@trac3er/oh-my-god 2.1.8 → 2.2.2

package/build/lib/hooks/test-validator.py

@@ -23,10 +23,13 @@ from collections import Counter
 from datetime import datetime, timezone
 
 HOOKS_DIR = os.path.dirname(__file__)
+PROJECT_ROOT = os.path.dirname(HOOKS_DIR)
 if HOOKS_DIR not in sys.path:
     sys.path.insert(0, HOOKS_DIR)
+if PROJECT_ROOT not in sys.path:
+    sys.path.insert(0, PROJECT_ROOT)
 
-from _common import _resolve_project_dir, should_skip_stop_hooks
+from hooks._common import _resolve_project_dir, should_skip_stop_hooks
 
 # --- Builtins excluded from parameterized-gap detection ---
 _BUILTIN_FUNCS = frozenset({
@@ -36,6 +39,9 @@ _BUILTIN_FUNCS = frozenset({
     "expect", "require", "import", "open", "super", "getattr", "setattr",
     "hasattr", "sorted", "enumerate", "zip", "map", "filter", "min", "max",
 })
+_MUTATION_TOOLS = frozenset({"write", "edit", "multiedit", "bash"})
+_SKIP_DIR_SEGMENTS = frozenset({"build", "dist", "node_modules", ".git"})
+_TEST_DIR_NAMES = frozenset({"tests", "test", "__tests__"})
 
 
 def analyze_test_content(content, filename="test.py"):
@@ -267,6 +273,31 @@ def persist_metrics(project_dir, analysis):
         pass  # Crash isolation: never fail the hook
 
 
+def _is_test_file(rel_path):
+    """
+    Heuristic: is this path likely a test file (vs source module)?
+
+    Excludes build artifacts and source modules that happen to start with
+    ``test_`` but live outside test directories (e.g. ``runtime/test_intent_lock.py``).
+    """
+    parts = rel_path.replace("\\", "/").split("/")
+    # Skip build artifacts and vendored code
+    if any(seg in _SKIP_DIR_SEGMENTS for seg in parts[:-1]):
+        return False
+    basename = parts[-1].lower() if parts else ""
+    # Standard test file patterns (checked against basename)
+    if any(p in basename for p in (".test.", ".spec.", "_test.", ".tests.")):
+        return True
+    # __tests__ directory anywhere in path
+    if "__tests__" in rel_path:
+        return True
+    # test_ prefix: only match if file is in a test directory or at repo root
+    if basename.startswith("test_"):
+        parent_dirs = {p.lower() for p in parts[:-1]}
+        return not parent_dirs or bool(parent_dirs & _TEST_DIR_NAMES)
+    return False
+
+
 def check_test_quality(data, project_dir):
     """Core test-quality validation. Returns list of block-reason strings."""
     import subprocess
@@ -279,8 +310,7 @@ def check_test_quality(data, project_dir):
             capture_output=True, text=True, timeout=10, cwd=project_dir
         )
         for f in result.stdout.strip().split("\n"):
-            if f and any(p in f.lower() for p in
-                         [".test.", ".spec.", "_test.", "test_", "__tests__", ".tests."]):
+            if f and _is_test_file(f):
                 full = os.path.join(project_dir, f)
                 if os.path.exists(full):
                     test_files.append(full)
@@ -344,6 +374,44 @@ def check_test_quality(data, project_dir):
     return []
 
 
+def check_methodology_contract(data):
+    if not isinstance(data, dict):
+        return []
+
+    tool_name = str(data.get("tool_name", "")).strip().lower()
+    if tool_name not in _MUTATION_TOOLS:
+        return []
+
+    tool_input = data.get("tool_input")
+    if not isinstance(tool_input, dict):
+        return ["METHODOLOGY: mutation-capable flow requires metadata with done_when criteria"]
+
+    exemption = str(tool_input.get("exemption", "")).strip().lower()
+    if exemption == "docs":
+        return []
+
+    metadata = tool_input.get("metadata")
+    if not isinstance(metadata, dict):
+        return ["METHODOLOGY: mutation-capable flow requires metadata with done_when criteria"]
+
+    done_when = metadata.get("done_when")
+    if isinstance(done_when, str) and done_when.strip():
+        return []
+    if isinstance(done_when, list):
+        if any(str(item).strip() for item in done_when):
+            return []
+    if isinstance(done_when, dict):
+        criteria = done_when.get("criteria")
+        if isinstance(criteria, str) and criteria.strip():
+            return []
+        if isinstance(criteria, list) and any(str(item).strip() for item in criteria):
+            return []
+        if str(done_when.get("summary", "")).strip():
+            return []
+
+    return ["METHODOLOGY: done_when criteria required before mutation-capable execution"]
+
+
 # Standalone execution (backward compat: invoked directly by hook runner)
 if __name__ == "__main__":
     try:
@@ -356,6 +424,7 @@ if __name__ == "__main__":
 
