feat(gitops): restore governed Online Agent execution chain and Action contracts

active-runtime/app/agent_event_bus.py

@@ -13,6 +13,7 @@ from hashlib import sha256
 from pathlib import Path
 import json
 from typing import Any
+from message_handoff import stable_event_id
 
 
 def utc_now() -> str:
@@ -55,13 +56,18 @@ class AgentEventBus:
         payload: dict[str, Any],
         correlation_id: str | None = None,
     ) -> dict[str, Any]:
-        event_id = "evt_" + sha256(
-            json.dumps(
-                {"kind": kind, "source": source, "summary": summary, "payload": payload},
-                sort_keys=True,
-                ensure_ascii=False,
-            ).encode("utf-8")
-        ).hexdigest()[:16]
+        event_id = stable_event_id(
+            source=source, target=target, message_type=kind, payload=payload,
+            tenant_id=(payload.get('tenant_id') if isinstance(payload, dict) else None),
+            user_id=(payload.get('user_id') if isinstance(payload, dict) else None),
+            project_id=(payload.get('project_id') if isinstance(payload, dict) else None),
+            conversation_id=(payload.get('conversation_id') if isinstance(payload, dict) else None),
+            task_id=(payload.get('task_id') if isinstance(payload, dict) else None),
+            run_id=(payload.get('run_id') if isinstance(payload, dict) else None),
+            causation_id=(payload.get('causation_id') if isinstance(payload, dict) else None),
+            sequence=(payload.get('sequence') if isinstance(payload, dict) else None),
+            idempotency_key=(payload.get('idempotency_key') if isinstance(payload, dict) else None),
+        )
         event = AgentEvent(event_id, kind, source, target, summary, payload, correlation_id=correlation_id)
         self._write("pending", event.to_dict())
         self._audit("created", event.to_dict())

active-runtime/app/aios_authority_git_executor.py

@@ -94,6 +94,91 @@ class AuthorityGitExecutor:
         self._git(["worktree", "add", "--detach", str(path), base_oid])
         return path
 
+    def recover_failed_detached_worktree_exact(
+        self,
+        *,
+        path: Path,
+        expected_oid: str,
+        stale_oid: str,
+        target_ref: str,
+    ) -> str:
+        """Recreate one exact clean, detached, single-attempt worktree at its durable head."""
+        _oid(expected_oid, "expected_oid")
+        _oid(stale_oid, "stale_oid")
+        if not TASK_BRANCH_RE.fullmatch(target_ref):
+            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
+        if self.read_ref(target_ref) is not None:
+            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
+        if (
+            not path.is_absolute()
+            or path.parent != self.worktree_root
+            or path.name in {"", ".", ".."}
+            or path.is_symlink()
+            or not path.is_dir()
+        ):
+            raise AuthorityGitError("WORKTREE_RECOVERY_PATH_INVALID")
+        head = subprocess.run(
+            ["git", "-C", str(path), "rev-parse", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if head.returncode != 0 or head.stdout.strip() != stale_oid or stale_oid == expected_oid:
+            raise AuthorityGitError("WORKTREE_RECOVERY_HEAD_INVALID")
+        symbolic = subprocess.run(
+            ["git", "-C", str(path), "symbolic-ref", "-q", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if symbolic.returncode != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_DETACHED")
+        status = subprocess.run(
+            ["git", "-C", str(path), "status", "--porcelain=v1", "--untracked-files=all"],
+            text=True, capture_output=True, check=False,
+        )
+        if status.returncode != 0 or status.stdout:
+            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_CLEAN")
+        parents = self._git(["rev-list", "--parents", "-n", "1", stale_oid]).split()
+        if parents != [stale_oid, expected_oid]:
+            raise AuthorityGitError("WORKTREE_RECOVERY_LINEAGE_INVALID")
+        registered = [
+            line.removeprefix("worktree ")
+            for line in self._git(["worktree", "list", "--porcelain"]).splitlines()
+            if line.startswith("worktree ")
+        ]
+        if registered.count(str(path)) != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_REGISTRATION_INVALID")
+        self._git(["worktree", "remove", "--force", str(path)])
+        if path.exists() or path.is_symlink():
+            raise AuthorityGitError("WORKTREE_RECOVERY_REMOVE_FAILED")
+        recreated = self.create_detached_worktree(expected_oid, path.name, path.parent)
+        readback = subprocess.run(
+            ["git", "-C", str(recreated), "rev-parse", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        detached = subprocess.run(
+            ["git", "-C", str(recreated), "symbolic-ref", "-q", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if readback.returncode != 0 or readback.stdout.strip() != expected_oid or detached.returncode != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_READBACK_MISMATCH")
+        return stale_oid
+
+    def create_task_branch_CAS(self, branch: str, expected_base_oid: str, new_oid: str) -> str:
+        if not TASK_BRANCH_RE.fullmatch(branch):
+            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
+        _oid(expected_base_oid, "expected_base_oid")
+        _oid(new_oid, "new_oid")
+        current = self.read_ref(branch)
+        if current is not None:
+            if current == new_oid:
+                return new_oid
+            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
+        if not self.ancestry_check(expected_base_oid, new_oid):
+            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
+        self._git(["update-ref", branch, new_oid, "0" * 40])
+        readback = self.read_ref(branch)
+        if readback != new_oid:
+            raise AuthorityGitError("AUTHORITY_CREATE_READBACK_MISMATCH")
+        return readback
+
     def advance_task_branch_CAS(self, branch: str, expected_oid: str, new_oid: str) -> str:
         if not TASK_BRANCH_RE.fullmatch(branch):
             raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")

active-runtime/app/aios_chatgpt_bridge_v2.py

@@ -12,7 +12,11 @@ BRIDGE_OPERATIONS = (
     "getRuntimeStatus",
     "getGovernedWriteCapabilities",
     "createGovernedTask",
+    "projectOnlineAgentExecution",
+    "registerOnlineAgentExecutionPlan",
     "acquireWriterLease",
+    "bootstrapWriterLease",
+    "renewWriterLease",
     "commitFileGoverned",
     "commitFilesGoverned",
     "getGitOpsJob",
@@ -30,7 +34,14 @@ BRIDGE_OPERATIONS = (
 
 OPERATION_REQUIRED_FIELDS = {
     "createGovernedTask": ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key"),
+    "projectOnlineAgentExecution": ("task_id",),
+    "registerOnlineAgentExecutionPlan": (
+        "schema", "task_id", "job_id", "source_head_oid", "generation",
+        "idempotency_key", "execution",
+    ),
     "acquireWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
+    "bootstrapWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
+    "renewWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
     "commitFileGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "path", "content_base64", "message"),
     "commitFilesGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "files", "message"),
     "getGitOpsJob": ("job_id",),
@@ -46,6 +57,68 @@ OPERATION_REQUIRED_FIELDS = {
     "getControlPlaneSnapshot": (),
 }
 
+BRIDGE_OPERATION_CONTRACTS = {
+    "projectOnlineAgentExecution": {
+        "method": "POST",
+        "path": "/v2/execution-envelope",
+        "required_fields": OPERATION_REQUIRED_FIELDS["projectOnlineAgentExecution"],
+        "response_fields": (
+            "schema", "task_id", "job_id", "repository", "base_oid",
+            "expected_branch_oid", "target_branch", "branch_mode", "generation",
+            "idempotency_key", "action", "execution_digest",
+        ),
+    },
+    "registerOnlineAgentExecutionPlan": {
+        "method": "POST",
+        "path": "/v2/execution-plan",
+        "required_fields": OPERATION_REQUIRED_FIELDS["registerOnlineAgentExecutionPlan"],
+        "response_fields": (
+            "schema", "task_id", "job_id", "source_head_oid", "generation",
+            "idempotency_key", "plan_digest", "execution", "execution_digest",
+        ),
+    },
+    "acquireWriterLease": {
+        "method": "POST",
+        "path": "/v2/writer-lease",
+        "required_fields": OPERATION_REQUIRED_FIELDS["acquireWriterLease"],
+        "response_fields": (
+            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
+            "create_target_branch", "worktree_mode", "cas_ref_update_required",
+        ),
+    },
+    "bootstrapWriterLease": {
+        "method": "POST",
+        "path": "/v2/writer-lease/bootstrap",
+        "required_fields": OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"],
+        "response_fields": (
+            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
+            "create_target_branch", "worktree_mode", "cas_ref_update_required",
+            "recovered", "bootstrapped", "runtime_rehydrated",
+            "durable_branch_lease_present", "idempotent",
+        ),
+    },
+    "renewWriterLease": {
+        "method": "POST",
+        "path": "/v2/writer-lease/renew",
+        "required_fields": OPERATION_REQUIRED_FIELDS["renewWriterLease"],
+        "response_fields": (
+            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
+            "recovered", "bootstrapped", "runtime_rehydrated",
+            "durable_branch_lease_present", "idempotent",
+        ),
+    },
+    "commitFileGoverned": {
+        "method": "POST", "path": "/v2/commit-file",
+        "required_fields": OPERATION_REQUIRED_FIELDS["commitFileGoverned"],
+        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
+    },
+    "commitFilesGoverned": {
+        "method": "POST", "path": "/v2/commit-files",
+        "required_fields": OPERATION_REQUIRED_FIELDS["commitFilesGoverned"],
+        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
+    },
+}
+
 
 class RuntimeDriftError(RuntimeError):
     pass
@@ -122,6 +195,14 @@ class BridgeV2Adapter:
             "legacy_writes_enabled": False,
             "governed_writes_enabled": True,
             "operations": list(BRIDGE_OPERATIONS),
+            "operation_contracts": {
+                operation: {
+                    **contract,
+                    "required_fields": list(contract["required_fields"]),
+                    "response_fields": list(contract["response_fields"]),
+                }
+                for operation, contract in BRIDGE_OPERATION_CONTRACTS.items()
+            },
             "force_push": False,
             "main_write": False,
             "tag_write": False,
@@ -150,7 +231,11 @@ class BridgeV2Adapter:
         return handler(dict(request))
 
     def createGovernedTask(self, request: Mapping[str, Any]) -> Any: return self._call("createGovernedTask", request)
+    def projectOnlineAgentExecution(self, request: Mapping[str, Any]) -> Any: return self._call("projectOnlineAgentExecution", request)
+    def registerOnlineAgentExecutionPlan(self, request: Mapping[str, Any]) -> Any: return self._call("registerOnlineAgentExecutionPlan", request)
     def acquireWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("acquireWriterLease", request)
+    def bootstrapWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("bootstrapWriterLease", request)
+    def renewWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("renewWriterLease", request)
     def commitFileGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFileGoverned", request)
     def commitFilesGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFilesGoverned", request)
     def getGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("getGitOpsJob", request)

active-runtime/app/aios_continuation_executor.py

@@ -51,11 +51,13 @@ class AuthorityPort(Protocol):
     def branch_exists(self, branch: str) -> bool: ...
     def branch_head(self, branch: str) -> str: ...
     def is_ancestor(self, older: str, newer: str) -> bool: ...
+    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str: ...
     def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
 
 
 class RemotePort(Protocol):
     def repository_identity(self) -> str: ...
+    def push_new_exact(self, branch: str, new: str) -> None: ...
     def push_exact(self, branch: str, expected: str, new: str) -> None: ...
     def read_git_ref(self, branch: str) -> str | None: ...
     def read_api_branch(self, branch: str) -> str | None: ...
@@ -103,6 +105,9 @@ class AuthorityGitAdapter:
     def is_ancestor(self, older: str, newer: str) -> bool:
         return self.executor.ancestry_check(older, newer)
 
+    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str:
+        return self.executor.create_task_branch_CAS(self._ref(branch), expected_base, new)
+
     def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str:
         return self.executor.advance_task_branch_CAS(self._ref(branch), expected, new)
 
@@ -152,7 +157,7 @@ class DetachedGitWorkspace:
     def materialize_files(self, files: Mapping[str, bytes]) -> None:
         dirty = self._dirty_paths()
         expected_paths = set(files)
-        if dirty and dirty != expected_paths:
+        if dirty and not dirty.issubset(expected_paths):
             raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
         for relative, content in files.items():
             target = (self.path / relative).resolve()
@@ -258,6 +263,15 @@ class GiteaContinuationRemote:
             raise ContinuationExecutionError("GITEA_GIT_READBACK_INVALID")
         return oid
 
+    def push_new_exact(self, branch: str, new: str) -> None:
+        self._require_projected()
+        self.repository_identity()
+        if self.read_git_ref(branch) is not None:
+            raise ContinuationExecutionError("GITEA_TARGET_BRANCH_ALREADY_EXISTS")
+        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
+        if self.read_git_ref(branch) != new:
+            raise ContinuationExecutionError("GITEA_CREATE_READBACK_MISMATCH")
+
     def push_exact(self, branch: str, expected: str, new: str) -> None:
         self._require_projected()
         self.repository_identity()
@@ -329,6 +343,7 @@ class ContinuationPermissions:
 @dataclass(frozen=True, slots=True)
 class ContinuationRuntimeBinding:
     request: WriterLeaseRequestV2
+    job_id: str
     workspace_path: Path
     lease_not_before: datetime
     lease_expires_at: datetime
@@ -389,13 +404,20 @@ class ContinuationExecutor:
     def observe_generation(self, branch: str, generation: int) -> None:
         self._observed_generations[branch] = max(generation, self._observed_generations.get(branch, 0))
 
-    def _max_generation(self, branch: str) -> int:
+    def _max_generation(self, branch: str, *, exclude_job_id: str | None = None) -> int:
         observed = self._observed_generations.get(branch, 0)
         with self.controller.store._connect() as connection:
+            if exclude_job_id is None:
                 row = connection.execute(
                     "SELECT MAX(generation) AS generation FROM branch_leases WHERE branch=?",
                     (branch,),
                 ).fetchone()
+            else:
+                row = connection.execute(
+                    "SELECT MAX(generation) AS generation FROM branch_leases "
+                    "WHERE branch=? AND job_id!=?",
+                    (branch, exclude_job_id),
+                ).fetchone()
         durable = int(row["generation"] or 0)
         return max(observed, durable)
 
@@ -404,6 +426,7 @@ class ContinuationExecutor:
         return {
             "schema": WriterLeaseRequestV2.schema,
             "task_id": request.task_id,
+            "job_id": request.job_id,
             "repository": request.repository,
             "branch_mode": request.branch_mode,
             "base_oid": request.base_oid,
@@ -413,10 +436,21 @@ class ContinuationExecutor:
             "lease_seconds": request.lease_seconds,
         }
 
-    def _validate_preflight(self, binding: ContinuationRuntimeBinding) -> None:
+    def _validate_preflight(self, binding: ContinuationRuntimeBinding, *, job_id: str | None = None) -> None:
         request = binding.request
-        normalized = validate_writer_lease_request_v2(self._request_mapping(request), self.authority)
-        if normalized != {**self._request_mapping(request), "create_target_branch": False, "worktree_mode": "detached_at_expected_head", "cas_ref_update_required": True}:
+        request_mapping = self._request_mapping(request)
+        normalized = validate_writer_lease_request_v2(request_mapping, self.authority)
+        expected_normalized = {
+            **request_mapping,
+            "create_target_branch": request.branch_mode == "CREATE_NEW",
+            "worktree_mode": (
+                "detached_at_base_oid"
+                if request.branch_mode == "CREATE_NEW"
+                else "detached_at_expected_head"
+            ),
+            "cas_ref_update_required": True,
+        }
+        if normalized != expected_normalized:
             raise ContinuationExecutionError("CONTINUATION_NORMALIZATION_INVALID")
         if not binding.original_receipt_valid or not binding.original_grant_consumed:
             raise ContinuationExecutionError("ORIGINAL_GRANT_LINEAGE_INVALID")
@@ -426,7 +460,7 @@ class ContinuationExecutor:
             raise ContinuationExecutionError("LEASE_NOT_ACTIVE")
         if now >= binding.lease_expires_at:
             raise ContinuationExecutionError("LEASE_EXPIRED")
-        if request.generation <= self._max_generation(request.target_branch):
+        if request.generation <= self._max_generation(request.target_branch, exclude_job_id=job_id):
             raise ContinuationExecutionError("GENERATION_NOT_MONOTONIC")
         if not self.workspace.is_detached():
             raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
@@ -452,57 +486,127 @@ class ContinuationExecutor:
             "generation": request.generation,
         }
 
-    def execute(self, binding: ContinuationRuntimeBinding, commit: ContinuationCommit) -> dict[str, object]:
-        payload = commit.payload()
-        submitted = self.controller.submit(self._job_request(binding, commit, payload), payload=payload)
-        current = self.controller.store.read(submitted.job_id)
-        if JobState(current["state"]) == JobState.COMPLETED:
-            return self.controller.store._receipt(current, duplicate=True).as_dict()
-        self._validate_preflight(binding)
+    def execute(
+        self,
+        binding: ContinuationRuntimeBinding,
+        commit: ContinuationCommit,
+        *,
+        before_complete: Callable[[str], None] | None = None,
+    ) -> dict[str, object]:
+        commit.payload()
+        if not binding.job_id or binding.request.job_id != binding.job_id:
+            raise ContinuationExecutionError("RUNTIME_LINEAGE_MISSING_JOB_ID")
+        current = self.controller.store.read(binding.job_id)
+        current_state = JobState(current["state"])
+        if current_state == JobState.COMPLETED:
+            cycle = self.controller.begin_continuation_cycle(
+                binding.job_id,
+                idempotency_key=commit.idempotency_key,
+                expected_head_oid=binding.request.expected_branch_oid,
+                generation=binding.request.generation,
+                expected_revision=int(current["revision"]),
+            )
+            if cycle.get("completed"):
+                return self.controller.store._receipt(
+                    self.controller.store.read(binding.job_id), duplicate=True
+                ).as_dict()
+            current = self.controller.store.read(binding.job_id)
+            current_state = JobState(current["state"])
+        if current_state == JobState.REMOTE_VERIFIED:
+            receipt = json.loads(str(current["receipt_json"] or "{}"))
+            commit_oid = str(receipt.get("authority_oid") or "")
+            if not OID_RE.fullmatch(commit_oid):
+                raise ContinuationExecutionError("GOVERNED_COMMIT_OID_INVALID")
+            if before_complete is not None:
+                before_complete(commit_oid)
+            result = self.controller.advance(
+                binding.job_id,
+                JobState.COMPLETED,
+                side_effect_state="REMOTE_VERIFIED",
+                receipt=receipt,
+            ).as_dict()
+            self.controller.complete_continuation_cycle(
+                binding.job_id,
+                idempotency_key=commit.idempotency_key,
+                commit_oid=commit_oid,
+            )
+            return result
+        self._validate_preflight(binding, job_id=binding.job_id)
         request = binding.request
         projected = False
         try:
             self.credential.project()
             projected = True
-            row = self.controller.store.read(submitted.job_id)
-            if JobState(row["state"]) == JobState.REQUESTED:
+            row = self.controller.store.read(binding.job_id)
+            state = JobState(row["state"])
+            if state == JobState.REQUESTED:
                 self.controller.advance(
-                    submitted.job_id,
+                    binding.job_id,
                     JobState.AUTHORIZED,
                     side_effect_state="AUTHORIZED",
                     receipt={"task_id": request.task_id, "original_grant_consumed": True},
+                    expected_revision=int(row["revision"]),
                 )
-                row = self.controller.store.read(submitted.job_id)
-            if JobState(row["state"]) == JobState.AUTHORIZED:
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.AUTHORIZED:
                 self.controller.lease_job(
-                    submitted.job_id,
-                    lease_id=f"lease-{submitted.job_id}",
+                    binding.job_id,
+                    lease_id=f"lease-{binding.job_id}",
                     lineage_anchor_oid=request.base_oid,
                     current_head_oid=request.expected_branch_oid,
                     generation=request.generation,
                     lease_expires_at=binding.lease_expires_at.astimezone(timezone.utc).isoformat(),
                     expected_revision=int(row["revision"]),
                 )
-            self.controller.advance(submitted.job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY")
-            self.controller.advance(submitted.job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.LEASED:
+                self.controller.advance(binding.job_id, JobState.WORKTREE_READY,
+                                        side_effect_state="WORKTREE_READY", expected_revision=int(row["revision"]))
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.WORKTREE_READY:
+                self.controller.advance(binding.job_id, JobState.EXECUTING,
+                                        side_effect_state="IN_PROGRESS", expected_revision=int(row["revision"]))
+            elif state != JobState.EXECUTING:
+                raise ContinuationExecutionError("JOB_EXECUTION_STATE_INVALID")
             new_oid = self.workspace.commit_files(commit.files, commit.message)
             if not OID_RE.fullmatch(new_oid) or not self.authority.is_ancestor(request.expected_branch_oid, new_oid):
                 raise ContinuationExecutionError("NON_FAST_FORWARD_COMMIT")
+            if request.branch_mode == "CREATE_NEW":
+                authority_oid = self.authority.create_task_branch_cas(request.target_branch, request.base_oid, new_oid)
+            else:
                 authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
             if authority_oid != new_oid:
                 raise ContinuationExecutionError("AUTHORITY_CAS_READBACK_MISMATCH")
             self.controller.advance(
-                submitted.job_id,
+                binding.job_id,
                 JobState.LOCAL_VERIFIED,
                 side_effect_state="LOCAL_VERIFIED",
                 receipt={"authority_oid": authority_oid, "force_push": False},
             )
             try:
-                self.controller.advance(submitted.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
+                self.controller.advance(binding.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
+                if request.branch_mode == "CREATE_NEW":
+                    self.remote.push_new_exact(request.target_branch, new_oid)
+                else:
                     self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
             except Exception:
-                return self._remote_pending(submitted.job_id, authority_oid, new_oid)
-            return self._finish_remote_verification(submitted.job_id, authority_oid, new_oid)
+                return self._remote_pending(binding.job_id, authority_oid, new_oid)
+            result = self._finish_remote_verification(
+                binding.job_id,
+                authority_oid,
+                new_oid,
+                before_complete=before_complete,
+            )
+            if str(result.get("state") or "") == JobState.COMPLETED.value:
+                self.controller.complete_continuation_cycle(
+                    binding.job_id,
+                    idempotency_key=commit.idempotency_key,
+                    commit_oid=new_oid,
+                )
+            return result
         finally:
             if projected:
                 self.credential.revoke()
@@ -525,7 +629,14 @@ class ContinuationExecutor:
         )
         return result.as_dict()
 
-    def _finish_remote_verification(self, job_id: str, authority_oid: str, new_oid: str) -> dict[str, object]:
+    def _finish_remote_verification(
+        self,
+        job_id: str,
+        authority_oid: str,
+        new_oid: str,
+        *,
+        before_complete: Callable[[str], None] | None = None,
+    ) -> dict[str, object]:
         row = self.controller.store.read(job_id)
         branch = row["branch"]
         request = json.loads(row["request_json"])["binding"]
@@ -542,8 +653,20 @@ class ContinuationExecutor:
             "reconciliation_decision": decision.action.value,
             "force_push": False,
         }
-        self.controller.advance(job_id, JobState.REMOTE_VERIFIED, side_effect_state="REMOTE_VERIFIED", receipt=receipt)
-        return self.controller.advance(job_id, JobState.COMPLETED, side_effect_state="REMOTE_VERIFIED", receipt=receipt).as_dict()
+        self.controller.advance(
+            job_id,
+            JobState.REMOTE_VERIFIED,
+            side_effect_state="REMOTE_VERIFIED",
+            receipt=receipt,
+        )
+        if before_complete is not None:
+            before_complete(new_oid)
+        return self.controller.advance(
+            job_id,
+            JobState.COMPLETED,
+            side_effect_state="REMOTE_VERIFIED",
+            receipt=receipt,
+        ).as_dict()
 
     def reconcile(self, job_id: str) -> dict[str, object]:
         row = self.controller.store.read(job_id)

active-runtime/app/aios_continuation_lease.py

@@ -49,6 +49,7 @@ class WriterLeaseRequestV2:
     target_branch: str
     generation: int
     lease_seconds: int = 900
+    job_id: str = ""
 
     schema = "aios.task-writer-lease.v2"
     accepted_schemas = frozenset({"aios.task-writer-lease.v2", "aios.task-writer-lease-request.v2"})
@@ -56,6 +57,8 @@ class WriterLeaseRequestV2:
     def validate(self, probe: BranchProbe) -> None:
         if not self.task_id or self.repository != "aios/aios":
             raise ContinuationError("request_identity_invalid")
+        if not self.job_id or not self.job_id.startswith("job-"):
+            raise ContinuationError("job_id_invalid")
         if self.branch_mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
             raise ContinuationError("branch_mode_invalid")
         _oid(self.base_oid, "base_oid")

active-runtime/app/aios_gitops_job_controller.py

@@ -27,6 +27,19 @@ class ServiceUnavailable(JobError):
     pass
 
 
+@dataclass(frozen=True, slots=True)
+class LeaseRenewalResult:
+    """Durable outcome of one writer-lease recovery attempt."""
+
+    renewed: bool
+    idempotent: bool
+    durable: bool
+    lease_expires_at: str | None
+
+    def __bool__(self) -> bool:
+        return self.renewed or self.idempotent
+
+
 class BindingConflict(JobError):
     pass
 
@@ -66,6 +79,14 @@ def utc_now() -> str:
     return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
 
 
+def parse_utc(value: str) -> datetime:
+    normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
+    parsed = datetime.fromisoformat(normalized)
+    if parsed.tzinfo is None:
+        raise ValueError("LEASE_EXPIRY_INVALID")
+    return parsed.astimezone(timezone.utc)
+
+
 def canonical_json(value: Any) -> bytes:
     return (
         json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n"
@@ -209,7 +230,15 @@ class JobStore:
                       kind TEXT NOT NULL, digest TEXT NOT NULL, payload_json TEXT NOT NULL,
                       created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
                     );
-                    INSERT OR REPLACE INTO metadata(key, value) VALUES('schema_version', '1');
+                    CREATE TABLE IF NOT EXISTS continuation_cycles (
+                      job_id TEXT NOT NULL, idempotency_key TEXT NOT NULL,
+                      sequence INTEGER NOT NULL, expected_head_oid TEXT NOT NULL,
+                      generation INTEGER NOT NULL, state TEXT NOT NULL,
+                      commit_oid TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+                      PRIMARY KEY(job_id,idempotency_key), UNIQUE(job_id,sequence),
+                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
+                    );
+                    INSERT OR REPLACE INTO metadata(key, value) VALUES('schema_version', '2');
                     """
                 )
         except sqlite3.Error as exc:
@@ -404,13 +433,16 @@ class GitOpsJobController:
         self.store._mirror(result)
         return self.store._receipt(result, duplicate=True)
 
-    def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE") -> None:
+    def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE", lease_expires_at: str | None = None) -> None:
         if len(current_head_oid) != 40 or generation < 1:
             raise JobError("LEASE_BINDING_INVALID")
         try:
             with self.store._connect() as connection:
                 connection.execute("BEGIN IMMEDIATE")
+                if lease_expires_at is None:
                     updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, state, lease_id, expected_revision))
+                else:
+                    updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,lease_expires_at=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, lease_expires_at, state, lease_id, expected_revision))
                 if updated.rowcount != 1:
                     raise JobError("LEASE_REVISION_CAS_CONFLICT")
                 connection.commit()
@@ -419,6 +451,271 @@ class GitOpsJobController:
         except sqlite3.Error as exc:
             raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
 
+    def renew_lease(
+        self,
+        *,
+        branch: str,
+        lineage_anchor_oid: str,
+        current_head_oid: str,
+        generation: int,
+        lease_expires_at: str,
+    ) -> LeaseRenewalResult:
+        if (
+            not branch
+            or len(lineage_anchor_oid) != 40
+            or len(current_head_oid) != 40
+            or generation < 1
+            or not lease_expires_at.strip()
+        ):
+            raise JobError("LEASE_BINDING_INVALID")
+        try:
+            with self.store._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
+                rows = connection.execute(
+                    "SELECT lease_id, revision, generation, state, lease_expires_at "
+                    "FROM branch_leases "
+                    "WHERE branch=? AND lineage_anchor_oid=? AND current_head_oid=? "
+                    "AND generation=? AND state='ACTIVE' ORDER BY revision DESC",
+                    (branch, lineage_anchor_oid, current_head_oid, generation),
+                ).fetchall()
+                if not rows:
+                    connection.commit()
+                    return LeaseRenewalResult(False, False, False, None)
+                if len(rows) != 1:
+                    raise JobError("LEASE_BINDING_CONFLICT")
+                row = rows[0]
+                try:
+                    current_expires_at = parse_utc(str(row["lease_expires_at"]))
+                    requested_expires_at = parse_utc(lease_expires_at)
+                except (TypeError, ValueError) as exc:
+                    raise JobError("LEASE_EXPIRY_INVALID") from exc
+                now = datetime.now(timezone.utc)
+                if requested_expires_at <= now:
+                    raise JobError("LEASE_EXPIRY_INVALID")
+                if current_expires_at > now:
+                    connection.commit()
+                    return LeaseRenewalResult(
+                        False,
+                        True,
+                        True,
+                        str(row["lease_expires_at"]),
+                    )
+                updated = connection.execute(
+                    "UPDATE branch_leases SET lease_expires_at=?,revision=revision+1 "
+                    "WHERE lease_id=? AND revision=? AND generation=? "
+                    "AND state='ACTIVE' AND lease_expires_at=?",
+                    (
+                        lease_expires_at,
+                        row["lease_id"],
+                        int(row["revision"]),
+                        generation,
+                        row["lease_expires_at"],
+                    ),
+                )
+                if updated.rowcount != 1:
+                    current = connection.execute(
+                        "SELECT lease_expires_at, generation, state FROM branch_leases "
+                        "WHERE lease_id=?",
+                        (row["lease_id"],),
+                    ).fetchone()
+                    if (
+                        current is not None
+                        and int(current["generation"]) == generation
+                        and current["state"] == "ACTIVE"
+                        and parse_utc(str(current["lease_expires_at"])) > now
+                    ):
+                        connection.commit()
+                        return LeaseRenewalResult(
+                            False,
+                            True,
+                            True,
+                            str(current["lease_expires_at"]),
+                        )
+                    raise JobError("LEASE_REVISION_CAS_CONFLICT")
+                connection.commit()
+                return LeaseRenewalResult(True, False, True, lease_expires_at)
+        except JobError:
+            raise
+        except sqlite3.Error as exc:
+            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
+
+    def begin_continuation_cycle(
+        self,
+        job_id: str,
+        *,
+        idempotency_key: str,
+        expected_head_oid: str,
+        generation: int,
+        expected_revision: int,
+    ) -> dict[str, Any]:
+        if (
+            not idempotency_key
+            or len(idempotency_key) > 128
+            or not all(character.isalnum() or character in "._:-" for character in idempotency_key)
+            or len(expected_head_oid) != 40
+            or any(character not in "0123456789abcdef" for character in expected_head_oid)
+            or generation < 1
+        ):
+            raise JobError("CONTINUATION_CYCLE_BINDING_INVALID")
+        try:
+            with self.store._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
+                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
+                if row is None:
+                    raise JobError("JOB_NOT_FOUND")
+                existing = connection.execute(
+                    "SELECT * FROM continuation_cycles WHERE job_id=? AND idempotency_key=?",
+                    (job_id, idempotency_key),
+                ).fetchone()
+                if existing is not None:
+                    if str(existing["expected_head_oid"]) != expected_head_oid or int(existing["generation"]) != generation:
+                        raise JobError("CONTINUATION_CYCLE_BINDING_CONFLICT")
+                    if str(existing["state"]) == "COMPLETED":
+                        connection.commit()
+                        return {"completed": True, "commit_oid": str(existing["commit_oid"] or ""), "idempotent": True}
+                    if str(row["state"]) == JobState.COMPLETED.value:
+                        receipt = json.loads(str(row["receipt_json"] or "{}"))
+                        commit_oid = str(receipt.get("authority_oid") or "")
+                        lease = connection.execute(
+                            "SELECT current_head_oid FROM branch_leases WHERE job_id=? AND generation=? AND state='ACTIVE'",
+                            (job_id, generation),
+                        ).fetchall()
+                        if (
+                            len(lease) == 1
+                            and len(commit_oid) == 40
+                            and str(lease[0]["current_head_oid"] or "") == commit_oid
+                            and receipt.get("remote_verified") is True
+                        ):
+                            now = utc_now()
+                            connection.execute(
+                                "UPDATE continuation_cycles SET state='COMPLETED',commit_oid=?,updated_at=? "
+                                "WHERE job_id=? AND idempotency_key=? AND state='ACTIVE'",
+                                (commit_oid, now, job_id, idempotency_key),
+                            )
+                            connection.commit()
+                            return {"completed": True, "commit_oid": commit_oid, "idempotent": True}
+                        raise JobError("CONTINUATION_CYCLE_RECOVERY_REQUIRED")
+                    connection.commit()
+                    return {"completed": False, "commit_oid": None, "idempotent": True}
+                if int(row["revision"]) != expected_revision:
+                    raise JobError("REVISION_CAS_CONFLICT")
+                if str(row["state"]) != JobState.COMPLETED.value:
+                    raise JobError("CONTINUATION_CYCLE_JOB_STATE_INVALID")
+                if str(row["branch"]) in {"main", "master"} or str(row["branch"]).startswith(("refs/", "tags/")):
+                    raise JobError("PROTECTED_BRANCH_REJECTED")
+                receipt = json.loads(str(row["receipt_json"] or "{}"))
+                if receipt.get("remote_verified") is not True or any(
+                    str(receipt.get(field) or "") != expected_head_oid
+                    for field in ("authority_oid", "api_branch_oid", "git_remote_oid")
+                ):
+                    raise JobError("CONTINUATION_CYCLE_RECEIPT_INVALID")
+                leases = connection.execute(
+                    "SELECT * FROM branch_leases WHERE job_id=? AND branch=? AND generation=? AND state='ACTIVE'",
+                    (job_id, str(row["branch"]), generation),
+                ).fetchall()
+                if len(leases) != 1 or str(leases[0]["current_head_oid"] or "") != expected_head_oid:
+                    raise JobError("CONTINUATION_CYCLE_LEASE_INVALID")
+                if connection.execute(
+                    "SELECT 1 FROM continuation_cycles WHERE job_id=? AND state='ACTIVE' LIMIT 1",
+                    (job_id,),
+                ).fetchone() is not None:
+                    raise JobError("CONTINUATION_CYCLE_ACTIVE_CONFLICT")
+                sequence = int(connection.execute(
+                    "SELECT COALESCE(MAX(sequence),0)+1 FROM continuation_cycles WHERE job_id=?",
+                    (job_id,),
+                ).fetchone()[0])
+                now = utc_now()
+                connection.execute(
+                    "INSERT INTO continuation_cycles(job_id,idempotency_key,sequence,expected_head_oid,generation,state,commit_oid,created_at,updated_at) "
+                    "VALUES(?,?,?,?,?,'ACTIVE',NULL,?,?)",
+                    (job_id, idempotency_key, sequence, expected_head_oid, generation, now, now),
+                )
+                next_revision = expected_revision + 1
+                updated = connection.execute(
+                    "UPDATE jobs SET state=?,side_effect_state=?,revision=?,updated_at=? WHERE job_id=? AND revision=?",
+                    (JobState.LEASED.value, "CONTINUATION_LEASED", next_revision, now, job_id, expected_revision),
+                )
+                if updated.rowcount != 1:
+                    raise JobError("REVISION_CAS_CONFLICT")
+                connection.execute(
+                    "INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)",
+                    (job_id, JobState.COMPLETED.value, JobState.LEASED.value, next_revision, "CONTINUATION_LEASED", now),
+                )
+                cycle_receipt = {
+                    "idempotency_key": idempotency_key,
+                    "expected_head_oid": expected_head_oid,
+                    "generation": generation,
+                    "sequence": sequence,
+                }
+                connection.execute(
+                    "INSERT INTO receipts(receipt_id,job_id,kind,digest,payload_json,created_at) VALUES(?,?,?,?,?,?)",
+                    (
+                        f"receipt-{job_id}-{next_revision}",
+                        job_id,
+                        "CONTINUATION_LEASED",
+                        hashlib.sha256(canonical_json(cycle_receipt)).hexdigest(),
+                        json.dumps(cycle_receipt, sort_keys=True),
+                        now,
+                    ),
+                )
+                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
+                connection.commit()
+        except (JobError, BindingConflict):
+            raise
+        except sqlite3.Error as exc:
+            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
+        result["request"] = json.loads(result["request_json"])
+        self.store._mirror(result)
+        return {"completed": False, "commit_oid": None, "idempotent": False}
+
+    def complete_continuation_cycle(self, job_id: str, *, idempotency_key: str, commit_oid: str) -> bool:
+        if len(commit_oid) != 40 or any(character not in "0123456789abcdef" for character in commit_oid):
+            raise JobError("CONTINUATION_CYCLE_COMMIT_OID_INVALID")
+        try:
+            with self.store._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
+                cycle = connection.execute(
+                    "SELECT * FROM continuation_cycles WHERE job_id=? AND idempotency_key=?",
+                    (job_id, idempotency_key),
+                ).fetchone()
+                if cycle is None:
+                    connection.commit()
+                    return False
+                if str(cycle["state"]) == "COMPLETED":
+                    if str(cycle["commit_oid"] or "") != commit_oid:
+                        raise JobError("CONTINUATION_CYCLE_COMMIT_CONFLICT")
+                    connection.commit()
+                    return True
+                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
+                leases = connection.execute(
+                    "SELECT current_head_oid FROM branch_leases WHERE job_id=? AND generation=? AND state='ACTIVE'",
+                    (job_id, int(cycle["generation"])),
+                ).fetchall()
+                receipt = json.loads(str(row["receipt_json"] or "{}")) if row is not None else {}
+                if (
+                    row is None
+                    or str(row["state"]) != JobState.COMPLETED.value
+                    or receipt.get("remote_verified") is not True
+                    or str(receipt.get("authority_oid") or "") != commit_oid
+                    or len(leases) != 1
+                    or str(leases[0]["current_head_oid"] or "") != commit_oid
+                ):
+                    raise JobError("CONTINUATION_CYCLE_COMPLETION_EVIDENCE_INVALID")
+                now = utc_now()
+                updated = connection.execute(
+                    "UPDATE continuation_cycles SET state='COMPLETED',commit_oid=?,updated_at=? "
+                    "WHERE job_id=? AND idempotency_key=? AND state='ACTIVE'",
+                    (commit_oid, now, job_id, idempotency_key),
+                )
+                if updated.rowcount != 1:
+                    raise JobError("CONTINUATION_CYCLE_CAS_CONFLICT")
+                connection.commit()
+                return True
+        except (JobError, BindingConflict):
+            raise
+        except sqlite3.Error as exc:
+            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
+
     def advance(self, job_id: str, state: JobState, *, side_effect_state: str, receipt: Mapping[str, Any] | None = None, expected_revision: int | None = None) -> JobReceipt:
         return self._advance(
             job_id,

active-runtime/app/aios_governed_task_bootstrap.py

@@ -2,6 +2,8 @@
 from __future__ import annotations
 
 from dataclasses import dataclass, asdict
+from contextlib import contextmanager
+import fcntl
 import hashlib
 import json
 from pathlib import Path
@@ -9,6 +11,11 @@ import re
 from typing import Any, Mapping
 
 from aios_gitops_job_controller import GitOpsJobController, JobStore
+from aios_online_agent_execution import (
+    GovernedExecutionBinding,
+    project_execution_envelope,
+    project_online_task,
+)
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
@@ -36,35 +43,161 @@ class GovernedTaskBinding:
         return {"task_id": self.task_id, "repository": self.repository, "base_oid": self.base_oid, "target_branch": self.target_branch, "expected_branch_oid": self.expected_branch_oid, "generation": self.generation, "branch_mode": self.branch_mode, "create_target_branch": self.branch_mode == "CREATE_NEW", "worktree_mode": "detached_at_base_oid" if self.branch_mode == "CREATE_NEW" else "detached_at_expected_head", "cas_ref_update_required": True, "idempotent": idempotent, "state": "BOUND", "job_id": self.job_id}
 
 
-def _safe(value: str) -> str:
+def _legacy_safe(value: str) -> str:
     return re.sub(r"[^A-Za-z0-9_.-]+", "-", value).strip("-")[:120] or "task"
 
 
+def _task_key(value: str) -> str:
+    readable = _legacy_safe(value)[:72]
+    return f"{readable}-{hashlib.sha256(value.encode('utf-8')).hexdigest()[:24]}"
+
+
 class GovernedTaskBootstrap:
     def __init__(self, authority: Any, root: Path, *, remote_name: str, token_path: Path, ssh_key_path: Path, api_base: str = "https://g.cnnetmkt.top/git/api/v1") -> None:
-        self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.task_meta_root.mkdir(parents=True, exist_ok=True); self.job_root.mkdir(parents=True, exist_ok=True)
+        self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.lock_root = self.root / "task-locks"; self.task_meta_root.mkdir(parents=True, exist_ok=True); self.job_root.mkdir(parents=True, exist_ok=True); self.lock_root.mkdir(parents=True, exist_ok=True)
 
     def _store(self, task_id: str) -> tuple[JobStore, GitOpsJobController]:
-        root = self.job_root / _safe(task_id); store = JobStore(root, payload_root=root / "payloads"); return store, GitOpsJobController(store)
+        legacy = self.job_root / _legacy_safe(task_id)
+        keyed = self.job_root / _task_key(task_id)
+        root = legacy if legacy.is_dir() and not keyed.exists() else keyed
+        store = JobStore(root, payload_root=root / "payloads"); return store, GitOpsJobController(store)
 
     def _metadata(self, task_id: str) -> Path:
-        return self.task_meta_root / (_safe(task_id) + ".json")
+        return self.task_meta_root / (_task_key(task_id) + ".json")
+
+    def _legacy_metadata(self, task_id: str) -> Path:
+        return self.task_meta_root / (_legacy_safe(task_id) + ".json")
+
+    @contextmanager
+    def _task_lock(self, task_id: str):
+        path = self.lock_root / (_task_key(task_id) + ".lock")
+        with path.open("a+b") as handle:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+
+    @contextmanager
+    def _branch_lock(self, repository: str, target_branch: str):
+        key = hashlib.sha256((repository + "\0" + target_branch).encode("utf-8")).hexdigest()
+        path = self.lock_root / ("branch-" + key + ".lock")
+        with path.open("a+b") as handle:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
 
     def _read_existing(self, task_id: str) -> GovernedTaskBinding | None:
         path = self._metadata(task_id)
+        if not path.exists():
+            path = self._legacy_metadata(task_id)
         if not path.is_file() or path.is_symlink(): return None
-        return GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
+        binding = GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
+        if binding.task_id != task_id:
+            raise BootstrapError("TASK_BINDING_KEY_COLLISION")
+        return binding
+
+    def get_binding(self, task_id: str) -> GovernedTaskBinding:
+        """Return the exact durable binding; never synthesize missing lineage."""
+        existing = self._read_existing(str(task_id))
+        if existing is None or not existing.job_id:
+            raise BootstrapError("TASK_EXECUTION_PROJECTION_MISSING")
+        return existing
+
+    def execution_binding(self, binding: GovernedTaskBinding) -> GovernedExecutionBinding:
+        expected = binding.expected_branch_oid
+        mode = binding.branch_mode
+        if mode == "CREATE_NEW":
+            current = self.authority.read_ref("refs/heads/" + binding.target_branch)
+            if current is not None:
+                store, _ = self._store(binding.task_id)
+                with store._connect() as connection:
+                    rows = connection.execute(
+                        "SELECT current_head_oid,generation,state,lineage_anchor_oid "
+                        "FROM branch_leases WHERE job_id=? AND branch=? AND state='ACTIVE' "
+                        "ORDER BY revision DESC",
+                        (binding.job_id, binding.target_branch),
+                    ).fetchall()
+                if len(rows) != 1:
+                    raise BootstrapError("SAME_JOB_CONTINUATION_LEASE_INVALID")
+                row = rows[0]
+                if (
+                    str(row["current_head_oid"] or "") != current
+                    or int(row["generation"] or 0) != binding.generation
+                    or str(row["lineage_anchor_oid"] or "") != binding.base_oid
+                ):
+                    raise BootstrapError("SAME_JOB_CONTINUATION_BINDING_INVALID")
+                expected = current
+                mode = "CONTINUE_EXISTING"
+        return GovernedExecutionBinding.from_mapping(
+            {
+                "task_id": binding.task_id,
+                "job_id": binding.job_id,
+                "repository": binding.repository,
+                "base_oid": binding.base_oid,
+                "expected_branch_oid": expected,
+                "target_branch": binding.target_branch,
+                "branch_mode": mode,
+                "generation": binding.generation,
+                "idempotency_key": binding.idempotency_key,
+            }
+        )
+
+    def execution_envelope(
+        self,
+        task_id: str,
+        execution_request: Mapping[str, Any] | None = None,
+        *,
+        required_capabilities: tuple[str, ...] = (),
+        expected_job_id: str | None = None,
+    ) -> dict[str, Any]:
+        binding = self.get_binding(task_id)
+        if expected_job_id and binding.job_id != expected_job_id:
+            raise BootstrapError("JOB_BINDING_CONFLICT")
+        return project_execution_envelope(
+            self.execution_binding(binding),
+            execution_request,
+            required_capabilities=required_capabilities,
+        )
+
+    def online_task_projection(
+        self,
+        task_id: str,
+        task_request: Mapping[str, Any],
+        execution_request: Mapping[str, Any] | None = None,
+        *,
+        expected_job_id: str | None = None,
+    ) -> dict[str, Any]:
+        binding = self.get_binding(task_id)
+        if expected_job_id and binding.job_id != expected_job_id:
+            raise BootstrapError("JOB_BINDING_CONFLICT")
+        return project_online_task(self.execution_binding(binding), task_request, execution_request)
 
     def _write(self, binding: GovernedTaskBinding) -> None:
         path = self._metadata(binding.task_id); temporary = path.with_suffix(".tmp"); temporary.write_text(json.dumps(asdict(binding), sort_keys=True), encoding="utf-8"); temporary.replace(path)
 
     def create(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        task_id = str(request.get("task_id") or "")
+        if not task_id:
+            raise BootstrapError("TASK_BINDING_INVALID")
+        repository = str(request.get("repository") or "")
+        target_branch = str(request.get("target_branch") or "")
+        with self._task_lock(task_id):
+            with self._branch_lock(repository, target_branch):
+                return self._create_locked(request)
+
+    def _create_locked(self, request: Mapping[str, Any]) -> dict[str, Any]:
         values = {key: str(request[key]) for key in ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")}
         if values["repository"] != "aios/aios" or not OID_RE.fullmatch(values["base_oid"]): raise BootstrapError("TASK_BINDING_INVALID")
         if not BRANCH_RE.fullmatch(values["target_branch"]): raise BootstrapError("TARGET_BRANCH_INVALID")
         existing = self._read_existing(values["task_id"])
         if existing is not None:
-            if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description")): raise BootstrapError("TASK_BINDING_CONFLICT")
+            if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")): raise BootstrapError("TASK_BINDING_CONFLICT")
+            optional = {"expected_branch_oid": existing.expected_branch_oid, "branch_mode": existing.branch_mode, "generation": existing.generation}
+            for key, durable in optional.items():
+                if key in request and str(request[key]) != str(durable): raise BootstrapError("TASK_BINDING_CONFLICT")
             return existing.response(idempotent=True)
         if not self.authority.commit_exists(values["base_oid"]): raise BootstrapError("BASE_COMMIT_NOT_FOUND")
         current = self.authority.read_ref("refs/heads/" + values["target_branch"])
@@ -74,8 +207,24 @@ class GovernedTaskBootstrap:
             if expected != values["base_oid"]: raise BootstrapError("EXPECTED_BASE_CONFLICT")
         else:
             if expected != current: raise BootstrapError("EXISTING_BRANCH_OID_CONFLICT")
-            mode, generation = "CONTINUE_EXISTING", int(request.get("generation", 2))
-            if generation < 1: raise BootstrapError("GENERATION_INVALID")
+            parent_task_id = str(request.get("parent_task_id") or "")
+            parent_job_id = str(request.get("parent_job_id") or "")
+            if not parent_task_id or not parent_job_id:
+                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_REQUIRED")
+            parent = self._read_existing(parent_task_id)
+            if parent is None or parent.job_id != parent_job_id or parent.repository != values["repository"] or parent.target_branch != values["target_branch"]:
+                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_CONFLICT")
+            store, _ = self._store(parent_task_id)
+            with store._connect() as connection:
+                rows = connection.execute(
+                    "SELECT current_head_oid,generation,state FROM branch_leases WHERE job_id=? AND branch=? AND state='ACTIVE' ORDER BY revision DESC",
+                    (parent_job_id, values["target_branch"]),
+                ).fetchall()
+            if len(rows) != 1 or str(rows[0]["current_head_oid"] or "") != current:
+                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_CONFLICT")
+            mode, generation = "CONTINUE_EXISTING", int(rows[0]["generation"]) + 1
+            if "generation" in request and int(request["generation"]) != generation:
+                raise BootstrapError("GENERATION_BINDING_CONFLICT")
         payload = json.dumps(values, sort_keys=True, separators=(",", ":")).encode()
         _, controller = self._store(values["task_id"])
         receipt = controller.submit({"idempotency_key": values["idempotency_key"], "campaign_id": values["task_id"], "task_id": values["task_id"], "repository": values["repository"], "operation": "GOVERNED_TASK_CREATE", "branch": values["target_branch"], "expected_branch_oid": expected, "payload_digest": hashlib.sha256(payload).hexdigest(), "lineage_anchor_oid": values["base_oid"]}, payload=payload)

active-runtime/app/aios_isolated_executor.py

@@ -0,0 +1,306 @@
+"""Uncredentialed deterministic executor for governed Online Agent changes.
+
+This process never receives Agent/Owner/Bridge credentials and never writes Git refs.
+It operates only on an exchange bundle and returns hash-bound changed files + test evidence.
+"""
+from __future__ import annotations
+
+import base64
+from dataclasses import dataclass
+import errno
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import socket
+import subprocess
+import tarfile
+import tempfile
+import time
+from typing import Any, Mapping, Sequence
+
+ALLOWED_PROGRAMS = {"/usr/bin/python3", "/usr/bin/git", "/bin/true", "/usr/bin/true"}
+MAX_ARCHIVE_BYTES = 64 * 1024 * 1024
+MAX_FILE_BYTES = 4 * 1024 * 1024
+SECRET_ENV_TOKENS = ("TOKEN", "SECRET", "PASSWORD", "CREDENTIAL", "AUTHORIZATION", "PRIVATE_KEY")
+REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{15,254}$")
+SENSITIVE_VALUE_RE = re.compile(
+    r"(?i)(authorization\s*[:=]\s*bearer\s+\S+|authorization\s+bearer\s+\S+|"
+    r"(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+)"
+)
+
+
+class IsolatedExecutorError(RuntimeError):
+    pass
+
+
+def sha256(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def safe_relative(value: object) -> str:
+    if not isinstance(value, str) or not value or value.startswith("/"):
+        raise IsolatedExecutorError("PATH_INVALID")
+    path = Path(value)
+    if ".." in path.parts or "." in path.parts or any(part in {"", ".git"} for part in path.parts):
+        raise IsolatedExecutorError("PATH_INVALID")
+    return path.as_posix()
+
+
+def resolve_under(root: Path, relative: str) -> Path:
+    root = root.resolve()
+    path = (root / safe_relative(relative)).resolve(strict=False)
+    if path == root or root not in path.parents:
+        raise IsolatedExecutorError("PATH_ESCAPE")
+    return path
+
+
+def _credential_exposure(directory: Path) -> str | None:
+    """Return an exposure code; EACCES is the intended credential isolation proof."""
+    try:
+        if not directory.exists():
+            return None
+        if directory.is_symlink():
+            return "CREDENTIAL_MOUNT_SYMLINK"
+        if os.access(directory, os.R_OK):
+            return "CREDENTIAL_MOUNT_ACCESSIBLE"
+        if directory.is_dir():
+            for child in directory.iterdir():
+                if child.is_file() and os.access(child, os.R_OK):
+                    return "CREDENTIAL_FILE_ACCESSIBLE"
+    except PermissionError:
+        return None
+    return None
+
+
+def assert_uncredentialed() -> None:
+    credentials = Path("/run/credentials")
+    candidates = {credentials}
+    credentials_directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
+    candidates.add(credentials_directory)
+    leaked = sorted(
+        key for key, value in os.environ.items()
+        if value
+        and (any(token in key.upper() for token in SECRET_ENV_TOKENS) or SENSITIVE_VALUE_RE.search(str(value)))
+    )
+    if leaked:
+        raise IsolatedExecutorError("CREDENTIAL_ENV_EXPOSED:" + ",".join(leaked))
+    for directory in candidates:
+        exposure = _credential_exposure(directory)
+        if exposure is not None:
+            raise IsolatedExecutorError(exposure)
+    # In the intended PrivateNetwork namespace host loopback services are unreachable.
+    try:
+        probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    except OSError as exc:
+        if exc.errno in {errno.EACCES, errno.EPERM, errno.EAFNOSUPPORT}:
+            return
+        raise IsolatedExecutorError("NETWORK_ISOLATION_PROBE_FAILED") from exc
+    probe.settimeout(0.15)
+    try:
+        if probe.connect_ex(("127.0.0.1", 18892)) == 0:
+            raise IsolatedExecutorError("GOVERNED_BRIDGE_REACHABLE")
+    finally:
+        probe.close()
+
+
+def extract_source(archive: Path, root: Path) -> None:
+    if archive.is_symlink() or not archive.is_file() or archive.stat().st_size > MAX_ARCHIVE_BYTES:
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_INVALID")
+    with tarfile.open(archive, "r:gz") as tf:
+        for member in tf.getmembers():
+            path = Path(member.name)
+            if path.is_absolute() or ".." in path.parts or ".git" in path.parts:
+                raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
+            if member.issym() or member.islnk():
+                raise IsolatedExecutorError("SOURCE_ARCHIVE_LINK_DENY")
+        tf.extractall(root, filter="data")
+
+
+def run_command(item: Mapping[str, Any], root: Path) -> dict[str, Any]:
+    argv = item.get("argv")
+    if not isinstance(argv, Sequence) or isinstance(argv, (str, bytes)) or not argv:
+        raise IsolatedExecutorError("COMMAND_INVALID")
+    argv = [str(part) for part in argv]
+    if argv[0] not in ALLOWED_PROGRAMS:
+        raise IsolatedExecutorError("COMMAND_PROGRAM_DENY")
+    if argv[0] == "/usr/bin/python3" and "-m" in argv:
+        index = argv.index("-m")
+        if index + 1 >= len(argv) or argv[index + 1] not in {"pytest", "py_compile"}:
+            raise IsolatedExecutorError("PYTHON_MODULE_DENY")
+    if argv[0] == "/usr/bin/git" and any(
+        token in {"push", "update-ref", "commit", "merge", "rebase", "reset", "clean", "branch"}
+        for token in argv[1:]
+    ):
+        raise IsolatedExecutorError("GIT_MUTATION_DENY")
+    timeout = int(item.get("timeout_seconds") or 300)
+    if not 1 <= timeout <= 1800:
+        raise IsolatedExecutorError("COMMAND_TIMEOUT_INVALID")
+    cwd = root if item.get("cwd", ".") == "." else resolve_under(root, str(item.get("cwd")))
+    started = time.monotonic()
+    completed = subprocess.run(
+        argv,
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=timeout,
+        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
+    )
+    result = {
+        "label": str(item.get("label") or "command"),
+        "exit_code": completed.returncode,
+        "stdout_sha256": sha256(completed.stdout.encode("utf-8", "replace")),
+        "stderr_sha256": sha256(completed.stderr.encode("utf-8", "replace")),
+        "duration_ms": int((time.monotonic() - started) * 1000),
+    }
+    if completed.returncode != 0:
+        raise IsolatedExecutorError(
+            "COMMAND_FAILED:" + result["label"] + ":" + str(completed.returncode)
+        )
+    return result
+
+
+def apply_changes(request: Mapping[str, Any], root: Path) -> list[str]:
+    changes = request.get("change_set")
+    if not isinstance(changes, list) or not changes:
+        raise IsolatedExecutorError("CHANGE_SET_INVALID")
+    changed: list[str] = []
+    for change in changes:
+        if not isinstance(change, Mapping):
+            raise IsolatedExecutorError("CHANGE_INVALID")
+        relative = safe_relative(change.get("path"))
+        path = resolve_under(root, relative)
+        current = path.read_bytes() if path.is_file() else None
+        expected = change.get("expected_sha256")
+        if expected is not None and (current is None or sha256(current) != expected):
+            raise IsolatedExecutorError("SOURCE_DRIFT:" + relative)
+        operation = change.get("operation")
+        if operation == "write_file":
+            content = change.get("content")
+            if not isinstance(content, str):
+                raise IsolatedExecutorError("WRITE_CONTENT_INVALID")
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(content, encoding="utf-8")
+        elif operation == "replace_text":
+            if current is None:
+                raise IsolatedExecutorError("REPLACE_SOURCE_MISSING")
+            old = str(change.get("old"))
+            new = str(change.get("new"))
+            count = int(change.get("count", 1))
+            text = current.decode("utf-8")
+            if text.count(old) != count:
+                raise IsolatedExecutorError("REPLACE_COUNT_INVALID:" + relative)
+            path.write_text(text.replace(old, new), encoding="utf-8")
+        elif operation == "delete_file":
+            if path.exists():
+                path.unlink()
+        else:
+            raise IsolatedExecutorError("CHANGE_OPERATION_INVALID")
+        changed.append(relative)
+    return sorted(set(changed))
+
+
+def changed_bundle(root: Path, changed: list[str]) -> list[dict[str, Any]]:
+    files = []
+    for relative in changed:
+        path = resolve_under(root, relative)
+        if path.exists():
+            data = path.read_bytes()
+            if len(data) > MAX_FILE_BYTES:
+                raise IsolatedExecutorError("CHANGED_FILE_TOO_LARGE:" + relative)
+            files.append({
+                "path": relative,
+                "deleted": False,
+                "sha256": sha256(data),
+                "content_b64": base64.b64encode(data).decode("ascii"),
+            })
+        else:
+            files.append({"path": relative, "deleted": True, "sha256": None, "content_b64": None})
+    return files
+
+
+def execute_request(request_path: Path, result_path: Path) -> None:
+    assert_uncredentialed()
+    request = json.loads(request_path.read_text(encoding="utf-8"))
+    if request.get("schema") != "aios.isolated-execution.request.v1":
+        raise IsolatedExecutorError("REQUEST_SCHEMA_INVALID")
+    request_id = request.get("request_id")
+    if not isinstance(request_id, str) or not REQUEST_ID_RE.fullmatch(request_id):
+        raise IsolatedExecutorError("REQUEST_ID_INVALID")
+    source_archive = Path(str(request.get("source_archive") or ""))
+    if not source_archive.is_absolute():
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
+    expected_archive_sha = str(request.get("source_archive_sha256") or "")
+    if sha256(source_archive.read_bytes()) != expected_archive_sha:
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_SHA_MISMATCH")
+    with tempfile.TemporaryDirectory(prefix="aios-isolated-executor-") as temporary:
+        root = Path(temporary) / "workspace"
+        root.mkdir()
+        extract_source(source_archive, root)
+        changed = apply_changes(request, root)
+        commands = [
+            run_command(item, root)
+            for item in request.get("verification", [])
+            if isinstance(item, Mapping)
+        ]
+        result = {
+            "schema": "aios.isolated-execution.result.v1",
+            "request_id": request_id,
+            "request_sha256": sha256(canonical(request)),
+            "changed_files": changed_bundle(root, changed),
+            "verification": commands,
+            "credential_isolation": {
+                "credential_env_absent": True,
+                "credential_mount_inaccessible": True,
+                "governed_bridge_unreachable": True,
+            },
+        }
+        result["result_sha256"] = sha256(canonical(result))
+        temporary_result = result_path.with_suffix(".tmp")
+        temporary_result.write_text(json.dumps(result, sort_keys=True, separators=(",", ":")), encoding="utf-8")
+        os.replace(temporary_result, result_path)
+
+
+def serve(root: Path) -> None:
+    assert_uncredentialed()
+    requests = root / "requests"
+    results = root / "results"
+    failed = root / "failed"
+    for path in (requests, results, failed):
+        path.mkdir(parents=True, exist_ok=True)
+    while True:
+        for request in sorted(requests.glob("*.json")):
+            if request.is_symlink():
+                continue
+            result = results / request.name
+            try:
+                execute_request(request, result)
+                request.unlink()
+            except Exception as exc:
+                (failed / request.name).write_text(
+                    json.dumps({"error": str(exc) or type(exc).__name__}, sort_keys=True),
+                    encoding="utf-8",
+                )
+                request.unlink(missing_ok=True)
+        time.sleep(0.5)
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--root", default="/var/lib/aios-online-agent-executor")
+    parser.add_argument("--request")
+    parser.add_argument("--result")
+    args = parser.parse_args()
+    if args.request and args.result:
+        execute_request(Path(args.request), Path(args.result))
+    else:
+        serve(Path(args.root))

active-runtime/app/aios_online_agent_execution.py

@@ -0,0 +1,397 @@
+"""Canonical governed execution projection for Online Agent Tasks.
+
+The durable governed binding is authoritative.  Natural-language task fields and
+worker configuration are never allowed to invent repository, ref, generation, or
+idempotency coordinates.
+"""
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass
+import hashlib
+import json
+import re
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+import urllib.error
+import urllib.request
+
+
+EXECUTION_SCHEMA = "aios.online-agent.execution.v2"
+PROJECTION_SCHEMA = "aios.online-agent.task-projection.v1"
+OID_RE = re.compile(r"^[0-9a-f]{40}$")
+TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
+BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
+KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
+PROTECTED_PREFIXES = ("main", "master", "refs/", "tags/", "tag/", "release/", "baseline/", "production/")
+MUTATION_ACTIONS = frozenset({"deterministic"})
+SUPPORTED_ACTIONS = frozenset({"deterministic", "source_capture"})
+
+
+class ExecutionProjectionError(RuntimeError):
+    """A canonical fail-closed projection or validation error."""
+
+
+class OnlineTaskProjectionClient:
+    """Official HTTP projection client using only a control credential reference."""
+
+    def __init__(self, api_base: str, control_token_path: Path) -> None:
+        self.api_base = api_base.rstrip("/")
+        self.control_token_path = Path(control_token_path)
+
+    def _token(self) -> str:
+        path = self.control_token_path
+        if path.is_symlink() or not path.is_file():
+            _error("ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE")
+        value = path.read_text(encoding="utf-8").strip()
+        if len(value) < 32:
+            _error("ONLINE_TASK_PROJECTION_CONTROL_INVALID")
+        return value
+
+    def create(
+        self,
+        projected_task: Mapping[str, Any],
+        *,
+        binding: "GovernedExecutionBinding",
+    ) -> dict[str, Any]:
+        body = dict(projected_task)
+        payload = _canonical(body).encode("utf-8")
+        request = urllib.request.Request(
+            self.api_base + "/v1/tasks",
+            method="POST",
+            data=payload,
+            headers={
+                "Authorization": "Bearer " + self._token(),
+                "Content-Type": "application/json",
+                "Accept": "application/json",
+            },
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=15) as response:
+                result = json.loads(response.read().decode("utf-8"))
+                status = response.status
+        except urllib.error.HTTPError as exc:
+            raw = exc.read(8192).decode("utf-8", "replace")
+            try:
+                error = json.loads(raw).get("error")
+            except (AttributeError, json.JSONDecodeError):
+                error = "HTTP_ERROR"
+            raise ExecutionProjectionError(f"ONLINE_TASK_PROJECTION_FAILED:{exc.code}:{error}") from exc
+        except (OSError, urllib.error.URLError, TimeoutError) as exc:
+            raise ExecutionProjectionError("ONLINE_TASK_PROJECTION_UNAVAILABLE") from exc
+        if status not in {200, 201} or not isinstance(result, dict):
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
+        if result.get("task_id") != binding.task_id or result.get("status") not in {"QUEUED", "VERIFYING", "SUCCEEDED"}:
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
+        metadata = result.get("metadata")
+        if not isinstance(metadata, Mapping):
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
+        returned_execution = validate_execution_envelope(
+            _object(metadata.get("execution"), "ONLINE_TASK_PROJECTION_RESPONSE_INVALID"),
+            binding=binding,
+        )
+        submitted_metadata = _object(body.get("metadata"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID")
+        submitted_execution = validate_execution_envelope(
+            _object(submitted_metadata.get("execution"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID"),
+            binding=binding,
+        )
+        if _canonical(returned_execution) != _canonical(submitted_execution):
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_BINDING_INVALID")
+        return result
+
+
+def _error(code: str) -> None:
+    raise ExecutionProjectionError(code)
+
+
+def _object(value: object, code: str) -> dict[str, Any]:
+    if not isinstance(value, Mapping):
+        _error(code)
+    return dict(value)
+
+
+def _string(value: object, code: str) -> str:
+    if not isinstance(value, str) or not value.strip():
+        _error(code)
+    return value.strip()
+
+
+def _task_id(value: object) -> str:
+    value = _string(value, "TASK_ID_INVALID")
+    if TASK_RE.fullmatch(value) is None:
+        _error("TASK_ID_INVALID")
+    return value
+
+
+def _oid(value: object, code: str) -> str:
+    value = _string(value, code)
+    if OID_RE.fullmatch(value) is None:
+        _error(code)
+    return value
+
+
+def _branch(value: object) -> str:
+    value = _string(value, "TARGET_BRANCH_INVALID")
+    if BRANCH_RE.fullmatch(value) is None or value.startswith(PROTECTED_PREFIXES):
+        _error("TARGET_BRANCH_INVALID")
+    return value
+
+
+def _generation(value: object) -> int:
+    if not isinstance(value, int) or isinstance(value, bool) or value < 1:
+        _error("GENERATION_INVALID")
+    return value
+
+
+def _canonical(value: object) -> str:
+    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+
+
+def _digest(value: object) -> str:
+    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
+
+
+def _source_signals(value: object) -> tuple[str, ...]:
+    """Normalize untrusted natural-language hints before they enter a signed envelope."""
+    if value is None:
+        return ()
+    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
+        _error("SOURCE_CAPTURE_SIGNALS_INVALID")
+    result: list[str] = []
+    for item in value:
+        if not isinstance(item, str):
+            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
+        text = " ".join(item.split()).strip()
+        if not text:
+            continue
+        # Projection may accept long task prose, but execution envelopes stay bounded.
+        text = text[:512].rstrip()
+        if text not in result:
+            result.append(text)
+        if len(result) == 16:
+            break
+    return tuple(result)
+
+
+def _capabilities(value: object) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
+        _error("CAPABILITY_SCOPE_INVALID")
+    result = tuple(sorted({_string(item, "CAPABILITY_SCOPE_INVALID") for item in value}))
+    if any(len(item) > 120 for item in result):
+        _error("CAPABILITY_SCOPE_INVALID")
+    return result
+
+
+@dataclass(frozen=True, slots=True)
+class GovernedExecutionBinding:
+    task_id: str
+    job_id: str
+    repository: str
+    base_oid: str
+    expected_branch_oid: str
+    target_branch: str
+    branch_mode: str
+    generation: int
+    idempotency_key: str
+
+    @classmethod
+    def from_mapping(cls, value: Mapping[str, Any]) -> "GovernedExecutionBinding":
+        data = dict(value)
+        task_id = _task_id(data.get("task_id"))
+        job_id = _string(data.get("job_id"), "JOB_ID_REQUIRED")
+        if TASK_RE.fullmatch(job_id) is None:
+            _error("JOB_ID_INVALID")
+        repository = _string(data.get("repository"), "REPOSITORY_INVALID")
+        if repository != "aios/aios":
+            _error("WRONG_REPOSITORY_ENVELOPE_DENY")
+        base_oid = _oid(data.get("base_oid"), "BASE_OID_INVALID")
+        expected = _oid(data.get("expected_branch_oid"), "EXPECTED_BRANCH_OID_INVALID")
+        target = _branch(data.get("target_branch"))
+        mode = _string(data.get("branch_mode"), "BRANCH_MODE_MISSING")
+        if mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
+            _error("BRANCH_MODE_INVALID")
+        generation = _generation(data.get("generation"))
+        if mode == "CREATE_NEW" and expected != base_oid:
+            _error("EXPECTED_BASE_CONFLICT")
+        key = _string(data.get("idempotency_key"), "IDEMPOTENCY_KEY_INVALID")
+        if KEY_RE.fullmatch(key) is None:
+            _error("IDEMPOTENCY_KEY_INVALID")
+        return cls(task_id, job_id, repository, base_oid, expected, target, mode, generation, key)
+
+    def public(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+def binding_from_bootstrap(value: Mapping[str, Any]) -> GovernedExecutionBinding:
+    return GovernedExecutionBinding.from_mapping(value)
+
+
+def validate_execution_envelope(
+    value: Mapping[str, Any],
+    *,
+    binding: GovernedExecutionBinding | None = None,
+    worker_capabilities: Sequence[str] | None = None,
+) -> dict[str, Any]:
+    envelope = dict(value)
+    if envelope.get("schema") != EXECUTION_SCHEMA:
+        _error("EXECUTION_ENVELOPE_SCHEMA_VALIDATION")
+    candidate = GovernedExecutionBinding.from_mapping(envelope)
+    if binding is not None and candidate != binding:
+        comparisons = (
+            (candidate.task_id, binding.task_id, "TASK_BINDING_CONFLICT"),
+            (candidate.job_id, binding.job_id, "JOB_BINDING_CONFLICT"),
+            (candidate.repository, binding.repository, "WRONG_REPOSITORY_ENVELOPE_DENY"),
+            (candidate.base_oid, binding.base_oid, "WRONG_BASE_ENVELOPE_DENY"),
+            (candidate.expected_branch_oid, binding.expected_branch_oid, "WRONG_EXPECTED_HEAD_ENVELOPE_DENY"),
+            (candidate.target_branch, binding.target_branch, "WRONG_BRANCH_ENVELOPE_DENY"),
+            (candidate.generation, binding.generation, "WRONG_GENERATION_ENVELOPE_DENY"),
+            (candidate.branch_mode, binding.branch_mode, "BRANCH_MODE_BINDING_CONFLICT"),
+            (candidate.idempotency_key, binding.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
+        )
+        for actual, expected, code in comparisons:
+            if actual != expected:
+                _error(code)
+    action = _string(envelope.get("action"), "EXECUTION_ACTION_MISSING")
+    if action not in SUPPORTED_ACTIONS:
+        _error("EXECUTION_ACTION_UNSUPPORTED")
+    capability_scope = _capabilities(envelope.get("capability_scope"))
+    if worker_capabilities is not None and not set(capability_scope).issubset(set(worker_capabilities)):
+        _error("CAPABILITY_MISMATCH_DENY")
+    workspace = _object(envelope.get("workspace"), "WORKSPACE_POLICY_REQUIRED")
+    if workspace.get("authority_git_dir") != "/data/aios-gitops/repo.git" or workspace.get("read_only_repository") is not True:
+        _error("WORKSPACE_POLICY_DENY")
+    governance = _object(envelope.get("governance"), "GOVERNANCE_POLICY_REQUIRED")
+    governed_coordinates = (
+        (governance.get("task_id"), candidate.task_id, "TASK_BINDING_CONFLICT"),
+        (governance.get("job_id"), candidate.job_id, "JOB_BINDING_CONFLICT"),
+        (governance.get("idempotency_key"), candidate.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
+    )
+    for actual_coordinate, expected_coordinate, code in governed_coordinates:
+        if actual_coordinate != expected_coordinate:
+            _error(code)
+    commit_key = _string(governance.get("commit_idempotency_key"), "COMMIT_IDEMPOTENCY_KEY_INVALID")
+    if KEY_RE.fullmatch(commit_key) is None:
+        _error("COMMIT_IDEMPOTENCY_KEY_INVALID")
+    if governance.get("writer_lease") is not (action in MUTATION_ACTIONS):
+        _error("WRITER_LEASE_POLICY_DENY")
+    for field in ("main_write", "production_write", "tag_write", "baseline_write", "force_push", "protected_ref_bypass"):
+        if governance.get(field, False) is not False:
+            _error("POLICY_DENY")
+    changes = envelope.get("change_set")
+    verification = envelope.get("verification")
+    if not isinstance(changes, list) or not isinstance(verification, list):
+        _error("EXECUTION_OPERATIONS_INVALID")
+    if action == "source_capture":
+        if changes or verification:
+            _error("SOURCE_CAPTURE_MUTATION_DENY")
+        signals = list(_source_signals(envelope.get("source_signals") or []))
+        if envelope.get("source_signals") != signals:
+            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
+    elif not changes:
+        _error("CHANGE_SET_INVALID")
+    declared = str(envelope.get("execution_digest") or "")
+    material = {key: item for key, item in envelope.items() if key != "execution_digest"}
+    actual = _digest(material)
+    if declared != actual:
+        _error("EXECUTION_DIGEST_INVALID")
+    return {**material, "execution_digest": actual}
+
+
+def project_execution_envelope(
+    binding: GovernedExecutionBinding,
+    execution_request: Mapping[str, Any] | None = None,
+    *,
+    required_capabilities: Sequence[str] = (),
+) -> dict[str, Any]:
+    request = dict(execution_request or {})
+    action = str(request.get("action") or "source_capture")
+    if action not in SUPPORTED_ACTIONS:
+        _error("EXECUTION_ACTION_UNSUPPORTED")
+    capabilities = _capabilities(request.get("capability_scope", required_capabilities))
+    governance = {
+        "task_id": binding.task_id,
+        "job_id": binding.job_id,
+        "idempotency_key": binding.idempotency_key,
+        "commit_idempotency_key": str(request.get("commit_idempotency_key") or f"{binding.task_id}-commit-g{binding.generation}"),
+        "writer_lease": action in MUTATION_ACTIONS,
+        "main_write": False,
+        "production_write": False,
+        "tag_write": False,
+        "baseline_write": False,
+        "force_push": False,
+        "protected_ref_bypass": False,
+    }
+    supplied_governance = request.get("governance")
+    if supplied_governance is not None:
+        governance.update(_object(supplied_governance, "GOVERNANCE_POLICY_REQUIRED"))
+    material: dict[str, Any] = {
+        "schema": EXECUTION_SCHEMA,
+        **binding.public(),
+        "action": action,
+        "adapter": str(request.get("adapter") or ("deterministic" if action == "deterministic" else "source_capture")),
+        "capability_scope": list(capabilities),
+        "change_set": list(request.get("change_set") or []),
+        "verification": list(request.get("verification") or []),
+        "source_signals": list(_source_signals(request.get("source_signals") or [])) if action == "source_capture" else [],
+        "governance": governance,
+        "workspace": {
+            "authority_git_dir": "/data/aios-gitops/repo.git",
+            "read_only_repository": True,
+            "cleanup_policy": "always",
+        },
+    }
+    envelope = {**material, "execution_digest": _digest(material)}
+    return validate_execution_envelope(envelope, binding=binding)
+
+
+def project_online_task(
+    binding: GovernedExecutionBinding,
+    task_request: Mapping[str, Any],
+    execution_request: Mapping[str, Any] | None = None,
+) -> dict[str, Any]:
+    request = dict(task_request)
+    required = _capabilities(request.get("required_capabilities"))
+    execution = project_execution_envelope(binding, execution_request, required_capabilities=required)
+    metadata = dict(request.get("metadata") or {})
+    if "execution" in metadata:
+        validate_execution_envelope(_object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"), binding=binding)
+        if metadata["execution"] != execution:
+            _error("EXECUTION_PROJECTION_CONFLICT")
+    metadata["execution"] = execution
+    metadata["execution_projection"] = {
+        "schema": PROJECTION_SCHEMA,
+        "task_id": binding.task_id,
+        "job_id": binding.job_id,
+        "execution_digest": execution["execution_digest"],
+    }
+    return {
+        **request,
+        "task_id": binding.task_id,
+        "metadata": metadata,
+        "required_capabilities": list(required),
+        "idempotency_key": str(request.get("idempotency_key") or f"online-task:{binding.idempotency_key}"),
+    }
+
+
+def resolve_task_execution(
+    task: Mapping[str, Any],
+    binding: GovernedExecutionBinding,
+    *,
+    worker_capabilities: Sequence[str] | None = None,
+) -> tuple[dict[str, Any], str]:
+    metadata = task.get("metadata")
+    if isinstance(metadata, Mapping) and "execution" in metadata:
+        value = validate_execution_envelope(
+            _object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"),
+            binding=binding,
+            worker_capabilities=worker_capabilities,
+        )
+        return value, "persisted"
+    projected = project_execution_envelope(
+        binding,
+        {"action": "source_capture", "capability_scope": task.get("required_capabilities") or []},
+        required_capabilities=task.get("required_capabilities") or [],
+    )
+    validate_execution_envelope(projected, binding=binding, worker_capabilities=worker_capabilities)
+    return projected, "recovered_projection"

active-runtime/app/aios_online_agent_plan_store.py

@@ -0,0 +1,187 @@
+"""Durable, authority-bound deterministic execution plans for Online Agent Tasks."""
+from __future__ import annotations
+
+from contextlib import contextmanager
+from dataclasses import dataclass
+import fcntl
+import hashlib
+import json
+from pathlib import Path
+from typing import Any, Mapping
+
+from aios_online_agent_execution import (
+    GovernedExecutionBinding,
+    project_execution_envelope,
+)
+
+
+class ExecutionPlanError(RuntimeError):
+    pass
+
+
+def _canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def _digest(value: object) -> str:
+    return hashlib.sha256(_canonical(value)).hexdigest()
+
+
+def _task_key(task_id: str) -> str:
+    readable = "".join(ch if ch.isalnum() or ch in "._-" else "-" for ch in task_id).strip("-")[:72] or "task"
+    return readable + "-" + hashlib.sha256(task_id.encode("utf-8")).hexdigest()[:24]
+
+
+@dataclass(frozen=True)
+class ExecutionPlanRecord:
+    task_id: str
+    job_id: str
+    source_head_oid: str
+    generation: int
+    idempotency_key: str
+    plan_digest: str
+    execution: dict[str, Any]
+
+    def public(self) -> dict[str, Any]:
+        return {
+            "schema": "aios.online-agent.plan-record.v1",
+            "task_id": self.task_id,
+            "job_id": self.job_id,
+            "source_head_oid": self.source_head_oid,
+            "generation": self.generation,
+            "idempotency_key": self.idempotency_key,
+            "plan_digest": self.plan_digest,
+            "execution": dict(self.execution),
+        }
+
+
+class ExecutionPlanStore:
+    def __init__(self, root: Path) -> None:
+        self.root = Path(root)
+        self.root.mkdir(parents=True, exist_ok=True)
+
+    def _path(self, task_id: str) -> Path:
+        return self.root / (_task_key(task_id) + ".json")
+
+    @contextmanager
+    def _lock(self, task_id: str):
+        path = self.root / (_task_key(task_id) + ".lock")
+        with path.open("a+b") as handle:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+
+    @staticmethod
+    def _source_head(binding: GovernedExecutionBinding) -> str:
+        return binding.expected_branch_oid if binding.branch_mode == "CONTINUE_EXISTING" else binding.base_oid
+
+    def _read(self, task_id: str) -> ExecutionPlanRecord | None:
+        path = self._path(task_id)
+        if not path.is_file() or path.is_symlink():
+            return None
+        value = json.loads(path.read_text(encoding="utf-8"))
+        if not isinstance(value, Mapping) or value.get("schema") != "aios.online-agent.plan-record.v1":
+            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
+        execution = value.get("execution")
+        if not isinstance(execution, Mapping):
+            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
+        return ExecutionPlanRecord(
+            task_id=str(value.get("task_id") or ""),
+            job_id=str(value.get("job_id") or ""),
+            source_head_oid=str(value.get("source_head_oid") or ""),
+            generation=int(value.get("generation") or 0),
+            idempotency_key=str(value.get("idempotency_key") or ""),
+            plan_digest=str(value.get("plan_digest") or ""),
+            execution=dict(execution),
+        )
+
+    def register(
+        self,
+        binding: GovernedExecutionBinding,
+        request: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        with self._lock(binding.task_id):
+            return self._register_locked(binding, request)
+
+    def _register_locked(
+        self,
+        binding: GovernedExecutionBinding,
+        request: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        if request.get("schema") != "aios.online-agent.plan.v1":
+            raise ExecutionPlanError("EXECUTION_PLAN_SCHEMA_INVALID")
+        if request.get("task_id") != binding.task_id or request.get("job_id") != binding.job_id:
+            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
+        if int(request.get("generation") or 0) != binding.generation:
+            raise ExecutionPlanError("EXECUTION_PLAN_GENERATION_CONFLICT")
+        source_head = str(request.get("source_head_oid") or "")
+        if source_head != self._source_head(binding):
+            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_CONFLICT")
+        key = str(request.get("idempotency_key") or "")
+        if len(key) < 8:
+            raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_INVALID")
+        execution_request = request.get("execution")
+        if not isinstance(execution_request, Mapping) or execution_request.get("action") != "deterministic":
+            raise ExecutionPlanError("EXECUTION_PLAN_DETERMINISTIC_REQUIRED")
+        envelope = project_execution_envelope(binding, execution_request)
+        material = {
+            "task_id": binding.task_id,
+            "job_id": binding.job_id,
+            "source_head_oid": source_head,
+            "generation": binding.generation,
+            "idempotency_key": key,
+            "execution": dict(execution_request),
+        }
+        plan_digest = _digest(material)
+        existing = self._read(binding.task_id)
+        expected_previous = request.get("expected_previous_plan_digest")
+        if existing is not None:
+            if existing.idempotency_key == key:
+                if existing.plan_digest != plan_digest:
+                    raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_CONFLICT")
+                return {**existing.public(), "idempotent": True, "execution_digest": envelope["execution_digest"]}
+            if expected_previous != existing.plan_digest:
+                raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
+            if existing.source_head_oid != source_head:
+                raise ExecutionPlanError("EXECUTION_PLAN_STALE_REPLACEMENT_DENY")
+        elif expected_previous not in (None, ""):
+            raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
+
+        record = ExecutionPlanRecord(
+            task_id=binding.task_id,
+            job_id=binding.job_id,
+            source_head_oid=source_head,
+            generation=binding.generation,
+            idempotency_key=key,
+            plan_digest=plan_digest,
+            execution=dict(execution_request),
+        )
+        path = self._path(binding.task_id)
+        temporary = path.with_suffix(".tmp")
+        temporary.write_text(
+            json.dumps(record.public(), sort_keys=True, separators=(",", ":")),
+            encoding="utf-8",
+        )
+        temporary.replace(path)
+        return {**record.public(), "idempotent": False, "execution_digest": envelope["execution_digest"]}
+
+    def resolve(self, binding: GovernedExecutionBinding) -> dict[str, Any] | None:
+        record = self._read(binding.task_id)
+        if record is None:
+            return None
+        if (
+            record.task_id != binding.task_id
+            or record.job_id != binding.job_id
+            or record.generation != binding.generation
+        ):
+            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
+        if record.source_head_oid != self._source_head(binding):
+            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_DRIFT")
+        envelope = project_execution_envelope(binding, record.execution)
+        return {
+            "execution": dict(record.execution),
+            "plan_digest": record.plan_digest,
+            "execution_digest": envelope["execution_digest"],
+        }

active-runtime/app/aios_online_agent_worker.py

@@ -18,6 +18,8 @@ from dataclasses import dataclass
 from datetime import datetime, timezone
 from abc import ABC, abstractmethod
 import hashlib
+import secrets
+import io
 import json
 import os
 from pathlib import Path
@@ -25,13 +27,19 @@ import re
 import shutil
 import subprocess
 import tempfile
+import tarfile
 import threading
 import time
 import urllib.error
 import urllib.request
-from typing import Any, Mapping
+from typing import Any, Mapping, Sequence
 from urllib.parse import unquote
 
+from aios_online_agent_execution import (
+    ExecutionProjectionError,
+    validate_execution_envelope,
+)
+
 
 API_BASE = os.environ.get("AIOS_AGENT_TASK_API_URL", "http://127.0.0.1:18940").rstrip("/")
 BRIDGE_BASE = os.environ.get("AIOS_GOVERNED_WRITE_API_URL", "http://127.0.0.1:18892").rstrip("/")
@@ -55,11 +63,32 @@ GIT_CONFIG_GLOBAL = STATE_ROOT / "gitconfig"
 POLL_SECONDS = int(os.environ.get("AIOS_WORKER_POLL_SECONDS", "5"))
 HEARTBEAT_SECONDS = int(os.environ.get("AIOS_WORKER_HEARTBEAT_SECONDS", "20"))
 LEASE_SECONDS = int(os.environ.get("AIOS_WORKER_LEASE_SECONDS", "300"))
+WORKER_CAPABILITIES = tuple(
+    sorted(
+        item.strip()
+        for item in os.environ.get(
+            "AIOS_WORKER_CAPABILITIES",
+            "git.read,git.test,governed.write.branch,governed.write.file",
+        ).split(",")
+        if item.strip()
+    )
+)
 MAX_TASK_BYTES = 512 * 1024
 MAX_FILE_BYTES = 2 * 1024 * 1024
+ISOLATED_EXECUTOR_ROOT = Path(
+    os.environ.get("AIOS_ISOLATED_EXECUTOR_ROOT", "/var/lib/aios-online-agent-executor")
+)
+ISOLATED_EXECUTOR_TIMEOUT_SECONDS = int(
+    os.environ.get("AIOS_ISOLATED_EXECUTOR_TIMEOUT_SECONDS", "1800")
+)
+ISOLATED_EXECUTOR_TIMEOUT_HARD_MAX_SECONDS = 7200
+GIT_VISIBILITY_TIMEOUT_SECONDS = int(
+    os.environ.get("AIOS_GIT_VISIBILITY_TIMEOUT_SECONDS", "45")
+)
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
 ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
+REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{15,254}$")
 BRANCH_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]*$")
 PATH_RE = re.compile(r"^[^\\\x00-\x1f\x7f]+$")
 SENSITIVE_RE = re.compile(
@@ -75,6 +104,33 @@ class WorkerError(RuntimeError):
         self.details = dict(details or {})
 
 
+def _isolated_executor_wait_seconds(verification: Sequence[Mapping[str, Any]]) -> int:
+    verification_budget = sum(int(item["timeout_seconds"]) for item in verification)
+    required_wait_seconds = max(30, verification_budget + 30)
+    if not 30 <= ISOLATED_EXECUTOR_TIMEOUT_SECONDS <= ISOLATED_EXECUTOR_TIMEOUT_HARD_MAX_SECONDS:
+        raise WorkerError("ISOLATED_EXECUTOR_TIMEOUT_CONFIG_INVALID", phase="adapter")
+    if required_wait_seconds > ISOLATED_EXECUTOR_TIMEOUT_SECONDS:
+        raise WorkerError(
+            "ISOLATED_EXECUTOR_TIMEOUT_BUDGET_EXCEEDED",
+            phase="adapter",
+            details={
+                "required_seconds": required_wait_seconds,
+                "configured_seconds": ISOLATED_EXECUTOR_TIMEOUT_SECONDS,
+            },
+        )
+    return required_wait_seconds
+
+
+def _claim_order(item: tuple[Mapping[str, Any], "ExecutionEnvelope"]) -> tuple[int, int, str, str]:
+    task, envelope = item
+    try:
+        priority = int(task.get("priority") or 0)
+    except (TypeError, ValueError):
+        priority = 0
+    action_rank = 0 if envelope.action == "deterministic" else 1
+    return (-priority, action_rank, str(task.get("created_at") or ""), envelope.task_id)
+
+
 def now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
@@ -276,10 +332,18 @@ def run_command(
 @dataclass(frozen=True)
 class ExecutionEnvelope:
     task_id: str
+    job_id: str
     repository: str
     base_oid: str
+    expected_branch_oid: str
     target_branch: str
+    branch_mode: str
+    generation: int
+    idempotency_key: str
+    action: str
     adapter: str
+    capability_scope: tuple[str, ...]
+    source_signals: tuple[str, ...]
     change_set: tuple[dict[str, Any], ...]
     verification: tuple[dict[str, Any], ...]
     governance: dict[str, Any]
@@ -287,18 +351,28 @@ class ExecutionEnvelope:
     digest: str
 
     @classmethod
-    def from_task(cls, task: Mapping[str, Any]) -> "ExecutionEnvelope":
+    def from_task(
+        cls,
+        task: Mapping[str, Any],
+        execution_override: Mapping[str, Any] | None = None,
+        worker_capabilities: tuple[str, ...] | None = None,
+    ) -> "ExecutionEnvelope":
         task_id = str(task.get("task_id") or "")
         if not ID_RE.fullmatch(task_id):
             raise WorkerError("TASK_ID_INVALID", phase="validation")
         metadata = task.get("metadata")
         if not isinstance(metadata, Mapping):
             raise WorkerError("TASK_METADATA_REQUIRED", phase="validation")
-        execution = metadata.get("execution")
+        execution = execution_override if execution_override is not None else metadata.get("execution")
         if not isinstance(execution, Mapping):
             raise WorkerError("DYNAMIC_EXECUTION_PAYLOAD_REQUIRED", phase="validation")
-        if execution.get("schema") != "aios.online-agent.execution.v2":
-            raise WorkerError("EXECUTION_SCHEMA_INVALID", phase="validation")
+        try:
+            execution = validate_execution_envelope(execution, worker_capabilities=worker_capabilities)
+        except ExecutionProjectionError as exc:
+            raise WorkerError(str(exc), phase="validation") from exc
+        if execution.get("task_id") != task_id:
+            raise WorkerError("TASK_BINDING_CONFLICT", phase="validation")
+        action = str(execution["action"])
         repository = execution.get("repository")
         if not isinstance(repository, str) or not repository:
             raise WorkerError("REPOSITORY_INVALID", phase="validation")
@@ -319,10 +393,10 @@ class ExecutionEnvelope:
             adapter = str(adapter_value.get("name") or "")
         else:
             adapter = str(adapter_value or "")
-        if adapter not in {"deterministic", "codex", "hermes"}:
+        if adapter not in {"deterministic", "source_capture", "codex", "hermes"}:
             raise WorkerError("RUNTIME_ADAPTER_UNSUPPORTED", phase="validation")
         change_set = execution.get("change_set")
-        if not isinstance(change_set, list) or not change_set or len(change_set) > 128:
+        if not isinstance(change_set, list) or len(change_set) > 128 or (action == "deterministic" and not change_set):
             raise WorkerError("CHANGE_SET_INVALID", phase="validation")
         normalized_changes: list[dict[str, Any]] = []
         for item in change_set:
@@ -398,15 +472,23 @@ class ExecutionEnvelope:
             governance_value["allowed_files"] = sorted(allowed)
         return cls(
             task_id=task_id,
+            job_id=str(execution["job_id"]),
             repository=repository,
             base_oid=base_oid,
+            expected_branch_oid=str(execution["expected_branch_oid"]),
             target_branch=target_branch,
+            branch_mode=str(execution["branch_mode"]),
+            generation=int(execution["generation"]),
+            idempotency_key=str(execution["idempotency_key"]),
+            action=action,
             adapter=adapter,
+            capability_scope=tuple(execution.get("capability_scope") or ()),
+            source_signals=tuple(execution.get("source_signals") or ()),
             change_set=tuple(normalized_changes),
             verification=tuple(normalized_verification),
             governance=governance_value,
             workspace=workspace_value,
-            digest=digest_json(execution),
+            digest=str(execution["execution_digest"]),
         )
 
 
@@ -479,6 +561,81 @@ class DeterministicExecutor(RuntimeAdapter):
         }
 
 
+class SourceCaptureExecutor(RuntimeAdapter):
+    """Read-only repository source capture for a first implementation attempt."""
+
+    name = "source_capture"
+    roots = ("active-runtime/app", "tests", "migrations", "deploy/systemd")
+    suffixes = {".py", ".sql", ".yaml", ".yml", ".json", ".md", ".service"}
+    defaults = {
+        "agent", "task", "worker", "execution", "projection", "claim", "heartbeat",
+        "governed", "trace", "tool", "credential", "scope", "message", "handoff",
+    }
+
+    def execute(self, envelope: ExecutionEnvelope, worktree: Path) -> dict[str, Any]:
+        terms = set(self.defaults)
+        for signal in envelope.source_signals:
+            terms.update(token.lower() for token in re.findall(r"[A-Za-z][A-Za-z0-9_.-]{2,63}", signal))
+        terms = set(sorted(terms)[:64])
+        selected: list[tuple[str, bytes]] = []
+        total = 0
+        root = worktree.resolve()
+        for relative_root in self.roots:
+            candidate_root = resolve_under(root, relative_root)
+            if not candidate_root.is_dir() or candidate_root.is_symlink():
+                continue
+            for path in sorted(candidate_root.rglob("*")):
+                if len(selected) >= 96 or total >= 3 * 1024 * 1024:
+                    break
+                if path.is_symlink() or not path.is_file() or path.suffix.lower() not in self.suffixes:
+                    continue
+                resolved = path.resolve(strict=True)
+                if root not in resolved.parents:
+                    raise WorkerError("SOURCE_CAPTURE_PATH_ESCAPE", phase="source_capture")
+                data = path.read_bytes()
+                if len(data) > MAX_FILE_BYTES:
+                    continue
+                relative = path.relative_to(root).as_posix()
+                searchable = (relative + "\n" + data[:256000].decode("utf-8", "ignore")).lower()
+                if not any(term in searchable for term in terms):
+                    continue
+                selected.append((relative, data))
+                total += len(data)
+        if not selected:
+            raise WorkerError("SOURCE_CAPTURE_EMPTY", phase="source_capture")
+        payload = io.BytesIO()
+        with tarfile.open(fileobj=payload, mode="w:gz") as archive:
+            for relative, data in selected:
+                info = tarfile.TarInfo(relative)
+                info.size = len(data)
+                info.mode = 0o640
+                info.mtime = 0
+                archive.addfile(info, io.BytesIO(data))
+        compressed = payload.getvalue()
+        if len(compressed) > MAX_TASK_BYTES:
+            raise WorkerError("SOURCE_CAPTURE_TOO_LARGE", phase="source_capture", details={"compressed_bytes": len(compressed)})
+        manifest = [
+            {"path": relative, "bytes": len(data), "sha256": digest_bytes(data), "source": "repository"}
+            for relative, data in selected
+        ]
+        audit("ENGINEERING_SOURCE_CAPTURED", file_count=len(manifest), compressed_bytes=len(compressed))
+        return {
+            "changed_files": [],
+            "commands": [],
+            "tests": [],
+            "adapter": self.name,
+            "source_snapshot": {
+                "schema": "aios.engineering.source-snapshot.v2",
+                "encoding": "tar.gz+base64",
+                "payload_b64": base64.b64encode(compressed).decode("ascii"),
+                "payload_sha256": digest_bytes(compressed),
+                "compressed_bytes": len(compressed),
+                "file_count": len(manifest),
+                "files": manifest,
+            },
+        }
+
+
 class CodexExecutor(RuntimeAdapter):
     name = "codex"
 
@@ -502,7 +659,12 @@ class HermesExecutor(RuntimeAdapter):
 
 
 def adapter_for(name: str) -> RuntimeAdapter:
-    return {"deterministic": DeterministicExecutor, "codex": CodexExecutor, "hermes": HermesExecutor}[name]()
+    return {
+        "deterministic": IsolatedDeterministicExecutor,
+        "source_capture": SourceCaptureExecutor,
+        "codex": CodexExecutor,
+        "hermes": HermesExecutor,
+    }[name]()
 
 
 class HttpClient:
@@ -544,6 +706,9 @@ class AgentTaskClient:
     def claim(self, task_id: str) -> tuple[int, dict[str, Any]]:
         return HttpClient.call(API_BASE, "POST", f"/v1/tasks/{task_id}/claim", self.token, {"lease_seconds": LEASE_SECONDS})
 
+    def get(self, task_id: str) -> tuple[int, dict[str, Any]]:
+        return HttpClient.call(API_BASE, "GET", f"/v1/tasks/{task_id}", self.token)
+
     def heartbeat(self, task_id: str, lease_token: str, stage: str) -> tuple[int, dict[str, Any]]:
         return HttpClient.call(
             API_BASE,
@@ -564,8 +729,20 @@ class AgentTaskClient:
 
 
 class BridgeClient:
+    def __init__(self, token: str) -> None:
+        self.token = token
+
     def call(self, route: str, body: Mapping[str, Any]) -> tuple[int, dict[str, Any]]:
-        return HttpClient.call(BRIDGE_BASE, "POST", route, None, body, timeout=60)
+        return HttpClient.call(BRIDGE_BASE, "POST", route, self.token, body, timeout=60)
+
+    def project_execution(self, task: Mapping[str, Any], execution: Mapping[str, Any] | None = None) -> tuple[int, dict[str, Any]]:
+        request: dict[str, Any] = {
+            "task_id": str(task.get("task_id") or ""),
+            "required_capabilities": list(task.get("required_capabilities") or []),
+        }
+        if execution is not None:
+            request["execution"] = dict(execution)
+        return self.call("/v2/execution-envelope", request)
 
 
 class LeaseHeartbeat:
@@ -652,7 +829,15 @@ def task_state_path(task_id: str) -> Path:
     return STATE_ROOT / "tasks" / f"{task_id}.json"
 
 
-def load_task_state(task_id: str, execution_digest: str) -> dict[str, Any] | None:
+def load_task_state(
+    task_id: str,
+    execution_digest: str,
+    *,
+    attempt: int | None = None,
+    continuation_head_oid: str | None = None,
+    continuation_job_id: str | None = None,
+    commit_idempotency_key: str | None = None,
+) -> dict[str, Any] | None:
     path = task_state_path(task_id)
     if not path.is_file() or path.is_symlink():
         return None
@@ -663,6 +848,55 @@ def load_task_state(task_id: str, execution_digest: str) -> dict[str, Any] | Non
     if not isinstance(value, dict):
         raise WorkerError("TASK_STATE_INVALID", phase="state")
     if value.get("execution_digest") not in {None, execution_digest}:
+        if value.get("phase") in {"claimed", "workspace_prepared", "source_capture_done"} and not value.get("governed"):
+            return None
+        if (
+            value.get("phase") == "verification_passed"
+            and not value.get("governed")
+            and attempt is not None
+            and int(value.get("attempt") or 0) < int(attempt)
+        ):
+            # The prior official attempt completed deterministic validation but failed before
+            # a WriterLease or governed commit. A later CAS-authorized retry may use its new
+            # digest; the same attempt can never erase or replace this state.
+            return None
+        if value.get("phase") == "reconciliation_required" and not value.get("governed"):
+            stored_attempt = value.get("attempt")
+            if (
+                stored_attempt is not None
+                and attempt is not None
+                and int(stored_attempt) < int(attempt)
+                and value.get("job_id") == continuation_job_id
+                and isinstance(continuation_head_oid, str)
+                and OID_RE.fullmatch(continuation_head_oid)
+            ):
+                return None
+            details = value.get("details")
+            if (
+                stored_attempt is None
+                and attempt is not None
+                and isinstance(details, Mapping)
+                and details.get("api_status") == 503
+                and details.get("error") == "WORKTREE_DIRTY_SCOPE_MISMATCH"
+                and value.get("job_id") == continuation_job_id
+                and isinstance(continuation_head_oid, str)
+                and OID_RE.fullmatch(continuation_head_oid)
+            ):
+                # Compatibility for the pre-fix recovery record written by attempt 18,
+                # which omitted its attempt number. This exact pre-commit failure has no
+                # governed side effect; plan-registry CAS and the continuation head still
+                # bind the later official claim before the stale state can be discarded.
+                return None
+        governed = value.get("governed")
+        if (
+            continuation_head_oid
+            and isinstance(governed, Mapping)
+            and governed.get("commit_oid") == continuation_head_oid
+            and governed.get("commit_idempotency_key") != commit_idempotency_key
+        ):
+            # A previous governed commit is the exact continuation head; a new digest/key is a
+            # legitimate next deterministic plan on the same Task/Job lineage.
+            return None
         raise WorkerError("TASK_PAYLOAD_DRIFT", phase="recovery")
     return value
 
@@ -687,35 +921,191 @@ def cleanup_run_root(path: Path) -> None:
         shutil.rmtree(candidate)
 
 
-def prepare_worktree(run_root: Path, base_oid: str) -> Path:
+def prepare_worktree(run_root: Path, envelope: ExecutionEnvelope) -> Path:
     clone = run_root / "repository"
     worktree = run_root / "worktree"
+    worktree_oid = (
+        envelope.expected_branch_oid
+        if envelope.branch_mode == "CONTINUE_EXISTING"
+        else envelope.base_oid
+    )
     run_command("workspace_clone", ["/usr/bin/git", "clone", "--no-local", "--no-hardlinks", str(AUTHORITY_GIT_DIR), str(clone)], cwd=run_root, timeout=300, internal_git=True)
-    run_command("workspace_base_probe", ["/usr/bin/git", "-C", str(clone), "rev-parse", "--verify", base_oid + "^{commit}"], cwd=run_root, timeout=60)
-    run_command("workspace_worktree_create", ["/usr/bin/git", "-C", str(clone), "worktree", "add", "--detach", str(worktree), base_oid], cwd=run_root, timeout=300, internal_git=True)
+    run_command("workspace_base_probe", ["/usr/bin/git", "-C", str(clone), "rev-parse", "--verify", worktree_oid + "^{commit}"], cwd=run_root, timeout=60)
+    run_command("workspace_worktree_create", ["/usr/bin/git", "-C", str(clone), "worktree", "add", "--detach", str(worktree), worktree_oid], cwd=run_root, timeout=300, internal_git=True)
     return worktree
 
 
+def _archive_worktree(worktree: Path, archive_path: Path) -> str:
+    with tarfile.open(archive_path, mode="w:gz") as archive:
+        for path in sorted(worktree.rglob("*")):
+            relative = path.relative_to(worktree)
+            if ".git" in relative.parts or path.is_symlink() or not path.is_file():
+                continue
+            data = path.read_bytes()
+            info = tarfile.TarInfo(relative.as_posix())
+            info.size = len(data)
+            info.mode = 0o640
+            info.mtime = 0
+            archive.addfile(info, io.BytesIO(data))
+    archive_path.chmod(0o640)
+    return digest_bytes(archive_path.read_bytes())
+
+
+class IsolatedDeterministicExecutor(RuntimeAdapter):
+    """Coordinator-side client for the uncredentialed executor exchange."""
+
+    name = "isolated-deterministic"
+
+    @staticmethod
+    def _atomic(path: Path, data: bytes) -> None:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=str(path.parent))
+        try:
+            with os.fdopen(fd, "wb") as handle:
+                handle.write(data)
+                handle.flush()
+                os.fsync(handle.fileno())
+            os.chmod(temporary, 0o640)
+            os.replace(temporary, path)
+        finally:
+            if os.path.exists(temporary):
+                os.unlink(temporary)
+
+    def execute(self, envelope: ExecutionEnvelope, worktree: Path) -> dict[str, Any]:
+        if envelope.action != "deterministic":
+            raise WorkerError("ISOLATED_EXECUTOR_ACTION_INVALID", phase="adapter")
+        root = ISOLATED_EXECUTOR_ROOT
+        for child in ("requests", "results", "failed", "sources"):
+            candidate = root / child
+            if candidate.is_symlink() or not candidate.is_dir():
+                raise WorkerError("ISOLATED_EXECUTOR_UNAVAILABLE", phase="adapter", details={"path": str(candidate)})
+        request_id = f"{envelope.task_id}.{secrets.token_hex(16)}"
+        if not REQUEST_ID_RE.fullmatch(request_id):
+            raise WorkerError("ISOLATED_EXECUTOR_REQUEST_ID_INVALID", phase="adapter")
+        archive = root / "sources" / f"{request_id}.tgz"
+        request_path = root / "requests" / f"{request_id}.json"
+        result_path = root / "results" / f"{request_id}.json"
+        failed_path = root / "failed" / f"{request_id}.json"
+        for stale in (request_path, result_path, failed_path, archive):
+            if stale.exists() or stale.is_symlink():
+                raise WorkerError(
+                    "ISOLATED_EXECUTOR_COLLISION_DETECTED", phase="adapter", details={"request_id": request_id, "path": str(stale)}
+                )
+        archive_sha = _archive_worktree(worktree, archive)
+        request = {
+            "schema": "aios.isolated-execution.request.v1",
+            "request_id": request_id,
+            "task_id": envelope.task_id,
+            "job_id": envelope.job_id,
+            "execution_digest": envelope.digest,
+            "source_archive": str(archive),
+            "source_archive_sha256": archive_sha,
+            "change_set": list(envelope.change_set),
+            "verification": list(envelope.verification),
+        }
+        request_sha = digest_json(request)
+        self._atomic(request_path, json.dumps(request, sort_keys=True, separators=(",", ":")).encode("utf-8"))
+        wait_seconds = _isolated_executor_wait_seconds(envelope.verification)
+        deadline = time.monotonic() + wait_seconds
+        try:
+            while time.monotonic() < deadline:
+                if failed_path.is_file():
+                    details = json.loads(failed_path.read_text(encoding="utf-8"))
+                    raise WorkerError("ISOLATED_EXECUTOR_FAILED", phase="adapter", details={"error": details.get("error")})
+                if result_path.is_file():
+                    result = json.loads(result_path.read_text(encoding="utf-8"))
+                    if result.get("request_id") != request_id:
+                        raise WorkerError("ISOLATED_EXECUTOR_REQUEST_ID_MISMATCH", phase="adapter")
+                    if result.get("schema") != "aios.isolated-execution.result.v1":
+                        raise WorkerError("ISOLATED_EXECUTOR_RESULT_INVALID", phase="adapter")
+                    if result.get("request_sha256") != request_sha:
+                        raise WorkerError("ISOLATED_EXECUTOR_REQUEST_BINDING_INVALID", phase="adapter")
+                    material = {key: value for key, value in result.items() if key != "result_sha256"}
+                    if result.get("result_sha256") != digest_json(material):
+                        raise WorkerError("ISOLATED_EXECUTOR_RESULT_DIGEST_INVALID", phase="adapter")
+                    isolation = result.get("credential_isolation")
+                    if not isinstance(isolation, Mapping) or not all(isolation.get(k) is True for k in (
+                        "credential_env_absent", "credential_mount_inaccessible", "governed_bridge_unreachable"
+                    )):
+                        raise WorkerError("CREDENTIAL_ISOLATION_VERIFY", phase="adapter")
+                    expected_paths = sorted({str(item["path"]) for item in envelope.change_set})
+                    returned = result.get("changed_files")
+                    if not isinstance(returned, list) or sorted(str(item.get("path")) for item in returned) != expected_paths:
+                        raise WorkerError("ISOLATED_EXECUTOR_CHANGED_FILESET_INVALID", phase="adapter")
+                    for item in returned:
+                        relative = safe_relative_path(item.get("path"), field="isolated_changed_file")
+                        path = resolve_under(worktree, relative, write=True)
+                        if item.get("deleted") is True:
+                            path.unlink(missing_ok=True)
+                            continue
+                        raw = base64.b64decode(str(item.get("content_b64") or ""), validate=True)
+                        if digest_bytes(raw) != item.get("sha256"):
+                            raise WorkerError("ISOLATED_EXECUTOR_FILE_DIGEST_INVALID", phase="adapter")
+                        self._atomic(path, raw)
+                    commands = [
+                        run_command("git_diff_check", ["/usr/bin/git", "-C", str(worktree), "diff", "--check"], cwd=worktree, timeout=120),
+                        run_command("git_diff_stat", ["/usr/bin/git", "-C", str(worktree), "diff", "--no-ext-diff", "--stat"], cwd=worktree, timeout=120),
+                    ]
+                    return {
+                        "changed_files": expected_paths,
+                        "commands": commands,
+                        "tests": list(result.get("verification") or []),
+                        "adapter": self.name,
+                        "credential_isolation": dict(isolation),
+                    }
+                time.sleep(0.25)
+            raise WorkerError("ISOLATED_EXECUTOR_TIMEOUT", phase="adapter")
+        finally:
+            request_path.unlink(missing_ok=True)
+            result_path.unlink(missing_ok=True)
+            failed_path.unlink(missing_ok=True)
+            archive.unlink(missing_ok=True)
+
+
+def _verify_converged_job(
+    response: Mapping[str, Any],
+    envelope: ExecutionEnvelope,
+    commit_oid: str,
+) -> None:
+    if response.get("state") != "COMPLETED":
+        raise WorkerError("GOVERNED_RECEIPT_STATE_INVALID", phase="verification")
+    receipt = response.get("receipt")
+    if not isinstance(receipt, Mapping) or receipt.get("remote_verified") is not True:
+        raise WorkerError("GOVERNED_RECEIPT_REQUIRED", phase="verification")
+    for field in ("authority_oid", "api_branch_oid", "git_remote_oid"):
+        if receipt.get(field) != commit_oid:
+            raise WorkerError("GOVERNED_RECEIPT_OID_MISMATCH", phase="verification", details={"field": field})
+    leases = response.get("branch_leases")
+    if not isinstance(leases, list):
+        raise WorkerError("WRITER_LEASE_RECOVERY_EVIDENCE_MISSING", phase="verification")
+    active = [
+        item for item in leases
+        if isinstance(item, Mapping)
+        and item.get("state") == "ACTIVE"
+        and item.get("job_id") == envelope.job_id
+        and item.get("branch") == envelope.target_branch
+    ]
+    if len(active) != 1:
+        raise WorkerError("WRITER_LEASE_RECOVERY_EVIDENCE_INVALID", phase="verification")
+    lease = active[0]
+    if (
+        int(lease.get("generation") or 0) != envelope.generation
+        or lease.get("current_head_oid") != commit_oid
+    ):
+        raise WorkerError("WRITER_LEASE_CURRENT_HEAD_MISMATCH", phase="verification")
+
+
 def governed_commit(envelope: ExecutionEnvelope, worktree: Path, bridge: BridgeClient, heartbeat: LeaseHeartbeat) -> dict[str, Any]:
     governance = envelope.governance
-    create_body = {
-        "task_id": governance["task_id"],
-        "repository": envelope.repository,
-        "base_oid": envelope.base_oid,
-        "target_branch": envelope.target_branch,
-        "risk": str(governance.get("risk") or "engineering"),
-        "description": str(governance.get("description") or f"Governed execution for {envelope.task_id}"),
-        "idempotency_key": governance["idempotency_key"],
-    }
-    status, response = bridge.call("/v2/governed-task", create_body)
-    if not 200 <= status < 300:
-        raise WorkerError("GOVERNED_TASK_CREATE_FAILED", phase="committing", details={"api_status": status, "error": response.get("error")})
-    generation = int(response.get("generation") or 0)
-    expected_branch_oid = str(response.get("expected_branch_oid") or envelope.base_oid)
-    branch_mode = str(response.get("branch_mode") or "CREATE_NEW")
+    if governance.get("task_id") != envelope.task_id or governance.get("job_id") != envelope.job_id:
+        raise WorkerError("GOVERNED_LINEAGE_INVALID", phase="committing")
+    generation = envelope.generation
+    expected_branch_oid = envelope.expected_branch_oid
+    branch_mode = envelope.branch_mode
     lease_body = {
         "schema": "aios.task-writer-lease.v2",
-        "task_id": governance["task_id"],
+        "task_id": envelope.task_id,
+        "job_id": envelope.job_id,
         "repository": envelope.repository,
         "branch_mode": branch_mode,
         "base_oid": envelope.base_oid,
@@ -727,6 +1117,17 @@ def governed_commit(envelope: ExecutionEnvelope, worktree: Path, bridge: BridgeC
     status, lease_response = bridge.call("/v2/writer-lease", lease_body)
     if not 200 <= status < 300:
         raise WorkerError("WRITER_LEASE_ACQUIRE_FAILED", phase="committing", details={"api_status": status, "error": lease_response.get("error")})
+    if (
+        lease_response.get("job_id") != envelope.job_id
+        or lease_response.get("task_id") != envelope.task_id
+        or lease_response.get("repository") != envelope.repository
+        or lease_response.get("base_oid") != envelope.base_oid
+        or lease_response.get("expected_branch_oid") != expected_branch_oid
+        or lease_response.get("branch_mode") != branch_mode
+        or int(lease_response.get("generation") or 0) != generation
+        or lease_response.get("target_branch") != envelope.target_branch
+    ):
+        raise WorkerError("WRITER_LEASE_RESPONSE_BINDING_INVALID", phase="committing")
     heartbeat.ensure()
     files: dict[str, str] = {}
     paths = governance.get("allowed_files") or [item["path"] for item in envelope.change_set]
@@ -736,7 +1137,8 @@ def governed_commit(envelope: ExecutionEnvelope, worktree: Path, bridge: BridgeC
             raise WorkerError("COMMIT_FILE_MISSING", phase="committing", details={"path": relative})
         files[relative] = base64.b64encode(path.read_bytes()).decode("ascii")
     commit_body = {
-        "task_id": governance["task_id"],
+        "task_id": envelope.task_id,
+        "job_id": envelope.job_id,
         "repository": envelope.repository,
         "expected_branch_oid": expected_branch_oid,
         "target_branch": envelope.target_branch,
@@ -747,12 +1149,25 @@ def governed_commit(envelope: ExecutionEnvelope, worktree: Path, bridge: BridgeC
     }
     status, commit_response = bridge.call("/v2/commit-files", commit_body)
     if not 200 <= status < 300:
-        raise WorkerError("GOVERNED_COMMIT_FAILED", phase="committing", details={"api_status": status, "error": commit_response.get("error")})
+        code = "RECONCILIATION_REQUIRED" if status == 599 or status >= 500 else "GOVERNED_COMMIT_FAILED"
+        raise WorkerError(code, phase="committing", details={"api_status": status, "error": commit_response.get("error"), "job_id": envelope.job_id})
+    if (
+        commit_response.get("job_id") != envelope.job_id
+        or commit_response.get("target_branch") != envelope.target_branch
+        or int(commit_response.get("generation") or 0) != generation
+        or commit_response.get("branch_mode") not in {"CREATE_NEW", "CONTINUE_EXISTING"}
+    ):
+        raise WorkerError("GOVERNED_COMMIT_RESPONSE_BINDING_INVALID", phase="committing")
     commit_oid = commit_response.get("commit_oid")
     if not isinstance(commit_oid, str) or not OID_RE.fullmatch(commit_oid):
         raise WorkerError("GOVERNED_COMMIT_OID_INVALID", phase="committing")
+    receipt = commit_response.get("receipt")
+    if not isinstance(receipt, Mapping) or receipt.get("remote_verified") is not True:
+        raise WorkerError("GOVERNED_COMMIT_RECEIPT_REQUIRED", phase="verification")
     visible_oid: str | None = None
-    for _ in range(5):
+    deadline = time.monotonic() + max(5, min(GIT_VISIBILITY_TIMEOUT_SECONDS, 120))
+    delay = 0.5
+    while time.monotonic() < deadline:
         probe = subprocess.run(
             ["/usr/bin/git", "--git-dir", str(AUTHORITY_GIT_DIR), "rev-parse", "--verify", f"refs/heads/{envelope.target_branch}"],
             text=True,
@@ -765,11 +1180,17 @@ def governed_commit(envelope: ExecutionEnvelope, worktree: Path, bridge: BridgeC
             visible_oid = probe.stdout.strip()
             if visible_oid == commit_oid:
                 break
-        time.sleep(1)
+        time.sleep(delay)
+        delay = min(delay * 1.7, 5.0)
     if visible_oid != commit_oid:
-        raise WorkerError("GIT_VISIBILITY_MISMATCH", phase="verification", details={"commit_oid": commit_oid, "visible_oid": visible_oid})
+        raise WorkerError("RECONCILIATION_REQUIRED", phase="verification", details={"commit_oid": commit_oid, "visible_oid": visible_oid, "job_id": envelope.job_id})
+    job_status, job_response = bridge.call("/v2/job", {"job_id": envelope.job_id})
+    if not 200 <= job_status < 300:
+        raise WorkerError("RECONCILIATION_REQUIRED", phase="verification", details={"api_status": job_status, "job_id": envelope.job_id})
+    _verify_converged_job(job_response, envelope, commit_oid)
     return {
-        "governed_task_id": governance["task_id"],
+        "governed_task_id": envelope.task_id,
+        "job_id": envelope.job_id,
         "branch_mode": branch_mode,
         "generation": generation,
         "target_branch": envelope.target_branch,
@@ -777,6 +1198,7 @@ def governed_commit(envelope: ExecutionEnvelope, worktree: Path, bridge: BridgeC
         "visible_oid": visible_oid,
         "commit_idempotency_key": governance["commit_idempotency_key"],
         "api_commit_visible": commit_response.get("commit_visible"),
+        "receipt": dict(commit_response.get("receipt")) if isinstance(commit_response.get("receipt"), Mapping) else None,
         "direct_main_write": False,
         "force_push": False,
         "production_write": False,
@@ -808,12 +1230,86 @@ def build_result(task_id: str, envelope: ExecutionEnvelope, execution: Mapping[s
     }
 
 
+def build_source_capture_result(
+    task_id: str,
+    envelope: ExecutionEnvelope,
+    execution: Mapping[str, Any],
+) -> dict[str, Any]:
+    snapshot = execution.get("source_snapshot")
+    if not isinstance(snapshot, Mapping):
+        raise WorkerError("SOURCE_CAPTURE_RESULT_INVALID", phase="result")
+    return {
+        "status": "SUCCEEDED",
+        "classification": "NEEDS_REWORK_SOURCE_CAPTURE",
+        "verification_state": "NEEDS_REWORK",
+        "execution_mode": "source_capture",
+        "execution_backend": "generic-online-agent-worker-v2",
+        "task_id": task_id,
+        "job_id": envelope.job_id,
+        "repository": envelope.repository,
+        "base_oid": envelope.base_oid,
+        "expected_branch_oid": envelope.expected_branch_oid,
+        "target_branch": envelope.target_branch,
+        "generation": envelope.generation,
+        "execution_digest": envelope.digest,
+        "changed_files": [],
+        "tests": [],
+        "source_snapshot": dict(snapshot),
+        "workspace_cleanup": "PASS",
+        "writer_lease": "NONE",
+        "secret_material_exposed": False,
+        "direct_main_write": False,
+        "force_push": False,
+        "production_write": False,
+        "protected_ref_bypass": False,
+    }
+
+
 class WorkerSupervisor:
     def __init__(self, token: str) -> None:
         self.agent = AgentTaskClient(token)
-        self.bridge = BridgeClient()
+        self.bridge = BridgeClient(token)
 
-    def process_claim(self, task: Mapping[str, Any], claim: Mapping[str, Any]) -> None:
+    def resolve_envelope(self, task: Mapping[str, Any]) -> tuple[ExecutionEnvelope, str]:
+        metadata = task.get("metadata")
+        execution = metadata.get("execution") if isinstance(metadata, Mapping) else None
+        if isinstance(metadata, Mapping) and "execution" in metadata:
+            if not isinstance(execution, Mapping):
+                raise WorkerError("EXECUTION_ENVELOPE_SCHEMA_VALIDATION", phase="validation")
+            persisted = ExecutionEnvelope.from_task(task, worker_capabilities=WORKER_CAPABILITIES)
+            status, authoritative = self.bridge.project_execution(task, execution)
+            if not 200 <= status < 300:
+                raise WorkerError("TASK_PERSISTED_BINDING_UNVERIFIED", phase="projection", details={"api_status": status, "error": authoritative.get("error")})
+            canonical = ExecutionEnvelope.from_task(task, authoritative, WORKER_CAPABILITIES)
+            if canonical.digest != persisted.digest or canonical.job_id != persisted.job_id:
+                raise WorkerError("TASK_PERSISTED_BINDING_CONFLICT", phase="projection")
+            return persisted, "persisted_verified"
+        status, projected = self.bridge.project_execution(task)
+        if status == 404 or projected.get("error") == "TASK_EXECUTION_PROJECTION_MISSING":
+            raise WorkerError("TASK_SKIPPED_PROJECTION_MISSING", phase="projection")
+        if not 200 <= status < 300:
+            raise WorkerError(
+                "TASK_SKIPPED_POLICY_DENY",
+                phase="projection",
+                details={"api_status": status, "error": projected.get("error")},
+            )
+        envelope = ExecutionEnvelope.from_task(task, projected, WORKER_CAPABILITIES)
+        audit(
+            "TASK_EXECUTION_ENVELOPE_PROJECTED",
+            task_id=envelope.task_id,
+            job_id=envelope.job_id,
+            generation=envelope.generation,
+            action=envelope.action,
+            execution_digest=envelope.digest,
+        )
+        return envelope, "recovered_projection"
+
+    def process_claim(
+        self,
+        task: Mapping[str, Any],
+        claim: Mapping[str, Any],
+        envelope: ExecutionEnvelope,
+    ) -> None:
         task_id = str(claim.get("task_id") or task.get("task_id") or "")
         lease_token = claim.get("lease_token")
         if not isinstance(lease_token, str) or len(lease_token) < 24:
@@ -825,10 +1321,31 @@ class WorkerSupervisor:
             heartbeat.set_stage("started")
             heartbeat.start()
             audit("TASK_STARTED", task_id=task_id, attempt=claim.get("attempt"))
-            envelope = ExecutionEnvelope.from_task(task)
-            state = load_task_state(task_id, envelope.digest) or {"task_id": task_id, "execution_digest": envelope.digest, "phase": "claimed"}
+            status, current_task = self.agent.get(task_id)
+            if status != 200:
+                raise WorkerError("TASK_READ_AFTER_CLAIM_FAILED", phase="claim", details={"api_status": status})
+            current_envelope, _ = self.resolve_envelope(current_task)
+            if current_envelope.digest != envelope.digest or current_envelope.job_id != envelope.job_id:
+                raise WorkerError("TASK_PAYLOAD_DRIFT", phase="claim")
+            state = load_task_state(
+                task_id,
+                envelope.digest,
+                attempt=int(claim.get("attempt") or 0),
+                continuation_head_oid=envelope.expected_branch_oid if envelope.branch_mode == "CONTINUE_EXISTING" else None,
+                continuation_job_id=envelope.job_id,
+                commit_idempotency_key=str(envelope.governance.get("commit_idempotency_key") or ""),
+            ) or {"task_id": task_id, "execution_digest": envelope.digest, "phase": "claimed"}
             governed = state.get("governed") if isinstance(state.get("governed"), Mapping) else None
-            if isinstance(governed, Mapping) and isinstance(governed.get("commit_oid"), str) and OID_RE.fullmatch(governed["commit_oid"]):
+            if envelope.action == "deterministic" and isinstance(governed, Mapping) and isinstance(governed.get("commit_oid"), str) and OID_RE.fullmatch(governed["commit_oid"]):
+                if governed.get("job_id") != envelope.job_id or governed.get("target_branch") != envelope.target_branch or int(governed.get("generation") or 0) != envelope.generation or not isinstance(governed.get("receipt"), Mapping):
+                    raise WorkerError("RECOVERY_EVIDENCE_BINDING_INVALID", phase="recovery")
+                job_status, job_receipt = self.bridge.call("/v2/job", {"job_id": envelope.job_id})
+                if not 200 <= job_status < 300:
+                    raise WorkerError("RECOVERY_RECEIPT_UNVERIFIED", phase="recovery", details={"api_status": job_status})
+                _verify_converged_job(job_receipt, envelope, str(governed["commit_oid"]))
+                probe = subprocess.run(["/usr/bin/git", "--git-dir", str(AUTHORITY_GIT_DIR), "rev-parse", "--verify", f"refs/heads/{envelope.target_branch}"], text=True, capture_output=True, check=False, env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8", "GIT_CONFIG_GLOBAL": str(GIT_CONFIG_GLOBAL)}, timeout=30)
+                if probe.returncode != 0 or probe.stdout.strip() != governed["commit_oid"]:
+                    raise WorkerError("RECOVERY_HEAD_UNVERIFIED", phase="recovery")
                 result = state.get("result")
                 if not isinstance(result, Mapping):
                     result = {"status": "SUCCEEDED", "verification_state": "VERIFIED_BY_WORKER_PENDING_SERVER_REVIEW", "task_id": task_id, "execution_digest": envelope.digest, "governed": dict(governed), "recovered_without_duplicate_commit": True, "direct_main_write": False, "production_write": False, "force_push": False, "protected_ref_bypass": False}
@@ -836,7 +1353,7 @@ class WorkerSupervisor:
             else:
                 run_root = new_run_root()
                 try:
-                    worktree = prepare_worktree(run_root, envelope.base_oid)
+                    worktree = prepare_worktree(run_root, envelope)
                     state.update({"phase": "workspace_prepared", "execution_digest": envelope.digest, "attempt": claim.get("attempt")})
                     save_task_state(task_id, state)
                     adapter = adapter_for(envelope.adapter)
@@ -844,6 +1361,10 @@ class WorkerSupervisor:
                     state.update({"phase": "verification_passed", "execution": execution})
                     save_task_state(task_id, state)
                     heartbeat.ensure()
+                    if envelope.action == "source_capture":
+                        result = build_source_capture_result(task_id, envelope, execution)
+                        state.update({"phase": "source_capture_done", "result": result})
+                    else:
                         heartbeat.set_stage("committing")
                         governed = governed_commit(envelope, worktree, self.bridge, heartbeat)
                         result = build_result(task_id, envelope, execution, governed)
@@ -861,6 +1382,10 @@ class WorkerSupervisor:
             audit("TASK_RESULT_SUBMITTED", task_id=task_id, api_status=status, result_idempotency_key=result_key, commit_oid=result.get("governed", {}).get("commit_oid"))
         except WorkerError as exc:
             audit("TASK_FAILED", task_id=task_id, error=exc.code, phase=exc.phase, details=exc.details)
+            if exc.code == "RECONCILIATION_REQUIRED":
+                save_task_state(task_id, {"task_id": task_id, "execution_digest": envelope.digest, "phase": "reconciliation_required", "attempt": claim.get("attempt"), "job_id": envelope.job_id, "details": exc.details})
+                audit("TASK_RECONCILIATION_REQUIRED", task_id=task_id, job_id=envelope.job_id, details=exc.details)
+                return
             failure_key = f"{task_id}-attempt-{claim.get('attempt', 0)}-failure"
             failure = {
                 "status": "FAILED",
@@ -891,15 +1416,22 @@ class WorkerSupervisor:
         except WorkerError as exc:
             audit("TASK_POLL_FAILED", error=exc.code, phase=exc.phase, details=exc.details)
             return 10
-        dynamic_tasks: list[dict[str, Any]] = []
+        dynamic_tasks: list[tuple[dict[str, Any], ExecutionEnvelope]] = []
         for task in tasks:
-            metadata = task.get("metadata")
-            execution = metadata.get("execution") if isinstance(metadata, Mapping) else None
-            if not isinstance(execution, Mapping) or execution.get("schema") != "aios.online-agent.execution.v2":
-                audit("TASK_SKIPPED_NON_DYNAMIC", task_id=task.get("task_id"), reason="DYNAMIC_EXECUTION_PAYLOAD_REQUIRED")
+            try:
+                envelope, source = self.resolve_envelope(task)
+            except WorkerError as exc:
+                event = "TASK_SKIPPED_ENVELOPE_INVALID"
+                if exc.code in {"TASK_SKIPPED_PROJECTION_MISSING", "TASK_SKIPPED_POLICY_DENY"}:
+                    event = exc.code
+                elif exc.code == "CAPABILITY_MISMATCH_DENY":
+                    event = "TASK_SKIPPED_CAPABILITY_MISMATCH"
+                audit(event, task_id=task.get("task_id"), reason=exc.code, phase=exc.phase, details=exc.details)
                 continue
-            dynamic_tasks.append(task)
-        for task in dynamic_tasks:
+            audit("TASK_VISIBLE_TO_WORKER_CLAIMABLE", task_id=task.get("task_id"), envelope_source=source, action=envelope.action)
+            dynamic_tasks.append((task, envelope))
+        dynamic_tasks.sort(key=_claim_order)
+        for task, envelope in dynamic_tasks:
             task_id = str(task.get("task_id") or "")
             status, claim = self.agent.claim(task_id)
             if status == 409:
@@ -908,13 +1440,13 @@ class WorkerSupervisor:
             if status != 200:
                 audit("TASK_CLAIM_FAILED", task_id=task_id, api_status=status, error=claim.get("error"))
                 continue
-            self.process_claim(task, claim)
+            self.process_claim(task, claim, envelope)
             return 0
         return 0
 
     def run_forever(self) -> int:
         ensure_roots()
-        audit("WORKER_STARTED", task_agnostic=True, api_base=API_BASE, bridge_base=BRIDGE_BASE, adapter_names=["deterministic", "codex", "hermes"], runtime_only_credentials=True)
+        audit("WORKER_STARTED", task_agnostic=True, api_base=API_BASE, bridge_base=BRIDGE_BASE, adapter_names=["isolated-deterministic", "source_capture", "codex", "hermes"], runtime_only_credentials=True, isolated_executor=True)
         while True:
             self.once()
             time.sleep(POLL_SECONDS)

active-runtime/app/authorized_task_writer_provisioning.py

@@ -964,6 +964,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
     required = {
         "schema",
         "task_id",
+        "job_id",
         "repository",
         "branch_mode",
         "base_oid",
@@ -976,6 +977,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
         raise ProvisioningError("LEASE_REQUEST_V2_FIELDS_REJECTED", 409)
     request = WriterLeaseRequestV2(
         task_id=str(raw["task_id"]),
+        job_id=str(raw["job_id"]),
         repository=str(raw["repository"]),
         branch_mode=str(raw["branch_mode"]),
         base_oid=str(raw["base_oid"]),
@@ -988,6 +990,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
     return {
         "schema": WriterLeaseRequestV2.schema,
         "task_id": request.task_id,
+        "job_id": request.job_id,
         "repository": request.repository,
         "branch_mode": request.branch_mode,
         "base_oid": request.base_oid,

deploy/agent-runtime-openclaw.conf.example

@@ -1,18 +0,0 @@
-# Non-secret staging configuration for the OpenClaw engineering backend.
-#
-# Discover the exact binary with `command -v openclaw`.
-# Do not point this at the chat/WeChat Gateway HTTP endpoint.
-AIOS_AGENT_RUNTIME_BACKEND_ARGV_JSON='["/usr/bin/python3","/usr/local/lib/aios-agent-runtime-broker/openclaw_engineering_backend.py"]'
-
-# Required: exact absolute path discovered on hw.imruyi.top.
-AIOS_OPENCLAW_BIN=/REPLACE/WITH/ABSOLUTE/OPENCLAW/PATH
-
-# Required: provider/model verified on the installed OpenClaw build.
-AIOS_OPENCLAW_MODEL=REPLACE_WITH_VERIFIED_PROVIDER_MODEL
-
-# Non-secret map: provider environment variable -> systemd credential file name.
-# Example after separately projecting an encrypted credential:
-# AIOS_OPENCLAW_PROVIDER_CREDENTIAL_MAP_JSON='{"OPENAI_API_KEY":"openai_api_key"}'
-AIOS_OPENCLAW_PROVIDER_CREDENTIAL_MAP_JSON='{}'
-
-AIOS_OPENCLAW_EXEC_TIMEOUT_SECONDS=1800

deploy/install-autonomous-intent-worker-staging.sh

@@ -1,66 +0,0 @@
-#!/bin/sh
-set -eu
-
-if [ "$(id -u)" -ne 0 ]; then
-  echo "must run as root" >&2
-  exit 20
-fi
-
-SRC_ROOT="${1:-.}"
-WORKER_SRC="$SRC_ROOT/services/aios-autonomous-agent-worker"
-BROKER_SRC="$SRC_ROOT/services/aios-agent-runtime-broker"
-UNIT_SRC="$SRC_ROOT/deploy/systemd"
-
-grep -Fq 'AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:19998' \
-  "$UNIT_SRC/aios-autonomous-agent-worker.service" || {
-    echo "staging bridge binding missing" >&2
-    exit 21
-  }
-
-getent group aios-agent-runtime >/dev/null 2>&1 || groupadd --system aios-agent-runtime
-id aios-agent-runtime >/dev/null 2>&1 || \
-  useradd --system --gid aios-agent-runtime --home-dir /nonexistent --shell /usr/sbin/nologin aios-agent-runtime
-id aios-autonomous-agent-worker >/dev/null 2>&1 || \
-  useradd --system --home-dir /nonexistent --shell /usr/sbin/nologin aios-autonomous-agent-worker
-usermod -a -G aios-agent-runtime aios-autonomous-agent-worker
-
-install -d -m 0755 /usr/local/lib/aios-autonomous-agent-worker
-install -d -m 0755 /usr/local/lib/aios-agent-runtime-broker
-install -d -m 0750 -o aios-autonomous-agent-worker -g aios-autonomous-agent-worker \
-  /var/lib/aios-autonomous-agent-worker
-install -d -m 0770 -o aios-autonomous-agent-worker -g aios-agent-runtime \
-  /var/lib/aios-autonomous-agent-worker/workspaces
-
-for file in autonomous_worker.py intent_runtime.py runtime_client.py register.py runtime_selftest.py; do
-  install -m 0755 "$WORKER_SRC/$file" "/usr/local/lib/aios-autonomous-agent-worker/$file"
-done
-install -m 0755 "$BROKER_SRC/broker.py" /usr/local/lib/aios-agent-runtime-broker/broker.py
-install -m 0755 "$BROKER_SRC/openclaw_engineering_backend.py" /usr/local/lib/aios-agent-runtime-broker/openclaw_engineering_backend.py
-install -m 0644 "$BROKER_SRC/RUNTIME_CONTRACT.md" /usr/local/lib/aios-agent-runtime-broker/RUNTIME_CONTRACT.md
-
-install -m 0644 "$UNIT_SRC/aios-autonomous-agent-worker.service" /etc/systemd/system/
-install -m 0644 "$UNIT_SRC/aios-autonomous-agent-register.service" /etc/systemd/system/
-install -m 0644 "$UNIT_SRC/aios-agent-runtime-broker@.service" /etc/systemd/system/
-
-systemctl daemon-reload
-
-cat <<'EOF'
-Files installed. Services were NOT started or enabled.
-
-Required before activation:
-1. Discover `openclaw` with `command -v openclaw`.
-2. Verify `openclaw agent exec --help` exposes the required headless coding
-   options on the installed version.
-3. Create /etc/aios/agent-runtime-openclaw.conf from the non-secret example.
-4. Project provider/model credentials into the OpenClaw broker service with a
-   separate systemd encrypted credential. Never reuse the Online Agent Task
-   token or writer lease.
-5. Start only `aios-agent-runtime-broker@openclaw.service`.
-6. Run runtime_selftest.py and require a real worktree mutation with unchanged
-   Git HEAD.
-7. Only after self-test PASS register the autonomous identity and enable
-   continuous polling.
-
-The autonomous worker is staging-only and rejects any Governed Bridge other
-than http://127.0.0.1:19998.
-EOF

deploy/systemd/aios-agent-runtime-broker@.service

@@ -1,42 +0,0 @@
-[Unit]
-Description=AIOS isolated %i engineering runtime broker
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=aios-agent-runtime
-Group=aios-agent-runtime
-Environment=PYTHONUNBUFFERED=1
-Environment=AIOS_AGENT_RUNTIME_ADAPTER=%i
-Environment=AIOS_AGENT_RUNTIME_SOCKET=/run/aios-agent-runtime/%i.sock
-Environment=AIOS_AGENT_RUNTIME_WORKSPACE_ROOT=/var/lib/aios-autonomous-agent-worker/workspaces
-Environment=AIOS_AGENT_RUNTIME_ALLOWED_PEER_USER=aios-autonomous-agent-worker
-Environment=AIOS_AGENT_RUNTIME_CONNECTION_TIMEOUT_SECONDS=15
-Environment=AIOS_AGENT_RUNTIME_BACKEND_TIMEOUT_SECONDS=3600
-EnvironmentFile=/etc/aios/agent-runtime-%i.conf
-ExecStart=/usr/bin/python3 -B /usr/local/lib/aios-agent-runtime-broker/broker.py
-Restart=always
-RestartSec=5
-RuntimeDirectory=aios-agent-runtime
-RuntimeDirectoryMode=0770
-UMask=0007
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-LockPersonality=true
-RestrictSUIDSGID=true
-RestrictRealtime=true
-RestrictNamespaces=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-ReadWritePaths=/var/lib/aios-autonomous-agent-worker/workspaces /run/aios-agent-runtime
-InaccessiblePaths=-/data/aios-gitops/repo.git -/etc/credstore.encrypted/aios-autonomous-agent-worker
-CapabilityBoundingSet=
-AmbientCapabilities=
-
-[Install]
-WantedBy=multi-user.target

deploy/systemd/aios-agent-runtime-broker@openclaw.service.d/10-provider-credential.conf.example

@@ -1,5 +0,0 @@
-# Example only. Choose the credential name/provider used by the verified model.
-# The encrypted credential file contains secret material and must never be committed.
-[Service]
-# Example:
-# LoadCredentialEncrypted=openai_api_key:/etc/credstore.encrypted/aios-agent-runtime-openclaw/openai_api_key

deploy/systemd/aios-autonomous-agent-register.service

@@ -1,38 +0,0 @@
-[Unit]
-Description=AIOS Autonomous Intent Agent register/recover
-After=network-online.target aios-agent-task-api.service aios-agent-runtime-broker@openclaw.service
-Wants=network-online.target
-Requires=aios-agent-runtime-broker@openclaw.service
-Before=aios-autonomous-agent-worker.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-User=root
-Group=root
-LoadCredential=bridge_control_token:/run/credentials/aios-gitops-model-api.service/agent_task_control_token
-Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
-Environment=AIOS_AGENT_ID=online-engineering-worker-cn-network-mkt-autonomous-20260815
-Environment=AIOS_AGENT_VERSION=2026-08-15.4-autonomous-intent
-Environment=AIOS_WORKER_REGISTRATION_STATE=/var/lib/aios-autonomous-agent-worker/registration
-Environment=AIOS_WORKER_ENCRYPTED_CREDENTIAL=/etc/credstore.encrypted/aios-autonomous-agent-worker/agent_token
-Environment=AIOS_HERMES_BROKER_SOCKET=/run/aios-agent-runtime/hermes.sock
-Environment=AIOS_OPENCLAW_BROKER_SOCKET=/run/aios-agent-runtime/openclaw.sock
-ExecStart=/usr/bin/python3 -B /usr/local/lib/aios-autonomous-agent-worker/register.py
-TimeoutStartSec=120
-UMask=0077
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-LockPersonality=true
-RestrictSUIDSGID=true
-RestrictRealtime=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-ReadWritePaths=/etc/credstore.encrypted /var/lib/aios-autonomous-agent-worker
-
-[Install]
-WantedBy=multi-user.target

deploy/systemd/aios-autonomous-agent-worker.service

@@ -1,56 +0,0 @@
-[Unit]
-Description=AIOS Autonomous Intent Engineering Worker (staging)
-After=network-online.target aios-agent-task-api.service aios-agent-runtime-broker@openclaw.service aios-autonomous-agent-register.service
-Wants=network-online.target aios-agent-runtime-broker@openclaw.service
-Requires=aios-autonomous-agent-register.service
-
-[Service]
-Type=simple
-User=aios-autonomous-agent-worker
-Group=aios-autonomous-agent-worker
-SupplementaryGroups=aios-agent-runtime gitops
-LoadCredentialEncrypted=agent_token:/etc/credstore.encrypted/aios-autonomous-agent-worker/agent_token
-Environment=PYTHONUNBUFFERED=1
-Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
-Environment=AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:19998
-Environment=AIOS_AGENT_ID=online-engineering-worker-cn-network-mkt-autonomous-20260815
-Environment=AIOS_AGENT_VERSION=2026-08-15.4-autonomous-intent
-Environment=AIOS_AUTONOMOUS_REPOSITORY=aios/aios
-Environment=AIOS_AUTONOMOUS_BASE_REF=refs/heads/main
-Environment=AIOS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
-Environment=AIOS_AUTONOMOUS_STATE_ROOT=/var/lib/aios-autonomous-agent-worker
-Environment=AIOS_AUTONOMOUS_WORKSPACE_ROOT=/var/lib/aios-autonomous-agent-worker/workspaces
-Environment=AIOS_AUTONOMOUS_POLL_SECONDS=5
-Environment=AIOS_AUTONOMOUS_HEARTBEAT_SECONDS=10
-Environment=AIOS_AUTONOMOUS_LEASE_SECONDS=300
-Environment=AIOS_AUTONOMOUS_RUNTIME_TIMEOUT_SECONDS=3600
-Environment=AIOS_AUTONOMOUS_DEFAULT_ADAPTER=openclaw
-Environment=AIOS_AGENT_RUNTIME_SHARED_GROUP=aios-agent-runtime
-Environment=AIOS_HERMES_BROKER_SOCKET=/run/aios-agent-runtime/hermes.sock
-Environment=AIOS_OPENCLAW_BROKER_SOCKET=/run/aios-agent-runtime/openclaw.sock
-ExecStart=/usr/bin/python3 -B /usr/local/lib/aios-autonomous-agent-worker/autonomous_worker.py
-Restart=always
-RestartSec=5
-TimeoutStopSec=30
-UMask=0027
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-LockPersonality=true
-RestrictSUIDSGID=true
-RestrictRealtime=true
-RestrictNamespaces=true
-MemoryDenyWriteExecute=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-ReadOnlyPaths=/data/aios-gitops/repo.git
-ReadWritePaths=/var/lib/aios-autonomous-agent-worker
-InaccessiblePaths=-/etc/credstore.encrypted
-CapabilityBoundingSet=
-AmbientCapabilities=
-
-[Install]
-WantedBy=multi-user.target

deploy/systemd/aios-chatgpt-bridge-v2-agent-task-projection.conf

@@ -0,0 +1,5 @@
+[Service]
+LoadCredential=agent_task_control_token:/etc/aios-gitops/agent-task-control.token
+Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
+Environment=AIOS_ONLINE_TASK_PROJECTION_ENABLED=1
+Environment=AIOS_AGENT_TASK_CONTROL_TOKEN_FILE=%d/agent_task_control_token

deploy/systemd/aios-online-agent-isolated-executor.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=AIOS uncredentialed deterministic Planner/Executor
+After=local-fs.target
+
+[Service]
+Type=simple
+User=aios-engineering-executor
+Group=aios-executor-exchange
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_isolated_executor.py --root /var/lib/aios-online-agent-executor
+Restart=always
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateNetwork=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET
+IPAddressDeny=any
+IPAddressAllow=localhost
+InaccessiblePaths=/run/credentials
+ReadWritePaths=/var/lib/aios-online-agent-executor
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-online-agent-worker-register-20260815.service

@@ -1,36 +0,0 @@
-[Unit]
-Description=AIOS generic Online Agent register-or-recover (2026-08-15)
-After=network-online.target aios-gitops-model-api.service aios-agent-task-api.service
-Wants=network-online.target
-Before=aios-online-agent-worker-20260815.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-User=root
-Group=root
-LoadCredential=bridge_control_token:/run/credentials/aios-gitops-model-api.service/agent_task_control_token
-Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
-Environment=AIOS_AGENT_ID=online-engineering-worker-cn-network-mkt-generic-20260815
-Environment=AIOS_AGENT_TYPE=trusted-online-engineering-worker
-Environment=AIOS_AGENT_VERSION=2026-08-15.3-generic
-Environment=AIOS_WORKER_ENCRYPTED_CREDENTIAL=/etc/credstore.encrypted/aios-online-agent-worker-20260815/agent_token
-Environment=AIOS_WORKER_REGISTRATION_STATE=/var/lib/aios-online-agent-worker-20260815/registration
-ExecStart=/usr/bin/python3 -B /usr/local/lib/aios-online-agent-worker-20260815/register.py
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-LockPersonality=true
-RestrictSUIDSGID=true
-RestrictRealtime=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-ReadWritePaths=/etc/credstore.encrypted /var/lib/aios-online-agent-worker-20260815
-UMask=0077
-TimeoutStartSec=120
-
-[Install]
-WantedBy=multi-user.target

deploy/systemd/aios-online-agent-worker.service

@@ -1,30 +1,29 @@
 [Unit]
-Description=AIOS generic governed Online Agent Worker (2026-08-15)
-After=aios-agent-task-api.service aios-online-agent-worker-register-20260815.service
-Wants=aios-online-agent-worker-register-20260815.service
+Description=AIOS governed Online Agent Worker
+After=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+Wants=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
 
 [Service]
 Type=simple
 User=aios-engineering-worker
 Group=aios-engineering-worker
-SupplementaryGroups=gitops
+SupplementaryGroups=gitops aios-executor-exchange
 LoadCredentialEncrypted=agent_token:/etc/credstore.encrypted/aios-online-agent-worker-20260815/agent_token
 Environment=PYTHONUNBUFFERED=1
 Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
 Environment=AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:18892
-Environment=AIOS_AGENT_ID=online-engineering-worker-cn-network-mkt-generic-20260815
+Environment=AIOS_AGENT_ID=online-engineering-worker
 Environment=AIOS_AGENT_TYPE=trusted-online-engineering-worker
-Environment=AIOS_AGENT_VERSION=2026-08-15.3-generic
+Environment=AIOS_AGENT_VERSION=2026-08-17.1-dynamic
+Environment=AIOS_WORKER_CAPABILITIES=git.read,git.test,governed.write.branch,governed.write.file
 Environment=AIOS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
-Environment=AIOS_WORKER_STATE_ROOT=/var/lib/aios-online-agent-worker-20260815
-Environment=AIOS_WORKER_WORKSPACE_ROOT=/var/lib/aios-online-agent-worker-20260815/workspaces
-Environment=AIOS_WORKER_POLL_SECONDS=5
-Environment=AIOS_WORKER_HEARTBEAT_SECONDS=10
-Environment=AIOS_WORKER_LEASE_SECONDS=300
-ExecStart=/usr/bin/python3 -B /usr/local/lib/aios-online-agent-worker-20260815/online_agent_worker.py
+Environment=AIOS_ISOLATED_EXECUTOR_ROOT=/var/lib/aios-online-agent-executor
+Environment=AIOS_WORKER_STATE_ROOT=/var/lib/aios-online-agent-worker
+Environment=AIOS_WORKER_WORKSPACE_ROOT=/var/lib/aios-online-agent-worker/workspaces
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_online_agent_worker.py
 Restart=always
 RestartSec=5
-TimeoutStopSec=15
+TimeoutStopSec=20
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
@@ -39,7 +38,7 @@ RestrictNamespaces=true
 MemoryDenyWriteExecute=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 ReadOnlyPaths=/data/aios-gitops/repo.git
-ReadWritePaths=/var/lib/aios-online-agent-worker-20260815
+ReadWritePaths=/var/lib/aios-online-agent-worker
 UMask=0027
 
 [Install]

deploy/systemd/aios-online-engineering-consumer.service

@@ -0,0 +1,45 @@
+[Unit]
+Description=AIOS trusted dynamic engineering consumer
+After=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+Wants=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+
+[Service]
+Type=simple
+User=aios-engineering-worker
+Group=aios-engineering-worker
+SupplementaryGroups=gitops aios-executor-exchange
+LoadCredentialEncrypted=agent_token:/etc/credstore.encrypted/aios-online-engineering-20260815/agent_token
+Environment=PYTHONUNBUFFERED=1
+Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
+Environment=AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:18892
+Environment=AIOS_AGENT_ID=online-engineering-consumer
+Environment=AIOS_AGENT_TYPE=trusted-online-engineering-worker
+Environment=AIOS_AGENT_VERSION=2026-08-17.1-dynamic
+Environment=AIOS_WORKER_CAPABILITIES=git.read,git.test,governed.write.branch,governed.write.file
+Environment=AIOS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
+Environment=AIOS_ISOLATED_EXECUTOR_ROOT=/var/lib/aios-online-agent-executor
+Environment=AIOS_WORKER_STATE_ROOT=/var/lib/aios-online-engineering-consumer
+Environment=AIOS_WORKER_WORKSPACE_ROOT=/var/lib/aios-online-engineering-consumer/workspaces
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_online_agent_worker.py
+Restart=always
+RestartSec=5
+TimeoutStopSec=20
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadOnlyPaths=/data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-online-engineering-consumer
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/sysusers.d/aios-online-agent-executor.conf

@@ -0,0 +1,4 @@
+g aios-executor-exchange -
+u aios-engineering-executor - "AIOS isolated engineering executor" /var/lib/aios-online-agent-executor /usr/sbin/nologin
+m aios-engineering-executor aios-executor-exchange
+m aios-engineering-worker aios-executor-exchange

deploy/tmpfiles.d/aios-online-agent-executor.conf

@@ -0,0 +1,5 @@
+d /var/lib/aios-online-agent-executor 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/requests 2770 aios-engineering-worker aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/results 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/failed 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/sources 2770 aios-engineering-worker aios-executor-exchange -

docs/autonomous-intent-worker-v2.md

@@ -1,110 +0,0 @@
-# Autonomous Intent Worker v2
-
-## Goal
-
-A Custom GPT or other trusted producer creates a prose engineering task with:
-
-- `goal`
-- `instructions`
-- `success_criteria`
-- `required_capabilities`
-
-A long-running autonomous worker claims only tasks explicitly marked with:
-
-- `intent.task`
-- `engineering.execute`
-
-and only when the requested engineering runtime capability is actually
-available, e.g. `agent.runtime.hermes`.
-
-The runtime edits a disposable worktree. The worker independently inspects the
-diff, scans for secrets, reruns verification, and persists through staging
-Governed GitOps.
-
-## Security domains
-
-The Online Agent worker owns task/lease/governed-write credentials.
-
-The runtime broker is a separate service identity. It authorizes the worker
-over Unix `SO_PEERCRED`, opens the worktree using `O_PATH|O_NOFOLLOW`, and
-passes a pinned `/proc/self/fd/<fd>` path to the engineering backend. The
-backend never receives the Agent Task token or writer lease.
-
-The worker rejects:
-- a runtime-created Git commit (`HEAD != base_oid`);
-- direct authoritative ref mutation/push;
-- sensitive credential/key paths;
-- obvious secret material;
-- non-staging Governed Bridge endpoints.
-
-## Staging boundary
-
-`autonomous_worker.py` intentionally rejects any Governed Write API base other
-than:
-
-`http://127.0.0.1:19998`
-
-Production/main/tag/baseline/force-push writes remain outside this worker.
-
-## Migration protection
-
-The worker does not infer intent from prose. Historical tasks without
-`intent.task` are skipped before claim, so they do not lose an attempt.
-
-The bootstrap task
-`implement-autonomous-intent-worker-v2-20260815` currently lacks the intent
-marker and is therefore intentionally not claimable by this worker. That is a
-control-plane/bootstrap concern, not a reason to weaken the runtime rule.
-
-## Runtime requirement
-
-A chat/WeChat Hermes endpoint is not enough. A compliant engineering backend
-must:
-1. accept `aios.online-agent.runtime-request.v1`;
-2. inspect and mutate the supplied disposable worktree;
-3. leave Git HEAD unchanged;
-4. return `aios.online-agent.runtime-result.v1`.
-
-The exact installed Hermes/Codex interface is host-specific and must be
-discovered before configuring the broker. No CLI flags are invented here.
-
-## Activation gate
-
-Do not register or enable the autonomous consumer until:
-1. a real engineering backend is found;
-2. broker is configured with that backend;
-3. `runtime_selftest.py` reports PASS;
-4. backend has no Agent Task token or writer lease.
-
-After activation, complete D/E/F/G:
-- D: native intent task, no `metadata.execution`;
-- E: goal-only engineering task, runtime finds files/root cause;
-- F: unavailable runtime capability remains unclaimed;
-- G: restart during real runtime execution, no duplicate commit/branch.
-
-
-## OpenClaw backend candidate
-
-A current OpenClaw installation can be used as an autonomous engineering
-runtime without making OpenClaw itself an AIOS Task API client.
-
-The bundled wrapper uses the official headless coding entry point:
-
-```text
-openclaw agent exec
-  --message-file -
-  --cwd <pinned-disposable-worktree>
-  --model <verified-provider/model>
-  --auth-env-only
-  --timeout <seconds>
-  --json
-```
-
-Reference used for implementation:
-`https://docs.openclaw.ai/cli/agent`
-
-The wrapper maps the stable OpenClaw JSON envelope into
-`aios.online-agent.runtime-result.v1`. The AIOS worker remains responsible for
-claim/heartbeat, independent diff verification and Governed GitOps.
-
-OpenClaw is advertised as `agent.runtime.openclaw`, not as Hermes or Codex.

docs/gitops/openapi-chatgpt-actions.yaml

@@ -240,6 +240,114 @@ components:
       additionalProperties: false
       properties:
         candidate_id: {type: string}
+    BridgeWriterLeaseRecoveryRequest:
+      type: object
+      additionalProperties: false
+      required: [schema, task_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds]
+      properties:
+        schema:
+          type: string
+          enum: [aios.task-writer-lease.v2, aios.task-writer-lease-request.v2]
+        task_id: {type: string, minLength: 1, maxLength: 256}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
+        base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        lease_seconds: {type: integer, minimum: 1, maximum: 86400}
+    BridgeWriterLeaseResponse:
+      type: object
+      additionalProperties: false
+      required: [schema, task_id, job_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds, create_target_branch, worktree_mode, cas_ref_update_required]
+      properties:
+        schema: {type: string, enum: [aios.task-writer-lease.v2]}
+        task_id: {type: string}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
+        base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        lease_seconds: {type: integer, minimum: 1, maximum: 86400}
+        create_target_branch: {type: boolean}
+        worktree_mode: {type: string, enum: [detached_at_base_oid, detached_at_expected_head]}
+        cas_ref_update_required: {type: boolean, const: true}
+        lease_expires_at: {type: string, format: date-time}
+    BridgeWriterLeaseRecoveryResponse:
+      type: object
+      additionalProperties: false
+      required: [schema, task_id, job_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds, lease_expires_at, create_target_branch, worktree_mode, cas_ref_update_required, recovered, bootstrapped, idempotent, runtime_rehydrated, durable_branch_lease_present]
+      properties:
+        schema: {type: string, enum: [aios.task-writer-lease.v2]}
+        task_id: {type: string}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
+        base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        lease_seconds: {type: integer, minimum: 1, maximum: 86400}
+        lease_expires_at: {type: string, format: date-time}
+        create_target_branch: {type: boolean, const: false}
+        worktree_mode: {type: string, enum: [detached_at_base_oid, detached_at_expected_head]}
+        cas_ref_update_required: {type: boolean, const: true}
+        recovered: {type: boolean}
+        bootstrapped: {type: boolean}
+        idempotent: {type: boolean}
+        runtime_rehydrated: {type: boolean}
+        durable_branch_lease_present: {type: boolean}
+    BridgeCommitFileRequest:
+      type: object
+      additionalProperties: false
+      required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, path, content_base64, message]
+      properties:
+        task_id: {type: string, minLength: 1}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        idempotency_key: {type: string, minLength: 1, maxLength: 256}
+        path: {type: string, minLength: 1, maxLength: 512}
+        content_base64: {type: string, format: byte}
+        message: {type: string, minLength: 1, maxLength: 200}
+    BridgeCommitFilesRequest:
+      type: object
+      additionalProperties: false
+      required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, files, message]
+      properties:
+        task_id: {type: string, minLength: 1}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        idempotency_key: {type: string, minLength: 1, maxLength: 256}
+        files: {type: object, additionalProperties: {type: string, format: byte}, minProperties: 1}
+        message: {type: string, minLength: 1, maxLength: 200}
+    BridgeCommitResponse:
+      type: object
+      additionalProperties: true
+      required: [job_id, commit_oid, commit_visible, branch_mode, target_branch, generation]
+      properties:
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        commit_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        commit_visible: {type: boolean}
+        branch_mode: {type: string, enum: [CONTINUE_EXISTING]}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+    BridgeGovernedCapabilities:
+      type: object
+      required: [bridge_schema_version, governed_writes_enabled, operations, operation_contracts]
+      properties:
+        bridge_schema_version: {type: string, const: aios.chatgpt-gitops-bridge.v2}
+        governed_writes_enabled: {type: boolean, const: true}
+        operations: {type: array, items: {type: string}}
+        operation_contracts: {type: object, additionalProperties: true}
 paths:
   /createReleaseIntent:
     post:
@@ -567,3 +675,206 @@ paths:
         '200': {description: Safe GitOps plan}
         '401': {description: Unauthorized}
       x-openai-isConsequential: true
+  /v2/capabilities:
+    get:
+      operationId: getGovernedWriteCapabilities
+      summary: Read the governed Bridge v2 capability contract
+      responses:
+        '200':
+          description: Governed operations and their request/response contracts
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeGovernedCapabilities'}
+  /v2/writer-lease:
+    post:
+      operationId: acquireWriterLease
+      summary: Acquire the exact governed writer lease for a task generation
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
+      responses:
+        '200':
+          description: Exact detached worktree lease binding
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeWriterLeaseResponse'}
+        '400': {description: Invalid lease binding}
+        '409': {description: Branch, base, or generation conflict}
+      x-openai-isConsequential: true
+  /v2/writer-lease/bootstrap:
+    post:
+      operationId: bootstrapWriterLease
+      summary: Bootstrap a governed writer runtime without creating a durable lease
+      description: >
+        Staging-only runtime recovery. It validates the exact task, repository,
+        base OID, expected branch OID, target branch, and generation. It must
+        not create a branch, insert a branch lease, or consume a generation.
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
+      responses:
+        '200':
+          description: Runtime binding bootstrapped or returned idempotently
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryResponse'}
+        '400': {description: Invalid lease binding}
+        '409': {description: A matching durable lease already exists or binding conflicts}
+        '503': {description: Runtime or durable state unavailable}
+      x-openai-isConsequential: true
+  /v2/writer-lease/renew:
+    post:
+      operationId: renewWriterLease
+      summary: Recover an expired governed writer lease without changing its binding
+      description: >
+        Renews only the current task generation and exact repository, base OID,
+        expected branch OID, and target branch. Durable renewal is revision-CAS
+        protected; runtime rehydration is reported separately.
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
+      responses:
+        '200':
+          description: Lease recovered or idempotently observed as already active
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryResponse'}
+        '400': {description: Invalid schema, generation, or lease duration}
+        '409': {description: Task, base, repository, branch, generation, or durable lease conflict}
+        '503': {description: Durable job store or runtime unavailable}
+      x-openai-isConsequential: true
+  /v2/commit-file:
+    post:
+      operationId: commitFileGoverned
+      summary: Commit one file through the governed writer lease
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeCommitFileRequest'}
+      responses:
+        '200':
+          description: Authority and remote visibility receipt
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeCommitResponse'}
+        '409': {description: Lease, expected-head, idempotency, or repository conflict}
+        '503': {description: Reconciliation required}
+      x-openai-isConsequential: true
+  /v2/commit-files:
+    post:
+      operationId: commitFilesGoverned
+      summary: Atomically commit a bounded set of files through the governed writer lease
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeCommitFilesRequest'}
+      responses:
+        '200':
+          description: Authority and remote visibility receipt
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeCommitResponse'}
+        '409': {description: Lease, expected-head, idempotency, or repository conflict}
+        '503': {description: Reconciliation required}
+      x-openai-isConsequential: true
+
+  /v2/execution-envelope:
+    post:
+      operationId: projectOnlineAgentExecution
+      summary: Project the canonical execution envelope for an existing governed task
+      description: Returns the durable task binding and canonical source_capture or deterministic projection.
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required: [task_id]
+              properties:
+                task_id: {type: string, minLength: 3}
+      responses:
+        '200':
+          description: Canonical execution envelope
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [schema, task_id, job_id, action, execution_digest]
+                properties:
+                  schema: {type: string, enum: [aios.online-agent.execution.v2]}
+                  task_id: {type: string}
+                  job_id: {type: string}
+                  action: {type: string, enum: [source_capture, deterministic]}
+                  execution_digest: {type: string, pattern: '^[0-9a-f]{64}$'}
+                  execution: {type: object, additionalProperties: true}
+        '400': {description: Missing or invalid task binding}
+        '409': {description: Canonical projection conflict}
+      x-openai-isConsequential: true
+  /v2/execution-plan:
+    post:
+      operationId: registerOnlineAgentExecutionPlan
+      summary: Register a deterministic plan for an existing governed task
+      description: Registers a non-empty deterministic change set and bounded verification plan against the exact source head.
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required: [schema, task_id, job_id, source_head_oid, generation, idempotency_key, execution]
+              properties:
+                schema: {type: string, enum: [aios.online-agent.plan.v1]}
+                task_id: {type: string, minLength: 3}
+                job_id: {type: string, minLength: 8}
+                source_head_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+                generation: {type: integer, minimum: 1}
+                idempotency_key: {type: string, minLength: 8}
+                expected_previous_plan_digest: {type: string, pattern: '^[0-9a-f]{64}$'}
+                execution:
+                  type: object
+                  additionalProperties: false
+                  required: [action, change_set, verification]
+                  properties:
+                    action: {type: string, const: deterministic}
+                    adapter: {type: string}
+                    capability_scope: {type: array, items: {type: string}}
+                    change_set: {type: array, minItems: 1, maxItems: 128, items: {type: object, additionalProperties: true}}
+                    verification: {type: array, maxItems: 128, items: {type: object, additionalProperties: true}}
+      responses:
+        '200':
+          description: Deterministic plan registered or returned idempotently
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [schema, task_id, job_id, source_head_oid, generation, idempotency_key, plan_digest, execution]
+                properties:
+                  schema: {type: string, enum: [aios-online-agent.plan-record.v1]}
+                  task_id: {type: string}
+                  job_id: {type: string}
+                  source_head_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+                  generation: {type: integer}
+                  idempotency_key: {type: string}
+                  plan_digest: {type: string, pattern: '^[0-9a-f]{64}$'}
+                  execution: {type: object, additionalProperties: true}
+                  execution_digest: {type: string, pattern: '^[0-9a-f]{64}$'}
+        '400': {description: Invalid deterministic plan or source head}
+        '409': {description: Binding, idempotency, or replacement CAS conflict}
+      x-openai-isConsequential: true

docs/superpowers/specs/2026-08-17-online-agent-auto-claim-design.md

@@ -0,0 +1,134 @@
+# Online Agent Automatic Claim Infrastructure
+
+## Status and fixed boundary
+
+This candidate targets `p0-claim-online-agent-auto-execution-20260817` on governed Job
+`job-2031a9e5682a4238f98e3ac7aee8a593`, base
+`a642b045775b9154a00ae78543037fbef4fb447b`, target branch
+`agent/p0-claim-online-agent-auto-execution-20260817`, generation 1.
+
+It does not authorize protected-main, Production, tag, baseline, raw Git, Task DB, or
+credential mutations.
+
+## Considered approaches
+
+1. Require every caller to write `metadata.execution`. This is simple but preserves the
+   current operational gap: a valid governed Job can still project an unexecutable Online
+   Task.
+2. Let workers infer repository and WriterLease coordinates from natural-language Task
+   fields. This removes the skip but violates fail-closed lineage and can bind the wrong Job,
+   branch, base, or generation.
+3. Use a canonical server-side projector plus a task-agnostic worker resolver. This is the
+   selected approach. The governed binding remains the only authority for repository, Job,
+   branch, base, expected head, generation, and idempotency. Producers can persist the
+   projected envelope when creating the Online Task. A worker may recover an omitted envelope
+   only from the same canonical projector and durable binding; it never guesses coordinates.
+
+## Components
+
+### Canonical execution contract
+
+`aios_online_agent_execution.py` owns schema `aios.online-agent.execution.v2`. It validates
+the complete governed lineage and supports two explicit actions:
+
+- `deterministic`: a hash-bound change set, verification commands, and governed commit;
+- `source_capture`: a read-only first attempt that returns `NEEDS_REWORK_SOURCE_CAPTURE` and
+  cannot acquire WriterLease or mutate Git.
+
+Wrong task, Job, repository, base, expected head, branch, generation, capability scope, or
+governance policy fails closed with a canonical diagnostic.
+
+### Governed Job to Online Task projection
+
+`GovernedTaskBootstrap` exposes an exact durable binding lookup and builds Online Task
+projection data through the canonical contract. When the Bridge is configured with the
+official Agent Task control credential reference, governed Job creation submits that complete
+projection through the official Task HTTP API. The Bridge also exposes a loopback envelope
+projection operation used for recovery. The persisted projection includes the versioned
+envelope rather than relying on manual metadata edits.
+
+Projection delivery is a durable outbox, not a best-effort tail call. The outbox record is
+written before HTTP delivery and a Bridge reconciler retries it after transient API failure or
+process restart. A response is accepted only when its complete execution envelope equals the
+submitted projection. Requests that explicitly require projection are rejected before governed
+bootstrap when the projection principal is unavailable.
+
+Loopback is not treated as an identity boundary. Every POST route requires an exact
+runtime-principal bearer credential supplied by systemd credential projection; unauthenticated
+local callers are denied before request dispatch. The control-plane credential used to create
+Online Tasks remains a separate Bridge-only reference and is never projected into the worker.
+
+For legacy Online Tasks with an omitted envelope, the generic worker asks the same Bridge
+operation for a read-only `source_capture` envelope. Projection succeeds only when the exact
+durable binding exists. An omitted envelope is therefore recoverable; an invalid envelope is
+never replaced or weakened.
+
+Persisted envelopes are also reprojected through the Bridge before claim and compared by exact
+digest and Job lineage. A self-consistent client-generated envelope is therefore not authority.
+
+### Dynamic worker and trusted consumer
+
+The repository gains a deployable generic worker and systemd unit definitions as governed
+source files. The worker validates or
+resolves an envelope before claim, revalidates after atomic claim, starts heartbeat, and then
+executes the selected action. The trusted engineering consumer uses this same task-agnostic
+entrypoint. No compiled worker contains a Task ID, base OID, branch, generation, or plan path.
+
+Skip observability distinguishes:
+
+- `TASK_SKIPPED_PROJECTION_MISSING`;
+- `TASK_SKIPPED_ENVELOPE_INVALID`;
+- `TASK_SKIPPED_CAPABILITY_MISMATCH`;
+- `TASK_SKIPPED_POLICY_DENY`;
+- `TASK_POLL_FAILED` / worker unavailable.
+
+## State flow
+
+```text
+Governed Job BOUND
+  -> canonical durable binding
+  -> Online Task projection with execution.v2
+  -> capability-filtered poll
+  -> envelope and lineage validation
+  -> atomic claim
+  -> initial heartbeat/start
+  -> refetch Task and re-resolve envelope
+  -> compare execution digest and Job
+  -> source capture OR deterministic governed execution
+  -> result construction
+  -> result submission
+  -> external server-side verification gate
+```
+
+Legacy omission uses `binding -> source_capture projection` between poll and validation. It
+does not write Task metadata and does not convert a malformed envelope into a valid one.
+
+## Recovery and safety
+
+- Projection is deterministic and digest-bound.
+- Governed Task creation is serialized by a cross-process, Task-ID-digest lock. Durable paths
+  use collision-resistant exact Task keys while retaining read compatibility with verified
+  legacy bindings.
+- A new Task cannot adopt an existing branch from caller-selected generation data. It must name
+  an exact durable parent Task/Job whose single ACTIVE lease owns the branch head; generation is
+  then derived from that lease.
+- Claim is attempted only after validation; claimed payload drift is denied.
+- Source capture has no WriterLease or commit path.
+- Deterministic execution retains detached worktree, exact WriterLease, governed commit,
+  durable current-head CAS, and receipt convergence.
+- Local deterministic recovery is keyed by Task and execution digest; live acceptance must
+  independently reconverge Job, lease, receipt, and branch OIDs before verification.
+- An ambiguous commit transport or server outcome becomes `RECONCILIATION_REQUIRED`; the
+  worker does not submit a canonical failure until exact Job receipt and head evidence is
+  observed.
+- A completed read-only `source_capture` state is ignored when a later attempt has a changed
+  digest and no governed state exists; all other digest drift is denied.
+- Protected refs are never worker targets.
+
+## Acceptance
+
+The implementation must pass the named projection, schema, claimability, dynamic-binding,
+wrong-lineage, capability, P0-A, and P0-B tests. Runtime acceptance additionally requires a
+real Online Task to be claimed and heartbeated without per-task worker or systemd plan
+injection, plus governed receipt/OID/CAS convergence for this implementation Task.
+Unit tests and deployable unit definitions do not by themselves satisfy runtime acceptance.

docs/superpowers/specs/2026-08-17-p0-claim-scheme-a-followup.md

@@ -0,0 +1,56 @@
+# P0-CLAIM Scheme A follow-up
+
+This follow-up continues the existing candidate `71523aef6e48b1e2fa516c456ca189b7a039104b`.
+It does not create a replacement Task, Job, branch or generation.
+
+## Retry extension
+
+A versioned Owner-controlled loopback API provides
+`POST /v1/tasks/{task_id}/retry-extension`.
+
+The request binds FAILED status, revision, exhausted attempt/max_attempts, next max attempts,
+previous verification SHA256, Owner authorization ID and idempotency key. The service performs one
+SQLite `BEGIN IMMEDIATE` transaction containing the CAS update, durable retry-extension record and
+Task event. Each authorization extends the boundary by exactly one attempt.
+
+## Same-Job continuation
+
+The durable GovernedTask binding remains the lineage anchor. After the first CREATE_NEW commit,
+`execution_binding()` may normalize that SAME Job to `CONTINUE_EXISTING` only when exactly one
+ACTIVE WriterLease for the Job owns the current authority branch head, generation and lineage
+anchor. The lineage `base_oid` stays unchanged; only `expected_branch_oid` becomes the current head.
+
+GovernedTask creation is also serialized by a branch-digest lock, preventing sibling continuation
+tasks from racing generation admission.
+
+## Projection and recovery
+
+Natural-language source signals are normalized server-side to at most 16 unique 512-byte values.
+Malformed persisted envelopes still fail closed.
+
+Fresh commits and recovery require a COMPLETED Job, `remote_verified=true`, exact
+authority/API/remote receipt OIDs, and exactly one ACTIVE WriterLease whose durable current head
+matches the commit. Delayed local ref visibility becomes `RECONCILIATION_REQUIRED`, not a terminal
+canonical failure.
+
+## Credential isolation
+
+The credentialed Coordinator performs only Task/Bridge coordination and governed commit. All
+deterministic repository modification and test commands run in
+`aios-online-agent-isolated-executor` under a separate system user with:
+
+- no Agent/Owner credential projection;
+- no gitops supplementary group;
+- `PrivateNetwork=true`;
+- `RestrictAddressFamilies=AF_UNIX AF_INET`, with `IPAddressDeny=any` and
+  `IPAddressAllow=localhost`, so regression tests may use an isolated loopback
+  HTTP server without gaining host or external network reachability;
+- `InaccessiblePaths=/run/credentials`.
+
+The executor receives a hash-bound source archive and deterministic change set through a filesystem
+exchange and returns only changed file bytes/hashes plus command evidence. The Coordinator validates
+that response before materializing exact allowed files and calling the governed Bridge.
+
+Codex/Hermes mutation adapters remain disabled until a separately audited uncredentialed planner
+backend exists. Under the current operating model, implementation code is authored before Online
+Agent execution and is carried as a deterministic plan.

services/aios-agent-runtime-broker/RUNTIME_CONTRACT.md

@@ -1,93 +0,0 @@
-# Autonomous Engineering Runtime Contract v1
-
-The Online Agent Worker and the Hermes/Codex engineering runtime are separate
-security domains.
-
-The worker owns:
-- Agent Task polling, atomic claim, task lease and heartbeat;
-- intent resolution and restart state;
-- authoritative repository/base selection;
-- independent diff inspection and secret checks;
-- verification command allowlisting and re-execution;
-- Governed GitOps task/lease/commit;
-- final result submission.
-
-The runtime broker and Hermes/Codex backend do **not** receive:
-- Agent Task API token;
-- task lease token;
-- governed writer lease or Bridge credential;
-- authority repository write access.
-
-## stdin request
-
-The backend configured behind the broker receives one JSON object:
-
-`schema = aios.online-agent.runtime-request.v1`
-
-It contains task goal/instructions/success criteria and a pinned disposable
-worktree path. The backend may inspect and modify that worktree. It must not
-commit or push.
-
-## stdout response
-
-The backend returns one JSON object:
-
-```json
-{
-  "schema": "aios.online-agent.runtime-result.v1",
-  "status": "COMPLETED",
-  "summary": "root cause and implementation summary",
-  "verification": [
-    {
-      "label": "focused test",
-      "argv": ["/usr/bin/python3", "-m", "pytest", "-q", "tests/test_x.py"],
-      "cwd": ".",
-      "timeout_seconds": 600
-    }
-  ],
-  "evidence": {
-    "root_cause": "..."
-  }
-}
-```
-
-`status` may also be `BLOCKED` or `FAILED`.
-
-The worker ignores any backend claim about changed files and independently reads
-Git state. It also reruns verification requests through its local command
-allowlist.
-
-## Real runtime requirement
-
-A chat/router/WeChat Hermes service is not an engineering backend. A compliant
-backend must be able to read and mutate the disposable worktree and emit the
-runtime result schema above.
-
-The exact Hermes/Codex CLI/API must be discovered from the installed runtime.
-Do not invent flags. `/etc/aios/agent-runtime-hermes.conf` contains only
-non-secret backend command configuration. Any model/runtime credential must be
-delivered to the broker/backend through its own systemd credential projection,
-never through the Online Agent worker token.
-
-
-## OpenClaw headless engineering backend
-
-For hosts that have a current OpenClaw CLI, use the bundled
-`openclaw_engineering_backend.py`.
-
-The wrapper invokes the documented headless coding entry point:
-
-`openclaw agent exec --message-file - --cwd <pinned-worktree> --model <model> --auth-env-only --timeout <seconds> --json`
-
-It deliberately does **not** use the Gateway/WeChat/chat route. `agent exec`
-runs an embedded, one-shot agent turn and scopes its workspace/tool working
-directory to `--cwd`.
-
-Provider credentials, if required, are projected into the broker service under
-separate systemd credentials and mapped to provider environment variables only
-for the OpenClaw child. The Online Agent Task token and writer lease remain
-absent.
-
-Before enabling the autonomous worker, run a disposable broker self-test that
-proves OpenClaw changes the requested worktree while Git HEAD remains at the
-base OID.

services/aios-agent-runtime-broker/broker.py

@@ -1,297 +0,0 @@
-#!/usr/bin/env python3
-from __future__ import annotations
-
-import array
-import json
-import os
-from pathlib import Path
-import pwd
-import re
-import socket
-import stat
-import subprocess
-from typing import Any, Mapping
-
-
-MAX_BYTES = 1024 * 1024
-ADAPTER = os.environ.get("AIOS_AGENT_RUNTIME_ADAPTER", "").strip()
-SOCKET_PATH = Path(os.environ.get("AIOS_AGENT_RUNTIME_SOCKET", ""))
-WORKSPACE_ROOT = Path(os.environ.get("AIOS_AGENT_RUNTIME_WORKSPACE_ROOT", ""))
-BACKEND_ARGV_JSON = os.environ.get("AIOS_AGENT_RUNTIME_BACKEND_ARGV_JSON", "")
-ALLOWED_PEER_UID = int(os.environ.get("AIOS_AGENT_RUNTIME_ALLOWED_PEER_UID", "-1"))
-ALLOWED_PEER_USER = os.environ.get("AIOS_AGENT_RUNTIME_ALLOWED_PEER_USER", "").strip()
-CONNECTION_TIMEOUT = float(os.environ.get("AIOS_AGENT_RUNTIME_CONNECTION_TIMEOUT_SECONDS", "15"))
-BACKEND_TIMEOUT = int(os.environ.get("AIOS_AGENT_RUNTIME_BACKEND_TIMEOUT_SECONDS", "3600"))
-BACKEND_ENV_ALLOWLIST = (
-    "AIOS_OPENCLAW_BIN",
-    "AIOS_OPENCLAW_MODEL",
-    "AIOS_OPENCLAW_PROVIDER_CREDENTIAL_MAP_JSON",
-    "AIOS_OPENCLAW_EXEC_TIMEOUT_SECONDS",
-)
-SENSITIVE_RE = re.compile(r"(?i)(authorization\s*:\s*bearer\s+\S+|(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+)")
-
-
-class BrokerError(RuntimeError):
-    def __init__(self, code: str, *, details: Mapping[str, Any] | None = None) -> None:
-        super().__init__(code)
-        self.code = code
-        self.details = dict(details or {})
-
-
-def peer_uid(connection: socket.socket) -> int:
-    if not hasattr(socket, "SO_PEERCRED"):
-        raise BrokerError("SO_PEERCRED_UNAVAILABLE")
-    raw = connection.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12)
-    pid, uid, gid = array.array("i", raw[:12])
-    return int(uid)
-
-
-def configured_peer_uid() -> int:
-    if ALLOWED_PEER_UID >= 0:
-        return ALLOWED_PEER_UID
-    if not ALLOWED_PEER_USER:
-        raise BrokerError("ALLOWED_PEER_UID_NOT_CONFIGURED")
-    try:
-        return int(pwd.getpwnam(ALLOWED_PEER_USER).pw_uid)
-    except KeyError as exc:
-        raise BrokerError("ALLOWED_PEER_USER_NOT_FOUND") from exc
-
-
-def authorize_peer(connection: socket.socket) -> None:
-    uid = peer_uid(connection)
-    expected = configured_peer_uid()
-    if uid != expected:
-        raise BrokerError("PEER_UID_REJECTED", details={"peer_uid": uid})
-
-
-def read_request(connection: socket.socket) -> dict[str, Any]:
-    connection.settimeout(CONNECTION_TIMEOUT)
-    total = 0
-    chunks: list[bytes] = []
-    while True:
-        try:
-            chunk = connection.recv(65536)
-        except socket.timeout as exc:
-            raise BrokerError("REQUEST_TIMEOUT") from exc
-        if not chunk:
-            break
-        total += len(chunk)
-        if total > MAX_BYTES:
-            raise BrokerError("REQUEST_TOO_LARGE")
-        chunks.append(chunk)
-    try:
-        value = json.loads(b"".join(chunks).decode("utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise BrokerError("REQUEST_INVALID_JSON") from exc
-    if not isinstance(value, Mapping):
-        raise BrokerError("REQUEST_OBJECT_REQUIRED")
-    return dict(value)
-
-
-def backend_argv() -> list[str]:
-    try:
-        value = json.loads(BACKEND_ARGV_JSON)
-    except json.JSONDecodeError as exc:
-        raise BrokerError("BACKEND_ARGV_JSON_INVALID") from exc
-    if not isinstance(value, list) or not value or not all(isinstance(item, str) and item for item in value):
-        raise BrokerError("BACKEND_ARGV_INVALID")
-    executable = Path(value[0])
-    if not executable.is_absolute():
-        raise BrokerError("BACKEND_EXECUTABLE_INVALID")
-    try:
-        resolved = executable.resolve(strict=True)
-    except OSError as exc:
-        raise BrokerError("BACKEND_EXECUTABLE_INVALID") from exc
-    if not resolved.is_file():
-        raise BrokerError("BACKEND_EXECUTABLE_INVALID")
-    return list(value)
-
-
-def validate_request(value: Mapping[str, Any]) -> tuple[dict[str, Any], int]:
-    if value.get("schema") != "aios.online-agent.runtime-request.v1":
-        raise BrokerError("REQUEST_SCHEMA_INVALID")
-    if value.get("adapter") != ADAPTER or ADAPTER not in {"hermes", "codex", "openclaw"}:
-        raise BrokerError("REQUEST_ADAPTER_INVALID")
-    context = value.get("execution_context")
-    policy = value.get("policy")
-    if not isinstance(context, Mapping) or not isinstance(policy, Mapping):
-        raise BrokerError("REQUEST_CONTEXT_INVALID")
-    worktree_raw = context.get("worktree")
-    if not isinstance(worktree_raw, str):
-        raise BrokerError("REQUEST_WORKTREE_INVALID")
-    for field in (
-        "authoritative_repository_write",
-        "direct_git_ref_mutation",
-        "direct_git_push",
-        "direct_git_commit",
-        "main_write",
-        "force_push",
-        "production_write",
-        "tag_write",
-        "baseline_write",
-        "task_api_credential_visible",
-        "writer_lease_visible",
-    ):
-        if policy.get(field) is not False:
-            raise BrokerError("REQUEST_POLICY_REJECTED", details={"field": field})
-
-    root = WORKSPACE_ROOT.resolve()
-    candidate = Path(worktree_raw)
-    if not candidate.is_absolute():
-        raise BrokerError("REQUEST_WORKTREE_INVALID")
-    parent = candidate.parent.resolve()
-    if root == parent or root not in parent.parents:
-        raise BrokerError("REQUEST_WORKTREE_OUT_OF_SCOPE")
-
-    flags = getattr(os, "O_PATH", os.O_RDONLY) | getattr(os, "O_NOFOLLOW", 0) | os.O_DIRECTORY
-    try:
-        fd = os.open(str(candidate), flags)
-    except OSError as exc:
-        raise BrokerError("REQUEST_WORKTREE_OPEN_FAILED") from exc
-    st = os.fstat(fd)
-    if not stat.S_ISDIR(st.st_mode):
-        os.close(fd)
-        raise BrokerError("REQUEST_WORKTREE_NOT_DIRECTORY")
-    pinned = Path(f"/proc/self/fd/{fd}")
-    try:
-        resolved = pinned.resolve(strict=True)
-    except OSError:
-        os.close(fd)
-        raise BrokerError("REQUEST_WORKTREE_PIN_FAILED")
-    if root not in resolved.parents:
-        os.close(fd)
-        raise BrokerError("REQUEST_WORKTREE_OUT_OF_SCOPE")
-    return dict(value), fd
-
-
-def sanitize(value: Any) -> Any:
-    if isinstance(value, Mapping):
-        cleaned: dict[str, Any] = {}
-        for key, inner in value.items():
-            lowered = str(key).lower()
-            if any(marker in lowered for marker in ("token", "secret", "credential", "authorization", "password", "api_key", "apikey", "access_key")):
-                cleaned[str(key)] = "[REDACTED]"
-            else:
-                cleaned[str(key)] = sanitize(inner)
-        return cleaned
-    if isinstance(value, list):
-        return [sanitize(item) for item in value]
-    if isinstance(value, str):
-        return SENSITIVE_RE.sub("[REDACTED]", value)
-    return value
-
-
-def sanitized_failure(code: str, details: Mapping[str, Any] | None = None) -> dict[str, Any]:
-    safe: dict[str, Any] = {}
-    for key, value in dict(details or {}).items():
-        lowered = str(key).lower()
-        if any(marker in lowered for marker in ("token", "secret", "credential", "authorization", "password", "api_key", "apikey", "access_key")):
-            safe[str(key)] = "[REDACTED]"
-        else:
-            safe[str(key)] = value
-    return {
-        "schema": "aios.online-agent.runtime-result.v1",
-        "status": "FAILED",
-        "summary": code,
-        "verification": [],
-        "evidence": safe,
-    }
-
-
-def execute_backend(request: Mapping[str, Any], worktree_fd: int) -> dict[str, Any]:
-    argv = backend_argv()
-    request = dict(request)
-    context = dict(request["execution_context"])
-    # Pass a pinned inode-backed path, not the original user-visible pathname.
-    context["worktree"] = f"/proc/self/fd/{worktree_fd}"
-    request["execution_context"] = context
-    payload = json.dumps(request, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    environment = {
-        "PATH": "/usr/local/bin:/usr/bin:/bin",
-        "LC_ALL": "C.UTF-8",
-        "AIOS_AGENT_RUNTIME_ADAPTER": ADAPTER,
-    }
-    for name in BACKEND_ENV_ALLOWLIST:
-        value = os.environ.get(name)
-        if value is not None:
-            environment[name] = value
-    credentials_dir = os.environ.get("CREDENTIALS_DIRECTORY")
-    if credentials_dir:
-        environment["CREDENTIALS_DIRECTORY"] = credentials_dir
-
-    try:
-        completed = subprocess.run(
-            argv,
-            input=payload,
-            cwd=f"/proc/self/fd/{worktree_fd}",
-            pass_fds=(worktree_fd,),
-            capture_output=True,
-            check=False,
-            timeout=BACKEND_TIMEOUT,
-            env=environment,
-        )
-    except subprocess.TimeoutExpired:
-        return sanitized_failure("AGENT_BACKEND_TIMEOUT")
-    except OSError as exc:
-        return sanitized_failure("AGENT_BACKEND_EXEC_FAILED", {"error": type(exc).__name__})
-    if completed.returncode != 0:
-        return sanitized_failure("AGENT_BACKEND_FAILED", {"exit_code": completed.returncode})
-    if len(completed.stdout) > MAX_BYTES:
-        return sanitized_failure("AGENT_BACKEND_RESULT_TOO_LARGE")
-    try:
-        value = json.loads(completed.stdout.decode("utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        return sanitized_failure("AGENT_BACKEND_RESULT_INVALID")
-    if not isinstance(value, Mapping) or value.get("schema") != "aios.online-agent.runtime-result.v1":
-        return sanitized_failure("AGENT_BACKEND_RESULT_SCHEMA_INVALID")
-    sanitized = sanitize(dict(value))
-    return sanitized if isinstance(sanitized, dict) else sanitized_failure("AGENT_BACKEND_RESULT_INVALID")
-
-
-def serve_once(listener: socket.socket) -> None:
-    connection, _ = listener.accept()
-    worktree_fd: int | None = None
-    try:
-        authorize_peer(connection)
-        request = read_request(connection)
-        request, worktree_fd = validate_request(request)
-        response = execute_backend(request, worktree_fd)
-    except BrokerError as exc:
-        response = sanitized_failure(exc.code, exc.details)
-    except Exception as exc:
-        response = sanitized_failure("BROKER_INTERNAL_ERROR", {"error": type(exc).__name__})
-    finally:
-        if worktree_fd is not None:
-            os.close(worktree_fd)
-    raw = json.dumps(response, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8") + b"\n"
-    try:
-        connection.settimeout(CONNECTION_TIMEOUT)
-        connection.sendall(raw[:MAX_BYTES])
-    finally:
-        connection.close()
-
-
-def main() -> int:
-    if ADAPTER not in {"hermes", "codex", "openclaw"}:
-        raise BrokerError("BROKER_ADAPTER_INVALID")
-    if not SOCKET_PATH.is_absolute() or not WORKSPACE_ROOT.is_absolute():
-        raise BrokerError("BROKER_PATH_INVALID")
-    SOCKET_PATH.parent.mkdir(parents=True, mode=0o750, exist_ok=True)
-    if SOCKET_PATH.exists() or SOCKET_PATH.is_symlink():
-        SOCKET_PATH.unlink()
-    listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    listener.bind(str(SOCKET_PATH))
-    os.chmod(SOCKET_PATH, 0o660)
-    listener.listen(8)
-    try:
-        while True:
-            serve_once(listener)
-    finally:
-        listener.close()
-        if SOCKET_PATH.exists():
-            SOCKET_PATH.unlink()
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

services/aios-agent-runtime-broker/openclaw_engineering_backend.py

@@ -1,369 +0,0 @@
-#!/usr/bin/env python3
-"""OpenClaw engineering backend for the AIOS autonomous runtime broker.
-
-This process is intentionally *not* an Online Agent Task worker. It receives
-one secret-free `aios.online-agent.runtime-request.v1` object on stdin, invokes
-OpenClaw's headless `agent exec` against the pinned disposable worktree, and
-returns one `aios.online-agent.runtime-result.v1` object on stdout.
-
-Online Task claim/heartbeat/result and Governed GitOps remain owned by the
-AIOS autonomous worker.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-from pathlib import Path
-import re
-import subprocess
-import sys
-from typing import Any, Mapping
-
-
-REQUEST_SCHEMA = "aios.online-agent.runtime-request.v1"
-RESULT_SCHEMA = "aios.online-agent.runtime-result.v1"
-MAX_INPUT_BYTES = 1024 * 1024
-MAX_OUTPUT_BYTES = 1024 * 1024
-DEFAULT_TIMEOUT = 1800
-ALLOWED_ADAPTERS = frozenset({"hermes", "codex", "openclaw"})
-SECRET_PATTERNS = (
-    re.compile(r"\bsk-[A-Za-z0-9_-]{20,}\b"),
-    re.compile(r"\bghp_[A-Za-z0-9]{20,}\b"),
-    re.compile(r"\bAKIA[0-9A-Z]{16}\b"),
-    re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
-)
-
-
-class BackendError(RuntimeError):
-    def __init__(self, code: str, *, details: Mapping[str, Any] | None = None) -> None:
-        super().__init__(code)
-        self.code = code
-        self.details = dict(details or {})
-
-
-def redact_text(value: str, limit: int = 8192) -> str:
-    value = value[:limit]
-    for pattern in SECRET_PATTERNS:
-        value = pattern.sub("[REDACTED]", value)
-    return value
-
-
-def result(
-    status: str,
-    summary: str,
-    *,
-    verification: list[dict[str, Any]] | None = None,
-    evidence: Mapping[str, Any] | None = None,
-) -> dict[str, Any]:
-    return {
-        "schema": RESULT_SCHEMA,
-        "status": status,
-        "summary": redact_text(summary) or status,
-        "verification": verification or [],
-        "evidence": dict(evidence or {}),
-    }
-
-
-def emit(value: Mapping[str, Any]) -> int:
-    raw = json.dumps(dict(value), ensure_ascii=False, sort_keys=True, separators=(",", ":"))
-    sys.stdout.write(raw)
-    sys.stdout.write("\n")
-    sys.stdout.flush()
-    return 0
-
-
-def read_request() -> dict[str, Any]:
-    raw = sys.stdin.buffer.read(MAX_INPUT_BYTES + 1)
-    if len(raw) > MAX_INPUT_BYTES:
-        raise BackendError("REQUEST_TOO_LARGE")
-    try:
-        value = json.loads(raw.decode("utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise BackendError("REQUEST_INVALID_JSON") from exc
-    if not isinstance(value, Mapping):
-        raise BackendError("REQUEST_OBJECT_REQUIRED")
-    if value.get("schema") != REQUEST_SCHEMA:
-        raise BackendError("REQUEST_SCHEMA_INVALID")
-    return dict(value)
-
-
-def nonempty(value: Any, field: str, limit: int) -> str:
-    if not isinstance(value, str):
-        raise BackendError(f"{field.upper()}_INVALID")
-    value = value.strip()
-    if not value or len(value) > limit:
-        raise BackendError(f"{field.upper()}_INVALID")
-    return value
-
-
-def string_list(value: Any, field: str) -> list[str]:
-    if not isinstance(value, list) or not value or len(value) > 64:
-        raise BackendError(f"{field.upper()}_INVALID")
-    result_value: list[str] = []
-    for item in value:
-        result_value.append(nonempty(item, field, 4096))
-    return result_value
-
-
-def validate_request(value: Mapping[str, Any]) -> tuple[dict[str, Any], Path]:
-    adapter = str(value.get("adapter") or "")
-    if adapter not in ALLOWED_ADAPTERS:
-        raise BackendError("ADAPTER_INVALID")
-
-    task = value.get("task")
-    context = value.get("execution_context")
-    policy = value.get("policy")
-    if not isinstance(task, Mapping) or not isinstance(context, Mapping) or not isinstance(policy, Mapping):
-        raise BackendError("REQUEST_CONTEXT_INVALID")
-
-    task_id = nonempty(task.get("task_id"), "task_id", 180)
-    goal = nonempty(task.get("goal"), "goal", 16384)
-    instructions = nonempty(task.get("instructions"), "instructions", 65536)
-    success = string_list(task.get("success_criteria"), "success_criteria")
-
-    worktree_raw = context.get("worktree")
-    if not isinstance(worktree_raw, str) or not worktree_raw.startswith("/proc/self/fd/"):
-        raise BackendError("PINNED_WORKTREE_REQUIRED")
-    worktree = Path(worktree_raw)
-    try:
-        resolved = worktree.resolve(strict=True)
-    except OSError as exc:
-        raise BackendError("PINNED_WORKTREE_UNAVAILABLE") from exc
-    if not resolved.is_dir():
-        raise BackendError("PINNED_WORKTREE_INVALID")
-
-    for field in (
-        "authoritative_repository_write",
-        "direct_git_ref_mutation",
-        "direct_git_push",
-        "direct_git_commit",
-        "main_write",
-        "force_push",
-        "production_write",
-        "tag_write",
-        "baseline_write",
-        "task_api_credential_visible",
-        "writer_lease_visible",
-    ):
-        if policy.get(field) is not False:
-            raise BackendError("REQUEST_POLICY_REJECTED", details={"field": field})
-
-    return {
-        "adapter": adapter,
-        "task_id": task_id,
-        "goal": goal,
-        "instructions": instructions,
-        "success_criteria": success,
-        "repository": str(context.get("repository") or ""),
-        "base_oid": str(context.get("base_oid") or ""),
-        "target_branch": str(context.get("target_branch") or ""),
-    }, worktree
-
-
-def openclaw_binary() -> Path:
-    configured = os.environ.get("AIOS_OPENCLAW_BIN", "").strip()
-    if not configured:
-        raise BackendError("OPENCLAW_BINARY_NOT_CONFIGURED")
-    path = Path(configured)
-    if not path.is_absolute():
-        raise BackendError("OPENCLAW_BINARY_INVALID")
-    try:
-        resolved = path.resolve(strict=True)
-    except OSError as exc:
-        raise BackendError("OPENCLAW_BINARY_UNAVAILABLE") from exc
-    if not resolved.is_file() or not os.access(resolved, os.X_OK):
-        raise BackendError("OPENCLAW_BINARY_UNAVAILABLE")
-    return resolved
-
-
-def provider_environment() -> dict[str, str]:
-    """Build an environment containing only explicitly projected provider auth.
-
-    `--auth-env-only` tells OpenClaw not to load ambient config/auth stores.
-    The mapping is non-secret; values are read from systemd credential files.
-    """
-    raw = os.environ.get("AIOS_OPENCLAW_PROVIDER_CREDENTIAL_MAP_JSON", "{}")
-    try:
-        mapping = json.loads(raw)
-    except json.JSONDecodeError as exc:
-        raise BackendError("PROVIDER_CREDENTIAL_MAP_INVALID") from exc
-    if not isinstance(mapping, Mapping):
-        raise BackendError("PROVIDER_CREDENTIAL_MAP_INVALID")
-
-    credentials_directory = os.environ.get("CREDENTIALS_DIRECTORY", "").strip()
-    environment = {
-        "PATH": "/usr/local/bin:/usr/bin:/bin",
-        "LC_ALL": "C.UTF-8",
-        "NO_COLOR": "1",
-        # Prevent optional login-shell env snapshot import into exec runs.
-        "OPENCLAW_EXEC_SHELL_SNAPSHOT": "0",
-    }
-    if mapping:
-        if not credentials_directory:
-            raise BackendError("PROVIDER_CREDENTIAL_DIRECTORY_UNAVAILABLE")
-        credential_root = Path(credentials_directory)
-        for env_name, credential_name in mapping.items():
-            if (
-                not isinstance(env_name, str)
-                or not re.fullmatch(r"[A-Z][A-Z0-9_]{2,63}", env_name)
-                or not isinstance(credential_name, str)
-                or not re.fullmatch(r"[A-Za-z0-9._-]{1,128}", credential_name)
-            ):
-                raise BackendError("PROVIDER_CREDENTIAL_MAP_INVALID")
-            path = credential_root / credential_name
-            if not path.is_file() or path.is_symlink():
-                raise BackendError("PROVIDER_CREDENTIAL_UNAVAILABLE", details={"name": credential_name})
-            secret = path.read_text(encoding="utf-8").strip()
-            if not secret:
-                raise BackendError("PROVIDER_CREDENTIAL_EMPTY", details={"name": credential_name})
-            environment[env_name] = secret
-    return environment
-
-
-def build_prompt(task: Mapping[str, Any]) -> str:
-    criteria = "\n".join(f"- {item}" for item in task["success_criteria"])
-    return f"""You are the autonomous engineering runtime for AIOS task {task['task_id']}.
-
-Repository: {task['repository']}
-Base OID: {task['base_oid']}
-Target branch (owned by AIOS Governed GitOps, not by you): {task['target_branch']}
-
-Goal:
-{task['goal']}
-
-Instructions:
-{task['instructions']}
-
-Success criteria:
-{criteria}
-
-Execution boundary:
-- Work only inside the current disposable worktree.
-- Inspect the repository yourself and determine the root cause and files to change.
-- Implement the smallest correct fix.
-- Run focused tests and repair failures when feasible.
-- Do NOT run `git commit`, `git push`, `git update-ref`, create branches/tags, or modify authoritative refs.
-- Do NOT attempt to access AIOS Agent Task credentials, writer leases, or Governed GitOps credentials.
-- Leave Git HEAD unchanged; AIOS independently inspects the diff, reruns verification, and performs the governed commit.
-- In your final answer, concisely state root cause, files changed, and tests you ran.
-"""
-
-
-def openclaw_timeout() -> int:
-    raw = os.environ.get("AIOS_OPENCLAW_EXEC_TIMEOUT_SECONDS", str(DEFAULT_TIMEOUT))
-    try:
-        value = int(raw)
-    except ValueError as exc:
-        raise BackendError("OPENCLAW_TIMEOUT_INVALID") from exc
-    if not 60 <= value <= 7200:
-        raise BackendError("OPENCLAW_TIMEOUT_INVALID")
-    return value
-
-
-def invoke_openclaw(task: Mapping[str, Any], worktree: Path) -> dict[str, Any]:
-    binary = openclaw_binary()
-    model = nonempty(os.environ.get("AIOS_OPENCLAW_MODEL"), "openclaw_model", 256)
-    timeout_seconds = openclaw_timeout()
-    prompt = build_prompt(task)
-
-    argv = [
-        str(binary),
-        "agent",
-        "exec",
-        "--message-file",
-        "-",
-        "--cwd",
-        str(worktree),
-        "--model",
-        model,
-        "--auth-env-only",
-        "--timeout",
-        str(timeout_seconds),
-        "--json",
-    ]
-
-    try:
-        pinned_fd = int(worktree.name)
-    except ValueError as exc:
-        raise BackendError("PINNED_WORKTREE_FD_INVALID") from exc
-
-    try:
-        completed = subprocess.run(
-            argv,
-            input=prompt.encode("utf-8"),
-            cwd=str(worktree),
-            pass_fds=(pinned_fd,),
-            capture_output=True,
-            check=False,
-            timeout=timeout_seconds + 90,
-            env=provider_environment(),
-        )
-    except subprocess.TimeoutExpired:
-        return result(
-            "FAILED",
-            "OPENCLAW_HARD_TIMEOUT",
-            evidence={"backend": "openclaw-agent-exec", "timeout_seconds": timeout_seconds},
-        )
-    except OSError as exc:
-        return result(
-            "FAILED",
-            "OPENCLAW_EXEC_FAILED",
-            evidence={"backend": "openclaw-agent-exec", "error": type(exc).__name__},
-        )
-
-    stdout = completed.stdout[:MAX_OUTPUT_BYTES]
-    try:
-        envelope = json.loads(stdout.decode("utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        return result(
-            "FAILED",
-            "OPENCLAW_RESULT_INVALID",
-            evidence={
-                "backend": "openclaw-agent-exec",
-                "exit_code": completed.returncode,
-                "stderr_sha256": __import__("hashlib").sha256(completed.stderr).hexdigest(),
-            },
-        )
-
-    if not isinstance(envelope, Mapping):
-        return result("FAILED", "OPENCLAW_RESULT_INVALID", evidence={"backend": "openclaw-agent-exec"})
-
-    ok = envelope.get("ok") is True and envelope.get("status") == "ok" and completed.returncode == 0
-    final_text = str(envelope.get("final") or "").strip()
-    evidence = {
-        "backend": "openclaw-agent-exec",
-        "openclaw_status": envelope.get("status"),
-        "exit_code": completed.returncode,
-        "model": envelope.get("model"),
-        "provider": envelope.get("provider"),
-        "session_id_present": bool(envelope.get("sessionId")),
-        "code_mode_engaged": envelope.get("codeModeEngaged"),
-        "assistant_turns": envelope.get("assistantTurns"),
-        "tool_summary": envelope.get("toolSummary") if isinstance(envelope.get("toolSummary"), Mapping) else {},
-    }
-
-    if not ok:
-        error = envelope.get("error")
-        if isinstance(error, Mapping):
-            evidence["error_kind"] = error.get("kind")
-        summary = "OPENCLAW_" + str(envelope.get("status") or "ERROR").upper()
-        return result("FAILED", summary, evidence=evidence)
-
-    summary = final_text or "OpenClaw completed the engineering turn."
-    return result("COMPLETED", summary, evidence=evidence)
-
-
-def main() -> int:
-    try:
-        request = read_request()
-        task, worktree = validate_request(request)
-        return emit(invoke_openclaw(task, worktree))
-    except BackendError as exc:
-        return emit(result("BLOCKED", exc.code, evidence=exc.details))
-    except Exception as exc:
-        return emit(result("FAILED", "OPENCLAW_BACKEND_INTERNAL_ERROR", evidence={"error": type(exc).__name__}))
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

