v1.6.28

• Support ordinary linked Git worktrees in Unix container execution by translating verified Git
  pointer metadata through runner-owned, read-only mounts, with the common Git directory following
  the selected workspace access posture. Ota now refuses malformed, aliased, or unsupported
  linked-worktree metadata rather than running against host-only Git paths. The translation relies
  on a protected per-user runner-state root and assumes no hostile concurrent process with the same
  OS identity can replace a validated mount source before the container engine resolves it.

• Keep optional nested .NET marker discovery resilient to permission-protected host subtrees.
  ota doctor and source-bound ota detect candidates now skip only descendant
  PermissionDenied directories during heuristic .sln/.csproj discovery, while unreadable
  requested roots and selected sources still refuse. Source-bound candidate inventory now retains
  nested .NET marker observations instead of silently dropping them.

• Fix secret_delivery command admission so contracts without secret requirements remain
  NotApplicable without requiring an exact task or workflow subject. ota up for task-less
  monorepo roots and service-only contracts no longer reports
  secret_delivery_admission_subject_unknown and instead preserves existing readiness,
  service-start, and environment diagnostics.

• Show a compact Ota Readiness success summary before runtime endpoint publication in rich
  output. The summary names only the resolved listener, aggregate probe count, and observed
  attempt; detailed targets and failure diagnostics remain retry-only, and JSON/plain output stays
  unchanged.

• Support explicit yarn_release: classic in typed node-package hydration so strict Yarn 1
  setup uses --frozen-lockfile rather than modern Yarn's --immutable. Existing Yarn contracts
  keep their modern behavior; Classic plus inline_builds is rejected.

• Harden ota agents --review and ota agents --write to recognize generated guidance only when
  it exactly occupies one uniquely delimited managed block. Duplicate, reversed, ambiguous, or
  stale markers no longer appear synchronized merely because matching generated text exists
  elsewhere in AGENTS.md; write mode now refuses ambiguous marker layouts without modifying the
  file, writes new files with the same markers, and migrates exact legacy generated-only files into
  one managed block. Contract-authored content containing a reserved marker also refuses instead of
  manufacturing a second ownership boundary, and unreadable existing files are preserved rather
  than being mistaken for missing files. Marker text embedded in ordinary prose is preserved and
  no longer treated as a replacement boundary.

• Reconstruct one crate-private, provider-free Step 1-6 secret-delivery transaction candidate from
  an authenticated protected authority snapshot, a challenge-backed invocation context, and the
  canonical selected RunPlan. Core re-derives task and workflow roots, binding/source, profile,
  implementation subject, exact provider tuple, effects, policy decision, evaluation, and dry-run
  plan, and refuses selected roots outside the exact native Linux transient structured-command
  boundary. Protected policy authority now flows only through a crate-private verified-snapshot
  evaluator and cannot be represented by ordinary policy archive records. This introduces no CLI
  route, OIDC request, provider contact,
  materialization, injection, public output, or positive evidence.

• Complete the provider-free Core half of the selected-child secret-delivery transaction boundary.
  After ordinary admission selects the exact systemd V4 broker carrier, Core uses the inherited
  startup-bound session for one signed same-child capability observation, one protected authority
  snapshot, canonical Step 1-6 candidate reconstruction, and one snapshot-bound V2 binding. The V2
  request reuses the exact observation and private prelude rather than creating a sibling probe;
  Core independently reloads installation authority, verifies every response, and retains a
  one-use guard for a future provider request. Unsupported carriers refuse before broker authority
  consumption, while the successful V2 path still refuses before task execution because provider
  contact remains inactive. This introduces no OIDC access, provider contact, materialization,
  injection, receipt, archive, assurance, or support claim.

• Keep ota detect task inference bounded to public task-runner entries and canonical reusable
  GitHub Actions verification steps. Taskfile helpers whose names begin with _ or declare
  internal: true remain implementation detail, while repeated calls to the same reusable
  verification step collapse to one readable task instead of producing caller-specific
  hash-qualified duplicates.

• Fix native Corepack run fulfillment so declared package managers are dispatched through
  corepack <manager> for structured task commands and typed Node dependency hydration instead
  of resolving an ambient global shim. Diagnose-only Corepack declarations remain non-provisioning;
  opaque shell bodies remain unchanged.

• Add a crate-private, provider-free GitHub Actions OIDC request-endpoint profile and semantic
  observation verifier for the activated V12.1 Linux/X64 protected-runner target. The initial
  profile is fail-closed to the retained East US service family with a canonical positive shard,
  exact path shape, and exact query shape. Each observation binds the exact supplied host;
  target, endpoint, profile, capability-identity, and recomputed-observation
  substitutions refuse. Core's active broker and capability-observation consumers require the
  immutable V4 protected-launcher profile while the V3 attestation wire envelope remains stable.
  The Linux-only compatibility client now issues one fresh challenge,
  sends the exact invocation-bound probe to the fixed root Launcher socket, reloads the
  administrator-installed projection verifier and its public installation binding, and accepts
  only the matching signed public projection. The endpoint model binds that projection identity,
  never the raw protected capability identity. A separate X64 workflow verifies the protected
  runner posture and administrator installation identity. A separate no-id-token job proves a
  pinned Actions Toolkit uses a supplied loopback URL rather than the JWT issuer; the protected
  job reads that retained probe and records the live endpoint shape. The protected job now also
  exercises the source-built Core client and retains only its signed public capability-observation
  projection. It does not instrument or claim OIDC or provider contact and activates no secret
  transaction, materialization, delivery, or selected execution.

