@trac3er/oh-my-god 2.0.4 → 2.0.7

package/runtime/data_lineage.py

@@ -0,0 +1,73 @@
+"""Lineage manifests for generated OMG artifacts."""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import json
+from pathlib import Path
+from typing import Any
+from uuid import uuid4
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def build_lineage_manifest(
+    project_dir: str,
+    *,
+    artifact_type: str,
+    sources: list[dict[str, Any]],
+    privacy: str,
+    license: str,
+    derivation: dict[str, Any],
+    trace_id: str | None = None,
+) -> dict[str, Any]:
+    lineage_id = f"lineage-{uuid4().hex}"
+    payload = {
+        "schema": "DataLineageManifest",
+        "lineage_id": lineage_id,
+        "generated_at": _now(),
+        "artifact_type": artifact_type,
+        "sources": sources,
+        "privacy": privacy,
+        "license": license,
+        "derivation": derivation,
+        "trace_id": trace_id or "",
+    }
+    validation = validate_lineage_manifest(payload)
+    payload["status"] = validation["status"]
+    payload["errors"] = validation["errors"]
+
+    rel_path = Path(".omg") / "lineage" / f"{lineage_id}.json"
+    path = Path(project_dir) / rel_path
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+    payload["path"] = rel_path.as_posix()
+    return payload
+
+
+def validate_lineage_manifest(payload: dict[str, Any]) -> dict[str, Any]:
+    errors: list[str] = []
+    if not payload.get("artifact_type"):
+        errors.append("artifact_type is required")
+    if not payload.get("privacy"):
+        errors.append("privacy is required")
+    if not payload.get("license"):
+        errors.append("license is required")
+    sources = payload.get("sources", [])
+    if not isinstance(sources, list) or not sources:
+        errors.append("sources are required")
+    else:
+        for idx, source in enumerate(sources):
+            if not isinstance(source, dict):
+                errors.append(f"source {idx} must be an object")
+                continue
+            if not source.get("license"):
+                errors.append(f"source {idx} missing license")
+            if not source.get("path"):
+                errors.append(f"source {idx} missing path")
+    return {
+        "schema": "DataLineageValidationResult",
+        "status": "ok" if not errors else "error",
+        "errors": errors,
+    }

package/runtime/delta_classifier.py

@@ -0,0 +1,81 @@
+"""Repo-aware change classification for routing and policy attachment."""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import subprocess
+from typing import Any
+
+
+_CATEGORY_RULES: dict[str, tuple[str, ...]] = {
+    "auth": ("auth", "token", "secret", "login", "credential"),
+    "payment": ("payment", "billing", "invoice", "stripe", "checkout"),
+    "db": ("migration", "schema", "database", "sql", "postgres", "mysql"),
+    "infra": ("terraform", ".tf", "deploy", "helm", "k8s", "docker"),
+    "api": ("openapi", "swagger", "postman", "endpoint", "api"),
+    "data": ("dataset", "lineage", "privacy", "warehouse", "etl"),
+    "compliance": ("gdpr", "hipaa", "pci", "soc2", "privacy"),
+    "robotics": ("robot", "actuator", "sensor", "simulator"),
+    "vision": ("vision", "image", "camera", "cv"),
+    "health": ("health", "patient", "clinical", "medical"),
+    "algorithms": ("algorithm", "benchmark", "determinism", "complexity"),
+}
+
+
+def classify_project_changes(
+    project_dir: str,
+    *,
+    touched_files: list[str] | None = None,
+    goal: str = "",
+) -> dict[str, Any]:
+    files = touched_files if touched_files is not None else _discover_files(project_dir)
+    manifest_names = sorted(path.name for path in Path(project_dir).glob("*") if path.is_file())
+    haystacks = [goal.lower(), *[file.lower() for file in files], *[name.lower() for name in manifest_names]]
+
+    categories = {
+        category
+        for category, tokens in _CATEGORY_RULES.items()
+        if any(token in haystack for token in tokens for haystack in haystacks)
+    }
+    if not categories:
+        categories.add("implementation")
+
+    result = {
+        "schema": "DeltaClassification",
+        "project_dir": project_dir,
+        "goal": goal,
+        "categories": sorted(categories),
+        "touched_files": files,
+        "manifests": manifest_names,
+    }
+    return result
+
+
+def _discover_files(project_dir: str) -> list[str]:
+    root = Path(project_dir)
+    git_dir = root / ".git"
+    if git_dir.exists():
+        proc = subprocess.run(
+            ["git", "diff", "--name-only", "HEAD"],
+            cwd=str(root),
+            capture_output=True,
+            text=True,
+            check=False,
+            timeout=10,
+        )
+        if proc.returncode == 0:
+            files = [line.strip() for line in proc.stdout.splitlines() if line.strip()]
+            if files:
+                return files
+
+    discovered: list[str] = []
+    for path in sorted(root.rglob("*")):
+        if not path.is_file():
+            continue
+        rel = path.relative_to(root).as_posix()
+        if rel.startswith(".omg/"):
+            continue
+        discovered.append(rel)
+        if len(discovered) >= 32:
+            break
+    return discovered

