feat(OMN-18868): a wire-compatibility gate replays every changed payload through the last released consumer

.github/workflows/call-receipt-gate.yml

@@ -24,4 +24,4 @@ permissions:
 
 jobs:
   verify:
-    uses: OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml@76532c203a2dccd5f928fba6657d5dd5ff3bdf10 # OMN-18882: immutable SHA pin, advanced from b97e20e2. Provenance: the squash commit of omnibase_core#1723 on that repo's dev branch, which adds the dependency-pin-only exemption to the Receipt Gate; verified by reading .github/workflows/receipt-gate.yml at this exact SHA. A 40-hex pin is the intended long-term form here, not a placeholder for a branch ref: it is immutable, so the gate this repo runs cannot change under it without a reviewed edit to this line
+    uses: OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml@a03b10720db364575b0477003da95b46de765950 # OMN-19149: immutable SHA pin, advanced from 76532c20 (0.47.19). Provenance: the squash commit of omnibase_core#1736 on that repo's dev branch, which closes the OMN-19050 FAIL-supersede latch -- at 76532c20 the resolver's supersede-suffix pattern excludes a dot, so an attempt-scoped record is invisible to it rather than outranked, and omnimarket#2751 was blocked on a key whose merged companion already carried a PASS. NO PUBLISHED RELEASE CONTAINS THIS FIX: v0.47.20 is the latest, tagged 3afa3528 on 2026-09-20, and the fix merged 2026-09-21, so this pins the merge sha and should be re-pointed at the first release that carries it. Blast radius, measured: .github/workflows/receipt-gate.yml is BYTE-IDENTICAL across the move (blob cb0c2b547e34d664644b3faa08758ef44d245576 at both shas), so the gate's own shape does not change; the validation surface moves 18 files, and the two gate-relevant validators besides the resolver, validator_occ_append_only.py and validator_receipt_diff_consistency.py, both come from one commit, omnibase_core#1730 (OMN-18996). A 40-hex pin remains the intended long-term form here, not a placeholder for a branch ref: it is immutable, so the gate this repo runs cannot change under it without a reviewed edit to this line

.github/workflows/ci.yml

@@ -1448,6 +1448,83 @@ jobs:
           git fetch --quiet origin "${BASE}" || true
           python scripts/check_release_identity.py --base "origin/${BASE}"
 
+  wire-compatibility-gate:
+    name: Wire Compatibility Gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # OMN-18868: full history AND tags, both load bearing. The gate
+          # resolves the last released consumer with `git tag --merged`, and a
+          # shallow clone resolves an OLDER release than the tree really
+          # descends from -- which is this gate's STRICT direction, so it would
+          # not be unsafe, but it would redden pull requests for a fetch depth
+          # rather than for a wire break. `git archive` then reads that
+          # release's src/ straight out of the object store, so the objects
+          # have to be present.
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+      - name: Set up Python 3.12
+        run: uv python install 3.12
+      - name: Install dependencies
+        # Unlike the release-identity gate above, this one cannot run on a bare
+        # `pip install packaging`: it IMPORTS the released wire models, and
+        # those import omnibase_core and sibling omnimarket modules. A missing
+        # dependency would surface as WIRE_COMPAT_PROBE_FAILED -- fail-closed,
+        # so safe, but red for the wrong reason.
+        run: uv sync --locked --all-extras
+      - name: Every changed wire payload must decode on the last release (OMN-18868)
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref || 'dev' }}
+        run: |
+          set -euo pipefail
+          BASE="${BASE_REF}"
+          git fetch --quiet origin "${BASE}" || true
+          uv run python scripts/ci/check_wire_compatibility.py \
+            --base "origin/${BASE}"
+      - name: The two real-history controls must EXECUTE here (OMN-18868)
+        # These two replay the OMN-18852 incident against this repository's
+        # own tags, and they need what only this job's checkout has. The
+        # shard job clones at depth 1 with no tags, so there they skip and
+        # are recorded in config/skip_count_baseline.yaml with that
+        # provenance. This is the checkout that carries the history, so this
+        # is where they run -- and this job is in the strict gate set, so a
+        # refusal here refuses the pull request.
+        #
+        # The exit status alone cannot be trusted for this: two SKIPPED tests
+        # also exit zero, which would turn the arrangement above into a gate
+        # that prints and passes. The report is read instead.
+        run: |
+          set -euo pipefail
+          uv run pytest tests/ci/test_check_wire_compatibility_omn18868.py \
+            -m integration -q --junit-xml=wire_compat_integration.xml
+          uv run python - <<'PY'
+          import sys
+          import xml.etree.ElementTree as ET
+
+          root = ET.parse("wire_compat_integration.xml").getroot()
+          suite = root if root.tag == "testsuite" else root.find("testsuite")
+          if suite is None:
+              print("WIRE_COMPAT_CONTROLS_UNREADABLE: no testsuite in the report", file=sys.stderr)
+              sys.exit(1)
+          executed = int(suite.get("tests", "0"))
+          skipped = int(suite.get("skipped", "0"))
+          if executed < 2 or skipped:
+              print(
+                  "WIRE_COMPAT_CONTROLS_DID_NOT_RUN: "
+                  f"{executed} collected, {skipped} skipped; this job must run both "
+                  "real-history controls, and a skip here means the checkout lost "
+                  "its tags or its depth",
+                  file=sys.stderr,
+              )
+              sys.exit(1)
+          print(f"WIRE_COMPAT_CONTROLS_RAN: {executed} executed, 0 skipped")
+          PY
+
   event-registry-drift:
     needs: occ-preflight
     if: always()

