Skip to content

ota-run/ota](https:

v1.6.16 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 9d Developer Productivity
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

cli configuration contracts developer-tools infrastructure ota
+5 more
productivity repo-readiness rust validation workspace

Affected surfaces

auth rbac

ReleasePort's take

Moderate signal
editorial:auto 9d

Starting with v1.6.16, the system enforces `metadata.ota.minimum_version` at contract load time for all commands.

Why it matters: Contracts must declare a minimum OTA version; otherwise loading fails on any command execution (severity 70).

Summary

AI summary

Enforced minimum Ota version at contract load time and added structured Windows native build bundle support.

Changes in this release

Breaking High

Enforce `metadata.ota.minimum_version` at contract load time across all commands.

Enforce `metadata.ota.minimum_version` at contract load time across all commands.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Feature Medium

Add `ota --version --json` with stable provenance fields and `contract_capabilities[]` entries.

Add `ota --version --json` with stable provenance fields and `contract_capabilities[]` entries.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Feature Medium

Introduce `toolchains.python` with provider `uv` as a managed Python runtime owner.

Introduce `toolchains.python` with provider `uv` as a managed Python runtime owner.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Feature Medium

Add `execution.contexts.<name>.only_on` to declare supported host OSes per execution context.

Add `execution.contexts.<name>.only_on` to declare supported host OSes per execution context.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Feature Medium

Add `tasks.<name>.effects.writes`, `.network`, and `.external_state` as first‑class task side‑effect metadata.

Add `tasks.<name>.effects.writes`, `.network`, and `.external_state` as first‑class task side‑effect metadata.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Feature Medium

Pin installer target in `ota init` bootstrap commands to the running Ota version via `OTA_VERSION=v<current>`.

Pin installer target in `ota init` bootstrap commands to the running Ota version via `OTA_VERSION=v<current>`.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Fix `ota proof runtime` wait‑budget derivation to honor readiness timing policy.

Fix `ota proof runtime` wait‑budget derivation to honor readiness timing policy.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Fix contract identity counts in preview output to report scoped execution‑context and task requirements accurately.

Fix contract identity counts in preview output to report scoped execution‑context and task requirements accurately.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Fix selected workflow/task toolchain scoping to avoid false runtime/tool blockers.

Fix selected workflow/task toolchain scoping to avoid false runtime/tool blockers.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Teach `ota doctor` to short‑circuit probing when preconditions already contain blocking errors.