package/runtime/domain_packs.py

@@ -9,21 +9,33 @@ DOMAIN_PACKS: dict[str, dict[str, Any]] = {
         "name": "robotics",
         "required_approvals": ["actuation-approval"],
         "required_evidence": ["simulator-replay", "kill-switch-check"],
+        "policy_modules": ["safe-actuation", "simulator-gate"],
+        "eval_hooks": ["robotics-sim"],
+        "replay_hooks": ["incident-replay"],
     },
     "vision": {
         "name": "vision",
         "required_approvals": [],
         "required_evidence": ["dataset-provenance", "drift-check"],
+        "policy_modules": ["dataset-lineage", "drift-gate"],
+        "eval_hooks": ["vision-regression"],
+        "replay_hooks": ["incident-replay"],
     },
     "algorithms": {
         "name": "algorithms",
         "required_approvals": [],
         "required_evidence": ["benchmark-harness", "determinism-check"],
+        "policy_modules": ["benchmark-gate", "determinism-gate"],
+        "eval_hooks": ["algorithm-benchmarks"],
+        "replay_hooks": ["incident-replay"],
     },
     "health": {
         "name": "health",
         "required_approvals": ["human-review"],
         "required_evidence": ["audit-trail", "restricted-tools", "provenance"],
+        "policy_modules": ["human-review", "privacy-gate"],
+        "eval_hooks": ["health-safety"],
+        "replay_hooks": ["incident-replay"],
     },
 }
 

package/runtime/ecosystem.py

@@ -8,7 +8,7 @@ import subprocess
 from typing import Any
 
 ECOSYSTEM_SCHEMA = "OmgEcosystemCatalog"
-ECOSYSTEM_CATALOG_VERSION = "1.0.0"
+ECOSYSTEM_CATALOG_VERSION = "2.0.7"
 ECOSYSTEM_LOCK_SCHEMA = "OmgEcosystemLock"
 DEFAULT_ECOSYSTEM_REPO_DIR = ".omg/ecosystem/repos"
 DEFAULT_ECOSYSTEM_LOCK_PATH = ".omg/state/ecosystem-lock.json"

package/runtime/eval_gate.py

@@ -0,0 +1,96 @@
+"""Reproducible evaluation results for release gating."""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import getpass
+import json
+import os
+from pathlib import Path
+import platform
+import socket
+from typing import Any
+from uuid import uuid4
+
+
+EVAL_GATE_LATEST_REL_PATH = Path(".omg") / "evals" / "latest.json"
+EVAL_GATE_HISTORY_REL_PATH = Path(".omg") / "evals" / "history.jsonl"
+EVAL_GATE_TRACE_LINKS_REL_PATH = Path(".omg") / "evals" / "trace-links.jsonl"
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _executor() -> dict[str, str | int]:
+    return {
+        "user": getpass.getuser(),
+        "pid": os.getpid(),
+    }
+
+
+def _environment() -> dict[str, str]:
+    return {
+        "hostname": socket.gethostname(),
+        "platform": platform.platform(),
+    }
+
+
+def evaluate_trace(
+    project_dir: str,
+    *,
+    trace_id: str,
+    suites: list[str],
+    metrics: dict[str, float],
+    lineage: dict[str, Any] | None = None,
+    regression_threshold: float = 0.95,
+) -> dict[str, Any]:
+    eval_id = f"eval-{uuid4().hex}"
+    scorecard = {name: float(metrics.get(name, 0.0)) for name in suites}
+    regressed = any(score < regression_threshold for score in scorecard.values())
+    result = {
+        "schema": "EvalGateResult",
+        "eval_id": eval_id,
+        "trace_id": trace_id,
+        "lineage": lineage or {},
+        "evaluated_at": _now(),
+        "timestamp": _now(),
+        "executor": _executor(),
+        "environment": _environment(),
+        "status": "fail" if regressed else "ok",
+        "suites": suites,
+        "metrics": scorecard,
+        "summary": {
+            "regressed": regressed,
+            "regression_threshold": regression_threshold,
+        },
+    }
+
+    latest_path = Path(project_dir) / EVAL_GATE_LATEST_REL_PATH
+    latest_path.parent.mkdir(parents=True, exist_ok=True)
+    _ = latest_path.write_text(json.dumps(result, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+
+    _ = link_trace(project_dir, eval_id=eval_id, trace_id=trace_id)
+
+    history_path = Path(project_dir) / EVAL_GATE_HISTORY_REL_PATH
+    with history_path.open("a", encoding="utf-8") as handle:
+        _ = handle.write(json.dumps(result, ensure_ascii=True) + "\n")
+
+    result["path"] = EVAL_GATE_LATEST_REL_PATH.as_posix()
+    return result
+
+
+def link_trace(project_dir: str, *, eval_id: str, trace_id: str) -> dict[str, Any]:
+    link = {
+        "schema": "EvalTraceLink",
+        "eval_id": eval_id,
+        "trace_id": trace_id,
+        "timestamp": _now(),
+        "executor": _executor(),
+        "environment": _environment(),
+    }
+    path = Path(project_dir) / EVAL_GATE_TRACE_LINKS_REL_PATH
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("a", encoding="utf-8") as handle:
+        _ = handle.write(json.dumps(link, ensure_ascii=True) + "\n")
+    link["path"] = EVAL_GATE_TRACE_LINKS_REL_PATH.as_posix()
+    return link

