@trac3er/oh-my-god 2.1.4 → 2.1.7

package/runtime/complexity_scorer.py

@@ -0,0 +1,148 @@
+from __future__ import annotations
+
+import re
+
+
+_MULTI_STEP_SIGNALS = (
+    "and then",
+    "after that",
+    "followed by",
+    "next",
+    "also",
+    "그리고",
+    "다음에",
+    "이후에",
+    "또한",
+    "하고",
+    "그다음",
+)
+
+_ACTION_VERBS = (
+    "fix",
+    "implement",
+    "build",
+    "create",
+    "add",
+    "update",
+    "refactor",
+    "migrate",
+    "deploy",
+    "rewrite",
+    "redesign",
+    "수정",
+    "구현",
+    "만들",
+    "추가",
+    "리팩토링",
+    "배포",
+)
+
+_MULTI_COMPONENT_SIGNALS = (
+    "entire",
+    "all files",
+    "whole project",
+    "full stack",
+    "frontend and backend",
+    "client and server",
+    "end to end",
+    "every",
+    "all the",
+    "across",
+    "전체",
+    "모든 파일",
+    "풀스택",
+    "모두",
+    "전부",
+    "처음부터 끝까지",
+)
+
+_ARCHITECTURE_SIGNALS = (
+    "architect",
+    "redesign",
+    "migration",
+    "microservice",
+    "monorepo",
+    "restructure",
+    "overhaul",
+    "rewrite from scratch",
+    "아키텍처",
+    "마이그레이션",
+    "재설계",
+    "전면 수정",
+    "처음부터 다시",
+)
+
+
+def score_complexity(goal: str) -> dict[str, object]:
+    normalized_goal = str(goal or "").strip()
+    score = _score_goal(normalized_goal)
+    category = _categorize_goal(normalized_goal, score)
+    governance = {
+        "read_first": score >= 3,
+        "simplify_only": category in {"trivial", "low"},
+        "optimize_only": category == "high",
+        "complexity": category,
+        "complexity_score": score,
+    }
+    return {
+        "score": score,
+        "category": category,
+        "governance": governance,
+    }
+
+
+def _score_goal(goal: str) -> int:
+    if not goal:
+        return 0
+
+    score = 0
+    lowered = goal.lower()
+
+    score += sum(1 for signal in _MULTI_STEP_SIGNALS if _signal_matches(signal, goal, lowered=lowered))
+    verb_count = sum(1 for signal in _ACTION_VERBS if _signal_matches(signal, goal, lowered=lowered))
+    score += min(max(verb_count - 1, 0), 3)
+    score += sum(
+        2 for signal in _MULTI_COMPONENT_SIGNALS if _signal_matches(signal, goal, lowered=lowered)
+    )
+    score += sum(2 for signal in _ARCHITECTURE_SIGNALS if _signal_matches(signal, goal, lowered=lowered))
+
+    numbered_items = len(re.findall(r"(?:^|\n)\s*[\d]+[.)]\s", lowered))
+    bullet_items = len(re.findall(r"(?:^|\n)\s*[-*]\s", lowered))
+    score += min(numbered_items + bullet_items, 5)
+
+    word_count = len(lowered.split())
+    if word_count > 80:
+        score += 2
+    elif word_count > 40:
+        score += 1
+
+    return score
+
+
+def _categorize_goal(goal: str, score: int) -> str:
+    if not goal:
+        return _score_bucket(score)
+
+    word_count = len(goal.split())
+    if word_count >= 25:
+        return "high"
+    if word_count >= 10:
+        return "medium"
+    return "low"
+
+
+def _score_bucket(score: int) -> str:
+    if score <= 1:
+        return "trivial"
+    if score <= 4:
+        return "low"
+    if score <= 9:
+        return "medium"
+    return "high"
+
+
+def _signal_matches(signal: str, text: str, *, lowered: str | None = None) -> bool:
+    lowered_text = lowered if lowered is not None else text.lower()
+    if re.search(r"[\uac00-\ud7a3]", signal):
+        return signal in text
+    return re.search(r"\b" + re.escape(signal) + r"\b", lowered_text, re.IGNORECASE) is not None

package/runtime/compliance_governor.py

@@ -0,0 +1,282 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any
+
+from registry.approval_artifact import load_approval_artifact_from_path, verify_approval_artifact
+from registry.verify_artifact import verify_artifact
+from runtime.claim_judge import evaluate_claims_for_release
+from runtime.runtime_contracts import read_run_state
+
+
+_READ_ONLY_TOOL_HINTS = (
+    "read",
+    "search",
+    "review",
+    "grep",
+    "glob",
+    "list",
+    "ls",
+    "context7",
+    "websearch",
+)
+_MUTATION_TOOLS = frozenset({"write", "edit", "multiedit", "bash"})
+
+
+def evaluate_tool_compliance(
+    *,
+    project_dir: str,
+    run_id: str,
+    tool: str,
+    has_tool_plan: bool,
+    clarification_status: dict[str, object] | None = None,
+) -> dict[str, object]:
+    clarification = _normalized_clarification_status(clarification_status)
+    if clarification["requires_clarification"]:
+        reason = _clarification_reason(str(clarification["clarification_prompt"]))
+        if _is_mutation_capable_tool(tool):
+            return {
+                "status": "blocked",
+                "authority": "clarification",
+                "reason": reason,
+                "clarification_status": clarification,
+            }
+        if _is_read_search_review_tool(tool):
+            return {
+                "status": "allowed",
+                "authority": "clarification",
+                "reason": "clarification pending; read/search/review tool allowed",
+                "clarification_status": clarification,
+            }
+
+    if has_tool_plan:
+        council = _read_council_verdicts(project_dir, run_id)
+        council_verdict = _council_gate_verdict(council)
+        if council_verdict["blocked"]:
+            return {
+                "status": "blocked",
+                "authority": "council_verdicts",
+                "reason": str(council_verdict["reason"]),
+                "council_verdicts": council.get("verdicts", {}),
+            }
+        return {"status": "allowed", "authority": "tool_plan", "reason": "tool plan present"}
+
+    return {
+        "status": "blocked",
+        "authority": "tool_plan",
+        "reason": "tool plan required before mutation-capable MCP evaluation",
+    }
+
+
+def evaluate_release_compliance(
+    *,
+    project_dir: str,
+    run_id: str,
+    release_evidence: dict[str, object] | None,
+) -> dict[str, object]:
+    artifact_gate = _artifact_gate_decision(release_evidence)
+    if artifact_gate["status"] == "blocked":
+        return artifact_gate
+
+    artifact_audit: dict[str, object] = {}
+    for key in (
+        "artifact_alg",
+        "artifact_key_id",
+        "artifact_subject_sha256",
+        "artifact_verdict",
+        "approval_authority",
+        "approval_reason",
+    ):
+        if key in artifact_gate:
+            artifact_audit[key] = artifact_gate[key]
+
+    council = _read_council_verdicts(project_dir, run_id)
+    council_verdict = _council_gate_verdict(council)
+    if council_verdict["blocked"]:
+        return {
+            "status": "blocked",
+            "authority": "council_verdicts",
+            "reason": str(council_verdict["reason"]),
+            "council_verdicts": council.get("verdicts", {}),
+        }
+
+    if not isinstance(release_evidence, dict):
+        return {"status": "blocked", "authority": "artifact", "reason": "no release evidence supplied"}
+
+    raw_claims = release_evidence.get("claims")
+    claims = raw_claims if isinstance(raw_claims, list) else []
+    if claims:
+        claim_decision = evaluate_claims_for_release(project_dir=project_dir, run_id=run_id, claims=claims)
+        if claim_decision.get("status") == "blocked":
+            return {
+                "status": "blocked",
+                "authority": "claim_judge",
+                "reason": str(claim_decision.get("reason", "claim_judge_verdict=unknown")),
+                "claim_judge_verdict": str(claim_decision.get("claim_judge_verdict", "")),
+            }
+
+    return {
+        "status": "allowed",
+        "authority": "release",
+        "reason": "compliance checks passed",
+        **artifact_audit,
+    }
+
+
+_UNVERIFIED_ARTIFACT_STATUSES = frozenset({"pending_verification", "insufficient_evidence", "placeholder"})
+
+
+def _artifact_gate_decision(release_evidence: dict[str, object] | None) -> dict[str, object]:
+    if not isinstance(release_evidence, dict):
+        return {"status": "blocked", "authority": "artifact", "reason": "no release evidence supplied"}
+    artifact = release_evidence.get("artifact")
+    if not isinstance(artifact, dict):
+        return {"status": "blocked", "authority": "artifact", "reason": "no artifact supplied"}
+
+    artifact_contracts = artifact.get("artifact_contracts")
+    if isinstance(artifact_contracts, Mapping):
+        unverified = []
+        for name, contract in artifact_contracts.items():
+            if isinstance(contract, Mapping):
+                status = str(contract.get("status", "")).strip().lower()
+                if status in _UNVERIFIED_ARTIFACT_STATUSES:
+                    unverified.append(f"{name}={status}")
+        if unverified:
+            return {
+                "status": "blocked",
+                "authority": "artifact",
