otaExecution governance for humans and AI agents.
Get startedGitHub

Operations · Lesson 01 of 02

CI projection

Ota compiles provider-neutral governance truth into a managed adapter while the CI provider retains scheduling, credentials, runners, and delivery policy.

LearnOperationsIntermediate9 min read1.6.26+2026-08-24

Learning objectives

  • Render a provider-neutral CI projection and GitHub adapter
  • Explain the one-way authority from ota.yaml to managed CI
  • Check and reconcile generated-file and caller-reference drift

Prerequisites

CI projection compiles Ota-owned governance truth into a provider-neutral model, then renders a narrow provider adapter. This removes duplicated setup and verification truth without trying to replace the provider's pipeline language.

One-way authority

ota.yaml remains canonical. Ota owns selected lanes, bootstrap source, stable merge-check identity, admission requirements, and proof boundaries. GitHub owns triggers, permissions, credentials, runner selection, environments, deployments, and non-Ota jobs.

Inspect the provider-neutral projection
ota ci projection --workflow verify --target-os linux --json
Render and check the GitHub adapter
ota ci github render --workflow verify --target-os linux --output .github/workflows/ota-governance.ymlota ci github check --workflow verify --target-os linux --output .github/workflows/ota-governance.yml --caller .github/workflows/ci.yml

Render, check, then sync

Render is deterministic output, check detects stale or manually changed generated governance, and sync explicitly updates an Ota-owned generated file. Ota refuses to overwrite provider files outside its ownership boundary.

Canonical terminology

ci-projectiongithub-actionsmanaged-workflow

Commands and expected output

Inspect provider-neutral truth
ota ci projection --workflow verify --target-os linux --json
Check the GitHub adapter
ota ci github check --workflow verify --target-os linux --output .github/workflows/ota-governance.yml --caller .github/workflows/ci.yml

Evidence boundary for this lesson

Establishes

  • The worked examples establish the lesson's canonical Ota distinctions for its stated scope.

Does not establish

  • Reading the lesson does not validate a repository, execute its tasks, or establish organizational acceptance.

Knowledge check

Which CI concerns remain provider-owned after Ota projection?

Triggers, permissions, credentials, runner selection, environments, deployments, and non-Ota jobs remain in the human-owned provider caller.

Relevant specifications