• Added V12.1 command-scoped secret-delivery admission for run, up, runtime and lifecycle
  proof, Doctor context, CI projection/re-evaluation, sandbox capability, and harness output. An
  empty selected requirement set preserves existing behavior. A non-empty set now refuses before
  setup, hydration, workflow environment rendering, durable logs, services, proof artifacts, child
  creation, repository mutation, or provider contact because no production protected binding
  loader or provider transaction exists yet. JSON exposes only a domain-separated public
  projection with bounded applicability, secret_delivery_protected_truth_unavailable,
  availability: not_checked, provider_contact: not_attempted, delivery: not_attempted, and
  execution_started: false; protected binding, source, policy, realization, subject, invocation,
  evaluation, and plan identities remain internal. Real ota up retains its existing generic
  blocked execution receipt with execution_attempted: false; this step provides no secret
  storage, materialization, delivery, execution authority, positive secret-delivery receipt,
  secret-delivery archive, assurance, or support claim.

• Added the sealed V12.1 provider-free secret-delivery evaluator and dry-run plan. Core now
  derives the selected requirement set from the retained contract and exact task/workflow graph,
  then independently re-verifies Step 1-4 requirement, realization,
  provider-binding/source, profile/subject, invocation, and effect-policy truth; empty selections
  remain not_applicable, policy denial refuses, and allow/warn establishes only structural
  eligibility for a future provider check. Every plan retains availability: not_checked,
  provider_contact: not_attempted, delivery: not_attempted, and execution_started: false.
  This internal step adds no loader, command consumer, provider contact, materialization, execution,
  public output, receipt, archive, assurance, pressure evidence, or support claim.

• Added the sealed V12.1 secret_material_delivery effect foundation. Core now derives a stable
  bounded-consequence identity separately from exact requirement, recipient, closure-role,
  invocation, protected binding/source, profile, implementation-subject, and target realization
  truth. Derived records are independently reconstructed before the existing canonical
  effect-policy finalizer applies fallback and precedence; every realization must map to exactly
  one retained selected invocation, and that structured mapping participates in execution-graph
  identity. Policy cannot manufacture missing authority. Equivalent consequences may share an
  effect identity while repeated roles and distinct recipients retain distinct realizations only
  when the selected graph retains those exact occurrences. This internal step adds no loader, policy
  authoring surface, CLI route, provider contact, materialization, injection, execution, public
  output, receipt, archive, assurance promotion, pressure evidence, or support claim.

• Added the V12.1 exact first-adapter identity foundation for
  google_secret_manager_github_oidc_process_environment_v1. A sealed Core model now separates
  stable profile semantics, exact implementation/build/target truth, and the protected per-run
  GitHub OIDC, Google Workload Identity Federation, service-account, project, and versioned Secret
  Manager tuple. Resolution requires the exact linux/x86_64 GitHub Actions native-process target,
  canonicalizes unordered claim input, binds every expected claim value, requires the OIDC audience
  to identify the selected WIF provider, and refuses omitted, duplicate, noncanonical, widened, or
  substituted inputs. This internal step adds no loader, registration, CLI route, token request,
  network or provider contact, secret delivery, effect/policy admission, execution, evidence, or
  support claim.

• Added the V12.1 protected provider-binding identity foundation. A sealed Core model now binds the
  exact requirement, provider reference, authority scope, source evidence, adapter identity,
  lifecycle posture, and target constraints, while a pure resolver refuses missing, duplicate,
  conflicting, unknown, cross-scope, and substituted bindings without precedence fallback. Its
  public projection excludes requirement linkage and all private provider/source material, exposing
  only the closed non-secret binding class, disclosure posture, and projection identities.
  This step adds no binding loader, CLI route, provider adapter, provider contact, secret delivery,
  execution authority, receipt, archive, or support claim.

• Fixed ota tasks --use, including the canonical ota tasks --safe --use agent-discovery lane,
  to render task notes alongside descriptions and runnable commands. Multiline notes retain plain
  output parity, so declared proof limits and external-boundary guidance are visible before an
  agent selects a task.

• Fixed CI verification drift detection to recognize ota run <aggregate> --agent as a bounded
  foreground execution of the declared aggregate. Agent admission changes who may execute the
  lane, not its contract-owned ordered membership; dry-run, dependency-skipping, alternate-contract,
  shell-indirected, and malformed invocations remain non-covering.

• Hardened the existing runtime-proof negative-control guarantee with a test-only live-transaction
  fault boundary. Two declared controls now produce distinct valid attestations in one proof run;
  substituting the sibling digest while retaining same_obligation: true refuses at production
  reconciliation before terminal proof output, receipt, or archive publication. The earlier
  malformed-digest regression remains separate structural coverage, and the published runtime-proof
  schema now requires canonical lowercase SHA-256 attestation identities. Thanks to
  @vinimabreu for identifying the difference between malformed-
  digest rejection and substitution of a valid digest from the wrong attestation, and for pushing
  the transaction-level regression that proves the latter refuses before evidence publication.

• Fixed detection so named GitHub Actions steps containing unresolved matrix or shell expressions
  cannot become runnable contract tasks, and made Rust channel validation consistent with Doctor:
  diagnose-only toolchains require comparable semantic versions while rustup-owned run fulfillment
  continues to accept stable, beta, and nightly.

• Activated V12.1 with an additive provider-neutral secret_requirements contract catalog. The
  initial declaration binds an authentication-credential purpose, canonical process-environment
  destination, exact task/workflow roots, deny-only propagation posture, requested execution
  constraints, and a domain-separated semantic identity. Validation rejects provider selectors,
  secret defaults, destination collisions, compatibility-owned values, unknown or noncanonical
  recipients, noncanonical environment-variable names, and a missing or lower-than-1.6.28 contract
  floor. This foundation does not load provider bindings, contact providers, materialize or inject
  secret bytes, authorize execution, or emit positive delivery evidence.