Add OpenClaw command for GitOps change archive audit

2026-07-08 20:43:22 +08:00
parent 0d30488be6
commit 0160b98131
1 changed files with 34 additions and 0 deletions
@@ -0,0 +1,34 @@
+# CMD-20260709-enable-gitops-change-archive-audit
+
+## Goal
+
+Enforce that all AIOS code and configuration changes are archived in Git and
+periodically checked for drift.
+
+## Execute
+
+1. Enable GitOps change archive policy.
+2. Run hourly diff audits:
+   - workspace vs HEAD
+   - HEAD vs baseline
+   - runtime config vs Git
+3. Write reports:
+   - audit/change-diff/
+4. Alert on:
+   - uncommitted changes
+   - runtime-only mutation
+   - missing actor/reason/branch/commit metadata
+
+## Validation
+
+Expected signal:
+
+- AIOS_GITOPS_CHANGE_ARCHIVE_READY
+- AIOS_DIFF_AUDITOR_READY
+
+## Governance
+
+- No direct main push.
+- No secrets in Git.
+- All changes require commit metadata.
+- Owner gate remains enabled.