omninode-memory 0.18.4__tar.gz → 0.18.5__tar.gz

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/.github/required-checks.yaml

@@ -17,6 +17,15 @@
 # Manifest entries (including CI Summary members): 15
 
 required_checks:
+  - name: "pr-title / check-title"
+    workflow: pr-title-check.yml
+    job_id: pr-title
+    producer_kind: local
+    conditional: false
+    rationale: >-
+      PR title ticket-reference check: the job runs omnimarket's
+      node_pr_title_check_compute from a pinned omnimarket release (OMN-20997).
+
   # OMN-18854: this is an umbrella member, not a separate protection context.
   - name: "occ-preflight / eligibility"
     workflow: ci.yml

omninode_memory-0.18.5/.github/workflows/call-repo-evidence-gate.yml

@@ -0,0 +1,70 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# Repo Evidence Gate caller (OMN-20074, OCC retirement OR.6) verifies
+# omnimemory's own contracts/<OMN-N>.yaml at the PR head through
+# omnibase_core's receipt-gate reusable with evidence-source: caller.
+# This is the path omnimarket proved as the canary (OMN-20070, OMN-20072).
+#
+# Why pull_request_target: GitHub reads the workflow definition from the BASE
+# branch, so a pull request that edits this file or the reusable's pin does not
+# change which definition runs on it. The pull request's own code is only ever
+# checked out as data by the reusable, which refuses fork heads.
+#
+# dev and main are the integration branches. The activity types cover new heads,
+# reopened and ready PRs, and edits to the ticket citation or base branch.
+# Per-PR concurrency cancels superseded runs so the latest event gets a verdict.
+# Read-only contents and pull-requests permissions are all this caller needs;
+# checkout and verification belong to the reusable, with no caller secrets.
+# The full-SHA pin makes the reusable immutable; verifier-version pins the
+# released verifier used to read the caller's contracts.
+#
+# The job id is the context prefix: repo-evidence / dod-verify carries the
+# verdict, so do not add a job name. The reusable also reports a
+# repo-evidence / verify job in this mode as a success no-op (the OCC path,
+# switched off by the input); only repo-evidence / dod-verify carries a verdict.
+#
+# S5 shadow count (OMN-20074): shadow and compare-with-occ are both "true", so
+# every run records this head's new-path verdict beside OCC's occ-preflight /
+# eligibility verdict on the same head, and no repo-evidence job concludes
+# anything but success. The verdict is one `Shadow verdict:` line in the job
+# summary and in a notice annotation, the data the S5 count reads.
+# repo-evidence / dod-verify is NOT a required context here yet. Every OCC
+# context stays required and no OCC caller is removed. Making it required, and
+# then removing the OCC contexts (S6), are separate rulings that wait for this
+# repository's own S5 bar. The S6 change sets shadow and compare-with-occ back
+# to "false".
+#
+# The reusable is pinned by full SHA to the squash commit of omnibase_core#1932
+# on dev, a descendant of #1914; it carries the `shadow` input. omnimemory does
+# not host receipt-gate.yml.
+#
+# The pinned reusable refuses a verifier-version below 0.4.303 before installing
+# it (VERIFIER_FLOOR, omnibase_core#1932; OMN-20032), the first release that
+# refuses a contract leaving a criterion unbound. While shadow is "true" that
+# install step is continue-on-error, so a refusal is recorded and blocks nothing;
+# the S6 change that sets shadow to "false" makes it block.
+
+name: Repo Evidence Gate
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, edited, ready_for_review]
+    branches: [dev, main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  repo-evidence:
+    uses: OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml@4e4f5e0404d364e296c5d37db6aa3ab9e07f8ffa # OMN-20032: immutable full-SHA pin, the squash commit of omnibase_core#1932 on that repo's dev branch; descends from #1914 (carries the shadow input) and adds the VERIFIER_FLOOR 0.4.303 refusal to the verifier install step
+    with:
+      evidence-source: caller
+      verifier-version: 0.4.305
+      compare-with-occ: "true"
+      shadow: "true"

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/.github/workflows/check-handshake.yml

