OpenAdapt Flow 2.7.0: Task replay, signed write authorization

1. Replay a task performed once as a program

The new openadapt wrap command runs a task with input fields defined by the operator. On the first call, it runs the agent once, independently checks the saved trace, then converts the execution into a program and approves it. Subsequent runs replay the task with new inputs using the approved program, without calling the model again.

Tasks can also be served locally for other tools to call through MCP, a communication protocol for connecting tools. Callers use the input fields declared by the task. With a request identifier, repeated or interrupted calls return the existing run rather than sending the same write again.

Task inputs and target identity data shown to the model are replaced by typed placeholders, symbols standing in for actual values. When the model enters a placeholder, the execution tool inserts the real value, and saved results are read back and verified locally using real values. The source says the previous approach of simply masking names and ID numbers prevented the model from distinguishing target records.

Request size limits for models have also changed. According to the company, Claude's default limit per request just before transmission rose from 64 KiB to 4 MiB. It says runs that included a screenshot on every turn ended on the second turn under the old limit. OpenAI's default limit remains 64 KiB, with a configurable maximum of 32 MiB.

2. Teach save actions within human-signed limits

A human-signed authorization document can now be used when teaching save actions in a browser. It specifies the task, inputs, allowed origins, permitted writes, and prohibited actions. The initial run starts when authorization is verified and includes permitted writes, and clicks, keystrokes, and selections are checked against it. Commands to create, sign, and verify authorization are also provided.

Desktop and remote apps can also be taught save actions through MCP, after which approved tools can be called. Authorization documents also cover desktop and remote screens, and authorization for actions taught on the desktop is scoped to the relevant app.

3. Check the evaluator itself, not just execution results

In the mode that monitors clients writing directly to a database, the agent signals the start and end of each action. Flow checks predefined database change conditions for each action and changes between actions. Changes outside any action are classified as violations or uncertain, depending on whether the app's audit log identifies the agent user.

The new audit tool tests the environment's evaluator rather than the agent. It injects errors such as incorrect records or values and duplicate or partial writes into baseline runs, and also runs valid controls with unrelated changes. It reports cases that accept incorrect results or reject valid ones, along with Wilson 95% intervals showing uncertainty in estimated error rates. The source provides this command:

python -m openadapt_flow.verifier_audit run --target module:factory --out DIR

Paginated reads using REST, a web resource request-response communication style, and FHIR, a healthcare information exchange standard, require a stable-dataset guarantee and a declaration that all records were received. These requirements check that data stayed unchanged while pages were collected and that no records were missed.

4. Check execution targets and trace conditions when upgrading

Specify the target address or demo app for replay, and use full names for long command-line options.

Tasks with recorded locale settings, date order, and keyboard layout are checked against the current environment; older tasks without this information are excluded from those checks.

Identity information containing numbers, including dates, ages, and counts, must exactly match the values on the current screen as written.

Paginated reads remain inconclusive if the completeness declaration is absent, the dataset marker is missing or changes, identifiers are duplicated, or different identifier namespaces are mixed. Namespaces define the scope used to distinguish identifiers. Replay is rejected if environment information differs from the trace or cannot be read, and failed replays or uncertain results are held until a person approves repair.

5. Invest in approval procedures in exchange for fewer model calls

Using approved programs for repeated tasks can eliminate model calls and reduce duplicate writes. When a model is used for the first run, cost and runtime limits are applied before the call, and usage is reported afterward.

In return, operators must prepare authorization documents and independent trace checks when first teaching a task. Later repairs also involve human approval, signed reapproval, and small trial runs. The cost of saving model calls during repeated execution shifts to verification work during initial setup and repair.

Flow 2.7.0 reduces model calls for repeated tasks while embedding checks that establish write authorization and results more deeply into the execution flow.