@trac3er/oh-my-god 2.2.4 → 2.2.5

package/plugins/core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-core",
-  "version": "2.2.4",
+  "version": "2.2.5",
   "description": "Core OMG commands - native setup, routing, orchestration, and verification surfaces",
   "type": "omg-plugin",
   "commands": {

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "oh-my-god"
-version = "2.2.4"
+version = "2.2.5"
 description = "OMG (Oh My God) — Multi-agent orchestration, evidence-backed verification, and durable session state for Claude Code, Codex, and supported agent hosts"
 readme = "README.md"
 requires-python = ">=3.10"

package/registry/bundles/algorithms.yaml

@@ -1,6 +1,6 @@
 id: algorithms
 kind: domain-pack
-version: 2.2.4
+version: 2.2.5
 title: OMG Algorithms Pack
 description: Determinism and benchmark attachments for algorithm-heavy work.
 hosts:

package/registry/bundles/api-twin.yaml

@@ -1,6 +1,6 @@
 id: api-twin
 kind: simulation
-version: 2.2.4
+version: 2.2.5
 title: OMG API Twin
 description: Versioned endpoint cassette replay with latency, drift, and cost reporting.
 hosts:

package/registry/bundles/ast-pack.yaml

@@ -1,6 +1,6 @@
 id: ast-pack
 kind: governance
-version: 2.2.4
+version: 2.2.5
 title: OMG AST Pack Lane
 description: Governed AST search and replace lane with canonical approvals and proofs.
 hosts:

package/registry/bundles/claim-judge.yaml

@@ -1,6 +1,6 @@
 id: claim-judge
 kind: proof
-version: 2.2.4
+version: 2.2.5
 title: OMG Claim Judge
 description: Evidence-backed claim validator for structured release and completion claims.
 hosts:

package/registry/bundles/control-plane.yaml

@@ -1,6 +1,6 @@
 id: control-plane
 kind: skill
-version: 2.2.4
+version: 2.2.5
 title: OMG Control Plane
 description: Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi.
 hosts:

package/registry/bundles/data-lineage.yaml

@@ -1,6 +1,6 @@
 id: data-lineage
 kind: provenance
-version: 2.2.4
+version: 2.2.5
 title: OMG Data Lineage
 description: Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts.
 hosts:

package/registry/bundles/delta-classifier.yaml

@@ -1,6 +1,6 @@
 id: delta-classifier
 kind: routing
-version: 2.2.4
+version: 2.2.5
 title: OMG Delta Classifier
 description: Change classifier that attaches risk-aware checks, approvals, and packs.
 hosts:

package/registry/bundles/eval-gate.yaml

@@ -1,6 +1,6 @@
 id: eval-gate
 kind: evaluation
-version: 2.2.4
+version: 2.2.5
 title: OMG Eval Gate
 description: Reproducible evaluation gate that blocks regressions before release.
 hosts:

package/registry/bundles/hash-edit.yaml

@@ -1,6 +1,6 @@
 id: hash-edit
 kind: governance
-version: 2.2.4
+version: 2.2.5
 title: OMG Hash Edit Lane
 description: Governed hash-bound edit lane with signed approvals and evidence routing.
 hosts:

package/registry/bundles/health.yaml

@@ -1,6 +1,6 @@
 id: health
 kind: domain-pack
-version: 2.2.4
+version: 2.2.5
 title: OMG Health Pack
 description: Health-sensitive approvals, provenance, and replay attachments.
 hosts:

package/registry/bundles/hook-governor.yaml

@@ -1,6 +1,6 @@
 id: hook-governor
 kind: governance
-version: 2.2.4
+version: 2.2.5
 title: OMG Hook Governor
 description: Canonical hook ordering, policy reinjection, and protected-path governance.
 hosts:

package/registry/bundles/incident-replay.yaml

@@ -1,6 +1,6 @@
 id: incident-replay
 kind: debugging
-version: 2.2.4
+version: 2.2.5
 title: OMG Incident Replay
 description: Replayable bug packs built from logs, failing tests, traces, and diffs.
 hosts:

package/registry/bundles/lsp-pack.yaml

@@ -1,6 +1,6 @@
 id: lsp-pack
 kind: diagnostics
-version: 2.2.4
+version: 2.2.5
 title: OMG LSP Pack
 description: Optional LSP-backed diagnostics and navigation bundle for production verification.
 hosts:

package/registry/bundles/mcp-fabric.yaml

@@ -1,6 +1,6 @@
 id: mcp-fabric
 kind: mcp
-version: 2.2.4
+version: 2.2.5
 title: OMG MCP Fabric
 description: Tools, prompts, resources, and server instructions for the OMG control plane.
 hosts:

package/registry/bundles/plan-council.yaml

@@ -1,6 +1,6 @@
 id: plan-council
 kind: planning
-version: 2.2.4
+version: 2.2.5
 title: OMG Plan Council
 description: Canonical council-style planning bundle for explicit, evidence-backed deep plans.
 hosts:

package/registry/bundles/preflight.yaml

@@ -1,6 +1,6 @@
 id: preflight
 kind: routing
-version: 2.2.4
+version: 2.2.5
 title: OMG Preflight
 description: Repo-aware route selection based on diff, manifests, and classified risk.
 hosts:

package/registry/bundles/proof-gate.yaml

@@ -1,6 +1,6 @@
 id: proof-gate
 kind: proof
-version: 2.2.4
+version: 2.2.5
 title: OMG Proof Gate
 description: Structured release proof gate that binds claims to required evidence artifacts and trace links.
 hosts:

package/registry/bundles/remote-supervisor.yaml

@@ -1,6 +1,6 @@
 id: remote-supervisor
 kind: orchestration
-version: 2.2.4
+version: 2.2.5
 title: OMG Remote Supervisor
 description: Local-only authenticated supervisor sessions for worker orchestration.
 hosts:

package/registry/bundles/robotics.yaml

@@ -1,6 +1,6 @@
 id: robotics
 kind: domain-pack
-version: 2.2.4
+version: 2.2.5
 title: OMG Robotics Pack
 description: Robotics safety policy, replay, and evaluation attachments.
 hosts:

package/registry/bundles/secure-worktree-pipeline.yaml

@@ -1,6 +1,6 @@
 id: secure-worktree-pipeline
 kind: runtime
-version: 2.2.4
+version: 2.2.5
 title: OMG Secure Worktree Pipeline
 description: Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs.
 hosts:

package/registry/bundles/security-check.yaml

@@ -1,6 +1,6 @@
 id: security-check
 kind: security
-version: 2.2.4
+version: 2.2.5
 title: OMG Security Check
 description: Canonical security audit bundle with provenance, trust scoring, and deterministic evidence.
 hosts:

package/registry/bundles/terminal-lane.yaml

@@ -1,6 +1,6 @@
 id: terminal-lane
 kind: governance
-version: 2.2.4
+version: 2.2.5
 title: OMG Terminal Lane
 description: Highest-risk governed terminal execution lane with strict approval and attestation.
 hosts:

package/registry/bundles/test-intent-lock.yaml

@@ -1,6 +1,6 @@
 id: test-intent-lock
 kind: proof
-version: 2.2.4
+version: 2.2.5
 title: OMG Test Intent Lock
 description: Structured test-delta guard that blocks weakened tests unless explicit override evidence is present.
 hosts:

package/registry/bundles/tracebank.yaml

@@ -1,6 +1,6 @@
 id: tracebank
 kind: evidence
-version: 2.2.4
+version: 2.2.5
 title: OMG Tracebank
 description: Structured plan-to-patch-to-verify trace capture for OMG routes.
 hosts:

package/registry/bundles/vision.yaml

@@ -1,6 +1,6 @@
 id: vision
 kind: domain-pack
-version: 2.2.4
+version: 2.2.5
 title: OMG Vision Pack
 description: Vision-specific OCR, comparison, lineage, drift, and replay attachments.
 hosts:

package/registry/omg-capability.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
   "title": "OMG Capability Bundle",
-  "version": "2.2.4",
+  "version": "2.2.5",
   "type": "object",
   "required": [
     "id",

package/registry/policy-packs/airgapped.yaml

@@ -0,0 +1,16 @@
+# Precedence: subscription tier -> channel -> policy pack -> preset
+id: airgapped
+description: Governance overlay for fully disconnected execution environments.
+tool_restrictions:
+  - web_search
+  - browser_automation
+network_posture: airgapped
+approval_threshold: 2
+protected_paths:
+  - .omg/**
+  - .agents/**
+evidence_requirements:
+  - tests
+  - security_scan
+  - audit_trail
+data_sharing: restricted

