evidence(OMN-17422): bind the kernel-path FORCE RLS proof to AC2

contracts/OMN-17422.yaml

@@ -236,3 +236,21 @@ dod_evidence:
     checks:
       - check_type: "command"
         check_value: "gh pr view 11251 --repo OmniNode-ai/onex_change_control --json number,state"
+  - id: "ac2-kernel-path-real-force-rls"
+    description: >-
+      AC2 kernel-path binding. The runtime's own projection adapter is exercised against disposable PostgreSQL
+      16 with FORCE ROW LEVEL SECURITY and NOBYPASSRLS roles by tests/integration/db/test_projection_writer_tenant_rls_omn15301.py
+      in omnibase_infra. At origin/dev 83f3a9976d556a7d2bebf9fb0626d61cc7c24a2b on 2026-09-26, all 16
+      cases passed. A reversible control setting _INITDB to None made this exact check exit 1; the source
+      was restored byte-identically (sha256 b1f07df1d49f248a8ef3ce628df0f73f9c234b6200513a0918fc9ff60cd7c514).
+      The --no-sync flag prevents this local Done gate from modifying the read-only clone's environment.
+      Hosted runners do not provide initdb, so this is a local_done_gate item.
+    source: "manual"
+    execution_scope: "local_done_gate"
+    binds_ac: ["AC2"]
+    checks:
+      - check_type: "command"
+        check_value: >-
+          bash -o pipefail -c 'uv run --no-sync pytest tests/integration/db/test_projection_writer_tenant_rls_omn15301.py
+          -q 2>&1 | tail -n 1 | grep -E "^16 passed in [0-9.]+s$"'
+        cwd: "${OMNI_HOME}/omnibase_infra"

drift/dod_receipts/OMN-17422/ac2-kernel-path-real-force-rls/command.yaml

@@ -0,0 +1,29 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-17422"
+evidence_item_id: "ac2-kernel-path-real-force-rls"
+check_type: "command"
+check_value: >-
+  bash -o pipefail -c 'uv run --no-sync pytest tests/integration/db/test_projection_writer_tenant_rls_omn15301.py
+  -q 2>&1 | tail -n 1 | grep -E "^16 passed in [0-9.]+s$"'
+contract_entry_sha256: "sha256:6f893af393cc006aad0520f83d09119b05bc5e520bcd47eaedd06c10d84991d2"
+status: "PASS"
+run_timestamp: "2026-09-26T05:12:01Z"
+commit_sha: "83f3a9976d556a7d2bebf9fb0626d61cc7c24a2b"
+runner: "occ-manual-receipt-check"
+verifier: "codex-01a0db8f (local PostgreSQL 16 run at omnibase_infra origin/dev)"
+probe_command: >-
+  gh api repos/OmniNode-ai/omnibase_infra/commits/83f3a9976d556a7d2bebf9fb0626d61cc7c24a2b --jq .sha &&
+  bash -o pipefail -c 'uv run --no-sync pytest tests/integration/db/test_projection_writer_tenant_rls_omn15301.py
+  -q 2>&1 | tail -n 1 | grep -E "^16 passed in [0-9.]+s$"'
+probe_stdout: "16 passed in 2.47s"
+actual_output: |-
+  repository: OmniNode-ai/omnibase_infra
+  ref: origin/dev 83f3a9976d556a7d2bebf9fb0626d61cc7c24a2b
+  ac_binding: AC2
+  postgres: PostgreSQL 16 (ephemeral local instance)
+  positive_result: 16 passed in 2.47s, check exit 0
+  negative_control_no_initdb: _INITDB set to None, check exit 1
+  restored_test_sha256: b1f07df1d49f248a8ef3ce628df0f73f9c234b6200513a0918fc9ff60cd7c514
+exit_code: 0
+pr_number: 4112

drift/occ_bindings/OMN-17422/occ-self-bind-pr-11470/command.yaml

@@ -0,0 +1,18 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-17422"
+evidence_item_id: "occ-self-bind-pr-11470"
+check_type: "command"
+check_value: "gh pr view 11470 --repo OmniNode-ai/onex_change_control --json number,state,headRefName"
+contract_sha256: "sha256:e7b8be5083537c44843f784125635ec6eef2fd56838b440d49318f21a5c02293"
+status: PASS
+run_timestamp: "2026-09-26T13:06:54Z"
+commit_sha: "e753f5afc10212dd60105c9893315803255c3b1f"
+runner: "occ-self-bind-mint"
+verifier: "github-pr-readback"
+probe_command: "gh pr view 11470 --repo OmniNode-ai/onex_change_control --json number,state,headRefName"
+probe_stdout: |
+  {"headRefName":"lakshman/OMN-17422-kernel-ac2-local-gate","number":11470,"state":"OPEN"}
+exit_code: 0
+pr_number: 11470
+branch: "lakshman/OMN-17422-kernel-ac2-local-gate"