     project_dir = _resolve_project_dir()
     blocks = check_test_quality(data, project_dir)
+    blocks.extend(check_methodology_contract(data))
     if blocks:
         json.dump({"decision": "block", "reason": blocks[0]}, sys.stdout)
     sys.exit(0)

package/build/lib/hooks/tool-ledger.py

@@ -53,8 +53,19 @@ entry = {
     "ts": datetime.now(timezone.utc).isoformat(),
     "pid": os.getpid(),
     "tool": tool_name,
+    "surface_tags": [],
 }
 
+if isinstance(tool_input, dict):
+    lane_name = tool_input.get("lane_name", tool_input.get("lane"))
+    if isinstance(lane_name, str) and lane_name.strip():
+        entry["lane"] = lane_name.strip().lower()
+        entry["surface_tags"].append("governed_tools")
+    governed_tool = tool_input.get("tool_name")
+    if isinstance(governed_tool, str) and governed_tool.strip() and governed_tool != tool_name:
+        entry["governed_tool"] = governed_tool.strip()
+        entry["surface_tags"].append("governed_tools")
+
 # Link ledger entries to OMG v1 run/evidence artifacts when available.
 run_id = os.environ.get("OMG_RUN_ID")
 if not run_id:
@@ -69,6 +80,7 @@ if run_id:
     entry["run_id"] = run_id
 
 if tool_name == "Bash":
+    entry["surface_tags"].append("hooks")
     entry["command"] = tool_input.get("command", "")[:500]
     if isinstance(tool_response, dict):
         entry["exit_code"] = tool_response.get("exitCode", tool_response.get("exit_code"))
@@ -107,6 +119,10 @@ if run_id:
     ev_path = os.path.join(project_dir, ".omg", "evidence", f"{run_id}.json")
     if os.path.exists(ev_path):
         entry["evidence_path"] = os.path.relpath(ev_path, project_dir)
+        entry["evidence_links"] = [entry["evidence_path"]]
+
+if not entry["surface_tags"]:
+    entry.pop("surface_tags", None)
 
 # ── Latency tracking: duration_ms ──
 # Prefer startTime/endTime from hook stdin (ISO8601), fall back to wall clock.

package/build/lib/plugins/advanced/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-advanced",
-  "version": "2.1.8",
+  "version": "2.2.2",
   "description": "Advanced OMG commands - deep planning, learning, code review, and specialized workflows",
   "type": "omg-plugin",
   "commands": {

package/build/lib/plugins/core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-core",
-  "version": "2.1.8",
+  "version": "2.2.2",
   "description": "Core OMG commands - native setup, routing, orchestration, and verification surfaces",
   "type": "omg-plugin",
   "commands": {
@@ -74,6 +74,11 @@
       "description": "Set cognitive mode for the session",
       "category": "config"
     },
+    "preset": {
+      "path": "commands/OMG:preset.md",
+      "description": "Inspect or apply the canonical OMG preset for the current project",
+      "category": "config"
+    },
     "domain-init": {
       "path": "commands/OMG:domain-init.md",
       "description": "Alias for domain scaffolding (use init instead)",
@@ -152,7 +157,8 @@
     "config": {
       "description": "Configuration and settings",
       "commands": [
-        "mode"
+        "mode",
+        "preset"
       ]
     },
     "observability": {

package/build/lib/registry/approval_artifact.py

@@ -2,16 +2,16 @@
 from __future__ import annotations
 
 import base64
+import hashlib
 import json
 from dataclasses import asdict, dataclass
 from pathlib import Path
 from typing import Any
 
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-
 from registry.verify_artifact import (
     _canonical_json,
     _key_id_from_public_key,
+    _load_ed25519_backend,
     _load_trusted_signers,
     _parse_minisign_detached,
     _utc_now,
@@ -30,6 +30,7 @@ class ApprovalArtifact:
     signer_key_id: str
     issued_at: str
     signature: str
+    run_id: str = ""
 
 
 def _approval_signing_payload(approval: ApprovalArtifact) -> dict[str, object]:
@@ -42,6 +43,7 @@ def _approval_signing_payload(approval: ApprovalArtifact) -> dict[str, object]:
         "signer_key_id": approval.signer_key_id,
         "issued_at": approval.issued_at,
         "type": _APPROVAL_TYPE,
+        "run_id": approval.run_id,
     }
 
