evidence(OMN-10855): bind omninode_infra merge queue PRs

contracts/OMN-10855.yaml

@@ -0,0 +1,64 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-10855"
+title: "Secure workflow gateway P0 slice"
+summary: >
+  omninode_infra PR #616 adds tenant-scoped workflow ingress routes, workflow-contract allowlist validation,
+  and the single-replica token-bucket rate-limit seam for the secure workflow gateway P0 slice.
+is_seam_ticket: true
+interface_change: true
+interfaces_touched:
+  - public_api
+  - topics
+evidence_requirements:
+  - kind: "manual"
+    description: "omninode_infra PR #616 is open at the recorded head with the gateway/API diff."
+    command: "grep -q '^status: PASS$' drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-head/command.yaml"
+  - kind: "ci"
+    description: "CI and onex-api-tests succeeded for omninode_infra PR #616 at the recorded head."
+    command: "grep -q '^status: PASS$' drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-ci/command.yaml"
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-omninode_infra-pr-616-head"
+    description: >
+      Binds omninode_infra PR #616 at head 2ea0583ed365d58931cd14fb0395f0cfb208d1ff.
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-head/command.yaml
+          && grep -q '2ea0583ed365d58931cd14fb0395f0cfb208d1ff' drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-head/command.yaml
+  - id: "dod-omninode_infra-pr-616-product-diff-scope"
+    description: "PR #616 product diff scope covers the workflow gateway routes, contracts, migrations,
+      tests, and deployment seam."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          grep -q '^status: PASS$' drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-product-diff-scope/command.yaml
+          && grep -q 'docker/onex-api/routers/workflows.py' drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-product-diff-scope/command.yaml
+          && grep -q 'docker/onex-api/workflow-contracts.yaml' drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-product-diff-scope/command.yaml
+          && grep -q 'k8s/onex-dev/api/deployment.yaml' drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-product-diff-scope/command.yaml
+  - id: "dod-omninode_infra-pr-616-ci"
+    description: "CI and onex-api-tests runs completed successfully at PR #616 head."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          python -c "from pathlib import Path; t=Path('drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-ci/command.yaml').read_text();
+          assert 'status: PASS' in t and 'name\":\"CI' in t and 'name\":\"onex-api-tests' in t and '2ea0583ed365d58931cd14fb0395f0cfb208d1ff'
+          in t"
+  - id: "occ-self-bind-pr-4604-omn10855"
+    description: "OCC companion PR #4604 carries central OMN-10855 evidence for omninode_infra#616."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          gh pr view 4604 --repo OmniNode-ai/onex_change_control --json number,state,headRefOid,headRefName

contracts/OMN-14153.yaml

@@ -89,3 +89,49 @@ dod_evidence:
       - check_type: "command"
         check_value: "PR_NUMBER=4307; REPO=OmniNode-ai/onex_change_control; gh pr view ${PR_NUMBER} --repo
           ${REPO} --json number,state"
+  - id: "occ-self-bind-pr-4294-supersede-0001"
+    description: "Append-only replacement for legacy inert-token OCC self-bind check occ-self-bind-pr-4294."
+    source: "manual"
+    status: "verified"
+    evidence_artifact: "supersedes_dod_evidence:occ-self-bind-pr-4294"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr view 4294 --repo OmniNode-ai/onex_change_control --json number,state"
+  - id: "occ-self-bind-pr-4295-supersede-0001"
+    description: "Append-only replacement for legacy inert-token OCC self-bind check occ-self-bind-pr-4295."
+    source: "manual"
+    status: "verified"
+    evidence_artifact: "supersedes_dod_evidence:occ-self-bind-pr-4295"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr view 4295 --repo OmniNode-ai/onex_change_control --json number,state"
+  - id: "occ-self-bind-pr-4307-supersede-0001"
+    description: "Append-only replacement for legacy inert-token OCC self-bind check occ-self-bind-pr-4307."
+    source: "manual"
+    status: "verified"
+    evidence_artifact: "supersedes_dod_evidence:occ-self-bind-pr-4307"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr view 4307 --repo OmniNode-ai/onex_change_control --json number,state"
+  - id: "dod-OmniNode-ai-omninode_infra-pr-617"
+    description: "PR #617 on OmniNode-ai/omninode_infra — OMN-14153 main OIDC build input promotion binding."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr view 617 --repo OmniNode-ai/omninode_infra --json number,state,headRefOid,headRefName"
+  - id: "dod-OmniNode-ai-omninode_infra-pr-617-ci"
+    description: "PR #617 on OmniNode-ai/omninode_infra — product diff scope is limited to omnidash build
+      workflow and Dockerfile inputs."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr diff 617 --repo OmniNode-ai/omninode_infra --name-only"
+  - id: "occ-self-bind-pr-4604-omn14153"
+    description: "OCC companion PR #4604 carries central OMN-14153 evidence for omninode_infra#617."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr view 4604 --repo OmniNode-ai/onex_change_control --json number,state,headRefOid,headRefName"

