[jonahgabriel]

Summary

Phase 3 of OMN-13502 (epic OMN-13498, golden-chain de-fake) for the omniclaude side of the flip.

• OMN-13500 (test(OMN-13500): burn down omniclaude faked-boundary findings to zero #1849) burned omniclaude's no-faked-boundary detector self-scan down from 61 findings (55 mock_assigned_to_boundary + 6 patch_httpx_egress) to zero, verified live on this branch via uv run python -m omnibase_core.validation.no_faked_boundary.runtime_no_faked_boundary src tests → No faked-boundary violations found.
• This PR drops --report-only from both surfaces that ran the detector:
  • .github/workflows/no-faked-boundary.yml (CI mirror)
  • .pre-commit-config.yaml check-no-faked-boundary hook (local mirror)
• Job/hook name renamed from "No Faked Boundary Gate (report-only)" to the bare "No Faked Boundary Gate" so it can become a dev branch-protection required context after it lands and reports once on a dev commit — required-context addition is a separate follow-up step, not part of this PR, per the ordering constraint (a required context that has never reported wedges every PR).

DoD evidence

Ticket OMN-13502 carries dod_evidence from the parallel omnibase_core/omnimarket legs of this same phase-3 flip (PRs #1377, #1378, #1608, OCC receipts #3530, #3533, #3535, #3587). This PR is the omniclaude leg of the same de-fake flip.

Test plan

• uv run python -m omnibase_core.validation.no_faked_boundary.runtime_no_faked_boundary src tests → 0 findings (confirms flip is safe)
• pre-commit run --all-files — check-no-faked-boundary passes; 3 pre-existing/unrelated failures confirmed present identically on origin/dev without this diff (Windows-path string in architecture-handshakes/validator-requirements.yaml, cross-repo @main ref in call-occ-preflight.yml, hook-bits-drift missing sibling omnibase_core checkout in this worktree)
• uv run pytest tests/ -v -m "unit and not integration" → 9103 passed, 26 skipped, 1 pre-existing failure (test_checkout_occ_contracts_shell_suite, missing gtimeout/timeout binary on this Mac — confirmed identical failure on origin/dev without this diff)

Summary by CodeRabbit

• Chores
  • Strengthened boundary-checking by making the related validation gates enforce new findings (pre-commit and CI now fail builds instead of only reporting).
  • Improved CI reliability across varied runners with more consistent dependency setup, Linux-specific readiness handling, and a more controlled streaming-test service lifecycle.
  • Enhanced security scanning by adjusting runner selection logic and expanding secret-scan coverage for pull requests, plus safer handling of privileged filesystem setup.
  • Updated timeouts and checkout depth to make workflow execution more consistent.

Evidence-Source: OCC#3599
Evidence-Ticket: OMN-13502

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 38 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 09c93a6b-e09c-447e-bac1-45f6edb7d7af

📥 Commits

Reviewing files that changed from the base of the PR and between 99e4e57 and 08a5b95.

📒 Files selected for processing (9)

• .github/workflows/ci.yml
• .github/workflows/hostile-reviewer.yml
• .github/workflows/no-faked-boundary.yml
• .github/workflows/omni-standards-compliance.yml
• .github/workflows/onex-schema-compat.yml
• .github/workflows/plugin-compat-gate.yml
• .pre-commit-config.yaml
• scripts/ci/run_golden_chain_live.py
• tests/hooks/test_hostile_reviewer_workflow.py

📝 Walkthrough

Walkthrough

CI workflows and the pre-commit hook are updated to enforce boundary checks, adjust checkout and dependency setup, harden security scanning, and make the golden-chain-live Redpanda job manage its own container lifecycle.

Changes

Workflow enforcement and reliability

Layer / File(s)	Summary
Boundary gate enforcement .github/workflows/no-faked-boundary.yml, .pre-commit-config.yaml, .github/workflows/onex-schema-compat.yml	Removes --report-only from the no-faked-boundary workflow and pre-commit hook, renames the gate, updates explanatory comments, and adds UV_HTTP_TIMEOUT: '300' to the affected workflows.
CI runtime setup .github/workflows/ci.yml	Pins uv sync to ${PYTHON_VERSION} in multiple jobs and adds a Linux-only libatomic availability/install step for pyright.
Golden-chain-live Redpanda lifecycle .github/workflows/ci.yml	Removes the Redpanda service container and replaces it with explicit start, health-check, logging, and cleanup steps inside the job.
Hostile-reviewer checkout and clones .github/workflows/hostile-reviewer.yml	Switches to a shallow PR checkout and adds retry/cleanup loops around the three dependency repository clones.
Security scan gating .github/workflows/security-scan.yml	Changes PR runner selection, adds PR-diff TruffleHog scanning, adjusts full-scan gating, makes Docker/Dockle handling sudo-aware, adds a soft-fail Checkov matcher, and restricts SARIF upload on pull requests.
PR contract checkout .github/workflows/validate-pr-contracts.yml	Changes the checkout step to fetch with depth 1.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

• OmniNode-ai/omniclaude#1846: Introduced the report-only no-faked-boundary behavior that this PR now switches to enforcement.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: switching the no-faked-boundary gate from report-only to enforcing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-13502-flip-omniclaude

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

❓ Hostile Reviewer — UNKNOWN

Blocking findings (critical/error): 0
Total findings: 0
Models succeeded: none

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/validate-pr-contracts.yml (1)

40-44: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disable persisted checkout credentials.

actions/checkout will leave the token in .git/config unless persist-credentials: false is set. This workflow processes PR content, so keeping write-capable credentials in the workspace is unnecessary exposure.

🔧 Suggested patch

       - name: Checkout
         if: github.event_name != 'merge_group'
         uses: actions/checkout@v7
         with:
+          persist-credentials: false
           fetch-depth: 1

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/validate-pr-contracts.yml around lines 40 - 44, The
Checkout step in the validate-pr-contracts workflow leaves credentials persisted
in the workspace, which is unnecessary for processing PR content. Update the
actions/checkout usage in the Checkout step to explicitly disable persisted
credentials by setting persist-credentials to false, keeping the existing
fetch-depth behavior unchanged.

Source: Linters/SAST tools

🧹 Nitpick comments (3)

.github/workflows/hostile-reviewer.yml (2)

59-63: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value

Unnecessary sleep before final failure.

On the 3rd (last) attempt, the loop still runs rm -rf and sleep $((attempt * 10)) (30s) before falling through to exit 1, wasting ~30s per failing clone with no retry benefit.

⏱️ Skip sleep on last attempt

           for attempt in 1 2 3; do
             git clone --depth=1 --branch main https://github.com/OmniNode-ai/omniintelligence.git ../omniintelligence && exit 0
             rm -rf ../omniintelligence
-            sleep $((attempt * 10))
+            [ "$attempt" -lt 3 ] && sleep $((attempt * 10))
           done
           exit 1

Also applies to: 69-73, 79-83

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/hostile-reviewer.yml around lines 59 - 63, Skip the
backoff sleep on the final retry in the clone loop so the workflow fails
immediately after the last unsuccessful attempt. Update the retry logic in the
hostile reviewer workflow around the git clone loop to only run the cleanup and
sleep when another attempt remains, using the existing attempt counter and loop
structure that includes git clone, rm -rf, sleep, and exit 1.

---

55-83: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Retry-clone logic duplicated three times.

The retry loop (3 attempts, cleanup, backoff sleep, final failure) is copy-pasted for omniintelligence, omnibase_core, and omnibase_compat, differing only in repo URL and directory name. Consider extracting this into a small reusable script (e.g., scripts/ci/clone-with-retry.sh <repo-url> <dest-dir>) invoked from each step, or a composite action, to avoid triplicated maintenance.

♻️ Example extraction

# scripts/ci/clone-with-retry.sh
#!/bin/bash
set -uo pipefail
repo_url="$1"; dest="$2"; branch="${3:-main}"
for attempt in 1 2 3; do
  git clone --depth=1 --branch "$branch" "$repo_url" "$dest" && exit 0
  rm -rf "$dest"
  [ "$attempt" -lt 3 ] && sleep $((attempt * 10))
done
exit 1

      - name: Clone omniintelligence
        working-directory: ${{ github.workspace }}
        run: bash scripts/ci/clone-with-retry.sh https://github.com/OmniNode-ai/omniintelligence.git ../omniintelligence

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/hostile-reviewer.yml around lines 55 - 83, The clone retry
logic in the workflow is duplicated across the omniintelligence, omnibase_core,
and omnibase_compat steps. Extract the shared 3-attempt clone/cleanup/backoff
behavior into a reusable helper such as a scripts/ci/clone-with-retry.sh script
or a composite action, then update each clone step to call it with the repo URL
and destination directory. Keep the existing branch, retry, rm -rf cleanup, and
sleep behavior centralized in the helper so future changes only need to be made
once.

.github/workflows/ci.yml (1)

1346-1354: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

aio-max-nr tuning can hard-fail the step under set -euo pipefail.

