fix(OMN-18024): retire the published cloud identity chain from the public tree

[jonahgabriel]

Ticket: OMN-18024 — Retire the published cloud identity chain from the public tree (omnibase_infra). Child of epic OMN-17992 (public-repo hygiene), wave A item (b). Source plan: beta/plans/2026-09-06-public-repo-hygiene-inventory-and-prevention-plan.md in the private planning corpus.

dod_evidence: the gate + probe pair below, each run at BOTH this branch and its first parent 0e23c66c5, with the parent run as the positive control.

The finding

This repository is public. It published the AWS account id, three EC2 instance ids (one of them the k3s node fronting production hostnames), the private MSK broker and ZooKeeper endpoints, the private RDS endpoint, a KMS key id, two subnet ids and a security-group id. No value is restated in this PR; every one is resolvable at the path:line the denylist entries name, in the parent commit.

What changed

Evidence bundles deleted, after being archived. docs/evidence/OMN-15124/probes-round4/ (9 files of raw AWS CLI output) and docs/evidence/OMN-15125/probes/ (4 files whose ECR references carry the account id) are removed here. They are already in the private evidence archive, byte-identical, merged before this PR: knowledge-base-internal PR #250, squash f2806312964acdfde92d46bed30bd0181931cd1a, merged 2026-09-07T06:13:50Z. Byte identity was proved with diff -r before that commit. Nothing in this repo references either directory (git grep -l probes-round4 returns nothing; git grep -rn 'docs/evidence/OMN-1512' returns only three unrelated proof-kit templates naming the parent ticket folders), so they are deleted rather than repointed. Nothing is only-deleted.

No workflow logic changed. Two COMMENT lines now name the Actions variable instead of the value. The functional role-to-assume: at all four call sites already composed the ARN from vars.AWS_ACCOUNT_ID and always did — please do not look for a behaviour change that is not there.

Three script literals became fail-fast env resolution, with no default. scripts/cloud-bus-tunnel.sh and scripts/k8s-pod-readiness-check.sh use the shell required-parameter form; scripts/compare_environments.py makes --instance-id required when SSM_INSTANCE_ID is unset. A fallback literal is exactly what published the id. Verified: with the variable unset both scripts abort naming the variable, and argparse exits error: the following arguments are required: --instance-id.

Two prose sites name the cluster by role. The migration ledger's reason column and one test docstring say "the dev-system cluster node" instead of an instance id. The ledger's asserted columns and field values are untouched.

Two incident-replay captures took length-preserving redactions, with their tests/incident_replays/registry.yaml and in-module sha256 pins moved in the same commit, and the modification recorded in each capture's own why/docstring per that registry's R1:

Capture	Redacted	Bytes before → after
tests/fixtures/omn17534/…rollout-diagnostics.log.captured	22 account-id occurrences inside echoed ECR references	83,228 → 83,228
tests/fixtures/omn17888/…gh-api.json.captured	2 occurrences of the pre-push authorizing host's instance id, inside the diff text of the OLD host table this compare response carries	303,194 → 303,194

Same technique and same precedent the omn17534 capture already used for one instance id and three UUIDs at capture time. Every byte offset is unchanged and no redacted byte is in any field a guard or replay reads. This was forced, not chosen: a digest entry cannot be minted while an occurrence of the literal survives in the tree.

Six digest-only denylist entries, minted through scripts/validation/gen_exposed_identifier_entry.py on stdin as its docstring requires — account id, three EC2 instance ids, the RDS endpoint, the KMS key id. No plaintext, no whole-file exemption, no per-line annotation.

Gate, with its positive control

python3 scripts/validation/check_exposed_identifiers.py --mode blocking --scope all, the same denylist file pointed at both trees:

Tree	Result
this branch, head 4e8f4d8de	entries=11 files_scanned=7126 findings=0 — exit 0
this branch, head 61b3b0c9d (before the dev merge)	entries=11 files_scanned=7125 findings=0 — exit 0
base 0e23c66c5, unmodified worktree	entries=11 files_scanned=7138 findings=42 — exit 1

The red base run is what makes the green ones evidence rather than an assertion. It was re-run independently at 61b3b0c9d and again after the dev merge; the 42 findings enumerate every path this PR touches, and the value of each is withheld by the gate itself.

