[jonahgabriel]

What

Task B2 of the second-deploy-slot plan (knowledge-base-internal beta/plans/2026-09-24-second-deploy-slot-plan.md, epic OMN-19500). Ticket: OMN-19505.

This declares dev-202, a second dev-shaped deployed lane on the .202 host (omnipc2), so that a second deploy-agent instance (task B3, OMN-19506) can run a second runtime deploy slot in parallel with .201's. The operator answered the plan's two questions yes (omni_home ledger RULING 2026-09-25T00:56:45Z, lane merge-drain-83).

• docker/docker-compose.dev-202.yml is an overlay on the dev composition (infra.yml + dev-lane.yml), in the same shape as sim-202 on the dogfood file. It renames the project, every container, the network and every volume. It republishes every port on 127.0.0.1 in the 61xxx block and relabels every com.omninode.lane=dev service as dev-202.
  • The four runtime-kernel services mount a new docker/lane-overlays/dev-202.bifrost.yaml (cloud locale, no local model rung). They never mount the dev overlay, which binds the .201 model server.
  • runtime-effects leaves the external omnimemory network, which does not exist on .202.
  • Host credential mounts are pinned to /dev/null.
  • Keycloak and Infisical, the roles plan's non-roles on .202, are disabled and declared nowhere.
  • onex-api and its two cloud-migration one-shots are disabled and declared profile_gated. Their image is the omninode_infra cloud build, and only the .201 lab-overlay pin delivers it.
• deploy/lane-census/lane-manifest.yaml declares dev-202 with hosts: [lab-202], optional: true, and every container the overlay names. That includes, under dev-202 names, every service the .201 dev lane declares (AC1). A fresh verified: line records the port-block read.
• scripts/generate_claude_lane_block.py gains the lane's main and effects ports and its boundary line.

Tests

• New tests/ci/test_dev_202_lane_boundary_omn19505.py. It checks that the lane is outside GOVERNED_LANES and GRANT_INTERLOCK_LANES and that both sets are unchanged (AC2). It checks that the manifest maps one to one from the dev lane's declared set, that the ports are loopback-only and inside the block, and that the block is clear of every other compose file. It checks that the overlay names no .201 address and no dev Bifrost mount, and that every dev-labelled service is relabelled. It also runs the .202 census plan: both .202 lanes are checked, every other lane is not applicable, and there is a negative control for a stopped runtime and one for a .201 container found on .202 (AC3).
• dev-202 has joined the manifest parity ratchet (_COMPOSE_LANES).
• The sim-202 boundary test and the OMN-19088 host-scope test now expect two lanes on .202.
• RED first. With the overlay moved aside, the parity test and the new boundary test gave 8 failed and 32 passed. With it in place, the focused set gives 65 passed (the parity, dev-202 boundary, sim-202 boundary and Bifrost lane overlay tests).
• The compose-globbing tests (lane isolation, teardown policy, nested expansion, env parity, writer coverage and others) gave 148 passed and 1 skipped. The census drift, snapshot and db-budget tests gave 79 passed. pre-commit run --files on every changed file is clean.
• The triple renders under env -i with docker compose ... --profile runtime config:
  • 28 services, all with dev-202 names, and every published port on 127.0.0.1:61xxx;
  • the network is omnibase-infra-dev-202-network and every volume name is dev-202;
  • there is no dev Bifrost bind and no .codex or .claude mount;
  • the render contains no reference to a .201 address;
  • the disabled services drop out of the runtime profile.

Lab readback

The declaration only: no lane was brought up. Read-only on .202 at 2026-09-25T01:28:58Z:

• ss -ltnH shows no listener on any :61xxx port. The listeners were 22, 53, 631, 3389, 8000, 8002 and sim-202's 62xxx.
• ip_local_port_range is 32768-60999.
• There are no dev-202 containers or networks.

Task B1 (OMN-19504) measured this host building the runtime image in 60 s against .201's 308 s, and booting the runtime to /health in 137 s against at most 274 s. That measurement is in the ticket.

Not in this PR, and why

• Bring-up (AC3's live census run on .202). Decision 19 of the unified verification plan (ruled 2026-09-23) holds: no clone and no .git on .202 while the C13, C14 and C29 clean-machine producers run bare there. C29's move into a disposable container is omninode_infra#1663, which is still open. A deploy agent that builds in workspace mode from clones cannot run on .202 until that ruling is discharged. This is recorded as a FRICTION row in the omni_home ledger.
• The agent instance, routing table and receipt lane are tasks B3 and B5.

Runtime classification

The PR is runtime-affecting by the docker/docker-compose*.yml trigger rule. Nothing in it changes the .201 dev lane's own compose model, so the .201 rebuild it starts should be a no-op recompose.

Evidence-Ticket: OMN-19505
Evidence-Source: OCC#11187

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Critical findings: 1
Major findings: 3
Total findings: 10
Models succeeded: glm-review

Note: Fewer than 2 reviewer models succeeded. Degraded results are informational (OMN-8468/OMN-8524) and do not block merge. Error: cli_review exit 2 (fewer than 2 models succeeded — partial/total outage)

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	No

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review, qwen3-review-b, glm-review (OMN-8468/OMN-8524/OMN-17492)

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: glm-review
Models failed: codex
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 9
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 9 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [CRITICAL] docker/docker-compose.dev-202.yml (glm-review) — Credential isolation applied to only 4 of ~20 services | The isolation property 'host credential mounts (Vertex token, Codex and Claude logins) are pinned to /dev/null; this lane carries no operator l
• [MAJOR] tests/ci/test_dev_202_lane_boundary_omn19505.py (glm-review) — Bifrost isolation verified by string count, not by rendered compose graph | The .201-isolation tests assert literal substrings in the overlay source file rather than the merged composition. String cou
• [MAJOR] tests/ci/test_dev_202_lane_boundary_omn19505.py (glm-review) — Port-block collision test scans only files, only declared ports, only 61xxx | test_dev_202_lane_boundary_block_is_clear_of_every_other_lane intersects the regex \b61\d{3}\b against EXPECTED_PUBLISHED_
• [MAJOR] docker/docker-compose.dev-202.yml (glm-review) — Redpanda SASL one-shots retained while listener and command are overridden | redpanda-scram-user, redpanda-sasl-enable and redpanda-partition-cap are kept from the base composition with only container
• [MINOR] tests/ci/test_dev_202_lane_boundary_omn19505.py (glm-review) — Port-line parser accepts only the exact quoted ip:port:port form | _published_port_lines matches only lines of the form - "a:b:c". An unquoted mapping, a long-syntax ports entry (target/published/host
• [MINOR] tests/ci/test_dev_202_lane_boundary_omn19505.py (glm-review) — Governed-set assertions duplicate implementation constants | test_dev_202_lane_boundary_is_not_deploy_attribution_governed asserts frozenset({"stability-test", "prod", "judge"}) == GOVERNED_LANES. Thi
• [MINOR] docker/docker-compose.dev-202.yml (glm-review) — DEV_202_REDPANDA_MEMORY env knob unpinned and unbounded | The broker memory is parameterized as ${DEV_202_REDPANDA_MEMORY:-4G} and set via an env file whose contents are not in this diff. .202 also se
• [MINOR] docker/docker-compose.dev-202.yml (glm-review) — ONEX_RUNTIME_LANE set only on runtime main, not effects or worker | omninode-runtime gets ONEX_RUNTIME_LANE: "compose-dev-202" but runtime-effects and runtime-worker, which are part of the same deploy
• [MINOR] docker/docker-compose.dev-202.yml (glm-review) — Renamed keycloak_data and cloud_migrations volumes with no consumer | The overlay renames volumes for keycloak_data and cloud_migrations, whose services are profile-disabled and never start on dev-202