[jonahgabriel]

OMN-17440

The topology declares, per principal, the exact relation set that principal may read and write. That block is generated from node contract db_io.db_tables declarations. Nothing has ever checked that a migration ISSUES those grants against a real database, and for 40 of the 65 declared pairs, none did.

The .201 dev lane holds most of them live only because they were granted out of band, by hand. A lane that has never been hand-patched — a fresh staging namespace, a rebuilt onex-dev, prod — gets none of them, and every projection writing those relations refuses on first traffic with InsufficientPrivilege while the runtime reports healthy and commits its offsets.

Five instances of this class in a fortnight: OMN-15701, OMN-16436, OMN-16993, OMN-17290, OMN-17374.

What this delivers

13 grants across 8 owning node lineages, ratchet 40 → 27.

Node	Relations
node_contract_registry/0001	contract_registry
node_merge_state_projection/0002	merge_state_transitions
node_omnigate_projection/0001	gate_activity, gate_metrics
node_pr_lifecycle_state_reducer/0002	pr_lifecycle_ledger_entries
node_projection_baselines/0003	breakdown, comparisons, snapshots, trend
node_projection_intent_classification/0002	intent_classification_events
node_projection_overnight/0002	session_phases, sessions
node_projection_receipt_gate/0001	receipt_gate_rows

Each grant lands in its owning node's lineage next to the file that creates the relation — the node_projection_session_replay/0002 / node_projection_tenant_registry/0001 convention — and deliberately not in one bulk grant file. A shared grant block is the shape that let OMN-15701 revert eight grants at once.

The tranche is chosen mechanically, not by taste: the nodes OMN-17447 derived as sequence-backed, i.e. where a TABLE grant alone still cannot write. merge_state_transitions, pr_lifecycle_ledger_entries and receipt_gate_rows are the three OMN-17377 measured at zero rows and OMN-17379 proved refusing on the real wired path.

dod_evidence

Proven on a scratch Postgres against real bytes and the real creating migrations (all 10 applied first), not asserted:

• BEFORE — 13/13 insert=false select=false
• AFTER — 13/13 insert/select/update=true, delete=false (a projection writer upserts, it does not reshape)
• every migration's own fail-loud 1/count(*) assertions passed in that run
• source↔vendor byte-identical, sha256-verified per file; sync-node-migrations.sh --check → in sync
• check_topology_grant_delivery.py → 27 undelivered (bound 27), exit 0
• tests/ci/test_topology_grant_delivery.py + test_application_migration_manifest.py → 41 passed
• governed pre-push: h101 ran 28821 tests green on 1a9d8586ac19 (suite log sha256 592e109f62e06f8f11ea2e9eda9e25576f19f5d60047c1e463555d068c7cc087, 1578s)

No live lane touched; the scratch container was destroyed and no residue kept.

Correction to OMN-17447, found by that replay

Its derived list calls the three baselines_* child tables BIGSERIAL, having read the CREATE in node_projection_baselines/0001. 0002 DROPs and recreates all three with id TEXT PRIMARY KEY, so in the applied end state they carry no sequence — pg_get_serial_sequence returns NULL and pg_attrdef reads default=NONE. Its real deliverable is 7, not 10. Recorded in the test's own comment.

OMN-16770 carve-out — verified, not assumed

savings_estimates is declared under tenant_projection_writer only (already delivered); omninode_runtime declares no grant on it anywhere, so it is absent from the undelivered set by construction and nothing here grants it. A runtime SELECT there would be actively wrong — FORCE RLS with an unset GUC returns zero rows and inverts the NOT EXISTS anti-join into re-finalizing every session forever. Now written into the checker's docstring so the next person driving the count toward zero does not "fix" it.

Notes

• The floor is 1, not 0: nightly_loop_configs is declared and has no CREATE TABLE anywhere, so its grant has no lineage to land in. test_residual_relation_has_no_creating_migration asserts that reason still holds rather than trusting prose. OMN-17440 AC2's plain == 0 target needs amending to == 1.
• Source half is omnimarket and lands after this, per node-migration-vendor-parity-gate.

Refs: OMN-17440, OMN-17447, OMN-17374, OMN-17377, OMN-17379, OMN-16770

Evidence-Ticket: OMN-17440
Evidence-Source: OCC#7944

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Blocking findings (critical): 0
Total findings: 0
Models succeeded: none

Note: All reviewer models failed or were unavailable. Degraded results are informational during the pilot phase (OMN-8468/OMN-8524) and do not block merge. Error: all review endpoints [192.168.86.201:8000 192.168.86.201:8000 ] unreachable — preflight short-circuit (no models available)

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical findings	No
blocked	CRITICAL findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review (OMN-8468/OMN-8524)