[jonahgabriel]

Lab: host=h200 lane=occ-ret-dash-cv-e5-5d21 head=9f7e1baa415b23fd0ce1046727bc2ffbc3188cb8 command=onex_lab_run.py --via bus --repo omnidash --ref omn-20074-dash-contract-validation-core -- bash -c <script> (work unit lw-da3e09302b534da2, exit 0). The workflow step's own run block, extracted from contract-validation.yml and run with real uv (omnibase-core==0.47.39 from PyPI): (1) each of the 4 contracts/OMN-*.yaml of the branch (OMN-12822, OMN-12833, OMN-13007, OMN-20074) passes, rc=0 each; the whole step with BRANCH=omn-20074-dash-contract-validation-core: rc=0, validation-status=passed. (2) planted clean contract: rc=0, passed. (3) positive control, planted binds_ac AC1 trailing text: rc=1, ::error file=contracts/OMN-2.yaml ... DOD_EVIDENCE_BINDS_AC_LABEL. (4) positive control, planted command_exit_0 binds_ac item: rc=1, ::error file=contracts/OMN-3.yaml ... DOD_EVIDENCE_BINDS_AC_CHECK_TYPE. (5) positive control, malformed contract (no title): rc=1, ::error file=contracts/OMN-4.yaml ... title Field required. (6) branches dependabot/bump-x and OMN-999-none: rc=0, validation-status=skipped. The OCC action's validator (onex_change_control a89a6f30, validate-yaml as action.yml:172) on the same inputs: the 4 branch contracts rc=0 (OMN-20074.yaml carries no binds_ac); the 4 planted contracts rc=1 each, including the clean one (dod_evidence.0.binds_ac: Extra inputs are not permitted [extra_forbidden]) and the malformed one (title: Field required). The new test in the workflow's own environment: 15 passed. Earlier run on h201 at c5dbe00 (work unit lw-db591d8954c140e2, exit 0), where contracts/OMN-20074.yaml still carried binds_ac, showed the OCC validator rejecting it with extra_forbidden; binds_ac was removed in 9f7e1ba. The OCC validator at the ONEX Schema Compatibility Check job's pin 3c8fa62f accepts the head's contracts/OMN-20074.yaml (rc=0, run on h201).

Summary

Ticket OMN-20074 (OCC retirement, epic OMN-20068). This is the twin of omnibase_spi#362, using the same step body with the changes noted below. The workflow .github/workflows/contract-validation.yml previously performed an auth preflight against OmniNode-ai/onex_change_control, checked out onex_change_control at 3c8fa62f for contracts/, and called the composite action OmniNode-ai/onex_change_control/.github/actions/validate-contract@a89a6f30 with contracts-path set to onex_change_control/contracts. After this change, there is no onex_change_control reference anywhere in the file. The step "Run contract validation" now resolves the ticket id from the branch name, finds contracts/<TICKET>.yaml (upper or lower case), and validates it with omnibase_core ModelTicketContract.from_yaml via uv run --no-project --python 3.12 --with "omnibase-core==${OMNIBASE_CORE_VERSION}". The job env OMNIBASE_CORE_VERSION is "0.47.39" (an exact version, from PyPI; no git source, no range). The fetch of the model is retried 3 times before the contract is read.

What the old action checked and the new step checks

The old action checked:

• action.yml:54-59 checks out its validators at the floating ref main (the new step pins an exact version).
• action.yml:129-145 resolves the contract from the contracts-path input, which omnidash set to onex_change_control/contracts, so the old gate read the contract hosted in onex_change_control (the new step reads only the repo-local contracts/<TICKET>.yaml).
• src/onex_change_control/scripts/validate_yaml.py:64-105 detects a day_close file and validates it with ModelDayClose (the new step validates ticket contracts only).
• validate_yaml.py:260-266 emits a best-effort governance event (not a check).

The new step checks:

• omnibase_core 0.47.39 src/omnibase_core/models/ticket/model_ticket_contract.py:348-385 (_validate_binds_ac_items) refuses a binds_ac entry that is not an acceptance-criterion label (rule DOD_EVIDENCE_BINDS_AC_LABEL, model_contract_dod_item.py:58) and a binds_ac item whose check type is command_exit_0 (rule DOD_EVIDENCE_BINDS_AC_CHECK_TYPE, model_contract_dod_item.py:59, allowed types at :62-73).
• The onex_change_control model at a89a6f30 has no binds_ac field, so its validate-yaml rejects any binds_ac as extra_forbidden; on the lab it rejected even a clean planted contract that carries binds_ac.
• Both models forbid extra fields and both fail a contract missing a required field.

Behaviour change to read before approving

Before, for a branch whose ticket has a contract in onex_change_control/contracts, the job validated that OCC-hosted contract and failed on a malformed one. Now only contracts/<TICKET>.yaml in omnidash is read; a ticket with a contract only in onex_change_control is skipped, so a malformed OCC-hosted contract is no longer refused by this job. This is the same loosening omnibase_spi#362 made; nothing further is loosened. omnidash has 4 contracts at this head (3 on dev plus contracts/OMN-20074.yaml). The job ONEX Schema Compatibility Check (not changed here; omnidash#386 moves it to omnibase_core) still validates every file in contracts/ with onex_change_control's validate-yaml.

Skip semantics, same as omnibase_spi#362: a branch name with no OMN-<digits> id is skipped with a notice; a branch whose ticket has no contracts/<TICKET>.yaml in this repository is skipped with a notice; a contract that fails the model fails the job.

Unchanged: workflow name "Contract Validation", job id and name "contract-validation", triggers, runs-on selector, the merge_group skip, and the required-checks.yaml row for contract-validation (REQUIRED, skip_semantics never; its rationale says it is a live required status check on omnidash dev).

Pin discipline: omnidash has no Dep Provenance workflow and no pyproject.toml or uv.lock. The gate that exists in omnibase_spi (.github/workflows/dep-provenance-gate.yml, OMN-13873) refuses git/rev/branch/tag source overrides of omnibase-core, omnibase-spi and omnibase-compat in pyproject.toml [tool.uv.sources]. This change adds no such override, no allowlist and no exception. The omnibase_core version is not bumped automatically: the pin-bump bot edits check-handshake.yml and type-sync-check.yml, not this file.

Tests and contract

A new step "Test the contract validation step" runs tests/ci/test_contract_validation_core_validator_omn20074.py inside the same uv environment, because that test needs omnibase_core and the repository's bare-environment pytest jobs do not install it.

New file tests/ci/test_contract_validation_core_validator_omn20074.py: 15 tests, written first; 13 of 15 failed against the unchanged workflow (the 2 that passed assert the unchanged names and the required-checks row). It asserts: no onex_change_control or validate-yaml in the file; names unchanged; the required-checks row unchanged; one exact omnibase_core version, at least 0.47.39, used by both steps; the step's own run block (uv replaced by a shim that runs the test interpreter) passes the repo contracts and the branch ticket contract, passes a clean planted contract, fails a planted binds_ac entry that is not a criterion label, a planted command_exit_0 binds_ac item, a contract missing a required field and an unparseable contract (each naming the file and the reason), validates only the branch ticket's contract, and skips a branch with no ticket or no contract.

New file contracts/OMN-20074.yaml adds criteria AC9 and AC10 with dod_evidence checks dod-contract-validation-core-ac9 and dod-contract-validation-core-ac10, each running that test. AC ids 9 and 10 were chosen to match omnibase_spi#362 and to avoid AC1 and AC2, which the unmerged branch jonah/omn-20074-omnidash-s6-cutover-prep uses in its own contracts/OMN-20074.yaml; if that branch lands first the two files conflict as an add/add and resolve as a union of requirements. The contract carries no binds_ac, matching the other omnidash contracts, because the ONEX Schema Compatibility Check job on dev still validates with a validator that rejects binds_ac.

No open omnidash pull request edits contract-validation.yml (checked for #386, #372, #350, #352, #356, #373, #383, #384 by changed-file list).

Evidence-Ticket: OMN-20074
Evidence-Source: OCC#13660