[Patel230]

Summary

The .201 dev lane's runtime-effects gets the projection read binding through OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY, so the runtime /skill edge can serve OMN-20159's node_projection_read_effect there. Today that edge answers projection_binding_unconfigured on every read: 100 of 100 at 02:59Z on 2026-10-05, while :3002 answered 200 with 50 rows for the same request.

The runtime binding variable stays off runtime-effects. #4441 used it, the delegate-skill claim store followed it and logged in as role_omnidash, and every bus delegation failed with UndefinedTable until #4481 (OMN-17427) took it out. #4481's test said to change it once the claim store resolves a write principal apart from the read binding. omnimarket#3364 did that (merged 2026-10-04T23:33:10Z, in omnimarket v0.4.298): only the read node and the local dashboard follow the read variable, and the claim store and evidence store keep following the runtime variable, which this lane does not set.

Update 2026-10-06 (head 5b27874e7)

• 5b27874e7 carries signed merges of current origin/dev through b4d3c11b8 into the previously green branch head bd197e5d2. Both merge-trees were conflict-free, and dev changed none of this PR's seven paths.
• CI run 37378198754 completed successfully on bd197e5d2; the required CI Summary context was green. CI for 5b27874e7 runs after this head is pushed. OCC#12864 is merged.
• On OMN-20159, Jonah recorded the operator's choice (c): keep dev-201 frozen through Tech Week, count a fresh Lakshman-lane readback on current code for AC4 for now, and repeat the readback on dev-201 after the freeze lifts. This merge does not deploy or restart the shared lane. The fresh Lakshman-lane readback is still owed, so the ticket remains In Progress after this PR merges.

What changed

• docker/docker-compose.dev-lane.yml, runtime-effects only:
  • sets OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: /etc/onex/projection-read-binding.yaml;
  • mounts docker/projection-runtime-binding/runtime-read.yaml read-only at that path;
  • the comment fix(OMN-17427): the dev lane's runtime-effects carries no projection read binding while it is also the claim store #4481 left there is replaced by one that says why it is the read variable and not the runtime one.
• docker/projection-runtime-binding/runtime-read.yaml (new, the file feat(OMN-20159): the lakshman and dev lanes' runtime-effects carry the projection read binding #4441 added and fix(OMN-17427): the dev lane's runtime-effects carries no projection read binding while it is also the claim store #4481 deleted, with its comment rewritten): database_url_secret_ref: env:OMNIDASH_ANALYTICS_DB_URL, consumer group local.omnimarket-projections.runtime-read.consume.v1, no credential material. The dev-lane overlay already renders that variable on runtime-effects as role_omnidash, the same identity projection-api (:3002) reads with, so no new secret or principal.
• docker/docker-compose.dev-105.yml, dev-200.yml, dev-202.yml, prepr.yml, runtime-effects: each sets OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: "". These four layer the dev-lane overlay, merge its environment and replace its volumes (volumes: !override). Without the blank they would inherit the variable but not the file, and every read on them would change from projection_binding_unconfigured to projection_binding_invalid (omnimarket raises when the read variable names a file that does not load). omnimarket treats a blank value as unset, so those lanes behave exactly as they do today. This is the same rebind pattern OMN-20533 used for the effects Infisical identity.
• tests/integration/infra/test_dev_runtime_compose_render.py: fix(OMN-17427): the dev lane's runtime-effects carries no projection read binding while it is also the claim store #4481's test_dev_lane_runtime_effects_carries_no_projection_binding is replaced by eight tests (26 in the module, up from 17), listed under verification.

Rendered docker compose config for the dev lane (docker-compose.infra.yml + docker-compose.dev-lane.yml, profile runtime) at head 1039fe49b:

runtime-effects environment:
  OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: /etc/onex/projection-read-binding.yaml
  OMNIMARKET_PROJECTION_RUNTIME_BINDING_OVERLAY: <absent>
runtime-effects mounts at /etc/onex:
  bind projection-runtime-binding/runtime-read.yaml -> /etc/onex/projection-read-binding.yaml read_only=True
runtime-effects mount count: 9   (8 before this change, none lost)
omninode-runtime: neither variable set

Unlike #4441, the claim store and evidence store do not move. The dev lane has had no runtime binding on runtime-effects since #4481, so both stores are already on their container-local SQLite files and stay there. The double-claim window #4441's body described (a delivery in flight while the store moves) does not apply here.

How it was verified

AC4 readback after merge (2026-10-06 04:08Z, lakshman lane, current code)

Per Jonah's option (c) ruling, the lakshman-lane readback counts for OMN-20159 AC4 until dev-201's freeze lifts on 10-19. Full record: ticket comment.

• delegation.decisions.v1, lane tenant, limit 50: the runtime /skill edge and :53002 each return 50 rows with the same 50 correlation ids (AC4_MATCH=PASS).
• 100 sequential edge calls (04:08:47–04:08:50Z): 0 failed; p50 14.3 ms, p95 75.2 ms (min 9.2, max 851.6, mean 32.2).
• Negative controls (undeclared topic, limit mismatch, foreign tenant) each make the compare fail, as expected.

The implementation proof was run locally against origin/dev ea5585e99; the original change is commit 1039fe49b. Renders are docker compose config (Compose v5.1.2) only: nothing was started, and no lane was touched. The current head 5b27874e7 additionally carries signed merges of dev through b4d3c11b8. The mandatory commit hooks passed; the compose-render module is container-aware and is therefore re-run by CI rather than on the laptop under the P52 lab-first guard.

Failure modes, written before the tests, each with the test that catches it:

1. Dev runtime-effects still unbound, the variable not equal to the mount target, or a writable mount: test_dev_lane_runtime_effects_carries_the_projection_read_binding.
2. The runtime binding (variable or a mount at /etc/onex/projection-runtime-binding.yaml) back on runtime-effects, which moves the claim store onto role_omnidash again: test_dev_lane_runtime_effects_carries_no_runtime_binding, fix(OMN-17427): the dev lane's runtime-effects carries no projection read binding while it is also the claim store #4481's assertion kept, with its positive control.
3. The binding naming anything but env:OMNIDASH_ANALYTICS_DB_URL, a URL in the file, or runtime-effects rendering that variable differently from projection-api: test_dev_lane_read_binding_reads_as_the_projection_api_does.
4. A consumer group shared with another binding or a writer: test_dev_lane_read_binding_consumer_group_is_its_own.
5. The read variable or mount reaching runtime main or any other service: test_only_runtime_effects_carries_the_read_binding.
6. A lane that layers the dev overlay inheriting the variable without the file: test_lanes_layering_the_dev_overlay_carry_no_read_binding, which renders each of the four three-file stacks and has two positive controls (the dev overlay's broker auth is present, and the lane's own container name won).
7. A new overlay that layers the dev overlay and is not on that list: test_every_lane_layering_the_dev_overlay_is_listed.

Check 1, red then green (module tests/integration/infra/test_dev_runtime_compose_render.py, run with -rs, 0 skipped on every run):

• Tests added, compose unchanged (ea5585e99): 4 failed, 22 passed. Failing: the read-binding, reads-as-projection-api, consumer-group and only-runtime-effects tests.
• Dev overlay wired, the four lane overlays not yet blanked: 4 failed, 22 passed. Failing: the borrower test for each of dev-105, dev-200, dev-202 and prepr, each on '/etc/onex/projection-read-binding.yaml' == ''. That is failure mode 6 measured, not supposed.
• Full change: 26 passed.

Check 2, mutations on the branch, each restored afterwards (sha256 of the file equal before and after, and the worktree diff hash unchanged):

• M1 drop the read variable from dev runtime-effects: 1 failed (read-binding test).
• M2 binding names env:OMNINODE_INTERNAL_DB_URL: 1 failed (reads-as-projection-api).
• M3 read variable added to omninode-runtime: 1 failed (only-runtime-effects).
• M4 runtime variable back on runtime-effects, the feat(OMN-20159): the lakshman and dev lanes' runtime-effects carry the projection read binding #4441 shape: 5 failed (no-runtime-binding, and all four lane overlays, which would inherit it too).
• M5 mount not read-only: 1 failed. M6 variable value not equal to the mount target: 1 failed.
• M7 consumer group set to the registration writer's: 1 failed. M8 dev-202 no longer blanks the variable: 1 failed (its borrower case).
• M9 a database URL inlined in the binding: 1 failed. M10 dev-105 removed from the borrower list: 1 failed (listing test).

Check 3, related suites: 71 files, every test file that names one of the changed compose files, the binding directory or either binding variable, plus every compose-render module, tests/unit/docker and tests/ci/test_compose_required_env_coverage.py.

• origin/dev ea5585e99: 1130 passed, 6 skipped, 0 failed.
• Branch 1039fe49b: 1139 passed, 6 skipped, 0 failed. The difference of 9 is the render module going from 17 to 26 tests. The skip counts match; the skipped test names were not compared.
• The lakshman lane's render suite and the OMN-20533 borrower test are in that set and pass; docker/docker-compose.lakshman.yml and lakshman-runtime-read.yaml have no diff.

Gates: ruff check and ruff format --check clean on the test file, mypy clean on it, and the repository pre-commit ran at commit time: 67 passed, 92 skipped (no matching files), 0 failed.

Prior lab shape proof from the Lakshman lane, with runtime-effects carrying only the read variable, which is this PR's dev-lane shape:

• 2026-10-05 02:56-02:58Z, image built from omnimarket 63ea16d (one commit after fix(OMN-18073): deploy agent launches through a bash-sourced env and re-execs on self-update #3364): edge vs :3002 for delegation.decisions.v1, same tenant, 50 = 50 at limit 50 and 124 = 124 at limit 500; 100 sequential edge calls, 0 failed. One real bus delegation (93c70623-e8a1-406c-880e-f078db9ea02c) succeeded with its claim in the container SQLite store and 0 new rows in the Postgres claims table.
• 2026-10-05 03:31-03:34Z, after the lane's compose moved to ea5585e99 (feat(OMN-20159): the lakshman lane's runtime-effects reads through the read binding variable, not the runtime binding #4556's shape, base compose only): 50 = 50 and 125 = 125; 100 calls at limit 50, 0 failed, p50 14.3 ms, p95 31.8 ms. Claim store SQLite, Postgres claims delta 0.

The operator chose option (c) on 2026-10-05: do not deploy dev-201 during its Tech Week freeze. A fresh Lakshman-lane readback on current code counts for AC4 for now, and the same readback is repeated on dev-201 after the freeze lifts. That fresh readback is not claimed by this PR body yet.

Overlap: the open omnibase_infra PR inventory was re-read during review; no open PR touches any of the seven paths here, so there is no overlapping open change to reconcile.

Failure paths

n/a: this change writes no receipt, verdict or report. It is compose wiring, one binding file and render tests.

Open defects

None in this change. The typed-refusal shape at the /skill edge is tracked separately as OMN-20336.

Local gates

• No gate was bypassed — no --no-verify, no SKIP=, no --no-gpg-sign, no core.hooksPath override. Every pre-commit and pre-push hook ran.
• Any hook that failed was fixed at the input, not worked around.

Runtime startup gate

• N/A — this PR does not touch auto_wiring/, service_kernel.py, handler __init__ signatures, or kernel-level registration.

Strict-gate ordering

• No — not a gate PR.

Not in this change

• The typed-refusal shape at the /skill edge. A typed refusal still reaches callers as dispatch_error with RuntimeError: <error>; OMN-20336 owns that behavior.
• Restarting or redeploying the shared dev lane. #4588 freezes dev-201 until 2026-10-19T07:00:00Z. Per the operator's option (c) ruling, this PR does not send a promotion/ deploy during Tech Week. A runtime image older than omnimarket#3364 ignores the read variable and keeps answering projection_binding_unconfigured; docker/Dockerfile.runtime installs omnimarket from git ref dev by default, and v0.4.298 contains fix(OMN-18073): deploy agent launches through a bash-sourced env and re-execs on self-update #3364. Which omnimarket the dev lane's current image carries was not read for this PR.
• The lakshman lane: unchanged since #4556.
• The dev-105, dev-200, dev-202 and pre-PR lanes getting a read binding of their own. They keep today's behaviour.
• omninode_internal relations through the edge. They stay on :3002 until the standalone process is retired (OMN-8899).
• Any change to how the claim store or evidence store choose their database.

