OpenAdaptAI · abrichr · Jul 28, 2026
@@ -66,10 +66,11 @@ before compilation rather than weakening the privacy or runtime gate.
 
 Cloud checks the attestation's exact recording and bundle hashes, provenance,
 report and evidence hashes, policy, engine-derived `low`/`consequential` risk
-class, HMAC, freshness, and one-time organization/token challenge. Server-side
+class, organization-trusted Ed25519 runner signature, separate ingest-token MAC,
+freshness, and one-time organization/token challenge. Server-side signer trust,
 policy, risk-class, and deployed compiler-version allowlists are additional
-restrictions. This is operator self-attestation, not independent certification
-or a general safety guarantee.
+restrictions and are checked again before dispatch. This is operator
+self-attestation, not independent certification or a general safety guarantee.
 
 The risk-based launch default is:
 

@@ -12,8 +12,10 @@ agent, and neither puts a model call on the runtime path.
 ## Where a halt goes: the attended decision
 
 When a run cannot confirm something, it stops and projects the paused step into
-a **bounded question** a member of staff can answer — from a workstation, or
-from a phone on your own network through ingress you control.
+a **bounded question** a member of staff can answer from a workstation or an
+authorized phone. The customer-controlled runner can dial out to the hosted
+decision lane, or an organization can publish the full-fidelity local portal
+through its own trusted ingress.
 
 The question is closed by construction. `openadapt-flow` projects the pause into
 a signed task carrying typed categories, bounded counts, and digests; the client
@@ -208,6 +210,7 @@ consequence in full:
 | Answer | Effect on this run | Effect on future runs |
 |---|---|---|
 | Check and continue | Re-verifies live state, then continues | None — the same drift stops the next run |
+| Reject and end run | Ends the run with the operator's rejection recorded | None |
 | Teach the correction | Continues nothing now | Enters the halt-learn loop below |
 | Needs more help | Leaves the run paused and untouched | None |
 

@@ -23,7 +23,7 @@ you explicitly push it to a [cloud workspace](connect-to-cloud.md).
 Get the installer from
 [openadapt.ai/download](https://openadapt.ai/download). The page detects your OS
 and architecture and offers the right build. Public Beta release
-`desktop-v0.14.0` ships the complete Windows, macOS, and Linux installer set with
+`desktop-v0.15.0` ships the complete Windows, macOS, and Linux installer set with
 `SHA256SUMS`, a CycloneDX SBOM, per-platform metadata, and build-provenance
 attestations.
 
@@ -118,7 +118,7 @@ first-week failures.
 
 ## During a governed run
 
-Desktop 0.14.0 can show a separate always-on-top status surface without adding
+Desktop 0.15.0 can show a separate always-on-top status surface without adding
 anything to the target application. While OpenAdapt is observing or executing,
 the surface is non-focusable, ignores pointer input, exposes no controls, and is
 excluded from capture before it becomes visible. Controls become interactive
@@ -134,7 +134,14 @@ and disappears if neither corner is safe. These presentation elements are not
 verification evidence and do not weaken the pointer, focus, or capture-exclusion
 boundary. [Watch the public demo](https://app.openadapt.ai/demo#footage) or
 review the exact released
-[control-overlay contract](https://github.com/OpenAdaptAI/openadapt-desktop/blob/desktop-v0.14.0/docs/CONTROL_OVERLAY.md).
+[control-overlay contract](https://github.com/OpenAdaptAI/openadapt-desktop/blob/desktop-v0.15.0/docs/CONTROL_OVERLAY.md).
+
+When an attended run halts, Desktop can connect the customer-controlled runner
+to the hosted decision lane. The runner uses outbound HTTPS only and sends a
+signed, closed, PHI-free context. An authorized operator can answer from a
+phone. The answer does not mark the step complete: the runner reacquires the
+live application and repeats its identity, state, target, and effect checks
+before it continues. This path requires `openadapt-flow` 1.26 or newer.
 
 ## Where to go next
 

@@ -33,7 +33,7 @@ module inside it:
 | [OpenAdapt](https://github.com/OpenAdaptAI/OpenAdapt) | **Beta** | Installer/meta-package and unified `openadapt flow` dispatcher. |
 | [openadapt-flow](https://github.com/OpenAdaptAI/openadapt-flow) | **Beta** | Canonical compiler and governed runtime. Drives web, native Windows, native macOS, native Linux, RDP, and Citrix/VDI as first-class substrates behind one backend protocol. |
 | [OpenAdapt Cloud](https://app.openadapt.ai/) | **Beta** | Proprietary live control plane for the managed subscription: organizations, exact-hash admission, runner orchestration, reports, billing, and usage. |
-| [openadapt-desktop](https://github.com/OpenAdaptAI/openadapt-desktop) | **Beta** | Public `desktop-v0.14.0` provides Windows MSI/NSIS, macOS arm64/x64 DMG, and Linux AppImage/DEB installers. Every installer path is installed, launched, and uninstalled in the native release workflow; the release includes exact checksums, a CycloneDX SBOM, platform metadata, and build-provenance attestations. |
+| [openadapt-desktop](https://github.com/OpenAdaptAI/openadapt-desktop) | **Beta** | Public `desktop-v0.15.0` provides Windows MSI/NSIS, macOS arm64/x64 DMG, and Linux AppImage/DEB installers, plus the outbound attended-decision connection for authorized phone answers. Every installer path is installed, launched, and uninstalled in the native release workflow; the release includes exact checksums, a CycloneDX SBOM, platform metadata, and build-provenance attestations. |
 | [openadapt-agent](https://github.com/OpenAdaptAI/openadapt-agent) | **Experimental** | Active v2 bridge that exposes governed Flow bundles to MCP clients and Agent Skills. The pre-v2 model-driven execution wrapper is the deprecated line; the repository itself is active. |
 | [openadapt-capture](https://github.com/OpenAdaptAI/openadapt-capture) | **Beta** | Canonical native screen, mouse, keyboard, timing, and window-scoped recorder behind Flow's Windows, macOS, Linux, RDP, and Citrix recording paths. Capture 1.1 retains Windows UIA evidence at action time; remote sessions remain externally black-box. Browser recording remains inside Flow's Playwright listener. |
 | [openadapt-privacy](https://github.com/OpenAdaptAI/openadapt-privacy) | **Experimental** | Optional PII/PHI scrubbing used on configured persist, log, and upload paths. |

@@ -68,10 +68,10 @@ customer-controlled runtime connected to the same governance model.
 | Native Linux backend | **Supported** | Required current-main job [`linux-atspi-x11`](https://github.com/OpenAdaptAI/openadapt-flow/actions/runs/30059807758/job/89378981573) at exact Flow commit `3de5fc67acf3024a621f812c5a6ed9be07fac335` ran one fresh GTK3 process per trial on Ubuntu 24.04 X11/AT-SPI. It confirmed 3/3 exact-file effects, 3/3 ambiguous-target refusals, and 3/3 stale-target refusals, with 0 silent incorrect successes, 0 over-halts, 0 operator interventions, and 0 model calls. | Native receipts prove AT-SPI delivery only; independent exact file bytes or confirmed absence prove effects. This is bounded to the in-tree GTK3 fixture and CI Xvfb image; it does not establish Wayland or arbitrary third-party application support. |
 | RDP backend | **Supported** | Two bounded results exercise complementary RDP paths. Aardwolf 0.2.14 over a Parallels Windows 11 VM completed 3/3 Windows Run-dialog file effects with independent guest-tools readback. The accepted full governed lifecycle at mechanism commit `6031fde` recorded, compiled, and replayed a synthetic note workflow through real FreeRDP3-transported pixels/input: 3/3 healthy effects and 3/3 drift safe-halts, with zero model calls, silent incorrect successes, false completions, drift writes, or healthy over-halts. Consequential remote actions now acquire a fresh frame, re-resolve target and identity, and use a one-shot input lease that refuses changed session context, pixels, dimensions, or readiness before delivery. Review the [Aardwolf/Windows report](https://github.com/OpenAdaptAI/openadapt-flow/blob/6610d24cebba27918b8ea507b2f05a094057ac85/benchmark/rdp/results_82a658a_20260718.sanitized.json), the [FreeRDP lifecycle report](https://github.com/OpenAdaptAI/openadapt-flow/blob/affedc5f1f0de533a0744deaa8e30a203c91c6b3/benchmark/rdp_ladder/results.json), [Flow PR #142](https://github.com/OpenAdaptAI/openadapt-flow/pull/142), [Flow PR #177](https://github.com/OpenAdaptAI/openadapt-flow/pull/177), and [Flow PR #238](https://github.com/OpenAdaptAI/openadapt-flow/pull/238). | The Windows batch qualifies its exact task, snapshot, transport, and oracle. The FreeRDP batch qualifies a synthetic Linux Tk task over a real RDP round trip; it is not Aardwolf, a Windows-app qualification, Citrix ICA/HDX, or WAN-captured drift. The two-phase mechanism is separately covered by runtime and backend refusal tests; it does not enlarge those bounded application results. |
 | Citrix / VDI backend | **Supported** | The dedicated `--backend citrix` path selects the exact Citrix Workspace/Viewer owner, optionally binds an exact title, requires a readiness marker for governed `run`, carries the closed target into durable resume, and uses the shared pixel identity, effect, policy, and halt contracts. Consequential input reacquires the exact client window, focus, geometry, readiness, fresh pixels, resolved target, and record identity, then refuses any change before the first input edge. The accepted no-DOM qualification completed 3/3 healthy effects and 3/3 severe-drift safe-halts with 0 model calls, silent incorrect successes, false completions, healthy over-halts, or drift writes. Review the [immutable report](https://github.com/OpenAdaptAI/openadapt-flow/blob/f6faac5b900b78cbda5980de0e983a9f987285ac/benchmark/citrix_workspace/results.json), [Flow PR #183](https://github.com/OpenAdaptAI/openadapt-flow/pull/183), and [Flow PR #238](https://github.com/OpenAdaptAI/openadapt-flow/pull/238). | The accepted artifact explicitly records `code_readiness_accepted: true` and `ica_hdx_accepted: false`. It qualifies the shipped Citrix Workspace-window backend contract over a no-DOM canvas stand-in, not a counted real ICA/HDX batch. The exact ICA/HDX client, codec, latency, DPI, lock/readiness, input, identity, and effect matrix is a separate per-deployment qualification boundary. |
-| Desktop authoring GUI and tray | **Supported / Beta** | Public `desktop-v0.14.0` provides Windows MSI/NSIS, macOS arm64/x64 DMG, and Linux AppImage/DEB installers. All six installer paths were installed, launched, and uninstalled in the native release workflow; the release includes `SHA256SUMS`, a CycloneDX SBOM, per-platform metadata, and build-provenance attestations. | Windows/Linux remain unsigned and macOS is ad-hoc signed, so verify checksums and provenance before overriding the OS publisher warning. The app and CLI drive the same released compiler/runtime. |
+| Desktop authoring GUI and tray | **Supported / Beta** | Public `desktop-v0.15.0` provides Windows MSI/NSIS, macOS arm64/x64 DMG, and Linux AppImage/DEB installers. It can connect the customer-controlled attended console to the hosted phone-decision lane through outbound HTTPS. All six installer paths were installed, launched, and uninstalled in the native release workflow; the release includes `SHA256SUMS`, a CycloneDX SBOM, per-platform metadata, and build-provenance attestations. | Windows/Linux remain unsigned and macOS is ad-hoc signed, so verify checksums and provenance before overriding the OS publisher warning. The app and CLI drive the same released compiler/runtime. A phone answer never bypasses the runner's fresh identity, state, target, or effect checks. |
 | Hosted CLI connectivity | **Supported / public offer** | `login`, exact-hash artifact preparation/upload, one-time runtime validation, bound replacement activation, and `report-break` connect the local engine to the live control plane. | Upload requires destination policy and an approved sanitized derivative; checkout never bypasses an egress refusal. |
 | Artifact sanitation and local review | **Supported / launch gate** | The sanitized-derivative pipeline inventories, transforms, rescans, manifests, hashes, and supports local review/approval. | The raw original remains sensitive; unknown or unresolved content is refused; runtime observations can reintroduce PHI/PII. |
-| Cross-engine hosted validation | **Supported / launch gate** | `validate-hosted` binds an approved recording and bundle, compiler provenance, strict lint, policy certification, derived risk class, and successful replay report to a one-time Cloud challenge. | It is operator self-attestation signed with the ingest token, not an independently observed certification. Exact deployment policy, risk-class, and deployed compiler-version allowlists still apply. |
+| Cross-engine hosted validation | **Supported / launch gate** | Runtime-validation v3 binds an approved recording and bundle, compiler provenance, strict lint, policy certification, derived risk class, and successful replay report to a one-time Cloud challenge. An organization-trusted Ed25519 runner key signs the evidence, and a separate ingest-token MAC binds the submission. | It is operator self-attestation, not an independently observed certification. Cloud rechecks exact signer trust and current deployment policy, risk-class, and compiler-version allowlists before dispatch. |
 | Hosted browser recorder and runtime health | **Supported / bounded launch component** | A retained non-simulated hosted session on `openadapt-flow` 1.8.0 produced frames and input evidence, assembled a compileable recording, finalized one workflow idempotently, enforced resource limits, and cleaned up ephemeral qualification data. Authenticated live health reports the pinned managed-runtime 1.23.0 runner/compiler identity and checks auth, database, storage, callbacks, scheduler, retention, secrets, validation policy, and billing. | Explicitly initiated, public-HTTPS, non-regulated authoring only. Raw observations remain private inside the declared hosted boundary. Readiness proves deployed dependencies and service identity, not a customer workflow qualification or SLA. |
 | Hosted dashboard/control plane | **Supported / public offer** | Authentication, organizations, exact-hash bundle ingest, immutable run admission, browser runner orchestration, structural reports, replacement activation, billing, and metering form the managed lifecycle. | Production uses live dependencies and fails unavailable rather than substituting mock behavior. |
 | Hosted execution | **Supported / public offer** | Live Stripe Checkout connects onboarding and subscription entitlements to managed browser execution; the runner verifies exact admitted bundle bytes and authenticated callbacks. | The public subscription covers approved browser workflows. Other substrates use separately scoped deployments and commercial terms. Checkout does not create an SLA or certification. |

@@ -98,19 +98,23 @@ The hosted lifecycle is:
    validation environment.
 6. Sanitize, review, and approve the compiled bundle. Bundle sanitation must
    preserve execution-bearing content.
-7. Run `validate-hosted`. It requests an expiring, one-time organization/token
-   challenge and creates an operator attestation bound to the exact approved
-   recording, bundle, compiler provenance, policy, risk class, and replay report.
-8. Immediately push the approved bundle with that attestation. Cloud consumes
+7. Provision one Ed25519 key for the customer-controlled runner. Give its
+   printed public entry to the Cloud deployment operator, who adds it to the
+   organization's trust policy. Keep the private key inside the runner boundary.
+8. Run `validate-hosted`. It requests an expiring, one-time organization/token
+   challenge and creates a v3 operator attestation bound to the exact approved
+   recording, bundle, compiler provenance, policy, risk class, replay report,
+   organization, and runner.
+9. Immediately push the approved bundle with that attestation. Cloud consumes
    the challenge and admits the bundle only if policy and risk-class allowlists
    also pass.
-9. Configure the vault secret-set reference and optional schedule. The target
+10. Configure the vault secret-set reference and optional schedule. The target
    URL, allowed hosts, and parameter schema are immutable attested bundle
    properties; supply non-secret parameter values for each run.
-10. Teach or repair a halted run locally, revalidate it, and activate the
+11. Teach or repair a halted run locally, revalidate it, and activate the
    attested replacement on the same workflow; promote only a revision that
    passes its gates.
-11. Inspect usage and manage the subscription through the billing portal.
+12. Inspect usage and manage the subscription through the billing portal.
 
 Checkout does not relax a safety or egress refusal. A paid organization cannot
 upload an unapproved artifact or execute a workflow that fails its configured
@@ -145,18 +149,30 @@ openadapt flow review-sanitized bundle.sanitized --original bundle
 openadapt flow approve-sanitized bundle.sanitized \
   --original bundle --reviewer alice@example.com
 
-# 4. Acquire the one-time challenge and bind the local evidence to it.
+# 4. Once per runner, create its signing key. Give the printed public entry to
+#    the Cloud deployment operator. Keep the private key local.
+openadapt flow runtime-keygen \
+  --out /secure/runner-ed25519.key \
+  --key-id clinic-runner-2026-07 \
+  --runner-id clinic-runner-01 \
+  --org-id 00000000-0000-4000-8000-000000000001
+
+# 5. Acquire the one-time challenge and bind the local evidence to it.
 openadapt flow validate-hosted \
   --recording recording.sanitized \
   --bundle bundle.sanitized \
   --run-dir runs/triage-validation \
   --policy clinical-write \
   --risk-class consequential \
   --environment validation/mock-emr-v1 \
+  --target-kind web \
   --target-url https://validation.example/login \
+  --signing-key-id clinic-runner-2026-07 \
+  --signing-runner-id clinic-runner-01 \
+  --signing-private-key-file /secure/runner-ed25519.key \
   --out triage.runtime-validation.json
 
-# 5. Consume the challenge by uploading the exact attested bundle once.
+# 6. Consume the challenge by uploading the exact attested bundle once.
 openadapt flow push bundle.sanitized --kind bundle --name "Triage" \
   --validation-attestation triage.runtime-validation.json
 ```
@@ -238,16 +254,20 @@ chain:
 - the approved bundle archive SHA-256 is the archive uploaded with the
   attestation.
 
-The client signs this envelope with the ingest token. Cloud verifies the HMAC,
+The customer-controlled runner signs this envelope with its organization-trusted
+Ed25519 key. A separate ingest-token MAC binds the complete submission to the
+one-time challenge. Cloud verifies the signature, runner and organization trust,
 fresh timestamp, exact bundle hash, configured policy, risk-class, and deployed
 compiler-version allowlists, and the challenge's organization, token, nonce,
-expiry, and unused state. The challenge expires after 15 minutes and is consumed
-transactionally by the accepted bundle upload.
+expiry, and unused state. It repeats the current signer, policy, risk-class, and
+compiler admission checks before dispatch. The challenge expires after 15
+minutes and is consumed transactionally by the accepted bundle upload.
 
 This is **operator self-attestation**, not independent certification. It proves
-that the token holder produced a tamper-evident envelope over the named local
-evidence; Cloud did not observe the local replay and the HMAC is not an auditor
-signature. `certify` means only that the bundle passed the selected policy.
+that the trusted runner signed a tamper-evident envelope and that the ingest
+token holder submitted that exact envelope. Cloud did not observe the local
+replay, and neither proof is an auditor signature. `certify` means only that the
+bundle passed the selected policy.
 Independent certification would require a separately controlled evaluator,
 test environment, evidence custody, and signing identity. Neither mechanism is
 a blanket safety, compliance, or correctness guarantee.