[clubanderson]

Part of #8419

Automated pin bump: omp 18.19.0 -> 18.20.0 in src/Dockerfile and src/Dockerfile.contributor.

Provenance

Every value below was resolved by src/scripts/cli-pin-bump.sh in run https://github.com/hivecommons/hive/actions/runs/43371821632; digests are computed from the downloaded artifacts and cross-checked against the vendor-published digest where one exists (never copied from a page).

VERSION=18.20.0
SHA256_AMD64=c8694be8c6e6a1f45e3636dd8a8e9eaa78878ad629a89000b403ec5e456d3f89
SHA256_ARM64=8b5e197db7c58b7ebabf83c6f03597f89bae3a766a84c6481b3a942a125f5e22

Smoke (before this PR was opened)

src/Dockerfile built for linux/amd64 with the new pin; inside the image:

$ omp --version
omp/18.20.0

Model lists (not automated)

::warning::claudePinnedCLIModels has no 'version pinned in src/Dockerfile (X' comment to check
::warning::codex static list comment says 0.166.0 but src/Dockerfile pins 0.167.0
2 model-list drift finding(s) against the CLI pins; also review static/index.html and src/pkg/tokens/pricing.go by hand.

• Allowlists and static fallbacks in src/pkg/dashboard/cli_models*.go match the new pin's model set, and their "matches CLI version" comments name it
• static/index.html model options updated
• src/pkg/tokens/pricing.go has prices for any new model

The docker workflow on this PR builds both images for linux/amd64 and linux/arm64 (every hash-verified layer runs sha256sum -c / sha512sum -c), and the backend smoke's pinned lane picks the new CLI up on its next run. See src/docs/cli-pins.md.

Opened by .github/workflows/cli-pin-bump.yml.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nicholasjackson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#18062	🌱 images: bump codex 0.167.0 -> 0.168.0	same files	src/Dockerfile src/Dockerfile.contributor

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

@clubanderson this PR is held at stage/071-needs-author and the hive will not merge it yet.

Failing checks:

• coverage

Next: the hive does not push to your branch. Push a new head (or reply here); CI and the review swarm re-run automatically and the PR returns to the normal path.

hive/awaiting-ci: the coverage check failed and baseline triage says the branch is 32 commits behind v5 (action MERGE_BASE, not a shared incident). This PR is human-authored, so the hive won't push to it. Please update the branch from v5 and re-run CI.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=claude model=claude-sonnet-5-5 claude=2.1.322

Evidence bundle `#180643602214` sha256:39088d012ae0b3ab1bf2ed4a40ddfddae34ec4a8cbf9d9bdc66c25c73384d8fc — download from the dashboard or `hivectl review evidence #18064`.

[hivecommons-hive]

Diff is correct; the red checks are inherited from v5, not from this PR.

The change is the pin ARGs in src/Dockerfile and src/Dockerfile.contributor only, and the docker (*) build jobs that consume them (running sha256sum -c on the downloaded artifacts) are green on both arches.

test (rest 3/4) → test → coverage fail on TestReopenedClaimPersistsAcrossLoad (src/pkg/github/prclaims_reopen_test.go:235), which has failed on every hourly run of v5@88f6c9c since 2026-11-13 03:31Z: the fixture date (prclaims_reopen_test.go:18, 2026-10-14) aged past settledClaimRetention (prclaims.go:92, 30d) and the test reloads via the wall-clock LoadClaimLedger, so loadClaimLedgerAt (prclaims.go:1273-1277) drops the claim. Full mechanism and a one-line test fix are in my comment on #18062; this PR goes green once that lands on v5. Nothing to change here.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

test (rest 3/4) is red on the v5 baseline itself (pkg/github.TestReopenedClaimPersistsAcrossLoad, a fixture-date time bomb), not caused by this PR — tracked as shared incident #18067, fix in #18066. Deferring this PR until the baseline is green; it needs no change of its own for that check.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

The hive's GitHub App lacks actions: write, so it cannot rerun shared ci for head 358557eb851f. A repository maintainer with Actions write can re-run failed jobs at https://github.com/hivecommons/hive/actions/runs/43372543568 . Alternatively, the App owner can request Actions read and write for this recovery installation and its owner must accept the update. This is a CI recovery permission block, not a source-code failure or merge approval. Hive retries after its bounded permission cooldown; no alternate credential is selected. Hive will resume automatically once the step is done; this label and note clear themselves.

[hivecommons-hive]

Needs a decision, not a merge:

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

[hivecommons-hive]

3602214

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head 3602214871d8) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • src/Dockerfile
  • src/Dockerfile.contributor

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.