test: governed action contract integration

active-runtime/app/aios_chatgpt_actions_api.py

@@ -22,6 +22,7 @@ from gitea_tag_publication import (
     TagPublisher,
     redact,
     validate_version,
+    validate_gitea_api_url,
 )
 from orchestrator.action_monitor import ActionMonitor
 from silent_release_hardening import (
@@ -308,8 +309,7 @@ def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
         raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
 
 def existing_tag_target(tag: str) -> str | None:
-    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
-        raise ValueError('invalid release version')
+    validate_version(tag)
     try:
         result = run_authoritative_git(
             ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
@@ -510,7 +510,15 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj({'error':redact(exc)},413)
                 except (AuthoritativeGitError, RuntimeError) as exc:
                     return self.sendj({'error':redact(exc)},503)
-                return self.sendj({'from':frm,'to':to,'diff':diff})
+                payload = {'from': frm, 'to': to, 'diff': diff}
+                payload.update({
+                    key: diff[key]
+                    for key in (
+                        'from_oid', 'to_oid', 'changed_paths', 'stats',
+                        'total_size_bytes', 'truncated', 'patch_limit_bytes',
+                    )
+                })
+                return self.sendj(payload)
             if path in ('/api/patch','/api/patches','/api/branches','/patch'):
                 snapshot = repository_snapshot(
                     git_dir=AUTHORITATIVE_GIT_DIR,
@@ -773,7 +781,10 @@ class H(BaseHTTPRequestHandler):
         a=self.need('tag:create');
         if not a: return
         ver=data.get('version') or data.get('tag')
-        if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
+        try:
+            validate_version(ver)
+        except ValueError:
+            return self.sendj({'error':'version must match VxRxCx'},400)
         if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
             return self.sendj({
                 'error':'production_tag_evidence_required',
@@ -947,6 +958,7 @@ def api_spec():
     return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
 
 def main():
+    validate_gitea_api_url(os.getenv('AIOS_GITOPS_GITEA_API_URL', ''))
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()

active-runtime/app/aios_chatgpt_bridge_v2.py

@@ -46,6 +46,75 @@ OPERATION_REQUIRED_FIELDS = {
     "getControlPlaneSnapshot": (),
 }
 
+_OPERATION_PATHS = {
+    "createGovernedTask": "/v2/governed-task",
+    "acquireWriterLease": "/v2/writer-lease",
+    "commitFileGoverned": "/v2/commit-file",
+    "commitFilesGoverned": "/v2/commit-files",
+    "getGitOpsJob": "/v2/job",
+    "resumeGitOpsJob": "/v2/job/resume",
+    "reconcileGitOpsJob": "/v2/job/reconcile",
+    "getTagPublicationStatus": "/v2/tag/status",
+    "getReleaseConsistency": "/v2/release/consistency",
+    "runReleaseAcceptance": "/v2/release/acceptance",
+}
+
+
+def operation_contracts() -> dict[str, dict[str, object]]:
+    """Return the runtime contract consumed by adapters and schema tooling."""
+    return {
+        operation: {
+            "method": "POST",
+            "path": _OPERATION_PATHS.get(operation),
+            "required_fields": list(fields),
+        }
+        for operation, fields in OPERATION_REQUIRED_FIELDS.items()
+    }
+
+
+def render_openapi_contract_fragment() -> str:
+    required = "\n".join(
+        f"                - {field}"
+        for field in OPERATION_REQUIRED_FIELDS["commitFilesGoverned"]
+    )
+    return (
+        "  /v2/commit-files:\n"
+        "    post:\n"
+        "      operationId: commitFilesGoverned\n"
+        "      summary: Submit one atomic governed commit containing multiple files\n"
+        "      requestBody:\n"
+        "        required: true\n"
+        "        content:\n"
+        "          application/json:\n"
+        "            schema:\n"
+        "              type: object\n"
+        "              additionalProperties: false\n"
+        "              required:\n"
+        f"{required}\n"
+        "              properties:\n"
+        "                task_id: {type: string}\n"
+        "                repository: {type: string, example: aios/aios}\n"
+        "                expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}\n"
+        "                target_branch: {type: string, pattern: '^agent/[A-Za-z0-9._/-]+$'}\n"
+        "                generation: {type: integer, minimum: 1}\n"
+        "                idempotency_key: {type: string}\n"
+        "                files:\n"
+        "                  type: array\n"
+        "                  minItems: 1\n"
+        "                  items:\n"
+        "                    type: object\n"
+        "                    additionalProperties: false\n"
+        "                    required: [path, content_base64]\n"
+        "                    properties:\n"
+        "                      path: {type: string, minLength: 1, maxLength: 512}\n"
+        "                      content_base64: {type: string}\n"
+        "                message: {type: string, minLength: 1, maxLength: 200}\n"
+        "      responses:\n"
+        "        '200': {description: Governed commit job and verified branch result}\n"
+        "        '400': {description: Contract or policy rejection}\n"
+        "        '409': {description: Branch CAS or idempotency conflict}\n"
+    )
+
 
 class RuntimeDriftError(RuntimeError):
     pass
@@ -122,6 +191,7 @@ class BridgeV2Adapter:
             "legacy_writes_enabled": False,
             "governed_writes_enabled": True,
             "operations": list(BRIDGE_OPERATIONS),
+            "operation_contracts": operation_contracts(),
             "force_push": False,
             "main_write": False,
             "tag_write": False,

active-runtime/app/aios_chatgpt_bridge_v2_server.py

@@ -14,10 +14,11 @@ from typing import Any, Mapping
 
 from aios_authority_git_executor import AuthorityGitExecutor
 from aios_chatgpt_bridge_v2 import BridgeV2Adapter, BridgeV2Error, OPERATION_REQUIRED_FIELDS
+from gitea_tag_publication import validate_gitea_api_url
 from aios_continuation_executor import AuthorityGitAdapter, ContinuationCommit, ContinuationExecutor, ContinuationPermissions, ContinuationRuntimeBinding, DetachedGitWorkspace, GiteaContinuationRemote, ServerSideCredentialProjection
 from aios_continuation_lease import WriterLeaseRequestV2
 from aios_control_plane_snapshot import build_control_plane_snapshot
-from aios_gitops_job_controller import GitOpsJobController, JobStore
+from aios_gitops_job_controller import GitOpsJobController, JobState, JobStore, _RECOVERABLE
 from aios_governed_task_bootstrap import BootstrapError, GovernedTaskBootstrap
 from governed_production_release import build_executor_config
 
