@trac3er/oh-my-god 2.0.7 → 2.0.8

package/artifacts/release/dist/enterprise/manifest.json

@@ -1,11 +1,11 @@
 {
   "schema": "OmgCompiledArtifactManifest",
   "channel": "enterprise",
-  "contract_version": "2.0.5",
+  "contract_version": "2.0.8",
   "artifacts": [
     {
       "path": "bundle/.agents/skills/omg/AGENTS.fragment.md",
-      "sha256": "9497432cb2ec30d045feadadeb1bcd8fc5e152d815c9ae4ffd303fe13303b3a8"
+      "sha256": "4e8f027295aaaf3573374599519eb839530cd9af6e34e70d7468a1f14e01222e"
     },
     {
       "path": "bundle/.agents/skills/omg/algorithms/SKILL.md",
@@ -23,13 +23,21 @@
       "path": "bundle/.agents/skills/omg/api-twin/openai.yaml",
       "sha256": "a6caee113518bda5e2a470ca7d166d18969392bde1470ef2a47f8ead2c0e33ab"
     },
+    {
+      "path": "bundle/.agents/skills/omg/claim-judge/SKILL.md",
+      "sha256": "12ad7141a9441a3b616b4516d58a5faf6ebb28ed0cece35f5bfda109f0aa0bb0"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/claim-judge/openai.yaml",
+      "sha256": "39285cf57979ddfa917972719d2dfa32c2333f4f7a712a970a5b78c759e04295"
+    },
     {
       "path": "bundle/.agents/skills/omg/codex-mcp.toml",
       "sha256": "a56de208a369a2b318d2e66e150eef4cba1fac1ecf32bda6db1a1e4b65db7311"
     },
     {
       "path": "bundle/.agents/skills/omg/codex-rules.md",
-      "sha256": "29b837dfc9a92cc5d9f060207d9187c8d49162edaa25a62f616c64c896589752"
+      "sha256": "bff9ed8de9aead25b9c5528b21b90486f4611742a58b768f8d1343b444fa5390"
     },
     {
       "path": "bundle/.agents/skills/omg/control-plane/SKILL.md",
@@ -103,6 +111,14 @@
       "path": "bundle/.agents/skills/omg/mcp-fabric/openai.yaml",
       "sha256": "2165ff298b110ef7fb6c42b6b539f8397b8772218de3fa2b8c2332fdd8db6d48"
     },
+    {
+      "path": "bundle/.agents/skills/omg/plan-council/SKILL.md",
+      "sha256": "f6fa96029e14e71b2d89c84f4312a68e25528b584ecf871c1cf3779e944ba0fc"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/plan-council/openai.yaml",
+      "sha256": "3afa688f970eb964620431b9638f7d290700f878add7ae999442df9c4dbb4f67"
+    },
     {
       "path": "bundle/.agents/skills/omg/preflight/SKILL.md",
       "sha256": "f9876277a0b836a3bcbe6e8b140368a85447658820974e09bec2fb1795fb0307"
@@ -111,6 +127,14 @@
       "path": "bundle/.agents/skills/omg/preflight/openai.yaml",
       "sha256": "97945c1a557703c41b53c68797ab9b5a38f8d69e1a9af45ed427bee7e37f589c"
     },
+    {
+      "path": "bundle/.agents/skills/omg/proof-gate/SKILL.md",
+      "sha256": "c421002fb132dcad1f02f69dca7f10e36e7d66e15c3a79b2531193eaea88253b"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/proof-gate/openai.yaml",
+      "sha256": "b38d5daf13301e7428565cd95a2af42d4ff3368d3394814fe11b50ee673e9ee6"
+    },
     {
       "path": "bundle/.agents/skills/omg/remote-supervisor/SKILL.md",
       "sha256": "05be2c248fc0eee2a3db70c0ddeba32b25881b3cc914ce16b719292add77b0c3"
