omninode-memory 0.18.5__tar.gz → 0.18.7__tar.gz

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/required-checks.yaml

@@ -20,25 +20,13 @@ required_checks:
   - name: "pr-title / check-title"
     workflow: pr-title-check.yml
     job_id: pr-title
-    producer_kind: local
+    producer_kind: cross_repo
+    cross_repo_ref: "OmniNode-ai/omnibase_core/.github/workflows/pr-title-check.yml@6d562b13401684270453f1dedd22f8737110f2f2"
     conditional: false
     rationale: >-
-      PR title ticket-reference check: the job runs omnimarket's
-      node_pr_title_check_compute from a pinned omnimarket release (OMN-20997).
-
-  # OMN-18854: this is an umbrella member, not a separate protection context.
-  - name: "occ-preflight / eligibility"
-    workflow: ci.yml
-    job_id: occ-preflight
-    conditional: true
-    condition: "Required on pull_request and merge_group; not applicable on push or workflow_dispatch"
-    rationale: >-
-      OMN-18854. The shared eligibility validator feeds the required CI Summary
-      through the OCC Eligibility Admission job. On pull_request and
-      merge_group, only successful preflight passes admission; CI Summary
-      requires a successful admission verdict on every event. Failed,
-      cancelled, skipped and absent results block. The caller and validator
-      source use the same immutable omnibase_core revision.
+      PR title ticket-reference check: omnibase_core's reusable runs omnimarket's
+      node_pr_title_check_compute from a pinned omnimarket release (OMN-20997);
+      the job pr-title calls it with only the omnimarket version (OMN-17427).
 
   # -- Phase 1: Quick Validation (parallel, ~2-5 min) -------------------------
 
@@ -133,6 +121,18 @@ required_checks:
       the required CI Summary context, which needs: this job and accepts only a
       success result.
 
+  - name: "Public Runner Placement (OMN-19998)"
+    workflow: ci.yml
+    job_id: public-runner-placement
+    conditional: false
+    rationale: >-
+      OMN-19998. Operator ruling 2026-10-16T07:07:09Z: CI runners are for
+      private repositories only. Refuses a job whose runs-on is, or can resolve
+      to, a self-hosted label, using omnibase_core's check at the release the
+      pre-commit hook pins. Unconditional (no needs, no if); gates merges
+      through the required CI Summary context, which needs: this job and
+      accepts only a success result.
+
   # -- Phase 2: Full Test Suite ------------------------------------------------
 
   - name: "Tests"

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/auto-tag-on-merge.yml

@@ -45,14 +45,8 @@ jobs:
        startsWith(github.event.pull_request.title, 'release:') ||
        startsWith(github.event.pull_request.title, 'chore: release') ||
        startsWith(github.event.pull_request.title, 'chore(release)'))
-    # OMNI_RUNNER_SELECTOR_V1 - trusted events default to self-hosted omnibase-ci; pull_request defaults to ubuntu-latest
-    runs-on: >-
-      ${{
-        (github.event_name == 'pull_request' &&
-         github.event.pull_request.head.repo.full_name != github.repository)
-        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
-        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
-      }}
+    # OMN-19998: public repository, GitHub-hosted runner only (RULING 2026-10-16T07:07:09Z)
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
@@ -61,7 +55,7 @@ jobs:
       # separate credential file and includes it through `includeIf.gitdir`, so
       # it overrides the App credential in the push URL below and the push
       # authenticates as github-actions[bot] again.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/ban-hardcoded-runner-ip.yml

@@ -31,7 +31,7 @@ jobs:
     # OMN-17993: pinned to an exact SHA, not @main. omniclaude main lags dev by
     # design (release-synced), so @main still resolves to the pre-widening scanner
     # body that scans workflow files only and exits 0 on a tests-only diff.
-    uses: OmniNode-ai/omniclaude/.github/workflows/ban-hardcoded-runner-ip.yml@3ea5bfc90dec0efd386214247b38c8c2cc46508d
+    uses: OmniNode-ai/omniclaude/.github/workflows/ban-hardcoded-runner-ip.yml@a45ba68f053e9979c6edef21103c0e674e5f7630  # OMN-20074: omniclaude#2656 squash, the reusable scans without the nested change-control preflight
     permissions:
       contents: read
       pull-requests: read

