@trac3er/oh-my-god 2.1.8 → 2.2.2

package/scripts/omg.py

@@ -29,6 +29,10 @@ ROOT_DIR = Path(SCRIPTS_DIR).resolve().parent
 if str(ROOT_DIR) not in sys.path:
     sys.path.insert(0, str(ROOT_DIR))
 
+from hooks._common import bootstrap_runtime_paths
+
+bootstrap_runtime_paths(__file__)
+
 from hooks.policy_engine import evaluate_bash_command
 from hooks.shadow_manager import create_evidence_pack
 from hooks.trust_review import review_config_change, write_trust_manifest
@@ -36,6 +40,7 @@ from lab.pipeline import publish_artifact, run_pipeline, run_pipeline_with_evide
 from runtime.forge_agents import dispatch_specialists, resolve_specialists
 from runtime.forge_contracts import load_forge_mvp, validate_forge_job
 from runtime.forge_run_id import normalize_run_id
+from runtime.issue_surface import IssueSurface
 from runtime.dispatcher import dispatch_runtime
 from runtime.api_twin import ingest_contract, record_fixture, serve_fixture, verify_fixture
 from runtime.data_lineage import build_lineage_manifest
@@ -65,11 +70,15 @@ from runtime.compat import (
 from runtime.validate import run_validate, format_text as validate_format_text
 from runtime.plugin_diagnostics import approve_plugin, run_plugin_diagnostics
 from runtime.adoption import CANONICAL_VERSION, VALID_PRESETS
+from runtime.canonical_surface import get_canonical_hosts
 from runtime.ecosystem import ecosystem_status, list_ecosystem_repos, sync_ecosystem_repos
 from runtime.team_router import TeamDispatchRequest, dispatch_team, execute_ccg_mode, execute_crazy_mode
 from runtime.release_run_coordinator import resolve_current_run_id
 
 
+CANONICAL_HOST_CHOICES = tuple(get_canonical_hosts())
+
+
 def _parse_simple_idea_yaml(path: str) -> dict[str, Any]:
     """Minimal parser for `.omg/idea.yml` template shape."""
     idea: dict[str, Any] = {
@@ -204,12 +213,43 @@ def cmd_ship(args: argparse.Namespace) -> int:
 
 
 def cmd_fix(args: argparse.Namespace) -> int:
+    project_dir = _ensure_project_dir()
+    issue_surface = IssueSurface(project_dir=project_dir)
+    scan_run_id = f"fix-{_sanitize_token(args.issue)}-{_now_run_id()}"
+    issue_report = issue_surface.scan(
+        scan_run_id,
+        surfaces=["live_session", "plugin_interop", "governed_tools", "forge_runs"],
+    )
     goal = f"Fix issue {args.issue}"
     dispatched = dispatch_runtime(args.runtime, {"goal": goal, "acceptance": [f"issue-{args.issue}-resolved"]})
+    dispatched["issue_surface"] = {
+        "run_id": issue_report.run_id,
+        "report_path": str(issue_report.summary.get("report_path", "")),
+        "summary": issue_report.summary,
+    }
     print(json.dumps(dispatched, indent=2))
     return 0 if dispatched.get("status") == "ok" else 2
 
 
+def cmd_issue(args: argparse.Namespace) -> int:
+    run_id = args.run_id or _now_run_id()
+    surfaces = [item.strip() for item in str(args.surfaces).split(",") if item.strip()]
+    issue_surface = IssueSurface(project_dir=_ensure_project_dir())
+    report = issue_surface.scan(run_id, surfaces=surfaces or None)
+
+    result: dict[str, Any] = {
+        "schema": "IssueCommandResult",
+        "status": "ok",
+        "run_id": run_id,
+        "report_path": str(report.summary.get("report_path", "")),
+        "report": report.to_dict(),
+    }
+    if args.simulate_surface and args.simulate_scenario:
+        result["simulation"] = issue_surface.simulate_failure(args.simulate_surface, args.simulate_scenario)
+    print(json.dumps(result, indent=2))
+    return 0
+
+
 def cmd_secure(args: argparse.Namespace) -> int:
     decision = evaluate_bash_command(args.command)
     print(json.dumps(decision.to_dict(), indent=2))
@@ -331,6 +371,40 @@ def cmd_domain_pack(args: argparse.Namespace) -> int:
     return 0
 
