@trac3er/oh-my-god 2.1.4 → 2.1.7

package/build/lib/runtime/forge_contracts.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import hashlib
 import json
 import os
 from collections.abc import Mapping
@@ -9,6 +10,8 @@ from time import monotonic
 from typing import cast
 
 from lab.policies import validate_job_request
+from runtime.domain_packs import DOMAIN_PACKS, get_domain_pack_contract
+from runtime.forge_domains import canonical_domain_for, get_all_canonical_domains, is_valid_domain
 from runtime.runtime_contracts import read_defense_state, read_session_health
 
 FORGE_STAGE_ORDER: tuple[str, ...] = (
@@ -101,6 +104,7 @@ def load_forge_mvp() -> dict[str, object]:
             },
         },
         "adapter_registry": dict(ADAPTER_REGISTRY),
+        "canonical_domains": get_all_canonical_domains(),
         "evidence_output_path": ".omg/evidence/forge-<run_id>.json",
         "starter_templates": {
             "vision-agent": {
@@ -143,6 +147,14 @@ def load_forge_mvp() -> dict[str, object]:
 
 
 def validate_forge_job(job: dict[str, object]) -> tuple[bool, str]:
+    domain = job.get("domain")
+    if not domain or not str(domain).strip():
+        return False, "domain missing: forge run requires an explicit canonical domain (e.g. 'vision', 'robotics')"
+    if not is_valid_domain(str(domain)):
+        valid = sorted(get_all_canonical_domains())
+        return False, f"unknown domain: {domain!r}. Valid domains: {valid}"
+    job["domain"] = canonical_domain_for(str(domain))
+
     ok, reason = validate_job_request(job)
     if not ok:
         return False, reason
@@ -264,6 +276,9 @@ def build_forge_evidence(
                 if isinstance(item, Mapping)
             ]
 
+    job_dict = dict(job)
+    context_checksum = hashlib.sha256(json.dumps(job_dict, sort_keys=True).encode()).hexdigest()
+    domain_pack = get_domain_pack_contract(domain) if domain in DOMAIN_PACKS else {}
     payload = {
         "schema": "ForgeMVPEvidence",
         "schema_version": "1.0.0",
@@ -286,8 +301,55 @@ def build_forge_evidence(
             "delta_summary": {"forge_run": run_id, "domain": domain, "specialist": specialist_str},
             "verification_status": str(result.get("status", "unknown")),
         },
+        "context_checksum": context_checksum,
+        "profile_version": "forge-run-v1",
+        "intent_gate_version": "1.0.0",
+        "domain_pack": domain_pack,
+        "artifact_contracts": {
+            "dataset_lineage": {
+                "standard": "Croissant-1.1",
+                "path": f".omg/evidence/forge-lineage-{run_id}.json",
+                "status": "placeholder",
+                "reason": "dataset lineage artifact not yet generated",
+            },
+            "model_card": {
+                "standard": "HuggingFace-ModelCard",
+                "path": f".omg/evidence/forge-model-card-{run_id}.md",
+                "status": "placeholder",
+                "reason": "model card artifact not yet generated",
+            },
+            "checkpoint_hash": {
+                "standard": "OpenSSF-OMS",
+                "path": f".omg/evidence/forge-checkpoint-{run_id}.json",
+                "status": "placeholder",
+                "reason": "checkpoint hash artifact not yet generated",
+            },
+            "regression_scoreboard": {
+                "standard": "lm-eval",
+                "path": f".omg/evidence/forge-scoreboard-{run_id}.json",
+                "status": "placeholder",
+                "reason": "regression scoreboard artifact not yet generated",
+            },
+            "promotion_decision": {
+                "status": "pending",
+                "reason": "promotion requires passing regression scoreboard and human review for health domain",
+                "replay_required": True,
+            },
+        },
     }
 
