@trac3er/oh-my-god 2.1.0 → 2.1.4

package/runtime/delta_classifier.py

@@ -1,7 +1,6 @@
 """Repo-aware change classification for routing and policy attachment."""
 from __future__ import annotations
 
-import json
 from pathlib import Path
 import subprocess
 from typing import Any
@@ -21,6 +20,51 @@ _CATEGORY_RULES: dict[str, tuple[str, ...]] = {
     "algorithms": ("algorithm", "benchmark", "determinism", "complexity"),
 }
 
+_DOCS_SUFFIXES: tuple[str, ...] = (
+    ".md",
+    ".mdx",
+    ".rst",
+    ".txt",
+)
+
+_DOCS_PATH_HINTS: tuple[str, ...] = (
+    "docs/",
+    "readme",
+    "changelog",
+)
+
+_SECURITY_CATEGORY_HINTS: tuple[str, ...] = (
+    "auth",
+    "payment",
+    "db",
+    "infra",
+    "compliance",
+    "health",
+)
+
+_SECURITY_TOKENS: tuple[str, ...] = (
+    "security",
+    "secret",
+    "vulnerability",
+    "audit",
+    "hardening",
+)
+
+_RELEASE_TOKENS: tuple[str, ...] = (
+    "release",
+    "publish",
+    "ship",
+    "cut tag",
+    "version bump",
+)
+
+_FORGE_TOKENS: tuple[str, ...] = (
+    "forge",
+    "prototype",
+    "evaluation run",
+    "lab job",
+)
+
 
 def classify_project_changes(
     project_dir: str,
@@ -40,17 +84,51 @@ def classify_project_changes(
     if not categories:
         categories.add("implementation")
 
+    sorted_categories = sorted(categories)
     result = {
         "schema": "DeltaClassification",
         "project_dir": project_dir,
         "goal": goal,
-        "categories": sorted(categories),
+        "categories": sorted_categories,
+        "evidence_profile": _classify_evidence_profile(goal=goal, touched_files=files, categories=sorted_categories),
         "touched_files": files,
         "manifests": manifest_names,
     }
     return result
 
 
+def _classify_evidence_profile(*, goal: str, touched_files: list[str], categories: list[str]) -> str:
+    lowered_goal = goal.lower()
+    lowered_files = [path.lower() for path in touched_files]
+
+    if _contains_any(lowered_goal, _RELEASE_TOKENS) or any(_contains_any(path, _RELEASE_TOKENS) for path in lowered_files):
+        return "release"
+
+    if _contains_any(lowered_goal, _FORGE_TOKENS) or any(_contains_any(path, _FORGE_TOKENS) for path in lowered_files):
+        return "forge-run"
+
+    if set(categories) & set(_SECURITY_CATEGORY_HINTS):
+        return "security-audit"
+    if _contains_any(lowered_goal, _SECURITY_TOKENS) or any(_contains_any(path, _SECURITY_TOKENS) for path in lowered_files):
+        return "security-audit"
+
+    if lowered_files and all(_is_docs_file(path) for path in lowered_files):
+        return "docs-only"
+
+    return "code-change"
+
+
+def _is_docs_file(path: str) -> bool:
+    lowered = path.lower()
+    if lowered.endswith(_DOCS_SUFFIXES):
+        return True
+    return any(hint in lowered for hint in _DOCS_PATH_HINTS)
+
+
+def _contains_any(haystack: str, needles: tuple[str, ...]) -> bool:
+    return any(token in haystack for token in needles)
+
+
 def _discover_files(project_dir: str) -> list[str]:
     root = Path(project_dir)
     git_dir = root / ".git"

package/runtime/evidence_query.py

@@ -1,9 +1,13 @@
 from __future__ import annotations
 
 import json
+import hashlib
 from pathlib import Path
 from typing import cast
 
+from runtime.context_engine import load_profile_digest
+from runtime.evidence_requirements import requirements_for_profile
+
 JsonPrimitive = str | int | float | bool | None
 JsonValue = JsonPrimitive | dict[str, "JsonValue"] | list["JsonValue"]
 JsonObject = dict[str, JsonValue]
@@ -35,6 +39,54 @@ def _load_json(path: Path) -> JsonObject | None:
     return cast(JsonObject, payload)
 
