ota-run/ota](https:

aligned the published contract schema with the shipped V11.11 workflow proof surface, including
seam observations, negative-control obligations, interventions, and expected failure classes;
canonical and public proof examples now validate against the same contract accepted by Ota

fixed source-run maintainer tasks to select the ota binary explicitly, so contract validation,
task discovery, doctor follow-up, and dependency-update release gates remain runnable after the
repository added schema and documentation synchronization binaries

fixed the release gate after the 1.6.24 execution and governance widenings: backend-provider
commands retain request stdin through the signal-forwarding wrapper, container overrides are
tested only on explicitly advertised task modes, and interrupt simulations restore process-global
state deterministically

fixed doctor governance recovery so structured CI verifier steps and multi-file command sequences
remain available for aggregate comparison, while manual runtime and task drift from governed
external sources is no longer suppressed by command-family filtering

aligned local artifact hygiene with archived semantic snapshots by treating .ota/contracts/
alongside .ota/state/, .ota/receipts/, and .ota/proof/, and fixed cleanup so an unavailable
stale recorded engine does not block cleanup through the currently healthy declared engine

fixed interrupted run rendering so a signal observed in the active execution epoch remains the
authoritative task outcome, while service-only interruption evidence still retains its richer
readiness, endpoint, and container-engine diagnosis instead of being flattened prematurely

fixed ota proof runtime cleanup for selected Compose-managed dependency services; proof now
snapshots required-service state before startup and stops only services that were not already
running, preserving pre-existing developer services while removing proof-owned workloads

added a canonical runtime-proof evidence example that demonstrates marker-bound dependency
exercise, same-obligation negative-control attestation, and the required distinction between
ok, proof_verdict, and retained not_proved boundaries

fixed ota proof runtime --container cleanup for workflows whose default mode is native. The
proof cleanup scope now follows the selected effective mode and derives persistent ownership
from declared context truth before probing the container engine, so it can remove the runtime it
started without admitting unrelated active executions.

completed the canonical build_container_image example with a runnable Dockerfile, explicit
Docker provider and minimum-version truth, a finite image-build workflow, and smoke coverage for
the typed task preview

fixed execution-mode admission to use the same contract-owned support rule as task discovery;
ota run <task> --container or --remote now refuses an unadvertised mode instead of forcing
unbranched host-owned actions, including Docker/Compose control tasks, into that runtime; also
corrected task and workspace-task JSON schemas to match the established
ensure_container_network from: docker / to: <network> summary

fixed ota run <aggregate> --dry-run --json governance truth to derive network, mutation,
external-state, and compiled sandbox posture from the selected aggregate closure instead of the
empty aggregate wrapper task; preview consumers now see the same governed execution surface Ota
will actually traverse

added first-class action.kind: build_container_image, so Dockerfile-backed local image
materialization can be contract-owned as typed file, context, tag, and provider truth
instead of opaque docker build command glue; validation, task previews, capability reporting,
published contract schema, direct task execution, and doctor replacement advisories now share
the same surface

fixed task discovery mode truth for aggregate tasks. ota tasks --use now advertises a
Container, Native, or Remote invocation only when every concrete task in the aggregate closure
supports that execution backend, instead of hiding a runnable aggregate mode because the
aggregate task has no command body of its own.

fixed doctor requirement probing for repo-owned command paths. Relative or absolute command and
launch executables such as ./bin/server are no longer treated as host-PATH tools to version
probe before their producing task has materialized them.

widened typed uv dependency hydration with contract-owned source posture. default_index,
ordered indexes[], and offline now project into the executed uv command through
cross-version compatible uv index flags and flow through
task previews plus receipt hydration_provenance; when neither index surface is declared, Ota
records source resolution as unavailable instead of treating ambient uv/pip configuration as
replayable repo truth.

fixed published contract-schema parity for existing V11.10 task fields: replay_inputs and
witnessed_observations.query_traces now validate as documented instead of being rejected by a
stale generated schema.

fixed V11.11 proof-runtime schema drift. The published ota proof runtime --json schema now
covers dependency evidence, marker-bound seam observations, canonical negative controls, and
the causal-depth not_proved boundaries that the runner already emits.

fixed replay trust for typed hydration provenance. A .NET restore source that remains
resolution: unavailable is now narrowing evidence rather than an acquitting dependency input,
so ambient feed selection cannot promote a receipt-to-baseline replay to hermetic.

fixed the first V11.12 hydration-provenance carrier. Successful ota up --json now records
selected structured hydration source posture in
typed receipt.evaluated_inputs[] hydration_provenance record, preserving the contract-declared
.NET restore source configuration separately from runner-resolved NuGet feed identities or an
explicit unavailable resolution. This captures feed truth before execution and prevents a later
config-file read from silently rewriting the receipt.

fixed Unix signal forwarding for native commands and persistent services. Ota now terminates
only the child tree it owns during interruption and runtime-proof teardown, instead of
signalling the inherited process group and potentially cancelling the surrounding CLI or CI
shell.

fixed agent-safe dependency-hydration warning fan-out for structured sequence-backed setup
lanes. First-class prepare.kind: sequence tasks that include a typed
dependency_hydration step now suppress per-task agent-safe hydration warnings the same way as
direct hydration tasks, while preserving the single honest selected-path informational finding.

fixed replay-baseline scope and staleness classification. ota up --replay-baseline ... now
treats a baseline from a different workflow/backend/provider/remote-target/lifecycle as
replay_unavailable with
baseline_scope_mismatch, while backend-scoped informational findings remain visible without
staling an otherwise reproduced witness on the same execution boundary. Replay JSON now carries
the archived baseline scope beside the selected current replay scope.

fixed two execution-evidence classification regressions: ota clean now preserves a configured
engine-unavailable failure when dependency-isolation volume discovery cannot reach that engine,
even if a separate cleanup query succeeded; and a late raw interrupt signal can no longer
overwrite an already-established non-interrupt task or service failure. Explicit runner
interruption evidence and a signal after clean completion still render interrupted.

tightened runtime-proof negative controls. Canonical control records now publish
contract-declared intervention identity and runner-derived failure mode; only a transaction-bound
expected_obligation_failed / expected_missing_effect attestation can promote evidence to
fault_tested. Unclassified non-zero exits remain invalid and retain the causality boundary;
fault-tested seams now retain dependency_output_shaping_not_proved, so seam causality cannot
be read as broader application-output proof.

tightened marker-bound seam proof boundaries. Every exercised or fault-tested seam now emits
dependency_output_shaping_not_proved; its absence is reserved for a future explicit
output-proof carrier. Nested dependency-level negative-control projections now self-identify as
evidence_class: derived, and proof-runtime JSON documents that ok is execution success only:
consumers must read proof_verdict with not_proved before interpreting proof breadth.

Added workflow proof seam observations. ota proof runtime can now issue a per-proof marker to
a declared workflow producer, run a finite observer before teardown, and emit attested
exercised dependency evidence only after Ota verifies a transaction-bound observer attestation
that recovered the marker through the declared seam. The observer never receives the marker;
receipts retain only transaction and attestation digests. Runner-owned OTA_PROOF_* values now
override task and env-file resolution so active proof values cannot be replaced by contract
environment defaults.

ota proof runtime text output now renders the same runner-derived Dependency Evidence as
JSON before proof boundaries. It preserves the evidence level, observation origin, and authority
class, so reachable and caller-side-only interaction attempts cannot be over-read from a green
runtime proof.

fixed user-initiated interruption classification for long-running tasks. When Ota observes an
interrupt, it now returns the stable interrupt exit code (130) and renders an interrupted
receipt/summary even if the child application exits with its own non-zero shutdown code.

native launch.kind: command service tasks now use the same contract-owned readiness and
endpoint-publication path as native shell and container service tasks. A declared attached
surface can therefore publish its resolved external/internal endpoint once its readiness gate
passes instead of leaving native structured launches silent.

ota validate and ota doctor now flag a host-projected runtime readiness listener that is
not attached to runtime.surfaces. The advisory directs authors to promote the listener to a
named top-level surface so endpoint publication, readiness, and runtime projection share one
canonical contract owner.

added transaction-bound workflow runtime-proof negative controls. Declare a separate finite
task under workflows.<name>.proof.negative_controls with one observed seam obligation and
typed expected_failure, then run
ota proof runtime --workflow <name> --negative-control <id>. A generic non-zero exit is now
invalid; only a matching control failure attestation for the same proof transaction can become
validated and promote that exact seam evidence to fault_tested.