Evidence-Ticket: OMN-20159
Evidence-Source: OCC#12864

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 2
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 6
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 6 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Test discovery heuristic misses lane overlays that do not declare runtime-effects | The test test_every_lane_layering_the_dev_overlay_is_listed discovers lane overlays by checking if the file contai
• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (gpt-oss-review) — Test helper _mounts_at assumes dict‑style volume definitions | The new helper _mounts_at filters service["volumes"] for dict entries with a "target" key. Docker Compose may emit volume mounts as plain
• [MAJOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (gpt-oss-review) — Inconsistent handling of read binding across lane overlays | Dev lane overlays set OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY to a valid path and mount the file, while all other lane compose files exp
• [MINOR] docker/projection-runtime-binding/runtime-read.yaml (qwen3-review) — Read-only mount of binding file does not prevent credential leakage if file permissions are misconfigured | The new file docker/projection-runtime-binding/runtime-read.yaml is mounted read-only into
• [MINOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (qwen3-review) — Ambiguity in 'blank is unset' behavior for OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY | The comment in the lane overlays states: "Blank is unset to omnimarket, so reads here keep refusing projection_b
• [MINOR] docker/docker-compose.dev-lane.yml (gpt-oss-review) — Projection read binding path exposed via environment variable | The added environment variable OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY contains an absolute file path to a configuration file. While

Findings demoted from threads (anchor rejected)

• [MINOR] hostile-reviewer (qwen3-review)

  Test test_dev_lane_read_binding_consumer_group_is_its_own relies on a specific group name that may not be present | The test test_dev_lane_read_binding_consumer_group_is_its_own asserts that "local.omnimarket-projections.delegation-writer.consume.v1" is in env_groups. This is a hardcoded string that assumes a specific consumer group name is present in the environment of some service. If this group name is changed or removed in a future commit, the test will fail with a confusing error message. The tes

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (gpt-oss-review)

  Test assumes environment variable value equals mount target string | test_dev_lane_runtime_effects_carries_the_projection_read_binding asserts that the environment variable OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY equals the exact mount target path. If compose renders the variable with surrounding quotes or resolves it via variable substitution, the equality check may fail despite correct behavior. | Evidence: In test_dev_lane_runtime_effects_carries_the_projection_read_binding:

  assert effects["
  
  _Resolve this thread when addressed — the `Hostile Review Thread Gate` blocks while hostile-reviewer threads are unresolved (OMN-17492)._

[github-actions]

✅ Hostile Reviewer — REVIEWED

Critical findings: 0
Major findings: 5
Total findings: 12
Models succeeded: qwen3-review,gpt-oss-review
Models unavailable: none

Action required: findings were posted as review threads. Address or reject each one, then resolve its thread — the Hostile Review Thread Gate fails while hostile-reviewer threads are unresolved (OMN-17492).

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	Fails this job with a named reason

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review (Qwen3.8-27B), gpt-oss-review (gpt-oss-120b) (OMN-8468/OMN-8524/OMN-17492)

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 2
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 6
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 6 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] docker/docker-compose.dev-lane.yml (qwen3-review) — Read-only bind mount does not prevent credential leakage via /proc | The new mount is declared read-only (:ro), which prevents the container from writing to the file. However, the file contains `dat
• [MAJOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (qwen3-review) — Ambiguity in 'unset' semantics for empty string env vars | The plan sets OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: "" in borrower overlays to simulate 'unset'. The comment states "Blank is unset t
• [MAJOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (gpt-oss-review) — Empty string used to unset projection read binding variable | Several docker‑compose files set OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY to an empty string. The comment claims "Blank is unset to om
• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (gpt-oss-review) — Test assumes Docker Compose renders volume mounts as dictionaries | The new helper _mounts_at filters service.get("volumes", []) for entries where mount.get("target") == target. Docker Compose m
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Redundant file reads in test | The test test_dev_lane_read_binding_reads_as_the_projection_api_does reads the _READ_BINDING_FILE twice: once to parse the YAML and once to check for :// in the ra
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Coupling between read binding and projection-api DSN | The test asserts that runtime-effects and projection-api have the same OMNIDASH_ANALYTICS_DB_URL. This creates a tight coupling between the

