@trac3er/oh-my-god 2.2.2 → 2.2.4

package/scripts/github_review_helpers.py

@@ -0,0 +1,241 @@
+#!/usr/bin/env python3
+# pyright: reportExplicitAny=false, reportAny=false, reportUnknownVariableType=false, reportUnknownMemberType=false, reportUnknownArgumentType=false, reportUnusedCallResult=false
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+from typing import Any
+
+from runtime.github_review_bot import GitHubReviewBot
+
+
+REQUIRED_PR_ARTIFACTS = (
+    "omg-compat-gap.json",
+    "omg-compat-contracts.json",
+    "public/.omg/evidence/doctor.json",
+    "public/dist/public/manifest.json",
+)
+
+
+def _read_json(path: Path) -> dict[str, Any]:
+    payload = json.loads(path.read_text(encoding="utf-8"))
+    if not isinstance(payload, dict):
+        raise ValueError(f"JSON object required: {path}")
+    return payload
+
+
+def _write_json(path: Path, payload: dict[str, Any]) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+
+
+def _extract_event(event_payload: dict[str, Any]) -> dict[str, Any]:
+    pull_request = event_payload.get("pull_request")
+    repository = event_payload.get("repository")
+    head_sha = ""
+    pr_number: int | None = None
+    if isinstance(pull_request, dict):
+        head = pull_request.get("head")
+        if isinstance(head, dict):
+            head_sha = str(head.get("sha", "")).strip()
+        raw_number = pull_request.get("number")
+        if isinstance(raw_number, int):
+            pr_number = raw_number
+    repo = ""
+    if isinstance(repository, dict):
+        repo = str(repository.get("full_name", "")).strip()
+    action = str(event_payload.get("action", "")).strip()
+    return {
+        "action": action,
+        "repo": repo,
+        "pr_number": pr_number,
+        "head_sha": head_sha,
+    }
+
+
+def _relative(path: Path, root: Path) -> str:
+    return str(path.resolve().relative_to(root.resolve())).replace("\\", "/")
+
+
+def _find_parity_report(artifacts_root: Path) -> Path | None:
+    candidates = sorted((artifacts_root / "public/.omg/evidence").glob("host-parity-*.json"))
+    if not candidates:
+        return None
+    return candidates[-1]
+
+
+def _check_file(artifacts_root: Path, relpath: str) -> tuple[bool, str]:
+    target = artifacts_root / relpath
+    return target.exists(), relpath
+
+
+def build_pr_handoff(event_payload: dict[str, Any], artifacts_root: Path) -> dict[str, Any]:
+    checks: list[dict[str, str]] = []
+    evidence_gaps: list[str] = []
+    artifacts: list[str] = []
+
+    identity_ok = True
+    for relpath in REQUIRED_PR_ARTIFACTS:
+        exists, _ = _check_file(artifacts_root, relpath)
+        if exists:
+            artifacts.append(relpath)
+        else:
+            identity_ok = False
+            evidence_gaps.append(f"missing artifact: {relpath}")
+    checks.append({
+        "name": "identity",
+        "status": "ok" if identity_ok else "failed",
+        "detail": "required compatibility and identity artifacts are present" if identity_ok else "required artifacts missing",
+    })
+
+    parity_path = _find_parity_report(artifacts_root)
+    parity_ok = False
+    parity_detail = "host parity report missing"
+    if parity_path is not None:
+        artifacts.append(_relative(parity_path, artifacts_root))
+        try:
+            parity_payload = _read_json(parity_path)
+        except Exception as exc:
+            parity_detail = f"host parity report invalid: {exc}"
+        else:
+            parity_results = parity_payload.get("parity_results")
+            if isinstance(parity_results, dict) and parity_results.get("passed") is True:
+                parity_ok = True
+                parity_detail = "host parity report passed"
+            else:
+                parity_detail = "host parity report indicates drift"
+
+    if not parity_ok:
+        evidence_gaps.append(parity_detail)
+    checks.append({
+        "name": "parity",
+        "status": "ok" if parity_ok else "failed",
+        "detail": parity_detail,
+    })
+
+    verdict = "pass" if identity_ok and parity_ok else "fail"
+    event = _extract_event(event_payload)
+    return {
+        "verdict": verdict,
+        "artifacts": sorted(set(artifacts)),
+        "checks": checks,
+        "evidence_gaps": evidence_gaps,
+        "inline_comments": [],
+        "event": event,
+    }
+
+
+def build_release_handoff(event_payload: dict[str, Any], artifacts_root: Path) -> dict[str, Any]:
+    evidence_path = artifacts_root / ".omg/evidence/release-readiness.json"
+    artifacts = [".omg/evidence/release-readiness.json"]
+    checks: list[dict[str, str]] = []
+    evidence_gaps: list[str] = []
+    verdict = "fail"
+
+    if not evidence_path.exists():
+        checks.append({
+            "name": "release-readiness",
+            "status": "failed",
+            "detail": "release-readiness evidence missing",
+        })
+        evidence_gaps.append("release-readiness evidence missing")
+    else:
+        payload = _read_json(evidence_path)
+        status = str(payload.get("status", "")).strip().lower()
+        ok = status == "ok"
+        checks.append({
+            "name": "release-readiness",
+            "status": "ok" if ok else "failed",
+            "detail": f"release readiness status={status or 'unknown'}",
+        })
+        verdict = "pass" if ok else "fail"
+        if not ok:
+            evidence_gaps.append("release-readiness status is not ok")
+
+    return {
+        "verdict": verdict,
+        "artifacts": artifacts,
+        "checks": checks,
+        "evidence_gaps": evidence_gaps,
+        "inline_comments": [],
+        "event": _extract_event(event_payload),
+    }
+
+
+def assert_pass(review_payload: dict[str, Any]) -> None:
+    verdict = str(review_payload.get("verdict", review_payload.get("status", ""))).strip().lower()
+    if verdict in {"ok", "pass", "passed", "success", "approved"}:
+        return
+    gaps = review_payload.get("evidence_gaps")
+    if isinstance(gaps, list) and gaps:
+        detail = "; ".join(str(item) for item in gaps)
+    else:
+        detail = "no evidence gap detail provided"
+    raise SystemExit(f"fast blockers failed: {detail}")
+
+
+def post_review(event_payload: dict[str, Any], review_payload: dict[str, Any]) -> dict[str, Any]:
+    bot = GitHubReviewBot()
+    return bot.process_pull_request_event(event_payload, review_payload)
+
+
+def _parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="Prepare and post GitHub PR review handoff artifacts.")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    build_pr = subparsers.add_parser("build-pr-handoff", help="Create a PR review handoff artifact from CI artifacts.")
+    build_pr.add_argument("--event-path", required=True)
+    build_pr.add_argument("--artifacts-root", required=True)
+    build_pr.add_argument("--output", required=True)
+
+    build_release = subparsers.add_parser("build-release-handoff", help="Create a release-review handoff artifact.")
+    build_release.add_argument("--event-path", required=True)
+    build_release.add_argument("--artifacts-root", required=True)
+    build_release.add_argument("--output", required=True)
+
+    assert_cmd = subparsers.add_parser("assert-pass", help="Fail if handoff verdict is not pass.")
+    assert_cmd.add_argument("--input", required=True)
+
+    post = subparsers.add_parser("post-review", help="Use GitHub App auth and post PR review/check run.")
+    post.add_argument("--event-path", required=True)
+    post.add_argument("--input", required=True)
+    post.add_argument("--output", required=True)
+
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = _parse_args()
+
+    if args.command == "build-pr-handoff":
+        event_payload = _read_json(Path(args.event_path))
+        handoff = build_pr_handoff(event_payload, Path(args.artifacts_root))
+        _write_json(Path(args.output), handoff)
+        return 0
+
+    if args.command == "build-release-handoff":
+        event_payload = _read_json(Path(args.event_path))
+        handoff = build_release_handoff(event_payload, Path(args.artifacts_root))
+        _write_json(Path(args.output), handoff)
+        return 0
+
+    if args.command == "assert-pass":
+        payload = _read_json(Path(args.input))
+        assert_pass(payload)
+        return 0
+
+    if args.command == "post-review":
+        event_payload = _read_json(Path(args.event_path))
+        payload = _read_json(Path(args.input))
+        result = post_review(event_payload, payload)
+        _write_json(Path(args.output), result)
+        if str(result.get("status", "")).strip().lower() != "ok":
+            raise SystemExit(json.dumps(result, ensure_ascii=True))
+        return 0
+
+    raise SystemExit("unknown command")
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/omg.py

@@ -53,6 +53,7 @@ from runtime.security_check import run_security_check
 from runtime.contract_compiler import (
     build_release_readiness,
     compile_contract_outputs,
+    compile_method_artifacts,
     validate_contract_registry,
 )
 from runtime.tracebank import record_trace
@@ -898,12 +899,20 @@ def cmd_contract_validate(args: argparse.Namespace) -> int:
 
 def cmd_contract_compile(args: argparse.Namespace) -> int:
     hosts = args.hosts or []
-    result = compile_contract_outputs(
-        root_dir=ROOT_DIR,
-        output_root=args.output_root,
-        hosts=hosts,
-        channel=args.channel,
-    )
+    if getattr(args, "method", False):
+        result = compile_method_artifacts(
+            root_dir=ROOT_DIR,
+            output_root=args.output_root,
+            hosts=hosts,
+            channel=args.channel,
+        )
+    else:
+        result = compile_contract_outputs(
+            root_dir=ROOT_DIR,
+            output_root=args.output_root,
+            hosts=hosts,
+            channel=args.channel,
+        )
     print(json.dumps(result, indent=2))
     return 0 if result.get("status") == "ok" else 2
 
@@ -964,6 +973,44 @@ def _add_ecosystem_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
     ecosystem_sync.set_defaults(func=cmd_ecosystem_sync)
 
 
+def cmd_provider_parity_eval(args: argparse.Namespace) -> int:
+    from runtime.provider_parity_eval import run_provider_parity_eval
+    result = run_provider_parity_eval(
+        task_path=args.task,
+        mode=args.mode,
+        output_root=args.output_root or None,
+    )
+    print(json.dumps(result, indent=2))
+    return 0 if result.get("status") == "ok" else 2
+
+
+def cmd_context_compile(args: argparse.Namespace) -> int:
+    from runtime.context_compiler import compile_context_packets
+    hosts = args.hosts or []
+    result = compile_context_packets(
+        root_dir=ROOT_DIR,
+        output_root=args.output_root,
+        hosts=hosts,
+    )
+    print(json.dumps(result, indent=2))
+    return 0 if result.get("status") == "ok" else 2
+
+
+def _add_context_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> None:
+    context_sub = parent.add_subparsers(dest=dest, required=True)
+    context_compile = context_sub.add_parser("compile", help="Compile bounded context packets for canonical hosts")
+    context_compile.add_argument(
+        "--host",
+        dest="hosts",
+        action="append",
+        choices=list(CANONICAL_HOST_CHOICES),
+        required=True,
+        help="Host to compile context for (repeat for multiple hosts)",
+    )
+    context_compile.add_argument("--output-root", default="", help="Write outputs to this root instead of the repo root")
+    context_compile.set_defaults(func=cmd_context_compile)
+
+
 def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> None:
     contract_sub = parent.add_subparsers(dest=dest, required=True)
 
@@ -994,6 +1041,7 @@ def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
     )
     contract_compile.add_argument("--channel", default="public", choices=["public", "enterprise"])
     contract_compile.add_argument("--output-root", default="", help="Write outputs to this root instead of the repo root")
+    contract_compile.add_argument("--method", action="store_true", default=False, help="Emit signed seven-phase methodology artifacts instead of host artifacts")
     contract_compile.set_defaults(func=cmd_contract_compile)
 
 
@@ -1441,6 +1489,15 @@ def build_parser() -> argparse.ArgumentParser:
     contract = sub.add_parser("contract", help="Canonical OMG contract validation and compilation")
     _add_contract_subcommands(contract, dest="contract_command")
 
+    context_parser = sub.add_parser("context", help="Context packet compiler")
+    _add_context_subcommands(context_parser, dest="context_command")
+
+    parity_eval = sub.add_parser("provider-parity-eval", help="Evaluate provider parity across canonical hosts")
+    parity_eval.add_argument("--task", required=True, help="Path to bounded task JSON file")
+    parity_eval.add_argument("--mode", default="recorded", choices=["recorded", "live"], help="Evaluation mode")
+    parity_eval.add_argument("--output-root", default="", help="Write outputs here instead of repo root")
+    parity_eval.set_defaults(func=cmd_provider_parity_eval)
+
     release = sub.add_parser("release", help="OMG release-readiness checks")
     _add_release_subcommands(release, dest="release_command")
 

package/scripts/prepare-release-proof-fixtures.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 import argparse
 import hashlib
 import json
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
 from registry.verify_artifact import sign_artifact_statement
@@ -99,9 +100,20 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
     issue_report_path = output_root / ".omg" / "evidence" / "issues" / "run-1.json"
     host_parity_path = output_root / ".omg" / "evidence" / "host-parity-run-1.json"
     music_omr_path = output_root / ".omg" / "evidence" / "music-omr-run-1.json"
+    tracked_music_omr_path = output_root / "artifacts" / "release" / "evidence" / "music-omr-run-1.json"
 
     # Ensure directories exist
-    for p in [exec_kernel_path, watchdog_path, merge_writer_path, ledger_path, budget_path, issue_report_path, host_parity_path, music_omr_path]:
+    for p in [
+        exec_kernel_path,
+        watchdog_path,
+        merge_writer_path,
+        ledger_path,
+        budget_path,
+        issue_report_path,
+        host_parity_path,
+        music_omr_path,
+        tracked_music_omr_path,
+    ]:
         p.parent.mkdir(parents=True, exist_ok=True)
 
     _write_text(
@@ -268,6 +280,20 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
                     "path": ".omg/evidence/music-omr-run-1.json",
                     "run_id": run_id,
                 },
+                "write_lease_provenance": {
+                    "path": ".omg/evidence/merge-writer-run-1.json",
+                    "run_id": run_id,
+                },
+                "proof_chain": {
+                    "status": "ok",
+                    "trace_id": trace_id,
+                    "blockers": [],
+                },
+                "test_intent_lock": {
+                    "status": "ok",
+                    "lock_id": lock_id,
+                    "run_id": run_id,
+                },
             },
     )
     _write_json(
@@ -446,23 +472,70 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
                 "drift_detected": False,
                 "drift_details": [],
                 "host_results": {
-                    "claude": {"present": True, "passed": True, "reason": "baseline"},
-                    "codex": {"present": True, "passed": True, "reason": "structured-equivalent"},
-                    "gemini": {"present": True, "passed": True, "reason": "structured-equivalent"},
-                    "kimi": {"present": True, "passed": True, "reason": "structured-equivalent"},
+                    "claude": {
+                        "present": True,
+                        "passed": True,
+                        "reason": "baseline",
+                        "normalized": {
+                            "source_class": "compiled_or_replayed",
+                            "source_kind": "compiled_artifact",
+                            "source_path": "settings.json",
+                        },
+                    },
+                    "codex": {
+                        "present": True,
+                        "passed": True,
+                        "reason": "structured-equivalent",
+                        "normalized": {
+                            "source_class": "compiled_or_replayed",
+                            "source_kind": "compiled_artifact",
+                            "source_path": ".agents/skills/omg/AGENTS.fragment.md",
+                        },
+                    },
+                    "gemini": {
+                        "present": True,
+                        "passed": True,
+                        "reason": "structured-equivalent",
+                        "normalized": {
+                            "source_class": "compiled_or_replayed",
+                            "source_kind": "compiled_artifact",
+                            "source_path": ".gemini/settings.json",
+                        },
+                    },
+                    "kimi": {
+                        "present": True,
+                        "passed": True,
+                        "reason": "structured-equivalent",
+                        "normalized": {
+                            "source_class": "compiled_or_replayed",
+                            "source_kind": "compiled_artifact",
+                            "source_path": ".kimi/mcp.json",
+                        },
+                    },
                 }
             },
             "overall_status": "ok",
         },
     )
-    _write_json(
-        music_omr_path,
-        {
-            "schema": "MusicOMREvidence",
-            "run_id": run_id,
-            "results": {},
+    _now = datetime.now(timezone.utc)
+    music_omr_payload = {
+        "schema": "MusicOMREvidence",
+        "schema_version": "2.1.0",
+        "run_id": run_id,
+        "trace_metadata": {
+            "run_id_linkage": run_id,
         },
-    )
+        "freshness": {
+            "generated_at": _now.isoformat(),
+            "expires_at": (_now + timedelta(seconds=86400)).isoformat(),
+            "max_age_seconds": 86400,
+            "freshness_threshold_secs": 86400,
+            "is_fresh": True,
+        },
+        "results": {},
+    }
+    _write_json(music_omr_path, music_omr_payload)
+    _write_json(tracked_music_omr_path, music_omr_payload)
     _write_text(
         profile_path,
         """profile_version: profile-v1

package/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.2.2 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.2.4 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -208,6 +208,16 @@
         ],
         "matcher": "Read|Write|Edit|MultiEdit"
       },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/terms-guard.py\"",
+            "timeout": 10
+          }
+        ],
+        "matcher": "Write|Edit|MultiEdit"
+      },
       {
         "hooks": [
           {
@@ -306,7 +316,7 @@
     ]
   },
   "_omg": {
-    "_version": "2.2.2",
+    "_version": "2.2.4",
     "preset": "safe",
     "omgMode": "focused",
     "default_mode": "ulw+ralph",
@@ -366,7 +376,7 @@
       "NOTEBOOKLM": false
     },
     "generated": {
-      "contract_version": "2.2.2",
+      "contract_version": "2.2.4",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",

package/artifacts/release/.agents/skills/omg/AGENTS.fragment.md

@@ -1,75 +0,0 @@
-# OMG Codex Governance (channel: enterprise)
-
-## Build & Test
-
-```bash
-python3 -m pytest tests -q
-python3 scripts/omg.py contract validate
-python3 scripts/omg.py contract compile --host codex --channel enterprise
-```
-
-## Protected Paths
-
-The following paths require tier-gated review before mutation:
-
-- `.omg/**`
-- `.agents/**`
-- `.codex/**`
-- `.claude/**`
-
-## Release Audit
-
-Release readiness requires claim and compliance outcomes:
-
-- `claim_judge`
-- `compliance_governor`
-- `execution_primitives`
-Attestation requirements:
-- `registry.verify_artifact.sign_artifact_statement`
-- `registry.verify_artifact.verify_artifact_statement`
-
-## Evidence Contract
-
-Every production action must emit evidence containing these fields:
-
-- `attestation_statement`
-- `attestation_verifier`
-- `claim_judge_verdict`
-- `compliance_verdict`
-- `executor`
-- `lineage`
-- `timestamp`
-- `trace_id`
-
-## Required Skills
-
-- `omg/control-plane`
-- `omg/mcp-fabric`
-
-## Protected Planning Surface
-
-Council planning skills are protected and explicit-invocation only:
-
-- `omg/plan-council`
-
-## Web Search Policy
-
-- Prefer cached results over live network requests.
-- Do NOT initiate live web searches unless explicitly instructed.
-- Use `context7` or local documentation before external lookups.
-- Set `cached_web_search: prefer_cached` as the default.
-
-## Approval Constraints
-
-- Destructive file operations require explicit user approval.
-- `git push --force` and branch deletions require explicit approval.
-- Production deployments require explicit approval.
-- Mutations to protected paths require tier-gated approval.
-
-## Rules & Automations
-
-- Rules: `protected_paths, explicit_invocation`
-- Automations: `contract-compile, release-readiness`
-- Defer to the repo's `AGENTS.md` / `AGENTS.override.md` instruction hierarchy before OMG-specific guidance.
-- Do not mirror or override Codex built-in slash commands; OMG guidance applies through MCP, skills, and generated rules.
-- Require explicit invocation for protected production planning skills.

package/artifacts/release/.agents/skills/omg/algorithms/SKILL.md

@@ -1,11 +0,0 @@
----
-name: omg-algorithms
-description: "Determinism and benchmark attachments for algorithm-heavy work."
----
-
-# OMG Algorithms Pack
-
-- Channel: `enterprise`
-- Execution modes: `embedded, local_supervisor`
-- MCP servers: `omg-control`
-- Evidence outputs: `.omg/evals/latest.json`

package/artifacts/release/.agents/skills/omg/algorithms/openai.yaml

@@ -1,11 +0,0 @@
-name: omg-algorithms
-description: "Determinism and benchmark attachments for algorithm-heavy work."
-allow_implicit_invocation: false
-metadata:
-  channel: enterprise
-  bundle_id: algorithms
-  title: "OMG Algorithms Pack"
-mcp_servers:
-  - omg-control
-allowed_tools:
-  - "Read"

package/artifacts/release/.agents/skills/omg/api-twin/SKILL.md

@@ -1,11 +0,0 @@
----
-name: omg-api-twin
-description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
----
-
-# OMG API Twin
-
-- Channel: `enterprise`
-- Execution modes: `embedded, local_supervisor`
-- MCP servers: `omg-control`
-- Evidence outputs: `.omg/state/api_twin.json`

package/artifacts/release/.agents/skills/omg/api-twin/openai.yaml

@@ -1,12 +0,0 @@
-name: omg-api-twin
-description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
-allow_implicit_invocation: false
-metadata:
-  channel: enterprise
-  bundle_id: api-twin
-  title: "OMG API Twin"
-mcp_servers:
-  - omg-control
-allowed_tools:
-  - "Read"
-  - "Bash(python3:*)"

package/artifacts/release/.agents/skills/omg/ast-pack/SKILL.md

@@ -1,11 +0,0 @@
----
-name: omg-ast-pack
-description: "Governed AST search and replace lane with canonical approvals and proofs."
----
-
-# OMG AST Pack Lane
-
-- Channel: `enterprise`
-- Execution modes: `embedded, local_supervisor`
-- MCP servers: `omg-control`
-- Evidence outputs: `.omg/evidence/ast-pack-{run_id}.json`

package/artifacts/release/.agents/skills/omg/ast-pack/openai.yaml

@@ -1,12 +0,0 @@
-name: omg-ast-pack
-description: "Governed AST search and replace lane with canonical approvals and proofs."
-allow_implicit_invocation: false
-metadata:
-  channel: enterprise
-  bundle_id: ast-pack
-  title: "OMG AST Pack Lane"
-mcp_servers:
-  - omg-control
-allowed_tools:
-  - "Grep"
-  - "Edit"