fix(OMN-16852): the catalog render stops handing the runtime build an empty OMNI_HOME

[jonahgabriel]

Ticket: OMN-16852, AC3 (epic OMN-16849, M4 criterion C17). Lane omn16849-children.

What

docker/catalog/generator.py rendered "OMNI_HOME": "${OMNI_HOME:-}" as a runtime-image build arg, which is a fail-soft expansion propagated into the render. That entry is removed.

Classification under the operator's 2026-08-28 boundary ruling

The ruling is recorded in omnibase_core#1714: customer and self-hoster parameters use OMNIBASE_PATH fail-fast, and internal orchestration keeps OMNI_HOME.

Here OMNI_HOME is internal:

reader	what it does	class
docker/Dockerfile.runtime builder guard (ARG OMNI_HOME="")	only a BUILD_SOURCE=workspace build needs it, to stage sibling repos from the operator's registry. It exits 64 when it is empty.	internal
deploy agent _build_source_args and scripts/deploy-runtime.sh	the sanctioned workspace builds. Both refuse an unset value, then pass --build-arg OMNI_HOME=… on the command line	internal
image ENV OMNI_HOME=/app, read by omnimarket's registry-walking sweep and scan nodes (65 source files)	a fixed in-image value with no :- default	internal, untouched

The checked-in compose files (docker-compose.infra.yml, docker-compose.dev-lane.yml) declare no OMNI_HOME build arg. The render entry added only a silent empty default. Removing it leaves the Dockerfile's workspace guard as the fail-fast form. Release builds are unchanged, because the Dockerfile ARG already defaults empty.

Lab proof (.201, 2026-09-23T10:02Z)

The branch tree was shipped to a scratch directory on .201 with git archive. No lane or container was touched.

• docker compose config, OMNI_HOME unset. The 32 other required variables got inert placeholders. The before render (origin/dev eb81f73f) interpolates the runtime build args to {'BUILD_SOURCE': 'release', 'EXPECTED_BUILD_SOURCE': 'release', 'OMNI_HOME': ''}. The after render (this branch) interpolates them to {'BUILD_SOURCE': 'release', 'EXPECTED_BUILD_SOURCE': 'release'}. Both returned rc 0.
• Workspace build without OMNI_HOME. docker build --target builder --build-arg BUILD_SOURCE=workspace … stops at the guard with BUILD_SOURCE=workspace requires OMNI_HOME, exit code 64. That is the fail-fast form.
• Positive control. The same build with --build-arg OMNI_HOME=… passes the guard and reaches [builder 3/34], then was canceled on purpose.
• Running dev-lane runtime. printenv OMNI_HOME returns /app. The internal image ENV is unaffected.

Tests

• RED first. The new test_runtime_image_build_carries_no_silent_omni_home_default asserts that no rendered build arg is OMNI_HOME or carries a ${OMNI_HOME:- expansion, with a positive control. It failed on origin/dev with ('omninode-runtime', 'OMNI_HOME', '${OMNI_HOME:-}').
• GREEN after: 54 catalog tests passed (generator, redaction guard, healthcheck probe, Infisical-first config, roundtrip, render placeholder) and 20 deploy-agent compose-gen tests passed.

Release identity

Version 0.38.56 → 0.38.57 for the OMN-13412 gate, because packaged source changed after 0.38.56 published. The runner image identity was regenerated for the new shared_env_digest. --mode verify was stale before regeneration and verifies after.

Evidence-Ticket: OMN-16852
Evidence-Source: OCC#10905

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: glm-review
Models failed: codex
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 5
Nit-level findings suppressed: 0

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 5 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] src/omnibase_infra/docker/catalog/generator.py, _runtime_image_build (glm-review) — Removal of OMNI_HOME arg changes env pass-through for compose-driven workspace builds | Previously the rendered stanza contained "OMNI_HOME": "${OMNI_HOME:-}", which under compose interpolation forwar
• [MINOR] tests/integration/test_catalog_render_no_omni_home_default_omn16852.py; tests/unit/infra/test_catalog_generator.py (glm-review) — Negative assertions are partially redundant and the substring check is weaker than the key check | In the integration test, assert "OMNI_HOME" not in build_args already implies no key or value check
• [MINOR] tests/integration/test_catalog_render_no_omni_home_default_omn16852.py, line ~44 (glm-review) — Integration test hardcodes service name and depends on the runtime bundle being the only/first build stanza | The test indexes compose["services"]["omninode-runtime"]["build"]["args"] directly. The un
• [MINOR] tests/integration/test_catalog_render_no_omni_home_default_omn16852.py; docker/Dockerfile.runtime (referenced, unchanged) (glm-review) — No test covers the fail-fast path the change relies on | The stated safety argument is that the Dockerfile's workspace guard fails fast when OMNI_HOME is unset under BUILD_SOURCE=workspace. The diff r
• [MINOR] docker/runners/runner-image.lock.json; uv.lock; pyproject.toml (glm-review) — Lock file digest bumps carry no provenance or regeneration evidence | identity_digest, shared_env_digest, uv.lock version, and image_version change in the same diff as the OMNI_HOME removal with no ex

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Critical findings: 0
Major findings: 1
Total findings: 5
Models succeeded: glm-review

Note: Fewer than 2 reviewer models succeeded. Degraded results are informational (OMN-8468/OMN-8524) and do not block merge. Error: cli_review exit 2 (fewer than 2 models succeeded — partial/total outage)

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	No

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review, qwen3-review-b, glm-review (OMN-8468/OMN-8524/OMN-17492)