reconcile: merge V1R4C6 release candidate into main

V1R4C6 merge candidate (squashed).
Contains 10 files, ~1440 lines added across:
- docs/releases/ (6 files: checklist, evidence, blocker, resume, merge-matrix, gate-status)
- ops/openclaw/ (2 files: integrate-deploy-verify, run-to-owner-gate-wechat)
- patches/ (1 file: branch patch)
- versions/ (1 file: V1R4C6.json)

Task: admin workbench, SR-03 Search Gateway, Agent Platform Integration
Baseline: V1R4C5
V1R4C5 tag semantics:
- tag refs/tags/V1R4C5 target d457ac3: immutable release snapshot
- baseline git a32c76a: runtime baseline promotion commit
No tag creation, baseline promotion, or memory search activation in this merge.
This commit is contained in:
openclaw
2026-07-11 16:34:03 +08:00
parent dc1642c2e8
commit 8410cd895e
10 changed files with 1440 additions and 0 deletions
@@ -0,0 +1,137 @@
# V1R4C6 Acceptance Checklist
Date: 2026-07-11
Base baseline: V1R4C5
Promotion blocked until every mandatory gate is green.
## Global Preflight
- [ ] `getRuntimeStatus.status == active`
- [ ] `getBaseline.current_baseline == V1R4C5`
- [ ] `getBaseline.git == a32c76a3c1baa49562e53fb8adce10a5ed0e6704`
- [ ] `AIOS_GITOPS_BARE_REPO` points to `/data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git`
- [ ] Gitea consistency sentinel reports `healthy`
- [ ] `AIOS_MEMORY_ENABLED=false`
- [ ] no force-push used
## Gate A — Admin Workbench / Portal AIOS
### Route/API
- [ ] `/portal/me/aios/manifest` returns authenticated module manifest
- [ ] `/portal/me/aios/dashboard` returns admin-authorized dashboard data
- [ ] `/portal/me/aios/health` returns system health data
- [ ] failed/empty backend data produces explicit empty/error state
### UI
- [ ] admin sees task progress
- [ ] admin sees process/flow diagram entry
- [ ] admin sees system health
- [ ] admin sees authorized agent observability
- [ ] user does not see admin-only modules
- [ ] admin does not see owner-only modules without owner role
### Isolation
- [ ] no cross-user data
- [ ] no cross-project data
- [ ] no cross-session data
- [ ] no cross-tenant/group data
Gate A result: `PASS / FAIL / DEFER`
## Gate B — SR-03 Search Gateway
### Provider Binding
- [ ] real provider configured and reachable
- [ ] provider errors return safe non-memory fallback
- [ ] timeout/retry/circuit-breaker behavior verified
### Scope and Provenance
- [ ] scope filter occurs before ranking
- [ ] provenance returned for accepted results
- [ ] denied/out-of-scope content never reaches ranking or summary
- [ ] global memory/vector index disabled
- [ ] memory search remains disabled
### Audit
- [ ] search request scope is logged without leaking content
- [ ] provider/fallback decision is auditable
- [ ] denied scope mismatch is auditable
Gate B result: `PASS / FAIL / DEFER`
## Gate C — Agent Platform
### Event Bus
- [ ] event envelope includes tenant/group, user, project, session and agent scope
- [ ] cross-scope subscribers cannot receive events
- [ ] failed delivery is observable and retry-bounded
### GPT Message Plane
- [ ] message envelope includes scope and provenance
- [ ] messages cannot cross user/project/session boundaries
- [ ] denied messages do not forward content
### Controller Dispatch
- [ ] dispatch stops when autonomous safe mode is active
- [ ] consequential actions require owner gate
- [ ] duplicate dispatch is idempotent or rejected
- [ ] stuck state cleanup remains green
### Observability
- [ ] admin can see platform status without unrestricted content access
- [ ] failures and queue state are visible
Gate C result: `PASS / FAIL / DEFER`
## Combined Runtime Acceptance
Run after integration and deployment:
```text
getRuntimeStatus
getBaseline
createBranch
createPatch
```
Expected before promotion:
```text
runtime = active
baseline = V1R4C5
write branch = committed + synced
write patch = committed + synced
```
## Rollback Validation
- [ ] Group A can disable workbench routes/menu entries
- [ ] Group B can disable provider binding and use safe non-memory fallback
- [ ] Group C can disable expanded dispatch
- [ ] all rollback modes preserve `AIOS_MEMORY_ENABLED=false`
## Release Decision
V1R4C6 is tag-ready only when:
```text
Global preflight PASS
AND Gate A PASS
AND Gate B PASS
AND Gate C PASS
AND combined runtime acceptance PASS
```
Any failed mandatory gate blocks tag, deployment promotion, and baseline promotion.
+153
View File
@@ -0,0 +1,153 @@
# V1R4C6 Acceptance Evidence
Date: 2026-07-11
Status: release candidate validation in progress
## Verified Global State
Observed through GitOps runtime:
```text
runtime status: active
workspace branch: release/v1r4c6-admin-search-agent-integration-20260711
current baseline: V1R4C5
previous baseline: V1R4C3
baseline git: a32c76a3c1baa49562e53fb8adce10a5ed0e6704
promoted by: openclaw/admin
```
Baseline constraints:
```text
memory_search_enabled = false
force_push_allowed = false
gitea_db_mutation_requires_owner_approval = true
```
Version inventory confirms:
```text
versions/V1R4C5.json exists
versions/V1R4C6.json exists
V1R4C5 tag exists
V1R4C6 tag does not yet exist
```
## Runtime Repository Configuration
The GitOps API service is configured to use:
```text
/data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git
```
The obsolete `aios-v23.git` path is not the intended active repository.
## Gate A — Admin Workbench / Portal AIOS
Release target:
- administrator task-progress visibility;
- process/flow diagram entry;
- system-health view;
- authorized agent observability;
- Portal AIOS manifest/dashboard/health routes.
Required acceptance remains:
- authenticated route checks;
- server-side and client-side RBAC checks;
- explicit empty/error state;
- no cross-user/project/session/tenant data exposure.
Current state:
```text
release scope defined
merge matrix defined
acceptance checklist defined
production acceptance pending integration/deployment
```
## Gate B — SR-03 Search Gateway
Release target:
- real provider binding;
- resilience and bounded retries;
- scope filtering before ranking;
- provenance on accepted results;
- auditable provider/fallback decisions.
Hard constraint:
```text
AIOS_MEMORY_ENABLED=false
```
Memory search and global memory/vector indexing are excluded from V1R4C6.
Current state:
```text
release scope defined
security constraints defined
provider acceptance pending integration/deployment
```
## Gate C — Agent Platform
Release target:
- unified agent event bus;
- scoped Agent/GPT message plane;
- autonomous controller dispatch behind safe-mode gate;
- orchestration governance policy;
- architecture record.
Required acceptance:
- event/message scope enforcement;
- no cross-context delivery;
- safe-mode stops dispatch;
- consequential operations remain owner-gated;
- failures and queues are observable.
Current state:
```text
release scope defined
safety constraints defined
platform acceptance pending integration/deployment
```
## Combined Runtime Acceptance
A clean write-path acceptance must confirm:
```text
getRuntimeStatus -> active
getBaseline -> V1R4C5
createBranch -> committed + synced
createPatch -> committed + synced
```
## Release Blocking Conditions
V1R4C6 is not tag-ready if any of the following is true:
- baseline changes away from V1R4C5 before promotion;
- memory search is enabled;
- Gitea consistency sentinel is unhealthy;
- Admin Workbench RBAC/isolation acceptance fails;
- Search Gateway provider returns unscoped or unprovenanced results;
- Agent Platform ignores safe mode or owner gate;
- force-push is used;
- GitOps writes fail or do not sync.
## Current Decision
V1R4C6 remains a release candidate.
Proceed with non-destructive runtime acceptance and release preparation. Stop before Git tag creation, production promotion, or any owner-gated activation.
@@ -0,0 +1,80 @@
# V1R4C6 Blocker: Baseline Visibility Discrepancy
Date: 2026-07-11
Status: blocking merge/deploy/tag
## Summary
OpenClaw/operator reported V1R4C5 baseline promotion completed successfully, but the ChatGPT GitOps action view still reports the active baseline as V1R4C3.
V1R4C6 must not proceed to merge/deploy/tag until this view is reconciled.
## Operator Reported State
Reported by operator:
```text
current_baseline = V1R4C5
previous_baseline = V1R4C3
promotion_git = a32c76a3c1baa49562e53fb8adce10a5ed0e6704
promoted_by = openclaw/admin
memory_search_enabled = false
force_push_allowed = false
gitea_db_mutation_requires_owner_approval = true
```
## ChatGPT GitOps Action Observed State
Observed through `getBaseline`:
```text
current_baseline = V1R4C3
previous_baseline = V1R3C1
git = f5435e308794c737f3e39de3f6b79807486943c3
promoted_by = openclaw
```
Observed through `listVersions`:
```text
V1R4C5 tag exists
versions_dir does not list canonical V1R4C5.json
workspace_branch = release/v1r4c6-admin-search-agent-integration-20260711
```
## Risk
If V1R4C6 proceeds while different controllers disagree on the active baseline, the release may be built against the wrong base and post-deployment verification may be invalid.
## Required Reconciliation
Before continuing V1R4C6:
1. Confirm the GitOps API used by ChatGPT reads the same `baseline/current.json` updated by OpenClaw.
2. Confirm the API service has reloaded or refreshed baseline state.
3. Confirm canonical `versions/V1R4C5.json` is visible to the action runtime or intentionally explain why it is not required.
4. Re-run:
```text
getBaseline
listVersions
getRuntimeStatus
```
Required result:
```text
getBaseline.current_baseline = V1R4C5
listVersions.tags contains V1R4C5
memory search remains disabled
```
## Hard Stop
Do not create V1R4C6 tag.
Do not promote V1R4C6 baseline.
Do not deploy V1R4C6.
Do not enable memory search.
Proceed only after baseline visibility is reconciled.
@@ -0,0 +1,83 @@
# V1R4C6 Context Isolation Recovery and Resume Decision
Date: 2026-07-11
Status: approved to resume merge/deploy/verification; stop before tag/promotion
## Recovery Evidence
The unrelated OpenClaw/WeChat report was traced to notification/task isolation weaknesses rather than GitOps baseline corruption.
Actions completed:
1. The legacy `AIOS每日自治报告` cron was disabled and retained for forensic review.
2. The expired `2026-07-06-reminder` cron was archived and deleted after confirming no pending dependency.
3. Pending notification queue depth was verified as zero.
4. Unknown/unscoped queued message count was verified as zero.
5. A scoped V1R4C6 WeChat test notification was sent successfully.
The test notification included:
```text
task_id = V1R4C6-integration
release_id = V1R4C6
branch = release/v1r4c6-admin-search-agent-integration-20260711
baseline = V1R4C5
correlation_id = 70308f5e243ab81d
```
No recipient identifier, token, cookie, or unrelated message content is stored in this release record.
## Resume Decision
V1R4C6 may resume:
```text
merge
component tests
security/isolation tests
deployment
production verification
release evidence updates
```
V1R4C6 must still stop before:
```text
Git tag creation
baseline promotion
memory search activation
```
## Required Execution Context
Before every OpenClaw execution or WeChat notification, assert:
```text
task_id = V1R4C6-integration
release_id = V1R4C6
branch = release/v1r4c6-admin-search-agent-integration-20260711
baseline = V1R4C5
memory_search_enabled = false
```
Any mismatch re-enters safe mode and blocks execution/notification.
## Hard Constraints
```text
no force-push
no Gitea DB mutation
no V1R4C5 tag movement
no global memory/vector index
no cross-user/project/session notification or task data
```
## Owner Gate
After Gate A, Gate B, Gate C, deployment verification, runtime acceptance, and Gitea sentinel checks pass, OpenClaw must request explicit owner approval through the scoped WeChat channel for both:
1. Create V1R4C6 Git tag.
2. Promote active baseline from V1R4C5 to V1R4C6.
Ambiguous acknowledgements do not count as approval.
@@ -0,0 +1,136 @@
# V1R4C6 Integration Merge Matrix
Date: 2026-07-11
Status: integration-ready
Base baseline: V1R4C5
Base baseline git: `a32c76a3c1baa49562e53fb8adce10a5ed0e6704`
## Release Objective
Deliver three capability groups in one controlled release train:
1. Admin Workbench and Portal AIOS read-only rollout.
2. SR-03 Search Gateway real provider binding.
3. Agent Platform Integration.
This is a bundled release train, not an uncontrolled bulk merge. Each group has an independent acceptance gate and rollback switch.
## Group A — Admin Workbench and Portal AIOS
| Branch | Capability | Decision |
|---|---|---|
| `feature/v1r4c4-sr04-admin-workbench-visibility-20260711` | Admin workbench task progress and process visibility | integrate |
| `feature/v1r4c4-sr04-portal-aios-visibility-20260710` | Portal AIOS route/menu visibility | integrate |
| `patch/user-portal-me-route-diagnostics-20260709` | `/portal/me/aios/manifest`, dashboard and health route contract | integrate after route review |
| `patch/user-portal-rbac-ops-dashboard` | Admin/group-admin RBAC dashboard | integrate after RBAC review |
| `patch/agent-observability-webui` | Agent observability UI | integrate read-only |
| `patch/web-ui-complete-gitops-dashboard-20260706` | GitOps dashboard UI | integrate only if not superseded by the newer workbench implementation |
### Required user-visible result
Administrators can see:
- task progress;
- task/flow/process diagram entry;
- system health;
- authorized agent observability;
- explicit empty/error states.
### Security constraints
- Read-only first.
- RBAC is enforced server-side and client-side.
- No cross-user, cross-project, cross-session, or cross-tenant data exposure.
- Owner-only modules remain hidden from non-owner administrators.
## Group B — SR-03 Search Gateway Real Provider Binding
| Branch | Capability | Decision |
|---|---|---|
| `feature/v1r4c4-sr02-search-gateway-resilience-20260710` | Gateway resilience and safe fallback | integrate |
| `patch/search-gateway-governed-general-capability` | Governed provider binding and policy surface | integrate after scope review |
| `patch/gitops-change-archive-audit` | Change/archive audit evidence | integrate or retain as supporting audit module |
### Required result
- Real provider binding works.
- Query scope is enforced before ranking.
- Accepted records include provenance.
- Provider failure falls back to `text-only`, `no-memory`, or `scoped-only`.
- Global memory/vector indexes are not used.
### Security constraints
```text
AIOS_MEMORY_ENABLED=false
```
Search Gateway provider binding must not implicitly enable memory search.
## Group C — Agent Platform Integration
| Branch | Capability | Decision |
|---|---|---|
| `patch/agent-event-bus-unified` | Unified scoped agent event bus | integrate |
| `patch/agent-gpt-message-plane` | Scoped Agent/GPT message plane | integrate |
| `patch/autonomous-controller-dispatch-20260709` | Autonomous controller dispatch | integrate behind safe-mode gate |
| `patch/self-evolution-agent-orchestration-policy` | Agent orchestration and governance policy | integrate |
| `patch/aios-autonomous-orchestrator-architecture-review-v1` | Architecture record | integrate as documentation or mark superseded after review |
### Required result
- Agent event and message envelopes include user/project/session scope.
- Controller dispatch stops when autonomous safe mode is active.
- Consequential actions remain owner-gated.
- Observability is available before autonomous expansion.
## Explicitly Excluded
Do not merge or activate in V1R4C6:
- memory search activation;
- global vector index;
- cross-session/global recall;
- unscoped search or message delivery;
- old test/smoke/auth-only branches;
- old V1R2/V1R3 promotion requests;
- force-push reconciliation;
- Gitea database mutation.
## Merge and Deployment Order
```text
1. Verify V1R4C5 baseline and bare-repo configuration.
2. Integrate Group A read-only workbench/portal surface.
3. Run Group A RBAC and visibility acceptance.
4. Integrate Group B provider binding under isolation gate.
5. Run Group B scope/provenance/fallback acceptance.
6. Integrate Group C event/message/dispatch capabilities.
7. Run Group C scope/safe-mode/owner-gate acceptance.
8. Run combined runtime acceptance.
9. Prepare V1R4C6 tag and promotion request.
10. Stop for owner confirmation before tag/promotion.
```
## Combined Acceptance
Required:
```text
getRuntimeStatus -> active
getBaseline -> V1R4C5 before promotion
createBranch -> committed and synced
createPatch -> committed and synced
Gitea branch sentinel -> healthy
memory search -> disabled
```
## Rollback Switches
- Group A: disable new workbench routes/menu entries.
- Group B: disable real provider binding and use safe non-memory fallback.
- Group C: disable expanded dispatch and keep event/message plane observational.
- Memory search remains disabled in all rollback modes.
@@ -0,0 +1,85 @@
# V1R4C6 Release Gate Status
Date: 2026-07-11
Status: ready for final integration gates
## Completed
- V1R4C5 baseline verified as active base.
- GitOps API and public API return:
- current_baseline: V1R4C5
- previous_baseline: V1R4C3
- git: a32c76a3c1baa49562e53fb8adce10a5ed0e6704
- GitOps bare repository path corrected to active `aios.git`.
- V1R4C6 merge matrix created.
- V1R4C6 acceptance checklist created.
- V1R4C6 acceptance evidence created.
- Runtime write acceptance completed:
```text
createBranch:
test/v1r4c6-runtime-acceptance-20260711-01
rev: d98e785
sync: synced
createPatch:
v1r4c6-runtime-acceptance-20260711-01
rev: 6536e42
sync: synced
```
## Remaining Gates
### Gate A
Admin Workbench / Portal AIOS:
- merge candidate review;
- RBAC acceptance;
- task progress visibility;
- flow diagram visibility;
- health/observability validation.
### Gate B
SR-03 Search Gateway:
- provider binding validation;
- scope-before-ranking validation;
- provenance validation;
- fallback validation.
### Gate C
Agent Platform:
- event scope validation;
- message plane scope validation;
- dispatch safe-mode validation;
- owner gate validation.
## Release Stop Point
After Gates A/B/C pass:
```text
prepare V1R4C6 tag
↓
owner confirmation required
↓
tag creation
↓
baseline promotion
```
## Hard Constraints
Remain:
```text
AIOS_MEMORY_ENABLED=false
memory search disabled
force-push forbidden
gitea DB mutation requires owner approval
```