@@ -52,7 +53,7 @@ class RuntimeConfig:
     ssh_key_path: Path
     remote_name: str = "gitea-http"
     repository: str = "aios/aios"
-    api_base: str = "https://g.cnnetmkt.top/git/api/v1"
+    api_base: str = ""
     v2_task_id: str = "TASK-P0-CHATGPT-BRIDGE-V2-CONTROL-PLANE-CONVERGENCE-20260809"
     v2_branch: str = "agent/p0-chatgpt-bridge-v2-control-plane-convergence-20260809"
     target_version: str = "V2R2C1"
@@ -280,6 +281,8 @@ class GovernedRuntime:
             return controller.store._receipt(row, duplicate=True).as_dict()
         if action == "resume":
             return controller.resume(job_id).as_dict()
+        if JobState(row["state"]) not in _RECOVERABLE:
+            return controller.store._receipt(row, duplicate=True).as_dict()
         return self._executor_from_row(row, controller).reconcile(job_id)
 
     def _snapshot_task(self) -> dict[str, Any]:
@@ -418,7 +421,7 @@ def main() -> None:
         token_path,
         ssh_key_path,
         remote_name=os.environ.get("AIOS_GITEA_REMOTE", "gitea-http"),
-        api_base=os.environ.get("AIOS_GITEA_API_BASE", "https://g.cnnetmkt.top/git/api/v1"),
+        api_base=validate_gitea_api_url(os.environ.get("AIOS_GITEA_API_BASE", "")),
         target_version=os.environ.get("AIOS_CONTROL_PLANE_TARGET_VERSION", "V2R2C1"),
     )
     runtime = GovernedRuntime(config)

active-runtime/app/aios_gitops_job_controller.py

@@ -41,6 +41,8 @@ class JobState(str, Enum):
     REMOTE_SYNCING = "REMOTE_SYNCING"
     REMOTE_VERIFIED = "REMOTE_VERIFIED"
     COMPLETED = "COMPLETED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
     RECOVERABLE_FAILURE = "RECOVERABLE_FAILURE"
     RECONCILING = "RECONCILING"
     RECONCILIATION_REQUIRED = "RECONCILIATION_REQUIRED"
@@ -59,7 +61,12 @@ _ORDER = {
     JobState.COMPLETED: 8,
 }
 _RECOVERABLE = {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}
-_TERMINAL = {JobState.COMPLETED, JobState.MANUAL_OWNER_REVIEW_REQUIRED}
+_TERMINAL = {
+    JobState.COMPLETED,
+    JobState.FAILED,
+    JobState.CANCELLED,
+    JobState.MANUAL_OWNER_REVIEW_REQUIRED,
+}
 
 
 def utc_now() -> str:

active-runtime/app/aios_gitops_model_api.py

@@ -5,6 +5,8 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
 
+from release_version import validate_release_version
+
 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WORKSPACE = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
 DB_PATH = Path(os.getenv('AIOS_GITOPS_DB', str(ROOT / 'runtime' / 'gitops_model.sqlite3')))
@@ -218,7 +220,11 @@ class Handler(BaseHTTPRequestHandler):
                 a = self.require_write(['owner']);
                 if not a: return
                 ver=data.get('version') or data.get('tag')
-                if not re.match(r'^V\d+R\d+C\d+(-[a-zA-Z0-9_.-]+)?$', ver or ''): self.send_json({'error':'version must match VxRxCx'},400); return
+                try:
+            validate_release_version(ver)
+        except ValueError:
+            self.send_json({'error':'version must match VxRxCx'},400)
+            return
                 msg=data.get('message') or f'release {ver}'; out=git_cmd(['tag','-a',ver,'-m',msg]);
                 if data.get('push',False): git_cmd(['push','origin',ver])
                 level='V' if re.match(r'^V[1-9]\d*R0C0', ver) else ('R' if re.match(r'^V\d+R[1-9]\d*C0', ver) else 'C'); exec_sql('INSERT OR REPLACE INTO gitops_versions(version,tag,level,summary,status,created_by,created_at) VALUES(?,?,?,?,?,?,?)',(ver,ver,level,msg,'ready',a['username'],now())); exec_sql('UPDATE gitops_baseline SET active_version=?,active_tag=?,updated_at=? WHERE id=?',(ver,ver,now(),'current')); audit(a['username'],'git_tag',ver,{'level':level}); self.send_json({'status':'tagged','version':ver,'git':out}); return

active-runtime/app/aios_model_api_staging.py

@@ -23,6 +23,7 @@ from gitea_tag_publication import (
     TagPublisher,
     redact,
     validate_version,
+    validate_gitea_api_url,
 )
 from orchestrator.action_monitor import ActionMonitor
 from silent_release_hardening import (
@@ -319,8 +320,7 @@ def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
         raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
 
 def existing_tag_target(tag: str) -> str | None:
-    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
-        raise ValueError('invalid release version')
+    validate_version(tag)
     try:
         result = run_authoritative_git(
             ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
@@ -553,7 +553,15 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj({'error':redact(exc)},413)
                 except (AuthoritativeGitError, RuntimeError) as exc:
                     return self.sendj({'error':redact(exc)},503)
-                return self.sendj({'from':frm,'to':to,'diff':diff})
+                payload = {'from': frm, 'to': to, 'diff': diff}
+                payload.update({
+                    key: diff[key]
+                    for key in (
+                        'from_oid', 'to_oid', 'changed_paths', 'stats',
+                        'total_size_bytes', 'truncated', 'patch_limit_bytes',
+                    )
+                })
+                return self.sendj(payload)
             if path in ('/api/patch','/api/patches','/api/branches','/patch'):
                 snapshot = repository_snapshot(
                     git_dir=AUTHORITATIVE_GIT_DIR,
@@ -822,7 +830,10 @@ class H(BaseHTTPRequestHandler):
         a=self.need('tag:create');
         if not a: return
         ver=data.get('version') or data.get('tag')
-        if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
+        try:
+            validate_version(ver)
+        except ValueError:
+            return self.sendj({'error':'version must match VxRxCx'},400)
         if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
             return self.sendj({
                 'error':'production_tag_evidence_required',
@@ -1016,6 +1027,7 @@ def api_spec():
 
