@trac3er/oh-my-god 2.1.4 → 2.1.7

package/lab/pipeline.py

@@ -1,4 +1,3 @@
-# pyright: reportExplicitAny=false, reportAny=false, reportUnknownMemberType=false
 """OMG full AI pipeline stub: data -> refine -> train/distill -> evaluate -> regression."""
 from __future__ import annotations
 
@@ -7,6 +6,8 @@ from pathlib import Path
 from time import monotonic
 from typing import Any
 
+from registry.verify_artifact import sign_artifact_statement
+
 from .policies import validate_job_request
 
 PIPELINE_STAGE_ORDER: tuple[str, ...] = (
@@ -35,10 +36,10 @@ def run_pipeline(
     project_dir: str | None = None,
 ) -> dict[str, Any]:
     from runtime.forge_contracts import build_stage_evidence, read_stage_runtime_snapshots, resolve_stage_timeout_ms
-
+    from runtime.forge_run_id import normalize_run_id
     from runtime.forge_agents import check_required_backends_satisfied, resolve_adapters
 
-    active_run_id = str(run_id or _now())
+    active_run_id = normalize_run_id(run_id)
     ok, reason = validate_job_request(job)
     if not ok:
         return {
@@ -71,7 +72,7 @@ def run_pipeline(
         adapter_by_kind.setdefault(kind, []).append(ev)
 
     target_metric = float(job.get("target_metric", 0.8))
-    simulated_metric = float(job.get("simulated_metric", target_metric))
+    live_metric = _resolve_live_metric(adapter_evidence)
     failed_stages = _normalize_stage_set(job.get("stage_failures"))
     explicit_failed_stage = str(job.get("fail_stage", "")).strip().lower()
     if explicit_failed_stage:
@@ -94,11 +95,11 @@ def run_pipeline(
             stage_status = "timeout"
         elif stage in failed_stages:
             stage_status = "failed"
-        elif stage in {"evaluate", "regression_test"} and simulated_metric < target_metric:
-            stage_status = "failed"
 
         stage_adapter_kind = _STAGE_ADAPTER_KIND.get(stage)
         stage_adapter_ev = adapter_by_kind.get(stage_adapter_kind, []) if stage_adapter_kind else []
+        if stage_status == "success" and stage_adapter_kind and _stage_adapter_failed(stage_adapter_ev):
+            stage_status = "failed"
 
         defense_snapshot: dict[str, object] = {}
         session_health_snapshot: dict[str, object] = {}
@@ -125,33 +126,31 @@ def run_pipeline(
                 "reason": f"stage timeout envelope exceeded for {stage}",
                 "stages": stages,
                 "published": False,
-                "evaluation_report": _evaluation_report(job, simulated_metric, target_metric),
+                "evaluation_report": _evaluation_report(job, live_metric, target_metric),
                 "run_id": active_run_id,
                 "stage_evidence": stage_evidence,
             }
         if stage_status == "failed":
-            if stage in {"evaluate", "regression_test"} and simulated_metric < target_metric:
-                return {
-                    "status": "failed_evaluation",
-                    "stage": "evaluate",
-                    "stages": stages,
-                    "published": False,
-                    "evaluation_report": _evaluation_report(job, simulated_metric, target_metric),
-                    "run_id": active_run_id,
-                    "stage_evidence": stage_evidence,
-                }
             return {
                 "status": "failed_stage",
                 "stage": stage,
                 "reason": f"stage execution failed for {stage}",
                 "stages": stages,
                 "published": False,
-                "evaluation_report": _evaluation_report(job, simulated_metric, target_metric),
+                "evaluation_report": _evaluation_report(job, live_metric, target_metric),
                 "run_id": active_run_id,
                 "stage_evidence": stage_evidence,
             }
 