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/call-reject-skip.yml

@@ -28,5 +28,5 @@ permissions:
 
 jobs:
   call-reject-skip-token:
-    uses: OmniNode-ai/omniclaude/.github/workflows/reject-deploy-gate-skip.yml@3ea5bfc90dec0efd386214247b38c8c2cc46508d
+    uses: OmniNode-ai/omniclaude/.github/workflows/reject-deploy-gate-skip.yml@b6ca3729f2a9b70ae6518a8c46d08f3c1ebb8c60
     secrets: inherit

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/call-repo-evidence-gate.yml

@@ -24,16 +24,16 @@
 # repo-evidence / verify job in this mode as a success no-op (the OCC path,
 # switched off by the input); only repo-evidence / dod-verify carries a verdict.
 #
-# S5 shadow count (OMN-20074): shadow and compare-with-occ are both "true", so
-# every run records this head's new-path verdict beside OCC's occ-preflight /
-# eligibility verdict on the same head, and no repo-evidence job concludes
-# anything but success. The verdict is one `Shadow verdict:` line in the job
-# summary and in a notice annotation, the data the S5 count reads.
-# repo-evidence / dod-verify is NOT a required context here yet. Every OCC
-# context stays required and no OCC caller is removed. Making it required, and
-# then removing the OCC contexts (S6), are separate rulings that wait for this
-# repository's own S5 bar. The S6 change sets shadow and compare-with-occ back
-# to "false".
+# S6 cut-over (OMN-20074): the caller enforces repo-owned evidence with
+# shadow: "false" and compare-with-occ: "false". Admission no longer compares
+# against OCC. The comparison was switched off on dev first, because this caller
+# runs from dev under pull_request_target and the retiring pull request cannot
+# change the input that judges it. No OCC caller remains in this repository, so
+# the difference step would otherwise wait for a verdict nobody reports.
+# repo-evidence / dod-verify carries the verdict; a repository ruleset on dev is
+# to require that context once the OCC contexts have left the ruleset.
+# Rollback is setting shadow back to "true", which makes every repo-evidence
+# job conclude success again while the cause is found.
 #
 # The reusable is pinned by full SHA to the squash commit of omnibase_core#1932
 # on dev, a descendant of #1914; it carries the `shadow` input. omnimemory does
@@ -41,9 +41,11 @@
 #
 # The pinned reusable refuses a verifier-version below 0.4.303 before installing
 # it (VERIFIER_FLOOR, omnibase_core#1932; OMN-20032), the first release that
-# refuses a contract leaving a criterion unbound. While shadow is "true" that
-# install step is continue-on-error, so a refusal is recorded and blocks nothing;
-# the S6 change that sets shadow to "false" makes it block.
+# refuses a contract leaving a criterion unbound. With shadow "false" that
+# install step blocks. verifier-version 0.4.310 is the first omnimarket release
+# that ships the writer-app and plugin-manifest diff classifiers
+# (omnimarket#3694) and refuses a contract that repeats a mapping key
+# (omnimarket#3751), the version omniclaude and omnidash run.
 
 name: Repo Evidence Gate
 
@@ -65,6 +67,6 @@ jobs:
     uses: OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml@4e4f5e0404d364e296c5d37db6aa3ab9e07f8ffa # OMN-20032: immutable full-SHA pin, the squash commit of omnibase_core#1932 on that repo's dev branch; descends from #1914 (carries the shadow input) and adds the VERIFIER_FLOOR 0.4.303 refusal to the verifier install step
     with:
       evidence-source: caller
-      verifier-version: 0.4.305
-      compare-with-occ: "true"
-      shadow: "true"
+      verifier-version: 0.4.310
+      compare-with-occ: "false"
+      shadow: "false"

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/check-handshake.yml

@@ -28,8 +28,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: OmniNode-ai/omnibase_core
-                                                                                # Auto-bumped by omnibase_core publish-downstream-pin-bump.yml to bac865f4f32a.
-          ref: bac865f4f32a3f8ca80cabcfac06c8400d8c80d7
+                                                                                # Auto-bumped by omnibase_core publish-downstream-pin-bump.yml to 9b083ad32228.
+          ref: 9b083ad32228f078aecfc47f9c71155656b47fae
           path: omnibase_core
 
       - name: Verify omnibase_core checkout

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/ci.yml

@@ -23,37 +23,6 @@ env:
   CACHE_VERSION: "0.1.0"
 
 jobs:
-  # OMN-18854: the existing eligibility validator must feed the required
-  # CI Summary. Other validations remain independent of this evidence gate.
-  occ-preflight:
-    if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
-    permissions:
-      contents: read
-      pull-requests: read
-    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@13ceae69c246a33c9fc8fc4b33f83fb66b89edc6
-    with:
-      core-ref: 13ceae69c246a33c9fc8fc4b33f83fb66b89edc6
-      contracts-dir: contracts
-      receipts-dir: drift/dod_receipts
-
-  # OMN-18854: evidence admission has its own verdict; shape detectors and
-  # their result aggregation do not branch directly on the evidence preflight.
-  occ-eligibility:
-    name: OCC Eligibility Admission
-    runs-on: ubuntu-latest
-    needs: occ-preflight
-    if: always()
-    steps:
-      - name: Require eligible evidence on admission events
-        run: |
-          event="${{ github.event_name }}"
-          if [[ "$event" == "pull_request" || "$event" == "merge_group" ]]; then
-            if [[ "${{ needs.occ-preflight.result }}" != "success" ]]; then
-              echo "::error::occ-preflight did not pass (result: ${{ needs.occ-preflight.result }})"
-              exit 1
-            fi
-          fi
-
   # =============================================================================
   # JOB ORDERING RATIONALE (Fail-Fast Optimization)
   # =============================================================================
@@ -258,10 +227,6 @@ jobs:
       - name: Pre-commit dependencies come from package indexes (OMN-19666)
         run: bash tests/test_precommit_additional_dependencies_omn19666.sh
 
-      # OMN-18854: the same focused regression runs before commit and in CI.
-      - name: Verify OCC eligibility enforcement (OMN-18854)
-        run: uv run pytest tests/scripts/test_occ_eligibility_enforcement.py -q
-
       # SYNC: Pre-commit hook 'validate-gitignore-baseline' at pre-commit stage (OMN-18033)
       # This step and the hook both pin released omnibase-core==0.47.23,
       # matching uv.lock and carrying the packaged baseline spec; move them together.
@@ -629,65 +594,52 @@ jobs:
 
   contract-compliance:
     name: Contract Compliance Check
-    # OMNI_RUNNER_SELECTOR_V1 (OMN-16437): `uv sync` here resolves onex_change_control's
-    # dependency set from the internal-only `.201` Tailscale PyPI mirror
-    # (http://omninode-pc.tail75df5e.ts.net:3141/root/pypi/...).
-    # onex-allow-internal-ip OMN-16437 reason="doc comment naming the host this fix routes around; not runnable"
-    # `ubuntu-latest` is GitHub-hosted, non-tailnet, and cannot resolve that hostname.
-    # Same defect class as OMN-16413 (omnibase_core#1579), OMN-16427
-    # (omninode_infra#969), OMN-16428 (omnimarket), and OMN-16431 (omniclaude#2023,
-    # same job name/shape) -- adopts the identical fork-aware selector: only an
-    # ACTUAL fork PR (head repo != base repo) routes to the public ubuntu-latest
-    # runner; every same-repo pull_request, push, and merge_group gets the
-    # tailnet-connected self-hosted omnibase-ci fleet, which CAN reach the .201
-    # mirror. This does NOT widen the trust boundary: untrusted fork code still
-    # never reaches the self-hosted fleet.
-    runs-on: >-
-      ${{
-        (github.event_name == 'pull_request' &&
-         github.event.pull_request.head.repo.full_name != github.repository)
-        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
-        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
-      }}
+    # OMN-19998: public repository, GitHub-hosted runner only (RULING 2026-10-16T07:07:09Z).
+    # OMN-20074 S6: validate this repository's contracts with locked core.
+    runs-on: ubuntu-latest
     if: github.event_name == 'pull_request' || github.event_name == 'merge_group' || github.event_name == 'push'
     steps:
       - uses: actions/checkout@v7
-      # OMN-20001: read the onex_change_control rev pinned in pyproject.toml,
-      # never OCC's live default branch.
-      - name: Resolve pinned onex_change_control rev
-        id: occ-pin
-        run: |
-          rev="$(grep -oE 'onex_change_control\.git@[0-9a-f]{40}' pyproject.toml | head -1 | cut -d@ -f2)"
-          [[ "$rev" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::no pinned onex_change_control rev in pyproject.toml"; exit 1; }
-          echo "rev=$rev" >> "$GITHUB_OUTPUT"
-
-      - name: Checkout onex_change_control
-        uses: actions/checkout@v7
-        with:
-          repository: OmniNode-ai/onex_change_control
-          ref: ${{ steps.occ-pin.outputs.rev }}
-          path: onex_change_control
-
       - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
-          cache-dependency-glob: 'onex_change_control/uv.lock'
+          cache-dependency-glob: uv.lock
 
-      - name: Install onex_change_control
-        working-directory: onex_change_control
-        run: uv sync --locked --all-extras
+      - name: Install dependencies
+        run: uv sync --frozen
 
       - name: Validate contract YAML files
-        working-directory: onex_change_control
         run: |
-          CONTRACTS=$(find "$GITHUB_WORKSPACE/onex_change_control/contracts" -maxdepth 1 -name "OMN-*.yaml" 2>/dev/null)
-          if [ -z "$CONTRACTS" ]; then
-            echo "No contract YAML files found — skipping validation"
-            exit 0
-          fi
-          uv run validate-yaml $CONTRACTS
-        env:
-          GH_TOKEN: ${{ github.token }}
+          set -euo pipefail
+          # Top-level ticket contracts only: contracts/v1 holds a different shape.
+          mapfile -t CONTRACTS < <(find contracts -maxdepth 1 -type f -name "OMN-*.yaml")
+          uv run python3 - "${CONTRACTS[@]}" <<'PY'
+          import sys
+          from pathlib import Path
+
+          from omnibase_core.models.errors.model_onex_error import ModelOnexError
+          from omnibase_core.models.ticket.model_ticket_contract import ModelTicketContract
+
+          # Named contracts, or every contracts/OMN-*.yaml when none are named.
+          paths = [Path(arg) for arg in sys.argv[1:]] or sorted(Path("contracts").glob("OMN-*.yaml"))
+          if not paths:
+              print("::error::contracts/ holds no OMN-*.yaml ticket contract")
+              sys.exit(1)
+
+          broken = []
+          for path in paths:
+              try:
+                  ModelTicketContract.from_yaml(path.read_text(encoding="utf-8"))
+              except (OSError, ModelOnexError) as exc:
+                  broken.append((path, " ".join(str(exc).split())))
+
+          for path, reason in broken:
+              print(f"::error file={path.as_posix()}::{path.as_posix()}: {reason}")
+          if broken:
+              print(f"ERROR: {len(broken)} of {len(paths)} ticket contract(s) fail omnibase_core's ModelTicketContract.")
+              sys.exit(1)
+          print(f"OK: {len(paths)} ticket contract(s) pass omnibase_core's ModelTicketContract.")
+          PY
 
   no-noncanonical-lifecycle-classes:
     name: no-noncanonical-lifecycle-classes
@@ -831,7 +783,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
-      CANONICAL_FILE_SHAPE_CORE: "omnibase-core @ git+https://github.com/OmniNode-ai/omnibase_core@031148215620031436cba30619bbae67c0bb38ad"
+      CANONICAL_FILE_SHAPE_CORE: "omnibase-core @ git+https://github.com/OmniNode-ai/omnibase_core@dev-20261023085853-9d65b648bff5"
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -899,21 +851,120 @@ jobs:
               python -m omnibase_core.validators.canonical_file_shape --head HEAD
           fi
 
+      - name: Node-home positive control (planted node refused, clean tree accepted)
+        run: |
+          set -u
+          node_home() {
+            uv run --no-project --with "$CANONICAL_FILE_SHAPE_CORE" \
+              python -m omnibase_core.nodes.node_node_home_check_compute.runtime_node_home_check "$@"
+          }
+          planted=src/omnimemory/nodes/node_zz_canary_planted_compute
+          mkdir -p "$planted"
+          printf 'name: node_zz_canary_planted_compute\n' > "$planted/contract.yaml"
+          printf 'class NodeZzCanaryPlantedCompute:\n    pass\n' > "$planted/handler.py"
+          git add "$planted"
+          if node_home; then
+            echo "POSITIVE CONTROL FAILED: planted $planted was accepted"
+            exit 1
+          fi
+          echo "positive control: planted node refused"
+          git rm -q -r --cached "$planted"
+          rm -r "$planted"
+          node_home
+          echo "positive control: clean tree accepted"
+
+      - name: Refuse new ONEX nodes outside omnimarket (OMN-20702)
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          MQ_BASE: ${{ github.event.merge_group.base_sha }}
+          PUSH_BEFORE: ${{ github.event.before }}
+        run: |
+          set -u
+          node_home() {
+            uv run --no-project --with "$CANONICAL_FILE_SHAPE_CORE" \
+              python -m omnibase_core.nodes.node_node_home_check_compute.runtime_node_home_check "$@"
+          }
+          base="${PR_BASE:-${MQ_BASE:-${PUSH_BEFORE:-}}}"
+          if [ -n "$base" ] && git cat-file -e "${base}^{commit}" 2>/dev/null; then
+            base="$(git merge-base "$base" HEAD)"
+            node_home --base "$base"
+          elif [ "$EVENT_NAME" = "pull_request" ] || [ "$EVENT_NAME" = "merge_group" ]; then
+            echo "node-home ratchet: no resolvable base revision on $EVENT_NAME; refusing"
+            exit 1
+          else
+            echo "no base revision on this event; checking the tree against HEAD"
+            node_home --base HEAD
+          fi
+
+  # OMN-19998: public-repository runner placement (RULING 2026-10-16T07:07:09Z,
+  # "Ci runners should be for private repos only"). omnibase_core's check refuses
+  # a job whose runs-on is, or can resolve to, a self-hosted label unless core's
+  # shrink-only baseline (shipped in the package, not editable here) records it,
+  # and refuses a baselined job that is new or newly self-hosted against the base.
+  # Same core release as the check-public-runner-placement pre-commit hook.
+  # Unconditional: no `if:`, no `needs:`; a CI Summary member below.
+  public-runner-placement:
+    name: Public Runner Placement (OMN-19998)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      # The published release whose tag v0.47.46 is the pre-commit hook's rev.
+      RUNNER_PLACEMENT_CORE: "omnibase-core==0.47.46"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: "0.8.3"
+      - name: Positive control (planted self-hosted job refused)
+        run: |
+          set -u
+          printf 'on: push\njobs:\n  planted:\n    runs-on: [self-hosted, omnibase-ci]\n    steps:\n      - run: "true"\n' \
+            > .github/workflows/zz-canary-planted.yml
+          git add .github/workflows/zz-canary-planted.yml
+          if uv run --no-project --with "$RUNNER_PLACEMENT_CORE" \
+            python -m omnibase_core.handlers.handler_public_runner_placement_cli --repo omnimemory \
+            .github/workflows/zz-canary-planted.yml; then
+            echo "POSITIVE CONTROL FAILED: planted self-hosted job was accepted"
+            exit 1
+          fi
+          echo "positive control: planted self-hosted job refused"
+          git rm -q --cached .github/workflows/zz-canary-planted.yml
+          rm .github/workflows/zz-canary-planted.yml
+      - name: Refuse new self-hosted jobs in this public repository
+        env:
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          MQ_BASE: ${{ github.event.merge_group.base_sha }}
+          PUSH_BEFORE: ${{ github.event.before }}
+        run: |
+          set -u
+          base="${PR_BASE:-${MQ_BASE:-${PUSH_BEFORE:-}}}"
+          args=(--repo omnimemory --visibility public)
+          if [ -n "$base" ] && git cat-file -e "${base}^{commit}" 2>/dev/null; then
+            args+=(--base-ref "$(git merge-base "$base" HEAD)")
+          else
+            echo "no base revision on this event; checking the tree against the baseline only"
+          fi
+          uv run --no-project --with "$RUNNER_PLACEMENT_CORE" \
+            python -m omnibase_core.handlers.handler_public_runner_placement_cli "${args[@]}"
+
   ci-summary:
     name: CI Summary
     runs-on: ubuntu-latest
-    needs: [migration-freeze, lint, pyright, onex-validation, transport-import-guard, contract-validation, io-audit, check-handshake, test-select, tests-gate, compliance, contract-compliance, no-noncanonical-lifecycle-classes, detect-secrets, shape-gate-independence, canonical-file-shape, occ-eligibility]
+    needs: [migration-freeze, lint, pyright, onex-validation, transport-import-guard, contract-validation, io-audit, check-handshake, test-select, tests-gate, compliance, contract-compliance, no-noncanonical-lifecycle-classes, detect-secrets, shape-gate-independence, canonical-file-shape, public-runner-placement]
     if: always()
 
     steps:
       - name: Check test results
         run: |
-          # OMN-18854: require the admission verdict on every event. That job
-          # judges eligibility on PR/queue events and passes non-admission events.
-          if [[ "${{ needs.occ-eligibility.result }}" != "success" ]]; then
-            echo "::error::occ-eligibility did not pass (result: ${{ needs.occ-eligibility.result }})"
-            exit 1
-          fi
           # OMN-14350: strict fail-closed gate on the non-canonical lifecycle-class
           # ratchet - only 'success' passes; skipped/cancelled/failure ALL block. It is
           # in needs: so this job WAITS for it (no race).
@@ -940,6 +991,12 @@ jobs:
             echo "::error::canonical-file-shape ratchet did not pass (result: ${{ needs.canonical-file-shape.result }}) - fail-closed (OMN-20304)"
             exit 1
           fi
+          # OMN-19998: strict fail-closed gate on public-repository runner
+          # placement - only 'success' passes; skipped/cancelled/failure ALL block.
+          if [[ "${{ needs.public-runner-placement.result }}" != "success" ]]; then
+            echo "::error::public-runner-placement did not pass (result: ${{ needs.public-runner-placement.result }}) - fail-closed (OMN-19998)"
+            exit 1
+          fi
           migration_freeze="${{ needs.migration-freeze.result }}"
           lint="${{ needs.lint.result }}"
           pyright="${{ needs.pyright.result }}"

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/contract-validation.yml

@@ -41,13 +41,8 @@ concurrency:
 jobs:
   contract-validation:
     name: contract-validation
-    # OMNI_RUNNER_SELECTOR_V1 - trusted events default to self-hosted omnibase-ci; pull_request defaults to ubuntu-latest
-    runs-on: >-
-      ${{
-        github.event_name != 'pull_request'
-        && fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
-        || fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
-      }}
+    # OMN-19998: public repository, GitHub-hosted runner only (RULING 2026-10-16T07:07:09Z)
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -83,7 +78,7 @@ jobs:
 
       - name: Check out calling repository
         if: steps.resolve-branch.outputs.skip_validation != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
           persist-credentials: false

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/dep-provenance-gate.yml

@@ -12,10 +12,8 @@
 # This gate is a pure static provenance check (no network calls). It FAILS if
 # any of omnibase-core / omnibase-spi / omnibase-compat (hyphen or underscore
 # spelling) has a git / rev / branch / tag source override in pyproject.toml's
-# [tool.uv.sources] block. onex-change-control is intentionally NOT checked (it
-# follows an immutable-main pin release model). A single line may be exempted
-# with an inline '# raw-override-ok: <ticket>' comment carrying a non-empty
-# token.
+# [tool.uv.sources] block. A single line may be exempted with an inline
+# '# raw-override-ok: <ticket>' comment carrying a non-empty token.
 #
 # Scoping: the whole-file gate runs only when a PR actually modifies
 # pyproject.toml (a forbidden override cannot be introduced without editing
@@ -55,7 +53,7 @@ jobs:
 
       - name: Checkout
         if: ${{ github.event_name == 'pull_request' }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 

omninode_memory-0.18.7/.github/workflows/dev-merge-tag.yml

@@ -0,0 +1,113 @@
+# SPDX-FileCopyrightText: 2026 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+#
+# dev-merge-tag.yml (OMN-19998)
+#
+# Every push to dev gets a lightweight tag dev-<UTC YYYYMMDDHHMMSS>-<sha12> on
+# the pushed commit. omnimemory is a sibling consumed by omnimarket: a
+# consumer can read it through a uv git source pinned to one of these tags
+# instead of waiting for a PyPI release, and a release is cut only when an
+# outside user needs one (RULING 2026-10-16T09:35:49Z). The tag is made here
+# so that it exists for every dev merge without anyone remembering to cut it.
+# Same mechanism as omnimarket's and omnibase_infra's dev-merge-tag.yml.
+#
+# The timestamp is the commit's committer time in UTC, not the run's clock, so
+# a rerun for the same commit computes the same name. The step is idempotent on
+# the sha: when any dev-*-<sha12> tag already exists on the remote it pushes
+# nothing. Names sort by time, so the newest tag is the last in a plain sort.
+#
+# No tag on main, on a pull request branch or on any other ref: the trigger is
+# `push` to `dev` only and the job repeats that check.
+#
+# The push uses the job's workflow token on purpose. A tag pushed with that
+# token starts no workflow, and nothing should start from a dev-* tag:
+# consumers read the tags by polling, and `release.yml` only listens for v*
+# tags. A dev merge therefore cannot fan out into extra runs.
+#
+# tests/ci/test_dev_merge_tag_workflow_omn19998.py runs the tag step below
+# against a throwaway repository and pins the name, idempotency and dry run.
+name: Dev Merge Tag
+
+on:
+  push:
+    branches: [dev]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.sha }}
+  cancel-in-progress: false
+
+jobs:
+  dev-merge-tag:
+    if: github.ref == 'refs/heads/dev'
+    # GitHub-hosted by literal: this is a public repository and CI runners are
+    # for private repositories only (RULING 2026-10-16T07:07:09Z, OMN-19998).
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+
+      - name: Create the dev merge tag
+        id: tag
+        env:
+          SHA: ${{ github.sha }}
+          DRY_RUN: 'false'
+        run: |
+          set -euo pipefail
+
+          if ! [[ "${SHA}" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::not a full commit sha: '${SHA}'"
+            exit 1
+          fi
+          SHA12="${SHA:0:12}"
+
+          STAMP=$(TZ=UTC0 git log -1 --format=%cd --date=format-local:%Y%m%d%H%M%S "${SHA}")
+          TAG="dev-${STAMP}-${SHA12}"
+
+          emit() {
+            if [ -n "${GITHUB_OUTPUT:-}" ]; then
+              printf 'tag=%s\ncreated=%s\n' "$1" "$2" >> "${GITHUB_OUTPUT}"
+            fi
+          }
+
+          EXISTING=$(git ls-remote --tags origin 'refs/tags/dev-*' |
+            awk -v suffix="-${SHA12}" '
+              length($2) > length(suffix) &&
+              substr($2, length($2) - length(suffix) + 1) == suffix {
+                sub(/^refs\/tags\//, "", $2); print $2
+              }' | LC_ALL=C sort | head -n 1)
+          if [ -n "${EXISTING}" ]; then
+            echo "dev tag ${EXISTING} already names ${SHA}; nothing to push"
+            emit "${EXISTING}" false
+            exit 0
+          fi
+
+          if [ "${DRY_RUN}" = "true" ]; then
+            echo "dry run: would push lightweight tag ${TAG} -> ${SHA}"
+            emit "${TAG}" false
+            exit 0
+          fi
+
+          git tag "${TAG}" "${SHA}"
+          PUSH_STATUS=0
+          git push origin "refs/tags/${TAG}" || PUSH_STATUS=$?
+          if [ "${PUSH_STATUS}" -ne 0 ]; then
+            # A concurrent run for the same commit may have pushed the same name.
+            REMOTE_SHA=$(git ls-remote --tags origin "refs/tags/${TAG}" | awk '{print $1}')
+            if [ "${REMOTE_SHA}" != "${SHA}" ]; then
+              echo "::error::push of ${TAG} failed (exit ${PUSH_STATUS}) and the remote does not hold it at ${SHA}"
+              exit 1
+            fi
+            echo "${TAG} was pushed by a concurrent run; nothing to do"
+            emit "${TAG}" false
+            exit 0
+          fi
+
+          echo "pushed lightweight tag ${TAG} -> ${SHA}"
+          emit "${TAG}" true
+          if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+            echo "Dev merge tag: \`${TAG}\`" >> "${GITHUB_STEP_SUMMARY}"
+          fi

