[jonahgabriel]

Summary

OMN-15689 (R3a) resolves the omnibase_core/omnibase_compat validator ref dynamically from the PR's base branch, with no fallback (deliberate fail-closed per the operator ruling — no hardcoded ref anywhere). Both call-receipt-gate.yml and call-occ-preflight.yml still trigger on hotfix/** base branches. A hotfix-targeted PR here whose base branch name doesn't also exist as a branch name in omnibase_core/omnibase_compat fails the checkout step hard instead of producing a real gate verdict on verify / verify / occ-preflight / eligibility.

Decision: propose-and-proceed, Option A (the ticket's scoping comment framed two options; this session decided A). Option B — accept the fail-closed posture permanently and close as won't-fix, citing the bounded-blast-radius argument already documented in each workflow's on: comment block (hotfix bases carry no branch protection; non-dev-base-guard already requires a Stacked-Parent: declaration on hotfix-targeted PRs) — remains available to the operator on review of this PR.

Change

In the validator_ref step of both workflows: after resolving resolved_ref from the PR base ref / merge_group base ref (unchanged, still fails closed with no fallback if unresolvable), add a scoped fallback:

• Only when resolved_ref matches hotfix/**, probe omnibase_core/omnibase_compat for a branch of that exact name (gh api repos/OmniNode-ai/<repo>/branches/<ref>).
• If not found, fall back to that repo's own default branch, resolved dynamically via gh api repos/OmniNode-ai/<repo> --jq '.default_branch' — never a hardcoded @main/@dev literal (mirrors the existing resolve_occ_default_branch pattern already in call-receipt-gate.yml).
• New outputs core_ref / compat_ref feed the two downstream checkout steps (previously both consumed the single ref output directly).

dev/main paths are untouched and byte-identical: resolved_ref never matches hotfix/** for those targets, so core_ref/compat_ref stay identical to resolved_ref and a dev/main base ref absent from omnibase_core/omnibase_compat still fails the checkout step hard, exactly as before this change.

Seam definition

• New step outputs: steps.validator_ref.outputs.core_ref (str, branch name) and steps.validator_ref.outputs.compat_ref (str, branch name) — replace the prior single steps.validator_ref.outputs.ref as the checkout ref: input for the omnibase_core and omnibase_compat checkout steps respectively, in both call-receipt-gate.yml and call-occ-preflight.yml.
• steps.validator_ref.outputs.ref is retained unchanged (still the raw resolved PR-base/merge_group ref) — no other step consumes it, so nothing downstream needed updating.
• New env: GH_TOKEN: ${{ github.token }} on the validator_ref step (required for the gh api branch-existence probes and default-branch lookups; same token already used by the sibling resolve_occ_default_branch step).
• No new inputs, no contract/schema changes, no new required-context surface.

Files

• .github/workflows/call-receipt-gate.yml (validator_ref step; omnibase_compat/omnibase_core checkout steps)
• .github/workflows/call-occ-preflight.yml (validator_ref step; omnibase_compat/omnibase_core checkout steps)

References

OMN-15698 (this ticket) · OMN-15689 (parent ruling, R3a) · scoping comment on OMN-15698 (Option A/B framing, live-verified line numbers)

Verification

• python3 -c "import yaml; yaml.safe_load(open(f))" on both files — OK
• pre-commit run --all-files on the two changed files — all applicable hooks passed (yamlfmt ratchet, no-hardcoded-topics, fork-aware-runner-routing, skip-vector guards, etc.)

Evidence-Ticket: OMN-15698
Evidence-Source: OCC#6130

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 57 minutes

Limit details: You’ve used all 1 included review currently available under your plan. You completed 114 included PR reviews in the past 7 days; at that activity level, included reviews refill at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b446d2f7-8f66-43fd-b8c6-aeedcb5afe7b

📥 Commits

Reviewing files that changed from the base of the PR and between 0558ef3 and 40f2134.

📒 Files selected for processing (7)

• .github/workflows/call-occ-preflight.yml
• .github/workflows/call-receipt-gate.yml
• contracts/OMN-15698.yaml
• drift/dod_receipts/OMN-15698/dod-occ-evidence-admissibility-validator-pr-6122/command.yaml
• drift/dod_receipts/OMN-15698/dod-precommit-workflow-files-pr-6122/command.yaml
• drift/dod_receipts/OMN-15698/dod-workflow-yaml-parse-pr-6122/command.yaml
• drift/dod_receipts/OMN-15698/occ-self-bind-pr-6122/command.yaml

---

_{Comment @coderabbitai help to get the list of available commands.}

[onexbot-occ-writer]

OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required.

[onexbot-occ-writer]

OCC autobind stood down for OmniNode-ai/onex_change_control#6122 (OMN-15698): this PR (hand_authored) already carries evidence for that ticket, so no competing companion was minted (OMN-15247 defer-on-contention).