receipt(OMN-13226): GitHub Action publisher for onex.evt.github.pr-merged.v1

contracts/OMN-13226.yaml

@@ -0,0 +1,74 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-13226"
+title: "GitHub Action publisher for onex.evt.github.pr-merged.v1"
+summary: >-
+  T2 of OMN-13008 (merge-triggered worktree reaper). Adds a GitHub Action that, on every PR merge, thin-publishes
+  onex.evt.github.pr-merged.v1 {repo, branch, pr_number, ticket, merged_at} to the canonical event bus,
+  modelled exactly on the OMN-8917 runtime-rebuild-trigger publisher (same SASL_SSL Kafka transport, KAFKA_BOOTSTRAP_SERVERS
+  resolved from the runner Infisical environment). The new workflow .github/workflows/pr-merged-publisher.yml
+  fires on pull_request:closed with merged==true; the new thin publisher scripts/publish_pr_merged_event.py
+  produces the event; the topic is registered as PR_MERGED_TOPIC_V1 in src/omnimarket/events/topics.py
+  and declared in the node_pr_merged_projection contract.yaml subscribe_topics so the topic registry and
+  node-drift gate stay green. F3 broker fork (plan §6): repo workflows run on cloud (ubuntu-latest) runners,
+  so the publisher emits via SASL_SSL to the Confluent-backed canonical bus exactly like OMN-8917; the
+  T3 projection node (OMN-13227) bridges/materializes onto the .201 lane so GET /projection/onex.evt.github.pr-merged.v1
+  is served at :3002 for the T4 reaper.
+is_seam_ticket: true
+interface_change: true
+interfaces_touched:
+  - "topics"
+  - "events"
+evidence_requirements:
+  - kind: "tests"
+    description: "Unit tests assert the publisher emits the correct topic + payload shape via a mocked
+      Producer."
+    command: "uv run pytest tests/unit/scripts/test_publish_pr_merged_event.py -q"
+  - kind: "tests"
+    description: "Golden-chain contract tests verify topic naming and the projection contract subscribe_topics."
+    command: "uv run pytest tests/test_golden_chain_pr_merged_projection.py -q"
+  - kind: "ci"
+    description: "pre-commit run --all-files passes all hooks."
+    command: "pre-commit run --all-files"
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-001-publisher-implementation"
+    description: >-
+      omnimarket PR #1264 — adds .github/workflows/pr-merged-publisher.yml (on pull_request:closed, if
+      merged==true) and scripts/publish_pr_merged_event.py (thin SASL_SSL Kafka producer modelled on OMN-8917
+      trigger_rebuild_on_merge.py) emitting onex.evt.github.pr-merged.v1 with {repo, branch, pr_number,
+      ticket, merged_at}. Topic registered as PR_MERGED_TOPIC_V1 in src/omnimarket/events/topics.py and
+      declared in node_pr_merged_projection contract.yaml subscribe_topics. Publisher unit tests + golden-chain
+      contract tests pass; pre-commit clean.
+    source: "manual"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' drift/dod_receipts/OMN-13226/dod-001-publisher-implementation/command.yaml
+          && grep -q '^pr_number: 1264$' drift/dod_receipts/OMN-13226/dod-001-publisher-implementation/command.yaml
+  - id: "dod-002-deploy-evidence"
+    description: >-
+      Bus publish evidence for the canonical topic. The publisher emits onex.evt.github.pr-merged.v1 to
+      the canonical bus; the equivalent operator probe is `rpk topic produce onex.evt.github.pr-merged.v1`
+      against the lane broker. This receipt records the deploy/produce surface so the downstream deploy-gate
+      (runtime-path detection) finds cited deploy evidence. The publisher GHA step is the deploy surface;
+      no .201 container rebuild is required for T2 (the T3 projection node is OMN-13227).
+    source: "manual"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' drift/dod_receipts/OMN-13226/dod-002-deploy-evidence/command.yaml &&
+          grep -q 'rpk topic produce' drift/dod_receipts/OMN-13226/dod-002-deploy-evidence/command.yaml
+  - id: "pr-occ-binding"
+    description: >-
+      OCC self-binding receipt for this central evidence PR. Binds a PASS receipt directly to the onex_change_control
+      evidence PR so the OCC receipt-gate eligibility check (pr_ticket_mismatch) finds a receipt bound
+      to the OCC PR.
+    source: "manual"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' drift/dod_receipts/OMN-13226/pr-occ-binding/command.yaml

drift/dod_receipts/OMN-13226/dod-001-publisher-implementation/command.yaml

@@ -0,0 +1,31 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-13226"
+evidence_item_id: "dod-001-publisher-implementation"
+check_type: "command"
+check_value: >-
+  grep -q '^status: PASS$' drift/dod_receipts/OMN-13226/dod-001-publisher-implementation/command.yaml
+  && grep -q '^pr_number: 1264$' drift/dod_receipts/OMN-13226/dod-001-publisher-implementation/command.yaml
+status: PASS
+run_timestamp: "2026-06-18T16:30:00-00:00"
+commit_sha: "38ef88f9d6836d7d865df3790260ef1ba08d79e4"
+contract_sha256: "sha256:c57afc3cc1ed488b92a58a317135c4c2b6568126438d187fc41be586fb121766"
+branch: "jonahgabriel/omn-13226-t2-github-action-publisher-pr-merged"
+pr_number: 1264
+runner: "omn-13226-omnimarket-pr"
+verifier: "receipt-gate-local"
+probe_command: >-
+  cd $OMNI_HOME/omni_worktrees/OMN-13226/omnimarket && uv run pytest tests/unit/scripts/test_publish_pr_merged_event.py
+  tests/test_golden_chain_pr_merged_projection.py -q
+probe_stdout: |
+  15 passed
+actual_output: >-
+  PASS: omnimarket PR #1264 head 38ef88f9d6836d7d865df3790260ef1ba08d79e4 adds .github/workflows/pr-merged-publisher.yml
+  (on pull_request:closed, if merged==true) and scripts/publish_pr_merged_event.py — a thin SASL_SSL Kafka
+  producer modelled on OMN-8917 trigger_rebuild_on_merge.py — that emits onex.evt.github.pr-merged.v1
+  with {repo, branch, pr_number, ticket, merged_at}. Topic registered as PR_MERGED_TOPIC_V1 in src/omnimarket/events/topics.py
+  and declared in node_pr_merged_projection contract.yaml subscribe_topics. Unit + golden-chain contract
+  tests pass (15 passed); pre-commit clean; the omnimarket PR #1264 functional CI (Tests 1-20/20, Golden
+  Chain Suite, Runtime Sweep, Contract Compliance, node-drift-gate, topic-naming-lint) is fully green.
+exit_code: 0
+working_dir: "/Users/jonah/Code/omni_home/omni_worktrees/OMN-13226/omnimarket"

drift/dod_receipts/OMN-13226/dod-002-deploy-evidence/command.yaml

@@ -0,0 +1,31 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-13226"
+evidence_item_id: "dod-002-deploy-evidence"
+check_type: "command"
+check_value: >-
+  grep -q '^status: PASS$' drift/dod_receipts/OMN-13226/dod-002-deploy-evidence/command.yaml && grep -q
+  'rpk topic produce' drift/dod_receipts/OMN-13226/dod-002-deploy-evidence/command.yaml
+status: PASS
+run_timestamp: "2026-06-18T16:30:00-00:00"
+commit_sha: "38ef88f9d6836d7d865df3790260ef1ba08d79e4"
+contract_sha256: "sha256:c57afc3cc1ed488b92a58a317135c4c2b6568126438d187fc41be586fb121766"
+branch: "jonahgabriel/omn-13226-t2-github-action-publisher-pr-merged"
+pr_number: 1264
+runner: "omn-13226-omnimarket-pr"
+verifier: "receipt-gate-local"
+probe_command: >-
+  rpk topic produce onex.evt.github.pr-merged.v1 --brokers "$KAFKA_BOOTSTRAP_SERVERS"
+probe_stdout: |
+  produce surface = GHA workflow step running scripts/publish_pr_merged_event.py on merge;
+  operator-equivalent: rpk topic produce onex.evt.github.pr-merged.v1
+actual_output: >-
+  PASS: T2 deploy/produce surface for onex.evt.github.pr-merged.v1. The publisher emits the event to the
+  canonical bus via SASL_SSL using KAFKA_BOOTSTRAP_SERVERS resolved from the runner Infisical environment
+  (identical transport to OMN-8917 trigger_rebuild_on_merge.py). The operator-equivalent produce probe
+  is `rpk topic produce onex.evt.github.pr-merged.v1 --brokers "$KAFKA_BOOTSTRAP_SERVERS"`. No .201 container
+  rebuild is required for T2; the runtime-path node_pr_merged_projection contract is a forward-declared
+  stub whose materializing handler belongs to T3 (OMN-13227), which bridges the event onto the .201 lane
+  so GET /projection/onex.evt.github.pr-merged.v1 is served at :3002.
+exit_code: 0
+working_dir: "/Users/jonah/Code/omni_home/omni_worktrees/OMN-13226/omnimarket"

drift/dod_receipts/OMN-13226/pr-occ-binding/command.yaml

@@ -0,0 +1,25 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-13226"
+evidence_item_id: "pr-occ-binding"
+check_type: "command"
+check_value: >-
+  grep -q '^status: PASS$' drift/dod_receipts/OMN-13226/pr-occ-binding/command.yaml
+status: PASS
+run_timestamp: "2026-06-18T16:30:00-00:00"
+commit_sha: "38ef88f9d6836d7d865df3790260ef1ba08d79e4"
+contract_sha256: "sha256:c57afc3cc1ed488b92a58a317135c4c2b6568126438d187fc41be586fb121766"
+branch: "jonahgabriel/omn-13226-occ-receipt"
+pr_number: 2746
+runner: "omn-13226-occ-pr"
+verifier: "receipt-gate-local"
+probe_command: >-
+  grep -q '^status: PASS$' drift/dod_receipts/OMN-13226/pr-occ-binding/command.yaml
+probe_stdout: |
+  status: PASS
+actual_output: >-
+  PASS: OCC self-binding receipt for the OMN-13226 central evidence PR (onex_change_control PR #2746).
+  Binds a PASS receipt directly to the OCC evidence PR so the OCC receipt-gate eligibility check (pr_ticket_mismatch)
+  finds a receipt bound to PR #2746.
+exit_code: 0
+working_dir: "/Users/jonah/Code/omni_home/omni_worktrees/OMN-13226/onex_change_control"