@trac3er/oh-my-god 2.1.4 → 2.1.7

package/runtime/forge_contracts.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import hashlib
 import json
 import os
 from collections.abc import Mapping
@@ -9,6 +10,8 @@ from time import monotonic
 from typing import cast
 
 from lab.policies import validate_job_request
+from runtime.domain_packs import DOMAIN_PACKS, get_domain_pack_contract
+from runtime.forge_domains import canonical_domain_for, get_all_canonical_domains, is_valid_domain
 from runtime.runtime_contracts import read_defense_state, read_session_health
 
 FORGE_STAGE_ORDER: tuple[str, ...] = (
@@ -27,6 +30,52 @@ DEFAULT_STAGE_TIMEOUT_MS: dict[str, int] = {
     "regression_test": 5_000,
 }
 
+AXOLOTL_LIVE_MODES: tuple[str, ...] = (
+    "preflight",
+    "live_sft",
+    "live_grpo",
+    "live_gdpo",
+)
+
+AXOLOTL_SEARCH_POLICY: dict[str, object] = {
+    "max_trials": 6,
+    "space": {
+        "learning_rate": [1e-5, 3e-5, 1e-4],
+        "batch_size": [4, 8],
+        "lora_rank": [8, 16, 32],
+        "grad_accum": [1, 2, 4],
+    },
+}
+
+OPERATION_ORCHESTRATION_PROFILES: dict[str, dict[str, object]] = {
+    "add": {
+        "mode": "incremental_extension",
+        "priority": "scope_safeguards",
+        "required_checks": ["schema_alignment", "backward_compatibility"],
+    },
+    "edit": {
+        "mode": "targeted_refinement",
+        "priority": "change_precision",
+        "required_checks": ["delta_scope", "regression_surface"],
+    },
+    "delete": {
+        "mode": "controlled_removal",
+        "priority": "safety_first",
+        "required_checks": ["dependency_impact", "rollback_path"],
+    },
+    "unknown": {
+        "mode": "bounded_execution",
+        "priority": "contract_defaults",
+        "required_checks": ["domain_contract"],
+    },
+}
+
+
+def _normalize_required_checks(value: object) -> list[str]:
+    if not isinstance(value, list):
+        return []
+    return [str(check) for check in value if isinstance(check, str)]
+
 
 ADAPTER_REGISTRY: dict[str, dict[str, object]] = {
     "axolotl": {
@@ -34,6 +83,13 @@ ADAPTER_REGISTRY: dict[str, dict[str, object]] = {
         "module": "axolotl",
         "hook": "lab.axolotl_adapter.run",
         "specialist": "training-architect",
+        "modes": list(AXOLOTL_LIVE_MODES),
+        "default_mode": "live_sft",
+        "rl_sidecar_required": {
+            "live_grpo": True,
+            "live_gdpo": True,
+        },
+        "search_policy": dict(AXOLOTL_SEARCH_POLICY),
     },
     "pybullet": {
         "kind": "simulator",
@@ -84,6 +140,14 @@ def load_forge_mvp() -> dict[str, object]:
             "security_review": "regression_test",
             "threat_model": "evaluate",
         },
+        "operation_orchestration": {
+            intent: {
+                "mode": str(profile.get("mode", "bounded_execution")),
+                "priority": str(profile.get("priority", "contract_defaults")),
+                "required_checks": _normalize_required_checks(profile.get("required_checks")),
+            }
+            for intent, profile in OPERATION_ORCHESTRATION_PROFILES.items()
+        },
         "specialist_contracts": {
             "forge-cybersecurity": {
                 "labs_only": True,
@@ -101,6 +165,8 @@ def load_forge_mvp() -> dict[str, object]:
             },
         },
         "adapter_registry": dict(ADAPTER_REGISTRY),
+        "axolotl_search_policy": dict(AXOLOTL_SEARCH_POLICY),
+        "canonical_domains": get_all_canonical_domains(),
         "evidence_output_path": ".omg/evidence/forge-<run_id>.json",
         "starter_templates": {
             "vision-agent": {
@@ -143,6 +209,14 @@ def load_forge_mvp() -> dict[str, object]:
 
