evidence(OMN-11423): hash-bind deploy-gate receipts

[jonahgabriel]

Summary

• Adds the required contract_sha256 binding to all OMN-11423 DoD receipts.
• Uses sha256:6a13b912c1f2d84d59360e241a28faddde386e8e23cc1568dbfb21104f638d4f, the current hash of contracts/OMN-11423.yaml after binding the OCC self receipt to PR 1298.
• Fixes merge-group Receipt Gate failure on omniclaude#1627.

Verification

• LC_ALL=C shasum -a 256 contracts/OMN-11423.yaml -> 6a13b912c1f2d84d59360e241a28faddde386e8e23cc1568dbfb21104f638d4f
• uv run validate-yaml contracts/OMN-11423.yaml
• CONTRACT_REPO_DIR=$PWD uv run python scripts/ci/run_contract_compliance_check.py --pr 1627 --repo OmniNode-ai/omniclaude --contracts-dir contracts -> OMN-11423: 4/4 PASS, 0 WARN, 0 BLOCK

Evidence-Ticket: OMN-11423

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds contract_sha256 to multiple OMN-11423 evidence command.yaml records; updates dod-occ-self receipt metadata (branch/PR/commit/working_dir and probe output) and aligns contracts/OMN-11423.yaml to expect pr_number: 1298.

Changes

OMN-11423 Evidence & Contract Updates

Layer / File(s)	Summary
Add contract_sha256 to evidence records drift/dod_receipts/OMN-11423/dod-ci-surface/command.yaml, drift/dod_receipts/OMN-11423/dod-deploy-gate-proof/command.yaml, drift/dod_receipts/OMN-11423/dod-omniclaude-pr-1627/command.yaml	Inserted a contract_sha256: "sha256:6a13b912c1f2d84d59360e241a28faddde386e8e23cc1568dbfb21104f638d4f" metadata entry into each listed evidence command.yaml. No other fields changed.
Update OCC self receipt and contract gate drift/dod_receipts/OMN-11423/dod-occ-self/command.yaml, contracts/OMN-11423.yaml	dod-occ-self receipt: switched GitHub PR/branch/commit/working_dir references, updated probe_stdout headRefOid and actual_output, and added the same contract_sha256 field. contracts/OMN-11423.yaml: changed dod-occ-self gate validation to expect pr_number: 1298 (was 1295).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• OmniNode-ai/onex_change_control#980: Similar updates adding/refreshing contract_sha256 in command.yaml evidence records.
• OmniNode-ai/onex_change_control#1003: Adds/updates contract_sha256 in DoD receipt YAMLs for a different ticket.
• OmniNode-ai/onex_change_control#973: Modifies drift/dod_receipts/*/command.yaml by adding/updating contract_sha256 fields.

Poem

🐰 A little rabbit hops with cheer,
Four receipts now hold a hash so clear,
PRs and probes all lined in row,
SHA-256 makes the evidence glow,
Hooray for verifications — hop, hooray!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'evidence(OMN-11423): hash-bind deploy-gate receipts' directly and clearly reflects the main change: adding contract_sha256 hash bindings to deployment gate receipts for ticket OMN-11423.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-11423-receipt-contract-hash

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@drift/dod_receipts/OMN-11423/dod-ci-surface/command.yaml`:
- Line 7: The contract_sha256 value is incorrect; update the contract_sha256
entry to the required hash by replacing
"sha256:6a13b912c1f2d84d59360e241a28faddde386e8e23cc1568dbfb21104f638d4f" with
the correct
"sha256:53cbe870e016338d948fcbbb346500fa71612d4afe8b7f73c484630036290c72" so the
receipt binds to the PR's required contract.

In `@drift/dod_receipts/OMN-11423/dod-omniclaude-pr-1627/command.yaml`:
- Line 7: Update the contract_sha256 value in the command.yaml to match the PR's
declared contract digest: replace the current contract_sha256
"sha256:6a13b912c1f2d84d59360e241a28faddde386e8e23cc1568dbfb21104f638d4f" with
the correct
"sha256:53cbe870e016338d948fcbbb346500fa71612d4afe8b7f73c484630036290c72" so the
receipt is bound to the correct contract digest.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 36f7d7bc-4491-4c5b-838e-2626890289b5

📥 Commits

Reviewing files that changed from the base of the PR and between 25dd692 and cc19409.

📒 Files selected for processing (5)

• contracts/OMN-11423.yaml
• drift/dod_receipts/OMN-11423/dod-ci-surface/command.yaml
• drift/dod_receipts/OMN-11423/dod-deploy-gate-proof/command.yaml
• drift/dod_receipts/OMN-11423/dod-occ-self/command.yaml
• drift/dod_receipts/OMN-11423/dod-omniclaude-pr-1627/command.yaml

✅ Files skipped from review due to trivial changes (2)

• drift/dod_receipts/OMN-11423/dod-occ-self/command.yaml
• drift/dod_receipts/OMN-11423/dod-deploy-gate-proof/command.yaml