@trac3er/oh-my-god 2.1.0 → 2.1.4

package/runtime/preflight.py

@@ -1,6 +1,7 @@
 """Structured preflight routing for OMG."""
 from __future__ import annotations
 
+import importlib
 from runtime.delta_classifier import classify_project_changes
 from runtime.tracebank import record_trace
 from typing import Any
@@ -45,6 +46,7 @@ def run_preflight(project_dir: str, *, goal: str) -> dict[str, Any]:
     categories = set(delta["categories"])
     requires_security_check = _requires_security_check(delta)
     domain_packs = [category for category in delta["categories"] if category in {"robotics", "vision", "algorithms", "health"}]
+    evidence_requirements = _requirements_for_profile(delta.get("evidence_profile"))
 
     if requires_security_check:
         task_class = "security"
@@ -83,6 +85,7 @@ def run_preflight(project_dir: str, *, goal: str) -> dict[str, Any]:
         "required_mcps": ["omg-control"] if route in {"security-check", "api-twin", "crazy"} else [],
         "missing_constraints": [],
         "evidence_plan": _evidence_plan(route),
+        "evidence_requirements": evidence_requirements,
         "delta_classification": delta,
         "domain_packs": domain_packs,
         "trace": {"trace_id": trace["trace_id"], "path": trace["path"]},
@@ -101,6 +104,17 @@ def _requires_security_check(delta: dict[str, Any]) -> bool:
     return False
 
 
+def _requirements_for_profile(evidence_profile: str | None) -> list[str]:
+    module = importlib.import_module("runtime.evidence_requirements")
+    resolver = getattr(module, "requirements_for_profile", None)
+    if callable(resolver):
+        resolved = resolver(evidence_profile)
+        if isinstance(resolved, (list, tuple, set)):
+            return [str(item) for item in resolved]
+    full = getattr(module, "FULL_REQUIREMENTS", [])
+    return [str(item) for item in full]
+
+
 def _required_tools(route: str) -> list[str]:
     return {
         "security-check": ["security"],

package/runtime/profile_io.py

@@ -0,0 +1,294 @@
+"""Canonical profile I/O — single owner of profile.yaml read/write/version.
+
+All profile consumers should use this module to load and persist profile data.
+``profile_version`` is derived from a canonical key-sorted JSON hash of the
+parsed dict, never from raw file text.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from typing import Any
+
+import yaml
+
+
+def load_profile(path: str) -> dict[str, Any]:
+    """Load a profile from *path*, returning a dict.
+
+    Handles both YAML and JSON-shaped content transparently (backward compat).
+    Returns ``{}`` when the file is missing or unreadable.
+    """
+    if not os.path.exists(path):
+        return {}
+    try:
+        with open(path, "r", encoding="utf-8", errors="replace") as fh:
+            payload = yaml.safe_load(fh)
+    except Exception:
+        return {}
+    if isinstance(payload, dict):
+        return payload
+    return {}
+
+
+def save_profile(path: str, data: dict[str, Any]) -> None:
+    """Persist *data* as canonical YAML to *path*.
+
+    Creates parent directories when needed.  Output is always YAML (never JSON)
+    so that ``profile_version_from_map`` produces a deterministic hash
+    regardless of how the file was previously written.
+
+    Uses an internal serializer that correctly round-trips empty collections
+    as ``[]`` / ``{}`` instead of bare ``key:`` (which the project yaml shim
+    parses back as ``None``).
+    """
+    parent = os.path.dirname(path)
+    if parent:
+        os.makedirs(parent, exist_ok=True)
+    dumped = "\n".join(_dump_lines(data, 0)) + "\n"
+    with open(path, "w", encoding="utf-8") as fh:
+        fh.write(dumped)
+
+
+def profile_version_from_map(data: dict[str, Any]) -> str:
+    """Derive a deterministic version string from a parsed profile dict.
+
+    The version is the full SHA-256 hex digest of the canonical key-sorted
+    JSON representation.  This is independent of on-disk formatting (JSON
+    vs YAML, whitespace, key ordering).
+    """
+    canonical = json.dumps(data, sort_keys=True, ensure_ascii=True)
+    return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+
+# ---------------------------------------------------------------------------
+# Internal YAML serializer — mirrors the project yaml shim's ``_dump_lines``
+# but renders empty collections as ``[]`` / ``{}`` so that ``yaml.safe_load``
+# round-trips them correctly.
+# ---------------------------------------------------------------------------
+
+_YAML_SPECIAL_WORDS = frozenset(
+    ("true", "false", "null", "yes", "no", "on", "off")
+)
+_YAML_SPECIAL_CHARS = set(":#{}[],&*?|>!%@`\"'")
+
+
+def _dump_scalar(value: object) -> str:
+    """Serialize a scalar to a YAML-safe string."""
+    if value is None:
+        return "null"
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, (int, float)):
+        return str(value)
+    text = str(value)
+    if (
+        text.lower() in _YAML_SPECIAL_WORDS
+        or text != text.strip()
+        or any(ch in _YAML_SPECIAL_CHARS for ch in text)
+        or not text
+        or _looks_numeric(text)
+    ):
+        return json.dumps(text, ensure_ascii=False)
+    return text
+
+
+def _looks_numeric(text: str) -> bool:
+    """Return True if *text* would be parsed as a number by yaml.safe_load."""
+    try:
+        float(text)
+        return True
+    except (TypeError, ValueError):
+        return False
+
+
+def _dump_lines(value: object, indent: int) -> list[str]:
+    """Recursively serialize *value* to a list of YAML lines."""
+    prefix = " " * indent
+    if isinstance(value, dict):
+        if not value:
+            return [f"{prefix}{{}}"]
+        lines: list[str] = []
+        for key, item in value.items():
+            if isinstance(item, dict):
+                if not item:
+                    lines.append(f"{prefix}{key}: {{}}")
+                else:
+                    lines.append(f"{prefix}{key}:")
+                    lines.extend(_dump_lines(item, indent + 2))
+            elif isinstance(item, list):
+                if not item:
+                    lines.append(f"{prefix}{key}: []")
+                else:
+                    lines.append(f"{prefix}{key}:")
+                    lines.extend(_dump_lines(item, indent + 2))
+            else:
+                lines.append(f"{prefix}{key}: {_dump_scalar(item)}")
+        return lines
+    if isinstance(value, list):
+        if not value:
+            return [f"{prefix}[]"]
+        lines = []
+        for item in value:
+            if isinstance(item, dict):
+                nested = _dump_lines(item, indent + 2)
+                if nested:
+                    first = nested[0].strip()
+                    lines.append(f"{prefix}- {first}")
+                    lines.extend(nested[1:])
+                else:
+                    lines.append(f"{prefix}- {{}}")
+            elif isinstance(item, list):
+                lines.append(f"{prefix}-")
+                lines.extend(_dump_lines(item, indent + 2))
+            else:
+                lines.append(f"{prefix}- {_dump_scalar(item)}")
+        return lines
+    return [f"{prefix}{_dump_scalar(value)}"]
+
+
+_GOVERNED_SECTIONS = ("style", "safety")
+_GOVERNED_CONFIRMATION_STATES = ("confirmed", "pending_confirmation", "inferred")
+
+
+def classify_preference_section(field: str, value: str) -> str:
+    token = f"{field} {value}".lower()
+    if "safety" in token or "guardrail" in token or "override" in token:
+        return "safety"
+    return "style"
+
+
+def is_destructive_preference(field: str, value: str) -> bool:
+    token = f"{field} {value}".lower()
+    destructive_tokens = (
+        "disable",
+        "off",
+        "bypass",
+        "ignore",
+        "override",
+        "unsafe",
+        "no_guard",
+        "no guard",
+    )
+    return any(piece in token for piece in destructive_tokens)
+
+
+def ensure_governed_preferences(profile: dict[str, Any]) -> None:
+    governed_obj = profile.get("governed_preferences")
+    governed = governed_obj if isinstance(governed_obj, dict) else {}
+    for section in _GOVERNED_SECTIONS:
+        raw_entries = governed.get(section)
+        if not isinstance(raw_entries, list):
+            governed[section] = []
+            continue
+        normalized: list[dict[str, Any]] = []
+        for raw in raw_entries:
+            if not isinstance(raw, dict):
+                continue
+            entry = _normalize_governed_entry(raw, section)
+            if entry is not None:
+                normalized.append(entry)
+        governed[section] = normalized
+    profile["governed_preferences"] = governed
+
+
+def upsert_governed_preference(
+    profile: dict[str, Any],
+    *,
+    field: str,
+    value: str,
+    source: str,
+    learned_at: str,
+    updated_at: str,
+    section: str,
+    confirmation_state: str,
+    decay_metadata: dict[str, Any] | None,
+) -> None:
+    ensure_governed_preferences(profile)
+    governed = profile["governed_preferences"]
+    if not isinstance(governed, dict):
+        return
+    target = governed.get(section)
+    if not isinstance(target, list):
+        target = []
+
+    match_index = -1
+    for idx, raw_entry in enumerate(target):
+        if not isinstance(raw_entry, dict):
+            continue
+        if str(raw_entry.get("field", "")).strip() == field and str(raw_entry.get("value", "")).strip() == value:
+            match_index = idx
+            break
+
+    baseline: dict[str, Any] = {
+        "field": field,
+        "value": value,
+        "source": source,
+        "learned_at": learned_at,
+        "updated_at": updated_at,
+        "section": section,
+        "confirmation_state": confirmation_state,
+    }
+    if section == "style" and decay_metadata is not None:
+        baseline["decay_metadata"] = decay_metadata
+
+    if match_index == -1:
+        target.append(baseline)
+    else:
+        existing = target[match_index]
+        if isinstance(existing, dict):
+            baseline["learned_at"] = str(existing.get("learned_at", learned_at)).strip() or learned_at
+        target[match_index] = baseline
+
+    governed[section] = target
+
+
+def _normalize_governed_entry(raw: dict[str, Any], section: str) -> dict[str, Any] | None:
+    field = str(raw.get("field", "")).strip()
+    value = " ".join(str(raw.get("value", "")).strip().split())
+    source = str(raw.get("source", "")).strip()
+    learned_at = str(raw.get("learned_at", "")).strip()
+    updated_at = str(raw.get("updated_at", "")).strip()
+    section_raw = str(raw.get("section", section)).strip().lower()
+    confirmation_state = str(raw.get("confirmation_state", "")).strip().lower()
+
+    if not (field and value and source and learned_at and updated_at):
+        return None
+    if section_raw not in _GOVERNED_SECTIONS:
+        return None
+    if confirmation_state not in _GOVERNED_CONFIRMATION_STATES:
+        return None
+
+    out: dict[str, Any] = {
+        "field": field,
+        "value": value,
+        "source": source,
+        "learned_at": learned_at,
+        "updated_at": updated_at,
+        "section": section_raw,
+        "confirmation_state": confirmation_state,
+    }
+
+    if section_raw == "style" and confirmation_state == "inferred":
+        decay_raw = raw.get("decay_metadata")
+        decay = decay_raw if isinstance(decay_raw, dict) else {}
+        out["decay_metadata"] = {
+            "decay_score": _coerce_decay_score(decay.get("decay_score", 0.0)),
+            "last_seen_at": str(decay.get("last_seen_at", updated_at)).strip() or updated_at,
+            "decay_reason": str(decay.get("decay_reason", "inferred_signal")).strip() or "inferred_signal",
+        }
+    return out
+
+
+def _coerce_decay_score(raw: Any) -> float:
+    try:
+        score = float(raw)
+    except (TypeError, ValueError):
+        score = 0.0
+    if score < 0.0:
+        return 0.0
+    if score > 1.0:
+        return 1.0
+    return round(score, 3)

package/runtime/proof_gate.py

@@ -1,14 +1,23 @@
 from __future__ import annotations
 
 import hashlib
+import os
 from pathlib import Path
 from typing import Any
 
 from runtime import artifact_parsers
+from runtime.evidence_requirements import FULL_REQUIREMENTS, requirements_for_profile
 
 
 _REQUIRED_ARTIFACT_FIELDS = ("kind", "path", "sha256", "parser", "summary", "trace_id")
 
+_REQUIRED_ARTIFACT_TOKENS: dict[str, tuple[str, ...]] = {
+    "junit": ("junit", "junit.xml", "surefire"),
+    "coverage": ("coverage", "lcov", "coverage.xml"),
+    "sarif": ("sarif", ".sarif"),
+    "browser_trace": ("trace.zip", "browser_trace", "playwright", "browser-evidence"),
+}
+
 
 def evaluate_proof_gate(input: dict[str, Any]) -> dict[str, Any]:
     claims = _as_claims(input.get("claims"))
@@ -17,6 +26,10 @@ def evaluate_proof_gate(input: dict[str, Any]) -> dict[str, Any]:
     security_evidence = _as_dict(input.get("security_evidence"))
     browser_evidence = _as_dict(input.get("browser_evidence"))
     evidence_pack = _as_dict(input.get("evidence_pack"))
+    evidence_profile = _resolve_evidence_profile(input=input, evidence_pack=evidence_pack)
+    evidence_requirements = requirements_for_profile(evidence_profile)
+    test_intent_lock = _as_dict(input.get("test_intent_lock"))
+    test_delta = _as_dict(input.get("test_delta"))
 
     blockers: list[str] = []
     if not claims:
@@ -32,21 +45,37 @@ def evaluate_proof_gate(input: dict[str, Any]) -> dict[str, Any]:
         blockers.append("proof_gate_proof_chain_blockers_invalid")
 
     trace_id = str(proof_chain.get("trace_id", "")).strip()
-    blockers.extend(_validate_claim_artifacts(claims))
+    blockers.extend(_validate_claim_artifacts(claims, evidence_requirements=evidence_requirements))
     blockers.extend(_validate_trace_linkage(claims=claims, trace_id=trace_id, eval_output=eval_output, browser_evidence=browser_evidence))
     blockers.extend(_validate_security_and_browser_artifacts(claims=claims, security_evidence=security_evidence, browser_evidence=browser_evidence))
     blockers.extend(_validate_evidence_pack(evidence_pack))
 
+    strict_mode = os.environ.get("OMG_PROOF_CHAIN_STRICT", "0").strip() == "1"
+    causal_chain_blockers = _validate_lock_delta_chain(
+        claims=claims,
+        test_intent_lock=test_intent_lock,
+        test_delta=test_delta,
+        evidence_pack=evidence_pack,
+    )
+    if strict_mode:
+        blockers.extend(causal_chain_blockers)
+
     unique_blockers = list(dict.fromkeys(item for item in blockers if str(item).strip()))
+    advisories = [] if strict_mode else causal_chain_blockers
     evidence_summary = {
         "claim_count": len(claims),
         "proof_chain_status": proof_status,
         "proof_chain_blocker_count": len(proof_blockers) if isinstance(proof_blockers, list) else 0,
-        "required_artifacts": ["junit", "coverage", "sarif", "browser_trace"],
+        "required_artifacts": _required_artifact_keys(evidence_requirements),
+        "evidence_profile": evidence_profile,
+        "evidence_requirements": list(evidence_requirements),
         "trace_id": trace_id,
         "eval_trace_id": str(eval_output.get("trace_id", "")).strip(),
         "has_security_evidence": bool(security_evidence),
         "has_browser_evidence": bool(browser_evidence),
+        "has_lock_evidence": _has_lock_evidence(claims, test_intent_lock, evidence_pack),
+        "has_waiver_artifact": _has_waiver_artifact(test_delta or _as_dict(evidence_pack.get("test_delta"))),
+        "advisories": advisories,
     }
     return {
         "schema": "ProofGateResult",
@@ -100,7 +129,11 @@ def _collect_trace_ids(claim: dict[str, Any]) -> set[str]:
     return {str(item).strip() for item in raw_trace_ids if str(item).strip()}
 
 
-def _validate_claim_artifacts(claims: list[dict[str, Any]]) -> list[str]:
+def _validate_claim_artifacts(
+    claims: list[dict[str, Any]],
+    *,
+    evidence_requirements: list[str],
+) -> list[str]:
     all_artifacts: list[str] = []
     artifact_records: list[dict[str, Any]] = []
     for claim in claims:
@@ -109,10 +142,9 @@ def _validate_claim_artifacts(claims: list[dict[str, Any]]) -> list[str]:
 
     blockers: list[str] = []
     required_tokens = {
-        "junit": ("junit", "junit.xml", "surefire"),
-        "coverage": ("coverage", "lcov", "coverage.xml"),
-        "sarif": ("sarif", ".sarif"),
-        "browser_trace": ("trace.zip", "browser_trace", "playwright", "browser-evidence"),
+        key: _REQUIRED_ARTIFACT_TOKENS[key]
+        for key in _required_artifact_keys(evidence_requirements)
+        if key in _REQUIRED_ARTIFACT_TOKENS
     }
     for key, tokens in required_tokens.items():
         if not any(any(token in artifact for token in tokens) for artifact in all_artifacts):
@@ -256,6 +288,89 @@ def _validate_artifact_hash(artifact: dict[str, Any]) -> str | None:
     return None
 
 
+def _has_lock_evidence(claims: list[dict[str, Any]], test_intent_lock: dict[str, Any], evidence_pack: dict[str, Any]) -> bool:
+    lock_status = str(test_intent_lock.get("status", "")).strip().lower()
+    if lock_status == "ok":
+        return True
+    if str(test_intent_lock.get("lock_id", "")).strip():
+        return True
+
+    test_delta = _as_dict(evidence_pack.get("test_delta"))
+    if str(test_delta.get("lock_id", "")).strip():
+        return True
+
+    for claim in claims:
+        if str(claim.get("lock_id", "")).strip():
+            return True
+        lock_verification = _as_dict(claim.get("lock_verification"))
+        if str(lock_verification.get("status", "")).strip().lower() == "ok":
+            return True
+    return False
+
+
+def _has_waiver_artifact(delta_summary: dict[str, Any]) -> bool:
+    waiver = delta_summary.get("waiver_artifact")
+    if isinstance(waiver, dict):
+        for field in ("artifact_path", "path", "id", "reason"):
+            if str(waiver.get(field, "")).strip():
+                return True
+    return bool(str(delta_summary.get("waiver_artifact_path", "")).strip())
+
+
+def _is_weakened_or_drift_delta(delta_summary: dict[str, Any]) -> bool:
+    flags = delta_summary.get("flags")
+    if not isinstance(flags, list):
+        return False
+    risk_flags = {
+        "weakened_assertions",
+        "tests_mismatch",
+        "selector_drift",
+        "removed_touched_area_coverage",
+        "integration_to_mock_downgrade",
+        "snapshot_only_refresh",
+    }
+    normalized_flags = {str(item).strip().lower() for item in flags if str(item).strip()}
+    return bool(normalized_flags & risk_flags)
+
+
+def _validate_lock_delta_chain(
+    *,
+    claims: list[dict[str, Any]],
+    test_intent_lock: dict[str, Any],
+    test_delta: dict[str, Any],
+    evidence_pack: dict[str, Any],
+) -> list[str]:
+    blockers: list[str] = []
+    if not _has_lock_evidence(claims, test_intent_lock, evidence_pack):
+        blockers.append("proof_gate_missing_lock_evidence")
+
+    delta_summary = test_delta if test_delta else _as_dict(evidence_pack.get("test_delta"))
+    if _is_weakened_or_drift_delta(delta_summary) and not _has_waiver_artifact(delta_summary):
+        blockers.append("proof_gate_missing_waiver_artifact")
+    return blockers
+
+
+def _resolve_evidence_profile(*, input: dict[str, Any], evidence_pack: dict[str, Any]) -> str:
+    profile = str(input.get("evidence_profile", "")).strip()
+    if profile:
+        return profile
+    return str(evidence_pack.get("evidence_profile", "")).strip()
+
+
+def _required_artifact_keys(evidence_requirements: list[str]) -> list[str]:
+    required: list[str] = []
+    requirement_set = {str(item).strip() for item in evidence_requirements if str(item).strip()}
+    if "tests" in requirement_set:
+        required.append("junit")
+    if "build" in requirement_set:
+        required.append("coverage")
+    if "security_scan" in requirement_set:
+        required.append("sarif")
+    if requirement_set == set(FULL_REQUIREMENTS):
+        required.append("browser_trace")
+    return required
+
+
 _PARSERS: dict[str, Any] = {
     "junit": artifact_parsers.parse_junit,
     "sarif": artifact_parsers.parse_sarif,

package/runtime/providers/opencode_provider.py

@@ -0,0 +1,94 @@
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+from pathlib import Path
+from typing import cast
+from typing import Any
+
+from runtime.cli_provider import CLIProvider, register_provider
+from runtime.mcp_config_writers import _atomic_write_text  # pyright: ignore[reportPrivateUsage]
+
+HOST_RULES = {
+    "compilation_targets": ["opencode.json"],
+    "mcp": ["omg-control"],
+    "mcp_key": "mcp",
+}
+
+
+class OpenCodeProvider(CLIProvider):
+    def get_name(self) -> str:  # pyright: ignore[reportImplicitOverride]
+        return "opencode"
+
+    def detect(self) -> bool:  # pyright: ignore[reportImplicitOverride]
+        return shutil.which("opencode") is not None
+
+    def check_auth(self) -> tuple[bool | None, str]:  # pyright: ignore[reportImplicitOverride]
+        auth_path = Path(os.path.expanduser("~/.local/share/opencode/auth.json"))
+        if not auth_path.exists():
+            return False, f"auth not found: missing {auth_path}"
+        try:
+            parsed = cast(object, json.loads(auth_path.read_text()))
+        except (json.JSONDecodeError, ValueError) as exc:
+            return False, f"auth not found: invalid json: {exc}"
+        except OSError as exc:
+            return False, f"auth not found: unreadable file: {exc}"
+
+        if not parsed:
+            return False, "auth not found: empty auth content"
+        return True, "auth found"
+
+    def invoke(self, prompt: str, project_dir: str, timeout: int = 120) -> dict[str, Any]:  # pyright: ignore[reportExplicitAny, reportImplicitOverride]
+        try:
+            result = self.run_tool(["opencode", prompt], timeout=timeout)
+            return {
+                "model": "opencode-cli",
+                "output": result.stdout,
+                "exit_code": result.returncode,
+            }
+        except subprocess.TimeoutExpired:
+            return {"error": "opencode-cli timeout", "fallback": "claude"}
+        except FileNotFoundError:
+            return {"error": "opencode-cli not found", "fallback": "claude"}
+        except Exception as exc:
+            return {"error": str(exc), "fallback": "claude"}
+
+    def invoke_tmux(self, prompt: str, project_dir: str, timeout: int = 120) -> dict[str, Any]:  # pyright: ignore[reportExplicitAny, reportImplicitOverride]
+        return self.invoke(prompt, project_dir, timeout=timeout)
+
+    def get_non_interactive_cmd(self, prompt: str) -> list[str]:  # pyright: ignore[reportImplicitOverride]
+        return ["opencode", prompt]
+
+    def get_config_path(self) -> str:  # pyright: ignore[reportImplicitOverride]
+        return os.path.expanduser("~/.config/opencode/opencode.json")
+
+    def get_project_config_path(self, root: str = ".") -> str:
+        return str(Path(root) / "opencode.json")
+
+    def get_plugin_dir(self, root: str = ".") -> str:
+        return str(Path(root) / ".opencode" / "plugins")
+
+    def write_mcp_config(self, server_url: str, server_name: str = "memory-server") -> None:  # pyright: ignore[reportImplicitOverride]
+        config_path = Path(self.get_config_path())
+        config: dict[str, object]
+        if config_path.exists():
+            try:
+                loaded = cast(object, json.loads(config_path.read_text()))
+                config = cast(dict[str, object], loaded) if isinstance(loaded, dict) else {}
+            except (json.JSONDecodeError, ValueError):
+                config = {}
+        else:
+            config = {}
+
+        mcp = config.get("mcp")
+        if not isinstance(mcp, dict):
+            mcp = {}
+            config["mcp"] = mcp
+
+        mcp[server_name] = {"type": "http", "url": server_url}
+        _atomic_write_text(config_path, json.dumps(config, indent=2) + "\n")
+
+
+register_provider(OpenCodeProvider())