chore(OMN-13495): bump actions/checkout from 6 to 7 - #728
Merged
jonahgabriel merged 3 commits intoJun 22, 2026
Conversation
Bumps the actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
📝 WalkthroughWalkthroughAll GitHub Actions workflows replace ChangesGitHub Actions checkout version bump
Dispatch engine test count adjustments
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
104-104: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winStatic analysis flags unpinned action references and credential persistence across all checkout steps.
zizmor reports two systematic security concerns affecting this file and likely others in the workflow suite:
Unpinned-uses [error]: All
actions/checkout@v7references are not pinned to commit SHAs. Best practice requires pinning (e.g.,actions/checkout@b4ffde65f69336500f745f31a4aca3a695e18fba). This reduces supply-chain risk. However,.github/workflows/release.ymlalready uses the same@v7pattern, suggesting this is a pre-existing condition across the repo rather than new in this PR.Artipacked [warning]: Many checkout steps lack
persist-credentials: false, which means GitHub Actions credentials used for checkout could be captured in workflow artifacts. Adding this to steps that don't require credential persistence improves security hygiene.Recommendation: These are valid security improvements, but they affect the entire workflow suite systematically. Consider addressing hash-pinning and credential persistence as a coordinated workflow hardening effort rather than within this version-bump PR. The version upgrade itself is sound and consistent with existing patterns.
Also applies to: 137-137, 166-166, 230-230, 283-283, 343-343, 421-421, 506-506, 586-586, 641-641, 703-703, 755-755, 778-781, 816-816, 885-885, 1035-1037, 1181-1181
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 104, Replace all instances of actions/checkout@v7 with the pinned commit SHA version (e.g., actions/checkout@b4ffde65f69336500f745f31a4aca3a695e18fba) to eliminate the unpinned-uses security concern. Additionally, add persist-credentials: false as a parameter to each checkout step that does not require GitHub Actions credentials for subsequent workflow steps, which will prevent credential capture in workflow artifacts. These changes should be applied systematically across all checkout steps throughout the workflow file to address the security hardening recommendations from the static analysis.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/receipt-honesty.yml:
- Around line 38-40: Replace the mutable tag `@v7` in the `actions/checkout`
action with a specific immutable commit SHA (obtain the exact SHA for v7.0.0
from https://github.com/actions/checkout/releases/tag/v7.0.0), and add
`persist-credentials: false` to the `with` section of the checkout step to
prevent credentials from being available to subsequent steps on the runner.
In @.github/workflows/release-dry-run.yml:
- Around line 16-18: Update the actions/checkout action at line 16 by replacing
the mutable v7 tag with a pinned commit SHA to ensure consistency and prevent
unexpected updates. Additionally, add the persist-credentials parameter set to
false in the with block alongside the fetch-depth parameter, since this
read-only build workflow does not require Git credentials to be persisted in the
runner environment.
In @.github/workflows/release.yml:
- Around line 27-30: The checkout action on line 27 uses a mutable version
reference (v7) instead of a pinned commit SHA, which increases supply-chain risk
in a release workflow with elevated permissions. Replace the
`actions/checkout@v7` reference with the full 40-character commit SHA for the v7
release. Additionally, add a new parameter `persist-credentials: false` to the
checkout action's with block to explicitly disable credential persistence and
reduce authorization risk.
In @.github/workflows/stale-todo-gate.yml:
- Line 37: The `actions/checkout` action in the stale-todo-gate.yml workflow
uses a mutable major version tag `@v7` instead of a pinned commit SHA, which
creates a security vulnerability. Replace the mutable `@v7` tag with a full
commit SHA (e.g., the format should be `actions/checkout@<commit-sha>` where
commit-sha is a complete 40-character SHA-1 hash) to ensure the workflow always
uses the intended version of the action and prevents tag-retargeting attacks.
In @.github/workflows/todo-audit-on-merge.yml:
- Around line 40-41: The Checkout step uses a semantic version tag
(actions/checkout@v7) which is mutable and poses a security risk. Replace the
version tag in the uses field with the exact commit SHA from the v7 release
(format: actions/checkout@<commit_sha>). Additionally, add a with section to the
Checkout step that includes persist-credentials: false to disable credential
persistence, which is important for pull request workflows to prevent potential
credential exposure.
In `@tests/unit/runtime/test_dispatch_handlers.py`:
- Around line 446-447: The inline comment at line 446-447 (and similarly at
lines 461-462) is too broad and misleading about what gets excluded in no-LLM
runs. Narrow the comment to clarify that only the code-analysis enrichment
adapter is optional without its dependencies, while the code-analysis handler
itself can still be wired with fallback behavior. Replace the current comment
that mentions "code-analysis enrichment are excluded" with a more precise
statement that distinguishes between the optional enrichment adapter and the
handler that has fallback wiring.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Line 104: Replace all instances of actions/checkout@v7 with the pinned commit
SHA version (e.g., actions/checkout@b4ffde65f69336500f745f31a4aca3a695e18fba) to
eliminate the unpinned-uses security concern. Additionally, add
persist-credentials: false as a parameter to each checkout step that does not
require GitHub Actions credentials for subsequent workflow steps, which will
prevent credential capture in workflow artifacts. These changes should be
applied systematically across all checkout steps throughout the workflow file to
address the security hardening recommendations from the static analysis.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 03c67cd7-b3c3-4182-a472-d012c64c01b6
📒 Files selected for processing (19)
.github/workflows/auto-merge.yml.github/workflows/build-and-push-migrate-image.yml.github/workflows/canonical-inference-gate.yml.github/workflows/check-handshake.yml.github/workflows/ci.yml.github/workflows/claude.yml.github/workflows/code-review-bot.yml.github/workflows/cr-thread-gate.yml.github/workflows/omni-standards-compliance.yml.github/workflows/receipt-honesty.yml.github/workflows/release-dry-run.yml.github/workflows/release.yml.github/workflows/stale-todo-gate.yml.github/workflows/todo-audit-on-merge.yml.github/workflows/url-authority-gate.yml.github/workflows/validate-validator-requirements.yml.github/workflows/validator-runtime-profiles.ymltests/unit/runtime/test_dispatch_handlers.pytests/unit/runtime/test_plugin_dispatch.py
jonahgabriel
added this pull request to the merge queue
Jun 22, 2026
jonahgabriel
added a commit
that referenced
this pull request
Jul 3, 2026
…4.0) (#749) * feat(OMN-11881): normalize version field in all 63 contracts (#672) Replaces `contract_version: {major: X, minor: Y, patch: Z}` dict format with top-level `version: "X.Y.Z"` string in all 63 omniintelligence contracts. Updates test_contract_validation.py to enforce the new string format. * fix(OMN-12165): Fix datetime.now() in omniintelligence handler (#674) Replace naive datetime.now() with datetime.now(timezone.utc) for last_updated and generated_at fields in handler_onextree_generator.py. * fix(OMN-12167): Add contract.yaml for 4 omniintelligence nodes (#675) Adds contract.yaml for four nodes missing topology coverage: - node_tcb_generation_compute (COMPUTE_GENERIC): TCB intent normalization and candidate scoring - node_intent_graph_reducer (REDUCER_GENERIC): directed intent transition graph accumulator with state_machine - node_anti_gaming_alerter_effect (EFFECT_GENERIC): Kafka alert publisher, Kafka event bus declared - node_objective_ab_framework_compute (COMPUTE_GENERIC): multi-variant A/B objective evaluation All contracts validated: zero new test failures vs main (52 pre-existing failures unchanged). * chore(OMN-12169): Delete high-confidence dead code in omniintelligence (#676) - Remove 3 orphaned introspection.py files (609 lines): node_pattern_demotion_effect, node_pattern_extraction_compute, node_pattern_storage_effect — not imported anywhere - Remove 4 unused create_empty_* factory functions (118 lines) from node_pattern_extraction_compute/handlers/protocols.py and scrub them from __all__ Pre-existing RL test failures (test_contracts, test_unified_train_cli) confirmed on main before changes. * fix(OMN-12174): Eliminate hardcoded paths in omniintelligence (#677) Replace machine-specific /Volumes/PRO-G40 and /Users/jonah paths in test fixtures and .pre-commit-config.yaml error message with portable alternatives. - test_debounce_state.py: _SOURCE → /omninode/code/omniintelligence - test_handler_crawl_scheduler.py: _SOURCE → /omninode/code/omniintelligence - node_crawl_scheduler_effect/conftest.py: source_ref fixture → /omninode/code/omniintelligence - test_handler_context_item_writer.py: /Users/jonah/.claude → /home/user/.claude - .pre-commit-config.yaml: error message → $OMNI_HOME/docs/plans/ * test(OMN-12179): add unit tests for handler_claude_event payload extractors and DLQ routing (#678) Covers previously untested helpers in the highest-CCN file (score 1.8, CCN 21): - _extract_file_path_from_payload: top-level and nested tool_input paths, truncation, non-string guards - _extract_tool_name_from_payload: key priority, truncation, empty/non-string guards - _determine_processing_status: all three status branches (SUCCESS emitted, SUCCESS no-config, PARTIAL failed) - _route_to_dlq: DLQ topic suffix, payload structure, metadata annotation, swallowed failures, envelope sanitization * refactor(OMN-12185): Convert boundary @DataClass to Pydantic in omniintelligence (#679) Convert the three mutable accumulator classes in node_intent_graph_reducer to frozen=False Pydantic BaseModel. Preserves in-place mutation semantics required by the graph update handlers; uses ConfigDict(arbitrary_types_allowed=True) for the tuple-keyed edges dict in ModelIntentGraphState. All 49 existing unit tests pass without modification. * feat(OMN-11577, OMN-11581): implement CiErrorClassifier + DebugRetrieval compute nodes (#673) - NodeCiErrorClassifierCompute: add handle_classify_ci_error handler that parses raw failure_output (JSON or plain-text), normalizes via _parse_llm_response, and delegates from node.py thin shell; add handler_routing to contract.yaml - NodeDebugRetrievalCompute: replace empty stub with store-injected constructor that delegates to query_fix_records_with_decay; node accepts ProtocolDebugStore at construction time; add handler_routing to contract.yaml - Tests: 14 new tests for handler_classifier (JSON input, plain-text fallback, confidence clamping, end-to-end), 14 tests for handler_retrieval (time-decay math, store delegation, record annotation) - Both contracts gain handler_routing sections, removing them from the test_all_nodes_have_handler_routing_or_exemption failure list (8→6 remaining) * feat(OMN-12280): wire dispatch_worker-completed bridge handlers in dispatch engine (#684) * chore: release v0.24.0 — bump all dependency pins * feat(OMN-12280): wire dispatch_worker-completed bridge handlers in dispatch engine Add two missing bridge handlers to create_intelligence_dispatch_engine: 1. create_dispatch_outcome_eval_dispatch_handler: routes onex.evt.omniclaude.dispatch_worker-completed.v1 → handle_dispatch_outcome() and publishes onex.evt.omniintelligence.dispatch-outcome-evaluated.v1 2. create_dispatch_outcome_record_dispatch_handler: routes onex.evt.omniintelligence.dispatch-outcome-evaluated.v1 → record_dispatch_outcome() → writes dispatch_eval_results rows Previously PluginIntelligence wired the Kafka consumer (via contract.yaml subscribe_topics) but MessageDispatchEngine had no handler registered for these topics, causing "No handler found" nacks on every message. * fix(OMN-12280): lowercase verdict and fix ModelCostProvenance construction (#685) - EnumDispatchVerdict values are lowercase (pass/fail/error); the eval handler publishes PASS/FAIL/ERROR uppercase from ModelOutput.verdict - ModelCostProvenance validator forbids source_payload_hash for non-measured usage; only pass it when usage_source == "measured" * fix(OMN-12250): restore RewardSignal contract schema and extend train CLI (#686) - rl/contracts/rewards.py: replace re-export with proper per-channel RewardSignal (latency_reward, success_reward, cost_reward, quality_reward, weight fields, to_scalar()) frozen Pydantic model. The shaper-based RewardSignal in rl/rewards.py has a different shape; the contract model is used by RL training loops and must remain independent. - rl/train.py: add --all, --min-episodes, --manifest, --schedule flags; add pipeline and team surface support; exit code 2 when all skipped; print maturity class in output. Fixes 19 unit test failures. * test(OMN-12250): use EnumUsageSource in GPU event test (#688) * refactor(OMN-11584): restructure tools/ and clients/ to ONEX taxonomy (#689) Reclassifies two bare-noun directories into proper ONEX taxonomy names: - tools/ → validators/ (contract linter, validation models — these are validators in ONEX taxonomy; all internal imports updated) - clients/ → merged into adapters/ (LLM/API clients are adapters per ONEX taxonomy; file names preserved, all cross-package imports updated) Deferred: runtime/ (50+ files, plugin entrypoint — separate PR needed), audit/ (CLI entrypoint, tightly coupled to test markers), protocols/ (already valid ONEX taxonomy name for protocol definitions). 407 targeted tests pass; 0 new failures vs pre-existing baseline. * fix(OMN-11584): align dependency lock after taxonomy merge (#690) * ci(OMN-11584): align CI with validators taxonomy (#691) * ci(OMN-7466): rescue omniintelligence main target guard (#693) * ci(OMN-12243): add main target guard (#683) * chore: release v0.24.0 (OMN-12245) (#681) * feat(OMN-11881): normalize version field in all 63 contracts (#672) Replaces `contract_version: {major: X, minor: Y, patch: Z}` dict format with top-level `version: "X.Y.Z"` string in all 63 omniintelligence contracts. Updates test_contract_validation.py to enforce the new string format. * fix(OMN-12165): Fix datetime.now() in omniintelligence handler (#674) Replace naive datetime.now() with datetime.now(timezone.utc) for last_updated and generated_at fields in handler_onextree_generator.py. * fix(OMN-12167): Add contract.yaml for 4 omniintelligence nodes (#675) Adds contract.yaml for four nodes missing topology coverage: - node_tcb_generation_compute (COMPUTE_GENERIC): TCB intent normalization and candidate scoring - node_intent_graph_reducer (REDUCER_GENERIC): directed intent transition graph accumulator with state_machine - node_anti_gaming_alerter_effect (EFFECT_GENERIC): Kafka alert publisher, Kafka event bus declared - node_objective_ab_framework_compute (COMPUTE_GENERIC): multi-variant A/B objective evaluation All contracts validated: zero new test failures vs main (52 pre-existing failures unchanged). * chore(OMN-12169): Delete high-confidence dead code in omniintelligence (#676) - Remove 3 orphaned introspection.py files (609 lines): node_pattern_demotion_effect, node_pattern_extraction_compute, node_pattern_storage_effect — not imported anywhere - Remove 4 unused create_empty_* factory functions (118 lines) from node_pattern_extraction_compute/handlers/protocols.py and scrub them from __all__ Pre-existing RL test failures (test_contracts, test_unified_train_cli) confirmed on main before changes. * fix(OMN-12174): Eliminate hardcoded paths in omniintelligence (#677) Replace machine-specific /Volumes/PRO-G40 and /Users/jonah paths in test fixtures and .pre-commit-config.yaml error message with portable alternatives. - test_debounce_state.py: _SOURCE → /omninode/code/omniintelligence - test_handler_crawl_scheduler.py: _SOURCE → /omninode/code/omniintelligence - node_crawl_scheduler_effect/conftest.py: source_ref fixture → /omninode/code/omniintelligence - test_handler_context_item_writer.py: /Users/jonah/.claude → /home/user/.claude - .pre-commit-config.yaml: error message → $OMNI_HOME/docs/plans/ * test(OMN-12179): add unit tests for handler_claude_event payload extractors and DLQ routing (#678) Covers previously untested helpers in the highest-CCN file (score 1.8, CCN 21): - _extract_file_path_from_payload: top-level and nested tool_input paths, truncation, non-string guards - _extract_tool_name_from_payload: key priority, truncation, empty/non-string guards - _determine_processing_status: all three status branches (SUCCESS emitted, SUCCESS no-config, PARTIAL failed) - _route_to_dlq: DLQ topic suffix, payload structure, metadata annotation, swallowed failures, envelope sanitization * refactor(OMN-12185): Convert boundary @DataClass to Pydantic in omniintelligence (#679) Convert the three mutable accumulator classes in node_intent_graph_reducer to frozen=False Pydantic BaseModel. Preserves in-place mutation semantics required by the graph update handlers; uses ConfigDict(arbitrary_types_allowed=True) for the tuple-keyed edges dict in ModelIntentGraphState. All 49 existing unit tests pass without modification. * feat(OMN-11577, OMN-11581): implement CiErrorClassifier + DebugRetrieval compute nodes (#673) - NodeCiErrorClassifierCompute: add handle_classify_ci_error handler that parses raw failure_output (JSON or plain-text), normalizes via _parse_llm_response, and delegates from node.py thin shell; add handler_routing to contract.yaml - NodeDebugRetrievalCompute: replace empty stub with store-injected constructor that delegates to query_fix_records_with_decay; node accepts ProtocolDebugStore at construction time; add handler_routing to contract.yaml - Tests: 14 new tests for handler_classifier (JSON input, plain-text fallback, confidence clamping, end-to-end), 14 tests for handler_retrieval (time-decay math, store delegation, record annotation) - Both contracts gain handler_routing sections, removing them from the test_all_nodes_have_handler_routing_or_exemption failure list (8→6 remaining) * chore: release v0.24.0 — bump all dependency pins * ci: re-trigger CI for release promotion PR * evidence(OMN-12245): add release promotion receipts * evidence(OMN-12245): allowlist receipt commit shas * ci(OMN-12245): rerun after dependency publish * fix(OMN-12245): remove product-local release receipts * ci(OMN-12245): rerun after OCC main evidence * fix(OMN-12245): refresh omniintelligence release locks * fix(OMN-12245): satisfy omniintelligence release gates * fix(OMN-12245): allowlist release pin secret scan * chore(auto-ship): rescue uncommitted work from canonical omniintelligence Rescue uncommitted canonical work (auto-ship node undeployed). Rescued files: - training_manifest.yaml * ci(OMN-7466): refresh auto-ship rescue gates * fix(OMN-7466): keep omniintelligence rescue scoped * docs(OMN-7466): satisfy strict README diff gate * ci(OMN-12477): remove hotfix/* bypass from main-target-guard (#694) Main now accepts only dev/promotion PRs (with promotion-receipt: OCC-N). Deletes the hotfix/* allow-block and updates error messaging to drop hotfix references. OMN-12477 * chore(deps): update omnibase-core requirement (#698) Updates the requirements on [omnibase-core](https://github.com/OmniNode-ai/omnibase_core) to permit the latest version. - [Release notes](https://github.com/OmniNode-ai/omnibase_core/releases) - [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md) - [Commits](OmniNode-ai/omnibase_core@v0.42.0...v0.43.0) --- updated-dependencies: - dependency-name: omnibase-core dependency-version: 0.43.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(deps): refresh aiohttp lock and stabilize baseline tests (#699) * chore(deps): bump starlette from 0.49.3 to 1.0.1 (#700) * chore(deps): bump starlette from 0.49.3 to 1.0.1 Bumps [starlette](https://github.com/Kludex/starlette) from 0.49.3 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.49.3...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * fix: keep starlette dependency PR green --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jonahgabriel <jonah.gabriel@gmail.com> * chore(deps): update omnibase-core requirement (#703) Updates the requirements on [omnibase-core](https://github.com/OmniNode-ai/omnibase_core) to permit the latest version. - [Release notes](https://github.com/OmniNode-ai/omnibase_core/releases) - [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md) - [Commits](OmniNode-ai/omnibase_core@v0.42.0...v0.44.0) --- updated-dependencies: - dependency-name: omnibase-core dependency-version: 0.44.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci(OMN-12825): wire receipt-honesty gate (queue-safe ratchet) (#702) Add `.github/workflows/receipt-honesty.yml` — the OMN-12791 receipt-honesty validator wired as a CI workflow. Triggers on pull_request + merge_group so it is queue-safe for a later additive flip to required status check. The gate is a no-op (PASS) on omniintelligence since the repo carries no committed drift/dod_receipts/ files; it activates automatically if a PR introduces receipt YAMLs and will catch gamed probes before merge. Evidence-Source: b4a423efb853fdfdfb821ae6af5c7a694a585e36 Evidence-Ticket: OMN-12825 * chore(deps): bump the actions group with 2 updates (#706) Bumps the actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `actions/checkout` from 4 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) Updates `astral-sh/setup-uv` from 4 to 7 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(OMN-13180): refresh omniintelligence documentation (#711) - AGENT.md: corrected Qdrant claim — patterns stored in PostgreSQL, not Qdrant - README.md: corrected node type counts (Compute 35+→24, Effect 14+→30) - CLAUDE.md: Runtime Module table updated — dispatch_handlers.py now 31 handlers / 40 routes; all 14 dispatch_handler_*.py modules noted - docs/architecture/ONEX_FOUR_NODE_ARCHITECTURE.md: updated Four Node Types counts; added validate_handshake as bootstrap step 2.5; corrected dispatch engine route claim; replaced stale inline inventory with pointer to NODE_INVENTORY.md - docs/reference/NODE_INVENTORY.md: added node_dispatch_outcome_eval_effect (OMN-12280); documented 7 unregistered node directories; updated last-verified date - docs/reference/EVENT_SURFACE.md: pattern-scored.v1 moved from deprecated to produced (live since OMN-8161); added dispatch_worker-completed.v1 (consumed) and dispatch-outcome-evaluated.v1 (produced) from OMN-12280; updated last-verified date Parent: OMN-13172 * chore(OMN-13187): refresh omniintelligence dependencies (#712) * chore(deps): bump cryptography from 46.0.7 to 48.0.1 Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.7 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.7...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps-dev): bump python-multipart from 0.0.27 to 0.0.31 Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.27 to 0.0.31. - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.27...0.0.31) --- updated-dependencies: - dependency-name: python-multipart dependency-version: 0.0.31 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump aiohttp from 3.14.0 to 3.14.1 --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore(OMN-13187): refresh dependency evidence event * fix(OMN-13187): route unreachable model fallback to codex * test(OMN-13187): stabilize default review model test --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(OMN-13187): bump pyjwt in omniintelligence (#714) * docs(OMN-13198): retarget ModelOnexEnvelope docstring ref to ModelEventEnvelope (#715) ModelEventBusConfig docstring referenced the legacy ModelOnexEnvelope class (deleted in B4/OMN-13196). The event bus wraps Kafka messages into the canonical ModelEventEnvelope. Docstring-only edit; no behavior changed. * fix: split intelligence subscription startup (#716) * feat(OMN-13298): wire url-authority gate (pre-commit + CI) (#719) * feat(OMN-13298): wire url-authority gate (pre-commit + CI) Wires the existing check-url-authority remote hook from omnibase_core and adds url-authority-gate.yml CI workflow. Existing violations are grandfathered in the shared baseline (seeded via omnibase_core PR #1264). Only NEW hardcoded URL fingerprints will fail the gate going forward. - pre-commit hook: check-url-authority (ratchet, burn-down baseline) - CI workflow: url-authority-gate.yml (REQUIRED STATUS CHECK) - Baseline: seeded in omnibase_core#1264 (OMN-13298) Child of OMN-12803. * fix(OMN-13298): pin url authority validator source * fix(OMN-13298): run pinned url authority validator in CI * feat(OMN-13296): add reject-deploy-gate-skip-token pre-commit hook (#717) * feat(OMN-13296): add reject-deploy-gate-skip-token pre-commit hook Adds skip-token rejection gate (OMN-10414 parity) to local pre-commit: - .pre-commit-hooks/reject-deploy-gate-skip-token.sh (hook script) - reject-deploy-gate-skip-token (pre-commit stage) - reject-deploy-gate-skip-token-commit-msg (commit-msg stage) CI mirror call-reject-skip.yml was already present; this adds the local enforcement layer so bypass tokens are caught at commit time, not only in CI. CLAUDE.md Rule #10. Fail-closed proof: stage a file with [skip-deploy-gate: x] → hook exits 1 naming OMN-10414; remove token → hook exits 0. * chore(OMN-13296): refresh skip-token checks * fix(OMN-13296): place skip-token hooks in pre-commit repos * fix(OMN-13296): move skip-token hook under validation scripts * feat(OMN-13297): wire runtime-profiles gate into omniintelligence (#718) * feat(OMN-13297): wire runtime-profiles gate into omniintelligence W3 from the validator standardization remediation plan (GAP-7). Verification (F1 pre-file grep confirmed absent before this change): - `rg "runtime_profile" .pre-commit-config.yaml` → ABSENT (before) - 67 node contracts, 0 with runtime_profiles Changes: - Add validation/runtime_profiles_allowlist.yaml (baseline-freezing 15 pre-existing command-consuming nodes without runtime_profiles) - Add scripts/ci/run_runtime_profiles_validator.py (wrapper script that loads the repo-local allowlist — mirrors OMN-12955 pattern from omnimarket) - Add onex-validate-runtime-profiles pre-commit hook to .pre-commit-config.yaml - Add .github/workflows/validator-runtime-profiles.yml CI gate Fail-closed proof: planting a cmd-consuming contract without runtime_profiles not in the allowlist exits non-zero with the specific error message. Gate blocks NEW orphans; pre-existing ones are allowlisted for drain via OMN-12982. Evidence-Source: OCC#TBD Evidence-Ticket: OMN-13297 * fix(OMN-13297): keep runtime profiles allowlist under scripts validation * fix(OMN-13297): raise runtime profiles uv timeout * feat(OMN-13249): wire canonical-inference gate (pre-commit + CI) (#720) Fleet rollout of OMN-13219 to omniintelligence: consume the remotely-exposed check-canonical-inference hook from omnibase_core (pinned to export commit 940d2f2a) as a pre-commit hook + add the Canonical Inference Gate required CI workflow. The gate rejects NEW non-canonical model-inference surfaces (shelled codex/claude/gemini/opencode CLIs, *_MODEL/*_PROVIDER env reads). The 1 existing omniintelligence violation is grandfathered in the shared baseline (canonical_inference_baseline.json, seeded by core#1265); burn-down only. Fail-closed proof (verifier = core@940d2f2a validator): clean full-repo scan -> exit 0 (0 new, 1 grandfathered). (cross-repo plant proof captured on omnimarket; same validator + baseline.) Evidence-Source: OCC#2757 Evidence-Ticket: OMN-13249 * feat(OMN-13291): wire validate-validator-requirements fleet gate (omniintelligence) (W0) (#721) * feat(OMN-13291): wire validate-validator-requirements fleet gate (omniintelligence) W0 of the validator-standardization remediation plan (§3 W0). Wires the validate-validator-requirements meta-gate into omniintelligence as a remote pre-commit hook + CI workflow, so omniintelligence proves it carries its required validator gate-set declared in omnibase_core's architecture-handshakes/validator-requirements.yaml. - Add the omnibase_core remote pre-commit hook (validate-validator-requirements), pinned to the core export commit; re-pin to merged-dev once core lands. - Add .github/workflows/validate-validator-requirements.yml (checks out core, runs the consumer against omniintelligence's spec copy + baseline). Reports ALL missing gates per run (never fail-on-first). - Add architecture-handshakes/validator-requirements-baseline.yaml: structured schema recording the current accepted gaps (19); shrinks as W1-W10 land. - Vendor architecture-handshakes/validator-requirements.yaml (spec copy) so the pre-commit hook resolves the spec from this repo root (mirrors onex_change_control). Fail-closed proof captured in the omnibase_core export PR body (verifier != runner). Parent epic: OMN-9048. * ci(OMN-13291): satisfy validator requirements hook formatting * feat(OMN-13283): consume core transport-import + node-purity hooks, delete local io-audit scanner (#722) * feat(OMN-13283): consume core transport-import + node-purity hooks, delete local io-audit scanner Consolidates omniintelligence's transport/purity gates into the canonical omnibase_core remote hooks (OMN-13283 / GAP-8a, under OMN-9048): - Delete the scanner: src/omniintelligence/audit/io_audit.py + __main__.py and scripts/validate_no_transport_imports.py, plus tests/audit/test_io_violations.py, its io fixtures, tests/audit/io_audit_whitelist.yaml, and the transport-import test. - KEEP the shared audit data models (enum_io_audit_rule, model_audit_result/metrics/ violation, model_inline_pragma, model_whitelist_*) — they are consumed by the runtime node node_context_audit_aggregator_compute, not the scanner. __init__ trims the scanner exports. - Wire core remote hooks 'validate-no-transport-imports' + 'node-purity' (scoped to src/omniintelligence/nodes) in .pre-commit-config.yaml; node-purity excludes mirror the former io_audit_whitelist file-scoped exemptions (effect-node handlers, __main__ entry points, documented compute exemption). - Repoint the io-audit CI job to run the core node-purity validator with matching excludes. No behavioral regression: both hooks pass clean; audit models still import; fail-closed proof captured. Pin advances to the core merge SHA once omnibase_core#1272 lands. Part of OMN-9048 validator-standardization. * docs(OMN-13283): retarget stale audit links * ci(OMN-13283): align audit selector with core purity hook * fix(OMN-9536): drop legacy routing.feedback bare-topic drain in node_routing_feedback_effect (#724) * fix(OMN-9536): drop legacy routing.feedback bare-topic drain The bare topic "routing.feedback" was re-added by OMN-8157 (PR #610) as a no-op drain subscription, explicitly gated: "Remove after topic is confirmed empty and purged from Redpanda." Both gating conditions are now met: - No producer emits to the bare topic anywhere across all repos. The omniclaude registration (event_registry.py routing.feedback EventRegistration) fans out to TopicBase.ROUTING_FEEDBACK = onex.evt.omniclaude.routing-feedback.v1 (the canonical topic), not the bare topic. - Live Redpanda probe on 192.168.86.201 across all four lanes (dev, stability-test, prod, judge): bare routing.feedback topic is ABSENT in every lane; canonical onex.evt.omniclaude.routing-feedback.v1 is present. Removes the bare topic from subscribe_topics, the legacy drain dispatch handler + route, handle_legacy_routing_feedback_drain(), the TOPIC_LEGACY_ROUTING_FEEDBACK_BARE constant, and the drain-only test. Updates dispatch-engine handler/route count assertions (baseline 30->29 handlers, 37->36 routes) and removes the legacy topic from the contract-topics expected set. Bumps node_routing_feedback_effect contract 1.2.0 -> 1.2.1. * ci(OMN-9536): use reachable url authority core pin * refactor(OMN-13349): decompose claude hook check extraction (#723) * docs(OMN-13455): refresh architecture docs verified against code (#725) * chore(deps): update omnibase-core requirement (#729) Updates the requirements on [omnibase-core](https://github.com/OmniNode-ai/omnibase_core) to permit the latest version. - [Release notes](https://github.com/OmniNode-ai/omnibase_core/releases) - [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md) - [Commits](OmniNode-ai/omnibase_core@v0.42.0...v0.45.0) --- updated-dependencies: - dependency-name: omnibase-core dependency-version: 0.45.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(OMN-13495): bump actions/checkout from 6 to 7 (#728) * chore(deps): bump actions/checkout from 6 to 7 in the actions group Bumps the actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> * test(OMN-13495): align dispatch counts for no-LLM env * fix(OMN-13495): address checkout v7 review hardening --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump pydantic-settings from 2.14.0 to 2.14.2 (#731) Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings) from 2.14.0 to 2.14.2. - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.14.0...v2.14.2) --- updated-dependencies: - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * refactor(OMN-13561): remove scattered os.environ endpoint reads from navigation-retriever docs (Wave 1) (#734) Epic OMN-13556 Wave 1 (endpoints, OVERLAY seam) for omniintelligence. The url-authority gate flagged three `os.environ["LLM_EMBEDDING_URL"]` / `os.environ["QDRANT_URL"]` reads inside docstring/Field-description text of node_navigation_retriever_effect. These are NOT live env reads — the node is a pure declarative shell and the endpoints are caller-injected via the input model (already the correct DI pattern). The docstring literals were the only thing tripping the env-url-read rule. Reworded to describe overlay/routing- authority resolution without showing a raw env read. This burns down 3 grandfathered url-authority findings (baseline shrink in the paired omnibase_core PR). Gate stays green: 0 new violations. Live integration-endpoint migrations in this repo (QDRANT_URL in the gmail evaluator handler; MEMGRAPH_URI in dispatch_handler_graph_storage) require the sanctioned overlay boundary `omnibase_infra.runtime.overlay.contract_env_ref. expand_contract_env_refs` (OMN-13247). That module is on omnibase_infra dev only — it is NOT in any released tag (latest v0.38.3 lacks it) and omniintelligence pins omnibase-infra <0.38.0. Those migrations are deferred until the resolver ships in a release this repo can pin; vendoring/shimming the resolver is prohibited (duplication of the sanctioned boundary). LLM_*_URL reads are Bifrost-owned (OMN-12803/12815) and out of scope. Wave-1 ticket: OMN-13561. Epic: OMN-13556. * docs(OMN-13570): sanitize omniintelligence documentation (local-env + OMN-XXXX + renames) (#735) Removes all local-environment traces and Linear ticket references from the public documentation surface of omniintelligence. Task 1 — local-env sanitization: - deployment/docker/README.md: replace 192.168.86.200 with <onex-host>/ ${ONEX_HOST}, replace ".201" host shorthand with "the runtime host" - README.md: replace "on .201" with "on the runtime host" - CLAUDE.md: replace "on .201" with "on the runtime host" Task 2 — OMN-XXXX ticket ref removal (15 files): - CHANGELOG.md: strip OMN-XXXX from all feat/fix/test/ci prefixes, inline tags, and parenthetical refs across full version history - CLAUDE.md: remove (OMN-12280) dispatch count annotation; rewrite (OMN-2253)/(OMN-2058) API purpose prose; replace TODO(OMN-1234) illustrative code with generic TICKET-123 placeholder - docs/architecture/ONEX_FOUR_NODE_ARCHITECTURE.md: remove (OMN-13455) from last-updated footer - docs/architecture/contract-package-spec.md: remove **Ticket**: OMN-7142 header - docs/INDEX.md: remove (OMN-13455) from status table - docs/reference/NODE_INVENTORY.md: remove (OMN-13455) + (OMN-12280) annotations - docs/reference/EVENT_SURFACE.md: rewrite four OMN-tagged descriptions - docs/reference/DASH_INTEGRATION_TRUTH_BOUNDARY.md: remove (OMN-2366) drain tag - docs/standards/STANDARD_DOC_LAYOUT.md: rename plans/OMN-1757-* example path - deployment/database/FK_SCAN_REPORT.md: remove **Ticket**/**Parent** header fields - scripts/validation/topic_naming_baseline.txt: remove (OMN-3259) from comment - src/omniintelligence/audit/README.md: replace OMN-123/456 in YAML examples - src/omniintelligence/review_pairing/TOPICS.md: remove (OMN-2353) subsystem ref + OMN-2535 reference footer No source code, contracts, or CI yaml touched. Evidence-Ticket: OMN-13570 Evidence-Source: 87fb618f0273a5694123aed70aa25e4f8a3d1953 * chore(ci): propagate normalization-symmetry-hook [bot] (#738) Co-authored-by: onex-propagate-bot <bot@omninode.ai> * chore(OMN-13162): bump actions/cache to v6 (#740) * chore(deps): bump tuf from 6.0.0 to 7.0.0 (#741) Bumps [tuf](https://github.com/theupdateframework/python-tuf) from 6.0.0 to 7.0.0. - [Release notes](https://github.com/theupdateframework/python-tuf/releases) - [Changelog](https://github.com/theupdateframework/python-tuf/blob/develop/docs/CHANGELOG.md) - [Commits](theupdateframework/python-tuf@v6.0.0...v7.0.0) --- updated-dependencies: - dependency-name: tuf dependency-version: 7.0.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump omnibase_core to 0.46.1 (#743) * feat(OMN-13802): add Cursor hook event effect (#744) * Add Cursor hook-event consumer + agent_source seam Surface the OmniCursor dispatcher backend draft for OmniNode review (ask H.1 of the 2026-06-23 response to OMNICURSOR_DISPATCHER_PLAN), rebased onto current dev (ask H.2). - node_cursor_hook_event_effect: peer of node_claude_hook_event_effect (route_cursor_hook_event), with handler, models, registry and tests - agent_source seam on route_hook_event (defaults to "claude"; additive, Claude path unchanged) threaded onto emitted events - CURSOR_HOOK_EVENT topic + dispatch/wiring/message-type registration Rebase reconciliation against live dev (H.2): - merged DISPATCH_ALIAS_CURSOR_HOOK into __all__ alongside dev's new DISPATCH_OUTCOME_EVALUATED / DISPATCH_WORKER_COMPLETED aliases - corrected the dispatch-engine assertions: with the cursor node wired onto dev's baseline the true counts are 30 handlers / 37 routes (dev's 29/36 + 1 cursor each). The pre-rebase draft asserted 29/36, which only passed by number-collision with dev's cursor-less totals. Verified: full node_claude_hook_event_effect suite + dispatch + cursor + topic/registration tests all green (317 passed) with the W1 omnibase_core cursor models present. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(OMN-13802): add cursor hook event effect * chore(OMN-13802): format cursor hook contract --------- Co-authored-by: andywu42 <awu42@dons.usfca.edu> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(OMN-13877): dep-provenance gate — omniintelligence (+OMN-13878 escape tokens) (#745) * feat(OMN-13877): dep-provenance gate — omniintelligence (+OMN-13878 escape tokens) Add the dep-provenance gate (OMN-13873) to omniintelligence: forbid first-party git-source overrides of omnibase-core / omnibase-spi / omnibase-compat in [tool.uv.sources]. Copied verbatim from omnibase_infra: - scripts/check_dep_provenance.py - .github/workflows/dep-provenance-gate.yml - tests/scripts/test_check_dep_provenance.py Wire the check-dep-provenance local hook into .pre-commit-config.yaml. This repo currently violates the gate (omnibase-core rev=, omnibase-spi tag=). Escape-token both existing lines to OMN-13878 so the gate lands green without changing any pin value; the drain of those overrides is tracked by OMN-13878. * test(OMN-13877): allowlist fixture git-rev hashes for detect-secrets The verbatim-copied dep-provenance test fixtures embed example git rev SHAs (omnibase_infra #2184 reproduction + occ-only allow case). This repo's Detect Secrets CI gate flags them as Hex High Entropy Strings. Annotate the three fixture lines with '# pragma: allowlist secret' (comment on an implicitly-concatenated string piece — no behavior change; all 11 tests still pass). omnibase_infra's own secrets baseline already allowlisted these; this repo scans tests/scripts/ so needs the inline mark. * ci(OMN-13875): Quality Gate actually evaluates contract-compliance (#746) * ci(OMN-13875): Quality Gate actually evaluates contract-compliance contract-compliance was in quality-gate's needs: but its .result was never read — a decorative dependency, so a Contract Compliance Check failure did not block merge. Read it and fail the gate on failure. Success-or-skipped tolerance only applies to non-gating events; on pull_request/merge_group it always runs, so nothing slips via skipped. quality-gate feeds the required CI Summary (requires quality==success), so the fix propagates. Evidence-Source: workflow-logic fix, no Python touched. * test(OMN-13885): bump handler/route baselines +1 for OMN-13802 cursor-hook OMN-13802 (#744) added the cursor-hook event effect: +1 baseline handler (intelligence-cursor-hook-handler) and +1 baseline route (intelligence-cursor-hook-route), plus a new node dir node_cursor_hook_event_effect. The drift-detector baselines were not bumped, turning omniintelligence dev red on Unit Tests -> CI Summary (blocks all dev PRs). Confirmed live counts locally (env -u PYTHONPATH, pinned core rev 5698f6f): - with projection: handler_count=31, route_count=40 - without projection: handler_count=30, route_count=37 Updated: - test_pattern_stored_triggers_projection.py: 30->31 / 39->40 (proj), 29->30 (base) - test_projection_handler_registration.py: 29->30, 36->37 - test_plugin_dispatch.py: 39->40, 30->31 - test_package_installability.py: EXPECTED_NODE_DIRS += node_cursor_hook_event_effect Full tests/unit green (5562+ passed). Unblocks OMN-13875 PR #746. * fix(OMN-13887): migrate omniintelligence dispatch off removed core MessageDispatchEngine + repin to PyPI (OMN-13878) (#748) omnibase_core removed runtime.runtime_message_dispatch.MessageDispatchEngine in 0.46.x. Migrate the Intelligence runtime onto the canonical successor (omnibase_infra.runtime.message_dispatch_engine.MessageDispatchEngine, the same engine omnimarket uses) via a single envelope-rehydration adapter seam so all ~30 domain handlers stay behavior-preserving and untouched. - dispatch_handlers.py: add _rehydrate_dispatch_envelope + _adapt_context_dispatcher + _register_dispatcher_adapted. The infra engine materializes every envelope to a JSON-safe dict at the dispatch boundary (OMN-1518) and treats a non-None str return as an output topic; the adapter restores a ModelEventEnvelope view (payload/correlation_id/event_type/timestamp from __debug_trace) and normalizes status-sentinel returns ("ok"/"skip"/...) to None. - plugin.py + dispatch_handlers.py: register_handler->register_dispatcher, handler_count->dispatcher_count, result.handler_id->result.dispatcher_id. - add tests/unit/runtime/test_dispatch_envelope_adapter.py (12 cases) covering the new boundary seam. - pyproject/uv.lock: repin omnibase-core 0.46.3 + omnibase-spi 0.23.1 from PyPI, bump infra to the core-0.46 dev rev, delete both raw-override-ok:OMN-13878 tokens and the core/spi git sources; ceilings <0.47.0 / <0.24.0. Closes the omniintelligence lane of OMN-13878 (4/4 token-free). Full CI-scoped suite (tests/ --ignore=tests/integration, matching ci.yml): 5675 passed, 0 failed. The 12 integration failures + e2e errors reproduce identically on clean origin/dev (service/pytest-asyncio, excluded from CI) — no regression. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: onex-propagate-bot <bot@omninode.ai> Co-authored-by: andywu42 <awu42@dons.usfca.edu> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
andywu42
added a commit
to andywu42/omniintelligence
that referenced
this pull request
Jul 6, 2026
* ci(OMN-12243): add main target guard (OmniNode-ai#683) * chore: release v0.24.0 (OMN-12245) (OmniNode-ai#681) * feat(OMN-11881): normalize version field in all 63 contracts (OmniNode-ai#672) Replaces `contract_version: {major: X, minor: Y, patch: Z}` dict format with top-level `version: "X.Y.Z"` string in all 63 omniintelligence contracts. Updates test_contract_validation.py to enforce the new string format. * fix(OMN-12165): Fix datetime.now() in omniintelligence handler (OmniNode-ai#674) Replace naive datetime.now() with datetime.now(timezone.utc) for last_updated and generated_at fields in handler_onextree_generator.py. * fix(OMN-12167): Add contract.yaml for 4 omniintelligence nodes (OmniNode-ai#675) Adds contract.yaml for four nodes missing topology coverage: - node_tcb_generation_compute (COMPUTE_GENERIC): TCB intent normalization and candidate scoring - node_intent_graph_reducer (REDUCER_GENERIC): directed intent transition graph accumulator with state_machine - node_anti_gaming_alerter_effect (EFFECT_GENERIC): Kafka alert publisher, Kafka event bus declared - node_objective_ab_framework_compute (COMPUTE_GENERIC): multi-variant A/B objective evaluation All contracts validated: zero new test failures vs main (52 pre-existing failures unchanged). * chore(OMN-12169): Delete high-confidence dead code in omniintelligence (OmniNode-ai#676) - Remove 3 orphaned introspection.py files (609 lines): node_pattern_demotion_effect, node_pattern_extraction_compute, node_pattern_storage_effect — not imported anywhere - Remove 4 unused create_empty_* factory functions (118 lines) from node_pattern_extraction_compute/handlers/protocols.py and scrub them from __all__ Pre-existing RL test failures (test_contracts, test_unified_train_cli) confirmed on main before changes. * fix(OMN-12174): Eliminate hardcoded paths in omniintelligence (OmniNode-ai#677) Replace machine-specific /Volumes/PRO-G40 and /Users/jonah paths in test fixtures and .pre-commit-config.yaml error message with portable alternatives. - test_debounce_state.py: _SOURCE → /omninode/code/omniintelligence - test_handler_crawl_scheduler.py: _SOURCE → /omninode/code/omniintelligence - node_crawl_scheduler_effect/conftest.py: source_ref fixture → /omninode/code/omniintelligence - test_handler_context_item_writer.py: /Users/jonah/.claude → /home/user/.claude - .pre-commit-config.yaml: error message → $OMNI_HOME/docs/plans/ * test(OMN-12179): add unit tests for handler_claude_event payload extractors and DLQ routing (OmniNode-ai#678) Covers previously untested helpers in the highest-CCN file (score 1.8, CCN 21): - _extract_file_path_from_payload: top-level and nested tool_input paths, truncation, non-string guards - _extract_tool_name_from_payload: key priority, truncation, empty/non-string guards - _determine_processing_status: all three status branches (SUCCESS emitted, SUCCESS no-config, PARTIAL failed) - _route_to_dlq: DLQ topic suffix, payload structure, metadata annotation, swallowed failures, envelope sanitization * refactor(OMN-12185): Convert boundary @DataClass to Pydantic in omniintelligence (OmniNode-ai#679) Convert the three mutable accumulator classes in node_intent_graph_reducer to frozen=False Pydantic BaseModel. Preserves in-place mutation semantics required by the graph update handlers; uses ConfigDict(arbitrary_types_allowed=True) for the tuple-keyed edges dict in ModelIntentGraphState. All 49 existing unit tests pass without modification. * feat(OMN-11577, OMN-11581): implement CiErrorClassifier + DebugRetrieval compute nodes (OmniNode-ai#673) - NodeCiErrorClassifierCompute: add handle_classify_ci_error handler that parses raw failure_output (JSON or plain-text), normalizes via _parse_llm_response, and delegates from node.py thin shell; add handler_routing to contract.yaml - NodeDebugRetrievalCompute: replace empty stub with store-injected constructor that delegates to query_fix_records_with_decay; node accepts ProtocolDebugStore at construction time; add handler_routing to contract.yaml - Tests: 14 new tests for handler_classifier (JSON input, plain-text fallback, confidence clamping, end-to-end), 14 tests for handler_retrieval (time-decay math, store delegation, record annotation) - Both contracts gain handler_routing sections, removing them from the test_all_nodes_have_handler_routing_or_exemption failure list (8→6 remaining) * chore: release v0.24.0 — bump all dependency pins * ci: re-trigger CI for release promotion PR * evidence(OMN-12245): add release promotion receipts * evidence(OMN-12245): allowlist receipt commit shas * ci(OMN-12245): rerun after dependency publish * fix(OMN-12245): remove product-local release receipts * ci(OMN-12245): rerun after OCC main evidence * fix(OMN-12245): refresh omniintelligence release locks * fix(OMN-12245): satisfy omniintelligence release gates * fix(OMN-12245): allowlist release pin secret scan * release(OMN-13828): promote omniintelligence dev→main (adoption + 0.24.0) (OmniNode-ai#749) * feat(OMN-11881): normalize version field in all 63 contracts (OmniNode-ai#672) Replaces `contract_version: {major: X, minor: Y, patch: Z}` dict format with top-level `version: "X.Y.Z"` string in all 63 omniintelligence contracts. Updates test_contract_validation.py to enforce the new string format. * fix(OMN-12165): Fix datetime.now() in omniintelligence handler (OmniNode-ai#674) Replace naive datetime.now() with datetime.now(timezone.utc) for last_updated and generated_at fields in handler_onextree_generator.py. * fix(OMN-12167): Add contract.yaml for 4 omniintelligence nodes (OmniNode-ai#675) Adds contract.yaml for four nodes missing topology coverage: - node_tcb_generation_compute (COMPUTE_GENERIC): TCB intent normalization and candidate scoring - node_intent_graph_reducer (REDUCER_GENERIC): directed intent transition graph accumulator with state_machine - node_anti_gaming_alerter_effect (EFFECT_GENERIC): Kafka alert publisher, Kafka event bus declared - node_objective_ab_framework_compute (COMPUTE_GENERIC): multi-variant A/B objective evaluation All contracts validated: zero new test failures vs main (52 pre-existing failures unchanged). * chore(OMN-12169): Delete high-confidence dead code in omniintelligence (OmniNode-ai#676) - Remove 3 orphaned introspection.py files (609 lines): node_pattern_demotion_effect, node_pattern_extraction_compute, node_pattern_storage_effect — not imported anywhere - Remove 4 unused create_empty_* factory functions (118 lines) from node_pattern_extraction_compute/handlers/protocols.py and scrub them from __all__ Pre-existing RL test failures (test_contracts, test_unified_train_cli) confirmed on main before changes. * fix(OMN-12174): Eliminate hardcoded paths in omniintelligence (OmniNode-ai#677) Replace machine-specific /Volumes/PRO-G40 and /Users/jonah paths in test fixtures and .pre-commit-config.yaml error message with portable alternatives. - test_debounce_state.py: _SOURCE → /omninode/code/omniintelligence - test_handler_crawl_scheduler.py: _SOURCE → /omninode/code/omniintelligence - node_crawl_scheduler_effect/conftest.py: source_ref fixture → /omninode/code/omniintelligence - test_handler_context_item_writer.py: /Users/jonah/.claude → /home/user/.claude - .pre-commit-config.yaml: error message → $OMNI_HOME/docs/plans/ * test(OMN-12179): add unit tests for handler_claude_event payload extractors and DLQ routing (OmniNode-ai#678) Covers previously untested helpers in the highest-CCN file (score 1.8, CCN 21): - _extract_file_path_from_payload: top-level and nested tool_input paths, truncation, non-string guards - _extract_tool_name_from_payload: key priority, truncation, empty/non-string guards - _determine_processing_status: all three status branches (SUCCESS emitted, SUCCESS no-config, PARTIAL failed) - _route_to_dlq: DLQ topic suffix, payload structure, metadata annotation, swallowed failures, envelope sanitization * refactor(OMN-12185): Convert boundary @DataClass to Pydantic in omniintelligence (OmniNode-ai#679) Convert the three mutable accumulator classes in node_intent_graph_reducer to frozen=False Pydantic BaseModel. Preserves in-place mutation semantics required by the graph update handlers; uses ConfigDict(arbitrary_types_allowed=True) for the tuple-keyed edges dict in ModelIntentGraphState. All 49 existing unit tests pass without modification. * feat(OMN-11577, OMN-11581): implement CiErrorClassifier + DebugRetrieval compute nodes (OmniNode-ai#673) - NodeCiErrorClassifierCompute: add handle_classify_ci_error handler that parses raw failure_output (JSON or plain-text), normalizes via _parse_llm_response, and delegates from node.py thin shell; add handler_routing to contract.yaml - NodeDebugRetrievalCompute: replace empty stub with store-injected constructor that delegates to query_fix_records_with_decay; node accepts ProtocolDebugStore at construction time; add handler_routing to contract.yaml - Tests: 14 new tests for handler_classifier (JSON input, plain-text fallback, confidence clamping, end-to-end), 14 tests for handler_retrieval (time-decay math, store delegation, record annotation) - Both contracts gain handler_routing sections, removing them from the test_all_nodes_have_handler_routing_or_exemption failure list (8→6 remaining) * feat(OMN-12280): wire dispatch_worker-completed bridge handlers in dispatch engine (OmniNode-ai#684) * chore: release v0.24.0 — bump all dependency pins * feat(OMN-12280): wire dispatch_worker-completed bridge handlers in dispatch engine Add two missing bridge handlers to create_intelligence_dispatch_engine: 1. create_dispatch_outcome_eval_dispatch_handler: routes onex.evt.omniclaude.dispatch_worker-completed.v1 → handle_dispatch_outcome() and publishes onex.evt.omniintelligence.dispatch-outcome-evaluated.v1 2. create_dispatch_outcome_record_dispatch_handler: routes onex.evt.omniintelligence.dispatch-outcome-evaluated.v1 → record_dispatch_outcome() → writes dispatch_eval_results rows Previously PluginIntelligence wired the Kafka consumer (via contract.yaml subscribe_topics) but MessageDispatchEngine had no handler registered for these topics, causing "No handler found" nacks on every message. * fix(OMN-12280): lowercase verdict and fix ModelCostProvenance construction (OmniNode-ai#685) - EnumDispatchVerdict values are lowercase (pass/fail/error); the eval handler publishes PASS/FAIL/ERROR uppercase from ModelOutput.verdict - ModelCostProvenance validator forbids source_payload_hash for non-measured usage; only pass it when usage_source == "measured" * fix(OMN-12250): restore RewardSignal contract schema and extend train CLI (OmniNode-ai#686) - rl/contracts/rewards.py: replace re-export with proper per-channel RewardSignal (latency_reward, success_reward, cost_reward, quality_reward, weight fields, to_scalar()) frozen Pydantic model. The shaper-based RewardSignal in rl/rewards.py has a different shape; the contract model is used by RL training loops and must remain independent. - rl/train.py: add --all, --min-episodes, --manifest, --schedule flags; add pipeline and team surface support; exit code 2 when all skipped; print maturity class in output. Fixes 19 unit test failures. * test(OMN-12250): use EnumUsageSource in GPU event test (OmniNode-ai#688) * refactor(OMN-11584): restructure tools/ and clients/ to ONEX taxonomy (OmniNode-ai#689) Reclassifies two bare-noun directories into proper ONEX taxonomy names: - tools/ → validators/ (contract linter, validation models — these are validators in ONEX taxonomy; all internal imports updated) - clients/ → merged into adapters/ (LLM/API clients are adapters per ONEX taxonomy; file names preserved, all cross-package imports updated) Deferred: runtime/ (50+ files, plugin entrypoint — separate PR needed), audit/ (CLI entrypoint, tightly coupled to test markers), protocols/ (already valid ONEX taxonomy name for protocol definitions). 