feat(OMN-16930): derive the tenant_registry_mirror TABLE grant from the released omnimarket contract

[jonahgabriel]

What

Leg 3 of the OMN-16804 chain. Regenerates the application-database TABLE grants from node contracts so tenant_registry_mirror — the runtime-populated slug→UUID mirror OMN-16930 introduced — is granted rather than ungranted.

omnimarket 0.4.12 (tag v0.4.12 → 4dcd92ee5f6a7d21339e0f3d599bc1fe94d357f1, the squash of omnimarket#2238) is the first build carrying node_projection_tenant_registry/contract.yaml, so its db_io.db_tables declaration can now be projected into the shipped topology.

Refs: OMN-16930, OMN-16804, OMN-17019

How — regenerated, never hand-listed

scripts/generate_application_database_table_grants.py --write \
  --contracts-root <omnimarket@v0.4.12>/src/omnimarket/nodes
scripts/render_application_database_topology.py --environment <e> \
  --output docker/catalog/database-topology/<e>.yaml     # all 7 environments

Proof — the same invocation CI runs

grant derivation check: 3 instance(s) in sync
profile=judge           PASS=54 FAIL=0 RESIDUAL=0
profile=local           PASS=54 FAIL=0 RESIDUAL=0
profile=onex-dev        PASS=54 FAIL=0 RESIDUAL=0
profile=onex-prod       PASS=54 FAIL=0 RESIDUAL=0
profile=prod            PASS=54 FAIL=0 RESIDUAL=0
profile=stability-test  PASS=54 FAIL=0 RESIDUAL=0
profile=test            PASS=54 FAIL=0 RESIDUAL=0

tests/unit/topology: 152 passed

Forward-proven against the consumer, not just against itself. Re-ran --check --prove with --contracts-root pointed at omnimarket#2239's tree (the reader side of this chain, which adds node_projection_delegation's access: read declaration of the same relation): 3 instances in sync, PASS=54 FAIL=0 on all seven profiles, 68 declarations loaded. So these grants are already complete for the reader too — no second regeneration is needed when #2239 lands.

That forward-proof is what caught a real defect in the reader: #2239 originally declared the relation schema: public, which has domain PUBLIC, which table_grant_derivation.DOMAIN_PROJECTION_BINDINGS does not map (only TENANT and OMNINODE_INTERNAL), so it derived no binding and therefore no grant — unfixable by regeneration. Corrected there to omninode_internal (omnimarket#2239, commit 21ff02a7), matching the owning node and OMN-16930's own classification ruling.

open_obligations is removed, and that is the derivation being honest

This is the one reviewable judgement in the PR, so it is stated plainly rather than buried in the diff.

omnibase_infra#3046 (OMN-17019, merged 03:01:45Z, current dev tip 3af68989b) added an open_obligations TABLE grant whose source contract is not on omnimarket dev. It landed using the branch escape hatch in its PR body:

a body trailer naming jonah/omn-17019-obligation-projection as the omnimarket source ref,
so its own run of this gate derived grants from omnimarket#2227's unmerged branch and passed legitimately. #2227 is still open and currently CONFLICTING/DIRTY against dev.

The consequence is mechanical, not a preference. This job runs --check --prove against .proof-dependencies/omnimarket at live omnimarket dev HEAD for any PR without that trailer, and --check fails in both directions — a contract-declared table with no grant, and a granted table no contract declares. Verified empirically before touching anything: --check on pristine dev HEAD already reported all three instances drifted.

So this branch takes the honest option. Per the generator's own docstring — "this script is the only sanctioned way to write them. Hand-listing is what ADR-0027 exists to remove" — a grant no merged contract declares does not survive a regeneration. Preserving it by hand would be exactly the hand-listing ADR-0027 removed, and would still fail the gate.

Nothing live breaks. node_projection_open_obligations has no contract on omnimarket dev, so no writer exists to be denied. docker/migrations/forward/nodes/node_projection_open_obligations/0001_create_open_obligations.sql is untouched.

When omnimarket#2227 merges, a regeneration re-derives the grant from the then-merged contract. That regeneration was already required by this gate regardless of this PR — the same --check would have failed in the opposite direction the moment #2227 landed. Recorded on omnimarket#2227 so that lane is not surprised.

Two process observations (neither blocks this PR)

1. The source-ref trailer lets a grant derived from an unmerged branch land on dev, leaving dev in a state where every subsequent unrelated PR either reverts that grant or fails the gate. Worth making the trailer carry a follow-up obligation rather than leaving the cost to whoever regenerates next.

2. scripts/resolve_node_migration_source_ref.py matches the trailer anywhere in the PR body, including inside fenced code blocks. The first revision of this very PR body quoted #3046's trailer verbatim in a fenced block to explain it — and thereby hijacked its own derivation, checking omnimarket out at jonah/omn-17019-obligation-projection instead of dev:

HEAD is now at ... -B jonah/omn-17019-obligation-projection

which produced a confusing, entirely self-inflicted failure (node_projection_open_obligations ... lacks declared write privileges) on a PR whose whole point is that that contract is not on dev. _parse_ref does line.strip().lower().startswith(prefix) with no fence tracking, so a PR that merely documents the mechanism silently changes its own behaviour. Worth ignoring fenced regions, or requiring the trailer in a trailing block the way git trailers work.

Scope

Generated files only — 3 topology instances + 7 rendered catalogs. No source, no migration, no runtime, no lane, no prod contact.

Evidence-Source: OCC#7791
Evidence-Ticket: OMN-16930

[coderabbitai]

Warning

Review limit reached

Next included review available in 3 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 137 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8a26a407-0d57-4c32-a405-28d3297decfc

📥 Commits

Reviewing files that changed from the base of the PR and between 3af6898 and 786f90b.

📒 Files selected for processing (10)

• docker/catalog/database-topology/judge.yaml
• docker/catalog/database-topology/local.yaml
• docker/catalog/database-topology/onex-dev.yaml
• docker/catalog/database-topology/onex-prod.yaml
• docker/catalog/database-topology/prod.yaml
• docker/catalog/database-topology/stability-test.yaml
• docker/catalog/database-topology/test.yaml
• src/omnibase_infra/topology/instances/local.yaml
• src/omnibase_infra/topology/instances/onex-dev.yaml
• src/omnibase_infra/topology/instances/onex-prod.yaml

---

_{Comment @coderabbitai help to get the list of available commands.}

[onexbot-occ-writer]

OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required.

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Blocking findings (critical): 0
Total findings: 0
Models succeeded: none

Note: All reviewer models failed or were unavailable. Degraded results are informational during the pilot phase (OMN-8468/OMN-8524) and do not block merge. Error: all review endpoints [192.168.86.201:8000 192.168.86.201:8000 ] unreachable — preflight short-circuit (no models available)

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical findings	No
blocked	CRITICAL findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review (OMN-8468/OMN-8524)