@trac3er/oh-my-god 2.1.9 → 2.2.2

package/build/lib/runtime/delta_classifier.py

@@ -5,6 +5,8 @@ from pathlib import Path
 import subprocess
 from typing import Any
 
+from runtime.canonical_surface import RELEASE_SURFACE_LABELS
+
 
 _CATEGORY_RULES: dict[str, tuple[str, ...]] = {
     "auth": ("auth", "token", "secret", "login", "credential"),
@@ -65,6 +67,8 @@ _FORGE_TOKENS: tuple[str, ...] = (
     "lab job",
 )
 
+_EVIDENCE_PROFILES = RELEASE_SURFACE_LABELS["evidence_profiles"]
+
 
 def classify_project_changes(
     project_dir: str,
@@ -102,20 +106,20 @@ def _classify_evidence_profile(*, goal: str, touched_files: list[str], categorie
     lowered_files = [path.lower() for path in touched_files]
 
     if _contains_any(lowered_goal, _RELEASE_TOKENS) or any(_contains_any(path, _RELEASE_TOKENS) for path in lowered_files):
-        return "release"
+        return _EVIDENCE_PROFILES["release"]
 
     if _contains_any(lowered_goal, _FORGE_TOKENS) or any(_contains_any(path, _FORGE_TOKENS) for path in lowered_files):
-        return "forge-run"
+        return _EVIDENCE_PROFILES["forge_run"]
 
     if set(categories) & set(_SECURITY_CATEGORY_HINTS):
-        return "security-audit"
+        return _EVIDENCE_PROFILES["security_audit"]
     if _contains_any(lowered_goal, _SECURITY_TOKENS) or any(_contains_any(path, _SECURITY_TOKENS) for path in lowered_files):
-        return "security-audit"
+        return _EVIDENCE_PROFILES["security_audit"]
 
     if lowered_files and all(_is_docs_file(path) for path in lowered_files):
-        return "docs-only"
+        return _EVIDENCE_PROFILES["docs_only"]
 
-    return "code-change"
+    return _EVIDENCE_PROFILES["code_change"]
 
 
 def _is_docs_file(path: str) -> bool:

package/build/lib/runtime/domain_packs.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 
 from typing import Any
 
+from runtime.canonical_surface import DOMAIN_DEFAULTS
+
 
 DOMAIN_PACKS: dict[str, dict[str, Any]] = {
     "robotics": {
@@ -47,8 +49,27 @@ DOMAIN_PACKS: dict[str, dict[str, Any]] = {
     },
 }
 
+if set(DOMAIN_PACKS) != set(DOMAIN_DEFAULTS["all_domain_packs"]):
+    raise ValueError("domain pack definitions drifted from canonical defaults")
+
 
 def get_domain_pack_contract(name: str) -> dict[str, Any]:
     if name not in DOMAIN_PACKS:
         raise KeyError(name)
     return dict(DOMAIN_PACKS[name])
+
+
+def get_required_approvals(name: str) -> list[str]:
+    contract = get_domain_pack_contract(name)
+    raw = contract.get("required_approvals")
+    if not isinstance(raw, list):
+        return []
+    return [str(item) for item in raw if str(item).strip()]
+
+
+def get_required_evidence(name: str) -> list[str]:
+    contract = get_domain_pack_contract(name)
+    raw = contract.get("required_evidence")
+    if not isinstance(raw, list):
+        return []
+    return [str(item) for item in raw if str(item).strip()]

package/build/lib/runtime/equalizer.py

@@ -1,8 +1,11 @@
 from __future__ import annotations
 
 import importlib
+import os
+import shutil
 from typing import Any
 
+from runtime.canonical_surface import is_canonical_parity_host
 from runtime.cli_provider import get_provider
 
 
@@ -124,16 +127,24 @@ def _domain_fit(task_text: str) -> str:
 
 
 def _probe_provider(provider: str) -> tuple[bool, bool | None, str]:
-    if provider == "claude":
-        return True, True, "built-in"
+    normalized_provider = str(provider).strip().lower()
+    if normalized_provider == "claude":
+        claude_bin = os.environ.get("OMG_CLAUDE_BIN", "claude")
+        worker_cmd = os.environ.get("OMG_CLAUDE_WORKER_CMD", "").strip()
+        if worker_cmd or shutil.which(claude_bin) is not None:
+            return True, None, "cli-detected"
+        return False, False, "provider CLI unavailable"
+
+    if not is_canonical_parity_host(normalized_provider):
+        return False, False, "unsupported provider"
 
-    module_name = f"runtime.providers.{provider}_provider"
+    module_name = f"runtime.providers.{normalized_provider}_provider"
     try:
         _ = importlib.import_module(module_name)
     except Exception as exc:
         return False, False, f"provider module import failed: {exc}"
 
-    cli_provider = get_provider(provider)
+    cli_provider = get_provider(normalized_provider)
     if cli_provider is None:
         return False, False, "provider not registered"
 

package/build/lib/runtime/evidence_query.py

@@ -6,7 +6,7 @@ from pathlib import Path
 from typing import cast
 
 from runtime.context_engine import load_profile_digest
-from runtime.evidence_requirements import requirements_for_profile
+from runtime.evidence_requirements import EVIDENCE_REQUIREMENTS_BY_PROFILE, requirements_for_profile
 
 JsonPrimitive = str | int | float | bool | None
 JsonValue = JsonPrimitive | dict[str, "JsonValue"] | list["JsonValue"]
@@ -54,6 +54,7 @@ def _record_copy_with_context_metadata(root: Path, record: JsonObject) -> JsonOb
     profile_version = existing_profile_version or str(profile_digest.get("profile_version", "")).strip()
     evidence_profile = _record_string(record, "evidence_profile").strip()
     evidence_requirements = requirements_for_profile(evidence_profile)
+    profile_is_known = not evidence_profile or evidence_profile in EVIDENCE_REQUIREMENTS_BY_PROFILE
 
     intent_gate_payload = _load_json(root / ".omg" / "state" / "intent_gate" / f"{run_id}.json") or {}
     existing_intent_gate_version = _record_string(record, "intent_gate_version")
@@ -84,6 +85,9 @@ def _record_copy_with_context_metadata(root: Path, record: JsonObject) -> JsonOb
     enriched["intent_gate_version"] = intent_gate_version
     enriched["evidence_profile"] = evidence_profile
     enriched["evidence_requirements"] = cast(JsonValue, [str(item) for item in evidence_requirements])
+    enriched["evidence_profile_known"] = profile_is_known
+    if evidence_profile and not profile_is_known:
+        enriched["evidence_profile_error"] = f"unknown_evidence_profile:{evidence_profile}"
     return enriched
 
 

package/build/lib/runtime/evidence_requirements.py

@@ -13,8 +13,15 @@ FULL_REQUIREMENTS: Final[list[str]] = [
     "license_scan",
     "sbom",
     "trace_link",
+    "artifact_contracts",
+    "signed_lineage",
+    "signed_model_card",
+    "signed_checkpoint",
+    "simulator-episode-evidence",
 ]
 
+HARDENED_READINESS_REQUIREMENTS: Final[list[str]] = list(FULL_REQUIREMENTS)
+
 EVIDENCE_REQUIREMENTS_BY_PROFILE: Final[dict[str, list[str]]] = {
     "code-change": [
         "tests",
@@ -60,6 +67,42 @@ EVIDENCE_REQUIREMENTS_BY_PROFILE: Final[dict[str, list[str]]] = {
         "provenance",
         "trace_link",
     ],
+    "music-omr": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+        "artifact_contracts",
+    ],
+    "forge-vision": list(HARDENED_READINESS_REQUIREMENTS)
+    + [
+        "vision-artifacts",
+        "drift-check",
+    ],
+    "health-flow": list(HARDENED_READINESS_REQUIREMENTS)
+    + [
+        "human-review",
+        "audit-trail",
+        "restricted-tools",
+    ],
+    "team-flow": list(HARDENED_READINESS_REQUIREMENTS)
+    + [
+        "human-review",
+        "audit-trail",
+        "restricted-tools",
+    ],
+    "transposition-flow": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+        "artifact_contracts",
+        "benchmark-harness",
+        "determinism-check",
+        "signed_lineage",
+        "signed_model_card",
+        "signed_checkpoint",
+    ],
     "buffet": list(FULL_REQUIREMENTS),
     "security-audit": list(FULL_REQUIREMENTS),
     "release": list(FULL_REQUIREMENTS),

package/build/lib/runtime/exec_kernel.py

@@ -0,0 +1,267 @@
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass
+import json
+import os
+from pathlib import Path
+from types import ModuleType
+from typing import Any
+from typing import cast
+from uuid import uuid4
+
+
+_DEFAULT_EVIDENCE_HOOKS = (
+    ".omg/evidence/subagents",
+    ".omg/state/release_run_coordinator",
+)
+
+
+def _project_dir(project_dir: str | None = None) -> Path:
+    if project_dir:
+        return Path(project_dir).resolve()
+    return Path(os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())).resolve()
+
+
+def _is_enabled_from_env() -> bool:
+    raw = str(os.environ.get("OMG_EXEC_KERNEL_ENABLED", "false")).strip().lower()
+    return raw in {"1", "true", "yes", "on"}
+
+
+@dataclass(frozen=True)
+class KernelRun:
+    run_id: str
+    isolation_mode: str
+    evidence_hooks: tuple[str, ...]
+    attach_log: str
+
+
+class ExecKernel:
+    def __init__(self, project_dir: str | None = None):
+        self.project_dir = _project_dir(project_dir)
+
+    @property
+    def enabled(self) -> bool:
+        return _is_enabled_from_env()
+
+    def attach_log(self, run_id: str) -> str:
+        return str(Path(".omg") / "state" / "exec-kernel" / f"{run_id}.log").replace("\\", "/")
+
+    def _state_path(self, run_id: str) -> Path:
+        return self.project_dir / ".omg" / "state" / "exec-kernel" / f"{run_id}.json"
+
+    def _write_state(self, run_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+        path = self._state_path(run_id)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        previous = self.get_run_state(run_id)
+        merged: dict[str, Any] = dict(previous)
+        merged.update(payload)
+        merged["schema"] = "ExecKernelRunState"
+        merged["run_id"] = run_id
+        merged["kernel_enabled"] = self.enabled
+        merged["state_path"] = str(path.relative_to(self.project_dir)).replace("\\", "/")
+        tmp_path = path.with_name(f"{path.name}.tmp")
+        tmp_path.write_text(json.dumps(merged, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+        os.replace(tmp_path, path)
+        return merged
+
+    def get_run_state(self, run_id: str) -> dict[str, Any]:
+        path = self._state_path(run_id)
+        if not path.exists():
+            return {}
+        try:
+            payload = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            return {}
+        return payload if isinstance(payload, dict) else {}
+
+    def normalize_isolation(self, isolation_mode: str) -> dict[str, Any]:
+        normalized = str(isolation_mode or "none").strip().lower() or "none"
+        if normalized == "worktree":
+            return {
+                "requested": "worktree",
+                "effective": "worktree",
+                "status": "supported",
+                "read_only": False,
+            }
+        if normalized == "container":
+            return {
+                "requested": "container",
+                "effective": "none",
+                "status": "deferred",
+                "reason": "container isolation is deferred/unsupported",
+                "read_only": True,
+            }
+        return {
+            "requested": "none",
+            "effective": "none",
+            "status": "read-only",
+            "reason": "none isolation permits read-only execution",
+            "read_only": True,
+        }
+
+    def _resolve_run_id(self, run_id: str | None) -> str:
+        module = cast(
+            ModuleType,
+            __import__("runtime.release_run_coordinator", fromlist=["resolve_canonical_run_id"]),
+        )
+        resolver = cast(object, getattr(module, "resolve_canonical_run_id", None))
+        if callable(resolver):
+            resolved_obj = resolver(
+                str(self.project_dir),
+                cli_run_id=run_id,
+                generate_if_missing=True,
+            )
+            resolved = cast(object, resolved_obj)
+            resolved_run_id = str(getattr(resolved, "run_id", "")).strip()
+            if resolved_run_id:
+                return resolved_run_id
+        return str(run_id or uuid4())
+
+    def _active_run_id(self) -> str:
+        shadow_path = self.project_dir / ".omg" / "shadow" / "active-run"
+        if not shadow_path.exists():
+            return ""
+        try:
+            return shadow_path.read_text(encoding="utf-8").strip()
+        except OSError:
+            return ""
+
+    def _ownership_snapshot(self, run_id: str) -> dict[str, Any]:
+        from runtime.merge_writer import get_merge_writer
+
+        merge_writer = get_merge_writer(str(self.project_dir))
+        merge_writer_details = merge_writer.check_authorization_details(run_id)
+        active_run_id = self._active_run_id()
+        return {
+            "active_run_id": active_run_id,
+            "run_id": run_id,
+            "merge_writer": merge_writer_details,
+        }
+
+    def register_run(
+        self,
+        run_id: str | None,
+        *,
+        isolation_mode: str = "none",
+        evidence_hooks: list[str] | tuple[str, ...] | None = None,
+        source: str = "runtime",
+        reason: str = "",
+    ) -> KernelRun:
+        resolved_run_id = self._resolve_run_id(run_id)
+        isolation = self.normalize_isolation(isolation_mode)
+        hooks = tuple(evidence_hooks or _DEFAULT_EVIDENCE_HOOKS)
+        ownership = self._ownership_snapshot(resolved_run_id)
+        kernel_run = KernelRun(
+            run_id=resolved_run_id,
+            isolation_mode=str(isolation["requested"]),
+            evidence_hooks=hooks,
+            attach_log=self.attach_log(resolved_run_id),
+        )
+        self._write_state(
+            resolved_run_id,
+            {
+                "status": "registered",
+                "source": source,
+                "reason": reason,
+                "kernel_run": asdict(kernel_run),
+                "isolation": isolation,
+                "ownership": ownership,
+                "evidence_hooks": list(hooks),
+                "attach_log": kernel_run.attach_log,
+            },
+        )
+        return kernel_run
+
+    def submit_worker(
+        self,
+        *,
+        run_id: str,
+        agent_name: str,
+        task_text: str,
+        isolation_mode: str = "none",
+        evidence_hooks: list[str] | tuple[str, ...] | None = None,
+    ) -> dict[str, Any]:
+        kernel_run = self.register_run(
+            run_id,
+            isolation_mode=isolation_mode,
+            evidence_hooks=evidence_hooks,
+            source="submit_worker",
+        )
+        canonical_run_id = kernel_run.run_id
+        isolation = self.normalize_isolation(kernel_run.isolation_mode)
+        ownership = self._ownership_snapshot(canonical_run_id)
+        if isolation["requested"] == "container":
+            state = self._write_state(
+                canonical_run_id,
+                {
+                    "status": "deferred",
+                    "dispatch": {
+                        "status": "deferred",
+                        "reason": isolation["reason"],
+                        "agent_name": agent_name,
+                    },
+                    "ownership": ownership,
+                },
+            )
+            return {
+                "status": "deferred",
+                "run_id": canonical_run_id,
+                "job_id": None,
+                "isolation": isolation,
+                "ownership": ownership,
+                "kernel_enabled": self.enabled,
+                "state_path": state.get("state_path", ""),
+                "reason": isolation["reason"],
+            }
+
+        from runtime import subagent_dispatcher
+
+        dispatch_isolation = "worktree" if isolation["effective"] == "worktree" else "none"
+        job_id = subagent_dispatcher.submit_job(
+            agent_name,
+            task_text,
+            isolation=dispatch_isolation,
+            run_id=canonical_run_id,
+            evidence_hooks=list(kernel_run.evidence_hooks),
+            attach_log=kernel_run.attach_log,
+        )
+        state = self._write_state(
+            canonical_run_id,
+            {
+                "status": "queued",
+                "dispatch": {
+                    "status": "queued",
+                    "job_id": job_id,
+                    "agent_name": agent_name,
+                    "task_text": task_text,
+                    "isolation": isolation,
+                    "passthrough": not self.enabled,
+                },
+                "ownership": ownership,
+            },
+        )
+        return {
+            "status": "queued",
+            "run_id": canonical_run_id,
+            "job_id": job_id,
+            "isolation": isolation,
+            "ownership": ownership,
+            "kernel_enabled": self.enabled,
+            "attach_log": kernel_run.attach_log,
+            "evidence_hooks": list(kernel_run.evidence_hooks),
+            "state_path": state.get("state_path", ""),
+            "passthrough": not self.enabled,
+        }
+
+    def record_supervisor_session(self, run_id: str, session_payload: dict[str, Any]) -> dict[str, Any]:
+        return self._write_state(
+            run_id,
+            {
+                "supervisor_session": dict(session_payload),
+                "supervisor_status": str(session_payload.get("status", "ok")),
+            },
+        )
+
+
+def get_exec_kernel(project_dir: str | None = None) -> ExecKernel:
+    return ExecKernel(project_dir)