 
 def validate_forge_job(job: dict[str, object]) -> tuple[bool, str]:
+    domain = job.get("domain")
+    if not domain or not str(domain).strip():
+        return False, "domain missing: forge run requires an explicit canonical domain (e.g. 'vision', 'robotics')"
+    if not is_valid_domain(str(domain)):
+        valid = sorted(get_all_canonical_domains())
+        return False, f"unknown domain: {domain!r}. Valid domains: {valid}"
+    job["domain"] = canonical_domain_for(str(domain))
+
     ok, reason = validate_job_request(job)
     if not ok:
         return False, reason
@@ -264,6 +338,47 @@ def build_forge_evidence(
                 if isinstance(item, Mapping)
             ]
 
+    job_dict = dict(job)
+    base_model_name = "unknown"
+    base_model_raw = job.get("base_model")
+    if isinstance(base_model_raw, Mapping):
+        base_model_name = str(base_model_raw.get("name", "unknown"))
+
+    evaluation_metric = 0.0
+    evaluation_report = result.get("evaluation_report")
+    if isinstance(evaluation_report, Mapping):
+        metric_raw = evaluation_report.get("metric", 0.0)
+        if isinstance(metric_raw, bool):
+            evaluation_metric = 0.0
+        elif isinstance(metric_raw, (int, float)):
+            evaluation_metric = float(metric_raw)
+        elif isinstance(metric_raw, str):
+            try:
+                evaluation_metric = float(metric_raw)
+            except ValueError:
+                evaluation_metric = 0.0
+
+    target_metric = 0.0
+    target_metric_raw = job.get("target_metric", 0.0)
+    if isinstance(target_metric_raw, bool):
+        target_metric = 0.0
+    elif isinstance(target_metric_raw, (int, float)):
+        target_metric = float(target_metric_raw)
+    elif isinstance(target_metric_raw, str):
+        try:
+            target_metric = float(target_metric_raw)
+        except ValueError:
+            target_metric = 0.0
+
+    context_checksum = hashlib.sha256(json.dumps(job_dict, sort_keys=True).encode()).hexdigest()
+    domain_pack = get_domain_pack_contract(domain) if domain in DOMAIN_PACKS else {}
+    artifact_contracts = _resolve_artifact_contracts(
+        run_id=run_id,
+        result=result,
+        evaluation_metric=evaluation_metric,
+        target_metric=target_metric,
+        base_model_name=base_model_name,
+    )
     payload = {
         "schema": "ForgeMVPEvidence",
         "schema_version": "1.0.0",
@@ -286,9 +401,101 @@ def build_forge_evidence(
             "delta_summary": {"forge_run": run_id, "domain": domain, "specialist": specialist_str},
             "verification_status": str(result.get("status", "unknown")),
         },
+        "context_checksum": context_checksum,
+        "profile_version": "forge-run-v1",
+        "intent_gate_version": "1.0.0",
+        "domain_pack": domain_pack,
+        "artifact_contracts": artifact_contracts,
     }
 
