evidence(OMN-14454): contract for the omnibase_infra DoD-runner canary

[jonahgabriel]

Closes OMN-14454

Unblocks omnibase_infra#2267 (the OMN-14436 canary), whose occ-preflight fails with missing_contract: OMN-14454.

Why this isn't just OMN-14436's contract — a constraint that only appeared once checks actually ran

A contract belongs to a TICKET, but its check_values execute in whatever REPO cites that ticket.

OMN-14436's contract is OCC-specific (pytest tests/test_dod_runner_ratchet.py, mypy scripts/ci/…, ruff scripts/ci/…). Run with cwd = the infra tree — exactly what the canary makes happen — it BLOCKs:

BLOCK  dod-ratchet-tests   exit 4     the test file doesn't exist in infra
BLOCK  dod-strict-mypy     exit 2
BLOCK  dod-ruff            exit 1
PASS   dod-verify-14436-digest-binding-in-source        <- gh api
PASS   dod-verify-14436-allowlist-fully-digest-bound    <- gh api

A cross-repo ticket cannot have one contract that passes in both repos. Note which two survived: the gh api content reads. They read GitHub, not the filesystem — workspace-independent, which is the same property that makes OMN-14418/OMN-14409 the known-good control group for this canary.

Every check here is a gh api content read, for exactly that reason.

Three product-observing checks on #2267

entry	asserts
dod-verify-2267-runner-executes-against-product	ci.yml actually invokes run_contract_compliance_check.py (not the dead validate-yaml, which never ran a single check_value — a green check meant only "OCC's YAML parses")
dod-verify-2267-gate-cannot-suppress-tests	contract-compliance is in no needs: list — a BLOCK can no longer skip the entire test suite
dod-verify-2267-occ-checkout-pinned	the OCC checkout carries a 40-hex ref: — it was unpinned, the same hazard that caused the original incident

RED proven against a ref where the artifact EXISTS but is WRONG

Not merely where it's absent. infra dev HAS ci.yml, HAS the contract-compliance job, HAS the checkout step — it just runs the dead executor, couples the gate to the test pipeline, and pins nothing.

check	#2267 head	infra dev (exists, wrong)	bogus SHA
runner invoked	0 GREEN	1 RED	1 RED
decoupled	0 GREEN	1 RED (coupled in 2 needs: lists)	1 RED
OCC pinned	0 GREEN	1 RED (no ref:)	1 RED

The naive decouple check is a VACUOUS GREEN — rejected here

"Count coupled needs: lines, require zero" passes against any ref with no ci.yml at all — zero lines trivially contain zero couplings.

A check that passes because the thing it inspects is ABSENT asserts nothing.

The shipped form requires needs: lists to exist (N > 0) and none to couple the gate. That's why the bogus-SHA column above is RED rather than a false green.

Re-proven from the YAML-round-tripped check_value. check_receipt_hardening rc=0 · lint_contract_check_values rc=0 · all three non-inert under the new runner.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 7 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0690364f-138a-48e7-9d61-a8c039075e0a

📥 Commits

Reviewing files that changed from the base of the PR and between a24e848 and 8a5a222.

📒 Files selected for processing (5)

• contracts/OMN-14454.yaml
• drift/dod_receipts/OMN-14454/dod-occ-self-14454/command.yaml
• drift/dod_receipts/OMN-14454/dod-verify-2267-gate-cannot-suppress-tests/command.yaml
• drift/dod_receipts/OMN-14454/dod-verify-2267-occ-checkout-pinned/command.yaml
• drift/dod_receipts/OMN-14454/dod-verify-2267-runner-executes-against-product/command.yaml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-14454-occ-contract

---

_{Comment @coderabbitai help to get the list of available commands.}