package/registry/policy-packs/fintech.yaml

@@ -0,0 +1,15 @@
+# Precedence: subscription tier -> channel -> policy pack -> preset
+id: fintech
+description: Governance overlay tuned for regulated fintech delivery.
+tool_restrictions:
+  - browser_automation
+network_posture: restricted
+approval_threshold: 2
+protected_paths:
+  - .omg/**
+  - .agents/**
+evidence_requirements:
+  - tests
+  - security_scan
+  - audit_trail
+data_sharing: restricted

package/registry/policy-packs/locked-prod.yaml

@@ -0,0 +1,18 @@
+# Precedence: subscription tier -> channel -> policy pack -> preset
+id: locked-prod
+description: Strict production governance overlay with mandatory human review.
+tool_restrictions:
+  - web_search
+network_posture: restricted
+approval_threshold: 3
+protected_paths:
+  - .omg/**
+  - .agents/**
+  - .claude/**
+  - .codex/**
+evidence_requirements:
+  - tests
+  - security_scan
+  - audit_trail
+  - human_review
+data_sharing: prohibited

package/runtime/adoption.py

@@ -7,19 +7,22 @@ import shutil
 from pathlib import Path
 from typing import Callable, cast
 
+from runtime.canonical_taxonomy import CANONICAL_PRESETS, RELEASE_CHANNELS
+
 
 CANONICAL_BRAND = "OMG"
 CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.2.4"
+CANONICAL_VERSION = "2.2.5"
 
 VALID_ADOPTION_MODES = ("omg-only", "coexist")
 CANONICAL_MODE_NAMES = ("chill", "focused", "exploratory")
 
-PRESET_ORDER: tuple[str, ...] = ("safe", "balanced", "interop", "labs", "buffet", "production")
-VALID_PRESETS = PRESET_ORDER
+PRESET_ORDER: tuple[str, ...] = CANONICAL_PRESETS
+VALID_PRESETS = CANONICAL_PRESETS
+VALID_RELEASE_CHANNELS = RELEASE_CHANNELS
 PRESET_LEVEL: dict[str, int] = {p: i for i, p in enumerate(PRESET_ORDER)}
 
 MANAGED_PRESET_FLAGS = (

package/runtime/canonical_taxonomy.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+
+RELEASE_CHANNELS: tuple[str, ...] = ("public", "enterprise")
+CANONICAL_PRESETS: tuple[str, ...] = ("safe", "balanced", "interop", "labs", "buffet", "production")
+SUBSCRIPTION_TIERS: tuple[str, ...] = ("free", "pro", "team", "enterprise_tier")
+POLICY_PACK_IDS: tuple[str, ...] = ("fintech", "airgapped", "locked-prod")
+
+
+def _assert_disjoint_namespaces() -> None:
+    namespaces: tuple[tuple[str, tuple[str, ...]], ...] = (
+        ("RELEASE_CHANNELS", RELEASE_CHANNELS),
+        ("CANONICAL_PRESETS", CANONICAL_PRESETS),
+        ("SUBSCRIPTION_TIERS", SUBSCRIPTION_TIERS),
+        ("POLICY_PACK_IDS", POLICY_PACK_IDS),
+    )
+
+    seen: dict[str, str] = {}
+    for namespace, values in namespaces:
+        for value in values:
+            owner = seen.get(value)
+            if owner is not None:
+                raise ValueError(f"{value!r} is defined in both {owner} and {namespace}")
+            seen[value] = namespace
+
+
+_assert_disjoint_namespaces()

package/runtime/compat.py

@@ -6,12 +6,14 @@ from __future__ import annotations
 
 from collections import Counter
 from datetime import datetime, timezone
+from importlib import import_module
 import json
 import os
 from pathlib import Path
 import re
 import sys
-from typing import Any
+import tempfile
+from typing import Any, Callable, TypedDict
 
 from hooks.policy_engine import evaluate_bash_command
 from lab.pipeline import run_pipeline
@@ -55,6 +57,11 @@ def _now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
+def _normalize_verdict_payload(payload: dict[str, Any]) -> dict[str, Any]:
+    module = import_module("runtime.verdict_schema")
+    return dict(module.normalize_verdict(payload))
+
+
 def _project_dir(project_dir: str | None) -> str:
     return project_dir or os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
 
@@ -846,12 +853,203 @@ def run_doctor(*, root_dir: Path | None = None) -> dict[str, Any]:
     checks.append(plugin_check)
 
     has_blocker = any(c["status"] == "blocker" for c in checks)
+    verdict_receipt = _normalize_verdict_payload({
+        "status": "fail" if has_blocker else "pass",
+        "blockers": [
+            str(check.get("name", ""))
+            for check in checks
+            if check.get("status") == "blocker"
+        ],
+        "planned_actions": [
+            "Fix blocker checks before shipping.",
+        ],
+        "executed_actions": [
+            "run_doctor",
+        ],
+        "provenance": "runtime.compat.run_doctor",
+        "evidence_paths": {},
+        "next_steps": [
+            "Fix any blocker checks before shipping.",
+        ],
+        "executed": True,
+    })
     return {
         "schema": "DoctorResult",
         "status": "fail" if has_blocker else "pass",
+        "verdict": "fail" if has_blocker else "pass",
         "checks": checks,
         "plugin_compatibility": plugin_check,
         "version": CANONICAL_VERSION,
+        "verdict_receipt": verdict_receipt,
+    }
+
+
+class DoctorFixSpec(TypedDict):
+    fixable: bool
+    fix_handler: Callable[[Path, dict[str, Any]], dict[str, Any]] | None
+    fixable_in_context: bool
+    suggestion: str
+
+
+def _fix_omg_control_reachable(root_dir: Path, _check: dict[str, Any]) -> dict[str, Any]:
+    from runtime.config_transaction import ConfigTransaction
+
+    mcp_json_path = root_dir / ".mcp.json"
+    mcp_data: dict[str, Any] = {}
+    if mcp_json_path.exists():
+        try:
+            with open(mcp_json_path, "r", encoding="utf-8") as f:
+                mcp_data = json.load(f)
+        except (json.JSONDecodeError, OSError):
+            pass
+    servers = mcp_data.setdefault("mcpServers", {})
+    servers["omg-control"] = {
+        "command": "python3",
+        "args": ["-m", "runtime.omg_mcp_server"],
+    }
+    content = json.dumps(mcp_data, indent=2, ensure_ascii=True) + "\n"
+    return {"planned_path": str(mcp_json_path), "content": content, "mode": 0o644}
+
+
+def _fix_policy_files(root_dir: Path, _check: dict[str, Any]) -> dict[str, Any]:
+    policy_path = root_dir / ".omg" / "policy.yaml"
+    if policy_path.exists():
+        return {}
+    content = "mode: warn_and_run\ncritical_block: true\n"
+    return {"planned_path": str(policy_path), "content": content, "mode": 0o644}
+
+
+def _fix_metadata_drift(root_dir: Path, check: dict[str, Any]) -> dict[str, Any]:
+    from runtime.adoption import CANONICAL_VERSION
+    from runtime.contract_compiler import _check_version_identity_drift
+
+    drift_result = _check_version_identity_drift(root_dir)
+    drift_details = drift_result.get("drift_details", {})
+    if not drift_details:
+        return {}
+
+    first_label = next(iter(drift_details))
+    old_version = drift_details[first_label]
+    parts = first_label.split(":", 1)
+    rel_path = parts[0] if parts else first_label
+    target = root_dir / rel_path
+    if not target.exists():
+        return {}
+    original = target.read_text(encoding="utf-8")
+    patched = original.replace(old_version, CANONICAL_VERSION) if old_version != "<not found>" else original
+    if patched == original:
+        return {}
+    return {"planned_path": str(target), "content": patched, "mode": 0o644}
+
+
+DOCTOR_FIX_SPECS: dict[str, DoctorFixSpec] = {
+    "python_version": {
+        "fixable": False,
+        "fix_handler": None,
+        "fixable_in_context": False,
+        "suggestion": "Install Python >= 3.10 from python.org or via your package manager",
+    },
+    "fastmcp": {
+        "fixable": False,
+        "fix_handler": None,
+        "fixable_in_context": False,
+        "suggestion": "Run: pip install fastmcp",
+    },
+    "omg_control_reachable": {
+        "fixable": True,
+        "fix_handler": _fix_omg_control_reachable,
+        "fixable_in_context": True,
+        "suggestion": "",
+    },
+    "policy_files": {
+        "fixable": True,
+        "fix_handler": _fix_policy_files,
+        "fixable_in_context": True,
+        "suggestion": "",
+    },
+    "metadata_drift": {
+        "fixable": True,
+        "fix_handler": _fix_metadata_drift,
+        "fixable_in_context": True,
+        "suggestion": "",
+    },
+}
+
+_DEFAULT_FIX_SPEC: DoctorFixSpec = {
+    "fixable": False,
+    "fix_handler": None,
+    "fixable_in_context": False,
+    "suggestion": "Manual intervention required",
+}
+
+
+def run_doctor_fix(*, root_dir: Path | None = None, dry_run: bool = True) -> dict[str, Any]:
+    from runtime.config_transaction import ConfigTransaction, ConfigTransactionError
+
+    doctor_result = run_doctor(root_dir=root_dir)
+    repo_root = root_dir or Path(__file__).resolve().parent.parent
+
+    enriched_checks: list[dict[str, Any]] = []
+    fix_receipts: list[dict[str, Any]] = []
+
+    for check in doctor_result["checks"]:
+        spec = DOCTOR_FIX_SPECS.get(check["name"], _DEFAULT_FIX_SPEC)
+        enriched = dict(check)
+        enriched["fixable"] = spec["fixable"]
+        if not spec["fixable"]:
+            enriched["suggestion"] = spec["suggestion"]
+        enriched_checks.append(enriched)
+
+        if check["status"] == "ok" or not spec["fixable"] or spec["fix_handler"] is None:
+            continue
+
+        handler = spec["fix_handler"]
+        plan_data = handler(repo_root, check)
+        if not plan_data or "planned_path" not in plan_data:
+            continue
+
+        lock_dir = tempfile.mkdtemp(prefix="doctor-fix-")
+        tx = ConfigTransaction(
+            lock_path=Path(lock_dir) / "doctor-fix.lock",
+            backup_root=Path(lock_dir) / "backups",
+        )
+        tx.plan(
+            plan_data["planned_path"],
+            plan_data["content"],
+            mode=plan_data.get("mode", 0o644),
+        )
+
+        try:
+            receipt = tx.dry_run() if dry_run else tx.execute()
+        except ConfigTransactionError as exc:
+            receipt = exc.receipt or {
+                "planned_writes": [],
+                "executed_writes": [],
+                "backup_path": "",
+                "verification": {},
+                "executed": False,
+                "rollback": None,
+            }
+
+        fix_receipts.append({
+            "check": check["name"],
+            "action": plan_data.get("action", f"fix_{check['name']}"),
+            "backup_path": receipt.get("backup_path", ""),
+            "verification": receipt.get("verification", {}),
+            "executed": receipt.get("executed", False),
+            "rollback": receipt.get("rollback"),
+        })
+
+    has_blocker = any(c["status"] == "blocker" for c in enriched_checks)
+    unfixed_blockers = has_blocker and dry_run
+
+    return {
+        "schema": "DoctorFixResult",
+        "mode": "dry_run" if dry_run else "fix",
+        "status": "fail" if unfixed_blockers else doctor_result["status"],
+        "checks": enriched_checks,
+        "fix_receipts": fix_receipts,
+        "version": CANONICAL_VERSION,
     }
 
