[jonahgabriel]

Hand-bound OCC companion (union-resolve) for the four product PRs of OMN-18080:

repo	PR	what it carries
omniweb	#365	the app half — RP-initiated logout
omnibase_infra	#3363	the canonical Keycloak client declaration
omninode_infra	#1279	the mirrored copy the seeding Job mounts
omnidash	#316	a transposed post-logout host in that repo's own declaration

Why this is hand-minted

OMN-18073 records that the autobind path is not minting companions in this window; the same hand-mint was taken for OMN-18077 (OCC#8787 → omninode_infra#1274) and OMN-18068 (OCC#8760 → omninode_infra#1266). Without a companion these four PRs have no receipt to cite, so the Receipt Gate fails on the missing citation rather than on anything wrong with the change.

What the product PRs do

The operator reported in-session on 2026-09-09 that signing out of the dev customer surface did not work and that the next sign-in was refused as already signed in, which made signing in as a second synthetic tenant impossible in the same browser.

Root cause, from source rather than inference: omniweb's entire sign-out was next-auth v5's local signOut with a redirect to the marketing home. That clears the app's own session cookie and contacts the identity provider not at all, so the Keycloak SSO session survived every sign-out and the next authorization request auto-resolved to the still-signed-in user. The "already signed in" text is Keycloak's own — a case-insensitive grep for it over omniweb at origin/dev returns zero hits. A second blocker sat underneath: the JWT callback persisted the access token, the refresh token and the expiry but not the ID token, so the id_token_hint a silent end-session call needs was retained nowhere.

omniweb#365 adds a discovery-resolved end-session resolver — the endpoint is read from the configured issuer's own well-known document, never hardcoded, because the dev pods point at one realm host and the production-facing lane at another — persists the ID token through sign-in and refresh, clears the local session first and then hands the client an absolute end-session URL carrying id_token_hint and post_logout_redirect_uri, and adds the registered /signed-out landing route together with the proxy entry that keeps it reachable without a session.

omnibase_infra#3363 and omninode_infra#1279 register that post-logout URI on the omniweb client in the committed reconciler input, applied by the sanctioned seeding Job. No live kcadm write was performed at any point.

omnidash#316 corrects a host transposition in that repo's own committed client declaration, where every host read dash.dev.omninode.ai rather than the dev.dash.omninode.ai the repo actually serves. The runtime side there needed no change: keycloak-connect's logout middleware already sends both parameters when a session grant exists, and the earlier anonymous probe that saw a bare end-session URL proves nothing about a real session.

What is bound, and what deliberately is not

AC4 is bound and is proved RED-then-GREEN in-lane. AC1, AC2 and the live half of AC3 are not bound: they need a browser session and a read-only realm session readback on the dev-system cluster after these merge.

Rule 24, stated rather than implied: the .201 compose lane runs no omniweb, no dashboard and no Keycloak, so no lab pass can cover a browser OIDC round trip and none is claimed. The proof for AC1/AC2 is a staging readback on dev.app / dev.auth.

Evidence carried here

item	shape
dod-OmniNode-ai-omniweb-pr-365	PR state + lib/federated-logout.ts present in the diff (grep -cFx, exact-line)
dod-occ-diff-derived-behavior-proof	18 tests pass at the pushed commit (OMN-16434)
dod-OmniNode-ai-omnibase_infra-pr-3363	PR state + the canonical client declaration in the diff
dod-OmniNode-ai-omninode_infra-pr-1279	PR state + the mirrored client declaration in the diff
dod-OmniNode-ai-omnidash-pr-316	PR state + that repo's client declaration in the diff
occ-self-bind-pr-<n>	binds OMN-18080 to this companion

The zeros are not vacuous. Every RED control was taken in this lane rather than asserted:

• omniweb — restoring auth.ts, app/(app)/actions.ts and proxy.ts to origin/dev and removing the /signed-out route gives 15/18 passed, failing exactly the three wiring assertions (the ID token is not persisted; the action is the local signOut; the landing route does not exist). GREEN at the pushed commit: 18/18.
• omnibase_infra — at the origin/dev client declaration the new test gives 5 failed, 1 passed; at the pushed commit, 6 passed.
• omninode_infra — same shape on the mirrored copy: 4 failed, 1 passed → 5 passed.
• omnidash — at the origin/dev client file the new suite gives 2 failed | 3 passed, the two failures being the transposed-host assertion and the one-consistent-origin assertion; at the pushed commit, 5 passed.

One process note worth recording rather than leaving in a log: the omnibase_infra governed pre-push failed its first attempt on tests/unit/scripts/test_heavy_lock.py::test_a_wedged_holder_is_distinguishable_from_a_working_one, an assertion that a process group is gone after cleanup. It passes in isolation and passed on the identical tree at re-run (1753 passed, 2 skipped), on a host whose load average ran between 30 and 96 throughout. It is load-sensitive, not a property of a change whose diff is one JSON data file plus one new test.

Merge order

This companion merges first. Then omnibase_infra#3363 (the canonical client declaration), because omninode_infra#1279's parity gate compares its copy byte-for-byte against that repo's dev. Then omninode_infra#1279, omniweb#365, omnidash#316.

Ticket

OMN-18080 — Dashboard logout does not end the Keycloak SSO session (next login refused as already signed in).