@trac3er/oh-my-god 2.2.2 → 2.2.3

package/runtime/claim_judge.py

@@ -9,7 +9,7 @@ from registry.verify_artifact import verify_artifact_statement
 from runtime import artifact_parsers
 from runtime.context_engine import load_profile_digest
 from runtime.evidence_query import get_evidence_pack
-from runtime.evidence_requirements import FULL_REQUIREMENTS, requirements_for_profile
+from runtime.evidence_requirements import FULL_REQUIREMENTS, normalize_profile, resolve_profile, requirements_for_profile
 
 
 def judge_claims(project_dir: str, claims: list[dict[str, Any]]) -> dict[str, Any]:
@@ -133,13 +133,16 @@ def judge_claim(claim: dict[str, Any]) -> dict[str, Any]:
     excluded_failures = _as_non_empty_list(normalized_claim.get("excluded_failures"))
     excluded_failures_waiver_path = str(normalized_claim.get("excluded_failures_waiver_path", "")).strip()
     evidence_profile = str(normalized_claim.get("evidence_profile", "")).strip()
-    evidence_requirements = requirements_for_profile(evidence_profile)
+    evidence_requirements, evidence_profile_error = _resolve_evidence_requirements(evidence_profile)
     requirement_set = {str(item).strip() for item in evidence_requirements if str(item).strip()}
     causal_chain = _as_dict(normalized_claim.get("causal_chain"))
 
     reasons: list[dict[str, Any]] = []
     advisories: list[str] = []
 
+    if evidence_profile_error:
+        reasons.append(evidence_profile_error)
+
     if "tests" in requirement_set and not artifacts:
         reasons.append(
             {
@@ -300,10 +303,41 @@ def _normalize_claim(claim: dict[str, Any]) -> dict[str, Any]:
         "excluded_failures": excluded_failures,
         "excluded_failures_waiver_path": excluded_failures_waiver_path,
         "causal_chain": causal_chain,
-        "evidence_profile": str(claim.get("evidence_profile", evidence.get("evidence_profile", ""))).strip(),
+        "evidence_profile": normalize_profile(str(claim.get("evidence_profile", evidence.get("evidence_profile", ""))).strip()),
     }
 
 
+def _resolve_evidence_requirements(evidence_profile: str) -> tuple[list[str], dict[str, Any] | None]:
+    raw_profile = str(evidence_profile or "").strip()
+    normalized = normalize_profile(raw_profile) if raw_profile else ""
+
+    try:
+        canonical = resolve_profile(normalized or None)
+        return requirements_for_profile(canonical), None
+    except ValueError as exc:
+        payload = _parse_profile_error(exc)
+        reason = {
+            "code": "unknown_evidence_profile",
+            "message": str(payload.get("reason", "unknown_profile")),
+            "field": "evidence_profile",
+            "profile": str(payload.get("profile", raw_profile)).strip(),
+        }
+        return list(FULL_REQUIREMENTS), reason
+
+
+def _parse_profile_error(exc: ValueError) -> dict[str, Any]:
+    raw = str(exc).strip()
+    if not raw:
+        return {}
+    try:
+        payload = json.loads(raw)
+    except json.JSONDecodeError:
+        return {}
+    if isinstance(payload, dict):
+        return payload
+    return {}
+
+
 def _validate_excluded_failures_policy(
     *,
     project_dir: str,

package/runtime/compliance_governor.py

@@ -7,6 +7,8 @@ from typing import Any
 from registry.approval_artifact import load_approval_artifact_from_path, verify_approval_artifact
 from registry.verify_artifact import verify_artifact, verify_tool_attestation
 from runtime.claim_judge import evaluate_claims_for_release
+from runtime.proof_gate import production_gate as evaluate_production_gate
+from runtime.proof_gate import required_production_primitives
 from runtime.runtime_contracts import read_run_state
 
 
@@ -153,6 +155,30 @@ def evaluate_release_compliance(
                 "reason": str(claim_decision.get("reason", "claim_judge_verdict=unknown")),
                 "claim_judge_verdict": str(claim_decision.get("claim_judge_verdict", "")),
             }
+    else:
+        claim_decision = release_evidence.get("claim_judge") if isinstance(release_evidence.get("claim_judge"), dict) else {
+            "status": "blocked",
+            "claim_judge_verdict": "missing",
+            "reason": "claim_judge_missing_claims",
+        }
+
+    release_gate = production_gate(
+        {
+            **release_evidence,
+            "claim_judge": claim_decision,
+        }
+    )
+    if release_gate.get("status") == "blocked":
+        blockers = release_gate.get("blockers")
+        blocker_list = blockers if isinstance(blockers, list) else []
+        return {
+            "status": "blocked",
+            "authority": "production_gate",
+            "reason": "production_gate_blocked",
+            "blockers": blocker_list,
+            "required_primitives": list(required_production_primitives()),
+            **artifact_audit,
+        }
 
     return {
         "status": "allowed",
@@ -162,6 +188,35 @@ def evaluate_release_compliance(
     }
 
 
+def production_gate(evidence: dict[str, Any]) -> dict[str, Any]:
+    payload = evidence if isinstance(evidence, dict) else {}
+    try:
+        gate_result = evaluate_production_gate(payload)
+    except Exception:
+        return {
+            "status": "blocked",
+            "blockers": ["production_gate_internal_error"],
+            "required_primitives": list(required_production_primitives()),
+        }
+
+    status = str(gate_result.get("status", "")).strip().lower()
+    blockers = gate_result.get("blockers")
+    blocker_list = blockers if isinstance(blockers, list) else []
+    if status != "ok":
+        if not blocker_list:
+            blocker_list = ["production_gate_unknown_blocker"]
+        return {
+            "status": "blocked",
+            "blockers": blocker_list,
+            "required_primitives": list(required_production_primitives()),
+        }
+
+    return {
+        "status": "ok",
+        "required_primitives": list(required_production_primitives()),
+    }
+
+
 def evaluate_governed_tool_request(
     *,
     project_dir: str,

package/runtime/context_limits.py

@@ -320,15 +320,27 @@ def get_model_limits(model_id: str) -> ContextLimitEntry:
 
     # 1. Exact match
     if normalized in _REGISTRY:
-        return _REGISTRY[normalized]
+        return _clone_entry(_REGISTRY[normalized])
 
     # 2. Prefix match (longest prefix first via _PREFIX_TABLE ordering)
     for prefix, registry_key in _PREFIX_TABLE:
         if normalized.startswith(prefix.lower()):
-            return _REGISTRY[registry_key]
+            return _clone_entry(_REGISTRY[registry_key])
 
     # 3. Fallback
-    return _FALLBACK
+    return _clone_entry(_FALLBACK)
+
+
+def _clone_entry(entry: ContextLimitEntry) -> ContextLimitEntry:
+    return {
+        "context_tokens": int(entry["context_tokens"]),
+        "output_reserve_tokens": int(entry["output_reserve_tokens"]),
+        "class_label": str(entry["class_label"]),
+        "preflight_counting": bool(entry["preflight_counting"]),
+        "native_compaction": bool(entry["native_compaction"]),
+        "compaction_trigger_default": int(entry["compaction_trigger_default"]),
+        "notes": str(entry["notes"]),
+    }
 
 
 def is_1m_class(model_id: str) -> bool:

package/runtime/contract_compiler.py

@@ -7,7 +7,7 @@ import importlib
 import importlib.util
 import json
 import os
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 import re
 import shutil
@@ -25,8 +25,8 @@ from runtime.proof_chain import _normalize_evidence_pack
 from runtime.evidence_requirements import requirements_for_profile
 from runtime.runtime_contracts import schema_versions
 from runtime.compliance_governor import evaluate_release_compliance
-from runtime.release_run_coordinator import get_active_coordinator_run_id
-from runtime.release_surfaces import get_runtime_behavior_surfaces
+from runtime.release_run_coordinator import get_active_coordinator_run_id, is_release_orchestration_active
+from runtime.release_surfaces import get_package_parity_surfaces, get_runtime_behavior_surfaces
 from runtime.adoption import (
     CANONICAL_MARKETPLACE_ID,
     CANONICAL_PACKAGE_NAME,
@@ -196,6 +196,7 @@ _REQUIRED_EXECUTION_PRIMITIVES = (
     "exec_kernel_state",
     "worker_watchdog_replay",
     "merge_writer_provenance",
+    "write_lease_provenance",
     "tool_fabric_ledger",
     "budget_envelope_state",
     "issue_report",
@@ -1908,6 +1909,7 @@ def _check_host_semantic_parity(
     overall_status = str(report.get("overall_status", "")).strip().lower()
     parity_results = report.get("parity_results", {})
     passed = bool(parity_results.get("passed")) if isinstance(parity_results, dict) else False
+    host_results = parity_results.get("host_results", {}) if isinstance(parity_results, dict) else {}
 
     blockers: list[str] = []
     report_run_id = str(report.get("run_id", "")).strip()
@@ -1919,6 +1921,16 @@ def _check_host_semantic_parity(
         blockers.append(f"host_semantic_parity: report overall_status={overall_status}")
     if isinstance(parity_results, dict) and not passed:
         blockers.append("host_semantic_parity: parity check reported drift")
+    if not isinstance(host_results, dict):
+        blockers.append("host_semantic_parity: report missing host results")
+    else:
+        for host in sorted(canonical_required_hosts):
+            host_result = host_results.get(host)
+            normalized = host_result.get("normalized", {}) if isinstance(host_result, dict) else {}
+            source_class = str(normalized.get("source_class", "")).strip().lower() if isinstance(normalized, dict) else ""
+            source_path = str(normalized.get("source_path", "")).strip() if isinstance(normalized, dict) else ""
+            if source_class != "compiled_or_replayed" or not source_path:
+                blockers.append(f"host_semantic_parity: synthetic payload rejected for {host}")
 
     return {
         "status": "ok" if not blockers else "error",
@@ -2119,6 +2131,10 @@ def build_release_readiness(
     checks["package_smoke"] = package_check
     blockers.extend(package_check.get("blockers", []))
 
+    package_parity = check_package_parity(root)
+    checks["package_parity"] = package_parity
+    blockers.extend(package_parity.get("blockers", []))
+
     plugin_cmd_check = _check_plugin_command_paths(root)
     checks["plugin_command_paths"] = plugin_cmd_check
     blockers.extend(plugin_cmd_check.get("blockers", []))
@@ -2586,6 +2602,10 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
         artifact = evidence_payload.get("artifact")
         if isinstance(artifact, dict):
             release_evidence["artifact"] = artifact
+        for _passthrough_key in ("test_delta", "test_intent_lock", "proof_chain"):
+            _passthrough_value = evidence_payload.get(_passthrough_key)
+            if isinstance(_passthrough_value, dict):
+                release_evidence[_passthrough_key] = _passthrough_value
         compliance = evaluate_release_compliance(
             project_dir=str(output_root),
             run_id=run_id,
@@ -2715,6 +2735,7 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
         "exec_kernel_state",
         "worker_watchdog_replay",
         "merge_writer_provenance",
+        "write_lease_provenance",
         "tool_fabric_ledger",
         "budget_envelope_state",
         "issue_report",
@@ -2741,6 +2762,10 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
             invalid.append(f"{token}:invalid_path")
             blockers.append(f"invalid_execution_primitive: {token}: invalid_path")
             continue
+        if not resolved.exists() and token == "music_omr_testbed_evidence":
+            tracked_candidates = sorted((output_root / "artifacts" / "release" / "evidence").glob("music-omr-*.json"))
+            if tracked_candidates:
+                resolved = tracked_candidates[-1]
         if not resolved.exists():
             missing.append(token)
             blockers.append(f"missing_execution_primitive: {token}")
@@ -2784,6 +2809,59 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
             invalid.append(f"{token}:stale")
             blockers.append(f"stale_execution_primitive: {token}")
 
+    if "music_omr_testbed_evidence" in evidence_paths and evidence_paths["music_omr_testbed_evidence"]:
+        music_omr_path = _resolve_relative_path(
+            output_root=output_root,
+            rel_path=evidence_paths["music_omr_testbed_evidence"],
+        )
+        if music_omr_path is not None:
+            music_omr_payload = _load_json_or_none(music_omr_path)
+            if isinstance(music_omr_payload, dict):
+                run_id_linkage = str(
+                    music_omr_payload.get("trace_metadata", {}).get("run_id_linkage", "")
+                ).strip()
+                if run_id_linkage != run_id:
+                    invalid.append("music_omr_testbed_evidence:run_id_linkage_mismatch")
+                    blockers.append(
+                        "invalid_execution_primitive: music_omr_testbed_evidence: run_id_linkage_mismatch"
+                    )
+
+                freshness_payload = music_omr_payload.get("freshness")
+                freshness_generated_at = ""
+                if isinstance(freshness_payload, dict):
+                    freshness_generated_at = str(freshness_payload.get("generated_at", "")).strip()
+                generated_at = None
+                if freshness_generated_at:
+                    try:
+                        generated_at = datetime.fromisoformat(freshness_generated_at.replace("Z", "+00:00"))
+                    except ValueError:
+                        generated_at = None
+                if generated_at is None:
+                    invalid.append("music_omr_testbed_evidence:payload_freshness_stale")
+                    blockers.append(
+                        "invalid_execution_primitive: music_omr_testbed_evidence: payload_freshness_stale"
+                    )
+                else:
+                    if generated_at.tzinfo is None:
+                        generated_at = generated_at.replace(tzinfo=timezone.utc)
+                    max_age = timedelta(seconds=max(1, max_age_seconds))
+                    if datetime.now(timezone.utc) - generated_at > max_age:
+                        invalid.append("music_omr_testbed_evidence:payload_freshness_stale")
+                        blockers.append(
+                            "invalid_execution_primitive: music_omr_testbed_evidence: payload_freshness_stale"
+                        )
+                if (
+                    is_release_orchestration_active(project_dir=str(output_root))
+                    and "coordinator_run_id" in music_omr_payload
+                ):
+                    coordinator_run_id = str(music_omr_payload.get("coordinator_run_id", "")).strip()
+                    active_coordinator_run_id = get_active_coordinator_run_id(str(output_root)) or ""
+                    if coordinator_run_id != active_coordinator_run_id:
+                        invalid.append("music_omr_testbed_evidence:coordinator_run_id_mismatch")
+                        blockers.append(
+                            "invalid_execution_primitive: music_omr_testbed_evidence: coordinator_run_id_mismatch"
+                        )
+
     return {
         "status": "ok" if not blockers else "error",
         "run_id": run_id,
@@ -2911,6 +2989,10 @@ def _check_claim_judge_compliance(output_root: Path) -> dict[str, Any]:
     artifact = evidence_payload.get("artifact")
     if isinstance(artifact, dict):
         release_evidence["artifact"] = artifact
+    for _pt_key in ("test_delta", "test_intent_lock", "proof_chain"):
+        _pt_val = evidence_payload.get(_pt_key)
+        if isinstance(_pt_val, dict):
+            release_evidence[_pt_key] = _pt_val
     decision = evaluate_release_compliance(
         project_dir=str(output_root),
         run_id=run_id,
@@ -3059,6 +3141,92 @@ def _check_bundle_promotion_parity(root: Path, output_root: Path) -> dict[str, A
     }
 
 
+def check_package_parity(root_path: str | Path) -> dict[str, Any]:
+    root = _resolve_root(root_path)
+    required_surfaces = tuple(get_package_parity_surfaces())
+    machine_blockers: list[dict[str, str]] = []
+    blockers: list[str] = []
+
+    def _add_blocker(*, location: str, surface: str, path: str, reason: str = "missing_surface") -> None:
+        blocker = {
+            "kind": "package_parity_missing",
+            "location": location,
+            "surface": surface,
+            "path": path,
+            "reason": reason,
+        }
+        machine_blockers.append(blocker)
+        blockers.append(
+            f"package_parity_missing: location={location} surface={surface} path={path} reason={reason}"
+        )
+
+    for surface in required_surfaces:
+        source_path = root / ".agents" / "skills" / "omg" / surface / "SKILL.md"
+        if not source_path.exists():
+            _add_blocker(location="source", surface=surface, path=str(source_path.relative_to(root)))
+
+    def _check_bundle_surface_roots(*, location: str, roots: list[Path]) -> None:
+        if not roots:
+            for surface in required_surfaces:
+                _add_blocker(
+                    location=location,
+                    surface=surface,
+                    path=f"{location}/bundle/.agents/skills/omg/{surface}/SKILL.md",
+                    reason="missing_output_location",
+                )
+            return
+        for surface in required_surfaces:
+            found = False
+            for bundle_root in roots:
+                candidate = bundle_root / ".agents" / "skills" / "omg" / surface / "SKILL.md"
+                if candidate.exists():
+                    found = True
+                    break
+            if not found:
+                _add_blocker(
+                    location=location,
+                    surface=surface,
+                    path=f"{location}/bundle/.agents/skills/omg/{surface}/SKILL.md",
+                )
+
+    dist_bundle_roots = [path for path in sorted((root / "dist").glob("*/bundle")) if path.is_dir()]
+    _check_bundle_surface_roots(location="dist", roots=dist_bundle_roots)
+
+    release_bundle_roots = [
+        path for path in sorted((root / "artifacts" / "release" / "dist").glob("*/bundle")) if path.is_dir()
+    ]
+    _check_bundle_surface_roots(location="release", roots=release_bundle_roots)
+
+    wheel_files = sorted((root / "dist").glob("*.whl"))
+    if not wheel_files:
+        for surface in required_surfaces:
+            _add_blocker(
+                location="wheel",
+                surface=surface,
+                path=f"dist/*.whl::.agents/skills/omg/{surface}/SKILL.md",
+                reason="missing_output_location",
+            )
+    else:
+        wheel_path = wheel_files[-1]
+        with zipfile.ZipFile(wheel_path) as archive:
+            names = set(archive.namelist())
+        for surface in required_surfaces:
+            suffix = f".agents/skills/omg/{surface}/SKILL.md"
+            if not any(name.endswith(suffix) for name in names):
+                _add_blocker(
+                    location="wheel",
+                    surface=surface,
+                    path=f"{wheel_path.relative_to(root)}::{suffix}",
+                )
+
+    return {
+        "status": "ok" if not blockers else "error",
+        "required_surfaces": list(required_surfaces),
+        "machine_blockers": machine_blockers,
+        "blockers": blockers,
+    }
+
+
 def _check_packaged_install_smoke(root: Path) -> dict[str, Any]:
     blockers: list[str] = []
     with tempfile.TemporaryDirectory(prefix="omg-wheel-") as tmp_dir:

package/runtime/evidence_query.py

@@ -6,7 +6,11 @@ from pathlib import Path
 from typing import cast
 
 from runtime.context_engine import load_profile_digest
-from runtime.evidence_requirements import EVIDENCE_REQUIREMENTS_BY_PROFILE, requirements_for_profile
+from runtime.evidence_requirements import (
+    EVIDENCE_REQUIREMENTS_BY_PROFILE,
+    requirements_for_profile,
+    resolve_profile,
+)
 
 JsonPrimitive = str | int | float | bool | None
 JsonValue = JsonPrimitive | dict[str, "JsonValue"] | list["JsonValue"]
@@ -53,8 +57,15 @@ def _record_copy_with_context_metadata(root: Path, record: JsonObject) -> JsonOb
     existing_profile_version = _record_string(record, "profile_version")
     profile_version = existing_profile_version or str(profile_digest.get("profile_version", "")).strip()
     evidence_profile = _record_string(record, "evidence_profile").strip()
-    evidence_requirements = requirements_for_profile(evidence_profile)
-    profile_is_known = not evidence_profile or evidence_profile in EVIDENCE_REQUIREMENTS_BY_PROFILE
+    try:
+        resolved = resolve_profile(evidence_profile if evidence_profile else None)
+        evidence_requirements = requirements_for_profile(evidence_profile if evidence_profile else None)
+        profile_is_known = True
+        if resolved is not None:
+            evidence_profile = resolved  # use canonical name
+    except ValueError:
+        evidence_requirements = []
+        profile_is_known = False
 
     intent_gate_payload = _load_json(root / ".omg" / "state" / "intent_gate" / f"{run_id}.json") or {}
     existing_intent_gate_version = _record_string(record, "intent_gate_version")

package/runtime/evidence_requirements.py

@@ -1,6 +1,7 @@
 """Single-source evidence profile requirements registry."""
 from __future__ import annotations
 
+import json
 from typing import Final
 
 FULL_REQUIREMENTS: Final[list[str]] = [
@@ -109,10 +110,48 @@ EVIDENCE_REQUIREMENTS_BY_PROFILE: Final[dict[str, list[str]]] = {
 }
 
 
+def normalize_profile(raw: str) -> str:
+    """Normalize a profile name: strip whitespace and lowercase."""
+    return raw.strip().lower()
+
+
+def resolve_profile(evidence_profile: str | None) -> str | None:
+    """Resolve a profile name to its canonical registry key.
+
+    Returns ``None`` for empty / ``None`` input (caller should use
+    ``FULL_REQUIREMENTS``).  Returns the canonical key for known profiles
+    (exact match first, then normalized).  Raises ``ValueError`` with a
+    machine-readable JSON message for unknown profiles.
+    """
+    if not evidence_profile or not evidence_profile.strip():
+        return None
+
+    # Exact match
+    if evidence_profile in EVIDENCE_REQUIREMENTS_BY_PROFILE:
+        return evidence_profile
+
+    # Normalized match (strip + lowercase)
+    normalized = normalize_profile(evidence_profile)
+    for key in EVIDENCE_REQUIREMENTS_BY_PROFILE:
+        if normalize_profile(key) == normalized:
+            return key
+
+    # Unknown — fail closed with machine-readable error
+    raise ValueError(
+        json.dumps(
+            {"status": "error", "reason": "unknown_profile", "profile": evidence_profile}
+        )
+    )
+
+
 def requirements_for_profile(evidence_profile: str | None) -> list[str]:
-    if not evidence_profile:
-        return list(FULL_REQUIREMENTS)
-    requirements = EVIDENCE_REQUIREMENTS_BY_PROFILE.get(evidence_profile)
-    if not requirements:
+    """Return the evidence requirement list for *evidence_profile*.
+
+    ``None`` / empty  → ``FULL_REQUIREMENTS``.
+    Known profile     → profile-specific list.
+    Unknown profile   → raises ``ValueError`` (machine-readable JSON).
+    """
+    canonical = resolve_profile(evidence_profile)
+    if canonical is None:
         return list(FULL_REQUIREMENTS)
-    return list(requirements)
+    return list(EVIDENCE_REQUIREMENTS_BY_PROFILE[canonical])