ota-run/ota](https:

tightened active-execution ownership around container attachment isolation: shared logical
write paths now only conflict when they land in the same effective execution namespace, so
container contexts with distinct attachments.isolated_paths volume families can coexist
truthfully while shared repo-worktree writes still block as before

added the first audited-crossing execution evidence slice for heavier governed lanes: ota run
and ota up now accept additive --reason <text>, repo-target receipts may include
receipt.crossing, and ota up --json can mirror the same record at governance.crossing
when the selected task or workflow crosses a derived heavier execution boundary; the current
shipped slice keeps requirement source honest as derived and records runner-visible actor
posture plus caller-supplied reason presence without pretending grant or approval semantics yet

tightened V11.7 phase semantics for agent-mode governance output: post-execution evidence now
publishes additive not_run_reason and crossing_record_state, so dry-run previews, preflight
refusals, and heavier lanes that have not executed yet no longer force consumers to infer why
nothing ran or why crossing evidence is absent

widened ota doctor --json with additive governance.merge_gate, publishing a first
machine-readable merge-oriented governance verdict over projected required verification lanes and
recovered CI drift metadata; the same surface now stays honest by distinguishing projected
from drift_detected instead of pretending full provider alignment when Ota only has partial
workflow recovery evidence

added additive harness-facing capability_profile export on ota tasks --json and
ota workflows --json, publishing agent-callable vs refused lanes with canonical preflight
governance, exact agent commands, environment boundaries, and closure effect posture so
harnesses/sandboxes can consume Ota’s execution truth without scraping human output or
rebuilding safe-task/refusal semantics themselves

widened CI verification governance findings with additive machine-readable
metadata.governance.merge_check_id plus verifier lane metadata on ota doctor --json, so
CI/merge consumers can key off stable Ota-owned verification-lane identity instead of brittle
workflow/job/check display names while Ota continues to recover actual provider source paths

added top-level governance.required_verification_lanes to ota doctor --json, projecting
merge-relevant verification lanes from ci_verification / legacy ci_validation workflows
before falling back to agent.verify_after_changes, so CI drift compares contract-owned required
lanes instead of broad task truth

tightened ota detect package-script task inference so pure guidance-only scripts such as
echo "use 'yarn start' instead" or echo '... no longer supported' no longer become
runnable task truth; this closes a mixed-signal precedence gap where redirect-only
package.json scripts could incorrectly outrank the repo's actual documented runnable surface

tightened CI verification drift scoping so repos that already declare workflows only get CI
verification governance on tasks reachable from workflows with intent: ci_validation; local
contributor verification slices no longer get falsely treated as CI mirrors just because their
task names contain verifier-shaped labels such as verify

fixed script-body tool inference so leading shell comments no longer get treated as required tools;
multi-line script: tasks now skip comment-prefixed lines before inferring presence-only
command requirements for doctor and dry-run surfaces

tightened external AGENTS.md / CLAUDE.md task-command admission so placeholder-heavy
command templates such as <PROJECT> or obvious path/to/... scaffolding stay out of detect
task truth; ota still admits narrow structured boundary-doc command sections, but only when the
recovered command is concrete enough to be runnable evidence instead of prose guidance, and it
now prefers command-derived canonical task identity over prose aliases when the command already
exposes a stable runnable task name

widened CI verification recovery again so ota doctor can now recover repo-local verifier
scripts such as node scripts/verify-*.js and bounded step-named opaque checks as declared
verification tasks, reducing false CI verification drift when the workflow lane is canonical
but the verifier body is not an ordinary package-manager subcommand

tightened ota detect so GitHub Actions run: lines containing ${{ ... }} interpolation no
longer get promoted into task-command truth, keeping workflow templating and local contract
execution truth separate instead of hallucinating executable repo tasks from CI expressions

tightened safe-task detect inference so verifier-shaped task names that still own orchestration
or adapter control lanes, such as docker:test, no longer get auto-promoted to
safe_for_agent: true just because their names contain test

tightened CI verification drift governance so ota doctor now unions exact verifier coverage
across multiple verification-oriented GitHub workflow files instead of forcing one best-match
file to own the whole aggregate and reporting false drift when the repo truth is intentionally
split

tightened that same CI verification drift lane again so only verification-oriented GitHub
workflows become canonical verification evidence; deploy, release, publish, sync, and similar
workflows no longer outrank real verification lanes just because they happen to contain one
check step

