evidence(OMN-16799): OCC companion for OmniNode-ai/omninode_infra#1044

[jonahgabriel]

OCC evidence companion for OmniNode-ai/omninode_infra#1044 — the gated api.omninode.ai hostname reclaim.

Ticket: OMN-16799.

Why this is hand-authored and not an autobind

node_occ_companion_compute's F-17 guard deliberately suppresses companion authoring when the product PR is a draft, or when its title/body is marked do-not-merge/WIP (handler_occ_companion_compute.py, added after incident occ#4333). omninode_infra#1044 is both:

• isDraft: true
• title: fix(OMN-16799): gate the api.omninode.ai hostname reclaim behind a prod-promotion grant [DO NOT MERGE — awaiting grant]

Both are correct and deliberate — #1044 must not become mergeable before the OMN-16799 prod-promotion grant lands on onex_change_control@main (OCC#7418). The suppression is the guard working, not a bug.

But that creates a small deadlock: #1044's verify / verify receipt gate needs an Evidence-Source: OCC#<PR> line, and the autobind that would mint it refuses to fire until #1044 is un-drafted and retitled. This PR supplies the evidence without touching #1044's draft state, so the operator's step is a plain un-draft + merge rather than un-draft, wait for autobind, then merge.

What it adds

Two dod_evidence items appended to the existing contracts/OMN-16799.yaml (the OCC#7342 autobind for omninode_infra#1034). Append-only: the OMN-13888 per-entry contract_entry_sha256 binding means entries 1..N keep their hashes, so nothing already bound is invalidated.

id	what it proves
dod-OmniNode-ai-omninode_infra-pr-1044	Evidence-Source bind. Literal PR number, per the OMN-15382 class-3 mis-binding rule (a bare ${PR_NUMBER} on a PR-bound id resolves to whatever PR the compliance runner is evaluating).
dod-omn-16799-reclaim-behavior-ratchet	A real behavior-class check on the changed surface — tests/k8s/test_omn_16799_api_hostname_reclaim.py, 8 tests pinning the fail-closed shape of reclaim_api_hostname: opt-in default false, runtime-only refusal cross-checked against the OMN-14209 guard it depends on, both steps gated on the input, the delete chained to the precondition step's outcome, the three preconditions probed, and a ratchet asserting no ungated delete ingress exists anywhere in the workflow. Not a ticket-independent suite standing in for a proof (OMN-16434).

Both probes were run before the receipts were written. pytest tests/k8s/test_omn_16799_api_hostname_reclaim.py -q → 8 passed.

Scope

Evidence only. This PR changes no runtime, no manifest, no workflow, and authorizes no prod mutation. omninode_infra#1044 stays DRAFT; nothing here un-drafts it or makes it mergeable.

Evidence-Ticket: OMN-16799

[coderabbitai]

Warning

Review limit reached

Next included review available in 31 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 131 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b9c58738-52f5-4bc3-8cbe-9da0fd038cd8

📥 Commits

Reviewing files that changed from the base of the PR and between 81fec26 and c1dc4ac.

📒 Files selected for processing (4)

• contracts/OMN-16799.yaml
• drift/dod_receipts/OMN-16799/dod-OmniNode-ai-omninode_infra-pr-1044/command.yaml
• drift/dod_receipts/OMN-16799/dod-omn-16799-reclaim-behavior-ratchet/command.yaml
• drift/dod_receipts/OMN-16799/occ-self-bind-pr-7420/command.yaml

---

_{Comment @coderabbitai help to get the list of available commands.}