@trac3er/oh-my-god 2.1.0 → 2.1.4

package/build/lib/hooks/setup_wizard.py

@@ -7,7 +7,9 @@ from __future__ import annotations
 import json
 import logging
 import os
+import re
 import sys
+from pathlib import Path
 from typing import Any, cast
 
 import yaml
@@ -35,6 +37,7 @@ from runtime.mcp_config_writers import (  # noqa: E402
 import runtime.providers.codex_provider  # noqa: E402, F401
 import runtime.providers.gemini_provider  # noqa: E402, F401
 import runtime.providers.kimi_provider  # noqa: E402, F401
+from runtime.validate import run_validate as _run_post_install_validate  # noqa: E402
 from runtime.adoption import (  # noqa: E402
     CANONICAL_MODE_NAMES,
     CANONICAL_VERSION,
@@ -191,6 +194,28 @@ MCP_CATALOG: list[dict[str, Any]] = [
         "default": False,
         "category": "memory",
     },
+    {
+        "id": "notebooklm",
+        "name": "NotebookLM",
+        "description": "NotebookLM MCP server for AI-powered research and note-taking",
+        "command": "npx",
+        "args": ["-y", "notebooklm-mcp@latest"],
+        "default": False,
+        "category": "productivity",
+        "warning": (
+            "NOTEBOOKLM MCP WARNING\n\n"
+            "NotebookLM requires browser automation and has several important considerations:\n\n"
+            "BROWSER AUTOMATION: NotebookLM uses Puppeteer for browser automation. "
+            "This requires a Chromium/Chrome installation and may consume significant system resources.\n\n"
+            "FIRST-RUN DOWNLOAD: On first run, NotebookLM will download a full browser instance "
+            "(typically 100-300 MB). This is a one-time operation but may take several minutes.\n\n"
+            "DEDICATED ACCOUNT: It is strongly recommended to use a dedicated Google account "
+            "for NotebookLM MCP. Do NOT use your primary account, as the MCP will store credentials locally.\n\n"
+            "AUTH EXPIRY: Google authentication tokens expire periodically. "
+            "You may need to re-authenticate if the MCP fails with auth errors.\n\n"
+            "Enable NotebookLM only if you understand these requirements and accept the risks."
+        ),
+    },
 ]
 
 _MCP_ID_ALIASES: dict[str, str] = {
@@ -451,6 +476,12 @@ def check_auth() -> dict[str, Any]:
 
 _HTTP_MEMORY_MIN_LEVEL: int = _PRESET_LEVEL["interop"]
 
+_PROFILE_ARCH_REQUEST_MAX = 8
+_PROFILE_TAG_MAX = 12
+_PROFILE_SUMMARY_MAX_CHARS = 240
+_PROFILE_RECENT_UPDATES_MAX = 5
+_PROFILE_GOVERNED_MAX = 24
+
 
 def get_mode_choices() -> list[str]:
     return list(CANONICAL_MODE_NAMES)
@@ -660,6 +691,8 @@ def set_preferences(project_dir: str, preferences: dict[str, Any]) -> dict[str,
     state_dir = os.path.join(project_dir, ".omg", "state")
     os.makedirs(state_dir, exist_ok=True)
 
+    _write_profile_learning_sections(state_dir, preferences)
+
     # Write config to YAML file
     config_path = os.path.join(state_dir, "cli-config.yaml")
     with open(config_path, "w") as f:
@@ -674,6 +707,260 @@ def set_preferences(project_dir: str, preferences: dict[str, Any]) -> dict[str,
     }
 
 
+def _write_profile_learning_sections(state_dir: str, preferences: dict[str, Any]) -> None:
+    profile_path = os.path.join(state_dir, "profile.yaml")
+    profile_data = _load_profile_yaml(profile_path)
+    _ensure_profile_baseline(profile_data)
+
+    profile_data["preferences"] = _normalize_preferences_block(preferences.get("preferences"))
+    profile_data["user_vector"] = _normalize_user_vector_block(preferences.get("user_vector"))
+    profile_data["profile_provenance"] = _normalize_provenance_block(preferences.get("profile_provenance"))
+    profile_data["governed_preferences"] = _normalize_governed_preferences_block(preferences.get("governed_preferences"))
+
+    from runtime.profile_io import save_profile
+    save_profile(profile_path, profile_data)
+
+
+def _render_explicit_empty_collections(dumped: str) -> str:
+    lines = dumped.splitlines()
+    output: list[str] = []
+
+    def _next_line(start: int) -> str:
+        if start + 1 < len(lines):
+            return lines[start + 1]
+        return ""
+
+    for idx, line in enumerate(lines):
+        next_line = _next_line(idx)
+        stripped = line.strip()
+
+        if stripped == "stack:" and (not next_line or not next_line.startswith("- ")):
+            output.append("stack: []")
+            continue
+        if stripped == "conventions:" and (not next_line or not next_line.startswith("  ")):
+            output.append("conventions: {}")
+            continue
+        if stripped == "ai_behavior:" and (not next_line or not next_line.startswith("  ")):
+            output.append("ai_behavior: {}")
+            continue
+        if stripped == "architecture_requests:" and (not next_line or not next_line.startswith("    - ")):
+            output.append("  architecture_requests: []")
+            continue
+        if stripped == "constraints:" and (not next_line or not next_line.startswith("    ")):
+            output.append("  constraints: {}")
+            continue
+        if stripped == "tags:" and (not next_line or not next_line.startswith("    - ")):
+            output.append("  tags: []")
+            continue
+        if stripped == "recent_updates:" and (not next_line or not next_line.startswith("    - ")):
+            output.append("  recent_updates: []")
+            continue
+
+        output.append(line)
+
+    return "\n".join(output) + "\n"
+
+
+def _load_profile_yaml(profile_path: str) -> dict[str, Any]:
+    from runtime.profile_io import load_profile
+    return load_profile(profile_path)
+
+
+def _ensure_profile_baseline(profile_data: dict[str, Any]) -> None:
+    profile_data.setdefault("name", "omg-project")
+    profile_data.setdefault("description", "initialized by OMG standalone compat bootstrap")
+    profile_data.setdefault("language", "unknown")
+    profile_data.setdefault("framework", "unknown")
+    profile_data.setdefault("stack", [])
+    profile_data.setdefault("conventions", {})
+    profile_data.setdefault("ai_behavior", {})
+    profile_data.setdefault("governed_preferences", {"style": [], "safety": []})
+
+
+def _normalize_preferences_block(raw: Any) -> dict[str, Any]:
+    block = raw if isinstance(raw, dict) else {}
+
+    requests_obj = block.get("architecture_requests")
+    architecture_requests: list[str] = []
+    if isinstance(requests_obj, list):
+        for value in requests_obj:
+            text = str(value).strip()
+            if text:
+                architecture_requests.append(text)
+            if len(architecture_requests) >= _PROFILE_ARCH_REQUEST_MAX:
+                break
+
+    constraints_obj = block.get("constraints")
+    constraints: dict[str, Any] = {}
+    if isinstance(constraints_obj, dict):
+        for key, value in constraints_obj.items():
+            normalized_key = _normalize_constraint_key(str(key))
+            normalized_value = _normalize_constraint_value(value)
+            if normalized_key and normalized_value is not None:
+                constraints[normalized_key] = normalized_value
+
+    routing_obj = block.get("routing")
+    routing_map = routing_obj if isinstance(routing_obj, dict) else {}
+    routing = {
+        "prefer_clarification": bool(routing_map.get("prefer_clarification", False)),
+    }
+
+    return {
+        "architecture_requests": architecture_requests,
+        "constraints": constraints,
+        "routing": routing,
+    }
+
+
+def _normalize_constraint_key(value: str) -> str:
+    normalized = value.strip().lower()
+    normalized = re.sub(r"\s+", "_", normalized)
+    normalized = re.sub(r"[^a-z0-9_]+", "", normalized)
+    return normalized
+
+
+def _normalize_constraint_value(value: Any) -> str | int | float | bool | None:
+    if isinstance(value, bool):
+        return value
+    if isinstance(value, int):
+        return value
+    if isinstance(value, float):
+        return value
+    if value is None:
+        return None
+    text = str(value).strip().lower()
+    return text if text else None
+
+
+def _normalize_user_vector_block(raw: Any) -> dict[str, Any]:
+    block = raw if isinstance(raw, dict) else {}
+
+    tags_obj = block.get("tags")
+    tags: list[str] = []
+    if isinstance(tags_obj, list):
+        for value in tags_obj:
+            token = _normalize_tag_token(str(value))
+            if token:
+                tags.append(token)
+            if len(tags) >= _PROFILE_TAG_MAX:
+                break
+
+    summary = ""
+    summary_obj = block.get("summary")
+    if isinstance(summary_obj, str):
+        summary = " ".join(summary_obj.strip().split())[:_PROFILE_SUMMARY_MAX_CHARS]
+
+    confidence = 0.0
+    confidence_obj = block.get("confidence")
+    if isinstance(confidence_obj, (int, float, str)):
+        try:
+            confidence = float(confidence_obj)
+        except (TypeError, ValueError):
+            confidence = 0.0
+    confidence = max(0.0, min(1.0, confidence))
+
+    return {
+        "tags": tags,
+        "summary": summary,
+        "confidence": confidence,
+    }
+
+
+def _normalize_tag_token(value: str) -> str:
+    normalized = value.strip().lower()
+    normalized = re.sub(r"\s+", "_", normalized)
+    normalized = re.sub(r"[^a-z0-9_\-]+", "", normalized)
+    return normalized
+
+
+def _normalize_provenance_block(raw: Any) -> dict[str, Any]:
+    block = raw if isinstance(raw, dict) else {}
+    updates_obj = block.get("recent_updates")
+    updates: list[dict[str, str]] = []
+    if isinstance(updates_obj, list):
+        for entry in updates_obj:
+            if not isinstance(entry, dict):
+                continue
+            run_id = str(entry.get("run_id", "")).strip()
+            source = str(entry.get("source", "")).strip()
+            field = str(entry.get("field", "")).strip()
+            updated_at = str(entry.get("updated_at", "")).strip()
+            if not (run_id and source and field and updated_at):
+                continue
+            updates.append(
+                {
+                    "run_id": run_id,
+                    "source": source,
+                    "field": field,
+                    "updated_at": updated_at,
+                }
+            )
+            if len(updates) >= _PROFILE_RECENT_UPDATES_MAX:
+                break
+    return {"recent_updates": updates}
+
+
+def _normalize_governed_preferences_block(raw: Any) -> dict[str, list[dict[str, Any]]]:
+    block = raw if isinstance(raw, dict) else {}
+    style_raw = block.get("style")
+    safety_raw = block.get("safety")
+    return {
+        "style": _normalize_governed_section_entries(style_raw, section="style"),
+        "safety": _normalize_governed_section_entries(safety_raw, section="safety"),
+    }
+
+
+def _normalize_governed_section_entries(raw: Any, *, section: str) -> list[dict[str, Any]]:
+    if not isinstance(raw, list):
+        return []
+    entries: list[dict[str, Any]] = []
+    for item in raw:
+        if not isinstance(item, dict):
+            continue
+        field = str(item.get("field", "")).strip()
+        value = " ".join(str(item.get("value", "")).strip().split())
+        source = str(item.get("source", "")).strip()
+        learned_at = str(item.get("learned_at", "")).strip()
+        updated_at = str(item.get("updated_at", "")).strip()
+        candidate_section = str(item.get("section", section)).strip().lower()
+        confirmation_state = str(item.get("confirmation_state", "")).strip().lower()
+
+        if not (field and value and source and learned_at and updated_at):
+            continue
+        if candidate_section != section:
+            continue
+        if confirmation_state not in ("confirmed", "pending_confirmation", "inferred"):
+            continue
+
+        entry: dict[str, Any] = {
+            "field": field,
+            "value": value,
+            "source": source,
+            "learned_at": learned_at,
+            "updated_at": updated_at,
+            "section": section,
+            "confirmation_state": confirmation_state,
+        }
+
+        if section == "style" and confirmation_state == "inferred":
+            decay_raw = item.get("decay_metadata")
+            decay = decay_raw if isinstance(decay_raw, dict) else {}
+            try:
+                score = float(decay.get("decay_score", 0.0))
+            except (TypeError, ValueError):
+                score = 0.0
+            entry["decay_metadata"] = {
+                "decay_score": max(0.0, min(1.0, score)),
+                "last_seen_at": str(decay.get("last_seen_at", updated_at)).strip() or updated_at,
+                "decay_reason": str(decay.get("decay_reason", "inferred_signal")).strip() or "inferred_signal",
+            }
+
+        entries.append(entry)
+        if len(entries) >= _PROFILE_GOVERNED_MAX:
+            break
+    return entries
+
+
 def _write_project_settings_preset(project_dir: str, preset: str) -> None:
     """Persist preset metadata into project settings when settings.json exists."""
     settings_path = os.path.join(project_dir, "settings.json")
@@ -760,7 +1047,7 @@ def run_setup_wizard(
     report_path = write_adoption_report(project_dir, adoption)
     adoption["report_path"] = report_path
 
-    return {
+    result: dict[str, Any] = {
         "status": "complete",
         "setup_mode": {
             "choices": get_mode_choices(),
@@ -773,3 +1060,48 @@ def run_setup_wizard(
         "preferences": prefs,
         "adoption": adoption,
     }
+
+    # --- Post-install validation (runs AFTER all setup writes are complete) ---
+    try:
+        validation_result = _run_post_install_validate(root_dir=Path(_PROJECT_ROOT))
+    except Exception as exc:
+        validation_result = {
+            "schema": "ValidateResult",
+            "status": "fail",
+            "checks": [
+                {
+                    "name": "validation_error",
+                    "status": "blocker",
+                    "message": str(exc),
+                    "required": True,
+                },
+            ],
+            "version": "",
+        }
+
+    # Persist machine-readable validation artifact
+    artifact_dir = os.path.join(project_dir, ".omg", "state")
+    os.makedirs(artifact_dir, exist_ok=True)
+    artifact_path = os.path.join(artifact_dir, "post-install-validation.json")
+    try:
+        with open(artifact_path, "w", encoding="utf-8") as f:
+            json.dump(validation_result, f, indent=2, ensure_ascii=True)
+            f.write("\n")
+    except OSError:
+        artifact_path = ""
+
+    blockers = [
+        c for c in validation_result.get("checks", [])
+        if c.get("status") == "blocker"
+    ]
+
+    result["post_install_validation"] = {
+        "status": validation_result.get("status", "fail"),
+        "artifact_path": artifact_path,
+        "blockers": [{"name": c["name"], "message": c["message"]} for c in blockers],
+    }
+
+    if blockers:
+        result["status"] = "validation_failed"
+
+    return result

package/build/lib/hooks/shadow_manager.py

@@ -146,7 +146,13 @@ def map_shadow_path(project_dir: str, run_id: str, file_path: str) -> str:
     return os.path.join(_shadow_root(project_dir), run_id, "overlay", rel)
 
 
-def record_shadow_write(project_dir: str, run_id: str, file_path: str, source: str = "tool") -> dict[str, Any]:
+def record_shadow_write(
+    project_dir: str,
+    run_id: str,
+    file_path: str,
+    source: str = "tool",
+    step_id: str | None = None,
+) -> dict[str, Any]:
     run_id = _validated_run_id(run_id)
     run_dir = os.path.join(_shadow_root(project_dir), run_id)
     os.makedirs(run_dir, exist_ok=True)
@@ -155,7 +161,8 @@ def record_shadow_write(project_dir: str, run_id: str, file_path: str, source: s
     os.makedirs(os.path.dirname(shadow_path), exist_ok=True)
 
     abs_file = file_path if os.path.isabs(file_path) else os.path.join(project_dir, file_path)
-    if os.path.exists(abs_file):
+    file_existed_before = os.path.exists(abs_file)
+    if file_existed_before:
         shutil.copy2(abs_file, shadow_path)
         file_hash = _hash_file(abs_file)
     else:
@@ -169,7 +176,10 @@ def record_shadow_write(project_dir: str, run_id: str, file_path: str, source: s
         "recorded_at": _utc_now(),
         "source": source,
         "sha256": file_hash,
+        "file_existed_before": file_existed_before,
     }
+    if step_id:
+        entry["step_id"] = step_id
 
     files = manifest.get("files", [])
     # Replace existing entry for same file.
@@ -181,6 +191,72 @@ def record_shadow_write(project_dir: str, run_id: str, file_path: str, source: s
     return entry
 
 
+def restore_shadow_entry(project_dir: str, run_id: str, step_id: str) -> dict[str, Any]:
+    run_id = _validated_run_id(run_id)
+    run_dir = os.path.join(_shadow_root(project_dir), run_id)
+    manifest = _load_manifest(run_dir)
+    entries = manifest.get("files", [])
+
+    restored: list[str] = []
+    failed: list[dict[str, str]] = []
+
+    selected_entries: list[dict[str, Any]] = []
+    for item in entries:
+        if not isinstance(item, dict):
+            continue
+        item_step_id = str(item.get("step_id", "")).strip()
+        if item_step_id == step_id:
+            selected_entries.append(item)
+
+    if not selected_entries and isinstance(entries, list) and len(entries) == 1:
+        single = entries[0]
+        if isinstance(single, dict):
+            selected_entries = [single]
+
+    if not selected_entries:
+        return {"restored": restored, "failed": failed, "reason": "step not found"}
+
+    for item in selected_entries:
+        rel = str(item.get("file", "")).strip()
+        shadow_rel = str(item.get("shadow_file", "")).strip()
+        file_existed_before = bool(item.get("file_existed_before", True))
+        if not rel:
+            failed.append({"file": "", "reason": "missing file path"})
+            continue
+
+        dst = os.path.join(project_dir, rel)
+        src = os.path.join(run_dir, shadow_rel) if shadow_rel else ""
+
+        if src and os.path.exists(src):
+            try:
+                os.makedirs(os.path.dirname(dst), exist_ok=True)
+                shutil.copy2(src, dst)
+                restored.append(rel)
+            except Exception as exc:
+                failed.append({"file": rel, "reason": f"copy failed: {exc}"})
+            continue
+
+        if not file_existed_before:
+            try:
+                if os.path.exists(dst):
+                    os.remove(dst)
+                restored.append(rel)
+            except Exception as exc:
+                failed.append({"file": rel, "reason": f"delete failed: {exc}"})
+            continue
+
+        failed.append({"file": rel, "reason": "shadow snapshot missing"})
+
+    manifest["status"] = "restored"
+    manifest["restored_at"] = _utc_now()
+    _save_manifest(run_dir, manifest)
+
+    reason = "shadow restore applied" if restored and not failed else "shadow restore partial"
+    if not restored and failed:
+        reason = "shadow restore failed"
+    return {"restored": restored, "failed": failed, "reason": reason}
+
+
 def create_evidence_pack(
     project_dir: str,
     run_id: str,
@@ -321,6 +397,34 @@ def drop_shadow(project_dir: str, run_id: str) -> dict[str, Any]:
     return {"run_id": run_id, "dropped": True}
 
 
+def auto_journal_mutation(
+    project_dir: str,
+    tool: str,
+    file_path: str,
+    run_id: str,
+) -> dict[str, Any] | None:
+    try:
+        from runtime.interaction_journal import InteractionJournal
+        from runtime.release_run_coordinator import resolve_current_run_id
+    except ImportError:
+        return None
+
+    canonical_run_id = resolve_current_run_id(project_dir) or run_id
+    shadow_manifest = os.path.join(
+        _shadow_root(project_dir), run_id, "manifest.json"
+    )
+
+    journal = InteractionJournal(project_dir)
+    return journal.record_step(
+        tool.lower(),
+        {
+            "file_path": file_path,
+            "run_id": canonical_run_id,
+            "shadow_manifest": shadow_manifest,
+        },
+    )
+
+
 def _handle_post_tool_use(payload: dict[str, Any]) -> None:
     tool = payload.get("tool_name", "")
     if tool not in ("Write", "Edit", "MultiEdit"):
@@ -343,6 +447,11 @@ def _handle_post_tool_use(payload: dict[str, Any]) -> None:
     run_id = begin_shadow_run(project_dir, metadata={"source": "post-tool-use"})
     record_shadow_write(project_dir, run_id, file_path)
 
+    try:
+        auto_journal_mutation(project_dir, tool, file_path, run_id)
+    except Exception:
+        pass
+
 
 def _main() -> int:
     # Early-exit: skip all work if shadow/evidence mode is not enabled

package/build/lib/hooks/stop_dispatcher.py

@@ -9,10 +9,12 @@ import subprocess
 import sys
 import time
 from datetime import datetime, timedelta, timezone
+import warnings
 
 sys.path.insert(0, os.path.dirname(__file__))
+sys.path.insert(0, os.path.dirname(os.path.dirname(__file__)))
 
-from _common import (  # noqa: E402
+from hooks._common import (  # noqa: E402
     atomic_json_write,
     block_decision,
     check_performance_budget,
@@ -27,7 +29,10 @@ from _common import (  # noqa: E402
     should_skip_stop_hooks,
     STOP_CHECK_MAX_MS,
 )
-from state_migration import resolve_state_file  # noqa: E402
+from hooks.state_migration import resolve_state_file  # noqa: E402
+
+from runtime.release_run_coordinator import resolve_current_run_id  # noqa: E402
+from runtime import test_intent_lock  # noqa: E402
 
 
 setup_crash_handler("stop_dispatcher")
@@ -132,7 +137,7 @@ def _is_internal_control_path(file_path: str) -> bool:
 
 
 try:
-    from shadow_manager import has_recent_evidence  # type: ignore
+    from hooks.shadow_manager import has_recent_evidence  # type: ignore
 except Exception:  # intentional: optional feature — shadow_manager may not exist
     has_recent_evidence = None
 
@@ -621,6 +626,104 @@ def check_bare_done(data, project_dir):
 
     return []
 
+
+def _proof_chain_strict_enabled() -> bool:
+    return os.environ.get("OMG_PROOF_CHAIN_STRICT", "0").strip() == "1"
+
+
+def _load_test_delta_from_evidence(project_dir: str, run_id: str | None) -> dict[str, object]:
+    evidence_dir = os.path.join(project_dir, ".omg", "evidence")
+    if not os.path.isdir(evidence_dir):
+        return {}
+
+    candidates = sorted(
+        [
+            os.path.join(evidence_dir, name)
+            for name in os.listdir(evidence_dir)
+            if name.endswith(".json")
+        ],
+        key=os.path.getmtime,
+        reverse=True,
+    )
+    for path in candidates:
+        try:
+            with open(path, "r", encoding="utf-8", errors="ignore") as handle:
+                payload = json.load(handle)
+        except (OSError, json.JSONDecodeError):
+            continue
+        if not isinstance(payload, dict):
+            continue
+        if payload.get("schema") != "EvidencePack":
+            continue
+        payload_run_id = str(payload.get("run_id", "")).strip()
+        if run_id and payload_run_id and payload_run_id != run_id:
+            continue
+        test_delta = payload.get("test_delta")
+        if isinstance(test_delta, dict):
+            return test_delta
+    return {}
+
+
+def _has_waiver_artifact(delta_summary: dict[str, object]) -> bool:
+    waiver = delta_summary.get("waiver_artifact")
+    if isinstance(waiver, dict):
+        for field in ("artifact_path", "path", "id", "reason"):
+            if str(waiver.get(field, "")).strip():
+                return True
+    return False
+
+
+def _has_weakened_or_drift(delta_summary: dict[str, object]) -> bool:
+    flags = delta_summary.get("flags")
+    if not isinstance(flags, list):
+        return False
+    risk_flags = {
+        "weakened_assertions",
+        "tests_mismatch",
+        "selector_drift",
+        "removed_touched_area_coverage",
+        "integration_to_mock_downgrade",
+        "snapshot_only_refresh",
+    }
+    normalized = {str(item).strip().lower() for item in flags if str(item).strip()}
+    return bool(normalized & risk_flags)
+
+
+def check_tdd_proof_chain(data, project_dir):
+    if not get_feature_flag("tdd_proof_chain", True):
+        return []
+
+    context = data["_stop_ctx"]
+    if not context.get("has_source_writes", False):
+        return []
+
+    run_id = resolve_current_run_id(project_dir=project_dir)
+    lock_verdict = test_intent_lock.verify_lock(project_dir, run_id=run_id)
+    delta_summary = data.get("_test_delta") if isinstance(data.get("_test_delta"), dict) else {}
+    if not delta_summary:
+        delta_summary = _load_test_delta_from_evidence(project_dir, run_id)
+
+    lock_missing = str(lock_verdict.get("status", "")).strip() != "ok"
+    weakened_without_waiver = _has_weakened_or_drift(delta_summary) and not _has_waiver_artifact(delta_summary)
+    if not lock_missing and not weakened_without_waiver:
+        return []
+
+    strict_mode = _proof_chain_strict_enabled()
+    if strict_mode:
+        return [json.dumps({"status": "blocked", "reason": "tdd_proof_chain_incomplete"}, sort_keys=True)]
+
+    warnings.warn(
+        "tdd_proof_chain_incomplete_permissive",
+        RuntimeWarning,
+        stacklevel=2,
+    )
+    advisories = data.setdefault("_stop_advisories", [])
+    advisories.append(
+        "[OMG advisory] tdd proof chain incomplete: active lock evidence or waiver artifact is missing. "
+        "Set OMG_PROOF_CHAIN_STRICT=1 to hard-block completion."
+    )
+    return []
+
 def check_simplifier(data, project_dir):
     """CHECK 7: Code simplifier — advisory only, never blocks."""
     if not get_feature_flag("simplifier", True):
@@ -832,7 +935,7 @@ def check_scope_drift(project_dir):
 
 
 
-def check_todo_continuation(data: dict) -> dict | None:
+def check_todo_continuation(data: dict[str, object]) -> dict[str, str] | None:
     """Check if agent should continue due to incomplete todos.
     Returns a dict with continuation response if idle, None otherwise.
     Budget: STOP_CHECK_MAX_MS (15s)
@@ -911,6 +1014,7 @@ def main():
         check_diff_budget,
         check_recent_failures,
         check_test_execution,
+        check_tdd_proof_chain,
         check_test_validator_coverage,
         check_false_fix,
         check_write_failures,