[jonahgabriel]

What

Item 4's DERIVABLE finding — vendored half. Source-of-truth migration lands in omnimarket (companion PR OmniNode-ai/omnimarket#2021, src/omnimarket/nodes/node_projection_registration/migrations/0004_node_service_registry_no_force_rls.sql, byte-identical to the copy here) per this repo's own vendoring architecture (scripts/sync-node-migrations.sh).

ALTER TABLE node_service_registry NO FORCE ROW LEVEL SECURITY reverses only the FORCE half of 0002_node_service_registry_tenant_rls.sql. node_service_registry is contract-declared omninode_internal domain (node_projection_registration/contract.yaml db_io.schema, and this repo's own application-migrations.tsv ledger classification for the whole node), corroborated by the 2026-08-02 operator domain ruling and OMN-15656's landed grants-derivation correction. FORCE on internal registry state is the wrong posture — 0002 stamped a DEFAULT 'omninode' single-tenant value with no real multi-tenant partition, and FORCE constrains even the table owner (the OMN-15301 write-lockout hazard). Idempotent (to_regclass guard): the registration trio is still operator-fenced by default, so a fenced database has no node_service_registry table at all.

Does not need a fenced-node-migrations.yaml entry: the OMN-15336 item-4 unclassified-FORCE-RLS guard (PR #2666, separate branch) only refuses migrations that enable FORCE ROW LEVEL SECURITY without a fence citation. NO FORCE is the disabling form and is explicitly excluded from that guard's match.

Merge order

omnimarket#2021's node-migration-vendor-parity-gate requires this repo's vendored copy at dev tip before it can pass. This PR merges first; omnimarket#2021 second.

Evidence

$ OMNIMARKET_SRC=<omnimarket branch with #2021's commit> bash scripts/sync-node-migrations.sh --check
[sync-node-migrations] check: in sync.

$ OMNIMARKET_SRC=<same> uv run pytest tests/unit/scripts/validation/test_application_migration_manifest.py -q
8 passed in 0.13s

$ OMNIMARKET_SRC=<same> uv run pytest tests/unit/migrations/ tests/ci/test_legacy_rds_fixture_contract.py -q
66 passed in 14.96s

Pre-push governed selector (full tests/unit/, escalated because the ledger tsv is a shared file; OMNIMARKET_SRC set so the vendor-sync assertion resolves against the paired branch instead of the not-yet-merged canonical omnimarket clone): 23172 passed, 36 skipped in ~567s.

test_application_migration_manifest.py's pinned declaration count updated 94 → 95 for the new manifest row.

OMN-15336 (item 4)

Node-Migration-Source-Ref: dev

(Updated 2026-08-08: omnimarket#2021 merged 2026-08-07T23:46:01Z and its branch was deleted post-merge, so the node-migration-sync gate's sibling checkout could no longer resolve jonah/omn-15336-node-service-registry-no-force-rls in omnimarket (404). The migration is now on omnimarket dev tip, so pinning to dev resolves correctly.)

Summary by CodeRabbit

• Bug Fixes

  • Updated database security behavior so row-level security remains enabled without forcing it on table owners.
  • Migration completes safely when the target table is unavailable.

• Tests

  • Updated migration validation checks to include the newly added migration.

Evidence-Ticket: OMN-15336
Evidence-Source: OCC#6167
Evidence-Head: ee979582745e8cc968a9dc3f996a44638e3b6f8e

[jonahgabriel]

Companion PR: OmniNode-ai/omnimarket#2021 (source-of-truth migration). Merge order: this PR first, #2021 second.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 25 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c32fc9cc-cc35-4215-b33c-adbb00991c9d

📥 Commits

Reviewing files that changed from the base of the PR and between d1abe39 and d249f9c.

📒 Files selected for processing (1)

• tests/unit/migrations/test_node_migration_discovery.py

📝 Walkthrough

Walkthrough

The PR adds a conditional migration that removes FORCE ROW LEVEL SECURITY from public.node_service_registry when present. It preserves RLS and existing policies. The migration manifest test now expects 95 declarations.

Changes

Node service registry RLS

Layer / File(s)	Summary
RLS migration and manifest validation docker/migrations/forward/nodes/node_projection_registration/0004_node_service_registry_no_force_rls.sql, tests/unit/scripts/validation/test_application_migration_manifest.py	The migration removes forced RLS when the table exists and emits a notice when it does not. The manifest test expects the added migration.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• OmniNode-ai/omnibase_infra#2633: Adds related tenant and RLS migration vendoring with manifest updates.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the vendored migration that removes FORCE ROW LEVEL SECURITY from node_service_registry.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-15336-node-service-registry-no-force-rls-vendor

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@docker/migrations/forward/nodes/node_projection_registration/0004_node_service_registry_no_force_rls.sql`:
- Around line 49-50: Update the ALTER TABLE statement in the
node_service_registry migration to target public.node_service_registry
explicitly, while preserving the existing to_regclass guard and NO FORCE ROW
LEVEL SECURITY operation.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bdfa7495-4856-4c7c-97f8-4795ef7b6285

📥 Commits

Reviewing files that changed from the base of the PR and between d1c5927 and d1abe39.

⛔ Files ignored due to path filters (1)

• docker/migrations/forward/_ledger/application-migrations.tsv is excluded by !**/*.tsv

📒 Files selected for processing (2)

• docker/migrations/forward/nodes/node_projection_registration/0004_node_service_registry_no_force_rls.sql
• tests/unit/scripts/validation/test_application_migration_manifest.py

[onexbot-occ-writer]

OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required.

[jonahgabriel]

Temporarily closed to relieve CI runner-fleet congestion (merge-sweep 2026-08-08, operator-approved — see ROLLING_WORK_LEDGER [mergesweep-0808-close]). Nothing is lost: branch, commits, and review state remain; this PR will be reopened in batches once the queue drains (reopen order recorded in the ledger).

[jonahgabriel]

Reopening (batch per [mergesweep-0808-close] reopen plan) — CI queue has drained.

[github-actions]

✅ Hostile Reviewer — PASSED

Blocking findings (critical): 0
Total findings: 0
Models succeeded: qwen3-review,qwen3-review-b

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical findings	No
blocked	CRITICAL findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8468/OMN-8524)