@trac3er/oh-my-god 2.2.2 → 2.2.3

package/build/lib/registry/bundles/robotics.yaml

@@ -1,6 +1,6 @@
 id: robotics
 kind: domain-pack
-version: 2.2.2
+version: 2.2.3
 title: OMG Robotics Pack
 description: Robotics safety policy, replay, and evaluation attachments.
 hosts:

package/build/lib/registry/bundles/secure-worktree-pipeline.yaml

@@ -1,6 +1,6 @@
 id: secure-worktree-pipeline
 kind: runtime
-version: 2.2.2
+version: 2.2.3
 title: OMG Secure Worktree Pipeline
 description: Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs.
 hosts:

package/build/lib/registry/bundles/security-check.yaml

@@ -1,6 +1,6 @@
 id: security-check
 kind: security
-version: 2.2.2
+version: 2.2.3
 title: OMG Security Check
 description: Canonical security audit bundle with provenance, trust scoring, and deterministic evidence.
 hosts:

package/build/lib/registry/bundles/terminal-lane.yaml

@@ -1,6 +1,6 @@
 id: terminal-lane
 kind: governance
-version: 2.2.2
+version: 2.2.3
 title: OMG Terminal Lane
 description: Highest-risk governed terminal execution lane with strict approval and attestation.
 hosts:

package/build/lib/registry/bundles/test-intent-lock.yaml

@@ -1,6 +1,6 @@
 id: test-intent-lock
 kind: proof
-version: 2.2.2
+version: 2.2.3
 title: OMG Test Intent Lock
 description: Structured test-delta guard that blocks weakened tests unless explicit override evidence is present.
 hosts:

package/build/lib/registry/bundles/tracebank.yaml

@@ -1,6 +1,6 @@
 id: tracebank
 kind: evidence
-version: 2.2.2
+version: 2.2.3
 title: OMG Tracebank
 description: Structured plan-to-patch-to-verify trace capture for OMG routes.
 hosts:

package/build/lib/registry/bundles/vision.yaml

@@ -1,6 +1,6 @@
 id: vision
 kind: domain-pack
-version: 2.2.2
+version: 2.2.3
 title: OMG Vision Pack
 description: Vision-specific OCR, comparison, lineage, drift, and replay attachments.
 hosts:

package/build/lib/registry/omg-capability.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
   "title": "OMG Capability Bundle",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "type": "object",
   "required": [
     "id",

package/build/lib/runtime/adoption.py

@@ -13,7 +13,7 @@ CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.2.2"
+CANONICAL_VERSION = "2.2.3"
 
 VALID_ADOPTION_MODES = ("omg-only", "coexist")
 CANONICAL_MODE_NAMES = ("chill", "focused", "exploratory")

package/build/lib/runtime/background_verification.py

@@ -73,7 +73,9 @@ def should_skip_validation(evidence_profile: str | None, stage: str) -> bool:
 
     Rules:
     - ``release`` and ``security-audit`` profiles NEVER skip any stage.
-    - ``None``, empty, or unknown profiles fall back to FULL_REQUIREMENTS (no skip).
+    - ``None`` or empty profiles use FULL_REQUIREMENTS (no skip).
+    - Unknown profiles fail closed (no skip) — the error is surfaced by
+      :func:`resolve_evidence_profile` instead.
     - For other profiles, a stage is skipped when it is NOT in that profile's
       requirement list.
     """
@@ -85,10 +87,50 @@ def should_skip_validation(evidence_profile: str | None, stage: str) -> bool:
     if profile in _NEVER_SKIP_PROFILES:
         return False
 
-    required = requirements_for_profile(profile if profile else None)
+    try:
+        required = requirements_for_profile(profile if profile else None)
+    except ValueError:
+        # Unknown profile: fail closed — don't skip any validation
+        return False
     return stage not in required
 
