Skip to content

chore(deps): bump OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml from 0.47.1 to 0.47.3 - #3308

Merged
jonahgabriel merged 2 commits into
devfrom
dependabot/github_actions/OmniNode-ai/omnibase_core/dot-github/workflows/receipt-gate.yml-0.47.3
Sep 8, 2026
Merged

chore(deps): bump OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml from 0.47.1 to 0.47.3#3308
jonahgabriel merged 2 commits into
devfrom
dependabot/github_actions/OmniNode-ai/omnibase_core/dot-github/workflows/receipt-gate.yml-0.47.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 8, 2026

Copy link
Copy Markdown
Contributor

Bumps OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml from 0.47.1 to 0.47.3.

Release notes

Sourced from OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml's releases.

v0.47.3

What's Changed

Full Changelog: OmniNode-ai/omnibase_core@v0.47.2...v0.47.3

v0.47.2

What's Changed

New Contributors

Full Changelog: OmniNode-ai/omnibase_core@v0.47.1...v0.47.2

What's Changed

... (truncated)

Changelog

Sourced from OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml's changelog.

v0.47.6 (2026-09-06)

Changes

  • docs no public prose in this repository names the private knowledge base (#1660). One README.md paragraph named a private repository, enumerated its contents and stated that teammates have access; it is deleted, since the public knowledge-base links beside it already serve the reader. The same phrasing had reached twenty other sites: fourteen shipped src/ docstrings that go out inside the published wheel and each pointed at a generation-provenance record the reader cannot reach (seven also cited an internal memory slug), architecture-handshakes/check-policy-gate.sh which printed a private destination into PUBLIC CI logs on failure, .github/CONTRIBUTING.md, CLAUDE.md's documentation map, and three changelog entries. Each now states that the record is not part of this repository and cites the ticket. Text only: no test, script or gate resolves any of it. The version moves because fourteen of the edited files are packaged source, so the wheel bytes change and the release-identity gate correctly refuses new packaged code on an already-published version — a docstring is shipped code.

v0.47.5 (2026-09-06)

Features

  • feat register the seven standalone projection-writer runtime profiles. projection-writer-{delegation,hook-ledger,live-events,registration,savings,tenant-credentials,tenant-registry} join both REGISTERED_RUNTIME_PROFILES and CONSUMER_ATTACHED_RUNTIME_PROFILES. Seven Deployments already run on onex-dev under these RUNTIME_PROFILE values; until now no registry knew them and no contract could declare them, so each writer's contract was also claimed by a shared runtime (two by effects, five by main via the undeclared-defaults-to-main rule) and two processes drained the same subscriptions under different consumer groups. Registration is what makes the ownership claim single-valued. Consumer-attachment is measured, not assumed: every one of the seven joined its group and holds a broker-issued partition assignment. Additive — no existing name changes meaning.

v0.47.4 (2026-09-06)

Changes

  • fix a def-B single-emit terminal no longer reads as a foreign run's terminal (#1655). v0.47.3 (#1645) armed the terminal correlation predicate in host mode as well as client mode, and the predicate required the terminal to declare this run's correlation id and nothing else. The canonical def-B terminal is the handler's bare domain model, published verbatim by LocalRuntimeBusAdapter on the single-emit path (result.model_dump_json()) — handle(request: ModelX) -> ModelY has no envelope and therefore no field in which to carry a correlation id. It declared nothing, so every def-B ORCHESTRATOR run through RuntimeLocal._run_event_driven recorded its own terminal as foreign, discarded it, and timed out. The predicate now judges a terminal that declares NO correlation on its shape: a bare domain payload is this run's own; an ENVELOPE that names nobody stays refused; and once anything is declared, every declared id must still be this run's, so the isolation boundary #1645 added is unchanged. Core's own event-driven coverage stamped a correlation id into a hand-built dict, which is why this repo stayed green while every downstream def-B node broke.

v0.47.3 (2026-09-05)

Features

  • feat typed store-resolved credential carrier on the deployment topology database binding, plus the tenant-projection runtime profile (#1648). ModelDeploymentTopologyDatabaseBinding now declares exactly ONE credential carrier per binding: dsn_env (legacy — a process env var holding the DSN) or secret_ref (a dotted logical secret name the runtime resolves through SecretResolver at the binding boundary). Both-set and neither-set are rejected by a model validator that names the offending principal either way; neither field is defaulted. tenant-projection is registered in REGISTERED_RUNTIME_PROFILES and in CONSUMER_ATTACHED_RUNTIME_PROFILES — it is one consolidated writer process owning every TENANT-domain projection contract, because it is the only process holding that binding's store-resolved credential. Additive: existing dsn_env bindings are unchanged.
  • feat give omnibase_core a lab host table so heavy pre-push escalations can leave the launching host (#1635), and add the hcloud EC2 overflow row while making the host-identity refusal proofs host-independent (#1640).

Changes

  • fix backend_secret_discipline no longer accepts api_key_env as a logical secret reference (#1649). An env-var name is a carrier, not a logical secret name; accepting it let a raw env credential pass a check that exists to force store resolution.
  • fix let a non-owner actor push through the governed pre-push dispatcher (#1642).
  • fix core vendored provenance record + the registry-root half of the picker (#1650), and port the zero-collected-tests refusal — a remote pre-push run that collected zero tests is no evidence, not a pass (#1647). A remote selector run that collected nothing now fails closed instead of reporting a green it never earned.
  • fix carry the pytest execution policy across the pre-push remote dispatch seam (#1643) — 3:36:06 to 1:32:51 on h105.
  • fix arm the terminal correlation predicate in host mode and stop reading a missing status as success (#1645).
  • fix arm omnibase_core auto-merge with the org PAT so dev push workflows fire (#1646).
  • fix scope the core release App token for workflows (#1638); the release main-sync pushes as onexbot-occ-writer, not github-actions[bot] (#1637).
  • fix remove a dead async autouse fixture that errors on pytest 9.1 + wire an async-fixture-decorator gate (#1636).
  • chore move this repository's prose documentation to the OmniNode knowledge base and flip the KB doc gate to mode: strict (#1644). 199 markdown files outside the gate's allowed set are gone: 113 to the public knowledge base, 37 to the internal one, 47 deleted as stubs or dated artifacts, and CONTRIBUTING.md/CODE_OF_CONDUCT.md moved under .github/. No public API changes; the packaged tree changes only in that the eight generated validators no longer ship a GENERATION_PROVENANCE.md beside them, and their docstrings now cite that record in the knowledge base instead.
  • ci require the KB doc gate on omnibase_core PRs (#1639).
  • chore(deps) bump the actions group with 2 updates.

v0.47.0 (2026-08-29)

Breaking Changes

  • bump omnibase_core to v0.47.0 — ModelWidgetConfigStatusGrid.status_colors is removed (#1612). The field carried a Mapping[str, str] of raw hex colours in the config's own default, which is the decision the theme contract exists to make; it is replaced by severity_roles: tuple[ModelSeverityRole, ...] naming theme tokens, and colours now resolve through the active theme instance. The model is extra="forbid", so any caller still passing status_colors= raises. Minor bump per pre-1.0 semver convention for a breaking public-API deletion.

  • ModelEventEnvelope now declares extra="forbid" (#1611). extra was previously undeclared on this model, so Pydantic's "ignore" default applied and any undeclared keyword was silently discarded at construction. Constructing the envelope with a keyword it does not declare now raises ValidationError ... [type=extra_forbidden] instead. This half of #1611 is not additive and is the reason v0.47.0 is a breaking release for envelope producers, independent of the status_colors deletion above.

    Who this breaks: any producer passing a keyword ModelEventEnvelope does not declare. The declared set is payload, envelope_id, envelope_timestamp, correlation_id, source_tool, target_tool, metadata, security_context, event_type, payload_type, payload_schema_version, priority, timeout_seconds, retry_count, request_id, trace_id, span_id, tenant_id, onex_version, envelope_version.

    Migration: producer identity belongs in the long-declared source_tool field — source= was never a field on this model and was being dropped on every call before 0.47.0. Rename source= to source_tool=. There is no source_version field; the envelope's version fields are onex_version, envelope_version, and payload_schema_version. Measured blast radius on the first consumer to resolve 0.47.0 (omnibase_infra): 11 production call sites and 138 failing tests, all one signature.

    Why it is correct anyway: silently discarding a producer's attribution is the failure class #1611 was opened to close, and extra="forbid" is mandatory on every model in this repo (enforced by omnibase_core.validators.pydantic_extra_forbid). 0.47.0 does not create the data loss — it converts a silent loss into a loud failure.

