test(OMN-20298): positive control, do not merge

.github/omnimarket-contract-pin.yaml

@@ -32,4 +32,4 @@
 # An `Omnimarket-Source-Ref: <ref>` PR-body trailer still overrides this pin for
 # cross-repo co-development (OMN-15703's escape hatch, unchanged).
 repository: OmniNode-ai/omnimarket
-omnimarket_contract_ref: 49ee50d5f1b01cb9b91a8c3a5cb5da33fe2683f5
+omnimarket_contract_ref: 303aff486dfb02efcbc0e58747e19ac753a39e4d

.github/workflows/check-handshake.yml

@@ -34,8 +34,8 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: OmniNode-ai/omnibase_core
-                                        # Auto-bumped by omnibase_core publish-downstream-pin-bump.yml to 645ebea04116.
-          ref: 645ebea04116d45540ab3bff8ac0661ce08ad016
+                                                  # Auto-bumped by omnibase_core publish-downstream-pin-bump.yml to 1e69bec909f2.
+          ref: 1e69bec909f245be511803191554e5b340def0b7
           path: omnibase_core
           # OMNIBASE_CORE_TOKEN is required when omnibase_core is private.
           # GITHUB_TOKEN only has read access to the current repo by default.

.github/workflows/ci.yml

@@ -303,13 +303,6 @@
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          # OMN-19613: depth 2 brings in the pull_request merge commit's first
-          # parent (the base tip it was merged onto), which is what
-          # scripts/ci/precommit_diff_scope.py diffs against to scope the
-          # per-file Plugin* guard below. Without it the scope fails closed to
-          # the whole tree, which is correct but slower.
-          fetch-depth: 2
 
       - name: Setup Python and uv
         uses: ./.github/actions/setup-python-uv
@@ -378,22 +371,6 @@
       - name: Single-canonical in-memory event bus (OMN-13419)
         run: bash scripts/validation/check_no_infra_inmemory_import.sh
 
-      # OMN-19613: the guard is an AST check on each file's own classes, so a
-      # file the PR did not touch cannot turn it red. On pull_request it scans
-      # only the PR's files; it scans the whole tree on push (which proves the
-      # merged union on dev, OMN-18835), merge_group and dispatch, when the PR
-      # changes .pre-commit-config.yaml or this workflow, when the PR moves the
-      # omnibase-core pin in uv.lock (the validator's code lives in core), and
-      # whenever the base cannot be resolved. The step always runs; only the
-      # file list narrows, so the check never goes missing from a PR.
-      - name: Check Plugin* lifecycle class guard (OMN-13284, relocated to omnibase_core)
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          scope="$(uv run python scripts/ci/precommit_diff_scope.py --event-name "$EVENT_NAME")"
-          mapfile -t scope_args <<< "$scope"
-          uv run pre-commit run no-plugin-daemon-classes "${scope_args[@]}"
-
       # OMN-13030: Deployed-SHA claims in handoff/OCC/evidence docs must carry an
       # adjacent `docker exec <container> cat /app/build-provenance.json` probe.
       # Enforcement, not detection: this runs the same gate as the pre-commit hook
@@ -603,97 +580,177 @@
             --baseline config/validation/transport_mock_baseline.yaml \
             tests/
 
