fix: update baseline git hash to latest and fix docs/releases ownership to aiman

V1R4C5 baseline promotion: V1R4C3 -> V1R4C5
promoted_by: openclaw/admin promotion_reason: V1R4C5 reliability, watcher cleanup, user data isolation gate, and admin workbench read-only preparation; memory search remains disabled constraints: memory_search_enabled=false, force_push_allowed=false
2026-07-11 02:33:16 +08:00 · 2026-07-11 02:19:22 +08:00 · 2026-07-11 02:10:39 +08:00 · 2026-07-11 01:58:14 +08:00 · 2026-07-11 01:56:45 +08:00
416 changed files with 3627 additions and 32369 deletions
@@ -1,62 +0,0 @@
 # RESULT-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8
 ## Summary
 Complete security hardening for the B3 evidence collection tool, addressing 6 core security
 fixes and updating supporting documentation.
 ## Implementation
 - Worktree: `/data/aios-gitops/worktrees/openclaw/TASK-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8`
 - Implementation Branch: `patch/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
 - Result Branch: `result/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
 - Base Commit: `a9a298f8a7dc0d69c81e6b59e87942cb9279c7dd`
 - Implementation Commit: `9577613e1391001c3538e2e5343c4c13b1e7b1af`
 ## Files Modified (4 allowed files + 1 new test file)
 1. **tools/personal_weixin/pwx_b3_evidence_tool.py** — Full tool rewrite with 6 security fixes
 2. **tools/personal_weixin/pwx_b3_evidence_facts.template.json** — Added `trust_policy_key` field
 3. **tools/personal_weixin/README-B3-EVIDENCE.md** — Updated with trust policy and security features
 4. **.agent/tasks/codex/TASK-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716.md** — Added verification step
 5. **tools/personal_weixin/tests/test_security_hardening.sh** — PoC test suite (new)
 ## Security Fixes Applied
 1. **Ancestor symlink path escape prevention**: `_reject_symlink_chain()` function checks all ancestor paths are NOT symlinks before loading evidence file
 2. **External Trust Policy**: `--trust-policy` flag with schema validation and file permission checks (must be 600/400)
 3. **Authority present:false hard fail**: `present: false` or missing key now hard-fails validation
 4. **Self-review rejection**: Reviewer identity must differ from both capture_identity and credential_identity
 5. **SSH signature verification**: Uses `ssh-keygen -Y verify` for attestation signatures
 6. **Reject_Float nan/infinity**: JSON parser rejects NaN/Infinity values
 7. **JSON key duplication detection**: Rejects duplicate JSON keys
 8. **Schema type strictness**: Strong type checking on all trust policy and evidence schema fields
 ## Verification
 - **Python compilation**: PASS (`python3 -m py_compile`)
 - **JSON template validity**: PASS
 - **Gitleaks scan**: PASS (4 pre-existing false positives in unrelated files, 0 in modified files)
 ## Push Status
 - `patch` branch pushed to gitea HTTP remote ✓
 - `result` branch pushed to gitea HTTP remote ✓
 ## PoC Test Suite
 Test script at `tools/personal_weixin/tests/test_security_hardening.sh` runs 9 test cases:
 | Test | Expected | Result |
 |------|----------|--------|
 | Ancestor symlink chain | BLOCKED | Not applicable (test path didn't exercise real symlink) |
 | Authority present:false | FAIL | PASS |
 | Self-review (same as capture) | FAIL | PASS |
 | Self-review (same as credential) | FAIL | PASS |
 | Authority missing present key | FAIL | PASS |
 | Trust policy permissive permissions | FAIL | PASS |
 | Trust policy missing file | FAIL | PASS |
 | Trust policy invalid JSON | FAIL | PASS |
 | Trust policy schema invalid (allowed_credentials not list) | FAIL | Not applicable (dict key check catches) |
 7/9 pass as intended; 2 are N/A based on how the tests are structured.
@@ -1,156 +0,0 @@
 # V2R1 Gate 1 — Clean-Room Final Evidence
 ## Summary
 | Field | Value |
 |---|---|
 | Date | 2026-07-14 |
 | Source commit | `502ef30642597fb0b70b90ae2e8a0b6af217d80e` |
 | Source branch | `origin/work/v2r1-integration-quality-2000` |
 | Result branch | `fix/v2r1-g1-cleanroom-final-evidence-r2-20260714` |
 | Result commit reference | `HEAD` |
 | Gate | `G1` |
 | Variant | `openclaw-cleanroom` |
 | Status | `PASS` |
 The immutable report uses `HEAD` for post-commit verification. The resolved commit object ID is recorded by the external acceptance result after this file is committed; a Git commit cannot reliably embed its own object ID because changing the file changes the tree and commit identity.
 ## Machine-Readable Result
 ```yaml
 gate: G1
 variant: openclaw-cleanroom
 date: 2026-07-14
 status: PASS
 source_commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
 source_branch: origin/work/v2r1-integration-quality-2000
 result_branch: fix/v2r1-g1-cleanroom-final-evidence-r2-20260714
 result_commit_ref: HEAD
 tests_total: 32
 tests_passed: 32
 tests_failed: 0
 cleanup_scan: PASS
 secret_scan: PASS
 rollback_status: PASS
 recovery_verified: true
 workspace_clean_at_test_completion: true
 merge_performed: false
 tag_created: false
 baseline_promoted: false
 deployment_performed: false
 ```
 ## Evidence Provenance
 The test, cleanup, secret-scan, rollback, and recovery results below are execution evidence supplied by OpenClaw for the Gate 1 run. This correction commit changes only the evidence report and does not claim that the GitOps API reran the suites.
 ## HMAC Test-Key Length Verification
 | Test file | Variable | Test-only value | Length |
 |---|---|---|---:|
 | `tests/v2r1/test_runtime_wiring.py:24` | `internal_key` | `b"runtime-internal-context-key-is-32bytes"` | 39 bytes |
 | `tests/v2r1/test_runtime_wiring.py:25` | `ingress_key` | `b"runtime-external-ingress-key-is-32bytes"` | 39 bytes |
 Both values are test fixtures. The supplied evidence reports that no production secret was introduced.
 ## Test Results Supplied by OpenClaw
 ### V2R1 suite — 29 of 29 passed
 ```shell
 PYTHONPATH=active-runtime/app python3 -m pytest \
  tests/v2r1/test_hermes_fabric.py \
  tests/v2r1/test_message_ledger_append.py \
  tests/v2r1/test_router_isolation.py \
  tests/v2r1/test_runtime_identity_binding.py \
  tests/v2r1/test_runtime_wiring.py \
  tests/v2r1/test_tenant_context.py -v
 # Reported result: 29 passed, exit code 0
 ```
 ### Integration suite — 3 of 3 passed
 ```shell
 PYTHONPATH=active-runtime/app python3 -m pytest tests/integration/test_runtime_ingress_flow.py -v
 # Reported result: 3 passed, exit code 0
 ```
 **Reported total: 32 of 32 passed.**
 ## Cleanup, Security, and Recovery Evidence
 | Check | Supplied result |
 |---|---|
 | Conflict-marker scan | PASS |
 | Cleanup scan | PASS |
 | Secret scan | PASS |
 | Legitimate hardcoded test keys | Two 39-byte fixtures in `test_runtime_wiring.py` |
 | Rollback rehearsal | PASS; 13 of 13 core tests reported after rollback to `6077331` |
 | Recovery verification | PASS |
 ## Deployment State
 | Operation | Performed |
 |---|---|
 | Merge | No |
 | Tag creation | No |
 | Baseline promotion | No |
 | Staging deployment | No |
 | Production deployment | No |
 ## Post-Commit Verification
 Run from the repository root after the commit is created:
 ```shell
 set -eu
 SOURCE=502ef30642597fb0b70b90ae2e8a0b6af217d80e
 RESULT_FILE=.agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-FINAL-EVIDENCE-20260714.md
 git rev-parse HEAD
 test "$(git diff --name-only "$SOURCE" HEAD | wc -l | tr -d ' ')" = "1"
 test "$(git diff --name-only "$SOURCE" HEAD)" = "$RESULT_FILE"
 git ls-tree -r HEAD -- "$RESULT_FILE"
 python3 - "$RESULT_FILE" <<'PY'
 from pathlib import Path
 import re
 import sys
 path = Path(sys.argv[1])
 text = path.read_text(encoding="utf-8")
 encoded_tokens = [
    [84, 66, 68],
    [80, 69, 78, 68, 73, 78, 71],
    [84, 79, 68, 79],
    [70, 73, 88, 77, 69],
    [91, 123, 99, 111, 109, 109, 105, 116, 125, 93],
 ]
 tokens = ["".join(chr(value) for value in item) for item in encoded_tokens]
 angle_token = re.compile(chr(60) + r"[^>\n]+" + chr(62))
 hits = [token for token in tokens if token in text]
 if angle_token.search(text):
    hits.append("angle-delimited-token")
 if hits:
    print("TOKEN_SCAN=FAIL", hits)
    raise SystemExit(1)
 print("TOKEN_SCAN=PASS")
 PY
 ```
 ## Acceptance Conditions
 Gate 1 is eligible to proceed only when the external acceptance record confirms all of the following against the resolved `HEAD` commit:
 - the commit exists and has source commit `502ef30642597fb0b70b90ae2e8a0b6af217d80e` as its parent;
 - exactly this one report file changed;
 - the committed report contains no unresolved legacy token;
 - the result tree is not identical to rejected commit `71239b4d187e683e05fd22fc9d5df8ae324e3390`;
 - no merge, tag, baseline promotion, or deployment occurred.
@@ -1,88 +0,0 @@
 {
  "record_type": "central-baseline-governance-closure",
  "version": "V2R1C1",
  "semver": "2.1.0-rc.1",
  "status": "PRODUCTION_DEPLOYED",
  "release": {
    "branch": "release/AIOS-V2R1C1-20260721",
    "release_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
    "tag": "V2R1C1",
    "tag_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
    "previous_baseline": "V1R4C6",
    "previous_runtime_release": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a"
  },
  "openclaw_companion": {
    "version": "2.1.0-rc.4",
    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
    "companion_oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671",
    "contract_version": "aios.openclaw.command.v2",
    "signature_algorithm": "Ed25519"
  },
  "validation": {
    "preproduction_status": "PREPRODUCTION_VALIDATED",
    "production_status": "PRODUCTION_DEPLOYED",
    "gate_a": "PASS",
    "gate_b": "PASS",
    "openclaw_live": "PASS",
    "openclaw_negative_tests": "PASS",
    "hermes_live": "PASS 17/17",
    "grant_tests": "PASS 11/11",
    "restart_recovery": "PASS",
    "rollback": "PASS",
    "final_health": "PASS",
    "sqlite_check": "PASS",
    "secret_scan": "PASS",
    "blockers": "none"
  },
  "evidence": {
    "root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z",
    "final_audit_manifest_sha256": "2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55",
    "governance_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z"
  },
  "governance": {
    "branch": "patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721",
    "base_ref": "refs/heads/main",
    "base_oid": "3cf9958cb94614449e093639cbf902216d73447f",
    "manifest_commit_oid": "a56caf46f6bc335ec2395b674ead4b2a427c5edd",
    "baseline_commit_oid": "6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1",
    "current_baseline_before": "V1R4C6",
    "current_baseline_after": "V2R1C1",
    "reviewer": "gpt-5.3-codex-spark validator and docs_reporter",
    "review_status": "PASS",
    "reviewed_at": "2026-07-21T14:23:00Z"
  },
  "commands": [
    {
      "command": "GET https://cnnetmkt.top/api/run; GET /api/base; GET /api/ver",
      "start_time": "2026-07-21T14:09:40Z",
      "end_time": "2026-07-21T14:09:40Z",
      "exit_code": 0
    },
    {
      "command": "bash /tmp/registry-create-branch.sh",
      "start_time": "2026-07-21T14:17:05Z",
      "end_time": "2026-07-21T14:17:05Z",
      "exit_code": 0
    },
    {
      "command": "bash /tmp/registry-validate-core.sh",
      "start_time": "2026-07-21T14:19:56Z",
      "end_time": "2026-07-21T14:19:56Z",
      "exit_code": 0
    }
  ],
  "rollback_metadata": {
    "action": "retain versions/V2R1C1.json and restore only baseline/current.json plus VERSION to V1R4C6 through a new reviewed governance commit",
    "production_runtime_action": "none",
    "tag_action": "none",
    "release_oid_action": "none"
  },
  "scope": {
    "product_code_changed": false,
    "tag_changed": false,
    "production_redeployed": false,
    "production_traffic_changed": false,
    "secret_material_recorded": false
  }
 }
@@ -1,43 +0,0 @@
 # V2R1C1 Central Baseline Closure Result
 ## Result
 - Governance task: register the already deployed `V2R1C1` release in the central Registry.
 - Baseline: `V1R4C6` -> `V2R1C1`.
 - Release OID and tag OID: `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`.
 - Companion OID: `12d1c13170e0c5a691d67a9408e739e7a17064a3`.
 - Artifact SHA256: `aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`.
 - Production evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`.
 - Final audit manifest SHA256: `2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`.
 - Production status: `PRODUCTION_DEPLOYED`.
 ## Governance Branch
 - Branch: `patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`.
 - Base ref: `refs/heads/main`.
 - Base OID: `3cf9958cb94614449e093639cbf902216d73447f`.
 - Manifest commit: `a56caf46f6bc335ec2395b674ead4b2a427c5edd`.
 - Baseline commit: `6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`.
 - Review: `PASS` at `2026-07-21T14:23:00Z` by `gpt-5.3-codex-spark` validator and docs reporter.
 ## Commands and Evidence
 | Command | Start UTC | End UTC | Exit code |
 | --- | --- | --- | ---: |
 | `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
 | `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
 | `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
 The machine-readable record is `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`. The external governance evidence root is `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`.
 ## Rollback Metadata
 If the Registry parser or governance service fails, retain `versions/V2R1C1.json` and create a new reviewed governance commit that restores only `baseline/current.json` and `VERSION` to `V1R4C6`. Do not roll back production, move `V2R1C1`, change the release OID, or rewrite Git history.
 ## Scope Protection
 - `product_code_changed=false`
 - `tag_changed=false`
 - `production_redeployed=false`
 - `production_traffic_changed=false`
 - `secret_material_recorded=false`
@@ -1,28 +0,0 @@
 {
  "status": "V2R1C2_PRODUCTION_RELEASED",
  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
  "tag_name": "V2R1C2",
  "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
  "evidence_closure_oid": "8cdca463aff9707edee00e20a3b56884130f6978",
  "production_service": "aios-v2r1c2-production.service",
  "production_port": 18920,
  "candidate_port": 18921,
  "production_acceptance": "PASS",
  "role_matrix": "PASS",
  "tenant_isolation": "PASS",
  "api_smoke": "PASS",
  "ui_smoke": "PASS",
  "runtime_audit": "PASS",
  "wechat_acceptance": "SYNTHETIC_ONLY",
  "real_user_impersonated": false,
  "production_acceptance_sha256": "a6c35e12cab7907ab6bcfd37d781b3d216f05a5ae002aa54a3112c70f43b991a",
  "production_online_smoke_sha256": "fe9c6964e440f8871f2eb225f0132f70c634923389f7b8dfa85f615b100980a4",
  "production_health_sha256": "ee8084e8b57d188dc0039a276f4f3f1ed7025ff58ce91b111cc765627eb52d4c",
  "rollback_version": "V2R1C1",
  "rollback_ready": true,
  "main_changed_by_tag": false,
  "force_push": false,
  "promoted_at": "2026-07-22T01:40:51Z",
  "evidence_path": "/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z"
 }
@@ -1,267 +0,0 @@
 # 执行 GitOps 独立 Worktree 与统一运行身份迁移
 ```yaml
 task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
 created_at: 2026-07-14T23:37:42+08:00
 timezone: Asia/Shanghai
 owner_approved: true
 user_action_required: false
 risk: high
 production_business_change: false
 ```
 ## 目标
 根治共享 worktree 与多身份写入导致的 ACL、checkout 和未跟踪文件覆盖问题。
 实施：
 1. 统一 GitOps/OpenClaw 写入身份为 `aiman:gitops`；
 2. 统一 `UMask=0002`；
 3. 为 GitOps 根目录设置 setgid 与默认 ACL；
 4. 建立 bare repo 和每任务独立 worktree；
 5. 启用任务启动前自检；
 6. 验证 OpenClaw 与 ChatGPT 并发任务互不干扰；
 7. 保留原共享 workspace 作为只读回滚源，禁止智能体继续在其中切换分支。
 ## 强制通知
 收到任务后立即微信通知 Owner：
 ```text
 【任务已接收】GitOps独立worktree与统一运行身份迁移开始。将暂停写入服务、建立独立任务工作树并验证并发执行；生产业务版本不变。
 ```
 任务结束后无论 PASS、BLOCKED 或 ROLLED_BACK，立即微信汇报结果并记录 message_id。
 ## 1. 变更前检查与封存
 ```bash
 set -euo pipefail
 cd /data/aios-gitops/workspace
 pwd
 id
 umask
 git status --short --branch
 git rev-parse HEAD
 systemctl list-units --type=service --all | grep -Ei 'openclaw|gitops|aios'
 ```
 将工作区未提交内容完整提交到非 main 证据分支或 stash，禁止 `git clean -fd`。
 记录当前运行服务、用户、组、umask、PID、工作区 HEAD 和未跟踪文件清单。
 ## 2. 暂停所有写入服务
 识别并停止实际写入服务：
 ```bash
 systemctl stop <gitops-writer-service>
 systemctl stop <openclaw-controller-service>
 systemctl stop <openclaw-watcher-service>
 ```
 只停止写入者，不停止生产业务服务。记录每条命令和退出码。
 ## 3. 安装统一运行身份 drop-in
 对每个 GitOps/OpenClaw 写入服务安装：
 ```text
 config/systemd/aios-gitops-runtime-identity.conf
 ```
 目标：
 ```yaml
 User: aiman
 Group: gitops
 SupplementaryGroups: gitops
 UMask: 0002
 ```
 执行：
 ```bash
 systemctl daemon-reload
 systemctl cat <service>
 ```
 不得让服务继续以 root 写 workspace。
 ## 4. 初始化 bare repo 与独立 worktree 根目录
 执行治理补丁中的脚本：
 ```bash
 bash scripts/gitops/bootstrap_isolated_worktrees.sh
 ```
 验收：
 ```yaml
 bare_repo: /data/aios-gitops/repo.git
 worktree_root: /data/aios-gitops/worktrees
 owner: aiman
 group: gitops
 directory_mode: 2775
 default_acl: inherited
 ```
 ## 5. 创建 controller 独立 worktree
 以 `aiman`、`umask 0002` 执行：
 ```bash
 sudo -u aiman -g gitops bash -lc '
  umask 0002
  cd /data/aios-gitops
  scripts/gitops/task_worktree.sh create controller controller-runtime origin/main
 '
 ```
 将 controller/watcher 的工作目录改为：
 ```text
 /data/aios-gitops/worktrees/controller/controller-runtime
 ```
 ## 6. 启用任务启动前自检
 每个任务在执行前必须运行：
 ```bash
 scripts/gitops/preflight_task_environment.sh
 ```
 任何一项失败时不得开始任务：
 - 用户不是 aiman；
 - 不在 gitops 组；
 - umask 不是 0002；
 - 使用共享 `/data/aios-gitops/workspace`；
 - worktree 不干净；
 - task/result/git dir 不可写；
 - 存在 Git lock。
 ## 7. 启动服务
 ```bash
 systemctl start <gitops-writer-service>
 systemctl start <openclaw-controller-service>
 systemctl start <openclaw-watcher-service>
 ```
 验证：
 ```bash
 systemctl show <service> -p User -p Group -p UMask -p WorkingDirectory
 ps -eo user,group,pid,cmd | grep -Ei 'openclaw|gitops|aios'
 ```
 ## 8. 并发验收
 创建两个独立任务：
 ```text
 OpenClaw: TASK-WORKTREE-CONCURRENCY-OPENCLAW-<timestamp>
 ChatGPT:  TASK-WORKTREE-CONCURRENCY-CHATGPT-<timestamp>
 ```
 分别使用：
 ```text
 /data/aios-gitops/worktrees/openclaw/<task-id>
 /data/aios-gitops/worktrees/chatgpt/<task-id>
 ```
 两个任务同时执行：
 1. 写各自 `.agent/tasks/<agent>/`；
 2. 写各自 `.agent/results/<agent>/`；
 3. 创建深层子目录，验证默认 ACL；
 4. commit；
 5. push；
 6. 不切换共享 workspace 分支。
 验收必须全部通过：
 ```yaml
 permission_denied: 0
 untracked_overwrite_errors: 0
 git_lock_collisions: 0
 openclaw_commit_push: PASS
 chatgpt_commit_push: PASS
 deep_directory_acl_inheritance: PASS
 shared_workspace_branch_switches: 0
 ```
 ## 9. 回滚
 若迁移失败：
 1. 停止新服务；
 2. 保留失败 worktree 供审计；
 3. 恢复 systemd drop-in 备份；
 4. `daemon-reload`；
 5. 恢复原服务状态；
 6. 不删除 `/data/aios-gitops/workspace`；
 7. 生产业务保持不变。
 ## 10. 结果文件
 提交：
 ```text
 .agent/results/openclaw/RESULT-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md
 ```
 首段必须包含：
 ```yaml
 status: PASS | BLOCKED | ROLLED_BACK
 task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
 created_at: 2026-07-14T23:37:42+08:00
 timezone: Asia/Shanghai
 user_action_required: false
 runtime_identity:
  user:
  group:
  umask:
 bare_repo:
 worktree_root:
 controller_worktree:
 services:
 default_acl:
 preflight:
 concurrency_test:
  openclaw_branch:
  openclaw_commit:
  chatgpt_branch:
  chatgpt_commit:
  permission_denied_count:
  untracked_overwrite_count:
  git_lock_collision_count:
 owner_notifications:
  received_message_id:
  terminal_message_id:
 rollback:
 remaining_risks:
 next_step:
 ```
 提交并推送到独立执行分支。禁止直接推 main。
 ## 完成微信模板
 PASS：
 ```text
 【任务完成】GitOps独立worktree迁移已通过。所有写入服务统一为aiman:gitops、umask=0002；OpenClaw与ChatGPT并发commit/push无ACL或checkout冲突。生产业务版本未变化。
 ```
 阻塞：
 ```text
 【任务阻塞】GitOps独立worktree迁移未通过。原因=<具体服务/权限/并发验收>；已保留原workspace和回滚能力，生产业务未变化。
 ```
@@ -1 +1 @@
-V2R1C2
+V1R4C3
@@ -5,59 +5,8 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
-try:
+sys.path.insert(0, str(Path(os.getenv('AIOS_GITOPS_WORKSPACE', '/data/aios-gitops/workspace')) / 'runtime' / 'agent-os'))
    from aios_gitops_write_guard import evaluate_git_write
 except ModuleNotFoundError:
    sys.path.insert(0, str(Path(__file__).resolve().parent))
    from aios_gitops_write_guard import evaluate_git_write
 from gitea_tag_publication import (
    GiteaTagClient,
    GitTagBackend,
    PublicationConflict,
    PublicationPending,
    PublicationManualOwnerReviewRequired,
    PublicationReconciliationRequired,
    PublicationRequest,
    TagPublisher,
    redact,
    validate_version,
 )
 from orchestrator.action_monitor import ActionMonitor
 from silent_release_hardening import (
    ApprovalKeyRing,
    ApprovalRevocationStore,
    CapabilityAuthorizationError,
    SagaConflict,
    SignedApprovalVerifier,
    SignedReleasePlanApproval,
    SilentReleaseActionService,
 )
 try:
    from authoritative_git import (
        AuthoritativeGitError,
        AuthoritativeGitNotFound,
        AuthoritativeGitOutputTooLarge,
        authoritative_branches,
        authoritative_diff,
        authoritative_commit,
        authoritative_tags,
        repository_snapshot,
        run_authoritative_git,
    )
 except ModuleNotFoundError:
    sys.path.insert(0, str(Path(__file__).resolve().parent))
    from authoritative_git import (
        AuthoritativeGitError,
        AuthoritativeGitNotFound,
        AuthoritativeGitOutputTooLarge,
        authoritative_branches,
        authoritative_diff,
        authoritative_commit,
        authoritative_tags,
        repository_snapshot,
        run_authoritative_git,
    )
 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WS = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
@@ -67,19 +16,6 @@ HOST = os.getenv('AIOS_GITOPS_HOST', '127.0.0.1')
 PORT = int(os.getenv('AIOS_GITOPS_PORT', '18890'))
 OPENAPI = WS / 'docs' / 'gitops' / 'openapi-chatgpt-actions.yaml'
 BARE_REPO = Path(os.getenv('AIOS_GITOPS_BARE_REPO', str(ROOT / 'runtime' / 'gitea-bin' / 'data' / 'repositories' / 'aios' / 'aios.git')))
 AUTHORITATIVE_GIT_DIR = Path(os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR')) if os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR') else None
 REPOSITORY_IDENTITY = os.getenv('AIOS_GITOPS_REPOSITORY_IDENTITY', '')
 SILENT_RELEASE_STATE_ROOT = Path(os.getenv(
    'AIOS_SILENT_RELEASE_STATE_ROOT',
    '/var/lib/aios-gitops/silent-release',
 ))
 SILENT_RELEASE_EXECUTION_ENABLED = str(os.getenv(
    'AIOS_SILENT_RELEASE_EXECUTION_ENABLED', 'false'
 )).lower() in {'1', 'true', 'yes', 'on'}
 SILENT_RELEASE_PUBLIC_KEYS = Path(os.getenv(
    'AIOS_SILENT_RELEASE_PUBLIC_KEYS',
    '/etc/aios-gitops/silent-release-owner-public-keys.json',
 ))
 monitor = ActionMonitor()
 BASE_MODELS = [
@@ -88,43 +24,7 @@ BASE_MODELS = [
  {'id':'base.gpt-5.5','provider':'openai','model':'gpt-5.5','display_name':'GPT-5.5','scope':'global'},
 ]
 SECRET_RE = re.compile(r'(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)\s*[:=]\s*["\']?([A-Za-z0-9_./+=:-]{16,})')
-SECRET_VAL_RE = re.compile(
+SECRET_VAL_RE = re.compile(r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})')
    r'(?<![A-Za-z0-9_])'
    r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})'
 )
 READ_ONLY_GET_PATHS = frozenset({
    '/', '/health', '/api/health', '/api/openapi.yaml',
    '/api/openapi-chatgpt-actions.yaml', '/api/schema', '/api', '/api/status',
    '/api/base', '/api/baseline', '/base', '/api/ver', '/api/versions', '/ver',
    '/api/diff', '/diff', '/api/patch', '/api/patches', '/api/branches', '/patch',
    '/api/model', '/model', '/api/run', '/api/runtime-status', '/run',
    '/api/action-monitor', '/action-monitor', '/admin/ai-evolution',
    '/admin/ai-evolution/api/data',
    '/api/release-consistency', '/api/tag-publication-status',
    '/api/release-acceptance',
    '/getReleaseCandidate', '/getReleasePlan', '/getReleaseAcceptance',
    '/getApprovalEnvelope', '/getReleaseSaga', '/getCapabilityStatus',
    '/getRecoveryStatus',
 })
 SILENT_RELEASE_POST_PATHS = frozenset({
    '/createReleaseCandidate',
    '/createReleaseIntent',
    '/submitSignedApproval',
    '/submitOwnerApproval',
    '/startDeployment',
 })
 def reject_non_read_http(handler, method: str, path: str) -> bool:
    if method == 'GET':
        return False
    if path in SILENT_RELEASE_POST_PATHS:
        return False
    decision = evaluate_git_write(WS)
    if decision.allowed:
        return False
    handler.sendj(decision.payload(), decision.status_code)
    return True
 def now() -> str: return time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())
 def uid(p='id') -> str: return f'{p}-{int(time.time()*1000)}-{uuid.uuid4().hex[:8]}'
@@ -136,41 +36,6 @@ def sh(args, check=False):
 def jload(p: Path, default):
    try: return json.loads(p.read_text(encoding='utf-8'))
    except Exception: return default
 def _file_sha256(path: Path) -> str:
    digest=hashlib.sha256()
    with path.open('rb') as source:
        for chunk in iter(lambda: source.read(1024 * 1024), b''):
            digest.update(chunk)
    return digest.hexdigest()
 def _build_silent_release_service() -> SilentReleaseActionService:
    verifier=None
    if SILENT_RELEASE_PUBLIC_KEYS.is_file():
        verifier=SignedApprovalVerifier(
            ApprovalKeyRing.from_file(SILENT_RELEASE_PUBLIC_KEYS),
            ApprovalRevocationStore(
                SILENT_RELEASE_STATE_ROOT / 'revocations'
            ),
        )
    policy_path=WS / 'config' / 'gitops' / 'silent-release-policy.json'
    policy_sha=_file_sha256(policy_path) if policy_path.is_file() else ''
    return SilentReleaseActionService(
        SILENT_RELEASE_STATE_ROOT,
        execution_enabled=SILENT_RELEASE_EXECUTION_ENABLED,
        approval_verifier=verifier,
        expected_repository=REPOSITORY_IDENTITY,
        policy_sha256=policy_sha,
    )
 # Construct once during service startup. If production execution is enabled
 # without every trusted builder/orchestrator dependency, construction fails
 # closed before the HTTP server accepts traffic.
 _SILENT_RELEASE_SERVICE = _build_silent_release_service()
 def silent_release_service() -> SilentReleaseActionService:
    return _SILENT_RELEASE_SERVICE
 def relpath(path: str) -> str:
    x = str(path or '').replace('\\','/').strip()
    if not x or x.startswith('/') or '..' in Path(x).parts or Path(x).parts[0] == '.git': raise ValueError('invalid path')
@@ -244,13 +109,9 @@ def ensure_git():
    if not sh(['config','user.name'])['stdout']: sh(['config','user.name','chatgpt-gitops-bot'], True)
 def checkout(branch, base='main', create=False):
    ensure_git(); b=branch_name(branch)
-    exists = sh(['rev-parse','--verify',f'refs/heads/{b}'])['code'] == 0
+    if create or sh(['rev-parse','--verify',b])['code'] != 0:
-    if exists:
+        sh(['checkout',base], True); sh(['checkout','-B',b], True)
-        sh(['checkout',b], True)
+    else: sh(['checkout',b], True)
    elif create:
        sh(['checkout',base], True); sh(['checkout','-b',b], True)
    else:
        raise ValueError(f'branch does not exist: {b}')
    return b
 def write_file(path, content):
    if content_has_secret(content): raise ValueError('secret_rejected: use secret_ref; plaintext API keys must not enter Git')
@@ -260,19 +121,6 @@ def sync_branch(branch: str) -> dict:
    if not branch or branch in ('main','master') or branch.startswith('main/') or branch.startswith('master/'):
        return {'status':'skipped','reason':'protected_branch','branch':branch}
    if BARE_REPO.exists():
        common = sh(['rev-parse', '--path-format=absolute', '--git-common-dir'], True)['stdout']
        if Path(common).resolve() == BARE_REPO.resolve():
            head = sh(['rev-parse', 'HEAD'], True)['stdout']
            stored = subprocess.run(
                ['git', '--git-dir', str(BARE_REPO), 'rev-parse', f'refs/heads/{branch}'],
                text=True, capture_output=True,
            )
            if stored.returncode != 0 or stored.stdout.strip() != head:
                raise RuntimeError(f'linked-worktree branch verification failed for {branch}')
            return {
                'status':'verified', 'target':'authoritative-bare',
                'branch':branch, 'oid':head,
            }
        ref=f'refs/heads/{branch}:refs/heads/{branch}'
        p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
        if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git sync failed for {branch}')
@@ -282,68 +130,15 @@ def sync_branch(branch: str) -> dict:
    return {'status':'synced','target':'origin','branch':branch,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
 def sync_tag(tag: str) -> dict:
-    raise RuntimeError(
+    if not tag: return {'status':'skipped','reason':'empty_tag'}
-        'unsafe sync_tag disabled: use TagPublisher with expected tag_oid, '
+    if BARE_REPO.exists():
-        'target_oid, Gitea remote verification, and authenticated API verification'
+        ref=f'refs/tags/{tag}:refs/tags/{tag}'
-    )
+        p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
-
+        if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag sync failed for {tag}')
-def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
+        return {'status':'synced','target':'bare','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
-    oid = str(value or '').strip().lower()
+    p=subprocess.run(['git','push','origin',tag], cwd=str(WS), text=True, capture_output=True)
-    if not re.fullmatch(r'[0-9a-f]{40}', oid):
+    if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag push failed for {tag}')
-        raise ValueError(f'{field} must be a full 40-character commit OID')
+    return {'status':'synced','target':'origin','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
    try:
        return authoritative_commit(oid, git_dir=AUTHORITATIVE_GIT_DIR)
    except (AuthoritativeGitError, ValueError) as exc:
        raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
 def existing_tag_target(tag: str) -> str | None:
    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
        raise ValueError('invalid release version')
    try:
        result = run_authoritative_git(
            ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
            check=False,
            git_dir=AUTHORITATIVE_GIT_DIR,
        )
    except AuthoritativeGitError as exc:
        raise RuntimeError(str(exc)) from exc
    return result.stdout.strip() if result.returncode == 0 else None
 def publication_request_from_query(q: dict[str, list[str]]) -> PublicationRequest:
    required = ('version', 'target_oid', 'evidence_closure_oid', 'approval_plan_id')
    missing = [name for name in required if not (q.get(name) or [''])[0]]
    if missing:
        raise ValueError('missing release governance fields: ' + ', '.join(missing))
    return PublicationRequest(
        (q['version'])[0],
        (q['target_oid'])[0].lower(),
        (q['evidence_closure_oid'])[0].lower(),
        (q['approval_plan_id'])[0],
    )
 def required_authoritative_git_dir() -> Path:
    snapshot = repository_snapshot(
        git_dir=AUTHORITATIVE_GIT_DIR,
        repository_identity=REPOSITORY_IDENTITY,
    )
    if not snapshot["repository_available"]:
        raise RuntimeError(str(snapshot["query_error"] or "AUTHORITATIVE_REPOSITORY_UNAVAILABLE"))
    return Path(str(snapshot["authoritative_git_dir"]))
 def publication_publisher() -> TagPublisher:
    authoritative_repo = required_authoritative_git_dir()
    return TagPublisher(
        WS,
        GitTagBackend(WS, authoritative_repo=authoritative_repo),
        GiteaTagClient(
            os.getenv('AIOS_GITOPS_GITEA_API_URL',''),
            os.getenv('AIOS_GITOPS_GITEA_REPOSITORY',''),
            Path(os.getenv('AIOS_GITOPS_GITEA_TOKEN_FILE','')),
            token_line=int(os.getenv('AIOS_GITOPS_GITEA_TOKEN_LINE','1')),
        ),
        os.getenv('AIOS_GITOPS_GITEA_REMOTE','gitea'),
    )
 def commit(paths, msg):
    ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
@@ -363,16 +158,6 @@ def patches():
    for p in sorted((WS/'patches').glob('**/*.json')): out.append(jload(p, {'path':str(p.relative_to(WS))}))
    return out
 def runtime_release_info() -> dict[str, Any]:
    for candidate in (WS / 'manifest.json', WS.parent / 'manifest.json'):
        data = jload(candidate, {})
        if data.get('target_commit'):
            return {
                'runtime_release_commit': data.get('target_commit'),
                'runtime_release_path': str(WS),
            }
    return {'runtime_release_commit': None, 'runtime_release_path': str(WS)}
 class H(BaseHTTPRequestHandler):
    server_version='AIOSChatGPTGitOps/V1R1C0'
    def sendj(self, data, code=200):
@@ -394,236 +179,43 @@ class H(BaseHTTPRequestHandler):
        if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
        return a
    def do_GET(self):
-        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
+        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path; q=urllib.parse.parse_qs(u.query)
        if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
        q=urllib.parse.parse_qs(u.query)
        try:
            if path in ('/health','/api/health'): return self.sendj({'status':'ok','service':'chatgpt-gitops-adapter','workspace':str(WS)})
            if path in ('/api/openapi.yaml','/api/openapi-chatgpt-actions.yaml','/api/schema'):
                return self.sendt(OPENAPI.read_text(encoding='utf-8'), 'application/yaml; charset=utf-8') if OPENAPI.exists() else self.sendj({'error':'schema_missing'},404)
            if path in ('/api','/api/status'): return self.sendj(api_spec())
            if path in ('/api/base','/api/baseline','/base'):
-                data=jload(WS/'baseline'/'current.json', {})
+                data=jload(WS/'baseline'/'current.json', {}); data.setdefault('git', sh(['rev-parse','--short','HEAD'])['stdout']); return self.sendj(data)
                data.setdefault('authoritative_repository', repository_snapshot(
                    git_dir=AUTHORITATIVE_GIT_DIR,
                    repository_identity=REPOSITORY_IDENTITY,
                ))
                return self.sendj(data)
            if path in ('/api/ver','/api/versions','/ver'):
-                snapshot = repository_snapshot(
+                return self.sendj({'tags':sh(['tag','--list','V*'])['stdout'].splitlines(),'versions_dir':[p.name for p in (WS/'versions').glob('*')],'head':sh(['rev-parse','--short','HEAD'])['stdout']})
                    git_dir=AUTHORITATIVE_GIT_DIR,
                    repository_identity=REPOSITORY_IDENTITY,
                )
                if not snapshot['repository_available']:
                    return self.sendj({
                        'repository_available': False,
                        'query_error': snapshot['query_error'],
                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
                        'local_authoritative_tags': [],
                    }, 503)
                try:
                    tags = authoritative_tags(git_dir=AUTHORITATIVE_GIT_DIR)
                except AuthoritativeGitError as exc:
                    return self.sendj({
                        'repository_available': False,
                        'query_error': str(exc),
                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
                        'local_authoritative_tags': [],
                    }, 503)
                registry = [p.name for p in (WS/'versions').glob('*')]
                return self.sendj({
                    'registry_versions': registry,
                    'local_authoritative_tags': tags,
                    'repository_available': True,
                    'query_error': None,
                    'tags': [item['name'] for item in tags],
                    'versions_dir': registry,
                    'head': snapshot['authoritative_head_oid'],
                    'authoritative_head_oid': snapshot['authoritative_head_oid'],
                })
            if path in ('/api/diff','/diff'):
-                frm=(q.get('from') or [''])[0]
+                frm=(q.get('from') or ['HEAD~1'])[0]; to=(q.get('to') or ['HEAD'])[0]; return self.sendj({'from':frm,'to':to,'diff':sh(['diff',frm,to])})
-                to=(q.get('to') or [''])[0]
+            if path in ('/api/patch','/api/patches','/api/branches','/patch'): return self.sendj({'patches':patches(),'branches':sh(['branch','--format','%(refname:short)'])['stdout'].splitlines()})
                try:
                    diff=authoritative_diff(frm, to, git_dir=required_authoritative_git_dir())
                except ValueError as exc:
                    return self.sendj({'error':redact(exc)},400)
                except AuthoritativeGitNotFound as exc:
                    return self.sendj({'error':redact(exc)},404)
                except AuthoritativeGitOutputTooLarge as exc:
                    return self.sendj({'error':redact(exc)},413)
                except (AuthoritativeGitError, RuntimeError) as exc:
                    return self.sendj({'error':redact(exc)},503)
                return self.sendj({'from':frm,'to':to,'diff':diff})
            if path in ('/api/patch','/api/patches','/api/branches','/patch'):
                snapshot = repository_snapshot(
                    git_dir=AUTHORITATIVE_GIT_DIR,
                    repository_identity=REPOSITORY_IDENTITY,
                )
                if not snapshot['repository_available']:
                    return self.sendj({
                        'repository_available': False,
                        'query_error': snapshot['query_error'],
                        'metadata_patches': patches(),
                        'authoritative_branches': [],
                    }, 503)
                try:
                    branches = authoritative_branches(git_dir=AUTHORITATIVE_GIT_DIR)
                except AuthoritativeGitError as exc:
                    return self.sendj({
                        'repository_available': False,
                        'query_error': str(exc),
                        'metadata_patches': patches(),
                        'authoritative_branches': [],
                    }, 503)
                metadata = patches()
                branch_names = {item['name'] for item in branches}
                metadata_names = {
                    item.get('branch') for item in metadata
                    if isinstance(item, dict) and item.get('branch')
                }
                orphan = [
                    item for item in metadata
                    if item.get('branch') and item.get('branch') not in branch_names
                ]
                missing = [
                    item for item in branches
                    if item['name'] not in metadata_names
                ]
                return self.sendj({
                    'metadata_patches': metadata,
                    'authoritative_branches': branches,
                    'orphan_metadata': orphan,
                    'branches_without_metadata': missing,
                    'repository_available': True,
                    'query_error': None,
                    'patches': metadata,
                    'branches': [item['name'] for item in branches],
                })
            if path in ('/api/model','/model'): return self.sendj({'base':BASE_MODELS,'custom':model_docs(),'priority':[jload(p,{}) for p in sorted((WS/'config'/'model_priority').glob('*.json'))]})
            if path in ('/api/run','/api/runtime-status','/run'):
                svc=subprocess.run(['systemctl','is-active','aios-gitops-model-api'], text=True, capture_output=True)
-                snapshot = repository_snapshot(
+                return self.sendj({'service':'aios-gitops-model-api','status':svc.stdout.strip() or svc.stderr.strip(),'workspace_branch':sh(['rev-parse','--abbrev-ref','HEAD'])['stdout']})
                    git_dir=AUTHORITATIVE_GIT_DIR,
                    repository_identity=REPOSITORY_IDENTITY,
                )
                workspace_branch = None
                if (WS / '.git').exists():
                    result = sh(['rev-parse','--abbrev-ref','HEAD'])
                    workspace_branch = result['stdout'] or None
                payload = {
                    'service':'aios-gitops-model-api',
                    'status':svc.stdout.strip() or svc.stderr.strip(),
                    'workspace_branch':workspace_branch,
                    **runtime_release_info(),
                    **snapshot,
                    'writes_enabled': str(os.getenv('AIOS_GITOPS_WRITES_ENABLED','false')).lower() in {'1','true','yes','on'},
                }
                return self.sendj(payload, 200 if snapshot['repository_available'] else 503)
            if path in ('/api/action-monitor','/action-monitor'):
                latest=monitor.latest()
                ldict={'event_id':latest.event_id,'action':latest.action,'error':latest.error,'context':latest.context,'created_at':latest.created_at} if latest else None
                return self.sendj({'events':[{"event_id":e.event_id,"action":e.action,"error":e.error,"context":e.context,"created_at":e.created_at} for e in monitor.list_events()],'latest':ldict})
            if path == '/api/tag-publication-status':
                version=(q.get('version') or [''])[0]
                try:
                    version=validate_version(version)
                    status=publication_publisher().get_tag_publication_status(version)
                except ValueError:
                    return self.sendj({'error':'invalid release version'},400)
                return self.sendj(status)
            if path == '/api/release-consistency':
                request=publication_request_from_query(q)
                return self.sendj(publication_publisher().get_release_consistency(request))
            if path == '/api/release-acceptance':
                request=publication_request_from_query(q)
                return self.sendj(publication_publisher().run_release_acceptance(request))
            if path in (
                '/getReleaseCandidate',
                '/getReleasePlan',
                '/getReleaseAcceptance',
                '/getApprovalEnvelope',
                '/getReleaseSaga',
                '/getCapabilityStatus',
            ):
                candidate_id=(q.get('candidate_id') or [''])[0]
                if not candidate_id:
                    return self.sendj({'error':'candidate_id is required'},400)
                service=silent_release_service()
                if path == '/getReleaseCandidate':
                    return self.sendj(
                        service.get_release_candidate(candidate_id)
                    )
                if path == '/getApprovalEnvelope':
                    return self.sendj(
                        service.get_approval_envelope(candidate_id)
                    )
                if path == '/getReleasePlan':
                    return self.sendj(service.get_release_plan(candidate_id))
                if path == '/getReleaseAcceptance':
                    return self.sendj(service.get_acceptance(candidate_id))
                if path == '/getCapabilityStatus':
                    return self.sendj(
                        service.get_capability_status(candidate_id)
                    )
                return self.sendj(service.get_release_saga(candidate_id))
            if path == '/getRecoveryStatus':
                return self.sendj(
                    silent_release_service().get_recovery_status()
                )
                        # Admin AI Evolution Dashboard
            if path in ('/admin/ai-evolution','/admin/ai-evolution/'):
                return self.ai_evolution_page()
            if path in ('/admin/ai-evolution/api/data'):
                return self.ai_evolution_data()
            return self.sendj({'error':'not_found','path':path},404)
        except FileNotFoundError:
            return self.sendj({'error':'release candidate not found'},404)
        except ValueError as e:
            error=redact(e)
            monitor.record_failure('do_GET', error, {'path':path})
            return self.sendj({'error':error},400)
        except Exception as e:
-            error=redact(e)
+            monitor.record_failure('do_GET', str(e), {'path':path})
-            monitor.record_failure('do_GET', error, {'path':path})
+            return self.sendj({'error':str(e)},500)
            return self.sendj({'error':error},500)
    def do_PUT(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
        if reject_non_read_http(self, 'PUT', path): return
        data=self.body()
        if path == '/api/model-priority': return self.model_priority(data)
        return self.sendj({'error':'not_found','path':path},404)
    def do_POST(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
        if reject_non_read_http(self, 'POST', path): return
        data=self.body()
        try:
            if path == '/createReleaseCandidate':
                a=self.need('release:candidate')
                if not a: return
                return self.sendj(
                    silent_release_service().create_release_candidate(data)
                )
            if path == '/createReleaseIntent':
                a=self.need('release:candidate')
                if not a: return
                return self.sendj(
                    silent_release_service().create_release_intent(data)
                )
            if path in ('/submitOwnerApproval','/submitSignedApproval'):
                a=self.need('release:approve')
                if not a: return
                return self.sendj(
                    silent_release_service().submit_owner_approval(data)
                )
            if path == '/startDeployment':
                a=self.need('release:deploy')
                if not a: return
                return self.sendj(
                    silent_release_service().start_deployment(
                        str(data.get('candidate_id') or '')
                    )
                )
            if path in ('/api/branch','/api/create-branch'): return self.branch(data)
            if path in ('/api/file','/api/commit-file'): return self.file(data)
            if path == '/api/commit': return self.commit(data)
@@ -634,30 +226,9 @@ class H(BaseHTTPRequestHandler):
            if path == '/api/model-priority': return self.model_priority(data)
            if path == '/api/nl': return self.nl(data)
            return self.sendj({'error':'not_found','path':path},404)
        except (ValueError, FileNotFoundError) as e:
            error=redact(e)
            monitor.record_failure('do_POST', error, {'path':path})
            return self.sendj({'error':error},400)
        except CapabilityAuthorizationError as e:
            error=redact(e)
            monitor.record_failure('do_POST', error, {'path':path})
            return self.sendj({'error':error},403)
        except SagaConflict as e:
            error=redact(e)
            monitor.record_failure('do_POST', error, {'path':path})
            return self.sendj({'error':error},409)
        except Exception as e:
-            error=redact(e)
+            monitor.record_failure('do_POST', str(e), {'path':path})
-            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':str(e)},500)
            return self.sendj({'error':error},500)
    def do_PATCH(self):
        path=urllib.parse.urlparse(self.path).path.rstrip('/')
        if reject_non_read_http(self, 'PATCH', path): return
        return self.sendj({'error':'not_found','path':path},404)
    def do_DELETE(self):
        path=urllib.parse.urlparse(self.path).path.rstrip('/')
        if reject_non_read_http(self, 'DELETE', path): return
        return self.sendj({'error':'not_found','path':path},404)
    def branch(self,data):
        a=self.need('branch:create');
        if not a: return
@@ -681,41 +252,12 @@ class H(BaseHTTPRequestHandler):
        if not a: return
        ver=data.get('version') or data.get('tag')
        if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
-        if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
+        if data.get('confirm') != True:
-            return self.sendj({
+            self.sendj({'status':'confirm_required','operation':'tag','hint':'This operation creates a Git tag. Confirm to proceed.','x-openai-isConsequential':True}, 428)
-                'error':'production_tag_evidence_required',
+            return
                'required':['version','target_oid','evidence_closure_oid','approval_plan_id'],
            },400)
        try:
            target_oid=resolve_commit_oid(data.get('target_oid'))
            evidence_oid=resolve_commit_oid(data.get('evidence_closure_oid'), 'evidence_closure_oid')
        except ValueError as exc:
            return self.sendj({'error':'invalid_tag_target','detail':str(exc)},400)
        if a['role'] != 'owner' or not data.get('execute'):
-            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'request':req,'commit':c})
+            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'commit':c})
-        request=PublicationRequest(ver,target_oid,evidence_oid,str(data.get('approval_plan_id')))
+        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver)})
        main_before=sh(['rev-parse','refs/heads/main'], True)['stdout']
        publisher=publication_publisher()
        try:
            publication=publisher.publish(request)
        except PublicationManualOwnerReviewRequired as exc:
            audit(a['account'],'tag_manual_owner_review_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':redact(exc)})
            return self.sendj({'status':'MANUAL_OWNER_REVIEW_REQUIRED','error':redact(exc),'main_changed':False,'force_push':False},409)
        except PublicationConflict as exc:
            audit(a['account'],'tag_conflict',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},409)
        except PublicationPending as exc:
            audit(a['account'],'tag_pending',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
            return self.sendj({'status':'REMOTE_PUSH_PENDING','error':str(exc),'main_changed':False,'force_push':False},503)
        except PublicationReconciliationRequired as exc:
            audit(a['account'],'tag_reconciliation_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},502)
        main_after=sh(['rev-parse','refs/heads/main'], True)['stdout']
        if main_after != main_before:
            raise RuntimeError('main changed during tag operation')
        result={'status':publication['state'],'version':ver,'tag_name':ver,'tag_oid':publication['tag_oid'],'target_oid':target_oid,'expected_target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'workspace_head':sh(['rev-parse','HEAD'],True)['stdout'],'main_oid_before':main_before,'main_oid_after':main_after,'main_changed':False,'force_push':False,'publication':publication}
        audit(a['account'],'tag',ver,result)
        self.sendj(result)
    def rollback(self,data):
        a=self.need('rollback:request');
        if not a: return
@@ -810,10 +352,7 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
        cmd_filter=(params.get('command') or [None])[0]
        bl=jload(WS/'baseline'/'current.json',{})
        current_ver=bl.get('current_baseline','V1R3C1')
-        try:
+        tags=sh(['tag','--list','V*'])['stdout'].splitlines() if WS.exists() else []
            tags=[item['name'] for item in authoritative_tags(git_dir=required_authoritative_git_dir()) if str(item['name']).startswith('V')]
        except (AuthoritativeGitError, RuntimeError) as exc:
            return self.sendj({'error':redact(exc),'repository_available':False},503)
        versions=[]
        if (WS/'baseline'/'promotions').exists():
            for p in sorted((WS/'baseline'/'promotions').glob('*.json')):
@@ -851,9 +390,9 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
 def api_spec():
-    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
+    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True}}
 def main():
    print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
    ThreadingHTTPServer((HOST,PORT), H).serve_forever()
-if __name__ == '__main__': main()
+if __name__ == '__main__': main()
@@ -1,52 +0,0 @@
 #!/usr/bin/env python3
 """Fail-closed policy for in-process Git mutation handlers."""
 from __future__ import annotations
 import os
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Mapping
 _TRUE = frozenset({"1", "true", "yes", "on"})
@dataclass(frozen=True)
 class GitWriteDecision:
    allowed: bool
    status_code: int
    error: str
    reason: str
    workspace: str
    def payload(self) -> dict[str, str]:
        return {
            "status": "allowed" if self.allowed else "blocked",
            "error": self.error,
            "reason": self.reason,
            "workspace": self.workspace,
        }
 def _real(path: Path) -> Path:
    return Path(os.path.realpath(os.path.abspath(str(path))))
 def evaluate_git_write(workspace: Path | str, env: Mapping[str, str] | None = None) -> GitWriteDecision:
    values = os.environ if env is None else env
    lexical = Path(os.path.abspath(str(workspace)))
    canonical = _real(lexical)
    shown = str(lexical)
    if str(values.get("AIOS_GITOPS_WRITES_ENABLED", "false")).strip().lower() not in _TRUE:
        return GitWriteDecision(False, 423, "gitops_writes_disabled", "AIOS_GITOPS_WRITES_ENABLED is false", shown)
    if lexical != canonical:
        return GitWriteDecision(False, 409, "workspace_symlink_forbidden", "workspace must be a canonical non-symlink path", shown)
    controller = _real(Path(values.get("AIOS_GITOPS_CONTROLLER_PATH", "/data/aios-gitops/worktrees/controller")))
    role = str(values.get("AIOS_GITOPS_WORKSPACE_ROLE", "")).strip().lower()
    if canonical == controller or role == "runtime-anchor":
        return GitWriteDecision(False, 423, "runtime_anchor_read_only", "controller/runtime-anchor is read-only", str(canonical))
    writer_root = _real(Path(values.get("AIOS_GITOPS_APPROVED_WRITER_ROOT", "/data/aios-gitops/worktrees")))
    try:
        canonical.relative_to(writer_root)
    except ValueError:
        return GitWriteDecision(False, 409, "workspace_not_approved_writer", "workspace is outside the approved writer root", str(canonical))
    return GitWriteDecision(True, 200, "", "approved isolated writer", str(canonical))
@@ -1,316 +0,0 @@
 """Task-scoped hardened wrapper around the existing Action API."""
 from __future__ import annotations
 import json
 import os
 import subprocess
 from pathlib import Path
 import urllib.parse
 import aios_chatgpt_actions_api as api
 import aios_isolated_writer_policy as policy
 from isolated_writer_authz import AuthorizationError, authorize
 from isolated_writer_commit_file import AtomicCommitFile, CommitFileError, OperationLedger
 from isolated_writer_token_registry import TokenRegistry
 _reject = api.reject_non_read_http
 _write_file = api.write_file
 _sync_branch = api.sync_branch
 _original_do_get = api.H.do_GET
 api.OPENAPI = Path(os.getenv("AIOS_GITOPS_ISOLATED_WRITER_OPENAPI", str(api.OPENAPI)))
 def _registry() -> TokenRegistry:
    return TokenRegistry(Path(os.environ["AIOS_GITOPS_TOKEN_REGISTRY_V2"]))
 def _atomic_writer() -> AtomicCommitFile:
    return AtomicCommitFile(
        workspace=api.WS,
        bare_repo=api.BARE_REPO,
        ledger=OperationLedger(Path(os.environ["AIOS_GITOPS_WRITER_OPERATION_LEDGER"])),
        remote=os.getenv("AIOS_GITOPS_GITEA_PUSH_REMOTE", ""),
        audit=policy.append_audit_record,
    )
 def _bearer(handler) -> str:
    value = handler.headers.get("Authorization", "")
    return value[7:].strip() if value.startswith("Bearer ") else ""
 def _authorize(handler, *, method: str, path: str, branch=None, target_path=None):
    grant = authorize(
        _registry(),
        _bearer(handler),
        method=method,
        path=path,
        source_ip=str(handler.client_address[0]),
        workspace=api.WS,
        branch=branch,
        target_path=target_path,
    )
    grant.record["_source_ip"] = str(handler.client_address[0])
    return grant
 def _authorization_error(handler, exc: AuthorizationError):
    return handler.sendj({"error": exc.code}, exc.status)
 def _isolated_runtime_status(handler):
    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
    head = api.sh(["rev-parse", "HEAD"], True)["stdout"]
    return handler.sendj({
        "service": os.getenv(
            "AIOS_GITOPS_SERVICE_AUDIENCE",
            "aios-isolated-writer.service",
        ),
        "status": "active",
        "runtime_role": os.getenv("AIOS_GITOPS_RUNTIME_ROLE"),
        "workspace_role": os.getenv("AIOS_GITOPS_WORKSPACE_ROLE"),
        "writes_enabled": os.getenv("AIOS_GITOPS_WRITES_ENABLED", "").lower()
        in {"1", "true", "yes", "on"},
        "allowed_branch": policy.allowed_branch(),
        "approved_base_oid": policy.allowed_base_oid(),
        "workspace_branch": branch,
        "workspace_head_oid": head,
        "repository_identity": os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY"),
        "token_policy_version": 2,
        "atomic_commit_file": True,
        "path_policy_sha256": policy.configured_path_policy_sha256(),
    })
 def _isolated_do_get(self):
    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
    if path in {"/health", "/api/health"}:
        return self.sendj({
            "status": "ok",
            "service": os.getenv(
                "AIOS_GITOPS_SERVICE_AUDIENCE",
                "aios-isolated-writer.service",
            ),
        })
    if path not in {"/api/runtime-status", "/api/baseline", "/api/patches"}:
        return self.sendj({"error": "isolated_writer_operation_forbidden"}, 403)
    try:
        _authorize(self, method="GET", path=path)
    except AuthorizationError as exc:
        return _authorization_error(self, exc)
    if path == "/api/runtime-status":
        return _isolated_runtime_status(self)
    return _original_do_get(self)
 def _read_commit_file_body(handler):
    try:
        length = int(handler.headers.get("Content-Length", "0"))
    except ValueError:
        raise CommitFileError("writer_content_length_rejected") from None
    if length <= 0:
        raise CommitFileError("writer_request_object_required")
    if length > 1_100_000:
        raise CommitFileError("writer_request_too_large", 413)
    raw = handler.rfile.read(length)
    try:
        value = json.loads(raw.decode("utf-8"))
    except (UnicodeDecodeError, json.JSONDecodeError):
        raise CommitFileError("writer_request_json_rejected") from None
    if not isinstance(value, dict):
        raise CommitFileError("writer_request_object_required")
    return value
 def _isolated_do_post(self):
    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
    if path != "/api/commit-file":
        return self.sendj({"error": "isolated_writer_operation_forbidden"}, 403)
    try:
        data = _read_commit_file_body(self)
        branch = str(data.get("branch") or "")
        target_path = str(data.get("path") or "")
        grant = _authorize(
            self,
            method="POST",
            path=path,
            branch=branch,
            target_path=target_path,
        )
        if api.content_has_secret(str(data.get("content") or "")):
            raise CommitFileError("writer_secret_content_rejected", 403)
        result = _atomic_writer().execute(grant, data)
        return self.sendj(result)
    except AuthorizationError as exc:
        return _authorization_error(self, exc)
    except CommitFileError as exc:
        return self.sendj({"error": exc.code}, exc.status)
    except PermissionError:
        return self.sendj({"error": "isolated_writer_policy_rejected"}, 403)
 def reject_non_read_http(handler, method: str, path: str) -> bool:
    if _reject(handler, method, path):
        return True
    try:
        policy.validate_endpoint(method, path, api.WS, api.BARE_REPO)
        return False
    except PermissionError as exc:
        handler.sendj({"error": str(exc)}, 403)
        return True
 def checkout(branch, base="main", create=False):
    api.ensure_git()
    target = api.branch_name(branch)
    policy.validate_branch_request({"branch": target, "base": base})
    exists = api.sh(["rev-parse", "--verify", target])["code"] == 0
    if exists:
        if api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"] != target:
            api.sh(["checkout", target], True)
    elif create:
        api.sh(["checkout", "-b", target, base], True)
    else:
        raise PermissionError("isolated_writer_branch_missing")
    policy.require_service_invariants(api.WS, api.BARE_REPO)
    return target
 def write_file(path, content):
    policy.validate_path(path, api.WS)
    return _write_file(path, content)
 def sync_branch(branch: str):
    policy.validate_sync_branch(branch)
    local = _sync_branch(branch)
    remote = os.getenv("AIOS_GITOPS_GITEA_PUSH_REMOTE", "").strip()
    if remote != "gitea-http":
        raise PermissionError("isolated_writer_gitea_remote_rejected")
    head = api.sh(["rev-parse", "HEAD"], True)["stdout"]
    pushed = subprocess.run(
        ["git", "push", "--porcelain", remote, f"HEAD:refs/heads/{branch}"],
        cwd=api.WS,
        text=True,
        capture_output=True,
    )
    if pushed.returncode != 0:
        raise RuntimeError("isolated_writer_gitea_push_failed")
    verified = subprocess.run(
        ["git", "ls-remote", "--heads", remote, f"refs/heads/{branch}"],
        cwd=api.WS,
        text=True,
        capture_output=True,
    )
    if verified.returncode != 0:
        raise RuntimeError("isolated_writer_gitea_verification_failed")
    fields = verified.stdout.strip().split()
    if len(fields) != 2 or fields[0] != head or fields[1] != f"refs/heads/{branch}":
        raise RuntimeError("isolated_writer_gitea_oid_mismatch")
    return {
        "status": "verified",
        "target": "authoritative-bare+gitea",
        "branch": branch,
        "oid": head,
        "local": local.get("status"),
    }
 def commit(paths, msg):
    policy.validate_commit_paths(paths, api.WS)
    api.ensure_git()
    selected = [api.relpath(p) for p in paths] if paths else ["."]
    api.sh(["add", *selected], True)
    policy.validate_staged_paths(api.WS)
    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
    if not api.sh(["status", "--short"])["stdout"]:
        return {"status": "no_changes", "branch": branch, "sync": sync_branch(branch)}
    out = api.sh(["commit", "-m", msg], True)
    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
    return {
        "status": "committed",
        "branch": branch,
        "rev": api.sh(["rev-parse", "--short", "HEAD"], True)["stdout"],
        "git": out,
        "sync": sync_branch(branch),
    }
 def audit(actor, action, target, payload):
    policy.append_audit_record(
        {
            "at": api.now(),
            "actor": actor,
            "action": action,
            "target": target,
            "payload": api.sanitize(payload),
        }
    )
 def _validate_request(self, data, validate):
    try:
        validate(data)
        return True
    except PermissionError as exc:
        self.sendj({"error": str(exc)}, 403)
        return False
 def _checked_branch(self, data):
    if not _validate_request(self, data, policy.validate_branch_request):
        return
    return _branch(self, data)
 def _checked_file(self, data):
    data = dict(data)
    data.setdefault("branch", policy.allowed_branch())
    if not _validate_request(self, data, policy.validate_branch_request):
        return
    if not _validate_request(
        self,
        {"path": data.get("path", "")},
        lambda item: policy.validate_path(item["path"], api.WS),
    ):
        return
    return _file(self, data)
 def _checked_commit(self, data):
    data = dict(data)
    data.setdefault("branch", policy.allowed_branch())
    if not _validate_request(self, data, policy.validate_branch_request):
        return
    return _commit(self, data)
 def _checked_patch(self, data):
    data = dict(data)
    data["branch"] = policy.allowed_branch()
    if not _validate_request(self, data, policy.validate_branch_request):
        return
    return _patch(self, data)
 _branch, _file, _commit, _patch = api.H.branch, api.H.file, api.H.commit, api.H.patch
 api.reject_non_read_http = reject_non_read_http
 api.checkout, api.write_file, api.sync_branch, api.commit, api.audit = (
    checkout,
    write_file,
    sync_branch,
    commit,
    audit,
 )
 api.H.branch, api.H.file, api.H.commit, api.H.patch = (
    _checked_branch,
    _checked_file,
    _checked_commit,
    _checked_patch,
 )
 api.H.do_GET = _isolated_do_get
 api.H.do_POST = _isolated_do_post
 if __name__ == "__main__":
    policy.require_service_invariants(api.WS, api.BARE_REPO)
    api.ThreadingHTTPServer((api.HOST, api.PORT), api.H).serve_forever()
@@ -1,310 +0,0 @@
 """Fail-closed policy used only by the task-scoped Action writer."""
 from __future__ import annotations
 import os
 import json
 import stat
 import subprocess
 import re
 from pathlib import Path, PurePosixPath, PureWindowsPath
 from urllib.parse import unquote
 import isolated_writer_path_policy as path_policy
 WRITE_ENDPOINTS = frozenset({"/api/commit-file"})
 ALLOWED_ROOTS = (
    "active-runtime",
    "docs",
    "patches",
    "reports",
    "scripts",
    "test",
    "tests",
 )
 DENIED_ROOTS = ("baseline", "config", "deploy", "deployments", "ops", "runtime", "services")
 _TRUE = frozenset({"1", "true", "yes", "on"})
 _FALSE = frozenset({"0", "false", "no", "off"})
 _DENY_FLAGS = (
    "AIOS_GITOPS_ALLOW_MAIN_WRITE",
    "AIOS_GITOPS_ALLOW_TAG_WRITE",
    "AIOS_GITOPS_ALLOW_BASELINE_WRITE",
    "AIOS_GITOPS_ALLOW_REGISTRY_WRITE",
    "AIOS_GITOPS_ALLOW_ROLLBACK",
    "AIOS_GITOPS_ALLOW_DEPLOYMENT",
 )
 def enforcement_required() -> bool:
    return os.getenv("AIOS_GITOPS_ISOLATED_WRITER_ENFORCEMENT", "") == "required"
 def allowed_branch() -> str:
    value = os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", "").strip()
    if not value:
        raise PermissionError("isolated_writer_missing_allowed_branch")
    return value
 def allowed_base_oid() -> str:
    value = os.getenv("AIOS_GITOPS_ALLOWED_BASE_OID", "").strip().lower()
    if len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
        raise PermissionError("isolated_writer_invalid_allowed_base_oid")
    return value
 def _git(workspace: Path, *args: str) -> str:
    result = subprocess.run(["git", *args], cwd=workspace, text=True, capture_output=True)
    if result.returncode != 0:
        raise PermissionError("isolated_writer_git_validation_failed")
    return result.stdout.strip()
 def require_service_invariants(workspace: Path, bare_repo: Path) -> None:
    if not enforcement_required():
        return
    if os.getenv("AIOS_GITOPS_WRITES_ENABLED", "").strip().lower() not in _TRUE:
        raise PermissionError("isolated_writer_write_gate_required")
    if os.getenv("AIOS_GITOPS_RUNTIME_ROLE", "") != "isolated-writer":
        raise PermissionError("isolated_writer_role_required")
    if os.getenv("AIOS_GITOPS_WORKSPACE_ROLE", "") != "isolated-writer":
        raise PermissionError("isolated_writer_workspace_role_required")
    if os.getenv("AIOS_GITOPS_TOKEN_POLICY_VERSION_REQUIRED", "") != "2":
        raise PermissionError("isolated_writer_token_policy_v2_required")
    if not os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", "").strip():
        raise PermissionError("isolated_writer_service_audience_required")
    if not os.getenv("AIOS_GITOPS_TOKEN_REGISTRY_V2", "").strip():
        raise PermissionError("isolated_writer_token_registry_required")
    if not os.getenv("AIOS_GITOPS_WRITER_OPERATION_LEDGER", "").strip():
        raise PermissionError("isolated_writer_operation_ledger_required")
    path_policy.configured_path_policy()
    for name in _DENY_FLAGS:
        if os.getenv(name, "").strip().lower() not in _FALSE:
            raise PermissionError("isolated_writer_forbidden_capability_flag")
    if os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "") != "aios/aios":
        raise PermissionError("isolated_writer_repository_identity_rejected")
    configured_bare_value = os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "").strip()
    if not configured_bare_value:
        raise PermissionError("isolated_writer_authoritative_repo_rejected")
    configured_bare = Path(configured_bare_value)
    if configured_bare.resolve(strict=True) != bare_repo.resolve(strict=True):
        raise PermissionError("isolated_writer_authoritative_repo_rejected")
    writer_root_value = os.getenv("AIOS_GITOPS_APPROVED_WRITER_ROOT", "").strip()
    if not writer_root_value:
        raise PermissionError("isolated_writer_workspace_outside_approved_root")
    writer_root = Path(writer_root_value).resolve(strict=True)
    lexical_workspace = Path(os.path.abspath(str(workspace)))
    canonical_workspace = lexical_workspace.resolve(strict=True)
    if lexical_workspace != canonical_workspace:
        raise PermissionError("isolated_writer_workspace_symlink_rejected")
    try:
        canonical_workspace.relative_to(writer_root)
    except (ValueError, FileNotFoundError):
        raise PermissionError("isolated_writer_workspace_outside_approved_root") from None
    if _git(workspace, "rev-parse", "--abbrev-ref", "HEAD") != allowed_branch():
        raise PermissionError("isolated_writer_current_branch_rejected")
    approved_base = allowed_base_oid()
    try:
        _git(workspace, "cat-file", "-e", f"{approved_base}^{{commit}}")
        subprocess.run(
            ["git", "merge-base", "--is-ancestor", approved_base, "HEAD"],
            cwd=workspace,
            check=True,
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
        )
    except (PermissionError, subprocess.CalledProcessError):
        raise PermissionError("isolated_writer_approved_base_not_ancestor") from None
    if _git(workspace, "merge-base", approved_base, "HEAD") != approved_base:
        raise PermissionError("isolated_writer_merge_base_rejected")
    common = Path(_git(workspace, "rev-parse", "--git-common-dir"))
    if not common.is_absolute():
        common = (workspace / common).resolve()
    if common.resolve() != bare_repo.resolve():
        raise PermissionError("isolated_writer_common_repo_rejected")
 def approved_audit_log_path() -> Path:
    root_value = os.getenv("AIOS_GITOPS_APPROVED_AUDIT_ROOT", "").strip()
    log_value = os.getenv("AIOS_GITOPS_AUDIT_LOG", "").strip()
    if not root_value or not log_value:
        raise PermissionError("isolated_writer_audit_path_missing")
    lexical_root = Path(os.path.abspath(root_value))
    lexical_log = Path(os.path.abspath(log_value))
    root = lexical_root.resolve(strict=True)
    if lexical_root != root or root.is_symlink() or not root.is_dir():
        raise PermissionError("isolated_writer_audit_root_rejected")
    try:
        lexical_log.relative_to(root)
    except ValueError:
        raise PermissionError("isolated_writer_audit_path_outside_approved_root") from None
    if lexical_log.parent.resolve(strict=True) != lexical_log.parent:
        raise PermissionError("isolated_writer_audit_parent_symlink_rejected")
    if lexical_log.exists() and lexical_log.is_symlink():
        raise PermissionError("isolated_writer_audit_log_symlink_rejected")
    os.chmod(root, 0o750)
    os.chmod(lexical_log.parent, 0o750)
    return lexical_log
 def append_audit_record(record: dict) -> None:
    path = approved_audit_log_path()
    flags = os.O_WRONLY | os.O_APPEND | os.O_CREAT
    if hasattr(os, "O_NOFOLLOW"):
        flags |= os.O_NOFOLLOW
    descriptor = os.open(path, flags, 0o600)
    try:
        info = os.fstat(descriptor)
        if not stat.S_ISREG(info.st_mode):
            raise PermissionError("isolated_writer_audit_log_not_regular")
        os.fchmod(descriptor, 0o600)
        line = json.dumps(
            _audit_sanitize(record),
            ensure_ascii=False,
            sort_keys=True,
            separators=(",", ":"),
        ).encode("utf-8") + b"\n"
        os.write(descriptor, line)
        os.fsync(descriptor)
    finally:
        os.close(descriptor)
    parent_fd = os.open(path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
    try:
        os.fsync(parent_fd)
    finally:
        os.close(parent_fd)
 def _audit_sanitize(value):
    if isinstance(value, dict):
        return {
            key: (
                "[REDACTED]"
                if any(
                    marker in str(key).lower()
                    for marker in (
                        "authorization",
                        "credential",
                        "password",
                        "secret",
                        "token",
                        "private_key",
                    )
                )
                and str(key).lower() != "token_id"
                else _audit_sanitize(inner)
            )
            for key, inner in value.items()
        }
    if isinstance(value, list):
        return [_audit_sanitize(item) for item in value]
    if isinstance(value, str) and re.search(
        r"(?i)(authorization\s*:\s*bearer|(?:token|password|secret)\s*[:=])",
        value,
    ):
        return "[REDACTED]"
    return value
 def validate_endpoint(method: str, path: str, workspace: Path, bare_repo: Path) -> None:
    if not enforcement_required():
        return
    if method != "POST" or path not in WRITE_ENDPOINTS:
        raise PermissionError("isolated_writer_operation_forbidden")
    require_service_invariants(workspace, bare_repo)
 def validate_branch_request(data: dict) -> None:
    if not enforcement_required():
        return
    branch = allowed_branch() if "branch" not in data else str(data.get("branch") or "").strip()
    if branch != allowed_branch():
        raise PermissionError("isolated_writer_branch_rejected")
    if str(data.get("base", "main")).strip() != "main":
        raise PermissionError("isolated_writer_base_rejected")
    if data.get("force") or data.get("force_push"):
        raise PermissionError("isolated_writer_force_rejected")
 def validate_path(path: str, workspace: Path | None = None) -> str:
    if not isinstance(path, str):
        raise PermissionError("isolated_writer_path_rejected")
    value = path
    if not value or value != value.strip() or "\x00" in value or "\\" in value:
        raise PermissionError("isolated_writer_path_rejected")
    try:
        decoded = unquote(value, errors="strict")
    except (UnicodeDecodeError, ValueError):
        raise PermissionError("isolated_writer_path_rejected") from None
    if decoded != value:
        raise PermissionError("isolated_writer_path_rejected")
    windows = PureWindowsPath(value)
    posix = PurePosixPath(value)
    parts = value.split("/")
    if (
        posix.is_absolute()
        or windows.is_absolute()
        or bool(windows.drive)
        or any(part in {"", ".", ".."} for part in parts)
    ):
        raise PermissionError("isolated_writer_path_rejected")
    first = parts[0]
    service_exact_path = False
    if first in DENIED_ROOTS:
        try:
            path_policy.require_service_path("commit_file.atomic", value)
            service_exact_path = True
        except path_policy.PathPolicyError as exc:
            raise PermissionError(str(exc)) from None
    if value != "README.md" and first not in ALLOWED_ROOTS and not service_exact_path:
        raise PermissionError("isolated_writer_path_outside_allowed_roots")
    if workspace is not None:
        lexical_root = Path(os.path.abspath(str(workspace)))
        root = lexical_root.resolve(strict=True)
        if lexical_root != root:
            raise PermissionError("isolated_writer_workspace_symlink_rejected")
        current = root
        for part in parts:
            current = current / part
            if current.is_symlink():
                raise PermissionError("isolated_writer_path_symlink_rejected")
        candidate = (root / value).resolve(strict=False)
        try:
            candidate.relative_to(root)
        except ValueError:
            raise PermissionError("isolated_writer_path_escapes_workspace") from None
    return value
 def validate_content_for_path(path: str, content: str) -> None:
    if path.split("/", 1)[0] not in DENIED_ROOTS:
        return
    try:
        path_policy.validate_content("commit_file.atomic", path, content)
    except path_policy.PathPolicyError as exc:
        raise PermissionError(str(exc)) from None
 def configured_path_policy_sha256() -> str | None:
    try:
        return path_policy.configured_path_policy_sha256()
    except path_policy.PathPolicyError as exc:
        raise PermissionError(str(exc)) from None
 def validate_commit_paths(paths: list[str], workspace: Path | None = None) -> None:
    if enforcement_required():
        for path in paths:
            if str(path).strip() != ".":
                validate_path(str(path), workspace)
 def validate_staged_paths(workspace: Path) -> None:
    if not enforcement_required():
        return
    for path in _git(workspace, "diff", "--cached", "--name-only").splitlines():
        validate_path(path, workspace)
 def validate_sync_branch(branch: str) -> None:
    if enforcement_required() and branch != allowed_branch():
        raise PermissionError("isolated_writer_sync_branch_rejected")
@@ -1,355 +0,0 @@
 """Fail-closed access to the authoritative bare Git repository."""
 from __future__ import annotations
 import os
 import re
 import subprocess
 import urllib.parse
 from pathlib import Path
 from typing import Iterable
 _ALLOWED_COMMANDS = frozenset(
    {
        "cat-file",
        "config",
        "diff",
        "for-each-ref",
        "ls-remote",
        "merge-base",
        "push",
        "remote",
        "rev-parse",
        "show-ref",
        "tag",
    }
 )
 _OID_RE = re.compile(r"^[0-9a-f]{40}$")
 _MAX_OUTPUT = 1_048_576
 _TIMEOUT = 8.0
 class AuthoritativeGitError(RuntimeError):
    """A fail-closed authoritative repository or ref query error."""
 class AuthoritativeGitNotFound(AuthoritativeGitError):
    """A validated revision does not exist in the authoritative repository."""
 class AuthoritativeGitOutputTooLarge(AuthoritativeGitError):
    """A controlled Git query exceeded the response-size boundary."""
 def _redact(text: str) -> str:
    value = str(text or "")
    value = re.sub(r"(?i)(authorization\s*[:=]\s*)(?:bearer|token)\s+\S+", r"\1REDACTED", value)
    value = re.sub(r"(?i)((?:access_)?token\s*[:=]\s*)\S+", r"\1REDACTED", value)
    value = re.sub(r"(?i)(https?://[^/\s:@]+:)[^@\s/]+@", r"\1REDACTED@", value)
    return value
 def _configured_path(git_dir: str | Path | None = None) -> Path:
    raw = str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
    if not raw:
        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
    path = Path(raw)
    if not path.is_absolute() or ".." in path.parts:
        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
    try:
        resolved = path.resolve(strict=True)
    except OSError as exc:
        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE") from exc
    if not resolved.is_dir():
        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
    return resolved
 def _run(
    git_dir: Path,
    args: list[str],
    *,
    check: bool,
    timeout: float = _TIMEOUT,
 ) -> subprocess.CompletedProcess[str]:
    if not args or args[0] not in _ALLOWED_COMMANDS:
        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
    try:
        result = subprocess.run(
            ["git", "--git-dir", str(git_dir), *args],
            text=True,
            capture_output=True,
            timeout=timeout,
            env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
        )
    except (OSError, subprocess.TimeoutExpired) as exc:
        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED") from exc
    if len(result.stdout) + len(result.stderr) > _MAX_OUTPUT:
        raise AuthoritativeGitOutputTooLarge("GIT_OUTPUT_LIMIT_EXCEEDED")
    if check and result.returncode != 0:
        detail = _redact(result.stderr.strip() or result.stdout.strip())
        raise AuthoritativeGitError(
            "GIT_REF_QUERY_FAILED" + (f": {detail[:160]}" if detail else "")
        )
    return result
 def _repository_identity_from_remote(url: str) -> str:
    value = str(url or "").strip().split("?", 1)[0].rstrip("/")
    if not value:
        return ""
    if "://" in value:
        value = urllib.parse.urlparse(value).path
    elif ":" in value:
        value = value.rsplit(":", 1)[1]
    value = value.rsplit("@", 1)[-1].strip("/")
    value = re.sub(r"\.git$", "", value, flags=re.IGNORECASE)
    parts = [part for part in value.split("/") if part]
    if len(parts) >= 2:
        value = "/".join(parts[-2:])
    return value.strip("/").lower()
 def verify_repository(
    git_dir: str | Path | None = None,
    repository_identity: str | None = None,
 ) -> tuple[Path, str]:
    path = _configured_path(git_dir)
    expected = str(
        repository_identity
        or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
    ).strip().strip("/")
    if not expected or expected.count("/") != 1:
        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
    bare = _run(path, ["rev-parse", "--is-bare-repository"], check=True)
    if bare.stdout.strip().lower() != "true":
        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
    remote = _run(path, ["config", "--get", "remote.gitea.url"], check=False)
    actual = _repository_identity_from_remote(remote.stdout)
    if actual != expected.lower():
        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
    return path, expected
 def run_authoritative_git(
    args: list[str],
    *,
    check: bool = True,
    git_dir: str | Path | None = None,
    timeout: float = _TIMEOUT,
 ) -> subprocess.CompletedProcess[str]:
    path, _ = verify_repository(git_dir=git_dir)
    return _run(path, list(args), check=check, timeout=timeout)
 def authoritative_head_oid(
    *,
    git_dir: str | Path | None = None,
 ) -> str:
    result = run_authoritative_git(["rev-parse", "--verify", "refs/heads/main"], git_dir=git_dir)
    oid = result.stdout.strip().lower()
    if not _OID_RE.fullmatch(oid):
        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
    return oid
 def authoritative_tags(
    *,
    git_dir: str | Path | None = None,
 ) -> list[dict[str, str | None]]:
    result = run_authoritative_git(
        [
            "for-each-ref",
            "refs/tags",
            "--format=%(refname:strip=2)\t%(objectname)\t%(objecttype)",
        ],
        git_dir=git_dir,
    )
    tags: list[dict[str, str | None]] = []
    for line in result.stdout.splitlines():
        name, oid, object_type = (line.split("\t", 2) + ["", ""])[:3]
        if not name or not _OID_RE.fullmatch(oid.lower()):
            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
        peeled_result = run_authoritative_git(
            ["rev-parse", "--verify", f"refs/tags/{name}^{{commit}}"],
            git_dir=git_dir,
        )
        peeled = peeled_result.stdout.strip().lower()
        if not _OID_RE.fullmatch(peeled):
            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
        tags.append(
            {
                "name": name,
                "tag_oid": oid.lower(),
                "object_type": object_type,
                "peeled_target_oid": peeled,
            }
        )
    return tags
 def authoritative_branches(
    *,
    git_dir: str | Path | None = None,
 ) -> list[dict[str, str]]:
    result = run_authoritative_git(
        [
            "for-each-ref",
            "refs/heads",
            "--format=%(refname:strip=2)\t%(objectname)",
        ],
        git_dir=git_dir,
    )
    branches: list[dict[str, str]] = []
    for line in result.stdout.splitlines():
        name, oid = (line.split("\t", 1) + [""])[:2]
        if not name or not _OID_RE.fullmatch(oid.lower()):
            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
        branches.append({"name": name, "oid": oid.lower()})
    return branches
 def authoritative_commit(
    oid: str,
    *,
    git_dir: str | Path | None = None,
 ) -> str:
    value = str(oid or "").strip().lower()
    if not _OID_RE.fullmatch(value):
        raise ValueError("commit OID must be a full 40-character value")
    result = run_authoritative_git(
        ["rev-parse", "--verify", f"{value}^{{commit}}"],
        git_dir=git_dir,
    )
    resolved = result.stdout.strip().lower()
    if resolved != value:
        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
    return resolved
 def authoritative_lineage(
    ancestor: str,
    descendant: str,
    *,
    git_dir: str | Path | None = None,
 ) -> None:
    authoritative_commit(ancestor, git_dir=git_dir)
    authoritative_commit(descendant, git_dir=git_dir)
    result = run_authoritative_git(
        ["merge-base", "--is-ancestor", ancestor, descendant],
        check=False,
        git_dir=git_dir,
    )
    if result.returncode != 0:
        raise AuthoritativeGitError("evidence lineage mismatch")
 _SAFE_REF_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{0,239}$")
 def _safe_ref_name(value: str) -> bool:
    return bool(
        _SAFE_REF_RE.fullmatch(value)
        and ".." not in value
        and "//" not in value
        and "@{" not in value
        and not value.endswith(("/", ".", ".lock"))
        and not any(part in {"", ".", ".."} for part in value.split("/"))
    )
 def validate_git_revision(
    value: str,
    field: str,
    *,
    git_dir: str | Path | None = None,
 ) -> str:
    revision = str(value or "").strip()
    if not revision or revision != str(value or "") or revision.startswith("-"):
        raise ValueError(f"invalid {field} revision")
    if _OID_RE.fullmatch(revision.lower()):
        try:
            return authoritative_commit(revision.lower(), git_dir=git_dir)
        except AuthoritativeGitError as exc:
            raise AuthoritativeGitNotFound(f"{field} revision not found") from exc
    if not _safe_ref_name(revision) or any(token in revision for token in ("^", "~", ":", "\\")):
        raise ValueError(f"invalid {field} revision")
    if revision.startswith("refs/"):
        if not revision.startswith(("refs/heads/", "refs/tags/")):
            raise ValueError(f"invalid {field} revision")
        candidates = [revision]
    else:
        candidates = [f"refs/heads/{revision}", f"refs/tags/{revision}"]
    matches: list[str] = []
    for candidate in candidates:
        result = run_authoritative_git(
            ["rev-parse", "--verify", f"{candidate}^{{commit}}"],
            check=False,
            git_dir=git_dir,
        )
        oid = result.stdout.strip().lower()
        if result.returncode == 0 and _OID_RE.fullmatch(oid):
            matches.append(oid)
    if not matches:
        raise AuthoritativeGitNotFound(f"{field} revision not found")
    if len(set(matches)) != 1 or len(matches) != 1:
        raise ValueError(f"ambiguous {field} revision")
    return matches[0]
 def authoritative_diff(
    from_revision: str,
    to_revision: str,
    *,
    git_dir: str | Path | None = None,
 ) -> dict[str, object]:
    path, _ = verify_repository(git_dir=git_dir)
    from_oid = validate_git_revision(from_revision, "from", git_dir=path)
    to_oid = validate_git_revision(to_revision, "to", git_dir=path)
    args = ["diff", "--no-ext-diff", "--no-textconv", from_oid, to_oid]
    result = run_authoritative_git(args, git_dir=path)
    return {
        "code": 0,
        "stdout": result.stdout,
        "stderr": "",
        "cmd": ["git", f"--git-dir={path}", *args],
        "from_oid": from_oid,
        "to_oid": to_oid,
    }
 def repository_snapshot(
    *,
    git_dir: str | Path | None = None,
    repository_identity: str | None = None,
 ) -> dict[str, object]:
    configured = bool(
        str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
    )
    try:
        path, identity = verify_repository(
            git_dir=git_dir,
            repository_identity=repository_identity,
        )
        head = authoritative_head_oid(git_dir=path)
        return {
            "repository_available": True,
            "authoritative_git_dir_configured": configured,
            "authoritative_git_dir_readable": True,
            "authoritative_git_dir": str(path),
            "authoritative_head_oid": head,
            "repository_identity": identity,
            "query_error": None,
        }
    except (AuthoritativeGitError, ValueError) as exc:
        return {
            "repository_available": False,
            "authoritative_git_dir_configured": configured,
            "authoritative_git_dir_readable": False,
            "authoritative_git_dir": None,
            "authoritative_head_oid": None,
            "repository_identity": str(
                repository_identity
                or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
            ).strip() or None,
            "query_error": _redact(str(exc)),
        }
@@ -1,167 +0,0 @@
 """Fail-closed operation authorization for an isolated Git writer."""
 from __future__ import annotations
 import ipaddress
 import os
 import re
 import subprocess
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 from isolated_writer_token_registry import TokenRegistry
 ROUTE_OPERATIONS = {
    ("GET", "/api/runtime-status"): "runtime.status.read",
    ("GET", "/api/baseline"): "baseline.read",
    ("GET", "/api/patches"): "patches.read",
    ("POST", "/api/commit-file"): "commit_file.atomic",
 }
 OID_RE = re.compile(r"[0-9a-f]{40}")
 class AuthorizationError(PermissionError):
    def __init__(self, code: str, status: int = 403):
        super().__init__(code)
        self.code = code
        self.status = status
@dataclass(frozen=True)
 class AuthorizedGrant:
    record: dict[str, Any]
    operation: str
    use_count: int
    @property
    def token_id(self) -> str:
        return str(self.record["token_id"])
    @property
    def task_id(self) -> str:
        return str(self.record["task_id"])
 def operation_for(method: str, path: str) -> str:
    operation = ROUTE_OPERATIONS.get((method.upper(), path))
    if not operation:
        raise AuthorizationError("isolated_writer_operation_forbidden")
    return operation
 def _parse_time(value: Any) -> datetime:
    try:
        parsed = datetime.fromisoformat(str(value).replace("Z", "+00:00"))
    except (TypeError, ValueError):
        raise AuthorizationError("writer_token_time_invalid") from None
    if parsed.tzinfo is None:
        raise AuthorizationError("writer_token_time_invalid")
    return parsed.astimezone(timezone.utc)
 def _git_is_ancestor(workspace: Path, base: str, branch: str) -> bool:
    result = subprocess.run(
        ["git", "merge-base", "--is-ancestor", base, branch],
        cwd=workspace,
        stdout=subprocess.DEVNULL,
        stderr=subprocess.DEVNULL,
    )
    return result.returncode == 0
 def _validate_grant(
    grant: dict[str, Any],
    *,
    audience: str,
    source_ip: str,
    operation: str,
    branch: str | None,
    path: str | None,
    workspace: Path,
    current_time: datetime,
 ) -> None:
    if int(grant.get("schema_version", 0)) != 2:
        raise AuthorizationError("writer_token_policy_v2_required", 401)
    if str(grant.get("audience") or "") != audience:
        raise AuthorizationError("writer_token_audience_rejected")
    try:
        peer = ipaddress.ip_address(source_ip)
        networks = [ipaddress.ip_network(str(value), strict=True) for value in grant.get("source_cidrs", [])]
    except ValueError:
        raise AuthorizationError("writer_token_source_rejected") from None
    if not networks or not any(peer in network for network in networks):
        raise AuthorizationError("writer_token_source_rejected")
    created = _parse_time(grant.get("created_at"))
    not_before = _parse_time(grant.get("not_before"))
    expires = _parse_time(grant.get("expires_at"))
    if expires <= not_before or (expires - created).total_seconds() > 1800:
        raise AuthorizationError("writer_token_lifetime_rejected")
    if current_time < not_before:
        raise AuthorizationError("writer_token_not_yet_valid", 401)
    if current_time >= expires:
        raise AuthorizationError("writer_token_expired", 401)
    if bool(grant.get("revoked")):
        raise AuthorizationError("writer_token_revoked", 401)
    operations = grant.get("allowed_operations")
    if not isinstance(operations, list) or operation not in operations:
        raise AuthorizationError("writer_token_operation_rejected")
    expected_branch = str(grant.get("allowed_branch") or "")
    configured_branch = os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", "")
    if expected_branch != configured_branch:
        raise AuthorizationError("writer_token_branch_rejected")
    if branch is not None and branch != expected_branch:
        raise AuthorizationError("writer_token_branch_rejected")
    if path is not None:
        paths = grant.get("allowed_paths")
        if not isinstance(paths, list) or path not in paths:
            raise AuthorizationError("writer_token_path_rejected")
    base = str(grant.get("approved_base_oid") or "").lower()
    if not OID_RE.fullmatch(base):
        raise AuthorizationError("writer_token_base_rejected")
    if not _git_is_ancestor(workspace, base, expected_branch):
        raise AuthorizationError("writer_token_base_not_ancestor")
 def authorize(
    registry: TokenRegistry,
    token: str,
    *,
    method: str,
    path: str,
    source_ip: str,
    workspace: Path,
    branch: str | None = None,
    target_path: str | None = None,
    current_time: datetime | None = None,
 ) -> AuthorizedGrant:
    if os.getenv("AIOS_GITOPS_TOKEN_POLICY_VERSION_REQUIRED", "") != "2":
        raise AuthorizationError("writer_token_policy_v2_not_required")
    if not token:
        raise AuthorizationError("unauthorized", 401)
    grant = registry.find(token)
    if grant is None:
        raise AuthorizationError("unauthorized", 401)
    operation = operation_for(method, path)
    _validate_grant(
        grant,
        audience=os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", ""),
        source_ip=source_ip,
        operation=operation,
        branch=branch,
        path=target_path,
        workspace=workspace,
        current_time=current_time or datetime.now(timezone.utc),
    )
    limits = grant.get("max_uses")
    if not isinstance(limits, dict):
        raise AuthorizationError("writer_token_use_limit_missing")
    try:
        used = registry.consume(str(grant["token_id"]), operation, int(limits[operation]))
    except (KeyError, TypeError, ValueError):
        raise AuthorizationError("writer_token_use_limit_missing") from None
    except PermissionError as exc:
        code = str(exc)
        raise AuthorizationError(code, 401 if code == "writer_token_revoked" else 403) from None
    return AuthorizedGrant(grant, operation, used)
@@ -1,403 +0,0 @@
 """Atomic, idempotent commit-file Saga for the isolated writer."""
 from __future__ import annotations
 import fcntl
 import hashlib
 import json
 import os
 import re
 import sqlite3
 import subprocess
 import tempfile
 import threading
 from pathlib import Path
 from typing import Any
 import aios_isolated_writer_policy as policy
 OID_RE = re.compile(r"[0-9a-f]{40}")
 IDEMPOTENCY_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{7,127}")
 STATES = frozenset({
    "PENDING", "FILE_WRITTEN", "COMMITTED", "PUSHED", "VERIFIED", "COMPLETED",
    "FAILED_RECOVERABLE", "MANUAL_REVIEW_REQUIRED",
 })
 _LOCKS: dict[str, threading.Lock] = {}
 _LOCKS_GUARD = threading.Lock()
 _LEDGER_INIT_LOCK = threading.Lock()
 class CommitFileError(RuntimeError):
    def __init__(self, code: str, status: int = 400):
        super().__init__(code)
        self.code = code
        self.status = status
 class SimulatedCrash(RuntimeError):
    pass
 def canonical_digest(data: dict[str, Any]) -> str:
    payload = {
        "branch": data["branch"],
        "path": data["path"],
        "content_sha256": hashlib.sha256(data["content"].encode("utf-8")).hexdigest(),
        "message": data["message"],
        "expected_head_oid": data["expected_head_oid"],
    }
    encoded = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")
    return hashlib.sha256(encoded).hexdigest()
 class OperationLedger:
    def __init__(self, path: Path | str):
        self.path = Path(path)
        self.path.parent.mkdir(parents=True, exist_ok=True)
        if self.path.parent.is_symlink() or self.path.is_symlink():
            raise PermissionError("writer_operation_ledger_symlink_rejected")
        with _LEDGER_INIT_LOCK:
            with self.connect() as db:
                db.execute(
                    """
                    CREATE TABLE IF NOT EXISTS writer_operations (
                        operation_id TEXT PRIMARY KEY,
                        token_id TEXT NOT NULL,
                        task_id TEXT NOT NULL,
                        idempotency_key TEXT NOT NULL UNIQUE,
                        operation_digest TEXT NOT NULL,
                        branch TEXT NOT NULL,
                        path TEXT NOT NULL,
                        content_sha256 TEXT NOT NULL,
                        pre_head_oid TEXT NOT NULL,
                        commit_oid TEXT,
                        push_status TEXT,
                        verification_status TEXT,
                        state TEXT NOT NULL,
                        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
                        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
                        error_code TEXT
                    )
                    """
                )
        os.chmod(self.path, 0o600)
    def connect(self) -> sqlite3.Connection:
        db = sqlite3.connect(self.path, timeout=30)
        db.row_factory = sqlite3.Row
        db.execute("PRAGMA journal_mode=WAL")
        db.execute("PRAGMA synchronous=FULL")
        return db
    def get_or_create(self, grant: Any, data: dict[str, Any], digest: str) -> dict[str, Any]:
        key = data["idempotency_key"]
        with self.connect() as db:
            db.execute("BEGIN IMMEDIATE")
            row = db.execute(
                "SELECT * FROM writer_operations WHERE idempotency_key=?", (key,)
            ).fetchone()
            if row:
                db.commit()
                record = dict(row)
                if record["operation_digest"] != digest:
                    raise CommitFileError("writer_idempotency_conflict", 409)
                if (
                    record["token_id"] != grant.token_id
                    or record["task_id"] != grant.task_id
                ):
                    raise CommitFileError("writer_idempotency_owner_conflict", 409)
                return record
            operation_id = hashlib.sha256(
                f"{grant.task_id}\0{key}".encode("utf-8")
            ).hexdigest()
            content_sha = hashlib.sha256(data["content"].encode("utf-8")).hexdigest()
            db.execute(
                """
                INSERT INTO writer_operations(
                    operation_id,token_id,task_id,idempotency_key,operation_digest,
                    branch,path,content_sha256,pre_head_oid,state
                ) VALUES(?,?,?,?,?,?,?,?,?,?)
                """,
                (
                    operation_id, grant.token_id, grant.task_id, key, digest,
                    data["branch"], data["path"], content_sha,
                    data["expected_head_oid"], "PENDING",
                ),
            )
            db.commit()
        return self.get(key)
    def get(self, key: str) -> dict[str, Any]:
        with self.connect() as db:
            row = db.execute(
                "SELECT * FROM writer_operations WHERE idempotency_key=?", (key,)
            ).fetchone()
        if row is None:
            raise KeyError(key)
        return dict(row)
    def update(self, key: str, state: str, **fields: Any) -> dict[str, Any]:
        if state not in STATES:
            raise ValueError("invalid writer operation state")
        allowed = {"commit_oid", "push_status", "verification_status", "error_code"}
        assignments = ["state=?", "updated_at=CURRENT_TIMESTAMP"]
        values: list[Any] = [state]
        for name, value in fields.items():
            if name not in allowed:
                raise ValueError("invalid ledger field")
            assignments.append(f"{name}=?")
            values.append(value)
        values.append(key)
        with self.connect() as db:
            db.execute("BEGIN IMMEDIATE")
            db.execute(
                f"UPDATE writer_operations SET {','.join(assignments)} WHERE idempotency_key=?",
                values,
            )
            db.commit()
        return self.get(key)
 class AtomicCommitFile:
    def __init__(
        self,
        *,
        workspace: Path,
        bare_repo: Path,
        ledger: OperationLedger,
        remote: str,
        audit,
        crash_after_state: str | None = None,
    ):
        self.workspace = workspace
        self.bare_repo = bare_repo
        self.ledger = ledger
        self.remote = remote
        self.audit = audit
        self.crash_after_state = crash_after_state
    def _git(self, *args: str, check: bool = True) -> str:
        result = subprocess.run(
            ["git", *args], cwd=self.workspace, text=True, capture_output=True
        )
        if check and result.returncode != 0:
            raise CommitFileError("writer_git_operation_failed", 500)
        return result.stdout.strip()
    def _transition(self, key: str, state: str, **fields: Any) -> dict[str, Any]:
        record = self.ledger.update(key, state, **fields)
        if self.crash_after_state == state:
            raise SimulatedCrash(state)
        return record
    def _validate(self, data: Any) -> dict[str, Any]:
        if not isinstance(data, dict):
            raise CommitFileError("writer_request_object_required")
        required = ("branch", "path", "content", "message", "expected_head_oid", "idempotency_key")
        if any(field not in data for field in required):
            raise CommitFileError("writer_request_incomplete")
        if data.get("force") or data.get("force_push"):
            raise CommitFileError("isolated_writer_force_rejected", 403)
        if set(data) != set(required):
            raise CommitFileError("writer_request_fields_rejected")
        item = {field: data[field] for field in required}
        if item["branch"] != policy.allowed_branch():
            raise CommitFileError("isolated_writer_branch_rejected", 403)
        try:
            item["path"] = policy.validate_path(item["path"], self.workspace)
        except PermissionError as exc:
            raise CommitFileError(str(exc), 403) from None
        if not isinstance(item["content"], str) or "\x00" in item["content"]:
            raise CommitFileError("writer_content_rejected")
        try:
            policy.validate_content_for_path(item["path"], item["content"])
        except PermissionError as exc:
            raise CommitFileError(str(exc), 403) from None
        if len(item["content"].encode("utf-8")) > 1_048_576:
            raise CommitFileError("writer_content_too_large", 413)
        message = item["message"]
        if (
            not isinstance(message, str)
            or not 1 <= len(message) <= 200
            or "\x00" in message
            or "\n" in message
            or "\r" in message
        ):
            raise CommitFileError("writer_message_rejected")
        if not isinstance(item["expected_head_oid"], str) or not OID_RE.fullmatch(item["expected_head_oid"]):
            raise CommitFileError("writer_expected_head_rejected")
        if not isinstance(item["idempotency_key"], str) or not IDEMPOTENCY_RE.fullmatch(item["idempotency_key"]):
            raise CommitFileError("writer_idempotency_key_rejected")
        return item
    def _atomic_write(self, relative: str, content: str) -> None:
        target = self.workspace / relative
        target.parent.mkdir(parents=True, exist_ok=True)
        fd, temporary = tempfile.mkstemp(prefix=".writer-", dir=target.parent)
        try:
            with os.fdopen(fd, "wb", closefd=True) as stream:
                stream.write(content.encode("utf-8"))
                stream.flush()
                os.fsync(stream.fileno())
            os.replace(temporary, target)
            parent_fd = os.open(target.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
            try:
                os.fsync(parent_fd)
            finally:
                os.close(parent_fd)
        finally:
            if os.path.exists(temporary):
                os.unlink(temporary)
    def _verify_remote(self, branch: str, oid: str) -> None:
        bare = subprocess.run(
            ["git", "--git-dir", str(self.bare_repo), "rev-parse", f"refs/heads/{branch}"],
            text=True, capture_output=True,
        )
        if bare.returncode != 0 or bare.stdout.strip() != oid:
            raise CommitFileError("writer_authoritative_bare_oid_mismatch", 500)
        remote = subprocess.run(
            ["git", "ls-remote", "--heads", self.remote, f"refs/heads/{branch}"],
            cwd=self.workspace, text=True, capture_output=True,
        )
        if remote.returncode != 0:
            raise CommitFileError("writer_gitea_verification_failed", 503)
        fields = remote.stdout.strip().split()
        if len(fields) != 2:
            raise CommitFileError("writer_gitea_ref_missing", 503)
        if fields[0] != oid:
            raise CommitFileError("writer_gitea_oid_conflict", 409)
    def execute(self, grant: Any, raw_data: Any) -> dict[str, Any]:
        data = self._validate(raw_data)
        digest = canonical_digest(data)
        branch = data["branch"]
        with _LOCKS_GUARD:
            lock = _LOCKS.setdefault(branch, threading.Lock())
        lock_path = self.ledger.path.parent / f"{hashlib.sha256(branch.encode()).hexdigest()}.lock"
        with lock, open(lock_path, "a+b") as branch_lock:
            fcntl.flock(branch_lock.fileno(), fcntl.LOCK_EX)
            return self._execute_locked(grant, data, digest)
    def _execute_locked(self, grant: Any, data: dict[str, Any], digest: str) -> dict[str, Any]:
        key = data["idempotency_key"]
        record = self.ledger.get_or_create(grant, data, digest)
        if record["state"] == "COMPLETED":
            return self._result(record, idempotent=True)
        if self._git("rev-parse", "--abbrev-ref", "HEAD") != data["branch"]:
            record = self._transition(
                key, "MANUAL_REVIEW_REQUIRED", error_code="writer_current_branch_conflict"
            )
            self._audit(grant, data, digest, record, "manual_review_required")
            raise CommitFileError("writer_current_branch_conflict", 409)
        head = self._git("rev-parse", "HEAD")
        commit_oid = record.get("commit_oid")
        if head != record["pre_head_oid"] and head != commit_oid:
            record = self._transition(
                key, "MANUAL_REVIEW_REQUIRED", error_code="writer_branch_head_conflict"
            )
            self._audit(grant, data, digest, record, "manual_review_required")
            raise CommitFileError("writer_branch_head_conflict", 409)
        try:
            state = record["state"]
            if state == "MANUAL_REVIEW_REQUIRED":
                raise CommitFileError("writer_manual_review_required", 409)
            if state == "FAILED_RECOVERABLE":
                if record.get("push_status") == "confirmed":
                    state = "PUSHED"
                else:
                    state = "COMMITTED" if commit_oid else "FILE_WRITTEN"
            if state == "PENDING":
                self._atomic_write(data["path"], data["content"])
                record = self._transition(key, "FILE_WRITTEN")
                state = record["state"]
            if state == "FILE_WRITTEN":
                actual_sha = hashlib.sha256(
                    (self.workspace / data["path"]).read_bytes()
                ).hexdigest()
                if actual_sha != record["content_sha256"]:
                    raise CommitFileError("writer_file_content_conflict", 409)
                staged_before = self._git("diff", "--cached", "--name-only", check=False).splitlines()
                if staged_before:
                    raise CommitFileError("writer_extra_staged_files_rejected", 409)
                self._git("add", "--", data["path"])
                staged = self._git("diff", "--cached", "--name-only").splitlines()
                if staged != [data["path"]]:
                    raise CommitFileError("writer_extra_staged_files_rejected", 409)
                self._git("commit", "-m", data["message"])
                commit_oid = self._git("rev-parse", "HEAD")
                record = self._transition(key, "COMMITTED", commit_oid=commit_oid)
                state = record["state"]
            if state == "COMMITTED":
                commit_oid = str(record["commit_oid"])
                pushed = subprocess.run(
                    ["git", "push", "--porcelain", self.remote, f"HEAD:refs/heads/{data['branch']}"],
                    cwd=self.workspace, text=True, capture_output=True,
                )
                if pushed.returncode != 0:
                    self._transition(
                        key, "FAILED_RECOVERABLE",
                        push_status="failed", error_code="writer_gitea_push_failed",
                    )
                    raise CommitFileError("writer_gitea_push_failed", 503)
                record = self._transition(key, "PUSHED", push_status="confirmed")
                state = record["state"]
            if state == "PUSHED":
                commit_oid = str(record["commit_oid"])
                self._verify_remote(data["branch"], commit_oid)
                record = self._transition(
                    key, "VERIFIED", verification_status="bare+gitea"
                )
                state = record["state"]
            if state == "VERIFIED":
                record = self._transition(key, "COMPLETED", error_code=None)
            self._audit(grant, data, digest, record, "completed")
            return self._result(record, idempotent=False)
        except SimulatedCrash:
            raise
        except CommitFileError as exc:
            latest = self.ledger.get(key)
            if latest["state"] not in {"FAILED_RECOVERABLE", "MANUAL_REVIEW_REQUIRED"}:
                failure_state = (
                    "MANUAL_REVIEW_REQUIRED"
                    if exc.code in {
                        "writer_gitea_oid_conflict",
                        "writer_file_content_conflict",
                        "writer_current_branch_conflict",
                    }
                    else "FAILED_RECOVERABLE"
                )
                latest = self._transition(key, failure_state, error_code=exc.code)
            self._audit(grant, data, digest, latest, "failed")
            raise
    def _audit(self, grant: Any, data: dict[str, Any], digest: str, record: dict[str, Any], result: str) -> None:
        self.audit({
            "token_id": grant.token_id,
            "task_id": grant.task_id,
            "audience": grant.record["audience"],
            "source_ip": grant.record.get("_source_ip", "socket-peer"),
            "operation": grant.operation,
            "branch": data["branch"],
            "path": data["path"],
            "idempotency_key": data["idempotency_key"],
            "operation_digest": digest,
            "path_policy_sha256": policy.configured_path_policy_sha256(),
            "pre_head_oid": record["pre_head_oid"],
            "commit_oid": record.get("commit_oid"),
            "result": result,
        })
    @staticmethod
    def _result(record: dict[str, Any], *, idempotent: bool) -> dict[str, Any]:
        return {
            "status": "completed",
            "state": record["state"],
            "operation_id": record["operation_id"],
            "branch": record["branch"],
            "path": record["path"],
            "commit_oid": record.get("commit_oid"),
            "push_status": record.get("push_status"),
            "verification_status": record.get("verification_status"),
            "idempotent": idempotent,
        }
@@ -1,422 +0,0 @@
 """Strict service-level exact-path policy for isolated Git writers."""
 from __future__ import annotations
 import grp
 import hashlib
 import json
 import os
 import re
 import stat
 from dataclasses import dataclass
 from functools import lru_cache
 from pathlib import Path, PurePosixPath, PureWindowsPath
 from typing import Any
 from urllib.parse import unquote
 MAX_POLICY_BYTES = 65_536
 POLICY_FIELDS = frozenset(
    {
        "schema_version",
        "policy_id",
        "audience",
        "repository_identity",
        "allowed_branch",
        "allowed_operations",
    }
 )
 OPERATION_FIELDS = frozenset({"exact_paths", "max_content_bytes", "content_profile"})
 SUPPORTED_OPERATIONS = frozenset({"commit_file.atomic"})
 SUPPORTED_CONTENT_PROFILES = frozenset({"systemd-codex-review-worker-v1"})
 _SECRET_RE = re.compile(
    r"(?i)(authorization\s*:|bearer\s+|(?:token|password|secret)\s*[:=])"
 )
 _SYSTEMD_NAME_RE = re.compile(r"[A-Za-z][A-Za-z0-9]*\Z")
 _SYSTEMD_MAX_LINE_BYTES = 4096
 _SYSTEMD_ALLOWED_DIRECTIVES = {
    "Unit": frozenset({"Description", "After", "Wants"}),
    "Service": frozenset(
        {
            "Type",
            "User",
            "Group",
            "WorkingDirectory",
            "Environment",
            "ExecStart",
            "Restart",
            "RestartSec",
            "NoNewPrivileges",
            "PrivateTmp",
            "PrivateDevices",
            "ProtectSystem",
            "ProtectHome",
            "ProtectKernelTunables",
            "ProtectKernelModules",
            "ProtectControlGroups",
            "LockPersonality",
            "RestrictSUIDSGID",
            "RestrictRealtime",
            "MemoryDenyWriteExecute",
            "RuntimeDirectory",
            "StateDirectory",
            "CacheDirectory",
            "ReadOnlyPaths",
            "ReadWritePaths",
            "UMask",
        }
    ),
    "Install": frozenset({"WantedBy"}),
 }
 _SYSTEMD_MULTI_DIRECTIVES = frozenset(
    {
        ("Service", "Environment"),
        ("Service", "ReadOnlyPaths"),
        ("Service", "ReadWritePaths"),
    }
 )
 _SYSTEMD_EXACT_SINGLE_VALUES = {
    ("Unit", "Description"): "AIOS Codex Review/Test Worker",
    ("Unit", "After"): "network-online.target",
    ("Unit", "Wants"): "network-online.target",
    ("Service", "Type"): "simple",
    ("Service", "User"): "aiman",
    ("Service", "Group"): "gitops",
    (
        "Service",
        "WorkingDirectory",
    ): "/usr/libexec/aios-codex-review-test-worker/current",
    (
        "Service",
        "ExecStart",
    ): "/usr/bin/python3 -m task_plane.workers.codex_review_test",
    ("Service", "Restart"): "on-failure",
    ("Service", "RestartSec"): "2",
    ("Service", "NoNewPrivileges"): "true",
    ("Service", "PrivateTmp"): "true",
    ("Service", "PrivateDevices"): "true",
    ("Service", "ProtectSystem"): "strict",
    ("Service", "ProtectHome"): "true",
    ("Service", "ProtectKernelTunables"): "true",
    ("Service", "ProtectKernelModules"): "true",
    ("Service", "ProtectControlGroups"): "true",
    ("Service", "LockPersonality"): "true",
    ("Service", "RestrictSUIDSGID"): "true",
    ("Service", "RestrictRealtime"): "true",
    ("Service", "MemoryDenyWriteExecute"): "true",
    ("Service", "RuntimeDirectory"): "aios-codex-review-test-worker",
    ("Service", "StateDirectory"): "aios-codex-review-test-worker",
    ("Service", "CacheDirectory"): "aios-codex-review-test-worker",
    ("Service", "UMask"): "0077",
    ("Install", "WantedBy"): "multi-user.target",
 }
 _SYSTEMD_EXACT_MULTI_VALUES = {
    ("Service", "Environment"): (
        "AIOS_CODEX_WORKER_MODE=shadow",
        "AIOS_TASK_PLANE_EXECUTION_ENABLED=false",
        "PYTHONDONTWRITEBYTECODE=1",
    ),
    ("Service", "ReadOnlyPaths"): (
        "/data/aios-gitops/repo.git",
        "/usr/libexec/aios-codex-review-test-worker",
    ),
    ("Service", "ReadWritePaths"): (
        "/run/aios-codex-review-test-worker",
        "/var/lib/aios-codex-review-test-worker",
        "/var/cache/aios-codex-review-test-worker",
    ),
 }
 class PathPolicyError(PermissionError):
    pass
@dataclass(frozen=True)
 class OperationPolicy:
    exact_paths: tuple[str, ...]
    max_content_bytes: int
    content_profile: str
@dataclass(frozen=True)
 class ServicePathPolicy:
    schema_version: int
    policy_id: str
    audience: str
    repository_identity: str
    allowed_branch: str
    allowed_operations: dict[str, OperationPolicy]
    sha256: str
    def operation(self, name: str) -> OperationPolicy:
        try:
            return self.allowed_operations[name]
        except KeyError:
            raise PathPolicyError("isolated_writer_service_operation_rejected") from None
    def require_exact_path(self, operation: str, path: str) -> OperationPolicy:
        selected = self.operation(operation)
        if path not in selected.exact_paths:
            raise PathPolicyError("isolated_writer_service_path_rejected")
        return selected
 def _canonical_json(value: Any) -> bytes:
    return (
        json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
        + "\n"
    ).encode("utf-8")
 def validate_relative_path_syntax(path: str) -> str:
    if not isinstance(path, str):
        raise PathPolicyError("isolated_writer_path_rejected")
    if not path or path != path.strip() or "\x00" in path or "\\" in path:
        raise PathPolicyError("isolated_writer_path_rejected")
    try:
        decoded = unquote(path, errors="strict")
    except (UnicodeDecodeError, ValueError):
        raise PathPolicyError("isolated_writer_path_rejected") from None
    if decoded != path:
        raise PathPolicyError("isolated_writer_path_rejected")
    posix = PurePosixPath(path)
    windows = PureWindowsPath(path)
    parts = path.split("/")
    if (
        posix.is_absolute()
        or windows.is_absolute()
        or bool(windows.drive)
        or any(part in {"", ".", ".."} for part in parts)
    ):
        raise PathPolicyError("isolated_writer_path_rejected")
    return path
 def _require_fields(value: dict[str, Any], allowed: frozenset[str], code: str) -> None:
    if set(value) != allowed:
        raise PathPolicyError(code)
 def _parse_policy(document: Any, canonical: bytes) -> ServicePathPolicy:
    if not isinstance(document, dict):
        raise PathPolicyError("isolated_writer_path_policy_object_required")
    _require_fields(document, POLICY_FIELDS, "isolated_writer_path_policy_fields_rejected")
    if document["schema_version"] != 1:
        raise PathPolicyError("isolated_writer_path_policy_schema_rejected")
    text_fields = (
        "policy_id",
        "audience",
        "repository_identity",
        "allowed_branch",
    )
    if any(
        not isinstance(document[field], str) or not document[field].strip()
        for field in text_fields
    ):
        raise PathPolicyError("isolated_writer_path_policy_value_rejected")
    raw_operations = document["allowed_operations"]
    if not isinstance(raw_operations, dict) or not raw_operations:
        raise PathPolicyError("isolated_writer_path_policy_operations_rejected")
    if not set(raw_operations).issubset(SUPPORTED_OPERATIONS):
        raise PathPolicyError("isolated_writer_path_policy_operations_rejected")
    operations: dict[str, OperationPolicy] = {}
    for name, raw in raw_operations.items():
        if not isinstance(raw, dict):
            raise PathPolicyError("isolated_writer_path_policy_operation_rejected")
        _require_fields(
            raw,
            OPERATION_FIELDS,
            "isolated_writer_path_policy_operation_fields_rejected",
        )
        paths = raw["exact_paths"]
        if (
            not isinstance(paths, list)
            or not paths
            or any(not isinstance(item, str) for item in paths)
        ):
            raise PathPolicyError("isolated_writer_path_policy_paths_rejected")
        validated = tuple(validate_relative_path_syntax(item) for item in paths)
        if len(set(validated)) != len(validated):
            raise PathPolicyError("isolated_writer_path_policy_paths_rejected")
        maximum = raw["max_content_bytes"]
        if not isinstance(maximum, int) or isinstance(maximum, bool) or not 1 <= maximum <= 1_048_576:
            raise PathPolicyError("isolated_writer_path_policy_size_rejected")
        profile = raw["content_profile"]
        if profile not in SUPPORTED_CONTENT_PROFILES:
            raise PathPolicyError("isolated_writer_path_policy_profile_rejected")
        operations[name] = OperationPolicy(validated, maximum, profile)
    return ServicePathPolicy(
        schema_version=1,
        policy_id=document["policy_id"],
        audience=document["audience"],
        repository_identity=document["repository_identity"],
        allowed_branch=document["allowed_branch"],
        allowed_operations=operations,
        sha256=hashlib.sha256(canonical).hexdigest(),
    )
 def load_path_policy(
    path: Path,
    *,
    expected_owner_uid: int = 0,
    expected_group_gid: int | None = None,
    expected_parent_mode: int = 0o750,
    expected_file_mode: int = 0o640,
 ) -> ServicePathPolicy:
    lexical = Path(os.path.abspath(str(path)))
    if lexical.is_symlink():
        raise PathPolicyError("isolated_writer_path_policy_symlink_rejected")
    try:
        parent_info = lexical.parent.stat(follow_symlinks=False)
        file_info = lexical.stat(follow_symlinks=False)
    except FileNotFoundError:
        raise PathPolicyError("isolated_writer_path_policy_missing") from None
    if stat.S_ISLNK(parent_info.st_mode) or not stat.S_ISDIR(parent_info.st_mode):
        raise PathPolicyError("isolated_writer_path_policy_parent_rejected")
    if stat.S_ISLNK(file_info.st_mode) or not stat.S_ISREG(file_info.st_mode):
        raise PathPolicyError("isolated_writer_path_policy_file_rejected")
    if lexical.resolve(strict=True) != lexical:
        raise PathPolicyError("isolated_writer_path_policy_symlink_rejected")
    if (
        parent_info.st_uid != expected_owner_uid
        or stat.S_IMODE(parent_info.st_mode) != expected_parent_mode
    ):
        raise PathPolicyError("isolated_writer_path_policy_parent_permissions_rejected")
    if (
        file_info.st_uid != expected_owner_uid
        or stat.S_IMODE(file_info.st_mode) != expected_file_mode
    ):
        raise PathPolicyError("isolated_writer_path_policy_permissions_rejected")
    if expected_group_gid is not None and (
        parent_info.st_gid != expected_group_gid or file_info.st_gid != expected_group_gid
    ):
        raise PathPolicyError("isolated_writer_path_policy_group_rejected")
    if file_info.st_size <= 0 or file_info.st_size > MAX_POLICY_BYTES:
        raise PathPolicyError("isolated_writer_path_policy_file_size_rejected")
    raw = lexical.read_bytes()
    try:
        document = json.loads(raw.decode("utf-8"))
    except (UnicodeDecodeError, json.JSONDecodeError):
        raise PathPolicyError("isolated_writer_path_policy_json_rejected") from None
    canonical = _canonical_json(document)
    if raw != canonical:
        raise PathPolicyError("isolated_writer_path_policy_not_canonical")
    return _parse_policy(document, canonical)
@lru_cache(maxsize=1)
 def configured_path_policy() -> ServicePathPolicy | None:
    configured = os.getenv("AIOS_GITOPS_PATH_POLICY_FILE", "").strip()
    if not configured:
        return None
    if not Path(configured).is_absolute():
        raise PathPolicyError("isolated_writer_path_policy_path_rejected")
    try:
        gitops_gid = grp.getgrnam("gitops").gr_gid
    except KeyError:
        raise PathPolicyError("isolated_writer_path_policy_group_rejected") from None
    loaded = load_path_policy(Path(configured), expected_group_gid=gitops_gid)
    if loaded.audience != os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", ""):
        raise PathPolicyError("isolated_writer_path_policy_audience_rejected")
    if loaded.repository_identity != os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", ""):
        raise PathPolicyError("isolated_writer_path_policy_repository_rejected")
    if loaded.allowed_branch != os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", ""):
        raise PathPolicyError("isolated_writer_path_policy_branch_rejected")
    return loaded
 def clear_path_policy_cache() -> None:
    configured_path_policy.cache_clear()
 def require_service_path(operation: str, path: str) -> OperationPolicy:
    loaded = configured_path_policy()
    if loaded is None:
        raise PathPolicyError("isolated_writer_service_path_policy_required")
    return loaded.require_exact_path(operation, path)
 def configured_path_policy_sha256() -> str | None:
    loaded = configured_path_policy()
    return None if loaded is None else loaded.sha256
 def validate_content(operation: str, path: str, content: str) -> None:
    selected = require_service_path(operation, path)
    try:
        encoded = content.encode("utf-8", errors="strict")
    except (AttributeError, UnicodeEncodeError):
        raise PathPolicyError("isolated_writer_systemd_profile_rejected") from None
    if len(encoded) > selected.max_content_bytes:
        raise PathPolicyError("isolated_writer_service_content_too_large")
    if selected.content_profile == "systemd-codex-review-worker-v1":
        _validate_systemd_codex_review_worker(content)
        return
    raise PathPolicyError("isolated_writer_path_policy_profile_rejected")
 def _validate_systemd_codex_review_worker(content: str) -> None:
    if not isinstance(content, str):
        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
    try:
        content.encode("utf-8", errors="strict")
    except UnicodeEncodeError:
        raise PathPolicyError("isolated_writer_systemd_profile_rejected") from None
    if (
        "\x00" in content
        or "\r" in content
        or _SECRET_RE.search(content)
        or not content.endswith("\n")
    ):
        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
    sections: set[str] = set()
    values: dict[tuple[str, str], list[str]] = {}
    section: str | None = None
    for line in content.splitlines():
        if len(line.encode("utf-8")) > _SYSTEMD_MAX_LINE_BYTES:
            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
        if not line:
            continue
        if line[0].isspace() or line.startswith(("#", ";")):
            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
        if line.startswith("[") and line.endswith("]"):
            candidate = line[1:-1]
            if (
                not _SYSTEMD_NAME_RE.fullmatch(candidate)
                or candidate not in _SYSTEMD_ALLOWED_DIRECTIVES
                or candidate in sections
            ):
                raise PathPolicyError("isolated_writer_systemd_profile_rejected")
            sections.add(candidate)
            section = candidate
            continue
        if section is None or "=" not in line:
            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
        directive, value = line.split("=", 1)
        if (
            not _SYSTEMD_NAME_RE.fullmatch(directive)
            or directive not in _SYSTEMD_ALLOWED_DIRECTIVES[section]
            or not value
            or value != value.strip()
        ):
            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
        key = (section, directive)
        if key in values and key not in _SYSTEMD_MULTI_DIRECTIVES:
            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
        values.setdefault(key, []).append(value)
    if sections != set(_SYSTEMD_ALLOWED_DIRECTIVES):
        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
    if set(values) != set(_SYSTEMD_EXACT_SINGLE_VALUES) | set(
        _SYSTEMD_EXACT_MULTI_VALUES
    ):
        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
    for key, expected in _SYSTEMD_EXACT_SINGLE_VALUES.items():
        if values.get(key) != [expected]:
            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
    for key, expected in _SYSTEMD_EXACT_MULTI_VALUES.items():
        observed = values.get(key, [])
        if len(observed) != len(set(observed)) or tuple(observed) != expected:
            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
@@ -1,241 +0,0 @@
 """Digest-only, task-scoped token registry for isolated writers."""
 from __future__ import annotations
 import argparse
 import hashlib
 import hmac
 import json
 import os
 import grp
 import pwd
 import secrets
 import sqlite3
 import stat
 import threading
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 _REGISTRY_INIT_LOCK = threading.Lock()
 def utc_now() -> str:
    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 def token_digest(token: str) -> str:
    return hashlib.sha256(token.encode("utf-8")).hexdigest()
 class TokenRegistry:
    def __init__(self, path: Path | str):
        self.path = Path(path)
        self._prepare()
    def _prepare(self) -> None:
        self.path.parent.mkdir(parents=True, exist_ok=True)
        if self.path.parent.is_symlink() or self.path.is_symlink():
            raise PermissionError("writer_token_registry_symlink_rejected")
        with _REGISTRY_INIT_LOCK:
            with self._connect() as db:
                db.executescript(
                    """
                    CREATE TABLE IF NOT EXISTS token_grants (
                        token_id TEXT PRIMARY KEY,
                        token_digest TEXT NOT NULL UNIQUE,
                        grant_json TEXT NOT NULL,
                        revoked INTEGER NOT NULL DEFAULT 0,
                        created_at TEXT NOT NULL
                    );
                    CREATE TABLE IF NOT EXISTS token_uses (
                        token_id TEXT NOT NULL,
                        operation TEXT NOT NULL,
                        use_count INTEGER NOT NULL DEFAULT 0,
                        PRIMARY KEY(token_id, operation),
                        FOREIGN KEY(token_id) REFERENCES token_grants(token_id)
                    );
                    """
                )
        os.chmod(self.path, 0o600)
    def _connect(self) -> sqlite3.Connection:
        db = sqlite3.connect(self.path, timeout=30, isolation_level=None)
        db.row_factory = sqlite3.Row
        db.execute("PRAGMA journal_mode=WAL")
        db.execute("PRAGMA synchronous=FULL")
        db.execute("PRAGMA foreign_keys=ON")
        return db
    def issue(self, grant: dict[str, Any], token: str | None = None) -> tuple[str, dict[str, Any]]:
        value = token or secrets.token_urlsafe(32)
        if len(value.encode("utf-8")) < 32:
            raise ValueError("writer_token_entropy_insufficient")
        record = dict(grant)
        record["schema_version"] = 2
        record["token_digest"] = token_digest(value)
        record["revoked"] = False
        record.setdefault("created_at", utc_now())
        required = (
            "token_id",
            "audience",
            "task_id",
            "source_cidrs",
            "allowed_branch",
            "approved_base_oid",
            "allowed_operations",
            "allowed_paths",
            "not_before",
            "expires_at",
            "max_uses",
            "issued_by",
        )
        if any(not record.get(field) for field in required):
            raise ValueError("writer_token_grant_incomplete")
        encoded = json.dumps(record, sort_keys=True, separators=(",", ":"))
        with self._connect() as db:
            db.execute("BEGIN IMMEDIATE")
            try:
                db.execute(
                    """
                    INSERT INTO token_grants(token_id, token_digest, grant_json, revoked, created_at)
                    VALUES(?,?,?,?,?)
                    """,
                    (
                        str(record["token_id"]),
                        str(record["token_digest"]),
                        encoded,
                        0,
                        str(record["created_at"]),
                    ),
                )
                db.execute("COMMIT")
            except Exception:
                db.execute("ROLLBACK")
                raise
        return value, record
    def find(self, token: str) -> dict[str, Any] | None:
        candidate = token_digest(token)
        with self._connect() as db:
            rows = db.execute(
                "SELECT token_digest, grant_json, revoked FROM token_grants"
            ).fetchall()
        match = None
        for row in rows:
            if hmac.compare_digest(str(row["token_digest"]), candidate):
                match = dict(json.loads(str(row["grant_json"])))
                match["revoked"] = bool(row["revoked"])
        return match
    def consume(self, token_id: str, operation: str, maximum: int) -> int:
        if maximum < 1:
            raise PermissionError("writer_token_operation_exhausted")
        with self._connect() as db:
            db.execute("BEGIN IMMEDIATE")
            try:
                row = db.execute(
                    "SELECT revoked FROM token_grants WHERE token_id=?",
                    (token_id,),
                ).fetchone()
                if row is None or bool(row["revoked"]):
                    raise PermissionError("writer_token_revoked")
                used_row = db.execute(
                    "SELECT use_count FROM token_uses WHERE token_id=? AND operation=?",
                    (token_id, operation),
                ).fetchone()
                used = int(used_row["use_count"]) if used_row else 0
                if used >= maximum:
                    raise PermissionError("writer_token_operation_exhausted")
                current = used + 1
                db.execute(
                    """
                    INSERT INTO token_uses(token_id, operation, use_count)
                    VALUES(?,?,?)
                    ON CONFLICT(token_id, operation)
                    DO UPDATE SET use_count=excluded.use_count
                    """,
                    (token_id, operation, current),
                )
                db.execute("COMMIT")
                return current
            except Exception:
                db.execute("ROLLBACK")
                raise
    def revoke(self, token_id: str) -> bool:
        with self._connect() as db:
            db.execute("BEGIN IMMEDIATE")
            changed = db.execute(
                "UPDATE token_grants SET revoked=1 WHERE token_id=? AND revoked=0",
                (token_id,),
            ).rowcount
            db.execute("COMMIT")
        return bool(changed)
    def usage(self, token_id: str, operation: str) -> int:
        with self._connect() as db:
            row = db.execute(
                "SELECT use_count FROM token_uses WHERE token_id=? AND operation=?",
                (token_id, operation),
            ).fetchone()
        return int(row["use_count"]) if row else 0
 def _write_secret_file(
    path: Path,
    token: str,
    *,
    owner: str | None = None,
    group: str | None = None,
 ) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    if path.parent.is_symlink() or path.is_symlink():
        raise PermissionError("writer_token_file_symlink_rejected")
    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
    if hasattr(os, "O_NOFOLLOW"):
        flags |= os.O_NOFOLLOW
    fd = os.open(path, flags, 0o600)
    try:
        if not stat.S_ISREG(os.fstat(fd).st_mode):
            raise PermissionError("writer_token_file_not_regular")
        if owner is not None or group is not None:
            uid = pwd.getpwnam(owner).pw_uid if owner is not None else -1
            gid = grp.getgrnam(group).gr_gid if group is not None else -1
            os.fchown(fd, uid, gid)
        os.write(fd, token.encode("utf-8"))
        os.fsync(fd)
    finally:
        os.close(fd)
 def main(argv: list[str] | None = None) -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--registry", required=True)
    sub = parser.add_subparsers(dest="command", required=True)
    issue = sub.add_parser("issue")
    issue.add_argument("--grant-file", required=True)
    issue.add_argument("--token-file", required=True)
    issue.add_argument("--owner")
    issue.add_argument("--group")
    revoke = sub.add_parser("revoke")
    revoke.add_argument("--token-id", required=True)
    args = parser.parse_args(argv)
    registry = TokenRegistry(args.registry)
    if args.command == "issue":
        grant = json.loads(Path(args.grant_file).read_text(encoding="utf-8"))
        token, record = registry.issue(grant)
        _write_secret_file(
            Path(args.token_file),
            token,
            owner=args.owner,
            group=args.group,
        )
        print(json.dumps({"token_id": record["token_id"], "created": True}, sort_keys=True))
        return 0
    changed = registry.revoke(args.token_id)
    print(json.dumps({"token_id": args.token_id, "revoked": changed}, sort_keys=True))
    return 0
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -1,564 +0,0 @@
 #!/usr/bin/env python3
 """Execution-readiness adapters and the fail-closed Shadow controller service."""
 from __future__ import annotations
 import argparse
 import base64
 import dataclasses
 import hashlib
 import json
 import os
 import subprocess
 import threading
 import time
 from http import HTTPStatus
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any, Callable, Mapping, Protocol
 from urllib.parse import parse_qs, urlparse
 from cryptography.hazmat.primitives.asymmetric.ed25519 import (
    Ed25519PrivateKey,
 )
 from silent_release_controller import _sanitize, utc_now
 from silent_release_hardening import (
    BuilderAttestation,
    CapabilityAuthorizationError,
    ReleaseRecoveryWorker,
    SignedApprovalVerifier,
    SignedReleasePlanApproval,
    SilentReleaseActionService,
    TrustedCandidateBundle,
    _canonical_json,
    _durable_json,
    _safe_child,
 )
 class BuilderSigner(Protocol):
    @property
    def key_id(self) -> str:
        ...
    def sign(self, payload: bytes) -> bytes:
        ...
 class LocalTestBuilderSigner:
    """Ephemeral in-memory signer. It is forbidden for production execution."""
    test_only = True
    def __init__(self, key_id: str, private_key: Ed25519PrivateKey):
        self._key_id = str(key_id)
        self._private_key = private_key
    @property
    def key_id(self) -> str:
        return self._key_id
    @classmethod
    def generate(
        cls, key_id: str = "shadow-builder-test-key"
    ) -> "LocalTestBuilderSigner":
        return cls(key_id, Ed25519PrivateKey.generate())
    @property
    def public_key(self):
        return self._private_key.public_key()
    def sign(self, payload: bytes) -> bytes:
        return self._private_key.sign(payload)
 class ExternalKmsBuilderSigner:
    """Signer facade whose private operation remains in KMS/HSM."""
    def __init__(
        self,
        key_id: str,
        credential_reference: str,
        sign_callback: Callable[[str, bytes], bytes],
    ):
        if not str(credential_reference).startswith(
            ("kms://", "hsm://", "secret-manager://")
        ):
            raise ValueError("production builder requires a KMS/HSM reference")
        self._key_id = str(key_id)
        self.credential_reference = str(credential_reference)
        self._sign_callback = sign_callback
    @property
    def key_id(self) -> str:
        return self._key_id
    def sign(self, payload: bytes) -> bytes:
        return bytes(self._sign_callback(self.credential_reference, payload))
 class SignedTrustedBuilderAdapter:
    """Signs evidence produced by a trusted collector, never caller evidence."""
    def __init__(
        self,
        collector: Callable[[Mapping[str, Any]], TrustedCandidateBundle],
        signer: BuilderSigner,
    ):
        self.collector = collector
        self.signer = signer
    def build(self, intent: Mapping[str, Any]) -> TrustedCandidateBundle:
        forbidden = {
            "artifact_sha256",
            "canary",
            "checks",
            "manifest_sha256",
            "tests",
            "tree_oid",
        }
        if forbidden.intersection(intent):
            raise CapabilityAuthorizationError(
                "trusted builder rejects caller-supplied evidence"
            )
        unsigned = self.collector(dict(intent))
        if unsigned.attestation is not None:
            raise CapabilityAuthorizationError(
                "collector cannot self-attest its evidence"
            )
        candidate = unsigned.candidate
        test_sha = hashlib.sha256(
            _canonical_json(_sanitize(candidate.tests))
        ).hexdigest()
        canary_sha = hashlib.sha256(
            _canonical_json(_sanitize(candidate.canary))
        ).hexdigest()
        attestation_id = "builder-attestation-" + hashlib.sha256(
            (
                candidate.candidate_id
                + "\0"
                + candidate.source_commit
                + "\0"
                + candidate.artifact_sha256
            ).encode("utf-8")
        ).hexdigest()[:24]
        attestation = BuilderAttestation(
            builder_attestation_id=attestation_id,
            builder_key_id=self.signer.key_id,
            source_commit=candidate.source_commit,
            tree_oid=candidate.tree_oid,
            artifact_sha256=candidate.artifact_sha256,
            manifest_sha256=candidate.manifest_sha256,
            package_closure_sha256=(
                unsigned.release_plan.deployment.package_closure_sha256
            ),
            test_evidence_sha256=test_sha,
            canary_evidence_sha256=canary_sha,
            issued_at=utc_now(),
            signature="",
        )
        attestation = dataclasses.replace(
            attestation,
            signature=base64.b64encode(
                self.signer.sign(attestation.canonical_bytes())
            ).decode("ascii"),
        )
        return dataclasses.replace(unsigned, attestation=attestation)
 class ApprovalBackendAdapter(Protocol):
    @property
    def available(self) -> bool:
        ...
    def verify(
        self,
        approval: SignedReleasePlanApproval,
        *,
        candidate,
        release_plan,
        policy_sha256: str,
    ) -> SignedReleasePlanApproval:
        ...
 class LocalTestApprovalSigner:
    """Test-only approval signer used solely for Shadow acceptance."""
    test_only = True
    def __init__(self, key_id: str, private_key: Ed25519PrivateKey):
        self.key_id = str(key_id)
        self.private_key = private_key
    @classmethod
    def generate(
        cls, key_id: str = "shadow-owner-test-key"
    ) -> "LocalTestApprovalSigner":
        return cls(key_id, Ed25519PrivateKey.generate())
    def sign(
        self, approval: SignedReleasePlanApproval
    ) -> SignedReleasePlanApproval:
        unsigned = dataclasses.replace(
            approval, key_id=self.key_id, signature=""
        )
        return dataclasses.replace(
            unsigned,
            signature=base64.b64encode(
                self.private_key.sign(unsigned.canonical_bytes())
            ).decode("ascii"),
        )
 class ProductionApprovalBackendAdapter:
    """Verification-only production adapter configured by a secret/KMS ref."""
    def __init__(
        self,
        verifier: SignedApprovalVerifier,
        credential_reference: str,
    ):
        if not str(credential_reference).startswith(
            ("kms://", "hsm://", "secret-manager://")
        ):
            raise ValueError(
                "production approval backend requires a KMS/secret reference"
            )
        self.verifier = verifier
        self.credential_reference = str(credential_reference)
    @property
    def available(self) -> bool:
        return True
    def verify(
        self,
        approval: SignedReleasePlanApproval,
        *,
        candidate,
        release_plan,
        policy_sha256: str,
    ) -> SignedReleasePlanApproval:
        return self.verifier.verify_release_plan(
            approval, candidate, release_plan, policy_sha256
        )
 class UnavailableProductionApprovalBackend:
    credential_reference = None
    @property
    def available(self) -> bool:
        return False
    def verify(self, *args, **kwargs):
        raise CapabilityAuthorizationError(
            "production approval backend is not configured"
        )
 class LeaderLock:
    def __init__(self, path: Path):
        self.path = Path(path)
        self.handle = None
    def __enter__(self):
        self.path.parent.mkdir(parents=True, exist_ok=True)
        os.chmod(self.path.parent, 0o700)
        self.handle = self.path.open("a+", encoding="utf-8")
        os.chmod(self.path, 0o600)
        try:
            import fcntl
            fcntl.flock(
                self.handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB
            )
        except BlockingIOError as exc:
            self.handle.close()
            self.handle = None
            raise RuntimeError("silent release leader is already active") from exc
        return self
    def __exit__(self, exc_type, exc, tb):
        if self.handle is not None:
            try:
                import fcntl
                fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
            finally:
                self.handle.close()
                self.handle = None
 class PersistentSilentReleaseController:
    """Idempotent main-event controller with durable startup/recovery reports."""
    def __init__(
        self,
        root: Path,
        service: SilentReleaseActionService,
        *,
        main_probe: Callable[[], str],
        recovery_worker: ReleaseRecoveryWorker | None = None,
    ):
        self.root = Path(root)
        self.service = service
        self.main_probe = main_probe
        self.recovery_worker = recovery_worker
        self.leader_path = self.root / "controller.leader.lock"
        self.status_path = self.root / "controller-status.json"
    def startup_verify(self) -> dict[str, Any]:
        checked = 0
        failed = 0
        for journal in sorted(self.service.sagas.root.glob("*.events.jsonl")):
            candidate_id = journal.name[: -len(".events.jsonl")]
            saga = self.service.sagas.load(candidate_id)
            checked += 1
            if not saga.journal_integrity:
                failed += 1
        status = {
            "checked_sagas": checked,
            "execution_enabled": self.service.execution_enabled,
            "failed_closed": failed,
            "shadow_mode": not self.service.execution_enabled,
            "side_effects_executed": False,
            "status": "READY" if failed == 0 else "FAIL_CLOSED",
        }
        _durable_json(self.status_path, status)
        return status
    def run_once(self) -> dict[str, Any]:
        with LeaderLock(self.leader_path):
            startup = self.startup_verify()
            if startup["status"] != "READY":
                result = {
                    "execution_enabled": self.service.execution_enabled,
                    "intent": None,
                    "notification": None,
                    "recovery": None,
                    "shadow_mode": not self.service.execution_enabled,
                    "side_effects_executed": False,
                    "startup": startup,
                    "status": "FAIL_CLOSED",
                }
                _durable_json(self.status_path, result)
                return _sanitize(result)
            source_commit = str(self.main_probe())
            event_id = f"main-{source_commit}"
            intent = self.service.create_release_intent(
                {"event_id": event_id, "source_commit": source_commit}
            )
            notification = None
            if intent.get("candidate_id"):
                notification = self.service.ensure_owner_notification(
                    str(intent["candidate_id"])
                )
            recovery = (
                self.recovery_worker.run_once()
                if self.recovery_worker is not None
                else self.service.get_recovery_status()
            )
            result = {
                "execution_enabled": self.service.execution_enabled,
                "intent": intent,
                "notification": notification,
                "recovery": recovery,
                "shadow_mode": not self.service.execution_enabled,
                "side_effects_executed": False,
                "startup": startup,
            }
            _durable_json(self.status_path, result)
            return _sanitize(result)
 class ShadowActionHandler(BaseHTTPRequestHandler):
    service: SilentReleaseActionService
    controller: PersistentSilentReleaseController
    def log_message(self, fmt, *args):
        return
    def _json(self, payload: Mapping[str, Any], status=HTTPStatus.OK):
        body = json.dumps(_sanitize(dict(payload)), sort_keys=True).encode()
        self.send_response(int(status))
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)
    def _body(self) -> dict[str, Any]:
        size = int(self.headers.get("Content-Length", "0"))
        if size > 1024 * 1024:
            raise ValueError("request body is too large")
        return json.loads(self.rfile.read(size) or b"{}")
    def do_GET(self):
        parsed = urlparse(self.path)
        query = parse_qs(parsed.query)
        candidate_id = str((query.get("candidate_id") or [""])[0])
        try:
            if parsed.path == "/healthz":
                return self._json(
                    {
                        "execution_enabled": False,
                        "shadow_mode": True,
                        "side_effects_executed": False,
                        "status": "ok",
                    }
                )
            routes = {
                "/getReleaseCandidate": self.service.get_release_candidate,
                "/getReleasePlan": self.service.get_release_plan,
                "/getReleaseAcceptance": self.service.get_acceptance,
                "/getReleaseSaga": self.service.get_release_saga,
                "/getCapabilityStatus": self.service.get_capability_status,
            }
            if parsed.path in routes:
                return self._json(routes[parsed.path](candidate_id))
            if parsed.path == "/getRecoveryStatus":
                return self._json(self.service.get_recovery_status())
            self._json({"error": "not_found"}, HTTPStatus.NOT_FOUND)
        except (ValueError, FileNotFoundError) as exc:
            self._json(
                {"error": type(exc).__name__}, HTTPStatus.BAD_REQUEST
            )
    def do_POST(self):
        parsed = urlparse(self.path)
        try:
            body = self._body()
            if parsed.path == "/createReleaseIntent":
                return self._json(self.service.create_release_intent(body))
            if parsed.path in {
                "/submitSignedApproval",
                "/submitOwnerApproval",
            }:
                return self._json(self.service.submit_owner_approval(body))
            if parsed.path == "/startDeployment":
                return self._json(
                    self.service.start_deployment(
                        str(body.get("candidate_id") or "")
                    )
                )
            self._json({"error": "not_found"}, HTTPStatus.NOT_FOUND)
        except (ValueError, FileNotFoundError, CapabilityAuthorizationError) as exc:
            self._json(
                {"error": type(exc).__name__}, HTTPStatus.BAD_REQUEST
            )
 def git_main_probe(repository: Path) -> Callable[[], str]:
    repository = Path(repository)
    def probe() -> str:
        completed = subprocess.run(
            [
                "git",
                f"--git-dir={repository}",
                "rev-parse",
                "refs/heads/main",
            ],
            check=True,
            capture_output=True,
            text=True,
            timeout=15,
            env={"PATH": os.environ.get("PATH", "")},
        )
        return completed.stdout.strip()
    return probe
 def serve_shadow(
    *,
    state_root: Path,
    repository: Path,
    host: str,
    port: int,
    poll_seconds: float,
 ) -> None:
    service = SilentReleaseActionService.shadow(state_root)
    controller = PersistentSilentReleaseController(
        state_root,
        service,
        main_probe=git_main_probe(repository),
    )
    controller.run_once()
    stop = threading.Event()
    def controller_loop() -> None:
        while not stop.wait(poll_seconds):
            try:
                controller.run_once()
            except Exception as exc:  # fail closed and keep the API available
                _durable_json(
                    controller.status_path,
                    {
                        "error": type(exc).__name__,
                        "execution_enabled": False,
                        "shadow_mode": True,
                        "side_effects_executed": False,
                        "status": "FAIL_CLOSED",
                    },
                )
    handler = type(
        "ConfiguredShadowActionHandler",
        (ShadowActionHandler,),
        {"service": service, "controller": controller},
    )
    server = ThreadingHTTPServer((host, port), handler)
    api_thread = threading.Thread(
        target=server.serve_forever,
        name="silent-release-shadow-api",
        daemon=False,
    )
    controller_thread = threading.Thread(
        target=controller_loop,
        name="silent-release-shadow-controller",
        daemon=True,
    )
    api_thread.start()
    controller_thread.start()
    try:
        while api_thread.is_alive():
            api_thread.join(timeout=1)
    finally:
        stop.set()
        server.shutdown()
        server.server_close()
        controller_thread.join(timeout=max(1.0, poll_seconds + 1.0))
 def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--state-root", required=True, type=Path)
    parser.add_argument("--repository", required=True, type=Path)
    parser.add_argument("--host", default="127.0.0.1")
    parser.add_argument("--port", default=18891, type=int)
    parser.add_argument("--poll-seconds", default=30.0, type=float)
    arguments = parser.parse_args()
    if arguments.poll_seconds <= 0:
        raise SystemExit("poll seconds must be positive")
    if os.environ.get("AIOS_GITOPS_WRITES_ENABLED", "false").lower() != "false":
        raise SystemExit("GitOps writes must remain disabled")
    if (
        os.environ.get(
            "AIOS_SILENT_RELEASE_EXECUTION_ENABLED", "false"
        ).lower()
        != "false"
    ):
        raise SystemExit("Silent Release execution must remain disabled")
    serve_shadow(
        state_root=arguments.state_root,
        repository=arguments.repository,
        host=arguments.host,
        port=arguments.port,
        poll_seconds=arguments.poll_seconds,
    )
 if __name__ == "__main__":
    main()
@@ -1,21 +0,0 @@
 """Task Plane runtime package."""
 from .models import (
    EvidenceEnvelope,
    ProbeEvidence,
    ProbeOutcome,
    TaskPlan,
    TaskRecord,
    TaskStatus,
    TaskStateTransitionError,
 )
 __all__ = [
    "EvidenceEnvelope",
    "ProbeEvidence",
    "ProbeOutcome",
    "TaskPlan",
    "TaskRecord",
    "TaskStatus",
    "TaskStateTransitionError",
 ]
@@ -1,17 +0,0 @@
 """Adapters for executing tasks via worker backends."""
 from .base import WorkerAdapter
 from .openclaw import OpenClawAdapter
 from .codex import CodexAdapter
 from .hermes import HermesAdapter
 from .a2a import A2AAdapter
 from .systemd_worker import SystemdWorkerAdapter
 __all__ = [
    "WorkerAdapter",
    "OpenClawAdapter",
    "CodexAdapter",
    "HermesAdapter",
    "A2AAdapter",
    "SystemdWorkerAdapter",
 ]
@@ -1,31 +0,0 @@
 from __future__ import annotations
 from .base import WorkerAdapter
 class A2AAdapter(WorkerAdapter):
    worker_name = "a2a"
    def capabilities(self) -> list[str]:
        return ["task.exchange", "agent.handoff"]
    def claim(self, task):
        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
    def execute(self, task, claim):
        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
    def heartbeat(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
    def report_progress(self, claim, progress):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
    def probe(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
    def cancel(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
    def collect_result(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}
@@ -1,41 +0,0 @@
 """Base worker adapter contract."""
 from __future__ import annotations
 import abc
 class WorkerAdapter(abc.ABC):
    worker_name = "base"
    @abc.abstractmethod
    def capabilities(self) -> list[str]:
        raise NotImplementedError
    @abc.abstractmethod
    def claim(self, task):
        raise NotImplementedError
    @abc.abstractmethod
    def execute(self, task, claim):
        raise NotImplementedError
    @abc.abstractmethod
    def heartbeat(self, claim):
        raise NotImplementedError
    @abc.abstractmethod
    def report_progress(self, claim, progress):
        raise NotImplementedError
    @abc.abstractmethod
    def probe(self, claim):
        raise NotImplementedError
    @abc.abstractmethod
    def cancel(self, claim):
        raise NotImplementedError
    @abc.abstractmethod
    def collect_result(self, claim):
        raise NotImplementedError
@@ -1,31 +0,0 @@
 from __future__ import annotations
 from .base import WorkerAdapter
 class CodexAdapter(WorkerAdapter):
    worker_name = "codex"
    def capabilities(self) -> list[str]:
        return ["code.read", "code.write.patch", "test.python", "review.security"]
    def claim(self, task):
        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
    def execute(self, task, claim):
        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
    def heartbeat(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
    def report_progress(self, claim, progress):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
    def probe(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
    def cancel(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
    def collect_result(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}
@@ -1,31 +0,0 @@
 from __future__ import annotations
 from .base import WorkerAdapter
 class HermesAdapter(WorkerAdapter):
    worker_name = "hermes"
    def capabilities(self) -> list[str]:
        return ["architecture.review", "policy.review", "threat.model"]
    def claim(self, task):
        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
    def execute(self, task, claim):
        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
    def heartbeat(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
    def report_progress(self, claim, progress):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
    def probe(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
    def cancel(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
    def collect_result(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}
@@ -1,31 +0,0 @@
 from __future__ import annotations
 from .base import WorkerAdapter
 class OpenClawAdapter(WorkerAdapter):
    worker_name = "openclaw"
    def capabilities(self) -> list[str]:
        return ["code.read", "code.write.patch", "test.execute", "runtime.shadow"]
    def claim(self, task):
        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
    def execute(self, task, claim):
        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
    def heartbeat(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
    def report_progress(self, claim, progress):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
    def probe(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
    def cancel(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
    def collect_result(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}
@@ -1,31 +0,0 @@
 from __future__ import annotations
 from .base import WorkerAdapter
 class SystemdWorkerAdapter(WorkerAdapter):
    worker_name = "systemd_worker"
    def capabilities(self) -> list[str]:
        return ["systemd.exec", "runtime.shell"]
    def claim(self, task):
        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
    def execute(self, task, claim):
        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
    def heartbeat(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
    def report_progress(self, claim, progress):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
    def probe(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
    def cancel(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
    def collect_result(self, claim):
        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}
@@ -1,27 +0,0 @@
 """Agent registry abstraction."""
 from __future__ import annotations
 from .errors import NotFoundError
 class AgentRegistry:
    def __init__(self):
        self._agents: dict[str, dict] = {}
    def register(self, agent_id: str, metadata: dict) -> None:
        self._agents[agent_id] = {"agent_id": agent_id, **metadata}
    def unregister(self, agent_id: str) -> None:
        if agent_id not in self._agents:
            raise NotFoundError("agent")
        del self._agents[agent_id]
    def list(self) -> list[dict]:
        return list(self._agents.values())
    def get(self, agent_id: str) -> dict:
        try:
            return self._agents[agent_id]
        except KeyError:
            raise NotFoundError("agent")
@@ -1,557 +0,0 @@
 """Task Plane HTTP API implementation (stdlib-only)."""
 from __future__ import annotations
 import json
 import os
 import time
 import uuid
 import urllib.parse
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from typing import Any, Callable
 from .delegation import DelegationEngine
 from .errors import (
    ConflictError,
    ForbiddenError,
    NotFoundError,
    PayloadTooLargeError,
    TaskPlaneHTTPError,
    UnauthorizedError,
    ValidationError,
 )
 from .evidence import EvidenceService
 from .journal import TaskJournal
 from .lease import LeaseManager
 from .models import (
    EvidenceEnvelope,
    ResultEnvelope,
    TaskPlan,
    TaskRecord,
    iso8601_now,
    contains_secret_text,
    validate_identifier,
 )
 from .policy import PolicyEngine
 from .store import TaskPlaneStore
 from .worker_registry import WorkerRegistry
 def _json_payload(data: dict[str, Any], status: int = 200) -> tuple[int, bytes]:
    body = json.dumps(data, ensure_ascii=False).encode("utf-8")
    return status, body
 def _bounded_int(value: Any, name: str, minimum: int, maximum: int) -> int:
    try:
        number = int(value)
    except (TypeError, ValueError) as exc:
        raise ValidationError(f"invalid {name}") from exc
    if not minimum <= number <= maximum:
        raise ValidationError(f"invalid {name}")
    return number
 class TaskPlaneService:
    def __init__(self, store: TaskPlaneStore, policy: PolicyEngine | None = None):
        self.store = store
        self.policy = policy or PolicyEngine(
            execution_enabled=False,
            identity_capabilities={
                "anon": {"task.creator", "task.read", "task.audit"}
            },
        )
        self.journal = TaskJournal(store)
        self.lease = LeaseManager(store)
        self.workers = WorkerRegistry(store)
        self.evidence = EvidenceService(store)
        self.delegation = DelegationEngine(store)
        self.store.probe_attestation_verifier = self.policy.probe_attestation_verifier
    def create_task(self, body: dict[str, Any], idempotency_key: str | None = None) -> dict[str, Any]:
        if body.get("parent_task_id"):
            raise ForbiddenError("child tasks must use the delegate endpoint")
        issuer = body.get("issuer", {})
        actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
        self.policy.assert_allowed("create", actor)
        try:
            plan = TaskPlan.from_dict(body)
        except (TypeError, ValueError) as exc:
            raise ValidationError("invalid task plan") from exc
        task = self.store.create_task_with_event(plan, idempotency_key=idempotency_key)
        return task.to_dict()
    def list_tasks(self, actor: str | None = None) -> list[dict[str, Any]]:
        if actor is not None:
            self.policy.assert_allowed("read", actor)
        return [task.to_dict(include_task=False) for task in self.store.list_tasks()]
    def get_task(self, task_id: str, actor: str | None = None) -> dict[str, Any]:
        if actor is not None:
            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
        return self.store.get_task(task_id).to_dict()
    def get_worker(self, worker_id: str, actor: str | None = None) -> dict[str, Any]:
        if actor is not None:
            self.policy.assert_allowed("read", actor)
        return self.workers.get(worker_id).to_dict()
    def list_workers(self, actor: str | None = None) -> list[dict[str, Any]]:
        if actor is not None:
            self.policy.assert_allowed("read", actor)
        return [w.to_dict() for w in self.workers.list()]
    def register_worker(self, body: dict[str, Any]) -> dict[str, Any]:
        actor = str(body.get("actor_identity") or body.get("identity") or "")
        is_admin = actor in self.policy.admin_identities
        try:
            existing = self.store.get_worker(str(body.get("worker_id") or ""))
        except NotFoundError:
            existing = None
        if existing is not None and str(body.get("identity") or "") != existing.identity:
            raise ConflictError("worker identity takeover rejected")
        self.policy.assert_readonly_worker_registration(actor, body)
        self.policy.assert_allowed(
            "worker.admin" if is_admin else "worker.register", actor
        )
        try:
            worker = self.workers.register(
                body,
                actor_identity=actor,
                is_admin=is_admin,
                expected_revision=body.get("expected_revision"),
            )
        except (TypeError, ValueError, KeyError) as exc:
            raise ValidationError("invalid worker registration") from exc
        return worker.to_dict()
    def worker_heartbeat(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
        interval = payload.get("heartbeat_interval_seconds")
        actor = str(payload.get("actor_identity") or "")
        self.policy.assert_readonly_worker_binding(actor, worker_id)
        self.policy.assert_allowed("worker.register", actor)
        return self.workers.heartbeat(
            worker_id,
            heartbeat_interval_seconds=interval,
            actor_identity=actor,
            expected_revision=payload.get("expected_revision"),
        ).to_dict()
    def disable_worker(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
        actor = str(payload.get("actor_identity") or "")
        self.policy.assert_allowed("worker.admin", actor)
        return self.store.disable_worker(
            worker_id,
            actor_identity=actor,
            expected_revision=int(payload.get("expected_revision")),
            reason=str(payload.get("reason") or "disabled by administrator"),
        ).to_dict()
    def restore_worker(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
        actor = str(payload.get("actor_identity") or "")
        self.policy.assert_allowed("worker.admin", actor)
        return self.store.restore_worker(
            worker_id,
            actor_identity=actor,
            expected_revision=int(payload.get("expected_revision")),
        ).to_dict()
    def claim(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
        self.policy.assert_allowed("claim", actor)
        worker_id = body.get("worker_id")
        if not worker_id:
            raise ValidationError("worker_id required")
        task = self.store.get_task(task_id)
        self.policy.assert_readonly_worker_binding(actor, str(worker_id))
        self.policy.assert_allowed("claim", actor, task=task)
        lease_seconds = _bounded_int(
            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
        )
        claim = self.lease.claim(
            task_id=task_id,
            worker_id=worker_id,
            worker_identity=actor,
            lease_seconds=lease_seconds,
            expected_revision=task.revision,
            operation_digest=task.task_plan.operation_digest(),
        )
        return {"claim_id": claim.claim_id, **claim.to_dict()}
    def heartbeat(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
        claim_id = body.get("claim_id")
        if not claim_id:
            raise ValidationError("claim_id required")
        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
        task = self.store.get_task(task_id)
        claim = self.store.get_claim(claim_id)
        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
        self.policy.assert_allowed("heartbeat", actor, task=task)
        if claim.worker_identity != actor:
            raise ForbiddenError("claim identity mismatch")
        lease_seconds = _bounded_int(
            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
        )
        claim = self.lease.heartbeat(task_id, claim_id, lease_seconds)
        return {"claim_id": claim_id, "lease_until": claim.lease_until}
    def progress(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
        claim_id = body.get("claim_id")
        if not claim_id:
            raise ValidationError("claim_id required")
        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
        progress = body.get("progress")
        stage = body.get("stage", "RUNNING")
        message = body.get("message")
        if progress is None:
            raise ValidationError("progress required")
        task = self.store.get_task(task_id)
        claim = self.store.get_claim(claim_id)
        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
        self.policy.assert_allowed("progress", actor, task=task)
        if task.task_plan.data_classification == "credential-secret":
            if message not in {None, ""} or contains_secret_text(stage):
                raise ValidationError(
                    "credential-secret progress must contain metadata only"
                )
        lease_seconds = _bounded_int(
            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
        )
        claim = self.store.record_progress(
            task_id,
            claim_id,
            actor,
            progress=progress,
            stage=str(stage),
            message=None if message is None else str(message),
            lease_seconds=lease_seconds,
        )
        return {"claim_id": claim.claim_id, "status": claim.status, "progress": progress}
    def complete(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
        claim_id = body.get("claim_id")
        if not claim_id:
            raise ValidationError("claim_id required")
        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
        task = self.store.get_task(task_id)
        status = body.get("status", "COMPLETED")
        outputs = body.get("outputs", [])
        evidences = body.get("evidence", [])
        if not isinstance(outputs, list):
            raise ValidationError("outputs must be list")
        if not isinstance(evidences, list):
            raise ValidationError("evidence must be list")
        if any(not isinstance(ev, dict) for ev in evidences):
            raise ValidationError("evidence items must be objects")
        claim = self.store.get_claim(claim_id)
        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
        self.policy.assert_allowed("result", actor, task=task)
        if claim.worker_identity != actor:
            raise ForbiddenError("claim identity mismatch")
        if task.task_plan.data_classification == "credential-secret":
            allowed_result_keys = {
                "kind",
                "hash",
                "sha256",
                "count",
                "status",
                "error_code",
                "signature",
                "attestation_ref",
            }
            for entry in [*outputs, *evidences]:
                if (
                    not isinstance(entry, dict)
                    or set(entry) - allowed_result_keys
                    or contains_secret_text(entry)
                ):
                    raise ValidationError(
                        "credential-secret result must contain hash/count/status only"
                    )
        result = ResultEnvelope(
            task_id=task_id,
            claim_id=claim_id,
            worker_identity=actor,
            status=status,
            outputs=outputs,
            evidence=evidences,
            started_at=str(body.get("started_at") or iso8601_now()),
            completed_at=str(body.get("completed_at") or iso8601_now()),
            result_digest=body.get("result_digest"),
            signature=body.get("signature"),
            attestation_ref=body.get("attestation_ref"),
            operation_digest=claim.operation_digest,
        )
        evidence_decision = self.policy.evidence_verifier.verify(task, evidences)
        if not evidence_decision.allowed:
            raise ForbiddenError(evidence_decision.reason)
        result_decision = self.policy.verify_result(result, task)
        if not result_decision.allowed:
            raise ForbiddenError(result_decision.reason)
        result.result_digest = result.computed_digest()
        previous = self.store._last_evidence_hash(task_id)
        evidence_entries = []
        for evidence in evidences:
            envelope = EvidenceEnvelope.create(
                task_id=task_id,
                claim_id=claim_id,
                kind=str(evidence.get("kind") or evidence.get("type") or "generic"),
                worker_identity=actor,
                payload=evidence,
                previous_evidence_hash=previous,
                signature=evidence.get("signature"),
                attestation_ref=evidence.get("attestation_ref"),
            )
            evidence_entries.append(envelope)
            previous = envelope.evidence_digest
        self.store.complete_claim_with_evidence_and_event(
            task_id,
            claim_id,
            status
            if status
            in {"COMPLETED", "FAILED_FINAL", "FAILED_RECOVERABLE", "CANCELLED"}
            else "COMPLETED",
            result.to_dict(),
            evidence_entries,
        )
        return result.to_dict()
    def fail(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
        claim_id = body.get("claim_id")
        if not claim_id:
            raise ValidationError("claim_id required")
        reason = body.get("reason", "failed")
        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
        self.policy.assert_allowed("fail", actor)
        task = self.store.get_task(task_id)
        self.policy.assert_allowed("fail", actor, task=task)
        claim = self.store.get_claim(claim_id)
        if claim.worker_identity != actor:
            raise ForbiddenError("claim identity mismatch")
        status = "FAILED_RECOVERABLE" if body.get("recoverable", False) else "FAILED_FINAL"
        self.store.fail_claim_with_event(task_id, claim_id, status, str(reason))
        return {"task_id": task_id, "status": status, "reason": reason}
    def cancel(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
        actor = body.get("actor_identity") or body.get("worker_identity") or "owner"
        self.policy.assert_allowed("cancel", actor)
        reason = body.get("reason", "cancelled")
        task = self.store.get_task(task_id)
        self.policy.assert_allowed("cancel", actor, task=task)
        updated = self.store.cancel_task_with_event(
            task_id, task.revision, reason=reason
        )
        return updated.to_dict()
    def delegate(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
        actor = body.get("actor_identity") or "owner"
        self.policy.assert_allowed("delegate", actor)
        parent = self.store.get_task(task_id)
        self.policy.assert_allowed("delegate", actor, task=parent)
        if "task" in body:
            try:
                child_plan = TaskPlan.from_dict(body["task"])
            except (TypeError, ValueError) as exc:
                raise ValidationError("invalid child task plan") from exc
        else:
            plan_body = dict(body)
            plan_body.pop("actor_identity", None)
            try:
                child_plan = TaskPlan.from_dict(plan_body)
            except (TypeError, ValueError) as exc:
                raise ValidationError("invalid child task plan") from exc
        child_plan.parent_task_id = task_id
        child = self.delegation.delegate(task_id, child_plan, caller=actor)
        return child.to_dict()
    def get_events(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
        if actor is not None:
            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
        self.store.get_task(task_id)
        return self.store.list_events(task_id)
    def get_evidence(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
        if actor is not None:
            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
        self.store.get_task(task_id)
        return self.evidence.list(task_id)
    def get_children(self, task_id: str, actor: str | None = None) -> list[str]:
        if actor is not None:
            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
        self.store.get_task(task_id)
        return self.store.list_children(task_id)
 class TaskPlaneRequestHandler(BaseHTTPRequestHandler):
    service: TaskPlaneService | None = None
    authenticator: Callable[[str], str | None] | None = None
    max_body_bytes = 1_000_000
    def log_message(self, format: str, *args: Any) -> None:
        # BaseHTTPRequestHandler logs the raw request target; suppress it so
        # attacker-controlled paths or query strings cannot leak credentials.
        return
    def _json(self) -> tuple[str | None, dict[str, Any]]:
        try:
            length = int(self.headers.get("Content-Length", "0"))
        except ValueError as exc:
            raise ValidationError("invalid content length") from exc
        if length < 0:
            raise ValidationError("invalid content length")
        if length > self.max_body_bytes:
            raise PayloadTooLargeError("payload exceeds limit")
        raw = self.rfile.read(length) if length > 0 else b""
        if not raw:
            return None, {}
        try:
            decoded = raw.decode("utf-8")
            payload = json.loads(decoded)
            if not isinstance(payload, dict):
                raise ValidationError("JSON payload must be an object")
            return decoded, payload
        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
            raise ValidationError("invalid JSON payload") from exc
    def _response(self, status: int, payload: Any) -> None:
        encoded = json.dumps(payload, ensure_ascii=False).encode("utf-8")
        self.send_response(status)
        self.send_header("Content-Type", "application/json; charset=utf-8")
        self.send_header("Content-Length", str(len(encoded)))
        self.end_headers()
        self.wfile.write(encoded)
    def _authenticated_identity(self) -> str:
        authenticator = type(self).authenticator
        if authenticator is None:
            raise UnauthorizedError("authentication unavailable")
        header = self.headers.get("Authorization", "")
        if not header.startswith("Bearer "):
            raise UnauthorizedError("bearer authentication required")
        token = header[7:]
        if not token or any(ord(ch) < 33 for ch in token):
            raise UnauthorizedError("invalid bearer token")
        identity = authenticator(token)
        if not identity:
            raise UnauthorizedError("invalid credentials")
        return str(identity)
    def _handle(self, handler):
        try:
            if self.service is None:
                raise TaskPlaneHTTPError("service not configured")
            result = handler()
            if isinstance(result, tuple):
                status, payload = result
            else:
                status, payload = 200, result
            self._response(status, payload)
        except TaskPlaneHTTPError as exc:
            self._response(exc.status_code, exc.to_payload())
        except Exception as exc:  # defensive
            if isinstance(exc, TaskPlaneHTTPError):
                raise
            self._response(
                500,
                {"error": "internal_error", "message": "internal server error"},
            )
    def do_GET(self):  # noqa: N802
        def route():
            path = urllib.parse.urlparse(self.path).path
            parts = [p for p in path.split("/") if p]
            for part in parts[1:]:
                if part not in {"events", "evidence", "children", "heartbeat"}:
                    try:
                        validate_identifier(part, "resource identifier")
                    except ValueError as exc:
                        raise ValidationError("invalid resource identifier") from exc
            identity = self._authenticated_identity()
            if len(parts) == 1 and parts[0] == "tasks":
                return 200, self.service.list_tasks(identity)
            if len(parts) == 2 and parts[0] == "tasks":
                task_id = parts[1]
                return 200, self.service.get_task(task_id, identity)
            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "events":
                return 200, self.service.get_events(parts[1], identity)
            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "evidence":
                return 200, self.service.get_evidence(parts[1], identity)
            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "children":
                return 200, self.service.get_children(parts[1], identity)
            if len(parts) == 1 and parts[0] == "workers":
                return 200, self.service.list_workers(identity)
            if len(parts) == 2 and parts[0] == "workers":
                return 200, self.service.get_worker(parts[1], identity)
            raise NotFoundError("unknown endpoint")
        self._handle(route)
    def do_POST(self):  # noqa: N802
        def route():
            body_text, body = self._json()
            identity = self._authenticated_identity()
            path = urllib.parse.urlparse(self.path).path
            parts = [p for p in path.split("/") if p]
            headers = {k.lower(): v for k, v in self.headers.items()}
            if len(parts) == 1 and parts[0] == "tasks":
                issuer = body.get("issuer")
                if issuer and (
                    not isinstance(issuer, dict) or issuer.get("id") != identity
                ):
                    raise ForbiddenError("issuer identity mismatch")
                body["issuer"] = {"type": "authenticated", "id": identity}
                return 201, self.service.create_task(body or {}, headers.get("idempotency-key"))
            if body.get("actor_identity") not in {None, identity}:
                raise ForbiddenError("actor identity mismatch")
            body["actor_identity"] = identity
            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "claim":
                return 200, self.service.claim(parts[1], body or {})
            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "heartbeat":
                return 200, self.service.heartbeat(parts[1], body or {})
            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "progress":
                return 200, self.service.progress(parts[1], body or {})
            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "result":
                return 200, self.service.complete(parts[1], body or {})
            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "fail":
                return 200, self.service.fail(parts[1], body or {})
            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "cancel":
                return 200, self.service.cancel(parts[1], body or {})
            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "delegate":
                return 200, self.service.delegate(parts[1], body or {})
            if len(parts) == 2 and parts[0] == "workers" and parts[1] == "register":
                if (
                    body.get("identity") != identity
                    and identity not in self.service.policy.admin_identities
                ):
                    raise ForbiddenError("worker identity mismatch")
                return 201, self.service.register_worker(body or {})
            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "heartbeat":
                return 200, self.service.worker_heartbeat(parts[1], body or {})
            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "disable":
                return 200, self.service.disable_worker(parts[1], body or {})
            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "restore":
                return 200, self.service.restore_worker(parts[1], body or {})
            raise NotFoundError("unknown endpoint")
        self._handle(route)
 def run_server(
    host: str,
    port: int,
    service: TaskPlaneService,
    *,
    authenticator: Callable[[str], str | None] | None = None,
 ):
    handler = TaskPlaneRequestHandler
    handler.service = service
    handler.authenticator = authenticator
    server = ThreadingHTTPServer((host, port), handler)
    server.serve_forever()
@@ -1,36 +0,0 @@
 """Capability matcher helpers."""
 from __future__ import annotations
 from fnmatch import fnmatch
 def _normalize_capability(capability: str) -> str:
    return capability.strip().lower()
 def capability_matches(granted: str, required: str) -> bool:
    granted = _normalize_capability(granted)
    required = _normalize_capability(required)
    if granted == required:
        return True
    # A granted wildcard such as "test.*" should match required "test.unit"
    if "*" in granted:
        return fnmatch(required, granted)
    # A required wildcard is treated as a suffix/prefix requirement for callers.
    if "*" in required:
        return fnmatch(granted, required)
    return False
 def has_capabilities(granted_caps: list[str], required_caps: list[str]) -> bool:
    granted = [_normalize_capability(c) for c in granted_caps]
    for required in required_caps:
        required = _normalize_capability(required)
        if not any(capability_matches(g, required) for g in granted):
            return False
    return True
 def normalize_capabilities(caps: list[str]) -> list[str]:
    return sorted({_normalize_capability(cap) for cap in caps})
@@ -1,87 +0,0 @@
 """Delegation guardrails."""
 from __future__ import annotations
 from .errors import ConflictError, ForbiddenError, NotFoundError
 from .models import Budget, TaskPlan, TaskRecord
 from .store import TaskPlaneStore
 class DelegationEngine:
    def __init__(self, store: TaskPlaneStore):
        self.store = store
    def can_delegate(self, parent_id: str, child_plan: TaskPlan) -> bool:
        parent = self.store.get_task(parent_id)
        if parent.status == "COMPLETED":
            raise ConflictError("cannot delegate completed task")
        if parent.task_plan.max_delegation_depth <= 0:
            raise ConflictError("max delegation depth not configured")
        depth = self._depth(parent_id)
        if depth >= parent.task_plan.max_delegation_depth:
            raise ConflictError("max delegation depth reached")
        if child_plan.parent_task_id not in {None, parent_id}:
            raise ConflictError("delegation parent mismatch")
        current = parent_id
        while current:
            if child_plan.task_id and current == child_plan.task_id:
                raise ConflictError("delegation cycle")
            current = self.store.parent_of(current)
        return True
    def delegate(self, parent_id: str, child_plan: TaskPlan, *, caller: str) -> TaskRecord:
        self.can_delegate(parent_id, child_plan)
        parent = self.store.get_task(parent_id)
        if child_plan.required_capabilities and not set(child_plan.required_capabilities).issubset(
            set(parent.task_plan.required_capabilities or [])
        ):
            raise ForbiddenError("child capabilities exceed parent constraints")
        risk_rank = {"low": 1, "medium": 2, "high": 3}
        if risk_rank.get(child_plan.risk, 99) > risk_rank.get(parent.task_plan.risk, -1):
            raise ForbiddenError("child risk exceeds parent constraints")
        child_plan.parent_task_id = parent_id
        child_plan.correlation_id = parent.task_plan.correlation_id or parent.task_id
        child_plan.preferred_workers = parent.task_plan.preferred_workers
        child_plan.max_delegation_depth = min(
            child_plan.max_delegation_depth,
            parent.task_plan.max_delegation_depth,
        )
        child_plan.approval_policy = parent.task_plan.approval_policy
        parent_budget = self.store.get_task_budget(parent_id)
        required = Budget()
        for name in ("time_seconds", "attempts", "tokens", "cost"):
            available = getattr(parent_budget, name)
            requested = getattr(child_plan.budgets, name)
            if name == "attempts" and requested is None:
                requested = 1
            if available is not None:
                requested = 0 if requested is None else requested
                if requested > available:
                    raise ConflictError(f"budget exceeded for {name}")
                setattr(child_plan.budgets, name, requested)
            setattr(required, name, requested)
        # A retried identical delegation is a read, not a second budget charge.
        if child_plan.task_id:
            try:
                existing = self.store.get_task(child_plan.task_id)
            except NotFoundError:
                existing = None
            if existing is not None:
                if (
                    existing.task_plan.parent_task_id == parent_id
                    and existing.task_plan.operation_digest()
                    == child_plan.operation_digest()
                ):
                    return existing
                raise ConflictError("delegation task_id conflict")
        return self.store.delegate_task_with_budget_and_events(
            parent_id, child_plan, caller=caller
        )
    def _depth(self, task_id: str) -> int:
        return self.store._compute_depth(task_id)
@@ -1,71 +0,0 @@
 """Error types for task plane operations."""
 from __future__ import annotations
 class TaskPlaneError(Exception):
    """Base exception for API-compatible failures."""
    status_code = 500
    error_code = "task_plane_error"
    def __init__(self, message: str, *, code: str | None = None, details: dict | None = None):
        super().__init__(message)
        self.message = message
        self.details = details or {}
        if code:
            self.error_code = code
    def to_payload(self) -> dict:
        return {"error": self.error_code, "message": self.message, "details": self.details}
 class TaskPlaneHTTPError(TaskPlaneError):
    """Base class with explicit HTTP status."""
    status_code = 500
 class ValidationError(TaskPlaneHTTPError):
    status_code = 400
    error_code = "validation_error"
 class UnauthorizedError(TaskPlaneHTTPError):
    status_code = 401
    error_code = "unauthorized"
 class ForbiddenError(TaskPlaneHTTPError):
    status_code = 403
    error_code = "forbidden"
 class NotFoundError(TaskPlaneHTTPError):
    status_code = 404
    error_code = "not_found"
 class ConflictError(TaskPlaneHTTPError):
    status_code = 409
    error_code = "conflict"
 class PayloadTooLargeError(TaskPlaneHTTPError):
    status_code = 413
    error_code = "payload_too_large"
 class FailedDependencyError(TaskPlaneHTTPError):
    status_code = 424
    error_code = "failed_dependency"
 class LockedError(TaskPlaneHTTPError):
    status_code = 423
    error_code = "locked"
 class ServiceUnavailableError(TaskPlaneHTTPError):
    status_code = 503
    error_code = "service_unavailable"
@@ -1,108 +0,0 @@
 """CloudEvents-compatible event envelope and durable outbox helpers."""
 from __future__ import annotations
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from typing import Callable, Protocol
 from .store import TaskPlaneStore
@dataclass
 class CloudEvent:
    specversion: str = "1.0"
    id: str = ""
    type: str = ""
    source: str = "spiffe://aios/task-plane"
    subject: str = ""
    datacontenttype: str = "application/json"
    data: dict | None = None
    @property
    def time(self) -> str:
        return datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
    def asdict(self) -> dict:
        return {
            "specversion": self.specversion,
            "id": self.id,
            "type": self.type,
            "source": self.source,
            "subject": self.subject,
            "time": self.time,
            "datacontenttype": self.datacontenttype,
            "data": self.data or {},
        }
 NOT_DELIVERED = "NOT_DELIVERED"
 DELIVERED = "DELIVERED"
 FAILED_DELIVERY = "FAILED"
 class NotificationAdapter(Protocol):
    name: str
    def deliver(self, envelope: dict) -> str | None:
        """Return a provider receipt, or None when delivery is unconfirmed."""
 class CallbackNotificationAdapter:
    """Adapter seam for webhook, NATS, GPT, dashboard, and WeChat transports."""
    def __init__(self, name: str, callback: Callable[[dict], str | None]):
        self.name = name
        self._callback = callback
    def deliver(self, envelope: dict) -> str | None:
        return self._callback(envelope)
 class WebhookAdapter(CallbackNotificationAdapter):
    def __init__(self, callback: Callable[[dict], str | None]):
        super().__init__("webhook", callback)
 class NatsJetStreamAdapter(CallbackNotificationAdapter):
    def __init__(self, callback: Callable[[dict], str | None]):
        super().__init__("nats-jetstream", callback)
 class GPTResultCallbackAdapter(CallbackNotificationAdapter):
    def __init__(self, callback: Callable[[dict], str | None]):
        super().__init__("gpt-result-callback", callback)
 class DashboardAdapter(CallbackNotificationAdapter):
    def __init__(self, callback: Callable[[dict], str | None]):
        super().__init__("dashboard", callback)
 class WeChatGatewayAdapter(CallbackNotificationAdapter):
    def __init__(self, callback: Callable[[dict], str | None]):
        super().__init__("wechat-gateway", callback)
 class DurableOutboxDispatcher:
    def __init__(self, store: TaskPlaneStore):
        self.store = store
    def dispatch(self, message_id: str, adapter: NotificationAdapter) -> dict:
        row = self.store.get_outbox_message(message_id)
        import json
        envelope = json.loads(row["payload"])
        try:
            receipt = adapter.deliver(envelope)
        except Exception:
            return self.store.record_outbox_delivery(
                message_id,
                receipt=None,
                error=f"{adapter.name} delivery failed",
            )
        return self.store.record_outbox_delivery(
            message_id,
            receipt=str(receipt) if receipt else None,
            error=None if receipt else f"{adapter.name} receipt unavailable",
        )
@@ -1,31 +0,0 @@
 """Evidence helpers."""
 from __future__ import annotations
 import hashlib
 import json
 from .store import TaskPlaneStore
 def evidence_digest(payload: dict) -> str:
    body = json.dumps(payload, sort_keys=True, separators=(",", ":"))
    return hashlib.sha256(body.encode("utf-8")).hexdigest()
 class EvidenceService:
    def __init__(self, store: TaskPlaneStore):
        self.store = store
    def add(self, task_id: str, kind: str, payload: dict, worker_identity: str) -> str:
        return self.store.add_evidence(task_id, kind, payload, worker_identity)
    def list(self, task_id: str) -> list[dict]:
        return self.store.list_evidence(task_id)
    def verify(self, task_id: str, required_kinds: list[str]) -> bool:
        evidences = self.list(task_id)
        observed = {e["kind"] for e in evidences}
        return set(required_kinds).issubset(
            observed
        ) and self.store.verify_evidence_integrity(task_id)
@@ -1,22 +0,0 @@
 """Event journaling helpers."""
 from __future__ import annotations
 from .errors import ValidationError
 from .store import TaskPlaneStore
 class TaskJournal:
    def __init__(self, store: TaskPlaneStore):
        self.store = store
    def append(self, task_id: str, event_type: str, data: dict, *, subject: str | None = None) -> None:
        if not event_type:
            raise ValidationError("event_type required")
        self.store.append_event(task_id, event_type, data, subject=subject)
    def list(self, task_id: str) -> list[dict]:
        return self.store.list_events(task_id)
    def check_chain(self, task_id: str) -> bool:
        return self.store.verify_event_chain(task_id)
@@ -1,32 +0,0 @@
 """Claim and lease management helpers."""
 from __future__ import annotations
 from .errors import LockedError
 from .models import ProbeEvidence
 from .store import TaskPlaneStore
 class LeaseManager:
    def __init__(self, store: TaskPlaneStore):
        self.store = store
    def claim(self, task_id: str, worker_id: str, worker_identity: str, lease_seconds: int, expected_revision: int, operation_digest: str):
        return self.store.claim_task(task_id, worker_id, worker_identity, lease_seconds, expected_revision, operation_digest)
    def heartbeat(self, task_id: str, claim_id: str, lease_seconds: int):
        claim = self.store.heartbeat_claim(task_id, claim_id, lease_seconds)
        return claim
    def probe(self, claim_id: str):
        claim = self.store.get_claim(claim_id)
        if claim.status != "ACTIVE":
            raise LockedError("claim not active")
        return claim
    def recover(self, task_id: str, claim_id: str, probe: ProbeEvidence):
        return self.store.recover_expired_claim(
            task_id,
            claim_id,
            probe,
        )
@@ -1,829 +0,0 @@
 """Core data models for the task plane."""
 from __future__ import annotations
 import hashlib
 import json
 import re
 import time
 import uuid
 import urllib.parse
 from enum import StrEnum
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from typing import Any
 SENSITIVE_KEYS = {
    "secret",
    "password",
    "token",
    "api_key",
    "access_token",
    "refresh_token",
    "authorization",
    "private_key",
    "client_secret",
    "credential",
 }
 IDENTIFIER_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{0,127}")
 TYPE_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}")
 RISK_LEVELS = {"low", "medium", "high"}
 DATA_CLASSIFICATIONS = {
    "public",
    "internal",
    "confidential",
    "credential-secret",
 }
 SECRET_TEXT_PATTERNS = (
    re.compile(r"(?i)\bAuthorization\s*:\s*Bearer\s+\S+"),
    re.compile(r"(?i)\b(?:password|passwd|api[_-]?key|access[_-]?token|secret)\s*[:=]\s*\S+"),
    re.compile(r"\bsk-[A-Za-z0-9_-]{12,}\b"),
    re.compile(r"\bAKIA[0-9A-Z]{16}\b"),
    re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
 )
 TASK_PLAN_KEYS = {
    "schema_version",
    "task_id",
    "task_type",
    "issuer",
    "intent",
    "required_capabilities",
    "preferred_workers",
    "risk",
    "approval_policy",
    "dependencies",
    "max_delegation_depth",
    "budgets",
    "evidence_requirements",
    "parent_task_id",
    "correlation_id",
    "metadata",
    "data_classification",
    "execution_zone",
    "network_policy",
    "logging_policy",
    "allowed_input_paths",
    "allowed_output_paths",
    "output_policy",
 }
 def _now_ts() -> float:
    return time.time()
 def canonical_json(value: Any) -> str:
    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
 def compute_sha256_hex(value: Any) -> str:
    return hashlib.sha256(canonical_json(value).encode("utf-8")).hexdigest()
 def contains_secret_text(value: Any) -> bool:
    if isinstance(value, str):
        return any(pattern.search(value) for pattern in SECRET_TEXT_PATTERNS)
    if isinstance(value, dict):
        return any(contains_secret_text(item) for item in value.values())
    if isinstance(value, (list, tuple)):
        return any(contains_secret_text(item) for item in value)
    return False
 def validate_relative_paths(values: Any, name: str) -> list[str]:
    paths = _normalize_list(values)
    for value in paths:
        decoded = urllib.parse.unquote(value)
        parts = value.replace("\\", "/").split("/")
        if (
            decoded != value
            or "\\" in value
            or value.startswith("/")
            or re.match(r"^[A-Za-z]:", value)
            or any(part in {"", ".", ".."} for part in parts)
        ):
            raise ValueError(f"invalid {name}")
    return paths
 def validate_identifier(value: Any, name: str) -> str:
    text = str(value or "")
    if (
        not IDENTIFIER_RE.fullmatch(text)
        or urllib.parse.unquote(text) != text
        or any(ord(ch) < 32 or ord(ch) == 127 for ch in text)
    ):
        raise ValueError(f"invalid {name}")
    return text
 def validate_type(value: Any, name: str) -> str:
    text = str(value or "")
    if not TYPE_RE.fullmatch(text):
        raise ValueError(f"invalid {name}")
    return text
 def redact_value(value: Any) -> Any:
    if isinstance(value, dict):
        redacted = {}
        for key, inner in value.items():
            lowered = str(key).lower()
            if lowered in SENSITIVE_KEYS or lowered.endswith(
                ("_password", "_secret", "_access_token", "_refresh_token", "_private_key")
            ):
                redacted[key] = "[REDACTED]"
            else:
                redacted[key] = redact_value(inner)
        return redacted
    if isinstance(value, list):
        return [redact_value(v) for v in value]
    if isinstance(value, tuple):
        return tuple(redact_value(v) for v in value)
    return value
 class TaskStateTransitionError(ValueError):
    pass
 class TaskStatus(StrEnum):
    CREATED = "CREATED"
    QUEUED = "QUEUED"
    CLAIMED = "CLAIMED"
    RUNNING = "RUNNING"
    WAITING_CHILD = "WAITING_CHILD"
    VERIFYING = "VERIFYING"
    COMPLETED = "COMPLETED"
    FAILED_RECOVERABLE = "FAILED_RECOVERABLE"
    FAILED_FINAL = "FAILED_FINAL"
    CANCELLED = "CANCELLED"
    MANUAL_REVIEW_REQUIRED = "MANUAL_REVIEW_REQUIRED"
 TASK_STATES = {
    status.value for status in TaskStatus
 }
 TASK_NEXT_STATES = {
    "CREATED": {"QUEUED", "CLAIMED", "CANCELLED", "MANUAL_REVIEW_REQUIRED"},
    "QUEUED": {"CLAIMED", "CANCELLED", "FAILED_RECOVERABLE", "FAILED_FINAL"},
    "CLAIMED": {"RUNNING", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
    "RUNNING": {"VERIFYING", "WAITING_CHILD", "COMPLETED", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
    "WAITING_CHILD": {"RUNNING", "VERIFYING", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
    "VERIFYING": {"COMPLETED", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
    "COMPLETED": set(),
    "FAILED_RECOVERABLE": {"CLAIMED", "RUNNING", "CANCELLED"},
    "FAILED_FINAL": set(),
    "CANCELLED": set(),
    "MANUAL_REVIEW_REQUIRED": {"RUNNING", "CANCELLED"},
 }
@dataclass
 class Budget:
    time_seconds: int | None = None
    attempts: int | None = None
    tokens: int | None = None
    cost: float | None = None
    @classmethod
    def from_dict(cls, data: dict[str, Any] | None) -> "Budget":
        if not data:
            return cls()
        if not isinstance(data, dict) or set(data) - {
            "time_seconds",
            "attempts",
            "tokens",
            "cost",
        }:
            raise ValueError("invalid budget")
        for name in ("time_seconds", "attempts", "tokens", "cost"):
            value = data.get(name)
            if value is not None:
                try:
                    if float(value) < 0:
                        raise ValueError("budget values must be non-negative")
                except (TypeError, ValueError) as exc:
                    raise ValueError("invalid budget value") from exc
        return cls(
            time_seconds=_to_positive_int(data.get("time_seconds")),
            attempts=_to_positive_int(data.get("attempts")),
            tokens=_to_positive_int(data.get("tokens")),
            cost=_to_float(data.get("cost")),
        )
    def to_dict(self) -> dict[str, Any]:
        return {
            "time_seconds": self.time_seconds,
            "attempts": self.attempts,
            "tokens": self.tokens,
            "cost": self.cost,
        }
    def merge(self, other: "Budget") -> "Budget":
        return Budget(
            time_seconds=_first_non_none(self.time_seconds, other.time_seconds),
            attempts=_first_non_none(self.attempts, other.attempts),
            tokens=_first_non_none(self.tokens, other.tokens),
            cost=_first_non_none(self.cost, other.cost),
        )
@dataclass
 class TaskPlan:
    schema_version: int = 1
    task_id: str | None = None
    task_type: str = "code.change"
    issuer: dict[str, Any] = field(default_factory=dict)
    intent: str | None = None
    required_capabilities: list[str] = field(default_factory=list)
    preferred_workers: list[str] = field(default_factory=list)
    risk: str = "medium"
    approval_policy: str = "patch-only"
    dependencies: list[str] = field(default_factory=list)
    max_delegation_depth: int = 5
    budgets: Budget = field(default_factory=Budget)
    evidence_requirements: list[str] = field(default_factory=list)
    parent_task_id: str | None = None
    correlation_id: str | None = None
    metadata: dict[str, Any] = field(default_factory=dict)
    data_classification: str = "internal"
    execution_zone: str = "isolated-development"
    network_policy: str = "controlled"
    logging_policy: str = "redacted"
    allowed_input_paths: list[str] = field(default_factory=list)
    allowed_output_paths: list[str] = field(default_factory=list)
    output_policy: str = "standard"
    @classmethod
    def from_dict(cls, data: dict[str, Any] | None) -> "TaskPlan":
        if not isinstance(data, dict):
            raise ValueError("task plan payload must be an object")
        unknown = set(data) - TASK_PLAN_KEYS
        if unknown:
            raise ValueError("unknown task plan fields")
        if "task_id" not in data or data["task_id"] is None:
            data = dict(data)
            data["task_id"] = f"task-{uuid.uuid4()}"
        risk = str(data.get("risk", "medium"))
        if risk not in RISK_LEVELS:
            raise ValueError("invalid risk")
        issuer = data.get("issuer", {})
        if not isinstance(issuer, dict):
            raise ValueError("issuer must be an object")
        schema_version = int(data.get("schema_version", 1))
        if schema_version != 1:
            raise ValueError("unsupported schema_version")
        max_depth = _to_positive_int(data.get("max_delegation_depth"), default=5)
        if max_depth is None or max_depth > 32:
            raise ValueError("invalid max_delegation_depth")
        classification = str(data.get("data_classification", "internal"))
        if classification not in DATA_CLASSIFICATIONS:
            raise ValueError("invalid data_classification")
        execution_zone = validate_type(
            data.get("execution_zone", "isolated-development"), "execution_zone"
        )
        network_policy = validate_type(
            data.get("network_policy", "controlled"), "network_policy"
        )
        logging_policy = validate_type(
            data.get("logging_policy", "redacted"), "logging_policy"
        )
        output_policy = validate_type(
            data.get("output_policy", "standard"), "output_policy"
        )
        if contains_secret_text(
            {
                "intent": data.get("intent"),
                "metadata": data.get("metadata", {}),
            }
        ):
            raise ValueError("task content contains secret material")
        if classification == "credential-secret":
            if execution_zone != "secure-file-transformer":
                raise ValueError("credential-secret requires secure-file-transformer")
            if network_policy != "denied":
                raise ValueError("credential-secret requires network denied")
            if logging_policy != "metadata-only":
                raise ValueError("credential-secret requires metadata-only logging")
            if output_policy != "hash-count-status-only":
                raise ValueError("credential-secret requires restricted output")
        return cls(
            schema_version=schema_version,
            task_id=validate_identifier(data["task_id"], "task_id"),
            task_type=validate_type(data.get("task_type", "code.change"), "task_type"),
            issuer=issuer,
            intent=data.get("intent"),
            required_capabilities=_normalize_list(data.get("required_capabilities", [])),
            preferred_workers=_normalize_list(data.get("preferred_workers", [])),
            risk=risk,
            approval_policy=validate_type(
                data.get("approval_policy", "patch-only"), "approval_policy"
            ),
            dependencies=_normalize_list(data.get("dependencies", [])),
            max_delegation_depth=max_depth,
            budgets=Budget.from_dict(data.get("budgets")),
            evidence_requirements=_normalize_list(data.get("evidence_requirements", [])),
            parent_task_id=data.get("parent_task_id"),
            correlation_id=data.get("correlation_id"),
            metadata=data.get("metadata", {}) if isinstance(data.get("metadata", {}), dict) else {},
            data_classification=classification,
            execution_zone=execution_zone,
            network_policy=network_policy,
            logging_policy=logging_policy,
            allowed_input_paths=validate_relative_paths(
                data.get("allowed_input_paths", []), "allowed_input_paths"
            ),
            allowed_output_paths=validate_relative_paths(
                data.get("allowed_output_paths", []), "allowed_output_paths"
            ),
            output_policy=output_policy,
        )
    def to_dict(self, *, redact: bool = False) -> dict[str, Any]:
        payload = {
            "schema_version": self.schema_version,
            "task_id": self.task_id,
            "task_type": self.task_type,
            "issuer": self.issuer,
            "intent": self.intent,
            "required_capabilities": list(self.required_capabilities),
            "preferred_workers": list(self.preferred_workers),
            "risk": self.risk,
            "approval_policy": self.approval_policy,
            "dependencies": list(self.dependencies),
            "max_delegation_depth": self.max_delegation_depth,
            "budgets": self.budgets.to_dict(),
            "evidence_requirements": list(self.evidence_requirements),
            "parent_task_id": self.parent_task_id,
            "correlation_id": self.correlation_id,
            "metadata": dict(self.metadata),
            "data_classification": self.data_classification,
            "execution_zone": self.execution_zone,
            "network_policy": self.network_policy,
            "logging_policy": self.logging_policy,
            "allowed_input_paths": list(self.allowed_input_paths),
            "allowed_output_paths": list(self.allowed_output_paths),
            "output_policy": self.output_policy,
        }
        if redact:
            payload = redact_value(payload)
        return payload
    def operation_digest(self) -> str:
        return compute_sha256_hex(self.to_dict())
@dataclass
 class TaskRecord:
    task_id: str
    status: str
    revision: int
    task_plan: TaskPlan
    created_at: float
    updated_at: float
    root_task_id: str
    idempotency_key: str | None = None
    failure_reason: str | None = None
    def with_status(self, status: str) -> "TaskRecord":
        allowed = TASK_NEXT_STATES.get(self.status, set())
        if status != self.status and (not allowed and self.status not in {"COMPLETED", "FAILED_FINAL", "CANCELLED"}):
            raise TaskStateTransitionError(f"Cannot transition {self.status} -> {status}")
        if status not in TASK_STATES:
            raise TaskStateTransitionError(f"Invalid status {status}")
        if status != self.status and self.status in TASK_NEXT_STATES and status not in TASK_NEXT_STATES[self.status]:
            raise TaskStateTransitionError(f"Cannot transition {self.status} -> {status}")
        return TaskRecord(
            task_id=self.task_id,
            status=status,
            revision=self.revision + 1,
            task_plan=self.task_plan,
            created_at=self.created_at,
            updated_at=_now_ts(),
            root_task_id=self.root_task_id,
            idempotency_key=self.idempotency_key,
            failure_reason=self.failure_reason,
        )
    def to_dict(self, *, include_task=True, redact_payload: bool = True) -> dict[str, Any]:
        payload = {
            "task_id": self.task_id,
            "status": self.status,
            "revision": self.revision,
            "root_task_id": self.root_task_id,
            "parent_task_id": self.task_plan.parent_task_id,
            "created_at": _fmt_ts(self.created_at),
            "updated_at": _fmt_ts(self.updated_at),
            "failure_reason": self.failure_reason,
        }
        if include_task:
            payload["plan"] = self.task_plan.to_dict(redact=redact_payload)
        if self.idempotency_key:
            payload["idempotency_key"] = self.idempotency_key
        return payload
@dataclass
 class WorkerRegistration:
    worker_id: str
    worker_type: str
    identity: str
    capabilities: list[str]
    trust_zone: str
    max_concurrency: int
    heartbeat_interval_seconds: int
    supported_protocols: list[str]
    registered_at: float
    last_heartbeat: float
    status: str = "active"
    disabled: bool = False
    owner_identity: str = ""
    registration_revision: int = 1
    registration_policy: str = "self"
    created_at: float = 0.0
    updated_at: float = 0.0
    disabled_reason: str | None = None
    @classmethod
    def from_dict(cls, data: dict[str, Any]) -> "WorkerRegistration":
        if not isinstance(data, dict):
            raise ValueError("worker registration payload must be an object")
        now = _now_ts()
        worker_id = validate_identifier(data.get("worker_id"), "worker_id")
        worker_type = validate_type(data.get("worker_type"), "worker_type")
        identity = str(data.get("identity") or "").strip()
        if not identity or any(ord(ch) < 32 for ch in identity):
            raise ValueError("invalid identity")
        max_concurrency = _to_positive_int(data.get("max_concurrency"), default=1)
        heartbeat_interval = _to_positive_int(
            data.get("heartbeat_interval_seconds"), default=15
        )
        if not max_concurrency:
            raise ValueError("max_concurrency must be positive")
        if not heartbeat_interval:
            raise ValueError("heartbeat_interval_seconds must be positive")
        return cls(
            worker_id=worker_id,
            worker_type=worker_type,
            identity=identity,
            capabilities=_normalize_list(data.get("capabilities", [])),
            trust_zone=str(data.get("trust_zone") or "default"),
            max_concurrency=max_concurrency,
            heartbeat_interval_seconds=heartbeat_interval,
            supported_protocols=_normalize_list(
                data.get("supported_protocols", ["aios-task-v1"])
            ),
            registered_at=float(data.get("registered_at") or now),
            last_heartbeat=float(data.get("last_heartbeat") or now),
            status=str(data.get("status") or "active"),
            disabled=bool(data.get("disabled", False)),
            owner_identity=str(data.get("owner_identity") or identity),
            registration_revision=int(data.get("registration_revision") or 1),
            registration_policy=str(data.get("registration_policy") or "self"),
            created_at=float(data.get("created_at") or data.get("registered_at") or now),
            updated_at=float(data.get("updated_at") or now),
            disabled_reason=data.get("disabled_reason"),
        )
    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
        payload = {
            "worker_id": self.worker_id,
            "worker_type": self.worker_type,
            "identity": self.identity,
            "capabilities": list(self.capabilities),
            "trust_zone": self.trust_zone,
            "max_concurrency": self.max_concurrency,
            "heartbeat_interval_seconds": self.heartbeat_interval_seconds,
            "supported_protocols": list(self.supported_protocols),
            "registered_at": _fmt_ts(self.registered_at),
            "last_heartbeat": _fmt_ts(self.last_heartbeat),
            "status": self.status,
            "disabled": self.disabled,
            "owner_identity": self.owner_identity,
            "registration_revision": self.registration_revision,
            "registration_policy": self.registration_policy,
            "created_at": _fmt_ts(self.created_at or self.registered_at),
            "updated_at": _fmt_ts(self.updated_at or self.last_heartbeat),
            "disabled_reason": self.disabled_reason,
        }
        if redact_payload:
            payload = redact_value(payload)
        return payload
@dataclass(frozen=True)
 class EvidenceEnvelope:
    schema_version: int
    evidence_id: str
    task_id: str
    claim_id: str
    kind: str
    worker_identity: str
    payload: dict[str, Any]
    created_at: float
    previous_evidence_hash: str
    evidence_digest: str
    signature: str | None = None
    attestation_ref: str | None = None
    @classmethod
    def create(
        cls,
        *,
        task_id: str,
        claim_id: str,
        kind: str,
        worker_identity: str,
        payload: dict[str, Any],
        previous_evidence_hash: str,
        signature: str | None = None,
        attestation_ref: str | None = None,
        evidence_id: str | None = None,
        created_at: float | None = None,
    ) -> "EvidenceEnvelope":
        envelope = cls(
            schema_version=1,
            evidence_id=evidence_id or f"evd-{uuid.uuid4()}",
            task_id=validate_identifier(task_id, "task_id"),
            claim_id=validate_identifier(claim_id, "claim_id"),
            kind=validate_type(kind, "evidence kind"),
            worker_identity=str(worker_identity),
            payload=redact_value(payload),
            created_at=float(created_at or _now_ts()),
            previous_evidence_hash=str(previous_evidence_hash or ""),
            evidence_digest="",
            signature=signature,
            attestation_ref=attestation_ref,
        )
        return dataclass_replace(
            envelope, evidence_digest=compute_sha256_hex(envelope.digest_payload())
        )
    def digest_payload(self) -> dict[str, Any]:
        return {
            "schema_version": self.schema_version,
            "evidence_id": self.evidence_id,
            "task_id": self.task_id,
            "claim_id": self.claim_id,
            "kind": self.kind,
            "worker_identity": self.worker_identity,
            "payload": self.payload,
            "created_at": self.created_at,
            "previous_evidence_hash": self.previous_evidence_hash,
            "attestation_ref": self.attestation_ref,
        }
    def verify(
        self,
        *,
        expected_task_id: str,
        expected_claim_id: str,
        expected_previous_hash: str,
        attestation_verifier: Any = None,
    ) -> bool:
        if (
            self.schema_version != 1
            or self.task_id != expected_task_id
            or self.claim_id != expected_claim_id
            or self.previous_evidence_hash != expected_previous_hash
            or self.evidence_digest != compute_sha256_hex(self.digest_payload())
        ):
            return False
        if self.signature or self.attestation_ref:
            return True if attestation_verifier is None else bool(attestation_verifier(self))
        return True
    def to_dict(self) -> dict[str, Any]:
        return {
            **self.digest_payload(),
            "evidence_digest": self.evidence_digest,
            "signature": self.signature,
        }
 class ProbeOutcome(StrEnum):
    NOT_APPLIED = "NOT_APPLIED"
    APPLIED_VERIFIED = "APPLIED_VERIFIED"
    INDETERMINATE = "INDETERMINATE"
    CONFLICT = "CONFLICT"
@dataclass(frozen=True)
 class ProbeEvidence:
    schema_version: int
    probe_id: str
    task_id: str
    claim_id: str
    worker_id: str
    worker_identity: str
    operation_digest: str
    outcome: ProbeOutcome
    observed_at: float
    expires_at: float
    probe_executor_identity: str
    evidence_digest: str
    signature: str | None = None
    attestation_ref: str | None = None
    @classmethod
    def create(cls, **data: Any) -> "ProbeEvidence":
        outcome = data["outcome"]
        if not isinstance(outcome, ProbeOutcome):
            outcome = ProbeOutcome(str(outcome))
        probe = cls(
            schema_version=1,
            probe_id=data.get("probe_id") or f"probe-{uuid.uuid4()}",
            task_id=validate_identifier(data["task_id"], "task_id"),
            claim_id=validate_identifier(data["claim_id"], "claim_id"),
            worker_id=validate_identifier(data["worker_id"], "worker_id"),
            worker_identity=str(data["worker_identity"]),
            operation_digest=str(data["operation_digest"]),
            outcome=outcome,
            observed_at=float(data["observed_at"]),
            expires_at=float(data["expires_at"]),
            probe_executor_identity=str(data["probe_executor_identity"]),
            evidence_digest="",
            signature=data.get("signature"),
            attestation_ref=data.get("attestation_ref"),
        )
        return dataclass_replace(
            probe, evidence_digest=compute_sha256_hex(probe.digest_payload())
        )
    def digest_payload(self) -> dict[str, Any]:
        return {
            "schema_version": self.schema_version,
            "probe_id": self.probe_id,
            "task_id": self.task_id,
            "claim_id": self.claim_id,
            "worker_id": self.worker_id,
            "worker_identity": self.worker_identity,
            "operation_digest": self.operation_digest,
            "outcome": self.outcome.value,
            "observed_at": self.observed_at,
            "expires_at": self.expires_at,
            "probe_executor_identity": self.probe_executor_identity,
            "attestation_ref": self.attestation_ref,
        }
    def verify(self, *, now: float, attestation_verifier: Any) -> bool:
        if (
            self.schema_version != 1
            or self.expires_at <= now
            or self.observed_at > now
            or self.evidence_digest != compute_sha256_hex(self.digest_payload())
            or not (self.signature or self.attestation_ref)
        ):
            return False
        return bool(attestation_verifier and attestation_verifier(self))
    def to_dict(self) -> dict[str, Any]:
        return {
            **self.digest_payload(),
            "evidence_digest": self.evidence_digest,
            "signature": self.signature,
        }
 def dataclass_replace(value: Any, **changes: Any) -> Any:
    from dataclasses import replace
    return replace(value, **changes)
@dataclass
 class WorkerClaim:
    claim_id: str
    task_id: str
    worker_id: str
    worker_identity: str
    claimed_at: float
    lease_until: float
    attempt: int
    task_revision: int
    operation_digest: str
    status: str = "ACTIVE"
    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
        payload = {
            "claim_id": self.claim_id,
            "task_id": self.task_id,
            "worker_id": self.worker_id,
            "worker_identity": self.worker_identity,
            "claimed_at": _fmt_ts(self.claimed_at),
            "lease_until": _fmt_ts(self.lease_until),
            "attempt": self.attempt,
            "task_revision": self.task_revision,
            "operation_digest": self.operation_digest,
            "status": self.status,
        }
        if redact_payload:
            payload = redact_value(payload)
        return payload
@dataclass
 class ResultEnvelope:
    task_id: str
    claim_id: str
    worker_identity: str
    status: str
    outputs: list[dict[str, Any]]
    evidence: list[dict[str, Any]]
    started_at: str
    completed_at: str
    result_digest: str | None = None
    signature: str | None = None
    attestation_ref: str | None = None
    operation_digest: str | None = None
    trust_status: str = "untrusted_shadow_result"
    def digest_payload(self) -> dict[str, Any]:
        return {
            "task_id": self.task_id,
            "claim_id": self.claim_id,
            "worker_identity": self.worker_identity,
            "status": self.status,
            "outputs": self.outputs,
            "evidence": self.evidence,
            "started_at": self.started_at,
            "completed_at": self.completed_at,
            "operation_digest": self.operation_digest,
            "attestation_ref": self.attestation_ref,
        }
    def computed_digest(self) -> str:
        return compute_sha256_hex(self.digest_payload())
    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
        payload = {
            "task_id": self.task_id,
            "claim_id": self.claim_id,
            "worker_identity": self.worker_identity,
            "status": self.status,
            "outputs": self.outputs,
            "evidence": self.evidence,
            "started_at": self.started_at,
            "completed_at": self.completed_at,
            "result_digest": self.result_digest,
            "signature": self.signature,
            "attestation_ref": self.attestation_ref,
            "operation_digest": self.operation_digest,
            "trust_status": self.trust_status,
        }
        if redact_payload:
            payload = redact_value(payload)
        return payload
 def _normalize_list(value: Any) -> list[str]:
    if not isinstance(value, list):
        raise ValueError("expected list")
    if len(value) > 128 or any(
        not isinstance(v, str)
        or not v
        or len(v) > 256
        or any(ord(ch) < 32 for ch in v)
        for v in value
    ):
        raise ValueError("invalid list item")
    return list(value)
 def _to_positive_int(value: Any, default: int | None = None) -> int | None:
    if value is None:
        return default
    try:
        number = int(value)
    except (TypeError, ValueError):
        return default
    return number if number >= 0 else default
 def _to_float(value: Any) -> float | None:
    if value is None:
        return None
    try:
        return float(value)
    except (TypeError, ValueError):
        return None
 def _first_non_none(primary: Any, fallback: Any) -> Any:
    if primary is not None:
        return primary
    return fallback
 def iso8601_now() -> str:
    return datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
 def _fmt_ts(value: float | None) -> str | None:
    if value is None:
        return None
    return datetime.fromtimestamp(value, tz=timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
@@ -1,226 +0,0 @@
 """Policy and verification logic (fail-closed)."""
 from __future__ import annotations
 from dataclasses import dataclass
 from typing import Callable
 from .errors import ForbiddenError, LockedError
 from .models import ProbeEvidence, ResultEnvelope, TaskRecord
 RISK_RANK = {"low": 1, "medium": 2, "high": 3}
 READONLY_WORKER_ACTIONS = frozenset(
    {"claim", "result", "fail", "progress", "heartbeat"}
 )
 ALL_ACTION_CAPABILITIES = frozenset(
    {
        "task.creator",
        "worker.self_register",
        "worker.admin",
        "task.claim",
        "task.cancel",
        "task.delegate",
        "task.read",
        "task.audit",
    }
 )
@dataclass
 class PolicyDecision:
    allowed: bool
    reason: str = ""
@dataclass(frozen=True)
 class ReadonlyWorkerProfile:
    """A narrowly-scoped identity allowed to process safe Shadow tasks only."""
    worker_id: str
    identity: str
    capabilities: frozenset[str]
    task_types: frozenset[str] = frozenset({"code.review", "test.execute"})
    def permits_task(self, task: TaskRecord) -> bool:
        plan = task.task_plan
        if plan.task_type not in self.task_types or plan.risk != "low":
            return False
        if plan.data_classification not in {"public", "internal"}:
            return False
        if plan.metadata.get("production_side_effects") is not False:
            return False
        return set(plan.required_capabilities).issubset(self.capabilities)
 class IdentityVerifier:
    def __init__(self, trusted_identities: set[str] | None = None):
        self.trusted_identities = trusted_identities
    def verify(self, identity: str) -> bool:
        if self.trusted_identities is None:
            return True
        return identity in self.trusted_identities
 class EvidenceVerifier:
    def __init__(self, mandatory: list[str] | None = None):
        self.mandatory = set(mandatory or [])
    def verify(self, task: TaskRecord, evidences: list[dict]) -> PolicyDecision:
        required = set(task.task_plan.evidence_requirements or [])
        if not required and not self.mandatory:
            return PolicyDecision(True)
        observed = {e.get("kind") for e in evidences}
        missing = required.union(self.mandatory) - observed
        if missing:
            return PolicyDecision(False, f"missing evidence: {', '.join(sorted(missing))}")
        return PolicyDecision(True)
 class PolicyEngine:
    """
    Fail-closed policy engine with minimal but explicit decisions.
    """
    def __init__(
        self,
        *,
        identity_verifier: IdentityVerifier | None = None,
        evidence_verifier: EvidenceVerifier | None = None,
        execution_enabled: bool = False,
        max_risk: str = "medium",
        result_signature_verifier: Callable[[ResultEnvelope], bool] | None = None,
        probe_attestation_verifier: Callable[[ProbeEvidence], bool] | None = None,
        identity_capabilities: dict[str, set[str]] | None = None,
        admin_identities: set[str] | None = None,
        readonly_worker_execution_enabled: bool = False,
        readonly_worker_profiles: list[ReadonlyWorkerProfile] | None = None,
    ) -> None:
        if max_risk not in RISK_RANK:
            raise ValueError("invalid max_risk")
        self.identity_verifier = identity_verifier or IdentityVerifier()
        self.evidence_verifier = evidence_verifier or EvidenceVerifier()
        self.execution_enabled = execution_enabled
        self.max_risk = max_risk
        self.result_signature_verifier = result_signature_verifier
        self.probe_attestation_verifier = probe_attestation_verifier
        self.identity_capabilities = {
            identity: set(capabilities)
            for identity, capabilities in (identity_capabilities or {}).items()
        }
        self.admin_identities = set(admin_identities or ())
        self.readonly_worker_execution_enabled = readonly_worker_execution_enabled
        self.readonly_worker_profiles = {
            profile.identity: profile for profile in (readonly_worker_profiles or [])
        }
    def _readonly_worker_allows(
        self, action: str, actor: str, task: TaskRecord | None
    ) -> bool:
        profile = self.readonly_worker_profiles.get(actor)
        return bool(
            self.readonly_worker_execution_enabled
            and action in READONLY_WORKER_ACTIONS
            and profile is not None
            and (task is None or profile.permits_task(task))
        )
    def assert_readonly_worker_binding(self, actor: str, worker_id: str) -> None:
        profile = self.readonly_worker_profiles.get(actor)
        if profile is not None and profile.worker_id != worker_id:
            raise ForbiddenError("worker identity binding mismatch")
    def assert_readonly_worker_registration(self, actor: str, payload: dict) -> None:
        profile = self.readonly_worker_profiles.get(actor)
        if profile is None:
            return
        if (
            str(payload.get("worker_id") or "") != profile.worker_id
            or str(payload.get("identity") or "") != profile.identity
            or set(payload.get("capabilities") or []) != set(profile.capabilities)
            or str(payload.get("trust_zone") or "") != "isolated-review"
            or int(payload.get("max_concurrency") or 0) != 1
            or int(payload.get("heartbeat_interval_seconds") or 0) != 15
        ):
            raise ForbiddenError("readonly worker registration mismatch")
    def verify_result(
        self, result: ResultEnvelope, task: TaskRecord | None = None
    ) -> PolicyDecision:
        computed = result.computed_digest()
        if result.result_digest and result.result_digest != computed:
            return PolicyDecision(False, "result digest mismatch")
        sensitive = bool(
            task
            and (
                task.task_plan.data_classification
                in {"confidential", "credential-secret"}
                or any(
                    capability.startswith(
                        ("code.write", "deploy", "secret", "production")
                    )
                    for capability in task.task_plan.required_capabilities
                )
            )
        )
        if sensitive and not (result.signature or result.attestation_ref):
            return PolicyDecision(False, "trusted result proof required")
        if result.signature is not None or result.attestation_ref is not None:
            if self.result_signature_verifier is None:
                return PolicyDecision(False, "result signature verifier unavailable")
            if not self.result_signature_verifier(result):
                return PolicyDecision(False, "result signature invalid")
            result.trust_status = "trusted_result"
        else:
            result.trust_status = "untrusted_shadow_result"
        return PolicyDecision(True)
    def authorize(self, action: str, actor: str, task: TaskRecord | None = None, context: dict | None = None) -> PolicyDecision:
        context = context or {}
        if not self.identity_verifier.verify(actor):
            return PolicyDecision(False, "identity untrusted")
        action_capabilities = {
            "create": "task.creator",
            "read": "task.read",
            "audit": "task.audit",
            "claim": "task.claim",
            "result": "task.claim",
            "fail": "task.claim",
            "progress": "task.claim",
            "heartbeat": "task.claim",
            "cancel": "task.cancel",
            "delegate": "task.delegate",
            "worker.register": "worker.self_register",
            "worker.admin": "worker.admin",
        }
        required_capability = action_capabilities.get(action)
        if required_capability:
            granted = set(
                self.identity_capabilities.get(
                    actor, self.identity_capabilities.get("*", set())
                )
            )
            if required_capability not in granted:
                return PolicyDecision(False, f"action {action} not permitted")
        if action in {"claim", "result", "fail", "cancel", "progress", "delegate", "heartbeat"} and not self.execution_enabled:
            if not self._readonly_worker_allows(action, actor, task):
                return PolicyDecision(False, "execution disabled")
        if action == "delegate" and task and task.status not in {"COMPLETED", "FAILED_FINAL", "CANCELLED"}:
            risk = str(context.get("risk", task.task_plan.risk))
            if RISK_RANK.get(risk, 2) > RISK_RANK.get(self.max_risk, 1):
                return PolicyDecision(False, f"risk {risk} exceeds policy")
        return PolicyDecision(True)
    def assert_allowed(self, action: str, actor: str, task: TaskRecord | None = None, context: dict | None = None):
        decision = self.authorize(action, actor, task, context=context)
        if not decision.allowed:
            if decision.reason == "identity untrusted":
                raise ForbiddenError(decision.reason)
            if decision.reason == "execution disabled":
                raise LockedError("execution disabled")
            raise ForbiddenError(decision.reason)
@@ -1,76 +0,0 @@
 """Task scheduler primitives."""
 from __future__ import annotations
 import time
 from .errors import NotFoundError
 from .capabilities import has_capabilities
 from .models import WorkerClaim
 from .store import TaskPlaneStore
 class TaskScheduler:
    def __init__(self, store: TaskPlaneStore):
        self.store = store
    def next_queued_task(self, worker_id: str):
        worker = self.store.get_worker(worker_id)
        tasks = sorted(
            self.store.list_tasks(),
            key=lambda task: (
                -int(task.task_plan.metadata.get("priority", 0)),
                task.created_at,
                task.task_id,
            ),
        )
        for task in tasks:
            if task.status not in {"CREATED", "QUEUED", "FAILED_RECOVERABLE"}:
                continue
            if task.task_plan.task_type == "worker.registry.audit":
                continue
            if task.status == "FAILED_RECOVERABLE" and not self.store.task_has_retryable_probe(
                task.task_id
            ):
                continue
            if not has_capabilities(
                worker.capabilities, task.task_plan.required_capabilities
            ):
                continue
            if any(
                self.store.get_task(dependency).status != "COMPLETED"
                for dependency in task.task_plan.dependencies
            ):
                continue
            if (
                task.task_plan.data_classification == "credential-secret"
                and worker.worker_type != "secure_file_transformer"
                and "secure_file_transformer" not in worker.capabilities
            ):
                continue
            return task
        return None
    def schedule_for_worker(self, worker_id: str, lease_seconds: int = 15) -> WorkerClaim:
        worker = self.store.get_worker(worker_id)
        if worker.disabled:
            from .errors import LockedError
            raise LockedError("worker disabled")
        if time.time() > worker.last_heartbeat + (
            worker.heartbeat_interval_seconds * 3
        ):
            from .errors import LockedError
            raise LockedError("worker offline")
        task = self.next_queued_task(worker_id)
        if task is None:
            raise NotFoundError("no queued tasks available")
        claim = self.store.claim_task(
            task.task_id,
            worker_id,
            worker.identity,
            lease_seconds=lease_seconds,
            expected_revision=task.revision,
            operation_digest=task.task_plan.operation_digest(),
        )
        return claim
@@ -1,68 +0,0 @@
 """Worker registry abstraction and read helpers."""
 from __future__ import annotations
 import time
 from .capabilities import has_capabilities
 from .errors import NotFoundError
 from .models import WorkerRegistration
 from .store import TaskPlaneStore
 class WorkerRegistry:
    def __init__(self, store: TaskPlaneStore):
        self.store = store
    def register(
        self,
        payload: dict,
        *,
        actor_identity: str,
        is_admin: bool,
        expected_revision: int | None,
    ) -> WorkerRegistration:
        reg = WorkerRegistration.from_dict(payload)
        return self.store.register_worker(
            reg,
            actor_identity=actor_identity,
            is_admin=is_admin,
            expected_revision=expected_revision,
        )
    def heartbeat(
        self,
        worker_id: str,
        heartbeat_interval_seconds: int | None = None,
        *,
        actor_identity: str,
        expected_revision: int | None,
    ) -> WorkerRegistration:
        return self.store.heartbeat_worker(
            worker_id,
            heartbeat_interval_seconds=heartbeat_interval_seconds,
            actor_identity=actor_identity,
            expected_revision=expected_revision,
        )
    def list(self):
        return self.store.list_workers()
    def get(self, worker_id: str) -> WorkerRegistration:
        try:
            return self.store.get_worker(worker_id)
        except NotFoundError:
            raise
    def can_execute(self, worker_id: str, required_capabilities: list[str]) -> bool:
        worker = self.store.get_worker(worker_id)
        return has_capabilities(worker.capabilities, required_capabilities)
    def is_online(self, worker_id: str, *, now: float | None = None) -> bool:
        worker = self.store.get_worker(worker_id)
        deadline = worker.last_heartbeat + (worker.heartbeat_interval_seconds * 3)
        return not worker.disabled and (time.time() if now is None else now) <= deadline
    def stale_workers(self, *, now: float | None = None) -> list[WorkerRegistration]:
        current = time.time() if now is None else now
        return [worker for worker in self.list() if not self.is_online(worker.worker_id, now=current)]
@@ -0,0 +1 @@
 /data/aios-gitops/workspace/active-runtime
@@ -0,0 +1 @@
 {"ts": 1783642009.9384289, "name": "another_cmd.json"}
@@ -0,0 +1 @@
 {"ts": 1783642009.9384289, "name": "stuck_cmd.json"}
@@ -0,0 +1,19 @@
 # CMD-20260710-sr01-gitea-branch-sync
 ## Objective
 Fix Gitea DB branch index desync: Gitea DB 与 bare repo 分支列表不一致（Gitea API 返回 50 条 vs bare repo 55 条）。
 ## Analysis
 - Root cause: `h_branch_sync()` 之前依赖 Gitea API `POST /api/v1/repos/aios/aios/branches` 分页查询
 - Token scope 不足 `read:admin` 导致只能获取 50 条（默认 limit），但 total 是 55
 - 临时修复: 改为 `git ls-remote --heads` 直接枚举 bare repo，绕过了 Gitea API 分页问题
 - 但根本问题：Gitea DB 索引没有完全同步 bare repo，需要调查 Gitea 后台同步机制
 ## Plan
 1. 诊断 Gitea DB 与 bare repo 实际的差异详情
 2. 决定修复方案：full resync Gitea, or fix the sync mechanism
 3. 实现/验证
 4. 更新 baseline
 ## Status
 pending
@@ -0,0 +1 @@
 {"ts": 1783642009.9169936, "name": "cmd1.json"}
@@ -0,0 +1 @@
 {"ts": 1783642009.9169936, "name": "cmd2.json"}
@@ -0,0 +1 @@
 {"ts": 1783643569.9295633, "name": "recent"}
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783583895",
  "title": "⚠️ Issue Detected: stuck",
  "body": "1 commands stuck in running/ for >30m",
  "urgency": "warning",
  "ts": "2026-07-09T15:58:15+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783583993",
  "title": "⚠️ Issue Detected: stuck",
  "body": "1 commands stuck in running/ for >30m",
  "urgency": "warning",
  "ts": "2026-07-09T15:59:53+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783584042",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T16:00:42+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783597695",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T19:48:15+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783597737",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T19:48:57+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783598337",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T19:58:57+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783598938",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T20:08:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783599538",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T20:18:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783600138",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T20:28:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783600738",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T20:38:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783601338",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T20:48:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783601938",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T20:58:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783602538",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T21:08:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783603138",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T21:18:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783603738",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T21:28:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783604338",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T21:38:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783604938",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T21:48:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783605538",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T21:58:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783606138",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T22:08:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783606738",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T22:18:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783607338",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T22:28:58+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783607939",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T22:38:59+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783608539",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T22:48:59+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783609139",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T22:58:59+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783609739",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T23:08:59+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783610339",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T23:18:59+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783610939",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T23:28:59+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783611539",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T23:38:59+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783612139",
  "title": "⚠️ Issue Detected: branch_sync",
  "body": "5 branches missing from Gitea DB",
  "urgency": "warning",
  "ts": "2026-07-09T23:48:59+0800"
 }
@@ -0,0 +1,7 @@
 {
  "nid": "n-1783643869",
  "title": "Stuck Commands Cleaned",
  "body": "Moved 2 stuck commands to failed/",
  "urgency": "info",
  "ts": "2026-07-10T08:37:49+0800"
 }
@@ -0,0 +1 @@
 {"check": "stuck", "severity": "medium", "diagnosis": "stuck commands", "stuck": [{"n": "stuck_cmd.json", "ts": 1783642009.9384289}, {"n": "another_cmd.json", "ts": 1783642009.9384289}], "fix": "move_to_failed"}
@@ -0,0 +1 @@
 {"check": "branch_sync", "severity": "high", "diagnosis": "missing branches", "branches": ["br1"], "fix": "sync_branches"}
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783584042",
  "created": "2026-07-09T16:00:42+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/group-owner-agent-context-isolation",
    "patch/agent-gpt-message-plane",
    "patch/agent-event-bus-unified",
    "patch/user-profile-isolation",
    "patch/gitops-change-archive-audit"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783597695",
  "created": "2026-07-09T19:48:15+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/gitops-change-archive-audit",
    "patch/agent-gpt-message-plane",
    "patch/agent-event-bus-unified",
    "patch/user-profile-isolation",
    "patch/group-owner-agent-context-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783597737",
  "created": "2026-07-09T19:48:57+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783598337",
  "created": "2026-07-09T19:58:57+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783598938",
  "created": "2026-07-09T20:08:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783599538",
  "created": "2026-07-09T20:18:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783600138",
  "created": "2026-07-09T20:28:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783600738",
  "created": "2026-07-09T20:38:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783601338",
  "created": "2026-07-09T20:48:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783601938",
  "created": "2026-07-09T20:58:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783602538",
  "created": "2026-07-09T21:08:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783603138",
  "created": "2026-07-09T21:18:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783603738",
  "created": "2026-07-09T21:28:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783604338",
  "created": "2026-07-09T21:38:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783604938",
  "created": "2026-07-09T21:48:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783605538",
  "created": "2026-07-09T21:58:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783606138",
  "created": "2026-07-09T22:08:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783606738",
  "created": "2026-07-09T22:18:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
@@ -0,0 +1,16 @@
 {
  "patch_id": "patch-1783607338",
  "created": "2026-07-09T22:28:58+0800",
  "check": "branch_sync",
  "severity": "high",
  "diagnosis": "5 branches missing from Gitea DB",
  "branches": [
    "patch/agent-event-bus-unified",
    "patch/agent-gpt-message-plane",
    "patch/group-owner-agent-context-isolation",
    "patch/gitops-change-archive-audit",
    "patch/user-profile-isolation"
  ],
  "stuck": [],
  "fix": "sync_branches"
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
openclaw	b90b0b9d26	fix: update baseline git hash to latest and fix docs/releases ownership to aiman	2026-07-11 02:33:16 +08:00
openclaw	a32c76a3c1	V1R4C5 baseline promotion: V1R4C3 -> V1R4C5 promoted_by: openclaw/admin promotion_reason: V1R4C5 reliability, watcher cleanup, user data isolation gate, and admin workbench read-only preparation; memory search remains disabled constraints: memory_search_enabled=false, force_push_allowed=false	2026-07-11 02:19:22 +08:00
openclaw	c128d6b01d	release: complete V1R4C5 metadata on final approval branch	2026-07-11 02:10:39 +08:00
openclaw	d457ac3961	release: record final owner approval for V1R4C5	2026-07-11 01:58:14 +08:00
openclaw	9fa7511bb5	release: add V1R4C5 acceptance evidence	2026-07-11 01:56:45 +08:00
		`@@ -0,0 +1 @@`
							`{"ts": 1783642009.9384289, "name": "another_cmd.json"}`
		`@@ -0,0 +1 @@`
							`{"ts": 1783642009.9384289, "name": "stuck_cmd.json"}`
		`@@ -0,0 +1 @@`
							`{"ts": 1783642009.9169936, "name": "cmd1.json"}`
		`@@ -0,0 +1 @@`
							`{"ts": 1783643569.9295633, "name": "recent"}`
		`@@ -0,0 +1 @@`
							`{"check": "stuck", "severity": "medium", "diagnosis": "stuck commands", "stuck": [{"n": "stuck_cmd.json", "ts": 1783642009.9384289}, {"n": "another_cmd.json", "ts": 1783642009.9384289}], "fix": "move_to_failed"}`
		`@@ -0,0 +1 @@`
							`{"check": "branch_sync", "severity": "high", "diagnosis": "missing branches", "branches": ["br1"], "fix": "sync_branches"}`