+    if domain == "cybersecurity":
+        evidence_dir = out_path.parent
+        security_links: list[str] = []
+        for pattern in ("security-*.json", "security-*.sarif"):
+            security_links.extend(
+                f".omg/evidence/{p.name}" for p in sorted(evidence_dir.glob(pattern))
+            )
+        payload["security_evidence_links"] = security_links if security_links else [
+            ".omg/evidence/security-*.json",
+            ".omg/evidence/security-*.sarif",
+        ]
+
     tmp_path = out_path.with_name(f"{out_path.name}.tmp")
     _ = tmp_path.write_text(json.dumps(payload, indent=2, ensure_ascii=True), encoding="utf-8")
     _ = os.rename(tmp_path, out_path)
     return str(out_path)
+
+
+def _resolve_artifact_contracts(
+    *,
+    run_id: str,
+    result: Mapping[str, object],
+    evaluation_metric: float,
+    target_metric: float,
+    base_model_name: str,
+) -> dict[str, object]:
+    result_contracts = result.get("artifact_contracts")
+    if isinstance(result_contracts, Mapping):
+        normalized = {str(key): value for key, value in result_contracts.items()}
+        if "dataset_lineage" not in normalized:
+            normalized["dataset_lineage"] = {
+                "standard": "Croissant-1.1",
+                "path": f".omg/evidence/forge-lineage-{run_id}.json",
+                "status": "pending_verification",
+                "lineage_hash": hashlib.sha256(f"lineage-{run_id}".encode()).hexdigest(),
+                "deterministic_metadata": True,
+            }
+        if "model_card" not in normalized:
+            normalized["model_card"] = {
+                "standard": "HuggingFace-ModelCard",
+                "path": f".omg/evidence/forge-model-card-{run_id}.md",
+                "status": "pending_verification",
+                "model_id": f"forge-model-{run_id}",
+                "base_model": base_model_name,
+            }
+        if "checkpoint_hash" not in normalized:
+            normalized["checkpoint_hash"] = {
+                "standard": "OpenSSF-OMS",
+                "path": f".omg/evidence/forge-checkpoint-{run_id}.json",
+                "status": "pending_verification",
+                "sha256": hashlib.sha256(f"checkpoint-{run_id}".encode()).hexdigest(),
+                "algorithm": "sha256",
+            }
+        return normalized
+
+    return {
+        "dataset_lineage": {
+            "standard": "Croissant-1.1",
+            "path": f".omg/evidence/forge-lineage-{run_id}.json",
+            "status": "pending_verification",
+            "lineage_hash": hashlib.sha256(f"lineage-{run_id}".encode()).hexdigest(),
+            "deterministic_metadata": True,
+        },
+        "model_card": {
+            "standard": "HuggingFace-ModelCard",
+            "path": f".omg/evidence/forge-model-card-{run_id}.md",
+            "status": "pending_verification",
+            "model_id": f"forge-model-{run_id}",
+            "base_model": base_model_name,
+        },
+        "checkpoint_hash": {
+            "standard": "OpenSSF-OMS",
+            "path": f".omg/evidence/forge-checkpoint-{run_id}.json",
+            "status": "pending_verification",
+            "sha256": hashlib.sha256(f"checkpoint-{run_id}".encode()).hexdigest(),
+            "algorithm": "sha256",
+        },
+        "regression_scoreboard": {
+            "standard": "lm-eval",
+            "path": f".omg/evidence/forge-scoreboard-{run_id}.json",
+            "status": "insufficient_evidence",
+            "score": evaluation_metric,
+            "target": target_metric,
+        },
+        "promotion_decision": {
+            "status": "pending",
+            "decision_id": f"dec-{run_id}",
+            "reason": "promotion requires passing regression scoreboard and human review for health domain",
+            "replay_required": True,
+        },
+    }

package/runtime/forge_domains.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from typing import Any
+
+
+CANONICAL_DOMAINS: dict[str, dict[str, Any]] = {
+    "vision": {
+        "canonical_id": "vision",
+        "aliases": ["vision-agent"],
+        "display_label": "Vision Agent",
+        "starter_template_id": "vision-agent",
+    },
+    "robotics": {
+        "canonical_id": "robotics",
+        "aliases": [],
+        "display_label": "Robotics",
+        "starter_template_id": "robotics",
+    },
+    "algorithms": {
+        "canonical_id": "algorithms",
+        "aliases": [],
+        "display_label": "Algorithms",
+        "starter_template_id": "algorithms",
+    },
+    "health": {
+        "canonical_id": "health",
+        "aliases": [],
+        "display_label": "Health",
+        "starter_template_id": "health",
+    },
+    "cybersecurity": {
+        "canonical_id": "cybersecurity",
+        "aliases": [],
+        "display_label": "Cybersecurity",
+        "starter_template_id": "cybersecurity",
+    },
+}
+
+# Build reverse alias map: alias -> canonical_id
+_ALIAS_MAP: dict[str, str] = {}
+for _canonical_id, _entry in CANONICAL_DOMAINS.items():
+    _ALIAS_MAP[_canonical_id] = _canonical_id
+    for _alias in _entry["aliases"]:
+        _ALIAS_MAP[_alias] = _canonical_id
+
+
+def canonical_domain_for(name: str) -> str:
+    """Resolve a domain name or alias to its canonical domain ID.
+
+    Raises ValueError for unknown domains.
+    """
+    normalized = str(name or "").strip().lower()
+    if normalized not in _ALIAS_MAP:
+        raise ValueError(
+            f"Unknown domain: {name!r}. Valid domains: {sorted(CANONICAL_DOMAINS.keys())}"
+        )
+    return _ALIAS_MAP[normalized]
+
+
+def is_valid_domain(name: str) -> bool:
+    """Return True if name is a canonical domain ID or a known alias."""
+    normalized = str(name or "").strip().lower()
+    return normalized in _ALIAS_MAP
+
+
+def get_all_canonical_domains() -> list[str]:
+    """Return list of all canonical domain IDs."""
+    return list(CANONICAL_DOMAINS.keys())

package/runtime/forge_run_id.py

@@ -0,0 +1,86 @@
+"""Canonical run identity generation and validation for Forge."""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import hashlib
+
+
+DETERMINISM_VERSION = "forge-determinism-v1"
+DETERMINISM_SCOPE = "same-hardware"
+_TEMPERATURE_LOCK = {
+    "critical_model_paths": 0.0,
+    "critical_tool_paths": 0.0,
+}
+
+
+def generate_run_id() -> str:
+    """Generate a compact UTC timestamp-based run ID.
+    
+    Format: YYYYMMDDTHHMMSSfffffZ (e.g., 20260309T143022123456Z)
+    
+    Returns:
+        str: Compact UTC format run ID.
+    """
+    return datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%S%fZ")
+
+
+def derive_run_seed(run_id: str) -> int:
+    is_valid, reason = validate_run_id(run_id)
+    if not is_valid:
+        raise ValueError(f"invalid run_id for deterministic seed derivation: {reason}")
+
+    digest = hashlib.sha256(run_id.encode("utf-8")).digest()
+    return int.from_bytes(digest[:8], byteorder="big", signed=False)
+
+
+def build_deterministic_contract(run_id: str) -> dict[str, object]:
+    return {
+        "seed": derive_run_seed(run_id),
+        "temperature_lock": dict(_TEMPERATURE_LOCK),
+        "determinism_version": DETERMINISM_VERSION,
+        "determinism_scope": DETERMINISM_SCOPE,
+    }
+
+
+def validate_run_id(run_id: str) -> tuple[bool, str]:
+    """Validate run ID format and constraints.
+    
+    Valid run IDs:
+    - Non-empty
+    - Alphanumeric + hyphens only (no spaces, special chars)
+    - Max 128 characters
+    
+    Args:
+        run_id: The run ID to validate.
+        
+    Returns:
+        tuple[bool, str]: (is_valid, reason). If valid, reason is empty string.
+    """
+    if not run_id:
+        return False, "run_id must be non-empty"
+    
+    if len(run_id) > 128:
+        return False, f"run_id exceeds 128 characters: {len(run_id)}"
+    
+    # Allow alphanumeric and hyphens only
+    if not all(c.isalnum() or c == "-" for c in run_id):
+        return False, "run_id must contain only alphanumeric characters and hyphens"
+    
+    return True, ""
+
+
+def normalize_run_id(run_id: str | None) -> str:
+    """Normalize run ID: use provided if valid, else generate new one.
+    
+    Args:
+        run_id: Optional run ID. If None or invalid, a new one is generated.
+        
+    Returns:
+        str: Valid run ID (either the provided one or a newly generated one).
+    """
+    if run_id:
+        is_valid, _ = validate_run_id(run_id)
+        if is_valid:
+            return run_id
+    
+    return generate_run_id()

package/runtime/mcp_memory_server.py

@@ -2,8 +2,10 @@ from __future__ import annotations
 
 import json
 import os
+import hashlib
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
+from datetime import datetime, timezone
 from typing import Any
 
