@trac3er/oh-my-god 2.2.3 → 2.2.5

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OMG - Oh-My-God for Claude Code and supported agent hosts",
-    "version": "2.2.3",
+    "version": "2.2.5",
     "homepage": "https://github.com/trac3er00/OMG",
     "repository": "https://github.com/trac3er00/OMG"
   },
@@ -14,7 +14,7 @@
     {
       "name": "omg",
       "description": "OMG plugin layer for Claude Code and supported agent hosts with native setup, orchestration, and interop.",
-      "version": "2.2.3",
+      "version": "2.2.5",
       "source": "./",
       "author": {
         "name": "trac3er00"
@@ -32,5 +32,5 @@
       ]
     }
   ],
-  "version": "2.2.3"
+  "version": "2.2.5"
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
   "author": {
     "name": "trac3er00"

package/.claude-plugin/scripts/install.sh

@@ -19,7 +19,7 @@ error() { echo -e "${RED}✗${NC} $1"; }
 echo ""
 echo -e "${BLUE}╔═══════════════════════════════════════════════════════════════╗${NC}"
 echo -e "${BLUE}║                                                               ║${NC}"
-echo -e "${BLUE}║              OMG Plugin Installer v2.2.3                     ║${NC}"
+echo -e "${BLUE}║              OMG Plugin Installer v2.2.5                     ║${NC}"
 echo -e "${BLUE}║                                                               ║${NC}"
 echo -e "${BLUE}╚═══════════════════════════════════════════════════════════════╝${NC}"
 echo ""

package/.gemini/settings.json

@@ -9,9 +9,9 @@
     }
   },
   "_omg": {
-    "_version": "2.2.3",
+    "_version": "2.2.5",
     "generated": {
-      "contract_version": "2.2.3",
+      "contract_version": "2.2.5",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",

package/.kimi/mcp.json

@@ -9,9 +9,9 @@
     }
   },
   "_omg": {
-    "_version": "2.2.3",
+    "_version": "2.2.5",
     "generated": {
-      "contract_version": "2.2.3",
+      "contract_version": "2.2.5",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",

package/CHANGELOG.md

@@ -1,6 +1,19 @@
 # Changelog
 
-## Unreleased
+## 2.2.5 - 2026-03-15
+
+### Governed Execution Engine Milestone
+
+- **production preset**: new `production` preset enables all governed flags — use `--preset=production` with `OMG-setup.sh` or `bunx @trac3er/oh-my-god`
+- **bunx install path**: `bunx @trac3er/oh-my-god` works alongside `npm install`
+- **terms_guard**: real enforcement blocks promotional cross-model sharing, hidden identity switching, undisclosed third-party data sharing
+- **six governed agents**: `architect-planner`, `explorer-indexer`, `implementer`, `security-reviewer`, `verifier`, `causal-tracer` compiled into Claude host artifacts; no `bypassPermissions` on any
+- **method compiler**: `contract compile --method` emits signed seven-phase methodology artifacts
+- **context compiler**: `context compile` emits bounded provenance-only packets for Claude, Codex, Gemini, and Kimi
+- **provider parity eval**: `provider-parity-eval --task task.json --mode recorded` evaluates all canonical hosts and emits a structured report
+- **PR risk engine**: structured risk classification by changed area; required gates and bundles exposed in PR review output
+- **governance hotfixes**: `verify_done_when({})` returns `ok`, `git tag -l` not classified as mutation, test-validator false positives eliminated
+- canonical hosts: `claude`, `codex`, `gemini`, `kimi`; OpenCode remains compatibility-only
 
 ## 2.2.3 - 2026-03-11
 

package/CLI-ADAPTER-MAP.md

@@ -164,7 +164,7 @@ OpenCode remains a compatibility-only adapter surface and is intentionally exclu
   - `~/.claude/settings.json` → `enabledPlugins[plugin_ref] = true`
   - `~/.claude/plugins/installed_plugins.json` → Plugin metadata with installed path, version, timestamp
 - **Plugin Ref Format:** `omg@omg` (name@marketplace_id)
-- **Version:** `2.2.3` (from package.json)
+- **Version:** `2.2.5` (from package.json)
 
 #### C. Plugin Unregistration (Lines 631-669)
 - **Function:** `unregister_plugin_from_registry(plugin_ref)`
@@ -208,7 +208,7 @@ OpenCode remains a compatibility-only adapter surface and is intentionally exclu
 ```json
 {
   "name": "@trac3er/oh-my-god",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "scripts": {
     "postinstall": "./OMG-setup.sh install --non-interactive",
     "update": "./OMG-setup.sh update",
@@ -240,7 +240,7 @@ CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.2.3"
+CANONICAL_VERSION = "2.2.5"
 ```
 
 ---

package/INSTALL-VERIFICATION-INDEX.md

@@ -1,354 +1,49 @@
+<!-- GENERATED: DO NOT EDIT MANUALLY -->
 # OMG Install Process Verification Index
 
 **Purpose:** Track all CLI adapter integration points, installation flows, and critical assumptions for end-to-end verification.
 
-**Created:** 2026-03-08  
-**Version:** OMG 2.1.0  
-**Status:** Ready for verification and fixing
+**Version:** OMG 2.2.5
 
 ---
 
 ## 📖 Documentation Map
 
 ### Primary References
-- **`CLI-ADAPTER-MAP.md`** (380 lines)
-  - Complete technical specification
-  - All provider implementations, config writers, and registration flows
-  - Critical assumptions and failure modes
-  - Verification checklists per target
-  - Line-number references to source files
-
-- **`QUICK-REFERENCE.md`** (6.7 KB)
-  - Quick lookup tables and commands
-  - Failure mode diagnosis
-  - Debugging checklist
-  - Installation verification steps
+- **`CLI-ADAPTER-MAP.md`**
+- **`QUICK-REFERENCE.md`**
 
 ### Source Files Referenced
-- `runtime/mcp_config_writers.py` (233 lines) - Config writer functions
-- `runtime/providers/codex_provider.py` (102 lines)
-- `runtime/providers/gemini_provider.py` (116 lines)
-- `runtime/providers/kimi_provider.py` (139 lines)
-- `OMG-setup.sh` (1333 lines) - Installation orchestrator
-- `runtime/adoption.py` (220 lines) - Constants
-- `package.json` - npm integration
-- `docs/install/claude-code.md` & `docs/install/codex.md`
+- `runtime/mcp_config_writers.py`
+- `runtime/adoption.py`
+- `OMG-setup.sh`
 
 ---
 
 ## 🎯 Installation Targets & Methods
 
 ### Canonical Targets
-1. **Claude Code**
-   - **Install:** `npm install @trac3er/oh-my-god` (postinstall hook)
-   - **Config:** `.mcp.json` (project root)
-   - **Registry:** `~/.claude/plugins/installed_plugins.json`
-   - **Preset:** `balanced` (recommended)
-   - **Detection:** Default (no detection needed)
+1. **Claude**
+   - **Config:** `.mcp.json`
 
 2. **Codex**
-   - **Install:** `npm install @trac3er/oh-my-god` + manual setup
-   - **Config:** `~/.codex/config.toml` ([mcp_servers.omg-control])
-   - **Registry:** Shared with Claude
-   - **Preset:** `interop` (recommended)
-   - **Detection:** `which codex` + `codex auth status`
+   - **Config:** `~/.codex/config.toml`
 
-### Compatibility Targets
 3. **Gemini**
-   - **Install:** Via provider detection during `/OMG:setup`
-   - **Config:** `~/.gemini/settings.json` (mcpServers)
-   - **Registry:** None (standalone)
-   - **Detection:** `which gemini` + `gemini auth status`
+   - **Config:** `~/.gemini/settings.json`
 
 4. **Kimi**
-   - **Install:** Via provider detection during `/OMG:setup`
-   - **Config:** `~/.kimi/mcp.json` (mcpServers)
-   - **Registry:** None (standalone)
-   - **Detection:** `which kimi` + token check
+   - **Config:** `~/.kimi/mcp.json`
 
 ---
 
-## 🔧 Config Writer Functions Summary
-
-| Function | Target | Format | Location | Input Validation |
-|----------|--------|--------|----------|------------------|
-| `write_claude_mcp_config()` | Claude | JSON | `.mcp.json` | Server URL + name |
-| `write_claude_mcp_stdio_config()` | Claude | JSON | `.mcp.json` | Command + args |
-| `write_codex_mcp_config()` | Codex | TOML | `~/.codex/config.toml` | Server URL + name |
-| `write_codex_mcp_stdio_config()` | Codex | TOML | `~/.codex/config.toml` | Command + args |
-| `write_gemini_mcp_config()` | Gemini | JSON | `~/.gemini/settings.json` | Server URL + name |
-| `write_gemini_mcp_stdio_config()` | Gemini | JSON | `~/.gemini/settings.json` | Command + args |
-| `write_kimi_mcp_config()` | Kimi | JSON | `~/.kimi/mcp.json` | Server URL + name |
-| `write_kimi_mcp_stdio_config()` | Kimi | JSON | `~/.kimi/mcp.json` | Command + args |
-
-**Shared Utilities:**
-- `get_managed_python_path()` - Returns venv Python path
-- `_atomic_write_text()` - Atomic file write (temp + rename)
-- `_load_json()` - Safe JSON load with fallback
-- `_validated_server_input()` - URL/name validation
-- `_validated_stdio_input()` - Command/args validation
-
----
-
-## 🚨 Critical Assumptions & Failure Modes
-
-### 1. Atomic Writes (CRITICAL)
-- **Implementation:** `_atomic_write_text()` uses `os.replace()`
-- **Risk Level:** HIGH
-- **Platform:** Fully atomic on POSIX; not guaranteed on Windows
-- **Mitigation:** 
-  - [ ] Verify file integrity after write on all platforms
-  - [ ] Use fsync on critical config files
-  - [ ] Implement backup + restore on write failure
-
-### 2. JSON Validation (DATA LOSS RISK)
-- **Implementation:** `_load_json()` silently returns `{}` on invalid JSON
-- **Risk Level:** CRITICAL
-- **Scenario:** Existing config malformed → overwritten with empty config
-- **Mitigation:**
-  - [ ] Validate existing JSON before load
-  - [ ] Create backups before any write
-  - [ ] Log warnings on validation failures
-  - [ ] Provide recovery mechanism
-
-### 3. TOML Parser Robustness (Codex-specific)
-- **Implementation:** Section header matching via regex (lines 117-139)
-- **Risk Level:** MEDIUM
-- **Scenarios:** Non-standard TOML formatting, duplicate headers
-- **Mitigation:**
-  - [ ] Use proper TOML parser instead of regex
-  - [ ] Validate section detection before write
-  - [ ] Test with malformed TOML files
-
-### 4. Python Version Requirement
-- **Requirement:** Python 3.10+ (fastmcp >=2.0)
-- **Risk Level:** HIGH
-- **Detection:** Preflight check in `OMG-setup.sh` (line 272-277)
-- **Mitigation:**
-  - [ ] Prominently document requirement
-  - [ ] Provide helpful error message with upgrade link
-  - [ ] Test on Python 3.9 and below
-
-### 5. Provider Binary Detection
-- **Implementation:** `shutil.which()` searches PATH
-- **Risk Level:** MEDIUM
-- **Scenarios:** Binary installed but PATH not refreshed; non-standard location
-- **Mitigation:**
-  - [ ] Document PATH refresh requirement
-  - [ ] Provide explicit binary location override option
-  - [ ] Check common installation paths as fallback
-
-### 6. Plugin Registry Consistency
-- **Implementation:** Two-file system (settings.json + installed_plugins.json)
-- **Risk Level:** MEDIUM
-- **Scenarios:** One file written, other fails; out-of-sync state
-- **Mitigation:**
-  - [ ] Use transactional writes or rollback mechanism
-  - [ ] Validate both files after registration
-  - [ ] Provide cleanup tool for stale entries
-
-### 7. Manifest File Accuracy
-- **Implementation:** Manifest tracks installed files for cleanup
-- **Risk Level:** MEDIUM
-- **Scenarios:** Manifest corrupted; files added outside installer
-- **Mitigation:**
-  - [ ] Validate manifest format before use
-  - [ ] Rebuild manifest if corrupted
-  - [ ] Compare manifest against actual files
-
-### 8. Settings Merge Script
-- **Implementation:** `scripts/settings-merge.py` must exist
-- **Risk Level:** MEDIUM
-- **Scenarios:** Script missing; script has errors
-- **Mitigation:**
-  - [ ] Verify script existence before calling
-  - [ ] Provide inline merge logic as fallback
-  - [ ] Test merge logic with various settings.json formats
-
-### 9. Venv Python Path Persistence
-- **Implementation:** `patch_omg_control_mcp_python()` updates .mcp.json
-- **Risk Level:** MEDIUM
-- **Scenarios:** Venv deleted; path changes after install
-- **Mitigation:**
-  - [ ] Store venv path in durable config
-  - [ ] Implement venv regeneration on missing interpreter
-  - [ ] Add health check on startup
-
-### 10. npm Environment Detection
-- **Implementation:** Check `$npm_lifecycle_event` and `$npm_execpath`
-- **Risk Level:** LOW
-- **Scenarios:** CI systems set npm env vars unexpectedly
-- **Mitigation:**
-  - [ ] Test in various CI systems (GitHub Actions, GitLab CI, etc.)
-  - [ ] Provide explicit --install-as-plugin flag override
-  - [ ] Document CI-specific setup requirements
-
----
-
-## ✅ Verification Checklist
-
-### Pre-Install Validation
-- [ ] Python 3.10+ available (`python3 --version`)
-- [ ] npm installed (if using npm install)