 
+def resolve_evidence_profile(evidence_profile: str | None) -> dict[str, Any]:
+    """Resolve an evidence profile with strict validation.
+
+    Returns a structured dict:
+    - Success: ``{"status": "ok", "profile": <canonical>, "requirements": [...]}``
+    - Failure: ``{"status": "error", "reason": "unknown_profile", "profile": <raw>}``
+    """
+    from runtime.evidence_requirements import (
+        FULL_REQUIREMENTS,
+        resolve_profile,
+        requirements_for_profile,
+    )
+
+    raw = (evidence_profile or "").strip()
+    if not raw:
+        return {
+            "status": "ok",
+            "profile": None,
+            "requirements": list(FULL_REQUIREMENTS),
+        }
+
+    try:
+        canonical = resolve_profile(raw)
+        return {
+            "status": "ok",
+            "profile": canonical,
+            "requirements": requirements_for_profile(raw),
+        }
+    except ValueError:
+        return {
+            "status": "error",
+            "reason": "unknown_profile",
+            "profile": raw,
+        }
+
+
 def skipped_stages_for_profile(evidence_profile: str | None) -> list[str]:
     """Return the list of stages that WOULD be skipped for a given profile.
 

package/build/lib/runtime/canonical_surface.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from typing import Final
 
-from runtime.evidence_requirements import EVIDENCE_REQUIREMENTS_BY_PROFILE
+from runtime.evidence_requirements import EVIDENCE_REQUIREMENTS_BY_PROFILE, normalize_profile
 
 CANONICAL_PARITY_HOSTS: Final[list[str]] = ["claude", "codex", "gemini", "kimi"]
 COMPATIBILITY_ONLY_HOSTS: Final[list[str]] = ["opencode"]
@@ -13,8 +13,9 @@ DOMAIN_DEFAULTS: Final[dict[str, tuple[str, ...]]] = {
 }
 
 def _release_evidence_profile_labels() -> dict[str, str]:
+    """Generate release labels synchronized with the normalized profile registry."""
     return {
-        profile.replace("-", "_"): profile
+        normalize_profile(profile).replace("-", "_"): profile
         for profile in EVIDENCE_REQUIREMENTS_BY_PROFILE
     }
 

package/build/lib/runtime/claim_judge.py

@@ -9,7 +9,7 @@ from registry.verify_artifact import verify_artifact_statement
 from runtime import artifact_parsers
 from runtime.context_engine import load_profile_digest
 from runtime.evidence_query import get_evidence_pack
-from runtime.evidence_requirements import FULL_REQUIREMENTS, requirements_for_profile
+from runtime.evidence_requirements import FULL_REQUIREMENTS, normalize_profile, resolve_profile, requirements_for_profile
 
 
 def judge_claims(project_dir: str, claims: list[dict[str, Any]]) -> dict[str, Any]:
@@ -133,13 +133,16 @@ def judge_claim(claim: dict[str, Any]) -> dict[str, Any]:
     excluded_failures = _as_non_empty_list(normalized_claim.get("excluded_failures"))
     excluded_failures_waiver_path = str(normalized_claim.get("excluded_failures_waiver_path", "")).strip()
     evidence_profile = str(normalized_claim.get("evidence_profile", "")).strip()
-    evidence_requirements = requirements_for_profile(evidence_profile)
+    evidence_requirements, evidence_profile_error = _resolve_evidence_requirements(evidence_profile)
     requirement_set = {str(item).strip() for item in evidence_requirements if str(item).strip()}
     causal_chain = _as_dict(normalized_claim.get("causal_chain"))
 
     reasons: list[dict[str, Any]] = []
     advisories: list[str] = []
 
+    if evidence_profile_error:
+        reasons.append(evidence_profile_error)
+
     if "tests" in requirement_set and not artifacts:
         reasons.append(
             {
@@ -300,10 +303,41 @@ def _normalize_claim(claim: dict[str, Any]) -> dict[str, Any]:
         "excluded_failures": excluded_failures,
         "excluded_failures_waiver_path": excluded_failures_waiver_path,
         "causal_chain": causal_chain,
-        "evidence_profile": str(claim.get("evidence_profile", evidence.get("evidence_profile", ""))).strip(),
+        "evidence_profile": normalize_profile(str(claim.get("evidence_profile", evidence.get("evidence_profile", ""))).strip()),
     }
 
 
+def _resolve_evidence_requirements(evidence_profile: str) -> tuple[list[str], dict[str, Any] | None]:
+    raw_profile = str(evidence_profile or "").strip()
+    normalized = normalize_profile(raw_profile) if raw_profile else ""
+
+    try:
+        canonical = resolve_profile(normalized or None)
+        return requirements_for_profile(canonical), None
+    except ValueError as exc:
+        payload = _parse_profile_error(exc)
+        reason = {
+            "code": "unknown_evidence_profile",
+            "message": str(payload.get("reason", "unknown_profile")),
+            "field": "evidence_profile",
+            "profile": str(payload.get("profile", raw_profile)).strip(),
+        }
+        return list(FULL_REQUIREMENTS), reason
+
+
+def _parse_profile_error(exc: ValueError) -> dict[str, Any]:
+    raw = str(exc).strip()
+    if not raw:
+        return {}
+    try:
+        payload = json.loads(raw)
+    except json.JSONDecodeError:
+        return {}
+    if isinstance(payload, dict):
+        return payload
+    return {}
+
+
 def _validate_excluded_failures_policy(
     *,
     project_dir: str,

package/build/lib/runtime/compliance_governor.py

@@ -7,6 +7,8 @@ from typing import Any
 from registry.approval_artifact import load_approval_artifact_from_path, verify_approval_artifact
 from registry.verify_artifact import verify_artifact, verify_tool_attestation
 from runtime.claim_judge import evaluate_claims_for_release
+from runtime.proof_gate import production_gate as evaluate_production_gate
+from runtime.proof_gate import required_production_primitives
 from runtime.runtime_contracts import read_run_state
 
 
@@ -153,6 +155,30 @@ def evaluate_release_compliance(
                 "reason": str(claim_decision.get("reason", "claim_judge_verdict=unknown")),
                 "claim_judge_verdict": str(claim_decision.get("claim_judge_verdict", "")),
             }
+    else:
+        claim_decision = release_evidence.get("claim_judge") if isinstance(release_evidence.get("claim_judge"), dict) else {
+            "status": "blocked",
+            "claim_judge_verdict": "missing",
+            "reason": "claim_judge_missing_claims",
+        }
+
+    release_gate = production_gate(
+        {
+            **release_evidence,
+            "claim_judge": claim_decision,
+        }
+    )
+    if release_gate.get("status") == "blocked":
+        blockers = release_gate.get("blockers")
+        blocker_list = blockers if isinstance(blockers, list) else []
+        return {
+            "status": "blocked",
+            "authority": "production_gate",
+            "reason": "production_gate_blocked",
+            "blockers": blocker_list,
+            "required_primitives": list(required_production_primitives()),
+            **artifact_audit,
+        }
 
     return {
         "status": "allowed",
@@ -162,6 +188,35 @@ def evaluate_release_compliance(
     }
 
 
+def production_gate(evidence: dict[str, Any]) -> dict[str, Any]:
+    payload = evidence if isinstance(evidence, dict) else {}
+    try:
+        gate_result = evaluate_production_gate(payload)
+    except Exception:
+        return {
+            "status": "blocked",
+            "blockers": ["production_gate_internal_error"],
+            "required_primitives": list(required_production_primitives()),
+        }
+
+    status = str(gate_result.get("status", "")).strip().lower()
+    blockers = gate_result.get("blockers")
+    blocker_list = blockers if isinstance(blockers, list) else []
+    if status != "ok":
+        if not blocker_list:
+            blocker_list = ["production_gate_unknown_blocker"]
+        return {
+            "status": "blocked",
+            "blockers": blocker_list,
+            "required_primitives": list(required_production_primitives()),
+        }
+
+    return {
+        "status": "ok",
+        "required_primitives": list(required_production_primitives()),
+    }
+
+
 def evaluate_governed_tool_request(
     *,
     project_dir: str,

package/build/lib/runtime/context_limits.py

@@ -320,15 +320,27 @@ def get_model_limits(model_id: str) -> ContextLimitEntry:
 
     # 1. Exact match
     if normalized in _REGISTRY:
-        return _REGISTRY[normalized]
+        return _clone_entry(_REGISTRY[normalized])
 
     # 2. Prefix match (longest prefix first via _PREFIX_TABLE ordering)
     for prefix, registry_key in _PREFIX_TABLE:
         if normalized.startswith(prefix.lower()):
-            return _REGISTRY[registry_key]
+            return _clone_entry(_REGISTRY[registry_key])
 
     # 3. Fallback
-    return _FALLBACK
+    return _clone_entry(_FALLBACK)
+
+
+def _clone_entry(entry: ContextLimitEntry) -> ContextLimitEntry:
+    return {
+        "context_tokens": int(entry["context_tokens"]),
+        "output_reserve_tokens": int(entry["output_reserve_tokens"]),
+        "class_label": str(entry["class_label"]),
+        "preflight_counting": bool(entry["preflight_counting"]),
+        "native_compaction": bool(entry["native_compaction"]),
+        "compaction_trigger_default": int(entry["compaction_trigger_default"]),
+        "notes": str(entry["notes"]),
+    }
 
 
 def is_1m_class(model_id: str) -> bool:

package/build/lib/runtime/contract_compiler.py

@@ -26,7 +26,7 @@ from runtime.evidence_requirements import requirements_for_profile
 from runtime.runtime_contracts import schema_versions
 from runtime.compliance_governor import evaluate_release_compliance
 from runtime.release_run_coordinator import get_active_coordinator_run_id
-from runtime.release_surfaces import get_runtime_behavior_surfaces
+from runtime.release_surfaces import get_package_parity_surfaces, get_runtime_behavior_surfaces
 from runtime.adoption import (
     CANONICAL_MARKETPLACE_ID,
     CANONICAL_PACKAGE_NAME,
@@ -196,6 +196,7 @@ _REQUIRED_EXECUTION_PRIMITIVES = (
     "exec_kernel_state",
     "worker_watchdog_replay",
     "merge_writer_provenance",
+    "write_lease_provenance",
     "tool_fabric_ledger",
     "budget_envelope_state",
     "issue_report",
@@ -1908,6 +1909,7 @@ def _check_host_semantic_parity(
     overall_status = str(report.get("overall_status", "")).strip().lower()
     parity_results = report.get("parity_results", {})
     passed = bool(parity_results.get("passed")) if isinstance(parity_results, dict) else False
+    host_results = parity_results.get("host_results", {}) if isinstance(parity_results, dict) else {}
 
     blockers: list[str] = []
     report_run_id = str(report.get("run_id", "")).strip()
@@ -1919,6 +1921,16 @@ def _check_host_semantic_parity(
         blockers.append(f"host_semantic_parity: report overall_status={overall_status}")
     if isinstance(parity_results, dict) and not passed:
         blockers.append("host_semantic_parity: parity check reported drift")
+    if not isinstance(host_results, dict):
+        blockers.append("host_semantic_parity: report missing host results")
+    else:
+        for host in sorted(canonical_required_hosts):
+            host_result = host_results.get(host)
+            normalized = host_result.get("normalized", {}) if isinstance(host_result, dict) else {}
+            source_class = str(normalized.get("source_class", "")).strip().lower() if isinstance(normalized, dict) else ""
+            source_path = str(normalized.get("source_path", "")).strip() if isinstance(normalized, dict) else ""
+            if source_class != "compiled_or_replayed" or not source_path:
+                blockers.append(f"host_semantic_parity: synthetic payload rejected for {host}")
 
     return {
         "status": "ok" if not blockers else "error",
@@ -2119,6 +2131,10 @@ def build_release_readiness(
     checks["package_smoke"] = package_check
     blockers.extend(package_check.get("blockers", []))
 
+    package_parity = check_package_parity(root)
+    checks["package_parity"] = package_parity
+    blockers.extend(package_parity.get("blockers", []))
+
     plugin_cmd_check = _check_plugin_command_paths(root)
     checks["plugin_command_paths"] = plugin_cmd_check
     blockers.extend(plugin_cmd_check.get("blockers", []))
@@ -2715,6 +2731,7 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
         "exec_kernel_state",
         "worker_watchdog_replay",
         "merge_writer_provenance",
+        "write_lease_provenance",
         "tool_fabric_ledger",
         "budget_envelope_state",
         "issue_report",
@@ -3059,6 +3076,92 @@ def _check_bundle_promotion_parity(root: Path, output_root: Path) -> dict[str, A
     }
 
 
+def check_package_parity(root_path: str | Path) -> dict[str, Any]:
+    root = _resolve_root(root_path)
+    required_surfaces = tuple(get_package_parity_surfaces())
+    machine_blockers: list[dict[str, str]] = []
+    blockers: list[str] = []
+
+    def _add_blocker(*, location: str, surface: str, path: str, reason: str = "missing_surface") -> None:
+        blocker = {
+            "kind": "package_parity_missing",
+            "location": location,
+            "surface": surface,
+            "path": path,
+            "reason": reason,
+        }
+        machine_blockers.append(blocker)
+        blockers.append(
+            f"package_parity_missing: location={location} surface={surface} path={path} reason={reason}"
+        )
+
+    for surface in required_surfaces:
+        source_path = root / ".agents" / "skills" / "omg" / surface / "SKILL.md"
+        if not source_path.exists():
+            _add_blocker(location="source", surface=surface, path=str(source_path.relative_to(root)))
+
+    def _check_bundle_surface_roots(*, location: str, roots: list[Path]) -> None:
+        if not roots:
+            for surface in required_surfaces:
+                _add_blocker(
+                    location=location,
+                    surface=surface,
+                    path=f"{location}/bundle/.agents/skills/omg/{surface}/SKILL.md",
+                    reason="missing_output_location",
+                )
+            return
+        for surface in required_surfaces:
+            found = False
+            for bundle_root in roots:
+                candidate = bundle_root / ".agents" / "skills" / "omg" / surface / "SKILL.md"
+                if candidate.exists():
+                    found = True
+                    break
+            if not found:
+                _add_blocker(
+                    location=location,
+                    surface=surface,
+                    path=f"{location}/bundle/.agents/skills/omg/{surface}/SKILL.md",
+                )
+
+    dist_bundle_roots = [path for path in sorted((root / "dist").glob("*/bundle")) if path.is_dir()]
+    _check_bundle_surface_roots(location="dist", roots=dist_bundle_roots)
+
+    release_bundle_roots = [
+        path for path in sorted((root / "artifacts" / "release" / "dist").glob("*/bundle")) if path.is_dir()
+    ]
+    _check_bundle_surface_roots(location="release", roots=release_bundle_roots)
+
+    wheel_files = sorted((root / "dist").glob("*.whl"))
+    if not wheel_files:
+        for surface in required_surfaces:
+            _add_blocker(
+                location="wheel",
+                surface=surface,
+                path=f"dist/*.whl::.agents/skills/omg/{surface}/SKILL.md",
+                reason="missing_output_location",
+            )
+    else:
+        wheel_path = wheel_files[-1]
+        with zipfile.ZipFile(wheel_path) as archive:
+            names = set(archive.namelist())
+        for surface in required_surfaces:
+            suffix = f".agents/skills/omg/{surface}/SKILL.md"
+            if not any(name.endswith(suffix) for name in names):
+                _add_blocker(
+                    location="wheel",
+                    surface=surface,
+                    path=f"{wheel_path.relative_to(root)}::{suffix}",
+                )
+
+    return {
+        "status": "ok" if not blockers else "error",
+        "required_surfaces": list(required_surfaces),
+        "machine_blockers": machine_blockers,
+        "blockers": blockers,
+    }
+
+
 def _check_packaged_install_smoke(root: Path) -> dict[str, Any]:
     blockers: list[str] = []
     with tempfile.TemporaryDirectory(prefix="omg-wheel-") as tmp_dir:

package/build/lib/runtime/evidence_query.py

@@ -6,7 +6,11 @@ from pathlib import Path
 from typing import cast
 
 from runtime.context_engine import load_profile_digest
-from runtime.evidence_requirements import EVIDENCE_REQUIREMENTS_BY_PROFILE, requirements_for_profile
+from runtime.evidence_requirements import (
+    EVIDENCE_REQUIREMENTS_BY_PROFILE,
+    requirements_for_profile,
+    resolve_profile,
+)
 
 JsonPrimitive = str | int | float | bool | None
 JsonValue = JsonPrimitive | dict[str, "JsonValue"] | list["JsonValue"]
@@ -53,8 +57,15 @@ def _record_copy_with_context_metadata(root: Path, record: JsonObject) -> JsonOb
     existing_profile_version = _record_string(record, "profile_version")
     profile_version = existing_profile_version or str(profile_digest.get("profile_version", "")).strip()
     evidence_profile = _record_string(record, "evidence_profile").strip()
-    evidence_requirements = requirements_for_profile(evidence_profile)
-    profile_is_known = not evidence_profile or evidence_profile in EVIDENCE_REQUIREMENTS_BY_PROFILE
+    try:
+        resolved = resolve_profile(evidence_profile if evidence_profile else None)
+        evidence_requirements = requirements_for_profile(evidence_profile if evidence_profile else None)
+        profile_is_known = True
+        if resolved is not None:
+            evidence_profile = resolved  # use canonical name
+    except ValueError:
+        evidence_requirements = []
+        profile_is_known = False
 
     intent_gate_payload = _load_json(root / ".omg" / "state" / "intent_gate" / f"{run_id}.json") or {}
     existing_intent_gate_version = _record_string(record, "intent_gate_version")

package/build/lib/runtime/evidence_requirements.py

@@ -1,6 +1,7 @@
 """Single-source evidence profile requirements registry."""
 from __future__ import annotations
 
+import json
 from typing import Final
 
 FULL_REQUIREMENTS: Final[list[str]] = [
@@ -109,10 +110,48 @@ EVIDENCE_REQUIREMENTS_BY_PROFILE: Final[dict[str, list[str]]] = {
 }
 
 
+def normalize_profile(raw: str) -> str:
+    """Normalize a profile name: strip whitespace and lowercase."""
+    return raw.strip().lower()
+
+
+def resolve_profile(evidence_profile: str | None) -> str | None:
+    """Resolve a profile name to its canonical registry key.
+
+    Returns ``None`` for empty / ``None`` input (caller should use
+    ``FULL_REQUIREMENTS``).  Returns the canonical key for known profiles
+    (exact match first, then normalized).  Raises ``ValueError`` with a
+    machine-readable JSON message for unknown profiles.
+    """
+    if not evidence_profile or not evidence_profile.strip():
+        return None
+
+    # Exact match
+    if evidence_profile in EVIDENCE_REQUIREMENTS_BY_PROFILE:
+        return evidence_profile
+
+    # Normalized match (strip + lowercase)
+    normalized = normalize_profile(evidence_profile)
+    for key in EVIDENCE_REQUIREMENTS_BY_PROFILE:
+        if normalize_profile(key) == normalized:
+            return key
+
+    # Unknown — fail closed with machine-readable error
+    raise ValueError(
+        json.dumps(
+            {"status": "error", "reason": "unknown_profile", "profile": evidence_profile}
+        )
+    )
+
+
 def requirements_for_profile(evidence_profile: str | None) -> list[str]:
-    if not evidence_profile:
-        return list(FULL_REQUIREMENTS)
-    requirements = EVIDENCE_REQUIREMENTS_BY_PROFILE.get(evidence_profile)
-    if not requirements:
+    """Return the evidence requirement list for *evidence_profile*.
+
+    ``None`` / empty  → ``FULL_REQUIREMENTS``.
+    Known profile     → profile-specific list.
+    Unknown profile   → raises ``ValueError`` (machine-readable JSON).
+    """
+    canonical = resolve_profile(evidence_profile)
+    if canonical is None:
         return list(FULL_REQUIREMENTS)
-    return list(requirements)
+    return list(EVIDENCE_REQUIREMENTS_BY_PROFILE[canonical])