 
 def main():
+    validate_gitea_api_url(os.getenv('AIOS_GITOPS_GITEA_API_URL', ''))
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()

active-runtime/app/authoritative_git.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 import os
 import re
 import subprocess
+import time
 import urllib.parse
 from pathlib import Path
 from typing import Iterable
@@ -306,14 +307,76 @@ def authoritative_diff(
     from_oid = validate_git_revision(from_revision, "from", git_dir=path)
     to_oid = validate_git_revision(to_revision, "to", git_dir=path)
     args = ["diff", "--no-ext-diff", "--no-textconv", from_oid, to_oid]
-    result = run_authoritative_git(args, git_dir=path)
+    patch_limit = max(1, min(_MAX_OUTPUT, 256 * 1024))
+    process = subprocess.Popen(
+        ["git", "--git-dir", str(path), *args],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
+    )
+    chunks: list[bytes] = []
+    stored_bytes = 0
+    total_bytes = 0
+    started = time.monotonic()
+    try:
+        while process.stdout is not None:
+            chunk = process.stdout.read(64 * 1024)
+            if not chunk:
+                break
+            total_bytes += len(chunk)
+            if stored_bytes < patch_limit:
+                remaining = patch_limit - stored_bytes
+                selected = chunk[:remaining]
+                chunks.append(selected)
+                stored_bytes += len(selected)
+            if time.monotonic() - started > _TIMEOUT:
+                process.kill()
+                raise AuthoritativeGitError("GIT_REF_QUERY_TIMEOUT")
+        stderr = (
+            process.stderr.read(8192).decode("utf-8", errors="replace")
+            if process.stderr is not None
+            else ""
+        )
+        returncode = process.wait(timeout=max(0.1, _TIMEOUT - (time.monotonic() - started)))
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        process.kill()
+        process.wait()
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED") from exc
+    if returncode != 0:
+        raise AuthoritativeGitError(_redact(stderr.strip() or "GIT_REF_QUERY_FAILED")[:200])
+    try:
+        names_result = run_authoritative_git(
+            ["diff", "--no-ext-diff", "--no-textconv", "--name-status", from_oid, to_oid],
+            git_dir=path,
+        )
+        changed_paths = [
+            line.split("\t", 1)[-1]
+            for line in names_result.stdout.splitlines()
+            if line.strip()
+        ]
+    except AuthoritativeGitOutputTooLarge:
+        changed_paths = []
+    try:
+        stats_result = run_authoritative_git(
+            ["diff", "--no-ext-diff", "--no-textconv", "--stat", from_oid, to_oid],
+            git_dir=path,
+        )
+        stats = stats_result.stdout.strip()
+    except AuthoritativeGitOutputTooLarge:
+        stats = "GIT_STAT_OUTPUT_TRUNCATED"
+    patch = b"".join(chunks).decode("utf-8", errors="replace")
     return {
         "code": 0,
-        "stdout": result.stdout,
+        "stdout": patch,
         "stderr": "",
         "cmd": ["git", f"--git-dir={path}", *args],
         "from_oid": from_oid,
         "to_oid": to_oid,
+        "changed_paths": changed_paths,
+        "stats": stats,
+        "total_size_bytes": total_bytes,
+        "truncated": total_bytes > patch_limit,
+        "patch_limit_bytes": patch_limit,
     }
 
 

active-runtime/app/gitea_tag_publication.py

@@ -8,6 +8,7 @@ import json
 import os
 import re
 import subprocess
+import sys
 import tempfile
 import time
 import urllib.error
@@ -23,10 +24,15 @@ try:
     from authoritative_git import AuthoritativeGitError, run_authoritative_git
 except ModuleNotFoundError:
     from .authoritative_git import AuthoritativeGitError, run_authoritative_git
+try:
+    from release_version import RELEASE_VERSION_RE, validate_release_version
+except ModuleNotFoundError:
+    sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
+    from release_version import RELEASE_VERSION_RE, validate_release_version
 
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
-VERSION_RE = re.compile(r"^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$")
+VERSION_RE = RELEASE_VERSION_RE
 DEPLOYMENT_EVIDENCE_RE = re.compile(r"^(?:sha256:[0-9a-f]{64}|git:[0-9a-f]{40})$")
 FINGERPRINT_FIELDS = (
     "version",
@@ -83,9 +89,14 @@ class PublicationManualOwnerReviewRequired(
 
 
 def validate_version(version: str) -> str:
-    value = str(version or "")
-    if not VERSION_RE.fullmatch(value):
-        raise ValueError("invalid release version")
+    return validate_release_version(version)
+
+
+def validate_gitea_api_url(api_url: str) -> str:
+    value = str(api_url or "").strip().rstrip("/")
+    parsed = urllib.parse.urlsplit(value)
+    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+        raise ValueError("Gitea API URL must be HTTP(S)")
     return value
 
 
@@ -411,13 +422,11 @@ class GiteaTagClient:
         timeout: float = 15,
         token_line: int = 1,
     ):
-        self.api_url = api_url.rstrip("/")
+        self.api_url = validate_gitea_api_url(api_url)
         self.repository = repository.strip("/")
         self.token_file = token_file
         self.timeout = timeout
         self.token_line = token_line
-        if not self.api_url.startswith(("https://", "http://")):
-            raise ValueError("Gitea API URL must be HTTP(S)")
         if self.repository.count("/") != 1:
             raise ValueError("Gitea repository must be owner/name")
 

active-runtime/app/governed_tag_adapter.py

@@ -34,6 +34,8 @@ from gitea_tag_publication import (
     TagPublisher,
 )
 
+from release_version import validate_release_version
+
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
 
@@ -44,8 +46,10 @@ def load_request() -> dict[str, Any]:
         raise ValueError("request_object_required")
     if value.get("schema") != "aios.production-executor-request.v1":
         raise ValueError("request_schema_invalid")
-    if not re.fullmatch(r"V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?", str(value.get("version", ""))):
-        raise ValueError("version_invalid")
+    try:
+        validate_release_version(value.get("version", ""))
+    except ValueError as exc:
+        raise ValueError("version_invalid") from exc
     for name in ("target_oid", "evidence_closure_oid"):
         if not OID_RE.fullmatch(str(value.get(name, ""))):
             raise ValueError(f"{name}_invalid")

active-runtime/app/release_metadata_adapter.py

@@ -27,6 +27,8 @@ import urllib.request
 from pathlib import Path
 from typing import Any, Mapping
 
