release(OMN-12816): promote SEA runtime infra fixes to main

.github/actions/emit-runner-identity/action.yml

@@ -0,0 +1,66 @@
+name: 'Emit runner image identity'
+description: >-
+  Emit the bound runner image identity (OMN-12567) as job startup evidence. The identity is a binding — image digest + dependency manifest + Python version + uv version + shared-env version — not a human label. Surfacing it in every job makes image-drift debugging deterministic instead of guesswork.
+author: 'OmniNode'
+inputs:
+  lock-file:
+    description: 'Path to the bound runner image identity lock file.'
+    required: false
+    default: 'docker/runners/runner-image.lock.json'
+  working-directory:
+    description: 'Working directory containing the repo checkout.'
+    required: false
+    default: '.'
+runs:
+  using: 'composite'
+  steps:
+    - name: Emit runner image identity
+      id: emit_runner_identity
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        OMNI_RUNNER_LOCK_FILE: ${{ inputs.lock-file }}
+      run: |
+        set -euo pipefail
+        if [[ -n "${pythonLocation:-}" && -x "${pythonLocation}/bin/python" ]]; then
+          python_bin="${pythonLocation}/bin/python"
+        else
+          python_bin="$(command -v python3)"
+        fi
+
+        if [[ ! -f "${OMNI_RUNNER_LOCK_FILE}" ]]; then
+          echo "::warning::runner image lock file not found: ${OMNI_RUNNER_LOCK_FILE}; skipping identity emission"
+          exit 0
+        fi
+
+        evidence="$(
+          PYTHONPATH="scripts/ci" "${python_bin}" \
+            scripts/ci/runner_image_identity.py \
+            --lock-file "${OMNI_RUNNER_LOCK_FILE}" \
+            --mode emit
+        )"
+
+        echo "runner image identity (startup evidence): ${evidence}"
+        echo "runner_image_identity=${evidence}" >> "${GITHUB_OUTPUT}"
+        echo "OMNI_RUNNER_IMAGE_IDENTITY_EVIDENCE=${evidence}" >> "${GITHUB_ENV}"
+
+        # The image baked into the running container (if any) must match the
+        # committed lock identity; surface a mismatch loudly without failing the
+        # job, so drift is visible in the step summary.
+        baked="${OMNI_RUNNER_IMAGE_IDENTITY:-}"
+        recorded="$("${python_bin}" -c 'import json,os; print(json.load(open(os.environ["OMNI_RUNNER_LOCK_FILE"]))["identity_digest"])')"
+        if [[ -n "${baked}" && "${baked}" != "unbound" && "${baked}" != "${recorded}" ]]; then
+          echo "::warning::runner image identity drift: baked=${baked} recorded=${recorded}"
+        fi
+
+        {
+          echo "### Runner image identity (OMN-12567)"
+          echo ""
+          echo '```json'
+          echo "${evidence}"
+          echo '```'
+          if [[ -n "${baked}" && "${baked}" != "unbound" ]]; then
+            echo ""
+            echo "- baked image identity: \`${baked}\`"
+          fi
+        } >> "${GITHUB_STEP_SUMMARY}"

.github/actions/setup-python-uv/action.yml

@@ -41,43 +41,127 @@ inputs:
   sync-attempts:
     description: 'Maximum uv sync attempts before failing'
     required: false
-    default: '3'
+    default: '5'
   sync-retry-delay-seconds:
     description: 'Base delay in seconds between uv sync retries'
     required: false
     default: '10'
+  github-token:
+    description: >-
+      Token used to authenticate uv git+https dependency fetches against github.com. Defaults to the workflow GITHUB_TOKEN, which authenticates same-org public-repo fetches and lifts them above the anonymous rate limit. Override with `secrets.CROSS_REPO_PAT` for private cross-repo deps.
+    required: false
+    default: ${{ github.token }}
+  shared-env-enabled:
+    description: >-
+      Use the host-local immutable CI environment cache. "auto" enables it only when OMNI_CI_SHARED_ENV_ENABLED=true in the workflow environment.
+    required: false
+    default: 'auto'
+  shared-env-root:
+    description: Host-local root for immutable CI environments.
+    required: false
+    default: '/home/runner/.cache/omni/ci-envs'
+  shared-env-install-args:
+    description: Arguments used when building the immutable shared CI env.
+    required: false
+    default: '--frozen --all-extras --all-groups --no-install-project'
 runs:
   using: 'composite'
   steps:
+    - name: Resolve shared CI env mode
+      id: shared_env_mode
+      shell: bash
+      env:
+        SHARED_ENV_ENABLED: ${{ inputs.shared-env-enabled }}
+      run: |
+        case "${SHARED_ENV_ENABLED}" in
+          true)
+            enabled=true
+            ;;
+          false)
+            enabled=false
+            ;;
+          auto)
+            if [ "${OMNI_CI_SHARED_ENV_ENABLED:-false}" = "true" ]; then
+              enabled=true
+            else
+              enabled=false
+            fi
+            ;;
+          *)
+            echo "::error::shared-env-enabled must be true, false, or auto"
+            exit 2
+            ;;
+        esac
+        echo "enabled=${enabled}" >> "$GITHUB_OUTPUT"
+        echo "shared CI env enabled: ${enabled}"
     - name: Set up Python
-      uses: actions/setup-python@v5
+      if: steps.shared_env_mode.outputs.enabled != 'true'
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ inputs.python-version }}
     - name: Install uv
+      if: steps.shared_env_mode.outputs.enabled != 'true'
       uses: astral-sh/setup-uv@v7
       with:
         version: ${{ inputs.uv-version }}
         enable-cache: ${{ inputs.cache-enabled != 'false' }}
+    - name: Prepare shared CI env
+      if: steps.shared_env_mode.outputs.enabled == 'true' && inputs.skip-install != 'true'
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        OMNI_CI_ENV_ROOT: ${{ inputs.shared-env-root }}
+        OMNI_CI_REPO: omnibase_infra
+        OMNI_CI_ENV_INSTALL_ARGS: ${{ inputs.shared-env-install-args }}
+        PYTHON_VERSION: ${{ inputs.python-version }}
+        UV_VERSION: ${{ inputs.uv-version }}
+        GIT_FETCH_TOKEN: ${{ inputs.github-token }}
+      run: |
+        "${GITHUB_ACTION_PATH}/../../../scripts/ci/ensure_ci_env.sh"
     - name: Load cached uv
-      if: inputs.cache-enabled != 'false'
+      if: steps.shared_env_mode.outputs.enabled != 'true' && inputs.cache-enabled != 'false'
       uses: actions/cache@v4
       with:
         path: ~/.cache/uv
         key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-${{ inputs.python-version }}-${{ hashFiles(inputs.lock-file-path) }}-${{ inputs.cache-version }}
         restore-keys: |
           ${{ inputs.cache-key-prefix }}-${{ runner.os }}-${{ inputs.python-version }}-${{ inputs.cache-version }}-
     - name: Install dependencies
-      if: inputs.skip-install != 'true'
+      if: steps.shared_env_mode.outputs.enabled != 'true' && inputs.skip-install != 'true'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
       env:
         CACHE_ENABLED: ${{ inputs.cache-enabled }}
         INSTALL_ARGS: ${{ inputs.install-args }}
         UV_SYNC_ATTEMPTS: ${{ inputs.sync-attempts }}
         UV_SYNC_RETRY_DELAY_SECONDS: ${{ inputs.sync-retry-delay-seconds }}
+        GIT_FETCH_TOKEN: ${{ inputs.github-token }}
       run: |
         export UV_HTTP_TIMEOUT="${UV_HTTP_TIMEOUT:-600}"
+        export UV_CONCURRENT_DOWNLOADS="${UV_CONCURRENT_DOWNLOADS:-1}"
+        export UV_CONCURRENT_BUILDS="${UV_CONCURRENT_BUILDS:-1}"
+        export UV_CONCURRENT_INSTALLS="${UV_CONCURRENT_INSTALLS:-1}"
+        export UV_TORCH_BACKEND="${UV_TORCH_BACKEND:-cpu}"
         git config --global http.version HTTP/1.1
+        # Treat a stalled transfer (0 bytes/s) as a failure rather than hanging
+        # indefinitely, so the retry loop below can recover. (OMN-12529)
+        git config --global http.lowSpeedLimit 0
+        git config --global http.lowSpeedTime 999999
+        # Authenticate uv's internal git+https fetches. Anonymous github.com
+        # requests are rate-limited (60/hr); many parallel --no-cache syncs from
+        # one runner egress IP trip "Empty reply from server". Authenticated
+        # requests get 5000/hr. uv shells out to `git fetch`, which inherits the
+        # GIT_CONFIG_* env vars below — a process-scoped insteadOf rewrite that
+        # never writes the token to a persistent gitconfig on the self-hosted
+        # runner. (OMN-12432)
+        if [ -n "${GIT_FETCH_TOKEN}" ]; then
+          export GIT_CONFIG_COUNT=1
+          export GIT_CONFIG_KEY_0="url.https://x-access-token:${GIT_FETCH_TOKEN}@github.com/.insteadOf"
+          export GIT_CONFIG_VALUE_0="https://github.com/"
+          echo "git github.com fetches: authenticated (x-access-token)"
+        else
+          echo "::warning::github-token not provided; uv git fetches stay anonymous and may be rate-limited"
+        fi
         read -r -a install_args <<< "$INSTALL_ARGS"
         sync_attempts="${UV_SYNC_ATTEMPTS}"
         retry_delay_seconds="${UV_SYNC_RETRY_DELAY_SECONDS}"
@@ -98,6 +182,7 @@ runs:
         echo "UV_HTTP_TIMEOUT=${UV_HTTP_TIMEOUT:-<unset>}"
         echo "UV_CONCURRENT_DOWNLOADS=${UV_CONCURRENT_DOWNLOADS:-<unset>}"
         echo "UV_CONCURRENT_BUILDS=${UV_CONCURRENT_BUILDS:-<unset>}"
+        echo "UV_TORCH_BACKEND=${UV_TORCH_BACKEND:-<unset>}"
         echo "UV_NO_CACHE=${UV_NO_CACHE:-<unset>}"
 
         sync_cmd=(uv sync)
@@ -120,3 +205,36 @@ runs:
           sleep "$sleep_seconds"
           attempt=$((attempt + 1))
         done
+    - name: Emit runner image identity
+      # OMN-12567: every job that prepares Python emits the bound runner image
+      # identity as startup evidence so image-drift debugging is deterministic.
+      # The action-relative path makes this work for both same-repo and
+      # cross-repo (subdir) checkout layouts.
+      shell: bash
+      run: |
+        set -euo pipefail
+        scripts_ci="${GITHUB_ACTION_PATH}/../../../scripts/ci"
+        lock_file="${GITHUB_ACTION_PATH}/../../../docker/runners/runner-image.lock.json"
+        if [[ ! -f "${lock_file}" ]]; then
+          echo "::warning::runner image lock file not found at ${lock_file}; skipping identity emission"
+          exit 0
+        fi
+        if [[ -n "${pythonLocation:-}" && -x "${pythonLocation}/bin/python" ]]; then
+          python_bin="${pythonLocation}/bin/python"
+        else
+          python_bin="$(command -v python3)"
+        fi
+        evidence="$(
+          PYTHONPATH="${scripts_ci}" "${python_bin}" \
+            "${scripts_ci}/runner_image_identity.py" \
+            --lock-file "${lock_file}" --mode emit
+        )"
+        echo "runner image identity (startup evidence): ${evidence}"
+        echo "OMNI_RUNNER_IMAGE_IDENTITY_EVIDENCE=${evidence}" >> "${GITHUB_ENV}"
+        {
+          echo "### Runner image identity (OMN-12567)"
+          echo ""
+          echo '```json'
+          echo "${evidence}"
+          echo '```'
+        } >> "${GITHUB_STEP_SUMMARY}"

.github/codeql/codeql-config.yml

@@ -0,0 +1,9 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+name: omnibase-infra-codeql
+paths:
+  - src
+  - scripts
+  - tests
+paths-ignore:
+  - .github/**

.github/workflows/artifact-reconciliation-webhook.yml

@@ -43,14 +43,15 @@ jobs:
         with:
           separator: ","
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
+      - name: Set up CI Python environment
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: ./.github/actions/setup-python-uv
         with:
           python-version: "3.12"
-
-      - name: Install dependencies
-        run: |
-          pip install --quiet confluent-kafka pydantic click
+          cache-key-prefix: uv-pr-webhook
+          cache-enabled: "false"
+          install-args: --frozen
+          shared-env-enabled: "true"
 
       - name: Publish PR webhook event
         if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
@@ -70,7 +71,7 @@ jobs:
           PR_MERGED: ${{ github.event.pull_request.merged }}
           PR_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
         run: |
-          python scripts/publish_pr_webhook_event.py \
+          uv run python scripts/publish_pr_webhook_event.py \
             --action "$PR_ACTION" \
             --repo "$PR_REPO" \
             --pr-number "$PR_NUMBER" \

.github/workflows/attest-source-hash.yml

@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
         with:
           persist-credentials: false
 

.github/workflows/build-and-push-runtime.yml

@@ -42,8 +42,19 @@ env:
   PYTHON_VERSION: "3.12"
 
 jobs:
+  # OMN-12626 (R1): refuse to build the prod-bound runtime image unless the
+  # source tree is clean AND HEAD is a promoted origin/main commit. This runs
+  # on push to main (the promoted ref), so a real main build passes and a
+  # dirty/dev-only build fails closed before any image is built or pushed.
+  lineage-guard:
+    name: Prod promotion lineage guard
+    uses: ./.github/workflows/prod-promotion-lineage.yml
+    with:
+      enforce_lineage: true
+
   build-and-push:
     name: Build and push runtime image
+    needs: lineage-guard
     permissions:
       id-token: write
       contents: read

.github/workflows/call-receipt-gate.yml

@@ -30,3 +30,16 @@ permissions:
 jobs:
   verify:
     uses: OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml@main
+    with:
+      branch-policy-mode: >-
+        ${{
+          github.event.pull_request.base.ref == 'main'
+          && 'main-release'
+          || github.event.merge_group.base_ref == 'refs/heads/main'
+          && 'main-release'
+          || github.event.pull_request.base.ref == 'dev'
+          && 'dev-preflight'
+          || github.event.merge_group.base_ref == 'refs/heads/dev'
+          && 'dev-preflight'
+          || 'legacy'
+        }}

.github/workflows/check-handshake.yml

@@ -19,7 +19,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 5
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repo