omninode-memory 0.18.2__tar.gz → 0.18.3__tar.gz

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/required-checks.yaml

@@ -14,7 +14,7 @@
 #
 # Applied via: gh api repos/OmniNode-ai/omnimemory/branches/main/protection -X PUT
 # Mode: strict (branch must be up-to-date before merging)
-# Total required checks: 11
+# Total required checks: 12
 
 required_checks:
   # -- Phase 1: Quick Validation (parallel, ~2-5 min) -------------------------
@@ -75,6 +75,19 @@ required_checks:
     condition: "Skipped when no Python/Markdown files changed in the PR diff"
     rationale: "Prevents AI-generated slop patterns from entering the codebase (OMN-2972)"
 
+  - name: "Detect Secrets"
+    workflow: ci.yml
+    job_id: detect-secrets
+    conditional: false
+    rationale: >-
+      OMN-18669. Judges the tracked set against .secrets.baseline with
+      detect-secrets-hook. Gates merges through the required CI Summary
+      context, which needs: this job and accepts only a success result --
+      skipped, cancelled and failure all block. Its selection and exclusions
+      are identical to the detect-secrets pre-commit hook by construction;
+      tests/unit/test_validate_ci_precommit_alignment.py fails if the pair
+      drifts apart.
+
   # -- Phase 2: Full Test Suite ------------------------------------------------
 
   - name: "Tests"

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/auto-merge.yml

@@ -21,11 +21,21 @@
 # workflow is NOT a required status check on dev, so narrowing it cannot
 # wedge branch protection (verified live via required_status_checks readback
 # before landing).
+# OMN-19216 (2026-09-22): RE-ADD `ready_for_review` to the pull_request
+# trigger, by operator decision. OMN-14777 dropped it because the ready
+# flip force-armed PRs someone meant to hold; since then a PR opened as a
+# draft was never armed by its flip and needed a manual arming step.
+# This repository has no OMN-18179 hold gate; the author gate below and
+# the already-armed guard are what bound arming on the flip.
+# Arming stays limited to the allowed author (the resolve step reads the
+# PR author from the payload, not the sender who flipped it), and the
+# Enable step returns early when the PR is already armed, so a ready flip
+# racing a check_suite or review event cannot arm twice.
 name: Auto-Merge
 
 on:
   pull_request:
-    types: [opened]
+    types: [opened, ready_for_review]
   pull_request_review:
     types: [submitted, dismissed]
   check_suite:
@@ -41,6 +51,22 @@ permissions:
   contents: write
   pull-requests: write
 
+# OMN-19216: one arming run per PR at a time. A newer event queues behind
+# a running one instead of racing it; the already-armed guard makes the
+# queued run a no-op. Every arming path carries a PR number. The constant
+# fallback covers only a check_suite with no associated PR, which the
+# resolve step skips, and it keeps those in one group rather than giving
+# each run a unique key that would serialize nothing.
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.number ||
+      github.event.inputs.pr_number ||
+      github.event.check_suite.pull_requests[0].number ||
+      'no-pr'
+    }}
+  cancel-in-progress: false
+
 jobs:
   auto-merge:
     name: Enable Auto-Merge
@@ -96,6 +122,14 @@ jobs:
           PR: ${{ steps.resolve.outputs.pr }}
         run: |
           set -euo pipefail
+          # OMN-19216: a ready flip, a check_suite completion and a review can each
+          # reach this step for one PR. An already-armed PR is left alone rather
+          # than armed a second time.
+          armed="$(gh pr view "$PR" --repo "$GH_REPO" --json autoMergeRequest --jq '.autoMergeRequest != null')"
+          if [ "$armed" = "true" ]; then
+            echo "PR #${PR} is already armed; not arming again (OMN-19216)."
+            exit 0
+          fi
           # OMN-13138/13214: on a queue-controlled branch the merge method is
           # set by the merge queue, so passing an explicit --squash is
           # rejected ("The merge strategy for dev is set by the merge queue")

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/auto-tag-on-merge.yml

@@ -33,6 +33,10 @@ on:
 # left byte-unchanged for whatever still calls it. Precedent and shape:
 # omnibase_core#1703 and omnibase_spi#308, under OMN-18658.
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   auto-tag:
     if: >-

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/ban-hardcoded-runner-ip.yml

@@ -22,11 +22,15 @@ on:
       - tests/**
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   ban-hardcoded-runner-ip:
     # OMN-17993: pinned to an exact SHA, not @main. omniclaude main lags dev by
     # design (release-synced), so @main still resolves to the pre-widening scanner
     # body that scans workflow files only and exits 0 on a tests-only diff.
-    uses: OmniNode-ai/omniclaude/.github/workflows/ban-hardcoded-runner-ip.yml@6f965a67ea2873fd76df955bca54b3a6472d2a91
+    uses: OmniNode-ai/omniclaude/.github/workflows/ban-hardcoded-runner-ip.yml@7fa1298149c7cd32bf76c4dee0290030110667d2
     permissions:
       contents: read

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/call-reject-skip.yml

@@ -18,6 +18,10 @@ on:
     branches: [main, dev]
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
   pull-requests: read

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/check-handshake.yml

@@ -10,6 +10,10 @@ on:
   merge_group:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   check-handshake:
     name: Check architecture handshake

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/ci.yml

@@ -150,7 +150,7 @@ jobs:
   onex-validation:
     name: ONEX Validation
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 30
 
     steps:
       - name: Checkout code
@@ -162,6 +162,9 @@ jobs:
       - name: Install dependencies
         run: uv sync --locked --reinstall-package omnibase-core --reinstall-package omnibase-spi --reinstall-package omnibase-infra
 
+      - name: Run the whole-tree pre-commit suite
+        run: uv run pre-commit run --all-files --show-diff-on-failure
+
       # SYNC: Pre-commit hook 'validate-pydantic-patterns' at pre-commit stage
       - name: Validate Pydantic patterns
         run: uv run python scripts/validation/validate_pydantic_patterns.py src/
@@ -202,6 +205,33 @@ jobs:
       - name: Validate no silent env fallbacks
         run: uv run python scripts/validation/validate_no_env_fallbacks.py
 
+      # SYNC: Pre-commit hook 'validate-model-locations' at pre-commit stage
+      - name: Validate model locations
+        run: uv run python scripts/validation/validate_model_locations.py src/
+
+      # SYNC: Pre-commit hook 'no-hardcoded-bolt-fallback' at pre-commit stage
+      - name: Validate no hardcoded bolt fallback (whole-tree backstop)
+        run: bash scripts/check_no_hardcoded_bolt.sh
+
+      # SYNC: Pre-commit hook 'kafka-no-hardcoded-fallback' at pre-commit stage
+      - name: Validate no hardcoded Kafka fallback (whole-tree backstop)
+        run: bash scripts/validation/check_kafka_no_hardcoded_fallback.sh
+
+      # SYNC: Pre-commit hook 'no-internal-ips' at pre-commit stage
+      - name: Validate no internal IPs (whole-tree backstop)
+        run: bash scripts/validation/check_no_internal_ips.sh
+
+      # CI counterpart of the no-git-precommit-additional-dependencies hook.
+      - name: Pre-commit dependencies come from package indexes (OMN-19666)
+        run: bash tests/test_precommit_additional_dependencies_omn19666.sh
+
+      # SYNC: Pre-commit hook 'validate-gitignore-baseline' at pre-commit stage (OMN-18033)
+      # This step and the hook both pin released omnibase-core==0.47.23,
+      # matching uv.lock and carrying the packaged baseline spec; move them together.
+      # OMN-19666: do not use git+ URLs for this validator.
+      - name: Validate gitignore baseline (OMN-18033)
+        run: uv run --isolated --no-project --with "omnibase-core==0.47.23" python -m omnibase_core.validators.gitignore_baseline .
+
       - name: ONEX validation summary
         if: always()
         run: |
@@ -218,6 +248,9 @@ jobs:
           echo "- Kafka import boundary enforcement (ARCH-002)" >> $GITHUB_STEP_SUMMARY
           echo "- Pydantic model location enforcement" >> $GITHUB_STEP_SUMMARY
           echo "- No silent env fallbacks (OMN-10735)" >> $GITHUB_STEP_SUMMARY
+          echo "- No hardcoded bolt fallback" >> $GITHUB_STEP_SUMMARY
+          echo "- No hardcoded Kafka fallback" >> $GITHUB_STEP_SUMMARY
+          echo "- No hardcoded internal IPs" >> $GITHUB_STEP_SUMMARY
 
   # Phase 1 - Transport Import Guard (ARCH-002)
   # SYNC: Pre-commit hook 'validate-no-transport-imports' (omnibase_core remote hook)
@@ -624,10 +657,87 @@ jobs:
             --allowlist .onex_ratchets/noncanonical_class_allowlist.yaml \
             src/omnimemory
 
+  # ============================================================================
+  # Detect Secrets - the CI half of the .secrets.baseline gate (OMN-18669)
+  # ============================================================================
+  # This repository carried a committed `.secrets.baseline` that NO hook and NO
+  # workflow read. Measured 2026-09-18 (integration probe R9): the file was
+  # present, the repository looked protected, and a full scan against it
+  # surfaced 47 findings in 18 files nothing had ever been asked to approve.
+  # Nobody had loosened a gate -- there was no gate.
+  #
+  # Uses detect-secrets-hook, which compares findings to the baseline on the
+  # full equality model (hashed_secret + type) and exits non-zero only for
+  # findings NOT already baselined. Same pin, same baseline and the same
+  # exclusions as the `detect-secrets` pre-commit hook in
+  # .pre-commit-config.yaml -- if the two selections differ, a commit passes
+  # locally and this check fails, or worse, the reverse.
+  #
+  # Wired into the required `CI Summary` context through needs: below, with a
+  # strict success-only verdict, so it gates merges rather than advising.
+  detect-secrets:
+    name: Detect Secrets
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      # detect-secrets is a CI-only scanning tool, not a project dependency.
+      # Installed via pip (not uv) because it is not declared in pyproject.toml.
+      - name: Install detect-secrets
+        run: pip install detect-secrets==1.5.0
+
+      - name: Run detect-secrets-hook
+        run: |
+          # -n/--no-verify (OMN-15063): several plugins (SlackDetector,
+          # StripeDetector, ...) call the live vendor API to "verify" each
+          # regex-matched candidate, then silently drop anything that comes
+          # back VERIFIED_FALSE. A negative or uncertain live-verification
+          # result must not silently remove a finding (fail-closed). Never
+          # remove this flag without re-proving the miss is fixed another way.
+          set +e
+          git ls-files -z | xargs -0 detect-secrets-hook \
+            --no-verify \
+            --baseline .secrets.baseline \
+            --exclude-files 'uv\.lock' \
+            --exclude-files '\.venv/' \
+            --exclude-files 'tests/fixtures/' \
+            --exclude-files '\.git/' \
+            --exclude-files '\.secrets\.baseline' \
+            --exclude-files '\.github/workflows/.*\.ya?ml'  # workflow YAML legitimately references the secrets context
+          HOOK_EXIT=$?
+          set -e
+
+          if [[ $HOOK_EXIT -eq 0 ]]; then
+            echo "## Secrets Scan" >> $GITHUB_STEP_SUMMARY
+            echo "No new secrets detected (all findings are baselined)." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "## New Secrets Detected" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Findings are present that .secrets.baseline does not carry." >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "If they are real, remove them and rotate under the credential-rotation" >> $GITHUB_STEP_SUMMARY
+            echo "runbook. If they are false positives, audit them into the baseline:" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            echo 'detect-secrets scan --no-verify --exclude-files "uv\.lock" --exclude-files "\.venv/" --exclude-files "tests/fixtures/" --exclude-files "\.git/" --exclude-files "\.secrets\.baseline" --exclude-files "\.github/workflows/.*\.ya?ml" --force-use-all-plugins > .secrets.baseline' >> $GITHUB_STEP_SUMMARY
+            echo 'detect-secrets audit .secrets.baseline' >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Never loosen the hook or widen the exclusions to clear this." >> $GITHUB_STEP_SUMMARY
+            exit $HOOK_EXIT
+          fi
+
   ci-summary:
     name: CI Summary
     runs-on: ubuntu-latest
-    needs: [migration-freeze, lint, pyright, onex-validation, transport-import-guard, contract-validation, io-audit, check-handshake, test-select, tests-gate, compliance, contract-compliance, no-noncanonical-lifecycle-classes]
+    needs: [migration-freeze, lint, pyright, onex-validation, transport-import-guard, contract-validation, io-audit, check-handshake, test-select, tests-gate, compliance, contract-compliance, no-noncanonical-lifecycle-classes, detect-secrets]
     if: always()
 
     steps:
@@ -640,6 +750,13 @@ jobs:
             echo "::error::no-noncanonical-lifecycle-classes ratchet did not pass (result: ${{ needs.no-noncanonical-lifecycle-classes.result }}) - fail-closed (OMN-14350)"
             exit 1
           fi
+          # OMN-18669: strict fail-closed gate on the secrets scan - only 'success'
+          # passes; skipped/cancelled/failure ALL block. A secrets gate that a
+          # skipped job can satisfy is the state this ticket exists to remove.
+          if [[ "${{ needs.detect-secrets.result }}" != "success" ]]; then
+            echo "::error::detect-secrets did not pass (result: ${{ needs.detect-secrets.result }}) - fail-closed (OMN-18669)"
+            exit 1
+          fi
           migration_freeze="${{ needs.migration-freeze.result }}"
           lint="${{ needs.lint.result }}"
           pyright="${{ needs.pyright.result }}"

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/dep-provenance-gate.yml

@@ -36,6 +36,10 @@ on:
     branches: [main, dev]
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/docs-validate.yml

@@ -9,6 +9,10 @@ on:
     branches: [main, 'hotfix/**']
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   call:
     uses: OmniNode-ai/omnibase_core/.github/workflows/validate-docs.yml@main

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/imperative-contract-guard.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/kb-doc-gate.yml

@@ -35,8 +35,12 @@ on:
   pull_request:
     branches: [dev]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   kb-doc-gate:
-    uses: OmniNode-ai/omniclaude/.github/workflows/kb-doc-gate-reusable.yml@6f965a67ea2873fd76df955bca54b3a6472d2a91
+    uses: OmniNode-ai/omniclaude/.github/workflows/kb-doc-gate-reusable.yml@7fa1298149c7cd32bf76c4dee0290030110667d2
     with:
       mode: strict

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/main-target-guard.yml

@@ -12,6 +12,10 @@ on:
   pull_request:
     types: [opened, edited, synchronize]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   main-target-guard:
     name: main-target-guard

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/omni-standards-compliance.yml

@@ -11,6 +11,10 @@ on:
   merge_group:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
   PYTHON_VERSION: "3.12"
   UV_VERSION: "0.8.3"

omninode_memory-0.18.3/.github/workflows/pin-resolvability-gate.yml

@@ -0,0 +1,111 @@
+---
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# PYPI DEPENDENCY-PIN RESOLVABILITY, BEFORE MERGE. OMN-19655.
+#
+# WHY THIS EXISTS
+#   The release workflow already refuses to publish a wheel whose declared
+#   dependencies cannot be installed from the published PyPI index
+#   (scripts/ci/verify_pypi_pin_resolvability.py, OMN-14070 / OMN-18034). That
+#   step runs AFTER the merge, so it detects and never enforces (CLAUDE.md rule
+#   5). Twice in two days a pull request raised omnimarket's omnibase-core floor
+#   to a version no published omnibase-infra pinned (omnimarket#2819 on
+#   2026-09-24, omnimarket#2896 on 2026-09-25), merged green, and then failed
+#   every release on merge until an upstream release caught up.
+#
+#   This job runs the SAME script on the pull request's own wheel, so the
+#   verdict before merge is the verdict the release job would reach after it.
+#   There is one implementation; this file is only a caller.
+#
+# WHEN IT JUDGES
+#   On a pull request it judges when the change touches pyproject.toml, uv.lock,
+#   the script or this file, and reports "not applicable" (success) otherwise:
+#   a change that moves no declared dependency cannot change what resolves. The
+#   nightly schedule judges dev unconditionally, because the index moves under
+#   an unchanged pyproject.toml (a yank, or a sibling's new exact pin).
+#
+#   NO `paths:` FILTER AND NO JOB-LEVEL `if:`, deliberately, so this context is
+#   minted on every pull request and can be made required without wedging the
+#   pull requests it does not apply to.
+
+name: PyPI Pin Resolvability
+
+on:
+  pull_request:
+  merge_group:
+  schedule:
+    # 06:23 UTC daily, off the hour and before the 07:11 release train.
+    - cron: "23 6 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  pin-resolvability:
+    name: pypi-pin-resolvability
+    # OMNI_RUNNER_SELECTOR_V1 - trusted CI defaults to self-hosted omnibase-ci;
+    # public forks default to ubuntu-latest. The untrusted test is the FORK
+    # test and only the fork test (OMN-18205). Read live from the routing
+    # seam; this workflow never writes a routing variable.
+    runs-on: >-
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # The pull_request checkout is the synthetic merge commit; its first
+          # parent is the base branch tip, so HEAD^1..HEAD is exactly the change
+          # this pull request makes to the base as it stands now.
+          fetch-depth: 2
+          persist-credentials: false
+
+      - name: Decide whether the declared dependencies can have changed
+        id: scope
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          if [ "${EVENT_NAME}" != "pull_request" ]; then
+            echo "applies=true" >>"${GITHUB_OUTPUT}"
+            echo "event ${EVENT_NAME}: judging unconditionally"
+            exit 0
+          fi
+          changed=$(git diff --name-only HEAD^1 HEAD)
+          printf 'changed files:\n%s\n' "${changed}"
+          if printf '%s\n' "${changed}" | grep -Eq \
+            '^(pyproject\.toml|uv\.lock|scripts/ci/verify_pypi_pin_resolvability\.py|\.github/workflows/pin-resolvability-gate\.yml)$'; then
+            echo "applies=true" >>"${GITHUB_OUTPUT}"
+          else
+            echo "applies=false" >>"${GITHUB_OUTPUT}"
+            echo "::notice title=PyPI pin resolvability::not applicable: this change touches no declared dependency"
+          fi
+
+      - name: Install uv
+        if: steps.scope.outputs.applies == 'true'
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: '3.12'
+
+      - name: Build the wheel this change would release
+        if: steps.scope.outputs.applies == 'true'
+        run: uv build --wheel --out-dir "${RUNNER_TEMP}/pin-resolvability-dist"
+
+      - name: Verify PyPI dependency-pin resolvability (OMN-14070, OMN-19655)
+        if: steps.scope.outputs.applies == 'true'
+        env:
+          # Same budget the release job's step uses (OMN-16047): a timeout is a
+          # throughput fault, reported as such, never as a broken pin.
+          PYPI_PIN_RESOLVE_TIMEOUT_SECONDS: '900'
+        run: python3 scripts/ci/verify_pypi_pin_resolvability.py "${RUNNER_TEMP}/pin-resolvability-dist"

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/pr-title-check.yml

@@ -10,6 +10,10 @@ on:
   merge_group:
     types: [checks_requested]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   pr-title:
     if: github.event_name == 'pull_request'

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/pre-commit.yml

@@ -9,6 +9,10 @@ on:
     branches: [main, 'hotfix/**']
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/public-repo-hygiene.yml

@@ -34,9 +34,13 @@ on:
   pull_request:
     branches: [dev]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   public-repo-hygiene:
-    uses: OmniNode-ai/omniclaude/.github/workflows/public-repo-hygiene-reusable.yml@5003030a79b410a0b08337c9f273b53e0db807e3
+    uses: OmniNode-ai/omniclaude/.github/workflows/public-repo-hygiene-reusable.yml@7fa1298149c7cd32bf76c4dee0290030110667d2
     with:
       mode: report
     secrets: inherit

