fix(OMN-12449): hot-load market nodes — shared trusted-namespace constant + resolve handler from handler_routing

[jonahgabriel]

OMN-12449 — Hot-load market nodes via contract on the bus

Fixes the two omnibase_infra runtime defects that blocked omnimarket nodes from hot-loading via contract on the event bus. The hot-load path itself is already implemented: producer node_contract_registry (omnimarket) → onex.evt.platform.node-registration.v1 → runtime _subscribe_node_registration → _materialize_handler_live → _wire_live_handler_subscriptions → event_bus.subscribe(). These two defects sat on that path.

Fix 1 — namespace allowlist uses the shared trusted-namespace constant

src/omnibase_infra/runtime/runtime_host_process.py (Step 4 of _materialize_handler_live, ~line 3401)

Before: allowed_namespaces = ("omnibase_infra.", "omnibase_core.") — every omnimarket. handler was rejected at the live-materializer namespace gate.

After: allowed_namespaces = TRUSTED_HANDLER_NAMESPACE_PREFIXES (imported from omnibase_infra/runtime/constants_security.py).

Security-boundary note (preempting the constants_security review comment): this is NOT a weakening of the security boundary. TRUSTED_HANDLER_NAMESPACE_PREFIXES already contains "omnimarket." (added under OMN-10500) and is the same already-approved policy the caching gate (kafka_contract_source.py) enforces. This change aligns the live materializer with that policy so the two gates agree, instead of the materializer carrying a narrower hardcoded tuple.

Fix 2 — descriptor parser resolves handler from handler_routing

src/omnibase_infra/runtime/kafka_contract_source.py (ContractYamlParser.parse, ~line 287; new helper _resolve_handler_class_from_routing, ~line 142)

Before: only metadata.handler_class was read. Market (node-shaped) contracts do not declare that key — they declare the handler module under top-level handler.module and/or handler_routing.handlers[].handler.module.

After: when metadata.handler_class is absent, fall back to _resolve_handler_class_from_routing, which joins module + class name into the fully qualified module.ClassName path the materializer imports. Routing form (handlers[0].handler.{module,name}) is preferred over the top-level form (handler.{module,class}); the debug log fires only when truly unresolvable. No ModelHandlerContract schema change and no market-contract edits.

Producer-confirmation finding (read-only)

node_contract_registry's handler (handler_contract_registry.py) publishes the full raw contract_yaml verbatim ("contract_yaml": request.contract_yaml) — it does not strip handler or handler_routing. The runtime consumer reads payload["contract_yaml"] and feeds it straight into ContractYamlParser.parse. So the handler_routing / handler keys the parser now reads are present in the registration payload. No producer change needed for these two fixes.

Adjacent gap flagged for follow-up (not in scope here): the current raw market contract.yaml files (e.g. node_aislop_sweep) are missing the handler_id, input_model, and output_model fields that core ModelHandlerContract requires, so parse() raises ValidationError before reaching handler_class resolution for those contracts as-authored. The two fixes above are still correct and required (they are necessary, and sufficient once the registration payload is handler-contract-shaped). This is tracked separately in OMN-12463, which reconciles the market node-contract shape with the handler-contract schema the runtime parser validates against.

dod_evidence

Tests added (fail before / pass after — verified by reverting each fix):

• tests/unit/runtime/test_kafka_contract_source.py::TestMarketNodeHandlerResolution (4 tests): resolves from handler_routing, resolves from top-level handler, routing-form-preferred-over-top-level, and unresolvable → None. The two resolution tests fail with the fallback disabled.
• tests/unit/runtime/test_live_contract_materialization.py::TestMaterializeHandlerLive::test_materialize_accepts_omnimarket_namespace: an omnimarket. handler module clears the namespace gate and materializes; asserts "omnimarket." in TRUSTED_HANDLER_NAMESPACE_PREFIXES. Fails when Fix 1 is reverted to the hardcoded tuple.

Verification run locally:

• uv run ruff format + ruff check --fix — clean.
• uv run mypy src/omnibase_infra/runtime/kafka_contract_source.py src/omnibase_infra/runtime/runtime_host_process.py — Success, no issues.
• Focused: tests/unit/runtime/ kafka_contract_source / materialization / live materialization / handler_contract_source / runtime_host_process / node-registration files — all green (226 + 103 passed).
• Full suite: uv run pytest tests/ -n auto — 6338 passed, 202 skipped. The 5 failures + 3 errors are all tests/integration/ and tests/performance/ requiring live Kafka/Postgres/Consul/runtime-container infra (unavailable in this env); each is unrelated to the changed modules and reproduces identically on the branch without these changes (verified for the MCP topic-drift case via git stash).
• pre-commit run --files <changed> — all hooks passed.

How to prove live materialization (runtime, with infra up): publish a market node registration to onex.evt.platform.node-registration.v1 with the full node contract.yaml as contract_yaml; the runtime materializer now (a) resolves handler_class from handler_routing/handler and (b) accepts the omnimarket. namespace, then wires the subscription via event_bus.subscribe() without a restart.

Closes OMN-12449.

Summary by CodeRabbit

• New Features

  • Added Linear project-tracker integration for issue/team/status management.
  • Introduced machine-class overlays (mac-dev, linux-server, cloud-k8s) for environment-specific configuration.
  • Added workspace staging and provenance tracking for Docker builds.

• Database Changes

  • New migrations: swarm_runs projection table, log_entries table for event logging.

• Breaking Changes

  • LLM adapter endpoints (LLM_CODER_URL, LLM_QWEN_72B_URL) are now required; localhost fallbacks removed.
  • Health endpoint /health returns HTTP 503 (degraded) during runtime startup instead of 200.

• Dependencies

  • Updated omnibase-core to 0.42.0+, omnibase-spi to 0.22.0+.

---

Evidence-Source: cb2076698e60ed162162a0c0bf9bdc27ed66df2a
Evidence-Ticket: OMN-12449

Paired OCC PR: OmniNode-ai/onex_change_control#1907 (contracts/OMN-12449.yaml + drift/dod_receipts/OMN-12449/). The Receipt-Gate resolves Evidence-Source against this OCC commit; the OCC PR need not be merged for this gate to pass.

[coderabbitai]

Warning

Review limit reached

@jonahgabriel, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 41 minutes and 38 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: da55d0dc-cc7b-4581-8b8f-c4220c47a3cf

📥 Commits

Reviewing files that changed from the base of the PR and between 24d4ebf and 2d11349.

📒 Files selected for processing (3)

• src/omnibase_infra/runtime/runtime_host_process.py
• tests/ci/test_ci_workflow_resilience.py
• tests/unit/runtime/test_live_contract_materialization.py

📝 Walkthrough

Walkthrough

This PR adds CI and config guardrails, workspace build provenance and Infisical machine-class support, runtime dispatch and health behavior changes, new migrations and contracts, multiple dataclass-to-Pydantic model conversions, registry and import path alignments, and broad test updates.

Changes

Runtime, build, and configuration updates

Layer / File(s)	Summary
CI, release, and machine-class config .github/workflows/main-target-guard.yml, config/overlays/*, config/infisical_projects.yaml, scripts/seed-infisical.py, scripts/deploy-agent/..., docker/Dockerfile.runtime, .gitignore	Adds PR target enforcement, machine-class overlay registries and seeding flow, workspace staging and provenance generation for image builds, and workspace root handling.
Runtime dispatch and wiring behavior src/omnibase_infra/runtime/..., src/omnibase_infra/event_bus/..., src/omnibase_infra/protocols/..., src/omnibase_infra/topics/...	Changes dispatch callback selection, projection routing and DB injection, duplicate contract discovery, delegation dispatch ports, runtime ingress route models, event-type derivation, concurrent Kafka consumer startup, and delegate-skill output wiring.
Health, environment, and contract behavior src/omnibase_infra/services/health_checker.py, src/omnibase_infra/nodes/node_llm_completion_effect/*, src/omnibase_infra/adapters/llm/*, docker/docker-compose.infra.yml, contracts/*	Removes localhost fallback for several LLM endpoints, changes /health degraded startup responses to HTTP 503 until runtime is attached and running, and records those behaviors in contracts and compose comments.
Model and schema boundary updates src/omnibase_infra/.../models/*, src/omnibase_infra/services/eval/*, src/omnibase_infra/services/session_registry/*, src/omnibase_infra/cli/*, src/omnibase_infra/topics/model_topic_spec.py	Converts multiple boundary models from dataclasses to Pydantic models, updates related typing and exports, and adjusts validation exemptions and protocol locks to match the new interfaces.
Migrations, catalog validation, and supporting updates docker/migrations/*, scripts/run-migrations.py, src/omnibase_infra/docker/catalog/cli.py, docker/catalog/services/consumer-health-projection.yaml, pyproject.toml, src/omnibase_infra/services/registry_api/*, tests/**	Adds new SQL migrations and rollback, enables per-database migration targeting via \connect, adds catalog runtime validation, updates dependency/version pins, aligns registry imports and module references, and expands tests for the new behavior.

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related PRs

• OmniNode-ai/omnibase_infra#1745: Both PRs change ProtocolDispatchResultApplier.apply and DispatchResultApplier.apply to accept ModelDispatchResult | None and short-circuit terminal output handling.
• OmniNode-ai/omnibase_infra#1732: Both PRs modify src/omnibase_infra/runtime/auto_wiring/discovery.py to surface duplicate contract names across entry-point packages.
• OmniNode-ai/omnibase_infra#1757: Both PRs include the OMN-12184 dataclass-to-Pydantic migration path across runtime and boundary models.

Poem

🐇 I thumped through configs in neat little rows,
and stitched new routes where the runtime now goes.
I packed build proofs in a burrow so tight,
made healthchecks grumble with truthful 503 bite.
With Pydantic carrots and tests all in line,
this patchwork meadow now hums just fine.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-12449-hotload-market-nodes

[coderabbitai]

Actionable comments posted: 20

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (8)

src/omnibase_infra/nodes/node_llm_completion_effect/handlers/handler_llm_completion.py (1)

127-143: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Wrap environment variable access with proper error context.

Line 143 will raise KeyError if LLM_CODER_URL is not set. Since _resolve_endpoint is called during request handling (not init-time), this should follow the error-handling guidelines and use ModelInfraErrorContext.with_correlation(). As per coding guidelines: "Error handling must use ModelInfraErrorContext.with_correlation() when raising infrastructure errors, passing correlation_id, transport_type, and operation."

🛡️ Proposed fix to add error context

+from omnibase_infra.enums import EnumInfraTransportType
+from omnibase_infra.errors import ModelInfraErrorContext, ProtocolConfigurationError
+
 class HandlerLLMCompletion:
     ...
     def _resolve_endpoint(self, request: ModelLLMCompletionRequest) -> str:
         """Pick the LLM endpoint URL based on request or env configuration."""
         if request.endpoint_url:
             return request.endpoint_url.rstrip("/")
 
         # Estimate token count from message character length (rough: 4 chars/token)
         char_count = sum(len(m.content) for m in request.messages)
         estimated_tokens = char_count // 4
 
         if estimated_tokens <= _FAST_MODEL_TOKEN_THRESHOLD:
             url = os.environ.get(  # ONEX_EXCLUDE: archive port
                 "LLM_CODER_FAST_URL", ""
             )
             if url:
                 return url.rstrip("/")
 
-        return os.environ["LLM_CODER_URL"].rstrip("/")  # ONEX_EXCLUDE: archive port
+        try:
+            return os.environ["LLM_CODER_URL"].rstrip("/")  # ONEX_EXCLUDE: archive port
+        except KeyError as exc:
+            context = ModelInfraErrorContext.with_correlation(
+                correlation_id=request.correlation_id,
+                transport_type=EnumInfraTransportType.HTTP,
+                operation="resolve_endpoint",
+            )
+            raise ProtocolConfigurationError(
+                "LLM_CODER_URL environment variable is required for full model routing. "
+                "Set LLM_CODER_URL or provide endpoint_url in the request.",
+                context=context,
+            ) from exc

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/omnibase_infra/nodes/node_llm_completion_effect/handlers/handler_llm_completion.py`
around lines 127 - 143, The _resolve_endpoint function currently accesses
os.environ["LLM_CODER_URL"] directly which will raise a bare KeyError; change it
to check for the environment value and if missing raise a proper infrastructure
error using
ModelInfraErrorContext.with_correlation(correlation_id=request.correlation_id,
transport_type=..., operation="resolve_endpoint") (fill in the appropriate
transport_type constant) and include a descriptive message about missing
LLM_CODER_URL; also ensure any returned URL is rstripped("/") as before and keep
the fast-url branch unchanged.

src/omnibase_infra/adapters/llm/adapter_llm_provider_openai.py (1)

170-171: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update class docstring to reflect the required environment variable.

Lines 170-171 state "Falls back to the LLM_CODER_URL environment variable (default: http://localhost:8000)", but Line 217 now requires LLM_CODER_URL without a fallback.

📝 Proposed docstring fix

-    Falls back to the ``LLM_CODER_URL`` environment variable (default:
-    ``http://localhost:8000``) if ``base_url`` is not provided at construction.
+    Requires the ``LLM_CODER_URL`` environment variable when ``base_url`` is
+    not provided at construction.
 
