@trac3er/oh-my-god 2.2.2 → 2.2.3

package/docs/install/github-app.md

@@ -0,0 +1,80 @@
+# GitHub App Setup
+
+The PR Reviewer Bot uses a GitHub App to securely interact with your repositories. This method is preferred over personal access tokens as it provides fine-grained permissions and short-lived installation tokens.
+
+## Setup
+
+### 1. Create the GitHub App
+1. Navigate to **Settings** -> **Developer settings** -> **GitHub Apps** -> **New GitHub App**.
+2. **GitHub App name**: Choose a unique name (e.g., `OMG-Reviewer-Bot`).
+3. **Homepage URL**: Use your repository URL.
+4. **Webhook**: Uncheck **Active** unless you are using a custom webhook listener.
+5. **Permissions**: Grant the following minimum repository permissions:
+   - **Pull requests**: Read & write (to post reviews and comments)
+   - **Checks**: Read & write (to create check runs)
+   - **Contents**: Read-only (to analyze code)
+6. **Where can this GitHub App be installed?**: Select **Only on this account** or **Any account** based on your needs.
+7. Click **Create GitHub App**.
+
+### 2. Generate Private Key and Installation ID
+1. After creation, scroll down to the **Private keys** section and click **Generate a private key**. A `.pem` file will download.
+2. Note the **App ID** displayed at the top of the app settings page.
+3. Navigate to **Install App** in the sidebar and install it on your target repository or organization.
+4. After installation, the URL will look like `https://github.com/settings/installations/12345678`. The number at the end is your `GITHUB_INSTALLATION_ID`.
+
+### 3. Configure Environment Variables
+The bot requires three configuration variables.
+
+| Variable | Type | Description |
+| :--- | :--- | :--- |
+| `GITHUB_APP_ID` | Config Variable | The App ID from your GitHub App settings. |
+| `GITHUB_APP_PRIVATE_KEY` | Secret | The full content of the downloaded `.pem` file. |
+| `GITHUB_INSTALLATION_ID` | Config Variable | The ID from the installation URL. |
+
+#### Local Development
+Store the private key in a file and load it:
+```bash
+export GITHUB_APP_ID="123456"
+export GITHUB_INSTALLATION_ID="78901234"
+export GITHUB_APP_PRIVATE_KEY="$(cat path/to/your-app.private-key.pem)"
+```
+
+#### GitHub Actions
+Add the App ID and Installation ID as **Variables** and the Private Key as a **Secret**:
+```yaml
+env:
+  GITHUB_APP_ID: ${{ vars.GITHUB_APP_ID }}
+  GITHUB_INSTALLATION_ID: ${{ vars.GITHUB_INSTALLATION_ID }}
+  GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+```
+
+## Security Hardening
+
+### Secret Management
+- **GITHUB_APP_ID**: This is non-sensitive. Store it as a repository or organization configuration variable.
+- **GITHUB_APP_PRIVATE_KEY**: This is highly sensitive. Store it as an encrypted secret. Never commit this key to version control.
+- **Rotation**: Regularly rotate your private keys in the GitHub App settings and delete old, unused keys.
+
+### Execution Safety
+- **Untrusted PRs**: Never expose `GITHUB_APP_PRIVATE_KEY` to `pull_request` event jobs that check out untrusted code. Secrets are unavailable to forks by default, but you must ensure your workflow does not manually bypass this.
+- **Workflow Triggers**: Avoid using `pull_request_target` with an explicit checkout of the PR head if you are using app secrets. This combination can allow malicious PRs to exfiltrate your secrets.
+- **Token Expiry**: The bot caches installation access tokens in memory for the duration of their 1-hour TTL and regenerates automatically when they expire. Do not persist tokens to disk or share them across processes.
+
+## Verify
+
+Confirm your setup with this checklist:
+- [ ] **Token Generation**: Run the bot locally or in a test workflow. It should successfully exchange the JWT for an installation token.
+- [ ] **Review Posting**: Create a test PR. The bot should post a review or comment.
+- [ ] **Stale Review Dismissal**: Push a new commit to the test PR. The bot should dismiss or update its prior approval.
+- [ ] **Permissions**: Verify the bot can only access the repositories it was explicitly installed on.
+
+## Troubleshooting
+
+| Error Code | Cause | Resolution |
+| :--- | :--- | :--- |
+| `GITHUB_CREDENTIALS_MISSING` | One or more env vars are empty. | Check that `GITHUB_APP_ID`, `GITHUB_APP_PRIVATE_KEY`, and `GITHUB_INSTALLATION_ID` are set. |
+| `GITHUB_APP_PRIVATE_KEY_INVALID` | The PEM key is malformed or not RSA. | Ensure the secret contains the full `-----BEGIN RSA PRIVATE KEY-----` block and no extra whitespace. |
+| `GITHUB_JWT_SIGNING_FAILED` | Cryptography error during signing. | Verify your environment has the required dependencies installed. |
+| `GITHUB_TOKEN_REQUEST_FAILED` | Network error or GitHub API downtime. | Check your internet connection and GitHub Status. |
+| `GITHUB_TOKEN_REQUEST_REJECTED` | 403/404 error from GitHub. | Verify the `GITHUB_INSTALLATION_ID` is correct and the app is installed on the repo. |
+| `GITHUB_TOKEN_RESPONSE_INVALID` | Unexpected response from GitHub. | Check if GitHub API versions have changed or if there is a proxy interference. |