 
+def _json_checksum(payload: JsonObject) -> str:
+    encoded = json.dumps(payload, sort_keys=True, ensure_ascii=True, separators=(",", ":"))
+    return hashlib.sha256(encoded.encode("utf-8", errors="ignore")).hexdigest()
+
+
+def _record_copy_with_context_metadata(root: Path, record: JsonObject) -> JsonObject:
+    run_id = _record_string(record, "run_id")
+    if not run_id:
+        return record
+
+    profile_digest = load_profile_digest(root)
+    existing_profile_version = _record_string(record, "profile_version")
+    profile_version = existing_profile_version or str(profile_digest.get("profile_version", "")).strip()
+    evidence_profile = _record_string(record, "evidence_profile").strip()
+    evidence_requirements = requirements_for_profile(evidence_profile)
+
+    intent_gate_payload = _load_json(root / ".omg" / "state" / "intent_gate" / f"{run_id}.json") or {}
+    existing_intent_gate_version = _record_string(record, "intent_gate_version")
+    intent_gate_version = existing_intent_gate_version or (
+        _record_string(intent_gate_payload, "intent_gate_version")
+        or _record_string(intent_gate_payload, "schema_version")
+        or _record_string(intent_gate_payload, "version")
+    )
+
+    packet_payload = _load_json(root / ".omg" / "state" / "context_engine_packet.json") or {}
+    packet_run_id = _record_string(packet_payload, "run_id")
+    scoped_packet = packet_payload if packet_run_id == run_id else {}
+    context_material: JsonObject = {
+        "run_id": run_id,
+        "profile_version": profile_version,
+        "intent_gate_version": intent_gate_version,
+    }
+    if scoped_packet:
+        context_material["context_packet"] = scoped_packet
+    if intent_gate_payload:
+        context_material["intent_gate"] = intent_gate_payload
+
+    existing_context_checksum = _record_string(record, "context_checksum")
+    context_checksum = existing_context_checksum or _json_checksum(context_material)
+    enriched = dict(record)
+    enriched["context_checksum"] = context_checksum
+    enriched["profile_version"] = profile_version
+    enriched["intent_gate_version"] = intent_gate_version
+    enriched["evidence_profile"] = evidence_profile
+    enriched["evidence_requirements"] = cast(JsonValue, [str(item) for item in evidence_requirements])
+    return enriched
+
+
 def _read_jsonl(path: Path) -> list[JsonObject]:
     if not path.exists():
         return []
@@ -109,7 +161,7 @@ def get_evidence_pack(project_dir: str, run_id: str) -> JsonObject | None:
         if payload.get("schema") != "EvidencePack":
             continue
         if _record_string(payload, "run_id") == run_id:
-            return payload
+            return _record_copy_with_context_metadata(root, payload)
     return None
 
 
@@ -136,7 +188,7 @@ def query_evidence(
                 schema=schema,
                 kind=kind,
             ):
-                records.append(payload)
+                records.append(_record_copy_with_context_metadata(root, payload))
 
         for row in _read_jsonl(root / rel_dir / "events.jsonl"):
             if _record_matches(
@@ -146,7 +198,7 @@ def query_evidence(
                 schema=schema,
                 kind=kind,
             ):
-                records.append(row)
+                records.append(_record_copy_with_context_metadata(root, row))
 
     return records
 
@@ -164,7 +216,7 @@ def list_evidence_packs(project_dir: str) -> list[JsonObject]:
             mtime = path.stat().st_mtime
         except OSError:
             mtime = 0.0
-        payloads.append((mtime, payload))
+        payloads.append((mtime, _record_copy_with_context_metadata(root, payload)))
 
     payloads.sort(key=lambda item: item[0], reverse=True)
     return [payload for _, payload in payloads]

package/runtime/evidence_registry.py

@@ -0,0 +1,16 @@
+"""Backward-compatible alias for evidence requirements registry."""
+from __future__ import annotations
+
+from importlib import import_module
+
+_registry = import_module("runtime.evidence_requirements")
+
+EVIDENCE_REQUIREMENTS_BY_PROFILE = getattr(_registry, "EVIDENCE_REQUIREMENTS_BY_PROFILE", {})
+FULL_REQUIREMENTS = getattr(_registry, "FULL_REQUIREMENTS", [])
+requirements_for_profile = getattr(_registry, "requirements_for_profile")
+
+__all__ = [
+    "EVIDENCE_REQUIREMENTS_BY_PROFILE",
+    "FULL_REQUIREMENTS",
+    "requirements_for_profile",
+]

package/runtime/evidence_requirements.py

@@ -0,0 +1,47 @@
+"""Single-source evidence profile requirements registry."""
+from __future__ import annotations
+
+from typing import Final
+
+FULL_REQUIREMENTS: Final[list[str]] = [
+    "tests",
+    "lsp_clean",
+    "build",
+    "provenance",
+    "trust_scores",
+    "security_scan",
+    "license_scan",
+    "sbom",
+    "trace_link",
+]
+
+EVIDENCE_REQUIREMENTS_BY_PROFILE: Final[dict[str, list[str]]] = {
+    "code-change": [
+        "tests",
+        "lsp_clean",
+        "build",
+        "provenance",
+        "trace_link",
+    ],
+    "docs-only": [
+        "lsp_clean",
+        "trace_link",
+    ],
+    "forge-run": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+    ],
+    "security-audit": list(FULL_REQUIREMENTS),
+    "release": list(FULL_REQUIREMENTS),
+}
+
+
+def requirements_for_profile(evidence_profile: str | None) -> list[str]:
+    if not evidence_profile:
+        return list(FULL_REQUIREMENTS)
+    requirements = EVIDENCE_REQUIREMENTS_BY_PROFILE.get(evidence_profile)
+    if not requirements:
+        return list(FULL_REQUIREMENTS)
+    return list(requirements)

package/runtime/forge_agents.py

@@ -1,12 +1,16 @@
 from __future__ import annotations
 
+import importlib
+import importlib.util
 import json
 import os
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
-from runtime.forge_contracts import load_forge_mvp, validate_forge_job
+from runtime.forge_contracts import ADAPTER_REGISTRY, load_forge_mvp, validate_forge_job
+from runtime.runtime_contracts import read_defense_state, read_session_health
+from runtime.security_check import run_security_check
 
 
 _SPECIALIST_REGISTRY: dict[str, dict[str, object]] = {
@@ -22,6 +26,10 @@ _SPECIALIST_REGISTRY: dict[str, dict[str, object]] = {
         "description": "Builds simulator-backed evaluations through the PyBullet hook contract.",
         "capabilities": ["simulator-scenarios", "pybullet-hook-contract", "regression-replay"],
     },
+    "forge-cybersecurity": {
+        "description": "Runs labs-bounded cybersecurity hardening and threat-evidence checks.",
+        "capabilities": ["threat-modeling", "security-regression", "proof-linked-security-evidence"],
+    },
 }
 
 _DOMAIN_SPECIALISTS: dict[str, list[str]] = {
@@ -30,6 +38,7 @@ _DOMAIN_SPECIALISTS: dict[str, list[str]] = {
     "robotics": ["training-architect", "simulator-engineer"],
     "algorithms": ["training-architect"],
     "health": ["data-curator", "training-architect"],
+    "cybersecurity": ["forge-cybersecurity"],
 }
 
 
@@ -42,7 +51,33 @@ def get_specialist_registry() -> dict[str, dict[str, object]]:
     return {name: dict(metadata) for name, metadata in _SPECIALIST_REGISTRY.items()}
 
 
-def dispatch_specialists(job: dict[str, Any], project_dir: str) -> dict[str, Any]:
+
+def _execute_cybersecurity_scan(project_dir: str) -> dict[str, Any]:
+    """Run canonical security_check scan for forge-cybersecurity specialist.
+
+    Reuses runtime/security_check.py engine. Degrades gracefully
+    when Semgrep or other external tools are unavailable.
+    """
+    try:
+        return run_security_check(
+            project_dir=project_dir,
+            scope=".",
+            include_live_enrichment=False,
+        )
+    except Exception:
+        return {
+            "schema": "SecurityCheckResult",
+            "status": "error",
+            "scope": ".",
+            "findings": [],
+            "security_scans": [],
+            "unresolved_risks": [],
+            "evidence": {},
+            "summary": {"scan_status": "failed", "finding_count": 0},
+        }
+
+
+def dispatch_specialists(job: dict[str, Any], project_dir: str, run_id: str | None = None) -> dict[str, Any]:
     ok, reason = validate_forge_job(job)
     if not ok:
         return {
@@ -61,7 +96,7 @@ def dispatch_specialists(job: dict[str, Any], project_dir: str) -> dict[str, Any
             "status": "blocked",
             "specialists_dispatched": [],
             "evidence_path": "",
-            "reason": f"domain '{domain}' has no specialist contract",
+            "reason": "invalid_specialist_domain_combination",
         }
 
     if requested_specialists:
@@ -79,7 +114,7 @@ def dispatch_specialists(job: dict[str, Any], project_dir: str) -> dict[str, Any
                 "status": "blocked",
                 "specialists_dispatched": [],
                 "evidence_path": "",
-                "reason": f"specialists not allowed for domain '{domain}': {', '.join(invalid_for_domain)}",
+                "reason": "invalid_specialist_domain_combination",
             }
         missing_required = [name for name in expected_specialists if name not in requested_specialists]
         if missing_required:
@@ -87,27 +122,66 @@ def dispatch_specialists(job: dict[str, Any], project_dir: str) -> dict[str, Any
                 "status": "blocked",
                 "specialists_dispatched": [],
                 "evidence_path": "",
-                "reason": f"missing required specialists for domain '{domain}': {', '.join(missing_required)}",
+                "reason": "invalid_specialist_domain_combination",
             }
 
     specialists_dispatched = requested_specialists if requested_specialists else expected_specialists
     status = "ok" if specialists_dispatched else "noop"
-    run_id = _now_run_id()
+    active_run_id = run_id or _now_run_id()
+
+    job_with_specialists = dict(job)
+    job_with_specialists["specialists"] = specialists_dispatched
+    adapter_evidence = resolve_adapters(job_with_specialists)
+
+    backends_ok, backends_reason = check_required_backends_satisfied(adapter_evidence)
+    if not backends_ok:
+        return {
+            "status": "blocked",
+            "specialists_dispatched": specialists_dispatched,
+            "evidence_path": "",
+            "reason": backends_reason,
+            "adapter_evidence": adapter_evidence,
+        }
+
+    security_scan: dict[str, Any] | None = None
+    if "forge-cybersecurity" in specialists_dispatched:
+        security_scan = _execute_cybersecurity_scan(project_dir)
+
     evidence_path = _write_dispatch_evidence(
         project_dir=project_dir,
-        run_id=run_id,
+        run_id=active_run_id,
+        snapshot_run_id=run_id,
         status=status,
         domain=domain,
         expected_specialists=expected_specialists,
         requested_specialists=requested_specialists,
         specialists_dispatched=specialists_dispatched,
         job=job,
+        security_scan=security_scan,
     )
-    return {
+    result_payload: dict[str, Any] = {
         "status": status,
         "specialists_dispatched": specialists_dispatched,
+        "run_id": active_run_id,
         "evidence_path": evidence_path,
+        "adapter_evidence": adapter_evidence,
     }
+    if security_scan is not None:
+        result_payload["security_scan"] = security_scan
+    return result_payload
+
+
+def _resolve_specialist_contracts(contract: dict[str, object], specialists: list[str]) -> dict[str, dict[str, object]]:
+    raw_contracts = contract.get("specialist_contracts")
+    if not isinstance(raw_contracts, dict):
+        return {}
+
+    selected: dict[str, dict[str, object]] = {}
+    for name in specialists:
+        entry = raw_contracts.get(name)
+        if isinstance(entry, dict):
+            selected[name] = dict(entry)
+    return selected
 
 
 def _normalize_specialist_list(value: object) -> list[str]:
@@ -125,27 +199,106 @@ def _now_run_id() -> str:
     return datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%S%fZ")
 
 
+def _check_backend_available(backend_name: str) -> bool:
+    entry = ADAPTER_REGISTRY.get(backend_name)
+    if entry is None:
+        return False
+    module_name = str(entry.get("module", ""))
+    if not module_name:
+        return False
+    try:
+        return importlib.util.find_spec(module_name) is not None
+    except Exception:
+        return False
+
+
+def _check_axolotl_available() -> bool:
+    return _check_backend_available("axolotl")
+
+
+def _check_simulator_available(name: str) -> bool:
+    return _check_backend_available(name)
+
+
+def resolve_adapters(job: dict[str, Any]) -> list[dict[str, object]]:
+    results: list[dict[str, object]] = []
+    dispatched_specialists = job.get("specialists", [])
+    if not isinstance(dispatched_specialists, list):
+        dispatched_specialists = []
+
+    requested_backend = str(job.get("simulator_backend", "")).strip().lower()
+    require_backend = bool(job.get("require_backend", False))
+
+    if "training-architect" in dispatched_specialists:
+        available = _check_axolotl_available()
+        results.append({
+            "adapter": "axolotl",
+            "kind": "training",
+            "status": "invoked" if available else "skipped_unavailable_backend",
+            "required": require_backend and requested_backend == "axolotl",
+            "reason": "" if available else "axolotl not installed",
+            "available": available,
+        })
+
+    if "simulator-engineer" in dispatched_specialists:
+        simulator_backends = _resolve_simulator_backends(requested_backend)
+        for backend in simulator_backends:
+            available = _check_simulator_available(backend)
+            is_required = require_backend and requested_backend == backend
+            results.append({
+                "adapter": backend,
+                "kind": "simulator",
+                "status": "invoked" if available else "skipped_unavailable_backend",
+                "required": is_required,
+                "reason": "" if available else f"{backend} not installed",
+                "available": available,
+            })
+
+    return results
+
+
+def _resolve_simulator_backends(requested: str) -> list[str]:
+    if requested and requested in ADAPTER_REGISTRY:
+        entry = ADAPTER_REGISTRY[requested]
+        if str(entry.get("kind", "")) == "simulator":
+            return [requested]
+    return ["pybullet"]
+
+
+def check_required_backends_satisfied(adapter_evidence: list[dict[str, object]]) -> tuple[bool, str]:
+    for ev in adapter_evidence:
+        if ev.get("required") is True and ev.get("status") == "skipped_unavailable_backend":
+            adapter_name = str(ev.get("adapter", "unknown"))
+            return False, f"required backend unavailable: {adapter_name}"
+    return True, "ok"
+
+
 def _write_dispatch_evidence(
     *,
     project_dir: str,
     run_id: str,
+    snapshot_run_id: str | None,
     status: str,
     domain: str,
     expected_specialists: list[str],
     requested_specialists: list[str],
     specialists_dispatched: list[str],
     job: dict[str, Any],
+    security_scan: dict[str, Any] | None = None,
 ) -> str:
     evidence_dir = Path(project_dir) / ".omg" / "evidence"
     evidence_dir.mkdir(parents=True, exist_ok=True)
     evidence_path = evidence_dir / f"forge-specialists-{run_id}.json"
     contract = load_forge_mvp()
-    payload = {
+    payload: dict[str, Any] = {
         "schema": "ForgeSpecialistDispatchEvidence",
         "schema_version": "1.0.0",
         "run_id": run_id,
         "generated_at": datetime.now(timezone.utc).isoformat(),
         "status": status,
+        "labs_only": True,
+        "proof_backed": True,
+        "specialist": ",".join(specialists_dispatched),
         "domain": domain,
         "requested_specialists": requested_specialists,
         "expected_specialists": expected_specialists,
@@ -155,9 +308,26 @@ def _write_dispatch_evidence(
             "axolotl_hook": contract.get("axolotl_hook", ""),
             "pybullet_hook": contract.get("pybullet_hook", ""),
         },
+        "specialist_contracts": _resolve_specialist_contracts(contract, specialists_dispatched),
+        "causal_chain": {
+            "lock_id": "",
+            "waiver_artifact_path": f".omg/evidence/forge-specialists-{run_id}.json",
+            "delta_summary": {"forge_dispatch": domain, "specialists": specialists_dispatched},
+            "verification_status": status,
+        },
         "job": job,
     }
 
+    if security_scan is not None:
+        payload["security_scan"] = security_scan
+
+    defense_state = read_defense_state(project_dir, run_id=snapshot_run_id, compat=True)
+    session_health = read_session_health(project_dir, run_id=snapshot_run_id, compat=True)
+    if isinstance(defense_state, dict):
+        payload["defense_state"] = defense_state
+    if isinstance(session_health, dict):
+        payload["session_health"] = session_health
+
     tmp_path = evidence_path.with_name(f"{evidence_path.name}.tmp")
     _ = tmp_path.write_text(json.dumps(payload, indent=2, ensure_ascii=True), encoding="utf-8")
     _ = os.replace(tmp_path, evidence_path)