fix(v2r2c2): gate recovery — normalize LF, EOF blank lines, deterministic test path-mode, secret-scan allowlist for release-freeze OIDs

.gitleaks.toml

@@ -4,7 +4,14 @@ title = "AIOS repository secret scan policy"
 useDefault = true
 
 [allowlist]
-description = "Exact non-secret Task Admission test idempotency fixture in the historical PR commit"
+description = "Exact non-secret fixtures: Task Admission idempotency test fixture and release-freeze git commit OIDs (generic-api-key false positive on 40-hex git hashes)"
 condition = "AND"
-paths = ['''tests/test_task_admission_bootstrap_http\.py$''']
-regexes = ['''idempotency-1''']
+paths = [
+    '''tests/test_task_admission_bootstrap_http\.py$''',
+    '''docs/V2R2C2-P0-convergence-20260909\.md$''',
+    '''artifacts/round3-provider-auth/ledger\.json$''',
+]
+regexes = [
+    '''idempotency-1''',
+    '''f7f53d0568767d6deec2c47008a89f4d8413f93d''',
+]

active-runtime/app/aios_gitea_machine_transport.py

@@ -24,25 +24,25 @@ def _safe_oid(value: str, field: str) -> str:
     return value
 
 
-def _safe_branch(value: str) -> str:
-    branch = str(value or "")
-    if (
-        not branch
-        or len(branch) > 240
-        or branch != branch.strip()
-        or branch.startswith(("/", "-", "."))
-        or branch.endswith(("/", ".", ".lock"))
-        or ".." in branch
-        or "//" in branch
-        or "@{" in branch
-        or "\\" in branch
-        or any(part in {"", ".", ".."} for part in branch.split("/"))
-        or any(ch not in "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._/-" for ch in branch)
-    ):
-        raise GiteaTransportError("BRANCH_INVALID")
-    return branch
-
-
+def _safe_branch(value: str) -> str:
+    branch = str(value or "")
+    if (
+        not branch
+        or len(branch) > 240
+        or branch != branch.strip()
+        or branch.startswith(("/", "-", "."))
+        or branch.endswith(("/", ".", ".lock"))
+        or ".." in branch
+        or "//" in branch
+        or "@{" in branch
+        or "\\" in branch
+        or any(part in {"", ".", ".."} for part in branch.split("/"))
+        or any(ch not in "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._/-" for ch in branch)
+    ):
+        raise GiteaTransportError("BRANCH_INVALID")
+    return branch
+
+
 @dataclass(slots=True)
 class GiteaMachineTransport:
     api_base: str
@@ -110,7 +110,7 @@ class GiteaMachineTransport:
         return self.repository_info()
 
     def read_branch(self, branch: str) -> str | None:
-        branch = _safe_branch(branch)
+        branch = _safe_branch(branch)
         owner, name = self.repository_id.split("/", 1)
         try:
             value = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/branches/{quote(branch, safe='/')}")[1]
@@ -156,99 +156,99 @@ class GiteaMachineTransport:
         finally:
             askpass.unlink(missing_ok=True)
 
