@trac3er/oh-my-god 2.1.4 → 2.1.7

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/proof-gate.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/proof-gate.yaml",
+      "digest": {
+        "sha256": "00323541740fd0bc41c54c44d90f316455e9762f618125ce9fc08546c488d016"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.756704+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.756704+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "e2f3b749009d187f",
+    "value": "untrusted comment: signature from omg local signing key\nl9WExjFWlXJsJlPVceL6o0aYwY9xDPFaXHcIyDhRQhg6At0ow29iAslzHyZtOoXJCMbZemJ+66yAqiZBGTR5Bg==\ntrusted comment: type=omg-slsa-v1 keyid=e2f3b749009d187f issued_at=2026-03-11T19:41:24.756827+00:00 artifact=bundle/registry/bundles/proof-gate.yaml sha256=00323541740fd0bc41c54c44d90f316455e9762f618125ce9fc08546c488d016\n51BZA8xBaxsaTu4zWAG81Z2zSNW147jud0NPp3yUAc7RPIv3yQQsDV/lk95TqnA/xJZpFZ1sfZcp6y3WqRqBCw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=e2f3b749009d187f issued_at=2026-03-11T19:41:24.756827+00:00 artifact=bundle/registry/bundles/proof-gate.yaml sha256=00323541740fd0bc41c54c44d90f316455e9762f618125ce9fc08546c488d016"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/remote-supervisor.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+05J7nRCaN231f4ZOFpuywItMZo4/fwpO2ON98Kh6FlP3sj0jpNK6Cuxjtr995J8lBb0eCFNn5pYuioimGYOEBg==
+trusted comment: type=omg-slsa-v1 keyid=46cfc3840f85e3e5 issued_at=2026-03-11T19:41:24.757440+00:00 artifact=bundle/registry/bundles/remote-supervisor.yaml sha256=374e95f8f295dd54b7ac432492d8076fb790c768cf59df0e7f09bceaac2d4bb0
+JJMeBa7nU1IRhZJOHJp2ePy1TU5uqgvvrpM0gzXneLIKlORADWoO9TYXoVG5DCy+APdY432Aqn5NqcesIz2HCg==

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/remote-supervisor.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/remote-supervisor.yaml",
+      "digest": {
+        "sha256": "374e95f8f295dd54b7ac432492d8076fb790c768cf59df0e7f09bceaac2d4bb0"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.757325+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.757325+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "46cfc3840f85e3e5",
+    "value": "untrusted comment: signature from omg local signing key\n05J7nRCaN231f4ZOFpuywItMZo4/fwpO2ON98Kh6FlP3sj0jpNK6Cuxjtr995J8lBb0eCFNn5pYuioimGYOEBg==\ntrusted comment: type=omg-slsa-v1 keyid=46cfc3840f85e3e5 issued_at=2026-03-11T19:41:24.757440+00:00 artifact=bundle/registry/bundles/remote-supervisor.yaml sha256=374e95f8f295dd54b7ac432492d8076fb790c768cf59df0e7f09bceaac2d4bb0\nJJMeBa7nU1IRhZJOHJp2ePy1TU5uqgvvrpM0gzXneLIKlORADWoO9TYXoVG5DCy+APdY432Aqn5NqcesIz2HCg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=46cfc3840f85e3e5 issued_at=2026-03-11T19:41:24.757440+00:00 artifact=bundle/registry/bundles/remote-supervisor.yaml sha256=374e95f8f295dd54b7ac432492d8076fb790c768cf59df0e7f09bceaac2d4bb0"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/robotics.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+BCyV2k/Bw9H+gcPXKHvLFaN4FNpO/CguXz4r68WUWgp9zH2zmCc9GSykQQwyVmlV8WFHL3z+0M1ROTpV2VVGBw==
+trusted comment: type=omg-slsa-v1 keyid=5ffb7da03cd7992e issued_at=2026-03-11T19:41:24.758009+00:00 artifact=bundle/registry/bundles/robotics.yaml sha256=9be73ba41e53eb57088910f644339e6642bf382b30532a55bbae60cca7536a24
+iTpVzxrOJZPv8aOVm3f+ZAGvBoINhrlxxH0HYjsbVWkc8MzC/02MrdNpu6LOmDR8hc/LyGbkRMY504mZkGAPCw==

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/robotics.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/robotics.yaml",
+      "digest": {
+        "sha256": "9be73ba41e53eb57088910f644339e6642bf382b30532a55bbae60cca7536a24"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.757892+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.757892+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "5ffb7da03cd7992e",
+    "value": "untrusted comment: signature from omg local signing key\nBCyV2k/Bw9H+gcPXKHvLFaN4FNpO/CguXz4r68WUWgp9zH2zmCc9GSykQQwyVmlV8WFHL3z+0M1ROTpV2VVGBw==\ntrusted comment: type=omg-slsa-v1 keyid=5ffb7da03cd7992e issued_at=2026-03-11T19:41:24.758009+00:00 artifact=bundle/registry/bundles/robotics.yaml sha256=9be73ba41e53eb57088910f644339e6642bf382b30532a55bbae60cca7536a24\niTpVzxrOJZPv8aOVm3f+ZAGvBoINhrlxxH0HYjsbVWkc8MzC/02MrdNpu6LOmDR8hc/LyGbkRMY504mZkGAPCw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=5ffb7da03cd7992e issued_at=2026-03-11T19:41:24.758009+00:00 artifact=bundle/registry/bundles/robotics.yaml sha256=9be73ba41e53eb57088910f644339e6642bf382b30532a55bbae60cca7536a24"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/secure-worktree-pipeline.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+MozsmeLO5kxWzLIVbpP6mb8ZEdsMtY9anbZOcDSPYUnBRAtHX/4BaJrSFJxjVud902ARfdWEJFJqIr0nyLARAQ==
+trusted comment: type=omg-slsa-v1 keyid=caf2473062e4ff39 issued_at=2026-03-11T19:41:24.758580+00:00 artifact=bundle/registry/bundles/secure-worktree-pipeline.yaml sha256=5d75ac83ab9edd69e019d1473928e8bd15168c494796078203f2379fe365e311
+T0277Qhu4Lmitk3ryzSvPd7gFSFDJvZuEjPInff7Rx6X2sr9/y0TgdDspxmuYh10x+C5GAii0DhCr6ZFMUJCBQ==

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/secure-worktree-pipeline.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/secure-worktree-pipeline.yaml",
+      "digest": {
+        "sha256": "5d75ac83ab9edd69e019d1473928e8bd15168c494796078203f2379fe365e311"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.758466+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.758466+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "caf2473062e4ff39",
+    "value": "untrusted comment: signature from omg local signing key\nMozsmeLO5kxWzLIVbpP6mb8ZEdsMtY9anbZOcDSPYUnBRAtHX/4BaJrSFJxjVud902ARfdWEJFJqIr0nyLARAQ==\ntrusted comment: type=omg-slsa-v1 keyid=caf2473062e4ff39 issued_at=2026-03-11T19:41:24.758580+00:00 artifact=bundle/registry/bundles/secure-worktree-pipeline.yaml sha256=5d75ac83ab9edd69e019d1473928e8bd15168c494796078203f2379fe365e311\nT0277Qhu4Lmitk3ryzSvPd7gFSFDJvZuEjPInff7Rx6X2sr9/y0TgdDspxmuYh10x+C5GAii0DhCr6ZFMUJCBQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=caf2473062e4ff39 issued_at=2026-03-11T19:41:24.758580+00:00 artifact=bundle/registry/bundles/secure-worktree-pipeline.yaml sha256=5d75ac83ab9edd69e019d1473928e8bd15168c494796078203f2379fe365e311"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/security-check.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+sQE9mVjMLOM+BUme9vKsqwqEgjKhBwhbtusd3XPRtLfgXXIp14NqlYTqEf3XFukqubtTGWGPp4xKhkpWYi6NCA==
+trusted comment: type=omg-slsa-v1 keyid=af0ef152ed52582e issued_at=2026-03-11T19:41:24.759797+00:00 artifact=bundle/registry/bundles/security-check.yaml sha256=c94db611d2fcc1df64fb28a2cc6ffaa21c2a1934de966bc0b332aa122aad521a
+MkHBuqxuzMglNIbkDPPZuIP7QrDM8s2ydaHYoYQaAEWGUihWF8/0PIm4Kc/psz7H9HphGjszKFFOxb2dlah7DQ==

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/security-check.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/security-check.yaml",
+      "digest": {
+        "sha256": "c94db611d2fcc1df64fb28a2cc6ffaa21c2a1934de966bc0b332aa122aad521a"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.759652+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.759652+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "af0ef152ed52582e",
+    "value": "untrusted comment: signature from omg local signing key\nsQE9mVjMLOM+BUme9vKsqwqEgjKhBwhbtusd3XPRtLfgXXIp14NqlYTqEf3XFukqubtTGWGPp4xKhkpWYi6NCA==\ntrusted comment: type=omg-slsa-v1 keyid=af0ef152ed52582e issued_at=2026-03-11T19:41:24.759797+00:00 artifact=bundle/registry/bundles/security-check.yaml sha256=c94db611d2fcc1df64fb28a2cc6ffaa21c2a1934de966bc0b332aa122aad521a\nMkHBuqxuzMglNIbkDPPZuIP7QrDM8s2ydaHYoYQaAEWGUihWF8/0PIm4Kc/psz7H9HphGjszKFFOxb2dlah7DQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=af0ef152ed52582e issued_at=2026-03-11T19:41:24.759797+00:00 artifact=bundle/registry/bundles/security-check.yaml sha256=c94db611d2fcc1df64fb28a2cc6ffaa21c2a1934de966bc0b332aa122aad521a"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/test-intent-lock.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+fYf7TS3r8RMH5deruCFdztrMuJZz+HzaKvTHdCN3oaPsm2PLfNA8D440Z0TNqe7tAi4jfZdnmEIy3ogvnjgHBA==
+trusted comment: type=omg-slsa-v1 keyid=56964122d1ce485e issued_at=2026-03-11T19:41:24.760599+00:00 artifact=bundle/registry/bundles/test-intent-lock.yaml sha256=08bb64f5d5625fd5b236f27238cc0b42683807eb29b4013a49cc6ba25ef37649
+lOpAPyr+Z2mbC8aNwavSMUx9/mgTSkkcG5gZ71pUUfggZjZPHa+tq4nPKNR0l0nGLL6s8KgxDRO4VB2BXuC7CQ==

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/test-intent-lock.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/test-intent-lock.yaml",
+      "digest": {
+        "sha256": "08bb64f5d5625fd5b236f27238cc0b42683807eb29b4013a49cc6ba25ef37649"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.760478+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.760478+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "56964122d1ce485e",
+    "value": "untrusted comment: signature from omg local signing key\nfYf7TS3r8RMH5deruCFdztrMuJZz+HzaKvTHdCN3oaPsm2PLfNA8D440Z0TNqe7tAi4jfZdnmEIy3ogvnjgHBA==\ntrusted comment: type=omg-slsa-v1 keyid=56964122d1ce485e issued_at=2026-03-11T19:41:24.760599+00:00 artifact=bundle/registry/bundles/test-intent-lock.yaml sha256=08bb64f5d5625fd5b236f27238cc0b42683807eb29b4013a49cc6ba25ef37649\nlOpAPyr+Z2mbC8aNwavSMUx9/mgTSkkcG5gZ71pUUfggZjZPHa+tq4nPKNR0l0nGLL6s8KgxDRO4VB2BXuC7CQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=56964122d1ce485e issued_at=2026-03-11T19:41:24.760599+00:00 artifact=bundle/registry/bundles/test-intent-lock.yaml sha256=08bb64f5d5625fd5b236f27238cc0b42683807eb29b4013a49cc6ba25ef37649"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/tracebank.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+r3Wjf+/5NSfLSTm+bG2Et0x1WBl6PoN/UYNYRL2LkB8NzFRgNChDCbt9hkXIGczsKz4JPf2DPahyD/6ezwBDBQ==
+trusted comment: type=omg-slsa-v1 keyid=11e8796193514bbf issued_at=2026-03-11T19:41:24.761297+00:00 artifact=bundle/registry/bundles/tracebank.yaml sha256=ff2f9fb605e84292a8d913138bfb1d1ff0021ff19bda2032fb7463ceeb4b2628
+hUCpWNHaA9QYbuKbWgfmBFDXhEy/J0s4EqESgOqmkfTDzJzKnzvWFvAOxyG1cua9zdd1kro4vKd3/7LEFWvmBQ==

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/tracebank.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/tracebank.yaml",
+      "digest": {
+        "sha256": "ff2f9fb605e84292a8d913138bfb1d1ff0021ff19bda2032fb7463ceeb4b2628"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.761179+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.761179+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "11e8796193514bbf",
+    "value": "untrusted comment: signature from omg local signing key\nr3Wjf+/5NSfLSTm+bG2Et0x1WBl6PoN/UYNYRL2LkB8NzFRgNChDCbt9hkXIGczsKz4JPf2DPahyD/6ezwBDBQ==\ntrusted comment: type=omg-slsa-v1 keyid=11e8796193514bbf issued_at=2026-03-11T19:41:24.761297+00:00 artifact=bundle/registry/bundles/tracebank.yaml sha256=ff2f9fb605e84292a8d913138bfb1d1ff0021ff19bda2032fb7463ceeb4b2628\nhUCpWNHaA9QYbuKbWgfmBFDXhEy/J0s4EqESgOqmkfTDzJzKnzvWFvAOxyG1cua9zdd1kro4vKd3/7LEFWvmBQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=11e8796193514bbf issued_at=2026-03-11T19:41:24.761297+00:00 artifact=bundle/registry/bundles/tracebank.yaml sha256=ff2f9fb605e84292a8d913138bfb1d1ff0021ff19bda2032fb7463ceeb4b2628"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/vision.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+Azihp1T68KZ5H7ngIiI3uYERcM4v/SNcPLFFColXqId41taun4InHW2tCgbx/LRp7GylCEYQEhwA2KRc8sEjBQ==
+trusted comment: type=omg-slsa-v1 keyid=babfa711d5986c50 issued_at=2026-03-11T19:41:24.761940+00:00 artifact=bundle/registry/bundles/vision.yaml sha256=efac126905e8e5beccfdfedaf7186c803b6ab6c24bdc63b19cb94c74bea4ab1b
+Q8Mo6/LNxkA5bK/x5Ivvuq1tNcjpyXAn/Nvw98CxAhiKtdI3r1PGzR/jzvI7IvWiaeIBI79iQJANDVM+N5kADw==

package/artifacts/release/dist/enterprise/attestations/bundle/registry/bundles/vision.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/vision.yaml",
+      "digest": {
+        "sha256": "efac126905e8e5beccfdfedaf7186c803b6ab6c24bdc63b19cb94c74bea4ab1b"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.761825+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.761825+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "babfa711d5986c50",
+    "value": "untrusted comment: signature from omg local signing key\nAzihp1T68KZ5H7ngIiI3uYERcM4v/SNcPLFFColXqId41taun4InHW2tCgbx/LRp7GylCEYQEhwA2KRc8sEjBQ==\ntrusted comment: type=omg-slsa-v1 keyid=babfa711d5986c50 issued_at=2026-03-11T19:41:24.761940+00:00 artifact=bundle/registry/bundles/vision.yaml sha256=efac126905e8e5beccfdfedaf7186c803b6ab6c24bdc63b19cb94c74bea4ab1b\nQ8Mo6/LNxkA5bK/x5Ivvuq1tNcjpyXAn/Nvw98CxAhiKtdI3r1PGzR/jzvI7IvWiaeIBI79iQJANDVM+N5kADw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=babfa711d5986c50 issued_at=2026-03-11T19:41:24.761940+00:00 artifact=bundle/registry/bundles/vision.yaml sha256=efac126905e8e5beccfdfedaf7186c803b6ab6c24bdc63b19cb94c74bea4ab1b"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/registry/omg-capability.schema.json.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+uSkVTv7Es68xAvZchFQyD1oz+9wglXS2NoQRf4pcyI8hCG8Phsa+LfpJvnqnIoPq8B+9PnIL/saas/JS25ktDA==
+trusted comment: type=omg-slsa-v1 keyid=7c7b27929bcd0b23 issued_at=2026-03-11T19:41:24.762628+00:00 artifact=bundle/registry/omg-capability.schema.json sha256=e2975775ab890b495a55ebe2816a854ec86402f8acf41cfc11572682d55b2a49
+VWoAfRvI8IGqxawyCqF47lwIYCF7NngfCU0KB0JAkdkbsJR+5bQw58Uhw9Ua6yyr0DOkeJhU6I/eH3r26UdPCg==

package/artifacts/release/dist/enterprise/attestations/bundle/registry/omg-capability.schema.json.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/omg-capability.schema.json",
+      "digest": {
+        "sha256": "e2975775ab890b495a55ebe2816a854ec86402f8acf41cfc11572682d55b2a49"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.762511+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.762511+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "7c7b27929bcd0b23",
+    "value": "untrusted comment: signature from omg local signing key\nuSkVTv7Es68xAvZchFQyD1oz+9wglXS2NoQRf4pcyI8hCG8Phsa+LfpJvnqnIoPq8B+9PnIL/saas/JS25ktDA==\ntrusted comment: type=omg-slsa-v1 keyid=7c7b27929bcd0b23 issued_at=2026-03-11T19:41:24.762628+00:00 artifact=bundle/registry/omg-capability.schema.json sha256=e2975775ab890b495a55ebe2816a854ec86402f8acf41cfc11572682d55b2a49\nVWoAfRvI8IGqxawyCqF47lwIYCF7NngfCU0KB0JAkdkbsJR+5bQw58Uhw9Ua6yyr0DOkeJhU6I/eH3r26UdPCg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=7c7b27929bcd0b23 issued_at=2026-03-11T19:41:24.762628+00:00 artifact=bundle/registry/omg-capability.schema.json sha256=e2975775ab890b495a55ebe2816a854ec86402f8acf41cfc11572682d55b2a49"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/settings.json.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+wKUqy5el6prJ2coeZqD3uZHWN83Iuiu7ntyoMGrTf/8QgGEg8fbnjHDXCmdeLo1y1aYthQ1XzoG+xouUxNRxDw==
+trusted comment: type=omg-slsa-v1 keyid=5032d5f46e94d120 issued_at=2026-03-11T19:41:24.763285+00:00 artifact=bundle/settings.json sha256=70aa3ef36f1f8dbd8417059988047dd5664d9a896000d5dbda8486a94689332c
+Zh3o+hwJVkPprYVbrcMbmW3FAEZNDMpXOKX3jzINi/9suDLmrnWLXbxE7iver/TgwqN/nB6iHd6K1AvhGl+yAA==

package/artifacts/release/dist/enterprise/attestations/bundle/settings.json.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/settings.json",
+      "digest": {
+        "sha256": "70aa3ef36f1f8dbd8417059988047dd5664d9a896000d5dbda8486a94689332c"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T19:41:24.763174+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T19:41:24.763174+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "5032d5f46e94d120",
+    "value": "untrusted comment: signature from omg local signing key\nwKUqy5el6prJ2coeZqD3uZHWN83Iuiu7ntyoMGrTf/8QgGEg8fbnjHDXCmdeLo1y1aYthQ1XzoG+xouUxNRxDw==\ntrusted comment: type=omg-slsa-v1 keyid=5032d5f46e94d120 issued_at=2026-03-11T19:41:24.763285+00:00 artifact=bundle/settings.json sha256=70aa3ef36f1f8dbd8417059988047dd5664d9a896000d5dbda8486a94689332c\nZh3o+hwJVkPprYVbrcMbmW3FAEZNDMpXOKX3jzINi/9suDLmrnWLXbxE7iver/TgwqN/nB6iHd6K1AvhGl+yAA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=5032d5f46e94d120 issued_at=2026-03-11T19:41:24.763285+00:00 artifact=bundle/settings.json sha256=70aa3ef36f1f8dbd8417059988047dd5664d9a896000d5dbda8486a94689332c"
+  }
+}

package/artifacts/release/dist/enterprise/bundle/.agents/skills/omg/AGENTS.fragment.md

@@ -17,10 +17,25 @@ The following paths require tier-gated review before mutation:
 - `.codex/**`
 - `.claude/**`
 
+## Release Audit
+
+Release readiness requires claim and compliance outcomes:
+
+- `claim_judge`
+- `compliance_governor`
+- `execution_primitives`
+Attestation requirements:
+- `registry.verify_artifact.sign_artifact_statement`
+- `registry.verify_artifact.verify_artifact_statement`
+
 ## Evidence Contract
 
 Every production action must emit evidence containing these fields:
 
+- `attestation_statement`
+- `attestation_verifier`
+- `claim_judge_verdict`
+- `compliance_verdict`
 - `executor`
 - `lineage`
 - `timestamp`

package/artifacts/release/dist/enterprise/bundle/.agents/skills/omg/control-plane/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: omg-control-plane
-description: "Canonical production control plane bundle for Claude and Codex."
+description: "Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi."
 ---
 
 # OMG Control Plane

package/artifacts/release/dist/enterprise/bundle/.agents/skills/omg/control-plane/openai.yaml

@@ -1,5 +1,5 @@
 name: omg-control-plane
-description: "Canonical production control plane bundle for Claude and Codex."
+description: "Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi."
 allow_implicit_invocation: false
 metadata:
   channel: enterprise

package/artifacts/release/dist/enterprise/bundle/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OMG - Oh-My-God for Claude Code and supported agent hosts",
-    "version": "2.1.4",
+    "version": "2.1.7",
     "homepage": "https://github.com/trac3er00/OMG",
     "repository": "https://github.com/trac3er00/OMG"
   },
@@ -14,7 +14,7 @@
     {
       "name": "omg",
       "description": "OMG plugin layer for Claude Code and supported agent hosts with native setup, orchestration, and interop.",
-      "version": "2.1.4",
+      "version": "2.1.7",
       "source": "./",
       "author": {
         "name": "trac3er00"
@@ -32,5 +32,5 @@
       ]
     }
   ],
-  "version": "2.1.4"
+  "version": "2.1.7"
 }

package/artifacts/release/dist/enterprise/bundle/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg",
-  "version": "2.1.4",
+  "version": "2.1.7",
   "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
   "author": {
     "name": "trac3er00"

package/artifacts/release/dist/enterprise/bundle/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.1.4
+version: 2.1.7
 canonical_hosts:
   - claude
   - codex

package/artifacts/release/dist/enterprise/bundle/plugins/advanced/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-advanced",
-  "version": "2.1.4",
+  "version": "2.1.7",
   "description": "Advanced OMG commands - deep planning, learning, code review, and specialized workflows",
   "type": "omg-plugin",
   "commands": {

package/artifacts/release/dist/enterprise/bundle/registry/bundles/algorithms.yaml

@@ -1,6 +1,6 @@
 id: algorithms
 kind: domain-pack
-version: 2.1.4
+version: 2.1.7
 title: OMG Algorithms Pack
 description: Determinism and benchmark attachments for algorithm-heavy work.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/api-twin.yaml

@@ -1,6 +1,6 @@
 id: api-twin
 kind: simulation
-version: 2.1.4
+version: 2.1.7
 title: OMG API Twin
 description: Versioned endpoint cassette replay with latency, drift, and cost reporting.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/claim-judge.yaml

@@ -1,6 +1,6 @@
 id: claim-judge
 kind: proof
-version: 2.1.4
+version: 2.1.7
 title: OMG Claim Judge
 description: Evidence-backed claim validator for structured release and completion claims.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/control-plane.yaml

@@ -1,11 +1,13 @@
 id: control-plane
 kind: skill
-version: 2.1.4
+version: 2.1.7
 title: OMG Control Plane
-description: Canonical production control plane bundle for Claude and Codex.
+description: Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi.
 hosts:
   - claude
   - codex
+  - gemini
+  - kimi
 assets:
   references:
     - OMG_COMPAT_CONTRACT.md
@@ -109,6 +111,10 @@ policy_model:
     executor: executor
     trace_id: trace_id
     lineage: lineage
+    attestation_statement: attestation_statement
+    attestation_verifier: attestation_verifier
+    claim_judge_verdict: claim_judge_verdict
+    compliance_verdict: compliance_verdict
   host_rules:
     claude:
       compilation_targets:
@@ -144,6 +150,26 @@ policy_model:
       automations:
         - contract-compile
         - release-readiness
+    gemini:
+      compilation_targets:
+        - .gemini/settings.json
+      mcp:
+        - omg-control
+      skills:
+        - omg/control-plane
+      automations:
+        - contract-compile
+        - release-readiness
+    kimi:
+      compilation_targets:
+        - .kimi/mcp.json
+      mcp:
+        - omg-control
+      skills:
+        - omg/control-plane
+      automations:
+        - contract-compile
+        - release-readiness
 channel_overrides:
   public:
     posture: self-serve

package/artifacts/release/dist/enterprise/bundle/registry/bundles/data-lineage.yaml

@@ -1,6 +1,6 @@
 id: data-lineage
 kind: provenance
-version: 2.1.4
+version: 2.1.7
 title: OMG Data Lineage
 description: Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/delta-classifier.yaml

@@ -1,6 +1,6 @@
 id: delta-classifier
 kind: routing
-version: 2.1.4
+version: 2.1.7
 title: OMG Delta Classifier
 description: Change classifier that attaches risk-aware checks, approvals, and packs.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/eval-gate.yaml

@@ -1,6 +1,6 @@
 id: eval-gate
 kind: evaluation
-version: 2.1.4
+version: 2.1.7
 title: OMG Eval Gate
 description: Reproducible evaluation gate that blocks regressions before release.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/health.yaml

@@ -1,6 +1,6 @@
 id: health
 kind: domain-pack
-version: 2.1.4
+version: 2.1.7
 title: OMG Health Pack
 description: Health-sensitive approvals, provenance, and replay attachments.
 hosts: