Veritas Kanban 6.3.0 adds optional ChatGPT identity sign-in and an opt-in OrcaRouter integration, completes the repository audit backlog, and improves task editing, recurring work, native navigation, storage reliability and client tooling. Both integrations remain disabled unless explicitly configured.
Optional integrations
ChatGPT sign-in links a verified OpenAI identity to an existing Veritas user. Start from an existing authenticated session in Settings → Security; matching email addresses never claim an account or create membership. Authorization Code with PKCE, state and nonce protects the flow, signed ID tokens are verified, and encrypted one-time transactions expire after ten minutes. Existing workspace membership governs current sessions, including role changes and removal. Password sign-in and recovery remain available. Activation requires an approved OAuth client and the exact registered callback. A live provider login has not been verified. See the setup and account-linking guide (#1639).
OrcaRouter is an opt-in profile for Codex CLI 0.155.1 with an explicit model, the fixed Responses gateway, and a server-side environment credential reference. Existing defaults stay in place, credentials are isolated to the selected profile, and managed execution keeps its admission, authority, sandbox, tool and supervision controls. Unsupported workflow execution is rejected before dispatch. Five checks using the actual pinned executable passed against a synthetic provider, covering tools, authentication rejection, rate limiting, stream interruption and cancellation. Live OrcaRouter compatibility is unverified: no real gateway request or task was tested. Actual upstream identity and gateway billing cost may be unavailable. See the setup, privacy, removal and acceptance guide (#1546, #1708).
Task editing and realtime behavior
Debounced edits stay bound to their originating task. Closing or navigating away finishes pending writes; failed or conflicted drafts remain recoverable when the task is reopened during the current app session. Draft recovery does not promise persistence across an application restart. Child-collection mutations apply atomically with their revision check, and board-filter URL changes preserve task navigation history (#1606, #1612, #1613, #1628).
Callbacks from replaced WebSocket connections are ignored, disconnected boards recover their fallback refresh, preview polling reads the current query status, and Squad realtime updates preserve the active filter and bounded cache. Compact Workbench collapse restores the visible opener only when the disappearing dock owned focus, including responsive opener replacement and early browser frames; active task focus and history remain intact (#1624–#1627, #1629).
Template editor clear controls stay in the keyboard sequence, support Enter and Space, and return focus to their field (#1721, #1723).
Recurring work and durable storage
Approved start times apply to automatic and manual runs. An early request is rejected without consuming run budget, and the automation stays active for its schedule. Overlap policies now have distinct durable outcomes: skip drops the overlapping window and stays active; forbid blocks until operator resume; queue-one retains the earliest waiting window and drops further overlap. Waiting work consumes budget only when admitted and rechecks current policy. Failed workflow usage contributes to aggregate budgets, and retained claim history preserves active or unreconciled work (#1608, #1609, #1621).
Journal persistence completes every byte before acknowledging a durable record. Shared-resource load failures preserve the previous data instead of replacing it with an empty collection. PDF text extraction accepts its documented byte input correctly (#1605, #1607, #1704, #1705).
Native desktop
Task links reach the ready, authenticated renderer and open the exact task and requested section. Cold-start links wait through login; unavailable tasks produce a visible message; ordinary Command Center menu behavior is preserved. Focused packaged checks covered existing-app and cold-start links using a disposable profile and synthetic login (#1619, #1694).
Legacy migration is a durable one-time operation. If startup detects an interrupted migration, it stops with recovery instructions and preserves both copies for explicit operator recovery. Managed shutdown is bounded even when an owned process ignores its initial termination request. The desktop dependency refresh stays within Electron 44.x (#1602, #1614, #1597).
CLI, MCP and development
CLI and MCP describe admission-queued launches accurately, accept the shared Critical task priority, preserve parseable GitHub configuration JSON, and apply bounded transport policy to text and binary responses. Provider readiness enforces the selected harness version rather than treating executable presence as compatibility proof (#1615–#1618, #1706, #1707).
The documented development command builds shared code before starting the app and watches it for subsequent changes. Cleanup signals only processes proven to belong to the checkout. Browser tests own disposable endpoints, data and synthetic credentials, and the demo seed follows the current API with visible partial-import failure. Mobile browser tests follow the existing filter disclosure and browser-specific setup flow (#1610, #1611, #1622, #1623, #1630, #1631).
Initial pages load less JavaScript. Shared-run controls load on their own route with the existing loading and unavailable states, and optional UI modules follow the existing lazy boundaries. The production bundle stays within the maintained initial and lazy-chunk budgets (#1726, #1728).
Security and maintenance
Production and development dependencies were refreshed, including the MCP SDK, text extraction, HTTP middleware and supporting tooling. Client, permission, request and persistence boundaries were strengthened, and local HTTP development retains its intended Content Security Policy behavior. Advisory-specific details are intentionally omitted. Historical hosted scan counts are not a fresh code certification (#1601, #1620, #1638, #1678, #1680, #1736, #1737).
Local macOS capture and promotion preserve signing, notarization, Gatekeeper, exact native and media evidence, source identity, distribution hashes and destination readback without GitHub CI. Existing login-Keychain signing identities and notarization profiles can be reused without exporting a private key. Retention seals establish artifact identity; successful build or source preflight alone does not establish release acceptance (#1709–#1712). Documentation publication preserves historical capture provenance and verifies fresh media in current guides (#1742, #1743).
The production ARM64 container retains the full pinned provider runtime under the approved 250,000,000-byte compressed-image budget; the AMD64 budget remains 600,000,000 bytes. The ARM64 candidate measured 238,236,315 bytes and passed non-root, storage, backup, authentication, health and clean-shutdown checks. No provider capabilities were pruned (#1738, #1739).
Upgrade and compatibility
Root, shared, server, web, CLI, MCP and desktop versions move together to 6.3.0. The REST API remains v1. SQLite migrations 35 and 36 add unique external-identity bindings and short-lived encrypted sign-in transactions. Back up the complete stopped-writer workspace before upgrading, retain it through acceptance, and use the matching backup if a downgrade requires recovery. Follow the upgrade and recovery guide; do not resolve an interrupted legacy migration by deleting either retained copy.
The supported macOS distribution consists of the Apple silicon DMG and ZIP, their blockmaps, checksum sidecars and updater metadata. Linux and Windows distribution remain separate from this macOS release. ChatGPT plan inference, automatic partner enrollment, verified live OrcaRouter compatibility, and replacement of an existing installed application are not implied by this release.