<!--
                █████
               ░░███
       ██████  ███████    ██████
      ███░░███░░░███░    ░░░░░███
     ░███ ░███  ░███      ███████
     ░███ ░███  ░███ ███ ███░░███
     ░░██████   ░░█████ ░░████████
      ░░░░░░     ░░░░░   ░░░░░░░░

   Copyright (C) 2026 — 2026, Ota. All Rights Reserved.

   DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

   Licensed under the Apache License, Version 2.0. See LICENSE for the full license text.
   You may not use this file except in compliance with that License.
   Unless required by applicable law or agreed to in writing, software distributed under the
   License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
   either express or implied. See the License for the specific language governing permissions
   and limitations under the License.

   If you need additional information or have any questions, please email: os@ota.run
-->

# V5 Plan

Status: complete (started 2026-03-24, completed 2026-03-26).

Source direction:
- `/Users/bobai/Desktop/ota.run/Spec/New/10-v5-spec.md`
- `/Users/bobai/Desktop/ota.run/Spec/New/ACTIVE_VERSION.md`
- [Policy pack model](../../spec/policy-packs.md)
- [Conventions and templates](../../spec/conventions-and-templates.md)
- [Audit and provenance](../../spec/audit-and-provenance.md)
- [Remote runner metadata and editor surface](../../spec/remote-runner-and-editor-surface.md)
- [Mutation controls and caching](../../spec/mutation-controls-and-caching.md)

V5 theme:

- organizations
- governance
- standardization at scale

## Included capabilities

- policy packs applied across repos in an org
- org-level conventions and templates
- signed config and provenance options
- team-level templates
- audit-friendly machine output
- remote runner metadata standard
- editor/IDE integration spec
- advanced caching
- enterprise-safe mutation controls

## Priorities

1. Make ota viable for organizations that need consistent standards across many repos
2. Enable platform teams to define and enforce policy once
3. Provide audit trails that stay useful under review and compliance pressure
4. Stabilize the editor integration surface for IDE adoption

## Execution slices

1. Policy pack model
- define an org-level policy contract that applies across repos
- keep policy evaluation deterministic and explicit
- align the target contract to `docs/spec/policy-packs.md`

2. Conventions and templates
- standardize shared repo templates and org conventions
- keep template application auditable and non-magical
- align the target contract to `docs/spec/conventions-and-templates.md`

3. Audit and provenance
- make machine output suitable for auditing and traceability
- surface signed config/provenance in a stable way
- align the target contract to `docs/spec/audit-and-provenance.md`

4. Remote runner and editor surface
- standardize remote runner metadata
- keep editor/IDE integrations on the documented contract surface
- align the target contract to `docs/spec/remote-runner-and-editor-surface.md`

5. Mutation controls and caching
- keep mutation paths explicit and enterprise-safe
- use caching only where it preserves determinism and trust

## Current progress

- policy-pack read path implemented in `ota doctor` for `.ota/org-policy.yaml`
- malformed policy packs now surface as doctor findings
- policy-required sections and required files now surface as doctor findings when missing from `ota.yaml` or the repo root

## Success criteria

- a platform team can define a policy pack that applies consistently across many repos
- audit logs remain useful for review and compliance use cases
- editor integrations can discover tasks and readiness without custom reverse-engineering
- signed `ota.yaml` is a viable option for security-sensitive environments