test(aios-v2): 固化回滚执行模式验收证据

.aios-evidence/acceptance/20260721T042105Z/summary.json

@@ -0,0 +1,67 @@
+{
+  "schema": "aios.v2.acceptance.v1",
+  "generated_at": "2026-07-21T04:21:06.025742Z",
+  "branch": "task/openclaw/AIOS-V2R1-PRODUCTION-DEPLOY-20260720",
+  "commit": "c81d4f40f3191037cb1a34f169e0a9ed7825bdbf",
+  "workspace_dirty": false,
+  "passed": 8,
+  "failed": 0,
+  "warnings": 1,
+  "steps": [
+    {
+      "name": "文档与代码匹配",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042105Z/文档与代码匹配.log"
+    },
+    {
+      "name": "Python 语法编译",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042105Z/Python_语法编译.log"
+    },
+    {
+      "name": "候选单元与集成测试",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042105Z/候选单元与集成测试.log"
+    },
+    {
+      "name": "Shell 脚本语法",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042105Z/Shell_脚本语法.log"
+    },
+    {
+      "name": "文档 Git 冲突标记",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042105Z/文档_Git_冲突标记.log"
+    },
+    {
+      "name": "明文密钥基础扫描",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042105Z/明文密钥基础扫描.log"
+    },
+    {
+      "name": "systemd 单元验证",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042105Z/systemd_单元验证.log"
+    },
+    {
+      "name": "Docker Compose 配置验证",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042105Z/Docker_Compose_配置验证.log"
+    },
+    {
+      "name": "在线健康检查",
+      "status": "警告",
+      "exit_code": 0,
+      "log": "未启用 AIOS_RUN_LIVE_HEALTHCHECK=1"
+    }
+  ],
+  "final_status": "passed"
+}

docs/aios-v2/04-MODULE-CONTRACTS.md

@@ -490,6 +490,8 @@ POST /api/v2/hermes/results/reconcile
 - 默认只回滚代码。
 - 状态恢复需显式授权。
 - 回滚后必须执行 healthcheck。
+- Release Archive 必须保留 `rollback.sh` 与 `healthcheck/check.sh` 的 executable bit；
+  验收测试必须阻止非执行模式进入候选包。
 
 ## 14. 契约变更规则
 

tests/aios_v2_candidate/test_candidate_flow.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import sys
 import os
+import stat
 import tempfile
 import unittest
 from dataclasses import replace
@@ -70,6 +71,14 @@ def bootstrap(service: ControlPlaneService, tenant_id: str = "tenant-a"):
 
 
 class CandidateFlowTests(unittest.TestCase):
+    def test_rollback_entrypoints_are_executable_in_release_archive(self) -> None:
+        for relative in (
+            "deploy/aios-v2/rollback/rollback.sh",
+            "deploy/aios-v2/healthcheck/check.sh",
+        ):
+            mode = (REPO_ROOT / relative).stat().st_mode
+            self.assertTrue(mode & stat.S_IXUSR, relative)
+
     def test_build_application_propagates_openclaw_signing_key_id(self) -> None:
         with tempfile.TemporaryDirectory() as temp_dir:
             material_path = Path(temp_dir) / "signing-material.bin"