fix: require Flow production release evidence

[abrichr]

Summary

• require an exact-SHA clean-machine Browser lifecycle on Linux, macOS, and Windows before release
• fail closed unless all three lifecycle jobs complete successfully and produce artifacts
• install one OpenCV distribution provider and verify its installed identity on every clean machine
• keep the full code matrix as an independent release requirement
• accept Capture window movement and resize while preserving one fixed encoded viewport
• consume Capture virtual-desktop coordinates, including negative-origin monitor layouts
• validate source geometry, content rectangles, scale factors, monitor topology, frame bounds, and action bounds

Why

The current release gate proves the source test matrix. It does not prove the built Browser wheel through install, record, compile, certification refusal, deterministic replay, verified drift replay, and uninstall on each supported OS.

It also installed two distributions that own the same cv2 package. rapidocr-onnxruntime 1.4.4 declares opencv-python>=4.5.1.48 by distribution name, and Python packaging has no provider/alias mechanism by which opencv-python-headless can satisfy that requirement. Declaring the headless distribution therefore did not replace opencv-python; it installed alongside it, and the resulting cv2 package was decided by install order. This change declares the one provider RapidOCR's published metadata requires and verifies the installed identity on every clean machine. It adds no new native requirement, because opencv-python was already being installed transitively in every environment.

The previous Capture adapter also treated a source-window resize as an invalid recording. A fixed encoded viewport does not require a fixed source window. This change keeps the output media contract fixed while it maps each resized source frame through the exact retained content rectangle and scale. It also supports the combined virtual desktop coordinate space from Capture PR #78.

Capture contract

The adapter now:

• permits source-window movement and resize when the encoded output viewport remains fixed
• rejects any encoded viewport change
• validates the retained source viewport, output content rectangle, and fit scale
• prevents legacy pixel_ratio from applying the same scale twice
• accepts the virtual_desktop_pixels coordinate space and its retained global origin
• validates monitor rectangles, monitor count, combined frame size, and action bounds
• rejects ambiguous window and desktop scope metadata
• retains privacy-safe virtual-desktop provenance for compilation and replay

This work depends on the Capture schema and capture behavior in OpenAdaptAI/openadapt-capture#78. That pull request is stacked on Capture PR #76. Do not merge or release this adapter as a supported contract before its Capture dependency lands.

Rebase note

This branch was rebased onto main at 16c9177, which added PR #367 (recording targets), PR #370 (bounded qualification and browser setup), PR #371 (claims gate requires passing evidence), and PR #363 (actions bump).

One semantic conflict was resolved rather than auto-merged. PR #367 deliberately removed the RDP backend_hints inference from the Capture adapter, because native Windows and macOS recordings use the same Capture primitive and must not be read as an RDP backend. This branch predated that removal. The resolution keeps main's removal and keeps only this branch's new desktop_capture provenance clause. tests/test_capture_adapter.py asserts "backend_hints" not in meta, and that assertion passes.

Evidence at this head

• 4876 unit tests passed, 35 skipped (the fast suite CI runs)
• 103 focused release-gate, release-contract, and Capture adapter tests passed
• scripts/check_release_consistency.py passed
• scripts/validate_claims.py --check --ci-job test passed: 20 claims, 11 supported, all cited test evidence passed
• scripts/check_consistency.py and scripts/check_bundle_phi.py passed
• Ruff lint, Ruff format, and mypy (240 source files) passed
• the wheel and the source archive were built and passed the distribution license boundary validator
• a clean-venv install of the built wheel reported exactly one cv2 provider, opencv-python, with cv2 5.0.0 importable
• the same clean venv confirmed the source-boundary carve: the public reliability mechanism imports while the frozen corpora, adversary corpora, and identity ROC tuning are absent
• .github/workflows/quickstart-lifecycle.yml changed, so the pinned inventory was regenerated with scripts/check_release_consistency.py --write-public-artifact-inventory and committed in the same commit

Release order — read before publishing

Flow 1.31.0 is already published on PyPI (uploaded 2026-08-09) and is immutable. It does not contain the new push-result contract. No Desktop production release may pin 1.31.0.

The correct order is:

1. Merge these reviewed Flow changes.
2. Dispatch CI in full-matrix mode and the Quickstart lifecycle on the exact release SHA. Semantic release waits for both exact-SHA runs and refuses partial, skipped, stale, or failed job sets.
3. Publish the next semantic release.
4. Update Desktop to that exact new package version and its hashes.

Both commits here are typed fix:, so semantic release would cut a patch. Note that the OpenCV provider change alters the installed distribution set, so a reviewer may prefer a minor bump.

Do not publish until the exact-SHA runs pass.

🤖 Generated with Claude Code