Probe, with its positive control

git grep -clE 'arn:aws:iam::[0-9]{12}|i-0[0-9a-f]{16}' -- . | grep -v exposed_identifiers

• this branch, head 4e8f4d8de: no rows, exit 1
• base 0e23c66c5: 8 files — both workflows, the migration ledger, all three scripts, the omn17888 capture, the topology test
• live origin/dev at 31e3a979a, re-run after the dev merge: the same 8 files, so the control is still red at the commit this will actually squash onto

Neither run suppressed stderr. A third grep confirms nothing in the tree referenced either deleted evidence directory — git grep -rln 'probes-round4' and git grep -rln 'OMN-15125/probes' return nothing at the base commit either, and the same grep form returns rows for a path that IS referenced (tests/incident_replays/registry.yaml, 5+ files), so the zero is an absence and not a broken query.

The SASL-fixture commit this branch carried is now dev's, not ours

61b3b0c9d on this branch repaired two credential-less SASL fixtures in tests/unit/topics/test_topic_provisioning_policy.py, broken on dev by #3258 (OMN-18012, 84833da7a) which made a credential-less PLAIN/SCRAM config fail closed at construction. It was carried here only because the governed pre-push is fail-closed and that red was refusing every push in the repo.

While this PR waited on CI, #3266 (OMN-17985, 31e3a979a) landed the same repair on dev, and the two edits conflicted. Resolution: merge commit 4e8f4d8de takes dev's version of that file verbatim — git diff origin/dev -- tests/unit/topics/test_topic_provisioning_policy.py is empty — so this PR no longer changes that file at all and the squash will not touch it. No history was rewritten and nothing was force-pushed; the redundant commit stays in the branch's history and simply contributes no diff.

Verification

Governed pre-push, twice, both accepted off-box on a lab host and neither bypassed:

Head	Host	Tests	Exit	Suite-log sha256	Wall
4e8f4d8debdf556cf21505d9576733e954bb2146 (current)	h105.2	26886	REMOTE_WRAPPER_EXIT=0	53480bcf323bc4f7db7d8c2c45a0c7899e970b66a9fb640f40e4434916821031	323s
61b3b0c9d11c90fa35ced7628470951c358f3a67	h105	26880	REMOTE_WRAPPER_EXIT=0	c1045df58e9004571f6f04667651128a9ddf44f1a5064740c8fb9e2950c3844d	429s

Focused locally on the merged head: tests/ci/test_exposed_identifier_gate.py, both incident replays, tests/unit/topics/test_topic_provisioning_policy.py, tests/unit/topology/test_validator_ro_principal_omn17792.py — 81 passed; plus tests/unit/services/test_runtime_health_monitor_profile_read.py (arriving from dev) — 6 passed. Focused locally: the exposed-identifier gate suite, both incident replays, the migration-ledger gate, the topology test, test_compare_environments.py, test_env_var_alignment.py, test_kafka_event_bus.py — all green. ruff format --check, ruff check, mypy clean on the touched Python. All pre-commit hooks passed on both commits, none bypassed.

Deliberately not done, so the next lane does not assume coverage

• No AWS mutation. No security group, Elastic IP, IAM trust policy or tailnet ACL. That is an operator decision (plan §6.4 feat: RedPanda Event Bus Integration with Fail-Fast Infrastructure #3) and no AWS API call was made.

• No history rewrite, no force-push, no tag move. The values remain in this repository's history; the operator ruled document-and-accept on history.

• No credential action. A published resource identifier is a disclosure defect, not a rotation trigger, and nothing here meets the exposure bar.

• The MSK broker hostname has NO digest entry, on purpose. It is still in the tree because docker/gateway/dns-bastion/dnsmasq.conf must name the real broker DNS in order to override it, and the compose healthcheck plus two test fixtures follow it — 11 sites in 4 files. Minting the entry would have needed either 11 per-line annotations or a functional change to a deployed gateway lane, neither of which belongs in a disclosure fix. The 11 sites are listed on OMN-18024. So the broker hostname is removed from the deleted probe bundle but has no forward-safety guard yet.

• Cross-repo parity pin drifted on purpose. PINNED_DENYLIST_SHA256 moves in this repo only, and the test now carries a comment saying why: omnimarket still carries the account id in its own leaked-literals header and both k3s instance ids in its own fixtures, so copying these entries there today would red every omnimarket PR rather than protect anything. omnimarket's copy pins its own unchanged file and stays green.

• Item (d) is untouched — the personal addresses in tests/fixtures/omn{15547,17292,16494,16906} are a different ticket.

• No org-wide claim. omnimarket carries the same account id and both k3s instance ids in its own tree. This PR is omnibase_infra only.

• The OIDC role NAME has no digest entry either, same reason as the broker hostname. The wave-A plan listed "the OIDC role ARN" among the literals to mint. There is no cleartext role ARN in this tree: all five role-to-assume: sites (four workflows plus one .captured workflow fixture) compose it as arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/…, so the only literal left is the role name itself, which those five functional lines must keep. A digest entry for it would red five files that cannot change without a workflow behaviour change. Recorded here rather than silently dropped.

• Plan correction: the plan also named .github/actions/resolve-ecr-digest/action.yml:9 as carrying the account id. It does not — that line's 123456789012 is AWS's own documentation placeholder, not this account. No change was made there and none is owed.

Evidence-Ticket: OMN-18024
Evidence-Source: OCC#8546

[onexbot-occ-writer]

OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required.

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: glm-review
Models failed: codex
New finding threads: 2
Deduped (already posted on this PR): 0
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Findings not anchored to a changed file

• [MAJOR] hostile-reviewer (glm-review)

  Empty SSM_INSTANCE_ID bypasses required check in compare_environments.py | The argparse construction sets required="SSM_INSTANCE_ID" not in os.environ and default=os.environ.get("SSM_INSTANCE_ID"). An environment variable that is set but empty (common in CI template expansion and launchd environments) satisfies the membership test, so required becomes False and the default resolves to the empty string. The script will then proceed with --instance-id '' and fail later, deeper in SSM invocation, or worse, pro

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MAJOR] hostile-reviewer (glm-review)

  Redaction is tree-only while disclosed values remain in public git history | The PR scrubs the AWS account id, EC2 instance ids, RDS endpoint, KMS key id and evidence bundles from HEAD, but the denylist file itself states the OMN-18024 values are 'resolvable from the pre-fix parent of its merge commit at the path:line each entry's notes field names -- the values are public in this repository's history'. The notes field then names the exact file each secret was in (e.g. msk_describe_cluster.json for the KMS

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MAJOR] hostile-reviewer (glm-review)

  Workflow comment claims vars.AWS_ACCOUNT_ID composition not present in changed lines | Both workflow files assert 'The functional role-to-assume: below composes the ARN from vars.AWS_ACCOUNT_ID', yet the diff for each file changes only comment lines (the removed lines are the two comment lines carrying the literal account id). If the role-to-assume step still hardcodes the ARN, the new comment is false and the account id remains in the working tree, contradicting the denylist entry omn18024-account-id who

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (glm-review)

  Fail-fast SSM_INSTANCE_ID changes are untested | Three scripts moved from defaulted to required configuration, the most behaviorally significant change in the PR, and no test exercises the failure path: unset variable, empty variable, or the argparse error in compare_environments.py. The denylist gate is well tested; the operational scripts it protects are not. A regression restoring a default (or an empty-string bypass) would not be caught by CI. | Evidence: SSM_INSTANCE="${SSM_INSTANCE_ID:?SSM_INSTANCE_ID

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

Findings demoted from threads (anchor rejected)

• [MINOR] hostile-reviewer (glm-review)

