[jonahgabriel]

What

The .105 row of the lab deploy lanes plan (epic OMN-19500; operator RULING in the omni_home ledger at 2026-09-25T10:22:22Z, amended 10:22:36Z: one deploy slot and one prover per lab host). Ticket: OMN-19544.

This declares dev-105. It copies the dev-202 lane (#4095) onto the .105 laptop (omnibook, Docker Desktop), and it takes turns with the prove-105 proof stack.

• A new time-shared lane, dev-105, on host .105, with a new Docker Compose overlay that publishes only on loopback (docker/docker-compose.dev-105.yml). It is the dev-202 overlay with every name changed to dev-105.
• The lane uses the port block 43xxx. The projection API is on 43302, because 43002 is the judge lane's default (docker-compose.judge.yml).
• The overlay fits the 15.6 GiB Docker VM, so the broker defaults to 2G, not dev-202's 4G. All publishes are on loopback only; a runner container still reaches them through host.docker.internal (measured on the lab, see below). The overlay has no 172.17.0.1 gateway binds: that is a Linux bridge address from feat(OMN-19507): dev-202 publishes its verify ports on the docker bridge gateway so a runner container reaches them #4109, and it does not exist on a macOS host. The broker disk settings from OMN-19082 come unchanged from docker-compose.dev-lane.yml.
• A new Bifrost overlay for dev-105 (docker/lane-overlays/dev-105.bifrost.yaml) with the cloud locale and no local model rung.
• The lane manifest gets a dev-105 entry with hosts: [lab-105] and optional: true, plus a new verified: line. scripts/generate_claude_lane_block.py gets the lane's ports and boundary row.
• A new test file for the dev-105 lane boundary, and changes to two lane census tests: the parity ratchet now includes dev-105, and the OMN-19088 host-scope test now expects dev-105 on .105.

(The draft of this list came from onex delegate run b04792b3-0906-411b-8f76-518708d9ac49. I checked every line against the diff.)

Tests

• New file tests/ci/test_dev_105_lane_boundary_omn19544.py, which checks:
  • the lane is outside GOVERNED_LANES and GRANT_INTERLOCK_LANES, and both sets are unchanged;
  • lab-105 is its only host;
  • the dev lane's declared services map one to one onto dev-105 names, with no Keycloak or Infisical;
  • every port is on 127.0.0.1 only and inside the block, and no other compose file publishes a port from the block;
  • the verify ports are loopback publishes, and no 172.17.0.1 address appears (a positive control shows dev-202 has one);
  • the broker defaults to 2G, and the dev lane's disk settings are not overridden;
  • it names no .201 address and mounts no dev Bifrost overlay;
  • on .105 the census checks dev-105 and dogfood and reads clean, with a negative control for a stopped runtime and another for a .201 container found on .105.
• RED first. Without the manifest entry the new file failed 8 of its 17 tests (KeyError 'dev-105'). It failed on the projection API too, until the port moved from 43002 to 43302. Now: 17 passed.
• Census, parity, dev-202 and sim-202 boundary, lane-block generator and incident-replay sets: 103 + 70 passed. Compose-globbing sets (nested expansion, teardown policy, env parity, writer coverage, lane isolation, Bifrost overlay, dev disk settings and others): 202 passed, 1 skipped (omnimarket is not importable in this venv).
• docker compose -p omnibase-infra-dev-105 -f infra.yml -f dev-lane.yml -f dev-105.yml --profile runtime config renders 34 services. That is the same count as the dev-202 triple. Every published port is 127.0.0.1:43xxx, and the network is omnibase-infra-dev-105-network.
• pre-commit run --files on every changed file: clean.

Lab readback

Declaration only: no lane was brought up. Two reads were taken on .105, both recorded in the omni_home ledger under lane dev-105-lane:

• Reach probe (HOLD on surface 105-compose-dev, RELEASE 2026-09-25T10:34:52Z, restored=yes):
  • A throwaway python:3.13-alpine server was published on 127.0.0.1:43999.
  • An alpine client with the runner's host.docker.internal:host-gateway alias reached it, from a user network and from the default bridge.
  • The unbound port 43998 was refused through the same alias.
  • The LAN address answered nothing.
  • The before and after container snapshots were identical.
• Port block and census (read-only, 2026-09-25T10:35:52Z):
  • lsof -iTCP:43000-43999 -sTCP:LISTEN found 0 rows. Positive control: 49085 shows the dogfood listener.
  • There are no dev-105 containers or networks. Positive control: 12 dogfood containers by the same filter.
  • The macOS ephemeral range is 49152-65535.

Not in this PR, and why

• The deploy-agent instance (routing-table row, executor composition, launchd LaunchAgent). This waits on OMN-19543, the dev-200 lane's change that turns executor instances into data and adds the launchd template. dev-105 then adds one data row on top of it.
• The host-slot lease (OMN-19544 AC1), so an agent job and a prover never run at once on .105. It is a separate deploy-agent PR.
• The compose-dev-105 receipt lane is a separate PR.
• Bring-up on .105. The dev-202 stack idles at about 7.3 GiB (docker stats on .202). The .105 VM has about 11.5 GiB after dogfood, so this lane and a prover stack cannot run together. Bring-up is time-shared with prove-105 through the ledger.

Runtime classification

This PR is runtime-affecting by the docker/docker-compose*.yml trigger rule. Nothing in it changes the .201 dev lane's own compose model.

Evidence-Ticket: OMN-19544
Evidence-Source: OCC#11256

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: glm-review
Models failed: codex
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 7
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 7 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] docker/docker-compose.dev-105.yml, x-omninode-contract-overlay (glm-review) — Loopback-advertised Kafka address unreachable from runner containers | The Redpanda external listener advertises 127.0.0.1:43192. The design states the runner container reaches publishes via host.dock
• [MAJOR] deploy/lane-census/lane-manifest.yaml, dev-105 lane block (glm-review) — Host slot exclusivity on .105 is procedural, not enforced | The lane is declared time-shared with the prove-105 proof stack on a 15.6 GiB VM where dogfood (4.1 GiB), a prover (5 GiB) and this lane (ab
• [MINOR] tests/ci/test_dev_105_lane_boundary_omn19544.py, EXPECTED_PUBLISHED_PORTS comment (glm-review) — Test comment cites wrong port literal for onex-api | The comment above EXPECTED_PUBLISHED_PORTS references 61090 (dev-202's number), while the set and the overlay use 43090. The comment is wrong in a
• [MINOR] docker/docker-compose.dev-105.yml (glm-review) — No test renders the overlay through the compose toolchain | The overlay uses the non-standard !override YAML tag throughout. Every test inspects it as raw text or regex; none runs docker compose confi
• [MINOR] tests/ci/test_dev_105_lane_boundary_omn19544.py, test_dev_105_lane_boundary_reaches_nothing_on_201 (glm-review) — Isolation assertion only covers the compose file, not env files | The no-route-to-.201 test greps only docker-compose.dev-105.yml for 192.168. and dev-lane references. The render command passes docker
• [MINOR] tests/ci/test_dev_105_lane_boundary_omn19544.py, test_dev_105_lane_boundary_block_is_clear_of_every_other_lane (glm-review) — Port collision test scans comments and non-port numbers | test_dev_105_lane_boundary_block_is_clear_of_every_other_lane regex-matches \b(43\d{3})\b over entire file contents including comment lines. T
• [MINOR] docker/docker-compose.dev-105.yml, volumes section (glm-review) — Declared keycloak_data and cloud_migrations volumes contradict the never-declared claim | The comment states Keycloak and Infisical are 'never started, never declared', yet the overlay's volumes secti

[github-actions]

✅ Hostile Reviewer — REVIEWED

Critical findings: 0
Major findings: 7
Total findings: 20
Models succeeded: qwen3-review,qwen3-review-b,glm-review

Action required: findings were posted as review threads. Address or reject each one, then resolve its thread — the Hostile Review Thread Gate fails while hostile-reviewer threads are unresolved (OMN-17492).

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	Fails this job with a named reason

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review, qwen3-review-b, glm-review (OMN-8468/OMN-8524/OMN-17492)

[onexbot-occ-writer]

OCC autobind rebound this PR's evidence-source stamp line to OCC#11256.

The receipt gate's own eligibility validator, run against the change-control tree the gate pins for OCC#11256, returned eligible for head da16db976e77229bf8ccf5c8acdbd0f8019456b0. The body now carries exactly one stamp line. Displaced: OCC#11254.

Reported by occ_companion_emitter (OMN-18853).

[onexbot-occ-writer]

No OCC evidence companion was minted for this PR.

this PR is already bound to OCC#11256; its evidence companion exists and nothing needs authoring

To clear this: Nothing to do — the companion already exists.

Reported by node_occ_companion_effect (decline code already_bound, OMN-16665). This decision was made against the PR's LIVE state at compute time, not at publish time — a green publisher job only means the command reached the broker.

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, qwen3-review-b, glm-review
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 17
Nit-level findings suppressed: 3

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 17 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] tests/ci/test_dev_105_lane_boundary_omn19544.py, module docstring (qwen3-review) — Test docstring misidentifies the lane being described | The module docstring for test_dev_105_lane_boundary_omn19544.py states 'The same properties as dev-105, with one difference that comes from the
• [MAJOR] docker/docker-compose.dev-105.yml, onex-api service; tests/ci/test_dev_105_lane_boundary_omn19544.py, EXPECTED_PUBLISHED_PORTS (qwen3-review) — Port collision: 43090 reserved for disabled onex-api conflicts with block claim | The overlay publishes 127.0.0.1:43090:8000 for onex-api, which is disabled via profiles: !override ["dev-105-disabled"
• [MAJOR] docker/docker-compose.dev-105.yml, redpanda service command (qwen3-review) — Redpanda external listener binds 0.0.0.0 inside container, published to loopback only | The Redpanda command sets --kafka-addr external://0.0.0.0:19092 and --pandaproxy-addr external://0.0.0.0:18082 a
• [MAJOR] tests/ci/test_dev_105_lane_boundary_omn19544.py, test_dev_105_lane_boundary_census_on_105_reads_clean (qwen3-review) — Missing test: no assertion that dev-105 is absent from GOVERNED_LANES in the census plan output | The test test_dev_105_lane_boundary_census_on_105_reads_clean asserts plan["findings"] == [] and plan[
• [MAJOR] docker/docker-compose.dev-105.yml, x-omninode-contract-overlay / redpanda command (glm-review) — Advertised Kafka address is unreachable from runner containers | Redpanda advertises external://127.0.0.1:43192. A client in a Docker Desktop runner container bootstraps successfully, but on the first
• [MAJOR] deploy/lane-census/lane-manifest.yaml, dev-105 lane block (glm-review) — Host slot time-sharing is procedural, not enforced | The lane and the prove-105 stack are mutually exclusive by arithmetic (4.1 GiB dogfood + ~5 GiB prover + ~5-7 GiB lane against a 15.6 GiB VM), yet
• [MAJOR] tests/ci/test_dev_105_lane_boundary_omn19544.py (glm-review) — Boundary tests regex-scrape static YAML instead of rendered compose config | The port, label, and volume assertions scrape the overlay file text with regexes. This bypasses compose semantics: !overrid
• [MINOR] tests/ci/test_dev_105_lane_boundary_omn19544.py, _published_port_lines (qwen3-review) — Regex in _published_port_lines may miss port lines with different indentation | The function _published_port_lines uses the regex ^\s+-\s+"([^"]:\d+:\d+)"\s$ with re.MULTILINE. This matches lines li
• [MINOR] docker/docker-compose.dev-105.yml, redpanda service (qwen3-review) — Redpanda memory default of 2G may be insufficient for the dev lane workload | The overlay sets DEV_105_REDPANDA_MEMORY default to 2G, justified by the .105 VM having 15.6 GiB total with 4.1 GiB used b
• [MINOR] tests/ci/test_dev_105_lane_boundary_omn19544.py, test_dev_105_lane_boundary_reaches_nothing_on_201 (qwen3-review) — No test verifies the Bifrost overlay file is syntactically valid YAML with the expected schema | The test test_dev_105_lane_boundary_reaches_nothing_on_201 validates the Bifrost overlay using ModelBif
• [MINOR] deploy/lane-census/lane-manifest.yaml, dev-105 entry (qwen3-review) — Time-sharing model has no enforcement mechanism | The lane manifest and overlay comments state that dev-105 and the prove-105 proof stack are time-shared on the .105 host, and that the lane is 'option
• [MINOR] tests/ci/test_dev_105_lane_boundary_omn19544.py, test_dev_105_lane_boundary_census_still_reports_a_stopped_runtime (qwen3-review) — Census test uses hardcoded container names that may drift from manifest | The test _healthy_dev_105_rows constructs container rows using the manifest's service names, which is correct. However, the ne
• [MINOR] tests/ci/test_dev_105_lane_boundary_omn19544.py, test_dev_105_lane_boundary_identifiers_cannot_trip_the_no_raw_prod_bypass_matcher (qwen3-review) — No test verifies that the dev-105 compose project name does not collide with any existing Docker project on .105 | The test test_dev_105_lane_boundary_block_is_clear_of_every_other_lane checks that no
• [MINOR] tests/ci/test_dev_105_lane_boundary_omn19544.py, _bindings() (glm-review) — Port-line parsing breaks on IPv6 and multi-address publishes | _bindings() splits each port line on ':' and assumes exactly host-ip:host-port:container-port. An IPv6 publish ([::1]:43436:5432) or a fu
• [MINOR] deploy/lane-census/lane-manifest.yaml, dev-105 lane block (glm-review) — Unanchored image_tag_pattern accepts any tag including prod | image_tag_pattern: '.+' matches every image tag, so the census on .105 accepts containers running prod- or stability-tagged images under t
• [MINOR] tests/ci/test_dev_105_lane_boundary_omn19544.py (glm-review) — Boundary test couples to unrelated governance constants | test_dev_105_lane_boundary_is_not_deploy_attribution_governed asserts frozenset equality on GOVERNED_LANES and GRANT_INTERLOCK_LANES. Any legi
• [MINOR] tests/ci/test_dev_105_lane_boundary_omn19544.py (glm-review) — Positive controls read live sibling files and fail misleadingly | test_dev_105_lane_boundary_verify_ports_are_loopback_publishes and the broker-sizing test assert facts about docker-compose.dev-202.ym