fix(OMN-10569): strip baked LAN/path/identity defaults from omnimarket source

docs/work-tracking/contracts/OMN-10569.yaml

@@ -0,0 +1,33 @@
+# OMN-10569 contract file for omnimarket deploy-gate (OMN-8912).
+# The canonical ticket contract lives in onex_change_control.
+# This file is the per-repo deploy-evidence carrier only.
+schema_version: "1.0.0"
+ticket_id: "OMN-10569"
+title: "Strip baked LAN/path/identity defaults from omnimarket production source"
+summary: "Replace all hardcoded 192.168.x.x IPs, user home paths, external volume paths, localhost:9092 Kafka defaults, and model ID literals in src/omnimarket/ with empty-string defaults."
+is_seam_ticket: false
+interface_change: false
+interfaces_touched: []
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-001"
+    description: "3425 unit tests pass; zero new failures vs main."
+    source: "manual"
+    checks:
+      - check_type: "command"
+        check_value: "uv run pytest tests/ -m 'not kafka' --ignore=tests/test_datasource_postgres.py -q"
+  - id: "dod-002"
+    description: "grep confirms no 192.168.x.x IPs remain as os.environ.get defaults in src/omnimarket/."
+    source: "manual"
+    checks:
+      - check_type: "command"
+        check_value: "grep -rn '192\\.168\\.' src/omnimarket/ --include='*.py' | grep 'os\\.environ\\.get' | grep -v '# onex-allow-internal-ip'"
+  - id: "dod-deploy"
+    description: "Runtime handlers import cleanly with empty env-var defaults on the running runtime container — no LAN defaults baked in."
+    source: "manual"
+    checks:
+      - check_type: "command"
+        check_value: "docker exec omninode-runtime-effects /app/.venv/bin/python -c \"import omnimarket.nodes.node_thread_reply_effect.handlers.handler_thread_reply as h; assert h._BASE_REGISTRY.get('qwen3-coder-30b', {}).get('url', '') == '', 'LAN default still baked in'\""

src/omnimarket/cli/cli_ab_compare_suite.py

@@ -343,7 +343,7 @@ async def _call_glm(
 
     base_url = os.environ.get("LLM_GLM_URL", "").strip()
     api_key = os.environ.get("LLM_GLM_API_KEY", "").strip()
-    model_name = os.environ.get("LLM_GLM_MODEL_NAME", "glm-4.5").strip() or "glm-4.5"
+    model_name = os.environ.get("LLM_GLM_MODEL_NAME", "").strip()
     if not base_url or not api_key:
         return None
 

src/omnimarket/nodes/node_ab_inference_effect/models/model_inference_request.py

@@ -18,7 +18,7 @@ class ModelInferenceRequest(BaseModel):
     )
     endpoint_url: str = Field(
         ...,
-        description="Full base URL for the LLM endpoint (e.g. http://192.168.86.201:8000).",  # onex-allow-internal-ip OMN-10580 reason="field description example only; no runtime default"
+        description="Full base URL for the LLM endpoint (e.g. http://<host>:<port>).",
     )
     model_id: str = Field(
         ...,

src/omnimarket/nodes/node_aislop_sweep/__main__.py

@@ -63,10 +63,10 @@ def _resolve_repo_dirs(repos: list[str], omni_home: str) -> list[str]:
 
 def main() -> None:
     logging.basicConfig(level=logging.WARNING, format="%(levelname)s: %(message)s")
-    omni_home = os.environ.get(
-        "OMNI_HOME",
-        "/Volumes/PRO-G40/Code/omni_home",  # onex-allow-local-path OMN-10580 reason="OMNI_HOME env-var fallback; OMNI_HOME must be set in any non-dev environment"
-    )
+    omni_home = os.environ.get("OMNI_HOME", "")
+    if not omni_home:
+        _log.error("OMNI_HOME is not set — cannot resolve repo directories")
+        sys.exit(1)
 
     parser = argparse.ArgumentParser(
         description="Detect AI-generated quality anti-patterns across repos."

