@trac3er/oh-my-god 2.1.9 → 2.2.3

package/docs/install/github-app.md

@@ -0,0 +1,80 @@
+# GitHub App Setup
+
+The PR Reviewer Bot uses a GitHub App to securely interact with your repositories. This method is preferred over personal access tokens as it provides fine-grained permissions and short-lived installation tokens.
+
+## Setup
+
+### 1. Create the GitHub App
+1. Navigate to **Settings** -> **Developer settings** -> **GitHub Apps** -> **New GitHub App**.
+2. **GitHub App name**: Choose a unique name (e.g., `OMG-Reviewer-Bot`).
+3. **Homepage URL**: Use your repository URL.
+4. **Webhook**: Uncheck **Active** unless you are using a custom webhook listener.
+5. **Permissions**: Grant the following minimum repository permissions:
+   - **Pull requests**: Read & write (to post reviews and comments)
+   - **Checks**: Read & write (to create check runs)
+   - **Contents**: Read-only (to analyze code)
+6. **Where can this GitHub App be installed?**: Select **Only on this account** or **Any account** based on your needs.
+7. Click **Create GitHub App**.
+
+### 2. Generate Private Key and Installation ID
+1. After creation, scroll down to the **Private keys** section and click **Generate a private key**. A `.pem` file will download.
+2. Note the **App ID** displayed at the top of the app settings page.
+3. Navigate to **Install App** in the sidebar and install it on your target repository or organization.
+4. After installation, the URL will look like `https://github.com/settings/installations/12345678`. The number at the end is your `GITHUB_INSTALLATION_ID`.
+
+### 3. Configure Environment Variables
+The bot requires three configuration variables.
+
+| Variable | Type | Description |
+| :--- | :--- | :--- |
+| `GITHUB_APP_ID` | Config Variable | The App ID from your GitHub App settings. |
+| `GITHUB_APP_PRIVATE_KEY` | Secret | The full content of the downloaded `.pem` file. |
+| `GITHUB_INSTALLATION_ID` | Config Variable | The ID from the installation URL. |
+
+#### Local Development
+Store the private key in a file and load it:
+```bash
+export GITHUB_APP_ID="123456"
+export GITHUB_INSTALLATION_ID="78901234"
+export GITHUB_APP_PRIVATE_KEY="$(cat path/to/your-app.private-key.pem)"
+```
+
+#### GitHub Actions
+Add the App ID and Installation ID as **Variables** and the Private Key as a **Secret**:
+```yaml
+env:
+  GITHUB_APP_ID: ${{ vars.GITHUB_APP_ID }}
+  GITHUB_INSTALLATION_ID: ${{ vars.GITHUB_INSTALLATION_ID }}
+  GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+```
+
+## Security Hardening
+
+### Secret Management
+- **GITHUB_APP_ID**: This is non-sensitive. Store it as a repository or organization configuration variable.
+- **GITHUB_APP_PRIVATE_KEY**: This is highly sensitive. Store it as an encrypted secret. Never commit this key to version control.
+- **Rotation**: Regularly rotate your private keys in the GitHub App settings and delete old, unused keys.
+
+### Execution Safety
+- **Untrusted PRs**: Never expose `GITHUB_APP_PRIVATE_KEY` to `pull_request` event jobs that check out untrusted code. Secrets are unavailable to forks by default, but you must ensure your workflow does not manually bypass this.
+- **Workflow Triggers**: Avoid using `pull_request_target` with an explicit checkout of the PR head if you are using app secrets. This combination can allow malicious PRs to exfiltrate your secrets.
+- **Token Expiry**: The bot caches installation access tokens in memory for the duration of their 1-hour TTL and regenerates automatically when they expire. Do not persist tokens to disk or share them across processes.
+
+## Verify
+
+Confirm your setup with this checklist:
+- [ ] **Token Generation**: Run the bot locally or in a test workflow. It should successfully exchange the JWT for an installation token.
+- [ ] **Review Posting**: Create a test PR. The bot should post a review or comment.
+- [ ] **Stale Review Dismissal**: Push a new commit to the test PR. The bot should dismiss or update its prior approval.
+- [ ] **Permissions**: Verify the bot can only access the repositories it was explicitly installed on.
+
+## Troubleshooting
+
+| Error Code | Cause | Resolution |
+| :--- | :--- | :--- |
+| `GITHUB_CREDENTIALS_MISSING` | One or more env vars are empty. | Check that `GITHUB_APP_ID`, `GITHUB_APP_PRIVATE_KEY`, and `GITHUB_INSTALLATION_ID` are set. |
+| `GITHUB_APP_PRIVATE_KEY_INVALID` | The PEM key is malformed or not RSA. | Ensure the secret contains the full `-----BEGIN RSA PRIVATE KEY-----` block and no extra whitespace. |
+| `GITHUB_JWT_SIGNING_FAILED` | Cryptography error during signing. | Verify your environment has the required dependencies installed. |
+| `GITHUB_TOKEN_REQUEST_FAILED` | Network error or GitHub API downtime. | Check your internet connection and GitHub Status. |
+| `GITHUB_TOKEN_REQUEST_REJECTED` | 403/404 error from GitHub. | Verify the `GITHUB_INSTALLATION_ID` is correct and the app is installed on the repo. |
+| `GITHUB_TOKEN_RESPONSE_INVALID` | Unexpected response from GitHub. | Check if GitHub API versions have changed or if there is a proxy interference. |

