fix(OMN-16859): product-CI receipt runner executes declared OCC checks and writes them into the open companion

src/omnimarket/nodes/node_pr_lifecycle_fix_effect/handlers/occ_companion_emitter.py

@@ -98,8 +98,10 @@
     ADMISSIBILITY_VALIDATOR_CHECK_VALUE,
     ADMISSIBILITY_VALIDATOR_EVIDENCE_ID,
     BEHAVIOR_PROOF_EVIDENCE_ID,
+    RECEIPT_RUNNER_NAME,
     SHA_RE,
     behavior_proof_check_value,
+    born_slot_receipt_status,
     changed_files_from_diff_scope_probe,
     ci_check_evidence_id,
     compute_contract_sha256,
@@ -717,14 +719,36 @@ def _emit_companion_sync(
             # executes the declared check. Writing a fabricated "N passed" here
             # is precisely the false-evidence class the Receipt Honesty Gate
             # exists to catch.
+            # OMN-16859 AC3a — say what is true. The declared check is a pytest
+            # run in the product repo; this producer runs in the effects
+            # runtime against the GitHub API and has no checkout of it. So on a
+            # runner-covered repo the receipt is minted PENDING (the
+            # vocabulary's own word for "allocated, not yet executed") and the
+            # AC3b runner supersedes it with the real run. Where no runner
+            # exists the prior status is preserved unchanged — see
+            # born_slot_receipt_status for why that direction is the fail-safe
+            # one.
+            slot_status = born_slot_receipt_status(
+                repo=repo, check_type=slot_check_type
+            )
             slot_actual_output = (
-                "PASS: product-repo test run executes the declared check; "
-                "probe is the live PR read."
+                f"{slot_status}: the declared test run is owed by "
+                f"{RECEIPT_RUNNER_NAME} in the product repo's CI, which "
+                "executes it in a real checkout and supersedes this receipt "
+                "with the result; probe is the live PR read."
+                if slot_status == "PENDING"
+                else (
+                    "PASS: product-repo test run executes the declared check; "
+                    "probe is the live PR read."
+                )
             )
         else:
             slot_evidence_id = ADMISSIBILITY_VALIDATOR_EVIDENCE_ID
             slot_check_type = "command"
             slot_check_value = ADMISSIBILITY_VALIDATOR_CHECK_VALUE
+            # The OCC contract-compliance runner really does execute this
+            # `command` check, so its PASS is earned, not assumed.
+            slot_status = "PASS"
             slot_actual_output = (
                 "PASS: OCC runner executes the declared check; "
                 "probe is the live PR read."
@@ -1180,6 +1204,10 @@ def _hosted_safe_check_values(ticket: str) -> tuple[str | None, str | None]:
                                 verifier=self._verifier,
                                 check_value=slot_check_value,
                                 check_type=slot_check_type,
+                                # OMN-16859 AC3a: PENDING on a runner-covered
+                                # repo for a check this producer cannot run;
+                                # PASS otherwise, unchanged.
+                                status=slot_status,
                             ),
                             encoding="utf-8",
                         )

src/omnimarket/nodes/node_pr_lifecycle_fix_effect/handlers/occ_evidence_stamp.py

@@ -481,6 +481,53 @@
 # BEHAVIOR. One string, three consumers, no drift.
 BEHAVIOR_PROOF_EVIDENCE_ID = "dod-occ-diff-derived-behavior-proof"
 