 _MCP_IMPORT_ERROR: ModuleNotFoundError | None = None
@@ -75,26 +77,39 @@ def memory_store(
     content: str,
     source_cli: str,
     tags: list[str] | None = None,
+    namespace: str = "default",
+    retention_days: int | None = None,
 ) -> dict[str, Any]:
     try:
-        return _store.add(key=key, content=content, source_cli=source_cli, tags=tags)
+        return _store.add(
+            key=key,
+            content=content,
+            source_cli=source_cli,
+            tags=tags,
+            namespace=namespace,
+            retention_days=retention_days,
+        )
     except MemoryStoreFullError as exc:
         return {"error": str(exc)}
+    except ValueError as exc:
+        return {"error": str(exc)}
 
 
 @mcp.tool()
 def memory_search(
     query: str,
     source_cli: str | None = None,
+    namespace: str | None = None,
 ) -> list[dict[str, Any]]:
-    return _store.search(query=query, source_cli=source_cli)
+    return _store.search(query=query, source_cli=source_cli, namespace=namespace)
 
 
 @mcp.tool()
 def memory_list(
     source_cli: str | None = None,
+    namespace: str | None = None,
 ) -> list[dict[str, Any]]:
-    return _store.list_all(source_cli=source_cli)
+    return _store.list_all(source_cli=source_cli, namespace=namespace)
 
 
 @mcp.tool()
@@ -105,13 +120,60 @@ def memory_delete(item_id: str) -> dict[str, Any]:
 
 @mcp.tool()
 def memory_import(items: list[dict[str, Any]]) -> dict[str, int]:
-    count = _store.import_items(items)
+    count = _store.import_items(items, quarantined=True)
     return {"imported": count}
 
 
 @mcp.tool()
-def memory_export() -> list[dict[str, Any]]:
-    return _store.export_all()
+def memory_import_bundle(bundle: dict[str, Any]) -> dict[str, Any]:
+    if str(bundle.get("format", "")) != "omg.memory.export.v1":
+        return {"imported": 0, "error": "bundle format is invalid"}
+    payload = str(bundle.get("encrypted_payload", ""))
+    integrity = bundle.get("integrity", {})
+    expected_sha = ""
+    if isinstance(integrity, dict):
+        expected_sha = str(integrity.get("sha256", ""))
+    if not payload or hashlib.sha256(payload.encode("utf-8")).hexdigest() != expected_sha:
+        return {"imported": 0, "error": "bundle integrity check failed"}
+    if not payload.startswith("enc:v1:"):
+        return {"imported": 0, "error": "bundle payload must be encrypted"}
+    decoded = _store._decrypt_text(payload, purpose="export-bundle")  # noqa: SLF001
+    if not decoded:
+        return {"imported": 0, "error": "bundle decryption failed"}
+    try:
+        raw_items = json.loads(decoded)
+    except (TypeError, ValueError, json.JSONDecodeError):
+        return {"imported": 0, "error": "bundle payload is not valid JSON"}
+    if not isinstance(raw_items, list):
+        return {"imported": 0, "error": "bundle payload must be a list"}
+    count = _store.import_items(raw_items, quarantined=True)
+    return {"imported": count, "quarantined": count}
+
+
+@mcp.tool()
+def memory_export(namespace: str | None = None) -> dict[str, Any]:
+    items = _store.list_all(namespace=namespace)
+    serialized = json.dumps(items, separators=(",", ":"), ensure_ascii=True)
+    encrypted_payload = _store._encrypt_text(serialized, purpose="export-bundle")  # noqa: SLF001
+    return {
+        "format": "omg.memory.export.v1",
+        "encrypted_payload": encrypted_payload,
+        "integrity": {
+            "sha256": hashlib.sha256(encrypted_payload.encode("utf-8")).hexdigest(),
+            "algorithm": "sha256",
+        },
+        "metadata": {
+            "count": len(items),
+            "exported_at": datetime.now(timezone.utc).isoformat(),
+            "namespace": namespace,
+        },
+    }
+
+
+@mcp.tool()
+def memory_promote(item_id: str) -> dict[str, Any]:
+    promoted = _store.promote_item(item_id)
+    return {"promoted": promoted, "id": item_id}
 
 
 @mcp.resource("memory://all")