+                "reason": f"artifact_contracts contain unverified artifacts: {', '.join(unverified)}",
+            }
+
+    verified = verify_artifact(artifact)
+    action = str(verified.get("action", "")).strip().lower()
+    audit_fields = {
+        "artifact_alg": str(verified.get("algorithm", "")),
+        "artifact_key_id": str(verified.get("key_id", "")),
+        "artifact_subject_sha256": str(verified.get("subject_sha256", "")),
+        "artifact_verdict": str(verified.get("action", "")),
+    }
+
+    if action == "deny":
+        return {
+            "status": "blocked",
+            "authority": "artifact",
+            "reason": f"artifact_verification={verified.get('reason', 'denied')}",
+        }
+    if action == "allow":
+        return {
+            "status": "allowed",
+            "authority": "artifact",
+            "reason": f"artifact_verification={verified.get('action', 'allow')}",
+            **audit_fields,
+        }
+    if action == "ask":
+        expected_digest = audit_fields["artifact_subject_sha256"]
+        approval_artifact = release_evidence.get("approval_artifact")
+        if isinstance(approval_artifact, dict):
+            approval_result = verify_approval_artifact(approval_artifact, expected_artifact_digest=expected_digest)
+            if bool(approval_result.get("valid")):
+                return {
+                    "status": "allowed",
+                    "authority": "artifact",
+                    "reason": "artifact_verification=ask; approval artifact verified",
+                    "approval_authority": str(approval_artifact.get("signer_key_id", "")),
+                    "approval_reason": str(approval_artifact.get("reason", "")),
+                    **audit_fields,
+                }
+
+        approval_path = release_evidence.get("approval_artifact_path")
+        if isinstance(approval_path, str) and approval_path.strip():
+            loaded = load_approval_artifact_from_path(
+                approval_path.strip(),
+                expected_artifact_digest=expected_digest,
+            )
+            if bool(loaded.get("valid")):
+                approval_payload = loaded.get("approval")
+                approval_dict = approval_payload if isinstance(approval_payload, dict) else {}
+                return {
+                    "status": "allowed",
+                    "authority": "artifact",
+                    "reason": "artifact_verification=ask; approval artifact verified",
+                    "approval_authority": str(approval_dict.get("signer_key_id", "")),
+                    "approval_reason": str(approval_dict.get("reason", "")),
+                    **audit_fields,
+                }
+
+        return {
+            "status": "blocked",
+            "authority": "artifact",
+            "reason": "ask result requires signed approval artifact",
+        }
+
+    return {
+        "status": "blocked",
+        "authority": "artifact",
+        "reason": "unknown artifact verification action",
+    }
+
+
+def _read_council_verdicts(project_dir: str, run_id: str | None) -> dict[str, object]:
+    if not run_id:
+        return {}
+    payload = read_run_state(project_dir, "council_verdicts", run_id)
+    if isinstance(payload, Mapping):
+        return dict(payload)
+    return {}
+
+
+def _council_gate_verdict(council: dict[str, object]) -> dict[str, object]:
+    verdicts = council.get("verdicts")
+    if not isinstance(verdicts, Mapping):
+        return {"blocked": False, "reason": ""}
+
+    for critic_name, critic_payload in verdicts.items():
+        if not isinstance(critic_payload, Mapping):
+            continue
+        token = str(critic_payload.get("verdict", "")).strip().lower()
+        if token == "fail":
+            return {
+                "blocked": True,
+                "reason": f"council critic '{critic_name}' failed; block mutation-capable tool execution",
+            }
+    return {"blocked": False, "reason": ""}
+
+
+def _normalized_clarification_status(clarification_status: dict[str, object] | None) -> dict[str, object]:
+    raw = clarification_status if isinstance(clarification_status, dict) else {}
+    prompt = str(raw.get("clarification_prompt", "")).strip().replace("\n", " ")
+    confidence = _to_float(raw.get("confidence"), 0.0)
+    return {
+        "requires_clarification": bool(raw.get("requires_clarification") is True),
+        "intent_class": str(raw.get("intent_class", "")).strip(),
+        "clarification_prompt": prompt,
+        "confidence": round(max(0.0, min(1.0, confidence)), 2),
+    }
+
+
+def _clarification_reason(clarification_prompt: str) -> str:
+    prompt = " ".join(str(clarification_prompt or "").split())
+    if prompt:
+        return f"Clarification required before mutation: {prompt}"
+    return "Clarification required before mutation: provide the missing intent details."
+
+
+def _is_mutation_capable_tool(tool: str) -> bool:
+    token = str(tool or "").strip().lower()
+    if token in _MUTATION_TOOLS:
+        return True
+    return token.startswith("bash:")
+
+
+def _is_read_search_review_tool(tool: str) -> bool:
+    token = str(tool or "").strip().lower()
+    if not token:
+        return False
+    return any(hint in token for hint in _READ_ONLY_TOOL_HINTS)
+
+
+def _to_float(value: Any, default: float) -> float:
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return default

package/runtime/context_engine.py

@@ -17,6 +17,8 @@ from typing import Any
 
 import yaml
 
+from runtime.forge_run_id import build_deterministic_contract
+from runtime.memory_store import MemoryStore
 from runtime.profile_io import profile_version_from_map
 
 _MAX_SUMMARY_CHARS = 1000
@@ -27,6 +29,7 @@ _PROFILE_DIGEST_ARCH_MAX = 3
 _PROFILE_DIGEST_CONSTRAINT_MAX = 5
 _PACKET_REL_PATH = Path(".omg") / "state" / "context_engine_packet.json"
 _PROFILE_REL_PATH = Path(".omg") / "state" / "profile.yaml"
+_MEMORY_STORE_REL_PATH = Path(".omg") / "state" / "memory.sqlite3"
 
 _STATE_PATHS = {
     "architecture_signal": Path(".omg") / "state" / "architecture_signal" / "latest.json",
@@ -271,8 +274,9 @@ class ContextEngine:
     def _build(self, run_id: str, *, delta_only: bool) -> dict[str, Any]:
         raw = self._read_all_state(run_id)
         artifact_pointers = self._collect_artifact_pointers(run_id)
+        artifact_handles = self._collect_artifact_handles(run_id)
 
-        if not artifact_pointers and all(v == {} for v in raw.values()):
+        if not artifact_pointers and not artifact_handles and all(v == {} for v in raw.values()):
             pkt = self._fallback(run_id)
             pkt["delta_only"] = delta_only
             pkt["profile_digest"] = load_profile_digest(self.project_dir)
@@ -297,7 +301,9 @@ class ContextEngine:
         packet: dict[str, Any] = {
             "summary": summary,
             "artifact_pointers": artifact_pointers,
+            "artifact_handles": artifact_handles,
             "clarification_status": self._compose_clarification_status(raw),
+            "governance": self._compose_governance(raw),
             "profile_digest": load_profile_digest(self.project_dir),
             "budget": {
                 "max_chars": _MAX_SUMMARY_CHARS,
@@ -305,6 +311,7 @@ class ContextEngine:
             },
             "delta_only": delta_only,
             "run_id": run_id,
+            "deterministic_contract": build_deterministic_contract(run_id),
         }
 
         self._persist_packet(packet)
@@ -365,6 +372,15 @@ class ContextEngine:
             "confidence": round(confidence, 2),
         }
 
+    def _compose_governance(self, raw: dict[str, Any]) -> dict[str, Any]:
+        intent_gate = raw.get("intent_gate", {})
+        if not isinstance(intent_gate, dict):
+            return {}
+        governance = intent_gate.get("governance")
+        if isinstance(governance, dict):
+            return dict(governance)
+        return {}
+
     def _compose_summary(self, raw: dict[str, Any]) -> str:
         """Compose a bounded summary from state signals."""
         parts: list[str] = []
@@ -438,14 +454,26 @@ class ContextEngine:
         return {
             "summary": "no context signals available",
             "artifact_pointers": [],
+            "artifact_handles": [],
             "clarification_status": {
                 "requires_clarification": False,
                 "intent_class": "",
                 "clarification_prompt": "",
                 "confidence": 0.0,
             },
+            "governance": {},
             "profile_digest": _empty_profile_digest(),
             "budget": {"max_chars": _MAX_SUMMARY_CHARS, "used_chars": 0},
             "delta_only": False,
             "run_id": run_id,
+            "deterministic_contract": build_deterministic_contract(run_id),
         }
+
+    def _collect_artifact_handles(self, run_id: str) -> list[dict[str, Any]]:
+        try:
+            profile_id_raw = str(load_profile_digest(self.project_dir).get("profile_version", "")).strip()
+            profile_id = profile_id_raw if profile_id_raw else None
+            store = MemoryStore(store_path=str(self.project_dir / _MEMORY_STORE_REL_PATH))
+            return store.query_artifacts(run_id=run_id, profile_id=profile_id)
+        except Exception:
+            return []