@trac3er/oh-my-god 2.1.4 → 2.1.7

package/runtime/mutation_gate.py

@@ -43,7 +43,7 @@ def check_mutation_allowed(
     explicit_exempt = bool(metadata_obj.get("exempt") is True)
     strict_mode = os.environ.get("OMG_TDD_GATE_STRICT", "0").strip() == "1"
 
-    if explicit_exempt:
+    if explicit_exempt and (normalized_exemption in _EXEMPTIONS or metadata_obj.get("exempt_reason")):
         return {
             "status": "exempt",
             "reason": "metadata exemption allows mutation without lock",
@@ -86,6 +86,7 @@ def check_mutation_allowed(
             "lock_id": normalized_lock_id,
         }
 
+    _write_warning_artifact(project_dir, normalized_tool, normalized_file_path, reason)
     warnings.warn(
         f"mutation_gate_permissive_allow:{normalized_tool}:{reason}",
         RuntimeWarning,
@@ -109,6 +110,25 @@ def _is_mutation_capable_bash(command: str) -> bool:
     return False
 
 
+def _write_warning_artifact(project_dir: str, tool: str, file_path: str, reason: str) -> None:
+    state_dir = Path(project_dir) / ".omg" / "state" / "mutation_gate"
+    state_dir.mkdir(parents=True, exist_ok=True)
+
+    path_hash = sha256(file_path.encode("utf-8")).hexdigest()[:8]
+    artifact_path = state_dir / f"warn-{path_hash}.json"
+    payload = {
+        "status": "warning",
+        "tool": tool,
+        "file_path": file_path,
+        "reason": reason,
+        "ts": datetime.now(timezone.utc).isoformat(),
+    }
+
+    temp_path = artifact_path.with_suffix(".tmp")
+    temp_path.write_text(json.dumps(payload, sort_keys=True, indent=2), encoding="utf-8")
+    os.replace(temp_path, artifact_path)
+
+
 def _write_block_artifact(project_dir: str, tool: str, file_path: str, reason: str) -> None:
     state_dir = Path(project_dir) / ".omg" / "state" / "mutation_gate"
     state_dir.mkdir(parents=True, exist_ok=True)

package/runtime/omg_compat_contract_snapshot.json

@@ -1,6 +1,6 @@
 {
   "schema": "OmgCompatContractSnapshot",
-  "contract_version": "2.1.4",
+  "contract_version": "2.1.7",
   "count": 47,
   "contracts": [
     {
@@ -913,4 +913,4 @@
     }
   ],
   "generated_at": "2026-03-09T21:20:44.496932+00:00"
-}
+}

package/runtime/profile_io.py

@@ -292,3 +292,37 @@ def _coerce_decay_score(raw: Any) -> float:
     if score > 1.0:
         return 1.0
     return round(score, 3)
+
+
+def assess_profile_risk(profile: dict[str, Any]) -> dict[str, Any]:
+    governed_obj = profile.get("governed_preferences")
+    governed = governed_obj if isinstance(governed_obj, dict) else {}
+
+    style_entries = governed.get("style", [])
+    style_entries = style_entries if isinstance(style_entries, list) else []
+    safety_entries = governed.get("safety", [])
+    safety_entries = safety_entries if isinstance(safety_entries, list) else []
+
+    destructive: list[dict[str, Any]] = []
+    pending = 0
+
+    for entry in style_entries + safety_entries:
+        if not isinstance(entry, dict):
+            continue
+        field = str(entry.get("field", ""))
+        value = str(entry.get("value", ""))
+        if is_destructive_preference(field, value):
+            destructive.append(entry)
+        if str(entry.get("confirmation_state", "")).strip() == "pending_confirmation":
+            pending += 1
+
+    risk_level = "low"
+    if destructive or pending > 0:
+        risk_level = "high" if destructive else "medium"
+
+    return {
+        "risk_level": risk_level,
+        "destructive_entries": destructive,
+        "pending_confirmations": pending,
+        "requires_review": risk_level in ("medium", "high"),
+    }

package/runtime/proof_chain.py

@@ -5,6 +5,8 @@ import json
 from pathlib import Path
 from typing import Any
 
+from runtime.forge_run_id import build_deterministic_contract
+
 
 _REQUIRED_ARTIFACT_FIELDS = ("kind", "path", "sha256", "parser", "summary", "trace_id")
 
@@ -76,6 +78,64 @@ def _artifact_record(*, kind: str, path: str, parser: str, summary: str, trace_i
     }
 
 
+def _is_promotion_path(claims: Any) -> bool:
+    if not isinstance(claims, list):
+        return False
+    for item in claims:
+        if not isinstance(item, dict):
+            continue
+        claim_type = str(item.get("claim_type", "")).strip().lower()
+        if claim_type in {"release_ready", "promotion_ready", "publish_ready"}:
+            return True
+    return False
+
+
+def _is_seed(value: Any) -> bool:
+    return isinstance(value, int) and not isinstance(value, bool)
+
+
+def _is_temperature_lock(value: Any) -> bool:
+    if not isinstance(value, dict):
+        return False
+    model_lock = value.get("critical_model_paths")
+    tool_lock = value.get("critical_tool_paths")
+    if not isinstance(model_lock, (int, float)):
+        return False
+    if not isinstance(tool_lock, (int, float)):
+        return False
+    return True
+
+
+def _validate_determinism_contract(chain: dict[str, Any]) -> list[str]:
+    blockers: list[str] = []
+    if not _is_promotion_path(chain.get("claims", [])):
+        return blockers
+
+    seed = chain.get("seed")
+    temperature_lock = chain.get("temperature_lock")
+    determinism_version = str(chain.get("determinism_version", "")).strip()
+
+    if not _is_seed(seed):
+        blockers.append("proof_chain_missing_deterministic_seed")
+    if not _is_temperature_lock(temperature_lock):
+        blockers.append("proof_chain_missing_temperature_lock")
+    if not determinism_version:
+        blockers.append("proof_chain_missing_determinism_version")
+
+    run_id = str(chain.get("run_id", "")).strip()
+    if blockers or not run_id:
+        return blockers
+
+    expected = build_deterministic_contract(run_id)
+    if seed != expected.get("seed"):
+        blockers.append("proof_chain_deterministic_seed_mismatch")
+    if determinism_version != expected.get("determinism_version"):
+        blockers.append("proof_chain_determinism_version_mismatch")
+    if temperature_lock != expected.get("temperature_lock"):
+        blockers.append("proof_chain_temperature_lock_mismatch")
+    return blockers
+
+
 def _build_chain_artifacts(
     *,
     output_root: Path,
@@ -128,6 +188,35 @@ def _build_chain_artifacts(
     return artifacts
 
 
+def _resolve_attestation_reference(evidence_payload: dict[str, Any]) -> dict[str, Any]:
+    direct_path = str(
+        evidence_payload.get("attestation_statement_path")
+        or evidence_payload.get("attestation_path")
+        or ""
+    ).strip()
+    if direct_path:
+        return {"path": direct_path, "schema": "InTotoStatement"}
+
+    records = evidence_payload.get("artifact_attestations")
+    if isinstance(records, list):
+        for item in records:
+            if not isinstance(item, dict):
+                continue
+            path = str(item.get("statement_path", "")).strip()
+            if not path:
+                continue
+            return {
+                "path": path,
+                "schema": str(item.get("schema", "InTotoStatement")) or "InTotoStatement",
+                "artifact_path": str(item.get("artifact_path", "")).strip(),
+                "signature_path": str(item.get("signature_path", "")).strip(),
+                "signer_key_id": str(item.get("signer_key_id", "")).strip(),
+                "algorithm": str(item.get("algorithm", "")).strip(),
+                "signer": item.get("signer"),
+            }
+    return {}
+
+
 def _latest_evidence_pack(output_root: Path) -> tuple[str, dict[str, Any]]:
     evidence_dir = output_root / ".omg" / "evidence"
     if not evidence_dir.exists():
@@ -180,9 +269,34 @@ def assemble_proof_chain(project_dir: str, *, evidence_path: str | None = None)
     if not eval_id and trace_id:
         eval_id = f"eval-{hashlib.sha256(trace_id.encode('utf-8')).hexdigest()[:12]}"
 
