fix(OMN-20682): grant the PR watcher its CI-bus topics and consumer group

[jonahgabriel]

Summary

Ticket OMN-20682. Parent lane orchestrator-716d. Lane watcher-acl-1840.

Since 18:28Z the operator Mac PR watcher (launchd ai.omninode.pr-watcher, handler_pr_watcher_cli serve --bus-lane ci-bus, the bus node from omnibase_internal#308) crash-loops with InfraConnectionError ... Failed to start consumer for topic onex.cmd.omnibase_internal.pr-watcher-tick-requested.v1: [Error 29] TopicAuthorizationFailedError. It logs in as the scoped lab-work principal, whose ACLs come from the ci-bus-labwork-user one-shot in docker/docker-compose.ci-bus.yml.

Source read: omnibase_internal node_pr_watcher_effect/contract.yaml at omnibase_internal main b893625b. Subscribes onex.cmd.omnibase_internal.pr-watcher-tick-requested.v1; publishes onex.evt.omnibase_internal.pr-watcher-tick-completed.v1, onex.evt.omnibase_internal.pr-watcher-tick-failed.v1, onex.evt.omnimarket.pr-state-observed.v1, onex.evt.omnimarket.repo-merged.v1 (already granted). runtime_dispatch.group_id: onex.omnibase_internal.node_pr_watcher_effect.

Group derivation: PrWatcherHost.start passes the contract's literal group_id to _subscribe (omnimarket lab_work/bus.py), which passes it to EventBusKafka.subscribe; derive_service_group_id is not called on this path, so no env-token prefix applies. EventBusKafka._resolve_effective_group_id appends .__i.<KAFKA_INSTANCE_ID> when set and always .__t.<topic>. Effective group: onex.omnibase_internal.node_pr_watcher_effect.__t.onex.cmd.omnibase_internal.pr-watcher-tick-requested.v1. Grant: prefixed onex.omnibase_internal.node_pr_watcher_effect. (trailing dot).

Not granted: publish --wait (call_tick) subscribes in group pr-watcher-caller.<envelope_id>; the serve process does not use it.

Changes

Changes in docker/docker-compose.ci-bus.yml: the four topics appended to LAB_TOPICS in the ci-bus-topics one-shot (it created none of them before) and in ci-bus-labwork-user (read, write, describe, literal); the group prefix appended to GROUP_PREFIXES (read, describe, prefixed); readback wording: topics one-shot "sixteen" to "twenty-three" (5 CI + 18 lab; "sixteen" was already wrong at 19), ACL one-shot "fourteen" to "eighteen" lab topics.

Changes in tests/unit/docker/test_ci_bus_broker_isolation_omn18691.py: pins the four topics; len(granted) == 18; topic regex widened from [a-z0-9.-] to [a-z0-9._-] (the old class did not match omnibase_internal names); new test test_ci_bus_labwork_grants_the_pr_watcher_group_and_counts_match (group prefix present; both readback echoes state the real counts).

Test plan

uv run pytest tests/unit/docker/test_ci_bus_broker_isolation_omn18691.py 13 passed; four neighbouring compose test files 86 passed; ruff and pre-commit clean on both files.

Lab apply (.201 ci-bus)

Lab apply on .201 from head 1219589 (compose sha256 prefix 7956a2159297, equal to the commit blob, from a scratch copy; canonical .201 clone not touched): ci-bus-topics via docker compose run --rm --no-deps exit 0, created the four watcher topics and onex.cmd.omnimarket.lab-job-submitted.v1 (OMN-20604, on dev but never applied on .201 before), 18 already present, "readback confirms all twenty-three topics exist". ci-bus-labwork-user via up --no-deps --force-recreate exit 0, "ACL readback confirms all eighteen lab topics", positive and negative controls passed.

Superuser readback: lab-work ALLOW ACL rows 52 to 69; rows READ/WRITE/DESCRIBE LITERAL for each of the four watcher topics and lab-job-submitted; GROUP onex.omnibase_internal.node_pr_watcher_effect. PREFIXED READ and DESCRIBE. Lab-work login readback: 18 topics visible including the four watcher topics; onex.evt.github.pr-merged.v1 invisible.

Broker omninode-ci-bus-redpanda 82b84f7222d3 not recreated: StartedAt 2026-10-01T13:50:15Z, restarts 0, healthy. No credential created, rotated or printed.

Pending: the Mac watcher restart and its log read are the orchestrator's next step; the watcher consumer start on the Mac is unverified.

Runtime startup gate

• N/A — this PR does not touch any of the above

Type safety checklist

• No new metadata["key"] or metadata.get("key") string literal access on Pydantic model fields
• No new metadata: dict[str, Any] fields without TypedDict or # ONEX_EXCLUDE: comment
• No new bare except Exception

Strict-gate ordering

• No — not a gate PR, skip this section.

Related issues

OMN-20682
omnibase_internal#308

Evidence-Ticket: OMN-20682
Evidence-Source: OCC#13328

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 4
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 4 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] tests/unit/docker/test_ci_bus_broker_isolation_omn18691.py (qwen3-review) — Regex change silently widens topic matching scope | The regex pattern was changed from onex\.[a-z]+\.[a-z0-9.-]+\.v\d+ to onex\.[a-z]+\.[a-z0-9._-]+\.v\d+, adding underscore to the character class
• [MAJOR] tests/unit/docker/test_ci_bus_broker_isolation_omn18691.py (qwen3-review) — Count assertion in new test is fragile and may not reflect actual state | The new test test_ci_bus_labwork_grants_the_pr_watcher_group_and_counts_match asserts that total == 23 and that the echo s
• [MINOR] docker/docker-compose.ci-bus.yml (qwen3-review) — New group prefix grant may be overly broad | The new group prefix onex.omnibase_internal.node_pr_watcher_effect. is granted to the lab-work principal. This prefix will match any consumer group tha
• [MINOR] tests/unit/docker/test_ci_bus_broker_isolation_omn18691.py (qwen3-review) — Missing test for the new group prefix in the ACL readback | The new test test_ci_bus_labwork_grants_the_pr_watcher_group_and_counts_match checks that the group prefix is present in the `GROUP_PREFIX

[github-actions]

✅ Hostile Reviewer — REVIEWED

Critical findings: 0
Major findings: 2
Total findings: 5
Models succeeded: qwen3-review,gpt-oss-review
Models unavailable: none

Action required: findings were posted as review threads. Address or reject each one, then resolve its thread — the Hostile Review Thread Gate fails while hostile-reviewer threads are unresolved (OMN-17492).

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	Fails this job with a named reason

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review (Qwen3.8-27B), gpt-oss-review (gpt-oss-120b) (OMN-8468/OMN-8524/OMN-17492)