abrichr · Oct 20, 2026 · Oct 20, 2026
@@ -15,6 +15,56 @@
 
 <!-- version list -->
 
+## v2.3.0 (2026-10-20)
+
+The shared contracts are back in `openadapt-types`, which depends only on Pydantic; this package requires `openadapt-types>=0.24.0,<0.25.0`, and `openadapt_flow.contracts` returns the same modules as `openadapt_types` ([#1270](https://github.com/OpenAdaptAI/OpenAdapt/pull/1270)).
+
+### Features
+
+- Offline Seals can be signed with a key the customer holds: a key file, the OS keychain, or a PKCS#11 token. `local-seal key` creates, pins and revokes keys, and a configured key that can't be used signs nothing ([#1392](https://github.com/OpenAdaptAI/OpenAdapt/pull/1392)).
+- `local-seal anchor` records an offline Seal in Sigstore Rekor. Only a digest, the Seal key's public key and a signature leave the machine, and `local-seal verify --require-anchor` checks the stored inclusion proof offline ([#1394](https://github.com/OpenAdaptAI/OpenAdapt/pull/1394)).
+- Run authorizations (`openadapt.run-authorization/v1`) are signed with the SSH key a person publishes on GitHub. `local-seal authorize sign` shows what is being authorized before it signs, verification runs offline, and `--live` re-reads the person's keys from GitHub. `local-seal run --authorization` seals only the items, profile and Seal keys the statement covers ([#1401](https://github.com/OpenAdaptAI/OpenAdapt/pull/1401)).
+- `local-seal timestamp` adds an RFC 3161 timestamp from Sigstore's TSA (or `--tsa-url`) to a Seal or a run authorization, and `verify --require-timestamp` checks it offline against the bundled TSA root ([#1401](https://github.com/OpenAdaptAI/OpenAdapt/pull/1401)).
+- `local-seal profile` writes an operator profile per Seal key: outcome counts, apps, programs and log times from anchored Seals, with no patient data. A report sealed again counts once ([#1401](https://github.com/OpenAdaptAI/OpenAdapt/pull/1401), [#1416](https://github.com/OpenAdaptAI/OpenAdapt/pull/1416)).
+- Session tokens, credential headers and bearer tokens are redacted from run reports before they are written, so no Seal covers them. The Seal refuses an unredacted report, and `openadapt-flow redact-report` cleans runs written earlier ([#1407](https://github.com/OpenAdaptAI/OpenAdapt/pull/1407)).
+- The compiler groups every program into named sections (`sections.json`) from the consequential write, the recorded form structure and the fields, with no model call ([#1405](https://github.com/OpenAdaptAI/OpenAdapt/pull/1405)). `openadapt_flow.visualize` projects a bundle into the program map that Desktop and openadapt.ai render ([#1387](https://github.com/OpenAdaptAI/OpenAdapt/pull/1387)).
+- `openadapt-flow compile-agent` compiles an agent's first verified run into a program that replays with zero model calls, on browser, Windows, macOS, Linux, RDP and Citrix apps, with a code-as-action agent for run 1 ([#1277](https://github.com/OpenAdaptAI/OpenAdapt/pull/1277), [#1283](https://github.com/OpenAdaptAI/OpenAdapt/pull/1283), [#1305](https://github.com/OpenAdaptAI/OpenAdapt/pull/1305), [#1303](https://github.com/OpenAdaptAI/OpenAdapt/pull/1303)).
+- Every teach path (JIT capture, compile-agent, teach over MCP and the guard) runs under the task's declared inputs, origins and writes, and a violation leaves no draft ([#1359](https://github.com/OpenAdaptAI/OpenAdapt/pull/1359), [#1386](https://github.com/OpenAdaptAI/OpenAdapt/pull/1386)). An approval shows who asked for a save, the agent's own reason, the screen text it saw, and any of it that reads like an instruction to an agent ([#1359](https://github.com/OpenAdaptAI/OpenAdapt/pull/1359)).
+- The MCP server can teach a workflow and then call it with no model calls ([#1335](https://github.com/OpenAdaptAI/OpenAdapt/pull/1335)), keeps a task ledger and can ask the user ([#1332](https://github.com/OpenAdaptAI/OpenAdapt/pull/1332)), and pins authoring to the app a deployment file names ([#1287](https://github.com/OpenAdaptAI/OpenAdapt/pull/1287)).
+- A guarded save wraps any agent's write: check the record, hold for approval, read back ([#1258](https://github.com/OpenAdaptAI/OpenAdapt/pull/1258)). A CDP commit guard covers an agent you already run ([#1357](https://github.com/OpenAdaptAI/OpenAdapt/pull/1357)).
+- JIT: a person names the record check's idempotency key at `confirm_params` ([#1339](https://github.com/OpenAdaptAI/OpenAdapt/pull/1339)); a retyped input is lifted from the saved record, and distill drops a corrected save ([#1336](https://github.com/OpenAdaptAI/OpenAdapt/pull/1336)).
+- API steps: a clean save in a recording's network capture compiles into an API step with the same record check, and falls back to page structure before anything is sent when the API is unavailable ([#1269](https://github.com/OpenAdaptAI/OpenAdapt/pull/1269)). API steps run in durable runs without ever resending a save ([#1358](https://github.com/OpenAdaptAI/OpenAdapt/pull/1358)), under governed runs and the Standard and Regulated profiles ([#1361](https://github.com/OpenAdaptAI/OpenAdapt/pull/1361)), and under per-item approval of the exact request ([#1355](https://github.com/OpenAdaptAI/OpenAdapt/pull/1355)); the read-back is pipelined ([#1362](https://github.com/OpenAdaptAI/OpenAdapt/pull/1362)).
+- Self-repair: a halted run can be repaired under one person's approval ([#1265](https://github.com/OpenAdaptAI/OpenAdapt/pull/1265)), including with a short bridge of up to three new steps ([#1325](https://github.com/OpenAdaptAI/OpenAdapt/pull/1325)); repairs a person approved in advance apply as standard changes ([#1294](https://github.com/OpenAdaptAI/OpenAdapt/pull/1294)); and every stop that wrote nothing is repaired by default ([#1360](https://github.com/OpenAdaptAI/OpenAdapt/pull/1360)).
+- After a stop: a change ledger, a write-ordering lint and declared undo steps ([#1263](https://github.com/OpenAdaptAI/OpenAdapt/pull/1263)). `openadapt-flow undo propose` proposes an undo for each save and keeps it only if a test copy shows every record restored; a person approves it once with `undo accept` ([#1346](https://github.com/OpenAdaptAI/OpenAdapt/pull/1346)).
+- Record checks: `scaffold-verifier` builds a working check from the reads the app made while the person viewed the saved record ([#1284](https://github.com/OpenAdaptAI/OpenAdapt/pull/1284)); the recording teaches the check when the person looks the record up after saving ([#1290](https://github.com/OpenAdaptAI/OpenAdapt/pull/1290)); a desktop, RDP or Citrix save is checked by looking the record up in a separate read-only session ([#1280](https://github.com/OpenAdaptAI/OpenAdapt/pull/1280)), with a fresh session for desktop relaunch and a second RDP session ([#1241](https://github.com/OpenAdaptAI/OpenAdapt/pull/1241)); a check level per save, a learned reopen, a read-only guard and reference capture ([#1239](https://github.com/OpenAdaptAI/OpenAdapt/pull/1239)).
+- A save confirmed by a later report or acknowledgment is `SAVED_AWAITING_CHECK` and never counts as done until then ([#1297](https://github.com/OpenAdaptAI/OpenAdapt/pull/1297)). The receipt keeps the server's own answer to a save, labelled `same_screen` ([#1298](https://github.com/OpenAdaptAI/OpenAdapt/pull/1298)), and signs `checked_how` ([#1240](https://github.com/OpenAdaptAI/OpenAdapt/pull/1240)). `verify-run` treats a changed non-target record as collateral, not only a vanished one ([#1375](https://github.com/OpenAdaptAI/OpenAdapt/pull/1375)).
+- Identity: extra looks before stopping on a look-alike record ID (fresh frames, the known-ID list, a select-and-copy of the ID) ([#1333](https://github.com/OpenAdaptAI/OpenAdapt/pull/1333)); a hover check on icon-only targets and a fresh-frame re-check right before every pixel click ([#1334](https://github.com/OpenAdaptAI/OpenAdapt/pull/1334)); one re-observation before halting on an identity mismatch ([#1293](https://github.com/OpenAdaptAI/OpenAdapt/pull/1293)).
+- Learning from many runs: shadow-mined episodes become candidate drafts, and a program admitted once stops only on problems ([#1212](https://github.com/OpenAdaptAI/OpenAdapt/pull/1212)); `induce --probe-on` settles a disagreement between recordings on a browser, desktop or remote test copy ([#1276](https://github.com/OpenAdaptAI/OpenAdapt/pull/1276)); a deterministic router sends each item to the right admitted variant ([#1264](https://github.com/OpenAdaptAI/OpenAdapt/pull/1264)); narration proposes branch rules that recordings, a probe or a person certify ([#1291](https://github.com/OpenAdaptAI/OpenAdapt/pull/1291)); common local edits are classified from the recording on strict evidence ([#1366](https://github.com/OpenAdaptAI/OpenAdapt/pull/1366)).
+- One program switches tabs, popups and backends mid-run ([#1197](https://github.com/OpenAdaptAI/OpenAdapt/pull/1197)); lists and worktables are walked with focus and modal checks before each copy ([#1253](https://github.com/OpenAdaptAI/OpenAdapt/pull/1253)); worklists run in parallel with one session per worker ([#1296](https://github.com/OpenAdaptAI/OpenAdapt/pull/1296)).
+- Records: READ is a workflow step ([#1229](https://github.com/OpenAdaptAI/OpenAdapt/pull/1229)), with a record and field schema ([#1214](https://github.com/OpenAdaptAI/OpenAdapt/pull/1214)), an interchange format ([#1215](https://github.com/OpenAdaptAI/OpenAdapt/pull/1215)), one read channel by default with an opt-in double read ([#1218](https://github.com/OpenAdaptAI/OpenAdapt/pull/1218)), a review queue with signed, write-once decisions ([#1219](https://github.com/OpenAdaptAI/OpenAdapt/pull/1219)), and export to CSV, DB-API databases and webhooks ([#1220](https://github.com/OpenAdaptAI/OpenAdapt/pull/1220)).
+- Everything that leaves the machine is scrubbed by default ([#1262](https://github.com/OpenAdaptAI/OpenAdapt/pull/1262)), and every PHI file is encrypted at rest under one sealed index ([#1354](https://github.com/OpenAdaptAI/OpenAdapt/pull/1354)).
+- The phone approval shows the values a save writes ([#1257](https://github.com/OpenAdaptAI/OpenAdapt/pull/1257)).
+- A qualification project can bind to the generic web environment observer (`observe_web_environment`), whose digest is the one a governed browser run on the same machine observes ([#1353](https://github.com/OpenAdaptAI/OpenAdapt/pull/1353)).
+- A compatibility matrix, checked against the runtime in CI ([#1364](https://github.com/OpenAdaptAI/OpenAdapt/pull/1364)).
+- Harness²: a benchmark adapter scored by read-back, GUI rollouts on pixel-only surfaces, and a Meta-Harness-style trace export ([#1299](https://github.com/OpenAdaptAI/OpenAdapt/pull/1299), [#1301](https://github.com/OpenAdaptAI/OpenAdapt/pull/1301), [#1300](https://github.com/OpenAdaptAI/OpenAdapt/pull/1300), [#1304](https://github.com/OpenAdaptAI/OpenAdapt/pull/1304)).
+
+### Performance
+
+- Apple Vision identity reads match RapidOCR on the dense surface ([#1228](https://github.com/OpenAdaptAI/OpenAdapt/pull/1228)).
+
+### Fixes
+
+- In a governed run, an armed step whose identity is unreadable halts before acting, whether or not the authorization lists it ([#1397](https://github.com/OpenAdaptAI/OpenAdapt/pull/1397)).
+- A scroll skipped because its target was already in view verifies instead of counting as undelivered ([#1395](https://github.com/OpenAdaptAI/OpenAdapt/pull/1395)).
+- Bundles certified by earlier releases load and keep their workflow contract hash: an effect's `forbid_collateral_change` is serialized only when it is on ([#1406](https://github.com/OpenAdaptAI/OpenAdapt/pull/1406)).
+- A bad `local-seal` input (missing, empty, not JSON, repeated keys, the wrong shape, or a saved web page) fails in one clear line with exit 2, never a traceback ([#1401](https://github.com/OpenAdaptAI/OpenAdapt/pull/1401)).
+- Next-step hints repeat the `uvx` form when Flow runs from a uvx environment, so they reach the same version ([#1404](https://github.com/OpenAdaptAI/OpenAdapt/pull/1404)).
+- API steps: secrets and tokens in JSON bodies and headers are withheld from network capture ([#1367](https://github.com/OpenAdaptAI/OpenAdapt/pull/1367)); fields bind by the step that typed them, not by equal values ([#1368](https://github.com/OpenAdaptAI/OpenAdapt/pull/1368)); record identifiers in URLs stay run parameters ([#1369](https://github.com/OpenAdaptAI/OpenAdapt/pull/1369)); a step whose span also wrote is refused ([#1370](https://github.com/OpenAdaptAI/OpenAdapt/pull/1370)); native form validation is enforced ([#1371](https://github.com/OpenAdaptAI/OpenAdapt/pull/1371)); an API step binds to the complete definition of the steps it replaces ([#1372](https://github.com/OpenAdaptAI/OpenAdapt/pull/1372)).
+- A relabelled Save halts on the Save, not on the scroll before it ([#1337](https://github.com/OpenAdaptAI/OpenAdapt/pull/1337)); a self-closing popup click counts as delivered only when the step expects it ([#1321](https://github.com/OpenAdaptAI/OpenAdapt/pull/1321)).
+- Pixel-path replays keep running across display scaling and ClearType ([#1286](https://github.com/OpenAdaptAI/OpenAdapt/pull/1286)); `emit`, `serve-execute`, bench and resume no longer assume a browser ([#1285](https://github.com/OpenAdaptAI/OpenAdapt/pull/1285)).
+- The durable authority database is created owner-only before SQLite opens it ([#1363](https://github.com/OpenAdaptAI/OpenAdapt/pull/1363)).
+- The agent CLI help states the approval-mode default and the agent approval tools ([#1238](https://github.com/OpenAdaptAI/OpenAdapt/pull/1238)).
+
 ## v2.2.0 (2026-10-18)
 
 First release from the [OpenAdapt monorepo](https://github.com/OpenAdaptAI/OpenAdapt) (`packages/flow`). The shared contracts (`openadapt_flow.contracts`) and the MCP agent server (`openadapt_flow.agent`) now ship inside this package; `openadapt-types` and `openadapt-agent` are thin compatibility packages over them.

@@ -1,6 +1,6 @@
 """openadapt-flow: record, compile, replay deterministically, heal on drift."""
 
-__version__ = "2.2.0"
+__version__ = "2.3.0"
 
 from openadapt_flow.ir import (  # noqa: F401
     ActionKind,

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openadapt-flow"
-version = "2.2.0"
+version = "2.3.0"
 description = "Compile demonstrated GUI workflows into deterministic local replay with governed repair and refusal"
 readme = "README.md"
 license = { text = "MIT" }
@@ -366,6 +366,8 @@ exclude = [
     "/public-demo",
     "/THIRD_PARTY_NOTICES.md",
     "/benchmark/openimis_claims",
+    # openIMIS runs, tasks and results committed under other benchmarks.
+    "/benchmark/**/*openimis*",
     "/benchmark/reliability",
     "/docs/validation/IDENTITY_ROC.md",
     "/docs/validation/adversary_corpus_manifest.json",

@@ -1,6 +1,16 @@
 # CHANGELOG
 
 
+## v0.24.0 (2026-10-20)
+
+The models live in this package again, and it depends only on `pydantic>=2.5`; the Python 3.13 cap is gone. `openadapt-flow` 2.3.0 and later depend on it, and `openadapt_flow.contracts` returns the same modules as `openadapt_types` ([#1270](https://github.com/OpenAdaptAI/OpenAdapt/pull/1270)). Upgrade `openadapt-flow` to 2.3.0 together with this package: openadapt-flow 2.2.0 carries its own copy of the models, so with 0.24.0 alone, `isinstance` checks between the two copies fail.
+
+### Features
+
+- `import openadapt_types` loads no models until a name is used; public names and submodules still resolve as attributes ([#1270](https://github.com/OpenAdaptAI/OpenAdapt/pull/1270)).
+- `checked_how` on the RFC-0002 effect receipt: `CheckedHowLabel` and `CHECKED_HOW_VALUES` (`unchecked`, `same_screen`, `reopened`, `separate_session`, `system_of_record`, `counterparty_confirmed`) ([#1240](https://github.com/OpenAdaptAI/OpenAdapt/pull/1240)).
+- The `SAVED_AWAITING_CHECK` outcome: the entry was saved and counts as done only when a later report confirms it; not safe to retry ([#1297](https://github.com/OpenAdaptAI/OpenAdapt/pull/1297)).
+
 ## v0.23.0 (2026-10-18)
 
 First release from the [OpenAdapt monorepo](https://github.com/OpenAdaptAI/OpenAdapt) (`packages/types`). The models now live in `openadapt_flow.contracts`; this package re-exports them, so `import openadapt_types` keeps working. It requires `openadapt-flow>=2.2.0,<3`.