refactor(OMN-20687): route host deployment through the operator node

.github/workflows/build-workspace-candidate-runtime.yml

@@ -5,7 +5,7 @@
 #
 # Builds a SCANNED workspace-from-dev runtime image and pushes it to ECR as an
 # explicitly NON-PROD "stability-candidate". This is the CI counterpart of the
-# local deploy-runtime.sh BUILD_SOURCE=workspace path: it stages the sibling
+# local onex-runtime-deploy BUILD_SOURCE=workspace path: it stages the sibling
 # repos at their dev HEAD, builds docker/Dockerfile.runtime in WORKSPACE mode,
 # runs the SAME Trivy scan + the OMN-9139 source-hash attestation + a provenance
 # manifest, and pushes a candidate-tagged image.

.github/workflows/node-migration-sync.yml

@@ -99,7 +99,7 @@ jobs:
           fi
 
   # OMN-13415: logic-regression gate for the deployed-migration-tree sync check.
-  # The PRIMARY enforcement is at deploy time — deploy-runtime.sh calls
+  # The PRIMARY enforcement is at deploy time — onex-runtime-deploy calls
   # check_deployed_migration_tree_sync.py after sync_files and BEFORE the
   # forward-migration phase, aborting if the bind-mounted deployed tree drifted
   # from the canonical clone @ the target SHA (the stability-promotion footgun:

.github/workflows/prod-promotion-lineage.yml

@@ -27,7 +27,7 @@ on:
       - "scripts/check_prod_promotion_lineage.py"
       - "tests/scripts/test_check_prod_promotion_lineage.py"
       - "tests/scripts/test_deploy_runtime_prod_lineage.py"
-      - "scripts/deploy-runtime.sh"
+      - "src/omnibase_infra/handlers/handler_runtime_deploy.sh"
       - "scripts/deploy-agent/deploy_agent/executor.py"
       - "scripts/deploy-agent/tests/unit/test_executor_promotion_lineage.py"
       - ".github/workflows/prod-promotion-lineage.yml"
@@ -38,7 +38,7 @@ on:
     paths:
       - "scripts/check_prod_promotion_lineage.py"
       - "tests/scripts/test_check_prod_promotion_lineage.py"
-      - "scripts/deploy-runtime.sh"
+      - "src/omnibase_infra/handlers/handler_runtime_deploy.sh"
       - "scripts/deploy-agent/deploy_agent/executor.py"
       - ".github/workflows/prod-promotion-lineage.yml"
   workflow_call:

.onex_ratchets/canonical_file_shape_baseline.txt

@@ -284,7 +284,6 @@ scripts/deploy-agent/deploy_agent/unit_drift.py
 scripts/deploy-build-loop-trigger.sh
 scripts/deploy-gateway.sh
 scripts/deploy-runners.sh
-scripts/deploy-runtime.sh
 scripts/deploy-timers.sh
 scripts/deploy-trigger.py
 scripts/diagnose_e2e.sh

