@trac3er/oh-my-god 2.1.4 → 2.1.7

package/runtime/evidence_query.py

@@ -123,12 +123,15 @@ def _record_matches(
     record: JsonObject,
     *,
     run_id: str | None,
+    profile_id: str | None,
     trace_id: str | None,
     schema: str | None,
     kind: str | None,
 ) -> bool:
     if run_id is not None and _record_string(record, "run_id") != run_id:
         return False
+    if profile_id is not None and _record_string(record, "profile_id") != profile_id:
+        return False
     if trace_id is not None:
         direct_trace_id = _record_string(record, "trace_id")
         trace_ids = _record_string_list(record, "trace_ids")
@@ -151,6 +154,33 @@ def _record_matches(
     return True
 
 
+def _artifact_handles_only(record: JsonObject) -> JsonObject:
+    artifacts_raw = record.get("artifacts")
+    if not isinstance(artifacts_raw, list):
+        return record
+
+    artifact_handles: list[JsonObject] = []
+    for item in artifacts_raw:
+        if not isinstance(item, dict):
+            continue
+        handle: JsonObject = {
+            "kind": _record_string(item, "kind"),
+            "path": _record_string(item, "path"),
+            "summary": _record_string(item, "summary"),
+        }
+        size_value = item.get("size_bytes")
+        if isinstance(size_value, int):
+            handle["size_bytes"] = size_value
+        payload = item.get("payload")
+        if payload is not None:
+            handle["omitted_payload"] = True
+        artifact_handles.append(handle)
+
+    enriched = dict(record)
+    enriched["artifacts"] = cast(JsonValue, artifact_handles)
+    return enriched
+
+
 def get_evidence_pack(project_dir: str, run_id: str) -> JsonObject | None:
     root = Path(project_dir)
     evidence_files = _iter_json_files(root, Path(".omg") / "evidence")
@@ -169,6 +199,7 @@ def query_evidence(
     project_dir: str,
     *,
     run_id: str | None = None,
+    profile_id: str | None = None,
     trace_id: str | None = None,
     schema: str | None = None,
     kind: str | None = None,
@@ -184,21 +215,23 @@ def query_evidence(
             if _record_matches(
                 payload,
                 run_id=run_id,
+                profile_id=profile_id,
                 trace_id=trace_id,
                 schema=schema,
                 kind=kind,
             ):
-                records.append(_record_copy_with_context_metadata(root, payload))
+                records.append(_record_copy_with_context_metadata(root, _artifact_handles_only(payload)))
 
         for row in _read_jsonl(root / rel_dir / "events.jsonl"):
             if _record_matches(
                 row,
                 run_id=run_id,
+                profile_id=profile_id,
                 trace_id=trace_id,
                 schema=schema,
                 kind=kind,
             ):
-                records.append(_record_copy_with_context_metadata(root, row))
+                records.append(_record_copy_with_context_metadata(root, _artifact_handles_only(row)))
 
     return records
 

package/runtime/evidence_requirements.py

@@ -32,7 +32,35 @@ EVIDENCE_REQUIREMENTS_BY_PROFILE: Final[dict[str, list[str]]] = {
         "lsp_clean",
         "provenance",
         "trace_link",
+        "artifact_contracts",
     ],
+    "browser-flow": [
+        "lsp_clean",
+        "trace_link",
+        "provenance",
+    ],
+    "forge-cybersecurity": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+        "artifact_contracts",
+        "security_scan",
+    ],
+    "interop-diagnosis": [
+        "lsp_clean",
+        "trace_link",
+        "provenance",
+        "trust_scores",
+    ],
+    "install-validation": [
+        "tests",
+        "lsp_clean",
+        "build",
+        "provenance",
+        "trace_link",
+    ],
+    "buffet": list(FULL_REQUIREMENTS),
     "security-audit": list(FULL_REQUIREMENTS),
     "release": list(FULL_REQUIREMENTS),
 }

package/runtime/forge_agents.py

@@ -1,14 +1,19 @@
 from __future__ import annotations
 
+import hashlib
 import importlib
 import importlib.util
 import json
 import os
+import re
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
+from runtime.domain_packs import DOMAIN_PACKS, get_domain_pack_contract
 from runtime.forge_contracts import ADAPTER_REGISTRY, load_forge_mvp, validate_forge_job
+from runtime.forge_domains import canonical_domain_for, is_valid_domain
+from runtime.forge_run_id import normalize_run_id
 from runtime.runtime_contracts import read_defense_state, read_session_health
 from runtime.security_check import run_security_check
 
@@ -33,7 +38,6 @@ _SPECIALIST_REGISTRY: dict[str, dict[str, object]] = {
 }
 
 _DOMAIN_SPECIALISTS: dict[str, list[str]] = {
-    "vision-agent": ["data-curator", "training-architect", "simulator-engineer"],
     "vision": ["data-curator", "training-architect", "simulator-engineer"],
     "robotics": ["training-architect", "simulator-engineer"],
     "algorithms": ["training-architect"],
@@ -41,9 +45,69 @@ _DOMAIN_SPECIALISTS: dict[str, list[str]] = {
     "cybersecurity": ["forge-cybersecurity"],
 }
 
+_OPERATION_SYNONYMS: dict[str, set[str]] = {
+    "add": {"add", "create", "insert", "new", "introduce", "build"},
+    "edit": {"edit", "update", "modify", "change", "adjust", "revise", "patch"},
+    "delete": {"delete", "remove", "drop", "retire", "deprecate", "decommission"},
+}
+
+_OPERATION_TEXT_KEYS: tuple[str, ...] = ("goal", "request", "prompt", "task", "summary", "description")
+
+
+def _normalize_operation_candidate(value: object) -> str:
+    candidate = str(value or "").strip().lower().replace("_", " ").replace("-", " ")
+    if not candidate:
+        return ""
+    if candidate in _OPERATION_SYNONYMS:
+        return candidate
+    for intent, synonyms in _OPERATION_SYNONYMS.items():
+        if candidate in synonyms:
+            return intent
+    return ""
+
+
+def classify_operation_intent(job: dict[str, Any]) -> dict[str, str]:
+    for key in ("operation", "intent", "change_type", "action"):
+        if key in job:
+            normalized = _normalize_operation_candidate(job.get(key))
+            if normalized:
+                return {"intent": normalized, "source": key}
+
+    for key in _OPERATION_TEXT_KEYS:
+        raw_value = str(job.get(key, "") or "")
+        text = raw_value.lower()
+        if not text:
+            continue
+        for intent, synonyms in _OPERATION_SYNONYMS.items():
+            if any(re.search(rf"\b{re.escape(token)}\b", text) for token in synonyms):
+                return {"intent": intent, "source": key}
+
+    return {"intent": "unknown", "source": "none"}
+
+
+def resolve_operation_plan(job: dict[str, Any]) -> dict[str, Any]:
+    contract = load_forge_mvp()
+    orchestration = contract.get("operation_orchestration")
+    profiles = orchestration if isinstance(orchestration, dict) else {}
+    classified = classify_operation_intent(job)
+    intent = str(classified.get("intent", "unknown"))
+    profile_raw = profiles.get(intent, profiles.get("unknown", {}))
+    profile = profile_raw if isinstance(profile_raw, dict) else {}
+    checks_raw = profile.get("required_checks")
+    required_checks = [str(entry) for entry in checks_raw] if isinstance(checks_raw, list) else []
+    return {
+        "intent": intent,
+        "source": str(classified.get("source", "none")),
+        "mode": str(profile.get("mode", "bounded_execution")),
+        "priority": str(profile.get("priority", "contract_defaults")),
+        "required_checks": required_checks,
+    }
+
 
 def resolve_specialists(domain: str) -> list[str]:
     normalized = str(domain or "").strip().lower()
+    if is_valid_domain(normalized):
+        normalized = canonical_domain_for(normalized)
     return list(_DOMAIN_SPECIALISTS.get(normalized, []))
 
 
@@ -127,11 +191,12 @@ def dispatch_specialists(job: dict[str, Any], project_dir: str, run_id: str | No
 
     specialists_dispatched = requested_specialists if requested_specialists else expected_specialists
     status = "ok" if specialists_dispatched else "noop"
-    active_run_id = run_id or _now_run_id()
+    active_run_id = normalize_run_id(run_id)
+    operation_plan = resolve_operation_plan(job)
 
     job_with_specialists = dict(job)
     job_with_specialists["specialists"] = specialists_dispatched
-    adapter_evidence = resolve_adapters(job_with_specialists)
+    adapter_evidence = resolve_adapters(job_with_specialists, operation_plan=operation_plan)
 
     backends_ok, backends_reason = check_required_backends_satisfied(adapter_evidence)
     if not backends_ok:
@@ -141,6 +206,7 @@ def dispatch_specialists(job: dict[str, Any], project_dir: str, run_id: str | No
             "evidence_path": "",
             "reason": backends_reason,
             "adapter_evidence": adapter_evidence,
+            "operation_plan": operation_plan,
         }
 
     security_scan: dict[str, Any] | None = None
@@ -156,6 +222,7 @@ def dispatch_specialists(job: dict[str, Any], project_dir: str, run_id: str | No
         expected_specialists=expected_specialists,
         requested_specialists=requested_specialists,
         specialists_dispatched=specialists_dispatched,
+        operation_plan=operation_plan,
         job=job,
         security_scan=security_scan,
     )
@@ -165,6 +232,7 @@ def dispatch_specialists(job: dict[str, Any], project_dir: str, run_id: str | No
         "run_id": active_run_id,
         "evidence_path": evidence_path,
         "adapter_evidence": adapter_evidence,
+        "operation_plan": operation_plan,
     }
     if security_scan is not None:
         result_payload["security_scan"] = security_scan
@@ -195,10 +263,6 @@ def _normalize_specialist_list(value: object) -> list[str]:
     return items
 
 
-def _now_run_id() -> str:
-    return datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%S%fZ")
-
-
 def _check_backend_available(backend_name: str) -> bool:
     entry = ADAPTER_REGISTRY.get(backend_name)
     if entry is None:
@@ -220,7 +284,150 @@ def _check_simulator_available(name: str) -> bool:
     return _check_backend_available(name)
 
 
-def resolve_adapters(job: dict[str, Any]) -> list[dict[str, object]]:
+def _resolve_simulator_adapter(job: dict[str, Any], *, backend: str, required: bool) -> dict[str, object]:
+    adapter_hooks: dict[str, str] = {
+        "pybullet": "lab.pybullet_adapter",
+        "gazebo": "lab.gazebo_adapter",
+        "isaac_gym": "lab.isaac_gym_adapter",
+    }
+    module_name = adapter_hooks.get(backend)
+    if not module_name:
+        return {
+            "adapter": backend,
+            "kind": "simulator",
+            "status": "error",
+            "required": required,
+            "reason": f"unknown simulator backend: {backend}",
+            "available": False,
+        }
+
+    module = importlib.import_module(module_name)
+    run_adapter = getattr(module, "run")
+
+    run_id = str(job.get("run_id", "")).strip() or None
+    sandbox_root = str(job.get("project_dir", "."))
+    raw_timeout = job.get("simulator_timeout_seconds", 30)
+    try:
+        timeout_seconds = max(1, int(raw_timeout))
+    except (TypeError, ValueError):
+        timeout_seconds = 30
+
+    evidence = run_adapter(
+        job,
+        backend_mode="live",
+        run_id=run_id,
+        timeout_seconds=timeout_seconds,
+        sandbox_root=sandbox_root,
+    )
+    status = str(evidence.get("status", "error"))
+    if not required and status == "unavailable_backend":
+        status = "skipped_unavailable_backend"
+    normalized: dict[str, object] = {
+        "adapter": backend,
+        "kind": "simulator",
+        "status": status,
+        "required": required,
+        "reason": str(evidence.get("reason", "")),
+        "available": bool(evidence.get("available", False)),
+    }
+    for key in (
+        "backend",
+        "seed",
+        "episode_stats",
+        "replay_metadata",
+        "availability_reason",
+        "fidelity_backend",
+        "throughput_role",
+        "run_id",
+    ):
+        if key in evidence:
+            normalized[key] = evidence[key]
+    normalized["promotion_blocked"] = bool(required and status in {"unavailable_backend", "skipped_unavailable_backend", "error", "blocked"})
+    if not required:
+        normalized["promotion_blocked"] = False
+    return normalized
+
+
+def _resolve_axolotl_mode(job: dict[str, Any]) -> str:
+    explicit_mode = str(job.get("axolotl_mode", "")).strip().lower()
+    if explicit_mode:
+        return explicit_mode
+    reward_heads = job.get("reward_heads")
+    if isinstance(reward_heads, bool):
+        return "live_sft"
+    if isinstance(reward_heads, (int, float)):
+        count = int(reward_heads)
+    elif isinstance(reward_heads, list):
+        count = len(reward_heads)
+    elif isinstance(reward_heads, dict):
+        count = len(reward_heads)
+    elif isinstance(reward_heads, str) and reward_heads.strip().isdigit():
+        count = int(reward_heads.strip())
+    else:
+        count = 0
+    if count > 1:
+        return "live_gdpo"
+    if count == 1:
+        return "live_grpo"
+    return "live_sft"
+
+
+def _resolve_axolotl_adapter(job: dict[str, Any], *, required: bool) -> dict[str, object]:
+    from lab.axolotl_adapter import run as run_axolotl_adapter
+
+    mode = _resolve_axolotl_mode(job)
+    run_id = str(job.get("run_id", "")).strip() or None
+    sandbox_root = str(job.get("project_dir", "."))
+    raw_timeout = job.get("axolotl_timeout_seconds", 30)
+    try:
+        timeout_seconds = max(1, int(raw_timeout))
+    except (TypeError, ValueError):
+        timeout_seconds = 30
+
+    evidence = run_axolotl_adapter(
+        job,
+        backend_mode=mode,
+        run_id=run_id,
+        timeout_seconds=timeout_seconds,
+        sandbox_root=sandbox_root,
+    )
+
+    status = str(evidence.get("status", "error"))
+    reason = str(evidence.get("reason", ""))
+    available = bool(evidence.get("available", False))
+
+    if not required and status == "unavailable_backend":
+        status = "skipped_unavailable_backend"
+
+    normalized: dict[str, object] = {
+        "adapter": "axolotl",
+        "kind": "training",
+        "status": status,
+        "required": required,
+        "reason": reason,
+        "available": available,
+        "mode": str(evidence.get("mode", mode)),
+    }
+    for key in (
+        "run_id",
+        "evidence_path",
+        "checkpoint_path",
+        "checkpoint_paths",
+        "checkpoint_artifacts",
+        "search_scores",
+        "search_best_trial",
+        "resume_metadata",
+        "sidecar_required",
+        "sidecar_evidence_path",
+    ):
+        if key in evidence:
+            normalized[key] = evidence[key]
+    if "promotion_blocked" in evidence:
+        normalized["promotion_blocked"] = evidence["promotion_blocked"] if required else False
+    return normalized
+
+
+def resolve_adapters(job: dict[str, Any], operation_plan: dict[str, Any] | None = None) -> list[dict[str, object]]:
     results: list[dict[str, object]] = []
     dispatched_specialists = job.get("specialists", [])
     if not isinstance(dispatched_specialists, list):
@@ -230,29 +437,24 @@ def resolve_adapters(job: dict[str, Any]) -> list[dict[str, object]]:
     require_backend = bool(job.get("require_backend", False))
 
     if "training-architect" in dispatched_specialists:
-        available = _check_axolotl_available()
-        results.append({
-            "adapter": "axolotl",
-            "kind": "training",
-            "status": "invoked" if available else "skipped_unavailable_backend",
-            "required": require_backend and requested_backend == "axolotl",
-            "reason": "" if available else "axolotl not installed",
-            "available": available,
-        })
+        axolotl_required = require_backend and requested_backend == "axolotl"
+        results.append(_resolve_axolotl_adapter(job, required=axolotl_required))
 
     if "simulator-engineer" in dispatched_specialists:
         simulator_backends = _resolve_simulator_backends(requested_backend)
         for backend in simulator_backends:
-            available = _check_simulator_available(backend)
             is_required = require_backend and requested_backend == backend
-            results.append({
-                "adapter": backend,
-                "kind": "simulator",
-                "status": "invoked" if available else "skipped_unavailable_backend",
-                "required": is_required,
-                "reason": "" if available else f"{backend} not installed",
-                "available": available,
-            })
+            results.append(_resolve_simulator_adapter(job, backend=backend, required=is_required))
+
+    if operation_plan is not None:
+        for evidence in results:
+            evidence["orchestration"] = {
+                "operation_plan": {
+                    "intent": str(operation_plan.get("intent", "unknown")),
+                    "mode": str(operation_plan.get("mode", "bounded_execution")),
+                    "priority": str(operation_plan.get("priority", "contract_defaults")),
+                }
+            }
 
     return results
 
@@ -266,8 +468,16 @@ def _resolve_simulator_backends(requested: str) -> list[str]:
 
 
 def check_required_backends_satisfied(adapter_evidence: list[dict[str, object]]) -> tuple[bool, str]:
+    unavailable_statuses = {
+        "skipped_unavailable_backend",
+        "unavailable",
+        "unavailable_backend",
+        "error",
+        "blocked",
+    }
     for ev in adapter_evidence:
-        if ev.get("required") is True and ev.get("status") == "skipped_unavailable_backend":
+        status = str(ev.get("status", ""))
+        if ev.get("required") is True and status in unavailable_statuses:
             adapter_name = str(ev.get("adapter", "unknown"))
             return False, f"required backend unavailable: {adapter_name}"
     return True, "ok"
@@ -283,6 +493,7 @@ def _write_dispatch_evidence(
     expected_specialists: list[str],
     requested_specialists: list[str],
     specialists_dispatched: list[str],
+    operation_plan: dict[str, Any],
     job: dict[str, Any],
     security_scan: dict[str, Any] | None = None,
 ) -> str:
@@ -290,6 +501,8 @@ def _write_dispatch_evidence(
     evidence_dir.mkdir(parents=True, exist_ok=True)
     evidence_path = evidence_dir / f"forge-specialists-{run_id}.json"
     contract = load_forge_mvp()
+    context_checksum = hashlib.sha256(json.dumps(job, sort_keys=True).encode()).hexdigest()
+    domain_pack = get_domain_pack_contract(domain) if domain in DOMAIN_PACKS else {}
     payload: dict[str, Any] = {
         "schema": "ForgeSpecialistDispatchEvidence",
         "schema_version": "1.0.0",
@@ -303,6 +516,7 @@ def _write_dispatch_evidence(
         "requested_specialists": requested_specialists,
         "expected_specialists": expected_specialists,
         "specialists_dispatched": specialists_dispatched,
+        "operation_plan": operation_plan,
         "contract": {
             "labs_only": bool(contract.get("labs_only", True)),
             "axolotl_hook": contract.get("axolotl_hook", ""),
@@ -316,8 +530,55 @@ def _write_dispatch_evidence(
             "verification_status": status,
         },
         "job": job,
+        "context_checksum": context_checksum,
+        "profile_version": "forge-run-v1",
+        "intent_gate_version": "1.0.0",
+        "domain_pack": domain_pack,
+        "artifact_contracts": {
+            "dataset_lineage": {
+                "standard": "Croissant-1.1",
+                "path": f".omg/evidence/forge-lineage-{run_id}.json",
+                "status": "pending_verification",
+                "reason": "dataset lineage artifact not yet generated",
+            },
+            "model_card": {
+                "standard": "HuggingFace-ModelCard",
+                "path": f".omg/evidence/forge-model-card-{run_id}.md",
+                "status": "pending_verification",
+                "reason": "model card artifact not yet generated",
+            },
+            "checkpoint_hash": {
+                "standard": "OpenSSF-OMS",
+                "path": f".omg/evidence/forge-checkpoint-{run_id}.json",
+                "status": "pending_verification",
+                "reason": "checkpoint hash artifact not yet generated",
+            },
+            "regression_scoreboard": {
+                "standard": "lm-eval",
+                "path": f".omg/evidence/forge-scoreboard-{run_id}.json",
+                "status": "insufficient_evidence",
+                "reason": "regression scoreboard artifact not yet generated",
+            },
+            "promotion_decision": {
+                "status": "pending",
+                "reason": "promotion requires passing regression scoreboard and human review for health domain",
+                "replay_required": True,
+            },
+        },
     }
 
+    if domain == "cybersecurity":
+        evidence_dir = evidence_path.parent
+        security_links: list[str] = []
+        for pattern in ("security-*.json", "security-*.sarif"):
+            security_links.extend(
+                f".omg/evidence/{p.name}" for p in sorted(evidence_dir.glob(pattern))
+            )
+        payload["security_evidence_links"] = security_links if security_links else [
+            ".omg/evidence/security-*.json",
+            ".omg/evidence/security-*.sarif",
+        ]
+
     if security_scan is not None:
         payload["security_scan"] = security_scan