Built in strict TypeScript on Bun as an OMP extension (one production entry point: `dist/index.js`). The reviewer is a normal OMP model invocation with ambient agent features disabled — no separate model SDK — so any configured provider/model that follows the versioned structured decision schema can act as the reviewer. Initial public beta is `0.1.0-beta.1`, targeting OMP `>=17.2.12 <18`.
Safety is layered: an emergency-brake shell lexer and executable deny list run first; static tool, command, capability, and path analysis decide routine vs. review; bounded, redacted evidence enriches the request without authorizing it; deterministic confidence, risk, authorization, scope, and evidence gates can only make an allow more restrictive after the model answers.
Evidence providers cover Bash capabilities, Git state relevant to pending mutations, local script contents when safely readable (Python/Node/Bun/shell/Ruby/Perl), and SSH destination, remote semantics, and bounded stdin code. Credential patterns (Bearer, cloud keys, JWTs, private keys, URL userinfo, cookies) are redacted before anything reaches the reviewer, and missing evidence is surfaced explicitly rather than hidden.
The trust boundary is asymmetric: trusted global config may select a dedicated reviewer model, thinking level, timeout, confidence threshold, and policy text, while repository config can only tighten behavior (raise confidence, add reviewed tools or protected paths, add denied executables, disable deterministic allow paths, enable subagent-spawn review, or escalate from `manual` to `deny`). It cannot disable auditing, redirect the audit file, lower confidence, remove protections, add trusted roots, or relax `deny` back to `manual`.
The repository is intentionally heavy relative to its surface area: focused tests cover capability analysis, decision invariants, the emergency brake, evidence enrichment (Git, SSH, local scripts), redaction, shell lexing, the OMP runtime, package smoke, and concurrency stress. CI runs format, lint, typecheck, tests, and build on a Bun matrix, plus a coverage gate and CodeQL; a release candidate also requires a fresh real-OMP live smoke. Apache-2.0 licensing with a NOTICE attributing design inspiration to OpenAI Codex Guardian.