@trac3er/oh-my-god 2.0.5 → 2.0.7

package/dist/enterprise/bundle/registry/bundles/mcp-fabric.yaml

@@ -1,6 +1,6 @@
 id: mcp-fabric
 kind: mcp
-version: 2.0.5
+version: 2.0.7
 title: OMG MCP Fabric
 description: Tools, prompts, resources, and server instructions for the OMG control plane.
 hosts:

package/dist/enterprise/bundle/registry/bundles/preflight.yaml

@@ -1,6 +1,6 @@
 id: preflight
 kind: routing
-version: 2.0.5
+version: 2.0.7
 title: OMG Preflight
 description: Repo-aware route selection based on diff, manifests, and classified risk.
 hosts:

package/dist/enterprise/bundle/registry/bundles/remote-supervisor.yaml

@@ -1,6 +1,6 @@
 id: remote-supervisor
 kind: orchestration
-version: 2.0.5
+version: 2.0.7
 title: OMG Remote Supervisor
 description: Local-only authenticated supervisor sessions for worker orchestration.
 hosts:

package/dist/enterprise/bundle/registry/bundles/robotics.yaml

@@ -1,6 +1,6 @@
 id: robotics
 kind: domain-pack
-version: 2.0.5
+version: 2.0.7
 title: OMG Robotics Pack
 description: Robotics safety policy, replay, and evaluation attachments.
 hosts:

package/dist/enterprise/bundle/registry/bundles/secure-worktree-pipeline.yaml

@@ -1,6 +1,6 @@
 id: secure-worktree-pipeline
 kind: runtime
-version: 2.0.5
+version: 2.0.7
 title: OMG Secure Worktree Pipeline
 description: Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs.
 hosts:

package/dist/enterprise/bundle/registry/bundles/security-check.yaml

@@ -1,6 +1,6 @@
 id: security-check
 kind: security
-version: 2.0.5
+version: 2.0.7
 title: OMG Security Check
 description: Canonical security audit bundle with provenance, trust scoring, and deterministic evidence.
 hosts:

package/dist/enterprise/bundle/registry/bundles/tracebank.yaml

@@ -1,6 +1,6 @@
 id: tracebank
 kind: evidence
-version: 2.0.5
+version: 2.0.7
 title: OMG Tracebank
 description: Structured plan-to-patch-to-verify trace capture for OMG routes.
 hosts:

package/dist/enterprise/bundle/registry/bundles/vision.yaml

@@ -1,6 +1,6 @@
 id: vision
 kind: domain-pack
-version: 2.0.5
+version: 2.0.7
 title: OMG Vision Pack
 description: Vision-specific lineage, drift, and replay attachments.
 hosts:

package/dist/enterprise/bundle/registry/omg-capability.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
   "title": "OMG Capability Bundle",
-  "version": "2.0.5",
+  "version": "2.0.7",
   "type": "object",
   "required": [
     "id",
@@ -72,6 +72,222 @@
     "execution_contract": {
       "type": "object"
     },
+    "policy_model": {
+      "type": "object",
+      "required": [
+        "trust_tiers",
+        "tool_policies",
+        "protected_paths",
+        "evidence_contract",
+        "host_rules"
+      ],
+      "properties": {
+        "trust_tiers": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "name",
+              "level",
+              "label",
+              "allowed_sources"
+            ],
+            "properties": {
+              "name": {
+                "type": "string"
+              },
+              "level": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "label": {
+                "type": "string"
+              },
+              "allowed_sources": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "type": "string"
+                }
+              }
+            },
+            "additionalProperties": true
+          }
+        },
+        "tool_policies": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "tool_name",
+              "allowed_tiers",
+              "requires_approval"
+            ],
+            "properties": {
+              "tool_name": {
+                "type": "string"
+              },
+              "allowed_tiers": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "type": "string"
+                }
+              },
+              "requires_approval": {
+                "type": "boolean"
+              }
+            },
+            "additionalProperties": true
+          }
+        },
+        "protected_paths": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "path_pattern",
+              "required_tier"
+            ],
+            "properties": {
+              "path_pattern": {
+                "type": "string"
+              },
+              "required_tier": {
+                "type": "string"
+              }
+            },
+            "additionalProperties": true
+          }
+        },
+        "evidence_contract": {
+          "type": "object",
+          "required": [
+            "timestamp",
+            "executor",
+            "trace_id",
+            "lineage"
+          ],
+          "properties": {
+            "timestamp": {
+              "type": "string"
+            },
+            "executor": {
+              "type": "string"
+            },
+            "trace_id": {
+              "type": "string"
+            },
+            "lineage": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": true
+        },
+        "host_rules": {
+          "type": "object",
+          "required": [
+            "claude",
+            "codex"
+          ],
+          "properties": {
+            "claude": {
+              "type": "object",
+              "required": [
+                "compilation_targets",
+                "hooks",
+                "subagents",
+                "skills"
+              ],
+              "properties": {
+                "compilation_targets": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "hooks": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "subagents": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "skills": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "additionalProperties": true
+            },
+            "codex": {
+              "type": "object",
+              "required": [
+                "compilation_targets",
+                "skills",
+                "agents_fragments",
+                "rules",
+                "automations"
+              ],
+              "properties": {
+                "compilation_targets": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "skills": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "agents_fragments": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "rules": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "automations": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "additionalProperties": true
+            }
+          },
+          "additionalProperties": true
+        }
+      },
+      "additionalProperties": true
+    },
     "channel_overrides": {
       "type": "object"
     }

package/dist/enterprise/bundle/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.0.5 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.0.7 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -281,10 +281,32 @@
         ],
         "matcher": ""
       }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"$HOME/.claude/hooks/user-prompt-submit.py\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "InstructionsLoaded": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"$HOME/.claude/hooks/instructions-loaded.py\"",
+            "timeout": 10
+          }
+        ]
+      }
     ]
   },
   "_omg": {
-    "_version": "2.0.5",
+    "_version": "2.0.7",
     "preset": "safe",
     "default_mode": "ulw+ralph",
     "vision_auto": true,
@@ -337,7 +359,7 @@
       "CONTEXT_MANAGER": false
     },
     "generated": {
-      "contract_version": "2.0.5",
+      "contract_version": "2.0.7",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",
@@ -363,9 +385,7 @@
         ".omg/**",
         ".agents/**",
         ".codex/**",
-        ".claude/**",
-        "registry/**",
-        "dist/**"
+        ".claude/**"
       ],
       "emulated_events": [
         "PreCompact",
@@ -375,6 +395,199 @@
         "SubagentStart",
         "SubagentStop",
         "TaskCompleted"
+      ],
+      "policy_model": {
+        "trust_tiers": [
+          {
+            "name": "safe",
+            "level": 0,
+            "label": "Safe",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry"
+            ]
+          },
+          {
+            "name": "balanced",
+            "level": 1,
+            "label": "Balanced",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry",
+              "reviewed_external"
+            ]
+          },
+          {
+            "name": "interop",
+            "level": 2,
+            "label": "Interop",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry",
+              "reviewed_external",
+              "migration_bridge"
+            ]
+          },
+          {
+            "name": "labs",
+            "level": 3,
+            "label": "Labs",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry",
+              "reviewed_external",
+              "experimental"
+            ]
+          }
+        ],
+        "tool_policies": [
+          {
+            "tool_name": "Read",
+            "allowed_tiers": [
+              "safe",
+              "balanced",
+              "interop",
+              "labs"
+            ],
+            "requires_approval": false
+          },
+          {
+            "tool_name": "Grep",
+            "allowed_tiers": [
+              "safe",
+              "balanced",
+              "interop",
+              "labs"
+            ],
+            "requires_approval": false
+          },
+          {
+            "tool_name": "Bash(python3:*)",
+            "allowed_tiers": [
+              "balanced",
+              "interop",
+              "labs"
+            ],
+            "requires_approval": true
+          }
+        ],
+        "protected_paths": [
+          {
+            "path_pattern": ".omg/**",
+            "required_tier": "balanced"
+          },
+          {
+            "path_pattern": ".agents/**",
+            "required_tier": "balanced"
+          },
+          {
+            "path_pattern": ".codex/**",
+            "required_tier": "balanced"
+          },
+          {
+            "path_pattern": ".claude/**",
+            "required_tier": "balanced"
+          }
+        ],
+        "evidence_contract": {
+          "timestamp": "timestamp",
+          "executor": "executor",
+          "trace_id": "trace_id",
+          "lineage": "lineage"
+        },
+        "host_rules": {
+          "claude": {
+            "compilation_targets": [
+              ".claude-plugin/plugin.json",
+              ".claude-plugin/marketplace.json",
+              ".mcp.json",
+              "settings.json"
+            ],
+            "hooks": [
+              "SessionStart",
+              "PreToolUse",
+              "PostToolUse",
+              "PreCompact"
+            ],
+            "subagents": [
+              "local_supervisor",
+              "workers"
+            ],
+            "skills": [
+              "omg/control-plane",
+              "omg/hook-governor"
+            ]
+          },
+          "codex": {
+            "compilation_targets": [
+              ".agents/skills/omg/<bundle>/SKILL.md",
+              ".agents/skills/omg/<bundle>/openai.yaml",
+              ".agents/skills/omg/AGENTS.fragment.md",
+              ".agents/skills/omg/codex-mcp.toml"
+            ],
+            "skills": [
+              "omg/control-plane",
+              "omg/mcp-fabric"
+            ],
+            "agents_fragments": [
+              ".agents/skills/omg/AGENTS.fragment.md"
+            ],
+            "rules": [
+              "protected_paths",
+              "explicit_invocation"
+            ],
+            "automations": [
+              "contract-compile",
+              "release-readiness"
+            ]
+          }
+        }
+      },
+      "subagents": [
+        {
+          "name": "security-reviewer",
+          "description": "Read-only security review subagent with scoped tool access.",
+          "tools": [
+            "Read",
+            "Grep",
+            "Glob",
+            "Bash(grep *)",
+            "Bash(find *)",
+            "Bash(git log *)",
+            "Bash(git diff *)"
+          ],
+          "bypassPermissions": false
+        },
+        {
+          "name": "release-manager",
+          "description": "Release management subagent with write access governed by protected-path policy.",
+          "tools": [
+            "Read",
+            "Write",
+            "Edit",
+            "Grep",
+            "Glob",
+            "Bash(git *)",
+            "Bash(python3 scripts/omg.py *)"
+          ],
+          "bypassPermissions": false,
+          "protectedPaths": [
+            ".omg/**",
+            ".agents/**",
+            ".codex/**",
+            ".claude/**"
+          ]
+        }
+      ],
+      "skills": [
+        {
+          "name": "omg/control-plane",
+          "source": ".agents/skills/omg/control-plane/"
+        },
+        {
+          "name": "omg/hook-governor",
+          "source": ".agents/skills/omg/hook-governor/"
+        }
       ]
     }
   }