@trac3er/oh-my-god 2.1.0 → 2.1.4

package/runtime/forge_contracts.py

@@ -5,9 +5,58 @@ import os
 from collections.abc import Mapping
 from datetime import datetime, timezone
 from pathlib import Path
+from time import monotonic
 from typing import cast
 
 from lab.policies import validate_job_request
+from runtime.runtime_contracts import read_defense_state, read_session_health
+
+FORGE_STAGE_ORDER: tuple[str, ...] = (
+    "data_prepare",
+    "synthetic_refine",
+    "train_distill",
+    "evaluate",
+    "regression_test",
+)
+
+DEFAULT_STAGE_TIMEOUT_MS: dict[str, int] = {
+    "data_prepare": 5_000,
+    "synthetic_refine": 5_000,
+    "train_distill": 5_000,
+    "evaluate": 5_000,
+    "regression_test": 5_000,
+}
+
+
+ADAPTER_REGISTRY: dict[str, dict[str, object]] = {
+    "axolotl": {
+        "kind": "training",
+        "module": "axolotl",
+        "hook": "lab.axolotl_adapter.run",
+        "specialist": "training-architect",
+    },
+    "pybullet": {
+        "kind": "simulator",
+        "module": "pybullet",
+        "hook": "lab.pybullet_adapter.run",
+        "specialist": "simulator-engineer",
+        "primary": True,
+    },
+    "gazebo": {
+        "kind": "simulator",
+        "module": "gazebo",
+        "hook": "lab.gazebo_adapter.run",
+        "specialist": "simulator-engineer",
+        "primary": False,
+    },
+    "isaac_gym": {
+        "kind": "simulator",
+        "module": "isaacgym",
+        "hook": "lab.isaac_gym_adapter.run",
+        "specialist": "simulator-engineer",
+        "primary": False,
+    },
+}
 
 
 def load_forge_mvp() -> dict[str, object]:
@@ -19,7 +68,7 @@ def load_forge_mvp() -> dict[str, object]:
             "required": ["dataset", "base_model", "target_metric"],
             "dataset_required": ["name", "license", "source"],
             "base_model_required": ["name", "source", "allow_distill"],
-            "optional": ["simulated_metric", "evaluation_notes"],
+            "optional": ["simulated_metric", "evaluation_notes", "simulator_backend", "require_backend"],
         },
         "evaluation_schema": {
             "required": ["status", "stage", "evaluation_report", "published"],
@@ -29,8 +78,67 @@ def load_forge_mvp() -> dict[str, object]:
         "specialist_dispatch": {
             "axolotl": ["dataset", "base_model", "target_metric"],
             "pybullet": ["dataset", "target_metric", "simulated_metric"],
+            "forge-cybersecurity": ["dataset", "base_model", "target_metric", "evaluation_notes"],
+        },
+        "stage_aliases": {
+            "security_review": "regression_test",
+            "threat_model": "evaluate",
         },
+        "specialist_contracts": {
+            "forge-cybersecurity": {
+                "labs_only": True,
+                "allowed_domains": ["cybersecurity"],
+                "evidence_profile": "forge-run",
+                "proof_backed_dispatch": True,
+                "stage_alias": "regression_test",
+                "evidence_outputs": {
+                    "sarif": ".omg/evidence/security-*.sarif",
+                    "sbom": ".omg/evidence/sbom-*.cdx.json",
+                    "license": ".omg/evidence/license-*.json",
+                    "security_json": ".omg/evidence/security-*.json",
+                },
+                "reuses_scanner": "runtime.security_check",
+            },
+        },
+        "adapter_registry": dict(ADAPTER_REGISTRY),
         "evidence_output_path": ".omg/evidence/forge-<run_id>.json",
+        "starter_templates": {
+            "vision-agent": {
+                "domain": "vision-agent",
+                "specialists": ["data-curator", "training-architect", "simulator-engineer"],
+                "dataset": {"name": "vision-agent", "license": "apache-2.0", "source": "internal-curated"},
+                "base_model": {"name": "distill-base-v1", "source": "approved-registry", "allow_distill": True},
+                "target_metric": 0.8,
+            },
+            "robotics": {
+                "domain": "robotics",
+                "specialists": ["training-architect", "simulator-engineer"],
+                "dataset": {"name": "robotics", "license": "apache-2.0", "source": "internal-curated"},
+                "base_model": {"name": "distill-base-v1", "source": "approved-registry", "allow_distill": True},
+                "target_metric": 0.8,
+            },
+            "algorithms": {
+                "domain": "algorithms",
+                "specialists": ["training-architect"],
+                "dataset": {"name": "algorithms", "license": "apache-2.0", "source": "internal-curated"},
+                "base_model": {"name": "distill-base-v1", "source": "approved-registry", "allow_distill": True},
+                "target_metric": 0.8,
+            },
+            "health": {
+                "domain": "health",
+                "specialists": ["data-curator", "training-architect"],
+                "dataset": {"name": "health", "license": "apache-2.0", "source": "internal-curated"},
+                "base_model": {"name": "distill-base-v1", "source": "approved-registry", "allow_distill": True},
+                "target_metric": 0.8,
+            },
+            "cybersecurity": {
+                "domain": "cybersecurity",
+                "specialists": ["forge-cybersecurity"],
+                "dataset": {"name": "cybersecurity", "license": "apache-2.0", "source": "internal-curated"},
+                "base_model": {"name": "distill-base-v1", "source": "approved-registry", "allow_distill": True},
+                "target_metric": 0.8,
+            },
+        },
     }
 
 
@@ -66,20 +174,118 @@ def validate_forge_job(job: dict[str, object]) -> tuple[bool, str]:
     return True, "ok"
 
 
-def build_forge_evidence(project_dir: str, run_id: str, job: Mapping[str, object], result: Mapping[str, object]) -> str:
+def read_stage_runtime_snapshots(project_dir: str, run_id: str) -> tuple[dict[str, object], dict[str, object]]:
+    defense_payload = read_defense_state(project_dir, run_id=run_id, compat=True)
+    health_payload = read_session_health(project_dir, run_id=run_id, compat=True)
+    defense_snapshot: dict[str, object] = {}
+    session_health_snapshot: dict[str, object] = {}
+    if isinstance(defense_payload, dict):
+        defense_snapshot = cast(dict[str, object], dict(defense_payload))
+    if isinstance(health_payload, dict):
+        session_health_snapshot = cast(dict[str, object], dict(health_payload))
+    return defense_snapshot, session_health_snapshot
+
+
+def resolve_stage_timeout_ms(job: Mapping[str, object], stage: str) -> int:
+    timeout_value: object | None = None
+    stage_timeouts = job.get("stage_timeouts_ms")
+    if isinstance(stage_timeouts, Mapping):
+        timeout_value = stage_timeouts.get(stage)
+    if timeout_value is None:
+        timeout_value = DEFAULT_STAGE_TIMEOUT_MS.get(stage, 5_000)
+
+    if isinstance(timeout_value, bool):
+        return DEFAULT_STAGE_TIMEOUT_MS.get(stage, 5_000)
+    if isinstance(timeout_value, int):
+        parsed = timeout_value
+    elif isinstance(timeout_value, float):
+        parsed = int(timeout_value)
+    elif isinstance(timeout_value, str):
+        try:
+            parsed = int(timeout_value)
+        except ValueError:
+            return DEFAULT_STAGE_TIMEOUT_MS.get(stage, 5_000)
+    else:
+        return DEFAULT_STAGE_TIMEOUT_MS.get(stage, 5_000)
+    return max(0, parsed)
+
+
+def build_stage_evidence(
+    *,
+    stage: str,
+    run_id: str,
+    status: str,
+    started_at_ms: float,
+    defense_snapshot: Mapping[str, object],
+    session_health_snapshot: Mapping[str, object],
+    artifacts: list[str],
+    adapter_evidence: list[dict[str, object]] | None = None,
+) -> dict[str, object]:
+    duration_ms = max(0, int((monotonic() - started_at_ms) * 1000))
+    result: dict[str, object] = {
+        "stage": stage,
+        "run_id": run_id,
+        "status": status,
+        "duration_ms": duration_ms,
+        "defense_snapshot": dict(defense_snapshot),
+        "session_health_snapshot": dict(session_health_snapshot),
+        "artifacts": list(artifacts),
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+    }
+    if adapter_evidence is not None:
+        result["adapter_evidence"] = list(adapter_evidence)
+    return result
+
+
+def build_forge_evidence(
+    project_dir: str,
+    run_id: str,
+    job: Mapping[str, object],
+    result: Mapping[str, object],
+    *,
+    stage_evidence: list[Mapping[str, object]] | None = None,
+) -> str:
     out_path = Path(project_dir) / ".omg" / "evidence" / f"forge-{run_id}.json"
     out_path.parent.mkdir(parents=True, exist_ok=True)
 
+    domain = str(job.get("domain", "")).strip()
+    specialists_raw = job.get("specialists")
+    specialist_str = ",".join(str(s) for s in specialists_raw) if isinstance(specialists_raw, list) else ""
+
+    merged_stage_evidence: list[Mapping[str, object]] = []
+    if stage_evidence is not None:
+        merged_stage_evidence = list(stage_evidence)
+    else:
+        existing_stage_evidence = result.get("stage_evidence")
+        if isinstance(existing_stage_evidence, list):
+            merged_stage_evidence = [
+                cast(Mapping[str, object], item)
+                for item in existing_stage_evidence
+                if isinstance(item, Mapping)
+            ]
+
     payload = {
         "schema": "ForgeMVPEvidence",
         "schema_version": "1.0.0",
         "run_id": run_id,
         "generated_at": datetime.now(timezone.utc).isoformat(),
+        "labs_only": True,
+        "proof_backed": True,
+        "specialist": specialist_str,
+        "domain": domain,
         "contract": load_forge_mvp(),
         "job": job,
         "result": result,
         "status": result.get("status", "unknown"),
         "evaluation_report": result.get("evaluation_report"),
+        "stages": result.get("stages", []),
+        "stage_evidence": merged_stage_evidence,
+        "causal_chain": {
+            "lock_id": "",
+            "waiver_artifact_path": str(out_path),
+            "delta_summary": {"forge_run": run_id, "domain": domain, "specialist": specialist_str},
+            "verification_status": str(result.get("status", "unknown")),
+        },
     }
 
     tmp_path = out_path.with_name(f"{out_path.name}.tmp")

package/runtime/hook_governor.py

@@ -14,6 +14,7 @@ except Exception:  # pragma: no cover - json fallback path
 
 
 DEFAULT_BUNDLE_PATH = Path("registry") / "bundles" / "hook-governor.yaml"
+_MODULE_DIR = Path(__file__).resolve().parent.parent  # project root (runtime/ → project root)
 SECURITY_REQUIRED_BY_EVENT: dict[str, tuple[str, ...]] = {
     "PreToolUse": ("firewall", "secret-guard"),
 }
@@ -49,6 +50,12 @@ def _load_compiled_hooks(
 ) -> tuple[dict[str, list[str]], str | None]:
     root = _resolve_project_dir(project_dir)
     candidate = Path(bundle_path) if bundle_path else (root / DEFAULT_BUNDLE_PATH)
+    if not bundle_path and not candidate.exists():
+        # Fallback: resolve relative to this module's installed location (robust to cwd changes
+        # and CLAUDE_PROJECT_DIR pointing to temp dirs in parallel test runs).
+        module_relative = _MODULE_DIR / DEFAULT_BUNDLE_PATH
+        if module_relative.exists():
+            candidate = module_relative
     try:
         raw = candidate.read_text(encoding="utf-8")
     except FileNotFoundError:
@@ -123,10 +130,21 @@ def validate_order(
     blockers: list[str] = []
     expected_positions = {name: idx for idx, name in enumerate(canonical)}
 
-    for required in SECURITY_REQUIRED_BY_EVENT.get(event, ()):
+    required_security_hooks = SECURITY_REQUIRED_BY_EVENT.get(event, ())
+    for required in required_security_hooks:
         if required not in hooks_list:
             blockers.append(f"missing required security hook: {required}")
 
+    if required_security_hooks:
+        for expected_index, required in enumerate(required_security_hooks):
+            if required not in hooks_list:
+                continue
+            actual_index = hooks_list.index(required)
+            if actual_index != expected_index:
+                blockers.append(
+                    f"hook order violation for {event}: {required} must run before non-security hooks"
+                )
+
     filtered_hooks = [hook for hook in hooks_list if hook in expected_positions]
     for left, right in zip(filtered_hooks, filtered_hooks[1:]):
         if expected_positions[left] > expected_positions[right]: