[jonahgabriel]

OMN-20074. Applies RULING 2026-10-10T11:04:20Z lane=orchestrator-9f8a (R5, "Yes to all recs"): a verification job whose only enforcing context was the embedded occ-preflight runs in ci.yml, where the required CI Summary poller fails on it. No new required context, annotation, allowlist or baseline entry is added. omnibase_core#1930 rebases onto this branch: with its head 096d4b1 the omniclaude advisory_job_gate (pinned at 966d61ce9f0c2eb6e18b317c2453bdfbe9eeb7d0, live dev required contexts) reports 6 UNENFORCED_VERIFICATION_JOB findings; with this branch merged under it, 3 remain, all automation.

Classification

• cr-thread-gate-caller.yml gate: Verification gate by shape. The reusable cr-thread-gate.yml is a no-op that exits 0 while CodeRabbit is retired, so it decides nothing today. Folded as is; a deletion belongs to the CodeRabbit removal the reusable's header names.
• handshake-policy-gate.yml policy-gate: Verification gate. Its only pull-request-reachable trigger was merge_group (it also runs weekly and on dispatch). It was not a required context, and its header called a required-context flip a separate staged decision. Folding makes it blocking in the merge queue.
• propagate-config.yml dry-run-ci-check: Verification check of the propagator script and targets file, filtered on five paths.
• auto-merge.yml pre-check and auto-merge, propagate-config.yml propagate: Automation (act, decide nothing).

What changed

• ci.yml gains job gate (uses ./.github/workflows/cr-thread-gate.yml, unconditional, no needs, composed context gate / CodeRabbit Thread Check unchanged).
• ci.yml gains job handshake-policy-gate (uses ./.github/workflows/handshake-policy-gate.yml, if: github.event_name == 'merge_group', permissions contents read and actions read, secrets inherit).
• ci.yml gains job propagate-dry-run named Propagate Config Dry-run (OMN-20074) (same steps and read-only token scope as the old job; the five-path filter of propagate-config.yml is matched in-run: pull_request and push compare against their base, workflow_dispatch always runs, merge_group and schedule skip, no computable diff runs the check).
• cr-thread-gate-caller.yml is deleted.
• handshake-policy-gate.yml drops merge_group and its embedded preflight and gains workflow_call (schedule and dispatch stay).
• propagate-config.yml drops dry-run-ci-check.
• scripts/ci/ci_summary_gate.py adds gate / CodeRabbit Thread Check and Propagate Config Dry-run (OMN-20074) to GATE_JOBS and STRICT_SUCCESS_JOBS; the merge_group-only caller is not anchored because it is skipped on every pull_request run, and a failure of it still fails CI Summary through the default-deny sweep.
• .github/required-checks.yaml row for gate / CodeRabbit Thread Check now names ci.yml.
• architecture-handshakes/pull-request-workflow-budget.yaml budget 30 to 29, with EXPECTED_BUDGET in tests/validation/test_pull_request_workflow_ratchet.py and the pin in tests/ci/test_repo_evidence_caller_omn20074.py lowered to 29.
• contracts/OMN-20074.yaml gains AC9, AC10, AC11, AC12.

Not changed

• auto-merge.yml pre-check and auto-merge.
• propagate-config.yml propagate.
• advisory_job_gate already has a way to classify automation: the # advisory-ok: OMN-nnnnn <reason> annotation and the per-repository census baseline in omniclaude. Neither is used here; whether automation should be annotated is an open operator question.

Rebase notes for #1930

The merge was resolved in a scratch tree:

• cr-thread-gate-caller.yml modify/delete conflict, resolve by deleting.
• propagate-config.yml conflict, resolve by taking the deletion of dry-run-ci-check.
• pull-request-workflow-budget.yaml budget 28 (both PRs lower it from 30), keep both waiver comment blocks.
• EXPECTED_BUDGET 28 and the pin in tests/ci/test_repo_evidence_caller_omn20074.py 28.
• contracts/OMN-20074.yaml keep AC7, AC8 then AC9 to AC12 in each of the three lists.

Tests

• New tests/ci/test_ci_fold_gates_omn20074.py (29 tests), written first: before the change 23 of its 29 tests failed (6 passed as controls), and the two edited existing tests (tests/scripts/test_propagate_config.py, tests/validation/test_pull_request_workflow_ratchet.py) failed too.
• It executes the in-run path-detection step against temporary git repositories for each of the five paths, for an unrelated path, for every event, and for a diff that cannot be computed.
• Positive controls: a failing folded job makes CI Summary's evaluate return failure for all three, a skipped anchored job returns failure, an absent anchored job returns pending.
• Not yet exercised on GitHub Actions: the anchored names gate / CodeRabbit Thread Check and Propagate Config Dry-run (OMN-20074) are derived from the reusable's job name and the job's name:, and a test pins them to those files.

Lab: host h201 (lane occ-ret-core-fold-c6-5d21), branch head eb5d91a.

• advisory_job_gate (omniclaude 966d61ce9f0c2eb6e18b317c2453bdfbe9eeb7d0, live dev required contexts) on ci(OMN-20074): omnibase_core S6 part 2, delete the OCC callers and stop comparing with OCC #1930 head 096d4b1 alone: exit 1, 6 findings.
• The same gate on ci(OMN-20074): omnibase_core S6 part 2, delete the OCC callers and stop comparing with OCC #1930 merged with this branch (scratch merge commit 6d9384c8ba, never pushed), with the live required contexts and again with occ-preflight / eligibility removed: exit 1 both times, 3 findings, named auto-merge.yml pre-check, auto-merge.yml auto-merge, propagate-config.yml propagate. On this branch alone the gate exits 0.
• 16 focused test files on the merged tree: 400 passed.
• tests/ci, tests/unit/scripts/ci, tests/unit/validation, tests/validation, tests/scripts and tests/unit/scripts/test_policy_gate_app_token.py through onex_lab_run.py on host h200 at eb5d91a: 8071 passed, 9 skipped, 30 failed, exit 1. All 30 failures are in tests/ci/test_receipt_gate_caller_evidence_omn20070.py and tests/ci/test_receipt_gate_merged_fix_control_omn17427.py; those two files pass (62 passed) on h201 at the same head. The cause on h200 was not investigated.

Evidence-Ticket: OMN-20074
Evidence-Source: OCC#13547