@trac3er/oh-my-god 2.0.3 → 2.0.5

package/dist/public/manifest.json

@@ -0,0 +1,255 @@
+{
+  "schema": "OmgCompiledArtifactManifest",
+  "channel": "public",
+  "contract_version": "2.0.5",
+  "artifacts": [
+    {
+      "path": "bundle/.agents/skills/omg/AGENTS.fragment.md",
+      "sha256": "603430cb291632105fda7444ae018da521cc3a57c71c1a1c98179efea42ce0f2"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/algorithms/SKILL.md",
+      "sha256": "48042e7ab674ef67c2d8a71a75abdd81aeee4363cb5e97c775c320d4edab33fb"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/algorithms/openai.yaml",
+      "sha256": "6196d26b4daf429292565142d3ed7233024402cc9206fd5df9e5f848231a79c6"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/api-twin/SKILL.md",
+      "sha256": "b394b7779173318ed29662c3c11bfa05b5d037d3a927b16bea28560a62752437"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/api-twin/openai.yaml",
+      "sha256": "8b711205c230c16695702b1eeeb426d844aa76a87c55f220298cdaf105ceee1d"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/codex-mcp.toml",
+      "sha256": "a56de208a369a2b318d2e66e150eef4cba1fac1ecf32bda6db1a1e4b65db7311"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/control-plane/SKILL.md",
+      "sha256": "fe281985ffbfb4d324d0ae421653c96d501bfda4ef1462865e2868276c40a3c2"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/control-plane/openai.yaml",
+      "sha256": "a7ba723d34839c6a444b6ee4416223103cd9b2bbd9caed0d4c0aa1e7d5a523fc"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/data-lineage/SKILL.md",
+      "sha256": "91352eee8b6a51d2e6a50d36de58e167344cce065fcbbf0c290c6ccd25a592f4"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/data-lineage/openai.yaml",
+      "sha256": "beb0bbc2e3313784b03e633e02ee894b4bc57d992296ebbfe63186fcfbf8a344"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/delta-classifier/SKILL.md",
+      "sha256": "a4ab3112459178d08d6f54b83c38c6638833e97479808f0d88bba8e56c50b20c"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/delta-classifier/openai.yaml",
+      "sha256": "b06422d0afc62af4085b38ead53ab28096beec5ae943ed317207bd7edacfc59c"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/eval-gate/SKILL.md",
+      "sha256": "5d6a18ad9ca08923c13096ee8457eb7ccfa75752679be0be3e105112e5f5a94b"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/eval-gate/openai.yaml",
+      "sha256": "43f4939ce1b6e51ec853f79cea0af80706bb8df6730e8854981cfdf3ee088822"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/health/SKILL.md",
+      "sha256": "93806b8c1848b55240de4697692b21516aebc2ca905d049eb6ca5104a372f88e"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/health/openai.yaml",
+      "sha256": "5f60504efb464cbcf130e183d3991b6fe9bc90ef12c21c4ffc2e8900ae1cd6e2"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/hook-governor/SKILL.md",
+      "sha256": "852df4b5f787f2a885e87cb8ad8dbb8d877e018e14083cfd5e5b98deb9dd19b5"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/hook-governor/openai.yaml",
+      "sha256": "8b4e219662bd9a12e89cdcd9a1828c1ff14810fa09cbfff9a6d9f932fb42ec85"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/incident-replay/SKILL.md",
+      "sha256": "fe4538481bed5a924e9b2155bb84b5d36863a9c380014d7e5ec6185dbff0fb49"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/incident-replay/openai.yaml",