services/aios-autonomous-agent-worker/autonomous_worker.py

@@ -1,822 +0,0 @@
-#!/usr/bin/env python3
-from __future__ import annotations
-
-import base64
-from datetime import datetime, timezone
-import grp
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import shutil
-import subprocess
-import tempfile
-import threading
-import time
-import urllib.error
-import urllib.request
-from typing import Any, Mapping, Sequence
-
-from intent_runtime import IntentError, Resolution, is_claimable_intent, resolve
-from runtime_client import RuntimeErrorV2, collect_changes, invoke, request_payload, scan_secrets
-
-
-API_BASE = os.environ.get("AIOS_AGENT_TASK_API_URL", "http://127.0.0.1:18940").rstrip("/")
-BRIDGE_BASE = os.environ.get("AIOS_GOVERNED_WRITE_API_URL", "http://127.0.0.1:19998").rstrip("/")
-AGENT_ID = os.environ.get("AIOS_AGENT_ID", "online-engineering-worker-cn-network-mkt-autonomous-20260815")
-AGENT_VERSION = os.environ.get("AIOS_AGENT_VERSION", "2026-08-15.4-autonomous-intent")
-REPOSITORY = os.environ.get("AIOS_AUTONOMOUS_REPOSITORY", "aios/aios")
-BASE_REF = os.environ.get("AIOS_AUTONOMOUS_BASE_REF", "refs/heads/main")
-AUTHORITY_GIT_DIR = Path(os.environ.get("AIOS_AUTHORITY_GIT_DIR", "/data/aios-gitops/repo.git"))
-STATE_ROOT = Path(os.environ.get("AIOS_AUTONOMOUS_STATE_ROOT", "/var/lib/aios-autonomous-agent-worker"))
-WORKSPACE_ROOT = Path(os.environ.get("AIOS_AUTONOMOUS_WORKSPACE_ROOT", str(STATE_ROOT / "workspaces")))
-SHARED_GROUP = os.environ.get("AIOS_AGENT_RUNTIME_SHARED_GROUP", "aios-agent-runtime")
-DEFAULT_ADAPTER = os.environ.get("AIOS_AUTONOMOUS_DEFAULT_ADAPTER", "hermes")
-HERMES_SOCKET = Path(os.environ.get("AIOS_HERMES_BROKER_SOCKET", "/run/aios-agent-runtime/hermes.sock"))
-CODEX_SOCKET = Path(os.environ.get("AIOS_CODEX_BROKER_SOCKET", "/run/aios-agent-runtime/codex.sock"))
-OPENCLAW_SOCKET = Path(os.environ.get("AIOS_OPENCLAW_BROKER_SOCKET", "/run/aios-agent-runtime/openclaw.sock"))
-POLL_SECONDS = int(os.environ.get("AIOS_AUTONOMOUS_POLL_SECONDS", "5"))
-HEARTBEAT_SECONDS = int(os.environ.get("AIOS_AUTONOMOUS_HEARTBEAT_SECONDS", "10"))
-LEASE_SECONDS = int(os.environ.get("AIOS_AUTONOMOUS_LEASE_SECONDS", "300"))
-RUNTIME_TIMEOUT_SECONDS = int(os.environ.get("AIOS_AUTONOMOUS_RUNTIME_TIMEOUT_SECONDS", "3600"))
-MAX_OUTPUT_BYTES = 64 * 1024
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SENSITIVE_RE = re.compile(
-    r"(?i)(authorization\s*:\s*bearer\s+\S+|(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+)"
-)
-
-
-class WorkerError(RuntimeError):
-    def __init__(self, code: str, *, phase: str, details: Mapping[str, Any] | None = None) -> None:
-        super().__init__(code)
-        self.code = code
-        self.phase = phase
-        self.details = dict(details or {})
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def sha256_bytes(value: bytes) -> str:
-    return hashlib.sha256(value).hexdigest()
-
-
-def sha256_json(value: Any) -> str:
-    return sha256_bytes(json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8"))
-
-
-def sanitize(value: Any) -> Any:
-    if isinstance(value, Mapping):
-        result: dict[str, Any] = {}
-        for key, inner in value.items():
-            lowered = str(key).lower()
-            if any(word in lowered for word in ("token", "secret", "credential", "authorization", "password", "api_key", "apikey", "access_key")):
-                result[str(key)] = "[REDACTED]"
-            else:
-                result[str(key)] = sanitize(inner)
-        return result
-    if isinstance(value, list):
-        return [sanitize(item) for item in value]
-    if isinstance(value, tuple):
-        return [sanitize(item) for item in value]
-    if isinstance(value, str):
-        return SENSITIVE_RE.sub("[REDACTED]", value)
-    return value
-
-
-def audit(event_type: str, **fields: Any) -> None:
-    STATE_ROOT.mkdir(parents=True, mode=0o750, exist_ok=True)
-    path = STATE_ROOT / "events.jsonl"
-    record = {
-        "event_type": event_type,
-        "created_at": now(),
-        "agent_id": AGENT_ID,
-        "agent_version": AGENT_VERSION,
-        "credential_material_exposed": False,
-        "writer_lease_material_exposed": False,
-        **sanitize(fields),
-    }
-    with path.open("a", encoding="utf-8") as handle:
-        handle.write(json.dumps(record, ensure_ascii=False, sort_keys=True) + "\n")
-    os.chmod(path, 0o640)
-    print(json.dumps(record, ensure_ascii=False, sort_keys=True), flush=True)
-
-
-def atomic_json(path: Path, value: Mapping[str, Any]) -> None:
-    path.parent.mkdir(parents=True, mode=0o750, exist_ok=True)
-    if path.parent.is_symlink() or path.is_symlink():
-        raise WorkerError("STATE_PATH_SYMLINK_REJECTED", phase="state")
-    fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=str(path.parent))
-    try:
-        os.fchmod(fd, 0o640)
-        with os.fdopen(fd, "w", encoding="utf-8") as handle:
-            json.dump(sanitize(dict(value)), handle, ensure_ascii=False, sort_keys=True)
-            handle.write("\n")
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(temporary, path)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def state_path(task_id: str) -> Path:
-    safe = re.sub(r"[^A-Za-z0-9._:-]+", "-", task_id)[:180]
-    return STATE_ROOT / "tasks" / f"{safe}.json"
-
-
-def load_state(task_id: str) -> dict[str, Any] | None:
-    path = state_path(task_id)
-    if not path.is_file() or path.is_symlink():
-        return None
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except Exception:
-        return None
-    return value if isinstance(value, dict) else None
-
-
-def save_state(task_id: str, value: Mapping[str, Any]) -> None:
-    atomic_json(state_path(task_id), value)
-
-
-def api_call(method: str, route: str, token: str, body: Mapping[str, Any] | None = None) -> tuple[int, dict[str, Any]]:
-    payload = None if body is None else json.dumps(dict(body), ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
-    if payload is not None:
-        headers["Content-Type"] = "application/json"
-    request = urllib.request.Request(API_BASE + route, data=payload, headers=headers, method=method)
-    try:
-        with urllib.request.urlopen(request, timeout=20) as response:
-            value = json.loads(response.read().decode("utf-8"))
-            return response.status, value if isinstance(value, dict) else {}
-    except urllib.error.HTTPError as exc:
-        try:
-            value = json.loads(exc.read(4096).decode("utf-8", "replace"))
-        except Exception:
-            value = {"error": "HTTP_ERROR"}
-        return exc.code, value if isinstance(value, dict) else {"error": "HTTP_ERROR"}
-    except (urllib.error.URLError, TimeoutError):
-        return 599, {"error": "AGENT_TASK_API_UNAVAILABLE"}
-
-
-def bridge_call(route: str, body: Mapping[str, Any]) -> tuple[int, dict[str, Any]]:
-    if BRIDGE_BASE != "http://127.0.0.1:19998":
-        raise WorkerError(
-            "NON_STAGING_BRIDGE_REJECTED",
-            phase="startup",
-            details={"bridge_base": BRIDGE_BASE},
-        )
-    payload = json.dumps(dict(body), ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    request = urllib.request.Request(
-        BRIDGE_BASE + route,
-        data=payload,
-        headers={"Accept": "application/json", "Content-Type": "application/json"},
-        method="POST",
-    )
-    try:
-        with urllib.request.urlopen(request, timeout=60) as response:
-            value = json.loads(response.read().decode("utf-8"))
-            return response.status, value if isinstance(value, dict) else {}
-    except urllib.error.HTTPError as exc:
-        try:
-            value = json.loads(exc.read(4096).decode("utf-8", "replace"))
-        except Exception:
-            value = {"error": "HTTP_ERROR"}
-        return exc.code, value if isinstance(value, dict) else {"error": "HTTP_ERROR"}
-    except (urllib.error.URLError, TimeoutError):
-        return 599, {"error": "GOVERNED_WRITE_API_UNAVAILABLE"}
-
-
-def load_agent_token() -> str:
-    directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", ""))
-    path = directory / "agent_token"
-    if not path.is_file():
-        raise WorkerError("AGENT_RUNTIME_CREDENTIAL_UNAVAILABLE", phase="startup")
-    token = path.read_text(encoding="utf-8").strip()
-    if len(token) < 24:
-        raise WorkerError("AGENT_RUNTIME_CREDENTIAL_INVALID", phase="startup")
-    return token
-
-
-def available_adapters() -> tuple[str, ...]:
-    values: list[str] = []
-    for name, path in (("hermes", HERMES_SOCKET), ("codex", CODEX_SOCKET), ("openclaw", OPENCLAW_SOCKET)):
-        try:
-            if path.is_socket():
-                values.append(name)
-        except OSError:
-            pass
-    return tuple(values)
-
-
-def capabilities() -> tuple[str, ...]:
-    values = {
-        "online_agent_task_api", "task.poll", "task.claim", "task.heartbeat", "task.result",
-        "intent.task", "engineering.consumer", "engineering.execute", "engineering.autonomous",
-        "workspace.worktree", "git.read", "git.diff", "git.test",
-        "governed.write.branch", "governed.write.file",
-    }
-    values.update(f"agent.runtime.{name}" for name in available_adapters())
-    return tuple(sorted(values))
-
-
-class LeaseHeartbeat:
-    def __init__(self, task_id: str, agent_token: str, lease_token: str) -> None:
-        self.task_id = task_id
-        self.agent_token = agent_token
-        self.lease_token = lease_token
-        self.stage = "claimed"
-        self.failed: str | None = None
-        self.stop = threading.Event()
-        self.thread = threading.Thread(target=self._run, daemon=True, name=f"heartbeat-{task_id}")
-
-    def set_stage(self, stage: str) -> None:
-        self.stage = stage
-        audit("TASK_PROGRESS_STAGE", task_id=self.task_id, stage=stage)
-
-    def send(self) -> None:
-        status, response = api_call(
-            "POST",
-            f"/v1/tasks/{self.task_id}/heartbeat",
-            self.agent_token,
-            {
-                "lease_token": self.lease_token,
-                "lease_seconds": LEASE_SECONDS,
-                "progress": {
-                    "stage": self.stage,
-                    "event_type": "TASK_STARTED" if self.stage == "started" else "TASK_PROGRESS",
-                    "execution_mode": "autonomous-intent-v2",
-                    "production_side_effects": False,
-                    "main_write": False,
-                },
-            },
-        )
-        if 200 <= status < 300:
-            audit(
-                "TASK_HEARTBEAT",
-                task_id=self.task_id,
-                stage=self.stage,
-                api_status=status,
-                task_status=response.get("status"),
-                lease_expires_at=response.get("lease_expires_at"),
-            )
-        else:
-            self.failed = str(response.get("error") or status)
-            audit("TASK_HEARTBEAT_FAILED", task_id=self.task_id, stage=self.stage, error=self.failed)
-
-    def _run(self) -> None:
-        while not self.stop.wait(HEARTBEAT_SECONDS):
-            try:
-                self.send()
-            except Exception as exc:
-                self.failed = type(exc).__name__
-                audit("TASK_HEARTBEAT_FAILED", task_id=self.task_id, error=self.failed)
-
-    def start(self) -> None:
-        self.thread.start()
-
-    def close(self) -> None:
-        self.stop.set()
-        self.thread.join(timeout=3)
-
-
-def ensure_roots() -> None:
-    if WORKSPACE_ROOT.is_symlink() or STATE_ROOT.is_symlink() or AUTHORITY_GIT_DIR.is_symlink():
-        raise WorkerError("ROOT_SYMLINK_REJECTED", phase="startup")
-    if not AUTHORITY_GIT_DIR.is_dir():
-        raise WorkerError("AUTHORITY_GIT_DIR_UNAVAILABLE", phase="startup")
-    STATE_ROOT.mkdir(parents=True, mode=0o750, exist_ok=True)
-    WORKSPACE_ROOT.mkdir(parents=True, mode=0o750, exist_ok=True)
-
-
-def run_git(args: Sequence[str], *, cwd: Path, timeout: int = 180) -> subprocess.CompletedProcess[bytes]:
-    completed = subprocess.run(
-        ["/usr/bin/git", *args],
-        cwd=str(cwd),
-        capture_output=True,
-        check=False,
-        timeout=timeout,
-        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
-    )
-    if completed.returncode != 0:
-        raise WorkerError(
-            "GIT_COMMAND_FAILED",
-            phase="workspace",
-            details={"operation": args[0] if args else "", "exit_code": completed.returncode},
-        )
-    return completed
-
-
-def prepare_worktree(task_id: str, base_oid: str) -> tuple[Path, Path]:
-    ensure_roots()
-    run_root = Path(tempfile.mkdtemp(prefix=f"{task_id[:48]}-", dir=str(WORKSPACE_ROOT)))
-    os.chmod(run_root, 0o750)
-    clone = run_root / "repository"
-    worktree = run_root / "worktree"
-    run_git(["clone", "--no-local", "--no-hardlinks", str(AUTHORITY_GIT_DIR), str(clone)], cwd=run_root, timeout=300)
-    run_git(["-C", str(clone), "rev-parse", "--verify", f"{base_oid}^{{commit}}"], cwd=run_root)
-    run_git(["-C", str(clone), "worktree", "add", "--detach", str(worktree), base_oid], cwd=run_root, timeout=300)
-    return run_root, worktree
-
-
-def share_run_root(run_root: Path) -> None:
-    try:
-        gid = grp.getgrnam(SHARED_GROUP).gr_gid
-    except KeyError as exc:
-        raise WorkerError("RUNTIME_SHARED_GROUP_UNAVAILABLE", phase="workspace") from exc
-    root = run_root.resolve()
-    if not root.is_dir() or run_root.is_symlink():
-        raise WorkerError("RUNTIME_RUN_ROOT_INVALID", phase="workspace")
-    for current, dirs, files in os.walk(root, topdown=True, followlinks=False):
-        current_path = Path(current)
-        for name in dirs + files:
-            candidate = current_path / name
-            if candidate.is_symlink():
-                raise WorkerError(
-                    "RUNTIME_WORKSPACE_SYMLINK_REJECTED",
-                    phase="workspace",
-                    details={"path": str(candidate.relative_to(root))},
-                )
-        for candidate in [current_path, *(current_path / name for name in dirs), *(current_path / name for name in files)]:
-            st = candidate.stat()
-            os.chown(candidate, -1, gid)
-            mode = st.st_mode & 0o777
-            os.chmod(candidate, mode | (0o070 if candidate.is_dir() else 0o060))
-
-
-def cleanup_run_root(run_root: Path) -> None:
-    root = WORKSPACE_ROOT.resolve()
-    candidate = run_root.resolve(strict=False)
-    if candidate == root or root not in candidate.parents:
-        raise WorkerError("CLEANUP_SCOPE_INVALID", phase="cleanup")
-    if candidate.exists():
-        shutil.rmtree(candidate)
-
-
-def allowed_programs() -> set[str]:
-    raw = os.environ.get("AIOS_AUTONOMOUS_ALLOWED_PROGRAMS_JSON", '["/usr/bin/git","/usr/bin/python3"]')
-    try:
-        value = json.loads(raw)
-    except json.JSONDecodeError as exc:
-        raise WorkerError("ALLOWED_PROGRAMS_CONFIG_INVALID", phase="startup") from exc
-    if not isinstance(value, list) or not all(isinstance(item, str) and item.startswith("/") for item in value):
-        raise WorkerError("ALLOWED_PROGRAMS_CONFIG_INVALID", phase="startup")
-    return set(value)
-
-
-def validate_verification_argv(value: Any) -> list[str]:
-    if not isinstance(value, list) or not value or not all(isinstance(item, str) and item for item in value):
-        raise WorkerError("VERIFICATION_ARGV_INVALID", phase="verification")
-    argv = list(value)
-    if argv[0] not in allowed_programs():
-        raise WorkerError("VERIFICATION_PROGRAM_NOT_ALLOWED", phase="verification", details={"program": Path(argv[0]).name})
-    if argv[0].endswith("/git") and any(item in {"push", "update-ref", "receive-pack", "send-pack", "commit", "reset", "clean"} for item in argv[1:]):
-        raise WorkerError("VERIFICATION_GIT_MUTATION_REJECTED", phase="verification")
-    if argv[0].endswith("/python3") and "-c" in argv:
-        raise WorkerError("VERIFICATION_INLINE_PYTHON_REJECTED", phase="verification")
-    return argv
-
-
-def run_verification(label: str, argv: Sequence[str], *, cwd: Path, timeout: int) -> dict[str, Any]:
-    started = time.monotonic()
-    completed = subprocess.run(
-        list(argv),
-        cwd=str(cwd),
-        capture_output=True,
-        check=False,
-        timeout=timeout,
-        env={"PATH": "/usr/local/bin:/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
-    )
-    result = {
-        "label": label[:120],
-        "argv": [Path(item).name if idx == 0 else item for idx, item in enumerate(argv)],
-        "exit_code": completed.returncode,
-        "stdout_sha256": sha256_bytes(completed.stdout),
-        "stderr_sha256": sha256_bytes(completed.stderr),
-        "duration_ms": int((time.monotonic() - started) * 1000),
-    }
-    audit("VERIFICATION_RESULT", **result)
-    if completed.returncode != 0:
-        raise WorkerError(
-            "VERIFICATION_FAILED",
-            phase="verification",
-            details={"label": label[:120], "exit_code": completed.returncode},
-        )
-    return result
-
-
-def independent_verification(
-    worktree: Path,
-    changed_files: Sequence[str],
-    runtime_verification: Sequence[Mapping[str, Any]],
-) -> list[dict[str, Any]]:
-    results = [
-        run_verification(
-            "git_diff_check",
-            ["/usr/bin/git", "-C", str(worktree), "diff", "--check"],
-            cwd=worktree,
-            timeout=120,
-        )
-    ]
-    py_files = [item for item in changed_files if item.endswith(".py")]
-    if py_files:
-        results.append(
-            run_verification(
-                "changed_python_compile",
-                ["/usr/bin/python3", "-m", "py_compile", *py_files],
-                cwd=worktree,
-                timeout=300,
-            )
-        )
-    test_files = [
-        item for item in py_files
-        if item.startswith("tests/") or Path(item).name.startswith("test_")
-    ]
-    if test_files:
-        results.append(
-            run_verification(
-                "changed_pytest",
-                ["/usr/bin/python3", "-m", "pytest", "-q", *test_files],
-                cwd=worktree,
-                timeout=900,
-            )
-        )
-    seen: set[str] = set()
-    for item in runtime_verification:
-        argv = validate_verification_argv(item.get("argv"))
-        cwd_value = item.get("cwd", ".")
-        if cwd_value in {"", "."}:
-            cwd = worktree
-        else:
-            if not isinstance(cwd_value, str) or cwd_value.startswith(("/", "~")) or ".." in Path(cwd_value).parts:
-                raise WorkerError("VERIFICATION_CWD_INVALID", phase="verification")
-            cwd = (worktree / cwd_value).resolve()
-            if worktree.resolve() not in cwd.parents and cwd != worktree.resolve():
-                raise WorkerError("VERIFICATION_CWD_ESCAPE", phase="verification")
-        timeout = item.get("timeout_seconds", 300)
-        if not isinstance(timeout, int) or isinstance(timeout, bool) or not 1 <= timeout <= 1800:
-            raise WorkerError("VERIFICATION_TIMEOUT_INVALID", phase="verification")
-        key = sha256_json({"argv": argv, "cwd": str(cwd), "timeout": timeout})
-        if key in seen:
-            continue
-        seen.add(key)
-        results.append(
-            run_verification(str(item.get("label") or "agent_requested_verification"), argv, cwd=cwd, timeout=timeout)
-        )
-    return results
-
-
-def governed_commit(
-    task_id: str,
-    resolution: Resolution,
-    worktree: Path,
-    changed_files: Sequence[str],
-) -> dict[str, Any]:
-    files: dict[str, str] = {}
-    for relative in changed_files:
-        path = (worktree / relative).resolve()
-        if worktree.resolve() not in path.parents or not path.is_file():
-            raise WorkerError("COMMIT_FILE_INVALID", phase="committing", details={"path": relative})
-        files[relative] = base64.b64encode(path.read_bytes()).decode("ascii")
-
-    governed_task_id = f"{task_id}-writer"
-    create_key = f"{task_id}-governed-v2"
-    commit_key = f"{task_id}-commit-v2"
-    status, created = bridge_call(
-        "/v2/governed-task",
-        {
-            "task_id": governed_task_id,
-            "repository": resolution.repository,
-            "base_oid": resolution.base_oid,
-            "target_branch": resolution.target_branch,
-            "risk": "engineering",
-            "description": f"Autonomous intent task {task_id}",
-            "idempotency_key": create_key,
-        },
-    )
-    if not 200 <= status < 300:
-        raise WorkerError(
-            "GOVERNED_TASK_CREATE_FAILED",
-            phase="committing",
-            details={"api_status": status, "error": created.get("error")},
-        )
-
-    generation = int(created.get("generation") or 1)
-    expected = str(created.get("expected_branch_oid") or resolution.base_oid)
-    branch_mode = str(created.get("branch_mode") or "CREATE_NEW")
-    status, lease = bridge_call(
-        "/v2/writer-lease",
-        {
-            "schema": "aios.task-writer-lease.v2",
-            "task_id": governed_task_id,
-            "repository": resolution.repository,
-            "branch_mode": branch_mode,
-            "base_oid": resolution.base_oid,
-            "expected_branch_oid": expected,
-            "target_branch": resolution.target_branch,
-            "generation": generation,
-            "lease_seconds": 900,
-        },
-    )
-    if not 200 <= status < 300:
-        raise WorkerError(
-            "WRITER_LEASE_ACQUIRE_FAILED",
-            phase="committing",
-            details={"api_status": status, "error": lease.get("error")},
-        )
-
-    status, committed = bridge_call(
-        "/v2/commit-files",
-        {
-            "task_id": governed_task_id,
-            "repository": resolution.repository,
-            "expected_branch_oid": expected,
-            "target_branch": resolution.target_branch,
-            "generation": generation,
-            "idempotency_key": commit_key,
-            "files": files,
-            "message": f"chore(agent): execute online intent task {task_id}"[:240],
-        },
-    )
-    if not 200 <= status < 300:
-        raise WorkerError(
-            "GOVERNED_COMMIT_FAILED",
-            phase="committing",
-            details={"api_status": status, "error": committed.get("error")},
-        )
-    commit_oid = committed.get("commit_oid")
-    if not isinstance(commit_oid, str) or not OID_RE.fullmatch(commit_oid):
-        raise WorkerError("GOVERNED_COMMIT_OID_INVALID", phase="committing")
-    return {
-        "governed_task_id": governed_task_id,
-        "generation": generation,
-        "branch_mode": branch_mode,
-        "commit_oid": commit_oid,
-        "commit_visible": committed.get("commit_visible"),
-        "target_branch": resolution.target_branch,
-        "create_idempotency_key": create_key,
-        "commit_idempotency_key": commit_key,
-    }
-
-
-def socket_for(adapter: str) -> Path:
-    if adapter == "hermes":
-        return HERMES_SOCKET
-    if adapter == "codex":
-        return CODEX_SOCKET
-    if adapter == "openclaw":
-        return OPENCLAW_SOCKET
-    raise WorkerError("ADAPTER_INVALID", phase="runtime")
-
-
-def resolve_task(task: Mapping[str, Any], prior: Mapping[str, Any] | None = None) -> Resolution:
-    try:
-        return resolve(
-            task,
-            authority_git_dir=AUTHORITY_GIT_DIR,
-            repository=REPOSITORY,
-            base_ref=BASE_REF,
-            available_adapters=available_adapters(),
-            default_adapter=DEFAULT_ADAPTER,
-            prior=prior,
-        )
-    except IntentError as exc:
-        raise WorkerError(exc.code, phase="intent_resolution", details=exc.details) from exc
-
-
-def execute_claim(task: Mapping[str, Any], claim: Mapping[str, Any], token: str) -> int:
-    task_id = str(claim.get("task_id") or task.get("task_id") or "")
-    lease_token = claim.get("lease_token")
-    if not isinstance(lease_token, str) or len(lease_token) < 24:
-        raise WorkerError("LEASE_TOKEN_NOT_RETURNED", phase="claim")
-    attempt = int(claim.get("attempt") or 0)
-    state = load_state(task_id) or {"task_id": task_id, "phase": "claimed"}
-    prior = state.get("resolution") if isinstance(state.get("resolution"), Mapping) else None
-    resolution = resolve_task(task, prior=prior)
-    state["resolution"] = resolution.to_json()
-    state["attempt"] = attempt
-    save_state(task_id, state)
-
-    heartbeat = LeaseHeartbeat(task_id, token, lease_token)
-    heartbeat.start()
-    run_root: Path | None = None
-    try:
-        heartbeat.set_stage("started")
-        heartbeat.send()
-        audit("TASK_STARTED", task_id=task_id, attempt=attempt, adapter=resolution.adapter)
-
-        existing_commit = state.get("governed")
-        if isinstance(existing_commit, Mapping) and isinstance(existing_commit.get("commit_oid"), str):
-            result = {
-                "status": "SUCCEEDED",
-                "verification_state": "VERIFIED_BY_WORKER_READBACK_PENDING_SERVER",
-                "task_id": task_id,
-                "execution_mode": "autonomous-intent-v2",
-                "adapter": resolution.adapter,
-                "resolution_digest": resolution.resolution_digest,
-                "governed": dict(existing_commit),
-                "recovered_after_commit": True,
-                "secret_material_exposed": False,
-                "direct_main_write": False,
-                "force_push": False,
-                "production_write": False,
-            }
-        else:
-            heartbeat.set_stage("workspace_preparing")
-            run_root, worktree = prepare_worktree(task_id, resolution.base_oid)
-            share_run_root(run_root)
-            state["phase"] = "workspace_prepared"
-            save_state(task_id, state)
-
-            heartbeat.set_stage("agent_executing")
-            payload = request_payload(
-                adapter=resolution.adapter,
-                task_id=task_id,
-                goal=resolution.goal,
-                instructions=resolution.instructions,
-                success_criteria=resolution.success_criteria,
-                repository=resolution.repository,
-                base_oid=resolution.base_oid,
-                target_branch=resolution.target_branch,
-                worktree=worktree,
-            )
-            runtime = invoke(
-                socket_for(resolution.adapter),
-                payload,
-                timeout_seconds=RUNTIME_TIMEOUT_SECONDS,
-            )
-            heartbeat.set_stage("validating")
-            changed_files = collect_changes(worktree, resolution.base_oid)
-            scan_secrets(worktree, changed_files)
-            verification = independent_verification(worktree, changed_files, runtime.verification)
-
-            heartbeat.set_stage("committing")
-            governed = governed_commit(task_id, resolution, worktree, changed_files)
-            state.update({"phase": "commit_done", "governed": governed, "changed_files": list(changed_files)})
-            save_state(task_id, state)
-
-            result = {
-                "status": "SUCCEEDED",
-                "verification_state": "VERIFIED_BY_WORKER_READBACK_PENDING_SERVER",
-                "task_id": task_id,
-                "execution_mode": "autonomous-intent-v2",
-                "adapter": resolution.adapter,
-                "resolution_digest": resolution.resolution_digest,
-                "base_oid": resolution.base_oid,
-                "target_branch": resolution.target_branch,
-                "changed_files": list(changed_files),
-                "tests": verification,
-                "agent_summary": runtime.summary,
-                "agent_evidence": sanitize(runtime.evidence),
-                "governed": governed,
-                "secret_material_exposed": False,
-                "direct_main_write": False,
-                "force_push": False,
-                "production_write": False,
-            }
-
-        if heartbeat.failed:
-            raise WorkerError("HEARTBEAT_UNHEALTHY", phase="result_submitting", details={"error": heartbeat.failed})
-        heartbeat.set_stage("result_submitting")
-        result_key = f"{task_id}-result-v2"
-        status, response = api_call(
-            "POST",
-            f"/v1/tasks/{task_id}/result",
-            token,
-            {
-                "lease_token": lease_token,
-                "idempotency_key": result_key,
-                "result": result,
-            },
-        )
-        if not 200 <= status < 300:
-            raise WorkerError(
-                "TASK_RESULT_SUBMIT_FAILED",
-                phase="result_submitting",
-                details={"api_status": status, "error": response.get("error")},
-            )
-        audit("RESULT_SUBMITTED", task_id=task_id, task_status=response.get("status"), result_idempotency_key=result_key)
-        state["phase"] = "result_submitted"
-        save_state(task_id, state)
-        return 0
-    except (WorkerError, RuntimeErrorV2) as exc:
-        code = exc.code if hasattr(exc, "code") else type(exc).__name__
-        phase = exc.phase if isinstance(exc, WorkerError) else "runtime"
-        details = exc.details if hasattr(exc, "details") else {}
-        audit("AUTONOMOUS_EXECUTION_FAILED", task_id=task_id, error=code, phase=phase, details=details)
-        failure_status = "BLOCKED" if code in {
-            "AGENT_RUNTIME_UNAVAILABLE", "RUNTIME_UNAVAILABLE", "RUNTIME_BLOCKED",
-            "GOVERNED_WRITE_API_UNAVAILABLE", "NON_STAGING_BRIDGE_REJECTED",
-        } else "FAILED_RETRYABLE"
-        failure = {
-            "status": failure_status,
-            "verification_state": "UNVERIFIED",
-            "task_id": task_id,
-            "execution_mode": "autonomous-intent-v2",
-            "error": code,
-            "phase": phase,
-            "details": sanitize(details),
-            "secret_material_exposed": False,
-            "direct_main_write": False,
-            "force_push": False,
-            "production_write": False,
-        }
-        if not heartbeat.failed:
-            status, response = api_call(
-                "POST",
-                f"/v1/tasks/{task_id}/result",
-                token,
-                {
-                    "lease_token": lease_token,
-                    "idempotency_key": f"{task_id}-attempt-{attempt}-failure-v2",
-                    "result": failure,
-                },
-            )
-            audit("FAILURE_RESULT_SUBMITTED", task_id=task_id, api_status=status, task_status=response.get("status"))
-        return 20
-    finally:
-        heartbeat.close()
-        if run_root is not None:
-            try:
-                cleanup_run_root(run_root)
-                audit("WORKSPACE_CLEANED", task_id=task_id, cleanup="PASS")
-            except Exception as exc:
-                audit("WORKSPACE_CLEANUP_FAILED", task_id=task_id, error=type(exc).__name__)
-
-
-def worker_once(token: str) -> int:
-    status, poll = api_call("POST", "/v1/tasks/poll", token, {"limit": 100})
-    if status != 200:
-        audit("TASK_POLL_FAILED", api_status=status, error=poll.get("error"))
-        return 10
-
-    worker_caps = capabilities()
-    candidates: list[Mapping[str, Any]] = []
-    for item in poll.get("tasks", []):
-        if not isinstance(item, Mapping):
-            continue
-        if not is_claimable_intent(item, worker_caps):
-            continue
-        try:
-            # Read-only preflight. Do not consume an attempt if runtime/base is unavailable.
-            resolve_task(item, prior=(load_state(str(item.get("task_id") or "")) or {}).get("resolution"))
-        except WorkerError as exc:
-            audit("TASK_SKIPPED_PREFLIGHT", task_id=item.get("task_id"), error=exc.code)
-            continue
-        candidates.append(item)
-
-    if not candidates:
-        return 0
-
-    # Server priority/order remains authoritative; take the first visible compatible task.
-    task = candidates[0]
-    task_id = str(task.get("task_id") or "")
-    status, claim = api_call("POST", f"/v1/tasks/{task_id}/claim", token, {"lease_seconds": LEASE_SECONDS})
-    if status != 200:
-        audit("TASK_CLAIM_FAILED", task_id=task_id, api_status=status, error=claim.get("error"))
-        return 11
-    audit(
-        "TASK_CLAIMED",
-        task_id=task_id,
-        attempt=claim.get("attempt"),
-        revision=claim.get("revision"),
-        claim_mode="server_atomic",
-        execution_mode="autonomous-intent-v2",
-    )
-    merged = dict(task)
-    merged.update({key: value for key, value in claim.items() if key not in {"lease_token"}})
-    merged["task_id"] = task_id
-    return execute_claim(merged, claim, token)
-
-
-def main() -> int:
-    ensure_roots()
-    if BRIDGE_BASE != "http://127.0.0.1:19998":
-        raise WorkerError("NON_STAGING_BRIDGE_REJECTED", phase="startup", details={"bridge_base": BRIDGE_BASE})
-    token = load_agent_token()
-    audit(
-        "AUTONOMOUS_WORKER_READY",
-        poll_mode="continuous",
-        claim_mode="server_atomic",
-        task_scope="intent-only",
-        bridge_base=BRIDGE_BASE,
-        available_adapters=list(available_adapters()),
-        capabilities=list(capabilities()),
-        main_write=False,
-        production_write=False,
-        force_push=False,
-    )
-    while True:
-        try:
-            result = worker_once(token)
-        except Exception as exc:
-            audit("WORKER_LOOP_ERROR", error=type(exc).__name__)
-            result = 20
-        time.sleep(POLL_SECONDS if result == 0 else max(POLL_SECONDS, 5))
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

services/aios-autonomous-agent-worker/intent_runtime.py

@@ -1,273 +0,0 @@
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-import hashlib
-import json
-from pathlib import Path
-import re
-import subprocess
-from typing import Any, Mapping, Sequence
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TASK_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-REPOSITORY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{2,199}$")
-ALLOWED_ADAPTERS = frozenset({"hermes", "codex", "openclaw"})
-
-
-class IntentError(RuntimeError):
-    def __init__(self, code: str, *, details: Mapping[str, Any] | None = None) -> None:
-        super().__init__(code)
-        self.code = code
-        self.details = dict(details or {})
-
-
-def stable_digest(value: Any) -> str:
-    raw = json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    return hashlib.sha256(raw).hexdigest()
-
-
-def _text(value: Any, field: str, limit: int) -> str:
-    if not isinstance(value, str):
-        raise IntentError(f"{field.upper()}_INVALID")
-    value = value.strip()
-    if not value or len(value) > limit:
-        raise IntentError(f"{field.upper()}_INVALID")
-    return value
-
-
-def _string_list(value: Any, field: str, *, required: bool) -> tuple[str, ...]:
-    if value is None and not required:
-        return ()
-    if not isinstance(value, list) or len(value) > 64 or (required and not value):
-        raise IntentError(f"{field.upper()}_INVALID")
-    return tuple(_text(item, field, 4096) for item in value)
-
-
-@dataclass(frozen=True)
-class IntentTask:
-    task_id: str
-    goal: str
-    instructions: str
-    success_criteria: tuple[str, ...]
-    required_capabilities: tuple[str, ...]
-    digest: str
-
-    @classmethod
-    def parse(cls, task: Mapping[str, Any]) -> "IntentTask":
-        task_id = str(task.get("task_id") or "")
-        if not TASK_ID_RE.fullmatch(task_id):
-            raise IntentError("TASK_ID_INVALID")
-
-        metadata = task.get("metadata")
-        if isinstance(metadata, Mapping) and isinstance(metadata.get("execution"), Mapping):
-            raise IntentError("STRUCTURED_TASK_NOT_INTENT")
-
-        goal = _text(task.get("goal"), "goal", 16384)
-        instructions = _text(
-            task.get("instructions") or "Inspect the repository, implement the goal, and satisfy the success criteria.",
-            "instructions",
-            65536,
-        )
-        success = _string_list(task.get("success_criteria"), "success_criteria", required=True)
-        capabilities = _string_list(task.get("required_capabilities") or [], "required_capabilities", required=False)
-
-        required_markers = {"intent.task", "engineering.execute"}
-        missing = sorted(required_markers - set(capabilities))
-        if missing:
-            raise IntentError("INTENT_CAPABILITY_MARKER_REQUIRED", details={"missing": missing})
-
-        canonical = {
-            "task_id": task_id,
-            "goal": goal,
-            "instructions": instructions,
-            "success_criteria": success,
-            "required_capabilities": sorted(capabilities),
-        }
-        return cls(
-            task_id=task_id,
-            goal=goal,
-            instructions=instructions,
-            success_criteria=success,
-            required_capabilities=capabilities,
-            digest=stable_digest(canonical),
-        )
-
-
-@dataclass(frozen=True)
-class Resolution:
-    schema: str
-    task_id: str
-    repository: str
-    base_ref: str
-    base_oid: str
-    target_branch: str
-    adapter: str
-    intent_digest: str
-    goal: str
-    instructions: str
-    success_criteria: tuple[str, ...]
-    required_capabilities: tuple[str, ...]
-    resolution_digest: str
-
-    def to_json(self) -> dict[str, Any]:
-        value = asdict(self)
-        value["success_criteria"] = list(self.success_criteria)
-        value["required_capabilities"] = list(self.required_capabilities)
-        return value
-
-    @classmethod
-    def from_json(cls, value: Mapping[str, Any], *, intent: IntentTask) -> "Resolution":
-        if value.get("schema") != "aios.autonomous-intent-resolution.v2":
-            raise IntentError("RESOLUTION_SCHEMA_INVALID")
-        if value.get("task_id") != intent.task_id or value.get("intent_digest") != intent.digest:
-            raise IntentError("RESOLUTION_TASK_DRIFT")
-        result = cls(
-            schema=str(value["schema"]),
-            task_id=str(value["task_id"]),
-            repository=str(value["repository"]),
-            base_ref=str(value["base_ref"]),
-            base_oid=str(value["base_oid"]),
-            target_branch=str(value["target_branch"]),
-            adapter=str(value["adapter"]),
-            intent_digest=str(value["intent_digest"]),
-            goal=str(value["goal"]),
-            instructions=str(value["instructions"]),
-            success_criteria=tuple(str(item) for item in value.get("success_criteria") or []),
-            required_capabilities=tuple(str(item) for item in value.get("required_capabilities") or []),
-            resolution_digest=str(value["resolution_digest"]),
-        )
-        validate_resolution(result)
-        if result.resolution_digest != resolution_digest(result):
-            raise IntentError("RESOLUTION_DIGEST_INVALID")
-        return result
-
-
-def read_base_oid(authority_git_dir: Path, base_ref: str) -> str:
-    if not base_ref.startswith("refs/heads/"):
-        raise IntentError("BASE_REF_INVALID")
-    if authority_git_dir.is_symlink() or not authority_git_dir.is_dir():
-        raise IntentError("AUTHORITY_GIT_DIR_INVALID")
-    completed = subprocess.run(
-        ["/usr/bin/git", "--git-dir", str(authority_git_dir), "rev-parse", "--verify", f"{base_ref}^{{commit}}"],
-        capture_output=True,
-        text=True,
-        check=False,
-        timeout=30,
-        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
-    )
-    oid = completed.stdout.strip()
-    if completed.returncode != 0 or not OID_RE.fullmatch(oid):
-        raise IntentError("BASE_OID_UNAVAILABLE")
-    return oid
-
-
-def derive_branch(task_id: str, digest: str) -> str:
-    slug = re.sub(r"[^A-Za-z0-9._-]+", "-", task_id).strip(".-").lower() or "task"
-    slug = slug[:100]
-    branch = f"agent/intent/{slug}-{digest[:12]}"
-    if len(branch) > 180:
-        branch = branch[:167] + "-" + digest[:12]
-    if ".." in branch or branch.endswith(("/", ".", ".lock")):
-        raise IntentError("TARGET_BRANCH_INVALID")
-    return branch
-
-
-def select_adapter(capabilities: Sequence[str], available: Sequence[str], default_adapter: str) -> str:
-    advertised = set(available)
-    if not advertised.issubset(ALLOWED_ADAPTERS):
-        raise IntentError("ADAPTER_CONFIGURATION_INVALID")
-    requested = {
-        item.split(".", 2)[-1]
-        for item in capabilities
-        if item.startswith("agent.runtime.")
-    }
-    requested.discard("")
-    if len(requested) > 1:
-        raise IntentError("MULTIPLE_AGENT_RUNTIMES_REQUIRED")
-    adapter = next(iter(requested)) if requested else default_adapter
-    if adapter not in ALLOWED_ADAPTERS:
-        raise IntentError("AGENT_RUNTIME_INVALID")
-    if adapter not in advertised:
-        raise IntentError("AGENT_RUNTIME_UNAVAILABLE", details={"adapter": adapter})
-    return adapter
-
-
-def resolution_digest(value: Resolution) -> str:
-    return stable_digest({
-        "schema": value.schema,
-        "task_id": value.task_id,
-        "repository": value.repository,
-        "base_ref": value.base_ref,
-        "base_oid": value.base_oid,
-        "target_branch": value.target_branch,
-        "adapter": value.adapter,
-        "intent_digest": value.intent_digest,
-        "goal": value.goal,
-        "instructions": value.instructions,
-        "success_criteria": value.success_criteria,
-        "required_capabilities": sorted(value.required_capabilities),
-    })
-
-
-def validate_resolution(value: Resolution) -> None:
-    if not TASK_ID_RE.fullmatch(value.task_id):
-        raise IntentError("TASK_ID_INVALID")
-    if not REPOSITORY_RE.fullmatch(value.repository) or value.repository.startswith(("/", ".")):
-        raise IntentError("REPOSITORY_INVALID")
-    if not value.base_ref.startswith("refs/heads/"):
-        raise IntentError("BASE_REF_INVALID")
-    if not OID_RE.fullmatch(value.base_oid):
-        raise IntentError("BASE_OID_INVALID")
-    if not value.target_branch.startswith("agent/intent/"):
-        raise IntentError("TARGET_BRANCH_POLICY_INVALID")
-    if value.adapter not in ALLOWED_ADAPTERS:
-        raise IntentError("AGENT_RUNTIME_INVALID")
-
-
-def resolve(
-    task: Mapping[str, Any],
-    *,
-    authority_git_dir: Path,
-    repository: str,
-    base_ref: str,
-    available_adapters: Sequence[str],
-    default_adapter: str,
-    prior: Mapping[str, Any] | None = None,
-) -> Resolution:
-    intent = IntentTask.parse(task)
-    if prior is not None:
-        return Resolution.from_json(prior, intent=intent)
-    if not REPOSITORY_RE.fullmatch(repository) or repository.startswith(("/", ".")):
-        raise IntentError("REPOSITORY_INVALID")
-    base_oid = read_base_oid(authority_git_dir, base_ref)
-    adapter = select_adapter(intent.required_capabilities, available_adapters, default_adapter)
-    provisional = Resolution(
-        schema="aios.autonomous-intent-resolution.v2",
-        task_id=intent.task_id,
-        repository=repository,
-        base_ref=base_ref,
-        base_oid=base_oid,
-        target_branch=derive_branch(intent.task_id, intent.digest),
-        adapter=adapter,
-        intent_digest=intent.digest,
-        goal=intent.goal,
-        instructions=intent.instructions,
-        success_criteria=intent.success_criteria,
-        required_capabilities=intent.required_capabilities,
-        resolution_digest="",
-    )
-    result = Resolution(
-        **{**asdict(provisional), "resolution_digest": resolution_digest(provisional)}
-    )
-    validate_resolution(result)
-    return result
-
-
-def is_claimable_intent(task: Mapping[str, Any], worker_capabilities: Sequence[str]) -> bool:
-    try:
-        intent = IntentTask.parse(task)
-    except IntentError:
-        return False
-    required = set(intent.required_capabilities)
-    return required.issubset(set(worker_capabilities))

services/aios-autonomous-agent-worker/register.py

@@ -1,197 +0,0 @@
-#!/usr/bin/env python3
-from __future__ import annotations
-
-import json
-import os
-from pathlib import Path
-import subprocess
-import tempfile
-import urllib.error
-import urllib.request
-from datetime import datetime, timezone
-from typing import Any
-
-
-BASE = os.environ.get("AIOS_AGENT_TASK_API_URL", "http://127.0.0.1:18940").rstrip("/")
-AGENT_ID = os.environ.get("AIOS_AGENT_ID", "online-engineering-worker-cn-network-mkt-autonomous-20260815")
-AGENT_TYPE = os.environ.get("AIOS_AGENT_TYPE", "trusted-online-engineering-worker")
-AGENT_VERSION = os.environ.get("AIOS_AGENT_VERSION", "2026-08-15.4-autonomous-intent")
-STATE_DIR = Path(os.environ.get("AIOS_WORKER_REGISTRATION_STATE", "/var/lib/aios-autonomous-agent-worker/registration"))
-CREDENTIAL_PATH = Path(os.environ.get("AIOS_WORKER_ENCRYPTED_CREDENTIAL", "/etc/credstore.encrypted/aios-autonomous-agent-worker/agent_token"))
-IDENTITY_PATH = STATE_DIR / "identity.json"
-PROJECTION_PROVIDER = "BridgeV2RuntimeCredentialProjection"
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def runtime_capabilities() -> list[str]:
-    values = [
-        "online_agent_task_api", "task.poll", "task.claim", "task.heartbeat", "task.result",
-        "intent.task", "engineering.consumer", "engineering.execute", "engineering.autonomous",
-        "workspace.worktree", "git.read", "git.diff", "git.test",
-        "governed.write.branch", "governed.write.file",
-    ]
-    hermes = os.environ.get("AIOS_HERMES_BROKER_SOCKET", "")
-    codex = os.environ.get("AIOS_CODEX_BROKER_SOCKET", "")
-    openclaw = os.environ.get("AIOS_OPENCLAW_BROKER_SOCKET", "")
-    if hermes and Path(hermes).is_socket():
-        values.append("agent.runtime.hermes")
-    if codex and Path(codex).is_socket():
-        values.append("agent.runtime.codex")
-    if openclaw and Path(openclaw).is_socket():
-        values.append("agent.runtime.openclaw")
-    return values
-
-
-def api_call(method: str, route: str, token: str, body: dict[str, Any] | None = None) -> tuple[int, dict[str, Any]]:
-    payload = None if body is None else json.dumps(body, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
-    if payload is not None:
-        headers["Content-Type"] = "application/json"
-    request = urllib.request.Request(BASE + route, data=payload, headers=headers, method=method)
-    try:
-        with urllib.request.urlopen(request, timeout=15) as response:
-            value = json.loads(response.read().decode("utf-8"))
-            return response.status, value if isinstance(value, dict) else {}
-    except urllib.error.HTTPError as exc:
-        try:
-            value = json.loads(exc.read(2048).decode("utf-8"))
-        except Exception:
-            value = {"error": "HTTP_ERROR"}
-        return exc.code, value if isinstance(value, dict) else {"error": "HTTP_ERROR"}
-    except (urllib.error.URLError, TimeoutError):
-        return 599, {"error": "AGENT_TASK_API_UNAVAILABLE"}
-
-
-def encrypted_credential_is_valid() -> bool:
-    if not CREDENTIAL_PATH.is_file() or CREDENTIAL_PATH.is_symlink():
-        return False
-    result = subprocess.run(
-        ["systemd-creds", "decrypt", "--with-key=host", str(CREDENTIAL_PATH), "/dev/null"],
-        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False, timeout=15,
-    )
-    return result.returncode == 0
-
-
-def load_identity() -> dict[str, Any] | None:
-    if not IDENTITY_PATH.is_file() or IDENTITY_PATH.is_symlink():
-        return None
-    try:
-        value = json.loads(IDENTITY_PATH.read_text(encoding="utf-8"))
-    except Exception:
-        return None
-    return value if isinstance(value, dict) else None
-
-
-def identity_matches(value: dict[str, Any] | None) -> bool:
-    return bool(
-        value
-        and value.get("agent_id") == AGENT_ID
-        and value.get("agent_type") == AGENT_TYPE
-        and value.get("agent_version") == AGENT_VERSION
-        and value.get("task_scope") == "intent-only"
-        and value.get("credential_projection_provider") == PROJECTION_PROVIDER
-    )
-
-
-def encrypt_agent_token(token: str) -> None:
-    CREDENTIAL_PATH.parent.mkdir(parents=True, mode=0o700, exist_ok=True)
-    fd, temporary = tempfile.mkstemp(prefix=".agent-token.", dir=str(CREDENTIAL_PATH.parent))
-    os.close(fd)
-    os.unlink(temporary)
-    try:
-        result = subprocess.run(
-            ["systemd-creds", "encrypt", "--with-key=host", "--name=agent_token", "/dev/stdin", temporary],
-            input=(token + "\n").encode("utf-8"),
-            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False, timeout=20,
-        )
-        if result.returncode != 0:
-            raise RuntimeError("AGENT_CREDENTIAL_ENCRYPT_FAILED")
-        os.chmod(temporary, 0o600)
-        os.replace(temporary, CREDENTIAL_PATH)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def write_identity() -> None:
-    value = {
-        "agent_id": AGENT_ID,
-        "agent_type": AGENT_TYPE,
-        "agent_version": AGENT_VERSION,
-        "task_scope": "intent-only",
-        "credential_projection_provider": PROJECTION_PROVIDER,
-        "credential_delivery": "systemd-LoadCredentialEncrypted",
-        "task_api_url": BASE,
-        "task_api_schema": "aios.agent-task.v1",
-        "execution_backend": "autonomous-intent-worker-v2",
-        "runtime_only_secret_delivery": True,
-        "main_write": False,
-        "production_write": False,
-        "force_push": False,
-        "tag_write": False,
-        "baseline_write": False,
-        "capabilities": runtime_capabilities(),
-        "created_at": now(),
-    }
-    STATE_DIR.mkdir(parents=True, mode=0o750, exist_ok=True)
-    fd, temporary = tempfile.mkstemp(prefix="identity.", dir=str(STATE_DIR))
-    try:
-        with os.fdopen(fd, "w", encoding="utf-8") as handle:
-            json.dump(value, handle, ensure_ascii=False, sort_keys=True)
-            handle.write("\n")
-        os.chmod(temporary, 0o640)
-        os.replace(temporary, IDENTITY_PATH)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def register_or_recover() -> str:
-    STATE_DIR.mkdir(parents=True, mode=0o750, exist_ok=True)
-    existing = load_identity()
-    if CREDENTIAL_PATH.exists():
-        if not identity_matches(existing):
-            raise RuntimeError("AGENT_IDENTITY_BINDING_CONFLICT")
-        if not encrypted_credential_is_valid():
-            raise RuntimeError("AGENT_ENCRYPTED_CREDENTIAL_INVALID")
-        return "RECOVERED"
-    if existing is not None:
-        raise RuntimeError("AGENT_CREDENTIAL_MISSING_AFTER_PRIOR_REGISTRATION")
-    credential_directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", ""))
-    control_path = credential_directory / "bridge_control_token"
-    if not control_path.is_file():
-        raise RuntimeError("BRIDGE_RUNTIME_CONTROL_CREDENTIAL_UNAVAILABLE")
-    control_token = control_path.read_text(encoding="utf-8").strip()
-    status, response = api_call(
-        "POST", "/v1/agents/register", control_token,
-        {
-            "agent_id": AGENT_ID,
-            "agent_type": AGENT_TYPE,
-            "agent_version": AGENT_VERSION,
-            "capabilities": runtime_capabilities(),
-            "metadata": {
-                "task_scope": "intent-only",
-                "credential_projection_provider": PROJECTION_PROVIDER,
-                "runtime_only_secret_delivery": True,
-                "execution_backend": "autonomous-intent-worker-v2",
-                "main_write": False,
-                "production_write": False,
-                "force_push": False,
-            },
-        },
-    )
-    if status != 201:
-        raise RuntimeError("AGENT_REGISTER_FAILED_" + str(response.get("error") or status))
-    token = response.get("agent_token")
-    if not isinstance(token, str) or len(token) < 24:
-        raise RuntimeError("AGENT_TOKEN_NOT_RETURNED")
-    encrypt_agent_token(token)
-    write_identity()
-    return "REGISTERED"
-
-
-if __name__ == "__main__":
-    raise SystemExit(0 if register_or_recover() in {"REGISTERED", "RECOVERED"} else 20)

services/aios-autonomous-agent-worker/runtime_client.py

@@ -1,224 +0,0 @@
-from __future__ import annotations
-
-from dataclasses import dataclass
-import json
-from pathlib import Path
-import re
-import socket
-import subprocess
-from typing import Any, Mapping, Sequence
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-MAX_BYTES = 1024 * 1024
-MAX_CHANGED_FILES = 256
-MAX_FILE_BYTES = 4 * 1024 * 1024
-SENSITIVE_NAMES = frozenset({
-    ".env", ".env.local", ".env.production", "id_rsa", "id_ed25519",
-    "credentials", "credentials.json",
-})
-SENSITIVE_SUFFIXES = (".key", ".p12", ".pfx")
-SECRET_PATTERNS = (
-    re.compile(rb"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
-    re.compile(rb"\bAKIA[0-9A-Z]{16}\b"),
-    re.compile(rb"\bghp_[A-Za-z0-9]{30,}\b"),
-    re.compile(rb"\bsk-[A-Za-z0-9_-]{24,}\b"),
-)
-
-
-class RuntimeErrorV2(RuntimeError):
-    def __init__(self, code: str, *, details: Mapping[str, Any] | None = None) -> None:
-        super().__init__(code)
-        self.code = code
-        self.details = dict(details or {})
-
-
-def safe_relative_path(value: str) -> str:
-    if (
-        not value
-        or value.startswith(("/", "~"))
-        or "\\" in value
-        or "\x00" in value
-        or any(part in {"", ".", ".."} for part in value.split("/"))
-    ):
-        raise RuntimeErrorV2("CHANGED_PATH_INVALID", details={"path": value[:160]})
-    lowered = value.split("/")[-1].lower()
-    if value.startswith(".git/") or value in {".git", ".gitmodules"}:
-        raise RuntimeErrorV2("GIT_METADATA_CHANGE_REJECTED", details={"path": value})
-    if lowered in SENSITIVE_NAMES or lowered.endswith(SENSITIVE_SUFFIXES):
-        raise RuntimeErrorV2("SENSITIVE_PATH_REJECTED", details={"path": value})
-    return value
-
-
-def git(worktree: Path, args: Sequence[str], timeout: int = 60) -> bytes:
-    completed = subprocess.run(
-        ["/usr/bin/git", "-C", str(worktree), *args],
-        capture_output=True,
-        check=False,
-        timeout=timeout,
-        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
-    )
-    if completed.returncode != 0:
-        raise RuntimeErrorV2("WORKTREE_GIT_FAILED", details={"operation": args[0] if args else ""})
-    return completed.stdout
-
-
-def _zpaths(raw: bytes) -> list[str]:
-    result: list[str] = []
-    for item in raw.split(b"\0"):
-        if not item:
-            continue
-        try:
-            result.append(item.decode("utf-8"))
-        except UnicodeDecodeError as exc:
-            raise RuntimeErrorV2("WORKTREE_PATH_ENCODING_INVALID") from exc
-    return result
-
-
-def collect_changes(worktree: Path, base_oid: str) -> list[str]:
-    if not OID_RE.fullmatch(base_oid):
-        raise RuntimeErrorV2("BASE_OID_INVALID")
-    head = git(worktree, ["rev-parse", "HEAD"]).decode("ascii", "strict").strip()
-    if head != base_oid:
-        raise RuntimeErrorV2("WORKTREE_HEAD_MUTATED", details={"expected": base_oid, "actual": head})
-    tracked = _zpaths(git(worktree, ["diff", "--name-only", "--no-renames", "-z", base_oid, "--"]))
-    untracked = _zpaths(git(worktree, ["ls-files", "--others", "--exclude-standard", "-z"]))
-    changed = sorted({safe_relative_path(item) for item in tracked + untracked})
-    if not changed:
-        raise RuntimeErrorV2("AGENT_PRODUCED_NO_CHANGES")
-    if len(changed) > MAX_CHANGED_FILES:
-        raise RuntimeErrorV2("CHANGED_FILE_LIMIT_EXCEEDED")
-    root = worktree.resolve()
-    for relative in changed:
-        path = (root / relative).resolve(strict=False)
-        if root not in path.parents or not path.is_file() or path.is_symlink():
-            raise RuntimeErrorV2("CHANGED_FILE_UNSUPPORTED", details={"path": relative})
-        if path.stat().st_size > MAX_FILE_BYTES:
-            raise RuntimeErrorV2("CHANGED_FILE_TOO_LARGE", details={"path": relative})
-    return changed
-
-
-def scan_secrets(worktree: Path, changed: Sequence[str]) -> None:
-    root = worktree.resolve()
-    for relative in changed:
-        path = (root / safe_relative_path(relative)).resolve()
-        raw = path.read_bytes()
-        for pattern in SECRET_PATTERNS:
-            if pattern.search(raw):
-                raise RuntimeErrorV2("SECRET_MATERIAL_REJECTED", details={"path": relative})
-
-
-@dataclass(frozen=True)
-class RuntimeResult:
-    status: str
-    summary: str
-    verification: tuple[dict[str, Any], ...]
-    evidence: dict[str, Any]
-
-    @classmethod
-    def parse(cls, value: Mapping[str, Any]) -> "RuntimeResult":
-        if value.get("schema") != "aios.online-agent.runtime-result.v1":
-            raise RuntimeErrorV2("RUNTIME_RESULT_SCHEMA_INVALID")
-        status = str(value.get("status") or "")
-        if status not in {"COMPLETED", "BLOCKED", "FAILED"}:
-            raise RuntimeErrorV2("RUNTIME_RESULT_STATUS_INVALID")
-        summary = str(value.get("summary") or "").strip()
-        if not summary or len(summary) > 8192:
-            raise RuntimeErrorV2("RUNTIME_RESULT_SUMMARY_INVALID")
-        verification = value.get("verification") or []
-        evidence = value.get("evidence") or {}
-        if not isinstance(verification, list) or len(verification) > 64:
-            raise RuntimeErrorV2("RUNTIME_VERIFICATION_INVALID")
-        if not isinstance(evidence, Mapping):
-            raise RuntimeErrorV2("RUNTIME_EVIDENCE_INVALID")
-        return cls(status, summary, tuple(dict(item) for item in verification if isinstance(item, Mapping)), dict(evidence))
-
-
-def request_payload(
-    *,
-    adapter: str,
-    task_id: str,
-    goal: str,
-    instructions: str,
-    success_criteria: Sequence[str],
-    repository: str,
-    base_oid: str,
-    target_branch: str,
-    worktree: Path,
-) -> dict[str, Any]:
-    if adapter not in {"hermes", "codex", "openclaw"}:
-        raise RuntimeErrorV2("ADAPTER_INVALID")
-    if not OID_RE.fullmatch(base_oid):
-        raise RuntimeErrorV2("BASE_OID_INVALID")
-    return {
-        "schema": "aios.online-agent.runtime-request.v1",
-        "adapter": adapter,
-        "task": {
-            "task_id": task_id,
-            "goal": goal,
-            "instructions": instructions,
-            "success_criteria": list(success_criteria),
-        },
-        "execution_context": {
-            "repository": repository,
-            "base_oid": base_oid,
-            "target_branch": target_branch,
-            "worktree": str(worktree),
-        },
-        "policy": {
-            "authoritative_repository_write": False,
-            "direct_git_ref_mutation": False,
-            "direct_git_push": False,
-            "direct_git_commit": False,
-            "main_write": False,
-            "force_push": False,
-            "production_write": False,
-            "tag_write": False,
-            "baseline_write": False,
-            "task_api_credential_visible": False,
-            "writer_lease_visible": False,
-        },
-    }
-
-
-def invoke(socket_path: Path, payload: Mapping[str, Any], timeout_seconds: int) -> RuntimeResult:
-    if not socket_path.is_absolute():
-        raise RuntimeErrorV2("RUNTIME_SOCKET_NOT_ABSOLUTE")
-    if not 1 <= timeout_seconds <= 7200:
-        raise RuntimeErrorV2("RUNTIME_TIMEOUT_INVALID")
-    raw = json.dumps(dict(payload), ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8") + b"\n"
-    if len(raw) > MAX_BYTES:
-        raise RuntimeErrorV2("RUNTIME_REQUEST_TOO_LARGE")
-
-    client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    client.settimeout(timeout_seconds)
-    try:
-        client.connect(str(socket_path))
-        client.sendall(raw)
-        client.shutdown(socket.SHUT_WR)
-        chunks: list[bytes] = []
-        total = 0
-        while True:
-            chunk = client.recv(65536)
-            if not chunk:
-                break
-            total += len(chunk)
-            if total > MAX_BYTES:
-                raise RuntimeErrorV2("RUNTIME_RESPONSE_TOO_LARGE")
-            chunks.append(chunk)
-    except (OSError, socket.timeout) as exc:
-        raise RuntimeErrorV2("RUNTIME_UNAVAILABLE", details={"socket": str(socket_path)}) from exc
-    finally:
-        client.close()
-    try:
-        value = json.loads(b"".join(chunks).decode("utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise RuntimeErrorV2("RUNTIME_RESPONSE_INVALID") from exc
-    if not isinstance(value, Mapping):
-        raise RuntimeErrorV2("RUNTIME_RESPONSE_INVALID")
-    result = RuntimeResult.parse(value)
-    if result.status == "BLOCKED":
-        raise RuntimeErrorV2("RUNTIME_BLOCKED", details={"summary": result.summary})
-    if result.status == "FAILED":
-        raise RuntimeErrorV2("RUNTIME_FAILED", details={"summary": result.summary})
-    return result

services/aios-autonomous-agent-worker/runtime_selftest.py

@@ -1,101 +0,0 @@
-#!/usr/bin/env python3
-from __future__ import annotations
-
-import json
-import os
-from pathlib import Path
-import shutil
-import subprocess
-import tempfile
-
-from runtime_client import collect_changes, invoke, request_payload, scan_secrets
-
-
-WORKSPACE_ROOT = Path(os.environ.get(
-    "AIOS_AUTONOMOUS_WORKSPACE_ROOT",
-    "/var/lib/aios-autonomous-agent-worker/workspaces",
-))
-ADAPTER = os.environ.get("AIOS_AUTONOMOUS_SELFTEST_ADAPTER", "openclaw")
-SOCKET = Path(os.environ.get(
-    "AIOS_AUTONOMOUS_SELFTEST_BROKER_SOCKET",
-    f"/run/aios-agent-runtime/{ADAPTER}.sock",
-))
-
-
-def run(argv: list[str], cwd: Path) -> str:
-    completed = subprocess.run(
-        argv,
-        cwd=str(cwd),
-        text=True,
-        capture_output=True,
-        check=False,
-        timeout=60,
-        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
-    )
-    if completed.returncode != 0:
-        raise RuntimeError(f"SELFTEST_COMMAND_FAILED:{argv[0]}:{completed.returncode}")
-    return completed.stdout.strip()
-
-
-def main() -> int:
-    if not SOCKET.is_socket():
-        raise RuntimeError("AUTONOMOUS_ENGINEERING_BACKEND_UNAVAILABLE")
-    WORKSPACE_ROOT.mkdir(parents=True, mode=0o750, exist_ok=True)
-    run_root = Path(tempfile.mkdtemp(prefix="runtime-selftest-", dir=str(WORKSPACE_ROOT)))
-    repo = run_root / "worktree"
-    repo.mkdir()
-    try:
-        run(["/usr/bin/git", "init", str(repo)], run_root)
-        run(["/usr/bin/git", "-C", str(repo), "config", "user.email", "selftest@example.invalid"], run_root)
-        run(["/usr/bin/git", "-C", str(repo), "config", "user.name", "AIOS Runtime Selftest"], run_root)
-        marker = repo / "agent_runtime_selftest.txt"
-        marker.write_text("VALUE=1\n", encoding="utf-8")
-        run(["/usr/bin/git", "-C", str(repo), "add", "agent_runtime_selftest.txt"], run_root)
-        run(["/usr/bin/git", "-C", str(repo), "commit", "-m", "selftest base"], run_root)
-        base_oid = run(["/usr/bin/git", "-C", str(repo), "rev-parse", "HEAD"], run_root)
-
-        payload = request_payload(
-            adapter=ADAPTER,
-            task_id="autonomous-runtime-selftest",
-            goal="Change agent_runtime_selftest.txt so it contains exactly VALUE=2 followed by a newline.",
-            instructions=(
-                "Modify only agent_runtime_selftest.txt in the provided disposable worktree. "
-                "Do not commit, push, change Git refs, or access task/governed-write credentials."
-            ),
-            success_criteria=[
-                "agent_runtime_selftest.txt contains VALUE=2",
-                "Git HEAD remains unchanged",
-            ],
-            repository="selftest/disposable",
-            base_oid=base_oid,
-            target_branch="agent/intent/runtime-selftest",
-            worktree=repo,
-        )
-        result = invoke(SOCKET, payload, timeout_seconds=300)
-        changed = collect_changes(repo, base_oid)
-        scan_secrets(repo, changed)
-        content = marker.read_text(encoding="utf-8")
-        head = run(["/usr/bin/git", "-C", str(repo), "rev-parse", "HEAD"], run_root)
-        if content != "VALUE=2\n":
-            raise RuntimeError("RUNTIME_SELFTEST_CONTENT_MISMATCH")
-        if head != base_oid:
-            raise RuntimeError("RUNTIME_SELFTEST_HEAD_MUTATED")
-        if changed != ["agent_runtime_selftest.txt"]:
-            raise RuntimeError("RUNTIME_SELFTEST_UNEXPECTED_DIFF")
-        print(json.dumps({
-            "status": "PASS",
-            "adapter": ADAPTER,
-            "base_oid": base_oid,
-            "changed_files": changed,
-            "head_unchanged": True,
-            "runtime_summary": result.summary,
-            "task_api_token_visible_to_runtime": False,
-            "writer_lease_visible_to_runtime": False,
-        }, sort_keys=True))
-        return 0
-    finally:
-        shutil.rmtree(run_root, ignore_errors=True)
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

services/aios-online-agent-worker/README.md

@@ -1,54 +0,0 @@
-# Generic Governed Online Agent Worker
-
-This worker is a pull-based, restartable consumer for `aios.agent-task.v1`.
-The service configuration contains only stable runtime identity, capability
-names, API endpoints, heartbeat timing, and the credential projection. It does
-not contain a task id, repository base OID, target branch, or plan-file path.
-
-## Dynamic task contract
-
-Engineering tasks carry `metadata.execution` with schema
-`aios.online-agent.execution.v2`. The payload supplies the repository, exact
-base OID, target branch, detached-worktree policy, adapter name, explicit file
-change set, verification commands, and governed commit idempotency keys.
-Task prose is descriptive only and is never passed to a shell.
-
-The worker accepts only structured operations:
-
-- `deterministic`: allow-listed file changes and test commands;
-- `codex`: fail-closed until a task supplies an explicit Codex file/command
-  policy;
-- `hermes`: fail-closed because the current Hermes runtime is a user-chat
-  service, not an engineering executor.
-
-All command execution uses `shell=False`, fixed program allowlists, relative
-paths beneath an ephemeral detached worktree, and output redaction. Direct
-`git branch`, `update-ref`, `push`, `commit`, `reset`, `clean`, main,
-production, tag, and baseline mutations are rejected by the worker.
-
-## Governed write path
-
-The worker calls the Bridge in this order:
-
-1. `POST /v2/governed-task`;
-2. `POST /v2/writer-lease`;
-3. `POST /v2/commit-files`;
-4. read-only authority-ref visibility verification.
-
-CREATE_NEW is represented by the task payload and is normalized by the Bridge
-lease authority. The worker never creates an authoritative ref itself.
-
-## Lifecycle and recovery
-
-The runtime registers with `register_or_recover`, receives its agent token
-once, and stores only the encrypted systemd credential. The consumer loops over
-poll, atomically claims one task, sends the first heartbeat, emits
-`TASK_STARTED`, and continues heartbeats while executing.
-
-State is atomically stored per task without agent or lease token material. If
-the process stops after a governed commit but before result submission, the
-next lease attempt reuses the stable governed idempotency key and submits the
-stored commit evidence without issuing a second commit.
-
-The control plane must independently verify submitted results; worker-local
-success is not production or mainline authorization.

services/aios-online-agent-worker/aios_online_agent_worker/__init__.py

@@ -1,3 +0,0 @@
-"""Generic governed Online Agent Worker runtime."""
-
-__all__ = ["worker"]

services/aios-online-agent-worker/register.py

@@ -1,157 +0,0 @@
-#!/usr/bin/env python3
-"""Register or recover the generic Online Agent using runtime-only secrets."""
-
-from __future__ import annotations
-
-import json
-import os
-from pathlib import Path
-import subprocess
-import tempfile
-import urllib.error
-import urllib.request
-from datetime import datetime, timezone
-from typing import Any
-
-
-BASE = os.environ.get("AIOS_AGENT_TASK_API_URL", "http://127.0.0.1:18940").rstrip("/")
-AGENT_ID = os.environ.get("AIOS_AGENT_ID", "online-engineering-worker-cn-network-mkt-generic-20260815")
-AGENT_TYPE = os.environ.get("AIOS_AGENT_TYPE", "trusted-online-engineering-worker")
-AGENT_VERSION = os.environ.get("AIOS_AGENT_VERSION", "2026-08-15.3-generic")
-PROJECTION_PROVIDER = "BridgeV2RuntimeCredentialProjection"
-STATE_DIR = Path(os.environ.get("AIOS_WORKER_REGISTRATION_STATE", "/var/lib/aios-online-agent-worker-20260815/registration"))
-CREDENTIAL_PATH = Path(os.environ.get("AIOS_WORKER_ENCRYPTED_CREDENTIAL", "/etc/credstore.encrypted/aios-online-agent-worker-20260815/agent_token"))
-IDENTITY_PATH = STATE_DIR / "identity.json"
-AUDIT_PATH = STATE_DIR / "events.jsonl"
-CAPABILITIES = [
-    "online_agent_task_api", "task.poll", "task.claim", "task.heartbeat", "task.result",
-    "engineering.consumer", "engineering.execute", "workspace.worktree", "git.read", "git.diff",
-    "git.test", "governed.write.branch", "governed.write.file",
-]
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def audit(event_type: str, **fields: Any) -> None:
-    STATE_DIR.mkdir(mode=0o750, parents=True, exist_ok=True)
-    record = {"event_type": event_type, "created_at": now(), "agent_id": AGENT_ID, "credential_material_exposed": False, **fields}
-    with AUDIT_PATH.open("a", encoding="utf-8") as handle:
-        handle.write(json.dumps(record, ensure_ascii=False, sort_keys=True) + "\n")
-    os.chmod(AUDIT_PATH, 0o640)
-    print(json.dumps(record, ensure_ascii=False, sort_keys=True), flush=True)
-
-
-def api_call(method: str, route: str, token: str, body: dict[str, Any] | None = None) -> tuple[int, dict[str, Any]]:
-    payload = None if body is None else json.dumps(body, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
-    if payload is not None:
-        headers["Content-Type"] = "application/json"
-    request = urllib.request.Request(BASE + route, data=payload, headers=headers, method=method)
-    try:
-        with urllib.request.urlopen(request, timeout=15) as response:
-            value = json.loads(response.read().decode("utf-8"))
-            return response.status, value if isinstance(value, dict) else {}
-    except urllib.error.HTTPError as exc:
-        try:
-            value = json.loads(exc.read(2048).decode("utf-8"))
-        except Exception:
-            value = {"error": "HTTP_ERROR"}
-        return exc.code, value if isinstance(value, dict) else {"error": "HTTP_ERROR"}
-    except (urllib.error.URLError, TimeoutError):
-        return 599, {"error": "AGENT_TASK_API_UNAVAILABLE"}
-
-
-def read_identity() -> dict[str, Any] | None:
-    if not IDENTITY_PATH.is_file() or IDENTITY_PATH.is_symlink():
-        return None
-    try:
-        value = json.loads(IDENTITY_PATH.read_text(encoding="utf-8"))
-    except Exception:
-        return None
-    return value if isinstance(value, dict) else None
-
-
-def identity_matches(value: dict[str, Any] | None) -> bool:
-    return bool(value and value.get("agent_id") == AGENT_ID and value.get("agent_type") == AGENT_TYPE and value.get("agent_version") == AGENT_VERSION and value.get("credential_projection_provider") == PROJECTION_PROVIDER and value.get("task_scope") == "dynamic")
-
-
-def encrypted_credential_is_valid() -> bool:
-    if not CREDENTIAL_PATH.is_file() or CREDENTIAL_PATH.is_symlink():
-        return False
-    result = subprocess.run(["systemd-creds", "decrypt", "--with-key=host", str(CREDENTIAL_PATH), "/dev/null"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False, timeout=15)
-    return result.returncode == 0
-
-
-def write_identity() -> None:
-    value = {"agent_id": AGENT_ID, "agent_type": AGENT_TYPE, "agent_version": AGENT_VERSION, "task_scope": "dynamic", "credential_projection_provider": PROJECTION_PROVIDER, "credential_delivery": "systemd-LoadCredentialEncrypted", "task_api_url": BASE, "task_api_schema": "aios.agent-task.v1", "execution_backend": "generic-online-agent-worker-v2", "runtime_only_secret_delivery": True, "production_write": False, "main_write": False, "force_push": False, "tag_write": False, "baseline_write": False, "writer_lease": True, "created_at": now()}
-    STATE_DIR.mkdir(mode=0o750, parents=True, exist_ok=True)
-    fd, temporary = tempfile.mkstemp(prefix="identity.", dir=str(STATE_DIR))
-    try:
-        with os.fdopen(fd, "w", encoding="utf-8") as handle:
-            json.dump(value, handle, ensure_ascii=False, sort_keys=True)
-            handle.write("\n")
-        os.chmod(temporary, 0o640)
-        os.replace(temporary, IDENTITY_PATH)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def encrypt_agent_token(agent_token: str) -> None:
-    CREDENTIAL_PATH.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
-    fd, temporary = tempfile.mkstemp(prefix=".online-agent-token.", dir=str(CREDENTIAL_PATH.parent))
-    os.close(fd)
-    os.unlink(temporary)
-    try:
-        result = subprocess.run(["systemd-creds", "encrypt", "--with-key=host", "--name=agent_token", "/dev/stdin", temporary], input=(agent_token + "\n").encode("utf-8"), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False, timeout=20)
-        if result.returncode != 0:
-            raise RuntimeError("AGENT_CREDENTIAL_ENCRYPT_FAILED")
-        os.chmod(temporary, 0o600)
-        os.replace(temporary, CREDENTIAL_PATH)
-        os.chmod(CREDENTIAL_PATH, 0o600)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def register_or_recover() -> str:
-    STATE_DIR.mkdir(mode=0o750, parents=True, exist_ok=True)
-    existing = read_identity()
-    if CREDENTIAL_PATH.exists():
-        if not identity_matches(existing):
-            raise RuntimeError("AGENT_IDENTITY_BINDING_CONFLICT")
-        if not encrypted_credential_is_valid():
-            raise RuntimeError("AGENT_ENCRYPTED_CREDENTIAL_INVALID")
-        audit("AGENT_RECOVERED", credential_delivery="systemd-LoadCredentialEncrypted", credential_projection_provider=PROJECTION_PROVIDER, register_or_recover=True)
-        return "RECOVERED"
-    if existing is not None:
-        raise RuntimeError("AGENT_CREDENTIAL_MISSING_AFTER_PRIOR_REGISTRATION")
-    credential_directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", ""))
-    control_path = credential_directory / "bridge_control_token"
-    if not control_path.is_file():
-        raise RuntimeError("BRIDGE_RUNTIME_CONTROL_CREDENTIAL_UNAVAILABLE")
-    control_token = control_path.read_text(encoding="utf-8").strip()
-    if len(control_token) < 32:
-        raise RuntimeError("BRIDGE_RUNTIME_CONTROL_CREDENTIAL_INVALID")
-    status, response = api_call("POST", "/v1/agents/register", control_token, {"agent_id": AGENT_ID, "agent_type": AGENT_TYPE, "agent_version": AGENT_VERSION, "capabilities": CAPABILITIES, "metadata": {"task_scope": "dynamic", "credential_projection_provider": PROJECTION_PROVIDER, "runtime_only_secret_delivery": True, "task_api_schema": "aios.agent-task.v1", "execution_backend": "generic-online-agent-worker-v2", "production_write": False, "main_write": False, "force_push": False, "tag_write": False, "baseline_write": False, "writer_lease": True}})
-    if status == 409 and response.get("error") == "AGENT_ALREADY_EXISTS":
-        raise RuntimeError("AGENT_ALREADY_EXISTS_RECOVERY_CREDENTIAL_UNAVAILABLE")
-    if status != 201:
-        raise RuntimeError("AGENT_REGISTER_FAILED_" + str(response.get("error") or status))
-    agent_token = response.get("agent_token")
-    if not isinstance(agent_token, str) or len(agent_token) < 24:
-        raise RuntimeError("AGENT_TOKEN_NOT_RETURNED")
-    encrypt_agent_token(agent_token)
-    write_identity()
-    audit("AGENT_REGISTERED", credential_delivery="systemd-LoadCredentialEncrypted", credential_projection_provider=PROJECTION_PROVIDER, register_or_recover=True)
-    return "REGISTERED"
-
-
-if __name__ == "__main__":
-    try:
-        raise SystemExit(0 if register_or_recover() in {"REGISTERED", "RECOVERED"} else 20)
-    except Exception as exc:
-        audit("AGENT_REGISTRATION_FAILED", error=type(exc).__name__)
-        raise SystemExit(20)

services/aios-online-agent-worker/test_worker_contract.py

@@ -1,79 +0,0 @@
-from __future__ import annotations
-
-import os
-from pathlib import Path
-
-from aios_online_agent_worker.worker import ExecutionEnvelope, WorkerError, sanitize  # noqa: E402
-
-
-BASE = "a" * 40
-
-
-def payload(task_id: str, branch: str, *, base_oid: str = BASE) -> dict[str, object]:
-    return {
-        "task_id": task_id,
-        "metadata": {
-            "execution": {
-                "schema": "aios.online-agent.execution.v2",
-                "repository": "aios/aios",
-                "base_oid": base_oid,
-                "target_branch": branch,
-                "adapter": "deterministic",
-                "workspace": {
-                    "authority_git_dir": str(Path(os.environ.get("AIOS_AUTHORITY_GIT_DIR", "/data/aios-gitops/repo.git"))),
-                    "read_only_repository": True,
-                    "cleanup_policy": "always",
-                },
-                "change_set": [
-                    {
-                        "operation": "write_file",
-                        "path": "tests/generated_marker.py",
-                        "content": "def test_marker():\n    assert True\n",
-                        "expected_sha256": None,
-                    }
-                ],
-                "verification": [
-                    {"label": "compile", "argv": ["/usr/bin/python3", "-m", "py_compile", "tests/generated_marker.py"], "cwd": ".", "timeout_seconds": 60}
-                ],
-                "governance": {
-                    "task_id": f"{task_id}-writer",
-                    "idempotency_key": f"{task_id}-governed-v1",
-                    "commit_idempotency_key": f"{task_id}-commit-v1",
-                    "allowed_files": ["tests/generated_marker.py"],
-                    "main_write": False,
-                    "force_push": False,
-                    "production_write": False,
-                    "tag_write": False,
-                    "baseline_write": False,
-                    "protected_ref_bypass": False,
-                },
-            }
-        },
-    }
-
-
-def test_dynamic_payload_is_not_bound_to_task_or_base() -> None:
-    first = ExecutionEnvelope.from_task(payload("task-alpha-20260815", "agent/alpha-20260815"))
-    second = ExecutionEnvelope.from_task(payload("task-beta-20260815", "agent/beta-20260815", base_oid="b" * 40))
-    assert first.task_id != second.task_id
-    assert first.base_oid != second.base_oid
-    assert first.target_branch != second.target_branch
-
-
-def test_protected_branch_is_rejected() -> None:
-    try:
-        ExecutionEnvelope.from_task(payload("task-main-20260815", "main"))
-    except WorkerError as exc:
-        assert exc.code == "PROTECTED_BRANCH_REJECTED"
-    else:
-        raise AssertionError("protected branch accepted")
-
-
-def test_task_payload_does_not_persist_secret_values() -> None:
-    value = sanitize({"agent_token": "agt-secret", "nested": {"authorization": "Bearer secret"}})
-    assert value == {"agent_token": "[REDACTED]", "nested": {"authorization": "[REDACTED]"}}
-
-
-def test_execution_digest_is_stable() -> None:
-    value = payload("task-digest-20260815", "agent/digest-20260815")
-    assert ExecutionEnvelope.from_task(value).digest == ExecutionEnvelope.from_task(value).digest

tests/test_agent_event_bus.py

@@ -20,3 +20,12 @@ def test_unified_event_flow():
 
     dashboard = AgentEventDashboard(bus).overview()
     assert dashboard["audit"]["enabled"] is True
+
+
+def test_target_changes_event_identity(tmp_path):
+    bus = AgentEventBus(tmp_path)
+    first = bus.publish('test', 'same', 'user-a', 'same summary', {'value': 1})
+    second = bus.publish('test', 'same', 'user-b', 'same summary', {'value': 1})
+    first_id = first.get('id') if isinstance(first, dict) else getattr(first, 'id', first)
+    second_id = second.get('id') if isinstance(second, dict) else getattr(second, 'id', second)
+    assert first_id != second_id

tests/test_autonomous_broker_security_v2.py

@@ -1,201 +0,0 @@
-from __future__ import annotations
-
-import importlib.util
-import json
-import os
-from pathlib import Path
-import socket
-import subprocess
-import sys
-import time
-
-import pytest
-
-
-BROKER_PATH = Path(__file__).parents[1] / "services" / "aios-agent-runtime-broker" / "broker.py"
-
-
-def load_broker():
-    spec = importlib.util.spec_from_file_location("broker_under_test", BROKER_PATH)
-    module = importlib.util.module_from_spec(spec)
-    assert spec.loader is not None
-    spec.loader.exec_module(module)
-    return module
-
-
-def test_peer_credentials_accept_configured_uid(monkeypatch) -> None:
-    broker = load_broker()
-    left, right = socket.socketpair()
-    try:
-        monkeypatch.setattr(broker, "ALLOWED_PEER_UID", os.getuid())
-        monkeypatch.setattr(broker, "ALLOWED_PEER_USER", "")
-        broker.authorize_peer(left)
-    finally:
-        left.close()
-        right.close()
-
-
-def test_peer_credentials_reject_other_uid(monkeypatch) -> None:
-    broker = load_broker()
-    left, right = socket.socketpair()
-    try:
-        monkeypatch.setattr(broker, "ALLOWED_PEER_UID", os.getuid() + 100000)
-        monkeypatch.setattr(broker, "ALLOWED_PEER_USER", "")
-        with pytest.raises(broker.BrokerError) as caught:
-            broker.authorize_peer(left)
-        assert caught.value.code == "PEER_UID_REJECTED"
-    finally:
-        left.close()
-        right.close()
-
-
-def test_request_read_timeout(monkeypatch) -> None:
-    broker = load_broker()
-    left, right = socket.socketpair()
-    try:
-        monkeypatch.setattr(broker, "CONNECTION_TIMEOUT", 0.05)
-        with pytest.raises(broker.BrokerError) as caught:
-            broker.read_request(left)
-        assert caught.value.code == "REQUEST_TIMEOUT"
-    finally:
-        left.close()
-        right.close()
-
-
-def test_worktree_fd_remains_pinned_after_path_replacement(tmp_path: Path, monkeypatch) -> None:
-    broker = load_broker()
-    root = tmp_path / "workspaces"
-    run_root = root / "run"
-    original = run_root / "worktree"
-    original.mkdir(parents=True)
-    (original / "marker.txt").write_text("original\n", encoding="utf-8")
-
-    request = {
-        "schema": "aios.online-agent.runtime-request.v1",
-        "adapter": "hermes",
-        "execution_context": {
-            "repository": "aios/aios",
-            "base_oid": "a" * 40,
-            "target_branch": "agent/intent/test",
-            "worktree": str(original),
-        },
-        "policy": {
-            "authoritative_repository_write": False,
-            "direct_git_ref_mutation": False,
-            "direct_git_push": False,
-            "direct_git_commit": False,
-            "main_write": False,
-            "force_push": False,
-            "production_write": False,
-            "tag_write": False,
-            "baseline_write": False,
-            "task_api_credential_visible": False,
-            "writer_lease_visible": False,
-        },
-    }
-    monkeypatch.setattr(broker, "ADAPTER", "hermes")
-    monkeypatch.setattr(broker, "WORKSPACE_ROOT", root)
-    _, fd = broker.validate_request(request)
-    try:
-        moved = run_root / "original-moved"
-        original.rename(moved)
-        original.mkdir()
-        (original / "marker.txt").write_text("replacement\n", encoding="utf-8")
-
-        pinned = Path(f"/proc/self/fd/{fd}")
-        (pinned / "through-fd.txt").write_text("pinned\n", encoding="utf-8")
-        assert (moved / "through-fd.txt").read_text(encoding="utf-8") == "pinned\n"
-        assert not (original / "through-fd.txt").exists()
-    finally:
-        os.close(fd)
-
-
-def test_backend_receives_no_task_api_token(tmp_path: Path, monkeypatch) -> None:
-    broker = load_broker()
-    worktree = tmp_path / "worktree"
-    worktree.mkdir()
-    backend = tmp_path / "backend.py"
-    backend.write_text(
-        """#!/usr/bin/env python3
-import json, os, pathlib, sys
-request = json.load(sys.stdin)
-assert 'AIOS_AGENT_TASK_TOKEN' not in os.environ
-worktree = pathlib.Path(request['execution_context']['worktree'])
-(worktree / 'changed.txt').write_text('ok\\n', encoding='utf-8')
-json.dump({
-  'schema':'aios.online-agent.runtime-result.v1',
-  'status':'COMPLETED',
-  'summary':'done',
-  'verification':[],
-  'evidence':{'token_visible':False, 'api_key':'runtime-secret-value'}
-}, sys.stdout)
-""",
-        encoding="utf-8",
-    )
-    backend.chmod(0o755)
-
-    monkeypatch.setattr(broker, "ADAPTER", "hermes")
-    monkeypatch.setattr(broker, "BACKEND_ARGV_JSON", json.dumps(["/usr/bin/python3", str(backend)]))
-    monkeypatch.setattr(broker, "BACKEND_TIMEOUT", 5)
-    monkeypatch.delenv("CREDENTIALS_DIRECTORY", raising=False)
-
-    fd = os.open(str(worktree), getattr(os, "O_PATH", os.O_RDONLY) | os.O_DIRECTORY)
-    try:
-        request = {
-            "schema": "aios.online-agent.runtime-request.v1",
-            "adapter": "hermes",
-            "execution_context": {"worktree": str(worktree)},
-        }
-        result = broker.execute_backend(request, fd)
-    finally:
-        os.close(fd)
-    assert result["status"] == "COMPLETED"
-    assert result["evidence"]["api_key"] == "[REDACTED]"
-    assert (worktree / "changed.txt").read_text(encoding="utf-8") == "ok\n"
-
-
-def test_broker_backend_env_does_not_inherit_task_token(tmp_path: Path, monkeypatch) -> None:
-    broker = load_broker()
-    worktree = tmp_path / "worktree-env"
-    worktree.mkdir()
-    backend = tmp_path / "backend-env.py"
-    backend.write_text(
-        """#!/usr/bin/env python3
-import json, os, sys
-assert 'AIOS_AGENT_TASK_TOKEN' not in os.environ
-assert os.environ.get('AIOS_OPENCLAW_MODEL') == 'test/model'
-assert os.environ.get('AIOS_OPENCLAW_BIN') == '/test/openclaw'
-json.dump({
-  'schema':'aios.online-agent.runtime-result.v1',
-  'status':'COMPLETED',
-  'summary':'environment isolated',
-  'verification':[],
-  'evidence':{'task_token_visible':False}
-}, sys.stdout)
-""",
-        encoding="utf-8",
-    )
-    backend.chmod(0o755)
-
-    monkeypatch.setattr(broker, "ADAPTER", "openclaw")
-    monkeypatch.setattr(
-        broker,
-        "BACKEND_ARGV_JSON",
-        json.dumps(["/usr/bin/python3", str(backend)]),
-    )
-    monkeypatch.setenv("AIOS_AGENT_TASK_TOKEN", "must-not-cross")
-    monkeypatch.setenv("AIOS_OPENCLAW_MODEL", "test/model")
-    monkeypatch.setenv("AIOS_OPENCLAW_BIN", "/test/openclaw")
-    monkeypatch.delenv("CREDENTIALS_DIRECTORY", raising=False)
-
-    fd = os.open(str(worktree), getattr(os, "O_PATH", os.O_RDONLY) | os.O_DIRECTORY)
-    try:
-        request = {
-            "schema": "aios.online-agent.runtime-request.v1",
-            "adapter": "openclaw",
-            "execution_context": {"worktree": str(worktree)},
-        }
-        result = broker.execute_backend(request, fd)
-    finally:
-        os.close(fd)
-    assert result["status"] == "COMPLETED"

tests/test_autonomous_intent_runtime_v2.py

@@ -1,143 +0,0 @@
-from __future__ import annotations
-
-from pathlib import Path
-import subprocess
-
-import pytest
-
-from intent_runtime import IntentError, IntentTask, is_claimable_intent, resolve
-
-
-def make_bare(tmp_path: Path) -> tuple[Path, str]:
-    work = tmp_path / "work"
-    bare = tmp_path / "repo.git"
-    subprocess.run(["git", "init", str(work)], check=True, capture_output=True)
-    subprocess.run(["git", "-C", str(work), "config", "user.email", "test@example.invalid"], check=True)
-    subprocess.run(["git", "-C", str(work), "config", "user.name", "AIOS Test"], check=True)
-    (work / "README.md").write_text("base\n", encoding="utf-8")
-    subprocess.run(["git", "-C", str(work), "add", "README.md"], check=True)
-    subprocess.run(["git", "-C", str(work), "commit", "-m", "base"], check=True, capture_output=True)
-    subprocess.run(["git", "-C", str(work), "branch", "-M", "main"], check=True)
-    oid = subprocess.check_output(["git", "-C", str(work), "rev-parse", "HEAD"], text=True).strip()
-    subprocess.run(["git", "clone", "--bare", str(work), str(bare)], check=True, capture_output=True)
-    return bare, oid
-
-
-def intent_task(task_id: str = "custom-gpt-intent-20260815") -> dict[str, object]:
-    return {
-        "task_id": task_id,
-        "goal": "Fix the repository behavior described by the task.",
-        "instructions": "Inspect the code, find the root cause, implement and test the smallest correct fix.",
-        "success_criteria": ["Relevant tests pass", "git diff --check passes"],
-        "required_capabilities": [
-            "intent.task",
-            "engineering.execute",
-            "engineering.autonomous",
-            "git.read",
-            "git.diff",
-            "git.test",
-            "governed.write.file",
-            "governed.write.branch",
-            "workspace.worktree",
-            "agent.runtime.hermes",
-        ],
-        "metadata": {},
-    }
-
-
-def fixed_implementation_task() -> dict[str, object]:
-    return {
-        "task_id": "implement-autonomous-intent-worker-v2-20260815",
-        "goal": "Implement autonomous intent worker v2.",
-        "instructions": "Implement the worker.",
-        "success_criteria": ["Implementation succeeds"],
-        "required_capabilities": [
-            "engineering.execute",
-            "git.diff",
-            "git.read",
-            "git.test",
-            "governed.write.branch",
-            "governed.write.file",
-            "workspace.worktree",
-        ],
-        "metadata": {},
-    }
-
-
-def test_fixed_bootstrap_task_is_not_claimable_by_intent_worker() -> None:
-    worker_caps = intent_task()["required_capabilities"]
-    assert is_claimable_intent(fixed_implementation_task(), worker_caps) is False
-    with pytest.raises(IntentError) as caught:
-        IntentTask.parse(fixed_implementation_task())
-    assert caught.value.code == "INTENT_CAPABILITY_MARKER_REQUIRED"
-
-
-def test_native_custom_gpt_intent_task_is_claimable() -> None:
-    task = intent_task()
-    assert is_claimable_intent(task, task["required_capabilities"]) is True
-
-
-def test_missing_runtime_capability_fails_closed() -> None:
-    task = intent_task()
-    caps = [item for item in task["required_capabilities"] if item != "agent.runtime.hermes"]
-    assert is_claimable_intent(task, caps) is False
-
-
-def test_resolution_is_stable_across_restart(tmp_path: Path) -> None:
-    bare, oid = make_bare(tmp_path)
-    task = intent_task()
-    first = resolve(
-        task,
-        authority_git_dir=bare,
-        repository="aios/aios",
-        base_ref="refs/heads/main",
-        available_adapters=["hermes"],
-        default_adapter="hermes",
-    )
-    recovered = resolve(
-        task,
-        authority_git_dir=bare,
-        repository="aios/aios",
-        base_ref="refs/heads/main",
-        available_adapters=["hermes"],
-        default_adapter="hermes",
-        prior=first.to_json(),
-    )
-    assert first == recovered
-    assert recovered.base_oid == oid
-    assert recovered.target_branch.startswith("agent/intent/")
-
-
-def test_requested_codex_is_rejected_when_unavailable(tmp_path: Path) -> None:
-    bare, _ = make_bare(tmp_path)
-    task = intent_task("codex-only-20260815")
-    task["required_capabilities"] = [
-        item for item in task["required_capabilities"] if item != "agent.runtime.hermes"
-    ] + ["agent.runtime.codex"]
-    with pytest.raises(IntentError) as caught:
-        resolve(
-            task,
-            authority_git_dir=bare,
-            repository="aios/aios",
-            base_ref="refs/heads/main",
-            available_adapters=["hermes"],
-            default_adapter="hermes",
-        )
-    assert caught.value.code == "AGENT_RUNTIME_UNAVAILABLE"
-
-
-def test_openclaw_is_a_first_class_runtime_adapter(tmp_path: Path) -> None:
-    bare, _ = make_bare(tmp_path)
-    task = intent_task("openclaw-intent-20260815")
-    task["required_capabilities"] = [
-        item for item in task["required_capabilities"] if item != "agent.runtime.hermes"
-    ] + ["agent.runtime.openclaw"]
-    resolved = resolve(
-        task,
-        authority_git_dir=bare,
-        repository="aios/aios",
-        base_ref="refs/heads/main",
-        available_adapters=["openclaw"],
-        default_adapter="openclaw",
-    )
-    assert resolved.adapter == "openclaw"

tests/test_autonomous_runtime_client_v2.py

@@ -1,102 +0,0 @@
-from __future__ import annotations
-
-import json
-from pathlib import Path
-import socket
-import subprocess
-import threading
-import time
-
-import pytest
-
-from runtime_client import RuntimeErrorV2, collect_changes, invoke, request_payload, scan_secrets
-
-
-def repo(tmp_path: Path) -> tuple[Path, str]:
-    work = tmp_path / "repo"
-    subprocess.run(["git", "init", str(work)], check=True, capture_output=True)
-    subprocess.run(["git", "-C", str(work), "config", "user.email", "test@example.invalid"], check=True)
-    subprocess.run(["git", "-C", str(work), "config", "user.name", "AIOS Test"], check=True)
-    (work / "a.py").write_text("VALUE = 1\n", encoding="utf-8")
-    subprocess.run(["git", "-C", str(work), "add", "a.py"], check=True)
-    subprocess.run(["git", "-C", str(work), "commit", "-m", "base"], check=True, capture_output=True)
-    oid = subprocess.check_output(["git", "-C", str(work), "rev-parse", "HEAD"], text=True).strip()
-    return work, oid
-
-
-def test_collect_changes_reads_actual_git_state(tmp_path: Path) -> None:
-    work, oid = repo(tmp_path)
-    (work / "a.py").write_text("VALUE = 2\n", encoding="utf-8")
-    (work / "new.py").write_text("NEW = True\n", encoding="utf-8")
-    assert collect_changes(work, oid) == ["a.py", "new.py"]
-
-
-def test_agent_commit_is_rejected(tmp_path: Path) -> None:
-    work, oid = repo(tmp_path)
-    (work / "a.py").write_text("VALUE = 2\n", encoding="utf-8")
-    subprocess.run(["git", "-C", str(work), "add", "a.py"], check=True)
-    subprocess.run(["git", "-C", str(work), "commit", "-m", "agent commit"], check=True, capture_output=True)
-    with pytest.raises(RuntimeErrorV2) as caught:
-        collect_changes(work, oid)
-    assert caught.value.code == "WORKTREE_HEAD_MUTATED"
-
-
-def test_secret_material_is_rejected(tmp_path: Path) -> None:
-    work, oid = repo(tmp_path)
-    private_key_marker = "-----BEGIN PRIVATE " + "KEY-----"
-    (work / "new.txt").write_text(
-        private_key_marker + "\nabc\n", encoding="utf-8")
-    changed = collect_changes(work, oid)
-    with pytest.raises(RuntimeErrorV2) as caught:
-        scan_secrets(work, changed)
-    assert caught.value.code == "SECRET_MATERIAL_REJECTED"
-
-
-def test_runtime_protocol_round_trip(tmp_path: Path) -> None:
-    sock = tmp_path / "runtime.sock"
-    response = {
-        "schema": "aios.online-agent.runtime-result.v1",
-        "status": "COMPLETED",
-        "summary": "Implemented the requested change.",
-        "verification": [],
-        "evidence": {"runtime": "fake-hermes"},
-    }
-
-    def server() -> None:
-        listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        listener.bind(str(sock))
-        listener.listen(1)
-        conn, _ = listener.accept()
-        raw = b""
-        while True:
-            chunk = conn.recv(65536)
-            if not chunk:
-                break
-            raw += chunk
-        value = json.loads(raw.decode("utf-8"))
-        assert value["schema"] == "aios.online-agent.runtime-request.v1"
-        conn.sendall(json.dumps(response).encode("utf-8"))
-        conn.close()
-        listener.close()
-
-    thread = threading.Thread(target=server)
-    thread.start()
-    for _ in range(100):
-        if sock.exists():
-            break
-        time.sleep(0.01)
-    payload = request_payload(
-        adapter="hermes",
-        task_id="intent-e2e-20260815",
-        goal="Change VALUE",
-        instructions="Inspect and implement",
-        success_criteria=["Tests pass"],
-        repository="aios/aios",
-        base_oid="a" * 40,
-        target_branch="agent/intent/example",
-        worktree=tmp_path,
-    )
-    result = invoke(sock, payload, 5)
-    thread.join(timeout=2)
-    assert result.status == "COMPLETED"
-    assert result.evidence["runtime"] == "fake-hermes"

tests/test_bridge_v2_governed_http_bootstrap.py

@@ -2,6 +2,7 @@ import base64
 from pathlib import Path
 
 from aios_authority_git_executor import AuthorityGitExecutor
+from aios_chatgpt_bridge_v2 import BridgeV2Adapter, OPERATION_REQUIRED_FIELDS
 from aios_chatgpt_bridge_v2_server import BridgeHandler, RuntimeConfig
 from aios_continuation_executor import GiteaContinuationRemote, ServerSideCredentialProjection
 from aios_continuation_lease import WriterLeaseRequestV2
@@ -26,6 +27,7 @@ class Probe:
 
 def test_create_new_lease_is_exact_base_and_absent():
     request = WriterLeaseRequestV2(
+        job_id="job-bridge-runtime-lineage-test",
         task_id="TASK-P0-BRIDGE-V21-DURABLE-RECONCILIATION-20260809",
         repository="aios/aios",
         branch_mode="CREATE_NEW",
@@ -39,6 +41,7 @@ def test_create_new_lease_is_exact_base_and_absent():
 
 def test_create_new_lease_rejects_existing_target():
     request = WriterLeaseRequestV2(
+        job_id="job-bridge-runtime-lineage-test",
         task_id="task",
         repository="aios/aios",
         branch_mode="CREATE_NEW",
@@ -74,8 +77,8 @@ def test_slash_branch_uses_paginated_collection():
 
 def test_http_route_contract_is_complete():
     expected = {
-        "/v2/runtime", "/v2/capabilities", "/v2/governed-task",
-        "/v2/writer-lease", "/v2/commit-file", "/v2/commit-files",
+            "/v2/runtime", "/v2/capabilities", "/v2/governed-task", "/v2/execution-envelope", "/v2/execution-plan",
+        "/v2/writer-lease", "/v2/writer-lease/bootstrap", "/v2/writer-lease/renew", "/v2/commit-file", "/v2/commit-files",
         "/v2/job", "/v2/job/resume", "/v2/job/reconcile",
         "/v2/tag/approval-request",
         "/v2/tag/publish",
@@ -88,3 +91,150 @@ def test_http_route_contract_is_complete():
     from aios_chatgpt_bridge_v2_server import ROUTES
 
     assert set(ROUTES) == expected
+
+
+def test_renew_writer_lease_is_exposed_in_action_and_capability_contracts():
+    adapter = BridgeV2Adapter(runtime_status={})
+    capabilities = adapter.getGovernedWriteCapabilities()
+    contract = capabilities["operation_contracts"]["renewWriterLease"]
+
+    assert contract["method"] == "POST"
+    assert contract["path"] == "/v2/writer-lease/renew"
+    assert tuple(contract["required_fields"]) == OPERATION_REQUIRED_FIELDS["renewWriterLease"]
+    assert "runtime_rehydrated" in contract["response_fields"]
+
+    action_schema = Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
+    assert "/v2/writer-lease/renew:" in action_schema
+    assert "operationId: renewWriterLease" in action_schema
+    assert "BridgeWriterLeaseRecoveryRequest" in action_schema
+    assert "BridgeWriterLeaseRecoveryResponse" in action_schema
+    assert {
+        capabilities["operation_contracts"][operation]["path"]
+        for operation in (
+            "acquireWriterLease",
+            "renewWriterLease",
+            "commitFileGoverned",
+            "commitFilesGoverned",
+        )
+    } == {
+        "/v2/writer-lease",
+        "/v2/writer-lease/renew",
+        "/v2/commit-file",
+        "/v2/commit-files",
+    }
+
+
+def test_bootstrap_writer_lease_is_exposed_in_action_and_capability_contracts():
+    adapter = BridgeV2Adapter(runtime_status={})
+    capabilities = adapter.getGovernedWriteCapabilities()
+    contract = capabilities["operation_contracts"]["bootstrapWriterLease"]
+
+    assert contract["method"] == "POST"
+    assert contract["path"] == "/v2/writer-lease/bootstrap"
+    assert tuple(contract["required_fields"]) == OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"]
+    assert "bootstrapped" in contract["response_fields"]
+    assert "durable_branch_lease_present" in contract["response_fields"]
+
+    action_schema = Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
+    assert "/v2/writer-lease/bootstrap:" in action_schema
+    assert "operationId: bootstrapWriterLease" in action_schema
+    assert "bootstrapped: {type: boolean}" in action_schema
+    assert "durable_branch_lease_present: {type: boolean}" in action_schema
+
+
+
+def test_http_allows_explicit_job_id_on_lease_and_commit_requests():
+    handler = BridgeHandler.__new__(BridgeHandler)
+    lease_body = {
+        "schema": WriterLeaseRequestV2.schema,
+        "task_id": "task",
+        "job_id": "job-explicit-runtime-lineage",
+        "repository": "aios/aios",
+        "branch_mode": "CONTINUE_EXISTING",
+        "base_oid": "a" * 40,
+        "expected_branch_oid": "a" * 40,
+        "target_branch": "agent/explicit-runtime-lineage",
+        "generation": 2,
+        "lease_seconds": 120,
+    }
+    handler._allowed("acquireWriterLease", lease_body)
+    handler._allowed(
+        "commitFilesGoverned",
+        {
+            "task_id": "task",
+            "job_id": "job-explicit-runtime-lineage",
+            "repository": "aios/aios",
+            "expected_branch_oid": "a" * 40,
+            "target_branch": "agent/explicit-runtime-lineage",
+            "generation": 2,
+            "idempotency_key": "commit-explicit-runtime-lineage",
+            "files": {"docs/x.txt": "eA=="},
+            "message": "test",
+        },
+    )
+
+
+def test_http_allows_omitted_job_id_for_durable_server_resolution():
+    handler = BridgeHandler.__new__(BridgeHandler)
+    lease_body = {
+        "schema": WriterLeaseRequestV2.schema,
+        "task_id": "task",
+        "repository": "aios/aios",
+        "branch_mode": "CONTINUE_EXISTING",
+        "base_oid": "a" * 40,
+        "expected_branch_oid": "a" * 40,
+        "target_branch": "agent/implicit-runtime-lineage",
+        "generation": 2,
+        "lease_seconds": 120,
+    }
+    handler._allowed("acquireWriterLease", lease_body)
+    handler._allowed(
+        "commitFilesGoverned",
+        {
+            "task_id": "task",
+            "repository": "aios/aios",
+            "expected_branch_oid": "a" * 40,
+            "target_branch": "agent/implicit-runtime-lineage",
+            "generation": 2,
+            "idempotency_key": "commit-implicit-runtime-lineage",
+            "files": {"docs/x.txt": "eA=="},
+            "message": "test",
+        },
+    )
+
+
+def test_http_mutation_routes_require_exact_runtime_principal():
+    handler = BridgeHandler.__new__(BridgeHandler)
+    runtime_principal = "runtime-" "agent-principal-token-1234"
+    handler.control_token = runtime_principal
+    handler.agent_task_api_url = "http://127.0.0.1:1"
+    handler.headers = {"Authorization": f"Bearer {runtime_principal}"}
+    assert handler._authorized("createGovernedTask", {}) is True
+    handler.headers = {"Authorization": "Bearer wrong-runtime-principal-token"}
+    assert handler._authorized("createGovernedTask", {}) is False
+    handler.headers = {}
+    assert handler._authorized("createGovernedTask", {}) is False
+
+
+def test_capability_contracts_return_exact_job_id_lineage():
+    contracts = BridgeV2Adapter(runtime_status={}).getGovernedWriteCapabilities()["operation_contracts"]
+    for operation in ("acquireWriterLease", "bootstrapWriterLease", "renewWriterLease"):
+        assert "job_id" in contracts[operation]["response_fields"]
+    for operation in ("commitFileGoverned", "commitFilesGoverned"):
+        assert "job_id" in contracts[operation]["response_fields"]
+
+
+def test_online_agent_execution_routes_and_action_projection_are_exposed():
+    from aios_chatgpt_bridge_v2 import BridgeV2Adapter, OPERATION_REQUIRED_FIELDS
+    from aios_chatgpt_bridge_v2_server import ROUTES
+    assert ROUTES["/v2/execution-envelope"] == "projectOnlineAgentExecution"
+    assert ROUTES["/v2/execution-plan"] == "registerOnlineAgentExecutionPlan"
+    adapter = BridgeV2Adapter(runtime_status={})
+    contracts = adapter.getGovernedWriteCapabilities()["operation_contracts"]
+    assert tuple(contracts["projectOnlineAgentExecution"]["required_fields"]) == OPERATION_REQUIRED_FIELDS["projectOnlineAgentExecution"]
+    assert tuple(contracts["registerOnlineAgentExecutionPlan"]["required_fields"]) == OPERATION_REQUIRED_FIELDS["registerOnlineAgentExecutionPlan"]
+    schema = Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
+    assert "/v2/execution-envelope:" in schema
+    assert "operationId: projectOnlineAgentExecution" in schema
+    assert "/v2/execution-plan:" in schema
+    assert "operationId: registerOnlineAgentExecutionPlan" in schema

tests/test_continuation_runtime_normalization.py

@@ -0,0 +1,307 @@
+from __future__ import annotations
+
+from pathlib import Path
+import re
+import json
+from types import SimpleNamespace
+
+import pytest
+import yaml
+
+from aios_chatgpt_bridge_v2_server import GovernedRuntime
+from aios_continuation_executor import ContinuationExecutor
+from aios_continuation_lease import WriterLeaseRequestV2
+from aios_gitops_job_controller import JobState
+
+
+TASK = "continuation-normalization-test"
+JOB = "job-continuation-normalization-test"
+REPO = "aios/aios"
+BASE = "a" * 40
+BRANCH = "agent/continuation-normalization-test"
+
+
+class Authority:
+    def __init__(self, head: str | None) -> None:
+        self.head = head
+
+    def read_ref(self, ref: str) -> str | None:
+        assert ref == "refs/heads/" + BRANCH
+        return self.head
+
+    def commit_exists(self, oid: str) -> bool:
+        return oid == BASE
+
+    def branch_exists(self, branch: str) -> bool:
+        assert branch == BRANCH
+        return self.head is not None
+
+    def branch_head(self, branch: str) -> str:
+        assert branch == BRANCH and self.head is not None
+        return self.head
+
+    def is_ancestor(self, older: str, newer: str) -> bool:
+        return older == BASE and newer == BASE
+
+
+def lease(**overrides: object) -> WriterLeaseRequestV2:
+    values = {
+        "task_id": TASK,
+        "job_id": JOB,
+        "repository": REPO,
+        "branch_mode": "CREATE_NEW",
+        "base_oid": BASE,
+        "expected_branch_oid": BASE,
+        "target_branch": BRANCH,
+        "generation": 1,
+        "lease_seconds": 120,
+    }
+    values.update(overrides)
+    return WriterLeaseRequestV2(**values)
+
+
+def runtime(*, head: str | None = BASE, **binding_overrides: object) -> GovernedRuntime:
+    value = GovernedRuntime.__new__(GovernedRuntime)
+    value.authority = Authority(head)
+    binding = {
+        "task_id": TASK,
+        "job_id": JOB,
+        "repository": REPO,
+        "base_oid": BASE,
+        "expected_branch_oid": BASE,
+        "target_branch": BRANCH,
+        "generation": 1,
+        "branch_mode": "CREATE_NEW",
+    }
+    binding.update(binding_overrides)
+    value.bindings = {TASK: binding}
+    return value
+
+
+def test_same_lineage_create_new_normalizes_to_continue_existing() -> None:
+    normalized = runtime()._normalize_runtime_lease(lease())
+    assert normalized.branch_mode == "CONTINUE_EXISTING"
+    assert normalized.task_id == TASK
+    assert normalized.job_id == JOB
+    assert normalized.repository == REPO
+    assert normalized.target_branch == BRANCH
+    assert normalized.expected_branch_oid == BASE
+    assert normalized.generation == 1
+
+
+def test_unprovisioned_create_new_stays_create_new() -> None:
+    assert runtime(head=None)._normalize_runtime_lease(lease()).branch_mode == "CREATE_NEW"
+
+
+@pytest.mark.parametrize(
+    ("field", "value"),
+    (
+        ("repository", "other/repo"),
+        ("base_oid", "b" * 40),
+        ("expected_branch_oid", "b" * 40),
+        ("target_branch", "agent/foreign"),
+        ("generation", 2),
+    ),
+)
+def test_binding_mismatch_fails_closed(field: str, value: object) -> None:
+    with pytest.raises(RuntimeError, match="LEASE_BINDING_CONFLICT"):
+        runtime(**{field: value})._normalize_runtime_lease(lease())
+
+
+def test_drifted_existing_head_fails_closed() -> None:
+    with pytest.raises(RuntimeError, match="EXPECTED_BRANCH_OID_CONFLICT"):
+        runtime(head="b" * 40)._normalize_runtime_lease(lease())
+
+
+def test_openapi_contract_parses_and_requires_exact_commit_lineage() -> None:
+    document = yaml.safe_load(
+        Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
+    )
+    schema = document["components"]["schemas"]["BridgeCommitResponse"]
+    assert {
+        "job_id",
+        "commit_oid",
+        "commit_visible",
+        "branch_mode",
+        "target_branch",
+        "generation",
+    } <= set(schema["required"])
+
+
+def test_changed_production_files_pass_secret_scan() -> None:
+    paths = [
+        Path("active-runtime/app/aios_authority_git_executor.py"),
+        Path("active-runtime/app/aios_chatgpt_bridge_v2_server.py"),
+        Path("active-runtime/app/aios_continuation_executor.py"),
+        Path("active-runtime/app/aios_continuation_lease.py"),
+        Path("active-runtime/app/authorized_task_writer_provisioning.py"),
+        Path("active-runtime/app/aios_chatgpt_bridge_v2.py"),
+        Path("docs/gitops/openapi-chatgpt-actions.yaml"),
+    ]
+    expression = re.compile(
+        r"(?i)(BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|"
+        r"authorization:\\s*bearer\\s+[A-Za-z0-9._-]{12,}|"
+        r"api[_-]?key\\s*[:=]\\s*['\\\"][^'\\\"]{12,})"
+    )
+    hits = []
+    for path in paths:
+        for number, line in enumerate(
+            path.read_text(encoding="utf-8", errors="replace").splitlines(), 1
+        ):
+            if expression.search(line):
+                hits.append(f"{path}:{number}")
+    assert hits == []
+
+
+def test_remote_verified_job_is_not_completed_when_head_cas_callback_fails() -> None:
+    class Store:
+        def read(self, _job_id):
+            return {
+                "branch": BRANCH,
+                "request_json": json.dumps(
+                    {"binding": {"expected_branch_oid": BASE}}
+                ),
+            }
+
+    class Controller:
+        def __init__(self):
+            self.store = Store()
+            self.states = []
+
+        def advance(self, _job_id, state, **_kwargs):
+            self.states.append(state)
+            return SimpleNamespace(as_dict=lambda: {"state": state.value})
+
+    executor = ContinuationExecutor.__new__(ContinuationExecutor)
+    executor.controller = Controller()
+    executor._observe_remote = lambda _branch, oid: (oid, oid, True)
+
+    def fail_cas(_oid):
+        raise RuntimeError("LEASE_CAS_CONFLICT")
+
+    with pytest.raises(RuntimeError, match="LEASE_CAS_CONFLICT"):
+        executor._finish_remote_verification(
+            JOB,
+            "b" * 40,
+            "b" * 40,
+            before_complete=fail_cas,
+        )
+
+    assert executor.controller.states == [JobState.REMOTE_VERIFIED]
+
+
+@pytest.mark.parametrize("branch_mode", ("CREATE_NEW", "CONTINUE_EXISTING"))
+def test_executor_preflight_accepts_the_exact_mode_dependent_normalized_shape(
+    branch_mode: str,
+) -> None:
+    from datetime import datetime, timedelta, timezone
+    from aios_continuation_executor import (
+        ContinuationPermissions,
+        ContinuationRuntimeBinding,
+    )
+
+    request = lease(branch_mode=branch_mode)
+    now = datetime.now(timezone.utc)
+    executor = ContinuationExecutor.__new__(ContinuationExecutor)
+    executor.authority = Authority(None if branch_mode == "CREATE_NEW" else BASE)
+    executor.now = lambda: now
+    executor._max_generation = lambda _branch, *, exclude_job_id=None: 0
+    executor.workspace = SimpleNamespace(
+        is_detached=lambda: True,
+        head_oid=lambda: BASE,
+    )
+    executor.remote = SimpleNamespace(repository_identity=lambda: REPO)
+    binding = ContinuationRuntimeBinding(
+        request=request,
+        job_id=JOB,
+        workspace_path=Path("/tmp/continuation-normalization-test"),
+        lease_not_before=now - timedelta(seconds=1),
+        lease_expires_at=now + timedelta(seconds=60),
+        original_receipt_valid=True,
+        original_grant_consumed=True,
+        permissions=ContinuationPermissions(),
+    )
+
+    executor._validate_preflight(binding, job_id=JOB)
+
+
+def test_create_new_executor_resumes_executing_and_uses_absence_bound_writers() -> None:
+    from datetime import datetime, timedelta, timezone
+    from aios_continuation_executor import (
+        ContinuationCommit,
+        ContinuationPermissions,
+        ContinuationRuntimeBinding,
+    )
+
+    new_oid = "b" * 40
+
+    class Store:
+        def read(self, _job_id: str) -> dict[str, object]:
+            return {"state": "EXECUTING", "revision": 4}
+
+    class Controller:
+        def __init__(self) -> None:
+            self.store = Store()
+            self.advanced: list[str] = []
+
+        def advance(self, _job_id: str, state: JobState, **_kwargs: object) -> object:
+            self.advanced.append(state.value)
+            return SimpleNamespace(as_dict=lambda: {"state": state.value})
+
+        def complete_continuation_cycle(self, *_args: object, **_kwargs: object) -> None:
+            return None
+
+    class Workspace:
+        def commit_files(self, _files: object, _message: str) -> str:
+            return new_oid
+
+    class CreateAuthority:
+        def __init__(self) -> None:
+            self.created: list[tuple[str, str, str]] = []
+
+        def is_ancestor(self, older: str, newer: str) -> bool:
+            return older == BASE and newer == new_oid
+
+        def create_task_branch_cas(self, branch: str, base: str, new: str) -> str:
+            self.created.append((branch, base, new))
+            return new
+
+        def compare_and_swap_branch(self, *_args: object) -> str:
+            raise AssertionError("existing-branch CAS must not serve CREATE_NEW")
+
+    class CreateRemote:
+        def __init__(self) -> None:
+            self.created: list[tuple[str, str]] = []
+
+        def push_new_exact(self, branch: str, new: str) -> None:
+            self.created.append((branch, new))
+
+        def push_exact(self, *_args: object) -> None:
+            raise AssertionError("existing-branch push must not serve CREATE_NEW")
+
+    class Credential:
+        def project(self) -> None: pass
+        def revoke(self) -> None: pass
+
+    controller=Controller(); authority=CreateAuthority(); remote=CreateRemote()
+    executor=ContinuationExecutor(controller,authority,Workspace(),remote,Credential())
+    executor._validate_preflight=lambda *_args,**_kwargs: None
+    executor._finish_remote_verification=lambda *_args,**_kwargs: {
+        "job_id":JOB,"state":"COMPLETED","receipt":{"authority_oid":new_oid,"commit_visible":True}
+    }
+    now=datetime.now(timezone.utc)
+    binding=ContinuationRuntimeBinding(
+        request=lease(branch_mode="CREATE_NEW"),job_id=JOB,
+        workspace_path=Path("/tmp/create-new-executor-resume"),
+        lease_not_before=now-timedelta(seconds=1),lease_expires_at=now+timedelta(seconds=60),
+        original_receipt_valid=True,original_grant_consumed=True,
+        permissions=ContinuationPermissions(),
+    )
+    result=executor.execute(
+        binding,ContinuationCommit("create-new-test",{"docs/test.txt":b"ok"},"test")
+    )
+
+    assert result["state"]=="COMPLETED"
+    assert authority.created==[(BRANCH,BASE,new_oid)]
+    assert remote.created==[(BRANCH,new_oid)]
+    assert controller.advanced==["LOCAL_VERIFIED","REMOTE_SYNCING"]

tests/test_isolated_executor.py

@@ -0,0 +1,67 @@
+from pathlib import Path
+import hashlib,json,os,tarfile,sys,tempfile
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+import aios_isolated_executor as mod
+
+def make_archive(tmp_path):
+    root=tmp_path/"src"; root.mkdir()
+    (root/"hello.py").write_text("VALUE = 1\n")
+    archive=tmp_path/"source.tgz"
+    with tarfile.open(archive,"w:gz") as tf: tf.add(root/"hello.py",arcname="hello.py")
+    return archive
+
+def test_isolated_executor_applies_hash_bound_change(tmp_path,monkeypatch):
+    archive=make_archive(tmp_path)
+    monkeypatch.delenv("CREDENTIALS_DIRECTORY",raising=False)
+    monkeypatch.setattr(mod,"assert_uncredentialed",lambda:None)
+    request={
+      "schema":"aios.isolated-execution.request.v1",
+      "request_id":"task-req-0000000000000000",
+      "source_archive":str(archive),
+      "source_archive_sha256":mod.sha256(archive.read_bytes()),
+      "change_set":[{
+        "path":"hello.py","operation":"replace_text","old":"VALUE = 1","new":"VALUE = 2","count":1,
+        "expected_sha256":mod.sha256(b"VALUE = 1\n")
+      }],
+      "verification":[{"label":"compile","argv":["/usr/bin/python3","-m","py_compile","hello.py"],"cwd":".","timeout_seconds":30}]
+    }
+    req=tmp_path/"req.json"; res=tmp_path/"res.json"
+    req.write_text(json.dumps(request))
+    mod.execute_request(req,res)
+    out=json.loads(res.read_text())
+    assert out["request_id"]=="task-req-0000000000000000"
+    assert out["credential_isolation"]["credential_env_absent"] is True
+    changed=out["changed_files"][0]
+    assert changed["path"]=="hello.py" and changed["deleted"] is False
+
+def test_isolated_executor_source_drift_denied(tmp_path,monkeypatch):
+    archive=make_archive(tmp_path); monkeypatch.setattr(mod,"assert_uncredentialed",lambda:None)
+    request={
+      "schema":"aios.isolated-execution.request.v1","request_id":"task-req-0000000000000001",
+      "source_archive":str(archive),
+      "source_archive_sha256":mod.sha256(archive.read_bytes()),
+      "change_set":[{"path":"hello.py","operation":"write_file","content":"x\n","expected_sha256":"0"*64}],
+      "verification":[]
+    }
+    req=tmp_path/"req.json"; res=tmp_path/"res.json"; req.write_text(json.dumps(request))
+    with pytest.raises(mod.IsolatedExecutorError,match="SOURCE_DRIFT"):
+        mod.execute_request(req,res)
+
+def test_credential_boundary_eacces_is_accepted(monkeypatch):
+    class DeniedDirectory:
+        def exists(self): return True
+        def is_symlink(self): return False
+        def is_dir(self): return True
+        def iterdir(self): raise PermissionError(13,"permission denied")
+    monkeypatch.setattr(mod.os,"access",lambda *_args,**_kwargs:False)
+    assert mod._credential_exposure(DeniedDirectory()) is None
+
+def test_systemd_unit_has_no_credentials_and_private_network():
+    unit=(ROOT/"deploy/systemd/aios-online-agent-isolated-executor.service").read_text()
+    assert "PrivateNetwork=true" in unit
+    assert "InaccessiblePaths=/run/credentials" in unit
+    assert "LoadCredential" not in unit
+    assert "SupplementaryGroups=gitops" not in unit

tests/test_online_agent_auto_claim.py

@@ -0,0 +1,524 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+import sys
+from types import SimpleNamespace
+
+import pytest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+APP = ROOT / "active-runtime" / "app"
+sys.path.insert(0, str(APP))
+
+from aios_chatgpt_bridge_v2 import (  # noqa: E402
+    BRIDGE_OPERATION_CONTRACTS,
+    BridgeV2Adapter,
+)
+from aios_chatgpt_bridge_v2_server import GovernedRuntime  # noqa: E402
+from aios_governed_task_bootstrap import BootstrapError, GovernedTaskBinding, GovernedTaskBootstrap, _task_key  # noqa: E402
+from aios_online_agent_execution import (  # noqa: E402
+    ExecutionProjectionError,
+    GovernedExecutionBinding,
+    OnlineTaskProjectionClient,
+    project_execution_envelope,
+    project_online_task,
+    validate_execution_envelope,
+)
+import aios_online_agent_worker as worker_module  # noqa: E402
+from aios_online_agent_worker import ExecutionEnvelope, WorkerError, WorkerSupervisor, governed_commit, load_task_state  # noqa: E402
+
+
+BASE = "a642b045775b9154a00ae78543037fbef4fb447b"
+TASK = "p0-claim-online-agent-auto-execution-20260817"
+JOB = "job-2031a9e5682a4238f98e3ac7aee8a593"
+BRANCH = "agent/p0-claim-online-agent-auto-execution-20260817"
+
+
+def binding() -> GovernedExecutionBinding:
+    return GovernedExecutionBinding.from_mapping(
+        {
+            "task_id": TASK,
+            "job_id": JOB,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "expected_branch_oid": BASE,
+            "target_branch": BRANCH,
+            "branch_mode": "CREATE_NEW",
+            "generation": 1,
+            "idempotency_key": "p0-claim-online-agent-auto-execution-v1",
+        }
+    )
+
+
+def task_without_envelope() -> dict:
+    return {
+        "task_id": TASK,
+        "goal": "make governed Online Tasks automatically executable",
+        "instructions": "project, claim, heartbeat, and preserve exact lineage",
+        "required_capabilities": ["git.read", "git.test"],
+        "metadata": {},
+    }
+
+
+def test_project_online_task_builds_execution_metadata_from_binding() -> None:
+    projected = project_online_task(binding(), task_without_envelope())
+    execution = projected["metadata"]["execution"]
+    assert execution["schema"] == "aios.online-agent.execution.v2"
+    assert execution["job_id"] == JOB
+    assert execution["task_id"] == TASK
+    assert execution["repository"] == "aios/aios"
+    assert execution["base_oid"] == BASE
+    assert execution["expected_branch_oid"] == BASE
+    assert execution["target_branch"] == BRANCH
+    assert execution["generation"] == 1
+    assert projected["metadata"]["execution_projection"]["execution_digest"] == execution["execution_digest"]
+
+
+def test_job_to_task_execution_projection(tmp_path: Path) -> None:
+    exact = binding()
+    durable = GovernedTaskBinding(
+        task_id=exact.task_id,
+        job_id=exact.job_id,
+        repository=exact.repository,
+        base_oid=exact.base_oid,
+        expected_branch_oid=exact.expected_branch_oid,
+        target_branch=exact.target_branch,
+        branch_mode=exact.branch_mode,
+        generation=exact.generation,
+        idempotency_key=exact.idempotency_key,
+        risk="engineering",
+        description="automatic claim infrastructure",
+    )
+
+    class Bootstrap:
+        def create(self, _request: dict) -> dict:
+            return durable.response()
+
+        def online_task_projection(self, _task_id: str, online: dict, execution: dict | None, **_kwargs: object) -> dict:
+            return project_online_task(exact, online, execution)
+
+        def get_binding(self, _task_id: str) -> GovernedTaskBinding:
+            return durable
+
+        def execution_binding(self, _binding: GovernedTaskBinding) -> GovernedExecutionBinding:
+            return exact
+
+    class Projector:
+        def __init__(self) -> None:
+            self.calls = 0
+
+        def create(self, projected: dict, *, binding: GovernedExecutionBinding) -> dict:
+            self.calls += 1
+            assert binding == exact
+            return {**projected, "status": "QUEUED"}
+
+    runtime = GovernedRuntime.__new__(GovernedRuntime)
+    runtime.bootstrap = Bootstrap()
+    runtime.bindings = {}
+    runtime.online_task_projector = Projector()
+    runtime.projection_outbox_root = tmp_path / "projection-outbox"
+    runtime.projection_outbox_root.mkdir()
+    response = GovernedRuntime.create_task(
+        runtime,
+        {
+            "task_id": TASK,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "target_branch": BRANCH,
+            "risk": "engineering",
+            "description": "automatic claim infrastructure",
+            "idempotency_key": exact.idempotency_key,
+            "online_task": task_without_envelope(),
+        },
+    )
+    assert response["online_task_projection"]["status"] == "PROJECTED"
+    assert response["online_task_projection"]["task_status"] == "QUEUED"
+    assert runtime.online_task_projector.calls == 1
+
+
+def test_execution_envelope_schema_validation() -> None:
+    envelope = project_execution_envelope(binding())
+    validate_execution_envelope(envelope, binding=binding())
+    malformed = dict(envelope)
+    malformed["schema"] = "aios.online-agent.execution.v1"
+    with pytest.raises(ExecutionProjectionError, match="EXECUTION_ENVELOPE_SCHEMA_VALIDATION"):
+        validate_execution_envelope(malformed, binding=binding())
+
+
+def test_projection_response_must_equal_submitted_execution(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    submitted = project_online_task(binding(), task_without_envelope(), {"action": "source_capture", "source_signals": ["submitted"]})
+    returned = project_online_task(binding(), task_without_envelope(), {"action": "source_capture", "source_signals": ["different"]})
+    returned.update({"status": "QUEUED"})
+
+    class Response:
+        status = 201
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_args: object) -> None:
+            return None
+
+        def read(self) -> bytes:
+            return json.dumps(returned).encode("utf-8")
+
+    monkeypatch.setattr("aios_online_agent_execution.urllib.request.urlopen", lambda *_args, **_kwargs: Response())
+    token = tmp_path / "control.token"
+    token.write_text("x" * 40, encoding="utf-8")
+    with pytest.raises(ExecutionProjectionError, match="ONLINE_TASK_PROJECTION_RESPONSE_BINDING_INVALID"):
+        OnlineTaskProjectionClient("http://127.0.0.1:1", token).create(submitted, binding=binding())
+
+
+class _ProjectedBridge:
+    def __init__(self, value: dict) -> None:
+        self.value = value
+        self.calls = 0
+
+    def project_execution(self, _task: dict, _execution: dict | None = None) -> tuple[int, dict]:
+        self.calls += 1
+        return 200, self.value
+
+
+class _FakeAgent:
+    def __init__(self, tasks: list[dict]) -> None:
+        self.tasks = tasks
+        self.claimed: list[str] = []
+
+    def poll(self) -> list[dict]:
+        return self.tasks
+
+    def claim(self, task_id: str) -> tuple[int, dict]:
+        self.claimed.append(task_id)
+        return 200, {"task_id": task_id, "lease_token": "x" * 32, "attempt": 1, "revision": 2}
+
+
+def test_task_visible_to_worker_claimable(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path)
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    envelope, source = supervisor.resolve_envelope(task_without_envelope())
+    assert source == "recovered_projection"
+    assert envelope.task_id == TASK
+    assert envelope.job_id == JOB
+    assert envelope.action == "source_capture"
+
+
+def test_task_claim_after_projection(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path)
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    fake_agent = _FakeAgent([task_without_envelope()])
+    supervisor.agent = fake_agent
+    supervisor.bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    processed: list[tuple[str, str]] = []
+    supervisor.process_claim = lambda task, claim, envelope: processed.append((task["task_id"], envelope.execution_digest if hasattr(envelope, "execution_digest") else envelope.digest))  # type: ignore[method-assign]
+    assert supervisor.once() == 0
+    assert fake_agent.claimed == [TASK]
+    assert processed and processed[0][0] == TASK
+
+
+def test_claim_heartbeat_source_capture_and_result_lifecycle(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    execution = project_execution_envelope(binding(), {"action": "source_capture", "source_signals": ["agent"]})
+    task = task_without_envelope()
+    task["metadata"] = {"execution": execution}
+
+    class Agent:
+        def __init__(self) -> None:
+            self.heartbeats: list[str] = []
+            self.results: list[dict] = []
+
+        def heartbeat(self, _task_id: str, _lease_token: str, stage: str) -> tuple[int, dict]:
+            self.heartbeats.append(stage)
+            return 200, {}
+
+        def get(self, _task_id: str) -> tuple[int, dict]:
+            return 200, task
+
+        def result(self, _task_id: str, _lease_token: str, _key: str, result: dict) -> tuple[int, dict]:
+            self.results.append(result)
+            return 200, {}
+
+    worktree = tmp_path / "worktree"
+    source = worktree / "active-runtime" / "app" / "agent_auto_fixture.py"
+    source.parent.mkdir(parents=True)
+    source.write_text("VALUE = 1\n", encoding="utf-8")
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path / "state")
+    monkeypatch.setattr(worker_module, "new_run_root", lambda: tmp_path / "run")
+    monkeypatch.setattr(worker_module, "prepare_worktree", lambda *_args, **_kwargs: worktree)
+    monkeypatch.setattr(worker_module, "cleanup_run_root", lambda *_args, **_kwargs: None)
+    agent = Agent()
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.agent = agent
+    supervisor.bridge = _ProjectedBridge(execution)
+    envelope, _ = supervisor.resolve_envelope(task)
+    supervisor.process_claim(task, {"task_id": TASK, "lease_token": "l" * 32, "attempt": 2, "revision": 8}, envelope)
+    assert agent.heartbeats and agent.heartbeats[0] == "claimed"
+    assert len(agent.results) == 1
+    assert agent.results[0]["status"] == "SUCCEEDED"
+    assert agent.results[0]["classification"] == "NEEDS_REWORK_SOURCE_CAPTURE"
+
+
+def test_dynamic_task_binding_no_hardcoded_task_id() -> None:
+    worker = (APP / "aios_online_agent_worker.py").read_text(encoding="utf-8")
+    assert TASK not in worker
+    assert BASE not in worker
+    for name in ("aios-online-agent-worker.service", "aios-online-engineering-consumer.service"):
+        unit = (ROOT / "deploy" / "systemd" / name).read_text(encoding="utf-8")
+        assert TASK not in unit
+        assert JOB not in unit
+        assert BASE not in unit
+        assert BRANCH not in unit
+        assert "AIOS_ENGINEERING_PLAN_FILE" not in unit
+        assert "aios_online_agent_worker.py" in unit
+    projection = (ROOT / "deploy" / "systemd" / "aios-chatgpt-bridge-v2-agent-task-projection.conf").read_text(encoding="utf-8")
+    assert "AIOS_ONLINE_TASK_PROJECTION_ENABLED=1" in projection
+    assert "LoadCredential=agent_task_control_token:" in projection
+    assert "LoadCredentialEncrypted=" not in projection
+    assert "Bearer " not in projection
+
+
+def test_durable_task_key_has_collision_resistant_exact_identity() -> None:
+    assert _task_key("task:a") != _task_key("task-a")
+    assert _task_key("x" * 140 + "a") != _task_key("x" * 140 + "b")
+
+
+def test_existing_binding_rejects_idempotency_head_and_generation_drift(tmp_path: Path) -> None:
+    class Authority:
+        @staticmethod
+        def commit_exists(_oid: str) -> bool:
+            return True
+
+        @staticmethod
+        def read_ref(_ref: str) -> None:
+            return None
+
+    bootstrap = GovernedTaskBootstrap(Authority(), tmp_path, remote_name="origin", token_path=tmp_path / "token", ssh_key_path=tmp_path / "key")
+    request = {
+        "task_id": TASK,
+        "repository": "aios/aios",
+        "base_oid": BASE,
+        "target_branch": BRANCH,
+        "risk": "engineering",
+        "description": "automatic claim infrastructure",
+        "idempotency_key": "p0-claim-online-agent-auto-execution-v1",
+        "expected_branch_oid": BASE,
+        "generation": 1,
+    }
+    bootstrap.create(request)
+    for drift in (
+        {"idempotency_key": "p0-claim-online-agent-auto-execution-v2"},
+        {"expected_branch_oid": "b" * 40},
+        {"generation": 2},
+    ):
+        with pytest.raises(BootstrapError, match="TASK_BINDING_CONFLICT"):
+            bootstrap.create({**request, **drift})
+
+
+def test_existing_branch_without_durable_parent_ownership_is_denied(tmp_path: Path) -> None:
+    class Authority:
+        @staticmethod
+        def commit_exists(_oid: str) -> bool:
+            return True
+
+        @staticmethod
+        def read_ref(_ref: str) -> str:
+            return BASE
+
+    bootstrap = GovernedTaskBootstrap(Authority(), tmp_path, remote_name="origin", token_path=tmp_path / "token", ssh_key_path=tmp_path / "key")
+    with pytest.raises(BootstrapError, match="EXISTING_BRANCH_OWNERSHIP_REQUIRED"):
+        bootstrap.create({
+            "task_id": TASK,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "target_branch": BRANCH,
+            "risk": "engineering",
+            "description": "automatic claim infrastructure",
+            "idempotency_key": "p0-claim-online-agent-auto-execution-v1",
+            "expected_branch_oid": BASE,
+            "generation": 2,
+        })
+
+
+@pytest.mark.parametrize(
+    ("field", "value", "error"),
+    [
+        ("repository", "other/repo", "WRONG_REPOSITORY_ENVELOPE_DENY"),
+        ("target_branch", "agent/wrong-branch", "WRONG_BRANCH_ENVELOPE_DENY"),
+        ("generation", 2, "WRONG_GENERATION_ENVELOPE_DENY"),
+    ],
+)
+def test_wrong_lineage_envelope_deny(field: str, value: object, error: str) -> None:
+    envelope = project_execution_envelope(binding())
+    envelope[field] = value
+    with pytest.raises(ExecutionProjectionError, match=error):
+        validate_execution_envelope(envelope, binding=binding())
+
+
+def test_capability_mismatch_deny() -> None:
+    envelope = project_execution_envelope(
+        binding(),
+        {"action": "source_capture", "capability_scope": ["git.read", "governed.write.file"]},
+    )
+    with pytest.raises(ExecutionProjectionError, match="CAPABILITY_MISMATCH_DENY"):
+        validate_execution_envelope(envelope, binding=binding(), worker_capabilities=["git.read"])
+
+
+def test_governance_lineage_override_deny() -> None:
+    envelope = project_execution_envelope(binding())
+    envelope["governance"] = {**envelope["governance"], "job_id": "job-wrong-lineage"}
+    with pytest.raises(ExecutionProjectionError, match="JOB_BINDING_CONFLICT"):
+        validate_execution_envelope(envelope, binding=binding())
+
+
+def test_malformed_persisted_envelope_does_not_fallback() -> None:
+    task = task_without_envelope()
+    task["metadata"] = {"execution": {"schema": "broken"}}
+    bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.bridge = bridge
+    with pytest.raises(WorkerError, match="EXECUTION_ENVELOPE_SCHEMA_VALIDATION"):
+        supervisor.resolve_envelope(task)
+    assert bridge.calls == 0
+
+
+def test_self_consistent_persisted_wrong_lineage_is_denied_by_authority() -> None:
+    task = task_without_envelope()
+    wrong = binding()
+    wrong = GovernedExecutionBinding.from_mapping({**wrong.public(), "job_id": "job-00000000000000000000000000000000"})
+    task["metadata"] = {"execution": project_execution_envelope(wrong)}
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    with pytest.raises(WorkerError, match="TASK_PERSISTED_BINDING_CONFLICT"):
+        supervisor.resolve_envelope(task)
+
+
+def test_projection_control_missing_denies_before_governed_side_effect() -> None:
+    class Bootstrap:
+        called = False
+
+        def create(self, _request: dict) -> dict:
+            self.called = True
+            raise AssertionError("must not create governed state")
+
+    runtime = GovernedRuntime.__new__(GovernedRuntime)
+    runtime.bootstrap = Bootstrap()
+    runtime.online_task_projector = None
+    with pytest.raises(RuntimeError, match="ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE"):
+        GovernedRuntime.create_task(runtime, {"task_id": TASK, "require_online_task_projection": True})
+    assert runtime.bootstrap.called is False
+
+
+def test_source_capture_projection_cannot_write() -> None:
+    envelope = project_execution_envelope(binding())
+    assert envelope["action"] == "source_capture"
+    assert envelope["change_set"] == []
+    assert envelope["verification"] == []
+    assert envelope["governance"]["writer_lease"] is False
+    assert all(envelope["governance"][field] is False for field in ("main_write", "production_write", "tag_write", "baseline_write", "force_push", "protected_ref_bypass"))
+
+
+def test_source_capture_state_allows_next_attempt_deterministic_digest(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path)
+    state_path = tmp_path / "tasks" / f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({"task_id": TASK, "execution_digest": "a" * 64, "phase": "source_capture_done"}), encoding="utf-8")
+    assert load_task_state(TASK, "b" * 64) is None
+
+
+def test_bridge_exposes_controlled_projection_operation() -> None:
+    seen: list[dict] = []
+    adapter = BridgeV2Adapter(
+        runtime_status={},
+        handlers={"projectOnlineAgentExecution": lambda request: seen.append(dict(request)) or project_execution_envelope(binding())},
+    )
+    response = adapter.projectOnlineAgentExecution({"task_id": TASK})
+    assert response["job_id"] == JOB
+    assert seen == [{"task_id": TASK}]
+    assert BRIDGE_OPERATION_CONTRACTS["projectOnlineAgentExecution"]["path"] == "/v2/execution-envelope"
+
+
+def test_execution_digest_is_canonical() -> None:
+    envelope = project_execution_envelope(binding())
+    material = {key: value for key, value in envelope.items() if key != "execution_digest"}
+    expected = hashlib.sha256(json.dumps(material, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    assert envelope["execution_digest"] == expected
+
+
+def test_governed_commit_uses_existing_exact_job_without_recreating(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    execution = project_execution_envelope(
+        binding(),
+        {
+            "action": "deterministic",
+            "change_set": [{"operation": "write_file", "path": "result.txt", "content": "ok\n"}],
+            "governance": {"allowed_files": ["result.txt"]},
+        },
+    )
+    envelope = ExecutionEnvelope.from_task({"task_id": TASK, "metadata": {"execution": execution}})
+    (tmp_path / "result.txt").write_text("ok\n", encoding="utf-8")
+    commit_oid = "b" * 40
+
+    class Bridge:
+        def __init__(self) -> None:
+            self.routes: list[str] = []
+
+        def call(self, route: str, body: dict) -> tuple[int, dict]:
+            self.routes.append(route)
+            if route == "/v2/job":
+                assert body == {"job_id": JOB}
+            else:
+                assert body["task_id"] == TASK
+                assert body["job_id"] == JOB
+            if route == "/v2/writer-lease":
+                return 200, {
+                    "task_id": TASK,
+                    "job_id": JOB,
+                    "repository": "aios/aios",
+                    "base_oid": BASE,
+                    "expected_branch_oid": BASE,
+                    "branch_mode": "CREATE_NEW",
+                    "generation": 1,
+                    "target_branch": BRANCH,
+                }
+            if route == "/v2/commit-files":
+                return 200, {
+                    "job_id": JOB,
+                    "target_branch": BRANCH,
+                    "generation": 1,
+                    "branch_mode": "CONTINUE_EXISTING",
+                    "commit_oid": commit_oid,
+                    "commit_visible": True,
+                    "receipt": {
+                        "remote_verified": True,
+                        "authority_oid": commit_oid,
+                        "api_branch_oid": commit_oid,
+                        "git_remote_oid": commit_oid,
+                    },
+                }
+            if route == "/v2/job":
+                return 200, {
+                    "state": "COMPLETED",
+                    "receipt": {
+                        "remote_verified": True,
+                        "authority_oid": commit_oid,
+                        "api_branch_oid": commit_oid,
+                        "git_remote_oid": commit_oid,
+                    },
+                    "branch_leases": [{
+                        "job_id": JOB,
+                        "branch": BRANCH,
+                        "state": "ACTIVE",
+                        "generation": 1,
+                        "current_head_oid": commit_oid,
+                    }],
+                }
+            raise AssertionError(route)
+
+    bridge = Bridge()
+    monkeypatch.setattr(worker_module.subprocess, "run", lambda *args, **kwargs: SimpleNamespace(returncode=0, stdout=commit_oid + "\n", stderr=""))
+    heartbeat = SimpleNamespace(ensure=lambda: None)
+    result = governed_commit(envelope, tmp_path, bridge, heartbeat)
+    assert bridge.routes == ["/v2/writer-lease", "/v2/commit-files", "/v2/job"]
+    assert result["job_id"] == JOB
+    assert result["commit_oid"] == commit_oid

tests/test_online_agent_plan_store.py

@@ -0,0 +1,60 @@
+from pathlib import Path
+import sys
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+
+from aios_online_agent_execution import GovernedExecutionBinding
+from aios_online_agent_plan_store import ExecutionPlanStore, ExecutionPlanError
+
+BASE="a642b045775b9154a00ae78543037fbef4fb447b"
+HEAD="71523aef6e48b1e2fa516c456ca189b7a039104b"
+
+def binding(head=HEAD):
+    return GovernedExecutionBinding.from_mapping({
+      "task_id":"task-plan-a","job_id":"job-plan-a","repository":"aios/aios","base_oid":BASE,
+      "expected_branch_oid":head,"target_branch":"agent/task-plan-a","branch_mode":"CONTINUE_EXISTING",
+      "generation":1,"idempotency_key":"governed-plan-a",
+    })
+
+def request():
+    return {
+      "schema":"aios.online-agent.plan.v1","task_id":"task-plan-a","job_id":"job-plan-a",
+      "source_head_oid":HEAD,"generation":1,"idempotency_key":"plan-task-a-v1",
+      "execution":{
+        "action":"deterministic",
+        "change_set":[{"path":"x.py","operation":"write_file","content":"x=1\n"}],
+        "verification":[{"label":"compile","argv":["/usr/bin/python3","-m","py_compile","x.py"],"cwd":".","timeout_seconds":30}],
+        "capability_scope":["git.read","git.test"],
+      }
+    }
+
+def test_plan_register_and_resolve(tmp_path):
+    store=ExecutionPlanStore(tmp_path)
+    created=store.register(binding(),request())
+    assert created["idempotent"] is False
+    resolved=store.resolve(binding())
+    assert resolved["plan_digest"]==created["plan_digest"]
+    assert resolved["execution"]["action"]=="deterministic"
+
+def test_plan_is_idempotent(tmp_path):
+    store=ExecutionPlanStore(tmp_path); req=request()
+    first=store.register(binding(),req); second=store.register(binding(),req)
+    assert second["idempotent"] is True
+    assert first["plan_digest"]==second["plan_digest"]
+
+def test_plan_source_head_drift_denied(tmp_path):
+    store=ExecutionPlanStore(tmp_path); store.register(binding(),request())
+    with pytest.raises(ExecutionPlanError,match="SOURCE_HEAD_DRIFT"):
+        store.resolve(binding("b"*40))
+
+def test_plan_replacement_requires_cas(tmp_path):
+    store=ExecutionPlanStore(tmp_path); first=store.register(binding(),request())
+    changed=request(); changed["idempotency_key"]="plan-task-a-v2"
+    changed["execution"]["change_set"][0]["content"]="x=2\n"
+    with pytest.raises(ExecutionPlanError,match="REPLACEMENT_CAS_MISMATCH"):
+        store.register(binding(),changed)
+    changed["expected_previous_plan_digest"]=first["plan_digest"]
+    second=store.register(binding(),changed)
+    assert second["plan_digest"]!=first["plan_digest"]

tests/test_online_agent_scheme_a.py

@@ -0,0 +1,245 @@
+from __future__ import annotations
+
+from pathlib import Path
+from types import SimpleNamespace
+import json
+import sys
+
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+APP=ROOT/"active-runtime/app"
+sys.path.insert(0,str(APP))
+
+from aios_online_agent_execution import GovernedExecutionBinding, project_execution_envelope
+from aios_governed_task_bootstrap import GovernedTaskBinding, GovernedTaskBootstrap
+from aios_gitops_job_controller import GitOpsJobController, JobState, JobStore
+from aios_continuation_executor import ContinuationExecutionError, DetachedGitWorkspace
+from aios_online_agent_worker import (
+    BridgeClient,
+    IsolatedDeterministicExecutor,
+    load_task_state,
+    _claim_order,
+    _isolated_executor_wait_seconds,
+    _verify_converged_job,
+    WorkerError,
+)
+
+
+BASE="a642b045775b9154a00ae78543037fbef4fb447b"
+HEAD="71523aef6e48b1e2fa516c456ca189b7a039104b"
+TASK="p0-claim-online-agent-auto-execution-20260817"
+JOB="job-2031a9e5682a4238f98e3ac7aee8a593"
+BRANCH="agent/p0-claim-online-agent-auto-execution-20260817"
+
+
+def test_source_signals_are_bounded_by_projection():
+    binding=GovernedExecutionBinding.from_mapping({
+      "task_id":TASK,"job_id":JOB,"repository":"aios/aios","base_oid":BASE,
+      "expected_branch_oid":BASE,"target_branch":BRANCH,"branch_mode":"CREATE_NEW",
+      "generation":1,"idempotency_key":"p0-claim-online-agent-auto-execution-a642b04-v1",
+    })
+    execution=project_execution_envelope(binding,{
+      "action":"source_capture",
+      "source_signals":["x"*5000,"x"*5000,"trace credential tool "*100],
+    })
+    assert len(execution["source_signals"]) <= 16
+    assert all(0 < len(item) <= 512 for item in execution["source_signals"])
+
+
+def test_same_job_create_new_binding_normalizes_to_current_head():
+    binding=GovernedTaskBinding(
+      task_id=TASK,job_id=JOB,repository="aios/aios",base_oid=BASE,
+      expected_branch_oid=BASE,target_branch=BRANCH,branch_mode="CREATE_NEW",
+      generation=1,idempotency_key="p0-claim-online-agent-auto-execution-a642b04-v1",
+      risk="engineering",description="automatic claim",
+    )
+    bootstrap=GovernedTaskBootstrap.__new__(GovernedTaskBootstrap)
+    bootstrap.authority=SimpleNamespace(read_ref=lambda ref: HEAD)
+    class Connection:
+        def __enter__(self): return self
+        def __exit__(self,*a): return False
+        def execute(self,*a,**k):
+            return SimpleNamespace(fetchall=lambda:[{
+              "current_head_oid":HEAD,"generation":1,"state":"ACTIVE","lineage_anchor_oid":BASE
+            }])
+    bootstrap._store=lambda _task:(SimpleNamespace(_connect=lambda:Connection()),None)
+    normalized=bootstrap.execution_binding(binding)
+    assert normalized.base_oid == BASE
+    assert normalized.expected_branch_oid == HEAD
+    assert normalized.branch_mode == "CONTINUE_EXISTING"
+    assert normalized.generation == 1
+
+
+def test_recovery_receipt_requires_exact_oid_and_active_lease():
+    envelope=SimpleNamespace(job_id=JOB,target_branch=BRANCH,generation=1)
+    response={
+      "state":"COMPLETED",
+      "receipt":{"remote_verified":True,"authority_oid":HEAD,"api_branch_oid":HEAD,"git_remote_oid":HEAD},
+      "branch_leases":[{
+        "job_id":JOB,"branch":BRANCH,"state":"ACTIVE","generation":1,"current_head_oid":HEAD
+      }],
+    }
+    _verify_converged_job(response,envelope,HEAD)
+    bad={**response,"receipt":{**response["receipt"],"git_remote_oid":BASE}}
+    with pytest.raises(WorkerError,match="GOVERNED_RECEIPT_OID_MISMATCH"):
+        _verify_converged_job(bad,envelope,HEAD)
+
+
+def test_executor_unit_is_uncredentialed():
+    unit=(ROOT/"deploy/systemd/aios-online-agent-isolated-executor.service").read_text()
+    assert "PrivateNetwork=true" in unit
+    assert "RestrictAddressFamilies=AF_UNIX AF_INET" in unit
+    assert "IPAddressDeny=any" in unit
+    assert "IPAddressAllow=localhost" in unit
+    assert "InaccessiblePaths=/run/credentials" in unit
+    assert "LoadCredential" not in unit
+    assert "SupplementaryGroups=gitops" not in unit
+
+
+def test_isolated_executor_wait_budget_includes_safety_margin():
+    assert _isolated_executor_wait_seconds(({"timeout_seconds":1200},)) == 1230
+
+
+def test_prepared_deterministic_plan_precedes_source_capture_at_same_priority():
+    deterministic=SimpleNamespace(action="deterministic",task_id="task-deterministic")
+    source_capture=SimpleNamespace(action="source_capture",task_id="task-source-capture")
+    task={"priority":100,"created_at":"2026-08-17T00:00:00Z"}
+    ordered=sorted(((task,source_capture),(task,deterministic)),key=_claim_order)
+    assert ordered[0][1] is deterministic
+
+
+def test_plan_registry_gets_precedence_when_task_has_no_execution(monkeypatch):
+    client=BridgeClient("agent-token-placeholder")
+    seen=[]
+    monkeypatch.setattr(client,"call",lambda route,body:(seen.append((route,body)) or (200,{})))
+    task={"task_id":TASK,"required_capabilities":["git.read"]}
+    client.project_execution(task)
+    assert seen == [("/v2/execution-envelope",{"task_id":TASK,"required_capabilities":["git.read"]})]
+    client.project_execution(task,{"action":"source_capture","source_signals":["trace"]})
+    assert seen[-1][1]["execution"]["action"] == "source_capture"
+
+
+def test_executor_exchange_files_are_group_readable_and_directories_setgid(tmp_path):
+    request=tmp_path/"request.json"
+    IsolatedDeterministicExecutor._atomic(request,b"{}")
+    assert request.stat().st_mode & 0o777 == 0o640
+    tmpfiles=(ROOT/"deploy/tmpfiles.d/aios-online-agent-executor.conf").read_text()
+    assert tmpfiles.count(" 2770 ") == 5
+
+
+def test_precommit_state_recovery_requires_a_later_official_attempt(monkeypatch,tmp_path):
+    import aios_online_agent_worker as worker_module
+    monkeypatch.setattr(worker_module,"STATE_ROOT",tmp_path)
+    state_path=tmp_path/"tasks"/f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({"task_id":TASK,"execution_digest":"a"*64,"phase":"workspace_prepared"}))
+    assert load_task_state(TASK,"b"*64) is None
+    state_path.write_text(json.dumps({"task_id":TASK,"execution_digest":"a"*64,"phase":"verification_passed","attempt":16}))
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=16)
+    assert load_task_state(TASK,"b"*64,attempt=17) is None
+
+
+def test_reconciliation_state_recovery_requires_later_attempt_and_same_job(monkeypatch,tmp_path):
+    import aios_online_agent_worker as worker_module
+    monkeypatch.setattr(worker_module,"STATE_ROOT",tmp_path)
+    state_path=tmp_path/"tasks"/f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({
+        "task_id":TASK,
+        "execution_digest":"a"*64,
+        "phase":"reconciliation_required",
+        "attempt":18,
+        "job_id":JOB,
+        "details":{"api_status":503,"error":"WORKTREE_DIRTY_SCOPE_MISMATCH"},
+    }))
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=18,continuation_job_id=JOB,continuation_head_oid=HEAD)
+    assert load_task_state(TASK,"b"*64,attempt=19,continuation_job_id=JOB,continuation_head_oid=HEAD) is None
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=19,continuation_job_id="job-other",continuation_head_oid=HEAD)
+
+
+def test_legacy_dirty_scope_reconciliation_state_is_exactly_bounded(monkeypatch,tmp_path):
+    import aios_online_agent_worker as worker_module
+    monkeypatch.setattr(worker_module,"STATE_ROOT",tmp_path)
+    state_path=tmp_path/"tasks"/f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({
+        "task_id":TASK,
+        "execution_digest":"a"*64,
+        "phase":"reconciliation_required",
+        "job_id":JOB,
+        "details":{"api_status":503,"error":"WORKTREE_DIRTY_SCOPE_MISMATCH"},
+    }))
+    assert load_task_state(TASK,"b"*64,attempt=19,continuation_job_id=JOB,continuation_head_oid=HEAD) is None
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=19,continuation_job_id=JOB,continuation_head_oid="not-an-oid")
+
+
+def test_completed_same_job_begins_one_idempotent_continuation_cycle(tmp_path):
+    controller=GitOpsJobController(JobStore(tmp_path/"jobs",payload_root=tmp_path/"payloads"))
+    submitted=controller.submit({
+        "idempotency_key":"same-job-continuation-test",
+        "campaign_id":TASK,
+        "task_id":TASK,
+        "repository":"aios/aios",
+        "operation":"GOVERNED_TASK_CREATE",
+        "branch":BRANCH,
+        "expected_branch_oid":HEAD,
+        "payload_digest":"a"*64,
+    })
+    job_id=submitted.job_id
+    controller.advance(job_id,JobState.AUTHORIZED,side_effect_state="AUTHORIZED",expected_revision=0)
+    controller.lease_job(
+        job_id,
+        lease_id="lease-"+job_id,
+        lineage_anchor_oid=BASE,
+        current_head_oid=HEAD,
+        generation=1,
+        lease_expires_at="2099-01-01T00:00:00+00:00",
+        expected_revision=1,
+    )
+    controller.advance(job_id,JobState.WORKTREE_READY,side_effect_state="WORKTREE_READY",expected_revision=2)
+    controller.advance(job_id,JobState.EXECUTING,side_effect_state="IN_PROGRESS",expected_revision=3)
+    controller.advance(job_id,JobState.LOCAL_VERIFIED,side_effect_state="LOCAL_VERIFIED",receipt={"authority_oid":HEAD},expected_revision=4)
+    controller.advance(job_id,JobState.REMOTE_SYNCING,side_effect_state="IN_PROGRESS",expected_revision=5)
+    receipt={
+        "remote_verified":True,
+        "commit_visible":True,
+        "authority_oid":HEAD,
+        "api_branch_oid":HEAD,
+        "git_remote_oid":HEAD,
+    }
+    controller.advance(job_id,JobState.REMOTE_VERIFIED,side_effect_state="REMOTE_VERIFIED",receipt=receipt,expected_revision=6)
+    controller.advance(job_id,JobState.COMPLETED,side_effect_state="REMOTE_VERIFIED",receipt=receipt,expected_revision=7)
+    first=controller.begin_continuation_cycle(
+        job_id,
+        idempotency_key="same-job-continuation-commit-v1",
+        expected_head_oid=HEAD,
+        generation=1,
+        expected_revision=8,
+    )
+    assert first == {"completed":False,"commit_oid":None,"idempotent":False}
+    assert controller.store.read(job_id)["state"] == "LEASED"
+    replay=controller.begin_continuation_cycle(
+        job_id,
+        idempotency_key="same-job-continuation-commit-v1",
+        expected_head_oid=HEAD,
+        generation=1,
+        expected_revision=8,
+    )
+    assert replay == {"completed":False,"commit_oid":None,"idempotent":True}
+
+
+def test_deterministic_materialization_recovers_only_an_in_scope_dirty_subset(monkeypatch,tmp_path):
+    workspace=object.__new__(DetachedGitWorkspace)
+    workspace.path=tmp_path
+    monkeypatch.setattr(DetachedGitWorkspace,"_dirty_paths",lambda _self:{"old.py"})
+    workspace.materialize_files({"old.py":b"new-old\n","new.py":b"new\n"})
+    assert (tmp_path/"old.py").read_bytes() == b"new-old\n"
+    assert (tmp_path/"new.py").read_bytes() == b"new\n"
+    monkeypatch.setattr(DetachedGitWorkspace,"_dirty_paths",lambda _self:{"outside.py"})
+    with pytest.raises(ContinuationExecutionError,match="WORKTREE_DIRTY_SCOPE_MISMATCH"):
+        workspace.materialize_files({"old.py":b"again\n"})

tests/test_openclaw_engineering_backend_v2.py

@@ -1,156 +0,0 @@
-from __future__ import annotations
-
-import importlib.util
-import json
-import os
-from pathlib import Path
-import subprocess
-import sys
-
-import pytest
-
-
-BACKEND_PATH = Path(__file__).parents[1] / "services" / "aios-agent-runtime-broker" / "openclaw_engineering_backend.py"
-
-
-def load_backend():
-    spec = importlib.util.spec_from_file_location("openclaw_backend_under_test", BACKEND_PATH)
-    module = importlib.util.module_from_spec(spec)
-    assert spec.loader is not None
-    spec.loader.exec_module(module)
-    return module
-
-
-def fake_openclaw(tmp_path: Path) -> Path:
-    path = tmp_path / "openclaw"
-    path.write_text(
-        """#!/usr/bin/env python3
-import json, os, pathlib, sys
-args = sys.argv[1:]
-assert args[:2] == ['agent', 'exec']
-def value(flag):
-    return args[args.index(flag) + 1]
-assert value('--message-file') == '-'
-cwd = pathlib.Path(value('--cwd'))
-assert cwd.resolve() == pathlib.Path.cwd().resolve()
-assert '--auth-env-only' in args
-assert '--json' in args
-assert os.environ.get('OPENCLAW_EXEC_SHELL_SNAPSHOT') == '0'
-assert 'AIOS_AGENT_TASK_TOKEN' not in os.environ
-prompt = sys.stdin.read()
-assert 'Do NOT run `git commit`' in prompt
-(cwd / 'changed_by_openclaw.txt').write_text('changed\\n', encoding='utf-8')
-json.dump({
-  'ok': True,
-  'status': 'ok',
-  'final': 'Changed the requested file and verified the result.',
-  'payloads': [{'text':'done'}],
-  'model': value('--model'),
-  'provider': 'test-provider',
-  'sessionId': 'test-session',
-  'assistantTurns': 2,
-  'codeModeEngaged': True,
-  'toolSummary': {'calls': 3, 'tools': ['read','write','exec'], 'totalToolTimeMs': 10}
-}, sys.stdout)
-""",
-        encoding="utf-8",
-    )
-    path.chmod(0o755)
-    return path
-
-
-def request(worktree: Path) -> dict[str, object]:
-    return {
-        "schema": "aios.online-agent.runtime-request.v1",
-        "adapter": "hermes",
-        "task": {
-            "task_id": "openclaw-backend-selftest",
-            "goal": "Make the requested change.",
-            "instructions": "Inspect, implement, and test.",
-            "success_criteria": ["The change is correct"],
-        },
-        "execution_context": {
-            "repository": "aios/aios",
-            "base_oid": "a" * 40,
-            "target_branch": "agent/intent/openclaw-backend-selftest",
-            "worktree": str(worktree),
-        },
-        "policy": {
-            "authoritative_repository_write": False,
-            "direct_git_ref_mutation": False,
-            "direct_git_push": False,
-            "direct_git_commit": False,
-            "main_write": False,
-            "force_push": False,
-            "production_write": False,
-            "tag_write": False,
-            "baseline_write": False,
-            "task_api_credential_visible": False,
-            "writer_lease_visible": False,
-        },
-    }
-
-
-def test_openclaw_agent_exec_contract(tmp_path: Path, monkeypatch) -> None:
-    backend = load_backend()
-    worktree = tmp_path / "worktree"
-    worktree.mkdir()
-    fake = fake_openclaw(tmp_path)
-    monkeypatch.setenv("AIOS_OPENCLAW_BIN", str(fake))
-    monkeypatch.setenv("AIOS_OPENCLAW_MODEL", "test/model")
-    monkeypatch.setenv("AIOS_OPENCLAW_PROVIDER_CREDENTIAL_MAP_JSON", "{}")
-    fd = os.open(str(worktree), getattr(os, "O_PATH", os.O_RDONLY) | os.O_DIRECTORY)
-    try:
-        value = request(worktree)
-        value["execution_context"]["worktree"] = f"/proc/self/fd/{fd}"
-        task, pinned = backend.validate_request(value)
-        result = backend.invoke_openclaw(task, pinned)
-    finally:
-        os.close(fd)
-    assert result["status"] == "COMPLETED"
-    assert result["evidence"]["backend"] == "openclaw-agent-exec"
-    assert result["evidence"]["model"] == "test/model"
-    assert (worktree / "changed_by_openclaw.txt").read_text(encoding="utf-8") == "changed\n"
-
-
-def test_provider_credential_is_projected_only_to_openclaw_child(tmp_path: Path, monkeypatch) -> None:
-    backend = load_backend()
-    credentials = tmp_path / "credentials"
-    credentials.mkdir()
-    (credentials / "openai_api_key").write_text("provider-secret\n", encoding="utf-8")
-    monkeypatch.setenv("CREDENTIALS_DIRECTORY", str(credentials))
-    monkeypatch.setenv(
-        "AIOS_OPENCLAW_PROVIDER_CREDENTIAL_MAP_JSON",
-        json.dumps({"OPENAI_API_KEY": "openai_api_key"}),
-    )
-    env = backend.provider_environment()
-    assert env["OPENAI_API_KEY"] == "provider-secret"
-    assert "AIOS_AGENT_TASK_TOKEN" not in env
-    assert env["OPENCLAW_EXEC_SHELL_SNAPSHOT"] == "0"
-
-
-def test_missing_model_fails_closed(tmp_path: Path, monkeypatch) -> None:
-    backend = load_backend()
-    worktree = tmp_path / "worktree"
-    worktree.mkdir()
-    monkeypatch.setenv("AIOS_OPENCLAW_BIN", str(fake_openclaw(tmp_path)))
-    monkeypatch.delenv("AIOS_OPENCLAW_MODEL", raising=False)
-    fd = os.open(str(worktree), getattr(os, "O_PATH", os.O_RDONLY) | os.O_DIRECTORY)
-    try:
-        value = request(worktree)
-        value["execution_context"]["worktree"] = f"/proc/self/fd/{fd}"
-        task, pinned = backend.validate_request(value)
-        with pytest.raises(backend.BackendError) as caught:
-            backend.invoke_openclaw(task, pinned)
-    finally:
-        os.close(fd)
-    assert caught.value.code == "OPENCLAW_MODEL_INVALID"
-
-
-def test_pinned_worktree_is_required(tmp_path: Path) -> None:
-    backend = load_backend()
-    value = request(tmp_path)
-    value["execution_context"]["worktree"] = str(tmp_path)
-    with pytest.raises(backend.BackendError) as caught:
-        backend.validate_request(value)
-    assert caught.value.code == "PINNED_WORKTREE_REQUIRED"

tests/test_writer_lease_recovery.py

@@ -0,0 +1,763 @@
+from __future__ import annotations
+
+from concurrent.futures import ThreadPoolExecutor
+from datetime import datetime, timedelta, timezone
+import hashlib
+from dataclasses import asdict
+from pathlib import Path
+import sqlite3
+import json
+from types import SimpleNamespace
+import threading
+
+import pytest
+
+from aios_chatgpt_bridge_v2_server import GovernedRuntime
+from aios_continuation_executor import ContinuationPermissions, ContinuationRuntimeBinding
+from aios_continuation_lease import WriterLeaseRequestV2
+from aios_gitops_job_controller import GitOpsJobController, JobError, JobStore
+from aios_governed_task_bootstrap import GovernedTaskBootstrap
+
+
+TASK_ID = "gov-writer-lease-recovery-test"
+BRANCH = "agent/writer-lease-recovery-test"
+BASE = "a" * 40
+JOB_ID_PREFIX = "writer-lease-runtime-lineage"
+
+
+class LocalAuthority:
+    def __init__(self, head: str | None = None) -> None:
+        self.head = head
+
+    def read_ref(self, _ref: str) -> str | None:
+        return self.head
+
+    def commit_exists(self, _oid: str) -> bool:
+        return True
+
+    def ancestry_check(self, _older: str, _newer: str) -> bool:
+        return True
+
+
+def writer_request(task_id: str = TASK_ID, **overrides: object) -> dict[str, object]:
+    request: dict[str, object] = {
+        "schema": WriterLeaseRequestV2.schema,
+        "task_id": task_id,
+        "repository": "aios/aios",
+        "branch_mode": "CREATE_NEW",
+        "base_oid": BASE,
+        "expected_branch_oid": BASE,
+        "target_branch": BRANCH,
+        "generation": 1,
+        "lease_seconds": 120,
+    }
+    request.update(overrides)
+    return request
+
+
+def make_runtime(tmp_path: Path, task_id: str = TASK_ID, *, authority_head: str | None = None) -> GovernedRuntime:
+    runtime = GovernedRuntime.__new__(GovernedRuntime)
+    runtime.config = SimpleNamespace(repository="aios/aios", state_root=tmp_path)
+    runtime.authority = LocalAuthority(authority_head)
+    runtime.bindings = {
+        task_id: {
+            "task_id": task_id,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "expected_branch_oid": BASE,
+            "target_branch": BRANCH,
+            "branch_mode": "CREATE_NEW",
+            "generation": 1,
+        }
+    }
+    runtime.runtimes = {}
+    runtime.controllers = {}
+    runtime.bootstrap = GovernedTaskBootstrap(
+        runtime.authority,
+        tmp_path,
+        remote_name="test",
+        token_path=tmp_path / "token",
+        ssh_key_path=tmp_path / "key",
+    )
+    runtime.bindings = {}
+    runtime.create_task(
+        {
+            "task_id": task_id,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "expected_branch_oid": BASE,
+            "target_branch": BRANCH,
+            "risk": "engineering",
+            "description": "governed runtime lineage test",
+            "idempotency_key": JOB_ID_PREFIX + "-" + task_id,
+        }
+    )
+    job_root = runtime._job_root(task_id)
+    runtime.controllers[task_id] = GitOpsJobController(
+        JobStore(job_root, payload_root=job_root / "payloads")
+    )
+
+    def build(
+        lease: WriterLeaseRequestV2,
+        *,
+        job_id: str,
+        lease_not_before: datetime | None = None,
+        lease_expires_at: datetime | None = None,
+    ) -> tuple[ContinuationRuntimeBinding, GitOpsJobController, object]:
+        controller = runtime.controllers.get(lease.task_id)
+        if controller is None:
+            root = runtime._job_root(lease.task_id)
+            controller = GitOpsJobController(JobStore(root, payload_root=root / "payloads"))
+        now = datetime.now(timezone.utc)
+        return (
+            ContinuationRuntimeBinding(
+                request=lease,
+                job_id=job_id,
+                workspace_path=tmp_path / "worktrees" / lease.task_id,
+                lease_not_before=lease_not_before or now - timedelta(seconds=1),
+                lease_expires_at=lease_expires_at or now + timedelta(seconds=lease.lease_seconds),
+                original_receipt_valid=True,
+                original_grant_consumed=True,
+                permissions=ContinuationPermissions(),
+            ),
+            controller,
+            object(),
+        )
+
+    runtime._build_runtime = build
+    return runtime
+
+
+def create_durable_lease(
+    runtime: GovernedRuntime,
+    *,
+    expires_at: str = "2020-01-01T00:00:00+00:00",
+) -> GitOpsJobController:
+    root = runtime._job_root(TASK_ID)
+    controller = GitOpsJobController(JobStore(root, payload_root=root / "payloads"))
+    receipt = SimpleNamespace(job_id=runtime.bindings[TASK_ID]["job_id"])
+    controller.lease_job(
+        receipt.job_id,
+        lease_id="writer-lease-recovery",
+        lineage_anchor_oid=BASE,
+        current_head_oid=BASE,
+        generation=1,
+        lease_expires_at=expires_at,
+        expected_revision=0,
+    )
+    runtime.controllers[TASK_ID] = controller
+    return controller
+
+
+def durable_row(runtime: GovernedRuntime) -> tuple[str, int]:
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        row = connection.execute(
+            "SELECT lease_expires_at, revision FROM branch_leases WHERE lease_id=?",
+            ("writer-lease-recovery",),
+        ).fetchone()
+    assert row is not None
+    return row
+
+
+def test_first_bootstrap_refreshes_only_runtime_without_durable_lease(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    result = runtime.bootstrap_writer_lease(writer_request())
+
+    assert result["bootstrapped"] is True
+    assert result["runtime_rehydrated"] is False
+    assert result["durable_branch_lease_present"] is False
+    assert result["idempotent"] is False
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        assert connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0] == 0
+
+
+def test_duplicate_bootstrap_is_idempotent_without_consuming_generation(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    first = runtime.bootstrap_writer_lease(writer_request())
+    second = runtime.bootstrap_writer_lease(writer_request())
+
+    assert first["bootstrapped"] is True
+    assert first["generation"] == 1
+    assert second["bootstrapped"] is False
+    assert second["idempotent"] is True
+    assert second["generation"] == 1
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        assert connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0] == 0
+
+
+def test_commit_after_bootstrap_reuses_the_exact_runtime_binding(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    class RecordingWorkspace:
+
+        def __init__(self) -> None:
+            self.files: dict[str, bytes] = {}
+
+        def materialize_files(self, files: dict[str, bytes]) -> None:
+            self.files = dict(files)
+
+    class RecordingExecutor:
+
+        def __init__(self) -> None:
+            self.workspace = RecordingWorkspace()
+            self.binding = None
+            self.commit = None
+
+        def execute(self, binding: object, commit: object) -> dict[str, object]:
+            self.binding = binding
+            self.commit = commit
+            return {'task_id': binding.request.task_id, 'generation': binding.request.generation, 'files': sorted(self.workspace.files)}
+    executor = RecordingExecutor()
+    original_build = runtime._build_runtime
+
+    def build(lease: WriterLeaseRequestV2, *, job_id: str, lease_not_before: datetime | None=None, lease_expires_at: datetime | None=None) -> tuple[ContinuationRuntimeBinding, GitOpsJobController, object]:
+        binding, controller, _ = original_build(lease, job_id=job_id, lease_not_before=lease_not_before, lease_expires_at=lease_expires_at)
+        return (binding, controller, executor)
+    runtime._build_runtime = build
+    runtime.bootstrap_writer_lease(writer_request())
+    lease_response = runtime.acquire_lease(writer_request())
+    binding, controller, executor = runtime.runtimes[TASK_ID, 1]
+    assert lease_response['job_id'] == binding.job_id
+    assert lease_response['durable_branch_lease_present'] is True
+    _original_execute = executor.execute
+
+    def _execute_with_governed_commit_contract(*args, **kwargs):
+        _before_complete = kwargs.pop('before_complete', None)
+        _legacy = dict(_original_execute(*args, **kwargs))
+        _result = {**_legacy, 'job_id': binding.job_id, 'state': 'COMPLETED', 'side_effect_state': 'REMOTE_VERIFIED', 'receipt': {'authority_oid': 'b' * 40, 'git_remote_oid': 'b' * 40, 'api_branch_oid': 'b' * 40, 'commit_visible': True, 'remote_verified': True, 'force_push': False}}
+        if _before_complete is not None:
+            _before_complete('b' * 40)
+        return _result
+    executor.execute = _execute_with_governed_commit_contract
+    _bound_job_id = binding.job_id
+    result = runtime.commit_files({'task_id': TASK_ID, 'repository': 'aios/aios', 'generation': 1, 'target_branch': BRANCH, 'expected_branch_oid': BASE, 'idempotency_key': 'commit-after-bootstrap-v1', 'path': 'docs/recovery.txt', 'content_base64': 'YQ==', 'message': 'test commit after bootstrap'})
+    assert result['task_id'] == TASK_ID
+    assert result['generation'] == 1
+    assert result['files'] == ['docs/recovery.txt']
+    assert executor.binding.request.task_id == TASK_ID
+    assert executor.binding.request.generation == 1
+    database = runtime._job_root(TASK_ID) / 'state.sqlite3'
+    with sqlite3.connect(f'file:{database}?mode=ro', uri=True) as connection:
+        assert connection.execute('SELECT COUNT(*) FROM branch_leases').fetchone()[0] == 1
+        assert connection.execute('PRAGMA foreign_key_check(branch_leases)').fetchall() == []
+    assert result['commit_oid'] == 'b' * 40
+    assert result['commit_visible'] is True
+    assert result['branch_mode'] == 'CONTINUE_EXISTING'
+    assert result['target_branch'] == BRANCH
+    assert int(result['generation']) == 1
+    with controller.store._connect() as connection:
+        _persisted = connection.execute('SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?', ('lease-' + str(_bound_job_id),)).fetchone()
+    assert _persisted is not None
+    assert _persisted[0] == 'b' * 40
+    assert int(_persisted[1]) == 1
+    fresh_runtime = make_runtime(tmp_path, authority_head='b' * 40)
+    fresh_response = fresh_runtime.bootstrap_writer_lease(writer_request(branch_mode='CONTINUE_EXISTING', expected_branch_oid='b' * 40))
+    fresh_binding, _, _ = fresh_runtime.runtimes[TASK_ID, 1]
+    assert fresh_response['job_id'] == str(_bound_job_id)
+    assert fresh_response['runtime_rehydrated'] is True
+    assert fresh_binding.job_id == str(_bound_job_id)
+    assert fresh_binding.request.expected_branch_oid == 'b' * 40
+    with fresh_runtime.controllers[TASK_ID].store._connect() as connection:
+        _fresh_lease = connection.execute('SELECT job_id,current_head_oid,revision FROM branch_leases WHERE lease_id=?', ('lease-' + str(_bound_job_id),)).fetchone()
+    assert tuple(_fresh_lease) == (str(_bound_job_id), 'b' * 40, 1)
+
+
+
+@pytest.mark.parametrize(
+    ("field", "value", "error"),
+    (
+        ("repository", "other/repository", "LEASE_BINDING_CONFLICT"),
+        ("base_oid", "b" * 40, "LEASE_BINDING_CONFLICT"),
+        ("expected_branch_oid", "b" * 40, "LEASE_BINDING_CONFLICT"),
+        ("target_branch", "agent/wrong-target", "LEASE_BINDING_CONFLICT"),
+        ("generation", 2, "GENERATION_BINDING_CONFLICT"),
+    ),
+)
+def test_bootstrap_rejects_any_nonmatching_binding_field(
+    tmp_path: Path, field: str, value: object, error: str
+) -> None:
+    runtime = make_runtime(tmp_path)
+
+    with pytest.raises(RuntimeError, match=error):
+        runtime.bootstrap_writer_lease(writer_request(**{field: value}))
+
+
+def test_bootstrap_rejects_unknown_task_ownership(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    with pytest.raises(RuntimeError, match="TASK_OWNERSHIP_INVALID"):
+        runtime.bootstrap_writer_lease(writer_request(task_id="unknown-task"))
+
+
+def test_renew_missing_durable_lease_is_not_bootstrap(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    with pytest.raises(RuntimeError, match="LEASE_NOT_FOUND"):
+        runtime.renew_writer_lease(writer_request())
+
+
+def test_renew_is_generation_scoped_before_durable_lookup(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    create_durable_lease(runtime)
+
+    with pytest.raises(RuntimeError, match="GENERATION_BINDING_CONFLICT"):
+        runtime.renew_writer_lease(writer_request(generation=2))
+    assert durable_row(runtime) == ("2020-01-01T00:00:00+00:00", 0)
+
+
+def test_restart_rehydrates_only_from_matching_durable_lease(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    create_durable_lease(runtime)
+    runtime.runtimes.clear()
+
+    result = runtime.renew_writer_lease(writer_request())
+
+    expires_at, revision = durable_row(runtime)
+    assert result["recovered"] is True
+    assert result["runtime_rehydrated"] is True
+    assert result["durable_branch_lease_present"] is True
+    assert revision == 1
+    assert datetime.fromisoformat(expires_at) > datetime.now(timezone.utc)
+
+
+def test_duplicate_renewal_is_idempotent_after_first_durable_recovery(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    create_durable_lease(runtime)
+
+    first = runtime.renew_writer_lease(writer_request())
+    second = runtime.renew_writer_lease(writer_request())
+
+    assert first["recovered"] is True
+    assert first["idempotent"] is False
+    assert second["recovered"] is False
+    assert second["idempotent"] is True
+    assert durable_row(runtime)[1] == 1
+
+
+def test_update_lease_keeps_expiry_without_optional_argument_and_keeps_cas(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    controller = create_durable_lease(runtime)
+
+    controller.update_lease(
+        "writer-lease-recovery",
+        expected_revision=0,
+        current_head_oid=BASE,
+        generation=1,
+    )
+    assert durable_row(runtime) == ("2020-01-01T00:00:00+00:00", 1)
+    with pytest.raises(JobError, match="LEASE_REVISION_CAS_CONFLICT"):
+        controller.update_lease(
+            "writer-lease-recovery",
+            expected_revision=0,
+            current_head_oid=BASE,
+            generation=1,
+        )
+
+
+def test_two_runtime_connections_resolve_renewal_cas_race_idempotently(tmp_path: Path) -> None:
+    first = make_runtime(tmp_path)
+    first_controller = create_durable_lease(first)
+    second = make_runtime(tmp_path)
+    second_controller = GitOpsJobController(
+        JobStore(second._job_root(TASK_ID), payload_root=second._job_root(TASK_ID) / "payloads")
+    )
+    second.controllers[TASK_ID] = second_controller
+    gate = threading.Barrier(2)
+
+    def gate_update(controller: GitOpsJobController) -> None:
+        original = controller.update_lease
+
+        def update(*args: object, **kwargs: object) -> None:
+            gate.wait(timeout=5)
+            original(*args, **kwargs)
+
+        controller.update_lease = update
+
+    gate_update(first_controller)
+    gate_update(second_controller)
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        results = list(pool.map(lambda runtime: runtime.renew_writer_lease(writer_request()), (first, second)))
+
+    assert sorted((item["recovered"], item["idempotent"]) for item in results) == [
+        (False, True),
+        (True, False),
+    ]
+    assert durable_row(first)[1] == 1
+
+
+def test_bootstrap_preserves_exact_governed_job_lineage(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+
+    response = runtime.bootstrap_writer_lease(writer_request())
+    binding, _, _ = runtime.runtimes[(TASK_ID, 1)]
+
+    assert response["job_id"] == expected_job_id
+    assert binding.job_id == expected_job_id
+    assert binding.request.job_id == expected_job_id
+
+
+def test_restart_rehydrate_preserves_exact_governed_job_lineage(tmp_path: Path) -> None:
+    first = make_runtime(tmp_path)
+    expected_job_id = first.bindings[TASK_ID]["job_id"]
+    first.acquire_lease(writer_request())
+
+    runtime = make_runtime(tmp_path)
+    assert runtime is not first
+    assert runtime.runtimes == {}
+    response = runtime.bootstrap_writer_lease(writer_request())
+    binding, _, _ = runtime.runtimes[(TASK_ID, 1)]
+
+    assert response["job_id"] == expected_job_id
+    assert binding.job_id == expected_job_id
+    assert binding.request.job_id == expected_job_id
+
+
+def test_wrong_governed_job_id_is_denied_before_runtime_or_lease_side_effect(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    with pytest.raises(RuntimeError, match="LEASE_BINDING_CONFLICT"):
+        runtime.bootstrap_writer_lease(writer_request(job_id="job-wrong-lineage"))
+
+    assert runtime.runtimes == {}
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        assert connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0] == 0
+        assert connection.execute("PRAGMA foreign_key_check(branch_leases)").fetchall() == []
+
+
+def test_acquire_creates_exact_governed_writer_lease_with_fk_and_cas(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+
+    response = runtime.acquire_lease(writer_request())
+
+    assert response["job_id"] == expected_job_id
+    assert response["durable_branch_lease_present"] is True
+    assert response["idempotent"] is False
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        foreign_keys = connection.execute(
+            "PRAGMA foreign_key_list(branch_leases)"
+        ).fetchall()
+        row = connection.execute(
+            "SELECT job_id,branch,lineage_anchor_oid,current_head_oid,generation,state,revision "
+            "FROM branch_leases"
+        ).fetchone()
+        job = connection.execute(
+            "SELECT state,side_effect_state,revision FROM jobs WHERE job_id=?",
+            (expected_job_id,),
+        ).fetchone()
+        assert connection.execute("PRAGMA foreign_key_check(branch_leases)").fetchall() == []
+    assert any(
+        fk[2] == "jobs" and fk[3] == "job_id" and fk[4] == "job_id"
+        for fk in foreign_keys
+    )
+    assert row == (expected_job_id, BRANCH, BASE, BASE, 1, "ACTIVE", 0)
+    assert job == ("LEASED", "LEASED", 2)
+
+
+def test_duplicate_acquire_observes_same_durable_writer_lease(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+
+    first = runtime.acquire_lease(writer_request())
+    second = runtime.acquire_lease(writer_request())
+
+    assert first["job_id"] == expected_job_id
+    assert second["job_id"] == expected_job_id
+    assert second["idempotent"] is True
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        leases = connection.execute(
+            "SELECT lease_id,job_id,revision FROM branch_leases"
+        ).fetchall()
+        job = connection.execute(
+            "SELECT state,revision FROM jobs WHERE job_id=?",
+            (expected_job_id,),
+        ).fetchone()
+    assert leases == [("lease-" + expected_job_id, expected_job_id, 0)]
+    assert job == ("LEASED", 2)
+
+
+def test_wrong_job_acquire_is_denied_before_authorize_or_lease(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+
+    with pytest.raises(RuntimeError, match="LEASE_BINDING_CONFLICT"):
+        runtime.acquire_lease(writer_request(job_id="job-wrong-lineage"))
+
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        job = connection.execute(
+            "SELECT state,side_effect_state,revision FROM jobs WHERE job_id=?",
+            (expected_job_id,),
+        ).fetchone()
+        lease_count = connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0]
+    assert job == ("REQUESTED", "NONE", 0)
+    assert lease_count == 0
+
+
+def test_omitted_request_job_id_resolves_the_exact_durable_parent(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+    raw = dict(writer_request())
+
+    response = runtime.acquire_lease(raw)
+    binding, _, _ = runtime.runtimes[(TASK_ID, 1)]
+
+    assert response["job_id"] == expected_job_id
+    assert binding.job_id == expected_job_id
+    assert binding.request.job_id == expected_job_id
+
+
+def test_durable_job_expected_head_mismatch_is_denied(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+    controller = runtime.controllers[TASK_ID]
+    with controller.store._connect() as connection:
+        row = connection.execute(
+            "SELECT request_json FROM jobs WHERE job_id=?", (expected_job_id,)
+        ).fetchone()
+        request = json.loads(row[0])
+        request["expected_branch_oid"] = "c" * 40
+        request["binding"]["expected_branch_oid"] = "c" * 40
+        connection.execute(
+            "UPDATE jobs SET request_json=? WHERE job_id=?",
+            (json.dumps(request, sort_keys=True, separators=(",", ":")), expected_job_id),
+        )
+        connection.commit()
+
+    with pytest.raises(RuntimeError, match="RUNTIME_GOVERNED_JOB_UNRESOLVED"):
+        runtime.bootstrap_writer_lease(writer_request())
+
+    assert runtime.runtimes == {}
+
+
+def _commit_ready_runtime(tmp_path: Path):
+    runtime = make_runtime(tmp_path)
+    runtime.bootstrap_writer_lease(writer_request())
+    binding, controller, _ = runtime.runtimes[(TASK_ID, 1)]
+
+    class Workspace:
+        def materialize_files(self, _files):
+            return None
+
+    class Executor:
+        def __init__(self):
+            self.workspace = Workspace()
+            self.calls = 0
+
+        def execute(self, _binding, _commit, *, before_complete=None):
+            self.calls += 1
+            result = {
+                "job_id": binding.job_id,
+                "state": "COMPLETED",
+                "side_effect_state": "REMOTE_VERIFIED",
+                "receipt": {
+                    "authority_oid": "b" * 40,
+                    "git_remote_oid": "b" * 40,
+                    "api_branch_oid": "b" * 40,
+                    "commit_visible": True,
+                    "remote_verified": True,
+                    "force_push": False,
+                },
+            }
+            if before_complete is not None:
+                before_complete("b" * 40)
+            return result
+
+    executor = Executor()
+    runtime.runtimes[(TASK_ID, 1)] = (binding, controller, executor)
+    runtime.acquire_lease(writer_request())
+    return runtime, binding, controller, executor
+
+
+def _commit_request():
+    return {
+        "task_id": TASK_ID,
+        "repository": "aios/aios",
+        "generation": 1,
+        "target_branch": BRANCH,
+        "expected_branch_oid": BASE,
+        "idempotency_key": "commit-cas-test-v1",
+        "path": "docs/cas.txt",
+        "content_base64": "YQ==",
+        "message": "test commit cas",
+    }
+
+
+def test_commit_lease_revision_cas_conflict_is_preserved(tmp_path: Path) -> None:
+    runtime, _binding, controller, _executor = _commit_ready_runtime(tmp_path)
+
+    def conflict(*_args, **_kwargs):
+        raise JobError("LEASE_REVISION_CAS_CONFLICT")
+
+    controller.update_lease = conflict
+    with pytest.raises(RuntimeError, match="LEASE_CAS_CONFLICT"):
+        runtime.commit_files(_commit_request())
+
+
+def test_commit_divergent_durable_head_fails_before_executor(tmp_path: Path) -> None:
+    runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
+    controller.update_lease(
+        "lease-" + binding.job_id,
+        expected_revision=0,
+        current_head_oid="c" * 40,
+        generation=1,
+    )
+
+    with pytest.raises(RuntimeError, match="LEASE_HEAD_RECONCILIATION_REQUIRED"):
+        runtime.commit_files(_commit_request())
+    assert executor.calls == 0
+
+
+def test_remote_pending_never_advances_durable_head(tmp_path: Path) -> None:
+    runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
+
+    def pending(_binding, _commit, **_kwargs):
+        executor.calls += 1
+        return {
+            "job_id": binding.job_id,
+            "state": "RECONCILIATION_REQUIRED",
+            "side_effect_state": "REMOTE_PUSH_PENDING",
+            "receipt": {
+                "authority_oid": "b" * 40,
+                "desired_remote_oid": "b" * 40,
+                "remote_verified": False,
+            },
+        }
+
+    executor.execute = pending
+    with pytest.raises(RuntimeError, match="RECONCILIATION_REQUIRED"):
+        runtime.commit_files(_commit_request())
+    with controller.store._connect() as connection:
+        row = connection.execute(
+            "SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?",
+            ("lease-" + binding.job_id,),
+        ).fetchone()
+    assert tuple(row) == (BASE, 0)
+
+
+def test_retry_accepts_exact_head_already_advanced_at_remote_verified_boundary(tmp_path: Path) -> None:
+    runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
+    commit_oid = "b" * 40
+    controller.update_lease(
+        "lease-" + binding.job_id,
+        expected_revision=0,
+        current_head_oid=commit_oid,
+        generation=1,
+    )
+    receipt = {
+        "authority_oid": commit_oid,
+        "git_remote_oid": commit_oid,
+        "api_branch_oid": commit_oid,
+        "commit_visible": True,
+        "remote_verified": True,
+        "force_push": False,
+    }
+    with controller.store._connect() as connection:
+        connection.execute(
+            "UPDATE jobs SET state='REMOTE_VERIFIED',side_effect_state='REMOTE_VERIFIED',"
+            "receipt_json=? WHERE job_id=?",
+            (json.dumps(receipt, sort_keys=True, separators=(",", ":")), binding.job_id),
+        )
+        connection.commit()
+
+    result = runtime.commit_files(_commit_request())
+
+    assert result["commit_oid"] == commit_oid
+    assert executor.calls == 1
+    with controller.store._connect() as connection:
+        row = connection.execute(
+            "SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?",
+            ("lease-" + binding.job_id,),
+        ).fetchone()
+    assert tuple(row) == (commit_oid, 1)
+
+
+def test_completed_response_with_invalid_oid_uses_canonical_oid_error(tmp_path: Path) -> None:
+    runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
+
+    def invalid_oid(_binding, _commit, **_kwargs):
+        executor.calls += 1
+        return {
+            "job_id": binding.job_id,
+            "state": "COMPLETED",
+            "side_effect_state": "REMOTE_VERIFIED",
+            "receipt": {
+                "authority_oid": "not-an-oid",
+                "commit_visible": True,
+                "remote_verified": True,
+            },
+        }
+
+    executor.execute = invalid_oid
+    with pytest.raises(RuntimeError, match="GOVERNED_COMMIT_OID_INVALID"):
+        runtime.commit_files(_commit_request())
+    with controller.store._connect() as connection:
+        row = connection.execute(
+            "SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?",
+            ("lease-" + binding.job_id,),
+        ).fetchone()
+    assert tuple(row) == (BASE, 0)
+
+
+def test_acquire_renews_an_expired_matching_durable_lease_with_revision_cas(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    create_durable_lease(runtime)
+    runtime.runtimes.clear()
+
+    result = runtime.acquire_lease(writer_request())
+
+    expires_at, revision = durable_row(runtime)
+    assert result["recovered"] is True
+    assert result["runtime_rehydrated"] is False
+    assert result["durable_branch_lease_present"] is True
+    assert revision == 1
+    assert datetime.fromisoformat(expires_at) > datetime.now(timezone.utc)
+
+
+def test_authority_recovers_only_clean_detached_single_attempt_worktree(tmp_path: Path) -> None:
+    import subprocess
+    from aios_authority_git_executor import AuthorityGitExecutor
+
+    bare = tmp_path / "authority.git"
+    seed = tmp_path / "seed"
+    subprocess.run(["git", "init", "--bare", str(bare)], check=True, capture_output=True)
+    subprocess.run(["git", "init", str(seed)], check=True, capture_output=True)
+    (seed / "base.txt").write_text("base\n", encoding="utf-8")
+    subprocess.run(["git", "-C", str(seed), "add", "base.txt"], check=True)
+    subprocess.run(
+        ["git", "-C", str(seed), "-c", "user.name=test", "-c", "user.email=test@example.invalid",
+         "commit", "-m", "base"], check=True, capture_output=True,
+    )
+    base = subprocess.check_output(["git", "-C", str(seed), "rev-parse", "HEAD"], text=True).strip()
+    subprocess.run(["git", "-C", str(seed), "push", str(bare), "HEAD:refs/heads/main"], check=True, capture_output=True)
+    root = tmp_path / "worktrees"
+    authority = AuthorityGitExecutor(bare, root)
+    worktree = authority.create_detached_worktree(base, "task")
+    (worktree / "attempt.txt").write_text("attempt\n", encoding="utf-8")
+    subprocess.run(["git", "-C", str(worktree), "add", "attempt.txt"], check=True)
+    subprocess.run(
+        ["git", "-C", str(worktree), "-c", "user.name=test", "-c", "user.email=test@example.invalid",
+         "commit", "-m", "failed attempt"], check=True, capture_output=True,
+    )
+    stale = subprocess.check_output(["git", "-C", str(worktree), "rev-parse", "HEAD"], text=True).strip()
+
+    recovered = authority.recover_failed_detached_worktree_exact(
+        path=worktree,
+        expected_oid=base,
+        stale_oid=stale,
+        target_ref="refs/heads/agent/recovery-test",
+    )
+
+    assert recovered == stale
+    assert subprocess.check_output(["git", "-C", str(worktree), "rev-parse", "HEAD"], text=True).strip() == base
+    assert subprocess.run(["git", "-C", str(worktree), "symbolic-ref", "-q", "HEAD"]).returncode == 1
+    assert subprocess.check_output(["git", "-C", str(worktree), "status", "--porcelain"], text=True) == ""

tools/fix_reanchor_import_order.py

@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import ast
+import pathlib
+import shutil
+import sys
+from datetime import datetime, timezone
+
+UTC = timezone.utc
+
+def die(msg: str) -> None:
+    print(f"ERROR: {msg}", file=sys.stderr)
+    raise SystemExit(2)
+
+def backup(path: pathlib.Path) -> pathlib.Path:
+    stamp = datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ")
+    out = path.with_name(path.name + f".bak.{stamp}")
+    shutil.copy2(path, out)
+    return out
+
+def main() -> int:
+    ap = argparse.ArgumentParser(
+        description="Repair misplaced subprocess import in execution-rebind runtime."
+    )
+    ap.add_argument("--rebind", required=True)
+    args = ap.parse_args()
+    path = pathlib.Path(args.rebind).resolve()
+    if not path.is_file():
+        die(f"missing rebind source: {path}")
+
+    text = path.read_text(encoding="utf-8")
+    marker = "from __future__ import annotations\n"
+    if marker not in text:
+        die("future import marker missing")
+
+    lines = text.splitlines(keepends=True)
+    filtered = [line for line in lines if line.strip() != "import subprocess"]
+    text2 = "".join(filtered)
+
+    future_index = text2.find(marker)
+    if future_index < 0:
+        die("future import marker missing after normalization")
+
+    insert_at = future_index + len(marker)
+    normalized = text2[:insert_at] + "\nimport subprocess\n" + text2[insert_at:]
+
+    if normalized == text:
+        print("OK import order already normalized")
+    else:
+        b = backup(path)
+        path.write_text(normalized, encoding="utf-8")
+        print(f"PATCHED import order; backup={b}")
+
+    ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+    print(f"OK syntax: {path}")
+
+    current = path.read_text(encoding="utf-8")
+    required_markers = (
+        "EXECUTION_REBIND_NON_FAST_FORWARD_DENY",
+        "old_expected_branch_oid",
+        "new_expected_branch_oid",
+    )
+    missing = [m for m in required_markers if m not in current]
+    if missing:
+        die("re-anchor patch markers missing: " + ",".join(missing))
+
+    print("RESULT: IMPORT_ORDER_REPAIRED")
+    return 0
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tools/repair_execution_reanchor.py

@@ -0,0 +1,172 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import ast
+from datetime import datetime, timezone
+import pathlib
+import shutil
+import sys
+
+UTC = timezone.utc
+
+def die(msg: str) -> None:
+    print(f"ERROR: {msg}", file=sys.stderr)
+    raise SystemExit(2)
+
+def backup(path: pathlib.Path) -> pathlib.Path:
+    stamp = datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ")
+    out = path.with_name(path.name + f".bak.{stamp}")
+    shutil.copy2(path, out)
+    return out
+
+def ensure_import(path: pathlib.Path, import_line: str) -> None:
+    text = path.read_text(encoding="utf-8")
+    if import_line + "\n" in text:
+        return
+    lines = text.splitlines(keepends=True)
+    at = 0
+    if lines and lines[0].startswith("#!"):
+        at = 1
+    if at < len(lines) and lines[at].startswith("from __future__ import"):
+        at += 1
+    lines.insert(at, import_line + "\n")
+    path.write_text("".join(lines), encoding="utf-8")
+
+def replace_once(path: pathlib.Path, old: str, new: str, label: str) -> None:
+    text = path.read_text(encoding="utf-8")
+    if new in text:
+        print(f"OK already patched: {label}")
+        return
+    count = text.count(old)
+    if count != 1:
+        die(f"{label}: expected exactly one match, found {count}")
+    b = backup(path)
+    path.write_text(text.replace(old, new, 1), encoding="utf-8")
+    print(f"PATCHED {label}; backup={b}")
+
+def syntax_check(path: pathlib.Path) -> None:
+    ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+    print(f"OK syntax: {path}")
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description="Add guarded same-job execution re-anchor support.")
+    ap.add_argument("--rebind", required=True)
+    args = ap.parse_args()
+    path = pathlib.Path(args.rebind).resolve()
+    if not path.is_file():
+        die(f"missing rebind source: {path}")
+
+    ensure_import(path, "import subprocess")
+
+    old = '''        binding = GovernedExecutionBinding.from_mapping(old_execution)
+        resolved = dict(self.resolver(task_id, capabilities))
+        new_execution = validate_execution_envelope(resolved, binding=binding)
+        if new_execution.get("action") != "deterministic":
+            raise ExecutionRebindError("EXECUTION_REBIND_DETERMINISTIC_PLAN_REQUIRED", 409)
+        if new_execution["execution_digest"] != request.expected_new_execution_digest:
+            raise ExecutionRebindError("EXECUTION_REBIND_NEW_DIGEST_DRIFT", 409)
+        if new_execution["execution_digest"] == old_execution["execution_digest"]:
+            raise ExecutionRebindError("EXECUTION_REBIND_DIGEST_UNCHANGED", 409)
+'''
+    new = '''        binding = GovernedExecutionBinding.from_mapping(old_execution)
+        resolved = dict(self.resolver(task_id, capabilities))
+        candidate_binding = GovernedExecutionBinding.from_mapping(resolved)
+
+        # Same-job continuation may advance only the branch head (and may
+        # transition CREATE_NEW -> CONTINUE_EXISTING after the branch exists).
+        immutable_fields = (
+            "task_id",
+            "job_id",
+            "repository",
+            "base_oid",
+            "target_branch",
+            "generation",
+            "idempotency_key",
+        )
+        for field in immutable_fields:
+            if getattr(candidate_binding, field) != getattr(binding, field):
+                raise ExecutionRebindError("EXECUTION_REBIND_BINDING_CONFLICT", 409)
+
+        head_advanced = candidate_binding.expected_branch_oid != binding.expected_branch_oid
+        if head_advanced:
+            allowed_modes = {
+                (binding.branch_mode, binding.branch_mode),
+                ("CREATE_NEW", "CONTINUE_EXISTING"),
+            }
+            if (binding.branch_mode, candidate_binding.branch_mode) not in allowed_modes:
+                raise ExecutionRebindError("EXECUTION_REBIND_BRANCH_MODE_CONFLICT", 409)
+
+            authority_git_dir = "/data/aios-gitops/repo.git"
+            authority_ref = f"refs/heads/{binding.target_branch}"
+            try:
+                authority_head = subprocess.check_output(
+                    [
+                        "/usr/bin/git",
+                        f"--git-dir={authority_git_dir}",
+                        "rev-parse",
+                        authority_ref,
+                    ],
+                    text=True,
+                    timeout=5,
+                ).strip()
+                ancestry = subprocess.run(
+                    [
+                        "/usr/bin/git",
+                        f"--git-dir={authority_git_dir}",
+                        "merge-base",
+                        "--is-ancestor",
+                        binding.expected_branch_oid,
+                        candidate_binding.expected_branch_oid,
+                    ],
+                    stdout=subprocess.DEVNULL,
+                    stderr=subprocess.DEVNULL,
+                    timeout=5,
+                    check=False,
+                )
+            except (OSError, subprocess.SubprocessError) as exc:
+                raise ExecutionRebindError("EXECUTION_REBIND_AUTHORITY_GIT_UNAVAILABLE", 503) from exc
+
+            if authority_head != candidate_binding.expected_branch_oid:
+                raise ExecutionRebindError("EXECUTION_REBIND_CURRENT_HEAD_MISMATCH", 409)
+            if ancestry.returncode != 0:
+                raise ExecutionRebindError("EXECUTION_REBIND_NON_FAST_FORWARD_DENY", 409)
+        elif candidate_binding.branch_mode != binding.branch_mode:
+            raise ExecutionRebindError("EXECUTION_REBIND_BRANCH_MODE_CONFLICT", 409)
+
+        # Validate the canonical envelope on its own after the continuation
+        # binding proof above. Worker-side strict equality remains unchanged.
+        new_execution = validate_execution_envelope(resolved)
+
+        # Re-anchor may legitimately remain source_capture when no deterministic
+        # plan is registered yet. A non-head-changing rebind must still advance
+        # source_capture -> deterministic.
+        if new_execution.get("action") not in {"source_capture", "deterministic"}:
+            raise ExecutionRebindError("EXECUTION_REBIND_ACTION_INVALID", 409)
+        if not head_advanced and new_execution.get("action") != "deterministic":
+            raise ExecutionRebindError("EXECUTION_REBIND_DETERMINISTIC_PLAN_REQUIRED", 409)
+        if new_execution["execution_digest"] != request.expected_new_execution_digest:
+            raise ExecutionRebindError("EXECUTION_REBIND_NEW_DIGEST_DRIFT", 409)
+        if new_execution["execution_digest"] == old_execution["execution_digest"]:
+            raise ExecutionRebindError("EXECUTION_REBIND_DIGEST_UNCHANGED", 409)
+'''
+    replace_once(path, old, new, "same-job fast-forward execution re-anchor")
+
+    old_event = '''                "old_action": old_execution.get("action"),
+                "new_action": new_execution.get("action"),
+                "previous_revision": request.expected_revision,
+'''
+    new_event = '''                "old_action": old_execution.get("action"),
+                "new_action": new_execution.get("action"),
+                "old_expected_branch_oid": binding.expected_branch_oid,
+                "new_expected_branch_oid": candidate_binding.expected_branch_oid,
+                "head_advanced": head_advanced,
+                "previous_revision": request.expected_revision,
+'''
+    replace_once(path, old_event, new_event, "re-anchor audit evidence")
+    syntax_check(path)
+    print("RESULT: PATCH_OK")
+    return 0
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tools/repair_loaded_governed_runtime.py

@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import ast
+from datetime import datetime, timezone
+import pathlib
+import shutil
+import sys
+
+UTC = timezone.utc
+
+def die(msg: str) -> None:
+    print(f"ERROR: {msg}", file=sys.stderr)
+    raise SystemExit(2)
+
+def backup(path: pathlib.Path) -> pathlib.Path:
+    stamp = datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ")
+    out = path.with_name(path.name + f".bak.{stamp}")
+    shutil.copy2(path, out)
+    return out
+
+def ensure_datetime_import(path: pathlib.Path) -> bool:
+    text = path.read_text(encoding="utf-8")
+    target = "from datetime import datetime, timezone\n"
+    if target in text:
+        return False
+    lines = text.splitlines(keepends=True)
+    at = 0
+    if lines and lines[0].startswith("#!"):
+        at = 1
+    if at < len(lines) and lines[at].startswith("from __future__ import"):
+        at += 1
+    b = backup(path)
+    lines.insert(at, target)
+    path.write_text("".join(lines), encoding="utf-8")
+    print(f"PATCHED datetime import: {path}; backup={b}")
+    return True
+
+def replace_once(path: pathlib.Path, old: str, new: str, label: str) -> bool:
+    text = path.read_text(encoding="utf-8")
+    if new in text:
+        print(f"OK already patched: {label}: {path}")
+        return False
+    n = text.count(old)
+    if n != 1:
+        die(f"{label}: expected exactly 1 match, found {n}: {path}")
+    b = backup(path)
+    path.write_text(text.replace(old, new, 1), encoding="utf-8")
+    print(f"PATCHED {label}: {path}; backup={b}")
+    return True
+
+def syntax_check(path: pathlib.Path) -> None:
+    ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+    print(f"OK syntax: {path}")
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--rebind", required=True)
+    ap.add_argument("--worker", required=True)
+    ap.add_argument("--bridge", required=True)
+    args = ap.parse_args()
+
+    rebind = pathlib.Path(args.rebind).resolve()
+    worker = pathlib.Path(args.worker).resolve()
+    bridge = pathlib.Path(args.bridge).resolve()
+    for p in (rebind, worker, bridge):
+        if not p.is_file():
+            die(f"missing file: {p}")
+
+    old_rebind = '''        if task["lease_token_hash"] not in (None, "") or task["lease_expires_at"] not in (None, ""):
+            raise ExecutionRebindError("EXECUTION_REBIND_ACTIVE_LEASE_DENY", 409)
+'''
+    new_rebind = '''        # A persisted lease token is not by itself proof of an active lease.
+        lease_expires_at = task["lease_expires_at"]
+        if lease_expires_at not in (None, ""):
+            try:
+                parsed_lease_expires_at = datetime.fromisoformat(
+                    str(lease_expires_at).replace("Z", "+00:00")
+                ).astimezone(timezone.utc)
+            except (TypeError, ValueError) as exc:
+                raise ExecutionRebindError("EXECUTION_REBIND_LEASE_EXPIRY_INVALID", 409) from exc
+            if parsed_lease_expires_at > datetime.now(timezone.utc):
+                raise ExecutionRebindError("EXECUTION_REBIND_ACTIVE_LEASE_DENY", 409)
+'''
+
+    old_worker = '''    active = [
+        item for item in leases
+        if isinstance(item, Mapping)
+        and item.get("state") == "ACTIVE"
+        and item.get("job_id") == envelope.job_id
+        and item.get("branch") == envelope.target_branch
+    ]
+'''
+    new_worker = '''    now = datetime.now(timezone.utc)
+    active = []
+    for item in leases:
+        if (
+            not isinstance(item, Mapping)
+            or item.get("state") != "ACTIVE"
+            or item.get("job_id") != envelope.job_id
+            or item.get("branch") != envelope.target_branch
+        ):
+            continue
+        try:
+            expires_at = datetime.fromisoformat(
+                str(item.get("lease_expires_at") or "").replace("Z", "+00:00")
+            ).astimezone(timezone.utc)
+        except (TypeError, ValueError):
+            continue
+        if expires_at > now:
+            active.append(item)
+'''
+
+    old_bridge = '''            if durable_expires_at <= datetime.now(timezone.utc):
+                return self.renew_writer_lease(request)
+'''
+    new_bridge = '''            # Expired durable lease is recoverable on the same task/job/generation.
+            if durable_expires_at <= datetime.now(timezone.utc):
+                return self.renew_writer_lease(request)
+'''
+
+    changed = []
+    for p in (rebind, worker):
+        if ensure_datetime_import(p):
+            changed.append(p)
+    if replace_once(rebind, old_rebind, new_rebind, "execution-rebind effective lease expiry"):
+        changed.append(rebind)
+    if replace_once(worker, old_worker, new_worker, "worker effective lease expiry"):
+        changed.append(worker)
+    if replace_once(bridge, old_bridge, new_bridge, "bridge actual-runtime marker"):
+        changed.append(bridge)
+
+    for p in (rebind, worker, bridge):
+        syntax_check(p)
+    print("RESULT: PATCH_OK")
+    print("CHANGED:", ",".join(dict.fromkeys(str(p) for p in changed)) if changed else "none")
+    return 0
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tools/repair_preclaim_rebind_attempt.py

@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import ast
+from datetime import datetime, timezone
+import pathlib
+import shutil
+import sys
+
+UTC = timezone.utc
+
+def die(msg: str) -> None:
+    print(f"ERROR: {msg}", file=sys.stderr)
+    raise SystemExit(2)
+
+def backup(path: pathlib.Path) -> pathlib.Path:
+    stamp = datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ")
+    out = path.with_name(path.name + f".bak.{stamp}")
+    shutil.copy2(path, out)
+    return out
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description="Allow pre-claim execution rebind at attempt=0.")
+    ap.add_argument("--rebind", required=True)
+    args = ap.parse_args()
+
+    path = pathlib.Path(args.rebind).resolve()
+    if not path.is_file():
+        die(f"missing rebind source: {path}")
+
+    text = path.read_text(encoding="utf-8")
+    old = "            or attempt < 1\n"
+    new = "            or attempt < 0\n"
+
+    if new in text:
+        print("OK already patched: pre-claim attempt=0")
+    else:
+        count = text.count(old)
+        if count != 1:
+            die(f"expected exactly one attempt<1 guard, found {count}")
+        b = backup(path)
+        path.write_text(text.replace(old, new, 1), encoding="utf-8")
+        print(f"PATCHED pre-claim attempt=0; backup={b}")
+
+    ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+
+    current = path.read_text(encoding="utf-8")
+    for marker in (
+        "or attempt < 0",
+        "EXECUTION_REBIND_NON_FAST_FORWARD_DENY",
+        "old_expected_branch_oid",
+        "new_expected_branch_oid",
+    ):
+        if marker not in current:
+            die(f"required marker missing: {marker}")
+
+    print(f"OK syntax: {path}")
+    print("RESULT: PRECLAIM_REBIND_PATCH_OK")
+    return 0
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tools/repair_stale_governed_lease.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import ast
+import datetime as dt
+import pathlib
+import shutil
+import sys
+
+UTC = dt.timezone.utc
+
+def die(msg: str) -> None:
+    print(f"ERROR: {msg}", file=sys.stderr)
+    raise SystemExit(2)
+
+def backup(path: pathlib.Path) -> pathlib.Path:
+    stamp = dt.datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ")
+    out = path.with_suffix(path.suffix + f".bak.{stamp}")
+    shutil.copy2(path, out)
+    return out
+
+def replace_once(path: pathlib.Path, old: str, new: str, label: str) -> bool:
+    text = path.read_text(encoding="utf-8")
+    if new in text:
+        print(f"OK already patched: {label}")
+        return False
+    count = text.count(old)
+    if count != 1:
+        die(f"{label}: expected exactly 1 match, found {count} in {path}")
+    backup_path = backup(path)
+    path.write_text(text.replace(old, new, 1), encoding="utf-8")
+    print(f"PATCHED {label}; backup={backup_path}")
+    return True
+
+def ensure_datetime_import(path: pathlib.Path) -> bool:
+    text = path.read_text(encoding="utf-8")
+    target = "from datetime import datetime, timezone\n"
+    if target in text:
+        return False
+    lines = text.splitlines(keepends=True)
+    insert_at = 0
+    if lines and lines[0].startswith("#!"):
+        insert_at = 1
+    if insert_at < len(lines) and lines[insert_at].startswith("from __future__ import"):
+        insert_at += 1
+    lines.insert(insert_at, target)
+    backup_path = backup(path)
+    path.write_text("".join(lines), encoding="utf-8")
+    print(f"PATCHED datetime import: {path}; backup={backup_path}")
+    return True
+
+def syntax_check(path: pathlib.Path) -> None:
+    ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+    print(f"OK syntax: {path}")
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description="Repair stale governed writer lease handling.")
+    ap.add_argument("--app-dir", default="/opt/aios/current/active-runtime/app")
+    args = ap.parse_args()
+    app = pathlib.Path(args.app_dir)
+
+    rebind = app / "aios_agent_task_execution_rebind.py"
+    worker = app / "aios_online_agent_worker.py"
+    bridge = app / "aios_chatgpt_bridge_v2_server.py"
+    for p in (rebind, worker, bridge):
+        if not p.is_file():
+            die(f"missing file: {p}")
+
+    old_rebind = '''        if task["lease_token_hash"] not in (None, "") or task["lease_expires_at"] not in (None, ""):
+            raise ExecutionRebindError("EXECUTION_REBIND_ACTIVE_LEASE_DENY", 409)
+'''
+    new_rebind = '''        # A persisted lease token is not by itself proof of an active lease.
+        # Treat an unexpired lease as active; stale lease projection is recoverable.
+        lease_expires_at = task["lease_expires_at"]
+        if lease_expires_at not in (None, ""):
+            try:
+                parsed_lease_expires_at = datetime.fromisoformat(
+                    str(lease_expires_at).replace("Z", "+00:00")
+                ).astimezone(timezone.utc)
+            except (TypeError, ValueError) as exc:
+                raise ExecutionRebindError("EXECUTION_REBIND_LEASE_EXPIRY_INVALID", 409) from exc
+            if parsed_lease_expires_at > datetime.now(timezone.utc):
+                raise ExecutionRebindError("EXECUTION_REBIND_ACTIVE_LEASE_DENY", 409)
+'''
+
+    old_worker = '''    active = [
+        item for item in leases
+        if isinstance(item, Mapping)
+        and item.get("state") == "ACTIVE"
+        and item.get("job_id") == envelope.job_id
+        and item.get("branch") == envelope.target_branch
+    ]
+'''
+    new_worker = '''    now = datetime.now(timezone.utc)
+    active = []
+    for item in leases:
+        if (
+            not isinstance(item, Mapping)
+            or item.get("state") != "ACTIVE"
+            or item.get("job_id") != envelope.job_id
+            or item.get("branch") != envelope.target_branch
+        ):
+            continue
+        try:
+            expires_at = datetime.fromisoformat(
+                str(item.get("lease_expires_at") or "").replace("Z", "+00:00")
+            ).astimezone(timezone.utc)
+        except (TypeError, ValueError):
+            continue
+        if expires_at > now:
+            active.append(item)
+'''
+
+    old_bridge = '''            if durable_expires_at <= datetime.now(timezone.utc):
+                return self.renew_writer_lease(request)
+'''
+    new_bridge = '''            # An expired durable lease is recoverable on the same governed
+            # task/job/generation. Renew it instead of treating stale ACTIVE state
+            # as a durable-binding failure.
+            if durable_expires_at <= datetime.now(timezone.utc):
+                return self.renew_writer_lease(request)
+'''
+
+    changed = []
+    if ensure_datetime_import(rebind):
+        changed.append(rebind)
+    if ensure_datetime_import(worker):
+        changed.append(worker)
+    if replace_once(rebind, old_rebind, new_rebind, "execution-rebind effective lease expiry"):
+        changed.append(rebind)
+    if replace_once(worker, old_worker, new_worker, "worker converged-job effective lease expiry"):
+        changed.append(worker)
+    if replace_once(bridge, old_bridge, new_bridge, "bridge expired-lease recovery contract"):
+        changed.append(bridge)
+
+    for p in (rebind, worker, bridge):
+        syntax_check(p)
+
+    print("RESULT: PATCH_OK")
+    print("CHANGED:", ",".join(dict.fromkeys(str(p) for p in changed)) if changed else "none")
+    return 0
+
+if __name__ == "__main__":
+    raise SystemExit(main())