v1.6.23

• tightened active-execution ownership around container attachment isolation: shared logical
  write paths now only conflict when they land in the same effective execution namespace, so
  container contexts with distinct attachments.isolated_paths volume families can coexist
  truthfully while shared repo-worktree writes still block as before

• added the first audited-crossing execution evidence slice for heavier governed lanes: ota run
  and ota up now accept additive --reason <text>, repo-target receipts may include
  receipt.crossing, and ota up --json can mirror the same record at governance.crossing
  when the selected task or workflow crosses a derived heavier execution boundary; the current
  shipped slice keeps requirement source honest as derived and records runner-visible actor
  posture plus caller-supplied reason presence without pretending grant or approval semantics yet

• tightened V11.7 phase semantics for agent-mode governance output: post-execution evidence now
  publishes additive not_run_reason and crossing_record_state, so dry-run previews, preflight
  refusals, and heavier lanes that have not executed yet no longer force consumers to infer why
  nothing ran or why crossing evidence is absent

• widened ota doctor --json with additive governance.merge_gate, publishing a first
  machine-readable merge-oriented governance verdict over projected required verification lanes and
  recovered CI drift metadata; the same surface now stays honest by distinguishing projected
  from drift_detected instead of pretending full provider alignment when Ota only has partial
  workflow recovery evidence

• added additive harness-facing capability_profile export on ota tasks --json and
  ota workflows --json, publishing agent-callable vs refused lanes with canonical preflight
  governance, exact agent commands, environment boundaries, and closure effect posture so
  harnesses/sandboxes can consume Ota’s execution truth without scraping human output or
  rebuilding safe-task/refusal semantics themselves

• widened CI verification governance findings with additive machine-readable
  metadata.governance.merge_check_id plus verifier lane metadata on ota doctor --json, so
  CI/merge consumers can key off stable Ota-owned verification-lane identity instead of brittle
  workflow/job/check display names while Ota continues to recover actual provider source paths

• added top-level governance.required_verification_lanes to ota doctor --json, projecting
  merge-relevant verification lanes from ci_verification / legacy ci_validation workflows
  before falling back to agent.verify_after_changes, so CI drift compares contract-owned required
  lanes instead of broad task truth

• tightened ota detect package-script task inference so pure guidance-only scripts such as
  echo "use 'yarn start' instead" or echo '... no longer supported' no longer become
  runnable task truth; this closes a mixed-signal precedence gap where redirect-only
  package.json scripts could incorrectly outrank the repo's actual documented runnable surface

• tightened CI verification drift scoping so repos that already declare workflows only get CI
  verification governance on tasks reachable from workflows with intent: ci_validation; local
  contributor verification slices no longer get falsely treated as CI mirrors just because their
  task names contain verifier-shaped labels such as verify

• fixed script-body tool inference so leading shell comments no longer get treated as required tools;
  multi-line script: tasks now skip comment-prefixed lines before inferring presence-only
  command requirements for doctor and dry-run surfaces

• tightened external AGENTS.md / CLAUDE.md task-command admission so placeholder-heavy
  command templates such as <PROJECT> or obvious path/to/... scaffolding stay out of detect
  task truth; ota still admits narrow structured boundary-doc command sections, but only when the
  recovered command is concrete enough to be runnable evidence instead of prose guidance, and it
  now prefers command-derived canonical task identity over prose aliases when the command already
  exposes a stable runnable task name

• widened CI verification recovery again so ota doctor can now recover repo-local verifier
  scripts such as node scripts/verify-*.js and bounded step-named opaque checks as declared
  verification tasks, reducing false CI verification drift when the workflow lane is canonical
  but the verifier body is not an ordinary package-manager subcommand

• tightened ota detect so GitHub Actions run: lines containing ${{ ... }} interpolation no
  longer get promoted into task-command truth, keeping workflow templating and local contract
  execution truth separate instead of hallucinating executable repo tasks from CI expressions

• tightened safe-task detect inference so verifier-shaped task names that still own orchestration
  or adapter control lanes, such as docker:test, no longer get auto-promoted to
  safe_for_agent: true just because their names contain test

• tightened CI verification drift governance so ota doctor now unions exact verifier coverage
  across multiple verification-oriented GitHub workflow files instead of forcing one best-match
  file to own the whole aggregate and reporting false drift when the repo truth is intentionally
  split

• tightened that same CI verification drift lane again so only verification-oriented GitHub
  workflows become canonical verification evidence; deploy, release, publish, sync, and similar
  workflows no longer outrank real verification lanes just because they happen to contain one
  check step

