@trac3r/oh-my-god 2.2.11

package/registry/omg-capability.schema.json

@@ -0,0 +1,378 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/trac3r00/OMG/registry/omg-capability.schema.json",
+  "title": "OMG Capability Bundle",
+  "version": "2.2.11",
+  "type": "object",
+  "required": [
+    "id",
+    "kind",
+    "version",
+    "title",
+    "description",
+    "hosts",
+    "assets",
+    "invocation_policy",
+    "tool_policy",
+    "lifecycle_hooks",
+    "mcp_contract",
+    "lsp_contract",
+    "evidence_outputs",
+    "execution_contract",
+    "channel_overrides"
+  ],
+  "properties": {
+    "id": {
+      "type": "string"
+    },
+    "kind": {
+      "type": "string"
+    },
+    "version": {
+      "type": "string"
+    },
+    "title": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "hosts": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "claude",
+          "codex",
+          "gemini",
+          "kimi"
+        ]
+      },
+      "minItems": 1
+    },
+    "assets": {
+      "type": "object"
+    },
+    "invocation_policy": {
+      "type": "object"
+    },
+    "tool_policy": {
+      "type": "object"
+    },
+    "lifecycle_hooks": {
+      "type": "object"
+    },
+    "mcp_contract": {
+      "type": "object"
+    },
+    "lsp_contract": {
+      "type": "object"
+    },
+    "evidence_outputs": {
+      "type": "object"
+    },
+    "execution_contract": {
+      "type": "object"
+    },
+    "policy_model": {
+      "type": "object",
+      "required": [
+        "trust_tiers",
+        "tool_policies",
+        "protected_paths",
+        "evidence_contract",
+        "host_rules"
+      ],
+      "properties": {
+        "trust_tiers": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "name",
+              "level",
+              "label",
+              "allowed_sources"
+            ],
+            "properties": {
+              "name": {
+                "type": "string"
+              },
+              "level": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "label": {
+                "type": "string"
+              },
+              "allowed_sources": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "type": "string"
+                }
+              }
+            },
+            "additionalProperties": true
+          }
+        },
+        "tool_policies": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "tool_name",
+              "allowed_tiers",
+              "requires_approval"
+            ],
+            "properties": {
+              "tool_name": {
+                "type": "string"
+              },
+              "allowed_tiers": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "type": "string"
+                }
+              },
+              "requires_approval": {
+                "type": "boolean"
+              }
+            },
+            "additionalProperties": true
+          }
+        },
+        "protected_paths": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "path_pattern",
+              "required_tier"
+            ],
+            "properties": {
+              "path_pattern": {
+                "type": "string"
+              },
+              "required_tier": {
+                "type": "string"
+              }
+            },
+            "additionalProperties": true
+          }
+        },
+        "evidence_contract": {
+          "type": "object",
+          "required": [
+            "timestamp",
+            "executor",
+            "trace_id",
+            "lineage"
+          ],
+          "properties": {
+            "timestamp": {
+              "type": "string"
+            },
+            "executor": {
+              "type": "string"
+            },
+            "trace_id": {
+              "type": "string"
+            },
+            "lineage": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": true
+        },
+        "host_rules": {
+          "type": "object",
+          "required": [
+            "claude",
+            "codex"
+          ],
+          "properties": {
+            "claude": {
+              "type": "object",
+              "required": [
+                "compilation_targets",
+                "hooks",
+                "subagents",
+                "skills"
+              ],
+              "properties": {
+                "compilation_targets": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "hooks": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "subagents": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "skills": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "additionalProperties": true
+            },
+            "codex": {
+              "type": "object",
+              "required": [
+                "compilation_targets",
+                "skills",
+                "agents_fragments",
+                "rules",
+                "automations"
+              ],
+              "properties": {
+                "compilation_targets": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "skills": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "agents_fragments": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "rules": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "automations": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "additionalProperties": true
+            },
+            "gemini": {
+              "type": "object",
+              "required": [
+                "compilation_targets",
+                "mcp",
+                "skills",
+                "automations"
+              ],
+              "properties": {
+                "compilation_targets": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "mcp": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "skills": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "automations": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "additionalProperties": true
+            },
+            "kimi": {
+              "type": "object",
+              "required": [
+                "compilation_targets",
+                "mcp",
+                "skills",
+                "automations"
+              ],
+              "properties": {
+                "compilation_targets": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "mcp": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "skills": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "automations": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "additionalProperties": true
+            }
+          },
+          "additionalProperties": true
+        }
+      },
+      "additionalProperties": true
+    },
+    "channel_overrides": {
+      "type": "object"
+    }
+  },
+  "additionalProperties": true
+}

