@trac3er/oh-my-god 2.2.2 → 2.3.0

package/runtime/contract_compiler.py

@@ -7,7 +7,7 @@ import importlib
 import importlib.util
 import json
 import os
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 import re
 import shutil
@@ -25,8 +25,8 @@ from runtime.proof_chain import _normalize_evidence_pack
 from runtime.evidence_requirements import requirements_for_profile
 from runtime.runtime_contracts import schema_versions
 from runtime.compliance_governor import evaluate_release_compliance
-from runtime.release_run_coordinator import get_active_coordinator_run_id
-from runtime.release_surfaces import get_runtime_behavior_surfaces
+from runtime.release_run_coordinator import get_active_coordinator_run_id, is_release_orchestration_active
+from runtime.release_surfaces import get_package_parity_surfaces, get_runtime_behavior_surfaces
 from runtime.adoption import (
     CANONICAL_MARKETPLACE_ID,
     CANONICAL_PACKAGE_NAME,
@@ -96,7 +96,8 @@ def _get_required_advanced_plugin_artifacts(root: Path) -> tuple[str, ...]:
         command_path = command.get("path")
         if not isinstance(command_path, str) or not command_path:
             continue
-        bundled_path = f"bundle/plugins/advanced/{command_path}"
+        safe_command_path = command_path.replace(":", "-")
+        bundled_path = f"bundle/plugins/advanced/{safe_command_path}"
         if bundled_path in seen:
             continue
         required.append(bundled_path)
@@ -140,7 +141,14 @@ REQUIRED_CLAUDE_HOOK_EVENTS = (
     "PostToolUseFailure",
     "InstructionsLoaded",
 )
-REQUIRED_CLAUDE_SUBAGENT_NAMES = ("security-reviewer", "release-manager")
+REQUIRED_CLAUDE_SUBAGENT_NAMES = (
+    "architect-planner",
+    "explorer-indexer",
+    "implementer",
+    "security-reviewer",
+    "verifier",
+    "causal-tracer",
+)
 REQUIRED_CODEX_AGENTS_SECTIONS = (
     "## Build & Test",
     "## Protected Paths",
@@ -196,6 +204,7 @@ _REQUIRED_EXECUTION_PRIMITIVES = (
     "exec_kernel_state",
     "worker_watchdog_replay",
     "merge_writer_provenance",
+    "write_lease_provenance",
     "tool_fabric_ledger",
     "budget_envelope_state",
     "issue_report",
@@ -645,7 +654,8 @@ def _copy_contract_inputs(root: Path, output_root: Path) -> list[Path]:
 
     advanced_commands = resolve_assets(Path("plugins") / "advanced" / "commands", suffix=".md")
     for src in advanced_commands:
-        rel = Path("plugins") / "advanced" / "commands" / src.name
+        safe_name = src.name.replace(":", "-")
+        rel = Path("plugins") / "advanced" / "commands" / safe_name
         dst = output_root / rel
         _write_text(dst, src.read_text(encoding="utf-8"))
         copied.append(dst)
@@ -847,36 +857,43 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
 
 
 def _build_claude_subagents(protected_paths: list[str]) -> list[dict[str, Any]]:
-    """Build narrow-tool Claude subagent definitions. No bypassPermissions allowed."""
     return [
+        {
+            "name": "architect-planner",
+            "description": "Read-only planning subagent. Analyses structure, proposes plans, produces evidence. No mutations.",
+            "tools": ["Read", "Grep", "Glob", "Bash(git log *)", "Bash(git diff *)", "Bash(python3 scripts/omg.py *)", "WebSearch"],
+            "bypassPermissions": False,
+        },
+        {
+            "name": "explorer-indexer",
+            "description": "Read-only codebase exploration subagent. Searches, indexes, and answers structural questions.",
+            "tools": ["Read", "Grep", "Glob", "Bash(grep *)", "Bash(find *)", "Bash(git log *)", "Bash(git diff *)"],
+            "bypassPermissions": False,
+        },
+        {
+            "name": "implementer",
+            "description": "Write-capable implementation subagent governed by protected-path policy and mutation gate.",
+            "tools": ["Read", "Write", "Edit", "MultiEdit", "Grep", "Glob", "Bash(git *)", "Bash(python3 *)", "Bash(pytest *)"],
+            "bypassPermissions": False,
+            "protectedPaths": protected_paths,
+        },
         {
             "name": "security-reviewer",
             "description": "Read-only security review subagent with scoped tool access.",
-            "tools": [
-                "Read",
-                "Grep",
-                "Glob",
-                "Bash(grep *)",
-                "Bash(find *)",
-                "Bash(git log *)",
-                "Bash(git diff *)",
-            ],
+            "tools": ["Read", "Grep", "Glob", "Bash(grep *)", "Bash(find *)", "Bash(git log *)", "Bash(git diff *)"],
             "bypassPermissions": False,
         },
         {
-            "name": "release-manager",
-            "description": "Release management subagent with write access governed by protected-path policy.",
-            "tools": [
-                "Read",
-                "Write",
-                "Edit",
-                "Grep",
-                "Glob",
-                "Bash(git *)",
-                "Bash(python3 scripts/omg.py *)",
-            ],
+            "name": "verifier",
+            "description": "Read-only verification subagent. Runs tests, lints, and produces evidence without mutations.",
+            "tools": ["Read", "Grep", "Glob", "Bash(python3 -m pytest *)", "Bash(python3 scripts/omg.py *)", "Bash(git diff *)"],
+            "bypassPermissions": False,
+        },
+        {
+            "name": "causal-tracer",
+            "description": "Read-only causal analysis subagent. Traces errors, diffs, and logs to root causes.",
+            "tools": ["Read", "Grep", "Glob", "Bash(git log *)", "Bash(git diff *)", "Bash(git blame *)", "Bash(grep *)"],
             "bypassPermissions": False,
-            "protectedPaths": protected_paths,
         },
     ]
 
@@ -1533,6 +1550,85 @@ def compile_contract_outputs(
     }
 
 
+_METHOD_PHASES = (
+    "deep-interview",
+    "approved-spec",
+    "done-when-contract",
+    "test-lock",
+    "implementation-plan",
+    "review",
+    "release",
+)
+
+
+def compile_method_artifacts(
+    *,
+    root_dir: str | Path | None = None,
+    output_root: str | Path | None = None,
+    hosts: list[str] | tuple[str, ...] | None = None,
+    channel: str = "public",
+) -> dict[str, Any]:
+    root = _resolve_root(root_dir)
+    output = _resolve_output_root(root, output_root)
+    selected_hosts = list(hosts or SUPPORTED_HOSTS)
+    method_dir = output / ".omg" / "evidence" / "method"
+    method_dir.mkdir(parents=True, exist_ok=True)
+    issued_at = datetime.now(timezone.utc).isoformat()
+
+    phase_artifacts: list[str] = []
+    for phase in _METHOD_PHASES:
+        phase_payload: dict[str, Any] = {
+            "schema": "OmgMethodPhase",
+            "phase": phase,
+            "contract_version": CANONICAL_VERSION,
+            "channel": channel,
+            "hosts": selected_hosts,
+            "issued_at": issued_at,
+        }
+        phase_path = method_dir / f"{phase}.json"
+        _write_json(phase_path, phase_payload)
+        raw = json.dumps(phase_payload, sort_keys=True, separators=(",", ":")).encode()
+        digest = hashlib.sha256(raw).hexdigest()
+        try:
+            from registry.verify_artifact import sign_artifact_statement
+            statement = sign_artifact_statement(
+                artifact_path=str(phase_path),
+                subject_digest=digest,
+                trusted_comment=f"omg-method:{phase}:{CANONICAL_VERSION}",
+            )
+        except Exception:
+            statement = {
+                "schema": "OmgMethodPhaseStatement",
+                "phase": phase,
+                "subject_digest": digest,
+                "issued_at": issued_at,
+                "signer": {"keyid": "offline", "algorithm": "sha256-only", "mode": "local-offline"},
+            }
+        stmt_path = method_dir / f"{phase}.statement.json"
+        _write_json(stmt_path, statement)
+        phase_artifacts.append(phase)
+
+    manifest: dict[str, Any] = {
+        "schema": "OmgMethodManifest",
+        "phases": list(_METHOD_PHASES),
+        "contract_version": CANONICAL_VERSION,
+        "channel": channel,
+        "hosts": selected_hosts,
+        "issued_at": issued_at,
+    }
+    manifest_path = method_dir / "manifest.json"
+    _write_json(manifest_path, manifest)
+
+    return {
+        "schema": "OmgMethodCompileResult",
+        "status": "ok",
+        "channel": channel,
+        "hosts": selected_hosts,
+        "phases": phase_artifacts,
+        "manifest": str(manifest_path.relative_to(output)),
+    }
+
+
 def _provider_statuses() -> dict[str, dict[str, Any]]:
     ready_override = {
         item.strip()
@@ -1908,6 +2004,7 @@ def _check_host_semantic_parity(
     overall_status = str(report.get("overall_status", "")).strip().lower()
     parity_results = report.get("parity_results", {})
     passed = bool(parity_results.get("passed")) if isinstance(parity_results, dict) else False
+    host_results = parity_results.get("host_results", {}) if isinstance(parity_results, dict) else {}
 
     blockers: list[str] = []
     report_run_id = str(report.get("run_id", "")).strip()
@@ -1919,6 +2016,16 @@ def _check_host_semantic_parity(
         blockers.append(f"host_semantic_parity: report overall_status={overall_status}")
     if isinstance(parity_results, dict) and not passed:
         blockers.append("host_semantic_parity: parity check reported drift")
+    if not isinstance(host_results, dict):
+        blockers.append("host_semantic_parity: report missing host results")
+    else:
+        for host in sorted(canonical_required_hosts):
+            host_result = host_results.get(host)
+            normalized = host_result.get("normalized", {}) if isinstance(host_result, dict) else {}
+            source_class = str(normalized.get("source_class", "")).strip().lower() if isinstance(normalized, dict) else ""
+            source_path = str(normalized.get("source_path", "")).strip() if isinstance(normalized, dict) else ""
+            if source_class != "compiled_or_replayed" or not source_path:
+                blockers.append(f"host_semantic_parity: synthetic payload rejected for {host}")
 
     return {
         "status": "ok" if not blockers else "error",
@@ -2119,6 +2226,10 @@ def build_release_readiness(
     checks["package_smoke"] = package_check
     blockers.extend(package_check.get("blockers", []))
 
+    package_parity = check_package_parity(root)
+    checks["package_parity"] = package_parity
+    blockers.extend(package_parity.get("blockers", []))
+
     plugin_cmd_check = _check_plugin_command_paths(root)
     checks["plugin_command_paths"] = plugin_cmd_check
     blockers.extend(plugin_cmd_check.get("blockers", []))
@@ -2586,6 +2697,10 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
         artifact = evidence_payload.get("artifact")
         if isinstance(artifact, dict):
             release_evidence["artifact"] = artifact
+        for _passthrough_key in ("test_delta", "test_intent_lock", "proof_chain"):
+            _passthrough_value = evidence_payload.get(_passthrough_key)
+            if isinstance(_passthrough_value, dict):
+                release_evidence[_passthrough_key] = _passthrough_value
         compliance = evaluate_release_compliance(
             project_dir=str(output_root),
             run_id=run_id,
@@ -2715,6 +2830,7 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
         "exec_kernel_state",
         "worker_watchdog_replay",
         "merge_writer_provenance",
+        "write_lease_provenance",
         "tool_fabric_ledger",
         "budget_envelope_state",
         "issue_report",
@@ -2741,6 +2857,10 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
             invalid.append(f"{token}:invalid_path")
             blockers.append(f"invalid_execution_primitive: {token}: invalid_path")
             continue
+        if not resolved.exists() and token == "music_omr_testbed_evidence":
+            tracked_candidates = sorted((output_root / "artifacts" / "release" / "evidence").glob("music-omr-*.json"))
+            if tracked_candidates:
+                resolved = tracked_candidates[-1]
         if not resolved.exists():
             missing.append(token)
             blockers.append(f"missing_execution_primitive: {token}")
@@ -2784,6 +2904,59 @@ def _check_execution_primitives(*, output_root: Path, evidence_profile: str | No
             invalid.append(f"{token}:stale")
             blockers.append(f"stale_execution_primitive: {token}")
 
+    if "music_omr_testbed_evidence" in evidence_paths and evidence_paths["music_omr_testbed_evidence"]:
+        music_omr_path = _resolve_relative_path(
+            output_root=output_root,
+            rel_path=evidence_paths["music_omr_testbed_evidence"],
+        )
+        if music_omr_path is not None:
+            music_omr_payload = _load_json_or_none(music_omr_path)
+            if isinstance(music_omr_payload, dict):
+                run_id_linkage = str(
+                    music_omr_payload.get("trace_metadata", {}).get("run_id_linkage", "")
+                ).strip()
+                if run_id_linkage != run_id:
+                    invalid.append("music_omr_testbed_evidence:run_id_linkage_mismatch")
+                    blockers.append(
+                        "invalid_execution_primitive: music_omr_testbed_evidence: run_id_linkage_mismatch"
+                    )
+
+                freshness_payload = music_omr_payload.get("freshness")
+                freshness_generated_at = ""
+                if isinstance(freshness_payload, dict):
+                    freshness_generated_at = str(freshness_payload.get("generated_at", "")).strip()
+                generated_at = None
+                if freshness_generated_at:
+                    try:
+                        generated_at = datetime.fromisoformat(freshness_generated_at.replace("Z", "+00:00"))
+                    except ValueError:
+                        generated_at = None
+                if generated_at is None:
+                    invalid.append("music_omr_testbed_evidence:payload_freshness_stale")
+                    blockers.append(
+                        "invalid_execution_primitive: music_omr_testbed_evidence: payload_freshness_stale"
+                    )
+                else:
+                    if generated_at.tzinfo is None:
+                        generated_at = generated_at.replace(tzinfo=timezone.utc)
+                    max_age = timedelta(seconds=max(1, max_age_seconds))
+                    if datetime.now(timezone.utc) - generated_at > max_age:
+                        invalid.append("music_omr_testbed_evidence:payload_freshness_stale")
+                        blockers.append(
+                            "invalid_execution_primitive: music_omr_testbed_evidence: payload_freshness_stale"
+                        )
+                if (
+                    is_release_orchestration_active(project_dir=str(output_root))
+                    and "coordinator_run_id" in music_omr_payload
+                ):
+                    coordinator_run_id = str(music_omr_payload.get("coordinator_run_id", "")).strip()
+                    active_coordinator_run_id = get_active_coordinator_run_id(str(output_root)) or ""
+                    if coordinator_run_id != active_coordinator_run_id:
+                        invalid.append("music_omr_testbed_evidence:coordinator_run_id_mismatch")
+                        blockers.append(
+                            "invalid_execution_primitive: music_omr_testbed_evidence: coordinator_run_id_mismatch"
+                        )
+
     return {
         "status": "ok" if not blockers else "error",
         "run_id": run_id,
@@ -2911,6 +3084,10 @@ def _check_claim_judge_compliance(output_root: Path) -> dict[str, Any]:
     artifact = evidence_payload.get("artifact")
     if isinstance(artifact, dict):
         release_evidence["artifact"] = artifact
+    for _pt_key in ("test_delta", "test_intent_lock", "proof_chain"):
+        _pt_val = evidence_payload.get(_pt_key)
+        if isinstance(_pt_val, dict):
+            release_evidence[_pt_key] = _pt_val
     decision = evaluate_release_compliance(
         project_dir=str(output_root),
         run_id=run_id,
@@ -3059,6 +3236,92 @@ def _check_bundle_promotion_parity(root: Path, output_root: Path) -> dict[str, A
     }
 
 
+def check_package_parity(root_path: str | Path) -> dict[str, Any]:
+    root = _resolve_root(root_path)
+    required_surfaces = tuple(get_package_parity_surfaces())
+    machine_blockers: list[dict[str, str]] = []
+    blockers: list[str] = []
+
+    def _add_blocker(*, location: str, surface: str, path: str, reason: str = "missing_surface") -> None:
+        blocker = {
+            "kind": "package_parity_missing",
+            "location": location,
+            "surface": surface,
+            "path": path,
+            "reason": reason,
+        }
+        machine_blockers.append(blocker)
+        blockers.append(
+            f"package_parity_missing: location={location} surface={surface} path={path} reason={reason}"
+        )
+
+    for surface in required_surfaces:
+        source_path = root / ".agents" / "skills" / "omg" / surface / "SKILL.md"
+        if not source_path.exists():
+            _add_blocker(location="source", surface=surface, path=str(source_path.relative_to(root)))
+
+    def _check_bundle_surface_roots(*, location: str, roots: list[Path]) -> None:
+        if not roots:
+            for surface in required_surfaces:
+                _add_blocker(
+                    location=location,
+                    surface=surface,
+                    path=f"{location}/bundle/.agents/skills/omg/{surface}/SKILL.md",
+                    reason="missing_output_location",
+                )
+            return
+        for surface in required_surfaces:
+            found = False
+            for bundle_root in roots:
+                candidate = bundle_root / ".agents" / "skills" / "omg" / surface / "SKILL.md"
+                if candidate.exists():
+                    found = True
+                    break
+            if not found:
+                _add_blocker(
+                    location=location,
+                    surface=surface,
+                    path=f"{location}/bundle/.agents/skills/omg/{surface}/SKILL.md",
+                )
+
+    dist_bundle_roots = [path for path in sorted((root / "dist").glob("*/bundle")) if path.is_dir()]
+    _check_bundle_surface_roots(location="dist", roots=dist_bundle_roots)
+
+    release_bundle_roots = [
+        path for path in sorted((root / "artifacts" / "release" / "dist").glob("*/bundle")) if path.is_dir()
+    ]
+    _check_bundle_surface_roots(location="release", roots=release_bundle_roots)
+
+    wheel_files = sorted((root / "dist").glob("*.whl"))
+    if not wheel_files:
+        for surface in required_surfaces:
+            _add_blocker(
+                location="wheel",
+                surface=surface,
+                path=f"dist/*.whl::.agents/skills/omg/{surface}/SKILL.md",
+                reason="missing_output_location",
+            )
+    else:
+        wheel_path = wheel_files[-1]
+        with zipfile.ZipFile(wheel_path) as archive:
+            names = set(archive.namelist())
+        for surface in required_surfaces:
+            suffix = f".agents/skills/omg/{surface}/SKILL.md"
+            if not any(name.endswith(suffix) for name in names):
+                _add_blocker(
+                    location="wheel",
+                    surface=surface,
+                    path=f"{wheel_path.relative_to(root)}::{suffix}",
+                )
+
+    return {
+        "status": "ok" if not blockers else "error",
+        "required_surfaces": list(required_surfaces),
+        "machine_blockers": machine_blockers,
+        "blockers": blockers,
+    }
+
+
 def _check_packaged_install_smoke(root: Path) -> dict[str, Any]:
     blockers: list[str] = []
     with tempfile.TemporaryDirectory(prefix="omg-wheel-") as tmp_dir:

package/runtime/delta_classifier.py

@@ -101,6 +101,74 @@ def classify_project_changes(
     return result
 
 
+_RISK_LEVEL_BY_CATEGORY: dict[str, str] = {
+    "auth": "critical",
+    "payment": "critical",
+    "compliance": "critical",
+    "health": "critical",
+    "db": "high",
+    "infra": "high",
+    "api": "high",
+    "security": "high",
+    "data": "medium",
+    "robotics": "medium",
+    "vision": "medium",
+    "algorithms": "low",
+}
+_REQUIRED_GATES_BY_RISK: dict[str, tuple[str, ...]] = {
+    "critical": ("claim_judge", "security_check", "proof_gate", "test_intent_lock", "compliance_governor"),
+    "high": ("claim_judge", "proof_gate", "test_intent_lock"),
+    "medium": ("claim_judge", "proof_gate"),
+    "low": ("claim_judge",),
+}
+_REQUIRED_BUNDLES_BY_RISK: dict[str, tuple[str, ...]] = {
+    "critical": ("security-check", "hook-governor", "proof-gate", "test-intent-lock"),
+    "high": ("proof-gate", "test-intent-lock"),
+    "medium": ("proof-gate",),
+    "low": (),
+}
+
+
+def compute_pr_risk_payload(
+    *,
+    changed_files: list[str],
+    categories: list[str],
+    goal: str = "",
+    evidence: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    category_risks = [_RISK_LEVEL_BY_CATEGORY.get(c, "low") for c in categories]
+    risk_order = ("low", "medium", "high", "critical")
+    max_risk = max(category_risks, key=lambda r: risk_order.index(r)) if category_risks else "low"
+
+    required_gates = list(_REQUIRED_GATES_BY_RISK.get(max_risk, ()))
+    required_bundles = list(_REQUIRED_BUNDLES_BY_RISK.get(max_risk, ()))
+
+    blockers: list[str] = []
+    if evidence is not None:
+        for gate in required_gates:
+            if gate not in evidence or not evidence[gate]:
+                blockers.append(f"Missing required gate evidence: {gate}")
+
+    runtime_touches = [
+        f for f in changed_files
+        if any(seg in f.lower() for seg in ("runtime/", "hooks/", "scripts/", "registry/"))
+    ]
+    if runtime_touches and "test_intent_lock" not in required_gates:
+        required_gates.append("test_intent_lock")
+        blockers.append("Runtime/hook changes require test_intent_lock evidence")
+
+    return {
+        "schema": "PrRiskPayload",
+        "risk_level": max_risk,
+        "changed_areas": sorted(categories),
+        "runtime_touches": runtime_touches,
+        "required_gates": required_gates,
+        "required_bundles": required_bundles,
+        "blockers": blockers,
+        "goal": goal,
+    }
+
+
 def _classify_evidence_profile(*, goal: str, touched_files: list[str], categories: list[str]) -> str:
     lowered_goal = goal.lower()
     lowered_files = [path.lower() for path in touched_files]

package/runtime/evidence_query.py

@@ -6,7 +6,11 @@ from pathlib import Path
 from typing import cast
 
 from runtime.context_engine import load_profile_digest
-from runtime.evidence_requirements import EVIDENCE_REQUIREMENTS_BY_PROFILE, requirements_for_profile
+from runtime.evidence_requirements import (
+    EVIDENCE_REQUIREMENTS_BY_PROFILE,
+    requirements_for_profile,
+    resolve_profile,
+)
 
 JsonPrimitive = str | int | float | bool | None
 JsonValue = JsonPrimitive | dict[str, "JsonValue"] | list["JsonValue"]
@@ -53,8 +57,15 @@ def _record_copy_with_context_metadata(root: Path, record: JsonObject) -> JsonOb
     existing_profile_version = _record_string(record, "profile_version")
     profile_version = existing_profile_version or str(profile_digest.get("profile_version", "")).strip()
     evidence_profile = _record_string(record, "evidence_profile").strip()
-    evidence_requirements = requirements_for_profile(evidence_profile)
-    profile_is_known = not evidence_profile or evidence_profile in EVIDENCE_REQUIREMENTS_BY_PROFILE
+    try:
+        resolved = resolve_profile(evidence_profile if evidence_profile else None)
+        evidence_requirements = requirements_for_profile(evidence_profile if evidence_profile else None)
+        profile_is_known = True
+        if resolved is not None:
+            evidence_profile = resolved  # use canonical name
+    except ValueError:
+        evidence_requirements = []
+        profile_is_known = False
 
     intent_gate_payload = _load_json(root / ".omg" / "state" / "intent_gate" / f"{run_id}.json") or {}
     existing_intent_gate_version = _record_string(record, "intent_gate_version")

package/runtime/evidence_requirements.py

@@ -1,6 +1,7 @@
 """Single-source evidence profile requirements registry."""
 from __future__ import annotations
 
+import json
 from typing import Final
 
 FULL_REQUIREMENTS: Final[list[str]] = [
@@ -109,10 +110,48 @@ EVIDENCE_REQUIREMENTS_BY_PROFILE: Final[dict[str, list[str]]] = {
 }
 
 
+def normalize_profile(raw: str) -> str:
+    """Normalize a profile name: strip whitespace and lowercase."""
+    return raw.strip().lower()
+
+
+def resolve_profile(evidence_profile: str | None) -> str | None:
+    """Resolve a profile name to its canonical registry key.
+
+    Returns ``None`` for empty / ``None`` input (caller should use
+    ``FULL_REQUIREMENTS``).  Returns the canonical key for known profiles
+    (exact match first, then normalized).  Raises ``ValueError`` with a
+    machine-readable JSON message for unknown profiles.
+    """
+    if not evidence_profile or not evidence_profile.strip():
+        return None
+
+    # Exact match
+    if evidence_profile in EVIDENCE_REQUIREMENTS_BY_PROFILE:
+        return evidence_profile
+
+    # Normalized match (strip + lowercase)
+    normalized = normalize_profile(evidence_profile)
+    for key in EVIDENCE_REQUIREMENTS_BY_PROFILE:
+        if normalize_profile(key) == normalized:
+            return key
+
+    # Unknown — fail closed with machine-readable error
+    raise ValueError(
+        json.dumps(
+            {"status": "error", "reason": "unknown_profile", "profile": evidence_profile}
+        )
+    )
+
+
 def requirements_for_profile(evidence_profile: str | None) -> list[str]:
-    if not evidence_profile:
-        return list(FULL_REQUIREMENTS)
-    requirements = EVIDENCE_REQUIREMENTS_BY_PROFILE.get(evidence_profile)
-    if not requirements:
+    """Return the evidence requirement list for *evidence_profile*.
+
+    ``None`` / empty  → ``FULL_REQUIREMENTS``.
+    Known profile     → profile-specific list.
+    Unknown profile   → raises ``ValueError`` (machine-readable JSON).
+    """
+    canonical = resolve_profile(evidence_profile)
+    if canonical is None:
         return list(FULL_REQUIREMENTS)
-    return list(requirements)
+    return list(EVIDENCE_REQUIREMENTS_BY_PROFILE[canonical])