-- [ ] Disk space available (~100 MB for runtime)
-- [ ] File write permissions in home directory
-- [ ] Git installed (for clone method)
-
-### Claude Code Installation
-- [ ] `npm install @trac3er/oh-my-god` completes without error
-- [ ] `.mcp.json` created in project root
-- [ ] `.mcp.json` contains `omg-control` and `filesystem` servers
-- [ ] `.mcp.json` valid JSON (`python3 -m json.tool` succeeds)
-- [ ] `~/.claude/plugins/installed_plugins.json` has `omg@omg` entry
-- [ ] `~/.claude/settings.json` has `enabledPlugins["omg@omg"] = true`
-- [ ] `~/.claude/hud/omg-hud.mjs` installed
-- [ ] `~/.claude/omg-runtime/` contains hooks, runtime, plugins
-- [ ] `~/.claude/omg-runtime/.venv/bin/python` exists and executable
-- [ ] `/OMG:setup` command available and executes without error
-- [ ] `.omg/state/adoption-report.json` generated
-
-### Codex Installation
-- [ ] `which codex` finds binary in PATH
-- [ ] `codex auth status` returns authenticated
-- [ ] `~/.codex/config.toml` contains `[mcp_servers.omg-control]` section
-- [ ] MCP section has `command` and `args` entries
-- [ ] `/OMG:setup` detects Codex CLI
-- [ ] MCP servers merged into `~/.claude/.mcp.json` (if multi-host)
-
-### Gemini Installation
-- [ ] `which gemini` finds binary in PATH
-- [ ] `gemini auth status` returns authenticated
-- [ ] `~/.gemini/settings.json` contains `mcpServers["omg-control"]`
-- [ ] MCP entry has `command` and `args` entries
-
-### Kimi Installation
-- [ ] `which kimi` finds binary in PATH
-- [ ] `~/.kimi/config.toml` contains token entry
-- [ ] `~/.kimi/mcp.json` contains `mcpServers["omg-control"]`
-- [ ] MCP entry has `type: "http"` and `url` entries
-
-### Post-Install Verification
-- [ ] Run `/OMG:setup` and verify setup wizard completes
-- [ ] Run `/OMG:crazy <goal>` and verify execution
-- [ ] Check `.omg/state/` directory for logs and state files
-- [ ] Verify MCP servers respond to requests
-- [ ] Test plugin features (if applicable to target)
-
----
-
-## 🔍 Debugging Steps
-
-### If Installation Fails
-
-1. **Check environment:**
-   ```bash
-   echo $CLAUDE_CONFIG_DIR
-   python3 --version
-   which npm
-   ```
-
-2. **Check file permissions:**
-   ```bash
-   ls -la ~/.claude/
-   ls -la ~/.codex/
-   ls -la ~/.gemini/
-   ls -la ~/.kimi/
-   ```
-
-3. **Validate config files:**
-   ```bash
-   python3 -m json.tool ~/.claude/.mcp.json
-   python3 -m toml ~/.codex/config.toml  # if toml module available
-   ```
-
-4. **Check for errors in setup output:**
-   ```bash
-   # Re-run with verbose output
-   ./OMG-setup.sh install --non-interactive 2>&1 | tee install.log
-   ```
-
-5. **Review manifest:**
-   ```bash
-   cat ~/.claude/.omg-manifest
-   ```
-
-6. **Check for stale files:**
-   ```bash
-   find ~/.claude/ -name ".omg*" -o -name "omg*" | head -20
-   ```
-
-### If Runtime Fails
-
-1. **Check Python venv:**
-   ```bash
-   ~/.claude/omg-runtime/.venv/bin/python --version
-   ~/.claude/omg-runtime/.venv/bin/pip list | grep fastmcp
-   ```
-
-2. **Check MCP servers:**
-   ```bash
-   # Test claude MCP
-   python3 -m runtime.omg_mcp_server
-   
-   # Test codex MCP
-   ~/.claude/omg-runtime/.venv/bin/python -m runtime.omg_mcp_server
-   ```
-
-3. **Check adoption report:**
-   ```bash
-   cat .omg/state/adoption-report.json | python3 -m json.tool
-   ```
-
-4. **Check settings application:**
-   ```bash
-   cat ~/.claude/settings.json | jq ._omg
-   ```
-
----
-
-## 📊 Installation Matrix
-
-| Scenario | Claude | Codex | Gemini | Kimi | Notes |
-|----------|--------|-------|--------|------|-------|
-| Fresh install | ✅ npm | ⚠️ manual | ✅ auto-detect | ✅ auto-detect | npm hook auto-triggers |
-| Update | ✅ npm | ✅ manual | ✅ auto-detect | ✅ auto-detect | Version pinning in manifest |
-| Multi-host | ✅ coexist | ✅ coexist | ✅ compatible | ✅ compatible | Preset: `interop` or `labs` |
-| CI/Automation | ✅ npm | ✅ manual | ⚠️ requires detection | ⚠️ requires detection | Non-interactive mode |
-| Dev (symlink) | ✅ --symlink | ✅ --symlink | ✅ --symlink | ✅ --symlink | Live updates from repo |
-| Uninstall | ✅ remove | ✅ remove | ✅ remove | ✅ remove | Manifest-based cleanup |
-
----
-
-## 🎬 Next Actions
-
-### Immediate (Blocking Issues)
-1. Test JSON validation and recovery on malformed configs
-2. Test atomic write resilience on all platforms
-3. Verify TOML parser robustness (Codex-specific)
-4. Test Windows compatibility for atomic writes
-
-### High Priority
-5. Test provider detection and PATH refresh requirement
-6. Test plugin registry consistency (multiversion scenarios)
-7. Test settings merge script presence and execution
-8. Test venv Python path patching accuracy
-
-### Medium Priority
-9. Test symlink mode robustness (moved/deleted repos)
-10. Test adoption report generation for mixed ecosystems
-11. Document error recovery procedures
-12. Create troubleshooting guide based on findings
-
-### Low Priority
-13. Performance optimization for large config files
-14. Add telemetry/logging for install success rates
-15. Create install wizard improvements based on UX testing
-
----
+## 🔧 Verification Commands
 
-## 📞 Support & Contact
+| Name | Command |
+| :--- | :--- |
+| doctor | `python3 scripts/omg.py doctor` |
+| validate | `python3 scripts/omg.py validate` |
 
-**Repository:** https://github.com/trac3er00/OMG  
-**Issue Tracker:** https://github.com/trac3er00/OMG/issues  
-**Documentation:** See CLI-ADAPTER-MAP.md and QUICK-REFERENCE.md in repository root
+## 📂 Cache Paths
 
+- `.omg/cache`

package/OMG-setup.sh

@@ -5,7 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 BACKUP_TS="$(date +%Y%m%d_%H%M%S)"
 BACKUP_DIR="$CLAUDE_DIR/.omg-backup-$BACKUP_TS"
-VERSION="2.2.3"
+VERSION="2.2.5"
 
 PLUGIN_NAME="omg"
 PLUGIN_MARKETPLACE="omg"
@@ -85,7 +85,7 @@ Options:
   --mode=omg-only|coexist
                      Native OMG adoption mode for overlapping ecosystems
   --adopt=auto       Detect OMG-adjacent ecosystems during install/update
-  --preset=safe|balanced|interop|labs|buffet
+  --preset=safe|balanced|interop|labs|buffet|production
                      User-facing preset for managed OMG features
   --enable-browser   Enable optional OMG browser capability metadata and guidance
   -h, --help         Show this help
@@ -96,6 +96,7 @@ Examples:
   ./OMG-setup.sh install --install-as-plugin
   ./OMG-setup.sh install --mode=coexist --preset=interop
   ./OMG-setup.sh update --non-interactive --merge-policy=apply
+  bunx @trac3er/oh-my-god
   ./OMG-setup.sh reinstall --dry-run
   ./OMG-setup.sh uninstall --dry-run
 EOF
@@ -239,12 +240,12 @@ parse_args() {
         FRESH_INSTALL=true
     fi
 
-    if [ ! -t 0 ] || [ -n "${npm_lifecycle_event:-}" ] || [ -n "${npm_execpath:-}" ]; then
+    if [ ! -t 0 ]; then
         NON_INTERACTIVE=true
     fi
 
-    # Auto-enable plugin mode for npm installs
-    if [ -n "${npm_execpath:-}" ] || [ -n "${npm_lifecycle_event:-}" ]; then
+    # Auto-enable plugin mode for npm/bunx installs
+    if [ -n "${npm_execpath:-}" ] || [ -n "${npm_lifecycle_event:-}" ] || [ -n "${BUN_INSTALL:-}" ]; then
         INSTALL_AS_PLUGIN=true
     fi
 
@@ -268,7 +269,7 @@ parse_args() {
         plugins-first)
             OMG_PRESET="interop"
             ;;
-        safe|balanced|interop|labs|buffet) ;;
+        safe|balanced|interop|labs|buffet|production) ;;
         *)
             echo "Unknown OMG preset: $OMG_PRESET"
             exit 1
@@ -1127,37 +1128,35 @@ managed_launcher = sys.argv[3]
 
 sys.path.insert(0, str(root))
 
-from runtime.mcp_config_writers import (  # noqa: E402
-    write_codex_mcp_stdio_config,
-    write_gemini_mcp_stdio_config,
-    write_kimi_mcp_stdio_config,
-)
+from runtime.install_planner import compute_install_plan, execute_plan  # noqa: E402
 
-configured: list[str] = []
-for host in ("codex", "gemini", "kimi"):
-    if shutil.which(host) is None:
-        continue
-    if host == "codex":
-        write_codex_mcp_stdio_config(
-            command=managed_python,
-            args=[managed_launcher],
-            server_name="omg-control",
-        )
-    elif host == "gemini":
-        write_gemini_mcp_stdio_config(
-            command=managed_python,
-            args=[managed_launcher],
-            server_name="omg-control",
-        )
-    else:
-        write_kimi_mcp_stdio_config(
-            command=managed_python,
-            args=[managed_launcher],
-            server_name="omg-control",
-        )
-    configured.append(host)
+detected_clis = {
+    host: {"detected": bool(shutil.which(host))}
+    for host in ("codex", "gemini", "kimi")
+}
+
+plan = compute_install_plan(
+    project_dir=str(root),
+    detected_clis=detected_clis,
+    preset="safe",
+    mode="focused",
+    selected_ids=["omg-control"],
+    control_command=managed_python,
+    control_args=[managed_launcher],
+    selected_servers={
+        "omg-control": {
+            "command": managed_python,
+            "args": [managed_launcher],
+        }
+    },
+    source_root=root,
+    include_claude_action=False,
+)
+plan.pre_checks = []
+result = execute_plan(plan)
 
-if configured:
+configured = [action.host for action in plan.actions if action.host in {"codex", "gemini", "kimi"}]
+if not result.get("errors") and configured:
     print(",".join(configured))
 PY
 }

package/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.2.3
+version: 2.2.5
 canonical_hosts:
   - claude
   - codex
@@ -28,6 +28,24 @@ Gemini and Kimi are canonical behavior-parity hosts for contract validation and
 
 OpenCode remains compatibility-only in v2.2.3. It is supported through compatibility MCP wiring and interop diagnostics, but it is not part of the canonical behavior-parity contract set.
 
+## release_channels
+
+OMG defines two normative release channels for capability delivery and governance enforcement. `runtime/canonical_taxonomy.py` is the single source of truth for channel, preset, tier, and policy pack namespaces.
+
+- `public`: Standard production channel. Guarantees behavior parity across canonical hosts and standard evidence-backed verification.
+- `enterprise`: Hardened production channel. Guarantees enhanced evidence (lineage, provenance), tier-gated policy enforcement, and compatibility with specialized policy packs (`fintech`, `airgapped`).
+
+## governance_precedence
+
+Governance and policy enforcement follow a strict precedence rule to resolve conflicts:
+
+**subscription tier → channel → policy pack → preset**
+
+1. **subscription tier**: Highest precedence. Defines the baseline capabilities and limits.
+2. **channel**: Delivery channel guarantees.
+3. **policy pack**: Domain-specific hardening (e.g., `fintech`).
+4. **preset**: User-selected adoption level (e.g., `safe`, `balanced`).
+
 ## metadata
 
 Every bundle must declare `id`, `kind`, `version`, `title`, `description`, `hosts`, and `assets`.