fix(OMN-13405): workspace build vendors omnibase_core from dev-HEAD clone

[jonahgabriel]

OMN-13405 — Workspace build vendors omnibase_core from the dev-HEAD clone

Closes the dev cold-bring-up blocker surfaced by Runtime E2E Closeout Phase 2 (v4): projection-api + omninode-runtime crash-looped with ModuleNotFoundError: omnibase_core.enums.enum_correction_failure_axis.

Problem (verified)

The workspace-mode runtime image installed omnibase_core only from omnibase_infra/uv.lock + pyproject.toml [tool.uv.sources] — a git rev (d6e9c3d, released-tag 0.45.0) that predates dev-only core enum modules. omnimarket dev (7e970f1e) imports omnibase_core.enums.enum_correction_failure_axis.EnumCorrectionFailureAxis at module-import time (omnimarket/intelligence/events.py), so the enum-less lock wheel crash-looped omnimarket-projection-api (12 restarts) and the runtime kernel never reached healthy.

The dev omnibase_core clone (8a53a063, label 0.45.0, has the enum — added by OMN-13234/OMN-12846) was never installed: the workspace sibling loop only vendored omnibase_compat/onex_change_control/omnimarket (omnimarket installed --no-deps, so its correct core pin was never honored). d6e9c3d and 8a53a063 both carry version 0.45.0 (version-never-bumped), so no version-mismatch guard caught it.

Evidence: .onex_state/runtime-e2e-2026-06-21/02-dev-deploy/v4-evidence/CAPTURE.md + a6/diagnosis.md.

Fix (workspace mode only; no PyPI release)

1. scripts/runtime_build/stage_workspace.sh — stage omnibase_core (first) into the build context.
2. docker/Dockerfile.runtime (workspace branch) — after uv sync, reinstall core from the staged dev tree. Defeating [tool.uv.sources] (which forces the git rev even with a @ file:// ref) requires running the install from / (no project scope) with --no-sources, an explicit omnibase-core @ file:///workspace/sibling-repos/omnibase_core direct reference, --no-cache (bypass the cached git wheel in the BuildKit uv cache mount), and --reinstall-package omnibase-core. release mode is unchanged — core still comes from the lock.
3. scripts/runtime_build/compute_workspace_provenance.py — add omnibase_core to WORKSPACE_PACKAGES so the build asserts core was installed from a local path (file://); a future regression (core silently reverting to the git wheel) now fails the build, not at runtime.

Proof — cold dev-lane bring-up came up HEALTHY

Workspace build on .201 (infra db3ae8527b, core 8a53a063, market 7e970f1e):

• Building omnibase-core @ file:///workspace/sibling-repos/omnibase_core → + omnibase-core==0.45.0 (from file:///…); All 4 workspace provenance proofs passed.
• New omnibase-infra-omninode-runtime:latest (sha256:d68b8972202c…) imports omnibase_core.enums.enum_correction_failure_axis and omnimarket.intelligence.events.ModelUserCorrectionEvent; core direct_url.json = file:///workspace/sibling-repos/omnibase_core.

Cold --profile runtime bring-up (project omnibase-infra):

• omninode-runtime running/healthy restarts=0, /health 8085 = 200.
• omninode-runtime-effects running/healthy restarts=0.
• omnimarket-projection-api running/healthy restarts=0, /health = 200, NOT crash-looping (the v4 ModuleNotFoundError is GONE).
• RUNTIME_SOURCE_HASH=db3ae8527b5f == infra dev short.
• broker = EventBusKafka (NOT InMemory), Redpanda cluster redpanda.23e7aed5-…, host :19092.
• migration ledger: node:node_projection_delegation:0017/0018/0019 applied (0007–0019 all applied).
• delegation_events / generation_events queryable.
• stability-test / prod / judge lanes untouched.

dev infisical :8880 collision with stability is non-blocking (runtime data path independent); the runtime tier was started with up -d --no-deps.

dod_evidence

Cited contract: contracts/OMN-13405.yaml.

• dod-001 — workspace build installs core local-path (file://), build-provenance passes:
  uv run pytest tests/scripts/test_deploy_runtime_build_context.py tests/scripts/test_check_sibling_lock_pins.py -q → 15 passed.
• dod-002 — new image imports the enum + omnimarket events; cold dev bring-up HEALTHY (projection-api restarts=0, /health 200).
  Evidence: .onex_state/runtime-e2e-2026-06-21/02-dev-deploy/a6/CAPTURE.md + build.log.
• ruff format/ruff check clean; pre-commit run --files <changed> → all hooks Passed/Skipped.

Evidence-Source: be26de8ad29bc431fecd0f851ec5240b5cba52ef
Evidence-Ticket: OMN-13405

OCC receipt pairing

Paired OCC PR: OmniNode-ai/onex_change_control#2875 (evidence(OMN-13405)), carrying contracts/OMN-13405.yaml + PASS dod_receipts. Evidence-Source pins the merged OCC squash commit (= OCC dev HEAD) rather than the OCC PR number, to avoid the dead pre-squash head tripping the Receipt Gate ancestry check in the merge_group context.

[coderabbitai]

Warning

Review limit reached

@jonahgabriel, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 7 minutes and 42 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e7c42e7c-a7b6-4f5d-b544-31d6b00cde7b

📥 Commits

Reviewing files that changed from the base of the PR and between a1ad98c and a7c7f47.

📒 Files selected for processing (1)

• contracts/OMN-13405.yaml

📝 Walkthrough

Walkthrough

Adds a new contracts/OMN-13405.yaml contract specifying that the workspace-mode runtime image must install omnibase_core from the staged dev-HEAD filesystem path. stage_workspace.sh is updated to list omnibase_core first in SIBLING_REPOS, and Dockerfile.runtime gains logic to uninstall the lock-pinned wheel and force-reinstall from the staged dev tree. Supporting comments are added to compute_workspace_provenance.py.

Changes

omnibase_core workspace-mode dev-HEAD reinstall (OMN-13405)

Layer / File(s)	Summary
OMN-13405 contract and DOD evidence contracts/OMN-13405.yaml	New contract defining workspace-vs-wheel install evidence requirements, runtime import/health DOD blocks (dod-001, dod-002), and CI pipeline green check.
Stage omnibase_core first in sibling-repo array scripts/runtime_build/stage_workspace.sh	Reorders SIBLING_REPOS to place omnibase_core at the head with an OMN-13405 comment explaining the required staging order before compat/occ/omnimarket.
Dockerfile workspace-mode uninstall and forced reinstall docker/Dockerfile.runtime	Adds a comment block documenting the file:// reinstall constraints, then extends workspace-mode logic to check for the staged directory, uninstall the existing wheel, and reinstall from the staged dev path using uv pip with --no-deps, --no-sources, --no-cache, and --reinstall-package executed from /.
Provenance script annotation scripts/runtime_build/compute_workspace_provenance.py	Adds an OMN-13405 comment block in WORKSPACE_PACKAGES describing omnibase_core special provisioning and fail-fast verification behavior; no code logic changed.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• OmniNode-ai/omnibase_infra#1889: Wires up the same workspace runtime build flow via deploy-runtime.sh and scripts/runtime_build/stage_workspace.sh, directly overlapping with the staging order and install mechanism changed here.
• OmniNode-ai/omnibase_infra#1891: Updates the pinned omnibase-core source revision in pyproject.toml/lock, targeting the same runtime core dependency wiring that this PR overrides with a dev-HEAD staged reinstall.

Poem

🐰 A wheel once pinned had too few enums inside,
So I staged the dev tree and let it reside.
SIBLING_REPOS reordered, core goes in first,
--no-cache --reinstall to quench import thirst!
The contract is filed, the DOD is clear —
dev-HEAD omnibase_core is finally here. 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: fixing a workspace build issue by vendoring omnibase_core from a dev-HEAD clone, which directly addresses the core problem described in PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-13405-workspace-vendor-core-dev-head

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jonahgabriel]

Merge-sweep maintenance: briefly cycling PR state to trigger required pull_request checks on the current head after OCC evidence metadata was updated; reopening immediately.

[jonahgabriel]

Reopened to let required pull_request checks run on current head for merge-queue eligibility.

[jonahgabriel]

Merge-sweep blocker: dequeued after queue accepted the PR but remained at AWAITING_CHECKS with head status rollup FAILURE.

Observed failing workflow on head a7c7f47e8963cbef2dcc9178b86932884549a883:

• Docker Build / Build Runtime Image: https://github.com/OmniNode-ai/omnibase_infra/actions/runs/27901570937/job/82562766088
• Docker Build / Build Summary: https://github.com/OmniNode-ai/omnibase_infra/actions/runs/27901570937/job/82563429932

Failure signature from the runtime image build:
claude --version exits with Error: claude native binary not installed. after installing @anthropic-ai/claude-code@2.1.181.

Receipt, CR thread gate, CI Summary, Handler Contract Compliance, and skip-token gates are green. This appears to be runtime image/release integration fallout, so I am leaving it for the integration workstream rather than patching it in the merge-sweep lane.