[abrichr]

Ports the Flow part of Play 5 (openadapt-flow feat/shadow-motif-mining) into packages/flow.

What it adds: openadapt_flow.compiler.motif_induction reads a shadow-episodes export (v2) from openadapt-capture's on-device motif mining. It turns repeated work into a candidate draft workflow. The code is deterministic, makes no model calls and uses no network. Digests stay out of drafts. A person must admit a candidate before it runs. See docs/SHADOW_CANDIDATES.md.

Includes three shadow-episode fixtures, listed in public-artifacts.json, and 26 tests in tests/test_motif_induction.py.

Related: capture side merged in openadapt-capture#156 (released in 1.3.0). Desktop side is openadapt-desktop#205.

Invariants: mining only proposes a draft. Nothing is admitted or authorized automatically, and replay of an admitted program still makes no model calls.

Local: ruff, ruff format, release-consistency pass; test_motif_induction.py 26 passed. Full suite on CI.

---

One admission command (added after review)

• openadapt-flow admit <recordings...> or admit --candidate ID compiles, induces and proposes checks. It then stops once with a short summary. accept applies the checks through accept_proposal, which re-runs the oracle gate. admit decide DIR decides later at a terminal.
• MCP: openadapt-agent serve --admissions DIR adds prepare_admission, list_admissions and decide_admission. A person decides in the client's form. With --delegate-approvals ID --approver-grant FILE, the agent decides as that delegated approver, under a grant a person signed (see below).
• admission-decision.json names who prepared and who decided. An agent can't decide what it prepared, and regulated needs a person. A decision binds the summary digest and the bundle digest. Shadow suggestions are never applied, and nothing is signed.
• Tests: tests/test_admit_pipeline.py (15) and packages/agent/tests/test_admission_tools.py (9). Both pass locally with the qualification-proposal, CLI-hints, motif and agent contract/CLI/README suites.

---

Admission sets "only problems" under a person-signed grant (added)

• An accepted admission admits the workflow to the problems_only approval mode. Its runs stop only for problems: a failed check, a changed screen, or a step outside what was qualified. They no longer stop before every save. openadapt-flow run reads this from the bundle's admission-decision.json and prints who admitted it. A --approval-mode flag or runtime.approval_mode still wins.
• The admitter is a person, or a delegated agent acting under an approver grant a registered person signed (openadapt-flow/approver-grant/v1 from Flow: person-signed approver grants, no self-approval, one-tap phone approval on the decision portal #1234). This replaces the unsigned delegate decision from feat(approval): delegated approvers, read-back field checks, triage and eligibility (carry-over of openadapt-flow#534) #1190. The grant must verify against the signer registry, name the agent, cover the workflow, and let an agent approve consequential saves. Otherwise the agent's decision is refused. The decision record keeps the grant's digest (policy_ref), its signer (on_behalf_of) and the signed grant itself.
• The mode applies only to the exact admitted bundle (any later change drops it). An agent's admission applies only while its grant still verifies (expired, swapped or narrowed grants drop it). problems_only keeps its own gates, so every save still waits for a person until the switch is earned.
• Tests: tests/test_admit_pipeline.py (25) and packages/agent/tests/test_admission_tools.py (9).

This branch now includes main and #1234's branch (merged, not rebased). Once #1234 lands, its commits drop out of this diff.

[abrichr]

Review before merge (main merged in; __main__.py conflict resolved by keeping both admit_default_form and main's no_outbound.enforce_from_env()). Commits 3e8eb85 and dc6a1e4 are still on the branch.

Fail-open paths found and fixed in 7a9aeb6, each with a test that fails without the fix:

Problem	Fix	Test
admission-decision.json was unsigned. Anyone who could write to the bundle could write a "person accepted" record and get problems_only	Pending and decision records are signed with the local admission key (same key and helpers as JIT admissions). admitted_approval_mode refuses an unsigned or edited record (admission_signature_invalid)	test_a_decision_file_written_without_the_admission_key_admits_nothing, test_a_signed_decision_edited_afterwards_admits_nothing
An edited admission-pending.json could relabel the preparer to get around the self-approval check	load_pending verifies the signature, and decide uses it	test_an_edited_pending_file_is_refused, agent test_a_tampered_pending_file_is_listed_but_never_shown
A server without --delegate-approvals records its preparer as mcp-client. The same agent could then decide on a delegate server	An agent can't decide what mcp-client prepared. A person still can	test_an_agent_cannot_decide_what_an_unidentified_client_prepared, agent test_a_delegate_cannot_decide_what_an_unidentified_client_prepared
MCP summaries carried induction's record-next lines and halt reasons, which can quote recorded labels ("Record each of X vs Y") to a client that may forward them to a hosted model	render_summary(value_free=True) for every MCP view and form: codes, counts and step ids only	test_the_value_free_summary_quotes_no_recorded_text

Checked and left as is:

• problems_only stays behind its readiness gate. Without a signed switch record, each save goes to a person. New end-to-end test: test_an_admitted_bundle_still_asks_a_person_until_the_switch_is_on.
• Candidates can't run: admitted and runnable are always false, there is no workflow.json, and accepting runs nothing.
• An agent decides only under a person-signed approver grant (Flow: person-signed approver grants, no self-approval, one-tap phone approval on the decision portal #1234) that is checked on every decision and on every run. The self-approval rule here is stricter than feat(jit): let the recording agent admit its own draft when the policy allows it #1249's allow_self_admission (it never allows it), which is compatible.
• Shadow episodes are value-free v2 data and the Flow side opens no network connections (existing tests).

Docs: new packages/flow/docs/LEARN_FROM_MANY_RUNS.md (status of induce, teach-branch and shadow mining), and SHADOW_CANDIDATES.md updated for the rules above.

Follow-ups, not done here:

• There is no CLI to turn a Capture episodes export into a candidate folder. Only the Python write_candidate exists.
• A person's MCP form decision is recorded as person:mcp-form. The engine can't tell who filled in the form.