fix(online-agent): close automatic execution loop

active-runtime/app/aios_agent_task_retry_extension.py

@@ -0,0 +1,427 @@
+"""Owner-controlled, CAS-bound retry extension for exhausted Online Agent Tasks."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import hashlib
+import hmac
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import json
+import os
+from pathlib import Path
+import re
+import sqlite3
+from typing import Any, Mapping
+
+TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
+KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
+MAX_BODY = 64 * 1024
+AUTHORIZE_EXTENSION_ID_ENV = "AIOS_AGENT_TASK_AUTHORIZATION_ID"
+
+
+class RetryExtensionError(RuntimeError):
+    def __init__(self, code: str, status: int = 409) -> None:
+        super().__init__(code)
+        self.code = code
+        self.status = status
+
+
+def _canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def _sha(value: object) -> str:
+    return hashlib.sha256(_canonical(value)).hexdigest()
+
+
+def _required_authorization_id() -> str:
+    value = os.environ.get(AUTHORIZE_EXTENSION_ID_ENV, "").strip()
+    if not value:
+        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_MISSING")
+    if KEY_RE.fullmatch(value) is None:
+        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_INVALID")
+    return value
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _require_string(value: object, code: str, pattern: re.Pattern[str] | None = None) -> str:
+    if not isinstance(value, str) or not value.strip():
+        raise RetryExtensionError(code, 400)
+    value = value.strip()
+    if pattern is not None and pattern.fullmatch(value) is None:
+        raise RetryExtensionError(code, 400)
+    return value
+
+
+@dataclass(frozen=True)
+class RetryExtensionRequest:
+    expected_status: str
+    expected_revision: int
+    expected_attempt: int
+    expected_max_attempts: int
+    next_max_attempts: int
+    previous_verification_sha256: str
+    authorization_id: str
+    idempotency_key: str
+
+    @classmethod
+    def from_mapping(cls, value: Mapping[str, Any]) -> "RetryExtensionRequest":
+        allowed = {
+            "expected_status", "expected_revision", "expected_attempt", "expected_max_attempts",
+            "next_max_attempts", "previous_verification_sha256", "authorization_id", "idempotency_key",
+        }
+        if set(value) != allowed:
+            raise RetryExtensionError("RETRY_EXTENSION_FIELDS_INVALID", 400)
+        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
+        if status != "FAILED":
+            raise RetryExtensionError("EXPECTED_STATUS_INVALID", 400)
+        ints: dict[str, int] = {}
+        for field in ("expected_revision", "expected_attempt", "expected_max_attempts", "next_max_attempts"):
+            item = value[field]
+            if not isinstance(item, int) or isinstance(item, bool) or item < 0:
+                raise RetryExtensionError("RETRY_EXTENSION_INTEGER_INVALID", 400)
+            ints[field] = item
+        if ints["expected_attempt"] != ints["expected_max_attempts"]:
+            raise RetryExtensionError("RETRY_EXTENSION_NOT_EXHAUSTED", 409)
+        if ints["next_max_attempts"] != ints["expected_max_attempts"] + 1:
+            raise RetryExtensionError("RETRY_EXTENSION_MUST_BE_BOUNDED_ONE_STEP", 400)
+        if ints["next_max_attempts"] > 50:
+            raise RetryExtensionError("RETRY_EXTENSION_LIMIT_EXCEEDED", 400)
+        verification = _require_string(value["previous_verification_sha256"], "VERIFICATION_SHA256_INVALID")
+        if re.fullmatch(r"[0-9a-f]{64}", verification) is None:
+            raise RetryExtensionError("VERIFICATION_SHA256_INVALID", 400)
+        authorization = _require_string(value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE)
+        key = _require_string(value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE)
+        return cls(
+            status,
+            ints["expected_revision"],
+            ints["expected_attempt"],
+            ints["expected_max_attempts"],
+            ints["next_max_attempts"],
+            verification,
+            authorization,
+            key,
+        )
+
+    def public(self) -> dict[str, Any]:
+        return {
+            "expected_status": self.expected_status,
+            "expected_revision": self.expected_revision,
+            "expected_attempt": self.expected_attempt,
+            "expected_max_attempts": self.expected_max_attempts,
+            "next_max_attempts": self.next_max_attempts,
+            "previous_verification_sha256": self.previous_verification_sha256,
+            "authorization_id": self.authorization_id,
+            "idempotency_key": self.idempotency_key,
+        }
+
+
+class RetryExtensionStore:
+    """Owns the official mutation. Direct/manual DB edits remain forbidden."""
+
+    def __init__(self, db_path: Path) -> None:
+        self.db_path = Path(db_path)
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(self.db_path, timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA foreign_keys=ON")
+        connection.execute("PRAGMA busy_timeout=30000")
+        return connection
+
+    @staticmethod
+    def _columns(connection: sqlite3.Connection, table: str) -> dict[str, sqlite3.Row]:
+        return {str(row["name"]): row for row in connection.execute(f'PRAGMA table_info("{table}")')}
+
+    @staticmethod
+    def _event_table(connection: sqlite3.Connection) -> tuple[str, dict[str, sqlite3.Row]]:
+        tables = {
+            row["name"]
+            for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")
+        }
+        for name in ("task_events", "events"):
+            if name not in tables:
+                continue
+            columns = RetryExtensionStore._columns(connection, name)
+            if "task_id" in columns and ("event_type" in columns or "type" in columns):
+                return name, columns
+        raise RetryExtensionError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
+
+    @staticmethod
+    def _verification_hash(raw: object) -> str:
+        if raw in (None, ""):
+            value: object = {}
+        elif isinstance(raw, str):
+            try:
+                value = json.loads(raw)
+            except json.JSONDecodeError as exc:
+                raise RetryExtensionError("TASK_VERIFICATION_INVALID", 409) from exc
+        else:
+            value = raw
+        return _sha(value)
+
+    @staticmethod
+    def _ensure_extension_table(connection: sqlite3.Connection) -> None:
+        connection.execute(
+            """
+            CREATE TABLE IF NOT EXISTS task_retry_extensions (
+              task_id TEXT NOT NULL,
+              idempotency_key TEXT NOT NULL,
+              request_sha256 TEXT NOT NULL,
+              authorization_id TEXT NOT NULL,
+              previous_verification_sha256 TEXT NOT NULL,
+              previous_max_attempts INTEGER NOT NULL,
+              next_max_attempts INTEGER NOT NULL,
+              expected_revision INTEGER NOT NULL,
+              applied_revision INTEGER NOT NULL,
+              created_at TEXT NOT NULL,
+              PRIMARY KEY(task_id, idempotency_key)
+            )
+            """
+        )
+
+    @staticmethod
+    def _insert_event(
+        connection: sqlite3.Connection,
+        task_id: str,
+        payload: Mapping[str, Any],
+    ) -> None:
+        table, columns = RetryExtensionStore._event_table(connection)
+        values: dict[str, Any] = {"task_id": task_id}
+        if "event_type" in columns:
+            values["event_type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
+        else:
+            values["type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
+        payload_text = json.dumps(payload, sort_keys=True, separators=(",", ":"))
+        if "payload_json" in columns:
+            values["payload_json"] = payload_text
+        elif "payload" in columns:
+            values["payload"] = payload_text
+        else:
+            raise RetryExtensionError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
+        if "created_at" in columns:
+            values["created_at"] = _now()
+        if "agent_id" in columns:
+            values["agent_id"] = "owner-control"
+        if "actor_id" in columns:
+            values["actor_id"] = "owner-control"
+        names = list(values)
+        sql = f'INSERT INTO "{table}" ({",".join(f"""\"{name}\"""" for name in names)}) VALUES ({",".join("?" for _ in names)})'
+        connection.execute(sql, tuple(values[name] for name in names))
+
+    def extend(self, task_id: str, request: RetryExtensionRequest) -> dict[str, Any]:
+        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
+        required_authorization_id = _required_authorization_id()
+        if request.authorization_id != required_authorization_id:
+            raise RetryExtensionError("RETRY_EXTENSION_AUTHORIZATION_ID_MISMATCH", 403)
+        request_payload = request.public()
+        request_sha = _sha(request_payload)
+        with self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            self._ensure_extension_table(connection)
+            replay = connection.execute(
+                "SELECT * FROM task_retry_extensions WHERE task_id=? AND idempotency_key=?",
+                (task_id, request.idempotency_key),
+            ).fetchone()
+            if replay is not None:
+                if replay["request_sha256"] != request_sha:
+                    raise RetryExtensionError("RETRY_EXTENSION_IDEMPOTENCY_CONFLICT", 409)
+                connection.commit()
+                return {
+                    "task_id": task_id,
+                    "status": "QUEUED",
+                    "attempt": request.expected_attempt,
+                    "max_attempts": int(replay["next_max_attempts"]),
+                    "revision": int(replay["applied_revision"]),
+                    "idempotent": True,
+                    "authorization_id": replay["authorization_id"],
+                    "previous_verification_sha256": replay["previous_verification_sha256"],
+                }
+
+            columns = self._columns(connection, "tasks")
+            required = {
+                "task_id", "status", "attempt", "max_attempts", "revision", "claimed_by",
+                "lease_token_hash", "lease_expires_at", "verification_json",
+            }
+            if not required.issubset(columns):
+                raise RetryExtensionError("TASK_SCHEMA_RETRY_EXTENSION_UNSUPPORTED", 503)
+            task = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
+            if task is None:
+                raise RetryExtensionError("TASK_NOT_FOUND", 404)
+            actual_verification_sha = self._verification_hash(task["verification_json"])
+            if actual_verification_sha != request.previous_verification_sha256:
+                raise RetryExtensionError("RETRY_EXTENSION_VERIFICATION_DRIFT", 409)
+            if (
+                task["status"] != request.expected_status
+                or int(task["revision"]) != request.expected_revision
+                or int(task["attempt"]) != request.expected_attempt
+                or int(task["max_attempts"]) != request.expected_max_attempts
+            ):
+                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
+            for lease_field in ("lease_token_hash", "lease_expires_at"):
+                if lease_field in columns and task[lease_field] not in (None, ""):
+                    raise RetryExtensionError("RETRY_EXTENSION_ACTIVE_LEASE_DENY", 409)
+
+            previous_claimed_by = task["claimed_by"]
+            applied_revision = request.expected_revision + 1
+            cursor = connection.execute(
+                """
+                UPDATE tasks
+                   SET status='QUEUED', max_attempts=?, revision=?, claimed_by=NULL,
+                       lease_token_hash=NULL, lease_expires_at=NULL
+                 WHERE task_id=? AND status=? AND revision=? AND attempt=? AND max_attempts=?
+                   AND claimed_by IS ?
+                   AND lease_token_hash IS NULL AND lease_expires_at IS NULL
+                """,
+                (
+                    request.next_max_attempts,
+                    applied_revision,
+                    task_id,
+                    request.expected_status,
+                    request.expected_revision,
+                    request.expected_attempt,
+                    request.expected_max_attempts,
+                    previous_claimed_by,
+                ),
+            )
+            if cursor.rowcount != 1:
+                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
+
+            event_payload = {
+                "schema": "aios.task-retry-extension.event.v1",
+                "task_id": task_id,
+                "authorization_id": request.authorization_id,
+                "idempotency_key": request.idempotency_key,
+                "previous_verification_sha256": request.previous_verification_sha256,
+                "previous_max_attempts": request.expected_max_attempts,
+                "next_max_attempts": request.next_max_attempts,
+                "previous_revision": request.expected_revision,
+                "applied_revision": applied_revision,
+                "request_sha256": request_sha,
+                "previous_claimed_by": previous_claimed_by,
+                "stale_terminal_claim_normalized": previous_claimed_by not in (None, ""),
+            }
+            self._insert_event(connection, task_id, event_payload)
+            connection.execute(
+                """
+                INSERT INTO task_retry_extensions(
+                  task_id,idempotency_key,request_sha256,authorization_id,previous_verification_sha256,
+                  previous_max_attempts,next_max_attempts,expected_revision,applied_revision,created_at
+                ) VALUES (?,?,?,?,?,?,?,?,?,?)
+                """,
+                (
+                    task_id,
+                    request.idempotency_key,
+                    request_sha,
+                    request.authorization_id,
+                    request.previous_verification_sha256,
+                    request.expected_max_attempts,
+                    request.next_max_attempts,
+                    request.expected_revision,
+                    applied_revision,
+                    _now(),
+                ),
+            )
+            connection.commit()
+            return {
+                "task_id": task_id,
+                "status": "QUEUED",
+                "attempt": request.expected_attempt,
+                "max_attempts": request.next_max_attempts,
+                "revision": applied_revision,
+                "idempotent": False,
+                "authorization_id": request.authorization_id,
+                "previous_verification_sha256": request.previous_verification_sha256,
+            }
+
+
+class RetryExtensionHandler(BaseHTTPRequestHandler):
+    store: RetryExtensionStore | None = None
+    control_token: str = ""
+
+    def log_message(self, *_args: Any) -> None:
+        return
+
+    def _json(self, value: Mapping[str, Any], status: int) -> None:
+        data = json.dumps(dict(value), sort_keys=True, separators=(",", ":")).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def _authorized(self) -> bool:
+        header = self.headers.get("Authorization", "")
+        return (
+            header.startswith("Bearer ")
+            and bool(self.control_token)
+            and hmac.compare_digest(header[7:], self.control_token)
+        )
+
+    def do_GET(self) -> None:
+        if self.path == "/health":
+            self._json({"status": "ok", "service": "aios-agent-task-retry-extension"}, 200)
+        else:
+            self._json({"error": "NOT_FOUND"}, 404)
+
+    def do_POST(self) -> None:
+        match = re.fullmatch(r"/v1/tasks/([^/]+)/retry-extension", self.path)
+        if match is None:
+            self._json({"error": "NOT_FOUND"}, 404)
+            return
+        if not self._authorized():
+            self._json({"error": "UNAUTHORIZED"}, 401)
+            return
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+        except ValueError:
+            self._json({"error": "CONTENT_LENGTH_INVALID"}, 400)
+            return
+        if length < 1 or length > MAX_BODY:
+            self._json({"error": "REQUEST_SIZE_INVALID"}, 413)
+            return
+        try:
+            value = json.loads(self.rfile.read(length).decode("utf-8"))
+            if not isinstance(value, Mapping):
+                raise ValueError
+            request = RetryExtensionRequest.from_mapping(value)
+            if self.store is None:
+                raise RetryExtensionError("RUNTIME_UNAVAILABLE", 503)
+            result = self.store.extend(match.group(1), request)
+            self._json(result, 200 if result["idempotent"] else 201)
+        except RetryExtensionError as exc:
+            self._json({"error": exc.code}, exc.status)
+        except (UnicodeDecodeError, json.JSONDecodeError, ValueError):
+            self._json({"error": "REQUEST_INVALID"}, 400)
+
+
+def load_control_token(path: Path) -> str:
+    if path.is_symlink() or not path.is_file():
+        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_UNAVAILABLE")
+    value = path.read_text(encoding="utf-8").strip()
+    if len(value) < 32:
+        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_INVALID")
+    return value
+
+
+def serve() -> None:
+    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
+    _required_authorization_id()
+    token_path = Path(
+        os.environ.get(
+            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
+            str(Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials")) / "agent_task_control_token"),
+        )
+    )
+    host = os.environ.get("AIOS_TASK_RETRY_HOST", "127.0.0.1")
+    port = int(os.environ.get("AIOS_TASK_RETRY_PORT", "18941"))
+    RetryExtensionHandler.store = RetryExtensionStore(db)
+    RetryExtensionHandler.control_token = load_control_token(token_path)
+    ThreadingHTTPServer((host, port), RetryExtensionHandler).serve_forever()
+
+
+if __name__ == "__main__":
+    serve()

active-runtime/app/aios_chatgpt_bridge_v2.py

@@ -12,6 +12,8 @@ BRIDGE_OPERATIONS = (
     "getRuntimeStatus",
     "getGovernedWriteCapabilities",
     "createGovernedTask",
+    "projectOnlineAgentExecution",
+    "registerOnlineAgentExecutionPlan",
     "acquireWriterLease",
     "bootstrapWriterLease",
     "renewWriterLease",
@@ -32,6 +34,11 @@ BRIDGE_OPERATIONS = (
 
 OPERATION_REQUIRED_FIELDS = {
     "createGovernedTask": ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key"),
+    "projectOnlineAgentExecution": ("task_id",),
+    "registerOnlineAgentExecutionPlan": (
+        "schema", "task_id", "job_id", "source_head_oid", "generation",
+        "idempotency_key", "execution",
+    ),
     "acquireWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
     "bootstrapWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
     "renewWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
@@ -51,6 +58,25 @@ OPERATION_REQUIRED_FIELDS = {
 }
 
 BRIDGE_OPERATION_CONTRACTS = {
+    "projectOnlineAgentExecution": {
+        "method": "POST",
+        "path": "/v2/execution-envelope",
+        "required_fields": OPERATION_REQUIRED_FIELDS["projectOnlineAgentExecution"],
+        "response_fields": (
+            "schema", "task_id", "job_id", "repository", "base_oid",
+            "expected_branch_oid", "target_branch", "branch_mode", "generation",
+            "idempotency_key", "action", "execution_digest",
+        ),
+    },
+    "registerOnlineAgentExecutionPlan": {
+        "method": "POST",
+        "path": "/v2/execution-plan",
+        "required_fields": OPERATION_REQUIRED_FIELDS["registerOnlineAgentExecutionPlan"],
+        "response_fields": (
+            "schema", "task_id", "job_id", "source_head_oid", "generation",
+            "idempotency_key", "plan_digest", "execution", "execution_digest",
+        ),
+    },
     "acquireWriterLease": {
         "method": "POST",
         "path": "/v2/writer-lease",
@@ -205,6 +231,8 @@ class BridgeV2Adapter:
         return handler(dict(request))
 
     def createGovernedTask(self, request: Mapping[str, Any]) -> Any: return self._call("createGovernedTask", request)
+    def projectOnlineAgentExecution(self, request: Mapping[str, Any]) -> Any: return self._call("projectOnlineAgentExecution", request)
+    def registerOnlineAgentExecutionPlan(self, request: Mapping[str, Any]) -> Any: return self._call("registerOnlineAgentExecutionPlan", request)
     def acquireWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("acquireWriterLease", request)
     def bootstrapWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("bootstrapWriterLease", request)
     def renewWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("renewWriterLease", request)

active-runtime/app/aios_chatgpt_bridge_v2_server.py

@@ -1,9 +1,10 @@
 """Loopback-only governed Bridge v2 HTTP gateway with durable handlers."""
 from __future__ import annotations
 
-from dataclasses import dataclass, replace
+from dataclasses import asdict, dataclass, replace
 from datetime import datetime, timedelta, timezone
 import base64
+import hmac
 import json
 import os
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
@@ -12,6 +13,8 @@ import re
 import sqlite3
 import threading
 from typing import Any, Mapping
+import urllib.error
+import urllib.request
 
 from aios_authority_git_executor import AuthorityGitExecutor
 from aios_chatgpt_bridge_v2 import BridgeV2Adapter, BridgeV2Error, OPERATION_REQUIRED_FIELDS
@@ -19,7 +22,9 @@ from aios_continuation_executor import AuthorityGitAdapter, ContinuationCommit,
 from aios_continuation_lease import WriterLeaseRequestV2
 from aios_control_plane_snapshot import build_control_plane_snapshot
 from aios_gitops_job_controller import GitOpsJobController, JobError, JobState, JobStore
-from aios_governed_task_bootstrap import BootstrapError, GovernedTaskBootstrap
+from aios_governed_task_bootstrap import BootstrapError, GovernedTaskBinding, GovernedTaskBootstrap, _legacy_safe, _task_key
+from aios_online_agent_execution import ExecutionProjectionError, OnlineTaskProjectionClient
+from aios_online_agent_plan_store import ExecutionPlanError, ExecutionPlanStore
 from governed_production_release import build_executor_config
 
 MAX_BODY = 2 * 1024 * 1024
@@ -27,6 +32,8 @@ ROUTES = {
     "/v2/runtime": "getRuntimeStatus",
     "/v2/capabilities": "getGovernedWriteCapabilities",
     "/v2/governed-task": "createGovernedTask",
+    "/v2/execution-envelope": "projectOnlineAgentExecution",
+    "/v2/execution-plan": "registerOnlineAgentExecutionPlan",
     "/v2/writer-lease": "acquireWriterLease",
     "/v2/writer-lease/bootstrap": "bootstrapWriterLease",
     "/v2/writer-lease/renew": "renewWriterLease",
@@ -62,6 +69,9 @@ class RuntimeConfig:
     registry_root: Path = Path("/var/lib/aios-gitops/runtime/registry-projection")
     baseline_path: Path = Path("/var/lib/aios-gitops-runtime-anchor/baseline/current.json")
     health_url: str = "http://127.0.0.1:18927/health"
+    agent_task_api_url: str = "http://127.0.0.1:18940"
+    agent_task_control_token_path: Path = Path("/run/credentials/aios-chatgpt-bridge-v2-staging.service/agent_task_control_token")
+    online_task_projection_enabled: bool = False
 
 
 def _safe(value: str) -> str:
@@ -74,6 +84,16 @@ class GovernedRuntime:
         config.state_root.mkdir(parents=True, exist_ok=True)
         self.authority = AuthorityGitExecutor(config.authoritative_git_dir, config.state_root / "worktrees")
         self.bootstrap = GovernedTaskBootstrap(self.authority, config.state_root, remote_name=config.remote_name, token_path=config.token_path, ssh_key_path=config.ssh_key_path, api_base=config.api_base)
+        self.online_task_projector = (
+            OnlineTaskProjectionClient(config.agent_task_api_url, config.agent_task_control_token_path)
+            if config.online_task_projection_enabled
+            else None
+        )
+        self.projection_outbox_root = config.state_root / "online-task-projection-outbox"
+        self.projection_outbox_root.mkdir(parents=True, exist_ok=True)
+        self.execution_plan_store = ExecutionPlanStore(config.state_root / "online-agent-execution-plans")
+        self._projection_locks_guard = threading.Lock()
+        self._projection_locks: dict[str, threading.RLock] = {}
         self.runtimes: dict[tuple[str, int], tuple[Any, GitOpsJobController, ContinuationExecutor]] = {}
         self.controllers: dict[str, GitOpsJobController] = {}
         self._recovery_lock = threading.RLock()
@@ -93,6 +113,54 @@ class GovernedRuntime:
             askpass.write_text('#!/bin/sh\ncase "$1" in *Username*) printf "%s\\n" "$GITEA_MACHINE_ACTOR" ;; *) cat "$CREDENTIAL_FILE" ;; esac\n', encoding="utf-8")
             askpass.chmod(0o700)
         os.environ.setdefault("GIT_ASKPASS", str(askpass)); os.environ.setdefault("GIT_ASKPASS_REQUIRE", "force"); os.environ.setdefault("GIT_TERMINAL_PROMPT", "0"); os.environ.setdefault("GITEA_MACHINE_ACTOR", "aios-autonomy-agent")
+        if self.online_task_projector is not None:
+            threading.Thread(target=self._projection_reconciler, name="online-task-projection-reconciler", daemon=True).start()
+
+    def _projection_lock(self, task_id: str) -> threading.RLock:
+        guard = getattr(self, "_projection_locks_guard", None)
+        if guard is None:
+            guard = threading.Lock()
+            self._projection_locks_guard = guard
+            self._projection_locks = {}
+        with guard:
+            return self._projection_locks.setdefault(task_id, threading.RLock())
+
+    def _projection_outbox_path(self, task_id: str) -> Path:
+        return self.projection_outbox_root / (_task_key(task_id) + ".json")
+
+    def _write_projection_outbox(self, task_id: str, projection: Mapping[str, Any], binding: Any) -> Path:
+        path = self._projection_outbox_path(task_id)
+        temporary = path.with_name(path.name + f".{os.getpid()}.{threading.get_ident()}.tmp")
+        temporary.write_text(json.dumps({"task": dict(projection), "binding": asdict(binding)}, sort_keys=True, separators=(",", ":")), encoding="utf-8")
+        temporary.replace(path)
+        return path
+
+    def _deliver_projection_outbox(self, path: Path) -> dict[str, Any]:
+        value = json.loads(path.read_text(encoding="utf-8"))
+        if not isinstance(value, Mapping) or not isinstance(value.get("task"), Mapping) or not isinstance(value.get("binding"), Mapping):
+            raise RuntimeError("ONLINE_TASK_PROJECTION_OUTBOX_INVALID")
+        binding = self.bootstrap.execution_binding(GovernedTaskBinding(**dict(value["binding"])))
+        if self.online_task_projector is None:
+            raise RuntimeError("ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE")
+        created = self.online_task_projector.create(dict(value["task"]), binding=binding)
+        path.unlink(missing_ok=True)
+        return created
+
+    def _projection_reconciler(self) -> None:
+        while True:
+            for path in sorted(self.projection_outbox_root.glob("*.json")):
+                try:
+                    value = json.loads(path.read_text(encoding="utf-8"))
+                    binding = value.get("binding") if isinstance(value, Mapping) else None
+                    task_id = str(binding.get("task_id") or "") if isinstance(binding, Mapping) else ""
+                    if not task_id:
+                        continue
+                    with self._projection_lock(task_id):
+                        if path.exists():
+                            self._deliver_projection_outbox(path)
+                except Exception:
+                    continue
+            threading.Event().wait(5)
 
     def runtime_status(self) -> dict[str, Any]:
         return {
@@ -113,7 +181,10 @@ class GovernedRuntime:
         }
 
     def _job_root(self, task_id: str) -> Path:
-        return self.config.state_root / "jobs" / _safe(task_id)
+        parent = self.config.state_root / "jobs"
+        keyed = parent / _task_key(task_id)
+        legacy = parent / _legacy_safe(task_id)
+        return keyed if keyed.exists() or not legacy.exists() else legacy
 
     def _build_runtime(
         self,
@@ -443,7 +514,77 @@ class GovernedRuntime:
         return result
 
     def create_task(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        result = self.bootstrap.create(request); self.bindings[result["task_id"]] = result; return result
+        online_request = request.get("online_task")
+        if online_request is not None and not isinstance(online_request, Mapping):
+            raise ValueError("ONLINE_TASK_REQUEST_INVALID")
+        execution_request = request.get("execution")
+        if execution_request is not None and not isinstance(execution_request, Mapping):
+            raise ValueError("EXECUTION_REQUEST_INVALID")
+        online_task_projector = getattr(self, "online_task_projector", None)
+        projection_required = online_request is not None or execution_request is not None or request.get("require_online_task_projection") is True
+        if online_task_projector is None and projection_required:
+            raise RuntimeError("ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE")
+        result = self.bootstrap.create(request)
+        self.bindings[result["task_id"]] = result
+        if online_task_projector is None:
+            return result
+        online = dict(online_request or {})
+        online.setdefault("goal", str(request.get("description") or "Governed engineering task"))
+        online.setdefault("instructions", "Execute only the exact governed binding and return server-verifiable evidence.")
+        online.setdefault("success_criteria", [{"id": "governed", "description": "Complete the exact governed task lifecycle."}])
+        online.setdefault("required_capabilities", ["git.read", "git.test", "governed.write.branch", "governed.write.file"])
+        online.setdefault("priority", int(request.get("priority") or 0))
+        online.setdefault("max_attempts", int(request.get("max_attempts") or 10))
+        projection = self.bootstrap.online_task_projection(
+            result["task_id"],
+            online,
+            execution_request,
+            expected_job_id=str(result.get("job_id") or "") or None,
+        )
+        durable_binding = self.bootstrap.get_binding(result["task_id"])
+        with self._projection_lock(result["task_id"]):
+            path = self._write_projection_outbox(result["task_id"], projection, durable_binding)
+            created = self._deliver_projection_outbox(path)
+        return {
+            **result,
+            "online_task_projection": {
+                "status": "PROJECTED",
+                "task_id": created["task_id"],
+                "job_id": result["job_id"],
+                "task_status": created["status"],
+                "execution_digest": projection["metadata"]["execution"]["execution_digest"],
+            },
+        }
+
+    def project_online_agent_execution(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        capabilities = request.get("required_capabilities") or []
+        if not isinstance(capabilities, list) or not all(isinstance(item, str) for item in capabilities):
+            raise ValueError("CAPABILITY_SCOPE_INVALID")
+        execution = request.get("execution")
+        if execution is not None and not isinstance(execution, Mapping):
+            raise ValueError("EXECUTION_REQUEST_INVALID")
+        task_id = str(request["task_id"])
+        durable = self.bootstrap.get_binding(task_id)
+        binding = self.bootstrap.execution_binding(durable)
+        expected_job_id = str(request.get("job_id") or "") or None
+        if expected_job_id and expected_job_id != binding.job_id:
+            raise BootstrapError("JOB_BINDING_CONFLICT")
+        if execution is None:
+            planned = self.execution_plan_store.resolve(binding)
+            if planned is not None:
+                execution = planned["execution"]
+        return self.bootstrap.execution_envelope(
+            task_id,
+            execution,
+            required_capabilities=tuple(capabilities),
+            expected_job_id=expected_job_id,
+        )
+
+    def register_online_agent_execution_plan(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        task_id = str(request["task_id"])
+        durable = self.bootstrap.get_binding(task_id)
+        binding = self.bootstrap.execution_binding(durable)
+        return self.execution_plan_store.register(binding, request)
 
     def acquire_lease(self, request: Mapping[str, Any]) -> dict[str, Any]:
         binding, controller, _ = self._runtime(request)
@@ -1340,7 +1481,19 @@ class GovernedRuntime:
         controller = self._controller_for_job(job_id)
         row = controller.store.read(job_id)
         if action == "get":
-            return controller.store._receipt(row, duplicate=True).as_dict()
+            response = controller.store._receipt(row, duplicate=True).as_dict()
+            try:
+                with controller.store._connect() as connection:
+                    connection.row_factory = sqlite3.Row
+                    leases = connection.execute(
+                        "SELECT lease_id,job_id,branch,lineage_anchor_oid,current_head_oid,generation,"
+                        "lease_expires_at,state,revision FROM branch_leases WHERE job_id=? ORDER BY revision DESC",
+                        (job_id,),
+                    ).fetchall()
+            except sqlite3.Error as exc:
+                raise RuntimeError("JOB_DB_UNAVAILABLE") from exc
+            response["branch_leases"] = [dict(item) for item in leases]
+            return response
         if action == "resume":
             return controller.resume(job_id).as_dict()
         return self._executor_from_row(row, controller).reconcile(job_id)
@@ -1405,6 +1558,8 @@ class GovernedRuntime:
     def handlers(self) -> dict[str, Any]:
         return {
             "createGovernedTask": self.create_task,
+            "projectOnlineAgentExecution": self.project_online_agent_execution,
+            "registerOnlineAgentExecutionPlan": self.register_online_agent_execution_plan,
             "acquireWriterLease": self.acquire_lease,
             "bootstrapWriterLease": self.bootstrap_writer_lease,
             "renewWriterLease": self.renew_writer_lease,
@@ -1434,6 +1589,8 @@ class _HTTPError(RuntimeError): pass
 
 class BridgeHandler(BaseHTTPRequestHandler):
     adapter: BridgeV2Adapter | None = None
+    control_token: str | None = None
+    agent_task_api_url: str = "http://127.0.0.1:18940"
     def log_message(self, *_args: Any) -> None: return
     def _json(self, value: Any, status: int = 200) -> None:
         raw = json.dumps(value, sort_keys=True, separators=(",", ":")).encode(); self.send_response(status); self.send_header("Content-Type", "application/json"); self.send_header("Content-Length", str(len(raw))); self.end_headers(); self.wfile.write(raw)
@@ -1451,7 +1608,50 @@ class BridgeHandler(BaseHTTPRequestHandler):
         allowed = set(OPERATION_REQUIRED_FIELDS[operation]) | {"schema", "job_id", "lease_seconds", "create_target_branch", "worktree_mode", "cas_ref_update_required", "expected_branch_oid", "generation", "branch_mode"}
         if operation == "commitFilesGoverned": allowed.add("files")
         allowed.update({"owner_approval", "execute"})
+        if operation == "projectOnlineAgentExecution":
+            allowed.update({"execution", "required_capabilities"})
+        if operation == "registerOnlineAgentExecutionPlan":
+            allowed.update({"execution", "source_head_oid", "expected_previous_plan_digest"})
+        if operation == "createGovernedTask":
+            allowed.update({"online_task", "execution", "require_online_task_projection", "priority", "max_attempts", "parent_task_id", "parent_job_id"})
         if set(body) - allowed: raise _HTTPError("UNKNOWN_FIELDS")
+    def _authorized(self, operation: str, body: Mapping[str, Any]) -> bool:
+        header = self.headers.get("Authorization", "")
+        if not header.startswith("Bearer "):
+            return False
+        supplied = header[7:]
+        if self.control_token and hmac.compare_digest(supplied, self.control_token):
+            return True
+        poll = urllib.request.Request(
+            self.agent_task_api_url.rstrip("/") + "/v1/tasks/poll",
+            method="POST",
+            data=b'{"limit":1}',
+            headers={"Authorization": header, "Content-Type": "application/json", "Accept": "application/json"},
+        )
+        try:
+            with urllib.request.urlopen(poll, timeout=5) as response:
+                principal = json.loads(response.read().decode("utf-8"))
+        except (OSError, urllib.error.URLError, urllib.error.HTTPError, ValueError):
+            return False
+        agent_id = str(principal.get("agent_id") or "") if isinstance(principal, Mapping) else ""
+        if not agent_id:
+            return False
+        claim_bound = {"acquireWriterLease", "bootstrapWriterLease", "renewWriterLease", "commitFileGoverned", "commitFilesGoverned"}
+        if operation not in claim_bound:
+            return operation in {"projectOnlineAgentExecution", "getGitOpsJob"}
+        task_id = str(body.get("task_id") or "")
+        if not task_id:
+            return False
+        task_request = urllib.request.Request(
+            self.agent_task_api_url.rstrip("/") + "/v1/tasks/" + task_id,
+            headers={"Authorization": header, "Accept": "application/json"},
+        )
+        try:
+            with urllib.request.urlopen(task_request, timeout=5) as response:
+                task = json.loads(response.read().decode("utf-8"))
+        except (OSError, urllib.error.URLError, urllib.error.HTTPError, ValueError):
+            return False
+        return isinstance(task, Mapping) and task.get("task_id") == task_id and task.get("claimed_by") == agent_id and task.get("status") in {"CLAIMED", "RUNNING"}
     def do_GET(self) -> None:
         if self.adapter is None: self._json({"error": "RUNTIME_UNAVAILABLE"}, 503); return
         if self.path == "/v2/runtime": self._json(self.adapter.getRuntimeStatus()); return
@@ -1462,14 +1662,23 @@ class BridgeHandler(BaseHTTPRequestHandler):
         operation = ROUTES.get(self.path)
         if operation is None or operation in ("getRuntimeStatus", "getGovernedWriteCapabilities") or self.adapter is None: self._json({"error": "NOT_FOUND"}, 404); return
         try:
-            body = self._body(); self._allowed(operation, body); self._json(getattr(self.adapter, operation)(body))
+            body = self._body()
+        except _HTTPError as exc: self._json({"error": str(exc)}, 413 if str(exc) == "REQUEST_TOO_LARGE" else 400); return
+        if not self._authorized(operation, body): self._json({"error": "BRIDGE_CALLER_UNAUTHORIZED"}, 401); return
+        try:
+            self._allowed(operation, body); self._json(getattr(self.adapter, operation)(body))
         except _HTTPError as exc: self._json({"error": str(exc)}, 413 if str(exc) == "REQUEST_TOO_LARGE" else 400)
-        except (BootstrapError, ValueError, BridgeV2Error) as exc: self._json({"error": str(exc)}, 409 if "CONFLICT" in str(exc) else 400)
+        except (BootstrapError, ExecutionProjectionError, ExecutionPlanError, ValueError, BridgeV2Error) as exc: self._json({"error": str(exc)}, 409 if any(token in str(exc) for token in ("CONFLICT", "DRIFT", "CAS")) else 400)
         except Exception as exc: self._json({"error": str(exc) or type(exc).__name__}, 409 if any(token in str(exc) for token in ("CONFLICT", "EXPECTATION", "MONOTONIC")) else 503)
 
 
-def serve(adapter: BridgeV2Adapter, host: str = "127.0.0.1", port: int = 18892) -> None:
-    BridgeHandler.adapter = adapter; ThreadingHTTPServer((host, port), BridgeHandler).serve_forever()
+def serve(adapter: BridgeV2Adapter, host: str = "127.0.0.1", port: int = 18892, *, control_token_path: Path, agent_task_api_url: str) -> None:
+    if not control_token_path.is_file() or control_token_path.is_symlink():
+        raise RuntimeError("BRIDGE_CONTROL_CREDENTIAL_UNAVAILABLE")
+    control_token = control_token_path.read_text(encoding="utf-8").strip()
+    if len(control_token) < 32:
+        raise RuntimeError("BRIDGE_CONTROL_CREDENTIAL_INVALID")
+    BridgeHandler.adapter = adapter; BridgeHandler.control_token = control_token; BridgeHandler.agent_task_api_url = agent_task_api_url; ThreadingHTTPServer((host, port), BridgeHandler).serve_forever()
 
 
 def main() -> None:
@@ -1488,11 +1697,21 @@ def main() -> None:
         remote_name=os.environ.get("AIOS_GITEA_REMOTE", "gitea-http"),
         api_base=os.environ.get("AIOS_GITEA_API_BASE", "https://g.cnnetmkt.top/git/api/v1"),
         target_version=os.environ.get("AIOS_CONTROL_PLANE_TARGET_VERSION", "V2R2C1"),
+        agent_task_api_url=os.environ.get("AIOS_AGENT_TASK_API_URL", "http://127.0.0.1:18940"),
+        agent_task_control_token_path=Path(
+            os.environ.get(
+                "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
+                str(Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials/aios-chatgpt-bridge-v2-staging.service")) / "agent_task_control_token"),
+            )
+        ),
+        online_task_projection_enabled=os.environ.get("AIOS_ONLINE_TASK_PROJECTION_ENABLED", "1") == "1",
     )
     runtime = GovernedRuntime(config)
     serve(
         BridgeV2Adapter(runtime_status=runtime.runtime_status(), handlers=runtime.handlers()),
         port=int(os.environ.get("AIOS_BRIDGE_V2_PORT", "18892")),
+        control_token_path=config.agent_task_control_token_path,
+        agent_task_api_url=config.agent_task_api_url,
     )
 
 

active-runtime/app/aios_continuation_executor.py

@@ -157,7 +157,7 @@ class DetachedGitWorkspace:
     def materialize_files(self, files: Mapping[str, bytes]) -> None:
         dirty = self._dirty_paths()
         expected_paths = set(files)
-        if dirty and dirty != expected_paths:
+        if dirty and not dirty.issubset(expected_paths):
             raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
         for relative, content in files.items():
             target = (self.path / relative).resolve()
@@ -499,7 +499,19 @@ class ContinuationExecutor:
         current = self.controller.store.read(binding.job_id)
         current_state = JobState(current["state"])
         if current_state == JobState.COMPLETED:
-            return self.controller.store._receipt(current, duplicate=True).as_dict()
+            cycle = self.controller.begin_continuation_cycle(
+                binding.job_id,
+                idempotency_key=commit.idempotency_key,
+                expected_head_oid=binding.request.expected_branch_oid,
+                generation=binding.request.generation,
+                expected_revision=int(current["revision"]),
+            )
+            if cycle.get("completed"):
+                return self.controller.store._receipt(
+                    self.controller.store.read(binding.job_id), duplicate=True
+                ).as_dict()
+            current = self.controller.store.read(binding.job_id)
+            current_state = JobState(current["state"])
         if current_state == JobState.REMOTE_VERIFIED:
             receipt = json.loads(str(current["receipt_json"] or "{}"))
             commit_oid = str(receipt.get("authority_oid") or "")
@@ -507,12 +519,18 @@ class ContinuationExecutor:
                 raise ContinuationExecutionError("GOVERNED_COMMIT_OID_INVALID")
             if before_complete is not None:
                 before_complete(commit_oid)
-            return self.controller.advance(
+            result = self.controller.advance(
                 binding.job_id,
                 JobState.COMPLETED,
                 side_effect_state="REMOTE_VERIFIED",
                 receipt=receipt,
             ).as_dict()
+            self.controller.complete_continuation_cycle(
+                binding.job_id,
+                idempotency_key=commit.idempotency_key,
+                commit_oid=commit_oid,
+            )
+            return result
         self._validate_preflight(binding, job_id=binding.job_id)
         request = binding.request
         projected = False
@@ -576,12 +594,19 @@ class ContinuationExecutor:
                     self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
             except Exception:
                 return self._remote_pending(binding.job_id, authority_oid, new_oid)
-            return self._finish_remote_verification(
+            result = self._finish_remote_verification(
                 binding.job_id,
                 authority_oid,
                 new_oid,
                 before_complete=before_complete,
             )
+            if str(result.get("state") or "") == JobState.COMPLETED.value:
+                self.controller.complete_continuation_cycle(
+                    binding.job_id,
+                    idempotency_key=commit.idempotency_key,
+                    commit_oid=new_oid,
+                )
+            return result
         finally:
             if projected:
                 self.credential.revoke()

active-runtime/app/aios_gitops_job_controller.py

@@ -230,7 +230,15 @@ class JobStore:
                       kind TEXT NOT NULL, digest TEXT NOT NULL, payload_json TEXT NOT NULL,
                       created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
                     );
-                    INSERT OR REPLACE INTO metadata(key, value) VALUES('schema_version', '1');
+                    CREATE TABLE IF NOT EXISTS continuation_cycles (
+                      job_id TEXT NOT NULL, idempotency_key TEXT NOT NULL,
+                      sequence INTEGER NOT NULL, expected_head_oid TEXT NOT NULL,
+                      generation INTEGER NOT NULL, state TEXT NOT NULL,
+                      commit_oid TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+                      PRIMARY KEY(job_id,idempotency_key), UNIQUE(job_id,sequence),
+                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
+                    );
+                    INSERT OR REPLACE INTO metadata(key, value) VALUES('schema_version', '2');
                     """
                 )
         except sqlite3.Error as exc:
@@ -531,6 +539,183 @@ class GitOpsJobController:
         except sqlite3.Error as exc:
             raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
 
+    def begin_continuation_cycle(
+        self,
+        job_id: str,
+        *,
+        idempotency_key: str,
+        expected_head_oid: str,
+        generation: int,
+        expected_revision: int,
+    ) -> dict[str, Any]:
+        if (
+            not idempotency_key
+            or len(idempotency_key) > 128
+            or not all(character.isalnum() or character in "._:-" for character in idempotency_key)
+            or len(expected_head_oid) != 40
+            or any(character not in "0123456789abcdef" for character in expected_head_oid)
+            or generation < 1
+        ):
+            raise JobError("CONTINUATION_CYCLE_BINDING_INVALID")
+        try:
+            with self.store._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
+                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
+                if row is None:
+                    raise JobError("JOB_NOT_FOUND")
+                existing = connection.execute(
+                    "SELECT * FROM continuation_cycles WHERE job_id=? AND idempotency_key=?",
+                    (job_id, idempotency_key),
+                ).fetchone()
+                if existing is not None:
+                    if str(existing["expected_head_oid"]) != expected_head_oid or int(existing["generation"]) != generation:
+                        raise JobError("CONTINUATION_CYCLE_BINDING_CONFLICT")
+                    if str(existing["state"]) == "COMPLETED":
+                        connection.commit()
+                        return {"completed": True, "commit_oid": str(existing["commit_oid"] or ""), "idempotent": True}
+                    if str(row["state"]) == JobState.COMPLETED.value:
+                        receipt = json.loads(str(row["receipt_json"] or "{}"))
+                        commit_oid = str(receipt.get("authority_oid") or "")
+                        lease = connection.execute(
+                            "SELECT current_head_oid FROM branch_leases WHERE job_id=? AND generation=? AND state='ACTIVE'",
+                            (job_id, generation),
+                        ).fetchall()
+                        if (
+                            len(lease) == 1
+                            and len(commit_oid) == 40
+                            and str(lease[0]["current_head_oid"] or "") == commit_oid
+                            and receipt.get("remote_verified") is True
+                        ):
+                            now = utc_now()
+                            connection.execute(
+                                "UPDATE continuation_cycles SET state='COMPLETED',commit_oid=?,updated_at=? "
+                                "WHERE job_id=? AND idempotency_key=? AND state='ACTIVE'",
+                                (commit_oid, now, job_id, idempotency_key),
+                            )
+                            connection.commit()
+                            return {"completed": True, "commit_oid": commit_oid, "idempotent": True}
+                        raise JobError("CONTINUATION_CYCLE_RECOVERY_REQUIRED")
+                    connection.commit()
+                    return {"completed": False, "commit_oid": None, "idempotent": True}
+                if int(row["revision"]) != expected_revision:
+                    raise JobError("REVISION_CAS_CONFLICT")
+                if str(row["state"]) != JobState.COMPLETED.value:
+                    raise JobError("CONTINUATION_CYCLE_JOB_STATE_INVALID")
+                if str(row["branch"]) in {"main", "master"} or str(row["branch"]).startswith(("refs/", "tags/")):
+                    raise JobError("PROTECTED_BRANCH_REJECTED")
+                receipt = json.loads(str(row["receipt_json"] or "{}"))
+                if receipt.get("remote_verified") is not True or any(
+                    str(receipt.get(field) or "") != expected_head_oid
+                    for field in ("authority_oid", "api_branch_oid", "git_remote_oid")
+                ):
+                    raise JobError("CONTINUATION_CYCLE_RECEIPT_INVALID")
+                leases = connection.execute(
+                    "SELECT * FROM branch_leases WHERE job_id=? AND branch=? AND generation=? AND state='ACTIVE'",
+                    (job_id, str(row["branch"]), generation),
+                ).fetchall()
+                if len(leases) != 1 or str(leases[0]["current_head_oid"] or "") != expected_head_oid:
+                    raise JobError("CONTINUATION_CYCLE_LEASE_INVALID")
+                if connection.execute(
+                    "SELECT 1 FROM continuation_cycles WHERE job_id=? AND state='ACTIVE' LIMIT 1",
+                    (job_id,),
+                ).fetchone() is not None:
+                    raise JobError("CONTINUATION_CYCLE_ACTIVE_CONFLICT")
+                sequence = int(connection.execute(
+                    "SELECT COALESCE(MAX(sequence),0)+1 FROM continuation_cycles WHERE job_id=?",
+                    (job_id,),
+                ).fetchone()[0])
+                now = utc_now()
+                connection.execute(
+                    "INSERT INTO continuation_cycles(job_id,idempotency_key,sequence,expected_head_oid,generation,state,commit_oid,created_at,updated_at) "
+                    "VALUES(?,?,?,?,?,'ACTIVE',NULL,?,?)",
+                    (job_id, idempotency_key, sequence, expected_head_oid, generation, now, now),
+                )
+                next_revision = expected_revision + 1
+                updated = connection.execute(
+                    "UPDATE jobs SET state=?,side_effect_state=?,revision=?,updated_at=? WHERE job_id=? AND revision=?",
+                    (JobState.LEASED.value, "CONTINUATION_LEASED", next_revision, now, job_id, expected_revision),
+                )
+                if updated.rowcount != 1:
+                    raise JobError("REVISION_CAS_CONFLICT")
+                connection.execute(
+                    "INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)",
+                    (job_id, JobState.COMPLETED.value, JobState.LEASED.value, next_revision, "CONTINUATION_LEASED", now),
+                )
+                cycle_receipt = {
+                    "idempotency_key": idempotency_key,
+                    "expected_head_oid": expected_head_oid,
+                    "generation": generation,
+                    "sequence": sequence,
+                }
+                connection.execute(
+                    "INSERT INTO receipts(receipt_id,job_id,kind,digest,payload_json,created_at) VALUES(?,?,?,?,?,?)",
+                    (
+                        f"receipt-{job_id}-{next_revision}",
+                        job_id,
+                        "CONTINUATION_LEASED",
+                        hashlib.sha256(canonical_json(cycle_receipt)).hexdigest(),
+                        json.dumps(cycle_receipt, sort_keys=True),
+                        now,
+                    ),
+                )
+                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
+                connection.commit()
+        except (JobError, BindingConflict):
+            raise
+        except sqlite3.Error as exc:
+            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
+        result["request"] = json.loads(result["request_json"])
+        self.store._mirror(result)
+        return {"completed": False, "commit_oid": None, "idempotent": False}
+
+    def complete_continuation_cycle(self, job_id: str, *, idempotency_key: str, commit_oid: str) -> bool:
+        if len(commit_oid) != 40 or any(character not in "0123456789abcdef" for character in commit_oid):
+            raise JobError("CONTINUATION_CYCLE_COMMIT_OID_INVALID")
+        try:
+            with self.store._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
+                cycle = connection.execute(
+                    "SELECT * FROM continuation_cycles WHERE job_id=? AND idempotency_key=?",
+                    (job_id, idempotency_key),
+                ).fetchone()
+                if cycle is None:
+                    connection.commit()
+                    return False
+                if str(cycle["state"]) == "COMPLETED":
+                    if str(cycle["commit_oid"] or "") != commit_oid:
+                        raise JobError("CONTINUATION_CYCLE_COMMIT_CONFLICT")
+                    connection.commit()
+                    return True
+                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
+                leases = connection.execute(
+                    "SELECT current_head_oid FROM branch_leases WHERE job_id=? AND generation=? AND state='ACTIVE'",
+                    (job_id, int(cycle["generation"])),
+                ).fetchall()
+                receipt = json.loads(str(row["receipt_json"] or "{}")) if row is not None else {}
+                if (
+                    row is None
+                    or str(row["state"]) != JobState.COMPLETED.value
+                    or receipt.get("remote_verified") is not True
+                    or str(receipt.get("authority_oid") or "") != commit_oid
+                    or len(leases) != 1
+                    or str(leases[0]["current_head_oid"] or "") != commit_oid
+                ):
+                    raise JobError("CONTINUATION_CYCLE_COMPLETION_EVIDENCE_INVALID")
+                now = utc_now()
+                updated = connection.execute(
+                    "UPDATE continuation_cycles SET state='COMPLETED',commit_oid=?,updated_at=? "
+                    "WHERE job_id=? AND idempotency_key=? AND state='ACTIVE'",
+                    (commit_oid, now, job_id, idempotency_key),
+                )
+                if updated.rowcount != 1:
+                    raise JobError("CONTINUATION_CYCLE_CAS_CONFLICT")
+                connection.commit()
+                return True
+        except (JobError, BindingConflict):
+            raise
+        except sqlite3.Error as exc:
+            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
+
     def advance(self, job_id: str, state: JobState, *, side_effect_state: str, receipt: Mapping[str, Any] | None = None, expected_revision: int | None = None) -> JobReceipt:
         return self._advance(
             job_id,

active-runtime/app/aios_governed_task_bootstrap.py

@@ -2,6 +2,8 @@
 from __future__ import annotations
 
 from dataclasses import dataclass, asdict
+from contextlib import contextmanager
+import fcntl
 import hashlib
 import json
 from pathlib import Path
@@ -9,6 +11,11 @@ import re
 from typing import Any, Mapping
 
 from aios_gitops_job_controller import GitOpsJobController, JobStore
+from aios_online_agent_execution import (
+    GovernedExecutionBinding,
+    project_execution_envelope,
+    project_online_task,
+)
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
@@ -36,35 +43,161 @@ class GovernedTaskBinding:
         return {"task_id": self.task_id, "repository": self.repository, "base_oid": self.base_oid, "target_branch": self.target_branch, "expected_branch_oid": self.expected_branch_oid, "generation": self.generation, "branch_mode": self.branch_mode, "create_target_branch": self.branch_mode == "CREATE_NEW", "worktree_mode": "detached_at_base_oid" if self.branch_mode == "CREATE_NEW" else "detached_at_expected_head", "cas_ref_update_required": True, "idempotent": idempotent, "state": "BOUND", "job_id": self.job_id}
 
 
-def _safe(value: str) -> str:
+def _legacy_safe(value: str) -> str:
     return re.sub(r"[^A-Za-z0-9_.-]+", "-", value).strip("-")[:120] or "task"
 
 
+def _task_key(value: str) -> str:
+    readable = _legacy_safe(value)[:72]
+    return f"{readable}-{hashlib.sha256(value.encode('utf-8')).hexdigest()[:24]}"
+
+
 class GovernedTaskBootstrap:
     def __init__(self, authority: Any, root: Path, *, remote_name: str, token_path: Path, ssh_key_path: Path, api_base: str = "https://g.cnnetmkt.top/git/api/v1") -> None:
-        self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.task_meta_root.mkdir(parents=True, exist_ok=True); self.job_root.mkdir(parents=True, exist_ok=True)
+        self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.lock_root = self.root / "task-locks"; self.task_meta_root.mkdir(parents=True, exist_ok=True); self.job_root.mkdir(parents=True, exist_ok=True); self.lock_root.mkdir(parents=True, exist_ok=True)
 
     def _store(self, task_id: str) -> tuple[JobStore, GitOpsJobController]:
-        root = self.job_root / _safe(task_id); store = JobStore(root, payload_root=root / "payloads"); return store, GitOpsJobController(store)
+        legacy = self.job_root / _legacy_safe(task_id)
+        keyed = self.job_root / _task_key(task_id)
+        root = legacy if legacy.is_dir() and not keyed.exists() else keyed
+        store = JobStore(root, payload_root=root / "payloads"); return store, GitOpsJobController(store)
 
     def _metadata(self, task_id: str) -> Path:
-        return self.task_meta_root / (_safe(task_id) + ".json")
+        return self.task_meta_root / (_task_key(task_id) + ".json")
+
+    def _legacy_metadata(self, task_id: str) -> Path:
+        return self.task_meta_root / (_legacy_safe(task_id) + ".json")
+
+    @contextmanager
+    def _task_lock(self, task_id: str):
+        path = self.lock_root / (_task_key(task_id) + ".lock")
+        with path.open("a+b") as handle:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+
+    @contextmanager
+    def _branch_lock(self, repository: str, target_branch: str):
+        key = hashlib.sha256((repository + "\0" + target_branch).encode("utf-8")).hexdigest()
+        path = self.lock_root / ("branch-" + key + ".lock")
+        with path.open("a+b") as handle:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
 
     def _read_existing(self, task_id: str) -> GovernedTaskBinding | None:
         path = self._metadata(task_id)
+        if not path.exists():
+            path = self._legacy_metadata(task_id)
         if not path.is_file() or path.is_symlink(): return None
-        return GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
+        binding = GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
+        if binding.task_id != task_id:
+            raise BootstrapError("TASK_BINDING_KEY_COLLISION")
+        return binding
+
+    def get_binding(self, task_id: str) -> GovernedTaskBinding:
+        """Return the exact durable binding; never synthesize missing lineage."""
+        existing = self._read_existing(str(task_id))
+        if existing is None or not existing.job_id:
+            raise BootstrapError("TASK_EXECUTION_PROJECTION_MISSING")
+        return existing
+
+    def execution_binding(self, binding: GovernedTaskBinding) -> GovernedExecutionBinding:
+        expected = binding.expected_branch_oid
+        mode = binding.branch_mode
+        if mode == "CREATE_NEW":
+            current = self.authority.read_ref("refs/heads/" + binding.target_branch)
+            if current is not None:
+                store, _ = self._store(binding.task_id)
+                with store._connect() as connection:
+                    rows = connection.execute(
+                        "SELECT current_head_oid,generation,state,lineage_anchor_oid "
+                        "FROM branch_leases WHERE job_id=? AND branch=? AND state='ACTIVE' "
+                        "ORDER BY revision DESC",
+                        (binding.job_id, binding.target_branch),
+                    ).fetchall()
+                if len(rows) != 1:
+                    raise BootstrapError("SAME_JOB_CONTINUATION_LEASE_INVALID")
+                row = rows[0]
+                if (
+                    str(row["current_head_oid"] or "") != current
+                    or int(row["generation"] or 0) != binding.generation
+                    or str(row["lineage_anchor_oid"] or "") != binding.base_oid
+                ):
+                    raise BootstrapError("SAME_JOB_CONTINUATION_BINDING_INVALID")
+                expected = current
+                mode = "CONTINUE_EXISTING"
+        return GovernedExecutionBinding.from_mapping(
+            {
+                "task_id": binding.task_id,
+                "job_id": binding.job_id,
+                "repository": binding.repository,
+                "base_oid": binding.base_oid,
+                "expected_branch_oid": expected,
+                "target_branch": binding.target_branch,
+                "branch_mode": mode,
+                "generation": binding.generation,
+                "idempotency_key": binding.idempotency_key,
+            }
+        )
+
+    def execution_envelope(
+        self,
+        task_id: str,
+        execution_request: Mapping[str, Any] | None = None,
+        *,
+        required_capabilities: tuple[str, ...] = (),
+        expected_job_id: str | None = None,
+    ) -> dict[str, Any]:
+        binding = self.get_binding(task_id)
+        if expected_job_id and binding.job_id != expected_job_id:
+            raise BootstrapError("JOB_BINDING_CONFLICT")
+        return project_execution_envelope(
+            self.execution_binding(binding),
+            execution_request,
+            required_capabilities=required_capabilities,
+        )
+
+    def online_task_projection(
+        self,
+        task_id: str,
+        task_request: Mapping[str, Any],
+        execution_request: Mapping[str, Any] | None = None,
+        *,
+        expected_job_id: str | None = None,
+    ) -> dict[str, Any]:
+        binding = self.get_binding(task_id)
+        if expected_job_id and binding.job_id != expected_job_id:
+            raise BootstrapError("JOB_BINDING_CONFLICT")
+        return project_online_task(self.execution_binding(binding), task_request, execution_request)
 
     def _write(self, binding: GovernedTaskBinding) -> None:
         path = self._metadata(binding.task_id); temporary = path.with_suffix(".tmp"); temporary.write_text(json.dumps(asdict(binding), sort_keys=True), encoding="utf-8"); temporary.replace(path)
 
     def create(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        task_id = str(request.get("task_id") or "")
+        if not task_id:
+            raise BootstrapError("TASK_BINDING_INVALID")
+        repository = str(request.get("repository") or "")
+        target_branch = str(request.get("target_branch") or "")
+        with self._task_lock(task_id):
+            with self._branch_lock(repository, target_branch):
+                return self._create_locked(request)
+
+    def _create_locked(self, request: Mapping[str, Any]) -> dict[str, Any]:
         values = {key: str(request[key]) for key in ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")}
         if values["repository"] != "aios/aios" or not OID_RE.fullmatch(values["base_oid"]): raise BootstrapError("TASK_BINDING_INVALID")
         if not BRANCH_RE.fullmatch(values["target_branch"]): raise BootstrapError("TARGET_BRANCH_INVALID")
         existing = self._read_existing(values["task_id"])
         if existing is not None:
-            if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description")): raise BootstrapError("TASK_BINDING_CONFLICT")
+            if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")): raise BootstrapError("TASK_BINDING_CONFLICT")
+            optional = {"expected_branch_oid": existing.expected_branch_oid, "branch_mode": existing.branch_mode, "generation": existing.generation}
+            for key, durable in optional.items():
+                if key in request and str(request[key]) != str(durable): raise BootstrapError("TASK_BINDING_CONFLICT")
             return existing.response(idempotent=True)
         if not self.authority.commit_exists(values["base_oid"]): raise BootstrapError("BASE_COMMIT_NOT_FOUND")
         current = self.authority.read_ref("refs/heads/" + values["target_branch"])
@@ -74,8 +207,24 @@ class GovernedTaskBootstrap:
             if expected != values["base_oid"]: raise BootstrapError("EXPECTED_BASE_CONFLICT")
         else:
             if expected != current: raise BootstrapError("EXISTING_BRANCH_OID_CONFLICT")
-            mode, generation = "CONTINUE_EXISTING", int(request.get("generation", 2))
-            if generation < 1: raise BootstrapError("GENERATION_INVALID")
+            parent_task_id = str(request.get("parent_task_id") or "")
+            parent_job_id = str(request.get("parent_job_id") or "")
+            if not parent_task_id or not parent_job_id:
+                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_REQUIRED")
+            parent = self._read_existing(parent_task_id)
+            if parent is None or parent.job_id != parent_job_id or parent.repository != values["repository"] or parent.target_branch != values["target_branch"]:
+                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_CONFLICT")
+            store, _ = self._store(parent_task_id)
+            with store._connect() as connection:
+                rows = connection.execute(
+                    "SELECT current_head_oid,generation,state FROM branch_leases WHERE job_id=? AND branch=? AND state='ACTIVE' ORDER BY revision DESC",
+                    (parent_job_id, values["target_branch"]),
+                ).fetchall()
+            if len(rows) != 1 or str(rows[0]["current_head_oid"] or "") != current:
+                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_CONFLICT")
+            mode, generation = "CONTINUE_EXISTING", int(rows[0]["generation"]) + 1
+            if "generation" in request and int(request["generation"]) != generation:
+                raise BootstrapError("GENERATION_BINDING_CONFLICT")
         payload = json.dumps(values, sort_keys=True, separators=(",", ":")).encode()
         _, controller = self._store(values["task_id"])
         receipt = controller.submit({"idempotency_key": values["idempotency_key"], "campaign_id": values["task_id"], "task_id": values["task_id"], "repository": values["repository"], "operation": "GOVERNED_TASK_CREATE", "branch": values["target_branch"], "expected_branch_oid": expected, "payload_digest": hashlib.sha256(payload).hexdigest(), "lineage_anchor_oid": values["base_oid"]}, payload=payload)

active-runtime/app/aios_isolated_executor.py

@@ -0,0 +1,306 @@
+"""Uncredentialed deterministic executor for governed Online Agent changes.
+
+This process never receives Agent/Owner/Bridge credentials and never writes Git refs.
+It operates only on an exchange bundle and returns hash-bound changed files + test evidence.
+"""
+from __future__ import annotations
+
+import base64
+from dataclasses import dataclass
+import errno
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import socket
+import subprocess
+import tarfile
+import tempfile
+import time
+from typing import Any, Mapping, Sequence
+
+ALLOWED_PROGRAMS = {"/usr/bin/python3", "/usr/bin/git", "/bin/true", "/usr/bin/true"}
+MAX_ARCHIVE_BYTES = 64 * 1024 * 1024
+MAX_FILE_BYTES = 4 * 1024 * 1024
+SECRET_ENV_TOKENS = ("TOKEN", "SECRET", "PASSWORD", "CREDENTIAL", "AUTHORIZATION", "PRIVATE_KEY")
+REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{15,254}$")
+SENSITIVE_VALUE_RE = re.compile(
+    r"(?i)(authorization\s*[:=]\s*bearer\s+\S+|authorization\s+bearer\s+\S+|"
+    r"(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+)"
+)
+
+
+class IsolatedExecutorError(RuntimeError):
+    pass
+
+
+def sha256(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def safe_relative(value: object) -> str:
+    if not isinstance(value, str) or not value or value.startswith("/"):
+        raise IsolatedExecutorError("PATH_INVALID")
+    path = Path(value)
+    if ".." in path.parts or "." in path.parts or any(part in {"", ".git"} for part in path.parts):
+        raise IsolatedExecutorError("PATH_INVALID")
+    return path.as_posix()
+
+
+def resolve_under(root: Path, relative: str) -> Path:
+    root = root.resolve()
+    path = (root / safe_relative(relative)).resolve(strict=False)
+    if path == root or root not in path.parents:
+        raise IsolatedExecutorError("PATH_ESCAPE")
+    return path
+
+
+def _credential_exposure(directory: Path) -> str | None:
+    """Return an exposure code; EACCES is the intended credential isolation proof."""
+    try:
+        if not directory.exists():
+            return None
+        if directory.is_symlink():
+            return "CREDENTIAL_MOUNT_SYMLINK"
+        if os.access(directory, os.R_OK):
+            return "CREDENTIAL_MOUNT_ACCESSIBLE"
+        if directory.is_dir():
+            for child in directory.iterdir():
+                if child.is_file() and os.access(child, os.R_OK):
+                    return "CREDENTIAL_FILE_ACCESSIBLE"
+    except PermissionError:
+        return None
+    return None
+
+
+def assert_uncredentialed() -> None:
+    credentials = Path("/run/credentials")
+    candidates = {credentials}
+    credentials_directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
+    candidates.add(credentials_directory)
+    leaked = sorted(
+        key for key, value in os.environ.items()
+        if value
+        and (any(token in key.upper() for token in SECRET_ENV_TOKENS) or SENSITIVE_VALUE_RE.search(str(value)))
+    )
+    if leaked:
+        raise IsolatedExecutorError("CREDENTIAL_ENV_EXPOSED:" + ",".join(leaked))
+    for directory in candidates:
+        exposure = _credential_exposure(directory)
+        if exposure is not None:
+            raise IsolatedExecutorError(exposure)
+    # In the intended PrivateNetwork namespace host loopback services are unreachable.
+    try:
+        probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    except OSError as exc:
+        if exc.errno in {errno.EACCES, errno.EPERM, errno.EAFNOSUPPORT}:
+            return
+        raise IsolatedExecutorError("NETWORK_ISOLATION_PROBE_FAILED") from exc
+    probe.settimeout(0.15)
+    try:
+        if probe.connect_ex(("127.0.0.1", 18892)) == 0:
+            raise IsolatedExecutorError("GOVERNED_BRIDGE_REACHABLE")
+    finally:
+        probe.close()
+
+
+def extract_source(archive: Path, root: Path) -> None:
+    if archive.is_symlink() or not archive.is_file() or archive.stat().st_size > MAX_ARCHIVE_BYTES:
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_INVALID")
+    with tarfile.open(archive, "r:gz") as tf:
+        for member in tf.getmembers():
+            path = Path(member.name)
+            if path.is_absolute() or ".." in path.parts or ".git" in path.parts:
+                raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
+            if member.issym() or member.islnk():
+                raise IsolatedExecutorError("SOURCE_ARCHIVE_LINK_DENY")
+        tf.extractall(root, filter="data")
+
+
+def run_command(item: Mapping[str, Any], root: Path) -> dict[str, Any]:
+    argv = item.get("argv")
+    if not isinstance(argv, Sequence) or isinstance(argv, (str, bytes)) or not argv:
+        raise IsolatedExecutorError("COMMAND_INVALID")
+    argv = [str(part) for part in argv]
+    if argv[0] not in ALLOWED_PROGRAMS:
+        raise IsolatedExecutorError("COMMAND_PROGRAM_DENY")
+    if argv[0] == "/usr/bin/python3" and "-m" in argv:
+        index = argv.index("-m")
+        if index + 1 >= len(argv) or argv[index + 1] not in {"pytest", "py_compile"}:
+            raise IsolatedExecutorError("PYTHON_MODULE_DENY")
+    if argv[0] == "/usr/bin/git" and any(
+        token in {"push", "update-ref", "commit", "merge", "rebase", "reset", "clean", "branch"}
+        for token in argv[1:]
+    ):
+        raise IsolatedExecutorError("GIT_MUTATION_DENY")
+    timeout = int(item.get("timeout_seconds") or 300)
+    if not 1 <= timeout <= 1800:
+        raise IsolatedExecutorError("COMMAND_TIMEOUT_INVALID")
+    cwd = root if item.get("cwd", ".") == "." else resolve_under(root, str(item.get("cwd")))
+    started = time.monotonic()
+    completed = subprocess.run(
+        argv,
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=timeout,
+        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
+    )
+    result = {
+        "label": str(item.get("label") or "command"),
+        "exit_code": completed.returncode,
+        "stdout_sha256": sha256(completed.stdout.encode("utf-8", "replace")),
+        "stderr_sha256": sha256(completed.stderr.encode("utf-8", "replace")),
+        "duration_ms": int((time.monotonic() - started) * 1000),
+    }
+    if completed.returncode != 0:
+        raise IsolatedExecutorError(
+            "COMMAND_FAILED:" + result["label"] + ":" + str(completed.returncode)
+        )
+    return result
+
+
+def apply_changes(request: Mapping[str, Any], root: Path) -> list[str]:
+    changes = request.get("change_set")
+    if not isinstance(changes, list) or not changes:
+        raise IsolatedExecutorError("CHANGE_SET_INVALID")
+    changed: list[str] = []
+    for change in changes:
+        if not isinstance(change, Mapping):
+            raise IsolatedExecutorError("CHANGE_INVALID")
+        relative = safe_relative(change.get("path"))
+        path = resolve_under(root, relative)
+        current = path.read_bytes() if path.is_file() else None
+        expected = change.get("expected_sha256")
+        if expected is not None and (current is None or sha256(current) != expected):
+            raise IsolatedExecutorError("SOURCE_DRIFT:" + relative)
+        operation = change.get("operation")
+        if operation == "write_file":
+            content = change.get("content")
+            if not isinstance(content, str):
+                raise IsolatedExecutorError("WRITE_CONTENT_INVALID")
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(content, encoding="utf-8")
+        elif operation == "replace_text":
+            if current is None:
+                raise IsolatedExecutorError("REPLACE_SOURCE_MISSING")
+            old = str(change.get("old"))
+            new = str(change.get("new"))
+            count = int(change.get("count", 1))
+            text = current.decode("utf-8")
+            if text.count(old) != count:
+                raise IsolatedExecutorError("REPLACE_COUNT_INVALID:" + relative)
+            path.write_text(text.replace(old, new), encoding="utf-8")
+        elif operation == "delete_file":
+            if path.exists():
+                path.unlink()
+        else:
+            raise IsolatedExecutorError("CHANGE_OPERATION_INVALID")
+        changed.append(relative)
+    return sorted(set(changed))
+
+
+def changed_bundle(root: Path, changed: list[str]) -> list[dict[str, Any]]:
+    files = []
+    for relative in changed:
+        path = resolve_under(root, relative)
+        if path.exists():
+            data = path.read_bytes()
+            if len(data) > MAX_FILE_BYTES:
+                raise IsolatedExecutorError("CHANGED_FILE_TOO_LARGE:" + relative)
+            files.append({
+                "path": relative,
+                "deleted": False,
+                "sha256": sha256(data),
+                "content_b64": base64.b64encode(data).decode("ascii"),
+            })
+        else:
+            files.append({"path": relative, "deleted": True, "sha256": None, "content_b64": None})
+    return files
+
+
+def execute_request(request_path: Path, result_path: Path) -> None:
+    assert_uncredentialed()
+    request = json.loads(request_path.read_text(encoding="utf-8"))
+    if request.get("schema") != "aios.isolated-execution.request.v1":
+        raise IsolatedExecutorError("REQUEST_SCHEMA_INVALID")
+    request_id = request.get("request_id")
+    if not isinstance(request_id, str) or not REQUEST_ID_RE.fullmatch(request_id):
+        raise IsolatedExecutorError("REQUEST_ID_INVALID")
+    source_archive = Path(str(request.get("source_archive") or ""))
+    if not source_archive.is_absolute():
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
+    expected_archive_sha = str(request.get("source_archive_sha256") or "")
+    if sha256(source_archive.read_bytes()) != expected_archive_sha:
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_SHA_MISMATCH")
+    with tempfile.TemporaryDirectory(prefix="aios-isolated-executor-") as temporary:
+        root = Path(temporary) / "workspace"
+        root.mkdir()
+        extract_source(source_archive, root)
+        changed = apply_changes(request, root)
+        commands = [
+            run_command(item, root)
+            for item in request.get("verification", [])
+            if isinstance(item, Mapping)
+        ]
+        result = {
+            "schema": "aios.isolated-execution.result.v1",
+            "request_id": request_id,
+            "request_sha256": sha256(canonical(request)),
+            "changed_files": changed_bundle(root, changed),
+            "verification": commands,
+            "credential_isolation": {
+                "credential_env_absent": True,
+                "credential_mount_inaccessible": True,
+                "governed_bridge_unreachable": True,
+            },
+        }
+        result["result_sha256"] = sha256(canonical(result))
+        temporary_result = result_path.with_suffix(".tmp")
+        temporary_result.write_text(json.dumps(result, sort_keys=True, separators=(",", ":")), encoding="utf-8")
+        os.replace(temporary_result, result_path)
+
+
+def serve(root: Path) -> None:
+    assert_uncredentialed()
+    requests = root / "requests"
+    results = root / "results"
+    failed = root / "failed"
+    for path in (requests, results, failed):
+        path.mkdir(parents=True, exist_ok=True)
+    while True:
+        for request in sorted(requests.glob("*.json")):
+            if request.is_symlink():
+                continue
+            result = results / request.name
+            try:
+                execute_request(request, result)
+                request.unlink()
+            except Exception as exc:
+                (failed / request.name).write_text(
+                    json.dumps({"error": str(exc) or type(exc).__name__}, sort_keys=True),
+                    encoding="utf-8",
+                )
+                request.unlink(missing_ok=True)
+        time.sleep(0.5)
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--root", default="/var/lib/aios-online-agent-executor")
+    parser.add_argument("--request")
+    parser.add_argument("--result")
+    args = parser.parse_args()
+    if args.request and args.result:
+        execute_request(Path(args.request), Path(args.result))
+    else:
+        serve(Path(args.root))

active-runtime/app/aios_online_agent_execution.py

@@ -0,0 +1,397 @@
+"""Canonical governed execution projection for Online Agent Tasks.
+
+The durable governed binding is authoritative.  Natural-language task fields and
+worker configuration are never allowed to invent repository, ref, generation, or
+idempotency coordinates.
+"""
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass
+import hashlib
+import json
+import re
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+import urllib.error
+import urllib.request
+
+
+EXECUTION_SCHEMA = "aios.online-agent.execution.v2"
+PROJECTION_SCHEMA = "aios.online-agent.task-projection.v1"
+OID_RE = re.compile(r"^[0-9a-f]{40}$")
+TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
+BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
+KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
+PROTECTED_PREFIXES = ("main", "master", "refs/", "tags/", "tag/", "release/", "baseline/", "production/")
+MUTATION_ACTIONS = frozenset({"deterministic"})
+SUPPORTED_ACTIONS = frozenset({"deterministic", "source_capture"})
+
+
+class ExecutionProjectionError(RuntimeError):
+    """A canonical fail-closed projection or validation error."""
+
+
+class OnlineTaskProjectionClient:
+    """Official HTTP projection client using only a control credential reference."""
+
+    def __init__(self, api_base: str, control_token_path: Path) -> None:
+        self.api_base = api_base.rstrip("/")
+        self.control_token_path = Path(control_token_path)
+
+    def _token(self) -> str:
+        path = self.control_token_path
+        if path.is_symlink() or not path.is_file():
+            _error("ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE")
+        value = path.read_text(encoding="utf-8").strip()
+        if len(value) < 32:
+            _error("ONLINE_TASK_PROJECTION_CONTROL_INVALID")
+        return value
+
+    def create(
+        self,
+        projected_task: Mapping[str, Any],
+        *,
+        binding: "GovernedExecutionBinding",
+    ) -> dict[str, Any]:
+        body = dict(projected_task)
+        payload = _canonical(body).encode("utf-8")
+        request = urllib.request.Request(
+            self.api_base + "/v1/tasks",
+            method="POST",
+            data=payload,
+            headers={
+                "Authorization": "Bearer " + self._token(),
+                "Content-Type": "application/json",
+                "Accept": "application/json",
+            },
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=15) as response:
+                result = json.loads(response.read().decode("utf-8"))
+                status = response.status
+        except urllib.error.HTTPError as exc:
+            raw = exc.read(8192).decode("utf-8", "replace")
+            try:
+                error = json.loads(raw).get("error")
+            except (AttributeError, json.JSONDecodeError):
+                error = "HTTP_ERROR"
+            raise ExecutionProjectionError(f"ONLINE_TASK_PROJECTION_FAILED:{exc.code}:{error}") from exc
+        except (OSError, urllib.error.URLError, TimeoutError) as exc:
+            raise ExecutionProjectionError("ONLINE_TASK_PROJECTION_UNAVAILABLE") from exc
+        if status not in {200, 201} or not isinstance(result, dict):
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
+        if result.get("task_id") != binding.task_id or result.get("status") not in {"QUEUED", "VERIFYING", "SUCCEEDED"}:
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
+        metadata = result.get("metadata")
+        if not isinstance(metadata, Mapping):
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
+        returned_execution = validate_execution_envelope(
+            _object(metadata.get("execution"), "ONLINE_TASK_PROJECTION_RESPONSE_INVALID"),
+            binding=binding,
+        )
+        submitted_metadata = _object(body.get("metadata"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID")
+        submitted_execution = validate_execution_envelope(
+            _object(submitted_metadata.get("execution"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID"),
+            binding=binding,
+        )
+        if _canonical(returned_execution) != _canonical(submitted_execution):
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_BINDING_INVALID")
+        return result
+
+
+def _error(code: str) -> None:
+    raise ExecutionProjectionError(code)
+
+
+def _object(value: object, code: str) -> dict[str, Any]:
+    if not isinstance(value, Mapping):
+        _error(code)
+    return dict(value)
+
+
+def _string(value: object, code: str) -> str:
+    if not isinstance(value, str) or not value.strip():
+        _error(code)
+    return value.strip()
+
+
+def _task_id(value: object) -> str:
+    value = _string(value, "TASK_ID_INVALID")
+    if TASK_RE.fullmatch(value) is None:
+        _error("TASK_ID_INVALID")
+    return value
+
+
+def _oid(value: object, code: str) -> str:
+    value = _string(value, code)
+    if OID_RE.fullmatch(value) is None:
+        _error(code)
+    return value
+
+
+def _branch(value: object) -> str:
+    value = _string(value, "TARGET_BRANCH_INVALID")
+    if BRANCH_RE.fullmatch(value) is None or value.startswith(PROTECTED_PREFIXES):
+        _error("TARGET_BRANCH_INVALID")
+    return value
+
+
+def _generation(value: object) -> int:
+    if not isinstance(value, int) or isinstance(value, bool) or value < 1:
+        _error("GENERATION_INVALID")
+    return value
+
+
+def _canonical(value: object) -> str:
+    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+
+
+def _digest(value: object) -> str:
+    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
+
+
+def _source_signals(value: object) -> tuple[str, ...]:
+    """Normalize untrusted natural-language hints before they enter a signed envelope."""
+    if value is None:
+        return ()
+    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
+        _error("SOURCE_CAPTURE_SIGNALS_INVALID")
+    result: list[str] = []
+    for item in value:
+        if not isinstance(item, str):
+            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
+        text = " ".join(item.split()).strip()
+        if not text:
+            continue
+        # Projection may accept long task prose, but execution envelopes stay bounded.
+        text = text[:512].rstrip()
+        if text not in result:
+            result.append(text)
+        if len(result) == 16:
+            break
+    return tuple(result)
+
+
+def _capabilities(value: object) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
+        _error("CAPABILITY_SCOPE_INVALID")
+    result = tuple(sorted({_string(item, "CAPABILITY_SCOPE_INVALID") for item in value}))
+    if any(len(item) > 120 for item in result):
+        _error("CAPABILITY_SCOPE_INVALID")
+    return result
+
+
+@dataclass(frozen=True, slots=True)
+class GovernedExecutionBinding:
+    task_id: str
+    job_id: str
+    repository: str
+    base_oid: str
+    expected_branch_oid: str
+    target_branch: str
+    branch_mode: str
+    generation: int
+    idempotency_key: str
+
+    @classmethod
+    def from_mapping(cls, value: Mapping[str, Any]) -> "GovernedExecutionBinding":
+        data = dict(value)
+        task_id = _task_id(data.get("task_id"))
+        job_id = _string(data.get("job_id"), "JOB_ID_REQUIRED")
+        if TASK_RE.fullmatch(job_id) is None:
+            _error("JOB_ID_INVALID")
+        repository = _string(data.get("repository"), "REPOSITORY_INVALID")
+        if repository != "aios/aios":
+            _error("WRONG_REPOSITORY_ENVELOPE_DENY")
+        base_oid = _oid(data.get("base_oid"), "BASE_OID_INVALID")
+        expected = _oid(data.get("expected_branch_oid"), "EXPECTED_BRANCH_OID_INVALID")
+        target = _branch(data.get("target_branch"))
+        mode = _string(data.get("branch_mode"), "BRANCH_MODE_MISSING")
+        if mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
+            _error("BRANCH_MODE_INVALID")
+        generation = _generation(data.get("generation"))
+        if mode == "CREATE_NEW" and expected != base_oid:
+            _error("EXPECTED_BASE_CONFLICT")
+        key = _string(data.get("idempotency_key"), "IDEMPOTENCY_KEY_INVALID")
+        if KEY_RE.fullmatch(key) is None:
+            _error("IDEMPOTENCY_KEY_INVALID")
+        return cls(task_id, job_id, repository, base_oid, expected, target, mode, generation, key)
+
+    def public(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+def binding_from_bootstrap(value: Mapping[str, Any]) -> GovernedExecutionBinding:
+    return GovernedExecutionBinding.from_mapping(value)
+
+
+def validate_execution_envelope(
+    value: Mapping[str, Any],
+    *,
+    binding: GovernedExecutionBinding | None = None,
+    worker_capabilities: Sequence[str] | None = None,
+) -> dict[str, Any]:
+    envelope = dict(value)
+    if envelope.get("schema") != EXECUTION_SCHEMA:
+        _error("EXECUTION_ENVELOPE_SCHEMA_VALIDATION")
+    candidate = GovernedExecutionBinding.from_mapping(envelope)
+    if binding is not None and candidate != binding:
+        comparisons = (
+            (candidate.task_id, binding.task_id, "TASK_BINDING_CONFLICT"),
+            (candidate.job_id, binding.job_id, "JOB_BINDING_CONFLICT"),
+            (candidate.repository, binding.repository, "WRONG_REPOSITORY_ENVELOPE_DENY"),
+            (candidate.base_oid, binding.base_oid, "WRONG_BASE_ENVELOPE_DENY"),
+            (candidate.expected_branch_oid, binding.expected_branch_oid, "WRONG_EXPECTED_HEAD_ENVELOPE_DENY"),
+            (candidate.target_branch, binding.target_branch, "WRONG_BRANCH_ENVELOPE_DENY"),
+            (candidate.generation, binding.generation, "WRONG_GENERATION_ENVELOPE_DENY"),
+            (candidate.branch_mode, binding.branch_mode, "BRANCH_MODE_BINDING_CONFLICT"),
+            (candidate.idempotency_key, binding.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
+        )
+        for actual, expected, code in comparisons:
+            if actual != expected:
+                _error(code)
+    action = _string(envelope.get("action"), "EXECUTION_ACTION_MISSING")
+    if action not in SUPPORTED_ACTIONS:
+        _error("EXECUTION_ACTION_UNSUPPORTED")
+    capability_scope = _capabilities(envelope.get("capability_scope"))
+    if worker_capabilities is not None and not set(capability_scope).issubset(set(worker_capabilities)):
+        _error("CAPABILITY_MISMATCH_DENY")
+    workspace = _object(envelope.get("workspace"), "WORKSPACE_POLICY_REQUIRED")
+    if workspace.get("authority_git_dir") != "/data/aios-gitops/repo.git" or workspace.get("read_only_repository") is not True:
+        _error("WORKSPACE_POLICY_DENY")
+    governance = _object(envelope.get("governance"), "GOVERNANCE_POLICY_REQUIRED")
+    governed_coordinates = (
+        (governance.get("task_id"), candidate.task_id, "TASK_BINDING_CONFLICT"),
+        (governance.get("job_id"), candidate.job_id, "JOB_BINDING_CONFLICT"),
+        (governance.get("idempotency_key"), candidate.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
+    )
+    for actual_coordinate, expected_coordinate, code in governed_coordinates:
+        if actual_coordinate != expected_coordinate:
+            _error(code)
+    commit_key = _string(governance.get("commit_idempotency_key"), "COMMIT_IDEMPOTENCY_KEY_INVALID")
+    if KEY_RE.fullmatch(commit_key) is None:
+        _error("COMMIT_IDEMPOTENCY_KEY_INVALID")
+    if governance.get("writer_lease") is not (action in MUTATION_ACTIONS):
+        _error("WRITER_LEASE_POLICY_DENY")
+    for field in ("main_write", "production_write", "tag_write", "baseline_write", "force_push", "protected_ref_bypass"):
+        if governance.get(field, False) is not False:
+            _error("POLICY_DENY")
+    changes = envelope.get("change_set")
+    verification = envelope.get("verification")
+    if not isinstance(changes, list) or not isinstance(verification, list):
+        _error("EXECUTION_OPERATIONS_INVALID")
+    if action == "source_capture":
+        if changes or verification:
+            _error("SOURCE_CAPTURE_MUTATION_DENY")
+        signals = list(_source_signals(envelope.get("source_signals") or []))
+        if envelope.get("source_signals") != signals:
+            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
+    elif not changes:
+        _error("CHANGE_SET_INVALID")
+    declared = str(envelope.get("execution_digest") or "")
+    material = {key: item for key, item in envelope.items() if key != "execution_digest"}
+    actual = _digest(material)
+    if declared != actual:
+        _error("EXECUTION_DIGEST_INVALID")
+    return {**material, "execution_digest": actual}
+
+
+def project_execution_envelope(
+    binding: GovernedExecutionBinding,
+    execution_request: Mapping[str, Any] | None = None,
+    *,
+    required_capabilities: Sequence[str] = (),
+) -> dict[str, Any]:
+    request = dict(execution_request or {})
+    action = str(request.get("action") or "source_capture")
+    if action not in SUPPORTED_ACTIONS:
+        _error("EXECUTION_ACTION_UNSUPPORTED")
+    capabilities = _capabilities(request.get("capability_scope", required_capabilities))
+    governance = {
+        "task_id": binding.task_id,
+        "job_id": binding.job_id,
+        "idempotency_key": binding.idempotency_key,
+        "commit_idempotency_key": str(request.get("commit_idempotency_key") or f"{binding.task_id}-commit-g{binding.generation}"),
+        "writer_lease": action in MUTATION_ACTIONS,
+        "main_write": False,
+        "production_write": False,
+        "tag_write": False,
+        "baseline_write": False,
+        "force_push": False,
+        "protected_ref_bypass": False,
+    }
+    supplied_governance = request.get("governance")
+    if supplied_governance is not None:
+        governance.update(_object(supplied_governance, "GOVERNANCE_POLICY_REQUIRED"))
+    material: dict[str, Any] = {
+        "schema": EXECUTION_SCHEMA,
+        **binding.public(),
+        "action": action,
+        "adapter": str(request.get("adapter") or ("deterministic" if action == "deterministic" else "source_capture")),
+        "capability_scope": list(capabilities),
+        "change_set": list(request.get("change_set") or []),
+        "verification": list(request.get("verification") or []),
+        "source_signals": list(_source_signals(request.get("source_signals") or [])) if action == "source_capture" else [],
+        "governance": governance,
+        "workspace": {
+            "authority_git_dir": "/data/aios-gitops/repo.git",
+            "read_only_repository": True,
+            "cleanup_policy": "always",
+        },
+    }
+    envelope = {**material, "execution_digest": _digest(material)}
+    return validate_execution_envelope(envelope, binding=binding)
+
+
+def project_online_task(
+    binding: GovernedExecutionBinding,
+    task_request: Mapping[str, Any],
+    execution_request: Mapping[str, Any] | None = None,
+) -> dict[str, Any]:
+    request = dict(task_request)
+    required = _capabilities(request.get("required_capabilities"))
+    execution = project_execution_envelope(binding, execution_request, required_capabilities=required)
+    metadata = dict(request.get("metadata") or {})
+    if "execution" in metadata:
+        validate_execution_envelope(_object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"), binding=binding)
+        if metadata["execution"] != execution:
+            _error("EXECUTION_PROJECTION_CONFLICT")
+    metadata["execution"] = execution
+    metadata["execution_projection"] = {
+        "schema": PROJECTION_SCHEMA,
+        "task_id": binding.task_id,
+        "job_id": binding.job_id,
+        "execution_digest": execution["execution_digest"],
+    }
+    return {
+        **request,
+        "task_id": binding.task_id,
+        "metadata": metadata,
+        "required_capabilities": list(required),
+        "idempotency_key": str(request.get("idempotency_key") or f"online-task:{binding.idempotency_key}"),
+    }
+
+
+def resolve_task_execution(
+    task: Mapping[str, Any],
+    binding: GovernedExecutionBinding,
+    *,
+    worker_capabilities: Sequence[str] | None = None,
+) -> tuple[dict[str, Any], str]:
+    metadata = task.get("metadata")
+    if isinstance(metadata, Mapping) and "execution" in metadata:
+        value = validate_execution_envelope(
+            _object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"),
+            binding=binding,
+            worker_capabilities=worker_capabilities,
+        )
+        return value, "persisted"
+    projected = project_execution_envelope(
+        binding,
+        {"action": "source_capture", "capability_scope": task.get("required_capabilities") or []},
+        required_capabilities=task.get("required_capabilities") or [],
+    )
+    validate_execution_envelope(projected, binding=binding, worker_capabilities=worker_capabilities)
+    return projected, "recovered_projection"

active-runtime/app/aios_online_agent_plan_store.py

@@ -0,0 +1,187 @@
+"""Durable, authority-bound deterministic execution plans for Online Agent Tasks."""
+from __future__ import annotations
+
+from contextlib import contextmanager
+from dataclasses import dataclass
+import fcntl
+import hashlib
+import json
+from pathlib import Path
+from typing import Any, Mapping
+
+from aios_online_agent_execution import (
+    GovernedExecutionBinding,
+    project_execution_envelope,
+)
+
+
+class ExecutionPlanError(RuntimeError):
+    pass
+
+
+def _canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def _digest(value: object) -> str:
+    return hashlib.sha256(_canonical(value)).hexdigest()
+
+
+def _task_key(task_id: str) -> str:
+    readable = "".join(ch if ch.isalnum() or ch in "._-" else "-" for ch in task_id).strip("-")[:72] or "task"
+    return readable + "-" + hashlib.sha256(task_id.encode("utf-8")).hexdigest()[:24]
+
+
+@dataclass(frozen=True)
+class ExecutionPlanRecord:
+    task_id: str
+    job_id: str
+    source_head_oid: str
+    generation: int
+    idempotency_key: str
+    plan_digest: str
+    execution: dict[str, Any]
+
+    def public(self) -> dict[str, Any]:
+        return {
+            "schema": "aios.online-agent.plan-record.v1",
+            "task_id": self.task_id,
+            "job_id": self.job_id,
+            "source_head_oid": self.source_head_oid,
+            "generation": self.generation,
+            "idempotency_key": self.idempotency_key,
+            "plan_digest": self.plan_digest,
+            "execution": dict(self.execution),
+        }
+
+
+class ExecutionPlanStore:
+    def __init__(self, root: Path) -> None:
+        self.root = Path(root)
+        self.root.mkdir(parents=True, exist_ok=True)
+
+    def _path(self, task_id: str) -> Path:
+        return self.root / (_task_key(task_id) + ".json")
+
+    @contextmanager
+    def _lock(self, task_id: str):
+        path = self.root / (_task_key(task_id) + ".lock")
+        with path.open("a+b") as handle:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+
+    @staticmethod
+    def _source_head(binding: GovernedExecutionBinding) -> str:
+        return binding.expected_branch_oid if binding.branch_mode == "CONTINUE_EXISTING" else binding.base_oid
+
+    def _read(self, task_id: str) -> ExecutionPlanRecord | None:
+        path = self._path(task_id)
+        if not path.is_file() or path.is_symlink():
+            return None
+        value = json.loads(path.read_text(encoding="utf-8"))
+        if not isinstance(value, Mapping) or value.get("schema") != "aios.online-agent.plan-record.v1":
+            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
+        execution = value.get("execution")
+        if not isinstance(execution, Mapping):
+            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
+        return ExecutionPlanRecord(
+            task_id=str(value.get("task_id") or ""),
+            job_id=str(value.get("job_id") or ""),
+            source_head_oid=str(value.get("source_head_oid") or ""),
+            generation=int(value.get("generation") or 0),
+            idempotency_key=str(value.get("idempotency_key") or ""),
+            plan_digest=str(value.get("plan_digest") or ""),
+            execution=dict(execution),
+        )
+
+    def register(
+        self,
+        binding: GovernedExecutionBinding,
+        request: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        with self._lock(binding.task_id):
+            return self._register_locked(binding, request)
+
+    def _register_locked(
+        self,
+        binding: GovernedExecutionBinding,
+        request: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        if request.get("schema") != "aios.online-agent.plan.v1":
+            raise ExecutionPlanError("EXECUTION_PLAN_SCHEMA_INVALID")
+        if request.get("task_id") != binding.task_id or request.get("job_id") != binding.job_id:
+            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
+        if int(request.get("generation") or 0) != binding.generation:
+            raise ExecutionPlanError("EXECUTION_PLAN_GENERATION_CONFLICT")
+        source_head = str(request.get("source_head_oid") or "")
+        if source_head != self._source_head(binding):
+            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_CONFLICT")
+        key = str(request.get("idempotency_key") or "")
+        if len(key) < 8:
+            raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_INVALID")
+        execution_request = request.get("execution")
+        if not isinstance(execution_request, Mapping) or execution_request.get("action") != "deterministic":
+            raise ExecutionPlanError("EXECUTION_PLAN_DETERMINISTIC_REQUIRED")
+        envelope = project_execution_envelope(binding, execution_request)
+        material = {
+            "task_id": binding.task_id,
+            "job_id": binding.job_id,
+            "source_head_oid": source_head,
+            "generation": binding.generation,
+            "idempotency_key": key,
+            "execution": dict(execution_request),
+        }
+        plan_digest = _digest(material)
+        existing = self._read(binding.task_id)
+        expected_previous = request.get("expected_previous_plan_digest")
+        if existing is not None:
+            if existing.idempotency_key == key:
+                if existing.plan_digest != plan_digest:
+                    raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_CONFLICT")
+                return {**existing.public(), "idempotent": True, "execution_digest": envelope["execution_digest"]}
+            if expected_previous != existing.plan_digest:
+                raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
+            if existing.source_head_oid != source_head:
+                raise ExecutionPlanError("EXECUTION_PLAN_STALE_REPLACEMENT_DENY")
+        elif expected_previous not in (None, ""):
+            raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
+
+        record = ExecutionPlanRecord(
+            task_id=binding.task_id,
+            job_id=binding.job_id,
+            source_head_oid=source_head,
+            generation=binding.generation,
+            idempotency_key=key,
+            plan_digest=plan_digest,
+            execution=dict(execution_request),
+        )
+        path = self._path(binding.task_id)
+        temporary = path.with_suffix(".tmp")
+        temporary.write_text(
+            json.dumps(record.public(), sort_keys=True, separators=(",", ":")),
+            encoding="utf-8",
+        )
+        temporary.replace(path)
+        return {**record.public(), "idempotent": False, "execution_digest": envelope["execution_digest"]}
+
+    def resolve(self, binding: GovernedExecutionBinding) -> dict[str, Any] | None:
+        record = self._read(binding.task_id)
+        if record is None:
+            return None
+        if (
+            record.task_id != binding.task_id
+            or record.job_id != binding.job_id
+            or record.generation != binding.generation
+        ):
+            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
+        if record.source_head_oid != self._source_head(binding):
+            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_DRIFT")
+        envelope = project_execution_envelope(binding, record.execution)
+        return {
+            "execution": dict(record.execution),
+            "plan_digest": record.plan_digest,
+            "execution_digest": envelope["execution_digest"],
+        }

deploy/systemd/aios-agent-task-retry-extension.service

@@ -0,0 +1,36 @@
+[Unit]
+Description=AIOS owner-controlled Task retry-extension API
+After=aios-agent-task-api.service
+Wants=aios-agent-task-api.service
+
+[Service]
+Type=simple
+User=aios-agent-task
+Group=aios-agent-task
+LoadCredential=agent_task_control_token:/etc/aios-gitops/agent-task-control.token
+EnvironmentFile=/etc/aios-gitops/agent-task-retry-extension.env
+Environment=AIOS_AGENT_TASK_DB=/var/lib/aios-agent-task/state.sqlite3
+Environment=AIOS_AGENT_TASK_CONTROL_TOKEN_FILE=%d/agent_task_control_token
+Environment=AIOS_TASK_RETRY_HOST=127.0.0.1
+Environment=AIOS_TASK_RETRY_PORT=18941
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_agent_task_retry_extension.py
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET
+ReadWritePaths=/var/lib/aios-agent-task
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-chatgpt-bridge-v2-agent-task-projection.conf

@@ -0,0 +1,5 @@
+[Service]
+LoadCredential=agent_task_control_token:/etc/aios-gitops/agent-task-control.token
+Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
+Environment=AIOS_ONLINE_TASK_PROJECTION_ENABLED=1
+Environment=AIOS_AGENT_TASK_CONTROL_TOKEN_FILE=%d/agent_task_control_token

deploy/systemd/aios-online-agent-isolated-executor.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=AIOS uncredentialed deterministic Planner/Executor
+After=local-fs.target
+
+[Service]
+Type=simple
+User=aios-engineering-executor
+Group=aios-executor-exchange
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_isolated_executor.py --root /var/lib/aios-online-agent-executor
+Restart=always
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateNetwork=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET
+IPAddressDeny=any
+IPAddressAllow=localhost
+InaccessiblePaths=/run/credentials
+ReadWritePaths=/var/lib/aios-online-agent-executor
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-online-agent-worker.service

@@ -0,0 +1,45 @@
+[Unit]
+Description=AIOS governed Online Agent Worker
+After=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+Wants=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+
+[Service]
+Type=simple
+User=aios-engineering-worker
+Group=aios-engineering-worker
+SupplementaryGroups=gitops aios-executor-exchange
+LoadCredentialEncrypted=agent_token:/etc/credstore.encrypted/aios-online-agent-worker-20260815/agent_token
+Environment=PYTHONUNBUFFERED=1
+Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
+Environment=AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:18892
+Environment=AIOS_AGENT_ID=online-engineering-worker
+Environment=AIOS_AGENT_TYPE=trusted-online-engineering-worker
+Environment=AIOS_AGENT_VERSION=2026-08-17.1-dynamic
+Environment=AIOS_WORKER_CAPABILITIES=git.read,git.test,governed.write.branch,governed.write.file
+Environment=AIOS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
+Environment=AIOS_ISOLATED_EXECUTOR_ROOT=/var/lib/aios-online-agent-executor
+Environment=AIOS_WORKER_STATE_ROOT=/var/lib/aios-online-agent-worker
+Environment=AIOS_WORKER_WORKSPACE_ROOT=/var/lib/aios-online-agent-worker/workspaces
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_online_agent_worker.py
+Restart=always
+RestartSec=5
+TimeoutStopSec=20
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadOnlyPaths=/data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-online-agent-worker
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-online-engineering-consumer.service

@@ -0,0 +1,45 @@
+[Unit]
+Description=AIOS trusted dynamic engineering consumer
+After=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+Wants=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+
+[Service]
+Type=simple
+User=aios-engineering-worker
+Group=aios-engineering-worker
+SupplementaryGroups=gitops aios-executor-exchange
+LoadCredentialEncrypted=agent_token:/etc/credstore.encrypted/aios-online-engineering-20260815/agent_token
+Environment=PYTHONUNBUFFERED=1
+Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
+Environment=AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:18892
+Environment=AIOS_AGENT_ID=online-engineering-consumer
+Environment=AIOS_AGENT_TYPE=trusted-online-engineering-worker
+Environment=AIOS_AGENT_VERSION=2026-08-17.1-dynamic
+Environment=AIOS_WORKER_CAPABILITIES=git.read,git.test,governed.write.branch,governed.write.file
+Environment=AIOS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
+Environment=AIOS_ISOLATED_EXECUTOR_ROOT=/var/lib/aios-online-agent-executor
+Environment=AIOS_WORKER_STATE_ROOT=/var/lib/aios-online-engineering-consumer
+Environment=AIOS_WORKER_WORKSPACE_ROOT=/var/lib/aios-online-engineering-consumer/workspaces
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_online_agent_worker.py
+Restart=always
+RestartSec=5
+TimeoutStopSec=20
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadOnlyPaths=/data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-online-engineering-consumer
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/sysusers.d/aios-online-agent-executor.conf

@@ -0,0 +1,4 @@
+g aios-executor-exchange -
+u aios-engineering-executor - "AIOS isolated engineering executor" /var/lib/aios-online-agent-executor /usr/sbin/nologin
+m aios-engineering-executor aios-executor-exchange
+m aios-engineering-worker aios-executor-exchange

deploy/tmpfiles.d/aios-online-agent-executor.conf

@@ -0,0 +1,5 @@
+d /var/lib/aios-online-agent-executor 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/requests 2770 aios-engineering-worker aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/results 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/failed 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/sources 2770 aios-engineering-worker aios-executor-exchange -

docs/superpowers/specs/2026-08-17-online-agent-auto-claim-design.md

@@ -0,0 +1,134 @@
+# Online Agent Automatic Claim Infrastructure
+
+## Status and fixed boundary
+
+This candidate targets `p0-claim-online-agent-auto-execution-20260817` on governed Job
+`job-2031a9e5682a4238f98e3ac7aee8a593`, base
+`a642b045775b9154a00ae78543037fbef4fb447b`, target branch
+`agent/p0-claim-online-agent-auto-execution-20260817`, generation 1.
+
+It does not authorize protected-main, Production, tag, baseline, raw Git, Task DB, or
+credential mutations.
+
+## Considered approaches
+
+1. Require every caller to write `metadata.execution`. This is simple but preserves the
+   current operational gap: a valid governed Job can still project an unexecutable Online
+   Task.
+2. Let workers infer repository and WriterLease coordinates from natural-language Task
+   fields. This removes the skip but violates fail-closed lineage and can bind the wrong Job,
+   branch, base, or generation.
+3. Use a canonical server-side projector plus a task-agnostic worker resolver. This is the
+   selected approach. The governed binding remains the only authority for repository, Job,
+   branch, base, expected head, generation, and idempotency. Producers can persist the
+   projected envelope when creating the Online Task. A worker may recover an omitted envelope
+   only from the same canonical projector and durable binding; it never guesses coordinates.
+
+## Components
+
+### Canonical execution contract
+
+`aios_online_agent_execution.py` owns schema `aios.online-agent.execution.v2`. It validates
+the complete governed lineage and supports two explicit actions:
+
+- `deterministic`: a hash-bound change set, verification commands, and governed commit;
+- `source_capture`: a read-only first attempt that returns `NEEDS_REWORK_SOURCE_CAPTURE` and
+  cannot acquire WriterLease or mutate Git.
+
+Wrong task, Job, repository, base, expected head, branch, generation, capability scope, or
+governance policy fails closed with a canonical diagnostic.
+
+### Governed Job to Online Task projection
+
+`GovernedTaskBootstrap` exposes an exact durable binding lookup and builds Online Task
+projection data through the canonical contract. When the Bridge is configured with the
+official Agent Task control credential reference, governed Job creation submits that complete
+projection through the official Task HTTP API. The Bridge also exposes a loopback envelope
+projection operation used for recovery. The persisted projection includes the versioned
+envelope rather than relying on manual metadata edits.
+
+Projection delivery is a durable outbox, not a best-effort tail call. The outbox record is
+written before HTTP delivery and a Bridge reconciler retries it after transient API failure or
+process restart. A response is accepted only when its complete execution envelope equals the
+submitted projection. Requests that explicitly require projection are rejected before governed
+bootstrap when the projection principal is unavailable.
+
+Loopback is not treated as an identity boundary. Every POST route requires an exact
+runtime-principal bearer credential supplied by systemd credential projection; unauthenticated
+local callers are denied before request dispatch. The control-plane credential used to create
+Online Tasks remains a separate Bridge-only reference and is never projected into the worker.
+
+For legacy Online Tasks with an omitted envelope, the generic worker asks the same Bridge
+operation for a read-only `source_capture` envelope. Projection succeeds only when the exact
+durable binding exists. An omitted envelope is therefore recoverable; an invalid envelope is
+never replaced or weakened.
+
+Persisted envelopes are also reprojected through the Bridge before claim and compared by exact
+digest and Job lineage. A self-consistent client-generated envelope is therefore not authority.
+
+### Dynamic worker and trusted consumer
+
+The repository gains a deployable generic worker and systemd unit definitions as governed
+source files. The worker validates or
+resolves an envelope before claim, revalidates after atomic claim, starts heartbeat, and then
+executes the selected action. The trusted engineering consumer uses this same task-agnostic
+entrypoint. No compiled worker contains a Task ID, base OID, branch, generation, or plan path.
+
+Skip observability distinguishes:
+
+- `TASK_SKIPPED_PROJECTION_MISSING`;
+- `TASK_SKIPPED_ENVELOPE_INVALID`;
+- `TASK_SKIPPED_CAPABILITY_MISMATCH`;
+- `TASK_SKIPPED_POLICY_DENY`;
+- `TASK_POLL_FAILED` / worker unavailable.
+
+## State flow
+
+```text
+Governed Job BOUND
+  -> canonical durable binding
+  -> Online Task projection with execution.v2
+  -> capability-filtered poll
+  -> envelope and lineage validation
+  -> atomic claim
+  -> initial heartbeat/start
+  -> refetch Task and re-resolve envelope
+  -> compare execution digest and Job
+  -> source capture OR deterministic governed execution
+  -> result construction
+  -> result submission
+  -> external server-side verification gate
+```
+
+Legacy omission uses `binding -> source_capture projection` between poll and validation. It
+does not write Task metadata and does not convert a malformed envelope into a valid one.
+
+## Recovery and safety
+
+- Projection is deterministic and digest-bound.
+- Governed Task creation is serialized by a cross-process, Task-ID-digest lock. Durable paths
+  use collision-resistant exact Task keys while retaining read compatibility with verified
+  legacy bindings.
+- A new Task cannot adopt an existing branch from caller-selected generation data. It must name
+  an exact durable parent Task/Job whose single ACTIVE lease owns the branch head; generation is
+  then derived from that lease.
+- Claim is attempted only after validation; claimed payload drift is denied.
+- Source capture has no WriterLease or commit path.
+- Deterministic execution retains detached worktree, exact WriterLease, governed commit,
+  durable current-head CAS, and receipt convergence.
+- Local deterministic recovery is keyed by Task and execution digest; live acceptance must
+  independently reconverge Job, lease, receipt, and branch OIDs before verification.
+- An ambiguous commit transport or server outcome becomes `RECONCILIATION_REQUIRED`; the
+  worker does not submit a canonical failure until exact Job receipt and head evidence is
+  observed.
+- A completed read-only `source_capture` state is ignored when a later attempt has a changed
+  digest and no governed state exists; all other digest drift is denied.
+- Protected refs are never worker targets.
+
+## Acceptance
+
+The implementation must pass the named projection, schema, claimability, dynamic-binding,
+wrong-lineage, capability, P0-A, and P0-B tests. Runtime acceptance additionally requires a
+real Online Task to be claimed and heartbeated without per-task worker or systemd plan
+injection, plus governed receipt/OID/CAS convergence for this implementation Task.
+Unit tests and deployable unit definitions do not by themselves satisfy runtime acceptance.

docs/superpowers/specs/2026-08-17-p0-claim-scheme-a-followup.md

@@ -0,0 +1,56 @@
+# P0-CLAIM Scheme A follow-up
+
+This follow-up continues the existing candidate `71523aef6e48b1e2fa516c456ca189b7a039104b`.
+It does not create a replacement Task, Job, branch or generation.
+
+## Retry extension
+
+A versioned Owner-controlled loopback API provides
+`POST /v1/tasks/{task_id}/retry-extension`.
+
+The request binds FAILED status, revision, exhausted attempt/max_attempts, next max attempts,
+previous verification SHA256, Owner authorization ID and idempotency key. The service performs one
+SQLite `BEGIN IMMEDIATE` transaction containing the CAS update, durable retry-extension record and
+Task event. Each authorization extends the boundary by exactly one attempt.
+
+## Same-Job continuation
+
+The durable GovernedTask binding remains the lineage anchor. After the first CREATE_NEW commit,
+`execution_binding()` may normalize that SAME Job to `CONTINUE_EXISTING` only when exactly one
+ACTIVE WriterLease for the Job owns the current authority branch head, generation and lineage
+anchor. The lineage `base_oid` stays unchanged; only `expected_branch_oid` becomes the current head.
+
+GovernedTask creation is also serialized by a branch-digest lock, preventing sibling continuation
+tasks from racing generation admission.
+
+## Projection and recovery
+
+Natural-language source signals are normalized server-side to at most 16 unique 512-byte values.
+Malformed persisted envelopes still fail closed.
+
+Fresh commits and recovery require a COMPLETED Job, `remote_verified=true`, exact
+authority/API/remote receipt OIDs, and exactly one ACTIVE WriterLease whose durable current head
+matches the commit. Delayed local ref visibility becomes `RECONCILIATION_REQUIRED`, not a terminal
+canonical failure.
+
+## Credential isolation
+
+The credentialed Coordinator performs only Task/Bridge coordination and governed commit. All
+deterministic repository modification and test commands run in
+`aios-online-agent-isolated-executor` under a separate system user with:
+
+- no Agent/Owner credential projection;
+- no gitops supplementary group;
+- `PrivateNetwork=true`;
+- `RestrictAddressFamilies=AF_UNIX AF_INET`, with `IPAddressDeny=any` and
+  `IPAddressAllow=localhost`, so regression tests may use an isolated loopback
+  HTTP server without gaining host or external network reachability;
+- `InaccessiblePaths=/run/credentials`.
+
+The executor receives a hash-bound source archive and deterministic change set through a filesystem
+exchange and returns only changed file bytes/hashes plus command evidence. The Coordinator validates
+that response before materializing exact allowed files and calling the governed Bridge.
+
+Codex/Hermes mutation adapters remain disabled until a separately audited uncredentialed planner
+backend exists. Under the current operating model, implementation code is authored before Online
+Agent execution and is carried as a deterministic plan.

tests/test_agent_task_retry_extension.py

@@ -0,0 +1,117 @@
+from pathlib import Path
+import hashlib, json, sqlite3, sys
+
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+from aios_agent_task_retry_extension import RetryExtensionRequest, RetryExtensionStore, RetryExtensionError
+
+AUTHORIZATION_ID="owner-scheme-a-20260817"
+
+
+@pytest.fixture(autouse=True)
+def _authorization_id(monkeypatch):
+    monkeypatch.setenv("AIOS_AGENT_TASK_AUTHORIZATION_ID", AUTHORIZATION_ID)
+
+
+def canon(v):
+    return hashlib.sha256(json.dumps(v,sort_keys=True,separators=(",",":")).encode()).hexdigest()
+
+
+def db(tmp_path):
+    p=tmp_path/"state.sqlite3"
+    c=sqlite3.connect(p)
+    c.executescript("""
+    CREATE TABLE tasks(
+      task_id TEXT PRIMARY KEY,status TEXT,attempt INTEGER,max_attempts INTEGER,revision INTEGER,
+      claimed_by TEXT,lease_token_hash TEXT,lease_expires_at TEXT,verification_json TEXT,result_json TEXT
+    );
+    CREATE TABLE task_events(
+      event_id INTEGER PRIMARY KEY AUTOINCREMENT,task_id TEXT,event_type TEXT,agent_id TEXT,
+      payload_json TEXT,created_at TEXT
+    );
+    """)
+    verification={"decision":"NEEDS_REWORK","reason":"BASE_OID_BINDING_INVALID"}
+    c.execute("INSERT INTO tasks VALUES (?,?,?,?,?,?,?,?,?,?)",
+              ("task-a","FAILED",10,10,41,None,None,None,json.dumps(verification),json.dumps({"status":"FAILED"})))
+    c.commit(); c.close()
+    return p,verification
+
+
+def request(v):
+    return RetryExtensionRequest.from_mapping({
+      "expected_status":"FAILED","expected_revision":41,"expected_attempt":10,"expected_max_attempts":10,
+      "next_max_attempts":11,"previous_verification_sha256":canon(v),
+      "authorization_id":AUTHORIZATION_ID,"idempotency_key":"retry-task-a-attempt11",
+    })
+
+
+def test_retry_extension_cas_and_audit(tmp_path):
+    p,v=db(tmp_path)
+    out=RetryExtensionStore(p).extend("task-a",request(v))
+    assert out["status"]=="QUEUED" and out["max_attempts"]==11 and out["revision"]==42
+    c=sqlite3.connect(p)
+    assert c.execute("select status,attempt,max_attempts,revision from tasks").fetchone()==("QUEUED",10,11,42)
+    event=c.execute("select event_type,payload_json from task_events").fetchone()
+    assert event[0]=="TASK_RETRY_EXTENSION_AUTHORIZED"
+    assert json.loads(event[1])["authorization_id"]=="owner-scheme-a-20260817"
+
+
+def test_retry_extension_idempotent_replay(tmp_path):
+    p,v=db(tmp_path); store=RetryExtensionStore(p); req=request(v)
+    first=store.extend("task-a",req); second=store.extend("task-a",req)
+    assert first["idempotent"] is False and second["idempotent"] is True
+    c=sqlite3.connect(p)
+    assert c.execute("select count(*) from task_retry_extensions").fetchone()[0]==1
+
+
+def test_retry_extension_normalizes_stale_terminal_claim_without_active_lease(tmp_path):
+    p,v=db(tmp_path)
+    c=sqlite3.connect(p)
+    c.execute("update tasks set claimed_by='previous-worker'")
+    c.commit(); c.close()
+    out=RetryExtensionStore(p).extend("task-a",request(v))
+    assert out["status"]=="QUEUED"
+    c=sqlite3.connect(p)
+    assert c.execute(
+        "select claimed_by,lease_token_hash,lease_expires_at from tasks"
+    ).fetchone()==(None,None,None)
+    payload=json.loads(c.execute("select payload_json from task_events").fetchone()[0])
+    assert payload["previous_claimed_by"]=="previous-worker"
+    assert payload["stale_terminal_claim_normalized"] is True
+    assert c.execute("select count(*) from task_events").fetchone()[0]==1
+
+
+def test_retry_extension_verification_drift_denied(tmp_path):
+    p,v=db(tmp_path)
+    bad=request({"decision":"NEEDS_REWORK","reason":"other"})
+    with pytest.raises(RetryExtensionError,match="RETRY_EXTENSION_VERIFICATION_DRIFT"):
+        RetryExtensionStore(p).extend("task-a",bad)
+
+
+def test_retry_extension_authorization_id_mismatch_rejected(tmp_path, monkeypatch):
+    p,v=db(tmp_path)
+    monkeypatch.setenv("AIOS_AGENT_TASK_AUTHORIZATION_ID", "other-owner-id")
+    with pytest.raises(RetryExtensionError,match="RETRY_EXTENSION_AUTHORIZATION_ID_MISMATCH"):
+        RetryExtensionStore(p).extend("task-a",request(v))
+
+
+def test_retry_extension_bounded_one_step():
+    v={"decision":"NEEDS_REWORK"}
+    data={
+      "expected_status":"FAILED","expected_revision":41,"expected_attempt":10,"expected_max_attempts":10,
+      "next_max_attempts":12,"previous_verification_sha256":canon(v),
+      "authorization_id":"owner-scheme-a-20260817","idempotency_key":"retry-task-a-attempt11",
+    }
+    with pytest.raises(RetryExtensionError,match="RETRY_EXTENSION_MUST_BE_BOUNDED_ONE_STEP"):
+        RetryExtensionRequest.from_mapping(data)
+
+
+def test_retry_extension_unit_is_unprivileged_and_requires_owner_binding():
+    unit=(ROOT/"deploy/systemd/aios-agent-task-retry-extension.service").read_text()
+    assert "User=aios-agent-task" in unit
+    assert "Group=aios-agent-task" in unit
+    assert "LoadCredential=agent_task_control_token:" in unit
+    assert "EnvironmentFile=/etc/aios-gitops/agent-task-retry-extension.env" in unit
+    assert "User=root" not in unit

tests/test_bridge_v2_governed_http_bootstrap.py

@@ -77,7 +77,7 @@ def test_slash_branch_uses_paginated_collection():
 
 def test_http_route_contract_is_complete():
     expected = {
-        "/v2/runtime", "/v2/capabilities", "/v2/governed-task",
+            "/v2/runtime", "/v2/capabilities", "/v2/governed-task", "/v2/execution-envelope", "/v2/execution-plan",
         "/v2/writer-lease", "/v2/writer-lease/bootstrap", "/v2/writer-lease/renew", "/v2/commit-file", "/v2/commit-files",
         "/v2/job", "/v2/job/resume", "/v2/job/reconcile",
         "/v2/tag/approval-request",
@@ -203,6 +203,19 @@ def test_http_allows_omitted_job_id_for_durable_server_resolution():
     )
 
 
+def test_http_mutation_routes_require_exact_runtime_principal():
+    handler = BridgeHandler.__new__(BridgeHandler)
+    runtime_principal = "runtime-" "agent-principal-token-1234"
+    handler.control_token = runtime_principal
+    handler.agent_task_api_url = "http://127.0.0.1:1"
+    handler.headers = {"Authorization": f"Bearer {runtime_principal}"}
+    assert handler._authorized("createGovernedTask", {}) is True
+    handler.headers = {"Authorization": "Bearer wrong-runtime-principal-token"}
+    assert handler._authorized("createGovernedTask", {}) is False
+    handler.headers = {}
+    assert handler._authorized("createGovernedTask", {}) is False
+
+
 def test_capability_contracts_return_exact_job_id_lineage():
     contracts = BridgeV2Adapter(runtime_status={}).getGovernedWriteCapabilities()["operation_contracts"]
     for operation in ("acquireWriterLease", "bootstrapWriterLease", "renewWriterLease"):

tests/test_isolated_executor.py

@@ -0,0 +1,67 @@
+from pathlib import Path
+import hashlib,json,os,tarfile,sys,tempfile
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+import aios_isolated_executor as mod
+
+def make_archive(tmp_path):
+    root=tmp_path/"src"; root.mkdir()
+    (root/"hello.py").write_text("VALUE = 1\n")
+    archive=tmp_path/"source.tgz"
+    with tarfile.open(archive,"w:gz") as tf: tf.add(root/"hello.py",arcname="hello.py")
+    return archive
+
+def test_isolated_executor_applies_hash_bound_change(tmp_path,monkeypatch):
+    archive=make_archive(tmp_path)
+    monkeypatch.delenv("CREDENTIALS_DIRECTORY",raising=False)
+    monkeypatch.setattr(mod,"assert_uncredentialed",lambda:None)
+    request={
+      "schema":"aios.isolated-execution.request.v1",
+      "request_id":"task-req-0000000000000000",
+      "source_archive":str(archive),
+      "source_archive_sha256":mod.sha256(archive.read_bytes()),
+      "change_set":[{
+        "path":"hello.py","operation":"replace_text","old":"VALUE = 1","new":"VALUE = 2","count":1,
+        "expected_sha256":mod.sha256(b"VALUE = 1\n")
+      }],
+      "verification":[{"label":"compile","argv":["/usr/bin/python3","-m","py_compile","hello.py"],"cwd":".","timeout_seconds":30}]
+    }
+    req=tmp_path/"req.json"; res=tmp_path/"res.json"
+    req.write_text(json.dumps(request))
+    mod.execute_request(req,res)
+    out=json.loads(res.read_text())
+    assert out["request_id"]=="task-req-0000000000000000"
+    assert out["credential_isolation"]["credential_env_absent"] is True
+    changed=out["changed_files"][0]
+    assert changed["path"]=="hello.py" and changed["deleted"] is False
+
+def test_isolated_executor_source_drift_denied(tmp_path,monkeypatch):
+    archive=make_archive(tmp_path); monkeypatch.setattr(mod,"assert_uncredentialed",lambda:None)
+    request={
+      "schema":"aios.isolated-execution.request.v1","request_id":"task-req-0000000000000001",
+      "source_archive":str(archive),
+      "source_archive_sha256":mod.sha256(archive.read_bytes()),
+      "change_set":[{"path":"hello.py","operation":"write_file","content":"x\n","expected_sha256":"0"*64}],
+      "verification":[]
+    }
+    req=tmp_path/"req.json"; res=tmp_path/"res.json"; req.write_text(json.dumps(request))
+    with pytest.raises(mod.IsolatedExecutorError,match="SOURCE_DRIFT"):
+        mod.execute_request(req,res)
+
+def test_credential_boundary_eacces_is_accepted(monkeypatch):
+    class DeniedDirectory:
+        def exists(self): return True
+        def is_symlink(self): return False
+        def is_dir(self): return True
+        def iterdir(self): raise PermissionError(13,"permission denied")
+    monkeypatch.setattr(mod.os,"access",lambda *_args,**_kwargs:False)
+    assert mod._credential_exposure(DeniedDirectory()) is None
+
+def test_systemd_unit_has_no_credentials_and_private_network():
+    unit=(ROOT/"deploy/systemd/aios-online-agent-isolated-executor.service").read_text()
+    assert "PrivateNetwork=true" in unit
+    assert "InaccessiblePaths=/run/credentials" in unit
+    assert "LoadCredential" not in unit
+    assert "SupplementaryGroups=gitops" not in unit

tests/test_online_agent_auto_claim.py

@@ -0,0 +1,524 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+import sys
+from types import SimpleNamespace
+
+import pytest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+APP = ROOT / "active-runtime" / "app"
+sys.path.insert(0, str(APP))
+
+from aios_chatgpt_bridge_v2 import (  # noqa: E402
+    BRIDGE_OPERATION_CONTRACTS,
+    BridgeV2Adapter,
+)
+from aios_chatgpt_bridge_v2_server import GovernedRuntime  # noqa: E402
+from aios_governed_task_bootstrap import BootstrapError, GovernedTaskBinding, GovernedTaskBootstrap, _task_key  # noqa: E402
+from aios_online_agent_execution import (  # noqa: E402
+    ExecutionProjectionError,
+    GovernedExecutionBinding,
+    OnlineTaskProjectionClient,
+    project_execution_envelope,
+    project_online_task,
+    validate_execution_envelope,
+)
+import aios_online_agent_worker as worker_module  # noqa: E402
+from aios_online_agent_worker import ExecutionEnvelope, WorkerError, WorkerSupervisor, governed_commit, load_task_state  # noqa: E402
+
+
+BASE = "a642b045775b9154a00ae78543037fbef4fb447b"
+TASK = "p0-claim-online-agent-auto-execution-20260817"
+JOB = "job-2031a9e5682a4238f98e3ac7aee8a593"
+BRANCH = "agent/p0-claim-online-agent-auto-execution-20260817"
+
+
+def binding() -> GovernedExecutionBinding:
+    return GovernedExecutionBinding.from_mapping(
+        {
+            "task_id": TASK,
+            "job_id": JOB,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "expected_branch_oid": BASE,
+            "target_branch": BRANCH,
+            "branch_mode": "CREATE_NEW",
+            "generation": 1,
+            "idempotency_key": "p0-claim-online-agent-auto-execution-v1",
+        }
+    )
+
+
+def task_without_envelope() -> dict:
+    return {
+        "task_id": TASK,
+        "goal": "make governed Online Tasks automatically executable",
+        "instructions": "project, claim, heartbeat, and preserve exact lineage",
+        "required_capabilities": ["git.read", "git.test"],
+        "metadata": {},
+    }
+
+
+def test_project_online_task_builds_execution_metadata_from_binding() -> None:
+    projected = project_online_task(binding(), task_without_envelope())
+    execution = projected["metadata"]["execution"]
+    assert execution["schema"] == "aios.online-agent.execution.v2"
+    assert execution["job_id"] == JOB
+    assert execution["task_id"] == TASK
+    assert execution["repository"] == "aios/aios"
+    assert execution["base_oid"] == BASE
+    assert execution["expected_branch_oid"] == BASE
+    assert execution["target_branch"] == BRANCH
+    assert execution["generation"] == 1
+    assert projected["metadata"]["execution_projection"]["execution_digest"] == execution["execution_digest"]
+
+
+def test_job_to_task_execution_projection(tmp_path: Path) -> None:
+    exact = binding()
+    durable = GovernedTaskBinding(
+        task_id=exact.task_id,
+        job_id=exact.job_id,
+        repository=exact.repository,
+        base_oid=exact.base_oid,
+        expected_branch_oid=exact.expected_branch_oid,
+        target_branch=exact.target_branch,
+        branch_mode=exact.branch_mode,
+        generation=exact.generation,
+        idempotency_key=exact.idempotency_key,
+        risk="engineering",
+        description="automatic claim infrastructure",
+    )
+
+    class Bootstrap:
+        def create(self, _request: dict) -> dict:
+            return durable.response()
+
+        def online_task_projection(self, _task_id: str, online: dict, execution: dict | None, **_kwargs: object) -> dict:
+            return project_online_task(exact, online, execution)
+
+        def get_binding(self, _task_id: str) -> GovernedTaskBinding:
+            return durable
+
+        def execution_binding(self, _binding: GovernedTaskBinding) -> GovernedExecutionBinding:
+            return exact
+
+    class Projector:
+        def __init__(self) -> None:
+            self.calls = 0
+
+        def create(self, projected: dict, *, binding: GovernedExecutionBinding) -> dict:
+            self.calls += 1
+            assert binding == exact
+            return {**projected, "status": "QUEUED"}
+
+    runtime = GovernedRuntime.__new__(GovernedRuntime)
+    runtime.bootstrap = Bootstrap()
+    runtime.bindings = {}
+    runtime.online_task_projector = Projector()
+    runtime.projection_outbox_root = tmp_path / "projection-outbox"
+    runtime.projection_outbox_root.mkdir()
+    response = GovernedRuntime.create_task(
+        runtime,
+        {
+            "task_id": TASK,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "target_branch": BRANCH,
+            "risk": "engineering",
+            "description": "automatic claim infrastructure",
+            "idempotency_key": exact.idempotency_key,
+            "online_task": task_without_envelope(),
+        },
+    )
+    assert response["online_task_projection"]["status"] == "PROJECTED"
+    assert response["online_task_projection"]["task_status"] == "QUEUED"
+    assert runtime.online_task_projector.calls == 1
+
+
+def test_execution_envelope_schema_validation() -> None:
+    envelope = project_execution_envelope(binding())
+    validate_execution_envelope(envelope, binding=binding())
+    malformed = dict(envelope)
+    malformed["schema"] = "aios.online-agent.execution.v1"
+    with pytest.raises(ExecutionProjectionError, match="EXECUTION_ENVELOPE_SCHEMA_VALIDATION"):
+        validate_execution_envelope(malformed, binding=binding())
+
+
+def test_projection_response_must_equal_submitted_execution(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    submitted = project_online_task(binding(), task_without_envelope(), {"action": "source_capture", "source_signals": ["submitted"]})
+    returned = project_online_task(binding(), task_without_envelope(), {"action": "source_capture", "source_signals": ["different"]})
+    returned.update({"status": "QUEUED"})
+
+    class Response:
+        status = 201
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_args: object) -> None:
+            return None
+
+        def read(self) -> bytes:
+            return json.dumps(returned).encode("utf-8")
+
+    monkeypatch.setattr("aios_online_agent_execution.urllib.request.urlopen", lambda *_args, **_kwargs: Response())
+    token = tmp_path / "control.token"
+    token.write_text("x" * 40, encoding="utf-8")
+    with pytest.raises(ExecutionProjectionError, match="ONLINE_TASK_PROJECTION_RESPONSE_BINDING_INVALID"):
+        OnlineTaskProjectionClient("http://127.0.0.1:1", token).create(submitted, binding=binding())
+
+
+class _ProjectedBridge:
+    def __init__(self, value: dict) -> None:
+        self.value = value
+        self.calls = 0
+
+    def project_execution(self, _task: dict, _execution: dict | None = None) -> tuple[int, dict]:
+        self.calls += 1
+        return 200, self.value
+
+
+class _FakeAgent:
+    def __init__(self, tasks: list[dict]) -> None:
+        self.tasks = tasks
+        self.claimed: list[str] = []
+
+    def poll(self) -> list[dict]:
+        return self.tasks
+
+    def claim(self, task_id: str) -> tuple[int, dict]:
+        self.claimed.append(task_id)
+        return 200, {"task_id": task_id, "lease_token": "x" * 32, "attempt": 1, "revision": 2}
+
+
+def test_task_visible_to_worker_claimable(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path)
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    envelope, source = supervisor.resolve_envelope(task_without_envelope())
+    assert source == "recovered_projection"
+    assert envelope.task_id == TASK
+    assert envelope.job_id == JOB
+    assert envelope.action == "source_capture"
+
+
+def test_task_claim_after_projection(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path)
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    fake_agent = _FakeAgent([task_without_envelope()])
+    supervisor.agent = fake_agent
+    supervisor.bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    processed: list[tuple[str, str]] = []
+    supervisor.process_claim = lambda task, claim, envelope: processed.append((task["task_id"], envelope.execution_digest if hasattr(envelope, "execution_digest") else envelope.digest))  # type: ignore[method-assign]
+    assert supervisor.once() == 0
+    assert fake_agent.claimed == [TASK]
+    assert processed and processed[0][0] == TASK
+
+
+def test_claim_heartbeat_source_capture_and_result_lifecycle(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    execution = project_execution_envelope(binding(), {"action": "source_capture", "source_signals": ["agent"]})
+    task = task_without_envelope()
+    task["metadata"] = {"execution": execution}
+
+    class Agent:
+        def __init__(self) -> None:
+            self.heartbeats: list[str] = []
+            self.results: list[dict] = []
+
+        def heartbeat(self, _task_id: str, _lease_token: str, stage: str) -> tuple[int, dict]:
+            self.heartbeats.append(stage)
+            return 200, {}
+
+        def get(self, _task_id: str) -> tuple[int, dict]:
+            return 200, task
+
+        def result(self, _task_id: str, _lease_token: str, _key: str, result: dict) -> tuple[int, dict]:
+            self.results.append(result)
+            return 200, {}
+
+    worktree = tmp_path / "worktree"
+    source = worktree / "active-runtime" / "app" / "agent_auto_fixture.py"
+    source.parent.mkdir(parents=True)
+    source.write_text("VALUE = 1\n", encoding="utf-8")
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path / "state")
+    monkeypatch.setattr(worker_module, "new_run_root", lambda: tmp_path / "run")
+    monkeypatch.setattr(worker_module, "prepare_worktree", lambda *_args, **_kwargs: worktree)
+    monkeypatch.setattr(worker_module, "cleanup_run_root", lambda *_args, **_kwargs: None)
+    agent = Agent()
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.agent = agent
+    supervisor.bridge = _ProjectedBridge(execution)
+    envelope, _ = supervisor.resolve_envelope(task)
+    supervisor.process_claim(task, {"task_id": TASK, "lease_token": "l" * 32, "attempt": 2, "revision": 8}, envelope)
+    assert agent.heartbeats and agent.heartbeats[0] == "claimed"
+    assert len(agent.results) == 1
+    assert agent.results[0]["status"] == "SUCCEEDED"
+    assert agent.results[0]["classification"] == "NEEDS_REWORK_SOURCE_CAPTURE"
+
+
+def test_dynamic_task_binding_no_hardcoded_task_id() -> None:
+    worker = (APP / "aios_online_agent_worker.py").read_text(encoding="utf-8")
+    assert TASK not in worker
+    assert BASE not in worker
+    for name in ("aios-online-agent-worker.service", "aios-online-engineering-consumer.service"):
+        unit = (ROOT / "deploy" / "systemd" / name).read_text(encoding="utf-8")
+        assert TASK not in unit
+        assert JOB not in unit
+        assert BASE not in unit
+        assert BRANCH not in unit
+        assert "AIOS_ENGINEERING_PLAN_FILE" not in unit
+        assert "aios_online_agent_worker.py" in unit
+    projection = (ROOT / "deploy" / "systemd" / "aios-chatgpt-bridge-v2-agent-task-projection.conf").read_text(encoding="utf-8")
+    assert "AIOS_ONLINE_TASK_PROJECTION_ENABLED=1" in projection
+    assert "LoadCredential=agent_task_control_token:" in projection
+    assert "LoadCredentialEncrypted=" not in projection
+    assert "Bearer " not in projection
+
+
+def test_durable_task_key_has_collision_resistant_exact_identity() -> None:
+    assert _task_key("task:a") != _task_key("task-a")
+    assert _task_key("x" * 140 + "a") != _task_key("x" * 140 + "b")
+
+
+def test_existing_binding_rejects_idempotency_head_and_generation_drift(tmp_path: Path) -> None:
+    class Authority:
+        @staticmethod
+        def commit_exists(_oid: str) -> bool:
+            return True
+
+        @staticmethod
+        def read_ref(_ref: str) -> None:
+            return None
+
+    bootstrap = GovernedTaskBootstrap(Authority(), tmp_path, remote_name="origin", token_path=tmp_path / "token", ssh_key_path=tmp_path / "key")
+    request = {
+        "task_id": TASK,
+        "repository": "aios/aios",
+        "base_oid": BASE,
+        "target_branch": BRANCH,
+        "risk": "engineering",
+        "description": "automatic claim infrastructure",
+        "idempotency_key": "p0-claim-online-agent-auto-execution-v1",
+        "expected_branch_oid": BASE,
+        "generation": 1,
+    }
+    bootstrap.create(request)
+    for drift in (
+        {"idempotency_key": "p0-claim-online-agent-auto-execution-v2"},
+        {"expected_branch_oid": "b" * 40},
+        {"generation": 2},
+    ):
+        with pytest.raises(BootstrapError, match="TASK_BINDING_CONFLICT"):
+            bootstrap.create({**request, **drift})
+
+
+def test_existing_branch_without_durable_parent_ownership_is_denied(tmp_path: Path) -> None:
+    class Authority:
+        @staticmethod
+        def commit_exists(_oid: str) -> bool:
+            return True
+
+        @staticmethod
+        def read_ref(_ref: str) -> str:
+            return BASE
+
+    bootstrap = GovernedTaskBootstrap(Authority(), tmp_path, remote_name="origin", token_path=tmp_path / "token", ssh_key_path=tmp_path / "key")
+    with pytest.raises(BootstrapError, match="EXISTING_BRANCH_OWNERSHIP_REQUIRED"):
+        bootstrap.create({
+            "task_id": TASK,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "target_branch": BRANCH,
+            "risk": "engineering",
+            "description": "automatic claim infrastructure",
+            "idempotency_key": "p0-claim-online-agent-auto-execution-v1",
+            "expected_branch_oid": BASE,
+            "generation": 2,
+        })
+
+
+@pytest.mark.parametrize(
+    ("field", "value", "error"),
+    [
+        ("repository", "other/repo", "WRONG_REPOSITORY_ENVELOPE_DENY"),
+        ("target_branch", "agent/wrong-branch", "WRONG_BRANCH_ENVELOPE_DENY"),
+        ("generation", 2, "WRONG_GENERATION_ENVELOPE_DENY"),
+    ],
+)
+def test_wrong_lineage_envelope_deny(field: str, value: object, error: str) -> None:
+    envelope = project_execution_envelope(binding())
+    envelope[field] = value
+    with pytest.raises(ExecutionProjectionError, match=error):
+        validate_execution_envelope(envelope, binding=binding())
+
+
+def test_capability_mismatch_deny() -> None:
+    envelope = project_execution_envelope(
+        binding(),
+        {"action": "source_capture", "capability_scope": ["git.read", "governed.write.file"]},
+    )
+    with pytest.raises(ExecutionProjectionError, match="CAPABILITY_MISMATCH_DENY"):
+        validate_execution_envelope(envelope, binding=binding(), worker_capabilities=["git.read"])
+
+
+def test_governance_lineage_override_deny() -> None:
+    envelope = project_execution_envelope(binding())
+    envelope["governance"] = {**envelope["governance"], "job_id": "job-wrong-lineage"}
+    with pytest.raises(ExecutionProjectionError, match="JOB_BINDING_CONFLICT"):
+        validate_execution_envelope(envelope, binding=binding())
+
+
+def test_malformed_persisted_envelope_does_not_fallback() -> None:
+    task = task_without_envelope()
+    task["metadata"] = {"execution": {"schema": "broken"}}
+    bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.bridge = bridge
+    with pytest.raises(WorkerError, match="EXECUTION_ENVELOPE_SCHEMA_VALIDATION"):
+        supervisor.resolve_envelope(task)
+    assert bridge.calls == 0
+
+
+def test_self_consistent_persisted_wrong_lineage_is_denied_by_authority() -> None:
+    task = task_without_envelope()
+    wrong = binding()
+    wrong = GovernedExecutionBinding.from_mapping({**wrong.public(), "job_id": "job-00000000000000000000000000000000"})
+    task["metadata"] = {"execution": project_execution_envelope(wrong)}
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    with pytest.raises(WorkerError, match="TASK_PERSISTED_BINDING_CONFLICT"):
+        supervisor.resolve_envelope(task)
+
+
+def test_projection_control_missing_denies_before_governed_side_effect() -> None:
+    class Bootstrap:
+        called = False
+
+        def create(self, _request: dict) -> dict:
+            self.called = True
+            raise AssertionError("must not create governed state")
+
+    runtime = GovernedRuntime.__new__(GovernedRuntime)
+    runtime.bootstrap = Bootstrap()
+    runtime.online_task_projector = None
+    with pytest.raises(RuntimeError, match="ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE"):
+        GovernedRuntime.create_task(runtime, {"task_id": TASK, "require_online_task_projection": True})
+    assert runtime.bootstrap.called is False
+
+
+def test_source_capture_projection_cannot_write() -> None:
+    envelope = project_execution_envelope(binding())
+    assert envelope["action"] == "source_capture"
+    assert envelope["change_set"] == []
+    assert envelope["verification"] == []
+    assert envelope["governance"]["writer_lease"] is False
+    assert all(envelope["governance"][field] is False for field in ("main_write", "production_write", "tag_write", "baseline_write", "force_push", "protected_ref_bypass"))
+
+
+def test_source_capture_state_allows_next_attempt_deterministic_digest(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path)
+    state_path = tmp_path / "tasks" / f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({"task_id": TASK, "execution_digest": "a" * 64, "phase": "source_capture_done"}), encoding="utf-8")
+    assert load_task_state(TASK, "b" * 64) is None
+
+
+def test_bridge_exposes_controlled_projection_operation() -> None:
+    seen: list[dict] = []
+    adapter = BridgeV2Adapter(
+        runtime_status={},
+        handlers={"projectOnlineAgentExecution": lambda request: seen.append(dict(request)) or project_execution_envelope(binding())},
+    )
+    response = adapter.projectOnlineAgentExecution({"task_id": TASK})
+    assert response["job_id"] == JOB
+    assert seen == [{"task_id": TASK}]
+    assert BRIDGE_OPERATION_CONTRACTS["projectOnlineAgentExecution"]["path"] == "/v2/execution-envelope"
+
+
+def test_execution_digest_is_canonical() -> None:
+    envelope = project_execution_envelope(binding())
+    material = {key: value for key, value in envelope.items() if key != "execution_digest"}
+    expected = hashlib.sha256(json.dumps(material, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    assert envelope["execution_digest"] == expected
+
+
+def test_governed_commit_uses_existing_exact_job_without_recreating(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    execution = project_execution_envelope(
+        binding(),
+        {
+            "action": "deterministic",
+            "change_set": [{"operation": "write_file", "path": "result.txt", "content": "ok\n"}],
+            "governance": {"allowed_files": ["result.txt"]},
+        },
+    )
+    envelope = ExecutionEnvelope.from_task({"task_id": TASK, "metadata": {"execution": execution}})
+    (tmp_path / "result.txt").write_text("ok\n", encoding="utf-8")
+    commit_oid = "b" * 40
+
+    class Bridge:
+        def __init__(self) -> None:
+            self.routes: list[str] = []
+
+        def call(self, route: str, body: dict) -> tuple[int, dict]:
+            self.routes.append(route)
+            if route == "/v2/job":
+                assert body == {"job_id": JOB}
+            else:
+                assert body["task_id"] == TASK
+                assert body["job_id"] == JOB
+            if route == "/v2/writer-lease":
+                return 200, {
+                    "task_id": TASK,
+                    "job_id": JOB,
+                    "repository": "aios/aios",
+                    "base_oid": BASE,
+                    "expected_branch_oid": BASE,
+                    "branch_mode": "CREATE_NEW",
+                    "generation": 1,
+                    "target_branch": BRANCH,
+                }
+            if route == "/v2/commit-files":
+                return 200, {
+                    "job_id": JOB,
+                    "target_branch": BRANCH,
+                    "generation": 1,
+                    "branch_mode": "CONTINUE_EXISTING",
+                    "commit_oid": commit_oid,
+                    "commit_visible": True,
+                    "receipt": {
+                        "remote_verified": True,
+                        "authority_oid": commit_oid,
+                        "api_branch_oid": commit_oid,
+                        "git_remote_oid": commit_oid,
+                    },
+                }
+            if route == "/v2/job":
+                return 200, {
+                    "state": "COMPLETED",
+                    "receipt": {
+                        "remote_verified": True,
+                        "authority_oid": commit_oid,
+                        "api_branch_oid": commit_oid,
+                        "git_remote_oid": commit_oid,
+                    },
+                    "branch_leases": [{
+                        "job_id": JOB,
+                        "branch": BRANCH,
+                        "state": "ACTIVE",
+                        "generation": 1,
+                        "current_head_oid": commit_oid,
+                    }],
+                }
+            raise AssertionError(route)
+
+    bridge = Bridge()
+    monkeypatch.setattr(worker_module.subprocess, "run", lambda *args, **kwargs: SimpleNamespace(returncode=0, stdout=commit_oid + "\n", stderr=""))
+    heartbeat = SimpleNamespace(ensure=lambda: None)
+    result = governed_commit(envelope, tmp_path, bridge, heartbeat)
+    assert bridge.routes == ["/v2/writer-lease", "/v2/commit-files", "/v2/job"]
+    assert result["job_id"] == JOB
+    assert result["commit_oid"] == commit_oid

tests/test_online_agent_plan_store.py

@@ -0,0 +1,60 @@
+from pathlib import Path
+import sys
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+
+from aios_online_agent_execution import GovernedExecutionBinding
+from aios_online_agent_plan_store import ExecutionPlanStore, ExecutionPlanError
+
+BASE="a642b045775b9154a00ae78543037fbef4fb447b"
+HEAD="71523aef6e48b1e2fa516c456ca189b7a039104b"
+
+def binding(head=HEAD):
+    return GovernedExecutionBinding.from_mapping({
+      "task_id":"task-plan-a","job_id":"job-plan-a","repository":"aios/aios","base_oid":BASE,
+      "expected_branch_oid":head,"target_branch":"agent/task-plan-a","branch_mode":"CONTINUE_EXISTING",
+      "generation":1,"idempotency_key":"governed-plan-a",
+    })
+
+def request():
+    return {
+      "schema":"aios.online-agent.plan.v1","task_id":"task-plan-a","job_id":"job-plan-a",
+      "source_head_oid":HEAD,"generation":1,"idempotency_key":"plan-task-a-v1",
+      "execution":{
+        "action":"deterministic",
+        "change_set":[{"path":"x.py","operation":"write_file","content":"x=1\n"}],
+        "verification":[{"label":"compile","argv":["/usr/bin/python3","-m","py_compile","x.py"],"cwd":".","timeout_seconds":30}],
+        "capability_scope":["git.read","git.test"],
+      }
+    }
+
+def test_plan_register_and_resolve(tmp_path):
+    store=ExecutionPlanStore(tmp_path)
+    created=store.register(binding(),request())
+    assert created["idempotent"] is False
+    resolved=store.resolve(binding())
+    assert resolved["plan_digest"]==created["plan_digest"]
+    assert resolved["execution"]["action"]=="deterministic"
+
+def test_plan_is_idempotent(tmp_path):
+    store=ExecutionPlanStore(tmp_path); req=request()
+    first=store.register(binding(),req); second=store.register(binding(),req)
+    assert second["idempotent"] is True
+    assert first["plan_digest"]==second["plan_digest"]
+
+def test_plan_source_head_drift_denied(tmp_path):
+    store=ExecutionPlanStore(tmp_path); store.register(binding(),request())
+    with pytest.raises(ExecutionPlanError,match="SOURCE_HEAD_DRIFT"):
+        store.resolve(binding("b"*40))
+
+def test_plan_replacement_requires_cas(tmp_path):
+    store=ExecutionPlanStore(tmp_path); first=store.register(binding(),request())
+    changed=request(); changed["idempotency_key"]="plan-task-a-v2"
+    changed["execution"]["change_set"][0]["content"]="x=2\n"
+    with pytest.raises(ExecutionPlanError,match="REPLACEMENT_CAS_MISMATCH"):
+        store.register(binding(),changed)
+    changed["expected_previous_plan_digest"]=first["plan_digest"]
+    second=store.register(binding(),changed)
+    assert second["plan_digest"]!=first["plan_digest"]

tests/test_online_agent_scheme_a.py

@@ -0,0 +1,245 @@
+from __future__ import annotations
+
+from pathlib import Path
+from types import SimpleNamespace
+import json
+import sys
+
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+APP=ROOT/"active-runtime/app"
+sys.path.insert(0,str(APP))
+
+from aios_online_agent_execution import GovernedExecutionBinding, project_execution_envelope
+from aios_governed_task_bootstrap import GovernedTaskBinding, GovernedTaskBootstrap
+from aios_gitops_job_controller import GitOpsJobController, JobState, JobStore
+from aios_continuation_executor import ContinuationExecutionError, DetachedGitWorkspace
+from aios_online_agent_worker import (
+    BridgeClient,
+    IsolatedDeterministicExecutor,
+    load_task_state,
+    _claim_order,
+    _isolated_executor_wait_seconds,
+    _verify_converged_job,
+    WorkerError,
+)
+
+
+BASE="a642b045775b9154a00ae78543037fbef4fb447b"
+HEAD="71523aef6e48b1e2fa516c456ca189b7a039104b"
+TASK="p0-claim-online-agent-auto-execution-20260817"
+JOB="job-2031a9e5682a4238f98e3ac7aee8a593"
+BRANCH="agent/p0-claim-online-agent-auto-execution-20260817"
+
+
+def test_source_signals_are_bounded_by_projection():
+    binding=GovernedExecutionBinding.from_mapping({
+      "task_id":TASK,"job_id":JOB,"repository":"aios/aios","base_oid":BASE,
+      "expected_branch_oid":BASE,"target_branch":BRANCH,"branch_mode":"CREATE_NEW",
+      "generation":1,"idempotency_key":"p0-claim-online-agent-auto-execution-a642b04-v1",
+    })
+    execution=project_execution_envelope(binding,{
+      "action":"source_capture",
+      "source_signals":["x"*5000,"x"*5000,"trace credential tool "*100],
+    })
+    assert len(execution["source_signals"]) <= 16
+    assert all(0 < len(item) <= 512 for item in execution["source_signals"])
+
+
+def test_same_job_create_new_binding_normalizes_to_current_head():
+    binding=GovernedTaskBinding(
+      task_id=TASK,job_id=JOB,repository="aios/aios",base_oid=BASE,
+      expected_branch_oid=BASE,target_branch=BRANCH,branch_mode="CREATE_NEW",
+      generation=1,idempotency_key="p0-claim-online-agent-auto-execution-a642b04-v1",
+      risk="engineering",description="automatic claim",
+    )
+    bootstrap=GovernedTaskBootstrap.__new__(GovernedTaskBootstrap)
+    bootstrap.authority=SimpleNamespace(read_ref=lambda ref: HEAD)
+    class Connection:
+        def __enter__(self): return self
+        def __exit__(self,*a): return False
+        def execute(self,*a,**k):
+            return SimpleNamespace(fetchall=lambda:[{
+              "current_head_oid":HEAD,"generation":1,"state":"ACTIVE","lineage_anchor_oid":BASE
+            }])
+    bootstrap._store=lambda _task:(SimpleNamespace(_connect=lambda:Connection()),None)
+    normalized=bootstrap.execution_binding(binding)
+    assert normalized.base_oid == BASE
+    assert normalized.expected_branch_oid == HEAD
+    assert normalized.branch_mode == "CONTINUE_EXISTING"
+    assert normalized.generation == 1
+
+
+def test_recovery_receipt_requires_exact_oid_and_active_lease():
+    envelope=SimpleNamespace(job_id=JOB,target_branch=BRANCH,generation=1)
+    response={
+      "state":"COMPLETED",
+      "receipt":{"remote_verified":True,"authority_oid":HEAD,"api_branch_oid":HEAD,"git_remote_oid":HEAD},
+      "branch_leases":[{
+        "job_id":JOB,"branch":BRANCH,"state":"ACTIVE","generation":1,"current_head_oid":HEAD
+      }],
+    }
+    _verify_converged_job(response,envelope,HEAD)
+    bad={**response,"receipt":{**response["receipt"],"git_remote_oid":BASE}}
+    with pytest.raises(WorkerError,match="GOVERNED_RECEIPT_OID_MISMATCH"):
+        _verify_converged_job(bad,envelope,HEAD)
+
+
+def test_executor_unit_is_uncredentialed():
+    unit=(ROOT/"deploy/systemd/aios-online-agent-isolated-executor.service").read_text()
+    assert "PrivateNetwork=true" in unit
+    assert "RestrictAddressFamilies=AF_UNIX AF_INET" in unit
+    assert "IPAddressDeny=any" in unit
+    assert "IPAddressAllow=localhost" in unit
+    assert "InaccessiblePaths=/run/credentials" in unit
+    assert "LoadCredential" not in unit
+    assert "SupplementaryGroups=gitops" not in unit
+
+
+def test_isolated_executor_wait_budget_includes_safety_margin():
+    assert _isolated_executor_wait_seconds(({"timeout_seconds":1200},)) == 1230
+
+
+def test_prepared_deterministic_plan_precedes_source_capture_at_same_priority():
+    deterministic=SimpleNamespace(action="deterministic",task_id="task-deterministic")
+    source_capture=SimpleNamespace(action="source_capture",task_id="task-source-capture")
+    task={"priority":100,"created_at":"2026-08-17T00:00:00Z"}
+    ordered=sorted(((task,source_capture),(task,deterministic)),key=_claim_order)
+    assert ordered[0][1] is deterministic
+
+
+def test_plan_registry_gets_precedence_when_task_has_no_execution(monkeypatch):
+    client=BridgeClient("agent-token-placeholder")
+    seen=[]
+    monkeypatch.setattr(client,"call",lambda route,body:(seen.append((route,body)) or (200,{})))
+    task={"task_id":TASK,"required_capabilities":["git.read"]}
+    client.project_execution(task)
+    assert seen == [("/v2/execution-envelope",{"task_id":TASK,"required_capabilities":["git.read"]})]
+    client.project_execution(task,{"action":"source_capture","source_signals":["trace"]})
+    assert seen[-1][1]["execution"]["action"] == "source_capture"
+
+
+def test_executor_exchange_files_are_group_readable_and_directories_setgid(tmp_path):
+    request=tmp_path/"request.json"
+    IsolatedDeterministicExecutor._atomic(request,b"{}")
+    assert request.stat().st_mode & 0o777 == 0o640
+    tmpfiles=(ROOT/"deploy/tmpfiles.d/aios-online-agent-executor.conf").read_text()
+    assert tmpfiles.count(" 2770 ") == 5
+
+
+def test_precommit_state_recovery_requires_a_later_official_attempt(monkeypatch,tmp_path):
+    import aios_online_agent_worker as worker_module
+    monkeypatch.setattr(worker_module,"STATE_ROOT",tmp_path)
+    state_path=tmp_path/"tasks"/f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({"task_id":TASK,"execution_digest":"a"*64,"phase":"workspace_prepared"}))
+    assert load_task_state(TASK,"b"*64) is None
+    state_path.write_text(json.dumps({"task_id":TASK,"execution_digest":"a"*64,"phase":"verification_passed","attempt":16}))
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=16)
+    assert load_task_state(TASK,"b"*64,attempt=17) is None
+
+
+def test_reconciliation_state_recovery_requires_later_attempt_and_same_job(monkeypatch,tmp_path):
+    import aios_online_agent_worker as worker_module
+    monkeypatch.setattr(worker_module,"STATE_ROOT",tmp_path)
+    state_path=tmp_path/"tasks"/f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({
+        "task_id":TASK,
+        "execution_digest":"a"*64,
+        "phase":"reconciliation_required",
+        "attempt":18,
+        "job_id":JOB,
+        "details":{"api_status":503,"error":"WORKTREE_DIRTY_SCOPE_MISMATCH"},
+    }))
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=18,continuation_job_id=JOB,continuation_head_oid=HEAD)
+    assert load_task_state(TASK,"b"*64,attempt=19,continuation_job_id=JOB,continuation_head_oid=HEAD) is None
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=19,continuation_job_id="job-other",continuation_head_oid=HEAD)
+
+
+def test_legacy_dirty_scope_reconciliation_state_is_exactly_bounded(monkeypatch,tmp_path):
+    import aios_online_agent_worker as worker_module
+    monkeypatch.setattr(worker_module,"STATE_ROOT",tmp_path)
+    state_path=tmp_path/"tasks"/f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({
+        "task_id":TASK,
+        "execution_digest":"a"*64,
+        "phase":"reconciliation_required",
+        "job_id":JOB,
+        "details":{"api_status":503,"error":"WORKTREE_DIRTY_SCOPE_MISMATCH"},
+    }))
+    assert load_task_state(TASK,"b"*64,attempt=19,continuation_job_id=JOB,continuation_head_oid=HEAD) is None
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=19,continuation_job_id=JOB,continuation_head_oid="not-an-oid")
+
+
+def test_completed_same_job_begins_one_idempotent_continuation_cycle(tmp_path):
+    controller=GitOpsJobController(JobStore(tmp_path/"jobs",payload_root=tmp_path/"payloads"))
+    submitted=controller.submit({
+        "idempotency_key":"same-job-continuation-test",
+        "campaign_id":TASK,
+        "task_id":TASK,
+        "repository":"aios/aios",
+        "operation":"GOVERNED_TASK_CREATE",
+        "branch":BRANCH,
+        "expected_branch_oid":HEAD,
+        "payload_digest":"a"*64,
+    })
+    job_id=submitted.job_id
+    controller.advance(job_id,JobState.AUTHORIZED,side_effect_state="AUTHORIZED",expected_revision=0)
+    controller.lease_job(
+        job_id,
+        lease_id="lease-"+job_id,
+        lineage_anchor_oid=BASE,
+        current_head_oid=HEAD,
+        generation=1,
+        lease_expires_at="2099-01-01T00:00:00+00:00",
+        expected_revision=1,
+    )
+    controller.advance(job_id,JobState.WORKTREE_READY,side_effect_state="WORKTREE_READY",expected_revision=2)
+    controller.advance(job_id,JobState.EXECUTING,side_effect_state="IN_PROGRESS",expected_revision=3)
+    controller.advance(job_id,JobState.LOCAL_VERIFIED,side_effect_state="LOCAL_VERIFIED",receipt={"authority_oid":HEAD},expected_revision=4)
+    controller.advance(job_id,JobState.REMOTE_SYNCING,side_effect_state="IN_PROGRESS",expected_revision=5)
+    receipt={
+        "remote_verified":True,
+        "commit_visible":True,
+        "authority_oid":HEAD,
+        "api_branch_oid":HEAD,
+        "git_remote_oid":HEAD,
+    }
+    controller.advance(job_id,JobState.REMOTE_VERIFIED,side_effect_state="REMOTE_VERIFIED",receipt=receipt,expected_revision=6)
+    controller.advance(job_id,JobState.COMPLETED,side_effect_state="REMOTE_VERIFIED",receipt=receipt,expected_revision=7)
+    first=controller.begin_continuation_cycle(
+        job_id,
+        idempotency_key="same-job-continuation-commit-v1",
+        expected_head_oid=HEAD,
+        generation=1,
+        expected_revision=8,
+    )
+    assert first == {"completed":False,"commit_oid":None,"idempotent":False}
+    assert controller.store.read(job_id)["state"] == "LEASED"
+    replay=controller.begin_continuation_cycle(
+        job_id,
+        idempotency_key="same-job-continuation-commit-v1",
+        expected_head_oid=HEAD,
+        generation=1,
+        expected_revision=8,
+    )
+    assert replay == {"completed":False,"commit_oid":None,"idempotent":True}
+
+
+def test_deterministic_materialization_recovers_only_an_in_scope_dirty_subset(monkeypatch,tmp_path):
+    workspace=object.__new__(DetachedGitWorkspace)
+    workspace.path=tmp_path
+    monkeypatch.setattr(DetachedGitWorkspace,"_dirty_paths",lambda _self:{"old.py"})
+    workspace.materialize_files({"old.py":b"new-old\n","new.py":b"new\n"})
+    assert (tmp_path/"old.py").read_bytes() == b"new-old\n"
+    assert (tmp_path/"new.py").read_bytes() == b"new\n"
+    monkeypatch.setattr(DetachedGitWorkspace,"_dirty_paths",lambda _self:{"outside.py"})
+    with pytest.raises(ContinuationExecutionError,match="WORKTREE_DIRTY_SCOPE_MISMATCH"):
+        workspace.materialize_files({"old.py":b"again\n"})