[jonahgabriel]

Part of OMN-18626, increment 2a. Test-only, no production code changes.

What this refuses

The delegation contract the runtime reads is rendered at container start from two halves that live in different repositories and arrive by different routes:

half	owner	how it reaches the container
the served id, via the lane overlay, constrained by the authorized binding table	omnibase_infra	a read-only bind mount of the overlay from the .201 host clone, advanced by the deploy agent's git phase
model_name in the base contract	omnimarket	baked into the image, swapped at the end of the build

render_bifrost_delegation_contract._merge_lane_overlay refuses when those disagree. That refusal is correct and is not touched here. The problem is that the two halves move at different moments, so they can diverge with no build at all, and the container that next starts does not route badly, it fails to start.

That is not hypothetical. omnibase_infra#3721 landed one half of a two-repo repoint on 2026-09-17 at 21:33:35Z; its twin did not. From the moment a deploy job's git phase advanced the host clone at 22:33:34Z, the dev lane was one container start away from a runtime that would not come up.

Why the test is here and could not be anywhere else

Neither repository can check this alone.

• omnibase_infra cannot import omnimarket. That is the compat to core to spi to infra layering, and inverting it is a circular package dependency.
• omnimarket cannot read the overlay files, because omnibase_infra does not package docker/ and those files never reach an installed distribution. I confirmed both by trying.

What omnimarket can see is both authorities: it installs omnibase_infra, so _AUTHORIZED_BINDINGS is importable, and it owns the base contract. Checking the base against the binding table is equivalent to checking it against every valid overlay, because ModelBifrostLaneBackendBinding refuses any overlay whose served_model_id differs from the table. An overlay that disagrees with this test's expectation cannot be loaded at all.

When it fires

At the omnimarket omnibase-infra floor bump, which is the moment the two halves would actually diverge inside an image. A bump that pulls in a repointed binding table without the matching base-contract change is refused here, in the repo making the bump, rather than found as a dead lane hours later.

RED first, against the live state

Reproducing tonight's actual half-applied pair — base at Qwen3.8-27B, installed binding table still at Qwen3.6-35B-A3B:

AssertionError: The delegation contract cannot be rendered from this pair, so the next
container start on any lab lane will FAIL TO START rather than route badly
(render_bifrost_delegation_contract._merge_lane_overlay).

  - local-coder: this repo's base contract says model_name='Qwen3.8-27B', the installed
    omnibase_infra binding table says served_model_id='Qwen3.6-35B-A3B'
  - local-heavy-reasoning: this repo's base contract says model_name='Qwen3.8-27B', the
    installed omnibase_infra binding table says served_model_id='Qwen3.6-35B-A3B'

This is a two-repo change landed one half at a time. Either move this repo's model_name
to match, in the same window as the omnibase_infra change, or set it to null so the
overlay is authoritative -- but null is only correct once a runtime resolver stands
behind it (OMN-18626 increment 2).

Restored, 2 passed.

The message names both values and both backends deliberately. The refusal a reader meets at 23:00 on a dead lane has to say which half is ahead, or it sends them to the wrong repo.

Positive control

test_the_comparison_is_a_real_comparison pins all four branches of the helper: an agreeing pair yields nothing, a null base defers to the overlay by design, a disagreeing pair yields exactly one finding that prints both values, and a backend only one side declares is not a disagreement. Without it, a helper that returned an empty list unconditionally would make the main test pass forever while checking nothing — which is the precise failure mode this ticket exists to remove, so it gets a control rather than a comment.

The main test also fails closed on a vacuous comparison: an empty backends list, or two sides sharing no backend id, are refusals rather than passes.

Honest limit, stated in the file itself

This is a static check over one installed pair. It cannot observe the running host, where the mounted overlay may be from a newer commit than the baked base. Closing that window needs provenance reporting at render time and is the next increment of OMN-18626. What this removes is the authoring mistake — landing one half of a two-repo change — which is how the 2026-09-17 window was opened.

dod_evidence

• RED: the failure above, produced by reproducing the live half-applied pair, then restored
• GREEN: uv run pytest tests/unit/delegation/ -q gives 1107 passed, 2 skipped
• ruff format, ruff check and mypy on the new file all clean
• The two structural findings behind the design were measured, not assumed: omnimarket is not importable from the omnibase_infra venv, and omnibase_infra declares no package data for docker/

Evidence-Source: OCC#10131
Evidence-Ticket: OMN-18626

[github-actions]

✅ Architectural Review — PASSED

Errors: 0
Warnings: 0

What this checks

Rule	Description
ARCH-TOPIC-001	No hardcoded Kafka topic strings in handler code
ARCH-DI-001	No event_bus=None bypass
ARCH-DI-002	No direct Handler instantiation outside workflow_runner/adapters
ARCH-DI-003	No reinvented DI containers
ARCH-TOPIC-002	contract.yaml topics follow `onex.{cmd

---

No architectural violations found.

Static architectural lint — no model inference (OMN-14176).

[github-actions]

✅ Hostile Reviewer — PASSED

Blocking findings (critical/error): 0
Total findings: 11
Models succeeded: qwen3-review,qwen3-review-b

---

Gate semantics

Verdict	Meaning	Blocks merge?
passed	>=2 models succeeded, no critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	Fewer than 2 models succeeded (infra unavailable/timeout)	Yes (OMN-15110)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)