jake-b-omni · Sep 19, 2026 · Sep 19, 2026 · Sep 19, 2026 · Sep 19, 2026
diff --git a/contracts/OMN-18601.yaml b/contracts/OMN-18601.yaml
@@ -154,12 +154,20 @@ dod_evidence:
       both. FALSIFIABLE IN THE USEFUL DIRECTION: the check asserts `entries: []` and therefore FAILS on
       onex_change_control@main at 6c54c74f8, where the entry is still live. Note the check deliberately
       does NOT grep for the absence of the grant id, because the revocation header above names it on purpose
-      and such a check would match the comment and report a false failure.'
+      and such a check would match the comment and report a false failure. READ FROM THE RECEIPT, NOT
+      THE LIVE REGISTRY, and the reason is the mirror image of why the two staged-state items above read
+      from theirs. `entries: []` is an assertion about registry STATE, and OCC#10454 stages the replacement
+      grant-aeae215d, so the live form inverts into a false failure the moment a new authorization is
+      written -- which is the registry working, not a regression. What this item records is unchanged
+      and remains true: grant-90f8e729 WAS removed, measured at 6c54c74f8 with a control that inverts,
+      and it has not come back. The check now reads the receipt minted when that removal happened. Every
+      state-asserting item on this contract has now been converted at the first moment its state changed,
+      which is the lifecycle this pattern exists to survive.'
     source: manual
     status: verified
     checks:
       - check_type: command
-        check_value: 'grep -Eq ''^entries: \[\]$'' grants/prod_promotion_grants.yaml'
+        check_value: 'grep -q ''^status: PASS$'' drift/dod_receipts/OMN-18601/dod-omn18601-grant-revoked/command.yaml'
   - id: "dod-omn18601-psa-admissible-at-main"
     description: >-
       THE QUESTION THE 20:32Z DISPATCH NEVER ASKED, asked here before the next one. Rendering k8s/keycloak-seed/overlays/prod
@@ -216,3 +224,103 @@ dod_evidence:
       - check_type: "command"
         check_value: >-
           grep -q '^status: PASS$' drift/dod_receipts/OMN-18601/dod-omn18601-psa-test-suite/command.yaml
+  - id: "dod-omn18601-grant2-values"
+    description: >-
+      STAGED STATE of the replacement grant. The registry carries grant-aeae215d-d796-4141-a0a9-7b5fd0c22055
+      and every one of its six target fields verbatim — target_kind manifest, manifest_path k8s/keycloak-seed/overlays/prod,
+      manifest_subtree k8s/keycloak-seed, manifest_ref ad45e2cc1a8bbd0c4524e62783ee8fd84532e00c and rendered_digest
+      sha256:976ef4de626144f156a6a227c3b881066e07273476a5f19f00b96e6e454fad06 — and the file is no longer
+      at rest. FALSIFIABLE IN THE USEFUL DIRECTION: the identical chain FAILS on onex_change_control@main
+      at 16a3db814, where the registry is `entries: []` and none of the six strings exists, so a chain
+      broken by a mistyped id or a grep that never matches would have failed on BOTH trees. THIS ITEM
+      ASSERTS STATE AND WILL INVERT WHEN THE ENTRY IS PRUNED, which is a lifecycle fact rather than a
+      defect and is recorded here so the next reader does not have to rediscover it: the PR that prunes
+      this entry must re-point this check at its own receipt, the way OCC#10302 re-pointed dod-prod-promotion-grant-values-omn18601
+      when it revoked grant-90f8e729. The measurement and its control live in the receipt either way.
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -Fq 'grant-aeae215d-d796-4141-a0a9-7b5fd0c22055' grants/prod_promotion_grants.yaml && grep
+          -Fq 'target_kind: manifest' grants/prod_promotion_grants.yaml && grep -Fq 'manifest_path: k8s/keycloak-seed/overlays/prod'
+          grants/prod_promotion_grants.yaml && grep -Fq 'manifest_subtree: k8s/keycloak-seed' grants/prod_promotion_grants.yaml
+          && grep -Fq 'manifest_ref: ad45e2cc1a8bbd0c4524e62783ee8fd84532e00c' grants/prod_promotion_grants.yaml
+          && grep -Fq 'rendered_digest: sha256:976ef4de626144f156a6a227c3b881066e07273476a5f19f00b96e6e454fad06'
+          grants/prod_promotion_grants.yaml && ! grep -Eq '^entries: \[\]$' grants/prod_promotion_grants.yaml
+  - id: "dod-omn18601-grant2-schema"
+    description: >-
+      The repo's own grant-schema suite passes against the STAGED registry: 44 tests across tests/test_prod_promotion_grants.py
+      and tests/test_prod_promotion_grants_manifest_kind.py, covering the OMN-18579 manifest-kind rules
+      this entry exercises — a manifest grant requires all four manifest fields and must NOT carry image_digest,
+      manifest_path must lie inside manifest_subtree segment-wise — plus the OMN-13424 at-rest invariant
+      that refuses any expired entry. The suite caught a real omission while this entry was being authored:
+      `reason` is a COMMON required field, and the entry was drafted without it. Stated plainly so the
+      suite is not over-read: this is a SCHEMA gate, not an authorization gate and not a proof the promotion
+      will succeed. It proves the entry is WELL-FORMED and of the kind it claims. The authority is the
+      CODEOWNERS-gated merge; the premise that the promotion can succeed is the two items below.
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          uv run pytest tests/test_prod_promotion_grants.py tests/test_prod_promotion_grants_manifest_kind.py
+          -q
+  - id: "dod-omn18601-grant2-admissible"
+    description: >-
+      THE CHECK WHOSE ABSENCE COST THE LAST DISPATCH, run before this one is authorized. Rendering k8s/keycloak-seed/overlays/prod
+      from a checkout of omninode_infra at the grant's own manifest_ref ad45e2cc yields exactly three
+      objects — ConfigMap seed-keycloak-desired-clients-4888bkdm6h, Job seed-keycloak-clients and InfisicalSecret
+      keycloak-reconcile-credentials, all in namespace onex-prod — and the one workload among them satisfies
+      every requirement PodSecurity `restricted` enforces per container: allowPrivilegeEscalation false,
+      capabilities.drop containing ALL, runAsNonRoot true, seccompProfile RuntimeDefault. FALSIFIABLE
+      IN THE USEFUL DIRECTION: the identical checker REFUSES the same Job at 8279e2ca, the ref the revoked
+      grant named, printing both absent field names and exiting 1. The digest recomputed at ad45e2cc with
+      omninode_infra's own scripts/manifest_promotion_render.py equals the rendered_digest this entry
+      declares, so identity and admissibility were measured on the same bytes. CROSS-REPO by construction
+      — the render needs an omninode_infra checkout the OCC runner does not have — so the hosted check
+      reads this receipt.
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' drift/dod_receipts/OMN-18601/dod-omn18601-grant2-admissible/command.yaml
+  - id: "dod-omn18601-grant2-premise-green"
+    description: >-
+      THE STABILITY PREMISE IS MET AT AUTHORING TIME, which the revoked grant's was not. promote-manifest
+      resolves a staging-apply receipt recorded AT the promoted commit and accepts it for at most 24 hours;
+      deploy-onex-staging run 35458357503, dispatched at ref main, recorded verdict=GREEN with sha=ad45e2cc1a8bbd0c4524e62783ee8fd84532e00c
+      and the applied mapping k8s/keycloak-seed/overlays/dev-system=k8s/keycloak-seed, so resolve_staging_apply
+      BINDS the subtree rather than reading SUBTREE_UNBOUND. Fresh until 2026-09-20T17:38:11Z. WHAT THIS
+      PREMISE DOES NOT PROVE, named rather than glossed: staging enforces no pod-security profile on any
+      of its namespaces, so a GREEN apply there says the overlay APPLIED, not that the Job RAN — it went
+      green for the revoked grant's manifest too, which production then refused. That is OMN-18764 and
+      it is open; the admissibility item above is what covers the gap for this dispatch, by hand, because
+      the gate cannot yet do it. CROSS-REPO by construction, as above.
