@trac3er/oh-my-god 2.1.4 → 2.1.7

package/runtime/contract_compiler.py

@@ -23,6 +23,7 @@ from runtime.asset_loader import resolve_asset, resolve_assets
 from runtime.proof_chain import _normalize_evidence_pack
 from runtime.evidence_requirements import requirements_for_profile
 from runtime.runtime_contracts import schema_versions
+from runtime.compliance_governor import evaluate_release_compliance
 from runtime.adoption import (
     CANONICAL_MARKETPLACE_ID,
     CANONICAL_PACKAGE_NAME,
@@ -30,6 +31,7 @@ from runtime.adoption import (
     CANONICAL_REPO_URL,
     CANONICAL_VERSION,
 )
+from registry.verify_artifact import sign_artifact_statement
 
 
 CONTRACT_DOC_PATH = Path("OMG_COMPAT_CONTRACT.md")
@@ -67,11 +69,31 @@ TRUTH_COUNCIL_BUNDLES = (
     "test-intent-lock",
     "proof-gate",
 )
-REQUIRED_ADVANCED_PLUGIN_ARTIFACTS = (
-    "bundle/plugins/advanced/plugin.json",
-    "bundle/plugins/advanced/commands/OMG:deep-plan.md",
-    "bundle/plugins/advanced/commands/OMG:security-review.md",
-)
+def _get_required_advanced_plugin_artifacts(root: Path) -> tuple[str, ...]:
+    manifest_path = root / "plugins" / "advanced" / "plugin.json"
+    try:
+        manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return ()
+
+    required: list[str] = ["bundle/plugins/advanced/plugin.json"]
+    seen = set(required)
+    commands = manifest.get("commands", {})
+    if not isinstance(commands, dict):
+        return tuple(required)
+
+    for command in commands.values():
+        if not isinstance(command, dict):
+            continue
+        command_path = command.get("path")
+        if not isinstance(command_path, str) or not command_path:
+            continue
+        bundled_path = f"bundle/plugins/advanced/{command_path}"
+        if bundled_path in seen:
+            continue
+        required.append(bundled_path)
+        seen.add(bundled_path)
+    return tuple(required)
 REQUIRED_DOC_TOKENS = (
     "execution_contract",
     "tool_policy",
@@ -115,6 +137,7 @@ REQUIRED_CODEX_AGENTS_SECTIONS = (
     "## Build & Test",
     "## Protected Paths",
     "## Evidence Contract",
+    "## Release Audit",
     "## Required Skills",
     "## Web Search Policy",
     "## Approval Constraints",
@@ -153,6 +176,36 @@ _REQUIRED_EXECUTION_PRIMITIVES = (
     "session_health_state",
     "council_verdicts",
     "forge_starter_proof",
+    "claim_judge_outcome",
+    "compliance_governor_outcome",
+)
+
+_PHASE1_FORGE_SPECIALIST_SURFACES = (
+    "forge-profile-review",
+    "forge-release-audit",
+    "forge-validate",
+)
+
+_PHASE1_RELEASE_SURFACES = (
+    "OMG:profile-review",
+    "OMG:release-audit",
+    "OMG:validate",
+)
+
+_PHASE1_ATTESTATION_REQUIREMENTS = (
+    "registry.verify_artifact.sign_artifact_statement",
+    "registry.verify_artifact.verify_artifact_statement",
+)
+
+_PHASE1_COMPLIANCE_EXPECTATIONS = (
+    "runtime.compliance_governor.evaluate_release_compliance",
+    "runtime.compliance_governor.evaluate_tool_compliance",
+)
+
+_PHASE1_RELEASE_READINESS_CHECKS = (
+    "claim_judge",
+    "compliance_governor",
+    "execution_primitives",
 )
 
 _REQUIRED_CONTEXT_METADATA = (
@@ -410,6 +463,16 @@ def _write_text(path: Path, content: str) -> None:
     path.write_text(content, encoding="utf-8")
 
 
+def _build_phase1_release_contract() -> dict[str, list[str]]:
+    return {
+        "forge_specialist_surfaces": list(_PHASE1_FORGE_SPECIALIST_SURFACES),
+        "release_surfaces": list(_PHASE1_RELEASE_SURFACES),
+        "attestation_requirements": list(_PHASE1_ATTESTATION_REQUIREMENTS),
+        "compliance_governor_expectations": list(_PHASE1_COMPLIANCE_EXPECTATIONS),
+        "release_readiness_checks": list(_PHASE1_RELEASE_READINESS_CHECKS),
+    }
+
+
 def _sha256_file(path: Path) -> str:
     digest = hashlib.sha256()
     with path.open("rb") as handle:
@@ -887,6 +950,7 @@ def _compile_claude_outputs(
 
     omg_settings = dict(settings.get("_omg", {}))
     omg_settings["_version"] = CANONICAL_VERSION
+    phase1_release_contract = _build_phase1_release_contract()
     omg_settings["generated"] = {
         "contract_version": CANONICAL_VERSION,
         "channel": channel,
@@ -896,6 +960,7 @@ def _compile_claude_outputs(
         "policy_model": policy_model or {},
         "subagents": subagents,
         "skills": skills,
+        "phase1_release_contract": phase1_release_contract,
     }
     settings["_omg"] = omg_settings
     _write_json(output_root / "settings.json", settings)
@@ -993,6 +1058,7 @@ def _render_codex_agents_fragment(
     codex_skills: list[str],
     evidence_fields: list[str],
     protected_planning_skills: list[str],
+    phase1_release_contract: dict[str, list[str]],
 ) -> str:
     """Render a comprehensive AGENTS.fragment.md for Codex host."""
     sections: list[str] = []
@@ -1015,6 +1081,15 @@ def _render_codex_agents_fragment(
         sections.append(f"- `{path}`")
     sections.append("")
 
+    sections.append("## Release Audit\n")
+    sections.append("Release readiness requires claim and compliance outcomes:\n")
+    for check in phase1_release_contract.get("release_readiness_checks", []):
+        sections.append(f"- `{check}`")
+    sections.append("Attestation requirements:")
+    for requirement in phase1_release_contract.get("attestation_requirements", []):
+        sections.append(f"- `{requirement}`")
+    sections.append("")
+
     # Evidence Contract
     sections.append("## Evidence Contract\n")
     sections.append("Every production action must emit evidence containing these fields:\n")
@@ -1169,6 +1244,7 @@ def _compile_codex_outputs(
     codex_skills = _codex_skill_refs(policy_model)
     evidence_fields = _codex_evidence_fields(policy_model)
     protected_planning_skills = _codex_protected_planning_skills(bundles)
+    phase1_release_contract = _build_phase1_release_contract()
 
     agents_fragment = _render_codex_agents_fragment(
         channel=channel,
@@ -1178,6 +1254,7 @@ def _compile_codex_outputs(
         codex_skills=codex_skills,
         evidence_fields=evidence_fields,
         protected_planning_skills=protected_planning_skills,
+        phase1_release_contract=phase1_release_contract,
     )
     _write_text(shared_dir / "AGENTS.fragment.md", agents_fragment)
     artifacts.append(shared_dir / "AGENTS.fragment.md")
@@ -1214,7 +1291,6 @@ def _compile_codex_outputs(
 
 
 def _compile_gemini_outputs(output_root: Path, channel: str) -> dict[str, Any]:
-    del channel
     from runtime.mcp_config_writers import write_gemini_mcp_stdio_config
 
     config_path = output_root / ".gemini" / "settings.json"
@@ -1224,11 +1300,21 @@ def _compile_gemini_outputs(output_root: Path, channel: str) -> dict[str, Any]:
         server_name="omg-control",
         config_path=config_path,
     )
+    payload = _load_json(config_path)
+    payload["_omg"] = {
+        "_version": CANONICAL_VERSION,
+        "generated": {
+            "contract_version": CANONICAL_VERSION,
+            "channel": channel,
+            "required_bundles": list(DEFAULT_REQUIRED_BUNDLES),
+            "phase1_release_contract": _build_phase1_release_contract(),
+        },
+    }
+    _write_json(config_path, payload)
     return {"host": "gemini", "artifacts": [config_path]}
 
 
 def _compile_kimi_outputs(output_root: Path, channel: str) -> dict[str, Any]:
-    del channel
     from runtime.mcp_config_writers import write_kimi_mcp_stdio_config
 
     config_path = output_root / ".kimi" / "mcp.json"
@@ -1238,6 +1324,17 @@ def _compile_kimi_outputs(output_root: Path, channel: str) -> dict[str, Any]:
         server_name="omg-control",
         config_path=config_path,
     )
+    payload = _load_json(config_path)
+    payload["_omg"] = {
+        "_version": CANONICAL_VERSION,
+        "generated": {
+            "contract_version": CANONICAL_VERSION,
+            "channel": channel,
+            "required_bundles": list(DEFAULT_REQUIRED_BUNDLES),
+            "phase1_release_contract": _build_phase1_release_contract(),
+        },
+    }
+    _write_json(config_path, payload)
     return {"host": "kimi", "artifacts": [config_path]}
 
 
@@ -1262,18 +1359,43 @@ def _copy_release_bundle(
 
 def _build_dist_manifest(output_root: Path, *, channel: str, hosts: list[str], artifacts: list[Path]) -> Path:
     dist_root = output_root / "dist" / channel
+    artifact_entries: list[dict[str, str]] = []
+    attestation_rows: list[dict[str, str]] = []
+
+    for path in sorted(set(artifacts)):
+        rel_path = str(path.relative_to(dist_root))
+        digest = _sha256_file(path)
+        artifact_entries.append({"path": rel_path, "sha256": digest})
+
+        statement = sign_artifact_statement(
+            artifact_path=rel_path,
+            subject_digest=digest,
+        )
+
+        statement_rel = f"attestations/{rel_path}.statement.json"
+        statement_abs = dist_root / statement_rel
+        _write_json(statement_abs, statement)
+
+        sig_rel = f"attestations/{rel_path}.minisig"
+        sig_abs = dist_root / sig_rel
+        sig_value = statement.get("signature", {}).get("value", "")
+        _write_text(sig_abs, sig_value + "\n")
+
+        attestation_rows.append({
+            "artifact_path": rel_path,
+            "statement_path": statement_rel,
+            "signature_path": sig_rel,
+            "signer_key_id": statement.get("signature", {}).get("keyid", ""),
+            "algorithm": "ed25519-minisign",
+        })
+
     payload = {
         "schema": "OmgCompiledArtifactManifest",
         "channel": channel,
         "hosts": list(hosts),
         "contract_version": CANONICAL_VERSION,
-        "artifacts": [
-            {
-                "path": str(path.relative_to(dist_root)),
-                "sha256": _sha256_file(path),
-            }
-            for path in sorted(set(artifacts))
-        ],
+        "artifacts": artifact_entries,
+        "attestations": attestation_rows,
     }
     out_path = dist_root / "manifest.json"
     _write_json(out_path, payload)
@@ -1438,6 +1560,54 @@ def _check_mcp_fabric() -> dict[str, Any]:
     }
 
