@trac3er/oh-my-god 2.1.9 → 2.2.2

package/scripts/omg.py

@@ -40,6 +40,7 @@ from lab.pipeline import publish_artifact, run_pipeline, run_pipeline_with_evide
 from runtime.forge_agents import dispatch_specialists, resolve_specialists
 from runtime.forge_contracts import load_forge_mvp, validate_forge_job
 from runtime.forge_run_id import normalize_run_id
+from runtime.issue_surface import IssueSurface
 from runtime.dispatcher import dispatch_runtime
 from runtime.api_twin import ingest_contract, record_fixture, serve_fixture, verify_fixture
 from runtime.data_lineage import build_lineage_manifest
@@ -69,11 +70,15 @@ from runtime.compat import (
 from runtime.validate import run_validate, format_text as validate_format_text
 from runtime.plugin_diagnostics import approve_plugin, run_plugin_diagnostics
 from runtime.adoption import CANONICAL_VERSION, VALID_PRESETS
+from runtime.canonical_surface import get_canonical_hosts
 from runtime.ecosystem import ecosystem_status, list_ecosystem_repos, sync_ecosystem_repos
 from runtime.team_router import TeamDispatchRequest, dispatch_team, execute_ccg_mode, execute_crazy_mode
 from runtime.release_run_coordinator import resolve_current_run_id
 
 
+CANONICAL_HOST_CHOICES = tuple(get_canonical_hosts())
+
+
 def _parse_simple_idea_yaml(path: str) -> dict[str, Any]:
     """Minimal parser for `.omg/idea.yml` template shape."""
     idea: dict[str, Any] = {
@@ -208,12 +213,43 @@ def cmd_ship(args: argparse.Namespace) -> int:
 
 
 def cmd_fix(args: argparse.Namespace) -> int:
+    project_dir = _ensure_project_dir()
+    issue_surface = IssueSurface(project_dir=project_dir)
+    scan_run_id = f"fix-{_sanitize_token(args.issue)}-{_now_run_id()}"
+    issue_report = issue_surface.scan(
+        scan_run_id,
+        surfaces=["live_session", "plugin_interop", "governed_tools", "forge_runs"],
+    )
     goal = f"Fix issue {args.issue}"
     dispatched = dispatch_runtime(args.runtime, {"goal": goal, "acceptance": [f"issue-{args.issue}-resolved"]})
+    dispatched["issue_surface"] = {
+        "run_id": issue_report.run_id,
+        "report_path": str(issue_report.summary.get("report_path", "")),
+        "summary": issue_report.summary,
+    }
     print(json.dumps(dispatched, indent=2))
     return 0 if dispatched.get("status") == "ok" else 2
 
 
+def cmd_issue(args: argparse.Namespace) -> int:
+    run_id = args.run_id or _now_run_id()
+    surfaces = [item.strip() for item in str(args.surfaces).split(",") if item.strip()]
+    issue_surface = IssueSurface(project_dir=_ensure_project_dir())
+    report = issue_surface.scan(run_id, surfaces=surfaces or None)
+
+    result: dict[str, Any] = {
+        "schema": "IssueCommandResult",
+        "status": "ok",
+        "run_id": run_id,
+        "report_path": str(report.summary.get("report_path", "")),
+        "report": report.to_dict(),
+    }
+    if args.simulate_surface and args.simulate_scenario:
+        result["simulation"] = issue_surface.simulate_failure(args.simulate_surface, args.simulate_scenario)
+    print(json.dumps(result, indent=2))
+    return 0
+
+
 def cmd_secure(args: argparse.Namespace) -> int:
     decision = evaluate_bash_command(args.command)
     print(json.dumps(decision.to_dict(), indent=2))
@@ -653,6 +689,10 @@ def cmd_teams(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_team(args: argparse.Namespace) -> int:
+    return cmd_teams(args)
+
+
 def cmd_ccg(args: argparse.Namespace) -> int:
     files = [f.strip() for f in args.files.split(",") if f.strip()] if args.files else []
     result = execute_ccg_mode(
@@ -869,6 +909,10 @@ def cmd_contract_compile(args: argparse.Namespace) -> int:
 
