@trac3er/oh-my-god 2.1.9 → 2.2.2

package/docs/install/opencode.md

@@ -27,4 +27,4 @@ cd OMG
 ## Notes
 
 - OpenCode consumes OMG through compatibility-host MCP registration
-- canonical v1 contract hosts remain Claude Code and Codex
+- canonical v2.1.9 behavior-parity hosts are Claude Code, Codex, Gemini CLI, and Kimi CLI

package/docs/proof.md

@@ -17,12 +17,33 @@ OMG keeps verification visible instead of burying it in implementation details.
   - `test-intent-lock`: `.omg/evidence/test-intent-lock-*.json` (verifies test-to-intent alignment)
   - `proof-gate`: `.omg/evidence/proof-gate-*.json` (verifies final release readiness)
 - Release execution primitives required by `omg release readiness`:
+  - canonical evidence profile registry: `runtime.evidence_requirements.EVIDENCE_REQUIREMENTS_BY_PROFILE` (release-facing labels derive from this map)
   - run coordinator state: `.omg/state/release_run_coordinator/<run_id>.json`
   - TDD lock evidence: `.omg/state/test-intent-lock/*.json`
   - rollback manifest: `.omg/state/rollback_manifest/*.json`
   - session health: `.omg/state/session_health/<run_id>.json`
   - council verdicts: `.omg/state/council_verdicts/<run_id>.json`
   - Forge starter proof (`proof_backed: true`): `.omg/evidence/forge-specialists-*.json`
+  - exec kernel state: `.omg/state/exec-kernel/<run_id>.json`
+  - worker watchdog replay: `.omg/evidence/subagents/<run_id>-replay.json`
+  - merge writer provenance: `.omg/evidence/merge-writer-<run_id>.json`
+  - tool fabric ledger: `.omg/state/ledger/tool-ledger.jsonl`
+  - budget envelope state: `.omg/state/budget-envelopes/<run_id>.json`
+  - issue report: `.omg/evidence/issues/<run_id>.json`
+  - host parity report: `.omg/evidence/host-parity-<run_id>.json`
+  - music OMR testbed evidence: `.omg/evidence/music-omr-<run_id>.json`
+
+## Permanent Music OMR Daily Gate
+
+Music OMR is the permanent daily release gate artifact. Release readiness requires a fresh Music OMR evidence file tied to the active run id.
+
+- Gate cadence: daily scheduled run via `.github/workflows/omg-release-readiness.yml`
+- Run scope: `run_id` must match the active release evidence pack run
+- Freshness metadata: `freshness.generated_at`, `freshness.max_age_seconds`, `freshness.expires_at`, `freshness.is_fresh`
+- Fixture inventory: `fixture_inventory` must include deterministic fixture ids (for this gate: `simple_c_major.json`, `simple_g_major.json`, `chromatic_fragment.json`, `waltz_three_four.json`, `transposition_pressure_fixture.json`); minimum 5 fixtures required (`fixture_inventory_valid` must be `true`)
+- Trace metadata: `trace.trace_id`, `trace.gate=music-omr-daily`, `trace.run_scope=release-run`, `trace_metadata.testbed`, `trace_metadata.fixture_count`, `trace_metadata.run_id_linkage`
+- Freshness threshold: `freshness_threshold_secs`, `freshness.freshness_threshold_secs`
+- Run linkage: `run_id` must match the active release run, `trace_metadata.run_id_linkage` must equal `run_id`
 
 ## Forge v0.3 Evidence
 
@@ -51,9 +72,9 @@ Forge v0.3 introduces richer evidence artifacts for domain-specific training and
 |----------|------|--------|------------|------------|---------------|
 | Claude Code | Canonical | host-native | host-native | yes | primary |
 | Codex | Canonical | yes | yes | yes | primary |
-| OpenCode | Compatibility | yes | yes | yes | supported |
-| Gemini | Compatibility | yes | yes | yes | supported |
-| Kimi | Compatibility | yes | yes | yes | supported |
+| Gemini | Canonical | yes | yes | yes | primary |
+| Kimi | Canonical | yes | yes | yes | primary |
+| OpenCode | Compatibility-only | yes | yes | yes | supported |
 
 ## Adoption Evidence
 

package/docs/release-checklist.md

@@ -18,11 +18,12 @@ Use this checklist before making OMG public or cutting a release tag.
 
 - [ ] `python3 scripts/sync-release-identity.py --check` — authored surfaces in sync
 - [ ] `python3 scripts/validate-release-identity.py --scope all --forbid-version <previous-version>` — full identity validation
-- `python3 scripts/omg.py diagnose-plugins --format json` exits 0
-- `python3 scripts/omg.py contract validate` passes
-- `python3 scripts/omg.py validate --format json` includes `plugin_compatibility` check
-- `python3 scripts/omg.py contract compile --host claude --host codex --channel public --output-root <tmp>` passes
-- `python3 scripts/omg.py contract compile --host claude --host codex --channel enterprise --output-root <tmp>` passes
+- [ ] `python3 scripts/omg.py contract validate` passes
+- [ ] `python3 scripts/omg.py compat gate --max-bridge 0 --output artifacts/omg-compat-gap.json` passes
+- [ ] `python3 scripts/omg.py release readiness --channel dual --output-root artifacts/release` returns `status=ok`
+- [ ] `python3 scripts/omg.py validate --format json` includes `plugin_compatibility` check
+- `python3 scripts/omg.py contract compile --host claude --host codex --host gemini --host kimi --channel public --output-root <tmp>` passes
+- `python3 scripts/omg.py contract compile --host claude --host codex --host gemini --host kimi --channel enterprise --output-root <tmp>` passes
 - `python3 scripts/omg.py release readiness --channel dual --output-root <tmp>` passes
 
 ## Forge v0.3

package/hooks/_common.py

@@ -107,7 +107,7 @@ def deny_decision(reason):
     }, sys.stdout)
 
 
-def block_decision(reason):
+def block_decision(reason, *, block_reason="unknown", project_dir=None):
     """Emit a Stop hook block decision to stdout.
 
     Also records the block for loop detection. Every stop hook that calls
@@ -117,7 +117,7 @@ def block_decision(reason):
     # Record block BEFORE emitting -- ensures tracker is updated even if
     # the process is killed after emitting the decision.
     try:
-        record_stop_block()
+        record_stop_block(project_dir=project_dir, reason=block_reason)
     except Exception:
         pass  # never let tracker failure prevent the block decision
     json.dump({"decision": "block", "reason": reason}, sys.stdout)
@@ -505,17 +505,24 @@ def should_skip_stop_hooks(data):
             if os.path.exists(_tracker_path):
                 with open(_tracker_path, "r", encoding="utf-8") as _f:
                     _state = json.load(_f)
-                _elapsed = (datetime.now(timezone.utc) - datetime.fromisoformat(_state["ts"])).total_seconds()
-                if _elapsed < _BLOCK_LOOP_WINDOW_SECS and _state.get("count", 0) >= 1:
-                    _reason = _state.get("reason", "unknown")
-                    if _reason in _LOOP_BLOCK_REASONS:
-                        print(
-                            "[OMG] Guard 5 triggered: context may be exhausted and stop hooks recently blocked. "
-                            "Skipping stop-hook blocks so compaction can run. "
-                            "Tip: /OMG:handoff then continue in a fresh session.",
-                            file=sys.stderr,
-                        )
-                        return True
+                # Session isolation: stale tracker from another session cannot suppress hooks
+                _tracker_session = _state.get("session_id", "")
+                _current_session = _get_session_id()
+                if (_tracker_session and _current_session != "unknown"
+                        and _tracker_session != _current_session):
+                    pass  # Different session — not a deadlock
+                else:
+                    _elapsed = (datetime.now(timezone.utc) - datetime.fromisoformat(_state["ts"])).total_seconds()
+                    if _elapsed < _BLOCK_LOOP_WINDOW_SECS and _state.get("count", 0) >= 1:
+                        _reason = _state.get("reason", "unknown")
+                        if _reason in _LOOP_BLOCK_REASONS:
+                            print(
+                                "[OMG] Guard 5 triggered: context may be exhausted and stop hooks recently blocked. "
+                                "Skipping stop-hook blocks so compaction can run. "
+                                "Tip: /OMG:handoff then continue in a fresh session.",
+                                file=sys.stderr,
+                            )
+                            return True
         except Exception:
             pass  # fail open
     return False
@@ -523,6 +530,16 @@ def should_skip_stop_hooks(data):
 
 # --- Stop-Block Loop Breaker (file-based safety net) ---
 
+
+def _get_session_id():
+    """Get current session ID from environment, falling back to 'unknown'."""
+    for key in ("CLAUDE_SESSION_ID", "SESSION_ID", "OMG_SESSION_ID"):
+        val = os.environ.get(key, "").strip()
+        if val:
+            return val
+    return "unknown"
+
+
 def record_stop_block(project_dir=None, reason: str = "unknown", session_id: str = ""):
     """Record that a stop hook block was issued. Called before block_decision().
     
@@ -532,6 +549,8 @@ def record_stop_block(project_dir=None, reason: str = "unknown", session_id: str
         session_id: Session identifier to prevent cross-session interference
     """
     try:
+        if not session_id:
+            session_id = _get_session_id()
         pdir = project_dir or get_project_dir()
         path = os.path.join(pdir, _STOP_BLOCK_TRACKER)
         state = {
@@ -573,6 +592,8 @@ def is_stop_block_loop(project_dir=None, session_id: str = ""):
                    returns False (cross-session, not a loop).
     """
     try:
+        if not session_id:
+            session_id = _get_session_id()
         pdir = project_dir or get_project_dir()
         path = os.path.join(pdir, _STOP_BLOCK_TRACKER)
         if not os.path.exists(path):

package/hooks/_token_counter.py

@@ -145,7 +145,7 @@ def _get_anthropic_api_key() -> str | None:
         key = store_mod.get_active_key("anthropic")
         if key:
             return key
-    except Exception:
+    except (ImportError, RuntimeError, ValueError, OSError, AttributeError):
         pass
     return os.environ.get("ANTHROPIC_API_KEY")
 

package/hooks/branch_manager.py

@@ -164,8 +164,25 @@ def _extract_task_description(project_dir: str) -> str | None:
     return None
 
 
+def _is_merge_writer_locked(project_dir: str) -> bool:
+    try:
+        _root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+        if _root not in sys.path:
+            sys.path.insert(0, _root)
+        from runtime.merge_writer import MergeWriter  # pyright: ignore[reportMissingImports]
+        return MergeWriter(project_dir).is_locked()
+    except Exception:
+        return False
+
+
 def _create_branch(project_dir: str, branch_name: str) -> bool:
     """Create and checkout a new branch. Returns True on success."""
+    if _is_merge_writer_locked(project_dir):
+        print(
+            f"[OMG branch-manager] Branch creation blocked: merge-writer lock is held",
+            file=sys.stderr,
+        )
+        return False
     try:
         result = subprocess.run(
             ["git", "-C", project_dir, "checkout", "-b", branch_name],

package/hooks/budget_governor.py

@@ -189,6 +189,27 @@ def _check_thresholds(
     return new_messages
 
 
+def _check_budget_envelope(project_dir: str) -> str:
+    run_id = os.environ.get("OMG_RUN_ID", "").strip()
+    if not run_id:
+        return ""
+    try:
+        parent = os.path.dirname(HOOKS_DIR)
+        if parent not in sys.path:
+            sys.path.insert(0, parent)
+        from runtime.budget_envelopes import get_budget_envelope_manager
+
+        mgr = get_budget_envelope_manager(project_dir)
+        result = mgr.check_envelope(run_id)
+        if result.status == "ok":
+            return ""
+        action_tag = {"warn": "@envelope-warning", "reflect": "@envelope-critical", "block": "@envelope-limit"}
+        tag = action_tag.get(result.governance_action, "@envelope-warning")
+        return f"{tag}: {result.reason} [action={result.governance_action}]"
+    except Exception:
+        return ""
+
+
 def main() -> None:
     setup_crash_handler("budget-governor", fail_closed=False)
 
@@ -224,6 +245,10 @@ def main() -> None:
     if threshold_alerts:
         context += "\n" + "\n".join(threshold_alerts)
 
+    envelope_context = _check_budget_envelope(project_dir)
+    if envelope_context:
+        context += "\n" + envelope_context
+
     json.dump({"additionalContext": context}, sys.stdout)
     sys.exit(0)
 

package/hooks/context_pressure.py

@@ -5,19 +5,49 @@ import json
 import os
 from datetime import datetime, timezone
 
-_DEFAULT_THRESHOLD = 150
+try:
+    from runtime.context_limits import get_model_limits, compaction_trigger
+except Exception:
+    get_model_limits = None
+    compaction_trigger = None
 
 
-def estimate_context_pressure(project_dir):
-    threshold = _DEFAULT_THRESHOLD
+def _detect_model_id(context_packet=None):
+    for key in ("CLAUDE_MODEL", "OMG_MODEL_ID", "OPENAI_MODEL"):
+        value = os.environ.get(key, "").strip()
+        if value:
+            return value
+
+    if isinstance(context_packet, dict):
+        model = context_packet.get("model")
+        if isinstance(model, dict):
+            for key in ("id", "display_name", "name"):
+                value = str(model.get(key, "") or "").strip()
+                if value:
+                    return value
+        elif isinstance(model, str) and model.strip():
+            return model.strip()
+    return ""
+
+
+def _host_aware_threshold(context_packet=None):
+    model_id = _detect_model_id(context_packet)
+    if compaction_trigger is not None and get_model_limits is not None:
+        return int(compaction_trigger(model_id)), model_id, get_model_limits(model_id)
+    return 80_000, model_id, {"class_label": "128k-class"}
+
+
+def estimate_context_pressure(project_dir, context_packet=None):
+    threshold, model_id, limits = _host_aware_threshold(context_packet)
     try:
         settings_path = os.path.join(project_dir, "settings.json")
         if os.path.exists(settings_path):
             with open(settings_path, "r", encoding="utf-8") as settings_file:
                 settings = json.load(settings_file)
-            threshold = settings.get("_omg", {}).get("context_budget", {}).get(
-                "pressure_threshold", _DEFAULT_THRESHOLD
+            configured = settings.get("_omg", {}).get("context_budget", {}).get(
+                "pressure_threshold", threshold
             )
+            threshold = int(configured)
     except Exception:
         pass
 
@@ -42,6 +72,8 @@ def estimate_context_pressure(project_dir):
                 {
                     "tool_count": tool_count,
                     "threshold": threshold,
+                    "model_id": model_id,
+                    "class_label": limits.get("class_label", "128k-class"),
                     "is_high": is_high,
                     "ts": datetime.now(timezone.utc).isoformat(),
                 },

package/hooks/credential_store.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# pyright: reportConstantRedefinition=false, reportMissingTypeArgument=false
 """OMG Multi-Credential Encrypted Store
 
 Fernet-based encrypted credential storage with PBKDF2HMAC key derivation.
@@ -17,27 +18,24 @@ import base64
 import gc
 import getpass
 import hashlib
-import hmac
 import json
 import os
 import sys
 from datetime import datetime, timezone
 from typing import Any
 
-# --- Ensure hooks dir is on sys.path for _common imports ---
 HOOKS_DIR = os.path.dirname(os.path.abspath(__file__))
-if HOOKS_DIR not in sys.path:
-    sys.path.insert(0, HOOKS_DIR)
+PROJECT_ROOT = os.path.dirname(HOOKS_DIR)
+if PROJECT_ROOT not in sys.path:
+    sys.path.insert(0, PROJECT_ROOT)
 
-from _common import (
+from hooks._common import (
     atomic_json_write,
     get_feature_flag,
     get_project_dir,
     setup_crash_handler,
 )
 
-# Credential storage prefers Fernet, but standalone/no-vendor verification
-# still needs a local authenticated fallback when optional crypto wheels are absent.
 setup_crash_handler("credential_store", fail_closed=True)
 
 # --- Lazy-loaded cryptography imports ---
@@ -47,9 +45,11 @@ _CRYPTO_BACKEND: str | None = None
 
 
 def _ensure_crypto():
-    """Prefer cryptography, but allow a stdlib fallback in standalone mode."""
+    """Require cryptography/Fernet for credential-store encryption."""
     global _Fernet, _InvalidToken, _CRYPTO_BACKEND
     if _CRYPTO_BACKEND is not None:
+        if _CRYPTO_BACKEND != "fernet" or _Fernet is None or _InvalidToken is None:
+            raise RuntimeError("Secure credential backend unavailable: cryptography is required")
         return
     try:
         from cryptography.fernet import Fernet, InvalidToken
@@ -57,10 +57,11 @@ def _ensure_crypto():
         _Fernet = Fernet
         _InvalidToken = InvalidToken
         _CRYPTO_BACKEND = "fernet"
-    except ImportError:
+    except ImportError as exc:
         _Fernet = None
-        _InvalidToken = ValueError
-        _CRYPTO_BACKEND = "stdlib"
+        _InvalidToken = None
+        _CRYPTO_BACKEND = "unavailable"
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required") from exc
 
 
 # --- Constants ---
@@ -73,57 +74,6 @@ MIN_PASSPHRASE_LEN = 8
 
 # Default empty store schema
 _EMPTY_STORE = {"version": 1, "providers": {}}
-_STDLIB_TOKEN_PREFIX = b"OMG1"
-
-
-def _raw_key(key: bytes) -> bytes:
-    return base64.urlsafe_b64decode(key)
-
-
-def _derive_keystream(secret: bytes, nonce: bytes, length: int) -> bytes:
-    chunks: list[bytes] = []
-    counter = 0
-    produced = 0
-    while produced < length:
-        block = hmac.new(secret, nonce + counter.to_bytes(4, "big"), hashlib.sha256).digest()
-        chunks.append(block)
-        produced += len(block)
-        counter += 1
-    return b"".join(chunks)[:length]
-
-
-def _encrypt_store_stdlib(payload: bytes, key: bytes) -> bytes:
-    secret = _raw_key(key)
-    nonce = os.urandom(16)
-    keystream = _derive_keystream(secret, nonce, len(payload))
-    ciphertext = bytes(left ^ right for left, right in zip(payload, keystream))
-    digest = hmac.new(secret, _STDLIB_TOKEN_PREFIX + nonce + ciphertext, hashlib.sha256).digest()
-    return base64.urlsafe_b64encode(_STDLIB_TOKEN_PREFIX + nonce + digest + ciphertext)
-
-
-def _decrypt_store_stdlib(token: bytes, key: bytes) -> dict | None:
-    try:
-        payload = base64.urlsafe_b64decode(token)
-    except Exception as exc:  # pragma: no cover - invalid base64 still handled as bad token
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store") from exc
-
-    if not payload.startswith(_STDLIB_TOKEN_PREFIX):
-        return None
-    if len(payload) < len(_STDLIB_TOKEN_PREFIX) + 16 + 32:
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
-
-    secret = _raw_key(key)
-    prefix_len = len(_STDLIB_TOKEN_PREFIX)
-    nonce = payload[prefix_len : prefix_len + 16]
-    digest = payload[prefix_len + 16 : prefix_len + 48]
-    ciphertext = payload[prefix_len + 48 :]
-    expected = hmac.new(secret, _STDLIB_TOKEN_PREFIX + nonce + ciphertext, hashlib.sha256).digest()
-    if not hmac.compare_digest(digest, expected):
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
-
-    keystream = _derive_keystream(secret, nonce, len(ciphertext))
-    plaintext = bytes(left ^ right for left, right in zip(ciphertext, keystream))
-    return json.loads(plaintext.decode("utf-8"))
 
 
 # =============================================================================
@@ -151,7 +101,7 @@ def derive_key(passphrase: bytes, salt: bytes, kdf_config: dict | None = None) -
 
 
 def encrypt_store(data: dict, key: bytes) -> bytes:
-    """Encrypt credential store payload with Fernet or the stdlib fallback.
+    """Encrypt credential store payload with Fernet.
 
     Args:
         data: Credential store dict to encrypt
@@ -159,12 +109,15 @@ def encrypt_store(data: dict, key: bytes) -> bytes:
 
     Returns:
         Token bytes
+
+    Raises:
+        RuntimeError: If secure cryptography backend is unavailable
     """
     _ensure_crypto()
     payload = json.dumps(data, separators=(",", ":")).encode("utf-8")
-    if _CRYPTO_BACKEND == "fernet" and _Fernet is not None:
-        return _Fernet(key).encrypt(payload)
-    return _encrypt_store_stdlib(payload, key)
+    if _Fernet is None:
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required")
+    return _Fernet(key).encrypt(payload)
 
 
 def decrypt_store(token: bytes, key: bytes) -> dict:
@@ -179,14 +132,11 @@ def decrypt_store(token: bytes, key: bytes) -> dict:
 
     Raises:
         ValueError: If passphrase is wrong or store contents are corrupted
+        RuntimeError: If secure cryptography backend is unavailable
     """
-    fallback = _decrypt_store_stdlib(token, key)
-    if fallback is not None:
-        return fallback
-
     _ensure_crypto()
-    if _CRYPTO_BACKEND != "fernet" or _Fernet is None or _InvalidToken is None:
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
+    if _Fernet is None or _InvalidToken is None:
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required")
 
     f = _Fernet(key)
     try:
@@ -618,7 +568,7 @@ def get_active_key(provider: str, project_dir: str | None = None) -> str | None:
 
     try:
         store = load_store(passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         return None
 
     providers = store.get("providers", {})
@@ -661,7 +611,7 @@ def advance_key(provider: str, project_dir: str | None = None) -> None:
 
     try:
         store = load_store(passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         return
 
     providers = store.get("providers", {})
@@ -688,7 +638,7 @@ def advance_key(provider: str, project_dir: str | None = None) -> None:
     # Failover only advances on error, not after success
     try:
         save_store(store, passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         pass  # Best-effort; don't crash the API call
 
 

package/hooks/firewall.py

@@ -26,6 +26,8 @@ setup_crash_handler("firewall", fail_closed=True)
 
 try:
     from policy_engine import evaluate_bash_command, to_pretool_hook_output, scan_mutation_command, ask, deny  # pyright: ignore[reportImplicitRelativeImport]
+    from runtime.compliance_governor import classify_bash_command_mode
+    from runtime.context_engine import _extract_clarification
     from runtime.defense_state import DefenseState
     from runtime.session_health import compute_session_health
     from runtime.mutation_gate import check_mutation_allowed
@@ -125,47 +127,17 @@ def _read_council_signal(project_dir: str, run_id: str) -> str:
 
 def _read_clarification_state(project_dir: str, run_id: str) -> dict[str, object]:
     if not run_id:
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
+        return _extract_clarification({})
     path = Path(project_dir) / ".omg" / "state" / "intent_gate" / f"{run_id}.json"
     if not path.exists():
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
+        return _extract_clarification({})
     try:
         payload = json.loads(path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
+        return _extract_clarification({})
     if not isinstance(payload, dict):
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
-    prompt = " ".join(str(payload.get("clarification_prompt", "")).split())
-    try:
-        confidence = float(payload.get("confidence", 0.0))
-    except (TypeError, ValueError):
-        confidence = 0.0
-    return {
-        "requires_clarification": bool(payload.get("requires_clarification") is True),
-        "intent_class": str(payload.get("intent_class", "")).strip(),
-        "clarification_prompt": prompt,
-        "confidence": round(max(0.0, min(1.0, confidence)), 2),
-    }
+        return _extract_clarification({})
+    return _extract_clarification(payload)
 
 
 def _clarification_reason(clarification_prompt: str) -> str:
@@ -175,6 +147,18 @@ def _clarification_reason(clarification_prompt: str) -> str:
     return "Clarification required before mutation: provide the missing intent details."
 
 
+def _clarification_external_reason(clarification_prompt: str) -> str:
+    prompt = " ".join(str(clarification_prompt or "").split())
+    if prompt:
+        return f"Clarification required before external execution: {prompt}"
+    return "Clarification required before external execution: provide the missing intent details."
+
+
+def _strict_ambiguity_mode_enabled() -> bool:
+    token = str(os.environ.get("OMG_STRICT_AMBIGUITY_MODE", "1")).strip().lower()
+    return token not in {"0", "false", "off", "no"}
+
+
 def _to_float(value: Any, default: float) -> float:
     try:
         return float(value)
@@ -266,8 +250,11 @@ gate_result = check_mutation_allowed(
     run_id=run_id or None,
     metadata=metadata if isinstance(metadata, dict) else None,
 )
-is_mutation_capable = str(gate_result.get("reason", "")) != "tool is read-only for mutation gate"
+bash_mode = classify_bash_command_mode(cmd)
+is_mutation_capable = bash_mode == "mutation"
+is_external_execution = bash_mode == "external"
 clarification_state = _read_clarification_state(get_project_dir(), run_id)
+strict_ambiguity_mode = _strict_ambiguity_mode_enabled()
 if is_mutation_capable:
     defense_decision = _mutating_defense_decision(
         project_dir=get_project_dir(),
@@ -277,8 +264,12 @@ if is_mutation_capable:
     if defense_decision is not None:
         decision = defense_decision
 
-if clarification_state.get("requires_clarification") is True and is_mutation_capable:
-    deny_decision(_clarification_reason(str(clarification_state.get("clarification_prompt", ""))))
+if strict_ambiguity_mode and clarification_state.get("requires_clarification") is True and (is_mutation_capable or is_external_execution):
+    prompt = str(clarification_state.get("clarification_prompt", ""))
+    if is_external_execution:
+        deny_decision(_clarification_external_reason(prompt))
+    else:
+        deny_decision(_clarification_reason(prompt))
     sys.exit(0)
 
 if is_mutation_capable and gate_result.get("status") == "blocked":