  Deliberate cross-repo pin drift removes the parity signal permanently | test_cross_repo_fingerprint_pin exists to make denylist divergence between repos visible, but the PR accepts permanent drift between the omninode_infra and omnimarket copies. The comment records the rationale, yet nothing schedules or enforces the convergence ('its denylist takes these entries once its own occurrences are scrubbed'). A documented drift with no owner and no ticket-linked reminder is indistinguishable, six months later, f

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (glm-review)

  dry-run mode now requires an instance id it does not use | Making --instance-id unconditionally required changes behavior for --dry-run invocations, which previously ran without the flag and presumably do not open an SSM session. Any existing automation or documentation invoking compare_environments.py --dry-run without SSM_INSTANCE_ID will now fail at argument parsing. This is a contract change hidden inside a security fix and is not called out in the diff. | Evidence: required="SSM_INSTANCE_ID" not in os.

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Critical findings: 1
Major findings: 3
Total findings: 9
Models succeeded: glm-review

Note: Fewer than 2 reviewer models succeeded. Degraded results are informational (OMN-8468/OMN-8524) and do not block merge. Error: cli_review exit 2 (fewer than 2 models succeeded — partial/total outage)

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	No

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review, qwen3-review-b, glm-review (OMN-8468/OMN-8524/OMN-17492)

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: glm-review
Models failed: codex
New finding threads: 2
Deduped (already posted on this PR): 0
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Findings not anchored to a changed file

• [MAJOR] hostile-reviewer (glm-review)

  History scrub is cosmetic; all identifiers remain in public git history | The PR removes the account id, EC2 instance ids, RDS endpoint, and KMS key id from HEAD, but every value is recoverable from prior commits of this public repository. The denylist notes acknowledge 'document-and-accept on history', which is a risk-acceptance decision, not a remediation. Any consumer of the repo's history, forks, or cached clones retains full disclosure. If the acceptance is deliberate it should be recorded as a formal

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (glm-review)

  Fixture pins rewritten in the same commit as fixture content | test_incident_replay_omn17534.py and test_incident_replay_omn17888.py update SHA256 pins, and registry.yaml updates its sha256 fields, in the same commit that redacts the fixtures. A pin updated atomically with the artifact it pins provides no tamper evidence against the author of the change; it only detects accidental later edits. The registry's own R1 'honesty' framing claims redactions are length-preserving and offset-neutral, but nothing in

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (glm-review)

  Workflow comments assert vars.AWS_ACCOUNT_ID wiring the diff does not show | Both workflow diffs change only header comments; the stated functional change ('The functional role-to-assume: below composes the ARN from vars.AWS_ACCOUNT_ID') is not visible in the hunks. If that composition is pre-existing, the comment is accurate but the PR's own CI cannot run for forks or repos where the repo-scoped variable is unset, and nothing in the diff adds a guard or validation step for it. If the composition is NOT pre

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

Findings demoted from threads (anchor rejected)

• [MAJOR] hostile-reviewer (glm-review)

  Salted SHA-256 denylist does not protect low-entropy identifiers | The new denylist entries for the AWS account id, EC2 instance ids, KMS key id, and RDS endpoint store salted SHA-256 digests with a static, publicly committed salt ('onex-exposed-identifier-v1:'). For the 12-digit account id in particular, the preimage space is trivially enumerable; publishing the digest and the salt together lets anyone confirm the account id offline with a brute-force loop running hours, not years. The mechanism is sound o

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MAJOR] hostile-reviewer (glm-review)

  argparse required=True breaks the documented SSM_INSTANCE_ID fallback | argparse raises 'the following arguments are required: --instance-id' whenever the flag is absent from argv, even when a non-None default is set. With required computed as '"SSM_INSTANCE_ID" not in os.environ', a caller who exports SSM_INSTANCE_ID and runs the script without --instance-id still gets an argparse error. The default=os.environ.get('SSM_INSTANCE_ID') branch is unreachable for exactly the callers the help text describes. Add

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: glm-review
Models failed: codex
New finding threads: 4
Deduped (already posted on this PR): 0
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Findings not anchored to a changed file

• [CRITICAL] hostile-reviewer (glm-review)

  Deletion of evidence files does not remove leaked identifiers from public git history | The PR removes thirteen evidence files that contained the AWS account id, MSK cluster ARN, KMS key ARN, RDS endpoint, subnet ids, security group id, zookeeper connect strings, and a private RDS hostname reachability result. Deletion from HEAD leaves every value fully recoverable via prior commits, and no history rewrite is included. The denylist file itself concedes the values remain public in history. The remediation is

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MAJOR] hostile-reviewer (glm-review)

  compare_environments.py accepts empty SSM_INSTANCE_ID as satisfying the requirement | The new argparse wiring uses required="SSM_INSTANCE_ID" not in os.environ with default=os.environ.get("SSM_INSTANCE_ID"). An environment variable set to the empty string passes the required check and yields default="", which then flows into an SSM command and fails downstream with an opaque error rather than at argument validation. This partially defeats the stated fail-fast intent. | Evidence: default=os.environ.get("SSM_

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (glm-review)

  Account id removal from workflow comments is cosmetic given id disclosure elsewhere | AWS account ids are not secrets; they appear in signed S3 endpoint hostnames, ARNs in public SDK output, and were already committed in fixtures (now deleted but present in history, as the denylist notes acknowledge). Editing two comment lines to remove 272493677981 while the runtime and migrate workflows still functionally reference vars.AWS_ACCOUNT_ID adds indirection without changing the actual exposure surface, and the

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (glm-review)

  Fixture sha256 re-pin in registry and test must be verified against the committed bytes | The omn17534 fixture hash changed in three places (test constant, registry.yaml) with an asserted property that the file remains exactly 83,228 bytes and that no test-read line is altered. The claim "every offset is still unchanged" and the equivalence of redacted-acc to the original 12-digit id are asserted in comments but no test in the diff verifies byte length or offset preservation; a future editor mutating the fi

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

Findings demoted from threads (anchor rejected)

• [MAJOR] hostile-reviewer (glm-review)

  k8s-pod-readiness-check.sh comment contradicts behavior; --instance-id override path broken | The comment states "--instance-id below still overrides" but the script now hard-fails at variable expansion via ${SSM_INSTANCE_ID:?...} before any argument parsing occurs. A caller who follows the documented interface and passes --instance-id without exporting the variable gets the fail-fast error, and the override path is unreachable without the environment variable also being set. Either the override no longer

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MAJOR] hostile-reviewer (glm-review)

  Deliberate cross-repo pin drift replaces an enforced invariant with a prose promise | The parity pin (PINNED_DENYLIST_SHA256) was moved unilaterally, converting a machine-checked cross-repo invariant into an unverifiable comment stating omnimarket will adopt the entries "once its own occurrences are scrubbed." No issue reference, deadline, or CI mechanism enforces eventual re-synchronization. Indefinite drift of an integrity pin with only a comment as the record is the exact silent-failure mode the pin was

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (glm-review)

  Removal of vulnerability scan evidence destroys the audit trail for CRITICAL findings | vuln_scan_round4.json contained ECR scan results including CVE-2026-12087 (CRITICAL, CVSS 9.1, Perl) and two HIGH SQLite FTS5 CVEs against perl 5.40.1 and sqlite3 3.46.1 in the runtime image. The PR deletes the evidence without any indication of whether these findings were remediated, accepted as risks, or tracked. Deleting the record of unresolved CRITICAL vulnerabilities from a public repository removes the only commit

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (glm-review)

  cloud-bus-tunnel.sh hard-fails under existing launchd deployment with no migration step | The script is described as "Managed by launchd plist ai.omninode.cloud-bus-tunnel" and previously ran with a baked-in default. ${SSM_INSTANCE_ID:?} now aborts unless the launchd plist exports the variable. The PR contains no plist change and no documented rollout step, so the next host reboot silently produces a broken tunnel until someone manually edits the plist on the machine. This is an uncoordinated breaking chang

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).