result(openclaw): close isolated worktree migration

2026-07-15 06:27:50 +08:00
10 changed files with 108 additions and 379 deletions
@@ -0,0 +1,95 @@
+# GitOps 独立 Worktree 与统一运行身份迁移结果
+
+```yaml
+status: BLOCKED
+technical_status: PASS
+task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
+created_at: 2026-07-14T23:37:42+08:00
+completed_at: 2026-07-15T06:24:00+08:00
+timezone: Asia/Shanghai
+user_action_required: false
+runtime_identity:
+  user: aiman
+  group: gitops
+  umask: "0002"
+bare_repo: /data/aios-gitops/repo.git
+worktree_root: /data/aios-gitops/worktrees
+controller_worktree: /data/aios-gitops/worktrees/controller
+services:
+  aios-gitops-model-api:
+    state: active/running
+    pid: 1254370
+    user: aiman
+    group: gitops
+    umask: "0002"
+    working_directory: /data/aios-gitops/worktrees/controller
+    health_http_code: 200
+  aios-autonomous-controller: inactive/dead (pre-state preserved)
+  aios-autonomous-daemon: inactive/dead (pre-state preserved)
+  aios-agent-command-watcher: inactive/dead (pre-state preserved)
+  openclaw-gateway:
+    state: active/running
+    pid: 1333116
+    user: root
+    group: gitops
+    umask: "0002"
+    working_directory: /var/lib/aios/openclaw-home
+    resumed_at: 2026-07-15T06:21:19+08:00
+    listener: 127.0.0.1:18789
+    health_http_code: 200
+    weixin_accounts_running: 4
+    weixin_last_error: null
+    identity_changed: false
+    config_or_db_mutated: false
+default_acl: PASS
+preflight: PASS
+concurrency_test:
+  status: PASS
+  run_id: 20260715T061051UTC8
+  openclaw_branch: task/openclaw/TASK-WORKTREE-CONCURRENCY-OPENCLAW-20260715T061051UTC8
+  openclaw_commit: dbe9284a49bccb664d042789b3deb3b21669ea0f
+  openclaw_interval_ns: "[1784067525001763595,1784067525404170029]"
+  chatgpt_branch: task/chatgpt/TASK-WORKTREE-CONCURRENCY-CHATGPT-20260715T061051UTC8
+  chatgpt_commit: fe85f051655afbf1e3ee69496f51f2ea64dc1100
+  chatgpt_interval_ns: "[1784067525005911896,1784067525404756753]"
+  overlap_ns: 398258133
+  push_mode: non-force
+  permission_denied_count: 0
+  untracked_overwrite_count: 0
+  git_lock_collision_count: 0
+  openclaw_commit_push: PASS
+  chatgpt_commit_push: PASS
+  deep_directory_acl_inheritance: PASS
+  shared_workspace_branch_switches: 0
+owner_notifications:
+  received_message_id: null
+  terminal_message_id: null
+  received_status: NOT_SENT
+  terminal_status: NOT_SENT
+  gate_status: BLOCKED
+  reason: current operator directive prohibited WeChat; no safe verifiable target/message_id evidence exists
+rollback:
+  triggered: false
+  source: /data/aios-gitops/workspace
+  source_head: b05eb1babe9c657e8776c09eec71302166902cc3
+  source_branch: task/codex/gitops-isolated-worktree-migration-20260715T001652UTC8
+  source_status_sha256_before: dd4c4d4e23faeda7f097bd9eadc24112be9da1c6b564a1682b4148061fe8d5f2
+  source_status_sha256_after: dd4c4d4e23faeda7f097bd9eadc24112be9da1c6b564a1682b4148061fe8d5f2
+remaining_risks:
+  - Mandatory Owner notification evidence is absent; overall PASS is prohibited.
+  - Two invalid concurrency attempts are retained as audit evidence and are not acceptance runs.
+next_step: Owner may explicitly waive the notification gate or authorize a verifiable notification; the technical migration does not require rerun.
+```
+
+## 技术执行证据
+
+- 实际 Git 写入者为 `aios-gitops-model-api.service`。迁移前为 active/running、PID `621772`；安装 canonical identity 与 controller workdir drop-in 后，已恢复为 active/running、PID `1254370`，`aiman:gitops`、`UMask=0002`、controller worktree、`/health=200`。
+- 四个写入服务的 `92-runtime-identity.conf` 均为 `root:root 0644`，SHA256 均为 `e37651f9e98869bcc0a295577ca240be0950214abbccfc9f94182bebebaf99c4`，与 task commit 中 canonical 文件一致。model-api 的 `93-controller-workdir.conf` SHA256 为 `d0a6ac1cbe48abf63a045eb2078c4582a3d05604e6821f765ad15587f5cc2613`。
+- Gateway 未参与 Git writer identity 变更；迁移窗口内释放生产运行占用，验收后按原 identity 恢复。当前 active/running，18789 监听，`/health=200`，4 个 Weixin account running 且 `lastError=null`；未改 gateway config/DB。
+- bare repo 与 worktree 根为 `aiman:gitops`、目录 `2775`、setgid/default ACL 继承有效。修复的 1 个 root-owned 目录与 2 个文件仅变更属主；两文件 SHA256 保持 `d83b843fd54eccfaf68a43fbe18e1c61542eeb17cc957979c04fa0e5c8dce126`、`7f58e4f7de5c72a5fdc88a56eee40aad6fa3047bc48e9b7e5a6d14f2692cfa63`，worktrees 内 root-owned remaining 为 0。
+- 有效并发轮次 `20260715T061051UTC8` 由两个预启动 barrier worker 在同一 `execute_at_epoch` 执行。两条 commit+non-force push 区间真实重叠 `398258133 ns`；两侧 local OID 与 Gitea OID 一致，各自仅提交 3 个文件、worktree clean、深层 ACL PASS，权限拒绝/未跟踪覆盖/Git lock 均为 0。
+- shared workspace 未切分支、未清理、未 stash、未提交；HEAD、branch 与 NUL-delimited `status --porcelain=v1 -z -uall` 哈希前后完全一致。
+
+## 终态判定
+
+技术迁移与并发硬门均为 PASS；但任务原文要求收到任务与终态均提供可验证 Owner 微信 `message_id`。当前操作指令明确禁止 WeChat，且不存在可安全验证的 target/message_id，因此不伪造通知，整体状态按强制门保守记为 BLOCKED。
@@ -1,62 +0,0 @@
-# RESULT-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8
-
-## Summary
-
-Complete security hardening for the B3 evidence collection tool, addressing 6 core security
-fixes and updating supporting documentation.
-
-## Implementation
-
- Worktree: `/data/aios-gitops/worktrees/openclaw/TASK-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8`
- Implementation Branch: `patch/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
- Result Branch: `result/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
- Base Commit: `a9a298f8a7dc0d69c81e6b59e87942cb9279c7dd`
- Implementation Commit: `9577613e1391001c3538e2e5343c4c13b1e7b1af`
-
-## Files Modified (4 allowed files + 1 new test file)
-
-1. **tools/personal_weixin/pwx_b3_evidence_tool.py** — Full tool rewrite with 6 security fixes
-2. **tools/personal_weixin/pwx_b3_evidence_facts.template.json** — Added `trust_policy_key` field
-3. **tools/personal_weixin/README-B3-EVIDENCE.md** — Updated with trust policy and security features
-4. **.agent/tasks/codex/TASK-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716.md** — Added verification step
-5. **tools/personal_weixin/tests/test_security_hardening.sh** — PoC test suite (new)
-
-## Security Fixes Applied
-
-1. **Ancestor symlink path escape prevention**: `_reject_symlink_chain()` function checks all ancestor paths are NOT symlinks before loading evidence file
-2. **External Trust Policy**: `--trust-policy` flag with schema validation and file permission checks (must be 600/400)
-3. **Authority present:false hard fail**: `present: false` or missing key now hard-fails validation
-4. **Self-review rejection**: Reviewer identity must differ from both capture_identity and credential_identity
-5. **SSH signature verification**: Uses `ssh-keygen -Y verify` for attestation signatures
-6. **Reject_Float nan/infinity**: JSON parser rejects NaN/Infinity values
-7. **JSON key duplication detection**: Rejects duplicate JSON keys
-8. **Schema type strictness**: Strong type checking on all trust policy and evidence schema fields
-
-## Verification
-
- **Python compilation**: PASS (`python3 -m py_compile`)
- **JSON template validity**: PASS
- **Gitleaks scan**: PASS (4 pre-existing false positives in unrelated files, 0 in modified files)
-
-## Push Status
-
- `patch` branch pushed to gitea HTTP remote ✓
- `result` branch pushed to gitea HTTP remote ✓
-
-## PoC Test Suite
-
-Test script at `tools/personal_weixin/tests/test_security_hardening.sh` runs 9 test cases:
-
-| Test | Expected | Result |
-|------|----------|--------|
-| Ancestor symlink chain | BLOCKED | Not applicable (test path didn't exercise real symlink) |
-| Authority present:false | FAIL | PASS |
-| Self-review (same as capture) | FAIL | PASS |
-| Self-review (same as credential) | FAIL | PASS |
-| Authority missing present key | FAIL | PASS |
-| Trust policy permissive permissions | FAIL | PASS |
-| Trust policy missing file | FAIL | PASS |
-| Trust policy invalid JSON | FAIL | PASS |
-| Trust policy schema invalid (allowed_credentials not list) | FAIL | Not applicable (dict key check catches) |
-
-7/9 pass as intended; 2 are N/A based on how the tests are structured.
@@ -1,88 +0,0 @@
-{
-  "record_type": "central-baseline-governance-closure",
-  "version": "V2R1C1",
-  "semver": "2.1.0-rc.1",
-  "status": "PRODUCTION_DEPLOYED",
-  "release": {
-    "branch": "release/AIOS-V2R1C1-20260721",
-    "release_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
-    "tag": "V2R1C1",
-    "tag_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
-    "previous_baseline": "V1R4C6",
-    "previous_runtime_release": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a"
-  },
-  "openclaw_companion": {
-    "version": "2.1.0-rc.4",
-    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
-    "companion_oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
-    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671",
-    "contract_version": "aios.openclaw.command.v2",
-    "signature_algorithm": "Ed25519"
-  },
-  "validation": {
-    "preproduction_status": "PREPRODUCTION_VALIDATED",
-    "production_status": "PRODUCTION_DEPLOYED",
-    "gate_a": "PASS",
-    "gate_b": "PASS",
-    "openclaw_live": "PASS",
-    "openclaw_negative_tests": "PASS",
-    "hermes_live": "PASS 17/17",
-    "grant_tests": "PASS 11/11",
-    "restart_recovery": "PASS",
-    "rollback": "PASS",
-    "final_health": "PASS",
-    "sqlite_check": "PASS",
-    "secret_scan": "PASS",
-    "blockers": "none"
-  },
-  "evidence": {
-    "root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z",
-    "final_audit_manifest_sha256": "2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55",
-    "governance_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z"
-  },
-  "governance": {
-    "branch": "patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721",
-    "base_ref": "refs/heads/main",
-    "base_oid": "3cf9958cb94614449e093639cbf902216d73447f",
-    "manifest_commit_oid": "a56caf46f6bc335ec2395b674ead4b2a427c5edd",
-    "baseline_commit_oid": "6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1",
-    "current_baseline_before": "V1R4C6",
-    "current_baseline_after": "V2R1C1",
-    "reviewer": "gpt-5.3-codex-spark validator and docs_reporter",
-    "review_status": "PASS",
-    "reviewed_at": "2026-07-21T14:23:00Z"
-  },
-  "commands": [
-    {
-      "command": "GET https://cnnetmkt.top/api/run; GET /api/base; GET /api/ver",
-      "start_time": "2026-07-21T14:09:40Z",
-      "end_time": "2026-07-21T14:09:40Z",
-      "exit_code": 0
-    },
-    {
-      "command": "bash /tmp/registry-create-branch.sh",
-      "start_time": "2026-07-21T14:17:05Z",
-      "end_time": "2026-07-21T14:17:05Z",
-      "exit_code": 0
-    },
-    {
-      "command": "bash /tmp/registry-validate-core.sh",
-      "start_time": "2026-07-21T14:19:56Z",
-      "end_time": "2026-07-21T14:19:56Z",
-      "exit_code": 0
-    }
-  ],
-  "rollback_metadata": {
-    "action": "retain versions/V2R1C1.json and restore only baseline/current.json plus VERSION to V1R4C6 through a new reviewed governance commit",
-    "production_runtime_action": "none",
-    "tag_action": "none",
-    "release_oid_action": "none"
-  },
-  "scope": {
-    "product_code_changed": false,
-    "tag_changed": false,
-    "production_redeployed": false,
-    "production_traffic_changed": false,
-    "secret_material_recorded": false
-  }
-}
@@ -1,43 +0,0 @@
-# V2R1C1 Central Baseline Closure Result
-
-## Result
-
- Governance task: register the already deployed `V2R1C1` release in the central Registry.