 
+def _emit_vision_placeholder(command: str) -> int:
+    print(
+        json.dumps(
+            {
+                "status": "error",
+                "error_code": "INVALID_VISION_INPUT",
+                "message": f"{command} is registered, but runtime execution is not implemented yet",
+            },
+            indent=2,
+        )
+    )
+    return 2
+
+
+def cmd_vision_ocr(args: argparse.Namespace) -> int:
+    return _emit_vision_placeholder("vision ocr")
+
+
+def cmd_vision_compare(args: argparse.Namespace) -> int:
+    return _emit_vision_placeholder("vision compare")
+
+
+def cmd_vision_analyze(args: argparse.Namespace) -> int:
+    return _emit_vision_placeholder("vision analyze")
+
+
+def cmd_vision_batch(args: argparse.Namespace) -> int:
+    return _emit_vision_placeholder("vision batch")
+
+
+def cmd_vision_eval(args: argparse.Namespace) -> int:
+    return _emit_vision_placeholder("vision eval")
+
+
 def cmd_trace_record(args: argparse.Namespace) -> int:
     result = record_trace(
         _ensure_project_dir(),
@@ -615,6 +689,10 @@ def cmd_teams(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_team(args: argparse.Namespace) -> int:
+    return cmd_teams(args)
+
+
 def cmd_ccg(args: argparse.Namespace) -> int:
     files = [f.strip() for f in args.files.split(",") if f.strip()] if args.files else []
     result = execute_ccg_mode(
@@ -831,6 +909,10 @@ def cmd_contract_compile(args: argparse.Namespace) -> int:
 
 
 def cmd_release_readiness(args: argparse.Namespace) -> int:
+    if not os.environ.get("OMG_RELEASE_READY_PROVIDERS", "").strip():
+        os.environ["OMG_RELEASE_READY_PROVIDERS"] = ",".join(get_canonical_hosts())
+    if not os.environ.get("OMG_REQUIRE_HOST_PARITY_REPORT", "").strip():
+        os.environ["OMG_REQUIRE_HOST_PARITY_REPORT"] = "1"
     result = build_release_readiness(
         root_dir=ROOT_DIR,
         output_root=args.output_root,
@@ -906,7 +988,7 @@ def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
         "--host",
         dest="hosts",
         action="append",
-        choices=["claude", "codex", "gemini", "kimi"],
+        choices=list(CANONICAL_HOST_CHOICES),
         required=True,
         help="Host to compile (repeat for multiple hosts)",
     )
@@ -1122,6 +1204,20 @@ def build_parser() -> argparse.ArgumentParser:
     fix.add_argument("--runtime", default="claude", choices=["claude", "gpt", "local"])
     fix.set_defaults(func=cmd_fix)
 
+    issue = sub.add_parser("issue", help="Active issue diagnostics and red-team simulation")
+    issue.add_argument("--run-id", default="")
+    issue.add_argument(
+        "--surfaces",
+        default="",
+        help=(
+            "Comma-separated surfaces to scan: "
+            "live_session,forge_runs,hooks,skills,mcps,plugin_interop,governed_tools,domain_pipelines"
+        ),
+    )
+    issue.add_argument("--simulate-surface", default="")
+    issue.add_argument("--simulate-scenario", default="")
+    issue.set_defaults(func=cmd_issue)
+
     undo = sub.add_parser("undo", help="Undo last interaction step")
     undo.add_argument("--step-id", default="", help="Journal step ID to undo (latest if omitted)")
     undo.set_defaults(func=cmd_undo)
@@ -1181,6 +1277,19 @@ def build_parser() -> argparse.ArgumentParser:
     domain_pack.add_argument("--name", required=True, choices=["robotics", "vision", "algorithms", "health"])
     domain_pack.set_defaults(func=cmd_domain_pack)
 
