fix(OMN-16076): resolve changed-SQL base from push event context, not a hardcoded pin

[jonahgabriel]

Ticket

OMN-16076

Problem

The main-branch post-merge CI run 31896443679 (push event, merge commit ecc061c9) failed in Application Database Domain Enforcement at the "Enforce schema qualification in changed SQL (trusted)" step:

RuntimeError: cannot resolve changed SQL range: fatal: Invalid symmetric difference expression 7228ce0c0934ae096dd6effd0f84ff1913fec6c0...HEAD

On push events the step's base-revision expression has neither pull_request.base.sha nor merge_group.base_sha, so it fell back to a hardcoded SHA. That SHA is the squash-merge commit of PR #2571 into a since-deleted stacked feature branch — it never entered dev's or main's commit graph and is unreachable from every remote branch head, so even fetch-depth: 0 cannot fetch it. Every push to main (each promotion) would re-fail deterministically; the same gate passed on the promotion PR because PR events use the real PR base.

Fix

• .github/workflows/ci.yml: base falls back to github.event.before on push events — for a promotion merge that is exactly the promotion PR's base, so the push verdict reproduces the proven PR-event verdict. No hardcoded SHA remains (same principle as the neighboring live-resolve step: fail loudly, never a stale pin).
• scripts/ci/check_application_database_sql.py: _assert_base_revision_resolvable() validates the base before diffing — empty, all-zeros, or unreachable-in-checkout bases now fail with an actionable message naming the expected event-context sources instead of a raw git fatal.
• Regression tests (5): push-event-shaped previous-commit base resolves; empty/zero/unreachable bases raise with remediation; a workflow assertion holds APPLICATION_SQL_BASE_REVISION to zero 40-hex literals and requires the github.event.before fallback.
• pyproject.toml 0.38.6 → 0.38.7 (+ uv.lock): v0.38.6 published today; the strict release-identity fitness gate requires the working version to be ahead of the latest published tag and was failing repo-wide on dev pre-push. This is the gate's own stated remediation and unblocks all open lanes.

Seams

• ci.yml env APPLICATION_SQL_BASE_REVISION (string SHA from event context) → script --base-revision arg: matched; the committed workflow-assertion test drives this seam (reads the real ci.yml, asserts the expression shape the script's validation contract expects).
• Script error contract: RuntimeError with event context / hardcoded pin phrasing; covered by three new tests.

dod_evidence

• Failing evidence: run 31896443679 job 95040451786 log (verbatim traceback above); gh api proof the pinned SHA is contained by zero remote branches.
• Green evidence: full local suite via governed pre-push selector: 23,48x passed / 0 failed (escalated to full suite by the pyproject change); focused gate suite 27/27 including the 5 new regressions.
• proof_class: receipt-bound (CI green on this PR pending); deployed-class proof lands on the next dev→main promotion push, which is the event this fix targets.

Evidence

Evidence-Ticket: OMN-16076
Evidence-Source: OCC#6523

Evidence-Source companion onex_change_control#6523 is MERGED (5a2639217), so the cited evidence is resolvable from OCC dev: contracts/OMN-16076.yaml + PASS receipts drift/dod_receipts/OMN-16076/dod-OmniNode-ai-omnibase_infra-pr-2754/command.yaml (exact-head content probe) and drift/dod_receipts/OMN-16076/occ-self-bind-pr-6523/command.yaml.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 8 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f46d7dbc-d340-467d-b55b-819b422224ec

📥 Commits

Reviewing files that changed from the base of the PR and between 186ab8d and 043ca62.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• docker/runners/runner-image.lock.json
• pyproject.toml
• scripts/ci/check_application_database_sql.py
• tests/ci/test_application_database_sql_gate.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

❓ Hostile Reviewer — UNKNOWN

Blocking findings (critical): 0
Total findings: 0
Models succeeded: none

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical findings	No
blocked	CRITICAL findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8468/OMN-8524)