release(OMN-12765): promote OCC dev evidence to main

.github/actions/validate-boundaries/action.yml

@@ -110,22 +110,40 @@ runs:
 
     - name: Set up Python
       if: steps.scope.outputs.should_run_boundary_checks == 'true'
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3.12"
 
     - name: Install uv
       if: steps.scope.outputs.should_run_boundary_checks == 'true'
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@v7
       with:
         version: "latest"
 
     - name: Install onex_change_control
       if: steps.scope.outputs.should_run_boundary_checks == 'true'
       shell: bash
+      env:
+        UV_HTTP_TIMEOUT: "600"
+        UV_SYNC_ATTEMPTS: "5"
+        UV_SYNC_RETRY_DELAY_SECONDS: "10"
+        UV_CONCURRENT_DOWNLOADS: "2"
       run: |
         cd .onex_change_control
-        uv sync --no-group dev
+        git config --global http.version HTTP/1.1
+        attempt=1
+        until uv sync --no-group dev; do
+          status=$?
+          if [ "$attempt" -ge "$UV_SYNC_ATTEMPTS" ]; then
+            echo "::error::uv sync failed after ${attempt} attempt(s)"
+            exit "$status"
+          fi
+
+          sleep_seconds=$((UV_SYNC_RETRY_DELAY_SECONDS * attempt))
+          echo "::warning::uv sync attempt ${attempt}/${UV_SYNC_ATTEMPTS} failed with exit ${status}; retrying in ${sleep_seconds}s"
+          sleep "$sleep_seconds"
+          attempt=$((attempt + 1))
+        done
 
     - name: Clone peer repos
       if: steps.scope.outputs.should_run_boundary_checks == 'true'
@@ -135,18 +153,35 @@ runs:
         rm -rf /tmp/omni_repos
         mkdir -p /tmp/omni_repos
         DEGRADED=""
+        CALLING_REPO="${GITHUB_REPOSITORY##*/}"
         IFS=',' read -ra REPOS <<< "${{ inputs.repos }}"
         for repo in "${REPOS[@]}"; do
           repo=$(echo "$repo" | xargs)  # trim whitespace
+          if [[ "$repo" == "$CALLING_REPO" ]]; then
+            echo "Skipping clone of calling repo ${repo}; checked-out workspace will be symlinked."
+            continue
+          fi
           if [ -n "${OMNI_REPO_CLONE_TOKEN:-}" ]; then
             auth_header="AUTHORIZATION: basic $(printf 'x-access-token:%s' "${OMNI_REPO_CLONE_TOKEN}" | base64 | tr -d '\n')"
             clone_args=(-c "http.https://github.com/.extraheader=${auth_header}")
           else
             clone_args=()
           fi
-          if git "${clone_args[@]}" clone --depth=1 "https://github.com/OmniNode-ai/${repo}.git" "/tmp/omni_repos/${repo}" 2>/dev/null; then
-            echo "Cloned ${repo}"
-          else
+          cloned=false
+          for attempt in 1 2 3; do
+            rm -rf "/tmp/omni_repos/${repo}"
+            if git "${clone_args[@]}" clone --depth=1 "https://github.com/OmniNode-ai/${repo}.git" "/tmp/omni_repos/${repo}" 2>/dev/null; then
+              echo "Cloned ${repo} on attempt ${attempt}"
+              cloned=true
+              break
+            fi
+            if [ "${attempt}" -lt 3 ]; then
+              sleep_seconds=$((attempt * 10))
+              echo "::warning::Boundary verification clone attempt ${attempt}/3 failed for ${repo}; retrying in ${sleep_seconds}s"
+              sleep "${sleep_seconds}"
+            fi
+          done
+          if [[ "${cloned}" != "true" ]]; then
             echo "::warning::Boundary verification DEGRADED: could not clone ${repo}. Seam parity NOT confirmed."
             DEGRADED="${DEGRADED}${repo},"
           fi

.github/actions/validate-contract/action.yml

@@ -60,20 +60,38 @@ runs:
         # No token needed — public repo
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3.12"
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@v7
       with:
         version: "latest"
 
     - name: Install onex_change_control validators
       shell: bash
+      env:
+        UV_HTTP_TIMEOUT: "600"
+        UV_SYNC_ATTEMPTS: "5"
+        UV_SYNC_RETRY_DELAY_SECONDS: "10"
+        UV_CONCURRENT_DOWNLOADS: "2"
       run: |
         cd .onex_change_control_validators
-        uv sync --no-group dev
+        git config --global http.version HTTP/1.1
+        attempt=1
+        until uv sync --no-group dev; do
+          status=$?
+          if [ "$attempt" -ge "$UV_SYNC_ATTEMPTS" ]; then
+            echo "::error::uv sync failed after ${attempt} attempt(s)"
+            exit "$status"
+          fi
+
+          sleep_seconds=$((UV_SYNC_RETRY_DELAY_SECONDS * attempt))
+          echo "::warning::uv sync attempt ${attempt}/${UV_SYNC_ATTEMPTS} failed with exit ${status}; retrying in ${sleep_seconds}s"
+          sleep "$sleep_seconds"
+          attempt=$((attempt + 1))
+        done
 
     - name: Extract ticket ID from branch name
       id: extract-ticket-id

.github/workflows/call-occ-preflight.yml

@@ -24,6 +24,10 @@ on:
   merge_group:
     types: [checks_requested]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   occ-preflight:
     uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@main

.github/workflows/ci.yml

@@ -184,7 +184,8 @@ jobs:
         run: |
           uv run check-imperative-contracts \
             --repo-root . \
-            --allowlists-dir allowlists
+            --allowlists-dir allowlists \
+            --scan-freestanding
 
   ai-slop-check:
     name: AI-Slop Pattern Check (strict, PR diff)

.github/workflows/imperative-contract-guard.yml

@@ -8,6 +8,11 @@ on:
         required: false
         type: string
         default: "3.12"
+      uv-version:
+        description: uv version for the validator runtime.
+        required: false
+        type: string
+        default: "0.8.3"
       target-ref:
         description: Caller repository ref to check out.
         required: false
@@ -50,11 +55,32 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
+        with:
+          version: ${{ inputs['uv-version'] }}
 
       - name: Run imperative contract guard
         working-directory: onex_change_control
+        env:
+          UV_HTTP_TIMEOUT: "600"
+          UV_SYNC_ATTEMPTS: "3"
+          UV_SYNC_RETRY_DELAY_SECONDS: "10"
         run: |
-          uv sync --locked --all-extras
+          git config --global http.version HTTP/1.1
+          attempt=1
+          until uv sync --locked --all-extras; do
+            status=$?
+            if [ "$attempt" -ge "$UV_SYNC_ATTEMPTS" ]; then
+              echo "::error::uv sync failed after ${attempt} attempt(s)"
+              exit "$status"
+            fi
+
+            sleep_seconds=$((UV_SYNC_RETRY_DELAY_SECONDS * attempt))
+            echo "::warning::uv sync attempt ${attempt}/${UV_SYNC_ATTEMPTS} failed with exit ${status}; retrying in ${sleep_seconds}s"
+            sleep "$sleep_seconds"
+            attempt=$((attempt + 1))
+          done
+
           uv run check-imperative-contracts \
             --repo-root "$GITHUB_WORKSPACE/target" \
-            --allowlists-dir "$GITHUB_WORKSPACE/onex_change_control/allowlists"
+            --allowlists-dir "$GITHUB_WORKSPACE/onex_change_control/allowlists" \
+            --scan-freestanding

.github/workflows/main-target-guard.yml

@@ -0,0 +1,80 @@
+# SPDX-FileCopyrightText: 2026 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# OMN-12243: Block PRs targeting main unless they are promotion PRs
+# from dev with a promotion receipt, or hotfix PRs with evidence and
+# a backmerge link.
+
+name: Main target guard
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+jobs:
+  main-target-guard:
+    name: main-target-guard
+    runs-on: >-
+      ${{
+        (github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 5
+
+    steps:
+      - name: Check PR target branch
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          set -euo pipefail
+
+          if [[ "${BASE_REF}" != "main" ]]; then
+            echo "::notice::PR targets '${BASE_REF}', not main; guard does not apply."
+            exit 0
+          fi
+
+          echo "PR targets main. Checking head ref: '${HEAD_REF}'"
+
+          if [[ "${HEAD_REF}" == "dev" ]]; then
+            if echo "${PR_BODY}" | grep -qE 'promotion-receipt:[[:space:]]*OCC-[0-9]+'; then
+              echo "::notice::Promotion PR from dev with valid promotion-receipt. Allowed."
+              exit 0
+            fi
+
+            echo "::error::PR is from dev but is missing a promotion receipt."
+            echo "::error::Add a line matching: promotion-receipt: OCC-<number>"
+            echo "::error::Retarget this PR to dev; main accepts only promotion or hotfix PRs."
+            exit 1
+          fi
+
+          if [[ "${HEAD_REF}" == hotfix/* ]]; then
+            MISSING=()
+
+            if ! echo "${PR_BODY}" | grep -qE 'hotfix-evidence:[[:space:]]*OCC-[0-9]+'; then
+              MISSING+=("hotfix-evidence: OCC-<number>")
+            fi
+
+            if ! echo "${PR_BODY}" | grep -qE 'backmerge:[[:space:]]*#[0-9]+'; then
+              MISSING+=("backmerge: #<pr-number>")
+            fi
+
+            if [[ "${#MISSING[@]}" -eq 0 ]]; then
+              echo "::notice::Hotfix PR from '${HEAD_REF}' with valid hotfix evidence and backmerge. Allowed."
+              exit 0
+            fi
+
+            echo "::error::Hotfix PR from '${HEAD_REF}' is missing required fields:"
+            for field in "${MISSING[@]}"; do
+              echo "::error::  - ${field}"
+            done
+            echo "::error::Retarget this PR to dev; main accepts only promotion or hotfix PRs."
+            exit 1
+          fi
+
+          echo "::error::PRs targeting main must come from dev or hotfix/*."
+          echo "::error::Head ref '${HEAD_REF}' is not permitted to target main directly."
+          echo "::error::Retarget this PR to dev; main accepts only promotion or hotfix PRs."
+          exit 1

.github/workflows/occ-rerun-downstream.yml

@@ -204,16 +204,16 @@ jobs:
           fi
           branch="automation/occ-rerun-state-${OCC_COMMIT:0:8}"
           git checkout -B "$branch"
-          git commit -m "chore(occ-deps): update rerun state after merge ${OCC_COMMIT:0:8} [skip ci]"
+          git commit -m "chore(OMN-10487): update rerun state after merge ${OCC_COMMIT:0:8}"
           git push --force-with-lease origin "$branch"
 
           if gh pr view "$branch" --repo OmniNode-ai/onex_change_control >/dev/null 2>&1; then
             echo "State update PR already exists for $branch"
           else
             gh pr create \
               --repo OmniNode-ai/onex_change_control \
-              --base main \
+              --base dev \
               --head "$branch" \
-              --title "chore(occ-deps): update rerun state after ${OCC_COMMIT:0:8}" \
-              --body "Automated OCC rerun state update for merge ${OCC_COMMIT}.\n\nThis PR is opened instead of direct-pushing to protected main."
+              --title "chore(OMN-10487): update OCC rerun state after ${OCC_COMMIT:0:8}" \
+              --body "Automated OCC rerun state update for merge ${OCC_COMMIT}.\n\nThis PR targets dev so normal CI and OCC evidence gates run before any main promotion.\n\nEvidence-Ticket: OMN-10487\nEvidence-Source: automated-rerun-state"
           fi

.gitignore

@@ -50,3 +50,4 @@ Thumbs.db
 # Tool caches
 .ruff_cache/
 .mypy_cache/
+.onex_state/

.pre-commit-config.yaml

@@ -49,10 +49,12 @@ repos:
       - id: ruff-format
         name: ruff format (auto-format)
         stages: [pre-commit]
+        exclude: ^evidence/
       - id: ruff
         name: ruff check (linting + import sorting)
         args: [--fix, --exit-non-zero-on-fix]
         stages: [pre-commit]
+        exclude: ^evidence/
   # Local hooks — all use uv run for consistency
   - repo: local
     hooks:
@@ -93,8 +95,7 @@ repos:
         name: Block planning docs (belong in omni_home/docs/plans/)
         entry: "bash -c 'PLAN_FILES=$(git diff --cached --name-only -- \"docs/plans/\"); if [ -n \"$PLAN_FILES\"
           ]; then echo \"ERROR: Planning docs must live in omni_home/docs/plans/, not in this repo:\";
-          echo \"$PLAN_FILES\"; echo; echo \"Move your file to: /Volumes/PRO-G40/Code/omni_home/docs/plans/\";
-          exit 1; fi'"
+          echo \"$PLAN_FILES\"; echo; echo \"Move your file to: $OMNI_HOME/docs/plans/\"; exit 1; fi'"
         language: system
         pass_filenames: false
         always_run: true
@@ -135,12 +136,20 @@ repos:
         pass_filenames: false
         types: [python]
         stages: [pre-commit]
+      - id: check-imperative-contracts-freestanding
+        name: Imperative contract guard with freestanding reachability
+        language: system
+        entry: >-
+          uv run check-imperative-contracts --repo-root . --allowlists-dir allowlists --scan-freestanding
+        pass_filenames: false
+        types: [python]
+        stages: [pre-commit]
       - id: no-hardcoded-topics
         name: No hardcoded ONEX topic strings
         language: system
         entry: uv run check-hardcoded-topics
         types_or: [python, yaml, ts, javascript]
-        exclude: ^(contracts/|src/onex_change_control/boundaries/|drift/dod_receipts/)  # Manifests and evidence receipts that document actual topic usage
+        exclude: ^(contracts/|src/onex_change_control/boundaries/|drift/dod_receipts/|evidence/)  # Manifests, receipts, and archived evidence may document actual topic usage
         pass_filenames: true
         stages: [pre-commit]
       - id: no-untracked-todos