@trac3er/oh-my-god 2.1.4 → 2.1.7

package/.kimi/mcp.json

@@ -7,5 +7,61 @@
         "runtime.omg_mcp_server"
       ]
     }
+  },
+  "_omg": {
+    "_version": "2.1.7",
+    "generated": {
+      "contract_version": "2.1.7",
+      "channel": "public",
+      "required_bundles": [
+        "control-plane",
+        "plan-council",
+        "claim-judge",
+        "test-intent-lock",
+        "proof-gate",
+        "hook-governor",
+        "mcp-fabric",
+        "lsp-pack",
+        "secure-worktree-pipeline",
+        "security-check",
+        "api-twin",
+        "preflight",
+        "robotics",
+        "vision",
+        "algorithms",
+        "health",
+        "tracebank",
+        "eval-gate",
+        "delta-classifier",
+        "incident-replay",
+        "data-lineage",
+        "remote-supervisor"
+      ],
+      "phase1_release_contract": {
+        "forge_specialist_surfaces": [
+          "forge-profile-review",
+          "forge-release-audit",
+          "forge-validate"
+        ],
+        "release_surfaces": [
+          "OMG:profile-review",
+          "OMG:release-audit",
+          "OMG:validate"
+        ],
+        "attestation_requirements": [
+          "registry.verify_artifact.sign_artifact_statement",
+          "registry.verify_artifact.verify_artifact_statement"
+        ],
+        "compliance_governor_expectations": [
+          "runtime.compliance_governor.evaluate_release_compliance",
+          "runtime.compliance_governor.evaluate_tool_compliance"
+        ],
+        "release_readiness_checks": [
+          "claim_judge",
+          "compliance_governor",
+          "execution_primitives"
+        ]
+      }
+    }
   }
 }

package/CHANGELOG.md

@@ -2,12 +2,40 @@
 
 ## Unreleased
 
+## 2.1.7 - 2026-03-11
+
+- fixed `/OMG:deep-plan` 404 by adding missing root compatibility stub routing to canonical plan-council bundle
+- added manifest-driven release readiness gate that audits plugin command source paths against manifests and fails fast on missing files
+- removed hard-coded artifact constant; advanced plugin artifacts now derived dynamically from `plugins/advanced/plugin.json`
+- purged all `2.1.1` version residue from scripts, docs, CI workflows, and tests; tightened identity validation to strict exit-code 0
+- added proof-backed compliance governor as single precedence authority over tool-plan gating, claim-judge verdicts, and artifact trust checks
+- added deterministic forge run contracts with explicit seed derivation and replay validation
+- shipped local-first agentic storage foundation with SQLite/FTS5 full-text search and adjacency-table lineage
+- added HMAC-SHA256 offline signed artifact attestation; release promotion gate now blocks unsigned artifacts
+- added sandboxed Forge runner with explicit time, cost, GPU, and network budget enforcement per run
+- shipped live Axolotl adapter with SFT/GRPO/GDPO modes, bounded hyperparameter search, and LoRA double-stacking guards
+- added live simulator backends for PyBullet, Gazebo, and Isaac Gym with CPU-only mock for CI environments
+- replaced simulated Forge pipeline outcomes with live evidence; `simulated_metric` fully removed as success criterion
+- added buffet preset as canonical configuration with single source of truth across setup, runtime, and config; includes `NOTEBOOKLM` and `COUNCIL_ROUTING` flags
+- added bounded session health auto-actions (pause, reflect, warn, require-review) with explicit evidence persistence
+- extended host-parity compiler with claim-judge and compliance governor in release audit; Gemini and Kimi added as canonical hosts
+- expanded 5 evidence profiles (browser-flow, forge-cybersecurity, interop-diagnosis, install-validation, buffet) with concrete non-placeholder data
+
+## 2.1.5 - 2026-03-09
+
+- shipped Forge v0.3 as the flagship feature
+- added adapter contract layer (axolotl, pybullet, gazebo, isaac_gym)
+- expanded domain-pack coverage for all 5 domains (vision, robotics, algorithms, health, cybersecurity)
+- introduced domain-specific CLI commands
+- delivered release-grade evidence bundles with artifact contracts
+- normalized run identity and domain registry
+
 ## 2.1.4 - 2026-03-09
 
 - bump authored release identity to 2.1.4 across all 42 authored surfaces
 - refresh compat contract snapshot
 
-## 2.1.1 - 2026-03-08
+## [historical] 2.1.x - 2026-03-08
 
 - shipped strict TDD-or-die enforcement: locked-tests-first mutation lifecycle with hard gate via `OMG_TDD_GATE_STRICT`, stop-dispatcher lock enforcement, waiver evidence requirement, and release-blocking proof chain
 - delivered granular per-interaction undo/rollback: `restore_shadow_entry` in shadow manager, rollback manifest schema with compensating actions for reversible external side effects, and `omg undo` CLI wired end-to-end

package/CLI-ADAPTER-MAP.md

@@ -162,7 +162,7 @@ OMG supports 4 canonical CLI targets with dedicated provider implementations and
   - `~/.claude/settings.json` → `enabledPlugins[plugin_ref] = true`
   - `~/.claude/plugins/installed_plugins.json` → Plugin metadata with installed path, version, timestamp
 - **Plugin Ref Format:** `omg@omg` (name@marketplace_id)
-- **Version:** `2.1.4` (from package.json)
+- **Version:** `2.1.7` (from package.json)
 
 #### C. Plugin Unregistration (Lines 631-669)
 - **Function:** `unregister_plugin_from_registry(plugin_ref)`
@@ -206,7 +206,7 @@ OMG supports 4 canonical CLI targets with dedicated provider implementations and
 ```json
 {
   "name": "@trac3er/oh-my-god",
-  "version": "2.1.4",
+  "version": "2.1.7",
   "scripts": {
     "postinstall": "./OMG-setup.sh install --non-interactive",
     "update": "./OMG-setup.sh update",
@@ -238,7 +238,7 @@ CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.1.4"
+CANONICAL_VERSION = "2.1.7"
 ```
 
 ---

package/OMG-setup.sh

@@ -5,7 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 BACKUP_TS="$(date +%Y%m%d_%H%M%S)"
 BACKUP_DIR="$CLAUDE_DIR/.omg-backup-$BACKUP_TS"
-VERSION="2.1.4"
+VERSION="2.1.7"
 
 PLUGIN_NAME="omg"
 PLUGIN_MARKETPLACE="omg"

package/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.1.4
+version: 2.1.7
 canonical_hosts:
   - claude
   - codex

package/README.md

@@ -6,6 +6,61 @@
 
 OMG upgrades your agent host instead of replacing it. It gives Claude Code, Codex, and other supported CLIs a tighter setup flow, stronger orchestration, native adoption from older plugin stacks, and proof-backed verification.
 
+## The Problem
+
+Agent hosts like Claude Code and Codex are powerful but lack governance, mutation safety, and evidence-backed verification. They often operate in a "trust me" mode where changes happen without a clear audit trail or safety gates. This leads to risky mutations, lack of interoperability between different agent stacks, and difficulty in verifying that a task was actually completed correctly.
+
+## The Solution
+
+OMG (Oh My OpenCode) provides a governance and orchestration layer that sits on top of existing agent hosts. It introduces:
+
+- **Hooks**: Pre-tool and post-tool execution gates for security and validation.
+- **Governance Payload**: Structured metadata for every action.
+- **Mutation Gate**: Prevents or warns about risky file system changes.
+- **Session Health**: Monitors the state of the session and requires review for risky states.
+- **Forge**: A modular orchestration engine for complex tasks.
+- **Memory**: A secure, namespaced, and encrypted state store.
+- **Evidence-Backed Verification**: Machine-generated proof for every claim.
+
+## Real-World Example
+
+Imagine an agent trying to delete a critical configuration file. Without OMG, the agent might just do it. With OMG's **Mutation Gate**, the action is intercepted, a warning is generated, and the user is prompted for approval. Or, when an agent claims a feature is "done", OMG's **Claim Judge** and **Proof Gate** require actual test results and build logs as evidence before the claim is accepted.
+
+## Architecture
+
+OMG operates as a middleware layer between the agent host and the underlying tools.
+
+```mermaid
+graph TD
+    Host[Agent Host: Claude Code / Codex] -->|Tool Call| Hooks[OMG Hooks]
+    Hooks -->|Security Check| Security[Security Guard / Firewall]
+    Hooks -->|Governance| ControlPlane[OMG Control Plane]
+    ControlPlane -->|State| Memory[OMG Memory]
+    ControlPlane -->|Verification| Proof[Proof Gate / Claim Judge]
+    ControlPlane -->|Orchestration| Forge[OMG Forge]
+    Hooks -->|Execution| Tool[Actual Tool Execution]
+    Tool -->|Result| Hooks
+    Hooks -->|Evidence| Proof
+```
+
+## Comparison
+
+| Feature | Raw Claude Code | Superpowers | OMG |
+| :--- | :---: | :---: | :---: |
+| **Governance** | Minimal | Plugin-based | Native Control Plane |
+| **Mutation Safety** | Basic | None | Hard Gates + Warnings |
+| **Verification** | Manual | None | Evidence-Backed Proof |
+| **Interoperability** | Single Host | Multi-Host | Universal MCP + Registry |
+| **State Management** | Volatile | Local Files | Encrypted + Namespaced |
+| **Orchestration** | Linear | Scripted | Modular Forge |
+
+## Limitations
+
+- **Not a Base Model**: OMG does not train or provide its own LLMs; it orchestrates existing ones.
+- **Local-Only**: Designed for same-machine production; no cloud-sync for state by design.
+- **Advisory-First**: In v1, many gates are advisory (warnings) rather than hard-blocking to avoid breaking workflows.
+- **Host Dependent**: Capabilities are limited by what the underlying agent host supports.
+
 - Brand: `OMG`
 - Repo: `https://github.com/trac3er00/OMG`
 - npm: `@trac3er/oh-my-god`
@@ -111,6 +166,7 @@ Compatibility references to OMC, OMX, and Superpowers are documented here: [docs
 Current local verification for this release: See `.omg/evidence/` for machine-generated verification artifacts.
 
 - Truth bundles: `claim-judge`, `test-intent-lock`, `proof-gate`
+- Evidence profiles: `browser-flow`, `forge-cybersecurity`, `interop-diagnosis`, `install-validation`, `buffet`
 - Verification and provider matrix: [docs/proof.md](docs/proof.md)
 - Sample setup transcript: [docs/transcripts/setup.md](docs/transcripts/setup.md)
 - Sample crazy transcript: [docs/transcripts/crazy.md](docs/transcripts/crazy.md)

package/artifacts/release/.agents/skills/omg/AGENTS.fragment.md

@@ -17,10 +17,25 @@ The following paths require tier-gated review before mutation:
 - `.codex/**`
 - `.claude/**`
 
+## Release Audit
+
+Release readiness requires claim and compliance outcomes:
+
+- `claim_judge`
+- `compliance_governor`
+- `execution_primitives`
+Attestation requirements:
+- `registry.verify_artifact.sign_artifact_statement`
+- `registry.verify_artifact.verify_artifact_statement`
+
 ## Evidence Contract
 
 Every production action must emit evidence containing these fields:
 
+- `attestation_statement`
+- `attestation_verifier`
+- `claim_judge_verdict`
+- `compliance_verdict`
 - `executor`
 - `lineage`
 - `timestamp`

package/artifacts/release/.agents/skills/omg/control-plane/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: omg-control-plane
-description: "Canonical production control plane bundle for Claude and Codex."
+description: "Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi."
 ---
 
 # OMG Control Plane

package/artifacts/release/.agents/skills/omg/control-plane/openai.yaml

@@ -1,5 +1,5 @@
 name: omg-control-plane
-description: "Canonical production control plane bundle for Claude and Codex."
+description: "Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi."
 allow_implicit_invocation: false
 metadata:
   channel: enterprise

package/artifacts/release/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OMG - Oh-My-God for Claude Code and supported agent hosts",
-    "version": "2.1.4",
+    "version": "2.1.7",
     "homepage": "https://github.com/trac3er00/OMG",
     "repository": "https://github.com/trac3er00/OMG"
   },
@@ -14,7 +14,7 @@
     {
       "name": "omg",
       "description": "OMG plugin layer for Claude Code and supported agent hosts with native setup, orchestration, and interop.",
-      "version": "2.1.4",
+      "version": "2.1.7",
       "source": "./",
       "author": {
         "name": "trac3er00"
@@ -32,5 +32,5 @@
       ]
     }
   ],
-  "version": "2.1.4"
+  "version": "2.1.7"
 }

package/artifacts/release/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg",
-  "version": "2.1.4",
+  "version": "2.1.7",
   "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
   "author": {
     "name": "trac3er00"

package/artifacts/release/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.1.4
+version: 2.1.7
 canonical_hosts:
   - claude
   - codex

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/AGENTS.fragment.md.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+81Vm7DjjC4dt6ljx0IYG61FmkQ9MaVzcdJywTOmdoO0InAVkOzg4COya+2BzYCJfpv3pIBpJ5DfQ/ktDfNOIDg==
+trusted comment: type=omg-slsa-v1 keyid=2641892c2a7be6d7 issued_at=2026-03-11T19:41:24.705880+00:00 artifact=bundle/.agents/skills/omg/AGENTS.fragment.md sha256=2cf0340fbea7f8f39660ed6e6f7bd0fc3df6e210302c3328915e871b0ac8606d
+cEJcndx8faPrn1yLJ6R9JJxQtvrEIgTmgvGjQqkAjOO81OXp/I7WsGd15K2XOdhI+a8sEgkqAcXs3NvaJJczBw==

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/AGENTS.fragment.md.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/.agents/skills/omg/AGENTS.fragment.md",
+      "digest": {
+        "sha256": "2cf0340fbea7f8f39660ed6e6f7bd0fc3df6e210302c3328915e871b0ac8606d"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.701856+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.701856+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "2641892c2a7be6d7",
+    "value": "untrusted comment: signature from omg local signing key\n81Vm7DjjC4dt6ljx0IYG61FmkQ9MaVzcdJywTOmdoO0InAVkOzg4COya+2BzYCJfpv3pIBpJ5DfQ/ktDfNOIDg==\ntrusted comment: type=omg-slsa-v1 keyid=2641892c2a7be6d7 issued_at=2026-03-11T19:41:24.705880+00:00 artifact=bundle/.agents/skills/omg/AGENTS.fragment.md sha256=2cf0340fbea7f8f39660ed6e6f7bd0fc3df6e210302c3328915e871b0ac8606d\ncEJcndx8faPrn1yLJ6R9JJxQtvrEIgTmgvGjQqkAjOO81OXp/I7WsGd15K2XOdhI+a8sEgkqAcXs3NvaJJczBw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=2641892c2a7be6d7 issued_at=2026-03-11T19:41:24.705880+00:00 artifact=bundle/.agents/skills/omg/AGENTS.fragment.md sha256=2cf0340fbea7f8f39660ed6e6f7bd0fc3df6e210302c3328915e871b0ac8606d"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/algorithms/SKILL.md.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+fc7a/8KdbG60xRzT5tZNQbZgZDKtBNz7woOlrS6aSNn4ynkw7jT438gE6njQ9ULEgYjwSur2vWwHDj3ZdjanCA==
+trusted comment: type=omg-slsa-v1 keyid=8ed12d85c5d11726 issued_at=2026-03-11T19:41:24.707124+00:00 artifact=bundle/.agents/skills/omg/algorithms/SKILL.md sha256=9f007935886f168e43cd76b69857e81c579f9cce8174e14f9b6b0173739c337d
+Lyz6wQ8wonzdzS2GDD4ejHUCGJk+iZaTmOAFbrZhkAySZb8SCyCLb4gIZX+/BopcZNciSsYA1ighREgPzUjQAw==

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/algorithms/SKILL.md.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/.agents/skills/omg/algorithms/SKILL.md",
+      "digest": {
+        "sha256": "9f007935886f168e43cd76b69857e81c579f9cce8174e14f9b6b0173739c337d"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.706980+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.706980+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "8ed12d85c5d11726",
+    "value": "untrusted comment: signature from omg local signing key\nfc7a/8KdbG60xRzT5tZNQbZgZDKtBNz7woOlrS6aSNn4ynkw7jT438gE6njQ9ULEgYjwSur2vWwHDj3ZdjanCA==\ntrusted comment: type=omg-slsa-v1 keyid=8ed12d85c5d11726 issued_at=2026-03-11T19:41:24.707124+00:00 artifact=bundle/.agents/skills/omg/algorithms/SKILL.md sha256=9f007935886f168e43cd76b69857e81c579f9cce8174e14f9b6b0173739c337d\nLyz6wQ8wonzdzS2GDD4ejHUCGJk+iZaTmOAFbrZhkAySZb8SCyCLb4gIZX+/BopcZNciSsYA1ighREgPzUjQAw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=8ed12d85c5d11726 issued_at=2026-03-11T19:41:24.707124+00:00 artifact=bundle/.agents/skills/omg/algorithms/SKILL.md sha256=9f007935886f168e43cd76b69857e81c579f9cce8174e14f9b6b0173739c337d"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/algorithms/openai.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+bu+GwbvNn1PLOiu2UwdJ1Ez/z8zLQ2ZlRdOp9z2sxwNtGWXijQOXZzQOfsicbybPbI4QDXWCkdzOyyc1yQvEBQ==
+trusted comment: type=omg-slsa-v1 keyid=864c06e1f789c52a issued_at=2026-03-11T19:41:24.707866+00:00 artifact=bundle/.agents/skills/omg/algorithms/openai.yaml sha256=879d3b5bcdb3ffa17387eae31634bd5ce7e2695c0e6dd3b478017843a024300d
+F5KFOB/aJ8g41rnsF0J5g6lXGwG5n4HqgzE7Z4VxXg2rF41pBEuiweczSLu45tqW63ZXsytMCxcWkoU+xExaCQ==

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/algorithms/openai.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/.agents/skills/omg/algorithms/openai.yaml",
+      "digest": {
+        "sha256": "879d3b5bcdb3ffa17387eae31634bd5ce7e2695c0e6dd3b478017843a024300d"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.707745+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.707745+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "864c06e1f789c52a",
+    "value": "untrusted comment: signature from omg local signing key\nbu+GwbvNn1PLOiu2UwdJ1Ez/z8zLQ2ZlRdOp9z2sxwNtGWXijQOXZzQOfsicbybPbI4QDXWCkdzOyyc1yQvEBQ==\ntrusted comment: type=omg-slsa-v1 keyid=864c06e1f789c52a issued_at=2026-03-11T19:41:24.707866+00:00 artifact=bundle/.agents/skills/omg/algorithms/openai.yaml sha256=879d3b5bcdb3ffa17387eae31634bd5ce7e2695c0e6dd3b478017843a024300d\nF5KFOB/aJ8g41rnsF0J5g6lXGwG5n4HqgzE7Z4VxXg2rF41pBEuiweczSLu45tqW63ZXsytMCxcWkoU+xExaCQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=864c06e1f789c52a issued_at=2026-03-11T19:41:24.707866+00:00 artifact=bundle/.agents/skills/omg/algorithms/openai.yaml sha256=879d3b5bcdb3ffa17387eae31634bd5ce7e2695c0e6dd3b478017843a024300d"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/api-twin/SKILL.md.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+UW73pG8Jp3RlaqCmBkaq06xKETeVeVJRqMw7J9MB3dl6zdM4R0r5vNCLBBnNqYpWiM4kCjySZB44VT2zu4ADAQ==
+trusted comment: type=omg-slsa-v1 keyid=4390911e5e2528d7 issued_at=2026-03-11T19:41:24.708555+00:00 artifact=bundle/.agents/skills/omg/api-twin/SKILL.md sha256=482db7bf01f80d8695f71f3bdbae8e9a179cf05355e736f90c40c1a3c9136fef
++kcZwykSZkGZrnnCFU/Tv6Ka+qTmC1GgbHUjOrAUUQZUyuOY0Hs1ujpbQY1dvLSS168fdi5G90HTHCFWe534DA==

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/api-twin/SKILL.md.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/.agents/skills/omg/api-twin/SKILL.md",
+      "digest": {
+        "sha256": "482db7bf01f80d8695f71f3bdbae8e9a179cf05355e736f90c40c1a3c9136fef"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.708438+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.708438+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "4390911e5e2528d7",
+    "value": "untrusted comment: signature from omg local signing key\nUW73pG8Jp3RlaqCmBkaq06xKETeVeVJRqMw7J9MB3dl6zdM4R0r5vNCLBBnNqYpWiM4kCjySZB44VT2zu4ADAQ==\ntrusted comment: type=omg-slsa-v1 keyid=4390911e5e2528d7 issued_at=2026-03-11T19:41:24.708555+00:00 artifact=bundle/.agents/skills/omg/api-twin/SKILL.md sha256=482db7bf01f80d8695f71f3bdbae8e9a179cf05355e736f90c40c1a3c9136fef\n+kcZwykSZkGZrnnCFU/Tv6Ka+qTmC1GgbHUjOrAUUQZUyuOY0Hs1ujpbQY1dvLSS168fdi5G90HTHCFWe534DA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=4390911e5e2528d7 issued_at=2026-03-11T19:41:24.708555+00:00 artifact=bundle/.agents/skills/omg/api-twin/SKILL.md sha256=482db7bf01f80d8695f71f3bdbae8e9a179cf05355e736f90c40c1a3c9136fef"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/api-twin/openai.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+k9qg7UtR74DWYM8WkBENjND8jWgecn423HndL6PfEq08ELoMcZ6tEFGB9e79yMosJBKgeCRphIuKF2CVaBkgAw==
+trusted comment: type=omg-slsa-v1 keyid=2202b76424e5ba82 issued_at=2026-03-11T19:41:24.709193+00:00 artifact=bundle/.agents/skills/omg/api-twin/openai.yaml sha256=a6caee113518bda5e2a470ca7d166d18969392bde1470ef2a47f8ead2c0e33ab
+BK0uCr2pFEI2ZZProTAic8Jjzv+y2DJt6LvNvF6xxhG3IwoRtYgsClaFYddxMkxWK5t+jk/pg6njABFWan7qBg==

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/api-twin/openai.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/.agents/skills/omg/api-twin/openai.yaml",
+      "digest": {
+        "sha256": "a6caee113518bda5e2a470ca7d166d18969392bde1470ef2a47f8ead2c0e33ab"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.709079+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.709079+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "2202b76424e5ba82",
+    "value": "untrusted comment: signature from omg local signing key\nk9qg7UtR74DWYM8WkBENjND8jWgecn423HndL6PfEq08ELoMcZ6tEFGB9e79yMosJBKgeCRphIuKF2CVaBkgAw==\ntrusted comment: type=omg-slsa-v1 keyid=2202b76424e5ba82 issued_at=2026-03-11T19:41:24.709193+00:00 artifact=bundle/.agents/skills/omg/api-twin/openai.yaml sha256=a6caee113518bda5e2a470ca7d166d18969392bde1470ef2a47f8ead2c0e33ab\nBK0uCr2pFEI2ZZProTAic8Jjzv+y2DJt6LvNvF6xxhG3IwoRtYgsClaFYddxMkxWK5t+jk/pg6njABFWan7qBg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=2202b76424e5ba82 issued_at=2026-03-11T19:41:24.709193+00:00 artifact=bundle/.agents/skills/omg/api-twin/openai.yaml sha256=a6caee113518bda5e2a470ca7d166d18969392bde1470ef2a47f8ead2c0e33ab"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/claim-judge/SKILL.md.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+7ZDsr07e/wHj28AxYmlpCypqJRs8lx/ruNA+H28RUxbLbBKTsFTeKyOn/zwOcL284ZgURKu2ufBNN5G4HTFlAQ==
+trusted comment: type=omg-slsa-v1 keyid=d5cac3a775bbea06 issued_at=2026-03-11T19:41:24.710077+00:00 artifact=bundle/.agents/skills/omg/claim-judge/SKILL.md sha256=12ad7141a9441a3b616b4516d58a5faf6ebb28ed0cece35f5bfda109f0aa0bb0
+O3i7rNtfpOO1+Xq6N36kAl4cnvICgiZ/KgpRmtqbhtNG5p5eNdlYVHUou2VY9aa5I3ELZpQ50GCnXrTFk358Cg==

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/claim-judge/SKILL.md.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/.agents/skills/omg/claim-judge/SKILL.md",
+      "digest": {
+        "sha256": "12ad7141a9441a3b616b4516d58a5faf6ebb28ed0cece35f5bfda109f0aa0bb0"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.709899+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.709899+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "d5cac3a775bbea06",
+    "value": "untrusted comment: signature from omg local signing key\n7ZDsr07e/wHj28AxYmlpCypqJRs8lx/ruNA+H28RUxbLbBKTsFTeKyOn/zwOcL284ZgURKu2ufBNN5G4HTFlAQ==\ntrusted comment: type=omg-slsa-v1 keyid=d5cac3a775bbea06 issued_at=2026-03-11T19:41:24.710077+00:00 artifact=bundle/.agents/skills/omg/claim-judge/SKILL.md sha256=12ad7141a9441a3b616b4516d58a5faf6ebb28ed0cece35f5bfda109f0aa0bb0\nO3i7rNtfpOO1+Xq6N36kAl4cnvICgiZ/KgpRmtqbhtNG5p5eNdlYVHUou2VY9aa5I3ELZpQ50GCnXrTFk358Cg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=d5cac3a775bbea06 issued_at=2026-03-11T19:41:24.710077+00:00 artifact=bundle/.agents/skills/omg/claim-judge/SKILL.md sha256=12ad7141a9441a3b616b4516d58a5faf6ebb28ed0cece35f5bfda109f0aa0bb0"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/claim-judge/openai.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+Gb0nOwaZmEbAAib8W3hiDR5c8a1msTYu4iLnBJ0OKExjASTbLrcLYOKTZwtvVUc/oKAfcz/n8ds9WyFKCrdaCA==
+trusted comment: type=omg-slsa-v1 keyid=cd409cd16f54d485 issued_at=2026-03-11T19:41:24.711291+00:00 artifact=bundle/.agents/skills/omg/claim-judge/openai.yaml sha256=39285cf57979ddfa917972719d2dfa32c2333f4f7a712a970a5b78c759e04295
+5Vyr6BqWukYEYFd+oEmFb1FBPifmcvet1VAJPSDjhAg//MaistGIatDE5u5WxAaDmR6R9dIhw+CpfOZIXyDECg==

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/claim-judge/openai.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/.agents/skills/omg/claim-judge/openai.yaml",
+      "digest": {
+        "sha256": "39285cf57979ddfa917972719d2dfa32c2333f4f7a712a970a5b78c759e04295"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.711159+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.711159+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "cd409cd16f54d485",
+    "value": "untrusted comment: signature from omg local signing key\nGb0nOwaZmEbAAib8W3hiDR5c8a1msTYu4iLnBJ0OKExjASTbLrcLYOKTZwtvVUc/oKAfcz/n8ds9WyFKCrdaCA==\ntrusted comment: type=omg-slsa-v1 keyid=cd409cd16f54d485 issued_at=2026-03-11T19:41:24.711291+00:00 artifact=bundle/.agents/skills/omg/claim-judge/openai.yaml sha256=39285cf57979ddfa917972719d2dfa32c2333f4f7a712a970a5b78c759e04295\n5Vyr6BqWukYEYFd+oEmFb1FBPifmcvet1VAJPSDjhAg//MaistGIatDE5u5WxAaDmR6R9dIhw+CpfOZIXyDECg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=cd409cd16f54d485 issued_at=2026-03-11T19:41:24.711291+00:00 artifact=bundle/.agents/skills/omg/claim-judge/openai.yaml sha256=39285cf57979ddfa917972719d2dfa32c2333f4f7a712a970a5b78c759e04295"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/codex-mcp.toml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+FnsfBmtcXtmQoB5JTKzG9oT87fS8fJDRBPP1aRaazXhB7VaP5jgX9/87Ry+tCG0CxfyaCptXH/zyW+D8uacBDA==
+trusted comment: type=omg-slsa-v1 keyid=9cdebf48ac275afd issued_at=2026-03-11T19:41:24.712013+00:00 artifact=bundle/.agents/skills/omg/codex-mcp.toml sha256=a56de208a369a2b318d2e66e150eef4cba1fac1ecf32bda6db1a1e4b65db7311
++OwI28bHuEM7RS/cwdD+/IezHTy6C018i4rR3QxRdT9mb6BX0XxoQwA8u7W48wmAOz/TGRxlmGSYYtTW+JaXBA==