[jonahgabriel]

Summary

omniclaude main-branch verify: verify job in call-receipt-gate.yml has a bare needs: occ-preflight with no if: — GitHub's implicit job-level if: is success() over needs:, so an occ-preflight failure/cancellation SKIPS verify, and a skipped job satisfies branch protection. verify / verify is live-required on main (the dev→main promotion boundary) and absent from dev's required set. It had zero row in .github/required-checks.yaml, which is why OMN-15057's own remediation (#1931) — which fixed the identical vector-5 shape in 7 other files — never touched this one: the guard only walks manifest REQUIRED rows.

• verify job: added if: always(). The full two-part if: always() + explicit needs.occ-preflight.result != 'success' -> exit 1 guard-step pattern from omnibase_core#1499 is not achievable here — a job whose body is uses: (calls a reusable workflow) cannot also declare steps: (GHA constraint; feat(launchd): add cron-closeout + nightly-merge-sweep plists [OMN-7842] #1499 hit the identical wall on its own deploy-gate/verify jobs and used the same if: always()-only fix there). Real enforcement doesn't depend on this job's own result: occ-preflight / eligibility is separately REQUIRED on this repo's dev+main branch protection, produced unconditionally (no needs/if) by call-occ-preflight.yml.
• Added the missing verify / verify row to .github/required-checks.yaml, with a new optional branch: main field (this manifest is otherwise dev-scoped per its header). Added matching support in reconcile_manifest_vs_live.py (reconcile() now takes a branch kwarg and excludes rows scoped to a different branch) so this main-only row doesn't corrupt the dev-only required-check-manifest-reconcile.yml job — verified both directions.

Proof (RED before GREEN, quoted from live runs)

RED — manifest row added, workflow untouched:

$ python3 .github/actions/required-check-skip-guard/validate_no_required_check_skip_vectors.py --manifest .github/required-checks.yaml --workflows-dir .github/workflows
FAIL: 1 required-check skip vector(s) found:
  - [vector-5-ungated-needs-cascade] required context 'verify / verify': caller job 'verify' in call-receipt-gate.yml has `needs: ['occ-preflight']` with no `if:` ...
EXIT=1

GREEN — after the workflow fix:

$ python3 .github/actions/required-check-skip-guard/validate_no_required_check_skip_vectors.py --manifest .github/required-checks.yaml --workflows-dir .github/workflows
PASS: no required-check skip vectors found.
EXIT=0

Reconcile regression check (privileged, push/schedule-only script, run manually against both branches):

$ python3 .../reconcile_manifest_vs_live.py --manifest .github/required-checks.yaml --repo OmniNode-ai/omniclaude --branch dev
PASS: manifest and live required_status_checks agree for OmniNode-ai/omniclaude@dev.

$ python3 .../reconcile_manifest_vs_live.py --manifest .github/required-checks.yaml --repo OmniNode-ai/omniclaude --branch main
FAIL: 1 live required context(s) missing from manifest (OmniNode-ai/omniclaude@main):
  - Security Gate
FAIL: 3 manifest-REQUIRED context(s) not live in branch protection (OmniNode-ai/omniclaude@main):
  - Cross-Repo Boundary Parity
  - no-noncanonical-lifecycle-classes
  - reason-graph

(verify / verify no longer appears in main's missing_from_manifest list — the remaining 4 lines are pre-existing, unrelated gaps, explicitly out of scope for this PR.)

New unit tests added for the branch: scoping behavior (tests/ci/test_reconcile_manifest_vs_live.py, 5 new cases). 30/30 tests in tests/ci/test_reconcile_manifest_vs_live.py + tests/ci/test_validate_no_required_check_skip_vectors.py pass. Full local pre-commit run --files <changed> green, including the live "Reject skip vectors on required-check workflows (OMN-14854)" hook.

Fleet-wide manifest-gap measurement (context, not fixed here)

Ran reconcile_manifest_vs_live.py against every repo/branch that ships a required-checks.yaml (only omniclaude ships the reconcile script; ran it manually pointed at each repo's own manifest file):

repo	dev missing_from_manifest	main missing_from_manifest
omniclaude	0	2 (now 1 after this PR: Security Gate)
omnibase_core	1 (occ-preflight / eligibility)	56
omnibase_infra	0	5
omnibase_spi	0	no manifest file on main (17 live required, 100% uncovered)
omnibase_compat	0	no manifest file on main (17 live required, 100% uncovered)
omnimarket	0	no manifest file on main (28 live required, 100% uncovered)
onex_change_control	0	no manifest file on main (23 live required, 100% uncovered)
omnidash	0	no manifest file on main (17 live required, 100% uncovered)

Sum where a manifest exists on that branch: 2+1+56+5 = 64. Sum of branches with zero manifest coverage at all: 17+17+28+23+17 = 102. Combined blind spot before this PR: 166 live-required-context/branch pairs with zero skip-vector-guard coverage. This PR closes exactly 1 (omniclaude main verify / verify); the rest (esp. omnibase_core main at 56) are separate follow-ups, not in scope here.

Non-goals

• Branch protection is NOT modified.
• The remaining omniclaude main gap (Security Gate context, plus 3 dev-only rows reported stale against main) is NOT fixed — out of scope.
• The other 165 fleet-wide manifest-gap pairs are NOT fixed — tracked as follow-ups.

OMN-15117

Summary by CodeRabbit

• New Features

  • Added branch-aware required-check reconciliation, allowing checks to apply only to their declared branches while preserving existing behavior for unscoped checks.
  • Added the verify / verify required check for the main branch.

• Bug Fixes

  • Prevented the verify check from being silently treated as successful when its prerequisite is skipped.

• Tests

  • Added coverage for branch-specific reconciliation and missing required checks.

Evidence-Ticket: OMN-15117
Evidence-Source: OCC#4834
Evidence-Commit: 76441b2aa157a87ae38a86c011b031575da36a58

[coderabbitai]

📝 Walkthrough

Walkthrough

The reconciliation tool now supports optional branch filtering for required gates. The manifest adds the main-only verify / verify check, and the receipt-gate workflow runs verification despite preflight outcomes. Tests cover scoped and legacy behavior.

Changes

Required-check reconciliation and verification

Layer / File(s)	Summary
Branch-scoped reconciliation and compatibility .github/actions/required-check-skip-guard/reconcile_manifest_vs_live.py, tests/ci/test_reconcile_manifest_vs_live.py	reconcile() filters branch-scoped REQUIRED gates when a branch is supplied, while unscoped gates and calls without a branch retain prior behavior.
Main verify gate registration and execution .github/required-checks.yaml, .github/workflows/call-receipt-gate.yml, .github/workflows/required-check-manifest-reconcile.yml	Registers verify / verify for main, runs the reusable verification job with if: always(), and documents the branch-specific reconciliation scope. The secrets baseline timestamp is refreshed in .secrets.baseline.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• OmniNode-ai/omniclaude#1868: Both changes modify the receipt-gate verify job’s handling of occ-preflight dependencies.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: fixing the verify skip vector and adding missing main-scoped manifest coverage.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-15117-verify-job-manifest-gap

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Blocking findings (critical/error): 0
Total findings: 0
Models succeeded: none

Note: All reviewer models failed or were unavailable. Degraded results are informational during the pilot phase (OMN-8524) and do not block merge. Error: cli_review exited non-zero (all models failed or binary error)

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)