@trac3er/oh-my-god 2.0.3 → 2.0.5

package/registry/bundles/secure-worktree-pipeline.yaml

@@ -0,0 +1,54 @@
+id: secure-worktree-pipeline
+kind: runtime
+version: 2.0.5
+title: OMG Secure Worktree Pipeline
+description: Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/subagent_dispatcher.py
+    - hooks/branch_manager.py
+invocation_policy:
+  user_invocable: false
+  model_invocable: true
+  allow_implicit_invocation: false
+tool_policy:
+  side_effect_level: high
+  allowed_tools:
+    claude:
+      - Read
+      - Bash(git:*)
+    codex:
+      - Read
+      - Bash(git:*)
+lifecycle_hooks:
+  native:
+    - SessionStart
+    - Stop
+  emulated:
+    - WorktreeCreate
+    - WorktreeRemove
+    - SubagentStart
+    - SubagentStop
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - python
+evidence_outputs:
+  artifacts:
+    - .omg/evidence/subagents/*.json
+execution_contract:
+  modes:
+    - automation
+    - ephemeral_worktree
+    - local_supervisor
+channel_overrides:
+  public:
+    worker_policy: local-only
+  enterprise:
+    worker_policy: managed-local

package/registry/bundles/security-check.yaml

@@ -0,0 +1,50 @@
+id: security-check
+kind: security
+version: 2.0.5
+title: OMG Security Check
+description: Canonical security audit bundle with provenance, trust scoring, and deterministic evidence.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/security_check.py
+    - commands/OMG:security-check.md
+invocation_policy:
+  user_invocable: true
+  model_invocable: true
+  allow_implicit_invocation: false
+tool_policy:
+  side_effect_level: medium
+  allowed_tools:
+    claude:
+      - Read
+      - Grep
+      - Bash(python3:*)
+    codex:
+      - Read
+      - Grep
+      - Bash(python3:*)
+lifecycle_hooks:
+  native:
+    - PostToolUse
+  emulated:
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - python
+evidence_outputs:
+  artifacts:
+    - .omg/evidence/security-check-*.json
+execution_contract:
+  modes:
+    - embedded
+    - local_supervisor
+channel_overrides:
+  public:
+    posture: self-serve
+  enterprise:
+    posture: managed

package/registry/bundles/tracebank.yaml

@@ -0,0 +1,47 @@
+id: tracebank
+kind: evidence
+version: 2.0.5
+title: OMG Tracebank
+description: Structured plan-to-patch-to-verify trace capture for OMG routes.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/tracebank.py
+invocation_policy:
+  user_invocable: true
+  model_invocable: true
+  allow_implicit_invocation: true
+tool_policy:
+  side_effect_level: medium
+  allowed_tools:
+    claude:
+      - Read
+      - Bash(python3:*)
+    codex:
+      - Read
+      - Bash(python3:*)
+lifecycle_hooks:
+  native:
+    - PostToolUse
+  emulated:
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - python
+evidence_outputs:
+  artifacts:
+    - .omg/tracebank/events.jsonl
+execution_contract:
+  modes:
+    - embedded
+    - local_supervisor
+channel_overrides:
+  public:
+    retention: project-local
+  enterprise:
+    retention: policy-managed

package/registry/bundles/vision.yaml

@@ -0,0 +1,45 @@
+id: vision
+kind: domain-pack
+version: 2.0.5
+title: OMG Vision Pack
+description: Vision-specific lineage, drift, and replay attachments.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/domain_packs.py
+invocation_policy:
+  user_invocable: true
+  model_invocable: true
+  allow_implicit_invocation: false
+tool_policy:
+  side_effect_level: medium
+  allowed_tools:
+    claude:
+      - Read
+    codex:
+      - Read
+lifecycle_hooks:
+  native:
+    - PostToolUse
+  emulated:
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - python
+evidence_outputs:
+  artifacts:
+    - .omg/lineage/*.json
+execution_contract:
+  modes:
+    - embedded
+    - local_supervisor
+channel_overrides:
+  public:
+    drift_checks: advisory
+  enterprise:
+    drift_checks: required

package/registry/omg-capability.schema.json

@@ -0,0 +1,80 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
+  "title": "OMG Capability Bundle",
+  "version": "2.0.5",
+  "type": "object",
+  "required": [
+    "id",
+    "kind",
+    "version",
+    "title",
+    "description",
+    "hosts",
+    "assets",
+    "invocation_policy",
+    "tool_policy",
+    "lifecycle_hooks",
+    "mcp_contract",
+    "lsp_contract",
+    "evidence_outputs",
+    "execution_contract",
+    "channel_overrides"
+  ],
+  "properties": {
+    "id": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "version": {
+      "type": "string"
+    },
+    "title": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "hosts": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "claude",
+          "codex"
+        ]
+      },
+      "minItems": 1
+    },
+    "assets": {
+      "type": "object"
+    },
+    "invocation_policy": {
+      "type": "object"
+    },
+    "tool_policy": {
+      "type": "object"
+    },
+    "lifecycle_hooks": {
+      "type": "object"
+    },
+    "mcp_contract": {
+      "type": "object"
+    },
+    "lsp_contract": {
+      "type": "object"
+    },
+    "evidence_outputs": {
+      "type": "object"
+    },
+    "execution_contract": {
+      "type": "object"
+    },
+    "channel_overrides": {
+      "type": "object"
+    }
+  },
+  "additionalProperties": true
+}

package/registry/verify_artifact.py

@@ -0,0 +1,90 @@
+"""OMG v1 supply-chain verification with Warn-and-Run semantics."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+
+@dataclass
+class SupplyArtifact:
+    id: str
+    signer: str | None
+    checksum: str | None
+    permissions: list[str]
+    static_scan: list[dict[str, Any]]
+    risk_level: str = "low"
+
+
+def _normalize(artifact: dict[str, Any]) -> SupplyArtifact:
+    return SupplyArtifact(
+        id=str(artifact.get("id", "unknown")),
+        signer=artifact.get("signer"),
+        checksum=artifact.get("checksum"),
+        permissions=[str(p) for p in artifact.get("permissions", [])],
+        static_scan=[f for f in artifact.get("static_scan", []) if isinstance(f, dict)],
+        risk_level=str(artifact.get("risk_level", "low")).lower(),
+    )
+
+
+def verify_artifact(artifact: dict[str, Any], mode: str = "warn_and_run") -> dict[str, Any]:
+    a = _normalize(artifact)
+    reasons: list[str] = []
+    controls: list[str] = []
+
+    for finding in a.static_scan:
+        sev = str(finding.get("severity", "")).lower()
+        if sev == "critical":
+            reasons.append("critical static scan finding")
+            return {
+                "action": "deny",
+                "risk_level": "critical",
+                "reason": "; ".join(reasons),
+                "controls": ["block-execution"],
+                "trusted": False,
+            }
+
+    perm_blob = " ".join(a.permissions).lower()
+    if any(token in perm_blob for token in ["sudo", "rm -rf", "--privileged", "curl |", "wget |"]):
+        return {
+            "action": "deny",
+            "risk_level": "critical",
+            "reason": "critical permission profile",
+            "controls": ["block-execution"],
+            "trusted": False,
+        }
+
+    if not a.signer or not a.checksum:
+        reasons.append("missing signer/checksum")
+        controls.extend(["isolate-network", "read-only-fs", "manual-approval"])
+        if mode == "warn_and_run":
+            return {
+                "action": "ask",
+                "risk_level": "high",
+                "reason": "; ".join(reasons),
+                "controls": controls,
+                "trusted": False,
+            }
+        return {
+            "action": "deny",
+            "risk_level": "high",
+            "reason": "; ".join(reasons),
+            "controls": ["block-execution"],
+            "trusted": False,
+        }
+
+    if any(str(f.get("severity", "")).lower() == "high" for f in a.static_scan):
+        return {
+            "action": "ask",
+            "risk_level": "high",
+            "reason": "high severity findings present",
+            "controls": ["manual-approval"],
+            "trusted": False,
+        }
+
+    return {
+        "action": "allow",
+        "risk_level": a.risk_level if a.risk_level in {"low", "med", "high", "critical"} else "low",
+        "reason": "artifact verified",
+        "controls": [],
+        "trusted": True,
+    }

package/runtime/adapters/claude.py

@@ -27,6 +27,7 @@ class ClaudeAdapter:
             "runtime": self.runtime,
             "phase": "execute",
             "status": "executed",
+            "worker_mode": "stub",
             "operations": [
                 "apply-plan",
                 "collect-diff",
@@ -43,6 +44,7 @@ class ClaudeAdapter:
             "checks": [
                 {"name": "tests", "passed": True},
                 {"name": "security", "passed": True},
+                {"name": "worker_implementation", "passed": False, "mode": "stub"},
             ],
         }
 
@@ -57,4 +59,5 @@ class ClaudeAdapter:
             "diff_summary": {},
             "reproducibility": {"seed": "deterministic"},
             "unresolved_risks": [],
+            "worker_mode": "stub",
         }

package/runtime/adapters/gpt.py

@@ -23,6 +23,7 @@ class GPTAdapter:
             "runtime": self.runtime,
             "phase": "execute",
             "status": "executed",
+            "worker_mode": "stub",
             "operations": ["apply-plan", "collect-diff"],
             "errors": [],
         }
@@ -36,6 +37,7 @@ class GPTAdapter:
             "checks": [
                 {"name": "tests", "passed": True},
                 {"name": "security", "passed": True},
+                {"name": "worker_implementation", "passed": False, "mode": "stub"},
             ],
         }
 
@@ -50,4 +52,5 @@ class GPTAdapter:
             "diff_summary": {},
             "reproducibility": {"seed": "deterministic"},
             "unresolved_risks": [],
+            "worker_mode": "stub",
         }

package/runtime/adapters/local.py

@@ -23,6 +23,7 @@ class LocalAdapter:
             "runtime": self.runtime,
             "phase": "execute",
             "status": "executed",
+            "worker_mode": "stub",
             "operations": ["apply-plan", "collect-diff"],
             "errors": [],
         }
@@ -36,6 +37,7 @@ class LocalAdapter:
             "checks": [
                 {"name": "tests", "passed": True},
                 {"name": "security", "passed": True},
+                {"name": "worker_implementation", "passed": False, "mode": "stub"},
             ],
         }
 
@@ -50,4 +52,5 @@ class LocalAdapter:
             "diff_summary": {},
             "reproducibility": {"seed": "deterministic"},
             "unresolved_risks": [],
+            "worker_mode": "stub",
         }

package/runtime/adoption.py

@@ -11,7 +11,7 @@ CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.0.3"
+CANONICAL_VERSION = "2.0.5"
 
 VALID_ADOPTION_MODES = ("omg-only", "coexist")
 VALID_PRESETS = ("safe", "balanced", "interop", "labs")

package/runtime/api_twin.py

@@ -0,0 +1,179 @@
+"""Fixture-based API twin state and replay helpers."""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import time
+from typing import Any
+
+
+STATE_REL_PATH = Path(".omg") / "state" / "api_twin.json"
+
+
+def ingest_contract(project_dir: str, *, name: str, source_path: str) -> dict[str, Any]:
+    state = _load_state(project_dir)
+    contract_path = Path(source_path)
+    contract = {
+        "name": name,
+        "source_path": str(contract_path),
+        "content": contract_path.read_text(encoding="utf-8"),
+        "fidelity": "schema-only",
+    }
+    state.setdefault("contracts", {})[name] = contract
+    _save_state(project_dir, state)
+    return {
+        "schema": "ApiTwinContract",
+        "name": name,
+        "fidelity": "schema-only",
+        "source_path": str(contract_path),
+    }
+
+
+def record_fixture(
+    project_dir: str,
+    *,
+    name: str,
+    endpoint: str = "default",
+    cassette_version: str = "v1",
+    request: dict[str, Any],
+    response: dict[str, Any],
+    validated: bool,
+    redactions: dict[str, str] | None = None,
+) -> dict[str, Any]:
+    state = _load_state(project_dir)
+    fixture = {
+        "name": name,
+        "endpoint": endpoint,
+        "cassette_version": cassette_version,
+        "request": request,
+        "response": response,
+        "fidelity": "recorded-validated" if validated else "recorded",
+        "validated": validated,
+        "redactions": redactions or {},
+    }
+    fixtures = state.setdefault("fixtures", {}).setdefault(name, {})
+    fixtures[_fixture_key(endpoint, cassette_version)] = fixture
+    _save_state(project_dir, state)
+    return {
+        "schema": "ApiTwinFixture",
+        "name": name,
+        "endpoint": endpoint,
+        "cassette_version": cassette_version,
+        "fidelity": fixture["fidelity"],
+    }
+
+
+def serve_fixture(
+    project_dir: str,
+    *,
+    name: str,
+    endpoint: str = "default",
+    cassette_version: str = "v1",
+    latency_ms: int = 0,
+    failure_mode: str = "",
+    schema_drift: bool = False,
+) -> dict[str, Any]:
+    state = _load_state(project_dir)
+    fixture = _fixture(state, name, endpoint=endpoint, cassette_version=cassette_version)
+    response = dict(fixture.get("response", {}))
+    fidelity = str(fixture.get("fidelity", "recorded"))
+    if latency_ms > 0:
+        time.sleep(max(latency_ms, 0) / 1000)
+    if schema_drift:
+        response["__schema_drift__"] = True
+        fidelity = "stale"
+    if failure_mode:
+        response = {"error": failure_mode}
+        fidelity = "stale"
+    return {
+        "schema": "ApiTwinServeResult",
+        "name": name,
+        "endpoint": endpoint,
+        "cassette_version": cassette_version,
+        "latency_ms": latency_ms,
+        "failure_mode": failure_mode,
+        "fidelity": fidelity,
+        "response": response,
+        "report": {
+            "saved_live_calls": 1,
+            "saved_cost_estimate": round(len(json.dumps(response)) * 0.0001, 4),
+            "redactions": fixture.get("redactions", {}),
+        },
+    }
+
+
+def verify_fixture(
+    project_dir: str,
+    *,
+    name: str,
+    endpoint: str = "default",
+    cassette_version: str = "v1",
+    live_response: dict[str, Any],
+) -> dict[str, Any]:
+    state = _load_state(project_dir)
+    fixture = _fixture(state, name, endpoint=endpoint, cassette_version=cassette_version)
+    matches_live = fixture.get("response", {}) == live_response
+    fidelity = "recorded-validated" if matches_live else "stale"
+    fixture["fidelity"] = fidelity
+    fixture["validated"] = matches_live
+    state.setdefault("fixtures", {}).setdefault(name, {})[_fixture_key(endpoint, cassette_version)] = fixture
+    _save_state(project_dir, state)
+    return {
+        "schema": "ApiTwinVerifyResult",
+        "name": name,
+        "endpoint": endpoint,
+        "cassette_version": cassette_version,
+        "fidelity": fidelity,
+        "matches_live": matches_live,
+        "live_verification_required": True,
+    }
+
+
+def _state_path(project_dir: str) -> Path:
+    return Path(project_dir) / STATE_REL_PATH
+
+
+def _load_state(project_dir: str) -> dict[str, Any]:
+    path = _state_path(project_dir)
+    if not path.exists():
+        return {"schema": "ApiTwinState", "version": "2.0.5", "contracts": {}, "fixtures": {}}
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {"schema": "ApiTwinState", "version": "2.0.5", "contracts": {}, "fixtures": {}}
+    if not isinstance(payload, dict):
+        return {"schema": "ApiTwinState", "version": "2.0.5", "contracts": {}, "fixtures": {}}
+    payload.setdefault("schema", "ApiTwinState")
+    payload.setdefault("version", "2.0.5")
+    payload.setdefault("contracts", {})
+    payload.setdefault("fixtures", {})
+    return payload
+
+
+def _save_state(project_dir: str, payload: dict[str, Any]) -> None:
+    path = _state_path(project_dir)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+
+
+def _fixture_key(endpoint: str, cassette_version: str) -> str:
+    return f"{endpoint}::{cassette_version}"
+
+
+def _fixture(
+    state: dict[str, Any],
+    name: str,
+    *,
+    endpoint: str = "default",
+    cassette_version: str = "v1",
+) -> dict[str, Any]:
+    fixtures = state.get("fixtures", {})
+    if not isinstance(fixtures, dict) or name not in fixtures:
+        raise ValueError(f"Unknown API twin fixture: {name}")
+    fixture_group = fixtures[name]
+    if not isinstance(fixture_group, dict):
+        raise ValueError(f"Invalid API twin fixture: {name}")
+    fixture = fixture_group.get(_fixture_key(endpoint, cassette_version))
+    if not isinstance(fixture, dict):
+        raise ValueError(f"Unknown API twin cassette: {name} {endpoint} {cassette_version}")
+    return fixture

package/runtime/asset_loader.py

@@ -0,0 +1,62 @@
+"""Helpers for locating packaged OMG assets from source checkouts or installs."""
+from __future__ import annotations
+
+from importlib import metadata
+from pathlib import Path
+
+
+_DIST_NAMES = ("oh-my-god", "oh_my_god")
+
+
+def project_root() -> Path:
+    return Path(__file__).resolve().parents[1]
+
+
+def resolve_asset(rel_path: str | Path) -> Path:
+    rel = Path(rel_path)
+    candidate = project_root() / rel
+    if candidate.exists():
+        return candidate
+
+    rel_posix = rel.as_posix()
+    for dist_name in _DIST_NAMES:
+        try:
+            dist = metadata.distribution(dist_name)
+        except metadata.PackageNotFoundError:
+            continue
+        for file in dist.files or []:
+            if str(file).endswith(rel_posix):
+                located = Path(dist.locate_file(file))
+                if located.exists():
+                    return located
+
+    raise FileNotFoundError(f"Unable to resolve packaged OMG asset: {rel_posix}")
+
+
+def resolve_assets(prefix: str | Path, suffix: str = "") -> list[Path]:
+    prefix_path = Path(prefix)
+    root_candidate = project_root() / prefix_path
+    if root_candidate.exists():
+        if root_candidate.is_dir():
+            if suffix:
+                return sorted(path for path in root_candidate.rglob("*") if path.is_file() and path.name.endswith(suffix))
+            return sorted(path for path in root_candidate.rglob("*") if path.is_file())
+        return [root_candidate]
+
+    prefix_posix = prefix_path.as_posix().rstrip("/")
+    matched: list[Path] = []
+    for dist_name in _DIST_NAMES:
+        try:
+            dist = metadata.distribution(dist_name)
+        except metadata.PackageNotFoundError:
+            continue
+        for file in dist.files or []:
+            file_text = str(file)
+            if not file_text.startswith(prefix_posix):
+                continue
+            if suffix and not file_text.endswith(suffix):
+                continue
+            located = Path(dist.locate_file(file))
+            if located.exists() and located.is_file():
+                matched.append(located)
+    return sorted(matched)