-    report = _evaluation_report(job, simulated_metric, target_metric)
+    report = _evaluation_report(job, live_metric, target_metric)
+    promotion_blockers = _collect_promotion_blockers(job, stage_evidence, adapter_evidence, live_metric)
+    artifact_contracts = _build_artifact_contracts(
+        run_id=active_run_id,
+        target_metric=target_metric,
+        live_metric=live_metric,
+        adapter_evidence=adapter_evidence,
+        promotion_blockers=promotion_blockers,
+    )
 
     result: dict[str, Any] = {
         "status": "ready",
@@ -161,13 +160,44 @@ def run_pipeline(
         "evaluation_report": report,
         "run_id": active_run_id,
         "stage_evidence": stage_evidence,
+        "artifact_contracts": artifact_contracts,
+        "promotion_blockers": promotion_blockers,
+        "promotion_ready": len(promotion_blockers) == 0,
+        "release_evidence": _normalize_release_evidence(job),
     }
     if adapter_evidence:
         result["adapter_evidence"] = adapter_evidence
     return result
 
 
+def _extract_artifact_payload(result: dict[str, Any]) -> dict[str, Any] | None:
+    contracts = result.get("artifact_contracts")
+    if not isinstance(contracts, dict):
+        return None
+    checkpoint = contracts.get("checkpoint_hash")
+    if not isinstance(checkpoint, dict) or str(checkpoint.get("status", "")).strip().lower() != "signed":
+        return None
+    attestation = checkpoint.get("attestation")
+    if not isinstance(attestation, dict):
+        return None
+    sha256 = str(checkpoint.get("sha256", "")).strip()
+    path = str(checkpoint.get("path", "")).strip()
+    signer_key_id = str(checkpoint.get("signer_key_id", "")).strip()
+    return {
+        "id": path,
+        "signer": signer_key_id or "forge-ephemeral",
+        "checksum": sha256,
+        "attestation": attestation,
+        "signer_pubkey": None,
+        "permissions": [],
+        "static_scan": [],
+        "risk_level": "low",
+    }
+
+
 def publish_artifact(result: dict[str, Any]) -> dict[str, Any]:
+    from runtime.compliance_governor import evaluate_release_compliance
+
     report = result.get("evaluation_report")
     if not isinstance(report, dict) or not report.get("passed"):
         return {
@@ -176,6 +206,43 @@ def publish_artifact(result: dict[str, Any]) -> dict[str, Any]:
             "published": False,
         }
 
+    blockers = _collect_publish_blockers(result)
+    if blockers:
+        return {
+            "status": "blocked",
+            "reason": blockers[0],
+            "published": False,
+            "blockers": blockers,
+        }
+
+    release_evidence = result.get("release_evidence")
+    release_evidence_payload = dict(release_evidence) if isinstance(release_evidence, dict) else {}
+
+    artifact_payload = _extract_artifact_payload(result)
+    if artifact_payload is not None:
+        release_evidence_payload["artifact"] = artifact_payload
+
+    claims = release_evidence_payload.get("claims")
+    if isinstance(claims, list) and claims and not isinstance(release_evidence_payload.get("artifact"), dict):
+        return {
+            "status": "blocked",
+            "reason": "promotion blocked: claims present but artifact evidence missing",
+            "published": False,
+        }
+
+    compliance = evaluate_release_compliance(
+        project_dir=str(result.get("project_dir", ".")),
+        run_id=str(result.get("run_id", "")),
+        release_evidence=release_evidence_payload,
+    )
+    if compliance.get("status") == "blocked":
+        reason = str(compliance.get("reason", "compliance blocked")).strip()
+        return {
+            "status": "blocked",
+            "reason": f"promotion blocked: {reason}",
+            "published": False,
+        }
+
     out = dict(result)
     out["status"] = "published"
     out["published"] = True
@@ -201,16 +268,214 @@ def run_pipeline_with_evidence(project_dir: str, job: dict[str, Any], run_id: st
     return out
 
 
-def _evaluation_report(job: dict[str, Any], simulated_metric: float, target_metric: float) -> dict[str, object]:
+def _evaluation_report(job: dict[str, Any], live_metric: float | None, target_metric: float) -> dict[str, object]:
+    metric = target_metric if live_metric is None else live_metric
     return {
         "created_at": _now(),
-        "metric": simulated_metric,
+        "metric": metric,
         "target_metric": target_metric,
-        "passed": simulated_metric >= target_metric,
+        "passed": metric >= target_metric,
         "notes": job.get("evaluation_notes", ""),
     }
 
 
+def _stage_adapter_failed(stage_adapter_ev: list[dict[str, object]]) -> bool:
+    if not stage_adapter_ev:
+        return False
+    for evidence in stage_adapter_ev:
+        status = str(evidence.get("status", "")).strip().lower()
+        if status in {"error", "blocked", "unavailable", "unavailable_backend"} and bool(evidence.get("required", False)):
+            return True
+    return False
+
+
+def _resolve_live_metric(adapter_evidence: list[dict[str, object]]) -> float | None:
+    metrics: list[float] = []
+    for evidence in adapter_evidence:
+        if str(evidence.get("kind", "")) != "simulator":
+            continue
+        episode_stats = evidence.get("episode_stats")
+        if not isinstance(episode_stats, dict):
+            continue
+        reward_obj = episode_stats.get("reward")
+        if isinstance(reward_obj, bool):
+            continue
+        if isinstance(reward_obj, (int, float)):
+            metrics.append(float(reward_obj))
+            continue
+        if isinstance(reward_obj, str):
+            try:
+                metrics.append(float(reward_obj))
+            except ValueError:
+                continue
+    if not metrics:
+        return None
+    return max(metrics)
+
+
+def _normalize_release_evidence(job: dict[str, Any]) -> dict[str, object]:
+    release_evidence = job.get("release_evidence")
+    if isinstance(release_evidence, dict):
+        return dict(release_evidence)
+    claims = job.get("claims")
+    if isinstance(claims, list):
+        return {"claims": list(claims)}
+    return {}
+
+
+def _collect_promotion_blockers(
+    job: dict[str, Any],
+    stage_evidence: list[dict[str, object]],
+    adapter_evidence: list[dict[str, object]],
+    live_metric: float | None,
+) -> list[str]:
+    blockers: list[str] = []
+    stage_by_name = {str(item.get("stage", "")): item for item in stage_evidence}
+    for required_stage in ("train_distill", "evaluate", "regression_test"):
+        stage_record = stage_by_name.get(required_stage)
+        if not isinstance(stage_record, dict) or str(stage_record.get("status", "")) != "success":
+            blockers.append("promotion blocked: missing concrete stage evidence")
+            break
+
+    has_checkpoint = False
+    for evidence in adapter_evidence:
+        if str(evidence.get("kind", "")) != "training":
+            continue
+        artifacts = evidence.get("checkpoint_artifacts")
+        if isinstance(artifacts, list) and artifacts:
+            has_checkpoint = True
+            break
+    if not has_checkpoint:
+        blockers.append("promotion blocked: missing attestation")
+
+    if live_metric is None:
+        blockers.append("promotion blocked: missing regression scoreboard")
+
+    if _requires_claims(job):
+        release_evidence = _normalize_release_evidence(job)
+        claims = release_evidence.get("claims")
+        if not isinstance(claims, list) or not claims:
+            blockers.append("promotion blocked: missing release claims")
+
+    return list(dict.fromkeys(blockers))
+
+
+def _requires_claims(job: dict[str, Any]) -> bool:
+    specialists = job.get("specialists")
+    if not isinstance(specialists, list):
+        return False
+    return "training-architect" in specialists or "simulator-engineer" in specialists
+
+
+def _build_artifact_contracts(
+    *,
+    run_id: str,
+    target_metric: float,
+    live_metric: float | None,
+    adapter_evidence: list[dict[str, object]],
+    promotion_blockers: list[str],
+) -> dict[str, object]:
+    checkpoint_contract = _build_checkpoint_contract(run_id=run_id, adapter_evidence=adapter_evidence)
+    regression_contract = _build_regression_contract(run_id=run_id, target_metric=target_metric, live_metric=live_metric)
+    promotion_status = "blocked" if promotion_blockers else "ready"
+    promotion_reason = ", ".join(promotion_blockers) if promotion_blockers else "promotion ready"
+    return {
+        "checkpoint_hash": checkpoint_contract,
+        "regression_scoreboard": regression_contract,
+        "promotion_decision": {
+            "status": promotion_status,
+            "decision_id": f"dec-{run_id}",
+            "reason": promotion_reason,
+            "replay_required": True,
+        },
+    }
+
+
+def _build_checkpoint_contract(*, run_id: str, adapter_evidence: list[dict[str, object]]) -> dict[str, object]:
+    for evidence in adapter_evidence:
+        if str(evidence.get("kind", "")) != "training":
+            continue
+        artifacts = evidence.get("checkpoint_artifacts")
+        if not isinstance(artifacts, list) or not artifacts:
+            continue
+        first = artifacts[0]
+        if not isinstance(first, dict):
+            continue
+        path = str(first.get("path", "")).strip() or f".omg/evidence/forge-checkpoint-{run_id}.json"
+        sha256 = str(first.get("sha256", "")).strip().lower()
+        if len(sha256) != 64:
+            continue
+        attestation = sign_artifact_statement(path, sha256)
+        signer_info = attestation.get("signer") if isinstance(attestation, dict) else None
+        signer_key_id = str(signer_info.get("keyid", "")) if isinstance(signer_info, dict) else ""
+        return {
+            "standard": "OpenSSF-OMS",
+            "path": path,
+            "status": "signed",
+            "sha256": sha256,
+            "algorithm": "ed25519-minisign",
+            "attestation": attestation,
+            "signer_key_id": signer_key_id,
+        }
+    return {
+        "standard": "OpenSSF-OMS",
+        "path": f".omg/evidence/forge-checkpoint-{run_id}.json",
+        "status": "blocked",
+        "reason": "promotion blocked: missing attestation",
+    }
+
+
+def _build_regression_contract(*, run_id: str, target_metric: float, live_metric: float | None) -> dict[str, object]:
+    if live_metric is None:
+        return {
+            "standard": "lm-eval",
+            "path": f".omg/evidence/forge-scoreboard-{run_id}.json",
+            "status": "blocked",
+            "reason": "promotion blocked: missing regression scoreboard",
+        }
+    status = "passed" if live_metric >= target_metric else "failed"
+    return {
+        "standard": "lm-eval",
+        "path": f".omg/evidence/forge-scoreboard-{run_id}.json",
+        "status": status,
+        "score": live_metric,
+        "target": target_metric,
+    }
+
+
+def _collect_publish_blockers(result: dict[str, Any]) -> list[str]:
+    blockers: list[str] = []
+    inherited_blockers = result.get("promotion_blockers")
+    if isinstance(inherited_blockers, list):
+        for token in inherited_blockers:
+            reason = str(token).strip()
+            if reason:
+                blockers.append(reason)
+
+    contracts = result.get("artifact_contracts")
+    contracts_map = contracts if isinstance(contracts, dict) else {}
+    checkpoint = contracts_map.get("checkpoint_hash")
+    if not isinstance(checkpoint, dict):
+        blockers.append("promotion blocked: missing attestation")
+    else:
+        checkpoint_status = str(checkpoint.get("status", "")).strip().lower()
+        attestation = checkpoint.get("attestation")
+        signer_key_id = str(checkpoint.get("signer_key_id", "")).strip()
+        if checkpoint_status != "signed" or not isinstance(attestation, dict) or not signer_key_id:
+            blockers.append("promotion blocked: missing attestation")
+
+    regression = contracts_map.get("regression_scoreboard")
+    if not isinstance(regression, dict) or str(regression.get("status", "")).strip().lower() != "passed":
+        blockers.append("promotion blocked: missing regression scoreboard")
+
+    release_evidence = result.get("release_evidence")
+    claims = release_evidence.get("claims") if isinstance(release_evidence, dict) else None
+    if not isinstance(claims, list) or not claims:
+        blockers.append("promotion blocked: missing release claims")
+
+    return list(dict.fromkeys(blockers))
+
+
 def _normalize_stage_set(value: object) -> set[str]:
     if not isinstance(value, list):
         return set()

package/lab/pybullet_adapter.py

@@ -0,0 +1,192 @@
+from __future__ import annotations
+
+import hashlib
+import importlib.util
+import json
+import random
+import uuid
+from pathlib import Path
+from time import monotonic
+from typing import Any
+
+ADAPTER_NAME = "pybullet"
+ADAPTER_KIND = "simulator"
+
+VALID_STATUSES = frozenset({"dry_run_contract", "skipped_unavailable_backend", "invoked", "error"})
+
+
+def _check_pybullet_available() -> bool:
+    return importlib.util.find_spec("pybullet") is not None
+
+
+def _compute_fingerprint(job: dict[str, Any]) -> str | None:
+    try:
+        return hashlib.sha256(json.dumps(job, sort_keys=True).encode()).hexdigest()[:16]
+    except (TypeError, ValueError):
+        return None
+
+
+def _validate_job(job: dict[str, Any]) -> tuple[bool, str]:
+    if not job:
+        return False, "invalid job: missing required fields"
+    if "domain" not in job:
+        return False, "invalid job: missing required field 'domain'"
+    return True, ""
+
+
+def _derive_seed(job: dict[str, Any], run_id: str) -> int:
+    explicit = job.get("seed")
+    if isinstance(explicit, int):
+        return explicit
+    material = json.dumps({"run_id": run_id, "job": _compute_fingerprint(job)}, sort_keys=True)
+    return int(hashlib.sha256(material.encode("utf-8")).hexdigest()[:8], 16)
+
+
+def _bounded_steps(job: dict[str, Any]) -> int:
+    raw = job.get("max_steps", 32)
+    try:
+        return max(1, min(int(raw), 256))
+    except (TypeError, ValueError):
+        return 32
+
+
+def _run_bounded_local_episode(*, job: dict[str, Any], seed: int, timeout_seconds: int) -> dict[str, Any]:
+    p = importlib.import_module("pybullet")
+
+    _ = max(1, timeout_seconds)
+    started = monotonic()
+    steps = _bounded_steps(job)
+    client = p.connect(p.DIRECT)
+    rng = random.Random(seed)
+    reward = 0.0
+    try:
+        p.setGravity(0.0, 0.0, -9.81, physicsClientId=client)
+        for _idx in range(steps):
+            p.stepSimulation(physicsClientId=client)
+            reward += rng.uniform(-0.05, 0.25)
+    finally:
+        p.disconnect(physicsClientId=client)
+    return {
+        "steps": steps,
+        "reward": round(reward, 6),
+        "duration_ms": int((monotonic() - started) * 1000),
+        "seed": seed,
+        "backend_version": getattr(p, "__version__", "unknown"),
+    }
+
+
+def run(
+    job: dict[str, Any],
+    *,
+    backend_mode: str = "preflight",
+    run_id: str | None = None,
+    timeout_seconds: int = 30,
+    sandbox_root: str = ".",
+) -> dict[str, Any]:
+    active_run_id = run_id or str(uuid.uuid4())
+
+    ok, validation_reason = _validate_job(job)
+    seed = _derive_seed(job, active_run_id)
+    available = _check_pybullet_available()
+    base_result: dict[str, Any] = {
+        "adapter": ADAPTER_NAME,
+        "kind": ADAPTER_KIND,
+        "backend": "pybullet",
+        "run_id": active_run_id,
+        "seed": seed,
+        "episode_stats": {
+            "steps": 0,
+            "reward": 0.0,
+            "duration_ms": 0,
+        },
+        "replay_metadata": {
+            "run_id": active_run_id,
+            "seed": seed,
+            "backend_version": "unavailable",
+        },
+    }
+
+    if not ok:
+        return {
+            **base_result,
+            "status": "error",
+            "available": False,
+            "reason": validation_reason,
+            "simulator_steps": None,
+            "replay_evidence": None,
+        }
+
+    if backend_mode == "preflight":
+        if available:
+            status = "dry_run_contract"
+            reason = "preflight mode: backend available but execution not requested"
+        else:
+            status = "skipped_unavailable_backend"
+            reason = "pybullet not installed"
+        return {
+            **base_result,
+            "status": status,
+            "available": available,
+            "reason": reason,
+            "simulator_steps": 0,
+            "replay_evidence": None,
+        }
+
+    if backend_mode == "live":
+        if not available:
+            return {
+                **base_result,
+                "status": "skipped_unavailable_backend",
+                "available": False,
+                "reason": "pybullet not installed",
+                "simulator_steps": 0,
+                "replay_evidence": None,
+            }
+
+        try:
+            sandbox_path = Path(sandbox_root)
+            sandbox_path.mkdir(parents=True, exist_ok=True)
+            episode = _run_bounded_local_episode(job=job, seed=seed, timeout_seconds=timeout_seconds)
+            replay_metadata = {
+                "run_id": active_run_id,
+                "seed": seed,
+                "backend_version": str(episode.get("backend_version", "unknown")),
+            }
+            episode_stats = {
+                "steps": int(episode.get("steps", 0)),
+                "reward": float(episode.get("reward", 0.0)),
+                "duration_ms": int(episode.get("duration_ms", 0)),
+            }
+            return {
+                **base_result,
+                "status": "invoked",
+                "available": True,
+                "reason": "live execution dispatched to pybullet backend",
+                "episode_stats": episode_stats,
+                "replay_metadata": replay_metadata,
+                "simulator_steps": episode_stats["steps"],
+                "replay_evidence": {
+                    "steps": episode_stats["steps"],
+                    "scenario": "bounded_local_episode",
+                    "deterministic": True,
+                    "seed": seed,
+                },
+            }
+        except Exception as exc:  # noqa: BLE001
+            return {
+                **base_result,
+                "status": "error",
+                "available": available,
+                "reason": f"live execution failed: {exc}",
+                "simulator_steps": None,
+                "replay_evidence": None,
+            }
+
+    return {
+        **base_result,
+        "status": "error",
+        "available": available,
+        "reason": f"unknown backend_mode: {backend_mode!r}",
+        "simulator_steps": None,
+        "replay_evidence": None,
+    }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trac3er/oh-my-god",
-  "version": "2.1.4",
+  "version": "2.1.7",
   "description": "OMG (Oh My God) — Multi-agent orchestration, evidence-backed verification, and durable session state for Claude Code, Codex, and supported agent hosts",
   "main": "OMG-setup.sh",
   "scripts": {

package/plugins/advanced/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-advanced",
-  "version": "2.1.4",
+  "version": "2.1.7",
   "description": "Advanced OMG commands - deep planning, learning, code review, and specialized workflows",
   "type": "omg-plugin",
   "commands": {

package/plugins/core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-core",
-  "version": "2.1.4",
+  "version": "2.1.7",
   "description": "Core OMG commands - native setup, routing, orchestration, and verification surfaces",
   "type": "omg-plugin",
   "commands": {
@@ -66,7 +66,7 @@
     },
     "profile-review": {
       "path": "commands/OMG:profile-review.md",
-      "description": "Review governed profile state \u2014 preferences, confirmations, decay, provenance",
+      "description": "Review governed profile state — preferences, confirmations, decay, provenance",
       "category": "observability"
     },
     "mode": {
@@ -103,13 +103,13 @@
     },
     "arch": {
       "path": "commands/OMG:arch.md",
-      "description": "Codebase visualization \u2014 dependency graphs and architecture diagrams",
+      "description": "Codebase visualization — dependency graphs and architecture diagrams",
       "category": "visualization",
       "feature_flag": "CODEBASE_VIZ"
     },
     "validate": {
       "path": "commands/OMG:validate.md",
-      "description": "Canonical validation \u2014 doctor + contract + profile + install checks",
+      "description": "Canonical validation — doctor + contract + profile + install checks",
       "category": "observability"
     }
   },

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "oh-my-god"
-version = "2.1.4"
+version = "2.1.7"
 description = "OMG (Oh My God) — Multi-agent orchestration, evidence-backed verification, and durable session state for Claude Code, Codex, and supported agent hosts"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -24,6 +24,7 @@ classifiers = [
     "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 dependencies = [
+    "cryptography>=44.0",
     "fastmcp>=2.0",
 ]