[jonahgabriel]

Summary

• Ticket OMN-20074, OCC retirement, S6 part 2 for omnibase_core: deletes omnibase_core's own OCC callers and stops comparing with OCC.
• S6 part 1 (omnibase_core#1929) merged to dev as 5524cb9; this branch was based on that commit. origin/dev 6017809 (which adds feat(OMN-20074): move boundary-parity and migration-conflicts from onex_change_control into omnibase_core #1942, ci(OMN-20074): contract-validation validates with the in-tree ModelTicketContract, not onex_change_control #1945 and the 0.47.41 release chore: release omnibase_core 0.47.41 (OMN-18595) #1950) was merged into this branch with a merge commit 7d6f3b3 (no rebase, no force push). Head is now 04272eb.
• Deleted workflows: call-occ-autobind.yml, occ-companion-merge-heal.yml, call-receipt-gate.yml (its occ-preflight job and OCC receipt verify job).
• ci.yml: removes the occ-companion-effect job, the OCC companion merged gate job and the Contract Compliance Check job (which read contracts from onex_change_control), plus CI Summary's deferred test_passes step; CI Summary timeout-minutes is 140.
• 37 other workflows: the embedded occ-preflight job, its needs edges, the paired if: always() lines and needs.occ-preflight conditions are removed. contract-validation.yml as changed by ci(OMN-20074): contract-validation validates with the in-tree ModelTicketContract, not onex_change_control #1945 merged cleanly with this removal.
• CI Summary (scripts/ci/ci_summary_gate.py) expects no OCC context; it still expects repo-evidence / dod-verify on pull_request runs (added in part 1).
• call-repo-evidence-gate.yml sets compare-with-occ "false".
• .github/required-checks.yaml: occ-preflight / eligibility, verify / verify, occ-companion-effect / Publish occ-companion-effect command and Contract Compliance Check are RETIRED.
• A second ticket's contract file loses its three contract-compliance criteria because this PR deletes that job and its test; the removal was approved by operator ruling 2026-10-10T11:04:39Z (lane orchestrator-9f8a).

Why this is a draft

• dev branch protection still requires occ-preflight / eligibility, verify / verify and occ-companion-effect / Publish occ-companion-effect command. After this PR merges no workflow produces them, so the PR must land in the same moment as that protection change (step B). No operator consent covers step B yet; the driver is asking the operator. This PR changes no protection.
• The step-B change (BEFORE 37 contexts, AFTER 34, and the replacement for each removed context: CI Summary carrying repo-evidence / dod-verify) was sent to orchestrator-9f8a in ledger MSG 2026-10-11T12:51:48Z-occ-ret-core1930-i5-5d21 (queued in the lane relay outbox).
• The S5 shadow count for omnibase_core is met per the driver (31 counted of 30, S5 shadow-count tracking document section 13); not re-read by this lane, because the knowledge base clone on h201 predates that section.

Kept on purpose

• occ-preflight.yml and receipt-gate.yml stay: they are workflow_call reusables other repositories still call. Deleting them is plan step S9.
• deploy-gate.yml still calls the omniclaude deploy-gate reusable; only its occ-preflight job is removed.
• Workflows that read onex_change_control standards or reusables (version-pin-check in ci.yml, codeql-reusable in security-scan.yml, pr-title-check, validate-boundaries in ci.yml) are not OCC eligibility callers and are unchanged.

Changes

• 71 files changed, 254 insertions, 7475 deletions; the diff excluding contracts/OMN-20074.yaml has the same git patch-id as the pre-merge diff against 5524cb9.
• Merge conflict only in contracts/OMN-20074.yaml: resolved as a union. Dev added AC24, AC25, AC26 (feat(OMN-20074): move boundary-parity and migration-conflicts from onex_change_control into omnibase_core #1942) and AC41, AC42 (ci(OMN-20074): contract-validation validates with the in-tree ModelTicketContract, not onex_change_control #1945); this PR's criterion keeps id AC23 because dev left AC23 unused, so no renumbering. No other criterion was edited by the merge.
• Commit 04272eb: one comment line in .github/workflows/advisory-job-gate.yml quoted the literal advisory-automation declaration marker; the omniclaude advisory_job_gate at pin 52227ebfeb738cde2f671104270a0e01071b9e53 reported it as ORPHANED_DECLARATION (1 finding) at the previous head. The comment no longer contains the marker.
• Earlier commits on this branch: bab40ff (delete the OCC callers), 4cf974d (born-path test), 2d38662 (advisory-automation declarations for three jobs), 2460d99 (pin advisory-job-gate to omniclaude#2659).

Tests and verification

All on lab host h201, at head 04272eb unless stated:

• tests/ci/test_no_occ_callers_omn20074.py, tests/ci/test_s6_part1_cutover_omn20074.py, tests/ci/test_repo_evidence_caller_omn20074.py, tests/unit/scripts/ci/test_ci_summary_gate.py: 115 passed.
• tests/ci -k "omn20074 or omn_20074": 116 passed (116 of 806 collected).
• node_dod_verify (omnimarket 0.4.311, --execution-audience hosted, OMNI_HOME laid out the way receipt-gate.yml lays out the head tree) on contracts/OMN-20074.yaml: verified, 28 of 28 checks verified, exit 0.
• Positive control at the merge base 6017809 with the PR's test side and contract overlaid: failed, 3 of 28 failed (dod-omn-20074-ac3, dod-omn-20074-ac22, dod-omn-20074-ac23); the two evidence items not carried from the merge base (ac3, ac23) are both among them.
• omniclaude advisory_job_gate at 52227ebfeb738cde2f671104270a0e01071b9e53, offline with --required-contexts-json: 0 findings with the 37-context list and with the 34-context list. Positive control with 2d38662's declarations reverted: 3 findings (UNENFORCED_VERIFICATION_JOB in auto-merge.yml twice and propagate-config.yml). Dev 6017809 with the 34-context list: 4 findings, so step B must not be applied before this merges.
• pre-commit passed on the merge commit and on 04272eb; pre-push passed on the push.

Lab: host h201, lane occ-ret-core1930-i5-5d21, head 04272eb; commands: uv run pytest on the four files above (115 passed, exit 0), uv run pytest tests/ci -k "omn20074 or omn_20074" (116 passed, exit 0), python -m omnimarket.nodes.node_dod_verify --ticket-id OMN-20074 --execution-audience hosted (verified 28/28, exit 0; merge-base control failed 3, exit 1), advisory_job_gate (0 findings, exit 0; positive control 3 findings, exit 1).

[jonahgabriel]

Lab: head=1c02afacf14b887913182236c1db11be24d7bc4f host=h201 lane=occ-ret-core-s6-d3-5d21 command="uv run pytest -n 4 -p no:randomly -q tests/ci/test_no_occ_callers_omn20074.py tests/ci/test_repo_evidence_caller_omn20074.py tests/ci/test_s6_part1_cutover_omn20074.py tests/ci/test_workflow_uses_refs_resolve.py tests/unit/scripts/ci/test_ci_summary_gate.py tests/unit/validation/test_auto_merge_workflow_shape.py tests/unit/validation/test_quality_gate_docs_only_short_circuit_omn16625.py tests/validation/test_pull_request_workflow_ratchet.py tests/ci/test_ci_fold_gates_omn20074.py tests/scripts/test_propagate_config.py tests/ci/test_ci_summary_l4_wait_omn20522.py" result="383 passed"

• Rebased onto omnibase_core#1929's new head 3bf033f, which sits on dev de3b6eb (omnibase_core#1934 merged); previous head 096d4b1. Still a draft.
• Conflicts resolved per ci(OMN-20074): fold the thread, handshake policy and propagate dry-run gates into ci.yml #1934's rebase notes: cr-thread-gate-caller.yml deleted; propagate-config.yml keeps dev's removal of dry-run-ci-check; pull-request-workflow-budget.yaml budget 28 with both waiver comment lines; EXPECTED_BUDGET and the budget pin in tests/ci/test_repo_evidence_caller_omn20074.py lowered to 28 (both failed with 28 == 29 before the edit); contracts/OMN-20074.yaml: this PR's criterion is renumbered AC14 with dod-omn-20074-ac14, and its references to AC8 in AC3 and AC13 now read AC14.
• pre-commit run --from-ref 3bf033f --to-ref HEAD: exit 0 after yamlfmt reflowed AC3.
• omniclaude advisory_job_gate at 966d61ce9f0c2eb6e18b317c2453bdfbe9eeb7d0, run offline on this tree: 3 UNENFORCED_VERIFICATION_JOB findings, the same with the live dev required contexts and with the four OCC contexts removed plus repo-evidence / dod-verify: auto-merge.yml pre-check, auto-merge.yml auto-merge, propagate-config.yml propagate. On 096d4b1 there were 6; ci(OMN-20074): fold the thread, handshake policy and propagate dry-run gates into ci.yml #1934 removed cr-thread-gate-caller.yml gate, handshake-policy-gate.yml policy-gate and propagate-config.yml dry-run-ci-check from the list.
• The 3 remaining jobs are automation; ci(OMN-20074): fold the thread, handshake policy and propagate dry-run gates into ci.yml #1934 left them for an operator decision. No annotation or baseline entry is added here, so advisory-job-gate stays red on this PR until that decision.

[jonahgabriel]

Lab: head=04272ebb187b859b27aaf456a1f2c2e934fb486d host=h201 lane=occ-ret-core1930-k1-5d21

• Dev moved since the PR's merge base 6017809 by one merge, 0311482 (feat(OMN-20946): canonical-file-shape reads the allowlist-path a caller passes to omnibase_core's imperative contract guard #1949). It touches pyproject.toml (version 0.47.41 to 0.47.42), uv.lock, one new contract file, src/omnibase_core/validators/canonical_file_shape.py and one test. It touches no .github/workflows file and not contracts/OMN-20074.yaml.
• git merge-tree of the head with origin/dev 0311482 is clean, so the head was not merged or changed; it stays 04272eb.
• Command: uv run pytest tests/ci/test_no_occ_callers_omn20074.py tests/ci/test_s6_part1_cutover_omn20074.py tests/ci/test_repo_evidence_caller_omn20074.py tests/unit/scripts/ci/test_ci_summary_gate.py -n 0 at the head on h201. Result: 115 passed.
• Positive control: origin/dev .github/workflows checked out over the head, then tests/ci/test_no_occ_callers_omn20074.py run again. Result: 5 failed, 2 passed (call-occ-autobind.yml still present, auto-merge.yml pre-check needs occ-preflight, compare-with-occ is true, occ-companion-effect and contract-compliance jobs still in ci.yml). Worktree restored to the head afterwards.
• The earlier proof at this same head by lane occ-ret-core1930-i5-5d21 on h201 stands: node_dod_verify 28/28 verified; merge-base control failed 3 (ac3, ac22, ac23); advisory_job_gate (omniclaude 52227ebfe, offline) 0 findings with the 37 and with the 34 required contexts; its positive control 3 findings.
• The three contexts occ-preflight / eligibility, occ-companion-effect / Publish occ-companion-effect command and verify / verify are produced by no workflow on this head, so they never report here; the merge waits on their removal from dev protection under operator consent ledger row 66460 item 7, applied by another lane right before the merge.

[jonahgabriel]

Lab: head=494ae04f307e74b06fe30be8799c876539502917

Resolved two conflicts on host h200 (lane surge-core-1930-7-8e80) for the merge of origin/dev 6c9ec59 into the branch. The old head was 04272eb; the new head is 494ae04, pushed as a normal fast-forward push, not forced.

• Conflict in .github/workflows/call-repo-evidence-gate.yml: comment-only; both sides set compare-with-occ: "false". The resolved comment keeps the # S5 shadow count heading and dev's PR-workflow budget paragraph, because tests/ci/test_s6_caller_occ_disabled_omn20969.py (from dev) requires every caller line outside the # S5 shadow count block to match its pinned text. The S6 part 2 facts (no OCC caller remains, comparison off on dev first, call-receipt-gate.yml deleted, budget lowered) are stated inside that block.

• Conflict in tests/ci/test_s6_part1_cutover_omn20074.py: both sides renamed the same test; kept one function, test_evidence_caller_stops_comparing_with_occ_after_part_2, with a comment naming both changes. Assertions unchanged.

• uv run pytest tests/ci/test_s6_part1_cutover_omn20074.py tests/ci/test_repo_evidence_caller_omn20074.py tests/ci/test_s6_caller_occ_disabled_omn20969.py tests/ci/test_no_occ_callers_omn20074.py -q -n 0 -p no:randomly => 24 passed

• Positive control: compare-with-occ flipped to "true" in the caller => 5 failed, 19 passed; reverted

• actionlint -shellcheck= -pyflakes= on call-repo-evidence-gate.yml, ci.yml, security-scan.yml => exit 0, no findings

• node_dod_verify (omnimarket) on contracts/OMN-20074.yaml at 494ae04, --dry-run --execution-audience local_done_gate => status verified, 30 of 30 items verified (including AC3, AC22, AC23)

• pre-commit run --files on the two resolved files => all hooks passed; commit and push hooks passed

• git grep "uses: OmniNode-ai/onex_change_control" in .github/workflows => one match, pr-title-check.yml (owned by another lane)

[jonahgabriel]

landing-controller (OMN-20768): worker lease L6467 pushed head 9929d62 (dispatched on 494ae04), and its own change touches what judges this pull request: tests/ci/test_pr_title_check_omnimarket_node.py (check_test). The controller does not land a head whose checks were changed by the worker sent to make them pass, so omnibase_core#1930 is held with the hold:needs-review label and gets no further fix worker. A person reviews the change: when the check itself was wrong, its fix belongs in a separate pull request whose title says it fixes that check, and the worker's edit is reverted here; when the edit is right, remove the label and the controller lands the head on its next tick.