@trac3er/oh-my-god 2.0.5 → 2.0.7

package/dist/enterprise/manifest.json

@@ -1,11 +1,11 @@
 {
   "schema": "OmgCompiledArtifactManifest",
   "channel": "enterprise",
-  "contract_version": "2.0.5",
+  "contract_version": "2.0.7",
   "artifacts": [
     {
       "path": "bundle/.agents/skills/omg/AGENTS.fragment.md",
-      "sha256": "ac0d35aa2a8d27a246627c7e9bbbe8cab5a50b7b25b2a16bb451f4c79f263d7d"
+      "sha256": "9497432cb2ec30d045feadadeb1bcd8fc5e152d815c9ae4ffd303fe13303b3a8"
     },
     {
       "path": "bundle/.agents/skills/omg/algorithms/SKILL.md",
@@ -27,6 +27,10 @@
       "path": "bundle/.agents/skills/omg/codex-mcp.toml",
       "sha256": "a56de208a369a2b318d2e66e150eef4cba1fac1ecf32bda6db1a1e4b65db7311"
     },
+    {
+      "path": "bundle/.agents/skills/omg/codex-rules.md",
+      "sha256": "29b837dfc9a92cc5d9f060207d9187c8d49162edaa25a62f616c64c896589752"
+    },
     {
       "path": "bundle/.agents/skills/omg/control-plane/SKILL.md",
       "sha256": "e3a53f89e15018895691657eb3962f942558475d6faaae760e7d48774ce6a47e"
@@ -157,11 +161,11 @@
     },
     {
       "path": "bundle/.claude-plugin/marketplace.json",
-      "sha256": "2c1e7ffe83d11c464662aba58720c52b3b136d3564c32b83019a7aeecd6a982c"
+      "sha256": "4690a0c1785fa1401ad430a270726476d93bc3262ae3ab0f195b15302b24f4ab"
     },
     {
       "path": "bundle/.claude-plugin/plugin.json",
-      "sha256": "fe79af472d21bd47da149116ff1ed5c82b08c4bfd60b470e5d4faf6799f9abf7"
+      "sha256": "64532d6060c986ec4fec62f038d27dc7c89ba088269b17390f727aae53d64294"
     },
     {
       "path": "bundle/.mcp.json",
@@ -169,87 +173,131 @@
     },
     {
       "path": "bundle/OMG_COMPAT_CONTRACT.md",
-      "sha256": "fa7a4a16097b35170784e136f8ff9eae64c825a07f55413fb8fea3e7ab40c2e5"
+      "sha256": "108ba784d61707ef22a58ff0898d84cdb867e5c2dcf5195eccadf30a6304437c"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:code-review.md",
+      "sha256": "99ba9756586924d0ebdd43c4ca65f925b86f6c4bf6bc98d355f0cb9a17f9f6b0"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:deep-plan.md",
+      "sha256": "ab0b327d541289c219ffac27c70bcb48affb7dba540b5299a420a8754a3ca458"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:handoff.md",
+      "sha256": "eea0da517e14abb0a9bc6fe661f310a81c0282ff666803da4ae1be47fb597011"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:learn.md",
+      "sha256": "338f87222db65114f8c83de2185a21c7c2538832395524ac39ea38a0e09d73b3"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:maintainer.md",
+      "sha256": "1a29d4cb6839dd6de8c11b88b93a72fb9a371cfb7784bfe409d5e5ef0a825508"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:ralph-start.md",
+      "sha256": "31b2aded6032b5f061dbb7cd92dff53bbe3b527b9e9ba93d5043cad2847a6365"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:ralph-stop.md",
+      "sha256": "b43acad180bd205ddd78d42f1c7ecf315e521a0c345bf9d42b24d8c4d3913ce3"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:security-review.md",
+      "sha256": "f2a0e1a61b4110ac88202e2e5c166191867423235bf61030ef9cc082d964cc22"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:sequential-thinking.md",
+      "sha256": "1830de63009cb07c80cbcecf143f6df7560e7f031ac5b1d509b726d184e441da"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:ship.md",
+      "sha256": "47979d0dfb2e8be6cfe4ac2f4f5ee2308b426c849eb51511c09bbd100ea2088f"
+    },
+    {
+      "path": "bundle/plugins/advanced/plugin.json",
+      "sha256": "37bed96f0d9113b5055c87f8e8291a7518e1b471d9fdabcd37ce9750e9f2546c"
     },
     {
       "path": "bundle/registry/bundles/algorithms.yaml",
-      "sha256": "cc589c80d47ab2eb1bb2f142d462e40fc1c5f108e175360b40929326966de723"
+      "sha256": "210dca6fd5499ecf33109e6b9d72a26311f353cb9bda3faca408a3693b895c2d"
     },
     {
       "path": "bundle/registry/bundles/api-twin.yaml",
-      "sha256": "6952f8d45dbfa29afac88de0f110b2941804c4543dae4c0f5562cb876de376b7"
+      "sha256": "247931ceb9c23d957561b0abf62bf07670e226921032ede652974556fafc9704"
     },
     {
       "path": "bundle/registry/bundles/control-plane.yaml",
-      "sha256": "fd624b518e20e48b7dc68378c95493a4f88e07c759ea53f3b9c82646b263d80c"
+      "sha256": "f76ddc2c53be8cc8448903351cdbd9a8690d2386523822c1f538a8f1f4120443"
     },
     {
       "path": "bundle/registry/bundles/data-lineage.yaml",
-      "sha256": "602a1906d976ff93beb961affd7b5f6d4dc6486cd960ad47aa2a2b6c65724585"
+      "sha256": "b73b8ee4ab22b3aebf2e065108cac691d6ef028252f426050997b0fd707ed417"
     },
     {
       "path": "bundle/registry/bundles/delta-classifier.yaml",
-      "sha256": "d08df8acb9713c58767a0c1a390fd35a61b7e1a290cfb13376a8f5517cbcc7f3"
+      "sha256": "554a14baae9c678da158cd7c6d5e012978f9c9cffbc755b006fd088790c61340"
     },
     {
       "path": "bundle/registry/bundles/eval-gate.yaml",
-      "sha256": "c3de322fece33b91f503740f828e318264d0388d3403b98f09c2d73486a57b81"
+      "sha256": "c5071c2bb8f06b51173ea5fec8765c5f455af6805ee95745cde4fe626b8a4171"
     },
     {
       "path": "bundle/registry/bundles/health.yaml",
-      "sha256": "3192a27f326656732fe83ed6e725366bc2c9bb7e5009de07b9097b864357383b"
+      "sha256": "b5764493f3bf3099bf4178cdee1e23bdb5122aa98590352c93a870c386e7aeb8"
     },
     {
       "path": "bundle/registry/bundles/hook-governor.yaml",
-      "sha256": "ccb6edc43da2594eb93ad00abe3447879923f83067201d82927a942bb25f412d"
+      "sha256": "50435af649637cc105813b3b0fc27fb4d8a9d54008385118ccf3bda15fbb7ee8"
     },
     {
       "path": "bundle/registry/bundles/incident-replay.yaml",
