@trac3er/oh-my-god 2.1.0 → 2.1.4

package/build/lib/runtime/mutation_gate.py

@@ -2,13 +2,25 @@ from __future__ import annotations
 
 import json
 import os
+import re
+import warnings
 from datetime import datetime, timezone
 from hashlib import sha256
 from pathlib import Path
 
+from runtime.release_run_coordinator import resolve_current_run_id
+from runtime.test_intent_lock import verify_lock
+
 
 _MUTATING_TOOLS = frozenset({"Write", "Edit", "MultiEdit"})
 _EXEMPTIONS = frozenset({"docs", "config", "generated", "test"})
+_MUTATION_BASH_PATTERNS = (
+    r"\b(git\s+(add|commit|push|rebase|cherry-pick|merge|tag))\b",
+    r"\b(rm|mv|cp|tee|touch|mkdir|rmdir|ln)\b",
+    r"\b(sed\s+-i|perl\s+-pi)\b",
+    r"\b(chmod|chown)\b",
+    r">\s*[^\s]",
+)
 
 
 def check_mutation_allowed(
@@ -18,11 +30,25 @@ def check_mutation_allowed(
     lock_id: str | None,
     *,
     exemption: str | None = None,
+    command: str | None = None,
+    run_id: str | None = None,
+    metadata: dict[str, object] | None = None,
 ) -> dict[str, str | None]:
     normalized_tool = str(tool or "").strip()
     normalized_file_path = str(file_path or "").strip()
     normalized_lock_id = str(lock_id or "").strip() or None
     normalized_exemption = str(exemption or "").strip().lower() or None
+    normalized_command = str(command or "").strip()
+    metadata_obj = metadata if isinstance(metadata, dict) else {}
+    explicit_exempt = bool(metadata_obj.get("exempt") is True)
+    strict_mode = os.environ.get("OMG_TDD_GATE_STRICT", "0").strip() == "1"
+
+    if explicit_exempt:
+        return {
+            "status": "exempt",
+            "reason": "metadata exemption allows mutation without lock",
+            "lock_id": normalized_lock_id,
+        }
 
     if normalized_exemption in _EXEMPTIONS:
         return {
@@ -31,36 +57,56 @@ def check_mutation_allowed(
             "lock_id": normalized_lock_id,
         }
 
-    if normalized_tool not in _MUTATING_TOOLS:
+    requires_lock = normalized_tool in _MUTATING_TOOLS
+    if normalized_tool == "Bash":
+        requires_lock = _is_mutation_capable_bash(normalized_command)
+
+    if not requires_lock:
         return {
             "status": "allowed",
             "reason": "tool is read-only for mutation gate",
             "lock_id": normalized_lock_id,
         }
 
-    if normalized_lock_id and _lock_exists(project_dir, normalized_lock_id):
+    resolved_run_id = str(run_id or "").strip() or resolve_current_run_id(project_dir=project_dir)
+    verification = verify_lock(project_dir, run_id=resolved_run_id, lock_id=normalized_lock_id)
+    if verification.get("status") == "ok":
         return {
             "status": "allowed",
             "reason": "active test intent lock found",
+            "lock_id": str(verification.get("lock_id") or normalized_lock_id or "") or None,
+        }
+
+    reason = str(verification.get("reason", "no_active_test_intent_lock"))
+    if strict_mode:
+        _write_block_artifact(project_dir, normalized_tool, normalized_file_path, reason)
+        return {
+            "status": "blocked",
+            "reason": reason,
             "lock_id": normalized_lock_id,
         }
 
-    reason = (
-        "mutation denied: active test intent lock is required for mutation tools"
-        if not normalized_lock_id
-        else f"mutation denied: lock_id '{normalized_lock_id}' not found"
+    warnings.warn(
+        f"mutation_gate_permissive_allow:{normalized_tool}:{reason}",
+        RuntimeWarning,
+        stacklevel=2,
     )
-    _write_block_artifact(project_dir, normalized_tool, normalized_file_path, reason)
     return {
-        "status": "blocked",
+        "status": "allowed",
         "reason": reason,
         "lock_id": normalized_lock_id,
     }
 
 
-def _lock_exists(project_dir: str, lock_id: str) -> bool:
-    lock_path = Path(project_dir) / ".omg" / "state" / "test-intent-lock" / f"{lock_id}.json"
-    return lock_path.is_file()
+def _is_mutation_capable_bash(command: str) -> bool:
+    normalized_command = str(command or "").strip()
+    if not normalized_command:
+        return False
+    lowered = normalized_command.lower()
+    for pattern in _MUTATION_BASH_PATTERNS:
+        if re.search(pattern, lowered):
+            return True
+    return False
 
 
 def _write_block_artifact(project_dir: str, tool: str, file_path: str, reason: str) -> None:

package/build/lib/runtime/omg_compat_contract_snapshot.json

@@ -1,6 +1,6 @@
 {
   "schema": "OmgCompatContractSnapshot",
-  "contract_version": "2.1.0",
+  "contract_version": "2.1.4",
   "count": 47,
   "contracts": [
     {
@@ -912,5 +912,5 @@
       "notes": "Writes long-form memory artifact for writing workflows."
     }
   ],
-  "generated_at": "2026-03-08T19:35:25.796113+00:00"
+  "generated_at": "2026-03-09T21:20:44.496932+00:00"
 }

package/build/lib/runtime/omg_mcp_server.py

@@ -125,7 +125,7 @@ def _read_repo_text(rel_path: str) -> str:
 
 @mcp.tool()
 def omg_policy_evaluate(tool: str, input: dict[str, Any]) -> dict[str, Any]:
-    if tool in {"Write", "Edit", "MultiEdit"}:
+    if tool in {"Write", "Edit", "MultiEdit", "Bash"}:
         run_id_candidate = input.get("run_id") if isinstance(input, dict) else None
         run_id: str | None = None
         if isinstance(run_id_candidate, str) and run_id_candidate.strip():
@@ -138,9 +138,10 @@ def omg_policy_evaluate(tool: str, input: dict[str, Any]) -> dict[str, Any]:
         if not run_id:
             run_id = resolve_current_run_id()
 
-        tool_plan_result = tool_plan_gate_check(_service().project_dir, run_id, tool)
-        if tool_plan_result.get("status") == "blocked":
-            return tool_plan_result
+        if tool in {"Write", "Edit", "MultiEdit"}:
+            tool_plan_result = tool_plan_gate_check(_service().project_dir, run_id, tool)
+            if tool_plan_result.get("status") == "blocked":
+                return tool_plan_result
 
         lock_id: str | None = None
         if isinstance(metadata, dict):
@@ -158,6 +159,9 @@ def omg_policy_evaluate(tool: str, input: dict[str, Any]) -> dict[str, Any]:
                 "file_path": str(input.get("file_path", "")) if isinstance(input, dict) else "",
                 "lock_id": lock_id,
                 "exemption": exemption,
+                "command": str(input.get("command", "")) if isinstance(input, dict) else "",
+                "run_id": run_id,
+                "metadata": metadata if isinstance(metadata, dict) else None,
             }
         )
         if gate_status == 200 and gate_payload.get("status") == "blocked":
@@ -238,6 +242,12 @@ def omg_guide_assert(candidate: str, rules: dict[str, Any]) -> dict[str, Any]:
     return payload
 
 
+@mcp.tool()
+def omg_get_session_health(run_id: str | None = None) -> dict[str, Any]:
+    _status, payload = _service().session_health({"run_id": run_id})
+    return payload
+
+
 @mcp.prompt(name="omg_contract_summary", description="Summarize the OMG production contract and generated host outputs")
 def omg_contract_summary(channel: str = "public") -> str:
     return (

package/build/lib/runtime/preflight.py

@@ -1,6 +1,7 @@
 """Structured preflight routing for OMG."""
 from __future__ import annotations
 
+import importlib
 from runtime.delta_classifier import classify_project_changes
 from runtime.tracebank import record_trace
 from typing import Any
@@ -45,6 +46,7 @@ def run_preflight(project_dir: str, *, goal: str) -> dict[str, Any]:
     categories = set(delta["categories"])
     requires_security_check = _requires_security_check(delta)
     domain_packs = [category for category in delta["categories"] if category in {"robotics", "vision", "algorithms", "health"}]
+    evidence_requirements = _requirements_for_profile(delta.get("evidence_profile"))
 
     if requires_security_check:
         task_class = "security"
@@ -83,6 +85,7 @@ def run_preflight(project_dir: str, *, goal: str) -> dict[str, Any]:
         "required_mcps": ["omg-control"] if route in {"security-check", "api-twin", "crazy"} else [],
         "missing_constraints": [],
         "evidence_plan": _evidence_plan(route),
+        "evidence_requirements": evidence_requirements,
         "delta_classification": delta,
         "domain_packs": domain_packs,
         "trace": {"trace_id": trace["trace_id"], "path": trace["path"]},
@@ -101,6 +104,17 @@ def _requires_security_check(delta: dict[str, Any]) -> bool:
     return False
 
 
+def _requirements_for_profile(evidence_profile: str | None) -> list[str]:
+    module = importlib.import_module("runtime.evidence_requirements")
+    resolver = getattr(module, "requirements_for_profile", None)
+    if callable(resolver):
+        resolved = resolver(evidence_profile)
+        if isinstance(resolved, (list, tuple, set)):
+            return [str(item) for item in resolved]
+    full = getattr(module, "FULL_REQUIREMENTS", [])
+    return [str(item) for item in full]
+
+
 def _required_tools(route: str) -> list[str]:
     return {
         "security-check": ["security"],

