@trac3er/oh-my-god 2.2.3 → 2.3.0

package/runtime/delta_classifier.py

@@ -101,6 +101,74 @@ def classify_project_changes(
     return result
 
 
+_RISK_LEVEL_BY_CATEGORY: dict[str, str] = {
+    "auth": "critical",
+    "payment": "critical",
+    "compliance": "critical",
+    "health": "critical",
+    "db": "high",
+    "infra": "high",
+    "api": "high",
+    "security": "high",
+    "data": "medium",
+    "robotics": "medium",
+    "vision": "medium",
+    "algorithms": "low",
+}
+_REQUIRED_GATES_BY_RISK: dict[str, tuple[str, ...]] = {
+    "critical": ("claim_judge", "security_check", "proof_gate", "test_intent_lock", "compliance_governor"),
+    "high": ("claim_judge", "proof_gate", "test_intent_lock"),
+    "medium": ("claim_judge", "proof_gate"),
+    "low": ("claim_judge",),
+}
+_REQUIRED_BUNDLES_BY_RISK: dict[str, tuple[str, ...]] = {
+    "critical": ("security-check", "hook-governor", "proof-gate", "test-intent-lock"),
+    "high": ("proof-gate", "test-intent-lock"),
+    "medium": ("proof-gate",),
+    "low": (),
+}
+
+
+def compute_pr_risk_payload(
+    *,
+    changed_files: list[str],
+    categories: list[str],
+    goal: str = "",
+    evidence: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    category_risks = [_RISK_LEVEL_BY_CATEGORY.get(c, "low") for c in categories]
+    risk_order = ("low", "medium", "high", "critical")
+    max_risk = max(category_risks, key=lambda r: risk_order.index(r)) if category_risks else "low"
+
+    required_gates = list(_REQUIRED_GATES_BY_RISK.get(max_risk, ()))
+    required_bundles = list(_REQUIRED_BUNDLES_BY_RISK.get(max_risk, ()))
+
+    blockers: list[str] = []
+    if evidence is not None:
+        for gate in required_gates:
+            if gate not in evidence or not evidence[gate]:
+                blockers.append(f"Missing required gate evidence: {gate}")
+
+    runtime_touches = [
+        f for f in changed_files
+        if any(seg in f.lower() for seg in ("runtime/", "hooks/", "scripts/", "registry/"))
+    ]
+    if runtime_touches and "test_intent_lock" not in required_gates:
+        required_gates.append("test_intent_lock")
+        blockers.append("Runtime/hook changes require test_intent_lock evidence")
+
+    return {
+        "schema": "PrRiskPayload",
+        "risk_level": max_risk,
+        "changed_areas": sorted(categories),
+        "runtime_touches": runtime_touches,
+        "required_gates": required_gates,
+        "required_bundles": required_bundles,
+        "blockers": blockers,
+        "goal": goal,
+    }
+
+
 def _classify_evidence_profile(*, goal: str, touched_files: list[str], categories: list[str]) -> str:
     lowered_goal = goal.lower()
     lowered_files = [path.lower() for path in touched_files]

package/runtime/github_review_bot.py

@@ -78,8 +78,8 @@ class GitHubReviewBot:
             review_status=str(formatted["review_status"]),
             body=str(formatted["body"]),
         )
-        if check_result.get("status") != "ok":
-            return check_result
+        # Check-run is supplementary — don't fail the whole flow if it errors
+        # (e.g., app may lack Checks permission while still having PR write)
 
         review_status = self._to_review_status(str(formatted["review_status"]))
         state = self.contract.record_review(

package/runtime/github_review_formatter.py

@@ -43,6 +43,19 @@ def format_review_payload(evidence: dict[str, Any], *, inline_batch_limit: int =
         dropped_comments=dropped_comments,
     )
 
+    changed_files = _as_str_list(evidence.get("changed_files"))
+    categories = _as_str_list(evidence.get("categories"))
+    goal = str(evidence.get("goal", "")).strip()
+    pr_risk: dict[str, Any] = {}
+    if changed_files or categories:
+        from runtime.delta_classifier import compute_pr_risk_payload
+        pr_risk = compute_pr_risk_payload(
+            changed_files=changed_files,
+            categories=categories,
+            goal=goal,
+            evidence=evidence,
+        )
+
     return {
         "status": "ok",
         "review_status": review_status,
@@ -50,6 +63,7 @@ def format_review_payload(evidence: dict[str, Any], *, inline_batch_limit: int =
         "body": body,
         "inline_comments": selected_comments,
         "dropped_inline_comments": dropped_comments,
+        "pr_risk": pr_risk,
     }
 
 

package/runtime/mutation_gate.py

@@ -16,7 +16,7 @@ from runtime.tool_plan_gate import has_tool_plan_for_run
 _MUTATING_TOOLS = frozenset({"Write", "Edit", "MultiEdit"})
 _EXEMPTIONS = frozenset({"docs", "config", "generated", "test"})
 _MUTATION_BASH_PATTERNS = (
-    r"\b(git\s+(add|commit|push|rebase|cherry-pick|merge|tag))\b",
+    r"\b(git\s+(add|commit|push|rebase|cherry-pick|merge|tag(?!\s+(-l|--list)\b)))\b",
     r"\b(rm|mv|cp|tee|touch|mkdir|rmdir|ln)\b",
     r"\b(sed\s+-i|perl\s+-pi)\b",
     r"\b(chmod|chown)\b",
@@ -91,6 +91,16 @@ def check_mutation_allowed(
         or resolve_current_run_id(project_dir=project_dir)
     )
 
+    # Release orchestration bypass: check FIRST before lock/plan/done_when gates.
+    # When release orchestration is active, all TDD gates are bypassed to allow
+    # CI/release operations to proceed without requiring test-intent locks.
+    if is_release_orchestration_active(project_dir=project_dir):
+        return {
+            "status": "allowed",
+            "reason": "release_orchestration_active",
+            "lock_id": normalized_lock_id,
+        }
+
     verification = verify_lock(project_dir, run_id=resolved_run_id, lock_id=normalized_lock_id)
     if verification.get("status") != "ok":
         reason = str(verification.get("reason", "no_active_test_intent_lock"))
@@ -135,13 +145,6 @@ def check_mutation_allowed(
             "lock_id": normalized_lock_id,
         }
 
-    if is_release_orchestration_active(project_dir=project_dir):
-        return {
-            "status": "allowed",
-            "reason": "release_orchestration_active",
-            "lock_id": normalized_lock_id,
-        }
-
     if resolved_run_id:
         done_when_verification = verify_done_when(metadata_obj, run_id=resolved_run_id)
         if done_when_verification.get("status") != "ok":
@@ -190,8 +193,34 @@ def _is_mutation_capable_bash(command: str) -> bool:
     for pattern in _MUTATION_BASH_PATTERNS:
         if re.search(pattern, dequoted):
             return True
+    # File-write redirection: only classify as mutation if the command itself
+    # is NOT a known read-only program.  `python3 script.py > out.json` is a
+    # read-only computation that merely saves output; the actual mutation
+    # patterns (git commit, rm, mv, etc.) are already caught above.
     if _FILE_WRITE_REDIRECTION_PATTERN.search(dequoted):
-        return True
+        if not _is_read_only_program_with_redirect(normalized_command):
+            return True
+    return False
+
+
+def _is_read_only_program_with_redirect(command: str) -> bool:
+    """Return True when the command before any > redirect is a read-only program."""
+    cmd_portion = re.split(r"(?<!\d)\s*>>?\s+\S+", command)[0].strip()
+    if not cmd_portion:
+        return False
+    lowered = cmd_portion.lower()
+    _read_only_prefixes = (
+        "python", "python3", "node", "ruby", "perl",
+        "jq", "yq",
+        "git log", "git diff", "git status", "git show", "git branch",
+        "gh pr", "gh run", "gh api",
+        "ls", "find", "grep", "rg", "ag", "wc", "sort", "uniq",
+        "head", "tail", "less", "more", "file", "stat", "du", "df",
+        "env", "printenv", "uname", "whoami", "hostname", "date",
+    )
+    for prefix in _read_only_prefixes:
+        if lowered.startswith(prefix):
+            return True
     return False
 
