OpenAdapt Files

The shared contracts are back in openadapt-types, which depends only on Pydantic; this package requires openadapt-types>=0.24.0,<0.25.0, and openadapt_flow.contracts returns the same modules as openadapt_types (#1270).

Features

• Offline Seals can be signed with a key the customer holds: a key file, the OS keychain, or a PKCS#11 token. local-seal key creates, pins and revokes keys, and a configured key that can't be used signs nothing (#1392).
• local-seal anchor records an offline Seal in Sigstore Rekor. Only a digest, the Seal key's public key and a signature leave the machine, and local-seal verify --require-anchor checks the stored inclusion proof offline (#1394).
• Run authorizations (openadapt.run-authorization/v1) are signed with the SSH key a person publishes on GitHub. local-seal authorize sign shows what is being authorized before it signs, verification runs offline, and --live re-reads the person's keys from GitHub. local-seal run --authorization seals only the items, profile and Seal keys the statement covers (#1401).
• local-seal timestamp adds an RFC 3161 timestamp from Sigstore's TSA (or --tsa-url) to a Seal or a run authorization, and verify --require-timestamp checks it offline against the bundled TSA root (#1401).
• local-seal profile writes an operator profile per Seal key: outcome counts, apps, programs and log times from anchored Seals, with no patient data. A report sealed again counts once (#1401, #1416).
• Session tokens, credential headers and bearer tokens are redacted from run reports before they are written, so no Seal covers them. The Seal refuses an unredacted report, and openadapt-flow redact-report cleans runs written earlier (#1407).
• The compiler groups every program into named sections (sections.json) from the consequential write, the recorded form structure and the fields, with no model call (#1405). openadapt_flow.visualize projects a bundle into the program map that Desktop and openadapt.ai render (#1387).
• openadapt-flow compile-agent compiles an agent's first verified run into a program that replays with zero model calls, on browser, Windows, macOS, Linux, RDP and Citrix apps, with a code-as-action agent for run 1 (#1277, #1283, #1305, #1303).
• Every teach path (JIT capture, compile-agent, teach over MCP and the guard) runs under the task's declared inputs, origins and writes, and a violation leaves no draft (#1359, #1386). An approval shows who asked for a save, the agent's own reason, the screen text it saw, and any of it that reads like an instruction to an agent (#1359).
• The MCP server can teach a workflow and then call it with no model calls (#1335), keeps a task ledger and can ask the user (#1332), and pins authoring to the app a deployment file names (#1287).
• A guarded save wraps any agent's write: check the record, hold for approval, read back (#1258). A CDP commit guard covers an agent you already run (#1357).
• JIT: a person names the record check's idempotency key at confirm_params (#1339); a retyped input is lifted from the saved record, and distill drops a corrected save (#1336).
• API steps: a clean save in a recording's network capture compiles into an API step with the same record check, and falls back to page structure before anything is sent when the API is unavailable (#1269). API steps run in durable runs without ever resending a save (#1358), under governed runs and the Standard and Regulated profiles (#1361), and under per-item approval of the exact request (#1355); the read-back is pipelined (#1362).
• Self-repair: a halted run can be repaired under one person's approval (#1265), including with a short bridge of up to three new steps (#1325); repairs a person approved in advance apply as standard changes (#1294); and every stop that wrote nothing is repaired by default (#1360).
• After a stop: a change ledger, a write-ordering lint and declared undo steps (#1263). openadapt-flow undo propose proposes an undo for each save and keeps it only if a test copy shows every record restored; a person approves it once with undo accept (#1346).
• Record checks: scaffold-verifier builds a working check from the reads the app made while the person viewed the saved record (#1284); the recording teaches the check when the person looks the record up after saving (#1290); a desktop, RDP or Citrix save is checked by looking the record up in a separate read-only session (#1280), with a fresh session for desktop relaunch and a second RDP session (#1241); a check level per save, a learned reopen, a read-only guard and reference capture (#1239).
• A save confirmed by a later report or acknowledgment is SAVED_AWAITING_CHECK and never counts as done until then (#1297). The receipt keeps the server's own answer to a save, labelled same_screen (#1298), and signs checked_how (#1240). verify-run treats a changed non-target record as collateral, not only a vanished one (#1375).
• Identity: extra looks before stopping on a look-alike record ID (fresh frames, the known-ID list, a select-and-copy of the ID) (#1333); a hover check on icon-only targets and a fresh-frame re-check right before every pixel click (#1334); one re-observation before halting on an identity mismatch (#1293).
• Learning from many runs: shadow-mined episodes become candidate drafts, and a program admitted once stops only on problems (#1212); induce --probe-on settles a disagreement between recordings on a browser, desktop or remote test copy (#1276); a deterministic router sends each item to the right admitted variant (#1264); narration proposes branch rules that recordings, a probe or a person certify (#1291); common local edits are classified from the recording on strict evidence (#1366).
• One program switches tabs, popups and backends mid-run (#1197); lists and worktables are walked with focus and modal checks before each copy (#1253); worklists run in parallel with one session per worker (#1296).
• Records: READ is a workflow step (#1229), with a record and field schema (#1214), an interchange format (#1215), one read channel by default with an opt-in double read (#1218), a review queue with signed, write-once decisions (#1219), and export to CSV, DB-API databases and webhooks (#1220).
• Everything that leaves the machine is scrubbed by default (#1262), and every PHI file is encrypted at rest under one sealed index (#1354).
• The phone approval shows the values a save writes (#1257).
• A qualification project can bind to the generic web environment observer (observe_web_environment), whose digest is the one a governed browser run on the same machine observes (#1353).
• A compatibility matrix, checked against the runtime in CI (#1364).
• Harness²: a benchmark adapter scored by read-back, GUI rollouts on pixel-only surfaces, and a Meta-Harness-style trace export (#1299, #1301, #1300, #1304).

Performance

• Apple Vision identity reads match RapidOCR on the dense surface (#1228).

Fixes

• In a governed run, an armed step whose identity is unreadable halts before acting, whether or not the authorization lists it (#1397).
• A scroll skipped because its target was already in view verifies instead of counting as undelivered (#1395).
• Bundles certified by earlier releases load and keep their workflow contract hash: an effect's forbid_collateral_change is serialized only when it is on (#1406).
• A bad local-seal input (missing, empty, not JSON, repeated keys, the wrong shape, or a saved web page) fails in one clear line with exit 2, never a traceback (#1401).
• Next-step hints repeat the uvx form when Flow runs from a uvx environment, so they reach the same version (#1404).
• API steps: secrets and tokens in JSON bodies and headers are withheld from network capture (#1367); fields bind by the step that typed them, not by equal values (#1368); record identifiers in URLs stay run parameters (#1369); a step whose span also wrote is refused (#1370); native form validation is enforced (#1371); an API step binds to the complete definition of the steps it replaces (#1372).
• A relabelled Save halts on the Save, not on the scroll before it (#1337); a self-closing popup click counts as delivered only when the step expects it (#1321).
• Pixel-path replays keep running across display scaling and ClearType (#1286); emit, serve-execute, bench and resume no longer assume a browser (#1285).
• The durable authority database is created owner-only before SQLite opens it (#1363).
• The agent CLI help states the approval-mode default and the agent approval tools (#1238).