 
 def cmd_release_readiness(args: argparse.Namespace) -> int:
+    if not os.environ.get("OMG_RELEASE_READY_PROVIDERS", "").strip():
+        os.environ["OMG_RELEASE_READY_PROVIDERS"] = ",".join(get_canonical_hosts())
+    if not os.environ.get("OMG_REQUIRE_HOST_PARITY_REPORT", "").strip():
+        os.environ["OMG_REQUIRE_HOST_PARITY_REPORT"] = "1"
     result = build_release_readiness(
         root_dir=ROOT_DIR,
         output_root=args.output_root,
@@ -944,7 +988,7 @@ def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
         "--host",
         dest="hosts",
         action="append",
-        choices=["claude", "codex", "gemini", "kimi"],
+        choices=list(CANONICAL_HOST_CHOICES),
         required=True,
         help="Host to compile (repeat for multiple hosts)",
     )
@@ -1160,6 +1204,20 @@ def build_parser() -> argparse.ArgumentParser:
     fix.add_argument("--runtime", default="claude", choices=["claude", "gpt", "local"])
     fix.set_defaults(func=cmd_fix)
 
+    issue = sub.add_parser("issue", help="Active issue diagnostics and red-team simulation")
+    issue.add_argument("--run-id", default="")
+    issue.add_argument(
+        "--surfaces",
+        default="",
+        help=(
+            "Comma-separated surfaces to scan: "
+            "live_session,forge_runs,hooks,skills,mcps,plugin_interop,governed_tools,domain_pipelines"
+        ),
+    )
+    issue.add_argument("--simulate-surface", default="")
+    issue.add_argument("--simulate-scenario", default="")
+    issue.set_defaults(func=cmd_issue)
+
     undo = sub.add_parser("undo", help="Undo last interaction step")
     undo.add_argument("--step-id", default="", help="Journal step ID to undo (latest if omitted)")
     undo.set_defaults(func=cmd_undo)
@@ -1350,6 +1408,14 @@ def build_parser() -> argparse.ArgumentParser:
     teams.add_argument("--expected-outcome", default="")
     teams.set_defaults(func=cmd_teams)
 
+    team = sub.add_parser("team", help="Internal OMG staged team routing (canonical)")
+    team.add_argument("--target", default="auto", choices=["auto", "codex", "gemini", "ccg"])
+    team.add_argument("--problem", required=True)
+    team.add_argument("--context", default="")
+    team.add_argument("--files", default="")
+    team.add_argument("--expected-outcome", default="")
+    team.set_defaults(func=cmd_team)
+
     ccg = sub.add_parser("ccg", help="OMG CCG (tri-track) routing")
     ccg.add_argument("--problem", required=True)
     ccg.add_argument("--context", default="")

package/scripts/prepare-release-proof-fixtures.py

@@ -91,6 +91,18 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
     intent_gate_path = output_root / ".omg" / "state" / "intent_gate" / "run-1.json"
     profile_path = output_root / ".omg" / "state" / "profile.yaml"
     tracebank_path = output_root / ".omg" / "tracebank" / "events.jsonl"
+    exec_kernel_path = output_root / ".omg" / "state" / "exec-kernel" / "run-1.json"
+    watchdog_path = output_root / ".omg" / "evidence" / "subagents" / "run-1-replay.json"
+    merge_writer_path = output_root / ".omg" / "evidence" / "merge-writer-run-1.json"
+    ledger_path = output_root / ".omg" / "state" / "ledger" / "tool-ledger.jsonl"
+    budget_path = output_root / ".omg" / "state" / "budget-envelopes" / "run-1.json"
+    issue_report_path = output_root / ".omg" / "evidence" / "issues" / "run-1.json"
+    host_parity_path = output_root / ".omg" / "evidence" / "host-parity-run-1.json"
+    music_omr_path = output_root / ".omg" / "evidence" / "music-omr-run-1.json"
+
+    # Ensure directories exist
+    for p in [exec_kernel_path, watchdog_path, merge_writer_path, ledger_path, budget_path, issue_report_path, host_parity_path, music_omr_path]:
+        p.parent.mkdir(parents=True, exist_ok=True)
 