package/registry/policy-packs/airgapped.lock.json

@@ -0,0 +1,11 @@
+{
+  "lockfile_version": 1,
+  "pack_id": "airgapped",
+  "pack_path": "registry/policy-packs/airgapped.yaml",
+  "canonical_digest": "9cdb4fc37bdd487e7e86bf15460c566b6e2accdda76180582af31fcb8126b90c",
+  "signer_key_id": "1f5fe64ec2f8c901",
+  "signer_public_key": "QwRr/kCSs+lJlOraFdzCDYqqB7ZY/TlU644O+4vcpd4=",
+  "algorithm": "ed25519-minisign",
+  "signature_path": "registry/policy-packs/airgapped.signature.json",
+  "created_at": "2026-03-18T03:27:26.101684+00:00"
+}

package/registry/policy-packs/airgapped.signature.json

@@ -0,0 +1,10 @@
+{
+  "artifact_digest": "9cdb4fc37bdd487e7e86bf15460c566b6e2accdda76180582af31fcb8126b90c",
+  "action": "policy-pack-sign",
+  "scope": "policy-pack/airgapped",
+  "reason": "Signing policy pack airgapped",
+  "signer_key_id": "1f5fe64ec2f8c901",
+  "issued_at": "2026-03-18T03:27:26.101684+00:00",
+  "signature": "untrusted comment: signature from omg local signing key\nQMdksugGU9/OGKu4XYAsxOSpP7YMTdPFe0oBg/99ufVcuGiKcfuEDFgxyOdjprYzrf0ni5LAVKZgzg01Oi9mBw==\ntrusted comment: type=omg-approval-artifact-v1 keyid=1f5fe64ec2f8c901 issued_at=2026-03-18T03:27:26.101684+00:00 digest=9cdb4fc37bdd487e7e86bf15460c566b6e2accdda76180582af31fcb8126b90c\ngs7lk/Rmd9N40Bnk7Ufws9zataQZOa5YGeZRtKDgLlJNqVUfS13l+6Rmz5n+DBmvHe0OJpht7p0aqls86gBZDw==",
+  "run_id": ""
+}

package/registry/policy-packs/airgapped.yaml

@@ -0,0 +1,16 @@
+# Precedence: subscription tier -> channel -> policy pack -> preset
+id: airgapped
+description: Governance overlay for fully disconnected execution environments.
+tool_restrictions:
+  - web_search
+  - browser_automation
+network_posture: airgapped
+approval_threshold: 2
+protected_paths:
+  - .omg/**
+  - .agents/**
+evidence_requirements:
+  - tests
+  - security_scan
+  - audit_trail
+data_sharing: restricted

package/registry/policy-packs/fintech.lock.json

@@ -0,0 +1,11 @@
+{
+  "lockfile_version": 1,
+  "pack_id": "fintech",
+  "pack_path": "registry/policy-packs/fintech.yaml",
+  "canonical_digest": "80be3bbba85fcaefc5b050d42266498cee194696e1977a17b6b8997aaefbefe5",
+  "signer_key_id": "1f5fe64ec2f8c901",
+  "signer_public_key": "QwRr/kCSs+lJlOraFdzCDYqqB7ZY/TlU644O+4vcpd4=",
+  "algorithm": "ed25519-minisign",
+  "signature_path": "registry/policy-packs/fintech.signature.json",
+  "created_at": "2026-03-18T03:27:26.475589+00:00"
+}

package/registry/policy-packs/fintech.signature.json

@@ -0,0 +1,10 @@
+{
+  "artifact_digest": "80be3bbba85fcaefc5b050d42266498cee194696e1977a17b6b8997aaefbefe5",
+  "action": "policy-pack-sign",
+  "scope": "policy-pack/fintech",
+  "reason": "Signing policy pack fintech",
+  "signer_key_id": "1f5fe64ec2f8c901",
+  "issued_at": "2026-03-18T03:27:26.475589+00:00",
+  "signature": "untrusted comment: signature from omg local signing key\nHcEgZw1/hd0rT0ANXeiEa3MJT6k5ijcjleMvqs9usow4VYH75cg0I60+Op3gzRv+CmdkK7N5bnZe7RRu5Kg2DA==\ntrusted comment: type=omg-approval-artifact-v1 keyid=1f5fe64ec2f8c901 issued_at=2026-03-18T03:27:26.475589+00:00 digest=80be3bbba85fcaefc5b050d42266498cee194696e1977a17b6b8997aaefbefe5\nQfAv2+zDOlgwtW+1yftQ0e1b+iHn175zsm4kXnAjpE8etvd6tl1qE7ukwHAMIorgIuxLEtsiKdo8aHQsfyWxBw==",
+  "run_id": ""
+}