package/hooks/context_pressure.py

@@ -13,11 +13,6 @@ except Exception:
 
 
 def _detect_model_id(context_packet=None):
-    for key in ("CLAUDE_MODEL", "OMG_MODEL_ID", "OPENAI_MODEL"):
-        value = os.environ.get(key, "").strip()
-        if value:
-            return value
-
     if isinstance(context_packet, dict):
         model = context_packet.get("model")
         if isinstance(model, dict):
@@ -27,6 +22,22 @@ def _detect_model_id(context_packet=None):
                     return value
         elif isinstance(model, str) and model.strip():
             return model.strip()
+
+        context = context_packet.get("context")
+        if isinstance(context, dict):
+            nested_model = context.get("model")
+            if isinstance(nested_model, dict):
+                for key in ("id", "display_name", "name"):
+                    value = str(nested_model.get(key, "") or "").strip()
+                    if value:
+                        return value
+            elif isinstance(nested_model, str) and nested_model.strip():
+                return nested_model.strip()
+
+    for key in ("CLAUDE_MODEL", "OMG_MODEL_ID", "OPENAI_MODEL"):
+        value = os.environ.get(key, "").strip()
+        if value:
+            return value
     return ""
 
 
@@ -38,20 +49,21 @@ def _host_aware_threshold(context_packet=None):
 
 
 def estimate_context_pressure(project_dir, context_packet=None):
-    threshold, model_id, limits = _host_aware_threshold(context_packet)
+    threshold_tokens, model_id, limits = _host_aware_threshold(context_packet)
     try:
         settings_path = os.path.join(project_dir, "settings.json")
         if os.path.exists(settings_path):
             with open(settings_path, "r", encoding="utf-8") as settings_file:
                 settings = json.load(settings_file)
             configured = settings.get("_omg", {}).get("context_budget", {}).get(
-                "pressure_threshold", threshold
+                "pressure_threshold", threshold_tokens
             )
-            threshold = int(configured)
+            threshold_tokens = int(configured)
     except Exception:
         pass
 
     tool_count = 0
+    estimated_tokens = 0
     ledger_path = os.path.join(project_dir, ".omg", "state", "ledger", "tool-ledger.jsonl")
     if os.path.exists(ledger_path):
         try:
@@ -59,10 +71,11 @@ def estimate_context_pressure(project_dir, context_packet=None):
                 for line in ledger_file:
                     if line.strip():
                         tool_count += 1
+                        estimated_tokens += _estimate_entry_tokens(line)
         except Exception:
             pass
 
-    is_high = tool_count >= threshold
+    is_high = estimated_tokens >= threshold_tokens if threshold_tokens > 0 else False
 
     try:
         pressure_path = os.path.join(project_dir, ".omg", "state", ".context-pressure.json")
@@ -71,7 +84,9 @@ def estimate_context_pressure(project_dir, context_packet=None):
             json.dump(
                 {
                     "tool_count": tool_count,
-                    "threshold": threshold,
+                    "estimated_tokens": estimated_tokens,
+                    "threshold": threshold_tokens,
+                    "threshold_tokens": threshold_tokens,
                     "model_id": model_id,
                     "class_label": limits.get("class_label", "128k-class"),
                     "is_high": is_high,
@@ -82,4 +97,23 @@ def estimate_context_pressure(project_dir, context_packet=None):
     except Exception:
         pass
 
-    return tool_count, threshold, is_high
+    return tool_count, threshold_tokens, is_high
+
+
+def _estimate_entry_tokens(line: str) -> int:
+    baseline = max(1, len(line) // 4)
+    try:
+        entry = json.loads(line)
+    except Exception:
+        return baseline
+
+    if not isinstance(entry, dict):
+        return baseline
+
+    command_chars = len(str(entry.get("command", "")))
+    stdout_chars = len(str(entry.get("stdout_snippet", "")))
+    file_chars = len(str(entry.get("file", "")))
+    metadata_chars = len(str(entry.get("tool", ""))) + len(str(entry.get("governed_tool", "")))
+    char_total = command_chars + stdout_chars + file_chars + metadata_chars
+    estimated = max(baseline, char_total // 4)
+    return max(1, estimated)

package/hooks/pre-compact.py

@@ -232,32 +232,32 @@ def _load_context_budget_config(project_dir):
 
 
 def _detect_model_id(data):
+    if isinstance(data, dict):
+        model = data.get("model")
+        if isinstance(model, dict):
+            for key in ("id", "display_name", "name"):
+                value = str(model.get(key, "") or "").strip()
+                if value:
+                    return value
+        elif isinstance(model, str) and model.strip():
+            return model.strip()
+
+        context = data.get("context")
+        if isinstance(context, dict):
+            nested_model = context.get("model")
+            if isinstance(nested_model, dict):
+                for key in ("id", "display_name", "name"):
+                    value = str(nested_model.get(key, "") or "").strip()
+                    if value:
+                        return value
+            elif isinstance(nested_model, str) and nested_model.strip():
+                return nested_model.strip()
+
     for key in ("CLAUDE_MODEL", "OMG_MODEL_ID", "OPENAI_MODEL"):
         value = os.environ.get(key, "").strip()
         if value:
             return value
 
-    if not isinstance(data, dict):
-        return ""
-
-    model = data.get("model")
-    if isinstance(model, dict):
-        for key in ("id", "display_name", "name"):
-            value = str(model.get(key, "") or "").strip()
-            if value:
-                return value
-    elif isinstance(model, str) and model.strip():
-        return model.strip()
-
-    context = data.get("context")
-    if isinstance(context, dict):
-        nested_model = context.get("model")
-        if isinstance(nested_model, dict):
-            for key in ("id", "display_name", "name"):
-                value = str(nested_model.get(key, "") or "").strip()
-                if value:
-                    return value
-
     return ""
 
 

package/hud/omg-hud.mjs

@@ -87,7 +87,7 @@ function readOmgVersion() {
     // fall through to static fallback
   }
 
-  return "2.2.2";
+  return "2.2.3";
 }
 
 const OMG_VERSION = readOmgVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trac3er/oh-my-god",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "OMG (Oh My God) — Multi-agent orchestration, evidence-backed verification, and durable session state for Claude Code, Codex, and supported agent hosts",
   "main": "OMG-setup.sh",
   "scripts": {

package/plugins/advanced/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-advanced",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "Advanced OMG commands - deep planning, learning, code review, and specialized workflows",
   "type": "omg-plugin",
   "commands": {

package/plugins/core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-core",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "Core OMG commands - native setup, routing, orchestration, and verification surfaces",
   "type": "omg-plugin",
   "commands": {

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "oh-my-god"
-version = "2.2.2"
+version = "2.2.3"
 description = "OMG (Oh My God) — Multi-agent orchestration, evidence-backed verification, and durable session state for Claude Code, Codex, and supported agent hosts"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -26,6 +26,7 @@ classifiers = [
 dependencies = [
     "cryptography>=44.0",
     "fastmcp>=2.0",
+    "requests>=2.28",
 ]
 
