@trac3er/oh-my-god 2.1.0 → 2.1.4

package/build/lib/runtime/release_surfaces.py

@@ -0,0 +1,243 @@
+"""Shared release surface inventory.
+
+Single audited source of truth for all version surfaces in the OMG project.
+This module describes WHERE version strings appear and HOW to find/update them.
+
+It does NOT import runtime.adoption or encode the canonical version value.
+The canonical version lives solely in runtime/adoption.py:CANONICAL_VERSION.
+
+Consumers:
+    - scripts/sync-release-identity.py  (sync/check flow)
+    - runtime/contract_compiler.py      (drift gate)
+    - tests/test_trust_release_identity.py (parity assertions)
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Union
+
+# ── Valid surface type identifiers ──────────────────────────────────────────
+
+SURFACE_TYPES = frozenset({
+    "json_key_path",
+    "regex_line",
+    "yaml_line",
+    "frontmatter_field",
+    "changelog_header",
+    "shell_literal",
+    "js_literal",
+    "banner_literal",
+})
+
+
+@dataclass(frozen=True)
+class AuthoredSurface:
+    """A version surface in an authored source file.
+
+    Attributes:
+        file_path: Relative path from repo root.
+        surface_type: One of SURFACE_TYPES.
+        field: For json_key_path — list of str/int keys to navigate.
+               For regex_line/shell_literal/js_literal/banner_literal — regex pattern.
+               For yaml_line/frontmatter_field — the YAML field name.
+               For changelog_header — regex pattern matching the header.
+        description: Human-readable description of this surface.
+    """
+
+    file_path: str
+    surface_type: str
+    field: Union[list[Union[str, int]], str]
+    description: str = ""
+
+
+# ── Explicit YAML bundle names (22 files) ──────────────────────────────────
+
+_BUNDLE_NAMES: tuple[str, ...] = (
+    "algorithms",
+    "api-twin",
+    "claim-judge",
+    "control-plane",
+    "data-lineage",
+    "delta-classifier",
+    "eval-gate",
+    "health",
+    "hook-governor",
+    "incident-replay",
+    "lsp-pack",
+    "mcp-fabric",
+    "plan-council",
+    "preflight",
+    "proof-gate",
+    "remote-supervisor",
+    "robotics",
+    "secure-worktree-pipeline",
+    "security-check",
+    "test-intent-lock",
+    "tracebank",
+    "vision",
+)
+
+
+# ── Authored surfaces: explicit, no dynamic discovery ──────────────────────
+
+AUTHORED_SURFACES: list[AuthoredSurface] = [
+    # ── JSON key paths (10 fields across 7 files) ──
+    AuthoredSurface(
+        "package.json", "json_key_path", ["version"],
+        "npm package version",
+    ),
+    AuthoredSurface(
+        "settings.json", "json_key_path", ["_omg", "_version"],
+        "OMG settings version",
+    ),
+    AuthoredSurface(
+        "settings.json", "json_key_path", ["_omg", "generated", "contract_version"],
+        "OMG generated contract version",
+    ),
+    AuthoredSurface(
+        ".claude-plugin/plugin.json", "json_key_path", ["version"],
+        "Claude plugin version",
+    ),
+    AuthoredSurface(
+        ".claude-plugin/marketplace.json", "json_key_path", ["version"],
+        "marketplace top-level version",
+    ),
+    AuthoredSurface(
+        ".claude-plugin/marketplace.json", "json_key_path", ["metadata", "version"],
+        "marketplace metadata version",
+    ),
+    AuthoredSurface(
+        ".claude-plugin/marketplace.json", "json_key_path", ["plugins", 0, "version"],
+        "marketplace plugins[0] version",
+    ),
+    AuthoredSurface(
+        "plugins/core/plugin.json", "json_key_path", ["version"],
+        "core plugin version",
+    ),
+    AuthoredSurface(
+        "plugins/advanced/plugin.json", "json_key_path", ["version"],
+        "advanced plugin version",
+    ),
+    AuthoredSurface(
+        "registry/omg-capability.schema.json", "json_key_path", ["version"],
+        "capability schema version",
+    ),
+
+    # ── Regex line (pyproject.toml) ──
+    AuthoredSurface(
+        "pyproject.toml", "regex_line", r'^version = "(.+?)"',
+        "Python package version",
+    ),
+
+    # ── YAML bundles (22 files) ──
+    *[
+        AuthoredSurface(
+            f"registry/bundles/{name}.yaml", "yaml_line", "version",
+            f"{name} bundle version",
+        )
+        for name in _BUNDLE_NAMES
+    ],
+
+    # ── Changelog ──
+    AuthoredSurface(
+        "CHANGELOG.md", "changelog_header", r'^## \[?(\d+\.\d+\.\d+)\]?',
+        "latest release header",
+    ),
+
+    # ── 6 previously missing authored surfaces ──
+
+    # 1. OMG_COMPAT_CONTRACT.md — frontmatter version: field (line 3)
+    AuthoredSurface(
+        "OMG_COMPAT_CONTRACT.md", "frontmatter_field", "version",
+        "compat contract frontmatter version",
+    ),
+
+    # 2. CLI-ADAPTER-MAP.md — 3 docs example version markers
+    AuthoredSurface(
+        "CLI-ADAPTER-MAP.md", "regex_line",
+        r'^- \*\*Version:\*\* `(\d+\.\d+\.\d+)`',
+        "docs example: version badge (line 165)",
+    ),
+    AuthoredSurface(
+        "CLI-ADAPTER-MAP.md", "regex_line",
+        r'^\s*"version":\s*"(\d+\.\d+\.\d+)"',
+        "docs example: JSON version literal (line 209)",
+    ),
+    AuthoredSurface(
+        "CLI-ADAPTER-MAP.md", "regex_line",
+        r'^CANONICAL_VERSION\s*=\s*"(\d+\.\d+\.\d+)"',
+        "docs example: Python constant (line 241)",
+    ),
+
+    # 3. OMG-setup.sh — VERSION="..." shell literal (line 8)
+    AuthoredSurface(
+        "OMG-setup.sh", "shell_literal", r'^VERSION="(.+?)"',
+        "setup script version variable",
+    ),
+
+    # 4. hud/omg-hud.mjs — JS fallback literal (line 90)
+    AuthoredSurface(
+        "hud/omg-hud.mjs", "js_literal", r'return "(\d+\.\d+\.\d+)"',
+        "HUD fallback version literal",
+    ),
+
+    # 5. .claude-plugin/scripts/install.sh — installer banner literal (line 22)
+    AuthoredSurface(
+        ".claude-plugin/scripts/install.sh", "banner_literal",
+        r'v(\d+\.\d+\.\d+)',
+        "installer banner version",
+    ),
+
+    # 6. runtime/omg_compat_contract_snapshot.json — contract_version field
+    AuthoredSurface(
+        "runtime/omg_compat_contract_snapshot.json", "json_key_path",
+        ["contract_version"],
+        "compat contract snapshot version",
+    ),
+]
+
+
+# ── Derived (generated) surface directories ────────────────────────────────
+# These are validation-only targets — not authored, but must be checked for
+# stale version residue after a bump.
+
+DERIVED_SURFACE_DIRS: list[str] = [
+    "dist/",
+    "artifacts/release/",
+    "build/lib/",
+]
+
+
+# ── Scoped residue targets ─────────────────────────────────────────────────
+# Specific files/dirs inside generated trees where stale version residue
+# must be rejected after a version bump.
+
+SCOPED_RESIDUE_TARGETS: list[str] = [
+    "dist/public/manifest.json",
+    "dist/enterprise/manifest.json",
+    "dist/public/bundle/",
+    "dist/enterprise/bundle/",
+    "artifacts/release/",
+    "build/lib/",
+]
+
+
+# ── Helpers ─────────────────────────────────────────────────────────────────
+
+def get_authored_paths() -> list[str]:
+    """Return deduplicated list of file paths from AUTHORED_SURFACES.
+
+    Preserves insertion order; useful for disk-existence checks.
+    """
+    seen: set[str] = set()
+    paths: list[str] = []
+    for surface in AUTHORED_SURFACES:
+        if surface.file_path not in seen:
+            seen.add(surface.file_path)
+            paths.append(surface.file_path)
+    return paths
+
+
+def get_derived_dirs() -> list[str]:
+    """Return all generated directory paths."""
+    return list(DERIVED_SURFACE_DIRS)

package/build/lib/runtime/rollback_manifest.py

@@ -0,0 +1,136 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import json
+from pathlib import Path
+from typing import Any
+
+
+def _utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def create_rollback_manifest(run_id: str, step_id: str) -> dict[str, Any]:
+    return {
+        "schema": "RollbackManifest",
+        "schema_version": "1.0.0",
+        "run_id": run_id,
+        "step_id": step_id,
+        "created_at": _utc_now(),
+        "updated_at": _utc_now(),
+        "local_restores": [],
+        "compensating_actions": [],
+        "side_effects": [],
+    }
+
+
+def classify_side_effect(tool: str, metadata: dict[str, Any] | None = None) -> dict[str, Any]:
+    payload = metadata or {}
+    if tool in {"write", "edit", "multiedit"}:
+        return {
+            "category": "local_file",
+            "decision": "reversible",
+            "reversible": True,
+            "reason": "local file shadow restore",
+        }
+
+    command = str(payload.get("command", "")).strip().lower()
+    if tool == "bash":
+        if any(token in command for token in ("rm -rf /", "mkfs", "fdisk", "wipefs", "dd if=")):
+            return {
+                "category": "irreversible",
+                "decision": "blocked",
+                "reversible": False,
+                "reason": "destructive side effect",
+            }
+
+        if "git commit" in command:
+            return {
+                "category": "git_commit",
+                "decision": "reversible",
+                "reversible": True,
+                "reason": "compensate with git revert",
+                "default_compensation": "git revert --no-edit <commit>",
+            }
+
+        if any(token in command for token in ("curl ", "wget ", "http ")):
+            compensation = payload.get("compensating_action")
+            if _has_compensating_action(compensation):
+                return {
+                    "category": "network_request",
+                    "decision": "reversible",
+                    "reversible": True,
+                    "reason": "declared compensating action",
+                }
+            return {
+                "category": "irreversible",
+                "decision": "escalation_required",
+                "reversible": False,
+                "reason": "network request missing compensation",
+            }
+
+    return {
+        "category": "irreversible",
+        "decision": "escalation_required",
+        "reversible": False,
+        "reason": "undeclared or unknown side effect",
+    }
+
+
+def record_local_restore(manifest: dict[str, Any], file_path: str, status: str, reason: str = "") -> None:
+    local_restores = manifest.setdefault("local_restores", [])
+    local_restores.append(
+        {
+            "file_path": file_path,
+            "status": status,
+            "reason": reason,
+            "recorded_at": _utc_now(),
+        }
+    )
+    manifest["updated_at"] = _utc_now()
+
+
+def record_compensating_action(
+    manifest: dict[str, Any],
+    effect_type: str,
+    action: str,
+    command: str,
+    status: str = "declared",
+) -> None:
+    actions = manifest.setdefault("compensating_actions", [])
+    actions.append(
+        {
+            "effect_type": effect_type,
+            "action": action,
+            "command": command,
+            "status": status,
+            "recorded_at": _utc_now(),
+        }
+    )
+    manifest["updated_at"] = _utc_now()
+
+
+def record_side_effect(manifest: dict[str, Any], classification: dict[str, Any]) -> None:
+    effects = manifest.setdefault("side_effects", [])
+    effects.append(dict(classification))
+    manifest["updated_at"] = _utc_now()
+
+
+def write_rollback_manifest(project_dir: str, manifest: dict[str, Any]) -> str:
+    run_id = str(manifest.get("run_id", "unknown")).strip() or "unknown"
+    step_id = str(manifest.get("step_id", "unknown")).strip() or "unknown"
+    out_dir = Path(project_dir) / ".omg" / "state" / "rollback_manifest"
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_path = out_dir / f"{run_id}-{step_id}.json"
+    tmp_path = out_path.with_name(f"{out_path.name}.tmp")
+    tmp_path.write_text(json.dumps(manifest, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+    tmp_path.replace(out_path)
+    return str(out_path)
+
+
+def _has_compensating_action(payload: Any) -> bool:
+    if not isinstance(payload, dict):
+        return False
+    action = str(payload.get("action", "")).strip()
+    command = str(payload.get("command", "")).strip()
+    return bool(action and command)

package/build/lib/runtime/router_critics.py

@@ -161,6 +161,54 @@ def _run_hallucination_auditor(
     }
 
 
+def _run_evidence_completeness(
+    candidate: dict[str, Any],
+    context_packet: dict[str, Any],
+    project_dir: str,
+) -> dict[str, Any]:
+    output_text = _extract_output_text(candidate).lower()
+    artifact_pointers = context_packet.get("artifact_pointers")
+    pointers: list[str] = []
+    if isinstance(artifact_pointers, list):
+        pointers = [str(item).strip() for item in artifact_pointers if isinstance(item, str) and str(item).strip()]
+
+    required_claim_tokens = ("implemented", "fixed", "tested", "verified", "release")
+    expects_evidence = any(token in output_text for token in required_claim_tokens)
+
+    existing_pointers: list[str] = []
+    missing_pointers: list[str] = []
+    for pointer in pointers:
+        full_path = os.path.join(project_dir, pointer.lstrip("./"))
+        if os.path.exists(full_path):
+            existing_pointers.append(pointer)
+        else:
+            missing_pointers.append(pointer)
+
+    findings: list[str] = []
+    if missing_pointers:
+        findings.append("missing evidence artifacts: " + ", ".join(missing_pointers[:6]))
+
+    if expects_evidence and not existing_pointers:
+        findings.append("claim-like output requires evidence artifacts but none were present")
+        return {"verdict": "fail", "findings": findings, "confidence": 0.92}
+
+    if findings:
+        return {"verdict": "warn", "findings": findings, "confidence": 0.76}
+
+    if existing_pointers:
+        return {
+            "verdict": "pass",
+            "findings": ["required evidence artifacts are present in bounded context packet"],
+            "confidence": 0.84,
+        }
+
+    return {
+        "verdict": "pass",
+        "findings": ["no evidence artifacts required for non-assertive output"],
+        "confidence": 0.78,
+    }
+
+
 def run_critics(candidate: dict[str, object], context_packet: dict[str, object], project_dir: str) -> dict[str, dict[str, Any]]:
     bounded_context = {
         "summary": context_packet.get("summary", ""),
@@ -173,7 +221,9 @@ def run_critics(candidate: dict[str, object], context_packet: dict[str, object],
 
     skeptic = _run_skeptic(candidate, bounded_context)
     hallucination_auditor = _run_hallucination_auditor(candidate, bounded_context, project_dir)
+    evidence_completeness = _run_evidence_completeness(candidate, bounded_context, project_dir)
     return {
         "skeptic": skeptic,
         "hallucination_auditor": hallucination_auditor,
+        "evidence_completeness": evidence_completeness,
     }

package/build/lib/runtime/runtime_contracts.py

@@ -8,9 +8,14 @@ from typing import TypedDict, cast
 
 _MODULES = (
     "verification_controller",
+    "release_run_coordinator",
     "interaction_journal",
     "context_engine",
     "defense_state",
+    "session_health",
+    "council_verdicts",
+    "rollback_manifest",
+    "release_run",
 )
 
 _STATUS_VALUES = frozenset({"pending", "running", "ok", "error", "blocked"})
@@ -43,6 +48,11 @@ def schema_versions() -> dict[str, SchemaVersion]:
             "version": "1.0.0",
             "required_fields": base_required + ["blockers", "evidence_links", "progress"],
         },
+        "release_run_coordinator": {
+            "schema_name": "ReleaseRunCoordinatorState",
+            "version": "1.0.0",
+            "required_fields": base_required + ["phase", "resolution_source", "resolution_reason"],
+        },
         "interaction_journal": {
             "schema_name": "InteractionJournalState",
             "version": "1.0.0",
@@ -58,6 +68,43 @@ def schema_versions() -> dict[str, SchemaVersion]:
             "version": "1.0.0",
             "required_fields": base_required + ["controls", "findings"],
         },
+        "session_health": {
+            "schema_name": "SessionHealth",
+            "version": "1.0.0",
+            "required_fields": base_required + [
+                "contamination_risk",
+                "overthinking_score",
+                "context_health",
+                "verification_status",
+                "recommended_action",
+            ],
+        },
+        "council_verdicts": {
+            "schema_name": "CouncilVerdicts",
+            "version": "1.0.0",
+            "required_fields": base_required + ["verdicts", "verification_status"],
+        },
+        "rollback_manifest": {
+            "schema_name": "RollbackManifest",
+            "version": "1.0.0",
+            "required_fields": base_required + [
+                "step_id",
+                "local_restores",
+                "compensating_actions",
+                "side_effects",
+            ],
+        },
+        "release_run": {
+            "schema_name": "ReleaseRunState",
+            "version": "1.0.0",
+            "required_fields": base_required + [
+                "phase",
+                "resolution_source",
+                "resolution_reason",
+                "release_evidence",
+                "health_action",
+            ],
+        },
     }
 
 
@@ -88,6 +135,74 @@ def read_run_state(project_dir: str, module: str, run_id: str) -> JsonObject | N
     return None
 
 
+def read_defense_state(
+    project_dir: str,
+    run_id: str | None = None,
+    *,
+    compat: bool = False,
+) -> JsonObject | None:
+    root = Path(project_dir)
+    active_run_id = _resolve_active_run_id(root, run_id)
+    if active_run_id:
+        payload = _read_payload(root / ".omg" / "state" / "defense_state" / f"{active_run_id}.json")
+        if payload is not None:
+            return payload
+
+    payload = _read_payload(root / ".omg" / "state" / "defense_state" / "current.json")
+    if payload is not None:
+        return payload
+
+    if compat or not active_run_id:
+        return _read_payload(root / ".omg" / "state" / "defense_state" / "latest.json")
+    return None
+
+
+def read_session_health(
+    project_dir: str,
+    run_id: str | None = None,
+    *,
+    compat: bool = False,
+) -> JsonObject | None:
+    root = Path(project_dir)
+    active_run_id = _resolve_active_run_id(root, run_id)
+    if active_run_id:
+        payload = _read_payload(root / ".omg" / "state" / "session_health" / f"{active_run_id}.json")
+        if payload is not None:
+            return payload
+
+    if compat or not active_run_id:
+        return _read_payload(root / ".omg" / "state" / "session_health" / "latest.json")
+    return None
+
+
+def read_context_packet(project_dir: str, *, compat: bool = False) -> JsonObject | None:
+    root = Path(project_dir)
+    payload = _read_payload(root / ".omg" / "state" / "context_engine_packet.json")
+    if payload is not None:
+        return payload
+    if compat:
+        return _read_payload(root / ".omg" / "state" / "context_engine" / "latest.json")
+    return None
+
+
+def read_council_verdicts(
+    project_dir: str,
+    run_id: str | None = None,
+    *,
+    compat: bool = False,
+) -> JsonObject | None:
+    root = Path(project_dir)
+    active_run_id = _resolve_active_run_id(root, run_id)
+    if active_run_id:
+        payload = _read_payload(root / ".omg" / "state" / "council_verdicts" / f"{active_run_id}.json")
+        if payload is not None:
+            return payload
+
+    if compat or not active_run_id:
+        return _read_payload(root / ".omg" / "state" / "council_verdicts" / "latest.json")
+    return None
+
+
 def _normalize_payload(module: str, run_id: str, payload: JsonObject) -> JsonObject:
     metadata = schema_versions()[module]
     state = dict(payload)
@@ -101,6 +216,28 @@ def _normalize_payload(module: str, run_id: str, payload: JsonObject) -> JsonObj
     return state
 
 
+def _resolve_active_run_id(project_dir: Path, run_id: str | None) -> str:
+    candidate = _to_str(run_id, "").strip()
+    if candidate:
+        return candidate
+
+    candidate = os.environ.get("OMG_RUN_ID", "").strip()
+    if candidate:
+        return candidate
+
+    for path in (
+        project_dir / ".omg" / "state" / "defense_state" / "current.json",
+        project_dir / ".omg" / "state" / "context_engine_packet.json",
+    ):
+        payload = _read_payload(path)
+        if payload is None:
+            continue
+        candidate = _to_str(payload.get("run_id"), "").strip()
+        if candidate:
+            return candidate
+    return ""
+
+
 def _read_payload(path: Path) -> JsonObject | None:
     if not path.exists():
         return None

package/build/lib/runtime/security_check.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 
 import ast
 from collections import Counter
+from importlib import import_module
 from datetime import datetime, timezone
 from hashlib import sha256
 import json
@@ -102,6 +103,7 @@ def run_security_check(
     source_counts = Counter(finding["source"] for finding in findings)
     relative_scope = _display_scope(project_dir, scope_path)
     delta = classify_project_changes(project_dir, touched_files=_delta_touched_files(project_dir, scope_path), goal="security check")
+    evidence_requirements = _requirements_for_profile(delta.get("evidence_profile"))
     unresolved_high_risk = [
         finding
         for finding in findings
@@ -191,7 +193,10 @@ def run_security_check(
             "scan_status": "completed",
             "manifest_count": len(manifests.manifests),
             "delta_categories": delta["categories"],
+            "delta_evidence_profile": delta.get("evidence_profile"),
+            "evidence_requirements": evidence_requirements,
         },
+        "evidence_requirements": evidence_requirements,
         "provenance": provenance,
         "trust_scores": trust_scores,
         "license": license_artifact,
@@ -207,6 +212,17 @@ def run_security_check(
 }
 
 
+def _requirements_for_profile(evidence_profile: str | None) -> list[str]:
+    module = import_module("runtime.evidence_requirements")
+    resolver = getattr(module, "requirements_for_profile", None)
+    if callable(resolver):
+        resolved = resolver(evidence_profile)
+        if isinstance(resolved, (list, tuple, set)):
+            return [str(item) for item in resolved]
+    full = getattr(module, "FULL_REQUIREMENTS", [])
+    return [str(item) for item in full]
+
+
 def security_check(
     *,
     project_dir: str,