contracts/OMN-14642.yaml

@@ -71,3 +71,30 @@ dod_evidence:
     checks:
       - check_type: command
         check_value: gh pr view ${PR_NUMBER} --repo ${REPO} --json number,state,headRefOid
+  - id: dod-omninode_infra-pr-614-head
+    description: >
+      Binds omninode_infra PR #614 at head c3dac92ea747c82a171d73b9418b7a2d9ce328d6 for the OMN-14642
+      omnidash staging image pin.
+    source: manual
+    status: verified
+    checks:
+      - check_type: command
+        check_value: >-
+          gh pr view 614 --repo OmniNode-ai/omninode_infra --json number,state,headRefOid,headRefName
+  - id: dod-omninode_infra-pr-614-product-diff-scope
+    description: >
+      PR #614 product diff scope is limited to k8s/onex-dev/omnidash/deployment.yaml.
+    source: manual
+    status: verified
+    checks:
+      - check_type: command
+        check_value: >-
+          gh pr diff 614 --repo OmniNode-ai/omninode_infra --name-only
+  - id: occ-self-bind-pr-4604-omn14642
+    description: OCC companion PR  #4604 carries central OMN-14642 evidence for omninode_infra#614.
+    source: manual
+    status: verified
+    checks:
+      - check_type: command
+        check_value: >-
+          gh pr view 4604 --repo OmniNode-ai/onex_change_control --json number,state,headRefOid,headRefName

contracts/OMN-14929.yaml

@@ -0,0 +1,58 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-14929"
+title: "Repair onex-dev runtime overlay kustomize patch"
+summary: >
+  omninode_infra PR #615 splits the multi-document runtime recovery strategic-merge patch into single-document
+  patch files for onex-dev and onex-prod so kustomize can build the runtime overlays again.
+is_seam_ticket: false
+interface_change: false
+interfaces_touched: []
+evidence_requirements:
+  - kind: "manual"
+    description: "omninode_infra PR #615 is open at the recorded head with the runtime overlay patch split."
+    command: "grep -q '^status: PASS$' drift/dod_receipts/OMN-14929/dod-omninode_infra-pr-615-head/command.yaml"
+  - kind: "ci"
+    description: "K8s Manifest Validation succeeded for omninode_infra PR #615 at the recorded head."
+    command: "grep -q '^status: PASS$' drift/dod_receipts/OMN-14929/dod-omninode_infra-pr-615-kustomize-ci/command.yaml"
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-omninode_infra-pr-615-head"
+    description: >
+      Binds omninode_infra PR #615 at head 8b868062a4ba2cb9f1521c81f2e9b6611b33de82.
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          gh pr view 615 --repo OmniNode-ai/omninode_infra --json number,state,headRefOid,headRefName
+  - id: "dod-omninode_infra-pr-615-product-diff-scope"
+    description: "PR #615 product diff scope is limited to the runtime overlay kustomization and split
+      recovery patch files."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          gh pr diff 615 --repo OmniNode-ai/omninode_infra --name-only
+  - id: "dod-omninode_infra-pr-615-kustomize-ci"
+    description: "K8s Manifest Validation run 29933290328 completed successfully at PR #615 head."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          test "$(gh run view 29933290328 --repo OmniNode-ai/omninode_infra --json conclusion --jq .conclusion)"
+          = success && test "$(gh run view 29933290328 --repo OmniNode-ai/omninode_infra --json headSha
+          --jq .headSha)" = 8b868062a4ba2cb9f1521c81f2e9b6611b33de82
+  - id: "occ-self-bind-pr-4604-omn14929"
+    description: "OCC companion PR #4604 carries central OMN-14929 evidence for omninode_infra#615."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          gh pr view 4604 --repo OmniNode-ai/onex_change_control --json number,state,headRefOid,headRefName

drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-ci/command.yaml

@@ -0,0 +1,27 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-10855"
+evidence_item_id: "dod-omninode_infra-pr-616-ci"
+check_type: "command"
+check_value: >-
+  test "$(gh run view 29941317150 --repo OmniNode-ai/omninode_infra --json conclusion --jq .conclusion)"
+  = success && test "$(gh run view 29941317150 --repo OmniNode-ai/omninode_infra --json headSha --jq .headSha)"
+  = 2ea0583ed365d58931cd14fb0395f0cfb208d1ff && test "$(gh run view 29941317088 --repo OmniNode-ai/omninode_infra
+  --json conclusion --jq .conclusion)" = success && test "$(gh run view 29941317088 --repo OmniNode-ai/omninode_infra
+  --json headSha --jq .headSha)" = 2ea0583ed365d58931cd14fb0395f0cfb208d1ff
+contract_entry_sha256: "sha256:bfc8c588df462d5b25951ebf1f2b5b20b6fdc5fbaf6dbea349c153bf035dfd82"
+status: PASS
+run_timestamp: "2026-07-22T17:55:00Z"
+commit_sha: "2ea0583ed365d58931cd14fb0395f0cfb208d1ff"
+runner: "codex-letter"
+verifier: "github-actions-run-readback"
+probe_command: "gh run view 29941317150 --repo OmniNode-ai/omninode_infra --json conclusion,headSha,name
+  && gh run view 29941317088 --repo OmniNode-ai/omninode_infra --json conclusion,headSha,name"
+probe_stdout: |
+  {"conclusion":"success","headSha":"2ea0583ed365d58931cd14fb0395f0cfb208d1ff","name":"CI"}
+  {"conclusion":"success","headSha":"2ea0583ed365d58931cd14fb0395f0cfb208d1ff","name":"onex-api-tests"}
+actual_output: "PASS: CI and onex-api-tests succeeded for omninode_infra#616 at the recorded OMN-10855
+  head."
+exit_code: 0
+pr_number: 616
+branch: "codex-letter/omninode-infra-614-617-occ"

drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-head/command.yaml

@@ -0,0 +1,19 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-10855"
+evidence_item_id: "dod-omninode_infra-pr-616-head"
+check_type: "command"
+check_value: "gh pr view 616 --repo OmniNode-ai/omninode_infra --json number,state,headRefOid,headRefName"
+contract_entry_sha256: "sha256:c5b4c8f62fd5c4baa8fe476b8240c343fadd97712320dba4ec17778055c7ca93"
+status: PASS
+run_timestamp: "2026-07-22T17:55:00Z"
+commit_sha: "2ea0583ed365d58931cd14fb0395f0cfb208d1ff"
+runner: "codex-letter"
+verifier: "github-pr-live-readback"
+probe_command: "gh pr view 616 --repo OmniNode-ai/omninode_infra --json number,state,headRefOid,headRefName"
+probe_stdout: |
+  {"headRefName":"jonah/omn-10855-secure-workflow-gateway","headRefOid":"2ea0583ed365d58931cd14fb0395f0cfb208d1ff","number":616,"state":"OPEN"}
+actual_output: "PASS: omninode_infra#616 is open at the recorded OMN-10855 secure workflow gateway head."
+exit_code: 0
+pr_number: 616
+branch: "codex-letter/omninode-infra-614-617-occ"

drift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-product-diff-scope/command.yaml

@@ -0,0 +1,43 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-10855"
+evidence_item_id: "dod-omninode_infra-pr-616-product-diff-scope"
+check_type: "command"
+check_value: "gh pr diff 616 --repo OmniNode-ai/omninode_infra --name-only"
+contract_entry_sha256: "sha256:eab21c788072d80a01f7c072464d2c539790ae4b09dff5733d827f9b85145fce"
+status: PASS
+run_timestamp: "2026-07-22T17:55:00Z"
+commit_sha: "2ea0583ed365d58931cd14fb0395f0cfb208d1ff"
+runner: "codex-letter"
+verifier: "github-pr-files-scope"
+probe_command: "gh pr diff 616 --repo OmniNode-ai/omninode_infra --name-only"
+probe_stdout: |
+  .github/workflows/onex-api-tests.yml
+  .github/workflows/validate-deployment-manifests.yml
+  db/migrations/20260721_gateway_workflows.sql
+  db/migrations/rollback/20260721_gateway_workflows_rollback.sql
+  docker/onex-api/auth_api_keys.py
+  docker/onex-api/gateway-routes.yaml
+  docker/onex-api/main.py
+  docker/onex-api/middleware/contract_validator.py
+  docker/onex-api/models/model_gateway_routes.py
+  docker/onex-api/models/model_workflow_contracts.py
+  docker/onex-api/models/model_workflow_envelope.py
+  docker/onex-api/routers/workflows.py
+  docker/onex-api/tests/mocks.py
+  docker/onex-api/tests/test_gateway_routes.py
+  docker/onex-api/tests/test_workflow_contracts.py
+  docker/onex-api/tests/test_workflow_rate_limit.py
+  docker/onex-api/tests/test_workflow_rate_limit_replica_seam.py
+  docker/onex-api/tests/test_workflows_router.py
+  docker/onex-api/topic_constants.py
+  docker/onex-api/workflow-contracts.yaml
+  docker/onex-api/workflow_contracts.py
+  docker/onex-api/workflow_publisher.py
+  docker/onex-api/workflow_rate_limit.py
+  k8s/onex-dev/api/deployment.yaml
+actual_output: "PASS: product diff scope for OMN-10855 from omninode_infra#616 covers workflow gateway
+  routes, contracts, migrations, tests, and deployment seam."
+exit_code: 0
+pr_number: 616
+branch: "codex-letter/omninode-infra-614-617-occ"

drift/dod_receipts/OMN-10855/occ-self-bind-pr-4604-omn10855/command.yaml

@@ -0,0 +1,19 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-10855"
+evidence_item_id: "occ-self-bind-pr-4604-omn10855"
+check_type: "command"
+check_value: "gh pr view 4604 --repo OmniNode-ai/onex_change_control --json number,state,headRefOid,headRefName"
+contract_entry_sha256: "sha256:65ad78734579ab20d69a3efc71886b153c7f00af9e35b2f485dca8429df76bfe"
+status: PASS
+run_timestamp: "2026-07-22T18:15:00Z"
+commit_sha: "1fa65cba0d4e15266bfd6c049dc7371f8f11cdb5"
+runner: "codex-letter"
+verifier: "occ-self-bind"
+probe_command: "gh pr view 4604 --repo OmniNode-ai/onex_change_control --json number,state,headRefOid,headRefName"
+probe_stdout: |
+  {"headRefName":"codex-letter/omninode-infra-614-617-occ","headRefOid":"1fa65cba0d4e15266bfd6c049dc7371f8f11cdb5","number":4604,"state":"OPEN"}
+actual_output: "PASS: OCC companion self-bind for OMN-10855 via onex_change_control#4604."
+exit_code: 0
+pr_number: 4604
+branch: "codex-letter/omninode-infra-614-617-occ"

drift/dod_receipts/OMN-14153/dod-OmniNode-ai-omninode_infra-pr-617-ci/command.yaml

@@ -0,0 +1,21 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-14153"
+evidence_item_id: "dod-OmniNode-ai-omninode_infra-pr-617-ci"
+check_type: "command"
+check_value: "gh pr diff 617 --repo OmniNode-ai/omninode_infra --name-only"
+contract_entry_sha256: "sha256:fc61e533947d43aa9f6e5ca13055103e02ae750c0dfb6237d97967da520a07d7"
+status: PASS
+run_timestamp: "2026-07-22T17:55:00Z"
+commit_sha: "1fd3f5ea576d37f0205859b9cd14c5d987b488d5"
+runner: "codex-letter"
+verifier: "github-pr-files-scope"
+probe_command: "gh pr diff 617 --repo OmniNode-ai/omninode_infra --name-only"
+probe_stdout: |
+  .github/workflows/build-and-push-omnidash.yml
+  docker/omnidash/Dockerfile
+actual_output: "PASS: product diff scope for OMN-14153 from omninode_infra#617 is limited to omnidash
+  build workflow and Dockerfile inputs."
+exit_code: 0
+pr_number: 617
+branch: "codex-letter/omninode-infra-614-617-occ"

drift/dod_receipts/OMN-14153/dod-OmniNode-ai-omninode_infra-pr-617/command.yaml

@@ -0,0 +1,20 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-14153"
+evidence_item_id: "dod-OmniNode-ai-omninode_infra-pr-617"
+check_type: "command"
+check_value: "gh pr view 617 --repo OmniNode-ai/omninode_infra --json number,state,headRefOid,headRefName"
+contract_entry_sha256: "sha256:e6a436280edf425c061e53b885549acfd5df8f4fcc9ff9c973f9244df6081b1b"
+status: PASS
+run_timestamp: "2026-07-22T17:55:00Z"
+commit_sha: "1fd3f5ea576d37f0205859b9cd14c5d987b488d5"
+runner: "codex-letter"
+verifier: "github-pr-live-readback"
+probe_command: "gh pr view 617 --repo OmniNode-ai/omninode_infra --json number,state,headRefOid,headRefName"
+probe_stdout: |
+  {"headRefName":"fix/omn-14153-main-oidc-build-args","headRefOid":"1fd3f5ea576d37f0205859b9cd14c5d987b488d5","number":617,"state":"OPEN"}
+actual_output: "PASS: omninode_infra#617 is open at the recorded OMN-14153 OIDC build input promotion
+  head."
+exit_code: 0
+pr_number: 617
+branch: "codex-letter/omninode-infra-614-617-occ"

drift/dod_receipts/OMN-14153/occ-self-bind-pr-4294-supersede-0001/command.yaml

@@ -0,0 +1,19 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-14153"
+evidence_item_id: "occ-self-bind-pr-4294-supersede-0001"
+check_type: "command"
+check_value: "gh pr view 4294 --repo OmniNode-ai/onex_change_control --json number,state"
+contract_entry_sha256: "sha256:9ef0f2044490a5ef1fd01256eec6efd07a29d51c7d7254fb7305e2fee55d0578"
+status: PASS
+run_timestamp: "2026-07-22T18:20:00Z"
+commit_sha: "1eb2b67546f0469eb816edf9db9a088058c589e8"
+runner: "codex-letter"
+verifier: "append-only-supersession"
+probe_command: "gh pr view 4294 --repo OmniNode-ai/onex_change_control --json number,state"
+probe_stdout: |
+  {"number":4294,"state":"MERGED"}
+actual_output: "PASS: append-only supersession for OMN-14153 OCC#4294 self-bind check."
+exit_code: 0
+pr_number: 4294
+branch: "codex-letter/omninode-infra-614-617-occ"

drift/dod_receipts/OMN-14153/occ-self-bind-pr-4295-supersede-0001/command.yaml

@@ -0,0 +1,19 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-14153"
+evidence_item_id: "occ-self-bind-pr-4295-supersede-0001"
+check_type: "command"
+check_value: "gh pr view 4295 --repo OmniNode-ai/onex_change_control --json number,state"
+contract_entry_sha256: "sha256:fbaa1019833e3349a9181a3c89d0c6588abf5ce2eb7c702cb796a1af27ea4ee0"
+status: PASS
+run_timestamp: "2026-07-22T18:20:00Z"
+commit_sha: "9e26141812364bac6bf1f96d38384bd49b51c932"
+runner: "codex-letter"
+verifier: "append-only-supersession"
+probe_command: "gh pr view 4295 --repo OmniNode-ai/onex_change_control --json number,state"
+probe_stdout: |
+  {"number":4295,"state":"MERGED"}
+actual_output: "PASS: append-only supersession for OMN-14153 OCC#4295 self-bind check."
+exit_code: 0
+pr_number: 4295
+branch: "codex-letter/omninode-infra-614-617-occ"