The sudo branch runs echo 1048576 | sudo tee /proc/sys/fs/aio-max-nr unguarded. If sudo exists but is not passwordless (or /proc/sys/fs/aio-max-nr is not writable), tee returns non-zero and set -e aborts the whole "Start Redpanda" step — even though the elif/else branches explicitly treat inability to set this tunable as a non-fatal ::notice::. This is an inconsistent failure mode for what is a best-effort optimization.

♻️ Make the sudo path non-fatal to match the other branches

           if command -v sudo >/dev/null 2>&1; then
-            echo 1048576 | sudo tee /proc/sys/fs/aio-max-nr >/dev/null
+            echo 1048576 | sudo tee /proc/sys/fs/aio-max-nr >/dev/null \
+              || echo "::notice::cannot adjust aio-max-nr on this runner"
           elif [ -w /proc/sys/fs/aio-max-nr ]; then

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 1346 - 1354, The aio-max-nr tuning in
the Start Redpanda step is still fatal in the sudo path, unlike the fallback
branches. Update the shell block in the workflow so the `sudo`/`tee` attempt is
treated as best-effort and does not abort under `set -euo pipefail`, matching
the non-fatal `::notice::` behavior already used when `/proc/sys/fs/aio-max-nr`
cannot be adjusted. Keep the change localized to the existing `sudo`, `tee`, and
`::notice::` logic.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 1355-1368: The `golden-chain-live` Redpanda setup in the workflow
uses a fixed container name and host port, which can collide across concurrent
self-hosted runs. Update the `docker run` step to use a unique container name
and an ephemeral mapped port, or add serialization via `concurrency:` so
simultaneous jobs do not stop each other’s `omniclaude-golden-chain-redpanda`
container or bind to port `9092`.

In @.github/workflows/security-scan.yml:
- Around line 265-282: The Checkov soft-fail matcher is only being written to a
file and never registered, so GitHub Actions won’t apply it. In the workflow
step that creates checkov-problem-matcher-softfail.json, add the matcher
registration using the same filename so the annotations are enabled, and ensure
it is later removed with the matching owner value checkov-softfail. Use the step
named Provide Checkov soft-fail problem matcher to locate the change.

---

Outside diff comments:
In @.github/workflows/validate-pr-contracts.yml:
- Around line 40-44: The Checkout step in the validate-pr-contracts workflow
leaves credentials persisted in the workspace, which is unnecessary for
processing PR content. Update the actions/checkout usage in the Checkout step to
explicitly disable persisted credentials by setting persist-credentials to
false, keeping the existing fetch-depth behavior unchanged.

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 1346-1354: The aio-max-nr tuning in the Start Redpanda step is
still fatal in the sudo path, unlike the fallback branches. Update the shell
block in the workflow so the `sudo`/`tee` attempt is treated as best-effort and
does not abort under `set -euo pipefail`, matching the non-fatal `::notice::`
behavior already used when `/proc/sys/fs/aio-max-nr` cannot be adjusted. Keep
the change localized to the existing `sudo`, `tee`, and `::notice::` logic.

In @.github/workflows/hostile-reviewer.yml:
- Around line 59-63: Skip the backoff sleep on the final retry in the clone loop
so the workflow fails immediately after the last unsuccessful attempt. Update
the retry logic in the hostile reviewer workflow around the git clone loop to
only run the cleanup and sleep when another attempt remains, using the existing
attempt counter and loop structure that includes git clone, rm -rf, sleep, and
exit 1.
- Around line 55-83: The clone retry logic in the workflow is duplicated across
the omniintelligence, omnibase_core, and omnibase_compat steps. Extract the
shared 3-attempt clone/cleanup/backoff behavior into a reusable helper such as a
scripts/ci/clone-with-retry.sh script or a composite action, then update each
clone step to call it with the repo URL and destination directory. Keep the
existing branch, retry, rm -rf cleanup, and sleep behavior centralized in the
helper so future changes only need to be made once.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b95a8749-2496-4629-b22f-b400ccb3ca04

📥 Commits

Reviewing files that changed from the base of the PR and between 9b14c8d and 99e4e57.

📒 Files selected for processing (6)

• .github/workflows/ci.yml
• .github/workflows/hostile-reviewer.yml
• .github/workflows/no-faked-boundary.yml
• .github/workflows/onex-schema-compat.yml
• .github/workflows/security-scan.yml
• .github/workflows/validate-pr-contracts.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/no-faked-boundary.yml