@trac3er/oh-my-god 2.1.0 → 2.1.4

package/scripts/omg.py

@@ -16,6 +16,7 @@ from __future__ import annotations
 
 import argparse
 from datetime import datetime, timezone
+import importlib.util
 import json
 import os
 from pathlib import Path
@@ -59,9 +60,12 @@ from runtime.compat import (
     list_compat_skills,
     run_doctor,
 )
+from runtime.validate import run_validate, format_text as validate_format_text
+from runtime.plugin_diagnostics import approve_plugin, run_plugin_diagnostics
 from runtime.adoption import CANONICAL_VERSION, VALID_PRESETS
 from runtime.ecosystem import ecosystem_status, list_ecosystem_repos, sync_ecosystem_repos
 from runtime.team_router import TeamDispatchRequest, dispatch_team, execute_ccg_mode, execute_crazy_mode
+from runtime.release_run_coordinator import resolve_current_run_id
 
 
 def _now_run_id() -> str:
@@ -213,9 +217,11 @@ def cmd_secure(args: argparse.Namespace) -> int:
 def cmd_undo(args: argparse.Namespace) -> int:
     from runtime.interaction_journal import InteractionJournal
 
-    result = InteractionJournal(".").undo(args.step_id)
+    project_dir = _ensure_project_dir()
+    run_id = resolve_current_run_id(project_dir=project_dir)
+    result = InteractionJournal(project_dir).undo(args.step_id, run_id=run_id)
     print(json.dumps(result, indent=2))
-    return 0
+    return 2 if result.get("status") == "rollback_failed" else 0
 
 
 def cmd_security_check(args: argparse.Namespace) -> int:
@@ -230,6 +236,40 @@ def cmd_security_check(args: argparse.Namespace) -> int:
     return 0
 
 
+def _sanitize_token(value: str) -> str:
+    cleaned = "".join(ch if ch.isalnum() or ch in {"-", "_"} else "-" for ch in str(value).strip())
+    return cleaned or "unknown"
+
+
+def cmd_waive_tests(args: argparse.Namespace) -> int:
+    project_dir = _ensure_project_dir()
+    issued_at = datetime.now(timezone.utc).isoformat()
+    lock_id = str(args.lock_id).strip()
+    reason = str(args.reason).strip()
+    run_id = resolve_current_run_id(project_dir=project_dir)
+
+    evidence_dir = Path(project_dir) / ".omg" / "evidence"
+    evidence_dir.mkdir(parents=True, exist_ok=True)
+
+    artifact_name = f"waiver-tests-{_sanitize_token(lock_id)}-{_now_run_id()}.json"
+    artifact_path = evidence_dir / artifact_name
+    artifact_rel_path = str(artifact_path.relative_to(project_dir)).replace("\\", "/")
+
+    payload = {
+        "schema": "WaiverEvidence",
+        "schema_version": 1,
+        "lock_id": lock_id,
+        "run_id": run_id,
+        "reason": reason,
+        "issued_at": issued_at,
+        "artifact_path": artifact_rel_path,
+    }
+    artifact_path.write_text(json.dumps(payload, indent=2, sort_keys=True), encoding="utf-8")
+
+    print(json.dumps(payload, indent=2))
+    return 0
+
+
 def cmd_api_twin_ingest(args: argparse.Namespace) -> int:
     result = ingest_contract(_ensure_project_dir(), name=args.name, source_path=args.source)
     print(json.dumps(result, indent=2))
@@ -648,10 +688,73 @@ def cmd_ecosystem_sync(args: argparse.Namespace) -> int:
     return 0 if not errors else 2
 
 
+def _load_release_identity_validator() -> Any:
+    validator_path = ROOT_DIR / "scripts" / "validate-release-identity.py"
+    spec = importlib.util.spec_from_file_location("validate_release_identity", validator_path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError("unable to load validate-release-identity.py")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
 def cmd_contract_validate(args: argparse.Namespace) -> int:
     result = validate_contract_registry(ROOT_DIR)
+
+    release_identity_scope = getattr(args, "release_identity_scope", "all")
+    forbid_version = getattr(args, "forbid_version", "") or None
+
+    try:
+        validator = _load_release_identity_validator()
+        canonical = validator.extract_canonical_version(ROOT_DIR / "runtime" / "adoption.py")
+        if canonical is None:
+            release_identity = {
+                "canonical_version": None,
+                "scope": release_identity_scope,
+                "forbid_version": forbid_version,
+                "overall_status": "fail",
+                "error": "CANONICAL_VERSION not found",
+            }
+        else:
+            authored_result = (
+                validator.validate_authored(ROOT_DIR, canonical)
+                if release_identity_scope in {"authored", "all"}
+                else {"status": "skipped", "blockers": []}
+            )
+            derived_result = (
+                validator.validate_derived(ROOT_DIR, canonical)
+                if release_identity_scope in {"derived", "all"}
+                else {"status": "skipped", "blockers": []}
+            )
+            residue_result = (
+                validator.scan_scoped_residue(ROOT_DIR, forbid_version)
+                if forbid_version
+                else None
+            )
+            release_identity = validator.build_report(
+                canonical=canonical,
+                scope=release_identity_scope,
+                forbid_version=forbid_version,
+                authored=authored_result,
+                derived=derived_result,
+                scoped_residue=residue_result,
+            )
+    except Exception as exc:
+        release_identity = {
+            "canonical_version": None,
+            "scope": release_identity_scope,
+            "forbid_version": forbid_version,
+            "overall_status": "fail",
+            "error": f"release identity validator failed: {exc}",
+        }
+
+    result["release_identity"] = release_identity
+    status_ok = result.get("status") == "ok" and release_identity.get("overall_status") == "ok"
+    if not status_ok:
+        result["status"] = "error"
+
     print(json.dumps(result, indent=2))
-    return 0 if result.get("status") == "ok" else 2
+    return 0 if status_ok else 2
 
 
 def cmd_contract_compile(args: argparse.Namespace) -> int:
@@ -722,6 +825,17 @@ def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
     contract_sub = parent.add_subparsers(dest=dest, required=True)
 
     contract_validate = contract_sub.add_parser("validate", help="Validate contract doc, schema, and bundle registry")
+    contract_validate.add_argument(
+        "--release-identity-scope",
+        default="all",
+        choices=["authored", "derived", "all"],
+        help="Scope for embedded release identity validation",
+    )
+    contract_validate.add_argument(
+        "--forbid-version",
+        default="",
+        help="Optional stale version to reject in scoped residue targets",
+    )
     contract_validate.set_defaults(func=cmd_contract_validate)
 
     contract_compile = contract_sub.add_parser(
@@ -740,6 +854,115 @@ def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
     contract_compile.set_defaults(func=cmd_contract_compile)
 
 
+def cmd_profile_review(args: argparse.Namespace) -> int:
+    """Read-only review of governed profile state."""
+    from runtime.profile_io import load_profile, ensure_governed_preferences, profile_version_from_map
+
+    project_dir = _ensure_project_dir()
+    profile_path = os.path.join(project_dir, ".omg", "state", "profile.yaml")
+    profile = load_profile(profile_path)
+
+    # Ensure governed_preferences structure exists (in-memory only, no write)
+    ensure_governed_preferences(profile)
+    governed = profile.get("governed_preferences", {})
+    governed = governed if isinstance(governed, dict) else {}
+
+    style_entries = governed.get("style", [])
+    style_entries = style_entries if isinstance(style_entries, list) else []
+    safety_entries = governed.get("safety", [])
+    safety_entries = safety_entries if isinstance(safety_entries, list) else []
+
+    pending = []
+    for entry in style_entries + safety_entries:
+        if isinstance(entry, dict) and entry.get("confirmation_state") == "pending_confirmation":
+            pending.append({
+                "field": entry.get("field", ""),
+                "value": entry.get("value", ""),
+                "section": entry.get("section", ""),
+            })
+
+    decay_candidates = []
+    for entry in style_entries:
+        if not isinstance(entry, dict):
+            continue
+        dm = entry.get("decay_metadata")
+        if isinstance(dm, dict):
+            score = 0.0
+            try:
+                score = float(dm.get("decay_score", 0.0))
+            except (TypeError, ValueError):
+                pass
+            if score > 0:
+                decay_candidates.append({
+                    "field": entry.get("field", ""),
+                    "value": entry.get("value", ""),
+                    "decay_score": score,
+                    "last_seen_at": dm.get("last_seen_at", ""),
+                    "decay_reason": dm.get("decay_reason", ""),
+                })
+
+    provenance_obj = profile.get("profile_provenance")
+    provenance = provenance_obj if isinstance(provenance_obj, dict) else {}
+    recent_updates = provenance.get("recent_updates", [])
+    recent_updates = recent_updates if isinstance(recent_updates, list) else []
+    provenance_summary = [
+        {
+            "run_id": str(u.get("run_id", "")),
+            "source": str(u.get("source", "")),
+            "field": str(u.get("field", "")),
+            "updated_at": str(u.get("updated_at", "")),
+        }
+        for u in recent_updates
+        if isinstance(u, dict)
+    ]
+
+    version = profile_version_from_map(profile) if profile else ""
+
+    result: dict[str, Any] = {
+        "schema": "ProfileReview",
+        "style": style_entries,
+        "safety": safety_entries,
+        "pending_confirmations": pending,
+        "decay_candidates": decay_candidates,
+        "provenance_summary": provenance_summary,
+        "profile_version": version,
+    }
+
+    fmt = getattr(args, "format", "json")
+    if fmt == "json":
+        print(json.dumps(result, indent=2))
+    else:
+        print("=== Profile Review ===")
+        print(f"Profile version: {version[:16]}..." if version else "Profile version: (none)")
+        print(f"\n--- Style preferences ({len(style_entries)}) ---")
+        for e in style_entries:
+            if isinstance(e, dict):
+                print(f"  {e.get('field', '?')}: {e.get('value', '?')}  [{e.get('confirmation_state', '?')}]")
+        print(f"\n--- Safety preferences ({len(safety_entries)}) ---")
+        for e in safety_entries:
+            if isinstance(e, dict):
+                print(f"  {e.get('field', '?')}: {e.get('value', '?')}  [{e.get('confirmation_state', '?')}]")
+        if pending:
+            print(f"\n--- Pending confirmations ({len(pending)}) ---")
+            for p in pending:
+                print(f"  {p['section']}/{p['field']}: {p['value']}")
+        else:
+            print("\n--- Pending confirmations: none ---")
+        if decay_candidates:
+            print(f"\n--- Decay candidates ({len(decay_candidates)}) ---")
+            for d in decay_candidates:
+                print(f"  {d['field']}: score={d['decay_score']:.3f}  reason={d['decay_reason']}")
+        else:
+            print("\n--- Decay candidates: none ---")
+        if provenance_summary:
+            print(f"\n--- Provenance ({len(provenance_summary)} recent updates) ---")
+            for p in provenance_summary:
+                print(f"  [{p['updated_at']}] {p['source']} -> {p['field']}")
+        else:
+            print("\n--- Provenance: no recent updates ---")
+    return 0
+
+
 def cmd_doctor(args: argparse.Namespace) -> int:
     fmt = getattr(args, "format", "text")
     result = run_doctor(root_dir=ROOT_DIR)
@@ -757,6 +980,60 @@ def cmd_doctor(args: argparse.Namespace) -> int:
     return 0 if result["status"] == "pass" else 1
 
 
+
+def cmd_validate(args: argparse.Namespace) -> int:
+    fmt = getattr(args, "format", "text")
+    result = run_validate(root_dir=ROOT_DIR)
+    if fmt == "json":
+        print(json.dumps(result, indent=2))
+    else:
+        print(validate_format_text(result))
+    return 0 if result["status"] == "pass" else 1
+
+
+def _format_plugin_diagnostics_text(result: dict[str, Any]) -> str:
+    summary = result.get("summary", {})
+    lines = [
+        "Plugin Diagnostics",
+        f"Status: {result.get('status', 'unknown').upper()}",
+        (
+            "Records: "
+            f"{summary.get('total_records', 0)} | Conflicts: {summary.get('total_conflicts', 0)} "
+            f"(blockers={summary.get('blockers', 0)}, warnings={summary.get('warnings', 0)}, infos={summary.get('infos', 0)})"
+        ),
+    ]
+
+    next_actions = result.get("next_actions", [])
+    if isinstance(next_actions, list) and next_actions:
+        lines.append("Next Actions:")
+        for action in next_actions:
+            lines.append(f"- {action}")
+
+    elapsed_ms = result.get("elapsed_ms", 0.0)
+    lines.append(f"Elapsed: {elapsed_ms:.2f}ms")
+    return "\n".join(lines)
+
+
+def cmd_diagnose_plugins(args: argparse.Namespace) -> int:
+    fmt = getattr(args, "format", "text")
+    result = run_plugin_diagnostics(root=str(ROOT_DIR), live=bool(getattr(args, "live", False)))
+    if fmt == "json":
+        print(json.dumps(result, indent=2))
+    else:
+        print(_format_plugin_diagnostics_text(result))
+    return 0
+
+
+def cmd_diagnose_plugins_approve(args: argparse.Namespace) -> int:
+    fmt = getattr(args, "format", "json")
+    result = approve_plugin(args.source, args.host, args.reason, root=str(ROOT_DIR))
+    if fmt == "json":
+        print(json.dumps(result, indent=2))
+    else:
+        print(f"Approval status: {result.get('status', 'unknown')}")
+        print(str(result.get("message", "")))
+    return 0 if result.get("status") == "ok" else 2
+
 def _add_release_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> None:
     release_sub = parent.add_subparsers(dest=dest, required=True)
 
@@ -797,6 +1074,11 @@ def build_parser() -> argparse.ArgumentParser:
     security_check.add_argument("--waivers-json", default="")
     security_check.set_defaults(func=cmd_security_check)
 
+    waive_tests = sub.add_parser("waive-tests", help="Emit structured waiver evidence for test-intent lock exceptions")
+    waive_tests.add_argument("--lock-id", required=True)
+    waive_tests.add_argument("--reason", required=True)
+    waive_tests.set_defaults(func=cmd_waive_tests)
+
     api_twin = sub.add_parser("api-twin", help="Contract replay and fixture-based API simulation")
     api_twin_sub = api_twin.add_subparsers(dest="api_twin_command", required=True)
     api_twin_ingest = api_twin_sub.add_parser("ingest", help="Ingest OpenAPI/Postman/example contract input")
@@ -973,6 +1255,27 @@ def build_parser() -> argparse.ArgumentParser:
     doctor.add_argument("--format", default="text", choices=["text", "json"], dest="format")
     doctor.set_defaults(func=cmd_doctor)
 
+    validate = sub.add_parser("validate", help="Canonical validation — doctor + contract + profile + install")
+    validate.add_argument("--format", default="text", choices=["text", "json"], dest="format")
+    validate.set_defaults(func=cmd_validate)
+
+    diagnose_plugins = sub.add_parser("diagnose-plugins", help="Diagnose plugin interoperability and conflicts")
+    diagnose_plugins.add_argument("--format", default="text", choices=["text", "json"], dest="format")
+    diagnose_plugins.add_argument("--live", action="store_true", help="Enable live probing mode")
+    diagnose_plugins.set_defaults(func=cmd_diagnose_plugins)
+    diagnose_plugins_sub = diagnose_plugins.add_subparsers(dest="diagnose_plugins_command")
+
+    diagnose_plugins_approve = diagnose_plugins_sub.add_parser("approve", help="Approve a plugin source for host use")
+    diagnose_plugins_approve.add_argument("--source", required=True)
+    diagnose_plugins_approve.add_argument("--host", required=True)
+    diagnose_plugins_approve.add_argument("--reason", required=True)
+    diagnose_plugins_approve.add_argument("--format", default="json", choices=["text", "json"], dest="format")
+    diagnose_plugins_approve.set_defaults(func=cmd_diagnose_plugins_approve)
+
+    profile_review = sub.add_parser("profile-review", help="Review governed profile state")
+    profile_review.add_argument("--format", default="json", choices=["json", "text"], dest="format")
+    profile_review.set_defaults(func=cmd_profile_review)
+
     return parser
 
 

package/scripts/prepare-release-proof-fixtures.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
 from pathlib import Path
 
@@ -16,9 +17,23 @@ def _write_text(path: Path, content: str) -> None:
     path.write_text(content, encoding="utf-8")
 
 
+def _context_checksum(*, run_id: str, profile_version: str, intent_gate_version: str) -> str:
+    material = f"{run_id}|{profile_version}|{intent_gate_version}"
+    return hashlib.sha256(material.encode("utf-8", errors="ignore")).hexdigest()
+
+
 def prepare_release_proof_fixtures(output_root: Path) -> None:
     trace_id = "trace-1"
     eval_id = "eval-1"
+    run_id = "run-1"
+    lock_id = "lock-1"
+    profile_version = "profile-v1"
+    intent_gate_version = "1.0.0"
+    context_checksum = _context_checksum(
+        run_id=run_id,
+        profile_version=profile_version,
+        intent_gate_version=intent_gate_version,
+    )
 
     junit_path = output_root / ".omg" / "evidence" / "junit.xml"
     coverage_path = output_root / ".omg" / "evidence" / "coverage.xml"
@@ -28,6 +43,14 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
     eval_path = output_root / ".omg" / "evals" / "latest.json"
     security_path = output_root / ".omg" / "evidence" / "security-check.json"
     evidence_path = output_root / ".omg" / "evidence" / "run-1.json"
+    forge_path = output_root / ".omg" / "evidence" / "forge-specialists-run-1.json"
+    release_run_path = output_root / ".omg" / "state" / "release_run_coordinator" / "run-1.json"
+    lock_path = output_root / ".omg" / "state" / "test-intent-lock" / "lock-1.json"
+    rollback_path = output_root / ".omg" / "state" / "rollback_manifest" / "run-1-step-1.json"
+    session_health_path = output_root / ".omg" / "state" / "session_health" / "run-1.json"
+    council_verdicts_path = output_root / ".omg" / "state" / "council_verdicts" / "run-1.json"
+    intent_gate_path = output_root / ".omg" / "state" / "intent_gate" / "run-1.json"
+    profile_path = output_root / ".omg" / "state" / "profile.yaml"
     tracebank_path = output_root / ".omg" / "tracebank" / "events.jsonl"
 
     _write_text(
@@ -89,16 +112,22 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
             "schema": "SecurityCheckResult",
             "status": "ok",
             "evidence": {"sarif_path": ".omg/evidence/results.sarif"},
+            "context_checksum": context_checksum,
+            "profile_version": profile_version,
+            "intent_gate_version": intent_gate_version,
         },
     )
     _write_json(
         evidence_path,
-        {
-            "schema": "EvidencePack",
-            "run_id": "run-1",
-            "timestamp": "2026-03-07T00:00:00Z",
-            "executor": {"user": "release-bot", "pid": 1},
-            "environment": {"hostname": "localhost", "platform": "linux"},
+            {
+                "schema": "EvidencePack",
+                "run_id": run_id,
+                "timestamp": "2026-03-07T00:00:00Z",
+                "executor": {"user": "release-bot", "pid": 1},
+                "environment": {"hostname": "localhost", "platform": "linux"},
+                "context_checksum": context_checksum,
+                "profile_version": profile_version,
+                "intent_gate_version": intent_gate_version,
             "tests": [{"name": "release_readiness", "passed": True}],
             "security_scans": [{"tool": "security-check", "path": ".omg/evidence/security-check.json"}],
             "diff_summary": {"files": 1},
@@ -120,9 +149,164 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
             ],
             "trace_ids": [trace_id],
             "lineage": {"trace_id": trace_id, "path": ".omg/lineage/lineage-1.json"},
-            "test_delta": {"override": {"approved_by": "release-bot"}},
+                "test_delta": {
+                    "override": {"approved_by": "release-bot"},
+                    "lock_id": lock_id,
+                    "waiver_artifact": {
+                        "artifact_path": ".omg/evidence/waiver-tests-lock-1.json",
+                        "reason": "approved release fixture",
+                    },
+                },
+                "intent_gate_state": {
+                    "path": ".omg/state/intent_gate/run-1.json",
+                    "run_id": run_id,
+                },
+                "profile_digest": {
+                    "path": ".omg/state/profile.yaml",
+                    "profile_version": profile_version,
+                },
+                "session_health_state": {
+                    "path": ".omg/state/session_health/run-1.json",
+                    "run_id": run_id,
+                },
+                "council_verdicts": {
+                    "path": ".omg/state/council_verdicts/run-1.json",
+                    "run_id": run_id,
+                },
+                "forge_starter_proof": {
+                    "path": ".omg/evidence/forge-specialists-run-1.json",
+                    "run_id": run_id,
+                },
+            },
+    )
+    _write_json(
+        forge_path,
+        {
+            "schema": "ForgeSpecialistDispatchEvidence",
+            "schema_version": "1.0.0",
+            "run_id": run_id,
+            "generated_at": "2026-03-07T00:00:00Z",
+            "status": "ok",
+            "proof_backed": True,
+            "specialists_dispatched": ["training-architect"],
+            "context_checksum": context_checksum,
+            "profile_version": profile_version,
+            "intent_gate_version": intent_gate_version,
+        },
+    )
+    _write_json(
+        release_run_path,
+        {
+            "schema": "ReleaseRunCoordinatorState",
+            "schema_version": "1.0.0",
+            "run_id": run_id,
+            "status": "ok",
+            "phase": "finalize",
+            "resolution_source": "fixtures",
+            "resolution_reason": "deterministic_release_seed",
+            "updated_at": "2026-03-07T00:00:00Z",
+            "context_checksum": context_checksum,
+            "profile_version": profile_version,
+            "intent_gate_version": intent_gate_version,
         },
     )
+    _write_json(
+        lock_path,
+        {
+            "schema": "TestIntentLock",
+            "schema_version": "1.0.0",
+            "lock_id": lock_id,
+            "status": "ok",
+            "intent": {"run_id": run_id},
+            "context_checksum": context_checksum,
+            "profile_version": profile_version,
+            "intent_gate_version": intent_gate_version,
+        },
+    )
+    _write_json(
+        rollback_path,
+        {
+            "schema": "RollbackManifest",
+            "schema_version": "1.0.0",
+            "run_id": run_id,
+            "status": "ok",
+            "step_id": "step-1",
+            "local_restores": [],
+            "compensating_actions": [],
+            "side_effects": [],
+            "updated_at": "2026-03-07T00:00:00Z",
+        },
+    )
+    _write_json(
+        session_health_path,
+        {
+            "schema": "SessionHealth",
+            "schema_version": "1.0.0",
+            "run_id": run_id,
+            "status": "ok",
+            "contamination_risk": 0.0,
+            "overthinking_score": 0.0,
+            "context_health": 1.0,
+            "verification_status": "ok",
+            "recommended_action": "continue",
+            "updated_at": "2026-03-07T00:00:00Z",
+            "context_checksum": context_checksum,
+            "profile_version": profile_version,
+            "intent_gate_version": intent_gate_version,
+        },
+    )
+    _write_json(
+        council_verdicts_path,
+        {
+            "schema": "CouncilVerdicts",
+            "schema_version": "1.0.0",
+            "run_id": run_id,
+            "status": "ok",
+            "verification_status": "ok",
+            "context_checksum": context_checksum,
+            "profile_version": profile_version,
+            "intent_gate_version": intent_gate_version,
+            "verdicts": {
+                "skeptic": {"verdict": "pass"},
+                "hallucination_auditor": {"verdict": "pass"},
+                "evidence_completeness": {"verdict": "pass"},
+            },
+            "updated_at": "2026-03-07T00:00:00Z",
+        },
+    )
+    _write_json(
+        intent_gate_path,
+        {
+            "schema": "IntentGateDecision",
+            "schema_version": intent_gate_version,
+            "run_id": run_id,
+            "intent_gate_version": intent_gate_version,
+            "requires_clarification": False,
+            "intent_class": "release_readiness",
+            "clarification_prompt": "",
+            "confidence": 0.98,
+            "context_checksum": context_checksum,
+            "profile_version": profile_version,
+            "updated_at": "2026-03-07T00:00:00Z",
+        },
+    )
+    _write_text(
+        profile_path,
+        """profile_version: profile-v1
+preferences:
+  architecture_requests:
+    - release_readiness
+  constraints:
+    release_mode: dual
+user_vector:
+  tags:
+    - proof
+    - readiness
+  summary: deterministic fixture profile digest
+profile_provenance:
+  checksum: profile-v1
+""",
+    )
     tracebank_path.parent.mkdir(parents=True, exist_ok=True)
     tracebank_path.write_text(
         json.dumps(