Ota v1.6.26 Now Available: Protected Execution Foundations and Receipt History

Idea

v1.6.26 closes the bounded V11.7 OSS audited-crossing slice.

Prior releases built execution governance: what should run, what closure to consume, when replay is allowed, whether cleanup was witnessed. The next boundary was authority: who decides whether work executes, and how do downstream consumers verify that decision independently?

v1.6.26 addresses this through the Linux systemd protected launcher. The release does not attempt provider attestation or cross-organization trust separation. Instead, it establishes a bounded first-class path where:

• the contract specifies whether execution is allowed or explicitly disabled
• the launcher independently attests each boundary before Ota processes an authorization request
• the crossing evidence chain becomes explicit and re-verifiable through receipt history
• receipt history immutably records each decision and persists independent archives
• operator-driven recovery preserves exact evidence through failures and reboots

The evidence is locally-bounded: independently administered Linux/x64 systemd production pressure proves the consumer-only positive path, while separately verified crash/reboot recovery preserves evidence through failures. Provider attestation remains open.

Feature

1. Closed the bounded V11.7 OSS audited-crossing slice

v1.6.26 completes the production-client and independently administered hardened-launcher acceptance branches.

Immutable Linux/x64 PID 1 runs 31939777636 and 31953535665 prove:

• Production client with protected receipt history, one-use selected execution, and terminal cleanup
• Exact archive reconciliation and administrator-driven reboot/fault recovery
• Repository state unchanged, complete terminal cleanup, zero invalid protected archives

Provider attestation remains optional stronger hardening rather than an implied V11.7 requirement. Contract-authored governance.crossing_requirements is explicitly deferred to follow-on work.

2. Production protected receipt-history Core surface

ota receipt --history --source systemd_protected_launcher adds immutable receipt history anchored to the Linux systemd launcher:

ota receipt --history --source systemd_protected_launcher --json
ota receipt --history --source systemd_protected_launcher --archive-identity sha256:<hash>

The bounded manifest binds:

• Admitted non-agent operator profile and live peer
• Repository and catalog identities
• Three content-addressed objects per entry: receipt archive, immutable contract snapshot, launcher-finalization sidecar

Core reconstructs exact bytes and applies existing semantic archive verifier. Optional --archive-identity selects one exact archive without exposing protected paths.

Local history remains default and now publishes explicit source and completeness posture in text and JSON.

Immutable Linux/x64 PID 1 run 31823037642 proves the installed production invocation client and protected-history source against exact Protocol, Core, and Launcher revisions with one valid protected archive, zero invalid archives, unchanged refusal worktrees, and no private signing material.

3. Execution-disabled systemd-launcher posture gate

The release adds bounded execution-disabled foundations through the protected launcher.

Core verifies signed V3 systemd launcher and job-principal attestation, but the launcher deliberately withholds authorization before exact scope, cgroup, child, and active-slot cleanup. The result is:

• posture_admitted_before_authorization_boundary_removed typed refusal
• Zero selected work, lease consumption, receipt, or archive
• Exact terminal cleanup preserved

Immutable Linux/x64 PID 1 runs 31561247605 and 31389237232/31389713244 prove execution-disabled allowed, denied, stale, wrong-scope, protected-installation/runtime drift, missing-credential, and crash-recovery paths with independently re-verifiable public signed decision/relay identities.

4. Protected systemd V3 one-use lease consumption

After exact admission, the launcher atomically consumes a signed lease from the broker before spawning work:

• One-use leases are consumed only once; reuse is cryptographically refused
• Core binds pending transaction posture to private persistence
• Launcher persists consume intent before relay and records signed response

Immutable Linux/x64 PID 1 systemd run 31631358796 proves one-use consumption, identical-lease already_consumed refusal, crash recovery, byte-identical repository state, and zero terminal slots/scopes.

5. Selected execution and receipt archives

Once the lease is consumed, Core may execute only the frozen work unit:

ota run <task> --grant <crossing_authority_id>

The launcher persists completion evidence before Core exits, verifies child reaped and scope removed, and persists launcher-owned finalization. Core then independently verifies both launcher signatures and every identity relationship.

Immutable Linux/x64 PID 1 pressure run 31664495937 proves completed, failed, interrupted, replay-refused, and crash-recovered selected execution with exact child, scope, cgroup, and active-slot cleanup.

V3 receipt archives accept only launcher-active-slot transactions. Receipt history preserves the carrier distinction and refuses to reinterpret legacy broker or signed-file carriers as V3.

6. Portable launcher finalization

v1.6.26 adds the portable protected-systemd launcher-finalization path.

New launcher-owned crossing transaction schema v3 is bound into the signed consume exchange and requires broker-archive schema v2 plus portable finalization verification. Historical transaction v2 and broker-archive v1 evidence retain original compatibility.

The launcher retains protected post-cleanup recovery state until the client acknowledges a producer-signed sidecar binding exact cleanup evidence, receipt-archive identity, and crossing transaction. Core durably publishes the exact execution receipt archive before emitting launcher completion. The root launcher reopens that private archive through the execution-principal repository descriptor, requires exact owner, content, and transaction identity, and atomically publishes the root-owned sidecar; the job principal only acknowledges it.

Signed profile bindings include CAP_DAC_OVERRIDE in the exact bounding set, solely so the root launcher can traverse private hierarchies inside its protected mount namespace.

Immutable PID 1 crash pressure and the production operator client are included in the released
bounded carrier; stronger provider-attested separation remains a follow-on boundary.

7. Honest launcher crash-recovery evidence

Live systemd finalization keeps directly observed exit and child-reaped posture; restart recovery uses signed finalization schema v2 with recovered_absent_completion_bound, verified child absence, and no claimed observed exit or reaping. Receipt history re-verifies either exact version without upgrading legacy evidence.

Immutable Linux/x64 PID 1 run 31758094819 proves the corrected portable-finalization path, one-use consumption, exact crash recovery, and valid archive history.

8. Refined active-execution admission

v1.6.26 refines native service listener conflicts around actual resource ownership:

• Fixed or Ota-managed dynamic listeners: Long-running tasks bind fixed, Ota-managed dynamic, isolated, or unresolved runtime listeners across their complete execution closure, including hooks.
• Native and container coexistence: Services can coexist when their projected host endpoints and effective write namespaces are disjoint.
• Ancestor/descendant path conflicts: Shared write and env-materialization paths now conflict on ancestor/descendant overlap, not exact text only.
• ota run <task> --host-port <port>: Directs native service execution. Container and Compose lanes remap only the host publication; direct native lanes apply the port to both canonical bind and projected host endpoint. Ota reprojects typed launch arguments and runtime environment values.
• Clear conflict reporting: "Host port already in use" now names requested and active execution modes plus endpoint owner, suggests truthful --host-port <free port> rerun, and preserves existing run-summary layout with additive Reason and Host port rows.

9. Fixed interactive native task closures

The release fixes interactive native task closures so typed hydration and bootstrap phases retain Ota's canonical 🦦 loader instead of inheriting terminal ownership from a later interactive command.

On Unix, Ctrl-C now terminates Ota's complete native child process group and waits for it to settle before emitting the interrupted summary, preventing late npm output after Ota reports completion.

Native task progress loaders now show selected execution class explicitly, for example Running setup:dev (native), matching existing container and remote labels.

10. Schema embedment and version pinning

v1.6.26 removes the source checkout's absolute CARGO_MANIFEST_DIR from production schema discovery. Published JSON schemas are now embedded into the Ota binary, so installed or relocated source builds validate machine output against their exact version-matched schema set without a source checkout or compiler-path dependency.

The release also emits the full 40-character source commit from ota --version --json so protected deployment evidence can bind the installed Core binary to one exact source revision.

11. Wildcard tool-version handling

Treat wildcard (*) task tool and runtime requirements as executable-availability requirements when a present command does not expose parseable version output. Pinned requirements still fail closed when Ota cannot establish the installed version.

This keeps POSIX sh tasks portable to Debian and Ubuntu systems where dash --version exits nonzero without weakening version pins.

12. Compatibility-preserving profile support

Add compatibility-preserving support for the separated-producer ota.authority-launcher.systemd/v2 profile. V3 broker bindings and the published receipt schema require an exact registered profile-ID/identity pair. Legacy V1 evidence remains verifiable but cannot be relabelled as V2. Complete ota.authority-launcher.systemd/v3 and ota.authority-job-principal.systemd/v2 verification branches re-derive ordered launcher and job-principal observations, nested identities, protected socket source, and limited-primary-group posture from signed evidence.

Boundaries

The most important v1.6.26 behaviors are what it qualifies and refuses to imply:

• execution-disabled posture proves no work runs, not that the launcher is trustworthy
• protected receipt history proves exact archive binding, not system-level secret protection
• launcher crash recovery preserves evidence through failures, not immunity from crashes
• locally-bounded independently administered pressure proves consumer-only operation, not provider attestation or cross-organization trust
• V3 receipt archives accept only launcher-active-slot transactions; legacy carriers remain in their original branches
• one-use lease consumption prevents duplicate execution within a transaction; it does not prevent replay across different invocations
• a successful protected execution does not prove downstream deployment or production health

Those are not disclaimers around the product. They are part of the product contract.

Docs

Use the live references for protected execution, receipt history, and crossing-evidence semantics:

• Install Ota
• Protected Execution
• Broker Crossing Authority
• Execution Receipt
• Command Reference
• Contract Reference

Release

Install or upgrade to the released version, then inspect the contract and protected-execution surface:

ota upgrade
ota --version --json
ota validate
ota doctor --json
ota tasks --safe --use

For protected execution and receipt history:

ota receipt --history --source systemd_protected_launcher --json
ota run <task> --dry-run --json
ota run <task> --grant <crossing_authority_id> --dry-run --json

The canonical release and complete patch-level changelog are available at
ota.run/releases/v1.6.26.

v1.6.26 closes the bounded V11.7 OSS audited-crossing slice through locally-bounded protected-launcher foundations: not only what should run and what proof exists, but which boundaries admitted it, how launcher isolation prevented unauthorized work, and what immutable receipt archives capture each decision through recovery scenarios. Provider attestation and cross-organization trust separation remain open for follow-on work.

Pressure and Evidence

The entire protected-execution stack was shaped by production pressure on isolated Linux/x64 systems:

• Installation and runtime drift: Invalid credentials and launcher-startup failures preserve zero selected work.
• One-use lease consumption: Identical lease-reuse is cryptographically refused; fresh invocations require fresh authorization.
• Crash recovery and restart scenarios: Launcher crash pressure and administrator-driven reboot recovery preserve exact evidence through multiple transitions.
• Execution-disabled posture: Core admits the contract, but the launcher withholds authorization and emits a typed refusal with exact scope, cgroup, and child cleanup.
• Receipt history and archive verification: Protected receipt history verifies exact archive, contract snapshot, and finalization sidecar identities without exposing private paths.

All evidence is immutable Linux/x64 hosted proof bound to exact Core, Launcher, and Protocol revisions. Independently administered Linux/x64 PID 1 production pressure (runs 31939777636, 31823037642, 31953535665) proves the consumer-only positive path and administrator-driven recovery branches.

Provider attestation and cross-organization trust remain open as stronger follow-on boundaries. The
independently administered launcher, portable finalization, and operator attachment surfaces are
part of the released bounded carrier.

The complete bounded V11.7 OSS slice is live. Follow-on work includes contract-authored governance.crossing_requirements, provider-attested separation, and broader multi-system authority delegation.

---

Originally posted here: https://ota.run/blog/ota-v1-6-26-release-essay