+      "sha256": "6685c86104f4257514dd25d3102baaba309020120bce925e6f40f6e5f43713f0"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/lsp-pack/SKILL.md",
+      "sha256": "86890c6671441f8687ad7d71dedd7d61574c42aa6e109aa8dd6ceb4b6a139879"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/lsp-pack/openai.yaml",
+      "sha256": "14000aec9cc9ff630b7354ae101cc43ed90c4e1ecd0fa719013741ca14598142"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/mcp-fabric/SKILL.md",
+      "sha256": "e741baf4fa5f09957fe37349b79fe6831afe0352eefa945f3e53514ea313bc36"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/mcp-fabric/openai.yaml",
+      "sha256": "18dc35b4d6fb598b572ec933153e80de5449be9e07ef07178e4f875e39a8915c"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/preflight/SKILL.md",
+      "sha256": "1f7783ff53f59a4368f1ec7746faa3f1a66805312291851f43ae2fe6a7d58f30"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/preflight/openai.yaml",
+      "sha256": "1074dff95ae9f6951cdd9bb3d6b5c4add7d6a688b0ceed3d79d365dff42bfca6"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/remote-supervisor/SKILL.md",
+      "sha256": "506988d9eb379dad027ad1dd0087e81f12594faed16a91dbda021975de28e19f"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/remote-supervisor/openai.yaml",
+      "sha256": "f4a87ea5ed5759c073adbdc9704d7bf75b16ba5ba3e5ceaa3c926c44e6d84dd2"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/robotics/SKILL.md",
+      "sha256": "fa191d7d7662321fa48cd1bbd25af59282c95d396ee959fd65fa873db4aa53c3"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/robotics/openai.yaml",
+      "sha256": "d6c28424bbcf9457da1fa5a0aff3952a5aca8a6e66257b633962c58e3e365f5c"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/secure-worktree-pipeline/SKILL.md",
+      "sha256": "1eebd557d77cc084161c3ffe11ed3a9ea5d78caa65b1021a992ac8b835fc6a0d"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/secure-worktree-pipeline/openai.yaml",
+      "sha256": "1f82a05b2fcad17c126e34541c995dedf3ed242fa499539ab693cc60a0d41c77"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/security-check/SKILL.md",
+      "sha256": "5d2131c7d93780b139917149017ffa696ea17da403506ab6077aff4e4a52e69a"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/security-check/openai.yaml",
+      "sha256": "cf06bd8b852ad6c4694d8aeadd05ae4c9b63d32fa5cee085152683c65a3343e5"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/tracebank/SKILL.md",
+      "sha256": "c4ba5cbe7acca1be333f376f27f800482c1080eb8e95b34744313f1d64a84fcd"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/tracebank/openai.yaml",
+      "sha256": "556e2ec3ac5a8e1b9bd40ecb7a744e85b49e34c5af899101070e7e72c9f45621"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/vision/SKILL.md",
+      "sha256": "a96b2fce777f5d9e6895c83b8d5d6eba98d5383d1c54f60a877ed22ec6a79011"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/vision/openai.yaml",
+      "sha256": "ea3b553bed57095f44103c154315e2f6017e1767708339a8760fb3a735d15075"
+    },
+    {
+      "path": "bundle/.claude-plugin/marketplace.json",
+      "sha256": "2c1e7ffe83d11c464662aba58720c52b3b136d3564c32b83019a7aeecd6a982c"
+    },
+    {
+      "path": "bundle/.claude-plugin/plugin.json",
+      "sha256": "fe79af472d21bd47da149116ff1ed5c82b08c4bfd60b470e5d4faf6799f9abf7"
+    },
+    {
+      "path": "bundle/.mcp.json",
+      "sha256": "d8249fdd26e0df0a9b7cabcb34256d7e33578e1d0e9878cc91d43452a10f7c24"
+    },
+    {
+      "path": "bundle/OMG_COMPAT_CONTRACT.md",
+      "sha256": "fa7a4a16097b35170784e136f8ff9eae64c825a07f55413fb8fea3e7ab40c2e5"
+    },
+    {
+      "path": "bundle/registry/bundles/algorithms.yaml",
+      "sha256": "cc589c80d47ab2eb1bb2f142d462e40fc1c5f108e175360b40929326966de723"
+    },
+    {
+      "path": "bundle/registry/bundles/api-twin.yaml",
+      "sha256": "6952f8d45dbfa29afac88de0f110b2941804c4543dae4c0f5562cb876de376b7"
+    },
+    {
+      "path": "bundle/registry/bundles/control-plane.yaml",
+      "sha256": "fd624b518e20e48b7dc68378c95493a4f88e07c759ea53f3b9c82646b263d80c"
+    },
+    {
+      "path": "bundle/registry/bundles/data-lineage.yaml",
+      "sha256": "602a1906d976ff93beb961affd7b5f6d4dc6486cd960ad47aa2a2b6c65724585"
+    },
+    {
+      "path": "bundle/registry/bundles/delta-classifier.yaml",
+      "sha256": "d08df8acb9713c58767a0c1a390fd35a61b7e1a290cfb13376a8f5517cbcc7f3"
+    },
+    {
+      "path": "bundle/registry/bundles/eval-gate.yaml",
+      "sha256": "c3de322fece33b91f503740f828e318264d0388d3403b98f09c2d73486a57b81"
+    },
+    {
+      "path": "bundle/registry/bundles/health.yaml",
+      "sha256": "3192a27f326656732fe83ed6e725366bc2c9bb7e5009de07b9097b864357383b"
+    },
+    {
+      "path": "bundle/registry/bundles/hook-governor.yaml",
+      "sha256": "ccb6edc43da2594eb93ad00abe3447879923f83067201d82927a942bb25f412d"
+    },
+    {
+      "path": "bundle/registry/bundles/incident-replay.yaml",
+      "sha256": "aeaee69df8fdb8652707f3a228e4556e3a42a1487f4b77d33f47197370bd24a6"
+    },
+    {
+      "path": "bundle/registry/bundles/lsp-pack.yaml",
+      "sha256": "b0e6f74fd0b52cf37960defc3c9a0b66b722d98b7db15f6b1d4e11eae9a96707"
+    },
+    {
+      "path": "bundle/registry/bundles/mcp-fabric.yaml",
+      "sha256": "40766fb1fed2fbd29ae029915d2c883f3c3f38157fa3c0d72018381c75df6e31"
+    },
+    {
+      "path": "bundle/registry/bundles/preflight.yaml",
+      "sha256": "f12fd6b4aaa045141dcaaf62b51f5de7d31de2625f819ad368adc1a6e2010b18"
+    },
+    {
+      "path": "bundle/registry/bundles/remote-supervisor.yaml",
+      "sha256": "ac727c3074ae4a95e66b7e023f38ad22c3ae903db8af079b8b66c83fad57e650"
+    },
+    {
+      "path": "bundle/registry/bundles/robotics.yaml",
+      "sha256": "8748fdb84285c2131685626182ba86806d3cffecfe5c94c6438a791f983afd2b"
+    },
+    {
+      "path": "bundle/registry/bundles/secure-worktree-pipeline.yaml",
+      "sha256": "f62b4d9daee055362e013883f86479d2ddc2b22f8a97be84342a1b2979b9d584"
+    },
+    {
+      "path": "bundle/registry/bundles/security-check.yaml",
+      "sha256": "768f412af9696b8c83320c4d1d92c0703ed553296bbf54aff9c0c387f7a86cf0"
+    },
+    {
+      "path": "bundle/registry/bundles/tracebank.yaml",
+      "sha256": "500b996f7c55e652e9b4b677fefa472b49b4f61c052b7996738ed1389a575f3a"
+    },
+    {
+      "path": "bundle/registry/bundles/vision.yaml",
+      "sha256": "9f8b8be109d791954e6da97c0caed9234a58c15f1e9a189c445d0a55ec2591d8"
+    },
+    {
+      "path": "bundle/registry/omg-capability.schema.json",
+      "sha256": "ac5ce4663ae343785c844b0404cc5745f329df1cd12674201929f82d1e6332c9"
+    },
+    {
+      "path": "bundle/settings.json",
+      "sha256": "7a2f1d2f501a6db4d57e9863b510c7dadcc4ed7826012783506d10d4514bed5a"
+    }
+  ]
+}

package/docs/assets/omg-hud.svg

@@ -0,0 +1,32 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="720" viewBox="0 0 1200 720">
+  <rect width="1200" height="720" fill="#0f1720"/>
+  <rect x="40" y="40" width="1120" height="640" rx="24" fill="#152435" stroke="#5eead4" stroke-width="2"/>
+  <text x="80" y="110" fill="#f8fafc" font-family="monospace" font-size="40">OMG HUD</text>
+  <text x="80" y="150" fill="#5eead4" font-family="monospace" font-size="20">native setup | adoption report | crazy orchestration</text>
+
+  <rect x="80" y="200" width="320" height="180" rx="18" fill="#1e293b"/>
+  <text x="105" y="240" fill="#f8fafc" font-family="monospace" font-size="22">Hosts</text>
+  <text x="105" y="280" fill="#cbd5e1" font-family="monospace" font-size="18">Claude Code</text>
+  <text x="105" y="310" fill="#cbd5e1" font-family="monospace" font-size="18">Codex</text>
+  <text x="105" y="340" fill="#cbd5e1" font-family="monospace" font-size="18">Kimi CLI</text>
+
+  <rect x="440" y="200" width="320" height="180" rx="18" fill="#1e293b"/>
+  <text x="465" y="240" fill="#f8fafc" font-family="monospace" font-size="22">Adoption</text>
+  <text x="465" y="280" fill="#cbd5e1" font-family="monospace" font-size="18">mode: omg-only</text>
+  <text x="465" y="310" fill="#cbd5e1" font-family="monospace" font-size="18">preset: balanced</text>
+  <text x="465" y="340" fill="#cbd5e1" font-family="monospace" font-size="18">ecosystems: omc, superpowers</text>
+
+  <rect x="800" y="200" width="320" height="180" rx="18" fill="#1e293b"/>
+  <text x="825" y="240" fill="#f8fafc" font-family="monospace" font-size="22">Proof</text>
+  <text x="825" y="280" fill="#cbd5e1" font-family="monospace" font-size="18">tests</text>
+  <text x="825" y="310" fill="#cbd5e1" font-family="monospace" font-size="18">provider matrix</text>
+  <text x="825" y="340" fill="#cbd5e1" font-family="monospace" font-size="18">sample transcripts</text>
+
+  <rect x="80" y="430" width="1040" height="190" rx="18" fill="#0b1220" stroke="#334155" stroke-width="1"/>
+  <text x="105" y="470" fill="#f8fafc" font-family="monospace" font-size="22">Session</text>
+  <text x="105" y="515" fill="#5eead4" font-family="monospace" font-size="18">/OMG:setup</text>
+  <text x="245" y="515" fill="#cbd5e1" font-family="monospace" font-size="18">detected codex, kimi</text>
+  <text x="105" y="550" fill="#5eead4" font-family="monospace" font-size="18">/OMG:crazy</text>
+  <text x="245" y="550" fill="#cbd5e1" font-family="monospace" font-size="18">launched 5-worker orchestration</text>
+  <text x="105" y="585" fill="#cbd5e1" font-family="monospace" font-size="18">evidence required before completion</text>
+</svg>

package/docs/install/claude-code.md

@@ -0,0 +1,31 @@
+# Install OMG for Claude Code
+
+## Fast Path
+
+```bash
+npm install @trac3er/oh-my-god
+```
+
+Then run:
+
+```text
+/OMG:setup
+```
+
+## Manual Path
+
+```bash
+git clone https://github.com/trac3er00/OMG
+cd OMG
+chmod +x OMG-setup.sh
+./OMG-setup.sh install --mode=omg-only --preset=balanced
+```
+
+## Verify
+
+- `OMG-only` is the recommended adoption mode.
+- The shipped `safe` preset should register `firewall.py` for `Bash` and `secret-guard.py` for file reads and edits before helper hooks run.
+- In the `safe` preset, raw `env`, `node`, `python`, `python3`, `chmod`, and `chown` commands should prompt for approval.
+- You should see `.mcp.json` plus `.omg/state/cli-config.yaml`.
+- If Claude Code already has overlapping plugins, OMG will emit `.omg/state/adoption-report.json`.
+- Run `/OMG:crazy <goal>` after setup.

package/docs/install/codex.md

@@ -0,0 +1,29 @@
+# Install OMG for Codex
+
+## Fast Path
+
+```bash
+npm install -g @openai/codex
+npm install @trac3er/oh-my-god
+```
+
+Then run:
+
+```text
+/OMG:setup
+```
+
+## Manual Path
+
+```bash
+git clone https://github.com/trac3er00/OMG
+cd OMG
+chmod +x OMG-setup.sh
+./OMG-setup.sh install --mode=omg-only --preset=interop
+```
+
+## Verify
+
+- OMG detects `codex` during setup and configures shared MCP state.
+- `interop` is the recommended preset when Codex is part of a multi-host workflow.
+- Run `/OMG:crazy <goal>` once setup confirms host detection and MCP wiring.

package/docs/migration/native-adoption.md

@@ -0,0 +1,57 @@
+# Native Adoption for OMC, OMX, and Superpowers
+
+OMG keeps adoption native to OMG. There is no public `migrate` command to memorize or map back to another project.
+
+Use either:
+
+- `/OMG:setup`
+- `./OMG-setup.sh install --adopt=auto`
+
+## What Setup Detects
+
+Setup can detect compatibility markers from:
+
+- OMC-style environments
+- OMX-style environments
+- Superpowers-style command, skill, or workspace surfaces
+
+Those detections are treated as adoption context, not as public implementation detail.
+
+## Adoption Modes
+
+### OMG-only
+
+Recommended for most users.
+
+- OMG becomes the primary hooks, HUD, MCP, and orchestration layer.
+- Portable state is preserved where safe and overlapping surfaces are backed up before replacement.
+- `compat` remains available for legacy skill routing only.
+
+### coexist
+
+Advanced mode for careful landings.
+
+- OMG avoids claiming ownership of third-party namespaces.
+- Existing HUD and hook ownership stays intact unless you explicitly switch later.
+- Conflicts are recorded in the adoption report instead of being overwritten.
+
+## Output
+
+Native adoption writes:
+
+- `.omg/state/adoption-report.json`
+- `.omg/state/cli-config.yaml`
+- `.mcp.json`
+
+## Choosing a Preset
+
+- `safe`: conservative OMG baseline
+- `balanced`: recommended daily workflow
+- `interop`: stronger shared-memory and multi-host interop
+- `labs`: enables the most opinionated experimentation surfaces
+
+## What Changes for Existing Users
+
+- OMG-native setup language replaces public migration language.
+- Compatibility references remain documented so users coming from OMC, OMX, or Superpowers can understand what setup detected.
+- Public onboarding stays focused on `/OMG:setup` and `/OMG:crazy`.

package/docs/proof.md

@@ -0,0 +1,55 @@
+# OMG Proof Surface
+
+[![Compat Gate](https://github.com/trac3er00/OMG/actions/workflows/omg-compat-gate.yml/badge.svg)](https://github.com/trac3er00/OMG/actions/workflows/omg-compat-gate.yml)
+[![npm version](https://img.shields.io/npm/v/%40trac3er%2Foh-my-god)](https://www.npmjs.com/package/@trac3er/oh-my-god)
+
+## Verification Status
+
+OMG keeps verification visible instead of burying it in implementation details.
+
+- Current local full-suite result: `2466 passed, 2 skipped` on March 7, 2026.
+- Releases are expected to pass the compat gate, the standalone verification path, and the public-readiness check.
+- Setup, presets, and native adoption behavior have targeted regression tests.
+- `security-check`, `api-twin`, runtime profiles, and the stdio `omg-control` MCP have targeted regression coverage.
+- `compat` remains covered, but it is not the public onboarding path.
+
+## Provider Matrix
+
+| Provider | Detect | Auth Check | MCP Config | Host Priority |
+|----------|--------|------------|------------|---------------|
+| Claude Code | host-native | host-native | yes | primary |
+| Codex | yes | yes | yes | primary |
+| Gemini | yes | yes | yes | supported |
+| Kimi | yes | yes | yes | supported |
+
+## Adoption Evidence
+
+- Native setup writes `.omg/state/adoption-report.json`
+- Native setup writes `.omg/state/cli-config.yaml`
+- `OMG-only` and `coexist` are both covered in setup tests
+- OMC, OMX, and Superpowers references stay limited to compatibility and adoption guidance
+
+## HUD Artifact
+
+![OMG HUD](assets/omg-hud.svg)
+
+## Benchmark Tasks
+
+Representative benchmark tasks for this release:
+
+- host detection and auth wiring
+- canonical security-check routing and evidence emission
+- stdio OMG control MCP wiring
+- adoption detection with overlapping ecosystems
+- plugin install and uninstall correctness
+- `crazy` orchestration smoke coverage
+
+## Sample Transcripts
+
+- Setup: [docs/transcripts/setup.md](transcripts/setup.md)
+- Crazy: [docs/transcripts/crazy.md](transcripts/crazy.md)
+
+## Release Discipline
+
+- Public launch checklist: [docs/release-checklist.md](release-checklist.md)
+- Changelog: [CHANGELOG.md](../CHANGELOG.md)

package/docs/release-checklist.md

@@ -0,0 +1,38 @@
+# Public Release Checklist
+
+Use this checklist before making OMG public or cutting a release tag.
+
+## Identity
+
+- README, `package.json`, plugin manifests, and CLI version output agree on the version
+- repo URL is `https://github.com/trac3er00/OMG`
+- plugin and marketplace id are `omg`
+
+## Public Safety
+
+- `python3 scripts/check-omg-public-ready.py` passes
+- no internal planning docs ship in `docs/plans/`
+- no absolute local paths or stale internal path references remain
+
+## Verification
+
+- `python3 scripts/omg.py contract validate` passes
+- `python3 scripts/omg.py contract compile --host claude --host codex --channel public --output-root <tmp>` passes
+- `python3 scripts/omg.py contract compile --host claude --host codex --channel enterprise --output-root <tmp>` passes
+- `python3 scripts/omg.py release readiness --channel dual --output-root <tmp>` passes
+- `python3 scripts/check-omg-standalone-clean.py` passes
+- `./scripts/verify-standalone.sh` passes
+- `python3 -m pytest tests -q` passes
+
+## Docs
+
+- README matches the current product surface
+- install guides for Claude Code and Codex are current
+- proof page includes current verification evidence
+- changelog includes the release entry
+
+## Release Ops
+
+- `package.json` version matches the tag you will create
+- npm publishing credentials are configured for `publish-npm.yml`
+- GitHub Actions required checks are green

package/docs/transcripts/crazy.md

@@ -0,0 +1,17 @@
+# Sample Transcript: /OMG:crazy
+
+```text
+/OMG:crazy stabilize auth and dashboard flows
+
+Workers:
+- architect-mode
+- backend-engineer
+- frontend-designer
+- security-auditor
+- testing-engineer
+
+Execution:
+- parallel
+- evidence-aware
+- verification required before completion
+```

package/docs/transcripts/setup.md

@@ -0,0 +1,25 @@
+# Sample Transcript: /OMG:setup
+
+```text
+/OMG:setup
+
+Detected hosts:
+- codex: installed, authenticated
+- gemini: not found
+- kimi: not found
+
+Detected ecosystems:
+- omc
+- superpowers
+
+Recommended mode: omg-only
+Selected preset: balanced
+
+Configured:
+- .mcp.json
+- .omg/state/cli-config.yaml
+- .omg/state/adoption-report.json
+
+Next step:
+/OMG:crazy stabilize auth and dashboard flows
+```

package/hooks/policy_engine.py

@@ -115,6 +115,23 @@ ASK_PATTERNS = [
     (r"node\s+-e\s+", "Inline Node execution"),
 ]
 