src/omnimarket/nodes/node_autopilot_orchestrator/consumer.py

@@ -181,9 +181,8 @@ def main() -> None:
         level=logging.INFO,
         format="%(asctime)s %(levelname)s %(name)s: %(message)s",
     )
-    broker = os.environ.get(
-        "KAFKA_BOOTSTRAP_SERVERS",
-        os.environ.get("KAFKA_BROKER", "localhost:9092"),
+    broker = os.environ.get("KAFKA_BOOTSTRAP_SERVERS") or os.environ.get(
+        "KAFKA_BROKER", ""
     )
     group_id = os.environ.get("AUTOPILOT_ORCH_GROUP", _DEFAULT_GROUP)
     asyncio.run(_run_consumer(broker, group_id))

src/omnimarket/nodes/node_baseline_capture/handlers/probes/probe_kafka_topics.py

@@ -29,12 +29,11 @@ async def collect(self, omni_home: str) -> list[ProbeSnapshotItem]:
             logger.warning("httpx not available — skipping kafka_topics probe")
             return []
 
-        # Redpanda admin API — default port 9644
-        admin_host = os.environ.get(
-            "REDPANDA_ADMIN_HOST",
-            "192.168.86.201",  # onex-allow-internal-ip OMN-10580 reason="env-var fallback to lab Redpanda host; override via REDPANDA_ADMIN_HOST"
-        )
+        admin_host = os.environ.get("REDPANDA_ADMIN_HOST", "")
         admin_port = os.environ.get("REDPANDA_ADMIN_PORT", "9644")
+        if not admin_host:
+            logger.warning("REDPANDA_ADMIN_HOST not set — skipping kafka_topics probe")
+            return []
         base_url = f"http://{admin_host}:{admin_port}"
 
         try:

src/omnimarket/nodes/node_baseline_capture/handlers/probes/probe_system_health.py

@@ -17,37 +17,47 @@
 
 
 def _services_from_env() -> list[tuple[str, str]]:
-    """Build list of (name, url) tuples from environment variables."""
-    candidates = [
-        (
-            "postgres",
-            f"http://{os.environ.get('POSTGRES_HOST', '192.168.86.201')}:{os.environ.get('POSTGRES_PORT', '5436')}",  # onex-allow-internal-ip OMN-10580 reason="env-var fallback to lab Postgres; override via POSTGRES_HOST/PORT"
-        ),
-        (
-            "redpanda",
-            f"http://{os.environ.get('REDPANDA_ADMIN_HOST', '192.168.86.201')}:9644/v1/cluster/health",  # onex-allow-internal-ip OMN-10580 reason="env-var fallback to lab Redpanda admin; override via REDPANDA_ADMIN_HOST"
-        ),
-        (
-            "valkey",
-            "http://192.168.86.201:16379",  # onex-allow-internal-ip OMN-10580 reason="lab Valkey endpoint; no env-var override in this probe"
-        ),
-        (
-            "qdrant",
-            f"http://{os.environ.get('QDRANT_HOST', '192.168.86.201')}:{os.environ.get('QDRANT_PORT', '6333')}/healthz",  # onex-allow-internal-ip OMN-10580 reason="env-var fallback to lab Qdrant; override via QDRANT_HOST/PORT"
-        ),
-        (
-            "llm_coder",
-            f"{os.environ.get('LLM_CODER_URL', 'http://192.168.86.201:8000')}/health",  # onex-allow-internal-ip OMN-10580 reason="env-var fallback to lab LLM coder; override via LLM_CODER_URL"
-        ),
-        (
-            "llm_coder_fast",
-            f"{os.environ.get('LLM_CODER_FAST_URL', 'http://192.168.86.201:8001')}/health",  # onex-allow-internal-ip OMN-10580 reason="env-var fallback to lab LLM fast; override via LLM_CODER_FAST_URL"
-        ),
-        (
-            "llm_embedding",
-            f"{os.environ.get('LLM_EMBEDDING_URL', 'http://192.168.86.200:8100')}/health",  # onex-allow-internal-ip OMN-10580 reason="env-var fallback to lab embedding endpoint; override via LLM_EMBEDDING_URL"
-        ),
-    ]
+    """Build list of (name, url) tuples from environment variables.
+
+    Services with unconfigured URLs are omitted — callers must set the
+    appropriate env vars to include them in health probes.
+    """
+    candidates: list[tuple[str, str]] = []
+
+    postgres_host = os.environ.get("POSTGRES_HOST", "")
+    postgres_port = os.environ.get("POSTGRES_PORT", "")
+    if postgres_host and postgres_port:
+        candidates.append(("postgres", f"http://{postgres_host}:{postgres_port}"))
+
+    redpanda_host = os.environ.get("REDPANDA_ADMIN_HOST", "")
+    redpanda_port = os.environ.get("REDPANDA_ADMIN_PORT", "9644")
+    if redpanda_host:
+        candidates.append(
+            ("redpanda", f"http://{redpanda_host}:{redpanda_port}/v1/cluster/health")
+        )
+
+    valkey_host = os.environ.get("VALKEY_HOST", "")
+    valkey_port = os.environ.get("VALKEY_PORT", "")
+    if valkey_host and valkey_port:
+        candidates.append(("valkey", f"http://{valkey_host}:{valkey_port}"))
+
+    qdrant_host = os.environ.get("QDRANT_HOST", "")
+    qdrant_port = os.environ.get("QDRANT_PORT", "")
+    if qdrant_host and qdrant_port:
+        candidates.append(("qdrant", f"http://{qdrant_host}:{qdrant_port}/healthz"))
+
+    llm_coder_url = os.environ.get("LLM_CODER_URL", "")
+    if llm_coder_url:
+        candidates.append(("llm_coder", f"{llm_coder_url}/health"))
+
+    llm_coder_fast_url = os.environ.get("LLM_CODER_FAST_URL", "")
+    if llm_coder_fast_url:
+        candidates.append(("llm_coder_fast", f"{llm_coder_fast_url}/health"))
+
+    llm_embedding_url = os.environ.get("LLM_EMBEDDING_URL", "")
+    if llm_embedding_url:
+        candidates.append(("llm_embedding", f"{llm_embedding_url}/health"))
+
     return candidates
 
 

src/omnimarket/nodes/node_build_loop_orchestrator/assemble_live.py

@@ -71,10 +71,8 @@
 LINEAR_API_URL = "https://api.linear.app/graphql"
 LINEAR_TEAM_ID = "9bdff6a3-f4ef-4ff7-b29a-6c4cf44371e6"
 
-OMNI_HOME = Path(os.environ.get("OMNI_HOME", str(Path.home() / "Code" / "omni_home")))
-WORKTREE_ROOT = Path(
-    os.environ.get("OMNI_WORKTREES_ROOT", str(Path.home() / "Code" / "omni_worktrees"))
-)
+OMNI_HOME = Path(os.environ.get("OMNI_HOME", ""))
+WORKTREE_ROOT = Path(os.environ.get("OMNI_WORKTREES_ROOT", ""))
 
 # LLM endpoints — resolved from env vars only, no hardcoded IP fallbacks (OMN-8782)
 LLM_FAST_URL = os.environ.get("LLM_CODER_FAST_URL", "")
@@ -83,7 +81,7 @@
 # Frontier: GLM-4.5 (primary code generation backend)
 LLM_GLM_API_KEY = os.environ.get("LLM_GLM_API_KEY", "")
 LLM_GLM_URL = os.environ.get("LLM_GLM_URL", "")
-LLM_GLM_MODEL_NAME = os.environ.get("LLM_GLM_MODEL_NAME", "glm-4.5")
+LLM_GLM_MODEL_NAME = os.environ.get("LLM_GLM_MODEL_NAME", "")
 
