fix(OMN-14531): close the omnimarket drift guard's fail-open blind spot

[jonahgabriel]

Summary

OMN-14531 (detector-shelf unblinding): the onex:aislop_sweep skill's only
documented dispatch path — uv run onex skill aislop_sweep — was
hard-failing with Unknown node 'node_aislop_sweep' because omnimarket
(the co-installed provider of onex.nodes entry points for market nodes,
including node_aislop_sweep) was completely absent from the
omnibase_infra venv on this operator's machine. This is the OMN-13829 →
OMN-14060 recurrence going one step further: the co-install regressed from
"stale" to "gone", and nothing caught it.

Two compounding gaps in omnimarket_drift_guard.py / cli_skill.py let
this go undetected instead of failing loud:

1. check_omnimarket_drift() failed open on "not installed" unconditionally.
   It returned silently whenever installed_omnimarket_commit() was None,
   even when a canonical $OMNI_HOME/omnimarket clone WAS present and
   reachable — a determinable, actionable state, not the "can't reason about
   it" case the fail-open design exists for. Reordered the checks: canonical
   clone absent → still fails open (CI, fresh machines, unchanged). Canonical
   clone present + omnimarket absent/non-VCS → now raises
   OmnimarketDriftError naming the exact repair command.
2. --omni-home had no envvar binding. Even with gap (1) fixed, the
   guard never received a real value in normal usage: callers never pass
   --omni-home explicitly, and exporting $OMNI_HOME in the shell had zero
   effect on the CLI. Bound the option to the OMNI_HOME environment
   variable so the guard is actually reachable without an undocumented flag.

Also includes an unrelated, pre-existing chore commit: vendoring
node_projection_context_roi/002_...sql to satisfy the local
onex-check-node-migration-sync pre-commit hook (repo-wide drift introduced
by OMN-14535, already fixed for real in omnibase_infra#2290 / OMN-14555,
not yet merged to dev). This hook is not a required GitHub status check
(confirmed live in ROLLING_WORK_LEDGER 2026-07-13), so it has no bearing on
mergeability — it only unblocks the local commit gate for the actual fix in
this PR. Expected to be a no-op once #2290 merges and this branch rebases.

RED → GREEN evidence (dod_evidence)

Manually reproduced against the real onex CLI (the exact uv run onex skill aislop_sweep path documented in plugins/onex/skills/aislop_sweep/):

BEFORE (omnimarket absent from the omnibase_infra venv):

$ uv run onex skill aislop_sweep --target-dirs <node_aislop_sweep source> --dry-run
Error: Unknown node 'node_aislop_sweep'. Known nodes: node_architecture_validator, ...
exit 1

AFTER (scripts/install-node-skill-package.sh --execute repairs the
venv; this PR's fix is what makes the failure loud/actionable instead of a
silent, unhelpful "Unknown node" wall of text next time it drifts):

$ uv run onex skill aislop_sweep --target-dirs <node_aislop_sweep source> --dry-run
exit 0
{"status":"success", ..., "result":{"findings":[
  {"check":"prohibited-patterns","message":"Prohibited pattern: ONEX_EVENT_BUS_TYPE=inmemory", "severity":"CRITICAL", ...},
  ... 11 findings total ...
], "repos_scanned":1, "status":"findings", "dry_run":true}}

repos_scanned=1, 11 real findings including CRITICAL-severity hits — the
handler and dispatch pipeline were never broken; only the venv provisioning
and this guard's blind spot were.

Automated regression coverage (new, both pass RED→GREEN against the prior
code):

• test_drift_check_raises_when_not_installed_but_canonical_clone_present —
  fails under the old unconditional fail-open code, passes under the fix.
• test_omnimarket_drift_guard.py full suite: 14 passed.
• test_cli_skill.py full suite (with a new autouse fixture keeping
  command-wiring tests hermetic against the now-live --omni-home envvar):
  341 passed, 19 skipped (pre-existing omnimarket-not-in-CI-venv skips,
  unrelated).

Local gates: ruff format --check / ruff check / mypy clean on touched
files; full pre-commit run clean.

Known related gap (out of scope for this PR)

cli_node.py (onex node / onex run) has NO drift-guard call at all —
the runbook's own documented symptom example (onex run-node node_pr_lifecycle_orchestrator) uses that exact path. aislop_sweep is
only reachable via onex skill, so this PR stays scoped there; flagging for
a follow-up ticket.

Evidence-Ticket: OMN-14531

OCC Evidence

Evidence-Source: OCC#4103
Evidence-Ticket: OMN-14531
Evidence-Commit: 798602635940a856f78f13d126406578e770e1f6

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 37 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8ff3b190-6795-4189-9f72-e85a0a0f51b4

📥 Commits

Reviewing files that changed from the base of the PR and between 79c97d5 and d8b5e4c.

📒 Files selected for processing (5)

• docker/migrations/forward/nodes/node_projection_context_roi/002_add_factor_subset_hash_and_routing_source.sql
• src/omnibase_infra/cli/cli_skill.py
• src/omnibase_infra/cli/omnimarket_drift_guard.py
• tests/unit/cli/test_cli_skill.py
• tests/unit/cli/test_omnimarket_drift_guard.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-14531-aislop-sweep-dispatch

---

_{Comment @coderabbitai help to get the list of available commands.}