devrites 4.7.0 → 5.1.0

package/engine/internal/devritespaths/paths.go

@@ -15,8 +15,10 @@ const (
 
 	ClaudeSkillsTarget    = ".claude/skills"
 	CodexSkillsTarget     = ".agents/skills"
+	OmpSkillsTarget       = ".omp/skills"
 	ClaudeAgentsTarget    = ".claude/agents"
 	CodexAgentsTarget     = ".codex/agents"
+	OmpAgentsTarget       = ".omp/agents"
 	ClaudeWorkflowsTarget = ".claude/workflows"
 
 	ManifestName = ".claude/devrites.manifest"
@@ -175,6 +177,7 @@ func ActiveSlug(root string) (string, error) {
 	if info, err := os.Lstat(activePath); err == nil && info.Mode()&os.ModeSymlink != 0 {
 		return "", fmt.Errorf("DRV-ACTIVE-SYMLINK: ACTIVE is a symlink; run `rm -f %q`", activePath)
 	}
+	// #nosec G304 -- operator-supplied workspace root; ACTIVE symlink refused above
 	raw, err := os.ReadFile(activePath)
 	if errors.Is(err, os.ErrNotExist) {
 		return "", nil

package/engine/internal/fsutil/copy.go

@@ -84,6 +84,7 @@ func CopyTree(src, dst string) error {
 		return fmt.Errorf("copy %s: %w", src, err)
 	}
 	if !info.IsDir() {
+		// #nosec G304 -- src is an engine-managed path inside the operator-supplied root
 		data, err := os.ReadFile(src)
 		if err != nil {
 			return fmt.Errorf("copy %s: %w", src, err)
@@ -91,6 +92,7 @@ func CopyTree(src, dst string) error {
 		if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
 			return fmt.Errorf("copy to %s: %w", dst, err)
 		}
+		// #nosec G703 -- dst mirrors src within the same managed tree
 		return os.WriteFile(dst, data, 0o644)
 	}
 	entries, err := os.ReadDir(src)

package/engine/internal/gate/gate.go

@@ -103,6 +103,12 @@ func checkObservation(kind Kind, observation *state.WorkspaceObservation) (*Resu
 			}
 		}
 	}
+	if len(missingFiles) == 0 {
+		for _, problem := range acceptanceMapProblems(observation, policy) {
+			stateProblems = append(stateProblems, "acceptance-map: "+problem)
+			blocked = true
+		}
+	}
 	if len(missingFiles) == 0 && phaseRequiresReadinessBinding(policy) {
 		expected, bindingErr := verifyReadinessBinding(observation)
 		if bindingErr != nil {
@@ -136,6 +142,30 @@ func checkObservation(kind Kind, observation *state.WorkspaceObservation) (*Resu
 	return result, nil
 }
 
+func acceptanceMapProblems(observation *state.WorkspaceObservation, policy state.PhasePolicy) []string {
+	requireTasks := phaseRequiresTasks(policy)
+	requireTestPlan := phaseRequiresTestPlan(policy)
+	if !requireTasks && !requireTestPlan {
+		return nil
+	}
+	spec, ok := observation.Fact("spec.md")
+	if !ok || spec.State() != state.ArtifactPresent {
+		return nil
+	}
+	var tasks, testPlan []byte
+	if requireTasks {
+		if fact, ok := observation.Fact("tasks.md"); ok && fact.State() == state.ArtifactPresent {
+			tasks = fact.Bytes()
+		}
+	}
+	if requireTestPlan {
+		if fact, ok := observation.Fact("test-plan.md"); ok && fact.State() == state.ArtifactPresent {
+			testPlan = fact.Bytes()
+		}
+	}
+	return state.ParseAcceptanceMap(spec.Bytes(), tasks, testPlan, requireTasks, requireTestPlan).Problems
+}
+
 func missingSections(observation *state.WorkspaceObservation, required []state.Section) []state.Section {
 	var missing []state.Section
 	for _, section := range required {

package/engine/internal/gate/readiness_binding.go

@@ -149,17 +149,20 @@ func readinessDiagnosticError(diagnostic state.ArtifactDiagnostic) error {
 }
 