 

package/runtime/omg_compat_contract_snapshot.json

@@ -1,6 +1,6 @@
 {
   "schema": "OmgCompatContractSnapshot",
-  "contract_version": "2.2.3",
+  "contract_version": "2.3.0",
   "count": 47,
   "contracts": [
     {

package/runtime/provider_parity_eval.py

@@ -0,0 +1,109 @@
+"""Provider parity evaluation for OMG canonical hosts.
+
+Supports `recorded` mode (offline, deterministic) and `live` mode
+(real provider invocations, requires credentials).  Recorded mode
+is the standard path for unit tests and CI.  Live mode is the
+release-grade path for actual provider parity claims.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from runtime.canonical_surface import get_canonical_hosts
+
+
+_RECORDED_TOKEN_MAP = {
+    "claude": "Claude response: ok",
+    "codex": "Codex response: ok",
+    "gemini": "Gemini response: ok",
+    "kimi": "Kimi response: ok",
+}
+
+
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _resolve_output_root(output_root) -> Path:
+    if output_root:
+        out = Path(output_root).resolve()
+        out.mkdir(parents=True, exist_ok=True)
+        return out
+    return Path.cwd()
+
+
+def _recorded_outputs(task: dict[str, Any]) -> dict[str, Any]:
+    expected = list(task.get("expected_tokens", []))
+    return {
+        host: {
+            "present": True,
+            "output": _RECORDED_TOKEN_MAP.get(host, f"{host} response: ok"),
+            "passed": all(tok.lower() in _RECORDED_TOKEN_MAP.get(host, "ok") for tok in expected),
+            "mode": "recorded",
+        }
+        for host in get_canonical_hosts()
+    }
+
+
+def run_provider_parity_eval(
+    *,
+    task_path: str,
+    mode: str = "recorded",
+    output_root: str | None = None,
+) -> dict[str, Any]:
+    task_file = Path(task_path)
+    if not task_file.exists():
+        return {"schema": "ProviderParityEvalResult", "status": "error", "error": f"task file not found: {task_path}"}
+
+    try:
+        task = json.loads(task_file.read_text(encoding="utf-8"))
+    except Exception as exc:
+        return {"schema": "ProviderParityEvalResult", "status": "error", "error": str(exc)}
+
+    output = _resolve_output_root(output_root)
+    run_id = hashlib.sha256(f"{task.get('goal', '')}:{_now_iso()}".encode()).hexdigest()[:16]
+    issued_at = _now_iso()
+
+    if mode == "recorded":
+        host_results = _recorded_outputs(task)
+    else:
+        return {
+            "schema": "ProviderParityEvalResult",
+            "status": "error",
+            "error": f"mode '{mode}' requires live provider credentials — use --mode recorded for offline evaluation",
+        }
+
+    canonical = get_canonical_hosts()
+    all_passed = all(
+        host_results.get(h, {}).get("passed", False)
+        for h in canonical
+    )
+
+    report: dict[str, Any] = {
+        "schema": "ProviderParityReport",
+        "run_id": run_id,
+        "mode": mode,
+        "goal": task.get("goal", ""),
+        "issued_at": issued_at,
+        "canonical_hosts": canonical,
+        "host_results": {h: host_results.get(h, {}) for h in canonical},
+        "overall_status": "ok" if all_passed else "drift",
+    }
+
+    report_path = output / ".omg" / "evidence" / "provider-parity-report.json"
+    report_path.parent.mkdir(parents=True, exist_ok=True)
+    report_path.write_text(json.dumps(report, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+
+    return {
+        "schema": "ProviderParityEvalResult",
+        "status": "ok",
+        "mode": mode,
+        "run_id": run_id,
+        "host_results": {h: host_results.get(h, {}) for h in canonical},
+        "overall_status": report["overall_status"],
+        "report": str(report_path.relative_to(output)),
+    }

package/runtime/test_intent_lock.py

@@ -144,18 +144,40 @@ def verify_lock(project_dir: str, run_id: str | None, lock_id: str | None = None
 
 def verify_done_when(metadata: dict[str, Any] | None, run_id: str | None) -> dict[str, Any]:
     metadata_obj = metadata if isinstance(metadata, dict) else {}
+    normalized_run_id = str(run_id or "").strip() or None
+
+    if metadata is None:
+        # No metadata provided at all -- treat the same as metadata without
+        # a done_when key.  This is the common case for CLI / non-Claude
+        # invocations and should not block.
+        return {
+            "status": "ok",
+            "reason": "done_when_not_provided",
+            "run_id": normalized_run_id,
+            "done_when_declared": False,
+            "done_when_completed": False,
+        }
+
+    if "done_when" not in metadata_obj:
+        return {
+            "status": "ok",
+            "reason": "done_when_not_declared",
+            "run_id": normalized_run_id,
+            "done_when_declared": False,
+            "done_when_completed": False,
+        }
+
     criteria = _extract_done_when_criteria(metadata_obj.get("done_when"))
     if not criteria:
         return {
             "status": "missing_done_when",
             "reason": "done_when_required",
-            "run_id": str(run_id or "").strip() or None,
+            "run_id": normalized_run_id,
             "done_when_declared": False,
             "done_when_completed": False,
         }
 
     done_when_run_id = _extract_done_when_run_id(metadata_obj.get("done_when"))
-    normalized_run_id = str(run_id or "").strip()
     if done_when_run_id and normalized_run_id and done_when_run_id != normalized_run_id:
         return {
             "status": "done_when_contract_mismatch",

package/scripts/omg.py

@@ -53,6 +53,7 @@ from runtime.security_check import run_security_check
 from runtime.contract_compiler import (
     build_release_readiness,
     compile_contract_outputs,
+    compile_method_artifacts,
     validate_contract_registry,
 )
 from runtime.tracebank import record_trace
@@ -898,12 +899,20 @@ def cmd_contract_validate(args: argparse.Namespace) -> int:
 
 def cmd_contract_compile(args: argparse.Namespace) -> int:
     hosts = args.hosts or []
-    result = compile_contract_outputs(
-        root_dir=ROOT_DIR,
-        output_root=args.output_root,
-        hosts=hosts,
-        channel=args.channel,
-    )
+    if getattr(args, "method", False):
+        result = compile_method_artifacts(
+            root_dir=ROOT_DIR,
+            output_root=args.output_root,
+            hosts=hosts,
+            channel=args.channel,
+        )
+    else:
+        result = compile_contract_outputs(
+            root_dir=ROOT_DIR,
+            output_root=args.output_root,
+            hosts=hosts,
+            channel=args.channel,
+        )
     print(json.dumps(result, indent=2))
     return 0 if result.get("status") == "ok" else 2
 
@@ -964,6 +973,44 @@ def _add_ecosystem_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
     ecosystem_sync.set_defaults(func=cmd_ecosystem_sync)
 
 
+def cmd_provider_parity_eval(args: argparse.Namespace) -> int:
+    from runtime.provider_parity_eval import run_provider_parity_eval
+    result = run_provider_parity_eval(
+        task_path=args.task,
+        mode=args.mode,
+        output_root=args.output_root or None,
+    )
+    print(json.dumps(result, indent=2))
+    return 0 if result.get("status") == "ok" else 2
+
+
+def cmd_context_compile(args: argparse.Namespace) -> int:
+    from runtime.context_compiler import compile_context_packets
+    hosts = args.hosts or []
+    result = compile_context_packets(
+        root_dir=ROOT_DIR,
+        output_root=args.output_root,
+        hosts=hosts,
+    )
+    print(json.dumps(result, indent=2))
+    return 0 if result.get("status") == "ok" else 2
+
+
+def _add_context_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> None:
+    context_sub = parent.add_subparsers(dest=dest, required=True)
+    context_compile = context_sub.add_parser("compile", help="Compile bounded context packets for canonical hosts")
+    context_compile.add_argument(
+        "--host",
+        dest="hosts",
+        action="append",
+        choices=list(CANONICAL_HOST_CHOICES),
+        required=True,
+        help="Host to compile context for (repeat for multiple hosts)",
+    )
+    context_compile.add_argument("--output-root", default="", help="Write outputs to this root instead of the repo root")
+    context_compile.set_defaults(func=cmd_context_compile)
+
+
 def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> None:
     contract_sub = parent.add_subparsers(dest=dest, required=True)
 
@@ -994,6 +1041,7 @@ def _add_contract_subcommands(parent: argparse.ArgumentParser, *, dest: str) ->
     )
     contract_compile.add_argument("--channel", default="public", choices=["public", "enterprise"])
     contract_compile.add_argument("--output-root", default="", help="Write outputs to this root instead of the repo root")
+    contract_compile.add_argument("--method", action="store_true", default=False, help="Emit signed seven-phase methodology artifacts instead of host artifacts")
     contract_compile.set_defaults(func=cmd_contract_compile)
 
 
@@ -1441,6 +1489,15 @@ def build_parser() -> argparse.ArgumentParser:
     contract = sub.add_parser("contract", help="Canonical OMG contract validation and compilation")
     _add_contract_subcommands(contract, dest="contract_command")
 
+    context_parser = sub.add_parser("context", help="Context packet compiler")
+    _add_context_subcommands(context_parser, dest="context_command")
+
+    parity_eval = sub.add_parser("provider-parity-eval", help="Evaluate provider parity across canonical hosts")
+    parity_eval.add_argument("--task", required=True, help="Path to bounded task JSON file")
+    parity_eval.add_argument("--mode", default="recorded", choices=["recorded", "live"], help="Evaluation mode")
+    parity_eval.add_argument("--output-root", default="", help="Write outputs here instead of repo root")
+    parity_eval.set_defaults(func=cmd_provider_parity_eval)
+
     release = sub.add_parser("release", help="OMG release-readiness checks")
     _add_release_subcommands(release, dest="release_command")
 

package/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.2.3 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.3.0 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -208,6 +208,16 @@
         ],
         "matcher": "Read|Write|Edit|MultiEdit"
       },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/terms-guard.py\"",
+            "timeout": 10
+          }
+        ],
+        "matcher": "Write|Edit|MultiEdit"
+      },
       {
         "hooks": [
           {
@@ -306,7 +316,7 @@
     ]
   },
   "_omg": {
-    "_version": "2.2.3",
+    "_version": "2.3.0",
     "preset": "safe",
     "omgMode": "focused",
     "default_mode": "ulw+ralph",
@@ -366,7 +376,7 @@
       "NOTEBOOKLM": false
     },
     "generated": {
-      "contract_version": "2.2.3",
+      "contract_version": "2.3.0",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",

package/artifacts/release/.agents/skills/omg/AGENTS.fragment.md

@@ -1,75 +0,0 @@
-# OMG Codex Governance (channel: enterprise)
-
-## Build & Test
-
-```bash
-python3 -m pytest tests -q
-python3 scripts/omg.py contract validate
-python3 scripts/omg.py contract compile --host codex --channel enterprise
-```
-
-## Protected Paths
-
-The following paths require tier-gated review before mutation:
-
-- `.omg/**`
-- `.agents/**`
-- `.codex/**`
-- `.claude/**`
-
-## Release Audit
-
-Release readiness requires claim and compliance outcomes:
-
-- `claim_judge`
-- `compliance_governor`
-- `execution_primitives`
-Attestation requirements:
-- `registry.verify_artifact.sign_artifact_statement`
-- `registry.verify_artifact.verify_artifact_statement`
-
-## Evidence Contract
-
-Every production action must emit evidence containing these fields:
-
-- `attestation_statement`
-- `attestation_verifier`
-- `claim_judge_verdict`
-- `compliance_verdict`
-- `executor`
-- `lineage`
-- `timestamp`
-- `trace_id`
-
-## Required Skills
-
-- `omg/control-plane`
-- `omg/mcp-fabric`
-
-## Protected Planning Surface
-
-Council planning skills are protected and explicit-invocation only:
-
-- `omg/plan-council`
-
-## Web Search Policy
-
-- Prefer cached results over live network requests.
-- Do NOT initiate live web searches unless explicitly instructed.
-- Use `context7` or local documentation before external lookups.
-- Set `cached_web_search: prefer_cached` as the default.
-
-## Approval Constraints
-
-- Destructive file operations require explicit user approval.
-- `git push --force` and branch deletions require explicit approval.
-- Production deployments require explicit approval.
-- Mutations to protected paths require tier-gated approval.
-
-## Rules & Automations
-
-- Rules: `protected_paths, explicit_invocation`
-- Automations: `contract-compile, release-readiness`
-- Defer to the repo's `AGENTS.md` / `AGENTS.override.md` instruction hierarchy before OMG-specific guidance.
-- Do not mirror or override Codex built-in slash commands; OMG guidance applies through MCP, skills, and generated rules.
-- Require explicit invocation for protected production planning skills.

package/artifacts/release/.agents/skills/omg/algorithms/SKILL.md

@@ -1,11 +0,0 @@
----
-name: omg-algorithms
-description: "Determinism and benchmark attachments for algorithm-heavy work."
----
-
-# OMG Algorithms Pack
-
-- Channel: `enterprise`
-- Execution modes: `embedded, local_supervisor`
-- MCP servers: `omg-control`
-- Evidence outputs: `.omg/evals/latest.json`

package/artifacts/release/.agents/skills/omg/algorithms/openai.yaml

@@ -1,11 +0,0 @@
-name: omg-algorithms
-description: "Determinism and benchmark attachments for algorithm-heavy work."
-allow_implicit_invocation: false
-metadata:
-  channel: enterprise
-  bundle_id: algorithms
-  title: "OMG Algorithms Pack"
-mcp_servers:
-  - omg-control
-allowed_tools:
-  - "Read"

package/artifacts/release/.agents/skills/omg/api-twin/SKILL.md

@@ -1,11 +0,0 @@
----
-name: omg-api-twin
-description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
----
-
-# OMG API Twin
-
-- Channel: `enterprise`
-- Execution modes: `embedded, local_supervisor`
-- MCP servers: `omg-control`
-- Evidence outputs: `.omg/state/api_twin.json`

package/artifacts/release/.agents/skills/omg/api-twin/openai.yaml

@@ -1,12 +0,0 @@
-name: omg-api-twin
-description: "Versioned endpoint cassette replay with latency, drift, and cost reporting."
-allow_implicit_invocation: false
-metadata:
-  channel: enterprise
-  bundle_id: api-twin
-  title: "OMG API Twin"
-mcp_servers:
-  - omg-control
-allowed_tools:
-  - "Read"
-  - "Bash(python3:*)"

package/artifacts/release/.agents/skills/omg/ast-pack/SKILL.md

@@ -1,11 +0,0 @@
----
-name: omg-ast-pack
-description: "Governed AST search and replace lane with canonical approvals and proofs."
----
-
-# OMG AST Pack Lane
-
-- Channel: `enterprise`
-- Execution modes: `embedded, local_supervisor`
-- MCP servers: `omg-control`
-- Evidence outputs: `.omg/evidence/ast-pack-{run_id}.json`

package/artifacts/release/.agents/skills/omg/ast-pack/openai.yaml

@@ -1,12 +0,0 @@
-name: omg-ast-pack
-description: "Governed AST search and replace lane with canonical approvals and proofs."
-allow_implicit_invocation: false
-metadata:
-  channel: enterprise
-  bundle_id: ast-pack
-  title: "OMG AST Pack Lane"
-mcp_servers:
-  - omg-control
-allowed_tools:
-  - "Grep"
-  - "Edit"

package/artifacts/release/.agents/skills/omg/claim-judge/SKILL.md

@@ -1,11 +0,0 @@
----
-name: omg-claim-judge
-description: "Evidence-backed claim validator for structured release and completion claims."
----
-
-# OMG Claim Judge
-
-- Channel: `enterprise`
-- Execution modes: `embedded, local_supervisor`
-- MCP servers: `omg-control`
-- Evidence outputs: `.omg/evidence/claim-judge-*.json`