@trac3er/oh-my-god 2.0.4 → 2.0.7

package/scripts/omg.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""OMG 2.0.4 CLI entrypoint.
+"""OMG 2.0.7 CLI entrypoint.
 
 Implements practical command-line flows for:
 - omg ship
@@ -33,14 +33,19 @@ from hooks.trust_review import review_config_change, write_trust_manifest
 from lab.pipeline import publish_artifact, run_pipeline
 from runtime.dispatcher import dispatch_runtime
 from runtime.api_twin import ingest_contract, record_fixture, serve_fixture, verify_fixture
+from runtime.data_lineage import build_lineage_manifest
+from runtime.eval_gate import evaluate_trace
+from runtime.incident_replay import build_incident_pack
 from runtime.domain_packs import get_domain_pack_contract
 from runtime.preflight import run_preflight
+from runtime.remote_supervisor import issue_local_supervisor_session, verify_local_supervisor_token
 from runtime.security_check import run_security_check
 from runtime.contract_compiler import (
     build_release_readiness,
     compile_contract_outputs,
     validate_contract_registry,
 )
+from runtime.tracebank import record_trace
 from runtime.compat import (
     DEFAULT_CONTRACT_SNAPSHOT_PATH,
     DEFAULT_GAP_REPORT_PATH,
@@ -50,6 +55,7 @@ from runtime.compat import (
     get_compat_skill_contract,
     list_compat_skill_contracts,
     list_compat_skills,
+    run_doctor,
 )
 from runtime.adoption import CANONICAL_VERSION
 from runtime.ecosystem import ecosystem_status, list_ecosystem_repos, sync_ecosystem_repos
@@ -130,14 +136,49 @@ def cmd_ship(args: argparse.Namespace) -> int:
     run_id = args.run_id or _now_run_id()
     verification = dispatched.get("verification", {})
     checks = verification.get("checks", []) if isinstance(verification, dict) else []
+    preflight = run_preflight(project_dir, goal=str(idea.get("goal", "")))
+    security_result = run_security_check(project_dir=project_dir, scope=".")
+    trace = record_trace(
+        project_dir,
+        trace_type="ship",
+        route=preflight["route"],
+        status="ok",
+        plan=dispatched.get("plan", {}),
+        verify=verification if isinstance(verification, dict) else {},
+        metadata={"runtime": runtime, "run_id": run_id},
+    )
+    eval_result = evaluate_trace(
+        project_dir,
+        trace_id=trace["trace_id"],
+        suites=["planning", "security"],
+        metrics={
+            "planning": 1.0 if dispatched.get("status") == "ok" else 0.0,
+            "security": max(float(security_result["trust_scores"].get("overall", 0.0)), 0.0),
+        },
+    )
+    lineage = build_lineage_manifest(
+        project_dir,
+        artifact_type="evidence-pack",
+        sources=[{"kind": "repo", "path": ".", "license": "MIT"}],
+        privacy="internal",
+        license="MIT",
+        derivation={"trace_id": trace["trace_id"], "route": preflight["route"], "eval_path": eval_result["path"]},
+        trace_id=trace["trace_id"],
+    )
     evidence_path = create_evidence_pack(
         project_dir,
         run_id,
         tests=checks if isinstance(checks, list) else [],
-        security_scans=[],
+        security_scans=security_result.get("security_scans", []),
         diff_summary={"runtime": runtime, "goal": idea.get("goal", "")},
         reproducibility={"command": f"omg ship --runtime {runtime} --idea {idea_path}"},
-        unresolved_risks=[],
+        unresolved_risks=security_result.get("unresolved_risks", []),
+        provenance=security_result["provenance"],
+        trust_scores=security_result["trust_scores"],
+        api_twin={"recommended_route": preflight["route"] if preflight["route"] == "api-twin" else ""},
+        route_metadata=preflight,
+        trace_ids=[trace["trace_id"]],
+        lineage=lineage,
     )
 
     out = {
@@ -147,6 +188,8 @@ def cmd_ship(args: argparse.Namespace) -> int:
         "run_id": run_id,
         "goal": idea.get("goal", ""),
         "evidence_path": os.path.relpath(evidence_path, project_dir),
+        "trace_id": trace["trace_id"],
+        "eval_path": eval_result["path"],
     }
     print(json.dumps(out, indent=2))
     return 0
@@ -166,10 +209,12 @@ def cmd_secure(args: argparse.Namespace) -> int:
 
 
 def cmd_security_check(args: argparse.Namespace) -> int:
+    waivers = json.loads(args.waivers_json) if args.waivers_json else None
     result = run_security_check(
         project_dir=_ensure_project_dir(),
         scope=args.scope,
         include_live_enrichment=bool(args.live_enrichment),
+        waivers=waivers,
     )
     print(json.dumps(result, indent=2))
     return 0
@@ -185,9 +230,12 @@ def cmd_api_twin_record(args: argparse.Namespace) -> int:
     result = record_fixture(
         _ensure_project_dir(),
         name=args.name,
+        endpoint=args.endpoint,
+        cassette_version=args.cassette_version,
         request=json.loads(args.request_json),
         response=json.loads(args.response_json),
         validated=bool(args.validated),
+        redactions=json.loads(args.redactions_json) if args.redactions_json else None,
     )
     print(json.dumps(result, indent=2))
     return 0
@@ -197,6 +245,8 @@ def cmd_api_twin_serve(args: argparse.Namespace) -> int:
     result = serve_fixture(
         _ensure_project_dir(),
         name=args.name,
+        endpoint=args.endpoint,
+        cassette_version=args.cassette_version,
         latency_ms=int(args.latency_ms),
         failure_mode=args.failure_mode,
         schema_drift=bool(args.schema_drift),
@@ -209,6 +259,8 @@ def cmd_api_twin_verify(args: argparse.Namespace) -> int:
     result = verify_fixture(
         _ensure_project_dir(),
         name=args.name,
+        endpoint=args.endpoint,
+        cassette_version=args.cassette_version,
         live_response=json.loads(args.live_response_json),
     )
     print(json.dumps(result, indent=2))
@@ -227,6 +279,82 @@ def cmd_domain_pack(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_trace_record(args: argparse.Namespace) -> int:
+    result = record_trace(
+        _ensure_project_dir(),
+        trace_type=args.trace_type,
+        route=args.route,
+        status=args.status,
+        plan=json.loads(args.plan_json) if args.plan_json else {},
+        verify=json.loads(args.verify_json) if args.verify_json else {},
+    )
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_eval_gate(args: argparse.Namespace) -> int:
+    result = evaluate_trace(
+        _ensure_project_dir(),
+        trace_id=args.trace_id,
+        suites=args.suites.split(","),
+        metrics=json.loads(args.metrics_json),
+    )
+    print(json.dumps(result, indent=2))
+    return 0 if result["status"] == "ok" else 2
+
+
+def cmd_delta_classify(args: argparse.Namespace) -> int:
+    from runtime.delta_classifier import classify_project_changes
+
+    touched_files = [item for item in args.files.split(",") if item]
+    result = classify_project_changes(_ensure_project_dir(), touched_files=touched_files or None, goal=args.goal)
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_incident_replay(args: argparse.Namespace) -> int:
+    result = build_incident_pack(
+        _ensure_project_dir(),
+        title=args.title,
+        failing_tests=[item for item in args.failing_tests.split(",") if item],
+        logs=[item for item in args.logs.split("|") if item],
+        diff_summary=json.loads(args.diff_summary_json),
+        trace_id=args.trace_id or None,
+    )
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_lineage(args: argparse.Namespace) -> int:
+    result = build_lineage_manifest(
+        _ensure_project_dir(),
+        artifact_type=args.artifact_type,
+        sources=json.loads(args.sources_json),
+        privacy=args.privacy,
+        license=args.license_name,
+        derivation=json.loads(args.derivation_json),
+        trace_id=args.trace_id or None,
+    )
+    print(json.dumps(result, indent=2))
+    return 0 if result["status"] == "ok" else 2
+
+
+def cmd_supervisor_issue(args: argparse.Namespace) -> int:
+    result = issue_local_supervisor_session(
+        _ensure_project_dir(),
+        worker_id=args.worker_id,
+        shared_secret=args.shared_secret,
+    )
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+def cmd_supervisor_verify(args: argparse.Namespace) -> int:
+    result = verify_local_supervisor_token(args.token, shared_secret=args.shared_secret)
+    print(json.dumps(result, indent=2))
+    return 0 if result["status"] == "ok" else 2
+
+
 def cmd_maintainer(args: argparse.Namespace) -> int:
     project_dir = _ensure_project_dir()
     out_dir = Path(project_dir) / ".omg" / "evidence"
@@ -519,6 +647,23 @@ def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
     contract_compile.set_defaults(func=cmd_contract_compile)
 
 
+def cmd_doctor(args: argparse.Namespace) -> int:
+    fmt = getattr(args, "format", "text")
+    result = run_doctor(root_dir=ROOT_DIR)
+    if fmt == "json":
+        print(json.dumps(result, indent=2))
+    else:
+        for check in result["checks"]:
+            marker = "PASS" if check["status"] == "ok" else ("BLOCKER" if check["status"] == "blocker" else "WARN")
+            req_tag = "" if check["required"] else " (optional)"
+            print(f"  {marker:>7} {check['name']}: {check['message']}{req_tag}")
+        blockers = sum(1 for c in result["checks"] if c["status"] == "blocker")
+        warnings = sum(1 for c in result["checks"] if c["status"] == "warning")
+        passed = sum(1 for c in result["checks"] if c["status"] == "ok")
+        print(f"\nPASS [{passed}] | WARN [{warnings}] | BLOCKER [{blockers}]")
+    return 0 if result["status"] == "pass" else 1
+
+
 def _add_release_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> None:
     release_sub = parent.add_subparsers(dest=dest, required=True)
 
@@ -552,6 +697,7 @@ def build_parser() -> argparse.ArgumentParser:
     security_check = security_sub.add_parser("check", help="Run canonical OMG security check")
     security_check.add_argument("--scope", default=".")
     security_check.add_argument("--live-enrichment", action="store_true")
+    security_check.add_argument("--waivers-json", default="")
     security_check.set_defaults(func=cmd_security_check)
 
     api_twin = sub.add_parser("api-twin", help="Contract replay and fixture-based API simulation")
@@ -562,18 +708,25 @@ def build_parser() -> argparse.ArgumentParser:
     api_twin_ingest.set_defaults(func=cmd_api_twin_ingest)
     api_twin_record = api_twin_sub.add_parser("record", help="Record approved fixture response")
     api_twin_record.add_argument("--name", required=True)
+    api_twin_record.add_argument("--endpoint", default="default")
+    api_twin_record.add_argument("--cassette-version", default="v1")
     api_twin_record.add_argument("--request-json", required=True)
     api_twin_record.add_argument("--response-json", required=True)
     api_twin_record.add_argument("--validated", action="store_true")
+    api_twin_record.add_argument("--redactions-json", default="")
     api_twin_record.set_defaults(func=cmd_api_twin_record)
     api_twin_serve = api_twin_sub.add_parser("serve", help="Replay a fixture with optional drift/failure injection")
     api_twin_serve.add_argument("--name", required=True)
+    api_twin_serve.add_argument("--endpoint", default="default")
+    api_twin_serve.add_argument("--cassette-version", default="v1")
     api_twin_serve.add_argument("--latency-ms", type=int, default=0)
     api_twin_serve.add_argument("--failure-mode", default="")
     api_twin_serve.add_argument("--schema-drift", action="store_true")
     api_twin_serve.set_defaults(func=cmd_api_twin_serve)
     api_twin_verify = api_twin_sub.add_parser("verify", help="Validate a fixture against a live response")
     api_twin_verify.add_argument("--name", required=True)
+    api_twin_verify.add_argument("--endpoint", default="default")
+    api_twin_verify.add_argument("--cassette-version", default="v1")
     api_twin_verify.add_argument("--live-response-json", required=True)
     api_twin_verify.set_defaults(func=cmd_api_twin_verify)
 
@@ -585,6 +738,53 @@ def build_parser() -> argparse.ArgumentParser:
     domain_pack.add_argument("--name", required=True, choices=["robotics", "vision", "algorithms", "health"])
     domain_pack.set_defaults(func=cmd_domain_pack)
 
+    tracebank = sub.add_parser("tracebank", help="Record structured route traces")
+    tracebank.add_argument("--trace-type", required=True)
+    tracebank.add_argument("--route", required=True)
+    tracebank.add_argument("--status", default="ok")
+    tracebank.add_argument("--plan-json", default="")
+    tracebank.add_argument("--verify-json", default="")
+    tracebank.set_defaults(func=cmd_trace_record)
+
+    eval_gate = sub.add_parser("eval-gate", help="Evaluate a trace for release gating")
+    eval_gate.add_argument("--trace-id", required=True)
+    eval_gate.add_argument("--suites", required=True, help="Comma-separated suite names")
+    eval_gate.add_argument("--metrics-json", required=True)
+    eval_gate.set_defaults(func=cmd_eval_gate)
+
+    delta = sub.add_parser("delta-classifier", help="Classify repo changes for routing and policy")
+    delta.add_argument("--goal", default="")
+    delta.add_argument("--files", default="")
+    delta.set_defaults(func=cmd_delta_classify)
+
+    incident = sub.add_parser("incident-replay", help="Build an incident replay pack")
+    incident.add_argument("--title", required=True)
+    incident.add_argument("--failing-tests", default="")
+    incident.add_argument("--logs", default="")
+    incident.add_argument("--diff-summary-json", required=True)
+    incident.add_argument("--trace-id", default="")
+    incident.set_defaults(func=cmd_incident_replay)
+
+    lineage = sub.add_parser("data-lineage", help="Build lineage metadata for generated artifacts")
+    lineage.add_argument("--artifact-type", required=True)
+    lineage.add_argument("--sources-json", required=True)
+    lineage.add_argument("--privacy", required=True)
+    lineage.add_argument("--license-name", required=True)
+    lineage.add_argument("--derivation-json", required=True)
+    lineage.add_argument("--trace-id", default="")
+    lineage.set_defaults(func=cmd_lineage)
+
+    supervisor = sub.add_parser("remote-supervisor", help="Local-only authenticated supervisor session helpers")
+    supervisor_sub = supervisor.add_subparsers(dest="remote_supervisor_command", required=True)
+    supervisor_issue = supervisor_sub.add_parser("issue", help="Issue a local supervisor session")
+    supervisor_issue.add_argument("--worker-id", required=True)
+    supervisor_issue.add_argument("--shared-secret", required=True)
+    supervisor_issue.set_defaults(func=cmd_supervisor_issue)
+    supervisor_verify = supervisor_sub.add_parser("verify", help="Verify a supervisor session token")
+    supervisor_verify.add_argument("--token", required=True)
+    supervisor_verify.add_argument("--shared-secret", required=True)
+    supervisor_verify.set_defaults(func=cmd_supervisor_verify)
+
     maintainer = sub.add_parser("maintainer", help="OSS maintainer evidence helper")
     maintainer.add_argument("--mode", default="impact", choices=["triage", "release", "review", "impact"])
     maintainer.set_defaults(func=cmd_maintainer)
@@ -652,6 +852,10 @@ def build_parser() -> argparse.ArgumentParser:
     release = sub.add_parser("release", help="OMG release-readiness checks")
     _add_release_subcommands(release, dest="release_command")
 
+    doctor = sub.add_parser("doctor", help="Canonical install and runtime verification")
+    doctor.add_argument("--format", default="text", choices=["text", "json"], dest="format")
+    doctor.set_defaults(func=cmd_doctor)
+
     return parser
 
 

package/scripts/verify-standalone.sh

@@ -10,7 +10,14 @@ echo "[verify-standalone] workdir: $TMP_DIR"
 tar --exclude="./.omc" --exclude="./.pytest_cache" -cf - -C "$ROOT_DIR" . | (cd "$TMP_DIR" && tar -xf -)
 
 cd "$TMP_DIR"
+mkdir -p .omg/evidence
+python3 scripts/omg.py doctor --format json > .omg/evidence/doctor.json
+python3 scripts/omg.py contract validate
+python3 scripts/omg.py contract compile --host claude --host codex --channel public --output-root .
+python3 scripts/omg.py contract compile --host claude --host codex --channel enterprise --output-root .
+OMG_RELEASE_READY_PROVIDERS=claude,codex python3 scripts/omg.py release readiness --channel dual --output-root .
 python3 scripts/omg.py compat gate --max-bridge 0 --output .omg/evidence/omg-compat-gap.json
+python3 scripts/check-omg-public-ready.py
 
 if command -v pyenv >/dev/null 2>&1 && pyenv prefix 3.12.7 >/dev/null 2>&1; then
   PYENV_VERSION=3.12.7 python -m pytest -q

package/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.0.4 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.0.7 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -281,10 +281,32 @@
         ],
         "matcher": ""
       }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"$HOME/.claude/hooks/user-prompt-submit.py\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "InstructionsLoaded": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"$HOME/.claude/hooks/instructions-loaded.py\"",
+            "timeout": 10
+          }
+        ]
+      }
     ]
   },
   "_omg": {
-    "_version": "2.0.4",
+    "_version": "2.0.7",
     "preset": "safe",
     "default_mode": "ulw+ralph",
     "vision_auto": true,
@@ -337,14 +359,27 @@
       "CONTEXT_MANAGER": false
     },
     "generated": {
-      "contract_version": "2.0.4",
-      "channel": "public",
+      "contract_version": "2.0.7",
+      "channel": "enterprise",
       "required_bundles": [
         "control-plane",
         "hook-governor",
         "mcp-fabric",
         "lsp-pack",
-        "secure-worktree-pipeline"
+        "secure-worktree-pipeline",
+        "security-check",
+        "api-twin",
+        "preflight",
+        "robotics",
+        "vision",
+        "algorithms",
+        "health",
+        "tracebank",
+        "eval-gate",
+        "delta-classifier",
+        "incident-replay",
+        "data-lineage",
+        "remote-supervisor"
       ],
       "protected_paths": [
         ".omg/**",
@@ -360,6 +395,199 @@
         "SubagentStart",
         "SubagentStop",
         "TaskCompleted"
+      ],
+      "policy_model": {
+        "trust_tiers": [
+          {
+            "name": "safe",
+            "level": 0,
+            "label": "Safe",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry"
+            ]
+          },
+          {
+            "name": "balanced",
+            "level": 1,
+            "label": "Balanced",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry",
+              "reviewed_external"
+            ]
+          },
+          {
+            "name": "interop",
+            "level": 2,
+            "label": "Interop",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry",
+              "reviewed_external",
+              "migration_bridge"
+            ]
+          },
+          {
+            "name": "labs",
+            "level": 3,
+            "label": "Labs",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry",
+              "reviewed_external",
+              "experimental"
+            ]
+          }
+        ],
+        "tool_policies": [
+          {
+            "tool_name": "Read",
+            "allowed_tiers": [
+              "safe",
+              "balanced",
+              "interop",
+              "labs"
+            ],
+            "requires_approval": false
+          },
+          {
+            "tool_name": "Grep",
+            "allowed_tiers": [
+              "safe",
+              "balanced",
+              "interop",
+              "labs"
+            ],
+            "requires_approval": false
+          },
+          {
+            "tool_name": "Bash(python3:*)",
+            "allowed_tiers": [
+              "balanced",
+              "interop",
+              "labs"
+            ],
+            "requires_approval": true
+          }
+        ],
+        "protected_paths": [
+          {
+            "path_pattern": ".omg/**",
+            "required_tier": "balanced"
+          },
+          {
+            "path_pattern": ".agents/**",
+            "required_tier": "balanced"
+          },
+          {
+            "path_pattern": ".codex/**",
+            "required_tier": "balanced"
+          },
+          {
+            "path_pattern": ".claude/**",
+            "required_tier": "balanced"
+          }
+        ],
+        "evidence_contract": {
+          "timestamp": "timestamp",
+          "executor": "executor",
+          "trace_id": "trace_id",
+          "lineage": "lineage"
+        },
+        "host_rules": {
+          "claude": {
+            "compilation_targets": [
+              ".claude-plugin/plugin.json",
+              ".claude-plugin/marketplace.json",
+              ".mcp.json",
+              "settings.json"
+            ],
+            "hooks": [
+              "SessionStart",
+              "PreToolUse",
+              "PostToolUse",
+              "PreCompact"
+            ],
+            "subagents": [
+              "local_supervisor",
+              "workers"
+            ],
+            "skills": [
+              "omg/control-plane",
+              "omg/hook-governor"
+            ]
+          },
+          "codex": {
+            "compilation_targets": [
+              ".agents/skills/omg/<bundle>/SKILL.md",
+              ".agents/skills/omg/<bundle>/openai.yaml",
+              ".agents/skills/omg/AGENTS.fragment.md",
+              ".agents/skills/omg/codex-mcp.toml"
+            ],
+            "skills": [
+              "omg/control-plane",
+              "omg/mcp-fabric"
+            ],
+            "agents_fragments": [
+              ".agents/skills/omg/AGENTS.fragment.md"
+            ],
+            "rules": [
+              "protected_paths",
+              "explicit_invocation"
+            ],
+            "automations": [
+              "contract-compile",
+              "release-readiness"
+            ]
+          }
+        }
+      },
+      "subagents": [
+        {
+          "name": "security-reviewer",
+          "description": "Read-only security review subagent with scoped tool access.",
+          "tools": [
+            "Read",
+            "Grep",
+            "Glob",
+            "Bash(grep *)",
+            "Bash(find *)",
+            "Bash(git log *)",
+            "Bash(git diff *)"
+          ],
+          "bypassPermissions": false
+        },
+        {
+          "name": "release-manager",
+          "description": "Release management subagent with write access governed by protected-path policy.",
+          "tools": [
+            "Read",
+            "Write",
+            "Edit",
+            "Grep",
+            "Glob",
+            "Bash(git *)",
+            "Bash(python3 scripts/omg.py *)"
+          ],
+          "bypassPermissions": false,
+          "protectedPaths": [
+            ".omg/**",
+            ".agents/**",
+            ".codex/**",
+            ".claude/**"
+          ]
+        }
+      ],
+      "skills": [
+        {
+          "name": "omg/control-plane",
+          "source": ".agents/skills/omg/control-plane/"
+        },
+        {
+          "name": "omg/hook-governor",
+          "source": ".agents/skills/omg/hook-governor/"
+        }
       ]
     }
   }