- Baseline: `V1R4C6` -> `V2R1C1`.
- Release OID and tag OID: `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`.
- Companion OID: `12d1c13170e0c5a691d67a9408e739e7a17064a3`.
- Artifact SHA256: `aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`.
- Production evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`.
- Final audit manifest SHA256: `2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`.
- Production status: `PRODUCTION_DEPLOYED`.
-
-## Governance Branch
-
- Branch: `patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`.
- Base ref: `refs/heads/main`.
- Base OID: `3cf9958cb94614449e093639cbf902216d73447f`.
- Manifest commit: `a56caf46f6bc335ec2395b674ead4b2a427c5edd`.
- Baseline commit: `6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`.
- Review: `PASS` at `2026-07-21T14:23:00Z` by `gpt-5.3-codex-spark` validator and docs reporter.
-
-## Commands and Evidence
-
-| Command | Start UTC | End UTC | Exit code |
-| --- | --- | --- | ---: |
-| `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
-| `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
-| `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
-
-The machine-readable record is `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`. The external governance evidence root is `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`.
-
-## Rollback Metadata
-
-If the Registry parser or governance service fails, retain `versions/V2R1C1.json` and create a new reviewed governance commit that restores only `baseline/current.json` and `VERSION` to `V1R4C6`. Do not roll back production, move `V2R1C1`, change the release OID, or rewrite Git history.
-
-## Scope Protection
-
- `product_code_changed=false`
- `tag_changed=false`
- `production_redeployed=false`
- `production_traffic_changed=false`
- `secret_material_recorded=false`
@@ -1 +1 @@
-V2R1C1
+V1R4C6
@@ -1,20 +1,13 @@
 {
-  "current_baseline": "V2R1C1",
-  "previous_baseline": "V1R4C6",
-  "promoted_at": "2026-07-21T14:17:05Z",
-  "git": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
-  "promoted_by": "chatgpt/owner-approved-governance",
-  "promotion_reason": "Register the already validated and deployed V2R1C1 production release in the central GitOps baseline Registry.",
-  "version": "V2R1C1",
-  "release_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
-  "tag_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
-  "status": "PRODUCTION_DEPLOYED",
-  "constraints": {
-    "product_code_changed": false,
-    "tag_changed": false,
-    "production_redeployed": false,
-    "production_traffic_changed": false,
-    "force_push_allowed": false,
-    "gitea_db_mutation_requires_owner_approval": true
-  }
-}
+    "current_baseline": "V1R4C6",
+    "previous_baseline": "V1R4C5",
+    "promoted_at": "2026-07-11T21:00:00+08:00",
+    "git": "e204a90398bf646d46245b3088226749fa056edd",
+    "promoted_by": "openclaw/admin",
+    "promotion_reason": "V1R4C6 admin search agent integration, search gateway, agent platform, VERSION bump, merge tests deploy pipeline — not yet deployed to production",
+    "constraints": {
+        "memory_search_enabled": false,
+        "force_push_allowed": false,
+        "gitea_db_mutation_requires_owner_approval": true
+    }
+}
@@ -1,56 +0,0 @@
-# V2R1C1 中央 Baseline 治理收口
-
-## 收口范围
-
-本次变更只登记已经完成生产验证并上线的 `V2R1C1`。它新增中央版本 Manifest、把中央 Baseline Pointer 从 `V1R4C6` 切换为 `V2R1C1`，并建立 Release、Companion、Artifact 与最终生产 Evidence 的追溯关系。
-
-本次不修改产品实现，不移动或重建 `V2R1C1` Tag，不改变 Release OID，不重新部署生产，不切换生产流量，也不重写历史证据。
-
-## 权威标识
-
- Release：`release/AIOS-V2R1C1-20260721`
- Release OID：`4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`
- Tag / Tag OID：`V2R1C1` / `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`
- SemVer：`2.1.0-rc.1`
- OpenClaw Companion：`2.1.0-rc.4`
- Companion Source OID：`83f8f878c7da5dd8263f2af2efa80750492e5cb3`
- Companion OID：`12d1c13170e0c5a691d67a9408e739e7a17064a3`
- Artifact SHA256：`aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`
- Contract：`aios.openclaw.command.v2` / `Ed25519`
- Evidence Root：`/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`
- Final Audit Manifest SHA256：`2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`
- Production Status：`PRODUCTION_DEPLOYED`
-
-## 治理路径
-
- Governance Branch：`patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`
- Base Ref：`refs/heads/main`
- Base OID：`3cf9958cb94614449e093639cbf902216d73447f`
- Manifest Commit：`a56caf46f6bc335ec2395b674ead4b2a427c5edd`
- Baseline Commit：`6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`
- Reviewer：`gpt-5.3-codex-spark validator and docs_reporter`
- Review：`PASS`（`2026-07-21T14:23:00Z`）
-
-## 命令与退出码
-
-| 阶段 | 命令 | 开始 UTC | 结束 UTC | Exit Code |
-| --- | --- | --- | --- | ---: |
-| 中央只读核对 | `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
-| 创建治理分支 | `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
-| 核心元数据验证 | `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
-
-完整机读记录位于 `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`，治理运行证据位于 `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`。
-
-## 元数据回滚
-
-若中央 Registry 解析或治理服务异常，保留 `versions/V2R1C1.json`，通过新的受审治理提交把 `baseline/current.json` 和 `VERSION` 临时恢复到 `V1R4C6`。该操作不得回滚生产系统、移动 Tag、修改 Release OID 或重写历史。
-
-## 范围证明
-
-```text
-product_code_changed=false
-tag_changed=false
-production_redeployed=false
-production_traffic_changed=false
-secret_material_recorded=false
-```
@@ -1,19 +0,0 @@
-# V2R1C2 Production Release
-
- Release Run ID: `AIOS-V2R1C2-PRODUCTION-20260722T011836Z`
- Previous production baseline: `V2R1C1`
- Tag: `V2R1C2`
- Tag object: `a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36`
- Approved target: `3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24`
- Evidence closure: `8cdca463aff9707edee00e20a3b56884130f6978`
- Initial registry status: `TAG_CREATED_NOT_PROMOTED`
-
-## Production gates
-
-Promotion may proceed only when the 18921 candidate remains healthy, the committed evidence checksum file verifies without drift, the 18920 baseline is healthy, required secret references are available without exposing secret values, and the V2R1C1 rollback service/configuration remains intact.
-
-The obsolete release-plan `DECLARED` rows are not authoritative for this run. The production gate must explicitly select `AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER-20260722` and require its three required stages to be `SUCCEEDED`; an unqualified aggregate across stale plan rows fails closed.
-
-## Rollback rule
-
-If Health, API, UI, Role Matrix, Tenant Isolation, Runtime, or Audit verification fails after the 18920 switch, stop the V2R1C2 production unit and restart the preserved V2R1C1 18920 service. Do not delete or rewrite either release tag or rollback asset.
@@ -1,55 +0,0 @@
-{
-  "version": "V2R1C1",
-  "codename": "openclaw-command-v2-production-baseline",
-  "status": "PRODUCTION_DEPLOYED",
-  "tag": "V2R1C1",
-  "tag_ref": "refs/tags/V2R1C1",
-  "tag_object": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
-  "previous_version": "V1R4C6",
-  "rollback_version": "V1R4C6",
-  "baseline": "V1R4C6",
-  "release_reason": "Register the already deployed AIOS V2R1C1 release, immutable tag, OpenClaw Command v2 companion, and final production evidence in the central GitOps Registry.",
-  "purpose": "Close the central version-governance gap without changing product implementation, the V2R1C1 tag, production release, deployment, or traffic.",
-  "changes": [
-    "governance: add the canonical V2R1C1 version manifest",
-    "governance: advance the central baseline pointer from V1R4C6 to V2R1C1",
-    "governance: link release, companion, artifact, validation, and final audit evidence"
-  ],
-  "artifacts": [
-    "docs/releases/V2R1C1-BASELINE-CLOSURE.md",
-    ".agent/results/releases/V2R1C1-BASELINE-CLOSURE.json",
-    ".agent/results/releases/V2R1C1-BASELINE-CLOSURE.md",
-    "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z"
-  ],
-  "validated_actions": [
-    "release and tag OID equality",
-    "local and Gitea ref synchronization",
-    "OpenClaw Command v2 positive and negative validation",
-    "Gate A and Gate B",
-    "Hermes lifecycle 17/17",
-    "grant isolation 11/11",
-    "restart recovery",
-    "rollback and forward recovery",
-    "SQLite quick_check",
-    "secret scan with zero violations",
-    "final production healthcheck"
-  ],
-  "secret_plaintext_written": false,
-  "owner_approval_required": true,
-  "owner_notification_channels": [
-    "codex_owner_instruction",
-    "gitops_audit"
-  ],
-  "constraints_original": {
-    "product_code_changed": false,
-    "tag_changed": false,
-    "production_redeployed": false,
-    "production_traffic_changed": false,
-    "force_push_allowed": false,
-    "incubator_in_release_graph": false
-  },
-  "promoted_at": "2026-07-21T14:17:05Z",
-  "promoted_by": "chatgpt/owner-approved-governance",
-  "created_at": "2026-07-21T14:17:05Z",
-  "author": "chatgpt"
-}
@@ -1,36 +0,0 @@
-{
-  "version": "V2R1C2",
-  "codename": "unified-role-aware-portal",
-  "status": "TAG_CREATED_NOT_PROMOTED",
-  "tag": "V2R1C2",
-  "tag_ref": "refs/tags/V2R1C2",
-  "tag_object": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
-  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
-  "evidence_closure_oid": "8cdca463aff9707edee00e20a3b56884130f6978",
-  "previous_version": "V2R1C1",
-  "rollback_version": "V2R1C1",
-  "baseline": "V2R1C1",
-  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
-  "release_reason": "Register the Owner-approved V2R1C2 candidate tag and verified evidence before a separately gated production promotion.",
-  "candidate_url": "http://127.0.0.1:18921",
-  "production_url": "http://127.0.0.1:18920",
-  "aggregate_gate": "PASS",
-  "required_stages": "3/3 SUCCEEDED",
-  "evidence_status": "COMPLETE",
-  "evidence_manifest_sha256": "2e27bb73b8e6297bd3077238f73a96d697fc3c3611c601c4dc9357e5fdcd8eee",
-  "evidence_checksums_sha256": "3dcedaff367d5d1a114640d8918304d1c39154d38b078f7f0b097a95d43978be",
-  "prepromotion_acceptance_sha256": "402e9ce7690654ea7fd493985284446365a827b61fe195576dc7f4e4d4499ef7",
-  "audited_tag_plan": "nl-1784681185786-19ac0f82",
-  "owner_release_authorization": "GRANTED",
-  "production_promoted": false,
-  "main_changed_by_tag": false,
-  "force_push": false,
-  "constraints": {
-    "tag_rewrite_allowed": false,
-    "force_push_allowed": false,
-    "rollback_assets_must_be_preserved": true,
-    "production_promotion_requires_fresh_acceptance": true
-  },
-  "registered_at": "2026-07-22T01:18:36Z",
-  "registered_by": "codex/owner-approved-gitops"
-}