Teach `ota doctor` to short‑circuit probing when preconditions already contain blocking errors.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Full changelog
  • removed visual_studio_build_tools: true from docs and shipped workflow examples so public
    guidance only teaches the structured platforms.windows.visual_studio.components form while
    keeping legacy shorthand compatibility in the parser
  • added structured native_prerequisites.<name>.platforms.windows.visual_studio.components
    support plus platform-scoped native_prerequisites.<name>.platforms.<os>.requires
    runtime/tool/toolchain/env/check requirements, so contracts can model Windows native build
    bundles through an Ota-owned vswhere probe, attach dependencies such as Python, and preserve
    receipt provenance without embedding long raw PowerShell checks in checks.run
  • made ota --version build identity explicit for source builds by including commit and dirty
    markers, and added ota --version --json with stable provenance fields (semver,
    source_build, commit, dirty), schema_version, and additive
    contract_capabilities[] entries so machines can distinguish build identity from contract
    capability support
  • formalized ota --version --json as a compatibility-locked JSON surface with a published
    version.json schema and conformance coverage
  • enforce metadata.ota.minimum_version at contract load time across command surfaces (not only
    validate), so doctor, up, and related commands fail early with a clear minimum-version
    message when the running binary is too old
  • centralized preview-status semantics so doctor, ota run --dry-run, and ota up --dry-run
    share one verdict model for READY / READY WITH WARNINGS / BLOCKED and
    RUNNABLE / RUNNABLE WITH WARNINGS / BLOCKED, and fixed preview JSON helpers to keep
    preview_status present on repo and member ota up --dry-run payloads
  • minimum-version compatibility diagnostics now call out detected unsupported contract
    capabilities when the contract uses a known feature newer than the running binary
  • minimum-version compatibility errors are now feature-first and operator-grade: they report the
    contract minimum, current binary identity, detected unsupported contract feature when known, and
    the next install/rebuild step with ota --version --json as the confirmation lane
  • documented the product rule that schema_version moves only for non-additive contract-generation
    changes while additive compatibility growth extends contract_capabilities[]
  • added an ota-readiness CI guard lane (json-schema-guard) that runs
    json_schema_contracts and json_output_conformance before readiness execution, preventing
    schema/output contract drift from reaching the main readiness lane
  • aligned ota up --dry-run and ota run --dry-run preview messaging with explicit
    preview_status (RUNNABLE, RUNNABLE WITH WARNINGS, BLOCKED) while keeping canonical
    shared readiness verdicts in summary.verdict
  • ota doctor now warns when .devcontainer/devcontainer.json advertises a Node image that
    drifts from the repo contract's declared runtimes.node requirement, so repo-owned
    devcontainer shells do not silently lag repo readiness truth
  • ota init starter agent boundaries now lock ota.yaml into agent.protected_paths as an
    explicit default and carry the matching agent.exceptions.sensitive_writes: [ota.yaml] rule
    whenever a starter intentionally grants contract-authoring authority with writable ota.yaml
  • ota proof runtime now treats warning-only risk findings such as
    effects.external_state / effects.network selected-path advisories as visible proof context
    instead of proof-failing blockers; only error-level proof findings now collapse a successful
    readiness proof
  • ota doctor now also warns when a repo-owned devcontainer bootstrap command uses a different
    Node package manager than the repo contract declares, and when agent.writable_paths includes
    sensitive lockfile, env/config, runtime-topology, CI, or repo-contract paths beyond the
    declared agent.posture; narrow intentional exceptions can be acknowledged through
    agent.exceptions.sensitive_writes while the legacy
    agent.acknowledged_sensitive_writable_paths alias still loads for compatibility
  • agent boundary validation now rejects overlapping agent.writable_paths and
    agent.protected_paths entries when they duplicate the same normalized path, while still
    allowing protected carve-outs under broader writable roots
  • fixed ota proof runtime wait-budget derivation for selected service surfaces so proof now
    honors declared readiness timing policy (start_period, interval, timeout, retries)
    instead of collapsing heavy startup paths down to a small timeout-only window; fresh CI Docker
    builds such as Hoppscotch self-host proof now respect the contract's actual startup budget
  • added execution.contexts.<name>.only_on so contracts can declare supported host OSes per
    execution context; ota doctor, ota up, and task execution now fail early and explicitly
    when a selected context is not supported on the current host platform
  • fixed contract identity counts in preview and related output so scoped execution-context and
    task requirements are counted honestly instead of reporting misleading zero-runtime/zero-tool
    summaries when the selected workflow is actually blocked on scoped requirements
  • improved native/container/remote Python runtime probing to accept versioned aliases such as
    python3.12 and python3.13 when they satisfy runtimes.python, preventing false
    Missing runtime: python or mismatch findings on repos that already expose a compatible Python
    interpreter through standard aliases
  • shipped toolchains.python with provider: uv as a first-class managed Python runtime owner:
    validator, doctor, dry-run, and run-path fulfillment now understand uv-backed Python toolchains,
    fulfillment: run can invoke uv python install <version> for installable version references,
    and detector/init now prefer the shipped Python toolchain contract over fallback Python
    opportunity guidance when uv.lock and Python version signals are present
  • fixed selected workflow/task toolchain scoping so preview/doctor/up no longer fall back to every
    declared toolchain when the selected closure does not require one, preventing false runtime/tool
    blockers on unrelated workflows such as host-Docker setup paths
  • updated detector-led ota init starter agent bootstrap commands to pin the installer target to
    the running Ota version via OTA_VERSION=v<current>, so generated contracts avoid floating
    latest install targets for both shell and PowerShell bootstrap paths
  • added Slack release announcements to the release gate workflow by publishing the same generated release summary text to SLACK_RELEASE_WEBHOOK_URL when configured, while keeping Discord publishing unchanged.
  • run branch-protection-required maintainer checks on branch pushes as well as main, and remove docs-only trigger filtering from docs-quality, so protected branch-first merges work without requiring a public PR flow
  • taught ota doctor to short-circuit later service/check readiness probing when selected-path
    preconditions already contain blocking errors, so broken setups stay bounded and diagnosis
    output keeps the real blocker in front instead of spending time on unreachable surfaces
  • added tasks.<name>.effects.writes as first-class task side-effect metadata, and now validate
    agent-safe task writes against declared agent.protected_paths plus agent.writable_paths
    when that writable boundary is present
  • expanded task side-effect metadata with tasks.<name>.effects.network and
    tasks.<name>.effects.external_state, surfaced those effects through ota tasks --json,
    ota workspace tasks --json, text task inventory, and generated AGENTS.md, added
    validation for machine-readable external-state tokens, and now surface agent-safe risk warnings
    plus selected-path doctor signals when those tasks depend on network access or mutate external
    systems

Breaking Changes

  • Enforced `metadata.ota.minimum_version` at contract load time across all command surfaces, causing early failure with a clear message when the running binary is too old.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ota-run/ota](https:

Get notified when new releases ship.

Sign up free

About ota-run/ota](https:

All releases →

Related context

Beta — feedback welcome: [email protected]