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/docs-validate.yml

@@ -15,4 +15,4 @@ concurrency:
 
 jobs:
   call:
-    uses: OmniNode-ai/omnibase_core/.github/workflows/validate-docs.yml@95d9e3e01f8ed82c0b618a8e7d3315e96e560e52
+    uses: OmniNode-ai/omnibase_core/.github/workflows/validate-docs.yml@35664cc30ca4bab02da4cac1d55786623db9a452

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/hardcoded-model-config.yml

@@ -19,6 +19,6 @@ concurrency:
 
 jobs:
   hardcoded-model-config:
-    uses: OmniNode-ai/omniclaude/.github/workflows/hardcoded-model-config-reusable.yml@3ea5bfc90dec0efd386214247b38c8c2cc46508d
+    uses: OmniNode-ai/omniclaude/.github/workflows/hardcoded-model-config-reusable.yml@b6ca3729f2a9b70ae6518a8c46d08f3c1ebb8c60
     with:
       core_ref: f873d2c30201c05d4be020fa0b281b5edbfb8307

{omninode_memory-0.18.5 → omninode_memory-0.18.7}/.github/workflows/kb-doc-gate.yml

@@ -41,6 +41,6 @@ concurrency:
 
 jobs:
   kb-doc-gate:
-    uses: OmniNode-ai/omniclaude/.github/workflows/kb-doc-gate-reusable.yml@3ea5bfc90dec0efd386214247b38c8c2cc46508d
+    uses: OmniNode-ai/omniclaude/.github/workflows/kb-doc-gate-reusable.yml@b6ca3729f2a9b70ae6518a8c46d08f3c1ebb8c60
     with:
       mode: strict