package/runtime/incident_replay.py

@@ -0,0 +1,47 @@
+"""Replayable incident pack generation."""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import json
+from pathlib import Path
+from typing import Any
+from uuid import uuid4
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def build_incident_pack(
+    project_dir: str,
+    *,
+    title: str,
+    failing_tests: list[str],
+    logs: list[str],
+    diff_summary: dict[str, Any],
+    trace_id: str | None = None,
+) -> dict[str, Any]:
+    incident_id = f"incident-{uuid4().hex}"
+    payload = {
+        "schema": "IncidentReplayPack",
+        "incident_id": incident_id,
+        "title": title,
+        "generated_at": _now(),
+        "trace_id": trace_id or "",
+        "failing_tests": failing_tests,
+        "logs": logs,
+        "diff_summary": diff_summary,
+        "reproduction_steps": [
+            "Replay the failing tests.",
+            "Inspect the attached logs.",
+            "Validate the diff summary before patching.",
+        ],
+        "regression_guards": failing_tests,
+    }
+
+    rel_path = Path(".omg") / "incidents" / f"{incident_id}.json"
+    path = Path(project_dir) / rel_path
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+    payload["path"] = rel_path.as_posix()
+    return payload

package/runtime/mcp_config_writers.py

@@ -35,6 +35,18 @@ def _write_json(path: Path, data: dict[str, object]) -> None:
     _atomic_write_text(path, json.dumps(data, indent=2) + "\n")
 
 
+def get_managed_python_path(claude_config_dir: str | None = None) -> str:
+    """Return the absolute path to the managed OMG venv Python interpreter.
+
+    Falls back to ``CLAUDE_CONFIG_DIR`` env var, then ``~/.claude``.
+    """
+    if claude_config_dir is None:
+        claude_config_dir = os.environ.get(
+            "CLAUDE_CONFIG_DIR", str(Path.home() / ".claude")
+        )
+    return str(Path(claude_config_dir) / "omg-runtime" / ".venv" / "bin" / "python")
+
+
 def _validated_server_input(server_url: str, server_name: str) -> tuple[str, str]:
     return validate_server_url(server_url), validate_server_name(server_name)
 

package/runtime/mcp_lifecycle.py

@@ -87,16 +87,24 @@ def start_memory_server() -> dict[str, Any]:
             stderr=subprocess.DEVNULL,
         )
 
-        pid_path.write_text(str(proc.pid))
-
         health_url = get_server_url().replace("/mcp", "/health")
         if _wait_for_health(health_url):
+            pid_path.write_text(str(proc.pid))
             return {"status": "started", "pid": proc.pid, "url": get_server_url()}
-        else:
-            return {
-                "status": "error",
-                "message": "Server did not respond within timeout",
-            }
+        try:
+            proc.terminate()
+            proc.wait(timeout=2)
+        except Exception:
+            try:
+                proc.kill()
+            except Exception:
+                pass
+        if pid_path.exists():
+            pid_path.unlink()
+        return {
+            "status": "error",
+            "message": "Server did not respond within timeout",
+        }
     except Exception as exc:
         return {"status": "error", "message": str(exc)}
 