+    if domain == "cybersecurity":
+        evidence_dir = out_path.parent
+        security_links: list[str] = []
+        for pattern in ("security-*.json", "security-*.sarif"):
+            security_links.extend(
+                f".omg/evidence/{p.name}" for p in sorted(evidence_dir.glob(pattern))
+            )
+        payload["security_evidence_links"] = security_links if security_links else [
+            ".omg/evidence/security-*.json",
+            ".omg/evidence/security-*.sarif",
+        ]
+
     tmp_path = out_path.with_name(f"{out_path.name}.tmp")
     _ = tmp_path.write_text(json.dumps(payload, indent=2, ensure_ascii=True), encoding="utf-8")
     _ = os.rename(tmp_path, out_path)

package/build/lib/runtime/forge_domains.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from typing import Any
+
+
+CANONICAL_DOMAINS: dict[str, dict[str, Any]] = {
+    "vision": {
+        "canonical_id": "vision",
+        "aliases": ["vision-agent"],
+        "display_label": "Vision Agent",
+        "starter_template_id": "vision-agent",
+    },
+    "robotics": {
+        "canonical_id": "robotics",
+        "aliases": [],
+        "display_label": "Robotics",
+        "starter_template_id": "robotics",
+    },
+    "algorithms": {
+        "canonical_id": "algorithms",
+        "aliases": [],
+        "display_label": "Algorithms",
+        "starter_template_id": "algorithms",
+    },
+    "health": {
+        "canonical_id": "health",
+        "aliases": [],
+        "display_label": "Health",
+        "starter_template_id": "health",
+    },
+    "cybersecurity": {
+        "canonical_id": "cybersecurity",
+        "aliases": [],
+        "display_label": "Cybersecurity",
+        "starter_template_id": "cybersecurity",
+    },
+}
+
+# Build reverse alias map: alias -> canonical_id
+_ALIAS_MAP: dict[str, str] = {}
+for _canonical_id, _entry in CANONICAL_DOMAINS.items():
+    _ALIAS_MAP[_canonical_id] = _canonical_id
+    for _alias in _entry["aliases"]:
+        _ALIAS_MAP[_alias] = _canonical_id
+
+
+def canonical_domain_for(name: str) -> str:
+    """Resolve a domain name or alias to its canonical domain ID.
+
+    Raises ValueError for unknown domains.
+    """
+    normalized = str(name or "").strip().lower()
+    if normalized not in _ALIAS_MAP:
+        raise ValueError(
+            f"Unknown domain: {name!r}. Valid domains: {sorted(CANONICAL_DOMAINS.keys())}"
+        )
+    return _ALIAS_MAP[normalized]
+
+
+def is_valid_domain(name: str) -> bool:
+    """Return True if name is a canonical domain ID or a known alias."""
+    normalized = str(name or "").strip().lower()
+    return normalized in _ALIAS_MAP
+
+
+def get_all_canonical_domains() -> list[str]:
+    """Return list of all canonical domain IDs."""
+    return list(CANONICAL_DOMAINS.keys())

package/build/lib/runtime/forge_run_id.py

@@ -0,0 +1,59 @@
+"""Canonical run identity generation and validation for Forge."""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+
+def generate_run_id() -> str:
+    """Generate a compact UTC timestamp-based run ID.
+    
+    Format: YYYYMMDDTHHMMSSfffffZ (e.g., 20260309T143022123456Z)
+    
+    Returns:
+        str: Compact UTC format run ID.
+    """
+    return datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%S%fZ")
+
+
+def validate_run_id(run_id: str) -> tuple[bool, str]:
+    """Validate run ID format and constraints.
+    
+    Valid run IDs:
+    - Non-empty
+    - Alphanumeric + hyphens only (no spaces, special chars)
+    - Max 128 characters
+    
+    Args:
+        run_id: The run ID to validate.
+        
+    Returns:
+        tuple[bool, str]: (is_valid, reason). If valid, reason is empty string.
+    """
+    if not run_id:
+        return False, "run_id must be non-empty"
+    
+    if len(run_id) > 128:
+        return False, f"run_id exceeds 128 characters: {len(run_id)}"
+    
+    # Allow alphanumeric and hyphens only
+    if not all(c.isalnum() or c == "-" for c in run_id):
+        return False, "run_id must contain only alphanumeric characters and hyphens"
+    
+    return True, ""
+
+
+def normalize_run_id(run_id: str | None) -> str:
+    """Normalize run ID: use provided if valid, else generate new one.
+    
+    Args:
+        run_id: Optional run ID. If None or invalid, a new one is generated.
+        
+    Returns:
+        str: Valid run ID (either the provided one or a newly generated one).
+    """
+    if run_id:
+        is_valid, _ = validate_run_id(run_id)
+        if is_valid:
+            return run_id
+    
+    return generate_run_id()