widened prepare.kind: tool_bootstrap with first-class prepare.tool: cypress_browsers for
source.kind: node_package_manager, so repos can now own npx|pnpm|yarn|bunx cypress install
structurally instead of burying Cypress browser bootstrap inside chained verification shells;
validator, runner, task previews, contract reference docs, and published schemas now treat that
lane as canonical while keeping Playwright-only fields such as prepare.browsers,
prepare.with_deps, and prepare.source.filter strict

added first-class action.kind: ensure_git_template, so deterministic scaffold/factory bootstrap
can now own git clone plus inherited .git removal plus fresh git init as one governed
materialization lane instead of pushing template bootstrap back into shell glue

widened action.kind: ensure_git_checkout / ensure_git_checkouts again so deterministic
checkout materialization can now also own declared Git remote wiring through remotes[];
Ota now idempotently adds missing remotes or updates remote URLs inside existing checkouts
instead of forcing fork/upstream remote truth back into shell bootstrap steps

added first-class action.kind: ensure_git_checkouts, so one setup lane can now own several
deterministic Git-backed sibling or vendored checkouts without flattening that materialization
truth into repeated low-level ensure_git_checkout entries; ensure_bundle can now compose the
same multi-checkout step with file/env prep, moving-head advisories stay per checkout, and the
published contract/docs/examples now describe the widened VCS materialization surface directly,
including the workspace task JSON schema and capability reference surfaces

widened action.kind: ensure_git_checkout / ensure_git_checkouts so declared checkout targets
may now use sibling or workspace-relative paths such as ../ui instead of being artificially
constrained to repo-internal paths; validator and runner now agree on that bootstrap truth, so
repos whose documented local runtime depends on side-by-side checkouts no longer need shell glue
just to materialize the required workspace layout

added first-class effects.workspace_writes for task paths that intentionally mutate sibling or
workspace-relative filesystem targets outside the repo root, so deterministic checkout/bootstrap
lanes can keep repo-scoped effects.writes strict while still declaring broader local workspace
materialization truth explicitly; agent-safe task closures continue to require repo-scoped write
boundaries, and doctor / run-preview surfaces now report workspace-relative write ownership

added first-class compose.build: true for tasks.<name>.compose.kind: run, so documented
one-off Compose contributor shells like docker compose run --rm --build ... no longer need
shell fallback or wrapper-script truth

added first-class compose.service_ports: true for tasks.<name>.compose.kind: run, so
documented one-off Compose dev lanes like docker compose run --rm --service-ports ... no
longer need shell fallback or repo-local wrapper truth

widened prepare.kind: dependency_hydration with first-class Composer ownership through
source.kind: composer, so repos can now declare structural composer install setup lanes
natively or through Compose exec/run wrappers instead of leaving Composer dependency hydration
command-owned; validator, runner, dry-run/output summaries, and contract reference docs now all
understand the Composer family consistently

taught ota doctor to flag CI bootstrap split-brain when workflows restate Ota install truth
outside agent.bootstrap.ota.source or conflict with it, so repos are pushed toward
ota-run/setup@v1 source: contract / ota-run/action@v1 source: contract instead of carrying
separate workflow-owned version, git-revision, branch, or source-install refs

added execution-boundary agent-safety enforcement to ota run and ota up: --agent now
refuses unsafe requested tasks and declared-safe task/workflow closures before any execution
starts, returns ota-authored blocked receipts/results instead of treating the safe surface as
review-only guidance, and is now recognized correctly on ota run <task> --agent instead of
being misread as task input after the task selector

widened machine-readable execution governance again with a canonical phase-labeled
governance.evaluation block on ota run --dry-run --json plus additive governance on
ota up --json: external consumers can now read explicit preflight allowed|warning_only|blocked|refused
posture separately from post-execution evidence state, and ota run --dry-run --json --agent
now truthfully publishes runner refusal instead of looking runnable in preview JSON

widened orchestrators with first-class launcher ownership and direct mode: subcommand
mediation so repos can declare truth like nix run ...#devenv -- test or devenv up without
faking direct PATH ownership or misusing task / exec; validator, selected-path diagnosis,
dry-run previews, and task execution now all consume the same orchestrator-owned command shape

widened orchestrator-mediated command previews across all shipped orchestrator modes (task,
exec, and subcommand) so ota tasks --use and ota run --dry-run now render the same
mediated command truth operators will actually execute, including readable devbox run -- ...
and nix run ...#devenv -- ... previews instead of split-brain raw host bodies

widened orchestrator-mediated first-class prepare execution so command-backed
prepare.kind: dependency_hydration and prepare.kind: tool_bootstrap can now run through
execution.orchestrator.mode: exec for declared orchestrators such as devbox and devenv,
while mixed/native prepare.kind: sequence remains outside orchestrator mediation in the
current slice; validator, dry-run preview, and runner behavior now all agree on that boundary

fixed native run-path activation ordering for command-acquired tools so repo-owned binaries such
as devbox can now be activated from tools.<name>.acquisition.provider: command before
orchestrator preparation or other selected task execution depends on them, instead of failing
early with a missing-binary spawn error

widened ota doctor --fix beyond repo-hygiene-only file edits so native doctor can now apply
deterministic command-acquired tool activation (for example a declared devbox command
acquisition) and rerun diagnosis before returning the final readiness verdict, while plain
ota doctor stays non-mutating

widened ota detect with the first V11.2 source-family ingestion step: repo-owned
mise.toml [tools] entries now contribute high-confidence runtime and Node package-manager
inference with explicit precedence over .tool-versions while still yielding to more specific
repo-local markers such as .nvmrc, .python-version, and package.json#packageManager

widened ota detect again in the same V11.2 source-family lane so
.devcontainer/devcontainer.json now contributes high-confidence Node image and bootstrap
package-manager inference while still yielding to stronger repo-local runtime and package-manager
truth

widened that same .devcontainer/devcontainer.json detector lane again so Ota now also
recognizes object/array postCreateCommand and updateContentCommand forms plus conservative
high-confidence runtime/tool presence from known devcontainer features such as node, python,
go, github-cli, and kubectl-helm-minikube, instead of only reading simple string command
fields

widened the matching doctor-side devcontainer package-manager drift lane so review pressure now
understands object/array postCreateCommand and updateContentCommand forms too, instead of
silently missing real drift once detect had already widened past string-only bootstrap commands

widened the matching doctor-side devcontainer runtime drift lane so Ota now reports
both feature-backed runtime drift and known image-backed runtime drift for node, python,
and go, instead of keeping image-hint review pressure effectively Node-only

taught Ota to read real devcontainer.json JSONC syntax for the devcontainer source family, so
comments and trailing commas no longer silently disable detect or doctor-side devcontainer truth

widened doctor-side devcontainer review again so forwardPorts now drifts against declared
host-facing contract ports from surfaces.*.port and services.*.endpoints.host.port

widened ota detect again across the next V11.2 source families so devbox.json now
contributes high-confidence tools.devbox and shell.scripts task inference, while
devenv.nix contributes conservative high-confidence tools.devenv presence without
pretending broader runtime truth than those files really own

widened the V11.2 agent-boundary source family from review-only metadata to real detect-backed
starter truth: structured repo-authored AGENTS.md and CLAUDE.md lists for
safe_tasks, verify_after_changes, writable_paths, and protected_paths now feed detect
as medium-confidence agent-boundary evidence, while Ota-generated/self-origin agent docs remain
excluded so source provenance does not recurse back into exported contract guidance

widened that same agent-doc source family again so explicit external AGENTS.md /
CLAUDE.md command sections now contribute low-confidence task guidance for narrow canonical
lanes such as build, check, lint, test, docs, and compile, including exact
| Task | Command | tables, bounded adjacent | Command | description | forms when ota can
still recover one stable canonical task name from the command itself, and labeled command
bullets inside explicit command sections, without promoting broader prose or
self-origin generated docs into executable contract truth

widened command-first external agent-doc task recovery again so direct tool commands such as
pytest ..., ruff check ..., and python -m build can now map back to stable canonical
test, lint, and build task names from | Command | description | tables instead of
being ignored unless they were wrapped in package-manager, Make, Taskfile, or Cargo forms

widened bounded external agent-doc task-table recovery again so structured sections such as
## Individual Commands and ## Common Commands, plus natural-language task labels like
Run all unit tests, Run type checking, and Format code, now recover canonical
test, typecheck, and fmt task names instead of being dropped even when the table itself
is explicit

widened bounded external agent-doc command-section admission again so nearby headings like
## Quick Reference Commands now participate in the same low-authority task-table recovery
lane instead of being ignored even when the table shape itself is canonical

tightened CI verification task recovery so bare package-manager flag invocations such as
yarn --no-check-resolutions no longer mint fake callable tasks just because a verifier token
appears inside the flag name; real verifier scripts and commands continue to recover normally
overclaiming broader Nix environment ownership

widened doctor/explain source-governance drift so manual contracts now warn when a high-confidence
external environment source already detected by Ota, such as mise.toml, devbox.json, or
devenv.nix, disagrees with the declared runtime/toolchain truth, instead of limiting that
review pressure to detector-owned merged fields; the same governance lane now also covers
high-confidence detected task-command truth from package.json#scripts.* and
devbox.json#shell.scripts.*, while existing devcontainer-specific doctor warnings remain the
narrower review surface for devcontainer drift

widened V11.2 task-command source governance again so Ota now detects high-confidence
Taskfile and justfile task truth as canonical runner-owned commands (task <name> and
just <name>) and uses that same source-governance drift lane to warn when manual
tasks.*.run entries diverge from those external task-runner sources

widened V11.2 CI/workflow verification governance so Ota now recovers medium-confidence
verifier task truth from explicit GitHub Actions run: lanes and warns when manual
tasks.*.run verification entries diverge from enforced workflow verification, while keeping
CI below direct repo execution sources in precedence

widened that same CI/workflow governance lane again so doctor now also warns when a manual
verifier task is no longer detected from enforced GitHub Actions verification truth, closing
the silent rename/removal case where workflow verification changed lanes without touching the
contract task name

tightened Taskfile/justfile detection so thin single-command wrappers now recover the underlying
direct task command instead of surfacing weaker task <name> / just <name> drift against an
already-canonical contract lane

widened V11.2 agent-boundary governance so ota doctor now detects structured AGENTS.md /
CLAUDE.md drift for agent-boundary fields such as safe_tasks, verify_after_changes,
writable_paths, and protected_paths, without pretending free-form prose is structured truth

widened first-class orchestrator ownership beyond mise: ota now ships devbox and devenv
orchestrator kinds, with validator and runner support for mediated task execution; devbox
supports prepare.install, devenv supports task/exec mediation, and unsupported trust/install
knobs now fail validation instead of pretending the contract owns behavior it does not

detect JSON and detect-written metadata now publish additive detector source-class governance
(source_class on inferred/comparison entries and metadata.ota.detect.field_source_class on
detect-written contracts) so ecosystem-source convergence can stay explicit without inventing a
parallel detector artifact

widened ota tasks --use and ota tasks --safe --use so the runnable task surface now shows
command preview, safety posture, declared effects, runnable mode commands, task dry-run JSON,
and the receipt follow-up command directly in one operator-facing view instead of leaving
execution-governance proof split across separate commands or implicit inference

widened ota run --dry-run --json with an additive top-level governance summary so CI and
agents can read the selected task lane’s safety posture, review requirement, default mode,
runnable mode commands, effect surface, and receipt follow-up command without stitching those
facts together from requested_task, task effects, and preview planning fields by hand

widened receipt/proof machine surfaces with explicit stage-family truth so execution receipts now
publish steps[*].stage_family and ota proof runtime --json now publishes
stage_family: "proof", letting CI and agents classify broad execution-governance stages
(prepare, setup, verify, proof, receipt) without inferring them from free-form labels
or proof phase names

widened execution-governance machine output with additive artifact_routing[] on dry-run,
receipt, proof, repo up, and workspace execution/status/receipt lanes so operators, CI, and
agents can see which receipt/proof artifact to inspect, archive, or capture next instead of
reconstructing that path from scattered next text and command-specific fields

widened workspace --progress-json NDJSON events with additive phase and stage_family, so
long-running workspace machine streams now publish command-local operational lane plus broad
governance family directly instead of leaving automation to infer those semantics from progress
status strings and command names

refined receipt-diff correlation ordering so likely_related_changes[] now prefers the sharpest
governance-stage match when several nearby semantic changes are otherwise equally plausible,
which keeps verify failures, setup blockers, and proof/readiness drift ordered by the failure
lane they most directly explain

fixed JSON schema compatibility for provisioning diagnostics so ota run --dry-run --json
previews that include nullable provisioning fields (source, source_config,
approved_version, and related optional metadata) now validate against published
run-preview.json / doctor.json references instead of failing smoke validation when blocked
provisioning entries include explicit null values

fixed selected-backend command executable inference so explicit command.exe or
launch.kind: command values of where/which are treated as path-lookup utilities (not
versioned tool requirements), which prevents false OTA_TOOL_PROBE_FAILED blockers in the
Windows native proof workflow