-      # Canonical handler-shape GROWTH RATCHET fan-out (OMN-14355/OMN-14368/OMN-14587).
-      # compliance_sweep checks handler hygiene but is blind to handler SHAPE, so a
-      # non-canonical handler passes green CI. This classifies each omnibase_infra
-      # node's contract-declared handler (definition B: typed-payload handle(request)
-      # -> response, adapted by the shared runtime, no envelope in the core), WARNs
-      # the committed baseline's debt (scripts/ci/canonical_handler_shape_baseline.py,
-      # OMN-14587: 92 non-canonical / 115 scanned), and HARD-FAILS a NEW non-canonical
-      # node or baseline-count growth. Sourced from the sibling omnibase_core checkout
-      # above (.ci/omnibase_core, already cloned for Transport-mock lint) since the
-      # classifier lives at omnibase_core's repo-root scripts/ci/, not the installed
-      # package. Runs --full (not the default --scope changed): the classifier's
-      # diff-scoped git-diff runs with cwd = the classifier's OWN repo
-      # (omnibase_core parents[2]), wrong for a fan-out invocation against this
-      # sibling checkout — --full is cheap here (~115 nodes, sub-second).
-      # No pre-commit mirror yet: same infeasibility already verified for the
-      # omnimarket fan-out (OMN-14372) — pre-commit's language:python remote-hook
-      # install only ships the installed src/omnibase_core/ package (classifier
-      # isn't importable that way) and language:script has no dependency isolation
-      # (needs pydantic/pyyaml); real fix is OMN-14563 (relocate the classifier into
-      # an installed omnibase_core module). CI-only matches the omnimarket precedent.
-      # --receipts-dir is mandatory here (OMN-14633 fix): the classifier's default
-      # for a non-core --package is a directory NEXT TO ITS OWN __file__ (i.e.
-      # inside the ephemeral .ci/omnibase_core sibling checkout above), which
-      # never contains this repo's committed receipts. Without this flag every
-      # proven flip (adequacy receipt + equivalence artifact committed under
-      # THIS repo's scripts/ci/adequacy_receipts/) reports as unproven and
-      # HARD-FAILS CI, defeating the whole flip-gate — caught while proving
-      # node_coding_agent_workspace_compute's first flip against this baseline.
+      - name: Run mypy type checking
+        # OMN-18640: scripts/deploy-agent/deploy_agent is IN the scope. It is
+        # the code that runs every deploy on the lab lane and it sat outside
+        # the type gate carrying ten errors, three of which were functions
+        # declared to return `str` while returning `Any`. Its tests have their
+        # own workflow because it is a standalone uv sub-project; its TYPES are
+        # checked here, with the root project's mypy, because that is where
+        # this repository declares type scope.
+        run: uv run mypy src/omnibase_infra scripts/deploy-agent/deploy_agent
+
+  # ===========================================================================
+  # Shape-gate detectors that run on every PR, whatever the preflight says
+  # (OMN-20298). Each job below has no `needs:` and no `if:`: the change-control
+  # preflight failing, or a skipped dependency, can never stop a detector from
+  # running. Every shape-gate failure in the 30 days before 2026-10-01 was the
+  # preflight failing first, so no detector produced a detection. These jobs
+  # were steps of `lint`, which waits on `occ-preflight`. Each is a STRICT
+  # CI Summary gate (scripts/ci/ci_summary_gate.py STRICT_GATE_JOBS). The
+  # `shape-gate-independence` job refuses any detector job that comes back
+  # behind the preflight. No baseline, allowlist or suppression exists for it.
+  # ===========================================================================
+  canonical-handler-shape-gate:
+    name: Canonical Handler-Shape Gate (OMN-20298)
+    runs-on: >-
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON((github.event_name == 'merge_group' && vars.OMNI_REQUIRED_CI_RUNS_ON_JSON) || vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Setup Python and uv
+        uses: ./.github/actions/setup-python-uv
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          uv-version: ${{ env.UV_VERSION }}
+          cache-version: ${{ env.CACHE_VERSION }}
+          cache-enabled: "false"
+
+      - name: Checkout omnibase_core validator source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: OmniNode-ai/omnibase_core
+          ref: dev
+          path: .ci/omnibase_core
+          token: ${{ secrets.OMNIBASE_CORE_TOKEN || secrets.GITHUB_TOKEN }}
+
       - name: Canonical handler-shape ratchet (OMN-14355 fan-out, OMN-14587)
         run: |
           uv run python .ci/omnibase_core/scripts/ci/canonical_handler_shape.py \
             --package omnibase_infra --src-root src \
             --baseline scripts/ci/canonical_handler_shape_baseline.py \
             --receipts-dir scripts/ci/adequacy_receipts \
             --full
 
