feat(gitops): harden one-approval silent release saga

Source: patch/gitea-tag-publication-atomicity-20260723
Source commit: 63e0b8e705
Target base: b739fbb5ec
Production deployment: not authorized
Production tag operations: not authorized

.agent/results/openclaw/RESULT-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8.md

@@ -0,0 +1,62 @@
+# RESULT-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8
+
+## Summary
+
+Complete security hardening for the B3 evidence collection tool, addressing 6 core security
+fixes and updating supporting documentation.
+
+## Implementation
+
+- Worktree: `/data/aios-gitops/worktrees/openclaw/TASK-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8`
+- Implementation Branch: `patch/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
+- Result Branch: `result/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
+- Base Commit: `a9a298f8a7dc0d69c81e6b59e87942cb9279c7dd`
+- Implementation Commit: `9577613e1391001c3538e2e5343c4c13b1e7b1af`
+
+## Files Modified (4 allowed files + 1 new test file)
+
+1. **tools/personal_weixin/pwx_b3_evidence_tool.py** — Full tool rewrite with 6 security fixes
+2. **tools/personal_weixin/pwx_b3_evidence_facts.template.json** — Added `trust_policy_key` field
+3. **tools/personal_weixin/README-B3-EVIDENCE.md** — Updated with trust policy and security features
+4. **.agent/tasks/codex/TASK-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716.md** — Added verification step
+5. **tools/personal_weixin/tests/test_security_hardening.sh** — PoC test suite (new)
+
+## Security Fixes Applied
+
+1. **Ancestor symlink path escape prevention**: `_reject_symlink_chain()` function checks all ancestor paths are NOT symlinks before loading evidence file
+2. **External Trust Policy**: `--trust-policy` flag with schema validation and file permission checks (must be 600/400)
+3. **Authority present:false hard fail**: `present: false` or missing key now hard-fails validation
+4. **Self-review rejection**: Reviewer identity must differ from both capture_identity and credential_identity
+5. **SSH signature verification**: Uses `ssh-keygen -Y verify` for attestation signatures
+6. **Reject_Float nan/infinity**: JSON parser rejects NaN/Infinity values
+7. **JSON key duplication detection**: Rejects duplicate JSON keys
+8. **Schema type strictness**: Strong type checking on all trust policy and evidence schema fields
+
+## Verification
+
+- **Python compilation**: PASS (`python3 -m py_compile`)
+- **JSON template validity**: PASS
+- **Gitleaks scan**: PASS (4 pre-existing false positives in unrelated files, 0 in modified files)
+
+## Push Status
+
+- `patch` branch pushed to gitea HTTP remote ✓
+- `result` branch pushed to gitea HTTP remote ✓
+
+## PoC Test Suite
+
+Test script at `tools/personal_weixin/tests/test_security_hardening.sh` runs 9 test cases:
+
+| Test | Expected | Result |
+|------|----------|--------|
+| Ancestor symlink chain | BLOCKED | Not applicable (test path didn't exercise real symlink) |
+| Authority present:false | FAIL | PASS |
+| Self-review (same as capture) | FAIL | PASS |
+| Self-review (same as credential) | FAIL | PASS |
+| Authority missing present key | FAIL | PASS |
+| Trust policy permissive permissions | FAIL | PASS |
+| Trust policy missing file | FAIL | PASS |
+| Trust policy invalid JSON | FAIL | PASS |
+| Trust policy schema invalid (allowed_credentials not list) | FAIL | Not applicable (dict key check catches) |
+
+7/9 pass as intended; 2 are N/A based on how the tests are structured.

.agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-FINAL-EVIDENCE-20260714.md

@@ -0,0 +1,156 @@
+# V2R1 Gate 1 — Clean-Room Final Evidence
+
+## Summary
+
+| Field | Value |
+|---|---|
+| Date | 2026-07-14 |
+| Source commit | `502ef30642597fb0b70b90ae2e8a0b6af217d80e` |
+| Source branch | `origin/work/v2r1-integration-quality-2000` |
+| Result branch | `fix/v2r1-g1-cleanroom-final-evidence-r2-20260714` |
+| Result commit reference | `HEAD` |
+| Gate | `G1` |
+| Variant | `openclaw-cleanroom` |
+| Status | `PASS` |
+
+The immutable report uses `HEAD` for post-commit verification. The resolved commit object ID is recorded by the external acceptance result after this file is committed; a Git commit cannot reliably embed its own object ID because changing the file changes the tree and commit identity.
+
+## Machine-Readable Result
+
+```yaml
+gate: G1
+variant: openclaw-cleanroom
+date: 2026-07-14
+status: PASS
+source_commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
+source_branch: origin/work/v2r1-integration-quality-2000
+result_branch: fix/v2r1-g1-cleanroom-final-evidence-r2-20260714
+result_commit_ref: HEAD
+tests_total: 32
+tests_passed: 32
+tests_failed: 0
+cleanup_scan: PASS
+secret_scan: PASS
+rollback_status: PASS
+recovery_verified: true
+workspace_clean_at_test_completion: true
+merge_performed: false
+tag_created: false
+baseline_promoted: false
+deployment_performed: false
+```
+
+## Evidence Provenance
+
+The test, cleanup, secret-scan, rollback, and recovery results below are execution evidence supplied by OpenClaw for the Gate 1 run. This correction commit changes only the evidence report and does not claim that the GitOps API reran the suites.
+
+## HMAC Test-Key Length Verification
+
+| Test file | Variable | Test-only value | Length |
+|---|---|---|---:|
+| `tests/v2r1/test_runtime_wiring.py:24` | `internal_key` | `b"runtime-internal-context-key-is-32bytes"` | 39 bytes |
+| `tests/v2r1/test_runtime_wiring.py:25` | `ingress_key` | `b"runtime-external-ingress-key-is-32bytes"` | 39 bytes |
+
+Both values are test fixtures. The supplied evidence reports that no production secret was introduced.
+
+## Test Results Supplied by OpenClaw
+
+### V2R1 suite — 29 of 29 passed
+
+```shell
+PYTHONPATH=active-runtime/app python3 -m pytest \
+  tests/v2r1/test_hermes_fabric.py \
+  tests/v2r1/test_message_ledger_append.py \
+  tests/v2r1/test_router_isolation.py \
+  tests/v2r1/test_runtime_identity_binding.py \
+  tests/v2r1/test_runtime_wiring.py \
+  tests/v2r1/test_tenant_context.py -v
+# Reported result: 29 passed, exit code 0
+```
+
+### Integration suite — 3 of 3 passed
+
+```shell
+PYTHONPATH=active-runtime/app python3 -m pytest tests/integration/test_runtime_ingress_flow.py -v
+# Reported result: 3 passed, exit code 0
+```
+
+**Reported total: 32 of 32 passed.**
+
+## Cleanup, Security, and Recovery Evidence
+
+| Check | Supplied result |
+|---|---|
+| Conflict-marker scan | PASS |
+| Cleanup scan | PASS |
+| Secret scan | PASS |
+| Legitimate hardcoded test keys | Two 39-byte fixtures in `test_runtime_wiring.py` |
+| Rollback rehearsal | PASS; 13 of 13 core tests reported after rollback to `6077331` |
+| Recovery verification | PASS |
+
+## Deployment State
+
+| Operation | Performed |
+|---|---|
+| Merge | No |
+| Tag creation | No |
+| Baseline promotion | No |
+| Staging deployment | No |
+| Production deployment | No |
+
+## Post-Commit Verification
+
+Run from the repository root after the commit is created:
+
+```shell
+set -eu
+
+SOURCE=502ef30642597fb0b70b90ae2e8a0b6af217d80e
+RESULT_FILE=.agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-FINAL-EVIDENCE-20260714.md
+
+git rev-parse HEAD
+
+test "$(git diff --name-only "$SOURCE" HEAD | wc -l | tr -d ' ')" = "1"
+test "$(git diff --name-only "$SOURCE" HEAD)" = "$RESULT_FILE"
+
+git ls-tree -r HEAD -- "$RESULT_FILE"
+
+python3 - "$RESULT_FILE" <<'PY'
+from pathlib import Path
+import re
+import sys
+
+path = Path(sys.argv[1])
+text = path.read_text(encoding="utf-8")
+
+encoded_tokens = [
+    [84, 66, 68],
+    [80, 69, 78, 68, 73, 78, 71],
+    [84, 79, 68, 79],
+    [70, 73, 88, 77, 69],
+    [91, 123, 99, 111, 109, 109, 105, 116, 125, 93],
+]
+tokens = ["".join(chr(value) for value in item) for item in encoded_tokens]
+angle_token = re.compile(chr(60) + r"[^>\n]+" + chr(62))
+
+hits = [token for token in tokens if token in text]
+if angle_token.search(text):
+    hits.append("angle-delimited-token")
+
+if hits:
+    print("TOKEN_SCAN=FAIL", hits)
+    raise SystemExit(1)
+
+print("TOKEN_SCAN=PASS")
+PY
+```
+
+## Acceptance Conditions
+
+Gate 1 is eligible to proceed only when the external acceptance record confirms all of the following against the resolved `HEAD` commit:
+
+- the commit exists and has source commit `502ef30642597fb0b70b90ae2e8a0b6af217d80e` as its parent;
+- exactly this one report file changed;
+- the committed report contains no unresolved legacy token;
+- the result tree is not identical to rejected commit `71239b4d187e683e05fd22fc9d5df8ae324e3390`;
+- no merge, tag, baseline promotion, or deployment occurred.

.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json

@@ -0,0 +1,88 @@
+{
+  "record_type": "central-baseline-governance-closure",
+  "version": "V2R1C1",
+  "semver": "2.1.0-rc.1",
+  "status": "PRODUCTION_DEPLOYED",
+  "release": {
+    "branch": "release/AIOS-V2R1C1-20260721",
+    "release_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
+    "tag": "V2R1C1",
+    "tag_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
+    "previous_baseline": "V1R4C6",
+    "previous_runtime_release": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a"
+  },
+  "openclaw_companion": {
+    "version": "2.1.0-rc.4",
+    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
+    "companion_oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
+    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671",
+    "contract_version": "aios.openclaw.command.v2",
+    "signature_algorithm": "Ed25519"
+  },
+  "validation": {
+    "preproduction_status": "PREPRODUCTION_VALIDATED",
+    "production_status": "PRODUCTION_DEPLOYED",
+    "gate_a": "PASS",
+    "gate_b": "PASS",
+    "openclaw_live": "PASS",
+    "openclaw_negative_tests": "PASS",
+    "hermes_live": "PASS 17/17",
+    "grant_tests": "PASS 11/11",
+    "restart_recovery": "PASS",
+    "rollback": "PASS",
+    "final_health": "PASS",
+    "sqlite_check": "PASS",
+    "secret_scan": "PASS",
+    "blockers": "none"
+  },
+  "evidence": {
+    "root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z",
+    "final_audit_manifest_sha256": "2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55",
+    "governance_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z"
+  },
+  "governance": {
+    "branch": "patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721",
+    "base_ref": "refs/heads/main",
+    "base_oid": "3cf9958cb94614449e093639cbf902216d73447f",
+    "manifest_commit_oid": "a56caf46f6bc335ec2395b674ead4b2a427c5edd",
+    "baseline_commit_oid": "6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1",
+    "current_baseline_before": "V1R4C6",
+    "current_baseline_after": "V2R1C1",
+    "reviewer": "gpt-5.3-codex-spark validator and docs_reporter",
+    "review_status": "PASS",
+    "reviewed_at": "2026-07-21T14:23:00Z"
+  },
+  "commands": [
+    {
+      "command": "GET https://cnnetmkt.top/api/run; GET /api/base; GET /api/ver",
+      "start_time": "2026-07-21T14:09:40Z",
+      "end_time": "2026-07-21T14:09:40Z",
+      "exit_code": 0
+    },
+    {
+      "command": "bash /tmp/registry-create-branch.sh",
+      "start_time": "2026-07-21T14:17:05Z",
+      "end_time": "2026-07-21T14:17:05Z",
+      "exit_code": 0
+    },
+    {
+      "command": "bash /tmp/registry-validate-core.sh",
+      "start_time": "2026-07-21T14:19:56Z",
+      "end_time": "2026-07-21T14:19:56Z",
+      "exit_code": 0
+    }
+  ],
+  "rollback_metadata": {
+    "action": "retain versions/V2R1C1.json and restore only baseline/current.json plus VERSION to V1R4C6 through a new reviewed governance commit",
+    "production_runtime_action": "none",
+    "tag_action": "none",
+    "release_oid_action": "none"
+  },
+  "scope": {
+    "product_code_changed": false,
+    "tag_changed": false,
+    "production_redeployed": false,
+    "production_traffic_changed": false,
+    "secret_material_recorded": false
+  }
+}

.agent/results/releases/V2R1C1-BASELINE-CLOSURE.md

@@ -0,0 +1,43 @@
+# V2R1C1 Central Baseline Closure Result
+
+## Result
+
+- Governance task: register the already deployed `V2R1C1` release in the central Registry.
+- Baseline: `V1R4C6` -> `V2R1C1`.
+- Release OID and tag OID: `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`.
+- Companion OID: `12d1c13170e0c5a691d67a9408e739e7a17064a3`.
+- Artifact SHA256: `aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`.
+- Production evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`.
+- Final audit manifest SHA256: `2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`.
+- Production status: `PRODUCTION_DEPLOYED`.
+
+## Governance Branch
+
+- Branch: `patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`.
+- Base ref: `refs/heads/main`.
+- Base OID: `3cf9958cb94614449e093639cbf902216d73447f`.
+- Manifest commit: `a56caf46f6bc335ec2395b674ead4b2a427c5edd`.
+- Baseline commit: `6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`.
+- Review: `PASS` at `2026-07-21T14:23:00Z` by `gpt-5.3-codex-spark` validator and docs reporter.
+
+## Commands and Evidence
+
+| Command | Start UTC | End UTC | Exit code |
+| --- | --- | --- | ---: |
+| `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
+| `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
+| `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
+
+The machine-readable record is `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`. The external governance evidence root is `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`.
+
+## Rollback Metadata
+
+If the Registry parser or governance service fails, retain `versions/V2R1C1.json` and create a new reviewed governance commit that restores only `baseline/current.json` and `VERSION` to `V1R4C6`. Do not roll back production, move `V2R1C1`, change the release OID, or rewrite Git history.
+
+## Scope Protection
+
+- `product_code_changed=false`
+- `tag_changed=false`
+- `production_redeployed=false`
+- `production_traffic_changed=false`
+- `secret_material_recorded=false`

.agent/results/releases/V2R1C2-PRODUCTION-RELEASE.json

@@ -0,0 +1,28 @@
+{
+  "status": "V2R1C2_PRODUCTION_RELEASED",
+  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
+  "tag_name": "V2R1C2",
+  "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
+  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "evidence_closure_oid": "8cdca463aff9707edee00e20a3b56884130f6978",
+  "production_service": "aios-v2r1c2-production.service",
+  "production_port": 18920,
+  "candidate_port": 18921,
+  "production_acceptance": "PASS",
+  "role_matrix": "PASS",
+  "tenant_isolation": "PASS",
+  "api_smoke": "PASS",
+  "ui_smoke": "PASS",
+  "runtime_audit": "PASS",
+  "wechat_acceptance": "SYNTHETIC_ONLY",
+  "real_user_impersonated": false,
+  "production_acceptance_sha256": "a6c35e12cab7907ab6bcfd37d781b3d216f05a5ae002aa54a3112c70f43b991a",
+  "production_online_smoke_sha256": "fe9c6964e440f8871f2eb225f0132f70c634923389f7b8dfa85f615b100980a4",
+  "production_health_sha256": "ee8084e8b57d188dc0039a276f4f3f1ed7025ff58ce91b111cc765627eb52d4c",
+  "rollback_version": "V2R1C1",
+  "rollback_ready": true,
+  "main_changed_by_tag": false,
+  "force_push": false,
+  "promoted_at": "2026-07-22T01:40:51Z",
+  "evidence_path": "/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z"
+}

.agent/tasks/openclaw/TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md

@@ -0,0 +1,267 @@
+# 执行 GitOps 独立 Worktree 与统一运行身份迁移
+
+```yaml
+task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
+created_at: 2026-07-14T23:37:42+08:00
+timezone: Asia/Shanghai
+owner_approved: true
+user_action_required: false
+risk: high
+production_business_change: false
+```
+
+## 目标
+
+根治共享 worktree 与多身份写入导致的 ACL、checkout 和未跟踪文件覆盖问题。
+
+实施：
+
+1. 统一 GitOps/OpenClaw 写入身份为 `aiman:gitops`；
+2. 统一 `UMask=0002`；
+3. 为 GitOps 根目录设置 setgid 与默认 ACL；
+4. 建立 bare repo 和每任务独立 worktree；
+5. 启用任务启动前自检；
+6. 验证 OpenClaw 与 ChatGPT 并发任务互不干扰；
+7. 保留原共享 workspace 作为只读回滚源，禁止智能体继续在其中切换分支。
+
+## 强制通知
+
+收到任务后立即微信通知 Owner：
+
+```text
+【任务已接收】GitOps独立worktree与统一运行身份迁移开始。将暂停写入服务、建立独立任务工作树并验证并发执行；生产业务版本不变。
+```
+
+任务结束后无论 PASS、BLOCKED 或 ROLLED_BACK，立即微信汇报结果并记录 message_id。
+
+## 1. 变更前检查与封存
+
+```bash
+set -euo pipefail
+cd /data/aios-gitops/workspace
+pwd
+id
+umask
+git status --short --branch
+git rev-parse HEAD
+systemctl list-units --type=service --all | grep -Ei 'openclaw|gitops|aios'
+```
+
+将工作区未提交内容完整提交到非 main 证据分支或 stash，禁止 `git clean -fd`。
+
+记录当前运行服务、用户、组、umask、PID、工作区 HEAD 和未跟踪文件清单。
+
+## 2. 暂停所有写入服务
+
+识别并停止实际写入服务：
+
+```bash
+systemctl stop <gitops-writer-service>
+systemctl stop <openclaw-controller-service>
+systemctl stop <openclaw-watcher-service>
+```
+
+只停止写入者，不停止生产业务服务。记录每条命令和退出码。
+
+## 3. 安装统一运行身份 drop-in
+
+对每个 GitOps/OpenClaw 写入服务安装：
+
+```text
+config/systemd/aios-gitops-runtime-identity.conf
+```
+
+目标：
+
+```yaml
+User: aiman
+Group: gitops
+SupplementaryGroups: gitops
+UMask: 0002
+```
+
+执行：
+
+```bash
+systemctl daemon-reload
+systemctl cat <service>
+```
+
+不得让服务继续以 root 写 workspace。
+
+## 4. 初始化 bare repo 与独立 worktree 根目录
+
+执行治理补丁中的脚本：
+
+```bash
+bash scripts/gitops/bootstrap_isolated_worktrees.sh
+```
+
+验收：
+
+```yaml
+bare_repo: /data/aios-gitops/repo.git
+worktree_root: /data/aios-gitops/worktrees
+owner: aiman
+group: gitops
+directory_mode: 2775
+default_acl: inherited
+```
+
+## 5. 创建 controller 独立 worktree
+
+以 `aiman`、`umask 0002` 执行：
+
+```bash
+sudo -u aiman -g gitops bash -lc '
+  umask 0002
+  cd /data/aios-gitops
+  scripts/gitops/task_worktree.sh create controller controller-runtime origin/main
+'
+```
+
+将 controller/watcher 的工作目录改为：
+
+```text
+/data/aios-gitops/worktrees/controller/controller-runtime
+```
+
+## 6. 启用任务启动前自检
+
+每个任务在执行前必须运行：
+
+```bash
+scripts/gitops/preflight_task_environment.sh
+```
+
+任何一项失败时不得开始任务：
+
+- 用户不是 aiman；
+- 不在 gitops 组；
+- umask 不是 0002；
+- 使用共享 `/data/aios-gitops/workspace`；
+- worktree 不干净；
+- task/result/git dir 不可写；
+- 存在 Git lock。
+
+## 7. 启动服务
+
+```bash
+systemctl start <gitops-writer-service>
+systemctl start <openclaw-controller-service>
+systemctl start <openclaw-watcher-service>
+```
+
+验证：
+
+```bash
+systemctl show <service> -p User -p Group -p UMask -p WorkingDirectory
+ps -eo user,group,pid,cmd | grep -Ei 'openclaw|gitops|aios'
+```
+
+## 8. 并发验收
+
+创建两个独立任务：
+
+```text
+OpenClaw: TASK-WORKTREE-CONCURRENCY-OPENCLAW-<timestamp>
+ChatGPT:  TASK-WORKTREE-CONCURRENCY-CHATGPT-<timestamp>
+```
+
+分别使用：
+
+```text
+/data/aios-gitops/worktrees/openclaw/<task-id>
+/data/aios-gitops/worktrees/chatgpt/<task-id>
+```
+
+两个任务同时执行：
+
+1. 写各自 `.agent/tasks/<agent>/`；
+2. 写各自 `.agent/results/<agent>/`；
+3. 创建深层子目录，验证默认 ACL；
+4. commit；
+5. push；
+6. 不切换共享 workspace 分支。
+
+验收必须全部通过：
+
+```yaml
+permission_denied: 0
+untracked_overwrite_errors: 0
+git_lock_collisions: 0
+openclaw_commit_push: PASS
+chatgpt_commit_push: PASS
+deep_directory_acl_inheritance: PASS
+shared_workspace_branch_switches: 0
+```
+
+## 9. 回滚
+
+若迁移失败：
+
+1. 停止新服务；
+2. 保留失败 worktree 供审计；
+3. 恢复 systemd drop-in 备份；
+4. `daemon-reload`；
+5. 恢复原服务状态；
+6. 不删除 `/data/aios-gitops/workspace`；
+7. 生产业务保持不变。
+
+## 10. 结果文件
+
+提交：
+
+```text
+.agent/results/openclaw/RESULT-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md
+```
+
+首段必须包含：
+
+```yaml
+status: PASS | BLOCKED | ROLLED_BACK
+task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
+created_at: 2026-07-14T23:37:42+08:00
+timezone: Asia/Shanghai
+user_action_required: false
+runtime_identity:
+  user:
+  group:
+  umask:
+bare_repo:
+worktree_root:
+controller_worktree:
+services:
+default_acl:
+preflight:
+concurrency_test:
+  openclaw_branch:
+  openclaw_commit:
+  chatgpt_branch:
+  chatgpt_commit:
+  permission_denied_count:
+  untracked_overwrite_count:
+  git_lock_collision_count:
+owner_notifications:
+  received_message_id:
+  terminal_message_id:
+rollback:
+remaining_risks:
+next_step:
+```
+
+提交并推送到独立执行分支。禁止直接推 main。
+
+## 完成微信模板
+
+PASS：
+
+```text
+【任务完成】GitOps独立worktree迁移已通过。所有写入服务统一为aiman:gitops、umask=0002；OpenClaw与ChatGPT并发commit/push无ACL或checkout冲突。生产业务版本未变化。
+```
+
+阻塞：
+
+```text
+【任务阻塞】GitOps独立worktree迁移未通过。原因=<具体服务/权限/并发验收>；已保留原workspace和回滚能力，生产业务未变化。
+```

VERSION

@@ -1 +1 @@
-V1R4C3
+V2R1C2

active-runtime/app/aios_chatgpt_actions_api.py

@@ -5,8 +5,59 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
 
-sys.path.insert(0, str(Path(os.getenv('AIOS_GITOPS_WORKSPACE', '/data/aios-gitops/workspace')) / 'runtime' / 'agent-os'))
+try:
+    from aios_gitops_write_guard import evaluate_git_write
+except ModuleNotFoundError:
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+    from aios_gitops_write_guard import evaluate_git_write
+
+from gitea_tag_publication import (
+    GiteaTagClient,
+    GitTagBackend,
+    PublicationConflict,
+    PublicationPending,
+    PublicationManualOwnerReviewRequired,
+    PublicationReconciliationRequired,
+    PublicationRequest,
+    TagPublisher,
+    redact,
+    validate_version,
+)
 from orchestrator.action_monitor import ActionMonitor
+from silent_release_hardening import (
+    ApprovalKeyRing,
+    ApprovalRevocationStore,
+    CapabilityAuthorizationError,
+    SagaConflict,
+    SignedApprovalVerifier,
+    SignedReleasePlanApproval,
+    SilentReleaseActionService,
+)
+try:
+    from authoritative_git import (
+        AuthoritativeGitError,
+        AuthoritativeGitNotFound,
+        AuthoritativeGitOutputTooLarge,
+        authoritative_branches,
+        authoritative_diff,
+        authoritative_commit,
+        authoritative_tags,
+        repository_snapshot,
+        run_authoritative_git,
+    )
+except ModuleNotFoundError:
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+    from authoritative_git import (
+        AuthoritativeGitError,
+        AuthoritativeGitNotFound,
+        AuthoritativeGitOutputTooLarge,
+        authoritative_branches,
+        authoritative_diff,
+        authoritative_commit,
+        authoritative_tags,
+        repository_snapshot,
+        run_authoritative_git,
+    )
 
 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WS = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
@@ -16,6 +67,19 @@ HOST = os.getenv('AIOS_GITOPS_HOST', '127.0.0.1')
 PORT = int(os.getenv('AIOS_GITOPS_PORT', '18890'))
 OPENAPI = WS / 'docs' / 'gitops' / 'openapi-chatgpt-actions.yaml'
 BARE_REPO = Path(os.getenv('AIOS_GITOPS_BARE_REPO', str(ROOT / 'runtime' / 'gitea-bin' / 'data' / 'repositories' / 'aios' / 'aios.git')))
+AUTHORITATIVE_GIT_DIR = Path(os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR')) if os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR') else None
+REPOSITORY_IDENTITY = os.getenv('AIOS_GITOPS_REPOSITORY_IDENTITY', '')
+SILENT_RELEASE_STATE_ROOT = Path(os.getenv(
+    'AIOS_SILENT_RELEASE_STATE_ROOT',
+    '/var/lib/aios-gitops/silent-release',
+))
+SILENT_RELEASE_EXECUTION_ENABLED = str(os.getenv(
+    'AIOS_SILENT_RELEASE_EXECUTION_ENABLED', 'false'
+)).lower() in {'1', 'true', 'yes', 'on'}
+SILENT_RELEASE_PUBLIC_KEYS = Path(os.getenv(
+    'AIOS_SILENT_RELEASE_PUBLIC_KEYS',
+    '/etc/aios-gitops/silent-release-owner-public-keys.json',
+))
 monitor = ActionMonitor()
 
 BASE_MODELS = [
@@ -26,6 +90,35 @@ BASE_MODELS = [
 SECRET_RE = re.compile(r'(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)\s*[:=]\s*["\']?([A-Za-z0-9_./+=:-]{16,})')
 SECRET_VAL_RE = re.compile(r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})')
 
+READ_ONLY_GET_PATHS = frozenset({
+    '/', '/health', '/api/health', '/api/openapi.yaml',
+    '/api/openapi-chatgpt-actions.yaml', '/api/schema', '/api', '/api/status',
+    '/api/base', '/api/baseline', '/base', '/api/ver', '/api/versions', '/ver',
+    '/api/diff', '/diff', '/api/patch', '/api/patches', '/api/branches', '/patch',
+    '/api/model', '/model', '/api/run', '/api/runtime-status', '/run',
+    '/api/action-monitor', '/action-monitor', '/admin/ai-evolution',
+    '/admin/ai-evolution/api/data',
+    '/api/release-consistency', '/api/tag-publication-status',
+    '/api/release-acceptance',
+    '/getReleaseCandidate', '/getApprovalEnvelope', '/getReleaseSaga',
+})
+SILENT_RELEASE_POST_PATHS = frozenset({
+    '/createReleaseCandidate',
+    '/submitOwnerApproval',
+    '/startDeployment',
+})
+
+def reject_non_read_http(handler, method: str, path: str) -> bool:
+    if method == 'GET':
+        return False
+    if path in SILENT_RELEASE_POST_PATHS:
+        return False
+    decision = evaluate_git_write(WS)
+    if decision.allowed:
+        return False
+    handler.sendj(decision.payload(), decision.status_code)
+    return True
+
 def now() -> str: return time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())
 def uid(p='id') -> str: return f'{p}-{int(time.time()*1000)}-{uuid.uuid4().hex[:8]}'
 def safe(s: str, n=160) -> str: return re.sub(r'[^A-Za-z0-9_./@-]+', '-', str(s or 'unknown')).strip('/-')[:n] or 'unknown'
@@ -36,6 +129,32 @@ def sh(args, check=False):
 def jload(p: Path, default):
     try: return json.loads(p.read_text(encoding='utf-8'))
     except Exception: return default
+
+def _file_sha256(path: Path) -> str:
+    digest=hashlib.sha256()
+    with path.open('rb') as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b''):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+def silent_release_service() -> SilentReleaseActionService:
+    verifier=None
+    if SILENT_RELEASE_PUBLIC_KEYS.is_file():
+        verifier=SignedApprovalVerifier(
+            ApprovalKeyRing.from_file(SILENT_RELEASE_PUBLIC_KEYS),
+            ApprovalRevocationStore(
+                SILENT_RELEASE_STATE_ROOT / 'revocations'
+            ),
+        )
+    policy_path=WS / 'config' / 'gitops' / 'silent-release-policy.json'
+    policy_sha=_file_sha256(policy_path) if policy_path.is_file() else ''
+    return SilentReleaseActionService(
+        SILENT_RELEASE_STATE_ROOT,
+        execution_enabled=SILENT_RELEASE_EXECUTION_ENABLED,
+        approval_verifier=verifier,
+        expected_repository=REPOSITORY_IDENTITY,
+        policy_sha256=policy_sha,
+    )
 def relpath(path: str) -> str:
     x = str(path or '').replace('\\','/').strip()
     if not x or x.startswith('/') or '..' in Path(x).parts or Path(x).parts[0] == '.git': raise ValueError('invalid path')
@@ -109,9 +228,13 @@ def ensure_git():
     if not sh(['config','user.name'])['stdout']: sh(['config','user.name','chatgpt-gitops-bot'], True)
 def checkout(branch, base='main', create=False):
     ensure_git(); b=branch_name(branch)
-    if create or sh(['rev-parse','--verify',b])['code'] != 0:
-        sh(['checkout',base], True); sh(['checkout','-B',b], True)
-    else: sh(['checkout',b], True)
+    exists = sh(['rev-parse','--verify',f'refs/heads/{b}'])['code'] == 0
+    if exists:
+        sh(['checkout',b], True)
+    elif create:
+        sh(['checkout',base], True); sh(['checkout','-b',b], True)
+    else:
+        raise ValueError(f'branch does not exist: {b}')
     return b
 def write_file(path, content):
     if content_has_secret(content): raise ValueError('secret_rejected: use secret_ref; plaintext API keys must not enter Git')
@@ -121,6 +244,19 @@ def sync_branch(branch: str) -> dict:
     if not branch or branch in ('main','master') or branch.startswith('main/') or branch.startswith('master/'):
         return {'status':'skipped','reason':'protected_branch','branch':branch}
     if BARE_REPO.exists():
+        common = sh(['rev-parse', '--path-format=absolute', '--git-common-dir'], True)['stdout']
+        if Path(common).resolve() == BARE_REPO.resolve():
+            head = sh(['rev-parse', 'HEAD'], True)['stdout']
+            stored = subprocess.run(
+                ['git', '--git-dir', str(BARE_REPO), 'rev-parse', f'refs/heads/{branch}'],
+                text=True, capture_output=True,
+            )
+            if stored.returncode != 0 or stored.stdout.strip() != head:
+                raise RuntimeError(f'linked-worktree branch verification failed for {branch}')
+            return {
+                'status':'verified', 'target':'authoritative-bare',
+                'branch':branch, 'oid':head,
+            }
         ref=f'refs/heads/{branch}:refs/heads/{branch}'
         p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
         if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git sync failed for {branch}')
@@ -130,15 +266,68 @@ def sync_branch(branch: str) -> dict:
     return {'status':'synced','target':'origin','branch':branch,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
 
 def sync_tag(tag: str) -> dict:
-    if not tag: return {'status':'skipped','reason':'empty_tag'}
-    if BARE_REPO.exists():
-        ref=f'refs/tags/{tag}:refs/tags/{tag}'
-        p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
-        if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag sync failed for {tag}')
-        return {'status':'synced','target':'bare','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
-    p=subprocess.run(['git','push','origin',tag], cwd=str(WS), text=True, capture_output=True)
-    if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag push failed for {tag}')
-    return {'status':'synced','target':'origin','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
+    raise RuntimeError(
+        'unsafe sync_tag disabled: use TagPublisher with expected tag_oid, '
+        'target_oid, Gitea remote verification, and authenticated API verification'
+    )
+
+def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
+    oid = str(value or '').strip().lower()
+    if not re.fullmatch(r'[0-9a-f]{40}', oid):
+        raise ValueError(f'{field} must be a full 40-character commit OID')
+    try:
+        return authoritative_commit(oid, git_dir=AUTHORITATIVE_GIT_DIR)
+    except (AuthoritativeGitError, ValueError) as exc:
+        raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
+
+def existing_tag_target(tag: str) -> str | None:
+    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
+        raise ValueError('invalid release version')
+    try:
+        result = run_authoritative_git(
+            ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
+            check=False,
+            git_dir=AUTHORITATIVE_GIT_DIR,
+        )
+    except AuthoritativeGitError as exc:
+        raise RuntimeError(str(exc)) from exc
+    return result.stdout.strip() if result.returncode == 0 else None
+
+def publication_request_from_query(q: dict[str, list[str]]) -> PublicationRequest:
+    required = ('version', 'target_oid', 'evidence_closure_oid', 'approval_plan_id')
+    missing = [name for name in required if not (q.get(name) or [''])[0]]
+    if missing:
+        raise ValueError('missing release governance fields: ' + ', '.join(missing))
+    return PublicationRequest(
+        (q['version'])[0],
+        (q['target_oid'])[0].lower(),
+        (q['evidence_closure_oid'])[0].lower(),
+        (q['approval_plan_id'])[0],
+    )
+
+def required_authoritative_git_dir() -> Path:
+    snapshot = repository_snapshot(
+        git_dir=AUTHORITATIVE_GIT_DIR,
+        repository_identity=REPOSITORY_IDENTITY,
+    )
+    if not snapshot["repository_available"]:
+        raise RuntimeError(str(snapshot["query_error"] or "AUTHORITATIVE_REPOSITORY_UNAVAILABLE"))
+    return Path(str(snapshot["authoritative_git_dir"]))
+
+
+def publication_publisher() -> TagPublisher:
+    authoritative_repo = required_authoritative_git_dir()
+    return TagPublisher(
+        WS,
+        GitTagBackend(WS, authoritative_repo=authoritative_repo),
+        GiteaTagClient(
+            os.getenv('AIOS_GITOPS_GITEA_API_URL',''),
+            os.getenv('AIOS_GITOPS_GITEA_REPOSITORY',''),
+            Path(os.getenv('AIOS_GITOPS_GITEA_TOKEN_FILE','')),
+            token_line=int(os.getenv('AIOS_GITOPS_GITEA_TOKEN_LINE','1')),
+        ),
+        os.getenv('AIOS_GITOPS_GITEA_REMOTE','gitea'),
+    )
 
 def commit(paths, msg):
     ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
@@ -158,6 +347,16 @@ def patches():
     for p in sorted((WS/'patches').glob('**/*.json')): out.append(jload(p, {'path':str(p.relative_to(WS))}))
     return out
 
+def runtime_release_info() -> dict[str, Any]:
+    for candidate in (WS / 'manifest.json', WS.parent / 'manifest.json'):
+        data = jload(candidate, {})
+        if data.get('target_commit'):
+            return {
+                'runtime_release_commit': data.get('target_commit'),
+                'runtime_release_path': str(WS),
+            }
+    return {'runtime_release_commit': None, 'runtime_release_path': str(WS)}
+
 class H(BaseHTTPRequestHandler):
     server_version='AIOSChatGPTGitOps/V1R1C0'
     def sendj(self, data, code=200):
@@ -179,43 +378,221 @@ class H(BaseHTTPRequestHandler):
         if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
         return a
     def do_GET(self):
-        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path; q=urllib.parse.parse_qs(u.query)
+        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
+        if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
+        q=urllib.parse.parse_qs(u.query)
         try:
             if path in ('/health','/api/health'): return self.sendj({'status':'ok','service':'chatgpt-gitops-adapter','workspace':str(WS)})
             if path in ('/api/openapi.yaml','/api/openapi-chatgpt-actions.yaml','/api/schema'):
                 return self.sendt(OPENAPI.read_text(encoding='utf-8'), 'application/yaml; charset=utf-8') if OPENAPI.exists() else self.sendj({'error':'schema_missing'},404)
             if path in ('/api','/api/status'): return self.sendj(api_spec())
             if path in ('/api/base','/api/baseline','/base'):
-                data=jload(WS/'baseline'/'current.json', {}); data.setdefault('git', sh(['rev-parse','--short','HEAD'])['stdout']); return self.sendj(data)
+                data=jload(WS/'baseline'/'current.json', {})
+                data.setdefault('authoritative_repository', repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                ))
+                return self.sendj(data)
             if path in ('/api/ver','/api/versions','/ver'):
-                return self.sendj({'tags':sh(['tag','--list','V*'])['stdout'].splitlines(),'versions_dir':[p.name for p in (WS/'versions').glob('*')],'head':sh(['rev-parse','--short','HEAD'])['stdout']})
+                snapshot = repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                )
+                if not snapshot['repository_available']:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': snapshot['query_error'],
+                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
+                        'local_authoritative_tags': [],
+                    }, 503)
+                try:
+                    tags = authoritative_tags(git_dir=AUTHORITATIVE_GIT_DIR)
+                except AuthoritativeGitError as exc:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': str(exc),
+                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
+                        'local_authoritative_tags': [],
+                    }, 503)
+                registry = [p.name for p in (WS/'versions').glob('*')]
+                return self.sendj({
+                    'registry_versions': registry,
+                    'local_authoritative_tags': tags,
+                    'repository_available': True,
+                    'query_error': None,
+                    'tags': [item['name'] for item in tags],
+                    'versions_dir': registry,
+                    'head': snapshot['authoritative_head_oid'],
+                    'authoritative_head_oid': snapshot['authoritative_head_oid'],
+                })
             if path in ('/api/diff','/diff'):
-                frm=(q.get('from') or ['HEAD~1'])[0]; to=(q.get('to') or ['HEAD'])[0]; return self.sendj({'from':frm,'to':to,'diff':sh(['diff',frm,to])})
-            if path in ('/api/patch','/api/patches','/api/branches','/patch'): return self.sendj({'patches':patches(),'branches':sh(['branch','--format','%(refname:short)'])['stdout'].splitlines()})
+                frm=(q.get('from') or [''])[0]
+                to=(q.get('to') or [''])[0]
+                try:
+                    diff=authoritative_diff(frm, to, git_dir=required_authoritative_git_dir())
+                except ValueError as exc:
+                    return self.sendj({'error':redact(exc)},400)
+                except AuthoritativeGitNotFound as exc:
+                    return self.sendj({'error':redact(exc)},404)
+                except AuthoritativeGitOutputTooLarge as exc:
+                    return self.sendj({'error':redact(exc)},413)
+                except (AuthoritativeGitError, RuntimeError) as exc:
+                    return self.sendj({'error':redact(exc)},503)
+                return self.sendj({'from':frm,'to':to,'diff':diff})
+            if path in ('/api/patch','/api/patches','/api/branches','/patch'):
+                snapshot = repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                )
+                if not snapshot['repository_available']:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': snapshot['query_error'],
+                        'metadata_patches': patches(),
+                        'authoritative_branches': [],
+                    }, 503)
+                try:
+                    branches = authoritative_branches(git_dir=AUTHORITATIVE_GIT_DIR)
+                except AuthoritativeGitError as exc:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': str(exc),
+                        'metadata_patches': patches(),
+                        'authoritative_branches': [],
+                    }, 503)
+                metadata = patches()
+                branch_names = {item['name'] for item in branches}
+                metadata_names = {
+                    item.get('branch') for item in metadata
+                    if isinstance(item, dict) and item.get('branch')
+                }
+                orphan = [
+                    item for item in metadata
+                    if item.get('branch') and item.get('branch') not in branch_names
+                ]
+                missing = [
+                    item for item in branches
+                    if item['name'] not in metadata_names
+                ]
+                return self.sendj({
+                    'metadata_patches': metadata,
+                    'authoritative_branches': branches,
+                    'orphan_metadata': orphan,
+                    'branches_without_metadata': missing,
+                    'repository_available': True,
+                    'query_error': None,
+                    'patches': metadata,
+                    'branches': [item['name'] for item in branches],
+                })
             if path in ('/api/model','/model'): return self.sendj({'base':BASE_MODELS,'custom':model_docs(),'priority':[jload(p,{}) for p in sorted((WS/'config'/'model_priority').glob('*.json'))]})
             if path in ('/api/run','/api/runtime-status','/run'):
                 svc=subprocess.run(['systemctl','is-active','aios-gitops-model-api'], text=True, capture_output=True)
-                return self.sendj({'service':'aios-gitops-model-api','status':svc.stdout.strip() or svc.stderr.strip(),'workspace_branch':sh(['rev-parse','--abbrev-ref','HEAD'])['stdout']})
+                snapshot = repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                )
+                workspace_branch = None
+                if (WS / '.git').exists():
+                    result = sh(['rev-parse','--abbrev-ref','HEAD'])
+                    workspace_branch = result['stdout'] or None
+                payload = {
+                    'service':'aios-gitops-model-api',
+                    'status':svc.stdout.strip() or svc.stderr.strip(),
+                    'workspace_branch':workspace_branch,
+                    **runtime_release_info(),
+                    **snapshot,
+                    'writes_enabled': str(os.getenv('AIOS_GITOPS_WRITES_ENABLED','false')).lower() in {'1','true','yes','on'},
+                }
+                return self.sendj(payload, 200 if snapshot['repository_available'] else 503)
             if path in ('/api/action-monitor','/action-monitor'):
                 latest=monitor.latest()
                 ldict={'event_id':latest.event_id,'action':latest.action,'error':latest.error,'context':latest.context,'created_at':latest.created_at} if latest else None
                 return self.sendj({'events':[{"event_id":e.event_id,"action":e.action,"error":e.error,"context":e.context,"created_at":e.created_at} for e in monitor.list_events()],'latest':ldict})
+            if path == '/api/tag-publication-status':
+                version=(q.get('version') or [''])[0]
+                try:
+                    version=validate_version(version)
+                    status=publication_publisher().get_tag_publication_status(version)
+                except ValueError:
+                    return self.sendj({'error':'invalid release version'},400)
+                return self.sendj(status)
+            if path == '/api/release-consistency':
+                request=publication_request_from_query(q)
+                return self.sendj(publication_publisher().get_release_consistency(request))
+            if path == '/api/release-acceptance':
+                request=publication_request_from_query(q)
+                return self.sendj(publication_publisher().run_release_acceptance(request))
+            if path in (
+                '/getReleaseCandidate',
+                '/getApprovalEnvelope',
+                '/getReleaseSaga',
+            ):
+                candidate_id=(q.get('candidate_id') or [''])[0]
+                if not candidate_id:
+                    return self.sendj({'error':'candidate_id is required'},400)
+                service=silent_release_service()
+                if path == '/getReleaseCandidate':
+                    return self.sendj(
+                        service.get_release_candidate(candidate_id)
+                    )
+                if path == '/getApprovalEnvelope':
+                    return self.sendj(
+                        service.get_approval_envelope(candidate_id)
+                    )
+                return self.sendj(service.get_release_saga(candidate_id))
                         # Admin AI Evolution Dashboard
             if path in ('/admin/ai-evolution','/admin/ai-evolution/'):
                 return self.ai_evolution_page()
             if path in ('/admin/ai-evolution/api/data'):
                 return self.ai_evolution_data()
             return self.sendj({'error':'not_found','path':path},404)
+        except FileNotFoundError:
+            return self.sendj({'error':'release candidate not found'},404)
+        except ValueError as e:
+            error=redact(e)
+            monitor.record_failure('do_GET', error, {'path':path})
+            return self.sendj({'error':error},400)
         except Exception as e:
-            monitor.record_failure('do_GET', str(e), {'path':path})
-            return self.sendj({'error':str(e)},500)
+            error=redact(e)
+            monitor.record_failure('do_GET', error, {'path':path})
+            return self.sendj({'error':error},500)
     def do_PUT(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'PUT', path): return
+        data=self.body()
         if path == '/api/model-priority': return self.model_priority(data)
         return self.sendj({'error':'not_found','path':path},404)
     def do_POST(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'POST', path): return
+        data=self.body()
         try:
+            if path == '/createReleaseCandidate':
+                a=self.need('release:candidate')
+                if not a: return
+                return self.sendj(
+                    silent_release_service().create_release_candidate(data)
+                )
+            if path == '/submitOwnerApproval':
+                a=self.need('release:approve')
+                if not a: return
+                return self.sendj(
+                    silent_release_service().submit_owner_approval(data)
+                )
+            if path == '/startDeployment':
+                a=self.need('release:deploy')
+                if not a: return
+                approval=(
+                    SignedReleasePlanApproval.from_dict(data['approval'])
+                    if isinstance(data.get('approval'), dict)
+                    else None
+                )
+                return self.sendj(
+                    silent_release_service().start_deployment(
+                        str(data.get('candidate_id') or ''),
+                        approval=approval,
+                    )
+                )
             if path in ('/api/branch','/api/create-branch'): return self.branch(data)
             if path in ('/api/file','/api/commit-file'): return self.file(data)
             if path == '/api/commit': return self.commit(data)
@@ -226,9 +603,30 @@ class H(BaseHTTPRequestHandler):
             if path == '/api/model-priority': return self.model_priority(data)
             if path == '/api/nl': return self.nl(data)
             return self.sendj({'error':'not_found','path':path},404)
+        except (ValueError, FileNotFoundError) as e:
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},400)
+        except CapabilityAuthorizationError as e:
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},403)
+        except SagaConflict as e:
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},409)
         except Exception as e:
-            monitor.record_failure('do_POST', str(e), {'path':path})
-            return self.sendj({'error':str(e)},500)
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},500)
+    def do_PATCH(self):
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'PATCH', path): return
+        return self.sendj({'error':'not_found','path':path},404)
+    def do_DELETE(self):
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'DELETE', path): return
+        return self.sendj({'error':'not_found','path':path},404)
     def branch(self,data):
         a=self.need('branch:create');
         if not a: return
@@ -252,12 +650,41 @@ class H(BaseHTTPRequestHandler):
         if not a: return
         ver=data.get('version') or data.get('tag')
         if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
-        if data.get('confirm') != True:
-            self.sendj({'status':'confirm_required','operation':'tag','hint':'This operation creates a Git tag. Confirm to proceed.','x-openai-isConsequential':True}, 428)
-            return
+        if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
+            return self.sendj({
+                'error':'production_tag_evidence_required',
+                'required':['version','target_oid','evidence_closure_oid','approval_plan_id'],
+            },400)
+        try:
+            target_oid=resolve_commit_oid(data.get('target_oid'))
+            evidence_oid=resolve_commit_oid(data.get('evidence_closure_oid'), 'evidence_closure_oid')
+        except ValueError as exc:
+            return self.sendj({'error':'invalid_tag_target','detail':str(exc)},400)
         if a['role'] != 'owner' or not data.get('execute'):
-            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'commit':c})
-        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver)})
+            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'request':req,'commit':c})
+        request=PublicationRequest(ver,target_oid,evidence_oid,str(data.get('approval_plan_id')))
+        main_before=sh(['rev-parse','refs/heads/main'], True)['stdout']
+        publisher=publication_publisher()
+        try:
+            publication=publisher.publish(request)
+        except PublicationManualOwnerReviewRequired as exc:
+            audit(a['account'],'tag_manual_owner_review_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':redact(exc)})
+            return self.sendj({'status':'MANUAL_OWNER_REVIEW_REQUIRED','error':redact(exc),'main_changed':False,'force_push':False},409)
+        except PublicationConflict as exc:
+            audit(a['account'],'tag_conflict',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
+            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},409)
+        except PublicationPending as exc:
+            audit(a['account'],'tag_pending',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
+            return self.sendj({'status':'REMOTE_PUSH_PENDING','error':str(exc),'main_changed':False,'force_push':False},503)
+        except PublicationReconciliationRequired as exc:
+            audit(a['account'],'tag_reconciliation_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
+            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},502)
+        main_after=sh(['rev-parse','refs/heads/main'], True)['stdout']
+        if main_after != main_before:
+            raise RuntimeError('main changed during tag operation')
+        result={'status':publication['state'],'version':ver,'tag_name':ver,'tag_oid':publication['tag_oid'],'target_oid':target_oid,'expected_target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'workspace_head':sh(['rev-parse','HEAD'],True)['stdout'],'main_oid_before':main_before,'main_oid_after':main_after,'main_changed':False,'force_push':False,'publication':publication}
+        audit(a['account'],'tag',ver,result)
+        self.sendj(result)
     def rollback(self,data):
         a=self.need('rollback:request');
         if not a: return
@@ -352,7 +779,10 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
         cmd_filter=(params.get('command') or [None])[0]
         bl=jload(WS/'baseline'/'current.json',{})
         current_ver=bl.get('current_baseline','V1R3C1')
-        tags=sh(['tag','--list','V*'])['stdout'].splitlines() if WS.exists() else []
+        try:
+            tags=[item['name'] for item in authoritative_tags(git_dir=required_authoritative_git_dir()) if str(item['name']).startswith('V')]
+        except (AuthoritativeGitError, RuntimeError) as exc:
+            return self.sendj({'error':redact(exc),'repository_available':False},503)
         versions=[]
         if (WS/'baseline'/'promotions').exists():
             for p in sorted((WS/'baseline'/'promotions').glob('*.json')):
@@ -390,9 +820,9 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
 
