omninode-memory 0.18.2__tar.gz → 0.18.4__tar.gz

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/required-checks.yaml

@@ -14,9 +14,23 @@
 #
 # Applied via: gh api repos/OmniNode-ai/omnimemory/branches/main/protection -X PUT
 # Mode: strict (branch must be up-to-date before merging)
-# Total required checks: 11
+# Manifest entries (including CI Summary members): 15
 
 required_checks:
+  # OMN-18854: this is an umbrella member, not a separate protection context.
+  - name: "occ-preflight / eligibility"
+    workflow: ci.yml
+    job_id: occ-preflight
+    conditional: true
+    condition: "Required on pull_request and merge_group; not applicable on push or workflow_dispatch"
+    rationale: >-
+      OMN-18854. The shared eligibility validator feeds the required CI Summary
+      through the OCC Eligibility Admission job. On pull_request and
+      merge_group, only successful preflight passes admission; CI Summary
+      requires a successful admission verdict on every event. Failed,
+      cancelled, skipped and absent results block. The caller and validator
+      source use the same immutable omnibase_core revision.
+
   # -- Phase 1: Quick Validation (parallel, ~2-5 min) -------------------------
 
   - name: "Migration Freeze Check"
@@ -75,6 +89,41 @@ required_checks:
     condition: "Skipped when no Python/Markdown files changed in the PR diff"
     rationale: "Prevents AI-generated slop patterns from entering the codebase (OMN-2972)"
 
+  - name: "Detect Secrets"
+    workflow: ci.yml
+    job_id: detect-secrets
+    conditional: false
+    rationale: >-
+      OMN-18669. Judges the tracked set against .secrets.baseline with
+      detect-secrets-hook. Gates merges through the required CI Summary
+      context, which needs: this job and accepts only a success result --
+      skipped, cancelled and failure all block. Its selection and exclusions
+      are identical to the detect-secrets pre-commit hook by construction;
+      tests/unit/test_validate_ci_precommit_alignment.py fails if the pair
+      drifts apart.
+
+  - name: "Shape-Gate Independence (OMN-20298)"
+    workflow: ci.yml
+    job_id: shape-gate-independence
+    conditional: false
+    rationale: >-
+      OMN-20298. Refuses any shape-gate detector job that depends on the
+      change-control preflight. Unconditional (no needs, no if); gates merges
+      through the required CI Summary context, which needs: this job and
+      accepts only a success result.
+
+  - name: "Canonical File Shape (OMN-20304)"
+    workflow: ci.yml
+    job_id: canonical-file-shape
+    conditional: false
+    rationale: >-
+      OMN-20304. Refuses a new code file outside the canonical locations, new
+      imperative SKILL.md lines and any new baseline, allowlist or suppression
+      entry, against the shrink-only
+      .onex_ratchets/canonical_file_shape_baseline.txt. Gates merges through
+      the required CI Summary context, which needs: this job and accepts only a
+      success result.
+
   # -- Phase 2: Full Test Suite ------------------------------------------------
 
   - name: "Tests"

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/workflows/auto-merge.yml

@@ -21,11 +21,21 @@
 # workflow is NOT a required status check on dev, so narrowing it cannot
 # wedge branch protection (verified live via required_status_checks readback
 # before landing).
+# OMN-19216 (2026-09-22): RE-ADD `ready_for_review` to the pull_request
+# trigger, by operator decision. OMN-14777 dropped it because the ready
+# flip force-armed PRs someone meant to hold; since then a PR opened as a
+# draft was never armed by its flip and needed a manual arming step.
+# This repository has no OMN-18179 hold gate; the author gate below and
+# the already-armed guard are what bound arming on the flip.
+# Arming stays limited to the allowed author (the resolve step reads the
+# PR author from the payload, not the sender who flipped it), and the
+# Enable step returns early when the PR is already armed, so a ready flip
+# racing a check_suite or review event cannot arm twice.
 name: Auto-Merge
 
 on:
   pull_request:
-    types: [opened]
+    types: [opened, ready_for_review]
   pull_request_review:
     types: [submitted, dismissed]
   check_suite:
@@ -41,6 +51,22 @@ permissions:
   contents: write
   pull-requests: write
 
+# OMN-19216: one arming run per PR at a time. A newer event queues behind
+# a running one instead of racing it; the already-armed guard makes the
+# queued run a no-op. Every arming path carries a PR number. The constant
+# fallback covers only a check_suite with no associated PR, which the
+# resolve step skips, and it keeps those in one group rather than giving
+# each run a unique key that would serialize nothing.
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.number ||
+      github.event.inputs.pr_number ||
+      github.event.check_suite.pull_requests[0].number ||
+      'no-pr'
+    }}
+  cancel-in-progress: false
+
 jobs:
   auto-merge:
     name: Enable Auto-Merge
@@ -96,6 +122,14 @@ jobs:
           PR: ${{ steps.resolve.outputs.pr }}
         run: |
           set -euo pipefail
+          # OMN-19216: a ready flip, a check_suite completion and a review can each
+          # reach this step for one PR. An already-armed PR is left alone rather
+          # than armed a second time.
+          armed="$(gh pr view "$PR" --repo "$GH_REPO" --json autoMergeRequest --jq '.autoMergeRequest != null')"
+          if [ "$armed" = "true" ]; then
+            echo "PR #${PR} is already armed; not arming again (OMN-19216)."
+            exit 0
+          fi
           # OMN-13138/13214: on a queue-controlled branch the merge method is
           # set by the merge queue, so passing an explicit --squash is
           # rejected ("The merge strategy for dev is set by the merge queue")

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/workflows/auto-tag-on-merge.yml

@@ -33,6 +33,10 @@ on:
 # left byte-unchanged for whatever still calls it. Precedent and shape:
 # omnibase_core#1703 and omnibase_spi#308, under OMN-18658.
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   auto-tag:
     if: >-

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/workflows/ban-hardcoded-runner-ip.yml

@@ -22,11 +22,16 @@ on:
       - tests/**
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   ban-hardcoded-runner-ip:
     # OMN-17993: pinned to an exact SHA, not @main. omniclaude main lags dev by
     # design (release-synced), so @main still resolves to the pre-widening scanner
     # body that scans workflow files only and exits 0 on a tests-only diff.
-    uses: OmniNode-ai/omniclaude/.github/workflows/ban-hardcoded-runner-ip.yml@6f965a67ea2873fd76df955bca54b3a6472d2a91
+    uses: OmniNode-ai/omniclaude/.github/workflows/ban-hardcoded-runner-ip.yml@3ea5bfc90dec0efd386214247b38c8c2cc46508d
     permissions:
       contents: read
+      pull-requests: read

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/workflows/call-occ-autobind.yml

@@ -100,15 +100,17 @@ jobs:
       github.actor != 'renovate[bot]' &&
       (contains(github.event.pull_request.title, 'OMN-') ||
        contains(github.event.pull_request.head.ref, 'OMN-'))
-    # OMN-14941 (F1 repin): pinned `@dev` until the reusable promotes to
-    # omniclaude main (call-occ-autobind-reusable.yml exists only on
-    # omniclaude dev today); then re-pin to `@main` or a main SHA (OMN-14812).
-    # tests/ci/test_workflow_uses_refs_resolve.py fails closed on any
-    # cross-repo `uses:` pin that does not resolve live.
-    uses: OmniNode-ai/omniclaude/.github/workflows/call-occ-autobind-reusable.yml@dev
+    # OMN-20001: the reusable and the omnimarket publisher it sources are both
+    # pinned to immutable revs (omniclaude 2a4123cf, omnimarket v0.4.276), never
+    # a sibling's live branch, so a merge there cannot turn this repo red.
+    # Bump both together in a consumer PR after an integration test of the new
+    # revs; tests/unit/test_workflow_sibling_pins.py fails closed on any
+    # sibling `uses:` / checkout without a 40-hex rev.
+    uses: OmniNode-ai/omniclaude/.github/workflows/call-occ-autobind-reusable.yml@3ea5bfc90dec0efd386214247b38c8c2cc46508d
     secrets: inherit
     with:
       lane: dev
+      omnimarket-ref: e11987165b960cb86cdeab7d0ad3fe1884bb2572 # omnimarket v0.4.276
 
   occ-autobind-manual-replay:
     # OMN-14993: manual re-publish entrypoint, gated to the workflow_dispatch
@@ -160,7 +162,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: OmniNode-ai/omnimarket
-          ref: dev
+          ref: e11987165b960cb86cdeab7d0ad3fe1884bb2572 # omnimarket v0.4.276
           path: .occ-autobind-src
           persist-credentials: false
           sparse-checkout: |

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/workflows/call-occ-companion-effect.yml

@@ -157,7 +157,7 @@ jobs:
       github.actor != 'renovate[bot]' &&
       (contains(github.event.pull_request.title, 'OMN-') ||
        contains(github.event.pull_request.head.ref, 'OMN-'))
-    uses: OmniNode-ai/omniclaude/.github/workflows/call-occ-companion-effect-reusable.yml@dev
+    uses: OmniNode-ai/omniclaude/.github/workflows/call-occ-companion-effect-reusable.yml@3ea5bfc90dec0efd386214247b38c8c2cc46508d
     # OMN-18012: the dev lane declares SASL_PLAINTEXT/SCRAM-SHA-256, so the
     # publisher needs the KAFKA_SASL_* credentials. The broker is still
     # resolved from omnimarket's committed overlay, never from a secret.
@@ -167,6 +167,7 @@ jobs:
     secrets: inherit  # pragma: allowlist secret
     with:
       lane: dev
+      omnimarket-ref: e11987165b960cb86cdeab7d0ad3fe1884bb2572 # omnimarket v0.4.276
 
   occ-companion-effect-manual-replay:
     # OMN-14993: manual re-publish entrypoint, gated to the workflow_dispatch
@@ -226,7 +227,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: OmniNode-ai/omnimarket
-          ref: dev
+          ref: e11987165b960cb86cdeab7d0ad3fe1884bb2572 # omnimarket v0.4.276
           path: .occ-companion-effect-src
           persist-credentials: false
           sparse-checkout: |

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/workflows/call-reject-skip.yml

@@ -18,11 +18,15 @@ on:
     branches: [main, dev]
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
   pull-requests: read
 
 jobs:
   call-reject-skip-token:
-    uses: OmniNode-ai/omniclaude/.github/workflows/reject-deploy-gate-skip.yml@main
+    uses: OmniNode-ai/omniclaude/.github/workflows/reject-deploy-gate-skip.yml@3ea5bfc90dec0efd386214247b38c8c2cc46508d
     secrets: inherit

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/workflows/check-handshake.yml

@@ -10,6 +10,10 @@ on:
   merge_group:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   check-handshake:
     name: Check architecture handshake
@@ -24,9 +28,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: OmniNode-ai/omnibase_core
-          # Pinned to omnibase_core main as of 2026-03-22.
-          # Update by running: gh api repos/OmniNode-ai/omnibase_core/commits/main --jq '.sha'
-          ref: 330a344cdb9c5dedd04a46dfbb0b63dae0baccfb
+                                                                                # Auto-bumped by omnibase_core publish-downstream-pin-bump.yml to 2f90bd814b14.
+          ref: 2f90bd814b140ed8f8dad74cc499b0976807e47d
           path: omnibase_core
 
       - name: Verify omnibase_core checkout

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/workflows/ci.yml

@@ -8,6 +8,8 @@ on:
     branches: [main, 'hotfix/**']
   pull_request:
     branches: [main, dev]
+    # OMN-18854: marking a draft ready must re-evaluate evidence admission.
+    types: [opened, synchronize, reopened, ready_for_review]
   merge_group:
   workflow_dispatch:
 
@@ -21,6 +23,37 @@ env:
   CACHE_VERSION: "0.1.0"
 
 jobs:
+  # OMN-18854: the existing eligibility validator must feed the required
+  # CI Summary. Other validations remain independent of this evidence gate.
+  occ-preflight:
+    if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
+    permissions:
+      contents: read
+      pull-requests: read
+    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@13ceae69c246a33c9fc8fc4b33f83fb66b89edc6
+    with:
+      core-ref: 13ceae69c246a33c9fc8fc4b33f83fb66b89edc6
+      contracts-dir: contracts
+      receipts-dir: drift/dod_receipts
+
+  # OMN-18854: evidence admission has its own verdict; shape detectors and
+  # their result aggregation do not branch directly on the evidence preflight.
+  occ-eligibility:
+    name: OCC Eligibility Admission
+    runs-on: ubuntu-latest
+    needs: occ-preflight
+    if: always()
+    steps:
+      - name: Require eligible evidence on admission events
+        run: |
+          event="${{ github.event_name }}"
+          if [[ "$event" == "pull_request" || "$event" == "merge_group" ]]; then
+            if [[ "${{ needs.occ-preflight.result }}" != "success" ]]; then
+              echo "::error::occ-preflight did not pass (result: ${{ needs.occ-preflight.result }})"
+              exit 1
+            fi
+          fi
+
   # =============================================================================
   # JOB ORDERING RATIONALE (Fail-Fast Optimization)
   # =============================================================================
@@ -150,7 +183,7 @@ jobs:
   onex-validation:
     name: ONEX Validation
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 30
 
     steps:
       - name: Checkout code
@@ -162,6 +195,9 @@ jobs:
       - name: Install dependencies
         run: uv sync --locked --reinstall-package omnibase-core --reinstall-package omnibase-spi --reinstall-package omnibase-infra
 
+      - name: Run the whole-tree pre-commit suite
+        run: uv run pre-commit run --all-files --show-diff-on-failure
+
       # SYNC: Pre-commit hook 'validate-pydantic-patterns' at pre-commit stage
       - name: Validate Pydantic patterns
         run: uv run python scripts/validation/validate_pydantic_patterns.py src/
@@ -202,6 +238,37 @@ jobs:
       - name: Validate no silent env fallbacks
         run: uv run python scripts/validation/validate_no_env_fallbacks.py
 
+      # SYNC: Pre-commit hook 'validate-model-locations' at pre-commit stage
+      - name: Validate model locations
+        run: uv run python scripts/validation/validate_model_locations.py src/
+
+      # SYNC: Pre-commit hook 'no-hardcoded-bolt-fallback' at pre-commit stage
+      - name: Validate no hardcoded bolt fallback (whole-tree backstop)
+        run: bash scripts/check_no_hardcoded_bolt.sh
+
+      # SYNC: Pre-commit hook 'kafka-no-hardcoded-fallback' at pre-commit stage
+      - name: Validate no hardcoded Kafka fallback (whole-tree backstop)
+        run: bash scripts/validation/check_kafka_no_hardcoded_fallback.sh
+
+      # SYNC: Pre-commit hook 'no-internal-ips' at pre-commit stage
+      - name: Validate no internal IPs (whole-tree backstop)
+        run: bash scripts/validation/check_no_internal_ips.sh
+
+      # CI counterpart of the no-git-precommit-additional-dependencies hook.
+      - name: Pre-commit dependencies come from package indexes (OMN-19666)
+        run: bash tests/test_precommit_additional_dependencies_omn19666.sh
+
+      # OMN-18854: the same focused regression runs before commit and in CI.
+      - name: Verify OCC eligibility enforcement (OMN-18854)
+        run: uv run pytest tests/scripts/test_occ_eligibility_enforcement.py -q
+
+      # SYNC: Pre-commit hook 'validate-gitignore-baseline' at pre-commit stage (OMN-18033)
+      # This step and the hook both pin released omnibase-core==0.47.23,
+      # matching uv.lock and carrying the packaged baseline spec; move them together.
+      # OMN-19666: do not use git+ URLs for this validator.
+      - name: Validate gitignore baseline (OMN-18033)
+        run: uv run --isolated --no-project --with "omnibase-core==0.47.23" python -m omnibase_core.validators.gitignore_baseline .
+
       - name: ONEX validation summary
         if: always()
         run: |
@@ -218,6 +285,9 @@ jobs:
           echo "- Kafka import boundary enforcement (ARCH-002)" >> $GITHUB_STEP_SUMMARY
           echo "- Pydantic model location enforcement" >> $GITHUB_STEP_SUMMARY
           echo "- No silent env fallbacks (OMN-10735)" >> $GITHUB_STEP_SUMMARY
+          echo "- No hardcoded bolt fallback" >> $GITHUB_STEP_SUMMARY
+          echo "- No hardcoded Kafka fallback" >> $GITHUB_STEP_SUMMARY
+          echo "- No hardcoded internal IPs" >> $GITHUB_STEP_SUMMARY
 
   # Phase 1 - Transport Import Guard (ARCH-002)
   # SYNC: Pre-commit hook 'validate-no-transport-imports' (omnibase_core remote hook)
@@ -309,10 +379,21 @@ jobs:
       # Uses default GITHUB_TOKEN which has read access to public repos in the org.
       # Same pattern as omniclaude ci-cd.yml. If omnibase_core becomes private,
       # add: token: ${{ secrets.OMNIBASE_CORE_ACCESS_TOKEN }}
+      # OMN-20001: read the omnibase_core rev this repo has PINNED (the one the
+      # omnibase_core downstream pin-bump bot maintains in check-handshake.yml),
+      # never core's live default branch.
+      - name: Resolve pinned omnibase_core rev
+        id: core-pin
+        run: |
+          rev="$(grep -E '^[[:space:]]+ref: [0-9a-f]{40}$' .github/workflows/check-handshake.yml | awk '{print $2}')"
+          [[ "$rev" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::no single pinned omnibase_core rev in check-handshake.yml"; exit 1; }
+          echo "rev=$rev" >> "$GITHUB_OUTPUT"
+
       - name: Checkout omnibase_core
         uses: actions/checkout@v7
         with:
           repository: OmniNode-ai/omnibase_core
+          ref: ${{ steps.core-pin.outputs.rev }}
           path: omnibase_core
 
       - name: Verify handshake is current
@@ -571,10 +652,20 @@ jobs:
     if: github.event_name == 'pull_request' || github.event_name == 'merge_group' || github.event_name == 'push'
     steps:
       - uses: actions/checkout@v7
+      # OMN-20001: read the onex_change_control rev pinned in pyproject.toml,
+      # never OCC's live default branch.
+      - name: Resolve pinned onex_change_control rev
+        id: occ-pin
+        run: |
+          rev="$(grep -oE 'onex_change_control\.git@[0-9a-f]{40}' pyproject.toml | head -1 | cut -d@ -f2)"
+          [[ "$rev" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::no pinned onex_change_control rev in pyproject.toml"; exit 1; }
+          echo "rev=$rev" >> "$GITHUB_OUTPUT"
+
       - name: Checkout onex_change_control
         uses: actions/checkout@v7
         with:
           repository: OmniNode-ai/onex_change_control
+          ref: ${{ steps.occ-pin.outputs.rev }}
           path: onex_change_control
 
       - uses: astral-sh/setup-uv@v7
@@ -618,21 +709,198 @@ jobs:
       - name: Ratchet non-canonical lifecycle-word classes against frozen allowlist (OMN-14350)
         run: |
           uv run --no-project \
-            --with 'omnibase-core @ git+https://github.com/OmniNode-ai/omnibase_core@63635097705d832e0ee9c4811093efb31349105c' \
+            --with 'omnibase-core @ git+https://github.com/OmniNode-ai/omnibase_core@f50d00fc7918d0b12ccd0d3497160325e32e7ac5' \
             python -m omnibase_core.validators.no_noncanonical_lifecycle_classes \
             --check-stale \
             --allowlist .onex_ratchets/noncanonical_class_allowlist.yaml \
             src/omnimemory
 
+  shape-gate-independence:
+    name: Shape-Gate Independence (OMN-20298)
+    # OMN-20298: no shape-gate detector may depend on the change-control preflight.
+    # Unconditional (no needs, no if); wired into required CI Summary via needs: +
+    # strict success-only verdict check.
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: "0.8.3"
+      - name: Refuse shape-gate detectors that depend on the preflight (OMN-20298)
+        run: |
+          uv run --no-project \
+            --with 'omnibase-core @ git+https://github.com/OmniNode-ai/omnibase_core@7f20b97895f01996c5858dde385ba8991c06e708' \
+            python -m omnibase_core.handlers.handler_shape_gate_independence
+
+  # ============================================================================
+  # Detect Secrets - the CI half of the .secrets.baseline gate (OMN-18669)
+  # ============================================================================
+  # This repository carried a committed `.secrets.baseline` that NO hook and NO
+  # workflow read. Measured 2026-09-18 (integration probe R9): the file was
+  # present, the repository looked protected, and a full scan against it
+  # surfaced 47 findings in 18 files nothing had ever been asked to approve.
+  # Nobody had loosened a gate -- there was no gate.
+  #
+  # Uses detect-secrets-hook, which compares findings to the baseline on the
+  # full equality model (hashed_secret + type) and exits non-zero only for
+  # findings NOT already baselined. Same pin, same baseline and the same
+  # exclusions as the `detect-secrets` pre-commit hook in
+  # .pre-commit-config.yaml -- if the two selections differ, a commit passes
+  # locally and this check fails, or worse, the reverse.
+  #
+  # Wired into the required `CI Summary` context through needs: below, with a
+  # strict success-only verdict, so it gates merges rather than advising.
+  detect-secrets:
+    name: Detect Secrets
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      # detect-secrets is a CI-only scanning tool, not a project dependency.
+      # Installed via pip (not uv) because it is not declared in pyproject.toml.
+      - name: Install detect-secrets
+        run: pip install detect-secrets==1.5.0
+
+      - name: Run detect-secrets-hook
+        run: |
+          # -n/--no-verify (OMN-15063): several plugins (SlackDetector,
+          # StripeDetector, ...) call the live vendor API to "verify" each
+          # regex-matched candidate, then silently drop anything that comes
+          # back VERIFIED_FALSE. A negative or uncertain live-verification
+          # result must not silently remove a finding (fail-closed). Never
+          # remove this flag without re-proving the miss is fixed another way.
+          set +e
+          git ls-files -z | xargs -0 detect-secrets-hook \
+            --no-verify \
+            --baseline .secrets.baseline \
+            --exclude-files 'uv\.lock' \
+            --exclude-files 'hardcoded_model_config_baseline\.yaml' \
+            --exclude-files '\.venv/' \
+            --exclude-files 'tests/fixtures/' \
+            --exclude-files '\.git/' \
+            --exclude-files '\.secrets\.baseline' \
+            --exclude-files '\.github/workflows/.*\.ya?ml'  # workflow YAML legitimately references the secrets context
+          HOOK_EXIT=$?
+          set -e
+
+          if [[ $HOOK_EXIT -eq 0 ]]; then
+            echo "## Secrets Scan" >> $GITHUB_STEP_SUMMARY
+            echo "No new secrets detected (all findings are baselined)." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "## New Secrets Detected" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Findings are present that .secrets.baseline does not carry." >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "If they are real, remove them and rotate under the credential-rotation" >> $GITHUB_STEP_SUMMARY
+            echo "runbook. If they are false positives, audit them into the baseline:" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            echo 'detect-secrets scan --no-verify --exclude-files "uv\.lock" --exclude-files "\.venv/" --exclude-files "tests/fixtures/" --exclude-files "\.git/" --exclude-files "\.secrets\.baseline" --exclude-files "\.github/workflows/.*\.ya?ml" --force-use-all-plugins > .secrets.baseline' >> $GITHUB_STEP_SUMMARY
+            echo 'detect-secrets audit .secrets.baseline' >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Never loosen the hook or widen the exclusions to clear this." >> $GITHUB_STEP_SUMMARY
+            exit $HOOK_EXIT
+          fi
+
+  # Canonical-file-shape ratchet (OMN-20304). Operator ruling 2026-10-01: no
+  # new scripts, plugins or exceptions in any repository. Refuses a new code
+  # file outside src/<pkg>/{nodes,handlers,models,protocols,contracts,enums}/,
+  # tests/ and docs/, new imperative lines in a SKILL.md, and any new baseline,
+  # allowlist, waiver or suppression entry. Existing files sit in the
+  # shrink-only .onex_ratchets/canonical_file_shape_baseline.txt. Same module
+  # and same omnibase_core commit as the canonical-file-shape pre-commit hook.
+  # Unconditional: no `if:`, no `needs:`. The positive-control step plants a
+  # bad sample on every run and fails unless the ratchet refuses it.
+  canonical-file-shape:
+    name: Canonical File Shape (OMN-20304)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      CANONICAL_FILE_SHAPE_CORE: "omnibase-core @ git+https://github.com/OmniNode-ai/omnibase_core@f50d00fc7918d0b12ccd0d3497160325e32e7ac5"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: "0.8.3"
+      - name: Positive control (planted bad sample refused, clean sample accepted)
+        run: |
+          set -u
+          ratchet() {
+            uv run --no-project --with "$CANONICAL_FILE_SHAPE_CORE" \
+              python -m omnibase_core.validators.canonical_file_shape "$@"
+          }
+          mkdir -p bin tests
+          printf '#!/bin/sh\necho planted\n' > bin/zz_canary_planted
+          git add bin/zz_canary_planted
+          if ratchet; then
+            echo "POSITIVE CONTROL FAILED: planted bin/zz_canary_planted was accepted"
+            exit 1
+          fi
+          echo "positive control: planted bad sample refused"
+          git rm -q --cached bin/zz_canary_planted
+          rm bin/zz_canary_planted
+          printf 'def test_canary() -> None:\n    assert True\n' > tests/zz_canary_clean.py
+          git add tests/zz_canary_clean.py
+          ratchet
+          echo "positive control: clean sample accepted"
+          git rm -q --cached tests/zz_canary_clean.py
+          rm tests/zz_canary_clean.py
+      - name: Refuse new non-canonical files and new exceptions
+        env:
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          MQ_BASE: ${{ github.event.merge_group.base_sha }}
+          PUSH_BEFORE: ${{ github.event.before }}
+        run: |
+          set -u
+          base="${PR_BASE:-${MQ_BASE:-${PUSH_BEFORE:-}}}"
+          if [ -n "$base" ] && git cat-file -e "${base}^{commit}" 2>/dev/null; then
+            base="$(git merge-base "$base" HEAD)"
+            uv run --no-project --with "$CANONICAL_FILE_SHAPE_CORE" \
+              python -m omnibase_core.validators.canonical_file_shape --base "$base" --head HEAD
+          else
+            echo "no base revision on this event; checking the tree against the baseline only"
+            uv run --no-project --with "$CANONICAL_FILE_SHAPE_CORE" \
+              python -m omnibase_core.validators.canonical_file_shape --head HEAD
+          fi
+
   ci-summary:
     name: CI Summary
     runs-on: ubuntu-latest
-    needs: [migration-freeze, lint, pyright, onex-validation, transport-import-guard, contract-validation, io-audit, check-handshake, test-select, tests-gate, compliance, contract-compliance, no-noncanonical-lifecycle-classes]
+    needs: [migration-freeze, lint, pyright, onex-validation, transport-import-guard, contract-validation, io-audit, check-handshake, test-select, tests-gate, compliance, contract-compliance, no-noncanonical-lifecycle-classes, detect-secrets, shape-gate-independence, canonical-file-shape, occ-eligibility]
     if: always()
 
     steps:
       - name: Check test results
         run: |
+          # OMN-18854: require the admission verdict on every event. That job
+          # judges eligibility on PR/queue events and passes non-admission events.
+          if [[ "${{ needs.occ-eligibility.result }}" != "success" ]]; then
+            echo "::error::occ-eligibility did not pass (result: ${{ needs.occ-eligibility.result }})"
+            exit 1
+          fi
           # OMN-14350: strict fail-closed gate on the non-canonical lifecycle-class
           # ratchet - only 'success' passes; skipped/cancelled/failure ALL block. It is
           # in needs: so this job WAITS for it (no race).
@@ -640,6 +908,25 @@ jobs:
             echo "::error::no-noncanonical-lifecycle-classes ratchet did not pass (result: ${{ needs.no-noncanonical-lifecycle-classes.result }}) - fail-closed (OMN-14350)"
             exit 1
           fi
+          # OMN-20298: strict fail-closed gate on shape-gate independence - only
+          # 'success' passes; skipped/cancelled/failure ALL block.
+          if [[ "${{ needs.shape-gate-independence.result }}" != "success" ]]; then
+            echo "::error::shape-gate-independence did not pass (result: ${{ needs.shape-gate-independence.result }}) - fail-closed (OMN-20298)"
+            exit 1
+          fi
+          # OMN-18669: strict fail-closed gate on the secrets scan - only 'success'
+          # passes; skipped/cancelled/failure ALL block. A secrets gate that a
+          # skipped job can satisfy is the state this ticket exists to remove.
+          if [[ "${{ needs.detect-secrets.result }}" != "success" ]]; then
+            echo "::error::detect-secrets did not pass (result: ${{ needs.detect-secrets.result }}) - fail-closed (OMN-18669)"
+            exit 1
+          fi
+          # OMN-20304: strict fail-closed gate on the canonical-file-shape ratchet -
+          # only 'success' passes; skipped/cancelled/failure ALL block.
+          if [[ "${{ needs.canonical-file-shape.result }}" != "success" ]]; then
+            echo "::error::canonical-file-shape ratchet did not pass (result: ${{ needs.canonical-file-shape.result }}) - fail-closed (OMN-20304)"
+            exit 1
+          fi
           migration_freeze="${{ needs.migration-freeze.result }}"
           lint="${{ needs.lint.result }}"
           pyright="${{ needs.pyright.result }}"

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/workflows/contract-validation.yml

@@ -95,7 +95,7 @@ jobs:
       - name: Run contract validation
         id: validate-contract
         if: steps.resolve-branch.outputs.skip_validation != 'true'
-        uses: OmniNode-ai/onex_change_control/.github/actions/validate-contract@main
+        uses: OmniNode-ai/onex_change_control/.github/actions/validate-contract@725d2967b031d7065efd41d0751f903638202cc1
         with:
           branch-name: ${{ steps.resolve-branch.outputs.resolved_branch }}
           contracts-path: contracts

{omninode_memory-0.18.2 → omninode_memory-0.18.4}/.github/workflows/dep-provenance-gate.yml

@@ -36,6 +36,10 @@ on:
     branches: [main, dev]
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read