v2.22.0

Retired since. The work plane shipped in this release — orun work, orun spec, the work MCP tools — was removed whole in a later release. This page is kept as the historical record.

Release notes for orun v2.22.0.

Highlights

• The work lens (orun work, orun spec, orun mcp). orun's delivery-derived work tracker lands in the CLI: import spec trees into Specs and Tasks, list tasks whose lifecycle derives from delivery facts (branches, PRs, merges, gate verdicts, live revisions) instead of a stored status, pull sealed content-addressed spec briefs to implement against, and serve the agent tool surface over MCP. There is no set-status anywhere — by construction.
• Build-input rescope (dependsOn[].input). The third orthogonal dependency axis after ordering and include: mark a dependency input: true when its sources are build inputs of your artifact, and --changed treats a change to the dependency as a direct change to your component — closing the shared-package gap where a packages/*-only change shipped no deploy of the worker bundling it.
• orun catalog affected --explain. Per-component selection provenance (file, intent, or build-input) in both text and JSON output.
• Secrets manager (SEC0–SEC7). secret:// references in plans with a leak guard, the orun secrets command group (masked prompts, audited reveal break-glass), the three-tier SecretPolicy loader + orun policy CLI, lease-bound runner-side resolution with injection and redaction, composition secretBindings with sealed provenance, and deploy-time materialization.
• Workspace overview read surface (WO3.1). Kind-aware orun catalog describe and orun catalog docs <entity> render entity envelopes and overview docs straight from the catalog.

New: dependsOn[].input

metadata:
  name: policy-worker
spec:
  type: cloudflare-worker-turbo
  dependsOn:
    - component: policy-engine
      input: true   # the worker bundles packages/policy-engine

changed: packages/policy-engine  ->  plan: policy-engine + policy-worker

• Transitive over other input edges (contracts ← sdk ← console).
• Orthogonal to include (forward pull) and dependencyMode (ordering).
• Runtime peers (service bindings) should not be marked input: they stay in the blast radius (affected) without forcing a redeploy.
• Provenance appears in orun catalog affected --explain as build input changed (dependsOn input:true).

See Dependency rules → Input edges.

New: the work lens CLI

Command	Purpose
orun work import	Map a specs/ tree to Specs + Tasks (idempotent apply, --dry-run preview, no lifecycle imported)
orun work list	Tasks with derived rungs and the evidence that put them there
orun spec pull	Seal + materialize a read-only, content-addressed spec brief (@sha256: pin verification, --push syncs refs/work to the remote)
orun mcp serve	Stdio MCP server: 3 read tools with evidence, 4 write tools through the cloud mutators; no status tool and no pin tool exist

See orun work, orun spec, orun mcp.

Compatibility

• Catalogs written by earlier versions load unchanged; input is absent from their edges and the engine behaves exactly as before. The field is omitempty end-to-end, so catalog ids for workspaces that don't use it are unaffected.
• The authored component.yaml schema gains the optional spec.dependsOn[].input boolean; both the plan engine and the catalog resolver accept it.