 [project.optional-dependencies]
@@ -50,7 +51,7 @@ include-package-data = true
 
 [tool.setuptools.packages.find]
 where = ["."]
-include = ["agents*", "commands*", "control_plane*", "hooks*", "plugins*", "registry*", "runtime*"]
+include = ["agents*", "commands*", "control_plane*", "hooks*", "lab*", "plugins*", "registry*", "runtime*"]
 
 [tool.setuptools.package-data]
 agents = ["*.md"]
@@ -87,6 +88,9 @@ runtime = ["*.json"]
 ".agents/skills/omg/claim-judge" = [".agents/skills/omg/claim-judge/SKILL.md", ".agents/skills/omg/claim-judge/openai.yaml"]
 ".agents/skills/omg/test-intent-lock" = [".agents/skills/omg/test-intent-lock/SKILL.md", ".agents/skills/omg/test-intent-lock/openai.yaml"]
 ".agents/skills/omg/proof-gate" = [".agents/skills/omg/proof-gate/SKILL.md", ".agents/skills/omg/proof-gate/openai.yaml"]
+".agents/skills/omg/hash-edit" = [".agents/skills/omg/hash-edit/SKILL.md", ".agents/skills/omg/hash-edit/openai.yaml"]
+".agents/skills/omg/ast-pack" = [".agents/skills/omg/ast-pack/SKILL.md", ".agents/skills/omg/ast-pack/openai.yaml"]
+".agents/skills/omg/terminal-lane" = [".agents/skills/omg/terminal-lane/SKILL.md", ".agents/skills/omg/terminal-lane/openai.yaml"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

package/registry/bundles/algorithms.yaml

@@ -1,6 +1,6 @@
 id: algorithms
 kind: domain-pack
-version: 2.2.2
+version: 2.2.3
 title: OMG Algorithms Pack
 description: Determinism and benchmark attachments for algorithm-heavy work.
 hosts:

package/registry/bundles/api-twin.yaml

@@ -1,6 +1,6 @@
 id: api-twin
 kind: simulation
-version: 2.2.2
+version: 2.2.3
 title: OMG API Twin
 description: Versioned endpoint cassette replay with latency, drift, and cost reporting.
 hosts:

package/registry/bundles/ast-pack.yaml

@@ -1,6 +1,6 @@
 id: ast-pack
 kind: governance
-version: 2.2.2
+version: 2.2.3
 title: OMG AST Pack Lane
 description: Governed AST search and replace lane with canonical approvals and proofs.
 hosts:

package/registry/bundles/claim-judge.yaml

@@ -1,6 +1,6 @@
 id: claim-judge
 kind: proof
-version: 2.2.2
+version: 2.2.3
 title: OMG Claim Judge
 description: Evidence-backed claim validator for structured release and completion claims.
 hosts:

package/registry/bundles/control-plane.yaml

@@ -1,6 +1,6 @@
 id: control-plane
 kind: skill
-version: 2.2.2
+version: 2.2.3
 title: OMG Control Plane
 description: Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi.
 hosts:

package/registry/bundles/data-lineage.yaml

@@ -1,6 +1,6 @@
 id: data-lineage
 kind: provenance
-version: 2.2.2
+version: 2.2.3
 title: OMG Data Lineage
 description: Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts.
 hosts:

package/registry/bundles/delta-classifier.yaml

@@ -1,6 +1,6 @@
 id: delta-classifier
 kind: routing
-version: 2.2.2
+version: 2.2.3
 title: OMG Delta Classifier
 description: Change classifier that attaches risk-aware checks, approvals, and packs.
 hosts:

package/registry/bundles/eval-gate.yaml

@@ -1,6 +1,6 @@
 id: eval-gate
 kind: evaluation
-version: 2.2.2
+version: 2.2.3
 title: OMG Eval Gate
 description: Reproducible evaluation gate that blocks regressions before release.
 hosts:

package/registry/bundles/hash-edit.yaml

@@ -1,6 +1,6 @@
 id: hash-edit
 kind: governance
-version: 2.2.2
+version: 2.2.3
 title: OMG Hash Edit Lane
 description: Governed hash-bound edit lane with signed approvals and evidence routing.
 hosts:

package/registry/bundles/health.yaml

@@ -1,6 +1,6 @@
 id: health
 kind: domain-pack
-version: 2.2.2
+version: 2.2.3
 title: OMG Health Pack
 description: Health-sensitive approvals, provenance, and replay attachments.
 hosts:

package/registry/bundles/hook-governor.yaml

@@ -1,6 +1,6 @@
 id: hook-governor
 kind: governance
-version: 2.2.2
+version: 2.2.3
 title: OMG Hook Governor
 description: Canonical hook ordering, policy reinjection, and protected-path governance.
 hosts:

package/registry/bundles/incident-replay.yaml

@@ -1,6 +1,6 @@
 id: incident-replay
 kind: debugging
-version: 2.2.2
+version: 2.2.3
 title: OMG Incident Replay
 description: Replayable bug packs built from logs, failing tests, traces, and diffs.
 hosts:

package/registry/bundles/lsp-pack.yaml

@@ -1,6 +1,6 @@
 id: lsp-pack
 kind: diagnostics
-version: 2.2.2
+version: 2.2.3
 title: OMG LSP Pack
 description: Optional LSP-backed diagnostics and navigation bundle for production verification.
 hosts:

package/registry/bundles/mcp-fabric.yaml

@@ -1,6 +1,6 @@
 id: mcp-fabric
 kind: mcp
-version: 2.2.2
+version: 2.2.3
 title: OMG MCP Fabric
 description: Tools, prompts, resources, and server instructions for the OMG control plane.
 hosts:

package/registry/bundles/plan-council.yaml

@@ -1,6 +1,6 @@
 id: plan-council
 kind: planning
-version: 2.2.2
+version: 2.2.3
 title: OMG Plan Council
 description: Canonical council-style planning bundle for explicit, evidence-backed deep plans.
 hosts:

package/registry/bundles/preflight.yaml

@@ -1,6 +1,6 @@
 id: preflight
 kind: routing
-version: 2.2.2
+version: 2.2.3
 title: OMG Preflight
 description: Repo-aware route selection based on diff, manifests, and classified risk.
 hosts:

package/registry/bundles/proof-gate.yaml

@@ -1,6 +1,6 @@
 id: proof-gate
 kind: proof
-version: 2.2.2
+version: 2.2.3
 title: OMG Proof Gate
 description: Structured release proof gate that binds claims to required evidence artifacts and trace links.
 hosts:

package/registry/bundles/remote-supervisor.yaml

@@ -1,6 +1,6 @@
 id: remote-supervisor
 kind: orchestration
-version: 2.2.2
+version: 2.2.3
 title: OMG Remote Supervisor
 description: Local-only authenticated supervisor sessions for worker orchestration.
 hosts:

package/registry/bundles/robotics.yaml

@@ -1,6 +1,6 @@
 id: robotics
 kind: domain-pack
-version: 2.2.2
+version: 2.2.3
 title: OMG Robotics Pack
 description: Robotics safety policy, replay, and evaluation attachments.
 hosts:

package/registry/bundles/secure-worktree-pipeline.yaml

@@ -1,6 +1,6 @@
 id: secure-worktree-pipeline
 kind: runtime
-version: 2.2.2
+version: 2.2.3
 title: OMG Secure Worktree Pipeline
 description: Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs.
 hosts:

package/registry/bundles/security-check.yaml

@@ -1,6 +1,6 @@
 id: security-check
 kind: security
-version: 2.2.2
+version: 2.2.3
 title: OMG Security Check
 description: Canonical security audit bundle with provenance, trust scoring, and deterministic evidence.
 hosts:

package/registry/bundles/terminal-lane.yaml

@@ -1,6 +1,6 @@
 id: terminal-lane
 kind: governance
-version: 2.2.2
+version: 2.2.3
 title: OMG Terminal Lane
 description: Highest-risk governed terminal execution lane with strict approval and attestation.
 hosts:

package/registry/bundles/test-intent-lock.yaml

@@ -1,6 +1,6 @@
 id: test-intent-lock
 kind: proof
-version: 2.2.2
+version: 2.2.3
 title: OMG Test Intent Lock
 description: Structured test-delta guard that blocks weakened tests unless explicit override evidence is present.
 hosts:

package/registry/bundles/tracebank.yaml

@@ -1,6 +1,6 @@
 id: tracebank
 kind: evidence
-version: 2.2.2
+version: 2.2.3
 title: OMG Tracebank
 description: Structured plan-to-patch-to-verify trace capture for OMG routes.
 hosts:

package/registry/bundles/vision.yaml

@@ -1,6 +1,6 @@
 id: vision
 kind: domain-pack
-version: 2.2.2
+version: 2.2.3
 title: OMG Vision Pack
 description: Vision-specific OCR, comparison, lineage, drift, and replay attachments.
 hosts:

package/registry/omg-capability.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
   "title": "OMG Capability Bundle",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "type": "object",
   "required": [
     "id",

package/runtime/adoption.py

@@ -13,7 +13,7 @@ CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.2.2"
+CANONICAL_VERSION = "2.2.3"
 
 VALID_ADOPTION_MODES = ("omg-only", "coexist")
 CANONICAL_MODE_NAMES = ("chill", "focused", "exploratory")

package/runtime/background_verification.py

@@ -73,7 +73,9 @@ def should_skip_validation(evidence_profile: str | None, stage: str) -> bool:
 
     Rules:
     - ``release`` and ``security-audit`` profiles NEVER skip any stage.
-    - ``None``, empty, or unknown profiles fall back to FULL_REQUIREMENTS (no skip).
+    - ``None`` or empty profiles use FULL_REQUIREMENTS (no skip).
+    - Unknown profiles fail closed (no skip) — the error is surfaced by
+      :func:`resolve_evidence_profile` instead.
     - For other profiles, a stage is skipped when it is NOT in that profile's
       requirement list.
     """
@@ -85,10 +87,50 @@ def should_skip_validation(evidence_profile: str | None, stage: str) -> bool:
     if profile in _NEVER_SKIP_PROFILES:
         return False
 
-    required = requirements_for_profile(profile if profile else None)
+    try:
+        required = requirements_for_profile(profile if profile else None)
+    except ValueError:
+        # Unknown profile: fail closed — don't skip any validation
+        return False
     return stage not in required
 
 
+def resolve_evidence_profile(evidence_profile: str | None) -> dict[str, Any]:
+    """Resolve an evidence profile with strict validation.
+
+    Returns a structured dict:
+    - Success: ``{"status": "ok", "profile": <canonical>, "requirements": [...]}``
+    - Failure: ``{"status": "error", "reason": "unknown_profile", "profile": <raw>}``
+    """
+    from runtime.evidence_requirements import (
+        FULL_REQUIREMENTS,
+        resolve_profile,
+        requirements_for_profile,
+    )
+
+    raw = (evidence_profile or "").strip()
+    if not raw:
+        return {
+            "status": "ok",
+            "profile": None,
+            "requirements": list(FULL_REQUIREMENTS),
+        }
+
+    try:
+        canonical = resolve_profile(raw)
+        return {
+            "status": "ok",
+            "profile": canonical,
+            "requirements": requirements_for_profile(raw),
+        }
+    except ValueError:
+        return {
+            "status": "error",
+            "reason": "unknown_profile",
+            "profile": raw,
+        }
+
+
 def skipped_stages_for_profile(evidence_profile: str | None) -> list[str]:
     """Return the list of stages that WOULD be skipped for a given profile.
 

package/runtime/canonical_surface.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from typing import Final
 
-from runtime.evidence_requirements import EVIDENCE_REQUIREMENTS_BY_PROFILE
+from runtime.evidence_requirements import EVIDENCE_REQUIREMENTS_BY_PROFILE, normalize_profile
 
 CANONICAL_PARITY_HOSTS: Final[list[str]] = ["claude", "codex", "gemini", "kimi"]
 COMPATIBILITY_ONLY_HOSTS: Final[list[str]] = ["opencode"]
@@ -13,8 +13,9 @@ DOMAIN_DEFAULTS: Final[dict[str, tuple[str, ...]]] = {
 }
 
 def _release_evidence_profile_labels() -> dict[str, str]:
+    """Generate release labels synchronized with the normalized profile registry."""
     return {
-        profile.replace("-", "_"): profile
+        normalize_profile(profile).replace("-", "_"): profile
         for profile in EVIDENCE_REQUIREMENTS_BY_PROFILE
     }