jonahgabriel · Aug 9, 2026 · Aug 9, 2026 · Aug 9, 2026 · Aug 9, 2026 · Aug 9, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1186,7 +1186,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 10
+    timeout-minutes: 45
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -1243,7 +1243,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 10
+    timeout-minutes: 45
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -1290,7 +1290,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 10
+    timeout-minutes: 45
     permissions:
       contents: read
     steps:
@@ -1367,7 +1367,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 20
+    timeout-minutes: 45
     permissions:
       contents: read
     steps:
@@ -1440,7 +1440,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 20
+    timeout-minutes: 45
     permissions:
       contents: read
     steps:
@@ -1502,7 +1502,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 20
+    timeout-minutes: 45
     permissions:
       contents: read
     steps:
@@ -1545,7 +1545,21 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 5
+    # OMN-15722: a uniform 45m floor across every ci-summary `needs:` member
+    # that declares a timeout-minutes. Measured on PR #6173 run 31222755192
+    # (head 2df62fc62): inside that ONE run, for the same repo and the same SHA,
+    # `Checkout code` ranged 6s to 1358s (22m38s), and `Run ./.github/actions/
+    # setup-uv` ranged 93s to 571s (9m31s) across the jobs that reached it,
+    # while the ten budgeted gates' own steps took at most 53s. Checkout alone
+    # has therefore been observed at 22m38s, so the 5/10/20/25 budgets on dev
+    # all sat below an already-observed single-phase latency, and a budget sized
+    # to one job's worst total is the same defect one contention spike later.
+    # A job that hits its wall is recorded conclusion=cancelled, which CI
+    # Summary's fail-closed `!= success` comparison reddens — so this is a
+    # starvation bug, not a slow check. Reducing the preamble (fetch-depth: 0
+    # full-history clone plus uv provisioning on a 64-runner shared fleet) is
+    # separate work.
+    timeout-minutes: 45
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -1593,7 +1607,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 5
+    timeout-minutes: 45
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -1799,7 +1813,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 25
+    timeout-minutes: 45
     permissions:
       contents: read
     steps:

diff --git a/contracts/OMN-14888.yaml b/contracts/OMN-14888.yaml
@@ -1941,6 +1941,21 @@ dod_evidence:
       - check_type: "command"
         check_value: |-
           gh api repos/OmniNode-ai/onex_change_control/commits/2ec3a9c2af2601f356a8c63690e798816aee4179 --jq .sha
+  - id: "occ-observation-run31058937953-1"
+    description: "OCC observation append for omnimarket PR #2022 (run 31058937953-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/6236ce1978d6120c3306dd0a49b53122f7d46011 --jq .sha
+  - id: "occ-self-bind-pr-6144"
+    description: "OCC observation PR #6144 — self-bind for OMN-14888 after manual merge-sweep repair."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/pulls/6144 --jq 'if (.number == 6144 and .base.repo.full_name == "OmniNode-ai/onex_change_control" and .head.ref == "auto/occ-observation-drift-occ-observations-omninode-ai--omnimarket-pr-2022-b8a1eb65a20f32e0e00efd473aaf7b69f3cad6f9--v1--run31058937953-1-yaml" and ((.state == "open") or (.state == "closed" and .merged == true))) then "true" else error("unexpected onex_change_control#6144 state") end' | grep -qx true
   - id: "occ-observation-run31185247575-1"
     description: "OCC observation append for omnimarket PR #2025 (run 31185247575-1)."
     source: "generated"
@@ -1977,3 +1992,132 @@ dod_evidence:
       - check_type: "command"
         check_value: |-
           gh api repos/OmniNode-ai/onex_change_control/pulls/6134 --jq 'if (.number == 6134 and .state == "open" and .head.ref == "auto/occ-observation-drift-occ-observations-omninode-ai--omnimarket-pr-2022-c482822ef8ea9766d91c1a2a59e787d1a02f6c13--v1--run31055159329-1-yaml") then "true" else error("unexpected onex_change_control#6134 state") end' | grep -qx true
+  - id: "occ-self-bind-pr-6134-superseded"
+    description: >-
+      Append-only supersession of occ-self-bind-pr-6134. That entry's check_value literally asserts PR
+      #6134 state == "open", but #6134 has since MERGED (2026-08-09T03:14:53Z, merge commit ea53c31be5439e12884fe6727a965911330eff43,
+      confirmed live via `gh pr view 6134 --repo OmniNode-ai/onex_change_control --json state,mergedAt,mergeCommit`),
+      so re-executing the original check_value now fails closed on a merged, evidence-bearing PR -- the
+      same pr-state-goes-stale class already repaired for occ-self-bind-pr-5855 (OMN-15374) and occ-self-bind-pr-6149
+      (OMN-14888). This entry retires only the occ-self-bind-pr-6134 open-state assertion with a merged-terminal-state
+      binding; the superseded entry stays verbatim above for audit.
+    source: "manual"
+    status: "verified"
+    evidence_artifact: "supersedes_dod_evidence:occ-self-bind-pr-6134"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          state="$(gh pr view 6134 --repo OmniNode-ai/onex_change_control --json state --jq .state)" &&
+          merge_sha="$(gh pr view 6134 --repo OmniNode-ai/onex_change_control --json mergeCommit --jq
+          .mergeCommit.oid)" && test "$state" = "MERGED" && test "$merge_sha" = "ea53c31be5439e12884fe6727a965911330eff43"
+          && printf 'OCC 6134 merged-terminal-state PASS\n'
+  - id: "occ-observation-run31054912492-1"
+    description: "OCC observation append for omnimarket PR #2021 (run 31054912492-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/f771402632d7fbb5c97b73f764e19d1f578482f4 --jq .sha
+  - id: "occ-self-bind-pr-6132"
+    description: "OCC observation PR #6132 — self-bind for OMN-14888 after manual merge-sweep repair."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/pulls/6132 --jq 'if (.number == 6132 and .head.ref == "auto/occ-observation-drift-occ-observations-omninode-ai--omnimarket-pr-2021-7bd1c1a9c39823834fe4e38dabc785887ecf524c--v1--run31054912492-1-yaml" and .base.repo.full_name == "OmniNode-ai/onex_change_control" and (.state == "open" or (.state == "closed" and .merged == true))) then "true" else error("unexpected onex_change_control#6132 state") end' | grep -qx true
+  - id: "occ-observation-run31061495853-1"
+    description: "OCC observation append for omnimarket PR #2022 (run 31061495853-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/3f1a7afb9c0b3e9c8d65140656fec988fd7e2fbc --jq .sha
+  - id: "occ-self-bind-pr-6149"
+    description: "OCC observation PR #6149 — self-bind for OMN-14888 after manual merge-sweep repair."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/pulls/6149 --jq 'if (.number == 6149 and .base.repo.full_name == "OmniNode-ai/onex_change_control" and .head.ref == "auto/occ-observation-drift-occ-observations-omninode-ai--omnimarket-pr-2022-d72b0c37559ddb1bad988e5a0f0a4c6011f0eb85--v1--run31061495853-1-yaml" and (.state == "open" or (.state == "closed" and .merged == true))) then "true" else error("unexpected onex_change_control#6149 state") end' | grep -qx true
+  - id: "occ-observation-run31057101391-1"
+    description: "OCC observation append for omnimarket PR #2023 (run 31057101391-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/cbe7c140c3f802e4d4cd201e703c94c4ab600c0e --jq .sha
+  - id: "occ-self-bind-pr-6138"
+    description: "OCC observation PR #6138 — self-bind for OMN-14888 after manual merge-sweep repair."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/pulls/6138 --jq 'if (.number == 6138 and .head.ref == "auto/occ-observation-drift-occ-observations-omninode-ai--omnimarket-pr-2023-cf77a700703ded2f8c99eacfb7695bdd767f772f--v1--run31057101391-1-yaml" and .base.repo.full_name == "OmniNode-ai/onex_change_control" and (.state == "open" or (.state == "closed" and .merged == true))) then "true" else error("unexpected onex_change_control#6138 state") end' | grep -qx true
+  - id: "occ-observation-run31062523818-1"
+    description: "OCC observation append for omnimarket PR #2024 (run 31062523818-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/8569003d7bf482c0e7812e18b59dd0e75ca03281 --jq .sha
+  - id: "occ-self-bind-pr-6152"
+    description: "OCC observation PR #6152 — self-bind for OMN-14888 after manual merge-sweep repair."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/pulls/6152 --jq 'if (.number == 6152 and .base.repo.full_name == "OmniNode-ai/onex_change_control" and .head.ref == "auto/occ-observation-drift-occ-observations-omninode-ai--omnimarket-pr-2024-38d1a7242b189f4d2a4b20e5324ce8f3f13f3be8--v1--run31062523818-1-yaml" and (.state == "open" or (.state == "closed" and .merged == true))) then "true" else error("unexpected onex_change_control#6152 state") end' | grep -qx true
+  - id: "occ-observation-run31142195987-1"
+    description: "OCC observation append for omnimarket PR #2025 (run 31142195987-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/9678d308790f0867cd6581365d4d233ff6b675e7 --jq .sha
+  - id: "occ-observation-run31063872175-1"
+    description: "OCC observation append for omnimarket PR #2022 (run 31063872175-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/2ff048db11b76ab80cc809b31d76657c309a0654 --jq .sha
+  - id: "occ-self-bind-pr-6155"
+    description: "OCC observation PR #6155 — self-bind for OMN-14888 after manual merge-sweep repair."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/pulls/6155 --jq 'if (.number == 6155 and .head.ref == "auto/occ-observation-drift-occ-observations-omninode-ai--omnimarket-pr-2022-023992b513456767c2ee39ad35703246bca5d83e--v1--run31063872175-1-yaml" and .base.repo.full_name == "OmniNode-ai/onex_change_control" and (.state == "open" or (.state == "closed" and .merged == true))) then "true" else error("unexpected onex_change_control#6155 state") end' | grep -qx true
+  - id: "occ-observation-run31303503673-1"
+    description: "OCC observation append for omnimarket PR #2029 (run 31303503673-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/595538dcddbeb8bd9dffb8ecf8baa36a00f730cb --jq .sha
+  - id: "occ-observation-run31304580306-1"
+    description: "OCC observation append for omnimarket PR #2029 (run 31304580306-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/bcab04df85168f34d98ee6d62f6df5708be4b160 --jq .sha
+  - id: "occ-observation-run31291311120-1"
+    description: "OCC observation append for omnimarket PR #2027 (run 31291311120-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/a4e1871e887ab8f16753be506c830a95b3ea6036 --jq .sha
+  - id: "occ-observation-run31292255084-1"
+    description: "OCC observation append for omnimarket PR #2027 (run 31292255084-1)."
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: |-
+          gh api repos/OmniNode-ai/onex_change_control/commits/525d1baec3e1f48c2798c7db136fabad9e1c43eb --jq .sha
diff --git a/contracts/OMN-15336.yaml b/contracts/OMN-15336.yaml
@@ -173,3 +173,49 @@ dod_evidence:
     checks:
       - check_type: "command"
         check_value: "gh pr view 6220 --repo OmniNode-ai/onex_change_control --json number,state"
+  - id: "dod-OmniNode-ai-omnibase_infra-pr-2676"
+    description: "PR #2676 on OmniNode-ai/omnibase_infra — vendored node_service_registry NO FORCE RLS
+      migration for omnimarket PR #2021."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          gh pr view 2676 --repo OmniNode-ai/omnibase_infra --json number,state,headRefName,headRefOid,files
+          --jq 'if (.number == 2676 and .state == "OPEN" and .headRefName == "jonah/omn-15336-node-service-registry-no-force-rls-vendor"
+          and .headRefOid == "f401b8354f14bdc1701522ef2b7bbbfec80c1c38" and ([.files[].path] | sort) ==
+          ["docker/migrations/forward/_ledger/application-migrations.tsv","docker/migrations/forward/nodes/node_projection_registration/0004_node_service_registry_no_force_rls.sql","tests/unit/migrations/test_node_migration_discovery.py","tests/unit/scripts/validation/test_application_migration_manifest.py"])
+          then "true" else error("unexpected #2676 state, head, or file set") end'
+  - id: "dod-OmniNode-ai-omnimarket-pr-2021-36ff2549"
+    description: "Append-only replacement for omnimarket PR #2021 after the product head advanced to 36ff2549
+      with the schema-qualification ownership test."
+    source: "manual"
+    status: "verified"
+    evidence_artifact: "supersedes_dod_evidence:dod-OmniNode-ai-omnimarket-pr-2021"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          gh pr view 2021 --repo OmniNode-ai/omnimarket --json number,state,headRefName,headRefOid,files
+          --jq 'if (.number == 2021 and .state == "OPEN" and .headRefName == "jonah/omn-15336-node-service-registry-no-force-rls"
+          and .headRefOid == "36ff25499216b222202257aad7df67ce8005e15a" and ([.files[].path] | sort) ==
+          ["src/omnimarket/nodes/node_projection_registration/migrations/0004_node_service_registry_no_force_rls.sql","tests/test_node_service_registry_migration_ownership.py"])
+          then "true" else error("unexpected #2021 state, head, or file set") end'
+  - id: "dod-infra-pr-2676-vendor-byte-parity"
+    description: "Byte-for-byte proof that omnibase_infra PR #2676 vendors the exact omnimarket PR #2021
+      node migration."
+    source: "manual"
+    status: "verified"
+    evidence_artifact: "supersedes_dod_evidence:dod-OmniNode-ai-omnibase_infra-pr-2676"
+    checks:
+      - check_type: "command"
+        check_value: >-
+          bash -lc 'cmp -s <(gh api "repos/OmniNode-ai/omnimarket/contents/src/omnimarket/nodes/node_projection_registration/migrations/0004_node_service_registry_no_force_rls.sql?ref=36ff25499216b222202257aad7df67ce8005e15a"
+          --jq .content | base64 -d) <(gh api "repos/OmniNode-ai/omnibase_infra/contents/docker/migrations/forward/nodes/node_projection_registration/0004_node_service_registry_no_force_rls.sql?ref=f401b8354f14bdc1701522ef2b7bbbfec80c1c38"
+          --jq .content | base64 -d)'
+  - id: "occ-self-bind-pr-6167"
+    description: "Binds OMN-15336 to OCC companion PR #6167 for omnibase_infra PR #2676."
+    source: "manual"
+    status: "verified"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr view 6167 --repo OmniNode-ai/onex_change_control --json number,state,headRefName"