+    vision = sub.add_parser("vision", help="OCR, visual diff, and semantic image analysis")
+    vision_sub = vision.add_subparsers(dest="vision_command", required=True)
+    vision_ocr = vision_sub.add_parser("ocr", help="Extract text from one or more images")
+    vision_ocr.set_defaults(func=cmd_vision_ocr)
+    vision_compare = vision_sub.add_parser("compare", help="Compare one or more images deterministically")
+    vision_compare.set_defaults(func=cmd_vision_compare)
+    vision_analyze = vision_sub.add_parser("analyze", help="Run semantic image analysis")
+    vision_analyze.set_defaults(func=cmd_vision_analyze)
+    vision_batch = vision_sub.add_parser("batch", help="Run a vision batch job")
+    vision_batch.set_defaults(func=cmd_vision_batch)
+    vision_eval = vision_sub.add_parser("eval", help="Evaluate vision job outputs")
+    vision_eval.set_defaults(func=cmd_vision_eval)
+
     tracebank = sub.add_parser("tracebank", help="Record structured route traces")
     tracebank.add_argument("--trace-type", required=True)
     tracebank.add_argument("--route", required=True)
@@ -1299,6 +1408,14 @@ def build_parser() -> argparse.ArgumentParser:
     teams.add_argument("--expected-outcome", default="")
     teams.set_defaults(func=cmd_teams)
 
+    team = sub.add_parser("team", help="Internal OMG staged team routing (canonical)")
+    team.add_argument("--target", default="auto", choices=["auto", "codex", "gemini", "ccg"])
+    team.add_argument("--problem", required=True)
+    team.add_argument("--context", default="")
+    team.add_argument("--files", default="")
+    team.add_argument("--expected-outcome", default="")
+    team.set_defaults(func=cmd_team)
+
     ccg = sub.add_parser("ccg", help="OMG CCG (tri-track) routing")
     ccg.add_argument("--problem", required=True)
     ccg.add_argument("--context", default="")

package/scripts/prepare-release-proof-fixtures.py

@@ -6,6 +6,18 @@ import hashlib
 import json
 from pathlib import Path
 
+from registry.verify_artifact import sign_artifact_statement
+
+
+_DEV_PRIVATE_KEY = "Hx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8="
+_DEV_KEY_ID = "1f5fe64ec2f8c901"
+_DETERMINISM_VERSION = "forge-determinism-v1"
+_DETERMINISM_SCOPE = "same-hardware"
+_TEMPERATURE_LOCK = {
+    "critical_model_paths": 0.0,
+    "critical_tool_paths": 0.0,
+}
+
 
 def _write_json(path: Path, payload: object) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
@@ -22,6 +34,16 @@ def _context_checksum(*, run_id: str, profile_version: str, intent_gate_version:
     return hashlib.sha256(material.encode("utf-8", errors="ignore")).hexdigest()
 
 
+def _build_deterministic_contract(run_id: str) -> dict[str, object]:
+    digest = hashlib.sha256(run_id.encode("utf-8")).digest()
+    return {
+        "seed": int.from_bytes(digest[:8], byteorder="big", signed=False),
+        "temperature_lock": dict(_TEMPERATURE_LOCK),
+        "determinism_version": _DETERMINISM_VERSION,
+        "determinism_scope": _DETERMINISM_SCOPE,
+    }
+
+
 def prepare_release_proof_fixtures(output_root: Path) -> None:
     trace_id = "trace-1"
     eval_id = "eval-1"
@@ -34,6 +56,23 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
         profile_version=profile_version,
         intent_gate_version=intent_gate_version,
     )
+    deterministic_contract = _build_deterministic_contract(run_id)
+    artifact_digest = hashlib.sha256(f"{run_id}:release-artifact".encode("utf-8")).hexdigest()
+    artifact_path = f"dist/public/{run_id}-release-bundle.tgz"
+    artifact = {
+        "id": f"release-{run_id}",
+        "signer": "omg-local",
+        "checksum": f"sha256:{artifact_digest}",
+        "attestation": sign_artifact_statement(
+            artifact_path=artifact_path,
+            subject_digest=artifact_digest,
+            signer_key=_DEV_PRIVATE_KEY,
+            signer_key_id=_DEV_KEY_ID,
+        ),
+        "permissions": ["read"],
+        "static_scan": [],
+        "risk_level": "low",
+    }
 