@@ -141,13 +149,27 @@ def check_memory_server() -> dict[str, Any]:
     }
 
 
+_HTTP_MEMORY_RESTRICTED_PRESETS = frozenset({"safe", "balanced"})
+
+
+def _get_current_preset() -> str:
+    return os.environ.get("OMG_PRESET", "safe")
+
+
 def ensure_memory_server() -> dict[str, Any]:
-    """Ensure the memory server is running (idempotent)."""
+    """Ensure the memory server is running (idempotent).
+
+    Skips startup when the active preset is ``safe`` or ``balanced`` —
+    HTTP memory is an opt-in surface starting at the ``interop`` tier.
+    """
+    preset = _get_current_preset()
+    if preset in _HTTP_MEMORY_RESTRICTED_PRESETS:
+        return {"status": "skipped", "reason": f"HTTP memory disabled for preset '{preset}'"}
     if is_server_running():
         return {"status": "already_running", "url": get_server_url()}
     return start_memory_server()
 
 
-# Feature flag: auto-start on import
+# Feature flag: auto-start on import (respects preset restrictions)
 if os.environ.get("OMG_MEMORY_AUTOSTART") == "1":
     ensure_memory_server()

package/runtime/mcp_memory_server.py

@@ -66,7 +66,7 @@ mcp = FastMCP("OMG Memory Server", lifespan=lifespan)
 
 @mcp.custom_route("/health", methods=["GET"])
 async def health(_: Request) -> JSONResponse:
-    return JSONResponse({"status": "ok", "version": "1.0.0"})
+    return JSONResponse({"status": "ok", "version": "2.0.7"})
 
 
 @mcp.tool()

package/runtime/omg_compat_contract_snapshot.json

@@ -1,6 +1,6 @@
 {
   "schema": "OmgCompatContractSnapshot",
-  "contract_version": "1.0.0",
+  "contract_version": "2.0.7",
   "count": 47,
   "contracts": [
     {

package/runtime/omg_contract_snapshot.json

@@ -1,6 +1,6 @@
 {
   "schema": "OmgCompatContractSnapshot",
-  "contract_version": "1.0.0",
+  "contract_version": "2.0.7",
   "count": 47,
   "contracts": [
     {

package/runtime/omg_mcp_server.py

@@ -7,12 +7,16 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
-_MCP_IMPORT_ERROR: ModuleNotFoundError | None = None
+from runtime.asset_loader import resolve_asset
+
+_mcp_import_error: ModuleNotFoundError | None = None
+_FastMCP: Any
 
 try:
-    from fastmcp import FastMCP
+    from fastmcp import FastMCP as _ImportedFastMCP
+    _FastMCP = _ImportedFastMCP
 except ModuleNotFoundError as exc:
-    _MCP_IMPORT_ERROR = exc
+    _mcp_import_error = exc
 
     def _passthrough_decorator(*_args: Any, **_kwargs: Any):
         def decorator(func: Any) -> Any:
@@ -34,9 +38,9 @@ except ModuleNotFoundError as exc:
         mime_type: str
         handler: Any
 
-    class FastMCP:  # type: ignore[override]
+    class _StubFastMCP:  # type: ignore[override]
         def __init__(self, *_args: Any, **_kwargs: Any) -> None:
-            self._import_error = _MCP_IMPORT_ERROR
+            self._import_error = _mcp_import_error
             self.instructions = str(_kwargs.get("instructions", ""))
             self._prompts: list[_StubPrompt] = []
             self._resources: dict[str, _StubResource] = {}
@@ -84,7 +88,10 @@ except ModuleNotFoundError as exc:
         def run(self, *_args: Any, **_kwargs: Any) -> None:
             raise RuntimeError("fastmcp is required to run the OMG MCP server") from self._import_error
 
-    FastMCP.__module__ = "fastmcp"
+    _StubFastMCP.__module__ = "fastmcp"
+    _FastMCP = _StubFastMCP
+
+FastMCP = _FastMCP
 
 from control_plane.service import ControlPlaneService
 
@@ -112,7 +119,7 @@ def _service() -> ControlPlaneService:
 
 
 def _read_repo_text(rel_path: str) -> str:
-    return (_root_dir() / rel_path).read_text(encoding="utf-8")
+    return resolve_asset(rel_path).read_text(encoding="utf-8")
 
 
 @mcp.tool()
@@ -162,8 +169,8 @@ def omg_runtime_dispatch(runtime: str, idea: dict[str, Any]) -> dict[str, Any]:
 
 
 @mcp.tool()
-def omg_security_check(scope: str = ".", include_live_enrichment: bool = False) -> dict[str, Any]:
-    _status, payload = _service().security_check({"scope": scope, "include_live_enrichment": include_live_enrichment})
+def omg_security_check(scope: str = ".", include_live_enrichment: bool = False, external_inputs: list[dict[str, Any]] | None = None, waivers: list[str] | None = None) -> dict[str, Any]:
+    _status, payload = _service().security_check({"scope": scope, "include_live_enrichment": include_live_enrichment, "external_inputs": external_inputs, "waivers": waivers})
     return payload