chore(OMN-12403): auto-ship rescue of uncommitted canonical onex_change_control work

.github/workflows/main-target-guard.yml

@@ -0,0 +1,80 @@
+# SPDX-FileCopyrightText: 2026 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# OMN-12243: Block PRs targeting main unless they are promotion PRs
+# from dev with a promotion receipt, or hotfix PRs with evidence and
+# a backmerge link.
+
+name: Main target guard
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+jobs:
+  main-target-guard:
+    name: main-target-guard
+    runs-on: >-
+      ${{
+        (github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 5
+
+    steps:
+      - name: Check PR target branch
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          set -euo pipefail
+
+          if [[ "${BASE_REF}" != "main" ]]; then
+            echo "::notice::PR targets '${BASE_REF}', not main; guard does not apply."
+            exit 0
+          fi
+
+          echo "PR targets main. Checking head ref: '${HEAD_REF}'"
+
+          if [[ "${HEAD_REF}" == "dev" ]]; then
+            if echo "${PR_BODY}" | grep -qE 'promotion-receipt:[[:space:]]*OCC-[0-9]+'; then
+              echo "::notice::Promotion PR from dev with valid promotion-receipt. Allowed."
+              exit 0
+            fi
+
+            echo "::error::PR is from dev but is missing a promotion receipt."
+            echo "::error::Add a line matching: promotion-receipt: OCC-<number>"
+            echo "::error::Retarget this PR to dev; main accepts only promotion or hotfix PRs."
+            exit 1
+          fi
+
+          if [[ "${HEAD_REF}" == hotfix/* ]]; then
+            MISSING=()
+
+            if ! echo "${PR_BODY}" | grep -qE 'hotfix-evidence:[[:space:]]*OCC-[0-9]+'; then
+              MISSING+=("hotfix-evidence: OCC-<number>")
+            fi
+
+            if ! echo "${PR_BODY}" | grep -qE 'backmerge:[[:space:]]*#[0-9]+'; then
+              MISSING+=("backmerge: #<pr-number>")
+            fi
+
+            if [[ "${#MISSING[@]}" -eq 0 ]]; then
+              echo "::notice::Hotfix PR from '${HEAD_REF}' with valid hotfix evidence and backmerge. Allowed."
+              exit 0
+            fi
+
+            echo "::error::Hotfix PR from '${HEAD_REF}' is missing required fields:"
+            for field in "${MISSING[@]}"; do
+              echo "::error::  - ${field}"
+            done
+            echo "::error::Retarget this PR to dev; main accepts only promotion or hotfix PRs."
+            exit 1
+          fi
+
+          echo "::error::PRs targeting main must come from dev or hotfix/*."
+          echo "::error::Head ref '${HEAD_REF}' is not permitted to target main directly."
+          echo "::error::Retarget this PR to dev; main accepts only promotion or hotfix PRs."
+          exit 1

allowlists/omniintelligence.yaml

@@ -9,6 +9,11 @@ allowlisted_handlers:
       - missing_handler_routing
       - logic_in_node
     ticket: '# migration pending'
+  - path: omniintelligence/nodes/node_anti_gaming_alerter_effect/handlers/protocols.py
+    violations:
+      - missing_handler_routing
+      - logic_in_node
+    ticket: '# migration pending'
   - path: omniintelligence/nodes/node_ast_extraction_compute/handlers/handler_ast_extract.py
     violations:
       - logic_in_node
@@ -530,3 +535,11 @@ allowlisted_handlers:
     violations:
       - missing_handler_routing
     ticket: '# migration pending'
+  - path: omniintelligence/nodes/node_intent_graph_reducer/handlers/handler_intent_graph_update.py
+    violations:
+      - missing_handler_routing
+    ticket: '# migration pending'
+  - path: omniintelligence/nodes/node_objective_ab_framework_compute/handlers/handler_ab_framework.py
+    violations:
+      - logic_in_node
+    ticket: '# migration pending'

allowlists/omnimarket.yaml

@@ -1056,3 +1056,29 @@ allowlisted_handlers:
     violations:
       - hybrid
     ticket: '# migration pending'
+  - path: omnimarket/nodes/node_generate_node_effect/handlers/handler_generate_node.py
+    violations:
+      - missing_handler_routing
+    ticket: OMN-12230
+  - path: omnimarket/nodes/node_log_persistence_effect/handlers/handler_log_persistence_effect.py
+    violations:
+      - undeclared_transport
+    ticket: OMN-12132
+  - path: omnimarket/nodes/node_observability_sink_effect/handlers/handler_observability_sink_effect.py
+    violations:
+      - missing_handler_routing
+    ticket: OMN-12217
+  - path: omnimarket/nodes/node_pr_lifecycle_fix_effect/handlers/adapter_occ_contract.py
+    violations:
+      - missing_handler_routing
+      - hardcoded_topic
+    ticket: OMN-10278
+  - path: omnimarket/nodes/node_routing_policy_engine/handlers/handler_score_lookup.py
+    violations:
+      - missing_handler_routing
+    ticket: OMN-8040
+  - path: omnimarket/nodes/node_ticketing_epic_org_orchestrator/handlers/handler_ticketing_epic_org.py
+    violations:
+      - imperative
+      - hardcoded_topic
+    ticket: OMN-12202

contracts/OMN-11599.yaml

@@ -0,0 +1,30 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-11599"
+title: "Migrate agent_router to node structure"
+summary: >
+  OCC evidence for omniclaude PR #1677. The change adds node_agent_router as a typed COMPUTE_GENERIC node
+  wrapper around the legacy AgentRouter while preserving the existing hook-compatible router path.
+is_seam_ticket: false
+interface_change: false
+interfaces_touched: []
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-agent-router-unit-tests"
+    description: "Agent router node unit tests pass on omniclaude PR #1677 head."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11599/dod-agent-router-unit-tests/command.yaml
+          && grep -q '17 passed' drift/dod_receipts/OMN-11599/dod-agent-router-unit-tests/command.yaml"
+  - id: "dod-occ-promotion-pr-1712"
+    description: "OCC main-promotion PR #1712 carries OMN-11599 router evidence onto main."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr view ${PR_NUMBER} --repo ${REPO} --json headRefOid,state,title"

contracts/OMN-11828.yaml

@@ -0,0 +1,51 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-11828"
+title: "Harden self-extending agent sandbox response handling"
+summary: >
+  Central OCC evidence for onex-self-extending-agent PR #128, which tightens generated-handler sandbox
+  guidance and guards ADK-wrapped registration responses so only object payloads replace the parsed response
+  map.
+is_seam_ticket: false
+interface_change: false
+interfaces_touched: []
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-onex-self-extending-agent-pr-128"
+    description: "onex-self-extending-agent PR #128 carries the OMN-11828 sandbox and ADK response handling
+      fix."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11828/dod-onex-self-extending-agent-pr-128/command.yaml
+          && grep -q '^pr_number: 128$' drift/dod_receipts/OMN-11828/dod-onex-self-extending-agent-pr-128/command.yaml"
+  - id: "dod-local-validation"
+    description: "Focused unit tests and lint passed for the ADK unwrap guard."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11828/dod-local-validation/command.yaml
+          && grep -q 'pytest tests/unit/test_main.py' drift/dod_receipts/OMN-11828/dod-local-validation/command.yaml
+          && grep -q 'ruff check' drift/dod_receipts/OMN-11828/dod-local-validation/command.yaml"
+  - id: "dod-coderabbit-thread"
+    description: "CodeRabbit ADK unwrap review thread was addressed by guarding decoded result payload
+      type."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11828/dod-coderabbit-thread/command.yaml
+          && grep -q 'PRRT_kwDOSfXbW86EcyHq' drift/dod_receipts/OMN-11828/dod-coderabbit-thread/command.yaml"
+  - id: "dod-occ-pr-1597"
+    description: "onex_change_control PR #1597 carries the central OMN-11828 contract and receipt bundle."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11828/dod-occ-pr-1597/command.yaml
+          && grep -q '^pr_number: 1597$' drift/dod_receipts/OMN-11828/dod-occ-pr-1597/command.yaml"

contracts/OMN-11969.yaml

@@ -20,15 +20,15 @@ dod_evidence:
     status: "verified"
     checks:
       - check_type: "command"
-        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-omninode-infra-pr-461/command.yaml
+        check_value: "cd /tmp/onex_change_control && grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-omninode-infra-pr-461/command.yaml
           && grep -q '^pr_number: 461$' drift/dod_receipts/OMN-11969/dod-omninode-infra-pr-461/command.yaml"
   - id: "dod-local-validation"
     description: "Focused local validation passed for shellcheck and Kubernetes kustomize rendering."
     source: "manual"
     status: "verified"
     checks:
       - check_type: "command"
-        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-local-validation/command.yaml
+        check_value: "cd /tmp/onex_change_control && grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-local-validation/command.yaml
           && grep -q 'shellcheck' drift/dod_receipts/OMN-11969/dod-local-validation/command.yaml && grep
           -q 'kubectl kustomize' drift/dod_receipts/OMN-11969/dod-local-validation/command.yaml"
   - id: "dod-coderabbit-thread"
@@ -38,7 +38,7 @@ dod_evidence:
     status: "verified"
     checks:
       - check_type: "command"
-        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-coderabbit-thread/command.yaml
+        check_value: "cd /tmp/onex_change_control && grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-coderabbit-thread/command.yaml
           && grep -q 'isResolved=true' drift/dod_receipts/OMN-11969/dod-coderabbit-thread/command.yaml"
   - id: "dod-deploy-assessment"
     description: "No live production deploy was performed in this sweep; PR records cloud-dev runtime
@@ -47,13 +47,29 @@ dod_evidence:
     status: "verified"
     checks:
       - check_type: "command"
-        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-deploy-assessment/command.yaml
+        check_value: "cd /tmp/onex_change_control && grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-deploy-assessment/command.yaml
           && grep -qi 'no live production deploy' drift/dod_receipts/OMN-11969/dod-deploy-assessment/command.yaml"
   - id: "dod-occ-pr-1595"
     description: "onex_change_control PR #1595 carries the central OMN-11969 contract and receipt bundle."
     source: "manual"
     status: "verified"
     checks:
       - check_type: "command"
-        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-occ-pr-1595/command.yaml
+        check_value: "cd /tmp/onex_change_control && grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-occ-pr-1595/command.yaml
           && grep -q '^pr_number: 1595$' drift/dod_receipts/OMN-11969/dod-occ-pr-1595/command.yaml"
+  - id: "dod-compat-pr-108"
+    description: "omnibase_compat PR #108 carries the OMN-11969 delegation wire model compatibility updates."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "cd /tmp/onex_change_control && grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-compat-pr-108/command.yaml
+          && grep -q '^pr_number: 108$' drift/dod_receipts/OMN-11969/dod-compat-pr-108/command.yaml"
+  - id: "dod-occ-pr-1620"
+    description: "onex_change_control PR #1620 carries the OMN-11969 compat PR #108 receipt repair."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "cd /tmp/onex_change_control && grep -q '^status: PASS$' drift/dod_receipts/OMN-11969/dod-occ-pr-1620/command.yaml
+          && grep -q '^pr_number: 1620$' drift/dod_receipts/OMN-11969/dod-occ-pr-1620/command.yaml"

contracts/OMN-11972.yaml

@@ -0,0 +1,50 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-11972"
+title: "Unwrap ADK response payloads for self-extending agent registration"
+summary: >
+  Central OCC evidence for onex-self-extending-agent PR #128, which fixes the ADK response-wrapper mismatch
+  for generated tool registration and guards non-object result payloads from replacing the parsed response
+  map.
+is_seam_ticket: false
+interface_change: false
+interfaces_touched: []
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-onex-self-extending-agent-pr-128"
+    description: "onex-self-extending-agent PR #128 carries the OMN-11972 ADK response unwrap fix."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11972/dod-onex-self-extending-agent-pr-128/command.yaml
+          && grep -q '^pr_number: 128$' drift/dod_receipts/OMN-11972/dod-onex-self-extending-agent-pr-128/command.yaml"
+  - id: "dod-local-validation"
+    description: "Focused unit tests and lint passed for the ADK unwrap behavior."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11972/dod-local-validation/command.yaml
+          && grep -q 'pytest tests/unit/test_main.py' drift/dod_receipts/OMN-11972/dod-local-validation/command.yaml
+          && grep -q 'ruff check' drift/dod_receipts/OMN-11972/dod-local-validation/command.yaml"
+  - id: "dod-coderabbit-thread"
+    description: "CodeRabbit ADK unwrap review thread was addressed by guarding decoded result payload
+      type."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11972/dod-coderabbit-thread/command.yaml
+          && grep -q 'PRRT_kwDOSfXbW86EcyHq' drift/dod_receipts/OMN-11972/dod-coderabbit-thread/command.yaml"
+  - id: "dod-occ-pr-1597"
+    description: "onex_change_control PR #1597 carries the central OMN-11972 contract and receipt bundle."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11972/dod-occ-pr-1597/command.yaml
+          && grep -q '^pr_number: 1597$' drift/dod_receipts/OMN-11972/dod-occ-pr-1597/command.yaml"

contracts/OMN-11994.yaml

@@ -0,0 +1,50 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-11994"
+title: "Fix handler wiring text array adaptation"
+summary: >
+  Central OCC evidence for omnibase_infra PR #1730, which fixes the synchronous psycopg2 handler-wiring
+  adapter so Postgres text[] list values pass through as native list parameters while dict values remain
+  JSON-adapted.
+is_seam_ticket: false
+interface_change: false
+interfaces_touched: []
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-omnibase-infra-pr-1730"
+    description: "omnibase_infra PR #1730 carries the OMN-11994 handler_wiring text[] adaptation fix."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11994/dod-omnibase-infra-pr-1730/command.yaml
+          && grep -q '^pr_number: 1730$' drift/dod_receipts/OMN-11994/dod-omnibase-infra-pr-1730/command.yaml"
+  - id: "dod-local-validation"
+    description: "Focused integration coverage and lint passed for psycopg2 text[] list adaptation."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11994/dod-local-validation/command.yaml
+          && grep -q 'test_projection_handler_db_injection_integration.py' drift/dod_receipts/OMN-11994/dod-local-validation/command.yaml
+          && grep -q 'ruff check' drift/dod_receipts/OMN-11994/dod-local-validation/command.yaml"
+  - id: "dod-deploy-assessment"
+    description: "No live deploy was performed; change is source-level adapter behavior with CI/deploy
+      gates expected to validate before merge."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11994/dod-deploy-assessment/command.yaml
+          && grep -qi 'no live deploy' drift/dod_receipts/OMN-11994/dod-deploy-assessment/command.yaml"
+  - id: "dod-occ-pr-1599"
+    description: "onex_change_control PR #1599 carries the central OCC evidence for OMN-11994."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11994/dod-occ-pr-1599/command.yaml
+          && grep -q '^pr_number: 1599$' drift/dod_receipts/OMN-11994/dod-occ-pr-1599/command.yaml"