docs(v2r2c1): refresh requirements from latest mechanism audit
This commit is contained in:
AIOS Governed Continuation
@@ -0,0 +1,284 @@
|
||||
# AIOS V2R2C1 Pre-Push Review Fix Requirements??? mechanism ????
|
||||
|
||||
## 1. ????????
|
||||
|
||||
??????? authoritative bare repository ?? mechanism branch?
|
||||
|
||||
- Repository?aios/aios
|
||||
- mechanism branch?patch/v2r2c1-release-registry-convergence-20260810
|
||||
- audit base?b660e2cc324749391323b1f7bebc865f324161f7
|
||||
- latest mechanism HEAD?52b74ba61040246fffa8b10011c1199830e3d665
|
||||
- follow-up commits?51b5f0e53e69bd9f5c4077c7f399ede17571c368?52b74ba61040246fffa8b10011c1199830e3d665
|
||||
- audited delta?17 files changed, 1403 insertions(+), 79 deletions(-)
|
||||
|
||||
????? b660e2c ????????????????????? b660e2c ??? HEAD ??????????
|
||||
|
||||
???????? V2R2C1?????? release artifact?source registry?annotated tag?evidence?approval?runtime ? closure ???????????????? provenance?
|
||||
|
||||
## 2. ??????
|
||||
|
||||
??????????
|
||||
|
||||
- source registry ????? M/C convergence?
|
||||
- authoritative repository identity?
|
||||
- approval authority ? canonical root?schema?Owner approval ???/?????
|
||||
- governed release artifact binding?
|
||||
- release executor ??? provenance ???
|
||||
- runtime / projection / source registry ?????
|
||||
- artifact release/general mode ???
|
||||
- TOCTOU?identity mismatch?runtime convergence ? authority boundary ?????
|
||||
|
||||
?????????
|
||||
|
||||
- ??? main?
|
||||
- merge main?
|
||||
- ?? Production Baseline?
|
||||
- ?? versions/V2R2C1.json ??????
|
||||
- ?????????? tag?
|
||||
- force push?
|
||||
- ???? runtime?
|
||||
- systemd/nginx ?????reload ? restart?
|
||||
- ??? release?rollback ??? consequential production action?
|
||||
|
||||
## 3. ????
|
||||
|
||||
### R1 ? Source registry ???? M
|
||||
|
||||
??????? refs/heads/main ?????????? M??? registry ??????????SHA-256 ? artifact ?????? M:versions/<version>.json ??? blob?
|
||||
|
||||
main ????????????????? M ?????????????????????????? TOCTOU?
|
||||
|
||||
### R2 ? Release provenance ???????
|
||||
|
||||
release identity ?????
|
||||
|
||||
- repository = aios/aios?
|
||||
- version?
|
||||
- annotated tag object A?
|
||||
- release target commit T?
|
||||
- peeled target?
|
||||
- evidence closure commit E?
|
||||
- owner-approved approval plan P?
|
||||
|
||||
?? source-registry provenance ???????
|
||||
|
||||
- source registry main commit M?
|
||||
- source registry path?
|
||||
- source registry SHA-256?
|
||||
|
||||
### R3 ? Git identity ? lineage ?????
|
||||
|
||||
?????
|
||||
|
||||
- A ? tag object???? lightweight tag?
|
||||
- refs/tags/<version> ?? A?
|
||||
- A^{commit} = T?
|
||||
- registry peeled target = T?
|
||||
- E ? commit?
|
||||
- T ? E ? ancestor?
|
||||
- M ? commit?
|
||||
- T ? M ? ancestor?
|
||||
- source registry ??? M ??? authoritative main C ??????
|
||||
|
||||
???????????????same-name?different-OID tag ?? MANUAL_OWNER_REVIEW_REQUIRED?
|
||||
|
||||
### R4 ? Authority repository ????????
|
||||
|
||||
?????????? /data/aios-gitops/repo.git??????
|
||||
|
||||
- ??????? configured authoritative path?
|
||||
- repository ? bare repository?
|
||||
- remote URL ??? Gitea repository identity?
|
||||
- repository identity = aios/aios?
|
||||
|
||||
????????? AIOS_GITOPS_AUTHORITATIVE_GIT_DIR?AIOS_GITOPS_REPOSITORY_IDENTITY ??????? authority??????? AIOS_TEST_MODE=1 ??????? bare repository?
|
||||
|
||||
### R5 ? Approval plan ??? canonical authority
|
||||
|
||||
??????? approval_plan_id ??????
|
||||
|
||||
approval authority ???
|
||||
|
||||
- ?? /var/lib/aios-gitops/approval-authority ???????????
|
||||
- ? regular file??? symlink?
|
||||
- ???????
|
||||
- ???? release-approval schema?
|
||||
- ?? authority ? repository?version?A?T?peeled target?E?P ??? binding?
|
||||
- ?? revoked?invalidated?expired ? cancelled?
|
||||
- ? canonical V2R2C1 Owner approval ?? approved=true?status=APPROVED?approved_by=aiman?approval_source=explicit_owner_approval_in_chat ?? owner_approval_digest_sha256?
|
||||
|
||||
generator ??????? approval??????????????????????? JSON?
|
||||
|
||||
### R6 ? Source registry generator ???? authority
|
||||
|
||||
scripts/generate_source_registry.py ???????
|
||||
|
||||
- authoritative repository?
|
||||
- canonical approval authority?
|
||||
- repository identity?
|
||||
|
||||
????? authoritative repository?Git identity ? approval authority ?????????? OID ????????????? registry?
|
||||
|
||||
### R7 ? Release artifact builder ????????
|
||||
|
||||
release mode ?????? release binding????????
|
||||
|
||||
- version?
|
||||
- repository?
|
||||
- tag_oid?
|
||||
- target_oid?
|
||||
- peeled_target_oid?
|
||||
- evidence_closure_oid?
|
||||
- approval_plan_id?
|
||||
|
||||
?? ArtifactBuilder ??? artifact_mode=release ? artifact_mode=general?
|
||||
|
||||
- canonical release version?release binding ? release_mode=true ??? release validation?
|
||||
- artifact_mode=general ???? canonical release metadata?
|
||||
- release/general ? release_mode ??????????
|
||||
- release mode ?? binding ?? fail closed?
|
||||
|
||||
CLI ? scripts/autonomous-release/build_artifact.py ???? artifact mode ?? builder?
|
||||
|
||||
### R8 ? Executor ?????? artifact ? authoritative Git
|
||||
|
||||
approved_release_executor.py ???? builder ? receipt ????? provenance-enabled binding ???????
|
||||
|
||||
- artifact size ? SHA-256?
|
||||
- payload/versions/<version>.json?
|
||||
- canonical source registry JSON?
|
||||
- source registry identity?
|
||||
- M?path?source registry SHA-256?
|
||||
- BUILD-METADATA ? release_target_oid?source_registry_main_oid?source_registry_path?source_registry_sha256?
|
||||
- ?? annotated tag?tag object ? peeled target?
|
||||
- authorization receipt?
|
||||
|
||||
? runtime adapter ????executor ???? Registry/Baseline closure ??? M:path ? C:path??? final readback ?????artifact ? current main source bytes ???????? ReleaseBlocked?ManualOwnerReviewRequired ? ReconciliationRequired?
|
||||
|
||||
### R9 ? Runtime adapter ???? Git convergence
|
||||
|
||||
v2r2c1_production_adapter.py ???? immutable runtime ??? exact source registry member???? runtime-only facts?
|
||||
|
||||
- runtime_registry_versions?
|
||||
- attested_projection_versions?
|
||||
- effective_registry_versions?
|
||||
- runtime_registry_converged?
|
||||
- runtime_bundle_contains_current_version?
|
||||
- source_registry_converged = not_checked?
|
||||
- registry_consistency_status = RUNTIME_ONLY_VERIFIED?
|
||||
|
||||
authoritative Git convergence ??? executor ???????? runtime adapter ??? runtime member ????? source Git convergence?
|
||||
|
||||
### R10 ? Version API ??????????
|
||||
|
||||
?? API ???????
|
||||
|
||||
- legacy display / registry_versions?
|
||||
- effective_registry_versions?
|
||||
- runtime_registry_versions?
|
||||
- attested_projection_versions?
|
||||
- attested_projection_version?
|
||||
- source_registry_converged?
|
||||
- source_registry_convergence_error?
|
||||
- runtime_registry_converged?
|
||||
- runtime_bundle_contains_current_version?
|
||||
- runtime_bundle_contains_version?
|
||||
- registry_consistency_status?
|
||||
|
||||
projection overlay ???????? source registry ????????? runtime bundle ????????
|
||||
|
||||
### R11 ? ????????
|
||||
|
||||
????????
|
||||
|
||||
- NO_ATTESTED_PROJECTION?
|
||||
- RUNTIME_ARTIFACT_RECONCILIATION_REQUIRED?
|
||||
- RUNTIME_ENTRY_INVALID?
|
||||
- RUNTIME_IDENTITY_MISMATCH?
|
||||
- SOURCE_GIT_NOT_CHECKED?
|
||||
- SOURCE_REGISTRY_NOT_CONVERGED?
|
||||
- FULLY_CONSISTENT?
|
||||
|
||||
assert_runtime_registry_convergence ??? runtime bundle?runtime identity?source Git convergence ???? consistency status ??????????
|
||||
|
||||
### R12 ? Legacy receipt ?????? future binding
|
||||
|
||||
?? V2R2C1 legacy receipt ???? future-only provenance ???
|
||||
|
||||
- tag_oid?
|
||||
- binding_schema?
|
||||
- source_registry_main_oid?
|
||||
- source_registry_path?
|
||||
- source_registry_sha256?
|
||||
|
||||
? future binding ? provenance-enabled binding ???? source registry provenance???????????? receipt ???? release ??????????
|
||||
|
||||
### R13 ? ????????????
|
||||
|
||||
?????
|
||||
|
||||
- pinned M ? main ???
|
||||
- source registry entry ? M/C ????
|
||||
- lightweight tag ???
|
||||
- annotated tag + lineage ???
|
||||
- approval authority schema/path/owner digest/revocation?
|
||||
- release binding ??????????
|
||||
- release mode ?? binding?
|
||||
- general artifact ?? release version?
|
||||
- executor source digest / BUILD-METADATA ?????
|
||||
- runtime bundle/convergence ???
|
||||
- runtime ? main advance ? Registry/Baseline ?????
|
||||
- projection-only ???? runtime convergence?
|
||||
- ?? authority ?????????????????
|
||||
|
||||
## 4. ??????
|
||||
|
||||
???? diff ???? 17 ????
|
||||
|
||||
### Runtime / release
|
||||
|
||||
- active-runtime/app/aios_chatgpt_actions_api.py
|
||||
- active-runtime/app/aios_model_api_staging.py
|
||||
- active-runtime/app/approved_release_executor.py
|
||||
- active-runtime/app/governed_production_release.py
|
||||
- active-runtime/app/v2r2c1_production_adapter.py
|
||||
- active-runtime/app/version_registry.py
|
||||
|
||||
### Builder / generator
|
||||
|
||||
- scripts/autonomous-release/build_artifact.py
|
||||
- scripts/generate_source_registry.py
|
||||
- services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/artifact.py
|
||||
- services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/cli.py
|
||||
|
||||
### Tests
|
||||
|
||||
- tests/autonomous_release/test_artifact_closure.py
|
||||
- tests/test_approved_release_executor.py
|
||||
- tests/test_authoritative_git_context.py
|
||||
- tests/test_governed_release_provenance.py
|
||||
- tests/test_model_api_immutable_staging.py
|
||||
- tests/test_v2r2c1_pre_push_review.py
|
||||
- tests/test_version_registry_convergence.py
|
||||
|
||||
## 5. ???????
|
||||
|
||||
- force_push_used = false
|
||||
- tag_rewritten = false
|
||||
- direct_main_push = false
|
||||
- secrets_committed = false
|
||||
- production_mutation = false
|
||||
- legacy_global_writes_enabled = false
|
||||
- ?? Owner review ??? merge ? production consequential action?
|
||||
- ???????? V2R2C1 ??? registry?tag?Baseline ? runtime identity?
|
||||
|
||||
## 6. ?????
|
||||
|
||||
- latest mechanism code audit?COMPLETE?
|
||||
- code fix at 52b74ba?COMPLETE?
|
||||
- latest full test gate?PARTIAL?
|
||||
- docs candidate branch?? main???????? Owner review?
|
||||
- merge / release / Baseline update?NOT RUN?
|
||||
- Owner review?REQUIRED?
|
||||
|
||||
????????? 760 passed?2 skipped?1 failed?154 subtests passed?????? signer self-test ?? 42????? all tests green ? ready for production?
|
||||
Reference in New Issue
Block a user