package/docs/install/opencode.md

@@ -27,4 +27,4 @@ cd OMG
 ## Notes
 
 - OpenCode consumes OMG through compatibility-host MCP registration
-- canonical v1 contract hosts remain Claude Code and Codex
+- canonical v2.1.9 behavior-parity hosts are Claude Code, Codex, Gemini CLI, and Kimi CLI

package/docs/proof.md

@@ -17,12 +17,33 @@ OMG keeps verification visible instead of burying it in implementation details.
   - `test-intent-lock`: `.omg/evidence/test-intent-lock-*.json` (verifies test-to-intent alignment)
   - `proof-gate`: `.omg/evidence/proof-gate-*.json` (verifies final release readiness)
 - Release execution primitives required by `omg release readiness`:
+  - canonical evidence profile registry: `runtime.evidence_requirements.EVIDENCE_REQUIREMENTS_BY_PROFILE` (release-facing labels derive from this map)
   - run coordinator state: `.omg/state/release_run_coordinator/<run_id>.json`
   - TDD lock evidence: `.omg/state/test-intent-lock/*.json`
   - rollback manifest: `.omg/state/rollback_manifest/*.json`
   - session health: `.omg/state/session_health/<run_id>.json`
   - council verdicts: `.omg/state/council_verdicts/<run_id>.json`
   - Forge starter proof (`proof_backed: true`): `.omg/evidence/forge-specialists-*.json`
+  - exec kernel state: `.omg/state/exec-kernel/<run_id>.json`
+  - worker watchdog replay: `.omg/evidence/subagents/<run_id>-replay.json`
+  - merge writer provenance: `.omg/evidence/merge-writer-<run_id>.json`
+  - tool fabric ledger: `.omg/state/ledger/tool-ledger.jsonl`
+  - budget envelope state: `.omg/state/budget-envelopes/<run_id>.json`
+  - issue report: `.omg/evidence/issues/<run_id>.json`
+  - host parity report: `.omg/evidence/host-parity-<run_id>.json`
+  - music OMR testbed evidence: `.omg/evidence/music-omr-<run_id>.json`
+
+## Permanent Music OMR Daily Gate
+
+Music OMR is the permanent daily release gate artifact. Release readiness requires a fresh Music OMR evidence file tied to the active run id.
+
+- Gate cadence: daily scheduled run via `.github/workflows/omg-release-readiness.yml`
+- Run scope: `run_id` must match the active release evidence pack run
+- Freshness metadata: `freshness.generated_at`, `freshness.max_age_seconds`, `freshness.expires_at`, `freshness.is_fresh`
+- Fixture inventory: `fixture_inventory` must include deterministic fixture ids (for this gate: `simple_c_major.json`, `simple_g_major.json`, `chromatic_fragment.json`, `waltz_three_four.json`, `transposition_pressure_fixture.json`); minimum 5 fixtures required (`fixture_inventory_valid` must be `true`)
+- Trace metadata: `trace.trace_id`, `trace.gate=music-omr-daily`, `trace.run_scope=release-run`, `trace_metadata.testbed`, `trace_metadata.fixture_count`, `trace_metadata.run_id_linkage`
+- Freshness threshold: `freshness_threshold_secs`, `freshness.freshness_threshold_secs`
+- Run linkage: `run_id` must match the active release run, `trace_metadata.run_id_linkage` must equal `run_id`
 
 ## Forge v0.3 Evidence
 
@@ -51,9 +72,9 @@ Forge v0.3 introduces richer evidence artifacts for domain-specific training and
 |----------|------|--------|------------|------------|---------------|
 | Claude Code | Canonical | host-native | host-native | yes | primary |
 | Codex | Canonical | yes | yes | yes | primary |
-| OpenCode | Compatibility | yes | yes | yes | supported |
-| Gemini | Compatibility | yes | yes | yes | supported |
-| Kimi | Compatibility | yes | yes | yes | supported |
+| Gemini | Canonical | yes | yes | yes | primary |
+| Kimi | Canonical | yes | yes | yes | primary |
+| OpenCode | Compatibility-only | yes | yes | yes | supported |
 
 ## Adoption Evidence
 

package/docs/release-checklist.md

@@ -18,11 +18,12 @@ Use this checklist before making OMG public or cutting a release tag.
 
 - [ ] `python3 scripts/sync-release-identity.py --check` — authored surfaces in sync
 - [ ] `python3 scripts/validate-release-identity.py --scope all --forbid-version <previous-version>` — full identity validation
-- `python3 scripts/omg.py diagnose-plugins --format json` exits 0
-- `python3 scripts/omg.py contract validate` passes
-- `python3 scripts/omg.py validate --format json` includes `plugin_compatibility` check
-- `python3 scripts/omg.py contract compile --host claude --host codex --channel public --output-root <tmp>` passes
-- `python3 scripts/omg.py contract compile --host claude --host codex --channel enterprise --output-root <tmp>` passes
+- [ ] `python3 scripts/omg.py contract validate` passes
+- [ ] `python3 scripts/omg.py compat gate --max-bridge 0 --output artifacts/omg-compat-gap.json` passes
+- [ ] `python3 scripts/omg.py release readiness --channel dual --output-root artifacts/release` returns `status=ok`
+- [ ] `python3 scripts/omg.py validate --format json` includes `plugin_compatibility` check
+- `python3 scripts/omg.py contract compile --host claude --host codex --host gemini --host kimi --channel public --output-root <tmp>` passes
+- `python3 scripts/omg.py contract compile --host claude --host codex --host gemini --host kimi --channel enterprise --output-root <tmp>` passes
 - `python3 scripts/omg.py release readiness --channel dual --output-root <tmp>` passes
 
 ## Forge v0.3

package/hooks/_common.py

@@ -107,7 +107,7 @@ def deny_decision(reason):
     }, sys.stdout)
 
 
-def block_decision(reason):
+def block_decision(reason, *, block_reason="unknown", project_dir=None):
     """Emit a Stop hook block decision to stdout.
 
     Also records the block for loop detection. Every stop hook that calls
@@ -117,7 +117,7 @@ def block_decision(reason):
     # Record block BEFORE emitting -- ensures tracker is updated even if
     # the process is killed after emitting the decision.
     try:
-        record_stop_block()
+        record_stop_block(project_dir=project_dir, reason=block_reason)
     except Exception:
         pass  # never let tracker failure prevent the block decision
     json.dump({"decision": "block", "reason": reason}, sys.stdout)
@@ -505,17 +505,24 @@ def should_skip_stop_hooks(data):
             if os.path.exists(_tracker_path):
                 with open(_tracker_path, "r", encoding="utf-8") as _f:
                     _state = json.load(_f)
-                _elapsed = (datetime.now(timezone.utc) - datetime.fromisoformat(_state["ts"])).total_seconds()
-                if _elapsed < _BLOCK_LOOP_WINDOW_SECS and _state.get("count", 0) >= 1:
-                    _reason = _state.get("reason", "unknown")
-                    if _reason in _LOOP_BLOCK_REASONS:
-                        print(
-                            "[OMG] Guard 5 triggered: context may be exhausted and stop hooks recently blocked. "
-                            "Skipping stop-hook blocks so compaction can run. "
-                            "Tip: /OMG:handoff then continue in a fresh session.",
-                            file=sys.stderr,
-                        )
-                        return True
+                # Session isolation: stale tracker from another session cannot suppress hooks
+                _tracker_session = _state.get("session_id", "")
+                _current_session = _get_session_id()
+                if (_tracker_session and _current_session != "unknown"
+                        and _tracker_session != _current_session):
+                    pass  # Different session — not a deadlock
+                else:
+                    _elapsed = (datetime.now(timezone.utc) - datetime.fromisoformat(_state["ts"])).total_seconds()
+                    if _elapsed < _BLOCK_LOOP_WINDOW_SECS and _state.get("count", 0) >= 1:
+                        _reason = _state.get("reason", "unknown")
+                        if _reason in _LOOP_BLOCK_REASONS:
+                            print(
+                                "[OMG] Guard 5 triggered: context may be exhausted and stop hooks recently blocked. "
+                                "Skipping stop-hook blocks so compaction can run. "
+                                "Tip: /OMG:handoff then continue in a fresh session.",
+                                file=sys.stderr,
+                            )
+                            return True
         except Exception:
             pass  # fail open
     return False
@@ -523,6 +530,16 @@ def should_skip_stop_hooks(data):
 
 # --- Stop-Block Loop Breaker (file-based safety net) ---
 
+
+def _get_session_id():
+    """Get current session ID from environment, falling back to 'unknown'."""
+    for key in ("CLAUDE_SESSION_ID", "SESSION_ID", "OMG_SESSION_ID"):
+        val = os.environ.get(key, "").strip()
+        if val:
+            return val
+    return "unknown"
+
+
 def record_stop_block(project_dir=None, reason: str = "unknown", session_id: str = ""):
     """Record that a stop hook block was issued. Called before block_decision().
     
@@ -532,6 +549,8 @@ def record_stop_block(project_dir=None, reason: str = "unknown", session_id: str
         session_id: Session identifier to prevent cross-session interference
     """
     try:
+        if not session_id:
+            session_id = _get_session_id()
         pdir = project_dir or get_project_dir()
         path = os.path.join(pdir, _STOP_BLOCK_TRACKER)
         state = {
@@ -573,6 +592,8 @@ def is_stop_block_loop(project_dir=None, session_id: str = ""):
                    returns False (cross-session, not a loop).
     """
     try:
+        if not session_id:
+            session_id = _get_session_id()
         pdir = project_dir or get_project_dir()
         path = os.path.join(pdir, _STOP_BLOCK_TRACKER)
         if not os.path.exists(path):

package/hooks/_token_counter.py

@@ -145,7 +145,7 @@ def _get_anthropic_api_key() -> str | None:
         key = store_mod.get_active_key("anthropic")
         if key:
             return key
-    except Exception:
+    except (ImportError, RuntimeError, ValueError, OSError, AttributeError):
         pass
     return os.environ.get("ANTHROPIC_API_KEY")
 

package/hooks/branch_manager.py

@@ -164,8 +164,25 @@ def _extract_task_description(project_dir: str) -> str | None:
     return None
 
 
+def _is_merge_writer_locked(project_dir: str) -> bool:
+    try:
+        _root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+        if _root not in sys.path:
+            sys.path.insert(0, _root)
+        from runtime.merge_writer import MergeWriter  # pyright: ignore[reportMissingImports]
+        return MergeWriter(project_dir).is_locked()
+    except Exception:
+        return False
+
+
 def _create_branch(project_dir: str, branch_name: str) -> bool:
     """Create and checkout a new branch. Returns True on success."""
+    if _is_merge_writer_locked(project_dir):
+        print(
+            f"[OMG branch-manager] Branch creation blocked: merge-writer lock is held",
+            file=sys.stderr,
+        )
+        return False
     try:
         result = subprocess.run(
             ["git", "-C", project_dir, "checkout", "-b", branch_name],

package/hooks/budget_governor.py

@@ -189,6 +189,27 @@ def _check_thresholds(
     return new_messages
 
 
+def _check_budget_envelope(project_dir: str) -> str:
+    run_id = os.environ.get("OMG_RUN_ID", "").strip()
+    if not run_id:
+        return ""
+    try:
+        parent = os.path.dirname(HOOKS_DIR)
+        if parent not in sys.path:
+            sys.path.insert(0, parent)
+        from runtime.budget_envelopes import get_budget_envelope_manager
+
+        mgr = get_budget_envelope_manager(project_dir)
+        result = mgr.check_envelope(run_id)
+        if result.status == "ok":
+            return ""
+        action_tag = {"warn": "@envelope-warning", "reflect": "@envelope-critical", "block": "@envelope-limit"}
+        tag = action_tag.get(result.governance_action, "@envelope-warning")
+        return f"{tag}: {result.reason} [action={result.governance_action}]"
+    except Exception:
+        return ""
+
+
 def main() -> None:
     setup_crash_handler("budget-governor", fail_closed=False)
 
@@ -224,6 +245,10 @@ def main() -> None:
     if threshold_alerts:
         context += "\n" + "\n".join(threshold_alerts)
 
+    envelope_context = _check_budget_envelope(project_dir)
+    if envelope_context:
+        context += "\n" + envelope_context
+
     json.dump({"additionalContext": context}, sys.stdout)
     sys.exit(0)
 

package/hooks/context_pressure.py

@@ -5,23 +5,65 @@ import json
 import os
 from datetime import datetime, timezone
 
-_DEFAULT_THRESHOLD = 150
+try:
+    from runtime.context_limits import get_model_limits, compaction_trigger
+except Exception:
+    get_model_limits = None
+    compaction_trigger = None
 
 
-def estimate_context_pressure(project_dir):
-    threshold = _DEFAULT_THRESHOLD
+def _detect_model_id(context_packet=None):
+    if isinstance(context_packet, dict):
+        model = context_packet.get("model")
+        if isinstance(model, dict):
+            for key in ("id", "display_name", "name"):
+                value = str(model.get(key, "") or "").strip()
+                if value:
+                    return value
+        elif isinstance(model, str) and model.strip():
+            return model.strip()
+
+        context = context_packet.get("context")
+        if isinstance(context, dict):
+            nested_model = context.get("model")
+            if isinstance(nested_model, dict):
+                for key in ("id", "display_name", "name"):
+                    value = str(nested_model.get(key, "") or "").strip()
+                    if value:
+                        return value
+            elif isinstance(nested_model, str) and nested_model.strip():
+                return nested_model.strip()
+
+    for key in ("CLAUDE_MODEL", "OMG_MODEL_ID", "OPENAI_MODEL"):
+        value = os.environ.get(key, "").strip()
+        if value:
+            return value
+    return ""
+
+
+def _host_aware_threshold(context_packet=None):
+    model_id = _detect_model_id(context_packet)
+    if compaction_trigger is not None and get_model_limits is not None:
+        return int(compaction_trigger(model_id)), model_id, get_model_limits(model_id)
+    return 80_000, model_id, {"class_label": "128k-class"}
+
+
+def estimate_context_pressure(project_dir, context_packet=None):
+    threshold_tokens, model_id, limits = _host_aware_threshold(context_packet)
     try:
         settings_path = os.path.join(project_dir, "settings.json")
         if os.path.exists(settings_path):
             with open(settings_path, "r", encoding="utf-8") as settings_file:
                 settings = json.load(settings_file)
-            threshold = settings.get("_omg", {}).get("context_budget", {}).get(
-                "pressure_threshold", _DEFAULT_THRESHOLD
+            configured = settings.get("_omg", {}).get("context_budget", {}).get(
+                "pressure_threshold", threshold_tokens
             )
+            threshold_tokens = int(configured)
     except Exception:
         pass
 
     tool_count = 0
+    estimated_tokens = 0
     ledger_path = os.path.join(project_dir, ".omg", "state", "ledger", "tool-ledger.jsonl")
     if os.path.exists(ledger_path):
         try:
@@ -29,10 +71,11 @@ def estimate_context_pressure(project_dir):
                 for line in ledger_file:
                     if line.strip():
                         tool_count += 1
+                        estimated_tokens += _estimate_entry_tokens(line)
         except Exception:
             pass
 
-    is_high = tool_count >= threshold
+    is_high = estimated_tokens >= threshold_tokens if threshold_tokens > 0 else False
 
     try:
         pressure_path = os.path.join(project_dir, ".omg", "state", ".context-pressure.json")
@@ -41,7 +84,11 @@ def estimate_context_pressure(project_dir):
             json.dump(
                 {
                     "tool_count": tool_count,
-                    "threshold": threshold,
+                    "estimated_tokens": estimated_tokens,
+                    "threshold": threshold_tokens,
+                    "threshold_tokens": threshold_tokens,
+                    "model_id": model_id,
+                    "class_label": limits.get("class_label", "128k-class"),
                     "is_high": is_high,
                     "ts": datetime.now(timezone.utc).isoformat(),
                 },
@@ -50,4 +97,23 @@ def estimate_context_pressure(project_dir):
     except Exception:
         pass
 
-    return tool_count, threshold, is_high
+    return tool_count, threshold_tokens, is_high
+
+
+def _estimate_entry_tokens(line: str) -> int:
+    baseline = max(1, len(line) // 4)
+    try:
+        entry = json.loads(line)
+    except Exception:
+        return baseline
+
+    if not isinstance(entry, dict):
+        return baseline
+
+    command_chars = len(str(entry.get("command", "")))
+    stdout_chars = len(str(entry.get("stdout_snippet", "")))
+    file_chars = len(str(entry.get("file", "")))
+    metadata_chars = len(str(entry.get("tool", ""))) + len(str(entry.get("governed_tool", "")))
+    char_total = command_chars + stdout_chars + file_chars + metadata_chars
+    estimated = max(baseline, char_total // 4)
+    return max(1, estimated)

package/hooks/credential_store.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# pyright: reportConstantRedefinition=false, reportMissingTypeArgument=false
 """OMG Multi-Credential Encrypted Store
 
 Fernet-based encrypted credential storage with PBKDF2HMAC key derivation.
@@ -17,27 +18,24 @@ import base64
 import gc
 import getpass
 import hashlib
-import hmac
 import json
 import os
 import sys
 from datetime import datetime, timezone
 from typing import Any
 
-# --- Ensure hooks dir is on sys.path for _common imports ---
 HOOKS_DIR = os.path.dirname(os.path.abspath(__file__))
-if HOOKS_DIR not in sys.path:
-    sys.path.insert(0, HOOKS_DIR)
+PROJECT_ROOT = os.path.dirname(HOOKS_DIR)
+if PROJECT_ROOT not in sys.path:
+    sys.path.insert(0, PROJECT_ROOT)
 
-from _common import (
+from hooks._common import (
     atomic_json_write,
     get_feature_flag,
     get_project_dir,
     setup_crash_handler,
 )
 
-# Credential storage prefers Fernet, but standalone/no-vendor verification
-# still needs a local authenticated fallback when optional crypto wheels are absent.
 setup_crash_handler("credential_store", fail_closed=True)
 
 # --- Lazy-loaded cryptography imports ---
@@ -47,9 +45,11 @@ _CRYPTO_BACKEND: str | None = None
 
 
 def _ensure_crypto():
-    """Prefer cryptography, but allow a stdlib fallback in standalone mode."""
+    """Require cryptography/Fernet for credential-store encryption."""
     global _Fernet, _InvalidToken, _CRYPTO_BACKEND
     if _CRYPTO_BACKEND is not None:
+        if _CRYPTO_BACKEND != "fernet" or _Fernet is None or _InvalidToken is None:
+            raise RuntimeError("Secure credential backend unavailable: cryptography is required")
         return
     try:
         from cryptography.fernet import Fernet, InvalidToken
@@ -57,10 +57,11 @@ def _ensure_crypto():
         _Fernet = Fernet
         _InvalidToken = InvalidToken
         _CRYPTO_BACKEND = "fernet"
-    except ImportError:
+    except ImportError as exc:
         _Fernet = None
-        _InvalidToken = ValueError
-        _CRYPTO_BACKEND = "stdlib"
+        _InvalidToken = None
+        _CRYPTO_BACKEND = "unavailable"
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required") from exc
 
 
 # --- Constants ---
@@ -73,57 +74,6 @@ MIN_PASSPHRASE_LEN = 8
 
 # Default empty store schema
 _EMPTY_STORE = {"version": 1, "providers": {}}
-_STDLIB_TOKEN_PREFIX = b"OMG1"
-
-
-def _raw_key(key: bytes) -> bytes:
-    return base64.urlsafe_b64decode(key)
-
-
-def _derive_keystream(secret: bytes, nonce: bytes, length: int) -> bytes:
-    chunks: list[bytes] = []
-    counter = 0
-    produced = 0
-    while produced < length:
-        block = hmac.new(secret, nonce + counter.to_bytes(4, "big"), hashlib.sha256).digest()
-        chunks.append(block)
-        produced += len(block)
-        counter += 1
-    return b"".join(chunks)[:length]
-
-
-def _encrypt_store_stdlib(payload: bytes, key: bytes) -> bytes:
-    secret = _raw_key(key)
-    nonce = os.urandom(16)
-    keystream = _derive_keystream(secret, nonce, len(payload))
-    ciphertext = bytes(left ^ right for left, right in zip(payload, keystream))
-    digest = hmac.new(secret, _STDLIB_TOKEN_PREFIX + nonce + ciphertext, hashlib.sha256).digest()
-    return base64.urlsafe_b64encode(_STDLIB_TOKEN_PREFIX + nonce + digest + ciphertext)
-
-
-def _decrypt_store_stdlib(token: bytes, key: bytes) -> dict | None:
-    try:
-        payload = base64.urlsafe_b64decode(token)
-    except Exception as exc:  # pragma: no cover - invalid base64 still handled as bad token
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store") from exc
-
-    if not payload.startswith(_STDLIB_TOKEN_PREFIX):
-        return None
-    if len(payload) < len(_STDLIB_TOKEN_PREFIX) + 16 + 32:
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
-
-    secret = _raw_key(key)
-    prefix_len = len(_STDLIB_TOKEN_PREFIX)
-    nonce = payload[prefix_len : prefix_len + 16]
-    digest = payload[prefix_len + 16 : prefix_len + 48]
-    ciphertext = payload[prefix_len + 48 :]
-    expected = hmac.new(secret, _STDLIB_TOKEN_PREFIX + nonce + ciphertext, hashlib.sha256).digest()
-    if not hmac.compare_digest(digest, expected):
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
-
-    keystream = _derive_keystream(secret, nonce, len(ciphertext))
-    plaintext = bytes(left ^ right for left, right in zip(ciphertext, keystream))
-    return json.loads(plaintext.decode("utf-8"))
 
 
 # =============================================================================
@@ -151,7 +101,7 @@ def derive_key(passphrase: bytes, salt: bytes, kdf_config: dict | None = None) -
 
 
 def encrypt_store(data: dict, key: bytes) -> bytes:
-    """Encrypt credential store payload with Fernet or the stdlib fallback.
+    """Encrypt credential store payload with Fernet.
 
     Args:
         data: Credential store dict to encrypt
@@ -159,12 +109,15 @@ def encrypt_store(data: dict, key: bytes) -> bytes:
 
     Returns:
         Token bytes
+
+    Raises:
+        RuntimeError: If secure cryptography backend is unavailable
     """
     _ensure_crypto()
     payload = json.dumps(data, separators=(",", ":")).encode("utf-8")
-    if _CRYPTO_BACKEND == "fernet" and _Fernet is not None:
-        return _Fernet(key).encrypt(payload)
-    return _encrypt_store_stdlib(payload, key)
+    if _Fernet is None:
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required")
+    return _Fernet(key).encrypt(payload)
 
 
 def decrypt_store(token: bytes, key: bytes) -> dict:
@@ -179,14 +132,11 @@ def decrypt_store(token: bytes, key: bytes) -> dict:
 
     Raises:
         ValueError: If passphrase is wrong or store contents are corrupted
+        RuntimeError: If secure cryptography backend is unavailable
     """
-    fallback = _decrypt_store_stdlib(token, key)
-    if fallback is not None:
-        return fallback
-
     _ensure_crypto()
-    if _CRYPTO_BACKEND != "fernet" or _Fernet is None or _InvalidToken is None:
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
+    if _Fernet is None or _InvalidToken is None:
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required")
 
     f = _Fernet(key)
     try:
@@ -618,7 +568,7 @@ def get_active_key(provider: str, project_dir: str | None = None) -> str | None:
 
     try:
         store = load_store(passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         return None
 
     providers = store.get("providers", {})
@@ -661,7 +611,7 @@ def advance_key(provider: str, project_dir: str | None = None) -> None:
 
     try:
         store = load_store(passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         return
 
     providers = store.get("providers", {})
@@ -688,7 +638,7 @@ def advance_key(provider: str, project_dir: str | None = None) -> None:
     # Failover only advances on error, not after success
     try:
         save_store(store, passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         pass  # Best-effort; don't crash the API call