docs(OMN-16606): migrate omnibase_core documentation to the knowledge base and flip the doc gate to strict

.github/CODEOWNERS

@@ -6,7 +6,7 @@
 
 # CI/CD workflow changes require platform team review
 # CRITICAL: Protects transport import validation on protected branches
-# See: docs/decisions/RISK-009-ci-workflow-modification-risk.md
+# See the CI-workflow-modification risk record in the OmniNode knowledge base.
 /.github/workflows/ @OmniNode-ai/platform-team
 
 # GitHub configuration (dependabot, issue templates, etc.)

CONTRIBUTING.md → .github/CONTRIBUTING.md

@@ -25,9 +25,9 @@ Thank you for your interest in contributing to omnibase_core! This document prov
 ### First Steps
 
 1. **Read the documentation**:
-   - [ONEX Architecture](docs/architecture/ONEX_FOUR_NODE_ARCHITECTURE.md)
-   - [Node Building Guide](docs/guides/node-building/README.md)
-   - [CLAUDE.md](CLAUDE.md) for coding standards and rules
+   - [ONEX Architecture](https://github.com/OmniNode-ai/knowledge-base/blob/main/architecture/onex-four-node-architecture.md)
+   - [Node Building Guide](https://github.com/OmniNode-ai/knowledge-base/blob/main/guides/onex-node-building-overview.md)
+   - [CLAUDE.md](../CLAUDE.md) for coding standards and rules
 
 2. **Explore the codebase**:
    - Review existing node implementations in `src/omnibase_core/`
@@ -363,9 +363,9 @@ Brief description of changes
 
 ### Resources
 
-- [Documentation](docs/INDEX.md)
-- [Node Building Guide](docs/guides/node-building/README.md)
-- [Node Purity Failure Guide](docs/ci/CORE_PURITY_FAILURE.md) - Fixing CI purity check failures
+- [Documentation](https://github.com/OmniNode-ai/knowledge-base) — the OmniNode knowledge base is this repository's documentation home
+- [Node Building Guide](https://github.com/OmniNode-ai/knowledge-base/blob/main/guides/onex-node-building-overview.md)
+- Node purity failure guide — in the OmniNode internal knowledge base
 - [GitHub Issues](https://github.com/OmniNode-ai/omnibase_core/issues)
 
 ### Questions

.github/workflows/ci.yml

@@ -312,7 +312,7 @@ jobs:
       #   - Protected branches (main/develop): Full scan mode (comprehensive validation)
       #
       # WARNING: Do not modify the branch detection logic without understanding RISK-009.
-      # See: docs/decisions/RISK-009-ci-workflow-modification-risk.md
+      # See the CI-workflow-modification risk record in the OmniNode knowledge base.
       - name: Check for transport import violations (OMN-220)
         id: transport-check
         run: |
@@ -444,7 +444,7 @@ jobs:
           echo "- No Message queues (pika, kombu, celery)" >> $GITHUB_STEP_SUMMARY
           echo "- No gRPC or WebSocket libraries" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "See: docs/decisions/ADR-005-core-infra-dependency-boundary.md" >> $GITHUB_STEP_SUMMARY
+          echo "See: https://github.com/OmniNode-ai/knowledge-base/blob/main/architecture/onex-dependency-inversion.md" >> $GITHUB_STEP_SUMMARY
 
   # Phase 1 validation job - runs in parallel with all other Phase 1 jobs
   # Intra-Core Dependency-Layering Oracle (OMN-14216, epic OMN-3210)
@@ -3918,7 +3918,21 @@ jobs:
           if [ "${{ github.event_name }}" != "pull_request" ]; then
             exit 0
           fi
-          gh pr diff "$PR_NUMBER" --repo "$GH_REPO" --name-only > /tmp/pr-files.txt
+          # OMN-16606: NOT `gh pr diff --name-only`. That verb fetches the whole
+          # unified diff and only then filters to names, so GitHub answers
+          # `HTTP 406: the diff exceeded the maximum number of lines (20000)`
+          # and the step exits 1 -- reddening this GATE_JOBS entry, and with it
+          # the required `CI Summary`, for every large PR regardless of content.
+          # Measured on this very PR (#1644, 91,033 deletions): "could not find
+          # pull request diff: HTTP 406 ... PullRequest.diff too_large".
+          # The files API returns names without the diff body and paginates, so
+          # it has no line cap. It does cap at 3000 files; a truncated list can
+          # only ever shrink `files`, and `workflow_only` requires ALL entries
+          # to be under .github/workflows/ with `bool(files)` guarding empty --
+          # so a truncation or an empty response leaves `exempt=false` and the
+          # full compliance check runs. Fail-closed in both directions.
+          gh api "repos/$GH_REPO/pulls/$PR_NUMBER/files" --paginate \
+            --jq '.[].filename' > /tmp/pr-files.txt
           python3 - <<'PY'
           import os
           from pathlib import Path

.importlinter

@@ -1,7 +1,7 @@
 # import-linter contract — intra-core dependency-layering oracle (OMN-14216)
 #
 # Encodes the DIRECTION of imports between omnibase_core's architectural
-# sub-packages, per ADR-001, ADR-005, and docs/architecture/DEPENDENCY_INVERSION.md.
+# sub-packages, per ADR-001, ADR-005, and https://github.com/OmniNode-ai/knowledge-base/blob/main/architecture/onex-dependency-inversion.md.
 # This is the enforcement oracle every later decoupling change verifies against:
 # a new illegal back-edge fails `lint-imports`; the current known back-edges are
 # frozen below as an explicit, annotated allowlist to be burned down under the
@@ -151,11 +151,9 @@ name = Execution-tier packages must not import nodes (direct)
 # file has zero production consumers anywhere in the OmniNode org (verified by
 # exhaustive grep across every canonical repo) but IS referenced as a
 # documented "Service Wrappers" pattern from 6 architecture/tutorial docs
-# (docs/architecture/overview.md, docs/architecture/NODE_CLASS_HIERARCHY.md,
-# docs/architecture/ECOSYSTEM_DIRECTORY_STRUCTURE.md,
-# docs/guides/node-building/03_EFFECT_NODE_TUTORIAL.md,
-# docs/guides/node-building/04_EFFECT_NODE_TUTORIAL.md,
-# docs/reference/SERVICE_WRAPPERS.md). Severing the 4 edges means either
+# (the omnibase_core overview, node class hierarchy, ecosystem directory
+# structure, node-building tutorials, and service-wrappers reference, all in the
+# OmniNode knowledge base). Severing the 4 edges means either
 # relocating infra_bases.py into nodes/ or retiring the documented pattern —
 # an architecture call out of scope for a lint-contract ticket, not a
 # mechanical import removal. Per this ticket's own precondition contingency

.kb-doc-gate.yaml

@@ -0,0 +1,38 @@
+# KB doc gate configuration (OMN-16589 built the gate, OMN-17172 rolled it out,
+# OMN-16606 completed this repo's migration and flipped it to strict).
+#
+# strict: any tracked markdown outside the allowed set fails the check, whether
+# or not the pull request touched it. This is the end-state mode for a repo
+# whose Wave-4 migration (epic OMN-16602) has landed — it is what keeps a
+# scrubbed repo scrubbed. omnibase_core's prose documentation now lives in the
+# OmniNode knowledge base; the root README's link carries the signposting role.
+#
+# The allowed set is the default in omniclaude/scripts/kb_doc_gate.py: root
+# README.md, root CLAUDE.md and .claude/**, CHANGELOG*.md, LICENSE*, root
+# SECURITY.md, .github/**, skills|commands|agents/**, and the three tests/**
+# fixture subtrees. This repo adds exactly one glob to it, below, and that
+# glob is machine-read configuration rather than prose.
+mode: strict
+
+# The ONE addition to the default allowed set, and it is not prose.
+#
+# `architecture-handshakes/repos/<repo>.md` are the fleet's per-repo handshake
+# SOURCE contracts, machine-consumed and cryptographically bound:
+# `architecture-handshakes/check-handshake.sh` reads `source_sha256:` out of a
+# repo's installed `.claude/architecture-handshake.md` and compares it to the
+# sha256 of the matching file here, failing the `Check architecture handshake`
+# job (exit 2) when the source is absent. Verified 2026-09-04 on this branch:
+# `.claude/architecture-handshake.md` carries
+# `source_sha256: 3553cfd0922697c12358831f9ad7a2f0c032794772de0c2e88185b547c7fa52a`
+# and `shasum -a 256 architecture-handshakes/repos/omnibase_core.md` returns the
+# same digest. omnibase_core IS the source of truth for these (see the comment
+# in `.github/workflows/check-handshake.yml`), and every downstream repo checks
+# this repo out and runs the same script against these paths.
+#
+# That places them squarely inside ruling (2) of the 2026-09-01 OMN-16602
+# comment -- markdown a program loads as executable configuration stays -- and
+# outside the prose scope of this migration. The human-readable narrative that
+# accompanied them (`architecture-handshakes/README.md`, 301 lines) IS prose and
+# IS deleted by this change; only the machine-read contracts remain.
+allowed:
+  - "architecture-handshakes/repos/*.md"