jonahgabriel · Jun 1, 2026 · Jun 1, 2026 · Jun 1, 2026 · Jun 1, 2026 · Jun 1, 2026
diff --git a/contracts/OMN-12564.yaml b/contracts/OMN-12564.yaml
@@ -0,0 +1,46 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-12564"
+title: "ci: add versioned host-local CI dependency environment canary for omnibase_infra"
+summary: >-
+  Adds the omnibase_infra canary for immutable host-local CI dependency environments under /home/runner/.cache/omni/ci-envs/omnibase_infra/<digest>.
+  Trusted CI jobs build/reuse the digest environment under a lock, consume it with UV_NO_SYNC=1 and PYTHONPATH=<checkout>/src,
+  and leave public fork PRs on isolated setup. This removes repeated dependency resolution from ordinary
+  CI jobs while keeping checked-out PR source authoritative.
+is_seam_ticket: false
+interface_change: false
+interfaces_touched: []
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-infra-pr-1824"
+    description: "omnibase_infra PR #1824 carries the versioned CI environment canary implementation and
+      docs."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml"
+          && grep -q '^pr_number: 1824$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml"
+          && grep -q '^commit_sha: "3d4856b81dac037f6b0a06da3341f409001c0f04"$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml"
+  - id: "dod-local-env-proof"
+    description: "Local temp-root proof built and then reused the immutable CI env without touching privileged
+      paths."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-local-env-proof/command.yaml"
+  - id: "dod-occ-pr-self"
+    description: "Self-binding receipt for the OCC PR carrying OMN-12564 central evidence."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-self/command.yaml"
+          && grep -q '^pr_number: 2015$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-self/command.yaml"
diff --git a/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml b/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml
@@ -0,0 +1,22 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-12564"
+evidence_item_id: "dod-infra-pr-1824"
+check_type: "command"
+check_value: "gh pr view 1824 --repo OmniNode-ai/omnibase_infra --json number,url,headRefOid,headRefName,baseRefName,title,state"
+status: PASS
+run_timestamp: "2026-06-01T12:24:00Z"
+commit_sha: "3d4856b81dac037f6b0a06da3341f409001c0f04"
+contract_sha256: "sha256:38a73ee142074155c93844117187d57217cb9d586a5cd1ee242487752c8bcdd6"
+branch: "jonah/omn-12564-ci-env-canary"
+pr_number: 1824
+runner: "codex"
+verifier: "jonah"
+probe_command: "gh pr view 1824 --repo OmniNode-ai/omnibase_infra --json number,url,headRefOid,headRefName,baseRefName,title,state"
+probe_stdout: |
+  {"baseRefName":"dev","headRefName":"jonah/omn-12564-ci-env-canary","headRefOid":"3d4856b81dac037f6b0a06da3341f409001c0f04","number":1824,"state":"OPEN","title":"ci(OMN-12564): add versioned CI env canary","url":"https://github.com/OmniNode-ai/omnibase_infra/pull/1824"}
+actual_output: >-
+  PASS: omnibase_infra PR #1824 carries the versioned CI env canary implementation, documentation, workflow
+  contract tests, and local temp-root build/reuse proof.
+exit_code: 0
+working_dir: "/Users/jonah/Code/omni_home/omni_worktrees/OMN-12564/omnibase_infra"
diff --git a/drift/dod_receipts/OMN-12564/dod-local-env-proof/command.yaml b/drift/dod_receipts/OMN-12564/dod-local-env-proof/command.yaml
@@ -0,0 +1,25 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-12564"
+evidence_item_id: "dod-local-env-proof"
+check_type: "command"
+check_value: "OMNI_CI_ENV_ROOT=$(mktemp -d /tmp/omni-ci-env-canary.XXXXXX) GITHUB_ENV=$(mktemp /tmp/omni-ci-env-github-env.XXXXXX)
+  scripts/ci/ensure_ci_env.sh && scripts/ci/ensure_ci_env.sh"
+status: PASS
+run_timestamp: "2026-06-01T12:18:00Z"
+commit_sha: "3d4856b81dac037f6b0a06da3341f409001c0f04"
+contract_sha256: "sha256:38a73ee142074155c93844117187d57217cb9d586a5cd1ee242487752c8bcdd6"
+branch: "jonah/omn-12564-ci-env-canary"
+pr_number: 1824
+runner: "codex"
+verifier: "jonah"
+probe_command: "temp-root invocation of scripts/ci/ensure_ci_env.sh twice"
+probe_stdout: |
+  Shared CI env: /tmp/omni-ci-env-canary.6vTvVd/omnibase_infra/ccebb92556c1f6631b8ccf5b
+  Shared CI env: /tmp/omni-ci-env-canary.6vTvVd/omnibase_infra/ccebb92556c1f6631b8ccf5b
+  manifest: {"schema":1,"repo":"omnibase_infra","digest":"ccebb92556c1f6631b8ccf5b","python_version":"3.12","uv_version":"0.6.14","install_args":"--frozen --all-extras --all-groups --no-install-project"}
+actual_output: >-
+  PASS: first invocation built the digest environment under a temporary root, second invocation reused
+  the same digest path, and no privileged path was mutated during local verification.
+exit_code: 0
+working_dir: "/Users/jonah/Code/omni_home/omni_worktrees/OMN-12564/omnibase_infra"
diff --git a/drift/dod_receipts/OMN-12564/dod-occ-pr-self/command.yaml b/drift/dod_receipts/OMN-12564/dod-occ-pr-self/command.yaml
@@ -0,0 +1,21 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-12564"
+evidence_item_id: "dod-occ-pr-self"
+check_type: "command"
+check_value: "gh pr view 2015 --repo OmniNode-ai/onex_change_control --json number,url,headRefOid,state"
+status: PASS
+run_timestamp: "2026-06-01T12:29:00Z"
+commit_sha: "957f0fd69bb66067bce2a5df26a4cc6846829bd7"
+contract_sha256: "sha256:38a73ee142074155c93844117187d57217cb9d586a5cd1ee242487752c8bcdd6"
+branch: "jonah/omn-12564-ci-env-occ"
+pr_number: 2015
+runner: "codex"
+verifier: "jonah"
+probe_command: "gh pr view 2015 --repo OmniNode-ai/onex_change_control --json number,url,headRefOid,state"
+probe_stdout: |
+  {"headRefOid":"957f0fd69bb66067bce2a5df26a4cc6846829bd7","number":2015,"state":"OPEN","url":"https://github.com/OmniNode-ai/onex_change_control/pull/2015"}
+actual_output: >-
+  PASS: onex_change_control PR #2015 publishes the OMN-12564 central contract and receipts at head 957f0fd69bb66067bce2a5df26a4cc6846829bd7.
+exit_code: 0
+working_dir: "/Users/jonah/Code/omni_home/omni_worktrees/OMN-12564/onex_change_control"