+from release_version import validate_release_version
+
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA_RE = re.compile(r"^[0-9a-f]{64}$")
 PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
@@ -86,8 +88,10 @@ def load_request() -> dict[str, Any]:
         raise ValueError("request_schema_invalid")
     if value.get("repository_identity") != "aios/aios":
         raise ValueError("repository_identity_invalid")
-    if not re.fullmatch(r"V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?", str(value.get("version", ""))):
-        raise ValueError("version_invalid")
+    try:
+        validate_release_version(value.get("version", ""))
+    except ValueError as exc:
+        raise ValueError("version_invalid") from exc
     for name in ("target_oid", "evidence_closure_oid"):
         if not OID_RE.fullmatch(str(value.get(name, ""))):
             raise ValueError(f"{name}_invalid")

active-runtime/app/silent_release_controller.py

@@ -22,11 +22,12 @@ from enum import Enum
 from pathlib import Path
 from typing import Any, Protocol
 
+from release_version import validate_release_version
+
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
 CANDIDATE_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]{2,127}$")
-VERSION_RE = re.compile(r"^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$")
 SECRET_PATTERNS = (
     re.compile(r"(?i)(authorization\s*[:=]\s*)(?:bearer|token)\s+\S+"),
     re.compile(r"(?i)((?:access_)?token\s*[:=]\s*)\S+"),
@@ -769,8 +770,10 @@ class TagApprovalEnvelope:
     def validate(self) -> None:
         if self.action != "production_tag":
             raise ApprovalError("approval does not authorize production tag")
-        if not VERSION_RE.fullmatch(self.version):
-            raise ApprovalError("invalid release version")
+        try:
+            validate_release_version(self.version)
+        except ValueError as exc:
+            raise ApprovalError("invalid release version") from exc
         _validate_oid("tag_oid", self.tag_oid)
         _validate_oid("target_oid", self.target_oid)
         if _parse_utc(self.expires_at) <= datetime.now(timezone.utc):

deploy/systemd/aios-chatgpt-bridge-v2-staging.service

@@ -4,14 +4,25 @@ After=network-online.target
 
 [Service]
 Type=simple
-User=aios-bridge-staging
-Group=aios-bridge-staging
-WorkingDirectory=/opt/aios/gitops-control-plane/current
+User=aiman
+Group=gitops
+PermissionsStartOnly=true
+WorkingDirectory=@RUNTIME_ROOT@
 Environment=AIOS_BRIDGE_SCHEMA_VERSION=aios.chatgpt-gitops-bridge.v2
 Environment=AIOS_GITOPS_WRITES_ENABLED=false
 Environment=AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED=true
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_GITEA_API_BASE=https://g.cnnetmkt.top/git/api/v1
+Environment=AIOS_GITEA_TOKEN_FILE=/run/credentials/aios-chatgpt-bridge-v2-staging.service/gitea_token
+Environment=AIOS_GITEA_REMOTE=gitea-http
+Environment=AIOS_CONTROL_PLANE_TARGET_VERSION=V2R2C1
+Environment=AIOS_CONTROL_PLANE_TARGET_OID=@SOURCE_OID@
+Environment=AIOS_CONTROL_PLANE_ARTIFACT_SHA256=@ARTIFACT_SHA256@
+Environment=PYTHONPATH=@RUNTIME_ROOT@:@RUNTIME_ROOT@/app:@RUNTIME_ROOT@/runtime-agent-os
 Environment=AIOS_DEPLOYMENT_STATE=STAGING
-ExecStart=/usr/bin/python3 /opt/aios/gitops-control-plane/current/bridge-v2-staging-server.py
+LoadCredential=gitea_token:/run/credentials/aios-governance-executor.service/gitea-governance-executor-token
+ExecStartPre=/usr/bin/install -d -o aiman -g gitops -m 0750 /var/lib/aios-gitops/bridge-v2-staging
+ExecStart=/usr/bin/python3 -B @RUNTIME_ROOT@/app/aios_chatgpt_bridge_v2_server.py
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict

deploy/systemd/aios-gitops-model-api-v2r2c1-staging.service

@@ -7,6 +7,9 @@ Wants=network-online.target
 Type=simple
 User=aiman
 Group=gitops
+PermissionsStartOnly=true
+ExecStartPre=/usr/bin/install -d -o aiman -g gitops -m 0750 /var/lib/aios-gitops/model-api-staging
+ExecStartPre=/usr/bin/install -d -o aiman -g gitops -m 0750 /var/lib/aios-gitops/model-api-staging/silent-release
 WorkingDirectory=@RUNTIME_ROOT@
 Environment=PYTHONUNBUFFERED=1
 Environment=PYTHONDONTWRITEBYTECODE=1
@@ -27,10 +30,16 @@ Environment=AIOS_GITOPS_DEPLOYMENT_STATE=STAGING
 Environment=AIOS_GITOPS_MODEL_API_SERVICE=aios-gitops-model-api-v2r2c1-staging.service
 Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
 Environment=AIOS_SILENT_RELEASE_STATE_ROOT=/var/lib/aios-gitops/model-api-staging/silent-release
+Environment=AIOS_GITOPS_GITEA_API_URL=https://g.cnnetmkt.top/git/api/v1
+Environment=AIOS_GITOPS_GITEA_REPOSITORY=aios/aios
+Environment=AIOS_GITOPS_GITEA_REMOTE=gitea-http
+Environment=AIOS_GITOPS_GITEA_TOKEN_FILE=/run/credentials/aios-gitops-model-api-v2r2c1-staging.service/gitea_token
+Environment=AIOS_GITOPS_GITEA_TOKEN_LINE=1
+LoadCredential=gitea_token:/run/credentials/aios-governance-executor.service/gitea-governance-executor-token
 Environment=AIOS_BRIDGE_V2_URL=http://127.0.0.1:18892
 Environment=AIOS_GITOPS_HOST=127.0.0.1
 Environment=AIOS_GITOPS_PORT=18893
-Environment=PYTHONPATH=@RUNTIME_ROOT@/app:@RUNTIME_ROOT@/runtime-agent-os
+Environment=PYTHONPATH=@RUNTIME_ROOT@:@RUNTIME_ROOT@/app:@RUNTIME_ROOT@/runtime-agent-os
 ExecStart=/usr/bin/python3 @RUNTIME_ROOT@/app/aios_model_api_staging.py
 Restart=on-failure
 RestartSec=2

docs/gitops/openapi-chatgpt-actions.yaml

@@ -241,6 +241,48 @@ components:
       properties:
         candidate_id: {type: string}
 paths:
+  /v2/commit-files:
+    post:
+      operationId: commitFilesGoverned
+      summary: Submit one atomic governed commit containing multiple files
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+                - task_id
+                - repository
+                - expected_branch_oid
+                - target_branch
+                - generation
+                - idempotency_key
+                - files
+                - message
+              properties:
+                task_id: {type: string}
+                repository: {type: string, example: aios/aios}
+                expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+                target_branch: {type: string, pattern: '^agent/[A-Za-z0-9._/-]+$'}
+                generation: {type: integer, minimum: 1}
+                idempotency_key: {type: string}
+                files:
+                  type: array
+                  minItems: 1
+                  items:
+                    type: object
+                    additionalProperties: false
+                    required: [path, content_base64]
+                    properties:
+                      path: {type: string, minLength: 1, maxLength: 512}
+                      content_base64: {type: string}
+                message: {type: string, minLength: 1, maxLength: 200}
+      responses:
+        '200': {description: Governed commit job and verified branch result}
+        '400': {description: Contract or policy rejection}
+        '409': {description: Branch CAS or idempotency conflict}
   /createReleaseIntent:
     post:
       operationId: createReleaseIntent

release_version.py

@@ -0,0 +1,21 @@
+"""Canonical AIOS release-version parser shared by runtime and release tools."""
+from __future__ import annotations
+
+import re
+
+
+# The suffix preserves already-supported annotated release names while the
+# canonical VnRnCn namespace remains accepted exactly.
+RELEASE_VERSION_PATTERN = r"^V[0-9]+R[0-9]+C[0-9]+(?:-[A-Za-z0-9_.-]+)?$"
+RELEASE_VERSION_RE = re.compile(RELEASE_VERSION_PATTERN)
+
+
+def parse_release_version(version: object) -> str:
+    value = str(version or "").strip()
+    if not RELEASE_VERSION_RE.fullmatch(value):
+        raise ValueError("invalid release version")
+    return value
+
+
+def validate_release_version(version: object) -> str:
+    return parse_release_version(version)

reports/action-contract-regression-remediation-20260825.md

@@ -0,0 +1,75 @@
+# Action Contract Regression Remediation — 2026-08-25
+
+## Scope
+
+Governed task: `fix-action-contracts-20260825-1407`
+Base: `3244f0f17f8845592ac94d585f5ebd65693c9f29`
+Target branch: `agent/fix-action-contracts-20260825-1407`
+
+## Verified regressions
+
+1. `getReleaseConsistency` and `runReleaseAcceptance` fail before evaluation with:
+   `Gitea API URL must be HTTP(S)`.
+   V2R2C1 release evidence at `a8b906d1bc24088c19647e98de6a679268f6d0a2`
+   proves Gitea API readback passed for target `998d30304787e31e5ae607c0bd86b5edb2b0e5ad`.
+   Therefore current staging/contract overlay configuration has regressed.
+
+2. `getReleaseSaga` fails with:
+   `Permission denied: '/var/lib/aios-gitops/silent-release'`.
+   Runtime service identity must have read/traverse access to the durable release state root.
+   Fix ownership/group/ACL at deployment time; do not broaden to world-writable permissions.
+
+3. `getTagPublicationStatus` rejects the authoritative approved version `V2R2C1`
+   as `invalid release version`, while `getGovernedWriteCapabilities` returns the same
+   version as the approved release scope. The two Action contracts are internally inconsistent.
+   Release-version validation must accept the canonical AIOS `^V[0-9]+R[0-9]+C[0-9]+$`
+   namespace (or, preferably, use one shared validator for all release Actions).
+
+4. `commitFilesGoverned` is unusable from the published Action schema.
+   Runtime capability metadata declares required fields:
+   `task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, files, message`,
+   but the exposed tool contract has no `files` input. Regenerate/publish the Action schema from
+   the same operation contract source and add a contract-parity test.
+
+5. `reconcileGitOpsJob` returned `DURABLE_BINDING_INVALID` for a completed governed
+   single-file job that was otherwise read back as `COMPLETED`.
+   Reconciliation of a valid terminal job should be idempotent/read-only and must not require
+   a stale or absent active lease. Add a regression case for terminal completed jobs.
+
+6. `getDiff` returns `ResponseTooLargeError` / `GIT_OUTPUT_LIMIT_EXCEEDED` for large diffs.
+   Add server-side bounded output: path/stat summary plus truncation metadata, or pagination.
+   The Action must never fail merely because a valid repository diff is large.
+
+## Required implementation changes
+
+- Centralize release-version parsing and reuse it in tag status, candidate, consistency, and acceptance.
+- Validate/normalize Gitea API URL at service startup and fail health checks with a configuration-specific diagnostic.
+- Ensure the deployment unit projects a valid HTTP(S) Gitea API base URL into the staging overlay.
+- Correct durable release-state directory ownership/ACL for the runtime service account.
+- Generate the external Action schema from the runtime operation contract; parity-test required fields.
+- Make terminal reconciliation idempotent and independent of expired active writer leases.
+- Bound diff output and return `truncated=true` with deterministic metadata rather than transport failure.
+
+## Acceptance gates
+
+All must pass on the same deployed overlay:
+
+- `getReleaseConsistency(V2R2C1, 998d303..., a8b906d..., approved_plan)` returns a structured result, not URL error.
+- `runReleaseAcceptance(...)` reaches policy evaluation, not URL error.
+- `getTagPublicationStatus("V2R2C1")` returns structured publication state.
+- `getReleaseSaga(nonexistent_candidate)` returns NOT_FOUND/empty-state semantics, never filesystem permission failure.
+- Published `commitFilesGoverned` schema exposes `files` and a two-file isolated branch commit succeeds.
+- Reconcile of a completed governed job is idempotent.
+- Large diff returns bounded/truncated data rather than transport exception.
+- Existing protected-ref controls remain unchanged: no direct main/tag/baseline/production write.
+
+## Proven stable reference
+
+V2R2C1 evidence closure (`a8b906d1bc24088c19647e98de6a679268f6d0a2`) records:
+- Gitea Git/API readback PASS
+- staging runtime PASS
+- restart recovery PASS
+- 59 mandatory tests passed / 0 failed
+
+This evidence should be used as the compatibility baseline when repairing the current
+`contract-overlay-v2` / `scheme-a-323b615b...` staging layer.

runbooks/agent-fix-action-contracts-20260825.md

@@ -0,0 +1,207 @@
+# Agent Execution Contract — Action Contract Regression Repair
+
+## Objective
+
+Fully repair the current AIOS Action runtime/contract overlay regressions on the single server, without modifying protected refs directly and without introducing new infrastructure. The task is not complete until the deployed staging/action overlay passes all acceptance gates.
+
+## Authority and scope
+
+- Repository: `aios/aios`
+- Base at task creation: `3244f0f17f8845592ac94d585f5ebd65693c9f29`
+- Governed task: `fix-action-contracts-20260825-1407`
+- Target branch: `agent/fix-action-contracts-20260825-1407`
+- Protected refs must not be directly written: `main`, release tags, baseline registry, production runtime.
+- No new SaaS, database, agent framework, or monitoring platform may be introduced.
+
+## Non-interactive rules
+
+The Agent must run the whole flow unnattended:
+
+1. Collect facts.
+2. Determine root causes.
+3. Make the smallest correct changes.
+4. Run unit/integration/contract tests.
+5. Deploy to staging only.
+6. Restart only the affected non-production services.
+7. Run the full Action smoke suite.
+8. On failure, automatically collect logs, diagnose, fix, and retry.
+9. If a change causes a new regression, automatically roll back the staging change to the previous known-good configuration and record the failure.
+10. Stop only if an owner decision is required for a high-risk, irreversible, or production-boundary action.
+
+## Fact collection — required before editing
+
+Record all of the following in the final evidence bundle:
+
+- `id`, `hostname`, `uname -a`, `date --iso-seconds`
+- `git rev-parse --show HEAD` for authority worktree and running overlay source
+- `git status --porcelaine=v2`
+- `git remote -v`
+- current systemd service unit(s), drop-ins, Environment/EnvironmentFile sources for GitOps/Bredge/release services
+- `systemctl show <affected-service>` including `User=`, `Group=`, `Environment=`, `EnvironmentFile=`, `ExecStart=`
+- resolved Gitea API base URL after env/config expansion; redact secrets but not scheme/host
+- `stat -c, `namei -l`, `getfacl`, als -ld on `/var/lib/aios-gitops/silent-release` and its parents
+- find Action OpenAPI/schema generator and runtime operation definitions for `commitFilesGoverned`
+- find the release version validator(s) and all callers of `getTagPublicationStatus`
+- find `reconcileGitOpsJob` implementation and durable binding validation logic
+- find `getDiff  implementation and transport output limits
+
+Do not edit any file until the actual implementation and configuration sources have been located.
+
+## Repair 1 — Gitea API URL
+
+Symptoms:
+
+- `getReleaseConsistency` → `Gitea API URL must be HTTP(S)`
+- `runReleaseAcceptance` → `Gitea API URL must be HTTP(ÊX
+
+Required behavior:
+
+- Determine which env/config key is projected into the current contract overlay.
+- Compare the deployed overlay with V2R2C1 known-good configuration/deployment manifests.
+- Restore a valid `HTTP://` or `HTTPS://` Gitea API base URL.
+- Add startup config validation so invalid schemes fail at health/startup with a config-specific message, not during a release check.
+- Never hard-code a different Gitea host if the existing deployment already has a single authoritative source.
+
+## Repair 2 — durable release state permissions
+
+Symptom:
+
+- `getReleaseSaga` → `Permission denied: '/var/lib/aios-gitops/silent-release'`
+
+Required behavior:
+
+- Identify the actual runtime service User/Group.
+- Grant only the required traverse/read/write permissions for the durable state directories the service must use.
+- Prefer ownership + group mode or a specific ACL; keep the directory non-world-writable.
+- Persist the permission in deployment/install logic so restart/reboot does not regress.
+- Verify create/read/update of a staging-only saga state file under the service identity.
+
+## Repair 3 — release version contract
+
+Symptom:
+
+- `getTagPublicationStatus("V2R2C1")` → `invalid release version`
+- The same runtime exposes `V2R2C1` as `approved_release_version`.
+
+Required behavior:
+
+- Locate all version validators; consolidate onto one canonical parser.
+- Accept the AIOS canonical namespace `^V[0-9]+R[0-9]+C[0-9]+$`.
+- Preserve any additional already-supported legacy formats unless they are security-sensitive.
+ - Add contract tests proving that the version accepted by capabilities is accepted by status, candidate, consistency, acceptance, and tag publication.
+
+## Repair 4 — `commitFilesGoverned` schema parity
+
+Symptom:
+
+- Runtime capability metadata requires `files`.
+- Published Action tool schema does not expose `files`.
+- Call reaches Bridge and fails `BRIDGE_REQUEST_FIELDS_MISSING`.
+
+Required behavior:
+
+- Find the canonical runtime operation contract.
+- Generate the external tool schema from the same source of truth; do not manually copy a parallel schema.
+- `files` must be required and must represent a list of file objects with at least `path` and `content_base64`.
+- Add a parity test that compares runtime required fields with published Action required fields.
+- Add a real governed commit test that writes two test files to an isolated `agent/` ibranch and verifies remote OID.
+
+## Repair 5 — terminal reconciliation
+
+Symptom:
+
+- A governed job read back as `COMPLETED' but `reconcileGitOpsJob` failed `DURABLE_BINDING_INVALID`.
+
+Required behavior:
+
+- Reconciling a terminal successful job must be idempotent.
+- An expired writer lease must not invalidate a durable binding for a job that is already terminal.
+- Active-job reconciliation may require a live lease; terminal read-back must not.
+- Add cases for COMPLETED, FAILED, CANCELLED / equivalent terminal states.
+
+## Repair 6 — bounded `getDiff` output
+
+Symptom:
+
+- Large valid diffs fail with `ResponseTooLargeError` or `GIT_OUTPUT_LIMIT_EXCEEDED`.
+
+Required behavior:
+
+- Do not load unbounded diff text into the Action response.
+- Return bounded summary data: commit identities, changed paths/stats, total bytes, and `truncated: true` when the full patch exceeds the safe limit.
+- If pagination already exists in the contract use it; otherwise prefer deterministic truncation over a breaking schema change.
+- Add tests for small, empty, and oversize diffs.
+
+## Staging deployment procedure
+
+1. Run the existing mandatory test suite before modification; record baseline.
+2. Apply code and config changes only on the governed branch/worktree.
+3. Run focused regression tests.
+4. Run the full mandatory suite.
+5. Build the staging contract overlay using the repository's existing build/deploy path.
+6. Deploy to staging/non-production only.
+7. If systemd units are changed: `systemctl daemon-reload`, then restart only the affected staging services.
+8. Wait for the existing health endpoint/runtime status to become healthy.
+9. Run the acceptance suite below.
+
+If any step fails:
+- collect `journalctl` logs and relevant app logs;
+- diagnose root cause;
+- automatically repair and retry when non-destructive;
+- if a new change breaks staging, restore the previous staging artifact/config and restart the affected service;
+- never silently continue after a failed gate.
+
+## Acceptance suite
+
+All of the following must pass on the same deployed staging overlay:
+
+- Runtime status is `active` and healthy after restart.
+- Gitea Git/API readback works from the runtime service identity.
+- `getReleaseConsistency(V2R2C1, 998d30304787e31e5ae607c0bd86b5edb2b0e5ad, a8b906d1bc24088c19647e98de6a679268f6d0a2, approved_plan) returns a structured result and reaches evaluation.
+- `runReleaseAcceptance` for the same identities reaches policy evaluation, not URL validation error.
+- `getTagPublicationStatus("V2R2C1")` returns structured state, not `invalid release version`.
+- `getReleaseSaga` for a nonexistent candidate returns NOT_FOUND/empty-state semantics, not filesystem permission failure.
+- `commitFilesGoverned` exposes its required `files` parameter in the published Action schema.
+ - A real two-file governed commit to an isolated `agent/` branch succeeds and remote branch OID matches.
+- Resuming a COMPLETED job returns the existing `JOB_TERMINAL` semantics or idempotent success as designed.
+- Reconciling a COMPLETED governed job is successful/idempotent and does not require an active lease.
+- Small/empty `getDiff  still works.
+- Large `getDiff` returns bounded output with truncation metadata instead of a transport exception.
+- Existing protected-ref controls remain unchange: no direct main/tag/baseline/production write.
+
+## Restart / reboot persistence
+
+After the first full pass:
+
+- Restart the staging Action/Bridge/release services one more time without changing files.
+- Rerun the acceptance suite.
+- Permissions, Gitea URL, and schema must still be correct after restart.
+- If the repository already has a safe staging reboot test, run it as well.
+
+## Evidence and completion
+
+Create a single durable report in the repository, e.g. `reports/action-contract-repair-evidence-20260825.md`, containing:
+
+- pre-change facts
+- root cause for each regression
+- files changed and why
+- config/permission changes
+- test commands and exact results
+- staging deployment identity (commit/artifact/config digest)
+- restart-persistence results
+- final Action smoke results
+- any remaining risks
+
+Commit all source, test, deployment config, and runbook changes to the governed task branch. Do not mark the task SUCCEEDED until all acceptance gates pass on the actually deployed staging overlay.
+
+## Automatic rollback conditions
+
+Automatically roll back the staging deployment if any of the following occur:
+
+- service fails to become healthy after restart
+- protected-ref write boundary is broken
+- Gitea readback that worked before the change stops working
+- durable saga state cannot be read or recovered
+- mandatory test suite regresses below the pre-change baseline
+
+Do not automatically roll back an existing production release. Rollback here refers only to the staging overlay/service configuration changes made by this task.

