[Patel230]

Summary

omnidash CI now reads every sibling repo (omnibase_core, omniclaude, onex_change_control, omnimarket) at a pinned commit, never a live dev/main or no ref. A sibling's merge can no longer turn omnidash red (OMN-20332, per the 2026-10-01T21:43:10Z sibling-pin ruling under OMN-20331).

What changed

• The 7 required checks the ticket lists, pinned by sha:
  • receipt-honesty.yml: the omnibase_core clone checks out 1e69bec9.
  • call-occ-preflight.yml, call-receipt-gate.yml, docs-validate.yml: omnibase_core @1e69bec9.
  • call-reject-skip.yml: omniclaude @61761f04.
  • required-check-skip-guard-caller.yml: omniclaude @4ddbc808.
  • contract-validation.yml: onex_change_control validate-contract@a89a6f30.
• The rest, pinned too:
  • pr-title-check.yml and security-scan.yml: onex_change_control @a89a6f30.
  • call-occ-autobind.yml and call-occ-companion-effect.yml: the omniclaude reusables @4ddbc808 and the omnimarket publisher checkouts ref: d471dcb9. The ticket marks these two as also related to OMN-14812, but AC1 covers every workflow.
• Each pin is today's tip of the branch the read used before, so nothing behaves differently at merge. Each line carries # <repo> <branch> as of 2026-10-02 ([OMN-20332](https://linear.app/omninode/issue/OMN-20332)). Moving a pin later is a PR that tests the new version.
• .github/required-checks.yaml: the five cross_repo_ref values follow the pins. The skip guard resolves the cross-repo ref from the caller's own uses:, not from this string (omniclaude _workflow_model.py:255), so this keeps the manifest truthful without changing its behaviour.
• New tests/ci/test_sibling_reads_pinned.py: fails on any sibling read in .github/workflows/ that isn't a full sha, whether a uses:, an actions/checkout repository:/ref: pair, or a git clone never moved to a sha. It also fails on any cross_repo_ref at a branch. It carries its own bad and good fixtures, plus a check that the scanner finds the tree's sibling reads at all.
• workflow-script-refs.yml: the test runs in the existing unconditional bare-environment job (pytest pyyaml, --noconftest). No new workflow and no new required check.

How it was verified

• Before the fix, on the unedited tree at cc628179: the new test failed 12 times. One failure per live read across the 11 workflows, including clone 51: git clone omnibase_core in receipt-honesty.yml, and one for the manifest. The extractor self-tests passed. Already-pinned reads (type-sync-check.yml:144, check-handshake.yml:41, onex-schema-compat.yml:46, contract-validation.yml:98) were not flagged.
• After the fix: python -m pytest tests/ci/ -q --noconftest -p no:cacheprovider -c /dev/null gives 93 passed. Every workflow and required-checks.yaml parses with yaml.safe_load.
• Every pin resolves: gh api repos/OmniNode-ai/<repo>/contents/<path>?ref=<sha> returned FOUND for all 14 pinned files (3 omnibase_core reusables, 4 omniclaude reusables, 3 onex_change_control files, 3 omnimarket publisher files and configs). A zero sha returned MISSING, which is the positive control.
• The new receipt-honesty steps work as written: run in a throwaway directory, they ended at HEAD=1e69bec909f245be511803191554e5b340def0b7 with pyproject.toml present.
• Not proven yet: that every required check still reports green at its pinned sha. This PR's own CI run is that proof.

Failure paths

n/a: this change writes no receipt, verdict or report. It changes which commit CI reads, plus one static test.

Open defects

none

Local gates

• No gate was bypassed — no --no-verify, no SKIP=, no --no-gpg-sign, no core.hooksPath override. Every pre-commit and pre-push hook ran.
• Any hook that failed was fixed at the input, not worked around.

Not in this change

• No change to what any reusable workflow does, and no pin moved to a newer sibling version.
• Other repos' pins, which are OMN-20331's other children.
• onex_change_control's own validate-contract action still checks out onex_change_control at ref: main inside itself. That read lives in onex_change_control and can't be pinned from omnidash.

Evidence-Ticket: OMN-20332
Evidence-Source: OCC#12281

[onexbot-occ-writer]

OCC autobind rebound this PR's evidence-source stamp line to OCC#12281.

The receipt gate's own eligibility validator, run against the change-control tree the gate pins for OCC#12281, returned eligible for head 9b908d19d4dc68d7b6d307385a3bf2fe4dd2b00e. The body now carries exactly one stamp line. Displaced: OCC#12270.

Reported by occ_companion_emitter (OMN-18853).

[Patel230]

@jonahgabriel one red check on head 9b908d19d is bot-side, not this PR's code, and a rerun did not clear it.

occ-autobind / outcome errors with GitHub 422 "No commits between dev and auto/window-omninode-ai-omnidash-occ-autobind": the autobind effect tried to open a batch-window companion PR with nothing in it. Two minutes earlier the same bot rebound this PR's evidence stamp to OCC#12281 and reported the receipt gate's eligibility validator eligible for this head (its comment above), so there was nothing left to mint.

• First run: correlation 6ab081c7-2b39-53fb-8c46-fac0e4d3c22c. Rerun of run 36989265563 at 09:24Z: same 422, correlation 0d6fd786-f39a-4817-be13-12f1d8713379.
• Everything else on this head is green: CI Summary success, verify / verify success (its cancelled entry is a superseded run), 34 passed in all.

I have stopped rerunning. Could the outcome check treat an empty batch window as nothing-to-mint rather than an error, or be cleared by hand for this head?

Thank you!