@trac3er/oh-my-god 2.2.3 → 2.2.5

package/runtime/context_compiler.py

@@ -0,0 +1,131 @@
+"""Bounded context packet compiler.
+
+Reads the live context_engine_packet.json and emits provenance-only, bounded
+summaries for each canonical host.  Raw transcript and session bodies are never
+written to compiled output.
+"""
+from __future__ import annotations
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+_PACKET_REL_PATH = Path(".omg") / "state" / "context_engine_packet.json"
+_ALLOWED_PACKET_KEYS = frozenset({
+    "packet_version", "summary", "artifact_pointers", "provenance_pointers",
+    "artifact_handles", "clarification_status", "ambiguity_state",
+    "provenance_only", "governance", "release_metadata", "coordinator_run_id",
+    "profile_digest", "budget", "delta_only", "run_id",
+    "deterministic_contract",
+})
+
+
+def _resolve_root(root_dir) -> Path:
+    return Path(root_dir).resolve() if root_dir else Path.cwd()
+
+
+def _resolve_output_root(root: Path, output_root) -> Path:
+    if output_root:
+        out = Path(output_root).resolve()
+        out.mkdir(parents=True, exist_ok=True)
+        return out
+    return root
+
+
+def _load_packet(root: Path) -> dict[str, Any]:
+    packet_path = root / _PACKET_REL_PATH
+    if packet_path.exists():
+        try:
+            raw = json.loads(packet_path.read_text(encoding="utf-8"))
+            if isinstance(raw, dict):
+                return {k: v for k, v in raw.items() if k in _ALLOWED_PACKET_KEYS}
+        except Exception:
+            pass
+    return {
+        "packet_version": "1.0",
+        "summary": "no active context signals",
+        "artifact_pointers": [],
+        "provenance_pointers": [],
+        "artifact_handles": [],
+        "provenance_only": True,
+        "generated_at": datetime.now(timezone.utc).isoformat(),
+    }
+
+
+def _write_json(path: Path, data: dict[str, Any]) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(data, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+
+
+def compile_context_packets(
+    *,
+    root_dir=None,
+    output_root=None,
+    hosts=None,
+) -> dict[str, Any]:
+    root = _resolve_root(root_dir)
+    output = _resolve_output_root(root, output_root)
+    selected_hosts = list(hosts or ["claude", "codex", "gemini", "kimi"])
+    packet = _load_packet(root)
+    issued_at = datetime.now(timezone.utc).isoformat()
+
+    packet["context_compile_issued_at"] = issued_at
+    packet["hosts"] = selected_hosts
+
+    packet_path = output / _PACKET_REL_PATH
+    _write_json(packet_path, packet)
+    emitted: list[str] = [str(packet_path.relative_to(output))]
+
+    if "codex" in selected_hosts:
+        frag_src = root / ".agents" / "skills" / "omg" / "AGENTS.fragment.md"
+        frag_dst = output / ".agents" / "skills" / "omg" / "AGENTS.fragment.md"
+        frag_dst.parent.mkdir(parents=True, exist_ok=True)
+        if frag_src.exists():
+            frag_dst.write_bytes(frag_src.read_bytes())
+        else:
+            frag_dst.write_text("# OMG Codex Context\n\n_No context signals available._\n", encoding="utf-8")
+        emitted.append(str(frag_dst.relative_to(output)))
+
+    if "gemini" in selected_hosts:
+        gemini_src = root / ".gemini" / "settings.json"
+        gemini_dst = output / ".gemini" / "settings.json"
+        gemini_dst.parent.mkdir(parents=True, exist_ok=True)
+        if gemini_src.exists():
+            try:
+                gemini_data = json.loads(gemini_src.read_text(encoding="utf-8"))
+            except Exception:
+                gemini_data = {}
+        else:
+            gemini_data = {}
+        gemini_data.setdefault("_omg", {})["context_packet"] = {
+            "summary": packet.get("summary", ""),
+            "issued_at": issued_at,
+        }
+        _write_json(gemini_dst, gemini_data)
+        emitted.append(str(gemini_dst.relative_to(output)))
+
+    if "kimi" in selected_hosts:
+        kimi_src = root / ".kimi" / "mcp.json"
+        kimi_dst = output / ".kimi" / "mcp.json"
+        kimi_dst.parent.mkdir(parents=True, exist_ok=True)
+        if kimi_src.exists():
+            try:
+                kimi_data = json.loads(kimi_src.read_text(encoding="utf-8"))
+            except Exception:
+                kimi_data = {}
+        else:
+            kimi_data = {}
+        kimi_data.setdefault("_omg", {})["context_packet"] = {
+            "summary": packet.get("summary", ""),
+            "issued_at": issued_at,
+        }
+        _write_json(kimi_dst, kimi_data)
+        emitted.append(str(kimi_dst.relative_to(output)))
+
+    return {
+        "schema": "OmgContextCompileResult",
+        "status": "ok",
+        "hosts": selected_hosts,
+        "artifacts": emitted,
+        "packet": str(packet_path.relative_to(output)),
+    }

package/runtime/contract_compiler.py

@@ -34,6 +34,7 @@ from runtime.adoption import (
     CANONICAL_REPO_URL,
     CANONICAL_VERSION,
 )
+from runtime.canonical_taxonomy import CANONICAL_PRESETS, RELEASE_CHANNELS
 from runtime.canonical_surface import get_canonical_hosts, get_compat_hosts
 from registry.verify_artifact import sign_artifact_statement, verify_artifact_statement
 
@@ -46,7 +47,8 @@ RELEASE_BLOCKING_HOSTS = tuple(get_canonical_hosts())
 # Compatibility-only hosts (for example, OpenCode) are intentionally excluded from
 # release-blocking parity and compile-readiness requirements.
 COMPATIBILITY_ONLY_HOSTS = tuple(get_compat_hosts())
-SUPPORTED_CHANNELS = ("public", "enterprise")
+SUPPORTED_PRESETS = CANONICAL_PRESETS
+SUPPORTED_CHANNELS = RELEASE_CHANNELS
 DEFAULT_REQUIRED_BUNDLES = (
     "control-plane",
     "plan-council",
@@ -96,7 +98,8 @@ def _get_required_advanced_plugin_artifacts(root: Path) -> tuple[str, ...]:
         command_path = command.get("path")
         if not isinstance(command_path, str) or not command_path:
             continue
-        bundled_path = f"bundle/plugins/advanced/{command_path}"
+        safe_command_path = command_path.replace(":", "-")
+        bundled_path = f"bundle/plugins/advanced/{safe_command_path}"
         if bundled_path in seen:
             continue
         required.append(bundled_path)
@@ -140,7 +143,14 @@ REQUIRED_CLAUDE_HOOK_EVENTS = (
     "PostToolUseFailure",
     "InstructionsLoaded",
 )
-REQUIRED_CLAUDE_SUBAGENT_NAMES = ("security-reviewer", "release-manager")
+REQUIRED_CLAUDE_SUBAGENT_NAMES = (
+    "architect-planner",
+    "explorer-indexer",
+    "implementer",
+    "security-reviewer",
+    "verifier",
+    "causal-tracer",
+)
 REQUIRED_CODEX_AGENTS_SECTIONS = (
     "## Build & Test",
     "## Protected Paths",
@@ -646,7 +656,8 @@ def _copy_contract_inputs(root: Path, output_root: Path) -> list[Path]:
 
     advanced_commands = resolve_assets(Path("plugins") / "advanced" / "commands", suffix=".md")
     for src in advanced_commands:
-        rel = Path("plugins") / "advanced" / "commands" / src.name
+        safe_name = src.name.replace(":", "-")
+        rel = Path("plugins") / "advanced" / "commands" / safe_name
         dst = output_root / rel
         _write_text(dst, src.read_text(encoding="utf-8"))
         copied.append(dst)
@@ -848,36 +859,43 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
 
