@trac3er/oh-my-god 2.1.8 → 2.2.2

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/preflight.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/preflight.yaml",
+      "digest": {
+        "sha256": "eb6342b0dd7c3df68e18800883f4f0109609b602a661610b03949d913409f948"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.623403+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.623403+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "7d0d123ddbc3dbdf",
+    "value": "untrusted comment: signature from omg local signing key\nmCheXmvkAYlP2ObyWPMWa6Uirx28KEFqN5cTOmoeROZCfM5ERFNJ9A153BpjE3N3bd2Lp5d5OMOKhmsutzWiBg==\ntrusted comment: type=omg-slsa-v1 keyid=7d0d123ddbc3dbdf issued_at=2026-03-13T21:11:22.623512+00:00 artifact=bundle/registry/bundles/preflight.yaml sha256=eb6342b0dd7c3df68e18800883f4f0109609b602a661610b03949d913409f948\nF/1p0LKCxSxVUIKYECISccNoR2rEIICPBYjA2GDlmJGNLAiM0B+e37TjxaIkSh4LcxxznKTLdAW/nFFaemkUCA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=7d0d123ddbc3dbdf issued_at=2026-03-13T21:11:22.623512+00:00 artifact=bundle/registry/bundles/preflight.yaml sha256=eb6342b0dd7c3df68e18800883f4f0109609b602a661610b03949d913409f948"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/proof-gate.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+oIVVIjNcrHSJzgAaOMK+HgpG4TEkNyNJp4OPiYuSrzr+WBhDkxnpnuffDqEo6WdU4gLV++qJjZlnu2sRd1/kCQ==
+trusted comment: type=omg-slsa-v1 keyid=68cef69fd11acdd7 issued_at=2026-03-13T21:11:22.624107+00:00 artifact=bundle/registry/bundles/proof-gate.yaml sha256=205c9fe0e96043886b0ad6ad4382e8adb65961898cf7b45b84bb0c53cec132b7
+lwd17vsQw1qFF2K+XwOnzccaebseydgNNLs1FkOxFyHk2KbDx3qPy9iAS6an+/w+k9UMmYxMCEJsHom1LKSVDQ==

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/proof-gate.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/proof-gate.yaml",
+      "digest": {
+        "sha256": "205c9fe0e96043886b0ad6ad4382e8adb65961898cf7b45b84bb0c53cec132b7"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.623996+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.623996+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "68cef69fd11acdd7",
+    "value": "untrusted comment: signature from omg local signing key\noIVVIjNcrHSJzgAaOMK+HgpG4TEkNyNJp4OPiYuSrzr+WBhDkxnpnuffDqEo6WdU4gLV++qJjZlnu2sRd1/kCQ==\ntrusted comment: type=omg-slsa-v1 keyid=68cef69fd11acdd7 issued_at=2026-03-13T21:11:22.624107+00:00 artifact=bundle/registry/bundles/proof-gate.yaml sha256=205c9fe0e96043886b0ad6ad4382e8adb65961898cf7b45b84bb0c53cec132b7\nlwd17vsQw1qFF2K+XwOnzccaebseydgNNLs1FkOxFyHk2KbDx3qPy9iAS6an+/w+k9UMmYxMCEJsHom1LKSVDQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=68cef69fd11acdd7 issued_at=2026-03-13T21:11:22.624107+00:00 artifact=bundle/registry/bundles/proof-gate.yaml sha256=205c9fe0e96043886b0ad6ad4382e8adb65961898cf7b45b84bb0c53cec132b7"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/remote-supervisor.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+BsNQIcTu5xCX+OwI9xFIq2fMbkyvz/+CpXqU/6FjNmqwuHdrBkY2EwAxjgT++eWyg1aPbVv1L6yFxHXztFCFCQ==
+trusted comment: type=omg-slsa-v1 keyid=1ea09f4388394f57 issued_at=2026-03-13T21:11:22.624647+00:00 artifact=bundle/registry/bundles/remote-supervisor.yaml sha256=c5c289534581995ab6c137c8997b093420845cb523259e967fabe78ce016a33a
+fElxnDUF1uK3yshTJZgReQfhTyrESX+OJSVAWWLRNEscEXFjXFWQIorm4fwf6q2q8z2MJmeWK94PvLK+GLcOCA==