+    artifacts = _build_chain_artifacts(
+        output_root=output_root,
+        selected_path=selected_path,
+        evidence_payload=evidence_payload,
+        trace_payload=trace_payload,
+        eval_payload=eval_payload,
+        lineage=lineage,
+        trace_id=trace_id,
+    )
+    attestation_ref = _resolve_attestation_reference(evidence_payload)
+    if isinstance(attestation_ref, dict):
+        attestation_path = str(attestation_ref.get("path", "")).strip()
+        if attestation_path:
+            artifacts.append(
+                _artifact_record(
+                    kind="attestation_statement",
+                    path=attestation_path,
+                    sha256=_hash_path(output_root / attestation_path),
+                    parser="json",
+                    summary="signed in-toto statement",
+                    trace_id=trace_id,
+                )
+            )
+
     chain = {
         "schema": "ProofChain",
         "schema_version": 2,
+        "run_id": str(evidence_payload.get("run_id", "")),
         "trace_id": trace_id,
         "eval_id": eval_id,
         "eval_trace_id": str(eval_payload.get("trace_id", "")),
@@ -193,17 +307,15 @@ def assemble_proof_chain(project_dir: str, *, evidence_path: str | None = None)
         "timestamp": evidence_payload.get("timestamp") or trace_payload.get("timestamp") or eval_payload.get("timestamp") or eval_payload.get("evaluated_at") or "unknown",
         "executor": evidence_payload.get("executor") or trace_payload.get("executor") or eval_payload.get("executor") or {"user": "unknown", "pid": "unknown"},
         "environment": evidence_payload.get("environment") or trace_payload.get("environment") or eval_payload.get("environment") or {"hostname": "unknown", "platform": "unknown"},
+        "seed": evidence_payload.get("seed"),
+        "temperature_lock": evidence_payload.get("temperature_lock"),
+        "determinism_version": evidence_payload.get("determinism_version"),
+        "determinism_scope": evidence_payload.get("determinism_scope") or "same-hardware",
         "ci_job_url": evidence_payload.get("ci_job_url") or "",
         "external_inputs": evidence_payload.get("external_inputs", []),
-        "artifacts": _build_chain_artifacts(
-            output_root=output_root,
-            selected_path=selected_path,
-            evidence_payload=evidence_payload,
-            trace_payload=trace_payload,
-            eval_payload=eval_payload,
-            lineage=lineage,
-            trace_id=trace_id,
-        ),
+        "claims": evidence_payload.get("claims", []),
+        "attestation_statement_ref": attestation_ref,
+        "artifacts": artifacts,
     }
     validation = validate_proof_chain(chain)
     chain["status"] = validation["status"]
@@ -269,6 +381,8 @@ def validate_proof_chain(chain: dict[str, Any]) -> dict[str, Any]:
     else:
         blockers.append("proof_chain_invalid_lineage")
 
+    blockers.extend(_validate_determinism_contract(chain))
+
     return {
         "schema": "ProofChainValidationResult",
         "status": "ok" if not blockers else "error",

package/runtime/release_run_coordinator.py

@@ -11,6 +11,7 @@ import warnings
 
 from runtime.defense_state import DefenseState
 from runtime.interaction_journal import InteractionJournal
+from runtime.compliance_governor import evaluate_release_compliance
 from runtime.runtime_contracts import write_run_state
 from runtime.session_health import compute_session_health
 from runtime.verification_controller import VerificationController
@@ -43,6 +44,7 @@ class ReleaseRunCoordinator:
 
         verification_state = self._verification.begin_run(run_id)
         self._write_active_run(run_id)
+        self._write_release_evidence(run_id, release_evidence)
         self._write_state(
             run_id,
             {
@@ -146,10 +148,25 @@ class ReleaseRunCoordinator:
         resolved = self.resolve_run_id(cli_run_id=run_id)
         canonical_run_id = resolved.run_id
 
+        release_evidence = self._read_release_evidence(canonical_run_id)
+        compliance = evaluate_release_compliance(
+            project_dir=self.project_dir,
+            run_id=canonical_run_id,
+            release_evidence=release_evidence,
+        )
+        resolved_status = status
+        resolved_blockers = list(blockers)
+        if compliance.get("status") == "blocked":
+            resolved_status = "blocked"
+            reason = str(compliance.get("reason", "compliance_governor_blocked")).strip()
+            if reason:
+                resolved_blockers.append(reason)
+        deduped_blockers = list(dict.fromkeys(resolved_blockers))
+
         verification_state = self._verification.complete_run(
             run_id=canonical_run_id,
-            status=status,
-            blockers=list(blockers),
+            status=resolved_status,
+            blockers=deduped_blockers,
             evidence_links=list(evidence_links),
         )
         DefenseState(self.project_dir).update()
@@ -175,21 +192,28 @@ class ReleaseRunCoordinator:
             },
         )
 
+        artifact_audit = _extract_artifact_audit(release_evidence)
         self._write_state(
             canonical_run_id,
             {
-                "status": str(verification_state.get("status", status)),
+                "status": str(verification_state.get("status", resolved_status)),
                 "phase": "finalize",
                 "compat_path": compat_path,
                 "health_path": self._health_state_path(canonical_run_id),
                 "health_action": str(health.get("recommended_action", "continue")),
                 "council_path": council_path,
                 "rollback_path": rollback_path,
+                "compliance_authority": str(compliance.get("authority", "")),
+                "compliance_reason": str(compliance.get("reason", "")),
+                "artifact_alg": artifact_audit.get("artifact_alg", ""),
+                "artifact_key_id": artifact_audit.get("artifact_key_id", ""),
+                "artifact_subject_sha256": artifact_audit.get("artifact_subject_sha256", ""),
+                "artifact_verdict": str(compliance.get("reason", "")),
                 "evidence_links": list(evidence_links),
             },
         )
         return {
-            "status": str(verification_state.get("status", status)),
+            "status": str(verification_state.get("status", resolved_status)),
             "run_id": canonical_run_id,
             "compat_path": compat_path,
             "health_path": self._health_state_path(canonical_run_id),
@@ -216,6 +240,26 @@ class ReleaseRunCoordinator:
     def _health_state_path(self, run_id: str) -> str:
         return str(Path(".omg") / "state" / "session_health" / f"{run_id}.json")
 
+    def _write_release_evidence(self, run_id: str, release_evidence: dict[str, object] | None) -> None:
+        payload = dict(release_evidence) if isinstance(release_evidence, dict) else {}
+        path = Path(self.project_dir) / ".omg" / "state" / "release_run_coordinator" / f"{run_id}-release-evidence.json"
+        path.parent.mkdir(parents=True, exist_ok=True)
+        tmp_path = path.with_name(f"{path.name}.tmp")
+        _ = tmp_path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+        os.replace(tmp_path, path)
+
+    def _read_release_evidence(self, run_id: str) -> dict[str, object]:
+        path = Path(self.project_dir) / ".omg" / "state" / "release_run_coordinator" / f"{run_id}-release-evidence.json"
+        if not path.exists():
+            return {}
+        try:
+            payload = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            return {}
+        if isinstance(payload, dict):
+            return payload
+        return {}
+
     def _write_fanout(self, run_id: str, producer: str, payload: dict[str, object]) -> str:
         path = Path(self.project_dir) / ".omg" / "state" / "release_run_coordinator" / run_id / f"{producer}.json"
         path.parent.mkdir(parents=True, exist_ok=True)
@@ -234,6 +278,33 @@ class ReleaseRunCoordinator:
         return candidates[-1].stem
 
