chore(OMN-14340): ratchet protocols→models frozen ignores + hub growth-ratchet in omnibase_core

[jonahgabriel]

Summary

Makes the operator's "no permanent exception" ruling on protocols→models (the ~65-edge cycle family of epic OMN-3210) mechanically true in the interim, WITHOUT doing the deferred DTO relocation (which rides the RSD canonical rewrite). Also adds a tiered growth-ratchet on the hub modules to stop the tangle compounding.

Does NOT touch protocols→models source — enforcement/ratchet only.

Closes OMN-14340 · Refs OMN-3210

Problem

The intra-core import-linter oracle freezes known back-edges as wildcard ignore_imports lines (e.g. omnibase_core.protocols.** -> omnibase_core.models.**). A wildcard ignore is permissive: it silently allows new edges of that class. So "frozen debt" can actually grow.

Mechanism

scripts/ci/check_import_ratchet.py uses grimp (import-linter's own graph builder) to enumerate the live direct edges and compares against a generated baseline (scripts/ci/import_ratchet_baseline.py).

1. protocols→models frozen at 65 — HARD-FAIL. A NEW protocols→models edge hard-fails; the set only shrinks.
2. Hub growth-ratchet — tiered enforcement (operator decision 2026-07-10):
   • mixins (17) + protocols (63) → HARD-FAIL on a new importer. Low-churn, clearly worth it.
   • utils (548) → WARN only (non-blocking, exit 0). A hard freeze on a 548-importer hub fires on most new files → friction → gets routed around (rubber-stamped baseline edits) → not real enforcement (rule feat: implement complete 4-node canary deployment architecture #5). utils is also scheduled for dissolution in the RSD rewrite, so a hard freeze on a doomed hub is low-value. Net-new utils importers are still logged and show in the baseline diff — visibility preserved, zero merge friction.
   • Hubs are not dissolved (dissolution waits for the rewrite).
3. .importlinter protocols→models ignore line tagged with the RSD-rewrite retirement mechanism (regeneration) + owner + date.
4. Wired as CI gate + pre-commit (enforcement, not detection — rule feat: implement complete 4-node canary deployment architecture #5): a step in the blocking Import Layering Oracle job (inherits the quality-gate needs), plus an import-ratchet pre-commit hook.

Retirement: the RSD rewrite regenerates these modules canonically (dissolving the protocols↔models cycle); the baseline drains to empty and this file + ratchet are deleted. Sanctioned downward re-freeze: uv run python scripts/ci/check_import_ratchet.py --update.

dod_evidence

• lint-imports: 4 kept, 0 broken (comment-only .importlinter change).
• Tiered enforcement proven end-to-end: a new utils importer → exit 0 + WARNING (surfaced, non-blocking); a new mixins importer → exit 1 FAILED; a synthetic protocols→models edge → exit 1; cleanup → exit 0. Unit tests assert each tier (utils = warn-not-fail incl. main() exit 0; mixins/protocols = hard-fail), so the gate can't rot into a no-op.
• Baseline frozen: protocols→models=65, hub_inbound={utils:548, mixins:17, protocols:63}.
• mypy --strict (checker) clean; ruff format+check clean (generator emits ruff-clean output — --update needs no manual format); 12 ratchet tests pass; pre-commit (changed files) exit 0, all hooks.

Design note

The baseline is a generated .py module (not YAML) to sidestep three yaml-hostile repo hooks (yamlfmt ---, manual-yaml-prevention's ban on yaml.safe_load, SPDX-on-yaml). It's SPDX-clean, ruff-clean, class-free.

• No dependency on the in-flight seam-retirement PRs; .importlinter change is comment-only on the protocols block (no conflict).
• No self-authored OCC — left for the independent verifier.

---

Evidence-Source: OCC#3858
Evidence-Commit: ead9fbe70d5780ab8afabc0d64438c649aa17a20
Evidence-Ticket: OMN-14340

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 44 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a6354309-6bc3-4aa2-af7d-fe8835ecf0b6

📥 Commits

Reviewing files that changed from the base of the PR and between 767e07a and 8bc59f6.

📒 Files selected for processing (7)

• .github/workflows/ci.yml
• .importlinter
• .pre-commit-config.yaml
• pyproject.toml
• scripts/ci/check_import_ratchet.py
• scripts/ci/import_ratchet_baseline.py
• tests/unit/scripts/ci/test_check_import_ratchet.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-14340-protocols-models-ratchet-hub-growth

---

_{Comment @coderabbitai help to get the list of available commands.}