[onexbot-occ-writer]

Summary

Binds the kernel-path real-Postgres RLS proof from omnibase_infra#4112 to AC2 of OMN-17422. AC2's existing item drives the async projection runner. This one drives the runtime's own handler_wiring adapter, which is the gap the 2026-09-18 comment on the ticket pointed out.

What changed

• contracts/OMN-17422.yaml: appends ac2-kernel-path-real-force-rls (binds_ac: ["AC2"], execution_scope: local_done_gate). It runs tests/integration/db/test_projection_writer_tenant_rls_omn15301.py in omnibase_infra, and it passes only when pytest's last line is 16 passed in <n>s. A run with no initdb skips, so it is red.
• drift/dod_receipts/OMN-17422/ac2-kernel-path-real-force-rls/command.yaml: the matching receipt, pinned to omnibase_infra 83f3a9976d556a7d2bebf9fb0626d61cc7c24a2b.
• Append-only. No existing item or receipt is edited.

How it was verified

• The receipt records its run: 2026-09-26T05:12:01Z, omnibase_infra dev 83f3a997, ephemeral PostgreSQL 16, 16 passed in 2.47s, exit 0. With _INITDB = None the check exited 1. Test file sha256 b1f07df1d49f248a8ef3ce628df0f73f9c234b6200513a0918fc9ff60cd7c514.
• Re-run 2026-09-26T12:45:25Z on a fresh clone of omnibase_infra dev 5854200e, 10 commits after 83f3a997. The test file is unchanged since omnibase_infra#4112 merged as 6ccfacb6 (same sha256). Result: 16 passed in 1.58s, exit 0. Negative control on the same clone with _INITDB = None: 1 skipped in 0.15s, exit 1, and the file was restored byte-identical.
• Pre-commit on this patch applied to onex_change_control dev 08129a54: 27 passed, 34 skipped, 0 failed. That includes the Receipt Hardening Gate, the Acceptance-Criterion Binding Gate and the check that re-verifies every per-entry binding a contract change moves.

Local gates

• No gate was bypassed — no --no-verify, no SKIP=, no --no-gpg-sign, no core.hooksPath override. Every pre-commit and pre-push hook ran.
• Any hook that failed was fixed at the input, not worked around.

Not in this change

• Hosted CI can't run this check, because the runners have no initdb. That's why the item is local_done_gate. Running it in hosted CI is a separate change.
• No product code, and no change to the ticket's state.

[Patel230]

Close-out. Merged 2026-09-26T13:58:16Z as 628c1d1c, for OMN-17422, with 89 checks passing and 7 skipped. No review comments to answer.

What it adds: ac2-kernel-path-real-force-rls binds AC2 to the kernel-path real-Postgres suite from omnibase_infra#4112, as a local Done-gate check that passes only on 16 passed, so a run without initdb is red rather than a skip. That closes the limit I noted on onex_change_control#11019: AC2's first binding drove the async runner, not the kernel handler_wiring path. The receipt records 16 passed at omnibase_infra 83f3a997, and the closing re-run on OMN-17422 got 16 passed on 90f79b29e9. Append-only; no existing item or receipt changed.

Still open, as on the ticket: hosted CI skips this suite, so it runs only by hand or at the local Done gate.

Thank you!