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/remote-supervisor.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/remote-supervisor.yaml",
+      "digest": {
+        "sha256": "c5c289534581995ab6c137c8997b093420845cb523259e967fabe78ce016a33a"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.624539+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.624539+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "1ea09f4388394f57",
+    "value": "untrusted comment: signature from omg local signing key\nBsNQIcTu5xCX+OwI9xFIq2fMbkyvz/+CpXqU/6FjNmqwuHdrBkY2EwAxjgT++eWyg1aPbVv1L6yFxHXztFCFCQ==\ntrusted comment: type=omg-slsa-v1 keyid=1ea09f4388394f57 issued_at=2026-03-13T21:11:22.624647+00:00 artifact=bundle/registry/bundles/remote-supervisor.yaml sha256=c5c289534581995ab6c137c8997b093420845cb523259e967fabe78ce016a33a\nfElxnDUF1uK3yshTJZgReQfhTyrESX+OJSVAWWLRNEscEXFjXFWQIorm4fwf6q2q8z2MJmeWK94PvLK+GLcOCA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=1ea09f4388394f57 issued_at=2026-03-13T21:11:22.624647+00:00 artifact=bundle/registry/bundles/remote-supervisor.yaml sha256=c5c289534581995ab6c137c8997b093420845cb523259e967fabe78ce016a33a"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/robotics.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+SAJseVZs3ZYLmdRg1sy1FdSHHDFbhr/StDCX/p0ocDxtcZti6VVb1p/ItPbdXp69p/DklbQctQNOOPMEZoaSAg==
+trusted comment: type=omg-slsa-v1 keyid=a00bf804c419a48d issued_at=2026-03-13T21:11:22.625180+00:00 artifact=bundle/registry/bundles/robotics.yaml sha256=863c5847b561b4fb0705cdaa9d021dec08fd5b2993cf4530a400de5e0f86d76a
+gxF6YKqI0//pAmBXGXhTW1foOqsjf3ADzoubcVwwdxwO4JCsDPv30ZS0ngGCFWs7ACuy75dVzdsng6gvB2RtDg==

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/robotics.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/robotics.yaml",
+      "digest": {
+        "sha256": "863c5847b561b4fb0705cdaa9d021dec08fd5b2993cf4530a400de5e0f86d76a"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.625071+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.625071+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "a00bf804c419a48d",
+    "value": "untrusted comment: signature from omg local signing key\nSAJseVZs3ZYLmdRg1sy1FdSHHDFbhr/StDCX/p0ocDxtcZti6VVb1p/ItPbdXp69p/DklbQctQNOOPMEZoaSAg==\ntrusted comment: type=omg-slsa-v1 keyid=a00bf804c419a48d issued_at=2026-03-13T21:11:22.625180+00:00 artifact=bundle/registry/bundles/robotics.yaml sha256=863c5847b561b4fb0705cdaa9d021dec08fd5b2993cf4530a400de5e0f86d76a\ngxF6YKqI0//pAmBXGXhTW1foOqsjf3ADzoubcVwwdxwO4JCsDPv30ZS0ngGCFWs7ACuy75dVzdsng6gvB2RtDg==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=a00bf804c419a48d issued_at=2026-03-13T21:11:22.625180+00:00 artifact=bundle/registry/bundles/robotics.yaml sha256=863c5847b561b4fb0705cdaa9d021dec08fd5b2993cf4530a400de5e0f86d76a"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/secure-worktree-pipeline.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+UAoF3IEo1vm9ysUBE+3KbWMEnARf+hNFRhmHpFMVHgeveTk6yk4QmW7Zy5uDg1aYfw5UWpJMpJUpra0hqO7qDQ==
+trusted comment: type=omg-slsa-v1 keyid=d56404e89012ed8a issued_at=2026-03-13T21:11:22.625701+00:00 artifact=bundle/registry/bundles/secure-worktree-pipeline.yaml sha256=a906e2ce83028a49d58b74c334e6ba9376a2f3b98501f17515598355e33ddf07
+BdjTXzm2fOHr9VNsCTaA991ZL1mR6SZhWr7eXMbVtsjonvasAxfzsOjeOvf2bAA4S8xmwnAmwCO+YTjcrsiqCA==

