@trac3er/oh-my-god 2.1.5 → 2.1.8

package/.agents/skills/omg/AGENTS.fragment.md

@@ -17,10 +17,25 @@ The following paths require tier-gated review before mutation:
 - `.codex/**`
 - `.claude/**`
 
+## Release Audit
+
+Release readiness requires claim and compliance outcomes:
+
+- `claim_judge`
+- `compliance_governor`
+- `execution_primitives`
+Attestation requirements:
+- `registry.verify_artifact.sign_artifact_statement`
+- `registry.verify_artifact.verify_artifact_statement`
+
 ## Evidence Contract
 
 Every production action must emit evidence containing these fields:
 
+- `attestation_statement`
+- `attestation_verifier`
+- `claim_judge_verdict`
+- `compliance_verdict`
 - `executor`
 - `lineage`
 - `timestamp`

package/.agents/skills/omg/control-plane/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: omg-control-plane
-description: "Canonical production control plane bundle for Claude and Codex."
+description: "Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi."
 ---
 
 # OMG Control Plane

package/.agents/skills/omg/control-plane/openai.yaml

@@ -1,5 +1,5 @@
 name: omg-control-plane
-description: "Canonical production control plane bundle for Claude and Codex."
+description: "Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi."
 allow_implicit_invocation: false
 metadata:
   channel: enterprise

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OMG - Oh-My-God for Claude Code and supported agent hosts",
-    "version": "2.1.5",
+    "version": "2.1.8",
     "homepage": "https://github.com/trac3er00/OMG",
     "repository": "https://github.com/trac3er00/OMG"
   },
@@ -14,7 +14,7 @@
     {
       "name": "omg",
       "description": "OMG plugin layer for Claude Code and supported agent hosts with native setup, orchestration, and interop.",
-      "version": "2.1.5",
+      "version": "2.1.8",
       "source": "./",
       "author": {
         "name": "trac3er00"
@@ -32,5 +32,5 @@
       ]
     }
   ],
-  "version": "2.1.5"
+  "version": "2.1.8"
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg",
-  "version": "2.1.5",
+  "version": "2.1.8",
   "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
   "author": {
     "name": "trac3er00"

package/.gemini/settings.json

@@ -7,5 +7,61 @@
         "runtime.omg_mcp_server"
       ]
     }
+  },
+  "_omg": {
+    "_version": "2.1.8",
+    "generated": {
+      "contract_version": "2.1.8",
+      "channel": "public",
+      "required_bundles": [
+        "control-plane",
+        "plan-council",
+        "claim-judge",
+        "test-intent-lock",
+        "proof-gate",
+        "hook-governor",
+        "mcp-fabric",
+        "lsp-pack",
+        "secure-worktree-pipeline",
+        "security-check",
+        "api-twin",
+        "preflight",
+        "robotics",
+        "vision",
+        "algorithms",
+        "health",
+        "tracebank",
+        "eval-gate",
+        "delta-classifier",
+        "incident-replay",
+        "data-lineage",
+        "remote-supervisor"
+      ],
+      "phase1_release_contract": {
+        "forge_specialist_surfaces": [
+          "forge-profile-review",
+          "forge-release-audit",
+          "forge-validate"
+        ],
+        "release_surfaces": [
+          "OMG:profile-review",
+          "OMG:release-audit",
+          "OMG:validate"
+        ],
+        "attestation_requirements": [
+          "registry.verify_artifact.sign_artifact_statement",
+          "registry.verify_artifact.verify_artifact_statement"
+        ],
+        "compliance_governor_expectations": [
+          "runtime.compliance_governor.evaluate_release_compliance",
+          "runtime.compliance_governor.evaluate_tool_compliance"
+        ],
+        "release_readiness_checks": [
+          "claim_judge",
+          "compliance_governor",
+          "execution_primitives"
+        ]
+      }
+    }
   }
 }

package/.kimi/mcp.json

@@ -7,5 +7,61 @@
         "runtime.omg_mcp_server"
       ]
     }
+  },
+  "_omg": {
+    "_version": "2.1.8",
+    "generated": {
+      "contract_version": "2.1.8",
+      "channel": "public",
+      "required_bundles": [
+        "control-plane",
+        "plan-council",
+        "claim-judge",
+        "test-intent-lock",
+        "proof-gate",
+        "hook-governor",
+        "mcp-fabric",
+        "lsp-pack",
+        "secure-worktree-pipeline",
+        "security-check",
+        "api-twin",
+        "preflight",
+        "robotics",
+        "vision",
+        "algorithms",
+        "health",
+        "tracebank",
+        "eval-gate",
+        "delta-classifier",
+        "incident-replay",
+        "data-lineage",
+        "remote-supervisor"
+      ],
+      "phase1_release_contract": {
+        "forge_specialist_surfaces": [
+          "forge-profile-review",
+          "forge-release-audit",
+          "forge-validate"
+        ],
+        "release_surfaces": [
+          "OMG:profile-review",
+          "OMG:release-audit",
+          "OMG:validate"
+        ],
+        "attestation_requirements": [
+          "registry.verify_artifact.sign_artifact_statement",
+          "registry.verify_artifact.verify_artifact_statement"
+        ],
+        "compliance_governor_expectations": [
+          "runtime.compliance_governor.evaluate_release_compliance",
+          "runtime.compliance_governor.evaluate_tool_compliance"
+        ],
+        "release_readiness_checks": [
+          "claim_judge",
+          "compliance_governor",
+          "execution_primitives"
+        ]
+      }
+    }
   }
 }

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+## 2.1.8 - 2026-03-11
+
+- fixed `/OMG:deep-plan` 404 by adding missing root compatibility stub routing to canonical plan-council bundle
+- added manifest-driven release readiness gate that audits plugin command source paths against manifests and fails fast on missing files
+- removed hard-coded artifact constant; advanced plugin artifacts now derived dynamically from `plugins/advanced/plugin.json`
+- purged all `2.1.1` version residue from scripts, docs, CI workflows, and tests; tightened identity validation to strict exit-code 0
+- added proof-backed compliance governor as single precedence authority over tool-plan gating, claim-judge verdicts, and artifact trust checks
+- added deterministic forge run contracts with explicit seed derivation and replay validation
+- shipped local-first agentic storage foundation with SQLite/FTS5 full-text search and adjacency-table lineage
+- added HMAC-SHA256 offline signed artifact attestation; release promotion gate now blocks unsigned artifacts
+- added sandboxed Forge runner with explicit time, cost, GPU, and network budget enforcement per run
+- shipped live Axolotl adapter with SFT/GRPO/GDPO modes, bounded hyperparameter search, and LoRA double-stacking guards
+- added live simulator backends for PyBullet, Gazebo, and Isaac Gym with CPU-only mock for CI environments
+- replaced simulated Forge pipeline outcomes with live evidence; `simulated_metric` fully removed as success criterion
+- added buffet preset as canonical configuration with single source of truth across setup, runtime, and config; includes `NOTEBOOKLM` and `COUNCIL_ROUTING` flags
+- added bounded session health auto-actions (pause, reflect, warn, require-review) with explicit evidence persistence
+- extended host-parity compiler with claim-judge and compliance governor in release audit; Gemini and Kimi added as canonical hosts
+- expanded 5 evidence profiles (browser-flow, forge-cybersecurity, interop-diagnosis, install-validation, buffet) with concrete non-placeholder data
+
 ## 2.1.5 - 2026-03-09
 
 - shipped Forge v0.3 as the flagship feature
@@ -16,7 +35,7 @@
 - bump authored release identity to 2.1.4 across all 42 authored surfaces
 - refresh compat contract snapshot
 
-## 2.1.1 - 2026-03-08
+## [historical] 2.1.x - 2026-03-08
 
 - shipped strict TDD-or-die enforcement: locked-tests-first mutation lifecycle with hard gate via `OMG_TDD_GATE_STRICT`, stop-dispatcher lock enforcement, waiver evidence requirement, and release-blocking proof chain
 - delivered granular per-interaction undo/rollback: `restore_shadow_entry` in shadow manager, rollback manifest schema with compensating actions for reversible external side effects, and `omg undo` CLI wired end-to-end

package/CLI-ADAPTER-MAP.md

@@ -162,7 +162,7 @@ OMG supports 4 canonical CLI targets with dedicated provider implementations and
   - `~/.claude/settings.json` → `enabledPlugins[plugin_ref] = true`
   - `~/.claude/plugins/installed_plugins.json` → Plugin metadata with installed path, version, timestamp
 - **Plugin Ref Format:** `omg@omg` (name@marketplace_id)
-- **Version:** `2.1.5` (from package.json)
+- **Version:** `2.1.8` (from package.json)
 
