feat(attended): execute governed halt actions

[abrichr]

Summary

Completes the additive attended-operation path on top of the existing evidence
queue without narrowing the ordinary console or CLI:

• wires an explicit persistent headed browser, desktop, or RDP executor into
  console --attend --allow-actions
• derives Continue and Skip from exact halted-step/program semantics instead of
  advertising blanket actions
• preserves Teach and Escalate as audited operator outcomes
• binds actions to signed run/workflow/bundle/step/pause capabilities, PHI-safe
  keyed transition baselines, live revalidation, leases, and idempotency
• verifies a human-completed action without re-actuating it; delivery evidence
  never substitutes for postcondition/effect evidence
• rejects ambiguous, unbaselined, collateral, irreversible, stale, cross-run,
  cross-frame, and alternate-target transitions
• adds exact structured-program transition receipts so guarded successors are
  evaluated once and nested interpreter cursors resume deterministically

Structured-program receipt boundary

The receipt contains no raw UI text, URL, or title. It is HMAC-sealed with the
per-run secret, atomically persisted with mode 0600 under a symlink-refusing
0700 directory, and bound to the exact run, workflow, bundle digest, pause
id/digest, action, source checkpoint sequence, graph/state, control-frame hash,
cursor digest, and guarded successor. Resume authenticates the
receipt/checkpoint lineage and consumes that stored transition rather than
re-evaluating it.

Both the linear and structured-program paths re-bind the exact signed pending
pause after live verification and before writing any checkpoint, receipt, or
approval. Adversarial regressions replace the pause in that interval and prove
refusal with no workflow actuation or transition artifacts.

Final release-base validation

Exact head: f27066a5353888544d3cd085d45d99f8e4faf953

Exact base: released v1.17.2 commit
597e06a7b042e6d6fe958e2bbdcd6509f9b7bdca

• 102 attended/console tests passed after the final rebase
• focused linear/program pause-race regressions passed
• Ruff check and format passed
• whole-package mypy passed
• release consistency, public consistency, claims, and diff checks passed
• v1.17.2 prerequisite has green 15/15 exact-main CI, verified release ancestry,
  byte-identical GitHub/PyPI artifacts, valid PyPI attestations, and a passing
  MIT/forbidden-payload boundary
• final exact-head protected CI:
  https://github.com/OpenAdaptAI/openadapt-flow/actions/runs/29674731479

Merge status

Draft until the final exact-head protected run is completely green. Then mark
ready and squash-merge only with an exact head-SHA lease.

[abrichr]

Structured-program attended receipts are pushed at exact head 6c20c87236627191dd67ebab5249050227dc93ab. The receipt contains no raw UI text/URL/title; it is HMAC-sealed with the per-run secret, atomically stored 0600 under a symlink-refusing private directory, and bound to run/workflow/bundle/pause/action/checkpoint sequence/graph state/exact frame/cursor. Resume authenticates and consumes the receipted guarded successor exactly once; it refuses cross-run/bundle/pause/state/frame replay and alternate-target substitution, and it never re-actuates the human-completed source action. Local gates: 293 dependency-focused, 47 attended/program, 13 release-contract tests, Ruff/format, mypy, Node syntax, wheel/sdist, and the actual MIT-only archive validator. Fresh protected CI is running. Draft remains dependency-gated on the active Flow release/pairing sequence; no merge/release yet.

[abrichr]

Rebase verification update (2026-07-18)

• Exact rebased head: f5f57a7ea630fc5866c1a05ec5b4dd24ccb39b0c
• Exact base: 30512ec1039790f29db7b2a1e3831f72fd91ed43 (region_stable invariant-preserving fix fix: preserve region stability across theme drift #153, after v1.17.0)
• The two attended commits replayed without conflicts. Pairing, localized structural region matching, and signed attended program receipts are all present in the combined tree.
• Combined focused integration: 278 passed (attended actions, console, replayer, hosted pairing, vision, and region-theme E2E).
• Full local browser E2E on the rebased tree: 95 passed, 5 skipped in 13m13s.
• Ruff lint/format, strict safety mypy, docs consistency, claims, PHI guard, release consistency, wheel/sdist build, installed-wheel import/CLI smoke, and MIT-only distribution-boundary validation passed.
• Built candidate hashes: wheel 02fc8e3dba1ded639b4509fb90ad6163a3d0dd46e444541b0c8a9199a1510156; sdist aac5048cf40bc188166106a4f8e8cc54a9b5c5db497a1a4dbed2ebcae02419f7.
• Protected lint, strict typing, claims, PHI, compatibility, interop, docs, Linux AT-SPI, and wheel checks are green; protected unit and browser jobs are still running.

Separate pre-existing optional-extra follow-up (not mixed into this PR): with local openadapt-capture installed, tests/test_capture_adapter.py::test_malformed_window_capture_marker_rejected expects “malformed window-capture metadata” while the #146 code emits “malformed capture_window metadata.” The fail-closed behavior is correct; only the message contract differs. The broad local run reached 1,053 passed / 8 skipped before the known RapidOCR/ONNX-heavy local path was bounded and stopped. This wording alignment will be handled separately; no functionality is disabled or skipped in #152.

[abrichr]

Independent post-runtime queue review (2026-07-19)

• Exact head remains f5f57a7ea630fc5866c1a05ec5b4dd24ccb39b0c; no attended functionality was narrowed, disabled, or made read-only.
• Every protected exact-head check is green, including unit, browser E2E, lint, strict safety typing, claims, PHI, compatibility, interop, docs, Linux AT-SPI, and wheel validation.
• Independent local attended/console verification passed 100/100, plus Ruff lint/format and git diff --check.
• The review rechecked the signed run/bundle/pause/frame/cursor binding, PHI-safe keyed transition baselines, exact program receipt validation, single-flight/idempotency journal, delivery-uncertain refusal, semantic Continue/Skip admission, live effect/postcondition revalidation, and preservation of ordinary console/CLI actions.
• Capture wording PR fix(capture): align malformed window marker error #154 changes only openadapt_flow/adapters/capture.py; feat(attended): execute governed halt actions #152 changes no capture paths. The changed-path intersection is empty and a synthetic merge tree over fix(capture): align malformed window marker error #154 exact head 685fd67238cc7ee8f1be78710d2e8989a442df95 is conflict-free.

This remains draft and unmerged until the v1.17.1 managed runtime promotion is confirmed. After #154 merges and its exact-main/release state is verified, #152 should rebase once on that exact result and receive fresh protected CI before merge. This avoids a redundant intermediate Flow release while preserving the complete attended action surface.

[abrichr]

Follow-up from the independent queue audit:

A linear attended Continue previously validated the signed pause before live verification but did not re-bind that exact pause immediately before committing its checkpoint. A concurrent normal durable CLI/operator process could replace the pending pause during verification, allowing the stale capability to approve the newer pause. The structured-program path already performed this final digest check.

Exact head 3406ca85617bec1002aa837d2faa828c75c6a8a5 adds the same fail-closed invariant to the linear path:

• re-read the pending pause after live verification;
• require its exact digest to equal the capability's signed pause_digest;
• refuse before checkpoint, approval, pending-status mutation, or continuation if it changed.

The adversarial regression replaces the pause after successful live verification and proves the action returns refused with no actuation, checkpoint, or approval and without overwriting the replacement pause.

Verification on the new head:

• focused race/normal/program tests: 3 passed;
• complete attended + console suite: 101 passed;
• Ruff lint/format and diff checks pass.

No action was removed or made read-only. Continue, Skip, Teach, and Escalate remain intact. Fresh protected exact-head CI is running; the PR remains draft and held behind the v1.17.1 production runtime promotion and #154 ordering gate.

[abrichr]

Final release-base checkpoint: exact head f27066a5353888544d3cd085d45d99f8e4faf953 is rebased on verified v1.17.2 release commit 597e06a7b042e6d6fe958e2bbdcd6509f9b7bdca. The additional structured-program TOCTOU regression replaces the pause after successful live verification and proves refusal before any receipt, program checkpoint, approval, or workflow actuation; the replacement pause remains intact. Post-rebase local gates: attended/console 102/102, Ruff, format, mypy, release consistency, consistency, claims, and diff checks all pass. Final protected CI: https://github.com/OpenAdaptAI/openadapt-flow/actions/runs/29674731479. Draft remains until that exact head is fully green.

[abrichr]

Final exact-head gate passed: protected run https://github.com/OpenAdaptAI/openadapt-flow/actions/runs/29674731479 completed successfully on f27066a5353888544d3cd085d45d99f8e4faf953; every applicable check is green. Exact base remains verified v1.17.2 597e06a7b042e6d6fe958e2bbdcd6509f9b7bdca, merge state is CLEAN, and the post-rebase safety/package audit is unchanged. Marking ready for exact-SHA squash merge.