@trac3r/oh-my-god 2.2.11

package/runtime/evidence_requirements.py

@@ -0,0 +1,157 @@
+"""Single-source evidence profile requirements registry."""
+from __future__ import annotations
+
+import json
+from typing import Final
+
+FULL_REQUIREMENTS: Final[list[str]] = [
+    "tests",
+    "lsp_clean",
+    "build",
+    "provenance",
+    "trust_scores",
+    "security_scan",
+    "license_scan",
+    "sbom",
+    "trace_link",
+    "artifact_contracts",
+    "signed_lineage",
+    "signed_model_card",
+    "signed_checkpoint",
+    "simulator-episode-evidence",
+]
+
+HARDENED_READINESS_REQUIREMENTS: Final[list[str]] = list(FULL_REQUIREMENTS)
+
+EVIDENCE_REQUIREMENTS_BY_PROFILE: Final[dict[str, list[str]]] = {
+    "code-change": [
+        "tests",
+        "lsp_clean",
+        "build",
+        "provenance",
+        "trace_link",
+    ],
+    "docs-only": [
+        "lsp_clean",
+        "trace_link",
+    ],
+    "forge-run": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+        "artifact_contracts",
+    ],
+    "browser-flow": [
+        "lsp_clean",
+        "trace_link",
+        "provenance",
+    ],
+    "forge-cybersecurity": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+        "artifact_contracts",
+        "security_scan",
+    ],
+    "interop-diagnosis": [
+        "lsp_clean",
+        "trace_link",
+        "provenance",
+        "trust_scores",
+    ],
+    "install-validation": [
+        "tests",
+        "lsp_clean",
+        "build",
+        "provenance",
+        "trace_link",
+    ],
+    "music-omr": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+        "artifact_contracts",
+    ],
+    "forge-vision": list(HARDENED_READINESS_REQUIREMENTS)
+    + [
+        "vision-artifacts",
+        "drift-check",
+    ],
+    "health-flow": list(HARDENED_READINESS_REQUIREMENTS)
+    + [
+        "human-review",
+        "audit-trail",
+        "restricted-tools",
+    ],
+    "team-flow": list(HARDENED_READINESS_REQUIREMENTS)
+    + [
+        "human-review",
+        "audit-trail",
+        "restricted-tools",
+    ],
+    "transposition-flow": [
+        "tests",
+        "lsp_clean",
+        "provenance",
+        "trace_link",
+        "artifact_contracts",
+        "benchmark-harness",
+        "determinism-check",
+        "signed_lineage",
+        "signed_model_card",
+        "signed_checkpoint",
+    ],
+    "buffet": list(FULL_REQUIREMENTS),
+    "security-audit": list(FULL_REQUIREMENTS),
+    "release": list(FULL_REQUIREMENTS),
+}
+
+
+def normalize_profile(raw: str) -> str:
+    """Normalize a profile name: strip whitespace and lowercase."""
+    return raw.strip().lower()
+
+
+def resolve_profile(evidence_profile: str | None) -> str | None:
+    """Resolve a profile name to its canonical registry key.
+
+    Returns ``None`` for empty / ``None`` input (caller should use
+    ``FULL_REQUIREMENTS``).  Returns the canonical key for known profiles
+    (exact match first, then normalized).  Raises ``ValueError`` with a
+    machine-readable JSON message for unknown profiles.
+    """
+    if not evidence_profile or not evidence_profile.strip():
+        return None
+
+    # Exact match
+    if evidence_profile in EVIDENCE_REQUIREMENTS_BY_PROFILE:
+        return evidence_profile
+
+    # Normalized match (strip + lowercase)
+    normalized = normalize_profile(evidence_profile)
+    for key in EVIDENCE_REQUIREMENTS_BY_PROFILE:
+        if normalize_profile(key) == normalized:
+            return key
+
+    # Unknown — fail closed with machine-readable error
+    raise ValueError(
+        json.dumps(
+            {"status": "error", "reason": "unknown_profile", "profile": evidence_profile}
+        )
+    )
+
+
+def requirements_for_profile(evidence_profile: str | None) -> list[str]:
+    """Return the evidence requirement list for *evidence_profile*.
+
+    ``None`` / empty  → ``FULL_REQUIREMENTS``.
+    Known profile     → profile-specific list.
+    Unknown profile   → raises ``ValueError`` (machine-readable JSON).
+    """
+    canonical = resolve_profile(evidence_profile)
+    if canonical is None:
+        return list(FULL_REQUIREMENTS)
+    return list(EVIDENCE_REQUIREMENTS_BY_PROFILE[canonical])

package/runtime/exec_kernel.py

@@ -0,0 +1,267 @@
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass
+import json
+import os
+from pathlib import Path
+from types import ModuleType
+from typing import Any
+from typing import cast
+from uuid import uuid4
+
+
+_DEFAULT_EVIDENCE_HOOKS = (
+    ".omg/evidence/subagents",
+    ".omg/state/release_run_coordinator",
+)
+
+
+def _project_dir(project_dir: str | None = None) -> Path:
+    if project_dir:
+        return Path(project_dir).resolve()
+    return Path(os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())).resolve()
+
+
+def _is_enabled_from_env() -> bool:
+    raw = str(os.environ.get("OMG_EXEC_KERNEL_ENABLED", "false")).strip().lower()
+    return raw in {"1", "true", "yes", "on"}
+
+
+@dataclass(frozen=True)
+class KernelRun:
+    run_id: str
+    isolation_mode: str
+    evidence_hooks: tuple[str, ...]
+    attach_log: str
+
+
+class ExecKernel:
+    def __init__(self, project_dir: str | None = None):
+        self.project_dir = _project_dir(project_dir)
+
+    @property
+    def enabled(self) -> bool:
+        return _is_enabled_from_env()
+
+    def attach_log(self, run_id: str) -> str:
+        return str(Path(".omg") / "state" / "exec-kernel" / f"{run_id}.log").replace("\\", "/")
+
+    def _state_path(self, run_id: str) -> Path:
+        return self.project_dir / ".omg" / "state" / "exec-kernel" / f"{run_id}.json"
+
+    def _write_state(self, run_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+        path = self._state_path(run_id)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        previous = self.get_run_state(run_id)
+        merged: dict[str, Any] = dict(previous)
+        merged.update(payload)
+        merged["schema"] = "ExecKernelRunState"
+        merged["run_id"] = run_id
+        merged["kernel_enabled"] = self.enabled
+        merged["state_path"] = str(path.relative_to(self.project_dir)).replace("\\", "/")
+        tmp_path = path.with_name(f"{path.name}.tmp")
+        tmp_path.write_text(json.dumps(merged, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+        os.replace(tmp_path, path)
+        return merged
+
+    def get_run_state(self, run_id: str) -> dict[str, Any]:
+        path = self._state_path(run_id)
+        if not path.exists():
+            return {}
+        try:
+            payload = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            return {}
+        return payload if isinstance(payload, dict) else {}
+
+    def normalize_isolation(self, isolation_mode: str) -> dict[str, Any]:
+        normalized = str(isolation_mode or "none").strip().lower() or "none"
+        if normalized == "worktree":
+            return {
+                "requested": "worktree",
+                "effective": "worktree",
+                "status": "supported",
+                "read_only": False,
+            }
+        if normalized == "container":
+            return {
+                "requested": "container",
+                "effective": "none",
+                "status": "deferred",
+                "reason": "container isolation is deferred/unsupported",
+                "read_only": True,
+            }
+        return {
+            "requested": "none",
+            "effective": "none",
+            "status": "read-only",
+            "reason": "none isolation permits read-only execution",
+            "read_only": True,
+        }
+
+    def _resolve_run_id(self, run_id: str | None) -> str:
+        module = cast(
+            ModuleType,
+            __import__("runtime.release_run_coordinator", fromlist=["resolve_canonical_run_id"]),
+        )
+        resolver = cast(object, getattr(module, "resolve_canonical_run_id", None))
+        if callable(resolver):
+            resolved_obj = resolver(
+                str(self.project_dir),
+                cli_run_id=run_id,
+                generate_if_missing=True,
+            )
+            resolved = cast(object, resolved_obj)
+            resolved_run_id = str(getattr(resolved, "run_id", "")).strip()
+            if resolved_run_id:
+                return resolved_run_id
+        return str(run_id or uuid4())
+
+    def _active_run_id(self) -> str:
+        shadow_path = self.project_dir / ".omg" / "shadow" / "active-run"
+        if not shadow_path.exists():
+            return ""
+        try:
+            return shadow_path.read_text(encoding="utf-8").strip()
+        except OSError:
+            return ""
+
+    def _ownership_snapshot(self, run_id: str) -> dict[str, Any]:
+        from runtime.merge_writer import get_merge_writer
+
+        merge_writer = get_merge_writer(str(self.project_dir))
+        merge_writer_details = merge_writer.check_authorization_details(run_id)
+        active_run_id = self._active_run_id()
+        return {
+            "active_run_id": active_run_id,
+            "run_id": run_id,
+            "merge_writer": merge_writer_details,
+        }
+
+    def register_run(
+        self,
+        run_id: str | None,
+        *,
+        isolation_mode: str = "none",
+        evidence_hooks: list[str] | tuple[str, ...] | None = None,
+        source: str = "runtime",
+        reason: str = "",
+    ) -> KernelRun:
+        resolved_run_id = self._resolve_run_id(run_id)
+        isolation = self.normalize_isolation(isolation_mode)
+        hooks = tuple(evidence_hooks or _DEFAULT_EVIDENCE_HOOKS)
+        ownership = self._ownership_snapshot(resolved_run_id)
+        kernel_run = KernelRun(
+            run_id=resolved_run_id,
+            isolation_mode=str(isolation["requested"]),
+            evidence_hooks=hooks,
+            attach_log=self.attach_log(resolved_run_id),
+        )
+        self._write_state(
+            resolved_run_id,
+            {
+                "status": "registered",
+                "source": source,
+                "reason": reason,
+                "kernel_run": asdict(kernel_run),
+                "isolation": isolation,
+                "ownership": ownership,
+                "evidence_hooks": list(hooks),
+                "attach_log": kernel_run.attach_log,
+            },
+        )
+        return kernel_run
+
+    def submit_worker(
+        self,
+        *,
+        run_id: str,
+        agent_name: str,
+        task_text: str,
+        isolation_mode: str = "none",
+        evidence_hooks: list[str] | tuple[str, ...] | None = None,
+    ) -> dict[str, Any]:
+        kernel_run = self.register_run(
+            run_id,
+            isolation_mode=isolation_mode,
+            evidence_hooks=evidence_hooks,
+            source="submit_worker",
+        )
+        canonical_run_id = kernel_run.run_id
+        isolation = self.normalize_isolation(kernel_run.isolation_mode)
+        ownership = self._ownership_snapshot(canonical_run_id)
+        if isolation["requested"] == "container":
+            state = self._write_state(
+                canonical_run_id,
+                {
+                    "status": "deferred",
+                    "dispatch": {
+                        "status": "deferred",
+                        "reason": isolation["reason"],
+                        "agent_name": agent_name,
+                    },
+                    "ownership": ownership,
+                },
+            )
+            return {
+                "status": "deferred",
+                "run_id": canonical_run_id,
+                "job_id": None,
+                "isolation": isolation,
+                "ownership": ownership,
+                "kernel_enabled": self.enabled,
+                "state_path": state.get("state_path", ""),
+                "reason": isolation["reason"],
+            }
+
+        from runtime import subagent_dispatcher
+
+        dispatch_isolation = "worktree" if isolation["effective"] == "worktree" else "none"
+        job_id = subagent_dispatcher.submit_job(
+            agent_name,
+            task_text,
+            isolation=dispatch_isolation,
+            run_id=canonical_run_id,
+            evidence_hooks=list(kernel_run.evidence_hooks),
+            attach_log=kernel_run.attach_log,
+        )
+        state = self._write_state(
+            canonical_run_id,
+            {
+                "status": "queued",
+                "dispatch": {
+                    "status": "queued",
+                    "job_id": job_id,
+                    "agent_name": agent_name,
+                    "task_text": task_text,
+                    "isolation": isolation,
+                    "passthrough": not self.enabled,
+                },
+                "ownership": ownership,
+            },
+        )
+        return {
+            "status": "queued",
+            "run_id": canonical_run_id,
+            "job_id": job_id,
+            "isolation": isolation,
+            "ownership": ownership,
+            "kernel_enabled": self.enabled,
+            "attach_log": kernel_run.attach_log,
+            "evidence_hooks": list(kernel_run.evidence_hooks),
+            "state_path": state.get("state_path", ""),
+            "passthrough": not self.enabled,
+        }
+
+    def record_supervisor_session(self, run_id: str, session_payload: dict[str, Any]) -> dict[str, Any]:
+        return self._write_state(
+            run_id,
+            {
+                "supervisor_session": dict(session_payload),
+                "supervisor_status": str(session_payload.get("status", "ok")),
+            },
+        )
+
+
+def get_exec_kernel(project_dir: str | None = None) -> ExecKernel:
+    return ExecKernel(project_dir)

package/runtime/explainer_formatter.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+from typing import Any
+
+
+def format_terminal(narrative: dict[str, Any]) -> str:
+    lines: list[str] = []
+
+    lines.append("=== OMG Verdict ===")
+    lines.append(narrative.get("verdict_summary", ""))
+    lines.append("")
+
+    blockers = narrative.get("blockers_section", [])
+    if blockers:
+        lines.append("Blockers:")
+        for b in blockers:
+            lines.append(f"  - {b}")
+        lines.append("")
+
+    next_actions = narrative.get("next_actions", [])
+    if next_actions:
+        lines.append("Next Actions:")
+        for a in next_actions:
+            lines.append(f"  - {a}")
+        lines.append("")
+
+    evidence = narrative.get("evidence_paths_section", [])
+    if evidence:
+        lines.append("Evidence:")
+        for e in evidence:
+            lines.append(f"  - {e}")
+        lines.append("")
+
+    provenance = narrative.get("provenance_note")
+    if provenance:
+        lines.append(f"Provenance: {provenance}")
+        lines.append("")
+
+    return "\n".join(lines)
+
+
+def format_markdown(narrative: dict[str, Any]) -> str:
+    lines: list[str] = []
+
+    lines.append("## OMG Verdict")
+    lines.append("")
+    lines.append(narrative.get("verdict_summary", ""))
+    lines.append("")
+
+    blockers = narrative.get("blockers_section", [])
+    if blockers:
+        lines.append("### Blockers")
+        lines.append("")
+        for b in blockers:
+            lines.append(f"- {b}")
+        lines.append("")
+
+    next_actions = narrative.get("next_actions", [])
+    if next_actions:
+        lines.append("### Next Actions")
+        lines.append("")
+        for a in next_actions:
+            lines.append(f"- {a}")
+        lines.append("")
+
+    evidence = narrative.get("evidence_paths_section", [])
+    if evidence:
+        lines.append("### Evidence")
+        lines.append("")
+        for e in evidence:
+            lines.append(f"- `{e}`")
+        lines.append("")
+
+    provenance = narrative.get("provenance_note")
+    if provenance:
+        lines.append(f"*{provenance}*")
+        lines.append("")
+
+    return "\n".join(lines)
+
+
+__all__ = ["format_terminal", "format_markdown"]

package/runtime/feature_registry.py

@@ -0,0 +1,109 @@
+"""Runtime feature registry for defense and verification controls."""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import TypedDict, cast
+
+DEFAULT_FEATURE_REGISTRY_PATH = Path(".omg") / "state" / "feature-registry.json"
+
+
+class FeatureConfig(TypedDict):
+    enabled: bool
+    depends_on: list[str]
+    description: str
+
+
+DEFAULT_REGISTRY: dict[str, FeatureConfig] = {
+    "DEFENSE_STATE": {
+        "enabled": True,
+        "depends_on": [],
+        "description": "Shared defense-state substrate for runtime policy and hooks.",
+    },
+    "HOOK_GOVERNOR": {
+        "enabled": True,
+        "depends_on": ["DEFENSE_STATE"],
+        "description": "Enforces canonical lifecycle hook order and fail-closed checks.",
+    },
+    "TDD_ENFORCEMENT": {
+        "enabled": True,
+        "depends_on": ["HOOK_GOVERNOR", "DEFENSE_STATE"],
+        "description": "Controls tdd-gate ordering and strict red-green-refactor constraints.",
+    },
+    "VERIFICATION_CONTROLLER": {
+        "enabled": True,
+        "depends_on": ["DEFENSE_STATE"],
+        "description": "Coordinates runtime verification and policy checkpoints.",
+    },
+    "INTERACTION_JOURNAL": {
+        "enabled": True,
+        "depends_on": ["DEFENSE_STATE", "VERIFICATION_CONTROLLER"],
+        "description": "Captures deterministic interaction history for replay and audits.",
+    },
+}
+
+
+def _normalize_entry(name: str, raw_entry: object) -> FeatureConfig:
+    default = DEFAULT_REGISTRY[name]
+    if not isinstance(raw_entry, dict):
+        return {
+            "enabled": default["enabled"],
+            "depends_on": list(default["depends_on"]),
+            "description": default["description"],
+        }
+
+    entry = cast(dict[object, object], raw_entry)
+
+    enabled_obj = entry.get("enabled")
+    enabled = enabled_obj if isinstance(enabled_obj, bool) else default["enabled"]
+
+    depends_obj = entry.get("depends_on")
+    depends_on: list[str] = []
+    if isinstance(depends_obj, list):
+        for item in cast(list[object], depends_obj):
+            if isinstance(item, str) and item.strip():
+                depends_on.append(item)
+    if not depends_on:
+        depends_on = list(default["depends_on"])
+
+    description_obj = entry.get("description")
+    if isinstance(description_obj, str) and description_obj.strip():
+        description = description_obj.strip()
+    else:
+        description = default["description"]
+
+    return {
+        "enabled": enabled,
+        "depends_on": depends_on,
+        "description": description,
+    }
+
+
+def _normalize_registry(raw_payload: object) -> dict[str, FeatureConfig]:
+    if not isinstance(raw_payload, dict):
+        raw_map: dict[object, object] = {}
+    else:
+        raw_map = cast(dict[object, object], raw_payload)
+
+    normalized: dict[str, FeatureConfig] = {}
+    for name in DEFAULT_REGISTRY:
+        normalized[name] = _normalize_entry(name, raw_map.get(name))
+    return normalized
+
+
+def load_registry(project_dir: str) -> dict[str, FeatureConfig]:
+    root = Path(project_dir)
+    registry_path = root / DEFAULT_FEATURE_REGISTRY_PATH
+    registry_path.parent.mkdir(parents=True, exist_ok=True)
+
+    if registry_path.exists():
+        try:
+            raw_payload: object = cast(object, json.loads(registry_path.read_text(encoding="utf-8")))
+        except Exception:
+            raw_payload = {}
+    else:
+        raw_payload = {}
+
+    normalized = _normalize_registry(raw_payload)
+    _ = registry_path.write_text(json.dumps(normalized, indent=2, ensure_ascii=True), encoding="utf-8")
+    return normalized