.pre-commit-config.yaml

@@ -248,7 +248,7 @@ repos:
       - id: check-added-large-files
         args: [--maxkb=1000]
   # OMN-13220: shellcheck the deploy surface this repo owns. Scoped to
-  # deploy-runtime.sh + its runtime_build sibling scripts (the deploy crash-loop
+  # onex-runtime-deploy + its runtime_build sibling scripts (the deploy crash-loop
   # blast radius) rather than all 56 scripts/*.sh, so the gate enforces real
   # defects without a 56-script pre-existing-cleanup detour. SC1091 (sourced
   # host-env files shellcheck cannot follow) is silenced in .shellcheckrc.
@@ -257,7 +257,7 @@ repos:
     hooks:
       - id: shellcheck
         name: shellcheck (deploy-runtime surface)
-        files: ^scripts/(deploy-runtime\.sh|runtime_build/.*\.sh)$
+        files: ^(src/omnibase_infra/handlers/handler_runtime_deploy\.sh|scripts/runtime_build/.*\.sh)$
         stages: [pre-commit]
   # actionlint (GitHub Actions linting) is intentionally NOT wired as a
   # repo-wide pre-commit hook in this PR: a baseline run flags pre-existing
@@ -452,7 +452,7 @@ repos:
         name: Cloud migration failure gates only cloud consumers (OMN-18496)
         entry: uv run --frozen pytest tests/scripts/test_deploy_runtime_cloud_gate_omn18496.py -q
         language: system
-        files: ^(scripts/deploy-runtime\.sh|scripts/runtime_build/compose_files\.sh|docker/docker-compose\.(infra|dev-lane)\.yml|tests/scripts/test_deploy_runtime_cloud_gate_omn18496\.py)$
+        files: ^(src/omnibase_infra/handlers/handler_runtime_deploy\.sh|scripts/runtime_build/compose_files\.sh|docker/docker-compose\.(infra|dev-lane)\.yml|tests/scripts/test_deploy_runtime_cloud_gate_omn18496\.py)$
         pass_filenames: false
         stages: [pre-commit]
       # OMN-16367: per-run compose proof images must be evicted at source
@@ -1613,7 +1613,7 @@ repos:
         entry: uv run --frozen pytest tests/scripts/test_check_prod_promotion_lineage.py tests/scripts/test_deploy_runtime_prod_lineage.py -q --tb=short --timeout=120 --timeout-method=signal
         language: system
         pass_filenames: false
-        files: ^(scripts/check_prod_promotion_lineage\.py|tests/scripts/test_(check_prod_promotion_lineage|deploy_runtime_prod_lineage)\.py|scripts/deploy-runtime\.sh|scripts/deploy-agent/deploy_agent/executor\.py)$
+        files: ^(scripts/check_prod_promotion_lineage\.py|tests/scripts/test_(check_prod_promotion_lineage|deploy_runtime_prod_lineage)\.py|src/omnibase_infra/handlers/handler_runtime_deploy\.sh|scripts/deploy-agent/deploy_agent/executor\.py)$
         stages: [pre-commit]
       # Lane restart-set / refresh build-scope agreement (OMN-18114, OMN-17448)
       # A governed refresh always exports RUNTIME_BUILD_SERVICES_OVERRIDE, and
@@ -1629,7 +1629,7 @@ repos:
         entry: uv run --frozen pytest tests/unit/scripts/test_omn18114_lane_carrier_build_scope.py tests/unit/scripts/test_omn17448_dev_lane_writer_build_scope.py -q --tb=short --timeout=120 --timeout-method=signal
         language: system
         pass_filenames: false
-        files: ^(scripts/deploy-runtime\.sh|scripts/runtime_build/refresh_(dev|stability)_lane\.sh|docker/docker-compose\.(infra|dev-lane|stability-test)\.yml|tests/unit/scripts/test_omn(18114_lane_carrier_build_scope|17448_dev_lane_writer_build_scope)\.py)$
+        files: ^(src/omnibase_infra/handlers/handler_runtime_deploy\.sh|scripts/runtime_build/refresh_(dev|stability)_lane\.sh|docker/docker-compose\.(infra|dev-lane|stability-test)\.yml|tests/unit/scripts/test_omn(18114_lane_carrier_build_scope|17448_dev_lane_writer_build_scope)\.py)$
         stages: [pre-commit]
       # Markdown link validation (PR #172)
       # Ensures all internal markdown links point to existing files and anchors

config/governed_helper_baseline.json

@@ -47,7 +47,6 @@
     {"pair": "lock-without-holder-record", "path": "docker/runners/runner-monitor.sh", "line_sha256_12": "e6174b90f524", "occurrences": 1, "ticket": "OMN-18630", "verdict": "defect", "verdict_reason": "The fallback taken when flock is absent: a bare mkdir lock released only by an rmdir and an EXIT trap, with no holder record, so a SIGKILL leaves a lock nobody can tell from a live one.", "note": "if ! mkdir \"${AUTO_BOUNCE_LOCKFILE}.d\" 2>/dev/null; then"},
     {"pair": "lock-without-holder-record", "path": "scripts/ci/ensure_ci_env.sh", "line_sha256_12": "508871d4e725", "occurrences": 1, "ticket": "OMN-18630", "verdict": "not-a-call-site", "verdict_reason": "Creates the directory that will hold the lock files, not a lock.", "note": "mkdir -p \"${lock_dir}\""},
     {"pair": "lock-without-holder-record", "path": "scripts/ci/ensure_ci_env.sh", "line_sha256_12": "a17cb45b46e7", "occurrences": 1, "ticket": "OMN-18630", "verdict": "defect", "verdict_reason": "The fallback taken when flock is absent: a bare mkdir lock polled forever with no holder record and released only by an EXIT trap, so a SIGKILL leaves every later run waiting on a corpse.", "note": "until mkdir \"${lock_path}\" 2>/dev/null; do"},
-    {"pair": "lock-without-holder-record", "path": "scripts/deploy-runtime.sh", "line_sha256_12": "4d7fe16da4c1", "occurrences": 1, "ticket": "OMN-18630", "verdict": "benign", "verdict_reason": "Writes the owner PID into the lock and, by design, refuses to reclaim it: a second deployer exits 2 naming the recorded PID. It records no host or timestamp, but it fails loudly rather than reporting a held lock as nothing to do.", "note": "if mkdir \"${LOCK_DIR}\" 2>/dev/null; then"},
     {"pair": "lock-without-holder-record", "path": "scripts/hooks/prepush_dispatch.sh", "line_sha256_12": "50de9f58afa8", "occurrences": 2, "ticket": "OMN-18630", "verdict": "benign", "verdict_reason": "Writes pid, host and timestamp into the lock directory and reclaims it only when that pid is gone on the same host: the holder protocol, which the pattern cannot see because the record is written on the next line.", "note": "if mkdir \"$lockdir\" 2> /dev/null; then"},
     {"pair": "lock-without-holder-record", "path": "scripts/hooks/prepush_dispatch.sh", "line_sha256_12": "ad7fd4cef8ba", "occurrences": 2, "ticket": "OMN-18630", "verdict": "benign", "verdict_reason": "Writes pid, host and timestamp into the lock directory and reclaims it only when that pid is gone on the same host: the holder protocol, which the pattern cannot see because the record is written on the next line.", "note": "if mkdir \"$LOCKDIR\" 2> /dev/null; then return 0; fi"}
   ]

deploy/lane-census/lane-manifest.yaml

@@ -61,7 +61,7 @@
 #   `lane-census-check.sh` run on .201 is what turns the gap into visible drift instead of
 #   silence. The census reporting ten `container_absent` findings after this merges is the
 #   gate working, not a regression — it clears when the lanes are refreshed through the
-#   sanctioned attributed paths (`scripts/deploy-runtime.sh --execute`,
+#   sanctioned attributed paths (`onex-runtime-deploy --execute`,
 #   `scripts/runtime_build/refresh_stability_lane.sh --execute`). Declaring the desired state
 #   FIRST is the same discipline the lakshman reservation above used, and it is the opposite
 #   of the failure this file exists for: a running-but-undeclared container is invisible,
@@ -340,7 +340,7 @@ lanes:
       # therefore cannot start them, by construction.
       #
       # They were declared `kind: service, replicas: 1` by OMN-13815 on
-      # 2026-07-02 evidence, when deploy-runtime.sh's warm `--restart` named the
+      # 2026-07-02 evidence, when onex-runtime-deploy's warm `--restart` named the
       # full RUNTIME_SERVICES set explicitly (naming a service on the CLI
       # bypasses profile filtering, so they did run). OMN-14873 then scoped the
       # stability refresh down to the 4 core services via

deploy/maintenance/omninode-host-maintenance-sync.sh

@@ -8,7 +8,7 @@
 # WHY THIS EXISTS (OMN-15525)
 #   `deploy/maintenance/omninode-system-slack-report.sh` runs as root from
 #   /data/maintenance/bin/ under /etc/cron.d/. No sanctioned deploy path covered
-#   that directory: `deploy-runtime.sh` deploys containers, not host files. So
+#   that directory: `onex-runtime-deploy` deploys containers, not host files. So
 #   the script was hand-copied once, drifted for weeks, and the divergence was
 #   invisible — OMN-15509 fixed the repo copy and changed nothing about what the
 #   platform actually alarmed on, because nothing installs or checks the host

deploy/maintenance/omninode-system-slack-report.sh

@@ -36,7 +36,7 @@
 #   Four separate false-green mechanisms are closed here:
 #     1. Lane coverage. Every lane's MAIN runtime health endpoint is probed,
 #        and the lane->port map is read from `docker/runtime-policy.env` (the
-#        rendered runtime-policy contract that `deploy-runtime.sh` and
+#        rendered runtime-policy contract that `onex-runtime-deploy` and
 #        `scripts/system_health_check.sh` already read) rather than being
 #        hardcoded per call site. A lane cannot be silently dropped.
 #     2. Body honesty. A runtime `/health` can return 200 with a body that says

docker/Dockerfile.runtime

@@ -1055,7 +1055,7 @@ EXPOSE 8085
 # works and simply carries no inventory. That is the honest outcome: the
 # readback distinguishes an ABSENT label from an empty one and refuses both, so
 # no consumer is ever handed an empty inventory as if it were an answer. The
-# sanctioned build path (scripts/deploy-runtime.sh) always stamps.
+# sanctioned build path (onex-runtime-deploy) always stamps.
 ARG NODE_INVENTORY=""
 RUN set -eu; \
     if [ -n "${NODE_INVENTORY}" ]; then \

docker/canary-s7-override.yml

@@ -25,7 +25,7 @@
 # re-checking): NOT applied. `onex.core-runtime.delegation` is absent from
 # `rpk group list` on the stability-test lane. Applying this file requires a
 # deliberate operator-approved redeploy — it is not wired into
-# scripts/deploy-runtime.sh and does not apply itself.
+# onex-runtime-deploy and does not apply itself.
 #
 # USAGE (stability-test lane ONLY — never prod, never judge):
 #   docker compose -p omnibase-infra-stability-test \

docker/dev-lane-required-env.manifest.txt

@@ -4,7 +4,7 @@
 # WHY A THIRD MANIFEST
 # --------------------
 # The dev lane brings up TWO compose files, not one. Both
-# scripts/deploy-runtime.sh resolve_compose_file_args() and the deploy agent's
+# onex-runtime-deploy resolve_compose_file_args() and the deploy agent's
 # _LANE_CONFIGS[DEV] resolve the bare `omnibase-infra` project to
 #   docker/docker-compose.infra.yml  +  docker/docker-compose.dev-lane.yml
 # and every ${VAR:?} in EITHER file is a hard requirement of the deploy.

docker/docker-compose.dev-lane.yml

@@ -63,7 +63,7 @@
 # ------------
 # The dev lane's `-f` list, in the two places that own lane -> compose-file
 # mapping and are kept matched:
-#   * scripts/deploy-runtime.sh          resolve_compose_file_args()
+#   * onex-runtime-deploy          resolve_compose_file_args()
 #   * scripts/deploy-agent/deploy_agent/executor.py  _LANE_CONFIGS[DEV]
 # Manually:
 #   docker compose -p omnibase-infra \
@@ -273,7 +273,7 @@ x-dev-lane-strict-wiring-env: &dev_lane_strict_wiring_env
 # directions by tests/integration/infra/test_omn18012_dev_lane_broker_auth_scope.py.
 #
 # CREDENTIAL HANDLING: reference, never a literal -- identical to phase A. Both
-# values are resolved by scripts/deploy-runtime.sh from the operator env file
+# values are resolved by onex-runtime-deploy from the operator env file
 # (OMNIBASE_OPERATOR_ENV_FILE, default ${HOME}/.omnibase/.env). `:?` and not
 # `:-`: a lane that silently falls back to an empty password is a lane whose
 # refusal proves nothing. NOT A ROTATION (Operating Rule 22) -- this binds the
@@ -386,7 +386,7 @@ services:
   # postgres over the base block and would inherit a base `command:`, recreating
   # their servers for capacity only this lane's slots need.
   #
-  # TAKES EFFECT ON RECREATE ONLY. deploy-runtime.sh's ensure_core_infra_ready
+  # TAKES EFFECT ON RECREATE ONLY. onex-runtime-deploy's ensure_core_infra_ready
   # runs `up -d --no-deps --wait postgres valkey` on every --restart, so the
   # first dev-lane restart after this lands recreates this container and drops
   # every connection on the lane for the length of a Postgres restart.
@@ -454,7 +454,7 @@ services:
   #
   # DEV LANE ONLY, AND MECHANICALLY SO. This is an override in the lane's
   # SECOND `-f` file, which `resolve_compose_file_args()` in
-  # scripts/deploy-runtime.sh appends for the bare `omnibase-infra` project and
+  # onex-runtime-deploy appends for the bare `omnibase-infra` project and
   # never for a lane with its own overlay. stability-test and prod inherit the
   # base healthcheck untouched; judge and lakshman redeclare the old one in
   # their own overlays. All four are pinned by
@@ -552,7 +552,7 @@ services:
   # CREDENTIAL HANDLING
   # -------------------
   # SYNTHETIC dev credential, referenced and never inlined. Both variables are
-  # resolved by scripts/deploy-runtime.sh from the operator env file
+  # resolved by onex-runtime-deploy from the operator env file
   # (OMNIBASE_OPERATOR_ENV_FILE, default ${HOME}/.omnibase/.env, sourced under
   # `set -a`) exactly like POSTGRES_PASSWORD and ROLE_OMNIDASH_PASSWORD above.
   # The `$$` forms in the command are compose escapes: the shell inside the
@@ -667,7 +667,7 @@ services:
   # THE ADMIN API STAYS OPEN, DELIBERATELY. `admin_api_require_auth` is false
   # and this ticket does not change it. Two things depend on that and both were
   # checked before the flip: the `redpanda` healthcheck (`rpk cluster health`)
-  # and scripts/deploy-runtime.sh's broker-reachability probe (line ~2791, the
+  # and onex-runtime-deploy's broker-reachability probe (line ~2791, the
   # same command) are ADMIN-API calls. Had SASL gated them, this change would
   # have made the lane undeployable by the only sanctioned path to it.
   #
@@ -732,7 +732,7 @@ services:
   #
   # WHY AN OVERRIDE OF `redpanda-partition-cap` AND NOT A NEW ONE-SHOT
   # ------------------------------------------------------------------
-  # scripts/deploy-runtime.sh warm_broker_topic_provisioning() force-recreates
+  # onex-runtime-deploy warm_broker_topic_provisioning() force-recreates
   # exactly this service on every dev-lane redeploy, including a restart-only
   # one, and a cold `up` runs it through depends_on. A separate service would
   # run on neither path. The service is declared in docker-compose.infra.yml,
@@ -943,7 +943,7 @@ services:
   # makes all three containers unhealthy on the next 30s interval; before this
   # block that would have been an autoheal restart loop, and after it, it is
   # three permanently-unhealthy containers. Deploy through the sanctioned
-  # attributed path (`scripts/deploy-runtime.sh --execute`) only.
+  # attributed path (`onex-runtime-deploy --execute`) only.
   #
   # Ticket: OMN-17562 (operator ruling 2026-09-03, item 4). Pattern source:
   #   docker/docker-compose.stability-test.yml (OMN-15217).
@@ -1127,7 +1127,7 @@ services:
       !!merge <<: *dev_lane_broker_auth_env
   # context-audit-consumer is additionally the one dev-lane Kafka client that NO
   # deploy path restarted: it is in neither RUNTIME_SERVICES nor
-  # DEV_LANE_ONLY_RUNTIME_SERVICES in scripts/deploy-runtime.sh, so it had been
+  # DEV_LANE_ONLY_RUNTIME_SERVICES in onex-runtime-deploy, so it had been
   # up 2 weeks across every intervening deploy. Binding the credential here is
   # inert on its own -- a container that is never recreated never reads a new
   # environment -- so the deploy script gains DEV_LANE_EXTRA_BROKER_CLIENTS in
@@ -1647,7 +1647,7 @@ services:
   # WHY IT IS HERE AND NOT IN docker-compose.infra.yml
   # --------------------------------------------------
   # Same reason as the six writers above. The base file is merged by every
-  # lane, and `scripts/deploy-runtime.sh` names RUNTIME_SERVICES verbatim in a
+  # lane, and `onex-runtime-deploy` names RUNTIME_SERVICES verbatim in a
   # lane-agnostic `up -d --no-deps`, so a service in the base plus an entry in
   # that array is a change to the prod, stability-test and judge deploy paths.
   # This service belongs to DEV_LANE_ONLY_RUNTIME_SERVICES and to this file, and

docker/docker-compose.dogfood.yml

@@ -596,7 +596,7 @@ services:
       - "com.omninode.service=projection-api"
   # OMN-13772 / OMN-13581 defence-in-depth. This file is designed to be run
   # STANDALONE (`-f docker/docker-compose.dogfood.yml`), and no sanctioned tool
-  # layers it — `scripts/deploy-runtime.sh` does not know this lane, deliberately
+  # layers it — `onex-runtime-deploy` does not know this lane, deliberately
   # (see the governance note in this file's header). But the base infra compose
   # defines keycloak and infisical with NO compose profile, so if anyone ever
   # renders `-f docker-compose.infra.yml -f docker-compose.dogfood.yml` the two