@trac3er/oh-my-god 2.2.2 → 2.2.3

package/runtime/providers/codex_provider.py

@@ -13,6 +13,7 @@ from typing import Any
 from runtime.cli_provider import CLIProvider, register_provider
 from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_codex_mcp_config
+from runtime.release_run_coordinator import build_release_env_prefix
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
@@ -91,7 +92,7 @@ class CodexProvider(CLIProvider):
             output = mgr.send_command(
                 session,
                 (
-                    f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+                    f"{build_release_env_prefix(project_dir)}"
                     f"codex exec --json {shlex.quote(prompt)}"
                 ),
                 timeout=timeout,

package/runtime/providers/gemini_provider.py

@@ -13,6 +13,7 @@ from typing import Any
 from runtime.cli_provider import CLIProvider, register_provider
 from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_gemini_mcp_config
+from runtime.release_run_coordinator import build_release_env_prefix
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
@@ -101,7 +102,7 @@ class GeminiProvider(CLIProvider):
             output = mgr.send_command(
                 session,
                 (
-                    f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+                    f"{build_release_env_prefix(project_dir)}"
                     f"gemini -p {shlex.quote(prompt)}"
                 ),
                 timeout=timeout,

package/runtime/providers/kimi_provider.py

@@ -13,6 +13,7 @@ from typing import Any
 from runtime.cli_provider import CLIProvider, register_provider
 from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_kimi_mcp_config
+from runtime.release_run_coordinator import build_release_env_prefix
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
@@ -126,7 +127,7 @@ class KimiCodeProvider(CLIProvider):
             output = mgr.send_command(
                 session,
                 (
-                    f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+                    f"{build_release_env_prefix(project_dir)}"
                     f"kimi --print -p {shlex.quote(prompt)}"
                 ),
                 timeout=timeout,

package/runtime/release_run_coordinator.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 from dataclasses import dataclass
 import json
 import os
+import shlex
 from pathlib import Path
 from types import ModuleType
 from typing import cast
@@ -18,7 +19,7 @@ from runtime.verification_controller import VerificationController
 from runtime.claim_judge import evaluate_claims_for_release
 from runtime.exec_kernel import get_exec_kernel
 from runtime.worker_watchdog import get_worker_watchdog
-from runtime.merge_writer import get_merge_writer
+from runtime.merge_writer import get_merge_writer, create_write_lease, is_lease_valid, WriteLease
 
 
 class RunIdConflictError(ValueError):
@@ -32,15 +33,20 @@ class ResolvedRunId:
     reason: str
 
 
+_DEFAULT_LEASE_DURATION_S = 3600.0  # 1 hour default lease
+
+
 class ReleaseRunCoordinator:
     project_dir: str
     _verification: VerificationController
     _journal: InteractionJournal
+    _active_lease: WriteLease | None
 
     def __init__(self, project_dir: str):
         self.project_dir = str(Path(project_dir).resolve())
         self._verification = VerificationController(self.project_dir)
         self._journal = InteractionJournal(self.project_dir)
+        self._active_lease = None
 
     def begin(self, cli_run_id: str | None = None, release_evidence: dict[str, object] | None = None) -> dict[str, object]:
         resolved = self.resolve_run_id(cli_run_id=cli_run_id, release_evidence=release_evidence)
@@ -79,6 +85,15 @@ class ReleaseRunCoordinator:
             merge_writer_token = token.lock_path
         except Exception:
             pass
+        # Create a run-scoped write lease bound to this release run
+        evidence_path = str(
+            Path(".omg") / "evidence" / f"merge-writer-{run_id}.json"
+        )
+        self._active_lease = create_write_lease(
+            run_id=run_id,
+            duration_s=_DEFAULT_LEASE_DURATION_S,
+            evidence_path=evidence_path,
+        )
         result: dict[str, object] = {
             "status": "running",
             "run_id": run_id,
@@ -87,6 +102,8 @@ class ReleaseRunCoordinator:
         }
         if merge_writer_token:
             result["merge_writer_lock"] = merge_writer_token
+        if self._active_lease:
+            result["write_lease_evidence"] = self._active_lease.evidence_path
         return result
 
     def mutate(
@@ -308,6 +325,8 @@ class ReleaseRunCoordinator:
                 mw.release(token)
         except Exception:
             pass
+        # Invalidate the write lease — leases do not survive across runs
+        self._active_lease = None
         return {
             "status": str(verification_state.get("status", resolved_status)),
             "run_id": canonical_run_id,
@@ -317,6 +336,20 @@ class ReleaseRunCoordinator:
             "rollback_path": rollback_path,
         }
 
+    def check_write_lease(self, run_id: str) -> dict[str, object]:
+        """Check write-lease validity for *run_id*.
+
+        Returns a dict with ``valid`` (bool), ``reason`` (str), and
+        optionally ``evidence_path``.
+        """
+        if self._active_lease is None:
+            return {"valid": False, "reason": "no_active_write_lease"}
+        valid, reason = is_lease_valid(self._active_lease, run_id)
+        result: dict[str, object] = {"valid": valid, "reason": reason}
+        if valid:
+            result["evidence_path"] = self._active_lease.evidence_path
+        return result
+
     def resolve_run_id(
         self,
         *,
@@ -462,6 +495,32 @@ def resolve_current_run_id(project_dir: str | None = None, cli_run_id: str | Non
     return resolved.run_id or None
 
 
+def is_release_orchestration_active(project_dir: str | None = None) -> bool:
+    """Return True only when BOTH conditions hold: an active coordinator run exists AND the env flag is set."""
+    return (
+        bool(get_active_coordinator_run_id(project_dir=project_dir))
+        and os.environ.get("OMG_RELEASE_ORCHESTRATION_ACTIVE", "").strip() == "1"
+    )
+
+
+def build_release_env_prefix(project_dir: str) -> str:
+    """Build a tmux-safe ``env KEY=VALUE ...`` prefix string.
+
+    Always includes ``CLAUDE_PROJECT_DIR``.  Conditionally includes
+    ``OMG_RELEASE_ORCHESTRATION_ACTIVE`` and ``OMG_RUN_ID`` when those
+    variables are set in the parent process environment.
+
+    Returns the prefix string ending with a trailing space.
+    """
+    parts = [f"CLAUDE_PROJECT_DIR={shlex.quote(project_dir)}"]
+    if os.environ.get("OMG_RELEASE_ORCHESTRATION_ACTIVE", "").strip() == "1":
+        parts.append(f"OMG_RELEASE_ORCHESTRATION_ACTIVE={shlex.quote('1')}")
+    run_id = os.environ.get("OMG_RUN_ID", "").strip()
+    if run_id:
+        parts.append(f"OMG_RUN_ID={shlex.quote(run_id)}")
+    return f"env {' '.join(parts)} "
+
+
 def get_active_coordinator_run_id(project_dir: str | None = None) -> str | None:
     root = _project_dir(project_dir)
     shadow = _read_shadow_run_id(str(root))

package/runtime/release_surfaces.py

@@ -83,6 +83,13 @@ _BUNDLE_NAMES: tuple[str, ...] = (
 )
 
 
+REQUIRED_PACKAGE_PARITY_SURFACES: tuple[str, ...] = (
+    "hash-edit",
+    "ast-pack",
+    "terminal-lane",
+)
+
+
 # ── Authored surfaces: explicit, no dynamic discovery ──────────────────────
 
 AUTHORED_SURFACES: list[AuthoredSurface] = [
@@ -99,6 +106,26 @@ AUTHORED_SURFACES: list[AuthoredSurface] = [
         "settings.json", "json_key_path", ["_omg", "generated", "contract_version"],
         "OMG generated contract version",
     ),
+    AuthoredSurface(
+        ".gemini/settings.json", "json_key_path", ["_omg", "_version"],
+        "Gemini settings OMG version",
+        source_only=False,
+    ),
+    AuthoredSurface(
+        ".gemini/settings.json", "json_key_path", ["_omg", "generated", "contract_version"],
+        "Gemini settings contract version",
+        source_only=False,
+    ),
+    AuthoredSurface(
+        ".kimi/mcp.json", "json_key_path", ["_omg", "_version"],
+        "Kimi MCP OMG version",
+        source_only=False,
+    ),
+    AuthoredSurface(
+        ".kimi/mcp.json", "json_key_path", ["_omg", "generated", "contract_version"],
+        "Kimi MCP contract version",
+        source_only=False,
+    ),
     AuthoredSurface(
         ".claude-plugin/plugin.json", "json_key_path", ["version"],
         "Claude plugin version",
@@ -275,6 +302,10 @@ def get_runtime_behavior_surfaces() -> list[str]:
     return list(RUNTIME_BEHAVIOR_SURFACES)
 
 
+def get_package_parity_surfaces() -> list[str]:
+    return list(REQUIRED_PACKAGE_PARITY_SURFACES)
+
+
 def surface_applies_to_root(surface: AuthoredSurface, root_dir: Path) -> bool:
     """Return whether a surface should be enforced for the given root layout."""
     if not surface.source_only:

package/runtime/team_router.py

@@ -41,7 +41,7 @@ except ImportError:
 
 from runtime.runtime_profile import resolve_parallel_workers
 from runtime.runtime_contracts import write_run_state
-from runtime.release_run_coordinator import resolve_current_run_id as resolve_coordinator_run_id
+from runtime.release_run_coordinator import resolve_current_run_id as resolve_coordinator_run_id, build_release_env_prefix
 from runtime.exec_kernel import get_exec_kernel
 from runtime.context_engine import ContextEngine
 from runtime.context_engine import _extract_clarification
@@ -489,7 +489,7 @@ def invoke_codex_tmux(prompt: str, project_dir: str, timeout: int = 120) -> dict
         session = mgr.get_or_create_session(session_name, cwd=project_dir)
         quoted_prompt = shlex.quote(prompt)
         cmd = (
-            f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+            f"{build_release_env_prefix(project_dir)}"
             f"codex exec --json {quoted_prompt}; "
             f"printf '\\n{_TMUX_EXIT_MARKER}:%s\\n' \"$?\""
         )
@@ -540,7 +540,7 @@ def invoke_gemini_tmux(prompt: str, project_dir: str, timeout: int = 120) -> dic
         session = mgr.get_or_create_session(session_name, cwd=project_dir)
         quoted_prompt = shlex.quote(prompt)
         cmd = (
-            f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+            f"{build_release_env_prefix(project_dir)}"
             f"gemini -p {quoted_prompt}; "
             f"printf '\\n{_TMUX_EXIT_MARKER}:%s\\n' \"$?\""
         )

package/runtime/test_intent_lock.py

@@ -150,6 +150,8 @@ def verify_done_when(metadata: dict[str, Any] | None, run_id: str | None) -> dic
             "status": "missing_done_when",
             "reason": "done_when_required",
             "run_id": str(run_id or "").strip() or None,
+            "done_when_declared": False,
+            "done_when_completed": False,
         }
 
     done_when_run_id = _extract_done_when_run_id(metadata_obj.get("done_when"))
@@ -159,13 +161,21 @@ def verify_done_when(metadata: dict[str, Any] | None, run_id: str | None) -> dic
             "status": "done_when_contract_mismatch",
             "reason": "done_when_run_id_mismatch",
             "run_id": normalized_run_id,
+            "done_when_declared": True,
+            "done_when_completed": False,
         }
 
+    completion_state = _extract_done_when_completion_state(metadata_obj)
+    done_when_completed = completion_state == "completed"
+
     return {
         "status": "ok",
         "reason": "done_when_present",
         "run_id": normalized_run_id or done_when_run_id or None,
         "done_when": criteria,
+        "done_when_declared": True,
+        "done_when_completed": done_when_completed,
+        "done_when_state": completion_state,
     }
 
 
@@ -347,6 +357,21 @@ def _extract_done_when_run_id(value: Any) -> str:
     return ""
 
 
+def _extract_done_when_completion_state(metadata: dict[str, Any]) -> str:
+    metadata_state = str(metadata.get("done_when_state", "")).strip().lower()
+    if metadata_state in {"declared", "completed"}:
+        return metadata_state
+
+    done_when = metadata.get("done_when")
+    if isinstance(done_when, dict):
+        done_when_state = str(done_when.get("state", "")).strip().lower()
+        if done_when_state in {"declared", "completed"}:
+            return done_when_state
+        if done_when.get("completed") is True:
+            return "completed"
+    return "declared"
+
+
 def _selector_to_path(selector: str) -> str:
     return selector.split("::", 1)[0].strip()
 

package/runtime/tool_plan_gate.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import os
+import re
 from collections.abc import Mapping
 from datetime import datetime, timezone
 from pathlib import Path
@@ -13,6 +14,7 @@ from runtime.compliance_governor import classify_bash_command_mode, evaluate_too
 from runtime.complexity_scorer import score_complexity
 from runtime.release_run_coordinator import (
     get_active_coordinator_run_id,
+    is_release_orchestration_active,
     resolve_current_run_id as resolve_coordinator_run_id,
 )
 from runtime.runtime_contracts import read_run_state
@@ -26,6 +28,13 @@ _TOOL_KEYWORDS: dict[str, tuple[str, ...]] = {
     "omg-control": ("policy", "governance", "release", "proof", "control plane"),
 }
 _MUTATION_TOOLS = frozenset({"write", "edit", "multiedit", "bash"})
+_READ_ONLY_BASH_ALLOWLIST = (
+    re.compile(r"^python\d?(?:\s+-[vV]{1,2}|\s+--version)(?:\s|$)"),
+    re.compile(r"^git\s+status(?:\s|$)"),
+    re.compile(r"^gh\s+pr\s+view(?:\s|$)"),
+    re.compile(r"^(?:.+\|\s*)?tee\s+/dev/null(?:\s|$)"),
+)
+_FULLY_QUOTED_PATTERN = re.compile(r"^\s*([\"']).*\1\s*$")
 
 def build_tool_plan(
     goal: str,
@@ -155,6 +164,13 @@ def tool_plan_gate_check(
                 "tool": tool,
             }
 
+        if is_release_orchestration_active(project_dir=project_dir):
+            return {
+                **decision,
+                "run_id": effective_run_id,
+                "tool": tool,
+            }
+
         metadata = _extract_metadata(tool_input_obj)
         done_when_verdict = verify_done_when(metadata, run_id=effective_run_id)
         if done_when_verdict.get("status") != "ok":
@@ -396,10 +412,26 @@ def _clarification_status(context_packet: dict[str, object]) -> dict[str, object
 def _is_mutation_capable_tool(tool: str, tool_input: dict[str, object]) -> bool:
     token = str(tool or "").strip().lower()
     if token == "bash":
-        return classify_bash_command_mode(str(tool_input.get("command", ""))) == "mutation"
+        command = str(tool_input.get("command", "")).strip()
+        lowered = command.lower()
+        if _is_allowlisted_read_only_bash(lowered):
+            return False
+        return classify_bash_command_mode(command) == "mutation"
     return token in _MUTATION_TOOLS
 
 
+def _is_allowlisted_read_only_bash(command: str) -> bool:
+    stripped = command.strip()
+    if not stripped:
+        return True
+    if _FULLY_QUOTED_PATTERN.match(stripped):
+        return True
+    for pattern in _READ_ONLY_BASH_ALLOWLIST:
+        if pattern.search(stripped):
+            return True
+    return False
+
+
 def _extract_metadata(tool_input: dict[str, object]) -> dict[str, object]:
     metadata = tool_input.get("metadata")
     if isinstance(metadata, dict):

package/runtime/vision_jobs.py

@@ -7,7 +7,10 @@ import itertools
 from pathlib import Path
 from typing import Any
 
-from omg_natives.image import image
+try:
+    from omg_natives.image import image
+except ImportError:
+    image = None  # omg_natives is an optional dependency
 
 from runtime.vision_artifacts import write_vision_artifacts
 from runtime.vision_cache import build_cache_key, load_cached_result, store_cached_result

package/scripts/github_review_helpers.py

@@ -0,0 +1,241 @@
+#!/usr/bin/env python3
+# pyright: reportExplicitAny=false, reportAny=false, reportUnknownVariableType=false, reportUnknownMemberType=false, reportUnknownArgumentType=false, reportUnusedCallResult=false
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+from typing import Any
+
+from runtime.github_review_bot import GitHubReviewBot
+
+
+REQUIRED_PR_ARTIFACTS = (
+    "omg-compat-gap.json",
+    "omg-compat-contracts.json",
+    "public/.omg/evidence/doctor.json",
+    "public/dist/public/manifest.json",
+)
+
+
+def _read_json(path: Path) -> dict[str, Any]:
+    payload = json.loads(path.read_text(encoding="utf-8"))
+    if not isinstance(payload, dict):
+        raise ValueError(f"JSON object required: {path}")
+    return payload
+
+
+def _write_json(path: Path, payload: dict[str, Any]) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+
+
+def _extract_event(event_payload: dict[str, Any]) -> dict[str, Any]:
+    pull_request = event_payload.get("pull_request")
+    repository = event_payload.get("repository")
+    head_sha = ""
+    pr_number: int | None = None
+    if isinstance(pull_request, dict):
+        head = pull_request.get("head")
+        if isinstance(head, dict):
+            head_sha = str(head.get("sha", "")).strip()
+        raw_number = pull_request.get("number")
+        if isinstance(raw_number, int):
+            pr_number = raw_number
+    repo = ""
+    if isinstance(repository, dict):
+        repo = str(repository.get("full_name", "")).strip()
+    action = str(event_payload.get("action", "")).strip()
+    return {
+        "action": action,
+        "repo": repo,
+        "pr_number": pr_number,
+        "head_sha": head_sha,
+    }
+
+
+def _relative(path: Path, root: Path) -> str:
+    return str(path.resolve().relative_to(root.resolve())).replace("\\", "/")
+
+
+def _find_parity_report(artifacts_root: Path) -> Path | None:
+    candidates = sorted((artifacts_root / "public/.omg/evidence").glob("host-parity-*.json"))
+    if not candidates:
+        return None
+    return candidates[-1]
+
+
+def _check_file(artifacts_root: Path, relpath: str) -> tuple[bool, str]:
+    target = artifacts_root / relpath
+    return target.exists(), relpath
+
+
+def build_pr_handoff(event_payload: dict[str, Any], artifacts_root: Path) -> dict[str, Any]:
+    checks: list[dict[str, str]] = []
+    evidence_gaps: list[str] = []
+    artifacts: list[str] = []
+
+    identity_ok = True
+    for relpath in REQUIRED_PR_ARTIFACTS:
+        exists, _ = _check_file(artifacts_root, relpath)
+        if exists:
+            artifacts.append(relpath)
+        else:
+            identity_ok = False
+            evidence_gaps.append(f"missing artifact: {relpath}")
+    checks.append({
+        "name": "identity",
+        "status": "ok" if identity_ok else "failed",
+        "detail": "required compatibility and identity artifacts are present" if identity_ok else "required artifacts missing",
+    })
+
+    parity_path = _find_parity_report(artifacts_root)
+    parity_ok = False
+    parity_detail = "host parity report missing"
+    if parity_path is not None:
+        artifacts.append(_relative(parity_path, artifacts_root))
+        try:
+            parity_payload = _read_json(parity_path)
+        except Exception as exc:
+            parity_detail = f"host parity report invalid: {exc}"
+        else:
+            parity_results = parity_payload.get("parity_results")
+            if isinstance(parity_results, dict) and parity_results.get("passed") is True:
+                parity_ok = True
+                parity_detail = "host parity report passed"
+            else:
+                parity_detail = "host parity report indicates drift"
+
+    if not parity_ok:
+        evidence_gaps.append(parity_detail)
+    checks.append({
+        "name": "parity",
+        "status": "ok" if parity_ok else "failed",
+        "detail": parity_detail,
+    })
+
+    verdict = "pass" if identity_ok and parity_ok else "fail"
+    event = _extract_event(event_payload)
+    return {
+        "verdict": verdict,
+        "artifacts": sorted(set(artifacts)),
+        "checks": checks,
+        "evidence_gaps": evidence_gaps,
+        "inline_comments": [],
+        "event": event,
+    }
+
+
+def build_release_handoff(event_payload: dict[str, Any], artifacts_root: Path) -> dict[str, Any]:
+    evidence_path = artifacts_root / ".omg/evidence/release-readiness.json"
+    artifacts = [".omg/evidence/release-readiness.json"]
+    checks: list[dict[str, str]] = []
+    evidence_gaps: list[str] = []
+    verdict = "fail"
+
+    if not evidence_path.exists():
+        checks.append({
+            "name": "release-readiness",
+            "status": "failed",
+            "detail": "release-readiness evidence missing",
+        })
+        evidence_gaps.append("release-readiness evidence missing")
+    else:
+        payload = _read_json(evidence_path)
+        status = str(payload.get("status", "")).strip().lower()
+        ok = status == "ok"
+        checks.append({
+            "name": "release-readiness",
+            "status": "ok" if ok else "failed",
+            "detail": f"release readiness status={status or 'unknown'}",
+        })
+        verdict = "pass" if ok else "fail"
+        if not ok:
+            evidence_gaps.append("release-readiness status is not ok")
+
+    return {
+        "verdict": verdict,
+        "artifacts": artifacts,
+        "checks": checks,
+        "evidence_gaps": evidence_gaps,
+        "inline_comments": [],
+        "event": _extract_event(event_payload),
+    }
+
+
+def assert_pass(review_payload: dict[str, Any]) -> None:
+    verdict = str(review_payload.get("verdict", review_payload.get("status", ""))).strip().lower()
+    if verdict in {"ok", "pass", "passed", "success", "approved"}:
+        return
+    gaps = review_payload.get("evidence_gaps")
+    if isinstance(gaps, list) and gaps:
+        detail = "; ".join(str(item) for item in gaps)
+    else:
+        detail = "no evidence gap detail provided"
+    raise SystemExit(f"fast blockers failed: {detail}")
+
+
+def post_review(event_payload: dict[str, Any], review_payload: dict[str, Any]) -> dict[str, Any]:
+    bot = GitHubReviewBot()
+    return bot.process_pull_request_event(event_payload, review_payload)
+
+
+def _parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="Prepare and post GitHub PR review handoff artifacts.")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    build_pr = subparsers.add_parser("build-pr-handoff", help="Create a PR review handoff artifact from CI artifacts.")
+    build_pr.add_argument("--event-path", required=True)
+    build_pr.add_argument("--artifacts-root", required=True)
+    build_pr.add_argument("--output", required=True)
+
+    build_release = subparsers.add_parser("build-release-handoff", help="Create a release-review handoff artifact.")
+    build_release.add_argument("--event-path", required=True)
+    build_release.add_argument("--artifacts-root", required=True)
+    build_release.add_argument("--output", required=True)
+
+    assert_cmd = subparsers.add_parser("assert-pass", help="Fail if handoff verdict is not pass.")
+    assert_cmd.add_argument("--input", required=True)
+
+    post = subparsers.add_parser("post-review", help="Use GitHub App auth and post PR review/check run.")
+    post.add_argument("--event-path", required=True)
+    post.add_argument("--input", required=True)
+    post.add_argument("--output", required=True)
+
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = _parse_args()
+
+    if args.command == "build-pr-handoff":
+        event_payload = _read_json(Path(args.event_path))
+        handoff = build_pr_handoff(event_payload, Path(args.artifacts_root))
+        _write_json(Path(args.output), handoff)
+        return 0
+
+    if args.command == "build-release-handoff":
+        event_payload = _read_json(Path(args.event_path))
+        handoff = build_release_handoff(event_payload, Path(args.artifacts_root))
+        _write_json(Path(args.output), handoff)
+        return 0
+
+    if args.command == "assert-pass":
+        payload = _read_json(Path(args.input))
+        assert_pass(payload)
+        return 0
+
+    if args.command == "post-review":
+        event_payload = _read_json(Path(args.event_path))
+        payload = _read_json(Path(args.input))
+        result = post_review(event_payload, payload)
+        _write_json(Path(args.output), result)
+        if str(result.get("status", "")).strip().lower() != "ok":
+            raise SystemExit(json.dumps(result, ensure_ascii=True))
+        return 0
+
+    raise SystemExit("unknown command")
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())