smom-dbis-138/docs/hybx-omnl/OMNL_RECONCILE_CRON_AND_CI.md

OMNL reconcile — cron and CI

The anchor is the SHA-256 of canonical JSON built from config/omnl-ipsas-gl-registry.json and config/omnl-journal-matrix.json (see services/token-aggregation/scripts/omnl-reconcile-report.mjs).

One-off (repo root)

bash scripts/hybx-omnl/omnl-reconcile-artifact.sh

Outputs under artifacts/omnl-reconcile/ (gitignored locally):

File	Purpose
omnl-reconcile-<UTC-timestamp>.json	Immutable run record
omnl-reconcile-latest.json	Copy of last run
omnl-reconcile-sha256.txt	Single line: hex digest for scripts / alerting
omnl-reconcile-ci-meta.json	Present when GITHUB_* env vars are set

Override output directory: OMNL_RECONCILE_ARTIFACT_DIR=/var/lib/omnl bash scripts/hybx-omnl/omnl-reconcile-artifact.sh

Cron example

Run daily at 06:00 UTC. The script calls node on omnl-reconcile-report.mjs (no npm install required; only Node.js and repo files).

# OMNL IPSAS / journal matrix anchor (adjust paths and log location)
0 6 * * * cd /opt/smom-dbis-138 && /usr/bin/bash scripts/hybx-omnl/omnl-reconcile-artifact.sh >> /var/log/omnl-reconcile.log 2>&1

After registry or matrix edits in git, re-run the script (or rely on CI) and archive the new sha256 in your ops log.

GitHub Actions

Scheduled / manual anchor

Workflow: .github/workflows/omnl-reconcile.yml

• schedule: weekly (edit cron as needed)
• workflow_dispatch: manual run
• push / pull_request: when OMNL config or the reconcile script changes

Artifacts: download omnl-reconcile-<run id> from the Actions run; it contains the same files as above.

PR checks (TypeScript + anchor, no Forge)

Workflow: .github/workflows/hybx-omnl-ts.yml

• workflow_dispatch: run manually from the Actions tab (no path filter).
• Runs on pull_request and push when OMNL contracts, token-aggregation, OMNL config, or scripts/hybx-omnl/** change.
• Steps: npm ci in services/token-aggregation, omnl-reconcile-artifact.sh, npm run build, uploads artifacts/omnl-reconcile/ (14-day retention).

Full stack validation (Forge hybx-omnl + tsc): pnpm run omnl:verify or bash scripts/hybx-omnl/ci-omnl-validation.sh locally (requires Foundry + lib/).

Both OMNL workflows use concurrency (cancel in-progress on the same ref) to avoid stacked runs on rapid pushes.