@trac3er/oh-my-god 2.2.2 → 2.2.3

package/build/lib/runtime/github_review_formatter.py

@@ -0,0 +1,165 @@
+from __future__ import annotations
+
+from typing import Any
+
+
+def format_review_payload(evidence: dict[str, Any], *, inline_batch_limit: int = 20) -> dict[str, Any]:
+    if not isinstance(evidence, dict):
+        return {
+            "status": "error",
+            "error_code": "GITHUB_REVIEW_EVIDENCE_INVALID",
+            "message": "Review evidence must be a JSON object.",
+        }
+
+    artifacts = _as_str_list(evidence.get("artifacts"))
+    if not artifacts:
+        return {
+            "status": "error",
+            "error_code": "GITHUB_REVIEW_ARTIFACTS_MISSING",
+            "message": "Review evidence is missing required artifacts.",
+        }
+
+    raw_verdict = str(evidence.get("verdict", evidence.get("status", "pending"))).strip().lower()
+    review_status = _normalize_review_status(raw_verdict)
+    review_event = _review_event_for_status(review_status)
+
+    checks = _normalize_checks(evidence.get("checks"))
+    evidence_gaps = _as_str_list(evidence.get("evidence_gaps"))
+    if not evidence_gaps:
+        evidence_gaps = _as_str_list(evidence.get("unresolved_risks"))
+
+    raw_inline = evidence.get("inline_comments")
+    inline_comments = _normalize_inline_comments(raw_inline)
+
+    limit = max(0, int(inline_batch_limit))
+    selected_comments = inline_comments[:limit]
+    dropped_comments = max(0, len(inline_comments) - len(selected_comments))
+    body = _build_review_body(
+        review_status=review_status,
+        raw_verdict=raw_verdict,
+        artifacts=artifacts,
+        checks=checks,
+        evidence_gaps=evidence_gaps,
+        dropped_comments=dropped_comments,
+    )
+
+    return {
+        "status": "ok",
+        "review_status": review_status,
+        "review_event": review_event,
+        "body": body,
+        "inline_comments": selected_comments,
+        "dropped_inline_comments": dropped_comments,
+    }
+
+
+def _build_review_body(
+    *,
+    review_status: str,
+    raw_verdict: str,
+    artifacts: list[str],
+    checks: list[dict[str, str]],
+    evidence_gaps: list[str],
+    dropped_comments: int,
+) -> str:
+    lines: list[str] = [
+        "## OMG PR Reviewer",
+        "",
+        f"- CI verdict: **{raw_verdict or review_status}**",
+        f"- Review state: **{review_status}**",
+        "",
+        "### Evidence Artifacts",
+    ]
+    for artifact in artifacts:
+        lines.append(f"- `{artifact}`")
+
+    lines.append("")
+    lines.append("### CI Checks")
+    if checks:
+        for check in checks:
+            name = check.get("name", "check")
+            status = check.get("status", "unknown")
+            detail = check.get("detail", "")
+            lines.append(f"- {name}: {status}" + (f" ({detail})" if detail else ""))
+    else:
+        lines.append("- No check details were provided by CI artifacts.")
+
+    lines.append("")
+    lines.append("### Evidence Gaps")
+    if evidence_gaps:
+        for gap in evidence_gaps:
+            lines.append(f"- {gap}")
+    else:
+        lines.append("- None reported.")
+
+    if dropped_comments > 0:
+        lines.append("")
+        lines.append(f"- Inline comments truncated to API-safe batch size; omitted: {dropped_comments}")
+
+    lines.append("")
+    lines.append("This review reports CI verdicts and evidence completeness only.")
+    return "\n".join(lines)
+
+
+def _normalize_review_status(verdict: str) -> str:
+    if verdict in {"ok", "pass", "passed", "success", "approved"}:
+        return "approved"
+    if verdict in {"fail", "failed", "error", "reject", "rejected", "block", "blocked"}:
+        return "rejected"
+    return "pending"
+
+
+def _review_event_for_status(status: str) -> str:
+    if status == "approved":
+        return "APPROVE"
+    if status == "rejected":
+        return "REQUEST_CHANGES"
+    return "COMMENT"
+
+
+def _normalize_checks(value: object) -> list[dict[str, str]]:
+    if not isinstance(value, list):
+        return []
+    checks: list[dict[str, str]] = []
+    for item in value:
+        if not isinstance(item, dict):
+            continue
+        name = str(item.get("name", "")).strip()
+        status = str(item.get("status", "")).strip()
+        detail = str(item.get("detail", "")).strip()
+        if not name and not status:
+            continue
+        checks.append({"name": name or "check", "status": status or "unknown", "detail": detail})
+    return checks
+
+
+def _normalize_inline_comments(value: object) -> list[dict[str, object]]:
+    if not isinstance(value, list):
+        return []
+    comments: list[dict[str, object]] = []
+    for item in value:
+        if not isinstance(item, dict):
+            continue
+        path = str(item.get("path", "")).strip()
+        body = str(item.get("body", "")).strip()
+        line = item.get("line")
+        if not path or not body:
+            continue
+        if not isinstance(line, int) or line <= 0:
+            continue
+        comments.append({"path": path, "line": line, "body": body})
+    return comments
+
+
+def _as_str_list(value: object) -> list[str]:
+    if not isinstance(value, list):
+        return []
+    result: list[str] = []
+    for item in value:
+        text = str(item).strip()
+        if text:
+            result.append(text)
+    return result
+
+
+__all__ = ["format_review_payload"]