 
@@ -1294,10 +1492,26 @@ def dispatch_compat_skill(
     if route == "health":
         if normalized == "omg-doctor":
             doctor_result = run_doctor(root_dir=Path(root))
+            verdict_receipt = _normalize_verdict_payload({
+                "status": doctor_result.get("status", "pending"),
+                "verdict": doctor_result.get("verdict", doctor_result.get("status", "pending")),
+                "blockers": doctor_result.get("verdict_receipt", {}).get("blockers", []),
+                "planned_actions": doctor_result.get("verdict_receipt", {}).get("planned_actions", []),
+                "executed_actions": doctor_result.get("verdict_receipt", {}).get("executed_actions", []),
+                "provenance": "runtime.compat.dispatch_compat_skill",
+                "evidence_paths": doctor_result.get("verdict_receipt", {}).get("evidence_paths", {}),
+                "next_steps": doctor_result.get("verdict_receipt", {}).get("next_steps", []),
+                "executed": True,
+                "metadata": {
+                    "checks": doctor_result.get("checks", []),
+                },
+            })
             snapshot = {
                 "project_dir": root,
                 "status": doctor_result["status"],
+                "verdict": doctor_result.get("verdict", doctor_result["status"]),
                 "checks": doctor_result["checks"],
+                "verdict_receipt": verdict_receipt,
             }
             return _res(
                 skill=normalized,