feat(OMN-10421): add contract + receipts for contract_sha256 hash-binding

contracts/OMN-10421.yaml

@@ -0,0 +1,52 @@
+---
+schema_version: '1.0.0'
+ticket_id: OMN-10421
+title: Hash-bind contract to receipt via contract_sha256
+summary: >-
+  Extends ModelDodReceipt with a contract_sha256 field (SHA-256 hex digest of the contract YAML at proof
+  time) and enforces hash-binding in receipt_gate.py so that mutating a contract after a receipt is produced
+  invalidates the receipt. Implements invariant I4 from the gate-collapse-fix plan (OMN-10410, T11).
+is_seam_ticket: false
+interface_change: true
+interfaces_touched:
+  - public_api
+emergency_bypass:
+  enabled: false
+  justification: ''
+  follow_up_ticket_id: ''
+dod_evidence:
+  - id: dod-001
+    description: >-
+      contract_sha256 field added to ModelDodReceipt with SHA-256 hex validator
+    source: manual
+    checks:
+      - check_type: command
+        check_value: >-
+          gh pr diff 1018 --repo OmniNode-ai/omnibase_core | grep -q 'contract_sha256'
+  - id: dod-002
+    description: >-
+      compute_contract_sha256 helper and hash-binding check present in receipt_gate.py
+    source: manual
+    checks:
+      - check_type: command
+        check_value: >-
+          gh pr diff 1018 --repo OmniNode-ai/omnibase_core | grep -q 'compute_contract_sha256'
+  - id: dod-003
+    description: >-
+      Four required test cases present and passing (matching, mismatch, pre-cutoff advisory, post-cutoff
+      fail)
+    source: manual
+    checks:
+      - check_type: command
+        check_value: >-
+          gh pr checks 1018 --repo OmniNode-ai/omnibase_core | grep -v fail | grep -c pass | grep -qv
+          '^0$'
+  - id: dod-004
+    description: >-
+      PR #1018 open against main on omnibase_core
+    source: manual
+    checks:
+      - check_type: command
+        check_value: >-
+          gh pr view 1018 --repo OmniNode-ai/omnibase_core --json state,baseRefName --jq 'select(.state=="OPEN"
+          and .baseRefName=="main") | "ok"' | grep -q ok

drift/dod_receipts/OMN-10421/dod-001/command.yaml

@@ -0,0 +1,26 @@
+---
+schema_version: "1.0.0"
+ticket_id: OMN-10421
+evidence_item_id: dod-001
+check_type: command
+check_value: "gh pr diff 1018 --repo OmniNode-ai/omnibase_core | grep -q 'contract_sha256'"
+status: PASS
+run_timestamp: "2026-04-30T10:50:00+00:00"
+commit_sha: efece354d8e39b881dd38aa9a50adcfd02a56460
+runner: worker-10421
+verifier: jonahgabriel
+probe_command: "gh pr diff 1018 --repo OmniNode-ai/omnibase_core | grep 'contract_sha256'"
+probe_stdout: |
+  +    contract_sha256: str | None = Field(
+  +        default=None,
+  +        description=(
+  +            "SHA-256 hex digest of the contract YAML file at the time this receipt "
+  +            "was produced (OMN-10421, invariant I4).
+  +    @field_validator("contract_sha256")
+  +    def _validate_contract_sha256(cls, v: str | None) -> str | None:
+  +        if receipt.contract_sha256 is None:
+  +        if receipt.contract_sha256 != actual_sha:
+  +            f"receipt contract_sha256={receipt.contract_sha256!r} but "
+  +    "_CONTRACT_SHA256_RE",
+exit_code: 0
+pr_number: 1018

drift/dod_receipts/OMN-10421/dod-002/command.yaml

@@ -0,0 +1,20 @@
+---
+schema_version: "1.0.0"
+ticket_id: OMN-10421
+evidence_item_id: dod-002
+check_type: command
+check_value: "gh pr diff 1018 --repo OmniNode-ai/omnibase_core | grep -q 'compute_contract_sha256'"
+status: PASS
+run_timestamp: "2026-04-30T10:50:00+00:00"
+commit_sha: efece354d8e39b881dd38aa9a50adcfd02a56460
+runner: worker-10421
+verifier: jonahgabriel
+probe_command: "gh pr diff 1018 --repo OmniNode-ai/omnibase_core | grep 'compute_contract_sha256'"
+probe_stdout: |
+  +def compute_contract_sha256(contract_path: Path) -> str:
+  +    """Return the SHA-256 hex digest of a contract YAML file's raw bytes."""
+  +    return hashlib.sha256(contract_path.read_bytes()).hexdigest()
+  +    actual_sha = compute_contract_sha256(contract_path)
+  +    "compute_contract_sha256",
+exit_code: 0
+pr_number: 1018

drift/dod_receipts/OMN-10421/dod-003/command.yaml

@@ -0,0 +1,26 @@
+---
+schema_version: "1.0.0"
+ticket_id: OMN-10421
+evidence_item_id: dod-003
+check_type: command
+check_value: "gh pr checks 1018 --repo OmniNode-ai/omnibase_core | grep -v fail | grep -c pass | grep
+  -qv '^0$'"
+status: PASS
+run_timestamp: "2026-04-30T10:50:00+00:00"
+commit_sha: efece354d8e39b881dd38aa9a50adcfd02a56460
+runner: worker-10421
+verifier: jonahgabriel
+probe_command: "env -u PYTHONPATH uv run pytest tests/unit/validation/test_receipt_gate_contract_sha256.py
+  -v --tb=short"
+probe_stdout: |
+  tests/unit/validation/test_receipt_gate_contract_sha256.py::TestContractSha256HashBinding::test_matching_contract_sha256_passes PASSED
+  tests/unit/validation/test_receipt_gate_contract_sha256.py::TestContractSha256HashBinding::test_mismatched_contract_sha256_fails PASSED
+  tests/unit/validation/test_receipt_gate_contract_sha256.py::TestContractSha256HashBinding::test_missing_contract_sha256_post_cutoff_hard_fails PASSED
+  tests/unit/validation/test_receipt_gate_contract_sha256.py::TestContractSha256HashBinding::test_missing_contract_sha256_pre_cutoff_is_advisory_fail PASSED
+  tests/unit/validation/test_receipt_gate_contract_sha256.py::TestContractSha256HashBinding::test_missing_pr_opened_at_skips_hash_check PASSED
+  tests/unit/validation/test_receipt_gate_contract_sha256.py::TestComputeContractSha256::test_sha256_changes_when_content_changes PASSED
+  tests/unit/validation/test_receipt_gate_contract_sha256.py::TestComputeContractSha256::test_sha256_is_64_lowercase_hex PASSED
+  tests/unit/validation/test_receipt_gate_contract_sha256.py::TestComputeContractSha256::test_sha256_matches_hashlib PASSED
+  8 passed in 2.97s
+exit_code: 0
+pr_number: 1018

drift/dod_receipts/OMN-10421/dod-004/command.yaml

@@ -0,0 +1,18 @@
+---
+schema_version: "1.0.0"
+ticket_id: OMN-10421
+evidence_item_id: dod-004
+check_type: command
+check_value: "gh pr view 1018 --repo OmniNode-ai/omnibase_core --json state,baseRefName --jq 'select(.state==\"OPEN\"
+  and .baseRefName==\"main\") | \"ok\"' | grep -q ok"
+status: PASS
+run_timestamp: "2026-04-30T10:50:00+00:00"
+commit_sha: efece354d8e39b881dd38aa9a50adcfd02a56460
+runner: worker-10421
+verifier: jonahgabriel
+probe_command: "gh pr view 1018 --repo OmniNode-ai/omnibase_core --json state,baseRefName --jq '.state
+  + \" \" + .baseRefName'"
+probe_stdout: |
+  OPEN main
+exit_code: 0
+pr_number: 1018