-    def fetch_branch_exact(self, branch: str, expected_oid: str) -> str:
-        """Fetch one exact remote branch tip into a quarantine ref.
-
-        This never updates ``main`` or any caller-visible branch.  The remote
-        ref is read before and after the fetch so a concurrent branch move
-        cannot be silently admitted.
-        """
-
-        branch = _safe_branch(branch)
-        expected_oid = _safe_oid(expected_oid, "expected_oid")
-        remote_before = self.read_branch(branch)
-        if remote_before != expected_oid:
-            raise GiteaTransportError("GITEA_SOURCE_REF_MISMATCH")
-        target_ref = f"refs/aios/release-sources/{expected_oid}"
-
-        current = subprocess.run(
-            [
-                "git",
-                f"--git-dir={self.authority_git_dir}",
-                "rev-parse",
-                "--verify",
-                f"{target_ref}^{{commit}}",
-            ],
-            text=True,
-            capture_output=True,
-            check=False,
-            timeout=self.timeout,
-        )
-        if current.returncode == 0 and current.stdout.strip().lower() == expected_oid:
-            remote_after = self.read_branch(branch)
-            if remote_after != expected_oid:
-                raise GiteaTransportError("GITEA_SOURCE_REF_MOVED")
-            return expected_oid
-
-        askpass, additions = self._askpass()
-        environment = os.environ.copy()
-        environment.update(additions)
-        try:
-            result = subprocess.run(
-                [
-                    "git",
-                    f"--git-dir={self.authority_git_dir}",
-                    "fetch",
-                    "--no-tags",
-                    "--no-write-fetch-head",
-                    self.remote_url,
-                    f"refs/heads/{branch}:{target_ref}",
-                ],
-                text=True,
-                capture_output=True,
-                check=False,
-                env=environment,
-                timeout=self.timeout,
-            )
-            if result.returncode != 0:
-                raise GiteaTransportError("GITEA_SOURCE_FETCH_FAILED")
-        finally:
-            askpass.unlink(missing_ok=True)
-
-        local = subprocess.run(
-            [
-                "git",
-                f"--git-dir={self.authority_git_dir}",
-                "rev-parse",
-                "--verify",
-                f"{target_ref}^{{commit}}",
-            ],
-            text=True,
-            capture_output=True,
-            check=False,
-            timeout=self.timeout,
-        )
-        local_oid = local.stdout.strip().lower()
-        if local.returncode != 0 or local_oid != expected_oid:
-            subprocess.run(
-                [
-                    "git",
-                    f"--git-dir={self.authority_git_dir}",
-                    "update-ref",
-                    "-d",
-                    target_ref,
-                ],
-                text=True,
-                capture_output=True,
-                check=False,
-                timeout=self.timeout,
-            )
-            raise GiteaTransportError("GITEA_SOURCE_FETCH_MISMATCH")
-        remote_after = self.read_branch(branch)
-        if remote_after != expected_oid:
-            raise GiteaTransportError("GITEA_SOURCE_REF_MOVED")
-        return expected_oid
-
+    def fetch_branch_exact(self, branch: str, expected_oid: str) -> str:
+        """Fetch one exact remote branch tip into a quarantine ref.
+
+        This never updates ``main`` or any caller-visible branch.  The remote
+        ref is read before and after the fetch so a concurrent branch move
+        cannot be silently admitted.
+        """
+
+        branch = _safe_branch(branch)
+        expected_oid = _safe_oid(expected_oid, "expected_oid")
+        remote_before = self.read_branch(branch)
+        if remote_before != expected_oid:
+            raise GiteaTransportError("GITEA_SOURCE_REF_MISMATCH")
+        target_ref = f"refs/aios/release-sources/{expected_oid}"
+
+        current = subprocess.run(
+            [
+                "git",
+                f"--git-dir={self.authority_git_dir}",
+                "rev-parse",
+                "--verify",
+                f"{target_ref}^{{commit}}",
+            ],
+            text=True,
+            capture_output=True,
+            check=False,
+            timeout=self.timeout,
+        )
+        if current.returncode == 0 and current.stdout.strip().lower() == expected_oid:
+            remote_after = self.read_branch(branch)
+            if remote_after != expected_oid:
+                raise GiteaTransportError("GITEA_SOURCE_REF_MOVED")
+            return expected_oid
+
+        askpass, additions = self._askpass()
+        environment = os.environ.copy()
+        environment.update(additions)
+        try:
+            result = subprocess.run(
+                [
+                    "git",
+                    f"--git-dir={self.authority_git_dir}",
+                    "fetch",
+                    "--no-tags",
+                    "--no-write-fetch-head",
+                    self.remote_url,
+                    f"refs/heads/{branch}:{target_ref}",
+                ],
+                text=True,
+                capture_output=True,
+                check=False,
+                env=environment,
+                timeout=self.timeout,
+            )
+            if result.returncode != 0:
+                raise GiteaTransportError("GITEA_SOURCE_FETCH_FAILED")
+        finally:
+            askpass.unlink(missing_ok=True)
+
+        local = subprocess.run(
+            [
+                "git",
+                f"--git-dir={self.authority_git_dir}",
+                "rev-parse",
+                "--verify",
+                f"{target_ref}^{{commit}}",
+            ],
+            text=True,
+            capture_output=True,
+            check=False,
+            timeout=self.timeout,
+        )
+        local_oid = local.stdout.strip().lower()
+        if local.returncode != 0 or local_oid != expected_oid:
+            subprocess.run(
+                [
+                    "git",
+                    f"--git-dir={self.authority_git_dir}",
+                    "update-ref",
+                    "-d",
+                    target_ref,
+                ],
+                text=True,
+                capture_output=True,
+                check=False,
+                timeout=self.timeout,
+            )
+            raise GiteaTransportError("GITEA_SOURCE_FETCH_MISMATCH")
+        remote_after = self.read_branch(branch)
+        if remote_after != expected_oid:
+            raise GiteaTransportError("GITEA_SOURCE_REF_MOVED")
+        return expected_oid
+
     def compare_and_swap_branch(self, branch: str, expected_oid: str, new_oid: str) -> str:
         _safe_oid(expected_oid, "expected_oid")
         _safe_oid(new_oid, "new_oid")

active-runtime/app/governed_evidence_runtime.py

@@ -321,4 +321,3 @@ def produce_authenticated_evidence(
         )
     except ProviderAuthenticationError as exc:
         raise EvidenceProduceError(str(exc)) from exc
-

docs/V2R2C2-P0-convergence-20260909.md

@@ -185,4 +185,3 @@ FINAL_SOURCE_TREE = FINAL_SOURCE_HEAD^{tree}
 - tests 唯一剩余失败 = `tests.baseline_v1_1.test_job_safety::test_subprocess_crash_after_durable_sink_success_recovers_without_repeat`（1486 tests，failures=1）。根因：`run_tests_provider` 调用 pytest 未置 `PYTHONPATH=active-runtime/app`，子进程式测试找不到仓库 runtime 模块（`ModuleNotFoundError: aios_gitops_job_executor`）→ 假失败。同测试置 PYTHONPATH 后 **1 passed**。仓库权威 runner `tools/baseline_v1_1/run_acceptance.py` 与 `docs/implementation-baseline-1.1/ACCEPTANCE_RESULTS.md` 均要求向子进程传递源码 PYTHONPATH。
 - **修复（非 skip/allowlist，不改任何 assertion）**：`trusted_evidence_providers.py` 的 `_run` 增加 `extra_env`，新增 `_tests_env()` 转发 `PYTHONPATH=<repo_root>;<repo_root>/active-runtime/app` 至 pytest collect 与执行两个子进程；新增 `tests/test_trusted_evidence_providers_harness.py`（2 passed，hw 验证）锁定该 harness 行为。
 - 因该源码修复，FINAL_SOURCE_HEAD **re-freeze** 至本 freeze commit（push 前次 c8ea953 现为中间态，最终以 re-freeze OID 为准），并重新完整 prove。
-

tests/test_governed_release_evidence_producer.py

@@ -442,4 +442,3 @@ def test_produce_embeds_trusted_provider_binding_in_closure(tmp_path: Path) -> N
         ev = candidate.get(etype)
         if isinstance(ev, dict):
             assert ev.get("passed") is True or ev.get("consistent") is True
-

tests/test_isolated_writer_exact_path_policy.py

@@ -86,7 +86,8 @@ class ExactPathPolicyTests(unittest.TestCase):
         self.temp = tempfile.TemporaryDirectory()
         self.root = Path(self.temp.name)
         self.policy_dir = self.root / "policies"
-        self.policy_dir.mkdir(mode=0o750)
+        self.policy_dir.mkdir()
+        self.policy_dir.chmod(0o750)
         self.policy_file = self.policy_dir / "writer.json"
         self.workspace = self.root / "workspace"
         self.workspace.mkdir(mode=0o700)