omninode-memory 0.18.1__tar.gz → 0.18.2__tar.gz

omninode_memory-0.18.2/.github/workflows/auto-tag-on-merge.yml

@@ -0,0 +1,146 @@
+name: Auto-Tag on Merge
+
+on:
+  pull_request:
+    types: [closed]
+
+# OMN-18662: this job used to delegate to omnibase_core's shared
+# `auto-tag-reusable.yml`, which pushes the release tag with the job's default
+# workflow token. A push made with that token delivers no push event, so
+# `release.yml` -- whose only automatic trigger is `push: tags:` -- never
+# started, the tag sat unconsumed, and every cut needed a hand
+# `workflow_dispatch`.
+#
+# An App-token push DOES start push-driven CI in this org (omni_home/CLAUDE.md,
+# corrected 2026-09-16 under OMN-18273; live proof: omnibase_spi run
+# 35134173847, `event: push`, `actor: onexbot-occ-writer[bot]`). Two conditions
+# make that true, and both are properties of this job rather than of the token:
+#
+#   1. the checkout does not persist credentials. A default `actions/checkout`
+#      writes a basic-auth `http.<origin>.extraheader` carrying the workflow
+#      token, and that header OVERRIDES any credential in the remote URL -- the
+#      confound that produced the wrong org-wide finding in August.
+#   2. the mint fails closed. No `|| secrets.GITHUB_TOKEN` fallback anywhere in
+#      the job: a fallback silently restores the workflow token, the push is
+#      suppressed again, and the job still reports success.
+#
+# Why this is inlined here rather than fixed in the shared reusable: the caller
+# pinned that reusable at a ref on omnibase_core's `main`, which is
+# release-synced (OMN-16289) and only advances when a release publishes -- so a
+# fix landed there would not be live for the NEXT cut, only the one after it,
+# which is the cut this ticket exists to stop hand-dispatching. The reusable
+# also cannot see the org App credentials unless every caller passes them. It is
+# left byte-unchanged for whatever still calls it. Precedent and shape:
+# omnibase_core#1703 and omnibase_spi#308, under OMN-18658.
+
+jobs:
+  auto-tag:
+    if: >-
+      github.event.pull_request.merged == true &&
+      (contains(github.event.pull_request.labels.*.name, 'release') ||
+       startsWith(github.event.pull_request.title, 'release:') ||
+       startsWith(github.event.pull_request.title, 'chore: release') ||
+       startsWith(github.event.pull_request.title, 'chore(release)'))
+    # OMNI_RUNNER_SELECTOR_V1 - trusted events default to self-hosted omnibase-ci; pull_request defaults to ubuntu-latest
+    runs-on: >-
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    permissions:
+      contents: read
+    steps:
+      # Condition 1. `persist-credentials: false` is load-bearing, not hygiene:
+      # with the default `true`, checkout v7 writes the workflow token into a
+      # separate credential file and includes it through `includeIf.gitdir`, so
+      # it overrides the App credential in the push URL below and the push
+      # authenticates as github-actions[bot] again.
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Extract version from pyproject.toml
+        id: version
+        run: |
+          set -euo pipefail
+          VERSION=$(grep -m1 '^version' pyproject.toml | sed 's/.*"\(.*\)".*/\1/')
+          if [ -z "$VERSION" ]; then
+            echo "::error::could not read a version from pyproject.toml"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Detected version: $VERSION (tag: v$VERSION)"
+
+      - name: Check if tag already exists
+        id: check
+        run: |
+          set -euo pipefail
+          if git rev-parse "refs/tags/${{ steps.version.outputs.tag }}" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "Tag ${{ steps.version.outputs.tag }} already exists — skipping"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Condition 2. `actions/create-github-app-token` fails the step when it
+      # cannot mint, which fails the job. There is deliberately no `||`
+      # expression joining this output to the workflow token: an unmintable
+      # token must stop the tag from being pushed at all, because a tag pushed
+      # with the workflow token is worse than no tag -- it is unconsumable and
+      # cannot be re-pushed without deleting it first.
+      #
+      # `permission-*` REPLACES the installation's permission set with exactly
+      # what is listed. Both scopes are required: `contents` to create the ref,
+      # `workflows` because a release commit can legitimately carry changes
+      # under .github/workflows/ and GitHub refuses a push that introduces them
+      # without it.
+      - name: Mint onexbot-occ-writer app token
+        id: app-token
+        if: steps.check.outputs.exists == 'false'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.ONEXBOT_OCC_APP_ID }}
+          private-key: ${{ secrets.ONEXBOT_OCC_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-workflows: write
+
+      - name: Create and push tag
+        if: steps.check.outputs.exists == 'false'
+        env:
+          TAG: ${{ steps.version.outputs.tag }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          set -euo pipefail
+
+          # Belt-and-braces on the fail-closed mint. The action above already
+          # fails the step when it cannot mint, but an empty token here would
+          # otherwise produce an unauthenticated push whose failure mode is a
+          # confusing 403 rather than a named one.
+          if [ -z "${APP_TOKEN}" ]; then
+            echo "::error::onexbot-occ-writer token is empty; refusing to push ${TAG}"
+            exit 1
+          fi
+
+          # An annotated tag carries a tagger identity. Use the App's real
+          # account address -- the numeric prefix is what links it to the bot
+          # account; a fabricated address renders unlinked and proves nothing
+          # (OMN-18273 AC-4).
+          git config user.name "onexbot-occ-writer[bot]"
+          git config user.email "307849072+onexbot-occ-writer[bot]@users.noreply.github.com"
+
+          git tag "${TAG}" -m "Release ${TAG}"
+
+          # The credential travels in the remote URL for this one command. With
+          # `persist-credentials: false` above there is no `extraheader` left to
+          # override it, which is the whole point of the pair.
+          git push \
+            "https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
+            "refs/tags/${TAG}"
+
+          echo "Pushed tag ${TAG} as onexbot-occ-writer[bot]"
+          echo "release.yml is expected to start from this push, with event=push and no workflow_dispatch"

omninode_memory-0.18.2/.github/workflows/ban-hardcoded-runner-ip.yml

@@ -0,0 +1,32 @@
+---
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+
+# Calls the reusable ban-hardcoded-runner-ip check from omniclaude.
+# Implements OMN-10603.
+#
+# OMN-17993: the paths: filter must list every path the reusable scans. It
+# listed workflows only, while the reusable also scans tests/** — the blind
+# spot that let omnibase_compat, a repository that ships this same gate, carry
+# the exact banned literal as a test fixture. A widened scanner behind a filter
+# that still excludes tests/ is never triggered by the change that introduces
+# the violation.
+
+name: Ban Hardcoded Runner IP
+
+on:
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - .github/workflows/**
+      - tests/**
+  merge_group:
+
+jobs:
+  ban-hardcoded-runner-ip:
+    # OMN-17993: pinned to an exact SHA, not @main. omniclaude main lags dev by
+    # design (release-synced), so @main still resolves to the pre-widening scanner
+    # body that scans workflow files only and exits 0 on a tests-only diff.
+    uses: OmniNode-ai/omniclaude/.github/workflows/ban-hardcoded-runner-ip.yml@6f965a67ea2873fd76df955bca54b3a6472d2a91
+    permissions:
+      contents: read

{omninode_memory-0.18.1 → omninode_memory-0.18.2}/.github/workflows/call-occ-companion-effect.yml

@@ -56,10 +56,21 @@
 # main, re-pin this `uses:` to `@main` or a main SHA so the caller no longer
 # tracks a moving dev branch.
 #
-# SECRET-FREE: no `secrets: inherit` — the dev-lane broker comes from
-# omnimarket's committed config/ci_bus_lanes.yaml overlay (OMN-14813), and the
-# dev-lane listener is plaintext. This repo needs no Kafka secrets for this
-# workflow.
+# BROKER-SECRET-FREE, SASL-CREDENTIALLED (OMN-14813 + OMN-18012). The paragraph
+# this replaces asserted that this workflow needs no Kafka secrets because the
+# dev-lane listener was unauthenticated. The BROKER half still holds and always
+# will:
+# it comes from omnimarket's committed config/ci_bus_lanes.yaml overlay and must
+# never be a secret, because an opaque broker value is the OMN-14800 silent-
+# repoint surface. The transport half expired at ~16:40Z on 2026-09-07, when
+# OMN-18012 Phase B enabled SASL/SCRAM-SHA-256 on the dev-lane listener. The
+# overlay now DECLARES that transport (SASL_PLAINTEXT / SCRAM-SHA-256 —
+# authenticated, not encrypted) and omnimarket's publisher reads the protocol
+# from it rather than inferring TLS from credential presence. `secrets: inherit`
+# is therefore required below so KAFKA_SASL_{USERNAME,PASSWORD} reach the
+# publisher; without them it fail-fasts on the declared SASL lane instead of
+# publishing unauthenticated. A credential is not a broker address and
+# re-creates none of the OMN-14800 surface.
 #
 # MANUAL REPLAY ENTRYPOINT (OMN-14993): `workflow_dispatch` lets an operator
 # manually re-request a mint for a PR whose original `pull_request` event was
@@ -104,7 +115,7 @@ name: OCC Companion Effect Publisher
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
+    types: [opened, edited, synchronize, reopened, ready_for_review]
   workflow_dispatch:
     inputs:
       pr_number:
@@ -147,6 +158,13 @@ jobs:
       (contains(github.event.pull_request.title, 'OMN-') ||
        contains(github.event.pull_request.head.ref, 'OMN-'))
     uses: OmniNode-ai/omniclaude/.github/workflows/call-occ-companion-effect-reusable.yml@dev
+    # OMN-18012: the dev lane declares SASL_PLAINTEXT/SCRAM-SHA-256, so the
+    # publisher needs the KAFKA_SASL_* credentials. The broker is still
+    # resolved from omnimarket's committed overlay, never from a secret.
+    # pragma: allowlist secret -- `secrets: inherit` is a GHA syntax keyword,
+    # not a literal secret; the repo secret scanner's Secret Keyword heuristic
+    # false-positives on the word "secrets:" here.
+    secrets: inherit  # pragma: allowlist secret
     with:
       lane: dev
 
@@ -228,6 +246,11 @@ jobs:
 
       - name: Publish onex.cmd.omnimarket.occ-companion-effect-requested.v1 (manual replay)
         env:
+          # OMN-18012: same declared-SASL lane as the reusable this job
+          # mirrors. The recovery path must not be the one that cannot
+          # authenticate.
+          KAFKA_SASL_USERNAME: ${{ secrets.KAFKA_SASL_USERNAME }}
+          KAFKA_SASL_PASSWORD: ${{ secrets.KAFKA_SASL_PASSWORD }}
           RUNNER_IS_TRUSTED: "true"
           PR_REPO: ${{ github.repository }}
           LANE: dev

omninode_memory-0.18.2/.github/workflows/kb-doc-gate.yml

@@ -0,0 +1,42 @@
+# SPDX-FileCopyrightText: 2026 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# KB Doc Gate — thin caller. OMN-17172 (fleet rollout; OMN-16589 built the gate).
+#
+# Canonical docs live in the knowledge-base repo. This gate keeps this repo's
+# markdown inside the allowed set stated by the operator ruling of 2026-09-01:
+# root README.md, root CLAUDE.md or anything under .claude/, CHANGELOG*.md,
+# LICENSE*, root SECURITY.md, .github/**, skills|commands|agents/**, and the
+# tests/**/{fixtures,data,golden}/** subtrees. Everything else is documentation
+# that must leave.
+#
+# mode: strict — fails if ANY markdown outside the allowed set EXISTS on the
+# branch, not merely when a PR touches one. This repo's KB Wave-4 migration
+# landed in OMN-16602 and its residual doc count is zero, which is the
+# precondition for strict; running it earlier would have blocked every
+# unrelated PR against the then-existing sprawl. The authoritative setting is
+# .kb-doc-gate.yaml at this repo's root — a `mode:` there always wins over the
+# `with: mode:` argument below, which is kept in sync for legibility.
+#
+# Validator + reusable workflow live in omniclaude (mirrors deploy-gate.yml's
+# thin-caller pattern). Pinned by immutable SHA, not @main: omniclaude's main is
+# release-synced and carries neither the reusable workflow nor
+# scripts/kb_doc_gate.py. The pin is a SINGLE source of truth — the reusable
+# checks its validator out at github.job_workflow_sha, i.e. this very SHA — so
+# advancing the gate is one line here, via a normal PR.
+#
+# REQUIRED status check: the surfaced context is 'kb-doc-gate / kb-doc-gate'
+# (this job's id / the reusable job's name). Removing this file wedges the
+# branch rather than silently dropping the gate.
+
+name: KB Doc Gate
+
+on:
+  pull_request:
+    branches: [dev]
+
+jobs:
+  kb-doc-gate:
+    uses: OmniNode-ai/omniclaude/.github/workflows/kb-doc-gate-reusable.yml@6f965a67ea2873fd76df955bca54b3a6472d2a91
+    with:
+      mode: strict

omninode_memory-0.18.2/.github/workflows/public-repo-hygiene.yml

@@ -0,0 +1,42 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# Public Repo Hygiene -- thin caller. OMN-18016, epic OMN-17992.
+#
+# This repository is PUBLIC. The gate refuses internal operating detail landing
+# in it: an undeclared top-level directory, an agent-state or evidence tree, a
+# misplaced dated document, a brand asset, an env file, cloud identity, a
+# private address, an operator machine path, a private repository name, and
+# internal-KB prose in a public README.
+#
+# mode: report. The gate records every finding and exits 0, so it lands without
+# blocking unrelated PRs on a repository that carries pre-existing residue. It
+# flips to enforce when that residue is FIXED -- never by moving it into
+# .public-repo-hygiene.yaml.
+#
+# Layer (a) reads .public-repo-hygiene.yaml at this repo's root; the gate
+# refuses to run without it rather than treating an absent config as an empty
+# allowlist.
+#
+# `secrets: inherit` IS REQUIRED: the denylist vocabulary lives in a private
+# repository and the reusable workflow mints an installation token to read it.
+# Without the secrets the gate fails CLOSED, which is the correct behaviour and
+# a loud one.
+#
+# The pin is a SINGLE source of truth: the reusable workflow checks its own
+# validator out at github.job_workflow_sha, i.e. this very SHA, so the workflow
+# and the script can never drift apart. Pin to an omniclaude commit on `dev`;
+# `main` is release-synced and does not carry the gate.
+
+name: Public Repo Hygiene
+
+on:
+  pull_request:
+    branches: [dev]
+
+jobs:
+  public-repo-hygiene:
+    uses: OmniNode-ai/omniclaude/.github/workflows/public-repo-hygiene-reusable.yml@5003030a79b410a0b08337c9f273b53e0db807e3
+    with:
+      mode: report
+    secrets: inherit

omninode_memory-0.18.2/.kb-doc-gate.yaml

@@ -0,0 +1,15 @@
+# KB doc gate config — OMN-16602 (omnimemory Wave-4 documentation migration).
+#
+# Canonical docs live in the OmniNode knowledge base; this repo's markdown is
+# now zero outside the allowed set, so the gate runs in whole-tree `strict`
+# mode rather than `diff`. Strict fails a PR when ANY tracked markdown outside
+# the allowed set exists on the branch, which is what keeps a scrubbed repo
+# scrubbed. Validator + allowed set: omniclaude/scripts/kb_doc_gate.py.
+#
+# No repo-specific `allowed:` entries: everything that survives here
+# (README.md, CLAUDE.md, .claude/**, CHANGELOG.md, LICENSE, SECURITY.md,
+# .github/**) is already in the validator's DEFAULT_ALLOWED. Do not add an
+# `allowed:` glob to keep a new doc — move the doc to the knowledge base.
+#
+# A `mode:` here always wins over the caller workflow's `--mode` argument.
+mode: strict

{omninode_memory-0.18.1 → omninode_memory-0.18.2}/.pre-commit-config.yaml

@@ -139,15 +139,17 @@ repos:
     rev: v0.21.0
     hooks:
       - id: yamlfmt
-        exclude: ^\.github/
+        # .kb-doc-gate.yaml and .public-repo-hygiene.yaml are excluded
+        # deliberately (OMN-16602 / OMN-18016): the shared .yamlfmt sets
+        # include_document_start:true, and the gate validators' restricted YAML
+        # parsers fail closed (exit 2) on the bare '---' marker yamlfmt would
+        # insert.
+        exclude: ^(\.github/|\.kb-doc-gate\.yaml$|\.public-repo-hygiene\.yaml$)
 
   # Essential file formatting (standard across ecosystem)
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
-      - id: trailing-whitespace
-        args: [--markdown-linebreak-ext=md]
-        exclude: ^\.github/workflows/
       - id: end-of-file-fixer
         exclude: ^(\.github/workflows/|\.mcp\.json$)
       - id: check-merge-conflict
@@ -412,8 +414,7 @@ repos:
         entry: >
           bash -c 'PLAN_FILES=$(git diff --cached --name-only -- "docs/plans/"); if [ -n "$PLAN_FILES"
           ]; then echo "ERROR: Planning docs must live in omni_home/docs/plans/, not in this repo:"; echo
-          "$PLAN_FILES"; echo ""; echo "Move your file to: /Volumes/PRO-G40/Code/omni_home/docs/plans/";
-          exit 1; fi'
+          "$PLAN_FILES"; echo ""; echo "Move your file to: \$OMNI_HOME/docs/plans/"; exit 1; fi'
         language: system
         pass_filenames: false
         always_run: true
@@ -554,6 +555,12 @@ repos:
         language: script
         pass_filenames: true
         stages: [commit-msg]
+      - id: strip-ai-coauthor-trailer
+        name: Strip AI-generated Co-Authored-By trailers from commit messages
+        entry: perl -i -ne 'print unless /^co-authored-by:.*claude.*noreply\@anthropic\.com/i'
+        language: system
+        pass_filenames: true
+        stages: [commit-msg]
 
   # OMN-13291 (W0): validator-requirements fleet gate. Reports ALL missing
   # required gates for omnimemory against omnibase_core's
@@ -575,7 +582,7 @@ repos:
           - architecture-handshakes/validator-requirements-baseline.yaml
 
 # Configuration
-default_install_hook_types: [pre-commit, pre-push]
+default_install_hook_types: [pre-commit, pre-push, commit-msg]
 default_stages: [pre-commit]
 fail_fast: false
 

omninode_memory-0.18.2/.public-repo-hygiene.yaml

@@ -0,0 +1,59 @@
+# Public-repository hygiene gate — this repo's declaration (OMN-18014).
+#
+# Layer (a) of the gate: the TOP-LEVEL PATH ALLOWLIST. Anything tracked at the
+# repository root that is not named below fails. This is the half that refuses
+# the next junk directory nobody has invented yet — a denylist must anticipate
+# that directory, an allowlist does not.
+#
+# Seeded from OmniNode-ai/omnimemory@dev at adoption time, MINUS the entries that
+# are themselves findings. Adding an entry here is a decision to publish that
+# directory, not a formality.
+#
+# WITHHELD AT ADOPTION, and they must stay withheld:
+#   (none — every root entry in this repo is legitimate)
+#
+# mode: report — the gate records every finding with a per-class count and
+# exits 0. It flips to enforce when the residue is FIXED, never by moving the
+# residue into this file: that is the recurrence mechanism the OMN-17992
+# programme exists to remove.
+
+mode: report
+suppression_registry: ".public-repo-hygiene-suppressions.yaml"
+
+allowed_top_level:
+  - ".claude"
+  - ".env.example"
+  - ".flake8"
+  - ".github"
+  - ".gitignore"
+  - ".kb-doc-gate.yaml"
+  - ".markdown-link-check.json"
+  - ".onex_ratchets"
+  - ".pre-commit-config.yaml"
+  - ".pre-commit-hooks"
+  - ".public-repo-hygiene-suppressions.yaml"
+  - ".public-repo-hygiene.yaml"
+  - ".secrets.baseline"
+  - ".serena"
+  - ".yamlfmt"
+  - "CHANGELOG.md"
+  - "CLAUDE.md"
+  - "LICENSE"
+  - "README.md"
+  - "SECURITY.md"
+  - "architecture-handshakes"
+  - "contract.yaml"
+  - "contracts"
+  - "deployment"
+  - "docker-compose.prod.yml"
+  - "docker-compose.yml"
+  - "docs"
+  - "examples"
+  - "pyproject.toml"
+  - "pyrightconfig.json"
+  - "scripts"
+  - "src"
+  - "tests"
+  - "uv.lock"
+  - "validate_architecture_improvements.py"
+  - "validation"

{omninode_memory-0.18.1 → omninode_memory-0.18.2}/CHANGELOG.md

@@ -1,3 +1,15 @@
+## v0.18.2 (2026-09-18)
+
+### Release
+- Cut omnimemory from dev at 0.18.2 by the scheduled release train.
+- 3 release-relevant commit(s) merged since v0.18.1.
+- Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.
+
+### Included Since v0.18.1
+- chore(deps, OMN-13902): refresh omninode sibling locks [bot] (#504)
+- docs(OMN-16602): scrub omnimemory docs to zero residual and require kb-doc-gate strict (#473)
+- build(deps-dev): update neo4j requirement from <6.0.0,>=5.0.0 to >=5.0.0,<7.0.0 (#471)
+
 ## v0.18.1 (2026-08-31)
 
 Patch release cut to ship the OMN-17236 PII detector pattern fixes, which merged

{omninode_memory-0.18.1 → omninode_memory-0.18.2}/CLAUDE.md

@@ -31,6 +31,23 @@ pre-commit run --all-files
 
 MIT SPDX headers required in `src/`, `tests/`, `scripts/`, `examples/` (spec: `omnibase_core/docs/conventions/FILE_HEADERS.md`). Stamp: `onex spdx fix src tests scripts examples` (add `--check` to dry-run). TRAP: the `# spdx-skip: <reason>` bypass is honored by the `onex spdx` CLI only — the local `validate-spdx-headers` pre-commit hook just scans the first 512 bytes for `SPDX-License-Identifier: MIT` and ignores the skip token.
 