Findings demoted from threads (anchor rejected)

• [MINOR] hostile-reviewer (qwen3-review)

  Test for lane discovery relies on fragile string matching | The test test_every_lane_layering_the_dev_overlay_is_listed uses a regex-like string check ("-f docker/docker-compose.dev-lane.yml" in text) to identify which overlays layer the dev-lane overlay. This is fragile because it depends on the exact formatting of the comment or instruction in the overlay file. If a new overlay uses a different phrasing or a different mechanism to layer the dev-lane overlay, the test will miss it, leading to incomplet

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (gpt-oss-review)

  Brittle assertion on KAFKA_SASL_MECHANISM in lane overlay test | The test test_lanes_layering_the_dev_overlay_carry_no_read_binding asserts that effects["environment"].get("KAFKA_SASL_MECHANISM") == "SCRAM-SHA-256". This couples the test to a specific overlay implementation; any legitimate change to authentication mechanism will break the test without indicating a real regression. | Evidence: Line in test asserts assert effects["environment"].get("KAFKA_SASL_MECHANISM") == "SCRAM-SHA-256". | Fix: Repl

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 10
Nit-level findings suppressed: 0

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 10 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] docker/projection-runtime-binding/runtime-read.yaml (qwen3-review) — Read-only mount does not prevent credential exfiltration via environment variable | The comment in runtime-read.yaml states 'NO CREDENTIAL MATERIAL. database_url_secret_ref names an ENV VAR; the compo
• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Borrower overlay test uses prepr render env for all four overlays | test_lanes_layering_the_dev_overlay_carry_no_read_binding is parametrized over all four borrower overlays (dev-105, dev-200, dev-202
• [MAJOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (gpt-oss-review) — Blank read-binding environment variable introduced in multiple compose overlays | The diff adds OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: "" to several compose files (dev-105, dev-200, dev-202, pr
• [MAJOR] docker/projection-runtime-binding/runtime-read.yaml and docker/docker-compose.dev-lane.yml (gpt-oss-review) — Missing test for absent or malformed read‑binding file | The new file docker/projection-runtime-binding/runtime-read.yaml is mounted read‑only, but the test suite does not verify behavior when the f
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — test_every_lane_layering_the_dev_overlay_is_listed uses fragile string matching | The test test_every_lane_layering_the_dev_overlay_is_listed discovers overlays that layer the dev-lane overlay by chec
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Consumer group uniqueness test does not verify partition assignment | test_dev_lane_read_binding_consumer_group_is_its_own asserts that the read binding's consumer group is not in the set of groups us
• [MINOR] docker/docker-compose.dev-105.yml (qwen3-review) — Blanking the read binding variable in borrower overlays may mask configuration errors | The borrower overlays (dev-105, dev-200, dev-202, prepr) set OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY to an em
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (gpt-oss-review) — _binding_mount_source helper returns only first matching mount | The helper was changed to use _mounts_at and returns the first element of the list. If a service defines multiple mounts to the sam
• [MINOR] docker/projection-runtime-binding/runtime-read.yaml (gpt-oss-review) — Unverified source of mounted configuration file | runtime-read.yaml is added to the repository and mounted into the container. If an attacker can modify this file in the source tree, they could inje
• [MINOR] docker/docker-compose.dev-lane.yml (gpt-oss-review) — Additional bind mount may increase container start‑up latency | Mounting runtime-read.yaml adds an extra filesystem bind operation for the runtime-effects service. While typically negligible, in e

