fix(OMN-14555): vendor node_projection_context_roi 002 migration; declare node-migration-sync parity gap

[jonahgabriel]

Summary

node-migration-sync (workflow node-migration-sync.yml) has been RED dev-wide on omnibase_infra since omnimarket PR #1743 (OMN-14535, merged to omnimarket dev) added src/omnimarket/nodes/node_projection_context_roi/migrations/002_add_factor_subset_hash_and_routing_source.sql without a corresponding vendoring PR here. Confirmed independently red on unrelated PRs #2288 and #2289, neither of which touches any migration file.

Closes OMN-14555. Addresses the vendoring half of OMN-14556; see the parity decision below for the remainder.

Root cause (OMN-14555)

scripts/sync-node-migrations.sh mirrors every src/omnimarket/nodes/<node>/migrations/*.sql into docker/migrations/forward/nodes/<node>/ so the forward-migration runner can materialize the projection table on a clean redeploy. The local pre-commit hook only fires on infra commits, so an omnimarket-only PR (#1743) that adds a node migration cannot trigger it — nobody ran the sync script in omnibase_infra afterward. This is the same drift class OMN-13124 (node_projection_pattern_learning) already burned once; the gate exists specifically to catch it, and did — it just had nowhere to go (see OMN-14556).

RED → GREEN, reproduced locally:

$ OMNIMARKET_SRC=<omnimarket@dev-tip> scripts/sync-node-migrations.sh --check
[sync-node-migrations] DRIFT: node_projection_context_roi/002_add_factor_subset_hash_and_routing_source.sql
[sync-node-migrations] node migration vendor tree is OUT OF SYNC with omnimarket.
EXIT: 1

# after `scripts/sync-node-migrations.sh` (this PR's commit):
$ OMNIMARKET_SRC=<omnimarket@dev-tip> scripts/sync-node-migrations.sh --check
[sync-node-migrations] check: in sync.
EXIT: 0

Fix is the single vendored file — no other node migrations are out of sync.

Parity gap (OMN-14556) — investigated and DECIDED

Finding: node-migration-sync is structurally invisible to CI Summary, not merely "missing from its aggregation." node-migration-sync.yml is its own workflow file, triggered by the same pull_request event but running under its own run_id. ci_summary_gate.py (the CI Summary poller) only calls gh api repos/.../actions/runs/${RUN_ID}/jobs for its own run's RUN_ID — it can never see a job from a sibling workflow run. node-migration-sync is not in STRICT_GATE_JOBS, SKIPPABLE_GATE_JOBS, or SOFT_ALLOWLIST either. This corrects the OMN-14556 ticket's working hypothesis ("CI Summary's internal aggregation... may already treat it as load-bearing") — it does not, and structurally cannot.

Live proof (PR #2288, unrelated to this fix):

Check	Conclusion	Run ID
node-migration-sync	fail	29234681423
CI Summary	pass	29234681594

Different run IDs, same PR, same commit — CI Summary's pass is blind to node-migration-sync's fail. It is also absent from required_status_checks (gh api repos/OmniNode-ai/omnibase_infra/branches/dev/protection/required_status_checks --jq '.contexts') and was, until this PR, absent from scripts/enforcement_parity_manifest.yaml — invisible to all three enforcement layers at once.

Decision: it should be required — this PR does not remove or weaken it. It's a real, meaningful, deterministic drift detector (prevents exactly the class of incident that shipped OMN-13124's pattern_learning_artifacts table missing on a clean redeploy). The honest fix is to make it properly required, not to fold it into CI Summary's non-cross-workflow-visible aggregation.

What this PR does toward that: adds node-migration-sync to scripts/enforcement_parity_manifest.yaml under omnibase_infra:dev as coverage: direct (the only correct mode for a gate in its own workflow file, per the manifest's own doc comment). This makes the OMN-14288 report-only parity ratchet (scripts/audit_required_context_parity_cli.py report) surface it as [MISSING] going forward — durable, mechanized evidence instead of a one-off finding:

--- omnibase_infra:dev
  [MISSING]  node-migration-sync  (rule: OMN-14556: ...)
      declared direct gate 'node-migration-sync' absent from required_status_checks [...]

What this PR deliberately does NOT do: execute the gh api --method PUT .../branches/dev/protection mutation to actually add node-migration-sync to required_status_checks.contexts. Per this repo's own branch-protection change-control note (CLAUDE.md → "Branch protection"), that mutation should run behind the dry-run audit (scripts/audit-branch-protection.sh --repo omnibase_infra --dry-run) with an operator/main sign-off, not be executed unilaterally by the same unattended session that just made the check pass. The dry-run audit was run for context and separately surfaced 4 pre-existing Check-B mismatches unrelated to this change (push-vs-pull_request context visibility on dev's last 5 commits) — flagged, not fixed, out of scope here.

Recommended follow-up (owned by main/operator):

gh api --method PUT repos/OmniNode-ai/omnibase_infra/branches/dev/protection/required_status_checks \
  -f strict=false \
  -f 'contexts[]=CI Summary' -f 'contexts[]=Handler Contract Compliance' -f 'contexts[]=verify / verify' \
  -f 'contexts[]=call-reject-skip-token / scan / reject-skip-gate-token' -f 'contexts[]=contract-validation' \
  -f 'contexts[]=receipt-honesty' -f 'contexts[]=URL Authority Gate' -f 'contexts[]=deploy-gate / deploy-gate' \
  -f 'contexts[]=Topic Enum Drift Check' -f 'contexts[]=Topic Naming Lint' -f 'contexts[]=Topic Drift Check' \
  -f 'contexts[]=dispatcher-route-coverage' -f 'contexts[]=Canonical Inference Gate' -f 'contexts[]=Dep Provenance Gate' \
  -f 'contexts[]=node-migration-sync'

(existing 14 contexts + the one addition — re-read required_status_checks.contexts before running to confirm no drift since this was captured.)

Verification

• sync-node-migrations.sh --check: RED before, GREEN after (shown above).
• tests/scripts/test_check_deployed_migration_tree_sync.py: 9 passed (sibling regression gate untouched).
• tests/ci/test_required_context_parity.py: 32 passed (manifest schema/logic untouched by the new entry).
• scripts/audit_required_context_parity_cli.py report: confirms [MISSING] node-migration-sync for omnibase_infra:dev with the new manifest entry.
• pre-commit run --files <both changed files>: clean, including "ONEX Node Migration Vendor Sync Check" (the local hook this class of drift always evaded).

OCC companion

Owed, not authored in this PR — per the no-self-authored-evidence rule the implementer should not hand-author its own OCC receipt. Flagged to the merge controller for a companion PR in onex_change_control dev citing this PR's merge commit.

Evidence-Ticket: OMN-14555

Summary by CodeRabbit

• Bug Fixes

  • Preserved additional scoring and routing metadata to improve data completeness and consistency.

• Chores

  • Added validation coverage for required migration checks, improving deployment reliability and preventing configuration drift.

Evidence-Source: OCC#4099
Evidence-Commit: 4e0184c9e3e5b322d57c7f16b17d1dccf9efc767

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds factor_subset_hash and routing_source to context_roi_scores and declares the node-migration-sync required status check in the enforcement parity manifest.

Changes

Context ROI schema

Layer / File(s)	Summary
Add context ROI score columns docker/migrations/forward/nodes/node_projection_context_roi/002_add_factor_subset_hash_and_routing_source.sql	Adds non-null text columns with empty-string defaults using idempotent column creation.

Enforcement parity

Layer / File(s)	Summary
Declare node migration sync gate scripts/enforcement_parity_manifest.yaml	Adds the direct node-migration-sync gate declaration for the omnibase_infra development branch with its workflow observation rule.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• OmniNode-ai/omnibase_infra#1820: Introduces the node migration sync/check workflow referenced by the new parity manifest gate.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects both main changes: vendoring the migration and documenting the node-migration-sync parity gap.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-14555-migration-sync-drift

---

_{Comment @coderabbitai help to get the list of available commands.}