@agentikos/omega-os 0.2.0 → 0.19.6

package/omega/Agentik_SSOT/skills/automationaudit/SKILL.md

@@ -0,0 +1,161 @@
+---
+name: automationaudit
+description: Forensic automation audit — Every cron is a promise, every script a liability, every daemon a lie — do they hold?. Runs the gather (deterministic) + falsify (agentic) pipeline, batches fixes, dispatches capped workers, re-audits, and persists scores. Use when the user says "/automationaudit", "audit automation", or asks to verify the automation health of the project.
+when_to_use: User says /automationaudit, audit automation, check automation, verify automation, is automation healthy.
+argument-hint: "[--scope <path>] [--fix] [--max-workers N]"
+arguments: [args]
+allowed-tools: Bash Read Edit Grep Glob Write
+---
+
+# automationaudit — forensic audit (Agentik OS Quality Arsenal)
+
+> Every cron is a promise, every script a liability, every daemon a lie — do they hold?
+
+You are running the automationaudit forensic audit. Apply the **Gestalt-Popper
+doctrine**: identify the hinge point, scrutinise it 10x, then assume
+every name is a CLAIM and look for the divergence between the claim and
+the reality. Bias toward FAIL. A perfect score is earned by finding zero
+falsifiable claims, never by absence of effort.
+
+## Run
+
+The audit is one engine call — gather (deterministic) + falsify (agentic)
++ optional fix-dispatch (capped) + re-audit. Invoke the unified pipeline:
+
+```bash
+omega audit run automationaudit $args
+```
+
+Common options:
+
+| Flag | Effect |
+|---|---|
+| `--scope <path>` | scope the audit (file or directory) |
+| `--fix` | after analysing, batch findings + dispatch up to N workers + re-audit |
+| `--max-workers N` | cap parallel fix workers (default 3) |
+| `--min-severity high` | only batch + fix findings at or above this severity |
+
+Read-only by default. Add `--fix` to enable the dispatch + re-audit loop.
+
+## Phases under investigation
+
+The agentic pass walks each phase below and emits structured findings
+(claim vs. reality). Every PASS must cite ≥3 concrete checks.
+
+### 1. cron-health
+
+Cron expressions valid; DST/timezone traps; journalctl proves actual run count matches schedule (gaps = silent failures); output captured not '>/dev/null'; overlap-locked; failure alerts wired.
+
+### 2. script-quality
+
+Shebang correct; 'set -euo pipefail' present; passes shellcheck; variables quoted; 'cd' guarded with '|| exit'; Python venv + imports valid; bare-except swallows nothing.
+
+### 3. dependency-order
+
+Map the timeline — script B reading A's output must have an EXPLICIT dependency (not 'scheduled 5min later'); pipeline stages gate on SUCCESS not just completion; clock-skew safe.
+
+### 4. error-recovery
+
+Transient failures retried with bounded exponential backoff; partial failures logged-and-continued not aborted; killed mid-run can resume from checkpoint; timeouts set on curl/ssh; reboot survival.
+
+### 5. idempotency
+
+Running twice produces no duplicates / double notifications / lock-collision crash; catch-up after downtime is safe (24 missed runs ≠ 24 simultaneous API calls); INSERT vs UPSERT correct.
+
+### 6. logging-monitoring
+
+Every automation writes a timestamped structured log; log rotation configured (no unbounded disk bomb); failure escalates log→monitor→alert→human; dead-man's-switch alerts on non-execution.
+
+### 7. secret-exposure
+
+No hardcoded keys/passwords/connection-strings in scripts; gitleaks clean on history; secrets not echoed in logs or 'set -x' traces; .env files chmod 600 and gitignored; rotation plan exists.
+
+### 8. daemon-health
+
+Daemon actually running and systemd-enabled; CPU/RSS/FD not leaking; output/heartbeat fresh; Restart=on-failure policy; SIGTERM flushes buffers and releases locks; no OOM-kill history.
+
+### 9. race-conditions
+
+Automations sharing files/APIs/tables/repos are flock-protected; atomic write (.tmp then mv); concurrent git access locked; API schedules staggered to avoid combined rate-limit breach.
+
+### 10. dead-automations
+
+Cron entries point to existing scripts; no scripts that never ran (no log, stale mtime); commented-out crons explained; no orphaned log files; no deprecated automation still running alongside its replacement.
+
+### 11. dispatch-chains
+
+Every dispatch chain (trigger→worker→completion) verifies completion via done-signal/exit-code; failure propagates not fire-and-forget; backpressure caps concurrency; orphaned workers detected.
+
+### 12. failure-cascade
+
+Build the dependency graph; identify SPOFs and blast radius; disk-full/network-down/token-expired common failure modes; circuit breakers back off instead of hammering; global freeze switch exists.
+
+### 13. lock-management
+
+Lock files have a max-age/staleness check (PID alive via 'kill -0'); cleanup trap on EXIT and crash; reboot clears stale locks; granularity avoids deadlock between mutually-waiting scripts.
+
+### 14. backup-portability
+
+Backups exist, offsite, integrity-verified, restore actually tested with documented RTO/RPO; scripts use full tool paths (cron's minimal PATH); correct shebang vs syntax; tool availability checked.
+
+## Falsification rules
+
+Every automation lies — the cron says "every 5min" (prove it with journalctl), the log says "completed successfully" (prove the output file is stale/empty), the daemon "is alive" (prove the heartbeat is stale). Exit code 0 is NOT success. Categorise findings as SCHEDULE-vs-REALITY, LOG-vs-TRUTH, DEPENDENCY-vs-ORDER, IDEMPOTENT-vs-DESTRUCTIVE, ALIVE-vs-ZOMBIE, or SECRET-vs-EXPOSED. Every PASS cites ≥3 concrete commands with output.
+
+## After the run
+
+The pipeline writes one structured verdict to:
+
+```
+Agentik_Runtime/audits.db    (history — `omega audit history automationaudit`)
+Agentik_Runtime/sessions/${CLAUDE_SESSION_ID}/.done.json   (this turn)
+```
+
+The `.done.json` schema:
+
+```json
+{
+  "status": "done_clean" | "pending" | "failed",
+  "summary": "<one-paragraph verdict>",
+  "artifacts": {
+    "audit": "automationaudit",
+    "score": 0-100,
+    "verified": bool,
+    "findings": [...],
+    "fix_plan": [...],
+    "dispatches": [...],
+    "reaudit_score": 0-100  // only when --fix was used
+  }
+}
+```
+
+## Hard rules (don't break these)
+
+1. **No fake "done".** First Law: only runtime tells the truth. If the
+   gather phase fails or the agentic verdict scores below the threshold,
+   you have NOT verified — set status to `pending` or `failed`.
+2. **Cap parallelism.** ≤ 3 fix workers at a time. The
+   batcher enforces this; do not call out to other dispatch mechanisms.
+3. **No worker per finding.** Findings are clustered by file footprint and
+   severity. One worker handles one disjoint batch.
+4. **Re-audit confirms.** After fixes land, the pipeline re-runs the same
+   gather + agentic phases. If the score did not improve, escalate honestly.
+5. **History is the trend.** `omega audit history automationaudit` shows whether the
+   codebase is improving over time on this dimension. Use it to decide
+   whether to push for `--fix` again.
+
+## Why this audit exists
+
+The 18 forensic audits are the OmegaOS verification layer. Claude's
+"I'm done" claims used to be unverified. With these audits running as
+the gate, completion is **derived from observable facts**, not declared
+by the worker. Run this audit any time someone (human or agent) claims
+the automation dimension is healthy. Insist on the score before you
+accept.
+
+## Reference
+
+Audit definition: `Agentik_SSOT/audits/automationaudit.yaml`
+Engine pipeline:  `omega_engine.audits.pipeline.AuditPipeline`
+Batcher:          `omega_engine.audits.batcher.batch_findings`
+History:          `omega_engine.audits.history`

package/omega/Agentik_SSOT/skills/cadence/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: cadence
+description: Schedule a recurring beat — cron, delay, or self-paced — that runs an intent at every tick via the OmegaOS AutonomousSupervisor. Agentik OS native equivalent of /loop, runs on the Claude Code Max subscription with zero API surcharge. Use when the user says "every N minutes do X", "schedule Y", "loop X every day", "run Z on a cron", "fire X in N seconds".
+when_to_use: A recurring or scheduled task that should persist beyond the current Claude Code session. Survives editor restarts because the supervisor daemon owns the schedule.
+allowed-tools: Bash Read
+argument-hint: "<cron|delay|self> <schedule-spec> <intent>"
+arguments: [trigger_type, schedule, intent]
+---
+
+# cadence — recurring execution on Max
+
+You are scheduling a beat. The user wants something to happen on a schedule
+(cron, delay, or self-paced). You will persist a charter to
+`Agentik_Orchestration/autonomous/cadence-<id>.yaml` — the existing
+`AutonomousSupervisor` daemon will pick it up at its next tick and run the
+intent at every beat from then on.
+
+## This run
+
+- **Trigger type:** $trigger_type (must be `cron`, `delay`, or `self`)
+- **Schedule:** $schedule
+- **Intent:** $intent
+
+## Protocol
+
+Use the Python primitive — it validates the trigger and writes the charter:
+
+```bash
+omega cadence "$trigger_type" "$schedule" "$intent"
+```
+
+The CLI:
+1. Validates the trigger type and schedule format.
+2. Generates a stable charter id `cadence-<8hex>`.
+3. Writes the YAML to `Agentik_Orchestration/autonomous/<id>.yaml`.
+4. The `omega-autonomous` daemon picks it up at its next tick (≤ 60s).
+
+## Trigger formats
+
+| Type | Schedule example | What it does |
+|---|---|---|
+| `cron` | `"*/5 * * * *"` | Standard 5-field cron — every 5 minutes |
+| `cron` | `"0 9 * * 1"` | Every Monday at 09:00 |
+| `delay` | `"3600"` | Fire once 3600 seconds from now |
+| `self` | `"self"` | Tick every 60s, the agent decides whether to act |
+
+## After scheduling
+
+Inspect:
+```bash
+omega cadence list                   # all scheduled cadences
+omega cadence list --enabled         # active only
+```
+
+Disable / remove:
+```bash
+omega cadence disable cadence-abc123def
+omega cadence remove cadence-abc123def
+```
+
+## Hard rules
+
+- **Never** write directly to `Agentik_Orchestration/autonomous/` from this skill — use the CLI so the charter is validated.
+- A `delay` charter that fires once should set itself to `enabled: false` on completion (the supervisor handles this).
+- A `cron` charter runs until you disable it or remove it. Make sure the user understands the cadence is persistent.
+
+## Completion
+
+Write `Agentik_Runtime/sessions/${CLAUDE_SESSION_ID}/.done.json`:
+```json
+{
+  "status": "done_clean",
+  "summary": "Scheduled cadence <id>: <trigger> at <schedule> → <intent>",
+  "artifacts": {"charter_id": "...", "path": "..."}
+}
+```

package/omega/Agentik_SSOT/skills/codeaudit/SKILL.md

@@ -0,0 +1,153 @@
+---
+name: codeaudit
+description: Forensic code audit — Is the code SOLID — does every claim the code makes hold at runtime?. Runs the gather (deterministic) + falsify (agentic) pipeline, batches fixes, dispatches capped workers, re-audits, and persists scores. Use when the user says "/codeaudit", "audit code", or asks to verify the code health of the project.
+when_to_use: User says /codeaudit, audit code, check code, verify code, is code healthy.
+argument-hint: "[--scope <path>] [--fix] [--max-workers N]"
+arguments: [args]
+allowed-tools: Bash Read Edit Grep Glob Write
+---
+
+# codeaudit — forensic audit (Agentik OS Quality Arsenal)
+
+> Is the code SOLID — does every claim the code makes hold at runtime?
+
+You are running the codeaudit forensic audit. Apply the **Gestalt-Popper
+doctrine**: identify the hinge point, scrutinise it 10x, then assume
+every name is a CLAIM and look for the divergence between the claim and
+the reality. Bias toward FAIL. A perfect score is earned by finding zero
+falsifiable claims, never by absence of effort.
+
+## Run
+
+The audit is one engine call — gather (deterministic) + falsify (agentic)
++ optional fix-dispatch (capped) + re-audit. Invoke the unified pipeline:
+
+```bash
+omega audit run codeaudit $args
+```
+
+Common options:
+
+| Flag | Effect |
+|---|---|
+| `--scope <path>` | scope the audit (file or directory) |
+| `--fix` | after analysing, batch findings + dispatch up to N workers + re-audit |
+| `--max-workers N` | cap parallel fix workers (default 3) |
+| `--min-severity high` | only batch + fix findings at or above this severity |
+
+Read-only by default. Add `--fix` to enable the dispatch + re-audit loop.
+
+## Phases under investigation
+
+The agentic pass walks each phase below and emits structured findings
+(claim vs. reality). Every PASS must cite ≥3 concrete checks.
+
+### 1. phantoms
+
+Dead code, unreachable branches, unused exports, orphan files, commented-out blocks.
+
+### 2. contracts
+
+Names vs behaviour — does `validate` validate? does `save` persist? does `delete` remove?
+
+### 3. data-flow
+
+Trace every external input to its sink — find untrusted data reaching a query, shell, path or render unguarded.
+
+### 4. state-mutation
+
+Shared mutable state, hidden globals, mutation through aliases, unenforced ordering assumptions.
+
+### 5. concurrency
+
+Races, missing locks/awaits, parent finishing before children, double-execution, lost updates.
+
+### 6. error-propagation
+
+Swallowed exceptions, errors logged but not handled, failure paths that silently succeed.
+
+### 7. blast-radius
+
+If this module breaks, what else dies? Identify the hinge point; prove its defenses exist.
+
+### 8. time-bombs
+
+Hardcoded dates, expiring tokens, size limits, retry loops with no ceiling, resources never released.
+
+### 9. contract-vs-type
+
+Type annotations vs runtime reality — a `str` param that receives `None`; a return shape the type denies.
+
+### 10. feature-verification
+
+Does the feature the code claims actually work end to end, or is it a stub wired to nothing?
+
+### 11. test-coverage
+
+Are failure modes tested, or only the happy path? Do tests assert behaviour or merely run it?
+
+### 12. resilience
+
+Behaviour under bad input, network failure, empty data, concurrent callers — what breaks first?
+
+## Falsification rules
+
+Every PASS must cite at least 3 concrete checks with their actual output. Categorise every finding as CLAIM-vs-REALITY, PROMISE-vs-DELIVERY, or CONTRACT-vs-BEHAVIOUR. Bias toward FAIL — a 100 is earned by finding zero falsifiable claims, never assumed.
+
+## After the run
+
+The pipeline writes one structured verdict to:
+
+```
+Agentik_Runtime/audits.db    (history — `omega audit history codeaudit`)
+Agentik_Runtime/sessions/${CLAUDE_SESSION_ID}/.done.json   (this turn)
+```
+
+The `.done.json` schema:
+
+```json
+{
+  "status": "done_clean" | "pending" | "failed",
+  "summary": "<one-paragraph verdict>",
+  "artifacts": {
+    "audit": "codeaudit",
+    "score": 0-100,
+    "verified": bool,
+    "findings": [...],
+    "fix_plan": [...],
+    "dispatches": [...],
+    "reaudit_score": 0-100  // only when --fix was used
+  }
+}
+```
+
+## Hard rules (don't break these)
+
+1. **No fake "done".** First Law: only runtime tells the truth. If the
+   gather phase fails or the agentic verdict scores below the threshold,
+   you have NOT verified — set status to `pending` or `failed`.
+2. **Cap parallelism.** ≤ 3 fix workers at a time. The
+   batcher enforces this; do not call out to other dispatch mechanisms.
+3. **No worker per finding.** Findings are clustered by file footprint and
+   severity. One worker handles one disjoint batch.
+4. **Re-audit confirms.** After fixes land, the pipeline re-runs the same
+   gather + agentic phases. If the score did not improve, escalate honestly.
+5. **History is the trend.** `omega audit history codeaudit` shows whether the
+   codebase is improving over time on this dimension. Use it to decide
+   whether to push for `--fix` again.
+
+## Why this audit exists
+
+The 18 forensic audits are the OmegaOS verification layer. Claude's
+"I'm done" claims used to be unverified. With these audits running as
+the gate, completion is **derived from observable facts**, not declared
+by the worker. Run this audit any time someone (human or agent) claims
+the code dimension is healthy. Insist on the score before you
+accept.
+
+## Reference
+
+Audit definition: `Agentik_SSOT/audits/codeaudit.yaml`
+Engine pipeline:  `omega_engine.audits.pipeline.AuditPipeline`
+Batcher:          `omega_engine.audits.batcher.batch_findings`
+History:          `omega_engine.audits.history`

package/omega/Agentik_SSOT/skills/copyaudit/SKILL.md

@@ -0,0 +1,161 @@
+---
+name: copyaudit
+description: Forensic copy audit — Is the copy CLEAR — does every word earn its place and every claim hold?. Runs the gather (deterministic) + falsify (agentic) pipeline, batches fixes, dispatches capped workers, re-audits, and persists scores. Use when the user says "/copyaudit", "audit copy", or asks to verify the copy health of the project.
+when_to_use: User says /copyaudit, audit copy, check copy, verify copy, is copy healthy.
+argument-hint: "[--scope <path>] [--fix] [--max-workers N]"
+arguments: [args]
+allowed-tools: Bash Read Edit Grep Glob Write
+---
+
+# copyaudit — forensic audit (Agentik OS Quality Arsenal)
+
+> Is the copy CLEAR — does every word earn its place and every claim hold?
+
+You are running the copyaudit forensic audit. Apply the **Gestalt-Popper
+doctrine**: identify the hinge point, scrutinise it 10x, then assume
+every name is a CLAIM and look for the divergence between the claim and
+the reality. Bias toward FAIL. A perfect score is earned by finding zero
+falsifiable claims, never by absence of effort.
+
+## Run
+
+The audit is one engine call — gather (deterministic) + falsify (agentic)
++ optional fix-dispatch (capped) + re-audit. Invoke the unified pipeline:
+
+```bash
+omega audit run copyaudit $args
+```
+
+Common options:
+
+| Flag | Effect |
+|---|---|
+| `--scope <path>` | scope the audit (file or directory) |
+| `--fix` | after analysing, batch findings + dispatch up to N workers + re-audit |
+| `--max-workers N` | cap parallel fix workers (default 3) |
+| `--min-severity high` | only batch + fix findings at or above this severity |
+
+Read-only by default. Add `--fix` to enable the dispatch + re-audit loop.
+
+## Phases under investigation
+
+The agentic pass walks each phase below and emits structured findings
+(claim vs. reality). Every PASS must cite ≥3 concrete checks.
+
+### 1. headline-clarity
+
+The 5-second test on every H1 — can a stranger answer what/who/why in 5 seconds? No 'Welcome to' or 'About Us' as H1.
+
+### 2. value-proposition
+
+Is the value prop stated, consistent across pages, differentiated, and ACTUALLY deliverable in a new user's first session?
+
+### 3. claim-verification
+
+THE HINGE — every factual/subjective/social-proof/comparison claim falsified; PROMISE-vs-REALITY. 'fast' must be fast, 'secure' must have security.
+
+### 4. cta-effectiveness
+
+Action+benefit labels not 'Submit'; CTA destination matches the label ('Get Started' goes to getting started, not pricing); one primary CTA per section.
+
+### 5. tone-consistency
+
+One brand voice across marketing, product, errors, email — no 'fun and casual' marketing with 'cold and corporate' product copy.
+
+### 6. technical-accuracy
+
+Every described feature exists and behaves as described; screenshots show current UI; comparison tables fair and current.
+
+### 7. grammar-spelling
+
+Zero typos and grammatical errors in user-facing copy; consistent punctuation, capitalization, number and date formats; product name spelled correctly.
+
+### 8. reading-level
+
+Flesch-Kincaid grade <=8 marketing / <=10 product; sentences <20 words; active voice; jargon simplified or explained; acronyms expanded on first use.
+
+### 9. microcopy
+
+Button labels describe their action; error messages say what went wrong AND how to fix it; empty states teach; success states confirm and suggest next step.
+
+### 10. social-proof
+
+Testimonials from real identifiable people; user counts and ratings accurate and current; 'as seen in' logos correspond to actual coverage.
+
+### 11. legal-compliance
+
+Required disclaimers (pricing taxes/billing, trial auto-renewal); no deceptive dark patterns in copy; no false competitor claims; unsubscribe instructions clear.
+
+### 12. copy-accessibility
+
+Link text makes sense out of context; inclusive non-ableist gender-neutral language; instructions simple and direct; diverse names in examples.
+
+### 13. brand-voice
+
+Voice recognizable without seeing the brand, appropriate for the audience, never sacrificing clarity for personality.
+
+### 14. i18n-readiness
+
+User-facing strings extractable via t()/_()/<Trans> when the project has i18n infrastructure; hardcoded English strings flagged.
+
+## Falsification rules
+
+Every claim is a hypothesis — attempt to disprove it. Every PASS must cite at least 3 concrete checks with actual output. Categorise findings as PROMISE-vs-REALITY, CLARITY-vs-CONFUSION, TONE-vs-AUDIENCE, CLAIM-vs-EVIDENCE, or CTA-vs-ACTION. "Nobody reads the copy" is never the user's fault — it means the copy failed. Bias toward FAIL — a claim without evidence is a lie until proven.
+
+## After the run
+
+The pipeline writes one structured verdict to:
+
+```
+Agentik_Runtime/audits.db    (history — `omega audit history copyaudit`)
+Agentik_Runtime/sessions/${CLAUDE_SESSION_ID}/.done.json   (this turn)
+```
+
+The `.done.json` schema:
+
+```json
+{
+  "status": "done_clean" | "pending" | "failed",
+  "summary": "<one-paragraph verdict>",
+  "artifacts": {
+    "audit": "copyaudit",
+    "score": 0-100,
+    "verified": bool,
+    "findings": [...],
+    "fix_plan": [...],
+    "dispatches": [...],
+    "reaudit_score": 0-100  // only when --fix was used
+  }
+}
+```
+
+## Hard rules (don't break these)
+
+1. **No fake "done".** First Law: only runtime tells the truth. If the
+   gather phase fails or the agentic verdict scores below the threshold,
+   you have NOT verified — set status to `pending` or `failed`.
+2. **Cap parallelism.** ≤ 3 fix workers at a time. The
+   batcher enforces this; do not call out to other dispatch mechanisms.
+3. **No worker per finding.** Findings are clustered by file footprint and
+   severity. One worker handles one disjoint batch.
+4. **Re-audit confirms.** After fixes land, the pipeline re-runs the same
+   gather + agentic phases. If the score did not improve, escalate honestly.
+5. **History is the trend.** `omega audit history copyaudit` shows whether the
+   codebase is improving over time on this dimension. Use it to decide
+   whether to push for `--fix` again.
+
+## Why this audit exists
+
+The 18 forensic audits are the OmegaOS verification layer. Claude's
+"I'm done" claims used to be unverified. With these audits running as
+the gate, completion is **derived from observable facts**, not declared
+by the worker. Run this audit any time someone (human or agent) claims
+the copy dimension is healthy. Insist on the score before you
+accept.
+
+## Reference
+
+Audit definition: `Agentik_SSOT/audits/copyaudit.yaml`
+Engine pipeline:  `omega_engine.audits.pipeline.AuditPipeline`
+Batcher:          `omega_engine.audits.batcher.batch_findings`
+History:          `omega_engine.audits.history`