Contract-to-CI Governance

ota.yaml remains the execution-governance authority.

Ota can inspect existing workflow files as onboarding and drift evidence, but generated CI is a provider adapter over contract truth, not a second contract.

• the provider-neutral projection owns selected lane, mode, bootstrap source, stable merge-check identity, assurance posture, and required evidence
• the GitHub adapter renders that projection without redefining the selected governance lane
• provider files keep triggers, permissions, credentials, runner selection, environments, deployments, notifications, and non-Ota jobs
• branch protection remains provider-owned; Ota can produce the required check, but the provider decides whether merge can bypass it

• projection identity is canonical and excludes provider YAML formatting and local file paths
• the provider adapter binds canonical projection identity, adapter version, generated content, and caller reference
• managed-file checks fail when contract-owned workflow content becomes stale or manually drifts
• required verification lanes have stable Ota-owned check identity instead of relying on brittle workflow display names
• provider execution re-evaluates observed input and claim evidence in its own checkout; render-time state is not execution proof

A positive verification check proves one lane still runs. A refusal canary proves the safety gate still refuses a selected unsafe lane.

• declare the canary in the contract
• run it through the same agent boundary using --expect-refusal
• make the generated canary check merge-required when the organization needs the gate to be non-optional
• do not imitate refusal with a shell condition; that tests the workflow, not Ota's runner boundary

• Ota does not replace GitHub Actions, GitLab CI, Bitbucket Pipelines, or another provider
• Ota does not own branch protection until the provider is configured to require the generated check
• projection does not prove the contract claim is correct; Contract-Claim Assurance remains a separate input
• bidirectional synchronization is intentionally rejected because it would create competing authority