     junit_path = output_root / ".omg" / "evidence" / "junit.xml"
     coverage_path = output_root / ".omg" / "evidence" / "coverage.xml"
@@ -52,6 +91,18 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
     intent_gate_path = output_root / ".omg" / "state" / "intent_gate" / "run-1.json"
     profile_path = output_root / ".omg" / "state" / "profile.yaml"
     tracebank_path = output_root / ".omg" / "tracebank" / "events.jsonl"
+    exec_kernel_path = output_root / ".omg" / "state" / "exec-kernel" / "run-1.json"
+    watchdog_path = output_root / ".omg" / "evidence" / "subagents" / "run-1-replay.json"
+    merge_writer_path = output_root / ".omg" / "evidence" / "merge-writer-run-1.json"
+    ledger_path = output_root / ".omg" / "state" / "ledger" / "tool-ledger.jsonl"
+    budget_path = output_root / ".omg" / "state" / "budget-envelopes" / "run-1.json"
+    issue_report_path = output_root / ".omg" / "evidence" / "issues" / "run-1.json"
+    host_parity_path = output_root / ".omg" / "evidence" / "host-parity-run-1.json"
+    music_omr_path = output_root / ".omg" / "evidence" / "music-omr-run-1.json"
+
+    # Ensure directories exist
+    for p in [exec_kernel_path, watchdog_path, merge_writer_path, ledger_path, budget_path, issue_report_path, host_parity_path, music_omr_path]:
+        p.parent.mkdir(parents=True, exist_ok=True)
 
     _write_text(
         junit_path,
@@ -122,12 +173,18 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
             {
                 "schema": "EvidencePack",
                 "run_id": run_id,
+                "evidence_profile": "release",
                 "timestamp": "2026-03-07T00:00:00Z",
                 "executor": {"user": "release-bot", "pid": 1},
                 "environment": {"hostname": "localhost", "platform": "linux"},
                 "context_checksum": context_checksum,
                 "profile_version": profile_version,
                 "intent_gate_version": intent_gate_version,
+                "seed": deterministic_contract["seed"],
+                "temperature_lock": deterministic_contract["temperature_lock"],
+                "determinism_version": deterministic_contract["determinism_version"],
+                "determinism_scope": deterministic_contract["determinism_scope"],
+                "artifact": artifact,
             "tests": [{"name": "release_readiness", "passed": True}],
             "security_scans": [{"tool": "security-check", "path": ".omg/evidence/security-check.json"}],
             "diff_summary": {"files": 1},
@@ -138,11 +195,13 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
             "claims": [
                 {
                     "claim_type": "release_ready",
+                    "run_id": run_id,
+                    "evidence_profile": "release",
                     "artifacts": [
-                        "junit.xml",
-                        "coverage.xml",
-                        "results.sarif",
-                        "browser_trace.json",
+                        ".omg/evidence/junit.xml",
+                        ".omg/evidence/coverage.xml",
+                        ".omg/evidence/results.sarif",
+                        ".omg/evidence/browser_trace.json",
                     ],
                     "trace_ids": [trace_id],
                 }
@@ -177,6 +236,38 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
                     "path": ".omg/evidence/forge-specialists-run-1.json",
                     "run_id": run_id,
                 },
+                "exec_kernel_state": {
+                    "path": ".omg/state/exec-kernel/run-1.json",
+                    "run_id": run_id,
+                },
+                "worker_watchdog_replay": {
+                    "path": ".omg/evidence/subagents/run-1-replay.json",
+                    "run_id": run_id,
+                },
+                "merge_writer_provenance": {
+                    "path": ".omg/evidence/merge-writer-run-1.json",
+                    "run_id": run_id,
+                },
+                "tool_fabric_ledger": {
+                    "path": ".omg/state/ledger/tool-ledger.jsonl",
+                    "run_id": run_id,
+                },
+                "budget_envelope_state": {
+                    "path": ".omg/state/budget-envelopes/run-1.json",
+                    "run_id": run_id,
+                },
+                "issue_report": {
+                    "path": ".omg/evidence/issues/run-1.json",
+                    "run_id": run_id,
+                },
+                "host_parity_report": {
+                    "path": ".omg/evidence/host-parity-run-1.json",
+                    "run_id": run_id,
+                },
+                "music_omr_testbed_evidence": {
+                    "path": ".omg/evidence/music-omr-run-1.json",
+                    "run_id": run_id,
+                },
             },
     )
     _write_json(
@@ -204,6 +295,12 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
             "phase": "finalize",
             "resolution_source": "fixtures",
             "resolution_reason": "deterministic_release_seed",
+            "compliance_authority": "release",
+            "compliance_reason": "compliance checks passed",
+            "artifact_verdict": "allow",
+            "artifact_alg": "ed25519-minisign",
+            "artifact_key_id": _DEV_KEY_ID,
+            "artifact_subject_sha256": artifact_digest,
             "updated_at": "2026-03-07T00:00:00Z",
             "context_checksum": context_checksum,
             "profile_version": profile_version,
@@ -290,6 +387,82 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
             "updated_at": "2026-03-07T00:00:00Z",
         },
     )
+    _write_json(
+        exec_kernel_path,
+        {
+            "schema": "ExecKernelRunState",
+            "run_id": run_id,
+            "status": "queued",
+            "kernel_enabled": True,
+        },
+    )
+    _write_json(
+        watchdog_path,
+        {
+            "schema": "WorkerReplayEvidence",
+            "run_id": run_id,
+            "reason": "completed",
+        },
+    )
+    _write_json(
+        merge_writer_path,
+        {
+            "schema": "MergeWriterProvenance",
+            "run_id": run_id,
+            "acquired_at": "2026-03-07T00:00:00Z",
+            "released_at": "2026-03-07T00:00:01Z",
+        },
+    )
+    ledger_path.parent.mkdir(parents=True, exist_ok=True)
+    ledger_path.write_text(
+        json.dumps({"ts": "2026-03-07T00:00:00Z", "tool": "ls", "run_id": run_id}) + "\n",
+        encoding="utf-8",
+    )
+    _write_json(
+        budget_path,
+        {
+            "schema": "BudgetEnvelopeState",
+            "run_id": run_id,
+            "usage": {"cpu_seconds_used": 0.1},
+        },
+    )
+    _write_json(
+        issue_report_path,
+        {
+            "schema": "IssueReport",
+            "run_id": run_id,
+            "issues": [],
+        },
+    )
+    _write_json(
+        host_parity_path,
+        {
+            "schema": "HostParityReport",
+            "run_id": run_id,
+            "timestamp": "2026-03-07T00:00:00Z",
+            "canonical_hosts": ["claude", "codex", "gemini", "kimi"],
+            "parity_results": {
+                "passed": True,
+                "drift_detected": False,
+                "drift_details": [],
+                "host_results": {
+                    "claude": {"present": True, "passed": True, "reason": "baseline"},
+                    "codex": {"present": True, "passed": True, "reason": "structured-equivalent"},
+                    "gemini": {"present": True, "passed": True, "reason": "structured-equivalent"},
+                    "kimi": {"present": True, "passed": True, "reason": "structured-equivalent"},
+                }
+            },
+            "overall_status": "ok",
+        },
+    )
+    _write_json(
+        music_omr_path,
+        {
+            "schema": "MusicOMREvidence",
+            "run_id": run_id,
+            "results": {},
+        },
+    )
     _write_text(
         profile_path,
         """profile_version: profile-v1

package/scripts/sync-release-identity.py

@@ -27,6 +27,7 @@ from runtime.release_surfaces import (
     AUTHORED_SURFACES,
     DERIVED_SURFACE_DIRS,
     AuthoredSurface,
+    surface_applies_to_root,
 )
 
 KeyPath = list[Union[str, int]]
@@ -393,6 +394,8 @@ def check_surface(
     repo_root: Path, surface: AuthoredSurface, canonical: str,
 ) -> list[tuple[str, str | None]]:
     """Check a single surface for version drift."""
+    if not surface_applies_to_root(surface, repo_root):
+        return []
     _guard_derived(surface)
     handler = _CHECK_DISPATCH.get(surface.surface_type)
     if handler is None:
@@ -404,6 +407,8 @@ def update_surface(
     repo_root: Path, surface: AuthoredSurface, canonical: str,
 ) -> list[str]:
     """Update a single surface to canonical version."""
+    if not surface_applies_to_root(surface, repo_root):
+        return []
     _guard_derived(surface)
     handler = _UPDATE_DISPATCH.get(surface.surface_type)
     if handler is None:

package/scripts/validate-release-identity.py

@@ -115,7 +115,7 @@ def validate_derived(repo_root: Path, canonical: str) -> dict[str, Any]:
     return {"status": status, "blockers": blockers}
 
 
-_KNOWN_ATTESTATION_ALGORITHMS = {"ed25519-minisign", "hmac-sha256"}
+_KNOWN_ATTESTATION_ALGORITHMS = {"ed25519-minisign"}
 
 
 def _collect_attestations(payload: dict[str, Any]) -> dict[str, dict[str, Any]]:
@@ -133,7 +133,7 @@ def _collect_attestations(payload: dict[str, Any]) -> dict[str, dict[str, Any]]:
         if row.get("statement_path") is not None or row.get("signature_path") is not None:
             indexed[artifact_path] = row
             continue
-        # Legacy inline shape: statement dict + signer_pubkey string (HMAC bridge)
+        # Inline shape: statement dict + signer_pubkey string
         statement = row.get("statement")
         signer_pubkey = row.get("signer_pubkey")
         if isinstance(statement, dict) and isinstance(signer_pubkey, str):
@@ -356,7 +356,14 @@ def main() -> int:
         derived_result = {"status": "skipped", "blockers": []}
 
     if args.forbid_version and args.scope in ("derived", "all"):
-        residue_result = scan_scoped_residue(_REPO_ROOT, args.forbid_version)
+        if args.forbid_version == canonical:
+            residue_result = {
+                "status": "ok",
+                "forbid_version": args.forbid_version,
+                "blockers": [],
+            }
+        else:
+            residue_result = scan_scoped_residue(_REPO_ROOT, args.forbid_version)
 
     report = build_report(
         canonical=canonical,

package/scripts/verify-standalone.sh

@@ -16,9 +16,9 @@ mkdir -p .omg/evidence
 python3 scripts/omg.py doctor --format json > .omg/evidence/doctor.json
 python3 scripts/prepare-release-proof-fixtures.py --output-root .
 python3 scripts/omg.py contract validate
-python3 scripts/omg.py contract compile --host claude --host codex --channel public --output-root .
-python3 scripts/omg.py contract compile --host claude --host codex --channel enterprise --output-root .
-OMG_RELEASE_READY_PROVIDERS=claude,codex python3 scripts/omg.py release readiness --channel dual --output-root .
+python3 scripts/omg.py contract compile --host claude --host codex --host gemini --host kimi --channel public --output-root .
+python3 scripts/omg.py contract compile --host claude --host codex --host gemini --host kimi --channel enterprise --output-root .
+OMG_RELEASE_READY_PROVIDERS=claude,codex,gemini,kimi python3 scripts/omg.py release readiness --channel dual --output-root .
 python3 scripts/omg.py compat gate --max-bridge 0 --output .omg/evidence/omg-compat-gap.json
 python3 scripts/check-omg-public-ready.py
 
@@ -26,9 +26,9 @@ echo "=== Validating release identity ==="
 python3 scripts/validate-release-identity.py --scope all --forbid-version "${FORBID_VERSION}"
 
 if command -v pyenv >/dev/null 2>&1 && pyenv prefix 3.12.7 >/dev/null 2>&1; then
-  PYENV_VERSION=3.12.7 python -m pytest -q
+  PYENV_VERSION=3.12.7 python -m pytest -q -o addopts=''
 else
-  python3 -m pytest -q
+  python3 -m pytest -q -o addopts=''
 fi
 
 echo "[verify-standalone] passed"