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 9
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 9 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] docker/projection-runtime-binding/runtime-read.yaml (qwen3-review) — Read binding file exposes analytics DB URL to runtime-effects | The new file docker/projection-runtime-binding/runtime-read.yaml sets database_url_secret_ref to env:OMNIDASH_ANALYTICS_DB_URL. The test
• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py, test_lanes_layering_the_dev_overlay_carry_no_read_binding (qwen3-review) — Borrower overlay test uses prepr render env for all four lanes | test_lanes_layering_the_dev_overlay_carry_no_read_binding is parametrized over all four borrower overlays (dev-105, dev-200, dev-202, p
• [MAJOR] plan (gpt-oss-review) — Blank environment variable may be treated as set | The diff adds OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: "" to several compose files. If the runtime interprets an empty string as a defined value
• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (gpt-oss-review) — _mounts_at helper ignores short‑syntax volume definitions | The helper _mounts_at filters only dictionary‑type volume entries. Docker Compose's short‑syntax (source:target:ro) may be emitted as a
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py, test_every_lane_layering_the_dev_overlay_is_listed (qwen3-review) — test_every_lane_layering_the_dev_overlay_is_listed uses fragile text matching | The test discovers borrower overlays by grepping for the literal string '-f docker/docker-compose.dev-lane.yml' or 'over
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py, test_dev_lane_read_binding_consumer_group_is_its_own (qwen3-review) — test_dev_lane_read_binding_consumer_group_is_its_own iterates all services and parses binding files | The test builds binding_groups by iterating over all services, calling _binding_mount_source for e
• [MINOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (qwen3-review) — Borrower overlays blank the read binding variable but do not remove the env key | In dev-105, dev-200, dev-202, and prepr, the diff adds OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: "" to the runtime-e
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py, test_only_runtime_effects_carries_the_read_binding (qwen3-review) — No test verifies the read binding file is not mounted at the runtime binding target | The test test_dev_lane_runtime_effects_carries_no_runtime_binding asserts that _mounts_at(effects, _RUNTIME_BINDIN
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (gpt-oss-review) — URL parsing may misinterpret DSN with special characters | The test test_dev_lane_read_binding_reads_as_the_projection_api_does uses urllib.parse.urlsplit to extract the username from a PostgreSQL

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 2
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 8
Nit-level findings suppressed: 0

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 8 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Read-only mount does not prevent credential leakage via environment variable | The test asserts the mount is read-only to prevent the container from rewriting its database identity. However, the bindi
• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — WALrus operator in set comprehension may cause subtle scoping issues | The test uses a walrus operator inside a set comprehension: `for name, service in services.items() if name != "runtime-effects" a
• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Test for lane overlay discovery relies on fragile string matching | The test test_every_lane_layering_the_dev_overlay_is_listed discovers lane overlays by searching for the literal string `"\n runt
• [MAJOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (gpt-oss-review) — Empty string environment variable treated as set | The diff adds OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: "" to several compose files. Docker treats an empty string as a defined variable, so the
• [MAJOR] docker/docker-compose.dev-lane.yml (gpt-oss-review) — Relative host path in volume mount may be invalid in overlays | The added volume mount in docker-compose.dev-lane.yml uses a relative path ./projection-runtime-binding/runtime-read.yaml. When this
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Redundant file reads in test_dev_lane_read_binding_reads_as_the_projection_api_does | The test reads the binding file twice: once via yaml.safe_load(_READ_BINDING_FILE.read_text(encoding="utf-8")) a
• [MINOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (qwen3-review) — Blank environment variable in borrower overlays relies on undocumented behavior | The borrower overlays (dev-105, dev-200, dev-202, prepr) set OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: "" to effec
• [MINOR] docker/projection-runtime-binding/runtime-read.yaml (gpt-oss-review) — Missing validation for referenced secret in runtime-read.yaml | The newly added runtime-read.yaml contains database_url_secret_ref: "env:OMNIDASH_ANALYTICS_DB_URL" but the code that consumes this

Findings demoted from threads (anchor rejected)

• [MINOR] hostile-reviewer (qwen3-review)

  Test for consumer group uniqueness does not verify the writer's group is actually used | The test test_dev_lane_read_binding_consumer_group_is_its_own asserts that the read binding's consumer group is not in the set of other groups, but it does not verify that the delegation writer's group (local.omnimarket-projections.delegation-writer.consume.v1) is actually used by a service in the dev lane. The assertion assert "local.omnimarket-projections.delegation-writer.consume.v1" in env_groups is a positive

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (gpt-oss-review)

  Test helper assumes dict representation of volume mounts | The new helper _mounts_at filters service.get("volumes", []) for dict entries with a target key. Docker Compose's config output often represents volume mounts as short strings (e.g., source:target:ro). When such strings appear, the helper will ignore them, potentially causing false negatives in tests that verify mount presence. | Evidence: tests/integration/infra/test_dev_runtime_compose_render.py defines:
  +def _mounts_at(service: dict[str

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 3
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 9
Nit-level findings suppressed: 0

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 9 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Read-only bind mount does not prevent container from reading host file | The volume mount ./projection-runtime-binding/runtime-read.yaml:/etc/onex/projection-read-binding.yaml:ro is read-only, which
• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Test asserts DSN equality but does not verify RLS policy enforcement | The test test_dev_lane_read_binding_reads_as_the_projection_api_does asserts that effects_dsn == api_dsn and that the usernam
• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Discovery test uses fragile string matching on YAML structure | The test test_every_lane_layering_the_dev_overlay_is_listed discovers overlays by checking if the file contains the literal string `"\
• [MAJOR] docker/docker-compose.dev-lane.yml (gpt-oss-review) — Host file bind‑mount uses relative path | docker-compose.dev-lane.yml adds a bind‑mount of ./projection-runtime-binding/runtime-read.yaml into the container. The relative path is resolved against the
• [MAJOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (gpt-oss-review) — Blank environment variable treated as configured | Several compose files set OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY to an empty string. The runtime treats a non‑null value as a configured binding,
• [MAJOR] docker/docker-compose.dev-lane.yml (gpt-oss-review) — Read binding only mounted in runtime‑effects | The new read‑binding overlay is added exclusively to the runtime‑effects service. All other services, including writers and the main runtime, lack this b
• [MAJOR] docker/projection-runtime-binding/runtime-read.yaml (gpt-oss-review) — Potential credential exposure in runtime‑read.yaml | runtime-read.yaml contains kafka_bootstrap_servers pointing to an internal service. If future changes add authentication credentials (e.g., SASL pa
• [MINOR] docker/docker-compose.dev-lane.yml (qwen3-review) — Blanking the variable in borrower overlays is a maintenance burden | Each borrower overlay (dev-105, dev-200, dev-202, prepr) must explicitly set OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: "" to co
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — New file runtime-read.yaml has no validation test for YAML syntax | The new file docker/projection-runtime-binding/runtime-read.yaml is mounted into the container. If the file has a YAML syntax erro

Findings demoted from threads (anchor rejected)

• [MINOR] hostile-reviewer (qwen3-review)

  Consumer group uniqueness test does not check all writer groups | The test test_dev_lane_read_binding_consumer_group_is_its_own collects binding_groups from other services' binding files and env_groups from environment variables. It asserts that the read binding's group is not in the union. However, it only checks KAFKA_CONSUMER_GROUP and ONEX_GROUP_ID environment variables. If a writer service uses a different environment variable name for its consumer group, the test will miss it and the asserti

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (gpt-oss-review)

  Assumption of dict‑format volume entries in tests | The helper _mounts_at in tests expects volume entries to be dictionaries with keys "target", "type", and "read_only". Docker Compose may emit volume mounts as plain strings (e.g., "src:dest:ro"), causing the test to miss valid mounts and produce false negatives. | Evidence: tests/integration/infra/test_dev_runtime_compose_render.py:+def _mounts_at(service: dict[str, Any], target: str) -> list[dict[str, Any]]:

  • return [

  •    mount
    

  •    for mount
    

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (gpt-oss-review)

  Missing guard for absent OMNIDASH_ANALYTICS_DB_URL | Tests test_dev_lane_read_binding_reads_as_the_projection_api_does and related assertions access services["runtime-effects"]["environment"]["OMNIDASH_ANALYTICS_DB_URL"] without checking key existence. If the environment variable is omitted in a future overlay, a KeyError will abort the test, obscuring the intended validation. | Evidence: tests/integration/infra/test_dev_runtime_compose_render.py:+ effects_dsn = services["runtime-effects"]["environment"]

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

[Patel230]

Merged #4569 at reviewed head 5b27874e7 as 489cfbbe7.

The required CI Summary passed, and OCC#12864 is merged.

OMN-20159 remains In Progress. Per Jonah’s option (c) ruling, dev-201 stays frozen during Tech Week; a fresh Lakshman-lane readback on current code counts for AC4 for now, and the dev-201 readback repeats after the freeze.

Thank you!

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 2
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 10
Nit-level findings suppressed: 0

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 10 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] docker/projection-runtime-binding/runtime-read.yaml (qwen3-review) — Read binding file exposes Kafka bootstrap server and consumer group in a world-readable mount | The new file docker/projection-runtime-binding/runtime-read.yaml is mounted read-only into the runtime-e
• [MAJOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (qwen3-review) — Blank-string override may not be equivalent to unset for the application | The borrower overlays (dev-105, dev-200, dev-202, prepr) set OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY to an empty string ("
• [MAJOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — test_every_lane_layering_the_dev_overlay_is_listed uses fragile text matching | The test test_every_lane_layering_the_dev_overlay_is_listed discovers borrower overlays by searching for the literal str
• [MAJOR] docker/docker-compose.dev-105.yml, docker/docker-compose.dev-200.yml, docker/docker-compose.dev-202.yml, docker/docker-compose.prepr.yml (gpt-oss-review) — Blank read-binding env var introduced in multiple compose files | The diff adds OMNIMARKET_PROJECTION_READ_BINDING_OVERLAY: "" to several compose files (dev-105, dev-200, dev-202, prepr). Setting th
• [MAJOR] docker/docker-compose.dev-lane.yml (gpt-oss-review) — Relative host path bind mount of configuration file | The diff adds a bind mount in docker-compose.dev-lane.yml that maps ./projection-runtime-binding/runtime-read.yaml into the container at `/etc
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (qwen3-review) — Consumer group uniqueness test does not cover all possible group sources | test_dev_lane_read_binding_consumer_group_is_its_own checks that the read binding's consumer group is not in the set of group
• [MINOR] docker/projection-runtime-binding/runtime-read.yaml (qwen3-review) — Read binding file is a static host file with no per-lane differentiation | The file docker/projection-runtime-binding/runtime-read.yaml is a single static file mounted into the dev-lane runtime-effect
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (gpt-oss-review) — Missing test for missing or corrupted read-binding file | The added test suite verifies correct mounting and content when the file is present, but does not cover the scenario where the file is absent
• [MINOR] docker/docker-compose.dev-lane.yml (gpt-oss-review) — Additional read-only bind mount may increase container startup latency | Introducing an extra volume mount for every runtime-effects container adds a filesystem bind operation during container creat
• [MINOR] tests/integration/infra/test_dev_runtime_compose_render.py (gpt-oss-review) — Potential exposure of DSN password in test assertions | The test test_dev_lane_read_binding_reads_as_the_projection_api_does extracts OMNIDASH_ANALYTICS_DB_URL from environment and compares userna

Findings demoted from threads (anchor rejected)

• [MINOR] hostile-reviewer (qwen3-review)

  Test asserts read-only mount but does not verify the mount is a bind mount from the expected host path | test_dev_lane_runtime_effects_carries_the_projection_read_binding asserts mount.get("type") == "bind" and mount.get("read_only") is True, and that the source resolves to _READ_BINDING_FILE. However, the assertion Path(mount["source"]).resolve() == _READ_BINDING_FILE.resolve() depends on the compose config output normalizing the source path. If docker compose config returns a relative path or a path with

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (gpt-oss-review)

  Test code assumes read-binding file always exists and is valid YAML | New tests in tests/integration/infra/test_dev_runtime_compose_render.py read _READ_BINDING_FILE without handling FileNotFoundError or yaml.YAMLError. If the file is missing or malformed, the test suite will crash rather than report a controlled failure. | Evidence: Lines in test file:

  binding = yaml.safe_load(_READ_BINDING_FILE.read_text(encoding="utf-8"))
  ``` | Fix: Wrap file reading and YAML parsing in try/except block
  
  _Resolve this thread when addressed — the `Hostile Review Thread Gate` blocks while hostile-reviewer threads are unresolved (OMN-17492)._