 
+def _check_plugin_command_paths(root: Path) -> dict[str, Any]:
+    blockers: list[str] = []
+    details: dict[str, Any] = {}
+
+    plugin_specs: list[tuple[str, Path, Path]] = [
+        ("core", root / "plugins" / "core" / "plugin.json", root),
+        ("advanced", root / "plugins" / "advanced" / "plugin.json", root / "plugins" / "advanced"),
+    ]
+
+    for plugin_name, manifest_path, resolve_root in plugin_specs:
+        plugin_detail: dict[str, Any] = {"manifest": str(manifest_path), "commands": {}}
+        if not manifest_path.exists():
+            blockers.append(f"plugin_command_paths: missing manifest {manifest_path.relative_to(root)}")
+            plugin_detail["status"] = "error"
+            details[plugin_name] = plugin_detail
+            continue
+
+        try:
+            manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+        except (json.JSONDecodeError, OSError) as exc:
+            blockers.append(f"plugin_command_paths: unreadable manifest {manifest_path.relative_to(root)}: {exc}")
+            plugin_detail["status"] = "error"
+            details[plugin_name] = plugin_detail
+            continue
+
+        commands = manifest.get("commands", {})
+        missing: list[str] = []
+        for cmd_name, cmd_config in commands.items():
+            cmd_path = cmd_config.get("path", "")
+            resolved = resolve_root / cmd_path
+            plugin_detail["commands"][cmd_name] = str(cmd_path)
+            if not resolved.exists():
+                missing.append(cmd_path)
+                blockers.append(
+                    f"plugin_command_paths: {plugin_name} command '{cmd_name}' missing source {cmd_path}"
+                )
+
+        plugin_detail["missing"] = missing
+        plugin_detail["status"] = "ok" if not missing else "error"
+        details[plugin_name] = plugin_detail
+
+    return {
+        "status": "ok" if not blockers else "error",
+        "blockers": blockers,
+        "details": details,
+    }
+
+
 def _check_version_identity_drift(root: Path) -> dict[str, Any]:
     canonical_version = CANONICAL_VERSION
     blockers: list[str] = []
@@ -1761,7 +1931,7 @@ def build_release_readiness(
                     manifest_errors.append(
                         f"{required_channel}: host_parity_missing {host_name} {bundled_host_path}"
                     )
-        for req_path in REQUIRED_ADVANCED_PLUGIN_ARTIFACTS:
+        for req_path in _get_required_advanced_plugin_artifacts(root):
             if req_path not in manifest_paths:
                 manifest_errors.append(f"{required_channel}: advanced_plugin_missing {req_path}")
         if manifest_errors:
@@ -1815,6 +1985,10 @@ def build_release_readiness(
     checks["execution_primitives"] = execution_primitives
     blockers.extend(execution_primitives.get("blockers", []))
 
+    claim_judge_compliance = _check_claim_judge_compliance(output)
+    checks["claim_judge_compliance"] = claim_judge_compliance
+    blockers.extend(claim_judge_compliance.get("blockers", []))
+
     security_blockers = [
         blocker
         for blocker in evidence_check.get("blockers", [])
@@ -1837,6 +2011,10 @@ def build_release_readiness(
     checks["package_smoke"] = package_check
     blockers.extend(package_check.get("blockers", []))
 
+    plugin_cmd_check = _check_plugin_command_paths(root)
+    checks["plugin_command_paths"] = plugin_cmd_check
+    blockers.extend(plugin_cmd_check.get("blockers", []))
+
     version_drift_check = _check_version_identity_drift(root)
     checks["version_identity_drift"] = version_drift_check
     blockers.extend(version_drift_check.get("blockers", []))
@@ -2028,6 +2206,7 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
         ("session_health_state", "session_health", "SessionHealth"),
         ("council_verdicts", "council_verdicts", "CouncilVerdicts"),
     ]
+    resolved_state_payloads: dict[str, dict[str, Any]] = {}
     for token, module, schema_name in checks:
         matched_path, matched_payload = _find_state_for_run(output_root=output_root, module=module, run_id=run_id)
         if matched_path is None or matched_payload is None:
@@ -2035,6 +2214,7 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
             blockers.append(f"missing_execution_primitive: {token}")
             continue
         evidence_paths[token] = str(matched_path.relative_to(output_root)).replace("\\", "/")
+        resolved_state_payloads[token] = matched_payload
         schema = str(matched_payload.get("schema", "")).strip()
         if schema != schema_name:
             invalid.append(f"{token}:schema_mismatch")
@@ -2056,6 +2236,55 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
                     f"missing_context_metadata={','.join(sorted(metadata_missing))}"
                 )
 
+    claims_payload = evidence_payload.get("claims")
+    claims = claims_payload if isinstance(claims_payload, list) else []
+    if not claims or not run_id:
+        missing.append("claim_judge_outcome")
+        blockers.append("missing_execution_primitive: claim_judge_outcome")
+    else:
+        release_evidence: dict[str, object] = {"run_id": run_id, "claims": claims}
+        artifact = evidence_payload.get("artifact")
+        if isinstance(artifact, dict):
+            release_evidence["artifact"] = artifact
+        compliance = evaluate_release_compliance(
+            project_dir=str(output_root),
+            run_id=run_id,
+            release_evidence=release_evidence,
+        )
+        claim_dir = output_root / ".omg" / "evidence"
+        claim_candidates = sorted(claim_dir.glob("claim-judge-*.json")) if claim_dir.exists() else []
+        if claim_candidates:
+            claim_path = claim_candidates[-1]
+            evidence_paths["claim_judge_outcome"] = str(claim_path.relative_to(output_root)).replace("\\", "/")
+        else:
+            missing.append("claim_judge_outcome")
+            blockers.append("missing_execution_primitive: claim_judge_outcome")
+        if str(compliance.get("status", "")).strip().lower() == "blocked":
+            invalid.append("claim_judge_outcome:blocked")
+            reason = str(compliance.get("reason", "claim_judge_blocked")).strip()
+            blockers.append(f"invalid_execution_primitive: claim_judge_outcome: {reason}")
+
+    release_state = resolved_state_payloads.get("release_run_coordinator_state", {})
+    if not release_state:
+        missing.append("compliance_governor_outcome")
+        blockers.append("missing_execution_primitive: compliance_governor_outcome")
+    else:
+        evidence_paths["compliance_governor_outcome"] = evidence_paths.get("release_run_coordinator_state", "")
+        authority = str(release_state.get("compliance_authority", "")).strip()
+        reason = str(release_state.get("compliance_reason", "")).strip()
+        if not authority or not reason:
+            invalid.append("compliance_governor_outcome:missing_fields")
+            blockers.append("invalid_execution_primitive: compliance_governor_outcome: missing_fields")
+        artifact_verdict = str(release_state.get("artifact_verdict", "")).strip()
+        if artifact_verdict:
+            artifact_alg = str(release_state.get("artifact_alg", "")).strip()
+            artifact_key_id = str(release_state.get("artifact_key_id", "")).strip()
+            if not artifact_alg or not artifact_key_id:
+                invalid.append("compliance_governor_outcome:missing_artifact_audit")
+                blockers.append(
+                    "invalid_execution_primitive: compliance_governor_outcome: missing_artifact_audit_fields"
+                )
+
     profile_path = output_root / ".omg" / "state" / "profile.yaml"
     if not profile_path.exists():
         missing.append("profile_digest")
@@ -2217,6 +2446,49 @@ def _find_forge_starter_proof(*, output_root: Path, run_id: str) -> tuple[Path |
     return None, None
 
