@trac3er/oh-my-god 2.1.9 → 2.2.3

package/artifacts/release/dist/enterprise/bundle/registry/bundles/data-lineage.yaml

@@ -1,6 +1,6 @@
 id: data-lineage
 kind: provenance
-version: 2.1.9
+version: 2.2.3
 title: OMG Data Lineage
 description: Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/delta-classifier.yaml

@@ -1,6 +1,6 @@
 id: delta-classifier
 kind: routing
-version: 2.1.9
+version: 2.2.3
 title: OMG Delta Classifier
 description: Change classifier that attaches risk-aware checks, approvals, and packs.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/eval-gate.yaml

@@ -1,6 +1,6 @@
 id: eval-gate
 kind: evaluation
-version: 2.1.9
+version: 2.2.3
 title: OMG Eval Gate
 description: Reproducible evaluation gate that blocks regressions before release.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/hash-edit.yaml

@@ -0,0 +1,73 @@
+id: hash-edit
+kind: governance
+version: 2.2.3
+title: OMG Hash Edit Lane
+description: Governed hash-bound edit lane with signed approvals and evidence routing.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/tool_fabric.py
+    - registry/approval_artifact.py
+invocation_policy:
+  user_invocable: true
+  model_invocable: true
+  allow_implicit_invocation: false
+tool_policy:
+  side_effect_level: medium
+  allowed_tools:
+    claude:
+      - Edit
+    codex:
+      - Edit
+lifecycle_hooks:
+  native:
+    - PreToolUse
+    - PostToolUse
+  emulated:
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - python
+    - typescript
+evidence_outputs:
+  artifacts:
+    - .omg/evidence/hash-edit-{run_id}.json
+execution_contract:
+  modes:
+    - embedded
+    - local_supervisor
+tool_fabric:
+  lane: hash-edit
+  enforcement_order:
+    - tool_selection
+    - approval_state
+    - evidence_requirements
+    - attestation_proof_validation
+    - execution
+  tools:
+    - Edit
+  semantic_operations:
+    - name: single_file_hash_edit
+      tool: Edit
+      mutation_capable: true
+      requires_explicit_promotion: false
+  requires_signed_approval: true
+  requires_signed_approval_for_mutation: true
+  requires_attestation: false
+  requires_attestation_for_mutation: true
+  single_file_hash_bound: true
+  require_run_scoped_evidence: true
+  require_fresh_evidence: true
+  evidence_max_age_seconds: 3600
+  required_evidence:
+    - .omg/evidence/hash-edit-{run_id}.json
+channel_overrides:
+  public:
+    posture: advisory
+  enterprise:
+    posture: managed

package/artifacts/release/dist/enterprise/bundle/registry/bundles/health.yaml

@@ -1,6 +1,6 @@
 id: health
 kind: domain-pack
-version: 2.1.9
+version: 2.2.3
 title: OMG Health Pack
 description: Health-sensitive approvals, provenance, and replay attachments.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/hook-governor.yaml

@@ -1,6 +1,6 @@
 id: hook-governor
 kind: governance
-version: 2.1.9
+version: 2.2.3
 title: OMG Hook Governor
 description: Canonical hook ordering, policy reinjection, and protected-path governance.
 hosts:
@@ -39,37 +39,37 @@ lifecycle_hooks:
     - TaskCompleted
 compiled_hooks:
   SessionStart:
-    - command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/session-start.py\""
+    - command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/session-start.py"'
       timeout: 10
   SessionEnd:
-    - command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/session-end-capture.py\""
+    - command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/session-end-capture.py"'
   PreToolUse:
     - matcher: Bash
-      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/firewall.py\""
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/firewall.py"'
       timeout: 10
     - matcher: Read|Write|Edit|MultiEdit
-      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/secret-guard.py\""
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/secret-guard.py"'
       timeout: 10
     - matcher: ""
-      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/pre-tool-inject.py\""
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/pre-tool-inject.py"'
   PostToolUse:
     - matcher: Bash
-      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/circuit-breaker.py\""
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/circuit-breaker.py"'
       timeout: 10
     - matcher: Write|Edit|MultiEdit
-      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/tool-ledger.py\""
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/tool-ledger.py"'
       timeout: 10
     - matcher: Write|Edit|MultiEdit
-      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/test_generator_hook.py\""
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/test_generator_hook.py"'
       timeout: 10
     - matcher: ""
-      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/budget_governor.py\""
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/budget_governor.py"'
       timeout: 10
   PostToolUseFailure:
-    - command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/post-tool-failure.py\""
+    - command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/post-tool-failure.py"'
   Stop:
     - matcher: ""
-      command: "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/stop_dispatcher.py\""
+      command: '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/stop_dispatcher.py"'
       timeout: 90
 feature_dependencies:
   defense-state:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/incident-replay.yaml

@@ -1,6 +1,6 @@
 id: incident-replay
 kind: debugging
-version: 2.1.9
+version: 2.2.3
 title: OMG Incident Replay
 description: Replayable bug packs built from logs, failing tests, traces, and diffs.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/lsp-pack.yaml

@@ -1,6 +1,6 @@
 id: lsp-pack
 kind: diagnostics
-version: 2.1.9
+version: 2.2.3
 title: OMG LSP Pack
 description: Optional LSP-backed diagnostics and navigation bundle for production verification.
 hosts:
@@ -19,8 +19,10 @@ tool_policy:
   allowed_tools:
     claude:
       - Read
+      - Edit
     codex:
       - Read
+      - Edit
 lifecycle_hooks:
   native:
     - PostToolUse
@@ -36,11 +38,41 @@ lsp_contract:
     - typescript
 evidence_outputs:
   artifacts:
-    - .omg/evidence/lsp-diagnostics.json
+    - .omg/evidence/lsp-pack-{run_id}.json
 execution_contract:
   modes:
     - embedded
     - local_supervisor
+tool_fabric:
+  lane: lsp-pack
+  enforcement_order:
+    - tool_selection
+    - approval_state
+    - evidence_requirements
+    - attestation_proof_validation
+    - execution
+  tools:
+    - Read
+    - Edit
+  semantic_operations:
+    - name: lsp_read_diagnostics
+      tool: Read
+      mutation_capable: false
+      requires_explicit_promotion: false
+    - name: lsp_promoted_edit
+      tool: Edit
+      mutation_capable: true
+      requires_explicit_promotion: true
+  requires_signed_approval: false
+  requires_signed_approval_for_mutation: true
+  requires_attestation: false
+  requires_attestation_for_mutation: true
+  read_only_by_default: true
+  require_run_scoped_evidence: true
+  require_fresh_evidence: true
+  evidence_max_age_seconds: 3600
+  required_evidence:
+    - .omg/evidence/lsp-pack-{run_id}.json
 channel_overrides:
   public:
     diagnostics: advisory

package/artifacts/release/dist/enterprise/bundle/registry/bundles/mcp-fabric.yaml

@@ -1,6 +1,6 @@
 id: mcp-fabric
 kind: mcp
-version: 2.1.9
+version: 2.2.3
 title: OMG MCP Fabric
 description: Tools, prompts, resources, and server instructions for the OMG control plane.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/plan-council.yaml

@@ -1,6 +1,6 @@
 id: plan-council
 kind: planning
-version: 2.1.9
+version: 2.2.3
 title: OMG Plan Council
 description: Canonical council-style planning bundle for explicit, evidence-backed deep plans.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/preflight.yaml

@@ -1,6 +1,6 @@
 id: preflight
 kind: routing
-version: 2.1.9
+version: 2.2.3
 title: OMG Preflight
 description: Repo-aware route selection based on diff, manifests, and classified risk.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/proof-gate.yaml

@@ -1,6 +1,6 @@
 id: proof-gate
 kind: proof
-version: 2.1.9
+version: 2.2.3
 title: OMG Proof Gate
 description: Structured release proof gate that binds claims to required evidence artifacts and trace links.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/remote-supervisor.yaml

@@ -1,6 +1,6 @@
 id: remote-supervisor
 kind: orchestration
-version: 2.1.9
+version: 2.2.3
 title: OMG Remote Supervisor
 description: Local-only authenticated supervisor sessions for worker orchestration.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/robotics.yaml

@@ -1,6 +1,6 @@
 id: robotics
 kind: domain-pack
-version: 2.1.9
+version: 2.2.3
 title: OMG Robotics Pack
 description: Robotics safety policy, replay, and evaluation attachments.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/secure-worktree-pipeline.yaml

@@ -1,6 +1,6 @@
 id: secure-worktree-pipeline
 kind: runtime
-version: 2.1.9
+version: 2.2.3
 title: OMG Secure Worktree Pipeline
 description: Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs.
 hosts:
@@ -8,7 +8,9 @@ hosts:
   - codex
 assets:
   references:
+    - runtime/exec_kernel.py
     - runtime/subagent_dispatcher.py
+    - runtime/merge_writer.py
     - hooks/branch_manager.py
 invocation_policy:
   user_invocable: false
@@ -39,10 +41,23 @@ mcp_contract:
 lsp_contract:
   languages:
     - python
+merge_writer_policy:
+  lock_path: .omg/state/merge-writer.lock
+  provenance_pattern: .omg/evidence/merge-writer-{run_id}.json
+  readers: concurrent
+  writers: exclusive
+  mutation_requires:
+    - worktree_isolation
+    - merge_writer_lock
 evidence_outputs:
   artifacts:
     - .omg/evidence/subagents/*.json
+    - .omg/evidence/merge-writer-*.json
+    - .omg/state/exec-kernel/*.json
+    - .omg/state/merge-writer.lock
 execution_contract:
+  flags:
+    - OMG_EXEC_KERNEL_ENABLED=false
   modes:
     - automation
     - ephemeral_worktree

package/artifacts/release/dist/enterprise/bundle/registry/bundles/security-check.yaml

@@ -1,6 +1,6 @@
 id: security-check
 kind: security
-version: 2.1.9
+version: 2.2.3
 title: OMG Security Check
 description: Canonical security audit bundle with provenance, trust scoring, and deterministic evidence.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/terminal-lane.yaml

@@ -0,0 +1,61 @@
+id: terminal-lane
+kind: governance
+version: 2.2.3
+title: OMG Terminal Lane
+description: Highest-risk governed terminal execution lane with strict approval and attestation.
+hosts:
+  - claude
+  - codex
+assets:
+  references:
+    - runtime/tool_fabric.py
+    - runtime/compliance_governor.py
+invocation_policy:
+  user_invocable: true
+  model_invocable: true
+  allow_implicit_invocation: false
+tool_policy:
+  side_effect_level: high
+  allowed_tools:
+    claude:
+      - Bash
+    codex:
+      - Bash
+lifecycle_hooks:
+  native:
+    - PreToolUse
+    - PostToolUse
+  emulated:
+    - TaskCompleted
+mcp_contract:
+  servers:
+    - omg-control
+lsp_contract:
+  languages:
+    - bash
+evidence_outputs:
+  artifacts:
+    - .omg/evidence/terminal-lane-{run_id}.json
+execution_contract:
+  modes:
+    - embedded
+    - local_supervisor
+tool_fabric:
+  lane: terminal-lane
+  enforcement_order:
+    - tool_selection
+    - approval_state
+    - evidence_requirements
+    - attestation_proof_validation
+    - execution
+  tools:
+    - Bash
+  requires_signed_approval: true
+  requires_attestation: true
+  required_evidence:
+    - .omg/evidence/terminal-lane-{run_id}.json
+channel_overrides:
+  public:
+    posture: restricted
+  enterprise:
+    posture: managed

package/artifacts/release/dist/enterprise/bundle/registry/bundles/test-intent-lock.yaml

@@ -1,6 +1,6 @@
 id: test-intent-lock
 kind: proof
-version: 2.1.9
+version: 2.2.3
 title: OMG Test Intent Lock
 description: Structured test-delta guard that blocks weakened tests unless explicit override evidence is present.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/tracebank.yaml

@@ -1,6 +1,6 @@
 id: tracebank
 kind: evidence
-version: 2.1.9
+version: 2.2.3
 title: OMG Tracebank
 description: Structured plan-to-patch-to-verify trace capture for OMG routes.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/bundles/vision.yaml

@@ -1,6 +1,6 @@
 id: vision
 kind: domain-pack
-version: 2.1.9
+version: 2.2.3
 title: OMG Vision Pack
 description: Vision-specific OCR, comparison, lineage, drift, and replay attachments.
 hosts:

package/artifacts/release/dist/enterprise/bundle/registry/omg-capability.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
   "title": "OMG Capability Bundle",
-  "version": "2.1.9",
+  "version": "2.2.3",
   "type": "object",
   "required": [
     "id",

package/artifacts/release/dist/enterprise/bundle/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.1.9 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.2.3 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -171,7 +171,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/session-start.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/session-start.py\"",
             "timeout": 10
           }
         ]
@@ -182,7 +182,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/session-end-capture.py\\\""
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/session-end-capture.py\""
           }
         ]
       }
@@ -192,7 +192,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/firewall.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/firewall.py\"",
             "timeout": 10
           }
         ],
@@ -202,7 +202,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/secret-guard.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/secret-guard.py\"",
             "timeout": 10
           }
         ],
@@ -212,7 +212,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/pre-tool-inject.py\\\""
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/pre-tool-inject.py\""
           }
         ],
         "matcher": ""
@@ -223,7 +223,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/circuit-breaker.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/circuit-breaker.py\"",
             "timeout": 10
           }
         ],
@@ -233,7 +233,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/tool-ledger.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/tool-ledger.py\"",
             "timeout": 10
           }
         ],
@@ -243,7 +243,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/test_generator_hook.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/test_generator_hook.py\"",
             "timeout": 10
           }
         ],
@@ -253,7 +253,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/budget_governor.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/budget_governor.py\"",
             "timeout": 10
           }
         ],
@@ -265,7 +265,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/post-tool-failure.py\\\""
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/post-tool-failure.py\""
           }
         ]
       }
@@ -275,7 +275,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/stop_dispatcher.py\\\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/stop_dispatcher.py\"",
             "timeout": 90
           }
         ],
@@ -306,7 +306,7 @@
     ]
   },
   "_omg": {
-    "_version": "2.1.9",
+    "_version": "2.2.3",
     "preset": "safe",
     "omgMode": "focused",
     "default_mode": "ulw+ralph",
@@ -366,7 +366,7 @@
       "NOTEBOOKLM": false
     },
     "generated": {
-      "contract_version": "2.1.9",
+      "contract_version": "2.2.3",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",
@@ -482,6 +482,21 @@
             "requires_approval": true
           }
         ],
+        "tool_fabric_contract": {
+          "enforcement_order": [
+            "tool_selection",
+            "approval_state",
+            "evidence_requirements",
+            "attestation_proof_validation",
+            "execution"
+          ],
+          "lanes": [
+            "lsp-pack",
+            "hash-edit",
+            "ast-pack",
+            "terminal-lane"
+          ]
+        },
         "protected_paths": [
           {
             "path_pattern": ".omg/**",
@@ -657,6 +672,11 @@
           "claim_judge",
           "compliance_governor",
           "execution_primitives"
+        ],
+        "runtime_behavior_surfaces": [
+          "execution_primitives",
+          "provider_host_parity",
+          "host_semantic_parity"
         ]
       }
     },