fix(OMN-12987): deploy-runtime.sh sibling lock-pin preflight uses current --lock/--repo/--output interface

scripts/deploy-runtime.sh

@@ -599,16 +599,38 @@ check_sibling_lock_pins() {
         exit 1
     fi
 
-    log_cmd "OMNI_HOME=${omni_home} ${guard} --provenance-out ${provenance_out}"
+    # The check_sibling_lock_pins.py interface changed under OMN-12977/12987:
+    # the original single-output flag was removed in favor of --lock (required,
+    # the pin authority), repeatable --repo PACKAGE=PATH (the canonical clones
+    # the build vendors), and --output (where to write the comparison JSON).
+    # The consuming repo's uv.lock (omnimarket) is the pin authority.
+    local lock_path="${omni_home}/omnimarket/uv.lock"
+    local guard_args=(
+        --lock "${lock_path}"
+        --repo "omnibase-infra=${omni_home}/omnibase_infra"
+        --repo "omnibase-core=${omni_home}/omnibase_core"
+        --repo "omnibase-spi=${omni_home}/omnibase_spi"
+        --repo "omnibase-compat=${omni_home}/omnibase_compat"
+        --repo "onex-change-control=${omni_home}/onex_change_control"
+        --output "${provenance_out}"
+    )
+    # Operator override (OMN-12977): ALLOW_SIBLING_PIN_DRIFT=1 records drift in
+    # the provenance artifact and proceeds instead of aborting. Never the default.
+    if [[ "${ALLOW_SIBLING_PIN_DRIFT:-0}" == "1" ]]; then
+        guard_args+=(--allow-drift)
+        log_warn "ALLOW_SIBLING_PIN_DRIFT=1 -- passing --allow-drift to sibling lock-pin preflight (OMN-12977)"
+    fi
+
+    log_cmd "OMNI_HOME=${omni_home} ${guard} ${guard_args[*]}"
     if [[ "${python_bin}" == "uv-run" ]]; then
         if ! OMNI_HOME="${omni_home}" uv run --project "${repo_root}" python "${guard}" \
-            --provenance-out "${provenance_out}"; then
+            "${guard_args[@]}"; then
             log_error "Sibling lock-pin preflight FAILED. Refusing to build a stale image."
             exit 1
         fi
     else
         if ! OMNI_HOME="${omni_home}" "${python_bin}" "${guard}" \
-            --provenance-out "${provenance_out}"; then
+            "${guard_args[@]}"; then
             log_error "Sibling lock-pin preflight FAILED. Refusing to build a stale image."
             exit 1
         fi

tests/scripts/test_deploy_runtime_build_context.py

@@ -162,6 +162,46 @@ def test_deploy_runtime_runs_sibling_lock_pin_preflight() -> None:
     assert "Refusing to build a stale image." in deploy_script
 
 
+@pytest.mark.unit
+def test_deploy_runtime_uses_current_lock_pin_preflight_interface() -> None:
+    """The preflight caller must match check_sibling_lock_pins.py's current CLI.
+
+    Regression guard: OMN-12977/12987 replaced the original ``--provenance-out``
+    flag with ``--lock`` (required pin authority), repeatable ``--repo
+    PACKAGE=PATH`` (the canonical clones the build vendors), and ``--output``
+    (where to write the comparison JSON). The deploy-runtime.sh caller was left
+    pinned to the removed ``--provenance-out`` flag, so EVERY workspace
+    ``--execute`` deploy failed at argparse (``the following arguments are
+    required: --lock``) before any build started. This test pins the corrected
+    interface so the stale-flag invocation can never come back.
+    """
+    deploy_script = DEPLOY_SCRIPT.read_text(encoding="utf-8")
+
+    # Removed flag must be gone — its presence is the exact regression we hit.
+    assert "--provenance-out" not in deploy_script
+
+    # Current required + supported flags must be wired into the guard_args.
+    assert '--lock "${lock_path}"' in deploy_script
+    assert "--repo " in deploy_script
+    assert '--output "${provenance_out}"' in deploy_script
+
+    # The consuming repo's omnimarket uv.lock is the pin authority, and every
+    # vendored sibling must be passed as a --repo PACKAGE=PATH entry.
+    assert 'lock_path="${omni_home}/omnimarket/uv.lock"' in deploy_script
+    for package in (
+        "omnibase-infra",
+        "omnibase-core",
+        "omnibase-spi",
+        "omnibase-compat",
+        "onex-change-control",
+    ):
+        assert f'--repo "{package}=' in deploy_script
+
+    # The OMN-12977 operator override must be honored via --allow-drift.
+    assert "ALLOW_SIBLING_PIN_DRIFT" in deploy_script
+    assert "--allow-drift" in deploy_script
+
+
 @pytest.mark.unit
 def test_stage_workspace_emits_build_sha_marker() -> None:
     """stage_workspace.sh must record each sibling's HEAD SHA (OMN-12987).