 
 def _build_claude_subagents(protected_paths: list[str]) -> list[dict[str, Any]]:
-    """Build narrow-tool Claude subagent definitions. No bypassPermissions allowed."""
     return [
+        {
+            "name": "architect-planner",
+            "description": "Read-only planning subagent. Analyses structure, proposes plans, produces evidence. No mutations.",
+            "tools": ["Read", "Grep", "Glob", "Bash(git log *)", "Bash(git diff *)", "Bash(python3 scripts/omg.py *)", "WebSearch"],
+            "bypassPermissions": False,
+        },
+        {
+            "name": "explorer-indexer",
+            "description": "Read-only codebase exploration subagent. Searches, indexes, and answers structural questions.",
+            "tools": ["Read", "Grep", "Glob", "Bash(grep *)", "Bash(find *)", "Bash(git log *)", "Bash(git diff *)"],
+            "bypassPermissions": False,
+        },
+        {
+            "name": "implementer",
+            "description": "Write-capable implementation subagent governed by protected-path policy and mutation gate.",
+            "tools": ["Read", "Write", "Edit", "MultiEdit", "Grep", "Glob", "Bash(git *)", "Bash(python3 *)", "Bash(pytest *)"],
+            "bypassPermissions": False,
+            "protectedPaths": protected_paths,
+        },
         {
             "name": "security-reviewer",
             "description": "Read-only security review subagent with scoped tool access.",
-            "tools": [
-                "Read",
-                "Grep",
-                "Glob",
-                "Bash(grep *)",
-                "Bash(find *)",
-                "Bash(git log *)",
-                "Bash(git diff *)",
-            ],
+            "tools": ["Read", "Grep", "Glob", "Bash(grep *)", "Bash(find *)", "Bash(git log *)", "Bash(git diff *)"],
             "bypassPermissions": False,
         },
         {
-            "name": "release-manager",
-            "description": "Release management subagent with write access governed by protected-path policy.",
-            "tools": [
-                "Read",
-                "Write",
-                "Edit",
-                "Grep",
-                "Glob",
-                "Bash(git *)",
-                "Bash(python3 scripts/omg.py *)",
-            ],
+            "name": "verifier",
+            "description": "Read-only verification subagent. Runs tests, lints, and produces evidence without mutations.",
+            "tools": ["Read", "Grep", "Glob", "Bash(python3 -m pytest *)", "Bash(python3 scripts/omg.py *)", "Bash(git diff *)"],
+            "bypassPermissions": False,
+        },
+        {
+            "name": "causal-tracer",
+            "description": "Read-only causal analysis subagent. Traces errors, diffs, and logs to root causes.",
+            "tools": ["Read", "Grep", "Glob", "Bash(git log *)", "Bash(git diff *)", "Bash(git blame *)", "Bash(grep *)"],
             "bypassPermissions": False,
-            "protectedPaths": protected_paths,
         },
     ]
 
@@ -1534,6 +1552,85 @@ def compile_contract_outputs(
     }
 
 
+_METHOD_PHASES = (
+    "deep-interview",
+    "approved-spec",
+    "done-when-contract",
+    "test-lock",
+    "implementation-plan",
+    "review",
+    "release",
+)
+
+
+def compile_method_artifacts(
+    *,
+    root_dir: str | Path | None = None,
+    output_root: str | Path | None = None,
+    hosts: list[str] | tuple[str, ...] | None = None,
+    channel: str = "public",
+) -> dict[str, Any]:
+    root = _resolve_root(root_dir)
+    output = _resolve_output_root(root, output_root)
+    selected_hosts = list(hosts or SUPPORTED_HOSTS)
+    method_dir = output / ".omg" / "evidence" / "method"
+    method_dir.mkdir(parents=True, exist_ok=True)
+    issued_at = datetime.now(timezone.utc).isoformat()
+
+    phase_artifacts: list[str] = []
+    for phase in _METHOD_PHASES:
+        phase_payload: dict[str, Any] = {
+            "schema": "OmgMethodPhase",
+            "phase": phase,
+            "contract_version": CANONICAL_VERSION,
+            "channel": channel,
+            "hosts": selected_hosts,
+            "issued_at": issued_at,
+        }
+        phase_path = method_dir / f"{phase}.json"
+        _write_json(phase_path, phase_payload)
+        raw = json.dumps(phase_payload, sort_keys=True, separators=(",", ":")).encode()
+        digest = hashlib.sha256(raw).hexdigest()
+        try:
+            from registry.verify_artifact import sign_artifact_statement
+            statement = sign_artifact_statement(
+                artifact_path=str(phase_path),
+                subject_digest=digest,
+                trusted_comment=f"omg-method:{phase}:{CANONICAL_VERSION}",
+            )
+        except Exception:
+            statement = {
+                "schema": "OmgMethodPhaseStatement",
+                "phase": phase,
+                "subject_digest": digest,
+                "issued_at": issued_at,
+                "signer": {"keyid": "offline", "algorithm": "sha256-only", "mode": "local-offline"},
+            }
+        stmt_path = method_dir / f"{phase}.statement.json"
+        _write_json(stmt_path, statement)
+        phase_artifacts.append(phase)
+
+    manifest: dict[str, Any] = {
+        "schema": "OmgMethodManifest",
+        "phases": list(_METHOD_PHASES),
+        "contract_version": CANONICAL_VERSION,
+        "channel": channel,
+        "hosts": selected_hosts,
+        "issued_at": issued_at,
+    }
+    manifest_path = method_dir / "manifest.json"
+    _write_json(manifest_path, manifest)
+
+    return {
+        "schema": "OmgMethodCompileResult",
+        "status": "ok",
+        "channel": channel,
+        "hosts": selected_hosts,
+        "phases": phase_artifacts,
+        "manifest": str(manifest_path.relative_to(output)),
+    }
+
+
 def _provider_statuses() -> dict[str, dict[str, Any]]:
     ready_override = {
         item.strip()

package/runtime/delta_classifier.py

@@ -101,6 +101,74 @@ def classify_project_changes(
     return result
 
 
+_RISK_LEVEL_BY_CATEGORY: dict[str, str] = {
+    "auth": "critical",
+    "payment": "critical",
+    "compliance": "critical",
+    "health": "critical",
+    "db": "high",
+    "infra": "high",
+    "api": "high",
+    "security": "high",
+    "data": "medium",
+    "robotics": "medium",
+    "vision": "medium",
+    "algorithms": "low",
+}
+_REQUIRED_GATES_BY_RISK: dict[str, tuple[str, ...]] = {
+    "critical": ("claim_judge", "security_check", "proof_gate", "test_intent_lock", "compliance_governor"),
+    "high": ("claim_judge", "proof_gate", "test_intent_lock"),
+    "medium": ("claim_judge", "proof_gate"),
+    "low": ("claim_judge",),
+}
+_REQUIRED_BUNDLES_BY_RISK: dict[str, tuple[str, ...]] = {
+    "critical": ("security-check", "hook-governor", "proof-gate", "test-intent-lock"),
+    "high": ("proof-gate", "test-intent-lock"),
+    "medium": ("proof-gate",),
+    "low": (),
+}
+
+
+def compute_pr_risk_payload(
+    *,
+    changed_files: list[str],
+    categories: list[str],
+    goal: str = "",
+    evidence: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    category_risks = [_RISK_LEVEL_BY_CATEGORY.get(c, "low") for c in categories]
+    risk_order = ("low", "medium", "high", "critical")
+    max_risk = max(category_risks, key=lambda r: risk_order.index(r)) if category_risks else "low"
+
+    required_gates = list(_REQUIRED_GATES_BY_RISK.get(max_risk, ()))
+    required_bundles = list(_REQUIRED_BUNDLES_BY_RISK.get(max_risk, ()))
+
+    blockers: list[str] = []
+    if evidence is not None:
+        for gate in required_gates:
+            if gate not in evidence or not evidence[gate]:
+                blockers.append(f"Missing required gate evidence: {gate}")
+
+    runtime_touches = [
+        f for f in changed_files
+        if any(seg in f.lower() for seg in ("runtime/", "hooks/", "scripts/", "registry/"))
+    ]
+    if runtime_touches and "test_intent_lock" not in required_gates:
+        required_gates.append("test_intent_lock")
+        blockers.append("Runtime/hook changes require test_intent_lock evidence")
+
+    return {
+        "schema": "PrRiskPayload",
+        "risk_level": max_risk,
+        "changed_areas": sorted(categories),
+        "runtime_touches": runtime_touches,
+        "required_gates": required_gates,
+        "required_bundles": required_bundles,
+        "blockers": blockers,
+        "goal": goal,
+    }
+
+
 def _classify_evidence_profile(*, goal: str, touched_files: list[str], categories: list[str]) -> str:
     lowered_goal = goal.lower()
     lowered_files = [path.lower() for path in touched_files]

package/runtime/doc_generator.py

@@ -0,0 +1,273 @@
+from __future__ import annotations
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, cast
+
+from runtime.adoption import CANONICAL_VERSION, PRESET_FEATURES
+from runtime.canonical_taxonomy import (
+    RELEASE_CHANNELS,
+    CANONICAL_PRESETS,
+    SUBSCRIPTION_TIERS,
+    POLICY_PACK_IDS,
+)
+from runtime.canonical_surface import get_canonical_hosts, get_compat_hosts
+
+def generate_docs(output_root: Path) -> dict[str, Any]:
+    output_root.mkdir(parents=True, exist_ok=True)
+    
+    canonical_hosts = list(get_canonical_hosts())
+    compat_hosts = list(get_compat_hosts())
+    timestamp = datetime.now(timezone.utc).isoformat()
+    
+    # 1. support-matrix.json
+    support_matrix = {
+        "generated_by": "omg docs generate",
+        "version": CANONICAL_VERSION,
+        "generated_at": timestamp,
+        "canonical_hosts": canonical_hosts,
+        "compatibility_hosts": compat_hosts,
+        "channels": list(RELEASE_CHANNELS),
+        "presets": list(CANONICAL_PRESETS),
+        "subscription_tiers": list(SUBSCRIPTION_TIERS),
+        "policy_packs": list(POLICY_PACK_IDS),
+    }
+    _write_json(output_root / "support-matrix.json", support_matrix)
+    
+    # 2. preset-matrix.json
+    preset_matrix = {
+        "generated_by": "omg docs generate",
+        "version": CANONICAL_VERSION,
+        "generated_at": timestamp,
+        "presets": PRESET_FEATURES,
+    }
+    _write_json(output_root / "preset-matrix.json", preset_matrix)
+    
+    # 3. host-tiers.json
+    host_tiers = {
+        "generated_by": "omg docs generate",
+        "version": CANONICAL_VERSION,
+        "generated_at": timestamp,
+        "tiers": {
+            "canonical": canonical_hosts,
+            "compatibility": compat_hosts,
+        }
+    }
+    _write_json(output_root / "host-tiers.json", host_tiers)
+    
+    # 4. install-verification.json
+    install_verification = {
+        "generated_by": "omg docs generate",
+        "version": CANONICAL_VERSION,
+        "generated_at": timestamp,
+        "verification_commands": [
+            {"name": "doctor", "command": "python3 scripts/omg.py doctor"},
+            {"name": "validate", "command": "python3 scripts/omg.py validate"},
+        ],
+        "cache_paths": [
+            ".omg/cache",
+        ]
+    }
+    _write_json(output_root / "install-verification.json", install_verification)
+    
+    # 5. SUPPORT-MATRIX.md
+    support_md = [
+        "<!-- GENERATED: DO NOT EDIT MANUALLY -->",
+        "# OMG Support Matrix",
+        "",
+        "## Canonical Hosts",
+        "",
+        "| Host | Tier |",
+        "| :--- | :--- |",
+    ]
+    for host in canonical_hosts:
+        support_md.append(f"| {host} | Canonical |")
+    
+    support_md.extend([
+        "",
+        "## Compatibility Hosts",
+        "",
+        "| Host | Tier |",
+        "| :--- | :--- |",
+    ])
+    for host in compat_hosts:
+        support_md.append(f"| {host} | Compatibility |")
+    
+    _write_text(output_root / "SUPPORT-MATRIX.md", "\n".join(support_md) + "\n")
+    
+    # 6. PRESET-REFERENCE.md
+    preset_md = [
+        "<!-- GENERATED: DO NOT EDIT MANUALLY -->",
+        "# OMG Preset Reference",
+        "",
+    ]
+    
+    # Get all unique flags
+    all_flags = sorted(next(iter(PRESET_FEATURES.values())).keys())
+    
+    header = "| Feature | " + " | ".join(CANONICAL_PRESETS) + " |"
+    separator = "| :--- | " + " | ".join([":---:"] * len(CANONICAL_PRESETS)) + " |"
+    preset_md.append(header)
+    preset_md.append(separator)
+    
+    for flag in all_flags:
+        row = f"| {flag} | "
+        row += " | ".join(["✅" if PRESET_FEATURES[p].get(flag) else "❌" for p in CANONICAL_PRESETS])
+        row += " |"
+        preset_md.append(row)
+    
+    _write_text(output_root / "PRESET-REFERENCE.md", "\n".join(preset_md) + "\n")
+    
+    # 7. INSTALL-VERIFICATION-INDEX.md
+    install_md = [
+        "<!-- GENERATED: DO NOT EDIT MANUALLY -->",
+        "# OMG Install Process Verification Index",
+        "",
+        "**Purpose:** Track all CLI adapter integration points, installation flows, and critical assumptions for end-to-end verification.",
+        "",
+        f"**Version:** OMG {CANONICAL_VERSION}",
+        "",
+        "---",
+        "",
+        "## 📖 Documentation Map",
+        "",
+        "### Primary References",
+        "- **`CLI-ADAPTER-MAP.md`**",
+        "- **`QUICK-REFERENCE.md`**",
+        "",
+        "### Source Files Referenced",