package/registry/policy-packs/fintech.yaml

@@ -0,0 +1,15 @@
+# Precedence: subscription tier -> channel -> policy pack -> preset
+id: fintech
+description: Governance overlay tuned for regulated fintech delivery.
+tool_restrictions:
+  - browser_automation
+network_posture: restricted
+approval_threshold: 2
+protected_paths:
+  - .omg/**
+  - .agents/**
+evidence_requirements:
+  - tests
+  - security_scan
+  - audit_trail
+data_sharing: restricted

package/registry/policy-packs/locked-prod.lock.json

@@ -0,0 +1,11 @@
+{
+  "lockfile_version": 1,
+  "pack_id": "locked-prod",
+  "pack_path": "registry/policy-packs/locked-prod.yaml",
+  "canonical_digest": "685ad062bda949705bd3c54ab3670957fbf7638811322f7851d28341a03f0625",
+  "signer_key_id": "1f5fe64ec2f8c901",
+  "signer_public_key": "QwRr/kCSs+lJlOraFdzCDYqqB7ZY/TlU644O+4vcpd4=",
+  "algorithm": "ed25519-minisign",
+  "signature_path": "registry/policy-packs/locked-prod.signature.json",
+  "created_at": "2026-03-19T23:15:10.657950+00:00"
+}

package/registry/policy-packs/locked-prod.signature.json

@@ -0,0 +1,10 @@
+{
+  "artifact_digest": "685ad062bda949705bd3c54ab3670957fbf7638811322f7851d28341a03f0625",
+  "action": "policy-pack-sign",
+  "scope": "policy-pack/locked-prod",
+  "reason": "Signing policy pack locked-prod",
+  "signer_key_id": "1f5fe64ec2f8c901",
+  "issued_at": "2026-03-19T23:15:10.657950+00:00",
+  "signature": "untrusted comment: signature from omg local signing key\nUsgsk5udcAKCj7z0xnfaVneVWuofU8tedanhp4EY1fmEyRj3xXrfVjYhLUDe5tGfzcadTi2/SIJh6Cr14ftmDA==\ntrusted comment: type=omg-approval-artifact-v1 keyid=1f5fe64ec2f8c901 issued_at=2026-03-19T23:15:10.657950+00:00 digest=685ad062bda949705bd3c54ab3670957fbf7638811322f7851d28341a03f0625\nNbE2mftGK941AM+u32p3LgjVZUPE/jyADmREZc6L5cTa/ZAHLamCYhBDF7d544Sctwle5MWIAtQQKRfCOogwCg==",
+  "run_id": ""
+}

package/registry/policy-packs/locked-prod.yaml

@@ -0,0 +1,18 @@
+# Precedence: subscription tier -> channel -> policy pack -> preset
+id: locked-prod
+description: Strict production governance overlay with mandatory human review.
+tool_restrictions:
+  - web_search
+network_posture: restricted
+approval_threshold: 3
+protected_paths:
+  - .omg/**
+  - .agents/**
+  - .claude/**
+  - .codex/**
+evidence_requirements:
+  - tests
+  - security_scan
+  - audit_trail
+  - human_review
+data_sharing: prohibited

package/registry/trusted_signers.json

@@ -0,0 +1,44 @@
+{
+  "version": 1,
+  "generated_by": "phase-0-immediate-fixes-t2",
+  "signers": [
+    {
+      "key_id": "1f5fe64ec2f8c901",
+      "algorithm": "ed25519-minisign",
+      "public_key": "QwRr/kCSs+lJlOraFdzCDYqqB7ZY/TlU644O+4vcpd4=",
+      "status": "active",
+      "usage": [
+        "dev",
+        "test"
+      ],
+      "owner": "omg-local",
+      "notes": "TEST-ONLY trust root — private key is committed in repo. Do NOT use for production attestation. Production signing requires OMG_SIGNING_KEY env var with a key not committed to the repository."
+    },
+    {
+      "key_id": "24280fe9f927c712",
+      "algorithm": "ed25519-minisign",
+      "public_key": "CcVbfRJr1bST580nJFIh8pUNRaMcBDDhGO2GPWVhdI8=",
+      "status": "active",
+      "usage": [
+        "dev",
+        "test",
+        "offline-attestation"
+      ],
+      "owner": "omg-local",
+      "notes": "test-lockfile-fields"
+    },
+    {
+      "key_id": "9902c47f32f29c2e",
+      "algorithm": "ed25519-minisign",
+      "public_key": "sbsqazR1pnPZ9FxutfjVQRz/sN5DTiz9vVMWu5DPfys=",
+      "status": "active",
+      "usage": [
+        "dev",
+        "test",
+        "offline-attestation"
+      ],
+      "owner": "omg-local",
+      "notes": "test-lockfile-fields"
+    }
+  ]
+}