feat(OMN-20782): omnibase_infra enforces the five hygiene classes on added lines

[jonahgabriel]

Lab: host=h101 lane=ph-hygiene-infra-r-5d21 command=pre-commit run public-repo-hygiene --files tests/planted_omn20782_probe.txt observed exit 1 with ADDED tests/planted_omn20782_probe.txt:1: lab-config as the one enforced finding; this change touches CI configuration and pre-commit configuration only and starts no runtime on any lab lane.

Summary

• .public-repo-hygiene.yaml declares enforce_scope: added-lines and enforce_classes private-repo-name, internal-kb-prose, lab-config, person-name, private-network (as omniclaude carries). mode stays report. The whole-tree residue (14956 other findings in the gate's scratch run) stays reported on every run and is cleared by the residue burn-down. No allowlist, suppression or baseline entry is added.

• .github/workflows/public-repo-hygiene.yml: the reusable pin moves from omniclaude 3b8addff365b1a53e04106284b9275b6d5fad3c6 to omniclaude dev 6e47aa311ac5d177d116d9597b07966a233d2463, a descendant of 9a58ef705 (the added-lines commit). The old pin already carried the added-lines scope; the new one also carries the env-var vocabulary path the exported pre-commit hook reads (6e47aa311). The reusable at that pin resolves the diff base (the pull request merge ref's first parent) and passes it to the gate itself, so the caller passes nothing extra. The CI log shows "public-repo-hygiene pin: 6e47aa311ac5d177d116d9597b07966a233d2463" and "diff base: 1d716d2 (merge-ref first parent)". Only this workflow's pin moves; the shared sibling pin for other omniclaude workflows in .github/sibling-pins.yaml is unchanged.

• .pre-commit-config.yaml: hook public-repo-hygiene from the omniclaude repository at the same revision, require_serial true, no args, files, exclude, stages or entry overrides.

• The CI Summary umbrella needs no change: its default-deny external sweep already fails on any red external check-run that no exclusion admits, and no exclusion names this context. tests/ci/test_public_repo_hygiene_enforcement_omn20782.py asserts that a failed "public-repo-hygiene / public-repo-hygiene" row fails the sweep and a success row passes.

• AC1: scratch pull request omnibase_infra#4781 (closed, branch deleted) carried this branch plus one planted lab-config literal in tests/planted_omn20782_probe.txt. The literal is a lab vocabulary entry; the file was created through the GitHub contents API on the scratch branch because the new pre-commit hook refuses the same literal locally. Run 37971751271, job "public-repo-hygiene / public-repo-hygiene", concluded failure at head 2400f364c1c4f85af21ccffe5d262338dde36004. Failing job log: https://github.com/OmniNode-ai/omnibase_infra/actions/runs/37971751271/job/113959842488 . The log reads: "ENFORCE SCOPE: added lines (merge-base(1d716d2, HEAD) = 1d716d2). 1 enforced finding(s) on lines this change adds fail the run; 14956 other finding(s) are reported only." then "ADDED tests/planted_omn20782_probe.txt:1: lab-config" then "Process completed with exit code 1." The literal does not appear in the log.

• AC2: with the planted file staged, pre-commit run public-repo-hygiene --files tests/planted_omn20782_probe.txt exited 1 with the same single ADDED lab-config finding. Positive control: with the planted file removed, pre-commit run public-repo-hygiene --files .public-repo-hygiene.yaml exited 0. With OMNI_HYGIENE_VOCAB_PATH unset the hook exits 1 with "THE GATE DID NOT RUN". The commit that carries this change also ran the hook over its own staged lines and passed.

• AC3: in the scratch run the only enforced finding was the planted line, so this change adds no enforced finding. This pull request's own gate run is the AC3 falsifier and is read from the pull request's checks after creation.

Tests

• tests/ci/test_public_repo_hygiene_enforcement_omn20782.py has 6 tests. The first commit of the branch is the tests alone (5 tests); 3 of the 5 failed before the change (config, workflow pin, pre-commit hook). The sixth test consumes tests/ci/fixtures/public_repo_hygiene_added_lines_omn20782.json, a recorded run of the real gate at the new revision over a planted lab-config literal; the CI-tooling live-contact hook requires this recording for a workflow edit. After the change, the 6 tests plus tests/ci/test_sibling_reads_pinned_omn20331.py pass locally (54 passed).