@@ -28,8 +28,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: OmniNode-ai/omnibase_core
-                                                                                # Auto-bumped by omnibase_core publish-downstream-pin-bump.yml to 2f90bd814b14.
-          ref: 2f90bd814b140ed8f8dad74cc499b0976807e47d
+                                                                                # Auto-bumped by omnibase_core publish-downstream-pin-bump.yml to bac865f4f32a.
+          ref: bac865f4f32a3f8ca80cabcfac06c8400d8c80d7
           path: omnibase_core
 
       - name: Verify omnibase_core checkout

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/.github/workflows/ci.yml

@@ -831,7 +831,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
-      CANONICAL_FILE_SHAPE_CORE: "omnibase-core @ git+https://github.com/OmniNode-ai/omnibase_core@f50d00fc7918d0b12ccd0d3497160325e32e7ac5"
+      CANONICAL_FILE_SHAPE_CORE: "omnibase-core @ git+https://github.com/OmniNode-ai/omnibase_core@031148215620031436cba30619bbae67c0bb38ad"
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -875,13 +875,26 @@ jobs:
           PUSH_BEFORE: ${{ github.event.before }}
         run: |
           set -u
-          base="${PR_BASE:-${MQ_BASE:-${PUSH_BEFORE:-}}}"
+          base="${PR_BASE:-${MQ_BASE:-}}"
+          # OMN-20868: release.yml fast-forwards main to a dev sha, so a push's
+          # `before` is the previous release and the range spans every dev PR
+          # since then, each already checked here against dev, including
+          # commits that predate this ratchet. A push whose HEAD is on dev is
+          # checked against the baseline; any other push diffs its own range.
+          if [ -z "$base" ] && [ -n "${PUSH_BEFORE:-}" ]; then
+            git fetch -q --no-tags origin +refs/heads/dev:refs/remotes/origin/dev
+            if git merge-base --is-ancestor HEAD refs/remotes/origin/dev; then
+              echo "push of a commit already on dev (fast-forward of ${PUSH_BEFORE}..HEAD); each commit was checked on its dev PR"
+            else
+              base="$PUSH_BEFORE"
+            fi
+          fi
           if [ -n "$base" ] && git cat-file -e "${base}^{commit}" 2>/dev/null; then
             base="$(git merge-base "$base" HEAD)"
             uv run --no-project --with "$CANONICAL_FILE_SHAPE_CORE" \
               python -m omnibase_core.validators.canonical_file_shape --base "$base" --head HEAD
           else
-            echo "no base revision on this event; checking the tree against the baseline only"
+            echo "no diff base for this event; checking the tree against the baseline only"
             uv run --no-project --with "$CANONICAL_FILE_SHAPE_CORE" \
               python -m omnibase_core.validators.canonical_file_shape --head HEAD
           fi

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/.github/workflows/contract-validation.yml

@@ -3,8 +3,10 @@
 
 # Contract Validation Gate
 #
-# Validates ONEX ticket contracts for PRs in omnimemory using the
-# reusable composite action from onex_change_control.
+# Validates the ONEX ticket contract of a PR's branch ticket with the installed
+# omnibase_core ModelTicketContract, at omnimemory's locked core version
+# (OMN-20074). Core refuses a binds_ac entry that is not a criterion label and a
+# binds_ac item with check_type command_exit_0 (omnibase_core#1935).
 #
 # Required status check: "contract-validation"
 # Must pass (or skip) before merging to main.
@@ -49,19 +51,6 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - name: Auth preflight — confirm onex_change_control action is accessible
-        id: auth-preflight
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          echo "Checking visibility of OmniNode-ai/onex_change_control..."
-          if gh api repos/OmniNode-ai/onex_change_control --silent; then
-            echo "::notice::onex_change_control repo is accessible."
-          else
-            echo "::error::Cannot reach OmniNode-ai/onex_change_control. Composite action will not resolve."
-            exit 1
-          fi
-
       - name: Resolve branch name
         id: resolve-branch
         env:
@@ -92,13 +81,88 @@ jobs:
           echo "resolved_branch=$BRANCH" >> "$GITHUB_OUTPUT"
           echo "::notice::Resolved branch name: $BRANCH"
 
+      - name: Check out calling repository
+        if: steps.resolve-branch.outputs.skip_validation != 'true'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Set up uv
+        if: steps.resolve-branch.outputs.skip_validation != 'true'
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+
       - name: Run contract validation
         id: validate-contract
         if: steps.resolve-branch.outputs.skip_validation != 'true'
-        uses: OmniNode-ai/onex_change_control/.github/actions/validate-contract@725d2967b031d7065efd41d0751f903638202cc1
-        with:
-          branch-name: ${{ steps.resolve-branch.outputs.resolved_branch }}
-          contracts-path: contracts
+        env:
+          BRANCH: ${{ steps.resolve-branch.outputs.resolved_branch }}
+          UV_HTTP_TIMEOUT: "600"
+        run: |
+          set -euo pipefail
+
+          TICKET_ID=$(printf '%s\n' "$BRANCH" | grep -ioE 'OMN-[0-9]+' | head -n 1 | tr '[:lower:]' '[:upper:]' || true)
+          echo "ticket-id=$TICKET_ID" >> "$GITHUB_OUTPUT"
+
+          if [[ -z "$TICKET_ID" ]]; then
+            echo "validation-status=skipped" >> "$GITHUB_OUTPUT"
+            echo "::notice::No OMN-XXXX ticket ID found in branch name; contract validation skipped."
+            exit 0
+          fi
+
+          CONTRACT_PATH="contracts/$TICKET_ID.yaml"
+          if [[ ! -f "$CONTRACT_PATH" ]]; then
+            CONTRACT_PATH="contracts/${TICKET_ID,,}.yaml"
+          fi
+          if [[ ! -f "$CONTRACT_PATH" ]]; then
+            echo "validation-status=skipped" >> "$GITHUB_OUTPUT"
+            echo "::notice::No contract file found for $TICKET_ID in contracts/; contract validation skipped."
+            exit 0
+          fi
+
+          for attempt in 1 2 3; do
+            if uv sync --locked --no-dev; then
+              break
+            fi
+            if [[ "$attempt" -eq 3 ]]; then
+              echo "validation-status=failed" >> "$GITHUB_OUTPUT"
+              echo "::error::Failed to sync omnimemory dependencies after 3 attempts."
+              exit 1
+            fi
+            sleep "$((10 * attempt))"
+          done
+
+          if uv run --no-sync python3 - "$CONTRACT_PATH" <<'PY'
+          import sys
+          from pathlib import Path
+
+          from omnibase_core.models.errors.model_onex_error import ModelOnexError
+          from omnibase_core.models.ticket.model_ticket_contract import ModelTicketContract
+
+          paths = [Path(arg) for arg in sys.argv[1:]]
+          broken = []
+          for path in paths:
+              try:
+                  ModelTicketContract.from_yaml(path.read_text(encoding="utf-8"))
+              except (OSError, ModelOnexError) as exc:
+                  broken.append((path, " ".join(str(exc).split())))
+
+          for path, reason in broken:
+              print(f"::error file={path.as_posix()}::{path.as_posix()}: {reason}")
+          if broken:
+              print(f"ERROR: {len(broken)} of {len(paths)} ticket contract(s) fail omnibase_core's ModelTicketContract.")
+              sys.exit(1)
+          print(f"OK: {len(paths)} ticket contract(s) pass omnibase_core's ModelTicketContract.")
+          PY
+          then
+            echo "validation-status=passed" >> "$GITHUB_OUTPUT"
+          else
+            echo "validation-status=failed" >> "$GITHUB_OUTPUT"
+            exit 1
+          fi
 
       - name: Report validation result
         if: always()
@@ -127,6 +191,7 @@ jobs:
               exit 1
               ;;
             *)
-              echo "::warning::Unexpected validation status: '$VALIDATION_STATUS'. Treating as skipped."
+              echo "::error::Contract validation did not finish: '$VALIDATION_STATUS'."
+              exit 1
               ;;
           esac

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/.github/workflows/imperative-contract-guard.yml

@@ -15,7 +15,8 @@ permissions:
 
 jobs:
   imperative-contract-guard:
+    # OMN-20943: the caller owns its unchanged, shrink-only allowlist.
     # self-gating-ok: central guard is intentionally shared across repos; caller PRs do not modify the referenced workflow.
-    uses: OmniNode-ai/onex_change_control/.github/workflows/imperative-contract-guard.yml@725d2967b031d7065efd41d0751f903638202cc1
+    uses: OmniNode-ai/omnibase_core/.github/workflows/imperative-contract-guard.yml@031148215620031436cba30619bbae67c0bb38ad
     with:
-      onex-change-control-ref: 725d2967b031d7065efd41d0751f903638202cc1
+      allowlist-path: imperative-contract-allowlist.yaml

omninode_memory-0.18.5/.github/workflows/pr-title-check.yml

@@ -0,0 +1,62 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+# OMN-6912
+
+name: PR Title Check
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+  merge_group:
+    types: [checks_requested]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  pr-title:
+    if: github.event_name == 'pull_request'
+    # OMN-20997: run the released title decision node under the existing context.
+    # No checkout: the decision reads only the event's title and author.
+    name: pr-title / check-title
+    runs-on: >-
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+
+      - name: Check PR title for ticket reference
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          OMNIMARKET_VERSION: "0.4.310"
+        run: |
+          set -euo pipefail
+          venv="${RUNNER_TEMP}/pr-title-check"
+          uv venv --quiet --python 3.12 "${venv}"
+          # The node imports only pydantic, so omnimarket's own dependency tree is not installed.
+          uv pip install --quiet --python "${venv}/bin/python" --no-deps "omnimarket==${OMNIMARKET_VERSION}"
+          uv pip install --quiet --python "${venv}/bin/python" "pydantic>=2.11"
+          "${venv}/bin/python" -I -c 'import json, os; print(json.dumps({"title": os.environ["PR_TITLE"], "author": os.environ["PR_AUTHOR"]}))' \
+            | "${venv}/bin/python" -I -m omnimarket.nodes.node_pr_title_check_compute
+
+  pr-title-merge-group:
+    if: github.event_name == 'merge_group'
+    name: pr-title / check-title
+    runs-on: >-
+      ${{
+        fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    steps:
+      - name: Accept merge-group title check
+        run: |
+          echo "PR title validation is enforced on pull_request opened/edited before enqueue."

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/.github/workflows/public-repo-hygiene.yml

@@ -40,7 +40,7 @@ concurrency:
 
 jobs:
   public-repo-hygiene:
-    uses: OmniNode-ai/omniclaude/.github/workflows/public-repo-hygiene-reusable.yml@3ea5bfc90dec0efd386214247b38c8c2cc46508d
+    uses: OmniNode-ai/omniclaude/.github/workflows/public-repo-hygiene-reusable.yml@0c9f9146d8dd0446fc5c10952aa57247b3a880ae
     with:
       mode: report
     secrets: inherit

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/.github/workflows/security-scan.yml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: MIT
 #
 # CodeQL security and quality analysis for omnimemory.
-# Calls the reusable workflow in onex_change_control.
+# Calls the reusable workflow in omnibase_core.
 # OMN-5424
 
 name: Security Scan
@@ -24,7 +24,7 @@ concurrency:
 jobs:
   codeql:
     name: CodeQL
-    uses: OmniNode-ai/onex_change_control/.github/workflows/codeql-reusable.yml@725d2967b031d7065efd41d0751f903638202cc1
+    uses: OmniNode-ai/omnibase_core/.github/workflows/codeql-reusable.yml@3fbb43eaff028a30edccb1b9b794e0a3f3d9523c
     with:
       language: python
       query_suite: security-and-quality

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/.pre-commit-config.yaml

@@ -88,9 +88,11 @@ repos:
         files: ^(\.github/workflows/ci\.yml|\.github/required-checks\.yaml|\.pre-commit-config\.yaml|tests/scripts/test_occ_eligibility_enforcement\.py)$
         stages: [pre-commit]
 
-  # No hardcoded ONEX topic strings — sourced from onex_change_control (OMN-5259)
-  - repo: https://github.com/OmniNode-ai/onex_change_control
-    rev: 8d7e85bc00e7f1b1306d1cb40949be1ab6e7e91a  # pragma: allowlist secret
+  # No hardcoded ONEX topic strings and ticketed TODO format — sourced from omnibase_core
+  # (OMN-5259; OMN-20074, OCC retirement S8: same hook ids, no longer pulled from
+  # the change-control repository)
+  - repo: https://github.com/OmniNode-ai/omnibase_core
+    rev: 4a4177335d11b138a29fe28e2f4c5575afa92b2b  # pragma: allowlist secret
     hooks:
       - id: no-hardcoded-topics
         exclude: ^src/omnimemory/topics\.py$
@@ -117,10 +119,10 @@ repos:
   # lines in a SKILL.md, and any new baseline, allowlist or suppression entry.
   # Shrink-only baseline at .onex_ratchets/canonical_file_shape_baseline.txt.
   # CI runs the same module at the same commit (job "Canonical File Shape
-  # (OMN-20304)"). The rev moved from 6363509770 to the OMN-20304 commit for
-  # both hooks; the lifecycle validator's source is identical at the two commits.
+  # (OMN-20304)"). OMN-20943 pins canonical-file-shape to the commit that reads
+  # the imperative guard caller's allowlist-path as a shrink-only declaration.
   - repo: https://github.com/OmniNode-ai/omnibase_core
-    rev: f50d00fc7918d0b12ccd0d3497160325e32e7ac5  # pragma: allowlist secret
+    rev: 031148215620031436cba30619bbae67c0bb38ad  # pragma: allowlist secret
     hooks:
       - id: no-noncanonical-lifecycle-classes
         args: [--allowlist, .onex_ratchets/noncanonical_class_allowlist.yaml, src/omnimemory]
@@ -576,7 +578,7 @@ repos:
 
   # Skip-token rejection gate (OMN-10414 / OMN-13296)
   # Blocks [skip-*] bypass tokens in staged markdown/yaml/txt files.
-  # Escape hatch: add '# skip-token-allowed: <receipt-id>' with a traceable approval receipt.
+  # There is no escape hatch (OMN-20074): a skip token is rejected whatever comment accompanies it.
   - repo: local
     hooks:
       - id: reject-deploy-gate-skip-token
@@ -673,9 +675,18 @@ repos:
   # the two verdicts cannot diverge. Advancing it is those two lines, together.
   # --------------------------------------------------------------------------
   - repo: https://github.com/OmniNode-ai/omniclaude
-    rev: 42b994826519e8d6bc21d0ca915803084c7c3955  # pragma: allowlist secret
+    rev: 0c9f9146d8dd0446fc5c10952aa57247b3a880ae  # pragma: allowlist secret
     hooks:
       - id: secrets-baseline-wired
+      # OMN-20940: the local twin of the required CI context
+      # `public-repo-hygiene / deployment-config` (the caller
+      # .github/workflows/public-repo-hygiene.yml), run at the same omniclaude
+      # commit as that job. It refuses deployment and lab configuration a commit
+      # adds, by shape, with no vocabulary and no token. It shares this block, and
+      # so its one existing allowlist comment, because the canonical-file-shape
+      # ratchet admits no new suppression.
+      - id: deployment-config
+        require_serial: true
 
   - repo: local
     hooks:

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/.pre-commit-hooks/reject-deploy-gate-skip-token.sh

@@ -12,17 +12,15 @@
 # bypasses this hook but not the remote GHA gate, which is a required status check.
 #
 # CLAUDE.md Rule #10: Never bypass local gates. Fix the underlying issue.
-# Plan: omni_home/docs/plans/2026-04-30-gate-collapse-fix.md Task 8
 #
 # Tokens blocked (case-insensitive):
 #   [skip-deploy-gate: ...]   — deploy-gate bypass (original OMN-9730)
 #   [skip-receipt-gate: ...]  — receipt-gate bypass (OMN-10414)
 #   [skip-<anything>: ...]    — any other [skip-*] form
 #
-# Escape hatch (explicit user approval only):
-#   Add a line containing:  # skip-token-allowed: <receipt-id>
-#   The receipt-id documents the explicit user approval hand-off.
-#   This is NOT a free-text bypass — it requires a traceable approval receipt.
+# There is NO escape hatch. The approvals registry and the comment form that cited it
+# are retired (OMN-20074): a skip token is rejected whatever else the file, the commit
+# message or the PR body says, a receipt-id comment included.
 #
 # Usage:
 #   Invoked by pre-commit with staged filenames as arguments.
@@ -33,10 +31,8 @@ set -euo pipefail
 
 # OMN-10347: Broadened to ALL [skip-* tokens per Rule #10 (was [skip-deploy-gate: only).
 SKIP_PATTERN='\[skip-[a-zA-Z]'
-# Case-insensitive allowlist pattern — matches the skip-pattern's -i flag
-ALLOWLIST_PATTERN='#[[:space:]]*[Ss][Kk][Ii][Pp]-[Tt][Oo][Kk][Ee][Nn]-[Aa][Ll][Ll][Oo][Ww][Ee][Dd]:[[:space:]]*[^[:space:]]'
 
-RULE_REF="CLAUDE.md Rule #10 + docs/plans/2026-04-30-gate-collapse-fix.md Task 8"
+RULE_REF="CLAUDE.md Rule #10"
 TICKET_REF="OMN-10414"
 
 # ──────────────────────────────────────────────────────────────────────────────
@@ -88,17 +84,17 @@ if [[ "${1:-}" == "--self-test" ]]; then
         "[skip-anything: some reason]" \
         1
 
-    run_test "skip-deploy-gate with allowlist receipt passes" \
+    run_test "skip-deploy-gate with a receipt-id comment still rejected (OMN-20074)" \
         "[skip-deploy-gate: correctness fix]
 # skip-token-allowed: USER-APPROVAL-2026-04-25-jonah" \
-        0
+        1
 
-    run_test "skip-receipt-gate with skip-token-allowed passes (OMN-10414)" \
+    run_test "skip-receipt-gate with a receipt-id comment still rejected (OMN-20074)" \
         "[skip-receipt-gate: chore only]
 # skip-token-allowed: USER-APPROVAL-2026-04-30-jonah" \
-        0
+        1
 
-    run_test "allowlist without skip-token passes" \
+    run_test "receipt-id comment without a skip token passes" \
         "Normal PR body
 # skip-token-allowed: some-receipt" \
         0
@@ -111,6 +107,11 @@ if [[ "${1:-}" == "--self-test" ]]; then
         "[Skip-Receipt-Gate: reason here]" \
         1
 
+    run_test "case-insensitive receipt-id comment does not rescue a token (OMN-20074)" \
+        "[Skip-Receipt-Gate: reason here]
+# SKIP-TOKEN-ALLOWED: ANYTHING" \
+        1
+
     echo ""
     echo "Results: $PASS passed, $FAIL failed"
     if [[ "$FAIL" -gt 0 ]]; then
@@ -141,13 +142,9 @@ if [[ "${1:-}" == "--check-pr-body" ]]; then
     fi
 
     if echo "$PR_BODY" | grep -qiE "$SKIP_PATTERN"; then
-        if echo "$PR_BODY" | grep -qiE "$ALLOWLIST_PATTERN"; then
-            echo "WARNING: [skip-*] token found in PR #$PR_NUMBER body but explicit approval receipt present — allowed." >&2
-            exit 0
-        fi
         echo "ERROR: PR #$PR_NUMBER body contains a [skip-*] bypass token." >&2
-        echo "  Per $RULE_REF, bypass is not permitted without explicit user approval." >&2
-        echo "  Fix the gate properly: add dod_evidence or use the structured no_deployable_artifact exception." >&2
+        echo "  Per $RULE_REF, there is no bypass: remove the token and fix the gate properly." >&2
+        echo "  Add dod_evidence or use the structured no_deployable_artifact exception." >&2
         echo "  Ticket: $TICKET_REF" >&2
         exit 1
     fi
@@ -163,16 +160,10 @@ if [[ "${GIT_HOOK_STAGE:-}" == "commit-msg" || "$#" -eq 1 && "${1:-}" == *COMMIT
     msg_file="${1:-}"
     if [[ -n "$msg_file" && -f "$msg_file" ]]; then
         if grep -qiE "$SKIP_PATTERN" "$msg_file"; then
-            if grep -qiE "$ALLOWLIST_PATTERN" "$msg_file"; then
-                echo "WARNING: [skip-*] token found in commit message but explicit approval receipt present — allowed." >&2
-                exit 0
-            fi
             echo "ERROR: commit message contains a [skip-*] bypass token." >&2
-            echo "  Per $RULE_REF, bypass is not permitted without explicit user approval." >&2
-            echo "  Fix the gate properly:" >&2
+            echo "  Per $RULE_REF, there is no bypass. Fix the gate properly:" >&2
             echo "    1. Add dod_evidence with type: no_deployable_artifact (preferred)" >&2
             echo "    2. Narrow the path patterns in validate_pr_deploy_required.py" >&2
-            echo "    3. If truly exceptional, add '# skip-token-allowed: <receipt-id>' with a traceable approval receipt" >&2
             echo "  Ticket: $TICKET_REF" >&2
             exit 1
         fi
@@ -210,18 +201,10 @@ for file in "$@"; do
     fi
 
     if grep -qiE "$SKIP_PATTERN" <<< "$staged_content"; then
-        # Check for explicit allowlist receipt in the staged content (also case-insensitive)
-        if grep -qiE "$ALLOWLIST_PATTERN" <<< "$staged_content"; then
-            echo "WARNING: [skip-*] token found in $file but explicit approval receipt present — allowed." >&2
-            continue
-        fi
-
         echo "ERROR: $file contains a [skip-*] bypass token." >&2
-        echo "  Per $RULE_REF, bypass is not permitted without explicit user approval." >&2
-        echo "  Fix the gate properly:" >&2
+        echo "  Per $RULE_REF, there is no bypass. Fix the gate properly:" >&2
         echo "    1. Add dod_evidence with type: no_deployable_artifact (preferred)" >&2
         echo "    2. For receipt-gate: add Evidence-Source + Evidence-Ticket to PR body and push OCC contract+receipts" >&2
-        echo "    3. If truly exceptional, add '# skip-token-allowed: <receipt-id>' with a traceable approval receipt" >&2
         echo "  Ticket: $TICKET_REF" >&2
         FOUND_VIOLATION=1
     fi

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/.secrets.baseline

@@ -145,7 +145,7 @@
         "filename": "CHANGELOG.md",
         "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
         "is_verified": false,
-        "line_number": 344
+        "line_number": 354
       }
     ],
     "docker-compose.prod.yml": [

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/CHANGELOG.md

@@ -1,3 +1,13 @@
+## v0.18.5 (2026-10-11)
+
+### Release
+- Cut omnimemory from dev at 0.18.5 by the scheduled release train.
+- 1 release-relevant commit(s) merged since v0.18.4.
+- Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.
+
+### Included Since v0.18.4
+- feat: remove the lab embedding default from omnimemory (#605)
+
 ## v0.18.4 (2026-10-01)
 
 ### Release

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: omninode-memory
-Version: 0.18.4
+Version: 0.18.5
 Summary: OmniNode memory primitives — models, protocols, and storage adapters for Qdrant, Memgraph, and PostgreSQL backends.
 Project-URL: Homepage, https://github.com/OmniNode-ai/omnimemory
 Project-URL: Repository, https://github.com/OmniNode-ai/omnimemory

{omninode_memory-0.18.4 → omninode_memory-0.18.5}/config/hardcoded_model_config_baseline.yaml

@@ -15,9 +15,6 @@
 
 schema_version: 1
 entries:
-  - path: pyproject.toml
-    family: E-LAN
-    content_sha1: 406121965f2c4f34b87405dc1d8725f587925e16
   - path: scripts/graphify_to_qdrant.py
     family: M
     content_sha1: 4e1b554d77d4c5298708b0f7b584ae355807acb7
@@ -42,9 +39,6 @@ entries:
   - path: src/omnimemory/nodes/node_navigation_history_reducer/handlers/handler_navigation_history_reducer.py
     family: M
     content_sha1: 4f853d37a6c51fa102b42d2ea0e775233f336d84
-  - path: src/omnimemory/runtime/plugin.py
-    family: E-LAN
-    content_sha1: eb3cab7ef94de5a3ca66ff4797bfe632a89addf2
   - path: tests/integration/test_golden_chain_memgraph_ingestion.py
     family: E-LAN
     content_sha1: 84b23ad58c9198587cfd9eac7e3fa2031eb8cb5f