@trac3er/oh-my-god 2.1.0 → 2.1.4

package/scripts/validate-release-identity.py

@@ -0,0 +1,246 @@
+#!/usr/bin/env python3
+"""Read-only release identity validator.
+
+Usage:
+    python3 scripts/validate-release-identity.py --scope all --forbid-version 2.1.1
+    python3 scripts/validate-release-identity.py --scope authored
+    python3 scripts/validate-release-identity.py --scope derived
+"""
+from __future__ import annotations
+
+import argparse
+import ast
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+_REPO_ROOT = Path(__file__).resolve().parent.parent
+if str(_REPO_ROOT) not in sys.path:
+    sys.path.insert(0, str(_REPO_ROOT))
+
+from runtime.release_surfaces import AUTHORED_SURFACES, SCOPED_RESIDUE_TARGETS
+
+import importlib.util
+
+_SYNC_SCRIPT = _REPO_ROOT / "scripts" / "sync-release-identity.py"
+_sync_spec = importlib.util.spec_from_file_location("sync_release_identity", _SYNC_SCRIPT)
+assert _sync_spec is not None and _sync_spec.loader is not None
+_sync_mod = importlib.util.module_from_spec(_sync_spec)
+_sync_spec.loader.exec_module(_sync_mod)
+
+check_surface = _sync_mod.check_surface
+extract_canonical_version = _sync_mod.extract_canonical_version
+
+
+_DERIVED_JSON_SURFACES: list[tuple[str, list[str]]] = [
+    ("dist/public/manifest.json", ["contract_version"]),
+    ("dist/enterprise/manifest.json", ["contract_version"]),
+    ("artifacts/release/dist/public/manifest.json", ["contract_version"]),
+    ("artifacts/release/dist/enterprise/manifest.json", ["contract_version"]),
+]
+
+_DERIVED_AST_SURFACE = "build/lib/runtime/adoption.py"
+
+_CHANGELOG_HISTORICAL_RE = re.compile(r"^## \[?\d+\.\d+\.\d+\]?")
+
+
+def validate_authored(repo_root: Path, canonical: str) -> dict[str, Any]:
+    blockers: list[dict[str, str]] = []
+    for surface in AUTHORED_SURFACES:
+        drifts = check_surface(repo_root, surface, canonical)
+        for label, found in drifts:
+            blockers.append({
+                "surface": label,
+                "found": found if found is not None else "<not found>",
+                "expected": canonical,
+            })
+    status = "fail" if blockers else "ok"
+    return {"status": status, "blockers": blockers}
+
+
+def validate_derived(repo_root: Path, canonical: str) -> dict[str, Any]:
+    blockers: list[dict[str, str]] = []
+
+    for rel_path, key_path in _DERIVED_JSON_SURFACES:
+        full_path = repo_root / rel_path
+        if not full_path.exists():
+            continue
+        try:
+            data = json.loads(full_path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            continue
+        current: Any = data
+        for key in key_path:
+            if isinstance(current, dict):
+                current = current.get(key)
+            else:
+                current = None
+                break
+        if current is not None and current != canonical:
+            blockers.append({
+                "surface": rel_path,
+                "found": str(current),
+                "expected": canonical,
+            })
+
+    ast_path = repo_root / _DERIVED_AST_SURFACE
+    if ast_path.exists():
+        try:
+            tree = ast.parse(ast_path.read_text(encoding="utf-8"))
+            for node in ast.walk(tree):
+                if isinstance(node, ast.Assign):
+                    for target in node.targets:
+                        if isinstance(target, ast.Name) and target.id == "CANONICAL_VERSION":
+                            if isinstance(node.value, ast.Constant) and isinstance(node.value.value, str):
+                                if node.value.value != canonical:
+                                    blockers.append({
+                                        "surface": _DERIVED_AST_SURFACE,
+                                        "found": node.value.value,
+                                        "expected": canonical,
+                                    })
+        except (OSError, SyntaxError):
+            pass
+
+    status = "fail" if blockers else "ok"
+    return {"status": status, "blockers": blockers}
+
+
+def _is_changelog_historical(line: str, forbid_version: str) -> bool:
+    return (
+        _CHANGELOG_HISTORICAL_RE.match(line.strip()) is not None
+        and forbid_version in line
+    )
+
+
+def _scan_file_for_residue(
