chore(OMN-12934): continue dev to main promotion for prod redeploy

.github/workflows/ci.yml

@@ -125,6 +125,28 @@ jobs:
       - name: LLM topology contract drift validator (OMN-11926)
         run: PYTHONPATH=src uv run python -m omnibase_infra.validators.llm_topology_validator contracts/llm_endpoints.yaml
 
+      # OMN-13026: Transport-mock lint. Bare AsyncMock/MagicMock without
+      # spec=/spec_set= on EventBus/transport/kafka surfaces. Ratchet: existing
+      # violations frozen in config/validation/transport_mock_baseline.yaml. New
+      # violations in any PR are blocked. Drain tracked by per-site tickets.
+      # SYNC with pre-commit hook 'transport-mock-lint'.
+      # Clone omnibase_core HEAD so the validator is available before the
+      # OMN-13026 omnibase_core pin bump lands in the lockfile.
+      - name: Checkout omnibase_core validator source
+        uses: actions/checkout@v6
+        with:
+          repository: OmniNode-ai/omnibase_core
+          ref: dev
+          path: .ci/omnibase_core
+          token: ${{ secrets.OMNIBASE_CORE_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - name: Transport-mock lint (OMN-13026)
+        run: |
+          PYTHONPATH=.ci/omnibase_core/src uv run python \
+            -m omnibase_core.validators.transport_mock_lint \
+            --baseline config/validation/transport_mock_baseline.yaml \
+            tests/
+
       - name: Run mypy type checking
         run: uv run mypy src/omnibase_infra
 
@@ -982,6 +1004,13 @@ jobs:
           echo "================================================================"
           uv run python scripts/check_dockerfile_pins.py
 
+      - name: Check runtime image identity stamping
+        run: |
+          echo "================================================================"
+          echo "Runtime Image Identity Check (OMN-12965)"
+          echo "================================================================"
+          uv run python scripts/check_runtime_image_identity.py
+
   # ============================================================================
   # ONEX Compliance Check
   # Runs `onex compliance check` to validate contracts, handlers, and schemas.

.github/workflows/dispatcher-route-coverage.yml

@@ -0,0 +1,134 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# dispatcher-route-coverage.yml — OMN-12858 / OMN-12879 / OMN-12880
+#
+# CI gate: for every contract.yaml in omnibase_infra + omnimarket that
+# subscribes to a command topic (onex.cmd.*), assert that the contract
+# declares a dispatcher route via handler_routing or runtime_dispatch.
+#
+# Missing wiring causes the command to go to DLQ silently.  This gate
+# catches that regression before it reaches the runtime.
+#
+# MOTIVATION — two incidents this gate would have caught:
+#
+#   1. June 9 2026 DLQ regression: node_generation_consumer subscribed
+#      onex.cmd.omnimarket.node-generation-requested.v1 but auto-wiring
+#      produced zero dispatchers after a sole-handler revert was merged.
+#      Messages silently went to DLQ.  (OMN-12858 post-mortem)
+#
+#   2. June 12 2026 DEL-01 live finding: onex.cmd.omnimarket.delegate-skill.v1
+#      was consumed by the dev lane bus but no dispatcher route existed in any
+#      deployed contract, so delegation requests went to DLQ silently.
+#      Discovered via manual rpk consumer-group lag probe (DEL-01 evidence).
+#
+# Coverage scope (OMN-12880):
+#   - All subscribed topics where topic contains '.cmd.'
+#   - compatibility_publish_topics are sender-side only; they are NOT
+#     checked for missing routes (no false positives).
+#
+# Changed-command-topic mode (OMN-12879):
+#   - When the PR diff touches contract.yaml files, only those contracts are
+#     checked.  Pre-existing allowlisted violations are not re-reported.
+#
+# Ratchet / baseline model:
+#   - Known pre-existing violations are in scripts/check_dispatcher_route_coverage.py
+#     _ALLOWLISTED_CMD_TOPICS with ticket refs and expiry dates.
+#   - New violations are NEVER silently added — they must be fixed.
+
+name: Dispatcher Route Coverage
+
+on:
+  pull_request:
+    branches: [main, dev]
+  push:
+    branches: [main]
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  dispatcher-route-coverage:
+    name: dispatcher-route-coverage
+    runs-on: >-
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout omnibase_infra
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Checkout omnimarket (sibling)
+        uses: actions/checkout@v6
+        with:
+          repository: OmniNode-ai/omnimarket
+          ref: dev
+          path: omnimarket
+          token: ${{ secrets.OMNI_GITHUB_TOKEN || github.token }}
+          # Sparse checkout: only the contract files needed for coverage analysis
+          sparse-checkout: |
+            src/omnimarket/nodes
+          sparse-checkout-cone-mode: false
+
+      - name: Install pyyaml (only dep for gate script)
+        shell: bash
+        run: |
+          # The gate script uses only stdlib + pyyaml; skip full uv sync to keep
+          # this job fast (no Kafka, no DB, no handler imports).
+          python3 -m pip install --quiet pyyaml
+
+      - name: Collect changed contract paths (OMN-12879)
+        id: changed_contracts
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Find contract.yaml files changed in this PR diff vs the base branch.
+          # For push/merge_group events there is no PR diff; run full scan.
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            BASE="${{ github.event.pull_request.base.sha }}"
+            HEAD="${{ github.event.pull_request.head.sha }}"
+            CHANGED=$(git diff --name-only "$BASE" "$HEAD" -- '**/contract.yaml' || true)
+            if [[ -n "$CHANGED" ]]; then
+              # Convert to absolute paths so the script can match them
+              ABS_PATHS=$(echo "$CHANGED" | xargs -I{} realpath --relative-to=. {} 2>/dev/null || echo "$CHANGED")
+              echo "changed_contracts=$ABS_PATHS" >> "$GITHUB_OUTPUT"
+              echo "Found changed contracts:"
+              echo "$CHANGED" | head -20
+            else
+              echo "changed_contracts=" >> "$GITHUB_OUTPUT"
+              echo "No contract.yaml files changed; full scan will run."
+            fi
+          else
+            echo "changed_contracts=" >> "$GITHUB_OUTPUT"
+            echo "Non-PR event; running full scan."
+          fi
+
+      - name: Run dispatcher route-coverage gate
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          CHANGED="${{ steps.changed_contracts.outputs.changed_contracts }}"
+          EXTRA_DIR="omnimarket/src/omnimarket/nodes"
+
+          ARGS=(
+            "--contracts-dir" "src/omnibase_infra/nodes"
+            "--extra-contracts-dir" "$EXTRA_DIR"
+          )
+
+          if [[ -n "${CHANGED}" ]]; then
+            echo "::notice::Running in changed-contract mode (OMN-12879): $(echo "${CHANGED}" | wc -w) paths"
+            ARGS+=("--changed-contracts" "${CHANGED}")
+          else
+            echo "::notice::Running full scan across both contract directories"
+          fi
+
+          python3 scripts/check_dispatcher_route_coverage.py "${ARGS[@]}"

.github/workflows/node-migration-sync.yml

@@ -0,0 +1,85 @@
+# Node Migration Vendor Sync Gate (OMN-13124)
+#
+# WHY THIS EXISTS
+#   omnimarket projection nodes ship SQL under
+#     src/omnimarket/nodes/<node>/migrations/*.sql
+#   which must be vendored into omnibase_infra under
+#     docker/migrations/forward/nodes/<node>/  (by scripts/sync-node-migrations.sh)
+#   so the forward-migration runner recreates the projection tables on a clean
+#   redeploy. The local pre-commit hook (onex-check-node-migration-sync) only
+#   runs in the infra repo and only when an infra commit is made; an omnimarket
+#   PR that adds a node migration cannot fire it. OMN-13124's
+#   node_projection_pattern_learning merged WITHOUT its vendored copy, so
+#   pattern_learning_artifacts was absent from omnidash_analytics on a clean
+#   redeploy and the golden-chain pattern_learning chain only passed via a live
+#   hot-fix (golden-chain sweep run12 Finding). This gate is the enforcement
+#   layer: every infra PR (and merge_group) re-runs the vendor --check against
+#   the current omnimarket dev tip, so an un-vendored or drifted node migration
+#   fails CI before merge.
+
+name: node-migration-sync
+
+on:
+  pull_request:
+    branches: [main, dev]
+  push:
+    branches: [main]
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  node-migration-sync:
+    name: node-migration-sync
+    runs-on: >-
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout omnibase_infra
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Checkout omnimarket (sibling — node migration source of truth)
+        uses: actions/checkout@v6
+        with:
+          repository: OmniNode-ai/omnimarket
+          ref: dev
+          path: omnimarket-src
+          token: ${{ secrets.OMNI_GITHUB_TOKEN || github.token }}
+          # Sparse checkout: only the node tree carrying migrations/*.sql.
+          sparse-checkout: |
+            src/omnimarket/nodes
+          sparse-checkout-cone-mode: false
+
+      - name: Run node migration vendor sync --check
+        shell: bash
+        env:
+          # The script's resolution order prefers OMNIMARKET_SRC (a repo root that
+          # contains src/omnimarket/nodes). Point it at the sibling checkout so the
+          # gate compares the vendored tree against the omnimarket dev tip and never
+          # silently passes on an unresolvable source.
+          OMNIMARKET_SRC: ${{ github.workspace }}/omnimarket-src
+        run: |
+          set -euo pipefail
+          echo "::group::node migration vendor sync --check"
+          if bash scripts/sync-node-migrations.sh --check; then
+            echo "::endgroup::"
+            echo "::notice::node migration vendor tree is in sync with omnimarket dev tip."
+          else
+            rc=$?
+            echo "::endgroup::"
+            if [[ "${rc}" -eq 2 ]]; then
+              echo "::error::Could not resolve the omnimarket source tree (exit 2). The sibling checkout is missing or empty."
+            else
+              echo "::error::Vendored node migrations under docker/migrations/forward/nodes/ are OUT OF SYNC with omnimarket. Run 'scripts/sync-node-migrations.sh' locally and commit the diff. An un-vendored node migration means its projection table will be MISSING after a clean redeploy (golden-chain run12 Finding)."
+            fi
+            exit "${rc}"
+          fi

.github/workflows/non-dev-base-guard.yml

@@ -0,0 +1,65 @@
+# SPDX-FileCopyrightText: 2026 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# OMN-13021 (retro A-6): Fail PRs whose base is neither dev nor main unless
+# the body declares an intentional stack via `Stacked-Parent: #<pr-number>`.
+#
+# Failure class: feedback_stacked_prs_orphan_from_dev — PRs #1185/#1954 were
+# auto-merged INTO parent feature branches, producing misleading MERGED states
+# and stranding the work off dev (recurrence of the June 5 incident, 3 tickets
+# stranded). Base=main is governed by main-target-guard (OMN-12243/OMN-12477).
+
+name: Non-dev base guard
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  non-dev-base-guard:
+    name: non-dev-base-guard
+    runs-on: >-
+      ${{
+        (github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 5
+
+    steps:
+      - name: Check PR base branch
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          set -euo pipefail
+
+          if [[ "${BASE_REF}" == "dev" ]]; then
+            echo "::notice::PR targets dev; guard does not apply."
+            exit 0
+          fi
+
+          if [[ "${BASE_REF}" == "main" ]]; then
+            echo "::notice::PR targets main; main-target-guard governs that path."
+            exit 0
+          fi
+
+          echo "PR targets feature base '${BASE_REF}' from head '${HEAD_REF}'."
+
+          if echo "${PR_BODY}" | grep -qE 'Stacked-Parent:[[:space:]]*#[0-9]+'; then
+            echo "::notice::Declared stacked PR (Stacked-Parent found). Allowed."
+            echo "::warning::Stacked PRs merge INTO their parent branch, not dev."
+            echo "::warning::Do NOT arm auto-merge on this PR; land the parent into dev first."
+            exit 0
+          fi
+
+          echo "::error::PR base '${BASE_REF}' is not the integration branch (dev)."
+          echo "::error::Auto-merge on this PR would fold it INTO '${BASE_REF}' and strand it off dev"
+          echo "::error::(feedback_stacked_prs_orphan_from_dev — the #1185/#1954 incident class)."
+          echo "::error::Either retarget to dev, or declare an intentional stack by adding a body line:"
+          echo "::error::  Stacked-Parent: #<parent-pr-number>"
+          exit 1

.github/workflows/reusable-runtime-boot.yml

@@ -287,13 +287,52 @@ jobs:
             echo "E2E_REDPANDA_ADVERTISE_HOST=${E2E_REDPANDA_ADVERTISE_HOST}"
           } >> "$GITHUB_ENV"
 
-          POSTGRES_PORT="${POSTGRES_PORT}" \
-          KAFKA_PORT="${KAFKA_PORT}" \
-          REDPANDA_ADMIN_PORT="${REDPANDA_ADMIN_PORT}" \
-          REDPANDA_SCHEMA_REGISTRY_PORT="${REDPANDA_SCHEMA_REGISTRY_PORT}" \
-          REDPANDA_PANDAPROXY_PORT="${REDPANDA_PANDAPROXY_PORT}" \
-          E2E_REDPANDA_ADVERTISE_HOST="${E2E_REDPANDA_ADVERTISE_HOST}" \
-            "${compose_cmd[@]}" -p "${OMNIBASE_INFRA_COMPOSE_PROJECT}" -f docker/docker-compose.e2e.yml up -d postgres redpanda
+          compose_up() {
+            POSTGRES_PORT="${POSTGRES_PORT}" \
+            KAFKA_PORT="${KAFKA_PORT}" \
+            REDPANDA_ADMIN_PORT="${REDPANDA_ADMIN_PORT}" \
+            REDPANDA_SCHEMA_REGISTRY_PORT="${REDPANDA_SCHEMA_REGISTRY_PORT}" \
+            REDPANDA_PANDAPROXY_PORT="${REDPANDA_PANDAPROXY_PORT}" \
+            E2E_REDPANDA_ADVERTISE_HOST="${E2E_REDPANDA_ADVERTISE_HOST}" \
+              "${compose_cmd[@]}" -p "${OMNIBASE_INFRA_COMPOSE_PROJECT}" -f docker/docker-compose.e2e.yml up -d postgres redpanda
+          }
+
+          retry_compose_down() {
+            "${compose_cmd[@]}" -p "${OMNIBASE_INFRA_COMPOSE_PROJECT}" -f docker/docker-compose.e2e.yml down -v --remove-orphans || true
+            docker network rm "${OMNIBASE_INFRA_NETWORK}" "${OMNIBASE_INFRA_COMPOSE_PROJECT}_default" 2>/dev/null || true
+          }
+
+          compose_started=false
+          for compose_attempt in 1 2 3; do
+            if compose_up; then
+              compose_started=true
+              break
+            fi
+            compose_status=$?
+            if [[ "${compose_attempt}" -eq 3 ]]; then
+              exit "${compose_status}"
+            fi
+            echo "::warning::compose infra bring-up failed on attempt ${compose_attempt}; repicking host ports and retrying"
+            retry_compose_down
+            export POSTGRES_PORT="$(pick_free_port)"
+            export KAFKA_PORT="$(pick_free_port)"
+            export REDPANDA_ADMIN_PORT="$(pick_free_port)"
+            export REDPANDA_SCHEMA_REGISTRY_PORT="$(pick_free_port)"
+            export REDPANDA_PANDAPROXY_PORT="$(pick_free_port)"
+            {
+              echo "POSTGRES_PORT=${POSTGRES_PORT}"
+              echo "PG_PORT=${POSTGRES_PORT}"
+              echo "KAFKA_PORT=${KAFKA_PORT}"
+              echo "REDPANDA_ADMIN_PORT=${REDPANDA_ADMIN_PORT}"
+              echo "REDPANDA_SCHEMA_REGISTRY_PORT=${REDPANDA_SCHEMA_REGISTRY_PORT}"
+              echo "REDPANDA_PANDAPROXY_PORT=${REDPANDA_PANDAPROXY_PORT}"
+            } >> "$GITHUB_ENV"
+          done
+
+          if [[ "${compose_started}" != "true" ]]; then
+            echo "::error::compose infra bring-up failed before health checks"
+            exit 1
+          fi
 
           capture_compose_infra_diagnostics() {
             {