feat(OMN-13877): add dep-provenance gate to omniclaude + repin omnibase-core to PyPI

[jonahgabriel]

Evidence-Source: OCC#3524
Evidence-Ticket: OMN-13877

Summary

Closes the last hole in the org-wide dep-provenance gate rollout (OMN-13877): omniclaude was the only Python repo without the gate. Ports the canonical per-repo gate from omnibase_infra dev (OMN-13873, PR #2187) and repins omnibase-core from a git tag to PyPI so the new gate passes.

Refs: OMN-13877, OMN-13873

What shipped

• scripts/check_dep_provenance.py — static/offline gate; forbids any git/rev/branch/tag source for omnibase-core|spi|compat in [tool.uv.sources] (onex-change-control + omnibase-infra exempt; inline # raw-override-ok: <ticket> escape hatch). Ported verbatim from infra; the escape-regex var was renamed _RAW_OVERRIDE_OK_RE so omniclaude's stricter validate-secrets hook does not false-positive on a *_TOKEN_* name.
• .github/workflows/dep-provenance-gate.yml — job Dep Provenance Gate; merge_group-safe always-reports, enforces only when a PR modifies pyproject.toml. Safe as a required check (never wedges the queue).
• .pre-commit-config.yaml — check-dep-provenance local hook (runs on pyproject.toml).
• tests/scripts/test_check_dep_provenance.py — 14 recurrence-guard tests (reject core/spi git-rev, branch, tag, underscore, single-quote, indented, subtable; allow occ-only/PyPI-only; escape-token semantics; fail-closed on missing file).

Repin (the reason the gate can pass here)

omniclaude pinned omnibase-core = { git rev = "v0.43.0" }. Findings:

• The git tag v0.43.0 ships omnibase_core/models/skill/model_skill_result.py, but the PyPI 0.43.0 wheel omits it; PyPI 0.45.0+ renamed it to model_skill_result_file.py. omniclaude's shared/models/model_skill_result.py imports the model_skill_result module.
• Therefore the only resolvable-from-PyPI compatible version is 0.44.0 (ships model_skill_result.py). Narrowed the constraint to >=0.44.0,<0.45.0 in both dependencies and [tool.uv].override-dependencies, removed the git source, and uv lock (now omnibase-core 0.44.0 from registry = pypi.org/simple).

Verification (local, PYTHONPATH cleared to match CI)

• python3 scripts/check_dep_provenance.py → OK (exit 0).
• pytest tests/scripts/test_check_dep_provenance.py → 14 passed.
• Full unit suite (pytest tests/ -m "not integration", env -u PYTHONPATH) → 11304 passed, 32 skipped. The lone local failure (test_checkout_occ_contracts_shell_suite) is an environmental missing-timeout-binary case on this macOS host (CI Ubuntu has timeout), unrelated to this change.
• ruff format + check clean; mypy clean on the new script; validate-secrets, validate-clean-root, and all pre-commit/pre-push hooks pass (no --no-verify).

Note: local runs must clear the ambient PYTHONPATH (which points at the canonical clones) or the local omnibase_core clone shadows the PyPI wheel — that shadowing produced 38 phantom failures until isolated (CLAUDE.md Rule #11). CI has no such PYTHONPATH.

After merge, Dep Provenance Gate is flipped required on omniclaude dev.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 38 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6380c82e-73b5-49a0-b702-73da6ea246b5

📥 Commits

Reviewing files that changed from the base of the PR and between 6ed4ab3 and 7a49d76.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• .github/workflows/dep-provenance-gate.yml
• .pre-commit-config.yaml
• pyproject.toml
• scripts/check_dep_provenance.py
• tests/scripts/test_check_dep_provenance.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-13877-omniclaude-dep-provenance-gate

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Blocking findings (critical/error): 0
Total findings: 0
Models succeeded: none

Note: All reviewer models failed or were unavailable. Degraded results are informational during the pilot phase (OMN-8524) and do not block merge. Error: cli_review exited non-zero (all models failed or binary error)

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)