+    file_path: Path, rel_path: str, forbid_version: str,
+) -> list[dict[str, Any]]:
+    blockers: list[dict[str, Any]] = []
+    try:
+        lines = file_path.read_text(encoding="utf-8").splitlines()
+    except (OSError, UnicodeDecodeError):
+        return blockers
+
+    for line_num, line in enumerate(lines, start=1):
+        if forbid_version not in line:
+            continue
+        if file_path.name == "CHANGELOG.md" and _is_changelog_historical(line, forbid_version):
+            continue
+        blockers.append({
+            "file": rel_path,
+            "line": line_num,
+            "content": line.strip(),
+        })
+    return blockers
+
+
+def scan_scoped_residue(repo_root: Path, forbid_version: str) -> dict[str, Any]:
+    blockers: list[dict[str, Any]] = []
+
+    for target in SCOPED_RESIDUE_TARGETS:
+        full_path = repo_root / target
+        if not full_path.exists():
+            continue
+
+        if full_path.is_file():
+            blockers.extend(_scan_file_for_residue(full_path, target, forbid_version))
+        elif full_path.is_dir():
+            for child in sorted(full_path.rglob("*")):
+                if child.is_file():
+                    rel = str(child.relative_to(repo_root))
+                    blockers.extend(_scan_file_for_residue(child, rel, forbid_version))
+
+    status = "fail" if blockers else "ok"
+    return {"status": status, "forbid_version": forbid_version, "blockers": blockers}
+
+
+def build_report(
+    *,
+    canonical: str,
+    scope: str,
+    forbid_version: str | None,
+    authored: dict[str, Any] | None,
+    derived: dict[str, Any] | None,
+    scoped_residue: dict[str, Any] | None,
+) -> dict[str, Any]:
+    has_failure = False
+    for section in (authored, derived, scoped_residue):
+        if section is not None and section.get("status") == "fail":
+            has_failure = True
+            break
+
+    report: dict[str, Any] = {
+        "canonical_version": canonical,
+        "scope": scope,
+        "forbid_version": forbid_version,
+    }
+
+    if authored is not None:
+        report["authored"] = authored
+    if derived is not None:
+        report["derived"] = derived
+    if scoped_residue is not None:
+        report["scoped_residue"] = scoped_residue
+
+    report["overall_status"] = "fail" if has_failure else "ok"
+    return report
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Read-only release identity validator")
+    parser.add_argument("--scope", choices=["authored", "derived", "all"], default="all")
+    parser.add_argument("--forbid-version", default=None)
+    parser.add_argument("--output-json", default=None)
+    args = parser.parse_args()
+
+    adoption_file = _REPO_ROOT / "runtime" / "adoption.py"
+    if not adoption_file.exists():
+        print(json.dumps({"error": "runtime/adoption.py not found"}), file=sys.stderr)
+        return 1
+
+    canonical = extract_canonical_version(adoption_file)
+    if canonical is None:
+        print(json.dumps({"error": "CANONICAL_VERSION not found"}), file=sys.stderr)
+        return 1
+
+    authored_result = None
+    derived_result = None
+    residue_result = None
+
+    if args.scope in ("authored", "all"):
+        authored_result = validate_authored(_REPO_ROOT, canonical)
+    else:
+        authored_result = {"status": "skipped", "blockers": []}
+
+    if args.scope in ("derived", "all"):
+        derived_result = validate_derived(_REPO_ROOT, canonical)
+    else:
+        derived_result = {"status": "skipped", "blockers": []}
+
+    if args.forbid_version and args.scope in ("derived", "all"):
+        residue_result = scan_scoped_residue(_REPO_ROOT, args.forbid_version)
+
+    report = build_report(
+        canonical=canonical,
+        scope=args.scope,
+        forbid_version=args.forbid_version,
+        authored=authored_result,
+        derived=derived_result,
+        scoped_residue=residue_result,
+    )
+
+    output = json.dumps(report, indent=2)
+
+    if args.output_json:
+        Path(args.output_json).parent.mkdir(parents=True, exist_ok=True)
+        Path(args.output_json).write_text(output + "\n", encoding="utf-8")
+    else:
+        print(output)
+
+    return 1 if report["overall_status"] == "fail" else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/verify-standalone.sh

@@ -20,6 +20,9 @@ OMG_RELEASE_READY_PROVIDERS=claude,codex python3 scripts/omg.py release readines
 python3 scripts/omg.py compat gate --max-bridge 0 --output .omg/evidence/omg-compat-gap.json
 python3 scripts/check-omg-public-ready.py
 
+echo "=== Validating release identity ==="
+python3 scripts/validate-release-identity.py --scope all --forbid-version 2.1.1
+
 if command -v pyenv >/dev/null 2>&1 && pyenv prefix 3.12.7 >/dev/null 2>&1; then
   PYENV_VERSION=3.12.7 python -m pytest -q
 else

package/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.1.0 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.1.4 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -316,7 +316,7 @@
     ]
   },
   "_omg": {
-    "_version": "2.1.0",
+    "_version": "2.1.4",
     "preset": "safe",
     "omgMode": "focused",
     "default_mode": "ulw+ralph",
@@ -370,7 +370,7 @@
       "CONTEXT_MANAGER": false
     },
     "generated": {
-      "contract_version": "2.1.0",
+      "contract_version": "2.1.4",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",

package/templates/plugins-allowlist.yaml

@@ -0,0 +1,19 @@
+# Plugins allowlist schema template
+#
+# - source: "mcp:filesystem"
+#   host: "claude"
+#   resource_type: "mcp_server"  # one of: mcp_server, skill, plugin
+#   reason: "trusted local plugin"
+#   scope: "project"             # optional: project | global
+#   timestamp: "2026-03-09T00:00:00Z"  # optional: ISO 8601 UTC
+#   approver: "user"             # optional
+#
+# - source: "skill:omg/control-plane"
+#   host: "codex"
+#   resource_type: "skill"
+#   reason: "required control-plane skill"
+#
+# - source: "plugin:omg-core"
+#   host: "gemini"
+#   resource_type: "plugin"
+#   reason: "approved core plugin"

package/artifacts/release/dist/enterprise/bundle/.gemini/settings.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "omg-control": {
-      "command": "python3",
-      "args": [
-        "-m",
-        "runtime.omg_mcp_server"
-      ]
-    }
-  }
-}

package/artifacts/release/dist/enterprise/bundle/.kimi/mcp.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "omg-control": {
-      "command": "python3",
-      "args": [
-        "-m",
-        "runtime.omg_mcp_server"
-      ]
-    }
-  }
-}

package/artifacts/release/dist/public/bundle/.gemini/settings.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "omg-control": {
-      "command": "python3",
-      "args": [
-        "-m",
-        "runtime.omg_mcp_server"
-      ]
-    }
-  }
-}

package/artifacts/release/dist/public/bundle/.kimi/mcp.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "omg-control": {
-      "command": "python3",
-      "args": [
-        "-m",
-        "runtime.omg_mcp_server"
-      ]
-    }
-  }
-}

package/build/lib/yaml.py

@@ -1,321 +0,0 @@
-"""Minimal YAML compatibility layer for OMG.
-
-This keeps standalone/no-vendor flows working when PyYAML is unavailable.
-It supports the subset used in OMG configs: mappings, lists, quoted strings,
-booleans, numbers, nulls, and simple flow-style collections.
-"""
-from __future__ import annotations
-
-import io
-import json
-from typing import Any
-
-
-def _read_text(stream_or_text: Any) -> str:
-    if hasattr(stream_or_text, "read"):
-        return str(stream_or_text.read())
-    return str(stream_or_text)
-
-
-def _strip_comments(line: str) -> str:
-    in_single = False
-    in_double = False
-    escaped = False
-    out: list[str] = []
-    for char in line:
-        if escaped:
-            out.append(char)
-            escaped = False
-            continue
-        if char == "\\" and in_double:
-            out.append(char)
-            escaped = True
-            continue
-        if char == "'" and not in_double:
-            in_single = not in_single
-            out.append(char)
-            continue
-        if char == '"' and not in_single:
-            in_double = not in_double
-            out.append(char)
-            continue
-        if char == "#" and not in_single and not in_double:
-            break
-        out.append(char)
-    return "".join(out).rstrip()
-
-
-def _prepare_lines(text: str) -> list[tuple[int, str]]:
-    prepared: list[tuple[int, str]] = []
-    for raw_line in text.splitlines():
-        stripped = _strip_comments(raw_line)
-        if not stripped.strip():
-            continue
-        indent = len(stripped) - len(stripped.lstrip(" "))
-        prepared.append((indent, stripped[indent:]))
-    return prepared
-
-
-def _split_key_value(text: str) -> tuple[str, str] | None:
-    in_single = False
-    in_double = False
-    escaped = False
-    for index, char in enumerate(text):
-        if escaped:
-            escaped = False
-            continue
-        if char == "\\" and in_double:
-            escaped = True
-            continue
-        if char == "'" and not in_double:
-            in_single = not in_single
-            continue
-        if char == '"' and not in_single:
-            in_double = not in_double
-            continue
-        if char == ":" and not in_single and not in_double:
-            if index + 1 < len(text) and text[index + 1] not in {" ", "\t"}:
-                continue
-            return text[:index].strip(), text[index + 1 :].strip()
-    return None
-
-
-def _split_flow_items(text: str) -> list[str]:
-    items: list[str] = []
-    current: list[str] = []
-    in_single = False
-    in_double = False
-    escaped = False
-    depth = 0
-    for char in text:
-        if escaped:
-            current.append(char)
-            escaped = False
-            continue
-        if char == "\\" and in_double:
-            current.append(char)
-            escaped = True
-            continue
-        if char == "'" and not in_double:
-            in_single = not in_single
-            current.append(char)
-            continue
-        if char == '"' and not in_single:
-            in_double = not in_double
-            current.append(char)
-            continue
-        if char in "[{" and not in_single and not in_double:
-            depth += 1
-            current.append(char)
-            continue
-        if char in "]}" and not in_single and not in_double:
-            depth -= 1
-            current.append(char)
-            continue
-        if char == "," and not in_single and not in_double and depth == 0:
-            item = "".join(current).strip()
-            if item:
-                items.append(item)
-            current = []
-            continue
-        current.append(char)
-    tail = "".join(current).strip()
-    if tail:
-        items.append(tail)
-    return items
-
-
-def _parse_scalar(text: str) -> Any:
-    if text == "":
-        return ""
-    if text[0] in {'"', "'"} and text[-1] == text[0]:
-        return text[1:-1]
-    lowered = text.lower()
-    if lowered in {"true", "yes", "on"}:
-        return True
-    if lowered in {"false", "no", "off"}:
-        return False
-    if lowered in {"null", "~"}:
-        return None
-    if text.startswith("[") and text.endswith("]"):
-        inner = text[1:-1].strip()
-        if not inner:
-            return []
-        return [_parse_scalar(item) for item in _split_flow_items(inner)]
-    if text.startswith("{") and text.endswith("}"):
-        inner = text[1:-1].strip()
-        if not inner:
-            return {}
-        out: dict[str, Any] = {}
-        for item in _split_flow_items(inner):
-            pair = _split_key_value(item)
-            if pair is None:
-                raise ValueError(f"Invalid flow mapping item: {item!r}")
-            out[str(_parse_scalar(pair[0]))] = _parse_scalar(pair[1])
-        return out
-    try:
-        if text.startswith("0") and text not in {"0", "0.0"} and not text.startswith("0."):
-            raise ValueError
-        return int(text)
-    except ValueError:
-        pass
-    try:
-        return float(text)
-    except ValueError:
-        return text
-
-
-class _Parser:
-    def __init__(self, lines: list[tuple[int, str]]):
-        self.lines = lines
-        self.index = 0
-
-    def parse(self) -> Any:
-        if not self.lines:
-            return None
-        return self._parse_block(self.lines[0][0])
-
-    def _parse_block(self, indent: int) -> Any:
-        if self.index >= len(self.lines):
-            return None
-        current_indent, content = self.lines[self.index]
-        if current_indent < indent:
-            return None
-        if content.startswith("- "):
-            return self._parse_list(indent)
-        return self._parse_mapping(indent)
-
-    def _parse_mapping(self, indent: int) -> dict[str, Any]:
-        out: dict[str, Any] = {}
-        while self.index < len(self.lines):
-            current_indent, content = self.lines[self.index]
-            if current_indent < indent:
-                break
-            if current_indent != indent or content.startswith("- "):
-                break
-            pair = _split_key_value(content)
-            if pair is None:
-                raise ValueError(f"Invalid mapping line: {content!r}")
-            raw_key, raw_value = pair
-            key = str(_parse_scalar(raw_key))
-            self.index += 1
-            if raw_value:
-                out[key] = _parse_scalar(raw_value)
-                continue
-            if self.index < len(self.lines) and self.lines[self.index][0] > current_indent:
-                out[key] = self._parse_block(self.lines[self.index][0])
-            else:
-                out[key] = None
-        return out
-
-    def _parse_list(self, indent: int) -> list[Any]:
-        out: list[Any] = []
-        while self.index < len(self.lines):
-            current_indent, content = self.lines[self.index]
-            if current_indent < indent:
-                break
-            if current_indent != indent or not content.startswith("- "):
-                break
-            item_content = content[2:].strip()
-            self.index += 1
-            if not item_content:
-                if self.index < len(self.lines) and self.lines[self.index][0] > current_indent:
-                    out.append(self._parse_block(self.lines[self.index][0]))
-                else:
-                    out.append(None)
-                continue
-
-            pair = _split_key_value(item_content)
-            if pair is not None and pair[0] and " " not in pair[0]:
-                raw_key, raw_value = pair
-                item: dict[str, Any] = {str(_parse_scalar(raw_key)): _parse_scalar(raw_value) if raw_value else None}
-                if not raw_value and self.index < len(self.lines) and self.lines[self.index][0] > current_indent:
-                    item[str(_parse_scalar(raw_key))] = self._parse_block(self.lines[self.index][0])
-                if self.index < len(self.lines) and self.lines[self.index][0] > current_indent:
-                    extra = self._parse_block(self.lines[self.index][0])
-                    if isinstance(extra, dict):
-                        item.update(extra)
-                out.append(item)
-                continue
-
-            out.append(_parse_scalar(item_content))
-        return out
-
-
-def safe_load(stream: Any) -> Any:
-    text = _read_text(stream)
-    stripped = text.strip()
-    if not stripped:
-        return None
-    if stripped[0] in {"{", "["}:
-        try:
-            return json.loads(stripped)
-        except json.JSONDecodeError:
-            pass
-    return _Parser(_prepare_lines(text)).parse()
-
-
-def _dump_scalar(value: Any) -> str:
-    if value is None:
-        return "null"
-    if isinstance(value, bool):
-        return "true" if value else "false"
-    if isinstance(value, (int, float)):
-        return str(value)
-    return json.dumps(str(value), ensure_ascii=False)
-
-
-def _dump_lines(value: Any, indent: int) -> list[str]:
-    prefix = " " * indent
-    if isinstance(value, dict):
-        lines: list[str] = []
-        for key, item in value.items():
-            if isinstance(item, (dict, list)):
-                lines.append(f"{prefix}{key}:")
-                lines.extend(_dump_lines(item, indent + 2))
-            else:
-                lines.append(f"{prefix}{key}: {_dump_scalar(item)}")
-        return lines
-    if isinstance(value, list):
-        lines = []
-        for item in value:
-            if isinstance(item, dict):
-                nested = _dump_lines(item, indent + 2)
-                if nested:
-                    first = nested[0].strip()
-                    lines.append(f"{prefix}- {first}")
-                    for line in nested[1:]:
-                        lines.append(line)
-                else:
-                    lines.append(f"{prefix}- {{}}")
-            elif isinstance(item, list):
-                lines.append(f"{prefix}-")
-                lines.extend(_dump_lines(item, indent + 2))
-            else:
-                lines.append(f"{prefix}- {_dump_scalar(item)}")
-        return lines
-    return [f"{prefix}{_dump_scalar(value)}"]
-
-
-def safe_dump(
-    data: Any,
-    stream: io.TextIOBase | None = None,
-    default_flow_style: bool | None = None,
-    sort_keys: bool = False,
-    **_: Any,
-) -> str | None:
-    _ = default_flow_style
-    dump_data = data
-    if sort_keys and isinstance(data, dict):
-        dump_data = dict(sorted(data.items()))
-    text = "\n".join(_dump_lines(dump_data, 0)) + "\n"
-    if stream is not None:
-        stream.write(text)
-        return None
-    return text
-
-
-dump = safe_dump
-load = safe_load
-
-__all__ = ["dump", "load", "safe_dump", "safe_load"]

package/dist/enterprise/bundle/.gemini/settings.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "omg-control": {
-      "command": "python3",
-      "args": [
-        "-m",
-        "runtime.omg_mcp_server"
-      ]
-    }
-  }
-}

package/dist/enterprise/bundle/.kimi/mcp.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "omg-control": {
-      "command": "python3",
-      "args": [
-        "-m",
-        "runtime.omg_mcp_server"
-      ]
-    }
-  }
-}