chore(OMN-16351): bump dev to 0.38.8 after v0.38.7 publish (release-identity gate root fix) by jonahgabriel · Pull Request #2833 · OmniNode-ai/omnibase_infra

jonahgabriel · 2026-08-21T13:41:36Z

Summary

v0.38.7 was published to PyPI at 2026-08-21T12:48:44Z while origin/dev pyproject.toml still read 0.38.7.
The OMN-13412 strict release-identity fitness gate ("No code merged onto a published version without a bump") requires pyproject.toml to be strictly ahead of the latest published version. With dev still on 0.38.7, the gate deterministically fails "packaged source changed but version NOT ahead of latest published" on every infra PR touching packaged source whose CI started after 12:48:44Z — a uniform dev-wide block, not a per-PR defect.
Root fix: bump dev to 0.38.8 in pyproject.toml (+ uv.lock regenerated via uv lock), mirroring the identical prior remediation in e013b5dcb (OMN-16076, 0.38.6 -> 0.38.7).

Cites OMN-16351 and OMN-13412. This is the single root fix for the uniform multi-PR block; do not apply per-PR workarounds — this PR unblocks all of them once merged.

Test plan

uv lock regenerated uv.lock in place (only the omnibase-infra version entry changed)
pre-commit run --all-files — all applicable hooks passed (including "No code merged onto a published version without a bump (OMN-13412)")
Governed impacted-test selector escalated to the full suite (version-bump touches packaged source broadly) — 23575 passed, 40 skipped in 709.03s

Evidence-Ticket: OMN-16351
Evidence-Source: OCC#6830

…dentity gate root fix) v0.38.7 published to PyPI 2026-08-21T12:48:44Z while origin/dev pyproject.toml still read 0.38.7. The OMN-13412 strict release-identity fitness gate requires pyproject to be strictly ahead of the latest published version, so it deterministically fails "packaged source changed but version NOT ahead of latest published" on every infra PR touching packaged source whose CI started after 12:48:44Z. This is a uniform dev-wide block, not a per-PR issue. Root fix: bump dev to 0.38.8 (pyproject.toml + uv.lock via `uv lock`), mirroring the prior remediation in e013b5d (OMN-16076, 0.38.6 -> 0.38.7).

coderabbitai · 2026-08-21T13:41:46Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your current included review allowance is based on your included PR review attempts over the past 7 days.

Next review available in: 14 minutes

Limit details: You’ve used the included review currently available. Your 117 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bb7dcd5c-5ed0-4293-8e0b-2ce81759fbd4

📥 Commits

Reviewing files that changed from the base of the PR and between 6d5ea5b and 14f6f08.

⛔ Files ignored due to path filters (1)

uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

docker/runners/runner-image.lock.json
pyproject.toml

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-21T13:49:42Z

✅ Hostile Reviewer — PASSED

Blocking findings (critical): 0
Total findings: 0
Models succeeded: qwen3-review,qwen3-review-b

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
`passed`	No critical findings	No
`blocked`	CRITICAL findings found	Yes
`degraded`	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8468/OMN-8524)

#6830) * evidence: OCC companion pass 1 for OmniNode-ai/omnibase_infra#2833 * evidence: OCC companion self-bind for #6830 --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai>

…8 lock uv.lock content changed with the 0.38.7 -> 0.38.8 version bump, which invalidates the recorded shared_env_digest fingerprint in docker/runners/runner-image.lock.json. Regenerated via scripts/ci/runner_image_identity.py --mode generate to unblock runner-image-build-smoke and the Tests split jobs that assert identity parity (test_runner_image_identity.py).

jonahgabriel · 2026-08-21T15:55:31Z

Heads-up from the OMN-16355 lane (PR #2834): this PR and #2834 are deadlocked on each other, and #2834 now carries the 0.38.8 bump to break the cycle.

The cycle: #2833 is blocked by Lockfile CVE Scan (OMN-16228), which is red on every infra PR because of the click 8.3.1 / kafka-python 2.3.0 CVEs. #2834 is the fix for that scan — but #2834 touches pyproject.toml, which trips the local check-release-identity hook (pass_filenames: false, no --base, so it always enforces version-ahead and fails on unmodified dev today). So #2833 can't land without #2834's fix, and #2834 couldn't be committed without #2833's bump.

Resolution: #2834 folds in 0.38.7 -> 0.38.8 (pyproject + the omnibase-infra entry in uv.lock), byte-identical to this PR's diff. Once #2834 merges, this PR is redundant — its diff will already be on dev and it should be closed rather than rebased. Flagging rather than closing it myself since it isn't my lane; if you'd rather keep the bump here and strip it from #2834, say so and I'll drop it, but note that only works if #2834 lands first, which is the thing this cycle prevents.

Current status of #2834: locally proven (gate exit 1 -> 0 with the pinned osv-scanner v2.5.1; 23575 tests passed via the governed pre-push selector; mypy --strict clean), CI blocked only by the runner-fleet disk exhaustion that runner-fleet-diag-1 is actively reclaiming. No action needed here until that clears.

…on) reddening every infra PR (#2834) * fix(OMN-16355): clear the 3 blocking lockfile CVEs reddening every infra PR Lockfile CVE Scan (OMN-16228) went required and is RED on every open PR -- a fleet-wide merge blocker. The scanner is correct; the lockfile is genuinely vulnerable. Raise the floors past the fixed versions and relock. Blocking findings cleared (osv-scanner v2.5.1 -> check_lockfile_cve): click 8.3.1 PYSEC-2026-2132 / CVE-2026-7246 / GHSA-47fr-3ffg-hgmw HIGH (gate-computed CVSS 7.2). Command injection in click.edit(): the editor command was handed to subprocess with shell=True. Fixed in 8.3.3 (shlex.split into an argv list, shell=True dropped). kafka-python 2.3.0 PYSEC-2026-2190 / CVE-2026-10142 DoS: 4-byte protocol frame length used unvalidated -> multi-GB allocation, or an uncaught ValueError that wedges the connection. kafka-python 2.3.0 PYSEC-2026-2191 / CVE-2026-10143 DoS: broker-supplied SCRAM iteration count passed straight to hashlib.pbkdf2_hmac() -> frozen client event loop, consumer-group eviction. Both kafka-python advisories are fixed in 2.3.2 (upstream #3019 frame-size validation + #3026 SCRAM iteration validation). They classify as UNKNOWN rather than HIGH because they carry only a CVSS_V4 vector and the gate parses CVSS_V3* only -- they still block via the intended fail-closed "UNKNOWN + fix-available -> BLOCK" rule. Left alone deliberately: narrowing that rule would turn these two into report-only, i.e. fail-open. Resolution: click 8.3.1 -> 8.4.2, kafka-python 2.3.0 -> 2.3.2. The lock diff moves exactly those two packages. kafka-python ceiling tightened 4.0.0 -> 3.0.0 deliberately. 3.0.0 is a breaking major: producer defaults flip to enable_idempotence=True/acks='all', consumer session_timeout_ms 10s->45s, api_version_auto_timeout_ms renamed to bootstrap_timeout_ms, Serializer/Partitioner signatures changed, KafkaError no longer subclasses RuntimeError, NoBrokersAvailableError removed, kafka.sasl -> kafka.net.sasl, kafka.client_async/kafka.conn deleted. Our kafka-python surface is scripts/deploy-agent/ (KafkaProducer/KafkaConsumer on the live deploy control bus) plus one integration test; the runtime itself is on aiokafka, untouched here. Verified on 2.3.2 that every kwarg the deploy-agent passes still exists, poll(timeout_ms=) is intact, and producer defaults are unchanged (enable_idempotence=False, acks=1) -- exactly the semantics 3.0 would have flipped under a live control bus. A 3.x migration is its own change with its own proof, not a rider on a CVE unblock. click took no ceiling change: no ParamType/Parameter subclassing in this repo, so 8.4.0's typing rework does not reach us. mypy --strict clean over 2813 files. Also carries the 0.38.7 -> 0.38.8 bump. The local check-release-identity hook (pass_filenames: false, no --base) always enforces version-ahead and fails on unmodified dev today, and this diff touches pyproject.toml so it fires here. The dedicated bump PR (#2833, OMN-16351) cannot land first -- it is itself blocked by this very Lockfile CVE Scan. Folding the bump in breaks the cycle; #2833 becomes redundant. CI's own release-identity check (--base origin/dev) was already exempt for this diff (no src/** change). Evidence: before: 3 blocking findings, gate exit 1 after: 0 blocking findings, gate exit 0 (4 MEDIUM/LOW report-only remain: h2 4.3.0 x2, pygments 2.19.2 x2 -- correctly non-blocking) 496 passed CLI/click test surface; 198 passed deploy-agent unit mypy --strict clean; ruff clean; pre-commit clean on the real file scope kafka -m marker, serial, vs an origin/dev baseline worktree: branch 13F/67P vs baseline 14F/66P -- identical failure set minus one, all pre-existing .201 dev-lane-not-running failures, none introduced here Fixes OMN-16355 Refs OMN-16228, OMN-16170, OMN-16351 * chore(OMN-16355): regenerate runner-image shared_env_digest for click/kafka-python bump uv.lock content changed with the click 8.3.1 -> 8.4.2 and kafka-python 2.3.0 -> 2.3.2 CVE-fix bump, which invalidates the recorded shared_env_digest fingerprint in docker/runners/runner-image.lock.json. Regenerated via scripts/ci/runner_image_identity.py --mode generate to unblock runner-image-build-smoke and the Tests split jobs that assert identity parity (test_runner_image_identity.py) -- same root cause and fix as OMN-16351 / omnibase_infra#2833 hit after its own uv.lock change.

jonahgabriel · 2026-08-21T18:47:35Z

Superseded — 0.38.8 bump folded into #2834 to break the circular CVE-gate block (OMN-16355/OMN-16351).

jonahgabriel · 2026-08-21T18:49:14Z

Superseded: #2834 (OMN-16355) landed the same 0.38.7 -> 0.38.8 dev bump as part of its CVE fix (merge commit 87fdd1a), including the runner-image-identity regeneration this PR needed. Closing to avoid a duplicate/conflicting version bump — OMN-16351's release-identity root-fix goal is satisfied by that merge.

github-actions Bot enabled auto-merge (squash) August 21, 2026 13:43

onexbot-occ-writer Bot mentioned this pull request Aug 21, 2026

evidence(OMN-16351): OCC companion for OmniNode-ai/omnibase_infra#2833 OmniNode-ai/onex_change_control#6830

Merged

jonahgabriel mentioned this pull request Aug 21, 2026

fix(OMN-16355): clear the 3 blocking lockfile CVEs (click, kafka-python) reddening every infra PR #2834

Merged

jonahgabriel closed this Aug 21, 2026

auto-merge was automatically disabled August 21, 2026 18:47
Pull request was closed

jonahgabriel mentioned this pull request Aug 21, 2026

fix(OMN-16351): backmerge main lineage into dev — restore ancestry for release-synced main #2832

Closed

jonahgabriel mentioned this pull request Sep 24, 2026

fix(OMN-19375): the rebuild classifier counts all installed source and exempts an inert version bump #4057

Merged

7 tasks done

Navigation Menu

Repository navigation

chore(OMN-16351): bump dev to 0.38.8 after v0.38.7 publish (release-identity gate root fix) - #2833

chore(OMN-16351): bump dev to 0.38.8 after v0.38.7 publish (release-identity gate root fix)#2833
jonahgabriel wants to merge 2 commits into
devfrom
jonah/omn-16351-bump-0388

jonahgabriel commented Aug 21, 2026 •

edited by onexbot-occ-writer Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 21, 2026 •

edited

Loading

Review limit reached

Uh oh!

github-actions Bot commented Aug 21, 2026

Uh oh!

jonahgabriel commented Aug 21, 2026

Uh oh!

jonahgabriel commented Aug 21, 2026

Uh oh!

jonahgabriel commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jonahgabriel commented Aug 21, 2026 • edited by onexbot-occ-writer Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

coderabbitai Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Aug 21, 2026

✅ Hostile Reviewer — PASSED

Uh oh!

jonahgabriel commented Aug 21, 2026

Uh oh!

jonahgabriel commented Aug 21, 2026

Uh oh!

jonahgabriel commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jonahgabriel commented Aug 21, 2026 •

edited by onexbot-occ-writer Bot

Loading

coderabbitai Bot commented Aug 21, 2026 •

edited

Loading