@trac3er/oh-my-god 2.1.7 → 2.1.9

package/registry/approval_artifact.py

@@ -7,11 +7,10 @@ from dataclasses import asdict, dataclass
 from pathlib import Path
 from typing import Any
 
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-
 from registry.verify_artifact import (
     _canonical_json,
     _key_id_from_public_key,
+    _load_ed25519_backend,
     _load_trusted_signers,
     _parse_minisign_detached,
     _utc_now,
@@ -126,8 +125,11 @@ def verify_approval_artifact(
     if not isinstance(public_key_b64, str) or not public_key_b64:
         return {"valid": False, "reason": "invalid trusted signer public key"}
     try:
+        _, _, Ed25519PublicKey = _load_ed25519_backend()
         public_key_raw = base64.b64decode(public_key_b64, validate=True)
         public_key = Ed25519PublicKey.from_public_bytes(public_key_raw)
+    except ModuleNotFoundError as exc:
+        return {"valid": False, "reason": str(exc)}
     except Exception:
         return {"valid": False, "reason": "invalid trusted signer public key"}
 

package/registry/bundles/algorithms.yaml

@@ -1,6 +1,6 @@
 id: algorithms
 kind: domain-pack
-version: 2.1.7
+version: 2.1.9
 title: OMG Algorithms Pack
 description: Determinism and benchmark attachments for algorithm-heavy work.
 hosts:

package/registry/bundles/api-twin.yaml

@@ -1,6 +1,6 @@
 id: api-twin
 kind: simulation
-version: 2.1.7
+version: 2.1.9
 title: OMG API Twin
 description: Versioned endpoint cassette replay with latency, drift, and cost reporting.
 hosts:

package/registry/bundles/claim-judge.yaml

@@ -1,6 +1,6 @@
 id: claim-judge
 kind: proof
-version: 2.1.7
+version: 2.1.9
 title: OMG Claim Judge
 description: Evidence-backed claim validator for structured release and completion claims.
 hosts:

package/registry/bundles/control-plane.yaml

@@ -1,6 +1,6 @@
 id: control-plane
 kind: skill
-version: 2.1.7
+version: 2.1.9
 title: OMG Control Plane
 description: Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi.
 hosts:

package/registry/bundles/data-lineage.yaml

@@ -1,6 +1,6 @@
 id: data-lineage
 kind: provenance
-version: 2.1.7
+version: 2.1.9
 title: OMG Data Lineage
 description: Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts.
 hosts:

package/registry/bundles/delta-classifier.yaml

@@ -1,6 +1,6 @@
 id: delta-classifier
 kind: routing
-version: 2.1.7
+version: 2.1.9
 title: OMG Delta Classifier
 description: Change classifier that attaches risk-aware checks, approvals, and packs.
 hosts:

package/registry/bundles/eval-gate.yaml

@@ -1,6 +1,6 @@
 id: eval-gate
 kind: evaluation
-version: 2.1.7
+version: 2.1.9
 title: OMG Eval Gate
 description: Reproducible evaluation gate that blocks regressions before release.
 hosts:

package/registry/bundles/health.yaml

@@ -1,6 +1,6 @@
 id: health
 kind: domain-pack
-version: 2.1.7
+version: 2.1.9
 title: OMG Health Pack
 description: Health-sensitive approvals, provenance, and replay attachments.
 hosts:

package/registry/bundles/hook-governor.yaml

@@ -1,6 +1,6 @@
 id: hook-governor
 kind: governance
-version: 2.1.7
+version: 2.1.9
 title: OMG Hook Governor
 description: Canonical hook ordering, policy reinjection, and protected-path governance.
 hosts:
@@ -39,46 +39,42 @@ lifecycle_hooks:
     - TaskCompleted
 compiled_hooks:
   SessionStart:
-    - command: python3 "$HOME/.claude/hooks/session-start.py"
+    - command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/session-start.py\""
       timeout: 10
   SessionEnd:
-    - command: python3 "$HOME/.claude/hooks/session-end-capture.py"
+    - command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/session-end-capture.py\""
   PreToolUse:
     - matcher: Bash
-      command: python3 "$HOME/.claude/hooks/firewall.py"
+      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/firewall.py\""
       timeout: 10
     - matcher: Read|Write|Edit|MultiEdit
-      command: python3 "$HOME/.claude/hooks/secret-guard.py"
+      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/secret-guard.py\""
       timeout: 10
     - matcher: ""
-      command: python3 "$HOME/.claude/hooks/tdd-gate.py"
-      timeout: 10
-    - matcher: ""
-      command: python3 "$HOME/.claude/hooks/pre-tool-inject.py"
+      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/pre-tool-inject.py\""
   PostToolUse:
     - matcher: Bash
-      command: python3 "$HOME/.claude/hooks/circuit-breaker.py"
+      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/circuit-breaker.py\""
       timeout: 10
     - matcher: Write|Edit|MultiEdit
-      command: python3 "$HOME/.claude/hooks/tool-ledger.py"
+      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/tool-ledger.py\""
       timeout: 10
     - matcher: Write|Edit|MultiEdit
-      command: python3 "$HOME/.claude/hooks/test_generator_hook.py"
+      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/test_generator_hook.py\""
       timeout: 10
     - matcher: ""
-      command: python3 "$HOME/.claude/hooks/budget_governor.py"
+      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/budget_governor.py\""
       timeout: 10
   PostToolUseFailure:
-    - command: python3 "$HOME/.claude/hooks/post-tool-failure.py"
+    - command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/post-tool-failure.py\""
   Stop:
     - matcher: ""
-      command: python3 "$HOME/.claude/hooks/stop_dispatcher.py"
+      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/stop_dispatcher.py\""
       timeout: 90
 feature_dependencies:
   defense-state:
     required_for:
       - hook-governor
-      - tdd-gate
 mcp_contract:
   servers:
     - omg-control

package/registry/bundles/incident-replay.yaml

@@ -1,6 +1,6 @@
 id: incident-replay
 kind: debugging
-version: 2.1.7
+version: 2.1.9
 title: OMG Incident Replay
 description: Replayable bug packs built from logs, failing tests, traces, and diffs.
 hosts:

package/registry/bundles/lsp-pack.yaml

@@ -1,6 +1,6 @@
 id: lsp-pack
 kind: diagnostics
-version: 2.1.7
+version: 2.1.9
 title: OMG LSP Pack
 description: Optional LSP-backed diagnostics and navigation bundle for production verification.
 hosts:

package/registry/bundles/mcp-fabric.yaml

@@ -1,6 +1,6 @@
 id: mcp-fabric
 kind: mcp
-version: 2.1.7
+version: 2.1.9
 title: OMG MCP Fabric
 description: Tools, prompts, resources, and server instructions for the OMG control plane.
 hosts:

package/registry/bundles/plan-council.yaml

@@ -1,6 +1,6 @@
 id: plan-council
 kind: planning
-version: 2.1.7
+version: 2.1.9
 title: OMG Plan Council
 description: Canonical council-style planning bundle for explicit, evidence-backed deep plans.
 hosts:

package/registry/bundles/preflight.yaml

@@ -1,6 +1,6 @@
 id: preflight
 kind: routing
-version: 2.1.7
+version: 2.1.9
 title: OMG Preflight
 description: Repo-aware route selection based on diff, manifests, and classified risk.
 hosts:

package/registry/bundles/proof-gate.yaml

@@ -1,6 +1,6 @@
 id: proof-gate
 kind: proof
-version: 2.1.7
+version: 2.1.9
 title: OMG Proof Gate
 description: Structured release proof gate that binds claims to required evidence artifacts and trace links.
 hosts:

package/registry/bundles/remote-supervisor.yaml

@@ -1,6 +1,6 @@
 id: remote-supervisor
 kind: orchestration
-version: 2.1.7
+version: 2.1.9
 title: OMG Remote Supervisor
 description: Local-only authenticated supervisor sessions for worker orchestration.
 hosts:

package/registry/bundles/robotics.yaml

@@ -1,6 +1,6 @@
 id: robotics
 kind: domain-pack
-version: 2.1.7
+version: 2.1.9
 title: OMG Robotics Pack
 description: Robotics safety policy, replay, and evaluation attachments.
 hosts:

package/registry/bundles/secure-worktree-pipeline.yaml

@@ -1,6 +1,6 @@
 id: secure-worktree-pipeline
 kind: runtime
-version: 2.1.7
+version: 2.1.9
 title: OMG Secure Worktree Pipeline
 description: Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs.
 hosts:

package/registry/bundles/security-check.yaml

@@ -1,6 +1,6 @@
 id: security-check
 kind: security
-version: 2.1.7
+version: 2.1.9
 title: OMG Security Check
 description: Canonical security audit bundle with provenance, trust scoring, and deterministic evidence.
 hosts:

package/registry/bundles/test-intent-lock.yaml

@@ -1,6 +1,6 @@
 id: test-intent-lock
 kind: proof
-version: 2.1.7
+version: 2.1.9
 title: OMG Test Intent Lock
 description: Structured test-delta guard that blocks weakened tests unless explicit override evidence is present.
 hosts:

package/registry/bundles/tracebank.yaml

@@ -1,6 +1,6 @@
 id: tracebank
 kind: evidence
-version: 2.1.7
+version: 2.1.9
 title: OMG Tracebank
 description: Structured plan-to-patch-to-verify trace capture for OMG routes.
 hosts:

package/registry/bundles/vision.yaml

@@ -1,8 +1,8 @@
 id: vision
 kind: domain-pack
-version: 2.1.7
+version: 2.1.9
 title: OMG Vision Pack
-description: Vision-specific lineage, drift, and replay attachments.
+description: Vision-specific OCR, comparison, lineage, drift, and replay attachments.
 hosts:
   - claude
   - codex

package/registry/omg-capability.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
   "title": "OMG Capability Bundle",
-  "version": "2.1.7",
+  "version": "2.1.9",
   "type": "object",
   "required": [
     "id",

package/registry/verify_artifact.py

@@ -11,9 +11,6 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
-from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
-
 
 @dataclass
 class SupplyArtifact:
@@ -33,6 +30,17 @@ _TRUST_ROOT_PATH = Path(__file__).with_name("trusted_signers.json")
 _DEFAULT_DEV_SIGNER_KEY_ID = "1f5fe64ec2f8c901"
 
 
+def _load_ed25519_backend() -> tuple[Any, Any, Any]:
+    try:
+        from cryptography.hazmat.primitives import serialization
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
+    except ModuleNotFoundError as exc:
+        raise ModuleNotFoundError(
+            "cryptography backend unavailable; run OMG setup to provision the managed venv"
+        ) from exc
+    return serialization, Ed25519PrivateKey, Ed25519PublicKey
+
+
 def _utc_now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
@@ -186,6 +194,8 @@ def sign_artifact(
     if len(clean_digest) != 64 or any(ch not in "0123456789abcdef" for ch in clean_digest):
         raise ValueError("subject_digest_must_be_sha256_hex")
 
+    serialization, Ed25519PrivateKey, _ = _load_ed25519_backend()
+
     if signer_private_key:
         private_raw = base64.b64decode(signer_private_key, validate=True)
         if len(private_raw) != 32:
@@ -288,6 +298,11 @@ def sign_artifact_statement(
 
 
 def _verify_ed25519_statement(statement: dict[str, Any]) -> tuple[bool, str]:
+    try:
+        _, _, Ed25519PublicKey = _load_ed25519_backend()
+    except ModuleNotFoundError as exc:
+        return False, str(exc)
+
     key_id = _statement_key_id(statement)
     if not key_id:
         return False, "missing signer key id"

package/runtime/__init__.py

@@ -13,6 +13,8 @@ from .compat import (
     list_omg_skills,
 )
 from .ecosystem import ecosystem_status, list_ecosystem_repos, resolve_ecosystem_selection, sync_ecosystem_repos
+from .vision_artifacts import write_vision_artifacts
+from .vision_jobs import run_vision_job
 
 __all__ = [
     "build_compat_gap_report",
@@ -29,4 +31,6 @@ __all__ = [
     "list_ecosystem_repos",
     "resolve_ecosystem_selection",
     "sync_ecosystem_repos",
+    "run_vision_job",
+    "write_vision_artifacts",
 ]

package/runtime/adoption.py

@@ -12,7 +12,7 @@ CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.1.7"
+CANONICAL_VERSION = "2.1.9"
 
 VALID_ADOPTION_MODES = ("omg-only", "coexist")
 CANONICAL_MODE_NAMES = ("chill", "focused", "exploratory")

package/runtime/cli_provider.py

@@ -2,19 +2,32 @@
 
 from __future__ import annotations
 
+import os
 import subprocess
 from abc import ABC, abstractmethod
 from typing import Any
+from typing import Mapping
 
 
-def _run_tool(cmd: list[str], *, timeout: int = 30) -> subprocess.CompletedProcess[str]:
+def _run_tool(
+    cmd: list[str],
+    *,
+    timeout: int = 30,
+    cwd: str | None = None,
+    env: Mapping[str, str] | None = None,
+) -> subprocess.CompletedProcess[str]:
     """Run an external tool with a mandatory timeout."""
+    proc_env = os.environ.copy()
+    if env:
+        proc_env.update({key: str(value) for key, value in env.items()})
     return subprocess.run(
         cmd,
         capture_output=True,
         text=True,
         check=False,
         timeout=timeout,
+        cwd=cwd,
+        env=proc_env,
     )
 
 
@@ -53,9 +66,16 @@ class CLIProvider(ABC):
     def write_mcp_config(self, server_url: str, server_name: str = "memory-server") -> None:
         """Write or update MCP server configuration for this provider."""
 
-    def run_tool(self, cmd: list[str], *, timeout: int = 30) -> subprocess.CompletedProcess[str]:
+    def run_tool(
+        self,
+        cmd: list[str],
+        *,
+        timeout: int = 30,
+        cwd: str | None = None,
+        env: Mapping[str, str] | None = None,
+    ) -> subprocess.CompletedProcess[str]:
         """Execute subprocess commands via mandatory timeout helper."""
-        return _run_tool(cmd, timeout=timeout)
+        return _run_tool(cmd, timeout=timeout, cwd=cwd, env=env)
 
 
 _PROVIDER_REGISTRY: dict[str, CLIProvider] = {}

package/runtime/compliance_governor.py

@@ -101,7 +101,12 @@ def evaluate_release_compliance(
         }
 
     if not isinstance(release_evidence, dict):
-        return {"status": "blocked", "authority": "artifact", "reason": "no release evidence supplied"}
+        return {
+            "status": "blocked",
+            "authority": "release",
+            "reason": "no release evidence supplied",
+            **artifact_audit,
+        }
 
     raw_claims = release_evidence.get("claims")
     claims = raw_claims if isinstance(raw_claims, list) else []

package/runtime/contract_compiler.py

@@ -764,7 +764,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/user-prompt-submit.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/user-prompt-submit.py"',
                         "timeout": 10,
                     }
                 ],
@@ -775,7 +775,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/firewall.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/firewall.py"',
                         "timeout": 10,
                     }
                 ],
@@ -785,7 +785,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/secret-guard.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/secret-guard.py"',
                         "timeout": 10,
                     }
                 ],
@@ -797,7 +797,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/tool-ledger.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/tool-ledger.py"',
                         "timeout": 10,
                     }
                 ],
@@ -809,7 +809,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/post-tool-failure.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/post-tool-failure.py"',
                     }
                 ],
             }
@@ -819,7 +819,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/instructions-loaded.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/instructions-loaded.py"',
                         "timeout": 10,
                     }
                 ],
@@ -1142,6 +1142,8 @@ def _render_codex_agents_fragment(
     auto_str = ", ".join(codex_automations) if codex_automations else "contract-compile"
     sections.append(f"- Rules: `{rules_str}`")
     sections.append(f"- Automations: `{auto_str}`")
+    sections.append("- Defer to the repo's `AGENTS.md` / `AGENTS.override.md` instruction hierarchy before OMG-specific guidance.")
+    sections.append("- Do not mirror or override Codex built-in slash commands; OMG guidance applies through MCP, skills, and generated rules.")
     sections.append("- Require explicit invocation for protected production planning skills.")
     sections.append("")
 
@@ -1174,6 +1176,11 @@ def _render_codex_rules(
         lines.append(f"- `{skill}`")
     lines.append("")
 
+    lines.append("## Host Interop\n")
+    lines.append("- Respect the repo `AGENTS.md` / `AGENTS.override.md` chain before applying OMG-specific rules.")
+    lines.append("- Keep OMG guidance separate from Codex built-in slash commands.")
+    lines.append("")
+
     lines.append("## Protected Planning Surface\n")
     if protected_planning_skills:
         for skill in protected_planning_skills:

package/runtime/domain_packs.py

@@ -16,7 +16,7 @@ DOMAIN_PACKS: dict[str, dict[str, Any]] = {
     "vision": {
         "name": "vision",
         "required_approvals": [],
-        "required_evidence": ["dataset-provenance", "drift-check"],
+        "required_evidence": ["dataset-provenance", "drift-check", "vision-artifacts"],
         "policy_modules": ["dataset-lineage", "drift-gate"],
         "eval_hooks": ["vision-regression"],
         "replay_hooks": ["incident-replay"],

package/runtime/interaction_journal.py

@@ -310,12 +310,15 @@ class InteractionJournal:
         normalized_run_id = run_id.strip()
         if not normalized_run_id:
             return None
+        fallback = f".omg/evidence/repro-pack-{normalized_run_id}.json"
         try:
             result = build_repro_pack(str(self.project_dir), normalized_run_id)
         except Exception:
-            return None
+            evidence_path = self.project_dir / ".omg" / "evidence" / f"{normalized_run_id}.json"
+            return fallback if evidence_path.exists() else None
         if result.get("status") != "ok":
-            return None
+            evidence_path = self.project_dir / ".omg" / "evidence" / f"{normalized_run_id}.json"
+            return fallback if evidence_path.exists() else None
         path = result.get("path")
         return str(path) if isinstance(path, str) and path else None