@trac3er/oh-my-god 2.1.8 → 2.2.2

package/build/lib/runtime/data_lineage.py

@@ -1,9 +1,10 @@
-"""Lineage manifests for generated OMG artifacts."""
 from __future__ import annotations
 
+from collections import deque
 from datetime import datetime, timezone
 import json
 from pathlib import Path
+import sqlite3
 from typing import Any
 from uuid import uuid4
 
@@ -12,6 +13,144 @@ def _now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
+def _lineage_db_path(project_dir: str) -> Path:
+    return Path(project_dir) / ".omg" / "lineage" / "adjacency.sqlite3"
+
+
+def _lineage_conn(project_dir: str) -> sqlite3.Connection:
+    path = _lineage_db_path(project_dir)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(path)
+    conn.row_factory = sqlite3.Row
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS lineage_edges (
+            edge_id TEXT PRIMARY KEY,
+            parent_node TEXT NOT NULL,
+            child_node TEXT NOT NULL,
+            edge_type TEXT NOT NULL,
+            run_id TEXT NOT NULL,
+            profile_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            metadata_json TEXT NOT NULL DEFAULT '{}'
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE INDEX IF NOT EXISTS idx_lineage_scope
+        ON lineage_edges(run_id, profile_id, parent_node, child_node)
+        """
+    )
+    conn.commit()
+    return conn
+
+
+def add_lineage_edge(
+    project_dir: str,
+    *,
+    parent_node: str,
+    child_node: str,
+    edge_type: str,
+    run_id: str,
+    profile_id: str,
+    metadata: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    edge_id = f"edge-{uuid4().hex}"
+    payload = {
+        "edge_id": edge_id,
+        "parent_node": parent_node,
+        "child_node": child_node,
+        "edge_type": edge_type,
+        "run_id": run_id,
+        "profile_id": profile_id,
+        "created_at": _now(),
+        "metadata": metadata or {},
+    }
+    conn = _lineage_conn(project_dir)
+    conn.execute(
+        """
+        INSERT INTO lineage_edges(
+            edge_id, parent_node, child_node, edge_type, run_id, profile_id, created_at, metadata_json
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        """,
+        (
+            payload["edge_id"],
+            payload["parent_node"],
+            payload["child_node"],
+            payload["edge_type"],
+            payload["run_id"],
+            payload["profile_id"],
+            payload["created_at"],
+            json.dumps(payload["metadata"], ensure_ascii=True),
+        ),
+    )
+    conn.commit()
+    conn.close()
+    return payload
+
+
+def traverse_lineage(
+    project_dir: str,
+    *,
+    start_node: str,
+    run_id: str,
+    profile_id: str,
+    max_depth: int = 3,
+) -> dict[str, Any]:
+    bounded_depth = max(1, min(int(max_depth), 16))
+    conn = _lineage_conn(project_dir)
+    queue: deque[tuple[str, int]] = deque([(start_node, 0)])
+    nodes: set[str] = {start_node}
+    seen_edges: set[str] = set()
+    edges: list[dict[str, Any]] = []
+
+    while queue:
+        node, depth = queue.popleft()
+        if depth >= bounded_depth:
+            continue
+        rows = conn.execute(
+            """
+            SELECT edge_id, parent_node, child_node, edge_type, run_id, profile_id, created_at, metadata_json
+            FROM lineage_edges
+            WHERE run_id = ? AND profile_id = ? AND parent_node = ?
+            ORDER BY created_at ASC
+            """,
+            (run_id, profile_id, node),
+        ).fetchall()
+        for row in rows:
+            edge_id = str(row["edge_id"])
+            if edge_id in seen_edges:
+                continue
+            seen_edges.add(edge_id)
+            child_node = str(row["child_node"])
+            nodes.add(child_node)
+            edges.append(
+                {
+                    "edge_id": edge_id,
+                    "parent_node": str(row["parent_node"]),
+                    "child_node": child_node,
+                    "edge_type": str(row["edge_type"]),
+                    "run_id": str(row["run_id"]),
+                    "profile_id": str(row["profile_id"]),
+                    "created_at": str(row["created_at"]),
+                    "metadata": _parse_json_object(row["metadata_json"]),
+                }
+            )
+            queue.append((child_node, depth + 1))
+
+    conn.close()
+    return {
+        "schema": "LineageTraversalResult",
+        "start_node": start_node,
+        "run_id": run_id,
+        "profile_id": profile_id,
+        "max_depth": bounded_depth,
+        "nodes": sorted(nodes),
+        "edges": edges,
+    }
+
+
 def build_lineage_manifest(
     project_dir: str,
     *,
@@ -43,6 +182,18 @@ def build_lineage_manifest(
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
     payload["path"] = rel_path.as_posix()
+
+    trace_node = str(payload.get("trace_id", "")).strip()
+    if trace_node:
+        add_lineage_edge(
+            project_dir,
+            parent_node=trace_node,
+            child_node=lineage_id,
+            edge_type="trace_to_lineage",
+            run_id=trace_node,
+            profile_id="",
+            metadata={"artifact_type": artifact_type},
+        )
     return payload
 
 
@@ -71,3 +222,23 @@ def validate_lineage_manifest(payload: dict[str, Any]) -> dict[str, Any]:
         "status": "ok" if not errors else "error",
         "errors": errors,
     }
+
+
+def _parse_json_object(raw: object) -> dict[str, Any]:
+    if isinstance(raw, dict):
+        return raw
+    if not isinstance(raw, str):
+        return {}
+    try:
+        payload = json.loads(raw)
+    except (TypeError, ValueError, json.JSONDecodeError):
+        return {}
+    return payload if isinstance(payload, dict) else {}
+
+
+__all__ = [
+    "add_lineage_edge",
+    "build_lineage_manifest",
+    "traverse_lineage",
+    "validate_lineage_manifest",
+]

package/build/lib/runtime/delta_classifier.py

@@ -5,6 +5,8 @@ from pathlib import Path
 import subprocess
 from typing import Any
 
+from runtime.canonical_surface import RELEASE_SURFACE_LABELS
+
 
 _CATEGORY_RULES: dict[str, tuple[str, ...]] = {
     "auth": ("auth", "token", "secret", "login", "credential"),
@@ -65,6 +67,8 @@ _FORGE_TOKENS: tuple[str, ...] = (
     "lab job",
 )
 
+_EVIDENCE_PROFILES = RELEASE_SURFACE_LABELS["evidence_profiles"]
+
 
 def classify_project_changes(
     project_dir: str,
@@ -102,20 +106,20 @@ def _classify_evidence_profile(*, goal: str, touched_files: list[str], categorie
     lowered_files = [path.lower() for path in touched_files]
 
     if _contains_any(lowered_goal, _RELEASE_TOKENS) or any(_contains_any(path, _RELEASE_TOKENS) for path in lowered_files):
-        return "release"
+        return _EVIDENCE_PROFILES["release"]
 
     if _contains_any(lowered_goal, _FORGE_TOKENS) or any(_contains_any(path, _FORGE_TOKENS) for path in lowered_files):
-        return "forge-run"
+        return _EVIDENCE_PROFILES["forge_run"]
 
     if set(categories) & set(_SECURITY_CATEGORY_HINTS):
-        return "security-audit"
+        return _EVIDENCE_PROFILES["security_audit"]
     if _contains_any(lowered_goal, _SECURITY_TOKENS) or any(_contains_any(path, _SECURITY_TOKENS) for path in lowered_files):
-        return "security-audit"
+        return _EVIDENCE_PROFILES["security_audit"]
 
     if lowered_files and all(_is_docs_file(path) for path in lowered_files):
-        return "docs-only"
+        return _EVIDENCE_PROFILES["docs_only"]
 
-    return "code-change"
+    return _EVIDENCE_PROFILES["code_change"]
 
 
 def _is_docs_file(path: str) -> bool:

package/build/lib/runtime/domain_packs.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 
 from typing import Any
 
+from runtime.canonical_surface import DOMAIN_DEFAULTS
+
 
 DOMAIN_PACKS: dict[str, dict[str, Any]] = {
     "robotics": {
@@ -16,7 +18,7 @@ DOMAIN_PACKS: dict[str, dict[str, Any]] = {
     "vision": {
         "name": "vision",
         "required_approvals": [],
-        "required_evidence": ["dataset-provenance", "drift-check"],
+        "required_evidence": ["dataset-provenance", "drift-check", "vision-artifacts"],
         "policy_modules": ["dataset-lineage", "drift-gate"],
         "eval_hooks": ["vision-regression"],
         "replay_hooks": ["incident-replay"],
@@ -47,8 +49,27 @@ DOMAIN_PACKS: dict[str, dict[str, Any]] = {
     },
 }
 
