@trac3er/oh-my-god 2.0.4 → 2.0.7

package/runtime/team_router.py

@@ -363,12 +363,12 @@ def _read_working_memory(project_dir: str) -> str:
         return ""
 
     try:
-        with open(working_memory_path, "r") as f:
+        with open(working_memory_path, "r", encoding="utf-8", errors="replace") as f:
             content = f.read()
         if len(content) > 500:
             content = content[:500] + "..."
         return content
-    except OSError:
+    except (OSError, UnicodeDecodeError):
         return ""
 
 
@@ -379,12 +379,12 @@ def _read_profile_context(project_dir: str) -> str:
         return ""
 
     try:
-        with open(profile_path, "r") as f:
+        with open(profile_path, "r", encoding="utf-8", errors="replace") as f:
             content = f.read()
         if len(content) > 300:
             content = content[:300] + "..."
         return content
-    except OSError:
+    except (OSError, UnicodeDecodeError):
         return ""
 
 
@@ -402,7 +402,7 @@ def _read_failure_history(project_dir: str) -> str:
         failures = []
         for file_path in failure_files[-5:]:
             try:
-                with open(file_path, "r") as f:
+                with open(file_path, "r", encoding="utf-8", errors="replace") as f:
                     for line in f:
                         if line.strip():
                             entry = json.loads(line)
@@ -410,7 +410,7 @@ def _read_failure_history(project_dir: str) -> str:
                             failures.append(f"- {error_msg}")
                             if len(failures) >= 5:
                                 break
-            except (OSError, json.JSONDecodeError):
+            except (OSError, UnicodeDecodeError, json.JSONDecodeError):
                 continue
 
         if failures:

package/runtime/test_intent_lock.py

@@ -0,0 +1,91 @@
+from __future__ import annotations
+
+from typing import Any
+
+
+def evaluate_test_delta(delta: dict[str, Any]) -> dict[str, Any]:
+    override = delta.get("override")
+    if _has_override(override):
+        return {
+            "verdict": "pass",
+            "reasons": [],
+            "flags": ["override_present"],
+        }
+
+    old_tests = _normalize_tests(delta.get("old_tests"))
+    new_tests = _normalize_tests(delta.get("new_tests"))
+    touched_paths = _normalize_paths(delta.get("touched_paths"))
+
+    old_by_name = {item["name"]: item for item in old_tests}
+    reasons: list[str] = []
+    flags: list[str] = []
+
+    for new_test in new_tests:
+        name = new_test["name"]
+        old_test = old_by_name.get(name)
+        if not old_test:
+            continue
+
+        old_assertions = int(old_test.get("assertions", 0))
+        new_assertions = int(new_test.get("assertions", 0))
+        if new_assertions < old_assertions:
+            flags.append("weakened_assertions")
+            reasons.append(
+                f"test '{name}' reduced assertions from {old_assertions} to {new_assertions}"
+            )
+
+        old_kind = str(old_test.get("kind", "")).strip().lower()
+        new_kind = str(new_test.get("kind", "")).strip().lower()
+        if old_kind == "integration" and new_kind == "mock":
+            flags.append("integration_to_mock_downgrade")
+            reasons.append(f"test '{name}' downgraded from integration to mock")
+
+    if touched_paths and old_tests and not new_tests:
+        flags.append("removed_touched_area_coverage")
+        reasons.append("all tests for touched paths were removed from test delta")
+
+    if touched_paths and new_tests and all(str(item.get("kind", "")).strip().lower() == "snapshot" for item in new_tests):
+        flags.append("snapshot_only_refresh")
+        reasons.append("delta contains only snapshot tests for touched paths")
+
+    unique_flags = list(dict.fromkeys(flags))
+    return {
+        "verdict": "fail" if reasons else "pass",
+        "reasons": reasons,
+        "flags": unique_flags,
+    }
+
+
+def _has_override(value: Any) -> bool:
+    return isinstance(value, dict) and bool(value)
+
+
+def _normalize_paths(value: Any) -> list[str]:
+    if not isinstance(value, list):
+        return []
+    return [str(item).strip() for item in value if str(item).strip()]
+
+
+def _normalize_tests(value: Any) -> list[dict[str, Any]]:
+    if not isinstance(value, list):
+        return []
+    tests: list[dict[str, Any]] = []
+    for item in value:
+        if not isinstance(item, dict):
+            continue
+        name = str(item.get("name", "")).strip()
+        if not name:
+            continue
+        assertions = item.get("assertions", 0)
+        try:
+            assertions_value = int(assertions)
+        except (TypeError, ValueError):
+            assertions_value = 0
+        tests.append(
+            {
+                "name": name,
+                "kind": str(item.get("kind", "")).strip(),
+                "assertions": max(assertions_value, 0),
+            }
+        )
+    return tests

package/runtime/tracebank.py

@@ -0,0 +1,95 @@
+"""Structured trace capture for OMG routes and release evidence."""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import getpass
+import json
+import os
+from pathlib import Path
+import platform
+import socket
+from typing import Any
+from uuid import uuid4
+
+
+TRACEBANK_REL_PATH = Path(".omg") / "tracebank" / "events.jsonl"
+TRACEBANK_EVIDENCE_LINKS_REL_PATH = Path(".omg") / "tracebank" / "evidence-links.jsonl"
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _executor() -> dict[str, str | int]:
+    return {
+        "user": getpass.getuser(),
+        "pid": os.getpid(),
+    }
+
+
+def _environment() -> dict[str, str]:
+    return {
+        "hostname": socket.gethostname(),
+        "platform": platform.platform(),
+    }
+
+
+def record_trace(
+    project_dir: str,
+    *,
+    trace_type: str,
+    route: str,
+    status: str,
+    plan: dict[str, Any] | None = None,
+    patch: dict[str, Any] | None = None,
+    verify: dict[str, Any] | None = None,
+    failures: list[dict[str, Any]] | None = None,
+    rejections: list[dict[str, Any]] | None = None,
+    metadata: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    trace_id = f"trace-{uuid4().hex}"
+    timestamp = _now()
+    record = {
+        "schema": "TracebankRecord",
+        "trace_id": trace_id,
+        "timestamp": timestamp,
+        "recorded_at": _now(),
+        "executor": _executor(),
+        "environment": _environment(),
+        "trace_type": trace_type,
+        "route": route,
+        "status": status,
+        "plan": plan or {},
+        "patch": patch or {},
+        "verify": verify or {},
+        "failures": failures or [],
+        "rejections": rejections or [],
+        "metadata": metadata or {},
+    }
+
+    path = Path(project_dir) / TRACEBANK_REL_PATH
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("a", encoding="utf-8") as handle:
+        _ = handle.write(json.dumps(record, ensure_ascii=True) + "\n")
+
+    record["path"] = TRACEBANK_REL_PATH.as_posix()
+    return record
+
+
+def link_evidence(project_dir: str, *, trace_id: str, evidence_path: str) -> dict[str, Any]:
+    link = {
+        "schema": "TraceEvidenceLink",
+        "trace_id": trace_id,
+        "evidence_path": evidence_path,
+        "timestamp": _now(),
+        "executor": _executor(),
+        "environment": _environment(),
+    }
+
+    path = Path(project_dir) / TRACEBANK_EVIDENCE_LINKS_REL_PATH
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("a", encoding="utf-8") as handle:
+        _ = handle.write(json.dumps(link, ensure_ascii=True) + "\n")
+
+    link["path"] = TRACEBANK_EVIDENCE_LINKS_REL_PATH.as_posix()
+    return link

package/runtime/untrusted_content.py

@@ -1,13 +1,18 @@
 """State and provenance tracking for untrusted external content."""
 from __future__ import annotations
 
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from hashlib import sha256
 import json
 from pathlib import Path
 import re
+from enum import Enum
 from typing import Any
 
