[jonahgabriel]

Summary

OCC retirement for omnibase_core (OMN-20074). Base dev; merge base 4bb0b7e, head 85fcb3f.

Changes

1. .github/workflows/ci.yml boundary-validation job: the validate-boundaries pin moves from de3398d (omnibase_core#1942) to c1f8e8f (omnibase_core#1972, which dropped the only boundary whose producer lived in onex_change_control), and the repos input drops onex_change_control. The job id, name and required context are unchanged. omniclaude#2757 made the same move.
2. .github/workflows/main-target-guard.yml: the promotion-receipt exception (a PR body line promotion-receipt: OCC-<n> admitted a dev or promotion/* PR onto main) is removed; every PR onto main is refused, and PRs onto other bases are not affected. release.yml moves main by fast-forwarding it to the release tag and opens no PR against main. omnibase_infra's guard already refuses every PR onto main.
3. Dead text: the ruff per-file ignore for the deleted scripts/ci/occ_preflight_wait.py; the dependency-cascade.yml header that named onex_change_control as a cascade target (the live REPOS list does not include it) and its note about the change-control repository's dependencies; the required-check-skip-guard _workflow_model.py docstring example naming the deleted occ-preflight.yml; the .pre-commit-config.yaml comment that said onex_change_control owns the ticket-contract schema.
4. Doc-content scan (src/omnibase_core/validation/doc_content_scan/): the onex_change_control/ path exemption for OMN ticket references is removed; the contracts/ exemption and the local-environment rules stay. No tracked path in omnibase_core sits under onex_change_control/, and of the ten repositories checked (onex_change_control included) only omnibase_core's pre-commit config runs check-doc-content-scan. The handler, model and package docstrings, the .pre-commit-config.yaml comment, the .pre-commit-hooks.yaml description and the validator-requirements.yaml entry follow.
5. contracts/OMN-20074.yaml: adds requirement req-omn20074-core-residual-callers with AC52, AC53 and AC54, two evidence_requirements entries and dod_evidence entries dod-omn-20074-ac52, dod-omn-20074-ac53 and dod-omn-20074-ac54. No existing criterion line changes.

Tests

Written first:

• tests/ci/test_validate_boundaries_caller_omn20962.py — new test that the pin is the fix(OMN-20074): drop the onex_change_control boundary from the kafka manifest #1972 merge; repos assertion without onex_change_control
• tests/ci/test_main_target_guard_prepush_omn20780.py — dev and promotion/* PRs onto main with a promotion-receipt body are refused; the guard step reads no receipt
• tests/unit/validation/doc_content_scan/test_handler_doc_content_scan_compute.py — a ticket reference under an onex_change_control/ path is flagged; the LAN-IP control moves to a contracts/ path

At the merge base 5 tests failed for the first two files and 1 for the doc-content scan; with the change the doc_content_scan tests pass, 68 tests. With the change, 63 passed across those two files and six neighbouring test files; tests/ci/test_ticket_contract_ids_unique_omn20074.py 4 passed; tests/ci/test_contract_validation_in_tree_omn20074.py 9 passed.

Remaining references

git grep -E 'onex_change_control|onex-change-control|occ-preflight' over tracked files: before 166 files / 568 lines; after 162 files / 555 lines. Non-comment lines in .github, .pre-commit-config.yaml and pyproject.toml outside required-checks.yaml: before 3, after 0.

• required-checks.yaml keeps three RETIRED rows (call-reject-skip-token / occ-preflight / eligibility, occ-companion-effect, occ-preflight / eligibility) because the required-context producer gate needs a RETIRED row for each context dropped from branch protection
• the onexbot-occ-writer App and the ONEXBOT_OCC_* secret names stay because renaming a credential is out of this change's scope
• validator_receipt_gate.py and validator_occ_merge_eligibility.py stay because omnibase_infra, omnimarket and omniclaude import them
• topics.py CONTRACT_DRIFT_DETECTED stays because omnibase_infra, omnimarket and omniclaude name it
• scripts/ci/product_reason_graph.py keeps its occ_eligibility input, which no workflow supplies, because omniclaude, omnibase_infra and omnimarket carry their own copies and its EVIDENCE_MISSING root needs one change across all of them
• the rest are comments recording the retirement history, "ported from" provenance notes, past ticket contracts, CHANGELOG entries and retirement tests and fixtures that assert the references are absent

Lab

Lab: host=h200 lane=occ-off-omnibase-core sha=85fcb3ffe0da87ba09dc0b11200baff0bf9f933d command="onex-lab-run --via bus -- uv run pytest <the two changed test files, tests/unit/validation/doc_content_scan and 9 neighbouring tests/ci, tests/scripts and tests/unit/validation files> -q -n 0 --no-cov -p no:randomly" observed 155 passed, exit 0 (work unit lw-e9fab5ec10d14c28). In the lane worktree on h201 the new tests failed at merge base 4bb0b7e (5, and 1 for the doc-content scan) before the change.

Closes OMN-20074