@trac3er/oh-my-god 2.1.8 → 2.2.2

package/build/lib/runtime/providers/kimi_provider.py

@@ -11,11 +11,23 @@ import uuid
 from typing import Any
 
 from runtime.cli_provider import CLIProvider, register_provider
+from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_kimi_mcp_config
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
 
+
+def _attach_normalized_output(payload: dict[str, Any], *, prompt: str, project_dir: str) -> dict[str, Any]:
+    normalized = normalize_output(
+        "kimi",
+        payload,
+        context={"prompt": prompt, "project_dir": project_dir},
+    )
+    merged = dict(payload)
+    merged["normalized_output"] = normalized
+    return merged
+
 HOST_RULES = {
     "compilation_targets": [".kimi/mcp.json"],
     "mcp": ["omg-control"],
@@ -66,12 +78,14 @@ class KimiCodeProvider(CLIProvider):
             result = self.run_tool(
                 ["kimi", "--print", "-p", prompt],
                 timeout=timeout,
+                cwd=project_dir,
+                env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "kimi-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "kimi-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -85,12 +99,14 @@ class KimiCodeProvider(CLIProvider):
             result = self.run_tool(
                 ["kimi", "--print", "--output-format", "stream-json", "-p", prompt],
                 timeout=timeout,
+                cwd=project_dir,
+                env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "kimi-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "kimi-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -106,10 +122,21 @@ class KimiCodeProvider(CLIProvider):
         try:
             mgr = TmuxSessionManager()
             session_name = mgr.make_session_name("kimi", unique_id=str(uuid.uuid4())[:8])
-            session = mgr.get_or_create_session(session_name)
-            output = mgr.send_command(session, f"kimi --print -p {shlex.quote(prompt)}", timeout=timeout)
+            session = mgr.get_or_create_session(session_name, cwd=project_dir)
+            output = mgr.send_command(
+                session,
+                (
+                    f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+                    f"kimi --print -p {shlex.quote(prompt)}"
+                ),
+                timeout=timeout,
+            )
             mgr.kill_session(session)
-            return {"model": "kimi-cli", "output": output, "exit_code": 0}
+            return _attach_normalized_output(
+                {"model": "kimi-cli", "output": output, "exit_code": 0},
+                prompt=prompt,
+                project_dir=project_dir,
+            )
         except Exception as exc:
             _logger.warning("tmux kimi invocation failed, falling back to subprocess: %s", exc)
             return self.invoke(prompt, project_dir, timeout=timeout)

package/build/lib/runtime/providers/opencode_provider.py

@@ -42,7 +42,12 @@ class OpenCodeProvider(CLIProvider):
 
     def invoke(self, prompt: str, project_dir: str, timeout: int = 120) -> dict[str, Any]:  # pyright: ignore[reportExplicitAny, reportImplicitOverride]
         try:
-            result = self.run_tool(["opencode", prompt], timeout=timeout)
+            result = self.run_tool(
+                ["opencode", prompt],
+                timeout=timeout,
+                cwd=project_dir,
+                env={"CLAUDE_PROJECT_DIR": project_dir},
+            )
             return {
                 "model": "opencode-cli",
                 "output": result.stdout,

package/build/lib/runtime/release_run_coordinator.py

@@ -15,6 +15,10 @@ from runtime.compliance_governor import evaluate_release_compliance
 from runtime.runtime_contracts import write_run_state
 from runtime.session_health import compute_session_health
 from runtime.verification_controller import VerificationController
+from runtime.claim_judge import evaluate_claims_for_release
+from runtime.exec_kernel import get_exec_kernel
+from runtime.worker_watchdog import get_worker_watchdog
+from runtime.merge_writer import get_merge_writer
 