@@ -143,6 +167,14 @@
       "path": "bundle/.agents/skills/omg/security-check/openai.yaml",
       "sha256": "9c47e9fa2ddcb341fa75d4307c5e36e0b928b06fdb28bd7b69ca6cb5941f6b77"
     },
+    {
+      "path": "bundle/.agents/skills/omg/test-intent-lock/SKILL.md",
+      "sha256": "98eca9c53d5228dddd218c29914aab8af5d94eb4ad19ed54e9947af4e53f959c"
+    },
+    {
+      "path": "bundle/.agents/skills/omg/test-intent-lock/openai.yaml",
+      "sha256": "62934b4eef9e0bd516d7db4864cf178e8367d47c7b5a5f9f883427c633e416fa"
+    },
     {
       "path": "bundle/.agents/skills/omg/tracebank/SKILL.md",
       "sha256": "5bac45273cd62373fb4387f8e64a63c4fb69f984a44ee79938be2273b5913b03"
@@ -159,85 +191,161 @@
       "path": "bundle/.agents/skills/omg/vision/openai.yaml",
       "sha256": "8a6f4e40c91ffff3686af47f6902043cf090df7afc530b052f1344efe9cc8e0a"
     },
+    {
+      "path": "bundle/.claude-plugin/marketplace.json",
+      "sha256": "06549b994609245c5f13d6053f9049acce862c7a949f8ec63ce057b13206c0c4"
+    },
+    {
+      "path": "bundle/.claude-plugin/plugin.json",
+      "sha256": "fe7531e0527d288413151433ee5daa3106383442024d5dad072373f8f26d57d1"
+    },
+    {
+      "path": "bundle/.mcp.json",
+      "sha256": "e16897732dbd20ba7f47e5c0513b146a8d847454c8c13aa9e0a6031e5a498fa4"
+    },
     {
       "path": "bundle/OMG_COMPAT_CONTRACT.md",
-      "sha256": "fa7a4a16097b35170784e136f8ff9eae64c825a07f55413fb8fea3e7ab40c2e5"
+      "sha256": "4c628cf93698b051e183db0ddaa80dbdac7a3667071d048cba0f25419271e28d"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:code-review.md",
+      "sha256": "99ba9756586924d0ebdd43c4ca65f925b86f6c4bf6bc98d355f0cb9a17f9f6b0"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:deep-plan.md",
+      "sha256": "ccc235efa52643afd5550765bb0a3b9697be40bf4731392fde3f1c0e5c43f9e0"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:handoff.md",
+      "sha256": "eea0da517e14abb0a9bc6fe661f310a81c0282ff666803da4ae1be47fb597011"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:learn.md",
+      "sha256": "338f87222db65114f8c83de2185a21c7c2538832395524ac39ea38a0e09d73b3"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:maintainer.md",
+      "sha256": "1a29d4cb6839dd6de8c11b88b93a72fb9a371cfb7784bfe409d5e5ef0a825508"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:ralph-start.md",
+      "sha256": "31b2aded6032b5f061dbb7cd92dff53bbe3b527b9e9ba93d5043cad2847a6365"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:ralph-stop.md",
+      "sha256": "b43acad180bd205ddd78d42f1c7ecf315e521a0c345bf9d42b24d8c4d3913ce3"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:security-review.md",
+      "sha256": "f2a0e1a61b4110ac88202e2e5c166191867423235bf61030ef9cc082d964cc22"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:sequential-thinking.md",
+      "sha256": "1830de63009cb07c80cbcecf143f6df7560e7f031ac5b1d509b726d184e441da"
+    },
+    {
+      "path": "bundle/plugins/advanced/commands/OMG:ship.md",
+      "sha256": "3a44016f71a4d73de04043f0c13a6655541c090498908b2bc858c29514a653d4"
+    },
+    {
+      "path": "bundle/plugins/advanced/plugin.json",
+      "sha256": "4968387bae13eaf91792a0c845c28a5007eeefd04d09320b0d783d9563f1481b"
     },
     {
       "path": "bundle/registry/bundles/algorithms.yaml",
-      "sha256": "cc589c80d47ab2eb1bb2f142d462e40fc1c5f108e175360b40929326966de723"
+      "sha256": "d52c36a0c18535eab9f45b37b0e835b1296ee2dc0d84f2925c23eb8d76390377"
     },
     {
       "path": "bundle/registry/bundles/api-twin.yaml",
-      "sha256": "6952f8d45dbfa29afac88de0f110b2941804c4543dae4c0f5562cb876de376b7"
+      "sha256": "1785a09173a380855d8d671d2e8c53b48a0c10ed79dd2d5647cac93fd95ef072"
+    },
+    {
+      "path": "bundle/registry/bundles/claim-judge.yaml",
+      "sha256": "681d69599a20b8172716eaf4290e10821594c4db0a3943147d17628e997cafe9"
     },
     {
       "path": "bundle/registry/bundles/control-plane.yaml",
-      "sha256": "fc3ecec96e30a384d56917aaed36ebd39bbc6f545d22b26465e2aec8a1f9b85d"
+      "sha256": "8a1677d622d2f660b7d1109579f026bd078f97eb624669c618247451bd07f172"
     },
     {
       "path": "bundle/registry/bundles/data-lineage.yaml",
-      "sha256": "602a1906d976ff93beb961affd7b5f6d4dc6486cd960ad47aa2a2b6c65724585"
+      "sha256": "5811a8cf765c73dac6990bebc5a4eaadf5e4be5b9418846efdb6289903b3c5e0"
     },
     {
       "path": "bundle/registry/bundles/delta-classifier.yaml",
-      "sha256": "d08df8acb9713c58767a0c1a390fd35a61b7e1a290cfb13376a8f5517cbcc7f3"
+      "sha256": "ecf2e6fc8e07bc091d3d429c90b94b47ff0c96455467c82feae709bada388c29"
     },
     {
       "path": "bundle/registry/bundles/eval-gate.yaml",
-      "sha256": "c3de322fece33b91f503740f828e318264d0388d3403b98f09c2d73486a57b81"
+      "sha256": "3048cb1c18c3d7814c88689121e44bc54ce45e1478f33c395b247edc55727f76"
     },
     {
       "path": "bundle/registry/bundles/health.yaml",
-      "sha256": "3192a27f326656732fe83ed6e725366bc2c9bb7e5009de07b9097b864357383b"
+      "sha256": "7d52b0d460e4b72a37557b787ab328e5f6be03c313f2c3c58c2882b6c55168b4"
     },
     {
       "path": "bundle/registry/bundles/hook-governor.yaml",
-      "sha256": "ccb6edc43da2594eb93ad00abe3447879923f83067201d82927a942bb25f412d"
+      "sha256": "5e5d6bc3f2f8a8fc5f7a461c46b1d4f9a76467098b057e5796cc70280c21bc0d"
     },
     {
       "path": "bundle/registry/bundles/incident-replay.yaml",
-      "sha256": "aeaee69df8fdb8652707f3a228e4556e3a42a1487f4b77d33f47197370bd24a6"
+      "sha256": "af2480af08cbc2617f97561225f1b7dfa3f0d9897754c9e04dc9035655709772"
     },
     {
       "path": "bundle/registry/bundles/lsp-pack.yaml",
-      "sha256": "b0e6f74fd0b52cf37960defc3c9a0b66b722d98b7db15f6b1d4e11eae9a96707"
+      "sha256": "58963389f5c24eb88f3fef181ce8593733b856f8db75fad3f51c0006413a2381"
     },
     {
       "path": "bundle/registry/bundles/mcp-fabric.yaml",
-      "sha256": "40766fb1fed2fbd29ae029915d2c883f3c3f38157fa3c0d72018381c75df6e31"
+      "sha256": "d9d69f9a5b60c3eb2ffe59500696866f28deebb159aff9ccfc81468c4ba727c1"
+    },
+    {
+      "path": "bundle/registry/bundles/plan-council.yaml",
+      "sha256": "48ffc6d1549a4ce3d8a1a5fbb25fd37d7a6f7af0c1347315b7d2a66408627679"
     },
     {
       "path": "bundle/registry/bundles/preflight.yaml",
-      "sha256": "f12fd6b4aaa045141dcaaf62b51f5de7d31de2625f819ad368adc1a6e2010b18"
+      "sha256": "716a47105e52bfae5fa69e520c2b3f0fb1cde63872837e817cd364e97b9bac11"
+    },
+    {
+      "path": "bundle/registry/bundles/proof-gate.yaml",
+      "sha256": "f0cd5d3916405e30b84069cda4348a9ba8dd073c22b259c6619cf55ebe07cde9"
     },
     {
       "path": "bundle/registry/bundles/remote-supervisor.yaml",
-      "sha256": "ac727c3074ae4a95e66b7e023f38ad22c3ae903db8af079b8b66c83fad57e650"
+      "sha256": "21ca5c27c01ec958aa17df08cf567b72d254a7ece628b6ef51452ef41541f8f8"
     },
     {
       "path": "bundle/registry/bundles/robotics.yaml",
-      "sha256": "8748fdb84285c2131685626182ba86806d3cffecfe5c94c6438a791f983afd2b"
+      "sha256": "c169d765137b80347c0d18c4bb4b462ed1797a7e13eb9c86bec2d4c4f5b8a28c"
     },
     {
       "path": "bundle/registry/bundles/secure-worktree-pipeline.yaml",
-      "sha256": "f62b4d9daee055362e013883f86479d2ddc2b22f8a97be84342a1b2979b9d584"
+      "sha256": "31c80af3b2cf589c338c8690880e330dcd9481b3a15ecb3f964aa2c6212df7aa"
     },
     {
       "path": "bundle/registry/bundles/security-check.yaml",
-      "sha256": "768f412af9696b8c83320c4d1d92c0703ed553296bbf54aff9c0c387f7a86cf0"
+      "sha256": "b2b4d4ec168acee3891cd0d6230909a2ba1544ea60a3df7b24957fd57405c711"
+    },
+    {
+      "path": "bundle/registry/bundles/test-intent-lock.yaml",
+      "sha256": "73f8eda6d0af194b334fa92c218c27b54d203db62ce7d9f2bf1ae6f9441535a2"
     },
     {
       "path": "bundle/registry/bundles/tracebank.yaml",
-      "sha256": "500b996f7c55e652e9b4b677fefa472b49b4f61c052b7996738ed1389a575f3a"
+      "sha256": "1143e896f40d59f1732a0ce3260a620abec202b61c9e335ae6a2e1e58eda5893"
     },
     {
       "path": "bundle/registry/bundles/vision.yaml",
-      "sha256": "9f8b8be109d791954e6da97c0caed9234a58c15f1e9a189c445d0a55ec2591d8"
+      "sha256": "1d9903c943ad6c1ca4796125e97da1839b6f6c0bd3242919036df65dec5ae495"
     },
     {
       "path": "bundle/registry/omg-capability.schema.json",
-      "sha256": "f83f7b4cab70c93fe8decc6d691bc713609b415b3195c66733b925db3a389bf8"
+      "sha256": "486751cecb434c5f169189528ebe5c7ddddadcb0549abdd59f09e7b10844aba1"
+    },
+    {
+      "path": "bundle/settings.json",
+      "sha256": "30acc45a193dc9fdc3733c559cd87e697d68dba9a364567b5097d0296f609ea8"
     }
   ]
 }

package/artifacts/release/dist/public/bundle/.agents/skills/omg/AGENTS.fragment.md

@@ -1,7 +1,58 @@
-# OMG Codex Protection Rules
+# OMG Codex Governance (channel: public)
+
+## Build & Test
+
+```bash
+python3 -m pytest tests -q
+python3 scripts/omg.py contract validate
+python3 scripts/omg.py contract compile --host codex --channel public
+```
+
+## Protected Paths
+
+The following paths require tier-gated review before mutation:
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Evidence Contract
+
+Every production action must emit evidence containing these fields:
+
+- `executor`
+- `lineage`
+- `timestamp`
+- `trace_id`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Protected Planning Surface
+
+Council planning skills are protected and explicit-invocation only:
+
+- `omg/plan-council`
+
+## Web Search Policy
+
+- Prefer cached results over live network requests.
+- Do NOT initiate live web searches unless explicitly instructed.
+- Use `context7` or local documentation before external lookups.
+- Set `cached_web_search: prefer_cached` as the default.
+
+## Approval Constraints
+
+- Destructive file operations require explicit user approval.
+- `git push --force` and branch deletions require explicit approval.
+- Production deployments require explicit approval.
+- Mutations to protected paths require tier-gated approval.
+
+## Rules & Automations
 
-- Channel: `public`
-- Protect `.omg/**, .agents/**, .codex/**, .claude/**` from unreviewed mutation.
-- Require explicit invocation for production-control-plane skills.
 - Rules: `protected_paths, explicit_invocation`
 - Automations: `contract-compile, release-readiness`
+- Require explicit invocation for protected production planning skills.

package/artifacts/release/dist/public/bundle/.agents/skills/omg/claim-judge/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-claim-judge
+description: "Evidence-backed claim validator for structured release and completion claims."
+---
+
+# OMG Claim Judge
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/claim-judge-*.json`

package/artifacts/release/dist/public/bundle/.agents/skills/omg/claim-judge/openai.yaml

@@ -0,0 +1,13 @@
+name: omg-claim-judge
+description: "Evidence-backed claim validator for structured release and completion claims."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: claim-judge
+  title: "OMG Claim Judge"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/artifacts/release/dist/public/bundle/.agents/skills/omg/codex-rules.md

@@ -0,0 +1,33 @@
+# OMG Codex Rules (channel: public)
+
+## Defaults
+
+- `cached_web_search: prefer_cached`
+- `live_network: deny_by_default`
+- `destructive_approval: required`
+
+## Protected Paths
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Protected Planning Surface
+
+- `omg/plan-council` (explicit invocation only)
+
+## Approval Matrix
+
+| Action | Approval Required |
+|--------|------------------|
+| Read / Grep | No |
+| Write to protected paths | Yes |
+| Bash (python3:*) | Yes (balanced+ tier) |
+| git push --force | Yes |
+| Production deploy | Yes |

package/artifacts/release/dist/public/bundle/.agents/skills/omg/plan-council/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-plan-council
+description: "Canonical council-style planning bundle for explicit, evidence-backed deep plans."
+---
+
+# OMG Plan Council
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/plans/deep-plan.md, .omg/plans/deep-plan.json, .omg/plans/dissent.json, .omg/evidence/plan-council.json`

package/artifacts/release/dist/public/bundle/.agents/skills/omg/plan-council/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-plan-council
+description: "Canonical council-style planning bundle for explicit, evidence-backed deep plans."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: plan-council
+  title: "OMG Plan Council"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"

package/artifacts/release/dist/public/bundle/.agents/skills/omg/proof-gate/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-proof-gate
+description: "Structured release proof gate that binds claims to required evidence artifacts and trace links."
+---
+
+# OMG Proof Gate
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/proof-gate-*.json`

package/artifacts/release/dist/public/bundle/.agents/skills/omg/proof-gate/openai.yaml

@@ -0,0 +1,13 @@
+name: omg-proof-gate
+description: "Structured release proof gate that binds claims to required evidence artifacts and trace links."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: proof-gate
+  title: "OMG Proof Gate"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/artifacts/release/dist/public/bundle/.agents/skills/omg/test-intent-lock/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-test-intent-lock
+description: "Structured test-delta guard that blocks weakened tests unless explicit override evidence is present."
+---
+
+# OMG Test Intent Lock
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/test-intent-lock-*.json`

package/artifacts/release/dist/public/bundle/.agents/skills/omg/test-intent-lock/openai.yaml

@@ -0,0 +1,13 @@
+name: omg-test-intent-lock
+description: "Structured test-delta guard that blocks weakened tests unless explicit override evidence is present."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: test-intent-lock
+  title: "OMG Test Intent Lock"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/artifacts/release/dist/public/bundle/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OMG - Oh-My-God for Claude Code and supported agent hosts",
-    "version": "2.0.5",
+    "version": "2.0.8",
     "homepage": "https://github.com/trac3er00/OMG",
     "repository": "https://github.com/trac3er00/OMG"
   },
@@ -14,7 +14,7 @@
     {
       "name": "omg",
       "description": "OMG plugin layer for Claude Code and supported agent hosts with native setup, orchestration, and interop.",
-      "version": "2.0.5",
+      "version": "2.0.8",
       "source": "./",
       "author": {
         "name": "trac3er00"
@@ -32,5 +32,5 @@
       ]
     }
   ],
-  "version": "2.0.5"
+  "version": "2.0.8"
 }

package/artifacts/release/dist/public/bundle/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg",
-  "version": "2.0.5",
+  "version": "2.0.8",
   "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
   "author": {
     "name": "trac3er00"

package/artifacts/release/dist/public/bundle/.mcp.json

@@ -1,11 +1,5 @@
 {
   "mcpServers": {
-    "context7": {
-      "command": "npx",
-      "args": [
-        "@upstash/context7-mcp@2.1.3"
-      ]
-    },
     "filesystem": {
       "command": "npx",
       "args": [
@@ -13,22 +7,6 @@
         "."
       ]
     },
-    "websearch": {
-      "command": "npx",
-      "args": [
-        "@zhafron/mcp-web-search@1.2.2"
-      ]
-    },
-    "chrome-devtools": {
-      "command": "npx",
-      "args": [
-        "chrome-devtools-mcp@0.19.0"
-      ]
-    },
-    "omg-memory": {
-      "type": "http",
-      "url": "http://127.0.0.1:8765/mcp"
-    },
     "omg-control": {
       "command": "python3",
       "args": [

package/artifacts/release/dist/public/bundle/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.0.5
+version: 2.0.8
 canonical_hosts:
   - claude
   - codex
@@ -11,6 +11,13 @@ status: active
 
 `OMG_COMPAT_CONTRACT.md` is the normative human-readable contract for OMG capability bundles. Machine-readable manifests in `registry/bundles/` are executable inputs and must remain version-locked to this document.
 
+## provider_tiers
+
+OMG distinguishes between canonical hosts and compatibility providers.
+
+- **Canonical Hosts**: `claude` and `codex`. These are the primary targets for bundle compilation, native hook integration, and production-grade state management.
+- **Compatibility Providers**: `gemini` and `kimi`. These are supported via routing providers that emulate host behavior and bridge MCP configurations. They are not targets for direct bundle compilation or normative contract enforcement.
+
 ## metadata
 
 Every bundle must declare `id`, `kind`, `version`, `title`, `description`, `hosts`, and `assets`.

package/artifacts/release/dist/public/bundle/plugins/advanced/commands/OMG:code-review.md

@@ -0,0 +1,114 @@
+---
+description: Deep code review — reads file completely, checks line-by-line for issues, then analyzes whole-file structure. Enforces code hygiene.
+allowed-tools: Read, Bash(cat:*), Bash(grep:*), Bash(wc:*), Bash(head:*), Bash(find:*), Bash(rg:*), Grep, Glob
+argument-hint: "[file path or 'recent' for git-changed files]"
+---
+
+# /OMG:code-review — Line-by-Line + Structural Review
+
+## Philosophy
+Two passes: LINE-BY-LINE precision, then WHOLE-FILE understanding.
+Don't just scan — READ and UNDERSTAND every line.
+
+## Step 1: Determine Scope
+
+- If file specified: review that file
+- If "recent" or no argument: review uncommitted changes
+  ```bash
+  git diff --name-only HEAD 2>/dev/null
+  git diff --cached --name-only 2>/dev/null
+  ```
+
+## Step 2: Read the FULL File First
+
+Read the ENTIRE file. Not just the changed part. Not just a function.
+Understanding comes from seeing the whole context.
+
+Note:
+- What does this file DO? (its purpose in the system)
+- What are its DEPENDENCIES? (imports, calls)
+- What does it EXPORT? (public API)
+
+## Step 3: Line-by-Line Scan
+
+For each line, check:
+
+**Correctness:**
+- Logic errors (off-by-one, null checks, type mismatches)
+- Missing error handling (unhandled promises, bare except, no null check)
+- Race conditions (shared state, async without await, unchecked concurrent access)
+
+**Security (if auth/payment/database):**
+- Hardcoded secrets → CRITICAL
+- SQL injection (string concatenation in queries) → CRITICAL
+- XSS (innerHTML, dangerouslySetInnerHTML) → HIGH
+- Missing input validation → MEDIUM
+- Overly permissive CORS/cookies → MEDIUM
+
+**Hygiene:**
+- Dead code (unused imports, variables, unreachable branches)
+- Noise comments ("increment i", "return result", "constructor")
+- console.log/print left in production code
+- TODO/FIXME/HACK without tracking
+- Overly complex functions (>40 lines → suggest extract)
+- Duplicated logic (same pattern in 2+ places → suggest DRY)
+
+## Step 4: Whole-File Structure Analysis
+
+After line-by-line:
+- Does the file do ONE thing well, or is it a dumping ground?
+- Are functions ordered logically? (public first, helpers after, or lifecycle order)
+- Is naming consistent? (camelCase throughout? PascalCase for classes?)
+- Does it follow the project's domain pattern? (check .omg/knowledge/domain-patterns/)
+- Any circular dependencies?
+- Is error handling consistent across all functions?
+
+## Step 5: Report
+
+```
+Code Review — [file]
+━━━━━━━━━━━━━━━━━━━━
+
+Structure: [CLEAN | NEEDS_WORK | MESSY]
+Security:  [SAFE | REVIEW_NEEDED | CRITICAL]
+Hygiene:   [CLEAN | NEEDS_CLEANUP]
+
+Issues:
+  [line:col] CRITICAL: [description]
+  [line:col] HIGH: [description]
+  [line:col] MEDIUM: [description]
+  [line:col] LOW: [description]
+
+Dead Code:
+  [line] unused import: [name]
+  [line] unreachable after return
+
+Noise Comments (remove these):
+  [line] "// increment counter"
+  [line] "// return the value"
+
+Structural:
+  - [function] is [N] lines — consider extracting [suggestion]
+  - [pattern] duplicated at lines [X] and [Y]
+
+Recommendation: [summary of what to fix, in priority order]
+```
+
+## Step 6: For Security-Critical Files
+
+If the file touches auth, payment, or database:
+```
+/OMG:escalate codex "Line-by-line security review of [file]. Check:
+1. Every input validation point
+2. Every database query for injection
+3. Every auth check for bypass
+4. Every secret reference for hardcoding
+Report: line numbers + severity + fix suggestion"
+```
+
+## Anti-patterns
+- DON'T skim and say "looks good" — read every line
+- DON'T only check the diff — read the full file for context
+- DON'T ignore test files — they can have real issues too
+- DON'T add more noise comments as "fixes" — remove them instead
+- DON'T suggest unnecessary code as improvements