@trac3er/oh-my-god 2.1.4 → 2.1.7

package/build/lib/runtime/validate.py

@@ -7,12 +7,14 @@ governor, install integrity) rather than duplicating their logic.
 from __future__ import annotations
 
 import os
+import shutil
 from pathlib import Path
 from typing import Any
 
 from runtime.adoption import CANONICAL_VERSION
 from runtime.compat import run_doctor, _doctor_check
 from runtime.contract_compiler import validate_contract_registry
+from runtime.plugin_diagnostics import run_plugin_diagnostics
 from runtime.profile_io import load_profile, ensure_governed_preferences
 
 
@@ -134,6 +136,91 @@ def _check_install_integrity(root_dir: Path) -> dict[str, Any]:
     )
 
 
+def _check_plugin_compatibility(root_dir: Path) -> dict[str, Any]:
+    try:
+        result = run_plugin_diagnostics(str(root_dir))
+    except Exception as exc:
+        return _doctor_check(
+            "plugin_compatibility",
+            ok=False,
+            message=f"plugin diagnostics error: {exc}",
+        )
+
+    status = str(result.get("status", "error"))
+    summary = result.get("summary", {})
+    summary = summary if isinstance(summary, dict) else {}
+    total_records = int(summary.get("total_records", 0))
+    total_conflicts = int(summary.get("total_conflicts", 0))
+    blockers = int(summary.get("blockers", 0))
+
+    return _doctor_check(
+        "plugin_compatibility",
+        ok=status in {"ok", "warn"},
+        message=(
+            f"plugin compatibility: {total_records} records, "
+            f"{total_conflicts} conflicts, {blockers} blockers"
+        ),
+    )
+
+
+def _load_selected_mcps(root_dir: Path) -> list[str]:
+    """Load selected MCP IDs from cli-config.yaml.
+
+    Checks CLAUDE_PROJECT_DIR env first, then falls back to root_dir.
+    Returns an empty list when the config file is absent or unparseable.
+    """
+    import yaml as _yaml
+
+    project_dir = os.environ.get("CLAUDE_PROJECT_DIR", "")
+    if project_dir:
+        config_path = os.path.join(project_dir, ".omg", "state", "cli-config.yaml")
+    else:
+        config_path = os.path.join(root_dir, ".omg", "state", "cli-config.yaml")
+
+    if not os.path.isfile(config_path):
+        return []
+
+    try:
+        with open(config_path, "r", encoding="utf-8") as f:
+            data = _yaml.safe_load(f)
+    except Exception:
+        return []
+
+    if not isinstance(data, dict):
+        return []
+
+    mcps = data.get("selected_mcps", [])
+    return [str(m) for m in mcps] if isinstance(mcps, list) else []
+
+
+def _check_notebooklm(root_dir: Path) -> dict[str, Any] | None:
+    """Optional NotebookLM health check — only runs when notebooklm is selected.
+
+    Returns None when NotebookLM is not in the selected MCP set (meaning:
+    skip entirely, no check emitted).  When selected, checks that ``npx``
+    is reachable on PATH.  Missing npx is a *warning*, never a blocker.
+    """
+    selected = _load_selected_mcps(root_dir)
+    if "notebooklm" not in selected:
+        return None
+
+    npx_path = shutil.which("npx")
+    if npx_path is None:
+        return _doctor_check(
+            "notebooklm",
+            ok=False,
+            message="npx not found — install Node.js to use NotebookLM",
+            required=False,
+        )
+
+    return _doctor_check(
+        "notebooklm",
+        ok=True,
+        message="npx available, notebooklm-mcp callable",
+        required=False,
+    )
+
+
 def run_validate(*, root_dir: Path | None = None) -> dict[str, Any]:
     """Run all validation checks and return a structured result.
 
@@ -142,6 +229,7 @@ def run_validate(*, root_dir: Path | None = None) -> dict[str, Any]:
     2. Contract registry validation
     3. Profile governor validation
     4. Install integrity check
+    5. Optional NotebookLM check (only when selected in MCP config)
 
     Returns a dict matching the ``ValidateResult`` schema:
     ``{"schema": "ValidateResult", "status": "pass"|"fail", "checks": [...], "version": "..."}``
@@ -163,6 +251,13 @@ def run_validate(*, root_dir: Path | None = None) -> dict[str, Any]:
     # 4. Install integrity
     checks.append(_check_install_integrity(repo_root))
 
+    if not any(c.get("name") == "plugin_compatibility" for c in checks):
+        checks.append(_check_plugin_compatibility(repo_root))
+
+    nb_check = _check_notebooklm(repo_root)
+    if nb_check is not None:
+        checks.append(nb_check)
+
     has_blocker = any(c["status"] == "blocker" for c in checks)
 
     return {

package/commands/OMG:deep-plan.md

@@ -0,0 +1,18 @@
+---
+description: "Strategic planning via the canonical plan-council bundle."
+allowed-tools: Read, Grep, Glob
+argument-hint: "<planning goal or feature to plan>"
+---
+
+# /OMG:deep-plan
+
+`/OMG:deep-plan` is a compatibility path to the canonical `plan-council` bundle.
+
+Users invoke `/OMG:deep-plan`; the runtime routes to `plan-council` for execution.
+For the full behavior specification, see `plugins/advanced/commands/OMG:deep-plan.md`.
+
+## Compatibility Notes
+
+- This alias exists so users can invoke deep-plan workflows from the root command surface.
+- Runtime behavior resolves to the `plan-council` bundle — same structured deliberation, same artifacts.
+- OMG uses the `plan-council` bundle for canonical planning, dissent, and evidence workflows.

package/commands/OMG:forge.md

@@ -31,19 +31,25 @@ Jobs that fail policy checks are blocked with a structured reason before any pip
 ## CLI Usage
 
 ```bash
-# Run a forge job from a JSON file
+# Run a forge job from a JSON file (domain required)
 python3 scripts/omg.py forge run --job path/to/job.json
 
 # Run with explicit preset (default: labs)
 python3 scripts/omg.py forge run --job path/to/job.json --preset labs
+
+# Run inline with domain-aware job JSON
+python3 scripts/omg.py forge run --preset labs --job-json '{"domain":"vision","dataset":{"name":"vision-agent","license":"apache-2.0","source":"internal-curated"},"base_model":{"name":"distill-base-v1","source":"approved-registry","allow_distill":true},"target_metric":0.8,"simulated_metric":0.9,"specialists":["data-curator","training-architect","simulator-engineer"]}'
 ```
 
 ## Job File Format
 
+Every forge job **must** include an explicit `domain` field. Valid canonical domains: `vision`, `robotics`, `algorithms`, `health`, `cybersecurity`. The alias `vision-agent` is accepted and canonicalized to `vision`.
+
 ```json
 {
+  "domain": "vision",
   "dataset": {
-    "name": "my-domain-dataset",
+    "name": "vision-agent",
     "license": "apache-2.0",
     "source": "internal-curated"
   },
@@ -54,13 +60,14 @@ python3 scripts/omg.py forge run --job path/to/job.json --preset labs
   },
   "target_metric": 0.85,
   "simulated_metric": 0.90,
-  "evaluation_notes": "Domain adaptation for robotics control"
+  "specialists": ["data-curator", "training-architect", "simulator-engineer"],
+  "evaluation_notes": "Domain adaptation for vision agent"
 }
 ```
 
 ## Output
 
-Forge returns structured JSON with pipeline results:
+Forge returns structured JSON with pipeline results. Domain-aware jobs with specialists also include a `specialist_dispatch` block:
 
 ```json
 {
@@ -78,6 +85,10 @@ Forge returns structured JSON with pipeline results:
     "metric": 0.90,
     "target_metric": 0.85,
     "passed": true
+  },
+  "specialist_dispatch": {
+    "status": "ok",
+    "specialists_dispatched": ["data-curator", "training-architect", "simulator-engineer"]
   }
 }
 ```

package/commands/OMG:profile-review.md

@@ -34,6 +34,20 @@ python3 scripts/omg.py profile-review [--format json|text]
 }
 ```
 
+## Auto-action routing
+
+Session health auto-actions may route to this command when governed profile
+state becomes risky. When `evaluate_auto_actions()` in `runtime/session_health.py`
+returns `require-review`, the agent is directed here to inspect risk before
+proceeding. This command remains strictly read-only — it never mutates
+`profile.yaml` or applies autonomous fixes.
+
+Bounded auto-actions that may trigger this route:
+
+- **pause** — session blocked due to high contamination or overthinking; destructive preferences escalate to require-review
+- **require-review** — profile risk detected (destructive preferences or pending confirmations)
+- **warn** — verification errors combined with profile risk
+
 ## Report sections
 
 1. **Style preferences** — governed style entries with source, learned_at, decay metadata
@@ -41,3 +55,4 @@ python3 scripts/omg.py profile-review [--format json|text]
 3. **Pending confirmations** — entries marked `pending_confirmation` (destructive signals awaiting user approval)
 4. **Decay candidates** — style entries with `decay_score > 0` that may be stale
 5. **Provenance summary** — recent profile update events from `profile_provenance.recent_updates`
+6. **Risk assessment** — overall risk level, destructive entries, and review requirement

package/commands/OMG:validate.md

@@ -36,7 +36,7 @@ python3 scripts/omg.py validate --format json
       "required": true | false
     }
   ],
-  "version": "2.1.4"
+  "version": "2.1.7"
 }
 ```
 

package/control_plane/service.py

@@ -208,7 +208,7 @@ class ControlPlaneService:
                 "message": "artifact must be an object",
             }
         decision = verify_artifact(artifact, mode=mode)
-        return 200, decision
+        return (403 if decision.get("action") == "deny" else 200), decision
 
     def lab_jobs(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
         if not isinstance(payload, dict):

package/dist/.agents/skills/omg/AGENTS.fragment.md

@@ -0,0 +1,73 @@
+# OMG Codex Governance (channel: public)
+
+## Build & Test
+
+```bash
+python3 -m pytest tests -q
+python3 scripts/omg.py contract validate
+python3 scripts/omg.py contract compile --host codex --channel public
+```
+
+## Protected Paths
+
+The following paths require tier-gated review before mutation:
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Release Audit
+
+Release readiness requires claim and compliance outcomes:
+
+- `claim_judge`
+- `compliance_governor`
+- `execution_primitives`
+Attestation requirements:
+- `registry.verify_artifact.sign_artifact_statement`
+- `registry.verify_artifact.verify_artifact_statement`
+
+## Evidence Contract
+
+Every production action must emit evidence containing these fields:
+
+- `attestation_statement`
+- `attestation_verifier`
+- `claim_judge_verdict`
+- `compliance_verdict`
+- `executor`
+- `lineage`
+- `timestamp`
+- `trace_id`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Protected Planning Surface
+
+Council planning skills are protected and explicit-invocation only:
+
+- `omg/plan-council`
+
+## Web Search Policy
+
+- Prefer cached results over live network requests.
+- Do NOT initiate live web searches unless explicitly instructed.
+- Use `context7` or local documentation before external lookups.
+- Set `cached_web_search: prefer_cached` as the default.
+
+## Approval Constraints
+
+- Destructive file operations require explicit user approval.
+- `git push --force` and branch deletions require explicit approval.
+- Production deployments require explicit approval.
+- Mutations to protected paths require tier-gated approval.
+
+## Rules & Automations
+
+- Rules: `protected_paths, explicit_invocation`
+- Automations: `contract-compile, release-readiness`
+- Require explicit invocation for protected production planning skills.

package/dist/.agents/skills/omg/algorithms/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-algorithms
+description: "Determinism and benchmark attachments for algorithm-heavy work."
+---
+
+# OMG Algorithms Pack
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evals/latest.json`

package/dist/.agents/skills/omg/algorithms/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-algorithms
+description: "Determinism and benchmark attachments for algorithm-heavy work."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: algorithms
+  title: "OMG Algorithms Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/dist/.agents/skills/omg/api-twin/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-api-twin
+description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
+---
+
+# OMG API Twin
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/state/api_twin.json`

package/dist/.agents/skills/omg/api-twin/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-api-twin
+description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: api-twin
+  title: "OMG API Twin"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/.agents/skills/omg/claim-judge/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-claim-judge
+description: "Evidence-backed claim validator for structured release and completion claims."
+---
+
+# OMG Claim Judge
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/claim-judge-*.json`

package/dist/.agents/skills/omg/claim-judge/openai.yaml

@@ -0,0 +1,13 @@
+name: omg-claim-judge
+description: "Evidence-backed claim validator for structured release and completion claims."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: claim-judge
+  title: "OMG Claim Judge"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/dist/.agents/skills/omg/codex-mcp.toml

@@ -0,0 +1,4 @@
+[mcp_servers.omg-control]
+command = "python3"
+args = ["-m", "runtime.omg_mcp_server"]
+

package/dist/.agents/skills/omg/codex-rules.md

@@ -0,0 +1,33 @@
+# OMG Codex Rules (channel: public)
+
+## Defaults
+
+- `cached_web_search: prefer_cached`
+- `live_network: deny_by_default`
+- `destructive_approval: required`
+
+## Protected Paths
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Protected Planning Surface
+
+- `omg/plan-council` (explicit invocation only)
+
+## Approval Matrix
+
+| Action | Approval Required |
+|--------|------------------|
+| Read / Grep | No |
+| Write to protected paths | Yes |
+| Bash (python3:*) | Yes (balanced+ tier) |
+| git push --force | Yes |
+| Production deploy | Yes |

package/dist/.agents/skills/omg/control-plane/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-control-plane
+description: "Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi."
+---
+
+# OMG Control Plane
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control, omg-memory`
+- Evidence outputs: `.omg/evidence/control-plane-compile.json`

package/dist/.agents/skills/omg/control-plane/openai.yaml

@@ -0,0 +1,14 @@
+name: omg-control-plane
+description: "Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: control-plane
+  title: "OMG Control Plane"
+mcp_servers:
+  - omg-control
+  - omg-memory
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/dist/.agents/skills/omg/data-lineage/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-data-lineage
+description: "Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts."
+---
+
+# OMG Data Lineage
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/lineage/*.json`

package/dist/.agents/skills/omg/data-lineage/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-data-lineage
+description: "Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts."
+allow_implicit_invocation: true
+metadata:
+  channel: public
+  bundle_id: data-lineage
+  title: "OMG Data Lineage"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/.agents/skills/omg/delta-classifier/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-delta-classifier
+description: "Change classifier that attaches risk-aware checks, approvals, and packs."
+---
+
+# OMG Delta Classifier
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/tracebank/events.jsonl`

package/dist/.agents/skills/omg/delta-classifier/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-delta-classifier
+description: "Change classifier that attaches risk-aware checks, approvals, and packs."
+allow_implicit_invocation: true
+metadata:
+  channel: public
+  bundle_id: delta-classifier
+  title: "OMG Delta Classifier"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"

package/dist/.agents/skills/omg/eval-gate/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-eval-gate
+description: "Reproducible evaluation gate that blocks regressions before release."
+---
+
+# OMG Eval Gate
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evals/latest.json`

package/dist/.agents/skills/omg/eval-gate/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-eval-gate
+description: "Reproducible evaluation gate that blocks regressions before release."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: eval-gate
+  title: "OMG Eval Gate"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/.agents/skills/omg/health/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-health
+description: "Health-sensitive approvals, provenance, and replay attachments."
+---
+
+# OMG Health Pack
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/lineage/*.json`

package/dist/.agents/skills/omg/health/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-health
+description: "Health-sensitive approvals, provenance, and replay attachments."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: health
+  title: "OMG Health Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/dist/.agents/skills/omg/hook-governor/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-hook-governor
+description: "Canonical hook ordering, policy reinjection, and protected-path governance."
+---
+
+# OMG Hook Governor
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/state/ledger/tool-ledger.jsonl`

package/dist/.agents/skills/omg/hook-governor/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-hook-governor
+description: "Canonical hook ordering, policy reinjection, and protected-path governance."
+allow_implicit_invocation: true
+metadata:
+  channel: public
+  bundle_id: hook-governor
+  title: "OMG Hook Governor"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/dist/.agents/skills/omg/incident-replay/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-incident-replay
+description: "Replayable bug packs built from logs, failing tests, traces, and diffs."
+---
+
+# OMG Incident Replay
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/incidents/*.json`

package/dist/.agents/skills/omg/incident-replay/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-incident-replay
+description: "Replayable bug packs built from logs, failing tests, traces, and diffs."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: incident-replay
+  title: "OMG Incident Replay"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"

package/dist/.agents/skills/omg/lsp-pack/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-lsp-pack
+description: "Optional LSP-backed diagnostics and navigation bundle for production verification."
+---
+
+# OMG LSP Pack
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/lsp-diagnostics.json`

package/dist/.agents/skills/omg/lsp-pack/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-lsp-pack
+description: "Optional LSP-backed diagnostics and navigation bundle for production verification."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: lsp-pack
+  title: "OMG LSP Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/dist/.agents/skills/omg/mcp-fabric/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-mcp-fabric
+description: "Tools, prompts, resources, and server instructions for the OMG control plane."
+---
+
+# OMG MCP Fabric
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control, omg-memory`
+- Evidence outputs: `.omg/evidence/mcp-fabric.json`