feat: add v0.8 workflow readiness gates

Author: Ubuntu

README.md

@@ -55,10 +55,13 @@ Run the core workflow inside Claude Code:
 
 omv findings init demo-traversal
 /omv-audit demo-traversal
+omv repro init demo-traversal
 /omv-repro demo-traversal
 omv findings validate demo-traversal
+omv findings doctor demo-traversal
 
 /omv-report demo-traversal
+omv report artifacts demo-traversal
 ```
 
 <details>
@@ -98,9 +101,12 @@ Project-level setup writes `.omv/setup-scope.json` so `omv doctor` can resolve t
   -> candidate packages and code-reading entry points
   -> .omv/findings/<id>.yaml
   -> /omv-audit
+  -> omv repro init <id>
   -> /omv-repro when observed_result still needs local confirmation
   -> omv findings validate <id>
+  -> omv findings doctor <id>
   -> /omv-report
+  -> omv report artifacts <id>
   -> advisory draft for VulDB, CVE, GHSA, OSV, or Markdown
 ```
 

README.zh-CN.md

@@ -55,10 +55,13 @@ npx -p oh-my-vul omv doctor
 
 omv findings init demo-traversal
 /omv-audit demo-traversal
+omv repro init demo-traversal
 /omv-repro demo-traversal
 omv findings validate demo-traversal
+omv findings doctor demo-traversal
 
 /omv-report demo-traversal
+omv report artifacts demo-traversal
 ```
 
 <details>
@@ -98,9 +101,12 @@ omv version --json
   -> 候选项目和源码入口
   -> .omv/findings/<id>.yaml
   -> /omv-audit
+  -> omv repro init <id>
   -> /omv-repro
   -> omv findings validate <id>
+  -> omv findings doctor <id>
   -> /omv-report
+  -> omv report artifacts <id>
   -> 提交前报告草稿
 ```
 

docs/examples/demo-finding-flow.md

@@ -182,3 +182,241 @@ A submission-ready finding should have:
 - no unresolved blockers
 
 If any of these are missing, keep the finding out of the submission path.
+
+## Copyable Example States
+
+The snippets below use fake package names and paths. To try one locally:
+
+```sh
+omv findings init demo-candidate --force
+# Replace .omv/findings/demo-candidate.yaml with one snippet, then:
+omv findings validate demo-candidate
+omv findings doctor demo-candidate
+```
+
+### Candidate: Needs Local Reproduction
+
+Expected shape: validation can pass, evidence score is partially complete, submission score remains low because local observation and version boundary are unresolved.
+
+```yaml
+schema_version: "1"
+handoff_version: "1.0"
+status: candidate
+researcher_goal: VulDB
+package:
+  ecosystem: npm
+  registry_name: demo-widget-renderer
+  repository_url: https://github.com/example/demo-widget-renderer
+  vendor: example
+  product: demo-widget-renderer
+versions:
+  tested: "1.4.2"
+  affected_range: unknown
+  fixed: unknown
+vulnerability:
+  class: path traversal
+  cwe: CWE-22
+  affected_component: lib/files.js
+  affected_function: renderFile
+evidence:
+  source: lib/server.js:18 req.query.template
+  sink: lib/files.js:44 fs.readFileSync
+  guard: missing path normalization before join
+  reproducer: node repro.js ../package.json
+  observed_result: unknown
+  repro_artifacts: []
+cvss:
+  vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
+  score: 5.5
+  severity: Medium
+impact:
+  attack_vector: Local
+  authentication_required: unknown
+  user_interaction_required: unknown
+  scope_changed: unknown
+  confidentiality: High
+  integrity: unknown
+  availability: unknown
+dedup:
+  nvd_searched: true
+  ghsa_searched: true
+  ecosystem_db_searched: true
+  existing_cve: none
+  notes: "searched NVD, GHSA, npm advisories"
+disclosure:
+  vendor_contacted: false
+  contact_date: unknown
+  vendor_response: unknown
+  planned_disclosure_date: unknown
+blockers: []
+verdict:
+  exploitability: plausible
+  confidence: medium
+  reason: source and sink are connected, but local output has not been observed yet
+provenance:
+  verification_date: "2026-05-08"
+  researcher: demo
+  unverified_fields:
+    - versions.affected_range
+    - versions.fixed
+    - evidence.observed_result
+    - disclosure.contact_date
+    - disclosure.vendor_response
+    - disclosure.planned_disclosure_date
+  tool_versions: {}
+```
+
+### Blocked: Default Guard Prevents Exploit
+
+Expected shape: validation passes only as `blocked`, submission score is zero, and the next action is archive or return to audit if the conclusion changes.
+
+```yaml
+schema_version: "1"
+handoff_version: "1.0"
+status: blocked
+researcher_goal: triage
+package:
+  ecosystem: go
+  registry_name: github.com/example/demo-webhook
+  repository_url: https://github.com/example/demo-webhook
+  vendor: example
+  product: demo-webhook
+versions:
+  tested: "0.8.0"
+  affected_range: unknown
+  fixed: unknown
+vulnerability:
+  class: server-side request forgery
+  cwe: CWE-918
+  affected_component: internal/webhook/client.go
+  affected_function: Send
+evidence:
+  source: internal/webhook/handler.go:31 request URL
+  sink: internal/webhook/client.go:87 http.Client.Do
+  guard: internal/webhook/client.go:63 default allowlist blocks private IP ranges
+  reproducer: none
+  observed_result: unknown
+  repro_artifacts: []
+cvss:
+  vector: unknown
+  score: unknown
+  severity: unknown
+impact:
+  attack_vector: Network
+  authentication_required: unknown
+  user_interaction_required: unknown
+  scope_changed: unknown
+  confidentiality: unknown
+  integrity: unknown
+  availability: unknown
+dedup:
+  nvd_searched: true
+  ghsa_searched: true
+  ecosystem_db_searched: true
+  existing_cve: none
+  notes: "no matching advisory found"
+disclosure:
+  vendor_contacted: false
+  contact_date: unknown
+  vendor_response: unknown
+  planned_disclosure_date: unknown
+blockers:
+  - default configuration blocks private network requests
+  - no bypass found during source audit
+verdict:
+  exploitability: blocked
+  confidence: high
+  reason: sink exists, but the default guard prevents the attacker-controlled URL from reaching private hosts
+provenance:
+  verification_date: "2026-05-08"
+  researcher: demo
+  unverified_fields:
+    - versions.affected_range
+    - versions.fixed
+    - evidence.reproducer
+    - evidence.observed_result
+    - cvss.vector
+    - cvss.score
+    - cvss.severity
+    - impact.authentication_required
+    - impact.user_interaction_required
+    - impact.scope_changed
+    - impact.confidentiality
+    - impact.integrity
+    - impact.availability
+    - disclosure.contact_date
+    - disclosure.vendor_response
+    - disclosure.planned_disclosure_date
+  tool_versions: {}
+```
+
+### Confirmed: Ready For Report Drafting
+
+Expected shape: validation passes as `confirmed`, submission score is above 75, and `omv report artifacts confirmed-demo` should pass after a non-empty report file exists under `.omv/reports/confirmed-demo/`.
+
+```yaml
+schema_version: "1"
+handoff_version: "1.0"
+status: confirmed
+researcher_goal: VulDB
+package:
+  ecosystem: python
+  registry_name: demo-config-loader
+  repository_url: https://github.com/example/demo-config-loader
+  vendor: example
+  product: demo-config-loader
+versions:
+  tested: "2.1.0"
+  affected_range: "up to and including 2.1.0"
+  fixed: none
+vulnerability:
+  class: YAML unsafe deserialization
+  cwe: CWE-502
+  affected_component: demo_config_loader/loader.py
+  affected_function: load_config
+evidence:
+  source: demo_config_loader/cli.py:22 user-supplied config path
+  sink: demo_config_loader/loader.py:41 yaml.load
+  guard: missing SafeLoader use before yaml.load
+  reproducer: python repro.py payload.yml
+  observed_result: local run printed marker DEMO_OWNED from the crafted YAML constructor
+  repro_artifacts:
+    - .omv/repro/confirmed-demo/commands.sh
+    - .omv/repro/confirmed-demo/observed.txt
+cvss:
+  vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+  score: 7.8
+  severity: High
+impact:
+  attack_vector: Local
+  authentication_required: false
+  user_interaction_required: true
+  scope_changed: false
+  confidentiality: High
+  integrity: High
+  availability: High
+dedup:
+  nvd_searched: true
+  ghsa_searched: true
+  ecosystem_db_searched: true
+  existing_cve: none
+  notes: "searched NVD, GHSA, PyPI advisory database, and repository issues"
+disclosure:
+  vendor_contacted: false
+  contact_date: unknown
+  vendor_response: unknown
+  planned_disclosure_date: unknown
+blockers: []
+verdict:
+  exploitability: proven
+  confidence: high
+  reason: local reproducer executed the unsafe YAML constructor on version 2.1.0
+provenance:
+  verification_date: "2026-05-08"
+  researcher: demo
+  unverified_fields:
+    - disclosure.contact_date
+    - disclosure.vendor_response
+    - disclosure.planned_disclosure_date
+  tool_versions: {}
+```

docs/roadmap-0.8.md

@@ -10,7 +10,7 @@ Make the CLI answer one question clearly:
 
 ## Planned Work
 
-### 1. `omv repro init <id>`
+### 1. `omv repro init <id>` — implemented
 
 Create a standard reproduction artifact directory:
 
@@ -36,7 +36,7 @@ Acceptance criteria:
 - Adds suggested `evidence.repro_artifacts` paths to the finding or prints a patch users can apply.
 - Works for active findings only by default.
 
-### 2. `omv findings doctor <id>`
+### 2. `omv findings doctor <id>` — implemented
 
 Explain why a finding is not submission-ready:
 
@@ -60,7 +60,7 @@ Acceptance criteria:
 - JSON mode is available for CI or future UI use.
 - It never suggests `/omv-report` unless the same finding would pass promotion and validation gates.
 
-### 3. `omv report artifacts <id>`
+### 3. `omv report artifacts <id>` — implemented
 
 Check report and reproduction material before archiving:
 
@@ -80,7 +80,7 @@ Acceptance criteria:
 - `omv findings archive <id> --reason reported --strict` can reuse the same artifact checks.
 - Missing artifacts produce warnings for candidate findings and errors for strict confirmed archive.
 
-### 4. Better Dashboard Detail
+### 4. Better Dashboard Detail — implemented
 
 Improve `omv dashboard` without turning it into a full-screen app:
 
@@ -95,7 +95,7 @@ Acceptance criteria:
 - The first screen tells users whether to audit, reproduce, report, or archive.
 - Long command truncation never hides the only actionable next step.
 
-### 5. Documentation And Demo Assets
+### 5. Documentation And Demo Assets — implemented
 
 Add sanitized examples:
 

scripts/package_skill.sh

@@ -32,7 +32,37 @@ done
 
 (
   cd "$skill_dir"
-  zip -qr "$out" "${entries[@]}" -x '*/__pycache__/*' '*.pyc' '*.pyo' '.git/*' '.claude/*'
+  if command -v zip >/dev/null 2>&1; then
+    zip -qr "$out" "${entries[@]}" -x '*/__pycache__/*' '*.pyc' '*.pyo' '.git/*' '.claude/*'
+  else
+    python3 - "$out" "${entries[@]}" <<'PY'
+import os
+import sys
+import zipfile
+
+out = sys.argv[1]
+entries = sys.argv[2:]
+
+def include(path: str) -> bool:
+    parts = path.split(os.sep)
+    if "__pycache__" in parts or ".git" in parts or ".claude" in parts:
+        return False
+    return not path.endswith((".pyc", ".pyo"))
+
+with zipfile.ZipFile(out, "w", compression=zipfile.ZIP_DEFLATED) as archive:
+    for entry in entries:
+        if os.path.isfile(entry):
+            if include(entry):
+                archive.write(entry, entry)
+            continue
+        for root, dirs, files in os.walk(entry):
+            dirs[:] = [name for name in dirs if include(os.path.join(root, name))]
+            for name in files:
+                path = os.path.join(root, name)
+                if include(path):
+                    archive.write(path, path)
+PY
+  fi
 )
 
 python3 "$repo_root/scripts/validate_skill.py" "$skill_dir" --package "$out"