scripts/build_v2r2c1_model_api_staging.py

@@ -5,6 +5,7 @@ import hashlib
 import json
 import os
 from pathlib import Path
+import sys
 import tarfile
 import tempfile
 
@@ -18,6 +19,18 @@ REQUIRED_APP = (
     'silent_release_controller.py',
     'silent_release_hardening.py',
     'aios_gitops_job_controller.py',
+    'aios_chatgpt_bridge_v2.py',
+    'aios_chatgpt_bridge_v2_server.py',
+    'governed_production_release.py',
+    'v2r2c1_production_adapter.py',
+    'v2r1c7_production_adapter.py',
+    'aios_governed_task_bootstrap.py',
+    'aios_continuation_executor.py',
+    'aios_continuation_lease.py',
+    'aios_authority_git_executor.py',
+    'aios_gitops_reconciliation_core.py',
+    'authorized_task_writer_provisioning.py',
+    'signer_contract_compatibility.py',
 )
 OPTIONAL_APP = (
     'aios_chatgpt_actions_api.py',
@@ -56,11 +69,18 @@ def main() -> int:
     source = args.source_root.resolve(strict=True)
     output = args.output_root.resolve()
     app = source / 'active-runtime' / 'app'
+    sys.path.insert(0, str(app))
+    from aios_chatgpt_bridge_v2 import render_openapi_contract_fragment
+
     runtime = source / 'runtime' / 'agent-os'
     docs = source / 'docs' / 'gitops'
     if not app.is_dir():
         raise SystemExit('active-runtime/app missing')
     paths = []
+    root_version = source / 'release_version.py'
+    if not root_version.is_file():
+        raise SystemExit('required source dependency missing: release_version.py')
+    paths.append((Path('release_version.py'), root_version))
     for name in REQUIRED_APP:
         path = app / name
         if not path.is_file():
@@ -77,6 +97,8 @@ def main() -> int:
         paths.append((Path('runtime-agent-os') / rel, path))
     openapi = docs / 'openapi-chatgpt-actions.yaml'
     if openapi.is_file():
+        if '  /v2/commit-files:' not in openapi.read_text(encoding='utf-8'):
+            raise SystemExit('published OpenAPI is missing generated commitFilesGoverned contract')
         paths.append((Path('docs') / 'gitops' / 'openapi-chatgpt-actions.yaml', openapi))
     for folder in ('config/model_registry', 'config/model_priority', 'patches', 'versions'):
         root = source / folder

scripts/release_version.sh

@@ -9,10 +9,16 @@ WORKSPACE="${AIOS_GITOPS_WORKSPACE:-/data/aios-gitops/workspace}"
 TAG_REMOTE="${AIOS_GITOPS_GITEA_REMOTE:-gitea}"
 BRANCH_REMOTE="${AIOS_GITOPS_BRANCH_REMOTE:-gitea}"
 