 
+def _sanitize_run_id(value: str) -> str:
+    cleaned = "".join(ch if ch.isalnum() or ch in {"-", "_", "."} else "-" for ch in value.strip())
+    return cleaned or "unknown"
+
+
+def _check_claim_judge_compliance(output_root: Path) -> dict[str, Any]:
+    latest = _latest_evidence_pack(output_root)
+    if latest is None:
+        return {"status": "missing", "blockers": []}
+
+    _, evidence_payload = latest
+    run_id = str(evidence_payload.get("run_id", "")).strip()
+    claims_payload = evidence_payload.get("claims")
+    claims = claims_payload if isinstance(claims_payload, list) else []
+    if not run_id or not claims:
+        return {
+            "status": "missing",
+            "run_id": run_id,
+            "blockers": ["claim_judge_compliance_gate: missing release claims for compliance evaluation"],
+        }
+
+    release_evidence: dict[str, object] = {"run_id": run_id, "claims": claims}
+    artifact = evidence_payload.get("artifact")
+    if isinstance(artifact, dict):
+        release_evidence["artifact"] = artifact
+    decision = evaluate_release_compliance(
+        project_dir=str(output_root),
+        run_id=run_id,
+        release_evidence=release_evidence,
+    )
+    decision_status = str(decision.get("status", "")).strip().lower()
+    blockers: list[str] = []
+    if decision_status == "blocked":
+        reason = str(decision.get("reason", "compliance_gate_blocked")).strip() or "compliance_gate_blocked"
+        blockers.append(f"claim_judge_compliance_gate: {reason}")
+    return {
+        "status": "ok" if not blockers else "error",
+        "run_id": run_id,
+        "decision": decision,
+        "blockers": blockers,
+    }
+
+
 def _check_test_intent_claims(payload: dict[str, Any]) -> list[str]:
     test_delta = payload.get("test_delta")
     claims = payload.get("claims", [])

package/runtime/data_lineage.py

@@ -1,9 +1,10 @@
-"""Lineage manifests for generated OMG artifacts."""
 from __future__ import annotations
 
+from collections import deque
 from datetime import datetime, timezone
 import json
 from pathlib import Path
+import sqlite3
 from typing import Any
 from uuid import uuid4
 
@@ -12,6 +13,144 @@ def _now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
+def _lineage_db_path(project_dir: str) -> Path:
+    return Path(project_dir) / ".omg" / "lineage" / "adjacency.sqlite3"
+
+
+def _lineage_conn(project_dir: str) -> sqlite3.Connection:
+    path = _lineage_db_path(project_dir)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(path)
+    conn.row_factory = sqlite3.Row
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS lineage_edges (
+            edge_id TEXT PRIMARY KEY,
+            parent_node TEXT NOT NULL,
+            child_node TEXT NOT NULL,
+            edge_type TEXT NOT NULL,
+            run_id TEXT NOT NULL,
+            profile_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            metadata_json TEXT NOT NULL DEFAULT '{}'
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE INDEX IF NOT EXISTS idx_lineage_scope
+        ON lineage_edges(run_id, profile_id, parent_node, child_node)
+        """
+    )
+    conn.commit()
+    return conn
+
+
+def add_lineage_edge(
+    project_dir: str,
+    *,
+    parent_node: str,
+    child_node: str,
+    edge_type: str,
+    run_id: str,
+    profile_id: str,
+    metadata: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    edge_id = f"edge-{uuid4().hex}"
+    payload = {
+        "edge_id": edge_id,
+        "parent_node": parent_node,
+        "child_node": child_node,
+        "edge_type": edge_type,
+        "run_id": run_id,
+        "profile_id": profile_id,
+        "created_at": _now(),
+        "metadata": metadata or {},
+    }
+    conn = _lineage_conn(project_dir)
+    conn.execute(
+        """
+        INSERT INTO lineage_edges(
+            edge_id, parent_node, child_node, edge_type, run_id, profile_id, created_at, metadata_json
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        """,
+        (
+            payload["edge_id"],
+            payload["parent_node"],
+            payload["child_node"],
+            payload["edge_type"],
+            payload["run_id"],
+            payload["profile_id"],
+            payload["created_at"],
+            json.dumps(payload["metadata"], ensure_ascii=True),
+        ),
+    )
+    conn.commit()
+    conn.close()
+    return payload
+
+
+def traverse_lineage(
+    project_dir: str,
+    *,
+    start_node: str,
+    run_id: str,
+    profile_id: str,
+    max_depth: int = 3,
+) -> dict[str, Any]:
+    bounded_depth = max(1, min(int(max_depth), 16))
+    conn = _lineage_conn(project_dir)
+    queue: deque[tuple[str, int]] = deque([(start_node, 0)])
+    nodes: set[str] = {start_node}
+    seen_edges: set[str] = set()
+    edges: list[dict[str, Any]] = []
+
+    while queue:
+        node, depth = queue.popleft()
+        if depth >= bounded_depth:
+            continue
+        rows = conn.execute(
+            """
+            SELECT edge_id, parent_node, child_node, edge_type, run_id, profile_id, created_at, metadata_json
+            FROM lineage_edges
+            WHERE run_id = ? AND profile_id = ? AND parent_node = ?
+            ORDER BY created_at ASC
+            """,
+            (run_id, profile_id, node),
+        ).fetchall()
+        for row in rows:
+            edge_id = str(row["edge_id"])
+            if edge_id in seen_edges:
+                continue
+            seen_edges.add(edge_id)
+            child_node = str(row["child_node"])
+            nodes.add(child_node)
+            edges.append(
+                {
+                    "edge_id": edge_id,
+                    "parent_node": str(row["parent_node"]),
+                    "child_node": child_node,
+                    "edge_type": str(row["edge_type"]),
+                    "run_id": str(row["run_id"]),
+                    "profile_id": str(row["profile_id"]),
+                    "created_at": str(row["created_at"]),
+                    "metadata": _parse_json_object(row["metadata_json"]),
+                }
+            )
+            queue.append((child_node, depth + 1))
+
+    conn.close()
+    return {
+        "schema": "LineageTraversalResult",
+        "start_node": start_node,
+        "run_id": run_id,
+        "profile_id": profile_id,
+        "max_depth": bounded_depth,
+        "nodes": sorted(nodes),
+        "edges": edges,
+    }
+
+
 def build_lineage_manifest(
     project_dir: str,
     *,
@@ -43,6 +182,18 @@ def build_lineage_manifest(
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
     payload["path"] = rel_path.as_posix()
+
+    trace_node = str(payload.get("trace_id", "")).strip()
+    if trace_node:
+        add_lineage_edge(
+            project_dir,
+            parent_node=trace_node,
+            child_node=lineage_id,
+            edge_type="trace_to_lineage",
+            run_id=trace_node,
+            profile_id="",
+            metadata={"artifact_type": artifact_type},
+        )
     return payload
 
 
@@ -71,3 +222,23 @@ def validate_lineage_manifest(payload: dict[str, Any]) -> dict[str, Any]:
         "status": "ok" if not errors else "error",
         "errors": errors,
     }
+
+
+def _parse_json_object(raw: object) -> dict[str, Any]:
+    if isinstance(raw, dict):
+        return raw
+    if not isinstance(raw, str):
+        return {}
+    try:
+        payload = json.loads(raw)
+    except (TypeError, ValueError, json.JSONDecodeError):
+        return {}
+    return payload if isinstance(payload, dict) else {}
+
+
+__all__ = [
+    "add_lineage_edge",
+    "build_lineage_manifest",
+    "traverse_lineage",
+    "validate_lineage_manifest",
+]

package/runtime/domain_packs.py

@@ -37,6 +37,14 @@ DOMAIN_PACKS: dict[str, dict[str, Any]] = {
         "eval_hooks": ["health-safety"],
         "replay_hooks": ["incident-replay"],
     },
+    "cybersecurity": {
+        "name": "cybersecurity",
+        "required_approvals": [],
+        "required_evidence": ["security-scan", "threat-model", "sarif-report"],
+        "policy_modules": ["security-gate", "threat-gate"],
+        "eval_hooks": ["security-regression"],
+        "replay_hooks": ["incident-replay"],
+    },
 }