@trac3er/oh-my-god 2.0.3 → 2.0.5

package/runtime/tracebank.py

@@ -0,0 +1,53 @@
+"""Structured trace capture for OMG routes and release evidence."""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import json
+from pathlib import Path
+from typing import Any
+from uuid import uuid4
+
+
+TRACEBANK_REL_PATH = Path(".omg") / "tracebank" / "events.jsonl"
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def record_trace(
+    project_dir: str,
+    *,
+    trace_type: str,
+    route: str,
+    status: str,
+    plan: dict[str, Any] | None = None,
+    patch: dict[str, Any] | None = None,
+    verify: dict[str, Any] | None = None,
+    failures: list[dict[str, Any]] | None = None,
+    rejections: list[dict[str, Any]] | None = None,
+    metadata: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    trace_id = f"trace-{uuid4().hex}"
+    record = {
+        "schema": "TracebankRecord",
+        "trace_id": trace_id,
+        "recorded_at": _now(),
+        "trace_type": trace_type,
+        "route": route,
+        "status": status,
+        "plan": plan or {},
+        "patch": patch or {},
+        "verify": verify or {},
+        "failures": failures or [],
+        "rejections": rejections or [],
+        "metadata": metadata or {},
+    }
+
+    path = Path(project_dir) / TRACEBANK_REL_PATH
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("a", encoding="utf-8") as handle:
+        handle.write(json.dumps(record, ensure_ascii=True) + "\n")
+
+    record["path"] = TRACEBANK_REL_PATH.as_posix()
+    return record

package/runtime/untrusted_content.py

@@ -0,0 +1,102 @@
+"""State and provenance tracking for untrusted external content."""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import re
+from typing import Any
+
+
+STATE_REL_PATH = Path(".omg") / "state" / "untrusted-content.json"
+_INSTRUCTION_PATTERNS: tuple[re.Pattern[str], ...] = (
+    re.compile(r"ignore\s+previous\s+instructions", re.IGNORECASE),
+    re.compile(r"\b(system|assistant|developer)\s*:", re.IGNORECASE),
+    re.compile(r"\b(run|execute|commit|push|apply_patch|edit)\b", re.IGNORECASE),
+)
+
+
+def mark_untrusted_content(
+    project_dir: str,
+    *,
+    source_type: str,
+    content: str,
+    source_ref: str = "",
+) -> dict[str, Any]:
+    state_path = _state_path(project_dir)
+    state = get_untrusted_content_state(project_dir)
+    sanitized, quarantined = quarantine_instruction_like_text(content)
+    entry = {
+        "source_type": source_type,
+        "source_ref": source_ref,
+        "quarantined_fragments": quarantined,
+        "trust_score": 0.0,
+    }
+    provenance = list(state.get("provenance", []))
+    provenance.append(entry)
+    next_state = {
+        "active": True,
+        "last_source_type": source_type,
+        "last_source_ref": source_ref,
+        "sanitized_content": sanitized,
+        "quarantined_fragments": quarantined,
+        "provenance": provenance[-20:],
+        "trust_scores": {"external_content": 0.0},
+    }
+    _write_state(state_path, next_state)
+    return next_state
+
+
+def clear_untrusted_content(project_dir: str, *, reason: str) -> dict[str, Any]:
+    state_path = _state_path(project_dir)
+    existing = get_untrusted_content_state(project_dir)
+    next_state = {
+        **existing,
+        "active": False,
+        "cleared_reason": reason,
+    }
+    _write_state(state_path, next_state)
+    return next_state
+
+
+def get_untrusted_content_state(project_dir: str) -> dict[str, Any]:
+    state_path = _state_path(project_dir)
+    if not state_path.exists():
+        return {
+            "active": False,
+            "provenance": [],
+            "trust_scores": {},
+        }
+    try:
+        payload = json.loads(state_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {
+            "active": False,
+            "provenance": [],
+            "trust_scores": {},
+        }
+    return payload if isinstance(payload, dict) else {"active": False, "provenance": [], "trust_scores": {}}
+
+
+def is_untrusted_content_mode_active(project_dir: str) -> bool:
+    return bool(get_untrusted_content_state(project_dir).get("active", False))
+
+
+def quarantine_instruction_like_text(content: str) -> tuple[str, list[str]]:
+    sanitized_lines: list[str] = []
+    quarantined: list[str] = []
+    for raw_line in content.splitlines():
+        line = raw_line.strip()
+        if any(pattern.search(line) for pattern in _INSTRUCTION_PATTERNS):
+            quarantined.append(raw_line)
+            continue
+        sanitized_lines.append(raw_line)
+    return "\n".join(sanitized_lines).strip(), quarantined
+
+
+def _state_path(project_dir: str) -> Path:
+    return Path(project_dir) / STATE_REL_PATH
+
+
+def _write_state(path: Path, payload: dict[str, Any]) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")

package/scripts/omg.py

@@ -1,10 +1,11 @@
 #!/usr/bin/env python3
-"""OMG 2.0.3 CLI entrypoint.
+"""OMG 2.0.5 CLI entrypoint.
 
 Implements practical command-line flows for:
 - omg ship
 - omg fix --issue
 - omg secure
+- omg security check
 - omg maintainer
 - omg trust review
 - omg runtime dispatch
@@ -31,6 +32,20 @@ from hooks.shadow_manager import create_evidence_pack
 from hooks.trust_review import review_config_change, write_trust_manifest
 from lab.pipeline import publish_artifact, run_pipeline
 from runtime.dispatcher import dispatch_runtime
+from runtime.api_twin import ingest_contract, record_fixture, serve_fixture, verify_fixture
+from runtime.data_lineage import build_lineage_manifest
+from runtime.eval_gate import evaluate_trace
+from runtime.incident_replay import build_incident_pack
+from runtime.domain_packs import get_domain_pack_contract
+from runtime.preflight import run_preflight
+from runtime.remote_supervisor import issue_local_supervisor_session, verify_local_supervisor_token
+from runtime.security_check import run_security_check
+from runtime.contract_compiler import (
+    build_release_readiness,
+    compile_contract_outputs,
+    validate_contract_registry,
+)
+from runtime.tracebank import record_trace
 from runtime.compat import (
     DEFAULT_CONTRACT_SNAPSHOT_PATH,
     DEFAULT_GAP_REPORT_PATH,
@@ -120,14 +135,55 @@ def cmd_ship(args: argparse.Namespace) -> int:
     run_id = args.run_id or _now_run_id()
     verification = dispatched.get("verification", {})
     checks = verification.get("checks", []) if isinstance(verification, dict) else []
+    preflight = run_preflight(project_dir, goal=str(idea.get("goal", "")))
+    security_result = run_security_check(project_dir=project_dir, scope=".")
+    trace = record_trace(
+        project_dir,
+        trace_type="ship",
+        route=preflight["route"],
+        status="ok",
+        plan=dispatched.get("plan", {}),
+        verify=verification if isinstance(verification, dict) else {},
+        metadata={"runtime": runtime, "run_id": run_id},
+    )
+    eval_result = evaluate_trace(
+        project_dir,
+        trace_id=trace["trace_id"],
+        suites=["planning", "security"],
+        metrics={
+            "planning": 1.0 if dispatched.get("status") == "ok" else 0.0,
+            "security": max(float(security_result["trust_scores"].get("overall", 0.0)), 0.0),
+        },
+    )
+    lineage = build_lineage_manifest(
+        project_dir,
+        artifact_type="evidence-pack",
+        sources=[{"kind": "repo", "path": ".", "license": "MIT"}],
+        privacy="internal",
+        license="MIT",
+        derivation={"trace_id": trace["trace_id"], "route": preflight["route"], "eval_path": eval_result["path"]},
+        trace_id=trace["trace_id"],
+    )
     evidence_path = create_evidence_pack(
         project_dir,
         run_id,
         tests=checks if isinstance(checks, list) else [],
-        security_scans=[],
+        security_scans=[
+            {
+                "tool": "security-check",
+                "finding_count": security_result["summary"]["finding_count"],
+                "path": security_result["evidence"]["path"],
+            }
+        ],
         diff_summary={"runtime": runtime, "goal": idea.get("goal", "")},
         reproducibility={"command": f"omg ship --runtime {runtime} --idea {idea_path}"},
         unresolved_risks=[],
+        provenance=security_result["provenance"],
+        trust_scores=security_result["trust_scores"],
+        api_twin={"recommended_route": preflight["route"] if preflight["route"] == "api-twin" else ""},
+        route_metadata=preflight,
+        trace_ids=[trace["trace_id"]],
+        lineage=lineage,
     )
 
     out = {
@@ -137,6 +193,8 @@ def cmd_ship(args: argparse.Namespace) -> int:
         "run_id": run_id,
         "goal": idea.get("goal", ""),
         "evidence_path": os.path.relpath(evidence_path, project_dir),
+        "trace_id": trace["trace_id"],
+        "eval_path": eval_result["path"],
     }
     print(json.dumps(out, indent=2))
     return 0
@@ -155,6 +213,151 @@ def cmd_secure(args: argparse.Namespace) -> int:
     return 0 if decision.action != "deny" else 3
 
 
+def cmd_security_check(args: argparse.Namespace) -> int:
+    result = run_security_check(
+        project_dir=_ensure_project_dir(),
+        scope=args.scope,
+        include_live_enrichment=bool(args.live_enrichment),
+    )
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_api_twin_ingest(args: argparse.Namespace) -> int:
+    result = ingest_contract(_ensure_project_dir(), name=args.name, source_path=args.source)
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_api_twin_record(args: argparse.Namespace) -> int:
+    result = record_fixture(
+        _ensure_project_dir(),
+        name=args.name,
+        endpoint=args.endpoint,
+        cassette_version=args.cassette_version,
+        request=json.loads(args.request_json),
+        response=json.loads(args.response_json),
+        validated=bool(args.validated),
+        redactions=json.loads(args.redactions_json) if args.redactions_json else None,
+    )
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_api_twin_serve(args: argparse.Namespace) -> int:
+    result = serve_fixture(
+        _ensure_project_dir(),
+        name=args.name,
+        endpoint=args.endpoint,
+        cassette_version=args.cassette_version,
+        latency_ms=int(args.latency_ms),
+        failure_mode=args.failure_mode,
+        schema_drift=bool(args.schema_drift),
+    )
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_api_twin_verify(args: argparse.Namespace) -> int:
+    result = verify_fixture(
+        _ensure_project_dir(),
+        name=args.name,
+        endpoint=args.endpoint,
+        cassette_version=args.cassette_version,
+        live_response=json.loads(args.live_response_json),
+    )
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_preflight(args: argparse.Namespace) -> int:
+    result = run_preflight(_ensure_project_dir(), goal=args.goal)
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_domain_pack(args: argparse.Namespace) -> int:
+    result = get_domain_pack_contract(args.name)
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_trace_record(args: argparse.Namespace) -> int:
+    result = record_trace(
+        _ensure_project_dir(),
+        trace_type=args.trace_type,
+        route=args.route,
+        status=args.status,
+        plan=json.loads(args.plan_json) if args.plan_json else {},
+        verify=json.loads(args.verify_json) if args.verify_json else {},
+    )
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_eval_gate(args: argparse.Namespace) -> int:
+    result = evaluate_trace(
+        _ensure_project_dir(),
+        trace_id=args.trace_id,
+        suites=args.suites.split(","),
+        metrics=json.loads(args.metrics_json),
+    )
+    print(json.dumps(result, indent=2))
+    return 0 if result["status"] == "ok" else 2
+
+
+def cmd_delta_classify(args: argparse.Namespace) -> int:
+    from runtime.delta_classifier import classify_project_changes
+
+    touched_files = [item for item in args.files.split(",") if item]
+    result = classify_project_changes(_ensure_project_dir(), touched_files=touched_files or None, goal=args.goal)
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_incident_replay(args: argparse.Namespace) -> int:
+    result = build_incident_pack(
+        _ensure_project_dir(),
+        title=args.title,
+        failing_tests=[item for item in args.failing_tests.split(",") if item],
+        logs=[item for item in args.logs.split("|") if item],
+        diff_summary=json.loads(args.diff_summary_json),
+        trace_id=args.trace_id or None,
+    )
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_lineage(args: argparse.Namespace) -> int:
+    result = build_lineage_manifest(
+        _ensure_project_dir(),
+        artifact_type=args.artifact_type,
+        sources=json.loads(args.sources_json),
+        privacy=args.privacy,
+        license=args.license_name,
+        derivation=json.loads(args.derivation_json),
+        trace_id=args.trace_id or None,
+    )
+    print(json.dumps(result, indent=2))
+    return 0 if result["status"] == "ok" else 2
+
+
+def cmd_supervisor_issue(args: argparse.Namespace) -> int:
+    result = issue_local_supervisor_session(
+        _ensure_project_dir(),
+        worker_id=args.worker_id,
+        shared_secret=args.shared_secret,
+    )
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_supervisor_verify(args: argparse.Namespace) -> int:
+    result = verify_local_supervisor_token(args.token, shared_secret=args.shared_secret)
+    print(json.dumps(result, indent=2))
+    return 0 if result["status"] == "ok" else 2
+
+
 def cmd_maintainer(args: argparse.Namespace) -> int:
     project_dir = _ensure_project_dir()
     out_dir = Path(project_dir) / ".omg" / "evidence"
@@ -357,6 +560,34 @@ def cmd_ecosystem_sync(args: argparse.Namespace) -> int:
     return 0 if not errors else 2
 
 
+def cmd_contract_validate(args: argparse.Namespace) -> int:
+    result = validate_contract_registry(ROOT_DIR)
+    print(json.dumps(result, indent=2))
+    return 0 if result.get("status") == "ok" else 2
+
+
+def cmd_contract_compile(args: argparse.Namespace) -> int:
+    hosts = args.hosts or []
+    result = compile_contract_outputs(
+        root_dir=ROOT_DIR,
+        output_root=args.output_root,
+        hosts=hosts,
+        channel=args.channel,
+    )
+    print(json.dumps(result, indent=2))
+    return 0 if result.get("status") == "ok" else 2
+
+
+def cmd_release_readiness(args: argparse.Namespace) -> int:
+    result = build_release_readiness(
+        root_dir=ROOT_DIR,
+        output_root=args.output_root,
+        channel=args.channel,
+    )
+    print(json.dumps(result, indent=2))
+    return 0 if result.get("status") == "ok" else 2
+
+
 def _add_compat_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> None:
     compat_sub = parent.add_subparsers(dest=dest, required=True)
     compat_list = compat_sub.add_parser("list", help="List supported legacy skill names")
@@ -399,6 +630,35 @@ def _add_ecosystem_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
     ecosystem_sync.set_defaults(func=cmd_ecosystem_sync)
 
 
+def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> None:
+    contract_sub = parent.add_subparsers(dest=dest, required=True)
+
+    contract_validate = contract_sub.add_parser("validate", help="Validate contract doc, schema, and bundle registry")
+    contract_validate.set_defaults(func=cmd_contract_validate)
+
+    contract_compile = contract_sub.add_parser("compile", help="Compile Claude/Codex artifacts from the canonical contract")
+    contract_compile.add_argument(
+        "--host",
+        dest="hosts",
+        action="append",
+        choices=["claude", "codex"],
+        required=True,
+        help="Host to compile (repeat for multiple hosts)",
+    )
+    contract_compile.add_argument("--channel", default="public", choices=["public", "enterprise"])
+    contract_compile.add_argument("--output-root", default="", help="Write outputs to this root instead of the repo root")
+    contract_compile.set_defaults(func=cmd_contract_compile)
+
+
+def _add_release_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> None:
+    release_sub = parent.add_subparsers(dest=dest, required=True)
+
+    release_readiness = release_sub.add_parser("readiness", help="Check production release readiness for compiled artifacts")
+    release_readiness.add_argument("--channel", default="dual", choices=["public", "enterprise", "dual"])
+    release_readiness.add_argument("--output-root", default="", help="Check compiled outputs from this root instead of the repo root")
+    release_readiness.set_defaults(func=cmd_release_readiness)
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="omg", description=f"OMG {CANONICAL_VERSION} CLI")
     sub = parser.add_subparsers(dest="command", required=True)
@@ -418,6 +678,98 @@ def build_parser() -> argparse.ArgumentParser:
     secure.add_argument("--command", required=True)
     secure.set_defaults(func=cmd_secure)
 
+    security = sub.add_parser("security", help="Canonical OMG security workflows")
+    security_sub = security.add_subparsers(dest="security_command", required=True)
+    security_check = security_sub.add_parser("check", help="Run canonical OMG security check")
+    security_check.add_argument("--scope", default=".")
+    security_check.add_argument("--live-enrichment", action="store_true")
+    security_check.set_defaults(func=cmd_security_check)
+
+    api_twin = sub.add_parser("api-twin", help="Contract replay and fixture-based API simulation")
+    api_twin_sub = api_twin.add_subparsers(dest="api_twin_command", required=True)
+    api_twin_ingest = api_twin_sub.add_parser("ingest", help="Ingest OpenAPI/Postman/example contract input")
+    api_twin_ingest.add_argument("--name", required=True)
+    api_twin_ingest.add_argument("--source", required=True)
+    api_twin_ingest.set_defaults(func=cmd_api_twin_ingest)
+    api_twin_record = api_twin_sub.add_parser("record", help="Record approved fixture response")
+    api_twin_record.add_argument("--name", required=True)
+    api_twin_record.add_argument("--endpoint", default="default")
+    api_twin_record.add_argument("--cassette-version", default="v1")
+    api_twin_record.add_argument("--request-json", required=True)
+    api_twin_record.add_argument("--response-json", required=True)
+    api_twin_record.add_argument("--validated", action="store_true")
+    api_twin_record.add_argument("--redactions-json", default="")
+    api_twin_record.set_defaults(func=cmd_api_twin_record)
+    api_twin_serve = api_twin_sub.add_parser("serve", help="Replay a fixture with optional drift/failure injection")
+    api_twin_serve.add_argument("--name", required=True)
+    api_twin_serve.add_argument("--endpoint", default="default")
+    api_twin_serve.add_argument("--cassette-version", default="v1")
+    api_twin_serve.add_argument("--latency-ms", type=int, default=0)
+    api_twin_serve.add_argument("--failure-mode", default="")
+    api_twin_serve.add_argument("--schema-drift", action="store_true")
+    api_twin_serve.set_defaults(func=cmd_api_twin_serve)
+    api_twin_verify = api_twin_sub.add_parser("verify", help="Validate a fixture against a live response")
+    api_twin_verify.add_argument("--name", required=True)
+    api_twin_verify.add_argument("--endpoint", default="default")
+    api_twin_verify.add_argument("--cassette-version", default="v1")
+    api_twin_verify.add_argument("--live-response-json", required=True)
+    api_twin_verify.set_defaults(func=cmd_api_twin_verify)
+
+    preflight = sub.add_parser("preflight", help="Structured OMG preflight routing")
+    preflight.add_argument("--goal", required=True)
+    preflight.set_defaults(func=cmd_preflight)
+
+    domain_pack = sub.add_parser("domain-pack", help="Inspect optional domain pack contracts")
+    domain_pack.add_argument("--name", required=True, choices=["robotics", "vision", "algorithms", "health"])
+    domain_pack.set_defaults(func=cmd_domain_pack)
+
+    tracebank = sub.add_parser("tracebank", help="Record structured route traces")
+    tracebank.add_argument("--trace-type", required=True)
+    tracebank.add_argument("--route", required=True)
+    tracebank.add_argument("--status", default="ok")
+    tracebank.add_argument("--plan-json", default="")
+    tracebank.add_argument("--verify-json", default="")
+    tracebank.set_defaults(func=cmd_trace_record)
+
+    eval_gate = sub.add_parser("eval-gate", help="Evaluate a trace for release gating")
+    eval_gate.add_argument("--trace-id", required=True)
+    eval_gate.add_argument("--suites", required=True, help="Comma-separated suite names")
+    eval_gate.add_argument("--metrics-json", required=True)
+    eval_gate.set_defaults(func=cmd_eval_gate)
+
+    delta = sub.add_parser("delta-classifier", help="Classify repo changes for routing and policy")
+    delta.add_argument("--goal", default="")
+    delta.add_argument("--files", default="")
+    delta.set_defaults(func=cmd_delta_classify)
+
+    incident = sub.add_parser("incident-replay", help="Build an incident replay pack")
+    incident.add_argument("--title", required=True)
+    incident.add_argument("--failing-tests", default="")
+    incident.add_argument("--logs", default="")
+    incident.add_argument("--diff-summary-json", required=True)
+    incident.add_argument("--trace-id", default="")
+    incident.set_defaults(func=cmd_incident_replay)
+
+    lineage = sub.add_parser("data-lineage", help="Build lineage metadata for generated artifacts")
+    lineage.add_argument("--artifact-type", required=True)
+    lineage.add_argument("--sources-json", required=True)
+    lineage.add_argument("--privacy", required=True)
+    lineage.add_argument("--license-name", required=True)
+    lineage.add_argument("--derivation-json", required=True)
+    lineage.add_argument("--trace-id", default="")
+    lineage.set_defaults(func=cmd_lineage)
+
+    supervisor = sub.add_parser("remote-supervisor", help="Local-only authenticated supervisor session helpers")
+    supervisor_sub = supervisor.add_subparsers(dest="remote_supervisor_command", required=True)
+    supervisor_issue = supervisor_sub.add_parser("issue", help="Issue a local supervisor session")
+    supervisor_issue.add_argument("--worker-id", required=True)
+    supervisor_issue.add_argument("--shared-secret", required=True)
+    supervisor_issue.set_defaults(func=cmd_supervisor_issue)
+    supervisor_verify = supervisor_sub.add_parser("verify", help="Verify a supervisor session token")
+    supervisor_verify.add_argument("--token", required=True)
+    supervisor_verify.add_argument("--shared-secret", required=True)
+    supervisor_verify.set_defaults(func=cmd_supervisor_verify)
+
     maintainer = sub.add_parser("maintainer", help="OSS maintainer evidence helper")
     maintainer.add_argument("--mode", default="impact", choices=["triage", "release", "review", "impact"])
     maintainer.set_defaults(func=cmd_maintainer)
@@ -479,6 +831,12 @@ def build_parser() -> argparse.ArgumentParser:
     ecosystem = sub.add_parser("ecosystem", help="Upstream ecosystem sync and status")
     _add_ecosystem_subcommands(ecosystem, dest="ecosystem_command")
 
+    contract = sub.add_parser("contract", help="Canonical OMG contract validation and compilation")
+    _add_contract_subcommands(contract, dest="contract_command")
+
+    release = sub.add_parser("release", help="OMG release-readiness checks")
+    _add_release_subcommands(release, dest="release_command")
+
     return parser