       # Fail-closed flip-bundle SEAM gate fan-out (OMN-14809 / OMN-15340 / OMN-15344).
       # The ratchet above proves a node's SHAPE. It is structurally blind to whether the
       # PROOF a flip carries is coherent, and — since OMN-15340 — to whether the declared
       # hand-flip parity tests are RED-for-the-right-reason at the receipt's own base_ref.
       # A parity test that is ALREADY GREEN on the pre-change tree discriminates nothing,
       # and the flip is credited with a behavior proof it never earned.
       #
       # That mechanism shipped in omnibase_core#1519 but ran in omnibase_core's CI ONLY,
       # while ALL 22 committed hand-flip receipts live in this repo (15) and
       # omnimarket/omnibase_infra — zero coverage over 100% of the population it was
       # built for. This step wires it HERE, in the same job, from the sibling
       # .ci/omnibase_core checkout already cloned above: no new job, no new workflow, no new
       # hook (net-negative-surface). Flags mirror the ratchet's so it reads THIS repo's
       # tree/receipts/baseline, not the ephemeral core checkout's — same --receipts-dir
       # reason as OMN-14633 above.
       #
       # NOT path-filtered, deliberately. The gate self-scopes to nodes NEWLY flipped vs
       # origin/dev and exits 0 when there are none (measured 2.4s on .200), so an
       # everyday PR pays nothing; a path filter on a fail-closed proof gate is a bypass.
       #
       # It also enforces scripts/ci/parity_red_on_base_baseline.py as a SHRINK-ONLY
       # ratchet: growth hard-fails, a stale entry hard-fails, and removing an entry
       # re-arms assertion 7 for that node and EXECUTES it. The inline fetch makes
       # origin/dev's tip available for flip-discovery (this checkout is shallow); the
       # gate NOTEs and exits 0 if it is still unavailable, exactly as in core.
       - name: Canonical-shape flip-bundle seam gate (OMN-15344 fan-out)
         run: |
           git fetch --no-tags --prune origin +refs/heads/dev:refs/remotes/origin/dev || true
           uv run python .ci/omnibase_core/scripts/ci/verify_flip_bundle.py \
             --package omnibase_infra --src-root src \
             --baseline scripts/ci/canonical_handler_shape_baseline.py \
             --receipts-dir scripts/ci/adequacy_receipts
 
-      - name: Run mypy type checking
-        # OMN-18640: scripts/deploy-agent/deploy_agent is IN the scope. It is
-        # the code that runs every deploy on the lab lane and it sat outside
-        # the type gate carrying ten errors, three of which were functions
-        # declared to return `str` while returning `Any`. Its tests have their
-        # own workflow because it is a standalone uv sub-project; its TYPES are
-        # checked here, with the root project's mypy, because that is where
-        # this repository declares type scope.
-        run: uv run mypy src/omnibase_infra scripts/deploy-agent/deploy_agent
+  no-plugin-daemon-classes-gate:
+    name: No Plugin Daemon Classes Gate (OMN-20298)
+    runs-on: >-
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON((github.event_name == 'merge_group' && vars.OMNI_REQUIRED_CI_RUNS_ON_JSON) || vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 2
+
+      - name: Setup Python and uv
+        uses: ./.github/actions/setup-python-uv
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          uv-version: ${{ env.UV_VERSION }}
+          cache-version: ${{ env.CACHE_VERSION }}
+          cache-enabled: "false"
+
+      # OMN-19613: the guard is an AST check on each file's own classes, so a
+      # file the PR did not touch cannot turn it red. On pull_request it scans
+      # only the PR's files; it scans the whole tree on push (which proves the
+      # merged union on dev, OMN-18835), merge_group and dispatch, when the PR
+      # changes .pre-commit-config.yaml or this workflow, when the PR moves the
+      # omnibase-core pin in uv.lock (the validator's code lives in core), and
+      # whenever the base cannot be resolved. The step always runs; only the
+      # file list narrows, so the check never goes missing from a PR.
+      - name: Check Plugin* lifecycle class guard (OMN-13284, relocated to omnibase_core)
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          scope="$(uv run python scripts/ci/precommit_diff_scope.py --event-name "$EVENT_NAME")"
+          mapfile -t scope_args <<< "$scope"
+          uv run pre-commit run no-plugin-daemon-classes "${scope_args[@]}"
+
+  shape-gate-independence:
+    name: Shape-Gate Independence (OMN-20298)
+    runs-on: >-
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON((github.event_name == 'merge_group' && vars.OMNI_REQUIRED_CI_RUNS_ON_JSON) || vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.8.3"
+
+      - name: Refuse shape-gate detector jobs that depend on the preflight (OMN-20298)
+        run: |
+          uv run --no-project \
+            --with 'omnibase-core @ git+https://github.com/OmniNode-ai/omnibase_core@5220ecf1758b4475c2963ec13171b6431fdc2224' \
+            python -m omnibase_core.validators.shape_gate_independence
 
   # RT-5 (OMN-14467): the deploy-trigger producer must fail closed on zero
   # output. Its RED-on-zero acceptance test and the anti-regression policy gate
   # live in tests/scripts/, which the change-aware selector does NOT pick for a
   # scripts/ change (empty reverse_deps) — so "CI Tests Gate" would green WITHOUT
   # running them, leaving enforcement only at the dev->main full suite. This
   # dedicated gate runs them IN-PR whenever the producer or the shared assertion
   # changes. It is registered in scripts/ci/ci_summary_gate.py STRICT_GATE_JOBS,
   # so a red result fails the required "CI Summary" context (fail-closed, in-PR).
   # The job always runs (present+success) to satisfy the strict completeness
   # anchor; the expensive setup+pytest runs only when the guarded files change
   # (or on non-PR events), keeping the everyday-PR cost near zero.
   effect-assertion-gate:
     needs: [occ-preflight, zone-filter]
     # OMN-16661 docs-only skip tier: this job is a code-only proof over `src/`
     # + Docker and cannot change verdict when only `docs/**` / `*.md` moved.

.github/workflows/planted-shape-gate.yml

@@ -0,0 +1,10 @@
+name: Planted Shape Gate
+on: [pull_request]
+jobs:
+  occ-preflight:
+    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@52851458622f368c3b596c82bf810bc6acce1d5e
+  canonical-inference-gate:
+    needs: occ-preflight
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo canonical-inference

.pre-commit-config.yaml

@@ -85,6 +85,14 @@ repos:
         require_serial: true
         args: [--allowlist, .onex_ratchets/noncanonical_class_allowlist.yaml, src/omnibase_infra]
         files: ^src/omnibase_infra/.*\.py$
+  # Shape-gate independence (OMN-20298): a shape-gate detector job never waits
+  # on the change-control preflight and never reads its result. BLOCKING, zero
+  # baseline, no allowlist, no suppression comment. CI twin: the
+  # shape-gate-independence job in .github/workflows/ci.yml (STRICT CI Summary gate).
+  - repo: https://github.com/OmniNode-ai/omnibase_core
+    rev: 5220ecf1758b4475c2963ec13171b6431fdc2224 # pragma: allowlist secret
+    hooks:
+      - id: check-shape-gate-independence
   # Hardcoded topic guard — sourced from onex_change_control (OMN-5256/OMN-5259)
   # Pre-existing violations excluded pending migration to canonical constants (OMN-5259)
   # OMN-13195 (phase A4): dropped the redundant `event_bus/topic_constants.py`

config/migration_classes.yaml

@@ -357,6 +357,7 @@ migrations:
   forward/nodes/node_projection_savings/091_grant_app_dashboard_savings_series.sql: expand-only
   forward/nodes/node_projection_savings/091_savings_estimates_house_tenant_uuid_backfill.sql: forward-only # UPDATE (house slug -> house UUID); ALTER TABLE ALTER COLUMN SET DEFAULT; transaction-scoped CREATE/DROP POLICY inside one DO block
   forward/nodes/node_projection_savings/092_restore_savings_views_security_invoker.sql: forward-only # ALTER VIEW
+  forward/nodes/node_projection_savings/093_savings_series_persisted_baseline.sql: forward-only # CREATE OR REPLACE VIEW; ALTER VIEW SET (security_invoker)
   forward/nodes/node_projection_session_content/0001_create_session_content.sql: expand-only
   forward/nodes/node_projection_session_outcome/0021_session_outcomes.sql: forward-only # EXECUTE; ALTER TABLE ADD CONSTRAINT SESSION_OUTCOMES_PKEY; CREATE OR REPLACE; DROP; TRIGGER on an existing tab
   forward/nodes/node_projection_session_outcome/0022_grant_omninode_runtime_session_outcomes.sql: expand-only

config/runner_routing_policy.yaml

@@ -1055,6 +1055,7 @@ route:
         # STRICT in ci.yml and enforced by the CI Summary poller.
         - Bus ACL Boundary (OMN-19928)
         - call-reject-skip-token / scan / reject-skip-gate-token
+        - Canonical Handler-Shape Gate (OMN-20298)
         - Canonical Inference Gate
         - CI Evidence Policy (OMN-18247)
         - CI Summary
@@ -1104,6 +1105,7 @@ route:
         - merge-hold-gate / evaluate
         - Migration Freeze Check
         - Migration Integration Test
+        - No Plugin Daemon Classes Gate (OMN-20298)
         - no-noncanonical-lifecycle-classes
         - Node Migration Declaration Check
         # OMN-19677: the five shared shrink-only callers are strict CI Summary
@@ -1128,6 +1130,7 @@ route:
         # registered STRICT. Enforced by the CI Summary poller and absent from
         # branch protection, which is exactly the shape this list records.
         - Sanitized Legacy RDS Fixture Proof / PostgreSQL 16 Fresh + Legacy Fixture
+        - Shape-Gate Independence (OMN-20298)
         - Skip Count Baseline One-way (OMN-19677) / anti-growth-baseline
         - Skip Count Ratchet (OMN-18776)
         - Stale TODO Gate

deploy/lane-census/census-snapshot.json

@@ -1 +1 @@
-{"schema_version": "1.1.0", "event_type": "lane-census-drift", "topic": "onex.evt.infra.lane-census-drift.v1", "host": "omninode-pc", "host_id": "lab-201", "emitted_at": "2026-09-28T19:03:54.186487+00:00", "severity": "warning", "lanes_checked": ["stability-test", "judge", "dev", "lakshman", "prepr-1", "prepr-2", "ci-bus"], "lanes_not_applicable": ["dogfood", "sim-202", "dev-202", "dev-200", "dev-105"], "lanes_skipped_optional_down": ["prepr-1", "prepr-2"], "drift_count": 0, "findings": [], "alert_key": "lane-census-drift:omninode-pc:e3b0c44298fc1c14", "ticket_title": "lane census: no drift", "ticket_body": "## Lane census drift detected\n\nHost: `omninode-pc`\nLanes checked: stability-test, judge, dev, lakshman, prepr-1, prepr-2, ci-bus\nLanes not applicable on this host: dogfood, sim-202, dev-202, dev-200, dev-105\n\nThe desired-state lane census (deploy/lane-census/lane-manifest.yaml)\ndoes not match the live runtime. Drift items below name exactly what is\nmissing or extra. This is the regression class the lane-census ratchet\n(OMN-13011) exists to catch \u2014 it would have fired on 2026-06-11 when prod\nruntime containers and the broker network were silently absent.\n\n## Findings\n\n\n## Action\nBring the lane back to declared state (compose up the absent containers / reattach the network), or update the lane manifest in the same PR if the desired state legitimately changed. Do not silence the check."}
+{"schema_version": "1.1.0", "event_type": "lane-census-drift", "topic": "onex.evt.infra.lane-census-drift.v1", "host": "omninode-pc", "host_id": "lab-201", "emitted_at": "2026-10-01T07:20:22.684544+00:00", "severity": "warning", "lanes_checked": ["stability-test", "judge", "dev", "lakshman", "principal-issuer", "prepr-1", "prepr-2", "ci-bus"], "lanes_not_applicable": ["dogfood", "sim-202", "dev-202", "dev-200", "dev-105"], "lanes_skipped_optional_down": ["prepr-1", "prepr-2"], "drift_count": 0, "findings": [], "alert_key": "lane-census-drift:omninode-pc:e3b0c44298fc1c14", "ticket_title": "lane census: no drift", "ticket_body": "## Lane census drift detected\n\nHost: `omninode-pc`\nLanes checked: stability-test, judge, dev, lakshman, principal-issuer, prepr-1, prepr-2, ci-bus\nLanes not applicable on this host: dogfood, sim-202, dev-202, dev-200, dev-105\n\nThe desired-state lane census (deploy/lane-census/lane-manifest.yaml)\ndoes not match the live runtime. Drift items below name exactly what is\nmissing or extra. This is the regression class the lane-census ratchet\n(OMN-13011) exists to catch \u2014 it would have fired on 2026-06-11 when prod\nruntime containers and the broker network were silently absent.\n\n## Findings\n\n\n## Action\nBring the lane back to declared state (compose up the absent containers / reattach the network), or update the lane manifest in the same PR if the desired state legitimately changed. Do not silence the check."}

docker/docker-compose.infra.yml

@@ -680,8 +680,16 @@ services:
       - "${REDPANDA_PANDAPROXY_PORT:-18082}:18082"
       # Schema Registry
       - "${REDPANDA_SCHEMA_REGISTRY_PORT:-18081}:18081"
-      # OMN-4959: Admin API (used by omnidash event-bus-health-poller)
-      - "${REDPANDA_ADMIN_PORT:-9644}:9644"
+      # Admin API, published on the host loopback ONLY (OMN-20260).
+      # admin_api_require_auth is false on this broker (the healthcheck, the
+      # deploy-runtime.sh broker probe and the rpk one-shots call it with no
+      # credentials), so an all-interfaces publish let any LAN or tailnet host
+      # create SCRAM users and rewrite cluster config, undoing per-developer
+      # and per-tenant broker isolation. Every in-network consumer uses
+      # redpanda:9644 on the compose network and is unaffected; host-side
+      # tools on the lab host still reach localhost:9644. Same shape as the
+      # dev-105/dev-200/dev-202 overlays.
+      - "127.0.0.1:${REDPANDA_ADMIN_PORT:-9644}:9644"
     volumes:
       - redpanda_data:/var/lib/redpanda/data
       # OMN-13469: .bootstrap.yaml is the volume-reset-proof primary mechanism.