+if set(DOMAIN_PACKS) != set(DOMAIN_DEFAULTS["all_domain_packs"]):
+    raise ValueError("domain pack definitions drifted from canonical defaults")
+
 
 def get_domain_pack_contract(name: str) -> dict[str, Any]:
     if name not in DOMAIN_PACKS:
         raise KeyError(name)
     return dict(DOMAIN_PACKS[name])
+
+
+def get_required_approvals(name: str) -> list[str]:
+    contract = get_domain_pack_contract(name)
+    raw = contract.get("required_approvals")
+    if not isinstance(raw, list):
+        return []
+    return [str(item) for item in raw if str(item).strip()]
+
+
+def get_required_evidence(name: str) -> list[str]:
+    contract = get_domain_pack_contract(name)
+    raw = contract.get("required_evidence")
+    if not isinstance(raw, list):
+        return []
+    return [str(item) for item in raw if str(item).strip()]

package/build/lib/runtime/equalizer.py

@@ -1,8 +1,11 @@
 from __future__ import annotations
 
 import importlib
+import os
+import shutil
 from typing import Any
 
+from runtime.canonical_surface import is_canonical_parity_host
 from runtime.cli_provider import get_provider
 
 
@@ -124,16 +127,24 @@ def _domain_fit(task_text: str) -> str:
 
 
 def _probe_provider(provider: str) -> tuple[bool, bool | None, str]:
-    if provider == "claude":
-        return True, True, "built-in"
+    normalized_provider = str(provider).strip().lower()
+    if normalized_provider == "claude":
+        claude_bin = os.environ.get("OMG_CLAUDE_BIN", "claude")
+        worker_cmd = os.environ.get("OMG_CLAUDE_WORKER_CMD", "").strip()
+        if worker_cmd or shutil.which(claude_bin) is not None:
+            return True, None, "cli-detected"
+        return False, False, "provider CLI unavailable"
+
+    if not is_canonical_parity_host(normalized_provider):
+        return False, False, "unsupported provider"
 
-    module_name = f"runtime.providers.{provider}_provider"
+    module_name = f"runtime.providers.{normalized_provider}_provider"
     try:
         _ = importlib.import_module(module_name)
     except Exception as exc:
         return False, False, f"provider module import failed: {exc}"
 
-    cli_provider = get_provider(provider)
+    cli_provider = get_provider(normalized_provider)
     if cli_provider is None:
         return False, False, "provider not registered"
 

package/build/lib/runtime/evidence_query.py

@@ -6,7 +6,7 @@ from pathlib import Path
 from typing import cast
 
 from runtime.context_engine import load_profile_digest
-from runtime.evidence_requirements import requirements_for_profile
+from runtime.evidence_requirements import EVIDENCE_REQUIREMENTS_BY_PROFILE, requirements_for_profile
 
 JsonPrimitive = str | int | float | bool | None
 JsonValue = JsonPrimitive | dict[str, "JsonValue"] | list["JsonValue"]
@@ -54,6 +54,7 @@ def _record_copy_with_context_metadata(root: Path, record: JsonObject) -> JsonOb
     profile_version = existing_profile_version or str(profile_digest.get("profile_version", "")).strip()
     evidence_profile = _record_string(record, "evidence_profile").strip()
     evidence_requirements = requirements_for_profile(evidence_profile)
+    profile_is_known = not evidence_profile or evidence_profile in EVIDENCE_REQUIREMENTS_BY_PROFILE
 
     intent_gate_payload = _load_json(root / ".omg" / "state" / "intent_gate" / f"{run_id}.json") or {}
     existing_intent_gate_version = _record_string(record, "intent_gate_version")
@@ -84,6 +85,9 @@ def _record_copy_with_context_metadata(root: Path, record: JsonObject) -> JsonOb
     enriched["intent_gate_version"] = intent_gate_version
     enriched["evidence_profile"] = evidence_profile
     enriched["evidence_requirements"] = cast(JsonValue, [str(item) for item in evidence_requirements])
+    enriched["evidence_profile_known"] = profile_is_known
+    if evidence_profile and not profile_is_known:
+        enriched["evidence_profile_error"] = f"unknown_evidence_profile:{evidence_profile}"
     return enriched
 
 
@@ -123,12 +127,15 @@ def _record_matches(
     record: JsonObject,
     *,
     run_id: str | None,
+    profile_id: str | None,
     trace_id: str | None,
     schema: str | None,
     kind: str | None,
 ) -> bool:
     if run_id is not None and _record_string(record, "run_id") != run_id:
         return False
+    if profile_id is not None and _record_string(record, "profile_id") != profile_id:
+        return False
     if trace_id is not None:
         direct_trace_id = _record_string(record, "trace_id")
         trace_ids = _record_string_list(record, "trace_ids")
@@ -151,6 +158,33 @@ def _record_matches(
     return True
 
 
+def _artifact_handles_only(record: JsonObject) -> JsonObject:
+    artifacts_raw = record.get("artifacts")
+    if not isinstance(artifacts_raw, list):
+        return record
+
+    artifact_handles: list[JsonObject] = []
+    for item in artifacts_raw:
+        if not isinstance(item, dict):
+            continue
+        handle: JsonObject = {
+            "kind": _record_string(item, "kind"),
+            "path": _record_string(item, "path"),
+            "summary": _record_string(item, "summary"),
+        }
+        size_value = item.get("size_bytes")
+        if isinstance(size_value, int):
+            handle["size_bytes"] = size_value
+        payload = item.get("payload")
+        if payload is not None:
+            handle["omitted_payload"] = True
+        artifact_handles.append(handle)
+
+    enriched = dict(record)
+    enriched["artifacts"] = cast(JsonValue, artifact_handles)
+    return enriched
+
+
 def get_evidence_pack(project_dir: str, run_id: str) -> JsonObject | None:
     root = Path(project_dir)
     evidence_files = _iter_json_files(root, Path(".omg") / "evidence")
@@ -169,6 +203,7 @@ def query_evidence(
     project_dir: str,
     *,
     run_id: str | None = None,
+    profile_id: str | None = None,
     trace_id: str | None = None,
     schema: str | None = None,
     kind: str | None = None,
@@ -184,21 +219,23 @@ def query_evidence(
             if _record_matches(
                 payload,
                 run_id=run_id,
+                profile_id=profile_id,
                 trace_id=trace_id,
                 schema=schema,
                 kind=kind,
             ):
-                records.append(_record_copy_with_context_metadata(root, payload))
+                records.append(_record_copy_with_context_metadata(root, _artifact_handles_only(payload)))
 
         for row in _read_jsonl(root / rel_dir / "events.jsonl"):
             if _record_matches(
                 row,
                 run_id=run_id,
+                profile_id=profile_id,
                 trace_id=trace_id,
                 schema=schema,
                 kind=kind,
             ):
-                records.append(_record_copy_with_context_metadata(root, row))
+                records.append(_record_copy_with_context_metadata(root, _artifact_handles_only(row)))
 
     return records
 

package/build/lib/runtime/evidence_requirements.py

@@ -13,8 +13,15 @@ FULL_REQUIREMENTS: Final[list[str]] = [
     "license_scan",
     "sbom",
     "trace_link",
+    "artifact_contracts",
+    "signed_lineage",
+    "signed_model_card",
+    "signed_checkpoint",
+    "simulator-episode-evidence",
 ]
 
+HARDENED_READINESS_REQUIREMENTS: Final[list[str]] = list(FULL_REQUIREMENTS)
+
 EVIDENCE_REQUIREMENTS_BY_PROFILE: Final[dict[str, list[str]]] = {
     "code-change": [
         "tests",
@@ -34,6 +41,69 @@ EVIDENCE_REQUIREMENTS_BY_PROFILE: Final[dict[str, list[str]]] = {
         "trace_link",
         "artifact_contracts",
     ],
+    "browser-flow": [
+        "lsp_clean",
+        "trace_link",
+        "provenance",
+    ],
+    "forge-cybersecurity": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+        "artifact_contracts",
+        "security_scan",
+    ],
+    "interop-diagnosis": [
+        "lsp_clean",
+        "trace_link",
+        "provenance",
+        "trust_scores",
+    ],
+    "install-validation": [
+        "tests",
+        "lsp_clean",
+        "build",
+        "provenance",
+        "trace_link",
+    ],
+    "music-omr": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+        "artifact_contracts",
+    ],
+    "forge-vision": list(HARDENED_READINESS_REQUIREMENTS)
+    + [
+        "vision-artifacts",
+        "drift-check",
+    ],
+    "health-flow": list(HARDENED_READINESS_REQUIREMENTS)
+    + [
+        "human-review",
+        "audit-trail",
+        "restricted-tools",
+    ],
+    "team-flow": list(HARDENED_READINESS_REQUIREMENTS)
+    + [
+        "human-review",
+        "audit-trail",
+        "restricted-tools",
+    ],
+    "transposition-flow": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+        "artifact_contracts",
+        "benchmark-harness",
+        "determinism-check",
+        "signed_lineage",
+        "signed_model_card",
+        "signed_checkpoint",
+    ],
+    "buffet": list(FULL_REQUIREMENTS),
     "security-audit": list(FULL_REQUIREMENTS),
     "release": list(FULL_REQUIREMENTS),
 }