[jonahgabriel]

Summary

OMN-20074: per the operator ruling of 2026-10-14T18:17:14Z, onex_change_control is retired completely. receipt-gate.yml, the shared reusable workflow, now runs caller evidence only. Its inputs are exactly evidence-source (default caller), verifier-version, compare-with-occ and shadow; dod-verify fails unless evidence-source is caller and compare-with-occ is false.

In contracts/OMN-20074.yaml, the AC1 and AC2 statements are rewritten to the new behaviour, and the new requirement req-omn20074-s11-occ-mode-removed adds AC47, bound to tests/ci/test_receipt_gate_occ_mode_removed_omn20074.py. AC47's requirement records that it supersedes AC45's clause that receipt-gate.yml, occ_preflight_wait.py and check_occ_companion_merged.py are still present. The contract edits sit outside the regions omnibase_core#1971 changes; a three-way merge of the file with #1971's version reported 0 conflicts. This PR does not touch any file of omnibase_core#1971 except contracts/OMN-20074.yaml, and none of #1972's files.

What is removed

• Inputs removed from receipt-gate.yml: occ-context, occ-wait-seconds, contracts-dir, receipts-dir, branch-policy-mode, core-ref.
• All change-control-mode steps of the verify job are deleted; the workflow goes from 2525 lines to 1349. The verify job keeps its name and now runs one step that prints one notice and exits 0, so a caller whose branch protection names <job> / verify still gets a concluded context.
• dod-verify: the omnibase_core checkout for the probe is deleted; the writer-app login is no longer probed and goes straight to the existing writer_pin_only step, which derives its verdict from the head's diff against the merge base. The missing-contract path no longer probes other repositories. The comparison step against the change-control eligibility context is deleted, and the shadow verdict line no longer carries an occ_difference field.
• Deleted files: .github/workflows/occ-preflight.yml, scripts/ci/occ_preflight_wait.py, scripts/ci/check_occ_companion_merged.py, the 12 test files that only tested them, and 3 test files that only tested the deleted verify-job steps.
• Two contract files are deleted; both bound only tests of check_occ_companion_merged.py, which is deleted.
• resolve_evidence_root is removed from omnibase_core.utils.util_omni_home_paths and from omnibase_core.utils.__all__; it returned $OMNI_HOME/onex_change_control/evidence.
• CLI defaults no longer name onex_change_control: validator_receipt_gate_cli --contracts-dir defaults to contracts and --receipts-dir to drift/dod_receipts; validator_receipt_reprobe and validator_receipt_honesty --receipts-dir defaults to drift/dod_receipts.
• The boundary analyzer's REGISTRY_PACKAGES no longer lists onex_change_control; its private-API fixtures now import omnimemory instead.
• environment_reader_inventory no longer lists scripts/ci/check_occ_companion_merged.py.

Follow-up in omniclaude, not in this PR: plugins/onex/skills/_lib/dod-evidence-runner/dod_evidence_runner.py imports resolve_evidence_root inside try/except ImportError; on a core release carrying this PR the import falls back to None and receipts land at <working_dir>/.evidence/<ticket>. The pre_tool_use_dod_completion_guard.sh reader in omniclaude still reads the old evidence root and needs the same move.

What stays and why

• validator_occ_merge_eligibility.py, validator_evidence_commit_binding.py and its CLI (default repo OmniNode-ai/onex_change_control), and validator_receipt_gate.py and its CLI stay; no workflow in this repo invokes them any more.
• The pyproject.toml ruff per-file-ignores for the two deleted scripts stay (pyproject.toml is a file of ci(OMN-20074): drop the remaining onex_change_control references nothing needs (S10) #1971).
• The ai_slop ci_scope.json fixture entries for the deleted files stay, left so files_scanned in ci_golden.json does not collide with ci(OMN-20074): drop the remaining onex_change_control references nothing needs (S10) #1971.
• Docstring mentions of onex_change_control as the origin of ported code stay.

Release order (omninode_infra)

omnibase_core must not release to main before omninode_infra's call-receipt-gate is handled. omninode_infra's .github/workflows/call-receipt-gate.yml calls OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml@main with branch-policy-mode and the default evidence-source. Once an omnibase_core main release carries this PR, that call fails: branch-policy-mode is no longer an input and the change-control mode is gone. omninode_infra's call-receipt-gate must be removed or repinned first, by lane omn20074-ninf; its carrier today is omninode_infra#1894 (draft). Do not cut an omnibase_core main release carrying this PR until that lands.

Every other caller — omnibase_compat, omnibase_infra, omnibase_spi, omniclaude, omnidash, omniintelligence, omnimarket, omnimemory, omninode_infra's call-repo-evidence-gate.yml and omnibase_core itself — pins receipt-gate.yml by full SHA and passes only evidence-source: caller, verifier-version, compare-with-occ: "false" and shadow, which stay valid.

Tests

TDD: tests/ci/test_receipt_gate_occ_mode_removed_omn20074.py — 12 failed at the base before the change, 12 passed after.

Focused runs on lab host h202: 28 affected test files, each run separately on the pre-rebase commit 1e9d27ede5, all passed; after the rebase onto dev c1f8e8f, 4 of them (the new structural test, the repo-evidence caller test, the boundary-parity handler test and the contract-home test) were re-run at head 7bb3ffa and passed. Test files: 1 added, 13 modified, 15 deleted; the rewrites of 10 of the modified files came from a Codex draft that the lane reviewed and re-ran.

Lab

Lab: host=h202 lane=omn20074-core4 — command uv run pytest <file> -q -p no:randomly -n0 per affected file, observed 28 of 28 files passed on 1e9d27ede5 and 4 of 4 re-run files passed at 7bb3ffa.

The broader run onex_lab_run.py --via bus --lane omn20074-core4 --repo omnibase_core --ref omn20074-core4-remove-occ-mode -- uv run pytest tests/ci tests/unit/validation tests/unit/utils tests/unit/nodes/node_boundary_import_check_compute tests/unit/scripts/ci tests/unit/validators exited 75 (placement refused over_capacity: h200 all unit slots busy, h201 load/core 0.99, h202 load/core 0.89) and was not run anywhere; hosted CI runs the full suite. This change is a CI workflow and validator-default change with no runtime surface, so there is no runtime slot to exercise.