@trac3er/oh-my-god 2.0.3 → 2.0.5

package/control_plane/service.py

@@ -0,0 +1,185 @@
+"""Control plane service handlers for OMG v1."""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import os
+from typing import Any
+
+from hooks.policy_engine import (
+    evaluate_bash_command,
+    evaluate_file_access,
+    evaluate_supply_artifact,
+)
+from hooks.security_validators import validate_opaque_identifier
+from hooks.shadow_manager import create_evidence_pack
+from hooks.trust_review import review_config_change
+from lab.pipeline import run_pipeline
+from registry.verify_artifact import verify_artifact
+from runtime.guide_assert import guide_assert
+from runtime.dispatcher import dispatch_runtime
+from runtime.security_check import run_security_check
+
+
+class ControlPlaneService:
+    def __init__(self, project_dir: str | None = None):
+        self.project_dir = project_dir or os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
+
+    def policy_evaluate(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+        tool = str(payload.get("tool", ""))
+        input_data = payload.get("input", {})
+
+        if tool == "Bash":
+            command = str((input_data or {}).get("command", ""))
+            decision = evaluate_bash_command(command)
+            return 200, decision.to_dict()
+
+        if tool in {"Read", "Write", "Edit", "MultiEdit"}:
+            file_path = str((input_data or {}).get("file_path", ""))
+            decision = evaluate_file_access(tool, file_path)
+            return 200, decision.to_dict()
+
+        if tool == "SupplyArtifact":
+            artifact = payload.get("artifact", {})
+            mode = str(payload.get("mode", "warn_and_run"))
+            decision = evaluate_supply_artifact(artifact, mode=mode)
+            return 200, decision.to_dict()
+
+        return 400, {
+            "status": "error",
+            "error_code": "INVALID_POLICY_INPUT",
+            "message": "Unsupported tool for policy evaluation",
+        }
+
+    def trust_review(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+        file_path = str(payload.get("file_path", "settings.json"))
+        old_config = payload.get("old_config", {})
+        new_config = payload.get("new_config", {})
+        if not isinstance(old_config, dict) or not isinstance(new_config, dict):
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_TRUST_INPUT",
+                "message": "old_config and new_config must be objects",
+            }
+        review = review_config_change(file_path, old_config, new_config)
+        return 200, review
+
+    def evidence_ingest(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+        run_id = str(payload.get("run_id", "")).strip()
+        required = ["tests", "security_scans", "diff_summary", "reproducibility", "unresolved_risks"]
+        missing = [key for key in required if key not in payload]
+
+        if not run_id:
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_EVIDENCE_INPUT",
+                "message": "run_id is required",
+            }
+        try:
+            run_id = validate_opaque_identifier(run_id, "run_id")
+        except ValueError as exc:
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_EVIDENCE_INPUT",
+                "message": str(exc),
+            }
+        if missing:
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_EVIDENCE_INPUT",
+                "message": f"Missing required fields: {', '.join(missing)}",
+            }
+
+        path = create_evidence_pack(
+            self.project_dir,
+            run_id,
+            tests=payload.get("tests"),
+            security_scans=payload.get("security_scans"),
+            diff_summary=payload.get("diff_summary"),
+            reproducibility=payload.get("reproducibility"),
+            unresolved_risks=payload.get("unresolved_risks"),
+            provenance=payload.get("provenance"),
+            trust_scores=payload.get("trust_scores"),
+            api_twin=payload.get("api_twin"),
+            route_metadata=payload.get("route_metadata"),
+            trace_ids=payload.get("trace_ids"),
+            lineage=payload.get("lineage"),
+        )
+        return 202, {
+            "status": "accepted",
+            "run_id": run_id,
+            "evidence_path": os.path.relpath(path, self.project_dir),
+        }
+
+    def security_check(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+        scope = str(payload.get("scope", "."))
+        include_live_enrichment = bool(payload.get("include_live_enrichment", False))
+        result = run_security_check(
+            project_dir=self.project_dir,
+            scope=scope,
+            include_live_enrichment=include_live_enrichment,
+        )
+        return 200, result
+
+    def guide_assert(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+        candidate = str(payload.get("candidate", ""))
+        rules = payload.get("rules", {})
+        if not isinstance(rules, dict):
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_GUIDE_INPUT",
+                "message": "rules must be an object",
+            }
+        return 200, guide_assert(candidate, rules)
+
+    def runtime_dispatch(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+        runtime = str(payload.get("runtime", "")).strip()
+        idea = payload.get("idea", {})
+        if not runtime:
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_RUNTIME_INPUT",
+                "message": "runtime is required",
+            }
+        if not isinstance(idea, dict):
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_RUNTIME_INPUT",
+                "message": "idea must be an object",
+            }
+        result = dispatch_runtime(runtime, idea)
+        if result.get("status") == "error":
+            return 400, result
+        return 200, result
+
+    def registry_verify(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+        artifact = payload.get("artifact", {})
+        mode = str(payload.get("mode", "warn_and_run"))
+        if not isinstance(artifact, dict):
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_REGISTRY_INPUT",
+                "message": "artifact must be an object",
+            }
+        decision = verify_artifact(artifact, mode=mode)
+        return 200, decision
+
+    def lab_jobs(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+        if not isinstance(payload, dict):
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_LAB_INPUT",
+                "message": "job payload must be an object",
+            }
+        result = run_pipeline(payload)
+        return 201 if result.get("status") in {"ready", "failed_evaluation"} else 400, result
+
+    def scoreboard_baseline(self) -> tuple[int, dict[str, Any]]:
+        return 200, {
+            "generated_at": datetime.now(timezone.utc).isoformat(),
+            "baseline": {
+                "safe_autonomy_rate": 0.0,
+                "pr_throughput": 0.0,
+                "adoption_velocity": 0.0,
+            },
+            "target_policy": "non-regression-or-better",
+        }

package/dist/enterprise/bundle/.agents/skills/omg/AGENTS.fragment.md

@@ -0,0 +1,5 @@
+# OMG Codex Protection Rules
+
+- Channel: `enterprise`
+- Protect `.omg/`, `.agents/`, `.codex/`, and `.claude/` from unreviewed mutation.
+- Require explicit invocation for production-control-plane skills.

package/dist/enterprise/bundle/.agents/skills/omg/algorithms/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-algorithms
+description: "Determinism and benchmark attachments for algorithm-heavy work."
+---
+
+# OMG Algorithms Pack
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evals/latest.json`

package/dist/enterprise/bundle/.agents/skills/omg/algorithms/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-algorithms
+description: "Determinism and benchmark attachments for algorithm-heavy work."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: algorithms
+  title: "OMG Algorithms Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/dist/enterprise/bundle/.agents/skills/omg/api-twin/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-api-twin
+description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
+---
+
+# OMG API Twin
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/state/api_twin.json`

package/dist/enterprise/bundle/.agents/skills/omg/api-twin/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-api-twin
+description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: api-twin
+  title: "OMG API Twin"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/codex-mcp.toml

@@ -0,0 +1,4 @@
+[mcp_servers.omg-control]
+command = "python3"
+args = ["-m", "runtime.omg_mcp_server"]
+

package/dist/enterprise/bundle/.agents/skills/omg/control-plane/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-control-plane
+description: "Canonical production control plane bundle for Claude and Codex."
+---
+
+# OMG Control Plane
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control, omg-memory`
+- Evidence outputs: `.omg/evidence/control-plane-compile.json`

package/dist/enterprise/bundle/.agents/skills/omg/control-plane/openai.yaml

@@ -0,0 +1,14 @@
+name: omg-control-plane
+description: "Canonical production control plane bundle for Claude and Codex."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: control-plane
+  title: "OMG Control Plane"
+mcp_servers:
+  - omg-control
+  - omg-memory
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/data-lineage/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-data-lineage
+description: "Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts."
+---
+
+# OMG Data Lineage
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/lineage/*.json`

package/dist/enterprise/bundle/.agents/skills/omg/data-lineage/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-data-lineage
+description: "Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts."
+allow_implicit_invocation: true
+metadata:
+  channel: enterprise
+  bundle_id: data-lineage
+  title: "OMG Data Lineage"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/delta-classifier/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-delta-classifier
+description: "Change classifier that attaches risk-aware checks, approvals, and packs."
+---
+
+# OMG Delta Classifier
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/tracebank/events.jsonl`

package/dist/enterprise/bundle/.agents/skills/omg/delta-classifier/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-delta-classifier
+description: "Change classifier that attaches risk-aware checks, approvals, and packs."
+allow_implicit_invocation: true
+metadata:
+  channel: enterprise
+  bundle_id: delta-classifier
+  title: "OMG Delta Classifier"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"

package/dist/enterprise/bundle/.agents/skills/omg/eval-gate/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-eval-gate
+description: "Reproducible evaluation gate that blocks regressions before release."
+---
+
+# OMG Eval Gate
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evals/latest.json`

package/dist/enterprise/bundle/.agents/skills/omg/eval-gate/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-eval-gate
+description: "Reproducible evaluation gate that blocks regressions before release."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: eval-gate
+  title: "OMG Eval Gate"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/health/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-health
+description: "Health-sensitive approvals, provenance, and replay attachments."
+---
+
+# OMG Health Pack
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/lineage/*.json`

package/dist/enterprise/bundle/.agents/skills/omg/health/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-health
+description: "Health-sensitive approvals, provenance, and replay attachments."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: health
+  title: "OMG Health Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/dist/enterprise/bundle/.agents/skills/omg/hook-governor/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-hook-governor
+description: "Canonical hook ordering, policy reinjection, and protected-path governance."
+---
+
+# OMG Hook Governor
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/state/ledger/tool-ledger.jsonl`