 func phaseRequiresTasks(policy state.PhasePolicy) bool {
-	for _, artifact := range policy.RequiredArtifacts {
-		if artifact == "tasks.md" {
-			return true
-		}
-	}
-	return false
+	return policyRequires(policy, "tasks.md")
+}
+
+func phaseRequiresTestPlan(policy state.PhasePolicy) bool {
+	return policyRequires(policy, "test-plan.md")
 }
 
 func phaseRequiresReadinessBinding(policy state.PhasePolicy) bool {
+	return policyRequires(policy, "eng-review.md")
+}
+
+func policyRequires(policy state.PhasePolicy, name state.ArtifactPath) bool {
 	for _, artifact := range policy.RequiredArtifacts {
-		if artifact == "eng-review.md" {
+		if artifact == name {
 			return true
 		}
 	}

package/engine/internal/gate/readiness_binding_test.go

@@ -97,7 +97,7 @@ func TestReadinessBindingBindsOnlyStableBuildInputs(t *testing.T) {
 func TestReadinessBindingGoldenDigest(t *testing.T) {
 	root := t.TempDir()
 	writeReadinessFixture(t, root, "golden", "build")
-	const want = "Readiness inputs SHA-256: c4a073e85373f5fd9f9302c61b6772e766e4fa2a3da2ccc77bad23756c9f412d"
+	const want = "Readiness inputs SHA-256: 6a0d4991d86f5a0e78333289840b5fb1a123adbb18b53243b1af34fcffcf1961"
 	if got := mustReadinessBinding(t, root, "golden"); got != want {
 		t.Fatalf("ReadinessBinding()=%q, want %q", got, want)
 	}
@@ -367,6 +367,48 @@ func TestReadinessDiagnosticPayloads(t *testing.T) {
 	}
 }
 
+func TestCheckReadinessBlocksUnmappedAcceptance(t *testing.T) {
+	root := t.TempDir()
+	workspace := writeReadinessFixture(t, root, "unmapped", "build")
+	testutil.WriteFile(t, filepath.Join(workspace, "spec.md"), "# Spec\n\n## Acceptance criteria\n- AC-002: extra requirement.\n")
+	binding := mustReadinessBinding(t, root, "unmapped")
+	testutil.AppendFile(t, filepath.Join(workspace, "eng-review.md"), "\n"+binding+"\n")
+
+	result, err := Check(Readiness, root, "unmapped")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !result.Blocked || result.ReasonID != reason.GateReadinessMissing {
+		t.Fatalf("blocked=%v reason=%q render=%s", result.Blocked, result.ReasonID, result.Render())
+	}
+	joined := strings.Join(result.StateProblems, "\n")
+	for _, want := range []string{
+		"acceptance-map: acceptance AC-002 is not referenced in tasks.md",
+		"acceptance-map: acceptance AC-002 is not referenced in test-plan.md",
+	} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("missing %q in %q", want, joined)
+		}
+	}
+}
+
+func TestCheckReadinessPassesMappedAcceptance(t *testing.T) {
+	root := t.TempDir()
+	workspace := writeReadinessFixture(t, root, "mapped", "build")
+	testutil.WriteFile(t, filepath.Join(workspace, "spec.md"), "# Spec\n\n## Acceptance criteria\n- AC-001: bind readiness inputs.\n")
+	testutil.WriteFile(t, filepath.Join(workspace, "test-plan.md"), "# Test plan\n\nAC-001 focused tests.\n")
+	binding := mustReadinessBinding(t, root, "mapped")
+	testutil.AppendFile(t, filepath.Join(workspace, "eng-review.md"), "\n"+binding+"\n")
+
+	result, err := Check(Readiness, root, "mapped")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Blocked {
+		t.Fatalf("mapped acceptance blocked: %s", result.Render())
+	}
+}
+
 func writeReadinessFixture(t *testing.T, root, slug, phase string) string {
 	t.Helper()
 	workspace := filepath.Join(root, "work", slug)

package/engine/internal/hostpack/hostpack.go

@@ -16,8 +16,10 @@ import (
 const (
 	ClaudeSkillsTarget    = devritespaths.ClaudeSkillsTarget
 	CodexSkillsTarget     = devritespaths.CodexSkillsTarget
+	OmpSkillsTarget       = devritespaths.OmpSkillsTarget
 	ClaudeAgentsTarget    = devritespaths.ClaudeAgentsTarget
 	CodexAgentsTarget     = devritespaths.CodexAgentsTarget
+	OmpAgentsTarget       = devritespaths.OmpAgentsTarget
 	ClaudeWorkflowsTarget = devritespaths.ClaudeWorkflowsTarget
 )
 
@@ -123,7 +125,7 @@ var managedMerges = []ManagedMerge{
 	LegacyCodexHooksMerge,
 }
 
-func RequiredPayload(withCodex bool) []string {
+func RequiredPayload(withCodex, withOmp bool) []string {
 	required := []string{
 		"claude/skills",
 		"claude/agents",
@@ -138,11 +140,18 @@ func RequiredPayload(withCodex bool) []string {
 			"codex/config.toml",
 		)
 	}
+	if withOmp {
+		required = append(required,
+			"omp/skills",
+			"omp/agents",
+			"omp/.omp-plugin/plugin.json",
+		)
+	}
 	return required
 }
 
-func ValidatePayload(payload fs.FS, withCodex bool) error {
-	for _, rel := range RequiredPayload(withCodex) {
+func ValidatePayload(payload fs.FS, withCodex, withOmp bool) error {
+	for _, rel := range RequiredPayload(withCodex, withOmp) {
 		if _, err := fs.Stat(payload, rel); err != nil {
 			return fmt.Errorf("missing %s", rel)
 		}
@@ -150,19 +159,25 @@ func ValidatePayload(payload fs.FS, withCodex bool) error {
 	return nil
 }
 
-func InstallTrees(withSkills, withAgents, withCodex bool) []Tree {
+func InstallTrees(withSkills, withAgents, withCodex, withOmp bool) []Tree {
 	var trees []Tree
 	if withSkills {
 		trees = append(trees, Tree{PayloadPrefix: "claude/skills", TargetPrefix: ClaudeSkillsTarget})
 		if withCodex {
 			trees = append(trees, Tree{PayloadPrefix: "codex/skills", TargetPrefix: CodexSkillsTarget})
 		}
+		if withOmp {
+			trees = append(trees, Tree{PayloadPrefix: "omp/skills", TargetPrefix: OmpSkillsTarget})
+		}
 	}
 	if withAgents {
 		trees = append(trees, Tree{PayloadPrefix: "claude/agents", TargetPrefix: ClaudeAgentsTarget})
 		if withCodex {
 			trees = append(trees, Tree{PayloadPrefix: "codex/agents", TargetPrefix: CodexAgentsTarget})
 		}
+		if withOmp {
+			trees = append(trees, Tree{PayloadPrefix: "omp/agents", TargetPrefix: OmpAgentsTarget})
+		}
 	}
 	if withSkills && withAgents {
 		trees = append(trees, Tree{PayloadPrefix: "claude/workflows", TargetPrefix: ClaudeWorkflowsTarget})
@@ -170,11 +185,14 @@ func InstallTrees(withSkills, withAgents, withCodex bool) []Tree {
 	return trees
 }
 
-func AliasTargets(alias Alias, withCodex bool) []string {
+func AliasTargets(alias Alias, withCodex, withOmp bool) []string {
 	targets := []string{filepath.ToSlash(filepath.Join(ClaudeSkillsTarget, alias.Name, "SKILL.md"))}
 	if withCodex {
 		targets = append(targets, filepath.ToSlash(filepath.Join(CodexSkillsTarget, alias.Name, "SKILL.md")))
 	}
+	if withOmp {
+		targets = append(targets, filepath.ToSlash(filepath.Join(OmpSkillsTarget, alias.Name, "SKILL.md")))
+	}
 	return targets
 }
 

package/engine/internal/hostpack/hostpack_test.go

@@ -18,39 +18,75 @@ func TestValidatePayloadRequiresClaudeAndCodexFiles(t *testing.T) {
 		"codex/agents/devrites-code-reviewer.toml":     {},
 		"codex/AGENTS.md":                              {},
 		"codex/config.toml":                            {},
+		"omp/skills/rite/SKILL.md":                     {},
+		"omp/agents/devrites-code-reviewer.md":         {},
+		"omp/.omp-plugin/plugin.json":                  {},
 	}
-	if err := ValidatePayload(payload, true); err != nil {
+	if err := ValidatePayload(payload, true, true); err != nil {
 		t.Fatal(err)
 	}
 	delete(payload, "codex/config.toml")
-	err := ValidatePayload(payload, true)
+	err := ValidatePayload(payload, true, true)
 	if err == nil || !strings.Contains(err.Error(), "missing codex/config.toml") {
 		t.Fatalf("ValidatePayload error = %v, want missing codex/config.toml", err)
 	}
-	if err := ValidatePayload(payload, false); err != nil {
+	if err := ValidatePayload(payload, false, true); err != nil {
 		t.Fatalf("claude-only payload should not require codex files: %v", err)
 	}
+	delete(payload, "omp/.omp-plugin/plugin.json")
+	err = ValidatePayload(payload, false, true)
+	if err == nil || !strings.Contains(err.Error(), "missing omp/.omp-plugin/plugin.json") {
+		t.Fatalf("ValidatePayload error = %v, want missing omp/.omp-plugin/plugin.json", err)
+	}
+	if err := ValidatePayload(payload, false, false); err != nil {
+		t.Fatalf("claude-only payload should not require omp files: %v", err)
+	}
 }
 
 func TestInstallTreesMapPayloadsToTargets(t *testing.T) {
-	got := InstallTrees(true, true, true)
+	got := InstallTrees(true, true, true, true)
 	want := []Tree{
 		{PayloadPrefix: "claude/skills", TargetPrefix: ".claude/skills"},
 		{PayloadPrefix: "codex/skills", TargetPrefix: ".agents/skills"},
+		{PayloadPrefix: "omp/skills", TargetPrefix: ".omp/skills"},
 		{PayloadPrefix: "claude/agents", TargetPrefix: ".claude/agents"},
 		{PayloadPrefix: "codex/agents", TargetPrefix: ".codex/agents"},
+		{PayloadPrefix: "omp/agents", TargetPrefix: ".omp/agents"},
 		{PayloadPrefix: "claude/workflows", TargetPrefix: ".claude/workflows"},
 	}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("InstallTrees() = %#v, want %#v", got, want)
 	}
-	for _, trees := range [][]Tree{InstallTrees(true, false, true), InstallTrees(false, true, true)} {
+	for _, trees := range [][]Tree{InstallTrees(true, false, true, true), InstallTrees(false, true, true, true)} {
 		for _, tree := range trees {
 			if tree.PayloadPrefix == "claude/workflows" {
 				t.Fatal("Claude workflow installed without both skills and agents")
 			}
 		}
 	}
+	for _, tree := range InstallTrees(true, true, true, false) {
+		if strings.HasPrefix(tree.TargetPrefix, ".omp/") {
+			t.Fatalf("omp tree installed with withOmp=false: %#v", tree)
+		}
+	}
+}
+
+func TestAliasTargetsIncludeOmpWhenEnabled(t *testing.T) {
+	got := AliasTargets(Alias{Name: "define"}, true, true)
+	want := []string{
+		".claude/skills/define/SKILL.md",
+		".agents/skills/define/SKILL.md",
+		".omp/skills/define/SKILL.md",
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("AliasTargets() = %#v, want %#v", got, want)
+	}
+	got = AliasTargets(Alias{Name: "define"}, true, false)
+	for _, rel := range got {
+		if strings.HasPrefix(rel, ".omp/") {
+			t.Fatalf("omp alias installed with withOmp=false: %s", rel)
+		}
+	}
 }
 
 func TestAliasTemplateOutput(t *testing.T) {

package/engine/internal/install/apply.go

@@ -23,6 +23,7 @@ func (r *runner) install() error {
 	fmt.Fprintln(r.opts.Stdout, "  standards: ship inside the devrites-lib skill")
 	fmt.Fprintf(r.opts.Stdout, "  agents : %s\n", yesno(r.opts.WithAgents))
 	fmt.Fprintf(r.opts.Stdout, "  codex  : %s\n", yesno(r.opts.WithCodex))
+	fmt.Fprintf(r.opts.Stdout, "  omp    : %s\n", yesno(r.opts.WithOmp))
 	fmt.Fprintf(r.opts.Stdout, "  aliases: %s\n", r.opts.AliasMode)
 	if r.opts.DryRun {
 		fmt.Fprintln(r.opts.Stdout, "  (dry run - no changes will be made)")
@@ -37,7 +38,7 @@ func (r *runner) install() error {
 		return err
 	}
 
-	for _, tree := range hostpack.InstallTrees(r.opts.WithSkills, r.opts.WithAgents, r.opts.WithCodex) {
+	for _, tree := range hostpack.InstallTrees(r.opts.WithSkills, r.opts.WithAgents, r.opts.WithCodex, r.opts.WithOmp) {
 		if err := r.installTree(tree.PayloadPrefix, tree.TargetPrefix); err != nil {
 			return fmt.Errorf("install tree %s: %w", tree.TargetPrefix, err)
 		}
@@ -48,7 +49,7 @@ func (r *runner) install() error {
 			if err != nil {
 				return fmt.Errorf("render alias skill %s: %w", alias.Name, err)
 			}
-			for _, rel := range hostpack.AliasTargets(alias, r.opts.WithCodex) {
+			for _, rel := range hostpack.AliasTargets(alias, r.opts.WithCodex, r.opts.WithOmp) {
 				if err := r.installData(data, rel); err != nil {
 					return fmt.Errorf("install alias: %w", err)
 				}
@@ -91,9 +92,14 @@ func (r *runner) install() error {
 	}
 	fmt.Fprintf(r.opts.Stdout, "  installed: %d   overwritten: %d   skipped(conflict): %d   pruned: %d\n", r.stats.installed, r.stats.overwrote, r.stats.skipped, r.stats.pruned)
 	if !r.opts.DryRun && r.opts.WithSkills {
-		if r.opts.WithCodex {
+		switch {
+		case r.opts.WithCodex && r.opts.WithOmp:
+			fmt.Fprintln(r.opts.Stdout, "Next: reopen the project, then run /rite (Claude) or $rite (Codex) or /skill:rite.")
+		case r.opts.WithCodex:
 			fmt.Fprintln(r.opts.Stdout, "Next: reopen the project, then run /rite (Claude) or $rite (Codex).")
-		} else {
+		case r.opts.WithOmp:
+			fmt.Fprintln(r.opts.Stdout, "Next: reopen the project, then run /rite or /skill:rite.")
+		default:
 			fmt.Fprintln(r.opts.Stdout, "Next: reopen the project, then run /rite.")
 		}
 	}
@@ -201,6 +207,7 @@ func (r *runner) seedDevrites() error {
 	if err := os.MkdirAll(filepath.Dir(active), 0o755); err != nil {
 		return fmt.Errorf("create %s: %w", filepath.Dir(active), err)
 	}
+	// #nosec G304 -- active path is the operator-selected install dir (O_EXCL create)
 	f, err := os.OpenFile(active, os.O_CREATE|os.O_EXCL, 0o644)
 	if err != nil {
 		if os.IsExist(err) {
@@ -301,6 +308,9 @@ func (r *runner) flagsString() string {
 	if !r.opts.WithCodex {
 		flags = append(flags, "--no-codex")
 	}
+	if !r.opts.WithOmp {
+		flags = append(flags, "--no-omp")
+	}
 	if !r.opts.WithBinary {
 		flags = append(flags, "--no-binary")
 	}

package/engine/internal/install/binary.go

@@ -48,6 +48,7 @@ func (r *runner) installBinary() error {
 	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
 		return err
 	}
+	// #nosec G304 -- staged artifact from the checksum-verified release temp dir
 	data, err := os.ReadFile(staged)
 	if err != nil {
 		return err
@@ -57,7 +58,7 @@ func (r *runner) installBinary() error {
 		return err
 	}
 	if backup != "" {
-		defer os.Remove(backup)
+		defer func() { _ = os.Remove(backup) }()
 	}
 	if err := fsutil.WriteFileAtomic(dest, data, 0o755); err != nil {
 		if restoreErr := restoreBinary(dest, backup, oldMode, hadOld); restoreErr != nil {
@@ -100,6 +101,7 @@ func backupBinary(dest string) (string, fs.FileMode, bool, error) {
 	if !info.Mode().IsRegular() {
 		return "", 0, false, fmt.Errorf("refusing to replace non-regular engine binary: %s", dest)
 	}
+	// #nosec G304 -- existing engine binary under the operator install dir; regular-file checked above
 	data, err := os.ReadFile(dest)
 	if err != nil {
 		return "", 0, false, fmt.Errorf("read existing engine binary: %w", err)
@@ -127,6 +129,7 @@ func restoreBinary(dest, backup string, mode fs.FileMode, hadOld bool) error {
 		}
 		return nil
 	}
+	// #nosec G304 -- backup of the same install-dir binary
 	data, err := os.ReadFile(backup)
 	if err != nil {
 		return err
@@ -235,6 +238,7 @@ func verifyEngineBinary(path, want string, timeout time.Duration) (string, error
 func readEngineVersion(path string, timeout time.Duration) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()
+	// #nosec G204,G702 -- execs the staged engine binary itself for a version probe
 	out, err := exec.CommandContext(ctx, path, "version").Output()
 	if err != nil {
 		if errors.Is(ctx.Err(), context.DeadlineExceeded) {

