[onexbot-occ-writer]

Summary

Binds AC1 and AC4 of OMN-15359 to checks that can fail. contracts/OMN-15359.yaml carried 28 evidence items and no binds_ac. The ticket's acceptance bullets carried no AC labels, so the binding gate could see none of its criteria (criteria_by_label returned []). The five bullets have now been labelled AC1–AC5 in the ticket, with no other text changed. AC2, AC3 and AC5 are not bound here.

What changed

Append-only, in contracts/OMN-15359.yaml plus one new receipt per item under drift/dod_receipts/OMN-15359/:

• AC1: ac1-omninode-internal-relation-family-record (command).

  • It reads reference/omninode-internal-relation-family.md from knowledge-base-internal main. That page is the transformation receipt AC1 names: knowledge-base-internal#441, regenerated after the original was deleted by the OMN-16607 scrub.
  • It asserts the page still carries owner, domain, migration stream, and the per-relation producer/consumer table.
  • It binds the one family this ticket built. tenant and platform_catalog were descoped to OMN-17887 on 2026-09-04, and the item says so.

• AC4: ac4-internal-no-tenant-guc-tenant-roles-denied (command, local_done_gate). It is a live READ ONLY query on the .201 dev lane (omnidash_analytics) and passes only when all of these hold:

  • every base table in omninode_internal has row-level security off;
  • the schema has zero pg_policy rows;
  • tenant_projection_writer can SELECT none of them;
  • the table count is non-zero.

  This matches how the 2026-09-04 and 2026-09-05 adjudications scored AC4. It is local_done_gate (OMN-15392) because hosted CI has no ssh to the lab host.

Deliberately not done:

• No merged item or receipt is edited.
• No product code, migration, grant or lane write.
• AC2 waits on OMN-17886 (grants and owners reconciliation) and AC3 on OMN-17887 (the build-or-retire ruling).

How it was verified

• AC1: the parsed check exits 0 against knowledge-base-internal main a9aa611f (2026-09-24T08:24:05Z). Negative control: a heading the page does not carry exits 1.
• AC4: AC4-OK 18 at 2026-09-24T08:22:36Z; the parsed check exits 0 at 08:24:05Z. The runtime image on the lane is at omnibase_infra 5a7aa99e. Negative controls:
  • the identical predicate on public reads AC4-FAIL (11 RLS tables, 12 policies, 16 readable by the tenant writer) and the check exits 1;
  • on a schema that does not exist it reads AC4-FAIL with n=0.
• Hosted Acceptance-Criterion Binding Gate (OMN-18236): run locally with the newly labelled ticket text, it gives 0 refusals.
• Pre-commit on the changed files: 27 passed, 0 failed, including Receipt Hardening, Receipt Honesty and OMN-18304 per-entry re-verification.
• Receipts: every check_value, per-entry hash and probe command matches the parsed contract after yamlfmt, with 0 mismatches.
• Append-only: 0 deleted lines.
• Signatures: the lane's commit is SSH-signed and verified. The structural self-bind commit is onexbot-occ-writer[bot]'s own mint (OMN-18921) and is unsigned, the same shape onex_change_control#10904 and evidence(OMN-17422): bind AC1-AC5 to checks that can fail #11019 merged with. It is not rewritten.

Local gates

• No gate was bypassed — no --no-verify, no SKIP=, no --no-gpg-sign, no core.hooksPath override. Every pre-commit and pre-push hook ran.
• Any hook that failed was fixed at the input, not worked around. Contract YAML validation refused an evidence id over 50 characters; the id was shortened. The skip-token hook needs Bash 4+; it was run under Homebrew bash 5.3 on PATH rather than skipped.

Not in this change

• AC5 is not bound. The handoff exists (knowledge-base-internal#116) and the ticket thread records it as cited on all five successor tickets. But the binding gate classifies AC5 as a live criterion, because its text contains "no live workload cutover". A document read would be refused as static evidence, and a check that reads the successor tickets needs Linear access this lane does not have.
• AC2 and AC3, as above.
• Ticket status is left to the closer and the operator.

[Patel230]

Close-out. Merged 2026-09-24T09:33:43Z as 3fb2710924 by jonahgabriel, for OMN-15359. Two commits, squashed: mine (8d6ad7b8f8) and the writer App's self-bind mint (167b73ec5b).

In short: there are no review comments to answer. The PR has no reviews, no inline comments and no issue comments (read 2026-09-27T18:48Z). The AC1 binding still stands and passes today. The AC4 binding was wrong, and I retired it the same day in onex_change_control#11061.

What it bound

It appended two items to contracts/OMN-15359.yaml (L402-452 at 3fb2710924) and removed nothing.

• AC1, ac1-omninode-internal-relation-family-record (L402-425, binds_ac at L415). It reads reference/omninode-internal-relation-family.md from knowledge-base-internal main, which is not pinned to a sha. It fails if the page loses its owner, domain or migration-stream rows, the per-relation producer/consumer table, or the consumer-set heading.
• AC4, ac4-internal-no-tenant-guc-tenant-roles-denied (L426-452, binds_ac at L440, local_done_gate). It runs a read-only query on the .201 lane. The query requires RLS off on every omninode_internal base table, zero policies, no SELECT for tenant_projection_writer, and a non-zero table count.

How it was verified

• CI on the final head 167b73ec5b: 89 check runs succeeded and 7 were skipped (the same autobind, companion and provenance jobs as on the other evidence PRs). The main CI run 35976845112 succeeded, including the Acceptance-Criterion Binding Gate and the Receipt Honesty Gate. Both Receipt Gate runs succeeded (35976844515, 35977090866).
• The AC1 and AC4 runs and their negative controls, as described in the PR, were local runs. The AC labels I added to the ticket text are on Linear. Neither is shown by GitHub, so both are not verified here.

What happened to these bindings since

• AC4 was my mistake. Its check reached .201 through onex-201, an ssh alias that exists only on my laptop. It could not run where the closer runs. onex_change_control#11061 re-issued it with the identical predicate on the fleet host form and retired this item with supersedes_ac_binding (L469 at 73032e439e). This item stays in the contract for audit. The autoclose sweep failure (2026-09-24T10:23:58Z, "Could not resolve hostname onex-201") is recorded in that item's description, but the sweep comment itself is on Linear and not verified here.
• AC1 still passes. I re-ran the check from the dev contract at 2026-09-27T18:45:17Z. It exits 0 and prints its PASS line. The first 452 lines of the contract on dev (5d86da6b84) are byte-identical to this merge.

Thank you!