[jonahgabriel]

OMN-19131

requested_timeout_seconds landed on ModelDelegateSkillRequest (omnimarket#2718, ce11a870d, merged 2026-09-22T03:49:58Z) without exclude_if. RuntimeLocal publishes the delegation command record as model_payload.model_dump_json().encode("utf-8"), so the field serialises as "requested_timeout_seconds": null on every delegation — including the overwhelming majority that never passed --timeout and have no interest in it.

The model declares extra="forbid". A consumer baked before the field declares no such field and refuses the record as publisher-malformed. This is the second instance of the rollout class whose remedy is spelled out three fields further down this same file.

Lab readback (rule 24) — .201, 2026-09-22

Each container's own copy of the model validating the exact published bytes, rather than comparing version strings (both sides reported the same version last time, which is why the first instance went undetected):

container	lane	pre-fix bytes	post-fix bytes
omninode-runtime	omnibase-infra (dev)	ACCEPTED	ACCEPTED
omninode-runtime-effects	omnibase-infra (dev)	field declared	field declared
omninode-stability-test-runtime	omnibase-infra-stability-test	REFUSED	ACCEPTED
omninode-stability-test-runtime-effects	omnibase-infra-stability-test	no field, extra=forbid	—

Refusal text on the pre-fix bytes:

1 validation error for ModelDelegateSkillRequest
requested_timeout_seconds
  Extra inputs are not permitted [type=extra_forbidden]

One producer, one record, accepted on one live lane and refused on another at the same moment. Read-only docker exec ... python -c on both lanes; nothing built, restarted, retagged or otherwise mutated.

RED then GREEN

tests/unit/delegation/test_omn19131_requested_timeout_excluded_when_unset.py
RED:   2 failed, 3 passed   (the 3 are the over-reach controls, correct to pass before the fix)
GREEN: 5 passed

Neighbouring suites after the fix, all green: test_omn18852_published_at_excluded_when_unset, test_omn18852_queue_wait_accounting, test_models, test_handler_delegate_skill_budget_omn15504, test_runtime_dispatch_port, test_response_contract_conformance_runner_omn18700, test_omn18852_inference_deadline_bound — 85 passing across the two runs.

Why the existing guard was green while this reached the wire

test_omn18852_published_at_excluded_when_unset derives its accepted field set as ModelDelegateSkillRequest.model_fields.keys() - {"published_at"}, so it ratifies whatever field the model gains next — exactly the hazard its own docstring warns about, applied to every field but the one it names. The new module therefore spells the permitted wire keyset as a literal, in both directions: a new optional field that forgets exclude_if names itself in the failure, and silently dropping a key an existing consumer requires fails too.

Scope

One field gains exclude_if=lambda value: value is None. No behaviour change for any caller: a request that does set a timeout still serialises it (covered by a positive control), the ge=1 bound is unchanged, and the handler's ceiling refusal and budget evidence are untouched. The other optional fields on this contract are older than every deployed consumer and are deliberately left on the wire — that is what the literal keyset records.

This closes the wire-safety half of Required outcome A. Halves B (AC3/AC4 — a pre-publish validation failure reported as itself rather than as an absent terminal) and AC5 (the cross-repo payload/model contract test) live in omnibase_infra's cli_delegate.py and are not touched here.

---

Merge sequencing (OMN-17427): this is runtime-affecting under the canonical deploy-gate path patterns, so it lands only after omnibase_infra#3939 under the 2026-09-21 runtime merge-order ruling. It is ready for review so its change-control companion can mint and every gate can run on a non-draft head; the hold:auto-merge label keeps the auto-merge workflow from arming it. Fresh head merges current dev, including the OMN-18868 wire-compatibility gate; run locally on that head it reports WIRE_COMPAT_PASS against released consumer v0.4.198.

Evidence-Ticket: OMN-19131
Evidence-Source: OCC#10822

[github-actions]

✅ Architectural Review — PASSED

Errors: 0
Warnings: 0

What this checks

Rule	Description
ARCH-TOPIC-001	No hardcoded Kafka topic strings in handler code
ARCH-DI-001	No event_bus=None bypass
ARCH-DI-002	No direct Handler instantiation outside workflow_runner/adapters
ARCH-DI-003	No reinvented DI containers
ARCH-TOPIC-002	contract.yaml topics follow `onex.{cmd

---

No architectural violations found.

Static architectural lint — no model inference (OMN-14176).

[github-actions]

✅ Hostile Reviewer — PASSED

Blocking findings (critical/error): 0
Total findings: 8
Models succeeded: qwen3-review,qwen3-review-b

---

Gate semantics

Verdict	Meaning	Blocks merge?
passed	>=2 models succeeded, no critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	Fewer than 2 models succeeded (infra unavailable/timeout)	Yes (OMN-15110)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)