• widened prepare.kind: tool_bootstrap with first-class prepare.tool: cypress_browsers for
  source.kind: node_package_manager, so repos can now own npx|pnpm|yarn|bunx cypress install
  structurally instead of burying Cypress browser bootstrap inside chained verification shells;
  validator, runner, task previews, contract reference docs, and published schemas now treat that
  lane as canonical while keeping Playwright-only fields such as prepare.browsers,
  prepare.with_deps, and prepare.source.filter strict

• added first-class action.kind: ensure_git_template, so deterministic scaffold/factory bootstrap
  can now own git clone plus inherited .git removal plus fresh git init as one governed
  materialization lane instead of pushing template bootstrap back into shell glue

• widened action.kind: ensure_git_checkout / ensure_git_checkouts again so deterministic
  checkout materialization can now also own declared Git remote wiring through remotes[];
  Ota now idempotently adds missing remotes or updates remote URLs inside existing checkouts
  instead of forcing fork/upstream remote truth back into shell bootstrap steps

• added first-class action.kind: ensure_git_checkouts, so one setup lane can now own several
  deterministic Git-backed sibling or vendored checkouts without flattening that materialization
  truth into repeated low-level ensure_git_checkout entries; ensure_bundle can now compose the
  same multi-checkout step with file/env prep, moving-head advisories stay per checkout, and the
  published contract/docs/examples now describe the widened VCS materialization surface directly,
  including the workspace task JSON schema and capability reference surfaces

• widened action.kind: ensure_git_checkout / ensure_git_checkouts so declared checkout targets
  may now use sibling or workspace-relative paths such as ../ui instead of being artificially
  constrained to repo-internal paths; validator and runner now agree on that bootstrap truth, so
  repos whose documented local runtime depends on side-by-side checkouts no longer need shell glue
  just to materialize the required workspace layout

• added first-class effects.workspace_writes for task paths that intentionally mutate sibling or
  workspace-relative filesystem targets outside the repo root, so deterministic checkout/bootstrap
  lanes can keep repo-scoped effects.writes strict while still declaring broader local workspace
  materialization truth explicitly; agent-safe task closures continue to require repo-scoped write
  boundaries, and doctor / run-preview surfaces now report workspace-relative write ownership

• added first-class compose.build: true for tasks.<name>.compose.kind: run, so documented
  one-off Compose contributor shells like docker compose run --rm --build ... no longer need
  shell fallback or wrapper-script truth

• added first-class compose.service_ports: true for tasks.<name>.compose.kind: run, so
  documented one-off Compose dev lanes like docker compose run --rm --service-ports ... no
  longer need shell fallback or repo-local wrapper truth

• widened prepare.kind: dependency_hydration with first-class Composer ownership through
  source.kind: composer, so repos can now declare structural composer install setup lanes
  natively or through Compose exec/run wrappers instead of leaving Composer dependency hydration
  command-owned; validator, runner, dry-run/output summaries, and contract reference docs now all
  understand the Composer family consistently

• taught ota doctor to flag CI bootstrap split-brain when workflows restate Ota install truth
  outside agent.bootstrap.ota.source or conflict with it, so repos are pushed toward
  ota-run/setup@v1 source: contract / ota-run/action@v1 source: contract instead of carrying
  separate workflow-owned version, git-revision, branch, or source-install refs

• added execution-boundary agent-safety enforcement to ota run and ota up: --agent now
  refuses unsafe requested tasks and declared-safe task/workflow closures before any execution
  starts, returns ota-authored blocked receipts/results instead of treating the safe surface as
  review-only guidance, and is now recognized correctly on ota run <task> --agent instead of
  being misread as task input after the task selector

• widened machine-readable execution governance again with a canonical phase-labeled
  governance.evaluation block on ota run --dry-run --json plus additive governance on
  ota up --json: external consumers can now read explicit preflight allowed|warning_only|blocked|refused
  posture separately from post-execution evidence state, and ota run --dry-run --json --agent
  now truthfully publishes runner refusal instead of looking runnable in preview JSON

• widened orchestrators with first-class launcher ownership and direct mode: subcommand
  mediation so repos can declare truth like nix run ...#devenv -- test or devenv up without
  faking direct PATH ownership or misusing task / exec; validator, selected-path diagnosis,
  dry-run previews, and task execution now all consume the same orchestrator-owned command shape

• widened orchestrator-mediated command previews across all shipped orchestrator modes (task,
  exec, and subcommand) so ota tasks --use and ota run --dry-run now render the same
  mediated command truth operators will actually execute, including readable devbox run -- ...
  and nix run ...#devenv -- ... previews instead of split-brain raw host bodies

• widened orchestrator-mediated first-class prepare execution so command-backed
  prepare.kind: dependency_hydration and prepare.kind: tool_bootstrap can now run through
  execution.orchestrator.mode: exec for declared orchestrators such as devbox and devenv,
  while mixed/native prepare.kind: sequence remains outside orchestrator mediation in the
  current slice; validator, dry-run preview, and runner behavior now all agree on that boundary

• fixed native run-path activation ordering for command-acquired tools so repo-owned binaries such
  as devbox can now be activated from tools.<name>.acquisition.provider: command before
  orchestrator preparation or other selected task execution depends on them, instead of failing
  early with a missing-binary spawn error

• widened ota doctor --fix beyond repo-hygiene-only file edits so native doctor can now apply
  deterministic command-acquired tool activation (for example a declared devbox command
  acquisition) and rerun diagnosis before returning the final readiness verdict, while plain
  ota doctor stays non-mutating

• widened ota detect with the first V11.2 source-family ingestion step: repo-owned
  mise.toml [tools] entries now contribute high-confidence runtime and Node package-manager
  inference with explicit precedence over .tool-versions while still yielding to more specific
  repo-local markers such as .nvmrc, .python-version, and package.json#packageManager

• widened ota detect again in the same V11.2 source-family lane so
  .devcontainer/devcontainer.json now contributes high-confidence Node image and bootstrap
  package-manager inference while still yielding to stronger repo-local runtime and package-manager
  truth

• widened that same .devcontainer/devcontainer.json detector lane again so Ota now also
  recognizes object/array postCreateCommand and updateContentCommand forms plus conservative
  high-confidence runtime/tool presence from known devcontainer features such as node, python,
  go, github-cli, and kubectl-helm-minikube, instead of only reading simple string command
  fields

• widened the matching doctor-side devcontainer package-manager drift lane so review pressure now
  understands object/array postCreateCommand and updateContentCommand forms too, instead of
  silently missing real drift once detect had already widened past string-only bootstrap commands

• widened the matching doctor-side devcontainer runtime drift lane so Ota now reports
  both feature-backed runtime drift and known image-backed runtime drift for node, python,
  and go, instead of keeping image-hint review pressure effectively Node-only

• taught Ota to read real devcontainer.json JSONC syntax for the devcontainer source family, so
  comments and trailing commas no longer silently disable detect or doctor-side devcontainer truth

• widened doctor-side devcontainer review again so forwardPorts now drifts against declared
  host-facing contract ports from surfaces.*.port and services.*.endpoints.host.port

• widened ota detect again across the next V11.2 source families so devbox.json now
  contributes high-confidence tools.devbox and shell.scripts task inference, while
  devenv.nix contributes conservative high-confidence tools.devenv presence without
  pretending broader runtime truth than those files really own

• widened the V11.2 agent-boundary source family from review-only metadata to real detect-backed
  starter truth: structured repo-authored AGENTS.md and CLAUDE.md lists for
  safe_tasks, verify_after_changes, writable_paths, and protected_paths now feed detect
  as medium-confidence agent-boundary evidence, while Ota-generated/self-origin agent docs remain
  excluded so source provenance does not recurse back into exported contract guidance

• widened that same agent-doc source family again so explicit external AGENTS.md /
  CLAUDE.md command sections now contribute low-confidence task guidance for narrow canonical
  lanes such as build, check, lint, test, docs, and compile, including exact
  | Task | Command | tables, bounded adjacent | Command | description | forms when ota can
  still recover one stable canonical task name from the command itself, and labeled command
  bullets inside explicit command sections, without promoting broader prose or
  self-origin generated docs into executable contract truth

• widened command-first external agent-doc task recovery again so direct tool commands such as
  pytest ..., ruff check ..., and python -m build can now map back to stable canonical
  test, lint, and build task names from | Command | description | tables instead of
  being ignored unless they were wrapped in package-manager, Make, Taskfile, or Cargo forms

• widened bounded external agent-doc task-table recovery again so structured sections such as
  ## Individual Commands and ## Common Commands, plus natural-language task labels like
  Run all unit tests, Run type checking, and Format code, now recover canonical
  test, typecheck, and fmt task names instead of being dropped even when the table itself
  is explicit

• widened bounded external agent-doc command-section admission again so nearby headings like
  ## Quick Reference Commands now participate in the same low-authority task-table recovery
  lane instead of being ignored even when the table shape itself is canonical

• tightened CI verification task recovery so bare package-manager flag invocations such as
  yarn --no-check-resolutions no longer mint fake callable tasks just because a verifier token
  appears inside the flag name; real verifier scripts and commands continue to recover normally
  overclaiming broader Nix environment ownership

• widened doctor/explain source-governance drift so manual contracts now warn when a high-confidence
  external environment source already detected by Ota, such as mise.toml, devbox.json, or
  devenv.nix, disagrees with the declared runtime/toolchain truth, instead of limiting that
  review pressure to detector-owned merged fields; the same governance lane now also covers
  high-confidence detected task-command truth from package.json#scripts.* and
  devbox.json#shell.scripts.*, while existing devcontainer-specific doctor warnings remain the
  narrower review surface for devcontainer drift

• widened V11.2 task-command source governance again so Ota now detects high-confidence
  Taskfile and justfile task truth as canonical runner-owned commands (task <name> and
  just <name>) and uses that same source-governance drift lane to warn when manual
  tasks.*.run entries diverge from those external task-runner sources

• widened V11.2 CI/workflow verification governance so Ota now recovers medium-confidence
  verifier task truth from explicit GitHub Actions run: lanes and warns when manual
  tasks.*.run verification entries diverge from enforced workflow verification, while keeping
  CI below direct repo execution sources in precedence

• widened that same CI/workflow governance lane again so doctor now also warns when a manual
  verifier task is no longer detected from enforced GitHub Actions verification truth, closing
  the silent rename/removal case where workflow verification changed lanes without touching the
  contract task name

• tightened Taskfile/justfile detection so thin single-command wrappers now recover the underlying
  direct task command instead of surfacing weaker task <name> / just <name> drift against an
  already-canonical contract lane

• widened V11.2 agent-boundary governance so ota doctor now detects structured AGENTS.md /
  CLAUDE.md drift for agent-boundary fields such as safe_tasks, verify_after_changes,
  writable_paths, and protected_paths, without pretending free-form prose is structured truth

• widened first-class orchestrator ownership beyond mise: ota now ships devbox and devenv
  orchestrator kinds, with validator and runner support for mediated task execution; devbox
  supports prepare.install, devenv supports task/exec mediation, and unsupported trust/install
  knobs now fail validation instead of pretending the contract owns behavior it does not

• detect JSON and detect-written metadata now publish additive detector source-class governance
  (source_class on inferred/comparison entries and metadata.ota.detect.field_source_class on
  detect-written contracts) so ecosystem-source convergence can stay explicit without inventing a
  parallel detector artifact

• widened ota tasks --use and ota tasks --safe --use so the runnable task surface now shows
  command preview, safety posture, declared effects, runnable mode commands, task dry-run JSON,
  and the receipt follow-up command directly in one operator-facing view instead of leaving
  execution-governance proof split across separate commands or implicit inference

• widened ota run --dry-run --json with an additive top-level governance summary so CI and
  agents can read the selected task lane’s safety posture, review requirement, default mode,
  runnable mode commands, effect surface, and receipt follow-up command without stitching those
  facts together from requested_task, task effects, and preview planning fields by hand

• widened receipt/proof machine surfaces with explicit stage-family truth so execution receipts now
  publish steps[*].stage_family and ota proof runtime --json now publishes
  stage_family: "proof", letting CI and agents classify broad execution-governance stages
  (prepare, setup, verify, proof, receipt) without inferring them from free-form labels
  or proof phase names

• widened execution-governance machine output with additive artifact_routing[] on dry-run,
  receipt, proof, repo up, and workspace execution/status/receipt lanes so operators, CI, and
  agents can see which receipt/proof artifact to inspect, archive, or capture next instead of
  reconstructing that path from scattered next text and command-specific fields

• widened workspace --progress-json NDJSON events with additive phase and stage_family, so
  long-running workspace machine streams now publish command-local operational lane plus broad
  governance family directly instead of leaving automation to infer those semantics from progress
  status strings and command names

• refined receipt-diff correlation ordering so likely_related_changes[] now prefers the sharpest
  governance-stage match when several nearby semantic changes are otherwise equally plausible,
  which keeps verify failures, setup blockers, and proof/readiness drift ordered by the failure
  lane they most directly explain

• fixed JSON schema compatibility for provisioning diagnostics so ota run --dry-run --json
  previews that include nullable provisioning fields (source, source_config,
  approved_version, and related optional metadata) now validate against published
  run-preview.json / doctor.json references instead of failing smoke validation when blocked
  provisioning entries include explicit null values

• fixed selected-backend command executable inference so explicit command.exe or
  launch.kind: command values of where/which are treated as path-lookup utilities (not
  versioned tool requirements), which prevents false OTA_TOOL_PROBE_FAILED blockers in the
  Windows native proof workflow