     _write_text(
         junit_path,
@@ -224,6 +236,38 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
                     "path": ".omg/evidence/forge-specialists-run-1.json",
                     "run_id": run_id,
                 },
+                "exec_kernel_state": {
+                    "path": ".omg/state/exec-kernel/run-1.json",
+                    "run_id": run_id,
+                },
+                "worker_watchdog_replay": {
+                    "path": ".omg/evidence/subagents/run-1-replay.json",
+                    "run_id": run_id,
+                },
+                "merge_writer_provenance": {
+                    "path": ".omg/evidence/merge-writer-run-1.json",
+                    "run_id": run_id,
+                },
+                "tool_fabric_ledger": {
+                    "path": ".omg/state/ledger/tool-ledger.jsonl",
+                    "run_id": run_id,
+                },
+                "budget_envelope_state": {
+                    "path": ".omg/state/budget-envelopes/run-1.json",
+                    "run_id": run_id,
+                },
+                "issue_report": {
+                    "path": ".omg/evidence/issues/run-1.json",
+                    "run_id": run_id,
+                },
+                "host_parity_report": {
+                    "path": ".omg/evidence/host-parity-run-1.json",
+                    "run_id": run_id,
+                },
+                "music_omr_testbed_evidence": {
+                    "path": ".omg/evidence/music-omr-run-1.json",
+                    "run_id": run_id,
+                },
             },
     )
     _write_json(
@@ -343,6 +387,82 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
             "updated_at": "2026-03-07T00:00:00Z",
         },
     )
+    _write_json(
+        exec_kernel_path,
+        {
+            "schema": "ExecKernelRunState",
+            "run_id": run_id,
+            "status": "queued",
+            "kernel_enabled": True,
+        },
+    )
+    _write_json(
+        watchdog_path,
+        {
+            "schema": "WorkerReplayEvidence",
+            "run_id": run_id,
+            "reason": "completed",
+        },
+    )
+    _write_json(
+        merge_writer_path,
+        {
+            "schema": "MergeWriterProvenance",
+            "run_id": run_id,
+            "acquired_at": "2026-03-07T00:00:00Z",
+            "released_at": "2026-03-07T00:00:01Z",
+        },
+    )
+    ledger_path.parent.mkdir(parents=True, exist_ok=True)
+    ledger_path.write_text(
+        json.dumps({"ts": "2026-03-07T00:00:00Z", "tool": "ls", "run_id": run_id}) + "\n",
+        encoding="utf-8",
+    )
+    _write_json(
+        budget_path,
+        {
+            "schema": "BudgetEnvelopeState",
+            "run_id": run_id,
+            "usage": {"cpu_seconds_used": 0.1},
+        },
+    )
+    _write_json(
+        issue_report_path,
+        {
+            "schema": "IssueReport",
+            "run_id": run_id,
+            "issues": [],
+        },
+    )
+    _write_json(
+        host_parity_path,
+        {
+            "schema": "HostParityReport",
+            "run_id": run_id,
+            "timestamp": "2026-03-07T00:00:00Z",
+            "canonical_hosts": ["claude", "codex", "gemini", "kimi"],
+            "parity_results": {
+                "passed": True,
+                "drift_detected": False,
+                "drift_details": [],
+                "host_results": {
+                    "claude": {"present": True, "passed": True, "reason": "baseline"},
+                    "codex": {"present": True, "passed": True, "reason": "structured-equivalent"},
+                    "gemini": {"present": True, "passed": True, "reason": "structured-equivalent"},
+                    "kimi": {"present": True, "passed": True, "reason": "structured-equivalent"},
+                }
+            },
+            "overall_status": "ok",
+        },
+    )
+    _write_json(
+        music_omr_path,
+        {
+            "schema": "MusicOMREvidence",
+            "run_id": run_id,
+            "results": {},
+        },
+    )
     _write_text(
         profile_path,
         """profile_version: profile-v1

package/scripts/validate-release-identity.py

@@ -115,7 +115,7 @@ def validate_derived(repo_root: Path, canonical: str) -> dict[str, Any]:
     return {"status": status, "blockers": blockers}
 
