# Current Ota Development State Update this file at a completed implementation, pressure, release, or handoff boundary. Replace stale state; do not turn it into an activity log. Durable decisions belong in `docs/adr/` and durable agent workflow belongs in the canonical Ota skill. ## Active Work - branch: `1.6.25-implementation` - released baseline: `v1.6.24` - completed V11.17 trusted replay-baseline regeneration: Core now has an additive `artifacts..replay` authority chain: explicit producer record, immutable recorded attestation, exact promotion, then replay consumption. A portable authority manifest binds the canonical recursive output set, producer receipt, source/contract identities, and the producer's V11.16 execution-boundary graph plus asserted-target and derivation-input closures. `read_only` refuses outside a runner-owned ephemeral container boundary and mounts a run-scoped snapshot outside the writable workspace for the full selected closure; `verify_unchanged` detects mutation after native or container replay and never claims prevention. Portable authority declares SCM review as its external selection trust root, not signer-backed provenance or Ota-verified reviewer approval. Bedrock now has an additive unsafe `record:baseline` producer and separate promoted offline consumers. Its promoted lane correctly fails closed with `OTA_REPLAY_BASELINE_UNAVAILABLE` until an intentional live recording is reviewed and explicitly promoted. Upstream [run 30268181240](https://github.com/vinimabreu/bedrock/actions/runs/30268181240) recorded an approved live-model candidate with attestation `sha256:0bfb61977a38310c7ee515a4de31cec5ca4198b7bb63fb1a1bd980f920a39b93` and source `git:bb0ace385cfe17c1a5c195f3cd20de60a446cea6`. Its aggregate score improved, but `top_product_by_quantity` became `stable_wrong`; it is intentionally unpromoted. The uploaded review artifact omitted the required producer receipt archive, so it cannot later support `ota baseline promote`; Bedrock must retain `.ota/receipts/` and make a fresh reviewed recording after that workflow fix. This is a Bedrock workflow-retention gap, not an Ota Core defect. Core focused record/promotion, JSON conformance, and published-schema tests pass. EventCatalog closes the independent non-model generated-baseline gate: [run 30198942717](https://github.com/bobaikato/eventcatalog/actions/runs/30198942717) preserves the ordinary native generator matrix on Ubuntu, macOS, and Windows and separately proves a fresh runner can consume the committed portable authority without local `.ota` history: Doctor admission, workflow dry-run, setup hydration, detached compiler consumption, and receipt archival all pass. CI never creates or commits that authority; its `scm_review` trust root remains an external delivery/review assumption, not Ota-verified reviewer approval. Source identity correctly excludes declared Langium outputs and refuses workflow-generated transient JSON until that evidence moves to `$RUNNER_TEMP`; the promoted consumer compiles the approved authority rather than comparing a newly approved baseline against Git `HEAD`. EventCatalog run [30226480354](https://github.com/bobaikato/eventcatalog/actions/runs/30226480354) completes the independent strict-replay pressure gate: ordinary generated-source lineage remains green on Ubuntu, macOS, and Windows, while explicit record/promotion and committed-authority consumption both run through the declared ephemeral container boundary with `read_only` enforcement. A credentialed Bedrock recording is now an upstream, intentionally reviewed adoption lane. Its first candidate remains unpromoted for a real `stable_wrong` regression and missing receipt retention; it is not a release gate for the general V11.17 model. Dagger exposed and now exercises the needed hybrid posture: `generated_source` retains an ordinary producer-dependent SDK check while a second task can consume the same output only through explicit promoted replay authority. The Core schema, Doctor, receipt, mutation guard, and strict runner boundary all derive that consumer distinction from the producer dependency. Its hosted pressure run [30179771523](https://github.com/bobaikato/dagger/actions/runs/30179771523) bootstrapped Core `b5b55e0e` and passed contract/discovery/dry-run admission, but the ordinary producer failed before record/promotion because Dagger's module-owned runtime resolves `protobuf-dev~32` against a mutable Alpine package index that no longer satisfies it. This is not an Ota replay defect or a reason to weaken the generator; it is an explicitly bounded external Dagger engine/module-runtime provenance gap. Dagger remains unsuitable for green generated- baseline pressure until its upstream runtime is made reproducible or Ota gains a Dagger adapter that can attest that tool-managed container state. - completed implementation slice: V11.19 typed uv local-project hydration. The replay classifier now requires resolved source posture, declared lockfile identity, and clean local-project source identity before editable hydration can be acquitting; missing lockfile or source identity remains narrowing evidence. Dograh [run 30165303012](https://github.com/bobaikato/dograh/actions/runs/30165303012) proves nested editable Pipecat hydration with its full declared extras, ordered `dev` group, manifest, lockfile, and Git source identities, plus bounded PostgreSQL/Redis lifecycle execution. Marimo [run 30165304206](https://github.com/bobaikato/marimo/actions/runs/30165304206) proves the different editable root-project plus `test`-group shape on Linux and macOS; it has no `uv.lock`, so Ota records manifest and Git source identities while correctly retaining narrowing replay evidence. Both matrices bootstrap exact Core `19509754` and retain platform-specific evidence artifacts. Dograh's Dev Container, unpinned Node validator install, and GitHub-service versus local-Compose divergence remain bounded. Marimo's frontend/pnpm, Playwright, Docker, release, and Windows lanes remain repo-owned outside its selected proof. - completed finite-command interaction pressure: omitted `tasks..command.interaction` resolves to `auto`, allowing terminal passthrough only for human native terminal execution. Explicit `forbidden` keeps every prepared closure step noninteractive, while `required` refuses before dependencies or workflow prepare/setup phases when the selected boundary cannot provide a terminal. Effective posture survives mode selection and orchestrator wrapping; dry-run JSON publishes the invocation-specific `terminal_passthrough`, `piped`, or `refused` resolution. Agent, captured, container, remote, and ordinary non-TTY CI execution do not acquire terminal capability. Workers SDK [run 30265519625](https://github.com/bobaikato/workers-sdk/actions/runs/30265519625) bootstraps Core `c5256d64f3060b30d40f07fa389b2bb16fc61b1f` and proves validation, Doctor, task discovery, dry-run JSON, non-TTY refusal before hydration, and agent refusal across Ubuntu, macOS, and Windows. Windows also proves a failed optional WSL shell probe cannot corrupt machine JSON. The real OAuth/account success remains intentionally external and not proved; the contract does not advertise container or remote execution for this terminal-auth lane. - completed replay-input identity hardening: optional task `replay_inputs[].expected_identity` pins validate canonical SHA-256 values, surface missing or mismatched artifacts through Doctor, block dry-run/run/up before task startup, and preserve expected plus observed identity in the receipt evaluated-input carrier. Bedrock pressure proves matching frozen inputs through Doctor, dry-run, and real native plus container agent-safe execution. - completed V11.20 policy-governed replay-input identity implementation: the shared `replay_input_policy` evaluator applies cumulative task/workflow rules over their exact selected closures, observes each task-qualified declared input once, and derives `deny > review > allow`. Doctor findings and JSON, dry-run, run, up, proof runtime, proof lifecycle, and admission-produced execution/refusal receipts reuse one command-scoped loaded policy snapshot and observed identity set across agent safety, claim assurance, replay policy, provisioning/effect findings, proof, CI projection, and receipt policy evidence. Runtime proof passes that same admitted authority to its detached child through a private temporary snapshot. Active policy load failures remain typed fail-closed admission evidence, and selected closures include recursive outcome hooks so a governed or mismatched hook cannot execute behind an admitted parent. Aggregate monorepo Doctor JSON retains the policy result for each selected member. Admission refuses before native provisioning, proof artifact creation, dependency hydration, service ownership, assertion execution, or task startup; unavailable observations and unreadable or mismatched declared pins fail closed, and hard-pin refusals retain the active policy evidence. Generic readiness receipts do not reconstruct policy after execution. Runtime proof evaluates its full selected proof closure, including seam observers and its selected negative control, before passing one preflight through every readiness diagnosis and the embedded Doctor artifact; lifecycle proof evaluates its exact prerequisite-plus-assertion closure before beginning a transaction. Missing pin coverage follows the rule's `on_insufficient`. Unknown selectors are contextual policy findings, not contract-validation errors. CI projection carries the exact active policy identity, applicable rule identities, canonical execution closure including recursive outcome hooks, and unresolved selector identities but no render-host observation; the provider checkout recomputes observed replay-input identities. Core unit, real-repo no-execution, JSON-schema, JSON-conformance, and projection checkout-re-evaluation regressions pass; copy-ready Core/external examples, canonical skill, and site reference are aligned. Bedrock [run 30413944121](https://github.com/bobaikato/bedrock/actions/runs/30413944121) proves strict matching admission for four declared frozen inputs through native and container execution. Kylrix [run 30413944203](https://github.com/bobaikato/kylrix/actions/runs/30413944203) preserves ordinary unpinned compatibility while its dedicated strict-policy lane refuses Doctor, dry-run, real `ota up`, receipt, and `doctor --fix` before setup outputs are created. Both bootstrap exact implementation Core `f97b96cc`; later Core `d0e77a95`, `ff35a910`, `2d0b20fc`, `c85af3d2`, `6aaa063e`, and `4729e042` reconcile release-gate fixtures, generated reference truth, and hermetic test tooling without changing runtime behavior. Core [Release Gate run 30452821989](https://github.com/ota-run/ota/actions/runs/30452821989) and [Ota Readiness run 30452822253](https://github.com/ota-run/ota/actions/runs/30452822253) are green at pushed candidate `6538cc07`; docs-quality, Smoke, CodeQL, and cargo-deny are green on the same source. Bedrock live recording/promotion, Kylrix long-running runtime surfaces, and undeclared ambient inputs remain outside this bounded policy proof. No new Ota platform gap was exposed. - next planned slice: V11.21 enforced sandbox policy application is unblocked but remains inactive until explicitly activated. No V11.21 implementation is part of the V11.20 completion batch. - completed V11.14 contract-claim assurance: the shared `claim_assurance` domain supplies the first additive `ota doctor --json` carrier for declared agent-safe tasks and workflow proof claims. It keeps maintainer declaration, derived V11.3 closure, policy-independent assurance, and policy decision separate; declaration plus closure remains `unknown` without non-self-origin evidence. Its first deterministic contradiction is a typed `reset_compose_service_volume` action that omits the exact `effects.adapter_state: compose_volume:` it mutates; opaque shell remains `unknown`. `ota proof runtime --json --archive` now creates a content-addressed proof-owned record bound to the terminal proof output, archived contract snapshot, clean source identity when available, resolved execution scope, and explicit witness-only replay posture. The shared proof-breadth evaluator consumes only a matching immutable archive: matching failed proof is cited as `contradicted`; missing, stale, source-mismatched, or scope-mismatched evidence remains `unknown`. Ota-owned `.ota` runtime state is excluded from the source-identity cleanliness check, so a fresh archive cannot invalidate its own proof claim. Opt-in `policies.agent.claim_assurance` requirements now drive the same canonical `deny` or `review` decision through Doctor, `ota run --agent`, previews, and `ota up --agent`; default agent admission remains unchanged without that policy requirement. Generic deterministic workflows without a declared dependency seam can opt into this same assurance through `workflows..proof.claim: bounded`; Doctor reports `bounded_proof` as `unknown` until a matching immutable archive exists, then `supported`. Bedrock proves that transition on its offline replay lane without inventing seam or negative-control evidence; Lead Quorum proves the independent `unknown` path without an archive. - committed finite command interaction capability (`6b2fa0ca`): structured `tasks..command.interaction` defaults to `auto`, so a native human TTY passes through only when available. Explicit `forbidden` preserves deterministic captured execution; `required` refuses before any selected task, workflow setup, or dependency work begins when no real terminal can be provided. Agent, container, remote, and ordinary non-TTY CI boundaries never acquire terminal interaction. The task JSON and dry-run JSON expose the resolved posture and invocation resolution; the copy-ready Wrangler OAuth example, canonical skill, public site contract reference, schemas, changelog, and regressions are aligned. - completed V11.18 managed lifecycle-sequence proof: committed lifecycle admission (`10a14971`) and the first bounded executor (`d70ca67e`, qualified by `dd3b02cd`). `ota proof lifecycle` selects only workflow-declared manager services, leases manager-observed inactive state before start, starts in dependency order, reuses transaction-owned services for an optional post-readiness assertion, and tears down in reverse order. Typed JSON/schema output binds each record to the transaction; a command-only start carries `service_started_state_not_proved`, alongside the mandatory application-output and broader-repo boundaries. Focused regressions cover pre-existing service preservation and assertion-failure teardown. Runner-owned finalization and a local content-addressed lifecycle archive landed in `af74ca4a`: the archive binds the semantic contract snapshot, selected workflow/service scope, transaction records, and terminal verdict. The command now shares selected-workflow agent admission, mode resolution for prerequisite/assertion tasks, and monorepo member loading; service-manager controls remain on their declared boundary. Archive scope and reader verification landed in `3607b6a7`; the current correction binds the resolved service closure/mode and contract/source identity, verifies archive filename plus snapshot staleness, and records typed interruption finalization with exactly-once teardown regressions. Multi-service dependency rollback now proves reverse, exactly-once finalization after a later start failure or interrupted later start; the matching local archive verifies the full closure, service records, transaction, and finalization binding. A runner-observed readiness interruption now emits a typed `interrupted` transition before the same finalizer runs. A stop-command failure retains typed transition evidence and does not prevent other leased services from finalizing; an interrupted teardown with unproved manager cleanup is explicitly `incomplete_after_interruption`. Focused local runner/archive/schema validation is complete; the lifecycle-lock correction is committed in `b3a018a7`. V11.18 does not reopen V11.15 provider-neutral or GitHub projection: lifecycle proof stays a local command with dedicated provider-owned pressure workflows until a later slice defines lifecycle-specific adapter semantics. **Pressure provenance correction:** the remote Flagr branch `bobai/flagr-v11.15-deployment-pressure` at `8881fbe` does not yet declare `workflows.integration.proof.lifecycle`; it cannot substantiate the recorded lifecycle archives. Treat those local records as implementation evidence only, not Flagr pressure proof. Open WebUI now provides the Compose pressure side: its pinned `5ac1388784` matrix and lifecycle-control run prove declared Docker health probes as `service_readiness`, successful lifecycle finalization, and a controlled assertion failure without copied shell cleanup. Caddy closes the isolated lifecycle boundary locally: its current-Core archived container proof `sha256:8cb602aa552d653c3a5d3e465e934b7ed773b8305235aa7bf1775c274c65a27e` runs the upstream structured `caddy start` / `caddy stop` commands inside one transaction-bound ephemeral session and attests only engine-confirmed session removal as `boundary_terminated`. It explicitly retains `service_started_state_not_proved`, `application_output_not_proved`, and `broader_repo_completion_not_proved`; it never claims `manager_inactive` or host process absence. Caddy matrix [30102633474](https://github.com/bobaikato/caddy/actions/runs/30102633474) is green for regenerated native and container governance lanes against committed Core `6025187b`, but it does not invoke `ota proof lifecycle`; it is not isolated-boundary pressure proof. The dedicated hosted lifecycle run [30111427705](https://github.com/bobaikato/caddy/actions/runs/30111427705) is green against Core `3ffaf362` and binds the exact runner-owned boundary identity. The final hardened rerun [30124528078](https://github.com/bobaikato/caddy/actions/runs/30124528078) is green against Core `53ff07eb`, emits qualified proof, and archives `sha256:8985f57cd191e4d1db370122a6adb33a5f3a3fc649a289b2855dd2b48894de39` with exact session `container:docker:ota-ephemeral-43c71044194b0e05`. The final setup-failure correction passed [30125996749](https://github.com/bobaikato/caddy/actions/runs/30125996749) against Core `fc88d215`, emitting archive `sha256:c2dab2e7535589819f416159ca06b5384d599093e87546cc1aab1b242d8e3235` with exact session `container:docker:ota-ephemeral-3890811a19b2944d`. Open WebUI supplies the independent Compose readiness/teardown family. V11.18 is complete: implementation, pressure evidence, and final independent review passed with no release blockers. - completed V11.16 fresh-boundary setup proof: `ota proof runtime --json` and archived runtime proofs carry a content-addressed `execution_boundary` graph. Native `ensure_virtualenv` plus a runner-recorded `.venv/bin/*` consumer, and frozen native pnpm hydration plus a declared local consumer, carry runner-attested precondition, producer, and `asserted_at` identities before deriving `cold_start_verified` or `persistent_state_reused`. The pnpm carrier binds its generated `node_modules/.modules.yaml` layout marker to the declared lockfile rather than claiming whole-tree hashing. The evaluator canonicalizes graph identity and rejects ambiguous, forged, stale, cross-scope, or causally mismatched edges before proof JSON or archives emit. Lead Quorum run `29742813235` proves fresh and reused virtualenv evidence; OrchardCore run `29697072972` proves an ephemeral typed .NET container closure; Athena run `29786128386` proves container Bundler fulfillment while retaining PostgreSQL lifecycle/output boundaries; and Kylrix run `29828933200` closes the native pnpm carrier with absent `node_modules`, a `setup` producer, a matching local `dev` assertion, and `cold_start_verified`. Provider state, databases, services, volumes, general container filesystem state, Windows virtualenvs, and uninstrumented package layouts remain `unknown`; V11.16 does not claim repo-global cold-start proof. - completed V11.15 managed CI projection: `ota ci projection --workflow --mode --target-os --json` now emits the provider-neutral governance lane with a semantic identity, merge-check identities, proof requirement, and provider-neutral ownership categories. The GitHub adapter consumes that object through one renderer powering `ota ci github render`, `check`, and atomic `sync`. It emits separate projection, render, and parsed-caller binding identities; generated content runs validation, doctor, safe discovery, agent dry-run, execution, receipt archival, and a declared runtime proof when the selected workflow owns one. Agent-safe lanes retain `--agent`; proof claims do not bypass agent admission, and proof-required lanes use one authoritative execution. Each unique contract refusal canary is now emitted as its own provider check with a stable `merge_check_id`; the GitHub adapter publishes the scope-qualified provider-check mapping so native/container and OS lanes stay independently requireable. The generated check invokes Ota's `--expect-refusal` runner boundary directly. Projection also carries selected-closure, provider-neutral `toolchains[]`; the GitHub adapter renders Go setup from the contract through an immutable Action revision and refuses unsupported required sources rather than relying on an ambient hosted-runner toolchain. Aggregate execution-mode admission now uses the same concrete member-closure rule as projection and task discovery, preventing a valid container projection from later failing before aggregate members run. Kylrix renders valid distinct native and container reusable lanes without collapsing its separately selected `sqlite-dev` runtime proof into `verify`; its committed caller/matrix preserves the existing native/container evidence. NopCommerce independently proves generated .NET verification on both native and container lanes: the native lane projects the declared .NET 10 toolchain through an immutable `actions/setup-dotnet` revision, while the container lane uses only the declared SDK image. Both lanes bootstrap Ota from the pressure contract, verify their projection identity, run the agent-admitted workflow closure, and archive a receipt in GitHub run `29686807594`. Strict V11.14 agent and proof assurance admission is evaluated before projection render/check; denied or review-required lanes return their canonical refusal rather than generating a green wrapper. Outline then exposed a projection/runner mismatch: a safe run task could be admitted while an unsafe setup phase was later refused by `ota up --agent`. Projection now shares the runner's ordered prepare/setup/run/attach admission roots, and Outline's unchanged `checks` workflow returns the same inspectable `requested_task_not_safe` refusal from projection and render. A clean Flagr deployment pressure clone then exposed a second renderer defect: finite workflows used readiness-only `ota up` as their only generated execution step. Projection now binds `run_execution` as `finite_task` or `service_runtime`; finite lanes retain a dry-run `ota up` admission preview, then execute their selected closure directly through `ota run --agent`. Compatible ephemeral container closure steps now share one runner-owned session, so typed hydration state survives into its finite consumer without leaking across CLI invocations. OrchardCore proves that .NET restore/build/test path locally in both native and container modes; its tag-triggered release CI remains provider-owned and untouched. Its pushed matrix and Caddy's independent green native/container governance matrix now satisfy the two-repository pressure target. Caddy also hardened the GitHub adapter's Go lower-bound projection: a valid one-sided contract range such as `>=1.25.1` now renders its explicit lower release through immutable `actions/setup-go`. Caddy's upstream start/stop shell smoke remains separately modeled and explicitly outside the generated build/test lane; Ota must not call that narrower lane full upstream CI equivalence until it can recover the lifecycle assertion without reducing it to a command-shaped approximation. The final V11.15 review passed focused neutral projection, GitHub renderer, JSON-conformance, and formatting checks; Kylrix plus OrchardCore/Caddy satisfy the two-repository pressure bar. V11.15 is complete. Projection identity now reuses the canonical normalized semantic snapshot identity used by receipts; omitted mode resolves from the selected task's effective contract default, while an unavailable explicit mode is refused. Denied provider-neutral JSON preserves the evaluated projection and typed refusal. Managed workflow paths reject symlink escape, and the neutral projection carries bootstrap posture, proof claim, and target-OS identity for the first GitHub adapter. - V11.3 refusal-canary implementation is pressure-proven on Athena and Kylrix: `agent.refusal_canaries` names one task or workflow negative control, and `ota run --agent --expect-refusal ` or `ota up --agent --expect-refusal --workflow ` passes only when the agent-safety closure refuses before selected work begins. A policy-only denial is the failing `wrong_refusal_boundary` outcome. The contract never supplies an expected reason; Ota emits the runner-derived refusal and blocked receipt for later comparison. First-party docs/site/skill are aligned; do not add it to released examples until `v1.6.25` is available. - completed `V11.10` replay trust refinement: `ota up --replay-baseline ... --json` now carries replay-authored baseline posture directly through `replay.baseline.last_known_good`, while declared static replay inputs remain receipt `evaluated_inputs[]` and Bedrock-style historical query traces stay separate as attested `witnessed_observations.query_traces[]`; plain-text replay output now mirrors the same trust split by rendering matched acquitting, narrowing, and pointer-only evidence separately from changed inputs, and hermeticity now requires at least one matched material runtime, dependency-resolution, or presentation anchor rather than over-reading same-contract reruns as hermetic; hidden-input replay failure now emits ordered `hidden_input_candidates` so operators can promote the next likely ambient class instead of reading one generic suspicion bucket - completed V11.12 typed hydration provenance across two ecosystems: successful `ota up --json` records selected structured hydration lanes through typed `receipt.evaluated_inputs[]` hydration records. The record captures contract-declared source posture and runner-resolved feed identity before execution, preserving explicit `resolution: unavailable` when source choice remains ambient. Azure SDK for .NET proves config-backed NuGet identity; Lead Quorum proves explicit uv PyPI index posture across native and container lanes on Ubuntu, macOS, and Windows. Ota projects uv index truth through flags supported by both older and current uv releases. Replay treats unavailable hydration resolution as narrowing evidence, never as a hermetic dependency-resolution anchor. - completed V11.9 governance reconciliation: Athena exposed a preview that named `not_run_reason: preflight_refusal` while reporting `refusal_occurred: false`. The canonical preview now carries the same refusal record, reason, and basis in both phases while preserving post-execution `state: not_run` because no execution began. - completed V11.11 proof-boundary and seam-control carrier: `ota proof runtime --json` publishes qualified proof verdicts, scoped `not_proved` boundaries, provenance-aware seam evidence, and canonical negative-control records. Athena's Rails/PostgreSQL lane proves transaction-bound marker recovery and same-obligation fault control across its green matrix. Every marker-bound seam retains `dependency_output_shaping_not_proved`; invariant coverage proves the pairing and derived control projection. Generic `ota up` and ordinary receipts intentionally do not inherit this evidence because they did not execute the proof lane. The canonical runtime-proof example now demonstrates the same carrier end to end. Compose dependencies started by proof are cleaned on success and readiness failure, while services already running before proof are preserved. - completed V11.13 generated-artifact lineage: Dagger proves the generator path and EventCatalog proves an independent sibling-consumer closure. Contract-owned producer, output-path, and input lineage is validated, surfaced in task discovery, checked before consumer execution, and carried into receipts as pointer-only evidence without claiming freshness. - completed the 1.6.24 release-readiness sweep: the active pressure set has no unresolved Ota platform gap, V11.11 proof evidence is propagated through the canonical and public examples, skill guidance, site reference, generated contract schema, and changelog, and the complete native `release-gate` passes. Lead Quorum's newest local-only pressure commit remains unpushed and is not part of the matrix-backed release claim. - V11.10 Bedrock replay proves native baseline replay as `replay_verified` and `partly_ambient`. A container replay against that native archive correctly returns `replay_unavailable` with `baseline_scope_mismatch`: workflow, backend, provider, remote target, and lifecycle identity are required for `last_known_good`. A freshly archived container witness then replays as `replay_verified` and `partly_ambient` on the same container/ephemeral scope. Backend-scoped informational doctor notes remain visible but do not stale an otherwise same-scope witness. ## Recent Completed Slice - Kylrix pressure exposed two connected Ota execution gaps and proved their fixes on the deterministic SQLite contributor lane. `launch.runtime_projection.adapter: nextjs` now projects `--hostname` / `--port` from the runtime listener into direct `next dev` launches, while validation rejects package-script wrappers that would make projection ambiguous. Dry-run input resolution now recognizes `ensure_env_file` output from the selected dependency closure as planned setup state on a clean checkout, while real execution waits for dependencies and then validates the rendered dotenv input. Published contract-schema coverage was synchronized for command runtime projection and already-shipped generated workflow-instance fields; the full examples gate now passes. Kylrix itself proves idempotent SQLite env materialization, agent-safe Vitest/lint/build verification, workflow preparation, archived receipt, and isolated native runtime proof. Its interactive Appwrite topology and credential/schema-provisioning paths remain explicitly outside this narrow proof. - Kylrix also exposed a native long-running task UX gap: applications such as Next.js can exit non-zero after a user `Ctrl+C`. Explicit runner interruption evidence, or a raw signal before a clean completion, returns canonical exit `130` with an `interrupted` receipt and summary. A late raw signal cannot overwrite an already-established non-interrupt task or service failure. - Dagger generated-SDK pressure exposed and fixed native source-managed tool activation: a release-asset tool was fulfilled and version-probed correctly, but the native shell task path discarded the managed PATH before executing its command. Ota now applies the resolved PATH to native shell execution and has a focused regression test. The narrowed Dagger contract proves release-asset fulfillment, workflow preparation, selected generator execution, generated-source lineage, a clean consumer diff, scoped doctor, and archived receipt locally. The selected closure requires Dagger v0.21.7 despite root `dagger.json` still naming v0.21.0; that is recorded as repo truth rather than hidden by the pressure contract. - Task platform availability is now contract-owned. `tasks..only_on` uses the same `linux` / `macos` / `windows` vocabulary as prerequisite and context scope; runner planning, `ota run`, and dry-run preview refuse an unsupported dependency closure before side effects. `ota tasks --use` marks context- or task-unavailable modes non-callable, and doctor filters unavailable closures before probing their requirements. Athena pressure uses this truth through its Linux/macOS Ruby context and proves the expected Windows refusal rather than hiding it with a workflow skip. - The current V11.10 refinement adds contract-owned `tasks..witnessed_observations.query_traces[]` for existing JSONL query traces. Ota validates immutable repo-relative trace paths, captures the selected closure before execution, and emits source identity, full run records, and divergent-subject summary under receipt `witnessed_observations`. It deliberately keeps the trace outside `evaluated_inputs[]` so historical observed behavior cannot be over-read as a current-run decision input. Bedrock's recorded SQL trace proves the narrow admission: three subjects diverge while stable repeated queries retain one identity across runs. - The completed `V11.13` core cut makes generated source a named repo-scoped contract artifact: `artifacts.` declares `kind: generated_source`, one producer task, output paths, and optional source inputs; consumers declare `requires_artifacts` and directly depend on the producer. Validation rejects dangling, overlapping, and dependency-disconnected lineage. The runner checks declared outputs after the producer closure and before consumers execute. Task JSON carries the producer map plus consumer references, and receipt `evaluated_inputs[]` captures producer/path/input lineage at issue time as pointer-only evidence, never as a freshness claim. - EventCatalog pressure proved the first healthy generator and sibling-package consumer closure: typed `pnpm --filter @eventcatalog/language-server install`, Langium generation, and the downstream VS Code extension build. It also widened `prepare.source.filter` from its old browser-bootstrap-only boundary into a pnpm-owned dependency-hydration selector. The first sibling build failure identified real missing SDK and visualiser build dependencies; modeling those finite tasks made the final extension build pass without shell orchestration. - Bedrock pressure proved the V11.10 replay-artifact shape on a deterministic offline NL-to-SQL stability harness across Ubuntu, macOS, and Windows: explicit script-test aggregation, committed SQL fixture replay, and the defended baseline gate all run in agent mode with no model key. Its live recording lane remains intentionally outside that claim because it reaches Claude, rewrites the fixture, and depends on an unpinned generic-pip requirements path that Ota does not yet own through typed dependency hydration. - The completed V11.10 replay carrier distinguishes whether the selected baseline is still the last known good witness. `ota up --replay-baseline ... --json` adds `replay.baseline.last_known_good` with `replay_verified`, `stale_witness`, or `unavailable` derived from the replay result itself, so promoted archives no longer all read as equally current after drift or unavailable-baseline failures. - V11.10 also names active execution governance as a replay-grade input. Receipts now capture a loaded org policy pack as `policy_ruleset_identity`, and replay treats a changed ruleset as named input drift rather than generic hidden-input suspicion. - V11.10 also names declared env-source files when the selected lane actually resolved from them. Receipts capture `env_source_identity` without recording values, so replay can distinguish declared env-source drift from still-ambient process or policy env. - The completed task-discovery UX batch renders closure-aware `Human Run`, `Agent Run`, and `Agent Policy` sections in `ota tasks` and `ota tasks --use`. It keeps the `ota-site` internal verification setup task agent-callable so its declared-safe public verification closures remain truthful without exposing setup in the default task inventory. Task mode rows now use stable `Container`, `Native`, then `Remote` presentation, show unsupported local planes explicitly, and recover native override support for container-context tasks without requiring a redundant task mode branch. `ota tasks --json` now carries the same canonical per-mode truth under `tasks[].use.modes[]`, while the existing `use.human` and `use.agent` remain selected-mode compatibility projections. - Flagr pressure confirmed native and container Go module hydration, binary build, aggregate verification, and runtime proof. It also closed two task-discovery regressions: aggregate mode rows now inherit executable closure support, and Doctor no longer version-probes repo-owned command paths before their producer task exists. The previously open locally tagged Dockerfile image-build gap is now closed by first-class `action.kind: build_container_image`: contracts own the provider, Dockerfile, repo-relative context, and local tag without raw `docker build` glue. Lead Quorum proves the direct image build; Flagr carries the equivalent integration-image task, with its live build awaiting a healthy Docker daemon on the pressure host. - `V11.11` contract-derived proof boundaries is implemented in Ota commit `e3bbdf02`. `ota proof runtime --json` now emits terminal `proof_verdict`, and Lead Quorum pressure proved `passed_with_unproven_boundaries` on the app lane across Ubuntu and macOS. - V11.11 keeps that qualified proof boundary visible in human output too: `ota proof runtime` now renders concrete `Proof Boundaries` entries whenever `not_proved[]` exists, so external-network and broader-scope exclusions travel with the green proof instead of living only in JSON. - V11.11 makes those proof boundaries machine-actionable too: each `not_proved` entry now carries an explicit `reason`, and the human proof render includes the same reason label for seam, adjacent-lane, and broader-scope exclusions. - The completed V11.11 seam-evidence carrier on `ota proof runtime --json`: `dependency_evidence[]` now publishes runner-derived `level: reachable` only for declared service seams that are also on the selected workflow-owned required-service path and have structured readiness Ota actually owns. This keeps selected service reachability distinct from still-unproved exercised interaction. - V11.11 keeps caller-side seam attempts separate from proved reachability: proof-derived DNS, auth, and loopback service failure signals can now publish additive `interaction_attempted: true` with `observation.origin: caller_side`, while the paired `dependency_exercise_not_proved` boundary tightens to `caller_side_only_evidence` instead of generic missing evidence. - The same commit fixes detached native proof lifecycle ownership: nested `ota up --detach` leaves the service running for the outer proof to observe and clean up, preventing recursive teardown. - V11.10 emits a runner-derived receipt-comparison artifact-trust record for matching semantic contract snapshots. It is `acquitting` for `contract_truth` only; lockfile/runtime artifact capture remains the next implementation cut. - V11.10 captures declared lockfile-strict Node identity in `receipt.evaluated_inputs[]` at receipt authoring time: `pnpm-lock.yaml` for frozen pnpm and `package-lock.json` or authoritative `npm-shrinkwrap.json` for `npm ci`. It carries this through archived baseline and current receipt diff and labels only matching `declared_dependency_resolution` identity as `acquitting`. Directus and ota-site proved matching archived/current paths with the source-built binary; unrelated runtime findings remain separate. - Lead Quorum is not yet the first hermetic replay target: its typed `uv pip_requirements` lane and Python range are real current repo truth, but not the pinned dependency/runtime pair V11.10 needs. Treat that as a repo contract/replay-readiness gap, not a reason to weaken Ota evidence. - V11.10 captures `runtime:node` through contract-local `node --version` on the same typed lockfile-strict Node hydration path. It is deliberately `narrowing` for `selected_runtime_version`, not an executable/image-digest acquittal. - V11.10 adds the first immutable runtime-artifact carrier. Receipts recover literal digest-pinned Compose `image` values only for explicitly selected services in explicitly declared files and their declared Compose `depends_on` closure as `selected_runtime_artifact`; receipt diff treats a matching digest as `acquitting` only for that named artifact. Mutable tags, interpolation, inferred files, and unrelated stack services remain outside the claim. Immich pressure also exposed and fixed an Ota runner gap: Compose adapter-file preflight now resolves files relative to the same adapter `cwd` used by execution. The narrow Redis/PostgreSQL launch, status, and stop path passed locally with the source-built binary. - Immich and Grafana confirmed the follow-on taxonomy need. `effects.network_kind: container_image_hydration` now owns registry-backed Compose image acquisition independently from package dependency hydration; `prepare.medium: container_images` requires this label, doctor and policy packs expose the same lane, and immutable image receipt evidence remains separate from the effect declaration. - The same branch upgraded the direct `quick-xml` dependency to `0.41.0` after `cargo deny` surfaced the two XML denial-of-service advisories in `0.38.4`; the NuGet feed-provenance parser uses the current XML 1.0 attribute-normalization API and its focused tests pass. - Grafana confirmed the receipt carrier on a mixed Compose stack with locally built, mutable, and digest-pinned services. The selected observability lane records four explicit digest-pinned services plus `tempo-init` through Tempo's declared `depends_on` closure, while excluding unrelated built and mutable stack services. This exposed and fixed the closure-recovery gap in Ota rather than leaving the init image absent from a selected runtime receipt. - The same Grafana pass exposed and fixed a doctor semver gap: whitespace-separated compound ranges such as `>=1.26.3 <1.27` now use the canonical normalized semver path while preserving Ota's established shorthand comparator behavior. ## Handoff To The Next Chat Start by reading `AGENTS.md`, this file, the canonical Ota skill, and `docs/planning/v11.20/plan.md`. Then inspect the actual worktree state in Core, `ota-site`, `ota-run/examples`, and `/Users/bobai/Workspace/Ota.run/skills` before editing. V11.20 is implemented and pressure-proven within the boundaries recorded above. Bedrock proves strict matching admission across native and container replay; Kylrix proves ordinary unpinned compatibility and strict refusal before setup mutation. Neither matrix proves undeclared ambient inputs, long-running Kylrix runtime behavior, or repo-global readiness. The remaining release work is reconciliation, not product widening: commit and push the first-party alignment batch, rerun Core plus connected first-party workflows from the exact contract-owned candidate source, and cut `v1.6.25` only after those checks are green. Do not activate V11.21 until the V11.20 release is complete. After release, replace unreleased `git_rev` bootstrap pins with `version: v1.6.25` where released proof is intended. ## Working Rules - Read the canonical Ota skill before Ota-specific work. - Use `references/pressure-testing-protocol.md` for every pressure pass. - Make and record the connected-surface decision for core docs, examples, skills, and site. - Use released Ota versions for released proof; use the active branch only for explicit unreleased pressure testing.