fix(OMN-16845): export OMNI_HOME in evidence-autoclose-sweep.yml so cwd-anchored dod_verify checks resolve

[jonahgabriel]

Summary

evidence-autoclose-sweep.yml never exported OMNI_HOME. EvidenceCollector._resolve_cwd (omnimarket) renders ${OMNI_HOME} from the process environment and requires the rendered path to exist, so every check pinned cwd: "${OMNI_HOME}/omnibase_infra" rendered to /omnibase_infra (never exists) and was recorded FAILED instead of verified — silently, since ONEX_CC_REPO_PATH was already set, so contract resolution itself never surfaced as broken.

Proven by execution, both directions, against the job's own env shape:

env -u OMNI_HOME ONEX_CC_REPO_PATH=$OMNI_HOME/onex_change_control uv run onex skill dod_verify OMN-16759
# status: failed  total_checks: 11  verified: 2  failed: 3  behavior_proving_count: 0
# [failed] cwd does not exist: '${OMNI_HOME}/omnibase_infra' -> /omnibase_infra  (x3)

Same invocation with OMNI_HOME set: status: verified failed: 0 behavior_proving_count: 3.

This is load-bearing right now: OMN-16434 (merged 2026-08-28) made render_behavior_proof_dod_evidence_item mint diff-derived behavior checks automatically with cwd: "${OMNI_HOME}/<product repo>" on every future OCC companion, so the rate of contracts carrying this exact guaranteed-CI-failing check goes up from here, not down.

Fix

GitHub Actions checks a repo out to <runner-work-dir>/<repo>/<repo> (the documented github.workspace convention — GitHub's own docs give /home/runner/work/my-repo-name/my-repo-name as the canonical example). So github.workspace's own parent directory already satisfies ${OMNI_HOME}/omnibase_infra == github.workspace exactly, using the real checkout — no symlink, no second checkout.

A symlink farm was considered and rejected: _resolve_cwd's containment check (candidate.is_relative_to(OMNI_HOME), evaluated after Path.resolve()) follows a symlink to its real target and rejects it if that target sits outside OMNI_HOME. A fabricated OMNI_HOME containing a symlink pointing at the real checkout (which would live outside it) would fail that check.

A new step derives and exports OMNI_HOME=$(dirname "$GITHUB_WORKSPACE") via $GITHUB_ENV, placed right after the initial checkout so every later step (including the diagnose step and the sweep step, which shells out to uv run onex skill dod_verify <ticket> per bound ticket) inherits it. Fail-fast, not a silent default (CLAUDE.md rule 8): the step asserts the derived path actually places omnibase_infra at github.workspace before exporting, and errors loudly (::error:: + exit 1) instead of exporting an unverified guess.

Tests

Adds tests/unit/nodes/node_evidence_autoclose_sweep_effect/test_omn_16845_omni_home_wiring.py, mirroring the existing test_omn_16792_kill_switch_wiring.py pattern (this class of defect is only visible by parsing the committed workflow — it's wiring, not behavior):

• a step exports OMNI_HOME to $GITHUB_ENV
• that export happens before every step invoking dod_verify / evidence_autoclose_sweep
• the export step fails fast (asserts + exit 1) rather than exporting an unverified guess

Confirmed RED against the unfixed workflow file, GREEN after the fix (both runs captured in-session).

Verification

• uv run pytest tests/unit/nodes/node_evidence_autoclose_sweep_effect/ -v — 92 passed (89 pre-existing + 3 new)
• uv run mypy tests/unit/nodes/node_evidence_autoclose_sweep_effect/test_omn_16845_omni_home_wiring.py --strict — no issues
• pre-commit run --all-files — all hooks passed, zero failures
• actionlint .github/workflows/evidence-autoclose-sweep.yml — same pre-existing shellcheck style note as the unmodified file (unrelated to this change), no new findings
• governed pre-push impacted-test selector escalated to the full suite (narrowing not provable safe for a .github/workflows/*.yml + test change) — 6067 passed, 3 skipped, 0 failed

OMN-16845 (scoped to the mechanical env-wiring fix — AC3 SKIPPED-not-FAILED reclassification and AC5 live-dispatch-dry-run proof are separate follow-on work per the ticket's own scope note).

Test plan

• uv run pytest tests/unit/nodes/node_evidence_autoclose_sweep_effect/ -v
• pre-commit run --all-files
• governed pre-push selector (full-suite escalation), green
• confirm the merged workflow's next scheduled run (or a workflow_dispatch with diagnose_tickets set) shows behavior_proving_count > 0 and zero cwd does not exist for OMN-16759 / OMN-16790 / OMN-16784 / OMN-16785

Evidence-Ticket: OMN-16845
Evidence-Source: OCC#7426

[coderabbitai]

Warning

Review limit reached

Next included review available in 9 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 131 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1305c0a4-dce2-4b89-8607-f34d3975e515

📥 Commits

Reviewing files that changed from the base of the PR and between 8ff6f9b and 5d5abc0.

📒 Files selected for processing (2)

• .github/workflows/evidence-autoclose-sweep.yml
• tests/unit/nodes/node_evidence_autoclose_sweep_effect/test_omn_16845_omni_home_wiring.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Blocking findings (critical): 0
Total findings: 0
Models succeeded: none

Note: All reviewer models failed or were unavailable. Degraded results are informational during the pilot phase (OMN-8468/OMN-8524) and do not block merge. Error: all review endpoints [192.168.86.201:8000 192.168.86.201:8000 ] unreachable — preflight short-circuit (no models available)

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical findings	No
blocked	CRITICAL findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review (OMN-8468/OMN-8524)