@trac3er/oh-my-god 2.0.7 → 2.0.9

package/runtime/runtime_profile.py

@@ -2,31 +2,93 @@
 from __future__ import annotations
 
 from pathlib import Path
-from typing import Any
+from typing import TypedDict, cast
 
 import yaml
 
+from .adoption import CANONICAL_MODE_NAMES
 
-PROFILE_PRESETS: dict[str, dict[str, Any]] = {
+
+class RuntimeProfile(TypedDict):
+    profile: str
+    max_workers: int
+    background_polling: bool
+
+
+class CanonicalModeProfile(TypedDict):
+    concurrency: int
+    background_verification: bool
+    context_window: str
+    noise_level: str
+
+
+PROFILE_PRESETS: dict[str, RuntimeProfile] = {
     "eco": {"profile": "eco", "max_workers": 2, "background_polling": False},
     "balanced": {"profile": "balanced", "max_workers": 3, "background_polling": False},
     "turbo": {"profile": "turbo", "max_workers": 5, "background_polling": True},
 }
 
+RUNTIME_CONCURRENCY_PROFILE_NAMES = tuple(PROFILE_PRESETS.keys())
+RESERVED_CANONICAL_MODE_NAMES = CANONICAL_MODE_NAMES
+
+_CANONICAL_MODE_PROFILES: dict[str, CanonicalModeProfile] = {
+    "chill": {
+        "concurrency": 1,
+        "background_verification": False,
+        "context_window": "minimal",
+        "noise_level": "quiet",
+    },
+    "focused": {
+        "concurrency": 2,
+        "background_verification": False,
+        "context_window": "standard",
+        "noise_level": "normal",
+    },
+    "exploratory": {
+        "concurrency": 4,
+        "background_verification": True,
+        "context_window": "extended",
+        "noise_level": "verbose",
+    },
+}
+
+
+def load_canonical_mode_profile(mode: str) -> dict[str, object]:
+    normalized_mode = mode.strip().lower()
+    profile = _CANONICAL_MODE_PROFILES.get(normalized_mode)
+    if profile is None:
+        raise ValueError(
+            f"Unknown canonical mode: {mode!r}. Valid: chill, focused, exploratory"
+        )
+    return dict(profile)
 
-def load_runtime_profile(project_dir: str) -> dict[str, Any]:
+
+def load_runtime_profile(project_dir: str) -> RuntimeProfile:
     runtime_path = Path(project_dir) / ".omg" / "runtime.yaml"
     profile_name = "balanced"
     if runtime_path.exists():
         try:
-            payload = yaml.safe_load(runtime_path.read_text(encoding="utf-8")) or {}
+            raw_payload: object = yaml.safe_load(runtime_path.read_text(encoding="utf-8")) or {}
         except Exception:
-            payload = {}
-        if isinstance(payload, dict):
-            candidate = str(payload.get("profile", profile_name)).strip()
-            if candidate in PROFILE_PRESETS:
+            raw_payload = {}
+        if isinstance(raw_payload, dict):
+            payload_map = cast(dict[object, object], raw_payload)
+            payload: dict[str, object] = {}
+            for key, value in payload_map.items():
+                if isinstance(key, str):
+                    payload[key] = value
+            candidate_obj = payload.get("profile", profile_name)
+            candidate = candidate_obj.strip() if isinstance(candidate_obj, str) else profile_name
+            if candidate in RUNTIME_CONCURRENCY_PROFILE_NAMES:
                 profile_name = candidate
-    return dict(PROFILE_PRESETS[profile_name])
+
+    preset = PROFILE_PRESETS[profile_name]
+    result: RuntimeProfile = {
+        "profile": preset["profile"],
+        "max_workers": preset["max_workers"],
+        "background_polling": preset["background_polling"],
+    }
+    return result
 
 
 def resolve_parallel_workers(project_dir: str, *, requested_workers: int) -> int:
@@ -43,19 +105,29 @@ def _load_cli_parallel_cap(project_dir: str) -> int | None:
     if not config_path.exists():
         return None
     try:
-        payload = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
+        raw_payload: object = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
     except Exception:
         return None
-    if not isinstance(payload, dict):
+    if not isinstance(raw_payload, dict):
         return None
-    cli_configs = payload.get("cli_configs", {})
-    if not isinstance(cli_configs, dict):
+
+    payload_map = cast(dict[object, object], raw_payload)
+    payload: dict[str, object] = {}
+    for key, value in payload_map.items():
+        if isinstance(key, str):
+            payload[key] = value
+
+    cli_configs_obj = payload.get("cli_configs")
+    if not isinstance(cli_configs_obj, dict):
         return None
-    caps = []
+
+    cli_configs = cast(dict[object, object], cli_configs_obj)
+    caps: list[int] = []
     for config in cli_configs.values():
         if not isinstance(config, dict):
             continue
-        value = config.get("max_parallel_agents")
+        config_map = cast(dict[object, object], config)
+        value = config_map.get("max_parallel_agents")
         if isinstance(value, int) and value > 0:
             caps.append(value)
     return min(caps) if caps else None

package/runtime/security_check.py

@@ -8,6 +8,7 @@ from hashlib import sha256
 import json
 from pathlib import Path
 import re
+import shutil
 import subprocess
 from typing import Any
 
@@ -128,6 +129,8 @@ def run_security_check(
             "severity": finding.get("severity"),
             "exploitability": finding.get("exploitability", "unknown"),
             "reachability": finding.get("reachability", "unknown"),
+            "kev_listed": finding.get("kev_listed", False),
+            "epss_score": finding.get("epss_score"),
             "waived": bool(finding.get("waived")),
             "waiver_justification": finding.get("waiver_justification", ""),
             "message": finding.get("message", ""),
@@ -267,9 +270,89 @@ def _scan_python_ast(scope_path: Path) -> list[dict[str, Any]]:
             continue
         findings.extend(_scan_python_file(py_file, source))
     findings.extend(_run_bandit_if_available(scope_path))
+    findings.extend(_scan_semgrep(scope_path))
     return findings
 
 
+def run_semgrep_scan(project_dir: str, rules: str = "auto") -> dict[str, Any]:
+    unavailable = {"status": "unavailable", "findings": [], "error": "semgrep not found"}
+    if shutil.which("semgrep") is None:
+        return unavailable
+
+    cmd = ["semgrep", "--json", "--config", rules, project_dir]
+    try:
+        proc = subprocess.run(cmd, capture_output=True, text=True, check=False, timeout=60)
+    except Exception:
+        return unavailable
+
+    if proc.returncode not in {0, 1}:
+        return unavailable
+
+    try:
+        payload = json.loads(proc.stdout or "{}")
+    except Exception:
+        return unavailable
+
+    findings: list[dict[str, Any]] = []
+    for item in payload.get("results", []):
+        extra = item.get("extra") if isinstance(item.get("extra"), dict) else {}
+        start = item.get("start") if isinstance(item.get("start"), dict) else {}
+        findings.append(
+            {
+                "severity": _normalize_semgrep_severity(str(extra.get("severity", "WARNING"))),
+                "rule": str(item.get("check_id", "semgrep")),
+                "path": str(item.get("path", "")),
+                "line": _safe_int(start.get("line", 1), default=1),
+                "message": str(extra.get("message", "Semgrep finding")),
+            }
+        )
+    return {"status": "ok", "findings": findings, "error": ""}
+
+
+def _normalize_semgrep_severity(raw: str) -> str:
+    lowered = raw.lower()
+    if lowered in {"error", "critical"}:
+        return "high"
+    if lowered in {"warning", "warn"}:
+        return "medium"
+    if lowered in {"info", "note", "low"}:
+        return "low"
+    return _normalize_severity(lowered)
+
+
+def _scan_semgrep(scope_path: Path) -> list[dict[str, Any]]:
+    result = run_semgrep_scan(str(scope_path))
+    if result.get("status") != "ok":
+        return []
+
+    findings: list[dict[str, Any]] = []
+    for item in result.get("findings", []):
+        if not isinstance(item, dict):
+            continue
+        file_path = Path(str(item.get("path", "")))
+        findings.append(
+            _finding(
+                rule_id=str(item.get("rule", "semgrep")),
+                source_name="semgrep-ce",
+                category="python_ast",
+                severity=_normalize_severity(str(item.get("severity", "medium"))),
+                path=file_path,
+                line=_safe_int(item.get("line", 1), default=1),
+                message=str(item.get("message", "Semgrep finding")),
+                recommendation="Review Semgrep finding and apply the suggested remediation.",
+                snippet="",
+            )
+        )
+    return findings
+
+
+def _safe_int(value: Any, *, default: int) -> int:
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return default
+
+
 def _scan_secret_patterns(scope_path: Path) -> list[dict[str, Any]]:
     findings: list[dict[str, Any]] = []
     for candidate in _iter_text_candidates(scope_path):
@@ -488,9 +571,7 @@ def _run_bandit_if_available(scope_path: Path) -> list[dict[str, Any]]:
 
 
 def _command_exists(command: str) -> bool:
-    from shutil import which
-
-    return which(command) is not None
+    return shutil.which(command) is not None
 
 
 def _scan_dependency_health(scope_path: Path, include_live_enrichment: bool) -> list[dict[str, Any]]:
@@ -530,6 +611,8 @@ def _scan_dependency_health(scope_path: Path, include_live_enrichment: bool) ->
                     "severity": _normalize_severity(str(vuln.get("severity", "unknown"))),
                     "exploitability": _risk_to_exploitability(str(reachability.get("risk_level", ""))),
                     "reachability": _normalize_reachability(str(reachability.get("reachability", "unknown"))),
+                    "kev_listed": reachability.get("kev_listed", False),
+                    "epss_score": reachability.get("epss_score"),
                     "evidence": {
                         "package": package_name,
                         "version": dependency["version"],

package/runtime/test_intent_lock.py

@@ -1,6 +1,47 @@
 from __future__ import annotations
 
+import json
+from pathlib import Path
 from typing import Any
+from uuid import uuid4
+
+
+def lock_intent(project_dir: str, intent: dict[str, Any]) -> dict[str, Any]:
+    lock_id = str(uuid4())
+    lock_dir = Path(project_dir) / ".omg" / "state" / "test-intent-lock"
+    lock_dir.mkdir(parents=True, exist_ok=True)
+
+    lock_path = lock_dir / f"{lock_id}.json"
+    payload = {"schema": "TestIntentLock", "lock_id": lock_id, "intent": intent}
+    lock_path.write_text(json.dumps(payload, indent=2, sort_keys=True), encoding="utf-8")
+
+    return {"lock_id": lock_id, "status": "locked", "path": str(lock_path)}
+
+
+def verify_intent(project_dir: str, lock_id: str, results: dict[str, Any]) -> dict[str, Any]:
+    lock_path = Path(project_dir) / ".omg" / "state" / "test-intent-lock" / f"{lock_id}.json"
+    if not lock_path.exists():
+        return {"status": "missing_lock", "lock_id": lock_id, "reasons": ["missing lock state"]}
+
+    try:
+        payload = json.loads(lock_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {"status": "missing_lock", "lock_id": lock_id, "reasons": ["missing lock state"]}
+
+    intent = payload.get("intent") if isinstance(payload, dict) else {}
+    intent_tests = _normalize_string_list(intent.get("tests") if isinstance(intent, dict) else None)
+    result_tests = _normalize_string_list(results.get("tests"))
+    weakened_assertions = results.get("weakened_assertions")
+
+    reasons: list[str] = []
+    if isinstance(weakened_assertions, list) and weakened_assertions:
+        reasons.append("weakened_assertions_present")
+
+    if result_tests != intent_tests:
+        reasons.append("tests_mismatch")
+
+    status = "ok" if not reasons else "fail"
+    return {"status": status, "lock_id": lock_id, "reasons": reasons}
 
 
 def evaluate_test_delta(delta: dict[str, Any]) -> dict[str, Any]:
@@ -89,3 +130,9 @@ def _normalize_tests(value: Any) -> list[dict[str, Any]]:
             }
         )
     return tests
+
+
+def _normalize_string_list(value: Any) -> list[str]:
+    if not isinstance(value, list):
+        return []
+    return [str(item).strip() for item in value if str(item).strip()]

package/runtime/tracebank.py

@@ -40,6 +40,7 @@ def record_trace(
     trace_type: str,
     route: str,
     status: str,
+    schema_version: int | None = None,
     plan: dict[str, Any] | None = None,
     patch: dict[str, Any] | None = None,
     verify: dict[str, Any] | None = None,
@@ -49,7 +50,7 @@ def record_trace(
 ) -> dict[str, Any]:
     trace_id = f"trace-{uuid4().hex}"
     timestamp = _now()
-    record = {
+    record: dict[str, Any] = {
         "schema": "TracebankRecord",
         "trace_id": trace_id,
         "timestamp": timestamp,
@@ -66,6 +67,10 @@ def record_trace(
         "rejections": rejections or [],
         "metadata": metadata or {},
     }
+    if schema_version is not None:
+        record["schema_version"] = schema_version
+    elif isinstance(metadata, dict) and metadata.get("schema_version") is not None:
+        record["schema_version"] = metadata.get("schema_version")
 
     path = Path(project_dir) / TRACEBANK_REL_PATH
     path.parent.mkdir(parents=True, exist_ok=True)
@@ -73,11 +78,34 @@ def record_trace(
         _ = handle.write(json.dumps(record, ensure_ascii=True) + "\n")
 
     record["path"] = TRACEBANK_REL_PATH.as_posix()
+
+    verification_status = (metadata or {}).get("verification_status")
+    if verification_status:
+        try:
+            from runtime.background_verification import publish_verification_state
+
+            publish_verification_state(
+                project_dir=project_dir,
+                run_id=trace_id,
+                status=str(verification_status),
+                blockers=(metadata or {}).get("verification_blockers", []),
+                evidence_links=(metadata or {}).get("verification_evidence_links", []),
+                progress=(metadata or {}).get("verification_progress", {}),
+            )
+        except Exception:
+            pass
+
     return record
 
 
-def link_evidence(project_dir: str, *, trace_id: str, evidence_path: str) -> dict[str, Any]:
-    link = {
+def link_evidence(
+    project_dir: str,
+    *,
+    trace_id: str,
+    evidence_path: str,
+    schema_version: int | None = None,
+) -> dict[str, Any]:
+    link: dict[str, Any] = {
         "schema": "TraceEvidenceLink",
         "trace_id": trace_id,
         "evidence_path": evidence_path,
@@ -85,6 +113,8 @@ def link_evidence(project_dir: str, *, trace_id: str, evidence_path: str) -> dic
         "executor": _executor(),
         "environment": _environment(),
     }
+    if schema_version is not None:
+        link["schema_version"] = schema_version
 
     path = Path(project_dir) / TRACEBANK_EVIDENCE_LINKS_REL_PATH
     path.parent.mkdir(parents=True, exist_ok=True)

package/runtime/verification_loop.py

@@ -0,0 +1,73 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import cast
+
+
+def _as_int(value: object, default: int) -> int:
+    if isinstance(value, bool):
+        return int(value)
+    if isinstance(value, int):
+        return value
+    if isinstance(value, float):
+        return int(value)
+    if isinstance(value, str):
+        try:
+            return int(value)
+        except ValueError:
+            return default
+    return default
+
+
+def _as_string_list(value: object) -> list[str]:
+    if not isinstance(value, list):
+        return []
+    items = cast(list[object], value)
+    return [str(item) for item in items]
+
+
+def build_loop_policy(
+    host: str,
+    max_iterations: int,
+    timeout_minutes: int,
+    read_only_default: bool = True,
+) -> dict[str, object]:
+    return {
+        "host": host,
+        "max_iterations": max_iterations,
+        "timeout_minutes": timeout_minutes,
+        "read_only_default": read_only_default,
+    }
+
+
+def should_continue_loop(state: Mapping[str, object]) -> dict[str, object]:
+    iteration = _as_int(state.get("iteration", 0), 0)
+    max_iterations = _as_int(state.get("max_iterations", 0), 0)
+    status = str(state.get("status", ""))
+
+    if iteration >= max_iterations:
+        return {"continue": False, "reason": "max_iterations_reached"}
+    if status == "ok":
+        return {"continue": False, "reason": "status_ok"}
+    return {"continue": True, "reason": "within_budget"}
+
+
+def summarize_next_step(state: Mapping[str, object]) -> dict[str, object]:
+    status = str(state.get("status", ""))
+    blockers = _as_string_list(state.get("blockers"))
+    evidence_links = _as_string_list(state.get("evidence_links"))
+
+    if blockers:
+        next_action = f"resolve blockers: {', '.join(blockers)}"
+    elif status in {"error", "blocked"}:
+        next_action = "verify evidence links and remediate verification errors"
+    elif evidence_links:
+        next_action = "verify evidence links"
+    else:
+        next_action = "collect verification evidence links"
+
+    return {
+        "next_action": next_action,
+        "evidence_links": evidence_links,
+        "blockers": blockers,
+    }

package/scripts/omg.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""OMG 2.0.7 CLI entrypoint.
+"""OMG 2.0.8 CLI entrypoint.
 
 Implements practical command-line flows for:
 - omg ship
@@ -10,6 +10,7 @@ Implements practical command-line flows for:
 - omg trust review
 - omg runtime dispatch
 - omg lab train / omg lab eval
+- omg forge run
 """
 from __future__ import annotations
 
@@ -57,7 +58,7 @@ from runtime.compat import (
     list_compat_skills,
     run_doctor,
 )
-from runtime.adoption import CANONICAL_VERSION
+from runtime.adoption import CANONICAL_VERSION, VALID_PRESETS
 from runtime.ecosystem import ecosystem_status, list_ecosystem_repos, sync_ecosystem_repos
 from runtime.team_router import TeamDispatchRequest, dispatch_team, execute_ccg_mode, execute_crazy_mode
 
@@ -409,6 +410,22 @@ def cmd_lab_eval(args: argparse.Namespace) -> int:
     return 0 if out.get("status") == "published" else 2
 
 
+def cmd_forge_run(args: argparse.Namespace) -> int:
+    preset = args.preset
+    if preset != "labs":
+        print(
+            json.dumps(
+                {"status": "error", "message": f"forge requires labs preset, got: {preset}"},
+                indent=2,
+            )
+        )
+        return 2
+    job = json.loads(args.job_json) if args.job_json else _load_json(args.job)
+    result = run_pipeline(job)
+    print(json.dumps(result, indent=2))
+    return 0 if result.get("status") in {"ready", "failed_evaluation"} else 2
+
+
 def cmd_teams(args: argparse.Namespace) -> int:
     files = [f.strip() for f in args.files.split(",") if f.strip()] if args.files else []
     req = TeamDispatchRequest(
@@ -633,12 +650,14 @@ def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
     contract_validate = contract_sub.add_parser("validate", help="Validate contract doc, schema, and bundle registry")
     contract_validate.set_defaults(func=cmd_contract_validate)
 
-    contract_compile = contract_sub.add_parser("compile", help="Compile Claude/Codex artifacts from the canonical contract")
+    contract_compile = contract_sub.add_parser(
+        "compile", help="Compile host artifacts from the canonical contract"
+    )
     contract_compile.add_argument(
         "--host",
         dest="hosts",
         action="append",
-        choices=["claude", "codex"],
+        choices=["claude", "codex", "gemini", "kimi"],
         required=True,
         help="Host to compile (repeat for multiple hosts)",
     )
@@ -816,6 +835,14 @@ def build_parser() -> argparse.ArgumentParser:
     lab_eval.add_argument("--result-json", default="", help="Inline result json")
     lab_eval.set_defaults(func=cmd_lab_eval)
 
+    forge = sub.add_parser("forge", help="Labs-only domain-model prototyping and evaluation")
+    forge_sub = forge.add_subparsers(dest="forge_command", required=True)
+    forge_run = forge_sub.add_parser("run", help="Run a forge job through the lab pipeline")
+    forge_run.add_argument("--job", default="", help="Path to job json")
+    forge_run.add_argument("--job-json", default="", help="Inline job json")
+    forge_run.add_argument("--preset", default="labs", choices=list(VALID_PRESETS), help="Adoption preset (must be labs)")
+    forge_run.set_defaults(func=cmd_forge_run)
+
     teams = sub.add_parser("teams", help="Internal OMG team routing")
     teams.add_argument("--target", default="auto", choices=["auto", "codex", "gemini", "ccg"])
     teams.add_argument("--problem", required=True)

package/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.0.7 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.0.9 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -306,8 +306,9 @@
     ]
   },
   "_omg": {
-    "_version": "2.0.7",
+    "_version": "2.0.9",
     "preset": "safe",
+    "omgMode": "focused",
     "default_mode": "ulw+ralph",
     "vision_auto": true,
     "false_fix_detection": true,
@@ -359,10 +360,14 @@
       "CONTEXT_MANAGER": false
     },
     "generated": {
-      "contract_version": "2.0.7",
+      "contract_version": "2.0.9",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",
+        "plan-council",
+        "claim-judge",
+        "test-intent-lock",
+        "proof-gate",
         "hook-governor",
         "mcp-fabric",
         "lsp-pack",

package/tools/python_sandbox.py

@@ -1,6 +1,5 @@
 #!/usr/bin/env python3
-"""
-Security Sandbox for OMG Python REPL
+"""Security Sandbox for OMG Python REPL (REPL-only).
 
 Provides a restricted execution environment that blocks dangerous operations:
 - Dangerous imports (subprocess, socket, ctypes, etc.)
@@ -11,6 +10,10 @@ Provides a restricted execution environment that blocks dangerous operations:
 
 Feature flag: OMG_REPL_SANDBOX_ENABLED (default: False)
 
+This module is the concrete REPL-only sandbox implementation. Broader sandbox
+policy is mediated by hook-level controls in hooks/firewall.py and
+hooks/secret-guard.py.
+
 Usage:
     from tools.python_sandbox import execute_sandboxed, is_safe_code, create_sandbox
 
@@ -67,7 +70,7 @@ def _is_sandbox_enabled() -> bool:
 
 # --- Blocked imports configuration ---
 
-_DEFAULT_BLOCKED_IMPORTS: frozenset = frozenset({
+_DEFAULT_BLOCKED_IMPORTS: frozenset[str] = frozenset({
     "subprocess",
     "socket",
     "ctypes",
@@ -91,13 +94,13 @@ def _get_blocked_imports() -> Set[str]:
     env_val = os.environ.get("OMG_SANDBOX_BLOCKED_IMPORTS", "").strip()
     if env_val:
         custom = frozenset(name.strip() for name in env_val.split(",") if name.strip())
-        return _DEFAULT_BLOCKED_IMPORTS | custom
+        return set(_DEFAULT_BLOCKED_IMPORTS | custom)
     return set(_DEFAULT_BLOCKED_IMPORTS)
 
 
 # --- Blocked builtins ---
 
-_DANGEROUS_BUILTINS: frozenset = frozenset({
+_DANGEROUS_BUILTINS: frozenset[str] = frozenset({
     "__import__",
     "eval",
     "exec",
@@ -278,7 +281,7 @@ def _check_string_escapes(code: str) -> Optional[str]:
 
 # --- Restricted open() ---
 
-_ALLOWED_READ_MODES: frozenset = frozenset({
+_ALLOWED_READ_MODES: frozenset[str] = frozenset({
     "r", "rb", "rt",
     "",  # default mode is 'r'
 })