@trac3er/oh-my-god 2.1.8 → 2.2.2

package/build/lib/runtime/budget_envelopes.py

@@ -0,0 +1,358 @@
+"""Multi-dimensional budget envelopes — CPU, memory, wall time, tokens, and network.
+
+Tracks per-run and per-worker resource usage against configurable limits.
+Persists envelope state to `.omg/state/budget-envelopes/<run_id>.json`.
+Feeds into session health, worker watchdogs, and governed tool decisions.
+
+Governance actions:
+  - warn:    log only, no execution impact
+  - reflect: pause and report to supervisor
+  - block:   terminate / reject further work
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+from dataclasses import asdict, dataclass, field
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+
+# ═══════════════════════════════════════════════════════════
+# Dataclasses
+# ═══════════════════════════════════════════════════════════
+
+
+@dataclass
+class BudgetEnvelope:
+    """Declared resource limits for a run or worker."""
+
+    run_id: str
+    cpu_seconds_limit: float = 0.0
+    memory_mb_limit: float = 0.0
+    wall_time_seconds_limit: float = 0.0
+    token_limit: int = 0
+    network_bytes_limit: int = 0
+
+
+@dataclass
+class BudgetEnvelopeState:
+    """Current resource usage tracking for a run or worker."""
+
+    run_id: str
+    cpu_seconds_used: float = 0.0
+    memory_mb_peak: float = 0.0
+    wall_time_seconds_elapsed: float = 0.0
+    tokens_used: int = 0
+    network_bytes_used: int = 0
+    started_at: str = ""
+    updated_at: str = ""
+
+
+@dataclass
+class EnvelopeCheckResult:
+    """Result of checking a run against its envelope limits."""
+
+    status: str  # "ok", "warn", "breach"
+    breached_dimensions: list[str] = field(default_factory=list)
+    governance_action: str = "warn"  # "warn", "reflect", "block"
+    reason: str = ""
+
+
+# ═══════════════════════════════════════════════════════════
+# Constants
+# ═══════════════════════════════════════════════════════════
+
+_GOVERNANCE_ACTIONS = frozenset({"warn", "reflect", "block"})
+
+# Warn at 80%, block at 100% by default
+_DEFAULT_WARN_RATIO = 0.80
+_DEFAULT_BLOCK_RATIO = 1.00
+
+_ENVELOPE_STATE_REL = Path(".omg") / "state" / "budget-envelopes"
+
+
+# ═══════════════════════════════════════════════════════════
+# Manager
+# ═══════════════════════════════════════════════════════════
+
+
+class BudgetEnvelopeManager:
+    """Create, track, and enforce multi-dimensional budget envelopes.
+
+    Envelopes are persisted as JSON to `.omg/state/budget-envelopes/<run_id>.json`.
+    """
+
+    def __init__(self, project_dir: str | None = None):
+        if project_dir:
+            self.project_dir = Path(project_dir)
+        else:
+            self.project_dir = Path(os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd()))
+
+    # --- Paths ---
+
+    def _envelope_dir(self) -> Path:
+        return self.project_dir / _ENVELOPE_STATE_REL
+
+    def _envelope_path(self, run_id: str) -> Path:
+        return self._envelope_dir() / f"{run_id}.json"
+
+    # --- CRUD ---
+
+    def create_envelope(
+        self,
+        run_id: str,
+        *,
+        cpu_seconds_limit: float = 0.0,
+        memory_mb_limit: float = 0.0,
+        wall_time_seconds_limit: float = 0.0,
+        token_limit: int = 0,
+        network_bytes_limit: int = 0,
+    ) -> dict[str, Any]:
+        """Create and persist a new budget envelope for *run_id*.
+
+        Returns the full persisted state dict.
+        """
+        now = _now_iso()
+        envelope = BudgetEnvelope(
+            run_id=run_id,
+            cpu_seconds_limit=cpu_seconds_limit,
+            memory_mb_limit=memory_mb_limit,
+            wall_time_seconds_limit=wall_time_seconds_limit,
+            token_limit=token_limit,
+            network_bytes_limit=network_bytes_limit,
+        )
+        state = BudgetEnvelopeState(
+            run_id=run_id,
+            started_at=now,
+            updated_at=now,
+        )
+        payload: dict[str, Any] = {
+            "schema": "BudgetEnvelopeState",
+            "schema_version": "1.0.0",
+            "envelope": asdict(envelope),
+            "usage": asdict(state),
+            "checks": [],
+        }
+        _write_atomic_json(self._envelope_path(run_id), payload)
+        return payload
+
+    def record_usage(
+        self,
+        run_id: str,
+        *,
+        cpu_seconds: float = 0.0,
+        memory_mb: float = 0.0,
+        wall_time_seconds: float = 0.0,
+        tokens: int = 0,
+        network_bytes: int = 0,
+    ) -> dict[str, Any]:
+        """Increment usage counters for *run_id*.
+
+        Memory is tracked as peak (max), all others are additive.
+        Returns the updated state dict.
+        """
+        payload = self._read_state(run_id)
+        if not payload:
+            # Auto-create a zero-limit envelope (uncapped) so usage is still tracked
+            payload = self.create_envelope(run_id)
+
+        usage = payload.get("usage", {})
+        usage["cpu_seconds_used"] = _to_float(usage.get("cpu_seconds_used"), 0.0) + cpu_seconds
+        usage["memory_mb_peak"] = max(
+            _to_float(usage.get("memory_mb_peak"), 0.0),
+            memory_mb,
+        )
+        usage["wall_time_seconds_elapsed"] = (
+            _to_float(usage.get("wall_time_seconds_elapsed"), 0.0) + wall_time_seconds
+        )
+        usage["tokens_used"] = _to_int(usage.get("tokens_used"), 0) + tokens
+        usage["network_bytes_used"] = _to_int(usage.get("network_bytes_used"), 0) + network_bytes
+        usage["updated_at"] = _now_iso()
+        payload["usage"] = usage
+
+        _write_atomic_json(self._envelope_path(run_id), payload)
+        return payload
+
+    def check_envelope(self, run_id: str) -> EnvelopeCheckResult:
+        """Compare current usage against envelope limits.
+
+        Returns an ``EnvelopeCheckResult`` with status, breached dimensions, and
+        the appropriate governance action.
+
+        Governance escalation logic:
+          - No limit set (0) → dimension is uncapped, never breaches.
+          - Usage >= 100% of limit → status=breach, action=block.
+          - Usage >= 80% of limit → status=warn, action=warn (first time) or reflect (repeated).
+          - Otherwise → status=ok, action=warn (no-op).
+        """
+        payload = self._read_state(run_id)
+        if not payload:
+            return EnvelopeCheckResult(status="ok", reason="no envelope found")
+
+        envelope = payload.get("envelope", {})
+        usage = payload.get("usage", {})
+        checks_history: list[dict[str, Any]] = payload.get("checks", [])
+
+        breached: list[str] = []
+        warned: list[str] = []
+
+        _DIMS: list[tuple[str, str, str]] = [
+            ("cpu_seconds_limit", "cpu_seconds_used", "cpu"),
+            ("memory_mb_limit", "memory_mb_peak", "memory"),
+            ("wall_time_seconds_limit", "wall_time_seconds_elapsed", "wall_time"),
+            ("token_limit", "tokens_used", "tokens"),
+            ("network_bytes_limit", "network_bytes_used", "network"),
+        ]
+
+        for limit_key, used_key, dim_name in _DIMS:
+            limit_val = _to_float(envelope.get(limit_key), 0.0)
+            if limit_val <= 0:
+                continue  # uncapped
+            used_val = _to_float(usage.get(used_key), 0.0)
+            ratio = used_val / limit_val
+
+            if ratio >= _DEFAULT_BLOCK_RATIO:
+                breached.append(dim_name)
+            elif ratio >= _DEFAULT_WARN_RATIO:
+                warned.append(dim_name)
+
+        # Determine governance action
+        if breached:
+            status = "breach"
+            governance_action = "block"
+            reason = f"envelope breached on: {', '.join(breached)}"
+        elif warned:
+            # Escalate to reflect if we warned before on the same dimensions
+            prior_warned = set()
+            for chk in checks_history:
+                if chk.get("status") == "warn":
+                    prior_warned.update(chk.get("breached_dimensions", []))
+            repeat_warns = set(warned) & prior_warned
+            if repeat_warns:
+                status = "warn"
+                governance_action = "reflect"
+                reason = f"repeated warning on: {', '.join(sorted(repeat_warns))}"
+            else:
+                status = "warn"
+                governance_action = "warn"
+                reason = f"approaching limits on: {', '.join(warned)}"
+        else:
+            status = "ok"
+            governance_action = "warn"  # no-op sentinel
+            reason = "all dimensions within limits"
+
+        result = EnvelopeCheckResult(
+            status=status,
+            breached_dimensions=breached or warned,
+            governance_action=governance_action,
+            reason=reason,
+        )
+
+        # Persist check result in history
+        check_record = {
+            "checked_at": _now_iso(),
+            "status": result.status,
+            "breached_dimensions": list(result.breached_dimensions),
+            "governance_action": result.governance_action,
+            "reason": result.reason,
+        }
+        checks_history.append(check_record)
+        payload["checks"] = checks_history
+        _write_atomic_json(self._envelope_path(run_id), payload)
+
+        return result
+
+    def get_envelope_state(self, run_id: str) -> dict[str, Any] | None:
+        """Read current envelope state from disk.
+
+        Returns the full state dict or None if no envelope exists.
+        """
+        payload = self._read_state(run_id)
+        return payload if payload else None
+
+    def get_envelope_pressure(self, run_id: str) -> dict[str, float]:
+        """Return per-dimension usage ratios (0.0–1.0+) for health integration.
+
+        Returns empty dict if no envelope exists.
+        """
+        payload = self._read_state(run_id)
+        if not payload:
+            return {}
+
+        envelope = payload.get("envelope", {})
+        usage = payload.get("usage", {})
+        pressure: dict[str, float] = {}
+
+        _DIMS: list[tuple[str, str, str]] = [
+            ("cpu_seconds_limit", "cpu_seconds_used", "cpu"),
+            ("memory_mb_limit", "memory_mb_peak", "memory"),
+            ("wall_time_seconds_limit", "wall_time_seconds_elapsed", "wall_time"),
+            ("token_limit", "tokens_used", "tokens"),
+            ("network_bytes_limit", "network_bytes_used", "network"),
+        ]
+
+        for limit_key, used_key, dim_name in _DIMS:
+            limit_val = _to_float(envelope.get(limit_key), 0.0)
+            if limit_val <= 0:
+                continue
+            used_val = _to_float(usage.get(used_key), 0.0)
+            pressure[dim_name] = round(used_val / limit_val, 4)
+
+        return pressure
+
+    # --- Internal ---
+
+    def _read_state(self, run_id: str) -> dict[str, Any]:
+        return _read_json(self._envelope_path(run_id))
+
+
+# ═══════════════════════════════════════════════════════════
+# Helpers
+# ═══════════════════════════════════════════════════════════
+
+
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _write_atomic_json(path: Path, payload: dict[str, Any]) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp_path = path.with_name(f"{path.name}.tmp")
+    tmp_path.write_text(
+        json.dumps(payload, indent=2, ensure_ascii=True) + "\n",
+        encoding="utf-8",
+    )
+    os.replace(tmp_path, path)
+
+
+def _read_json(path: Path) -> dict[str, Any]:
+    if not path.exists():
+        return {}
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {}
+    return payload if isinstance(payload, dict) else {}
+
+
+def _to_float(value: Any, default: float) -> float:
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return default
+
+
+def _to_int(value: Any, default: int) -> int:
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return default
+
+
+def get_budget_envelope_manager(project_dir: str | None = None) -> BudgetEnvelopeManager:
+    """Factory for BudgetEnvelopeManager instances."""
+    return BudgetEnvelopeManager(project_dir)

package/build/lib/runtime/canonical_surface.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+from typing import Final
+
+from runtime.evidence_requirements import EVIDENCE_REQUIREMENTS_BY_PROFILE
+
+CANONICAL_PARITY_HOSTS: Final[list[str]] = ["claude", "codex", "gemini", "kimi"]
+COMPATIBILITY_ONLY_HOSTS: Final[list[str]] = ["opencode"]
+
+DOMAIN_DEFAULTS: Final[dict[str, tuple[str, ...]]] = {
+    "preflight_domain_packs": ("robotics", "vision", "algorithms", "health"),
+    "all_domain_packs": ("robotics", "vision", "algorithms", "health", "cybersecurity"),
+}
+
+def _release_evidence_profile_labels() -> dict[str, str]:
+    return {
+        profile.replace("-", "_"): profile
+        for profile in EVIDENCE_REQUIREMENTS_BY_PROFILE
+    }
+
+
+RELEASE_SURFACE_LABELS: Final[dict[str, dict[str, str]]] = {
+    "evidence_profiles": {
+        **_release_evidence_profile_labels(),
+    },
+    "routes": {
+        "teams": "teams",
+        "security_check": "security-check",
+        "api_twin": "api-twin",
+        "crazy": "crazy",
+    },
+}
+
+
+def get_canonical_hosts() -> list[str]:
+    return list(CANONICAL_PARITY_HOSTS)
+
+
+def get_compat_hosts() -> list[str]:
+    return list(COMPATIBILITY_ONLY_HOSTS)
+
+
+def get_all_supported_hosts() -> list[str]:
+    return [*CANONICAL_PARITY_HOSTS, *COMPATIBILITY_ONLY_HOSTS]
+
+
+def is_canonical_parity_host(host: str) -> bool:
+    return str(host).strip().lower() in CANONICAL_PARITY_HOSTS
+
+
+def is_compat_only_host(host: str) -> bool:
+    return str(host).strip().lower() in COMPATIBILITY_ONLY_HOSTS

package/build/lib/runtime/claim_judge.py

@@ -5,6 +5,7 @@ import os
 from pathlib import Path
 from typing import Any
 
+from registry.verify_artifact import verify_artifact_statement
 from runtime import artifact_parsers
 from runtime.context_engine import load_profile_digest
 from runtime.evidence_query import get_evidence_pack
@@ -89,14 +90,48 @@ def judge_claims(project_dir: str, claims: list[dict[str, Any]]) -> dict[str, An
     }
 
 
+def evaluate_claims_for_release(
+    project_dir: str,
+    run_id: str,
+    claims: list[dict[str, Any]] | None = None,
+) -> dict[str, Any]:
+    candidate_claims = claims if isinstance(claims, list) and claims else [
+        {
+            "claim_type": "release_ready",
+            "run_id": run_id,
+            "evidence_profile": "release",
+        }
+    ]
+    judged = judge_claims(project_dir, candidate_claims)
+    verdict = str(judged.get("verdict", "")).strip().lower()
+    if verdict in {"fail", "insufficient", "block", "blocked", "error"}:
+        return {
+            "status": "blocked",
+            "authority": "claim_judge",
+            "reason": f"claim_judge_verdict={verdict}",
+            "claim_judge_verdict": verdict,
+            "claim_judge": judged,
+        }
+    return {
+        "status": "allowed",
+        "authority": "claim_judge",
+        "reason": f"claim_judge_verdict={verdict or 'pass'}",
+        "claim_judge_verdict": verdict or "pass",
+        "claim_judge": judged,
+    }
+
+
 def judge_claim(claim: dict[str, Any]) -> dict[str, Any]:
     normalized_claim = _normalize_claim(claim)
     claim_type = str(normalized_claim.get("claim_type", "")).strip()
     subject = str(normalized_claim.get("subject", "")).strip()
+    run_id = str(claim.get("run_id", "")).strip()
     artifacts = _as_non_empty_str_list(normalized_claim.get("artifacts"))
     trace_ids = _as_non_empty_str_list(normalized_claim.get("trace_ids"))
     security_scans = normalized_claim.get("security_scans")
     browser_evidence = normalized_claim.get("browser_evidence")
+    excluded_failures = _as_non_empty_list(normalized_claim.get("excluded_failures"))
+    excluded_failures_waiver_path = str(normalized_claim.get("excluded_failures_waiver_path", "")).strip()
     evidence_profile = str(normalized_claim.get("evidence_profile", "")).strip()
     evidence_requirements = requirements_for_profile(evidence_profile)
     requirement_set = {str(item).strip() for item in evidence_requirements if str(item).strip()}
@@ -157,6 +192,15 @@ def judge_claim(claim: dict[str, Any]) -> dict[str, Any]:
             }
         )
 
+    reasons.extend(
+        _validate_excluded_failures_policy(
+            project_dir=project_dir,
+            run_id=run_id,
+            excluded_failures=excluded_failures,
+            waiver_path=excluded_failures_waiver_path,
+        )
+    )
+
     strict_mode = os.environ.get("OMG_PROOF_CHAIN_STRICT", "0").strip() == "1"
     strict_causal_chain = strict_mode or _claim_type_enforces_strict_causal_chain(
         claim_type=claim_type,
@@ -197,6 +241,8 @@ def judge_claim(claim: dict[str, Any]) -> dict[str, Any]:
             "lineage": normalized_claim.get("lineage") if isinstance(normalized_claim.get("lineage"), dict) else {},
             "security_scans": security_scans if isinstance(security_scans, list) else [],
             "browser_evidence": browser_evidence if isinstance(browser_evidence, list) else [],
+            "excluded_failures": excluded_failures,
+            "excluded_failures_waiver_path": excluded_failures_waiver_path,
             "causal_chain": causal_chain,
             "advisories": advisories,
             "evidence_profile": evidence_profile,
@@ -223,6 +269,13 @@ def _normalize_claim(claim: dict[str, Any]) -> dict[str, Any]:
     claim_browser_evidence = claim.get("browser_evidence")
     browser_evidence = claim_browser_evidence if isinstance(claim_browser_evidence, list) else _as_non_empty_dict_list(evidence.get("browser_evidence"))
 
+    claim_excluded_failures = claim.get("excluded_failures")
+    excluded_failures = claim_excluded_failures if isinstance(claim_excluded_failures, list) else _as_non_empty_list(evidence.get("excluded_failures"))
+
+    excluded_failures_waiver_path = str(
+        claim.get("excluded_failures_waiver_path", evidence.get("excluded_failures_waiver_path", ""))
+    ).strip()
+
     lock_verification = claim.get("lock_verification") if isinstance(claim.get("lock_verification"), dict) else _as_dict(evidence.get("lock_verification"))
     causal_chain = {
         "lock_id": str(claim.get("lock_id", evidence.get("lock_id", ""))).strip(),
@@ -244,11 +297,127 @@ def _normalize_claim(claim: dict[str, Any]) -> dict[str, Any]:
         "lineage": lineage,
         "security_scans": security_scans,
         "browser_evidence": browser_evidence,
+        "excluded_failures": excluded_failures,
+        "excluded_failures_waiver_path": excluded_failures_waiver_path,
         "causal_chain": causal_chain,
         "evidence_profile": str(claim.get("evidence_profile", evidence.get("evidence_profile", ""))).strip(),
     }
 
 
+def _validate_excluded_failures_policy(
+    *,
+    project_dir: str,
+    run_id: str,
+    excluded_failures: list[Any],
+    waiver_path: str,
+) -> list[dict[str, Any]]:
+    if not excluded_failures:
+        return []
+
+    if not waiver_path:
+        return [
+            {
+                "code": "excluded_failures_without_signed_waiver",
+                "message": "Excluded failures require a signed waiver artifact.",
+                "field": "excluded_failures",
+            }
+        ]
+
+    waiver_file = Path(waiver_path)
+    if not waiver_file.is_absolute():
+        waiver_file = Path(project_dir) / waiver_file
+    if not waiver_file.exists():
+        return [
+            {
+                "code": "excluded_failures_without_signed_waiver",
+                "message": f"Excluded failures waiver artifact not found: {waiver_path}",
+                "field": "excluded_failures_waiver_path",
+            }
+        ]
+
+    try:
+        waiver_payload = json.loads(waiver_file.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        waiver_payload = None
+    if not isinstance(waiver_payload, dict):
+        return [
+            {
+                "code": "excluded_failures_without_signed_waiver",
+                "message": "Excluded failures waiver artifact must be valid JSON.",
+                "field": "excluded_failures_waiver_path",
+            }
+        ]
+
+    statement = _extract_signed_statement(waiver_payload)
+    if not isinstance(statement, dict) or not verify_artifact_statement(statement):
+        return [
+            {
+                "code": "excluded_failures_without_signed_waiver",
+                "message": "Excluded failures waiver artifact must include a valid signed attestation statement.",
+                "field": "excluded_failures_waiver_path",
+            }
+        ]
+
+    waiver_run_id = str(waiver_payload.get("run_id", "")).strip()
+    if run_id and waiver_run_id and waiver_run_id != run_id:
+        return [
+            {
+                "code": "excluded_failures_without_signed_waiver",
+                "message": "Excluded failures waiver artifact run_id does not match claim run_id.",
+                "field": "excluded_failures_waiver_path",
+            }
+        ]
+
+    waiver_exclusions = _as_non_empty_list(waiver_payload.get("excluded_failures"))
+    if not waiver_exclusions:
+        return [
+            {
+                "code": "excluded_failures_without_signed_waiver",
+                "message": "Excluded failures waiver artifact must enumerate excluded failures.",
+                "field": "excluded_failures_waiver_path",
+            }
+        ]
+
+    required = {_normalize_exclusion_token(item) for item in excluded_failures}
+    provided = {_normalize_exclusion_token(item) for item in waiver_exclusions}
+    if not required.issubset(provided):
+        return [
+            {
+                "code": "excluded_failures_without_signed_waiver",
+                "message": "Excluded failures waiver artifact does not authorize all excluded failures.",
+                "field": "excluded_failures",
+            }
+        ]
+    return []
+
+
+def _extract_signed_statement(payload: dict[str, Any]) -> dict[str, Any] | None:
+    if "_type" in payload and "subject" in payload and "predicateType" in payload:
+        return payload
+    candidate = payload.get("attestation_statement")
+    if isinstance(candidate, dict):
+        return candidate
+    candidate = payload.get("statement")
+    if isinstance(candidate, dict):
+        return candidate
+    candidate = payload.get("attestation")
+    if isinstance(candidate, dict):
+        return candidate
+    return None
+
+
+def _normalize_exclusion_token(value: Any) -> str:
+    if isinstance(value, str):
+        return value.strip()
+    if isinstance(value, dict):
+        for field in ("id", "test", "name", "reason"):
+            token = str(value.get(field, "")).strip()
+            if token:
+                return token
+        return json.dumps(value, sort_keys=True, ensure_ascii=True)
+    return str(value).strip()
+
+
 def _validate_causal_chain(causal_chain: dict[str, Any], *, require_versions: bool) -> list[str]:
     errors: list[str] = []
     lock_id = str(causal_chain.get("lock_id", "")).strip()
@@ -350,6 +519,19 @@ def _as_non_empty_str_list(value: Any) -> list[str]:
     return [str(item).strip() for item in value if str(item).strip()]
 
 
+def _as_non_empty_list(value: Any) -> list[Any]:
+    if not isinstance(value, list):
+        return []
+    items: list[Any] = []
+    for item in value:
+        if isinstance(item, str) and not item.strip():
+            continue
+        if item in ({}, []):
+            continue
+        items.append(item)
+    return items
+
+
 def _as_non_empty_dict_list(value: Any) -> list[dict[str, Any]]:
     if not isinstance(value, list):
         return []