evidence(OMN-13336): refresh omniclaude PR head binding

contracts/OMN-13336.yaml

@@ -32,8 +32,10 @@ dod_evidence:
       Per-code-PR binding receipt for omniclaude PR #1782 (jonah/omn-13336-plan-verified-state-ci-gate,
       base=dev). The PR adds scripts/lint_plan_verified_state.py, the plan-verified-state-gate.yml CI
       workflow, the lint-plan-verified-state pre-commit hook, the burn-down allowlist, 21 unit tests,
-      and the CLAUDE.md Standalone-Lint-Gates entry. Binds OMN-13336 to omniclaude PR #1782 by pr_number
-      and commit_sha so downstream Receipt Gate can resolve central OCC evidence for the citing PR.
+      the CLAUDE.md Standalone-Lint-Gates entry, and a minimal deployment/Dockerfile hardening change
+      that runs the image as an unprivileged user so the required image security scan can pass. Binds
+      OMN-13336 to omniclaude PR #1782 by pr_number and commit_sha so downstream Receipt Gate can resolve
+      central OCC evidence for the citing PR.
     source: "manual"
     status: "verified"
     checks:
@@ -56,10 +58,12 @@ dod_evidence:
           grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-gate-fail-closed-proof/command.yaml
   - id: "dod-deploy-no-runtime-impact"
     description: >-
-      Deploy-path DoD evidence for OMN-13336. The change is repository CI/pre-commit tooling only (a Python
-      lint script, a GHA workflow, a pre-commit hook entry, a ratchet allowlist, tests, and a docs table
-      row). It adds no runtime node, no Kafka topic, no contract, and no image-build input; it performs
-      no .201 mutation and gates no redeploy. There is nothing to deploy. deploy
+      Deploy-path DoD evidence for OMN-13336. The PR is primarily repository CI/pre-commit tooling (a
+      Python lint script, a GHA workflow, a pre-commit hook entry, a ratchet allowlist, tests, and a docs
+      table row) and now includes deployment/Dockerfile hardening to run the image as an unprivileged
+      user for the required container security scan. It adds no runtime node, no Kafka topic, and no contract.
+      No .201 mutation or live deploy was performed; the Dockerfile hardening takes effect only through
+      the normal dev -> promotion -> image rebuild path. deploy
     source: "manual"
     status: "verified"
     checks:

drift/dod_receipts/OMN-13336/dod-deploy-no-runtime-impact/command.yaml

@@ -5,10 +5,10 @@ evidence_item_id: "dod-deploy-no-runtime-impact"
 check_type: "command"
 check_value: >-
   grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-deploy-no-runtime-impact/command.yaml
-contract_sha256: "sha256:90ca68f031cf8e046121d7d24127cc47dc38dbe4ec32eaa502700b8e03acfb28"
+contract_sha256: "sha256:87b0afb8227eaaab0fc7e4043212c0e978ff19db6e2970458acae28ecfd423b6"
 status: PASS
 run_timestamp: "2026-06-19T19:10:00Z"
-commit_sha: "cc4db30fc74360f5812518de041dba5f130807c9"
+commit_sha: "22c7393b2c18ce14573568edb7128286b0daef1d"
 branch: "jonah/omn-13336-plan-verified-state-ci-gate"
 pr_number: 1782
 runner: "codex"
@@ -20,12 +20,13 @@ probe_stdout: |
   .onex_ratchets/plan_verified_state_allowlist.yaml
   .pre-commit-config.yaml
   CLAUDE.md
+  deployment/Dockerfile
   scripts/lint_plan_verified_state.py
   tests/scripts/test_lint_plan_verified_state.py
 actual_output: >-
-  PASS: OMN-13336 is repository CI/pre-commit tooling only. The diff touches a Python lint script, a GHA
-  workflow, a pre-commit hook entry, a ratchet allowlist, a unit-test module, and one CLAUDE.md docs row
-  — no runtime node, no Kafka topic, no node contract, no image-build input. The change reaches no .201
-  lane, gates no redeploy, and performs no production mutation. There is nothing to deploy; deploy-path
-  DoD is satisfied by the absence of any runtime surface. deploy
+  PASS: OMN-13336 is repository CI/pre-commit tooling plus Dockerfile hardening required by the container
+  security scan. The diff touches a Python lint script, a GHA workflow, a pre-commit hook entry, a ratchet
+  allowlist, a unit-test module, one CLAUDE.md docs row, and deployment/Dockerfile. It adds no runtime
+  node, no Kafka topic, and no node contract. No .201 mutation or live deploy was performed; the image
+  hardening takes effect through the normal dev -> promotion -> image rebuild path. deploy
 exit_code: 0

drift/dod_receipts/OMN-13336/dod-gate-fail-closed-proof/command.yaml

@@ -5,7 +5,7 @@ evidence_item_id: "dod-gate-fail-closed-proof"
 check_type: "command"
 check_value: >-
   grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-gate-fail-closed-proof/command.yaml
-contract_sha256: "sha256:90ca68f031cf8e046121d7d24127cc47dc38dbe4ec32eaa502700b8e03acfb28"
+contract_sha256: "sha256:87b0afb8227eaaab0fc7e4043212c0e978ff19db6e2970458acae28ecfd423b6"
 status: PASS
 run_timestamp: "2026-06-19T19:10:00Z"
 commit_sha: "cc4db30fc74360f5812518de041dba5f130807c9"

drift/dod_receipts/OMN-13336/dod-occ-pr-self/command.yaml

@@ -5,20 +5,20 @@ evidence_item_id: "dod-occ-pr-self"
 check_type: "command"
 check_value: >-
   grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-occ-pr-self/command.yaml
-contract_sha256: "sha256:90ca68f031cf8e046121d7d24127cc47dc38dbe4ec32eaa502700b8e03acfb28"
+contract_sha256: "sha256:87b0afb8227eaaab0fc7e4043212c0e978ff19db6e2970458acae28ecfd423b6"
 status: PASS
-run_timestamp: "2026-06-19T19:12:00Z"
-commit_sha: "54c211a21626182c2ff497450e97a09009f884c9"
-branch: "jonah/omn-13336-occ-evidence"
-pr_number: 2810
+run_timestamp: "2026-06-19T19:34:00Z"
+commit_sha: "87813117f67ce10dc90f07a1b49682952ae8a925"
+branch: "jonah/omn-13336-occ-evidence-refresh"
+pr_number: 2814
 runner: "codex"
 verifier: "receipt-gate-local"
 probe_command: >-
-  gh pr view 2810 --repo OmniNode-ai/onex_change_control --json number,state,headRefName,baseRefName,title
+  gh pr view 2814 --repo OmniNode-ai/onex_change_control --json number,state,headRefName,baseRefName,title
 probe_stdout: |
-  {"baseRefName":"dev","headRefName":"jonah/omn-13336-occ-evidence","number":2810,"state":"OPEN","title":"evidence(OMN-13336): OCC evidence for plan verified state gate"}
+  {"baseRefName":"dev","headRefName":"jonah/omn-13336-occ-evidence-refresh","number":2814,"state":"OPEN","title":"evidence(OMN-13336): refresh omniclaude PR head binding"}
 actual_output: >-
-  PASS: onex_change_control evidence PR #2810 carries the OMN-13336 contract, the omniclaude PR #1782
+  PASS: onex_change_control evidence PR #2814 carries the OMN-13336 contract, the omniclaude PR #1782
   code-PR binding receipt, the gate fail-closed proof receipt, and the deploy no-runtime-impact receipt.
   Binds the OCC PR itself by pr_number so the OCC receipt-gate eligibility check can resolve a PASS receipt
   for the evidence PR.

drift/dod_receipts/OMN-13336/dod-omniclaude-pr-1782/command.yaml

@@ -5,26 +5,27 @@ evidence_item_id: "dod-omniclaude-pr-1782"
 check_type: "command"
 check_value: >-
   grep -q '^status: PASS$' drift/dod_receipts/OMN-13336/dod-omniclaude-pr-1782/command.yaml
-contract_sha256: "sha256:90ca68f031cf8e046121d7d24127cc47dc38dbe4ec32eaa502700b8e03acfb28"
+contract_sha256: "sha256:87b0afb8227eaaab0fc7e4043212c0e978ff19db6e2970458acae28ecfd423b6"
 status: PASS
-run_timestamp: "2026-06-19T19:10:00Z"
-commit_sha: "cc4db30fc74360f5812518de041dba5f130807c9"
+run_timestamp: "2026-06-19T19:32:00Z"
+commit_sha: "22c7393b2c18ce14573568edb7128286b0daef1d"
 branch: "jonah/omn-13336-plan-verified-state-ci-gate"
 pr_number: 1782
 runner: "codex"
 verifier: "receipt-gate-local"
 probe_command: >-
   gh pr view 1782 --repo OmniNode-ai/omniclaude --json number,state,headRefName,headRefOid,baseRefName,title
 probe_stdout: |
-  {"baseRefName":"dev","headRefName":"jonah/omn-13336-plan-verified-state-ci-gate","headRefOid":"cc4db30fc74360f5812518de041dba5f130807c9","number":1782,"state":"OPEN","title":"feat(OMN-13336): plan-verified-state CI gate for plan_to_tickets plans (R1)"}
+  {"baseRefName":"dev","headRefName":"jonah/omn-13336-plan-verified-state-ci-gate","headRefOid":"22c7393b2c18ce14573568edb7128286b0daef1d","number":1782,"state":"OPEN","title":"feat(OMN-13336): plan-verified-state CI gate for plan_to_tickets plans (R1)"}
 actual_output: >-
-  PASS: omniclaude PR #1782 at commit cc4db30fc74360f5812518de041dba5f130807c9 ships the plan-verified-state
+  PASS: omniclaude PR #1782 at commit 22c7393b2c18ce14573568edb7128286b0daef1d ships the plan-verified-state
   gate on the plan_to_tickets host repo. Adds scripts/lint_plan_verified_state.py (stdlib-only parser
   over docs/plans/ + docs/tracking/ that FAILs on a missing/stale/malformed "## Current Verified State"
   section), .github/workflows/plan-verified-state-gate.yml (Plan Verified State Gate on pull_request +
   merge_group), the lint-plan-verified-state pre-commit hook, .onex_ratchets/plan_verified_state_allowlist.yaml
   (burn-down grandfather list for the 3 pre-existing docs), 21 unit tests in tests/scripts/test_lint_plan_verified_state.py,
-  and the CLAUDE.md Standalone-Lint-Gates row. ruff check / ruff format --check / mypy --ignore-missing-imports
-  clean; pre-commit run --all-files passes the new hook; tests/scripts/ green (133 passed / 3 skipped).
-  Binds OMN-13336 to omniclaude PR #1782 by pr_number and commit_sha.
+  the CLAUDE.md Standalone-Lint-Gates row, and deployment/Dockerfile hardening that runs the image as
+  an unprivileged user. ruff check / ruff format --check / mypy --ignore-missing-imports clean; pre-commit
+  run --all-files passes the new hook; tests/scripts/ green (133 passed / 3 skipped). Binds OMN-13336
+  to omniclaude PR #1782 by pr_number and commit_sha.
 exit_code: 0