[jonahgabriel]

Summary
This change implements a hard guard for the work-ledger projection writer (WorkLedgerProjectionWriter, table omninode_internal.work_ledger_rows). It refuses to execute when a real Data Source Name (DSN) is detected while running under a test runner.

Implementation Details

• New Handler: Added handlers/handler_work_ledger_write_guard.py containing HandlerWorkLedgerWriteGuard.
• Detection Logic:
  • Test Runner Detection: Triggered if PYTEST_CURRENT_TEST is set, if pytest or unittest is imported, or if ONEX_TEST_CONTEXT is non-empty. No ONEX_TEST_CONTEXT value removes a signal (0 still counts as set).
  • Real DSN Detection: Triggered if the DSN host is not loopback or a local socket.
• Behavior:
  • Upon detection, the process exits with code 79 (SystemExit), naming the guard ledger-test-write-guard.
  • This check occurs before db.connect and before any SQL statement execution.
  • The guard is active in both handle() and project_event().
  • There are no bypass flags or allowlists.
• Test Infrastructure:
  • tests/conftest.py includes an autouse fixture that deletes OMNIDASH_ANALYTICS_DB_URL and OMNIMARKET_PROJECTION_RUNTIME_BINDING_OVERLAY.

Versioning & Configuration

• Versioning: pyproject and uv.lock move from 0.4.276 to 0.4.278 (0.4.277 was already published, so the Release Identity Gate failed on 0.4.277).
• No new baseline or exception entries were added.
• Reference design: omnibase_internal#121.

Verification

• New Tests: tests/unit/nodes/node_projection_work_ledger/test_work_ledger_write_guard_omn19513.py contains 7 tests; the five behaviours below are the core:
  1. Fixture write to a real DSN exits with code 79; the recording DB saw zero calls.
  2. Same write to a loopback DSN succeeds.
  3. Command form exits with code 79 for a real DSN and 0 for loopback.
  4. ONEX_TEST_CONTEXT=0 cannot remove the test runner signal.
  5. With the refusal switched off, 4 of the 7 tests fail (verified locally); the remaining tests cover project_event() refusal, the conftest strip and the switched-off control.
• Local Results:
  • 34 passed in tests/unit/nodes/node_projection_work_ledger.
  • ruff and mypy strict checks are clean.
  • pre-commit hooks ran on commit.
• CI Strategy: Only focused tests were run locally; hosted CI is the final gate.

Ticket: OMN-19513.

Lab: host h201, lane ledger-guard-market, command uv run pytest tests/unit/nodes/node_projection_work_ledger -q, observed 34 passed; with the refusal switched off 4 of the 7 new tests failed.

Lab: host h202, head e8f5d89, command uv run pytest tests/unit/nodes/node_projection_read_effect tests/unit/nodes/node_projection_work_ledger -q, observed 65 passed; uv run mypy src/omnimarket/ --strict reported no issues in 4014 source files, after merging dev and giving SqliteTableRowSource the walk_origin method and selection parameter that ProtocolProjectionRowSource requires.

DELEGATION delegated=1 runs=0076c107-75a3-4baf-a97d-f09a6bfcdb2d

Evidence-Ticket: OMN-19513
Evidence-Source: OCC#12260

[github-actions]

✅ Architectural Review — PASSED

Errors: 0
Warnings: 0

What this checks

Rule	Description
ARCH-TOPIC-001	No hardcoded Kafka topic strings in handler code
ARCH-DI-001	No event_bus=None bypass
ARCH-DI-002	No direct Handler instantiation outside workflow_runner/adapters
ARCH-DI-003	No reinvented DI containers
ARCH-TOPIC-002	contract.yaml topics follow `onex.{cmd

---

No architectural violations found.

Static architectural lint — no model inference (OMN-14176).

[github-actions]

✅ Hostile Reviewer — PASSED

Blocking findings (critical/error): 0
Total findings: 17
Models succeeded: qwen3-review,gpt-oss-review

---

Gate semantics

Verdict	Meaning	Blocks merge?
passed	>=2 models succeeded, no critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	Fewer than 2 models succeeded (infra unavailable/timeout)	Yes (OMN-15110)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)