v1.6.16

• removed visual_studio_build_tools: true from docs and shipped workflow examples so public
  guidance only teaches the structured platforms.windows.visual_studio.components form while
  keeping legacy shorthand compatibility in the parser
• added structured native_prerequisites.<name>.platforms.windows.visual_studio.components
  support plus platform-scoped native_prerequisites.<name>.platforms.<os>.requires
  runtime/tool/toolchain/env/check requirements, so contracts can model Windows native build
  bundles through an Ota-owned vswhere probe, attach dependencies such as Python, and preserve
  receipt provenance without embedding long raw PowerShell checks in checks.run
• made ota --version build identity explicit for source builds by including commit and dirty
  markers, and added ota --version --json with stable provenance fields (semver,
  source_build, commit, dirty), schema_version, and additive
  contract_capabilities[] entries so machines can distinguish build identity from contract
  capability support
• formalized ota --version --json as a compatibility-locked JSON surface with a published
  version.json schema and conformance coverage
• enforce metadata.ota.minimum_version at contract load time across command surfaces (not only
  validate), so doctor, up, and related commands fail early with a clear minimum-version
  message when the running binary is too old
• centralized preview-status semantics so doctor, ota run --dry-run, and ota up --dry-run
  share one verdict model for READY / READY WITH WARNINGS / BLOCKED and
  RUNNABLE / RUNNABLE WITH WARNINGS / BLOCKED, and fixed preview JSON helpers to keep
  preview_status present on repo and member ota up --dry-run payloads
• minimum-version compatibility diagnostics now call out detected unsupported contract
  capabilities when the contract uses a known feature newer than the running binary
• minimum-version compatibility errors are now feature-first and operator-grade: they report the
  contract minimum, current binary identity, detected unsupported contract feature when known, and
  the next install/rebuild step with ota --version --json as the confirmation lane
• documented the product rule that schema_version moves only for non-additive contract-generation
  changes while additive compatibility growth extends contract_capabilities[]
• added an ota-readiness CI guard lane (json-schema-guard) that runs
  json_schema_contracts and json_output_conformance before readiness execution, preventing
  schema/output contract drift from reaching the main readiness lane
• aligned ota up --dry-run and ota run --dry-run preview messaging with explicit
  preview_status (RUNNABLE, RUNNABLE WITH WARNINGS, BLOCKED) while keeping canonical
  shared readiness verdicts in summary.verdict
• ota doctor now warns when .devcontainer/devcontainer.json advertises a Node image that
  drifts from the repo contract's declared runtimes.node requirement, so repo-owned
  devcontainer shells do not silently lag repo readiness truth
• ota init starter agent boundaries now lock ota.yaml into agent.protected_paths as an
  explicit default and carry the matching agent.exceptions.sensitive_writes: [ota.yaml] rule
  whenever a starter intentionally grants contract-authoring authority with writable ota.yaml
• ota proof runtime now treats warning-only risk findings such as
  effects.external_state / effects.network selected-path advisories as visible proof context
  instead of proof-failing blockers; only error-level proof findings now collapse a successful
  readiness proof
• ota doctor now also warns when a repo-owned devcontainer bootstrap command uses a different
  Node package manager than the repo contract declares, and when agent.writable_paths includes
  sensitive lockfile, env/config, runtime-topology, CI, or repo-contract paths beyond the
  declared agent.posture; narrow intentional exceptions can be acknowledged through
  agent.exceptions.sensitive_writes while the legacy
  agent.acknowledged_sensitive_writable_paths alias still loads for compatibility
• agent boundary validation now rejects overlapping agent.writable_paths and
  agent.protected_paths entries when they duplicate the same normalized path, while still
  allowing protected carve-outs under broader writable roots
• fixed ota proof runtime wait-budget derivation for selected service surfaces so proof now
  honors declared readiness timing policy (start_period, interval, timeout, retries)
  instead of collapsing heavy startup paths down to a small timeout-only window; fresh CI Docker
  builds such as Hoppscotch self-host proof now respect the contract's actual startup budget
• added execution.contexts.<name>.only_on so contracts can declare supported host OSes per
  execution context; ota doctor, ota up, and task execution now fail early and explicitly
  when a selected context is not supported on the current host platform
• fixed contract identity counts in preview and related output so scoped execution-context and
  task requirements are counted honestly instead of reporting misleading zero-runtime/zero-tool
  summaries when the selected workflow is actually blocked on scoped requirements
• improved native/container/remote Python runtime probing to accept versioned aliases such as
  python3.12 and python3.13 when they satisfy runtimes.python, preventing false
  Missing runtime: python or mismatch findings on repos that already expose a compatible Python
  interpreter through standard aliases
• shipped toolchains.python with provider: uv as a first-class managed Python runtime owner:
  validator, doctor, dry-run, and run-path fulfillment now understand uv-backed Python toolchains,
  fulfillment: run can invoke uv python install <version> for installable version references,
  and detector/init now prefer the shipped Python toolchain contract over fallback Python
  opportunity guidance when uv.lock and Python version signals are present
• fixed selected workflow/task toolchain scoping so preview/doctor/up no longer fall back to every
  declared toolchain when the selected closure does not require one, preventing false runtime/tool
  blockers on unrelated workflows such as host-Docker setup paths
• updated detector-led ota init starter agent bootstrap commands to pin the installer target to
  the running Ota version via OTA_VERSION=v<current>, so generated contracts avoid floating
  latest install targets for both shell and PowerShell bootstrap paths
• added Slack release announcements to the release gate workflow by publishing the same generated release summary text to SLACK_RELEASE_WEBHOOK_URL when configured, while keeping Discord publishing unchanged.
• run branch-protection-required maintainer checks on branch pushes as well as main, and remove docs-only trigger filtering from docs-quality, so protected branch-first merges work without requiring a public PR flow
• taught ota doctor to short-circuit later service/check readiness probing when selected-path
  preconditions already contain blocking errors, so broken setups stay bounded and diagnosis
  output keeps the real blocker in front instead of spending time on unreachable surfaces
• added tasks.<name>.effects.writes as first-class task side-effect metadata, and now validate
  agent-safe task writes against declared agent.protected_paths plus agent.writable_paths
  when that writable boundary is present
• expanded task side-effect metadata with tasks.<name>.effects.network and
  tasks.<name>.effects.external_state, surfaced those effects through ota tasks --json,
  ota workspace tasks --json, text task inventory, and generated AGENTS.md, added
  validation for machine-readable external-state tokens, and now surface agent-safe risk warnings
  plus selected-path doctor signals when those tasks depend on network access or mutate external
  systems