[dependabot]

Bumps openadapt-flow from 2.2.0 to 2.4.1.

Release notes

Sourced from openadapt-flow's releases.

openadapt-flow 2.4.1

Flow runs without its benchmark package and accepts a pinned config with Windows line endings. Several checks now halt or refute where 2.4.0 could act on the wrong row or pass a weaker check, and the frame can compare the whole database.

Fixes

• On Windows, --config-sha256 now hashes the config file's exact bytes. A config with CRLF line endings used to be read in text mode, so its hash never matched and the run was refused with deployment_config_changed (#1593).
• Product code no longer imports openadapt_flow.benchmark. An install or frozen build without the benchmark package, such as Desktop's engine, can now load the JIT adapters, annotation, narration rules and the qualification proposer. The default model, scroll step and API key loader moved to openadapt_flow.anthropic_defaults; openadapt_flow.benchmark.agent_baseline still exports them (#1594).
• Worklists built from plain div rows, CSS grid rows or cards are treated as rows. Teach records each row's identity, and replay halts when rows move or look alike, instead of clicking a button by its position (#open-0) on another record. A twin row seen at teach time marks the identity ambiguous, and a row nothing can read halts before a write (identity_uncounted) (#1569).
• The fault gate admits a record check only when it catches every fault class it claims. Two new classes write outside the table the check reads (other_table, side_write), and a check must claim both delta and frame. A check that reads one table of a larger store is no longer admitted, so VERIFIED is issued less often, never more. The receipt lists each class as killed, missed, untestable, not applicable or missing (#1539).
• The provenance round trip applies a field's declared value map before it compares the record with the source document. A document that prints a label (Massachusetts) for a stored code (MA) can now be checked, so a misread value is caught instead of saved and verified. A document value the map doesn't name is reported as not_checked (#1572).
• A step that leaves the store unchanged, such as dismissing a notice, no longer gets a placeholder record_written effect. The store snapshots before the step, after it and before the next action must all be equal, and a write request seen on the network cancels this (#1616).
• On a slow app, the recorder waits for the screen to change after a click that has started a change (the URL or title changed, or the page is busy), for up to 8 seconds (settle_pending_timeout_s). Before, the old screen was taken as the result, and certification refused navigation clicks (#1616).
• The interactive recorder waits for writes in flight (any request but GET, HEAD or OPTIONS, for up to 30 seconds) before it takes a click's after-frame or reads the record. A save the agent guard held could be read before it landed and get a placeholder effect (#1622).
• On Python 3.10, Flow's lock pins onnxruntime 1.23.2, the last release with a 3.10 wheel (#1622).
• verify-run's baseline keeps keyed hashes (MACs) of each record's identity and fields instead of the records' values, so no patient data from the read set is written to disk. A baseline that kept values still loads (#1599).

Features

• A key that changes nothing visible, such as a Tab onto an icon button or an ArrowDown that highlights an option, can now be checked: the new focus_on postcondition requires the focused element to have the recorded identity and to be the only element with it. The compiler adds it only for an element with a role and a non-empty accessible name; an element without them gets no check and stays unverified (#1579, #1595).
• A record check can name a duplicate key made of several fields, such as last name, first name and birth date (Effect.composite_key; record.duplicate_key in verify.yaml takes a list; --idempotency-key can be repeated). record_written is refuted when more than one record carries every key field (#1618).
• Frame checks can key audit entries by a record field (attribution.record_key), so another user's edit to the same patient counts as concurrent rather than collateral. frame.side_records declares rows a save adds beside its record; a missing or doubled side row refutes the frame (#1570).
• The frame can compare the whole database: with frame.database, a row added, removed or changed in any table is collateral unless a declared effect, side record or another actor's write explains it. The baseline holds keyed hashes, not values, and the read runs in one read-only transaction. Tables on a reviewed allow-list are append-only or skipped with a stated reason. After the save, the database is read twice, settle_s apart, and when the reads differ the frame is not checked (#1582, #1600).
• frame.database.profile: openemr applies a versioned profile of the bookkeeping OpenEMR writes on its own (openadapt_flow.app_profiles). A rule may not excuse a patient-data table, and the receipt names the profile version and the rules it used (#1604).
• openadapt_flow.verifier is a stable Python API for checking one write: capture reads the baseline before the write, and verify_write returns verified, refuted or unconfirmed with the checks and the receipt digest (#1588).
• Skills can be pulled from an attested registry, bound to the user's own instance and qualified there before they run. A shipped SQL read-back runs on a read-only session and may only be a plain SELECT (#1623, #1624).

openadapt-flow 2.4.0

A person's approval counts only when a registered approver key signed it, and the verification, identity and recovery paths below fail closed where they used to pass.

Features

• A person's approval of a gated save carries an Ed25519 signature from a key registered under the approvers role (jit register --role approver), made with the route's own method (desktop_key for Desktop, portal_key for the decision portal). Item approvals, the durable approve and resume, the console and the agent tools all verify it; an unsigned, claimed or hand-written answer gives no authority. approve, resume, run and run-case take --key-dir to name the registry (#1486, #1501).
• Loop induction learns worklists that are not back-to-back repeats: a click names the parameter that identifies its row (Step.target_param), and each pass works on, and is checked against, its own row's record (#1435).
• Pipelined read-back runs under durable, Standard and Regulated runs. The deferred check is written into the durable pause before the side thread gets it, and a problems_only run decides each item from its settled check (#1442, #1460).
• An admitted API step runs inside a multi-surface program on its own surface, under a managed dispatch that names it, and under a qualification admission that qualified its path (#1439, #1444, #1451).
• verify-run judges frame conditions: a record that no effect declares, added, removed or changed, is a collateral change, with optional attribution from an audit log or a modified-by field (#1443). A record check is admitted only after it catches its faults on a test copy of the system of record (fault_gate, openadapt.check-coverage/v1) (#1445). A saved record is compared with its source document through a second extraction by a different method (provenance) (#1446).
• A pinned bundle can be repaired: the fix is re-qualified on a test copy and re-admitted with signed lineage, and the pin accepts the new version only through that lineage (#1450). A renamed save button is repaired when the recorded identity hash proves only the label changed (#1514). qualify handles a bundle that already has a qualification project, an encrypted bundle and a sealed set (#1454).
• The record check reads a typed label back as its stored code (ValueExpr map) and can require exactly the new record (record.exact_new_set) (#1456).
• Under problems_only, problems with an item's own input leave the switch on and send that item to a person; program and environment problems turn it off, and a person re-arms it with one signed tap (#1517).
• Look-alike rows are counted on Windows, macOS, Linux and pixel-only surfaces, so a step that picks a row halts when it cannot tell the target from its twin (#1504, #1518, #1557).
• openadapt-agent serve --teach-browser lets a coding agent turn a read-only browser task into a named tool it calls again with new values; openadapt setup registers it with Claude Code, Cursor, Codex and Gemini CLI (#1502).
• induce --held-out scores each held-out item by running it and checking the record independently (#1527).

Fixes

• A save that was sent but not confirmed never resumes as a plain retry; the pause offers reconcile or an explicit single retry (#1485).
• A value typed whole in one step and inside longer text in another is reported as unlifted, and a canary that reuses run 1's values returns the draft to review (#1465).
• Record identity stays stable across the JSON baseline, so rows read back from UUID, decimal and datetime columns are not counted as new (#1482).
• An empty or not-found page in a separate-session read-back is indeterminate, not proof that a record is absent (#1515, thanks @​yunusarda-sudo).
• A binary SQL column (such as OpenEMR's uuid) is read as hex by verify-run and scaffold-verifier (#1503).

... (truncated)

Commits

• 88e6328 benchmark: what OpenAdapt adds on top of a competent agent (live OpenEMR) (#1...
• ec125ec test(flow): agent guard e2e says why run 1 was not recorded (#1635)
• 543dd7a effects: declared value kinds (phone, date, email) (#1597)
• 0d29362 effects: a contract value can say how the store saves what was entered (#1586)
• b604199 fix(flow): print the skill bind and qualify hints through command(); guards b...
• 17da07c docs(flow): complete the 2.4.1 changelog (#1631)
• b8250b7 docs(flow): add #1616, #1570 and #1618 to the 2.4.1 changelog (#1627)
• c214b9f Merge remote-tracking branch 'origin/main' into claude/ci-desktop-push-never-...
• c7f5b77 frame: two reads after the save must match (#1600)
• a32be0c verifier: a stable Python API for checking one write (#1588)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.