+        "- `runtime/mcp_config_writers.py`",
+        "- `runtime/adoption.py`",
+        "- `OMG-setup.sh`",
+        "",
+        "---",
+        "",
+        "## 🎯 Installation Targets & Methods",
+        "",
+        "### Canonical Targets",
+    ]
+    
+    target_configs = {
+        "claude": ".mcp.json",
+        "codex": "~/.codex/config.toml",
+        "gemini": "~/.gemini/settings.json",
+        "kimi": "~/.kimi/mcp.json",
+    }
+    
+    for i, host in enumerate(canonical_hosts, 1):
+        config_path = target_configs.get(host, "Unknown")
+        install_md.extend([
+            f"{i}. **{host.capitalize()}**",
+            f"   - **Config:** `{config_path}`",
+            "",
+        ])
+    
+    install_md.extend([
+        "---",
+        "",
+        "## 🔧 Verification Commands",
+        "",
+        "| Name | Command |",
+        "| :--- | :--- |",
+    ])
+    verification_cmds = cast(list[dict[str, str]], install_verification["verification_commands"])
+    for cmd in verification_cmds:
+        name = cmd.get("name", "")
+        command = cmd.get("command", "")
+        install_md.append(f"| {name} | `{command}` |")
+        
+    install_md.extend([
+        "",
+        "## 📂 Cache Paths",
+        "",
+    ])
+    for path in install_verification["cache_paths"]:
+        install_md.append(f"- `{path}`")
+        
+    _write_text(output_root / "INSTALL-VERIFICATION-INDEX.md", "\n".join(install_md) + "\n")
+    
+    # 8. QUICK-REFERENCE.md
+    quick_md = [
+        "<!-- GENERATED: DO NOT EDIT MANUALLY -->",
+        "# OMG CLI Adapter Quick Reference",
+        "",
+        "## 🎯 Core Integration Points",
+        "",
+        "### Canonical Hosts",
+        "",
+        "| Host | Config File |",
+        "| :--- | :--- |",
+    ]
+    for host in canonical_hosts:
+        config_path = target_configs.get(host, "Unknown")
+        quick_md.append(f"| {host} | `{config_path}` |")
+        
+    quick_md.extend([
+        "",
+        "### Release Channels",
+        "",
+    ])
+    for channel in RELEASE_CHANNELS:
+        quick_md.append(f"- `{channel}`")
+        
+    quick_md.extend([
+        "",
+        "### Preset Quick Reference",
+        "",
+        "| Preset | Key Features |",
+        "| :--- | :--- |",
+    ])
+    for preset in CANONICAL_PRESETS:
+        features = [f for f, enabled in PRESET_FEATURES[preset].items() if enabled]
+        feature_summary = ", ".join(features[:5]) + ("..." if len(features) > 5 else "")
+        quick_md.append(f"| {preset} | {feature_summary or 'None'} |")
+        
+    quick_md.extend([
+        "",
+        "### Quick Commands",
+        "",
+        "| Task | Command |",
+        "| :--- | :--- |",
+        "| Setup | `/OMG:setup` |",
+        "| Browser | `/OMG:browser <goal>` |",
+        "| Crazy Mode | `/OMG:crazy <goal>` |",
+        "| Deep Plan | `/OMG:deep-plan <goal>` |",
+    ])
+    
+    _write_text(output_root / "QUICK-REFERENCE.md", "\n".join(quick_md) + "\n")
+    
+    # 9. channel-guarantees.json
+    channel_guarantees = {
+        "generated_by": "omg docs generate",
+        "version": CANONICAL_VERSION,
+        "generated_at": timestamp,
+        "channels": {
+            "public": "Standard production channel. Guarantees behavior parity across canonical hosts and standard evidence-backed verification.",
+            "enterprise": "Hardened production channel. Guarantees enhanced evidence (lineage, provenance), tier-gated policy enforcement, and compatibility with specialized policy packs (fintech, airgapped).",
+        },
+        "precedence_rule": "subscription tier → channel → policy pack → preset",
+        "policy_pack_ids": list(POLICY_PACK_IDS),
+    }
+    _write_json(output_root / "channel-guarantees.json", channel_guarantees)
+    
+    return {
+        "status": "ok",
+        "output_root": str(output_root),
+        "artifacts": [
+            "support-matrix.json",
+            "preset-matrix.json",
+            "host-tiers.json",
+            "install-verification.json",
+            "SUPPORT-MATRIX.md",
+            "PRESET-REFERENCE.md",
+            "INSTALL-VERIFICATION-INDEX.md",
+            "QUICK-REFERENCE.md",
+            "channel-guarantees.json",
+        ]
+    }
+
+def _write_json(path: Path, data: dict[str, Any]) -> None:
+    _ = path.write_text(json.dumps(data, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+
+def _write_text(path: Path, content: str) -> None:
+    _ = path.write_text(content, encoding="utf-8")