@sriinnu/omit 0.3.0 → 0.4.0

package/.clinerules/omit.md

@@ -4,7 +4,7 @@ Great software is edited, not written. You are the editor, not just the author.
 
 **Before code: the Seven Omissions** (stop at the first that holds): (1) Omit the feature: speculative need = needless until proven needed; write nothing. (2) Omit the new code: the codebase already does this; reuse it. (3) Omit the custom: stdlib covers it. (4) Omit the script: the platform does it natively. (5) Omit the dependency: an installed dep covers it; never add a new one for a few lines. (6) Omit the ceremony: one plain line beats a pattern. (7) What survives editing, ships.
 
-**Fact-Check**: no omission counts until verified now: codebase reuse → cite path:line; stdlib/platform claims → real docs or a run snippet; dependency claims → manifest + API exists in the installed version.
+**Fact-Check**: no omission counts until verified now, and verified means checkable by something other than you. Record each in `.omit/receipts.jsonl`: reuse → `{"claim":"reuse","rung":2,"file":"src/x.ts","line":42,"symbol":"name"}`; stdlib/platform → `{"claim":"stdlib","rung":3,"api":"<function>","run":["node","-e","<snippet>"]}`; installed dep → `{"claim":"installed-dep","rung":5,"dep":"zod","run":["node","-e","require('zod').object"]}`; a NEW dependency → `{"claim":"new-dep","rung":7,"dep":"x","tried":[{"rung":2,"absent":"<symbol you searched for>"}]}`. `run` must name the api/dep it exercises — a snippet whose exit status is the whole evidence (`["true"]`, `["false"]`) proves nothing. A `tried` entry cites a symbol to search the tree for, not a file, and every entry must fail its own check. `run` is argv, never a shell string. `omit verify` re-checks them all; a claim that does not survive is not a claim.
 
 **Final Draft**: after tests go green, one ruthless edit of your own diff; report the net (±lines, files, new deps: target 0). Done = final draft, not green tests.
 

package/.cursor/rules/omit.mdc

@@ -14,7 +14,7 @@ BEFORE code: the Seven Omissions (stop at the first that holds):
 6. Omit the ceremony: one plain line beats a pattern.
 7. What survives editing, ships: minimum that works, fewest files, shortest diff.
 
-FACT-CHECK: no omission counts until verified now: codebase reuse → cite path:line; stdlib/platform claims → real docs or a run snippet; dependency claims → in the manifest AND the API exists in the installed version. A hallucinated shortcut is a fabricated quote.
+FACT-CHECK: no omission counts until verified now, and verified means checkable by something other than you. Record each in `.omit/receipts.jsonl`: reuse → `{"claim":"reuse","rung":2,"file":"src/x.ts","line":42,"symbol":"name"}`; stdlib/platform → `{"claim":"stdlib","rung":3,"api":"<function>","run":["node","-e","<snippet>"]}`; installed dep → `{"claim":"installed-dep","rung":5,"dep":"zod","run":["node","-e","require('zod').object"]}`; a NEW dependency → `{"claim":"new-dep","rung":7,"dep":"x","tried":[{"rung":2,"absent":"<symbol you searched for>"}]}`. `run` must name the api/dep it exercises — a snippet whose exit status is the whole evidence (`["true"]`, `["false"]`) proves nothing. A `tried` entry cites a symbol to search the tree for, not a file, and every entry must fail its own check. `run` is argv, never a shell string. `omit verify` re-checks them all; a hallucinated shortcut is a fabricated citation, and it does not survive one.
 
 AFTER green: the Final Draft: one ruthless edit of your own diff (dead branches, unused params/imports, speculative options, restating comments, single-caller indirection). Report the net: ±lines, files, new deps (target 0). Done = final draft, not green tests.
 

package/.github/copilot-instructions.md

@@ -0,0 +1,15 @@
+# omit: Omit needless code.
+
+Great software is edited, not written. You are the editor, not just the author. Draft less, cite everything, cut last.
+
+**Before code, the Seven Omissions** (stop at the first that holds): (1) Omit the feature: speculative need is needless until proven needed; write nothing. (2) Omit the new code: the codebase already does this; reuse it. (3) Omit the custom: stdlib covers it. (4) Omit the script: the platform does it natively. (5) Omit the dependency: an installed dep covers it; never add a new one for a few lines. (6) Omit the ceremony: one plain line beats a pattern. (7) What survives editing, ships.
+
+**Fact-Check**: no omission counts until verified now, and verified means checkable by something other than you. Record each in `.omit/receipts.jsonl`: reuse → `{"claim":"reuse","rung":2,"file":"src/x.ts","line":42,"symbol":"name"}`; stdlib/platform → `{"claim":"stdlib","rung":3,"api":"<function>","run":["node","-e","<snippet>"]}`; installed dep → `{"claim":"installed-dep","rung":5,"dep":"zod","run":["node","-e","require('zod').object"]}`; a NEW dependency → `{"claim":"new-dep","rung":7,"dep":"x","tried":[{"rung":2,"absent":"<symbol you searched for>"}]}`. `run` must name the api/dep it exercises — a snippet whose exit status is the whole evidence (`["true"]`, `["false"]`) proves nothing. A `tried` entry cites a symbol to search the tree for, not a file, and every entry must fail its own check. `run` is argv, never a shell string. `omit verify` re-checks them all; a claim that does not survive is not a claim.
+
+**Final Draft**: after tests go green, one ruthless edit of your own diff; report the net (plus/minus lines, files, new deps, target 0). Done means final draft, not green tests.
+
+**Never cut load-bearing lines**: validation at trust boundaries, error handling preventing data loss, security, accessibility, concurrency correctness, explicit requests. Announce them (`load-bearing: <reason>`), never skip them.
+
+**Footnotes**: record deliberate omissions: `// omitted: <what>; <when to add it back>`.
+
+**Voice**: root causes, not symptoms; boring beats clever; deletion is the strongest edit.

package/.github/workflows/publish.yml

@@ -0,0 +1,69 @@
+name: Publish to npm
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Verify tag matches package.json version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PKG_VERSION="$(node -p "require('./package.json').version")"
+          PKG_NAME="$(node -p "require('./package.json').name")"
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "Tag v$TAG_VERSION does not match package.json version $PKG_VERSION"
+            exit 1
+          fi
+          echo "PKG_NAME=$PKG_NAME" >> "$GITHUB_ENV"
+          echo "PKG_VERSION=$PKG_VERSION" >> "$GITHUB_ENV"
+
+      - name: Skip if already published
+        id: check
+        run: |
+          if npm view "$PKG_NAME@$PKG_VERSION" version >/dev/null 2>&1; then
+            echo "Already on the registry, nothing to do."
+            echo "already_published=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "already_published=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish
+        if: steps.check.outputs.already_published == 'false'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          if npm publish --access public --provenance; then
+            echo "Publish succeeded."
+            exit 0
+          fi
+
+          # npm's registry can 404 a fresh scoped package's first publish for a
+          # few seconds after the write actually lands (read-replica lag), which
+          # makes npm publish report failure even though the version is live.
+          # Poll before trusting the error.
+          echo "npm publish reported failure; checking whether it landed anyway..."
+          for i in $(seq 1 10); do
+            sleep 6
+            if npm view "$PKG_NAME@$PKG_VERSION" version >/dev/null 2>&1; then
+              echo "Version $PKG_VERSION is live on the registry — treating as success."
+              exit 0
+            fi
+          done
+
+          echo "Version never appeared on the registry after retries. Publish failed."
+          exit 1

package/.github/workflows/test.yml

@@ -0,0 +1,40 @@
+name: Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - run: npm test
+
+      # action.yml is read by GitHub's action loader, not by anything in this
+      # repo, so an invalid one fails silently: the Action simply never runs and
+      # no check here notices. It shipped invalid once already — an unquoted
+      # ": " inside the description — which no test, and no reviewer, caught.
+      - name: action.yml parses
+        run: |
+          python3 - <<'PY'
+          import sys
+          try:
+              import yaml
+          except ImportError:
+              # Announced rather than silent: on a runner without PyYAML this
+              # guard is advisory, and saying so beats implying it ran.
+              print("PyYAML unavailable on this runner — action.yml was NOT validated")
+              sys.exit(0)
+          doc = yaml.safe_load(open("action.yml"))
+          for key in ("name", "description", "runs"):
+              assert key in doc, f"action.yml is missing a required key: {key}"
+          assert doc["runs"].get("using") == "composite", "runs.using must be composite"
+          print("action.yml parses and carries its required keys")
+          PY

package/.windsurf/rules/omit.md

@@ -4,7 +4,7 @@ Great software is edited, not written. You are the editor, not just the author.
 
 **Before code: the Seven Omissions** (stop at the first that holds): (1) Omit the feature: speculative need = needless until proven needed; write nothing. (2) Omit the new code: the codebase already does this; reuse it. (3) Omit the custom: stdlib covers it. (4) Omit the script: the platform does it natively. (5) Omit the dependency: an installed dep covers it; never add a new one for a few lines. (6) Omit the ceremony: one plain line beats a pattern. (7) What survives editing, ships.
 
-**Fact-Check**: no omission counts until verified now: codebase reuse → cite path:line; stdlib/platform claims → real docs or a run snippet; dependency claims → manifest + API exists in the installed version.
+**Fact-Check**: no omission counts until verified now, and verified means checkable by something other than you. Record each in `.omit/receipts.jsonl`: reuse → `{"claim":"reuse","rung":2,"file":"src/x.ts","line":42,"symbol":"name"}`; stdlib/platform → `{"claim":"stdlib","rung":3,"api":"<function>","run":["node","-e","<snippet>"]}`; installed dep → `{"claim":"installed-dep","rung":5,"dep":"zod","run":["node","-e","require('zod').object"]}`; a NEW dependency → `{"claim":"new-dep","rung":7,"dep":"x","tried":[{"rung":2,"absent":"<symbol you searched for>"}]}`. `run` must name the api/dep it exercises — a snippet whose exit status is the whole evidence (`["true"]`, `["false"]`) proves nothing. A `tried` entry cites a symbol to search the tree for, not a file, and every entry must fail its own check. `run` is argv, never a shell string. `omit verify` re-checks them all; a claim that does not survive is not a claim.
 
 **Final Draft**: after tests go green, one ruthless edit of your own diff; report the net (±lines, files, new deps: target 0). Done = final draft, not green tests.
 

package/AGENTS.md

@@ -20,11 +20,20 @@ Try to omit, in order: stop at the first omission that holds:
 
 ## The Fact-Check
 
-No omission counts until verified in this session: codebase reuse → cite `path:line`; stdlib/platform claims → real docs or a run snippet; dependency claims → in the manifest AND the API exists in the installed version. No citation, no omission.
+No omission counts until verified in this session — and verified means checkable by something other than you. Record each one in `.omit/receipts.jsonl`, one JSON object per line, naming its own evidence:
+
+```
+{"claim":"reuse","rung":2,"file":"src/x.ts","line":42,"symbol":"parseRange"}
+{"claim":"stdlib","rung":3,"api":"crypto.randomUUID","run":["node","-e","crypto.randomUUID()"]}
+{"claim":"installed-dep","rung":5,"dep":"zod","run":["node","-e","require('zod').object"]}
+{"claim":"new-dep","rung":7,"dep":"left-pad","tried":[{"rung":2,"absent":"padTo"}]}
+```
+
+Evidence is bound to the claim: a snippet's exit status proves nothing on its own, so `run` must also name what it exercises and the argv must mention it. `run` is argv, never a shell string. A `tried` entry cites a symbol to search the tree for, not a location — citing a file that merely does not exist proves nothing. A `new-dep` receipt is the strongest claim: it asserts omissions 2-5 were tried and did not hold, so every `tried` entry is re-checked and must fail. `omit verify` re-checks the ledger; `omit gate` refuses a new dependency cited by anything less. No receipt, no omission.
 
 ## After code works: the Final Draft
 
-One ruthless edit of your own diff: dead branches, unused params/imports, speculative options, comments restating code, single-caller indirection. Report the net (+/− lines, files, new deps: target 0). Done = final draft, not green tests.
+One ruthless edit of your own diff: dead branches, unused params/imports, speculative options, comments restating code, single-caller indirection. Write the net report to `.omit/final-draft.md` in the shape the stop gate parses — `files touched: <n>`, `lines +<added> −<removed>`, `new dependencies: <n>` (untracked files count; `omit audit` prints exactly these). Done = final draft, not green tests.
 
 ## Load-Bearing Lines: never cut
 

package/README.md

@@ -24,7 +24,7 @@ AI agents are prolific authors and terrible editors. Left alone they add abstrac
 | Part | What it does |
 |---|---|
 | **The Seven Omissions** | Before writing anything, try seven ways to *not* write it: omit the feature, the new code, the custom, the script, the dependency, the ceremony: stopping at the first omission that holds. What survives editing, ships. |
-| **The Fact-Check** | No omission counts without a citation verified this session: `path:line` for "the codebase has this", real docs or a run snippet for "stdlib covers it", manifest + installed API for "the dep handles it". A hallucinated shortcut is a fabricated quote. |
+| **The Fact-Check** | No omission counts without a citation **the tool can re-check itself**: `file:line:symbol` for "the codebase has this", an executable snippet for "stdlib covers it", a declared dep + snippet for "the dep handles it". A citation only its author can read is a self-report, and a hallucinated shortcut is a fabricated citation. |
 | **The Final Draft** | Working code is a first draft. After tests go green, one ruthless edit of the agent's own diff: then a net report: files, ±lines, new deps (target: 0). Done means final draft, not green tests. |
 | **Load-Bearing Lines** | Editing cuts fat, not walls. Validation, error handling, security, accessibility, concurrency correctness, and explicit requests are never cut: and adding them is announced, never smuggled or skipped. |
 
@@ -40,27 +40,78 @@ Every other skill in this genre is words the agent can ignore under context pres
 
 | Mechanism | What it does |
 |---|---|
-| **Command sentinel** (hook) | Inspects every shell command BEFORE it runs and blocks the classic agent disasters: `rm -rf ~`, recursive deletes of system/drive roots, deletes through unset variables (`rm -rf $OUT/*` with `$OUT` empty), `dd` to block devices, `mkfs`, fork bombs. The user's machine is load-bearing. |
-| **Dep sentinel** (hook) | A new dependency hits a manifest with no receipt in `.omit/receipts.jsonl` → the edit is objected to on the spot. Cite why omissions 2-5 failed, or revert. |
-| **Hazard sentinel** (hook) | Hardcoded API keys/secrets and injection-prone patterns (string-built SQL, `eval`, shell concatenation, `innerHTML`, unsafe deserialization) are blocked the moment they land in a file. Secrets have no override; injection lines need a reviewed `omit-allow: <reason>`. |
-| **Lint sentinel** (hook) | omit ships no lint rules. It detects the linter the repo already configured (eslint, biome, ruff, flake8) and runs it on every edited file, so the agent hears objections immediately instead of at CI time. |
-| **Final Draft gate** (hook) | The session cannot end with an edited tree and no `.omit/final-draft.md` net report. The deletion pass is a gate, not a suggestion. |
-| **Receipts ledger** | Every Fact-Check citation is appended to `.omit/receipts.jsonl`: an auditable trail of the agent's claims your reviewers can actually read. |
+| **Command sentinel** (hook) | Inspects every shell command BEFORE it runs and blocks the classic agent disasters: `rm -rf ~`, recursive deletes of system/drive roots, deletes through unset variables (`rm -rf $OUT/*` with `$OUT` empty), `dd` to block devices, `mkfs`, fork bombs. The user's machine is load-bearing. Waiving one takes a trailing comment carrying a real reason — `# omit-allow: <reason>`. The bare token, a token inside a string literal, and a reason-less marker are ignored. |
+| **Dep sentinel** (hook) | A new dependency hits a manifest with no *verified* receipt in `.omit/receipts.jsonl` → the edit is objected to on the spot. The receipt has to name the omissions that were tried, and each one is re-checked: if an omission actually applies, the receipt is refuted and the dependency is refused. |
+| **Hazard sentinel** (hook) | Hardcoded API keys/secrets and injection-prone patterns (string-built SQL, `eval`, shell concatenation, `innerHTML`, unsafe deserialization) are blocked the moment they land in a file. **Secrets have no override** — the secret rules run before any marker is consulted, so no `omit-allow:` waives one. Injection lines take a trailing comment with a real reason, and only that form. |
+| **Leak sentinel** (hook) | Blocks shell commands that print an *existing* secret's raw value to stdout before they run, or a live key typed straight into the command line: macOS Keychain, Linux `secret-tool`/`pass`/`gpg -d`, 1Password/Vault/AWS/GCP/Azure/kubectl secret CLIs, bare `env`/`printenv`, `env \| grep`-ing a KEY/TOKEN/SECRET/connection-string var, or `cat`-ing a `.env`/`credentials`/`*.pem`/`id_rsa` file. Redirecting to a real file or piping into a non-printing sink (clipboard, `--password-stdin`) is recognized as safe — the goal is keeping secrets out of the transcript, not off disk. Adversarially reviewed (3 lenses, every finding re-verified by execution, not inspection) before shipping — one known gap stays undetected on purpose rather than chasing a fragile fix: a `for`/`do`/`done > file` loop's trailing redirect isn't attributed back to the loop body. The agent's own transcript is not a safe place for a real key. |
+| **Lint sentinel** (hook) | omit ships no lint rules. It detects the linter the repo already configured (eslint, biome, ruff, flake8) and runs it on every edited file, so the agent hears objections immediately instead of at CI time. A linter that is configured but cannot be run — no `node_modules`, nothing on PATH — is reported as *not run* with the reason, never as a pass; "no linter configured" is now reserved for a repo that genuinely has none. |
+| **Final Draft gate** (hook) | The session cannot end with an edited tree and no current `.omit/final-draft.md` net report — and the report is read, not just stat'd. Its files/lines/deps counts are cross-checked against the actual diff, so a stub or a stale draft does not pass. The deletion pass is a gate, not a suggestion. |
+| **Receipts ledger** | Every Fact-Check citation is appended to `.omit/receipts.jsonl` as a claim *plus the evidence that settles it*, and `omit verify` re-checks the lot. Run it on a PR: "17/17 claims survived" is a number a reviewer can act on, and "3 refuted" names exactly which shortcuts were invented. |
 
-Hooks install automatically with the Claude Code plugin. Escape hatch for humans: `OMIT_OFF=1`.
+Hooks install automatically with the Claude Code plugin. Codex CLI has its own hooks system in the same shape (`PreToolUse` fires with `tool_input.command` for Bash, exit 2 blocks) — run `npx @sriinnu/omit hook install codex` to write `.codex/hooks.json`. The command and leak sentinels are verified against Codex's documented schema and payload shape (not yet a live Codex session firing them end-to-end); the file-based sentinels (dep/hazard/lint) and the Final Draft gate are wired too but best-effort, since Codex's `apply_patch` input shape for those isn't verified. Escape hatch for humans: `OMIT_OFF=1`.
+
+## What this does not catch
+
+A table of mechanisms invites you to read it as a guarantee. It isn't one, so here is the rest of it. Every item below is a known, reproduced limit, not a hypothetical.
+
+- **Writes whose path cannot be read out of the command reach no file sentinel.** `python -c "open('f','w').write(...)"`, `curl -o f`, `node -e fs.writeFileSync`. A literal secret in such a command is still caught by the command-text scan; its *injection* patterns are not. The same goes for a file rewritten through a tool no sentinel is wired to.
+- **`omit gate` is a git hook.** `git commit --no-verify` skips it, and `core.hooksPath` shadows it entirely — `omit audit` and `omit gate` both report that in the verdict, and `omit hook install` writes to whichever directory git actually runs hooks from, but nothing can stop you bypassing your own pre-commit hook.
+- **The dependency allowlist is short.** `setup.py`, `build.gradle`, `Package.swift` and `*.csproj` are dependency-shaped and unparsed. They are now *reported* (`unparsed deps: …`) rather than counted as zero, and a changed one suppresses the `✅` on the deps row — but the gate does not fail on them, because a `setup.py` in a repo is not evidence of anything.
+- **The lint sentinel runs your linter in your session**, which executes your lint config — the same trust as running `npm run lint` yourself. In the GitHub Action it is gated: with the default `exec: false`, CI does not run the linter at all, and the verdict says *not run* rather than claiming a pass.
+- **Receipt evidence is bound to its claim textually.** A `run` snippet must name what it exercises and the argv must mention it, which closes snippets that exit on demand (`["true"]`, `["false"]`). It does not catch a snippet that names a symbol without calling it. Proving that would mean the verifier writing the snippet, and then it is testing the verifier.
+- **`omit`'s own directory is exempt** from the hazard scan, because the ledger holds evidence strings by construction. Its execution risk is what `OMIT_HOOK_EXEC` gates.
+- **The Action does not run a PR's receipts** unless you set `with: { exec: true }`. A PR's `run` snippets are untrusted code, so the default is not to execute them.
+
+`// omitted: a mechanism for the first item above` would be a shell parser, and a wrong shell parser is worse than none. It is left out on purpose.
+
+## Receipts: the claim and the evidence, in one line
+
+Minimalism is a taste, and taste has no receipt. The failure mode underneath it does: the agent says *"the codebase already does this"* or *"stdlib covers it"*, and nobody checks. Every rule file in this genre **tells** the agent not to lie. `omit` checks.
+
+Each claim lands in `.omit/receipts.jsonl` with the evidence that settles it:
+
+```json
+{"claim":"reuse","rung":2,"file":"src/util.ts","line":42,"symbol":"parseRange"}
+{"claim":"stdlib","rung":3,"api":"crypto.randomUUID","run":["node","-e","crypto.randomUUID()"]}
+{"claim":"installed-dep","rung":5,"dep":"zod","run":["node","-e","require('zod').object"]}
+{"claim":"new-dep","rung":7,"dep":"left-pad","tried":[{"rung":2,"absent":"padTo"}]}
+```
+
+```
+$ npx @sriinnu/omit verify
+✅ line   1  verified      reuse
+⛔ line   2  failed        new-dep
+        [new-dep] tried[0] (rung 2) actually HOLDS: padTo is present at src/util.ts — so the omission applies and this dep is not needed
+
+1/2 claims survived re-checking · 1 refuted · 0 unverifiable
+```
+
+That second one is the whole idea. A `new-dep` receipt exists to say *"I tried the earlier omissions and none of them held"* — so it cites the symbol it looked for, `omit` searches the tree for itself, and a symbol that **is** there refutes the agent's own conclusion. When the author supplies the question instead of the evidence, citing your way past an omission you never tried stops being possible.
+
+Two bindings make that hold, and neither is decorative:
+
+- **`run` must name what it exercises** (`api`, or the dependency), and the argv must mention it. Exit status alone proves nothing: `["true"]` exits 0 and `["false"]` exits 1 while testing neither the standard library nor anything else. A snippet that exits on demand is not evidence.
+- **A `tried` entry cites a search, not a location.** Naming a file that merely doesn't exist proves nothing — and it used to be the cheapest possible way to fake "I tried reuse", because the check only asked whether it failed.
+
+`run` is an argv array, never a shell string: nothing expands, nothing hides in an argument. `.omit/receipts.jsonl` is executable in the same sense a Makefile is — read it in a PR the way you'd read one. `OMIT_NO_EXEC=1` downgrades those checks to "unverifiable" instead of executing them, and the dependency hook does not execute them at all unless you set `OMIT_HOOK_EXEC=1`: a *Write* of the ledger would otherwise run code as you, with no approval prompt.
+
+**Upgrading from 0.3.x:** the shapes above are the 0.4.0 schema. A receipt written before it — a prose `receipt` string, or a `tried` entry citing a file — reads as `unverifiable`, which `omit verify` names individually. They are not silently accepted, and they are not silently dropped.
 
 ## Any provider, same gates
 
-The enforcement logic lives in a zero-dependency CLI, not in any one vendor's hook system: Claude Code's hooks are just thin adapters over it. For Cursor, Codex, Copilot, or anything else, enforce at the two chokepoints every agent passes through:
+The enforcement logic lives in a zero-dependency CLI, not in any one vendor's hook system: Claude Code's and Codex's hooks are both just thin adapters over it. For Cursor, Copilot, or anything else, enforce at the two chokepoints every agent passes through:
 
 ```
 npx @sriinnu/omit hook install   # git pre-commit: audits the staged diff,
                                  # fails on secrets, injections, uncited deps
-npx @sriinnu/omit audit          # net diff, new deps, hazards, omit score
+npx @sriinnu/omit audit          # net diff (untracked files included), new deps, hazards
 npx @sriinnu/omit check <files>  # hazard-scan specific files (wire into any hook system)
 npx @sriinnu/omit lint [files]   # run the repo's OWN linter on changed files
+npx @sriinnu/omit verify         # re-check every claim in .omit/receipts.jsonl
 npx @sriinnu/omit guard "<cmd>"  # is this shell command a disaster? (wire into any hook system)
+npx @sriinnu/omit leak "<cmd>"   # would this command print a real secret to stdout?
 npx @sriinnu/omit gate           # the pre-commit check, callable from anywhere
+npx @sriinnu/omit hook install codex  # write .codex/hooks.json — live sentinels inside Codex CLI
 ```
 
 And server-side, the GitHub Action comments the verdict on every PR regardless of what wrote the code:
@@ -76,6 +127,9 @@ jobs:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }
       - uses: sriinnu/omit@main
+        # with: { exec: true }   # execute receipts' `run` snippets to verify them
+                                 # fully. Off by default: a PR's receipts are
+                                 # untrusted code, and this runs on pull requests.
 ```
 
 ```
@@ -84,7 +138,14 @@ jobs:
 - new deps: 0 ✅
 - hazards: 0 ✅
 - footnotes: 3 recorded · load-bearing: 1 marked
-- omit score: 91/100 🟢
+- receipts: 17/17 verified
+- lint: eslint ✅
+```
+
+```
+// omitted: a composite "omit score": any weight vector over these counts is
+// invented, and footnotes could raise it by adding lines. The counts above are
+// the receipts; a single number would just be another uncited claim.
 ```
 
 ## The referee (experimental)
@@ -162,10 +223,6 @@ skills/omit/SKILL.md  →  .claude/skills/omit/SKILL.md      (project)
 - `/omit [margin|redline|rewrite|off]`: switch or show the current mode
 - `/omit-edit`: run an editor's pass over the current diff: flag bloat, uncited claims, missing footnotes, and cut opportunities
 
-## Benchmarks
-
-None yet: and we won't publish numbers we can't hand you the harness for. `benchmarks/METHODOLOGY.md` defines the measurement we consider honest (paired tasks, agentic baseline, net LOC / new deps / defect rate / load-bearing violations, full transcripts). Reproducible runs are the most welcome PR this repo can receive.
-
 ## Prior art
 
 The minimalism-pressure idea was popularized by [ponytail](https://github.com/DietrichGebert/ponytail), which deserves its stars. `omit` differs where it matters: shortcuts require citations, the diff is edited *after* it works, safety lines are enumerated and never cut, and what's left out is footnoted instead of silent.

package/action.yml

@@ -1,5 +1,5 @@
 name: omit audit
-description: Comment the omit verdict (net diff, new deps, hazards, score) on pull requests: works whatever agent or editor wrote the code.
+description: Comment the omit verdict (net diff, new deps, hazards, lint) on pull requests — works whatever agent or editor wrote the code.
 branding:
   icon: scissors
   color: gray-dark
@@ -8,11 +8,28 @@ inputs:
     description: Base ref to diff against
     required: false
     default: ''
+  exec:
+    description: >
+      Execute the `run` snippets in .omit/receipts.jsonl to fully verify them.
+      Off by default: a PR's receipts are untrusted code, and this action runs on
+      pull requests. Turn it on for repos whose PRs you already run code from.
+      Also gates the repo's own linter, which a PR's config file can make
+      arbitrary: with exec off, the verdict reports the linter as not run.
+    required: false
+    default: 'false'
 runs:
   using: composite
   steps:
     - name: Run omit audit
       shell: bash
+      env:
+        # Inverted on purpose. The obvious `exec == 'true' && '' || '1'` never
+        # enables anything: '' is falsy in an expression, so the `&&` yields
+        # false and the `||` always takes '1'. Here the value being truth-tested
+        # is '1', which is never ambiguous, and the enabled branch yields '0' —
+        # an explicit off-value for OMIT_NO_EXEC, so the input can never mean
+        # "maybe". Anything that isn't exactly 'true' stays disabled.
+        OMIT_NO_EXEC: ${{ inputs.exec != 'true' && '1' || '0' }}
       run: |
         BASE="${{ inputs.base }}"
         if [ -z "$BASE" ]; then BASE="origin/${{ github.event.pull_request.base.ref }}"; fi

package/bench/run.mjs

@@ -10,6 +10,7 @@ import { tmpdir } from 'node:os'
 import { basename, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { isManifest, addedDeps } from '../lib/deps.mjs'
+import { fileAtRevision } from '../lib/git.mjs'
 import { findHazards } from '../lib/hazards.mjs'
 
 const configPath = process.argv[2]
@@ -51,7 +52,7 @@ for (const task of cfg.tasks) {
     const durationMs = Date.now() - t0
 
     // metrics vs the base commit
-    let added = 0, deleted = 0, newDeps = [], hazards = []
+    let added = 0, deleted = 0, newDeps = [], hazards = [], metricsError = null
     try {
       sh('git add -A', dir)
       for (const row of sh('git diff --cached --numstat', dir).split('\n').filter(Boolean)) {
@@ -59,11 +60,30 @@ for (const task of cfg.tasks) {
         if (a === '-') continue
         added += +a
         deleted += +d
-        if (isManifest(path)) newDeps.push(...addedDeps(basename(path), sh(`git diff --cached -- "${path}"`, dir)))
+        // Declared dependency sets across the two revisions, not diff lines:
+        // the arm's manifest is read the same whether the agent wrote it
+        // minified or pretty-printed.
+        if (isManifest(path)) {
+          let after = ''
+          try {
+            after = readFileSync(join(dir, path), 'utf8')
+          } catch {}
+          // Three outcomes, not string-or-null: "git could not answer" used to
+          // coalesce to '' and report every dependency the manifest declares as
+          // newly added — a measurement nobody made, in a file of measurements.
+          const before = fileAtRevision(dir, 'HEAD', path)
+          if (before.failed) throw new Error(`git could not read ${path} at HEAD: ${before.reason}`)
+          newDeps.push(...addedDeps(basename(path), before.present ? before.text : '', after))
+        }
       }
       const addedLines = sh('git diff --cached', dir).split('\n').filter((l) => l.startsWith('+') && !l.startsWith('+++')).map((l) => l.slice(1))
       hazards = findHazards(addedLines)
-    } catch {}
+    } catch (e) {
+      // Swallowing this printed "deps +0 · hazards 0" for a run nothing measured.
+      // The harness keeps going (it is a referee, not a gate) but the run's
+      // record says which metrics are missing, and the summary counts the run.
+      metricsError = e.message
+    }
 
     let testPass = null
     if (task.testCmd) {
@@ -71,10 +91,11 @@ for (const task of cfg.tasks) {
       testPass = t.status === 0
     }
 
-    const rec = { task: task.id, arm: arm.name, added, deleted, net: added - deleted, newDeps, hazards: hazards.length, testPass, durationMs, dir }
+    const rec = { task: task.id, arm: arm.name, added, deleted, net: added - deleted, newDeps, hazards: hazards.length, testPass, durationMs, dir, ...(metricsError ? { metricsError } : {}) }
     results.push(rec)
     writeFileSync(join(benchRoot, `${task.id}--${arm.name}.log`), `${run.stdout ?? ''}\n--- stderr ---\n${run.stderr ?? ''}`)
     console.log(`   net ${rec.net >= 0 ? '+' : ''}${rec.net} · deps +${newDeps.length} · hazards ${rec.hazards} · tests ${testPass === null ? 'n/a' : testPass ? 'pass' : 'FAIL'} · ${(durationMs / 1000).toFixed(0)}s`)
+    if (metricsError) console.log(`   ⚠ metrics incomplete: ${metricsError}`)
   }
 }