@trac3er/oh-my-god 2.1.9 → 2.2.3

package/build/lib/runtime/plugin_interop.py

@@ -12,6 +12,13 @@ from pathlib import Path
 from typing import cast
 import yaml
 
+from runtime.canonical_surface import (
+    get_all_supported_hosts,
+    get_canonical_hosts,
+    get_compat_hosts,
+    is_canonical_parity_host,
+    is_compat_only_host,
+)
 from runtime.hook_governor import validate_order
 
 
@@ -61,7 +68,7 @@ CONFLICT_SEVERITY_MAP: dict[ConflictCode, ConflictSeverity] = {
     ConflictCode.HOST_PRECEDENCE_OVERLAP: ConflictSeverity.INFO,
 }
 
-SUPPORTED_HOSTS: set[str] = {"claude", "codex", "gemini", "kimi", "opencode"}
+SUPPORTED_HOSTS: set[str] = set(get_all_supported_hosts())
 SECURITY_PRETOOL_PLUGINS: tuple[str, ...] = ("firewall", "secret-guard")
 PRESET_ORDER: tuple[str, ...] = ("safe", "balanced", "interop", "labs", "buffet")
 _PRESET_ORDER_INDEX: dict[str, int] = {name: idx for idx, name in enumerate(PRESET_ORDER)}
@@ -71,6 +78,12 @@ _SEVERITY_RANK: dict[str, int] = {
     ConflictSeverity.INFO.value: 2,
 }
 
+_ISSUE_SEVERITY_MAP: dict[str, str] = {
+    ConflictSeverity.BLOCKER.value: "high",
+    ConflictSeverity.WARNING.value: "medium",
+    ConflictSeverity.INFO.value: "low",
+}
+
 
 @dataclass(slots=True)
 class PluginInteropRecord:
@@ -174,7 +187,12 @@ def validate_plugin_allowlist_entry(payload: Mapping[str, object]) -> None:
     if not isinstance(source, str) or not source:
         raise ValueError("source must be a non-empty string")
     if not isinstance(host, str) or host not in SUPPORTED_HOSTS:
-        raise ValueError(f"host must be one of {sorted(SUPPORTED_HOSTS)}")
+        canonical_hosts = ", ".join(get_canonical_hosts())
+        compat_hosts = ", ".join(get_compat_hosts())
+        raise ValueError(
+            f"host must be one of {sorted(SUPPORTED_HOSTS)} "
+            f"(canonical parity: {canonical_hosts}; compatibility-only: {compat_hosts})"
+        )
     if not isinstance(resource_type, str) or resource_type not in {"mcp_server", "skill", "plugin"}:
         raise ValueError("resource_type must be one of: mcp_server, skill, plugin")
     if not isinstance(reason, str) or not reason.strip():
@@ -404,13 +422,17 @@ def classify_conflicts(records: list[PluginInteropRecord]) -> list[ConflictResul
             )
 
     for record in records:
-        if record.host not in SUPPORTED_HOSTS:
+        normalized_host = record.host.strip().lower()
+        if not (is_canonical_parity_host(normalized_host) or is_compat_only_host(normalized_host)):
+            canonical_hosts = ", ".join(get_canonical_hosts())
+            compat_hosts = ", ".join(get_compat_hosts())
             add_conflict(
                 ConflictCode.UNSUPPORTED_HOST,
                 [record.plugin_id],
                 [record.host],
                 f"Plugin '{record.plugin_id}' targets unsupported host '{record.host}'.",
-                "Use one of the supported hosts: claude, codex, gemini, kimi, opencode.",
+                f"Use one of the supported hosts: canonical parity [{canonical_hosts}] "
+                f"or compatibility-only [{compat_hosts}].",
             )
 
     for record in records:
@@ -461,7 +483,8 @@ def classify_conflicts(records: list[PluginInteropRecord]) -> list[ConflictResul
 
 
 def approval_status_for_record(record: PluginInteropRecord, approvals: list[PluginAllowlistEntry]) -> str:
-    if record.host not in SUPPORTED_HOSTS:
+    normalized_host = record.host.strip().lower()
+    if not (is_canonical_parity_host(normalized_host) or is_compat_only_host(normalized_host)):
         return "blocked"
 
     record_conflicts = classify_conflicts([record])
@@ -482,6 +505,10 @@ def get_approval_status_for_all(
     return {record.plugin_id: approval_status_for_record(record, approvals) for record in records}
 
 
+def conflict_severity_to_issue_severity(severity: str) -> str:
+    return _ISSUE_SEVERITY_MAP.get(str(severity).strip().lower(), "info")
+
+
 def _approval_sources_for_record(record: PluginInteropRecord) -> set[str]:
     source_ids: set[str] = set()
     for server_name in record.mcp_servers:
@@ -995,6 +1022,7 @@ __all__ = [
     "PluginInteropRecord",
     "Source",
     "approval_status_for_record",
+    "conflict_severity_to_issue_severity",
     "classify_conflicts",
     "discover_host_plugin_state",
     "discover_omg_plugin_state",

package/build/lib/runtime/preflight.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import importlib
+from runtime.canonical_surface import DOMAIN_DEFAULTS, RELEASE_SURFACE_LABELS
 from runtime.delta_classifier import classify_project_changes
 from runtime.tracebank import record_trace
 from typing import Any
@@ -36,33 +37,36 @@ _HIGH_RISK_DELTA_TOKENS = (
     "configs",
 )
 
+_ROUTES = RELEASE_SURFACE_LABELS["routes"]
+_PREFLIGHT_DOMAIN_PACKS = set(DOMAIN_DEFAULTS["preflight_domain_packs"])
+
 
 def run_preflight(project_dir: str, *, goal: str) -> dict[str, Any]:
     lowered = goal.lower()
     task_class = "implementation"
     risk_class = "medium"
-    route = "teams"
+    route = _ROUTES["teams"]
     delta = classify_project_changes(project_dir, goal=goal)
     categories = set(delta["categories"])
     requires_security_check = _requires_security_check(delta)
-    domain_packs = [category for category in delta["categories"] if category in {"robotics", "vision", "algorithms", "health"}]
+    domain_packs = [category for category in delta["categories"] if category in _PREFLIGHT_DOMAIN_PACKS]
     evidence_requirements = _requirements_for_profile(delta.get("evidence_profile"))
 
     if requires_security_check:
         task_class = "security"
         risk_class = "high"
-        route = "security-check"
+        route = _ROUTES["security_check"]
     elif categories & {"api"} or any(token in lowered for token in ("openapi", "swagger", "postman", "contract", "fixture", "replay")):
         task_class = "contract"
-        route = "api-twin"
+        route = _ROUTES["api_twin"]
     elif any(token in lowered for token in ("auth", "secret", "security", "token", "injection")):
         task_class = "security"
         risk_class = "high"
-        route = "security-check"
+        route = _ROUTES["security_check"]
     elif any(token in lowered for token in ("full stack", "frontend and backend", "dashboard", "orchestrate")):
         task_class = "orchestration"
         risk_class = "high"
-        route = "crazy"
+        route = _ROUTES["crazy"]
 
     trace = record_trace(
         project_dir,
@@ -82,7 +86,7 @@ def run_preflight(project_dir: str, *, goal: str) -> dict[str, Any]:
         "route": route,
         "requires_security_check": requires_security_check,
         "required_tools": _required_tools(route),
-        "required_mcps": ["omg-control"] if route in {"security-check", "api-twin", "crazy"} else [],
+        "required_mcps": ["omg-control"] if route in {_ROUTES["security_check"], _ROUTES["api_twin"], _ROUTES["crazy"]} else [],
         "missing_constraints": [],
         "evidence_plan": _evidence_plan(route),
         "evidence_requirements": evidence_requirements,
@@ -117,15 +121,15 @@ def _requirements_for_profile(evidence_profile: str | None) -> list[str]:
 
 def _required_tools(route: str) -> list[str]:
     return {
-        "security-check": ["security"],
-        "api-twin": ["api-twin"],
-        "crazy": ["teams", "ccg"],
-    }.get(route, ["teams"])
+        _ROUTES["security_check"]: ["security"],
+        _ROUTES["api_twin"]: ["api-twin"],
+        _ROUTES["crazy"]: ["teams", "ccg"],
+    }.get(route, [_ROUTES["teams"]])
 
 
 def _evidence_plan(route: str) -> list[str]:
     return {
-        "security-check": ["security findings", "provenance"],
-        "api-twin": ["fixture fidelity", "live verification"],
-        "crazy": ["verification output", "evidence pack"],
+        _ROUTES["security_check"]: ["security findings", "provenance"],
+        _ROUTES["api_twin"]: ["fixture fidelity", "live verification"],
+        _ROUTES["crazy"]: ["verification output", "evidence pack"],
     }.get(route, ["verification output"])

package/build/lib/runtime/proof_chain.py

@@ -327,7 +327,7 @@ def assemble_proof_chain(project_dir: str, *, evidence_path: str | None = None)
         evidence_links = [selected_path] if selected_path else []
         publish_verification_state(
             project_dir=project_dir,
-            run_id=str(chain.get("eval_id", "")),
+            run_id=str(chain.get("run_id", "")),
             status=str(validation["status"]),
             blockers=list(validation.get("blockers", [])),
             evidence_links=evidence_links,

package/build/lib/runtime/proof_gate.py

@@ -10,6 +10,7 @@ from runtime.evidence_requirements import FULL_REQUIREMENTS, requirements_for_pr
 
 
 _REQUIRED_ARTIFACT_FIELDS = ("kind", "path", "sha256", "parser", "summary", "trace_id")
+_PRODUCTION_REQUIRED_PRIMITIVES = ("claim_judge", "proof_gate", "test_intent_lock")
 
 _REQUIRED_ARTIFACT_TOKENS: dict[str, tuple[str, ...]] = {
     "junit": ("junit", "junit.xml", "surefire"),
@@ -19,6 +20,67 @@ _REQUIRED_ARTIFACT_TOKENS: dict[str, tuple[str, ...]] = {
 }
 
 
+def required_production_primitives() -> tuple[str, ...]:
+    return _PRODUCTION_REQUIRED_PRIMITIVES
+
+
+def production_gate(evidence: dict[str, Any]) -> dict[str, Any]:
+    payload = _as_dict(evidence)
+    blockers: list[str] = []
+
+    primitive_payload = _as_dict(payload.get("claim_judge"))
+    if not primitive_payload:
+        blockers.append("production_gate_missing_claim_judge")
+    else:
+        status = str(primitive_payload.get("status", "")).strip().lower()
+        verdict = str(primitive_payload.get("claim_judge_verdict", primitive_payload.get("verdict", ""))).strip().lower()
+        if status in {"blocked", "error", "fail", "insufficient"} or verdict in {"blocked", "error", "fail", "insufficient"}:
+            blockers.append("production_gate_claim_judge_blocked")
+
+    proof_result = _as_dict(payload.get("proof_gate"))
+    if not proof_result:
+        try:
+            proof_result = evaluate_proof_gate(payload)
+        except Exception:
+            proof_result = {"verdict": "fail", "blockers": ["proof_gate_internal_error"]}
+
+    if not proof_result:
+        blockers.append("production_gate_missing_proof_gate")
+    else:
+        proof_verdict = str(proof_result.get("verdict", "")).strip().lower()
+        if proof_verdict != "pass":
+            proof_blockers = proof_result.get("blockers")
+            if isinstance(proof_blockers, list) and proof_blockers:
+                blockers.extend(
+                    f"production_gate_proof_gate:{str(item).strip()}"
+                    for item in proof_blockers
+                    if str(item).strip()
+                )
+            else:
+                blockers.append("production_gate_proof_gate_failed")
+
+    lock_payload = _as_dict(payload.get("test_intent_lock"))
+    if not lock_payload:
+        blockers.append("production_gate_missing_test_intent_lock")
+    else:
+        lock_status = str(lock_payload.get("status", "")).strip().lower()
+        lock_id = str(lock_payload.get("lock_id", "")).strip()
+        if lock_status in {"blocked", "error", "fail", "insufficient"} or (lock_status not in {"ok", "allowed"} and not lock_id):
+            blockers.append("production_gate_test_intent_lock_unsatisfied")
+
+    unique_blockers = list(dict.fromkeys(item for item in blockers if str(item).strip()))
+    if unique_blockers:
+        return {
+            "status": "blocked",
+            "blockers": unique_blockers,
+            "required_primitives": list(_PRODUCTION_REQUIRED_PRIMITIVES),
+        }
+    return {
+        "status": "ok",
+        "required_primitives": list(_PRODUCTION_REQUIRED_PRIMITIVES),
+    }
+
+
 def evaluate_proof_gate(input: dict[str, Any]) -> dict[str, Any]:
     claims = _as_claims(input.get("claims"))
     proof_chain = _as_dict(input.get("proof_chain"))

package/build/lib/runtime/providers/codex_provider.py

@@ -11,12 +11,24 @@ import uuid
 from typing import Any
 
 from runtime.cli_provider import CLIProvider, register_provider
+from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_codex_mcp_config
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
 
 
+def _attach_normalized_output(payload: dict[str, Any], *, prompt: str, project_dir: str) -> dict[str, Any]:
+    normalized = normalize_output(
+        "codex",
+        payload,
+        context={"prompt": prompt, "project_dir": project_dir},
+    )
+    merged = dict(payload)
+    merged["normalized_output"] = normalized
+    return merged
+
+
 class CodexProvider(CLIProvider):
     """CLIProvider implementation for the Codex CLI (``codex``)."""
 
@@ -55,11 +67,11 @@ class CodexProvider(CLIProvider):
                 cwd=project_dir,
                 env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "codex-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "codex-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -85,7 +97,11 @@ class CodexProvider(CLIProvider):
                 timeout=timeout,
             )
             mgr.kill_session(session)
-            return {"model": "codex-cli", "output": output, "exit_code": 0}
+            return _attach_normalized_output(
+                {"model": "codex-cli", "output": output, "exit_code": 0},
+                prompt=prompt,
+                project_dir=project_dir,
+            )
         except Exception as exc:
             _logger.warning("tmux codex invocation failed, falling back to subprocess: %s", exc)
             return self.invoke(prompt, project_dir, timeout=timeout)

package/build/lib/runtime/providers/gemini_provider.py

@@ -11,11 +11,23 @@ import uuid
 from typing import Any
 
 from runtime.cli_provider import CLIProvider, register_provider
+from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_gemini_mcp_config
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
 
+
+def _attach_normalized_output(payload: dict[str, Any], *, prompt: str, project_dir: str) -> dict[str, Any]:
+    normalized = normalize_output(
+        "gemini",
+        payload,
+        context={"prompt": prompt, "project_dir": project_dir, "no_json_mode": True},
+    )
+    merged = dict(payload)
+    merged["normalized_output"] = normalized
+    return merged
+
 HOST_RULES = {
     "compilation_targets": [".gemini/settings.json"],
     "mcp": ["omg-control"],
@@ -65,11 +77,11 @@ class GeminiProvider(CLIProvider):
                 cwd=project_dir,
                 env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "gemini-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "gemini-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -95,7 +107,11 @@ class GeminiProvider(CLIProvider):
                 timeout=timeout,
             )
             mgr.kill_session(session)
-            return {"model": "gemini-cli", "output": output, "exit_code": 0}
+            return _attach_normalized_output(
+                {"model": "gemini-cli", "output": output, "exit_code": 0},
+                prompt=prompt,
+                project_dir=project_dir,
+            )
         except Exception as exc:
             _logger.warning("tmux gemini invocation failed, falling back to subprocess: %s", exc)
             return self.invoke(prompt, project_dir, timeout=timeout)

package/build/lib/runtime/providers/kimi_provider.py

@@ -11,11 +11,23 @@ import uuid
 from typing import Any
 
 from runtime.cli_provider import CLIProvider, register_provider
+from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_kimi_mcp_config
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
 
+
+def _attach_normalized_output(payload: dict[str, Any], *, prompt: str, project_dir: str) -> dict[str, Any]:
+    normalized = normalize_output(
+        "kimi",
+        payload,
+        context={"prompt": prompt, "project_dir": project_dir},
+    )
+    merged = dict(payload)
+    merged["normalized_output"] = normalized
+    return merged
+
 HOST_RULES = {
     "compilation_targets": [".kimi/mcp.json"],
     "mcp": ["omg-control"],
@@ -69,11 +81,11 @@ class KimiCodeProvider(CLIProvider):
                 cwd=project_dir,
                 env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "kimi-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "kimi-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -90,11 +102,11 @@ class KimiCodeProvider(CLIProvider):
                 cwd=project_dir,
                 env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "kimi-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "kimi-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -120,7 +132,11 @@ class KimiCodeProvider(CLIProvider):
                 timeout=timeout,
             )
             mgr.kill_session(session)
-            return {"model": "kimi-cli", "output": output, "exit_code": 0}
+            return _attach_normalized_output(
+                {"model": "kimi-cli", "output": output, "exit_code": 0},
+                prompt=prompt,
+                project_dir=project_dir,
+            )
         except Exception as exc:
             _logger.warning("tmux kimi invocation failed, falling back to subprocess: %s", exc)
             return self.invoke(prompt, project_dir, timeout=timeout)

package/build/lib/runtime/release_run_coordinator.py

@@ -16,6 +16,9 @@ from runtime.runtime_contracts import write_run_state
 from runtime.session_health import compute_session_health
 from runtime.verification_controller import VerificationController
 from runtime.claim_judge import evaluate_claims_for_release
+from runtime.exec_kernel import get_exec_kernel
+from runtime.worker_watchdog import get_worker_watchdog
+from runtime.merge_writer import get_merge_writer, create_write_lease, is_lease_valid, WriteLease
 
 
 class RunIdConflictError(ValueError):
@@ -29,15 +32,20 @@ class ResolvedRunId:
     reason: str
 
 
+_DEFAULT_LEASE_DURATION_S = 3600.0  # 1 hour default lease
+
+
 class ReleaseRunCoordinator:
     project_dir: str
     _verification: VerificationController
     _journal: InteractionJournal
+    _active_lease: WriteLease | None
 
     def __init__(self, project_dir: str):
         self.project_dir = str(Path(project_dir).resolve())
         self._verification = VerificationController(self.project_dir)
         self._journal = InteractionJournal(self.project_dir)
+        self._active_lease = None
 
     def begin(self, cli_run_id: str | None = None, release_evidence: dict[str, object] | None = None) -> dict[str, object]:
         resolved = self.resolve_run_id(cli_run_id=cli_run_id, release_evidence=release_evidence)
@@ -57,12 +65,45 @@ class ReleaseRunCoordinator:
                 "verification_status": verification_state.get("status", "running"),
             },
         )
-        return {
+        get_exec_kernel(self.project_dir).register_run(
+            run_id,
+            source="release_run_coordinator.begin",
+            reason=f"{resolved.source}:{resolved.reason}",
+        )
+        try:
+            get_worker_watchdog(self.project_dir).record_heartbeat(
+                run_id, status="alive",
+                metadata={"phase": "begin", "source": resolved.source},
+            )
+        except Exception:
+            pass
+        merge_writer_token = None
+        try:
+            mw = get_merge_writer(self.project_dir)
+            token = mw.acquire(run_id, reason=f"release_run:{resolved.source}")
+            merge_writer_token = token.lock_path
+        except Exception:
+            pass
+        # Create a run-scoped write lease bound to this release run
+        evidence_path = str(
+            Path(".omg") / "evidence" / f"merge-writer-{run_id}.json"
+        )
+        self._active_lease = create_write_lease(
+            run_id=run_id,
+            duration_s=_DEFAULT_LEASE_DURATION_S,
+            evidence_path=evidence_path,
+        )
+        result: dict[str, object] = {
             "status": "running",
             "run_id": run_id,
             "resolution_source": resolved.source,
             "resolution_reason": resolved.reason,
         }
+        if merge_writer_token:
+            result["merge_writer_lock"] = merge_writer_token
+        if self._active_lease:
+            result["write_lease_evidence"] = self._active_lease.evidence_path
+        return result
 
     def mutate(
         self,
@@ -107,6 +148,11 @@ class ReleaseRunCoordinator:
                 "health_action": str(health.get("recommended_action", "continue")),
             },
         )
+        get_exec_kernel(self.project_dir).register_run(
+            canonical_run_id,
+            source="release_run_coordinator.mutate",
+            reason=f"tool={tool}",
+        )
         return {
             "status": "running",
             "run_id": canonical_run_id,
@@ -133,6 +179,28 @@ class ReleaseRunCoordinator:
                 "health_action": str(health.get("recommended_action", "continue")),
             },
         )
+        get_exec_kernel(self.project_dir).register_run(
+            canonical_run_id,
+            source="release_run_coordinator.verify",
+            reason="verification_phase",
+        )
+        try:
+            watchdog = get_worker_watchdog(self.project_dir)
+            watchdog.record_heartbeat(
+                canonical_run_id, status="alive",
+                metadata={"phase": "verify"},
+            )
+            stall = watchdog.escalate_stall(canonical_run_id)
+            if stall:
+                from runtime.incident_replay import build_worker_lifecycle_pack
+                build_worker_lifecycle_pack(
+                    self.project_dir,
+                    run_id=canonical_run_id,
+                    event="stall_detected_during_verify",
+                    heartbeat=stall.get("heartbeat"),
+                )
+        except Exception:
+            pass
         return {
             "status": str(verification_state.get("status", "running")),
             "run_id": canonical_run_id,
@@ -235,6 +303,29 @@ class ReleaseRunCoordinator:
                 "evidence_links": list(evidence_links),
             },
         )
+        get_exec_kernel(self.project_dir).register_run(
+            canonical_run_id,
+            source="release_run_coordinator.finalize",
+            reason=f"status={resolved_status}",
+        )
+        try:
+            mw = get_merge_writer(self.project_dir)
+            if mw.check_authorization(canonical_run_id):
+                from runtime.merge_writer import MergeWriterToken
+                lock_data = mw._lock_path().read_text(encoding="utf-8")
+                import json as _json
+                lock_info = _json.loads(lock_data)
+                token = MergeWriterToken(
+                    run_id=canonical_run_id,
+                    acquired_at=str(lock_info.get("acquired_at", "")),
+                    lock_path=str(mw._lock_path().relative_to(mw.project_dir)).replace("\\", "/"),
+                    provenance_path=str(mw._provenance_path(canonical_run_id).relative_to(mw.project_dir)).replace("\\", "/"),
+                )
+                mw.release(token)
+        except Exception:
+            pass
+        # Invalidate the write lease — leases do not survive across runs
+        self._active_lease = None
         return {
             "status": str(verification_state.get("status", resolved_status)),
             "run_id": canonical_run_id,
@@ -244,6 +335,20 @@ class ReleaseRunCoordinator:
             "rollback_path": rollback_path,
         }
 
+    def check_write_lease(self, run_id: str) -> dict[str, object]:
+        """Check write-lease validity for *run_id*.
+
+        Returns a dict with ``valid`` (bool), ``reason`` (str), and
+        optionally ``evidence_path``.
+        """
+        if self._active_lease is None:
+            return {"valid": False, "reason": "no_active_write_lease"}
+        valid, reason = is_lease_valid(self._active_lease, run_id)
+        result: dict[str, object] = {"valid": valid, "reason": reason}
+        if valid:
+            result["evidence_path"] = self._active_lease.evidence_path
+        return result
+
     def resolve_run_id(
         self,
         *,
@@ -389,6 +494,15 @@ def resolve_current_run_id(project_dir: str | None = None, cli_run_id: str | Non
     return resolved.run_id or None
 
 
+def get_active_coordinator_run_id(project_dir: str | None = None) -> str | None:
+    root = _project_dir(project_dir)
+    shadow = _read_shadow_run_id(str(root))
+    if shadow:
+        return shadow
+    active = _read_active_coordinator_run(str(root))
+    return active or None
+
+
 def _project_dir(project_dir: str | None = None) -> Path:
     if project_dir:
         return Path(project_dir)