docs(flow): complete the 2.4.1 changelog

llms-full.txt

@@ -2091,7 +2091,7 @@ automation into an independently certified transaction system.
 
 ## What changed in openadapt-flow 2.4.1
 
-Flow runs without its benchmark package, a pinned config with Windows line endings is accepted, and several checks halt where 2.4.0 could act on the wrong row or pass a weaker check.
+Flow runs without its benchmark package and accepts a pinned config with Windows line endings. Several checks now halt or refute where 2.4.0 could act on the wrong row or pass a weaker check, and the frame can compare the whole database.
 
 ### Fixes
 
@@ -2102,9 +2102,16 @@ Flow runs without its benchmark package, a pinned config with Windows line endin
 - The provenance round trip applies a field's declared value map before it compares the record with the source document. A document that prints a label (`Massachusetts`) for a stored code (`MA`) can now be checked, so a misread value is caught instead of saved and verified. A document value the map doesn't name is reported as `not_checked` ([#1572](https://github.com/OpenAdaptAI/OpenAdapt/pull/1572)).
 - A step that leaves the store unchanged, such as dismissing a notice, no longer gets a placeholder `record_written` effect. The store snapshots before the step, after it and before the next action must all be equal, and a write request seen on the network cancels this ([#1616](https://github.com/OpenAdaptAI/OpenAdapt/pull/1616)).
 - On a slow app, the recorder waits for the screen to change after a click that has started a change (the URL or title changed, or the page is busy), for up to 8 seconds (`settle_pending_timeout_s`). Before, the old screen was taken as the result, and certification refused navigation clicks ([#1616](https://github.com/OpenAdaptAI/OpenAdapt/pull/1616)).
+- The interactive recorder waits for writes in flight (any request but GET, HEAD or OPTIONS, for up to 30 seconds) before it takes a click's after-frame or reads the record. A save the agent guard held could be read before it landed and get a placeholder effect ([#1622](https://github.com/OpenAdaptAI/OpenAdapt/pull/1622)).
+- On Python 3.10, Flow's lock pins onnxruntime 1.23.2, the last release with a 3.10 wheel ([#1622](https://github.com/OpenAdaptAI/OpenAdapt/pull/1622)).
+- `verify-run`'s baseline keeps keyed hashes (MACs) of each record's identity and fields instead of the records' values, so no patient data from the read set is written to disk. A baseline that kept values still loads ([#1599](https://github.com/OpenAdaptAI/OpenAdapt/pull/1599)).
 
 ### Features
 
 - A key that changes nothing visible, such as a Tab onto an icon button or an ArrowDown that highlights an option, can now be checked: the new `focus_on` postcondition requires the focused element to have the recorded identity and to be the only element with it. The compiler adds it only for an element with a role and a non-empty accessible name; an element without them gets no check and stays unverified ([#1579](https://github.com/OpenAdaptAI/OpenAdapt/pull/1579), [#1595](https://github.com/OpenAdaptAI/OpenAdapt/pull/1595)).
 - A record check can name a duplicate key made of several fields, such as last name, first name and birth date (`Effect.composite_key`; `record.duplicate_key` in `verify.yaml` takes a list; `--idempotency-key` can be repeated). `record_written` is refuted when more than one record carries every key field ([#1618](https://github.com/OpenAdaptAI/OpenAdapt/pull/1618)).
 - Frame checks can key audit entries by a record field (`attribution.record_key`), so another user's edit to the same patient counts as concurrent rather than collateral. `frame.side_records` declares rows a save adds beside its record; a missing or doubled side row refutes the frame ([#1570](https://github.com/OpenAdaptAI/OpenAdapt/pull/1570)).
+- The frame can compare the whole database: with `frame.database`, a row added, removed or changed in any table is collateral unless a declared effect, side record or another actor's write explains it. The baseline holds keyed hashes, not values, and the read runs in one read-only transaction. Tables on a reviewed allow-list are append-only or skipped with a stated reason. After the save, the database is read twice, `settle_s` apart, and when the reads differ the frame is not checked ([#1582](https://github.com/OpenAdaptAI/OpenAdapt/pull/1582), [#1600](https://github.com/OpenAdaptAI/OpenAdapt/pull/1600)).
+- `frame.database.profile: openemr` applies a versioned profile of the bookkeeping OpenEMR writes on its own (`openadapt_flow.app_profiles`). A rule may not excuse a patient-data table, and the receipt names the profile version and the rules it used ([#1604](https://github.com/OpenAdaptAI/OpenAdapt/pull/1604)).
+- `openadapt_flow.verifier` is a stable Python API for checking one write: `capture` reads the baseline before the write, and `verify_write` returns `verified`, `refuted` or `unconfirmed` with the checks and the receipt digest ([#1588](https://github.com/OpenAdaptAI/OpenAdapt/pull/1588)).
+- Skills can be pulled from an attested registry, bound to the user's own instance and qualified there before they run. A shipped SQL read-back runs on a read-only session and may only be a plain `SELECT` ([#1623](https://github.com/OpenAdaptAI/OpenAdapt/pull/1623), [#1624](https://github.com/OpenAdaptAI/OpenAdapt/pull/1624)).

packages/flow/CHANGELOG.md

@@ -17,7 +17,7 @@
 
 ## v2.4.1 (2026-10-28)
 
-Flow runs without its benchmark package, a pinned config with Windows line endings is accepted, and several checks halt where 2.4.0 could act on the wrong row or pass a weaker check.
+Flow runs without its benchmark package and accepts a pinned config with Windows line endings. Several checks now halt or refute where 2.4.0 could act on the wrong row or pass a weaker check, and the frame can compare the whole database.
 
 ### Fixes
 
@@ -28,12 +28,19 @@ Flow runs without its benchmark package, a pinned config with Windows line endin
 - The provenance round trip applies a field's declared value map before it compares the record with the source document. A document that prints a label (`Massachusetts`) for a stored code (`MA`) can now be checked, so a misread value is caught instead of saved and verified. A document value the map doesn't name is reported as `not_checked` ([#1572](https://github.com/OpenAdaptAI/OpenAdapt/pull/1572)).
 - A step that leaves the store unchanged, such as dismissing a notice, no longer gets a placeholder `record_written` effect. The store snapshots before the step, after it and before the next action must all be equal, and a write request seen on the network cancels this ([#1616](https://github.com/OpenAdaptAI/OpenAdapt/pull/1616)).
 - On a slow app, the recorder waits for the screen to change after a click that has started a change (the URL or title changed, or the page is busy), for up to 8 seconds (`settle_pending_timeout_s`). Before, the old screen was taken as the result, and certification refused navigation clicks ([#1616](https://github.com/OpenAdaptAI/OpenAdapt/pull/1616)).
+- The interactive recorder waits for writes in flight (any request but GET, HEAD or OPTIONS, for up to 30 seconds) before it takes a click's after-frame or reads the record. A save the agent guard held could be read before it landed and get a placeholder effect ([#1622](https://github.com/OpenAdaptAI/OpenAdapt/pull/1622)).
+- On Python 3.10, Flow's lock pins onnxruntime 1.23.2, the last release with a 3.10 wheel ([#1622](https://github.com/OpenAdaptAI/OpenAdapt/pull/1622)).
+- `verify-run`'s baseline keeps keyed hashes (MACs) of each record's identity and fields instead of the records' values, so no patient data from the read set is written to disk. A baseline that kept values still loads ([#1599](https://github.com/OpenAdaptAI/OpenAdapt/pull/1599)).
 
 ### Features
 
 - A key that changes nothing visible, such as a Tab onto an icon button or an ArrowDown that highlights an option, can now be checked: the new `focus_on` postcondition requires the focused element to have the recorded identity and to be the only element with it. The compiler adds it only for an element with a role and a non-empty accessible name; an element without them gets no check and stays unverified ([#1579](https://github.com/OpenAdaptAI/OpenAdapt/pull/1579), [#1595](https://github.com/OpenAdaptAI/OpenAdapt/pull/1595)).
 - A record check can name a duplicate key made of several fields, such as last name, first name and birth date (`Effect.composite_key`; `record.duplicate_key` in `verify.yaml` takes a list; `--idempotency-key` can be repeated). `record_written` is refuted when more than one record carries every key field ([#1618](https://github.com/OpenAdaptAI/OpenAdapt/pull/1618)).
 - Frame checks can key audit entries by a record field (`attribution.record_key`), so another user's edit to the same patient counts as concurrent rather than collateral. `frame.side_records` declares rows a save adds beside its record; a missing or doubled side row refutes the frame ([#1570](https://github.com/OpenAdaptAI/OpenAdapt/pull/1570)).
+- The frame can compare the whole database: with `frame.database`, a row added, removed or changed in any table is collateral unless a declared effect, side record or another actor's write explains it. The baseline holds keyed hashes, not values, and the read runs in one read-only transaction. Tables on a reviewed allow-list are append-only or skipped with a stated reason. After the save, the database is read twice, `settle_s` apart, and when the reads differ the frame is not checked ([#1582](https://github.com/OpenAdaptAI/OpenAdapt/pull/1582), [#1600](https://github.com/OpenAdaptAI/OpenAdapt/pull/1600)).
+- `frame.database.profile: openemr` applies a versioned profile of the bookkeeping OpenEMR writes on its own (`openadapt_flow.app_profiles`). A rule may not excuse a patient-data table, and the receipt names the profile version and the rules it used ([#1604](https://github.com/OpenAdaptAI/OpenAdapt/pull/1604)).
+- `openadapt_flow.verifier` is a stable Python API for checking one write: `capture` reads the baseline before the write, and `verify_write` returns `verified`, `refuted` or `unconfirmed` with the checks and the receipt digest ([#1588](https://github.com/OpenAdaptAI/OpenAdapt/pull/1588)).
+- Skills can be pulled from an attested registry, bound to the user's own instance and qualified there before they run. A shipped SQL read-back runs on a read-only session and may only be a plain `SELECT` ([#1623](https://github.com/OpenAdaptAI/OpenAdapt/pull/1623), [#1624](https://github.com/OpenAdaptAI/OpenAdapt/pull/1624)).
 
 ## v2.4.0 (2026-10-25)