v1.6.25

• fixed Doctor agent-readiness derivation for intentionally read-only agent boundaries. A contract
  with safe tasks, no writable paths, and declared protected paths now reports Agent: ready
  instead of an unexplained ready with warnings; contracts with no filesystem boundary remain
  risky.

• tightened execution-option admission across task execution and previews. Explicit lifecycle
  overrides such as --ephemeral and --persistent now fail before dependencies, provisioning,
  or task startup when the resolved native or remote path has no managed lifecycle boundary,
  instead of degrading to advisory behavior. Existing mode, host-port, memory, and dependency
  override refusals remain fail-closed. Run summaries distinguish requested options from effective
  execution and state Execution: not started; run and up preview JSON now carry
  execution_started: false, and option refusals use typed blocker codes.

• fixed Windows optional-shell capability detection so a failing bash or WSL probe cannot leak
  child output into Ota human or --json command output.

• added first-class replay authority for generated artifacts. A declared producer can now issue a
  receipt-bound, content-addressed recording through ota baseline record --artifact <name>;
  only ota baseline promote --artifact <name> --attestation <path> may atomically select it in
  the contract-declared portable authority manifest. Consumers verify the selected complete output
  identity set before execution. Existing generated_source artifacts retain their producer
  lineage: a producer-dependent consumer remains ordinary generated-source execution, while a
  consumer without that dependency uses promoted replay authority. Strict read_only consumers receive run-scoped snapshots outside
  the writable workspace mounted across their full ephemeral-container closure. Native or other
  non-strict consumers may instead declare consumption: verify_unchanged; Ota rechecks the
  canonical output manifest after execution and fails with replay_artifact_mutation_detected
  when it changed rather than claiming an unenforceable write was refused. Portable authority
  manifests embed the selected attestation and explicitly use scm_review as their external
  trust root; they rely on repository delivery review rather than signer-backed provenance.
  Replay-baseline
  symlinks that escape declared output boundaries are rejected. Successful consumer receipts retain the selected attestation and
  promotion identities so later comparison does not reconstruct baseline authority from paths.
  Recorded attestations always carry V11.16 graph and closure identities; a producer with no
  observed material prerequisites records canonical unknown evidence rather than omitting the
  graph. Strict replay now projects command-capable typed preparation through the same
  runner-owned container closure instead of requiring repos to replace typed hydration with shell
  glue. Container execution also defaults CI=true when the contract does not explicitly set it,
  matching its noninteractive execution boundary.

• added effects.network_kind: service_readiness for finite probes of declared repo-managed
  service endpoints. Contract schemas, task and dry-run JSON, Doctor findings, effect overrides,
  and policy packs now keep local/runtime readiness distinct from live or staging-backed
  integration_test lanes.

• added the first V11.18 managed lifecycle-proof admission surface. Workflows can reference
  manager-owned service closures under proof.lifecycle, optionally name a finite post-readiness
  assertion task, and require positive manager_inactive teardown observation. Validation keeps
  the assertion's full dependency closure outside the normal workflow closure, rejects lifecycle
  ownership without typed Compose or systemd state observation, and preserves generic host commands
  as ineligible rather than guessing cleanup authority. Runtime systemd observation also refuses
  unknown units instead of treating them as inactive.

• added ota proof lifecycle as the first bounded transaction executor for that admitted surface.
  It runs the selected workflow prerequisite closure, leases only manager-observed inactive
  services, starts/readies them in dependency order, executes an optional post-readiness assertion
  without duplicating service ownership, and tears leased services down in reverse order. JSON
  publishes typed transaction-bound service records and mandatory proof boundaries. A service
  without declared readiness also carries
  service_started_state_not_proved; command exit alone does not prove its started state.
  Structured host-manager lifecycle commands can additionally use
  lifecycle.teardown_assertion: boundary_terminated when the selected workflow resolves to an
  Ota-owned ephemeral container boundary. The runner executes both commands in one
  transaction-bound session and publishes the terminal observation only after the engine confirms
  removal of that exact session; it never upgrades this to host-manager inactivity or application
  output proof.

• moved lifecycle finalization into the runner and added opt-in immutable lifecycle archives through
  ota proof lifecycle --json --archive. The runner owns reverse teardown and manager-inactive
  verification after every acquired lease, including failed starts, readiness failures, assertion
  failures, and interrupted start, readiness, or assertion paths. Each archive is content-addressed and binds the
  semantic contract snapshot, selected workflow/services, transaction-bound service records, and
  terminal lifecycle verdict; archive verification rejects mismatched content-addressed filenames,
  stale snapshot references, malformed source/contract identity, and incomplete service closures.
  Interrupted starts, readiness observations, assertions, and teardowns now carry typed
  finalization evidence and stop every leased service exactly once. It is local evidence only, not
  CI projection or broader runtime proof.
  Lifecycle proof now also reuses selected-workflow agent admission, task execution-mode resolution,
  and monorepo member loading; manager commands stay on their declared control boundary.
  Archives now bind the resolved execution scope and target OS and verify their content identity,
  semantic snapshot reference, and transaction/service binding before use as local evidence.

• fixed concurrent lifecycle-proof ownership. ota proof lifecycle now acquires a repository-scoped
  transaction lock before it observes any manager state; a competing invocation is refused before
  it can acquire a cleanup lease, start a service, or run a post-readiness assertion.

• hardened isolated lifecycle-boundary ownership and evidence. Ota now treats an ephemeral
  container session as owned immediately after engine creation and removes it after network or
  start setup failures as well as normal finalization. Lifecycle JSON and archives require
  qualified proof boundaries, reject bare passed success, bind boundary_terminated to the exact
  runner-owned engine/session identity, and verify that scope identity against every emitted
  boundary record. Boundary cleanup failure independently produces incomplete finalization, while
  archive verification re-derives the selected service closure and teardown authority from the
  archived contract snapshot. Failed-start cleanup now also re-observes exact session absence
  instead of treating a successful remove command as sufficient, and failed isolated cleanup
  remains runner-attested evidence rather than manager-derived state.

• lifecycle proof JSON and its local archive now retain typed, bounded diagnostics for a declared
  assertion task: terminal state, exit code, and stdout/stderr tails (8 KiB per stream). These
  runner-attested diagnostics redact declared secret values and explain assertion failures without
  promoting lifecycle proof into application-output proof, replay, claim assurance, or CI evidence.

• fixed selected container readiness for Ruby-owned Bundler fulfillment. When the base image has a
  different Bundler version but the selected Ruby toolchain declares fulfillment: run, Doctor
  now validates the Ruby provider and admits Ota's typed gem install bundler --version <version>
  fulfillment before dependency hydration. A fulfillable base-image Bundler mismatch no longer
  blocks the same container run path that will materialize the declared version.

• added command.interaction field to command: task bodies. Allowed values are auto (default),
  forbidden, and required. With auto or required, when Ota runs in a
  human TTY context with a native execution backend, stdin/stdout/stderr are inherited by the
  child process so that interactive tools such as Wrangler can detect a real TTY and open browser
  OAuth or other interactive flows. In ordinary non-TTY CI, agent mode, or other non-TTY contexts
  auto silently falls back to non-interactive captured execution. required returns a preflight
  refusal error before any dependencies or task execution when an interactive terminal cannot be
  provided. forbidden
  always uses non-interactive execution with stdin closed. Agent mode never acquires interactive
  capability from the contract
  posture. For structured command tasks, dry-run JSON publishes both the effective contract
  posture and its invocation-specific resolution as terminal_passthrough, piped, or refused.

• fixed native Corepack task execution to activate each selected declared package manager before
  direct yarn or pnpm commands run. A globally installed but incompatible package-manager shim
  can no longer bypass the contract-owned Corepack version.

• fixed managed GitHub Node/Corepack projection to disable setup-node's provider cache before Ota
  activates the contract-owned package manager. setup-node can no longer invoke an ambient Yarn
  shim before Ota's selected workflow preparation runs.

• fixed managed CI projection so finite verification workflows execute their selected
  ota run --agent closure directly after the dry-run admission preview, rather than treating
  readiness-only ota up success as verification proof. The renderer no longer performs a
  redundant mutable ota up whose ephemeral container state cannot carry into the later task
  invocation; provider-neutral projection now binds run_execution as finite_task or
  service_runtime.

• fixed managed CI projection admission to evaluate the same full workflow closure as
  ota up --agent. A safe run task can no longer render a generated lane when an unsafe prepare,
  setup, or attach phase would be refused by the runner.

• extended managed GitHub CI projection to render native toolchains.dotnet through an immutable
  actions/setup-dotnet revision. Container-owned .NET toolchains remain owned by their declared
  execution image.

• fixed aggregate-task execution-mode admission to use the same concrete member-closure rule as
  task discovery and CI projection. A container-capable aggregate can no longer render a valid
  projection while ota up --mode container rejects it before its member tasks run.

• extended managed CI projection with provider-neutral selected-closure toolchains[]. The first
  GitHub adapter renders Go from contract-owned source: go version truth using an immutable
  actions/setup-go revision, translates supported one-sided or bounded Go lower-bound ranges
  into the provider's release selector, and refuses unsupported required provisioning sources or
  version forms instead of silently depending on a hosted runner image.

• extended managed CI projection with contract-owned agent.refusal_canaries. Provider-neutral
  projections now carry de-duplicated task/workflow control identities and stable merge-check IDs;
  the GitHub adapter renders each as an independent provider check through Ota's real
  --expect-refusal runner path without provider-shell assertion glue. Its emitted
  provider_checks[] maps each canonical identity to a target-OS/mode-qualified GitHub check name.

• fixed published execution receipt and preview schemas to model the complete structured prepare
  summary, including Compose file/env-file selection, browser bootstrap, and typed hydration
  provenance. Receipt environment source status is again constrained to the runner's canonical
  source-status vocabulary instead of arbitrary text.

• added contract-owned agent.refusal_canaries and runner-bound --expect-refusal controls for
  V11.3 agent safety. ota run --agent --expect-refusal <task> and
  ota up --agent --expect-refusal --workflow <workflow> now pass only when the existing agent
  admission boundary refuses the declared target before work starts, publishing a typed
  refused_as_expected result with the derived refusal receipt. An admitted target fails the
  canary without starting the selected lane.

• added the first V11.15 CI projection surface: ota ci projection --workflow <name> --mode <mode> --target-os <linux|macos|windows> --json emits the provider-neutral contract lane, while ota ci github render, check, and
  sync share one deterministic GitHub reusable-workflow adapter. Generated content uses immutable
  Action revisions, consumes
  ota-run/setup through source: contract, runs contract validation, discovery, dry-run,
  execution, archival, and declared proof requirements, uses canonical merge-check identity, and
  binds a human-owned caller through a parsed structural reference. Native, container, and target-OS
  lanes have distinct projection identities; proof claims never bypass agent admission; proof lanes
  use one authoritative runtime-proof execution; render and caller binding identities are separate; sync is
  atomic and refuses unowned files, caller paths, absolute/traversal paths, or any attempt to
  rewrite provider-owned scheduling policy.

• hardened target-OS admission for every provider-neutral projection: the selected workflow closure
  must support both the requested execution mode and each resolved execution context on that OS;
  Ota refuses impossible provider jobs before render, check, or sync.

• added execution-scoped projection toolchains. Provider-neutral JSON now identifies whether each
  selected toolchain belongs to native, container, or remote execution; the GitHub adapter
  provisions only native-owned toolchains and leaves container runtime ownership with the declared
  execution image.

• widened the GitHub projection adapter to provision native Python toolchains fulfilled through
  source: uv with immutable actions/setup-python and astral-sh/setup-uv revisions. Supported
  lower-bound Python ranges project to an explicit runtime selector; unsupported sources and ranges
  still refuse rendering.

• widened the GitHub projection adapter to provision contract-owned Node/Corepack lanes with an
  immutable actions/setup-node revision while preserving the declared Node semver selector;
  unsupported fulfillment sources still fail rendering rather than falling back to a hosted image.

• widened the same provider adapter to project contract-owned Ruby lanes with immutable
  ruby/setup-ruby, preserving the declared Ruby release selector instead of requiring caller YAML
  to duplicate runtime setup.

• added workflows.<name>.proof.claim: bounded for archive-backed verification proof lanes that
  do not declare a dependency seam. Doctor now evaluates the same proof_breadth assurance model
  for those lanes: it remains unknown without a matching immutable proof archive and becomes
  supported only when the archived proof matches contract snapshot, source identity, and scope.
  Existing seam-control proof declarations remain compatible and continue to publish their
  qualified runtime-proof claim.

• extended V11.14 claim_assurance[] with workflow proof_breadth. Doctor now consumes only a
  content-addressed runtime-proof archive matching the current semantic contract, clean source
  identity, resolved execution scope, and witness-only replay posture; matching failed proof is
  cited as contradicted, while missing, stale, changed-source, or scope-mismatched archives
  remain unknown. Ota-owned .ota runtime state does not dirty that source identity, so a fresh
  archive cannot invalidate its own proof claim.

• added optional immutable tasks.<name>.replay_inputs[].expected_identity pins. Ota now
  validates canonical SHA-256 identities, evaluates them in dry-run and Doctor, blocks ota run
  and ota up before task startup on missing or mismatched pins, and preserves expected plus
  observed identity in the resulting blocked receipt instead of reducing the failure to text.

• added policy-governed replay-input identity admission through
  policies.replay_inputs.identity.tasks|workflows. One runner-owned preflight observation set now
  drives Doctor findings and JSON, dry-run, run, up, proof runtime, proof lifecycle, and
  admission-produced execution/refusal receipts. Replay admission, Doctor/provisioning findings,
  receipt policy evidence, agent admission, claim assurance, and CI projection now consume one
  loaded policy snapshot per command instead of independently reloading a changing local or remote
  authority. Runtime proof passes that admitted authority, including explicit absence, to its
  detached child through a private temporary snapshot. Governed deny and review
  outcomes refuse
  before native provisioning, proof artifact creation, dependency hydration, service ownership,
  assertion execution, or task startup. Unavailable observations and unreadable or mismatched
  declared pins fail closed, and hard-pin refusals retain the active policy evidence. Generic
  readiness receipts do not reconstruct policy after execution. Runtime proof evaluates the full
  selected proof closure, including seam observers and its selected negative control, and reuses
  that preflight for both readiness findings and the embedded Doctor artifact; lifecycle
  proof evaluates the exact prerequisite-plus-assertion closure before beginning its transaction.
  Active policy sources that fail to load now refuse with typed
  replay_input_policy_unavailable evidence instead of disappearing as absent policy. Replay
  observation, policy selection, and hard-pin capture also include recursive after_success,
  after_failure, and after_always execution edges before the parent starts.
  Aggregate monorepo Doctor JSON retains each member's canonical policy result. CI projection binds
  the active policy identity, applicable rules, canonical execution closure including recursive
  outcome hooks, and unresolved selector identities while each provider checkout evaluates its
  own observed replay-input identities. Bedrock pressure proves strict matching admission across
  native and container replay, while Kylrix proves ordinary unpinned compatibility and strict
  refusal before setup mutation.

• added native virtualenv provenance to the V11.16 execution_boundary carrier in
  ota proof runtime --json and archived runtime proofs. Ota now records a repo-local
  ensure_virtualenv precondition, pyvenv.cfg identity, producer edge, and post-success native
  .venv/bin/* assertion before deriving cold_start_verified or
  persistent_state_reused. Other filesystem targets, container filesystem prerequisites,
  Windows virtualenvs, services, volumes, caches, and provider-managed state remain explicitly
  unknown.

• fixed native ensure_virtualenv Python selection to prefer a version-compatible interpreter
  matching the host architecture over an earlier incompatible PATH candidate. Ota passes that
  local executable to uv, preventing Rosetta/x86 Python selection on Apple Silicon and its
  resulting native dependency cross-build failures.

• preserved a verified reused-boundary identity in the execution-boundary graph and signed trace.
  Later workflow phases can now re-verify an existing virtualenv or pnpm layout at the selected
  boundary and derive persistent_state_reused instead of dropping the evidence or treating it as
  a new producer result.

• added native pnpm provenance to the same V11.16 runtime-proof carrier. A frozen-lockfile,
  non-Compose pnpm hydration can now establish node_modules only when a declared local
  pnpm exec or package-script consumer runs. Ota binds pnpm's generated .modules.yaml layout
  marker to the declared lockfile and emits asserted_at package-resolution evidence without
  claiming whole-tree hashing or process-level consumption. Other Node package-manager layouts and
  container paths remain unknown.

• preserved that runner-authored virtualenv provenance across separate workflow setup and runtime
  task transactions, so a later ensure_virtualenv observation cannot erase an earlier
  absent-and-materialized boundary before the selected .venv/bin/* consumer asserts it.

• checkpointed frozen native pnpm hydration after its producer completes, then bind the generated
  node_modules layout and frozen lockfile identities to the runner-observed local consumer after
  readiness. Detached runtime proof no longer depends on service teardown to flush that evidence.

• made compatible finite ephemeral-container dependency closures share one runner-owned session,
  so typed hydration survives into build/test consumers and the session is removed after the
  selected closure terminates. This does not attest container filesystem freshness beyond the
  prerequisites Ota can identify and verify.

• fixed CI bootstrap drift recovery to distinguish ota-run/action reporting steps from Ota
  installers: an Action step with install: never no longer emits a false bootstrap-drift warning
  merely because it references an unreleased Action branch for pressure proof

• added additive claim_assurance[] to ota doctor --json as the first V11.14 carrier for
  contract-claim assurance. Agent-safe task declarations now keep maintainer assertion, derived
  closure, policy-independent assurance, and policy decision separate; contract-only evidence
  remains explicitly unknown rather than reading as independently supported. Org policy can now
  opt into family-scoped assurance requirements without reclassifying the canonical evidence state

• added the first deterministic V11.14 contradiction: a declared-safe typed
  reset_compose_service_volume action that omits its matching
  effects.adapter_state: compose_volume:<volume> is now cited as contradicted in Doctor
  claim-assurance output; opaque shell remains unknown rather than inferred

• added ota proof runtime --json --archive for immutable runtime-proof records. Archived proof
  JSON is content-addressed and bound to a semantic contract snapshot, clean source identity when
  available, and resolved execution scope; the mutable proof working bundle is no longer a
  candidate replay witness