[jonahgabriel]

OMN-20700: Update onex onboarding script pin

Summary

This PR updates the onboarding guide to pin the lab-onboarding.sh script to a newer commit, aligning the documentation with the current runtime configuration behavior introduced by omnibase_infra#4630 and omniclaude#2565.

Changes

• File: plugins/onex/ONBOARDING.md
• Scope: 2 lines changed in the "Run it" block (the curl URL and the sha256 line). No other content in the guide was modified.
• Old Pin:
  • Commit: 9026723d3996be1414d104897be42d71b7491d06
  • SHA256: 61f658d93349c5342fcaf76f20aa0862eb4f308c70da1c98b4e1415e742d87f4
• New Pin:
  • Commit: 296be3faf32a3443adc7dbb818233bcd323c415c (omniclaude#2565, OMN-19743)
  • SHA256: 8a059b095aabec81ec800902806c04aa7f9fe82b53ac8b4364911d1f01798c25
  • Note: This SHA256 matches the hash of the script at current HEAD d677d3234.

Rationale

• omnibase_infra#4630 changed onex to read the workspace runtime config from the ONEX_WORKSPACE_CONFIG_ROOT environment variable, falling back to ../omnibase_internal, and refusing to proceed otherwise.
• omniclaude#2565 updated the script to write the config to ~/code/omni/.onex/workspace-config/ and export ONEX_WORKSPACE_CONFIG_ROOT.
• The guide previously pinned the older script, which did not handle this new configuration flow.

Verification

A dry run was performed on lab host h202 using a clean HOME in a throwaway directory, with no omnibase_internal sibling, no credentials, and env -i:

1. Download & Integrity: Downloaded the script at the new commit via the guide's curl line. shasum -a 256 -c printed lab-onboarding.sh: OK.
2. Preflight: bash lab-onboarding.sh --preflight-only --no-containers --provider ollama passed phase 0. (Linux host; macOS-specific readings were supplied through the script's ONBOARD_TEST_* seams).
3. Config Resolution:
   • Phase 1 requires Homebrew and phase 3 requires a model key, so a full run was not possible.
   • The script's write_workspace_runtime_config (extracted unmodified from the verified file) wrote the config.
   • onex delegate was run twice from the clean HOME with OMNIBASE_PATH bound.
   • Without ONEX_WORKSPACE_CONFIG_ROOT: Resulted in refused_before_dispatch with the error: "workspace root ... is bound but has no materialised runtime config ... declares no working-tree runtime config at .../omnibase_internal/config/onex/runtime/runtime_config.yaml".
   • With ONEX_WORKSPACE_CONFIG_ROOT set to the workspace-config directory: The config resolved (config.event_bus.type=inmemory (workspace tier-1 runtime config at .../.onex/workspace-config/config/onex/runtime/runtime_config.yaml)). The delegate was dispatched and ran, failing only due to the lack of a model key ("Your own provider key is missing too"), which is expected without credentials.

Limitations

• This was not a full phase 1–3 run.
• The delegate used the host's existing dispatch venv with the omnibase_infra clone (ed01b6dd, version 0.38.68) shadowing its source.
• The throwaway HOME directory was removed after testing.

Post-Merge

Walkers will re-walk on a new account once this merges.

Evidence-Ticket: OMN-20700
Evidence-Source: OCC#13239

[jonahgabriel]

Lab: host=h202 lane=onboarding-repin-2110 head=d6a0d9cb2d709733f5498dda0e25007d5cf2dc5a The command was download via the guide's curl line, shasum -a 256 -c, bash lab-onboarding.sh --preflight-only --no-containers --provider ollama (phase 0 passed through ONBOARD_TEST_* seams on Linux), then onex delegate in a clean HOME with no omnibase_internal sibling and no credentials. Observed: without ONEX_WORKSPACE_CONFIG_ROOT the delegate was refused_before_dispatch with the runtime-config error; with ONEX_WORKSPACE_CONFIG_ROOT set to the workspace-config directory the config resolved and the delegate was dispatched, failing only for lack of a model key. Checksum printed lab-onboarding.sh: OK. Not a full phase 1-3 run.

[onexbot-occ-writer]

OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required.

Considered 1 changed file(s):

• plugins/onex/ONBOARDING.md: no candidate grammar reads this file type (only Python declarations, uv.lock lines, release-artefact lines and contract-pin lines are proposed)

This verdict is occ-autobind's, derived from this head and its merge base alone. A second producer, the occ-companion-effect backstop, consumes its own command on the lab bus and may still mint a companion under the generic binding. Whether it does depends on that consumer running, not on this diff (OMN-18876).

[github-actions]

✅ Hostile Reviewer — PASSED

Blocking findings (critical/error): 0
Total findings: 4
Models succeeded: qwen3-review,gpt-oss-review

Findings

Severity	Location	Finding
warning	plugins/onex/ONBOARDING.md:1	ai-reviewer:qwen3-review:security SHA-256 checksum does not match the referenced commit | The ONBOARDING.md diff updates the raw.githubusercontent.com URL to point at commit 296be3f and simultaneously changes the expected SHA-256 to 8a059b095aabec81ec800902806c04aa7f9fe82b53ac8b4364911d1f01798c25. The integrity check is only as strong as the correctness of the hardcoded hash. If the hash does not correspond to the actual file content at that commit, the shasum -a 256 -c - step will fail and block onboardin
info	plugins/onex/.claude-plugin/plugin.json, plugins/onex-dev-marketplace/.claude-plugin/marketplace.json:1	ai-reviewer:qwen3-review:correctness Version bump without corresponding functional change in diff | Both marketplace.json and plugin.json are bumped from 2.4.49 to 2.4.50, but the diff contains no changes to agent definitions, skill files, routing logic, or any other functional artifact that would justify a minor version increment. The only substantive change is the onboarding script URL and checksum. If the script content at the new commit differs from the old commit, the version bump is warranted; if it does not, the bump is cosmetic and may
info	plugins/onex/ONBOARDING.md:1	ai-reviewer:qwen3-review:completeness Onboarding script not included in diff; integrity of new commit unverifiable | The diff references a new commit (296be3f) for the lab-onboarding.sh download but does not include the script file in the PR. A reviewer cannot confirm that the script at the new commit is safe, that the new SHA-256 is correct, or that no malicious code was introduced between the two commits. The onboarding flow executes an arbitrary shell script fetched from a remote URL; the review surface for t
info	plugins/onex/ONBOARDING.md:1	ai-reviewer:gpt-oss-review:security Reliance on checksum for external script without additional integrity guarantees | The onboarding guide fetches a shell script from a public GitHub raw URL and validates it only with a SHA-256 checksum. If an attacker could alter the commit referenced (e.g., by compromising the repository or the commit history), the checksum would no longer match and the validation would fail, but the process does not include a cryptographic signature or trusted source verification beyond the checksum. This leaves a narrow

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	Reviewer ran but every model failed mid-run	No (pilot)
infra_error	cli_review failed to run at all (install/crash) after 2 attempts	Yes
unavailable_fork_isolation	Fork PR — the LAN-only model is unreachable and the fleet is off limits	Yes

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)