+# OMN-16859 AC3a/AC3b — the rollout knob for honest born receipts.
+#
+# A repo belongs here ONLY when its CI carries the receipt runner
+# (`.github/workflows/occ-receipt-runner.yml` + `scripts/ci/occ_receipt_runner.py`),
+# because membership changes the born `test_passes` receipt from a fabricated
+# PASS to an honest PENDING — and PENDING is non-PASS, so it holds the
+# companion ineligible until something actually executes the check.
+#
+# Order matters and is the whole safety property: install the runner FIRST,
+# then add the repo. Reversed, every PR in that repo mints a receipt nothing
+# will ever flip, converting a dishonest-but-moving pipeline into a permanent
+# jam on the ~55% of PRs that carry this item. This producer serves every
+# product repo from one deployment, so the blast radius of getting it backwards
+# is org-wide.
+RUNNER_COVERED_REPOS: frozenset[str] = frozenset({"OmniNode-ai/omnimarket"})
+
+# The name the PENDING receipt cites as owing the execution. Four separate
+# lanes re-diagnosed the missing-receipt failure from scratch because nothing
+# in the evidence named the surface that would resolve it.
+RECEIPT_RUNNER_NAME = "occ-receipt-runner"
+
+# Kept in step with `EXECUTABLE_CHECK_TYPES` in scripts/ci/occ_receipt_runner.py:
+# these are the check types whose declared command only a product checkout can
+# honestly run.
+EXECUTED_BY_PRODUCT_RUNNER_CHECK_TYPES: frozenset[str] = frozenset({"test_passes"})
+
+
+def born_slot_receipt_status(*, repo: str, check_type: str) -> str:
+    """The honest status for a born slot receipt this producer mints.
+
+    ``PENDING`` exactly when two things are BOTH true:
+
+    1. the check type is one this producer cannot execute (``test_passes``
+       names a pytest run in a product checkout it does not have), and
+    2. the repo has a runner that will execute it.
+
+    Everything else keeps ``PASS``. That is not a concession — for a
+    ``command`` admissibility item the OCC contract-compliance runner really
+    does execute the declared check, so its PASS is earned rather than assumed.
+    """
+    if check_type in EXECUTED_BY_PRODUCT_RUNNER_CHECK_TYPES and repo in (
+        RUNNER_COVERED_REPOS
+    ):
+        return "PENDING"
+    return "PASS"
+
+
 # Bound on how many test targets one minted command names. A behavior check
 # whose command grows without limit is a check nobody can read and a fold risk
 # on the contract line; four is enough to carry a normal PR's test surface and
@@ -790,7 +837,7 @@
 _DOWNSTREAM_RECEIPT_MID1_TEMPLATE = textwrap.dedent("""\
     contract_sha256: "sha256:PENDING"
     contract_entry_sha256: "sha256:PENDING"
-    status: PASS
+    status: {status}
     run_timestamp: "{run_timestamp}"
     commit_sha: "{commit_sha}"
     runner: "{runner}"
@@ -1769,9 +1816,21 @@
     check_value: str | None = None,
     actual_output: str | None = None,
     check_type: str = "command",
+    status: str = "PASS",
 ) -> str:
     """Render the downstream (product-PR-bound) DoD receipt YAML.
 
+    ``status`` (OMN-16859 AC3a) defaults to ``PASS`` so every pre-existing
+    caller renders byte-identically. It exists so a producer that CANNOT
+    execute the check it declares can say so: a ``test_passes`` item's
+    declared check is a pytest run in the product repo, and this producer runs
+    in the effects runtime against the GitHub API with no checkout of it.
+    ``PENDING`` is the vocabulary's own word for "the probe was allocated but
+    has not yet executed", and ``ModelDodReceipt`` Rule 3 exempts PENDING from
+    the non-empty ``probe_stdout`` requirement, so an honest unexecuted receipt
+    is structurally valid with no schema change. See
+    :func:`born_slot_receipt_status` for when it is used.
+
     ``check_type`` (OMN-16892) MUST equal the ``check_type`` declared by the
     contract item this receipt backs, and the caller MUST write the file at
     ``<evidence_id>/<check_type>.yaml`` — that is the path
@@ -1810,6 +1869,7 @@
             indent=0,
         )
         + _DOWNSTREAM_RECEIPT_MID1_TEMPLATE.format(
+            status=status,
             run_timestamp=run_timestamp,
             commit_sha=commit_sha,
             runner=runner,

tests/unit/nodes/node_pr_lifecycle_fix_effect/test_born_path_behavior_proof_omn_16892.py

@@ -66,6 +66,7 @@
     ADMISSIBILITY_VALIDATOR_EVIDENCE_ID,
     BEHAVIOR_PROOF_EVIDENCE_ID,
     behavior_proof_cwd,
+    born_slot_receipt_status,
     render_companion_contract,
 )
 
@@ -401,7 +402,17 @@ def test_receipt_filename_matches_the_declared_check_type(
         receipt = yaml.safe_load(expected.read_text(encoding="utf-8"))
         assert receipt["check_type"] == declared_type
         assert receipt["evidence_item_id"] == BEHAVIOR_PROOF_EVIDENCE_ID
-        assert receipt["status"] == "PASS"
+        # OMN-16859 AC3a: this line asserted "PASS" when the module landed.
+        # That PASS was the defect, not the contract — it claimed the outcome
+        # of a pytest run this producer cannot perform (it has no product-repo
+        # checkout). On a runner-covered repo the born receipt is now PENDING
+        # and the product-CI receipt runner supersedes it with the real run.
+        # The subject of THIS test is unchanged: the receipt filename matches
+        # the declared check_type. The status is sourced from the same helper
+        # the producer uses, so the two cannot drift apart.
+        assert receipt["status"] == born_slot_receipt_status(
+            repo=_REPO, check_type=declared_type
+        )
 
     def test_no_orphan_surrogate_receipt_is_minted_alongside(
         self, tmp_path: Path