chore(OMN-12751): baseline omnibase_infra freestanding guard

allowlists/omnibase_infra.yaml

@@ -109,3 +109,197 @@ allowlisted_handlers:
     violations:
       - missing_handler_routing
     ticket: '# migration pending'
+  - path: src/omnibase_infra/adapters/github/adapter_github_client.py
+    violations:
+      - freestanding_raw_http
+    ticket: OMN-12751
+  - path: src/omnibase_infra/backends/backend_probe.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/cli/artifact_reconcile.py
+    violations:
+      - freestanding_kafka_client
+    ticket: OMN-12751
+  - path: src/omnibase_infra/cli/cli_env.py
+    violations:
+      - freestanding_hardcoded_private_ip
+    ticket: OMN-12751
+  - path: src/omnibase_infra/cli/cli_kafka.py
+    violations:
+      - freestanding_kafka_client
+      - freestanding_hardcoded_private_ip
+    ticket: OMN-12751
+  - path: src/omnibase_infra/cli/commands.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/cli/infra_test/run_suite.py
+    violations:
+      - freestanding_db_connection
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/cli/infra_test/verify.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/cli/service_demo_reset.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/dlq/plugin_dlq.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/dlq/service_dlq_tracking.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/enums/generated/enum_artifact_topic.py
+    violations:
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/enums/generated/enum_omnibase_infra_topic.py
+    violations:
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/enums/generated/enum_omnimarket_topic.py
+    violations:
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/enums/generated/enum_platform_topic.py
+    violations:
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/event_bus/event_bus_kafka.py
+    violations:
+      - freestanding_raw_http
+      - freestanding_kafka_client
+    ticket: OMN-12751
+  - path: src/omnibase_infra/event_bus/topic_constants.py
+    violations:
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/event_bus/topic_violation_alerter.py
+    violations:
+      - freestanding_raw_http
+    ticket: OMN-12751
+  - path: src/omnibase_infra/handlers/handler_db.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/handlers/handler_gmail_api.py
+    violations:
+      - freestanding_raw_http
+    ticket: OMN-12751
+  - path: src/omnibase_infra/handlers/handler_linear_db_error_reporter.py
+    violations:
+      - freestanding_raw_http
+    ticket: OMN-12751
+  - path: src/omnibase_infra/handlers/handler_slack_webhook.py
+    violations:
+      - freestanding_raw_http
+    ticket: OMN-12751
+  - path: src/omnibase_infra/handlers/registration_storage/handler_registration_storage_postgres.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/idempotency/store_postgres.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/mixins/mixin_llm_http_transport.py
+    violations:
+      - freestanding_raw_http
+      - freestanding_hardcoded_private_ip
+    ticket: OMN-12751
+  - path: src/omnibase_infra/models/discovery/model_introspection_config.py
+    violations:
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/models/projection/model_topic_projection.py
+    violations:
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/models/validation_ledger/model_validation_ledger_entry.py
+    violations:
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/nodes/node_dlq_replay_effect/engine_dlq_replay.py
+    violations:
+      - freestanding_kafka_client
+    ticket: OMN-12751
+  - path: src/omnibase_infra/nodes/node_registration_orchestrator/plugin.py
+    violations:
+      - freestanding_kafka_client
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/probes/capability_probe.py
+    violations:
+      - freestanding_raw_http
+    ticket: OMN-12751
+  - path: src/omnibase_infra/projectors/snapshot_publisher_registration.py
+    violations:
+      - freestanding_kafka_client
+    ticket: OMN-12751
+  - path: src/omnibase_infra/runtime/auto_wiring/handler_wiring.py
+    violations:
+      - freestanding_kafka_client
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/runtime/emit_daemon/topics.py
+    violations:
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/runtime/providers/provider_http_client.py
+    violations:
+      - freestanding_raw_http
+    ticket: OMN-12751
+  - path: src/omnibase_infra/runtime/providers/provider_kafka_producer.py
+    violations:
+      - freestanding_kafka_client
+    ticket: OMN-12751
+  - path: src/omnibase_infra/runtime/providers/provider_postgres_pool.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/runtime/request_response_wiring.py
+    violations:
+      - freestanding_kafka_client
+    ticket: OMN-12751
+  - path: src/omnibase_infra/runtime/runtime_scheduler.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/runtime/service_kernel.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/runtime/service_pattern_b_broker.py
+    violations:
+      - freestanding_kafka_client
+    ticket: OMN-12751
+  - path: src/omnibase_infra/runtime/util_schema_fingerprint.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/services/service_llm_endpoint_health.py
+    violations:
+      - freestanding_raw_http
+    ticket: OMN-12751
+  - path: src/omnibase_infra/services/session/consumer.py
+    violations:
+      - freestanding_kafka_client
+    ticket: OMN-12751
+  - path: src/omnibase_infra/services/session/store.py
+    violations:
+      - freestanding_db_connection
+    ticket: OMN-12751
+  - path: src/omnibase_infra/topics/platform_topic_suffixes.py
+    violations:
+      - freestanding_hardcoded_topic
+    ticket: OMN-12751
+  - path: src/omnibase_infra/tui/consumers/consumer_status.py
+    violations:
+      - freestanding_kafka_client
+    ticket: OMN-12751

contracts/OMN-12751.yaml

@@ -0,0 +1,37 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-12751"
+title: "Pay down omnibase_infra freestanding imperative guard baseline"
+summary: >-
+  Central OCC evidence for baselining the existing omnibase_infra freestanding imperative guard findings
+  so the OMN-12245 release backmerge can validate version-only release metadata without masking new findings.
+is_seam_ticket: false
+interface_change: false
+interfaces_touched: []
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-occ-allowlist-main-pr-2240"
+    description: "onex_change_control PR #2240 carries the main OCC allowlist baseline for omnibase_infra
+      live freestanding imperative guard findings."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml
+          && grep -q '^pr_number: 2240$' drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml
+          && grep -q '8967abe38959180c8a8f2bbd5f8e24209cc23ebd' drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml
+  - id: "dod-occ-allowlist-backmerge-pr-2239"
+    description: "onex_change_control PR #2239 carries the dev backmerge of the OMN-12751 omnibase_infra
+      freestanding imperative guard baseline."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml
+          && grep -q '^pr_number: 2239$' drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml
+          && grep -q '1150786c7f83cbf93b62ab1145d88cd15ba7cfd7' drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml

drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml

@@ -0,0 +1,21 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-12751"
+evidence_item_id: "dod-occ-allowlist-backmerge-pr-2239"
+check_type: "command"
+check_value: "gh pr view 2239 --repo OmniNode-ai/onex_change_control --json number,state,baseRefName,headRefName,headRefOid,title,url"
+contract_sha256: "sha256:4d9c359c8fcc6982fb07485e3e8049a51b445dd21de877e27dd495aa0514533d"
+status: PASS
+run_timestamp: "2026-06-06T21:27:00Z"
+commit_sha: "1150786c7f83cbf93b62ab1145d88cd15ba7cfd7"
+runner: "codex-cli"
+verifier: "main-release-version-backmerge-sweep"
+probe_command: "gh pr view 2239 --repo OmniNode-ai/onex_change_control --json number,state,baseRefName,headRefName,headRefOid,title,url"
+probe_stdout: |
+  {"baseRefName":"dev","headRefName":"hotfix/omn-12751-infra-freestanding-baseline-dev","headRefOid":"1150786c7f83cbf93b62ab1145d88cd15ba7cfd7","number":2239,"state":"OPEN","title":"chore(OMN-12751): backmerge omnibase_infra freestanding guard baseline","url":"https://github.com/OmniNode-ai/onex_change_control/pull/2239"}
+actual_output: "PASS: onex_change_control PR #2239 carries the OMN-12751 omnibase_infra freestanding imperative
+  guard allowlist baseline backmerge on dev."
+exit_code: 0
+pr_number: 2239
+branch: "hotfix/omn-12751-infra-freestanding-baseline-dev"
+working_dir: "/Users/jonah/Code/omni_home/omni_worktrees/OMN-12751-backmerge/onex_change_control"

drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml

@@ -0,0 +1,21 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-12751"
+evidence_item_id: "dod-occ-allowlist-main-pr-2240"
+check_type: "command"
+check_value: "gh pr view 2240 --repo OmniNode-ai/onex_change_control --json number,state,baseRefName,headRefName,headRefOid,title,url"
+contract_sha256: "sha256:4d9c359c8fcc6982fb07485e3e8049a51b445dd21de877e27dd495aa0514533d"
+status: PASS
+run_timestamp: "2026-06-06T21:27:00Z"
+commit_sha: "8967abe38959180c8a8f2bbd5f8e24209cc23ebd"
+runner: "codex-cli"
+verifier: "main-release-version-backmerge-sweep"
+probe_command: "gh pr view 2240 --repo OmniNode-ai/onex_change_control --json number,state,baseRefName,headRefName,headRefOid,title,url"
+probe_stdout: |
+  {"baseRefName":"main","headRefName":"hotfix/omn-12751-infra-freestanding-baseline","headRefOid":"8967abe38959180c8a8f2bbd5f8e24209cc23ebd","number":2240,"state":"OPEN","title":"chore(OMN-12751): baseline omnibase_infra freestanding guard","url":"https://github.com/OmniNode-ai/onex_change_control/pull/2240"}
+actual_output: "PASS: onex_change_control PR #2240 carries the OMN-12751 omnibase_infra freestanding imperative
+  guard allowlist baseline on main."
+exit_code: 0
+pr_number: 2240
+branch: "hotfix/omn-12751-infra-freestanding-baseline"
+working_dir: "/Users/jonah/Code/omni_home/omni_worktrees/OMN-12751/onex_change_control"