config/skip_count_baseline.yaml

@@ -27,7 +27,7 @@ suites:
     repo: omnimarket
     job: Tests (Split n/m)
     mode: nodeids
-    max_skips: 259
+    max_skips: 261
     baseline_collected: 22836
     provenance:
       measured_at: '2026-09-18'
@@ -38,8 +38,10 @@ suites:
       corroborating_runs:
         - '35393542842'
         - '35392845454'
-      notes: '35395544621 is a full-width run: detect-changes reported is_full_suite=true, split_count=20, selected_paths=["tests/"] (full_suite_reason=test_infrastructure), 20 JUnit reports, 22836 collected, 259 unique skipped test ids. The two corroborating runs are also full-width at split_count=20 and each reported exactly 259 unique skipped ids, with SETS byte-identical to this one -- 0 ids of symmetric difference in any of the three pairs. Split 1/20 alone reported 42 unique skips, reproducing epic OMN-18775''s 42/42/42 reading for this repo exactly. Mode is nodeids, NOT count, and the reason is a live measurement rather than a preference: this job sits behind scripts/ci/detect_test_paths.py with ENABLE_SMART_TESTS=true, and all three runs above were full-width only because each happened to touch test infrastructure. OMN-18790''s own first CI run, 35414570676, was narrowed by that selector to 765 collected and 2 unique skipped ids in a single split -- so the collected set here does vary, by a factor of 30. Under count mode that run passed but printed a RATCHET CANDIDATE advising max_skips be lowered to 2, and adopting that advice would have turned every subsequent full-width run red. Under nodeids the same run reads as a narrowed selection and a newly-added environmentally-skipped test still turns it red. Subset evidence for the claim that a narrowed run cannot false-fail: both corroborating full-width runs and the real narrowed run 35414570676 have 0 ids outside this baseline. Positive control for that zero: injecting one synthetic id into the same comparison reports 1.'
+      notes: '35395544621 is a full-width run: detect-changes reported is_full_suite=true, split_count=20, selected_paths=["tests/"] (full_suite_reason=test_infrastructure), 20 JUnit reports, 22836 collected, 259 unique skipped test ids. The two corroborating runs are also full-width at split_count=20 and each reported exactly 259 unique skipped ids, with SETS byte-identical to this one -- 0 ids of symmetric difference in any of the three pairs. Split 1/20 alone reported 42 unique skips, reproducing epic OMN-18775''s 42/42/42 reading for this repo exactly. Mode is nodeids, NOT count, and the reason is a live measurement rather than a preference: this job sits behind scripts/ci/detect_test_paths.py with ENABLE_SMART_TESTS=true, and all three runs above were full-width only because each happened to touch test infrastructure. OMN-18790''s own first CI run, 35414570676, was narrowed by that selector to 765 collected and 2 unique skipped ids in a single split -- so the collected set here does vary, by a factor of 30. Under count mode that run passed but printed a RATCHET CANDIDATE advising max_skips be lowered to 2, and adopting that advice would have turned every subsequent full-width run red. Under nodeids the same run reads as a narrowed selection and a newly-added environmentally-skipped test still turns it red. Subset evidence for the claim that a narrowed run cannot false-fail: both corroborating full-width runs and the real narrowed run 35414570676 have 0 ids outside this baseline. Positive control for that zero: injecting one synthetic id into the same comparison reports 1. OMN-18868 raised this from 259 to 261 and the two added ids are the real-history controls of the wire-compatibility gate. WHY THEY MAY NEVER EXECUTE ON THIS SUITE, and it is a property of the checkout rather than of the tests: both resolve a released consumer out of the tags of this repository, and the Tests job clones at the default depth with no tags, so git tag --merged answers nothing there. Measured, not assumed: an earlier revision let one of them FAIL rather than skip for that reason, and it refused PR 2751 with WIRE_COMPAT_RELEASE_UNRESOLVABLE while the gate under test was sound (occ-receipt-runner run 35620477201, 1 failed 12 passed 1 skipped). THEY ARE NOT UNEXECUTED WORK. Both run on every pull request in the Wire Compatibility Gate job, which checks out at fetch-depth 0, is registered in STRICT_GATE_JOBS, and reads the JUnit report afterwards so that two skipped controls cannot exit zero. The test test_the_gate_job_runs_the_real_history_controls asserts that arrangement against the workflow tree and carries five negative controls, so removing the step turns a test red rather than turning these two ids into skips that nothing runs anywhere.'
     node_ids:
+      - tests.ci.test_check_wire_compatibility_omn18868::test_real_published_at_replay_against_the_release_that_predates_it
+      - tests.ci.test_check_wire_compatibility_omn18868::test_the_current_release_decodes_todays_wire_models
       - tests.ci.test_cross_repo_contract_deps::test_cross_repo_dependencies_declared
       - tests.ci.test_cross_repo_contract_deps::test_cross_repo_dependency_topics_resolve_in_referenced_contracts
       - tests.delegation_golden.test_layer2_live_runner.TestDelegationGoldenTasksLive::test_case_behaves_as_expected[I1]