 
@@ -52,6 +54,7 @@ def create_approval_artifact(
     reason: str,
     signer_key_id: str,
     signer_private_key: str,
+    run_id: str = "",
 ) -> ApprovalArtifact:
 
     clean_digest = str(artifact_digest).strip().lower()
@@ -74,6 +77,7 @@ def create_approval_artifact(
         signer_key_id=signer_key_id,
         issued_at=issued_at,
         signature="",
+        run_id=str(run_id).strip(),
     )
 
     sig_result = sign_artifact(
@@ -108,6 +112,9 @@ def verify_approval_artifact(
     for field in required:
         if not isinstance(data.get(field), str) or not data[field].strip():
             return {"valid": False, "reason": f"missing or empty field: {field}"}
+    run_id_value = data.get("run_id", "")
+    if run_id_value is not None and not isinstance(run_id_value, str):
+        return {"valid": False, "reason": "run_id must be a string when present"}
 
     clean_expected = str(expected_artifact_digest).strip().lower()
     clean_actual = str(data["artifact_digest"]).strip().lower()
@@ -126,8 +133,11 @@ def verify_approval_artifact(
     if not isinstance(public_key_b64, str) or not public_key_b64:
         return {"valid": False, "reason": "invalid trusted signer public key"}
     try:
+        _, _, Ed25519PublicKey = _load_ed25519_backend()
         public_key_raw = base64.b64decode(public_key_b64, validate=True)
         public_key = Ed25519PublicKey.from_public_bytes(public_key_raw)
+    except ModuleNotFoundError as exc:
+        return {"valid": False, "reason": str(exc)}
     except Exception:
         return {"valid": False, "reason": "invalid trusted signer public key"}
 
@@ -148,6 +158,7 @@ def verify_approval_artifact(
         signer_key_id=key_id,
         issued_at=data["issued_at"],
         signature="",
+        run_id=str(run_id_value).strip(),
     )
     payload = _approval_signing_payload(temp_approval)
 
@@ -182,3 +193,44 @@ def load_approval_artifact_from_path(
         "reason": result["reason"],
         "approval": data if result["valid"] else None,
     }
+
+
+def build_tool_approval_digest(lane_name: str, tool_name: str, run_id: str) -> str:
+    payload = {
+        "lane": str(lane_name).strip().lower(),
+        "tool": str(tool_name).strip(),
+        "run_id": str(run_id).strip(),
+        "type": "omg-tool-fabric-approval-v1",
+    }
+    return hashlib.sha256(_canonical_json(payload)).hexdigest()
+
+
+def verify_tool_approval(
+    approval: ApprovalArtifact | dict[str, Any],
+    *,
+    lane_name: str,
+    tool_name: str,
+    run_id: str,
+) -> dict[str, Any]:
+    expected_digest = build_tool_approval_digest(lane_name=lane_name, tool_name=tool_name, run_id=run_id)
+    verified = verify_approval_artifact(approval, expected_artifact_digest=expected_digest)
+    if not bool(verified.get("valid")):
+        return verified
+
+    approval_obj: dict[str, Any]
+    if isinstance(approval, ApprovalArtifact):
+        approval_obj = asdict(approval)
+    elif isinstance(approval, dict):
+        approval_obj = dict(approval)
+    else:
+        return {"valid": False, "reason": "invalid approval artifact type"}
+
+    run_binding = str(approval_obj.get("run_id", "")).strip()
+    if not run_binding:
+        scope = str(approval_obj.get("scope", "")).strip()
+        token = f"/runs/{run_id}"
+        if token in scope:
+            run_binding = run_id
+    if run_binding != str(run_id).strip():
+        return {"valid": False, "reason": "approval artifact run_id mismatch"}
+    return verified

package/build/lib/registry/bundles/algorithms.yaml

@@ -1,6 +1,6 @@
 id: algorithms
 kind: domain-pack
-version: 2.1.8
+version: 2.2.2
 title: OMG Algorithms Pack
 description: Determinism and benchmark attachments for algorithm-heavy work.
 hosts:

package/build/lib/registry/bundles/api-twin.yaml

@@ -1,6 +1,6 @@
 id: api-twin
 kind: simulation
-version: 2.1.8
+version: 2.2.2
 title: OMG API Twin
 description: Versioned endpoint cassette replay with latency, drift, and cost reporting.
 hosts:

package/build/lib/registry/bundles/ast-pack.yaml

@@ -0,0 +1,80 @@
+id: ast-pack
+kind: governance
+version: 2.2.2
+title: OMG AST Pack Lane
+description: Governed AST search and replace lane with canonical approvals and proofs.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/tool_fabric.py
+    - registry/verify_artifact.py
+invocation_policy:
+  user_invocable: true
+  model_invocable: true
+  allow_implicit_invocation: false
+tool_policy:
+  side_effect_level: medium
+  allowed_tools:
+    claude:
+      - Grep
+      - Edit
+    codex:
+      - Grep
+      - Edit
+lifecycle_hooks:
+  native:
+    - PreToolUse
+    - PostToolUse
+  emulated:
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - python
+    - typescript
+evidence_outputs:
+  artifacts:
+    - .omg/evidence/ast-pack-{run_id}.json
+execution_contract:
+  modes:
+    - embedded
+    - local_supervisor
+tool_fabric:
+  lane: ast-pack
+  enforcement_order:
+    - tool_selection
+    - approval_state
+    - evidence_requirements
+    - attestation_proof_validation
+    - execution
+  tools:
+    - Grep
+    - Edit
+  semantic_operations:
+    - name: ast_search
+      tool: Grep
+      mutation_capable: false
+      requires_explicit_promotion: false
+    - name: ast_rewrite
+      tool: Edit
+      mutation_capable: true
+      requires_explicit_promotion: true
+  requires_signed_approval: true
+  requires_signed_approval_for_mutation: true
+  requires_attestation: false
+  requires_attestation_for_mutation: true
+  dry_run_first: true
+  require_run_scoped_evidence: true
+  require_fresh_evidence: true
+  evidence_max_age_seconds: 3600
+  required_evidence:
+    - .omg/evidence/ast-pack-{run_id}.json
+channel_overrides:
+  public:
+    posture: advisory
+  enterprise:
+    posture: managed

package/build/lib/registry/bundles/claim-judge.yaml

@@ -1,6 +1,6 @@
 id: claim-judge
 kind: proof
-version: 2.1.8
+version: 2.2.2
 title: OMG Claim Judge
 description: Evidence-backed claim validator for structured release and completion claims.
 hosts:

package/build/lib/registry/bundles/control-plane.yaml

@@ -1,6 +1,6 @@
 id: control-plane
 kind: skill
-version: 2.1.8
+version: 2.2.2
 title: OMG Control Plane
 description: Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi.
 hosts:
@@ -42,6 +42,8 @@ mcp_contract:
     - omg-memory
   prompts:
     - omg_contract_summary
+  tools:
+    - omg_tool_fabric_request
   resources:
     - resource://omg/contract
     - resource://omg/release-checklist
@@ -52,6 +54,7 @@ lsp_contract:
 evidence_outputs:
   artifacts:
     - .omg/evidence/control-plane-compile.json
+    - .omg/evidence/tool-fabric.json
 execution_contract:
   modes:
     - embedded
@@ -97,6 +100,18 @@ policy_model:
     - tool_name: Bash(python3:*)
       allowed_tiers: [balanced, interop, labs]
       requires_approval: true
+  tool_fabric_contract:
+    enforcement_order:
+      - tool_selection
+      - approval_state
+      - evidence_requirements
+      - attestation_proof_validation
+      - execution
+    lanes:
+      - lsp-pack
+      - hash-edit
+      - ast-pack
+      - terminal-lane
   protected_paths:
     - path_pattern: .omg/**
       required_tier: balanced

package/build/lib/registry/bundles/data-lineage.yaml

@@ -1,6 +1,6 @@
 id: data-lineage
 kind: provenance
-version: 2.1.8
+version: 2.2.2
 title: OMG Data Lineage
 description: Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts.
 hosts:

package/build/lib/registry/bundles/delta-classifier.yaml

@@ -1,6 +1,6 @@
 id: delta-classifier
 kind: routing
-version: 2.1.8
+version: 2.2.2
 title: OMG Delta Classifier
 description: Change classifier that attaches risk-aware checks, approvals, and packs.
 hosts:

package/build/lib/registry/bundles/eval-gate.yaml

@@ -1,6 +1,6 @@
 id: eval-gate
 kind: evaluation
-version: 2.1.8
+version: 2.2.2
 title: OMG Eval Gate
 description: Reproducible evaluation gate that blocks regressions before release.
 hosts:

package/build/lib/registry/bundles/hash-edit.yaml

@@ -0,0 +1,73 @@
+id: hash-edit
+kind: governance
+version: 2.2.2
+title: OMG Hash Edit Lane
+description: Governed hash-bound edit lane with signed approvals and evidence routing.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/tool_fabric.py
+    - registry/approval_artifact.py
+invocation_policy:
+  user_invocable: true
+  model_invocable: true
+  allow_implicit_invocation: false
+tool_policy:
+  side_effect_level: medium
+  allowed_tools:
+    claude:
+      - Edit
+    codex:
+      - Edit
+lifecycle_hooks:
+  native:
+    - PreToolUse
+    - PostToolUse
+  emulated:
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - python
+    - typescript
+evidence_outputs:
+  artifacts:
+    - .omg/evidence/hash-edit-{run_id}.json
+execution_contract:
+  modes:
+    - embedded
+    - local_supervisor
+tool_fabric:
+  lane: hash-edit
+  enforcement_order:
+    - tool_selection
+    - approval_state
+    - evidence_requirements
+    - attestation_proof_validation
+    - execution
+  tools:
+    - Edit
+  semantic_operations:
+    - name: single_file_hash_edit
+      tool: Edit
+      mutation_capable: true
+      requires_explicit_promotion: false
+  requires_signed_approval: true
+  requires_signed_approval_for_mutation: true
+  requires_attestation: false
+  requires_attestation_for_mutation: true
+  single_file_hash_bound: true
+  require_run_scoped_evidence: true
+  require_fresh_evidence: true
+  evidence_max_age_seconds: 3600
+  required_evidence:
+    - .omg/evidence/hash-edit-{run_id}.json
+channel_overrides:
+  public:
+    posture: advisory
+  enterprise:
+    posture: managed

package/build/lib/registry/bundles/health.yaml

@@ -1,6 +1,6 @@
 id: health
 kind: domain-pack
-version: 2.1.8
+version: 2.2.2
 title: OMG Health Pack
 description: Health-sensitive approvals, provenance, and replay attachments.
 hosts:

package/build/lib/registry/bundles/hook-governor.yaml

@@ -1,6 +1,6 @@
 id: hook-governor
 kind: governance
-version: 2.1.8
+version: 2.2.2
 title: OMG Hook Governor
 description: Canonical hook ordering, policy reinjection, and protected-path governance.
 hosts:
@@ -39,46 +39,42 @@ lifecycle_hooks:
     - TaskCompleted
 compiled_hooks:
   SessionStart:
-    - command: python3 "$HOME/.claude/hooks/session-start.py"
+    - command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/session-start.py"'
       timeout: 10
   SessionEnd:
-    - command: python3 "$HOME/.claude/hooks/session-end-capture.py"
+    - command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/session-end-capture.py"'
   PreToolUse:
     - matcher: Bash
-      command: python3 "$HOME/.claude/hooks/firewall.py"
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/firewall.py"'
       timeout: 10
     - matcher: Read|Write|Edit|MultiEdit
-      command: python3 "$HOME/.claude/hooks/secret-guard.py"
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/secret-guard.py"'
       timeout: 10
     - matcher: ""
-      command: python3 "$HOME/.claude/hooks/tdd-gate.py"
-      timeout: 10
-    - matcher: ""
-      command: python3 "$HOME/.claude/hooks/pre-tool-inject.py"
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/pre-tool-inject.py"'
   PostToolUse:
     - matcher: Bash
-      command: python3 "$HOME/.claude/hooks/circuit-breaker.py"
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/circuit-breaker.py"'
       timeout: 10
     - matcher: Write|Edit|MultiEdit
-      command: python3 "$HOME/.claude/hooks/tool-ledger.py"
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/tool-ledger.py"'
       timeout: 10
     - matcher: Write|Edit|MultiEdit
-      command: python3 "$HOME/.claude/hooks/test_generator_hook.py"
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/test_generator_hook.py"'
       timeout: 10
     - matcher: ""
-      command: python3 "$HOME/.claude/hooks/budget_governor.py"
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/budget_governor.py"'
       timeout: 10
   PostToolUseFailure:
-    - command: python3 "$HOME/.claude/hooks/post-tool-failure.py"
+    - command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/post-tool-failure.py"'
   Stop:
     - matcher: ""
-      command: python3 "$HOME/.claude/hooks/stop_dispatcher.py"
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/stop_dispatcher.py"'
       timeout: 90
 feature_dependencies:
   defense-state:
     required_for:
       - hook-governor
-      - tdd-gate
 mcp_contract:
   servers:
     - omg-control

package/build/lib/registry/bundles/incident-replay.yaml

@@ -1,6 +1,6 @@
 id: incident-replay
 kind: debugging
-version: 2.1.8
+version: 2.2.2
 title: OMG Incident Replay
 description: Replayable bug packs built from logs, failing tests, traces, and diffs.
 hosts: