@trac3er/oh-my-god 2.1.8 → 2.2.2

package/lab/pipeline.py

@@ -1,6 +1,7 @@
 """OMG full AI pipeline stub: data -> refine -> train/distill -> evaluate -> regression."""
 from __future__ import annotations
 
+import importlib
 from datetime import datetime, timezone
 from pathlib import Path
 from time import monotonic
@@ -73,6 +74,10 @@ def run_pipeline(
 
     target_metric = float(job.get("target_metric", 0.8))
     live_metric = _resolve_live_metric(adapter_evidence)
+    if live_metric is None:
+        simulated_metric = job.get("simulated_metric")
+        if isinstance(simulated_metric, (int, float)) and not isinstance(simulated_metric, bool):
+            live_metric = float(simulated_metric)
     failed_stages = _normalize_stage_set(job.get("stage_failures"))
     explicit_failed_stage = str(job.get("fail_stage", "")).strip().lower()
     if explicit_failed_stage:
@@ -143,7 +148,14 @@ def run_pipeline(
             }
 
     report = _evaluation_report(job, live_metric, target_metric)
-    promotion_blockers = _collect_promotion_blockers(job, stage_evidence, adapter_evidence, live_metric)
+    domain_pack_gate = _resolve_domain_pack_gate(job, stage_evidence, adapter_evidence, live_metric)
+    promotion_blockers = _collect_promotion_blockers(
+        job,
+        stage_evidence,
+        adapter_evidence,
+        live_metric,
+        domain_pack_gate=domain_pack_gate,
+    )
     artifact_contracts = _build_artifact_contracts(
         run_id=active_run_id,
         target_metric=target_metric,
@@ -153,18 +165,20 @@ def run_pipeline(
     )
 
     result: dict[str, Any] = {
-        "status": "ready",
+        "status": "ready" if bool(report.get("passed")) else "failed_evaluation",
         "stage": "complete",
         "stages": stages,
         "published": False,
         "evaluation_report": report,
         "run_id": active_run_id,
         "stage_evidence": stage_evidence,
-        "artifact_contracts": artifact_contracts,
+        "domain_pack_gate": domain_pack_gate,
         "promotion_blockers": promotion_blockers,
         "promotion_ready": len(promotion_blockers) == 0,
         "release_evidence": _normalize_release_evidence(job),
     }
+    if adapter_evidence:
+        result["artifact_contracts"] = artifact_contracts
     if adapter_evidence:
         result["adapter_evidence"] = adapter_evidence
     return result
@@ -196,7 +210,8 @@ def _extract_artifact_payload(result: dict[str, Any]) -> dict[str, Any] | None:
 
 
 def publish_artifact(result: dict[str, Any]) -> dict[str, Any]:
-    from runtime.compliance_governor import evaluate_release_compliance
+    governor_module = importlib.import_module("runtime.compliance_governor")
+    evaluate_release_compliance = getattr(governor_module, "evaluate_release_compliance")
 
     report = result.get("evaluation_report")
     if not isinstance(report, dict) or not report.get("passed"):
@@ -223,6 +238,12 @@ def publish_artifact(result: dict[str, Any]) -> dict[str, Any]:
         release_evidence_payload["artifact"] = artifact_payload
 
     claims = release_evidence_payload.get("claims")
+    if not isinstance(claims, list) and artifact_payload is None:
+        out = dict(result)
+        out["status"] = "published"
+        out["published"] = True
+        out["published_at"] = _now()
+        return out
     if isinstance(claims, list) and claims and not isinstance(release_evidence_payload.get("artifact"), dict):
         return {
             "status": "blocked",
@@ -328,8 +349,35 @@ def _collect_promotion_blockers(
     stage_evidence: list[dict[str, object]],
     adapter_evidence: list[dict[str, object]],
     live_metric: float | None,
+    *,
+    domain_pack_gate: dict[str, object] | None = None,
 ) -> list[str]:
     blockers: list[str] = []
+
+    gate = domain_pack_gate if isinstance(domain_pack_gate, dict) else {}
+    missing_approvals_raw = gate.get("missing_approvals")
+    missing_evidence_raw = gate.get("missing_evidence")
+    missing_approvals: list[str] = []
+    if isinstance(missing_approvals_raw, list):
+        for item in missing_approvals_raw:
+            missing_approvals.append(str(item))
+    missing_evidence: list[str] = []
+    if isinstance(missing_evidence_raw, list):
+        for item in missing_evidence_raw:
+            missing_evidence.append(str(item))
+    domain_name = str(gate.get("domain", "")).strip()
+    if missing_approvals:
+        blockers.append(
+            f"promotion blocked: domain '{domain_name}' missing required approvals: {', '.join(missing_approvals)}"
+        )
+    if missing_evidence:
+        blockers.append(
+            f"promotion blocked: domain '{domain_name}' missing required evidence: {', '.join(missing_evidence)}"
+        )
+
+    if not adapter_evidence:
+        return list(dict.fromkeys(blockers))
+
     stage_by_name = {str(item.get("stage", "")): item for item in stage_evidence}
     for required_stage in ("train_distill", "evaluate", "regression_test"):
         stage_record = stage_by_name.get(required_stage)
@@ -360,6 +408,144 @@ def _collect_promotion_blockers(
     return list(dict.fromkeys(blockers))
 
 
+def _resolve_domain_pack_gate(
+    job: dict[str, Any],
+    stage_evidence: list[dict[str, object]],
+    adapter_evidence: list[dict[str, object]],
+    live_metric: float | None,
+) -> dict[str, object]:
+    from runtime.domain_packs import get_required_approvals, get_required_evidence
+    from runtime.evidence_requirements import requirements_for_profile
+    from runtime.forge_contracts import load_forge_mvp
+
+    domain = str(job.get("domain", "")).strip().lower()
+    if not domain:
+        return {
+            "domain": "",
+            "required_approvals": [],
+            "required_evidence": [],
+            "present_approvals": [],
+            "present_evidence": [],
+            "missing_approvals": [],
+            "missing_evidence": [],
+            "evidence_profile": "",
+        }
+
+    try:
+        required_approvals = get_required_approvals(domain)
+        required_evidence = get_required_evidence(domain)
+    except KeyError:
+        required_approvals = []
+        required_evidence = []
+
+    profile = ""
+    contract = load_forge_mvp()
+    profile_map = contract.get("domain_evidence_profiles")
+    if isinstance(profile_map, dict):
+        profile = str(profile_map.get(domain, "")).strip()
+
+    provided_approvals = _collect_provided_approvals(job)
+    provided_evidence = _collect_provided_evidence(job, stage_evidence, adapter_evidence, live_metric)
+
+    profile_requirements = requirements_for_profile(profile)
+    profile_required_runtime = [item for item in profile_requirements if item in _RUNTIME_CHECKABLE_PROFILE_REQUIREMENTS]
+    merged_required_evidence = list(dict.fromkeys([*required_evidence, *profile_required_runtime]))
+
+    missing_approvals = [token for token in required_approvals if token not in provided_approvals]
+    missing_evidence = [token for token in merged_required_evidence if token not in provided_evidence]
+    return {
+        "domain": domain,
+        "required_approvals": required_approvals,
+        "required_evidence": merged_required_evidence,
+        "present_approvals": sorted(provided_approvals),
+        "present_evidence": sorted(provided_evidence),
+        "missing_approvals": missing_approvals,
+        "missing_evidence": missing_evidence,
+        "evidence_profile": profile,
+    }
+
+
+_RUNTIME_CHECKABLE_PROFILE_REQUIREMENTS = frozenset(
+    {
+        "artifact_contracts",
+        "audit-trail",
+        "benchmark-harness",
+        "determinism-check",
+        "drift-check",
+        "human-review",
+        "provenance",
+        "restricted-tools",
+        "signed_checkpoint",
+        "signed_lineage",
+        "signed_model_card",
+        "simulator-episode-evidence",
+        "vision-artifacts",
+    }
+)
+
+
+def _collect_provided_approvals(job: dict[str, Any]) -> set[str]:
+    approvals: set[str] = set()
+    raw = job.get("approvals")
+    if isinstance(raw, list):
+        approvals.update(str(item).strip() for item in raw if str(item).strip())
+
+    release_evidence = _normalize_release_evidence(job)
+    release_approvals = release_evidence.get("approvals")
+    if isinstance(release_approvals, list):
+        approvals.update(str(item).strip() for item in release_approvals if str(item).strip())
+    return approvals
+
+
+def _collect_provided_evidence(
+    job: dict[str, Any],
+    stage_evidence: list[dict[str, object]],
+    adapter_evidence: list[dict[str, object]],
+    live_metric: float | None,
+) -> set[str]:
+    evidence: set[str] = set()
+
+    for key in ("evidence", "domain_evidence"):
+        raw = job.get(key)
+        if isinstance(raw, list):
+            evidence.update(str(item).strip() for item in raw if str(item).strip())
+
+    release_evidence = _normalize_release_evidence(job)
+    raw_release_evidence = release_evidence.get("evidence")
+    if isinstance(raw_release_evidence, list):
+        evidence.update(str(item).strip() for item in raw_release_evidence if str(item).strip())
+
+    if isinstance(job.get("dataset"), dict):
+        evidence.update({"dataset-provenance", "provenance", "signed_lineage"})
+    if isinstance(job.get("base_model"), dict):
+        evidence.update({"signed_model_card", "restricted-tools"})
+    if live_metric is not None:
+        evidence.update({"drift-check", "benchmark-harness"})
+
+    if stage_evidence:
+        evidence.add("audit-trail")
+
+    for adapter in adapter_evidence:
+        kind = str(adapter.get("kind", "")).strip().lower()
+        if kind == "training":
+            artifacts = adapter.get("checkpoint_artifacts")
+            if isinstance(artifacts, list) and artifacts:
+                evidence.update({"signed_checkpoint", "artifact_contracts", "determinism-check"})
+
+        if kind != "simulator":
+            continue
+
+        replay_metadata = adapter.get("replay_metadata")
+        if isinstance(replay_metadata, dict) and replay_metadata:
+            evidence.add("simulator-replay")
+
+        episode_stats = adapter.get("episode_stats")
+        if isinstance(episode_stats, dict) and episode_stats:
+            evidence.update({"simulator-episode-evidence", "vision-artifacts", "kill-switch-check"})
+
+    return {item for item in evidence if item}
+
+
 def _requires_claims(job: dict[str, Any]) -> bool:
     specialists = job.get("specialists")
     if not isinstance(specialists, list):
@@ -452,7 +638,11 @@ def _collect_publish_blockers(result: dict[str, Any]) -> list[str]:
             if reason:
                 blockers.append(reason)
 
+    adapter_evidence = result.get("adapter_evidence")
     contracts = result.get("artifact_contracts")
+    if (not isinstance(adapter_evidence, list) or not adapter_evidence) and not isinstance(contracts, dict):
+        return list(dict.fromkeys(blockers))
+
     contracts_map = contracts if isinstance(contracts, dict) else {}
     checkpoint = contracts_map.get("checkpoint_hash")
     if not isinstance(checkpoint, dict):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trac3er/oh-my-god",
-  "version": "2.1.8",
+  "version": "2.2.2",
   "description": "OMG (Oh My God) — Multi-agent orchestration, evidence-backed verification, and durable session state for Claude Code, Codex, and supported agent hosts",
   "main": "OMG-setup.sh",
   "scripts": {

package/plugins/advanced/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-advanced",
-  "version": "2.1.8",
+  "version": "2.2.2",
   "description": "Advanced OMG commands - deep planning, learning, code review, and specialized workflows",
   "type": "omg-plugin",
   "commands": {

package/plugins/core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-core",
-  "version": "2.1.8",
+  "version": "2.2.2",
   "description": "Core OMG commands - native setup, routing, orchestration, and verification surfaces",
   "type": "omg-plugin",
   "commands": {
@@ -74,6 +74,11 @@
       "description": "Set cognitive mode for the session",
       "category": "config"
     },
+    "preset": {
+      "path": "commands/OMG:preset.md",
+      "description": "Inspect or apply the canonical OMG preset for the current project",
+      "category": "config"
+    },
     "domain-init": {
       "path": "commands/OMG:domain-init.md",
       "description": "Alias for domain scaffolding (use init instead)",
@@ -152,7 +157,8 @@
     "config": {
       "description": "Configuration and settings",
       "commands": [
-        "mode"
+        "mode",
+        "preset"
       ]
     },
     "observability": {

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "oh-my-god"
-version = "2.1.8"
+version = "2.2.2"
 description = "OMG (Oh My God) — Multi-agent orchestration, evidence-backed verification, and durable session state for Claude Code, Codex, and supported agent hosts"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -34,6 +34,7 @@ test = [
     "pytest-cov>=4.0",
     "pytest-xdist>=3.0",
     "pytest-timeout>=2.0",
+    "Pillow>=10.0",
 ]
 mcp = [
     "fastmcp>=2.0",

package/registry/approval_artifact.py

@@ -2,16 +2,16 @@
 from __future__ import annotations
 
 import base64
+import hashlib
 import json
 from dataclasses import asdict, dataclass
 from pathlib import Path
 from typing import Any
 
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-
 from registry.verify_artifact import (
     _canonical_json,
     _key_id_from_public_key,
+    _load_ed25519_backend,
     _load_trusted_signers,
     _parse_minisign_detached,
     _utc_now,
@@ -30,6 +30,7 @@ class ApprovalArtifact:
     signer_key_id: str
     issued_at: str
     signature: str
+    run_id: str = ""
 
 
 def _approval_signing_payload(approval: ApprovalArtifact) -> dict[str, object]:
@@ -42,6 +43,7 @@ def _approval_signing_payload(approval: ApprovalArtifact) -> dict[str, object]:
         "signer_key_id": approval.signer_key_id,
         "issued_at": approval.issued_at,
         "type": _APPROVAL_TYPE,
+        "run_id": approval.run_id,
     }
 
 
@@ -52,6 +54,7 @@ def create_approval_artifact(
     reason: str,
     signer_key_id: str,
     signer_private_key: str,
+    run_id: str = "",
 ) -> ApprovalArtifact:
 
     clean_digest = str(artifact_digest).strip().lower()
@@ -74,6 +77,7 @@ def create_approval_artifact(
         signer_key_id=signer_key_id,
         issued_at=issued_at,
         signature="",
+        run_id=str(run_id).strip(),
     )
 
     sig_result = sign_artifact(
@@ -108,6 +112,9 @@ def verify_approval_artifact(
     for field in required:
         if not isinstance(data.get(field), str) or not data[field].strip():
             return {"valid": False, "reason": f"missing or empty field: {field}"}
+    run_id_value = data.get("run_id", "")
+    if run_id_value is not None and not isinstance(run_id_value, str):
+        return {"valid": False, "reason": "run_id must be a string when present"}
 
     clean_expected = str(expected_artifact_digest).strip().lower()
     clean_actual = str(data["artifact_digest"]).strip().lower()
@@ -126,8 +133,11 @@ def verify_approval_artifact(
     if not isinstance(public_key_b64, str) or not public_key_b64:
         return {"valid": False, "reason": "invalid trusted signer public key"}
     try:
+        _, _, Ed25519PublicKey = _load_ed25519_backend()
         public_key_raw = base64.b64decode(public_key_b64, validate=True)
         public_key = Ed25519PublicKey.from_public_bytes(public_key_raw)
+    except ModuleNotFoundError as exc:
+        return {"valid": False, "reason": str(exc)}
     except Exception:
         return {"valid": False, "reason": "invalid trusted signer public key"}
 
@@ -148,6 +158,7 @@ def verify_approval_artifact(
         signer_key_id=key_id,
         issued_at=data["issued_at"],
         signature="",
+        run_id=str(run_id_value).strip(),
     )
     payload = _approval_signing_payload(temp_approval)
 
@@ -182,3 +193,44 @@ def load_approval_artifact_from_path(
         "reason": result["reason"],
         "approval": data if result["valid"] else None,
     }
+
+
+def build_tool_approval_digest(lane_name: str, tool_name: str, run_id: str) -> str:
+    payload = {
+        "lane": str(lane_name).strip().lower(),
+        "tool": str(tool_name).strip(),
+        "run_id": str(run_id).strip(),
+        "type": "omg-tool-fabric-approval-v1",
+    }
+    return hashlib.sha256(_canonical_json(payload)).hexdigest()
+
+
+def verify_tool_approval(
+    approval: ApprovalArtifact | dict[str, Any],
+    *,
+    lane_name: str,
+    tool_name: str,
+    run_id: str,
+) -> dict[str, Any]:
+    expected_digest = build_tool_approval_digest(lane_name=lane_name, tool_name=tool_name, run_id=run_id)
+    verified = verify_approval_artifact(approval, expected_artifact_digest=expected_digest)
+    if not bool(verified.get("valid")):
+        return verified
+
+    approval_obj: dict[str, Any]
+    if isinstance(approval, ApprovalArtifact):
+        approval_obj = asdict(approval)
+    elif isinstance(approval, dict):
+        approval_obj = dict(approval)
+    else:
+        return {"valid": False, "reason": "invalid approval artifact type"}
+
+    run_binding = str(approval_obj.get("run_id", "")).strip()
+    if not run_binding:
+        scope = str(approval_obj.get("scope", "")).strip()
+        token = f"/runs/{run_id}"
+        if token in scope:
+            run_binding = run_id
+    if run_binding != str(run_id).strip():
+        return {"valid": False, "reason": "approval artifact run_id mismatch"}
+    return verified

package/registry/bundles/algorithms.yaml

@@ -1,6 +1,6 @@
 id: algorithms
 kind: domain-pack
-version: 2.1.8
+version: 2.2.2
 title: OMG Algorithms Pack
 description: Determinism and benchmark attachments for algorithm-heavy work.
 hosts:

package/registry/bundles/api-twin.yaml

@@ -1,6 +1,6 @@
 id: api-twin
 kind: simulation
-version: 2.1.8
+version: 2.2.2
 title: OMG API Twin
 description: Versioned endpoint cassette replay with latency, drift, and cost reporting.
 hosts:

package/registry/bundles/ast-pack.yaml

@@ -0,0 +1,80 @@
+id: ast-pack
+kind: governance
+version: 2.2.2
+title: OMG AST Pack Lane
+description: Governed AST search and replace lane with canonical approvals and proofs.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/tool_fabric.py
+    - registry/verify_artifact.py
+invocation_policy:
+  user_invocable: true
+  model_invocable: true
+  allow_implicit_invocation: false
+tool_policy:
+  side_effect_level: medium
+  allowed_tools:
+    claude:
+      - Grep
+      - Edit
+    codex:
+      - Grep
+      - Edit
+lifecycle_hooks:
+  native:
+    - PreToolUse
+    - PostToolUse
+  emulated:
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - python
+    - typescript
+evidence_outputs:
+  artifacts:
+    - .omg/evidence/ast-pack-{run_id}.json
+execution_contract:
+  modes:
+    - embedded
+    - local_supervisor
+tool_fabric:
+  lane: ast-pack
+  enforcement_order:
+    - tool_selection
+    - approval_state
+    - evidence_requirements
+    - attestation_proof_validation
+    - execution
+  tools:
+    - Grep
+    - Edit
+  semantic_operations:
+    - name: ast_search
+      tool: Grep
+      mutation_capable: false
+      requires_explicit_promotion: false
+    - name: ast_rewrite
+      tool: Edit
+      mutation_capable: true
+      requires_explicit_promotion: true
+  requires_signed_approval: true
+  requires_signed_approval_for_mutation: true
+  requires_attestation: false
+  requires_attestation_for_mutation: true
+  dry_run_first: true
+  require_run_scoped_evidence: true
+  require_fresh_evidence: true
+  evidence_max_age_seconds: 3600
+  required_evidence:
+    - .omg/evidence/ast-pack-{run_id}.json
+channel_overrides:
+  public:
+    posture: advisory
+  enterprise:
+    posture: managed

package/registry/bundles/claim-judge.yaml

@@ -1,6 +1,6 @@
 id: claim-judge
 kind: proof
-version: 2.1.8
+version: 2.2.2
 title: OMG Claim Judge
 description: Evidence-backed claim validator for structured release and completion claims.
 hosts:

package/registry/bundles/control-plane.yaml

@@ -1,6 +1,6 @@
 id: control-plane
 kind: skill
-version: 2.1.8
+version: 2.2.2
 title: OMG Control Plane
 description: Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi.
 hosts:
@@ -42,6 +42,8 @@ mcp_contract:
     - omg-memory
   prompts:
     - omg_contract_summary
+  tools:
+    - omg_tool_fabric_request
   resources:
     - resource://omg/contract
     - resource://omg/release-checklist
@@ -52,6 +54,7 @@ lsp_contract:
 evidence_outputs:
   artifacts:
     - .omg/evidence/control-plane-compile.json
+    - .omg/evidence/tool-fabric.json
 execution_contract:
   modes:
     - embedded
@@ -97,6 +100,18 @@ policy_model:
     - tool_name: Bash(python3:*)
       allowed_tiers: [balanced, interop, labs]
       requires_approval: true
+  tool_fabric_contract:
+    enforcement_order:
+      - tool_selection
+      - approval_state
+      - evidence_requirements
+      - attestation_proof_validation
+      - execution
+    lanes:
+      - lsp-pack
+      - hash-edit
+      - ast-pack
+      - terminal-lane
   protected_paths:
     - path_pattern: .omg/**
       required_tier: balanced

package/registry/bundles/data-lineage.yaml

@@ -1,6 +1,6 @@
 id: data-lineage
 kind: provenance
-version: 2.1.8
+version: 2.2.2
 title: OMG Data Lineage
 description: Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts.
 hosts:

package/registry/bundles/delta-classifier.yaml

@@ -1,6 +1,6 @@
 id: delta-classifier
 kind: routing
-version: 2.1.8
+version: 2.2.2
 title: OMG Delta Classifier
 description: Change classifier that attaches risk-aware checks, approvals, and packs.
 hosts:

package/registry/bundles/eval-gate.yaml

@@ -1,6 +1,6 @@
 id: eval-gate
 kind: evaluation
-version: 2.1.8
+version: 2.2.2
 title: OMG Eval Gate
 description: Reproducible evaluation gate that blocks regressions before release.
 hosts: