@trac3er/oh-my-god 2.0.5 → 2.0.8

package/runtime/api_twin.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import re
 from pathlib import Path
 import time
 from typing import Any
@@ -9,6 +10,25 @@ from typing import Any
 
 STATE_REL_PATH = Path(".omg") / "state" / "api_twin.json"
 
+DEFAULT_FRESHNESS_WINDOW_HOURS = 24
+
+_SENSITIVE_KEY_PATTERNS = re.compile(
+    r"(authorization|auth|token|api[_-]?key|password|passwd|secret|bearer|credential)",
+    re.IGNORECASE,
+)
+
+_METHOD_COST_WEIGHTS: dict[str, float] = {
+    "GET": 1.0,
+    "POST": 2.0,
+    "PUT": 1.5,
+    "PATCH": 1.5,
+    "DELETE": 1.0,
+    "HEAD": 0.5,
+    "OPTIONS": 0.5,
+}
+
+_BASE_CALL_COST = 0.002
+
 
 def ingest_contract(project_dir: str, *, name: str, source_path: str) -> dict[str, Any]:
     state = _load_state(project_dir)
@@ -39,17 +59,39 @@ def record_fixture(
     response: dict[str, Any],
     validated: bool,
     redactions: dict[str, str] | None = None,
+    freshness_window_hours: float = DEFAULT_FRESHNESS_WINDOW_HOURS,
+    schema: dict[str, Any] | None = None,
+    endpoint_metadata: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     state = _load_state(project_dir)
+
+    redacted_request = redact_sensitive(request)
+    redacted_response = redact_sensitive(response)
+
+    now = time.time()
+    freshness_metadata = {
+        "recorded_at": now,
+        "freshness_window_hours": freshness_window_hours,
+        "is_stale": False,
+    }
+
+    recorded_schema = schema if schema else _derive_schema(response)
+    ep_meta = endpoint_metadata or _parse_endpoint_metadata(endpoint)
+
     fixture = {
         "name": name,
         "endpoint": endpoint,
         "cassette_version": cassette_version,
-        "request": request,
-        "response": response,
+        "request": redacted_request,
+        "response": redacted_response,
         "fidelity": "recorded-validated" if validated else "recorded",
         "validated": validated,
         "redactions": redactions or {},
+        "freshness_metadata": freshness_metadata,
+        "schema": recorded_schema,
+        "endpoint_metadata": ep_meta,
+        "schema_drifted": False,
+        "proof_chain": {},
     }
     fixtures = state.setdefault("fixtures", {}).setdefault(name, {})
     fixtures[_fixture_key(endpoint, cassette_version)] = fixture
@@ -60,6 +102,7 @@ def record_fixture(
         "endpoint": endpoint,
         "cassette_version": cassette_version,
         "fidelity": fixture["fidelity"],
+        "freshness_metadata": freshness_metadata,
     }
 
 
@@ -77,6 +120,11 @@ def serve_fixture(
     fixture = _fixture(state, name, endpoint=endpoint, cassette_version=cassette_version)
     response = dict(fixture.get("response", {}))
     fidelity = str(fixture.get("fidelity", "recorded"))
+
+    freshness = fixture.get("freshness_metadata", {})
+    if freshness and _is_stale(freshness):
+        fidelity = "stale"
+
     if latency_ms > 0:
         time.sleep(max(latency_ms, 0) / 1000)
     if schema_drift:
@@ -85,6 +133,10 @@ def serve_fixture(
     if failure_mode:
         response = {"error": failure_mode}
         fidelity = "stale"
+
+    ep_meta = fixture.get("endpoint_metadata", {})
+    cost_report = _compute_saved_cost(ep_meta)
+
     return {
         "schema": "ApiTwinServeResult",
         "name": name,
@@ -96,7 +148,8 @@ def serve_fixture(
         "response": response,
         "report": {
             "saved_live_calls": 1,
-            "saved_cost_estimate": round(len(json.dumps(response)) * 0.0001, 4),
+            "saved_cost_estimate": cost_report["saved_cost_estimate"],
+            "cost_method": "endpoint_metadata",
             "redactions": fixture.get("redactions", {}),
         },
     }
@@ -113,9 +166,20 @@ def verify_fixture(
     state = _load_state(project_dir)
     fixture = _fixture(state, name, endpoint=endpoint, cassette_version=cassette_version)
     matches_live = fixture.get("response", {}) == live_response
-    fidelity = "recorded-validated" if matches_live else "stale"
+
+    freshness = fixture.get("freshness_metadata", {})
+    is_stale = _is_stale(freshness) if freshness else False
+
+    fidelity = "recorded-validated" if (matches_live and not is_stale) else "stale"
+
     fixture["fidelity"] = fidelity
     fixture["validated"] = matches_live
+
+    if matches_live and not is_stale and freshness:
+        freshness["recorded_at"] = time.time()
+        freshness["is_stale"] = False
+        fixture["freshness_metadata"] = freshness
+
     state.setdefault("fixtures", {}).setdefault(name, {})[_fixture_key(endpoint, cassette_version)] = fixture
     _save_state(project_dir, state)
     return {
@@ -129,6 +193,159 @@ def verify_fixture(
     }
 
 
+def verify_endpoint(
+    project_dir: str,
+    *,
+    name: str,
+    endpoint: str = "default",
+    cassette_version: str = "v1",
+    live_response: dict[str, Any],
+    schema: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    state = _load_state(project_dir)
+    fixture = _fixture(state, name, endpoint=endpoint, cassette_version=cassette_version)
+
+    recorded_response = fixture.get("response", {})
+    matches_live = recorded_response == live_response
+
+    check_schema = schema or fixture.get("schema", {})
+    schema_drifted = False
+    drift_details: list[str] = []
+
+    if check_schema and isinstance(check_schema, dict):
+        required_fields = check_schema.get("required_fields", [])
+        for field in required_fields:
+            if field not in live_response:
+                schema_drifted = True
+                drift_details.append(f"missing_field:{field}")
+
+        expected_types = check_schema.get("field_types", {})
+        for field, expected_type in expected_types.items():
+            if field in live_response:
+                actual_type = type(live_response[field]).__name__
+                if actual_type != expected_type:
+                    schema_drifted = True
+                    drift_details.append(f"type_mismatch:{field}:{expected_type}->{actual_type}")
+
+    freshness = fixture.get("freshness_metadata", {})
+    is_stale = _is_stale(freshness) if freshness else False
+
+    if schema_drifted:
+        fidelity = "schema-drifted"
+    elif is_stale:
+        fidelity = "stale"
+    elif matches_live:
+        fidelity = "recorded-validated"
+    else:
+        fidelity = "stale"
+
+    production_proven = matches_live and not schema_drifted and not is_stale
+
+    fixture["fidelity"] = fidelity
+    fixture["validated"] = matches_live and not schema_drifted
+    fixture["schema_drifted"] = schema_drifted
+
+    if matches_live and not schema_drifted and freshness:
+        freshness["recorded_at"] = time.time()
+        freshness["is_stale"] = False
+        fixture["freshness_metadata"] = freshness
+
+    state.setdefault("fixtures", {}).setdefault(name, {})[_fixture_key(endpoint, cassette_version)] = fixture
+    _save_state(project_dir, state)
+
+    ep_meta = fixture.get("endpoint_metadata", {})
+
+    return {
+        "schema": "ApiTwinEndpointVerifyResult",
+        "name": name,
+        "endpoint": endpoint,
+        "cassette_version": cassette_version,
+        "fidelity": fidelity,
+        "matches_live": matches_live,
+        "schema_drifted": schema_drifted,
+        "drift_details": drift_details,
+        "is_stale": is_stale,
+        "production_proven": production_proven,
+        "live_verification_required": True,
+        "endpoint_metadata": ep_meta,
+        "report": {
+            "endpoint": endpoint,
+            "fidelity": fidelity,
+            "production_proven": production_proven,
+            "schema_drifted": schema_drifted,
+            "drift_details": drift_details,
+            "freshness": freshness,
+            "saved_cost": _compute_saved_cost(ep_meta),
+        },
+    }
+
+
+def redact_sensitive(payload: dict[str, Any]) -> dict[str, Any]:
+    if not isinstance(payload, dict):
+        return payload
+
+    redacted: dict[str, Any] = {}
+    for key, value in payload.items():
+        if _SENSITIVE_KEY_PATTERNS.search(key):
+            redacted[key] = "[REDACTED]"
+        elif isinstance(value, dict):
+            redacted[key] = redact_sensitive(value)
+        elif isinstance(value, list):
+            redacted[key] = [redact_sensitive(item) if isinstance(item, dict) else item for item in value]
+        else:
+            redacted[key] = value
+    return redacted
+
+
+def saved_cost_report(
+    project_dir: str,
+    *,
+    name: str,
+    endpoint: str = "default",
+    cassette_version: str = "v1",
+) -> dict[str, Any]:
+    state = _load_state(project_dir)
+    fixture = _fixture(state, name, endpoint=endpoint, cassette_version=cassette_version)
+    ep_meta = fixture.get("endpoint_metadata", {})
+    cost = _compute_saved_cost(ep_meta)
+    return {
+        "schema": "ApiTwinSavedCostReport",
+        "name": name,
+        "endpoint": endpoint,
+        "cassette_version": cassette_version,
+        "endpoint_metadata": ep_meta,
+        **cost,
+    }
+
+
+def link_proof_chain(
+    project_dir: str,
+    *,
+    name: str,
+    endpoint: str = "default",
+    cassette_version: str = "v1",
+    trace_id: str,
+    eval_id: str = "",
+) -> dict[str, Any]:
+    state = _load_state(project_dir)
+    fixture = _fixture(state, name, endpoint=endpoint, cassette_version=cassette_version)
+    proof_chain = {
+        "trace_id": trace_id,
+        "eval_id": eval_id,
+        "linked_at": time.time(),
+    }
+    fixture["proof_chain"] = proof_chain
+    state.setdefault("fixtures", {}).setdefault(name, {})[_fixture_key(endpoint, cassette_version)] = fixture
+    _save_state(project_dir, state)
+    return {
+        "schema": "ApiTwinProofChainLink",
+        "name": name,
+        "endpoint": endpoint,
+        "cassette_version": cassette_version,
+        "proof_chain": proof_chain,
+    }
+
+
 def _state_path(project_dir: str) -> Path:
     return Path(project_dir) / STATE_REL_PATH
 
@@ -136,15 +353,15 @@ def _state_path(project_dir: str) -> Path:
 def _load_state(project_dir: str) -> dict[str, Any]:
     path = _state_path(project_dir)
     if not path.exists():
-        return {"schema": "ApiTwinState", "version": "2.0.5", "contracts": {}, "fixtures": {}}
+        return {"schema": "ApiTwinState", "version": "2.0.8", "contracts": {}, "fixtures": {}}
     try:
         payload = json.loads(path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):
-        return {"schema": "ApiTwinState", "version": "2.0.5", "contracts": {}, "fixtures": {}}
+        return {"schema": "ApiTwinState", "version": "2.0.8", "contracts": {}, "fixtures": {}}
     if not isinstance(payload, dict):
-        return {"schema": "ApiTwinState", "version": "2.0.5", "contracts": {}, "fixtures": {}}
+        return {"schema": "ApiTwinState", "version": "2.0.8", "contracts": {}, "fixtures": {}}
     payload.setdefault("schema", "ApiTwinState")
-    payload.setdefault("version", "2.0.5")
+    payload.setdefault("version", "2.0.8")
     payload.setdefault("contracts", {})
     payload.setdefault("fixtures", {})
     return payload
@@ -177,3 +394,57 @@ def _fixture(
     if not isinstance(fixture, dict):
         raise ValueError(f"Unknown API twin cassette: {name} {endpoint} {cassette_version}")
     return fixture
+
+
+def _is_stale(freshness: dict[str, Any]) -> bool:
+    recorded_at = freshness.get("recorded_at", 0)
+    window_hours = freshness.get("freshness_window_hours", DEFAULT_FRESHNESS_WINDOW_HOURS)
+    if not recorded_at:
+        return True
+    age_hours = (time.time() - recorded_at) / 3600
+    return age_hours > window_hours
+
+
+def _derive_schema(response: dict[str, Any]) -> dict[str, Any]:
+    if not isinstance(response, dict):
+        return {}
+    required_fields = list(response.keys())
+    field_types = {k: type(v).__name__ for k, v in response.items()}
+    return {
+        "required_fields": required_fields,
+        "field_types": field_types,
+    }
+
+
+def _parse_endpoint_metadata(endpoint: str) -> dict[str, Any]:
+    parts = endpoint.strip().split(None, 1)
+    if len(parts) == 2:
+        method, path = parts
+    elif len(parts) == 1:
+        method, path = "GET", parts[0]
+    else:
+        method, path = "GET", endpoint
+
+    method = method.upper()
+    path_segments = [s for s in path.split("/") if s]
+    avg_tokens = max(50, len(path_segments) * 100)
+
+    return {
+        "method": method,
+        "path": path,
+        "avg_tokens": avg_tokens,
+    }
+
+
+def _compute_saved_cost(ep_meta: dict[str, Any]) -> dict[str, Any]:
+    method = ep_meta.get("method", "GET").upper()
+    avg_tokens = ep_meta.get("avg_tokens", 50)
+    method_weight = _METHOD_COST_WEIGHTS.get(method, 1.0)
+    token_cost = avg_tokens * 0.00001
+    saved_cost_estimate = round(_BASE_CALL_COST * method_weight + token_cost, 6)
+    return {
+        "saved_cost_estimate": saved_cost_estimate,
+        "cost_method": "endpoint_metadata",
+        "method_weight": method_weight,
+        "avg_tokens": avg_tokens,
+    }

package/runtime/business_workflow.py

@@ -71,6 +71,14 @@ def build_business_task_plan(idea: dict[str, Any]) -> dict[str, Any]:
     user_instructions = _as_string_list(idea.get("user_instructions", []))
     workflow_path = _resolve_workflow_path(idea)
 
+    # Plan Council extensions
+    assumptions = _as_string_list(idea.get("assumptions", []))
+    objections = _as_string_list(idea.get("objections", []) or idea.get("dissent", []))
+    rollback_plan = _as_string_list(idea.get("rollback_plan", []))
+    verification_commands = _as_string_list(idea.get("verification_commands", []))
+    evidence_requirements = _as_string_list(idea.get("evidence_requirements", []))
+    falsifiability = _as_string_list(idea.get("falsifiability", []))
+
     tasks: list[dict[str, Any]] = []
     task_id = 1
 
@@ -178,6 +186,12 @@ def build_business_task_plan(idea: dict[str, Any]) -> dict[str, Any]:
         "constraints": constraints,
         "acceptance": acceptance,
         "user_instructions": user_instructions,
+        "assumptions": assumptions,
+        "objections": objections,
+        "rollback_plan": rollback_plan,
+        "verification_commands": verification_commands,
+        "evidence_requirements": evidence_requirements,
+        "falsifiability": falsifiability,
         "stages": stage_summaries,
         "task_count": len(tasks),
     }

package/runtime/claim_judge.py

@@ -0,0 +1,95 @@
+from __future__ import annotations
+
+from typing import Any
+
+
+def judge_claim(claim: dict[str, Any]) -> dict[str, Any]:
+    claim_type = str(claim.get("claim_type", "")).strip()
+    subject = str(claim.get("subject", "")).strip()
+    artifacts = _as_non_empty_str_list(claim.get("artifacts"))
+    trace_ids = _as_non_empty_str_list(claim.get("trace_ids"))
+    security_scans = claim.get("security_scans")
+    browser_evidence = claim.get("browser_evidence")
+
+    reasons: list[dict[str, Any]] = []
+
+    if not artifacts:
+        reasons.append(
+            {
+                "code": "missing_artifacts",
+                "message": "Claim must include at least one evidence artifact reference.",
+                "field": "artifacts",
+            }
+        )
+
+    if not trace_ids:
+        reasons.append(
+            {
+                "code": "missing_trace_ids",
+                "message": "Claim must include at least one trace identifier.",
+                "field": "trace_ids",
+            }
+        )
+
+    if _has_failed_scan(security_scans):
+        reasons.append(
+            {
+                "code": "security_scan_failed",
+                "message": "Security scans report unresolved failures; claim is blocked.",
+                "field": "security_scans",
+            }
+        )
+
+    if _has_failed_scan(browser_evidence):
+        reasons.append(
+            {
+                "code": "browser_evidence_failed",
+                "message": "Browser evidence reports failed checks; claim is blocked.",
+                "field": "browser_evidence",
+            }
+        )
+
+    hard_fail_codes = {"missing_artifacts", "missing_trace_ids"}
+    if any(reason.get("code") in hard_fail_codes for reason in reasons):
+        verdict = "fail"
+    elif reasons:
+        verdict = "block"
+    else:
+        verdict = "pass"
+
+    return {
+        "schema": "ClaimJudgeResult",
+        "verdict": verdict,
+        "reasons": reasons,
+        "claim_type": claim_type,
+        "subject": subject,
+        "evidence": {
+            "artifacts": artifacts,
+            "trace_ids": trace_ids,
+            "lineage": claim.get("lineage") if isinstance(claim.get("lineage"), dict) else {},
+            "security_scans": security_scans if isinstance(security_scans, list) else [],
+            "browser_evidence": browser_evidence if isinstance(browser_evidence, list) else [],
+        },
+    }
+
+
+def _as_non_empty_str_list(value: Any) -> list[str]:
+    if not isinstance(value, list):
+        return []
+    return [str(item).strip() for item in value if str(item).strip()]
+
+
+def _has_failed_scan(value: Any) -> bool:
+    if not isinstance(value, list):
+        return False
+    failure_tokens = {"fail", "failed", "error", "block", "blocked"}
+    for item in value:
+        if not isinstance(item, dict):
+            continue
+        status = str(item.get("status", "")).strip().lower()
+        if status in failure_tokens:
+            return True
+        unresolved_risks = item.get("unresolved_risks")
+        if isinstance(unresolved_risks, list) and unresolved_risks:
+            return True
+    return False

package/runtime/compat.py

@@ -674,6 +674,131 @@ def _health_snapshot(project_dir: str) -> dict[str, Any]:
     }
 
 
+def _doctor_check(name: str, *, ok: bool, message: str, required: bool = True) -> dict[str, Any]:
+    if ok:
+        status = "ok"
+    elif required:
+        status = "blocker"
+    else:
+        status = "warning"
+    return {"name": name, "status": status, "message": message, "required": required}
+
+
+def run_doctor(*, root_dir: Path | None = None) -> dict[str, Any]:
+    """Canonical install/runtime verification engine.
+
+    Called by both ``omg doctor`` CLI and the ``omg-doctor`` compat route.
+    """
+    from runtime.contract_compiler import _check_version_identity_drift
+
+    repo_root = root_dir or Path(__file__).resolve().parent.parent
+    checks: list[dict[str, Any]] = []
+
+    # 1. Python version >= 3.10
+    py_ok = sys.version_info >= (3, 10)
+    checks.append(_doctor_check(
+        "python_version",
+        ok=py_ok,
+        message=f"Python {sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}"
+        + ("" if py_ok else " (requires >=3.10)"),
+    ))
+
+    # 2. fastmcp availability
+    fastmcp_ok = False
+    fastmcp_msg = ""
+    try:
+        import importlib
+        importlib.import_module("fastmcp")
+        fastmcp_ok = True
+        fastmcp_msg = "fastmcp importable"
+    except ImportError:
+        fastmcp_msg = "fastmcp not installed — required for MCP server"
+    checks.append(_doctor_check("fastmcp", ok=fastmcp_ok, message=fastmcp_msg))
+
+    # 3. omg-control reachable (stdio config present in .mcp.json)
+    mcp_json_path = repo_root / ".mcp.json"
+    omg_control_ok = False
+    omg_control_msg = ".mcp.json not found"
+    if mcp_json_path.exists():
+        try:
+            with open(mcp_json_path, "r", encoding="utf-8") as f:
+                mcp_data = json.load(f)
+            servers = mcp_data.get("mcpServers", {})
+            if "omg-control" in servers:
+                ctrl = servers["omg-control"]
+                if ctrl.get("command"):
+                    omg_control_ok = True
+                    omg_control_msg = f"omg-control configured (stdio: {ctrl['command']})"
+                else:
+                    omg_control_ok = True
+                    omg_control_msg = "omg-control configured (non-stdio)"
+            else:
+                omg_control_msg = "omg-control not found in .mcp.json mcpServers"
+        except (json.JSONDecodeError, KeyError) as exc:
+            omg_control_msg = f".mcp.json parse error: {exc}"
+    checks.append(_doctor_check("omg_control_reachable", ok=omg_control_ok, message=omg_control_msg))
+
+    # 4. Policy files present
+    policy_path = repo_root / ".omg" / "policy.yaml"
+    commands_dir = repo_root / "commands"
+    policy_ok = policy_path.exists() or commands_dir.exists()
+    if policy_path.exists() and commands_dir.exists():
+        policy_msg = "policy.yaml and commands/ present"
+    elif policy_path.exists():
+        policy_msg = "policy.yaml present (commands/ missing)"
+    elif commands_dir.exists():
+        policy_msg = "commands/ present (policy.yaml missing)"
+    else:
+        policy_msg = "neither policy.yaml nor commands/ found"
+    checks.append(_doctor_check("policy_files", ok=policy_ok, message=policy_msg))
+
+    # 5. Metadata drift (release identity)
+    drift_result = _check_version_identity_drift(repo_root)
+    drift_ok = drift_result.get("status") == "ok"
+    drift_blockers = drift_result.get("blockers", [])
+    drift_msg = "all version surfaces aligned" if drift_ok else f"{len(drift_blockers)} drift(s): {'; '.join(drift_blockers[:3])}"
+    checks.append(_doctor_check("metadata_drift", ok=drift_ok, message=drift_msg))
+
+    # 6. Compiled bundles exist (optional)
+    bundles_dir = repo_root / "dist"
+    bundles_ok = bundles_dir.exists() and any(bundles_dir.iterdir()) if bundles_dir.exists() else False
+    bundles_msg = "dist/ contains compiled bundles" if bundles_ok else "dist/ missing or empty"
+    checks.append(_doctor_check("compiled_bundles", ok=bundles_ok, message=bundles_msg, required=False))
+
+    # 7. Host compatibility (optional)
+    claude_dir = os.environ.get("CLAUDE_DIR", os.path.expanduser("~/.claude"))
+    host_ok = os.path.isdir(claude_dir)
+    host_msg = f"host config dir exists ({claude_dir})" if host_ok else f"host config dir not found ({claude_dir})"
+    checks.append(_doctor_check("host_compatibility", ok=host_ok, message=host_msg, required=False))
+
+    # 8. HTTP memory — optional, never required
+    memory_msg = "HTTP memory not configured (optional)"
+    if mcp_json_path.exists():
+        try:
+            with open(mcp_json_path, "r", encoding="utf-8") as f:
+                mcp_data = json.load(f)
+            mem_cfg = mcp_data.get("mcpServers", {}).get("omg-memory", {})
+            if mem_cfg.get("type") == "http" and mem_cfg.get("url"):
+                memory_msg = f"omg-memory configured at {mem_cfg['url']} (optional, not probed)"
+        except (json.JSONDecodeError, KeyError):
+            pass
+    checks.append(_doctor_check("memory_reachable", ok=True, message=memory_msg, required=False))
+
+    # 9. Managed runtime venv (optional)
+    managed_venv_path = Path(claude_dir) / "omg-runtime" / ".venv"
+    venv_ok = managed_venv_path.exists()
+    venv_msg = f"managed venv at {managed_venv_path}" if venv_ok else f"managed venv not found at {managed_venv_path} (install via OMG-setup.sh)"
+    checks.append(_doctor_check("managed_runtime", ok=venv_ok, message=venv_msg, required=False))
+
+    has_blocker = any(c["status"] == "blocker" for c in checks)
+    return {
+        "schema": "DoctorResult",
+        "status": "fail" if has_blocker else "pass",
+        "checks": checks,
+        "version": CANONICAL_VERSION,
+    }
+
+
 def _write_release_artifact(project_dir: str, message: str) -> str:
     _ensure_state_layout(project_dir)
     out = os.path.join(project_dir, ".omg", "evidence", "release-draft.md")
@@ -1111,6 +1236,20 @@ def dispatch_compat_skill(
         )
 
     if route == "health":
+        if normalized == "omg-doctor":
+            doctor_result = run_doctor(root_dir=Path(root))
+            snapshot = {
+                "project_dir": root,
+                "status": doctor_result["status"],
+                "checks": doctor_result["checks"],
+            }
+            return _res(
+                skill=normalized,
+                route=route,
+                findings=["Doctor verification completed."],
+                actions=["Fix any blocker checks before shipping."],
+                result=snapshot,
+            )
         snapshot = _health_snapshot(root)
         return _res(
             skill=normalized,