package/dist/enterprise/bundle/.agents/skills/omg/hook-governor/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-hook-governor
+description: "Canonical hook ordering, policy reinjection, and protected-path governance."
+allow_implicit_invocation: true
+metadata:
+  channel: enterprise
+  bundle_id: hook-governor
+  title: "OMG Hook Governor"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/dist/enterprise/bundle/.agents/skills/omg/incident-replay/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-incident-replay
+description: "Replayable bug packs built from logs, failing tests, traces, and diffs."
+---
+
+# OMG Incident Replay
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/incidents/*.json`

package/dist/enterprise/bundle/.agents/skills/omg/incident-replay/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-incident-replay
+description: "Replayable bug packs built from logs, failing tests, traces, and diffs."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: incident-replay
+  title: "OMG Incident Replay"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/lsp-pack/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-lsp-pack
+description: "Optional LSP-backed diagnostics and navigation bundle for production verification."
+---
+
+# OMG LSP Pack
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/lsp-diagnostics.json`

package/dist/enterprise/bundle/.agents/skills/omg/lsp-pack/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-lsp-pack
+description: "Optional LSP-backed diagnostics and navigation bundle for production verification."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: lsp-pack
+  title: "OMG LSP Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/dist/enterprise/bundle/.agents/skills/omg/mcp-fabric/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-mcp-fabric
+description: "Tools, prompts, resources, and server instructions for the OMG control plane."
+---
+
+# OMG MCP Fabric
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control, omg-memory`
+- Evidence outputs: `.omg/evidence/mcp-fabric.json`

package/dist/enterprise/bundle/.agents/skills/omg/mcp-fabric/openai.yaml

@@ -0,0 +1,13 @@
+name: omg-mcp-fabric
+description: "Tools, prompts, resources, and server instructions for the OMG control plane."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: mcp-fabric
+  title: "OMG MCP Fabric"
+mcp_servers:
+  - omg-control
+  - omg-memory
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/preflight/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-preflight
+description: "Repo-aware route selection based on diff, manifests, and classified risk."
+---
+
+# OMG Preflight
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/tracebank/events.jsonl`

package/dist/enterprise/bundle/.agents/skills/omg/preflight/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-preflight
+description: "Repo-aware route selection based on diff, manifests, and classified risk."
+allow_implicit_invocation: true
+metadata:
+  channel: enterprise
+  bundle_id: preflight
+  title: "OMG Preflight"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"

package/dist/enterprise/bundle/.agents/skills/omg/remote-supervisor/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-remote-supervisor
+description: "Local-only authenticated supervisor sessions for worker orchestration."
+---
+
+# OMG Remote Supervisor
+
+- Channel: `enterprise`
+- Execution modes: `local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/supervisor/sessions/*.json`

package/dist/enterprise/bundle/.agents/skills/omg/remote-supervisor/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-remote-supervisor
+description: "Local-only authenticated supervisor sessions for worker orchestration."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: remote-supervisor
+  title: "OMG Remote Supervisor"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/robotics/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-robotics
+description: "Robotics safety policy, replay, and evaluation attachments."
+---
+
+# OMG Robotics Pack
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/incidents/*.json`

package/dist/enterprise/bundle/.agents/skills/omg/robotics/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-robotics
+description: "Robotics safety policy, replay, and evaluation attachments."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: robotics
+  title: "OMG Robotics Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/dist/enterprise/bundle/.agents/skills/omg/secure-worktree-pipeline/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-secure-worktree-pipeline
+description: "Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs."
+---
+
+# OMG Secure Worktree Pipeline
+
+- Channel: `enterprise`
+- Execution modes: `automation, ephemeral_worktree, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/subagents/*.json`

package/dist/enterprise/bundle/.agents/skills/omg/secure-worktree-pipeline/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-secure-worktree-pipeline
+description: "Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: secure-worktree-pipeline
+  title: "OMG Secure Worktree Pipeline"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(git:*)"

package/dist/enterprise/bundle/.agents/skills/omg/security-check/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-security-check
+description: "Canonical security audit bundle with provenance, trust scoring, and deterministic evidence."
+---
+
+# OMG Security Check
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/security-check-*.json`

package/dist/enterprise/bundle/.agents/skills/omg/security-check/openai.yaml

@@ -0,0 +1,13 @@
+name: omg-security-check
+description: "Canonical security audit bundle with provenance, trust scoring, and deterministic evidence."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: security-check
+  title: "OMG Security Check"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/tracebank/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-tracebank
+description: "Structured plan-to-patch-to-verify trace capture for OMG routes."
+---
+
+# OMG Tracebank
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/tracebank/events.jsonl`

package/dist/enterprise/bundle/.agents/skills/omg/tracebank/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-tracebank
+description: "Structured plan-to-patch-to-verify trace capture for OMG routes."
+allow_implicit_invocation: true
+metadata:
+  channel: enterprise
+  bundle_id: tracebank
+  title: "OMG Tracebank"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/vision/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-vision
+description: "Vision-specific lineage, drift, and replay attachments."
+---
+
+# OMG Vision Pack
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/lineage/*.json`