Build local-first findings manager CLI

Author: bx33661

README.md

@@ -44,7 +44,7 @@ omv findings validate demo-traversal
 <!-- omv:skills:start -->
 | Skill | Command | Category | Purpose |
 |---|---|---|---|
-| `omv` | `/omv` | manager | Collection manager — lists skills, shows registry status |
+| `omv` | `/omv` | manager | Local-first project manager — shows workspace status, active finding next actions, archive state, and installed skills |
 | `omv-find` | `/omv-find` | research | Find and rank open-source packages worth auditing for passive CVE research |
 | `omv-audit` | `/omv-audit` | audit | Deep-audit a candidate finding — prove or disprove the vulnerability, fill Evidence.v1 fields for omv-report |
 | `omv-repro` | `/omv-repro` | audit | Guide local reproduction of a finding — walk through execution, record observed_result, confirm or block |

registry.yaml

@@ -12,7 +12,7 @@ skills:
     path: skills/omv
     invocation: /omv
     status: stable
-    description: Collection manager — lists skills, shows registry status
+    description: Local-first project manager — shows workspace status, active finding next actions, archive state, and installed skills
     produces: []
     consumes: []
 

scripts/release_check.py

@@ -18,6 +18,8 @@
 SYNC_SCRIPT = REPO_ROOT / "scripts" / "sync_skill_assets.py"
 SYNC_METADATA_SCRIPT = REPO_ROOT / "scripts" / "sync_metadata.py"
 STABLE_EVAL_CHECKS = [
+    ("skills/omv/scripts/check_output.py", "0", "skills/omv/evals/golden/next-workflow.md"),
+    ("skills/omv/scripts/check_output.py", "1", "skills/omv/evals/golden/archive-delegation.md"),
     ("skills/omv-audit/scripts/check_output.py", "0", "skills/omv-audit/evals/golden/incomplete-observed-result.md"),
     ("skills/omv-audit/scripts/check_output.py", "1", "skills/omv-audit/evals/golden/duplicate-blocked.md"),
     ("skills/omv-audit/scripts/check_output.py", "2", "skills/omv-audit/evals/golden/confirmed-complete.md"),

skills/omv-audit/SKILL.md

@@ -72,9 +72,22 @@ Stay in passive research mode: read public source code only. Do not send request
 omv findings validate <id>
 ```
 
+然后运行或建议：
+
+```bash
+omv findings workflow
+```
+
+Use the CLI result for lifecycle handoff:
+
+- If the finding remains `candidate` because only `evidence.observed_result` is missing, tell the user to run `/omv-repro <id>`.
+- If the finding is `confirmed` and validation returns OK, tell the user to run `/omv-report <id>`.
+- If the finding is `blocked`, tell the user to review blockers and optionally run `omv findings archive <id> --reason blocked`.
+
 ## Deterministic Helpers
 
 - `omv findings validate <id>` — 校验字段完整性，输出 readiness 分数
 - `omv findings promote <id> --status confirmed|blocked` — 更新 status 字段
+- `omv findings workflow` — 显示 active findings 的下一步动作
 - `python3 shared/scripts/resolve_source_path.py --ecosystem npm --pkg <name>` — 获取源文件 raw URL
 - `python3 shared/scripts/collect_metadata.py --repo <github-url>` — 获取仓库元数据

skills/omv-find/SKILL.md

@@ -81,6 +81,7 @@ For narrow requests, use `rg` inside the relevant reference to read only the nee
    - Sort by score descending.
    - Include data freshness, sources used, and uncertainty.
    - If the user asks to pass a confirmed finding to `omv-report`, create or output a `.omv/findings/<id>.yaml` Evidence.v1 handoff structured per `contracts/evidence.v1.yaml`. Do not emit a handoff packet for ordinary unconfirmed target lists.
+   - When any `.omv/findings/<id>.yaml` candidate is created or updated, end by telling the user to run `omv findings workflow` or `/omv next` to choose the next audit target.
 
 ## Source File Discovery
 
@@ -128,6 +129,7 @@ When a user asks to continue from a confirmed or blocked finding, use the Eviden
 2. If workspace file tools are available, run or suggest `omv findings init <id> --status candidate|confirmed|blocked`, then fill the YAML fields from verified evidence only.
 3. If file tools are not available, output a fenced YAML block titled `Save as .omv/findings/<id>.yaml`.
 4. Run or suggest `omv findings validate <id>` after filling the file.
+5. Run or suggest `omv findings workflow` after validation so the candidate appears in the local-first active queue.
 
 Use `status: confirmed` only when tested version, source, sink, guard, local reproducer, and observed result are known. Use `status: candidate` for promising but unproven research and `status: blocked` when the missing evidence or duplicate risk should stop report generation.
 

skills/omv-report/SKILL.md

@@ -57,6 +57,20 @@ Use the validation result to choose output mode:
 - `status: candidate`: produce only triage notes or a draft outline clearly marked not ready for submission.
 - `status: confirmed`: proceed only if required evidence is present and readiness is at least 75/100; include validation warnings in the pre-submission checklist.
 
+After producing a submission-ready report for a confirmed finding, suggest removing it from the active local queue:
+
+```bash
+omv findings archive <id> --reason reported
+```
+
+If the report was written under `.omv/reports/<id>/`, the archive command records those artifact paths in archive metadata. For a stricter local gate, use:
+
+```bash
+omv findings archive <id> --reason reported --strict
+```
+
+Do not archive automatically unless the user asks; archiving is project-management state, not part of Evidence.v1 validation.
+
 ---
 
 ## Severity

skills/omv-repro/SKILL.md

@@ -64,7 +64,20 @@ Stay in passive research mode: do not execute any commands yourself. Guide the u
 omv findings validate <id>
 ```
 
+然后运行或建议：
+
+```bash
+omv findings workflow
+```
+
+Use the CLI result for lifecycle handoff:
+
+- If reproduction confirms the finding and validation returns OK, tell the user to run `/omv-report <id>`.
+- If reproduction cannot continue and the finding is `blocked`, tell the user to review blockers and optionally run `omv findings archive <id> --reason not-reproducible`.
+- If validation still fails because audit fields are missing, tell the user to return to `/omv-audit <id>`.
+
 ## Deterministic Helpers
 
 - `omv findings validate <id>` — 校验字段完整性，输出 readiness 分数
 - `omv findings promote <id> --status confirmed|blocked` — 更新 status 字段
+- `omv findings workflow` — 显示 active findings 的下一步动作

skills/omv/SKILL.md

@@ -1,20 +1,29 @@
 ---
 name: omv
-description: oh-my-vul collection manager. Lists installed omv-* skills, shows registry info, and displays version/status of the oh-my-vul skill collection. Use when the user types /omv, asks what oh-my-vul skills are available, or wants to see the collection status.
+description: oh-my-vul local-first vulnerability research project manager. Shows workspace status, next actions, installed omv-* skills, registry info, and delegates .omv findings lifecycle commands. Use when the user types /omv, asks what to do next, or manages local findings.
 ---
 
 # omv
 
-oh-my-vul collection manager for Claude Code.
+oh-my-vul local-first vulnerability research project manager for Claude Code.
 
 ## Commands
 
 ```text
 /omv list                   — list all installed omv-* skills with one-line descriptions
-/omv status                 — show registry version, last updated, skill count
+/omv dashboard              — show workspace, active workflow queue, and recent activity
+/omv status                 — show local .omv workspace status (delegates to omv CLI)
+/omv log                    — show local workspace activity log (delegates to omv CLI)
+/omv next                   — show active findings and recommended next actions
 /omv audit <id>             — deep-audit a candidate finding (delegates to omv-audit skill)
 /omv repro <id>             — guide local reproduction of a finding (delegates to omv-repro skill)
+/omv archive <id> --reason <reason>
+                            — archive an inactive finding (delegates to omv CLI)
+/omv restore <id>           — restore an archived finding (delegates to omv CLI)
 /omv findings list          — list .omv/findings evidence files (delegates to omv CLI)
+/omv findings workflow      — show lifecycle next actions (delegates to omv CLI)
+/omv findings show <id>     — show one finding's validation state and next action
+/omv findings open <id>     — print one finding YAML path for editing
 /omv findings init <id>     — create a finding template (delegates to omv CLI)
 /omv findings validate [id] — validate one or all findings (delegates to omv CLI)
 /omv findings promote <id>  — update finding status (delegates to omv CLI)
@@ -38,29 +47,48 @@ Collection metadata lives in `references/registry.yaml`. Read it to show current
 
 ## State Directory
 
-`.omv/` at the repository root stores findings and context snapshots. It is gitignored. Use `/omv-find` and `/omv-report` to create and read finding files under `.omv/findings/`.
+`.omv/` at the repository root stores findings, archive metadata, and the rebuildable local workspace index. It is private local research state and should be gitignored. Active findings live under `.omv/findings/`; inactive findings live under `.omv/archive/findings/`.
 
-## omv findings — CLI Delegation
+## CLI Delegation
 
-When the user invokes any `omv findings` subcommand, **run it as a shell command via `Bash` and display its output. Do not implement the behavior manually** (do not `mkdir`, do not write YAML directly).
+When the user invokes workspace, lifecycle, archive, or restore commands, **run the matching shell command via `Bash` and display its output. Do not implement the behavior manually** (do not `mkdir`, do not move files, do not write YAML directly).
 
 | Invocation | Run this shell command |
 |---|---|
+| `/omv dashboard` | `omv dashboard` |
+| `/omv status` | `omv workspace status` |
+| `/omv log` | `omv workspace log` |
+| `/omv next` | `omv findings workflow` |
+| `/omv archive <id> --reason <reason>` | `omv findings archive <id> --reason <reason>` |
+| `/omv restore <id>` | `omv findings restore <id>` |
 | `/omv findings list` | `omv findings list` |
+| `/omv findings workflow` | `omv findings workflow` |
+| `/omv findings show <id>` | `omv findings show <id>` |
+| `/omv findings open <id>` | `omv findings open <id>` |
 | `/omv findings init <id>` | `omv findings init <id>` |
 | `/omv findings init <id> --status confirmed` | `omv findings init <id> --status confirmed` |
 | `/omv findings validate` | `omv findings validate` |
 | `/omv findings validate <id>` | `omv findings validate <id>` |
 | `/omv findings promote <id> --status <s>` | `omv findings promote <id> --status <s>` |
+| `/omv findings archive list` | `omv findings archive list` |
 
 **If `omv` is not found on PATH**, output: "`omv` is not installed. Run: `npx oh-my-vul setup`"
 
 ### Subcommand reference
 
+- **dashboard** — prints workspace status, active workflow queue, and recent activity in one view.
+- **workspace status** — prints workspace path, active/archive counts, status counts, and privacy warnings.
+- **workspace log** — prints the local activity trail for workspace init, finding init, promotion, archive, and restore.
 - **init `<id>`** — creates `.omv/findings/<id>.yaml` from the Evidence.v1 template; default `--status candidate`. If file exists, CLI errors — suggest `--force`.
 - **list** — prints ID / STATUS / READY / PACKAGE / VULNERABILITY table for every `.yaml` in `.omv/findings/`.
+- **workflow** — prints active findings sorted by priority with NEXT ACTION recommendations such as `/omv-audit`, `/omv-repro`, `/omv-report`, promotion, or archive.
+- **show `<id>`** — prints one finding's package, vulnerability, validation errors/warnings, missing fields, and next action. Use `--archived` to inspect archived findings.
+- **open `<id>`** — prints the Evidence.v1 YAML path and next action so the user can edit or inspect the local file.
 - **validate `[id|path]`** — checks required Evidence.v1 fields; exits non-zero on errors. No arg = validate whole ledger.
 - **promote `<id|path> --status <s>`** — updates the `status` field and re-validates. Valid statuses: `candidate`, `confirmed`, `blocked`.
+- **archive `<id> --reason <reason>`** — moves a finding to `.omv/archive/findings/` and removes it from active workflow views. For `--reason reported`, confirmed findings are checked for report artifacts under `.omv/reports/<id>/`; use `--strict` to block archive when those artifacts are missing.
+- **archive list** — lists archived findings and archive reasons.
+- **restore `<id>`** — moves an archived finding back to `.omv/findings/`.
 
 ## Workflow Overview
 
@@ -77,6 +105,9 @@ When the user invokes any `omv findings` subcommand, **run it as a shell command
               updates .omv/findings/<id>.yaml  (status: confirmed | blocked)
                         ↓
 /omv-report → reads confirmed finding, generates VulDB/CVE/GHSA/OSV report
+                        ↓
+archive    → omv findings archive <id> --reason reported
 ```
 
 Each finding uses one of three Evidence.v1 statuses: `candidate`, `confirmed`, or `blocked`.
+Use `omv dashboard`, `omv findings workflow`, or `/omv next` as the canonical active queue view after each stage. When the CLI prints a priority value, follow the highest-priority row first unless the user names a specific finding.

skills/omv/evals/evals.json

@@ -0,0 +1,33 @@
+{
+  "skill_name": "omv",
+  "evals": [
+    {
+      "id": 0,
+      "prompt": "/omv next",
+      "expected_output": "The agent delegates next-action discovery to the CLI workflow dashboard.",
+      "files": [
+        "evals/golden/next-workflow.md"
+      ],
+      "assertions": [
+        {
+          "type": "delegates_next_to_cli",
+          "text": "next command must run omv findings workflow"
+        }
+      ]
+    },
+    {
+      "id": 1,
+      "prompt": "/omv archive demo --reason reported",
+      "expected_output": "The agent delegates archive requests to the CLI and does not move files manually.",
+      "files": [
+        "evals/golden/archive-delegation.md"
+      ],
+      "assertions": [
+        {
+          "type": "delegates_archive_to_cli",
+          "text": "archive command must run omv findings archive with reason"
+        }
+      ]
+    }
+  ]
+}

skills/omv/evals/golden/archive-delegation.md

@@ -0,0 +1,7 @@
+Running:
+
+```bash
+omv findings archive demo --reason reported
+```
+
+I will display the CLI result. I will not move `.omv/findings/demo.yaml` manually or edit workspace index files directly.