package/build/lib/runtime/profile_io.py

@@ -0,0 +1,294 @@
+"""Canonical profile I/O — single owner of profile.yaml read/write/version.
+
+All profile consumers should use this module to load and persist profile data.
+``profile_version`` is derived from a canonical key-sorted JSON hash of the
+parsed dict, never from raw file text.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from typing import Any
+
+import yaml
+
+
+def load_profile(path: str) -> dict[str, Any]:
+    """Load a profile from *path*, returning a dict.
+
+    Handles both YAML and JSON-shaped content transparently (backward compat).
+    Returns ``{}`` when the file is missing or unreadable.
+    """
+    if not os.path.exists(path):
+        return {}
+    try:
+        with open(path, "r", encoding="utf-8", errors="replace") as fh:
+            payload = yaml.safe_load(fh)
+    except Exception:
+        return {}
+    if isinstance(payload, dict):
+        return payload
+    return {}
+
+
+def save_profile(path: str, data: dict[str, Any]) -> None:
+    """Persist *data* as canonical YAML to *path*.
+
+    Creates parent directories when needed.  Output is always YAML (never JSON)
+    so that ``profile_version_from_map`` produces a deterministic hash
+    regardless of how the file was previously written.
+
+    Uses an internal serializer that correctly round-trips empty collections
+    as ``[]`` / ``{}`` instead of bare ``key:`` (which the project yaml shim
+    parses back as ``None``).
+    """
+    parent = os.path.dirname(path)
+    if parent:
+        os.makedirs(parent, exist_ok=True)
+    dumped = "\n".join(_dump_lines(data, 0)) + "\n"
+    with open(path, "w", encoding="utf-8") as fh:
+        fh.write(dumped)
+
+
+def profile_version_from_map(data: dict[str, Any]) -> str:
+    """Derive a deterministic version string from a parsed profile dict.
+
+    The version is the full SHA-256 hex digest of the canonical key-sorted
+    JSON representation.  This is independent of on-disk formatting (JSON
+    vs YAML, whitespace, key ordering).
+    """
+    canonical = json.dumps(data, sort_keys=True, ensure_ascii=True)
+    return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+
+# ---------------------------------------------------------------------------
+# Internal YAML serializer — mirrors the project yaml shim's ``_dump_lines``
+# but renders empty collections as ``[]`` / ``{}`` so that ``yaml.safe_load``
+# round-trips them correctly.
+# ---------------------------------------------------------------------------
+
+_YAML_SPECIAL_WORDS = frozenset(
+    ("true", "false", "null", "yes", "no", "on", "off")
+)
+_YAML_SPECIAL_CHARS = set(":#{}[],&*?|>!%@`\"'")
+
+
+def _dump_scalar(value: object) -> str:
+    """Serialize a scalar to a YAML-safe string."""
+    if value is None:
+        return "null"
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, (int, float)):
+        return str(value)
+    text = str(value)
+    if (
+        text.lower() in _YAML_SPECIAL_WORDS
+        or text != text.strip()
+        or any(ch in _YAML_SPECIAL_CHARS for ch in text)
+        or not text
+        or _looks_numeric(text)
+    ):
+        return json.dumps(text, ensure_ascii=False)
+    return text
+
+
+def _looks_numeric(text: str) -> bool:
+    """Return True if *text* would be parsed as a number by yaml.safe_load."""
+    try:
+        float(text)
+        return True
+    except (TypeError, ValueError):
+        return False
+
+
+def _dump_lines(value: object, indent: int) -> list[str]:
+    """Recursively serialize *value* to a list of YAML lines."""
+    prefix = " " * indent
+    if isinstance(value, dict):
+        if not value:
+            return [f"{prefix}{{}}"]
+        lines: list[str] = []
+        for key, item in value.items():
+            if isinstance(item, dict):
+                if not item:
+                    lines.append(f"{prefix}{key}: {{}}")
+                else:
+                    lines.append(f"{prefix}{key}:")
+                    lines.extend(_dump_lines(item, indent + 2))
+            elif isinstance(item, list):
+                if not item:
+                    lines.append(f"{prefix}{key}: []")
+                else:
+                    lines.append(f"{prefix}{key}:")
+                    lines.extend(_dump_lines(item, indent + 2))
+            else:
+                lines.append(f"{prefix}{key}: {_dump_scalar(item)}")
+        return lines
+    if isinstance(value, list):
+        if not value:
+            return [f"{prefix}[]"]
+        lines = []
+        for item in value:
+            if isinstance(item, dict):
+                nested = _dump_lines(item, indent + 2)
+                if nested:
+                    first = nested[0].strip()
+                    lines.append(f"{prefix}- {first}")
+                    lines.extend(nested[1:])
+                else:
+                    lines.append(f"{prefix}- {{}}")
+            elif isinstance(item, list):
+                lines.append(f"{prefix}-")
+                lines.extend(_dump_lines(item, indent + 2))
+            else:
+                lines.append(f"{prefix}- {_dump_scalar(item)}")
+        return lines
+    return [f"{prefix}{_dump_scalar(value)}"]
+
+
+_GOVERNED_SECTIONS = ("style", "safety")
+_GOVERNED_CONFIRMATION_STATES = ("confirmed", "pending_confirmation", "inferred")
+
+
+def classify_preference_section(field: str, value: str) -> str:
+    token = f"{field} {value}".lower()
+    if "safety" in token or "guardrail" in token or "override" in token:
+        return "safety"
+    return "style"
+
+
+def is_destructive_preference(field: str, value: str) -> bool:
+    token = f"{field} {value}".lower()
+    destructive_tokens = (
+        "disable",
+        "off",
+        "bypass",
+        "ignore",
+        "override",
+        "unsafe",
+        "no_guard",
+        "no guard",
+    )
+    return any(piece in token for piece in destructive_tokens)
+
+
+def ensure_governed_preferences(profile: dict[str, Any]) -> None:
+    governed_obj = profile.get("governed_preferences")
+    governed = governed_obj if isinstance(governed_obj, dict) else {}
+    for section in _GOVERNED_SECTIONS:
+        raw_entries = governed.get(section)
+        if not isinstance(raw_entries, list):
+            governed[section] = []
+            continue
+        normalized: list[dict[str, Any]] = []
+        for raw in raw_entries:
+            if not isinstance(raw, dict):
+                continue
+            entry = _normalize_governed_entry(raw, section)
+            if entry is not None:
+                normalized.append(entry)
+        governed[section] = normalized
+    profile["governed_preferences"] = governed
+
+
+def upsert_governed_preference(
+    profile: dict[str, Any],
+    *,
+    field: str,
+    value: str,
+    source: str,
+    learned_at: str,
+    updated_at: str,
+    section: str,
+    confirmation_state: str,
+    decay_metadata: dict[str, Any] | None,
+) -> None:
+    ensure_governed_preferences(profile)
+    governed = profile["governed_preferences"]
+    if not isinstance(governed, dict):
+        return
+    target = governed.get(section)
+    if not isinstance(target, list):
+        target = []
+
+    match_index = -1
+    for idx, raw_entry in enumerate(target):
+        if not isinstance(raw_entry, dict):
+            continue
+        if str(raw_entry.get("field", "")).strip() == field and str(raw_entry.get("value", "")).strip() == value:
+            match_index = idx
+            break
+
+    baseline: dict[str, Any] = {
+        "field": field,
+        "value": value,
+        "source": source,
+        "learned_at": learned_at,
+        "updated_at": updated_at,
+        "section": section,
+        "confirmation_state": confirmation_state,
+    }
+    if section == "style" and decay_metadata is not None:
+        baseline["decay_metadata"] = decay_metadata
+
+    if match_index == -1:
+        target.append(baseline)
+    else:
+        existing = target[match_index]
+        if isinstance(existing, dict):
+            baseline["learned_at"] = str(existing.get("learned_at", learned_at)).strip() or learned_at
+        target[match_index] = baseline
+
+    governed[section] = target
+
+
+def _normalize_governed_entry(raw: dict[str, Any], section: str) -> dict[str, Any] | None:
+    field = str(raw.get("field", "")).strip()
+    value = " ".join(str(raw.get("value", "")).strip().split())
+    source = str(raw.get("source", "")).strip()
+    learned_at = str(raw.get("learned_at", "")).strip()
+    updated_at = str(raw.get("updated_at", "")).strip()
+    section_raw = str(raw.get("section", section)).strip().lower()
+    confirmation_state = str(raw.get("confirmation_state", "")).strip().lower()
+
+    if not (field and value and source and learned_at and updated_at):
+        return None
+    if section_raw not in _GOVERNED_SECTIONS:
+        return None
+    if confirmation_state not in _GOVERNED_CONFIRMATION_STATES:
+        return None
+
+    out: dict[str, Any] = {
+        "field": field,
+        "value": value,
+        "source": source,
+        "learned_at": learned_at,
+        "updated_at": updated_at,
+        "section": section_raw,
+        "confirmation_state": confirmation_state,
+    }
+
+    if section_raw == "style" and confirmation_state == "inferred":
+        decay_raw = raw.get("decay_metadata")
+        decay = decay_raw if isinstance(decay_raw, dict) else {}
+        out["decay_metadata"] = {
+            "decay_score": _coerce_decay_score(decay.get("decay_score", 0.0)),
+            "last_seen_at": str(decay.get("last_seen_at", updated_at)).strip() or updated_at,
+            "decay_reason": str(decay.get("decay_reason", "inferred_signal")).strip() or "inferred_signal",
+        }
+    return out
+
+
+def _coerce_decay_score(raw: Any) -> float:
+    try:
+        score = float(raw)
+    except (TypeError, ValueError):
+        score = 0.0
+    if score < 0.0:
+        return 0.0
+    if score > 1.0:
+        return 1.0
+    return round(score, 3)