[jonahgabriel]

OMN-12477: Enforce dev-only promotion to main — remove hotfix/* bypass

Removes the hotfix/* allow-block from the main-target-guard so that main
accepts only promotion PRs (head ref dev/promotion/* carrying a
promotion-receipt: OCC-N line). The dev/promotion happy-path and its
promotion-receipt requirement are unchanged.

Why

The guard previously let hotfix/* branches merge directly to main on the mere
presence of hotfix-evidence: OCC-N + backmerge: #N text — it never verified
the back-merge actually landed, so dev fell behind main (drift in every repo,
verified 2026-05-30). Pure dev-only flow eliminates the drift class.

Change

• Delete the if [[ "${HEAD_REF}" == hotfix/* ]]; then ... fi block.
• Update residual error messages to reference only dev / promotion (drop hotfix).
• Trigger, permissions, runner selection, and the dev/promotion path are untouched.

dod_evidence

• Per-repo guard edit; CI must be green.
• omniclaude/tests/workflows/test_main_target_guard.py executes the guard shell
  logic and asserts a hotfix/*-headed PR to main is rejected while a dev
  promotion PR with a receipt is still allowed (the happy path is preserved).
• actionlint clean on every edited workflow.

This PR targets dev to dogfood the policy. Do not merge until the team-lead
verifies via gh pr checks.

OMN-12477

Evidence-Source: OCC#1921
Evidence-Ticket: OMN-12477

[coderabbitai]

Warning

Review limit reached

@jonahgabriel, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 28 minutes and 54 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a0380e18-0e52-49a5-adfe-bd3dad30a22c

📥 Commits

Reviewing files that changed from the base of the PR and between 42e3903 and cd735d1.

📒 Files selected for processing (1)

• .github/workflows/main-target-guard.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-12477-dev-only-main-guard

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jonahgabriel]

CI triage update for 75dbd009b:

• Inspected failing checks from the prior head 38ab8aefc: Type Safety Validation, PEP 604 Type Union Check (UP007), Omni Standards Gate, Contract Compliance Check, deploy-gate / deploy-gate, Check architecture handshake, Publish PR Webhook Event, plus true/canceled CI rollup state from gh pr checks.
• Raw logs pointed to transient install/checkout failures rather than type/code failures: uv numpy==2.4.2 extraction timeout at default 30s, omnibase_spi/omnibase_core git fetch GnuTLS disconnects, OCC checkout HTTP 408/GnuTLS disconnects, and canceled setup steps.
• Branch-code gap found: standards jobs and CI contract-compliance still used raw uv sync --no-cache --all-extras, bypassing the retrying .github/actions/setup-python-uv action added in this PR.
• Fix pushed in 75dbd009b: route standards type-safety/UP007 installs and CI contract-compliance OCC install through the retrying uv setup action.

Local validation:

• UV_HTTP_TIMEOUT=600 uv sync --reinstall-package omnibase-core --reinstall-package omnibase-spi passed.
• uv run python -m pytest tests/ci/test_ci_workflow_resilience.py -q passed: 10 passed.
• uv run ruff check tests/ci/test_ci_workflow_resilience.py passed.
• git diff --check passed.

New check run is queued/in progress on head 75dbd009b; no bypasses used.

[jonahgabriel]

Manual foreground tick: sidecar read-only classification found setup/transport/platform failures only. CodeQL log fetch returned Actions BlobNotFound; reject-skip cancelled during checkout fetch; CI Summary failed because children were cancelled after dependency/download setup. Reran workflows 26699850863, 26699850859, and 26699850834.

[jonahgabriel]

Worker Z merge-sweep update (2026-06-01)

• Updated branch from current dev with a normal merge commit.
• Resolved the ci.yml conflict by keeping current dev contract-compliance setup behavior; PR compare now remains scoped to .github/workflows/main-target-guard.yml.
• Head SHA: cd735d1dee988ba1ccf2d95fef93feccab456cb4.
• Local validation: actionlint .github/workflows/main-target-guard.yml; actionlint -ignore 'SC2044|SC2129|SC2086' .github/workflows/ci.yml.\n- GitHub now reports mergeable=MERGEABLE; PR remains draft and post-push CI is running.\n\nSafe for foreground: wait for the new CI run to finish green, then this is safe to undraft/enqueue from the conflict side.