 
-_KNOWN_ATTESTATION_ALGORITHMS = {"ed25519-minisign", "hmac-sha256"}
+_KNOWN_ATTESTATION_ALGORITHMS = {"ed25519-minisign"}
 
 
 def _collect_attestations(payload: dict[str, Any]) -> dict[str, dict[str, Any]]:
@@ -133,7 +133,7 @@ def _collect_attestations(payload: dict[str, Any]) -> dict[str, dict[str, Any]]:
         if row.get("statement_path") is not None or row.get("signature_path") is not None:
             indexed[artifact_path] = row
             continue
-        # Legacy inline shape: statement dict + signer_pubkey string (HMAC bridge)
+        # Inline shape: statement dict + signer_pubkey string
         statement = row.get("statement")
         signer_pubkey = row.get("signer_pubkey")
         if isinstance(statement, dict) and isinstance(signer_pubkey, str):
@@ -356,7 +356,14 @@ def main() -> int:
         derived_result = {"status": "skipped", "blockers": []}
 
     if args.forbid_version and args.scope in ("derived", "all"):
-        residue_result = scan_scoped_residue(_REPO_ROOT, args.forbid_version)
+        if args.forbid_version == canonical:
+            residue_result = {
+                "status": "ok",
+                "forbid_version": args.forbid_version,
+                "blockers": [],
+            }
+        else:
+            residue_result = scan_scoped_residue(_REPO_ROOT, args.forbid_version)
 
     report = build_report(
         canonical=canonical,

package/scripts/verify-standalone.sh

@@ -16,9 +16,9 @@ mkdir -p .omg/evidence
 python3 scripts/omg.py doctor --format json > .omg/evidence/doctor.json
 python3 scripts/prepare-release-proof-fixtures.py --output-root .
 python3 scripts/omg.py contract validate
-python3 scripts/omg.py contract compile --host claude --host codex --channel public --output-root .
-python3 scripts/omg.py contract compile --host claude --host codex --channel enterprise --output-root .
-OMG_RELEASE_READY_PROVIDERS=claude,codex python3 scripts/omg.py release readiness --channel dual --output-root .
+python3 scripts/omg.py contract compile --host claude --host codex --host gemini --host kimi --channel public --output-root .
+python3 scripts/omg.py contract compile --host claude --host codex --host gemini --host kimi --channel enterprise --output-root .
+OMG_RELEASE_READY_PROVIDERS=claude,codex,gemini,kimi python3 scripts/omg.py release readiness --channel dual --output-root .
 python3 scripts/omg.py compat gate --max-bridge 0 --output .omg/evidence/omg-compat-gap.json
 python3 scripts/check-omg-public-ready.py
 

package/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.1.9 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.2.2 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -171,7 +171,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/session-start.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/session-start.py\"",
             "timeout": 10
           }
         ]
@@ -182,7 +182,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/session-end-capture.py\\\""
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/session-end-capture.py\""
           }
         ]
       }
@@ -192,7 +192,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/firewall.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/firewall.py\"",
             "timeout": 10
           }
         ],
@@ -202,7 +202,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/secret-guard.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/secret-guard.py\"",
             "timeout": 10
           }
         ],
@@ -212,7 +212,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/pre-tool-inject.py\\\""
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/pre-tool-inject.py\""
           }
         ],
         "matcher": ""
@@ -223,7 +223,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/circuit-breaker.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/circuit-breaker.py\"",
             "timeout": 10
           }
         ],
@@ -233,7 +233,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/tool-ledger.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/tool-ledger.py\"",
             "timeout": 10
           }
         ],
@@ -243,7 +243,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/test_generator_hook.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/test_generator_hook.py\"",
             "timeout": 10
           }
         ],
@@ -253,7 +253,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/budget_governor.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/budget_governor.py\"",
             "timeout": 10
           }
         ],
@@ -265,7 +265,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/post-tool-failure.py\\\""
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/post-tool-failure.py\""
           }
         ]
       }
@@ -275,7 +275,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/stop_dispatcher.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/stop_dispatcher.py\"",
             "timeout": 90
           }
         ],
@@ -306,7 +306,7 @@
     ]
   },
   "_omg": {
-    "_version": "2.1.9",
+    "_version": "2.2.2",
     "preset": "safe",
     "omgMode": "focused",
     "default_mode": "ulw+ralph",
@@ -366,7 +366,7 @@
       "NOTEBOOKLM": false
     },
     "generated": {
-      "contract_version": "2.1.9",
+      "contract_version": "2.2.2",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",
@@ -482,6 +482,21 @@
             "requires_approval": true
           }
         ],
+        "tool_fabric_contract": {
+          "enforcement_order": [
+            "tool_selection",
+            "approval_state",
+            "evidence_requirements",
+            "attestation_proof_validation",
+            "execution"
+          ],
+          "lanes": [
+            "lsp-pack",
+            "hash-edit",
+            "ast-pack",
+            "terminal-lane"
+          ]
+        },
         "protected_paths": [
           {
             "path_pattern": ".omg/**",
@@ -657,6 +672,11 @@
           "claim_judge",
           "compliance_governor",
           "execution_primitives"
+        ],
+        "runtime_behavior_surfaces": [
+          "execution_primitives",
+          "provider_host_parity",
+          "host_semantic_parity"
         ]
       }
     },