+## Cross-Repo
+
+- Shared platform standards: `~/.claude/CLAUDE.md`
+- Core models and ONEX kernel: [`omnibase_core`](https://github.com/OmniNode-ai/omnibase_core)
+- Platform protocols: [`omnibase_spi`](https://github.com/OmniNode-ai/omnibase_spi)
+- Event bus and PostgreSQL: [`omnibase_infra`](https://github.com/OmniNode-ai/omnibase_infra)
+
+## Domain Rules
+
+- Qdrant for vector storage, Memgraph for intent/relationship graphs, PostgreSQL for metadata.
+- Document ingestion + semantic retrieval pipeline; PII detection runs before storage.
+- Runnable node handlers (`contract.yaml`) are migrating to `omnimarket`; protocols, models, adapters and `PluginMemory` stay here.
+
 ## Documentation
 
-Documentation lives in the [OmniNode knowledge base](https://github.com/OmniNode-ai/knowledge-base); the README carries the full pointer index and every migrated path under `docs/` is a stub pointing at its page. Three full documents deliberately remain: `docs/ci/CI_MONITORING_GUIDE.md`, `docs/stub_protocols.md`, `docs/db-split/fk-audit.md`. High-traffic: [Environment Variables](https://github.com/OmniNode-ai/knowledge-base/blob/main/reference/omnimemory-environment-variables.md) (Memgraph/Qdrant/Postgres/embedding env vars), [Starting OmniMemory Services](https://github.com/OmniNode-ai/knowledge-base/blob/main/runbooks/omnimemory-starting-memory-services.md), [ONEX Four-Node Architecture](https://github.com/OmniNode-ai/knowledge-base/blob/main/architecture/omnimemory-four-node-architecture.md). What stays in-repo: this file, `AGENT.md`, `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, `CHANGELOG.md`, and the CI/agent-config and point-in-time files under `docs/` that are out of scope for the public knowledge base.
+Every OmniMemory document lives in the OmniNode knowledge base, not in this repository. The only markdown that remains here is this file, the root `README.md`, `CHANGELOG.md`, `LICENSE`, `SECURITY.md`, and the `.claude/` and `.github/` trees — enforced by the required `kb-doc-gate` check running in `strict` mode (`.kb-doc-gate.yaml`). A pointer stub is not a removal: the README's Documentation section carries the signposting role for the whole repo and is the full page index.
+
+- Public: <https://github.com/OmniNode-ai/knowledge-base>
+
+High-traffic pages: [Environment Variables](https://github.com/OmniNode-ai/knowledge-base/blob/main/reference/omnimemory-environment-variables.md), [Starting OmniMemory Services](https://github.com/OmniNode-ai/knowledge-base/blob/main/runbooks/omnimemory-starting-memory-services.md), [ONEX Four-Node Architecture](https://github.com/OmniNode-ai/knowledge-base/blob/main/architecture/omnimemory-four-node-architecture.md), [PII Handling](https://github.com/OmniNode-ai/knowledge-base/blob/main/guides/omnimemory-pii-handling.md).

omninode_memory-0.18.2/PKG-INFO

@@ -0,0 +1,146 @@
+Metadata-Version: 2.5
+Name: omninode-memory
+Version: 0.18.2
+Summary: OmniNode memory primitives — models, protocols, and storage adapters for Qdrant, Memgraph, and PostgreSQL backends.
+Project-URL: Homepage, https://github.com/OmniNode-ai/omnimemory
+Project-URL: Repository, https://github.com/OmniNode-ai/omnimemory
+Project-URL: Documentation, https://github.com/OmniNode-ai/knowledge-base
+Project-URL: Issues, https://github.com/OmniNode-ai/omnimemory/issues
+Project-URL: Changelog, https://github.com/OmniNode-ai/omnimemory/blob/main/CHANGELOG.md
+Author-email: "OmniNode.ai" <contact@omninode.ai>
+License: MIT
+License-File: LICENSE
+Keywords: embeddings,memory,omninode,onex,rag,semantic-search
+Requires-Python: <3.14,>=3.12
+Requires-Dist: aiohttp<4.0.0,>=3.14.1
+Requires-Dist: alembic<2.0.0,>=1.18.5
+Requires-Dist: asyncio-mqtt<1.0.0,>=0.16.2
+Requires-Dist: asyncpg<1.0.0,>=0.31.0
+Requires-Dist: cachetools<8.0.0,>=6.2.4
+Requires-Dist: fastapi<0.142.0,>=0.136.3
+Requires-Dist: httpx<1.0.0,>=0.28.1
+Requires-Dist: mcp<3.0.0,>=1.27.2
+Requires-Dist: omnibase-core<0.48.0,>=0.47.0
+Requires-Dist: omnibase-infra<0.39.0,>=0.38.4
+Requires-Dist: omnibase-spi<0.24.0,>=0.23.0
+Requires-Dist: pinecone-client<7.0.0,>=6.0.0
+Requires-Dist: psutil<8.0.0,>=7.2.2
+Requires-Dist: psycopg2-binary<3.0.0,>=2.9.12
+Requires-Dist: pydantic-settings<3.0.0,>=2.14.2
+Requires-Dist: pydantic<3.0.0,>=2.13.4
+Requires-Dist: python-dotenv<2.0.0,>=1.2.2
+Requires-Dist: pyyaml<7.0.0,>=6.0.3
+Requires-Dist: qdrant-client<1.20.0,>=1.18.0
+Requires-Dist: redis<9.0.0,>=8.0.1
+Requires-Dist: sqlalchemy<3.0.0,>=2.0.51
+Requires-Dist: structlog<26.0.0,>=25.5.0
+Requires-Dist: supabase<3.0.0,>=2.31.0
+Requires-Dist: uvicorn[standard]<1.0.0,>=0.49.0
+Provides-Extra: graph
+Requires-Dist: httpx<1.0.0,>=0.28.1; extra == 'graph'
+Requires-Dist: neo4j<7.0.0,>=5.0.0; extra == 'graph'
+Requires-Dist: qdrant-client<1.20.0,>=1.18.0; extra == 'graph'
+Description-Content-Type: text/markdown
+
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="docs/assets/brand/omninode-inline-white.png">
+    <source media="(prefers-color-scheme: light)" srcset="docs/assets/brand/omninode-inline-full-color.svg">
+    <img alt="omninode" src="docs/assets/brand/omninode-inline-full-color.svg" width="420">
+  </picture>
+</p>
+
+# OmniMemory
+
+[![CI](https://github.com/OmniNode-ai/omnimemory/actions/workflows/ci.yml/badge.svg)](https://github.com/OmniNode-ai/omnimemory/actions/workflows/ci.yml)
+[![Python 3.12+](https://img.shields.io/badge/python-3.12+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![ONEX 4.0](https://img.shields.io/badge/ONEX-4.0-purple.svg)](https://github.com/OmniNode-ai/omnibase_core)
+[![Linting: ruff](https://img.shields.io/badge/linting-ruff-261230.svg)](https://github.com/astral-sh/ruff)
+[![Type checked: mypy](https://img.shields.io/badge/type%20checked-mypy%20strict-blue.svg)](https://mypy.readthedocs.io/)
+[![Pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)
+
+**Memory persistence, recall, and semantic retrieval for the OmniNode platform.** OmniMemory provides ONEX (OmniNode eXecution)-compliant nodes and handlers for storing agent context, indexing embeddings, querying intent graphs, and managing the full memory lifecycle across distributed omni agents.
+
+## Documentation
+
+**Every OmniMemory document lives in the OmniNode knowledge base, not in this repository.** This README is the landing page and the full index; there are no `docs/` pages here to read.
+
+- **[OmniNode knowledge base](https://github.com/OmniNode-ai/knowledge-base)** — public documentation home.
+
+**Architecture**
+- [ONEX Four-Node Architecture](https://github.com/OmniNode-ai/knowledge-base/blob/main/architecture/omnimemory-four-node-architecture.md) — the EFFECT / COMPUTE / REDUCER / ORCHESTRATOR archetypes applied to memory
+- [ARCH-002: Kafka Abstraction Rule](https://github.com/OmniNode-ai/knowledge-base/blob/main/architecture/omnimemory-arch-002-kafka-abstraction.md) — why nodes never speak to a broker directly
+
+**Reference**
+- [Environment Variables](https://github.com/OmniNode-ai/knowledge-base/blob/main/reference/omnimemory-environment-variables.md) — every setting, type, default and constraint
+- [Memory Data Ownership](https://github.com/OmniNode-ai/knowledge-base/blob/main/reference/omnimemory-memory-data-ownership.md) — which repository owns which storage service
+- [Runtime Plugin System](https://github.com/OmniNode-ai/knowledge-base/blob/main/reference/omnimemory-runtime-plugins.md) — how `PluginMemory` wires into the ONEX kernel
+- [Handler Reuse Matrix](https://github.com/OmniNode-ai/knowledge-base/blob/main/reference/omnimemory-handler-reuse-matrix.md) — which `omnibase_infra` handler each memory node reuses
+
+**Guides**
+- [PII Handling](https://github.com/OmniNode-ai/knowledge-base/blob/main/guides/omnimemory-pii-handling.md) — detection, sanitization and storage-path integration
+- [Performance Testing](https://github.com/OmniNode-ai/knowledge-base/blob/main/guides/omnimemory-performance-testing.md) — SLA targets, benchmarks and how to read them
+- [Market Migration Boundary](https://github.com/OmniNode-ai/knowledge-base/blob/main/guides/omnimemory-market-migration-boundary.md) — what moves to `omnimarket` and what stays
+
+**Runbooks**
+- [Starting OmniMemory Services](https://github.com/OmniNode-ai/knowledge-base/blob/main/runbooks/omnimemory-starting-memory-services.md) — bringing the storage layer up, health checks, troubleshooting
+
+Only this README, [CLAUDE.md](CLAUDE.md), [CHANGELOG.md](CHANGELOG.md), [LICENSE](LICENSE), [SECURITY.md](SECURITY.md) and the `.claude/` and `.github/` trees carry markdown in this repository. The `kb-doc-gate` required check runs in `strict` mode (see [`.kb-doc-gate.yaml`](.kb-doc-gate.yaml)) and fails any PR that reintroduces documentation here.
+
+---
+
+## What This Repo Owns
+
+- **Domain models** — memory, crawl, persona, intent, and intelligence Pydantic models in `src/omnimemory/models/`
+- **Protocol interfaces** — `ProtocolEmbeddingClient`, `ProtocolEmbeddingProvider`, `ProtocolIntentGraphAdapter`, `ProtocolSecretsProvider` and the base protocols in `src/omnimemory/protocols/`
+- **Storage adapters** — Qdrant, Memgraph, Valkey and filesystem implementations in `handlers/adapters/` and `nodes/*/adapters/`
+- **Runtime plugin** — `PluginMemory` in `src/omnimemory/runtime/`, registered as `onex.domain_plugins`
+- **Memory-layer data services** — Qdrant, Memgraph, Valkey, Kreuzberg (owned via `docker-compose.yml`)
+- **Node handlers** — contract-carrying nodes in `src/omnimemory/nodes/`, migrating to `omnimarket`
+
+Not owned here: Kafka/Redpanda and PostgreSQL ([`omnibase_infra`](https://github.com/OmniNode-ai/omnibase_infra)), the ONEX kernel and contracts ([`omnibase_core`](https://github.com/OmniNode-ai/omnibase_core)), platform-boundary protocols ([`omnibase_spi`](https://github.com/OmniNode-ai/omnibase_spi)), the post-migration node runtime ([`omnimarket`](https://github.com/OmniNode-ai/omnimarket)), and dashboard read models ([`omnidash`](https://github.com/OmniNode-ai/omnidash)). See [Memory Data Ownership](https://github.com/OmniNode-ai/knowledge-base/blob/main/reference/omnimemory-memory-data-ownership.md) for the full boundary table, and [Market Migration Boundary](https://github.com/OmniNode-ai/knowledge-base/blob/main/guides/omnimemory-market-migration-boundary.md) for what is moving.
+
+---
+
+## Quick Start
+
+```bash
+git clone https://github.com/OmniNode-ai/omnimemory.git
+cd omnimemory
+
+# Start platform infra first (Kafka + PostgreSQL — owned by omnibase_infra)
+infra-up
+
+# Start the memory data services (Qdrant 6333, Memgraph 7687, Valkey 6379, Kreuzberg 8090)
+docker compose up -d
+docker compose ps
+
+# Install and run the fast test suite
+uv sync --group dev
+uv run pytest tests/ -m unit
+```
+
+Ports and every other setting are configurable — see [Environment Variables](https://github.com/OmniNode-ai/knowledge-base/blob/main/reference/omnimemory-environment-variables.md). The full startup runbook, with health checks and troubleshooting, is [Starting OmniMemory Services](https://github.com/OmniNode-ai/knowledge-base/blob/main/runbooks/omnimemory-starting-memory-services.md).
+
+## Development
+
+```bash
+uv run ruff format src/ tests/ && uv run ruff check --fix src/ tests/
+uv run mypy src/omnimemory/ --strict
+uv run pytest tests/ -v
+pre-commit run --all-files
+```
+
+Repo invariants, enforced conventions and the pre-commit/pre-push split are in [CLAUDE.md](CLAUDE.md).
+
+---
+
+## Security, Contributing, and License
+
+- [SECURITY.md](SECURITY.md)
+- [CONTRIBUTING.md](.github/CONTRIBUTING.md)
+- [CODE_OF_CONDUCT.md](.github/CODE_OF_CONDUCT.md)
+- [LICENSE](LICENSE)
+
+Open an issue or email <contact@omninode.ai>.