-case "$VERSION" in
-  V[0-9]*R[0-9]*C[0-9]*) ;;
-  *) echo "ERROR: version must match VxRxCx" >&2; exit 64 ;;
-esac
+SCRIPT_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+if ! PYTHONPATH="$SCRIPT_ROOT:${PYTHONPATH:-}" python3 - "$VERSION" <<'PY'
+import sys
+from release_version import validate_release_version
+validate_release_version(sys.argv[1])
+PY
+then
+  echo "ERROR: version must match VxRxCx" >&2
+  exit 64
+fi
 
 for value in "$TARGET_OID" "$EVIDENCE_CLOSURE_OID"; do
   [[ "$value" =~ ^[0-9a-f]{40}$ ]] || {

services/aios-release-controller/aios_release_controller/manifest.py

@@ -1,8 +1,9 @@
 from __future__ import annotations
 import hashlib,json,re,tarfile
+from release_version import RELEASE_VERSION_RE
 from pathlib import Path
 from typing import Any
-OID_RE=re.compile(r"^[0-9a-f]{40}$"); SHA_RE=re.compile(r"^[0-9a-f]{64}$"); VERSION_RE=re.compile(r"^V[0-9]+R[0-9]+C[0-9]+(?:-[A-Za-z0-9_.-]+)?$")
+OID_RE=re.compile(r"^[0-9a-f]{40}$"); SHA_RE=re.compile(r"^[0-9a-f]{64}$"); VERSION_RE=RELEASE_VERSION_RE
 REQUIRED_SOURCE={"schema","version","repository","base_ref","base_oid","binding_mode","release_readiness","production_deployed","tag_created","baseline_changed","production_service","production_port","rollback_metadata","controller_schema","required_checks"}
 REQUEST_KEYS={"schema","version","repository","base_oid","target_oid","artifact_uri","artifact_sha256","artifact_size","evidence_closure_oid","approval_plan_id","execute","production_deployed","production_service","production_port","rollback_metadata","current_tag_oid","source_manifest_sha256"}
 class ManifestValidationError(ValueError):

tests/contract-integration-a.txt

@@ -0,0 +1 @@
+action-contract-integration-a

tests/contract-integration-b.txt

@@ -0,0 +1 @@
+action-contract-integration-b

tests/test_action_contract_regressions.py

@@ -0,0 +1,116 @@
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+
+from aios_chatgpt_bridge_v2 import (  # noqa: E402
+    OPERATION_REQUIRED_FIELDS,
+    operation_contracts,
+    render_openapi_contract_fragment,
+)
+from aios_chatgpt_bridge_v2_server import GovernedRuntime  # noqa: E402
+from aios_gitops_job_controller import JobState  # noqa: E402
+from gitea_tag_publication import validate_gitea_api_url  # noqa: E402
+from release_version import validate_release_version  # noqa: E402
+
+
+def test_canonical_release_version_is_shared_and_accepts_v2r2c1():
+    assert validate_release_version("V2R2C1") == "V2R2C1"
+    assert validate_release_version("V2R2C1-repair") == "V2R2C1-repair"
+    with pytest.raises(ValueError):
+        validate_release_version("v2r2c1")
+
+
+def test_gitea_url_validation_is_startup_safe():
+    assert validate_gitea_api_url("https://g.cnnetmkt.top/git/api/v1") == (
+        "https://g.cnnetmkt.top/git/api/v1"
+    )
+    with pytest.raises(ValueError, match="HTTP"):
+        validate_gitea_api_url("g.cnnetmkt.top/git/api/v1")
+
+
+def test_commit_files_runtime_and_published_schema_have_same_required_fields():
+    runtime = operation_contracts()["commitFilesGoverned"]["required_fields"]
+    assert runtime == list(OPERATION_REQUIRED_FIELDS["commitFilesGoverned"])
+    fragment = render_openapi_contract_fragment()
+    published = (ROOT / "docs/gitops/openapi-chatgpt-actions.yaml").read_text()
+    assert fragment in published
+    for field in runtime:
+        assert f"                - {field}" in fragment
+    assert "required: [path, content_base64]" in fragment
+
+
+class _Store:
+    def __init__(self, row):
+        self.row = row
+        self.receipt_calls = 0
+
+    def read(self, _job_id):
+        return self.row
+
+    def _receipt(self, row, duplicate=False):
+        self.receipt_calls += 1
+        return type("Receipt", (), {"as_dict": lambda _self: {
+            "job_id": row["job_id"],
+            "state": row["state"],
+            "duplicate": duplicate,
+        }})()
+
+
+class _Controller:
+    def __init__(self, row):
+        self.store = _Store(row)
+
+
+def _runtime_for(row):
+    runtime = object.__new__(GovernedRuntime)
+    controller = _Controller(row)
+    runtime._controller_for_job = lambda _job_id: controller
+    runtime._executor_from_row = lambda *_args: (_ for _ in ()).throw(
+        AssertionError("terminal reconcile must not reconstruct an executor")
+    )
+    return runtime, controller
+
+
+@pytest.mark.parametrize(
+    "state",
+    [
+        JobState.COMPLETED.value,
+        JobState.FAILED.value,
+        JobState.CANCELLED.value,
+        JobState.MANUAL_OWNER_REVIEW_REQUIRED.value,
+    ],
+)
+def test_terminal_reconcile_is_idempotent_without_durable_binding(state):
+    row = {
+        "job_id": "job-terminal",
+        "state": state,
+        "request_json": json.dumps({}),
+    }
+    runtime, controller = _runtime_for(row)
+    result = GovernedRuntime.job(runtime, {"job_id": row["job_id"]}, "reconcile")
+    assert result["duplicate"] is True
+    assert controller.store.receipt_calls == 1
+
+
+def test_active_reconcile_still_uses_executor():
+    row = {
+        "job_id": "job-active",
+        "state": JobState.RECONCILIATION_REQUIRED.value,
+        "request_json": json.dumps({}),
+    }
+    runtime, controller = _runtime_for(row)
+    class Executor:
+        def reconcile(self, job_id):
+            return {"job_id": job_id, "state": "COMPLETED"}
+    runtime._executor_from_row = lambda *_args: Executor()
+    assert GovernedRuntime.job(runtime, {"job_id": row["job_id"]}, "reconcile") == {
+        "job_id": "job-active",
+        "state": "COMPLETED",
+    }