Features

  • feat theme instances + theme catalog — ModelThemeInstance, ModelThemeCatalog, ModelThemeCatalogEntry, ModelThemeActivation, util_theme_catalog, and the onex.theme.{light,dark,warm} 1.0.0 theme contracts (#1608)

... (truncated)

Commits
  • 839e5d5 chore(OMN-17556): describe the real contents of the v0.47.3 release in the ch...
  • f6a7a1b fix(OMN-17280): let a non-owner actor push through the governed pre-push disp...
  • 9b32438 fix(OMN-17754): core vendored provenance record + the registry-root half of t...
  • 05e1845 fix(OMN-17931): backend_secret_discipline no longer accepts api_key_env as a ...
  • aabb0b5 feat(OMN-17556): typed store-resolved credential carrier on the topology DB b...
  • e0ea349 fix(OMN-17754): port OMN-17787 — a remote pre-push run that collected zero te...
  • 94cd22c docs(OMN-16606): migrate omnibase_core documentation to the knowledge base an...
  • 334d088 fix(OMN-17875): arm omnibase_core auto-merge with the org PAT so dev push wor...
  • 1bd884e fix(OMN-15660): arm the terminal correlation predicate in host mode and stop ...
  • d191ffb fix(OMN-17603): carry the pytest execution policy across the pre-push remote ...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump OmniNode-ai/omnibase_core/.github/workflows/receipt…
78b97aa 
…-gate.yml

Bumps [OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml](https://github.com/omninode-ai/omnibase_core) from 0.47.1 to 0.47.3.
- [Release notes](https://github.com/omninode-ai/omnibase_core/releases)
- [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md)
- [Commits](OmniNode-ai/omnibase_core@31e44e9...839e5d5)

---
updated-dependencies:
- dependency-name: OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml
  dependency-version: 0.47.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 8, 2026
@jonahgabriel

jonahgabriel commented Sep 8, 2026

Copy link
Copy Markdown
Collaborator

Manual merge sweep — attributed, with the fix in flight. Lane manual-merge-sweep-products, live reads 2026-09-08T06:0xZ.

Named blocker: CI Summary (the only required context on omnibase_infra dev), failing on a producer that has nothing to do with this diff.

Deduped check-runs on this head (max(started_at) per name) show the failing producer is Exposed Identifier Gate (OMN-17320), which runs --scope all over the whole tree:

exposed-id-gate: mode=blocking scope=all entries=11 files_scanned=7186 findings=1
  src/omnibase_infra/runtime/entrypoint_preflight.py:16:23: denylisted
  ec2-instance-id (entry=omn18024-ec2-dev-system ticket=OMN-18024)

That file is not in this PR. Two PRs landed on dev 80 seconds apart — #3268 (OMN-17372, 84211f73f, 05:39:37Z) introduced the docstring citing the instance id, #3272 (OMN-18024, 308c31400, 05:40:57Z) added that id to the denylist — with no textual conflict between them, so the whole-tree scan only starts failing once both are on dev. Every open PR in this repository inherits it, including this one and #3307.

Fix in flight: #3313, which removes the literal and keeps the claim (findings=0 on that branch; findings=1 on its parent origin/dev 34314a61b as the positive control). Once #3313 lands, this PR needs one rerun of its CI run — nothing else. The Detect Changes / CI Tests Gate / Tests (Split ...) cancellations on this head are downstream of the same failure, not independent reds.

Separately, and not fixed here: public-repo-hygiene / public-repo-hygiene fails on this head with The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string, because a Dependabot-triggered run reads the Dependabot secret store (Secret source: Dependabot in the job log) and the org App credentials are not there. It is not a required context here, so it is a red rather than a block — but the gate is therefore not actually running on any dependency PR, which is worth its own repair.

@jonahgabriel
Merge branch 'dev' into dependabot/github_actions/OmniNode-ai/omnibas…
cce516e 
…e_core/dot-github/workflows/receipt-gate.yml-0.47.3
@jonahgabriel
jonahgabriel enabled auto-merge (squash) September 8, 2026 07:14
@jonahgabriel
jonahgabriel merged commit 8fc0391 into dev Sep 8, 2026
112 checks passed
@jonahgabriel
jonahgabriel deleted the dependabot/github_actions/OmniNode-ai/omnibase_core/dot-github/workflows/receipt-gate.yml-0.47.3 branch September 8, 2026 07:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jonahgabriel