 
 STATE_REL_PATH = Path(".omg") / "state" / "untrusted-content.json"
+EVIDENCE_REL_DIR = Path(".omg") / "evidence"
 _INSTRUCTION_PATTERNS: tuple[re.Pattern[str], ...] = (
     re.compile(r"ignore\s+previous\s+instructions", re.IGNORECASE),
     re.compile(r"\b(system|assistant|developer)\s*:", re.IGNORECASE),
@@ -15,32 +20,194 @@ _INSTRUCTION_PATTERNS: tuple[re.Pattern[str], ...] = (
 )
 
 
+class TrustTier(str, Enum):
+    LOCAL = "local"
+    BALANCED = "balanced"
+    RESEARCH = "research"
+    BROWSER = "browser"
+
+
+@dataclass(frozen=True)
+class TrustTierConfig:
+    tier: TrustTier
+    label: str
+    score: float
+    trusted: bool
+
+
+TRUST_TIER_CONFIG: dict[TrustTier, TrustTierConfig] = {
+    TrustTier.LOCAL: TrustTierConfig(
+        tier=TrustTier.LOCAL,
+        label="TRUSTED_LOCAL_CONTENT",
+        score=1.0,
+        trusted=True,
+    ),
+    TrustTier.BALANCED: TrustTierConfig(
+        tier=TrustTier.BALANCED,
+        label="TRUSTED_LOCAL_CONTENT",
+        score=0.7,
+        trusted=True,
+    ),
+    TrustTier.RESEARCH: TrustTierConfig(
+        tier=TrustTier.RESEARCH,
+        label="UNTRUSTED_EXTERNAL_CONTENT",
+        score=0.0,
+        trusted=False,
+    ),
+    TrustTier.BROWSER: TrustTierConfig(
+        tier=TrustTier.BROWSER,
+        label="UNTRUSTED_EXTERNAL_CONTENT",
+        score=0.0,
+        trusted=False,
+    ),
+}
+
+
+_SOURCE_TO_TIER: dict[str, TrustTier] = {
+    "local": TrustTier.LOCAL,
+    "workspace": TrustTier.LOCAL,
+    "balanced": TrustTier.BALANCED,
+    "tool": TrustTier.BALANCED,
+    "web": TrustTier.RESEARCH,
+    "research": TrustTier.RESEARCH,
+    "mcp": TrustTier.RESEARCH,
+    "remote_document": TrustTier.RESEARCH,
+    "browser": TrustTier.BROWSER,
+    "dom": TrustTier.BROWSER,
+    "screenshot": TrustTier.BROWSER,
+}
+
+
+def normalize_trust_tier(tier: TrustTier | str) -> TrustTier:
+    if isinstance(tier, TrustTier):
+        return tier
+    normalized = str(tier).strip().lower()
+    if normalized in TrustTier._value2member_map_:
+        return TrustTier(normalized)
+    raise ValueError(f"Unsupported trust tier: {tier}")
+
+
+def trust_tier_for_source(source_type: str) -> TrustTier:
+    source_key = str(source_type).strip().lower()
+    return _SOURCE_TO_TIER.get(source_key, TrustTier.RESEARCH)
+
+
+def trust_tier_for_preset(preset: str) -> TrustTier:
+    mapping = {
+        "safe": TrustTier.LOCAL,
+        "balanced": TrustTier.BALANCED,
+        "interop": TrustTier.RESEARCH,
+        "labs": TrustTier.BROWSER,
+    }
+    return mapping.get(str(preset).strip().lower(), TrustTier.BALANCED)
+
+
+def tag_content(payload: Any, tier: TrustTier | str) -> dict[str, Any]:
+    normalized_tier = normalize_trust_tier(tier)
+    config = TRUST_TIER_CONFIG[normalized_tier]
+    tagged: dict[str, Any]
+    if isinstance(payload, dict):
+        tagged = dict(payload)
+    else:
+        tagged = {"content": payload}
+    tagged["_trust_tier"] = normalized_tier.value
+    tagged["_trust_label"] = config.label
+    tagged["_trust_score"] = config.score
+    return tagged
+
+
+def write_trust_evidence(inputs: list[dict[str, Any]], output_dir: str | Path) -> str:
+    output_path = Path(output_dir)
+    output_path.mkdir(parents=True, exist_ok=True)
+    timestamp = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%S%fZ")
+    evidence_path = output_path / f"trust-{timestamp}.json"
+
+    normalized_inputs: list[dict[str, Any]] = []
+    for item in inputs:
+        data = dict(item)
+        trust_tier = str(data.get("_trust_tier", "research"))