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' drift/dod_receipts/OMN-18601/dod-omn18601-grant2-premise-green/command.yaml
+  - id: "dod-omn18601-grant2-author-identity"
+    description: >-
+      ANTI-SELF-APPROVAL, on the only surface this repo controls. The entry names approved_by jonahgabriel,
+      a real GitHub login rather than a placeholder, because omninode_infra's scripts/validate_prod_promotion_grant.py
+      enforces approved_by != requested_by against github.actor at dispatch time; a synthetic value would
+      compare unequal to EVERY dispatcher and would silently disable the only mechanical anti-self-approval
+      check on this path. This PR is authored by jake-b-omni, who is also the intended dispatcher, so
+      approved_by differs from both and each refusal is satisfied on its own terms. What this does NOT
+      claim: no file proves a human said the words behind approved_by. The CODEOWNERS-gated merge is that
+      act, and because grants/prod_promotion_grants.yaml is owned by @OmniNode-ai/platform-leads and GitHub
+      refuses an author's own approval, the only person who can land this is jonahgabriel. Like the values
+      item, this asserts STAGED state and inverts when the entry is pruned; the pruning PR re-points it
+      at its receipt.
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -Fq 'approved_by: jonahgabriel' grants/prod_promotion_grants.yaml && ! grep -Fq 'approved_by:
+          jake-b-omni' grants/prod_promotion_grants.yaml
diff --git a/drift/dod_receipts/OMN-18601/dod-omn18601-grant-revoked/command.yaml b/drift/dod_receipts/OMN-18601/dod-omn18601-grant-revoked/command.yaml
@@ -4,9 +4,9 @@ ticket_id: OMN-18601
 evidence_item_id: dod-omn18601-grant-revoked
 check_type: command
 check_value: |-
-  grep -Eq '^entries: \[\]$' grants/prod_promotion_grants.yaml
-contract_sha256: "sha256:42d15b4097240c36029c3c59d9b04896a7e533eb89a8da00b1ede768d61f5924"
-contract_entry_sha256: "sha256:961ff774a228a99224fc418e32521f01d0ce9a2ed237916f6dc698c951f145c1"
+  grep -q '^status: PASS$' drift/dod_receipts/OMN-18601/dod-omn18601-grant-revoked/command.yaml
+contract_sha256: "sha256:c3c6936bb2fb73f13c28691b63c8a71dfb9223d081bc6960073d38cfa33e6149"
+contract_entry_sha256: "sha256:602fcf833c73ccbfdfd03b9d15c50ecba557c86f883e0d08469243f2491a5740"
 status: PASS
 run_timestamp: '2026-09-18T23:51:27Z'
 commit_sha: 6c54c74f8c86c2d1ac5d1e7d21a78eba145e7e6e
@@ -56,3 +56,18 @@ actual_output: |-
   37bd8519, which has no occ_bindings support and therefore cannot see that file. pr_number here is the
   binding the pinned gate actually reads. The occ_bindings receipt stays in place and becomes the live
   path once that pin advances.
+
+  CHECK RE-POINTED AT THIS RECEIPT BY OCC#10454, with the measurement above unchanged. This item's
+  check_value was `grep -Eq` for an empty entries list on the live registry -- an assertion about registry
+  STATE. OCC#10454 stages the replacement grant-aeae215d, so that assertion stops holding the moment a
+  new authorization is written, which is the registry working rather than a regression. The removal this
+  receipt evidences is unchanged and still true: grant-90f8e729 was removed, measured at 6c54c74f8 with
+  a control that inverted, and it has not returned -- a search for that grant id finds only the revocation
+  header that names it on purpose. What is asserted is therefore narrower and exact: the revocation WAS
+  measured, at 6c54c74f8, not that the file is at rest now -- it deliberately is not.
+
+  THE PATTERN, SO THE NEXT AUTHOR DOES NOT REDISCOVER IT. Every item on this contract that asserts
+  registry STATE inverts when that state legitimately changes, and there are now two directions of it:
+  the staged-state items inverted when OCC#10302 revoked, and this at-rest item inverted when OCC#10454
+  re-staged. The remedy each time is the same, and it is not a workaround -- move the check to the receipt
+  that holds the measurement and its control, and narrow the description to what is actually claimed.
diff --git a/drift/dod_receipts/OMN-18601/dod-omn18601-grant2-admissible/command.yaml b/drift/dod_receipts/OMN-18601/dod-omn18601-grant2-admissible/command.yaml
@@ -0,0 +1,73 @@
+---
+schema_version: "1.0.0"
+ticket_id: OMN-18601
+evidence_item_id: dod-omn18601-grant2-admissible
+check_type: command
+check_value: |-
+  grep -q '^status: PASS$' drift/dod_receipts/OMN-18601/dod-omn18601-grant2-admissible/command.yaml
+contract_sha256: "sha256:8a0128be269e5a8ad1c302b7201189379fce665ecd0f473304badccbf076d057"
+contract_entry_sha256: "sha256:a4e140a52848b4139937df3e00997ec129e4c15afc7ec895f2b8f9327672a120"
+status: PASS
+run_timestamp: '2026-09-19T17:52:40Z'
+commit_sha: 16a3db81400f7d7f1096ebdb46c56a90f8b14883
+runner: occ-grant2-admissibility-lane
+verifier: occ-grant2-admissibility-verifier
+probe_command: |-
+  # Run in a checkout of repos/OmniNode-ai/omninode_infra detached at the grant's own manifest_ref,
+  # repos/OmniNode-ai/omninode_infra/commits/ad45e2cc1a8bbd0c4524e62783ee8fd84532e00c, which is that
+  # repository's main head after omninode_infra#1580 merged at 2026-09-19T17:30:13Z.
+  #
+  # The checker renders the overlay with `kubectl kustomize` and asserts, per container, the four
+  # requirements PodSecurity `restricted` enforces.
+  python3 check_admissible.py k8s/keycloak-seed/overlays/prod   # at ad45e2cc
+  # CONTROL, the SAME checker at the ref the revoked grant named:
+  python3 check_admissible.py k8s/keycloak-seed/overlays/prod   # at 8279e2ca
+  # Identity, recomputed on the same bytes with that repo's own renderer:
+  python3 -c "... manifest_promotion_render.rendered_digest(load_documents(kubectl kustomize ...)) ..."
+probe_stdout: |-
+  # at ad45e2cc (the grant's manifest_ref)
+  k8s/keycloak-seed/overlays/prod: 3 object(s), 1 workload(s)
+    [OK] Job/seed-keycloak-clients admits under restricted
+  exit=0
+
+  # CONTROL at 8279e2ca (the revoked grant's manifest_ref), same checker
+  k8s/keycloak-seed/overlays/prod: 3 object(s), 1 workload(s)
+    [X] Job/seed-keycloak-clients would be REFUSED by restricted:
+          - seed-keycloak-clients: allowPrivilegeEscalation must be false (got ABSENT)
+          - seed-keycloak-clients: capabilities.drop must include ALL (got ABSENT)
+  exit=1
+
+  # Identity on the same bytes, at ad45e2cc
+  objects: 3
+     v1 ConfigMap seed-keycloak-desired-clients-4888bkdm6h ns=onex-prod
+     batch/v1 Job seed-keycloak-clients ns=onex-prod
+     secrets.infisical.com/v1alpha1 InfisicalSecret keycloak-reconcile-credentials ns=onex-prod
+  rendered_digest: sha256:976ef4de626144f156a6a227c3b881066e07273476a5f19f00b96e6e454fad06
+
+  # Declared blast radius, resolved transitively
+  kustomization tree (6 files):
+     k8s/keycloak-seed/base/kustomization.yaml
+     k8s/keycloak-seed/base/seed-keycloak-clients-job.yaml
+     k8s/keycloak-seed/overlays/prod/keycloak-reconcile-infisical-secret.yaml
+     k8s/keycloak-seed/overlays/prod/kustomization.yaml
+     k8s/keycloak-seed/overlays/prod/patch-credentials.yaml
+     k8s/keycloak-seed/overlays/prod/patch-environment.yaml
+actual_output: |-
+  PASS, and the control is what makes it a measurement. The same checker REFUSES the same Job at 8279e2ca,
+  naming both absent fields, and ADMITS it at ad45e2cc. A checker that was silently broken would have
+  admitted BOTH refs; it did not. This is the question the 2026-09-18T20:32Z dispatch never asked: run
+  35392020746 satisfied every identity premise, applied all three objects to onex-prod with a live
+  readback, and then Job seed-keycloak-clients reached DeadlineExceeded at 22:06Z having created ZERO
+  pods, with ten FailedCreate events naming exactly the two fields above.
+
+  IDENTITY AND ADMISSIBILITY WERE MEASURED ON THE SAME BYTES. The digest recomputed at ad45e2cc equals
+  the rendered_digest this entry declares, so the tree proven admissible is the tree the grant authorizes
+  rather than a neighbouring one. The declared manifest_subtree k8s/keycloak-seed is wider than
+  manifest_path because the overlay's kustomization names ../../base: the transitive tree is six files
+  spanning both directories, and a subtree equal to manifest_path would refuse the very overlay this
+  grant kind exists to authorize.
+
+  WHAT THIS DOES NOT CLAIM. The rendered pod template is ADMISSIBLE; whether the Job then does its
+  seeding work is answered only by a real run. The general defect — that the gate's stability premise
+  proves an overlay APPLIED rather than RAN — is OMN-18764 and stays open. This item covers that gap by
+  hand for this one dispatch, which is the honest description of it.
diff --git a/drift/dod_receipts/OMN-18601/dod-omn18601-grant2-author-identity/command.yaml b/drift/dod_receipts/OMN-18601/dod-omn18601-grant2-author-identity/command.yaml
@@ -0,0 +1,51 @@
+---
+schema_version: "1.0.0"
+ticket_id: OMN-18601
+evidence_item_id: dod-omn18601-grant2-author-identity
+check_type: command
+check_value: |-
+  grep -Fq 'approved_by: jonahgabriel' grants/prod_promotion_grants.yaml && ! grep -Fq 'approved_by: jake-b-omni' grants/prod_promotion_grants.yaml
+contract_sha256: "sha256:8a0128be269e5a8ad1c302b7201189379fce665ecd0f473304badccbf076d057"
+contract_entry_sha256: "sha256:cf70923a19b935b4d6bc1e9dae2ea181ced079249e4522101e2905f9739532e6"
+status: PASS
+run_timestamp: '2026-09-19T17:52:40Z'
+commit_sha: 16a3db81400f7d7f1096ebdb46c56a90f8b14883
+runner: occ-grant2-identity-lane
+verifier: occ-grant2-identity-verifier
+probe_command: |-
+  grep -Fq 'approved_by: jonahgabriel' grants/prod_promotion_grants.yaml
+  ! grep -Fq 'approved_by: jake-b-omni' grants/prod_promotion_grants.yaml
+  gh api user --jq .login                       # the authoring identity
+  gh api repos/OmniNode-ai/onex_change_control/branches/main/protection \
+    --jq '.required_pull_request_reviews.require_code_owner_reviews,
+          .required_pull_request_reviews.required_approving_review_count,
+          .enforce_admins.enabled'
+  gh api repos/OmniNode-ai/onex_change_control/contents/.github/CODEOWNERS | grep prod_promotion
+probe_stdout: |-
+  approved_by: jonahgabriel        present   exit=0
+  approved_by: jake-b-omni         absent    exit=0 (negated)
+  gh api user --jq .login          jake-b-omni
+
+  require_code_owner_reviews       true
+  required_approving_review_count  0
+  enforce_admins                   true
+  CODEOWNERS  grants/prod_promotion_grants.yaml @OmniNode-ai/platform-leads
+
+  approved_by (jonahgabriel) != PR author (jake-b-omni)           -> authoring-time check satisfied
+  approved_by (jonahgabriel) != intended dispatcher (jake-b-omni) -> dispatch-time check satisfied
+actual_output: |-
+  PASS. approved_by names a real GitHub login rather than a placeholder, which matters mechanically: the
+  consumer enforces approved_by != requested_by against github.actor, so a synthetic value would compare
+  unequal to EVERY dispatcher and would silently disable the only mechanical anti-self-approval check on
+  this path. It differs from both the PR author and the intended dispatcher, so the authoring-time refusal
+  in this repository and the dispatch-time refusal in omninode_infra are each satisfied on their own terms
+  rather than by assertion.
+
+  WHO CAN LAND THIS, measured rather than assumed. main requires code-owner review with admins enforced,
+  and CODEOWNERS assigns grants/prod_promotion_grants.yaml to @OmniNode-ai/platform-leads, whose members
+  are jonahgabriel and jake-b-omni. GitHub refuses an approving review on one's own pull request, so the
+  only person who can approve this PR is jonahgabriel. That is the property the registry exists to have:
+  the author of an authorization is structurally barred from blessing it.
+
+  WHAT THIS DOES NOT CLAIM: no file anywhere proves a human said the words behind approved_by. The
+  CODEOWNERS-gated merge is that act, which is why this PR must be landed by a person.