@trac3er/oh-my-god 2.1.4 → 2.1.7

package/dist/dist/enterprise/attestations/bundle/registry/bundles/mcp-fabric.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/mcp-fabric.yaml",
+      "digest": {
+        "sha256": "4cc64a7f9a4d9b7128c2ee38e3cb325368bca27b4a82e262a3b1cb839287654d"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.321551+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.321551+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "04ec0312ff1d0e66",
+    "value": "untrusted comment: signature from omg local signing key\nS7q1+q6nhZd8zu9ovCiFdejPA4LumrFdX3SprQGMWw7XGOdspL7SnTqr9pcT5xZR87Lqsjxl/NtCFUzbzf0VCg==\ntrusted comment: type=omg-slsa-v1 keyid=04ec0312ff1d0e66 issued_at=2026-03-11T19:41:23.321665+00:00 artifact=bundle/registry/bundles/mcp-fabric.yaml sha256=4cc64a7f9a4d9b7128c2ee38e3cb325368bca27b4a82e262a3b1cb839287654d\nEi8RYw2CVWA4B0DQFjlbANyfpJ8RlodBpEZdvu0YDhqBS/QlXBWeEalHYc9PiyPMKxT8IKT/MT3HSucrC8SwCA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=04ec0312ff1d0e66 issued_at=2026-03-11T19:41:23.321665+00:00 artifact=bundle/registry/bundles/mcp-fabric.yaml sha256=4cc64a7f9a4d9b7128c2ee38e3cb325368bca27b4a82e262a3b1cb839287654d"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/bundles/plan-council.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+tVfPYvgXWlQCq9CmmlVhxF9zGH6sLh5/vnNTyEMUQULAs+Rk2E5fqmUtD92Ksf16HwBDBpEaxIQ3igHwTEbSCg==
+trusted comment: type=omg-slsa-v1 keyid=3e28a4c4ba6d991b issued_at=2026-03-11T19:41:23.322350+00:00 artifact=bundle/registry/bundles/plan-council.yaml sha256=8bf03bf3ae53ba928b644660d2e61e7aba2f916396591cffd3372d399ac82b93
+G91G3FqY2ZkjoecOH14M/IjEvNlqEYIVQDkWxSudTXlJmtURY7sJRSR8q7J29E7JLCAU7XYltYC7ZI2MiuamBA==

package/dist/dist/enterprise/attestations/bundle/registry/bundles/plan-council.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/plan-council.yaml",
+      "digest": {
+        "sha256": "8bf03bf3ae53ba928b644660d2e61e7aba2f916396591cffd3372d399ac82b93"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.322234+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.322234+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "3e28a4c4ba6d991b",
+    "value": "untrusted comment: signature from omg local signing key\ntVfPYvgXWlQCq9CmmlVhxF9zGH6sLh5/vnNTyEMUQULAs+Rk2E5fqmUtD92Ksf16HwBDBpEaxIQ3igHwTEbSCg==\ntrusted comment: type=omg-slsa-v1 keyid=3e28a4c4ba6d991b issued_at=2026-03-11T19:41:23.322350+00:00 artifact=bundle/registry/bundles/plan-council.yaml sha256=8bf03bf3ae53ba928b644660d2e61e7aba2f916396591cffd3372d399ac82b93\nG91G3FqY2ZkjoecOH14M/IjEvNlqEYIVQDkWxSudTXlJmtURY7sJRSR8q7J29E7JLCAU7XYltYC7ZI2MiuamBA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=3e28a4c4ba6d991b issued_at=2026-03-11T19:41:23.322350+00:00 artifact=bundle/registry/bundles/plan-council.yaml sha256=8bf03bf3ae53ba928b644660d2e61e7aba2f916396591cffd3372d399ac82b93"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/bundles/preflight.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+lLhe9QPNMvsoJ+zBkgfbA3H5UjWmVgV2DXbZgDPxSoelsDPoGEfDwL6OUc26Ua65YiTCh67woR7cyOJGHMXSBA==
+trusted comment: type=omg-slsa-v1 keyid=bc0b79e0982bd0ae issued_at=2026-03-11T19:41:23.323000+00:00 artifact=bundle/registry/bundles/preflight.yaml sha256=18f264b067150518332cb08d48cb3f47ff864ed5d166e9c2dd74c25aad9a6862
+EyTpJyI7v0i3ldf6ddmZGJAasPZuOcy+7X+1dF+4zdEHcSyBGB/iBQn7DLCrietMbp5vbZ0lU2aThawznnLWBw==

