OpenAdaptAI · abrichr · Jul 25, 2026 · Jul 25, 2026 · Jul 25, 2026
@@ -100,13 +100,12 @@ Production selects live mode explicitly. Development mock mode is visibly
 synthetic. A missing production dependency makes the affected operation
 unavailable rather than substituting a simulated success.
 
-The hosted recorder passed its bounded, non-simulated live-provider
-qualification on a Flow 1.8.0 worker. Authenticated live health qualified the
-exact-version replay and compiler service identities, and three independent
-pre-payment trials verified tenant-bound live Checkout and refusal before
-entitlement. The first genuine paid subscription extends that operational
-evidence through webhook activation, managed execution, usage, portal, and
-cancellation.
+The retained hosted-recorder qualification used a Flow 1.8.0 worker. The live
+runner and compiler now report the published Flow 1.23.0 identity, and public
+readiness checks live authentication, database, private storage, runner,
+compiler, recorder, callbacks, scheduler, retention, secret encryption,
+validation policy, and billing dependencies. That is configuration and service
+identity evidence, not a customer workflow qualification or SLA.
 
 Stripe is the commercial source of truth for pricing. This matrix does
 not create a price, quota, SLA, certification, or backend entitlement.

@@ -105,11 +105,11 @@ still apply, and `run` is honest about them:
   surface the action wrote to: **same-surface** confirmation, not an independent
   system-of-record check. A REST/FHIR/document-hash verifier reads the *record*;
   a screen read-back reads the *pixels*.
-- **Encryption is opt-in at authoring time.** `Workflow.save(..., encrypt=True)`
-  seals workflow JSON and template crops, but normal compilation writes
-  plaintext. `run` refuses plaintext by default; keep full-disk encryption as
-  defense in depth and use `--strict-templates` to refuse any unsealed image
-  asset.
+- **Encryption is opt-in at authoring time.** `openadapt flow seal SOURCE --out
+  DESTINATION` seals workflow JSON and template crops, but normal compilation
+  writes plaintext. `run` refuses plaintext by default; keep full-disk
+  encryption as defense in depth and use `--strict-templates` to refuse any
+  unsealed image asset.
 - **A green certification is scoped to what the policy asserts.** `certify`
   enforces the policy you wrote; a gap the policy does not name is not caught by
   `run`.

@@ -17,8 +17,9 @@ you explicitly push it to a [cloud workspace](connect-to-cloud.md).
 Get the installer from
 [openadapt.ai/download](https://openadapt.ai/download). The page detects your OS
 and architecture and offers the right build. Public Beta release
-`desktop-v0.10.0` ships the complete Windows, macOS, and Linux installer set with
-`SHA256SUMS` and per-platform provenance metadata.
+`desktop-v0.12.1` ships the complete Windows, macOS, and Linux installer set with
+`SHA256SUMS`, a CycloneDX SBOM, per-platform metadata, and build-provenance
+attestations.
 
 | OS | Installer |
 |---|---|
@@ -33,8 +34,9 @@ and can connect to Cloud for governed reports and updates.
 
 ## 2. Get past the first-launch OS warning
 
-The current builds are **not code-signed yet**, so your OS shows a one-time
-warning at first launch. Expected for unsigned software, not a download problem.
+The Windows/Linux builds are **unsigned** and the macOS builds are **ad-hoc
+signed**, so your OS can show a one-time publisher warning at first launch.
+Verify `SHA256SUMS` and the release provenance before overriding it.
 
 === "macOS"
 

@@ -32,7 +32,7 @@ module inside it:
 | [OpenAdapt](https://github.com/OpenAdaptAI/OpenAdapt) | **Supported** | Installer/meta-package and unified `openadapt flow` dispatcher. |
 | [openadapt-flow](https://github.com/OpenAdaptAI/openadapt-flow) | **Supported** | Canonical compiler and governed runtime. Drives web, native Windows, native macOS, native Linux, RDP, and Citrix/VDI as first-class substrates behind one backend protocol. |
 | [openadapt-cloud](https://github.com/OpenAdaptAI/openadapt-cloud) | **Supported** | Live control plane for the public managed-browser subscription: organizations, exact-hash admission, runner orchestration, reports, billing, and usage. |
-| [openadapt-desktop](https://github.com/OpenAdaptAI/openadapt-desktop) | **Supported** | Public Beta `desktop-v0.10.0` provides Windows MSI/NSIS, macOS arm64/x64 DMG, and Linux AppImage/DEB installers. Every installer path was installed, launched, and uninstalled in the native release workflow; the release includes exact checksums, platform metadata, and build attestations. |
+| [openadapt-desktop](https://github.com/OpenAdaptAI/openadapt-desktop) | **Supported** | Public Beta `desktop-v0.12.1` provides Windows MSI/NSIS, macOS arm64/x64 DMG, and Linux AppImage/DEB installers. Every installer path was installed, launched, and uninstalled in the native release workflow; the release includes exact checksums, a CycloneDX SBOM, platform metadata, and build-provenance attestations. |
 | [openadapt-agent](https://github.com/OpenAdaptAI/openadapt-agent) | **Supported** | Active v2 bridge that exposes governed Flow bundles to MCP clients and Agent Skills. The pre-v2 model-driven execution wrapper is the deprecated line; the repository itself is active. |
 | [openadapt-capture](https://github.com/OpenAdaptAI/openadapt-capture) | **Supported** | Canonical native screen, mouse, keyboard, timing, and window-scoped recorder behind Flow's Windows, macOS, Linux, RDP, and Citrix recording paths. Capture 1.1 retains Windows UIA evidence at action time; remote sessions remain externally black-box. Browser recording remains inside Flow's Playwright listener. |
 | [openadapt-privacy](https://github.com/OpenAdaptAI/openadapt-privacy) | **Supported** | Optional PII/PHI scrubbing used on configured persist, log, and upload paths. |

@@ -87,20 +87,20 @@ A real deployment must replace demo drift flags with explicit backend, effect,
 durability, and policy configuration:
 
 ```bash
-# 10. Prepare an encrypted candidate, then inspect and pass the run gate
-cp -R bundle-v2 bundle-prod
+# 10. Seal an encrypted candidate, then inspect and pass the run gate
 export OPENADAPT_BUNDLE_KEY='<inject from your secret manager>'
-python -c 'from openadapt_flow.ir import Workflow; w=Workflow.load("bundle-prod"); w.save("bundle-prod", encrypt=True)'
+openadapt flow seal bundle-v2 --out bundle-prod
 openadapt flow certify bundle-prod --config deployment.yaml
 openadapt flow run bundle-prod --config deployment.yaml --dry-run
 openadapt flow run bundle-prod --config deployment.yaml
 ```
 
 Follow [Run a deployment](../guides/run-a-deployment.md), then complete the
 [security and deployment review](../guides/security-review.md). Do not promote a
-bundle just because the sample-app tour passed. The base CLI has no dedicated
-`seal` verb yet, so the encryption step uses the shipped library API; key
-custody and rotation belong to the deployment.
+bundle just because the sample-app tour passed. `seal` preserves the source,
+refuses symlinks and an existing destination, encrypts the workflow and template
+crops, verifies the result, and expires any certification inherited from the
+source. Key custody and rotation belong to the deployment.
 
 ## Beyond one demonstration
 

@@ -53,11 +53,11 @@ customer-controlled runtime connected to the same governance model.
 | Native Linux backend | **Supported** | Required current-main job [`linux-atspi-x11`](https://github.com/OpenAdaptAI/openadapt-flow/actions/runs/30059807758/job/89378981573) at exact Flow commit `3de5fc67acf3024a621f812c5a6ed9be07fac335` ran one fresh GTK3 process per trial on Ubuntu 24.04 X11/AT-SPI. It confirmed 3/3 exact-file effects, 3/3 ambiguous-target refusals, and 3/3 stale-target refusals, with 0 silent incorrect successes, 0 over-halts, 0 operator interventions, and 0 model calls. | Native receipts prove AT-SPI delivery only; independent exact file bytes or confirmed absence prove effects. This is bounded to the in-tree GTK3 fixture and CI Xvfb image; it does not establish Wayland or arbitrary third-party application support. |
 | RDP backend | **Supported** | Two bounded results exercise complementary RDP paths. Aardwolf 0.2.14 over a Parallels Windows 11 VM completed 3/3 Windows Run-dialog file effects with independent guest-tools readback. The accepted full governed lifecycle at mechanism commit `6031fde` recorded, compiled, and replayed a synthetic note workflow through real FreeRDP3-transported pixels/input: 3/3 healthy effects and 3/3 drift safe-halts, with zero model calls, silent incorrect successes, false completions, drift writes, or healthy over-halts. Consequential remote actions now acquire a fresh frame, re-resolve target and identity, and use a one-shot input lease that refuses changed session context, pixels, dimensions, or readiness before delivery. Review the [Aardwolf/Windows report](https://github.com/OpenAdaptAI/openadapt-flow/blob/6610d24cebba27918b8ea507b2f05a094057ac85/benchmark/rdp/results_82a658a_20260718.sanitized.json), the [FreeRDP lifecycle report](https://github.com/OpenAdaptAI/openadapt-flow/blob/affedc5f1f0de533a0744deaa8e30a203c91c6b3/benchmark/rdp_ladder/results.json), [Flow PR #142](https://github.com/OpenAdaptAI/openadapt-flow/pull/142), [Flow PR #177](https://github.com/OpenAdaptAI/openadapt-flow/pull/177), and [Flow PR #238](https://github.com/OpenAdaptAI/openadapt-flow/pull/238). | The Windows batch qualifies its exact task, snapshot, transport, and oracle. The FreeRDP batch qualifies a synthetic Linux Tk task over a real RDP round trip; it is not Aardwolf, a Windows-app qualification, Citrix ICA/HDX, or WAN-captured drift. The two-phase mechanism is separately covered by runtime and backend refusal tests; it does not enlarge those bounded application results. |
 | Citrix / VDI backend | **Supported** | The dedicated `--backend citrix` path selects the exact Citrix Workspace/Viewer owner, optionally binds an exact title, requires a readiness marker for governed `run`, carries the closed target into durable resume, and uses the shared pixel identity, effect, policy, and halt contracts. Consequential input reacquires the exact client window, focus, geometry, readiness, fresh pixels, resolved target, and record identity, then refuses any change before the first input edge. The accepted no-DOM qualification completed 3/3 healthy effects and 3/3 severe-drift safe-halts with 0 model calls, silent incorrect successes, false completions, healthy over-halts, or drift writes. Review the [immutable report](https://github.com/OpenAdaptAI/openadapt-flow/blob/f6faac5b900b78cbda5980de0e983a9f987285ac/benchmark/citrix_workspace/results.json), [Flow PR #183](https://github.com/OpenAdaptAI/openadapt-flow/pull/183), and [Flow PR #238](https://github.com/OpenAdaptAI/openadapt-flow/pull/238). | The accepted artifact explicitly records `code_readiness_accepted: true` and `ica_hdx_accepted: false`. It qualifies the shipped Citrix Workspace-window backend contract over a no-DOM canvas stand-in, not a counted real ICA/HDX batch. The exact ICA/HDX client, codec, latency, DPI, lock/readiness, input, identity, and effect matrix is a separate per-deployment qualification boundary. |
-| Desktop authoring GUI and tray | **Supported / Beta** | Public `desktop-v0.10.0` provides Windows MSI/NSIS, macOS arm64/x64 DMG, and Linux AppImage/DEB installers. All six installer paths were installed, launched, and uninstalled in the native release workflow; the published set includes checksums and per-platform provenance metadata. | Builds are not yet fully code-signed/notarized, so verify `SHA256SUMS` and provenance before overriding the OS publisher warning. The app and CLI drive the same released compiler/runtime. |
+| Desktop authoring GUI and tray | **Supported / Beta** | Public `desktop-v0.12.1` provides Windows MSI/NSIS, macOS arm64/x64 DMG, and Linux AppImage/DEB installers. All six installer paths were installed, launched, and uninstalled in the native release workflow; the release includes `SHA256SUMS`, a CycloneDX SBOM, per-platform metadata, and build-provenance attestations. | Windows/Linux remain unsigned and macOS is ad-hoc signed, so verify checksums and provenance before overriding the OS publisher warning. The app and CLI drive the same released compiler/runtime. |
 | Hosted CLI connectivity | **Supported / public offer** | `login`, exact-hash artifact preparation/upload, one-time runtime validation, bound replacement activation, and `report-break` connect the local engine to the live control plane. | Upload requires destination policy and an approved sanitized derivative; checkout never bypasses an egress refusal. |
 | Artifact sanitation and local review | **Supported / launch gate** | The sanitized-derivative pipeline inventories, transforms, rescans, manifests, hashes, and supports local review/approval. | The raw original remains sensitive; unknown or unresolved content is refused; runtime observations can reintroduce PHI/PII. |
 | Cross-engine hosted validation | **Supported / launch gate** | `validate-hosted` binds an approved recording and bundle, compiler provenance, strict lint, policy certification, derived risk class, and successful replay report to a one-time Cloud challenge. | It is operator self-attestation signed with the ingest token, not an independently observed certification. Exact deployment policy, risk-class, and deployed compiler-version allowlists still apply. |
-| Hosted browser recorder and runtime health | **Supported / bounded launch component** | A non-simulated hosted browser session on `openadapt-flow` 1.8.0 produced PNG frames and retained input evidence, assembled a compileable recording, finalized one workflow idempotently, enforced resource limits, and cleaned up ephemeral qualification data. Authenticated live health probes also qualified the exact-version replay and compiler service identities. | Explicitly initiated, public-HTTPS, non-regulated authoring only. Raw observations remain private inside the declared hosted boundary. Health proves deployed service identity and reachability, not a paid checkout-to-run lifecycle or successful managed replay. |
+| Hosted browser recorder and runtime health | **Supported / bounded launch component** | A retained non-simulated hosted session on `openadapt-flow` 1.8.0 produced frames and input evidence, assembled a compileable recording, finalized one workflow idempotently, enforced resource limits, and cleaned up ephemeral qualification data. Authenticated live health reports the current published 1.23.0 runner/compiler identity and checks auth, database, storage, callbacks, scheduler, retention, secrets, validation policy, and billing. | Explicitly initiated, public-HTTPS, non-regulated authoring only. Raw observations remain private inside the declared hosted boundary. Readiness proves deployed dependencies and service identity, not a customer workflow qualification or SLA. |
 | Hosted dashboard/control plane | **Supported / public offer** | Authentication, organizations, exact-hash bundle ingest, immutable run admission, browser runner orchestration, structural reports, replacement activation, billing, and metering form the managed lifecycle. | Production uses live dependencies and fails unavailable rather than substituting mock behavior. |
 | Hosted execution | **Supported / public offer** | Live Stripe Checkout connects onboarding and subscription entitlements to managed browser execution; the runner verifies exact admitted bundle bytes and authenticated callbacks. | The public subscription covers approved browser workflows. Other substrates use separately scoped deployments and commercial terms. Checkout does not create an SLA or certification. |
 | Air-gapped on-prem package | **Supported** | A local queue, systemd unit, minimized hash-chained audit log, and air-gap checks are provided. | Full-disk encryption and operational hardening remain operator/deployment responsibilities. |

@@ -139,16 +139,20 @@ holds the disk key). At-rest protection has three layers:
 |---|---|---|
 | The disk holding `storage_root` (bundles, runs, audit, frames) | **Operator full-disk encryption** (LUKS / BitLocker / FileVault) | REAL: the primary PHI/PII-at-rest control. Operator-provisioned |
 | The identity band inside `workflow.json` | **Salted-hash `identity_template`** (no plaintext name / DOB / MRN; optional external `OPENADAPT_FLOW_IDENTITY_SALT`) | REAL. A hash of a low-entropy identifier is brute-forceable by a holder of both bundle and salt, so it is **not** a cryptographic seal |
-| The bundle `workflow.json` + durable checkpoints | **Opt-in AES-256-GCM sealing** via `OPENADAPT_BUNDLE_KEY` (`Workflow.save(encrypt=True)`; scrypt-derived key) | REAL (opt-in, shipped). A wrong/missing key or tampered ciphertext fails loud and safe |
+| The bundle `workflow.json` + durable checkpoints | **Opt-in AES-256-GCM sealing** via `OPENADAPT_BUNDLE_KEY` (`openadapt flow seal` for the bundle; the same key for runtime checkpoints) | REAL (opt-in, shipped). A wrong/missing key or tampered ciphertext fails loud and safe |
 | `templates/*.png` (recorded screen crops of identifiers) | **AES-256-GCM sealing with the bundle key** plus full-disk encryption and governance guards | REAL when bundle encryption is enabled; plaintext crops are removed after sealing and authenticated ciphertext is verified on load |
 
 Enable the per-bundle seal for cryptographic at-rest protection that does not
 depend solely on the volume:
 
 ```bash
-export OPENADAPT_BUNDLE_KEY=…            # seals workflow.json, template crops, and checkpoints
+export OPENADAPT_BUNDLE_KEY=…
+openadapt flow seal bundle-v2 --out bundle-prod  # seals workflow.json + template crops
 ```
 
+Run and resume the sealed destination with the same injected key so durable
+checkpoints are encrypted as they are written.
+
 !!! warning "Identifier crops remain regulated data"
     The identity check needs a **rendered crop of the identifier** (an image of
     the MRN / name as it appeared on screen), stored as `templates/*.png`. These