package/build/lib/runtime/hook_governor.py

@@ -14,6 +14,7 @@ except Exception:  # pragma: no cover - json fallback path
 
 
 DEFAULT_BUNDLE_PATH = Path("registry") / "bundles" / "hook-governor.yaml"
+_MODULE_DIR = Path(__file__).resolve().parent.parent  # project root (runtime/ → project root)
 SECURITY_REQUIRED_BY_EVENT: dict[str, tuple[str, ...]] = {
     "PreToolUse": ("firewall", "secret-guard"),
 }
@@ -49,6 +50,12 @@ def _load_compiled_hooks(
 ) -> tuple[dict[str, list[str]], str | None]:
     root = _resolve_project_dir(project_dir)
     candidate = Path(bundle_path) if bundle_path else (root / DEFAULT_BUNDLE_PATH)
+    if not bundle_path and not candidate.exists():
+        # Fallback: resolve relative to this module's installed location (robust to cwd changes
+        # and CLAUDE_PROJECT_DIR pointing to temp dirs in parallel test runs).
+        module_relative = _MODULE_DIR / DEFAULT_BUNDLE_PATH
+        if module_relative.exists():
+            candidate = module_relative
     try:
         raw = candidate.read_text(encoding="utf-8")
     except FileNotFoundError:
@@ -123,10 +130,21 @@ def validate_order(
     blockers: list[str] = []
     expected_positions = {name: idx for idx, name in enumerate(canonical)}
 
-    for required in SECURITY_REQUIRED_BY_EVENT.get(event, ()):
+    required_security_hooks = SECURITY_REQUIRED_BY_EVENT.get(event, ())
+    for required in required_security_hooks:
         if required not in hooks_list:
             blockers.append(f"missing required security hook: {required}")
 
+    if required_security_hooks:
+        for expected_index, required in enumerate(required_security_hooks):
+            if required not in hooks_list:
+                continue
+            actual_index = hooks_list.index(required)
+            if actual_index != expected_index:
+                blockers.append(
+                    f"hook order violation for {event}: {required} must run before non-security hooks"
+                )
+
     filtered_hooks = [hook for hook in hooks_list if hook in expected_positions]
     for left, right in zip(filtered_hooks, filtered_hooks[1:]):
         if expected_positions[left] > expected_positions[right]:

package/build/lib/runtime/omg_compat_contract_snapshot.json

@@ -1,6 +1,6 @@
 {
   "schema": "OmgCompatContractSnapshot",
-  "contract_version": "2.1.4",
+  "contract_version": "2.1.7",
   "count": 47,
   "contracts": [
     {
@@ -913,4 +913,4 @@
     }
   ],
   "generated_at": "2026-03-09T21:20:44.496932+00:00"
-}
+}