 # Frontier: OpenAI
 OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY", "")

src/omnimarket/nodes/node_build_loop_orchestrator/consumer.py

@@ -207,9 +207,8 @@ def main() -> None:
         level=logging.INFO,
         format="%(asctime)s %(levelname)s %(name)s: %(message)s",
     )
-    broker = os.environ.get(
-        "KAFKA_BOOTSTRAP_SERVERS",
-        os.environ.get("KAFKA_BROKER", "localhost:9092"),
+    broker = os.environ.get("KAFKA_BOOTSTRAP_SERVERS") or os.environ.get(
+        "KAFKA_BROKER", ""
     )
     group_id = os.environ.get("BUILD_LOOP_GROUP", _DEFAULT_GROUP)
     asyncio.run(_run_consumer(broker, group_id))

src/omnimarket/nodes/node_build_loop_orchestrator/handlers/adapter_delegation_router.py

@@ -214,7 +214,7 @@ def build_endpoint_configs() -> dict[EnumModelTier, ModelEndpointConfig]:
     # Frontier GLM (primary code gen) — reads LLM_GLM_* from env
     glm_key = os.environ.get("LLM_GLM_API_KEY", "")
     glm_url = os.environ.get("LLM_GLM_URL", "")
-    glm_model = os.environ.get("LLM_GLM_MODEL_NAME", "glm-4.5")
+    glm_model = os.environ.get("LLM_GLM_MODEL_NAME", "")
     if glm_key and glm_url:
         configs[EnumModelTier.FRONTIER_GLM] = ModelEndpointConfig(
             tier=EnumModelTier.FRONTIER_GLM,

src/omnimarket/nodes/node_build_loop_orchestrator/handlers/assemble_live.py

@@ -179,10 +179,7 @@ async def run_live_build_loop(
         )
 
     # Write results to disk
-    _default_output = os.environ.get(
-        "BUILD_LOOP_OUTPUT_DIR",
-        str(Path.home() / ".onex_state" / "build-loop-results"),
-    )
+    _default_output = os.environ.get("BUILD_LOOP_OUTPUT_DIR", "")
     out_path = Path(output_dir or _default_output)
     out_path.mkdir(parents=True, exist_ok=True)
     result_file = out_path / f"live-run-{command.correlation_id}.json"

src/omnimarket/nodes/node_compliance_sweep/__main__.py

@@ -51,10 +51,10 @@ def _resolve_repo_dirs(repos: list[str], omni_home: str) -> list[str]:
 
 def main() -> None:
     logging.basicConfig(level=logging.WARNING, format="%(levelname)s: %(message)s")
-    omni_home = os.environ.get(
-        "OMNI_HOME",
-        "/Volumes/PRO-G40/Code/omni_home",  # onex-allow-local-path OMN-10580 reason="OMNI_HOME env-var fallback; OMNI_HOME must be set in any non-dev environment"
-    )
+    omni_home = os.environ.get("OMNI_HOME", "")
+    if not omni_home:
+        _log.error("OMNI_HOME is not set — cannot resolve repo directories")
+        sys.exit(1)
 
     parser = argparse.ArgumentParser(
         description="Handler contract compliance sweep across repos."

src/omnimarket/nodes/node_database_sweep/handlers/handler_database_sweep.py

@@ -381,13 +381,7 @@ class NodeDatabaseSweep:
     """Scan projection tables and migration state across all ONEX databases."""
 
     def handle(self, request: DatabaseSweepRequest) -> DatabaseSweepResult:
-        omni_home = (
-            request.omni_home
-            or os.environ.get(
-                "OMNI_HOME",
-                "/Users/jonah/Code/omni_home",  # onex-allow-local-path OMN-10580 reason="OMNI_HOME env-var fallback; OMNI_HOME must be set in any non-dev environment"
-            )
-        )
+        omni_home = request.omni_home or os.environ.get("OMNI_HOME", "")
         analytics_db = "omnidash_analytics"
 
         drizzle_tables = _get_drizzle_tables(omni_home)

src/omnimarket/nodes/node_dispatch_queue_drainer/handlers/handler_dispatch_queue_drainer.py

@@ -169,12 +169,7 @@ def _resolve_state_dir(state_dir: Path | None) -> Path:
 
 
 def _resolve_omni_home() -> Path:
-    return Path(
-        os.environ.get(
-            "OMNI_HOME",
-            "/Users/jonah/Code/omni_home",  # onex-allow-local-path OMN-10580 reason="OMNI_HOME env-var fallback; OMNI_HOME must be set in any non-dev environment"
-        )
-    )
+    return Path(os.environ["OMNI_HOME"])
 
 
 def _to_dispatch_worker_command(

src/omnimarket/nodes/node_doc_freshness_sweep/handlers/handler_doc_freshness_sweep.py

@@ -152,13 +152,7 @@ class NodeDocFreshnessSweep:
     """Scan documentation files across repos for broken references and stale content."""
 
     def handle(self, request: DocFreshnessSweepRequest) -> DocFreshnessSweepResult:
-        omni_home = (
-            request.omni_home
-            or os.environ.get(
-                "OMNI_HOME",
-                "/Users/jonah/Code/omni_home",  # onex-allow-local-path OMN-10580 reason="OMNI_HOME env-var fallback; OMNI_HOME must be set in any non-dev environment"
-            )
-        )
+        omni_home = request.omni_home or os.environ.get("OMNI_HOME", "")
         repos = request.repos or _DEFAULT_REPOS
 
         # Resolve repo directories

src/omnimarket/nodes/node_dod_verify/services/evidence_collector.py

@@ -158,7 +158,7 @@ def _find_contract(self, ticket_id: str) -> Path | None:
                 return candidate
 
         # Fallback: resolve via OMNI_HOME env var
-        omni_home = os.environ.get("OMNI_HOME", str(Path.home() / "Code" / "omni_home"))
+        omni_home = os.environ.get("OMNI_HOME", "")
         candidate = (
             Path(omni_home) / "onex_change_control" / "contracts" / f"{ticket_id}.yaml"
         )

src/omnimarket/nodes/node_duplication_sweep/handlers/handler_duplication_sweep.py

@@ -317,13 +317,7 @@ class NodeDuplicationSweep:
     """Detect duplicate definitions across repos."""
 
     def handle(self, request: DuplicationSweepRequest) -> DuplicationSweepResult:
-        omni_home = (
-            request.omni_home
-            or os.environ.get(
-                "OMNI_HOME",
-                "/Users/jonah/Code/omni_home",  # onex-allow-local-path OMN-10580 reason="OMNI_HOME env-var fallback; OMNI_HOME must be set in any non-dev environment"
-            )
-        )
+        omni_home = request.omni_home or os.environ.get("OMNI_HOME", "")
         checks = request.checks or _ALL_CHECKS
 
         check_results: list[ModelDuplicationCheckResult] = []

src/omnimarket/nodes/node_e2e_orchestrator/consumer.py

@@ -368,9 +368,8 @@ def main() -> None:
         level=logging.INFO,
         format="%(asctime)s %(levelname)s %(name)s: %(message)s",
     )
-    broker = os.environ.get(
-        "KAFKA_BOOTSTRAP_SERVERS",
-        os.environ.get("KAFKA_BROKER", "localhost:9092"),
+    broker = os.environ.get("KAFKA_BOOTSTRAP_SERVERS") or os.environ.get(
+        "KAFKA_BROKER", ""
     )
     group_id = os.environ.get("E2E_ORCH_GROUP", _DEFAULT_GROUP)
     ci_timeout = int(os.environ.get("CI_POLL_TIMEOUT_SECONDS", _DEFAULT_CI_TIMEOUT))

src/omnimarket/nodes/node_environment_health_scanner/handlers/handler_environment_health_scanner.py

@@ -116,9 +116,7 @@ def handle(self, request: EnvironmentHealthRequest) -> EnvironmentHealthResult:
         )
         omni_home = request.omni_home or os.environ.get("OMNI_HOME", "")
         ssh_target = request.ssh_target or os.environ.get("ONEX_INFRA_SSH_TARGET")
-        onex_state_dir = os.environ.get(
-            "ONEX_STATE_DIR", str(Path.home() / ".onex_state")
-        )
+        onex_state_dir = os.environ.get("ONEX_STATE_DIR", "")
 
         results: list[ModelSubsystemResult] = []
 

src/omnimarket/nodes/node_handoff_effect/handlers/handler_handoff_effect.py

@@ -20,10 +20,7 @@
 
 logger = logging.getLogger(__name__)
 
-_SSH_HOST = os.environ.get(
-    "ONEX_INFRA_SSH_TARGET",
-    "jonah@192.168.86.201",  # onex-allow-internal-ip OMN-10580 reason="lab infra SSH default; override via ONEX_INFRA_SSH_TARGET"
-)
+_SSH_HOST = os.environ.get("ONEX_INFRA_SSH_TARGET", "")
 _SSH_TIMEOUT = 15
 
 
@@ -172,7 +169,7 @@ def handle(
 
         cwd_hash = hashlib.sha256(work_dir.encode()).hexdigest()[:8]
 
-        state_dir = Path(os.environ.get("ONEX_STATE_DIR", Path.home() / ".onex_state"))
+        state_dir = Path(os.environ.get("ONEX_STATE_DIR", ""))
         env_sync_log = state_dir / "logs" / "env-sync.log"
 
         # Raises InfraHealthGatherError on any SSH failure — fail loudly

src/omnimarket/nodes/node_merge_sweep_compute/consumer.py

@@ -8,7 +8,7 @@
 
 Environment variables (all resolved at startup — no hardcoded strings):
     GH_PAT             GitHub PAT (required — fail-fast if missing)
-    KAFKA_BROKER        Redpanda/Kafka bootstrap server (default: localhost:9092)
+    KAFKA_BROKER        Redpanda/Kafka bootstrap server (required — no default)
     ONEX_STATE_DIR      Failure-history state dir (default: ~/.onex_state)
     MERGE_SWEEP_GROUP   Consumer group ID (default: omnimarket.merge_sweep.consume.v1)
 
@@ -274,7 +274,9 @@ def main() -> None:
         level=logging.INFO,
         format="%(asctime)s %(levelname)s %(name)s: %(message)s",
     )
-    broker = os.environ.get("KAFKA_BROKER", "localhost:9092")
+    broker = os.environ.get("KAFKA_BOOTSTRAP_SERVERS") or os.environ.get(
+        "KAFKA_BROKER", ""
+    )
     group_id = os.environ.get("MERGE_SWEEP_GROUP", "omnimarket.merge_sweep.consume.v1")
     state_dir = os.environ.get("ONEX_STATE_DIR", os.path.expanduser("~/.onex_state"))
 

src/omnimarket/nodes/node_nightly_loop_controller/models/model_nightly_loop.py

@@ -199,14 +199,8 @@ def build_default_routing_table() -> tuple[ModelDelegationRoute, ...]:
     import os
 
     gemini_endpoint = os.environ.get("GEMINI_CLI_ENDPOINT", "cli://gemini")
-    local_coder_endpoint = os.environ.get(
-        "LLM_CODER_URL",
-        "http://192.168.86.201:8000",  # onex-allow-internal-ip OMN-10580 reason="env-var fallback to lab coder endpoint; override via LLM_CODER_URL"
-    )
-    local_fast_endpoint = os.environ.get(
-        "LLM_CODER_FAST_URL",
-        "http://192.168.86.201:8001",  # onex-allow-internal-ip OMN-10580 reason="env-var fallback to lab fast endpoint; override via LLM_CODER_FAST_URL"
-    )
+    local_coder_endpoint = os.environ.get("LLM_CODER_URL", "")
+    local_fast_endpoint = os.environ.get("LLM_CODER_FAST_URL", "")
 
     return (
         ModelDelegationRoute(