[jake-b-omni]

Stages grant-aeae215d-d796-4141-a0a9-7b5fd0c22055, the replacement prod-promotion manifest grant, at a tree onex-prod can admit.

Jonah — this needs your approval. grants/prod_promotion_grants.yaml is owned by @OmniNode-ai/platform-leads, GitHub refuses an author's own approval, and approved_by names you. You are the only person who can land it, which is the property the registry exists to have.

What changed since the revoked grant

Two fields, and no others:

	revoked grant-90f8e729	this entry
manifest_ref	8279e2ca	ad45e2cc
rendered_digest	sha256:33b54afe…	sha256:976ef4de…

Both trace to one file — k8s/keycloak-seed/base/seed-keycloak-clients-job.yaml now declares allowPrivilegeEscalation: false, capabilities.drop: [ALL], runAsNonRoot: true, seccompProfile: RuntimeDefault. It reached main as omninode_infra#1580, a narrow hotfix carrying the two files of b4eac797 rather than a promotion of all of dev, because #1565 is red on a dev-only hook-topic mirror drift that has nothing to do with Keycloak. Path, subtree, lane and approver are unchanged.

The check whose absence cost the last dispatch

Run 35392020746 passed every identity premise, applied all three objects to onex-prod with a live readback, and then Job seed-keycloak-clients hit DeadlineExceeded with zero pods. So this time admissibility was measured, with a control:

at ad45e2cc   [OK] Job/seed-keycloak-clients admits under restricted        exit=0
at 8279e2ca   [X]  would be REFUSED by restricted:                          exit=1
                   - allowPrivilegeEscalation must be false (got ABSENT)
                   - capabilities.drop must include ALL (got ABSENT)

Same checker, both refs. One that was silently broken would have admitted both. The digest recomputed at ad45e2cc equals the rendered_digest this entry declares, so the tree proven admissible is the tree the grant authorizes.

manifest_subtree is declared wider than manifest_path because the overlay's kustomization names ../../base: the transitive tree is six files across base/ and overlays/prod/.

The stability premise is met, not assumed

deploy-onex-staging run 35458357503, dispatched at ref main after #1580 merged:

verdict=GREEN  cluster=dev-system  sha=ad45e2cc1a8bbd0c4524e62783ee8fd84532e00c
applied=['k8s/keycloak-seed/overlays/dev-system=k8s/keycloak-seed' ...]

GREEN, recorded at the promoted commit, and the mapping names the subtree — so resolve_staging_apply binds it instead of reading SUBTREE_UNBOUND. Fresh until 2026-09-20T17:38:11Z.

What is still not proven

Staging enforces no pod-security profile on any of its namespaces, so a GREEN apply establishes that the overlay APPLIED, not that the Job RAN — it went green for the revoked grant's manifest too. That is OMN-18764, it is open, and the admissibility item above covers the gap by hand, for this dispatch only. The gate still cannot ask that question itself.

Nothing in production is mutated by merging this

The merge adds an authorization, not a workload. No dispatch, deploy, rollback or restart happens, and onex-prod keeps running exactly what it runs now. The inert DeadlineExceeded Job left by the failed reconcile is untouched.

Prune it once consumed

It expires 2026-09-20T17:44:56Z, and the OMN-13424 at-rest invariant FAILS on any expired entry left in the file — reddening every subsequent PR to this repository, which is the trap that put a clock on OCC#10302. Remove it after the dispatch settles, whichever way it settles.

Verification before pushing

All 14 declared check_values execute; every contract_entry_sha256 equals the recomputed per-entry hash; the nine pre-existing entries still bind their already-merged receipts after yamlfmt; honesty rules clean; no corruption sentinel. The schema suite (44 tests) passes and earned its keep — it caught that reason is a required field the entry was drafted without.

hotfix-evidence: OCC-10440
backmerge: #1580

Evidence-Class: hotfix
Evidence-Ticket: OMN-18601

🤖 Generated with Claude Code

https://claude.ai/code/session_01P5jA4UseYGEptrKijm4X9g