fix(v2r2c1): bind baseline authority and openapi staging path

active-runtime/app/aios_model_api_staging.py

@@ -75,6 +75,9 @@ OPENAPI = WS / 'docs' / 'gitops' / 'openapi-chatgpt-actions.yaml'
 BARE_REPO = Path(os.getenv('AIOS_GITOPS_BARE_REPO', str(ROOT / 'runtime' / 'gitea-bin' / 'data' / 'repositories' / 'aios' / 'aios.git')))
 AUTHORITATIVE_GIT_DIR = Path(os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR')) if os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR') else None
 REPOSITORY_IDENTITY = os.getenv('AIOS_GITOPS_REPOSITORY_IDENTITY', '')
+BASELINE_AUTHORITY = BaselineAuthority()
+GIT_DIR = Path(os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR') or os.getenv('AIOS_GITOPS_REPO', '/data/aios-gitops/repo.git'))
+LEGACY_GIT_WRITE_COMMANDS = frozenset({'add','commit','checkout','branch','tag','push','fetch','reset','merge','rebase','update-ref','worktree'})
 SILENT_RELEASE_STATE_ROOT = Path(os.getenv(
     'AIOS_SILENT_RELEASE_STATE_ROOT',
     '/var/lib/aios-gitops/silent-release',

scripts/build_v2r2c1_model_api_staging.py

@@ -77,7 +77,7 @@ def main() -> int:
         paths.append((Path('runtime-agent-os') / rel, path))
     openapi = docs / 'openapi-chatgpt-actions.yaml'
     if openapi.is_file():
-        paths.append((Path('docs') / 'openapi-chatgpt-actions.yaml', openapi))
+        paths.append((Path('docs') / 'gitops' / 'openapi-chatgpt-actions.yaml', openapi))
     for folder in ('config/model_registry', 'config/model_priority', 'patches', 'versions'):
         root = source / folder
         if root.is_dir():

tests/test_model_api_immutable_staging.py

@@ -6,6 +6,8 @@ ROOT = Path(__file__).resolve().parents[1]
 def test_model_api_source_is_immutable_and_authority_bound():
     source = (ROOT / 'active-runtime' / 'app' / 'aios_model_api_staging.py').read_text(encoding='utf-8')
     assert 'BaselineAuthority' in source
+    assert 'BASELINE_AUTHORITY = BaselineAuthority()' in source
+    assert 'LEGACY_GIT_WRITE_COMMANDS' in source
     assert 'BaselineAuthorityError' in source
     assert 'IMMUTABLE_STAGING' in source
     assert 'LEGACY_GLOBAL_WRITES_DISABLED' in source