evidence(OMN-16690): OCC companion for OmniNode-ai/omnimarket#2164

contracts/OMN-16690.yaml

@@ -0,0 +1,50 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-16690"
+title: "Projection contracts declared access='write' while their handlers read — every event DLQ'd"
+summary: >-
+  A projection node whose contract declares a table `access: write` cannot perform any read against that
+  table: the wiring guard `_assert_read_declared()` in omnibase_infra admits only `read` / `read_write`.
+  Two shipped omnimarket handlers are built to read, so every event they received was refused with a PermissionError
+  and routed to the platform quarantine DLQ, and zero rows were ever written. The read is deliberate and
+  documented in the handler's own docstring — the projection adapter's `upsert()` has no `ON CONFLICT
+  ... DO NOTHING` mode, so an unconditional upsert would bump `updated_at` on every Kafka redelivery;
+  the handler therefore reads before writing and skips the upsert when found. The declared capability
+  (`write`) was strictly narrower than the capability the handler was built to use (`read_write`), so
+  this code path could never have written a row. It was invisible only because the gateway entry was fenced.
+  The failure mode is the dangerous kind: the gateway answers 202, the runtime logs an ERROR, the event
+  lands in quarantine, and the caller sees success. OmniNode-ai/omnimarket#2164 widens the 13 mismatched
+  contracts (14 tables), and — the load-bearing part — lands a fail-closed guard that resolves each projection
+  contract's declared access against the operations its handler actually invokes, wired as BOTH a CI job
+  and a pre-commit hook in the same PR so the class cannot reach production as a per-event DLQ again.
+is_seam_ticket: false
+interface_change: false
+interfaces_touched: []
+evidence_requirements:
+  - kind: "ci"
+    description: "PR #2164 on OmniNode-ai/omnimarket CI checks green"
+    command: "gh pr checks ${PR_NUMBER} --repo ${REPO}"
+emergency_bypass:
+  enabled: false
+  justification: ""
+  follow_up_ticket_id: ""
+dod_evidence:
+  - id: "dod-OmniNode-ai-omnimarket-pr-2164"
+    description: >-
+      PR #2164 on OmniNode-ai/omnimarket — widens the 13 mismatched projection contracts to `read_write`
+      and lands scripts/ci/check_projection_contract_access.py as a fail-closed CI + pre-commit gate.
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr view 2164 --repo OmniNode-ai/omnimarket --json number,state,headRefName"
+      - check_type: "command"
+        check_value: "gh pr view 2164 --repo OmniNode-ai/omnimarket --json files"
+  - id: "occ-self-bind-pr-7289"
+    description: >-
+      PR #7289 on OmniNode-ai/onex_change_control — this OCC companion itself. OCC PRs validate their
+      contract and receipts from the PR's own in-tree checkout (invariant I3), so the companion must carry
+      a receipt binding itself.
+    source: "generated"
+    checks:
+      - check_type: "command"
+        check_value: "gh pr view 7289 --repo OmniNode-ai/onex_change_control --json number,state,headRefName"

drift/dod_receipts/OMN-16690/dod-OmniNode-ai-omnimarket-pr-2164/command.yaml

@@ -0,0 +1,24 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-16690"
+evidence_item_id: "dod-OmniNode-ai-omnimarket-pr-2164"
+check_type: "command"
+check_value: "gh pr view 2164 --repo OmniNode-ai/omnimarket --json number,state,headRefName"
+contract_sha256: "sha256:1eb75286bbf324b1319443cf1fd5598c4304d68820329dad4e2344effa523cc6"
+contract_entry_sha256: "sha256:aa5731bb7985617688f28d62b4e1daadf34a5e4b88dab98775a295381b3ffb59"
+status: PASS
+run_timestamp: "2026-08-27T12:24:00.869296+00:00"
+commit_sha: 778e6780b46e0b1579de8366e170f20a325423fa
+runner: "claude-code-agent-omn16752-gate-runner-fix"
+verifier: "governed-prepush-full-suite-200"
+probe_command: "gh pr view 2164 --repo OmniNode-ai/omnimarket --json number,state,headRefName"
+probe_stdout: '{"headRefName":"jonah/omn-16690-projection-access-class-fix","number":2164,"state":"OPEN"}'
+actual_output: >-
+  PASS (exit 0). Declared check executed verbatim in the onex_change_control checkout. The behavior it
+  probes was additionally executed: the governed pre-push selector escalated to the full suite (is_full_suite=True
+  reason=changed_test_unnarrowable) and ran it on the designated .200 gate host — 16250 passed, 105 skipped,
+  3 deselected, 1 xfailed, 0 failed in 710.97s. No bypass flags were used (PREPUSH_FULL_SUITE, PREPUSH_ALLOW_LOCAL_FULL_SUITE,
+  ENABLE_SMART_TESTS=off and --no-verify all unused).
+exit_code: 0
+pr_number: 2164
+branch: "jonah/omn-16690-projection-access-class-fix"

drift/dod_receipts/OMN-16690/occ-self-bind-pr-7289/command.yaml

@@ -0,0 +1,20 @@
+---
+schema_version: "1.0.0"
+ticket_id: "OMN-16690"
+evidence_item_id: "occ-self-bind-pr-7289"
+check_type: "command"
+check_value: "gh pr view 7289 --repo OmniNode-ai/onex_change_control --json number,state,headRefName"
+contract_sha256: "sha256:1eb75286bbf324b1319443cf1fd5598c4304d68820329dad4e2344effa523cc6"
+contract_entry_sha256: "sha256:b2dc1a9caee748336e8021e2a7de9de500b6b97677c4a0027981a6f49f1c283e"
+status: PASS
+run_timestamp: "2026-08-27T12:27:15.017635+00:00"
+commit_sha: 65ca9a3ae0e6045492e36000ba765337f0bc95f2
+runner: "claude-code-agent-omn16752-gate-runner-fix"
+verifier: "occ-self-bind"
+probe_command: "gh pr view 7289 --repo OmniNode-ai/onex_change_control --json number,state,headRefName"
+probe_stdout: '{"headRefName":"jonah/omn-16690-occ-companion","number":7289,"state":"OPEN"}'
+actual_output: "PASS (exit 0). Declared check executed verbatim in the onex_change_control checkout; this
+  OCC companion PR binds itself per invariant I3."
+exit_code: 0
+pr_number: 7289
+branch: "jonah/omn-16690-occ-companion"