@trac3er/oh-my-god 2.0.4 → 2.0.7

package/.claude-plugin/marketplace.json

@@ -5,16 +5,16 @@
     "name": "trac3er00"
   },
   "metadata": {
-    "description": "OMG - Oh-My-God for Claude Code",
-    "version": "2.0.4",
+    "description": "OMG - Oh-My-God for Claude Code and supported agent hosts",
+    "version": "2.0.7",
     "homepage": "https://github.com/trac3er00/OMG",
     "repository": "https://github.com/trac3er00/OMG"
   },
   "plugins": [
     {
       "name": "omg",
-      "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
-      "version": "2.0.4",
+      "description": "OMG plugin layer for Claude Code and supported agent hosts with native setup, orchestration, and interop.",
+      "version": "2.0.7",
       "source": "./",
       "author": {
         "name": "trac3er00"
@@ -32,5 +32,5 @@
       ]
     }
   ],
-  "version": "2.0.4"
+  "version": "2.0.7"
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg",
-  "version": "2.0.4",
+  "version": "2.0.7",
   "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
   "author": {
     "name": "trac3er00"

package/.claude-plugin/scripts/uninstall.sh

@@ -19,7 +19,7 @@ error() { echo -e "${RED}✗${NC} $1"; }
 echo ""
 echo -e "${BLUE}╔═══════════════════════════════════════════════════════════════╗${NC}"
 echo -e "${BLUE}║                                                               ║${NC}"
-echo -e "${BLUE}║              OMG Plugin Uninstaller v1.0.0                   ║${NC}"
+echo -e "${BLUE}║              OMG Plugin Uninstaller v2.0.7                   ║${NC}"
 echo -e "${BLUE}║                                                               ║${NC}"
 echo -e "${BLUE}╚═══════════════════════════════════════════════════════════════╝${NC}"
 echo ""
@@ -77,4 +77,4 @@ fi
 
 echo ""
 success "OMG Plugin uninstalled successfully!"
-echo ""
+echo ""

package/.mcp.json

@@ -1,11 +1,5 @@
 {
   "mcpServers": {
-    "context7": {
-      "command": "npx",
-      "args": [
-        "@upstash/context7-mcp@2.1.3"
-      ]
-    },
     "filesystem": {
       "command": "npx",
       "args": [
@@ -13,22 +7,6 @@
         "."
       ]
     },
-    "websearch": {
-      "command": "npx",
-      "args": [
-        "@zhafron/mcp-web-search@1.2.2"
-      ]
-    },
-    "chrome-devtools": {
-      "command": "npx",
-      "args": [
-        "chrome-devtools-mcp@0.19.0"
-      ]
-    },
-    "omg-memory": {
-      "type": "http",
-      "url": "http://127.0.0.1:8765/mcp"
-    },
     "omg-control": {
       "command": "python3",
       "args": [

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## Unreleased
 
+## 2.0.7 - 2026-03-07
+
+- canonicalized v2.0.7 release identity across all source, tests, and generated security artifact metadata
+- updated README.md heading to `# OMG` (removed version from H1 permanently) and removed `- Version: 2.0.5` line from brand metadata block
+- refactored identity tests to derive expected version from CANONICAL_VERSION instead of hardcoding values
+- extended release-readiness/version-drift coverage to newly canonicalized locations and updated contract_compiler.py to skip README H1 version check
+
+## 2.0.5 - 2026-03-07
+
+- expanded release identity and version-drift gate across full public surface (README.md, package.json, pyproject.toml, settings.json, .claude-plugin/plugin.json, .claude-plugin/marketplace.json, plugins/core/plugin.json, plugins/advanced/plugin.json, CHANGELOG.md)
+- fixed plugins/advanced/plugin.json version drift from 1.0.5 to 2.0.5
+- added canonical version source of truth in runtime/adoption.py with comprehensive drift detection
+
 ## 2.0.4 - 2026-03-07
 
 - shipped the OMG production control plane contract, executable bundle registry, host compiler, and dual-channel public and enterprise release bundles

package/OMG-setup.sh

@@ -5,7 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 BACKUP_TS="$(date +%Y%m%d_%H%M%S)"
 BACKUP_DIR="$CLAUDE_DIR/.omg-backup-$BACKUP_TS"
-VERSION="2.0.4"
+VERSION="2.0.7"
 
 PLUGIN_NAME="omg"
 PLUGIN_MARKETPLACE="omg"
@@ -269,13 +269,67 @@ preflight() {
     py_ver=$(python3 -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")
     py_maj=$(echo "$py_ver" | cut -d. -f1)
     py_min=$(echo "$py_ver" | cut -d. -f2)
-    if [ "$py_maj" -lt 3 ] || { [ "$py_maj" -eq 3 ] && [ "$py_min" -lt 8 ]; }; then
-        echo "  ❌ Python $py_ver found, 3.8+ required"
+    if [ "$py_maj" -lt 3 ] || { [ "$py_maj" -eq 3 ] && [ "$py_min" -lt 10 ]; }; then
+        echo "  ❌ Python $py_ver is not supported. OMG requires Python 3.10 or newer."
+        echo "     Python 3.8 and 3.9 are unsupported because OMG depends on"
+        echo "     libraries (fastmcp >=2.0) that require Python >= 3.10."
+        echo "     Upgrade at: https://www.python.org/downloads/"
         exit 1
     fi
     echo "  ✓ Python $py_ver"
 }
 
+provision_managed_venv() {
+    local venv_dir="$CLAUDE_DIR/omg-runtime/.venv"
+
+    if [ ! -f "$venv_dir/bin/python" ]; then
+        python3 -m venv "$venv_dir" || {
+            echo "  ⚠ Could not create managed venv (continuing without it)"
+            return 0
+        }
+    fi
+
+    if $USE_SYMLINK; then
+        "$venv_dir/bin/pip" install --quiet -e "${SCRIPT_DIR}[mcp]" 2>/dev/null || true
+    else
+        "$venv_dir/bin/pip" install --quiet "${SCRIPT_DIR}[mcp]" 2>/dev/null || true
+    fi
+
+    echo "  ✓ Managed venv → $venv_dir"
+}
+
+patch_omg_control_mcp_python() {
+    local mcp_path="$CLAUDE_DIR/.mcp.json"
+    local venv_python="$CLAUDE_DIR/omg-runtime/.venv/bin/python"
+
+    if [ ! -f "$mcp_path" ]; then
+        return 0
+    fi
+
+    python3 - "$mcp_path" "$venv_python" <<'PY'
+import json
+import sys
+from pathlib import Path
+
+mcp_path = Path(sys.argv[1])
+venv_python = sys.argv[2]
+
+try:
+    data = json.loads(mcp_path.read_text(encoding="utf-8"))
+except Exception:
+    raise SystemExit(0)
+
+servers = data.get("mcpServers")
+if not isinstance(servers, dict):
+    raise SystemExit(0)
+
+omg_control = servers.get("omg-control")
+if isinstance(omg_control, dict) and omg_control.get("command") in ("python3", "python"):
+    omg_control["command"] = venv_python
+    mcp_path.write_text(json.dumps(data, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+PY
+}
+
 ensure_backup() {
     if ! $DRY_RUN; then
         mkdir -p "$BACKUP_DIR"
@@ -791,21 +845,13 @@ install_plugin_bundle() {
         cat > "$_fallback_mcp_dir/.mcp.json" <<'FALLBACK_MCP'
 {
   "mcpServers": {
-    "context7": {
-      "command": "npx",
-      "args": ["@upstash/context7-mcp@2.1.3"]
-    },
     "filesystem": {
       "command": "npx",
       "args": ["@modelcontextprotocol/server-filesystem@2026.1.14", "."]
     },
-    "websearch": {
-      "command": "npx",
-      "args": ["@zhafron/mcp-web-search@1.2.2"]
-    },
-    "chrome-devtools": {
-      "command": "npx",
-      "args": ["chrome-devtools-mcp@0.19.0"]
+    "omg-control": {
+      "command": "python3",
+      "args": ["-m", "runtime.omg_mcp_server"]
     }
   }
 }
@@ -1223,6 +1269,9 @@ run_install_like() {
             install_plugin_bundle
         fi
 
+        provision_managed_venv
+        patch_omg_control_mcp_python
+
         local adoption_report_path=""
         adoption_report_path=$(write_native_adoption_report)
         echo "  ✓ Adoption report → $adoption_report_path"
@@ -1231,6 +1280,7 @@ run_install_like() {
         if $INSTALL_AS_PLUGIN; then
             install_plugin_bundle
         fi
+        echo "  (would provision managed Python venv at $CLAUDE_DIR/omg-runtime/.venv)"
         echo "  (would write adoption report and apply preset/mode markers)"
     fi
 

package/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.0.4
+version: 2.0.7
 canonical_hosts:
   - claude
   - codex

package/README.md

@@ -1,4 +1,4 @@
-# OMG 2.0.4
+# OMG
 
 [![Compat Gate](https://github.com/trac3er00/OMG/actions/workflows/omg-compat-gate.yml/badge.svg)](https://github.com/trac3er00/OMG/actions/workflows/omg-compat-gate.yml)
 [![npm version](https://img.shields.io/npm/v/%40trac3er%2Foh-my-god)](https://www.npmjs.com/package/@trac3er/oh-my-god)
@@ -11,18 +11,18 @@ OMG upgrades your agent host instead of replacing it. It gives Claude Code, Code
 - npm: `@trac3er/oh-my-god`
 - Plugin id: `omg`
 - Marketplace id: `omg`
-- Version: `2.0.4`
 
 ## Why OMG
 
 - Small front door: install, run `/OMG:setup`, then `/OMG:crazy <goal>`.
 - Multi-host support: Claude Code, Codex, Gemini CLI, and Kimi CLI.
+- Compiled planning: advanced planning is now compiled into the `plan-council` bundle for deterministic execution.
 - Native adoption: setup detects OMC, OMX, and Superpowers-style environments without exposing copycat public migration commands.
 - Proof-first delivery: verification, provider coverage, HUD artifacts, and transcripts are published instead of implied.
 
 ## Canonical Contract
 
-OMG now ships a production control-plane contract and generated host artifacts.
+OMG now ships a production control-plane contract and generated host artifacts. Same-machine production support is anchored by the stdio-first `omg-control` MCP. HTTP control-plane exposure is intended for development and local HUD use only.
 
 - Normative spec: `OMG_COMPAT_CONTRACT.md`
 - Executable registry: `registry/omg-capability.schema.json` and `registry/bundles/*.yaml`
@@ -60,8 +60,8 @@ Then run:
 Success looks like:
 
 - supported hosts are detected
-- `.mcp.json` is configured
-- `.mcp.json` includes both `omg-memory` and stdio `omg-control`
+- `.mcp.json` is configured with `filesystem` and stdio `omg-control` (the narrowed defaults)
+- additional MCP servers are added when a broader preset is selected (`balanced` adds `context7`; `interop` adds `websearch` and `omg-memory`; `labs` adds browser automation)
 - `.omg/state/adoption-report.json` is written when another ecosystem is present
 - OMG reports the selected preset and next step
 
@@ -87,8 +87,9 @@ Compatibility references to OMC, OMX, and Superpowers are documented here: [docs
 
 ## Proof
 
-Current local verification for this release: `2466 passed, 2 skipped` on March 7, 2026.
+Current local verification for this release: See `.omg/evidence/` for machine-generated verification artifacts.
 
+- Truth bundles: `claim-judge`, `test-intent-lock`, `proof-gate`
 - Verification and provider matrix: [docs/proof.md](docs/proof.md)
 - Sample setup transcript: [docs/transcripts/setup.md](docs/transcripts/setup.md)
 - Sample crazy transcript: [docs/transcripts/crazy.md](docs/transcripts/crazy.md)
@@ -100,6 +101,7 @@ Primary entry points:
 
 - `/OMG:setup`
 - `/OMG:crazy`
+- `/OMG:deep-plan` (compatibility path to `plan-council`)
 
 Advanced surfaces stay available for deeper workflows:
 

package/agents/omg-security-auditor.md

@@ -31,7 +31,7 @@ Security auditor. Reviews code for vulnerabilities, enforces security best pract
 
 ## Guardrails
 
-- MUST run `/OMG:security-review` before completing any audit
+- MUST run `/OMG:security-check` before completing any audit
 - MUST NOT approve code with hardcoded secrets (API keys, tokens, passwords, connection strings)
 - MUST flag any SQL injection, XSS, CSRF vulnerabilities found
 - MUST check for: auth bypass, privilege escalation, path traversal, SSRF, open redirects

package/artifacts/release/.agents/skills/omg/AGENTS.fragment.md

@@ -0,0 +1,52 @@
+# OMG Codex Governance (channel: enterprise)
+
+## Build & Test
+
+```bash
+python3 -m pytest tests -q
+python3 scripts/omg.py contract validate
+python3 scripts/omg.py contract compile --host codex --channel enterprise
+```
+
+## Protected Paths
+
+The following paths require tier-gated review before mutation:
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Evidence Contract
+
+Every production action must emit evidence containing these fields:
+
+- `executor`
+- `lineage`
+- `timestamp`
+- `trace_id`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Web Search Policy
+
+- Prefer cached results over live network requests.
+- Do NOT initiate live web searches unless explicitly instructed.
+- Use `context7` or local documentation before external lookups.
+- Set `cached_web_search: prefer_cached` as the default.
+
+## Approval Constraints
+
+- Destructive file operations require explicit user approval.
+- `git push --force` and branch deletions require explicit approval.
+- Production deployments require explicit approval.
+- Mutations to protected paths require tier-gated approval.
+
+## Rules & Automations
+
+- Rules: `protected_paths, explicit_invocation`
+- Automations: `contract-compile, release-readiness`
+- Require explicit invocation for production-control-plane skills.

package/artifacts/release/.agents/skills/omg/algorithms/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-algorithms
+description: "Determinism and benchmark attachments for algorithm-heavy work."
+---
+
+# OMG Algorithms Pack
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evals/latest.json`

package/artifacts/release/.agents/skills/omg/algorithms/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-algorithms
+description: "Determinism and benchmark attachments for algorithm-heavy work."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: algorithms
+  title: "OMG Algorithms Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/artifacts/release/.agents/skills/omg/api-twin/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-api-twin
+description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
+---
+
+# OMG API Twin
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/state/api_twin.json`

package/artifacts/release/.agents/skills/omg/api-twin/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-api-twin
+description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: api-twin
+  title: "OMG API Twin"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/artifacts/release/.agents/skills/omg/codex-mcp.toml

@@ -0,0 +1,4 @@
+[mcp_servers.omg-control]
+command = "python3"
+args = ["-m", "runtime.omg_mcp_server"]
+

package/artifacts/release/.agents/skills/omg/codex-rules.md

@@ -0,0 +1,29 @@
+# OMG Codex Rules (channel: enterprise)
+
+## Defaults
+
+- `cached_web_search: prefer_cached`
+- `live_network: deny_by_default`
+- `destructive_approval: required`
+
+## Protected Paths
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Approval Matrix
+
+| Action | Approval Required |
+|--------|------------------|
+| Read / Grep | No |
+| Write to protected paths | Yes |
+| Bash (python3:*) | Yes (balanced+ tier) |
+| git push --force | Yes |
+| Production deploy | Yes |

package/artifacts/release/.agents/skills/omg/control-plane/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-control-plane
+description: "Canonical production control plane bundle for Claude and Codex."
+---
+
+# OMG Control Plane
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control, omg-memory`
+- Evidence outputs: `.omg/evidence/control-plane-compile.json`

package/artifacts/release/.agents/skills/omg/control-plane/openai.yaml

@@ -0,0 +1,14 @@
+name: omg-control-plane
+description: "Canonical production control plane bundle for Claude and Codex."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: control-plane
+  title: "OMG Control Plane"
+mcp_servers:
+  - omg-control
+  - omg-memory
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/artifacts/release/.agents/skills/omg/data-lineage/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-data-lineage
+description: "Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts."
+---
+
+# OMG Data Lineage
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/lineage/*.json`

package/artifacts/release/.agents/skills/omg/data-lineage/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-data-lineage
+description: "Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts."
+allow_implicit_invocation: true
+metadata:
+  channel: enterprise
+  bundle_id: data-lineage
+  title: "OMG Data Lineage"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/artifacts/release/.agents/skills/omg/delta-classifier/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-delta-classifier
+description: "Change classifier that attaches risk-aware checks, approvals, and packs."
+---
+
+# OMG Delta Classifier
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/tracebank/events.jsonl`

package/artifacts/release/.agents/skills/omg/delta-classifier/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-delta-classifier
+description: "Change classifier that attaches risk-aware checks, approvals, and packs."
+allow_implicit_invocation: true
+metadata:
+  channel: enterprise
+  bundle_id: delta-classifier
+  title: "OMG Delta Classifier"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"

package/artifacts/release/.agents/skills/omg/eval-gate/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-eval-gate
+description: "Reproducible evaluation gate that blocks regressions before release."
+---
+
+# OMG Eval Gate
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evals/latest.json`

package/artifacts/release/.agents/skills/omg/eval-gate/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-eval-gate
+description: "Reproducible evaluation gate that blocks regressions before release."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: eval-gate
+  title: "OMG Eval Gate"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/artifacts/release/.agents/skills/omg/health/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-health
+description: "Health-sensitive approvals, provenance, and replay attachments."
+---
+
+# OMG Health Pack
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/lineage/*.json`

package/artifacts/release/.agents/skills/omg/health/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-health
+description: "Health-sensitive approvals, provenance, and replay attachments."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: health
+  title: "OMG Health Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/artifacts/release/.agents/skills/omg/hook-governor/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-hook-governor
+description: "Canonical hook ordering, policy reinjection, and protected-path governance."
+---
+
+# OMG Hook Governor
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/state/ledger/tool-ledger.jsonl`

package/artifacts/release/.agents/skills/omg/hook-governor/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-hook-governor
+description: "Canonical hook ordering, policy reinjection, and protected-path governance."
+allow_implicit_invocation: true
+metadata:
+  channel: enterprise
+  bundle_id: hook-governor
+  title: "OMG Hook Governor"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/artifacts/release/.agents/skills/omg/incident-replay/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-incident-replay
+description: "Replayable bug packs built from logs, failing tests, traces, and diffs."
+---
+
+# OMG Incident Replay
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/incidents/*.json`

package/artifacts/release/.agents/skills/omg/incident-replay/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-incident-replay
+description: "Replayable bug packs built from logs, failing tests, traces, and diffs."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: incident-replay
+  title: "OMG Incident Replay"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/artifacts/release/.agents/skills/omg/lsp-pack/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-lsp-pack
+description: "Optional LSP-backed diagnostics and navigation bundle for production verification."
+---
+
+# OMG LSP Pack
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/lsp-diagnostics.json`

package/artifacts/release/.agents/skills/omg/lsp-pack/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-lsp-pack
+description: "Optional LSP-backed diagnostics and navigation bundle for production verification."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: lsp-pack
+  title: "OMG LSP Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"