@trac3er/oh-my-god 2.0.4 → 2.0.7

package/registry/bundles/tracebank.yaml

@@ -0,0 +1,47 @@
+id: tracebank
+kind: evidence
+version: 2.0.7
+title: OMG Tracebank
+description: Structured plan-to-patch-to-verify trace capture for OMG routes.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/tracebank.py
+invocation_policy:
+  user_invocable: true
+  model_invocable: true
+  allow_implicit_invocation: true
+tool_policy:
+  side_effect_level: medium
+  allowed_tools:
+    claude:
+      - Read
+      - Bash(python3:*)
+    codex:
+      - Read
+      - Bash(python3:*)
+lifecycle_hooks:
+  native:
+    - PostToolUse
+  emulated:
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - python
+evidence_outputs:
+  artifacts:
+    - .omg/tracebank/events.jsonl
+execution_contract:
+  modes:
+    - embedded
+    - local_supervisor
+channel_overrides:
+  public:
+    retention: project-local
+  enterprise:
+    retention: policy-managed

package/registry/bundles/vision.yaml

@@ -0,0 +1,45 @@
+id: vision
+kind: domain-pack
+version: 2.0.7
+title: OMG Vision Pack
+description: Vision-specific lineage, drift, and replay attachments.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/domain_packs.py
+invocation_policy:
+  user_invocable: true
+  model_invocable: true
+  allow_implicit_invocation: false
+tool_policy:
+  side_effect_level: medium
+  allowed_tools:
+    claude:
+      - Read
+    codex:
+      - Read
+lifecycle_hooks:
+  native:
+    - PostToolUse
+  emulated:
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - python
+evidence_outputs:
+  artifacts:
+    - .omg/lineage/*.json
+execution_contract:
+  modes:
+    - embedded
+    - local_supervisor
+channel_overrides:
+  public:
+    drift_checks: advisory
+  enterprise:
+    drift_checks: required

package/registry/omg-capability.schema.json

@@ -0,0 +1,296 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
+  "title": "OMG Capability Bundle",
+  "version": "2.0.7",
+  "type": "object",
+  "required": [
+    "id",
+    "kind",
+    "version",
+    "title",
+    "description",
+    "hosts",
+    "assets",
+    "invocation_policy",
+    "tool_policy",
+    "lifecycle_hooks",
+    "mcp_contract",
+    "lsp_contract",
+    "evidence_outputs",
+    "execution_contract",
+    "channel_overrides"
+  ],
+  "properties": {
+    "id": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "version": {
+      "type": "string"
+    },
+    "title": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "hosts": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "claude",
+          "codex"
+        ]
+      },
+      "minItems": 1
+    },
+    "assets": {
+      "type": "object"
+    },
+    "invocation_policy": {
+      "type": "object"
+    },
+    "tool_policy": {
+      "type": "object"
+    },
+    "lifecycle_hooks": {
+      "type": "object"
+    },
+    "mcp_contract": {
+      "type": "object"
+    },
+    "lsp_contract": {
+      "type": "object"
+    },
+    "evidence_outputs": {
+      "type": "object"
+    },
+    "execution_contract": {
+      "type": "object"
+    },
+    "policy_model": {
+      "type": "object",
+      "required": [
+        "trust_tiers",
+        "tool_policies",
+        "protected_paths",
+        "evidence_contract",
+        "host_rules"
+      ],
+      "properties": {
+        "trust_tiers": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "name",
+              "level",
+              "label",
+              "allowed_sources"
+            ],
+            "properties": {
+              "name": {
+                "type": "string"
+              },
+              "level": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "label": {
+                "type": "string"
+              },
+              "allowed_sources": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "type": "string"
+                }
+              }
+            },
+            "additionalProperties": true
+          }
+        },
+        "tool_policies": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "tool_name",
+              "allowed_tiers",
+              "requires_approval"
+            ],
+            "properties": {
+              "tool_name": {
+                "type": "string"
+              },
+              "allowed_tiers": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "type": "string"
+                }
+              },
+              "requires_approval": {
+                "type": "boolean"
+              }
+            },
+            "additionalProperties": true
+          }
+        },
+        "protected_paths": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "path_pattern",
+              "required_tier"
+            ],
+            "properties": {
+              "path_pattern": {
+                "type": "string"
+              },
+              "required_tier": {
+                "type": "string"
+              }
+            },
+            "additionalProperties": true
+          }
+        },
+        "evidence_contract": {
+          "type": "object",
+          "required": [
+            "timestamp",
+            "executor",
+            "trace_id",
+            "lineage"
+          ],
+          "properties": {
+            "timestamp": {
+              "type": "string"
+            },
+            "executor": {
+              "type": "string"
+            },
+            "trace_id": {
+              "type": "string"
+            },
+            "lineage": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": true
+        },
+        "host_rules": {
+          "type": "object",
+          "required": [
+            "claude",
+            "codex"
+          ],
+          "properties": {
+            "claude": {
+              "type": "object",
+              "required": [
+                "compilation_targets",
+                "hooks",
+                "subagents",
+                "skills"
+              ],
+              "properties": {
+                "compilation_targets": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "hooks": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "subagents": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "skills": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "additionalProperties": true
+            },
+            "codex": {
+              "type": "object",
+              "required": [
+                "compilation_targets",
+                "skills",
+                "agents_fragments",
+                "rules",
+                "automations"
+              ],
+              "properties": {
+                "compilation_targets": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "skills": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "agents_fragments": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "rules": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "automations": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "additionalProperties": true
+            }
+          },
+          "additionalProperties": true
+        }
+      },
+      "additionalProperties": true
+    },
+    "channel_overrides": {
+      "type": "object"
+    }
+  },
+  "additionalProperties": true
+}

package/registry/verify_artifact.py

@@ -0,0 +1,90 @@
+"""OMG v1 supply-chain verification with Warn-and-Run semantics."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+
+@dataclass
+class SupplyArtifact:
+    id: str
+    signer: str | None
+    checksum: str | None
+    permissions: list[str]
+    static_scan: list[dict[str, Any]]
+    risk_level: str = "low"
+
+
+def _normalize(artifact: dict[str, Any]) -> SupplyArtifact:
+    return SupplyArtifact(
+        id=str(artifact.get("id", "unknown")),
+        signer=artifact.get("signer"),
+        checksum=artifact.get("checksum"),
+        permissions=[str(p) for p in artifact.get("permissions", [])],
+        static_scan=[f for f in artifact.get("static_scan", []) if isinstance(f, dict)],
+        risk_level=str(artifact.get("risk_level", "low")).lower(),
+    )
+
+
+def verify_artifact(artifact: dict[str, Any], mode: str = "warn_and_run") -> dict[str, Any]:
+    a = _normalize(artifact)
+    reasons: list[str] = []
+    controls: list[str] = []
+
+    for finding in a.static_scan:
+        sev = str(finding.get("severity", "")).lower()
+        if sev == "critical":
+            reasons.append("critical static scan finding")
+            return {
+                "action": "deny",
+                "risk_level": "critical",
+                "reason": "; ".join(reasons),
+                "controls": ["block-execution"],
+                "trusted": False,
+            }
+
+    perm_blob = " ".join(a.permissions).lower()
+    if any(token in perm_blob for token in ["sudo", "rm -rf", "--privileged", "curl |", "wget |"]):
+        return {
+            "action": "deny",
+            "risk_level": "critical",
+            "reason": "critical permission profile",
+            "controls": ["block-execution"],
+            "trusted": False,
+        }
+
+    if not a.signer or not a.checksum:
+        reasons.append("missing signer/checksum")
+        controls.extend(["isolate-network", "read-only-fs", "manual-approval"])
+        if mode == "warn_and_run":
+            return {
+                "action": "ask",
+                "risk_level": "high",
+                "reason": "; ".join(reasons),
+                "controls": controls,
+                "trusted": False,
+            }
+        return {
+            "action": "deny",
+            "risk_level": "high",
+            "reason": "; ".join(reasons),
+            "controls": ["block-execution"],
+            "trusted": False,
+        }
+
+    if any(str(f.get("severity", "")).lower() == "high" for f in a.static_scan):
+        return {
+            "action": "ask",
+            "risk_level": "high",
+            "reason": "high severity findings present",
+            "controls": ["manual-approval"],
+            "trusted": False,
+        }
+
+    return {
+        "action": "allow",
+        "risk_level": a.risk_level if a.risk_level in {"low", "med", "high", "critical"} else "low",
+        "reason": "artifact verified",
+        "controls": [],
+        "trusted": True,
+    }

package/runtime/adapters/claude.py

@@ -27,6 +27,7 @@ class ClaudeAdapter:
             "runtime": self.runtime,
             "phase": "execute",
             "status": "executed",
+            "worker_mode": "stub",
             "operations": [
                 "apply-plan",
                 "collect-diff",
@@ -43,6 +44,7 @@ class ClaudeAdapter:
             "checks": [
                 {"name": "tests", "passed": True},
                 {"name": "security", "passed": True},
+                {"name": "worker_implementation", "passed": False, "mode": "stub"},
             ],
         }
 
@@ -57,4 +59,5 @@ class ClaudeAdapter:
             "diff_summary": {},
             "reproducibility": {"seed": "deterministic"},
             "unresolved_risks": [],
+            "worker_mode": "stub",
         }

package/runtime/adapters/gpt.py

@@ -23,6 +23,7 @@ class GPTAdapter:
             "runtime": self.runtime,
             "phase": "execute",
             "status": "executed",
+            "worker_mode": "stub",
             "operations": ["apply-plan", "collect-diff"],
             "errors": [],
         }
@@ -36,6 +37,7 @@ class GPTAdapter:
             "checks": [
                 {"name": "tests", "passed": True},
                 {"name": "security", "passed": True},
+                {"name": "worker_implementation", "passed": False, "mode": "stub"},
             ],
         }
 
@@ -50,4 +52,5 @@ class GPTAdapter:
             "diff_summary": {},
             "reproducibility": {"seed": "deterministic"},
             "unresolved_risks": [],
+            "worker_mode": "stub",
         }

package/runtime/adapters/local.py

@@ -23,6 +23,7 @@ class LocalAdapter:
             "runtime": self.runtime,
             "phase": "execute",
             "status": "executed",
+            "worker_mode": "stub",
             "operations": ["apply-plan", "collect-diff"],
             "errors": [],
         }
@@ -36,6 +37,7 @@ class LocalAdapter:
             "checks": [
                 {"name": "tests", "passed": True},
                 {"name": "security", "passed": True},
+                {"name": "worker_implementation", "passed": False, "mode": "stub"},
             ],
         }
 
@@ -50,4 +52,5 @@ class LocalAdapter:
             "diff_summary": {},
             "reproducibility": {"seed": "deterministic"},
             "unresolved_risks": [],
+            "worker_mode": "stub",
         }

package/runtime/adoption.py

@@ -11,7 +11,7 @@ CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.0.4"
+CANONICAL_VERSION = "2.0.7"
 
 VALID_ADOPTION_MODES = ("omg-only", "coexist")
 VALID_PRESETS = ("safe", "balanced", "interop", "labs")