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/secure-worktree-pipeline.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/secure-worktree-pipeline.yaml",
+      "digest": {
+        "sha256": "a906e2ce83028a49d58b74c334e6ba9376a2f3b98501f17515598355e33ddf07"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.625594+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.625594+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "d56404e89012ed8a",
+    "value": "untrusted comment: signature from omg local signing key\nUAoF3IEo1vm9ysUBE+3KbWMEnARf+hNFRhmHpFMVHgeveTk6yk4QmW7Zy5uDg1aYfw5UWpJMpJUpra0hqO7qDQ==\ntrusted comment: type=omg-slsa-v1 keyid=d56404e89012ed8a issued_at=2026-03-13T21:11:22.625701+00:00 artifact=bundle/registry/bundles/secure-worktree-pipeline.yaml sha256=a906e2ce83028a49d58b74c334e6ba9376a2f3b98501f17515598355e33ddf07\nBdjTXzm2fOHr9VNsCTaA991ZL1mR6SZhWr7eXMbVtsjonvasAxfzsOjeOvf2bAA4S8xmwnAmwCO+YTjcrsiqCA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=d56404e89012ed8a issued_at=2026-03-13T21:11:22.625701+00:00 artifact=bundle/registry/bundles/secure-worktree-pipeline.yaml sha256=a906e2ce83028a49d58b74c334e6ba9376a2f3b98501f17515598355e33ddf07"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/security-check.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+UKoJANhuiG/jUMGR/FpCbjUNUF4oQKRBYVUb3/nHdoDdxPNoa8dwKyi/1tFm/WRdoZd3xTlAxy5xZatimANfAQ==
+trusted comment: type=omg-slsa-v1 keyid=ba8999e138408311 issued_at=2026-03-13T21:11:22.626226+00:00 artifact=bundle/registry/bundles/security-check.yaml sha256=3594b1fe4491c11f85e9a2bec243bde0661a0d8fca347ebbec7601324311a608
+CNryrCzsOxQxfl4KuxwIo0XzeTnfI+9/aPqILWfqzKWhJmsYrIIKjY2AUzH49omGThr35uUx7pxL1DlX4jynBQ==

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/security-check.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/security-check.yaml",
+      "digest": {
+        "sha256": "3594b1fe4491c11f85e9a2bec243bde0661a0d8fca347ebbec7601324311a608"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.626118+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.626118+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "ba8999e138408311",
+    "value": "untrusted comment: signature from omg local signing key\nUKoJANhuiG/jUMGR/FpCbjUNUF4oQKRBYVUb3/nHdoDdxPNoa8dwKyi/1tFm/WRdoZd3xTlAxy5xZatimANfAQ==\ntrusted comment: type=omg-slsa-v1 keyid=ba8999e138408311 issued_at=2026-03-13T21:11:22.626226+00:00 artifact=bundle/registry/bundles/security-check.yaml sha256=3594b1fe4491c11f85e9a2bec243bde0661a0d8fca347ebbec7601324311a608\nCNryrCzsOxQxfl4KuxwIo0XzeTnfI+9/aPqILWfqzKWhJmsYrIIKjY2AUzH49omGThr35uUx7pxL1DlX4jynBQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=ba8999e138408311 issued_at=2026-03-13T21:11:22.626226+00:00 artifact=bundle/registry/bundles/security-check.yaml sha256=3594b1fe4491c11f85e9a2bec243bde0661a0d8fca347ebbec7601324311a608"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/terminal-lane.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+jcKRxZ9pCSL9GHId8axk/yswKw+l7Bi7TZSQPfRWddWRZydzADgvBuq8joWDWuBrArqYTtrSbAdBwXlVZzUzCA==
+trusted comment: type=omg-slsa-v1 keyid=ff18da8f5f0c90f6 issued_at=2026-03-13T21:11:22.627415+00:00 artifact=bundle/registry/bundles/terminal-lane.yaml sha256=518c2e3ebe6da4986ea92d47ac0152f37453becc5b5779f9b1dcde84593c53f7
+9Vwi1FigZRRIwSK4QBy3nFW4vALTMACOnWUe/9d+sgDFDiPgFT8FMhplAxKTSPN3armnNNhA9QJ8NvOtwGp1CQ==

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/terminal-lane.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/terminal-lane.yaml",
+      "digest": {
+        "sha256": "518c2e3ebe6da4986ea92d47ac0152f37453becc5b5779f9b1dcde84593c53f7"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.627245+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.627245+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "ff18da8f5f0c90f6",
+    "value": "untrusted comment: signature from omg local signing key\njcKRxZ9pCSL9GHId8axk/yswKw+l7Bi7TZSQPfRWddWRZydzADgvBuq8joWDWuBrArqYTtrSbAdBwXlVZzUzCA==\ntrusted comment: type=omg-slsa-v1 keyid=ff18da8f5f0c90f6 issued_at=2026-03-13T21:11:22.627415+00:00 artifact=bundle/registry/bundles/terminal-lane.yaml sha256=518c2e3ebe6da4986ea92d47ac0152f37453becc5b5779f9b1dcde84593c53f7\n9Vwi1FigZRRIwSK4QBy3nFW4vALTMACOnWUe/9d+sgDFDiPgFT8FMhplAxKTSPN3armnNNhA9QJ8NvOtwGp1CQ==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=ff18da8f5f0c90f6 issued_at=2026-03-13T21:11:22.627415+00:00 artifact=bundle/registry/bundles/terminal-lane.yaml sha256=518c2e3ebe6da4986ea92d47ac0152f37453becc5b5779f9b1dcde84593c53f7"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/test-intent-lock.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+KEIDliiHDCkOip37zc2GIuXqfdXtlcL8T2cdTNg/3+01b24CKNNFBT+cjXFR9FntLQ3GGhNvdwxnXYzhoKR+DQ==
+trusted comment: type=omg-slsa-v1 keyid=fb3d98e65fe31654 issued_at=2026-03-13T21:11:22.628182+00:00 artifact=bundle/registry/bundles/test-intent-lock.yaml sha256=1bc9e631dda5fac529f49af66343caf25295cf68027127e1b5662d8f8faeb81e
+wTdsNp5YiG/Y71GJk9735o6vX9H5S96uh197LPAOPitRiSGUcsNSh05RrKPx48PuEXYgWkvn9/48c+1HJe8SAA==

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/test-intent-lock.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/test-intent-lock.yaml",
+      "digest": {
+        "sha256": "1bc9e631dda5fac529f49af66343caf25295cf68027127e1b5662d8f8faeb81e"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.628058+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.628058+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "fb3d98e65fe31654",
+    "value": "untrusted comment: signature from omg local signing key\nKEIDliiHDCkOip37zc2GIuXqfdXtlcL8T2cdTNg/3+01b24CKNNFBT+cjXFR9FntLQ3GGhNvdwxnXYzhoKR+DQ==\ntrusted comment: type=omg-slsa-v1 keyid=fb3d98e65fe31654 issued_at=2026-03-13T21:11:22.628182+00:00 artifact=bundle/registry/bundles/test-intent-lock.yaml sha256=1bc9e631dda5fac529f49af66343caf25295cf68027127e1b5662d8f8faeb81e\nwTdsNp5YiG/Y71GJk9735o6vX9H5S96uh197LPAOPitRiSGUcsNSh05RrKPx48PuEXYgWkvn9/48c+1HJe8SAA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=fb3d98e65fe31654 issued_at=2026-03-13T21:11:22.628182+00:00 artifact=bundle/registry/bundles/test-intent-lock.yaml sha256=1bc9e631dda5fac529f49af66343caf25295cf68027127e1b5662d8f8faeb81e"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/tracebank.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+53CdkIDlWjc+tQIUOowYOKylZw4f3Snj2XG21NeqeMTz0cf1fUzYyltYp2+jbj7Ddw/R4uTdvSZ8Z2d5dvnEBg==
+trusted comment: type=omg-slsa-v1 keyid=6b775388d3f60dbb issued_at=2026-03-13T21:11:22.628790+00:00 artifact=bundle/registry/bundles/tracebank.yaml sha256=ee1a5e9eee8d2a10730c002b71c4bb12ba1316c1bb167b54adbdba9f264d9d0b
+dA0wVA1znyc9sXQUR/4EcS1lkVZtoBcGNSWJ2izsn3KN61NWgMMjnzWEpmD5Qr79ODj1ezTE98CEM1KfNA5bBw==

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/tracebank.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/tracebank.yaml",
+      "digest": {
+        "sha256": "ee1a5e9eee8d2a10730c002b71c4bb12ba1316c1bb167b54adbdba9f264d9d0b"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.628675+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.628675+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "6b775388d3f60dbb",
+    "value": "untrusted comment: signature from omg local signing key\n53CdkIDlWjc+tQIUOowYOKylZw4f3Snj2XG21NeqeMTz0cf1fUzYyltYp2+jbj7Ddw/R4uTdvSZ8Z2d5dvnEBg==\ntrusted comment: type=omg-slsa-v1 keyid=6b775388d3f60dbb issued_at=2026-03-13T21:11:22.628790+00:00 artifact=bundle/registry/bundles/tracebank.yaml sha256=ee1a5e9eee8d2a10730c002b71c4bb12ba1316c1bb167b54adbdba9f264d9d0b\ndA0wVA1znyc9sXQUR/4EcS1lkVZtoBcGNSWJ2izsn3KN61NWgMMjnzWEpmD5Qr79ODj1ezTE98CEM1KfNA5bBw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=6b775388d3f60dbb issued_at=2026-03-13T21:11:22.628790+00:00 artifact=bundle/registry/bundles/tracebank.yaml sha256=ee1a5e9eee8d2a10730c002b71c4bb12ba1316c1bb167b54adbdba9f264d9d0b"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/vision.yaml.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+2dfGv3CRnfmLpjxp1HdlgfB9DLYhWdbt++YdnXbk1xZKEFVHS1VIECERvIduDzGEiD1qjZGfr84KviH15DruAA==
+trusted comment: type=omg-slsa-v1 keyid=9ae6195d30b1e36c issued_at=2026-03-13T21:11:22.629381+00:00 artifact=bundle/registry/bundles/vision.yaml sha256=3e64993127e45e5b2899736368dc60c848d307b11f21450dc0d410b2cf615842
+gLQ+wP2T7huKcbUjn8voZydNRYOs2H4vRyoI3R+iMzh8X7YRJnALqGMGaGMW0rldojEj4EmmBVddQBSHlx7iBA==

package/artifacts/public/dist/public/attestations/bundle/registry/bundles/vision.yaml.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/bundles/vision.yaml",
+      "digest": {
+        "sha256": "3e64993127e45e5b2899736368dc60c848d307b11f21450dc0d410b2cf615842"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.629266+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.629266+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "9ae6195d30b1e36c",
+    "value": "untrusted comment: signature from omg local signing key\n2dfGv3CRnfmLpjxp1HdlgfB9DLYhWdbt++YdnXbk1xZKEFVHS1VIECERvIduDzGEiD1qjZGfr84KviH15DruAA==\ntrusted comment: type=omg-slsa-v1 keyid=9ae6195d30b1e36c issued_at=2026-03-13T21:11:22.629381+00:00 artifact=bundle/registry/bundles/vision.yaml sha256=3e64993127e45e5b2899736368dc60c848d307b11f21450dc0d410b2cf615842\ngLQ+wP2T7huKcbUjn8voZydNRYOs2H4vRyoI3R+iMzh8X7YRJnALqGMGaGMW0rldojEj4EmmBVddQBSHlx7iBA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=9ae6195d30b1e36c issued_at=2026-03-13T21:11:22.629381+00:00 artifact=bundle/registry/bundles/vision.yaml sha256=3e64993127e45e5b2899736368dc60c848d307b11f21450dc0d410b2cf615842"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/registry/omg-capability.schema.json.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+09Etj8V8qxdwyTmOZjKrAxyFnzstjOkRTHVcaiaV3SUMW6pmuaCFgeyRuffC2QV68p0O99sX63M9z7uLldFtAQ==
+trusted comment: type=omg-slsa-v1 keyid=d1eb66dc0053247a issued_at=2026-03-13T21:11:22.629936+00:00 artifact=bundle/registry/omg-capability.schema.json sha256=ec9ef7f547774e9a5c8089695290bea10c351128a61b4fa09c108934acb64523
+I8xSOTo71prWR1Uh7FIsiSoxyKRGxPCqhYtx7yNt9YON3j7NSIyDMT0kKiH5QsacfHTqLT0RWHLon61FRgHFDw==

package/artifacts/public/dist/public/attestations/bundle/registry/omg-capability.schema.json.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/registry/omg-capability.schema.json",
+      "digest": {
+        "sha256": "ec9ef7f547774e9a5c8089695290bea10c351128a61b4fa09c108934acb64523"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.629827+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.629827+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "d1eb66dc0053247a",
+    "value": "untrusted comment: signature from omg local signing key\n09Etj8V8qxdwyTmOZjKrAxyFnzstjOkRTHVcaiaV3SUMW6pmuaCFgeyRuffC2QV68p0O99sX63M9z7uLldFtAQ==\ntrusted comment: type=omg-slsa-v1 keyid=d1eb66dc0053247a issued_at=2026-03-13T21:11:22.629936+00:00 artifact=bundle/registry/omg-capability.schema.json sha256=ec9ef7f547774e9a5c8089695290bea10c351128a61b4fa09c108934acb64523\nI8xSOTo71prWR1Uh7FIsiSoxyKRGxPCqhYtx7yNt9YON3j7NSIyDMT0kKiH5QsacfHTqLT0RWHLon61FRgHFDw==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=d1eb66dc0053247a issued_at=2026-03-13T21:11:22.629936+00:00 artifact=bundle/registry/omg-capability.schema.json sha256=ec9ef7f547774e9a5c8089695290bea10c351128a61b4fa09c108934acb64523"
+  }
+}

package/artifacts/public/dist/public/attestations/bundle/settings.json.minisig

@@ -0,0 +1,4 @@
+untrusted comment: signature from omg local signing key
+JMIARktrsOqEe+Y8CrtJVXwq94ktkrrDqGlzZSvZ966qhRcNHATChtfvcC6rSxmJknNvJv+H7P5bsVlfiS/gDQ==
+trusted comment: type=omg-slsa-v1 keyid=89debae9e5009a6b issued_at=2026-03-13T21:11:22.630588+00:00 artifact=bundle/settings.json sha256=4711dac8c968ccd8e9e80336fa0bf9fc331e53dca42aed6d2814429b018383b6
+M3KOjKw/Sn+ck0/LCZ+J3euWeCp6vxJ+qWGwO0rsYy+D4bMQ6xQHaAFhvfa4z09M6iFpFag2g1ttgustRN5rAA==

package/artifacts/public/dist/public/attestations/bundle/settings.json.statement.json

@@ -0,0 +1,35 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "bundle/settings.json",
+      "digest": {
+        "sha256": "4711dac8c968ccd8e9e80336fa0bf9fc331e53dca42aed6d2814429b018383b6"
+      }
+    }
+  ],
+  "predicate": {
+    "buildType": "https://omg.security/offline-attestation/v1",
+    "metadata": {
+      "signer": {
+        "keyid": "1f5fe64ec2f8c901",
+        "algorithm": "ed25519-minisign",
+        "mode": "local-offline"
+      },
+      "timestamp": "2026-03-13T21:11:22.630422+00:00"
+    }
+  },
+  "signer": {
+    "keyid": "1f5fe64ec2f8c901",
+    "algorithm": "ed25519-minisign",
+    "mode": "local-offline"
+  },
+  "issued_at": "2026-03-13T21:11:22.630422+00:00",
+  "signature": {
+    "alg": "ed25519-minisign",
+    "keyid": "89debae9e5009a6b",
+    "value": "untrusted comment: signature from omg local signing key\nJMIARktrsOqEe+Y8CrtJVXwq94ktkrrDqGlzZSvZ966qhRcNHATChtfvcC6rSxmJknNvJv+H7P5bsVlfiS/gDQ==\ntrusted comment: type=omg-slsa-v1 keyid=89debae9e5009a6b issued_at=2026-03-13T21:11:22.630588+00:00 artifact=bundle/settings.json sha256=4711dac8c968ccd8e9e80336fa0bf9fc331e53dca42aed6d2814429b018383b6\nM3KOjKw/Sn+ck0/LCZ+J3euWeCp6vxJ+qWGwO0rsYy+D4bMQ6xQHaAFhvfa4z09M6iFpFag2g1ttgustRN5rAA==",
+    "trusted_comment": "type=omg-slsa-v1 keyid=89debae9e5009a6b issued_at=2026-03-13T21:11:22.630588+00:00 artifact=bundle/settings.json sha256=4711dac8c968ccd8e9e80336fa0bf9fc331e53dca42aed6d2814429b018383b6"
+  }
+}

package/artifacts/public/dist/public/bundle/.agents/skills/omg/AGENTS.fragment.md

@@ -0,0 +1,75 @@
+# OMG Codex Governance (channel: public)
+
+## Build & Test
+
+```bash
+python3 -m pytest tests -q
+python3 scripts/omg.py contract validate
+python3 scripts/omg.py contract compile --host codex --channel public
+```
+
+## Protected Paths
+
+The following paths require tier-gated review before mutation:
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Release Audit
+
+Release readiness requires claim and compliance outcomes:
+
+- `claim_judge`
+- `compliance_governor`
+- `execution_primitives`
+Attestation requirements:
+- `registry.verify_artifact.sign_artifact_statement`
+- `registry.verify_artifact.verify_artifact_statement`
+
+## Evidence Contract
+
+Every production action must emit evidence containing these fields:
+
+- `attestation_statement`
+- `attestation_verifier`
+- `claim_judge_verdict`
+- `compliance_verdict`
+- `executor`
+- `lineage`
+- `timestamp`
+- `trace_id`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Protected Planning Surface
+
+Council planning skills are protected and explicit-invocation only:
+
+- `omg/plan-council`
+
+## Web Search Policy
+
+- Prefer cached results over live network requests.
+- Do NOT initiate live web searches unless explicitly instructed.
+- Use `context7` or local documentation before external lookups.
+- Set `cached_web_search: prefer_cached` as the default.
+
+## Approval Constraints
+
+- Destructive file operations require explicit user approval.
+- `git push --force` and branch deletions require explicit approval.
+- Production deployments require explicit approval.
+- Mutations to protected paths require tier-gated approval.
+
+## Rules & Automations
+
+- Rules: `protected_paths, explicit_invocation`
+- Automations: `contract-compile, release-readiness`
+- Defer to the repo's `AGENTS.md` / `AGENTS.override.md` instruction hierarchy before OMG-specific guidance.
+- Do not mirror or override Codex built-in slash commands; OMG guidance applies through MCP, skills, and generated rules.
+- Require explicit invocation for protected production planning skills.

package/artifacts/public/dist/public/bundle/.agents/skills/omg/algorithms/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-algorithms
+description: "Determinism and benchmark attachments for algorithm-heavy work."
+---
+
+# OMG Algorithms Pack
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evals/latest.json`

package/artifacts/public/dist/public/bundle/.agents/skills/omg/algorithms/openai.yaml

@@ -0,0 +1,11 @@
+name: omg-algorithms
+description: "Determinism and benchmark attachments for algorithm-heavy work."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: algorithms
+  title: "OMG Algorithms Pack"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"

package/artifacts/public/dist/public/bundle/.agents/skills/omg/api-twin/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-api-twin
+description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
+---
+
+# OMG API Twin
+
+- Channel: `public`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/state/api_twin.json`

package/artifacts/public/dist/public/bundle/.agents/skills/omg/api-twin/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-api-twin
+description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
+allow_implicit_invocation: false
+metadata:
+  channel: public
+  bundle_id: api-twin
+  title: "OMG API Twin"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Bash(python3:*)"