package/dist/dist/enterprise/attestations/bundle/registry/bundles/preflight.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/preflight.yaml",
+      "digest": {
+        "sha256": "18f264b067150518332cb08d48cb3f47ff864ed5d166e9c2dd74c25aad9a6862"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.322888+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.322888+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "bc0b79e0982bd0ae",
+    "value": "untrusted comment: signature from omg local signing key\nlLhe9QPNMvsoJ+zBkgfbA3H5UjWmVgV2DXbZgDPxSoelsDPoGEfDwL6OUc26Ua65YiTCh67woR7cyOJGHMXSBA==\ntrusted comment: type=omg-slsa-v1 keyid=bc0b79e0982bd0ae issued_at=2026-03-11T19:41:23.323000+00:00 artifact=bundle/registry/bundles/preflight.yaml sha256=18f264b067150518332cb08d48cb3f47ff864ed5d166e9c2dd74c25aad9a6862\nEyTpJyI7v0i3ldf6ddmZGJAasPZuOcy+7X+1dF+4zdEHcSyBGB/iBQn7DLCrietMbp5vbZ0lU2aThawznnLWBw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=bc0b79e0982bd0ae issued_at=2026-03-11T19:41:23.323000+00:00 artifact=bundle/registry/bundles/preflight.yaml sha256=18f264b067150518332cb08d48cb3f47ff864ed5d166e9c2dd74c25aad9a6862"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/bundles/proof-gate.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+qJn1gRuCUzyUv7JNuZusHWAZwTXb6ST09brknMlUfdOT/vqDz1w7TZuJL3OWIIw02D/h9aHn1VOOnZP1KNQcBg==
+trusted comment: type=omg-slsa-v1 keyid=5291f6e036f2c103 issued_at=2026-03-11T19:41:23.323649+00:00 artifact=bundle/registry/bundles/proof-gate.yaml sha256=00323541740fd0bc41c54c44d90f316455e9762f618125ce9fc08546c488d016
+lzBoK7oKfkFMqVw5b07RvSRTryw/u/juTYaCCT/S8pjDSjMyNUt9RpmVM5UYdBSnIu98yFwdeNFZvsEBxH+DCw==

package/dist/dist/enterprise/attestations/bundle/registry/bundles/proof-gate.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/proof-gate.yaml",
+      "digest": {
+        "sha256": "00323541740fd0bc41c54c44d90f316455e9762f618125ce9fc08546c488d016"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.323539+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.323539+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "5291f6e036f2c103",
+    "value": "untrusted comment: signature from omg local signing key\nqJn1gRuCUzyUv7JNuZusHWAZwTXb6ST09brknMlUfdOT/vqDz1w7TZuJL3OWIIw02D/h9aHn1VOOnZP1KNQcBg==\ntrusted comment: type=omg-slsa-v1 keyid=5291f6e036f2c103 issued_at=2026-03-11T19:41:23.323649+00:00 artifact=bundle/registry/bundles/proof-gate.yaml sha256=00323541740fd0bc41c54c44d90f316455e9762f618125ce9fc08546c488d016\nlzBoK7oKfkFMqVw5b07RvSRTryw/u/juTYaCCT/S8pjDSjMyNUt9RpmVM5UYdBSnIu98yFwdeNFZvsEBxH+DCw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=5291f6e036f2c103 issued_at=2026-03-11T19:41:23.323649+00:00 artifact=bundle/registry/bundles/proof-gate.yaml sha256=00323541740fd0bc41c54c44d90f316455e9762f618125ce9fc08546c488d016"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/bundles/remote-supervisor.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+oIVuuJdBFvZ2c73Kw6xT3VqnS2uf5GJuSgwcrQ/KgFESad1NUTR8XN6QBNAks02QaI4wEK+sddmBXzmVUwNkDA==
+trusted comment: type=omg-slsa-v1 keyid=780a9a4730b7c984 issued_at=2026-03-11T19:41:23.324317+00:00 artifact=bundle/registry/bundles/remote-supervisor.yaml sha256=374e95f8f295dd54b7ac432492d8076fb790c768cf59df0e7f09bceaac2d4bb0
++hd1FUfU1btvirpUZlCw4R1Lwf5+ZA9jvTIEH/8k1SffkhvXe/cnRd0bvc4HBDY7Qn/GuTpoosEx1TedbPD/CQ==

package/dist/dist/enterprise/attestations/bundle/registry/bundles/remote-supervisor.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/remote-supervisor.yaml",
+      "digest": {
+        "sha256": "374e95f8f295dd54b7ac432492d8076fb790c768cf59df0e7f09bceaac2d4bb0"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.324207+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.324207+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "780a9a4730b7c984",
+    "value": "untrusted comment: signature from omg local signing key\noIVuuJdBFvZ2c73Kw6xT3VqnS2uf5GJuSgwcrQ/KgFESad1NUTR8XN6QBNAks02QaI4wEK+sddmBXzmVUwNkDA==\ntrusted comment: type=omg-slsa-v1 keyid=780a9a4730b7c984 issued_at=2026-03-11T19:41:23.324317+00:00 artifact=bundle/registry/bundles/remote-supervisor.yaml sha256=374e95f8f295dd54b7ac432492d8076fb790c768cf59df0e7f09bceaac2d4bb0\n+hd1FUfU1btvirpUZlCw4R1Lwf5+ZA9jvTIEH/8k1SffkhvXe/cnRd0bvc4HBDY7Qn/GuTpoosEx1TedbPD/CQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=780a9a4730b7c984 issued_at=2026-03-11T19:41:23.324317+00:00 artifact=bundle/registry/bundles/remote-supervisor.yaml sha256=374e95f8f295dd54b7ac432492d8076fb790c768cf59df0e7f09bceaac2d4bb0"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/bundles/robotics.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+zXUPhFEkPIqV9DNLQJww1CAUttUuHYui1gx+734ok3mjrPtBNH1iJhFCzkAd3BQVHheBTgrh488uNsTS7QyYDw==
+trusted comment: type=omg-slsa-v1 keyid=aa0e3d2cefa1406f issued_at=2026-03-11T19:41:23.324989+00:00 artifact=bundle/registry/bundles/robotics.yaml sha256=9be73ba41e53eb57088910f644339e6642bf382b30532a55bbae60cca7536a24
+wL8aANNk7f1GYW9EDxsFen0VHDypAqoz/OykMgsif/IoKsjthtkSM+GscGg43ZDkWI3vCCV3FlWWUG90hgY6Bg==

package/dist/dist/enterprise/attestations/bundle/registry/bundles/robotics.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/robotics.yaml",
+      "digest": {
+        "sha256": "9be73ba41e53eb57088910f644339e6642bf382b30532a55bbae60cca7536a24"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.324878+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.324878+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "aa0e3d2cefa1406f",
+    "value": "untrusted comment: signature from omg local signing key\nzXUPhFEkPIqV9DNLQJww1CAUttUuHYui1gx+734ok3mjrPtBNH1iJhFCzkAd3BQVHheBTgrh488uNsTS7QyYDw==\ntrusted comment: type=omg-slsa-v1 keyid=aa0e3d2cefa1406f issued_at=2026-03-11T19:41:23.324989+00:00 artifact=bundle/registry/bundles/robotics.yaml sha256=9be73ba41e53eb57088910f644339e6642bf382b30532a55bbae60cca7536a24\nwL8aANNk7f1GYW9EDxsFen0VHDypAqoz/OykMgsif/IoKsjthtkSM+GscGg43ZDkWI3vCCV3FlWWUG90hgY6Bg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=aa0e3d2cefa1406f issued_at=2026-03-11T19:41:23.324989+00:00 artifact=bundle/registry/bundles/robotics.yaml sha256=9be73ba41e53eb57088910f644339e6642bf382b30532a55bbae60cca7536a24"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/bundles/secure-worktree-pipeline.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+vAsUnN245xFUgT2q30AnNAnTwdYLAaznUy4YwHD2HyZlTskbK5qPGsUO0/9YAcLQOCBY7iBvkAH6RyZqq42kCA==
+trusted comment: type=omg-slsa-v1 keyid=f26df548127f80bd issued_at=2026-03-11T19:41:23.325622+00:00 artifact=bundle/registry/bundles/secure-worktree-pipeline.yaml sha256=5d75ac83ab9edd69e019d1473928e8bd15168c494796078203f2379fe365e311
+fY9jm0BJSRihswYzr5hysQQB/HU4bFlsLVa2HeLFae2eT6udjBYxFiuMxL5lpLr8r8mbzpR7CLfhKLdd7UbqBQ==

package/dist/dist/enterprise/attestations/bundle/registry/bundles/secure-worktree-pipeline.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/secure-worktree-pipeline.yaml",
+      "digest": {
+        "sha256": "5d75ac83ab9edd69e019d1473928e8bd15168c494796078203f2379fe365e311"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.325507+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.325507+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "f26df548127f80bd",
+    "value": "untrusted comment: signature from omg local signing key\nvAsUnN245xFUgT2q30AnNAnTwdYLAaznUy4YwHD2HyZlTskbK5qPGsUO0/9YAcLQOCBY7iBvkAH6RyZqq42kCA==\ntrusted comment: type=omg-slsa-v1 keyid=f26df548127f80bd issued_at=2026-03-11T19:41:23.325622+00:00 artifact=bundle/registry/bundles/secure-worktree-pipeline.yaml sha256=5d75ac83ab9edd69e019d1473928e8bd15168c494796078203f2379fe365e311\nfY9jm0BJSRihswYzr5hysQQB/HU4bFlsLVa2HeLFae2eT6udjBYxFiuMxL5lpLr8r8mbzpR7CLfhKLdd7UbqBQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=f26df548127f80bd issued_at=2026-03-11T19:41:23.325622+00:00 artifact=bundle/registry/bundles/secure-worktree-pipeline.yaml sha256=5d75ac83ab9edd69e019d1473928e8bd15168c494796078203f2379fe365e311"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/bundles/security-check.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+Rez7gMz3+bzehjNR1x6d3pztmE3MBReaKVDDnhxxAwWy+DNpcUmz2Dtwj8Gh8F4PJhANb2H3l3fbYLOhgBN0Bg==
+trusted comment: type=omg-slsa-v1 keyid=09166342b767e68f issued_at=2026-03-11T19:41:23.326256+00:00 artifact=bundle/registry/bundles/security-check.yaml sha256=c94db611d2fcc1df64fb28a2cc6ffaa21c2a1934de966bc0b332aa122aad521a
+3/us0TpM+evZZkpovOu75+cJq651wbA12bsqIC76fhgFduondizuvdeiXsNAtc3V4xUVdgt9Ib0Ot/0mT8zsCQ==

package/dist/dist/enterprise/attestations/bundle/registry/bundles/security-check.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/security-check.yaml",
+      "digest": {
+        "sha256": "c94db611d2fcc1df64fb28a2cc6ffaa21c2a1934de966bc0b332aa122aad521a"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.326142+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.326142+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "09166342b767e68f",
+    "value": "untrusted comment: signature from omg local signing key\nRez7gMz3+bzehjNR1x6d3pztmE3MBReaKVDDnhxxAwWy+DNpcUmz2Dtwj8Gh8F4PJhANb2H3l3fbYLOhgBN0Bg==\ntrusted comment: type=omg-slsa-v1 keyid=09166342b767e68f issued_at=2026-03-11T19:41:23.326256+00:00 artifact=bundle/registry/bundles/security-check.yaml sha256=c94db611d2fcc1df64fb28a2cc6ffaa21c2a1934de966bc0b332aa122aad521a\n3/us0TpM+evZZkpovOu75+cJq651wbA12bsqIC76fhgFduondizuvdeiXsNAtc3V4xUVdgt9Ib0Ot/0mT8zsCQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=09166342b767e68f issued_at=2026-03-11T19:41:23.326256+00:00 artifact=bundle/registry/bundles/security-check.yaml sha256=c94db611d2fcc1df64fb28a2cc6ffaa21c2a1934de966bc0b332aa122aad521a"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/bundles/test-intent-lock.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+/l6KZOtkpl/VP0XH9WW47ZrhQUdBJNlsOFAzgu8KODd4pH2/vsWhzF8xubP5DWTSLq+JZUlUIaWayvgpM9z5AQ==
+trusted comment: type=omg-slsa-v1 keyid=44bec7cbe5630d29 issued_at=2026-03-11T19:41:23.326881+00:00 artifact=bundle/registry/bundles/test-intent-lock.yaml sha256=08bb64f5d5625fd5b236f27238cc0b42683807eb29b4013a49cc6ba25ef37649
+1ft8EO4LrQyrWN5+hGuKz6LjrvJSxiK5k+q4MLhQHKG01F27+KVu4p5L5z8+/OTib4ngn41Q/+LCDA/D7vf1CA==

package/dist/dist/enterprise/attestations/bundle/registry/bundles/test-intent-lock.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/test-intent-lock.yaml",
+      "digest": {
+        "sha256": "08bb64f5d5625fd5b236f27238cc0b42683807eb29b4013a49cc6ba25ef37649"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.326768+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.326768+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "44bec7cbe5630d29",
+    "value": "untrusted comment: signature from omg local signing key\n/l6KZOtkpl/VP0XH9WW47ZrhQUdBJNlsOFAzgu8KODd4pH2/vsWhzF8xubP5DWTSLq+JZUlUIaWayvgpM9z5AQ==\ntrusted comment: type=omg-slsa-v1 keyid=44bec7cbe5630d29 issued_at=2026-03-11T19:41:23.326881+00:00 artifact=bundle/registry/bundles/test-intent-lock.yaml sha256=08bb64f5d5625fd5b236f27238cc0b42683807eb29b4013a49cc6ba25ef37649\n1ft8EO4LrQyrWN5+hGuKz6LjrvJSxiK5k+q4MLhQHKG01F27+KVu4p5L5z8+/OTib4ngn41Q/+LCDA/D7vf1CA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=44bec7cbe5630d29 issued_at=2026-03-11T19:41:23.326881+00:00 artifact=bundle/registry/bundles/test-intent-lock.yaml sha256=08bb64f5d5625fd5b236f27238cc0b42683807eb29b4013a49cc6ba25ef37649"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/bundles/tracebank.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+u7damVm2UFysaQNdcAx8Kjwajc+uliBOOU6RQRVBrfaOyp28K4aCiBThQfH9wj7UbZAMJrEHHwLrLB0iOIjRCw==
+trusted comment: type=omg-slsa-v1 keyid=f26486b1d4d170ad issued_at=2026-03-11T19:41:23.327478+00:00 artifact=bundle/registry/bundles/tracebank.yaml sha256=ff2f9fb605e84292a8d913138bfb1d1ff0021ff19bda2032fb7463ceeb4b2628
+pG3qu52eE3NAiKQGcXsLryxomfWmx2tF+i4ZJb1rCqfC6apsPbP4+rQwElMuwjUXTmWIOWyWgvez0XQRgEC9AA==

package/dist/dist/enterprise/attestations/bundle/registry/bundles/tracebank.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/tracebank.yaml",
+      "digest": {
+        "sha256": "ff2f9fb605e84292a8d913138bfb1d1ff0021ff19bda2032fb7463ceeb4b2628"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.327367+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.327367+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "f26486b1d4d170ad",
+    "value": "untrusted comment: signature from omg local signing key\nu7damVm2UFysaQNdcAx8Kjwajc+uliBOOU6RQRVBrfaOyp28K4aCiBThQfH9wj7UbZAMJrEHHwLrLB0iOIjRCw==\ntrusted comment: type=omg-slsa-v1 keyid=f26486b1d4d170ad issued_at=2026-03-11T19:41:23.327478+00:00 artifact=bundle/registry/bundles/tracebank.yaml sha256=ff2f9fb605e84292a8d913138bfb1d1ff0021ff19bda2032fb7463ceeb4b2628\npG3qu52eE3NAiKQGcXsLryxomfWmx2tF+i4ZJb1rCqfC6apsPbP4+rQwElMuwjUXTmWIOWyWgvez0XQRgEC9AA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=f26486b1d4d170ad issued_at=2026-03-11T19:41:23.327478+00:00 artifact=bundle/registry/bundles/tracebank.yaml sha256=ff2f9fb605e84292a8d913138bfb1d1ff0021ff19bda2032fb7463ceeb4b2628"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/bundles/vision.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+9MBWaiAdmkJ0MUtHCLA/YhwTOe4L+chlgslbGmDbHFyDwc4X/Z6WWtIsjpGwyyORwIW8+3Tage1z4Z2ZsMIBAQ==
+trusted comment: type=omg-slsa-v1 keyid=eb5d304b5ee90c01 issued_at=2026-03-11T19:41:23.328135+00:00 artifact=bundle/registry/bundles/vision.yaml sha256=efac126905e8e5beccfdfedaf7186c803b6ab6c24bdc63b19cb94c74bea4ab1b
+1ZOU9BpGMEDLpoqLhFGiN8xiiNKQOOcricQzqe36hoWTHek31dCb0RoGRABYjM+qBMJO461qi99rfUPLYIYQBw==

package/dist/dist/enterprise/attestations/bundle/registry/bundles/vision.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/vision.yaml",
+      "digest": {
+        "sha256": "efac126905e8e5beccfdfedaf7186c803b6ab6c24bdc63b19cb94c74bea4ab1b"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.328024+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.328024+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "eb5d304b5ee90c01",
+    "value": "untrusted comment: signature from omg local signing key\n9MBWaiAdmkJ0MUtHCLA/YhwTOe4L+chlgslbGmDbHFyDwc4X/Z6WWtIsjpGwyyORwIW8+3Tage1z4Z2ZsMIBAQ==\ntrusted comment: type=omg-slsa-v1 keyid=eb5d304b5ee90c01 issued_at=2026-03-11T19:41:23.328135+00:00 artifact=bundle/registry/bundles/vision.yaml sha256=efac126905e8e5beccfdfedaf7186c803b6ab6c24bdc63b19cb94c74bea4ab1b\n1ZOU9BpGMEDLpoqLhFGiN8xiiNKQOOcricQzqe36hoWTHek31dCb0RoGRABYjM+qBMJO461qi99rfUPLYIYQBw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=eb5d304b5ee90c01 issued_at=2026-03-11T19:41:23.328135+00:00 artifact=bundle/registry/bundles/vision.yaml sha256=efac126905e8e5beccfdfedaf7186c803b6ab6c24bdc63b19cb94c74bea4ab1b"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/registry/omg-capability.schema.json.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+262lBxY23qHi+NNuXAnHozh0dbEzSF/eboOKZ/kJFfcVvGtmDO9qUA4Bp0aWI+YhtcaO/YTiwu9o9OPRKy0pDg==
+trusted comment: type=omg-slsa-v1 keyid=4e2f653cb530067c issued_at=2026-03-11T19:41:23.328771+00:00 artifact=bundle/registry/omg-capability.schema.json sha256=e2975775ab890b495a55ebe2816a854ec86402f8acf41cfc11572682d55b2a49
+hvFNX0Iy0NCCWx+YilXPsccp7o6ntLe1ZEdZCuq+SX+fwyOxvoRFKdgxjltx1r+nVqTaW33uqnfobJg8KxjFBg==

package/dist/dist/enterprise/attestations/bundle/registry/omg-capability.schema.json.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/omg-capability.schema.json",
+      "digest": {
+        "sha256": "e2975775ab890b495a55ebe2816a854ec86402f8acf41cfc11572682d55b2a49"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.328659+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.328659+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "4e2f653cb530067c",
+    "value": "untrusted comment: signature from omg local signing key\n262lBxY23qHi+NNuXAnHozh0dbEzSF/eboOKZ/kJFfcVvGtmDO9qUA4Bp0aWI+YhtcaO/YTiwu9o9OPRKy0pDg==\ntrusted comment: type=omg-slsa-v1 keyid=4e2f653cb530067c issued_at=2026-03-11T19:41:23.328771+00:00 artifact=bundle/registry/omg-capability.schema.json sha256=e2975775ab890b495a55ebe2816a854ec86402f8acf41cfc11572682d55b2a49\nhvFNX0Iy0NCCWx+YilXPsccp7o6ntLe1ZEdZCuq+SX+fwyOxvoRFKdgxjltx1r+nVqTaW33uqnfobJg8KxjFBg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=4e2f653cb530067c issued_at=2026-03-11T19:41:23.328771+00:00 artifact=bundle/registry/omg-capability.schema.json sha256=e2975775ab890b495a55ebe2816a854ec86402f8acf41cfc11572682d55b2a49"
+  }
+}

package/dist/dist/enterprise/attestations/bundle/settings.json.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+n9rHKimLcL9n0IbUmINb11Am+8zEQ7VHNviboIbNumOQqyRWPWQZMy2QfDk2bLx0me79AODfQALAZZtRZUZFDQ==
+trusted comment: type=omg-slsa-v1 keyid=0e01c82c5223b858 issued_at=2026-03-11T19:41:23.329412+00:00 artifact=bundle/settings.json sha256=70aa3ef36f1f8dbd8417059988047dd5664d9a896000d5dbda8486a94689332c
+9y+hGhu+YyloUeO1x/dXOz97vOf5vkLCjaMfG8IYx255jEr4KKUv+al4yVlgVwh/VjQhluafZCMnQu5wcvyDDg==

package/dist/dist/enterprise/attestations/bundle/settings.json.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/settings.json",
+      "digest": {
+        "sha256": "70aa3ef36f1f8dbd8417059988047dd5664d9a896000d5dbda8486a94689332c"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:23.329291+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:23.329291+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "0e01c82c5223b858",
+    "value": "untrusted comment: signature from omg local signing key\nn9rHKimLcL9n0IbUmINb11Am+8zEQ7VHNviboIbNumOQqyRWPWQZMy2QfDk2bLx0me79AODfQALAZZtRZUZFDQ==\ntrusted comment: type=omg-slsa-v1 keyid=0e01c82c5223b858 issued_at=2026-03-11T19:41:23.329412+00:00 artifact=bundle/settings.json sha256=70aa3ef36f1f8dbd8417059988047dd5664d9a896000d5dbda8486a94689332c\n9y+hGhu+YyloUeO1x/dXOz97vOf5vkLCjaMfG8IYx255jEr4KKUv+al4yVlgVwh/VjQhluafZCMnQu5wcvyDDg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=0e01c82c5223b858 issued_at=2026-03-11T19:41:23.329412+00:00 artifact=bundle/settings.json sha256=70aa3ef36f1f8dbd8417059988047dd5664d9a896000d5dbda8486a94689332c"
+  }
+}

package/dist/dist/enterprise/bundle/.agents/skills/omg/AGENTS.fragment.md

@@ -0,0 +1,73 @@
+# OMG Codex Governance (channel: enterprise)
+
+## Build & Test
+
+```bash
+python3 -m pytest tests -q
+python3 scripts/omg.py contract validate
+python3 scripts/omg.py contract compile --host codex --channel enterprise
+```
+
+## Protected Paths
+
+The following paths require tier-gated review before mutation:
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Release Audit
+
+Release readiness requires claim and compliance outcomes:
+
+- `claim_judge`
+- `compliance_governor`
+- `execution_primitives`
+Attestation requirements:
+- `registry.verify_artifact.sign_artifact_statement`
+- `registry.verify_artifact.verify_artifact_statement`
+
+## Evidence Contract
+
+Every production action must emit evidence containing these fields:
+
+- `attestation_statement`
+- `attestation_verifier`
+- `claim_judge_verdict`
+- `compliance_verdict`
+- `executor`
+- `lineage`
+- `timestamp`
+- `trace_id`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Protected Planning Surface
+
+Council planning skills are protected and explicit-invocation only:
+
+- `omg/plan-council`
+
+## Web Search Policy
+
+- Prefer cached results over live network requests.
+- Do NOT initiate live web searches unless explicitly instructed.
+- Use `context7` or local documentation before external lookups.
+- Set `cached_web_search: prefer_cached` as the default.
+
+## Approval Constraints
+
+- Destructive file operations require explicit user approval.
+- `git push --force` and branch deletions require explicit approval.
+- Production deployments require explicit approval.
+- Mutations to protected paths require tier-gated approval.
+
+## Rules & Automations
+
+- Rules: `protected_paths, explicit_invocation`
+- Automations: `contract-compile, release-readiness`
+- Require explicit invocation for protected production planning skills.

package/dist/dist/enterprise/bundle/.agents/skills/omg/algorithms/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-algorithms
+description: "Determinism and benchmark attachments for algorithm-heavy work."
+---
+
+# OMG Algorithms Pack
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evals/latest.json`