 #### C. Plugin Unregistration (Lines 631-669)
 - **Function:** `unregister_plugin_from_registry(plugin_ref)`
@@ -206,7 +206,7 @@ OMG supports 4 canonical CLI targets with dedicated provider implementations and
 ```json
 {
   "name": "@trac3er/oh-my-god",
-  "version": "2.1.5",
+  "version": "2.1.8",
   "scripts": {
     "postinstall": "./OMG-setup.sh install --non-interactive",
     "update": "./OMG-setup.sh update",
@@ -238,7 +238,7 @@ CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.1.5"
+CANONICAL_VERSION = "2.1.8"
 ```
 
 ---

package/OMG-setup.sh

@@ -5,7 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 BACKUP_TS="$(date +%Y%m%d_%H%M%S)"
 BACKUP_DIR="$CLAUDE_DIR/.omg-backup-$BACKUP_TS"
-VERSION="2.1.5"
+VERSION="2.1.8"
 
 PLUGIN_NAME="omg"
 PLUGIN_MARKETPLACE="omg"

package/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.1.5
+version: 2.1.8
 canonical_hosts:
   - claude
   - codex

package/README.md

@@ -6,6 +6,61 @@
 
 OMG upgrades your agent host instead of replacing it. It gives Claude Code, Codex, and other supported CLIs a tighter setup flow, stronger orchestration, native adoption from older plugin stacks, and proof-backed verification.
 
+## The Problem
+
+Agent hosts like Claude Code and Codex are powerful but lack governance, mutation safety, and evidence-backed verification. They often operate in a "trust me" mode where changes happen without a clear audit trail or safety gates. This leads to risky mutations, lack of interoperability between different agent stacks, and difficulty in verifying that a task was actually completed correctly.
+
+## The Solution
+
+OMG (Oh My OpenCode) provides a governance and orchestration layer that sits on top of existing agent hosts. It introduces:
+
+- **Hooks**: Pre-tool and post-tool execution gates for security and validation.
+- **Governance Payload**: Structured metadata for every action.
+- **Mutation Gate**: Prevents or warns about risky file system changes.
+- **Session Health**: Monitors the state of the session and requires review for risky states.
+- **Forge**: A modular orchestration engine for complex tasks.
+- **Memory**: A secure, namespaced, and encrypted state store.
+- **Evidence-Backed Verification**: Machine-generated proof for every claim.
+
+## Real-World Example
+
+Imagine an agent trying to delete a critical configuration file. Without OMG, the agent might just do it. With OMG's **Mutation Gate**, the action is intercepted, a warning is generated, and the user is prompted for approval. Or, when an agent claims a feature is "done", OMG's **Claim Judge** and **Proof Gate** require actual test results and build logs as evidence before the claim is accepted.
+
+## Architecture
+
+OMG operates as a middleware layer between the agent host and the underlying tools.
+
+```mermaid
+graph TD
+    Host[Agent Host: Claude Code / Codex] -->|Tool Call| Hooks[OMG Hooks]
+    Hooks -->|Security Check| Security[Security Guard / Firewall]
+    Hooks -->|Governance| ControlPlane[OMG Control Plane]
+    ControlPlane -->|State| Memory[OMG Memory]
+    ControlPlane -->|Verification| Proof[Proof Gate / Claim Judge]
+    ControlPlane -->|Orchestration| Forge[OMG Forge]
+    Hooks -->|Execution| Tool[Actual Tool Execution]
+    Tool -->|Result| Hooks
+    Hooks -->|Evidence| Proof
+```
+
+## Comparison
+
+| Feature | Raw Claude Code | Superpowers | OMG |
+| :--- | :---: | :---: | :---: |
+| **Governance** | Minimal | Plugin-based | Native Control Plane |
+| **Mutation Safety** | Basic | None | Hard Gates + Warnings |
+| **Verification** | Manual | None | Evidence-Backed Proof |
+| **Interoperability** | Single Host | Multi-Host | Universal MCP + Registry |
+| **State Management** | Volatile | Local Files | Encrypted + Namespaced |
+| **Orchestration** | Linear | Scripted | Modular Forge |
+
+## Limitations
+
+- **Not a Base Model**: OMG does not train or provide its own LLMs; it orchestrates existing ones.
+- **Local-Only**: Designed for same-machine production; no cloud-sync for state by design.
+- **Advisory-First**: In v1, many gates are advisory (warnings) rather than hard-blocking to avoid breaking workflows.
+- **Host Dependent**: Capabilities are limited by what the underlying agent host supports.
+
 - Brand: `OMG`
 - Repo: `https://github.com/trac3er00/OMG`
 - npm: `@trac3er/oh-my-god`
@@ -111,6 +166,7 @@ Compatibility references to OMC, OMX, and Superpowers are documented here: [docs
 Current local verification for this release: See `.omg/evidence/` for machine-generated verification artifacts.
 
 - Truth bundles: `claim-judge`, `test-intent-lock`, `proof-gate`
+- Evidence profiles: `browser-flow`, `forge-cybersecurity`, `interop-diagnosis`, `install-validation`, `buffet`
 - Verification and provider matrix: [docs/proof.md](docs/proof.md)
 - Sample setup transcript: [docs/transcripts/setup.md](docs/transcripts/setup.md)
 - Sample crazy transcript: [docs/transcripts/crazy.md](docs/transcripts/crazy.md)

package/RELEASING.md

@@ -0,0 +1,83 @@
+# Releasing OMG
+
+This document covers the release procedure and golden rules for publishing new versions of OMG.
+
+## Golden Rules
+
+1. **Never delete a published GitHub release.** GitHub marks deleted releases as immutable ghosts. The tag name becomes permanently locked — you cannot re-create a release or tag with the same name. If you delete a release by accident, you must bump the version number and release under the new version.
+
+2. **Always run `pre-release-check.sh` before releasing.** This script verifies that the target tag name is not locked by an immutable release ghost and that no conflicting tag already exists on the remote.
+
+   ```bash
+   ./scripts/pre-release-check.sh <version> [repo]
+   # Example:
+   ./scripts/pre-release-check.sh 2.1.8 trac3er00/OMG
+   ```
+
+3. **If a tag is locked by an immutable release**, you have two options:
+   - **Bump the version** — increment the patch (or minor/major) version and release under the new number. This is the recommended and fastest path.
+   - **Contact GitHub Support** at https://support.github.com — they may be able to clear the immutable lock, but this can take days and is not guaranteed.
+
+## Release Procedure
+
+### 1. Bump version surfaces
+
+Edit the canonical version source and propagate to all surfaces:
+
+```bash
+# 1. Edit runtime/adoption.py — update CANONICAL_VERSION
+# 2. Edit package.json — update "version"
+
+# 3. Sync all authored surfaces
+python3 scripts/sync-release-identity.py
+
+# 4. Compile derived manifests
+python3 scripts/omg.py contract compile --host claude --host codex --channel public
+python3 scripts/omg.py contract compile --host claude --host codex --channel enterprise
+python3 scripts/omg.py contract compile --host claude --host codex --channel public --output-root artifacts/release
+python3 scripts/omg.py contract compile --host claude --host codex --channel enterprise --output-root artifacts/release
+
+# 5. Rebuild Python package
+python3 -m build --wheel
+
+# 6. Manually update .gemini/settings.json and .kimi/mcp.json
+#    Set _omg._version and _omg.generated.contract_version to the new version
+```
+
+> **WARNING:** Do NOT pass `--output-root dist` to the compile command — it creates `dist/dist/` double-nesting. Only use `--output-root artifacts/release` for release artifact outputs.
+
+### 2. Validate
+
+```bash
+python3 scripts/validate-release-identity.py --scope all
+pytest tests/test_version_gate.py -v
+```
+
+Both must exit 0 before proceeding.
+
+### 3. Pre-release safety check
+
+```bash
+./scripts/pre-release-check.sh <version>
+```
+
+### 4. Commit and push
+
+```bash
+git add -A
+git commit -m "chore(release): bump to v<version> and sync all surfaces"
+git push origin main
+```
+
+### 5. Publish
+
+Trigger the `Publish to npm` workflow via GitHub Actions workflow dispatch, or push a `v*.*.*` tag. The workflow includes an automatic pre-release tag safety check that will fail fast if the tag is locked.
+
+## Troubleshooting
+
+| Problem | Solution |
+|---------|----------|
+| `tag_name was used by an immutable release` | Bump the version number. The old tag is permanently locked. |
+| `validate-release-identity.py` fails | Run the fix sequence shown in the error output. |
+| `dist/dist/` double-nesting | You passed `--output-root dist`. Re-run without that flag. |
+| `.gemini` or `.kimi` version mismatch | These are not tracked by `sync-release-identity.py` — update manually. |

package/artifacts/release/.agents/skills/omg/AGENTS.fragment.md

@@ -17,10 +17,25 @@ The following paths require tier-gated review before mutation:
 - `.codex/**`
 - `.claude/**`
 
+## Release Audit
+
+Release readiness requires claim and compliance outcomes:
+
+- `claim_judge`
+- `compliance_governor`
+- `execution_primitives`
+Attestation requirements:
+- `registry.verify_artifact.sign_artifact_statement`
+- `registry.verify_artifact.verify_artifact_statement`
+
 ## Evidence Contract
 
 Every production action must emit evidence containing these fields:
 
+- `attestation_statement`
+- `attestation_verifier`
+- `claim_judge_verdict`
+- `compliance_verdict`
 - `executor`
 - `lineage`
 - `timestamp`

package/artifacts/release/.agents/skills/omg/control-plane/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: omg-control-plane
-description: "Canonical production control plane bundle for Claude and Codex."
+description: "Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi."
 ---
 
 # OMG Control Plane

package/artifacts/release/.agents/skills/omg/control-plane/openai.yaml

@@ -1,5 +1,5 @@
 name: omg-control-plane
-description: "Canonical production control plane bundle for Claude and Codex."
+description: "Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi."
 allow_implicit_invocation: false
 metadata:
   channel: enterprise

package/artifacts/release/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OMG - Oh-My-God for Claude Code and supported agent hosts",
-    "version": "2.1.5",
+    "version": "2.1.8",
     "homepage": "https://github.com/trac3er00/OMG",
     "repository": "https://github.com/trac3er00/OMG"
   },
@@ -14,7 +14,7 @@
     {
       "name": "omg",
       "description": "OMG plugin layer for Claude Code and supported agent hosts with native setup, orchestration, and interop.",
-      "version": "2.1.5",
+      "version": "2.1.8",
       "source": "./",
       "author": {
         "name": "trac3er00"
@@ -32,5 +32,5 @@
       ]
     }
   ],
-  "version": "2.1.5"
+  "version": "2.1.8"
 }

package/artifacts/release/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg",
-  "version": "2.1.5",
+  "version": "2.1.8",
   "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
   "author": {
     "name": "trac3er00"

package/artifacts/release/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.1.5
+version: 2.1.8
 canonical_hosts:
   - claude
   - codex

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/AGENTS.fragment.md.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+5wCknYLSVSjl0M96B+IBeKAScfKoiqapO+NdmpemmUj8FBLstksrI41G7l9dGMHXTXcyq069ugjxuqtq3wWlDg==
+trusted comment: type=omg-slsa-v1 keyid=8380b1f8058c3ca6 issued_at=2026-03-11T20:10:57.146055+00:00 artifact=bundle/.agents/skills/omg/AGENTS.fragment.md sha256=2cf0340fbea7f8f39660ed6e6f7bd0fc3df6e210302c3328915e871b0ac8606d
+EBpb9vB1WhtRnZDP35M/DgN3jutQegWvx+9L1hf1U1xdZgfApnIZP+tkVvTjqDaoJn2fx4BPL5ogDYjcCibhDw==

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/AGENTS.fragment.md.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/.agents/skills/omg/AGENTS.fragment.md",
+      "digest": {
+        "sha256": "2cf0340fbea7f8f39660ed6e6f7bd0fc3df6e210302c3328915e871b0ac8606d"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T20:10:57.141899+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T20:10:57.141899+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "8380b1f8058c3ca6",
+    "value": "untrusted comment: signature from omg local signing key\n5wCknYLSVSjl0M96B+IBeKAScfKoiqapO+NdmpemmUj8FBLstksrI41G7l9dGMHXTXcyq069ugjxuqtq3wWlDg==\ntrusted comment: type=omg-slsa-v1 keyid=8380b1f8058c3ca6 issued_at=2026-03-11T20:10:57.146055+00:00 artifact=bundle/.agents/skills/omg/AGENTS.fragment.md sha256=2cf0340fbea7f8f39660ed6e6f7bd0fc3df6e210302c3328915e871b0ac8606d\nEBpb9vB1WhtRnZDP35M/DgN3jutQegWvx+9L1hf1U1xdZgfApnIZP+tkVvTjqDaoJn2fx4BPL5ogDYjcCibhDw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=8380b1f8058c3ca6 issued_at=2026-03-11T20:10:57.146055+00:00 artifact=bundle/.agents/skills/omg/AGENTS.fragment.md sha256=2cf0340fbea7f8f39660ed6e6f7bd0fc3df6e210302c3328915e871b0ac8606d"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/algorithms/SKILL.md.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+zjfUe9i4eABQkXHiruFdccB0//DT9g4TIlmIli944LUnzA8tCwcFB64mIAFjr2go5qU320odJxyts+kCZ31UAA==
+trusted comment: type=omg-slsa-v1 keyid=c1f52fe0897e24f7 issued_at=2026-03-11T20:10:57.147254+00:00 artifact=bundle/.agents/skills/omg/algorithms/SKILL.md sha256=9f007935886f168e43cd76b69857e81c579f9cce8174e14f9b6b0173739c337d
+NXygCpXmoKdDVjz2E2Nqj1qrYhLGjpScwf5gX/VFZ9tucCbP+Ukf7RlM7sRiB+B6ZRwYjhnpZfz8vqnwafhpDg==

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/algorithms/SKILL.md.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/.agents/skills/omg/algorithms/SKILL.md",
+      "digest": {
+        "sha256": "9f007935886f168e43cd76b69857e81c579f9cce8174e14f9b6b0173739c337d"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T20:10:57.147116+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T20:10:57.147116+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "c1f52fe0897e24f7",
+    "value": "untrusted comment: signature from omg local signing key\nzjfUe9i4eABQkXHiruFdccB0//DT9g4TIlmIli944LUnzA8tCwcFB64mIAFjr2go5qU320odJxyts+kCZ31UAA==\ntrusted comment: type=omg-slsa-v1 keyid=c1f52fe0897e24f7 issued_at=2026-03-11T20:10:57.147254+00:00 artifact=bundle/.agents/skills/omg/algorithms/SKILL.md sha256=9f007935886f168e43cd76b69857e81c579f9cce8174e14f9b6b0173739c337d\nNXygCpXmoKdDVjz2E2Nqj1qrYhLGjpScwf5gX/VFZ9tucCbP+Ukf7RlM7sRiB+B6ZRwYjhnpZfz8vqnwafhpDg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=c1f52fe0897e24f7 issued_at=2026-03-11T20:10:57.147254+00:00 artifact=bundle/.agents/skills/omg/algorithms/SKILL.md sha256=9f007935886f168e43cd76b69857e81c579f9cce8174e14f9b6b0173739c337d"
+  }
+}

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/algorithms/openai.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+E0IehBVjT2JwXX3rRscUQqV3t64UyCb97s7R83TNRSDuKdqijlx1B5h+50rmCCMkZ4vfI3PVUnyZlagutCT9Cg==
+trusted comment: type=omg-slsa-v1 keyid=6f802d7ce27ff088 issued_at=2026-03-11T20:10:57.147940+00:00 artifact=bundle/.agents/skills/omg/algorithms/openai.yaml sha256=879d3b5bcdb3ffa17387eae31634bd5ce7e2695c0e6dd3b478017843a024300d
+SNDEoIyHXxQQbDv5KffwebyEljvjBH1iROIOWLtKEXZnyhWtOqGRAwNyGVIYbial4WB8IkbWve9qNsSVzmG9Dg==

package/artifacts/release/dist/enterprise/attestations/bundle/.agents/skills/omg/algorithms/openai.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/.agents/skills/omg/algorithms/openai.yaml",
+      "digest": {
+        "sha256": "879d3b5bcdb3ffa17387eae31634bd5ce7e2695c0e6dd3b478017843a024300d"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-11T20:10:57.147821+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-11T20:10:57.147821+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "6f802d7ce27ff088",
+    "value": "untrusted comment: signature from omg local signing key\nE0IehBVjT2JwXX3rRscUQqV3t64UyCb97s7R83TNRSDuKdqijlx1B5h+50rmCCMkZ4vfI3PVUnyZlagutCT9Cg==\ntrusted comment: type=omg-slsa-v1 keyid=6f802d7ce27ff088 issued_at=2026-03-11T20:10:57.147940+00:00 artifact=bundle/.agents/skills/omg/algorithms/openai.yaml sha256=879d3b5bcdb3ffa17387eae31634bd5ce7e2695c0e6dd3b478017843a024300d\nSNDEoIyHXxQQbDv5KffwebyEljvjBH1iROIOWLtKEXZnyhWtOqGRAwNyGVIYbial4WB8IkbWve9qNsSVzmG9Dg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=6f802d7ce27ff088 issued_at=2026-03-11T20:10:57.147940+00:00 artifact=bundle/.agents/skills/omg/algorithms/openai.yaml sha256=879d3b5bcdb3ffa17387eae31634bd5ce7e2695c0e6dd3b478017843a024300d"
+  }
+}