fixed ota proof runtime admission for warning-only readiness. A detached runtime process exit
no longer suppresses a declared seam observer when ota up is ready and Doctor reports no
errors; advisory warnings remain evidence, not proof blockers.

fixed runtime-proof seam callbacks under ota up --detach. The active-execution registry now
recognizes proof callbacks and the selected runtime as coordinated children of the same
orchestrator, while unrelated executions retain normal write, service, and environment conflict
protection.

ota proof runtime --json now distinguishes caller-side dependency attempts from proved seam
reachability. dependency_evidence[] can publish additive interaction_attempted: true with
observation.origin: caller_side when proof-derived failure evidence shows the selected lane
reached for a declared dependency without independent dependency-side or round-trip proof; the
paired dependency_exercise_not_proved boundary now tightens to
reason: caller_side_only_evidence instead of generic missing evidence

ota proof runtime --json now carries additive dependency_evidence[] for selected declared
service seams when Ota can honestly prove only reachability, not exercised interaction. The
first shipped carrier publishes runner-derived reachable evidence from structured service
readiness on the selected workflow-owned required-service path and leaves stronger seam
exercise in not_proved

ota proof runtime now emits explicit reason values on not_proved entries and mirrors them
in text output, so qualified proof boundaries distinguish missing independent seam evidence,
adjacent external paths not selected, and broader proof-scope exclusions instead of publishing
only boundary kinds

hidden-input replay failures now publish an ordered hidden_input_candidates set in JSON and
mirror it in ota up --replay-baseline ... text output, so hidden-input suspicion points
operators toward the next promotion order instead of staying one generic failure bucket:
dependency resolution, runtime or machine, execution presentation, ambient environment, then
live external state

ota proof runtime text output now carries qualified proof boundaries inline: when
proof_verdict is passed_with_unproven_boundaries, the human render lists the concrete
not_proved entries before artifacts, so a green runtime-proof lane cannot silently swallow
unproved external or broader-scope boundaries

replay hermeticity is now stricter: a same-contract rerun no longer reads as hermetic
unless replay also matched at least one material runtime, dependency, or presentation anchor;
pure contract/source/policy/env-source matches now fall to ambient_fresh_derivation, while
Bedrock-style lanes with narrowing replay artifacts remain partly_ambient

ota up --replay-baseline ... text output now surfaces replay evidence groups directly:
matched acquitting, narrowing, and pointer_only artifacts are rendered before changed
inputs, so operators can see which artifacts actually cleared a class and which only narrowed
the remaining search without digging into JSON output

ota receipt and ota up --replay-baseline ... --json now distinguish generic task replay
files from declared presentation_profile and comparator_profile replay inputs. Matching
presentation profiles acquit only the named execution-presentation class for the selected lane,
while matching comparator profiles remain narrowing evidence for comparator drift rather than a
full hermetic replay claim.

replay-capable receipts now capture clean git HEAD as source:git_head when the selected repo
worktree is clean. Receipt comparison treats a matching source identity as acquitting only
for the named source_identity class; dirty or non-git worktrees stay outside the claim.

ota up --replay-baseline ... --json now classifies replay misses with machine-readable
failure_kind, separating baseline unavailability, semantic contract drift, named replay-input
drift, hidden-input suspicion, and plain witness mismatch.

replay baseline metadata now includes last_known_good, so a promoted witness is distinguished
explicitly between replay_verified, stale_witness, and unavailable instead of all green
archives reading as equally current.

active org policy packs are now captured as replay-grade policy_ruleset_identity receipt
inputs, so execution-governance drift can fail replay as named input drift instead of falling
through as generic hidden-input suspicion.

selected declared env source files are now captured as replay-grade env_source_identity
receipt inputs when the lane actually resolves from them, so env-source drift becomes named
input drift without leaking resolved values into replay evidence.

added first-class replay execution for repo ota up: ota up --replay-baseline <latest|promoted|archive>
now resolves an archived baseline witness before execution, runs the selected workflow lane,
and emits machine-readable replay_verified, replay_failed, or replay_unavailable posture
from the execution-authored receipt instead of reconstructing replay from a later compare step;
archived ota receipt --workflow ... --archive baselines now also carry declared
replay_inputs and witnessed query-trace observations so replay compares named inputs honestly

fixed native shell task execution after source-managed tool fulfillment: release-asset and
other managed tool PATH exports now reach the task shell itself, so a fulfilled contract-owned
tool remains callable for the task that required it instead of only for Ota's fulfillment probe

added task-level only_on host support declarations. Ota validates the same platform tokens
used by tool, runtime, and execution-context scope; task planning and execution now refuse an
unsupported selected dependency closure before provisioning or side effects. ota doctor now
honors unavailable selected closures before probing their requirements, while ota tasks --use
marks unavailable mode commands instead of advertising a runnable host path

widened ota proof runtime --json not-proved boundaries with contract-derived service seams:
each requires_services dependency in the selected workflow closure now emits
dependency_exercise_not_proved with its service:<name> identity and declaring tasks until Ota
records independent seam evidence. Runtime proof no longer lets declared availability imply
exercised dependency interaction.

added task-scoped witnessed_observations.query_traces for JSONL query identity evidence from
prior or external runs. Ota captures the declared source before the selected closure begins and
emits its full attested trace under receipt witnessed_observations, separately from
evaluated_inputs; stable repeated queries retain one identity across runs, while divergent
subjects name observed query-shape variation without claiming model causality or treating
historical output as a current-run decision input

added task-scoped replay_inputs for static files consumed by deterministic verification lanes;
Ota validates repo-relative non-overlapping declarations, captures their SHA-256 identities before
ota run or ota up begins the selected closure, persists them in receipts, and renders them as
runner-derived narrowing declared_replay_input evidence

added contract-owned generated artifact lineage: artifacts.<name> now declares a generated
source artifact's producer task, output paths, and derivation inputs, while consumer tasks use
requires_artifacts; Ota validates explicit producer dependencies and rejects execution when a
producer did not materialize its declared output

widened typed node_package_manager dependency hydration with prepare.source.filter for
pnpm workspace slices; Ota renders the selector before install and rejects unsupported
package-manager ownership instead of requiring raw pnpm --filter ... install shell

upgraded quick-xml to 0.41.0 to remediate RUSTSEC-2026-0194 and RUSTSEC-2026-0195;
the NuGet feed-provenance parser now uses the current XML 1.0 attribute-normalization API

added effects.network_kind: container_image_hydration for registry-backed Compose image-pull
lanes. Structured prepare.medium: container_images now requires that explicit effect instead
of misclassifying image acquisition as package dependency hydration; doctor and policy packs can
govern the lane independently, including the matching --effect-override selector, while
immutable image receipt evidence remains a separate claim

fixed whitespace-separated semver range evaluation for runtime and tool probes, so valid ranges
such as >=1.26.3 <1.27 accept go1.26.3 without weakening Ota's existing shorthand-version
behavior

fixed Compose adapter-file preflight to resolve declared Compose files relative to the same
adapter cwd used by execution, so valid cwd-relative contracts no longer fail before Docker
can run them

fixed repo-hygiene diagnosis and ota doctor --fix so archived semantic snapshots under
.ota/contracts/ are protected alongside Ota state, receipt, and runtime-proof artifacts

added receipt-authored immutable Compose image evidence for explicitly selected services in
explicitly declared Compose files: a literal @sha256: image is captured as
selected_runtime_artifact, and receipt comparison reports a matching digest as
acquitting only for that named runtime artifact; mutable tags, interpolation, and inferred
Compose files remain outside the evidence; selected Compose services now include their declared
depends_on closure so receipt evidence follows the actual selected runtime path without
pulling unrelated stack services into the claim

added receipt-authored selected Node runtime-version evidence for the same typed lockfile-strict
hydration lanes: receipt comparison now reports a matching node --version as runner-derived
narrowing evidence for selected_runtime_version, never as a binary/image digest or broader
runtime acquittal

added receipt-authored immutable dependency input identity for typed lockfile-strict Node
hydration: selected task and workflow receipts now capture pnpm-lock.yaml for frozen pnpm and
package-lock.json or authoritative npm-shrinkwrap.json for npm ci as an
evaluated_inputs[] SHA-256 record at authoring time, and receipt comparison reports a matching
or changed lockfile as runner-derived acquitting evidence only for the named
declared_dependency_resolution input class

added terminal runtime-proof qualification: ota proof runtime --json now emits
proof_verdict as passed, passed_with_unproven_boundaries, or failed, and the text
surface renders the same decision so a narrow green proof is not over-read as broader repo
completion

added runner-derived artifact trust to receipt comparison: matching archived semantic contract
snapshots are now acquitting for the named contract_truth input class only, never for
dependency, environment, runtime, or external-world inputs that receipts did not capture. The
broader acquitting / narrowing / pointer_only model was sharpened through discovery
feedback from Vinicius Pereira.

redesigned task discovery text around closure-aware execution truth: ota tasks and
ota tasks --use now render grouped Human Run, Agent Run, and Agent Policy sections;
agent commands appear only when the full task closure is callable in agent mode, while blocked
lanes name the review-required dependency closure instead of making safe_for_agent: true look
executable by itself; Human and Agent mode lists now keep stable Container, Native, then
Remote display order and mark the selected lane as (Default), while explicitly marking
unavailable Container or Native task planes instead of silently omitting them

widened ota tasks --json with canonical use.modes[] task-mode truth: each Container,
Native, and advertised Remote mode now publishes selected/default status, contract support,
and separate human/agent callable commands or explicit refusal/unavailability reasons, while
preserving use.human and use.agent as compatibility projections of the selected mode

hardened first-class .NET restore provenance: ota up --json and ota run --dry-run --json
now distinguish declared dotnet_restore source posture from resolved execution evidence;
config-backed restores parse active NuGet.Config package sources into stable feed name/URL
identities; unreadable, invalid, environment-dependent, or undeclared ambient source selection
publishes resolution: unavailable with an honest error instead of repeating declared config as
resolved truth

fixed ephemeral container-backed .NET hydration across task boundaries: contexts that declare
attachments.isolated_paths: [.nuget/packages] now receive one Ota-managed package-cache volume
plus NUGET_PACKAGES=/workspace/.nuget/packages, so typed dotnet restore can truthfully feed
later dotnet build --no-restore and dotnet test --no-restore tasks without repo-local cache
glue

Tightened runtime-proof boundaries: ota proof runtime --json now identifies adjacent declared
external integration workflows as external_network_path_not_proved, while keeping generic
broader-repo exclusion explicitly derived from the selected proof scope.

tightened CI verification drift for narrow contract slices: workflow verification recovery now
rejects incompatible command-family and scope evidence before surfacing governance or aggregate
drift, and GitHub Actions .NET verifier inference now recognizes dotnet build / dotnet test directly so narrow .NET repo lanes do not get overruled by broader Node, docs-only, or
mismatched-project workflow signals

widened first-class .NET hydration truth with additive source provenance: prepare.source.kind: dotnet_restore now accepts optional config_file and repeated sources[], the runner and
command preview project those exact restore inputs, and ota up --json now carries structured
plan.dependency_steps[].prepare.{declared_hydration_provenance,resolved_hydration_provenance}
so setup-only dependency lanes expose replay-relevant restore source posture on the canonical
machine-readable carrier instead of leaving feed selection implicit

tightened merge-facing governance with the same narrow mechanism tripwire: ota doctor --json
merge-gate summaries and per-lane records now publish additive decision_inputs[] with stable
decision_owner:<stable-id> identity plus cited merge inputs, and now reconcile that emitted
verdict through replay, so downstream consumers can link and re-check the doctor-side merge
verdict without inventing a second merge governance model

hardened that same merge-facing replay lane so cited-input class drift now counts there too:
merge-gate replay now rejects records when canonical merge inputs are emitted with weaker
pinned / witnessed posture than the trust model expects

added the first machine-readable proof-boundary carrier to ota proof runtime --json:
runtime proof now emits canonical proof_scope and anchored not_proved[] entries so narrow
proof posture travels with the artifact instead of living only in prose

tightened V11.9 governance replay with a narrow mechanism tripwire: the canonical
governance.evaluation.*.decision_inputs[] lane now carries additive
decision_owner:<stable-id> cited inputs for preflight and post-execution records, and replay
reconciliation verifies that stable decision-owner identity on the same canonical governance
surface instead of leaving hook/branch linkage as prose-only trust

turned cited governance inputs into an actual replay lane: task preview, workflow preview, and
ota up --json governance records now publish additive preflight.replay /
post_execution.replay status, cite the extra replay-critical inputs they really depend on
(such as doctor verdict or evidence expectations), and mark satisfied, mismatch, or
unavailable directly on the canonical machine-readable governance surface instead of leaving
decision_inputs[] as a passive list

hardened that same replay lane so cited-input class drift now counts too: replay now rejects
governance records when canonical decision inputs that should stay pinned, witnessed, or
trust-sensitive attested are emitted with weaker classes

tightened field-level provenance on doctor merge-gate governance: projected required lanes,
merge-gate summaries, and per-lane merge posture now also publish additive evidence_classes
so downstream consumers can distinguish authoritative derived merge truth from future asserted
or attested fields instead of over-trusting flat JSON

widened doctor merge-gate governance with additive decision_basis[] on both
governance.merge_gate and governance.merge_gate.lanes[], so projected-vs-drifted CI merge
posture now cites stable lane and drift basis instead of publishing a flatter merge verdict

widened machine-readable governance again so post-execution evidence no longer stops at flat
state / not_run_reason / crossing_record_state: ota run --dry-run --json,
ota up --json --dry-run, and executed ota up --json now also publish additive
governance.evaluation.post_execution.decision_basis[], citing the stable non-run, evidence,
and crossing-record basis behind the selected evidence posture

fixed preview governance phase reconciliation for agent refusal. A preflight refusal now remains
explicitly present in post_execution as refusal_occurred: true with the same refusal record
and cited reason, while state: not_run truthfully preserves that execution never began.

added canonical runtime_boundary ownership on repo execution, workflow, and task lanes, so
contracts can declare compiled filesystem posture plus explicit outbound target truth for
harness-facing sandbox export instead of relying only on derived agent.*_paths and broad
effect-owned network posture; destination-constrained outbound lanes can now declare the
narrower effective destination truth, source posture, enforcement posture, and optional shared
pin freshness instead of tagging a host as send_host / relay_host without the real
downstream boundary; ota run --dry-run --json and ota up --json --dry-run governance output
now carry the same compiled sandbox_policy so execution-facing preview consumers do not need a
second task/workflow query to recover the selected lane's filesystem and outbound boundary
posture

widened workflow-instance ownership with bounded generated instance families under
workflows.<name>.instances.generated, so one explicit default instance can now coexist with a
finite repeated selector family like ws1..ws8; generated templates stay on the existing
instance boundary, support ${OTA_WORKFLOW_INSTANCE} /
${OTA_WORKFLOW_INSTANCE_INDEX} string interpolation, and can derive repeated surface/runtime
host ports with port_stride / stride instead of duplicating explicit per-instance overlays

widened task and workflow discovery output so ota tasks --use, ota tasks --safe --use,
and workflow summaries now publish explicit Humans and Agents commands instead of a single
ambiguous Use line, and task/workflow JSON now carries the same canonical use object with
agent callability and reason state

added launch.runtime_projection for supported long-running command adapters, so explicit
runtime.listeners.<name> bind truth can project uvicorn or rails host/port argv into
launch.kind: command without duplicating bind flags in launch.args

widened launch.runtime_projection with a nextjs adapter for direct structured next dev
launches, so Node application runtime listeners can own --hostname and --port instead of
duplicating those flags in package-script wrappers

fixed task and workflow dry-run input ordering when a dependency closure declares
ensure_env_file: a clean checkout now treats that env artifact as planned setup output rather
than rejecting the dependent preview before setup can materialize it

tightened native run-path fulfillment around repo-local Python setup lanes: backend/runtime
requirement probing now waits until depends_on materializes repo-local executables like
.venv/bin/python, and native Python runtime candidate probing now prefers satisfying
version-specific executables before falling back to mismatched generic binaries

widened Python setup ownership in two connected ways: prepare.kind: dependency_hydration
with source.kind: uv now supports mode: pip_requirements plus
source.requirements_file for structural uv pip install -r ..., and
action.kind: ensure_virtualenv now owns deterministic repo-local virtualenv materialization
such as .venv without shell glue

widened dependency-hydration governance so raw uv sync and raw
uv pip install -r requirements.txt lanes now produce replaceable-ownership advisories instead
of hiding a first-class Ota setup surface behind shell or command bodies

widened harness-facing capability JSON with the first compiled sandbox target,
sandbox_policy.target: "codex_local", on ota tasks --json and
ota workflows --json; task and workflow capability entries can now publish
derived filesystem compilation state from declared agent.writable_paths /
agent.protected_paths plus the current broad network posture compiled from
lane effect truth, without inventing host or destination allowlists that the
contract does not yet own