 
+def _extract_artifact_audit(release_evidence: dict[str, object]) -> dict[str, str]:
+    if not isinstance(release_evidence, dict):
+        return {}
+    artifact = release_evidence.get("artifact")
+    if not isinstance(artifact, dict):
+        return {"artifact_alg": "", "artifact_key_id": "", "artifact_subject_sha256": ""}
+    attestation = artifact.get("attestation")
+    if not isinstance(attestation, dict):
+        return {"artifact_alg": "", "artifact_key_id": "", "artifact_subject_sha256": ""}
+    signer = attestation.get("signer")
+    alg = str(signer.get("algorithm", "")) if isinstance(signer, dict) else ""
+    key_id = str(signer.get("keyid", "")) if isinstance(signer, dict) else ""
+    subject = attestation.get("subject")
+    subject_sha256 = ""
+    if isinstance(subject, list) and subject:
+        first = subject[0]
+        if isinstance(first, dict):
+            digest = first.get("digest")
+            if isinstance(digest, dict):
+                subject_sha256 = str(digest.get("sha256", ""))
+    return {
+        "artifact_alg": alg,
+        "artifact_key_id": key_id,
+        "artifact_subject_sha256": subject_sha256,
+    }
+
+
 def resolve_canonical_run_id(
     project_dir: str,
     *,

package/runtime/release_surfaces.py

@@ -194,6 +194,18 @@ AUTHORED_SURFACES: list[AuthoredSurface] = [
         ["contract_version"],
         "compat contract snapshot version",
     ),
+
+    # 7. commands/OMG:validate.md — JSON example version field (line 39)
+    AuthoredSurface(
+        "commands/OMG:validate.md", "regex_line", r'^\s*"version":\s*"(\d+\.\d+\.\d+)"',
+        "validate command JSON example version",
+    ),
+
+    # 8. settings.json — banner comment literal (line 3)
+    AuthoredSurface(
+        "settings.json", "banner_literal", r'OMG (\d+\.\d+\.\d+)',
+        "settings banner comment version",
+    ),
 ]
 
 

package/runtime/repro_pack.py

@@ -15,6 +15,7 @@ from runtime.evidence_query import (
     get_trace,
     get_verification_state,
 )
+from runtime.forge_run_id import build_deterministic_contract
 
 
 def _now() -> str:
@@ -68,6 +69,46 @@ def _string_field(payload: JsonObject, key: str) -> str:
     return value if isinstance(value, str) else ""
 
 
+def _is_int(value: JsonValue | None) -> bool:
+    return isinstance(value, int) and not isinstance(value, bool)
+
+
+def _matches_temperature_lock(value: JsonValue | None, expected: dict[str, object]) -> bool:
+    if not isinstance(value, dict):
+        return False
+    model_lock = value.get("critical_model_paths")
+    tool_lock = value.get("critical_tool_paths")
+    if not isinstance(model_lock, (int, float)):
+        return False
+    if not isinstance(tool_lock, (int, float)):
+        return False
+    return value == expected
+
+
+def _validate_determinism_contract(evidence_pack: JsonObject, expected: dict[str, object]) -> str | None:
+    seed_value = evidence_pack.get("seed")
+    version_value = evidence_pack.get("determinism_version")
+    lock_value = evidence_pack.get("temperature_lock")
+
+    if not _is_int(seed_value):
+        return "determinism_metadata_missing"
+    if not isinstance(version_value, str) or not version_value.strip():
+        return "determinism_metadata_missing"
+
+    expected_lock = expected.get("temperature_lock")
+    if not isinstance(expected_lock, dict):
+        return "determinism_metadata_missing"
+    expected_lock_object = cast(dict[str, object], expected_lock)
+    if not _matches_temperature_lock(lock_value, expected_lock_object):
+        return "determinism_metadata_missing"
+
+    expected_seed = expected.get("seed")
+    expected_version = expected.get("determinism_version")
+    if seed_value != expected_seed or version_value != expected_version:
+        return "determinism_metadata_mismatch"
+    return None
+
+
 def _artifact_ref(*, kind: str, path: str, sha256: str = "", extras: JsonObject | None = None) -> JsonObject:
     artifact: JsonObject = {
         "kind": kind,
@@ -187,6 +228,57 @@ def _incident_artifacts(root: Path, records: JsonValue | None) -> list[JsonObjec
     return artifacts
 
 
+def _attestation_artifacts(root: Path, evidence_pack: JsonObject) -> list[JsonObject]:
+    artifacts: list[JsonObject] = []
+    direct_path_value = evidence_pack.get("attestation_statement_path") or evidence_pack.get("attestation_path")
+    if isinstance(direct_path_value, str) and direct_path_value.strip():
+        direct_path = direct_path_value.strip()
+        artifacts.append(
+            _artifact_ref(
+                kind="attestation_statement",
+                path=direct_path,
+                sha256=_hash_path(root / direct_path),
+            )
+        )
+
+    records = evidence_pack.get("artifact_attestations")
+    if not isinstance(records, list):
+        return artifacts
+
+    for item in records:
+        if not isinstance(item, dict):
+            continue
+        row = cast(JsonObject, item)
+        statement_path = _string_field(row, "statement_path").strip()
+        if not statement_path:
+            continue
+        artifacts.append(
+            _artifact_ref(
+                kind="attestation_statement",
+                path=statement_path,
+                sha256=_hash_path(root / statement_path),
+                extras={
+                    "artifact_path": _string_field(row, "artifact_path"),
+                    "signer": row.get("signer") if isinstance(row.get("signer"), dict) else {},
+                },
+            )
+        )
+        signature_path = _string_field(row, "signature_path").strip()
+        if signature_path:
+            artifacts.append(
+                _artifact_ref(
+                    kind="attestation_signature",
+                    path=signature_path,
+                    sha256=_hash_path(root / signature_path),
+                    extras={
+                        "artifact_path": _string_field(row, "artifact_path"),
+                    },
+                )
+            )
+
+    return artifacts
+
+
 def _dedupe_artifacts(artifacts: list[JsonObject]) -> list[JsonObject]:
     seen: set[tuple[str, str, str]] = set()
     deduped: list[JsonObject] = []
@@ -206,6 +298,7 @@ def _dedupe_artifacts(artifacts: list[JsonObject]) -> list[JsonObject]:
 
 def build_repro_pack(project_dir: str, run_id: str) -> dict[str, str]:
     root = Path(project_dir)
+    deterministic_contract = build_deterministic_contract(run_id)
     evidence_pack = get_evidence_pack(project_dir, run_id)
     if evidence_pack is None:
         return {
@@ -214,6 +307,14 @@ def build_repro_pack(project_dir: str, run_id: str) -> dict[str, str]:
             "reason": "evidence_pack_not_found",
         }
 
+    determinism_error = _validate_determinism_contract(evidence_pack, deterministic_contract)
+    if determinism_error is not None:
+        return {
+            "status": "error",
+            "run_id": run_id,
+            "reason": determinism_error,
+        }
+
     evidence_pack_path = f".omg/evidence/{run_id}.json"
     artifacts: list[JsonObject] = [
         _artifact_ref(kind="evidence_pack", path=evidence_pack_path, sha256=_hash_path(root / evidence_pack_path))
@@ -260,6 +361,7 @@ def build_repro_pack(project_dir: str, run_id: str) -> dict[str, str]:
     artifacts.extend(_security_artifacts(root, evidence_pack.get("security_scans")))
     artifacts.extend(_browser_artifacts(root, evidence_pack.get("artifacts")))
     artifacts.extend(_incident_artifacts(root, evidence_pack.get("artifacts")))
+    artifacts.extend(_attestation_artifacts(root, evidence_pack))
 
     verification_path = root / ".omg" / "state" / "background-verification.json"
     if get_verification_state(project_dir) is not None and verification_path.exists():
@@ -276,6 +378,10 @@ def build_repro_pack(project_dir: str, run_id: str) -> dict[str, str]:
         "schema": "ReproPack",
         "schema_version": 1,
         "run_id": run_id,
+        "seed": deterministic_contract["seed"],
+        "temperature_lock": deterministic_contract["temperature_lock"],
+        "determinism_version": deterministic_contract["determinism_version"],
+        "determinism_scope": deterministic_contract["determinism_scope"],
         "evidence_pack_path": evidence_pack_path,
         "artifacts": _dedupe_artifacts(artifacts),
         "unresolved_risks": unresolved_risks,