[jonahgabriel]

What this is

One line plus its comment. It advances the Receipt Gate pin in .github/workflows/call-receipt-gate.yml to 9cc9f035465266442df542d345cde621c9c3b0d5, the squash commit of omnibase_core#1740, so the OMN-19050 supersede-latch fix is actually in force on the path this repository's pull requests are decided on.

Corrected since this was opened. The original pin target here was a03b1072, and advancing this line to it would have been inert. This line selects which copy of receipt-gate.yml runs; that file carries a second, separate hardcoded ref supplying the validator SOURCE, and at a03b1072 that inner ref still read the August 37bd8519. Proven live on omnimarket#2751, whose gate log shows it checking out omnibase_core at 37bd8519 after this pin had already been advanced. omnibase_core#1740 (leg 1, merged) moves the inner ref; 9cc9f035 is the first sha at which this repository's gate actually runs the fixed validator. The a03b1072 advance itself already reached dev inside the omnimarket#2751 squash, so the repoint is the whole remaining diff.

Undrafted on the operator go relayed by the team lead: durable authorization is the OPERATOR-CONSENT row at docs/tracking/ROLLING_WORK_LEDGER.md:5193 (2026-09-22T13:54:22Z), whose approved scope is omnibase_core#1740 and then this pull request.

The defect

OMN-19050 closed the FAIL-supersede latch in omnibase_core and merged to that repo's dev. It is inert here, because the gate this repo runs is pinned to a commit that predates it.

The pin was 76532c203a2dccd5f928fba6657d5dd5ff3bdf10, version 0.47.19, an ancestor of the fix a03b10720db364575b0477003da95b46de765950 by exactly 11 commits. At that sha the resolver's supersede-suffix pattern still excludes a dot, and neither _sequence_key nor _guarded_winner exists. An attempt-scoped record is therefore not outranked there. It is invisible.

Live consequence on #2751: occ-preflight passes, while the Receipt Gate reports a non-pass receipt for OMN-18868:dod-occ-diff-derived-behavior-proof-pr-2751:test_passes even though the merged companion carries a PASS record for exactly that key. The gate's receipt_ids does not list the key at all, which is the signature of an unseen record rather than a rejected one.

This is the same silent-drop shape as the original defect, one layer further out: the fix is merged, and it is not in force.

Proof, with a negative control

Run over the same three merged receipt files fetched from onex_change_control dev, changing nothing but which omnibase_core the resolver comes from:

core at	resolved record	status
76532c20, the old pin	test_passes.supersede.2751.yaml	FAIL at bab99887
a03b1072, the new pin	test_passes.supersede.2751.0002.yaml	PASS at b5c6f7a4

The negative control is the point: the old pin still returns the FAIL over identical input, so the new result is caused by the pin and not by the receipts having changed under the test. The old-pin run was done in a detached checkout at that exact sha, not by patching a newer tree.

Pin target, and why it is not a release

No published release carries the fix. v0.47.20 is the latest, tagged 3afa3528 on 2026-09-20T22:33Z; the fix merged 2026-09-21T20:12Z, and git tag --contains on it returns empty.

A released version would be the better pin for a required gate, so this deliberately takes second best and says so in the comment: it pins the merge sha and records that it should be re-pointed at the first release that carries the fix.

Blast radius, measured

.github/workflows/receipt-gate.yml is byte-identical across the move, blob cb0c2b547e34d664644b3faa08758ef44d245576 at both shas, so the gate's own shape does not change.

The validation surface does move: 18 files, +893/-220. Two are gate-relevant besides the resolver, and both come from a single commit, feat(OMN-18996): deliver core delegation source slice (omnibase_core#1730).

file	blob at the old pin	blob at the new pin
validator_occ_append_only.py	20d8213555ba0ea3e559f7b0591f607285aed722	01632345c74be77e885a39d497655497bb1fda98
validator_receipt_diff_consistency.py	9ccbafd9bb0790a6b6aaa53373b4965e0959518a	98bec78a98c4f29d555102ee841bf923e03590ca
validator_receipt_supersession.py	624b4c03f359862d5be07b0ff8174ec321a97713	f0721783054a6d046bc4173b76befc23b14d7217

That third-party movement inside a required gate is the whole reason this is its own pull request under its own ticket rather than a rider, and the reason the pin's own comment calls advancing it a reviewed edit.

Why it is a draft

It was a draft because merging moves this repository's dev head and re-triggers the deploy agent, and because the pin it should carry did not exist until leg 1 merged. Both have now resolved: leg 1 merged at 2026-09-22T14:21:56Z, and omnimarket dev has taken several merges since the hold was written. The operator go is the consent row cited above.

Scope

No runtime path is touched. This is a workflow pin. Countersignature is with a second actor rather than self-attested.

Evidence-Ticket OMN-19149

Scope against the merge-order hold

This pull request changes exactly one file, .github/workflows/call-receipt-gate.yml, and nothing else. It is a CI gate pin: no runtime path, no source, no image, no packaging metadata, and pyproject.toml is untouched so no version moves. The merge-order hold whose head is omnibase_infra#3939 sequences runtime-affecting merges on omnibase_infra and omnimarket; a workflow-only change does not move this repository's runtime and is outside it. Authorization is the operator consent row at docs/tracking/ROLLING_WORK_LEDGER.md:5193, recorded 2026-09-22T13:54:22Z, which post-dates the hold and names this pull request explicitly.

Evidence-Ticket: OMN-19149
Evidence-Source: OCC#10799

[github-actions]

✅ Architectural Review — PASSED

Errors: 0
Warnings: 0

What this checks

Rule	Description
ARCH-TOPIC-001	No hardcoded Kafka topic strings in handler code
ARCH-DI-001	No event_bus=None bypass
ARCH-DI-002	No direct Handler instantiation outside workflow_runner/adapters
ARCH-DI-003	No reinvented DI containers
ARCH-TOPIC-002	contract.yaml topics follow `onex.{cmd

---

No architectural violations found.

Static architectural lint — no model inference (OMN-14176).

[github-actions]

✅ Hostile Reviewer — PASSED

Blocking findings (critical/error): 0
Total findings: 8
Models succeeded: qwen3-review,qwen3-review-b

---

Gate semantics

Verdict	Meaning	Blocks merge?
passed	>=2 models succeeded, no critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	Fewer than 2 models succeeded (infra unavailable/timeout)	Yes (OMN-15110)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)

[jonahgabriel]

This PR alone is inert — leg 1 added, and this one will be repointed

Correcting my own causal claim above rather than leaving it standing.

The caller pin this PR advances selects which copy of receipt-gate.yml runs. That file is byte-identical across the move, blob cb0c2b54 on both sides, as the body already states. What the body got wrong is what happens next: at omnibase_core/.github/workflows/receipt-gate.yml:589 the gate checks the validator SOURCE out from a hardcoded ref, 37bd85194b96c5a476ae2e2c0ef79235955fb748 (0.46.12), which is neither this caller pin nor a lock. Its own comment says a caller uses: pin alone cannot propagate a Python source-level fix.

So the gate runs 0.46.12's validator at either value of this pin, and the proof in the body ran the resolver imported directly, which the gate never does. The measurement was real; the inference from resolver behaviour to gate behaviour was the load-bearing step, and it was false here. That was the limit flagged in the body, and it turned out to be the whole thing.

Leg 1 is omnibase_core#1740, also a draft, which moves that hardcoded ref. It is proven at the gate's own eligibility entrypoint rather than at the resolver:

validator source	verdict	the disputed key
37bd8519, old ref	eligible: false, reason: nonpass_receipt, exit 1	absent from receipt_ids
a03b1072, new ref	eligible: true, reason: eligible, exit 0	present in receipt_ids

The negative control reproduces the live gate's reported output verbatim, including the key's absence from receipt_ids.

This PR will be repointed at leg 1's merge sha rather than at a03b1072 directly, so the caller and the validator source agree. It stays a draft until then, and its countersigner has been told to hold.

Evidence-Ticket OMN-19149

[onexbot-occ-writer]

OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required.