@trac3er/oh-my-god 2.1.9 → 2.2.2

package/build/lib/runtime/preflight.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import importlib
+from runtime.canonical_surface import DOMAIN_DEFAULTS, RELEASE_SURFACE_LABELS
 from runtime.delta_classifier import classify_project_changes
 from runtime.tracebank import record_trace
 from typing import Any
@@ -36,33 +37,36 @@ _HIGH_RISK_DELTA_TOKENS = (
     "configs",
 )
 
+_ROUTES = RELEASE_SURFACE_LABELS["routes"]
+_PREFLIGHT_DOMAIN_PACKS = set(DOMAIN_DEFAULTS["preflight_domain_packs"])
+
 
 def run_preflight(project_dir: str, *, goal: str) -> dict[str, Any]:
     lowered = goal.lower()
     task_class = "implementation"
     risk_class = "medium"
-    route = "teams"
+    route = _ROUTES["teams"]
     delta = classify_project_changes(project_dir, goal=goal)
     categories = set(delta["categories"])
     requires_security_check = _requires_security_check(delta)
-    domain_packs = [category for category in delta["categories"] if category in {"robotics", "vision", "algorithms", "health"}]
+    domain_packs = [category for category in delta["categories"] if category in _PREFLIGHT_DOMAIN_PACKS]
     evidence_requirements = _requirements_for_profile(delta.get("evidence_profile"))
 
     if requires_security_check:
         task_class = "security"
         risk_class = "high"
-        route = "security-check"
+        route = _ROUTES["security_check"]
     elif categories & {"api"} or any(token in lowered for token in ("openapi", "swagger", "postman", "contract", "fixture", "replay")):
         task_class = "contract"
-        route = "api-twin"
+        route = _ROUTES["api_twin"]
     elif any(token in lowered for token in ("auth", "secret", "security", "token", "injection")):
         task_class = "security"
         risk_class = "high"
-        route = "security-check"
+        route = _ROUTES["security_check"]
     elif any(token in lowered for token in ("full stack", "frontend and backend", "dashboard", "orchestrate")):
         task_class = "orchestration"
         risk_class = "high"
-        route = "crazy"
+        route = _ROUTES["crazy"]
 
     trace = record_trace(
         project_dir,
@@ -82,7 +86,7 @@ def run_preflight(project_dir: str, *, goal: str) -> dict[str, Any]:
         "route": route,
         "requires_security_check": requires_security_check,
         "required_tools": _required_tools(route),
-        "required_mcps": ["omg-control"] if route in {"security-check", "api-twin", "crazy"} else [],
+        "required_mcps": ["omg-control"] if route in {_ROUTES["security_check"], _ROUTES["api_twin"], _ROUTES["crazy"]} else [],
         "missing_constraints": [],
         "evidence_plan": _evidence_plan(route),
         "evidence_requirements": evidence_requirements,
@@ -117,15 +121,15 @@ def _requirements_for_profile(evidence_profile: str | None) -> list[str]:
 
 def _required_tools(route: str) -> list[str]:
     return {
-        "security-check": ["security"],
-        "api-twin": ["api-twin"],
-        "crazy": ["teams", "ccg"],
-    }.get(route, ["teams"])
+        _ROUTES["security_check"]: ["security"],
+        _ROUTES["api_twin"]: ["api-twin"],
+        _ROUTES["crazy"]: ["teams", "ccg"],
+    }.get(route, [_ROUTES["teams"]])
 
 
 def _evidence_plan(route: str) -> list[str]:
     return {
-        "security-check": ["security findings", "provenance"],
-        "api-twin": ["fixture fidelity", "live verification"],
-        "crazy": ["verification output", "evidence pack"],
+        _ROUTES["security_check"]: ["security findings", "provenance"],
+        _ROUTES["api_twin"]: ["fixture fidelity", "live verification"],
+        _ROUTES["crazy"]: ["verification output", "evidence pack"],
     }.get(route, ["verification output"])

package/build/lib/runtime/proof_chain.py

@@ -327,7 +327,7 @@ def assemble_proof_chain(project_dir: str, *, evidence_path: str | None = None)
         evidence_links = [selected_path] if selected_path else []
         publish_verification_state(
             project_dir=project_dir,
-            run_id=str(chain.get("eval_id", "")),
+            run_id=str(chain.get("run_id", "")),
             status=str(validation["status"]),
             blockers=list(validation.get("blockers", [])),
             evidence_links=evidence_links,

package/build/lib/runtime/providers/codex_provider.py

@@ -11,12 +11,24 @@ import uuid
 from typing import Any
 
 from runtime.cli_provider import CLIProvider, register_provider
+from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_codex_mcp_config
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
 
 
+def _attach_normalized_output(payload: dict[str, Any], *, prompt: str, project_dir: str) -> dict[str, Any]:
+    normalized = normalize_output(
+        "codex",
+        payload,
+        context={"prompt": prompt, "project_dir": project_dir},
+    )
+    merged = dict(payload)
+    merged["normalized_output"] = normalized
+    return merged
+
+
 class CodexProvider(CLIProvider):
     """CLIProvider implementation for the Codex CLI (``codex``)."""
 
@@ -55,11 +67,11 @@ class CodexProvider(CLIProvider):
                 cwd=project_dir,
                 env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "codex-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "codex-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -85,7 +97,11 @@ class CodexProvider(CLIProvider):
                 timeout=timeout,
             )
             mgr.kill_session(session)
-            return {"model": "codex-cli", "output": output, "exit_code": 0}
+            return _attach_normalized_output(
+                {"model": "codex-cli", "output": output, "exit_code": 0},
+                prompt=prompt,
+                project_dir=project_dir,
+            )
         except Exception as exc:
             _logger.warning("tmux codex invocation failed, falling back to subprocess: %s", exc)
             return self.invoke(prompt, project_dir, timeout=timeout)

package/build/lib/runtime/providers/gemini_provider.py

@@ -11,11 +11,23 @@ import uuid
 from typing import Any
 
 from runtime.cli_provider import CLIProvider, register_provider
+from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_gemini_mcp_config
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
 
+
+def _attach_normalized_output(payload: dict[str, Any], *, prompt: str, project_dir: str) -> dict[str, Any]:
+    normalized = normalize_output(
+        "gemini",
+        payload,
+        context={"prompt": prompt, "project_dir": project_dir, "no_json_mode": True},
+    )
+    merged = dict(payload)
+    merged["normalized_output"] = normalized
+    return merged
+
 HOST_RULES = {
     "compilation_targets": [".gemini/settings.json"],
     "mcp": ["omg-control"],
@@ -65,11 +77,11 @@ class GeminiProvider(CLIProvider):
                 cwd=project_dir,
                 env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "gemini-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "gemini-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -95,7 +107,11 @@ class GeminiProvider(CLIProvider):
                 timeout=timeout,
             )
             mgr.kill_session(session)
-            return {"model": "gemini-cli", "output": output, "exit_code": 0}
+            return _attach_normalized_output(
+                {"model": "gemini-cli", "output": output, "exit_code": 0},
+                prompt=prompt,
+                project_dir=project_dir,
+            )
         except Exception as exc:
             _logger.warning("tmux gemini invocation failed, falling back to subprocess: %s", exc)
             return self.invoke(prompt, project_dir, timeout=timeout)

package/build/lib/runtime/providers/kimi_provider.py

@@ -11,11 +11,23 @@ import uuid
 from typing import Any
 
 from runtime.cli_provider import CLIProvider, register_provider
+from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_kimi_mcp_config
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
 
+
+def _attach_normalized_output(payload: dict[str, Any], *, prompt: str, project_dir: str) -> dict[str, Any]:
+    normalized = normalize_output(
+        "kimi",
+        payload,
+        context={"prompt": prompt, "project_dir": project_dir},
+    )
+    merged = dict(payload)
+    merged["normalized_output"] = normalized
+    return merged
+
 HOST_RULES = {
     "compilation_targets": [".kimi/mcp.json"],
     "mcp": ["omg-control"],
@@ -69,11 +81,11 @@ class KimiCodeProvider(CLIProvider):
                 cwd=project_dir,
                 env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "kimi-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "kimi-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -90,11 +102,11 @@ class KimiCodeProvider(CLIProvider):
                 cwd=project_dir,
                 env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "kimi-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "kimi-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -120,7 +132,11 @@ class KimiCodeProvider(CLIProvider):
                 timeout=timeout,
             )
             mgr.kill_session(session)
-            return {"model": "kimi-cli", "output": output, "exit_code": 0}
+            return _attach_normalized_output(
+                {"model": "kimi-cli", "output": output, "exit_code": 0},
+                prompt=prompt,
+                project_dir=project_dir,
+            )
         except Exception as exc:
             _logger.warning("tmux kimi invocation failed, falling back to subprocess: %s", exc)
             return self.invoke(prompt, project_dir, timeout=timeout)

package/build/lib/runtime/release_run_coordinator.py

@@ -16,6 +16,9 @@ from runtime.runtime_contracts import write_run_state
 from runtime.session_health import compute_session_health
 from runtime.verification_controller import VerificationController
 from runtime.claim_judge import evaluate_claims_for_release
+from runtime.exec_kernel import get_exec_kernel
+from runtime.worker_watchdog import get_worker_watchdog
+from runtime.merge_writer import get_merge_writer
 
 
 class RunIdConflictError(ValueError):
@@ -57,12 +60,34 @@ class ReleaseRunCoordinator:
                 "verification_status": verification_state.get("status", "running"),
             },
         )
-        return {
+        get_exec_kernel(self.project_dir).register_run(
+            run_id,
+            source="release_run_coordinator.begin",
+            reason=f"{resolved.source}:{resolved.reason}",
+        )
+        try:
+            get_worker_watchdog(self.project_dir).record_heartbeat(
+                run_id, status="alive",
+                metadata={"phase": "begin", "source": resolved.source},
+            )
+        except Exception:
+            pass
+        merge_writer_token = None
+        try:
+            mw = get_merge_writer(self.project_dir)
+            token = mw.acquire(run_id, reason=f"release_run:{resolved.source}")
+            merge_writer_token = token.lock_path
+        except Exception:
+            pass
+        result: dict[str, object] = {
             "status": "running",
             "run_id": run_id,
             "resolution_source": resolved.source,
             "resolution_reason": resolved.reason,
         }
+        if merge_writer_token:
+            result["merge_writer_lock"] = merge_writer_token
+        return result
 
     def mutate(
         self,
@@ -107,6 +132,11 @@ class ReleaseRunCoordinator:
                 "health_action": str(health.get("recommended_action", "continue")),
             },
         )
+        get_exec_kernel(self.project_dir).register_run(
+            canonical_run_id,
+            source="release_run_coordinator.mutate",
+            reason=f"tool={tool}",
+        )
         return {
             "status": "running",
             "run_id": canonical_run_id,
@@ -133,6 +163,28 @@ class ReleaseRunCoordinator:
                 "health_action": str(health.get("recommended_action", "continue")),
             },
         )
+        get_exec_kernel(self.project_dir).register_run(
+            canonical_run_id,
+            source="release_run_coordinator.verify",
+            reason="verification_phase",
+        )
+        try:
+            watchdog = get_worker_watchdog(self.project_dir)
+            watchdog.record_heartbeat(
+                canonical_run_id, status="alive",
+                metadata={"phase": "verify"},
+            )
+            stall = watchdog.escalate_stall(canonical_run_id)
+            if stall:
+                from runtime.incident_replay import build_worker_lifecycle_pack
+                build_worker_lifecycle_pack(
+                    self.project_dir,
+                    run_id=canonical_run_id,
+                    event="stall_detected_during_verify",
+                    heartbeat=stall.get("heartbeat"),
+                )
+        except Exception:
+            pass
         return {
             "status": str(verification_state.get("status", "running")),
             "run_id": canonical_run_id,
@@ -235,6 +287,27 @@ class ReleaseRunCoordinator:
                 "evidence_links": list(evidence_links),
             },
         )
+        get_exec_kernel(self.project_dir).register_run(
+            canonical_run_id,
+            source="release_run_coordinator.finalize",
+            reason=f"status={resolved_status}",
+        )
+        try:
+            mw = get_merge_writer(self.project_dir)
+            if mw.check_authorization(canonical_run_id):
+                from runtime.merge_writer import MergeWriterToken
+                lock_data = mw._lock_path().read_text(encoding="utf-8")
+                import json as _json
+                lock_info = _json.loads(lock_data)
+                token = MergeWriterToken(
+                    run_id=canonical_run_id,
+                    acquired_at=str(lock_info.get("acquired_at", "")),
+                    lock_path=str(mw._lock_path().relative_to(mw.project_dir)).replace("\\", "/"),
+                    provenance_path=str(mw._provenance_path(canonical_run_id).relative_to(mw.project_dir)).replace("\\", "/"),
+                )
+                mw.release(token)
+        except Exception:
+            pass
         return {
             "status": str(verification_state.get("status", resolved_status)),
             "run_id": canonical_run_id,
@@ -389,6 +462,15 @@ def resolve_current_run_id(project_dir: str | None = None, cli_run_id: str | Non
     return resolved.run_id or None
 
 
+def get_active_coordinator_run_id(project_dir: str | None = None) -> str | None:
+    root = _project_dir(project_dir)
+    shadow = _read_shadow_run_id(str(root))
+    if shadow:
+        return shadow
+    active = _read_active_coordinator_run(str(root))
+    return active or None
+
+
 def _project_dir(project_dir: str | None = None) -> Path:
     if project_dir:
         return Path(project_dir)

package/build/lib/runtime/release_surfaces.py

@@ -52,16 +52,18 @@ class AuthoredSurface:
     source_only: bool = False
 
 
-# ── Explicit YAML bundle names (22 files) ──────────────────────────────────
+# ── Explicit YAML bundle names (25 files) ──────────────────────────────────
 
 _BUNDLE_NAMES: tuple[str, ...] = (
     "algorithms",
     "api-twin",
+    "ast-pack",
     "claim-judge",
     "control-plane",
     "data-lineage",
     "delta-classifier",
     "eval-gate",
+    "hash-edit",
     "health",
     "hook-governor",
     "incident-replay",
@@ -74,6 +76,7 @@ _BUNDLE_NAMES: tuple[str, ...] = (
     "robotics",
     "secure-worktree-pipeline",
     "security-check",
+    "terminal-lane",
     "test-intent-lock",
     "tracebank",
     "vision",
@@ -131,7 +134,7 @@ AUTHORED_SURFACES: list[AuthoredSurface] = [
         "Python package version",
     ),
 
-    # ── YAML bundles (22 files) ──
+    # ── YAML bundles (25 files) ──
     *[
         AuthoredSurface(
             f"registry/bundles/{name}.yaml", "yaml_line", "version",
@@ -232,11 +235,21 @@ SCOPED_RESIDUE_TARGETS: list[str] = [
     "dist/enterprise/manifest.json",
     "dist/public/bundle/",
     "dist/enterprise/bundle/",
+    # Explicitly include accidental double-nesting outputs to prevent silent
+    # stale-version residue from surviving a misconfigured compile run.
+    "dist/dist/",
     "artifacts/release/",
     "build/lib/",
 ]
 
 
+RUNTIME_BEHAVIOR_SURFACES: tuple[str, ...] = (
+    "execution_primitives",
+    "provider_host_parity",
+    "host_semantic_parity",
+)
+
+
 # ── Helpers ─────────────────────────────────────────────────────────────────
 
 def get_authored_paths() -> list[str]:
@@ -258,6 +271,10 @@ def get_derived_dirs() -> list[str]:
     return list(DERIVED_SURFACE_DIRS)
 
 
+def get_runtime_behavior_surfaces() -> list[str]:
+    return list(RUNTIME_BEHAVIOR_SURFACES)
+
+
 def surface_applies_to_root(surface: AuthoredSurface, root_dir: Path) -> bool:
     """Return whether a surface should be enforced for the given root layout."""
     if not surface.source_only:

package/build/lib/runtime/remote_supervisor.py

@@ -10,18 +10,29 @@ from pathlib import Path
 from typing import Any
 from uuid import uuid4
 
+from runtime.exec_kernel import get_exec_kernel
+from runtime.release_run_coordinator import resolve_current_run_id
+
 
 def _now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
-def issue_local_supervisor_session(project_dir: str, *, worker_id: str, shared_secret: str) -> dict[str, Any]:
+def issue_local_supervisor_session(
+    project_dir: str,
+    *,
+    worker_id: str,
+    shared_secret: str,
+    run_id: str | None = None,
+) -> dict[str, Any]:
+    resolved_run_id = run_id or resolve_current_run_id(project_dir)
     session_id = f"session-{uuid4().hex}"
     issued_at = _now()
     token_payload = {
         "session_id": session_id,
         "worker_id": worker_id,
         "issued_at": issued_at,
+        "run_id": resolved_run_id,
     }
     payload_json = json.dumps(token_payload, sort_keys=True, separators=(",", ":"))
     signature = hmac.new(shared_secret.encode("utf-8"), payload_json.encode("utf-8"), hashlib.sha256).hexdigest()
@@ -35,6 +46,7 @@ def issue_local_supervisor_session(project_dir: str, *, worker_id: str, shared_s
         "session_id": session_id,
         "worker_id": worker_id,
         "issued_at": issued_at,
+        "run_id": resolved_run_id,
         "local_only": True,
         "token": token,
     }
@@ -44,6 +56,8 @@ def issue_local_supervisor_session(project_dir: str, *, worker_id: str, shared_s
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(json.dumps({k: v for k, v in result.items() if k != "token"}, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
     result["path"] = rel_path.as_posix()
+    if resolved_run_id:
+        get_exec_kernel(project_dir).record_supervisor_session(resolved_run_id, result)
     return result
 
 
@@ -60,5 +74,6 @@ def verify_local_supervisor_token(token: str, *, shared_secret: str) -> dict[str
         "session_id": str(payload["session_id"]),
         "worker_id": str(payload["worker_id"]),
         "issued_at": str(payload["issued_at"]),
+        "run_id": str(payload.get("run_id") or ""),
         "local_only": True,
     }