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/release.yml

@@ -92,6 +92,24 @@ jobs:
             exit 1
           }
 
+      - name: Verify PyPI dependency-pin resolvability (OMN-14070, OMN-19655)
+        # This repository published to PyPI with no resolvability check at all
+        # until OMN-19655, while its four publishing siblings refused a wheel
+        # whose declared dependencies cannot be installed from the published
+        # index (omnimarket 0.4.6 pinned a nonexistent omnibase-compat, OMN-14064;
+        # omnimarket 0.4.21-0.4.24 needed an omnibase-core no published
+        # omnibase-infra allowed, OMN-18034). The script is vendored
+        # byte-for-byte from omnibase_infra and is the same one
+        # pin-resolvability-gate.yml runs before merge, so the pre-merge and
+        # release verdicts are one implementation. It installs the built wheel
+        # with `uv pip install` into a bare scratch venv, where
+        # [tool.uv.sources] is unreachable, so a broken pin fails here, before
+        # `uv publish` runs. A timeout is reported as a throughput fault, never
+        # as a broken pin (OMN-16047).
+        env:
+          PYPI_PIN_RESOLVE_TIMEOUT_SECONDS: '900'
+        run: python3 scripts/ci/verify_pypi_pin_resolvability.py dist/
+
       - name: Publish to PyPI
         run: |
           uv publish --token "$UV_PUBLISH_TOKEN" dist/*.whl dist/*.tar.gz

omninode_memory-0.18.3/.github/workflows/secrets-baseline-wiring.yml

@@ -0,0 +1,39 @@
+# SPDX-FileCopyrightText: 2026 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# Secrets Baseline Wiring Gate — thin caller. OMN-18669.
+#
+# This repository carries `.secrets.baseline`. That file is the allowlist a
+# detect-secrets scan is judged against, and on its own it is inert: it blocks
+# nothing, it proves nothing, and it looks exactly like a repository that is
+# protected. Measured 2026-09-18 across the registry, one repo carried a
+# baseline no hook and no workflow read; a full scan against it surfaced 47
+# findings in 18 files nothing had ever been asked to approve.
+#
+# So this gate refuses the silent state: a repo carrying the baseline owes BOTH
+# a pre-commit entry and a CI workflow that read it, and neither substitutes for
+# the other. A repo with no baseline passes — the gate never demands one.
+#
+# Validator + reusable workflow live in omniclaude, pinned by immutable SHA and
+# never @main: omniclaude's main is release-synced and does not carry either.
+# The pin is a SINGLE source of truth — the reusable checks its validator out at
+# github.job_workflow_sha, i.e. this very SHA — so advancing the gate is one
+# line here, plus the matching `rev:` in .pre-commit-config.yaml, in one PR.
+#
+# Surfaced context: 'secrets-baseline-wiring / secrets-baseline-wiring' (this
+# job's id / the reusable job's name). Removing this file removes the CI half
+# and the local hook then fails the repo on its own next commit.
+
+name: Secrets Baseline Wiring Gate
+
+on:
+  pull_request:
+    branches: [dev]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  secrets-baseline-wiring:
+    uses: OmniNode-ai/omniclaude/.github/workflows/secrets-baseline-wiring-reusable.yml@7fa1298149c7cd32bf76c4dee0290030110667d2

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/security-scan.yml

@@ -17,6 +17,10 @@ on:
     # Run weekly on Monday at 06:00 UTC
     - cron: "0 6 * * 1"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   codeql:
     name: CodeQL

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/stale-todo-gate.yml

@@ -22,6 +22,10 @@ on:
     branches: [main, dev]
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   stale-todo-gate:
     name: Stale TODO Gate

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/todo-audit-on-merge.yml

@@ -30,6 +30,10 @@ on:
       - main
       - dev
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   todo-audit:
     name: TODO Audit

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/url-authority-gate.yml

@@ -29,6 +29,10 @@ on:
     branches: [main, dev]
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 

{omninode_memory-0.18.2 → omninode_memory-0.18.3}/.github/workflows/validate-validator-requirements.yml

@@ -12,6 +12,10 @@ on:
   merge_group:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   validate-validator-requirements:
     name: Enforce validator-requirements.yaml (OMN-13291)