407 targeted tests pass; 0 new failures vs pre-existing baseline. * fix(OMN-11584): align dependency lock after taxonomy merge (OmniNode-ai#690) * ci(OMN-11584): align CI with validators taxonomy (OmniNode-ai#691) * ci(OMN-7466): rescue omniintelligence main target guard (OmniNode-ai#693) * ci(OMN-12243): add main target guard (OmniNode-ai#683) * chore: release v0.24.0 (OMN-12245) (OmniNode-ai#681) * feat(OMN-11881): normalize version field in all 63 contracts (OmniNode-ai#672) Replaces `contract_version: {major: X, minor: Y, patch: Z}` dict format with top-level `version: "X.Y.Z"` string in all 63 omniintelligence contracts. Updates test_contract_validation.py to enforce the new string format. * fix(OMN-12165): Fix datetime.now() in omniintelligence handler (OmniNode-ai#674) Replace naive datetime.now() with datetime.now(timezone.utc) for last_updated and generated_at fields in handler_onextree_generator.py. * fix(OMN-12167): Add contract.yaml for 4 omniintelligence nodes (OmniNode-ai#675) Adds contract.yaml for four nodes missing topology coverage: - node_tcb_generation_compute (COMPUTE_GENERIC): TCB intent normalization and candidate scoring - node_intent_graph_reducer (REDUCER_GENERIC): directed intent transition graph accumulator with state_machine - node_anti_gaming_alerter_effect (EFFECT_GENERIC): Kafka alert publisher, Kafka event bus declared - node_objective_ab_framework_compute (COMPUTE_GENERIC): multi-variant A/B objective evaluation All contracts validated: zero new test failures vs main (52 pre-existing failures unchanged). * chore(OMN-12169): Delete high-confidence dead code in omniintelligence (OmniNode-ai#676) - Remove 3 orphaned introspection.py files (609 lines): node_pattern_demotion_effect, node_pattern_extraction_compute, node_pattern_storage_effect — not imported anywhere - Remove 4 unused create_empty_* factory functions (118 lines) from node_pattern_extraction_compute/handlers/protocols.py and scrub them from __all__ Pre-existing RL test failures (test_contracts, test_unified_train_cli) confirmed on main before changes. * fix(OMN-12174): Eliminate hardcoded paths in omniintelligence (OmniNode-ai#677) Replace machine-specific /Volumes/PRO-G40 and /Users/jonah paths in test fixtures and .pre-commit-config.yaml error message with portable alternatives. - test_debounce_state.py: _SOURCE → /omninode/code/omniintelligence - test_handler_crawl_scheduler.py: _SOURCE → /omninode/code/omniintelligence - node_crawl_scheduler_effect/conftest.py: source_ref fixture → /omninode/code/omniintelligence - test_handler_context_item_writer.py: /Users/jonah/.claude → /home/user/.claude - .pre-commit-config.yaml: error message → $OMNI_HOME/docs/plans/ * test(OMN-12179): add unit tests for handler_claude_event payload extractors and DLQ routing (OmniNode-ai#678) Covers previously untested helpers in the highest-CCN file (score 1.8, CCN 21): - _extract_file_path_from_payload: top-level and nested tool_input paths, truncation, non-string guards - _extract_tool_name_from_payload: key priority, truncation, empty/non-string guards - _determine_processing_status: all three status branches (SUCCESS emitted, SUCCESS no-config, PARTIAL failed) - _route_to_dlq: DLQ topic suffix, payload structure, metadata annotation, swallowed failures, envelope sanitization * refactor(OMN-12185): Convert boundary @DataClass to Pydantic in omniintelligence (OmniNode-ai#679) Convert the three mutable accumulator classes in node_intent_graph_reducer to frozen=False Pydantic BaseModel. Preserves in-place mutation semantics required by the graph update handlers; uses ConfigDict(arbitrary_types_allowed=True) for the tuple-keyed edges dict in ModelIntentGraphState. All 49 existing unit tests pass without modification. * feat(OMN-11577, OMN-11581): implement CiErrorClassifier + DebugRetrieval compute nodes (OmniNode-ai#673) - NodeCiErrorClassifierCompute: add handle_classify_ci_error handler that parses raw failure_output (JSON or plain-text), normalizes via _parse_llm_response, and delegates from node.py thin shell; add handler_routing to contract.yaml - NodeDebugRetrievalCompute: replace empty stub with store-injected constructor that delegates to query_fix_records_with_decay; node accepts ProtocolDebugStore at construction time; add handler_routing to contract.yaml - Tests: 14 new tests for handler_classifier (JSON input, plain-text fallback, confidence clamping, end-to-end), 14 tests for handler_retrieval (time-decay math, store delegation, record annotation) - Both contracts gain handler_routing sections, removing them from the test_all_nodes_have_handler_routing_or_exemption failure list (8→6 remaining) * chore: release v0.24.0 — bump all dependency pins * ci: re-trigger CI for release promotion PR * evidence(OMN-12245): add release promotion receipts * evidence(OMN-12245): allowlist receipt commit shas * ci(OMN-12245): rerun after dependency publish * fix(OMN-12245): remove product-local release receipts * ci(OMN-12245): rerun after OCC main evidence * fix(OMN-12245): refresh omniintelligence release locks * fix(OMN-12245): satisfy omniintelligence release gates * fix(OMN-12245): allowlist release pin secret scan * chore(auto-ship): rescue uncommitted work from canonical omniintelligence Rescue uncommitted canonical work (auto-ship node undeployed). Rescued files: - training_manifest.yaml * ci(OMN-7466): refresh auto-ship rescue gates * fix(OMN-7466): keep omniintelligence rescue scoped * docs(OMN-7466): satisfy strict README diff gate * ci(OMN-12477): remove hotfix/* bypass from main-target-guard (OmniNode-ai#694) Main now accepts only dev/promotion PRs (with promotion-receipt: OCC-N). Deletes the hotfix/* allow-block and updates error messaging to drop hotfix references. OMN-12477 * chore(deps): update omnibase-core requirement (OmniNode-ai#698) Updates the requirements on [omnibase-core](https://github.com/OmniNode-ai/omnibase_core) to permit the latest version. - [Release notes](https://github.com/OmniNode-ai/omnibase_core/releases) - [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md) - [Commits](OmniNode-ai/omnibase_core@v0.42.0...v0.43.0) --- updated-dependencies: - dependency-name: omnibase-core dependency-version: 0.43.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(deps): refresh aiohttp lock and stabilize baseline tests (OmniNode-ai#699) * chore(deps): bump starlette from 0.49.3 to 1.0.1 (OmniNode-ai#700) * chore(deps): bump starlette from 0.49.3 to 1.0.1 Bumps [starlette](https://github.com/Kludex/starlette) from 0.49.3 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.49.3...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * fix: keep starlette dependency PR green --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jonahgabriel <jonah.gabriel@gmail.com> * chore(deps): update omnibase-core requirement (OmniNode-ai#703) Updates the requirements on [omnibase-core](https://github.com/OmniNode-ai/omnibase_core) to permit the latest version. - [Release notes](https://github.com/OmniNode-ai/omnibase_core/releases) - [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md) - [Commits](OmniNode-ai/omnibase_core@v0.42.0...v0.44.0) --- updated-dependencies: - dependency-name: omnibase-core dependency-version: 0.44.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci(OMN-12825): wire receipt-honesty gate (queue-safe ratchet) (OmniNode-ai#702) Add `.github/workflows/receipt-honesty.yml` — the OMN-12791 receipt-honesty validator wired as a CI workflow. Triggers on pull_request + merge_group so it is queue-safe for a later additive flip to required status check. The gate is a no-op (PASS) on omniintelligence since the repo carries no committed drift/dod_receipts/ files; it activates automatically if a PR introduces receipt YAMLs and will catch gamed probes before merge. Evidence-Source: b4a423efb853fdfdfb821ae6af5c7a694a585e36 Evidence-Ticket: OMN-12825 * chore(deps): bump the actions group with 2 updates (OmniNode-ai#706) Bumps the actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `actions/checkout` from 4 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) Updates `astral-sh/setup-uv` from 4 to 7 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(OMN-13180): refresh omniintelligence documentation (OmniNode-ai#711) - AGENT.md: corrected Qdrant claim — patterns stored in PostgreSQL, not Qdrant - README.md: corrected node type counts (Compute 35+→24, Effect 14+→30) - CLAUDE.md: Runtime Module table updated — dispatch_handlers.py now 31 handlers / 40 routes; all 14 dispatch_handler_*.py modules noted - docs/architecture/ONEX_FOUR_NODE_ARCHITECTURE.md: updated Four Node Types counts; added validate_handshake as bootstrap step 2.5; corrected dispatch engine route claim; replaced stale inline inventory with pointer to NODE_INVENTORY.md - docs/reference/NODE_INVENTORY.md: added node_dispatch_outcome_eval_effect (OMN-12280); documented 7 unregistered node directories; updated last-verified date - docs/reference/EVENT_SURFACE.md: pattern-scored.v1 moved from deprecated to produced (live since OMN-8161); added dispatch_worker-completed.v1 (consumed) and dispatch-outcome-evaluated.v1 (produced) from OMN-12280; updated last-verified date Parent: OMN-13172 * chore(OMN-13187): refresh omniintelligence dependencies (OmniNode-ai#712) * chore(deps): bump cryptography from 46.0.7 to 48.0.1 Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.7 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.7...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps-dev): bump python-multipart from 0.0.27 to 0.0.31 Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.27 to 0.0.31. - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.27...0.0.31) --- updated-dependencies: - dependency-name: python-multipart dependency-version: 0.0.31 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump aiohttp from 3.14.0 to 3.14.1 --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore(OMN-13187): refresh dependency evidence event * fix(OMN-13187): route unreachable model fallback to codex * test(OMN-13187): stabilize default review model test --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(OMN-13187): bump pyjwt in omniintelligence (OmniNode-ai#714) * docs(OMN-13198): retarget ModelOnexEnvelope docstring ref to ModelEventEnvelope (OmniNode-ai#715) ModelEventBusConfig docstring referenced the legacy ModelOnexEnvelope class (deleted in B4/OMN-13196). The event bus wraps Kafka messages into the canonical ModelEventEnvelope. Docstring-only edit; no behavior changed. * fix: split intelligence subscription startup (OmniNode-ai#716) * feat(OMN-13298): wire url-authority gate (pre-commit + CI) (OmniNode-ai#719) * feat(OMN-13298): wire url-authority gate (pre-commit + CI) Wires the existing check-url-authority remote hook from omnibase_core and adds url-authority-gate.yml CI workflow. Existing violations are grandfathered in the shared baseline (seeded via omnibase_core PR #1264). Only NEW hardcoded URL fingerprints will fail the gate going forward. - pre-commit hook: check-url-authority (ratchet, burn-down baseline) - CI workflow: url-authority-gate.yml (REQUIRED STATUS CHECK) - Baseline: seeded in omnibase_core#1264 (OMN-13298) Child of OMN-12803. * fix(OMN-13298): pin url authority validator source * fix(OMN-13298): run pinned url authority validator in CI * feat(OMN-13296): add reject-deploy-gate-skip-token pre-commit hook (OmniNode-ai#717) * feat(OMN-13296): add reject-deploy-gate-skip-token pre-commit hook Adds skip-token rejection gate (OMN-10414 parity) to local pre-commit: - .pre-commit-hooks/reject-deploy-gate-skip-token.sh (hook script) - reject-deploy-gate-skip-token (pre-commit stage) - reject-deploy-gate-skip-token-commit-msg (commit-msg stage) CI mirror call-reject-skip.yml was already present; this adds the local enforcement layer so bypass tokens are caught at commit time, not only in CI. CLAUDE.md Rule OmniNode-ai#10. Fail-closed proof: stage a file with [skip-deploy-gate: x] → hook exits 1 naming OMN-10414; remove token → hook exits 0. * chore(OMN-13296): refresh skip-token checks * fix(OMN-13296): place skip-token hooks in pre-commit repos * fix(OMN-13296): move skip-token hook under validation scripts * feat(OMN-13297): wire runtime-profiles gate into omniintelligence (OmniNode-ai#718) * feat(OMN-13297): wire runtime-profiles gate into omniintelligence W3 from the validator standardization remediation plan (GAP-7). Verification (F1 pre-file grep confirmed absent before this change): - `rg "runtime_profile" .pre-commit-config.yaml` → ABSENT (before) - 67 node contracts, 0 with runtime_profiles Changes: - Add validation/runtime_profiles_allowlist.yaml (baseline-freezing 15 pre-existing command-consuming nodes without runtime_profiles) - Add scripts/ci/run_runtime_profiles_validator.py (wrapper script that loads the repo-local allowlist — mirrors OMN-12955 pattern from omnimarket) - Add onex-validate-runtime-profiles pre-commit hook to .pre-commit-config.yaml - Add .github/workflows/validator-runtime-profiles.yml CI gate Fail-closed proof: planting a cmd-consuming contract without runtime_profiles not in the allowlist exits non-zero with the specific error message. Gate blocks NEW orphans; pre-existing ones are allowlisted for drain via OMN-12982. Evidence-Source: OCC#TBD Evidence-Ticket: OMN-13297 * fix(OMN-13297): keep runtime profiles allowlist under scripts validation * fix(OMN-13297): raise runtime profiles uv timeout * feat(OMN-13249): wire canonical-inference gate (pre-commit + CI) (OmniNode-ai#720) Fleet rollout of OMN-13219 to omniintelligence: consume the remotely-exposed check-canonical-inference hook from omnibase_core (pinned to export commit 940d2f2a) as a pre-commit hook + add the Canonical Inference Gate required CI workflow. The gate rejects NEW non-canonical model-inference surfaces (shelled codex/claude/gemini/opencode CLIs, *_MODEL/*_PROVIDER env reads). The 1 existing omniintelligence violation is grandfathered in the shared baseline (canonical_inference_baseline.json, seeded by core#1265); burn-down only. Fail-closed proof (verifier = core@940d2f2a validator): clean full-repo scan -> exit 0 (0 new, 1 grandfathered). (cross-repo plant proof captured on omnimarket; same validator + baseline.) Evidence-Source: OCC#2757 Evidence-Ticket: OMN-13249 * feat(OMN-13291): wire validate-validator-requirements fleet gate (omniintelligence) (W0) (OmniNode-ai#721) * feat(OMN-13291): wire validate-validator-requirements fleet gate (omniintelligence) W0 of the validator-standardization remediation plan (§3 W0). Wires the validate-validator-requirements meta-gate into omniintelligence as a remote pre-commit hook + CI workflow, so omniintelligence proves it carries its required validator gate-set declared in omnibase_core's architecture-handshakes/validator-requirements.yaml. - Add the omnibase_core remote pre-commit hook (validate-validator-requirements), pinned to the core export commit; re-pin to merged-dev once core lands. - Add .github/workflows/validate-validator-requirements.yml (checks out core, runs the consumer against omniintelligence's spec copy + baseline). Reports ALL missing gates per run (never fail-on-first). - Add architecture-handshakes/validator-requirements-baseline.yaml: structured schema recording the current accepted gaps (19); shrinks as W1-W10 land. - Vendor architecture-handshakes/validator-requirements.yaml (spec copy) so the pre-commit hook resolves the spec from this repo root (mirrors onex_change_control). Fail-closed proof captured in the omnibase_core export PR body (verifier != runner). Parent epic: OMN-9048. * ci(OMN-13291): satisfy validator requirements hook formatting * feat(OMN-13283): consume core transport-import + node-purity hooks, delete local io-audit scanner (OmniNode-ai#722) * feat(OMN-13283): consume core transport-import + node-purity hooks, delete local io-audit scanner Consolidates omniintelligence's transport/purity gates into the canonical omnibase_core remote hooks (OMN-13283 / GAP-8a, under OMN-9048): - Delete the scanner: src/omniintelligence/audit/io_audit.py + __main__.py and scripts/validate_no_transport_imports.py, plus tests/audit/test_io_violations.py, its io fixtures, tests/audit/io_audit_whitelist.yaml, and the transport-import test. - KEEP the shared audit data models (enum_io_audit_rule, model_audit_result/metrics/ violation, model_inline_pragma, model_whitelist_*) — they are consumed by the runtime node node_context_audit_aggregator_compute, not the scanner. __init__ trims the scanner exports. - Wire core remote hooks 'validate-no-transport-imports' + 'node-purity' (scoped to src/omniintelligence/nodes) in .pre-commit-config.yaml; node-purity excludes mirror the former io_audit_whitelist file-scoped exemptions (effect-node handlers, __main__ entry points, documented compute exemption). - Repoint the io-audit CI job to run the core node-purity validator with matching excludes. No behavioral regression: both hooks pass clean; audit models still import; fail-closed proof captured. Pin advances to the core merge SHA once omnibase_core#1272 lands. Part of OMN-9048 validator-standardization. * docs(OMN-13283): retarget stale audit links * ci(OMN-13283): align audit selector with core purity hook * fix(OMN-9536): drop legacy routing.feedback bare-topic drain in node_routing_feedback_effect (OmniNode-ai#724) * fix(OMN-9536): drop legacy routing.feedback bare-topic drain The bare topic "routing.feedback" was re-added by OMN-8157 (PR OmniNode-ai#610) as a no-op drain subscription, explicitly gated: "Remove after topic is confirmed empty and purged from Redpanda." Both gating conditions are now met: - No producer emits to the bare topic anywhere across all repos. The omniclaude registration (event_registry.py routing.feedback EventRegistration) fans out to TopicBase.ROUTING_FEEDBACK = onex.evt.omniclaude.routing-feedback.v1 (the canonical topic), not the bare topic. - Live Redpanda probe on 192.168.86.201 across all four lanes (dev, stability-test, prod, judge): bare routing.feedback topic is ABSENT in every lane; canonical onex.evt.omniclaude.routing-feedback.v1 is present. Removes the bare topic from subscribe_topics, the legacy drain dispatch handler + route, handle_legacy_routing_feedback_drain(), the TOPIC_LEGACY_ROUTING_FEEDBACK_BARE constant, and the drain-only test. Updates dispatch-engine handler/route count assertions (baseline 30->29 handlers, 37->36 routes) and removes the legacy topic from the contract-topics expected set. Bumps node_routing_feedback_effect contract 1.2.0 -> 1.2.1. * ci(OMN-9536): use reachable url authority core pin * refactor(OMN-13349): decompose claude hook check extraction (OmniNode-ai#723) * docs(OMN-13455): refresh architecture docs verified against code (OmniNode-ai#725) * chore(deps): update omnibase-core requirement (OmniNode-ai#729) Updates the requirements on [omnibase-core](https://github.com/OmniNode-ai/omnibase_core) to permit the latest version. - [Release notes](https://github.com/OmniNode-ai/omnibase_core/releases) - [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md) - [Commits](OmniNode-ai/omnibase_core@v0.42.0...v0.45.0) --- updated-dependencies: - dependency-name: omnibase-core dependency-version: 0.45.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(OMN-13495): bump actions/checkout from 6 to 7 (OmniNode-ai#728) * chore(deps): bump actions/checkout from 6 to 7 in the actions group Bumps the actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> * test(OMN-13495): align dispatch counts for no-LLM env * fix(OMN-13495): address checkout v7 review hardening --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump pydantic-settings from 2.14.0 to 2.14.2 (OmniNode-ai#731) Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings) from 2.14.0 to 2.14.2. - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.14.0...v2.14.2) --- updated-dependencies: - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * refactor(OMN-13561): remove scattered os.environ endpoint reads from navigation-retriever docs (Wave 1) (OmniNode-ai#734) Epic OMN-13556 Wave 1 (endpoints, OVERLAY seam) for omniintelligence. The url-authority gate flagged three `os.environ["LLM_EMBEDDING_URL"]` / `os.environ["QDRANT_URL"]` reads inside docstring/Field-description text of node_navigation_retriever_effect. These are NOT live env reads — the node is a pure declarative shell and the endpoints are caller-injected via the input model (already the correct DI pattern). The docstring literals were the only thing tripping the env-url-read rule. Reworded to describe overlay/routing- authority resolution without showing a raw env read. This burns down 3 grandfathered url-authority findings (baseline shrink in the paired omnibase_core PR). Gate stays green: 0 new violations. Live integration-endpoint migrations in this repo (QDRANT_URL in the gmail evaluator handler; MEMGRAPH_URI in dispatch_handler_graph_storage) require the sanctioned overlay boundary `omnibase_infra.runtime.overlay.contract_env_ref. expand_contract_env_refs` (OMN-13247). That module is on omnibase_infra dev only — it is NOT in any released tag (latest v0.38.3 lacks it) and omniintelligence pins omnibase-infra <0.38.0. Those migrations are deferred until the resolver ships in a release this repo can pin; vendoring/shimming the resolver is prohibited (duplication of the sanctioned boundary). LLM_*_URL reads are Bifrost-owned (OMN-12803/12815) and out of scope. Wave-1 ticket: OMN-13561. Epic: OMN-13556. * docs(OMN-13570): sanitize omniintelligence documentation (local-env + OMN-XXXX + renames) (OmniNode-ai#735) Removes all local-environment traces and Linear ticket references from the public documentation surface of omniintelligence. Task 1 — local-env sanitization: - deployment/docker/README.md: replace 192.168.86.200 with <onex-host>/ ${ONEX_HOST}, replace ".201" host shorthand with "the runtime host" - README.md: replace "on .201" with "on the runtime host" - CLAUDE.md: replace "on .201" with "on the runtime host" Task 2 — OMN-XXXX ticket ref removal (15 files): - CHANGELOG.md: strip OMN-XXXX from all feat/fix/test/ci prefixes, inline tags, and parenthetical refs across full version history - CLAUDE.md: remove (OMN-12280) dispatch count annotation; rewrite (OMN-2253)/(OMN-2058) API purpose prose; replace TODO(OMN-1234) illustrative code with generic TICKET-123 placeholder - docs/architecture/ONEX_FOUR_NODE_ARCHITECTURE.md: remove (OMN-13455) from last-updated footer - docs/architecture/contract-package-spec.md: remove **Ticket**: OMN-7142 header - docs/INDEX.md: remove (OMN-13455) from status table - docs/reference/NODE_INVENTORY.md: remove (OMN-13455) + (OMN-12280) annotations - docs/reference/EVENT_SURFACE.md: rewrite four OMN-tagged descriptions - docs/reference/DASH_INTEGRATION_TRUTH_BOUNDARY.md: remove (OMN-2366) drain tag - docs/standards/STANDARD_DOC_LAYOUT.md: rename plans/OMN-1757-* example path - deployment/database/FK_SCAN_REPORT.md: remove **Ticket**/**Parent** header fields - scripts/validation/topic_naming_baseline.txt: remove (OMN-3259) from comment - src/omniintelligence/audit/README.md: replace OMN-123/456 in YAML examples - src/omniintelligence/review_pairing/TOPICS.md: remove (OMN-2353) subsystem ref + OMN-2535 reference footer No source code, contracts, or CI yaml touched. Evidence-Ticket: OMN-13570 Evidence-Source: 87fb618f0273a5694123aed70aa25e4f8a3d1953 * chore(ci): propagate normalization-symmetry-hook [bot] (OmniNode-ai#738) Co-authored-by: onex-propagate-bot <bot@omninode.ai> * chore(OMN-13162): bump actions/cache to v6 (OmniNode-ai#740) * chore(deps): bump tuf from 6.0.0 to 7.0.0 (OmniNode-ai#741) Bumps [tuf](https://github.com/theupdateframework/python-tuf) from 6.0.0 to 7.0.0. - [Release notes](https://github.com/theupdateframework/python-tuf/releases) - [Changelog](https://github.com/theupdateframework/python-tuf/blob/develop/docs/CHANGELOG.md) - [Commits](theupdateframework/python-tuf@v6.0.0...v7.0.0) --- updated-dependencies: - dependency-name: tuf dependency-version: 7.0.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump omnibase_core to 0.46.1 (OmniNode-ai#743) * feat(OMN-13802): add Cursor hook event effect (OmniNode-ai#744) * Add Cursor hook-event consumer + agent_source seam Surface the OmniCursor dispatcher backend draft for OmniNode review (ask H.1 of the 2026-06-23 response to OMNICURSOR_DISPATCHER_PLAN), rebased onto current dev (ask H.2). - node_cursor_hook_event_effect: peer of node_claude_hook_event_effect (route_cursor_hook_event), with handler, models, registry and tests - agent_source seam on route_hook_event (defaults to "claude"; additive, Claude path unchanged) threaded onto emitted events - CURSOR_HOOK_EVENT topic + dispatch/wiring/message-type registration Rebase reconciliation against live dev (H.2): - merged DISPATCH_ALIAS_CURSOR_HOOK into __all__ alongside dev's new DISPATCH_OUTCOME_EVALUATED / DISPATCH_WORKER_COMPLETED aliases - corrected the dispatch-engine assertions: with the cursor node wired onto dev's baseline the true counts are 30 handlers / 37 routes (dev's 29/36 + 1 cursor each). The pre-rebase draft asserted 29/36, which only passed by number-collision with dev's cursor-less totals. Verified: full node_claude_hook_event_effect suite + dispatch + cursor + topic/registration tests all green (317 passed) with the W1 omnibase_core cursor models present. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(OMN-13802): add cursor hook event effect * chore(OMN-13802): format cursor hook contract --------- Co-authored-by: andywu42 <awu42@dons.usfca.edu> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(OMN-13877): dep-provenance gate — omniintelligence (+OMN-13878 escape tokens) (OmniNode-ai#745) * feat(OMN-13877): dep-provenance gate — omniintelligence (+OMN-13878 escape tokens) Add the dep-provenance gate (OMN-13873) to omniintelligence: forbid first-party git-source overrides of omnibase-core / omnibase-spi / omnibase-compat in [tool.uv.sources]. Copied verbatim from omnibase_infra: - scripts/check_dep_provenance.py - .github/workflows/dep-provenance-gate.yml - tests/scripts/test_check_dep_provenance.py Wire the check-dep-provenance local hook into .pre-commit-config.yaml. This repo currently violates the gate (omnibase-core rev=, omnibase-spi tag=). Escape-token both existing lines to OMN-13878 so the gate lands green without changing any pin value; the drain of those overrides is tracked by OMN-13878. * test(OMN-13877): allowlist fixture git-rev hashes for detect-secrets The verbatim-copied dep-provenance test fixtures embed example git rev SHAs (omnibase_infra #2184 reproduction + occ-only allow case). This repo's Detect Secrets CI gate flags them as Hex High Entropy Strings. Annotate the three fixture lines with '# pragma: allowlist secret' (comment on an implicitly-concatenated string piece — no behavior change; all 11 tests still pass). omnibase_infra's own secrets baseline already allowlisted these; this repo scans tests/scripts/ so needs the inline mark. * ci(OMN-13875): Quality Gate actually evaluates contract-compliance (OmniNode-ai#746) * ci(OMN-13875): Quality Gate actually evaluates contract-compliance contract-compliance was in quality-gate's needs: but its .result was never read — a decorative dependency, so a Contract Compliance Check failure did not block merge. Read it and fail the gate on failure. Success-or-skipped tolerance only applies to non-gating events; on pull_request/merge_group it always runs, so nothing slips via skipped. quality-gate feeds the required CI Summary (requires quality==success), so the fix propagates. Evidence-Source: workflow-logic fix, no Python touched. * test(OMN-13885): bump handler/route baselines +1 for OMN-13802 cursor-hook OMN-13802 (OmniNode-ai#744) added the cursor-hook event effect: +1 baseline handler (intelligence-cursor-hook-handler) and +1 baseline route (intelligence-cursor-hook-route), plus a new node dir node_cursor_hook_event_effect. The drift-detector baselines were not bumped, turning omniintelligence dev red on Unit Tests -> CI Summary (blocks all dev PRs). Confirmed live counts locally (env -u PYTHONPATH, pinned core rev 5698f6f): - with projection: handler_count=31, route_count=40 - without projection: handler_count=30, route_count=37 Updated: - test_pattern_stored_triggers_projection.py: 30->31 / 39->40 (proj), 29->30 (base) - test_projection_handler_registration.py: 29->30, 36->37 - test_plugin_dispatch.py: 39->40, 30->31 - test_package_installability.py: EXPECTED_NODE_DIRS += node_cursor_hook_event_effect Full tests/unit green (5562+ passed). Unblocks OMN-13875 PR OmniNode-ai#746. * fix(OMN-13887): migrate omniintelligence dispatch off removed core MessageDispatchEngine + repin to PyPI (OMN-13878) (OmniNode-ai#748) omnibase_core removed runtime.runtime_message_dispatch.MessageDispatchEngine in 0.46.x. Migrate the Intelligence runtime onto the canonical successor (omnibase_infra.runtime.message_dispatch_engine.MessageDispatchEngine, the same engine omnimarket uses) via a single envelope-rehydration adapter seam so all ~30 domain handlers stay behavior-preserving and untouched. - dispatch_handlers.py: add _rehydrate_dispatch_envelope + _adapt_context_dispatcher + _register_dispatcher_adapted. The infra engine materializes every envelope to a JSON-safe dict at the dispatch boundary (OMN-1518) and treats a non-None str return as an output topic; the adapter restores a ModelEventEnvelope view (payload/correlation_id/event_type/timestamp from __debug_trace) and normalizes status-sentinel returns ("ok"/"skip"/...) to None. - plugin.py + dispatch_handlers.py: register_handler->register_dispatcher, handler_count->dispatcher_count, result.handler_id->result.dispatcher_id. - add tests/unit/runtime/test_dispatch_envelope_adapter.py (12 cases) covering the new boundary seam. - pyproject/uv.lock: repin omnibase-core 0.46.3 + omnibase-spi 0.23.1 from PyPI, bump infra to the core-0.46 dev rev, delete both raw-override-ok:OMN-13878 tokens and the core/spi git sources; ceilings <0.47.0 / <0.24.0. Closes the omniintelligence lane of OMN-13878 (4/4 token-free). Full CI-scoped suite (tests/ --ignore=tests/integration, matching ci.yml): 5675 passed, 0 failed. The 12 integration failures + e2e errors reproduce identically on clean origin/dev (service/pytest-asyncio, excluded from CI) — no regression. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: onex-propagate-bot <bot@omninode.ai> Co-authored-by: andywu42 <awu42@dons.usfca.edu> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * chore(deps): bump omnibase_core to 0.46.4 Automated dependency cascade from OmniNode-ai/omnibase_core release v0.46.4. Triggered-by: https://github.com/OmniNode-ai/omnibase_core/actions/runs/28660603530 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: onex-propagate-bot <bot@omninode.ai> Co-authored-by: andywu42 <awu42@dons.usfca.edu> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ticketed replacement for Dependabot PR #726, carrying the same head commit from
dependabot/OMN-13495/github-actions-checkout-v7so receipt-gate identity can bind to OMN-13495.Original PR: #726
Evidence-Ticket: OMN-13495
Evidence-Source: a9b0e80f9a6379d8b3dfb76d9def5fb9d4f7c427
Summary by CodeRabbit