[abrichr]

What kind of change does this PR introduce?

Release preparation: openadapt-flow 2.7.0.

Summary

Versions: openadapt-flow 2.6.0 -> 2.7.0 (minor). Since 2.6.0, main has new
features (feat: commits, including openadapt wrap) and fixes, and no
BREAKING CHANGE commits, so the repository's semver rule gives a minor bump.
Changes that make some runs refuse are listed under "Upgrade notes", as in 2.6.0.

The launcher half is in a separate draft, release/launcher-1.21.0 (openadapt
1.21.0 on Flow 2.7). It follows the same order as #1844 and then #1850: the
launcher lock and platform manifest can only be regenerated after PyPI serves
Flow 2.7.0.

Merging this PR publishes Flow 2.7.0. release-package.yml treats a merged
version bump as the authorization. It publishes after the next green Packages
run on main, subject to the pypi-flow environment protection. Do not merge
until the founder approves.

Changelog summary (full text in packages/flow/CHANGELOG.md, ## v2.7.0):

• openadapt wrap runs one operator-configured agent task. The first call runs the agent, checks the saved record, compiles the run and admits it. Later calls replay it with new inputs and no model calls. --serve offers the task as a stdio MCP tool, request IDs stop a repeated call from writing twice, and spend and time caps apply before each model call.
• Browser teach writes under a person-signed teach authorization. Every click, key and select is checked against it.
• An agent can teach and call a save on desktop and remote apps over MCP. Native authoring trees are available on Windows (UIA), macOS (AX) and Linux (AT-SPI).
• Verifier audit (python -m openadapt_flow.verifier_audit) tests an environment's own scorer with injected faults and reports false accepts and false rejects per fault family.
• Database shadow mode watches agents that write directly to a database, with an optional guard.
• Writes stay provisional while a history recheck is owed. Incomplete history is refused.
• Reusable, versioned subroutines are re-admitted on every run.
• A safe expression language computes parameters between steps and evaluates effect predicates. It has no eval.
• API steps cover multipart saves, the clicked button's value, and saves sent by page scripts.
• A new record-write certification policy covers non-clinical systems of record.
• Setup learns how a record reader maps to database rows and columns, and drafts REST read setups from explicit API semantics.
• Taught-tool parameters can be bound to intake provenance. Regulated approvals can require a named-person binding (WebAuthn, OIDC or SAML).
• Explicit retention and sealed-set key rewrapping. Strict at-rest mode encrypts every run directory.
• CLI commands are grouped into 15 tasks, and every earlier name still works as an alias.
• Upgrade notes: replay needs --url, backend.url or --demo-app. Abbreviated long options are rejected. Paged REST and FHIR reads must declare completeness. FHIR query parameters are refused. Locale, date-order and layout facts can refuse replay. Identity bands are stricter for digit tokens. SQLite rows are hashed with their storage class.
• Fixes: a headed browser no longer hangs on first launch, and startup refuses when frames don't advance. Confirm-dialog clicks keep write safeguards. Early rechecks stay pending. The space bar stays as typed text.

Checklist

• python scripts/check_release_consistency.py: version 2.7.0 is synchronized across project, module and lock
• python scripts/validate_claims.py --check --structure-only: passed (27 claims, 18 supported)
• --stamp-release-inventory, uv build --wheel --sdist, --validate-dist-dir: the license boundary passed for both dists, and public-artifacts.json was restored
• The built wheel contains openadapt_flow/wrap/{__init__,cli,mcp}.py (693 files)
• packages/flow/tests/test_release_contract.py, test_release_ci_gate.py, test_release_publication.py: 67 passed
• llms-full.txt regenerated with scripts/build_llms_full.py
• No prospect names in the diff. The changelog describes shipped behavior only.
• CI passes

Notes

• The OpenEMR capitalize_words entry that sat under Unreleased was dropped. Its code (OpenEMR contracts declare the form's stored forms; capitalize_words joins the closed set (#1811) #1816) is already in the 2.6.0 tag.
• The worker and new-window containment (feat(flow): worker and new-window containment for guarded browser contexts #1828) is not wired into any lane, so it isn't listed. Reverted work (flow: scope Linux X11 recording to one window #1966, feat(desktop): register the Chrome extension host per recording #2082, Preserve exact browser frame boundaries during event persistence #2094) isn't listed either.
• The release date in the heading is 2026-11-09. Change it if the merge happens on another day: the release plan only checks that the heading names the version.