Operator note

• Every commit in this repository now needs OMNI_HYGIENE_VOCAB_PATH set to the private denylist file; without it the hook exits non-zero and the commit is refused, by the gate's design (it fails closed). The lab vocabulary is read from a file named public_repo_hygiene_lab_vocabulary.yaml beside the denylist file; without it the lab-config class cannot run and the gate refuses. Lab hosts and machines that commit here need that variable in their environment.

Where deployment values live

• This change adds no lane, host, role, endpoint or routing value. The private denylist vocabularies live in private repositories; CI fetches them with the organisation app token. A local commit reads the denylist from the file named by the OMNI_HYGIENE_VOCAB_PATH environment variable.

Ticket

• OMN-20782.

Evidence-Ticket: OMN-20782
Evidence-Source: OCC#13464

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, local-studio-planner
Models failed: none
New finding threads: 2
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 9
Nit-level findings suppressed: 0

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 9 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [CRITICAL] tests/ci/fixtures/public_repo_hygiene_added_lines_omn20782.json (local-studio-planner) — Hardcoded credentials in test fixture | The file tests/ci/fixtures/public_repo_hygiene_added_lines_omn20782.json contains a JSON object with a _provenance.source field that references specific int
• [MAJOR] .pre-commit-config.yaml (qwen3-review) — Pre-commit hook fetches arbitrary code from a remote repository at commit time | The new pre-commit hook references repo: https://github.com/OmniNode-ai/omniclaude at a pinned revision. Pre-commit c
• [MAJOR] .github/workflows/public-repo-hygiene.yml (qwen3-review) — No test verifies that the CI workflow's mode: report is consistent with the new enforce_classes semantics | The workflow still passes mode: report to the reusable workflow. The comment in the YAML
• [MAJOR] .github/workflows/public-repo-hygiene.yml, .pre-commit-config.yaml (local-studio-planner) — Tight coupling between repo and omniclaude revision | The workflow, pre-commit config, and tests all hardcode the same commit SHA (6e47aa311ac5d177d116d9597b07966a233d2463) for the omniclaude reus
• [MINOR] tests/ci/fixtures/public_repo_hygiene_added_lines_omn20782.json (qwen3-review) — Fixture provenance timestamp is in the future relative to the copyright header | The fixture file public_repo_hygiene_added_lines_omn20782.json has captured_utc: 2026-10-09T18:07:47Z, and the test
• [MINOR] tests/ci/test_public_repo_hygiene_enforcement_omn20782.py (qwen3-review) — Dual enforcement points (CI and pre-commit) can diverge if the omniclaude revision is updated in one but not the other | The CI workflow and the pre-commit hook both pin to `6e47aa311ac5d177d116d9597b
• [MINOR] tests/ci/test_public_repo_hygiene_enforcement_omn20782.py (qwen3-review) — Test test_hygiene_context_is_not_excluded_from_the_ci_summary_sweep is tautological | The test asserts not [k for k in EXTERNAL_SWEEP_EXCLUSIONS if "hygiene" in k.lower()]. This only fails if some
• [MINOR] .pre-commit-config.yaml (local-studio-planner) — Pre-commit hook requires serial execution | The pre-commit hook for public-repo-hygiene includes require_serial: true. This forces all pre-commit hooks to run sequentially, disabling parallel exec
• [MINOR] tests/ci/test_public_repo_hygiene_enforcement_omn20782.py (local-studio-planner) — Test does not verify actual enforcement logic | The test test_config_enforces_the_five_classes_on_added_lines only checks that the YAML config file contains the expected keys and values. It does not

Findings demoted from threads (anchor rejected)

• [MAJOR] hostile-reviewer (qwen3-review)

  Test asserts absence of narrowing keys but does not verify the hook actually runs on added lines | The test test_precommit_runs_the_gate_hook_at_the_same_revision asserts that the hook block does not contain any of the keys in narrowing = {"entry", "args", "files", "exclude", "stages", "always_run"}. The comment claims 'The exported hook already runs over the staged added lines (--diff-staged), always_run, in the pre-commit stage.' This is an assumption about the behavior of the remote hook definition t

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MAJOR] hostile-reviewer (local-studio-planner)

  Test relies on external state and manual evidence | The test test_gate_at_the_pin_fails_a_planted_lab_config_literal is marked with @pytest.mark.live_contact and relies on a static JSON fixture (recorded_response) that represents a past run. This is not a unit test of the code logic but a verification of historical state. If the underlying tool behavior changes slightly (e.g., output formatting), this test will fail without indicating if the actual security gate still works. It also assumes the 'plant

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

[github-actions]

✅ Hostile Reviewer — REVIEWED

Critical findings: 1
Major findings: 5
Total findings: 10
Models succeeded: qwen3-review,local-studio-planner
Models unavailable: none

Action required: findings were posted as review threads. Address or reject each one, then resolve its thread — the Hostile Review Thread Gate fails while hostile-reviewer threads are unresolved (OMN-17492).

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	Fails this job with a named reason

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review (Qwen3.8-27B), local-studio-planner (Qwen3.6-35B-A3B) (OMN-8468/OMN-8524/OMN-17492)

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, local-studio-planner
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 9
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 9 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [CRITICAL] tests/ci/fixtures/public_repo_hygiene_added_lines_omn20782.json (local-studio-planner) — Hardcoded credentials in test fixture | The file tests/ci/fixtures/public_repo_hygiene_added_lines_omn20782.json contains a captured output from a live run. The 'command' field includes the path to a
• [MAJOR] tests/ci/test_public_repo_hygiene_enforcement_omn20782.py, test_precommit_runs_the_gate_hook_at_the_same_revision (qwen3-review) — Pre-commit hook revision may not support added-lines enforcement | The pre-commit hook is pinned to omniclaude revision 6e47aa311ac5d177d116d9597b07966a233d2463. The test docstring states that the add
• [MAJOR] .pre-commit-config.yaml, tests/ci/test_public_repo_hygiene_enforcement_omn20782.py (qwen3-review) — Pre-commit hook reads private denylist from environment variable without validation | The pre-commit hook reads the private denylist from the file named by OMNI_HYGIENE_VOCAB_PATH. The diff comment
• [MAJOR] tests/ci/test_public_repo_hygiene_enforcement_omn20782.py (qwen3-review) — No test verifies that the CI gate and pre-commit hook use the same omniclaude revision | The contract requires that the CI gate and the pre-commit hook use the same omniclaude revision to prevent dive
• [MAJOR] tests/ci/test_public_repo_hygiene_enforcement_omn20782.py (local-studio-planner) — Test relies on external state and hardcoded SHA | The test test_gate_at_the_pin_fails_a_planted_lab_config_literal relies on a pre-recorded JSON fixture. This breaks the principle of self-contained te
• [MAJOR] .pre-commit-config.yaml (local-studio-planner) — Pre-commit hook requires network access and external dependency | The pre-commit hook is configured to use a remote repo (https://github.com/OmniNode-ai/omniclaude) with a specific revision. This intr
• [MINOR] tests/ci/test_anti_growth_baselines_omn19677.py, _omniclaude_repo (qwen3-review) — Test for anti-growth baseline may match multiple omniclaude repos | The change to test_anti_growth_baselines_omn19677.py adds a filter to match only the omniclaude repo that has the `anti-growth-bas
• [MINOR] tests/ci/test_public_repo_hygiene_enforcement_omn20782.py, test_gate_at_the_pin_fails_a_planted_lab_config_literal (qwen3-review) — Fixture-based test does not verify live behavior of the gate | The test test_gate_at_the_pin_fails_a_planted_lab_config_literal uses a recorded fixture from a previous run. This is a good practice f
• [MINOR] tests/ci/test_public_repo_hygiene_enforcement_omn20782.py (local-studio-planner) — Missing test for negative case (passing commit) | The test suite verifies that a commit with a prohibited class fails. However, it does not explicitly verify that a commit without any prohibited class