+        trust_label = str(data.get("_trust_label", "UNTRUSTED_EXTERNAL_CONTENT"))
+        try:
+            trust_score = float(data.get("_trust_score", 0.0))
+        except (TypeError, ValueError):
+            trust_score = 0.0
+        content_repr = data.get("sanitized_content", data.get("content", ""))
+        if not isinstance(content_repr, str):
+            content_repr = json.dumps(content_repr, sort_keys=True, ensure_ascii=True)
+        content_hash = sha256(content_repr.encode("utf-8")).hexdigest()
+        normalized_inputs.append(
+            {
+                "source_type": str(data.get("source_type", "unknown")),
+                "source_ref": str(data.get("source_ref", "")),
+                "trust_tier": trust_tier,
+                "trust_label": trust_label,
+                "trust_score": trust_score,
+                "content_hash": content_hash,
+            }
+        )
+
+    payload = {
+        "schema": "TrustEvidence",
+        "generated_at": datetime.now(timezone.utc).isoformat(),
+        "input_count": len(normalized_inputs),
+        "inputs": normalized_inputs,
+    }
+    evidence_path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+    return evidence_path.as_posix()
+
+
 def mark_untrusted_content(
     project_dir: str,
     *,
     source_type: str,
     content: str,
     source_ref: str = "",
+    tier: TrustTier | str | None = None,
 ) -> dict[str, Any]:
     state_path = _state_path(project_dir)
     state = get_untrusted_content_state(project_dir)
     sanitized, quarantined = quarantine_instruction_like_text(content)
-    entry = {
+    resolved_tier = normalize_trust_tier(tier) if tier is not None else trust_tier_for_source(source_type)
+    entry = tag_content(
+        {
         "source_type": source_type,
         "source_ref": source_ref,
         "quarantined_fragments": quarantined,
-        "trust_score": 0.0,
-    }
+        "sanitized_content": sanitized,
+        },
+        resolved_tier,
+    )
+    entry["trust_score"] = entry.get("_trust_score", 0.0)
     provenance = list(state.get("provenance", []))
     provenance.append(entry)
+    evidence_path = write_trust_evidence(
+        [entry],
+        output_dir=Path(project_dir) / EVIDENCE_REL_DIR,
+    )
+
+    prior_scores = state.get("trust_scores", {})
+    next_external_score = min(
+        [
+            float(prior_scores.get("external_content", 1.0)),
+            float(entry.get("_trust_score", 0.0)),
+        ]
+    )
     next_state = {
-        "active": True,
+        "active": resolved_tier in {TrustTier.RESEARCH, TrustTier.BROWSER},
         "last_source_type": source_type,
         "last_source_ref": source_ref,
+        "last_trust_tier": resolved_tier.value,
+        "last_trust_label": entry.get("_trust_label"),
+        "last_trust_score": entry.get("_trust_score"),
         "sanitized_content": sanitized,
         "quarantined_fragments": quarantined,
         "provenance": provenance[-20:],
-        "trust_scores": {"external_content": 0.0},
+        "trust_scores": {
+            **(prior_scores if isinstance(prior_scores, dict) else {}),
+            "external_content": next_external_score,
+            resolved_tier.value: float(entry.get("_trust_score", 0.0)),
+        },
+        "evidence_artifacts": (list(state.get("evidence_artifacts", [])) + [evidence_path])[-20:],
     }
     _write_state(state_path, next_state)
     return next_state

package/scripts/check-omg-public-ready.py

@@ -6,8 +6,14 @@ import argparse
 import json
 from pathlib import Path
 import re
+import sys
+from urllib.parse import urlparse
 
+# Add root to sys.path to import runtime.adoption
 ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+
+from runtime.adoption import CANONICAL_VERSION
 
 REQUIRED_PUBLIC_DOCS = [
     "README.md",
@@ -59,6 +65,7 @@ TEXT_GLOBS = [
 ]
 
 MARKDOWN_LINK_RE = re.compile(r"!\[[^\]]*\]\(([^)]+)\)|\[[^\]]+\]\(([^)]+)\)")
+HTTP_URL_RE = re.compile(r"https?://[^\s)\]>'\"]+")
 ALLOW_PATTERN_REFERENCES = {
     ROOT / "scripts" / "check-omg-public-ready.py",
 }
@@ -167,6 +174,74 @@ def _find_broken_markdown_links(root: Path) -> list[str]:
     return violations
 
 
+def _is_loopback_host(hostname: str) -> bool:
+    lowered = hostname.strip().lower()
+    return lowered in {"localhost", "127.0.0.1", "::1"}
+
+
+def _find_proof_surface_violations(root: Path) -> list[str]:
+    violations: list[str] = []
+    proof_path = root / "docs" / "proof.md"
+    if not proof_path.exists():
+        violations.append("docs/proof.md: missing proof surface document")
+        return violations
+
+    content = _read(proof_path)
+    lowered = content.lower()
+    hardcoded_counts = bool(
+        re.search(r"\b\d+\s*/\s*\d+\b", lowered)
+        or re.search(r"\b\d+\s+(tests?|checks?|providers?)\s+(passed|pass|green|successful)\b", lowered)
+        or re.search(r"\ball\s+tests?\s+passed\b", lowered)
+    )
+    has_artifact_refs = any(
+        token in content
+        for token in (
+            ".omg/evidence/",
+            ".omg/evals/",
+            ".omg/tracebank/",
+            ".omg/lineage/",
+        )
+    )
+    if hardcoded_counts and not has_artifact_refs:
+        violations.append("docs/proof.md: prose-only proof counts found without machine artifact references")
+
+    if ".omg/evidence/doctor.json" not in content:
+        violations.append("docs/proof.md: missing doctor output artifact reference (.omg/evidence/doctor.json)")
+
+    for path in _iter_files(root, PUBLIC_DOC_GLOBS):
+        rel = path.relative_to(root)
+        for line in _read(path).splitlines():
+            if "production" not in line.lower():
+                continue
+            for url in HTTP_URL_RE.findall(line):
+                parsed = urlparse(url)
+                if parsed.scheme != "http":
+                    continue
+                host = parsed.hostname or ""
+                if host and not _is_loopback_host(host):
+                    violations.append(
+                        f"{rel}: production claim uses non-loopback HTTP endpoint ({url})"
+                    )
+    return violations
+
+
+def _find_doc_currency_violations(root: Path) -> list[str]:
+    violations: list[str] = []
+    changelog_path = root / "CHANGELOG.md"
+    if not changelog_path.exists():
+        violations.append("CHANGELOG.md: missing changelog file")
+        return violations
+
+    content = _read(changelog_path)
+    # Look for version in headers like ## [2.0.7] or ## 2.0.7
+    version_pattern = re.compile(rf"##\s*\[?{re.escape(CANONICAL_VERSION)}\]?")
+    if not version_pattern.search(content):
+        violations.append(
+            f"CHANGELOG.md: missing entry for current version {CANONICAL_VERSION}"
+        )
+    return violations
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description="Check OMG public-readiness hygiene")
     parser.add_argument("--root", default=str(ROOT))
@@ -179,6 +254,8 @@ def main() -> int:
     violations.extend(_find_internal_docs(root))
     violations.extend(_find_text_violations(root))
     violations.extend(_find_broken_markdown_links(root))
+    violations.extend(_find_proof_surface_violations(root))
+    violations.extend(_find_doc_currency_violations(root))
     violations = sorted(set(violations))
 
     if violations: