; probe_stdout is the byte-exact capture, emitted as a literal block scalar so the yamlfmt v0.21.0 folded-scalar rewrite (OMN-15479) cannot touch it. Product head at authoring time is 6c9da542682b5c1d23772a397346fd2062ad5b7b; the recorded diff scope is the desired-clients mirror plus its secrets baseline. runner/verifier are this lane's own handles rather than the writer's (node_pr_lifecycle_fix_effect / occ-evidence-source-autobind) — this companion was not machine-minted and must not claim to have been. Append-only: no prior entry or receipt is edited. The existing receipts all carry contract_entry_sha256, which is immune to contract appends, so no rebind supersedes are needed. STILL REQUIRED before this can pass occ-preflight: the occ-self-bind-pr-<N> entry + receipt, which cannot exist until the PR number does. The eligibility validator resolves all six receipts as PASS and hash-bound and fails only on pr_ticket_mismatch for exactly that reason. The merged #903 companion landed the same way, as two commits. Local verification, all green: receipt hardening, receipt honesty, Evidence-Commit SHA existence, contract shape v1, substance floor, DoD-authoring hygiene, yamlfmt contamination (file + --corpus, 518/15 unchanged), supersession corpus ratchet (2344 = baseline), contract corpus ratchets A-E (17/17), full pre-commit over the changed files. * evidence(OMN-10221): occ-self-bind-pr-6573 Appends the mandatory self-bind evidence item for OCC companion PR #6573, per the merged #903/#6492 pattern. Whole-file contract_sha256 recomputed and propagated to the two PR-915 evidence receipts so all three receipts in this commit agree on the same hash. Evidence-Ticket: OMN-10221
jonahgabriel
added a commit
that referenced
this pull request
Aug 17, 2026
The occ-autobind emitter (node_pr_lifecycle_fix_effect) re-minted drift/dod_receipts/OMN-10221/dod-occ-evidence-admissibility-validator/command.yaml in place with PR #922's probe values, overwriting the already-merged receipt from PR #903's companion (OCC#6492). Merged receipts are immutable per the OCC Append-Only Gate -- corrections must be net-new add-only files, never edits to a merged receipt. That evidence item is a ticket-level admissibility check, not scoped to a specific product PR, and is already satisfied by the merged receipt from #6492. Reverting it to the dev baseline; the genuinely new evidence for PR #922 (dod-OmniNode-ai-omninode_infra-pr-922, dod-OmniNode-ai-omninode_infra-pr-922-ci, occ-self-bind-pr-6577, and the contracts/OMN-10221.yaml dod_evidence appends) remains untouched. OMN-10221
jonahgabriel
added a commit
that referenced
this pull request
Aug 17, 2026
…inode_infra#922 (#6577) * evidence(OMN-10221): author OCC companion for OmniNode-ai/omninode_infra#922 OCC companion by node_pr_lifecycle_fix_effect (OMN-13317 F1 / OMN-13990 / OMN-14285). Product PR head 34790dfe498cb5f3e08dc25ff0cf7f7842f2f40e. * evidence(OMN-10221): self-bind OCC#6577 + rebind contract_sha256 * fix: restore append-only-immutable receipt, drop in-place mutation The occ-autobind emitter (node_pr_lifecycle_fix_effect) re-minted drift/dod_receipts/OMN-10221/dod-occ-evidence-admissibility-validator/command.yaml in place with PR #922's probe values, overwriting the already-merged receipt from PR #903's companion (OCC#6492). Merged receipts are immutable per the OCC Append-Only Gate -- corrections must be net-new add-only files, never edits to a merged receipt. That evidence item is a ticket-level admissibility check, not scoped to a specific product PR, and is already satisfied by the merged receipt from #6492. Reverting it to the dev baseline; the genuinely new evidence for PR #922 (dod-OmniNode-ai-omninode_infra-pr-922, dod-OmniNode-ai-omninode_infra-pr-922-ci, occ-self-bind-pr-6577, and the contracts/OMN-10221.yaml dod_evidence appends) remains untouched. OMN-10221 --------- Co-authored-by: omnimarket-bot <bot@omninode.ai> Co-authored-by: Jonah Gray <jonah@omninode.ai>
jonahgabriel
added a commit
that referenced
this pull request
Aug 17, 2026
Appends the mandatory self-bind evidence item for OCC companion PR #6589, per the merged #903/#6492/#6573 pattern (OMN-14650). This item cannot exist before the PR number does, so it lands as a second commit after opening #6589. Uses contract_entry_sha256 (per-entry, OMN-13888) rather than the legacy whole-file scheme #6573 used: appending this entry left the two existing receipts' own per-entry hashes byte-identical (verified via the canonical validator_receipt_gate hashers), so neither needed re-stamping. Only the whole-file contract_sha256 changed (file grew); both existing receipts carry contract_entry_sha256, which the gate treats as authoritative over contract_sha256, so they remain valid unmodified. Local verification, all green: - validator_occ_append_only --ticket-id OMN-16112 (in-repo, base = merge-base with origin/dev) -> ok:true. - validator_occ_merge_eligibility run twice: once as onex_change_control's own in-tree PR (#6589, its own title/branch/commit) -> eligible:true, and once simulating omnimarket#2085's real body with a live 'Evidence-Source: OCC#6589' line appended -> eligible:true. - check-receipt-honesty, check-contract-substance-floor, check-contract-shape-v1, check-dod-authoring-hygiene, check-receipt-hardening all Passed locally. Evidence-Ticket: OMN-16112
jonahgabriel
added a commit
that referenced
this pull request
Aug 17, 2026
…6589) * evidence(OMN-16112): author OCC companion for OmniNode-ai/omnimarket#2085 The autobind writer never minted a companion for this product PR (verified live: no OCC PR, no branch, no contract entry references it) — its diff is a single-package uv.lock bump (mcp 1.28.0 -> 1.29.0, CVE-2026-59950) with no RED-derivable source file, which is outside autobind's current derivation surface. That gap is tracked separately as OMN-16118. Authored by hand on the occ#6573/OMN-10221 manual-companion precedent per controller authorization. Adds a net-new contract + two dod_evidence entries and their receipts, mirroring the #6573 template field-for-field: dod-OmniNode-ai-omnimarket-pr-2085 gh pr view 2085 --json number,state dod-OmniNode-ai-omnimarket-pr-2085-ci gh pr view 2085 --json files Both probes were executed live against omnimarket#2085's real head (2b4fac8076f5667c1ac44a3e87cdcac0c2efd51f); probe_stdout is the byte-exact capture, emitted as a literal block scalar so the yamlfmt v0.21.0 folded-scalar rewrite (OMN-15479) cannot touch it. Receipts carry both contract_sha256 (whole-file) and contract_entry_sha256 (per-entry, OMN-13888) computed via the canonical validator_receipt_gate hashers after a first yamlfmt pass stabilized the contract bytes. runner/verifier are this lane's own handles rather than the writer's (node_pr_lifecycle_fix_effect / occ-evidence-source-autobind) — this companion was not machine-minted and must not claim to have been. Local `validator_occ_merge_eligibility` run against omnimarket#2085's live title/branch/commit-sha with this commit's on-disk contract+receipts as the evidence source returns eligible:true. STILL REQUIRED before this can pass occ-preflight on its own PR: the occ-self-bind-pr-<N> entry + receipt, which cannot exist until the PR number does — same two-commit shape as the merged #6573/#903 companions. Evidence-Ticket: OMN-16112 * evidence(OMN-16112): occ-self-bind-pr-6589 Appends the mandatory self-bind evidence item for OCC companion PR #6589, per the merged #903/#6492/#6573 pattern (OMN-14650). This item cannot exist before the PR number does, so it lands as a second commit after opening #6589. Uses contract_entry_sha256 (per-entry, OMN-13888) rather than the legacy whole-file scheme #6573 used: appending this entry left the two existing receipts' own per-entry hashes byte-identical (verified via the canonical validator_receipt_gate hashers), so neither needed re-stamping. Only the whole-file contract_sha256 changed (file grew); both existing receipts carry contract_entry_sha256, which the gate treats as authoritative over contract_sha256, so they remain valid unmodified. Local verification, all green: - validator_occ_append_only --ticket-id OMN-16112 (in-repo, base = merge-base with origin/dev) -> ok:true. - validator_occ_merge_eligibility run twice: once as onex_change_control's own in-tree PR (#6589, its own title/branch/commit) -> eligible:true, and once simulating omnimarket#2085's real body with a live 'Evidence-Source: OCC#6589' line appended -> eligible:true. - check-receipt-honesty, check-contract-substance-floor, check-contract-shape-v1, check-dod-authoring-hygiene, check-receipt-hardening all Passed locally. Evidence-Ticket: OMN-16112 * fix(OMN-16112): replace PR-existence probes with admissible content reads OCC#6589's own Contract Compliance Check BLOCKed: both PR-scoped dod_evidence items used bare `gh pr view <n> --json ...`, which the OMN-15309 evidence-admissibility predicate treats as the paradigm "PR-existence probe" anti-pattern -- not falsifiable, proves only that a PR object exists. Bare `gh` is not in the admissible-command vocabulary (only the compound `gh api` token is), and the module's own comment names `gh pr view/list/status` as "trivially true via almost every ticket's own generated self-bind check" -- exactly the shape both merged precedents this companion was modeled on (occ#6573, occ#6583) also used. Neither precedent's Contract Compliance Check ever actually ran on its head (confirmed live: absent entirely from both PRs' check-runs, ~100 runs each) -- apparently because the job needs the ci:ready label to fire for real, which this companion has and the autobind-minted/earlier precedents evidently didn't at authoring time. So this is the first time this exact companion shape has been checked for real, and it fails honestly. Replaced two of the three items with genuinely admissible probes (EXECUTED, FALSIFIABLE, OUTSIDE ITS OWN DIFF per the predicate): dod-OmniNode-ai-omnimarket-pr-2085: reads uv.lock content at #2085's pinned head ref via `gh api .../contents/uv.lock?ref=<sha>` and asserts mcp==1.29.0 -- proves the CVE-2026-59950 fix actually landed in the file, not just that a PR exists. RED-verified against the vulnerable 1.28.0 string. dod-OmniNode-ai-omnimarket-pr-2085-ci: reads the actual diff via `gh api .../pulls/2085/files` (admitted per the module's own BLOCK-message guidance -- "/pulls/<n>/files ... returns the actual diff") and asserts the file list is exactly ["uv.lock"]. RED-verified against a fabricated two-file list. occ-self-bind-pr-6589 is left unchanged and stays individually INADMISSIBLE (WARN, not BLOCK) -- self-bind is structurally incapable of being "outside its own diff" (the predicate's own module comment acknowledges this class exists), and `_has_effective_check` only requires ONE admissible item across the contract, not all three, to avoid the hard BLOCK. Locally verified via `onex_change_control.validation.evidence_admissibility.classify_evidence` directly: both new items -> ADMISSIBLE; self-bind -> still NOT_EXECUTED as expected. contract_entry_sha256 recomputed for the two changed items via the canonical validator_receipt_gate hashers; occ-self-bind-pr-6589's own per-entry hash is byte-identical (unaffected, confirming the append-immunity property). validator_occ_append_only re-run against the origin/dev merge-base: ok:true (this ticket still diffs as pure 'A' -- the whole OMN-16112 corpus is net-new to dev). Local validator_occ_merge_eligibility re-run for omnimarket#2085's real Evidence-Source binding: eligible:true, unchanged. Evidence-Ticket: OMN-16112
jonahgabriel
added a commit
that referenced
this pull request
Aug 17, 2026
Appends the mandatory self-bind evidence item for OCC companion PR #6595, per the merged #903/#6492/#6573/#6589 pattern (OMN-14650). This item cannot exist before the PR number does, so it lands as a second commit after opening #6595. Local verification, all green: - validator_occ_append_only --ticket-id OMN-16114 (base = merge-base with origin/dev) -> ok:true. - validator_occ_merge_eligibility run twice: once as onex_change_control's own in-tree PR (#6595, its own title/branch/commit) -> eligible:true, and once simulating omnibase_infra#2768's real body with a live 'Evidence-Source: OCC#6595' line appended -> eligible:true. - check-receipt-honesty, check-contract-substance-floor, check-contract-shape-v1, check-dod-authoring-hygiene, check-receipt-hardening all Passed locally. Evidence-Ticket: OMN-16114
jonahgabriel
added a commit
that referenced
this pull request
Aug 17, 2026
#6595) * evidence(OMN-16114): author OCC companion for OmniNode-ai/omnibase_infra#2768 The occ-autobind born-path event for this PR was swallowed at the consumer twice in a row -- not a replay-tooling failure, a delivery-guarantee gap. Confirmed forensically via live workflow logs rather than assumed: 1. Original PR-open trigger (pull_request event, run 32008569724, 08:03:41Z, head f18eee68f0933eb3206f909c4d8079e952647bb3): produced no companion. 2. Manual workflow_dispatch replay #1 (run 32010077750, job 95327597955): the publish step ran clean -- "Published onex.cmd.omnimarket.occ-autobind.v1 event_id=9e01122d-9253-40b1-83c5-ef2583280482" at 08:25:14Z, to the dev-lane broker (omninode-pc.tail75df5e.ts.net:19092). No companion appeared after 74+ minutes. 3. Manual workflow_dispatch replay #2, fired from this lane (run 32016316098, job 95346440127): also published clean -- "Published onex.cmd.omnimarket.occ-autobind.v1 event_id=e3defa43-ff9a-4c67-9b7c-72fe9e7bd77c" at 09:44:30Z (the job's overall conclusion shows "cancelled", but that fired AFTER the publish step completed and logged success -- the cancellation did not touch the already-published event). No companion after 5+ minutes at authoring time. Two independent, successfully-published events for the same PR/ticket with zero consumption is new evidence for the delivery-guarantee defect thread -- the failure is at the consumer/effect-handler side, not the publisher. Hand-authored on the occ#6573/OMN-10221 and OMN-16112/occ#6589 manual-companion precedent per controller authorization. Learned from the occ#6589 lane (same session): bare `gh pr view --json ...` is the OMN-15309-inadmissible "PR-existence probe" anti-pattern, so both dod_evidence checks here are built admissible from the start -- content-bound, RED-verified probes, not existence probes: dod-OmniNode-ai-omnibase_infra-pr-2768: gh api .../contents/docker/runners/runner-job-started.sh?ref=<sha> reads the actual file content at #2768's head and asserts the new shared rewrite-flush function (_c2_rewrite_flush) is present. RED-verified: zero matches at the PR's base ref. dod-OmniNode-ai-omnibase_infra-pr-2768-ci: gh api .../pulls/2768/files reads the actual diff (admitted per the module's own guidance) and asserts the exact two-file change set. Locally verified via onex_change_control.validation.evidence_admissibility .classify_evidence directly: both items -> ADMISSIBLE. Local validator_occ_merge_eligibility run against #2768's real title/branch/ commit-sha with this commit's on-disk contract+receipts returns eligible:true. STILL REQUIRED before this can pass occ-preflight on its own PR: the occ-self-bind-pr-<N> entry + receipt, which cannot exist until the PR number does -- same two-commit shape as the merged #6573/#903/#6589 companions. Evidence-Ticket: OMN-16114 * evidence(OMN-16114): occ-self-bind-pr-6595 Appends the mandatory self-bind evidence item for OCC companion PR #6595, per the merged #903/#6492/#6573/#6589 pattern (OMN-14650). This item cannot exist before the PR number does, so it lands as a second commit after opening #6595. Local verification, all green: - validator_occ_append_only --ticket-id OMN-16114 (base = merge-base with origin/dev) -> ok:true. - validator_occ_merge_eligibility run twice: once as onex_change_control's own in-tree PR (#6595, its own title/branch/commit) -> eligible:true, and once simulating omnibase_infra#2768's real body with a live 'Evidence-Source: OCC#6595' line appended -> eligible:true. - check-receipt-honesty, check-contract-substance-floor, check-contract-shape-v1, check-dod-authoring-hygiene, check-receipt-hardening all Passed locally. Evidence-Ticket: OMN-16114 * fix(OMN-16114): SIGPIPE-safe the two content-bound probes (Rule E) #6595's own Contract Corpus Ratchets (OMN-15411) check failed the census baseline: both new dod_evidence check_values matched the measured SIGPIPE-fragile shape. dod-OmniNode-ai-omnibase_infra-pr-2768: `... | base64 -d | grep -q ...` -- the "base64-decoded file body" producer, measured 141,0,141,0,141 across 5 runs against the corpus' own real inputs. dod-OmniNode-ai-omnibase_infra-pr-2768-ci: `--jq '[.[].filename]' | grep -qxF ...` -- the "iterating jq projection" producer (unbounded output by construction, `.[]` in the jq expression). `grep -q`/`grep -qxF` exit at the first match and close stdin; if the upstream producer still has bytes to write it is killed by SIGPIPE (exit 141), which `bash -o pipefail` propagates as a false RED on genuinely-passing evidence. Rewritten per the documented repair idiom (occ#5496/#5523 precedent, fetched and matched field-for-field): buffer the producer's full output into a shell variable first, so it runs to completion before anything reads from it, then pipe a printf of that variable into grep -qF. Re-verified both probes live against #2768's real head -- same PASS result, same RED-control failure against wrong input. Verified against the actual gates, not inferred: - onex_change_control.validation.evidence_admissibility.classify_evidence -> both items still ADMISSIBLE (gh-api + grep in command position unaffected by the buffering). - scripts/lint_contract_check_values._sigpipe_producer_label -> None for all three dod_evidence items (Rule E clean). - uv run pytest tests/unit/scripts/test_lint_contract_check_values_corpus_baseline.py -> 17/17 passed locally (was 3 failed before this fix). - validator_occ_append_only --ticket-id OMN-16114 -> ok:true (all four files still diff as pure 'A' against the origin/dev merge-base). - validator_occ_merge_eligibility (companion's own in-tree binding, both commits cited) -> eligible:true, unchanged. contract_entry_sha256 recomputed for the two edited items via the canonical hashers; occ-self-bind-pr-6595's own per-entry hash is byte-identical (unaffected, confirming append-immunity). Evidence-Ticket: OMN-16114
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
OMN-10419
Verification