evidence(OMN-17422): bind AC1-AC5 to checks that can fail

[onexbot-occ-writer]

Summary

Binds all five acceptance criteria of OMN-17422 to checks that can fail. contracts/OMN-17422.yaml had 12 evidence items and no binds_ac, so the Beta board showed every criterion unmet although the work is merged.

What changed

Append-only against dev, in contracts/OMN-17422.yaml, with one new receipt per item under drift/dod_receipts/OMN-17422/:

• AC1: ac1-option-a-writer-binds-recorded-tenant (test_passes, local_done_gate).
  • The item cites the ruling recorded before code: option (a), Jonah Gray, 2026-09-01, comment 2e544ded, including what isolation it still buys.
  • It runs the writer's own behaviour tests from omnibase_infra#3088 (-k 'unbound or recorded_write_scope'). They cover four behaviours:
    • The unbound write is scoped to the recorded tenant on every tenant-GUC relation.
    • A tenant-less or blank row opens no scope.
    • No tenant is ever invented.
    • The scope rolls back and never leaks.
• AC2: ac2-real-force-rls-dispatch-not-refused (command, local_done_gate).
  • It runs the five TestRealPostgresRlsRefusesTheUnboundWriteAndAcceptsTheBoundOne tests from omnimarket#2807 against a real Postgres.
  • It passes only when pytest's last line starts with 5 passed, so a run with no database (skips) is red.
• AC3: ac3-live-delegation-lands-row-dlq-clean (command).
  • It covers one delegation on the .201 dev lane through the chain-canary workflow, omnibase_infra run 35966603205.
  • The check re-reads the run's conclusion from the API, then the recorded read-only readback.
• AC4: ac4-guc-parity-covers-every-tenant-relation (test_passes) runs the contract-derived parity suite (omnibase_infra#4004).
• AC5: two items.
  • Behaviour: ac5-guc-parity-ratchet-incident-replay replays the real 0027 bytes (rejected) and the 0043 remedy (accepted).
  • Enforcement: ac5-guc-parity-ratchet-wired-in-ci asserts the ratchet runs in omnibase_infra dev CI.

local_done_gate (OMN-15392) is declared where the hosted gate cannot run the check: it checks out neither omnibase_infra nor a Postgres.

Deliberately not done: no merged item or receipt is edited, and no product code, migration, role or deploy is changed.

Follow-up in this PR: the AC1 refusal

The first version bound AC1 to a grep of handler_wiring.py. The hosted Acceptance-Criterion Binding Gate (OMN-18236) refused it in run 35957942675 with ac_binding_static_evidence_on_live_criterion: a grep proves the code was written, not that the writer does anything.

That refusal is correct. AC1 now runs the behaviour tests instead. The local pre-commit run had passed only because it had no ticket text. The gate now returns 0 refusals when run locally with the ticket's AC text.

How it was verified

• AC1: 26 passed at omnibase_infra origin/dev 26ed39800f1a2028ba0026ba386453246767b716 (2026-09-24T06:43:36Z). Both files are unchanged at origin/dev 370adc5e. RED control: with _statement_tenant_scope's unbound branch reverted to the pre-fix return None, 18 of 26 fail. The file was restored byte-identical.
• AC2: 5 passed in 4.10s at omnimarket origin/dev 923b76baef5c013cefb79989f3f7d6626a2ad18c, against a disposable local Postgres 16.15 (06:40:28Z). The exact parsed check exits 0 against it (06:57:28Z) and exits 1 with credentials unset (5 skipped). The same five tests PASSED in omnimarket CI run 35868014833, split 10/20.
• AC3: read back out of Postgres inside a READ ONLY transaction.
  • The run concluded success, PROBE-GREEN 5/5 links.
  • Exactly one row changed during the run: tenant 820272f9-4aaf-5add-a2df-0af942852ab2, correlation id fcdb0f37-2819-40cc-b496-6c176418bc6d, captured 06:52:49Z inside the job window (06:52:12–06:53:03Z). The id is present in recent_responses, and one row carries it. An absent id reads false.
  • DLQ onex.dlq.omnimarket.projection-delegation-inference-response-malformed.v1: high watermark 1028 before (06:50:55Z) and 1028 after (06:53:43Z). Zero new entries.
  • The check exits 0. It exits 1 with one receipt field altered, and exits 1 against a scheduled run id.
• AC4 and AC5: unchanged from the first push. 19 passed and 4 passed at 26ed3980; the wiring check exits 0, and an unwired name exits 1.
• Pre-commit on the changed files: 27 passed, 0 failed, including the Acceptance-Criterion Binding Gate, Receipt Hardening, Receipt Honesty, and OMN-18304 per-entry re-verification. Every receipt's check_value, per-entry hash and probe command was compared with the parsed contract after yamlfmt: 0 mismatches.
• Append-only: against the merge base, 0 deleted lines. The only removed lines are this PR's own first AC1 text and its superseded receipt.
• Structural self-bind: re-minted against the new contract bytes with scripts/ci/mint_occ_self_bind.py --write. The eligibility verdict reads eligible.
• Earlier follow-up: the piped grep -q that failed Contract Compliance with exit 141 on the OMN-17374 companion was also fixed here; every piped check reads to end of input.
• Signatures: every commit authored on this branch by the lane is SSH-signed and verified. The one unsigned commit is onexbot-occ-writer[bot]'s own self-bind mint (OMN-18921), the same shape onex_change_control#10904 carried and merged with. It cannot be signed without rewriting the branch, which is not done.

Local gates

• No gate was bypassed — no --no-verify, no SKIP=, no --no-gpg-sign, no core.hooksPath override. Every pre-commit and pre-push hook ran.
• Any hook that failed was fixed at the input, not worked around. The skip-token hook needs Bash 4+; it was run under Homebrew bash 5.3 on PATH rather than skipped.

Not in this change

• The AC3 row is overwritten later. The table is a per-tenant singleton, so a later delegation overwrites latest_*. The readback is recorded in the receipt, and the re-checkable half is the run's conclusion.
• AC2 needs a database at the Done gate. It needs INTEGRATION_POSTGRES_* wherever the Done gate runs; without it the check is red, never falsely green.
• Ticket status is left to the closer and the operator.

[Patel230]

Close-out. Merged 2026-09-24T08:02:21Z as dfc4b14b, for OMN-17422. No review comments. Two hosted checks failed along the way, and both were fixed before merge. Contract Compliance failed on piped greps that exited 141, fixed in d33fabc6cc. The Acceptance-Criterion Binding Gate refused the first AC1 binding, a grep, in run 35957942675. The gate was right, and AC1 was rebound to the behaviour tests, as the description says.

Since merge:

• OMN-17422 closed as Done on 2026-09-26T13:14:57Z. The six binds_ac items from this PR are on dev unchanged; the only later change to contracts/OMN-17422.yaml is the bot's autobind for omnibase_infra#4112, appended after them (read at 2af1fbd4bf).
• The closing re-run on OMN-17422, on omnibase_infra dev 90f79b29e9 on 2026-09-26: AC1's selection 26 passed, AC4 and AC5 25 passed. AC2 (needs INTEGRATION_POSTGRES_*) and AC3 (a recorded live receipt) weren't re-run.
• The limit I noted on the ticket, that AC2's bound test drives the async runner and not the kernel handler_wiring path, is closed at source by omnibase_infra#4112 (merged 2026-09-25 as 6ccfacb6, kernel-path real-Postgres suite 16 passed). onex_change_control#11470 binds that suite to AC2 and is still open (read at 13:56Z).

Thank you!