+UNTRUSTED_MUTATION_PATTERNS = [
+    r"\bgit\s+(commit|push|tag)\b",
+    r"\bnpm\s+(install|publish)\b",
+    r"\bpython[23]?\s+.*\b(setup\.py|manage\.py)\b",
+    r"\b(mv|cp|tee|sed\s+-i|touch|mkdir)\b",
+]
+
+
+def _is_untrusted_content_mode_active() -> bool:
+    try:
+        from runtime.untrusted_content import is_untrusted_content_mode_active
+
+        project_dir = os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
+        return is_untrusted_content_mode_active(project_dir)
+    except Exception:
+        return False
+
 
 def evaluate_bash_command(cmd: str) -> PolicyDecision:
     if not cmd:
@@ -158,6 +175,15 @@ def evaluate_bash_command(cmd: str) -> PolicyDecision:
         if re.search(pat, cmd):
             return ask(f"{label}: {cmd[:120]}", "med", ["human-approval"])
 
+    if _is_untrusted_content_mode_active():
+        for pat in UNTRUSTED_MUTATION_PATTERNS:
+            if re.search(pat, cmd):
+                return ask(
+                    "Untrusted external content mode is active. Review before running state-changing commands.",
+                    "high",
+                    ["manual-approval", "review-provenance"],
+                )
+
     return allow("command allowed")
 
 
@@ -409,8 +435,8 @@ def evaluate_file_access(
 ) -> PolicyDecision:
     """Evaluate file access policy.
 
-    If an allowlist is provided, matching entries override deny decisions
-    for the given path and tool combination.
+    If an allowlist is provided, matching entries may override non-secret-file
+    deny decisions for the given path and tool combination.
     """
     if not file_path:
         return allow("no file")
@@ -424,11 +450,6 @@ def evaluate_file_access(
     basename = os.path.basename(normalized).lower()
     lowpath = normalized.lower()
 
-    # --- Allowlist check (before deny rules) ---
-    # Check allowlist early: if path+tool is allowlisted, override deny.
-    if allowlist and is_allowlisted(file_path, tool, allowlist):
-        return allow(f"Allowlisted: {file_path}")
-
     if basename in EXAMPLE_FILES and tool in ("Write", "Edit", "MultiEdit"):
         return deny(
             f"Modifying example env file blocked (Read is allowed): {file_path}",
@@ -451,6 +472,16 @@ def evaluate_file_access(
         if re.search(pat, lowpath):
             return deny(f"Sensitive path blocked: {file_path}", "critical", ["secret-access"])
 
+    if tool in {"Write", "Edit", "MultiEdit"} and _is_untrusted_content_mode_active():
+        return ask(
+            "Untrusted external content mode is active. Review before mutating files.",
+            "high",
+            ["manual-approval", "review-provenance"],
+        )
+
+    if allowlist and is_allowlisted(file_path, tool, allowlist):
+        return allow(f"Allowlisted: {file_path}")
+
     return allow("file allowed")
 
 

package/hooks/post-write.py

@@ -213,7 +213,7 @@ for i, line in enumerate(content.split("\n"), 1):
 
 if sec_warnings:
     msg = f"SECURITY WARNINGS in {file_path}:\n" + "\n".join(sec_warnings[:5])
-    msg += "\n\nConsider running /OMG:security-review for a full audit."
+    msg += "\n\nConsider running /OMG:security-check for the canonical audit pipeline."
     print(msg, file=sys.stderr)
 
 sys.exit(0)

package/hooks/prompt-enhancer.py

@@ -386,7 +386,7 @@ SECURITY_SIGNALS = [
 ]
 if not route_lock and any(signal_matches_text(sig, prompt) for sig in SECURITY_SIGNALS) and budget_ok():
     if detected_intent in ("fix", "implement", "refactor"):
-        add("@security: CRITICAL DOMAIN — No hardcoded secrets. Run /OMG:security-review after.")
+        add("@security: CRITICAL DOMAIN — No hardcoded secrets. Run /OMG:security-check after.")
 
 # ═══════════════════════════════════════════════════════════
 # 5. VISION DETECTION