 
 class RunIdConflictError(ValueError):
@@ -56,12 +60,34 @@ class ReleaseRunCoordinator:
                 "verification_status": verification_state.get("status", "running"),
             },
         )
-        return {
+        get_exec_kernel(self.project_dir).register_run(
+            run_id,
+            source="release_run_coordinator.begin",
+            reason=f"{resolved.source}:{resolved.reason}",
+        )
+        try:
+            get_worker_watchdog(self.project_dir).record_heartbeat(
+                run_id, status="alive",
+                metadata={"phase": "begin", "source": resolved.source},
+            )
+        except Exception:
+            pass
+        merge_writer_token = None
+        try:
+            mw = get_merge_writer(self.project_dir)
+            token = mw.acquire(run_id, reason=f"release_run:{resolved.source}")
+            merge_writer_token = token.lock_path
+        except Exception:
+            pass
+        result: dict[str, object] = {
             "status": "running",
             "run_id": run_id,
             "resolution_source": resolved.source,
             "resolution_reason": resolved.reason,
         }
+        if merge_writer_token:
+            result["merge_writer_lock"] = merge_writer_token
+        return result
 
     def mutate(
         self,
@@ -106,6 +132,11 @@ class ReleaseRunCoordinator:
                 "health_action": str(health.get("recommended_action", "continue")),
             },
         )
+        get_exec_kernel(self.project_dir).register_run(
+            canonical_run_id,
+            source="release_run_coordinator.mutate",
+            reason=f"tool={tool}",
+        )
         return {
             "status": "running",
             "run_id": canonical_run_id,
@@ -132,6 +163,28 @@ class ReleaseRunCoordinator:
                 "health_action": str(health.get("recommended_action", "continue")),
             },
         )
+        get_exec_kernel(self.project_dir).register_run(
+            canonical_run_id,
+            source="release_run_coordinator.verify",
+            reason="verification_phase",
+        )
+        try:
+            watchdog = get_worker_watchdog(self.project_dir)
+            watchdog.record_heartbeat(
+                canonical_run_id, status="alive",
+                metadata={"phase": "verify"},
+            )
+            stall = watchdog.escalate_stall(canonical_run_id)
+            if stall:
+                from runtime.incident_replay import build_worker_lifecycle_pack
+                build_worker_lifecycle_pack(
+                    self.project_dir,
+                    run_id=canonical_run_id,
+                    event="stall_detected_during_verify",
+                    heartbeat=stall.get("heartbeat"),
+                )
+        except Exception:
+            pass
         return {
             "status": str(verification_state.get("status", "running")),
             "run_id": canonical_run_id,
@@ -149,11 +202,33 @@ class ReleaseRunCoordinator:
         canonical_run_id = resolved.run_id
 
         release_evidence = self._read_release_evidence(canonical_run_id)
-        compliance = evaluate_release_compliance(
-            project_dir=self.project_dir,
-            run_id=canonical_run_id,
-            release_evidence=release_evidence,
-        )
+        compliance: dict[str, object] = {
+            "status": "allowed",
+            "authority": "release",
+            "reason": "no release evidence supplied",
+        }
+        if isinstance(release_evidence, dict) and release_evidence:
+            raw_claims = release_evidence.get("claims")
+            claims = raw_claims if isinstance(raw_claims, list) else []
+            artifact = release_evidence.get("artifact")
+            if claims and not isinstance(artifact, dict):
+                claim_decision = evaluate_claims_for_release(
+                    project_dir=self.project_dir,
+                    run_id=canonical_run_id,
+                    claims=claims,
+                )
+                if claim_decision.get("status") == "blocked":
+                    compliance = {
+                        "status": "blocked",
+                        "authority": "claim_judge",
+                        "reason": str(claim_decision.get("reason", "claim_judge_verdict=unknown")),
+                    }
+            else:
+                compliance = evaluate_release_compliance(
+                    project_dir=self.project_dir,
+                    run_id=canonical_run_id,
+                    release_evidence=release_evidence,
+                )
         resolved_status = status
         resolved_blockers = list(blockers)
         if compliance.get("status") == "blocked":
@@ -212,6 +287,27 @@ class ReleaseRunCoordinator:
                 "evidence_links": list(evidence_links),
             },
         )
+        get_exec_kernel(self.project_dir).register_run(
+            canonical_run_id,
+            source="release_run_coordinator.finalize",
+            reason=f"status={resolved_status}",
+        )
+        try:
+            mw = get_merge_writer(self.project_dir)
+            if mw.check_authorization(canonical_run_id):
+                from runtime.merge_writer import MergeWriterToken
+                lock_data = mw._lock_path().read_text(encoding="utf-8")
+                import json as _json
+                lock_info = _json.loads(lock_data)
+                token = MergeWriterToken(
+                    run_id=canonical_run_id,
+                    acquired_at=str(lock_info.get("acquired_at", "")),
+                    lock_path=str(mw._lock_path().relative_to(mw.project_dir)).replace("\\", "/"),
+                    provenance_path=str(mw._provenance_path(canonical_run_id).relative_to(mw.project_dir)).replace("\\", "/"),
+                )
+                mw.release(token)
+        except Exception:
+            pass
         return {
             "status": str(verification_state.get("status", resolved_status)),
             "run_id": canonical_run_id,
@@ -366,6 +462,15 @@ def resolve_current_run_id(project_dir: str | None = None, cli_run_id: str | Non
     return resolved.run_id or None
 
 
+def get_active_coordinator_run_id(project_dir: str | None = None) -> str | None:
+    root = _project_dir(project_dir)
+    shadow = _read_shadow_run_id(str(root))
+    if shadow:
+        return shadow
+    active = _read_active_coordinator_run(str(root))
+    return active or None
+
+
 def _project_dir(project_dir: str | None = None) -> Path:
     if project_dir:
         return Path(project_dir)

package/build/lib/runtime/release_surfaces.py

@@ -14,6 +14,7 @@ Consumers:
 from __future__ import annotations
 
 from dataclasses import dataclass
+from pathlib import Path
 from typing import Union
 
 # ── Valid surface type identifiers ──────────────────────────────────────────
@@ -48,18 +49,21 @@ class AuthoredSurface:
     surface_type: str
     field: Union[list[Union[str, int]], str]
     description: str = ""
+    source_only: bool = False
 
 
-# ── Explicit YAML bundle names (22 files) ──────────────────────────────────
+# ── Explicit YAML bundle names (25 files) ──────────────────────────────────
 
 _BUNDLE_NAMES: tuple[str, ...] = (
     "algorithms",
     "api-twin",
+    "ast-pack",
     "claim-judge",
     "control-plane",
     "data-lineage",
     "delta-classifier",
     "eval-gate",
+    "hash-edit",
     "health",
     "hook-governor",
     "incident-replay",
@@ -72,6 +76,7 @@ _BUNDLE_NAMES: tuple[str, ...] = (
     "robotics",
     "secure-worktree-pipeline",
     "security-check",
+    "terminal-lane",
     "test-intent-lock",
     "tracebank",
     "vision",
@@ -129,7 +134,7 @@ AUTHORED_SURFACES: list[AuthoredSurface] = [
         "Python package version",
     ),
 
-    # ── YAML bundles (22 files) ──
+    # ── YAML bundles (25 files) ──
     *[
         AuthoredSurface(
             f"registry/bundles/{name}.yaml", "yaml_line", "version",
@@ -186,6 +191,7 @@ AUTHORED_SURFACES: list[AuthoredSurface] = [
         ".claude-plugin/scripts/install.sh", "banner_literal",
         r'v(\d+\.\d+\.\d+)',
         "installer banner version",
+        source_only=True,
     ),
 
     # 6. runtime/omg_compat_contract_snapshot.json — contract_version field
@@ -229,11 +235,21 @@ SCOPED_RESIDUE_TARGETS: list[str] = [
     "dist/enterprise/manifest.json",
     "dist/public/bundle/",
     "dist/enterprise/bundle/",
+    # Explicitly include accidental double-nesting outputs to prevent silent
+    # stale-version residue from surviving a misconfigured compile run.
+    "dist/dist/",
     "artifacts/release/",
     "build/lib/",
 ]
 
 
+RUNTIME_BEHAVIOR_SURFACES: tuple[str, ...] = (
+    "execution_primitives",
+    "provider_host_parity",
+    "host_semantic_parity",
+)
+
+
 # ── Helpers ─────────────────────────────────────────────────────────────────
 
 def get_authored_paths() -> list[str]:
@@ -253,3 +269,14 @@ def get_authored_paths() -> list[str]:
 def get_derived_dirs() -> list[str]:
     """Return all generated directory paths."""
     return list(DERIVED_SURFACE_DIRS)
+
+
+def get_runtime_behavior_surfaces() -> list[str]:
+    return list(RUNTIME_BEHAVIOR_SURFACES)
+
+
+def surface_applies_to_root(surface: AuthoredSurface, root_dir: Path) -> bool:
+    """Return whether a surface should be enforced for the given root layout."""
+    if not surface.source_only:
+        return True
+    return (root_dir / ".git").exists()

package/build/lib/runtime/remote_supervisor.py

@@ -10,18 +10,29 @@ from pathlib import Path
 from typing import Any
 from uuid import uuid4
 
+from runtime.exec_kernel import get_exec_kernel
+from runtime.release_run_coordinator import resolve_current_run_id
+
 
 def _now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
-def issue_local_supervisor_session(project_dir: str, *, worker_id: str, shared_secret: str) -> dict[str, Any]:
+def issue_local_supervisor_session(
+    project_dir: str,
+    *,
+    worker_id: str,
+    shared_secret: str,
+    run_id: str | None = None,
+) -> dict[str, Any]:
+    resolved_run_id = run_id or resolve_current_run_id(project_dir)
     session_id = f"session-{uuid4().hex}"
     issued_at = _now()
     token_payload = {
         "session_id": session_id,
         "worker_id": worker_id,
         "issued_at": issued_at,
+        "run_id": resolved_run_id,
     }
     payload_json = json.dumps(token_payload, sort_keys=True, separators=(",", ":"))
     signature = hmac.new(shared_secret.encode("utf-8"), payload_json.encode("utf-8"), hashlib.sha256).hexdigest()
@@ -35,6 +46,7 @@ def issue_local_supervisor_session(project_dir: str, *, worker_id: str, shared_s
         "session_id": session_id,
         "worker_id": worker_id,
         "issued_at": issued_at,
+        "run_id": resolved_run_id,
         "local_only": True,
         "token": token,
     }
@@ -44,6 +56,8 @@ def issue_local_supervisor_session(project_dir: str, *, worker_id: str, shared_s
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(json.dumps({k: v for k, v in result.items() if k != "token"}, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
     result["path"] = rel_path.as_posix()
+    if resolved_run_id:
+        get_exec_kernel(project_dir).record_supervisor_session(resolved_run_id, result)
     return result
 
 
@@ -60,5 +74,6 @@ def verify_local_supervisor_token(token: str, *, shared_secret: str) -> dict[str
         "session_id": str(payload["session_id"]),
         "worker_id": str(payload["worker_id"]),
         "issued_at": str(payload["issued_at"]),
+        "run_id": str(payload.get("run_id") or ""),
         "local_only": True,
     }

package/build/lib/runtime/runtime_contracts.py

@@ -121,6 +121,10 @@ def write_run_state(project_dir: str, module: str, run_id: str, payload: dict[st
     tmp_path = path.with_name(f"{path.name}.tmp")
     _ = tmp_path.write_text(json.dumps(state, indent=2, ensure_ascii=True), encoding="utf-8")
     _ = os.rename(tmp_path, path)
+    latest_path = path.parent / "latest.json"
+    latest_tmp_path = latest_path.with_name("latest.json.tmp")
+    _ = latest_tmp_path.write_text(json.dumps(state, indent=2, ensure_ascii=True), encoding="utf-8")
+    _ = os.rename(latest_tmp_path, latest_path)
     return str(path)
 
 
@@ -225,6 +229,15 @@ def _resolve_active_run_id(project_dir: Path, run_id: str | None) -> str:
     if candidate:
         return candidate
 
+    active_run_path = project_dir / ".omg" / "shadow" / "active-run"
+    if active_run_path.exists():
+        try:
+            candidate = active_run_path.read_text(encoding="utf-8").strip()
+        except OSError:
+            candidate = ""
+        if candidate:
+            return candidate
+
     for path in (
         project_dir / ".omg" / "state" / "defense_state" / "current.json",
         project_dir / ".omg" / "state" / "context_engine_packet.json",