package/build/lib/runtime/guide_assert.py

@@ -1,6 +1,7 @@
 """Rule-based output assertions for OMG guide checks."""
 from __future__ import annotations
 
+import re
 from typing import Any
 
 
@@ -9,6 +10,17 @@ def guide_assert(candidate: str, rules: dict[str, Any]) -> dict[str, Any]:
     lowered = text.lower()
     violations: list[dict[str, str]] = []
 
+    terms_rules = rules.get("terms_guard") if isinstance(rules, dict) else {}
+    terms_verdict = terms_guard(text, terms_rules if isinstance(terms_rules, dict) else {})
+    if terms_verdict.get("status") != "ok":
+        violations.append(
+            {
+                "rule_type": "terms_guard",
+                "rule": "terms_guard",
+                "reason": str(terms_verdict.get("reason", "terms_guard_rejected")),
+            }
+        )
+
     for goal in _as_list(rules.get("goals")):
         if "todo" in goal.lower() and "todo" in lowered:
             violations.append({"rule_type": "goal", "rule": goal, "reason": "candidate still includes TODO markers"})
@@ -25,6 +37,7 @@ def guide_assert(candidate: str, rules: dict[str, Any]) -> dict[str, Any]:
         "schema": "GuideAssertionResult",
         "verdict": "fail" if violations else "pass",
         "violations": violations,
+        "terms_guard": terms_verdict,
         "summary": {
             "rule_count": sum(len(_as_list(rules.get(key))) for key in ("goals", "non_goals", "acceptance_criteria", "architecture_constraints", "style_rules", "risk_appetite")),
             "violation_count": len(violations),
@@ -32,6 +45,57 @@ def guide_assert(candidate: str, rules: dict[str, Any]) -> dict[str, Any]:
     }
 
