feat(OMN-16589): org-wide KB doc gate — block new/regrown non-KB markdown

[jonahgabriel]

What

Adds scripts/kb_doc_gate.py (stdlib-only, evaluated against the diff — no repo inventory needed): FAILs on a changed .md file that is (a) new and not exempt, or (b) modified in place, not exempt, not the repo-root README.md, and past the stub-size cap (30 lines, strict mode only). Renames/deletions always allowed. Per-repo exemptions/mode via .kb-doc-gate.yaml (additive globs + optional mode; config-file mode wins over --mode).

Ships as:

• .pre-commit-hooks.yaml — exports the kb-doc-gate hook (language: script, same idiom as omnibase_core/onex_change_control's exported hooks) for consuming repos to reference via repo: https://github.com/OmniNode-ai/omniclaude.
• .github/workflows/kb-doc-gate-reusable.yml — workflow_call reusable, mirrors deploy-gate-reusable.yml's checkout + sparse-checkout-validator pattern. Not wired as required anywhere by this change.

Why

Operator direction (2026-08-26), verbatim: "all we need is a hook that stops new MD docs from getting created in non kb repos" + two ratified amendments: (1) non-README .md must also stay stub-sized (blocks regrowth-by-edit of an existing pointer stub); (2) functional markdown (plugin skills/agents/commands/rules, CLAUDE.md, README.md, community-health files, .github/ templates, test fixtures) is exempt.

This supersedes wiring the knowledge-base-hosted, manifest-driven docs-drift-guard-reusable.yml into product repos: that guard depends on a live manifest fetch from knowledge-base@main at run time (single point of failure fanning out to every wired repo) and only covers repos with existing migrated-doc rows. This gate needs neither — it evaluates the diff directly.

Testing

41 new tests (tests/scripts/test_kb_doc_gate.py): unit coverage of evaluate() / load_config() / the glob matcher, plus 12 end-to-end tests against real tmp git repos proving --staged and --base-ref/--head-ref git plumbing, rename detection, and config-vs-CLI mode precedence. uv run pytest tests/scripts/test_kb_doc_gate.py -v → 41 passed. ruff format --check, ruff check, and mypy --strict all clean on the new script. Full local pre-commit hook chain green; governed pre-push impacted-test selector green.

OMN-16589

Evidence-Ticket: OMN-16589
Evidence-Source: OCC#7178

[coderabbitai]

Warning

Review limit reached

Next included review available in 13 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 124 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e4d502fc-dc50-493b-bfc3-54541c93ef77

📥 Commits

Reviewing files that changed from the base of the PR and between 03acfcd and 796c7e9.

📒 Files selected for processing (5)

• .github/workflows/kb-doc-gate-reusable.yml
• .pre-commit-hooks.yaml
• .secrets.baseline
• scripts/kb_doc_gate.py
• tests/scripts/test_kb_doc_gate.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Blocking findings (critical/error): 0
Total findings: 0
Models succeeded: none

Note: All reviewer models failed or were unavailable. Degraded results are informational during the pilot phase (OMN-8524) and do not block merge.

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	Reviewer ran but every model failed mid-run	No (pilot)
infra_error	cli_review failed to run at all (install/crash) after 2 attempts	Yes

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)