ci(OMN-15241): wire reject-required-check-skip-vector pre-commit hook in onex_change_control

[jonahgabriel]

What

Wires the OMN-14854 Required-Check Skip-Vector Guard as a local pre-commit hook in onex_change_control.
Two files: .pre-commit-hooks/reject-required-check-skip-vector.sh (new) and the hook entry in
.pre-commit-config.yaml.

onex_change_control already calls the guard in CI via .github/workflows/required-check-skip-guard-caller.yml
but had no local hook, so a skip-vector violation committed with every local hook GREEN and was
caught CI-only — detection without local enforcement, the class root CLAUDE.md Rule #5 exists to kill.

Second file in this PR — .github/workflows/ci.yml. onex_change_control is the only one of the five that runs pre-commit run --all-files inside CI. The new hook is a LOCAL shift-left wrapper that resolves the canonical validator from $OMNI_HOME/omniclaude, which does not exist on a GitHub-hosted runner — left unhandled it would hard-error in CI for a missing sibling clone, not for a real skip vector. It is therefore added to the existing SKIP= list on the three pre-commit invocations, with an inline comment. Zero enforcement is lost: the identical validator already runs in this repo's CI on every PR via .github/workflows/required-check-skip-guard-caller.yml (required-check-skip-guard / check-skip-vectors). This removes a duplicate invocation, it is not a gate bypass — and the hook is deliberately NOT weakened with a CI-detecting exit 0 branch, which would have been the false-green shape the fail-loud meta-gate exists to reject.

Proof it runs where it should: this PR's own commit staged ci.yml, so the new hook fired at commit time and reported Reject skip vectors on required-check workflows (OMN-15241) ... Passed — an in-commit GREEN, not a (no files to check) Skipped.

How — DRY, not a re-implementation

The wrapper follows the omnibase_infra fan-out pattern (OMN-14865), not the omnibase_core
vendoring pattern: it executes the same validate_no_required_check_skip_vectors.py that the CI
reusable workflow executes, resolved from $OMNI_HOME/omniclaude. No validator logic is copied, so
local and CI verdicts cannot diverge on logic. Zero new detection surface, zero allowlist, no
skip-token.

Fail-loud (Rule #8 and the fail-loud pre-commit meta-gate): unset OMNI_HOME, a missing validator, or
no PyYAML-capable interpreter each exit 1 with remediation. There is no exit 0 degrade path
anywhere in the script.

One deliberate improvement over the omnibase_infra copy: interpreter resolution is
$PYTHON_BIN -> a python3 that can actually import yaml -> uv run --no-project --with pyyaml python -> hard error. A bare python3 on PATH is not guaranteed to have PyYAML (a uv-managed shim
commonly does not — reproduced on .200 this session), and a gate that hard-errors on every
workflow-touching commit for a missing third-party import is a gate developers rip out.

Proof — seeded RED then clean GREEN (local, .200)

Seeded an OMN-15057 vector-5 violation (needs: with no if: that provably runs regardless of the
needs result) into the required context verify / verify — job verify in call-receipt-gate.yml — then ran
the hook through the pre-commit framework against this repo's real config:

$ uv run pre-commit run reject-required-check-skip-vector --all-files
Reject skip vectors on required-check workflows (OMN-15241).......................Failed
- hook id: reject-required-check-skip-vector
- exit code: 1

FAIL: 1 required-check skip vector(s) found:

  - [vector-5-ungated-needs-cascade] required context 'verify / verify': caller job 'verify' in
    call-receipt-gate.yml has `needs: ['seed-omn15241-upstream']` with no `if:` that provably runs regardless
    of the needs result ...
RED_EXIT=1

Seed reverted, same command on the clean tree:

Reject skip vectors on required-check workflows (OMN-15241).......................Passed
GREEN_EXIT=0

The commit-refusal path was additionally proven end-to-end in omnibase_compat: with the seed staged,
git commit ran the full hook set, this hook reported Failed, and HEAD stayed at the base commit —
the commit was refused, not merely warned about.

Baseline check before wiring: the canonical validator was run against all five target repos' current
dev and returned PASS: no required-check skip vectors found in every one, so this hook lands GREEN
and blocks nothing that exists today.

Audit re-verification (ticket wording corrected)

OMN-15241 describes the five repos as carrying "the required guard". Re-probed live 2026-07-27 —
that is true for the caller workflow, not for the required status check:

repo	caller workflow	manifest mode	live required context on dev
omnimarket	yes	REQUIRED	yes
omnibase_spi	yes	ADVISORY	no
omnibase_compat	yes	ADVISORY	no
onex_change_control	yes	ADVISORY	no
omnidash	yes	ADVISORY	no

onex_change_control's own row is mode: ADVISORY. This does not weaken the hook: the validator iterates every
mode: REQUIRED row in .github/required-checks.yaml, and each of these repos has many other
REQUIRED contexts (the seeded RED above fired on one of them). It does mean the guard's own context
becomes load-bearing here only when the ADVISORY->REQUIRED branch-protection flip lands.

Scope / risk

Source-only. No lane mutation, no runtime touch, no branch-protection change, no merge. proof_class: code-only + local receipt-bound RED/GREEN.

Gates were run on .200 (stickybeatz-studio) per CLAUDE.md rule 11a, remote-only mode: every
mutation in this branch was made over ssh, never with a local Edit/Write, so there is no
edit-locality mismatch. Commit ran the repo's real pre-commit hook set; push originated on .200.

Evidence-Ticket: OMN-15241

Evidence-Source: 0ff7713

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 2 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 48614abc-3c7d-4229-8ed6-9b29e393e16a

📥 Commits

Reviewing files that changed from the base of the PR and between a08eb79 and 2c62403.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .pre-commit-config.yaml
• .pre-commit-hooks/reject-required-check-skip-vector.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-15241-onex_change_control-skip-vector-precommit-hook

---

_{Comment @coderabbitai help to get the list of available commands.}