package/tools/python_repl.py

@@ -18,7 +18,7 @@ import sys
 import traceback
 import uuid
 from datetime import datetime, timezone
-from typing import Any, Dict, Generator, List, Optional, Union
+from typing import Any, Dict, Generator, List, Optional, Union, cast
 
 
 # --- Lazy imports for hooks/_common.py ---
@@ -61,11 +61,11 @@ def _check_jupyter() -> bool:
     global _HAS_JUPYTER, _jupyter_client
     if _HAS_JUPYTER is None:
         try:
-            import jupyter_client as _jc
+            import jupyter_client as _jc  # pyright: ignore[reportMissingImports]
             _jupyter_client = _jc
-            _HAS_JUPYTER = True
+            _HAS_JUPYTER = True  # pyright: ignore[reportConstantRedefinition]
         except ImportError:
-            _HAS_JUPYTER = False
+            _HAS_JUPYTER = False  # pyright: ignore[reportConstantRedefinition]
     return _HAS_JUPYTER
 
 
@@ -112,7 +112,7 @@ def _get_helpers_flag() -> bool:
     return False
 
 
-def _build_prelude_namespace() -> dict:
+def _build_prelude_namespace() -> dict[str, Any]:
     """Build the prelude namespace with helper functions for REPL sessions.
 
     Returns a dict of helper functions injected into every session when
@@ -140,7 +140,7 @@ def _build_prelude_namespace() -> dict:
         except Exception:
             return False
 
-    def lines(path: str) -> list:
+    def lines(path: str) -> list[str]:
         """Read file lines as list. Returns empty list on error."""
         try:
             with open(path, "r") as f:
@@ -148,7 +148,7 @@ def _build_prelude_namespace() -> dict:
         except Exception:
             return []
 
-    def search_code(pattern: str, path: str = ".", ext=None) -> list:
+    def search_code(pattern: str, path: str = ".", ext: str | None = None) -> list[dict[str, Any]]:
         """Grep-like search across files. Returns list of {file, line, match} dicts."""
         results = []
         try:
@@ -173,7 +173,7 @@ def _build_prelude_namespace() -> dict:
             pass
         return results
 
-    def grep(pattern: str, text: str) -> list:
+    def grep(pattern: str, text: str) -> list[str]:
         """Regex grep on a string. Returns matching lines."""
         try:
             compiled = _re.compile(pattern)
@@ -181,7 +181,7 @@ def _build_prelude_namespace() -> dict:
         except Exception:
             return []
 
-    def insert_at(lines_list: list, index: int, new_line: str) -> list:
+    def insert_at(lines_list: list[str], index: int, new_line: str) -> list[str]:
         """Insert a line at index. Returns new list."""
         try:
             result = list(lines_list)
@@ -190,7 +190,7 @@ def _build_prelude_namespace() -> dict:
         except Exception:
             return list(lines_list)
 
-    def delete_lines(lines_list: list, start: int, end: int) -> list:
+    def delete_lines(lines_list: list[str], start: int, end: int) -> list[str]:
         """Delete lines from start to end (exclusive). Returns new list."""
         try:
             result = list(lines_list)
@@ -223,6 +223,24 @@ def _now_iso() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
+def _exec_kernel_metadata() -> Dict[str, Any]:
+    try:
+        from runtime.exec_kernel import get_exec_kernel
+        from runtime.release_run_coordinator import resolve_current_run_id
+
+        project_dir = os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
+        run_id = resolve_current_run_id(project_dir)
+        kernel = get_exec_kernel(project_dir)
+        return {
+            "run_id": run_id,
+            "enabled": kernel.enabled,
+            "attach_log": kernel.attach_log(run_id) if run_id else "",
+            "evidence_hooks": [".omg/evidence/subagents"],
+        }
+    except Exception:
+        return {"run_id": None, "enabled": False, "attach_log": "", "evidence_hooks": []}
+
+
 def _validate_session_id(session_id: str) -> str:
     """Validate a caller-supplied session identifier."""
     _ensure_imports()
@@ -280,6 +298,8 @@ class _IPythonSession:
     """Wraps a jupyter_client kernel for code execution."""
 
     def __init__(self):
+        if _jupyter_client is None:
+            raise RuntimeError("jupyter_client unavailable")
         km, kc = _jupyter_client.manager.start_new_kernel(kernel_name="python3")
         self.kernel_manager = km
         self.kernel_client = kc
@@ -478,8 +498,10 @@ def start_repl_session(session_id: Optional[str] = None) -> Dict[str, Any]:
     # Inject prelude helpers if enabled
     if _get_helpers_flag():
         prelude = _build_prelude_namespace()
-        if hasattr(backend, "namespace"):
-            backend.namespace.update(prelude)
+        backend_any = backend
+        namespace_obj = getattr(backend_any, "namespace", None)
+        if isinstance(namespace_obj, dict):
+            namespace_obj.update(prelude)
     _persist_session(new_id)
 
     return _session_info(_sessions[new_id])
@@ -506,20 +528,23 @@ def execute_code(session_id: str, code_str: str) -> Dict[str, Any]:
     if _get_sandbox_flag():
         from tools.python_sandbox import execute_sandboxed
         session = _sessions[session_id]
-        backend = session.get("_backend")
-        ns = backend.namespace if hasattr(backend, "namespace") else None
+        backend_any = session.get("_backend")
+        namespace_obj = getattr(backend_any, "namespace", None)
+        ns = namespace_obj if isinstance(namespace_obj, dict) else None
         output = execute_sandboxed(code_str, namespace=ns)
         session["exec_count"] += 1
         session["last_used"] = _now_iso()
         output["exec_count"] = session["exec_count"]
+        output["exec_kernel"] = _exec_kernel_metadata()
         _persist_session(session_id)
         return output
 
     session = _sessions[session_id]
     backend = session["_backend"]
+    output: Dict[str, Any]
 
     try:
-        output = backend.execute(code_str)
+        output = cast(Dict[str, Any], backend.execute(code_str))
     except Exception as e:
         output = {
             "stdout": "",
@@ -531,6 +556,7 @@ def execute_code(session_id: str, code_str: str) -> Dict[str, Any]:
     session["exec_count"] += 1
     session["last_used"] = _now_iso()
     output["exec_count"] = session["exec_count"]
+    output["exec_kernel"] = _exec_kernel_metadata()
 
     _persist_session(session_id)
     return output

package/tools/python_sandbox.py

@@ -624,6 +624,24 @@ def _run_isolated_python(code: str, timeout_seconds: int) -> Dict[str, Any]:
     }
 
 
+def _exec_kernel_metadata() -> Dict[str, Any]:
+    try:
+        from runtime.exec_kernel import get_exec_kernel
+        from runtime.release_run_coordinator import resolve_current_run_id
+
+        project_dir = os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
+        run_id = resolve_current_run_id(project_dir)
+        kernel = get_exec_kernel(project_dir)
+        return {
+            "run_id": run_id,
+            "enabled": kernel.enabled,
+            "attach_log": kernel.attach_log(run_id) if run_id else "",
+            "evidence_hooks": [".omg/evidence/subagents"],
+        }
+    except Exception:
+        return {"run_id": None, "enabled": False, "attach_log": "", "evidence_hooks": []}
+
+
 def execute_budgeted_run(
     *,
     trainer_code: str,
@@ -692,6 +710,7 @@ def execute_budgeted_run(
         },
         "trainer": trainer_result,
         "sidecar": sidecar_result,
+        "exec_kernel": _exec_kernel_metadata(),
     }