feat(OMN-13341): verification doctrine + non-authoritative-evidence lint (R6)

[jonahgabriel]

OMN-13341 — Verification doctrine + non-authoritative-evidence lint (R6)

Retro enforcement R6, child of the ratchet-enforcement epic OMN-13325. Source audit: omni_home/docs/audits/2026-06-19-ratchet-enforcement-audit.md.

Problem

Probes verified against local canonical clones, ticket text, or statusCheckRollup — all of which drift from live truth. Proven three times in one session: a stale local clone produced a false node NOT_FOUND; a stale ticket said "escalation never fires" when the projection showed it does; statusCheckRollup showed FAILURE after passing reruns.

What this PR ships

• docs/standards/VERIFICATION_DOCTRINE.md — codifies the authoritative truth surfaces (origin/dev for existence, the live materialized projection for runtime/data state, gh pr checks for PR verdicts, branch protection for required-gate claims), the non-authoritative surfaces and their failure modes, 6 rules, a copy-paste command reference, and the enforcement section. Each rule traces to a real 2026-06-19 failure.
• scripts/lint_verification_evidence.py — blocking lint flagging worker prompts / receipts / handoffs / evidence docs that cite (1) a statusCheckRollup verdict, (2) state asserted "from/against the local clone", or (3) "the ticket says X, so/therefore Y". Phrase-anchored so documenting the failure mode or fetching the raw --json statusCheckRollup field does not trip it. Suppression: # verification-evidence-ok: <reason>. Ships with --self-test (14 cases) + 31 unit tests.
• .pre-commit-config.yaml — lint-verification-evidence hook (blocking, pre-commit stage).
• .github/workflows/verification-evidence-lint.yml — CI gate (PR + push + merge_group; self-test then full scan).
• CLAUDE.md — new "Standalone Lint Gates" row + a "Verification Doctrine" subsection linking the doc.

Enforcement is wired in the same PR as the detection (CLAUDE.md Rule #5).

Note on the matcher

An initial statusCheckRollup matcher flagged 10 legitimate field-access / queue-mechanics lines. Fixed by narrowing the matcher to "rollup adjacent to a verdict token" — not an allowlist — per CLAUDE.md Rule #10. Full-repo scan is now clean (exit 0).

Verification (dod_evidence)

• python3 scripts/lint_verification_evidence.py --self-test → 14/14 pass
• python3 scripts/lint_verification_evidence.py (full repo) → exit 0, no false positives
• uv run pytest tests/unit/scripts/test_lint_verification_evidence.py → 31 passed
• ruff format + ruff check clean; mypy --ignore-missing-imports clean
• pre-commit run lint-verification-evidence --all-files → Passed; full pre-commit on changed files → all Passed

Evidence also recorded on OMN-13341.

Evidence-Source: OCC#2818
Evidence-Ticket: OMN-13341

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Blocking findings (critical/error): 0
Total findings: 0
Models succeeded: none

Note: All reviewer models failed or were unavailable. Degraded results are informational during the pilot phase (OMN-8524) and do not block merge. Error: cli_review exited non-zero (all models failed or binary error)

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)

[coderabbitai]

Warning

Review limit reached

@jonahgabriel, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 24 minutes and 50 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 729c0d87-3699-4903-9bbf-1e560c375740

📥 Commits

Reviewing files that changed from the base of the PR and between 91e64ef and ea863cf.

📒 Files selected for processing (7)

• .github/workflows/url-authority-gate.yml
• .github/workflows/verification-evidence-lint.yml
• .pre-commit-config.yaml
• CLAUDE.md
• docs/standards/VERIFICATION_DOCTRINE.md
• scripts/lint_verification_evidence.py
• tests/unit/scripts/test_lint_verification_evidence.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-13341-r6-verification-doctrine-lint

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}