 
 def api_spec():
-    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True}}
+    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
 
 def main():
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
-if __name__ == '__main__': main()
+if __name__ == '__main__': main()

active-runtime/app/aios_gitops_write_guard.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""Fail-closed policy for in-process Git mutation handlers."""
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Mapping
+
+_TRUE = frozenset({"1", "true", "yes", "on"})
+
+
+@dataclass(frozen=True)
+class GitWriteDecision:
+    allowed: bool
+    status_code: int
+    error: str
+    reason: str
+    workspace: str
+
+    def payload(self) -> dict[str, str]:
+        return {
+            "status": "allowed" if self.allowed else "blocked",
+            "error": self.error,
+            "reason": self.reason,
+            "workspace": self.workspace,
+        }
+
+
+def _real(path: Path) -> Path:
+    return Path(os.path.realpath(os.path.abspath(str(path))))
+
+
+def evaluate_git_write(workspace: Path | str, env: Mapping[str, str] | None = None) -> GitWriteDecision:
+    values = os.environ if env is None else env
+    lexical = Path(os.path.abspath(str(workspace)))
+    canonical = _real(lexical)
+    shown = str(lexical)
+    if str(values.get("AIOS_GITOPS_WRITES_ENABLED", "false")).strip().lower() not in _TRUE:
+        return GitWriteDecision(False, 423, "gitops_writes_disabled", "AIOS_GITOPS_WRITES_ENABLED is false", shown)
+    if lexical != canonical:
+        return GitWriteDecision(False, 409, "workspace_symlink_forbidden", "workspace must be a canonical non-symlink path", shown)
+    controller = _real(Path(values.get("AIOS_GITOPS_CONTROLLER_PATH", "/data/aios-gitops/worktrees/controller")))
+    role = str(values.get("AIOS_GITOPS_WORKSPACE_ROLE", "")).strip().lower()
+    if canonical == controller or role == "runtime-anchor":
+        return GitWriteDecision(False, 423, "runtime_anchor_read_only", "controller/runtime-anchor is read-only", str(canonical))
+    writer_root = _real(Path(values.get("AIOS_GITOPS_APPROVED_WRITER_ROOT", "/data/aios-gitops/worktrees")))
+    try:
+        canonical.relative_to(writer_root)
+    except ValueError:
+        return GitWriteDecision(False, 409, "workspace_not_approved_writer", "workspace is outside the approved writer root", str(canonical))
+    return GitWriteDecision(True, 200, "", "approved isolated writer", str(canonical))

active-runtime/app/architecture_owner_gate_http.py

@@ -0,0 +1,79 @@
+"""HTTP handler and display data for architecture owner gate."""
+
+from __future__ import annotations
+
+from dataclasses import asdict
+from datetime import datetime, timezone
+from typing import Any
+
+from .architecture_owner_gate import ArchitectureOwnerGate, ArchitectureOwnerApprovalRequest
+
+
+gate = ArchitectureOwnerGate()
+
+# In-memory store for pending approval requests
+_pending_requests: dict[str, dict[str, Any]] = {}
+_decisions: dict[str, dict[str, Any]] = {}
+
+
+def create_owner_approval_request(change: dict[str, Any], architect_decision: dict[str, Any]) -> dict[str, Any]:
+    req = gate.create_request(change, architect_decision)
+    d = asdict(req)
+    _pending_requests[req.change_id] = d
+    return d
+
+
+def approve_request(change_id: str, decided_by: str = "owner", reason: str = "") -> dict[str, Any]:
+    req = _pending_requests.get(change_id)
+    if not req:
+        return {"error": f"no pending request for change_id={change_id}"}
+    decision = asdict(
+        ArchitectureOwnerApprovalRequest.__bases__[1].__new__(type("_ArchitectureOwnerDecision", (), {}))  # noqa
+    )
+    try:
+        from .architecture_owner_gate import ArchitectureOwnerDecision
+        dec = ArchitectureOwnerDecision(
+            request_id=req["request_id"],
+            change_id=change_id,
+            decision="approved",
+            decided_by=decided_by,
+            reason=reason,
+        )
+        d = asdict(dec)
+        _decisions[change_id] = d
+        # remove from pending
+        _pending_requests.pop(change_id, None)
+        return {"allowed": True, "decision": d}
+    except Exception as exc:
+        return {"error": str(exc)}
+
+
+def reject_request(change_id: str, decided_by: str = "owner", reason: str = "") -> dict[str, Any]:
+    from .architecture_owner_gate import ArchitectureOwnerDecision
+    req = _pending_requests.get(change_id)
+    if not req:
+        return {"error": f"no pending request for change_id={change_id}"}
+    try:
+        dec = ArchitectureOwnerDecision(
+            request_id=req["request_id"],
+            change_id=change_id,
+            decision="rejected",
+            decided_by=decided_by,
+            reason=reason,
+        )
+        d = asdict(dec)
+        _decisions[change_id] = d
+        _pending_requests.pop(change_id, None)
+        return {"allowed": False, "decision": d}
+    except Exception as exc:
+        return {"error": str(exc)}
+
+
+def get_owner_gate_overview() -> dict[str, Any]:
+    return {
+        "pending_requests": list(_pending_requests.values()),
+        "decisions": list(_decisions.values()),
+        "pending_count": len(_pending_requests),
+        "approved_count": sum(1 for d in _decisions.values() if d.get("decision") == "approved"),
+        "rejected_count": sum(1 for d in _decisions.values() if d.get("decision") == "rejected"),
+    }

active-runtime/app/authoritative_git.py

@@ -0,0 +1,355 @@
+"""Fail-closed access to the authoritative bare Git repository."""
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import urllib.parse
+from pathlib import Path
+from typing import Iterable
+
+_ALLOWED_COMMANDS = frozenset(
+    {
+        "cat-file",
+        "config",
+        "diff",
+        "for-each-ref",
+        "ls-remote",
+        "merge-base",
+        "push",
+        "remote",
+        "rev-parse",
+        "show-ref",
+        "tag",
+    }
+)
+_OID_RE = re.compile(r"^[0-9a-f]{40}$")
+_MAX_OUTPUT = 1_048_576
+_TIMEOUT = 8.0
+
+
+class AuthoritativeGitError(RuntimeError):
+    """A fail-closed authoritative repository or ref query error."""
+
+
+class AuthoritativeGitNotFound(AuthoritativeGitError):
+    """A validated revision does not exist in the authoritative repository."""
+
+
+class AuthoritativeGitOutputTooLarge(AuthoritativeGitError):
+    """A controlled Git query exceeded the response-size boundary."""
+
+
+def _redact(text: str) -> str:
+    value = str(text or "")
+    value = re.sub(r"(?i)(authorization\s*[:=]\s*)(?:bearer|token)\s+\S+", r"\1REDACTED", value)
+    value = re.sub(r"(?i)((?:access_)?token\s*[:=]\s*)\S+", r"\1REDACTED", value)
+    value = re.sub(r"(?i)(https?://[^/\s:@]+:)[^@\s/]+@", r"\1REDACTED@", value)
+    return value
+
+
+def _configured_path(git_dir: str | Path | None = None) -> Path:
+    raw = str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
+    if not raw:
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    path = Path(raw)
+    if not path.is_absolute() or ".." in path.parts:
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    try:
+        resolved = path.resolve(strict=True)
+    except OSError as exc:
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE") from exc
+    if not resolved.is_dir():
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    return resolved
+
+
+def _run(
+    git_dir: Path,
+    args: list[str],
+    *,
+    check: bool,
+    timeout: float = _TIMEOUT,
+) -> subprocess.CompletedProcess[str]:
+    if not args or args[0] not in _ALLOWED_COMMANDS:
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+    try:
+        result = subprocess.run(
+            ["git", "--git-dir", str(git_dir), *args],
+            text=True,
+            capture_output=True,
+            timeout=timeout,
+            env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED") from exc
+    if len(result.stdout) + len(result.stderr) > _MAX_OUTPUT:
+        raise AuthoritativeGitOutputTooLarge("GIT_OUTPUT_LIMIT_EXCEEDED")
+    if check and result.returncode != 0:
+        detail = _redact(result.stderr.strip() or result.stdout.strip())
+        raise AuthoritativeGitError(
+            "GIT_REF_QUERY_FAILED" + (f": {detail[:160]}" if detail else "")
+        )
+    return result
+
+
+def _repository_identity_from_remote(url: str) -> str:
+    value = str(url or "").strip().split("?", 1)[0].rstrip("/")
+    if not value:
+        return ""
+    if "://" in value:
+        value = urllib.parse.urlparse(value).path
+    elif ":" in value:
+        value = value.rsplit(":", 1)[1]
+    value = value.rsplit("@", 1)[-1].strip("/")
+    value = re.sub(r"\.git$", "", value, flags=re.IGNORECASE)
+    parts = [part for part in value.split("/") if part]
+    if len(parts) >= 2:
+        value = "/".join(parts[-2:])
+    return value.strip("/").lower()
+
+
+def verify_repository(
+    git_dir: str | Path | None = None,
+    repository_identity: str | None = None,
+) -> tuple[Path, str]:
+    path = _configured_path(git_dir)
+    expected = str(
+        repository_identity
+        or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
+    ).strip().strip("/")
+    if not expected or expected.count("/") != 1:
+        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
+    bare = _run(path, ["rev-parse", "--is-bare-repository"], check=True)
+    if bare.stdout.strip().lower() != "true":
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    remote = _run(path, ["config", "--get", "remote.gitea.url"], check=False)
+    actual = _repository_identity_from_remote(remote.stdout)
+    if actual != expected.lower():
+        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
+    return path, expected
+
+
+def run_authoritative_git(
+    args: list[str],
+    *,
+    check: bool = True,
+    git_dir: str | Path | None = None,
+    timeout: float = _TIMEOUT,
+) -> subprocess.CompletedProcess[str]:
+    path, _ = verify_repository(git_dir=git_dir)
+    return _run(path, list(args), check=check, timeout=timeout)
+
+
+def authoritative_head_oid(
+    *,
+    git_dir: str | Path | None = None,
+) -> str:
+    result = run_authoritative_git(["rev-parse", "--verify", "refs/heads/main"], git_dir=git_dir)
+    oid = result.stdout.strip().lower()
+    if not _OID_RE.fullmatch(oid):
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+    return oid
+
+
+def authoritative_tags(
+    *,
+    git_dir: str | Path | None = None,
+) -> list[dict[str, str | None]]:
+    result = run_authoritative_git(
+        [
+            "for-each-ref",
+            "refs/tags",
+            "--format=%(refname:strip=2)\t%(objectname)\t%(objecttype)",
+        ],
+        git_dir=git_dir,
+    )
+    tags: list[dict[str, str | None]] = []
+    for line in result.stdout.splitlines():
+        name, oid, object_type = (line.split("\t", 2) + ["", ""])[:3]
+        if not name or not _OID_RE.fullmatch(oid.lower()):
+            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+        peeled_result = run_authoritative_git(
+            ["rev-parse", "--verify", f"refs/tags/{name}^{{commit}}"],
+            git_dir=git_dir,
+        )
+        peeled = peeled_result.stdout.strip().lower()
+        if not _OID_RE.fullmatch(peeled):
+            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+        tags.append(
+            {
+                "name": name,
+                "tag_oid": oid.lower(),
+                "object_type": object_type,
+                "peeled_target_oid": peeled,
+            }
+        )
+    return tags
+
+
+def authoritative_branches(
+    *,
+    git_dir: str | Path | None = None,
+) -> list[dict[str, str]]:
+    result = run_authoritative_git(
+        [
+            "for-each-ref",
+            "refs/heads",
+            "--format=%(refname:strip=2)\t%(objectname)",
+        ],
+        git_dir=git_dir,
+    )
+    branches: list[dict[str, str]] = []
+    for line in result.stdout.splitlines():
+        name, oid = (line.split("\t", 1) + [""])[:2]
+        if not name or not _OID_RE.fullmatch(oid.lower()):
+            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+        branches.append({"name": name, "oid": oid.lower()})
+    return branches
+
+
+def authoritative_commit(
+    oid: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> str:
+    value = str(oid or "").strip().lower()
+    if not _OID_RE.fullmatch(value):
+        raise ValueError("commit OID must be a full 40-character value")
+    result = run_authoritative_git(
+        ["rev-parse", "--verify", f"{value}^{{commit}}"],
+        git_dir=git_dir,
+    )
+    resolved = result.stdout.strip().lower()
+    if resolved != value:
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+    return resolved
+
+
+def authoritative_lineage(
+    ancestor: str,
+    descendant: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> None:
+    authoritative_commit(ancestor, git_dir=git_dir)
+    authoritative_commit(descendant, git_dir=git_dir)
+    result = run_authoritative_git(
+        ["merge-base", "--is-ancestor", ancestor, descendant],
+        check=False,
+        git_dir=git_dir,
+    )
+    if result.returncode != 0:
+        raise AuthoritativeGitError("evidence lineage mismatch")
+
+
+_SAFE_REF_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{0,239}$")
+
+
+def _safe_ref_name(value: str) -> bool:
+    return bool(
+        _SAFE_REF_RE.fullmatch(value)
+        and ".." not in value
+        and "//" not in value
+        and "@{" not in value
+        and not value.endswith(("/", ".", ".lock"))
+        and not any(part in {"", ".", ".."} for part in value.split("/"))
+    )
+
+
+def validate_git_revision(
+    value: str,
+    field: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> str:
+    revision = str(value or "").strip()
+    if not revision or revision != str(value or "") or revision.startswith("-"):
+        raise ValueError(f"invalid {field} revision")
+    if _OID_RE.fullmatch(revision.lower()):
+        try:
+            return authoritative_commit(revision.lower(), git_dir=git_dir)
+        except AuthoritativeGitError as exc:
+            raise AuthoritativeGitNotFound(f"{field} revision not found") from exc
+    if not _safe_ref_name(revision) or any(token in revision for token in ("^", "~", ":", "\\")):
+        raise ValueError(f"invalid {field} revision")
+    if revision.startswith("refs/"):
+        if not revision.startswith(("refs/heads/", "refs/tags/")):
+            raise ValueError(f"invalid {field} revision")
+        candidates = [revision]
+    else:
+        candidates = [f"refs/heads/{revision}", f"refs/tags/{revision}"]
+    matches: list[str] = []
+    for candidate in candidates:
+        result = run_authoritative_git(
+            ["rev-parse", "--verify", f"{candidate}^{{commit}}"],
+            check=False,
+            git_dir=git_dir,
+        )
+        oid = result.stdout.strip().lower()
+        if result.returncode == 0 and _OID_RE.fullmatch(oid):
+            matches.append(oid)
+    if not matches:
+        raise AuthoritativeGitNotFound(f"{field} revision not found")
+    if len(set(matches)) != 1 or len(matches) != 1:
+        raise ValueError(f"ambiguous {field} revision")
+    return matches[0]
+
+
+def authoritative_diff(
+    from_revision: str,
+    to_revision: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> dict[str, object]:
+    path, _ = verify_repository(git_dir=git_dir)
+    from_oid = validate_git_revision(from_revision, "from", git_dir=path)
+    to_oid = validate_git_revision(to_revision, "to", git_dir=path)
+    args = ["diff", "--no-ext-diff", "--no-textconv", from_oid, to_oid]
+    result = run_authoritative_git(args, git_dir=path)
+    return {
+        "code": 0,
+        "stdout": result.stdout,
+        "stderr": "",
+        "cmd": ["git", f"--git-dir={path}", *args],
+        "from_oid": from_oid,
+        "to_oid": to_oid,
+    }
+
+
+def repository_snapshot(
+    *,
+    git_dir: str | Path | None = None,
+    repository_identity: str | None = None,
+) -> dict[str, object]:
+    configured = bool(
+        str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
+    )
+    try:
+        path, identity = verify_repository(
+            git_dir=git_dir,
+            repository_identity=repository_identity,
+        )
+        head = authoritative_head_oid(git_dir=path)
+        return {
+            "repository_available": True,
+            "authoritative_git_dir_configured": configured,
+            "authoritative_git_dir_readable": True,
+            "authoritative_git_dir": str(path),
+            "authoritative_head_oid": head,
+            "repository_identity": identity,
+            "query_error": None,
+        }
+    except (AuthoritativeGitError, ValueError) as exc:
+        return {
+            "repository_available": False,
+            "authoritative_git_dir_configured": configured,
+            "authoritative_git_dir_readable": False,
+            "authoritative_git_dir": None,
+            "authoritative_head_oid": None,
+            "repository_identity": str(
+                repository_identity
+                or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
+            ).strip() or None,
+            "query_error": _redact(str(exc)),
+        }

active-runtime/app/static/admin-ai-evolution.html

@@ -58,6 +58,8 @@ pre { white-space: pre-wrap; word-break: break-word; }
       <li onclick="showPanel('versions')"><i>🏷️</i> Versions</li>
       <li onclick="showPanel('commands')"><i>⚡</i> Commands</li>
       <li onclick="showPanel('agents')"><i>🤖</i> Agent Runs</li>
+      <li onclick="showPanel('arch-owner')"><i>🔐</i> Owner Gate</li>
+      <li onclick="showPanel('arch-approve')"><i>✓</i> Approve Changes</li>
     </ul>
   </div>
   <div class="main">
@@ -90,6 +92,14 @@ pre { white-space: pre-wrap; word-break: break-word; }
     </div>
     <div id="panel-agents" class="panel" style="display:none;">
       <div class="main-header"><h2>Recent Agent Executions</h2></div>
+    <div id="panel-arch-owner" class="panel" style="display:none;">
+      <div class="main-header"><h2>🔐 Architecture Owner Gate</h2></div>
+      <div id="arch-owner-content">Loading...</div>
+    </div>
+    <div id="panel-arch-approve" class="panel" style="display:none;">
+      <div class="main-header"><h2>✓ Approve Architecture Changes</h2></div>
+      <div id="arch-approve-content">Loading...</div>
+    </div>
       <div id="agents-list">Loading...</div>
     </div>
   </div>
@@ -97,3 +107,159 @@ pre { white-space: pre-wrap; word-break: break-word; }
 <script>
 async function fetchData() {
   const r = await fetch('/admin/ai-evolution/api/data');
+  const data = await r.json();
+  document.getElementById('loading').style.display = 'none';
+  document.getElementById('error').style.display = 'none';
+  document.getElementById('content').style.display = '';
+
+  const hs = document.getElementById('header-status');
+  hs.className = 'status-badge ' + (data.healthy ? 'ok' : 'fail');
+  hs.textContent = data.healthy ? '▪ operational' : '⚠ degraded';
+
+  document.getElementById('base').textContent = data.baseline || '-';
+  document.getElementById('branch').textContent = data.main_branch || 'main';
+  document.getElementById('uptime').textContent = data.uptime || '-';
+  document.getElementById('bus-status').textContent = data.bus ? JSON.stringify(data.bus, null, 2) : 'no event bus data';
+}
+
+async function loadVersions() {
+  const el = document.getElementById('versions-list');
+  el.innerHTML = '<div class="loading">Loading versions...</div>';
+  try {
+    const r = await fetch('/admin/ai-evolution/api/versions');
+    const data = await r.json();
+    if (data.error) { el.innerHTML = '<div class="error">' + data.error + '</div>'; return; }
+    let html = '<div class="grid">';
+    for (const v of data.versions || []) {
+      html += '<div class="card"><div class="card-title">' + v.tag + '</div><div class="card-value">' + (v.version || v.tag) + '</div></div>';
+    }
+    html += '</div>';
+    el.innerHTML = html;
+  } catch(e) {
+    el.innerHTML = '<div class="error">Failed to load versions: ' + e.message + '</div>';
+  }
+}
+
+async function loadCommands() {
+  const el = document.getElementById('commands-list');
+  el.innerHTML = '<div class="loading">Loading commands...</div>';
+  try {
+    const r = await fetch('/admin/ai-evolution/api/data');
+    const data = await r.json();
+    let cmds = data.commands || [];
+    let html = '<div style="display:flex;gap:24px;margin-bottom:16px;">';
+    html += '<div><div class="card"><div class="card-title">Total</div><div class="card-value">' + cmds.length + '</div></div></div>';
+    html += '<div><div class="card"><div class="card-title">By Category</div>';
+    const cats = {};
+    for (const c of cmds) { const k = c.category || 'uncategorized'; cats[k] = (cats[k] || 0) + 1; }
+    for (const [k, v] of Object.entries(cats)) html += '<div style="font-size:14px;color:#8b949e;margin:4px 0;">' + k + ': ' + v + '</div>';
+    html += '</div></div></div>';
+    for (const cmd of cmds.slice().reverse()) {
+      html += '<div class="command-item"><div class="meta">' + cmd.category + ' | ' + cmd.filename + '</div><div class="name">' + cmd.title + '</div><div style="font-size:13px;color:#c9d1d9;margin-top:4px;">' + cmd.summary + '</div></div>';
+    }
+    el.innerHTML = html;
+  } catch(e) {
+    el.innerHTML = '<div class="error">Failed to load commands: ' + e.message + '</div>';
+  }
+}
+
+async function loadAgents() {
+  const el = document.getElementById('agents-list');
+  el.innerHTML = '<div class="loading">Loading agent runs...</div>';
+  try {
+    const r = await fetch('/admin/ai-evolution/api/agents');
+    const data = await r.json();
+    if (data.error) { el.innerHTML = '<div class="error">' + data.error + '</div>'; return; }
+    let html = '';
+    for (const agent of data.agents || []) {
+      html += '<div class="agent-item"><div class="agent-title">' + agent.name + ' <span class="state state-' + (agent.status === 'running' ? 'running' : (agent.status === 'ok' ? 'completed' : 'failed')) + '">' + agent.status + '</span></div><div class="agent-meta">' + (agent.runs || 0) + ' runs | last: ' + (agent.last_run || '-') + '</div></div>';
+    }
+    el.innerHTML = html || '<div style="padding:24px;color:#8b949e;">No agent runs recorded yet.</div>';
+  } catch(e) {
+    el.innerHTML = '<div class="error">Failed to load agents: ' + e.message + '</div>';
+  }
+}
+
+function showPanel(name) {
+
+async function loadOwnerGate() {
+  const el = document.getElementById('arch-owner-content');
+  el.innerHTML = '<div class="loading">Loading owner gate data...</div>';
+  try {
+    const r = await fetch('/admin/ai-evolution/api/owner-gate');
+    const data = await r.json();
+    let html = '<div class="row">';
+    html += '<div class="col"><div class="card"><div class="card-title">Pending Requests</div><div class="card-value">' + data.pending_count + '</div></div></div>';
+    html += '<div class="col"><div class="card"><div class="card-title">Approved</div><div class="card-value">' + data.approved_count + '</div></div></div>';
+    html += '<div class="col"><div class="card"><div class="card-title">Rejected</div><div class="card-value">' + data.rejected_count + '</div></div></div>';
+    html += '</div>';
+    html += '<div class="card"><div class="card-title">Pending Approval Requests</div>';
+    if (data.pending_requests && data.pending_requests.length) {
+      for (const req of data.pending_requests) {
+        html += '<div class="command-item">';
+        html += '<div class="name">' + (req.title || req.change_id) + '</div>';
+        html += '<div class="meta">ID: ' + req.change_id + ' | Risk: ' + req.risk + '</div>';
+        html += '<div style="font-size:13px;color:#c9d1d9;margin-top:4px;">' + (req.reason || '') + '</div>';
+        html += '</div>';
+      }
+    } else {
+      html += '<div style="color:#8b949e;padding:12px;">No pending requests.</div>';
+    }
+    html += '</div>';
+    el.innerHTML = html;
+  } catch(e) {
+    el.innerHTML = '<div class="error">Failed to load: ' + e.message + '</div>';
+  }
+}
+
+async function loadApprove() {
+  const el = document.getElementById('arch-approve-content');
+  el.innerHTML = '<div class="loading">Loading pending approvals...</div>';
+  try {
+    const r = await fetch('/admin/ai-evolution/api/owner-gate');
+    const data = await r.json();
+    let html = '';
+    if (data.pending_requests && data.pending_requests.length) {
+      html += '<div class="card"><div class="card-title">Pending changes requiring your approval</div>';
+      for (const req of data.pending_requests) {
+        html += '<div class="command-item">';
+        html += '<div class="name">' + (req.title || req.change_id) + '</div>';
+        html += '<div class="meta">Risk: <strong>' + req.risk + '</strong></div>';
+        html += '<div style="font-size:13px;color:#c9d1d9;margin:8px 0;">' + (req.reason || '') + '</div>';
+        html += '<div style="display:flex;gap:8px;">';
+        html += '<button onclick="ownerAction.classList.add('\'approved\');this.disabled=true" style="padding:6px 16px;background:#238636;color:#fff;border:none;border-radius:6px;cursor:pointer;font-size:13px;">✓ Approve</button>';
+        html += '</div></div>';
+      }
+      html += '</div>';
+    } else {
+      html += '<div class="card"><div style="padding:24px;text-align:center;color:#8b949e;">✅ All changes processed. No pending approval requests.</div></div>';
+    }
+    el.innerHTML = html;
+  } catch(e) {
+    el.innerHTML = '<div class="error">Failed to load: ' + e.message + '</div>';
+  }
+}
+
+  document.querySelectorAll('.panel').forEach(p => p.style.display = 'none');
+  document.getElementById('panel-' + name).style.display = '';
+  document.querySelectorAll('.sidebar-nav li').forEach(li => li.classList.remove('active'));
+  document.querySelector('.sidebar-nav li:nth-child(' + ({overview:1,versions:2,commands:3,agents:4}[name] || 1) + ')').classList.add('active');
+  if (name === 'overview') {
+    document.getElementById('panel-overview').innerHTML = '<div class="main-header"><h2>System Overview</h2><div id="header-status" class="status-badge">Loading...</div></div><div id="loading" class="loading">Loading...</div><div id="error" class="error" style="display:none;"></div><div id="content"><div class="row"><div class="col"><div class="card"><div class="card-title">Current Baseline</div><div id="base" class="card-value">-</div></div></div><div class="col"><div class="card"><div class="card-title">Git Branch</div><div id="branch" class="card-value">-</div></div></div><div class="col"><div class="card"><div class="card-title">Uptime</div><div id="uptime" class="card-value">-</div></div></div></div><div class="card" style="margin-top:16px"><div class="card-title">Event Bus Status</div><pre id="bus-status">-</pre></div></div>';
+    fetchData();
+  }
+  const loaders = {
+    'arch-owner': loadOwnerGate,
+    'arch-approve': loadApprove,
+    versions: loadVersions,
+    commands: loadCommands,
+    agents: loadAgents,
+  };
+  const fn = loaders[name];
+  if (fn) fn();
+}
+
+fetchData();
+</script>
+</body>
+</html>

baseline/current.json

@@ -1 +1,25 @@
-{"current_baseline":"V1R3C1","promoted_at":"2026-07-08T14:31:00+08:00","previous_baseline":"V1R2C3"}
+{
+  "current_baseline": "V2R1C2",
+  "previous_baseline": "V2R1C1",
+  "promoted_at": "2026-07-22T01:40:51Z",
+  "git": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "promoted_by": "codex/owner-approved-gitops",
+  "promotion_reason": "Owner-authorized V2R1C2 Unified Portal production release after exact tag binding, complete evidence verification, and production acceptance PASS.",
+  "version": "V2R1C2",
+  "release_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
+  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
+  "status": "PRODUCTION_DEPLOYED",
+  "production_service": "aios-v2r1c2-production.service",
+  "production_port": 18920,
+  "rollback_version": "V2R1C1",
+  "constraints": {
+    "product_code_changed": true,
+    "production_redeployed": true,
+    "production_traffic_changed": true,
+    "tag_rewritten": false,
+    "force_push_allowed": false,
+    "rollback_assets_preserved": true
+  }
+}

config/gitops/silent-release-policy.json

@@ -0,0 +1,63 @@
+{
+  "schema_version": 2,
+  "automatic": [
+    "build",
+    "test",
+    "artifact",
+    "canary",
+    "evidence"
+  ],
+  "owner": [
+    "signed_release_plan"
+  ],
+  "forbidden": [
+    "force_push",
+    "tag_rewrite",
+    "direct_main_push",
+    "baseline_mutation",
+    "registry_mutation"
+  ],
+  "runtime_deployment": {
+    "approval_action": "signed_release_plan",
+    "required_capability": "runtime_switch",
+    "tag_operations_allowed": false,
+    "baseline_mutation_allowed": false,
+    "registry_mutation_allowed": false,
+    "writer_default": false,
+    "rollback_required": true
+  },
+  "tag_release": {
+    "approval_action": "signed_release_plan",
+    "required_capability": "tag_publish",
+    "separate_controller": true,
+    "duplicate_conflict": "fail_closed",
+    "rewrite_allowed": false,
+    "force_push_allowed": false
+  },
+  "baseline_registry_finalize": {
+    "approval_action": "signed_release_plan",
+    "required_capability": "baseline_registry_finalize",
+    "separate_controller": true,
+    "remote_tag_verification_required": true,
+    "gitea_api_verification_required": true,
+    "registry_baseline_consistency_required": true
+  },
+  "approval": {
+    "algorithm": "Ed25519",
+    "replay_protection": true,
+    "revocation_fail_closed": true,
+    "key_rotation_supported": true,
+    "capabilities": [
+      "runtime_switch",
+      "tag_publish",
+      "baseline_registry_finalize"
+    ]
+  },
+  "execution": {
+    "environment_variable": "AIOS_SILENT_RELEASE_EXECUTION_ENABLED",
+    "default_enabled": false,
+    "shadow_side_effects_allowed": false,
+    "durable_saga_required": true,
+    "pre_switch_revalidation_required": true
+  }
+}

config/gitops/worktree-governance.yaml

@@ -0,0 +1,59 @@
+version: 1
+policy_id: gitops-isolated-worktree-governance-20260714T232948UTC8
+
+runtime_identity:
+  user: aiman
+  group: gitops
+  umask: "0002"
+  prohibit_root_workspace_writes: true
+
+repository:
+  source_worktree: /data/aios-gitops/workspace
+  bare_repo: /data/aios-gitops/repo.git
+  worktree_root: /data/aios-gitops/worktrees
+  remote: origin
+
+worktrees:
+  controller: /data/aios-gitops/worktrees/controller
+  task_pattern: /data/aios-gitops/worktrees/{agent}/{task_id}
+  allowed_agents:
+    - openclaw
+    - chatgpt
+    - controller
+  require_clean_start: true
+  remove_after_successful_push: true
+  retain_on_failure: true
+
+permissions:
+  owner: aiman
+  group: gitops
+  directory_mode: "2775"
+  file_mode: "0664"
+  default_acl:
+    user:aiman: rwx
+    group:gitops: rwx
+  apply_to:
+    - /data/aios-gitops
+    - /data/aios-gitops/worktrees
+
+preflight:
+  required_user: aiman
+  required_group: gitops
+  required_umask: "0002"
+  require_writable_git_dir: true
+  require_writable_task_dir: true
+  require_writable_result_dir: true
+  reject_shared_source_worktree: true
+  reject_existing_git_lock: true
+
+notifications:
+  owner_on_received: required
+  owner_on_terminal: required
+  preferred_channel: weixin
+  redact_secrets: true
+
+rollback:
+  preserve_source_worktree: true
+  remove_created_worktrees: true
+  restore_service_dropins: true
+  restore_service_state: true

config/systemd/aios-gitops-runtime-identity.conf

@@ -0,0 +1,14 @@
+# Install as a systemd drop-in for GitOps/OpenClaw writer services.
+# Example: /etc/systemd/system/<service>.service.d/10-runtime-identity.conf
+
+[Service]
+User=aiman
+Group=gitops
+SupplementaryGroups=gitops
+UMask=0002
+Environment=AIOS_GITOPS_ROOT=/data/aios-gitops
+Environment=AIOS_BARE_REPO=/data/aios-gitops/repo.git
+Environment=AIOS_WORKTREE_ROOT=/data/aios-gitops/worktrees
+Environment=AIOS_RUNTIME_USER=aiman
+Environment=AIOS_RUNTIME_GROUP=gitops
+Environment=AIOS_RUNTIME_UMASK=0002

deploy/aios-v2/systemd/aios-v2r1c2-production.env.example

@@ -0,0 +1,27 @@
+# AIOS V2R1C2 Unified Portal production metadata.
+# No secret values belong in this file; runtime integrations use references.
+
+AIOS_V2_HOST=127.0.0.1
+AIOS_V2_PORT=18920
+AIOS_V2_STATE_DIR=/var/lib/aios-v2r1c2-production
+AIOS_PROVENANCE_STORE_FILE=/var/lib/aios-v2r1c2-production/run-provenance.sqlite3
+AIOS_EXTERNAL_TASK_STORE_FILE=/var/lib/aios-v2r1c2-production/external-task-truth.sqlite3
+AIOS_EXECUTOR_CATALOG_FILE=/var/lib/aios-v2r1c2-production/executor-catalog.json
+AIOS_EXECUTION_PLAN_FILES=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-RELEASE.json:/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+AIOS_EXECUTION_PLAN_FILE=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+
+AIOS_RELEASE_VERSION=V2R1C2
+AIOS_TARGET_VERSION=V2R1C2
+AIOS_BASELINE_VERSION=V2R1C1
+AIOS_PREVIOUS_VERSION=V2R1C1
+AIOS_RELEASE_STATUS=PRODUCTION
+AIOS_RELEASE_SOURCE_OID=3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24
+AIOS_RELEASE_OID=3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24
+AIOS_RELEASE_TAG=V2R1C2
+AIOS_RELEASE_EVIDENCE_SHA256=2e27bb73b8e6297bd3077238f73a96d697fc3c3611c601c4dc9357e5fdcd8eee
+
+AIOS_OPENCLAW_CONTRACT_VERSION=aios.openclaw.command.v2
+AIOS_OPENCLAW_SIGNATURE_ALGORITHM=Ed25519
+AIOS_OPENCLAW_PLUGIN_VERSION=2.1.0-rc.4
+AIOS_OPENCLAW_SIGNING_KEY_ID=openclaw-v2r1-candidate-ed25519
+AIOS_OWNER_WECHAT_TARGET_REF=AIOS_OWNER_WECHAT_TARGET_REF

deploy/aios-v2/systemd/aios-v2r1c2-production.service

@@ -0,0 +1,44 @@
+[Unit]
+Description=AIOS V2R1C2 Unified Portal Production
+After=network-online.target
+Wants=network-online.target
+Conflicts=aios-orchestrator-gateway.service
+ConditionPathExists=/opt/aios-v2r1c2/active-runtime/app/aios_web/release_application.py
+ConditionPathExists=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+
+[Service]
+Type=simple
+User=aios
+Group=aios
+WorkingDirectory=/opt/aios-v2r1c2/active-runtime/app
+EnvironmentFile=/etc/aios-v2/aios-v2r1c2-production.env
+Environment=PYTHONUNBUFFERED=1
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStartPre=/usr/bin/test "$AIOS_V2_PORT" = "18920"
+ExecStartPre=/usr/bin/test "$AIOS_RELEASE_SOURCE_OID" = "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24"
+ExecStartPre=/usr/bin/test "$AIOS_RELEASE_TAG" = "V2R1C2"
+ExecStart=/usr/bin/python3 -m aios_web.release_application
+Restart=on-failure
+RestartSec=3
+TimeoutStartSec=60
+TimeoutStopSec=30
+KillSignal=SIGTERM
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+ReadWritePaths=/var/lib/aios-v2r1c2-production
+StateDirectory=aios-v2r1c2-production
+StateDirectoryMode=0750
+UMask=0027
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-gitops-model-api.service

@@ -11,6 +11,8 @@ Environment=AIOS_GITOPS_WORKSPACE=/data/aios-gitops/workspace
 Environment=AIOS_GITOPS_DB=/data/aios-gitops/runtime/gitops_model.sqlite3
 Environment=AIOS_GITOPS_TOKEN_FILE=/data/aios-gitops/runtime/secrets/gitops.tokens
 Environment=AIOS_GITOPS_BARE_REPO=/data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios-v23.git
+Environment=AIOS_GITOPS_AUTHORITATIVE_GIT_DIR=/data/aios-gitops/repo.git
+Environment=AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
 Environment=AIOS_GITOPS_HOST=127.0.0.1
 Environment=AIOS_GITOPS_PORT=18890
 ExecStart=/usr/bin/python3 /data/aios-gitops/workspace/active-runtime/app/aios_chatgpt_actions_api.py

deployments/V1R4C6/backup-result.md

@@ -0,0 +1,7 @@
+# V1R4C6 Backup Result
+
+- version: V1R4C6
+- status: NOT_STARTED
+- reason: No confirmed production Stack, persistent volume, database migration target, or V1R4C5 image digest is bound to this source release. A backup cannot be claimed or executed safely without an identified target datastore.
+- prohibited_actions_not_performed: production database deletion; persistent-volume deletion; docker system prune --volumes; direct copy of live database files.
+- required_before_resume: confirmed Stack identity and its documented backup/restore command.

deployments/V1R4C6/deployment-result.md

@@ -0,0 +1,14 @@
+# V1R4C6 Deployment Result
+
+- version: V1R4C6
+- source_commit: e204a90398bf646d46245b3088226749fa056edd
+- tag_commit: d8cf6058e99f5c7f2dfd2b45a406c0a7edf955b2
+- image_repository: UNRESOLVED
+- image_digest: UNRESOLVED
+- previous_image_digest: UNRESOLVED
+- portainer_environment: UNRESOLVED
+- portainer_stack: UNRESOLVED
+- deployment_action: NOT_EXECUTED
+- reason: No source-to-image-to-Portainer-Stack mapping exists. Existing Portainer containers and known Docker workloads do not expose a V1R4C6/e204 deployment target or Portainer stack labels. The active GitOps API is a direct systemd Python process, not a Portainer-managed Docker Stack.
+- rollback_status: NOT_APPLICABLE_NO_CHANGE
+- final_status: BLOCKED_MISSING_CONFIRMED_PRODUCTION_STACK

deployments/V1R4C6/preflight-result.md

@@ -0,0 +1,15 @@
+# V1R4C6 Production Preflight Result
+
+- version: V1R4C6
+- started_at_utc: 2026-07-11T16:57:04.0596039Z
+- source_tag_object: 356a8a8c1860b94b7d61a456c29228c88e57d963
+- source_tag_commit: d8cf6058e99f5c7f2dfd2b45a406c0a7edf955b2
+- source_commit: e204a90398bf646d46245b3088226749fa056edd
+- tag_to_source_relation: tag commit is direct parent of source commit (verified)
+- production_host_identifier: cn-network-mkt (hw / 1.95.164.183)
+- host_preflight: Docker 29.5.3; root filesystem 29 percent used; memory available approximately 56 GiB
+- GitOps_runtime: active at /data/aios-gitops/workspace via aios-gitops-model-api.service
+- runtime_base: current_baseline V1R4C6; previous_baseline V1R4C5; git e204a90398bf646d46245b3088226749fa056edd; service status ok
+- Portainer discovery: Portainer instances are reachable on ubuntu-admin and ubuntu-aihost, but no confirmed Portainer Environment/Stack maps to V1R4C6 or e204a90398bf646d46245b3088226749fa056edd.
+- source_build_contract: target source contains only deploy/gitea/docker-compose.yml and no application Dockerfile/Containerfile or V1R4C6 image repository declaration.
+- status: BLOCKED_MISSING_CONFIRMED_PRODUCTION_STACK

deployments/V1R4C6/rollback-result.md

@@ -0,0 +1,7 @@
+# V1R4C6 Rollback Result
+
+- version: V1R4C6
+- rollback_required: No
+- rollback_executed: No
+- reason: No container, Stack, database, image, or production configuration was changed during this run.
+- captured_v1r4c5_digest: UNRESOLVED because no matching current production Stack was confirmed.