-      "sha256": "aeaee69df8fdb8652707f3a228e4556e3a42a1487f4b77d33f47197370bd24a6"
+      "sha256": "189980c25e986d6d30b67c8250e31dc687d55d293a41723833e04ee588bf422a"
     },
     {
       "path": "bundle/registry/bundles/lsp-pack.yaml",
-      "sha256": "b0e6f74fd0b52cf37960defc3c9a0b66b722d98b7db15f6b1d4e11eae9a96707"
+      "sha256": "85539b633e5fb2c6058e5b2232abc5749d5aa26fe6827041efd3673e44ab44a9"
     },
     {
       "path": "bundle/registry/bundles/mcp-fabric.yaml",
-      "sha256": "40766fb1fed2fbd29ae029915d2c883f3c3f38157fa3c0d72018381c75df6e31"
+      "sha256": "560cbc610be709b177db60776adba502f4f6d14fd5935649f6b7ebfe49c78880"
     },
     {
       "path": "bundle/registry/bundles/preflight.yaml",
-      "sha256": "f12fd6b4aaa045141dcaaf62b51f5de7d31de2625f819ad368adc1a6e2010b18"
+      "sha256": "48cc963426dcfab2027e1cb6f189bbe4f363eb1e7d0545a2f0db766e907519f7"
     },
     {
       "path": "bundle/registry/bundles/remote-supervisor.yaml",
-      "sha256": "ac727c3074ae4a95e66b7e023f38ad22c3ae903db8af079b8b66c83fad57e650"
+      "sha256": "c1df55fadf42cc9598575b5cfcf74b6bfc0767e817c9c59990259b515c774007"
     },
     {
       "path": "bundle/registry/bundles/robotics.yaml",
-      "sha256": "8748fdb84285c2131685626182ba86806d3cffecfe5c94c6438a791f983afd2b"
+      "sha256": "87333553aebe6e89196665dc24ccdd0c71c68044c252d2f9f84b1047dbd66063"
     },
     {
       "path": "bundle/registry/bundles/secure-worktree-pipeline.yaml",
-      "sha256": "f62b4d9daee055362e013883f86479d2ddc2b22f8a97be84342a1b2979b9d584"
+      "sha256": "e7fdae261d9671be6ae32448cc2d20636eefd8bbbcee7379b98d911d2483c37d"
     },
     {
       "path": "bundle/registry/bundles/security-check.yaml",
-      "sha256": "768f412af9696b8c83320c4d1d92c0703ed553296bbf54aff9c0c387f7a86cf0"
+      "sha256": "bb19a53192a7c8b476585b30724c0c114d0b62786b1f8e2147d9367ac5c344f9"
     },
     {
       "path": "bundle/registry/bundles/tracebank.yaml",
-      "sha256": "500b996f7c55e652e9b4b677fefa472b49b4f61c052b7996738ed1389a575f3a"
+      "sha256": "a6b1378a290a659f6eadbf9bb63e639539f7ca01d226af418a0504f69d7406cb"
     },
     {
       "path": "bundle/registry/bundles/vision.yaml",
-      "sha256": "9f8b8be109d791954e6da97c0caed9234a58c15f1e9a189c445d0a55ec2591d8"
+      "sha256": "607c4c8582f79392adcf09e5a8f8f1eaf2550603749b162e70f8b7dc4eccb3de"
     },
     {
       "path": "bundle/registry/omg-capability.schema.json",
-      "sha256": "ac5ce4663ae343785c844b0404cc5745f329df1cd12674201929f82d1e6332c9"
+      "sha256": "2df3a4e2f2fc4c0a0e6c150669f463cc7f07e673a0759c15df4e8dd80572ae5b"
     },
     {
       "path": "bundle/settings.json",
-      "sha256": "e8d244b7fb6fa8d83afad7d6fb3ee29f52e21aafaa0f719a7ca4292d45ef35cb"
+      "sha256": "0208ccb5e20f5e456b1bb3701994fbedbf528260758c539b9afadeacbdf50065"
     }
   ]
 }

package/dist/public/bundle/.agents/skills/omg/AGENTS.fragment.md

@@ -1,5 +1,52 @@
-# OMG Codex Protection Rules
+# OMG Codex Governance (channel: public)
 
-- Channel: `public`
-- Protect `.omg/`, `.agents/`, `.codex/`, and `.claude/` from unreviewed mutation.
+## Build & Test
+
+```bash
+python3 -m pytest tests -q
+python3 scripts/omg.py contract validate
+python3 scripts/omg.py contract compile --host codex --channel public
+```
+
+## Protected Paths
+
+The following paths require tier-gated review before mutation:
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Evidence Contract
+
+Every production action must emit evidence containing these fields:
+
+- `executor`
+- `lineage`
+- `timestamp`
+- `trace_id`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Web Search Policy
+
+- Prefer cached results over live network requests.
+- Do NOT initiate live web searches unless explicitly instructed.
+- Use `context7` or local documentation before external lookups.
+- Set `cached_web_search: prefer_cached` as the default.
+
+## Approval Constraints
+
+- Destructive file operations require explicit user approval.
+- `git push --force` and branch deletions require explicit approval.
+- Production deployments require explicit approval.
+- Mutations to protected paths require tier-gated approval.
+
+## Rules & Automations
+
+- Rules: `protected_paths, explicit_invocation`
+- Automations: `contract-compile, release-readiness`
 - Require explicit invocation for production-control-plane skills.

package/dist/public/bundle/.agents/skills/omg/codex-rules.md

@@ -0,0 +1,29 @@
+# OMG Codex Rules (channel: public)
+
+## Defaults
+
+- `cached_web_search: prefer_cached`
+- `live_network: deny_by_default`
+- `destructive_approval: required`
+
+## Protected Paths
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Approval Matrix
+
+| Action | Approval Required |
+|--------|------------------|
+| Read / Grep | No |
+| Write to protected paths | Yes |
+| Bash (python3:*) | Yes (balanced+ tier) |
+| git push --force | Yes |
+| Production deploy | Yes |

package/dist/public/bundle/.claude-plugin/marketplace.json

@@ -5,16 +5,16 @@
     "name": "trac3er00"
   },
   "metadata": {
-    "description": "OMG - Oh-My-God for Claude Code",
-    "version": "2.0.5",
+    "description": "OMG - Oh-My-God for Claude Code and supported agent hosts",
+    "version": "2.0.7",
     "homepage": "https://github.com/trac3er00/OMG",
     "repository": "https://github.com/trac3er00/OMG"
   },
   "plugins": [
     {
       "name": "omg",
-      "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
-      "version": "2.0.5",
+      "description": "OMG plugin layer for Claude Code and supported agent hosts with native setup, orchestration, and interop.",
+      "version": "2.0.7",
       "source": "./",
       "author": {
         "name": "trac3er00"
@@ -32,5 +32,5 @@
       ]
     }
   ],
-  "version": "2.0.5"
+  "version": "2.0.7"
 }

package/dist/public/bundle/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg",
-  "version": "2.0.5",
+  "version": "2.0.7",
   "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
   "author": {
     "name": "trac3er00"

package/dist/public/bundle/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.0.5
+version: 2.0.7
 canonical_hosts:
   - claude
   - codex

package/dist/public/bundle/plugins/advanced/commands/OMG:code-review.md

@@ -0,0 +1,114 @@
+---
+description: Deep code review — reads file completely, checks line-by-line for issues, then analyzes whole-file structure. Enforces code hygiene.
+allowed-tools: Read, Bash(cat:*), Bash(grep:*), Bash(wc:*), Bash(head:*), Bash(find:*), Bash(rg:*), Grep, Glob
+argument-hint: "[file path or 'recent' for git-changed files]"
+---
+
+# /OMG:code-review — Line-by-Line + Structural Review
+
+## Philosophy
+Two passes: LINE-BY-LINE precision, then WHOLE-FILE understanding.
+Don't just scan — READ and UNDERSTAND every line.
+
+## Step 1: Determine Scope
+
+- If file specified: review that file
+- If "recent" or no argument: review uncommitted changes
+  ```bash
+  git diff --name-only HEAD 2>/dev/null
+  git diff --cached --name-only 2>/dev/null
+  ```
+
+## Step 2: Read the FULL File First
+
+Read the ENTIRE file. Not just the changed part. Not just a function.
+Understanding comes from seeing the whole context.
+
+Note:
+- What does this file DO? (its purpose in the system)
+- What are its DEPENDENCIES? (imports, calls)
+- What does it EXPORT? (public API)
+
+## Step 3: Line-by-Line Scan
+
+For each line, check:
+
+**Correctness:**
+- Logic errors (off-by-one, null checks, type mismatches)
+- Missing error handling (unhandled promises, bare except, no null check)
+- Race conditions (shared state, async without await, unchecked concurrent access)
+
+**Security (if auth/payment/database):**
+- Hardcoded secrets → CRITICAL
+- SQL injection (string concatenation in queries) → CRITICAL
+- XSS (innerHTML, dangerouslySetInnerHTML) → HIGH
+- Missing input validation → MEDIUM
+- Overly permissive CORS/cookies → MEDIUM
+
+**Hygiene:**
+- Dead code (unused imports, variables, unreachable branches)
+- Noise comments ("increment i", "return result", "constructor")
+- console.log/print left in production code
+- TODO/FIXME/HACK without tracking
+- Overly complex functions (>40 lines → suggest extract)
+- Duplicated logic (same pattern in 2+ places → suggest DRY)
+
+## Step 4: Whole-File Structure Analysis
+
+After line-by-line:
+- Does the file do ONE thing well, or is it a dumping ground?
+- Are functions ordered logically? (public first, helpers after, or lifecycle order)
+- Is naming consistent? (camelCase throughout? PascalCase for classes?)
+- Does it follow the project's domain pattern? (check .omg/knowledge/domain-patterns/)
+- Any circular dependencies?
+- Is error handling consistent across all functions?
+
+## Step 5: Report
+
+```
+Code Review — [file]
+━━━━━━━━━━━━━━━━━━━━
+
+Structure: [CLEAN | NEEDS_WORK | MESSY]
+Security:  [SAFE | REVIEW_NEEDED | CRITICAL]
+Hygiene:   [CLEAN | NEEDS_CLEANUP]
+
+Issues:
+  [line:col] CRITICAL: [description]
+  [line:col] HIGH: [description]
+  [line:col] MEDIUM: [description]
+  [line:col] LOW: [description]
+
+Dead Code:
+  [line] unused import: [name]
+  [line] unreachable after return
+
+Noise Comments (remove these):
+  [line] "// increment counter"
+  [line] "// return the value"
+
+Structural:
+  - [function] is [N] lines — consider extracting [suggestion]
+  - [pattern] duplicated at lines [X] and [Y]
+
+Recommendation: [summary of what to fix, in priority order]
+```
+
+## Step 6: For Security-Critical Files
+
+If the file touches auth, payment, or database:
+```
+/OMG:escalate codex "Line-by-line security review of [file]. Check:
+1. Every input validation point
+2. Every database query for injection
+3. Every auth check for bypass
+4. Every secret reference for hardcoding
+Report: line numbers + severity + fix suggestion"
+```
+
+## Anti-patterns
+- DON'T skim and say "looks good" — read every line
+- DON'T only check the diff — read the full file for context
+- DON'T ignore test files — they can have real issues too
+- DON'T add more noise comments as "fixes" — remove them instead
+- DON'T suggest unnecessary code as improvements

package/dist/public/bundle/plugins/advanced/commands/OMG:deep-plan.md

@@ -0,0 +1,221 @@
+---
+description: Deep strategic planning — understands user direction, asks smart questions, creates comprehensive plan with domain awareness
+allowed-tools: Read, Write, Edit, MultiEdit, Bash(find:*), Bash(cat:*), Bash(git:*), Bash(wc:*), Bash(tree:*), Bash(mkdir:*), Bash(tee:*), Grep, Glob
+argument-hint: "[feature or goal to plan]"
+---
+
+# /OMG:deep-plan — Strategic Planning with Direction Understanding
+
+## Philosophy
+Regular planning = "what steps to take."
+Deep planning = "understand WHY the user wants this, WHAT direction they're heading, and HOW it fits the bigger picture."
+
+## Step 1: Direction Discovery (MANDATORY)
+
+Do not assume goals, constraints, or context. Extract direction from:
+- user prompt
+- `.omg/state/handoff.md`
+- `.omg/state/ledger/failure-tracker.json`
+- current repo structure and patterns
+
+Before planning anything, understand:
+1. **User's real goal** — Often the stated request is one step toward something bigger. Ask: "What's the end state you're imagining?"
+2. **User's constraints** — Time, budget, existing code, team preferences, tech stack decisions already made.
+3. **User's domain knowledge** — Are they expert in this domain (follow their lead) or exploring (guide them)?
+4. **What they've already tried** — Check .omg/state/handoff.md, failure-tracker.json, git log.
+
+If direction is still ambiguous after repo exploration, ask only minimal focused questions.
+
+Examples of BAD questions: "What framework do you want?" "What's your deadline?"
+Examples of GOOD questions:
+- "I see you have a Stripe integration started in /src/payment/. Are you building on that, or replacing it?"
+- "Your auth uses JWT in cookies. Should the new feature respect that pattern, or are you migrating to sessions?"
+- "The DB schema has 3 user types. Does this feature apply to all of them or just one?"
+
+## Step 2: Map the Domain
+
+Read the codebase to understand the CURRENT state:
+```bash
+# Directory structure
+find . -type f -name "*.ts" -o -name "*.py" -o -name "*.go" | head -50
+
+# Key architectural patterns
+grep -rn "export class\|export function\|def \|func \|struct " src/ --include="*.{ts,py,go}" | head -30
+
+# Existing domain boundaries
+ls -la src/*/  # or app/*/ or packages/*/
+
+# Data flow
+grep -rn "import.*from\|require(" src/ --include="*.{ts,js}" | head -20
+```
+
+If DDD reference patterns exist (see .omg/knowledge/ or existing domain modules):
+- Read the reference domain FIRST
+- Plan the new feature to MATCH the pattern
+- Note any intentional deviations with WHY
+
+## Step 3: Create the Deep Plan
+
+Use Bash heredoc to write `.omg/state/_plan.md` (and `.omg/idea.yml`). Do NOT use the `Write` tool — it requires a prior Read which is unnecessary for fresh plan creation:
+
+```markdown
+# Deep Plan: [Feature Name]
+Created: [date]
+CHANGE_BUDGET=[small|medium|large]
+
+## Direction
+[1-2 sentences: what the user is building toward, not just this task]
+
+## Domain Context
+Reference pattern: [file/module that sets the pattern]
+Bounded contexts affected: [list]
+Key interfaces: [list the interfaces/types this touches]
+
+## Architecture Decisions
+- [Decision]: [chosen approach] because [reason]
+  Alternatives considered: [what was rejected and why]
+
+## Implementation Plan
+
+### Phase 1: Foundation [N files, ~M lines]
+1. [ ] [specific action] — [file] — [what and why]
+2. [ ] [specific action] — [file]
+
+### Phase 2: Core Logic [N files, ~M lines]
+3. [ ] [specific action]
+4. [ ] [specific action]
+
+### Phase 3: Integration + Security [N files, ~M lines]
+5. [ ] [specific action]
+6. [ ] Security review: /OMG:security-check [affected files]
+
+### Phase 4: Verification
+7. [ ] Tests: [what to test, how]
+8. [ ] Edge cases: [list]
+9. [ ] Manual verification: [steps]
+
+## Risk Map
+- [Risk]: [mitigation]
+- [Risk]: [mitigation]
+
+## What NOT to Do
+- [Anti-pattern specific to this feature]
+- [Approach that looks tempting but will fail because...]
+
+## Files to Read Before Starting
+1. [file] — [why: contains the reference pattern]
+2. [file] — [why: defines the interface this must implement]
+```
+
+## Step 4: Present and Iterate
+
+Show the plan to the user. Ask:
+- "Does this match the direction you're thinking?"
+- "Anything I'm missing about your goals?"
+- "Should I adjust the scope or priority?"
+
+Update the plan based on feedback BEFORE starting implementation.
+
+## Step 4.5: Codex Plan Validation (MANDATORY)
+
+Before implementation, run a dedicated Codex validation pass on the final plan.
+
+Checklist for Codex validation:
+- ordering and dependency correctness
+- hidden edge cases and rollback gaps
+- security/performance blind spots
+- missing verification steps
+
+Only after applying those corrections, continue to execution.
+
+## Step 4.6: Multi-Agent Bootstrap (MANDATORY)
+
+After validation, launch exactly 5 planning tracks with mixed-model intent using OMG-native routing (same planning discipline as OMG):
+
+1. Architect track (Claude)
+2. Backend track (GPT/Codex)
+3. Frontend track (Gemini)
+4. Security track (GPT/Codex)
+5. Verification track (Claude)
+
+Dispatch pattern is mandatory: all 5 tracks launch in parallel as background sub-agents.
+
+```python
+task(subagent_type="explore", run_in_background=true, load_skills=[], description="Architect planning track", prompt="...")
+task(subagent_type="explore", run_in_background=true, load_skills=[], description="Backend planning track", prompt="...")
+task(subagent_type="explore", run_in_background=true, load_skills=[], description="Frontend planning track", prompt="...")
+task(subagent_type="explore", run_in_background=true, load_skills=[], description="Security planning track", prompt="...")
+task(subagent_type="explore", run_in_background=true, load_skills=[], description="Verification planning track", prompt="...")
+```
+
+Collection and merge protocol:
+- collect every track using `background_output(task_id="...")`
+- run a `sequential-thinking` merge pass to resolve conflicts and ordering
+- emit one final executable checklist only after the merge pass
+
+Each track must return:
+- concrete plan steps
+- risk notes
+- verification commands
+
+Then merge outputs into a single execution checklist before implementation.
+
+## Step 5: Generate Checklist
+
+Convert the plan into `.omg/state/_checklist.md` with concrete steps.
+Each step should be completable in ONE tool interaction (not "implement the feature").
+
+## Step 5.5: Business Workflow Contract (MANDATORY)
+
+Deep-plan owns the business-style delivery workflow and task-plan contract.
+
+Always generate a normalized workflow path and task plan directly from user instructions:
+
+- canonical stages: `plan -> implement -> qa -> simulate -> final_test -> production`
+- accepted user path keys: `workflow`, `path`, `delivery_path`, `workflow_path`
+- accepted stage aliases:
+  - `planning -> plan`
+  - `implementation|build -> implement`
+  - `quality|quality_assurance -> qa`
+  - `testing|test -> final_test`
+  - `prod|deploy -> production`
+
+Rules:
+1. If user provides a partial path, keep user order and append missing canonical stages.
+2. If user provides no path, use the full canonical path.
+3. Build tasks from:
+   - `user_instructions[]` (source of truth for requested workflow)
+   - `constraints[]` (delivery boundaries)
+   - `acceptance[]` (final test criteria)
+4. Include stage readiness for production handoff:
+   - `production=ready` only when QA/simulation/final_test gates pass.
+
+Persist this contract into planning artifacts:
+- `.omg/state/_plan.md` (human-readable plan)
+- `.omg/state/_checklist.md` (atomic execution items)
+- include structured task metadata in the plan output (`stage`, `title`, `detail`, `source`).
+
+## Integration with DDD
+
+If this is a new domain:
+1. Ask the user to write (or help write) the first domain reference
+2. Extract the pattern: naming convention, data flow, error handling style
+3. Document the pattern in .omg/knowledge/domain-patterns/[name].md
+4. Use the pattern for ALL subsequent domains
+
+## Idea-as-Code Contract (required)
+
+Before leaving planning, ensure `.omg/idea.yml` exists with:
+- `goal`
+- `constraints[]`
+- `acceptance[]`
+- `risk.security[]|risk.performance[]|risk.compatibility[]`
+- `evidence_required.tests[]|security_scans[]|reproducibility[]`
+
+If missing, scaffold from template and fill from the conversation.
+
+## Anti-patterns
+- Don't plan in your head and dump a wall of text — INTERACT with the user
+- Don't make architecture decisions without checking existing patterns
+- Don't create a plan with vague steps like "implement feature" — be specific
+- Don't skip the Direction step — it's the difference between useful and useless