Veritas Kanban 6.1.3 adds governed file artifacts, provenance-aware execution, operator Run Access controls, and recurring automation activation. It closes the August Apple-design audit and hardens concurrent storage and provider teardown paths. This is a backward-compatible patch release for 6.1.2 with additive REST contracts and SQLite migration 34.
What changed
Work Products can retain governed downloadable files with exact version, run, digest, media, quarantine, deletion, and storage evidence across file and SQLite backends. Bounded previews cover text, JSON, image, audio, video, PDF, archive, and opaque-origin HTML content, while causal provenance identifies repository, agent, command, tool, attachment, connector, downloaded, operator, and unknown file sources.
Executable, script, loader, configuration, archive, and load-path inputs now bind to exact bytes and provenance. External or unknown content requires fresh human approval and immediate pre-spawn revalidation. Effective Run Access provides one redacted digest of filesystem, command, network, tool, integration, credential, budget, provider, and historical authority, while active changes use exact compare-and-set evidence and durable reversal.
Recurring automation drafts and activation previews now bind standing authority, provider and workflow readiness, tools, integrations, targets, expiry, budgets, blockers, and human approval. Activation remains deterministic, revisioned, bounded, idempotent, and auditable.
Authentication errors now relate to their fields and announce without moving focus. Secondary actions reveal on keyboard focus and remain available on coarse pointers. The macOS shell adds standard Window and Help menus, shared motion is explicit and reduced-motion aware, and contention fixes harden admission persistence, ACP teardown, and atomic workflow reads.
Issue and pull request traceability
| Area | Issues | Pull requests |
|---|---|---|
| Work Products and previews | #1247, #1250, #1254 | #1270, #1278, #1285 |
| Run file provenance and execution | #1251, #1255 | #1277, #1286 |
| Run Access | #1248, #1252 | #1275, #1279 |
| Recurring automation | #1249, #1253 | #1276, #1280 |
| Apple-design and adaptive UI audit | #1256-#1260 | #1271-#1274 |
| Reliability follow-ups | #1261, #1264, #1266, #1268, #1281, #1283, #1287, #1289, #1291 | #1263, #1265, #1267, #1269, #1282, #1284, #1288, #1290, #1292 |
Install or upgrade
Back up the complete stopped-writer workspace before upgrading and retain the backup until the new runtime is accepted.
brew update
brew upgrade --cask bradgroux/tap/veritas-kanbanFor a first installation:
brew install --cask bradgroux/tap/veritas-kanbanThe Assets section provides signed and notarized macOS arm64 DMG and ZIP packages after the release workflow completes. Linux and Windows packages remain unsigned verification previews.
Compatibility, migration, and rollback
The public REST API remains v1; new routes and schemas are additive. SQLite migration 34 creates governed work-product artifact storage and indexes without rewriting existing Work Product rows. After migration, rollback to 6.1.2 requires restoring the complete stopped-writer 6.1.2 backup. Never open migrated data with an older binary or copy an older database over a running instance.
See the full release notes, upgrade guide, compatibility policy, and changelog.