package/build/lib/runtime/plugin_diagnostics.py

@@ -0,0 +1,248 @@
+from __future__ import annotations
+
+import json
+import time
+from pathlib import Path
+from typing import Callable, cast
+
+from runtime import plugin_interop
+
+
+def _load_allowlist(root: str | None) -> list[plugin_interop.PluginAllowlistEntry]:
+    load_fn = cast(
+        Callable[[str | None], list[plugin_interop.PluginAllowlistEntry]] | None,
+        getattr(plugin_interop, "load_plugin_allowlist", None),
+    )
+    if callable(load_fn):
+        return load_fn(root)
+    return []
+
+
+_LIVE_BUDGET_MS: float = 3000.0
+
+
+def _resolve_mcp_command(server_name: str, root: str | None) -> list[str] | None:
+    root_path = Path(root or ".").resolve()
+    for mcp_path in (
+        root_path / ".claude-plugin" / "mcp.json",
+        root_path / ".mcp.json",
+    ):
+        try:
+            raw = mcp_path.read_text(encoding="utf-8")
+        except OSError:
+            continue
+        try:
+            payload = json.loads(raw)
+        except (json.JSONDecodeError, ValueError):
+            continue
+        if not isinstance(payload, dict):
+            continue
+        servers = payload.get("mcpServers", {})
+        if not isinstance(servers, dict):
+            continue
+        entry = servers.get(server_name)
+        if not isinstance(entry, dict):
+            continue
+        cmd = entry.get("command")
+        args = entry.get("args", [])
+        if isinstance(cmd, str):
+            cmd_list = [cmd]
+            if isinstance(args, list):
+                cmd_list.extend(str(a) for a in args)
+            return cmd_list
+    return None
+
+
+def _probe_mcp_servers_live(
+    records: list[plugin_interop.PluginInteropRecord],
+    root: str | None,
+) -> list[dict[str, object]]:
+    budget_start = time.monotonic()
+    results: list[dict[str, object]] = []
+    seen: set[str] = set()
+
+    for record in records:
+        for server_name in record.mcp_servers:
+            if server_name in seen:
+                continue
+            seen.add(server_name)
+
+            elapsed_total_ms = (time.monotonic() - budget_start) * 1000.0
+            if elapsed_total_ms >= _LIVE_BUDGET_MS:
+                results.append({
+                    "server": server_name,
+                    "status": "skipped",
+                    "elapsed_ms": 0.0,
+                })
+                continue
+
+            command = _resolve_mcp_command(server_name, root)
+            if command is None:
+                results.append({
+                    "server": server_name,
+                    "status": "skipped",
+                    "elapsed_ms": 0.0,
+                })
+                continue
+
+            remaining_ms = _LIVE_BUDGET_MS - elapsed_total_ms
+            probe_timeout = min(1500, int(remaining_ms))
+            results.append(
+                plugin_interop.probe_mcp_server_live(
+                    server_name, command, timeout_ms=probe_timeout,
+                )
+            )
+
+    return results
+
+
+def _record_sort_key(record: plugin_interop.PluginInteropRecord) -> tuple[str, str, str, str]:
+    return (record.host, record.plugin_id, record.layer, record.source)
+
+
+def run_plugin_diagnostics(root: str | None = None, live: bool = False) -> dict[str, object]:
+    started = time.monotonic()
+
+    omg_payload = plugin_interop.discover_omg_plugin_state(root)
+    host_payload = plugin_interop.discover_host_plugin_state(root)
+
+    all_records = [*omg_payload.records, *host_payload.records]
+    ordered_records = sorted(all_records, key=_record_sort_key)
+    conflicts = plugin_interop.classify_conflicts(ordered_records)
+    approvals = _load_allowlist(root)
+    approval_states = plugin_interop.get_approval_status_for_all(ordered_records, approvals)
+
+    blocker_count = sum(1 for conflict in conflicts if conflict.severity == "blocker")
+    warning_count = sum(1 for conflict in conflicts if conflict.severity == "warning")
+    info_count = sum(1 for conflict in conflicts if conflict.severity == "info")
+
+    if blocker_count > 0:
+        status = "error"
+    elif warning_count > 0:
+        status = "warn"
+    else:
+        status = "ok"
+
+    next_actions: list[str] = []
+    for conflict in conflicts:
+        action = conflict.next_action
+        if action and action not in next_actions:
+            next_actions.append(action)
+        if len(next_actions) >= 3:
+            break
+
+    result: dict[str, object] = {
+        "schema": "PluginDiagnosticsResult",
+        "status": status,
+        "records": [record.to_dict() for record in ordered_records],
+        "conflicts": [
+            {
+                "code": conflict.code,
+                "severity": conflict.severity,
+                "affected_plugin_ids": list(conflict.affected_plugin_ids),
+                "affected_hosts": list(conflict.affected_hosts),
+                "detail": conflict.detail,
+                "next_action": conflict.next_action,
+            }
+            for conflict in conflicts
+        ],
+        "approval_states": dict(sorted(approval_states.items())),
+        "summary": {
+            "total_records": len(ordered_records),
+            "total_conflicts": len(conflicts),
+            "blockers": blocker_count,
+            "warnings": warning_count,
+            "infos": info_count,
+        },
+        "next_actions": next_actions,
+        "elapsed_ms": (time.monotonic() - started) * 1000.0,
+    }
+
+    if live:
+        result["live_probe_results"] = _probe_mcp_servers_live(ordered_records, root)
+
+    return result
+
+
+def _infer_resource_type(source: str) -> str:
+    if source.startswith("mcp:"):
+        return "mcp_server"
+    if source.startswith("skill:"):
+        return "skill"
+    if source.startswith("plugin:"):
+        return "plugin"
+    raise ValueError("source must start with one of: mcp:, skill:, plugin:")
+
+
+def _record_sources(record: dict[str, object]) -> set[str]:
+    discovered: set[str] = set()
+    for server in cast(list[object], record.get("mcp_servers", [])):
+        if isinstance(server, str):
+            discovered.add(f"mcp:{server}")
+
+    plugin_id = record.get("plugin_id")
+    source = record.get("source")
+    if isinstance(plugin_id, str):
+        if source == plugin_interop.Source.SKILL_REGISTRY.value:
+            discovered.add(f"skill:{plugin_id}")
+        else:
+            discovered.add(f"plugin:{plugin_id}")
+    return discovered
+
+
+def approve_plugin(source: str, host: str, reason: str, root: str | None = None) -> dict[str, object]:
+    diagnostics = run_plugin_diagnostics(root)
+    records = diagnostics.get("records", [])
+    approval_states = diagnostics.get("approval_states", {})
+
+    matching_discovered = False
+    if isinstance(records, list):
+        for record in cast(list[object], records):
+            if not isinstance(record, dict):
+                continue
+            record_host = cast(str | None, record.get("host"))
+            if record_host != host:
+                continue
+            if source in _record_sources(cast(dict[str, object], record)):
+                matching_discovered = True
+                break
+
+    if not matching_discovered and isinstance(approval_states, dict):
+        for plugin_id, _status in cast(dict[object, object], approval_states).items():
+            if not isinstance(plugin_id, str):
+                continue
+            if source in {f"plugin:{plugin_id}", f"skill:{plugin_id}"}:
+                matching_discovered = True
+                break
+
+    if not matching_discovered:
+        return {
+            "schema": "ApprovalResult",
+            "status": "error",
+            "message": (
+                f"No discovered resource matching source={source!r} and host={host!r}. "
+                "Run diagnose-plugins first."
+            ),
+        }
+
+    entry = plugin_interop.PluginAllowlistEntry(
+        source=source,
+        host=host,
+        resource_type=_infer_resource_type(source),
+        reason=reason,
+    )
+    plugin_interop.validate_plugin_allowlist_entry(entry.to_dict())
+    entries = plugin_interop.load_plugin_allowlist(root)
+
+    exists = any(existing.source == source and existing.host == host for existing in entries)
+    if not exists:
+        entries.append(entry)
+
+    _ = plugin_interop.save_plugin_allowlist(entries, root)
+    return {
+        "schema": "ApprovalResult",
+        "status": "ok",
+        "source": source,
+        "host": host,
+        "message": "Approved and saved to .omg/state/plugins-allowlist.yaml",
+    }