     Attributes:

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_llm_provider_openai.py` around lines
170 - 171, Update the class docstring in adapter_llm_provider_openai.py to
accurately state that the adapter requires the LLM_CODER_URL environment
variable (no longer falling back to http://localhost:8000) when base_url is not
provided; specifically mention the constructor parameter base_url and that
LLM_CODER_URL must be set and will be used if base_url is omitted, removing any
text that implies a default fallback URL.

src/omnibase_infra/adapters/llm/adapter_documentation_generation.py (1)

204-249: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update docstring to match the new required environment variable behavior.

The docstring (lines 207-209) states that base_url "Defaults to the LLM_DEEPSEEK_R1_URL environment variable, falling back to http://localhost:8001", but Line 249 now requires LLM_DEEPSEEK_R1_URL (raising KeyError if unset).

📝 Proposed docstring fix

         Args:
             base_url: Base URL of the DeepSeek-R1 endpoint.  Defaults to the
-                ``LLM_DEEPSEEK_R1_URL`` environment variable, falling back to
-                ``http://localhost:8001``.
+                required ``LLM_DEEPSEEK_R1_URL`` environment variable.
             model: Model identifier string sent in inference requests.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_documentation_generation.py` around
lines 204 - 249, Update the __init__ docstring for the adapter to reflect that
base_url no longer falls back to "http://localhost:8001" and instead requires
the LLM_DEEPSEEK_R1_URL environment variable when base_url is None (absence will
cause a KeyError); mention that passing an empty string raises
ProtocolConfigurationError and that base_url resolves from the
LLM_DEEPSEEK_R1_URL env var into self._base_url when not provided.

src/omnibase_infra/adapters/llm/adapter_summarization_enrichment.py (1)

163-195: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update docstring to match the new required environment variable behavior.

The docstring (lines 166-168) states that base_url "Defaults to the LLM_QWEN_72B_URL environment variable, falling back to http://localhost:8100", but Line 195 now requires LLM_QWEN_72B_URL (raising KeyError if unset).

📝 Proposed docstring fix

         Args:
             base_url: Base URL of the Qwen-72B endpoint.  Defaults to the
-                ``LLM_QWEN_72B_URL`` environment variable, falling back to
-                ``http://localhost:8100``.
+                required ``LLM_QWEN_72B_URL`` environment variable.
             model: Model identifier string sent in inference requests.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_summarization_enrichment.py` around
lines 163 - 195, Update the __init__ docstring for
adapter_summarization_enrichment to reflect the new behavior of base_url: it now
defaults to the LLM_QWEN_72B_URL environment variable and will raise if that env
var is not set (no fallback to "http://localhost:8100"). Modify the text that
currently says "falling back to `http://localhost:8100`" to state that the env
var is required, and mention that self._base_url is populated from
os.environ["LLM_QWEN_72B_URL"] when base_url is not provided.

src/omnibase_infra/adapters/llm/adapter_code_review_analysis.py (1)

213-258: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update docstring to match the new required environment variable behavior.

The docstring (lines 216-218) states that base_url "Defaults to the LLM_CODER_FAST_URL environment variable, falling back to http://localhost:8001", but Line 258 now requires LLM_CODER_FAST_URL (raising KeyError if unset).

📝 Proposed docstring fix

         Args:
             base_url: Base URL of the Coder-14B endpoint.  Defaults to the
-                ``LLM_CODER_FAST_URL`` environment variable, falling back to
-                ``http://localhost:8001``.
+                required ``LLM_CODER_FAST_URL`` environment variable.
             model: Model identifier string sent in inference requests.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_code_review_analysis.py` around lines
213 - 258, The docstring for the adapter initializer is out of sync: it claims
base_url "Defaults to the LLM_CODER_FAST_URL environment variable, falling back
to http://localhost:8001" but the code now uses resolved_base_url = base_url or
os.environ["LLM_CODER_FAST_URL"] (no fallback), which will raise if the env var
is missing; update the initializer docstring (the description for the base_url
parameter) to state that base_url defaults to the LLM_CODER_FAST_URL environment
variable and that this environment variable is required (no localhost fallback),
and mention that omitting both will raise a KeyError or that callers must set
LLM_CODER_FAST_URL or pass base_url.

src/omnibase_infra/adapters/llm/adapter_code_analysis_enrichment.py (1)

148-159: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update docstring to match the new required environment variable behavior.

The docstring (lines 151-153) states that base_url "Defaults to the LLM_CODER_URL environment variable, falling back to http://localhost:8000", but Line 159 now requires LLM_CODER_URL (using os.environ["LLM_CODER_URL"] which raises KeyError if unset) with no fallback.

📝 Proposed docstring fix

         Args:
             base_url: Base URL of the Coder-14B endpoint.  Defaults to the
-                ``LLM_CODER_URL`` environment variable, falling back to
-                ``http://localhost:8000``.
+                required ``LLM_CODER_URL`` environment variable.
             model: Model identifier string sent in inference requests.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_code_analysis_enrichment.py` around
lines 148 - 159, The docstring for the adapter __init__ misleadingly claims
base_url falls back to "http://localhost:8000" but the implementation
(assignment to self._base_url using os.environ["LLM_CODER_URL"]) requires
LLM_CODER_URL to be set and will raise if absent; update the parameter docs for
base_url in the __init__ docstring to state that base_url defaults to the
required LLM_CODER_URL environment variable and that the environment variable is
mandatory (or explicitly document that a KeyError will be raised if it is
unset), referencing the base_url parameter and the self._base_url assignment so
readers know the behavior.

src/omnibase_infra/adapters/llm/adapter_test_boilerplate_generation.py (1)

225-227: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update docstring to match implementation.

The docstring states the adapter "falls back to http://localhost:8001" when LLM_CODER_FAST_URL is unset, but line 267 now uses os.environ["LLM_CODER_FAST_URL"] which raises KeyError when the variable is missing.

📝 Proposed fix for docstring

         Args:
             base_url: Base URL of the Coder-14B endpoint.  Defaults to the
-                ``LLM_CODER_FAST_URL`` environment variable, falling back to
-                ``http://localhost:8001``.
+                ``LLM_CODER_FAST_URL`` environment variable (required if
+                ``base_url`` is not provided).
             model: Model identifier string sent in inference requests.

Also applies to: 267-267

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_test_boilerplate_generation.py`
around lines 225 - 227, Docstring claims the adapter falls back to
"http://localhost:8001" but the code uses os.environ["LLM_CODER_FAST_URL"] which
raises KeyError if unset; change the environment lookup to use a safe fallback
(e.g. replace os.environ["LLM_CODER_FAST_URL"] with
os.environ.get("LLM_CODER_FAST_URL", "http://localhost:8001")) so the
implementation matches the docstring (referencing the LLM_CODER_FAST_URL lookup
in the adapter/boilerplate generation code).

src/omnibase_infra/nodes/node_rsd_score_compute/handlers/handler_rsd_score_calculate.py (1)

12-12: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove unused import timezone.

The timezone symbol is imported but never used after the UTC normalization refactor (lines 297-304 now use only UTC and datetime).

🧹 Proposed fix

-from datetime import UTC, datetime, timezone
+from datetime import UTC, datetime

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/omnibase_infra/nodes/node_rsd_score_compute/handlers/handler_rsd_score_calculate.py`
at line 12, Remove the unused `timezone` import from the top of
handler_rsd_score_calculate.py: update the import line that currently reads
"from datetime import UTC, datetime, timezone" to only import the symbols
actually used (keep `UTC` and `datetime`); ensure no other references to
`timezone` exist in functions like the RSD normalization block (e.g., code
around lines using `UTC` and `datetime`) before committing.

🧹 Nitpick comments (8)

src/omnibase_infra/runtime/service_dispatch_result_applier.py (1)

299-329: ⚡ Quick win

Tighten ONEX topic parsing to the documented 5-segment shape
The ONEX topics defined in this repo follow onex.{evt|cmd}.{producer}.{event-name}.v{n} with exactly 5 dot-separated segments, so the current extraction of parts[2]/parts[3] matches the observed convention and won’t misparse today’s topics. For defensiveness and clarity, change the guard from len(parts) >= 5 to len(parts) == 5 (otherwise return None).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/runtime/service_dispatch_result_applier.py` around lines
299 - 329, The ONEX topic parser in _derive_event_type_from_topic currently
allows any topic with 5 or more segments; tighten the validation by requiring
exactly 5 dot-separated segments to match the documented shape
(onex.{kind}.{producer}.{event-name}.v{n}). Update the guard from len(parts) >=
5 to len(parts) == 5 inside the _derive_event_type_from_topic static method so
only strictly 5-segment topics return f"{producer}.{event_name}" (otherwise
return None).

tests/unit/models/runtime/test_model_plugin_discovery_report.py (1)

555-556: 💤 Low value

Consider updating docstrings that reference "dataclass" to "Pydantic model".

The docstrings at lines 555, 572, and 598 still reference "dataclass equality" and "frozen dataclasses" but the models are now Pydantic BaseModel instances. This is a minor inconsistency.

Also applies to: 572-573, 598-599

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/models/runtime/test_model_plugin_discovery_report.py` around lines
555 - 556, Update the docstrings in this test module that still say "dataclass"
or "frozen dataclasses" to instead reference "Pydantic model" (or "immutable
Pydantic model" where appropriate); for example change the docstring on the
test_equality_of_entries function to mention Pydantic BaseModel equality, and
similarly update the docstrings for the other related tests in the same file
that assert immutability/equality to mention Pydantic models rather than
dataclasses so wording matches the actual types under test.

scripts/deploy-agent/deploy_agent/executor.py (1)

709-724: 💤 Low value

Duplicate OMNI_HOME validation.

_build_source_build_args (line 115-116) already validates that OMNI_HOME is set when BUILD_SOURCE=workspace. The check at lines 720-723 duplicates this validation. The first call to _build_source_build_args at line 711-714 will raise before reaching line 720 if OMNI_HOME is missing.

This redundancy is harmless but could be removed for clarity.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/deploy-agent/deploy_agent/executor.py` around lines 709 - 724, Remove
the redundant OMNI_HOME presence check inside the selected_source ==
BuildSource.WORKSPACE block since _build_source_build_args already validates
OMNI_HOME; keep the os.environ lookup for omni_home (used by _stage_workspace)
and simply call self._stage_workspace(REPO_DIR, omni_home) when selected_source
== BuildSource.WORKSPACE, removing the if not omni_home: raise RuntimeError(...)
branch; update references to selected_source, _build_source_build_args,
_coerce_build_source, and _stage_workspace accordingly.

src/omnibase_infra/adapters/llm/adapter_code_review_analysis.py (1)

258-258: ⚡ Quick win

Wrap environment variable access to provide a clearer error message.

Line 258 will raise KeyError if LLM_CODER_FAST_URL is not set. The existing validation at lines 259-268 checks for empty strings but won't catch the missing-key case. Adding a try-except around the env access would provide a clearer configuration error.

🛡️ Proposed fix for clearer error messaging

-        resolved_base_url: str = base_url or os.environ["LLM_CODER_FAST_URL"]
+        if base_url is None:
+            try:
+                resolved_base_url = os.environ["LLM_CODER_FAST_URL"]
+            except KeyError as exc:
+                context = ModelInfraErrorContext.with_correlation(
+                    transport_type=EnumInfraTransportType.HTTP,
+                    operation="validate_config",
+                )
+                raise ProtocolConfigurationError(
+                    "LLM_CODER_FAST_URL environment variable is required when base_url is not provided. "
+                    "Set LLM_CODER_FAST_URL or pass base_url explicitly.",
+                    context=context,
+                ) from exc
+        else:
+            resolved_base_url = base_url
         if not resolved_base_url.strip():

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_code_review_analysis.py` at line 258,
The code sets resolved_base_url = base_url or os.environ["LLM_CODER_FAST_URL"]
which will raise KeyError if the env var is missing; update the logic in
adapter_code_review_analysis to catch that case by wrapping the os.environ
access in a try/except (or use os.getenv) and raise a clear ConfigurationError
or ValueError indicating that LLM_CODER_FAST_URL is not set, then proceed with
the existing empty-string validation; reference the resolved_base_url assignment
and the base_url/LLM_CODER_FAST_URL names when applying the change.

src/omnibase_infra/adapters/llm/adapter_documentation_generation.py (1)

249-249: ⚡ Quick win

Provide a clearer error message when LLM_DEEPSEEK_R1_URL is missing.

Line 249 will raise KeyError if LLM_DEEPSEEK_R1_URL is not set. The validation at lines 239-248 checks for explicitly empty base_url but won't catch the missing-key case. Adding a try-except would improve the error message.

🛡️ Proposed fix for clearer error messaging

-        self._base_url: str = base_url or os.environ["LLM_DEEPSEEK_R1_URL"]
+        if base_url is None:
+            try:
+                self._base_url = os.environ["LLM_DEEPSEEK_R1_URL"]
+            except KeyError as exc:
+                context = ModelInfraErrorContext.with_correlation(
+                    transport_type=EnumInfraTransportType.HTTP,
+                    operation="validate_config",
+                )
+                raise ProtocolConfigurationError(
+                    "LLM_DEEPSEEK_R1_URL environment variable is required when base_url is not provided. "
+                    "Set LLM_DEEPSEEK_R1_URL or pass base_url explicitly.",
+                    context=context,
+                ) from exc
+        else:
+            self._base_url = base_url
         self._model: str = model

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_documentation_generation.py` at line
249, The code currently directly accesses os.environ["LLM_DEEPSEEK_R1_URL"] when
assigning self._base_url, which raises a KeyError if the env var is absent;
update the assignment in the constructor (where self._base_url is set) to
attempt to read os.environ.get("LLM_DEEPSEEK_R1_URL") or wrap the
os.environ[...] access in a try/except and raise a clearer error (ValueError or
RuntimeError) that explains the missing environment variable and suggests how to
set LLM_DEEPSEEK_R1_URL, keeping the existing empty-string check logic intact.

src/omnibase_infra/adapters/llm/adapter_code_analysis_enrichment.py (1)

159-159: ⚡ Quick win

Provide a clearer error message when LLM_CODER_URL is missing.

Line 159 will raise a KeyError if LLM_CODER_URL is not set. A try-except block with a descriptive message would help operators quickly identify the missing configuration.

🛡️ Proposed fix to add clear error messaging

-        self._base_url: str = base_url or os.environ["LLM_CODER_URL"]
+        if base_url is None:
+            try:
+                self._base_url = os.environ["LLM_CODER_URL"]
+            except KeyError as exc:
+                raise RuntimeError(
+                    "LLM_CODER_URL environment variable is required when base_url is not provided. "
+                    "Set LLM_CODER_URL or pass base_url explicitly."
+                ) from exc
+        else:
+            self._base_url = base_url

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_code_analysis_enrichment.py` at line
159, The assignment to self._base_url uses os.environ["LLM_CODER_URL"] which
raises a KeyError when the env var is missing; update the constructor (where
self._base_url is set) to read the env var using os.environ.get or wrap the
lookup in try/except and raise a clearer exception (e.g., RuntimeError or
ValueError) that mentions the missing LLM_CODER_URL and how to set it, so
operators get a descriptive error instead of a raw KeyError; modify the code
referencing self._base_url in adapter_code_analysis_enrichment (the __init__ /
initializer that sets self._base_url) accordingly.

src/omnibase_infra/adapters/llm/adapter_summarization_enrichment.py (1)

195-195: ⚡ Quick win

Provide a clearer error message when LLM_QWEN_72B_URL is missing.

Line 195 will raise KeyError if LLM_QWEN_72B_URL is not set. Adding a try-except block with a descriptive message would help operators quickly identify the missing configuration.

🛡️ Proposed fix for clearer error messaging

-        self._base_url: str = base_url or os.environ["LLM_QWEN_72B_URL"]
+        if base_url is None:
+            try:
+                self._base_url = os.environ["LLM_QWEN_72B_URL"]
+            except KeyError as exc:
+                raise ValueError(
+                    "LLM_QWEN_72B_URL environment variable is required when base_url is not provided. "
+                    "Set LLM_QWEN_72B_URL or pass base_url explicitly."
+                ) from exc
+        else:
+            self._base_url = base_url
         self._model: str = model

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_summarization_enrichment.py` at line
195, The assignment to self._base_url currently uses
os.environ["LLM_QWEN_72B_URL"] which raises a KeyError with no context; modify
the adapter's initializer (where self._base_url is set) to safely read the env
var (e.g., use os.getenv) and if neither base_url param nor the environment
variable is provided, catch the missing case and raise a clear RuntimeError or
ValueError that names LLM_QWEN_72B_URL and explains that the configuration is
required (include guidance to set the env var or pass base_url); update the code
path in adapter_summarization_enrichment where self._base_url is assigned to
implement this try/check-and-raise logic.

src/omnibase_infra/adapters/llm/adapter_llm_provider_openai.py (1)

217-217: ⚡ Quick win

Provide a clearer error message when LLM_CODER_URL is missing.

Line 217 will raise KeyError if LLM_CODER_URL is not set. Adding a try-except with a descriptive message would help operators quickly identify the missing configuration.

🛡️ Proposed fix for clearer error messaging

-        self._base_url = base_url or os.environ["LLM_CODER_URL"]
+        if base_url is None:
+            try:
+                self._base_url = os.environ["LLM_CODER_URL"]
+            except KeyError as exc:
+                raise RuntimeError(
+                    "LLM_CODER_URL environment variable is required when base_url is not provided. "
+                    "Set LLM_CODER_URL or pass base_url explicitly."
+                ) from exc
+        else:
+            self._base_url = base_url
         self._default_model = default_model

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/omnibase_infra/adapters/llm/adapter_llm_provider_openai.py` at line 217,
Currently self._base_url = base_url or os.environ["LLM_CODER_URL"] will raise a
raw KeyError when LLM_CODER_URL is unset; change the assignment in the
constructor (where self._base_url is set) to explicitly check for base_url or
the environment variable and wrap the os.environ access in a try/except (or use
os.getenv) and raise a clear RuntimeError or ValueError that mentions the
missing LLM_CODER_URL configuration and how to set it (e.g., "LLM_CODER_URL
environment variable not set; please provide base_url or set LLM_CODER_URL").

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/runtime_build/compute_workspace_provenance.py`:
- Around line 42-57: The filter in _hash_tree uses the literal "*.egg-info"
against path.parts so it never matches actual egg-info directory names; change
the condition in the any(...) check inside _hash_tree to detect egg-info
directories correctly (e.g., use part.endswith(".egg-info") or check for
part.endswith("egg-info")/match a pattern) so directories like
"omnibase_compat.egg-info" are skipped when iterating over path.parts.

In `@scripts/runtime_build/stage_workspace.sh`:
- Around line 8-10: Update the usage comment in the script header of
stage_workspace.sh so the example points to the correct relative path: replace
the incorrect docker/runtime_build/stage_workspace.sh with
scripts/runtime_build/stage_workspace.sh in the top-of-file usage block (the
comment around the script name in scripts/runtime_build/stage_workspace.sh) so
operators can copy/paste the correct command.

In `@scripts/seed-infisical.py`:
- Around line 762-769: The machine-class seeding path returns into
_seed_machine_class when args.machine_class is set but does not load the
operator environment first; before invoking _seed_machine_class (and any
downstream _do_seed or Infisical/database/Kafka operations) ensure you source
~/.omnibase/.env by calling the existing operator env loader (e.g.,
load_operator_env() or equivalent), or add a small helper to read/export that
file, then call _seed_machine_class with the same args so credentials are
present for Infisical operations.

In `@scripts/validation/topic_literal_baseline.txt`:
- Around line 123-124: The baseline contains stale entries for
service_kernel.py:2015-2016 even though the code uses
EnumOmnimarketTopic.EVT_DELEGATE_SKILL_COMPLETED_V1.value and
EnumOmnimarketTopic.EVT_DELEGATE_SKILL_FAILED_V1.value (the only literal-like
text nearby is a comment), and scripts/validation/check_topic_literals.py only
inspects AST string constants; remove the redundant baseline entries covering
service_kernel.py:2015-2016 so the baseline matches current AST-detected topic
literals.

In `@src/omnibase_infra/adapters/llm/adapter_llm_provider_openai.py`:
- Around line 206-207: The docstring for the parameter base_url in
adapter_llm_provider_openai.py contains contradictory phrasing "Defaults to the
required `LLM_CODER_URL` env var"; update that line to remove the contradiction
by rephrasing to something like "Defaults to the `LLM_CODER_URL` environment
variable" (or, if it is actually required, change to "Required: `LLM_CODER_URL`
environment variable") so the intent for base_url is clear.

In `@src/omnibase_infra/adapters/models/model_infisical_batch_result.py`:
- Line 32: The ConfigDict for this model currently sets only frozen=False;
update the model_config ConfigDict to also include extra="forbid" and
from_attributes=True while keeping frozen=False so batch accumulation still
works—modify the ConfigDict instantiation referenced by the model_config
variable (where ConfigDict(...) is called) to include extra="forbid" and
from_attributes=True to satisfy validation and ORM/pytest-xdist compatibility.

In `@src/omnibase_infra/adapters/models/model_infisical_secret_result.py`:
- Line 25: The ConfigDict for the Pydantic model currently only sets
frozen=True; update the model_config variable (symbol: model_config) to include
extra="forbid" and from_attributes=True so it becomes ConfigDict(frozen=True,
extra="forbid", from_attributes=True) to enforce immutability, forbid unknown
fields, and enable ORM/attributes parsing for tests.

In `@src/omnibase_infra/cli/model_reset_action_result.py`:
- Line 30: The model_config assignment uses ConfigDict(frozen=True) but must
include extra="forbid" and from_attributes=True; update the ConfigDict call for
the model_config symbol to ConfigDict(frozen=True, extra="forbid",
from_attributes=True) so the Pydantic model enforces immutability, forbids
unknown fields, and supports attribute-based parsing.

In `@src/omnibase_infra/event_bus/topic_constants.py`:
- Around line 520-526: These two Kafka topic constants
(TOPIC_DELEGATE_SKILL_COMPLETED and TOPIC_DELEGATE_SKILL_FAILED) must be removed
from src/omnibase_infra/event_bus/topic_constants.py and instead declared in the
node's contract.yaml for node_delegate_skill_orchestrator under
event_bus.publish_topics (or subscribe_topics as appropriate); update code that
references those constants to resolve the topic name via the node contract
wiring/contract resolver API rather than using the literals, and ensure any unit
tests or wiring code uses the contract-based lookup so topic ownership remains
the single source of truth.

In `@src/omnibase_infra/handlers/mcp/adapter_onex_to_mcp.py`:
- Line 101: MCPToolParameter and MCPToolDefinition are marked as internal via
the comment "# internal-dataclass-ok: mcp-adapter-internal" but are also
exported in __all__, creating an API inconsistency; decide whether they should
be public or internal and fix accordingly — either remove the internal marker
comment from the `@dataclass` lines for MCPToolParameter and MCPToolDefinition to
make them clearly public, or remove the "MCPToolParameter" and
"MCPToolDefinition" entries from the module's __all__ to keep them internal
(update any docs/tests that rely on their export if needed).

In `@src/omnibase_infra/mixins/mixin_postgres_error_response.py`:
- Line 82: PostgresErrorContext is marked as an internal dataclass but is also
exported in __all__, creating an inconsistency; either remove
"PostgresErrorContext" from the module-level __all__ export list to keep it
internal, or change the inline marker/comment on the `@dataclass` (the "#
internal-dataclass-ok: mixin-internal error context" adjacent to
PostgresErrorContext) to indicate it's part of the public API so the export is
intentional—update only the marker or the __all__ entry accordingly and ensure
the change references PostgresErrorContext and the module __all__ list.

In
`@src/omnibase_infra/nodes/node_decision_store_effect/handlers/handler_write_decision.py`:
- Line 193: The five dataclasses ActiveDecisionRow, Stage1Result,
ConflictWritten, Stage2Result, and DecisionScopeKey are marked as
handler-internal but are also exported in __all__, causing an inconsistency;
decide which is correct and fix it: if they are internal-only, remove their
names from the module-level __all__ list; if they are meant to be public, remove
the "# internal-dataclass-ok: handler-internal ..." comments above the dataclass
declarations so the comment no longer mislabels them. Update only the entries in
__all__ or the internal-dataclass-ok comments accordingly to make the module
intent consistent.

In `@src/omnibase_infra/runtime/models/model_handshake_check_result.py`:
- Line 30: The ConfigDict for the Pydantic model is using incorrect settings;
update the model_config definition to use ConfigDict(frozen=True,
extra="forbid", from_attributes=True) so the model is immutable, forbids unknown
fields, and supports attribute-based initialization; locate the model_config
symbol in model_handshake_check_result.py and replace the existing
ConfigDict(frozen=False) with ConfigDict(frozen=True, extra="forbid",
from_attributes=True).

In `@src/omnibase_infra/runtime/models/model_handshake_result.py`:
- Line 63: Replace the current model_config definition to follow Pydantic
guidelines: change the ConfigDict instantiation used for the model
(model_config) to ConfigDict(frozen=True, extra="forbid", from_attributes=True)
so the Pydantic model becomes immutable, forbids unknown fields, and supports
from-attributes/ORM compatibility; update the module-level variable model_config
accordingly in model_handshake_result.py.

In `@src/omnibase_infra/runtime/models/model_plugin_discovery_entry.py`:
- Line 62: The ConfigDict used for Pydantic model config is missing
extra="forbid" and from_attributes=True; update the model_config assignment (the
ConfigDict variable) to use ConfigDict(frozen=True, extra="forbid",
from_attributes=True) so the model enforces immutability, forbids unknown
fields, and supports attribute-based population/ORM usage.

In `@src/omnibase_infra/runtime/models/model_plugin_discovery_report.py`:
- Line 43: The ConfigDict for this Pydantic model is incomplete: update the
model_config variable (in model_plugin_discovery_report.py) to use the full
required configuration by adding extra="forbid" and from_attributes=True so it
becomes ConfigDict(frozen=True, extra="forbid", from_attributes=True); mirror
the same change applied in ModelPluginDiscoveryEntry to enforce immutability,
forbid unknown fields, and enable attribute-based population.

In `@src/omnibase_infra/runtime/render_bifrost_delegation_contract.py`:
- Around line 32-48: The conversion Path(str(ref)) in
_resolve_default_source_path fails for zip/wheel installs because
importlib.resources.Traversable may not be a filesystem path; change the logic
to use importlib.resources.as_file(ref) (or use ref.is_file()/readable checks)
to obtain a real temporary filesystem path before calling exists(), and return
that Path if the resource is accessible; otherwise fall back to
_LEGACY_SOURCE_PATH. Ensure you update the branch that currently constructs
candidate = Path(str(ref)) and the candidate.exists() check to use the as_file
context manager or Traversable checks so the resource is correctly resolved for
archive-installed packages.

In `@src/omnibase_infra/topics/model_topic_spec.py`:
- Around line 63-64: The MappingProxyType is currently created from the original
dict `v` which keeps a live reference and allows caller mutations to leak into
the proxy; change the code that returns MappingProxyType(v) to wrap a shallow
copy (e.g., MappingProxyType(v.copy() or MappingProxyType(dict(v))) so the proxy
holds an independent mapping; update the return in the function/method where `if
isinstance(v, dict): return MappingProxyType(v)` appears to use a copied dict
instead.

In `@src/omnibase_infra/validation/validation_exemptions.yaml`:
- Line 755: In validation_exemptions.yaml the file_pattern entries currently use
'health_checker.py' which is treated as a regex and the unescaped '.' will match
any character; update both file_pattern occurrences for health_checker to use an
escaped dot 'health_checker\.py' so the regex matches the literal filename
exactly (search for the file_pattern keys with value 'health_checker.py' and
replace them with 'health_checker\.py').

In `@tests/integration/envelope_routing/test_projection_topic_extraction.py`:
- Around line 11-17: The test function
test_projection_topic_uses_onex_event_type_when_envelope_topic_is_absent is
missing an explicit pytest marker; add `@pytest.mark.integration` above the
function to tag it as an integration test and ensure the file imports pytest
(add "import pytest" at top if not present); keep the test body unchanged — it
should still construct ModelEventEnvelope and assert
_extract_projection_topic(envelope) == envelope.event_type.

---

Outside diff comments:
In `@src/omnibase_infra/adapters/llm/adapter_code_analysis_enrichment.py`:
- Around line 148-159: The docstring for the adapter __init__ misleadingly
claims base_url falls back to "http://localhost:8000" but the implementation
(assignment to self._base_url using os.environ["LLM_CODER_URL"]) requires
LLM_CODER_URL to be set and will raise if absent; update the parameter docs for
base_url in the __init__ docstring to state that base_url defaults to the
required LLM_CODER_URL environment variable and that the environment variable is
mandatory (or explicitly document that a KeyError will be raised if it is
unset), referencing the base_url parameter and the self._base_url assignment so
readers know the behavior.

In `@src/omnibase_infra/adapters/llm/adapter_code_review_analysis.py`:
- Around line 213-258: The docstring for the adapter initializer is out of sync:
it claims base_url "Defaults to the LLM_CODER_FAST_URL environment variable,
falling back to http://localhost:8001" but the code now uses resolved_base_url =
base_url or os.environ["LLM_CODER_FAST_URL"] (no fallback), which will raise if
the env var is missing; update the initializer docstring (the description for
the base_url parameter) to state that base_url defaults to the
LLM_CODER_FAST_URL environment variable and that this environment variable is
required (no localhost fallback), and mention that omitting both will raise a
KeyError or that callers must set LLM_CODER_FAST_URL or pass base_url.

In `@src/omnibase_infra/adapters/llm/adapter_documentation_generation.py`:
- Around line 204-249: Update the __init__ docstring for the adapter to reflect
that base_url no longer falls back to "http://localhost:8001" and instead
requires the LLM_DEEPSEEK_R1_URL environment variable when base_url is None
(absence will cause a KeyError); mention that passing an empty string raises
ProtocolConfigurationError and that base_url resolves from the
LLM_DEEPSEEK_R1_URL env var into self._base_url when not provided.

In `@src/omnibase_infra/adapters/llm/adapter_llm_provider_openai.py`:
- Around line 170-171: Update the class docstring in
adapter_llm_provider_openai.py to accurately state that the adapter requires the
LLM_CODER_URL environment variable (no longer falling back to
http://localhost:8000) when base_url is not provided; specifically mention the
constructor parameter base_url and that LLM_CODER_URL must be set and will be
used if base_url is omitted, removing any text that implies a default fallback
URL.

In `@src/omnibase_infra/adapters/llm/adapter_summarization_enrichment.py`:
- Around line 163-195: Update the __init__ docstring for
adapter_summarization_enrichment to reflect the new behavior of base_url: it now
defaults to the LLM_QWEN_72B_URL environment variable and will raise if that env
var is not set (no fallback to "http://localhost:8100"). Modify the text that
currently says "falling back to `http://localhost:8100`" to state that the env
var is required, and mention that self._base_url is populated from
os.environ["LLM_QWEN_72B_URL"] when base_url is not provided.

In `@src/omnibase_infra/adapters/llm/adapter_test_boilerplate_generation.py`:
- Around line 225-227: Docstring claims the adapter falls back to
"http://localhost:8001" but the code uses os.environ["LLM_CODER_FAST_URL"] which
raises KeyError if unset; change the environment lookup to use a safe fallback
(e.g. replace os.environ["LLM_CODER_FAST_URL"] with
os.environ.get("LLM_CODER_FAST_URL", "http://localhost:8001")) so the
implementation matches the docstring (referencing the LLM_CODER_FAST_URL lookup
in the adapter/boilerplate generation code).

In
`@src/omnibase_infra/nodes/node_llm_completion_effect/handlers/handler_llm_completion.py`:
- Around line 127-143: The _resolve_endpoint function currently accesses
os.environ["LLM_CODER_URL"] directly which will raise a bare KeyError; change it
to check for the environment value and if missing raise a proper infrastructure
error using
ModelInfraErrorContext.with_correlation(correlation_id=request.correlation_id,
transport_type=..., operation="resolve_endpoint") (fill in the appropriate
transport_type constant) and include a descriptive message about missing
LLM_CODER_URL; also ensure any returned URL is rstripped("/") as before and keep
the fast-url branch unchanged.

In
`@src/omnibase_infra/nodes/node_rsd_score_compute/handlers/handler_rsd_score_calculate.py`:
- Line 12: Remove the unused `timezone` import from the top of
handler_rsd_score_calculate.py: update the import line that currently reads
"from datetime import UTC, datetime, timezone" to only import the symbols
actually used (keep `UTC` and `datetime`); ensure no other references to
`timezone` exist in functions like the RSD normalization block (e.g., code
around lines using `UTC` and `datetime`) before committing.

---

Nitpick comments:
In `@scripts/deploy-agent/deploy_agent/executor.py`:
- Around line 709-724: Remove the redundant OMNI_HOME presence check inside the
selected_source == BuildSource.WORKSPACE block since _build_source_build_args
already validates OMNI_HOME; keep the os.environ lookup for omni_home (used by
_stage_workspace) and simply call self._stage_workspace(REPO_DIR, omni_home)
when selected_source == BuildSource.WORKSPACE, removing the if not omni_home:
raise RuntimeError(...) branch; update references to selected_source,
_build_source_build_args, _coerce_build_source, and _stage_workspace
accordingly.

