@trac3er/oh-my-god 2.0.5 → 2.0.7

package/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.0.5 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.0.7 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -281,10 +281,32 @@
         ],
         "matcher": ""
       }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"$HOME/.claude/hooks/user-prompt-submit.py\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "InstructionsLoaded": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"$HOME/.claude/hooks/instructions-loaded.py\"",
+            "timeout": 10
+          }
+        ]
+      }
     ]
   },
   "_omg": {
-    "_version": "2.0.5",
+    "_version": "2.0.7",
     "preset": "safe",
     "default_mode": "ulw+ralph",
     "vision_auto": true,
@@ -337,7 +359,7 @@
       "CONTEXT_MANAGER": false
     },
     "generated": {
-      "contract_version": "2.0.5",
+      "contract_version": "2.0.7",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",
@@ -363,9 +385,7 @@
         ".omg/**",
         ".agents/**",
         ".codex/**",
-        ".claude/**",
-        "registry/**",
-        "dist/**"
+        ".claude/**"
       ],
       "emulated_events": [
         "PreCompact",
@@ -375,6 +395,199 @@
         "SubagentStart",
         "SubagentStop",
         "TaskCompleted"
+      ],
+      "policy_model": {
+        "trust_tiers": [
+          {
+            "name": "safe",
+            "level": 0,
+            "label": "Safe",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry"
+            ]
+          },
+          {
+            "name": "balanced",
+            "level": 1,
+            "label": "Balanced",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry",
+              "reviewed_external"
+            ]
+          },
+          {
+            "name": "interop",
+            "level": 2,
+            "label": "Interop",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry",
+              "reviewed_external",
+              "migration_bridge"
+            ]
+          },
+          {
+            "name": "labs",
+            "level": 3,
+            "label": "Labs",
+            "allowed_sources": [
+              "local_repo",
+              "trusted_registry",
+              "reviewed_external",
+              "experimental"
+            ]
+          }
+        ],
+        "tool_policies": [
+          {
+            "tool_name": "Read",
+            "allowed_tiers": [
+              "safe",
+              "balanced",
+              "interop",
+              "labs"
+            ],
+            "requires_approval": false
+          },
+          {
+            "tool_name": "Grep",
+            "allowed_tiers": [
+              "safe",
+              "balanced",
+              "interop",
+              "labs"
+            ],
+            "requires_approval": false
+          },
+          {
+            "tool_name": "Bash(python3:*)",
+            "allowed_tiers": [
+              "balanced",
+              "interop",
+              "labs"
+            ],
+            "requires_approval": true
+          }
+        ],
+        "protected_paths": [
+          {
+            "path_pattern": ".omg/**",
+            "required_tier": "balanced"
+          },
+          {
+            "path_pattern": ".agents/**",
+            "required_tier": "balanced"
+          },
+          {
+            "path_pattern": ".codex/**",
+            "required_tier": "balanced"
+          },
+          {
+            "path_pattern": ".claude/**",
+            "required_tier": "balanced"
+          }
+        ],
+        "evidence_contract": {
+          "timestamp": "timestamp",
+          "executor": "executor",
+          "trace_id": "trace_id",
+          "lineage": "lineage"
+        },
+        "host_rules": {
+          "claude": {
+            "compilation_targets": [
+              ".claude-plugin/plugin.json",
+              ".claude-plugin/marketplace.json",
+              ".mcp.json",
+              "settings.json"
+            ],
+            "hooks": [
+              "SessionStart",
+              "PreToolUse",
+              "PostToolUse",
+              "PreCompact"
+            ],
+            "subagents": [
+              "local_supervisor",
+              "workers"
+            ],
+            "skills": [
+              "omg/control-plane",
+              "omg/hook-governor"
+            ]
+          },
+          "codex": {
+            "compilation_targets": [
+              ".agents/skills/omg/<bundle>/SKILL.md",
+              ".agents/skills/omg/<bundle>/openai.yaml",
+              ".agents/skills/omg/AGENTS.fragment.md",
+              ".agents/skills/omg/codex-mcp.toml"
+            ],
+            "skills": [
+              "omg/control-plane",
+              "omg/mcp-fabric"
+            ],
+            "agents_fragments": [
+              ".agents/skills/omg/AGENTS.fragment.md"
+            ],
+            "rules": [
+              "protected_paths",
+              "explicit_invocation"
+            ],
+            "automations": [
+              "contract-compile",
+              "release-readiness"
+            ]
+          }
+        }
+      },
+      "subagents": [
+        {
+          "name": "security-reviewer",
+          "description": "Read-only security review subagent with scoped tool access.",
+          "tools": [
+            "Read",
+            "Grep",
+            "Glob",
+            "Bash(grep *)",
+            "Bash(find *)",
+            "Bash(git log *)",
+            "Bash(git diff *)"
+          ],
+          "bypassPermissions": false
+        },
+        {
+          "name": "release-manager",
+          "description": "Release management subagent with write access governed by protected-path policy.",
+          "tools": [
+            "Read",
+            "Write",
+            "Edit",
+            "Grep",
+            "Glob",
+            "Bash(git *)",
+            "Bash(python3 scripts/omg.py *)"
+          ],
+          "bypassPermissions": false,
+          "protectedPaths": [
+            ".omg/**",
+            ".agents/**",
+            ".codex/**",
+            ".claude/**"
+          ]
+        }
+      ],
+      "skills": [
+        {
+          "name": "omg/control-plane",
+          "source": ".agents/skills/omg/control-plane/"
+        },
+        {
+          "name": "omg/hook-governor",
+          "source": ".agents/skills/omg/hook-governor/"
+        }
       ]
     }
   }