feat(OMN-10420): contract + receipts for ticket-identity binding

[jonahgabriel]

Summary

• Adds contracts/OMN-10420.yaml with 4 DoD evidence items for the ticket-identity binding feature
• Adds PASS receipts under drift/dod_receipts/OMN-10420/ for all 4 items
• Pairs with omnibase_core PR receipt(OMN-11025): add delegation DTO evidence #1019 implementing invariant I3

OMN-10420

Evidence-Source: jonah/omn-10420-ticket-identity-binding
Evidence-Ticket: OMN-10420

Test plan

• Contract YAML validates against ModelTicketContract (pre-commit hook passed)
• 4 receipts with status=PASS, distinct runner/verifier, non-empty probe_stdout
• dod-001: 9 identity-binding tests pass (5 required plan cases)
• dod-002: 68 existing receipt_gate tests pass (no regressions)
• dod-003: EVIDENCE_SOURCE/TICKET_PATTERN exported in all
• dod-004: CLI --evidence-ticket and --branch-name flags present

Summary by CodeRabbit

• New Features

  • Receipt gate CLI now supports --evidence-ticket and --branch-name options.

• Tests

  • Added comprehensive unit and integration validation tests covering identity-binding cases; all recorded test runs show passing results.

• Chores

  • Added structured evidence records and a contract entry documenting required validation checks and acceptance criteria.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bb2b206a-919e-4f1a-9324-85d68dbf48a7

📥 Commits

Reviewing files that changed from the base of the PR and between 298900a and ea4212f.

📒 Files selected for processing (5)

• contracts/OMN-10420.yaml
• drift/dod_receipts/OMN-10420/dod-001/command.yaml
• drift/dod_receipts/OMN-10420/dod-002/command.yaml
• drift/dod_receipts/OMN-10420/dod-003/command.yaml
• drift/dod_receipts/OMN-10420/dod-004/command.yaml

✅ Files skipped from review due to trivial changes (4)

• drift/dod_receipts/OMN-10420/dod-003/command.yaml
• drift/dod_receipts/OMN-10420/dod-001/command.yaml
• drift/dod_receipts/OMN-10420/dod-004/command.yaml
• drift/dod_receipts/OMN-10420/dod-002/command.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• contracts/OMN-10420.yaml

---

📝 Walkthrough

Walkthrough

Adds a contract for OMN-10420 declaring ticket‑identity binding enforcement in receipt_gate.py and four DoD evidence records documenting required CI checks: unit tests for identity binding, broader receipt_gate test suite, exported constant presence, and CLI help showing required flags.

Changes

Cohort / File(s)	Summary
Contract Definition contracts/OMN-10420.yaml	New YAML contract (schema 1.0.0) declaring an interface change (ticket-identity binding), disabling emergency bypass, and listing four DoD items with required CI evidence commands and patterns.
DoD Evidence — dod-001 drift/dod_receipts/OMN-10420/dod-001/command.yaml	Adds a command record showing a unit pytest run for receipt_gate identity-binding cases with status: PASS and captured stdout listing each test as PASSED.
DoD Evidence — dod-002 drift/dod_receipts/OMN-10420/dod-002/command.yaml	Adds a command record for running multiple receipt_gate test modules (adversarial, allowlist, hardening, workflow-shape, CLI) with status: PASS and aggregated pytest summary.
DoD Evidence — dod-003 drift/dod_receipts/OMN-10420/dod-003/command.yaml	Adds a command record that imports omnibase_core.validation.receipt_gate, checks EVIDENCE_SOURCE_PATTERN and EVIDENCE_TICKET_PATTERN are present in __all__, and records ok / status: PASS.
DoD Evidence — dod-004 drift/dod_receipts/OMN-10420/dod-004/command.yaml	Adds a command record that runs the receipt gate CLI help and verifies presence of --evidence-ticket and --branch-name flags, recording status: PASS and matching help output.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I hopped through YAML, firm and spry,
I bound each ticket, watched tests fly,
Evidence lined up, flags in sight,
The receipt gate hums into the night. 🥕✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a contract and receipts for the ticket-identity binding feature (OMN-10420), matching the PR's core objective of adding contract YAML and DoD evidence files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-10420-ticket-identity-binding

---

_{Review rate limit: 0/5 reviews remaining, refill in 58 minutes and 50 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@contracts/OMN-10420.yaml`:
- Around line 41-47: The current check only verifies those names are importable;
update the command check to assert that EVIDENCE_SOURCE_PATTERN and
EVIDENCE_TICKET_PATTERN are present in the module's __all__ instead: load
omnibase_core.validation.receipt_gate, then inspect its __all__ attribute and
fail unless both "EVIDENCE_SOURCE_PATTERN" and "EVIDENCE_TICKET_PATTERN" are
listed; reference the module name omnibase_core.validation.receipt_gate and the
symbols EVIDENCE_SOURCE_PATTERN and EVIDENCE_TICKET_PATTERN so the check
enforces explicit export membership rather than mere importability.
- Around line 49-54: The check currently uses a single grep with alternation
which passes if either flag exists; update the check_value in
contracts/OMN-10420.yaml so the CLI help is tested for both flags (e.g., run the
help command twice or capture output once and test both patterns): replace the
single pipe to grep -E 'evidence-ticket|branch-name' with a command that ensures
both are present, such as `python -m omnibase_core.validation.receipt_gate_cli
--help | grep -E 'evidence-ticket' && python -m
omnibase_core.validation.receipt_gate_cli --help | grep -E 'branch-name'` (or
capture output once and run two greps), so the check verifies presence of both
--evidence-ticket and --branch-name.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ab9d4ca0-6966-42fd-bb9b-2f307909dc15

📥 Commits

Reviewing files that changed from the base of the PR and between 0ef1be5 and 298900a.

📒 Files selected for processing (5)

• contracts/OMN-10420.yaml
• drift/dod_receipts/OMN-10420/dod-001/command.yaml
• drift/dod_receipts/OMN-10420/dod-002/command.yaml
• drift/dod_receipts/OMN-10420/dod-003/command.yaml
• drift/dod_receipts/OMN-10420/dod-004/command.yaml