package/engine/internal/install/install.go

@@ -34,6 +34,7 @@ type Options struct {
 	WithSkills  bool
 	WithAgents  bool
 	WithCodex   bool
+	WithOmp     bool
 	WithBinary  bool
 	KeepBinary  bool
 	AliasMode   string
@@ -82,6 +83,7 @@ func DefaultOptions(mode Mode) Options {
 		WithSkills: true,
 		WithAgents: true,
 		WithCodex:  true,
+		WithOmp:    true,
 		WithBinary: true,
 		AliasMode:  "safe",
 		Stdout:     io.Discard,
@@ -132,6 +134,7 @@ func parseArgs(args []string, opts *Options) error {
 	dryRun := flags.Bool("dry-run", opts.DryRun, "")
 	force := flags.Bool("force", opts.Force, "")
 	noCodex := flags.Bool("no-codex", !opts.WithCodex, "")
+	noOmp := flags.Bool("no-omp", !opts.WithOmp, "")
 	noAgents := flags.Bool("no-agents", !opts.WithAgents, "")
 	noSkills := flags.Bool("no-skills", !opts.WithSkills, "")
 	noBinary := flags.Bool("no-binary", !opts.WithBinary, "")
@@ -158,6 +161,7 @@ func parseArgs(args []string, opts *Options) error {
 	opts.DryRun = *dryRun
 	opts.Force = *force
 	opts.WithCodex = !*noCodex
+	opts.WithOmp = !*noOmp
 	opts.WithAgents = !*noAgents
 	opts.WithSkills = !*noSkills
 	opts.WithBinary = !*noBinary
@@ -204,7 +208,7 @@ func usage(mode Mode) string {
 	case ModeUpdate:
 		return "usage: devrites-engine update [--target DIR] [--dry-run] [--force] [--check] [install flags] [--source-dir DIR --payload-dir DIR]\n"
 	default:
-		return "usage: devrites-engine install [--target DIR] [--dry-run] [--force] [--no-codex] [--no-agents] [--no-skills] [--no-binary] [--short-aliases=all]\n"
+		return "usage: devrites-engine install [--target DIR] [--dry-run] [--force] [--no-codex] [--no-omp] [--no-agents] [--no-skills] [--no-binary] [--short-aliases=all]\n"
 	}
 }
 
@@ -329,7 +333,7 @@ func (r *runner) validatePayload() error {
 	if r.payload == "" {
 		return fmt.Errorf("generated install payload not found; pass --payload-dir or run scripts/build-host-artifacts.sh")
 	}
-	if err := hostpack.ValidatePayload(r.payloadFS, r.opts.WithCodex); err != nil {
+	if err := hostpack.ValidatePayload(r.payloadFS, r.opts.WithCodex, r.opts.WithOmp); err != nil {
 		return fmt.Errorf("generated install payload under %s: %w", r.payload, err)
 	}
 	return nil
@@ -340,7 +344,12 @@ func isGlobalTarget(target string) bool {
 	if target == home {
 		return true
 	}
-	for _, global := range []string{filepath.Join(home, ".claude"), filepath.Join(home, ".codex")} {
+	for _, global := range []string{
+		filepath.Join(home, ".claude"),
+		filepath.Join(home, ".codex"),
+		filepath.Join(home, ".omp"),
+		filepath.Join(home, ".omp", "agent"),
+	} {
 		if target == global || strings.HasPrefix(target, global+string(os.PathSeparator)) {
 			return true
 		}
@@ -361,6 +370,7 @@ func pruneEmptyDirs(start, stop string) {
 }
 
 func exists(path string) bool {
+	// #nosec G703 -- existence probe on managed install paths
 	_, err := os.Lstat(path)
 	return err == nil
 }

package/engine/internal/install/install_test.go

@@ -52,10 +52,13 @@ func TestInstallPrintsFirstMoveForInstalledHosts(t *testing.T) {
 	for _, tc := range []struct {
 		name      string
 		withCodex bool
+		withOmp   bool
 		want      string
 	}{
-		{name: "Claude and Codex", withCodex: true, want: "Next: reopen the project, then run /rite (Claude) or $rite (Codex)."},
-		{name: "Claude only", withCodex: false, want: "Next: reopen the project, then run /rite."},
+		{name: "Claude, Codex, and OMP", withCodex: true, withOmp: true, want: "Next: reopen the project, then run /rite (Claude) or $rite (Codex) or /skill:rite."},
+		{name: "Claude and Codex", withCodex: true, withOmp: false, want: "Next: reopen the project, then run /rite (Claude) or $rite (Codex)."},
+		{name: "Claude and OMP", withCodex: false, withOmp: true, want: "Next: reopen the project, then run /rite or /skill:rite."},
+		{name: "Claude only", withCodex: false, withOmp: false, want: "Next: reopen the project, then run /rite."},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			var out bytes.Buffer
@@ -63,6 +66,7 @@ func TestInstallPrintsFirstMoveForInstalledHosts(t *testing.T) {
 			opts.Target = t.TempDir()
 			opts.PayloadDir = testPayload(t)
 			opts.WithCodex = tc.withCodex
+			opts.WithOmp = tc.withOmp
 			opts.Stdout = &out
 			opts.Stderr = &bytes.Buffer{}
 
@@ -754,7 +758,7 @@ func TestLegacyCodexHooksMergeIsCleanupOnly(t *testing.T) {
 	if !ok || merge != legacy {
 		t.Fatalf("legacy marker lookup = %#v, %t", merge, ok)
 	}
-	if slices.Contains(hostpack.RequiredPayload(true), "codex/hooks.json") {
+	if slices.Contains(hostpack.RequiredPayload(true, true), "codex/hooks.json") {
 		t.Fatal("legacy Codex hooks entered the required payload")
 	}
 	r := runner{opts: DefaultOptions(ModeInstall), payloadFS: os.DirFS(testPayload(t))}
@@ -1053,7 +1057,7 @@ func TestVerifyEngineBinary(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			path := filepath.Join(t.TempDir(), "engine")
 			testutil.WriteExecutable(t, path, "#!/bin/sh\n"+tc.body+"\n")
-			_, err := verifyEngineBinary(path, tc.want, time.Second)
+			_, err := verifyEngineBinary(path, tc.want, 5*time.Second)
 			if (err == nil) != tc.ok {
 				t.Fatalf("verifyEngineBinary error = %v, ok = %t", err, tc.ok)
 			}
@@ -1128,7 +1132,7 @@ func TestBackupRestoreBinaryIsPlatformSafe(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer os.Remove(backup)
+	defer func() { _ = os.Remove(backup) }()
 	if filepath.Dir(backup) != filepath.Dir(dest) {
 		t.Fatalf("backup %s is not beside %s", backup, dest)
 	}
@@ -1240,6 +1244,9 @@ default_permissions = "devrites-orchestrator"
 extends = ":workspace"
 # END DEVRITES CODEX PERMISSIONS
 `)
+	testutil.WriteFile(t, filepath.Join(root, "omp", "skills", "rite", "SKILL.md"), "omp rite\n")
+	testutil.WriteFile(t, filepath.Join(root, "omp", "agents", "devrites-code-reviewer.md"), "omp agent\n")
+	testutil.WriteFile(t, filepath.Join(root, "omp", ".omp-plugin", "plugin.json"), "{}\n")
 }
 
 func testSource(t *testing.T, version string) string {

package/engine/internal/install/manifest.go

@@ -25,6 +25,7 @@ func readManifestList(path string) ([]string, error) {
 }
 
 func parseManifest(path string) (map[string]managedRecord, []string, error) {
+	// #nosec G304 -- install manifest under the operator-selected target
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
@@ -75,6 +76,7 @@ func validManagedHash(hash string) bool {
 }
 
 func manifestHeader(path, key string) string {
+	// #nosec G304 -- install manifest under the operator-selected target
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return ""
@@ -90,6 +92,7 @@ func manifestHeader(path, key string) string {
 
 func installedVersion(source string) string {
 	if source != "" {
+		// #nosec G304 -- package.json inside the operator-selected install source
 		data, err := os.ReadFile(filepath.Join(source, "package.json"))
 		if err != nil {
 			return "unknown"

package/engine/internal/install/merge.go

@@ -36,6 +36,7 @@ func (r *runner) mergeMarkerFile(merge hostpack.MarkerMerge) error {
 	dest := filepath.Join(r.target, filepath.FromSlash(merge.TargetRel))
 	if r.opts.DryRun {
 		verb := "create DevRites block"
+		// #nosec G304 -- dest joins the operator target with a fixed manifest-relative record
 		current, readErr := os.ReadFile(dest)
 		if readErr == nil {
 			if bytes.Contains(current, []byte(merge.Begin)) {
@@ -52,6 +53,7 @@ func (r *runner) mergeMarkerFile(merge hostpack.MarkerMerge) error {
 			return err
 		}
 		next := block
+		// #nosec G304 -- dest joins the operator target with a fixed manifest-relative record
 		current, readErr := os.ReadFile(dest)
 		if readErr == nil {
 			next = hostpack.MergeMarkerBlock(current, block, merge.Begin, merge.End)
@@ -80,6 +82,7 @@ func (r *runner) mergeCodexConfig() error {
 		return err
 	}
 	var current []byte
+	// #nosec G304 -- dest joins the operator target with a fixed manifest-relative record
 	if data, readErr := os.ReadFile(dest); readErr == nil {
 		current = stripMarkerBlock(data, merge.Begin, merge.End)
 		current = stripMarkerBlock(current, "# BEGIN DEVRITES CODEX MCP", "# END DEVRITES CODEX MCP")
@@ -183,6 +186,7 @@ func (r *runner) stripClaudeSettings(path string, preserveEmpty bool) error {
 }
 
 func stripMarkerPath(path, begin, end string) error {
+	// #nosec G304 -- managed file path from the install manifest
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -236,6 +240,7 @@ func hasTopLevelTOMLKey(data []byte, key string) bool {
 }
 
 func readJSON(path string) (map[string]any, error) {
+	// #nosec G304 -- engine-written workspace or metadata JSON
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return nil, fmt.Errorf("read %s: %w", path, err)

package/engine/internal/install/preflight.go

@@ -93,7 +93,7 @@ func (r *runner) preflightUninstall(entries []string) error {
 
 func (r *runner) desiredInstallPaths() (map[string]bool, error) {
 	out := map[string]bool{".devrites/README.md": true}
-	for _, tree := range hostpack.InstallTrees(r.opts.WithSkills, r.opts.WithAgents, r.opts.WithCodex) {
+	for _, tree := range hostpack.InstallTrees(r.opts.WithSkills, r.opts.WithAgents, r.opts.WithCodex, r.opts.WithOmp) {
 		err := fs.WalkDir(r.payloadFS, tree.PayloadPrefix, func(path string, d fs.DirEntry, err error) error {
 			if err != nil {
 				return err
@@ -114,7 +114,7 @@ func (r *runner) desiredInstallPaths() (map[string]bool, error) {
 	}
 	if r.opts.WithSkills && r.opts.AliasMode == "all" {
 		for _, alias := range hostpack.Aliases {
-			for _, rel := range hostpack.AliasTargets(alias, r.opts.WithCodex) {
+			for _, rel := range hostpack.AliasTargets(alias, r.opts.WithCodex, r.opts.WithOmp) {
 				out[rel] = true
 			}
 		}
@@ -203,11 +203,12 @@ func inspectManagedPath(target, rel string) (pathSnapshot, error) {
 	if !info.Mode().IsRegular() {
 		return pathSnapshot{}, fmt.Errorf("refusing non-regular managed path: %s", rel)
 	}
+	// #nosec G304 -- managed path snapshot; regular-file check above
 	f, err := os.Open(dest)
 	if err != nil {
 		return pathSnapshot{}, fmt.Errorf("read managed path %s: %w", rel, err)
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 	sum := sha256.New()
 	if _, err := io.Copy(sum, f); err != nil {
 		return pathSnapshot{}, fmt.Errorf("hash managed path %s: %w", rel, err)