deployments/V1R4C6/verification-result.md

@@ -0,0 +1,11 @@
+# V1R4C6 Verification Result
+
+- version: V1R4C6
+- healthcheck_result: GitOps adapter /health = 200 and /api/base = 200; this verifies the control-plane API only, not a V1R4C6 production deployment.
+- gate_a_result: NOT_RUN (production admin workbench target and authenticated test path unresolved)
+- gate_b_result: NOT_RUN (production Search Gateway target/provider binding unresolved)
+- gate_c_result: NOT_RUN (production Agent Platform target/runtime request path unresolved)
+- runtime_acceptance_result: NOT_RUN (0/8; cannot reuse non-production results)
+- critical_control_plane_finding: gitea-branch-consistency-sentinel is failed with five Git-ref-to-Gitea-metadata drift entries and autonomous safe mode emitted. This is a hard safety gate failure.
+- no_unresolved_critical_errors: false
+- final_status: BLOCKED_MISSING_CONFIRMED_PRODUCTION_STACK

docs/gitops/SILENT_RELEASE_CONTROLLER_DESIGN.md

@@ -0,0 +1,268 @@
+# AIOS Silent Release Controller Design Report
+
+状态：隔离分支实现；生产 mutation 禁止
+目标：自动准备 → 自动验证 → 单次 Owner 签名授权 → 分控制器自动执行与验收
+
+## 1. 当前痛点
+
+现有流程需要多轮人工传递 commit、tree、artifact、manifest、测试、canary、drop-in
+和回滚证据。证据在不同消息里重复抄写，容易出现：
+
+- 构建后 artifact、manifest 或 policy 已变化，但旧批准仍被使用；
+- Git、Gitea、systemd 与回滚结果由人工拼接，缺少同一一致性快照；
+- runtime switch、tag、Baseline、Registry 的授权边界不清；
+- 重启后只剩工作树内临时 JSON，无法可靠恢复；
+- approval replay、并发 writer、key revoke 和 secret inheritance 缺少统一防线。
+
+## 2. 新架构
+
+```text
+Build / Test / Canary
+        |
+        v
+ReleaseCandidate + DeploymentPlan
+        |
+        v
+ReleaseAcceptanceEngine
+        |
+        v
+READY_FOR_APPROVAL
+        |
+        v
+SignedReleasePlanApproval (Ed25519)
+        |
+        +--> runtime_switch capability
+        |       DeploymentController
+        |
+        +--> tag_publish capability
+        |       TagController
+        |
+        +--> baseline_registry_finalize capability
+                BaselineRegistryFinalizeController
+
+Durable ReleaseSagaStore + CapabilityLedger + Event Journal
+贯穿三个控制器；控制器互相不拥有对方的 mutation API。
+```
+
+一次 Owner 批准是同一个不可变 release plan 的签名，不是一个万能执行入口。三个 capability
+分别消费、分别留痕、分别幂等恢复。`force_push`、`tag_rewrite`、`direct_main_push`
+永远不是可签发 capability。
+
+## 3. 状态机
+
+```text
+PREPARING
+  -> VERIFYING
+  -> READY_FOR_APPROVAL
+  -> APPROVED
+  -> PRE_SWITCH_REVALIDATING
+  -> SWITCH_PENDING
+  -> SWITCHED
+  -> RUNTIME_VERIFYING
+  -> TAG_PENDING
+  -> TAG_VERIFIED
+  -> BASELINE_REGISTRY_PENDING
+  -> COMPLETED
+
+任一可恢复故障 -> RECONCILIATION_REQUIRED
+对象冲突       -> MANUAL_OWNER_REVIEW_REQUIRED
+切换后失败     -> ROLLBACK_PENDING -> ROLLED_BACK
+```
+
+状态快照使用 revision compare-and-set；事件同时写入 append-only journal。writer 崩溃后根据
+状态确定唯一恢复动作。并发控制器中只有一个 CAS winner。
+
+## 4. 数据模型
+
+### ReleaseCandidate
+
+```text
+candidate_id
+source_commit
+tree_oid
+artifact_sha256
+manifest_sha256
+tests
+canary
+rollback_ready
+git_consistency
+gitea_consistency
+approval_state
+```
+
+### DeploymentPlan
+
+```text
+service
+release_path / release_root
+dropin_path / dropin_sha256
+rollback_path / rollback_sha256
+source_commit
+artifact_sha256
+manifest_sha256
+policy_sha256
+health_contract
+sha256
+```
+
+### SignedReleasePlanApproval
+
+```text
+release_plan_id
+candidate_id
+source_commit
+tree_oid
+artifact_sha256
+manifest_sha256
+deployment_plan_sha256
+policy_sha256
+approval_plan_id
+evidence_closure_oid
+owner_approval_record_oid
+capabilities
+expires_at
+nonce
+key_id
+signature
+fingerprint
+```
+
+签名内容使用 canonical JSON，`signature` 不参与被签名字段。验证包括 Ed25519 签名、过期时间、
+公钥状态、approval revoke、candidate/plan/policy 逐字段绑定和 capability allowlist。
+
+## 5. API
+
+```text
+POST /createReleaseCandidate
+GET  /getReleaseCandidate?candidate_id=...
+GET  /getApprovalEnvelope?candidate_id=...
+POST /submitOwnerApproval
+POST /startDeployment
+GET  /getReleaseSaga?candidate_id=...
+```
+
+写接口要求 Bearer scope。`AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false` 是默认值；此时可以
+持久化 candidate、生成 approval envelope、保存经验证的 Owner approval 和读取 Saga，
+但 `/startDeployment` 只返回 `SHADOW_MODE` 与空 `side_effects`。
+
+## 6. PreSwitchValidator
+
+切换前重新收集并比较：
+
+- source commit 与 tree；
+- artifact、manifest、policy 和 deployment plan SHA-256；
+- rollback readiness；
+- local、authoritative bare 与 Gitea refs；
+- repository identity；
+- task writer/production writer 边界；
+- health contract。
+
+任一变化都抛出：
+
+```text
+APPROVAL_STALE_REAPPROVAL_REQUIRED
+```
+
+旧批准不会被“最佳努力”继续使用。
+
+## 7. systemd 防线
+
+- service 与 drop-in 均为显式 allowlist；
+- release 与 drop-in resolved path 必须位于 release root 内；
+- 拒绝普通文件被替换为 symlink，拒绝 symlink escape；
+- deployment lock 覆盖 switch、restart 和首次 health check；
+- restart 前后记录 MainPID 与 ActiveEnterTimestampMonotonic；
+- artifact、drop-in、rollback 和 manifest 均按 plan hash 复验；
+- 子进程只接收固定 allowlist 环境，不继承 token、password、credential、askpass、
+  auth socket、`LD_PRELOAD`、`PYTHONPATH` 或数据库连接串。
+
+## 8. TagController 分离
+
+TagController 必须独立完成 approval、execute、verify，并留下：
+
+```text
+evidence_closure_oid
+approval_plan_id
+repository_identity
+remote_tag_oid
+remote_peeled_target_oid
+gitea_api_tag_oid
+gitea_listing_visible
+```
+
+同名 tag 的 tag OID 或 peeled target 不同，进入
+`MANUAL_OWNER_REVIEW_REQUIRED`；自动流程不 push、不删除、不重写、不 force push。
+
+## 9. Baseline / Registry 门禁
+
+只有以下全部一致时，`baseline_registry_finalize` capability 才能完成：
+
+```text
+Registry = Baseline = remote tag = Gitea API = expected target
+```
+
+UNKNOWN、API 不可达、repository identity 不符或 listing 不可见均 fail closed。
+
+## 10. Policy as Code
+
+```text
+automatic:
+  build, test, artifact, canary, evidence
+
+owner:
+  signed_release_plan
+
+capabilities:
+  runtime_switch
+  tag_publish
+  baseline_registry_finalize
+
+forbidden:
+  force_push
+  tag_rewrite
+  direct_main_push
+  baseline_mutation
+  registry_mutation
+```
+
+最后两个 forbidden 项指“脱离受治理 finalize controller 的直接 mutation”。
+
+## 11. Security model
+
+- Ed25519 公钥 ring 支持 rotation 和 revoke，私钥不进入 runtime；
+- approval plan 可撤销，过期、未知 key、错误签名均 fail closed；
+- nonce 与 capability operation 持久化，重复相同请求幂等，不同 fingerprint 重放拒绝；
+- Saga snapshot 原子写、journal append-only、CAS 防并发 writer；
+- credential 只通过受控 reference 使用，不进入 Git、API 响应或异常；
+- 子进程环境从空集合构建，不复制 `os.environ`；
+- Shadow 模式默认开启，execution adapter 缺失时不能降级执行；
+- runtime、tag、Baseline/Registry 分属三个能力最小化控制器。
+
+## 12. Migration plan
+
+1. Shadow：生成 candidate、plan、acceptance、approval package，仅比较现有人工结果。
+2. Signed approval：接入 Owner 公钥 ring、撤销源和审计 record；仍不接生产 executor。
+3. Canary execution：使用非生产 service/release root 验证锁、PID、health、崩溃恢复和回滚。
+4. Controlled production switch：另行 Owner 授权启用 execution flag，只开放 runtime capability。
+5. Tag/finalize：分别完成 Gitea 与 Registry/Baseline 生产验收后再启用对应 capability。
+
+每个阶段均可退回上一个阶段；不开启下一能力不会影响已经启用的控制器。
+
+## 13. Rollback plan
+
+- switch 前保存旧 symlink target、PID、启动时间、artifact 与 plan fingerprint；
+- restart 或 health 任一失败进入 `ROLLBACK_PENDING`；
+- 原子恢复旧 target，只 restart 指定 allowlist service；
+- 重新验证旧 runtime commit、writer=false 与 repository identity；
+- 成功进入 `ROLLED_BACK`，失败进入 `MANUAL_OWNER_REVIEW_REQUIRED`；
+- rollback 不修改 Git main、production tag、Baseline 或 Registry；
+- 保留脱敏 journal、approval fingerprint 和失败证据。
+
+## 14. 测试与外部依赖边界
+
+自动测试覆盖签名伪造、字段篡改、过期/revoke/key rotation、nonce replay、CAS race、
+崩溃恢复、artifact/policy/plan mutation、tag conflict、secret leakage、runtime without
+`.git`、rollback 和 shadow no-side-effects。
+
+本隔离实现不创建生产 KMS/key、不安装 systemd unit、不部署 Action runtime、不创建 tag，
+也不修改 Baseline/Registry。上述动作必须在单独生产批准中执行。

docs/gitops/gitea-tag-publication-atomicity.md

@@ -0,0 +1,68 @@
+# Gitea Tag Publication Atomicity
+
+Release publication is a fail-closed Saga bound to one immutable governance
+fingerprint:
+
+- `version`
+- `target_oid`
+- `evidence_closure_oid`
+- `approval_plan_id`
+
+The normal progression is:
+
+`PENDING` → `LOCAL_TAG_CREATED` → `REMOTE_PUSH_CONFIRMED` →
+`GITEA_API_CONFIRMED` → `BASELINE_UPDATE_PENDING` → `BASELINE_UPDATED` →
+`PRODUCTION_DEPLOYED`
+
+An unavailable remote uses `REMOTE_PUSH_PENDING` or
+`RECONCILIATION_REQUIRED`. A same-name tag object mismatch, peeled-target
+mismatch, changed governance fingerprint, or immutable deployment-evidence
+conflict enters `MANUAL_OWNER_REVIEW_REQUIRED`. That state blocks automatic
+push and reconciliation; recovery never deletes, rewrites, or force-pushes a
+tag.
+
+## Legacy state migration
+
+Readers normalize the historical `TAG_CREATED_LOCAL` value to
+`LOCAL_TAG_CREATED` in memory. Read-only status responses therefore expose only
+the canonical value. The next governed Saga write persists the canonical name;
+reading legacy state alone does not mutate the tag, Baseline, Registry, or Saga
+file. Any unrecognized persisted state fails closed as
+`RECONCILIATION_REQUIRED`.
+
+`BASELINE_UPDATE_PENDING` is persisted before either `baseline/current.json` or
+`versions/<version>.json` changes. Recovery revalidates the governance
+fingerprint, evidence lineage, remote annotated tag, peeled target, Gitea API,
+listing, and repository identity before idempotently completing matching
+partial records. A different tag or target enters
+`MANUAL_OWNER_REVIEW_REQUIRED`.
+
+## Durable state
+
+Production writers set `AIOS_GITOPS_PUBLICATION_STATE_DIR` to storage outside
+their disposable worktree. Recreating a writer must reuse that directory.
+Worktree JSON is not the authoritative Saga store.
+
+## Deployment gate
+
+`mark_production_deployed` performs fresh Git remote, peeled-target, Gitea ref,
+Gitea tag-object, listing, repository-identity, evidence-lineage, Registry, and
+Baseline checks. Deployment is allowed only when:
+
+`Registry = Baseline = remote tag = Gitea API = expected target`
+
+Deployment evidence must be an immutable `sha256:<64 hex>` or `git:<40 hex>`
+identifier.
+
+## Read-only acceptance
+
+- `getTagPublicationStatus` reads durable Saga state.
+- `getReleaseConsistency` compares every release authority.
+- `runReleaseAcceptance` returns `accepted: true` only for `PASS`.
+
+Unavailable evidence returns `UNKNOWN` with `fail_closed: true`; it is never
+treated as acceptance.
+
+The CLI, HTTP Action, and release script all enter the same publisher core for
+evidence-lineage verification. The release script stages Registry and Baseline
+records only; durable Saga state remains outside Git.

docs/gitops/openapi-chatgpt-actions.yaml

@@ -13,6 +13,27 @@ components:
       scheme: bearer
       bearerFormat: opaque-token
   schemas:
+    PublicationState:
+      type: string
+      description: Canonical durable publication state. Legacy TAG_CREATED_LOCAL is normalized on read and is never emitted by new writes.
+      enum:
+        - PENDING
+        - LOCAL_TAG_CREATED
+        - REMOTE_PUSH_PENDING
+        - REMOTE_PUSH_CONFIRMED
+        - GITEA_API_CONFIRMED
+        - BASELINE_UPDATE_PENDING
+        - BASELINE_UPDATED
+        - PRODUCTION_DEPLOYED
+        - RECONCILIATION_REQUIRED
+        - MANUAL_OWNER_REVIEW_REQUIRED
+    PublicationStatus:
+      type: object
+      required: [version, state]
+      properties:
+        version: {type: string}
+        state: {$ref: '#/components/schemas/PublicationState'}
+        fail_closed: {type: boolean}
     BranchRequest:
       type: object
       required: [branch]
@@ -50,9 +71,20 @@ components:
         message: {type: string}
     TagRequest:
       type: object
-      required: [version]
+      required: [version, target_oid, evidence_closure_oid, approval_plan_id]
       properties:
         version: {type: string, example: V1R1C1}
+        target_oid:
+          type: string
+          pattern: '^[0-9a-fA-F]{40}$'
+          description: Full approved commit OID. The tag is created explicitly at this commit, never implicitly at workspace HEAD.
+        evidence_closure_oid:
+          type: string
+          pattern: '^[0-9a-fA-F]{40}$'
+          description: Required evidence closure commit. target_oid must be its ancestor.
+        approval_plan_id:
+          type: string
+          description: Audited owner-approved release or tag plan identifier.
         message: {type: string}
         execute:
           type: boolean
@@ -103,7 +135,142 @@ components:
       properties:
         text: {type: string}
         branch: {type: string}
+    DeploymentPlan:
+      type: object
+      required: [service, release_path, release_root, dropin_path, dropin_sha256, rollback_path, rollback_sha256, source_commit, artifact_sha256, manifest_sha256, policy_sha256, health_contract]
+      properties:
+        service: {type: string}
+        release_path: {type: string}
+        release_root: {type: string}
+        dropin_path: {type: string}
+        dropin_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        rollback_path: {type: string}
+        rollback_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        source_commit: {type: string, pattern: '^[0-9a-f]{40}$'}
+        artifact_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        manifest_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        policy_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        health_contract: {type: object, additionalProperties: true}
+    ReleaseCandidateInput:
+      type: object
+      required: [candidate_id, source_commit, tree_oid, artifact_sha256, manifest_sha256]
+      properties:
+        candidate_id: {type: string, pattern: '^[A-Za-z0-9][A-Za-z0-9_.-]{2,127}$'}
+        source_commit: {type: string, pattern: '^[0-9a-f]{40}$'}
+        tree_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        artifact_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        manifest_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        tests: {type: object}
+        canary: {type: object}
+        rollback_ready: {type: boolean}
+        git_consistency: {type: object}
+        gitea_consistency: {type: object}
+        deployment_plan: {$ref: '#/components/schemas/DeploymentPlan'}
+    SignedReleasePlanApproval:
+      type: object
+      required: [release_plan_id, candidate_id, source_commit, tree_oid, artifact_sha256, manifest_sha256, deployment_plan_sha256, policy_sha256, approval_plan_id, evidence_closure_oid, owner_approval_record_oid, capabilities, expires_at, nonce, key_id, signature]
+      properties:
+        release_plan_id: {type: string}
+        candidate_id: {type: string}
+        source_commit: {type: string, pattern: '^[0-9a-f]{40}$'}
+        tree_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        artifact_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        manifest_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        deployment_plan_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        policy_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
+        approval_plan_id: {type: string}
+        evidence_closure_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        owner_approval_record_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        capabilities:
+          type: array
+          uniqueItems: true
+          items:
+            type: string
+            enum: [runtime_switch, tag_publish, baseline_registry_finalize]
+        expires_at: {type: string, format: date-time}
+        nonce: {type: string, minLength: 16}
+        key_id: {type: string}
+        signature: {type: string, format: byte, writeOnly: true}
+    StartDeploymentRequest:
+      type: object
+      required: [candidate_id, approval]
+      properties:
+        candidate_id: {type: string}
+        approval: {$ref: '#/components/schemas/SignedReleasePlanApproval'}
 paths:
+  /createReleaseCandidate:
+    post:
+      operationId: createReleaseCandidate
+      summary: Persist an immutable release candidate and deployment plan; shadow-safe
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/ReleaseCandidateInput'}
+      responses:
+        '200': {description: Candidate created or idempotently returned}
+        '400': {description: Invalid or conflicting candidate evidence}
+        '401': {description: Unauthorized}
+      x-openai-isConsequential: true
+  /getReleaseCandidate:
+    get:
+      operationId: getReleaseCandidate
+      summary: Read a durable release candidate
+      parameters:
+        - {in: query, name: candidate_id, required: true, schema: {type: string}}
+      responses:
+        '200': {description: Candidate}
+        '404': {description: Candidate not found}
+  /getApprovalEnvelope:
+    get:
+      operationId: getApprovalEnvelope
+      summary: Generate the immutable owner-signature payload
+      parameters:
+        - {in: query, name: candidate_id, required: true, schema: {type: string}}
+      responses:
+        '200': {description: Approval envelope fingerprint inputs}
+        '404': {description: Candidate not found}
+  /submitOwnerApproval:
+    post:
+      operationId: submitOwnerApproval
+      summary: Verify and durably store a signed owner release plan
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/SignedReleasePlanApproval'}
+      responses:
+        '200': {description: Signature verified and approval stored}
+        '400': {description: Invalid approval}
+        '403': {description: Signature, key, expiry, or revocation failure}
+        '409': {description: Conflicting release plan}
+      x-openai-isConsequential: true
+  /startDeployment:
+    post:
+      operationId: startDeployment
+      summary: Start the approved Saga; default shadow mode returns no side effects
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/StartDeploymentRequest'}
+      responses:
+        '200': {description: Shadow result or deployment Saga result}
+        '403': {description: Execution disabled or approval invalid}
+        '409': {description: Saga conflict}
+      x-openai-isConsequential: true
+  /getReleaseSaga:
+    get:
+      operationId: getReleaseSaga
+      summary: Read durable Saga state and event journal
+      parameters:
+        - {in: query, name: candidate_id, required: true, schema: {type: string}}
+      responses:
+        '200': {description: Saga snapshot}
+        '404': {description: Saga not found}
   /api/base:
     get:
       operationId: getBaseline
@@ -199,6 +366,39 @@ paths:
             schema: {$ref: '#/components/schemas/CommitRequest'}
       responses: {'200': {description: Commit result}, '401': {description: Unauthorized}}
       x-openai-isConsequential: true
+  /api/tag-publication-status:
+    get:
+      operationId: getTagPublicationStatus
+      summary: Read durable publication Saga status without mutation
+      parameters:
+        - {in: query, name: version, required: true, schema: {type: string, pattern: '^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$'}}
+      responses:
+        '200':
+          description: Canonical publication state or fail-closed UNKNOWN
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/PublicationStatus'}
+        '400': {description: Version required}
+  /api/release-consistency:
+    get:
+      operationId: getReleaseConsistency
+      summary: Compare Registry, Baseline, remote tag, Gitea API, listing, repository identity, and expected target
+      parameters:
+        - {in: query, name: version, required: true, schema: {type: string}}
+        - {in: query, name: target_oid, required: true, schema: {type: string, pattern: '^[0-9a-fA-F]{40}$'}}
+        - {in: query, name: evidence_closure_oid, required: true, schema: {type: string, pattern: '^[0-9a-fA-F]{40}$'}}
+        - {in: query, name: approval_plan_id, required: true, schema: {type: string}}
+      responses: {'200': {description: PASS, FAIL, or fail-closed UNKNOWN}}
+  /api/release-acceptance:
+    get:
+      operationId: runReleaseAcceptance
+      summary: Run read-only release acceptance; UNKNOWN is not accepted
+      parameters:
+        - {in: query, name: version, required: true, schema: {type: string}}
+        - {in: query, name: target_oid, required: true, schema: {type: string, pattern: '^[0-9a-fA-F]{40}$'}}
+        - {in: query, name: evidence_closure_oid, required: true, schema: {type: string, pattern: '^[0-9a-fA-F]{40}$'}}
+        - {in: query, name: approval_plan_id, required: true, schema: {type: string}}
+      responses: {'200': {description: Acceptance result with accepted boolean}}
   /api/tag:
     post:
       operationId: requestOrCreateTag
@@ -209,7 +409,7 @@ paths:
         content:
           application/json:
             schema: {$ref: '#/components/schemas/TagRequest'}
-      responses: {'200': {description: Tag request committed or tag created}, '403': {description: Forbidden}}
+      responses: {'200': {description: Gitea-confirmed tag and fail-closed baseline result}, '400': {description: Missing governance evidence or invalid OID}, '403': {description: Forbidden}, '409': {description: Existing tag target conflict or evidence lineage mismatch}, '502': {description: Gitea reconciliation required}, '503': {description: Remote push pending}}
       x-openai-isConsequential: true
   /api/rollback:
     post:
@@ -245,4 +445,7 @@ paths:
         content:
           application/json:
             schema: {$ref: '#/components/schemas/NLRequest'}
-      responses: {'
+      responses:
+        '200': {description: Safe GitOps plan}
+        '401': {description: Unauthorized}
+      x-openai-isConsequential: true

docs/incidents/WEIXIN_TEXT_IMAGE_CACHE_ISOLATION_20260711.md

@@ -0,0 +1,113 @@
+# 微信文本-图片缓存隔离事故报告
+
+## 结论
+
+本次事故已经按最新备份链路回滚并完成第二轮评审修复。`3d9782fc346d1e7defde090ab8637e62ab28ab8a` 进一步修复了英文诊断文本和未确认引用文本误入图片路径的问题，`706c0b0` 则是后续最小修复提交。当前文档只记录证据、部署和验收边界，不把“真实 owner inbound 已完成”写成结论。
+
+## 现象
+
+- 纯文本消息被误答成旧图片回复，属于 stale-image reply on pure text。
+- 现场证据显示 `types=1` 且 `hasMedia=false`，但后续又进入 `message_type=image`、`image_count=0`、`implicit_image_message`，最终落到 `cached_image_expired`。
+- 这说明“诊断文本”被误判成图片意图后，又继承了 sender 级旧图缓存。
+
+## 根因
+
+- `fixes/patch_openclaw_weixin_hermes.py:768-839` 把文本意图判断和缓存回退放在同一条链上。
+- `looksLikeHermesImageFollowup()` 会把含图片关键字的诊断文本推进 image intent。
+- `resolveHermesFollowupImageContext()` 随后会读取 sender 级缓存；一旦缓存命中失败或过期，就会落到 `cached_image_expired`，从而让纯文本沾上旧图上下文。
+- `handleHermesImplicitImage()` 继续把消息送入 `handleHermes(..., "implicit_image_message")`，所以误判会沿着同一条图片处理通道传播。
+
+## 护栏不变量
+
+- 图片处理上下文必须来自当前消息图片、已确认的引用图片，或精确匹配的缓存图片 ID；缺少这三类证据时，纯文本不能进入 `handleHermesImplicitImage()`。
+- 未确认的引用文本不能继承 sender 级旧图缓存，必须返回 `referenced_image_not_confirmed`。
+- 只有精确缓存图片 ID 命中且缓存仍有效时，才允许走 `resolveHermesCachedImageEntry()` 的 `cached_image_matched` 路径。
+- `/hermes` 这类 slash 路径保持原有分流，slash/channel 面不变。
+- 这次修复的守卫目标，是把中英文诊断文本、未确认引用文本与图片缓存回退拆开，避免再把普通文本提升成图片意图。
+
+## TDD 与幂等性
+
+- `66d637fc0364a617c7b9fd8cd9baa68fb0368675`（`fix(weixin): isolate text from stale image cache`）引入了隔离修复和 `tests/test_weixin_image_followup_intent.py`。
+- `2de29c59bb946cc3db3e14e8a06270391ede8401`（`fix(weixin): add process-only runtime patch mode`）继续收紧 process-only 运行模式，保持回放幂等。
+- `3d9782fc346d1e7defde090ab8637e62ab28ab8a`（`fix(weixin): require confirmed image reference context`）补齐英文诊断文本和未确认引用文本用例，并把图片引用收紧到已确认上下文。
+- 用户实测的 TDD 路径为 RED `8 PASS / 1 FAIL`，随后 GREEN `9 PASS`。
+- 最小修复提交为 `706c0b0`，对应 quoted pure text 的最后一层收敛修复。
+- 第二轮回归结果为 `8 PASS`；node check 同样通过，重复应用补丁保持幂等。
+- 生产 npm 分发侧本身缺少 `tsconfig/tests`，baseline 与 patched 共享这一限制，所以这里不把分发目录的缺口当成回归点；验收以 node check 和 8 tests 为准。
+
+## 用户实测补充
+
+- 普通文本两项为 PASS。
+- quoted pure text 为 FAIL，日志证据包含 `ref_msg.message_item.type=0/NONE`、quoted id、`implicit_image_message`、`referenced_image_unresolved`。
+- 这组证据说明 quoted pure text 没有被当成真正的图片 follow-up，且没有越过引用确认边界。
+
+## 回滚与备份
+
+- 回滚按最新备份执行，基线指向 `/data/aios-gitops/runtime/latest-backup-dir.txt` 所示的最新备份目录。
+- 备份路径链路按供给证据记录为 `T064506Z`、`T074212Z`、`T081658Z`。
+- 第一轮恢复后的部署过程哈希记录为 `e9625d12` 和 `c00c58f8`。
+- v2 部署备份为 `/var/backups/aios/weixin-text-cache-isolation-20260711T094908Z`。
+- v2 部署文件哈希为 TS `024c6498284d1871b048f6157d5d3dbd4d34e54b53a05afd744b00458ceeb79f`、JS `d73b15d6752056192a1d1939b04107334419785b41175b39f1cbc1132ac65c47`；slash/channel 口径保持不变。
+- 首次部署因为 `-- No entries --` 门禁误判而回滚，随后纠正部署在线，PID 为 `2496603`。
+- 在线修复后的 hashes 为 `86dfe...` / `a9b854...`，`channel 4` accounts healthy，cache unchanged。
+
+## 主线合并与生产发布
+
+- 主线 fast-forward source rev 为 `9269e819972c2e709e0c27bed7eab590da6961c9`，本次不 tag、不 baseline。
+- 生产发布结论为 PASS，release dir 为 `/var/backups/aios/weixin-mainline-release-20260711T181842Z`。
+- old PID 为 `2655072`，new PID 为 `2656106`。
+- TS hash 为 `86dfe4543c4414bc86778a4b218c244a742a139c66e3c9f19cf6f0de871234c3`，JS hash 为 `a9b854015108020458ce6f31b9d9187eff82e170c4c214259b0afb9be6a7336f`。
+- `18789` 监听，`channel 4` accounts healthy，`error_count=0`，cache unchanged。
+- 一次参数门禁失败已回滚，且不影响最终发布。
+- owner quoted-text live acceptance 仍为 PENDING。
+
+## 运行态验证
+
+- 第一轮 gateway PID 由 `4025932` 变为 `1723576`；v2 部署后由 `1723576` 变为 `1876713`。
+- v2 现场/供给证据为 `active`、监听 `18789`、`error_count=0`、`channel gate pass`、`cache preserved`。
+- 最终 read-only gate 通过，说明部署后运行态未出现新的插件错误，channel 状态和缓存均保持预期。
+- quoted pure text 的第二次 owner live acceptance 仍为 PENDING。
+
+## 未完成的真实验收
+
+- owner 纯文本
+- diagnostic text
+- genuine image-followup message
+- quoted pure text 的第二次 owner live acceptance
+
+以上四类消息仍需要由 owner 真实 inbound 到达，才能把这次“文本隔离”结论升格为完整的线上接受；本报告明确保留该项为 pending，不把它们写成已经完成。
+
+## 引用文字语义修复与发布（2026-07-12）
+
+- 后续 owner 实测证明图片误路由已消失，但模型在没有被引正文时根据 `chat_id/message_id/timestamp` 编造解释，因此图片隔离 PASS、语义验收 FAIL。
+- 现场 payload 的 `ref_msg.message_item.type=0/NONE` 只有 quoted ID 与时间字段，没有 `text_item`；session transcript 又没有原始 Weixin 数字 message ID，不能精确回表。
+- 出站 `clientId` 与引用的 19 位数字 `msg_id` 格式不同，发送 API 也不返回服务端 message ID。本次明确禁止 recent-message、时间窗口、session 顺序和近似 ID 猜测。
+- `1136b4186d7578cd77f255297204b10152c47dab` 增加证据优先处理：payload 明确含 `text_item.text` 时才构造引用上下文；引用存在但正文缺失时，经标准 dispatcher 确定性回复“无法读取被引用文字，请复制原文后再提问。”，并在模型 dispatch 前返回。
+- TDD 先出现两项预期 RED（quoted-text resolver 不存在），最终 GREEN 为 `17 passed`；`py_compile`、`git diff --check`、`node --check` 均通过。
+- Scratch 双跑验证只改变 `src/messaging/process-message.ts` 与 `dist/src/messaging/process-message.js`，第二次应用 diff 为 0；slash/channel 文件保持不变。
+- 主线为 `1136b4186d7578cd77f255297204b10152c47dab`，生产发布目录为 `/var/backups/aios/weixin-quoted-text-failclosed-release-20260712T054451Z`。
+- 发布后 PID 从 `2656106` 变为 `3670157`；TS hash 为 `1a73e735e9c8fb40a1f82d2a66bc022396c8105ed989aac95e11b66326e9fdf1`，JS hash 为 `1c76bf6ec3b45021e68b932cbf52222ba2130a867b95e41d7a91f261b991a304`。
+- `18789`、4 个 Weixin accounts、post-start error 0 和图片 cache unchanged 均通过。新的 owner live acceptance 仍为 PENDING。
+
+## Owner 引用文字 Fail-Closed 验收（2026-07-12）
+
+- Owner 引用一条微信未提供正文的文字消息并发送“是什么意思”，收到固定回复“无法读取被引用文字，请复制原文后再提问。”。
+- 日志窗口为 `2026-07-12 14:06:23.424-14:06:23.893 +08:00`：入站 `types=1`、`bodyLen=6`、`hasMedia=false`，出站 `textLen=20` 且发送成功。
+- 同一窗口 `model-fetch=0`、`implicit_image_message=0`、Hermes route=0，`quoted_text_unavailable=1` 且 `quoted_message_id=present`。
+- 该证据确认无正文引用不会进入模型猜测或图片缓存路径。Owner quoted-text no-body live acceptance 为 **PASS**。
+- 微信 payload 明确携带 `text_item.text` 时的 grounded explanation 和 genuine image follow-up 仍作为独立兼容性验收项保留。
+
+## 可见引用摘要解析修复（2026-07-12）
+
+- Owner 进一步确认微信客户端能够显示被引用正文，因此上一节的“未提供正文”只适用于旧 resolver 的观察结果，不代表协议 payload 没有可用文本。
+- 根因是插件 `inbound.ts` 已将协议字段 `ref_msg.title` 定义为引用摘要并拼入 `ctx.Body`，而 `extractHermesReferencedText()` 只读取 `ref_msg.message_item.text_item.text`，导致客户端可见摘要被错误丢弃。
+- `13c2a182860131abcad0f5a70ae8263477578588` 在真实 `text_item.text` 缺失时，仅从 reference envelope 读取 `ref_msg.title`；不会读取 `message_item.title` 或任意嵌套通用 `title`，也不改变图片、slash 或 channel 路由。
+- TDD 先得到 `18 passed / 1 failed`，失败项为可见 `ref_msg.title` 仍落到 `quoted_text_unavailable`；修复后为 `19 passed`，`py_compile`、`node --check` 与 `git diff --check` 通过。
+- 生产发布目录为 `/var/backups/aios/weixin-quoted-text-title-resolution-20260712T155112+0800`，PID 从 `3859376` 变为 `3860863`，post-start error 为 0，图片 cache unchanged。
+- 部署后 TS hash 为 `8e77ce61214688a2507b07f0cf1ee85401b58198b8271bebd69efc2681872726`，JS hash 为 `663db8d30a5cd5eb80fe46cf941cce6e6f5d04cb7e4b8d9b4d0086d87faba290`。
+- 可见正文引用的 owner live acceptance 尚待下一条真实微信消息确认；预期日志必须命中 `quoted_text_resolved`，且同一窗口不得出现 `quoted_text_unavailable` 或图片路由。
+
+## 安全说明
+
+- 本次仅更新本报告，没有修改代码、runtime、services 或 secrets。
+- 报告里没有任何凭据、密钥或原始敏感 ID。

docs/releases/V1R4C5-acceptance-evidence.md

@@ -0,0 +1,212 @@
+# V1R4C5 Acceptance Evidence
+
+Date: 2026-07-11
+
+Status: release candidate evidence in progress
+
+Current active baseline: V1R4C3
+
+V1R4C5 has not been promoted yet.
+
+## Owner Decision
+
+Owner approved continued V1R4C5 work under the following constraints:
+
+```text
+允许无 force-push 的分支 reconcile
+memory search 保持关闭
+先完成 SR-01/SR-02/数据隔离验收
+再进入 merge/deploy/tag owner gate
+```
+
+## Scope
+
+V1R4C5 release candidate scope:
+
+1. SR-01 Gitea reliability and branch consistency guardrails.
+2. SR-02 watcher/stuck command cleanup.
+3. User data isolation redline and enforcement gates.
+4. SR-04 admin workbench read-only visibility preparation only.
+
+Explicitly excluded from V1R4C5 activation:
+
+- memory search activation;
+- full SR-04 portal production rollout;
+- bulk merge of old test/smoke/auth branches;
+- force push reconciliation;
+- Gitea DB mutation without owner/admin approval.
+
+## Runtime Acceptance Evidence
+
+### Runtime status
+
+Observed:
+
+```json
+{
+  "service": "aios-gitops-model-api",
+  "status": "active",
+  "workspace_branch": "patch/v1r4c5-runtime-acceptance-clean-20260711-01"
+}
+```
+
+### Baseline
+
+Observed:
+
+```json
+{
+  "current_baseline": "V1R4C3",
+  "previous_baseline": "V1R3C1",
+  "promoted_by": "openclaw"
+}
+```
+
+### Clean createBranch acceptance
+
+Branch:
+
+```text
+test/v1r4c5-runtime-acceptance-clean-20260711-01
+```
+
+Result:
+
+```text
+status: ok
+commit: 6ae7058
+sync: synced
+```
+
+### Clean createPatch acceptance
+
+Patch:
+
+```text
+patch/v1r4c5-runtime-acceptance-clean-20260711-01
+```
+
+Patch id:
+
+```text
+patch-1783706123789-f5ca8b69
+```
+
+Commit:
+
+```text
+ba0391e
+```
+
+Result:
+
+```text
+synced
+```
+
+## SR-01 Evidence
+
+Known accepted evidence:
+
+- Gitea branch consistency sentinel deployed.
+- Sentinel reports:
+
+```json
+{
+  "status": "healthy",
+  "unhealthy_checks": []
+}
+```
+
+- systemd timer runs every 5 minutes.
+- service runs with:
+
+```text
+--emit-safe-mode --json
+```
+
+- broken symlink issue resolved by replacing the external reliability symlink with workspace-local files.
+
+Required before final promotion:
+
+- confirm latest sentinel report remains healthy after acceptance writes.
+
+## SR-02 Evidence
+
+Known accepted evidence:
+
+```text
+11 / 11 tests pass
+```
+
+Fix summary:
+
+- stuck command detection reads parsed timestamps through `data.get('ts', 0)`;
+- `.md` fixture mtime is aligned with stored stuck timestamp via `os.utime(path, (ts, ts))`;
+- behavior is consistent across `.json` and `.md` state formats.
+
+Required before final promotion:
+
+- re-run SR-02 tests on the final integration candidate.
+
+## User Data Isolation Evidence
+
+Implemented controls:
+
+- user data isolation redline;
+- memory scope guard;
+- provider gate;
+- activation gate;
+- audit service/timer;
+- CI acceptance scripts;
+- memory search activation check.
+
+Required safety state:
+
+```text
+AIOS_MEMORY_ENABLED=false
+```
+
+Required before memory/search activation:
+
+- isolation audit healthy;
+- no denied records;
+- no invalid records;
+- provider filters by scope before ranking;
+- provenance required;
+- global index disabled;
+- activation gate returns allowed;
+- explicit owner approval.
+
+V1R4C5 does not approve memory search activation.
+
+## SR-04 Admin Workbench Evidence
+
+Current user-visible gap is confirmed:
+
+- administrator cannot yet see task progress;
+- administrator cannot yet see flow/process diagrams;
+- SR-04 remains activation-ready but gated.
+
+V1R4C5 scope allows only read-only visibility preparation and acceptance design, not full production rollout.
+
+Required before SR-04 deployment:
+
+- SR-01 green;
+- SR-02 green;
+- user data isolation gate accepted;
+- admin RBAC read-only check green.
+
+## Remaining Required Gates Before Promotion
+
+- [ ] Latest Gitea sentinel report remains healthy.
+- [ ] SR-02 watcher tests pass on final candidate.
+- [ ] User data isolation acceptance passes.
+- [ ] Admin workbench read-only RBAC acceptance passes or remains explicitly deferred.
+- [ ] No force-push was used.
+- [ ] Memory search remains disabled.
+- [ ] Owner approves merge/deploy/tag/promotion.
+
+## Promotion Rule
+
+V1R4C5 may not be promoted until all required gates are green or explicitly deferred with owner approval.

docs/releases/V1R4C5-final-owner-approval.md

@@ -0,0 +1,54 @@
+# V1R4C5 Final Owner Approval
+
+Date: 2026-07-11
+
+Status: approved for final promotion
+
+## Owner Decision
+
+Owner approved final V1R4C5 promotion.
+
+Memory search must remain disabled.
+
+```text
+允许最终晋升
+继续保持 memory search 关闭
+```
+
+## Promotion Scope
+
+Approved for V1R4C5:
+
+1. SR-01 Gitea reliability and branch consistency guardrails.
+2. SR-02 watcher/stuck command cleanup.
+3. User data isolation redline and enforcement gates.
+4. SR-04 admin workbench read-only visibility preparation only.
+
+## Explicit Non-Activation
+
+The following are not approved by this promotion:
+
+```text
+memory search activation
+full cross-session memory recall
+global vector index
+full SR-04 production portal rollout beyond read-only/admin visibility preparation
+bulk merge of old test/smoke/auth branches
+force-push based reconciliation
+```
+
+## Required Runtime State
+
+Memory remains disabled:
+
+```text
+AIOS_MEMORY_ENABLED=false
+```
+
+If a provider or deployment attempts to enable memory/search, it must be blocked unless a future owner approval explicitly allows it after the user-data isolation activation gate returns allowed.
+
+## Final Promotion Rule
+
+V1R4C5 may proceed to tag/promotion under owner gate.
+
+If any final gate fails, promotion must stop and memory/search must remain disabled.

docs/releases/V1R4C5-main-reconcile-plan.md

@@ -0,0 +1,107 @@
+# V1R4C5 Release to Main Reconcile Plan
+
+Date: 2026-07-11
+
+Status: reconcile preparation
+
+## Objective
+
+Bring the V1R4C5 release state back into `main` without rewriting history and without moving the immutable V1R4C5 tag.
+
+## Source of Truth
+
+Release baseline:
+
+```text
+V1R4C5
+```
+
+Promotion commit:
+
+```text
+a32c76a3c1baa49562e53fb8adce10a5ed0e6704
+```
+
+Tag:
+
+```text
+V1R4C5
+```
+
+Tag policy:
+
+```text
+immutable
+```
+
+## Reconcile Rules
+
+Allowed:
+
+- normal merge commits;
+- fast-forward where possible;
+- conflict resolution with review;
+- updating main to contain released C5 state.
+
+Forbidden:
+
+- force-push;
+- tag movement;
+- rewriting release history;
+- importing V1R4C6 feature code into this reconcile.
+
+## Expected Included C5 Content
+
+- SR-01 Gitea reliability guardrails.
+- Gitea branch consistency sentinel.
+- SR-02 watcher state cleanup.
+- User Data Isolation gate.
+- Reliability governance documents.
+- Admin Workbench read-only preparation records.
+
+## Expected Excluded Content
+
+Do not include:
+
+- V1R4C6 Admin Workbench implementation code.
+- SR-03 Search Gateway implementation.
+- Agent Platform integration.
+- Memory search activation.
+- Global vector index.
+
+## Validation Before Main Merge
+
+Required:
+
+```text
+getBaseline.current_baseline == V1R4C5
+V1R4C5 tag unchanged
+memory search disabled
+Gitea sentinel healthy
+SR-02 tests pass
+main merge does not include V1R4C6 branches
+```
+
+## Post Merge Validation
+
+Run:
+
+```text
+getRuntimeStatus
+getBaseline
+createBranch
+createPatch
+```
+
+Expected:
+
+```text
+main contains V1R4C5 release state
+active baseline remains V1R4C5
+```
+
+## Owner Gate
+
+Normal merge to `main` may proceed after validation.
+
+No tag creation or baseline promotion is required because V1R4C5 is already promoted.

docs/releases/V1R4C6-acceptance-checklist.md

@@ -0,0 +1,137 @@
+# V1R4C6 Acceptance Checklist
+
+Date: 2026-07-11
+
+Base baseline: V1R4C5
+
+Promotion blocked until every mandatory gate is green.
+
+## Global Preflight
+
+- [ ] `getRuntimeStatus.status == active`
+- [ ] `getBaseline.current_baseline == V1R4C5`
+- [ ] `getBaseline.git == a32c76a3c1baa49562e53fb8adce10a5ed0e6704`
+- [ ] `AIOS_GITOPS_BARE_REPO` points to `/data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git`
+- [ ] Gitea consistency sentinel reports `healthy`
+- [ ] `AIOS_MEMORY_ENABLED=false`
+- [ ] no force-push used
+
+## Gate A — Admin Workbench / Portal AIOS
+
+### Route/API
+
+- [ ] `/portal/me/aios/manifest` returns authenticated module manifest
+- [ ] `/portal/me/aios/dashboard` returns admin-authorized dashboard data
+- [ ] `/portal/me/aios/health` returns system health data
+- [ ] failed/empty backend data produces explicit empty/error state
+
+### UI
+
+- [ ] admin sees task progress
+- [ ] admin sees process/flow diagram entry
+- [ ] admin sees system health
+- [ ] admin sees authorized agent observability
+- [ ] user does not see admin-only modules
+- [ ] admin does not see owner-only modules without owner role
+
+### Isolation
+
+- [ ] no cross-user data
+- [ ] no cross-project data
+- [ ] no cross-session data
+- [ ] no cross-tenant/group data
+
+Gate A result: `PASS / FAIL / DEFER`
+
+## Gate B — SR-03 Search Gateway
+
+### Provider Binding
+
+- [ ] real provider configured and reachable
+- [ ] provider errors return safe non-memory fallback
+- [ ] timeout/retry/circuit-breaker behavior verified
+
+### Scope and Provenance
+
+- [ ] scope filter occurs before ranking
+- [ ] provenance returned for accepted results
+- [ ] denied/out-of-scope content never reaches ranking or summary
+- [ ] global memory/vector index disabled
+- [ ] memory search remains disabled
+
+### Audit
+
+- [ ] search request scope is logged without leaking content
+- [ ] provider/fallback decision is auditable
+- [ ] denied scope mismatch is auditable
+
+Gate B result: `PASS / FAIL / DEFER`
+
+## Gate C — Agent Platform
+
+### Event Bus
+
+- [ ] event envelope includes tenant/group, user, project, session and agent scope
+- [ ] cross-scope subscribers cannot receive events
+- [ ] failed delivery is observable and retry-bounded
+
+### GPT Message Plane
+
+- [ ] message envelope includes scope and provenance
+- [ ] messages cannot cross user/project/session boundaries
+- [ ] denied messages do not forward content
+
+### Controller Dispatch
+
+- [ ] dispatch stops when autonomous safe mode is active
+- [ ] consequential actions require owner gate
+- [ ] duplicate dispatch is idempotent or rejected
+- [ ] stuck state cleanup remains green
+
+### Observability
+
+- [ ] admin can see platform status without unrestricted content access
+- [ ] failures and queue state are visible
+
+Gate C result: `PASS / FAIL / DEFER`
+
+## Combined Runtime Acceptance
+
+Run after integration and deployment:
+
+```text
+getRuntimeStatus
+getBaseline
+createBranch
+createPatch
+```
+
+Expected before promotion:
+
+```text
+runtime = active
+baseline = V1R4C5
+write branch = committed + synced
+write patch = committed + synced
+```
+
+## Rollback Validation
+
+- [ ] Group A can disable workbench routes/menu entries
+- [ ] Group B can disable provider binding and use safe non-memory fallback
+- [ ] Group C can disable expanded dispatch
+- [ ] all rollback modes preserve `AIOS_MEMORY_ENABLED=false`
+
+## Release Decision
+
+V1R4C6 is tag-ready only when:
+
+```text
+Global preflight PASS
+AND Gate A PASS
+AND Gate B PASS
+AND Gate C PASS
+AND combined runtime acceptance PASS
+```
+
+Any failed mandatory gate blocks tag, deployment promotion, and baseline promotion.

docs/releases/V1R4C6-acceptance-evidence.md

@@ -0,0 +1,51 @@
+# V1R4C6 Acceptance Evidence
+
+Date: 2026-07-11
+
+## Merge
+
+- **PR #6** (merge commit `ae49bf0fa35b0f599a96a4d12644576447f39cec`): V1R4C6 release-candidate control artifacts merged to main.
+- **Result**: PASS
+  - 10 files (1440 lines) added: release docs, patch records, ops commands, version metadata
+  - No V1R4C6 tag created
+  - No baseline promotion
+  - Memory search remains disabled
+  - Force-push remains disabled
+
+## Verified State (post-merge)
+
+| Check                    | Result |
+|--------------------------|--------|
+| main HEAD                | ae49bf0fa35b0f599a96a4d12644576447f39cec |
+| V1R4C5 tag               | Still at d457ac396147043ed5d0a3fd8b44bcb10f48bceb (not moved) |
+| V1R4C6 tag               | absent |
+| baseline/current.json    | current_baseline = V1R4C5, git = a32c76a3c1baa49562e53fb8adce10a5ed0e6704 |
+| memory_search_enabled    | false |
+| force_push_allowed       | false |
+| versions/V1R4C5.json     | exists |
+| versions/V1R4C6.json     | exists |
+
+## Gates
+
+| Gate                         | Status  | Notes                          |
+|------------------------------|---------|--------------------------------|
+| control artifacts merge      | PASS    | PR #6 merged to main           |
+| Gate A — Admin Workbench     | NOT RUN | Engineering integration pending|
+| Gate B — SR-03 Search Gateway| NOT RUN | Engineering integration pending|
+| Gate C — Agent Platform      | NOT RUN | Engineering integration pending|
+| tests                        | NOT RUN | No test suite executed         |
+| artifact digest              | NOT CREATED | No build performed          |
+| deployment                   | NOT RUN | No deploy performed            |
+| production verification      | NOT RUN | No production verification     |
+
+## Rollback
+
+Revert command (creates new branch and PR, non-destructive):
+
+```bash
+git revert -m 1 ae49bf0fa35b0f599a96a4d12644576447f39cec
+```
+
+## Current Overall Status
+
+**BLOCKED / INTEGRATION PENDING** — all engineering gates remain unexecuted.

docs/releases/V1R4C6-baseline-visibility-blocker.md

@@ -0,0 +1,80 @@
+# V1R4C6 Blocker: Baseline Visibility Discrepancy
+
+Date: 2026-07-11
+
+Status: blocking merge/deploy/tag
+
+## Summary
+
+OpenClaw/operator reported V1R4C5 baseline promotion completed successfully, but the ChatGPT GitOps action view still reports the active baseline as V1R4C3.
+
+V1R4C6 must not proceed to merge/deploy/tag until this view is reconciled.
+
+## Operator Reported State
+
+Reported by operator:
+
+```text
+current_baseline = V1R4C5
+previous_baseline = V1R4C3
+promotion_git = a32c76a3c1baa49562e53fb8adce10a5ed0e6704
+promoted_by = openclaw/admin
+memory_search_enabled = false
+force_push_allowed = false
+gitea_db_mutation_requires_owner_approval = true
+```
+
+## ChatGPT GitOps Action Observed State
+
+Observed through `getBaseline`:
+
+```text
+current_baseline = V1R4C3
+previous_baseline = V1R3C1
+git = f5435e308794c737f3e39de3f6b79807486943c3
+promoted_by = openclaw
+```
+
+Observed through `listVersions`:
+
+```text
+V1R4C5 tag exists
+versions_dir does not list canonical V1R4C5.json
+workspace_branch = release/v1r4c6-admin-search-agent-integration-20260711
+```
+
+## Risk
+
+If V1R4C6 proceeds while different controllers disagree on the active baseline, the release may be built against the wrong base and post-deployment verification may be invalid.
+
+## Required Reconciliation
+
+Before continuing V1R4C6:
+
+1. Confirm the GitOps API used by ChatGPT reads the same `baseline/current.json` updated by OpenClaw.
+2. Confirm the API service has reloaded or refreshed baseline state.
+3. Confirm canonical `versions/V1R4C5.json` is visible to the action runtime or intentionally explain why it is not required.
+4. Re-run:
+
+```text
+getBaseline
+listVersions
+getRuntimeStatus
+```
+
+Required result:
+
+```text
+getBaseline.current_baseline = V1R4C5
+listVersions.tags contains V1R4C5
+memory search remains disabled
+```
+
+## Hard Stop
+
+Do not create V1R4C6 tag.
+Do not promote V1R4C6 baseline.
+Do not deploy V1R4C6.
+Do not enable memory search.
+
+Proceed only after baseline visibility is reconciled.

docs/releases/V1R4C6-context-isolation-resume.md

@@ -0,0 +1,83 @@
+# V1R4C6 Context Isolation Recovery and Resume Decision
+
+Date: 2026-07-11
+
+Status: approved to resume merge/deploy/verification; stop before tag/promotion
+
+## Recovery Evidence
+
+The unrelated OpenClaw/WeChat report was traced to notification/task isolation weaknesses rather than GitOps baseline corruption.
+
+Actions completed:
+
+1. The legacy `AIOS每日自治报告` cron was disabled and retained for forensic review.
+2. The expired `2026-07-06-reminder` cron was archived and deleted after confirming no pending dependency.
+3. Pending notification queue depth was verified as zero.
+4. Unknown/unscoped queued message count was verified as zero.
+5. A scoped V1R4C6 WeChat test notification was sent successfully.
+
+The test notification included:
+
+```text
+task_id = V1R4C6-integration
+release_id = V1R4C6
+branch = release/v1r4c6-admin-search-agent-integration-20260711
+baseline = V1R4C5
+correlation_id = 70308f5e243ab81d
+```
+
+No recipient identifier, token, cookie, or unrelated message content is stored in this release record.
+
+## Resume Decision
+
+V1R4C6 may resume:
+
+```text
+merge
+component tests
+security/isolation tests
+deployment
+production verification
+release evidence updates
+```
+
+V1R4C6 must still stop before:
+
+```text
+Git tag creation
+baseline promotion
+memory search activation
+```
+
+## Required Execution Context
+
+Before every OpenClaw execution or WeChat notification, assert:
+
+```text
+task_id = V1R4C6-integration
+release_id = V1R4C6
+branch = release/v1r4c6-admin-search-agent-integration-20260711
+baseline = V1R4C5
+memory_search_enabled = false
+```
+
+Any mismatch re-enters safe mode and blocks execution/notification.
+
+## Hard Constraints
+
+```text
+no force-push
+no Gitea DB mutation
+no V1R4C5 tag movement
+no global memory/vector index
+no cross-user/project/session notification or task data
+```
+
+## Owner Gate
+
+After Gate A, Gate B, Gate C, deployment verification, runtime acceptance, and Gitea sentinel checks pass, OpenClaw must request explicit owner approval through the scoped WeChat channel for both:
+
+1. Create V1R4C6 Git tag.
+2. Promote active baseline from V1R4C5 to V1R4C6.
+
+Ambiguous acknowledgements do not count as approval.

docs/releases/V1R4C6-integration-merge-matrix.md

@@ -0,0 +1,136 @@
+# V1R4C6 Integration Merge Matrix
+
+Date: 2026-07-11
+
+Status: integration-ready
+
+Base baseline: V1R4C5
+
+Base baseline git: `a32c76a3c1baa49562e53fb8adce10a5ed0e6704`
+
+## Release Objective
+
+Deliver three capability groups in one controlled release train:
+
+1. Admin Workbench and Portal AIOS read-only rollout.
+2. SR-03 Search Gateway real provider binding.
+3. Agent Platform Integration.
+
+This is a bundled release train, not an uncontrolled bulk merge. Each group has an independent acceptance gate and rollback switch.
+
+## Group A — Admin Workbench and Portal AIOS
+
+| Branch | Capability | Decision |
+|---|---|---|
+| `feature/v1r4c4-sr04-admin-workbench-visibility-20260711` | Admin workbench task progress and process visibility | integrate |
+| `feature/v1r4c4-sr04-portal-aios-visibility-20260710` | Portal AIOS route/menu visibility | integrate |
+| `patch/user-portal-me-route-diagnostics-20260709` | `/portal/me/aios/manifest`, dashboard and health route contract | integrate after route review |
+| `patch/user-portal-rbac-ops-dashboard` | Admin/group-admin RBAC dashboard | integrate after RBAC review |
+| `patch/agent-observability-webui` | Agent observability UI | integrate read-only |
+| `patch/web-ui-complete-gitops-dashboard-20260706` | GitOps dashboard UI | integrate only if not superseded by the newer workbench implementation |
+
+### Required user-visible result
+
+Administrators can see:
+
+- task progress;
+- task/flow/process diagram entry;
+- system health;
+- authorized agent observability;
+- explicit empty/error states.
+
+### Security constraints
+
+- Read-only first.
+- RBAC is enforced server-side and client-side.
+- No cross-user, cross-project, cross-session, or cross-tenant data exposure.
+- Owner-only modules remain hidden from non-owner administrators.
+
+## Group B — SR-03 Search Gateway Real Provider Binding
+
+| Branch | Capability | Decision |
+|---|---|---|
+| `feature/v1r4c4-sr02-search-gateway-resilience-20260710` | Gateway resilience and safe fallback | integrate |
+| `patch/search-gateway-governed-general-capability` | Governed provider binding and policy surface | integrate after scope review |
+| `patch/gitops-change-archive-audit` | Change/archive audit evidence | integrate or retain as supporting audit module |
+
+### Required result
+
+- Real provider binding works.
+- Query scope is enforced before ranking.
+- Accepted records include provenance.
+- Provider failure falls back to `text-only`, `no-memory`, or `scoped-only`.
+- Global memory/vector indexes are not used.
+
+### Security constraints
+
+```text
+AIOS_MEMORY_ENABLED=false
+```
+
+Search Gateway provider binding must not implicitly enable memory search.
+
+## Group C — Agent Platform Integration
+
+| Branch | Capability | Decision |
+|---|---|---|
+| `patch/agent-event-bus-unified` | Unified scoped agent event bus | integrate |
+| `patch/agent-gpt-message-plane` | Scoped Agent/GPT message plane | integrate |
+| `patch/autonomous-controller-dispatch-20260709` | Autonomous controller dispatch | integrate behind safe-mode gate |
+| `patch/self-evolution-agent-orchestration-policy` | Agent orchestration and governance policy | integrate |
+| `patch/aios-autonomous-orchestrator-architecture-review-v1` | Architecture record | integrate as documentation or mark superseded after review |
+
+### Required result
+
+- Agent event and message envelopes include user/project/session scope.
+- Controller dispatch stops when autonomous safe mode is active.
+- Consequential actions remain owner-gated.
+- Observability is available before autonomous expansion.
+
+## Explicitly Excluded
+
+Do not merge or activate in V1R4C6:
+
+- memory search activation;
+- global vector index;
+- cross-session/global recall;
+- unscoped search or message delivery;
+- old test/smoke/auth-only branches;
+- old V1R2/V1R3 promotion requests;
+- force-push reconciliation;
+- Gitea database mutation.
+
+## Merge and Deployment Order
+
+```text
+1. Verify V1R4C5 baseline and bare-repo configuration.
+2. Integrate Group A read-only workbench/portal surface.
+3. Run Group A RBAC and visibility acceptance.
+4. Integrate Group B provider binding under isolation gate.
+5. Run Group B scope/provenance/fallback acceptance.
+6. Integrate Group C event/message/dispatch capabilities.
+7. Run Group C scope/safe-mode/owner-gate acceptance.
+8. Run combined runtime acceptance.
+9. Prepare V1R4C6 tag and promotion request.
+10. Stop for owner confirmation before tag/promotion.
+```
+
+## Combined Acceptance
+
+Required:
+
+```text
+getRuntimeStatus -> active
+getBaseline -> V1R4C5 before promotion
+createBranch -> committed and synced
+createPatch -> committed and synced
+Gitea branch sentinel -> healthy
+memory search -> disabled
+```
+
+## Rollback Switches
+
+- Group A: disable new workbench routes/menu entries.
+- Group B: disable real provider binding and use safe non-memory fallback.
+- Group C: disable expanded dispatch and keep event/message plane observational.
+- Memory search remains disabled in all rollback modes.

docs/releases/V1R4C6-release-acceptance-checklist.md

@@ -0,0 +1,51 @@
+# V1R4C6 Release Acceptance Checklist
+
+Date: 2026-07-11
+
+## Gate A — Admin Workbench / Portal AIOS
+
+| Check                          | Status  | Notes                          |
+|--------------------------------|---------|--------------------------------|
+| Admin workbench RBAC read-only | NOT RUN |                                |
+| Portal AIOS manifest route     | NOT RUN |                                |
+| Portal AIOS dashboard route    | NOT RUN |                                |
+| Flow/process diagram renders   | NOT RUN |                                |
+| Portal AIOS health route       | NOT RUN |                                |
+
+## Gate B — SR-03 Search Gateway
+
+| Check                              | Status  | Notes                          |
+|------------------------------------|---------|--------------------------------|
+| Provider binding correctness       | NOT RUN |                                |
+| Scope-before-ranking validation    | NOT RUN |                                |
+| Provenance correctness             | NOT RUN |                                |
+| Fallback to disabled provider      | NOT RUN |                                |
+
+## Gate C — Agent Platform
+
+| Check                              | Status  | Notes                          |
+|------------------------------------|---------|--------------------------------|
+| Event scope isolation               | NOT RUN |                                |
+| Message plane scope isolation       | NOT RUN |                                |
+| Dispatch safe-mode respects control | NOT RUN |                                |
+| Owner gate for consequential ops    | NOT RUN |                                |
+
+## Final Deployment Gates
+
+| Check                     | Status    | Notes                          |
+|---------------------------|-----------|--------------------------------|
+| Tag V1R4C6                | NO        | Requires owner approval        |
+| Baseline promotion        | NO        | Requires owner approval        |
+| Memory search enabled     | NO        | Requires future owner approval |
+
+## Active Constraints
+
+- AIOS_MEMORY_ENABLED: false
+- Force-push: forbidden
+- Gitea DB mutation: owner approval required
+- Memory search: disabled (future owner approval required for enable)
+
+## Artifact
+
+- **PR #6 merge commit**: `ae49bf0fa35b0f599a96a4d12644576447f39cec`
+- **Source baseline**: V1R4C5 (commit a32c76a3c1baa49562e53fb8adce10a5ed0e6704)

docs/releases/V1R4C6-release-gate-status.md

@@ -0,0 +1,92 @@
+# V1R4C6 Release Gate Status
+
+Date: 2026-07-11
+
+Status: integration pending — release-candidate control artifacts merged, engineering gates not yet executed
+
+## Completed
+
+- V1R4C5 baseline verified as active base.
+- GitOps API and public API return:
+  - current_baseline: V1R4C5
+  - previous_baseline: V1R4C3
+  - git: a32c76a3c1baa49562e53fb8adce10a5ed0e6704
+- GitOps bare repository path corrected to active `aios.git`.
+- V1R4C6 merge matrix created.
+- V1R4C6 acceptance checklist created.
+- V1R4C6 acceptance evidence created.
+- PR #6: control artifacts merge — PASS
+
+## Result Summary
+
+| Item                    | Status    |
+|-------------------------|-----------|
+| control artifacts merge | PASS       |
+| Gate A                  | NOT RUN   |
+| Gate B                  | NOT RUN   |
+| Gate C                  | NOT RUN   |
+| tests                   | NOT RUN   |
+| artifact                | NOT CREATED |
+| deployment              | NOT RUN   |
+| production verification | NOT RUN   |
+| tag created             | NO        |
+| baseline promoted       | NO        |
+| memory search enabled   | NO        |
+| **overall**             | **BLOCKED / INTEGRATION PENDING** |
+
+## Verified Artifact
+
+- **PR #6 merge commit**: `ae49bf0fa35b0f599a96a4d12644576447f39cec`
+- **Current baseline**: V1R4C5
+- **V1R4C6 tag**: absent
+- **Memory search**: disabled
+- **Force-push**: disabled
+
+## Remaining Gates (not yet executed)
+
+### Gate A — Admin Workbench / Portal AIOS
+
+- merge candidate review;
+- RBAC acceptance;
+- task progress visibility;
+- flow diagram visibility;
+- health/observability validation.
+
+### Gate B — SR-03 Search Gateway
+
+- provider binding validation;
+- scope-before-ranking validation;
+- provenance validation;
+- fallback validation.
+
+### Gate C — Agent Platform
+
+- event scope validation;
+- message plane scope validation;
+- dispatch safe-mode validation;
+- owner gate validation.
+
+## Release Stop Point
+
+After Gates A/B/C pass:
+
+```text
+prepare V1R4C6 tag
+        ↓
+owner confirmation required
+        ↓
+tag creation
+        ↓
+baseline promotion
+```
+
+## Hard Constraints
+
+Remain:
+
+```text
+AIOS_MEMORY_ENABLED=false
+memory search disabled
+force-push forbidden
+gitea DB mutation requires owner approval
+```

docs/releases/V2R1C1-BASELINE-CLOSURE.md

@@ -0,0 +1,56 @@
+# V2R1C1 中央 Baseline 治理收口
+
+## 收口范围
+
+本次变更只登记已经完成生产验证并上线的 `V2R1C1`。它新增中央版本 Manifest、把中央 Baseline Pointer 从 `V1R4C6` 切换为 `V2R1C1`，并建立 Release、Companion、Artifact 与最终生产 Evidence 的追溯关系。
+
+本次不修改产品实现，不移动或重建 `V2R1C1` Tag，不改变 Release OID，不重新部署生产，不切换生产流量，也不重写历史证据。
+
+## 权威标识
+
+- Release：`release/AIOS-V2R1C1-20260721`
+- Release OID：`4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`
+- Tag / Tag OID：`V2R1C1` / `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`
+- SemVer：`2.1.0-rc.1`
+- OpenClaw Companion：`2.1.0-rc.4`
+- Companion Source OID：`83f8f878c7da5dd8263f2af2efa80750492e5cb3`
+- Companion OID：`12d1c13170e0c5a691d67a9408e739e7a17064a3`
+- Artifact SHA256：`aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`
+- Contract：`aios.openclaw.command.v2` / `Ed25519`
+- Evidence Root：`/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`
+- Final Audit Manifest SHA256：`2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`
+- Production Status：`PRODUCTION_DEPLOYED`
+
+## 治理路径
+
+- Governance Branch：`patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`
+- Base Ref：`refs/heads/main`
+- Base OID：`3cf9958cb94614449e093639cbf902216d73447f`
+- Manifest Commit：`a56caf46f6bc335ec2395b674ead4b2a427c5edd`
+- Baseline Commit：`6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`
+- Reviewer：`gpt-5.3-codex-spark validator and docs_reporter`
+- Review：`PASS`（`2026-07-21T14:23:00Z`）
+
+## 命令与退出码
+
+| 阶段 | 命令 | 开始 UTC | 结束 UTC | Exit Code |
+| --- | --- | --- | --- | ---: |
+| 中央只读核对 | `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
+| 创建治理分支 | `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
+| 核心元数据验证 | `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
+
+完整机读记录位于 `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`，治理运行证据位于 `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`。
+
+## 元数据回滚
+
+若中央 Registry 解析或治理服务异常，保留 `versions/V2R1C1.json`，通过新的受审治理提交把 `baseline/current.json` 和 `VERSION` 临时恢复到 `V1R4C6`。该操作不得回滚生产系统、移动 Tag、修改 Release OID 或重写历史。
+
+## 范围证明
+
+```text
+product_code_changed=false
+tag_changed=false
+production_redeployed=false
+production_traffic_changed=false
+secret_material_recorded=false
+```

docs/releases/V2R1C2-PRODUCTION-RELEASE.md

@@ -0,0 +1,35 @@
+# V2R1C2 Production Release
+
+- Release Run ID: `AIOS-V2R1C2-PRODUCTION-20260722T011836Z`
+- Previous production baseline: `V2R1C1`
+- Tag: `V2R1C2`
+- Tag object: `a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36`
+- Approved target: `3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24`
+- Evidence closure: `8cdca463aff9707edee00e20a3b56884130f6978`
+- Initial registry status: `TAG_CREATED_NOT_PROMOTED`
+- Final status: `PRODUCTION_DEPLOYED`
+- Production service: `aios-v2r1c2-production.service`
+- Production port: `18920`
+- Production acceptance SHA256: `a6c35e12cab7907ab6bcfd37d781b3d216f05a5ae002aa54a3112c70f43b991a`
+- Production online smoke SHA256: `fe9c6964e440f8871f2eb225f0132f70c634923389f7b8dfa85f615b100980a4`
+- Production health SHA256: `ee8084e8b57d188dc0039a276f4f3f1ed7025ff58ce91b111cc765627eb52d4c`
+- Live evidence directory: `/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z`
+- Evidence hash index: `/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z/production-evidence.sha256`
+
+## Production gates
+
+Promotion may proceed only when the 18921 candidate remains healthy, the committed evidence checksum file verifies without drift, the 18920 baseline is healthy, required secret references are available without exposing secret values, and the V2R1C1 rollback service/configuration remains intact.
+
+The obsolete release-plan `DECLARED` rows are not authoritative for this run. The production gate must explicitly select `AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER-20260722` and require its three required stages to be `SUCCEEDED`; an unqualified aggregate across stale plan rows fails closed.
+
+## Synthetic WeChat scope
+
+WeChat-facing acceptance for this release used synthetic/mock receipts and transcripts only. It did not impersonate a real user and does not claim a real-user WeChat session. The relevant committed evidence entries are `wechat_simulated_receipts` and `wechat_simulated_transcript`; the production online smoke also records `simulation: true` and `real_user_impersonated: false`.
+
+## Rollback rule
+
+If Health, API, UI, Role Matrix, Tenant Isolation, Runtime, or Audit verification fails after the 18920 switch, stop the V2R1C2 production unit and restart the preserved V2R1C1 18920 service. Do not delete or rewrite either release tag or rollback asset.
+
+## Result
+
+The production switch completed at `2026-07-22T01:40:51Z`. Full acceptance and the production online smoke passed, including Health, API, UI, Role Matrix, Tenant Isolation, Runtime, Audit and the selected takeover release gate. The previous `aios-orchestrator-gateway.service` unit, configuration and Release Run backup remain available for rollback.

docs/superpowers/plans/2026-07-12-weixin-quoted-text-failclosed.md

@@ -0,0 +1,67 @@
+# Weixin Quoted Text Fail-Closed Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Resolve explicit quoted text safely and fail closed without a model call when Weixin omits the quoted body.
+
+**Architecture:** Add pure JS/TS reference-text helpers and one process hook guard to the existing patcher. Keep the patch surface limited to generated `process-message.ts/js`; do not introduce a persistent cache or modify send/monitor/API modules.
+
+**Tech Stack:** Python patch generator, TypeScript/JavaScript, Node test harness, pytest.
+
+## Global Constraints
+
+- Sub-agents use `gpt-5.3-codex-spark`.
+- No force push, tag, baseline promotion, credential persistence, recent-message fallback, or approximate text matching.
+- Existing confirmed image and ordinary text behavior must remain unchanged.
+
+---
+
+### Task 1: Add Quoted Text Resolver With TDD
+
+**Files:**
+- Modify: `tests/test_weixin_image_followup_intent.py`
+- Modify: `fixes/patch_openclaw_weixin_hermes.py`
+
+**Interfaces:**
+- Produces: `extractHermesReferencedText(items)` and `resolveHermesQuotedTextContext(items, currentText)` in TS and JS helper templates.
+
+- [ ] Add a Node-backed failing test with `ref_msg.message_item.type=1` and explicit `text_item.text="被引用的正文"`; assert `reason="quoted_text_resolved"`, `handled=false`, and a prompt containing only delimited quoted/current text.
+- [ ] Add a Node-backed failing test with `type=0`, quoted ID, no text, and no confirmed image; assert `reason="quoted_text_unavailable"`, `handled=true`, and exact deterministic `replyText`.
+- [ ] Run `pytest -q tests/test_weixin_image_followup_intent.py -k 'quoted_text'` and record expected RED because the resolver is absent.
+- [ ] Implement the smallest recursive explicit-text extractor. Accept only known referenced text fields; cap each extracted string at 4000 characters and reject blank values.
+- [ ] Implement the resolver in both TS and JS templates. Do not read session history, image latest cache, timestamps, or metadata values.
+- [ ] Re-run the focused tests and record GREEN.
+- [ ] Commit with `fix(weixin): fail closed on unavailable quoted text`.
+
+### Task 2: Guard The Real Process Hook
+
+**Files:**
+- Modify: `tests/test_weixin_image_followup_intent.py`
+- Modify: `fixes/patch_openclaw_weixin_hermes.py`
+
+**Interfaces:**
+- Consumes: `resolveHermesQuotedTextContext(items, currentText)`.
+- Produces: process hook behavior that replies deterministically or replaces only the ordinary text prompt.
+
+- [ ] Add a failing JS hook test that stubs the ordinary model dispatch and reply function. For type 0 without text, assert reply called once and model called zero times.
+- [ ] Add a failing JS hook test for explicit quoted text. Assert model called once with delimited context and no message metadata.
+- [ ] Add regression assertions for plain text, current image, and exact quoted image.
+- [ ] Run focused tests and record RED for the missing guard.
+- [ ] Insert the resolver after reference/image evidence extraction and before ordinary model dispatch. Confirmed image references must bypass the text fail-closed branch.
+- [ ] Emit structured reason-only diagnostics without message bodies.
+- [ ] Run focused tests and record GREEN.
+- [ ] Commit with `fix(weixin): guard quoted text model dispatch`.
+
+### Task 3: Idempotence, Review, And Release
+
+**Files:**
+- Modify: `docs/incidents/WEIXIN_TEXT_IMAGE_CACHE_ISOLATION_20260711.md`
+
+- [ ] Run `pytest -q tests/test_weixin_image_followup_intent.py` and require all tests pass.
+- [ ] Run `python3 -m py_compile fixes/patch_openclaw_weixin_hermes.py tests/test_weixin_image_followup_intent.py`.
+- [ ] Run `git diff --check`.
+- [ ] Apply `--process-only` twice to a scratch production-plugin copy and require identical second-run hashes; require slash/channel files unchanged.
+- [ ] Obtain independent spec and code review.
+- [ ] Update the incident document with RED/GREEN evidence, main revision, production hashes, rollback directory, and owner live acceptance state.
+- [ ] Merge by non-force fast-forward from a clean main-based branch, deploy only the two generated process-message files, restart only `openclaw-gateway.service`, and verify service, port 18789, four accounts, zero post-start errors, and unchanged image cache.
+- [ ] Owner live acceptance: quote a type 0 text message and verify deterministic no-body response; quote a payload that includes explicit text and verify grounded explanation.

docs/superpowers/specs/2026-07-12-weixin-quoted-text-failclosed-design.md

@@ -0,0 +1,45 @@
+# Weixin Quoted Text Fail-Closed Design
+
+## Goal
+
+Prevent quoted-text questions from being answered with invented message metadata when Weixin does not provide the quoted body. Preserve normal text and confirmed image behavior.
+
+## Evidence
+
+- A quoted text event can arrive as `ref_msg.message_item.type=0` with only `msg_id` and timestamps.
+- Session transcripts retain text but not the original Weixin numeric message ID.
+- Outbound `clientId` values are not the same format as quoted numeric `msg_id` values, and the send API does not expose a server message ID.
+- Therefore recent-message, timestamp, session, and outbound-client-ID matching are not exact evidence and must not be used.
+
+## Decision
+
+Use an evidence-only resolver in `process-message`:
+
+1. If reference payload contains an explicit text item, extract that text and build a bounded quoted-text context for the ordinary text model path.
+2. If reference context exists but has no explicit text and is not a confirmed image, return a deterministic response: `无法读取被引用文字，请复制原文后再提问。`
+3. The unresolved branch is handled before ordinary model dispatch and before Hermes image dispatch.
+4. Do not infer quoted text from metadata, recent messages, session order, timestamps, or approximate IDs.
+
+No persistent text cache is introduced in this change. Outbound ID aliasing remains a separate observation task because an exact mapping has not been proved.
+
+## Interfaces
+
+- `extractHermesReferencedText(items): string` returns only explicit referenced text, otherwise an empty string.
+- `resolveHermesQuotedTextContext(items, currentText)` returns one of:
+  - `{ referenced: false, handled: false, prompt: currentText, reason: "none" }`
+  - `{ referenced: true, handled: false, prompt, reason: "quoted_text_resolved" }`
+  - `{ referenced: true, handled: true, replyText: "无法读取被引用文字，请复制原文后再提问。", reason: "quoted_text_unavailable" }`
+- Confirmed referenced images bypass this text resolver and keep the existing exact image path.
+
+## Privacy And Logging
+
+- Do not log quoted or current text.
+- Log only `reason`, account ID, a one-way bounded hash of quoted ID when available, and boolean evidence flags.
+- Do not persist tokens, credentials, full payloads, or message text.
+
+## Acceptance
+
+- Explicit quoted text is supplied to the ordinary text model with a clear delimiter.
+- Type 0 reference without text returns the deterministic Chinese response and does not call the model.
+- Plain text, current image, and exact quoted image behavior remain unchanged.
+- Generated TS and JS remain byte-idempotent under `--process-only`.

execution/openclaw-v1r4c6-merge-tests-deploy.yaml

@@ -0,0 +1,152 @@
+apiVersion: aios.gitops/v1
+kind: ExecutionOrder
+metadata:
+  name: openclaw-v1r4c6-merge-tests-deploy
+  date: 2026-07-11
+  owner_approval:
+    branch: request/openclaw-v1r4c6-merge-deploy-20260711
+    file: approvals/openclaw-v1r4c6-merge-deploy-owner-approval.yaml
+    commit: 4653f92
+spec:
+  objective: >-
+    Integrate the approved V1R4C6 Admin Workbench, Search Gateway, and Agent Platform
+    changes into a clean candidate based on the latest main, execute all mandatory gates,
+    merge to main only after success, then deploy and verify production.
+  confirmation_policy: no_additional_confirmation_required
+  source:
+    primary_branch: release/v1r4c6-admin-search-agent-integration-20260711
+    supporting_domains:
+      - admin-workbench-portal-aios
+      - search-gateway-governance
+      - agent-platform-integration
+  target:
+    integration_branch: integration/v1r4c6-merge-deploy-20260711-01
+    final_branch: main
+    release_version: V1R4C6
+  execution:
+    - id: preflight
+      actions:
+        - fetch_all_refs_and_tags
+        - verify_workspace_clean
+        - reset_integration_candidate_to_latest_main
+        - verify_baseline_is_V1R4C5
+        - verify_memory_search_enabled_is_false
+        - verify_V1R4C5_tag_unchanged
+        - record_main_head_and_source_head
+      stop_conditions:
+        - dirty_workspace
+        - missing_source_branch
+        - baseline_not_V1R4C5
+        - protected_setting_changed
+    - id: semantic-diff-review
+      actions:
+        - compute_three_dot_diff_from_main_to_primary_branch
+        - classify_changes_by_admin_search_agent_domains
+        - detect_duplicate_control_artifacts_already_merged_by_PR_6
+        - preserve_PR_7_NOT_RUN_status_until_tests_execute
+        - reject_reversion_of_V1R4C5_baseline_metadata
+        - reject_enablement_of_memory_search
+      output:
+        - execution/evidence/v1r4c6-semantic-diff-report.md
+    - id: merge-candidate
+      actions:
+        - merge_primary_branch_into_integration_candidate_without_fast_forward
+        - resolve_text_conflicts_by_preserving_latest_main_control_metadata
+        - preserve_source_business_functionality_when_not_conflicting_with_safety_controls
+        - commit_resolved_candidate
+      forbidden:
+        - force_push
+        - direct_commit_to_main
+        - bypass_branch_protection
+        - bypass_owner_gate
+        - weaken_rbac_or_scope_isolation
+        - mark_unexecuted_tests_as_passed
+    - id: gate-a-admin
+      required_checks:
+        - admin_workbench_routes_and_assets_load
+        - portal_aios_manifest_dashboard_health_endpoints
+        - server_side_and_frontend_rbac
+        - empty_error_and_loading_states
+        - tenant_user_project_session_isolation
+    - id: gate-b-search
+      required_checks:
+        - real_provider_binding_or_explicit_safe_fallback
+        - timeout_limited_retry_and_safe_fallback
+        - scope_filter_before_ranking
+        - provenance_in_results
+        - provider_and_fallback_audit
+        - unauthorized_results_never_enter_ranking_or_summary
+        - memory_search_remains_disabled
+    - id: gate-c-agent
+      required_checks:
+        - unified_agent_event_bus
+        - scoped_agent_gpt_message_plane
+        - autonomous_controller_dispatch
+        - safe_mode_stops_dispatch_and_change
+        - high_risk_actions_remain_owner_gated
+        - duplicate_dispatch_is_idempotent_or_rejected
+        - queue_failure_retry_observability
+    - id: runtime-and-regression
+      actions:
+        - run_getRuntimeStatus
+        - run_getBaseline
+        - run_createBranch_smoke_test
+        - run_createPatch_smoke_test
+        - run_full_regression_suite
+        - run_deployment_preflight_health_checks
+      expected:
+        reads: "200 OK with service, status, workspace_branch"
+        writes: "200 OK with branch, commit, rev, sync_status"
+    - id: promote-main
+      conditions:
+        - gate_a_passed
+        - gate_b_passed
+        - gate_c_passed
+        - runtime_acceptance_passed
+        - regression_passed
+        - deployment_preflight_passed
+      actions:
+        - open_or_update_merge_request_from_integration_candidate_to_main
+        - merge_without_rewriting_history
+        - record_new_main_head
+        - update_versions_V1R4C6_json_to_release_ready_or_active_baseline_as_policy_requires
+        - update_baseline_current_json_only_after_successful_promotion
+        - create_V1R4C6_tag_according_to_repository_tag_semantics
+    - id: deploy-and-verify
+      actions:
+        - trigger_direct_deployment_from_new_main
+        - verify_service_health
+        - verify_admin_search_agent_smoke_paths
+        - verify_runtime_status_and_baseline_after_deploy
+        - verify_rollback_artifact_and_previous_baseline_are_available
+        - publish_production_verification_report
+  failure_policy:
+    mode: fail_closed
+    on_any_failure:
+      - stop_pipeline
+      - do_not_update_main
+      - do_not_create_or_move_release_tag
+      - do_not_deploy
+      - preserve_integration_branch_for_forensics
+      - commit_failure_evidence_and_exact_blocker
+  reporting:
+    required_files:
+      - execution/evidence/v1r4c6-semantic-diff-report.md
+      - execution/evidence/gate-a-admin-result.md
+      - execution/evidence/gate-b-search-result.md
+      - execution/evidence/gate-c-agent-result.md
+      - execution/evidence/runtime-acceptance-result.md
+      - execution/evidence/regression-result.md
+      - execution/evidence/deployment-result.md
+      - execution/evidence/production-verification-result.md
+    final_summary_fields:
+      - source_head
+      - integration_head
+      - main_head_before
+      - main_head_after
+      - merge_commit
+      - release_tag
+      - deployment_id
+      - gate_results
+      - production_health
+      - rollback_ready

fixes/patch_openclaw_weixin_bigint.py

@@ -0,0 +1,112 @@
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+
+TS_HELPER = '''// AIOS Weixin lossless getUpdates JSON begin
+const WEIXIN_EXACT_ID_FIELDS = new Set(["message_id", "msg_id", "root_id", "parent_id", "server_msg_id", "new_msg_id"]);
+function parseWeixinGetUpdatesJson(rawText: string): GetUpdatesResp {
+  return JSON.parse(rawText, (key: string, value: unknown, context?: { source?: string }) => {
+    if (!WEIXIN_EXACT_ID_FIELDS.has(key) || value == null || typeof value === "string") return value;
+    if (typeof value !== "number") throw new Error(`invalid ${key} type in getUpdates response`);
+    const source = context?.source;
+    if (!source || !/^(?:0|[1-9]\\d*)$/.test(source)) throw new Error(`unsafe numeric ${key} in getUpdates response`);
+    return source;
+  }) as GetUpdatesResp;
+}
+// AIOS Weixin lossless getUpdates JSON end'''
+
+JS_HELPER = '''// AIOS Weixin lossless getUpdates JSON begin
+const WEIXIN_EXACT_ID_FIELDS = new Set(["message_id", "msg_id", "root_id", "parent_id", "server_msg_id", "new_msg_id"]);
+function parseWeixinGetUpdatesJson(rawText) {
+    return JSON.parse(rawText, (key, value, context) => {
+        if (!WEIXIN_EXACT_ID_FIELDS.has(key) || value == null || typeof value === "string")
+            return value;
+        if (typeof value !== "number")
+            throw new Error(`invalid ${key} type in getUpdates response`);
+        const source = context?.source;
+        if (!source || !/^(?:0|[1-9]\\d*)$/.test(source))
+            throw new Error(`unsafe numeric ${key} in getUpdates response`);
+        return source;
+    });
+}
+// AIOS Weixin lossless getUpdates JSON end'''
+
+
+def insert_once(text: str, marker: str, addition: str) -> str:
+    if addition in text:
+        return text
+    if marker not in text:
+        raise RuntimeError(f'marker not found: {marker}')
+    return text.replace(marker, marker + '\n' + addition, 1)
+
+
+def patch_api_ts(text: str) -> str:
+    text = insert_once(text, 'import { redactBody, redactUrl } from "../util/redact.js";', '\n' + TS_HELPER)
+    old = 'const resp: GetUpdatesResp = JSON.parse(rawText);'
+    new = 'const resp: GetUpdatesResp = parseWeixinGetUpdatesJson(rawText);'
+    if new not in text:
+        if old not in text:
+            raise RuntimeError('TypeScript getUpdates parser marker not found')
+        text = text.replace(old, new, 1)
+    return text
+
+
+def patch_api_js(text: str) -> str:
+    text = insert_once(text, 'import { redactBody, redactUrl } from "../util/redact.js";', '\n' + JS_HELPER)
+    old = 'const resp = JSON.parse(rawText);'
+    new = 'const resp = parseWeixinGetUpdatesJson(rawText);'
+    if new not in text:
+        if old not in text:
+            raise RuntimeError('JavaScript getUpdates parser marker not found')
+        text = text.replace(old, new, 1)
+    return text
+
+
+def patch_types_ts(text: str) -> str:
+    new = 'message_id?: string | number;'
+    if new in text:
+        return text
+    old = 'message_id?: number;'
+    if old not in text:
+        raise RuntimeError('message_id type marker not found')
+    return text.replace(old, new, 1)
+
+
+def write_if_changed(path: Path, content: str) -> bool:
+    original = path.read_text(encoding='utf-8')
+    if original == content:
+        return False
+    path.write_text(content, encoding='utf-8')
+    return True
+
+
+def apply(plugin_root: Path) -> dict[str, bool]:
+    paths = {
+        'src/api/api.ts': patch_api_ts,
+        'dist/src/api/api.js': patch_api_js,
+        'src/api/types.ts': patch_types_ts,
+    }
+    changed: dict[str, bool] = {}
+    for relative, transform in paths.items():
+        path = plugin_root / relative
+        if not path.exists():
+            raise RuntimeError(f'missing plugin file: {path}')
+        original = path.read_text(encoding='utf-8')
+        changed[relative] = write_if_changed(path, transform(original))
+    return changed
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument('plugin_root', type=Path)
+    args = parser.parse_args()
+    changed = apply(args.plugin_root.resolve())
+    print(json.dumps({'plugin_root': str(args.plugin_root.resolve()), 'changed': changed}, ensure_ascii=False))
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

fixes/patch_openclaw_weixin_outbound_quotes.py

@@ -0,0 +1,156 @@
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+
+def replace_required(text: str, old: str, new: str, label: str) -> str:
+    if new in text:
+        return text
+    if old not in text:
+        raise RuntimeError(f'{label} marker not found')
+    return text.replace(old, new, 1)
+
+
+def patch_send_ts(text: str) -> str:
+    text = replace_required(
+        text,
+        '}): Promise<{ messageId: string }> {\n  const { to, text, opts } = params;\n',
+        '}): Promise<{ messageId: string; createTimeMs: number }> {\n  const { to, text, opts } = params;\n',
+        'TS send return type',
+    )
+    text = replace_required(
+        text,
+        '  const clientId = generateClientId();\n  const req = buildSendMessageReq({',
+        '  const clientId = generateClientId();\n  const createTimeMs = Date.now();\n  const req = buildSendMessageReq({',
+        'TS create time',
+    )
+    text = replace_required(
+        text,
+        '  });\n  try {\n    await sendMessageApi({',
+        '  });\n  if (!req.msg?.item_list?.[0]) throw new Error("sendMessageWeixin: text item missing");\n  req.msg.item_list[0].create_time_ms = createTimeMs;\n  try {\n    await sendMessageApi({',
+        'TS request timestamp',
+    )
+    text = replace_required(
+        text,
+        '  return { messageId: clientId };\n}\n\n/** Send a single structured MessageItem downstream. */',
+        '  return { messageId: clientId, createTimeMs };\n}\n\n/** Send a single structured MessageItem downstream. */',
+        'TS send result',
+    )
+    return text
+
+
+def patch_send_js(text: str) -> str:
+    text = replace_required(
+        text,
+        '    const clientId = generateClientId();\n    const req = buildSendMessageReq({',
+        '    const clientId = generateClientId();\n    const createTimeMs = Date.now();\n    const req = buildSendMessageReq({',
+        'JS create time',
+    )
+    text = replace_required(
+        text,
+        '    });\n    try {\n        await sendMessageApi({',
+        '    });\n    if (!req.msg?.item_list?.[0])\n        throw new Error("sendMessageWeixin: text item missing");\n    req.msg.item_list[0].create_time_ms = createTimeMs;\n    try {\n        await sendMessageApi({',
+        'JS request timestamp',
+    )
+    text = replace_required(
+        text,
+        '    return { messageId: clientId };\n}\n/** Send a single structured MessageItem downstream. */',
+        '    return { messageId: clientId, createTimeMs };\n}\n/** Send a single structured MessageItem downstream. */',
+        'JS send result',
+    )
+    return text
+
+
+def patch_process_ts(text: str) -> str:
+    old = '''await sendMessageWeixin({ to: ctx.To, text, opts: {
+                baseUrl: deps.baseUrl,
+                token: deps.token,
+                contextToken,
+                runId,
+              }});'''
+    new = '''const sentText = await sendMessageWeixin({ to: ctx.To, text, opts: {
+                baseUrl: deps.baseUrl,
+                token: deps.token,
+                contextToken,
+                runId,
+              }});
+              rememberHermesOutboundTextMessage(deps.accountId, ctx.To, text, sentText.createTimeMs);'''
+    text = replace_required(text, old, new, 'TS fallback text send')
+    old = '''await sendMessageWeixin({ to: ctx.To, text, opts: {
+              baseUrl: deps.baseUrl,
+              token: deps.token,
+              contextToken,
+              runId,
+            }});'''
+    new = '''const sentText = await sendMessageWeixin({ to: ctx.To, text, opts: {
+              baseUrl: deps.baseUrl,
+              token: deps.token,
+              contextToken,
+              runId,
+            }});
+            rememberHermesOutboundTextMessage(deps.accountId, ctx.To, text, sentText.createTimeMs);'''
+    return replace_required(text, old, new, 'TS normal text send')
+
+
+def patch_process_js(text: str) -> str:
+    old = '''await sendMessageWeixin({ to: ctx.To, text, opts: {
+                                baseUrl: deps.baseUrl,
+                                token: deps.token,
+                                contextToken,
+                                runId,
+                            } });'''
+    new = '''const sentText = await sendMessageWeixin({ to: ctx.To, text, opts: {
+                                baseUrl: deps.baseUrl,
+                                token: deps.token,
+                                contextToken,
+                                runId,
+                            } });
+                        rememberHermesOutboundTextMessage(deps.accountId, ctx.To, text, sentText.createTimeMs);'''
+    text = replace_required(text, old, new, 'JS fallback text send')
+    old = '''await sendMessageWeixin({ to: ctx.To, text, opts: {
+                            baseUrl: deps.baseUrl,
+                            token: deps.token,
+                            contextToken,
+                            runId,
+                        } });'''
+    new = '''const sentText = await sendMessageWeixin({ to: ctx.To, text, opts: {
+                            baseUrl: deps.baseUrl,
+                            token: deps.token,
+                            contextToken,
+                            runId,
+                        } });
+                    rememberHermesOutboundTextMessage(deps.accountId, ctx.To, text, sentText.createTimeMs);'''
+    return replace_required(text, old, new, 'JS normal text send')
+
+
+def apply(root: Path) -> dict[str, bool]:
+    transforms = {
+        'src/messaging/send.ts': patch_send_ts,
+        'dist/src/messaging/send.js': patch_send_js,
+        'src/messaging/process-message.ts': patch_process_ts,
+        'dist/src/messaging/process-message.js': patch_process_js,
+    }
+    changed = {}
+    for relative, transform in transforms.items():
+        path = root / relative
+        original = path.read_text(encoding='utf-8')
+        updated = transform(original)
+        changed[relative] = updated != original
+        if updated != original:
+            path.write_text(updated, encoding='utf-8')
+    return changed
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument('plugin_root', type=Path)
+    args = parser.parse_args()
+    root = args.plugin_root.resolve()
+    print(json.dumps({'plugin_root': str(root), 'changed': apply(root)}, ensure_ascii=False))
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

ops/aios-v2/v2r1c2-production-control.sh

@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+VERSION=V2R1C2
+EXPECTED_TARGET=3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24
+TAG_OBJECT=a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36
+REPO=/data/aios-gitops/repo.git
+SOURCE=/opt/aios-v2r1c2
+TAKEOVER=/data/aios-gitops/worktrees/codex/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER-20260722
+CANDIDATE_SERVICE=aios-v2r1c2-portal.service
+OLD_SERVICE=aios-orchestrator-gateway.service
+NEW_SERVICE=aios-v2r1c2-production.service
+CANDIDATE_STATE=/var/lib/aios-v2r1c2-portal
+PRODUCTION_STATE=/var/lib/aios-v2r1c2-production
+RUN_ID=${AIOS_RELEASE_RUN_ID:-AIOS-V2R1C2-PRODUCTION-20260722T011836Z}
+EVIDENCE_DIR=/var/lib/aios-gitops/acceptance/$RUN_ID
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+RELEASE_ROOT=$(cd -- "$SCRIPT_DIR/../.." && pwd)
+UNIT_SOURCE=$RELEASE_ROOT/deploy/aios-v2/systemd/aios-v2r1c2-production.service
+ENV_SOURCE=$RELEASE_ROOT/deploy/aios-v2/systemd/aios-v2r1c2-production.env.example
+LOCK=/run/lock/aios-v2r1c2-production-release.lock
+
+require_root() {
+  test "$(id -u)" -eq 0 || { echo 'root required' >&2; exit 77; }
+}
+
+health_old() {
+  curl -fsS --max-time 10 http://127.0.0.1:18920/healthz
+}
+
+health_new() {
+  curl -fsS --max-time 10 http://127.0.0.1:18920/api/v2/health
+}
+
+health_candidate() {
+  curl -fsS --max-time 10 http://127.0.0.1:18921/api/v2/health
+}
+
+wait_candidate() {
+  for _ in $(seq 1 30); do
+    if health_candidate; then
+      return 0
+    fi
+    sleep 1
+  done
+  return 1
+}
+
+preflight() {
+  require_root
+  test "$(git --git-dir="$REPO" rev-parse refs/tags/$VERSION)" = "$TAG_OBJECT"
+  test "$(git --git-dir="$REPO" rev-list -n 1 "$VERSION")" = "$EXPECTED_TARGET"
+  test -f "$SOURCE/active-runtime/app/aios_web/release_application.py"
+  test -f "$UNIT_SOURCE"
+  test -f "$ENV_SOURCE"
+  command -v sqlite3 >/dev/null
+  systemctl is-active --quiet "$CANDIDATE_SERVICE"
+  systemctl is-active --quiet "$OLD_SERVICE"
+  health_candidate >/dev/null
+  health_old >/dev/null
+  (
+    cd "$TAKEOVER/artifacts/v2r1c2"
+    sha256sum -c checksums.sha256 >/dev/null
+  )
+  diff -qr --exclude=__pycache__ "$TAKEOVER/active-runtime/app" "$SOURCE/active-runtime/app" >/dev/null
+  diff -qr "$TAKEOVER/plans" "$SOURCE/plans" >/dev/null
+  echo PREFLIGHT=PASS
+}
+
+prepare() {
+  preflight
+  install -d -m 0750 "$EVIDENCE_DIR" "$EVIDENCE_DIR/backup"
+  health_old >"$EVIDENCE_DIR/production-health-before.json"
+  health_candidate >"$EVIDENCE_DIR/candidate-health-before.json"
+  systemctl cat "$OLD_SERVICE" >"$EVIDENCE_DIR/backup/$OLD_SERVICE.unit"
+  cp -a /etc/aios-orchestrator-gateway "$EVIDENCE_DIR/backup/"
+  cp -a /etc/systemd/system/aios-orchestrator-gateway.service "$EVIDENCE_DIR/backup/"
+  if test -e "$PRODUCTION_STATE"; then
+    mv "$PRODUCTION_STATE" "$EVIDENCE_DIR/backup/aios-v2r1c2-production-state.preexisting"
+  fi
+  systemctl stop "$CANDIDATE_SERVICE"
+  trap 'systemctl start "$CANDIDATE_SERVICE" || true' EXIT
+  while IFS= read -r -d '' database; do
+    sqlite3 "$database" 'PRAGMA wal_checkpoint(TRUNCATE);' >/dev/null
+    test "$(sqlite3 "$database" 'PRAGMA quick_check;')" = ok
+  done < <(find "$CANDIDATE_STATE" -maxdepth 1 -type f -name '*.sqlite3' -print0)
+  install -d -o aios -g aios -m 0750 "$PRODUCTION_STATE"
+  cp -a "$CANDIDATE_STATE/." "$PRODUCTION_STATE/"
+  chown -R aios:aios "$PRODUCTION_STATE"
+  while IFS= read -r -d '' database; do
+    test "$(sqlite3 "$database" 'PRAGMA quick_check;')" = ok
+  done < <(find "$PRODUCTION_STATE" -maxdepth 1 -type f -name '*.sqlite3' -print0)
+  install -o root -g root -m 0644 "$UNIT_SOURCE" /etc/systemd/system/aios-v2r1c2-production.service
+  install -d -o root -g aios -m 0750 /etc/aios-v2
+  install -o root -g aios -m 0640 "$ENV_SOURCE" /etc/aios-v2/aios-v2r1c2-production.env
+  systemctl daemon-reload
+  systemctl start "$CANDIDATE_SERVICE"
+  wait_candidate >"$EVIDENCE_DIR/candidate-health-after-state-copy.json"
+  trap - EXIT
+  echo PREPARE=PASS
+}
+
+rollback() {
+  require_root
+  systemctl stop "$NEW_SERVICE" || true
+  systemctl disable "$NEW_SERVICE" >/dev/null 2>&1 || true
+  systemctl enable "$OLD_SERVICE" >/dev/null 2>&1 || true
+  systemctl start "$OLD_SERVICE"
+  health_old >"$EVIDENCE_DIR/rollback-health.json"
+  echo ROLLBACK=PASS
+}
+
+promote() {
+  require_root
+  test -f /etc/systemd/system/aios-v2r1c2-production.service
+  test -f /etc/aios-v2/aios-v2r1c2-production.env
+  ! systemctl is-active --quiet "$NEW_SERVICE"
+  systemctl is-active --quiet "$CANDIDATE_SERVICE"
+  health_candidate >/dev/null
+  health_old >"$EVIDENCE_DIR/production-health-switch-input.json"
+  trap 'trap - ERR; rollback' ERR
+  systemctl stop "$OLD_SERVICE"
+  systemctl start "$NEW_SERVICE"
+  for _ in $(seq 1 30); do
+    if health_new >"$EVIDENCE_DIR/production-health-after-switch.json" 2>/dev/null; then
+      echo PROMOTE=PASS
+      trap - ERR
+      return 0
+    fi
+    sleep 1
+  done
+  return 1
+}
+
+finalize() {
+  require_root
+  systemctl is-active --quiet "$NEW_SERVICE"
+  health_new >"$EVIDENCE_DIR/production-health-final.json"
+  systemctl disable "$OLD_SERVICE" >/dev/null
+  systemctl enable "$NEW_SERVICE" >/dev/null
+  echo FINALIZE=PASS
+}
+
+exec 9>"$LOCK"
+flock -n 9 || { echo 'release operation already running' >&2; exit 75; }
+case "${1:-}" in
+  preflight) preflight ;;
+  prepare) prepare ;;
+  promote) promote ;;
+  rollback) rollback ;;
+  finalize) finalize ;;
+  *) echo "usage: $0 {preflight|prepare|promote|rollback|finalize}" >&2; exit 64 ;;
+esac

ops/aios-v2/v2r1c2-promote-and-accept.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+RUN_ID=AIOS-V2R1C2-PRODUCTION-20260722T011836Z
+CONTROL=/data/aios-gitops/worktrees/controller/ops/aios-v2/v2r1c2-production-control.sh
+REPO=/data/aios-gitops/repo.git
+EVIDENCE_DIR=/var/lib/aios-gitops/acceptance/$RUN_ID
+DRIVER=/data/aios-gitops/worktrees/controller/tools/run_online_smoke_18920.py
+TEMP_SOURCE=
+
+cleanup_temp() {
+  case "$TEMP_SOURCE" in
+    /tmp/aios-v2r1c2-production-acceptance.*)
+      test -d "$TEMP_SOURCE" && rm -rf -- "$TEMP_SOURCE"
+      ;;
+    '') ;;
+    *) echo "refusing to remove unexpected temporary path: $TEMP_SOURCE" >&2; return 1 ;;
+  esac
+}
+
+rollback_on_error() {
+  code=$?
+  trap - ERR
+  AIOS_RELEASE_RUN_ID="$RUN_ID" "$CONTROL" rollback || true
+  cleanup_temp || true
+  exit "$code"
+}
+trap rollback_on_error ERR
+
+AIOS_RELEASE_RUN_ID="$RUN_ID" "$CONTROL" promote
+systemctl is-active --quiet aios-v2r1c2-production.service
+! systemctl is-active --quiet aios-orchestrator-gateway.service
+curl -fsS --max-time 10 http://127.0.0.1:18920/api/v2/health >"$EVIDENCE_DIR/health-after-promote.json"
+curl -fsS --max-time 10 http://127.0.0.1:18921/api/v2/health >"$EVIDENCE_DIR/candidate-health-during-production.json"
+
+TEMP_SOURCE=$(mktemp -d /tmp/aios-v2r1c2-production-acceptance.XXXXXX)
+git --git-dir="$REPO" archive 8cdca463aff9707edee00e20a3b56884130f6978 | tar -x -C "$TEMP_SOURCE"
+(
+  cd "$TEMP_SOURCE"
+  python3 tools/aios_v2r1c2_acceptance.py \
+    --source-oid 3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24 \
+    --online \
+    --base-url http://127.0.0.1:18920 \
+    --evidence-output "$EVIDENCE_DIR/production-acceptance.json"
+)
+python3 "$DRIVER" "$TEMP_SOURCE" "$EVIDENCE_DIR/production-online-smoke.json"
+
+python3 - "$EVIDENCE_DIR/production-acceptance.json" "$EVIDENCE_DIR/production-online-smoke.json" <<'PY'
+import json
+import sys
+for path in sys.argv[1:]:
+    with open(path, encoding='utf-8') as handle:
+        data = json.load(handle)
+    if data.get('passed') is not True:
+        raise SystemExit(f'acceptance failed: {path}')
+PY
+
+systemctl show aios-v2r1c2-production.service \
+  -p ActiveState -p SubState -p MainPID -p NRestarts \
+  >"$EVIDENCE_DIR/production-service-status.txt"
+sha256sum "$EVIDENCE_DIR"/production-acceptance.json \
+  "$EVIDENCE_DIR"/production-online-smoke.json \
+  "$EVIDENCE_DIR"/health-after-promote.json \
+  >"$EVIDENCE_DIR/production-evidence.sha256"
+
+cleanup_temp
+TEMP_SOURCE=
+trap - ERR
+echo SWITCH_VALIDATED=PASS

ops/openclaw/CMD-20260711-v1r4c6-integrate-deploy-verify.md

@@ -0,0 +1,429 @@
+# CMD-20260711-v1r4c6-integrate-deploy-verify
+
+## Goal
+
+Perform the actual controlled integration, deployment, and verification for V1R4C6.
+
+V1R4C6 includes:
+
+1. Admin Workbench / Portal AIOS read-only rollout.
+2. SR-03 Search Gateway real provider binding.
+3. Agent Platform Integration.
+
+Stop before V1R4C6 Git tag creation and baseline promotion. Those operations require owner confirmation.
+
+## Hard Constraints
+
+```text
+AIOS_MEMORY_ENABLED=false
+memory search remains disabled
+no global vector index
+no force-push
+no V1R4C5 tag movement
+no Gitea DB mutation
+no secret plaintext in Git, logs, or reports
+```
+
+If any mandatory security or reliability check fails, stop deployment and report the blocker. Do not bypass the gate.
+
+## Verified Base
+
+Required before starting:
+
+```text
+current_baseline = V1R4C5
+previous_baseline = V1R4C3
+baseline_git = a32c76a3c1baa49562e53fb8adce10a5ed0e6704
+AIOS_GITOPS_BARE_REPO = /data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git
+runtime = active
+```
+
+## Phase 0 — Preflight and Backup
+
+```bash
+set -euo pipefail
+
+ROOT=/data/aios-gitops/workspace
+SOURCE_RELEASE=release/v1r4c6-admin-search-agent-integration-20260711
+EXEC_BRANCH=release/v1r4c6-integration-exec-20260711
+
+cd "$ROOT"
+git fetch origin --tags --prune
+
+git status --short
+
+test -f baseline/current.json
+python3 - <<'PY'
+import json
+from pathlib import Path
+p = Path('baseline/current.json')
+d = json.loads(p.read_text(encoding='utf-8'))
+assert d['current_baseline'] == 'V1R4C5', d
+assert d['previous_baseline'] == 'V1R4C3', d
+assert d['git'] == 'a32c76a3c1baa49562e53fb8adce10a5ed0e6704', d
+assert d.get('constraints', {}).get('memory_search_enabled') is False, d
+print('baseline preflight: PASS')
+PY
+
+test -d /data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git
+
+BACKUP=/data/aios-gitops/runtime/backups/v1r4c6-predeploy-$(date +%Y%m%d-%H%M%S)
+mkdir -p "$BACKUP"
+cp -a baseline/current.json "$BACKUP/current.json"
+cp -a versions/V1R4C5.json "$BACKUP/V1R4C5.json"
+
+if git show-ref --verify --quiet "refs/heads/$EXEC_BRANCH"; then
+  git checkout "$EXEC_BRANCH"
+  git pull --ff-only origin "$EXEC_BRANCH"
+else
+  git checkout -b "$EXEC_BRANCH" "origin/$SOURCE_RELEASE"
+  git push -u origin "$EXEC_BRANCH"
+fi
+```
+
+Never use `git push --force` or `git tag -f`.
+
+## Phase 1 — Merge Group A: Admin Workbench / Portal AIOS
+
+Merge in this order:
+
+```bash
+git merge --no-ff origin/feature/v1r4c4-sr04-admin-workbench-visibility-20260711 \
+  -m 'merge(v1r4c6): admin workbench visibility preparation'
+
+git merge --no-ff origin/feature/v1r4c4-sr04-portal-aios-visibility-20260710 \
+  -m 'merge(v1r4c6): portal AIOS visibility preparation'
+
+git merge --no-ff origin/patch/user-portal-me-route-diagnostics-20260709 \
+  -m 'merge(v1r4c6): portal AIOS routes and RBAC manifest'
+
+git merge --no-ff origin/patch/user-portal-rbac-ops-dashboard \
+  -m 'merge(v1r4c6): portal RBAC operations dashboard'
+
+git merge --no-ff origin/patch/agent-observability-webui \
+  -m 'merge(v1r4c6): agent observability web UI'
+```
+
+Before merging `patch/web-ui-complete-gitops-dashboard-20260706`, compare overlap:
+
+```bash
+git diff --stat HEAD..origin/patch/web-ui-complete-gitops-dashboard-20260706
+```
+
+Merge only if it adds required functionality not already present. Otherwise record it as superseded.
+
+### Conflict Policy
+
+Do not auto-resolve conflicts in:
+
+```text
+auth/RBAC configuration
+user/session/tenant isolation
+search provider configuration
+safe-mode/controller dispatch
+systemd units
+baseline/current.json
+versions/*.json
+```
+
+For those files, stop and report conflict paths.
+
+### Group A Tests
+
+Run at minimum:
+
+```bash
+python3 -m pytest -q \
+  tests/test_portal_aios_frontend_contract.py \
+  tests/test_portal_aios_module_registry.py \
+  tests/test_portal_aios_navigation.py \
+  tests/test_portal_integration_health.py \
+  tests/test_portal_system_health_adapter.py
+```
+
+Run any additional portal/RBAC/dashboard tests discovered under `tests/`.
+
+## Phase 2 — Merge Group B: SR-03 Search Gateway
+
+```bash
+git merge --no-ff origin/feature/v1r4c4-sr02-search-gateway-resilience-20260710 \
+  -m 'merge(v1r4c6): search gateway resilience metadata'
+
+git merge --no-ff origin/patch/search-gateway-governed-general-capability \
+  -m 'merge(v1r4c6): governed search gateway provider binding'
+
+git merge --no-ff origin/patch/gitops-change-archive-audit \
+  -m 'merge(v1r4c6): search and GitOps audit evidence'
+```
+
+### Group B Security Review
+
+Verify before deployment:
+
+```text
+scope filtering occurs before ranking
+provenance is attached to accepted results
+out-of-scope records never reach ranking or summarization
+fallback is text-only, no-memory, or scoped-only
+global memory/vector index is disabled
+memory search remains disabled
+provider credentials are secret references only
+```
+
+Reject any code path that silently broadens search scope.
+
+### Group B Tests
+
+Discover and run all search/provider/isolation tests:
+
+```bash
+find tests -maxdepth 2 -type f \
+  \( -iname '*search*' -o -iname '*provider*' -o -iname '*scope*' -o -iname '*isolation*' \) \
+  -print
+```
+
+Then run the discovered files with `python3 -m pytest -q`.
+
+Also run:
+
+```bash
+bash ops/ci/run-user-data-isolation-acceptance.sh
+```
+
+If that script is not present after merge, stop: the data-isolation gate is mandatory.
+
+## Phase 3 — Merge Group C: Agent Platform
+
+```bash
+git merge --no-ff origin/patch/agent-event-bus-unified \
+  -m 'merge(v1r4c6): unified scoped agent event bus'
+
+git merge --no-ff origin/patch/agent-gpt-message-plane \
+  -m 'merge(v1r4c6): scoped agent GPT message plane'
+
+git merge --no-ff origin/patch/autonomous-controller-dispatch-20260709 \
+  -m 'merge(v1r4c6): autonomous controller dispatch with gates'
+
+git merge --no-ff origin/patch/self-evolution-agent-orchestration-policy \
+  -m 'merge(v1r4c6): self-evolution orchestration policy'
+```
+
+Review `patch/aios-autonomous-orchestrator-architecture-review-v1`:
+
+- merge if it contains a current architecture record not already present;
+- otherwise mark it superseded in the release report.
+
+### Group C Security Review
+
+Verify:
+
+```text
+event envelope includes tenant/group, user, project, session, agent, source and provenance
+message plane rejects cross-scope delivery
+denied messages never forward body/content
+controller dispatch checks autonomous safe mode before mutation
+consequential actions remain owner-gated
+duplicate dispatch is idempotent or rejected
+queue/retry behavior is bounded and observable
+```
+
+### Group C Tests
+
+Discover and run agent/event/message/dispatch/controller tests:
+
+```bash
+find tests -maxdepth 2 -type f \
+  \( -iname '*agent*' -o -iname '*event*' -o -iname '*message*' -o -iname '*dispatch*' -o -iname '*autonomous_controller*' \) \
+  -print
+```
+
+Run all discovered files with `python3 -m pytest -q`.
+
+Re-run the SR-02 watcher/controller suite and require all tests to pass.
+
+## Phase 4 — Full Test and Static Validation
+
+```bash
+python3 -m compileall -q active-runtime scripts tests
+python3 -m pytest -q
+```
+
+If the full suite has unrelated historical failures, report them separately, but all V1R4C6-touched component tests must pass.
+
+Validate JSON/YAML configuration without printing secrets.
+
+Verify:
+
+```bash
+git diff --check
+git status --short
+```
+
+Commit integration result normally:
+
+```bash
+git add -A
+git commit -m 'release: integrate V1R4C6 admin search and agent platform'
+git push origin "$EXEC_BRANCH"
+```
+
+If no uncommitted changes remain because merge commits already captured everything, just push normally.
+
+## Phase 5 — Deploy to Staging/Production Runtime
+
+Use the existing deployment mechanism for this repository. Do not invent a new deployment path.
+
+Before restart/reload, identify changed services and frontend bundles from the merged diff.
+
+At minimum:
+
+1. Deploy backend modules under `active-runtime/app/`.
+2. Deploy portal frontend/navigation/proxy changes.
+3. Deploy Search Gateway provider binding using secret references.
+4. Deploy Agent Platform event/message/dispatch changes.
+5. Preserve existing Gitea sentinel and user-data isolation systemd controls.
+6. Keep `AIOS_MEMORY_ENABLED=false`.
+
+Restart only affected services. Do not restart Gitea unless it independently fails health checks.
+
+After deployment, verify affected services are active and no restart loop exists.
+
+## Phase 6 — Actual Deployment Verification
+
+### Global
+
+```bash
+curl -fsS http://127.0.0.1:18890/api/base | python3 -m json.tool
+curl -fsS https://cnnetmkt.top/api/base | python3 -m json.tool
+```
+
+Before V1R4C6 promotion both must still report V1R4C5.
+
+Verify Gitea sentinel remains healthy and memory search remains disabled.
+
+### Gate A — Portal/Admin Workbench
+
+Use an existing authenticated test mechanism or secret-backed admin session. Do not log cookies/tokens.
+
+Verify:
+
+```text
+/portal/me/aios/manifest
+/portal/me/aios/dashboard
+/portal/me/aios/health
+```
+
+For `user`, `group_admin/admin`, and `owner`, record only module names/status, not personal data.
+
+Required admin-visible functions:
+
+```text
+task progress
+process/flow diagram entry
+system health
+agent observability
+```
+
+Verify forbidden owner modules are hidden from non-owner admins.
+
+### Gate B — Search Gateway
+
+Execute scoped test queries using non-sensitive fixtures.
+
+Verify:
+
+```text
+real provider selected
+scope applied before ranking
+provenance returned
+out-of-scope fixture denied
+safe fallback works
+memory search remains disabled
+```
+
+### Gate C — Agent Platform
+
+Using synthetic non-sensitive events/messages:
+
+```text
+same-scope delivery succeeds
+cross-user/project/session delivery is denied
+denied payload body is not forwarded
+safe-mode blocks controller mutation
+owner-gated action remains pending approval
+duplicate dispatch is idempotent/rejected
+```
+
+## Phase 7 — Release Evidence
+
+Update:
+
+```text
+docs/releases/V1R4C6-acceptance-checklist.md
+docs/releases/V1R4C6-acceptance-evidence.md
+docs/releases/V1R4C6-release-gate-status.md
+versions/V1R4C6.json
+```
+
+Set each gate to PASS/FAIL with concrete test commands and results.
+
+Required final state before requesting owner confirmation:
+
+```text
+Gate A = PASS
+Gate B = PASS
+Gate C = PASS
+full touched-component tests = PASS
+runtime write acceptance = PASS
+Gitea sentinel = healthy
+memory search = disabled
+force-push used = no
+V1R4C6 tag = absent
+active baseline = V1R4C5
+```
+
+Commit and push evidence normally to `$EXEC_BRANCH`.
+
+## Stop Point — Owner Confirmation Required
+
+Do not create `V1R4C6` tag.
+Do not promote baseline to V1R4C6.
+Do not enable memory search.
+
+When all gates pass, notify the owner through the configured notification mechanism, preferably WeChat if configured. The notification must contain no secrets and must request confirmation for:
+
+```text
+Create V1R4C6 Git tag
+Promote active baseline from V1R4C5 to V1R4C6
+```
+
+Required report fields:
+
+```text
+Status
+Integration branch and HEAD
+Merged branches
+Skipped/superseded branches
+Gate A result
+Gate B result
+Gate C result
+Test totals
+Deployment services/build versions
+Portal/admin verification result
+Search provider verification result
+Agent platform verification result
+Gitea sentinel status
+Memory search status
+Active baseline
+V1R4C6 tag status
+Rollback readiness
+Owner confirmation required
+```
+
+If WeChat notification is not configured, write the exact notification message to:
+
+```text
+/data/aios-gitops/runtime/state/V1R4C6-owner-confirmation-message.txt
+```
+
+and report that path.

ops/openclaw/CMD-20260711-v1r4c6-run-to-owner-gate-wechat.md

@@ -0,0 +1,217 @@
+# CMD-20260711-v1r4c6-run-to-owner-gate-wechat
+
+## Execution Mode
+
+Execute immediately using the existing V1R4C6 integration command:
+
+```text
+ops/openclaw/CMD-20260711-v1r4c6-integrate-deploy-verify.md
+```
+
+Continue through actual merge, tests, deployment, and production verification.
+
+Stop only at the owner gate for:
+
+```text
+V1R4C6 Git tag creation
+V1R4C6 baseline promotion
+```
+
+Do not ask the owner to perform routine engineering or deployment work.
+
+## Verified Starting State
+
+Required before starting:
+
+```text
+runtime = active
+current_baseline = V1R4C5
+previous_baseline = V1R4C3
+baseline_git = a32c76a3c1baa49562e53fb8adce10a5ed0e6704
+AIOS_GITOPS_BARE_REPO = /data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git
+memory_search_enabled = false
+force_push_allowed = false
+```
+
+If any starting condition differs, stop and send a WeChat blocker notification.
+
+## Required Work
+
+Complete all phases in the referenced command:
+
+1. Create/update the normal non-force-pushed integration execution branch.
+2. Merge and validate Admin Workbench / Portal AIOS.
+3. Merge and validate SR-03 Search Gateway real provider binding.
+4. Merge and validate Agent Platform Integration.
+5. Run component and full touched-scope test suites.
+6. Deploy using the repository's existing deployment mechanism.
+7. Verify production routes, RBAC, scope isolation, provenance, safe mode, and owner gates.
+8. Update V1R4C6 release evidence and version metadata.
+9. Push all normal commits to origin.
+10. Keep V1R4C6 tag absent and baseline at V1R4C5 until owner approval.
+
+## Hard Constraints
+
+```text
+AIOS_MEMORY_ENABLED=false
+memory search remains disabled
+no global memory/vector index
+no force-push
+no tag rewrite
+no V1R4C5 tag movement
+no Gitea DB mutation
+no plaintext secrets in Git, logs, reports, or WeChat
+```
+
+Never bypass a failed security, isolation, RBAC, safe-mode, or owner gate.
+
+## WeChat Progress Notifications
+
+Use the configured OpenClaw WeChat notification channel.
+
+Send concise progress notifications at these milestones:
+
+### Notification 1 — Integration Started
+
+```text
+V1R4C6 集成已启动。
+范围：管理员工作台、SR-03 Search Gateway、Agent Platform。
+当前基线：V1R4C5。
+memory search 保持关闭。
+下一步：完成合并、测试和部署验证。
+```
+
+### Notification 2 — Gate A Complete
+
+Include only:
+
+```text
+Gate A result: PASS/FAIL
+Admin task progress visibility: PASS/FAIL
+Flow diagram visibility: PASS/FAIL
+RBAC/isolation: PASS/FAIL
+Blockers, if any
+```
+
+Do not include user records, tokens, cookies, or sensitive task content.
+
+### Notification 3 — Gate B Complete
+
+Include only:
+
+```text
+Gate B result: PASS/FAIL
+Real provider binding: PASS/FAIL
+Scope-before-ranking: PASS/FAIL
+Provenance: PASS/FAIL
+Safe fallback: PASS/FAIL
+Memory search: disabled
+Blockers, if any
+```
+
+### Notification 4 — Gate C Complete
+
+Include only:
+
+```text
+Gate C result: PASS/FAIL
+Event scope: PASS/FAIL
+Message plane scope: PASS/FAIL
+Safe-mode dispatch block: PASS/FAIL
+Owner gate: PASS/FAIL
+Blockers, if any
+```
+
+## Final WeChat Owner Authorization Request
+
+Send only after all mandatory gates and deployment verification pass.
+
+Use this message:
+
+```text
+V1R4C6 已完成实际合并、测试、部署和生产验证，现等待最终发布授权。
+
+版本范围：
+1. 管理员工作台 / Portal AIOS 上线
+2. SR-03 Search Gateway Real Provider Binding
+3. Agent Platform Integration
+
+验收结果：
+- Gate A（管理员工作台 / RBAC / 隔离）：PASS
+- Gate B（Provider / scope / provenance / fallback）：PASS
+- Gate C（Event Bus / Message Plane / Dispatch / Owner Gate）：PASS
+- Runtime 写链路：PASS
+- Gitea consistency sentinel：healthy
+- memory search：仍为 disabled
+- force-push：未使用
+- 当前 active baseline：V1R4C5
+- V1R4C6 tag：尚未创建
+
+请明确回复以下其中一项：
+A. 批准创建 V1R4C6 Git tag，并将 active baseline 从 V1R4C5 晋升至 V1R4C6。
+B. 暂不批准，保持 V1R4C5，并说明需要处理的问题。
+```
+
+## Authorization Rules
+
+Do not treat reactions, emojis, acknowledgements, or ambiguous replies as approval.
+
+Valid approval must explicitly authorize both:
+
+```text
+create V1R4C6 Git tag
+promote baseline V1R4C5 -> V1R4C6
+```
+
+If the owner approves only one operation, execute only the approved operation and stop before the other.
+
+Before executing a consequential operation, record authorization in:
+
+```text
+docs/releases/V1R4C6-owner-approval.md
+```
+
+Record only:
+
+```text
+approved operation(s)
+approved_at
+approval channel = wechat
+message/conversation identifier if available
+owner identity reference without copying personal message content
+memory search remains disabled
+```
+
+Do not store access tokens, cookies, phone numbers, or unrelated chat content.
+
+## WeChat Failure Handling
+
+If the configured WeChat channel is unavailable:
+
+1. Do not claim that a message was sent.
+2. Stop before tag/promotion.
+3. Write the exact final authorization request to:
+
+```text
+/data/aios-gitops/runtime/state/V1R4C6-owner-confirmation-message.txt
+```
+
+4. Write notification failure details to:
+
+```text
+/data/aios-gitops/runtime/state/V1R4C6-wechat-notification-failure.json
+```
+
+5. Report the failure through the active GitOps task/status channel.
+
+## Final Stop Condition
+
+Before explicit owner authorization, final state must remain:
+
+```text
+current_baseline = V1R4C5
+V1R4C6 tag = absent
+memory search = disabled
+```
+
+After owner authorization, follow the existing tag confirmation and baseline promotion controls. Do not bypass consequential-operation confirmation layers.

patches/deploy_v1r4c6-production-20260711.branch.json

@@ -0,0 +1,9 @@
+{
+  "type": "branch",
+  "branch": "deploy/v1r4c6-production-20260711",
+  "base": "main",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-11T13:10:51Z",
+  "direct_main_push": false,
+  "owner_approval_required": true
+}

patches/gitea-tag-publication-atomicity-20260723.json

@@ -0,0 +1,15 @@
+{
+  "patch_name": "gitea-tag-publication-atomicity",
+  "branch": "patch/gitea-tag-publication-atomicity-20260723",
+  "base": "main",
+  "risk": "high",
+  "description": "Fail-closed, resumable Gitea release-tag publication with exact remote ref, peeled target, API and listing verification before baseline update.",
+  "owner_approval": "received",
+  "constraints": {
+    "force_push": false,
+    "tag_rewrite": false,
+    "direct_main_push": false,
+    "secret_commit": false,
+    "production_runtime_anchor_change": false
+  }
+}

patches/gitops-isolated-worktree-governance-20260714T232948UTC8.json

@@ -0,0 +1,9 @@
+{
+  "id": "patch-1784043007770-e97206c3",
+  "patch_name": "gitops-isolated-worktree-governance-20260714T232948UTC8",
+  "branch": "patch/gitops-isolated-worktree-governance-20260714T232948UTC8",
+  "risk": "high",
+  "description": "Root-cause remediation for recurring ACL and shared-worktree failures: unified aiman:gitops runtime identity, UMask=0002, inherited default ACLs, per-task isolated Git worktrees, startup preflight, migration/rollback scripts, systemd drop-in templates, audit evidence, and an OpenClaw execution task. No production business deployment in this patch.",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-14T15:30:07Z"
+}

patches/nl/nl-1784681185786-19ac0f82.json

@@ -0,0 +1,10 @@
+{
+  "id": "nl-1784681185786-19ac0f82",
+  "text": "Create a safe GitOps plan for tag V2R1C2. The tag target must be commit 3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24. Evidence closure commit is 8cdca463aff9707edee00e20a3b56884130f6978. Do not tag the current workspace HEAD. Do not modify main. Do not force push. Do not promote production. If the target commit cannot be bound explicitly, keep the operation blocked.",
+  "intent": "unknown",
+  "action_plan": [],
+  "execute": false,
+  "owner_approval_required": true,
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-22T00:46:25Z"
+}

patches/patch_gitea-tag-publication-atomicity-20260723.branch.json

@@ -0,0 +1,9 @@
+{
+  "type": "branch",
+  "branch": "patch/gitea-tag-publication-atomicity-20260723",
+  "base": "main",
+  "created_by": "owner-gitea-tag-atomicity-20260723",
+  "created_at": "2026-07-23T04:59:13Z",
+  "direct_main_push": false,
+  "owner_approval_required": true
+}

patches/reconcile_v1r4c5-release-to-main-20260711.branch.json

@@ -0,0 +1,9 @@
+{
+  "type": "branch",
+  "branch": "reconcile/v1r4c5-release-to-main-20260711",
+  "base": "main",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-10T23:56:41Z",
+  "direct_main_push": false,
+  "owner_approval_required": true
+}

patches/task_codex_gitops-isolated-worktree-migration-20260715T001652UTC8.branch.json

@@ -0,0 +1,9 @@
+{
+  "type": "branch",
+  "branch": "task/codex/gitops-isolated-worktree-migration-20260715T001652UTC8",
+  "base": "patch/gitops-isolated-worktree-governance-20260714T232948UTC8",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-14T16:17:28Z",
+  "direct_main_push": false,
+  "owner_approval_required": true
+}

patches/v1r4c6-admin-search-agent-integration-20260711.json

@@ -0,0 +1,9 @@
+{
+  "id": "patch-1783707996243-33717dfe",
+  "patch_name": "v1r4c6-admin-search-agent-integration-20260711",
+  "branch": "release/v1r4c6-admin-search-agent-integration-20260711",
+  "risk": "high",
+  "description": "V1R4C6 bundled integration release: Admin Workbench visibility, SR-03 Search Gateway real provider binding, and Agent Platform Integration. Memory search remains disabled and user data isolation gates remain mandatory.",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-10T18:26:36Z"
+}

reports/gitea-tag-publication-atomicity-delivery.json

@@ -0,0 +1,43 @@
+{
+  "base": "main",
+  "base_oid": "b739fbb5ec8f7096d2f5ade87f65a7c74b0ee870",
+  "commit_count": 10,
+  "commits": [
+    "fc0b9f29bf6dadfbcc8599da6f0ab11a6e19b529",
+    "3812e1ab0123c7da4726e51179a10746b5bbde83",
+    "3196d91b12d0ac5d7ea550b0474703a08736471b",
+    "54093d15437ce0af31acf6feeeffacf6626a59cd",
+    "27a0ae126b96d63c40544174e7a3859e30eba056",
+    "83ab67f7e11eae9da4546cab53169f5a6a47e0ae",
+    "f4b6ac8609faf947d2659b2c32564a26fcb3eb10",
+    "a3edc628a91a4af3d702aacefe0389f844615bc1",
+    "e40c05779c435c3726618de81e02e90953d727f3",
+    "edfad05d57fb3d23d8ab19d27bb6a43a7f2a298f"
+  ],
+  "file_count": 15,
+  "files": [
+    "active-runtime/app/aios_chatgpt_actions_api.py",
+    "active-runtime/app/aios_gitops_write_guard.py",
+    "active-runtime/app/gitea_tag_publication.py",
+    "docs/gitops/gitea-tag-publication-atomicity.md",
+    "docs/gitops/openapi-chatgpt-actions.yaml",
+    "patches/gitea-tag-publication-atomicity-20260723.json",
+    "patches/patch_gitea-tag-publication-atomicity-20260723.branch.json",
+    "scripts/generate_delivery_manifest.py",
+    "scripts/release_version.sh",
+    "scripts/verify_gitea_credential_rotation.py",
+    "security/incidents/GITEA-TOKEN-33-EXPOSURE-20260723.redacted.json",
+    "tests/run_live_gitea_fixture.sh",
+    "tests/test_chatgpt_actions_tag.py",
+    "tests/test_gitea_tag_publication.py",
+    "tests/test_gitea_tag_publication_live.py"
+  ],
+  "generated_from": {
+    "commit_range": "b739fbb5ec8f7096d2f5ade87f65a7c74b0ee870..edfad05d57fb3d23d8ab19d27bb6a43a7f2a298f",
+    "commits_command": "git log --reverse --format=%H b739fbb5ec8f7096d2f5ade87f65a7c74b0ee870..edfad05d57fb3d23d8ab19d27bb6a43a7f2a298f",
+    "files_command": "git diff --name-only b739fbb5ec8f7096d2f5ade87f65a7c74b0ee870..edfad05d57fb3d23d8ab19d27bb6a43a7f2a298f"
+  },
+  "manifest_path": "reports/gitea-tag-publication-atomicity-delivery.json",
+  "source_branch": "patch/gitea-tag-publication-atomicity-20260723",
+  "source_commit": "edfad05d57fb3d23d8ab19d27bb6a43a7f2a298f"
+}

scripts/generate_delivery_manifest.py

@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+"""Generate the delivery file list from Git instead of hand-maintained counts."""
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+from pathlib import Path
+
+
+def git(root: Path, *args: str) -> list[str]:
+    output = subprocess.check_output(
+        ["git", *args], cwd=root, text=True, encoding="utf-8"
+    )
+    return [line for line in output.splitlines() if line]
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--base", default="main")
+    parser.add_argument(
+        "--output",
+        default="reports/gitea-tag-publication-atomicity-delivery.json",
+    )
+    args = parser.parse_args()
+    root = Path(
+        subprocess.check_output(
+            ["git", "rev-parse", "--show-toplevel"], text=True, encoding="utf-8"
+        ).strip()
+    )
+    output = Path(args.output)
+    if output.is_absolute() or ".." in output.parts:
+        raise SystemExit("output must remain inside the repository")
+    output_path = root / output
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    base_oid = git(root, "rev-parse", "--verify", f"{args.base}^{{commit}}")[0]
+    source_commit = git(root, "rev-parse", "--verify", "HEAD^{commit}")[0]
+    source_branch = git(root, "symbolic-ref", "--short", "HEAD")[0]
+    commit_range = f"{base_oid}..{source_commit}"
+    commits = git(root, "log", "--reverse", "--format=%H", commit_range)
+    files = [
+        path
+        for path in git(root, "diff", "--name-only", commit_range)
+        if path != output.as_posix()
+    ]
+    payload = {
+        "base": args.base,
+        "base_oid": base_oid,
+        "source_branch": source_branch,
+        "source_commit": source_commit,
+        "commit_count": len(commits),
+        "commits": commits,
+        "file_count": len(files),
+        "files": files,
+        "manifest_path": output.as_posix(),
+        "generated_from": {
+            "commit_range": commit_range,
+            "files_command": f"git diff --name-only {commit_range}",
+            "commits_command": f"git log --reverse --format=%H {commit_range}",
+        },
+    }
+    output_path.write_text(
+        json.dumps(payload, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

scripts/gitops/bootstrap_isolated_worktrees.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="${AIOS_GITOPS_ROOT:-/data/aios-gitops}"
+SOURCE="${AIOS_SOURCE_WORKTREE:-$ROOT/workspace}"
+BARE="${AIOS_BARE_REPO:-$ROOT/repo.git}"
+WORKTREES="${AIOS_WORKTREE_ROOT:-$ROOT/worktrees}"
+RUNTIME_USER="${AIOS_RUNTIME_USER:-aiman}"
+RUNTIME_GROUP="${AIOS_RUNTIME_GROUP:-gitops}"
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "ERROR: bootstrap must run as root" >&2
+  exit 2
+fi
+
+getent passwd "$RUNTIME_USER" >/dev/null
+getent group "$RUNTIME_GROUP" >/dev/null
+[[ -d "$SOURCE/.git" || -f "$SOURCE/.git" ]] || {
+  echo "ERROR: source worktree not found: $SOURCE" >&2
+  exit 3
+}
+
+install -d -o "$RUNTIME_USER" -g "$RUNTIME_GROUP" -m 2775 "$ROOT" "$WORKTREES"
+install -d -o "$RUNTIME_USER" -g "$RUNTIME_GROUP" -m 2775 \
+  "$WORKTREES/openclaw" "$WORKTREES/chatgpt" "$WORKTREES/controller"
+
+if [[ ! -d "$BARE" ]]; then
+  sudo -u "$RUNTIME_USER" -g "$RUNTIME_GROUP" git clone --bare "$SOURCE" "$BARE"
+fi
+
+chown -R "$RUNTIME_USER:$RUNTIME_GROUP" "$BARE" "$WORKTREES"
+find "$BARE" "$WORKTREES" -type d -exec chmod 2775 {} +
+find "$BARE" "$WORKTREES" -type f -exec chmod ug+rw {} +
+
+setfacl -R -m "u:${RUNTIME_USER}:rwX,g:${RUNTIME_GROUP}:rwX,m::rwX" "$BARE" "$WORKTREES"
+find "$BARE" "$WORKTREES" -type d -exec \
+  setfacl -m "d:u:${RUNTIME_USER}:rwx,d:g:${RUNTIME_GROUP}:rwx,d:m::rwx" {} +
+
+cat <<EOF
+bootstrap_status: PASS
+root: $ROOT
+source_worktree: $SOURCE
+bare_repo: $BARE
+worktree_root: $WORKTREES
+runtime_user: $RUNTIME_USER
+runtime_group: $RUNTIME_GROUP
+EOF

scripts/gitops/preflight_task_environment.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+EXPECTED_USER="${AIOS_RUNTIME_USER:-aiman}"
+EXPECTED_GROUP="${AIOS_RUNTIME_GROUP:-gitops}"
+EXPECTED_UMASK="${AIOS_RUNTIME_UMASK:-0002}"
+TASK_DIR="${AIOS_TASK_DIR:-.agent/tasks}"
+RESULT_DIR="${AIOS_RESULT_DIR:-.agent/results}"
+
+fail() {
+  echo "preflight_status: FAIL"
+  echo "reason: $1"
+  exit 1
+}
+
+USER_NOW="$(id -un)"
+GROUPS_NOW="$(id -Gn)"
+UMASK_NOW="$(umask)"
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+GIT_DIR="$(git rev-parse --git-dir 2>/dev/null || true)"
+BRANCH="$(git branch --show-current 2>/dev/null || true)"
+
+[[ "$USER_NOW" == "$EXPECTED_USER" ]] || fail "runtime user is $USER_NOW, expected $EXPECTED_USER"
+[[ " $GROUPS_NOW " == *" $EXPECTED_GROUP "* ]] || fail "runtime user is not in $EXPECTED_GROUP"
+[[ "$UMASK_NOW" == "$EXPECTED_UMASK" || "$UMASK_NOW" == "002" ]] || fail "umask is $UMASK_NOW, expected $EXPECTED_UMASK"
+[[ -n "$ROOT" ]] || fail "not inside a git worktree"
+[[ "$ROOT" == /data/aios-gitops/worktrees/* ]] || fail "shared source worktree is prohibited: $ROOT"
+[[ -w "$ROOT" ]] || fail "worktree root is not writable"
+[[ -w "$GIT_DIR" ]] || fail "git dir is not writable: $GIT_DIR"
+[[ ! -e "$GIT_DIR/index.lock" ]] || fail "git index lock exists"
+install -d -m 2775 "$TASK_DIR" "$RESULT_DIR"
+[[ -w "$TASK_DIR" ]] || fail "task directory is not writable: $TASK_DIR"
+[[ -w "$RESULT_DIR" ]] || fail "result directory is not writable: $RESULT_DIR"
+[[ -z "$(git status --porcelain)" ]] || fail "worktree is not clean at task start"
+
+cat <<EOF
+preflight_status: PASS
+runtime_user: $USER_NOW
+runtime_groups: $GROUPS_NOW
+umask: $UMASK_NOW
+worktree: $ROOT
+git_dir: $GIT_DIR
+branch: $BRANCH
+workspace_clean: true
+task_path_writable: true
+result_path_writable: true
+git_lock_present: false
+EOF

scripts/gitops/task_worktree.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ACTION="${1:-}"
+AGENT="${2:-}"
+TASK_ID="${3:-}"
+BASE_REF="${4:-origin/main}"
+
+ROOT="${AIOS_GITOPS_ROOT:-/data/aios-gitops}"
+BARE="${AIOS_BARE_REPO:-$ROOT/repo.git}"
+WORKTREES="${AIOS_WORKTREE_ROOT:-$ROOT/worktrees}"
+RUNTIME_USER="${AIOS_RUNTIME_USER:-aiman}"
+RUNTIME_GROUP="${AIOS_RUNTIME_GROUP:-gitops}"
+
+usage() {
+  echo "usage: $0 create|remove <openclaw|chatgpt|controller> <task-id> [base-ref]" >&2
+  exit 64
+}
+
+[[ "$ACTION" =~ ^(create|remove)$ ]] || usage
+[[ "$AGENT" =~ ^(openclaw|chatgpt|controller)$ ]] || usage
+[[ "$TASK_ID" =~ ^[A-Za-z0-9._-]+$ ]] || {
+  echo "ERROR: invalid task id" >&2
+  exit 65
+}
+[[ "$(id -un)" == "$RUNTIME_USER" ]] || {
+  echo "ERROR: must run as $RUNTIME_USER" >&2
+  exit 66
+}
+[[ "$(id -gn)" == "$RUNTIME_GROUP" || " $(id -Gn) " == *" $RUNTIME_GROUP "* ]] || {
+  echo "ERROR: user must be in $RUNTIME_GROUP" >&2
+  exit 67
+}
+[[ "$(umask)" == "0002" || "$(umask)" == "002" ]] || {
+  echo "ERROR: umask must be 0002" >&2
+  exit 68
+}
+[[ -d "$BARE" ]] || {
+  echo "ERROR: bare repository missing: $BARE" >&2
+  exit 69
+}
+
+PATHNAME="$WORKTREES/$AGENT/$TASK_ID"
+BRANCH="task/$AGENT/$TASK_ID"
+
+case "$ACTION" in
+  create)
+    [[ ! -e "$PATHNAME" ]] || {
+      echo "ERROR: worktree already exists: $PATHNAME" >&2
+      exit 70
+    }
+    git --git-dir="$BARE" fetch --all --prune
+    git --git-dir="$BARE" worktree add -b "$BRANCH" "$PATHNAME" "$BASE_REF"
+    install -d -m 2775 "$PATHNAME/.agent/tasks/$AGENT" "$PATHNAME/.agent/results/$AGENT"
+    setfacl -m "u:${RUNTIME_USER}:rwx,g:${RUNTIME_GROUP}:rwx,m::rwx" "$PATHNAME"
+    find "$PATHNAME" -type d -exec chmod g+s {} +
+    find "$PATHNAME" -type d -exec \
+      setfacl -m "d:u:${RUNTIME_USER}:rwx,d:g:${RUNTIME_GROUP}:rwx,d:m::rwx" {} +
+    printf 'worktree: %s\nbranch: %s\nbase: %s\n' "$PATHNAME" "$BRANCH" "$BASE_REF"
+    ;;
+  remove)
+    [[ -d "$PATHNAME" ]] || {
+      echo "ERROR: worktree not found: $PATHNAME" >&2
+      exit 71
+    }
+    [[ -z "$(git -C "$PATHNAME" status --porcelain)" ]] || {
+      echo "ERROR: worktree is not clean; retain for investigation" >&2
+      exit 72
+    }
+    git --git-dir="$BARE" worktree remove "$PATHNAME"
+    printf 'removed: %s\n' "$PATHNAME"
+    ;;
+esac

scripts/release_version.sh

@@ -1,23 +1,53 @@
 #!/usr/bin/env bash
-set -euo pipefail
-VERSION="${1:?version required, e.g. V1R1C0}"
-MESSAGE="${2:-release $VERSION}"
-if ! echo "$VERSION" | grep -Eq '^V[0-9]+R[0-9]+C[0-9]+$'; then echo "ERROR: version must match VxRxCx"; exit 1; fi
-cd "${AIOS_GITOPS_WORKSPACE:-/data/aios-gitops/workspace}"
-git checkout main
-git pull origin main || true
-git tag -a "$VERSION" -m "$MESSAGE" || true
-git push origin "$VERSION" || true
-python3 - <<PY
-import json, datetime
-from pathlib import Path
-p=Path('baseline/current.json')
-if p.exists(): d=json.loads(p.read_text())
-else: p.parent.mkdir(exist_ok=True); d={}
-d['active_version']='$VERSION'; d['active_tag']='$VERSION'; d['updated_at']=datetime.datetime.now(datetime.UTC).isoformat(); d['update_mode']='git_patch_only'
-p.write_text(json.dumps(d, ensure_ascii=False, indent=2))
-PY
-git add baseline/current.json || true
-git commit -m "release($VERSION): update active baseline" || true
-git push origin main || true
-echo "RELEASE_DONE $VERSION"
+set -Eeuo pipefail
+
+VERSION="${1:?version required, e.g. V2R1C4}"
+TARGET_OID="${2:?target_oid required}"
+EVIDENCE_CLOSURE_OID="${3:?evidence_closure_oid required}"
+APPROVAL_PLAN_ID="${4:?approval_plan_id required}"
+WORKSPACE="${AIOS_GITOPS_WORKSPACE:-/data/aios-gitops/workspace}"
+TAG_REMOTE="${AIOS_GITOPS_GITEA_REMOTE:-gitea}"
+BRANCH_REMOTE="${AIOS_GITOPS_BRANCH_REMOTE:-gitea}"
+
+case "$VERSION" in
+  V[0-9]*R[0-9]*C[0-9]*) ;;
+  *) echo "ERROR: version must match VxRxCx" >&2; exit 64 ;;
+esac
+
+for value in "$TARGET_OID" "$EVIDENCE_CLOSURE_OID"; do
+  [[ "$value" =~ ^[0-9a-f]{40}$ ]] || {
+    echo "ERROR: target and evidence OIDs must be full lowercase 40-character OIDs" >&2
+    exit 64
+  }
+done
+
+[[ -n "$APPROVAL_PLAN_ID" ]] || {
+  echo "ERROR: approval_plan_id is required" >&2
+  exit 64
+}
+
+cd "$WORKSPACE"
+BRANCH="$(git symbolic-ref --quiet --short HEAD)" || {
+  echo "ERROR: release must run on an isolated branch, not detached HEAD" >&2
+  exit 65
+}
+case "$BRANCH" in
+  main|master) echo "ERROR: direct main/master release writes are forbidden" >&2; exit 65 ;;
+esac
+
+python3 "$WORKSPACE/active-runtime/app/gitea_tag_publication.py" publish \
+  --workspace "$WORKSPACE" \
+  --remote "$TAG_REMOTE" \
+  --version "$VERSION" \
+  --target-oid "$TARGET_OID" \
+  --evidence-closure-oid "$EVIDENCE_CLOSURE_OID" \
+  --approval-plan-id "$APPROVAL_PLAN_ID"
+
+git add -- "baseline/current.json" "versions/$VERSION.json"
+if ! git diff --cached --quiet; then
+  git commit -m "release($VERSION): record Gitea-confirmed baseline"
+fi
+
+# No force, no main push, and no ignored failure.
+git push "$BRANCH_REMOTE" "HEAD:refs/heads/$BRANCH"
+echo "RELEASE_BASELINE_UPDATED $VERSION branch=$BRANCH"

scripts/verify_gitea_credential_rotation.py

@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+"""Verify a Gitea credential rotation without printing either credential."""
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+import urllib.error
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+
+def token_at(path: Path, line: int) -> str:
+    lines = path.read_text(encoding="utf-8").splitlines()
+    if line < 1 or line > len(lines) or not lines[line - 1].strip():
+        raise RuntimeError("credential reference has no configured token line")
+    return lines[line - 1].strip()
+
+
+def get(api: str, path: str, token: str) -> tuple[int, object | None]:
+    request = urllib.request.Request(
+        api.rstrip("/") + path,
+        headers={
+            "Accept": "application/json",
+            "Authorization": f"token {token}",
+            "User-Agent": "aios-gitops-credential-rotation-verifier/1",
+        },
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=15) as response:
+            return response.status, json.loads(response.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        return exc.code, None
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--old-token-file", type=Path, required=True)
+    parser.add_argument("--new-credential-file", type=Path, required=True)
+    parser.add_argument("--new-token-line", type=int, default=2)
+    parser.add_argument("--api", default="http://127.0.0.1:3000/api/v1")
+    parser.add_argument("--repository", default="aios/aios")
+    parser.add_argument("--version", default="V2R1C2")
+    parser.add_argument("--workspace", type=Path, required=True)
+    parser.add_argument("--remote", default="http://127.0.0.1:3000/aios/aios.git")
+    parser.add_argument(
+        "--branch",
+        default="patch/gitea-tag-publication-atomicity-20260723",
+    )
+    args = parser.parse_args()
+    old_token = token_at(args.old_token_file, 1)
+    new_token = token_at(args.new_credential_file, args.new_token_line)
+    repo_path = f"/repos/{args.repository}"
+    old_status, _ = get(args.api, repo_path, old_token)
+    new_status, _ = get(args.api, repo_path, new_token)
+    encoded = urllib.parse.quote(args.version, safe="")
+    ref_status, ref = get(
+        args.api,
+        f"{repo_path}/git/refs/tags/{encoded}",
+        new_token,
+    )
+    listing_status, listing = get(
+        args.api,
+        f"{repo_path}/tags?limit=50&page=1",
+        new_token,
+    )
+    refs = ref if isinstance(ref, list) else [ref]
+    exact = [
+        item
+        for item in refs
+        if isinstance(item, dict)
+        and item.get("ref") in {
+            f"refs/tags/{args.version}",
+            f"tags/{args.version}",
+        }
+    ]
+    tag_oid = (
+        str(((exact[0].get("object") or {}).get("sha")) or "").lower()
+        if len(exact) == 1
+        else None
+    )
+    tag_status, tag = (
+        get(args.api, f"{repo_path}/git/tags/{tag_oid}", new_token)
+        if tag_oid
+        else (0, None)
+    )
+    peeled_target = (
+        str(((tag.get("object") or {}).get("sha")) or "").lower()
+        if isinstance(tag, dict)
+        else None
+    )
+    listing_target = None
+    if isinstance(listing, list):
+        for item in listing:
+            if item.get("name") == args.version:
+                listing_target = str(
+                    ((item.get("commit") or {}).get("sha")) or ""
+                ).lower()
+                break
+    remote = subprocess.run(
+        [
+            "git",
+            "-c",
+            f"safe.directory={args.workspace}",
+            "-c",
+            "credential.helper=!/usr/local/libexec/aios-gitea-credential",
+            "-c",
+            "credential.useHttpPath=true",
+            "-C",
+            str(args.workspace),
+            "ls-remote",
+            args.remote,
+            f"refs/heads/{args.branch}",
+        ],
+        text=True,
+        capture_output=True,
+    )
+    remote_oid = (
+        remote.stdout.split()[0].lower()
+        if remote.returncode == 0 and remote.stdout.split()
+        else None
+    )
+    result = {
+        "old_token_repository_http": old_status,
+        "new_token_repository_http": new_status,
+        "git_ls_remote_oid": remote_oid,
+        "gitea_ref_http": ref_status,
+        "gitea_tag_oid": tag_oid,
+        "gitea_tag_object_http": tag_status,
+        "gitea_peeled_target_oid": peeled_target,
+        "gitea_listing_http": listing_status,
+        "gitea_listing_target_oid": listing_target,
+        "credentials_printed": False,
+    }
+    print(json.dumps(result, indent=2, sort_keys=True))
+    passed = (
+        old_status in {401, 403}
+        and new_status == 200
+        and remote_oid is not None
+        and ref_status == 200
+        and tag_oid is not None
+        and tag_status == 200
+        and peeled_target is not None
+        and listing_status == 200
+        and listing_target is not None
+    )
+    return 0 if passed else 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

security/incidents/GITEA-TOKEN-33-EXPOSURE-20260723.redacted.json

@@ -0,0 +1,38 @@
+{
+  "exposure_window": {
+    "detected_at": "2026-07-23T13:40:23+08:00",
+    "revoked_at": "2026-07-23T13:40:56+08:00",
+    "start": "2026-07-23T12:00:00+08:00",
+    "start_accuracy": "bounded approximation; precise platform tool-log timestamp unavailable"
+  },
+  "gitea_tag_read_validation": {
+    "listing_target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+    "peeled_target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+    "tag_mutation_performed": false,
+    "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
+    "version": "V2R1C2"
+  },
+  "impact_scope": "Gitea repository write access for gitops-bot; no evidence of unauthorized use observed during rotation checks",
+  "incident_id": "GITEA-TOKEN-33-EXPOSURE-20260723",
+  "log_handling": {
+    "credential_values_in_record": false,
+    "reason": "formal audit/tool logs must not be deleted",
+    "server_redacted_record_mode": "0640 root:gitops",
+    "source_tool_log_deleted": false
+  },
+  "new_credential_reference": "/etc/aios-gitops/credentials/gitea-git-http",
+  "new_token_validation": {
+    "after_revoke_repository_http": 200,
+    "before_revoke_repository_http": 200,
+    "git_ls_remote_oid": "54093d15437ce0af31acf6feeeffacf6626a59cd",
+    "idempotent_branch_push": true
+  },
+  "old_token_validation": {
+    "after_revoke_repository_http": 401,
+    "before_revoke_repository_http": 200
+  },
+  "production_tag_operation": "NOT_EXECUTED",
+  "replacement_token_record_id": 50,
+  "scope": "write:repository",
+  "token_id": 33
+}

tests/run_live_gitea_fixture.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+umask 077
+GITEA="${AIOS_GITEA_BINARY:-/data/aios-gitops/runtime/bin/gitea}"
+CONFIG="${AIOS_GITEA_CONFIG:-/data/aios-gitops/runtime/gitea-bin/custom/conf/app.ini}"
+WORKSPACE="${AIOS_GITOPS_WORKSPACE:-$(cd "$(dirname "$0")/.." && pwd)}"
+USER_NAME="tagatomicitytest$(date +%s)"
+TMP_DIR="$(mktemp -d /tmp/aios-gitea-live-test.XXXXXX)"
+
+cleanup() {
+  "$GITEA" --config "$CONFIG" admin user delete \
+    --username "$USER_NAME" --purge >/dev/null 2>&1 || true
+  rm -f "$TMP_DIR/token" "$TMP_DIR/create-output"
+  rmdir "$TMP_DIR" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+"$GITEA" --config "$CONFIG" admin user create \
+  --username "$USER_NAME" \
+  --email "$USER_NAME@example.invalid" \
+  --random-password \
+  --must-change-password=false >"$TMP_DIR/create-output" 2>&1
+"$GITEA" --config "$CONFIG" admin user generate-access-token \
+  --username "$USER_NAME" \
+  --token-name live-temporary-repository-test \
+  --raw \
+  --scopes write:repository,write:user >"$TMP_DIR/token"
+chmod 600 "$TMP_DIR/token"
+
+cd "$WORKSPACE"
+AIOS_GITOPS_LIVE_GITEA_TEST=1 \
+AIOS_GITOPS_LIVE_GITEA_OWNER="$USER_NAME" \
+AIOS_GITOPS_LIVE_GITEA_TOKEN_FILE="$TMP_DIR/token" \
+AIOS_GITOPS_LIVE_GITEA_TOKEN_LINE=1 \
+python3 -m pytest -q tests/test_gitea_tag_publication_live.py

tests/test_authoritative_git_context.py

@@ -0,0 +1,324 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+import os
+import subprocess
+import tempfile
+import unittest
+from types import SimpleNamespace
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+ROOT = Path(__file__).resolve().parents[1]
+import sys
+sys.path.insert(0, str(ROOT / "runtime" / "agent-os"))
+sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
+from gitea_tag_publication import build_publisher
+import authoritative_git as authoritative_git_module
+from authoritative_git import (
+    AuthoritativeGitError,
+    AuthoritativeGitNotFound,
+    AuthoritativeGitOutputTooLarge,
+    authoritative_branches,
+    authoritative_diff,
+    authoritative_commit,
+    authoritative_head_oid,
+    authoritative_tags,
+    repository_snapshot,
+    run_authoritative_git,
+    validate_git_revision,
+    verify_repository,
+)
+
+API_SPEC = importlib.util.spec_from_file_location(
+    "authoritative_test_api",
+    ROOT / "active-runtime" / "app" / "aios_chatgpt_actions_api.py",
+)
+assert API_SPEC and API_SPEC.loader
+api = importlib.util.module_from_spec(API_SPEC)
+API_SPEC.loader.exec_module(api)
+
+
+class AuthoritativeGitContextTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self.tmp.name)
+        self.bare = self.root / "repo.git"
+        self.seed = self.root / "seed"
+        self.runtime = self.root / "runtime"
+        subprocess.run(["git", "init", "--bare", str(self.bare)], check=True, capture_output=True)
+        subprocess.run(["git", "init", "-b", "main", str(self.seed)], check=True, capture_output=True)
+        for key, value in (("user.name", "test"), ("user.email", "test@example.invalid")):
+            subprocess.run(["git", "-C", str(self.seed), "config", key, value], check=True)
+        (self.seed / "README").write_text("context\n", encoding="utf-8")
+        subprocess.run(["git", "-C", str(self.seed), "add", "README"], check=True)
+        subprocess.run(["git", "-C", str(self.seed), "commit", "-m", "seed"], check=True, capture_output=True)
+        subprocess.run(["git", "-C", str(self.seed), "remote", "add", "origin", str(self.bare)], check=True)
+        subprocess.run(["git", "-C", str(self.seed), "push", "origin", "main"], check=True, capture_output=True)
+        subprocess.run(["git", "--git-dir", str(self.bare), "config", "remote.gitea.url", "https://g.cnnetmkt.top/git/aios/aios.git"], check=True)
+        subprocess.run(["git", "-C", str(self.seed), "tag", "-a", "V1R1C0", "-m", "annotated"], check=True)
+        subprocess.run(["git", "-C", str(self.seed), "tag", "V1R1C1"], check=True)
+        subprocess.run(["git", "-C", str(self.seed), "checkout", "-b", "patch/context"], check=True, capture_output=True)
+        (self.seed / "CHANGE").write_text("authoritative diff\n", encoding="utf-8")
+        subprocess.run(["git", "-C", str(self.seed), "add", "CHANGE"], check=True)
+        subprocess.run(["git", "-C", str(self.seed), "commit", "-m", "change"], check=True, capture_output=True)
+        subprocess.run(["git", "-C", str(self.seed), "push", "origin", "patch/context", "--tags"], check=True, capture_output=True)
+        (self.runtime / "versions").mkdir(parents=True)
+        (self.runtime / "patches").mkdir()
+        (self.runtime / "versions" / "V1R1C0.json").write_text(
+            json.dumps({"version": "V1R1C0"}), encoding="utf-8"
+        )
+        (self.runtime / "patches" / "context.json").write_text(
+            json.dumps({"branch": "patch/context"}), encoding="utf-8"
+        )
+        self.env = {
+            "AIOS_GITOPS_AUTHORITATIVE_GIT_DIR": str(self.bare),
+            "AIOS_GITOPS_REPOSITORY_IDENTITY": "aios/aios",
+        }
+
+    def tearDown(self):
+        self.tmp.cleanup()
+
+    def test_runtime_cwd_without_git_uses_authoritative_head(self):
+        with patch.dict(os.environ, self.env, clear=False), patch("os.getcwd", return_value=str(self.runtime)):
+            self.assertFalse((self.runtime / ".git").exists())
+            self.assertEqual(len(authoritative_head_oid()), 40)
+
+    def test_annotated_and_lightweight_tags_include_type_and_peeled_target(self):
+        with patch.dict(os.environ, self.env, clear=False):
+            tags = {item["name"]: item for item in authoritative_tags()}
+        self.assertEqual(tags["V1R1C0"]["object_type"], "tag")
+        self.assertEqual(tags["V1R1C0"]["peeled_target_oid"], tags["V1R1C1"]["peeled_target_oid"])
+        self.assertEqual(tags["V1R1C1"]["object_type"], "commit")
+
+    def test_authoritative_branches_include_exact_oids(self):
+        with patch.dict(os.environ, self.env, clear=False):
+            branches = {item["name"]: item["oid"] for item in authoritative_branches()}
+        self.assertIn("main", branches)
+        self.assertIn("patch/context", branches)
+        self.assertEqual(len(branches["main"]), 40)
+
+    def test_runtime_cwd_changes_do_not_change_results(self):
+        old_cwd = os.getcwd()
+        try:
+            with patch.dict(os.environ, self.env, clear=False):
+                first = authoritative_head_oid()
+                os.chdir(str(self.runtime))
+                second = authoritative_head_oid()
+            self.assertEqual(first, second)
+        finally:
+            os.chdir(old_cwd)
+
+    def test_missing_configuration_fails_closed(self):
+        with patch.dict(os.environ, {}, clear=True), self.assertRaises(AuthoritativeGitError):
+            verify_repository()
+
+    def test_missing_repository_fails_closed(self):
+        with patch.dict(os.environ, {**self.env, "AIOS_GITOPS_AUTHORITATIVE_GIT_DIR": str(self.root / "missing")}, clear=False):
+            with self.assertRaises(AuthoritativeGitError):
+                verify_repository()
+
+    def test_non_bare_repository_fails_closed(self):
+        with patch.dict(os.environ, self.env, clear=False), self.assertRaises(AuthoritativeGitError):
+            verify_repository(self.seed)
+
+    def test_repository_identity_mismatch_fails_closed(self):
+        with patch.dict(os.environ, {**self.env, "AIOS_GITOPS_REPOSITORY_IDENTITY": "other/repo"}, clear=False):
+            with self.assertRaises(AuthoritativeGitError):
+                verify_repository()
+
+    def test_git_command_failure_is_not_an_empty_success(self):
+        with patch.dict(os.environ, self.env, clear=False):
+            with self.assertRaises(AuthoritativeGitError) as ctx:
+                run_authoritative_git(["rev-parse", "--verify", "refs/heads/no-such-branch"])
+        self.assertIn("GIT_REF_QUERY_FAILED", str(ctx.exception))
+        self.assertNotIn("tags=[]", str(ctx.exception))
+
+    def test_commit_input_rejects_git_parameter_injection(self):
+        with patch.dict(os.environ, self.env, clear=False):
+            with self.assertRaises(ValueError):
+                authoritative_commit("1" * 39 + ";")
+
+    def test_repository_snapshot_exposes_authoritative_head(self):
+        with patch.dict(os.environ, self.env, clear=False):
+            snapshot = repository_snapshot()
+        self.assertTrue(snapshot["repository_available"])
+        self.assertEqual(snapshot["repository_identity"], "aios/aios")
+        self.assertEqual(len(snapshot["authoritative_head_oid"]), 40)
+
+    def _get(self, path):
+        handler = object.__new__(api.H)
+        handler.path = path
+        handler.sendj = Mock(side_effect=lambda data, code=200: (data, code))
+        handler.sendt = Mock(side_effect=lambda data, ctype="text/plain; charset=utf-8", code=200: (data, code))
+        with (
+            patch.dict(os.environ, self.env, clear=False),
+            patch.object(api, "WS", self.runtime),
+            patch.object(api, "AUTHORITATIVE_GIT_DIR", self.bare),
+            patch.object(api, "REPOSITORY_IDENTITY", "aios/aios"),
+        ):
+            api.H.do_GET(handler)
+        args = handler.sendj.call_args.args
+        return args[0], args[1] if len(args) > 1 else 200
+
+    def test_api_list_versions_uses_authoritative_tags(self):
+        body, code = self._get("/api/ver")
+        self.assertEqual(code, 200)
+        self.assertTrue(body["repository_available"])
+        self.assertTrue(body["local_authoritative_tags"])
+        self.assertEqual(body["head"], body["authoritative_head_oid"])
+        self.assertIn("V1R1C0", body["tags"])
+
+    def test_api_list_patches_uses_authoritative_branches(self):
+        body, code = self._get("/api/patch")
+        self.assertEqual(code, 200)
+        self.assertIn("patch/context", body["branches"])
+        self.assertTrue(body["authoritative_branches"])
+
+    def test_api_unavailable_does_not_return_empty_lists(self):
+        handler = object.__new__(api.H)
+        handler.path = "/api/ver"
+        handler.sendj = Mock(side_effect=lambda data, code=200: (data, code))
+        with patch.dict(os.environ, {}, clear=True), patch.object(api, "WS", self.runtime), patch.object(api, "AUTHORITATIVE_GIT_DIR", None), patch.object(api, "REPOSITORY_IDENTITY", ""):
+            api.H.do_GET(handler)
+        body, code = handler.sendj.call_args.args
+        self.assertEqual(code, 503)
+        self.assertFalse(body["repository_available"])
+        self.assertIn("query_error", body)
+
+    def test_api_runtime_status_contains_release_and_repository_fields(self):
+        handler = object.__new__(api.H)
+        handler.path = "/api/run"
+        handler.sendj = Mock(side_effect=lambda data, code=200: (data, code))
+        real_run = subprocess.run
+        def service_or_real(*args, **kwargs):
+            command = args[0] if args else kwargs.get("args", [])
+            if command and command[0] == "systemctl":
+                return subprocess.CompletedProcess(command, 0, stdout="active\n", stderr="")
+            return real_run(*args, **kwargs)
+        with (
+            patch.dict(os.environ, self.env, clear=False),
+            patch.object(api, "WS", self.runtime),
+            patch.object(api, "AUTHORITATIVE_GIT_DIR", self.bare),
+            patch.object(api, "REPOSITORY_IDENTITY", "aios/aios"),
+            patch.object(api.subprocess, "run", side_effect=service_or_real),
+        ):
+            api.H.do_GET(handler)
+        body, code = handler.sendj.call_args.args
+        self.assertEqual(code, 200)
+        self.assertIsNone(body["workspace_branch"])
+        self.assertTrue(body["authoritative_git_dir_configured"])
+        self.assertEqual(body["authoritative_head_oid"], body["authoritative_head_oid"])
+
+    def test_authoritative_head_is_independent_of_runtime_directory(self):
+        with patch.dict(os.environ, self.env, clear=False):
+            old = os.getcwd()
+            try:
+                os.chdir(str(self.runtime))
+                self.assertEqual(authoritative_head_oid(), authoritative_head_oid())
+            finally:
+                os.chdir(old)
+
+    def test_authoritative_api_is_read_only(self):
+        before = subprocess.run(["git", "--git-dir", str(self.bare), "show-ref"], check=True, capture_output=True, text=True).stdout
+        with patch.dict(os.environ, self.env, clear=False):
+            authoritative_tags()
+            authoritative_branches()
+        after = subprocess.run(["git", "--git-dir", str(self.bare), "show-ref"], check=True, capture_output=True, text=True).stdout
+        self.assertEqual(before, after)
+
+    def test_error_text_does_not_include_credential_values(self):
+        with patch.dict(os.environ, self.env, clear=False):
+            with self.assertRaises(AuthoritativeGitError) as ctx:
+                run_authoritative_git(["rev-parse", "--verify", "https://user:password@example.invalid/x"])
+        self.assertNotIn("password", str(ctx.exception).lower())
+
+    def test_cli_publisher_requires_and_uses_authoritative_repository(self):
+        args = SimpleNamespace(
+            workspace=str(self.runtime),
+            remote="gitea",
+            gitea_api="http://127.0.0.1:3000/api/v1",
+            gitea_repo="aios/aios",
+            gitea_token_file="/dev/null",
+        )
+        with patch.dict(os.environ, self.env, clear=False):
+            publisher = build_publisher(args)
+        self.assertEqual(publisher.git.authoritative_repo, self.bare)
+
+    def test_cli_publisher_fails_closed_without_authoritative_repository(self):
+        args = SimpleNamespace(
+            workspace=str(self.runtime),
+            remote="gitea",
+            gitea_api="http://127.0.0.1:3000/api/v1",
+            gitea_repo="aios/aios",
+            gitea_token_file="/dev/null",
+        )
+        with patch.dict(os.environ, {}, clear=True), self.assertRaises(RuntimeError):
+            build_publisher(args)
+
+    def test_authoritative_diff_supports_branch_tag_and_exact_oid(self):
+        with patch.dict(os.environ, self.env, clear=True):
+            by_ref = authoritative_diff("V1R1C0", "patch/context")
+            main_oid = validate_git_revision("refs/heads/main", "from")
+            patch_oid = validate_git_revision("refs/heads/patch/context", "to")
+            by_oid = authoritative_diff(main_oid, patch_oid)
+        self.assertIn("CHANGE", by_ref["stdout"])
+        self.assertEqual(by_ref["stdout"], by_oid["stdout"])
+        self.assertEqual(by_ref["code"], 0)
+
+    def test_authoritative_diff_is_cwd_independent(self):
+        old = os.getcwd()
+        try:
+            with patch.dict(os.environ, self.env, clear=True):
+                first = authoritative_diff("V1R1C0", "patch/context")["stdout"]
+                os.chdir(self.runtime)
+                second = authoritative_diff("V1R1C0", "patch/context")["stdout"]
+            self.assertEqual(first, second)
+        finally:
+            os.chdir(old)
+
+    def test_revision_injection_and_revision_expressions_are_rejected(self):
+        with patch.dict(os.environ, self.env, clear=True):
+            for value in ("--help", "--output=x", "HEAD~1", "main^{tree}", "@{1}", ":/secret", "", " main"):
+                with self.subTest(value=value), self.assertRaises(ValueError):
+                    validate_git_revision(value, "from")
+
+    def test_valid_but_missing_revision_is_not_found(self):
+        with patch.dict(os.environ, self.env, clear=True), self.assertRaises(AuthoritativeGitNotFound):
+            validate_git_revision("missing-branch", "from")
+
+    def test_diff_output_limit_is_fail_closed(self):
+        with patch.dict(os.environ, self.env, clear=True), patch.object(authoritative_git_module, "_MAX_OUTPUT", 1):
+            with self.assertRaises(AuthoritativeGitOutputTooLarge):
+                authoritative_diff("V1R1C0", "patch/context")
+
+    def test_api_diff_uses_authoritative_repository(self):
+        body, code = self._get("/api/diff?from=V1R1C0&to=patch/context")
+        self.assertEqual(code, 200)
+        self.assertIn("CHANGE", body["diff"]["stdout"])
+        self.assertEqual(len(body["diff"]["from_oid"]), 40)
+
+    def test_api_diff_status_mapping(self):
+        _, code = self._get("/api/diff?from=--help&to=patch/context")
+        self.assertEqual(code, 400)
+        _, code = self._get("/api/diff?from=missing-branch&to=patch/context")
+        self.assertEqual(code, 404)
+        with patch.object(api, "authoritative_diff", side_effect=AuthoritativeGitOutputTooLarge("GIT_OUTPUT_LIMIT_EXCEEDED")):
+            _, code = self._get("/api/diff?from=V1R1C0&to=patch/context")
+        self.assertEqual(code, 413)
+
+    def test_http_publisher_fails_closed_without_authoritative_repository(self):
+        with patch.dict(os.environ, {}, clear=True), patch.object(api, "AUTHORITATIVE_GIT_DIR", None), patch.object(api, "REPOSITORY_IDENTITY", ""):
+            with self.assertRaises(RuntimeError):
+                api.publication_publisher()
+
+    def test_http_publisher_fails_closed_on_identity_mismatch(self):
+        with patch.dict(os.environ, self.env, clear=True), patch.object(api, "AUTHORITATIVE_GIT_DIR", self.bare), patch.object(api, "REPOSITORY_IDENTITY", "other/repo"):
+            with self.assertRaises(RuntimeError):
+                api.publication_publisher()
+
+    def test_writer_guard_remains_false(self):
+        decision = api.evaluate_git_write(self.runtime, {"AIOS_GITOPS_WRITES_ENABLED": "false"})
+        self.assertFalse(decision.allowed)
+        self.assertEqual(decision.status_code, 423)

tests/test_chatgpt_actions_tag.py

@@ -0,0 +1,431 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+import yaml
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+ROOT = Path(__file__).resolve().parents[1]
+os.environ.setdefault("AIOS_GITOPS_WORKSPACE", str(ROOT))
+sys.path.insert(0, str(ROOT / "runtime" / "agent-os"))
+sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
+SPEC = importlib.util.spec_from_file_location(
+    "aios_chatgpt_actions_api",
+    ROOT / "active-runtime" / "app" / "aios_chatgpt_actions_api.py",
+)
+assert SPEC and SPEC.loader
+api = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(api)
+
+TARGET = "1" * 40
+EVIDENCE = "2" * 40
+TAG_OID = "3" * 40
+MAIN = "4" * 40
+
+
+class TagActionTests(unittest.TestCase):
+    def handler(self, role: str = "owner"):
+        handler = object.__new__(api.H)
+        handler.need = Mock(
+            return_value={"account": "owner", "role": role, "scopes": {"tag:create"}}
+        )
+        handler.sendj = Mock(side_effect=lambda data, code=200: (data, code))
+        return handler
+
+    def complete_request(self):
+        return {
+            "version": "V9R9C9",
+            "target_oid": TARGET,
+            "evidence_closure_oid": EVIDENCE,
+            "approval_plan_id": "owner-approved-test",
+            "execute": True,
+        }
+
+    def test_tag_publication_status_rejects_invalid_versions_without_reading(self):
+        invalid_queries = (
+            "../current",
+            "../../versions/V2R1C3",
+            "%2e%2e%2fcurrent",
+            "/etc/secret",
+            r"..\current",
+            "",
+        )
+        for value in invalid_queries:
+            with self.subTest(value=value):
+                handler = object.__new__(api.H)
+                handler.path = f"/api/tag-publication-status?version={value}"
+                handler.sendj = Mock(side_effect=lambda data, code=200: (data, code))
+                with patch.object(api, "publication_publisher") as publisher:
+                    handler.do_GET()
+                body = handler.sendj.call_args.args[0]
+                code = (
+                    handler.sendj.call_args.args[1]
+                    if len(handler.sendj.call_args.args) > 1
+                    else handler.sendj.call_args.kwargs.get("code", 200)
+                )
+                self.assertEqual(code, 400)
+                self.assertEqual(body, {"error": "invalid release version"})
+                if value:
+                    self.assertNotIn(value, str(body))
+                self.assertNotIn("/data/", str(body))
+                self.assertNotIn("BAIT-MUST-NOT-BE-READ", str(body))
+                publisher.assert_not_called()
+
+    def test_tag_publication_status_accepts_canonical_versions(self):
+        for version in ("V2R1C3", "V2R1C3-rc.1_build"):
+            with self.subTest(version=version):
+                handler = object.__new__(api.H)
+                handler.path = f"/api/tag-publication-status?version={version}"
+                handler.sendj = Mock(side_effect=lambda data, code=200: (data, code))
+                publisher = Mock()
+                publisher.get_tag_publication_status.return_value = {
+                    "version": version,
+                    "state": "UNKNOWN",
+                }
+                with patch.object(api, "publication_publisher", return_value=publisher):
+                    handler.do_GET()
+                body = handler.sendj.call_args.args[0]
+                code = (
+                    handler.sendj.call_args.args[1]
+                    if len(handler.sendj.call_args.args) > 1
+                    else handler.sendj.call_args.kwargs.get("code", 200)
+                )
+                self.assertEqual(code, 200)
+                self.assertEqual(body["version"], version)
+                publisher.get_tag_publication_status.assert_called_once_with(version)
+
+    def test_resolve_commit_oid_requires_full_exact_commit(self):
+        with patch.object(api, "authoritative_commit", return_value=TARGET):
+            self.assertEqual(api.resolve_commit_oid(TARGET), TARGET)
+        for value in (None, "1234567", "z" * 40):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                api.resolve_commit_oid(value)
+
+    def test_production_tag_requires_all_governance_fields(self):
+        handler = self.handler()
+        for missing in ("target_oid", "evidence_closure_oid", "approval_plan_id"):
+            payload = self.complete_request()
+            payload.pop(missing)
+            handler.tag(payload)
+            body, code = handler.sendj.call_args.args
+            self.assertEqual(code, 400)
+            self.assertIn("required", body)
+
+    def test_owner_execution_uses_atomic_publisher_and_never_changes_main(self):
+        handler = self.handler()
+        publication = {
+            "state": "BASELINE_UPDATED",
+            "tag_oid": TAG_OID,
+            "remote_tag_oid": TAG_OID,
+            "remote_peeled_target_oid": TARGET,
+            "gitea_listing_visible": True,
+        }
+
+        def fake_sh(args, check=False):
+            if args[:2] == ["merge-base", "--is-ancestor"]:
+                return {"code": 0, "stdout": "", "stderr": "", "cmd": []}
+            if args == ["rev-parse", "refs/heads/main"]:
+                return {"code": 0, "stdout": MAIN, "stderr": "", "cmd": []}
+            if args == ["rev-parse", "HEAD"]:
+                return {"code": 0, "stdout": EVIDENCE, "stderr": "", "cmd": []}
+            return {"code": 0, "stdout": "", "stderr": "", "cmd": []}
+
+        publisher = Mock()
+        publisher.publish.return_value = publication
+        with (
+            patch.object(api, "resolve_commit_oid", side_effect=[TARGET, EVIDENCE]),
+            patch.object(api, "sh", side_effect=fake_sh),
+            patch.object(api, "required_authoritative_git_dir", return_value=Path("/tmp/authoritative.git")),
+            patch.object(api, "GiteaTagClient"),
+            patch.object(api, "GitTagBackend"),
+            patch.object(api, "TagPublisher", return_value=publisher),
+            patch.object(api, "audit"),
+        ):
+            handler.tag(self.complete_request())
+        result = handler.sendj.call_args.args[0]
+        self.assertEqual(result["status"], "BASELINE_UPDATED")
+        self.assertEqual(result["target_oid"], TARGET)
+        self.assertEqual(result["tag_oid"], TAG_OID)
+        self.assertFalse(result["main_changed"])
+        self.assertFalse(result["force_push"])
+
+    def test_atomic_publisher_conflict_returns_reconciliation_required(self):
+        handler = self.handler()
+        publisher = Mock()
+        publisher.publish.side_effect = api.PublicationConflict("different remote OID")
+        with (
+            patch.object(api, "resolve_commit_oid", side_effect=[TARGET, EVIDENCE]),
+            patch.object(
+                api,
+                "sh",
+                side_effect=[
+                    {"code": 0, "stdout": "", "stderr": "", "cmd": []},
+                    {"code": 0, "stdout": MAIN, "stderr": "", "cmd": []},
+                ],
+            ),
+            patch.object(api, "required_authoritative_git_dir", return_value=Path("/tmp/authoritative.git")),
+            patch.object(api, "GiteaTagClient"),
+            patch.object(api, "GitTagBackend"),
+            patch.object(api, "TagPublisher", return_value=publisher),
+            patch.object(api, "audit"),
+        ):
+            handler.tag(self.complete_request())
+        body, code = handler.sendj.call_args.args
+        self.assertEqual(code, 409)
+        self.assertEqual(body["status"], "RECONCILIATION_REQUIRED")
+
+    def test_non_owner_request_persists_complete_target_binding(self):
+        handler = self.handler(role="chatgpt_bot")
+        with (
+            patch.object(api, "resolve_commit_oid", side_effect=[TARGET, EVIDENCE]),
+            patch.object(
+                api, "sh", return_value={"code": 0, "stdout": "", "stderr": "", "cmd": []}
+            ),
+            patch.object(api, "checkout", return_value="request/tag-v9r9c9"),
+            patch.object(
+                api,
+                "write_json",
+                return_value="baseline/tag_requests/V9R9C9.json",
+            ) as write_json,
+            patch.object(api, "commit", return_value={"status": "committed"}),
+        ):
+            handler.tag(self.complete_request())
+        saved = write_json.call_args.args[1]
+        self.assertEqual(saved["target_oid"], TARGET)
+        self.assertEqual(saved["evidence_closure_oid"], EVIDENCE)
+        self.assertEqual(saved["approval_plan_id"], "owner-approved-test")
+
+    def test_linked_worktree_branch_sync_verifies_instead_of_self_fetch(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            bare = root / "repo.git"
+            seed = root / "seed"
+            worktree = root / "writer"
+            subprocess.run(["git", "init", "--bare", str(bare)], check=True, capture_output=True)
+            subprocess.run(["git", "init", "-b", "main", str(seed)], check=True, capture_output=True)
+            subprocess.run(["git", "-C", str(seed), "config", "user.name", "test"], check=True)
+            subprocess.run(
+                ["git", "-C", str(seed), "config", "user.email", "test@example.invalid"],
+                check=True,
+            )
+            (seed / "x").write_text("x", encoding="utf-8")
+            subprocess.run(["git", "-C", str(seed), "add", "x"], check=True)
+            subprocess.run(["git", "-C", str(seed), "commit", "-m", "seed"], check=True, capture_output=True)
+            subprocess.run(["git", "-C", str(seed), "push", str(bare), "main"], check=True, capture_output=True)
+            subprocess.run(
+                ["git", "--git-dir", str(bare), "worktree", "add", "-b", "patch/test", str(worktree), "main"],
+                check=True,
+                capture_output=True,
+            )
+            old_ws, old_bare = api.WS, api.BARE_REPO
+            api.WS, api.BARE_REPO = worktree, bare
+            try:
+                result = api.sync_branch("patch/test")
+            finally:
+                api.WS, api.BARE_REPO = old_ws, old_bare
+            self.assertEqual(result["status"], "verified")
+            self.assertEqual(result["target"], "authoritative-bare")
+
+    def test_create_existing_branch_never_resets_it(self):
+        calls = []
+
+        def fake_sh(args, check=False):
+            calls.append(args)
+            if args[:2] == ["rev-parse", "--verify"]:
+                return {"code": 0, "stdout": MAIN, "stderr": "", "cmd": []}
+            return {"code": 0, "stdout": "", "stderr": "", "cmd": []}
+
+        with patch.object(api, "ensure_git"), patch.object(api, "sh", side_effect=fake_sh):
+            self.assertEqual(api.checkout("patch/existing", "main", True), "patch/existing")
+        self.assertIn(["checkout", "patch/existing"], calls)
+        self.assertFalse(any(call[:2] == ["checkout", "-B"] for call in calls))
+        self.assertFalse(any(call[:2] == ["checkout", "-b"] for call in calls))
+
+    def test_release_script_has_no_ignored_push_or_direct_main_update(self):
+        script = (ROOT / "scripts" / "release_version.sh").read_text(encoding="utf-8")
+        self.assertNotIn('git push origin "$VERSION" || true', script)
+        self.assertNotIn("git checkout main", script)
+        self.assertIn("approval_plan_id required", script)
+        self.assertIn("git push \"$BRANCH_REMOTE\"", script)
+        self.assertNotIn("RELEASE_DONE", script)
+        self.assertNotIn("merge-base --is-ancestor", script)
+        self.assertIn('"versions/$VERSION.json"', script)
+        self.assertNotIn('"baseline/tag_publications/$VERSION.json"', script)
+
+    def test_openapi_requires_complete_tag_governance_evidence(self):
+        schema = (
+            ROOT / "docs" / "gitops" / "openapi-chatgpt-actions.yaml"
+        ).read_text(encoding="utf-8")
+        self.assertIn(
+            "required: [version, target_oid, evidence_closure_oid, approval_plan_id]",
+            schema,
+        )
+        self.assertIn("x-openai-isConsequential: true", schema)
+        self.assertIn("Remote push pending", schema)
+        self.assertIn("operationId: getReleaseConsistency", schema)
+        self.assertIn("operationId: getTagPublicationStatus", schema)
+        self.assertIn("operationId: runReleaseAcceptance", schema)
+        document = yaml.safe_load(schema)
+        self.assertIn("/api/release-consistency", document["paths"])
+        status_parameters = document["paths"]["/api/tag-publication-status"]["get"][
+            "parameters"
+        ]
+        self.assertEqual(
+            status_parameters[0]["schema"]["pattern"],
+            r"^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$",
+        )
+        publication_states = document["components"]["schemas"]["PublicationState"][
+            "enum"
+        ]
+        self.assertIn("LOCAL_TAG_CREATED", publication_states)
+        self.assertIn("BASELINE_UPDATE_PENDING", publication_states)
+        self.assertNotIn("TAG_CREATED_LOCAL", publication_states)
+
+    def test_documented_normal_state_sequence_matches_canonical_contract(self):
+        document = (
+            ROOT / "docs" / "gitops" / "gitea-tag-publication-atomicity.md"
+        ).read_text(encoding="utf-8")
+        normal_section = document.split("## Legacy state migration", 1)[0]
+        self.assertIn("LOCAL_TAG_CREATED", normal_section)
+        self.assertIn("BASELINE_UPDATE_PENDING", normal_section)
+        self.assertNotIn("TAG_CREATED_LOCAL", normal_section)
+
+    def test_delivery_manifest_is_derived_from_git_without_self_reference(self):
+        generator = ROOT / "scripts" / "generate_delivery_manifest.py"
+        with tempfile.TemporaryDirectory() as td:
+            repo = Path(td)
+            subprocess.run(
+                ["git", "init", "-q", "-b", "main"], cwd=repo, check=True
+            )
+            subprocess.run(
+                ["git", "config", "user.email", "test@example.invalid"],
+                cwd=repo,
+                check=True,
+            )
+            subprocess.run(
+                ["git", "config", "user.name", "test"], cwd=repo, check=True
+            )
+            (repo / "base.txt").write_text("base", encoding="utf-8")
+            subprocess.run(["git", "add", "base.txt"], cwd=repo, check=True)
+            subprocess.run(
+                ["git", "commit", "-q", "-m", "base"], cwd=repo, check=True
+            )
+            base_oid = subprocess.check_output(
+                ["git", "rev-parse", "HEAD"], cwd=repo, text=True
+            ).strip()
+            subprocess.run(
+                ["git", "checkout", "-q", "-b", "patch/manifest-test"],
+                cwd=repo,
+                check=True,
+            )
+            (repo / "scripts").mkdir()
+            shutil.copy2(generator, repo / "scripts" / generator.name)
+            (repo / "source.txt").write_text(
+                "no credential content", encoding="utf-8"
+            )
+            subprocess.run(["git", "add", "."], cwd=repo, check=True)
+            subprocess.run(
+                ["git", "commit", "-q", "-m", "source one"], cwd=repo, check=True
+            )
+            (repo / "source.txt").write_text(
+                "no credential content\nsecond", encoding="utf-8"
+            )
+            subprocess.run(["git", "add", "source.txt"], cwd=repo, check=True)
+            subprocess.run(
+                ["git", "commit", "-q", "-m", "source two"], cwd=repo, check=True
+            )
+            source_commit = subprocess.check_output(
+                ["git", "rev-parse", "HEAD"], cwd=repo, text=True
+            ).strip()
+
+            subprocess.run(
+                [
+                    sys.executable,
+                    str(repo / "scripts" / generator.name),
+                    "--base",
+                    "main",
+                    "--output",
+                    "delivery.json",
+                ],
+                cwd=repo,
+                check=True,
+            )
+            manifest = json.loads((repo / "delivery.json").read_text())
+            expected_commits = (
+                subprocess.check_output(
+                    [
+                        "git",
+                        "log",
+                        "--reverse",
+                        "--format=%H",
+                        f"{base_oid}..{source_commit}",
+                    ],
+                    cwd=repo,
+                    text=True,
+                )
+                .strip()
+                .splitlines()
+            )
+
+            self.assertEqual(manifest["base"], "main")
+            self.assertEqual(manifest["base_oid"], base_oid)
+            self.assertEqual(manifest["source_branch"], "patch/manifest-test")
+            self.assertEqual(manifest["source_commit"], source_commit)
+            self.assertEqual(manifest["commits"], expected_commits)
+            self.assertEqual(manifest["commit_count"], len(expected_commits))
+            self.assertEqual(manifest["file_count"], len(manifest["files"]))
+            self.assertEqual(
+                manifest["manifest_path"],
+                "delivery.json",
+            )
+            self.assertNotIn(manifest["manifest_path"], manifest["files"])
+            self.assertEqual(
+                subprocess.check_output(
+                    ["git", "rev-parse", f"{manifest['source_commit']}^{{commit}}"],
+                    cwd=repo,
+                    text=True,
+                ).strip(),
+                source_commit,
+            )
+            self.assertNotIn("credential content", json.dumps(manifest))
+
+    def test_read_only_release_interfaces_are_allowlisted(self):
+        self.assertIn("/api/release-consistency", api.READ_ONLY_GET_PATHS)
+        self.assertIn("/api/tag-publication-status", api.READ_ONLY_GET_PATHS)
+        self.assertIn("/api/release-acceptance", api.READ_ONLY_GET_PATHS)
+
+    def test_release_consistency_query_requires_full_governance_fingerprint(self):
+        with self.assertRaises(ValueError):
+            api.publication_request_from_query({"version": ["V9R9C9"]})
+        parsed = api.publication_request_from_query(
+            {
+                "version": ["V9R9C9"],
+                "target_oid": [TARGET],
+                "evidence_closure_oid": [EVIDENCE],
+                "approval_plan_id": ["owner-approved-test"],
+            }
+        )
+        self.assertEqual(parsed.target_oid, TARGET)
+        self.assertEqual(parsed.approval_plan_id, "owner-approved-test")
+
+    def test_committed_security_incident_record_contains_no_secret(self):
+        record = (
+            ROOT
+            / "security"
+            / "incidents"
+            / "GITEA-TOKEN-33-EXPOSURE-20260723.redacted.json"
+        ).read_text(encoding="utf-8")
+        self.assertFalse(api.content_has_secret(record))
+        self.assertNotIn("token_plain", record)
+        self.assertNotIn("Authorization", record)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_gitea_tag_publication.py

@@ -0,0 +1,872 @@
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
+
+import gitea_tag_publication as publication_module  # noqa: E402
+
+from gitea_tag_publication import (  # noqa: E402
+    PublicationConflict,
+    PublicationPending,
+    PublicationReconciliationRequired,
+    PublicationRequest,
+    PublicationState,
+    PublicationStore,
+    GiteaTagClient,
+    GitTagBackend,
+    TagPublisher,
+)
+
+
+TARGET = "1" * 40
+EVIDENCE = "2" * 40
+TAG_OID = "3" * 40
+WRONG = "4" * 40
+
+
+class FakeGit:
+    def __init__(self):
+        self.local = None
+        self.remote = None
+        self.push_error = None
+        self.remote_error = None
+        self.lineage_error = None
+        self.pushes = 0
+        self.remote_checks = 0
+
+    def ensure_local_annotated_tag(self, request):
+        if self.local and self.local != (TAG_OID, request.target_oid):
+            raise PublicationConflict("local tag conflict")
+        self.local = (TAG_OID, request.target_oid)
+        return self.local
+
+    def remote_tag(self, remote, version):
+        self.remote_checks += 1
+        if self.remote_error:
+            raise self.remote_error
+        return self.remote
+
+    def push_tag(self, remote, version):
+        self.pushes += 1
+        if self.push_error:
+            raise self.push_error
+        self.remote = self.local
+
+    def validate_evidence_lineage(self, request):
+        if self.lineage_error:
+            raise self.lineage_error
+        return None
+
+    def repository_identity(self, remote, expected_repository):
+        return expected_repository
+
+
+class FakeGitea:
+    def __init__(self):
+        self.repository = "aios/aios"
+        self.lookup = (TAG_OID, TARGET)
+        self.visible = True
+        self.error = None
+        self.lookup_checks = 0
+        self.listing_checks = 0
+
+    def lookup_tag(self, version):
+        self.lookup_checks += 1
+        if self.error:
+            raise self.error
+        return self.lookup
+
+    def tag_visible_in_listing(self, version, expected_target_oid):
+        self.listing_checks += 1
+        if self.error:
+            raise self.error
+        return self.visible
+
+    def repository_identity(self):
+        return self.repository
+
+
+def request():
+    return PublicationRequest(
+        version="V9R9C9",
+        target_oid=TARGET,
+        evidence_closure_oid=EVIDENCE,
+        approval_plan_id="owner-approved-test",
+    )
+
+
+class TagPublicationTests(unittest.TestCase):
+    def publisher(self, root: Path, git=None, gitea=None):
+        baseline = root / "baseline" / "current.json"
+        baseline.parent.mkdir(parents=True)
+        baseline.write_text(
+            json.dumps({"current_baseline": "V9R9C8", "status": "PRODUCTION_DEPLOYED"}),
+            encoding="utf-8",
+        )
+        return TagPublisher(
+            workspace=root,
+            git=git or FakeGit(),
+            gitea=gitea or FakeGitea(),
+            remote="gitea",
+        )
+
+    def test_publication_store_rejects_path_traversal_without_reading(self):
+        invalid_versions = (
+            "../current",
+            "../../versions/V2R1C3",
+            "%2e%2e%2fcurrent",
+            "/etc/secret",
+            r"..\current",
+            "V2R1C3-..",
+            "",
+        )
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td) / "saga"
+            root.mkdir()
+            bait = root.parent / "current.json"
+            bait.write_text('{"secret":"BAIT-MUST-NOT-BE-READ"}', encoding="utf-8")
+            store = PublicationStore(Path(td), state_root=root)
+            for version in invalid_versions:
+                with self.subTest(version=version):
+                    with patch.object(
+                        Path,
+                        "read_text",
+                        side_effect=AssertionError("state file read attempted"),
+                    ):
+                        with self.assertRaisesRegex(
+                            ValueError, "^invalid release version$"
+                        ):
+                            store.load(version)
+                    with self.assertRaisesRegex(
+                        ValueError, "^invalid release version$"
+                    ):
+                        store.path(version)
+                    with self.assertRaisesRegex(
+                        ValueError, "^invalid release version$"
+                    ):
+                        with store.lock(version):
+                            self.fail("invalid version acquired a publication lock")
+            self.assertEqual(
+                bait.read_text(encoding="utf-8"),
+                '{"secret":"BAIT-MUST-NOT-BE-READ"}',
+            )
+
+    def test_publication_store_accepts_canonical_release_versions(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td) / "saga"
+            store = PublicationStore(Path(td), state_root=root)
+            for version in ("V2R1C3", "V2R1C3-rc.1_build"):
+                with self.subTest(version=version):
+                    self.assertEqual(store.path(version).parent, root.resolve())
+                    self.assertEqual(store.path(version).name, f"{version}.json")
+
+    def test_new_publication_uses_canonical_local_and_pending_states(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (TAG_OID, TARGET)
+            gitea = FakeGitea()
+            publisher = self.publisher(root, git=git, gitea=gitea)
+            transitions = []
+            record = publisher.store.record
+
+            def observe(publication_request, state, **evidence):
+                transitions.append(state.value)
+                return record(publication_request, state, **evidence)
+
+            with patch.object(publisher.store, "record", side_effect=observe):
+                publisher.publish(request())
+
+            self.assertIn(PublicationState.LOCAL_TAG_CREATED.value, transitions)
+            self.assertNotIn("TAG_CREATED_LOCAL", transitions)
+            self.assertLess(
+                transitions.index(PublicationState.GITEA_API_CONFIRMED.value),
+                transitions.index(PublicationState.BASELINE_UPDATE_PENDING.value),
+            )
+            self.assertLess(
+                transitions.index(PublicationState.BASELINE_UPDATE_PENDING.value),
+                transitions.index(PublicationState.BASELINE_UPDATED.value),
+            )
+
+    def test_legacy_local_tag_state_is_normalized_on_read_and_next_write(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            publisher = self.publisher(root)
+            path = publisher.store.path(request().version)
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(
+                json.dumps(
+                    {
+                        **request().__dict__,
+                        "state": "TAG_CREATED_LOCAL",
+                        "tag_oid": TAG_OID,
+                    }
+                ),
+                encoding="utf-8",
+            )
+
+            loaded = publisher.get_tag_publication_status(request().version)
+            self.assertEqual(loaded["state"], "LOCAL_TAG_CREATED")
+            self.assertEqual(
+                json.loads(path.read_text(encoding="utf-8"))["state"],
+                "TAG_CREATED_LOCAL",
+            )
+
+            publisher.store.record(request(), PublicationState.LOCAL_TAG_CREATED)
+            persisted = json.loads(path.read_text(encoding="utf-8"))
+            self.assertEqual(persisted["state"], "LOCAL_TAG_CREATED")
+            self.assertNotIn("TAG_CREATED_LOCAL", json.dumps(persisted))
+
+    def test_unknown_persisted_state_fails_closed_without_mutation(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            publisher = self.publisher(root, git=git)
+            path = publisher.store.path(request().version)
+            path.parent.mkdir(parents=True, exist_ok=True)
+            original = {
+                **request().__dict__,
+                "state": "UNRECOGNIZED_LEGACY_STATE",
+                "tag_oid": TAG_OID,
+            }
+            path.write_text(json.dumps(original), encoding="utf-8")
+
+            status = publisher.get_tag_publication_status(request().version)
+            self.assertEqual(
+                status["state"], PublicationState.RECONCILIATION_REQUIRED.value
+            )
+            self.assertTrue(status["fail_closed"])
+            with self.assertRaises(PublicationReconciliationRequired):
+                publisher.publish(request())
+            self.assertEqual(json.loads(path.read_text(encoding="utf-8")), original)
+            self.assertEqual(git.pushes, 0)
+
+    def test_evidence_lineage_conflict_requires_manual_owner_review(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.lineage_error = PublicationConflict("evidence lineage mismatch")
+            publisher = self.publisher(root, git=git)
+
+            with self.assertRaises(PublicationConflict):
+                publisher.publish(request())
+
+            self.assertEqual(
+                publisher.store.load(request().version)["state"],
+                PublicationState.MANUAL_OWNER_REVIEW_REQUIRED.value,
+            )
+            self.assertEqual(git.pushes, 0)
+
+    def test_push_failure_does_not_update_baseline(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.push_error = RuntimeError("push rejected")
+            publisher = self.publisher(root, git=git)
+            with self.assertRaises(PublicationPending):
+                publisher.publish(request())
+            baseline = json.loads((root / "baseline/current.json").read_text())
+            state = publisher.store.load("V9R9C9")
+            self.assertEqual(baseline["current_baseline"], "V9R9C8")
+            self.assertEqual(state["state"], PublicationState.REMOTE_PUSH_PENDING.value)
+
+    def test_deployed_record_with_missing_remote_tag_fails_closed(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            publisher = self.publisher(root, git=git)
+            publisher.store.record(
+                request(),
+                PublicationState.PRODUCTION_DEPLOYED,
+                tag_oid=TAG_OID,
+                deployment_evidence="sha256:" + ("a" * 64),
+            )
+            with self.assertRaises(PublicationReconciliationRequired):
+                publisher.publish(request())
+            self.assertEqual(
+                publisher.store.load("V9R9C9")["state"],
+                "MANUAL_OWNER_REVIEW_REQUIRED",
+            )
+            self.assertEqual(git.pushes, 0)
+
+    def test_gitea_api_failure_does_not_deploy_or_update_baseline(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (TAG_OID, TARGET)
+            gitea = FakeGitea()
+            gitea.error = RuntimeError("gitea unavailable")
+            publisher = self.publisher(root, git=git, gitea=gitea)
+            with self.assertRaises(PublicationReconciliationRequired):
+                publisher.publish(request())
+            baseline = json.loads((root / "baseline/current.json").read_text())
+            state = publisher.store.load("V9R9C9")
+            self.assertEqual(baseline["current_baseline"], "V9R9C8")
+            self.assertNotEqual(state["state"], PublicationState.PRODUCTION_DEPLOYED.value)
+            self.assertEqual(state["state"], PublicationState.RECONCILIATION_REQUIRED.value)
+
+    def test_remote_unreachable_recovers_idempotently(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote_error = RuntimeError("network down")
+            publisher = self.publisher(root, git=git)
+            with self.assertRaises(PublicationPending):
+                publisher.publish(request())
+            git.remote_error = None
+            result = publisher.reconcile(request())
+            self.assertEqual(result["state"], PublicationState.BASELINE_UPDATED.value)
+            self.assertEqual(git.pushes, 1)
+
+    def test_same_name_different_remote_oid_is_rejected(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (WRONG, TARGET)
+            publisher = self.publisher(root, git=git)
+            with self.assertRaises(PublicationConflict):
+                publisher.publish(request())
+            self.assertEqual(
+                publisher.store.load("V9R9C9")["state"],
+                PublicationState.MANUAL_OWNER_REVIEW_REQUIRED.value,
+            )
+
+    def test_annotated_tag_requires_exact_object_and_peeled_target(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (TAG_OID, WRONG)
+            publisher = self.publisher(root, git=git)
+            with self.assertRaises(PublicationConflict):
+                publisher.publish(request())
+            self.assertEqual(git.pushes, 0)
+
+    def test_local_bare_success_but_gitea_failure_is_fail_closed(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (TAG_OID, TARGET)
+            gitea = FakeGitea()
+            gitea.visible = False
+            publisher = self.publisher(root, git=git, gitea=gitea)
+            with self.assertRaises(PublicationReconciliationRequired):
+                publisher.publish(request())
+            self.assertEqual(
+                json.loads((root / "baseline/current.json").read_text())["current_baseline"],
+                "V9R9C8",
+            )
+
+    def test_restart_recovery_uses_persisted_state(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.push_error = RuntimeError("temporary")
+            first = self.publisher(root, git=git)
+            with self.assertRaises(PublicationPending):
+                first.publish(request())
+            git.push_error = None
+            second = TagPublisher(root, git, FakeGitea(), "gitea")
+            result = second.reconcile(request())
+            self.assertEqual(result["state"], PublicationState.BASELINE_UPDATED.value)
+
+    def test_baseline_write_failure_preserves_update_pending(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (TAG_OID, TARGET)
+            publisher = self.publisher(root, git=git)
+            atomic_write = publication_module.atomic_json_write
+
+            def fail_baseline(path, payload):
+                if path == publisher.baseline_path:
+                    raise OSError("baseline write failed")
+                return atomic_write(path, payload)
+
+            with (
+                patch.object(
+                    publication_module, "atomic_json_write", side_effect=fail_baseline
+                ),
+                self.assertRaises(PublicationReconciliationRequired),
+            ):
+                publisher.publish(request())
+
+            self.assertEqual(
+                publisher.store.load(request().version)["state"],
+                PublicationState.BASELINE_UPDATE_PENDING.value,
+            )
+            self.assertEqual(
+                json.loads(publisher.baseline_path.read_text())["current_baseline"],
+                "V9R9C8",
+            )
+            self.assertFalse(
+                (root / "versions" / f"{request().version}.json").exists()
+            )
+
+    def test_registry_write_failure_recovers_after_restart_without_tag_push(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (TAG_OID, TARGET)
+            publisher = self.publisher(root, git=git)
+            registry_path = root / "versions" / f"{request().version}.json"
+            atomic_write = publication_module.atomic_json_write
+
+            def fail_registry(path, payload):
+                if path == registry_path:
+                    raise OSError("registry write failed")
+                return atomic_write(path, payload)
+
+            with (
+                patch.object(
+                    publication_module, "atomic_json_write", side_effect=fail_registry
+                ),
+                self.assertRaises(PublicationReconciliationRequired),
+            ):
+                publisher.publish(request())
+
+            self.assertEqual(
+                publisher.store.load(request().version)["state"],
+                PublicationState.BASELINE_UPDATE_PENDING.value,
+            )
+            self.assertEqual(
+                json.loads(publisher.baseline_path.read_text())["current_baseline"],
+                request().version,
+            )
+            self.assertFalse(registry_path.exists())
+
+            recovered = TagPublisher(root, git, FakeGitea(), "gitea")
+            result = recovered.reconcile(request())
+            self.assertEqual(result["state"], PublicationState.BASELINE_UPDATED.value)
+            self.assertTrue(registry_path.exists())
+            self.assertEqual(git.pushes, 0)
+
+    def test_pending_recovery_fills_missing_baseline_from_matching_registry(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (TAG_OID, TARGET)
+            gitea = FakeGitea()
+            publisher = self.publisher(root, git=git, gitea=gitea)
+            publisher.store.record(
+                request(),
+                PublicationState.BASELINE_UPDATE_PENDING,
+                tag_oid=TAG_OID,
+            )
+            registry_path = root / "versions" / f"{request().version}.json"
+            registry_path.parent.mkdir(parents=True, exist_ok=True)
+            registry_path.write_text(
+                json.dumps(
+                    {
+                        **request().__dict__,
+                        "tag_oid": TAG_OID,
+                        "tag_object": TAG_OID,
+                        "registered": True,
+                        "enabled": True,
+                    }
+                ),
+                encoding="utf-8",
+            )
+
+            result = publisher.reconcile(request())
+
+            self.assertEqual(result["state"], PublicationState.BASELINE_UPDATED.value)
+            self.assertEqual(
+                json.loads(publisher.baseline_path.read_text())["current_baseline"],
+                request().version,
+            )
+            self.assertEqual(git.pushes, 0)
+            self.assertGreater(git.remote_checks, 0)
+            self.assertGreater(gitea.lookup_checks, 0)
+            self.assertGreater(gitea.listing_checks, 0)
+
+    def test_pending_recovery_revalidates_remote_and_conflict_requires_owner(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (WRONG, TARGET)
+            publisher = self.publisher(root, git=git)
+            publisher.store.record(
+                request(),
+                PublicationState.BASELINE_UPDATE_PENDING,
+                tag_oid=TAG_OID,
+            )
+
+            with self.assertRaises(PublicationConflict):
+                publisher.reconcile(request())
+
+            self.assertEqual(
+                publisher.store.load(request().version)["state"],
+                PublicationState.MANUAL_OWNER_REVIEW_REQUIRED.value,
+            )
+            self.assertEqual(git.pushes, 0)
+
+    def test_reconciliation_is_idempotent_and_never_marks_deployed(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (TAG_OID, TARGET)
+            publisher = self.publisher(root, git=git)
+            first = publisher.publish(request())
+            second = publisher.reconcile(request())
+            self.assertEqual(first["state"], PublicationState.BASELINE_UPDATED.value)
+            self.assertEqual(second["state"], PublicationState.BASELINE_UPDATED.value)
+            baseline = json.loads((root / "baseline/current.json").read_text())
+            self.assertEqual(baseline["status"], PublicationState.BASELINE_UPDATED.value)
+            self.assertEqual(git.pushes, 0)
+
+    def test_mark_deployed_requires_baseline_updated_and_evidence(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            publisher = self.publisher(root)
+            with self.assertRaises(PublicationReconciliationRequired):
+                publisher.mark_production_deployed(request(), "")
+            publisher.publish(request())
+            result = publisher.mark_production_deployed(
+                request(), "sha256:" + ("a" * 64)
+            )
+            self.assertEqual(result["state"], PublicationState.PRODUCTION_DEPLOYED.value)
+
+    def test_deployed_fingerprint_change_requires_manual_owner_review(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            publisher = self.publisher(root, git=git)
+            publisher.store.record(
+                request(),
+                PublicationState.PRODUCTION_DEPLOYED,
+                tag_oid=TAG_OID,
+                deployment_evidence="sha256:" + ("a" * 64),
+            )
+            changed = PublicationRequest(
+                request().version,
+                WRONG,
+                request().evidence_closure_oid,
+                request().approval_plan_id,
+            )
+            with self.assertRaises(PublicationReconciliationRequired):
+                publisher.publish(changed)
+            state = publisher.store.load(request().version)
+            self.assertEqual(
+                state["state"], PublicationState.MANUAL_OWNER_REVIEW_REQUIRED.value
+            )
+            self.assertIn("target_oid", state["conflict_fields"])
+            self.assertEqual(git.pushes, 0)
+
+    def test_deployed_gitea_tag_object_change_requires_manual_review(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (TAG_OID, TARGET)
+            gitea = FakeGitea()
+            gitea.lookup = (WRONG, TARGET)
+            publisher = self.publisher(root, git=git, gitea=gitea)
+            publisher.store.record(
+                request(),
+                PublicationState.PRODUCTION_DEPLOYED,
+                tag_oid=TAG_OID,
+                deployment_evidence="sha256:" + ("a" * 64),
+            )
+            with self.assertRaises(PublicationReconciliationRequired):
+                publisher.publish(request())
+            self.assertEqual(
+                publisher.store.load(request().version)["state"],
+                PublicationState.MANUAL_OWNER_REVIEW_REQUIRED.value,
+            )
+
+    def test_mark_deployed_rejects_different_approval_plan_id(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            publisher = self.publisher(root)
+            publisher.publish(request())
+            changed = PublicationRequest(
+                request().version,
+                request().target_oid,
+                request().evidence_closure_oid,
+                "different-owner-plan",
+            )
+            with self.assertRaises(PublicationReconciliationRequired):
+                publisher.mark_production_deployed(
+                    changed, "sha256:" + ("a" * 64)
+                )
+            self.assertEqual(
+                publisher.store.load(request().version)["state"],
+                PublicationState.MANUAL_OWNER_REVIEW_REQUIRED.value,
+            )
+
+    def test_state_survives_writer_worktree_deletion(self):
+        with tempfile.TemporaryDirectory() as td:
+            base = Path(td)
+            first_workspace = base / "writer-a"
+            first_workspace.mkdir()
+            state_root = base / "durable-state"
+            publisher = TagPublisher(
+                first_workspace,
+                FakeGit(),
+                FakeGitea(),
+                "gitea",
+                state_root=state_root,
+            )
+            publisher.store.record(request(), PublicationState.REMOTE_PUSH_PENDING)
+            shutil.rmtree(first_workspace)
+            second_workspace = base / "writer-b"
+            second_workspace.mkdir()
+            recovered = TagPublisher(
+                second_workspace,
+                FakeGit(),
+                FakeGitea(),
+                "gitea",
+                state_root=state_root,
+            )
+            self.assertEqual(
+                recovered.get_tag_publication_status(request().version)["state"],
+                PublicationState.REMOTE_PUSH_PENDING.value,
+            )
+
+    def test_duplicate_publication_lock_serializes_writers(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            state_root = root / "durable-state"
+            first = TagPublisher(
+                root, FakeGit(), FakeGitea(), "gitea", state_root=state_root
+            )
+            second = TagPublisher(
+                root, FakeGit(), FakeGitea(), "gitea", state_root=state_root
+            )
+            entered = threading.Event()
+
+            def wait_for_lock():
+                with second.store.lock(request().version):
+                    entered.set()
+
+            with first.store.lock(request().version):
+                worker = threading.Thread(target=wait_for_lock)
+                worker.start()
+                time.sleep(0.05)
+                self.assertFalse(entered.is_set())
+            worker.join(timeout=2)
+            self.assertTrue(entered.is_set())
+
+    def test_registry_baseline_mismatch_blocks_deployment(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            publisher = self.publisher(root)
+            publisher.publish(request())
+            registry_path = root / "versions" / f"{request().version}.json"
+            registry = json.loads(registry_path.read_text(encoding="utf-8"))
+            registry["target_oid"] = WRONG
+            registry_path.write_text(json.dumps(registry), encoding="utf-8")
+            with self.assertRaises(PublicationReconciliationRequired):
+                publisher.mark_production_deployed(
+                    request(), "sha256:" + ("a" * 64)
+                )
+            self.assertNotEqual(
+                publisher.store.load(request().version)["state"],
+                PublicationState.PRODUCTION_DEPLOYED.value,
+            )
+
+    def test_release_consistency_is_unknown_and_fail_closed_on_api_failure(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            git = FakeGit()
+            git.remote = (TAG_OID, TARGET)
+            gitea = FakeGitea()
+            publisher = self.publisher(root, git=git, gitea=gitea)
+            publisher.publish(request())
+            gitea.error = RuntimeError("Authorization: token super-secret")
+            result = publisher.run_release_acceptance(request())
+            self.assertEqual(result["status"], "UNKNOWN")
+            self.assertFalse(result["accepted"])
+            self.assertTrue(result["fail_closed"])
+            self.assertNotIn("super-secret", result["error"])
+
+    def test_release_consistency_fingerprint_failure_is_read_only(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            publisher = self.publisher(root)
+            publisher.publish(request())
+            before = publisher.store.load(request().version)
+            changed = PublicationRequest(
+                request().version,
+                WRONG,
+                request().evidence_closure_oid,
+                request().approval_plan_id,
+            )
+            result = publisher.get_release_consistency(changed)
+            after = publisher.store.load(request().version)
+            self.assertEqual(result["status"], "FAIL")
+            self.assertTrue(result["fail_closed"])
+            self.assertEqual(after, before)
+
+    def test_cli_evidence_lineage_mismatch_is_fail_closed(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            subprocess.run(["git", "init", "-q", "-b", "patch/test"], cwd=root, check=True)
+            subprocess.run(
+                ["git", "config", "user.email", "test@example.invalid"],
+                cwd=root,
+                check=True,
+            )
+            subprocess.run(["git", "config", "user.name", "test"], cwd=root, check=True)
+            (root / "a").write_text("a", encoding="utf-8")
+            subprocess.run(["git", "add", "a"], cwd=root, check=True)
+            subprocess.run(["git", "commit", "-q", "-m", "a"], cwd=root, check=True)
+            target = subprocess.check_output(
+                ["git", "rev-parse", "HEAD"], cwd=root, text=True
+            ).strip()
+            subprocess.run(
+                ["git", "checkout", "-q", "--orphan", "unrelated"], cwd=root, check=True
+            )
+            subprocess.run(["git", "rm", "-q", "-rf", "."], cwd=root, check=True)
+            (root / "b").write_text("b", encoding="utf-8")
+            subprocess.run(["git", "add", "b"], cwd=root, check=True)
+            subprocess.run(["git", "commit", "-q", "-m", "b"], cwd=root, check=True)
+            evidence = subprocess.check_output(
+                ["git", "rev-parse", "HEAD"], cwd=root, text=True
+            ).strip()
+            authoritative = root / "authoritative.git"
+            subprocess.run(["git", "init", "-q", "--bare", str(authoritative)], check=True)
+            subprocess.run(
+                ["git", "--git-dir", str(authoritative), "config", "remote.gitea.url", "https://g.cnnetmkt.top/git/aios/aios.git"],
+                check=True,
+            )
+            subprocess.run(["git", "-C", str(root), "remote", "add", "authority", str(authoritative)], check=True)
+            subprocess.run(["git", "-C", str(root), "push", "-q", "authority", "--all"], check=True)
+            module = ROOT / "active-runtime" / "app" / "gitea_tag_publication.py"
+            cli_env = {
+                **os.environ,
+                "AIOS_GITOPS_AUTHORITATIVE_GIT_DIR": str(authoritative),
+                "AIOS_GITOPS_REPOSITORY_IDENTITY": "aios/aios",
+            }
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    str(module),
+                    "publish",
+                    "--workspace",
+                    str(root),
+                    "--version",
+                    "V9R9C9",
+                    "--target-oid",
+                    target,
+                    "--evidence-closure-oid",
+                    evidence,
+                    "--approval-plan-id",
+                    "owner-plan",
+                    "--gitea-api",
+                    "http://127.0.0.1:1/api/v1",
+                    "--gitea-repo",
+                    "aios/aios",
+                    "--gitea-token-file",
+                    str(root / "missing-token"),
+                ],
+                text=True,
+                capture_output=True,
+                env=cli_env,
+            )
+            self.assertEqual(result.returncode, 2)
+            self.assertIn("evidence lineage mismatch", result.stdout)
+
+    def test_release_script_uses_shared_lineage_validation(self):
+        script = (ROOT / "scripts" / "release_version.sh").read_text(encoding="utf-8")
+        self.assertIn("gitea_tag_publication.py\" publish", script)
+        self.assertNotIn("merge-base --is-ancestor", script)
+
+    def test_error_redaction_hides_authorization_and_token_values(self):
+        from gitea_tag_publication import redact
+
+        message = redact(
+            "Authorization: Bearer abcdefghijklmnop token=super-secret "
+            "https://user:password@example.invalid/repo.git"
+        )
+        self.assertNotIn("abcdefghijklmnop", message)
+        self.assertNotIn("super-secret", message)
+        self.assertNotIn("password", message)
+
+    def test_remote_parser_requires_annotated_tag_object_and_peeled_target(self):
+        backend = GitTagBackend(Path("."))
+        with (
+            patch.object(backend, "_network_remote_url", return_value="ssh://gitea/repo"),
+            patch.object(
+                backend,
+                "run",
+                return_value=(
+                    f"{TAG_OID}\trefs/tags/V9R9C9\n"
+                    f"{TARGET}\trefs/tags/V9R9C9^{{}}"
+                ),
+            ),
+        ):
+            self.assertEqual(backend.remote_tag("gitea", "V9R9C9"), (TAG_OID, TARGET))
+        with (
+            patch.object(backend, "_network_remote_url", return_value="ssh://gitea/repo"),
+            patch.object(
+                backend,
+                "run",
+                return_value=f"{TARGET}\trefs/tags/V9R9C9",
+            ),
+            self.assertRaises(PublicationConflict),
+        ):
+            backend.remote_tag("gitea", "V9R9C9")
+
+    def test_local_path_remote_cannot_count_as_gitea(self):
+        backend = GitTagBackend(Path("."))
+        with (
+            patch.object(backend, "run", return_value="/data/aios-gitops/repo.git"),
+            self.assertRaises(PublicationConflict),
+        ):
+            backend._network_remote_url("origin")
+
+    def test_process_config_remote_url_is_resolved_for_subprocesses(self):
+        backend = GitTagBackend(Path("."))
+        with (
+            patch.object(backend, "run", side_effect=RuntimeError("no such remote")),
+            patch.dict(
+                os.environ,
+                {
+                    "GIT_CONFIG_COUNT": "1",
+                    "GIT_CONFIG_KEY_0": "remote.gitea-local.url",
+                    "GIT_CONFIG_VALUE_0": "http://127.0.0.1:3000/aios/aios.git",
+                },
+                clear=False,
+            ),
+        ):
+            self.assertEqual(
+                backend._network_remote_url("gitea-local"),
+                "http://127.0.0.1:3000/aios/aios.git",
+            )
+
+    def test_gitea_lookup_and_listing_use_authenticated_api(self):
+        with tempfile.TemporaryDirectory() as td:
+            token = Path(td) / "token"
+            token.write_text("test-token", encoding="utf-8")
+            client = GiteaTagClient("https://gitea.invalid/api/v1", "aios/aios", token)
+            paths = []
+
+            def fake_get(path):
+                paths.append(path)
+                if "/git/refs/tags/" in path:
+                    return {"object": {"type": "tag", "sha": TAG_OID}}
+                if "/git/tags/" in path:
+                    return {"object": {"type": "commit", "sha": TARGET}}
+                return [{"name": "V9R9C9", "commit": {"sha": TARGET}}]
+
+            with patch.object(client, "_get", side_effect=fake_get):
+                self.assertEqual(client.lookup_tag("V9R9C9"), (TAG_OID, TARGET))
+                self.assertTrue(client.tag_visible_in_listing("V9R9C9", TARGET))
+            self.assertTrue(any("/git/refs/tags/" in path for path in paths))
+            self.assertTrue(any("/tags?limit=" in path for path in paths))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_gitea_tag_publication_live.py

@@ -0,0 +1,153 @@
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+import urllib.request
+import uuid
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
+
+from gitea_tag_publication import (  # noqa: E402
+    GiteaTagClient,
+    GitTagBackend,
+    PublicationRequest,
+)
+
+
+@unittest.skipUnless(
+    os.getenv("AIOS_GITOPS_LIVE_GITEA_TEST") == "1",
+    "set AIOS_GITOPS_LIVE_GITEA_TEST=1 on the isolated writer host",
+)
+class LiveTemporaryGiteaIntegrationTest(unittest.TestCase):
+    def test_authenticated_ref_api_and_listing_against_temporary_repository(self):
+        api_url = os.getenv(
+            "AIOS_GITOPS_GITEA_API_URL", "http://127.0.0.1:3000/api/v1"
+        ).rstrip("/")
+        credential = Path(
+            os.getenv(
+                "AIOS_GITOPS_LIVE_GITEA_TOKEN_FILE",
+                os.getenv(
+                    "AIOS_GITOPS_GITEA_TOKEN_FILE",
+                "/etc/aios-gitops/credentials/gitea-git-http",
+                ),
+            )
+        )
+        token_line = int(os.getenv("AIOS_GITOPS_LIVE_GITEA_TOKEN_LINE", "1"))
+        token = credential.read_text(encoding="utf-8").splitlines()[token_line - 1].strip()
+        name = "tag-atomicity-integration-" + uuid.uuid4().hex[:12]
+        owner = os.getenv("AIOS_GITOPS_LIVE_GITEA_OWNER", "gitops-bot")
+
+        def api_request(method: str, path: str, payload=None):
+            body = (
+                json.dumps(payload).encode("utf-8") if payload is not None else None
+            )
+            request = urllib.request.Request(
+                api_url + path,
+                data=body,
+                method=method,
+                headers={
+                    "Accept": "application/json",
+                    "Content-Type": "application/json",
+                    "Authorization": f"token {token}",
+                },
+            )
+            with urllib.request.urlopen(request, timeout=15) as response:
+                raw = response.read()
+                return json.loads(raw.decode("utf-8")) if raw else None
+
+        created = False
+        try:
+            repository = api_request(
+                "POST",
+                "/user/repos",
+                {"name": name, "private": True, "auto_init": False},
+            )
+            created = True
+            self.assertEqual(repository["full_name"], f"{owner}/{name}")
+            with tempfile.TemporaryDirectory() as td:
+                work = Path(td)
+                subprocess.run(["git", "init", "-q", "-b", "patch/live"], cwd=work, check=True)
+                subprocess.run(
+                    ["git", "config", "user.email", "gitops-test@example.invalid"],
+                    cwd=work,
+                    check=True,
+                )
+                subprocess.run(
+                    ["git", "config", "user.name", "gitops-integration"],
+                    cwd=work,
+                    check=True,
+                )
+                (work / "release").write_text("target\n", encoding="utf-8")
+                subprocess.run(["git", "add", "release"], cwd=work, check=True)
+                subprocess.run(
+                    ["git", "commit", "-q", "-m", "target"], cwd=work, check=True
+                )
+                target = subprocess.check_output(
+                    ["git", "rev-parse", "HEAD"], cwd=work, text=True
+                ).strip()
+                (work / "evidence").write_text("closure\n", encoding="utf-8")
+                subprocess.run(["git", "add", "evidence"], cwd=work, check=True)
+                subprocess.run(
+                    ["git", "commit", "-q", "-m", "evidence"], cwd=work, check=True
+                )
+                evidence = subprocess.check_output(
+                    ["git", "rev-parse", "HEAD"], cwd=work, text=True
+                ).strip()
+                remote_url = f"http://127.0.0.1:3000/{owner}/{name}.git"
+                subprocess.run(["git", "remote", "add", "gitea", remote_url], cwd=work, check=True)
+                username_file = work / ".fixture-user"
+                username_file.write_text(owner + "\n", encoding="utf-8")
+                askpass = work / ".fixture-askpass"
+                askpass.write_text(
+                    "#!/bin/sh\n"
+                    'case \"$1\" in\n'
+                    f'  *Username*) sed -n 1p "{username_file}" ;;\n'
+                    f'  *) sed -n {token_line}p "{credential}" ;;\n'
+                    "esac\n",
+                    encoding="utf-8",
+                )
+                askpass.chmod(0o700)
+                git_env = {
+                    **os.environ,
+                    "GIT_ASKPASS": str(askpass),
+                    "GIT_TERMINAL_PROMPT": "0",
+                }
+                subprocess.run(
+                    ["git", "push", "gitea", "HEAD:refs/heads/patch/live"],
+                    cwd=work,
+                    check=True,
+                    capture_output=True,
+                    text=True,
+                    env=git_env,
+                )
+                version = "V0R0C1-LIVE-" + uuid.uuid4().hex[:8]
+                release = PublicationRequest(version, target, evidence, "live-integration")
+                backend = GitTagBackend(work)
+                os.environ["GIT_ASKPASS"] = str(askpass)
+                os.environ["GIT_TERMINAL_PROMPT"] = "0"
+                backend.validate_evidence_lineage(release)
+                tag_oid, peeled = backend.ensure_local_annotated_tag(release)
+                backend.push_tag("gitea", version)
+                self.assertEqual(backend.remote_tag("gitea", version), (tag_oid, peeled))
+                client = GiteaTagClient(
+                    api_url,
+                    f"{owner}/{name}",
+                    credential,
+                    token_line=token_line,
+                )
+                self.assertEqual(client.repository_identity(), f"{owner}/{name}")
+                self.assertEqual(client.lookup_tag(version), (tag_oid, target))
+                self.assertTrue(client.tag_visible_in_listing(version, target))
+        finally:
+            if created:
+                api_request("DELETE", f"/repos/{owner}/{name}")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_search_gateway_general_capability.py

@@ -25,8 +25,11 @@ class SuccessProvider:
 
 
 def test_single_provider_failure_is_not_terminal():
-    gateway = SearchGateway(providers=[FailingProvider(), SuccessProvider()])
-    result = gateway.search(SearchRequest(query="policy update", requester="test", intent="policy_regulation"))
+    gateway = SearchGateway(providers=[SuccessProvider(), FailingProvider()])
+    result = gateway.search(SearchRequest(
+        query="policy update", requester="test", intent="policy_regulation",
+        group_profile={"provider_order": ["general_web", "official_site"]},
+    ))
     assert result.status == "found"
     assert any(a.status == "failed" for a in result.attempts)
     assert result.confidence == "high"

tests/test_silent_release_controller.py

@@ -0,0 +1,369 @@
+from __future__ import annotations
+
+import json
+import sys
+import tempfile
+import unittest
+from dataclasses import replace
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
+
+from silent_release_controller import (  # noqa: E402
+    AcceptanceEvidence,
+    ApprovalEnvelope,
+    ApprovalError,
+    ApprovalLedger,
+    DeploymentController,
+    DuplicateTagConflict,
+    ReleaseAcceptanceEngine,
+    ReleaseCandidate,
+    ReleaseCandidateStore,
+    ReleaseState,
+    SilentReleaseController,
+    SilentReleasePolicy,
+    TagApprovalEnvelope,
+    TagController,
+    redact,
+)
+
+
+COMMIT = "1" * 40
+TREE = "2" * 40
+ARTIFACT = "3" * 64
+MANIFEST = "4" * 64
+TAG_OID = "5" * 40
+TARGET = "6" * 40
+
+
+def candidate() -> ReleaseCandidate:
+    return ReleaseCandidate(
+        candidate_id="rc-20260723-001",
+        source_commit=COMMIT,
+        tree_oid=TREE,
+        artifact_sha256=ARTIFACT,
+        manifest_sha256=MANIFEST,
+    )
+
+
+def passing_evidence() -> AcceptanceEvidence:
+    return AcceptanceEvidence(
+        local_main_oid=COMMIT,
+        bare_main_oid=COMMIT,
+        gitea_main_oid=COMMIT,
+        repository_identity="aios/aios",
+        artifact_sha256=ARTIFACT,
+        manifest_sha256=MANIFEST,
+        manifest_source_commit=COMMIT,
+        manifest_tree_oid=TREE,
+        tests={"passed": True, "summary": "81 passed"},
+        canary={
+            "passed": True,
+            "runtime_without_git": True,
+            "writes_enabled": False,
+        },
+        rollback_ready=True,
+        authoritative_git_dir="/data/aios-gitops/repo.git",
+        authoritative_git_readable=True,
+    )
+
+
+class FakeProbe:
+    def __init__(self, evidence=None, error=None):
+        self.evidence = evidence or passing_evidence()
+        self.error = error
+        self.calls = 0
+
+    def collect(self, release_candidate):
+        self.calls += 1
+        if self.error:
+            raise self.error
+        return self.evidence
+
+
+class FakeBuilder:
+    def __init__(self):
+        self.calls = 0
+
+    def build(self, source_commit):
+        self.calls += 1
+        self.source_commit = source_commit
+        return candidate()
+
+
+class FakeDeployment:
+    def __init__(self, health=True, restart_error=None):
+        self.health = health
+        self.restart_error = restart_error
+        self.switched = 0
+        self.restarted = 0
+        self.rolled_back = 0
+
+    def atomic_switch(self, release_candidate):
+        self.switched += 1
+        return {"previous_target": "old", "new_target": release_candidate.candidate_id}
+
+    def restart(self):
+        self.restarted += 1
+        if self.restart_error:
+            raise self.restart_error
+
+    def health_check(self, release_candidate):
+        return {
+            "passed": self.health,
+            "runtime_commit": release_candidate.source_commit,
+            "writes_enabled": False,
+            "authoritative_head_oid": release_candidate.source_commit,
+            "repository_identity": "aios/aios",
+        }
+
+    def rollback(self, switch_evidence):
+        self.rolled_back += 1
+        return {"passed": True, "writes_enabled": False}
+
+
+class FakeTagAdapter:
+    def __init__(self):
+        self.current = None
+        self.creates = 0
+
+    def lookup(self, version):
+        return self.current
+
+    def create(self, version, tag_oid, target_oid):
+        self.creates += 1
+        self.current = (tag_oid, target_oid)
+
+    def verify(self, version):
+        return self.current
+
+
+class SilentReleaseControllerTests(unittest.TestCase):
+    def test_top_level_controller_automates_prepare_then_waits_for_owner(self):
+        builder = FakeBuilder()
+        with tempfile.TemporaryDirectory() as td:
+            store = ReleaseCandidateStore(Path(td) / "candidates")
+            controller = SilentReleaseController(
+                builder=builder,
+                acceptance=ReleaseAcceptanceEngine(
+                    FakeProbe(), expected_repository="aios/aios"
+                ),
+                deployment=DeploymentController(
+                    FakeDeployment(),
+                    ApprovalLedger(Path(td) / "approvals"),
+                    SilentReleasePolicy.default(),
+                    store,
+                    allow_legacy_unsigned_approval=True,
+                ),
+                store=store,
+                policy=SilentReleasePolicy.default(),
+            )
+            prepared = controller.prepare(COMMIT)
+            self.assertEqual(builder.calls, 1)
+            self.assertEqual(prepared.state, ReleaseState.READY_FOR_APPROVAL)
+            self.assertEqual(prepared.approval_state, "PENDING")
+            self.assertEqual(
+                store.load(prepared.candidate_id).state,
+                ReleaseState.READY_FOR_APPROVAL,
+            )
+
+    def test_candidate_model_round_trips_and_enforces_state_machine(self):
+        value = candidate()
+        self.assertEqual(value.state, ReleaseState.BUILDING)
+        value.transition(ReleaseState.VERIFYING)
+        restored = ReleaseCandidate.from_dict(value.to_dict())
+        self.assertEqual(restored.state, ReleaseState.VERIFYING)
+        with self.assertRaisesRegex(ValueError, "invalid release transition"):
+            restored.transition(ReleaseState.VERIFIED)
+
+    def test_acceptance_engine_moves_verified_candidate_to_ready(self):
+        value = candidate()
+        result = ReleaseAcceptanceEngine(
+            FakeProbe(), expected_repository="aios/aios"
+        ).evaluate(value)
+        self.assertTrue(result.ready)
+        self.assertEqual(value.state, ReleaseState.READY_FOR_APPROVAL)
+        self.assertTrue(value.rollback_ready)
+        self.assertTrue(value.tests["passed"])
+        self.assertTrue(value.canary["runtime_without_git"])
+        self.assertEqual(value.git_consistency["bare_main_oid"], COMMIT)
+        self.assertEqual(value.gitea_consistency["main_oid"], COMMIT)
+
+    def test_artifact_mismatch_fails_closed(self):
+        evidence = replace(passing_evidence(), artifact_sha256="9" * 64)
+        value = candidate()
+        result = ReleaseAcceptanceEngine(
+            FakeProbe(evidence), expected_repository="aios/aios"
+        ).evaluate(value)
+        self.assertFalse(result.ready)
+        self.assertEqual(value.state, ReleaseState.FAILED)
+        self.assertIn("artifact_sha256", result.failed_checks)
+
+    def test_gitea_unavailable_fails_closed(self):
+        value = candidate()
+        result = ReleaseAcceptanceEngine(
+            FakeProbe(error=RuntimeError("GITEA_UNAVAILABLE")),
+            expected_repository="aios/aios",
+        ).evaluate(value)
+        self.assertFalse(result.ready)
+        self.assertEqual(value.state, ReleaseState.FAILED)
+        self.assertIn("GITEA_UNAVAILABLE", value.failure_reason)
+
+    def test_git_unavailable_fails_closed(self):
+        value = candidate()
+        result = ReleaseAcceptanceEngine(
+            FakeProbe(error=RuntimeError("AUTHORITATIVE_GIT_UNAVAILABLE")),
+            expected_repository="aios/aios",
+        ).evaluate(value)
+        self.assertFalse(result.ready)
+        self.assertEqual(value.state, ReleaseState.FAILED)
+        self.assertIn("AUTHORITATIVE_GIT_UNAVAILABLE", value.failure_reason)
+
+    def test_runtime_with_git_metadata_is_rejected(self):
+        evidence = replace(
+            passing_evidence(),
+            canary={"passed": True, "runtime_without_git": False},
+        )
+        value = candidate()
+        result = ReleaseAcceptanceEngine(
+            FakeProbe(evidence), expected_repository="aios/aios"
+        ).evaluate(value)
+        self.assertFalse(result.ready)
+        self.assertIn("runtime_without_git", result.failed_checks)
+
+    def test_runtime_switch_requires_one_bound_owner_approval(self):
+        value = candidate()
+        ReleaseAcceptanceEngine(
+            FakeProbe(), expected_repository="aios/aios"
+        ).evaluate(value)
+        envelope = ApprovalEnvelope.for_candidate(
+            value,
+            approval_id="approval-001",
+            owner_id="owner",
+            expires_at="2099-01-01T00:00:00Z",
+        )
+        with tempfile.TemporaryDirectory() as td:
+            deployment = FakeDeployment()
+            controller = DeploymentController(
+                deployment,
+                ApprovalLedger(Path(td) / "approvals"),
+                SilentReleasePolicy.default(),
+                allow_legacy_unsigned_approval=True,
+            )
+            result = controller.deploy(value, envelope)
+            self.assertEqual(value.state, ReleaseState.VERIFIED)
+            self.assertTrue(result["verified"])
+            self.assertEqual(deployment.switched, 1)
+            self.assertEqual(deployment.restarted, 1)
+            self.assertEqual(deployment.rolled_back, 0)
+
+    def test_failed_health_check_rolls_back(self):
+        value = candidate()
+        ReleaseAcceptanceEngine(
+            FakeProbe(), expected_repository="aios/aios"
+        ).evaluate(value)
+        envelope = ApprovalEnvelope.for_candidate(
+            value,
+            approval_id="approval-rollback",
+            owner_id="owner",
+            expires_at="2099-01-01T00:00:00Z",
+        )
+        with tempfile.TemporaryDirectory() as td:
+            deployment = FakeDeployment(health=False)
+            result = DeploymentController(
+                deployment,
+                ApprovalLedger(Path(td) / "approvals"),
+                SilentReleasePolicy.default(),
+                allow_legacy_unsigned_approval=True,
+            ).deploy(value, envelope)
+            self.assertFalse(result["verified"])
+            self.assertEqual(value.state, ReleaseState.ROLLED_BACK)
+            self.assertEqual(deployment.rolled_back, 1)
+
+    def test_approval_replay_is_rejected(self):
+        value = candidate()
+        ReleaseAcceptanceEngine(
+            FakeProbe(), expected_repository="aios/aios"
+        ).evaluate(value)
+        envelope = ApprovalEnvelope.for_candidate(
+            value,
+            approval_id="approval-replay",
+            owner_id="owner",
+            expires_at="2099-01-01T00:00:00Z",
+        )
+        with tempfile.TemporaryDirectory() as td:
+            ledger = ApprovalLedger(Path(td) / "approvals")
+            controller = DeploymentController(
+                FakeDeployment(),
+                ledger,
+                SilentReleasePolicy.default(),
+                allow_legacy_unsigned_approval=True,
+            )
+            controller.deploy(value, envelope)
+            second = candidate()
+            ReleaseAcceptanceEngine(
+                FakeProbe(), expected_repository="aios/aios"
+            ).evaluate(second)
+            with self.assertRaisesRegex(ApprovalError, "already consumed"):
+                controller.deploy(second, envelope)
+
+    def test_tag_controller_is_separate_and_rejects_duplicate_conflict(self):
+        adapter = FakeTagAdapter()
+        adapter.current = (TAG_OID, TARGET)
+        controller = TagController(
+            adapter,
+            SilentReleasePolicy.default(),
+            ledger=None,
+            allow_legacy_unsigned_approval=True,
+        )
+        envelope = TagApprovalEnvelope(
+            approval_id="tag-approval-001",
+            owner_id="owner",
+            version="V9R9C9",
+            tag_oid="7" * 40,
+            target_oid=TARGET,
+            action="production_tag",
+            expires_at="2099-01-01T00:00:00Z",
+        )
+        approved = controller.approve(envelope)
+        with self.assertRaises(DuplicateTagConflict):
+            controller.execute(approved)
+        self.assertEqual(adapter.creates, 0)
+
+    def test_policy_separates_automatic_owner_and_forbidden_actions(self):
+        policy = SilentReleasePolicy.default()
+        self.assertTrue(policy.is_automatic("canary"))
+        self.assertTrue(policy.requires_owner("production_runtime_switch"))
+        self.assertTrue(policy.requires_owner("production_tag"))
+        self.assertTrue(policy.is_forbidden("force_push"))
+        self.assertTrue(policy.is_forbidden("tag_rewrite"))
+        self.assertTrue(policy.is_forbidden("direct_main_push"))
+        self.assertTrue(policy.is_forbidden("baseline_mutation"))
+        self.assertTrue(policy.is_forbidden("registry_mutation"))
+
+    def test_redaction_removes_credentials_from_errors(self):
+        message = (
+            "Authorization: Bearer super-secret-token "
+            "https://bot:password@example.invalid/repo.git token=another-secret"
+        )
+        safe = redact(message)
+        self.assertNotIn("super-secret-token", safe)
+        self.assertNotIn("password", safe)
+        self.assertNotIn("another-secret", safe)
+        self.assertIn("REDACTED", safe)
+
+    def test_candidate_store_persists_without_secret_fields(self):
+        value = candidate()
+        value.tests = {"passed": True, "Authorization": "Bearer hidden"}
+        with tempfile.TemporaryDirectory() as td:
+            store = ReleaseCandidateStore(Path(td))
+            store.save(value)
+            raw = store.path(value.candidate_id).read_text(encoding="utf-8")
+            self.assertNotIn("Bearer hidden", raw)
+            loaded = store.load(value.candidate_id)
+            self.assertEqual(loaded.candidate_id, value.candidate_id)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_weixin_bigint_parser.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+import subprocess
+from pathlib import Path
+
+
+PATCHER_PATH = Path(__file__).resolve().parents[1] / 'fixes' / 'patch_openclaw_weixin_bigint.py'
+
+
+def load_patcher():
+    spec = importlib.util.spec_from_file_location('patch_openclaw_weixin_bigint', PATCHER_PATH)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_api_patch_is_idempotent_and_scoped() -> None:
+    patcher = load_patcher()
+    ts = '\n'.join([
+        'import { fileURLToPath } from "node:url";',
+        'import { redactBody, redactUrl } from "../util/redact.js";',
+        'const resp: GetUpdatesResp = JSON.parse(rawText);',
+    ])
+    js = '\n'.join([
+        'import { fileURLToPath } from "node:url";',
+        'import { redactBody, redactUrl } from "../util/redact.js";',
+        'const resp = JSON.parse(rawText);',
+    ])
+    types = 'export interface WeixinMessage {\n  message_id?: number;\n}\n'
+
+    ts_once = patcher.patch_api_ts(ts)
+    js_once = patcher.patch_api_js(js)
+    types_once = patcher.patch_types_ts(types)
+
+    assert patcher.patch_api_ts(ts_once) == ts_once
+    assert patcher.patch_api_js(js_once) == js_once
+    assert patcher.patch_types_ts(types_once) == types_once
+    assert 'parseWeixinGetUpdatesJson(rawText)' in ts_once
+    assert 'parseWeixinGetUpdatesJson(rawText)' in js_once
+    assert 'message_id?: string | number;' in types_once
+
+
+def test_node_reviver_preserves_only_weixin_exact_ids() -> None:
+    script = '''
+const ids = new Set(["message_id", "msg_id", "root_id", "parent_id", "server_msg_id", "new_msg_id"]);
+const parsed = JSON.parse('{"ret":0,"seq":42,"msgs":[{"message_id":7482038281766381234,"create_time_ms":1783856936191,"item_list":[{"msg_id":"3123141975110186863"}]}]}', (key, value, context) => {
+  if (!ids.has(key) || value == null || typeof value === "string") return value;
+  if (typeof value !== "number" || !context?.source || !/^(?:0|[1-9]\\d*)$/.test(context.source)) throw new Error("unsafe id");
+  return context.source;
+});
+console.log(JSON.stringify({ messageId: parsed.msgs[0].message_id, msgId: parsed.msgs[0].item_list[0].msg_id, seqType: typeof parsed.seq, timestampType: typeof parsed.msgs[0].create_time_ms }));
+'''
+    completed = subprocess.run(['node', '-e', script], check=True, capture_output=True, text=True)
+    result = json.loads(completed.stdout)
+    assert result == {
+        'messageId': '7482038281766381234',
+        'msgId': '3123141975110186863',
+        'seqType': 'number',
+        'timestampType': 'number',
+    }

tests/test_weixin_image_followup_intent.py

@@ -0,0 +1,563 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+import subprocess
+from pathlib import Path
+
+import pytest
+
+
+def load_js_process_helpers() -> str:
+    patcher_path = Path(__file__).resolve().parents[1] / 'fixes' / 'patch_openclaw_weixin_hermes.py'
+    assert patcher_path.exists(), f'missing patcher: {patcher_path}'
+    spec = importlib.util.spec_from_file_location('patch_openclaw_weixin_hermes', patcher_path)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module.JS_PROCESS_HELPERS
+
+
+
+def load_patcher_module() -> object:
+    patcher_path = Path(__file__).resolve().parents[1] / 'fixes' / 'patch_openclaw_weixin_hermes.py'
+    assert patcher_path.exists(), f'missing patcher: {patcher_path}'
+    spec = importlib.util.spec_from_file_location('patch_openclaw_weixin_hermes', patcher_path)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+
+def run_js_process_helpers(tmp_path: Path, body: str) -> dict:
+    js_process_helpers = load_js_process_helpers()
+    node_prelude = '\n'.join(
+        [
+            'const hermesTestFs = require("node:fs");',
+            'globalThis.existsSync = hermesTestFs.existsSync;',
+            'globalThis.readFileSync = hermesTestFs.readFileSync;',
+            'globalThis.writeFileSync = hermesTestFs.writeFileSync;',
+            'globalThis.mkdirSync = hermesTestFs.mkdirSync;',
+            'globalThis.appendFileSync = hermesTestFs.appendFileSync;',
+            'globalThis.path = require("node:path");',
+            'globalThis.logger = { info() {}, warn() {}, error() {} };',
+        ]
+    )
+    node_script = tmp_path / 'hermes_image_followup_check.js'
+    node_script.write_text(node_prelude + '\n\n' + js_process_helpers + '\n\n' + body, encoding='utf-8')
+    completed = subprocess.run(['node', str(node_script)], check=True, capture_output=True, text=True)
+    return json.loads(completed.stdout.strip())
+
+
+@pytest.mark.parametrize('is_ts', [True, False], ids=['ts', 'js'])
+def test_replace_or_insert_process_helpers_is_byte_idempotent(is_ts: bool) -> None:
+    patcher = load_patcher_module()
+    marker = 'export async function processOneMessage'
+    source = marker + '(message) {\n  return message;\n}\n'
+
+    once = patcher.replace_or_insert_process_helpers(source, is_ts=is_ts)
+    twice = patcher.replace_or_insert_process_helpers(once, is_ts=is_ts)
+    helpers = patcher.TS_PROCESS_HELPERS if is_ts else patcher.JS_PROCESS_HELPERS
+
+    assert helpers + '\n\n' + marker in once
+    assert twice == once
+
+
+@pytest.mark.parametrize(
+    ('is_ts', 'hook_name'),
+    [(True, 'TS_PROCESS_HOOK'), (False, 'JS_PROCESS_HOOK')],
+    ids=['ts', 'js'],
+)
+def test_remove_and_reinsert_process_hook_is_byte_idempotent(is_ts: bool, hook_name: str) -> None:
+    patcher = load_patcher_module()
+    hook = getattr(patcher, hook_name)
+    indent = '  ' if is_ts else '    '
+    needle = indent + 'ctx.CommandAuthorized = commandAuthorized;\n'
+    next_nonblank = indent + 'continueProcessing();\n'
+
+    def cycle(text: str) -> str:
+        without_hook = patcher.remove_existing_process_hermes_hook(text)
+        return without_hook.replace(needle, needle + hook + '\n', 1)
+
+    once = cycle(needle + next_nonblank)
+    twice = cycle(once)
+
+    assert hook + '\n' + next_nonblank in once
+    assert twice == once
+
+
+
+def test_looks_like_hermes_image_followup_distinguishes_diagnostics_from_real_image_questions(tmp_path: Path) -> None:
+    cases = {
+        'diag_cache_expired': ('\u56fe\u7247\u7f13\u5b58\u5df2\u5931\u6548\uff0c\u8bf7\u91cd\u65b0\u53d1\u9001\u56fe\u7247\u3002', False),
+        'diag_cache_error_en': ('image cache error', False),
+        'diag_cache_expired_en': ('the image cache expired, please resend', False),
+        'diag_copying_text_shows_cache_error': ('\u4e3a\u4ec0\u4e48\u6211\u590d\u5236\u53d1\u7ed9\u4f60\u7684\u6587\u5b57\uff0c\u4f60\u90fd\u663e\u793a\u56fe\u7247\u7f13\u5b58\u5df2\u5931\u6548\uff0c\u8bf7\u91cd\u65b0\u53d1\u9001\u56fe\u7247\u3002', False),
+        'diag_not_image': ('\u8fd9\u4e0d\u662f\u56fe\u7247\uff0c\u662f\u6587\u5b57\u6d88\u606f', False),
+        'diag_text_not_image_en': ('this is a text message, not an image', False),
+        'diag_no_image_sent': ('\u6211\u6ca1\u6709\u53d1\u56fe\u7247', False),
+        'diag_system_logs': ('\u8bf7\u68c0\u67e5\u7cfb\u7edf\u65e5\u5fd7\uff0c\u4ece\u673a\u5236\u4e0a\u4fee\u590d\u9519\u8bef', False),
+        'image_cn_1': ('\u8bf7\u770b\u4e00\u4e0b\u8fd9\u5f20\u56fe\u7247', True),
+        'image_cn_2': ('\u8fd9\u56fe\u662f\u4ec0\u4e48', True),
+        'image_cn_3': ('\u8bc6\u522b\u56fe\u7247\u5185\u5bb9', True),
+        'image_en': ('look at this image', True),
+    }
+    results = run_js_process_helpers(
+        tmp_path,
+        'const cases = '
+        + json.dumps({key: text for key, (text, _) in cases.items()}, ensure_ascii=False)
+        + ';\nconst results = {};\n'
+        + 'for (const [key, text] of Object.entries(cases)) {\n'
+        + '  results[key] = looksLikeHermesImageFollowup(text);\n'
+        + '}\n'
+        + 'console.log(JSON.stringify(results));\n',
+    )
+    for key, (_, expected) in cases.items():
+        assert results[key] is expected, f'{key}: expected {expected}, got {results[key]!r}'
+
+
+
+def test_resolve_hermes_referenced_image_followup_requires_exact_cache(tmp_path: Path) -> None:
+    cache_path = tmp_path / 'hermes-last-image-cache.json'
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                'const fs = require("fs");',
+                f'const cachePath = {json.dumps(str(cache_path))};',
+                'const accountId = "account-a";',
+                'const senderId = "sender-b";',
+                'const exactQuotedId = "quoted-123";',
+                'const cache = {};',
+                'cache[hermesLastImageCacheKey(accountId, senderId)] = {',
+                '  mediaUrl: "data:image/png;base64,iVBORw0KGgo=",',
+                '  timestampMs: Date.now(),',
+                '  messageId: "latest-999",',
+                '  mediaType: "image/png",',
+                '};',
+                'cache[hermesExactImageCacheKey(accountId, senderId, exactQuotedId)] = {',
+                '  mediaUrl: "data:image/png;base64,iVBORw0KGgo=",',
+                '  timestampMs: Date.now(),',
+                '  messageId: exactQuotedId,',
+                '  mediaType: "image/png",',
+                '};',
+                'fs.writeFileSync(cachePath, JSON.stringify(cache, null, 2), "utf-8");',
+                'process.env.AIOS_HERMES_WEIXIN_LAST_IMAGE_CACHE = cachePath;',
+                'const generic = resolveHermesReferencedImageFollowup(accountId, senderId, "plain quoted text", "quoted-999");',
+                'const exact = resolveHermesReferencedImageFollowup(accountId, senderId, "plain quoted text", exactQuotedId);',
+                'const forced = resolveHermesFollowupImageContext(accountId, senderId, "plain quoted text", exactQuotedId, false, true);',
+                'console.log(JSON.stringify({ generic, exact, forced }));',
+            ]
+        ),
+    )
+
+    assert results['generic']['imageIntent'] is False
+    assert results['generic']['matched'] is False
+    assert results['generic']['reason'] == 'referenced_image_not_confirmed'
+    assert results['exact']['imageIntent'] is True
+    assert results['exact']['matched'] is True
+    assert results['exact']['reason'] == 'cached_image_matched'
+    assert results['forced']['imageIntent'] is True
+    assert results['forced']['matched'] is True
+
+
+
+def test_referenced_text_without_media_evidence_stays_out_of_image_cache(tmp_path: Path) -> None:
+    cache_path = tmp_path / 'hermes-last-image-cache.json'
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                'const fs = require("fs");',
+                f'const cachePath = {json.dumps(str(cache_path))};',
+                'const accountId = "account-a";',
+                'const senderId = "sender-b";',
+                'const cache = {};',
+                'cache[hermesLastImageCacheKey(accountId, senderId)] = {',
+                '  mediaUrl: "data:image/png;base64,iVBORw0KGgo=",',
+                '  timestampMs: Date.now(),',
+                '  messageId: "latest-999",',
+                '  mediaType: "image/png",',
+                '};',
+                'fs.writeFileSync(cachePath, JSON.stringify(cache, null, 2), "utf-8");',
+                'process.env.AIOS_HERMES_WEIXIN_LAST_IMAGE_CACHE = cachePath;',
+                'const full = { item_list: [{ ref_msg: { message_item: { type: 0, id: "quoted-999" } } }] };',
+                'const hermesContent = "\u8fd9\u662f\u4ec0\u4e48";',
+                'const hermesReferenceContextPresent = hasHermesReferenceContext(full.item_list);',
+                'const hermesQuotedMessageId = findHermesReferencedMessageId(full.item_list);',
+                'const refMediaItem = undefined;',
+                'const hermesReferencedMediaIsImage = Boolean(refMediaItem && hermesCurrentMessageIsImage({}, refMediaItem));',
+                'const hermesReferencedImageFollowupIntent = hermesReferenceContextPresent && !refMediaItem;',
+                'const hermesCurrentImage = false;',
+                'const hermesFollowup = hermesCurrentImage',
+                '  ? { imageIntent: false, matched: false, reason: "current_image_message", cacheStrategy: "current", quotedMessageId: hermesQuotedMessageId }',
+                '  : (hermesReferencedMediaIsImage',
+                '      ? resolveHermesFollowupImageContext(accountId, senderId, hermesContent, hermesQuotedMessageId, false, true)',
+                '      : (hermesReferencedImageFollowupIntent',
+                '          ? resolveHermesReferencedImageFollowup(accountId, senderId, hermesContent, hermesQuotedMessageId)',
+                '          : resolveHermesFollowupImageContext(accountId, senderId, hermesContent)));',
+                'console.log(JSON.stringify({ hermesReferenceContextPresent, hermesQuotedMessageId, hermesReferencedMediaIsImage, hermesReferencedImageFollowupIntent, hermesFollowup }));',
+            ]
+        ),
+    )
+
+    assert results['hermesReferenceContextPresent'] is True
+    assert results['hermesQuotedMessageId'] == 'quoted-999'
+    assert results['hermesReferencedMediaIsImage'] is False
+    assert results['hermesReferencedImageFollowupIntent'] is True
+    assert results['hermesFollowup']['imageIntent'] is False
+    assert results['hermesFollowup']['matched'] is False
+    assert results['hermesFollowup']['reason'] == 'referenced_image_not_confirmed'
+
+
+def test_explicit_quoted_text_builds_grounded_plain_text_context(tmp_path: Path) -> None:
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                'const available = typeof resolveHermesQuotedTextContext === "function";',
+                'const items = [{ type: 1, ref_msg: { message_item: { type: 1, text_item: { text: "被引用的正文" } } } }];',
+                'const result = available ? resolveHermesQuotedTextContext(items, "这是什么意思？") : null;',
+                'console.log(JSON.stringify({ available, result }));',
+            ]
+        ),
+    )
+
+    assert results['available'] is True
+    assert results['result'] == {
+        'referenced': True,
+        'handled': False,
+        'prompt': '[被引用文字]\n被引用的正文\n[/被引用文字]\n\n[当前问题]\n这是什么意思？\n[/当前问题]',
+        'reason': 'quoted_text_resolved',
+    }
+
+
+def test_visible_ref_title_builds_grounded_plain_text_context(tmp_path: Path) -> None:
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                'const items = [{ type: 1, ref_msg: { title: "客户端可见的引用正文", message_item: { type: 0, msg_id: "quoted-123" } } }];',
+                'const result = resolveHermesQuotedTextContext(items, "这是什么意思？");',
+                'console.log(JSON.stringify(result));',
+            ]
+        ),
+    )
+
+    assert results == {
+        'referenced': True,
+        'handled': False,
+        'prompt': '[被引用文字]\n客户端可见的引用正文\n[/被引用文字]\n\n[当前问题]\n这是什么意思？\n[/当前问题]',
+        'reason': 'quoted_text_resolved',
+    }
+
+
+def test_nested_generic_title_is_not_treated_as_quoted_text(tmp_path: Path) -> None:
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                'const items = [{ type: 1, ref_msg: { message_item: { type: 0, title: "非协议引用摘要" } } }];',
+                'const result = resolveHermesQuotedTextContext(items, "这是什么意思？");',
+                'console.log(JSON.stringify(result));',
+            ]
+        ),
+    )
+
+    assert results == {
+        'referenced': True,
+        'handled': True,
+        'replyText': '无法读取被引用文字，请复制原文后再提问。',
+        'reason': 'quoted_text_unavailable',
+    }
+
+
+def test_exact_message_id_cache_resolves_server_reference_without_guessing(tmp_path: Path) -> None:
+    cache_path = tmp_path / 'hermes-message-text-cache.json'
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                f'process.env.AIOS_HERMES_WEIXIN_TEXT_MESSAGE_CACHE = {json.dumps(str(cache_path))};',
+                'const accountId = "account-a";',
+                'const senderId = "sender-b";',
+                'const original = { item_list: [{ type: 1, msg_id: "7481729105240418312", text_item: { text: "客户端已经显示的原始正文" } }] };',
+                'rememberHermesTextMessage(accountId, senderId, original, "客户端已经显示的原始正文");',
+                'const quotedItems = [{ type: 1, ref_msg: { message_item: { type: 0, msg_id: "7481729105240418312" } }, text_item: { text: "这是什么意思？" } }];',
+                'const quotedId = findHermesReferencedMessageId(quotedItems);',
+                'const exact = resolveHermesCachedQuotedText(accountId, senderId, quotedId);',
+                'const wrong = resolveHermesCachedQuotedText(accountId, senderId, "7481729105240418313");',
+                'const resolved = resolveHermesQuotedTextContext(quotedItems, "这是什么意思？", exact);',
+                'const mode = (hermesTestFs.statSync(process.env.AIOS_HERMES_WEIXIN_TEXT_MESSAGE_CACHE).mode & 0o777).toString(8);',
+                'console.log(JSON.stringify({ quotedId, exact, wrong, resolved, mode }));',
+            ]
+        ),
+    )
+
+    assert results['quotedId'] == '7481729105240418312'
+    assert results['exact'] == '客户端已经显示的原始正文'
+    assert results['wrong'] == ''
+    assert results['resolved'] == {
+        'referenced': True,
+        'handled': False,
+        'prompt': '[被引用文字]\n客户端已经显示的原始正文\n[/被引用文字]\n\n[当前问题]\n这是什么意思？\n[/当前问题]',
+        'reason': 'quoted_text_resolved',
+    }
+    assert results['mode'] == '600'
+
+
+def test_expired_message_id_cache_entry_is_not_resolved(tmp_path: Path) -> None:
+    cache_path = tmp_path / 'hermes-message-text-cache.json'
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                f'process.env.AIOS_HERMES_WEIXIN_TEXT_MESSAGE_CACHE = {json.dumps(str(cache_path))};',
+                'const key = hermesTextMessageCacheKey("account-a", "sender-b", "quoted-old");',
+                'hermesTestFs.writeFileSync(process.env.AIOS_HERMES_WEIXIN_TEXT_MESSAGE_CACHE, JSON.stringify({ [key]: { text: "过期正文", timestampMs: Date.now() - (8 * 24 * 60 * 60 * 1000) } }), { encoding: "utf-8", mode: 0o600 });',
+                'const result = resolveHermesCachedQuotedText("account-a", "sender-b", "quoted-old");',
+                'console.log(JSON.stringify({ result }));',
+            ]
+        ),
+    )
+
+    assert results['result'] == ''
+
+
+def test_unsafe_numeric_message_id_is_rejected_before_cache_keying(tmp_path: Path) -> None:
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                'const exactString = extractHermesMessageId({ message_id: "7482038281766381234" });',
+                'const unsafeNumber = extractHermesMessageId({ message_id: 7482038281766381234 });',
+                'const safeNumber = extractHermesMessageId({ message_id: 12345 });',
+                'console.log(JSON.stringify({ exactString, unsafeNumber: unsafeNumber ?? null, safeNumber }));',
+            ]
+        ),
+    )
+
+    assert results == {
+        'exactString': '7482038281766381234',
+        'unsafeNumber': None,
+        'safeNumber': '12345',
+    }
+
+
+def test_exact_outbound_create_time_resolves_quoted_bot_text(tmp_path: Path) -> None:
+    cache_path = tmp_path / 'hermes-message-text-cache.json'
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                f'process.env.AIOS_HERMES_WEIXIN_TEXT_MESSAGE_CACHE = {json.dumps(str(cache_path))};',
+                'const accountId = "account-a";',
+                'const senderId = "sender-b";',
+                'const createTimeMs = 1783857900123;',
+                'rememberHermesOutboundTextMessage(accountId, senderId, "机器人出站正文", createTimeMs);',
+                'const quotedItems = [{ type: 1, ref_msg: { message_item: { type: 0, msg_id: "server-quoted", create_time_ms: createTimeMs } }, text_item: { text: "进展汇报" } }];',
+                'const referencedTime = findHermesReferencedCreateTimeMs(quotedItems);',
+                'const exact = resolveHermesCachedQuotedText(accountId, senderId, "server-quoted", referencedTime);',
+                'const wrong = resolveHermesCachedQuotedText(accountId, senderId, "server-quoted", createTimeMs + 1);',
+                'const resolved = resolveHermesQuotedTextContext(quotedItems, "进展汇报", exact);',
+                'console.log(JSON.stringify({ referencedTime, exact, wrong, resolved }));',
+            ]
+        ),
+    )
+
+    assert results['referencedTime'] == '1783857900123'
+    assert results['exact'] == '机器人出站正文'
+    assert results['wrong'] == ''
+    assert results['resolved']['reason'] == 'quoted_text_resolved'
+    assert '机器人出站正文' in results['resolved']['prompt']
+
+
+def test_outbound_create_time_collision_fails_closed(tmp_path: Path) -> None:
+    cache_path = tmp_path / 'hermes-message-text-cache.json'
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                f'process.env.AIOS_HERMES_WEIXIN_TEXT_MESSAGE_CACHE = {json.dumps(str(cache_path))};',
+                'const createTimeMs = 1783857900123;',
+                'rememberHermesOutboundTextMessage("account-a", "sender-b", "第一条", createTimeMs);',
+                'rememberHermesOutboundTextMessage("account-a", "sender-b", "第二条", createTimeMs);',
+                'const resolved = resolveHermesCachedQuotedText("account-a", "sender-b", undefined, createTimeMs);',
+                'console.log(JSON.stringify({ resolved }));',
+            ]
+        ),
+    )
+
+    assert results['resolved'] == ''
+
+
+def test_missing_quoted_text_fails_closed_without_model_prompt(tmp_path: Path) -> None:
+    results = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                'const available = typeof resolveHermesQuotedTextContext === "function";',
+                'const items = [{ type: 1, ref_msg: { message_item: { type: 0, msg_id: "7481729105240418312" } } }];',
+                'const result = available ? resolveHermesQuotedTextContext(items, "这是什么意思？") : null;',
+                'let modelCalls = 0;',
+                'if (result && !result.handled) modelCalls += 1;',
+                'console.log(JSON.stringify({ available, result, modelCalls }));',
+            ]
+        ),
+    )
+
+    assert results['available'] is True
+    assert results['result'] == {
+        'referenced': True,
+        'handled': True,
+        'replyText': '无法读取被引用文字，请复制原文后再提问。',
+        'reason': 'quoted_text_unavailable',
+    }
+    assert results['modelCalls'] == 0
+
+
+@pytest.mark.parametrize('hook_name', ['TS_PROCESS_HOOK', 'JS_PROCESS_HOOK'])
+def test_process_hook_stops_unavailable_quote_before_model_dispatch(hook_name: str) -> None:
+    patcher = load_patcher_module()
+    hook = getattr(patcher, hook_name)
+    guard_name = 'TS_QUOTED_TEXT_DISPATCH_GUARD' if hook_name.startswith('TS_') else 'JS_QUOTED_TEXT_DISPATCH_GUARD'
+    guard = getattr(patcher, guard_name)
+
+    assert 'rememberHermesTextMessage(deps.accountId, hermesSenderId, full, textBody)' in hook
+    assert 'findHermesReferencedCreateTimeMs(full.item_list)' in hook
+    assert 'resolveHermesCachedQuotedText(deps.accountId, hermesSenderId, hermesQuotedMessageId, hermesQuotedCreateTimeMs)' in hook
+    assert 'resolveHermesQuotedTextContext(full.item_list, hermesContent, hermesCachedQuotedText)' in hook
+    assert '!hermesQuotedTextContext.referenced && !textBody.startsWith("/")' in hook
+    assert 'ctx.Body = hermesQuotedTextContext.prompt' in hook
+    assert 'await dispatchHermesQuotedTextFailClosed(hermesQuotedTextContext, dispatcher)' in guard
+    assert 'markDispatchIdle();' in guard
+
+
+def test_dispatch_quoted_text_fail_closed_uses_dispatcher_without_model(tmp_path: Path) -> None:
+    result = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                '(async () => {',
+                '  const calls = [];',
+                '  const dispatcher = {',
+                '    sendFinalReply(payload) { calls.push(["final", payload]); },',
+                '    markComplete() { calls.push(["complete"]); },',
+                '    async waitForIdle() { calls.push(["idle"]); },',
+                '  };',
+                '  const context = resolveHermesQuotedTextContext([{ ref_msg: { message_item: { type: 0, msg_id: "quoted-1" } } }], "这是什么意思？");',
+                '  let modelCalls = 0;',
+                '  const handled = await dispatchHermesQuotedTextFailClosed(context, dispatcher);',
+                '  if (!handled) modelCalls += 1;',
+                '  console.log(JSON.stringify({ handled, modelCalls, calls }));',
+                '})();',
+            ]
+        ),
+    )
+
+    assert result['handled'] is True
+    assert result['modelCalls'] == 0
+    assert result['calls'] == [
+        ['final', {'text': '无法读取被引用文字，请复制原文后再提问。'}],
+        ['complete'],
+        ['idle'],
+    ]
+
+
+@pytest.mark.parametrize(
+    ('is_ts', 'guard_name', 'needle'),
+    [
+        (True, 'TS_QUOTED_TEXT_DISPATCH_GUARD', '  logger.debug(`dispatchReplyFromConfig: starting agentId=${route.agentId ?? "(none)"}`);\n'),
+        (False, 'JS_QUOTED_TEXT_DISPATCH_GUARD', '    logger.debug(`dispatchReplyFromConfig: starting agentId=${route.agentId ?? "(none)"}`);\n'),
+    ],
+    ids=['ts', 'js'],
+)
+def test_dispatch_guard_remove_and_reinsert_is_byte_idempotent(is_ts: bool, guard_name: str, needle: str) -> None:
+    patcher = load_patcher_module()
+    guard = getattr(patcher, guard_name)
+
+    def cycle(text: str) -> str:
+        without = patcher.remove_existing_process_hermes_hook(text)
+        return without.replace(needle, guard + '\n' + needle, 1)
+
+    once = cycle(needle)
+    twice = cycle(once)
+
+    assert guard + '\n' + needle in once
+    assert twice == once
+
+
+def test_reference_metadata_content_is_not_treated_as_quoted_text(tmp_path: Path) -> None:
+    result = run_js_process_helpers(
+        tmp_path,
+        '\n'.join(
+            [
+                'const items = [{ ref_msg: { message_item: { type: 0, msg_id: "quoted-1", content: "metadata only" } } }];',
+                'console.log(JSON.stringify(resolveHermesQuotedTextContext(items, "这是什么意思？")));',
+            ]
+        ),
+    )
+
+    assert result['handled'] is True
+    assert result['reason'] == 'quoted_text_unavailable'
+    assert result['replyText'] == '无法读取被引用文字，请复制原文后再提问。'
+
+
+def test_patch_plugin_process_only_skips_slash_and_channel(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    patcher = load_patcher_module()
+    calls: list[tuple[str, Path]] = []
+
+    def record(name: str, result):
+        def _inner(root: Path):
+            calls.append((name, root))
+            return result
+
+        return _inner
+
+    monkeypatch.setattr(patcher, 'patch_ts', record('patch_ts', False))
+    monkeypatch.setattr(patcher, 'patch_js', record('patch_js', False))
+    monkeypatch.setattr(patcher, 'patch_process_messages', record('patch_process_messages', {'src/messaging/process-message.ts': True, 'dist/src/messaging/process-message.js': False}))
+    monkeypatch.setattr(patcher, 'patch_channel_files', record('patch_channel_files', {'src/channel.ts': False, 'dist/src/channel.js': False}))
+    monkeypatch.setattr(patcher, 'verify_plugin_hook', record('verify_plugin_hook', {
+        'hook_status': {},
+        'hook_installed': False,
+        'process_status': {'src/messaging/process-message.ts': True, 'dist/src/messaging/process-message.js': True},
+        'process_hook_installed': True,
+        'channel_status': {},
+        'channel_hook_installed': False,
+        'dispatch_reference_found': False,
+        'dispatch_reference_files': [],
+    }))
+
+    result = patcher.patch_plugin(tmp_path, process_only=True)
+
+    assert calls == [
+        ('patch_process_messages', tmp_path),
+        ('verify_plugin_hook', tmp_path),
+    ]
+    assert result['mode'] == 'process-only'
+    assert result['plugin_root'] == str(tmp_path)
+    assert result['slash_changes'] == {}
+    assert result['channel_changes'] == {}
+    assert result['process_changes'] == {'src/messaging/process-message.ts': True, 'dist/src/messaging/process-message.js': False}
+    assert result['behavior_changes'] == {'src/messaging/process-message.ts': True, 'dist/src/messaging/process-message.js': False}
+    assert result['verification']['process_hook_installed'] is True
+
+
+
+def test_parse_args_supports_default_root_and_process_only_flag() -> None:
+    patcher = load_patcher_module()
+
+    defaults = patcher.parse_args([])
+    assert defaults.plugin_root == patcher.DEFAULT_PLUGIN_ROOT
+    assert defaults.process_only is False
+
+    process_only = patcher.parse_args(['--process-only'])
+    assert process_only.plugin_root == patcher.DEFAULT_PLUGIN_ROOT
+    assert process_only.process_only is True
+
+    custom_root = Path('/tmp/custom-plugin-root')
+    custom = patcher.parse_args([str(custom_root), '--process-only'])
+    assert custom.plugin_root == custom_root
+    assert custom.process_only is True

tests/test_weixin_outbound_quote_timestamp.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+
+
+PATCHER_PATH = Path(__file__).resolve().parents[1] / 'fixes' / 'patch_openclaw_weixin_outbound_quotes.py'
+
+
+def load_patcher():
+    spec = importlib.util.spec_from_file_location('patch_openclaw_weixin_outbound_quotes', PATCHER_PATH)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_send_patch_adds_exact_create_time_and_is_idempotent() -> None:
+    patcher = load_patcher()
+    ts = '''function buildTextMessageReq(params: {
+  to: string;
+  text: string;
+  contextToken?: string;
+  runId?: string;
+  clientId: string;
+}): SendMessageReq {
+  const { to, text, contextToken, runId, clientId } = params;
+  return { msg: { client_id: clientId, message_type: MessageType.BOT } };
+}
+export async function sendMessageWeixin(params: {}): Promise<{ messageId: string }> {
+  const { to, text, opts } = params;
+  const clientId = generateClientId();
+  const req = buildSendMessageReq({
+    payload: {},
+    clientId,
+  });
+  try {
+    await sendMessageApi({ body: req });
+  } catch (err) {
+    throw err;
+  }
+  return { messageId: clientId };
+}
+
+/** Send a single structured MessageItem downstream. */'''
+    js = '''function buildTextMessageReq(params) {
+    const { to, text, contextToken, runId, clientId } = params;
+    return { msg: { client_id: clientId, message_type: MessageType.BOT } };
+}
+export async function sendMessageWeixin(params) {
+    const clientId = generateClientId();
+    const req = buildSendMessageReq({
+        payload: {},
+        clientId,
+    });
+    try {
+        await sendMessageApi({ body: req });
+    }
+    catch (err) {
+        throw err;
+    }
+    return { messageId: clientId };
+}
+/** Send a single structured MessageItem downstream. */'''
+
+    ts_once = patcher.patch_send_ts(ts)
+    js_once = patcher.patch_send_js(js)
+    assert patcher.patch_send_ts(ts_once) == ts_once
+    assert patcher.patch_send_js(js_once) == js_once
+    for result in (ts_once, js_once):
+        assert 'const createTimeMs = Date.now();' in result
+        assert 'text item missing' in result
+        assert 'req.msg.item_list[0].create_time_ms = createTimeMs' in result
+        assert 'req.msg.create_time_ms = createTimeMs' not in result
+        assert 'return { messageId: clientId, createTimeMs }' in result

tools/run_online_smoke_18920.py

@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+import importlib.util
+import sys
+from pathlib import Path
+
+if len(sys.argv) != 3:
+    raise SystemExit('usage: run_online_smoke_18920.py <source-root> <output>')
+source_root = Path(sys.argv[1]).resolve()
+script = source_root / 'tools' / 'aios_v2r1c2_online_smoke.py'
+spec = importlib.util.spec_from_file_location('v2r1c2_online_smoke_production', script)
+if spec is None or spec.loader is None:
+    raise SystemExit('unable to load approved online smoke harness')
+module = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(module)
+module.BASE = 'http://127.0.0.1:18920'
+raise SystemExit(module.main(sys.argv[2]))

versions/V1R4C5.json

@@ -0,0 +1,38 @@
+{
+    "version": "V1R4C5",
+    "codename": "C5 reliability-security-admin",
+    "status": "active-baseline",
+    "tag": "V1R4C5",
+    "tag_ref": "refs/tags/V1R4C5",
+    "tag_object": "ac9bdacb19ff66cba8046d75358866f0f0fffb82",
+    "previous_version": "V1R4C3",
+    "rollback_version": "V1R4C3",
+    "baseline": "V1R4C3",
+    "release_reason": "reliability, watcher cleanup, user data isolation gate, and admin workbench read-only preparation; memory search disabled",
+    "purpose": "stabilize autonomous operations, enforce user isolation gate, prepare admin workbench read-only for C6",
+    "changes": [
+        "reliability: idle container GC with nixos-activate fallback retention policy and CI reset",
+        "watcher: remove redundant local async watcher, consolidate to server-pushed events",
+        "security: user data isolation gate (read-only admin panel, fb isolation check)",
+        "admin workbench: read-only preparation layout for V1R4C6 admin-search integration",
+        "governance: final owner approval via Owner Gate Web UI"
+    ],
+    "artifacts": [
+        "VERSION",
+        "docs/releases/V1R4C5-acceptance-evidence.md",
+        "docs/releases/V1R4C5-final-owner-approval.md"
+    ],
+    "validated_actions": [],
+    "secret_plaintext_written": false,
+    "owner_approval_required": true,
+    "owner_notification_channels": ["wechat", "web_ui_audit"],
+    "constraints_original": {
+        "memory_search": "remain disabled",
+        "sr04": "disable read-only visibility slice if RBAC or isolation check fails",
+        "gitea": "enter autonomous safe mode if branch consistency drift detected"
+    },
+    "promoted_at": "2026-07-11T02:17:31+08:00",
+    "promoted_by": "openclaw/admin",
+    "created_at": "2026-07-11T01:40:00+08:00",
+    "author": "openclaw"
+}

versions/V1R4C6.json

@@ -0,0 +1,111 @@
+{
+  "version": "V1R4C6",
+  "codename": "admin-search-agent-integration",
+  "status": "release-candidate-started",
+  "base_baseline": "V1R4C5",
+  "created_at": "2026-07-11",
+  "created_by": "chatgpt-gitops-bot",
+  "release_type": "controlled-bundled-integration",
+  "promotion_policy": "owner-gated",
+  "owner_decision": {
+    "accepted_scope": true,
+    "requested_delivery": "admin workbench, SR-03, and Agent Platform Integration in one release train",
+    "memory_search_enabled": false,
+    "force_push_allowed": false
+  },
+  "scope": {
+    "included_groups": [
+      {
+        "id": "V1R4C6-A",
+        "name": "Admin Workbench and Portal AIOS Read-Only Rollout",
+        "branches": [
+          "feature/v1r4c4-sr04-admin-workbench-visibility-20260711",
+          "feature/v1r4c4-sr04-portal-aios-visibility-20260710",
+          "patch/user-portal-me-route-diagnostics-20260709",
+          "patch/user-portal-rbac-ops-dashboard",
+          "patch/agent-observability-webui",
+          "patch/web-ui-complete-gitops-dashboard-20260706"
+        ],
+        "risk": "medium",
+        "delivery": "administrator-visible task progress, process diagrams, health, agent observability, and portal AIOS entry points",
+        "guardrails": [
+          "read-only first",
+          "RBAC enforced",
+          "empty states explicit",
+          "no cross-user or cross-project data exposure"
+        ]
+      },
+      {
+        "id": "V1R4C6-B",
+        "name": "SR-03 Search Gateway Real Provider Binding",
+        "branches": [
+          "feature/v1r4c4-sr02-search-gateway-resilience-20260710",
+          "patch/search-gateway-governed-general-capability",
+          "patch/gitops-change-archive-audit"
+        ],
+        "risk": "high",
+        "delivery": "real provider binding, governed search gateway, resilience, and audit trail",
+        "guardrails": [
+          "user data isolation gate required",
+          "scope filter before ranking",
+          "provenance required",
+          "no global memory/vector index"
+        ]
+      },
+      {
+        "id": "V1R4C6-C",
+        "name": "Agent Platform Integration",
+        "branches": [
+          "patch/agent-event-bus-unified",
+          "patch/agent-gpt-message-plane",
+          "patch/autonomous-controller-dispatch-20260709",
+          "patch/self-evolution-agent-orchestration-policy",
+          "patch/aios-autonomous-orchestrator-architecture-review-v1"
+        ],
+        "risk": "high",
+        "delivery": "agent event bus, GPT message plane, dispatch, orchestration policy, and architecture record",
+        "guardrails": [
+          "controller safe-mode respected",
+          "event/message scopes enforced",
+          "owner gate for consequential operations",
+          "observability before autonomous expansion"
+        ]
+      }
+    ],
+    "excluded": [
+      "memory search activation",
+      "global vector index",
+      "full cross-session recall",
+      "unscoped search over memory",
+      "bulk merge of test/smoke/auth branches",
+      "Gitea DB mutation",
+      "force-push reconciliation"
+    ]
+  },
+  "acceptance_required": [
+    "getRuntimeStatus active",
+    "getBaseline reports V1R4C5 before integration and V1R4C6 after promotion",
+    "Admin workbench RBAC read-only check passes",
+    "Portal AIOS manifest/dashboard/health routes verified",
+    "Flow/process diagram renders or returns explicit empty state",
+    "Search gateway provider binding returns scoped, provenanced results only",
+    "User data isolation acceptance remains green",
+    "Agent event bus and GPT message plane tests pass",
+    "Autonomous controller dispatch respects safe mode",
+    "Memory search remains disabled"
+  ],
+  "deployment_constraints": {
+    "AIOS_MEMORY_ENABLED": false,
+    "memory_search_activation_requires_future_owner_approval": true,
+    "force_push_allowed": false,
+    "gitea_db_mutation_requires_owner_admin_approval": true,
+    "admin_workbench_mode": "read_only_first",
+    "search_provider_scope": "scoped_only"
+  },
+  "rollback_policy": {
+    "admin_workbench": "disable new menu/routes if RBAC or route acceptance fails",
+    "search_gateway": "fallback to disabled provider binding, not memory search",
+    "agent_platform": "disable dispatch expansion and keep event/message plane read-only if safety tests fail",
+    "memory_search": "remain disabled"
+  }
+}

versions/V2R1C1.json

@@ -0,0 +1,55 @@
+{
+  "version": "V2R1C1",
+  "codename": "openclaw-command-v2-production-baseline",
+  "status": "PRODUCTION_DEPLOYED",
+  "tag": "V2R1C1",
+  "tag_ref": "refs/tags/V2R1C1",
+  "tag_object": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
+  "previous_version": "V1R4C6",
+  "rollback_version": "V1R4C6",
+  "baseline": "V1R4C6",
+  "release_reason": "Register the already deployed AIOS V2R1C1 release, immutable tag, OpenClaw Command v2 companion, and final production evidence in the central GitOps Registry.",
+  "purpose": "Close the central version-governance gap without changing product implementation, the V2R1C1 tag, production release, deployment, or traffic.",
+  "changes": [
+    "governance: add the canonical V2R1C1 version manifest",
+    "governance: advance the central baseline pointer from V1R4C6 to V2R1C1",
+    "governance: link release, companion, artifact, validation, and final audit evidence"
+  ],
+  "artifacts": [
+    "docs/releases/V2R1C1-BASELINE-CLOSURE.md",
+    ".agent/results/releases/V2R1C1-BASELINE-CLOSURE.json",
+    ".agent/results/releases/V2R1C1-BASELINE-CLOSURE.md",
+    "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z"
+  ],
+  "validated_actions": [
+    "release and tag OID equality",
+    "local and Gitea ref synchronization",
+    "OpenClaw Command v2 positive and negative validation",
+    "Gate A and Gate B",
+    "Hermes lifecycle 17/17",
+    "grant isolation 11/11",
+    "restart recovery",
+    "rollback and forward recovery",
+    "SQLite quick_check",
+    "secret scan with zero violations",
+    "final production healthcheck"
+  ],
+  "secret_plaintext_written": false,
+  "owner_approval_required": true,
+  "owner_notification_channels": [
+    "codex_owner_instruction",
+    "gitops_audit"
+  ],
+  "constraints_original": {
+    "product_code_changed": false,
+    "tag_changed": false,
+    "production_redeployed": false,
+    "production_traffic_changed": false,
+    "force_push_allowed": false,
+    "incubator_in_release_graph": false
+  },
+  "promoted_at": "2026-07-21T14:17:05Z",
+  "promoted_by": "chatgpt/owner-approved-governance",
+  "created_at": "2026-07-21T14:17:05Z",
+  "author": "chatgpt"
+}

versions/V2R1C2.json

@@ -0,0 +1,47 @@
+{
+  "version": "V2R1C2",
+  "codename": "unified-role-aware-portal",
+  "status": "PRODUCTION_DEPLOYED",
+  "tag": "V2R1C2",
+  "tag_ref": "refs/tags/V2R1C2",
+  "tag_object": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
+  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "evidence_closure_oid": "8cdca463aff9707edee00e20a3b56884130f6978",
+  "previous_version": "V2R1C1",
+  "rollback_version": "V2R1C1",
+  "baseline": "V2R1C1",
+  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
+  "release_reason": "Register the Owner-approved V2R1C2 candidate tag and verified evidence before a separately gated production promotion.",
+  "candidate_url": "http://127.0.0.1:18921",
+  "production_url": "http://127.0.0.1:18920",
+  "aggregate_gate": "PASS",
+  "required_stages": "3/3 SUCCEEDED",
+  "evidence_status": "COMPLETE",
+  "wechat_acceptance": "SYNTHETIC_ONLY",
+  "real_user_wechat_accepted": false,
+  "evidence_manifest_sha256": "2e27bb73b8e6297bd3077238f73a96d697fc3c3611c601c4dc9357e5fdcd8eee",
+  "evidence_checksums_sha256": "3dcedaff367d5d1a114640d8918304d1c39154d38b078f7f0b097a95d43978be",
+  "prepromotion_acceptance_sha256": "402e9ce7690654ea7fd493985284446365a827b61fe195576dc7f4e4d4499ef7",
+  "audited_tag_plan": "nl-1784681185786-19ac0f82",
+  "owner_release_authorization": "GRANTED",
+  "production_acceptance_sha256": "a6c35e12cab7907ab6bcfd37d781b3d216f05a5ae002aa54a3112c70f43b991a",
+  "production_online_smoke_sha256": "fe9c6964e440f8871f2eb225f0132f70c634923389f7b8dfa85f615b100980a4",
+  "production_evidence_index": "/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z/production-evidence.sha256",
+  "production_health_sha256": "ee8084e8b57d188dc0039a276f4f3f1ed7025ff58ce91b111cc765627eb52d4c",
+  "production_service": "aios-v2r1c2-production.service",
+  "production_promoted": true,
+  "main_changed_by_tag": false,
+  "main_changed_by_authorized_registry": true,
+  "force_push": false,
+  "constraints": {
+    "tag_rewrite_allowed": false,
+    "force_push_allowed": false,
+    "rollback_assets_must_be_preserved": true,
+    "production_promotion_requires_fresh_acceptance": true
+  },
+  "registered_at": "2026-07-22T01:18:36Z",
+  "promoted_at": "2026-07-22T01:40:51Z",
+  "updated_at": "2026-07-22T01:43:15Z",
+  "registered_by": "codex/owner-approved-gitops",
+  "promoted_by": "codex/owner-approved-gitops"
+}