In `@src/omnibase_infra/adapters/llm/adapter_code_analysis_enrichment.py`:
- Line 159: The assignment to self._base_url uses os.environ["LLM_CODER_URL"]
which raises a KeyError when the env var is missing; update the constructor
(where self._base_url is set) to read the env var using os.environ.get or wrap
the lookup in try/except and raise a clearer exception (e.g., RuntimeError or
ValueError) that mentions the missing LLM_CODER_URL and how to set it, so
operators get a descriptive error instead of a raw KeyError; modify the code
referencing self._base_url in adapter_code_analysis_enrichment (the __init__ /
initializer that sets self._base_url) accordingly.

In `@src/omnibase_infra/adapters/llm/adapter_code_review_analysis.py`:
- Line 258: The code sets resolved_base_url = base_url or
os.environ["LLM_CODER_FAST_URL"] which will raise KeyError if the env var is
missing; update the logic in adapter_code_review_analysis to catch that case by
wrapping the os.environ access in a try/except (or use os.getenv) and raise a
clear ConfigurationError or ValueError indicating that LLM_CODER_FAST_URL is not
set, then proceed with the existing empty-string validation; reference the
resolved_base_url assignment and the base_url/LLM_CODER_FAST_URL names when
applying the change.

In `@src/omnibase_infra/adapters/llm/adapter_documentation_generation.py`:
- Line 249: The code currently directly accesses
os.environ["LLM_DEEPSEEK_R1_URL"] when assigning self._base_url, which raises a
KeyError if the env var is absent; update the assignment in the constructor
(where self._base_url is set) to attempt to read
os.environ.get("LLM_DEEPSEEK_R1_URL") or wrap the os.environ[...] access in a
try/except and raise a clearer error (ValueError or RuntimeError) that explains
the missing environment variable and suggests how to set LLM_DEEPSEEK_R1_URL,
keeping the existing empty-string check logic intact.

In `@src/omnibase_infra/adapters/llm/adapter_llm_provider_openai.py`:
- Line 217: Currently self._base_url = base_url or os.environ["LLM_CODER_URL"]
will raise a raw KeyError when LLM_CODER_URL is unset; change the assignment in
the constructor (where self._base_url is set) to explicitly check for base_url
or the environment variable and wrap the os.environ access in a try/except (or
use os.getenv) and raise a clear RuntimeError or ValueError that mentions the
missing LLM_CODER_URL configuration and how to set it (e.g., "LLM_CODER_URL
environment variable not set; please provide base_url or set LLM_CODER_URL").

In `@src/omnibase_infra/adapters/llm/adapter_summarization_enrichment.py`:
- Line 195: The assignment to self._base_url currently uses
os.environ["LLM_QWEN_72B_URL"] which raises a KeyError with no context; modify
the adapter's initializer (where self._base_url is set) to safely read the env
var (e.g., use os.getenv) and if neither base_url param nor the environment
variable is provided, catch the missing case and raise a clear RuntimeError or
ValueError that names LLM_QWEN_72B_URL and explains that the configuration is
required (include guidance to set the env var or pass base_url); update the code
path in adapter_summarization_enrichment where self._base_url is assigned to
implement this try/check-and-raise logic.

In `@src/omnibase_infra/runtime/service_dispatch_result_applier.py`:
- Around line 299-329: The ONEX topic parser in _derive_event_type_from_topic
currently allows any topic with 5 or more segments; tighten the validation by
requiring exactly 5 dot-separated segments to match the documented shape
(onex.{kind}.{producer}.{event-name}.v{n}). Update the guard from len(parts) >=
5 to len(parts) == 5 inside the _derive_event_type_from_topic static method so
only strictly 5-segment topics return f"{producer}.{event_name}" (otherwise
return None).

In `@tests/unit/models/runtime/test_model_plugin_discovery_report.py`:
- Around line 555-556: Update the docstrings in this test module that still say
"dataclass" or "frozen dataclasses" to instead reference "Pydantic model" (or
"immutable Pydantic model" where appropriate); for example change the docstring
on the test_equality_of_entries function to mention Pydantic BaseModel equality,
and similarly update the docstrings for the other related tests in the same file
that assert immutability/equality to mention Pydantic models rather than
dataclasses so wording matches the actual types under test.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[jonahgabriel]

Fixed the fresh lint failure from workflow 26690137538: tests/ci/test_ci_workflow_resilience.py needed ruff formatting.

Pushed head 1b1b948a3. Local verification:

• uv run ruff format --check tests/ci/test_ci_workflow_resilience.py
• uv run ruff check tests/ci/test_ci_workflow_resilience.py

[jonahgabriel]

Foreground blocker triage update (2026-05-31T16:42Z)

Classified the terminal checks on the post-fix head. The failed Standards jobs are infra/setup symptoms, not new source assertions:

• PEP 604 Type Union Check: omnibase_core checkout failed with GnuTLS/early EOF.
• Handler Contract Compliance: PyPI tomli-w download timed out.
• Type Safety Validation: aiokafka extraction timed out.
• Security Scan / CodeQL: GitHub log endpoint returned BlobNotFound on the failed job.
• Artifact Reconciliation Webhook, Deploy Gate, and Reject skip-gate bypass tokens were cancelled fanout.

Reran the failed jobs/workflows: 26717077289, 26717077358, 26717077273, 26717077356, and 26717077352. Keeping this in the foreground polling set until the queue clears.

[jonahgabriel]

Foreground controller update: inspected Topic Naming Lint failure on CI run 26717077374/job 78740340970. The job did not reach the naming lint assertion; it failed during uv sync after repeated transient GitHub git fetch errors for pinned internal repos (empty reply / GnuTLS termination) and exhausted the bootstrap retry loop. Rerunning failed jobs for run 26717077374; no source change indicated by this log.

[jonahgabriel]

Foreground controller update: picked up new cancelled reject-skip context on terminal workflow 26717077352 attempt 2. Reran failed jobs for that terminal parent. Main CI run 26717077374 and CodeQL 26717077358 are still active/in progress, so I am not rerunning those until they settle.

[jonahgabriel]

Foreground update: pushed OMN-12449 logging hardening commit a79bc18. The rejected handler warning no longer logs the allowed namespace list; it keeps only allowed_namespace_count plus handler_class_redacted. Local verification: PYTHONPATH=$PWD/src uv run python -m pytest tests/unit/runtime/test_live_contract_materialization.py -q (20 passed); uv run ruff check src/omnibase_infra/runtime/runtime_host_process.py tests/unit/runtime/test_live_contract_materialization.py (passed). The current Type Safety / PEP 604 failures in the Standards parent are transient uv sync git fetch errors against onex_change_control / omnibase_spi, not source failures; I will rerun terminal parents once GitHub marks them rerunnable.