 
+def terms_guard(input_text: str, rules: dict[str, Any]) -> dict[str, Any]:
+    text = str(input_text or "")
+    config = rules if isinstance(rules, dict) else {}
+
+    min_length = _as_int(config.get("min_length"))
+    max_length = _as_int(config.get("max_length"))
+    if min_length is not None and min_length < 0:
+        return {"status": "rejected", "reason": "terms_guard_invalid_min_length"}
+    if max_length is not None and max_length < 0:
+        return {"status": "rejected", "reason": "terms_guard_invalid_max_length"}
+    if min_length is not None and max_length is not None and min_length > max_length:
+        return {"status": "rejected", "reason": "terms_guard_invalid_length_bounds"}
+
+    allowlist = _as_exact_terms(config.get("allowlist"))
+    if config.get("allowlist") is not None and allowlist is None:
+        return {"status": "rejected", "reason": "terms_guard_invalid_allowlist"}
+
+    pattern = config.get("pattern")
+    if pattern is not None and not isinstance(pattern, str):
+        return {"status": "rejected", "reason": "terms_guard_invalid_pattern"}
+
+    deny_patterns = _as_exact_terms(config.get("deny_patterns"))
+    if config.get("deny_patterns") is not None and deny_patterns is None:
+        return {"status": "rejected", "reason": "terms_guard_invalid_deny_patterns"}
+
+    if min_length is not None and len(text) < min_length:
+        return {"status": "rejected", "reason": "terms_guard_too_short"}
+    if max_length is not None and len(text) > max_length:
+        return {"status": "rejected", "reason": "terms_guard_too_long"}
+
+    if allowlist is not None and text not in allowlist:
+        return {"status": "rejected", "reason": "terms_guard_not_in_allowlist"}
+
+    if isinstance(pattern, str) and pattern:
+        try:
+            if re.fullmatch(pattern, text) is None:
+                return {"status": "rejected", "reason": "terms_guard_pattern_mismatch"}
+        except re.error:
+            return {"status": "rejected", "reason": "terms_guard_invalid_pattern"}
+
+    if deny_patterns:
+        for blocked in deny_patterns:
+            try:
+                if re.search(blocked, text):
+                    return {"status": "rejected", "reason": "terms_guard_disallowed_pattern"}
+            except re.error:
+                return {"status": "rejected", "reason": "terms_guard_invalid_deny_pattern"}
+
+    return {"status": "ok"}
+
+
 def _as_list(value: Any) -> list[str]:
     if not isinstance(value, list):
         return []
@@ -43,3 +107,29 @@ def _mentions(lowered_candidate: str, rule: str) -> bool:
     if not tokens:
         return False
     return all(token in lowered_candidate for token in tokens)
+
+
+def _as_int(value: Any) -> int | None:
+    if value is None:
+        return None
+    if isinstance(value, bool):
+        return None
+    if isinstance(value, int):
+        return value
+    if isinstance(value, str) and value.strip().isdigit():
+        return int(value.strip())
+    return None
+
+
+def _as_exact_terms(value: Any) -> list[str] | None:
+    if not isinstance(value, list):
+        return None
+    output: list[str] = []
+    for item in value:
+        if not isinstance(item, str):
+            return None
+        token = item.strip()
+        if not token:
+            return None
+        output.append(token)
+    return output

package/build/lib/runtime/host_parity.py

@@ -28,6 +28,12 @@ _IGNORED_SEMANTIC_KEYS = {
 
 _TOKEN_RE = re.compile(r"[a-z0-9_\-]+")
 _KV_LINE_RE = re.compile(r"^\s*([A-Za-z0-9_\- ]+):\s*(.+?)\s*$")
+_REAL_PARITY_SOURCE_KINDS = {
+    "compiled_artifact",
+    "compiled_output",
+    "replayed_output",
+    "replayed_artifact",
+}
 
 
 @dataclass
@@ -55,6 +61,33 @@ def _normalize_host(host: str) -> str:
     return str(host).strip().lower()
 
 
+def _source_metadata(payload: dict[str, Any]) -> tuple[str, str]:
+    raw_source = payload.get("source")
+    if not isinstance(raw_source, dict):
+        return "", ""
+
+    source: dict[str, Any] = raw_source
+    source_kind = str(source.get("kind", "")).strip().lower()
+    source_path = ""
+    for key in ("artifact_path", "replay_path", "compiled_path", "output_path", "path"):
+        value = str(source.get(key, "")).strip()
+        if value:
+            source_path = value
+            break
+    return source_kind, source_path
+
+
+def is_synthetic(payload: dict[str, Any]) -> bool:
+    source_kind, source_path = _source_metadata(payload)
+    if not source_kind:
+        return True
+    if source_kind not in _REAL_PARITY_SOURCE_KINDS:
+        return True
+    if not source_path:
+        return True
+    return False
+
+
 def _canonicalize(value: Any) -> Any:
     if isinstance(value, dict):
         out: dict[str, Any] = {}
@@ -177,6 +210,7 @@ class HostParityNormalizer:
         _ = context
         host_name = _normalize_host(host)
         payload = raw_output if isinstance(raw_output, dict) else {"output": raw_output}
+        source_kind, source_path = _source_metadata(payload)
 
         exit_code_raw = payload.get("exit_code", 0)
         try:
@@ -197,6 +231,9 @@ class HostParityNormalizer:
             "fallback": fallback,
             "error": error,
             "error_class": "none" if not error else "provider-error",
+            "source_kind": source_kind or "synthetic",
+            "source_path": source_path,
+            "source_class": "compiled_or_replayed" if not is_synthetic(payload) else "synthetic",
             "semantic": semantic_content,
         }
         return normalized
@@ -242,7 +279,19 @@ class HostParityNormalizer:
                 drift_details.append(f"missing host output: {host}")
                 continue
 
-            normalized = self.normalize_output(host, outputs_by_host[host], context)
+            raw_payload = outputs_by_host[host]
+            payload = raw_payload if isinstance(raw_payload, dict) else {"output": raw_payload}
+            normalized = self.normalize_output(host, payload, context)
+            if is_synthetic(payload):
+                host_results[host] = {
+                    "present": True,
+                    "passed": False,
+                    "reason": "synthetic payload rejected",
+                    "normalized": normalized,
+                }
+                drift_details.append(f"synthetic payload rejected: {host}")
+                continue
+
             host_results[host] = {
                 "present": True,
                 "passed": True,
@@ -258,6 +307,8 @@ class HostParityNormalizer:
                 current = host_results.get(host, {})
                 if not current.get("present"):
                     continue
+                if current.get("reason") == "synthetic payload rejected":
+                    continue
                 normalized = current.get("normalized")
                 if not isinstance(normalized, dict):
                     continue
@@ -315,6 +366,7 @@ __all__ = [
     "HostParityNormalizer",
     "ParityCheckResult",
     "HostParityReport",
+    "is_synthetic",
     "normalize_output",
     "check_parity",
     "emit_parity_report",

package/build/lib/runtime/merge_writer.py

@@ -5,6 +5,10 @@ Enforces one-writer/many-readers semantics:
 - Mutation-capable workers MUST hold the merge-writer lock AND run
   inside a worktree before applying changes back to the main tree.
 
+Write leases extend the merge-writer lock with run-scoped, time-bounded
+authorization.  A write lease is NOT a second lock — it layers on top of
+the existing single-writer lock, adding temporal and evidence constraints.
+
 Lock file:     .omg/state/merge-writer.lock   (JSON)
 Provenance:    .omg/evidence/merge-writer-<run_id>.json
 """
@@ -12,7 +16,8 @@ from __future__ import annotations
 
 import json
 import os
-from dataclasses import dataclass
+import time as _time
+from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
@@ -311,6 +316,89 @@ class MergeWriter:
             )
 
 
+# ---------------------------------------------------------------------------
+# Write Lease — run-scoped, time-bounded authorization over merge writer
+# ---------------------------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class WriteLease:
+    """Run-scoped, time-bounded authorization layered over the merge writer.
+
+    A write lease is NOT a second lock.  It constrains an already-held
+    merge-writer lock with temporal bounds and evidence linkage.
+    """
+
+    run_id: str
+    created_at: float  # monotonic seconds (time.monotonic())
+    duration_s: float
+    evidence_path: str
+    is_active: bool = True
+
+
+def create_write_lease(
+    run_id: str,
+    duration_s: float,
+    evidence_path: str,
+) -> WriteLease:
+    """Create a new write lease bound to *run_id*.
+
+    Args:
+        run_id:         The release-run identifier this lease is scoped to.
+        duration_s:     Maximum lifetime in seconds.
+        evidence_path:  Path to the evidence artifact backing this lease.
+
+    Returns:
+        A ``WriteLease`` instance.
+    """
+    return WriteLease(
+        run_id=run_id,
+        created_at=_time.monotonic(),
+        duration_s=float(duration_s),
+        evidence_path=str(evidence_path),
+        is_active=True,
+    )
+
+
+def is_lease_valid(
+    lease: WriteLease,
+    current_run_id: str,
+    current_time: float | None = None,
+) -> tuple[bool, str]:
+    """Check whether *lease* is still valid for *current_run_id*.
+
+    Args:
+        lease:           The lease to validate.
+        current_run_id:  The run_id of the currently active release run.
+        current_time:    Monotonic timestamp (defaults to ``time.monotonic()``).
+
+    Returns:
+        ``(True, "valid")`` when the lease authorizes the run, or
+        ``(False, reason)`` with a deterministic blocker reason.
+    """
+    if not lease.is_active:
+        return False, "write_lease_inactive"
+
+    if lease.run_id != current_run_id:
+        return (
+            False,
+            f"write_lease_run_id_mismatch:lease={lease.run_id},current={current_run_id}",
+        )
+
+    now = current_time if current_time is not None else _time.monotonic()
+    elapsed = now - lease.created_at
+    if elapsed > lease.duration_s:
+        return (
+            False,
+            f"write_lease_expired:elapsed={elapsed:.1f}s,limit={lease.duration_s:.1f}s",
+        )
+
+    if not lease.evidence_path:
+        return False, "write_lease_missing_evidence_path"
+
+    return True, "valid"
+
+
 # ---------------------------------------------------------------------------
 # Module-level factory
 # ---------------------------------------------------------------------------

package/build/lib/runtime/mutation_gate.py

@@ -29,6 +29,15 @@ _HARMLESS_REDIRECTION_PATTERNS = (
 _FILE_WRITE_REDIRECTION_PATTERN = re.compile(
     r"(?:^|[\s;&|()])\d*>>?(?!\s*(?:/dev/(?:null|stdout|stderr)\b|&\d+\b|&-\b))\s*\S+"
 )
+_SHELL_C_PATTERN = re.compile(r"\b(?:bash|sh|zsh)\s+-[^\s]*c\s+([\"'])(.+?)\1")
+_FULLY_QUOTED_PATTERN = re.compile(r"^\s*([\"']).*\1\s*$")
+_READ_ONLY_BASH_ALLOWLIST = (
+    re.compile(r"^python\d?(?:\s+-[vV]{1,2}|\s+--version)(?:\s|$)"),
+    re.compile(r"^git\s+status(?:\s|$)"),
+    re.compile(r"^gh\s+pr\s+view(?:\s|$)"),
+    re.compile(r"^(?:.+\|\s*)?tee\s+/dev/null(?:\s|$)"),
+)
+_QUOTED_SEGMENT_PATTERN = re.compile(r"(['\"]).*?\1")
 
 
 def check_mutation_allowed(
@@ -161,11 +170,20 @@ def _is_mutation_capable_bash(command: str) -> bool:
     normalized_command = str(command or "").strip()
     if not normalized_command:
         return False
+
+    shell_payload = _extract_shell_payload(normalized_command)
+    if shell_payload is not None:
+        return _is_mutation_capable_bash(shell_payload)
+
     lowered = _strip_harmless_redirections(normalized_command.lower())
+    if _is_allowlisted_read_only_command(lowered):
+        return False
+
+    dequoted = _strip_quoted_segments(lowered)
     for pattern in _MUTATION_BASH_PATTERNS:
-        if re.search(pattern, lowered):
+        if re.search(pattern, dequoted):
             return True
-    if _FILE_WRITE_REDIRECTION_PATTERN.search(lowered):
+    if _FILE_WRITE_REDIRECTION_PATTERN.search(dequoted):
         return True
     return False
 
@@ -177,6 +195,31 @@ def _strip_harmless_redirections(command: str) -> str:
     return re.sub(r"\s+", " ", sanitized).strip()
 
 
+def _extract_shell_payload(command: str) -> str | None:
+    match = _SHELL_C_PATTERN.search(command.strip())
+    if not match:
+        return None
+    return str(match.group(2)).strip()
+
+
+def _strip_quoted_segments(command: str) -> str:
+    if _FULLY_QUOTED_PATTERN.match(command):
+        return ""
+    return re.sub(r"\s+", " ", _QUOTED_SEGMENT_PATTERN.sub(" ", command)).strip()
+
+
+def _is_allowlisted_read_only_command(command: str) -> bool:
+    stripped = command.strip()
+    if not stripped:
+        return True
+    if _FULLY_QUOTED_PATTERN.match(stripped):
+        return True
+    for pattern in _READ_ONLY_BASH_ALLOWLIST:
+        if pattern.search(stripped):
+            return True
+    return False
+
+
 def _write_warning_artifact(project_dir: str, tool: str, file_path: str, reason: str) -> None:
     state_dir = Path(project_dir) / ".omg" / "state" / "mutation_gate"
     state_dir.mkdir(parents=True, exist_ok=True)

package/build/lib/runtime/omg_compat_contract_snapshot.json

@@ -1,6 +1,6 @@
 {
   "schema": "OmgCompatContractSnapshot",
-  "contract_version": "2.2.2",
+  "contract_version": "2.2.3",
   "count": 47,
   "contracts": [
     {

package/build/lib/runtime/proof_gate.py

@@ -10,6 +10,7 @@ from runtime.evidence_requirements import FULL_REQUIREMENTS, requirements_for_pr
 
 
 _REQUIRED_ARTIFACT_FIELDS = ("kind", "path", "sha256", "parser", "summary", "trace_id")
+_PRODUCTION_REQUIRED_PRIMITIVES = ("claim_judge", "proof_gate", "test_intent_lock")
 
 _REQUIRED_ARTIFACT_TOKENS: dict[str, tuple[str, ...]] = {
     "junit": ("junit", "junit.xml", "surefire"),
@@ -19,6 +20,67 @@ _REQUIRED_ARTIFACT_TOKENS: dict[str, tuple[str, ...]] = {
 }
 
 
+def required_production_primitives() -> tuple[str, ...]:
+    return _PRODUCTION_REQUIRED_PRIMITIVES
+
+
+def production_gate(evidence: dict[str, Any]) -> dict[str, Any]:
+    payload = _as_dict(evidence)
+    blockers: list[str] = []
+
+    primitive_payload = _as_dict(payload.get("claim_judge"))
+    if not primitive_payload:
+        blockers.append("production_gate_missing_claim_judge")
+    else:
+        status = str(primitive_payload.get("status", "")).strip().lower()
+        verdict = str(primitive_payload.get("claim_judge_verdict", primitive_payload.get("verdict", ""))).strip().lower()
+        if status in {"blocked", "error", "fail", "insufficient"} or verdict in {"blocked", "error", "fail", "insufficient"}:
+            blockers.append("production_gate_claim_judge_blocked")
+
+    proof_result = _as_dict(payload.get("proof_gate"))
+    if not proof_result:
+        try:
+            proof_result = evaluate_proof_gate(payload)
+        except Exception:
+            proof_result = {"verdict": "fail", "blockers": ["proof_gate_internal_error"]}
+
+    if not proof_result:
+        blockers.append("production_gate_missing_proof_gate")
+    else:
+        proof_verdict = str(proof_result.get("verdict", "")).strip().lower()
+        if proof_verdict != "pass":
+            proof_blockers = proof_result.get("blockers")
+            if isinstance(proof_blockers, list) and proof_blockers:
+                blockers.extend(
+                    f"production_gate_proof_gate:{str(item).strip()}"
+                    for item in proof_blockers
+                    if str(item).strip()
+                )
+            else:
+                blockers.append("production_gate_proof_gate_failed")
+
+    lock_payload = _as_dict(payload.get("test_intent_lock"))
+    if not lock_payload:
+        blockers.append("production_gate_missing_test_intent_lock")
+    else:
+        lock_status = str(lock_payload.get("status", "")).strip().lower()
+        lock_id = str(lock_payload.get("lock_id", "")).strip()
+        if lock_status in {"blocked", "error", "fail", "insufficient"} or (lock_status not in {"ok", "allowed"} and not lock_id):
+            blockers.append("production_gate_test_intent_lock_unsatisfied")
+
+    unique_blockers = list(dict.fromkeys(item for item in blockers if str(item).strip()))
+    if unique_blockers:
+        return {
+            "status": "blocked",
+            "blockers": unique_blockers,
+            "required_primitives": list(_PRODUCTION_REQUIRED_PRIMITIVES),
+        }
+    return {
+        "status": "ok",
+        "required_primitives": list(_PRODUCTION_REQUIRED_PRIMITIVES),
+    }
+
+
 def evaluate_proof_gate(input: dict[str, Any]) -> dict[str, Any]:
     claims = _as_claims(input.get("claims"))
     proof_chain = _as_dict(input.get("proof_chain"))