Fix release acceptance health status collision without changing authorization

active-runtime/app/aios_authority_git_executor.py

@@ -9,6 +9,8 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 import os
+import base64
+import hashlib
 from pathlib import Path
 import re
 import subprocess
@@ -58,6 +60,82 @@ class AuthorityGitExecutor:
         value = self._git(["rev-parse", "--verify", ref], check=False)
         return value if value and OID_RE.fullmatch(value) else None
 
+    @staticmethod
+    def _read_path(path: str) -> str:
+        if not isinstance(path, str) or not path or len(path) > 512:
+            raise AuthorityGitError("SOURCE_PATH_INVALID")
+        if "\\" in path or "\x00" in path:
+            raise AuthorityGitError("SOURCE_PATH_INVALID")
+        parts = Path(path).parts
+        if not parts or path.startswith("/") or ".." in parts or ".git" in parts:
+            raise AuthorityGitError("SOURCE_PATH_INVALID")
+        return "/".join(parts)
+
+    def _read_revision(self, ref: str) -> str:
+        if not isinstance(ref, str) or not ref or len(ref) > 256 or "\x00" in ref:
+            raise AuthorityGitError("SOURCE_REF_INVALID")
+        if OID_RE.fullmatch(ref):
+            if not self.commit_exists(ref):
+                raise AuthorityGitError("SOURCE_REF_NOT_FOUND")
+            return ref
+        if ref == "main":
+            ref = "refs/heads/main"
+        elif ref.startswith("agent/"):
+            ref = "refs/heads/" + ref
+        elif ref.startswith("refs/heads/agent/"):
+            pass
+        elif ref == "V2R2C1":
+            ref = "refs/tags/V2R2C1"
+        elif ref.startswith("refs/tags/V"):
+            pass
+        else:
+            raise AuthorityGitError("SOURCE_REF_SCOPE_DENIED")
+        if ".." in ref or not re.fullmatch(r"refs/(heads/(?:agent/[A-Za-z0-9._/-]+|main)|tags/V[0-9]+R[0-9]+C[0-9]+)", ref):
+            raise AuthorityGitError("SOURCE_REF_SCOPE_DENIED")
+        value = self._git(["rev-parse", "--verify", ref + "^{commit}"], check=False)
+        if not OID_RE.fullmatch(value):
+            raise AuthorityGitError("SOURCE_REF_NOT_FOUND")
+        return value
+
+    def read_file(self, ref: str, path: str, max_bytes: int) -> dict[str, object]:
+        if not isinstance(max_bytes, int) or isinstance(max_bytes, bool) or not 1 <= max_bytes <= 262_144:
+            raise AuthorityGitError("SOURCE_MAX_BYTES_INVALID")
+        revision = self._read_revision(ref)
+        relative = self._read_path(path)
+        spec = f"{revision}:{relative}"
+        size_result = subprocess.run(
+            ["git", f"--git-dir={self.git_dir}", "cat-file", "-s", spec],
+            text=True, capture_output=True, check=False,
+        )
+        if size_result.returncode != 0:
+            raise AuthorityGitError("SOURCE_FILE_NOT_FOUND")
+        try:
+            size = int(size_result.stdout.strip())
+        except ValueError as exc:
+            raise AuthorityGitError("SOURCE_FILE_READ_FAILED") from exc
+        if size > max_bytes:
+            raise AuthorityGitError("SOURCE_FILE_TOO_LARGE")
+        result = subprocess.run(
+            ["git", f"--git-dir={self.git_dir}", "show", spec],
+            capture_output=True, check=False,
+        )
+        if result.returncode != 0:
+            raise AuthorityGitError("SOURCE_FILE_NOT_FOUND")
+        content = result.stdout
+        if len(content) != size:
+            raise AuthorityGitError("SOURCE_FILE_READ_FAILED")
+        return {
+            "repository": "aios/aios",
+            "ref": ref,
+            "resolved_commit_oid": revision,
+            "path": relative,
+            "size_bytes": size,
+            "sha256": hashlib.sha256(content).hexdigest(),
+            "content_base64": base64.b64encode(content).decode("ascii"),
+            "truncated": False,
+            "read_only": True,
+        }
+
     def commit_exists(self, oid: str) -> bool:
         _oid(oid, "commit_oid")
         result = subprocess.run(["git", f"--git-dir={self.git_dir}", "cat-file", "-e", oid + "^{commit}"], capture_output=True, check=False)
@@ -94,6 +172,25 @@ class AuthorityGitExecutor:
         self._git(["worktree", "add", "--detach", str(path), base_oid])
         return path
 
+    def create_task_branch(self, branch: str, base_oid: str) -> str:
+        """Create an isolated agent branch once, using an empty-ref CAS."""
+        ref = branch if branch.startswith("refs/heads/") else "refs/heads/" + branch
+        if not TASK_BRANCH_RE.fullmatch(ref):
+            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
+        _oid(base_oid, "base_oid")
+        if not self.commit_exists(base_oid):
+            raise AuthorityGitError("BASE_COMMIT_NOT_FOUND")
+        current = self.read_ref(ref)
+        if current is not None:
+            if current == base_oid:
+                return current
+            raise AuthorityGitError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
+        self._git(["update-ref", ref, base_oid, "0" * 40])
+        readback = self.read_ref(ref)
+        if readback != base_oid:
+            raise AuthorityGitError("AUTHORITY_CAS_READBACK_MISMATCH")
+        return readback
+
     def advance_task_branch_CAS(self, branch: str, expected_oid: str, new_oid: str) -> str:
         if not TASK_BRANCH_RE.fullmatch(branch):
             raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")

active-runtime/app/aios_chatgpt_actions_api.py

@@ -22,6 +22,7 @@ from gitea_tag_publication import (
     TagPublisher,
     redact,
     validate_version,
+    validate_gitea_api_url,
 )
 from orchestrator.action_monitor import ActionMonitor
 from silent_release_hardening import (
@@ -308,8 +309,7 @@ def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
         raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
 
 def existing_tag_target(tag: str) -> str | None:
-    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
-        raise ValueError('invalid release version')
+    validate_version(tag)
     try:
         result = run_authoritative_git(
             ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
@@ -344,7 +344,7 @@ def required_authoritative_git_dir() -> Path:
 
 def publication_publisher() -> TagPublisher:
     authoritative_repo = required_authoritative_git_dir()
-    return TagPublisher(
+    publisher = TagPublisher(
         WS,
         GitTagBackend(WS, authoritative_repo=authoritative_repo),
         GiteaTagClient(
@@ -355,6 +355,10 @@ def publication_publisher() -> TagPublisher:
         ),
         os.getenv('AIOS_GITOPS_GITEA_REMOTE','gitea'),
     )
+    publisher.baseline_path = Path(os.getenv(
+        'AIOS_GITOPS_BASELINE_AUTHORITY', str(WS / 'baseline' / 'current.json')
+    ))
+    return publisher
 
 def commit(paths, msg):
     ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
@@ -510,7 +514,15 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj({'error':redact(exc)},413)
                 except (AuthoritativeGitError, RuntimeError) as exc:
                     return self.sendj({'error':redact(exc)},503)
-                return self.sendj({'from':frm,'to':to,'diff':diff})
+                payload = {'from': frm, 'to': to, 'diff': diff}
+                payload.update({
+                    key: diff[key]
+                    for key in (
+                        'from_oid', 'to_oid', 'changed_paths', 'stats',
+                        'total_size_bytes', 'truncated', 'patch_limit_bytes',
+                    )
+                })
+                return self.sendj(payload)
             if path in ('/api/patch','/api/patches','/api/branches','/patch'):
                 snapshot = repository_snapshot(
                     git_dir=AUTHORITATIVE_GIT_DIR,
@@ -622,7 +634,8 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj(
                         service.get_capability_status(candidate_id)
                     )
-                return self.sendj(service.get_release_saga(candidate_id))
+                result = service.get_release_saga(candidate_id)
+                return self.sendj(result, 404 if result.get('status') == 'NOT_FOUND' else 200)
             if path == '/getRecoveryStatus':
                 return self.sendj(
                     silent_release_service().get_recovery_status()
@@ -773,7 +786,10 @@ class H(BaseHTTPRequestHandler):
         a=self.need('tag:create');
         if not a: return
         ver=data.get('version') or data.get('tag')
-        if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
+        try:
+            validate_version(ver)
+        except ValueError:
+            return self.sendj({'error':'version must match VxRxCx'},400)
         if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
             return self.sendj({
                 'error':'production_tag_evidence_required',
@@ -947,6 +963,7 @@ def api_spec():
     return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
 
 def main():
+    validate_gitea_api_url(os.getenv('AIOS_GITOPS_GITEA_API_URL', ''))
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()

active-runtime/app/aios_chatgpt_bridge_v2.py

@@ -11,6 +11,7 @@ BRIDGE_SCHEMA_VERSION = "aios.chatgpt-gitops-bridge.v2"
 BRIDGE_OPERATIONS = (
     "getRuntimeStatus",
     "getGovernedWriteCapabilities",
+    "readRepositoryFile",
     "createGovernedTask",
     "acquireWriterLease",
     "commitFileGoverned",
@@ -44,8 +45,82 @@ OPERATION_REQUIRED_FIELDS = {
     "getReleaseConsistency": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
     "runReleaseAcceptance": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
     "getControlPlaneSnapshot": (),
+    "readRepositoryFile": ("repository", "ref", "path", "max_bytes"),
 }
 
+_OPERATION_PATHS = {
+    "createGovernedTask": "/v2/governed-task",
+    "acquireWriterLease": "/v2/writer-lease",
+    "commitFileGoverned": "/v2/commit-file",
+    "commitFilesGoverned": "/v2/commit-files",
+    "getGitOpsJob": "/v2/job",
+    "resumeGitOpsJob": "/v2/job/resume",
+    "reconcileGitOpsJob": "/v2/job/reconcile",
+    "getTagPublicationStatus": "/v2/tag/status",
+    "getReleaseConsistency": "/v2/release/consistency",
+    "runReleaseAcceptance": "/v2/release/acceptance",
+    "readRepositoryFile": "/v2/source/file",
+}
+
+
+def operation_contracts() -> dict[str, dict[str, object]]:
+    """Return the runtime contract consumed by adapters and schema tooling."""
+    return {
+        operation: {
+            "method": "POST",
+            "path": _OPERATION_PATHS.get(operation),
+            "required_fields": list(fields),
+        }
+        for operation, fields in OPERATION_REQUIRED_FIELDS.items()
+    }
+
+
+def render_openapi_contract_fragment() -> str:
+    required = "\n".join(
+        f"                - {field}"
+        for field in OPERATION_REQUIRED_FIELDS["commitFilesGoverned"]
+    )
+    return (
+        "  /v2/commit-files:\n"
+        "    post:\n"
+        "      operationId: commitFilesGoverned\n"
+        "      summary: Submit one atomic governed commit containing multiple files\n"
+        "      security: [{bearerAuth: []}]\n"
+        "      requestBody:\n"
+        "        required: true\n"
+        "        content:\n"
+        "          application/json:\n"
+        "            schema:\n"
+        "              type: object\n"
+        "              additionalProperties: false\n"
+        "              required:\n"
+        f"{required}\n"
+        "              properties:\n"
+        "                task_id: {type: string}\n"
+        "                repository: {type: string, example: aios/aios}\n"
+        "                expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}\n"
+        "                target_branch: {type: string, pattern: '^agent/[A-Za-z0-9._/-]+$'}\n"
+        "                generation: {type: integer, minimum: 1}\n"
+        "                idempotency_key: {type: string, minLength: 8, maxLength: 128, pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$'}\n"
+        "                files:\n"
+        "                  type: array\n"
+        "                  minItems: 1\n"
+        "                  maxItems: 50\n"
+        "                  items:\n"
+        "                    type: object\n"
+        "                    additionalProperties: false\n"
+        "                    required: [path, content_base64]\n"
+        "                    properties:\n"
+        "                      path: {type: string, minLength: 1, maxLength: 512}\n"
+        "                      content_base64: {type: string}\n"
+        "                message: {type: string, minLength: 1, maxLength: 200}\n"
+        "      responses:\n"
+        "        '200': {description: Governed commit job and verified branch result}\n"
+        "        '400': {description: Contract or policy rejection}\n"
+        "        '409': {description: Branch CAS or idempotency conflict}\n"
+        "      x-openai-isConsequential: true\n"
+    )
+
 
 class RuntimeDriftError(RuntimeError):
     pass
@@ -122,6 +197,7 @@ class BridgeV2Adapter:
             "legacy_writes_enabled": False,
             "governed_writes_enabled": True,
             "operations": list(BRIDGE_OPERATIONS),
+            "operation_contracts": operation_contracts(),
             "force_push": False,
             "main_write": False,
             "tag_write": False,
@@ -153,6 +229,7 @@ class BridgeV2Adapter:
     def acquireWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("acquireWriterLease", request)
     def commitFileGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFileGoverned", request)
     def commitFilesGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFilesGoverned", request)
+    def readRepositoryFile(self, request: Mapping[str, Any]) -> Any: return self._call("readRepositoryFile", request)
     def getGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("getGitOpsJob", request)
     def resumeGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("resumeGitOpsJob", request)
     def reconcileGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("reconcileGitOpsJob", request)

active-runtime/app/aios_chatgpt_bridge_v2_server.py

@@ -4,6 +4,8 @@ from __future__ import annotations
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 import base64
+import hashlib
+import hmac
 import json
 import os
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
@@ -14,14 +16,17 @@ from typing import Any, Mapping
 
 from aios_authority_git_executor import AuthorityGitExecutor
 from aios_chatgpt_bridge_v2 import BridgeV2Adapter, BridgeV2Error, OPERATION_REQUIRED_FIELDS
+from gitea_tag_publication import validate_gitea_api_url
 from aios_continuation_executor import AuthorityGitAdapter, ContinuationCommit, ContinuationExecutor, ContinuationPermissions, ContinuationRuntimeBinding, DetachedGitWorkspace, GiteaContinuationRemote, ServerSideCredentialProjection
 from aios_continuation_lease import WriterLeaseRequestV2
+from scoped_lease_store import ScopedLeaseError, ScopedLeaseStore
 from aios_control_plane_snapshot import build_control_plane_snapshot
-from aios_gitops_job_controller import GitOpsJobController, JobStore
+from aios_gitops_job_controller import GitOpsJobController, JobState, JobStore, _RECOVERABLE
 from aios_governed_task_bootstrap import BootstrapError, GovernedTaskBootstrap
 from governed_production_release import build_executor_config
 
 MAX_BODY = 2 * 1024 * 1024
+MAX_SOURCE_BYTES = 262_144
 ROUTES = {
     "/v2/runtime": "getRuntimeStatus",
     "/v2/capabilities": "getGovernedWriteCapabilities",
@@ -29,6 +34,7 @@ ROUTES = {
     "/v2/writer-lease": "acquireWriterLease",
     "/v2/commit-file": "commitFileGoverned",
     "/v2/commit-files": "commitFilesGoverned",
+    "/v2/source/file": "readRepositoryFile",
     "/v2/job": "getGitOpsJob",
     "/v2/job/resume": "resumeGitOpsJob",
     "/v2/job/reconcile": "reconcileGitOpsJob",
@@ -52,7 +58,7 @@ class RuntimeConfig:
     ssh_key_path: Path
     remote_name: str = "gitea-http"
     repository: str = "aios/aios"
-    api_base: str = "https://g.cnnetmkt.top/git/api/v1"
+    api_base: str = ""
     v2_task_id: str = "TASK-P0-CHATGPT-BRIDGE-V2-CONTROL-PLANE-CONVERGENCE-20260809"
     v2_branch: str = "agent/p0-chatgpt-bridge-v2-control-plane-convergence-20260809"
     target_version: str = "V2R2C1"
@@ -74,6 +80,7 @@ class GovernedRuntime:
         self.runtimes: dict[tuple[str, int], tuple[Any, GitOpsJobController, ContinuationExecutor]] = {}
         self.controllers: dict[str, GitOpsJobController] = {}
         self.bindings: dict[str, dict[str, Any]] = {}
+        self.leases = ScopedLeaseStore(config.state_root / "scoped-leases.sqlite3")
         self.release = build_executor_config(config)
         metadata_root = config.state_root / "task-bindings"
         if metadata_root.is_dir():
@@ -115,6 +122,30 @@ class GovernedRuntime:
         key = (str(request["task_id"]), int(request["generation"]))
         if key in self.runtimes: return self.runtimes[key]
         lease = WriterLeaseRequestV2(task_id=str(request["task_id"]), repository=str(request["repository"]), branch_mode=str(request.get("branch_mode", "CONTINUE_EXISTING")), base_oid=str(request["base_oid"]), expected_branch_oid=str(request["expected_branch_oid"]), target_branch=str(request["target_branch"]), generation=int(request["generation"]), lease_seconds=int(request.get("lease_seconds", 900)))
+        original_branch_mode = lease.branch_mode
+        if lease.branch_mode == "CREATE_NEW":
+            try:
+                lease.validate(AuthorityGitAdapter(self.authority))
+            except Exception as exc:
+                # A request replay after the authority CAS may observe the
+                # already-created branch. Only the exact base identity is
+                # idempotent; all other validation failures remain fail-closed.
+                if str(exc) != "TARGET_BRANCH_ALREADY_EXISTS":
+                    raise
+            # Bootstrap owns the durable binding; the runtime performs the one-time
+            # branch materialization through the authority CAS before continuation
+            # validation. No direct Git or legacy writer path is used.
+            self.authority.create_task_branch(lease.target_branch, lease.base_oid)
+            lease = WriterLeaseRequestV2(
+                task_id=lease.task_id,
+                repository=lease.repository,
+                branch_mode="CONTINUE_EXISTING",
+                base_oid=lease.base_oid,
+                expected_branch_oid=lease.expected_branch_oid,
+                target_branch=lease.target_branch,
+                generation=lease.generation,
+                lease_seconds=lease.lease_seconds,
+            )
         lease.validate(AuthorityGitAdapter(self.authority))
         worktree_path = self.config.state_root / "worktrees" / _safe(lease.task_id)
         if worktree_path.exists():
@@ -124,16 +155,102 @@ class GovernedRuntime:
             workspace = DetachedGitWorkspace(worktree_path)
         if workspace.head_oid() != lease.expected_branch_oid or not workspace.is_detached(): raise RuntimeError("WORKTREE_HEAD_MISMATCH")
         job_root = self._job_root(lease.task_id); controller = GitOpsJobController(JobStore(job_root, payload_root=job_root / "payloads")); credential = ServerSideCredentialProjection(self.config.ssh_key_path, self.config.token_path); remote = GiteaContinuationRemote(workspace=worktree_path, credential=credential, remote_name=self.config.remote_name, repository=lease.repository, api_base=self.config.api_base); executor = ContinuationExecutor(controller, AuthorityGitAdapter(self.authority), workspace, remote, credential)
-        binding = ContinuationRuntimeBinding(request=lease, workspace_path=worktree_path, lease_not_before=datetime.now(timezone.utc) - timedelta(seconds=1), lease_expires_at=datetime.now(timezone.utc) + timedelta(seconds=lease.lease_seconds), original_receipt_valid=True, original_grant_consumed=True, permissions=ContinuationPermissions())
+        binding = ContinuationRuntimeBinding(request=lease, workspace_path=worktree_path, lease_not_before=datetime.now(timezone.utc) - timedelta(seconds=1), lease_expires_at=datetime.now(timezone.utc) + timedelta(seconds=lease.lease_seconds), original_receipt_valid=True, original_grant_consumed=True, permissions=ContinuationPermissions(), remote_branch_create_allowed=original_branch_mode == "CREATE_NEW")
         result = (binding, controller, executor); self.runtimes[key] = result; self.controllers[lease.task_id] = controller; return result
 
+    def _validate_task_binding(self, request: Mapping[str, Any]) -> None:
+        stored = self.bindings.get(str(request.get("task_id")))
+        if not stored:
+            raise RuntimeError("TASK_BINDING_NOT_FOUND")
+        if (
+            str(request.get("repository")) != str(stored.get("repository"))
+            or str(request.get("target_branch")) != str(stored.get("target_branch"))
+            or str(request.get("base_oid")) != str(stored.get("base_oid"))
+        ):
+            raise RuntimeError("TASK_LEASE_BINDING_CONFLICT")
+        if str(request.get("branch_mode")) != "CONTINUE_EXISTING":
+            raise RuntimeError("TASK_BRANCH_MODE_INVALID")
+        try:
+            generation = int(request.get("generation"))
+            stored_generation = int(stored.get("generation") or 1)
+        except (TypeError, ValueError) as exc:
+            raise RuntimeError("TASK_LEASE_BINDING_CONFLICT") from exc
+        if generation < stored_generation:
+            raise RuntimeError("TASK_GENERATION_STALE")
+        current = self.authority.read_ref("refs/heads/" + str(request["target_branch"]))
+        if current != str(request.get("expected_branch_oid")):
+            raise RuntimeError("LEASE_EXPECTED_BRANCH_OID_STALE")
+        if not self.authority.ancestry_check(str(stored.get("expected_branch_oid")), str(request["expected_branch_oid"])):
+            raise RuntimeError("TASK_LEASE_LINEAGE_INVALID")
+
     def create_task(self, request: Mapping[str, Any]) -> dict[str, Any]:
         result = self.bootstrap.create(request); self.bindings[result["task_id"]] = result; return result
 
     def acquire_lease(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        binding, _, _ = self._runtime(request)
+        if os.environ.get("AIOS_GITOPS_WRITES_ENABLED", "false").lower() not in {"1", "true", "yes", "on"}:
+            raise RuntimeError("GITOPS_WRITES_DISABLED")
+        self._validate_task_binding(request)
+        try:
+            record, created = self.leases.acquire(request)
+        except ScopedLeaseError:
+            raise
+        if not created:
+            if record["state"] == "EXPIRED":
+                raise RuntimeError("LEASE_EXPIRED")
+            record = {**record, "created": False}
+            return self._lease_response(record["binding"], record)
+        try:
+            binding, _, _ = self._runtime(request)
+        except Exception:
+            # The lease cannot be usable if its detached runtime could not be
+            # established. Leave no durable orphan behind.
+            self.leases.delete(record["lease_key"])
+            raise
         req = binding.request
-        return {"schema": WriterLeaseRequestV2.schema, "task_id": req.task_id, "repository": req.repository, "branch_mode": req.branch_mode, "base_oid": req.base_oid, "expected_branch_oid": req.expected_branch_oid, "target_branch": req.target_branch, "generation": req.generation, "lease_seconds": req.lease_seconds, "create_target_branch": req.branch_mode == "CREATE_NEW", "worktree_mode": "detached_at_base_oid" if req.branch_mode == "CREATE_NEW" else "detached_at_expected_head", "cas_ref_update_required": True}
+        return self._lease_response(
+            {
+                "schema": WriterLeaseRequestV2.schema,
+                "task_id": req.task_id,
+                "repository": req.repository,
+                "branch_mode": req.branch_mode,
+                "base_oid": req.base_oid,
+                "expected_branch_oid": req.expected_branch_oid,
+                "target_branch": req.target_branch,
+                "generation": req.generation,
+                "lease_seconds": req.lease_seconds,
+            },
+            {**record, "created": True},
+        )
+
+    @staticmethod
+    def _lease_response(request: Mapping[str, Any], record: Mapping[str, Any]) -> dict[str, Any]:
+        return {
+            "schema": WriterLeaseRequestV2.schema,
+            "task_id": request["task_id"],
+            "repository": request["repository"],
+            "branch_mode": request["branch_mode"],
+            "base_oid": request["base_oid"],
+            "expected_branch_oid": request["expected_branch_oid"],
+            "target_branch": request["target_branch"],
+            "generation": int(request["generation"]),
+            "lease_seconds": int(request["lease_seconds"]),
+            "lease_key": record["lease_key"],
+            "lease_state": record["state"],
+            "lease_expires_at": record["expires_at"],
+            "idempotent": not bool(record.get("created", True)),
+            "create_target_branch": request["branch_mode"] == "CREATE_NEW",
+            "worktree_mode": "detached_at_base_oid" if request["branch_mode"] == "CREATE_NEW" else "detached_at_expected_head",
+            "cas_ref_update_required": True,
+        }
+
+    def read_source_file(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        repository = str(request.get("repository") or "")
+        if repository != self.config.repository:
+            raise RuntimeError("REPOSITORY_NOT_ALLOWED")
+        max_bytes = request.get("max_bytes")
+        if not isinstance(max_bytes, int) or isinstance(max_bytes, bool) or not 1 <= max_bytes <= MAX_SOURCE_BYTES:
+            raise RuntimeError("SOURCE_MAX_BYTES_INVALID")
+        return self.authority.read_file(str(request.get("ref") or ""), str(request.get("path") or ""), max_bytes)
 
     @staticmethod
     def _files(request: Mapping[str, Any]) -> dict[str, bytes]:
@@ -142,13 +259,29 @@ class GovernedRuntime:
         return files
 
     def commit_files(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        if os.environ.get("AIOS_GITOPS_WRITES_ENABLED", "false").lower() not in {"1", "true", "yes", "on"}:
+            raise RuntimeError("GITOPS_WRITES_DISABLED")
+        self._validate_task_binding(request)
+        record = self.leases.for_commit(request)
+        if record is None:
+            raise RuntimeError("LEASE_NOT_FOUND")
+        if record["state"] == "EXPIRED":
+            raise RuntimeError("LEASE_EXPIRED")
+        if record["state"] == "USED":
+            if record.get("idempotency_key") == str(request["idempotency_key"]):
+                return dict(record["result"])
+            raise RuntimeError("LEASE_ALREADY_USED")
         runtime = self.runtimes.get((str(request["task_id"]), int(request["generation"])))
-        if runtime is None: raise RuntimeError("LEASE_NOT_FOUND")
+        if runtime is None:
+            runtime = self._runtime(record["binding"])
         binding, _, executor = runtime
-        if request["target_branch"] != binding.request.target_branch or request["expected_branch_oid"] != binding.request.expected_branch_oid: raise RuntimeError("LEASE_BINDING_CONFLICT")
+        if request["repository"] != binding.request.repository or request["target_branch"] != binding.request.target_branch or request["expected_branch_oid"] != binding.request.expected_branch_oid:
+            raise RuntimeError("LEASE_BINDING_CONFLICT")
         commit = ContinuationCommit(idempotency_key=str(request["idempotency_key"]), files=self._files(request), message=str(request["message"]))
         executor.workspace.materialize_files(commit.files)
-        return executor.execute(binding, commit)
+        result = executor.execute(binding, commit)
+        self.leases.mark_used(record["lease_key"], commit.idempotency_key, result)
+        return result
 
     def _controller_for_job(self, job_id: str) -> GitOpsJobController:
         for controller in self.controllers.values():
@@ -280,6 +413,8 @@ class GovernedRuntime:
             return controller.store._receipt(row, duplicate=True).as_dict()
         if action == "resume":
             return controller.resume(job_id).as_dict()
+        if JobState(row["state"]) not in _RECOVERABLE:
+            return controller.store._receipt(row, duplicate=True).as_dict()
         return self._executor_from_row(row, controller).reconcile(job_id)
 
     def _snapshot_task(self) -> dict[str, Any]:
@@ -345,6 +480,7 @@ class GovernedRuntime:
             "acquireWriterLease": self.acquire_lease,
             "commitFileGoverned": lambda request: self.commit_files({**request, "files": {request["path"]: request["content_base64"]}}),
             "commitFilesGoverned": self.commit_files,
+            "readRepositoryFile": self.read_source_file,
             "getGitOpsJob": lambda request: self.job(request, "get"),
             "resumeGitOpsJob": lambda request: self.job(request, "resume"),
             "reconcileGitOpsJob": lambda request: self.job(request, "reconcile"),
@@ -369,6 +505,7 @@ class _HTTPError(RuntimeError): pass
 
 class BridgeHandler(BaseHTTPRequestHandler):
     adapter: BridgeV2Adapter | None = None
+    action_token_path: Path | None = None
     def log_message(self, *_args: Any) -> None: return
     def _json(self, value: Any, status: int = 200) -> None:
         raw = json.dumps(value, sort_keys=True, separators=(",", ":")).encode(); self.send_response(status); self.send_header("Content-Type", "application/json"); self.send_header("Content-Length", str(len(raw))); self.end_headers(); self.wfile.write(raw)
@@ -379,6 +516,43 @@ class BridgeHandler(BaseHTTPRequestHandler):
         value = json.loads(self.rfile.read(length).decode("utf-8"))
         if not isinstance(value, dict): raise _HTTPError("JSON_OBJECT_REQUIRED")
         return value
+    def _authorized(self, operation: str) -> bool:
+        if operation not in {"readRepositoryFile", "acquireWriterLease", "commitFilesGoverned", "commitFileGoverned"}:
+            return True
+        header = self.headers.get("Authorization", "")
+        token = header[7:].strip() if header.startswith("Bearer ") else self.headers.get("X-AIOS-Token", "")
+        if not token or self.action_token_path is None or not self.action_token_path.is_file():
+            self._json({"error": "UNAUTHORIZED", "hint": "Bearer token required"}, 401)
+            return False
+        digest = hashlib.sha256(token.encode()).hexdigest()
+        try:
+            records = self.action_token_path.read_text(encoding="utf-8").splitlines()
+        except OSError:
+            self._json({"error": "AUTHORITY_UNAVAILABLE"}, 503)
+            return False
+        for raw in records:
+            line = raw.strip()
+            if not line or line.startswith("#"):
+                continue
+            try:
+                record = json.loads(line) if line.startswith("{") else {"token_plain": line, "scopes": ["*"]}
+            except ValueError:
+                continue
+            if record.get("disabled"):
+                continue
+            valid = bool(record.get("token_sha256") and hmac.compare_digest(str(record["token_sha256"]), digest))
+            valid = valid or bool(record.get("token_plain") and hmac.compare_digest(str(record["token_plain"]), token))
+            scopes = set(record.get("scopes") or [])
+            required = {
+                "readRepositoryFile": {"repository:read", "file:write"},
+                "acquireWriterLease": {"agent-task:control"},
+                "commitFilesGoverned": {"file:write"},
+                "commitFileGoverned": {"file:write"},
+            }[operation]
+            if valid and ("*" in scopes or required.intersection(scopes)):
+                return True
+        self._json({"error": "FORBIDDEN", "required_scope": sorted(required)}, 403)
+        return False
     def _allowed(self, operation: str, body: Mapping[str, Any]) -> None:
         allowed = set(OPERATION_REQUIRED_FIELDS[operation]) | {"schema", "lease_seconds", "create_target_branch", "worktree_mode", "cas_ref_update_required", "expected_branch_oid", "generation", "branch_mode"}
         if operation == "commitFilesGoverned": allowed.add("files")
@@ -394,14 +568,28 @@ class BridgeHandler(BaseHTTPRequestHandler):
         operation = ROUTES.get(self.path)
         if operation is None or operation in ("getRuntimeStatus", "getGovernedWriteCapabilities") or self.adapter is None: self._json({"error": "NOT_FOUND"}, 404); return
         try:
+            if not self._authorized(operation):
+                return
             body = self._body(); self._allowed(operation, body); self._json(getattr(self.adapter, operation)(body))
         except _HTTPError as exc: self._json({"error": str(exc)}, 413 if str(exc) == "REQUEST_TOO_LARGE" else 400)
         except (BootstrapError, ValueError, BridgeV2Error) as exc: self._json({"error": str(exc)}, 409 if "CONFLICT" in str(exc) else 400)
-        except Exception as exc: self._json({"error": str(exc) or type(exc).__name__}, 409 if any(token in str(exc) for token in ("CONFLICT", "EXPECTATION", "MONOTONIC")) else 503)
+        except Exception as exc:
+            code = str(exc) or type(exc).__name__
+            if code.endswith("NOT_FOUND") or code in {"SOURCE_FILE_NOT_FOUND", "SOURCE_REF_NOT_FOUND", "LEASE_NOT_FOUND"}:
+                status = 404
+            elif code in {"SOURCE_FILE_TOO_LARGE", "SOURCE_MAX_BYTES_INVALID", "SOURCE_PATH_INVALID", "SOURCE_REF_INVALID", "SOURCE_REF_SCOPE_DENIED", "REPOSITORY_NOT_ALLOWED", "GITOPS_WRITES_DISABLED"}:
+                status = 400 if code != "GITOPS_WRITES_DISABLED" else 423
+            elif any(token in code for token in ("CONFLICT", "EXPECTATION", "MONOTONIC", "EXPIRED", "ALREADY_USED", "STALE", "BINDING")):
+                status = 409
+            else:
+                status = 503
+            self._json({"error": code, "retryable": status >= 500}, status)
 
 
 def serve(adapter: BridgeV2Adapter, host: str = "127.0.0.1", port: int = 18892) -> None:
-    BridgeHandler.adapter = adapter; ThreadingHTTPServer((host, port), BridgeHandler).serve_forever()
+    BridgeHandler.adapter = adapter
+    BridgeHandler.action_token_path = Path(os.environ.get("AIOS_GITOPS_TOKEN_FILE", "/var/lib/aios-gitops/runtime/secrets/gitops.tokens"))
+    ThreadingHTTPServer((host, port), BridgeHandler).serve_forever()
 
 
 def main() -> None:
@@ -418,8 +606,12 @@ def main() -> None:
         token_path,
         ssh_key_path,
         remote_name=os.environ.get("AIOS_GITEA_REMOTE", "gitea-http"),
-        api_base=os.environ.get("AIOS_GITEA_API_BASE", "https://g.cnnetmkt.top/git/api/v1"),
+        api_base=validate_gitea_api_url(os.environ.get("AIOS_GITEA_API_BASE", "")),
         target_version=os.environ.get("AIOS_CONTROL_PLANE_TARGET_VERSION", "V2R2C1"),
+        baseline_path=Path(os.environ.get(
+            "AIOS_GITOPS_BASELINE_AUTHORITY",
+            "/var/lib/aios-gitops-runtime-anchor/baseline/current.json",
+        )),
     )
     runtime = GovernedRuntime(config)
     serve(

active-runtime/app/aios_continuation_executor.py

@@ -56,7 +56,7 @@ class AuthorityPort(Protocol):
 
 class RemotePort(Protocol):
     def repository_identity(self) -> str: ...
-    def push_exact(self, branch: str, expected: str, new: str) -> None: ...
+    def push_exact(self, branch: str, expected: str, new: str, *, allow_absent: bool = False) -> None: ...
     def read_git_ref(self, branch: str) -> str | None: ...
     def read_api_branch(self, branch: str) -> str | None: ...
     def commit_visible(self, oid: str) -> bool: ...
@@ -258,10 +258,11 @@ class GiteaContinuationRemote:
             raise ContinuationExecutionError("GITEA_GIT_READBACK_INVALID")
         return oid
 
-    def push_exact(self, branch: str, expected: str, new: str) -> None:
+    def push_exact(self, branch: str, expected: str, new: str, *, allow_absent: bool = False) -> None:
         self._require_projected()
         self.repository_identity()
-        if self.read_git_ref(branch) != expected:
+        current = self.read_git_ref(branch)
+        if current != expected and not (allow_absent and current is None):
             raise ContinuationExecutionError("GITEA_BRANCH_EXPECTATION_MISMATCH")
         _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
 
@@ -335,6 +336,7 @@ class ContinuationRuntimeBinding:
     original_receipt_valid: bool
     original_grant_consumed: bool
     permissions: ContinuationPermissions
+    remote_branch_create_allowed: bool = False
 
 
 @dataclass(frozen=True, slots=True)
@@ -450,6 +452,7 @@ class ContinuationExecutor:
             "payload_digest": hashlib.sha256(payload).hexdigest(),
             "lineage_anchor_oid": request.base_oid,
             "generation": request.generation,
+            "remote_branch_create_allowed": binding.remote_branch_create_allowed,
         }
 
     def execute(self, binding: ContinuationRuntimeBinding, commit: ContinuationCommit) -> dict[str, object]:
@@ -499,7 +502,7 @@ class ContinuationExecutor:
             )
             try:
                 self.controller.advance(submitted.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
-                self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
+                self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid, allow_absent=binding.remote_branch_create_allowed)
             except Exception:
                 return self._remote_pending(submitted.job_id, authority_oid, new_oid)
             return self._finish_remote_verification(submitted.job_id, authority_oid, new_oid)
@@ -583,11 +586,14 @@ class ContinuationExecutor:
                 and self.authority.is_ancestor(git_oid, new_oid)
             ):
                 self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_CHAIN")
-                self.remote.push_exact(row["branch"], git_oid, new_oid)
+                self.remote.push_exact(row["branch"], git_oid, new_oid, allow_absent=bool(request.get("remote_branch_create_allowed")) or request.get("branch_mode") == "CREATE_NEW")
                 return self._finish_remote_verification(job_id, new_oid, new_oid)
-            if authority_oid == new_oid and git_oid == api_oid == expected_oid:
+            allow_remote_create = bool(request.get("remote_branch_create_allowed")) or request.get("branch_mode") == "CREATE_NEW" or (git_oid is None and api_oid is None)
+            remote_matches_expected = git_oid == api_oid == expected_oid
+            remote_absent_for_create = git_oid is None and api_oid is None
+            if authority_oid == new_oid and (remote_matches_expected or remote_absent_for_create):
                 self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_RETRY")
-                self.remote.push_exact(row["branch"], expected_oid, new_oid)
+                self.remote.push_exact(row["branch"], expected_oid, new_oid, allow_absent=allow_remote_create)
                 return self._finish_remote_verification(job_id, new_oid, new_oid)
             return self.controller.store._receipt(row, duplicate=True).as_dict()
         finally:

active-runtime/app/aios_gitops_job_controller.py

@@ -41,6 +41,8 @@ class JobState(str, Enum):
     REMOTE_SYNCING = "REMOTE_SYNCING"
     REMOTE_VERIFIED = "REMOTE_VERIFIED"
     COMPLETED = "COMPLETED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
     RECOVERABLE_FAILURE = "RECOVERABLE_FAILURE"
     RECONCILING = "RECONCILING"
     RECONCILIATION_REQUIRED = "RECONCILIATION_REQUIRED"
@@ -59,7 +61,12 @@ _ORDER = {
     JobState.COMPLETED: 8,
 }
 _RECOVERABLE = {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}
-_TERMINAL = {JobState.COMPLETED, JobState.MANUAL_OWNER_REVIEW_REQUIRED}
+_TERMINAL = {
+    JobState.COMPLETED,
+    JobState.FAILED,
+    JobState.CANCELLED,
+    JobState.MANUAL_OWNER_REVIEW_REQUIRED,
+}
 
 
 def utc_now() -> str:

active-runtime/app/aios_gitops_model_api.py

@@ -5,6 +5,8 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
 
+from release_version import validate_release_version
+
 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WORKSPACE = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
 DB_PATH = Path(os.getenv('AIOS_GITOPS_DB', str(ROOT / 'runtime' / 'gitops_model.sqlite3')))
@@ -218,7 +220,11 @@ class Handler(BaseHTTPRequestHandler):
                 a = self.require_write(['owner']);
                 if not a: return
                 ver=data.get('version') or data.get('tag')
-                if not re.match(r'^V\d+R\d+C\d+(-[a-zA-Z0-9_.-]+)?$', ver or ''): self.send_json({'error':'version must match VxRxCx'},400); return
+                try:
+            validate_release_version(ver)
+        except ValueError:
+            self.send_json({'error':'version must match VxRxCx'},400)
+            return
                 msg=data.get('message') or f'release {ver}'; out=git_cmd(['tag','-a',ver,'-m',msg]);
                 if data.get('push',False): git_cmd(['push','origin',ver])
                 level='V' if re.match(r'^V[1-9]\d*R0C0', ver) else ('R' if re.match(r'^V\d+R[1-9]\d*C0', ver) else 'C'); exec_sql('INSERT OR REPLACE INTO gitops_versions(version,tag,level,summary,status,created_by,created_at) VALUES(?,?,?,?,?,?,?)',(ver,ver,level,msg,'ready',a['username'],now())); exec_sql('UPDATE gitops_baseline SET active_version=?,active_tag=?,updated_at=? WHERE id=?',(ver,ver,now(),'current')); audit(a['username'],'git_tag',ver,{'level':level}); self.send_json({'status':'tagged','version':ver,'git':out}); return

active-runtime/app/aios_model_api_staging.py

@@ -23,6 +23,7 @@ from gitea_tag_publication import (
     TagPublisher,
     redact,
     validate_version,
+    validate_gitea_api_url,
 )
 from orchestrator.action_monitor import ActionMonitor
 from silent_release_hardening import (
@@ -123,12 +124,19 @@ SILENT_RELEASE_POST_PATHS = frozenset({
     '/submitOwnerApproval',
     '/startDeployment',
 })
+BRIDGE_CONTROL_POST_PATHS = frozenset({
+    '/readRepositoryFile',
+    '/acquireWriterLease',
+    '/commitFilesGoverned',
+})
 
 def reject_non_read_http(handler, method: str, path: str) -> bool:
     if method == 'GET':
         return False
     if path in SILENT_RELEASE_POST_PATHS:
         return False
+    if method == 'POST' and path in BRIDGE_CONTROL_POST_PATHS:
+        return False
     if (
         method == 'POST'
         and path in ('/api/file', '/api/commit-file')
@@ -319,8 +327,7 @@ def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
         raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
 
 def existing_tag_target(tag: str) -> str | None:
-    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
-        raise ValueError('invalid release version')
+    validate_version(tag)
     try:
         result = run_authoritative_git(
             ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
@@ -343,6 +350,16 @@ def publication_request_from_query(q: dict[str, list[str]]) -> PublicationReques
         (q['approval_plan_id'])[0],
     )
 
+
+def governed_release_query_payload(q: dict[str, list[str]]) -> dict[str, str]:
+    request = publication_request_from_query(q)
+    return {
+        'version': request.version,
+        'target_oid': request.target_oid,
+        'evidence_closure_oid': request.evidence_closure_oid,
+        'approval_plan_id': request.approval_plan_id,
+    }
+
 def required_authoritative_git_dir() -> Path:
     snapshot = repository_snapshot(
         git_dir=AUTHORITATIVE_GIT_DIR,
@@ -355,7 +372,7 @@ def required_authoritative_git_dir() -> Path:
 
 def publication_publisher() -> TagPublisher:
     authoritative_repo = required_authoritative_git_dir()
-    return TagPublisher(
+    publisher = TagPublisher(
         WS,
         GitTagBackend(WS, authoritative_repo=authoritative_repo),
         GiteaTagClient(
@@ -366,6 +383,10 @@ def publication_publisher() -> TagPublisher:
         ),
         os.getenv('AIOS_GITOPS_GITEA_REMOTE','gitea'),
     )
+    publisher.baseline_path = Path(os.getenv(
+        'AIOS_GITOPS_BASELINE_AUTHORITY', str(WS / 'baseline' / 'current.json')
+    ))
+    return publisher
 
 def commit(paths, msg):
     ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
@@ -431,7 +452,10 @@ class H(BaseHTTPRequestHandler):
         request = urllib.request.Request(
             base + route,
             data=json.dumps(data, sort_keys=True, separators=(',', ':')).encode('utf-8'),
-            headers={'Content-Type': 'application/json'},
+            headers={
+                'Content-Type': 'application/json',
+                **({k: self.headers[k] for k in ('Authorization', 'X-AIOS-Token') if self.headers.get(k)}),
+            },
             method='POST',
         )
         try:
@@ -446,6 +470,36 @@ class H(BaseHTTPRequestHandler):
             return self.sendj(body, exc.code)
         except (urllib.error.URLError, TimeoutError) as exc:
             return self.sendj({'error': 'GOVERNED_BRIDGE_UNAVAILABLE', 'detail': type(exc).__name__}, 503)
+    def bridge_control(self, path, data):
+        route = {
+            '/readRepositoryFile': '/v2/source/file',
+            '/acquireWriterLease': '/v2/writer-lease',
+            '/commitFilesGoverned': '/v2/commit-files',
+        }.get(path)
+        if route is None:
+            return self.sendj({'error': 'governed_control_route_invalid'}, 400)
+        base = os.getenv('AIOS_BRIDGE_V2_URL', 'http://127.0.0.1:18892').rstrip('/')
+        request = urllib.request.Request(
+            base + route,
+            data=json.dumps(data, sort_keys=True, separators=(',', ':')).encode('utf-8'),
+            headers={
+                'Content-Type': 'application/json',
+                **({k: self.headers[k] for k in ('Authorization', 'X-AIOS-Token') if self.headers.get(k)}),
+            },
+            method='POST',
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=60) as response:
+                result = json.loads(response.read().decode('utf-8'))
+                return self.sendj(result, response.status)
+        except urllib.error.HTTPError as exc:
+            try:
+                body = json.loads(exc.read().decode('utf-8'))
+            except Exception:
+                body = {'error': 'bridge_http_error'}
+            return self.sendj(body, exc.code)
+        except (urllib.error.URLError, TimeoutError) as exc:
+            return self.sendj({'error': 'GOVERNED_BRIDGE_UNAVAILABLE', 'detail': type(exc).__name__}, 503)
     def do_POST(self):
         path = urllib.parse.urlparse(self.path).path
         if path in {
@@ -553,7 +607,15 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj({'error':redact(exc)},413)
                 except (AuthoritativeGitError, RuntimeError) as exc:
                     return self.sendj({'error':redact(exc)},503)
-                return self.sendj({'from':frm,'to':to,'diff':diff})
+                payload = {'from': frm, 'to': to, 'diff': diff}
+                payload.update({
+                    key: diff[key]
+                    for key in (
+                        'from_oid', 'to_oid', 'changed_paths', 'stats',
+                        'total_size_bytes', 'truncated', 'patch_limit_bytes',
+                    )
+                })
+                return self.sendj(payload)
             if path in ('/api/patch','/api/patches','/api/branches','/patch'):
                 snapshot = repository_snapshot(
                     git_dir=AUTHORITATIVE_GIT_DIR,
@@ -638,11 +700,15 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj({'error':'invalid release version'},400)
                 return self.sendj(status)
             if path == '/api/release-consistency':
-                request=publication_request_from_query(q)
-                return self.sendj(publication_publisher().get_release_consistency(request))
+                return self.bridge_release(
+                    '/getReleaseConsistency',
+                    governed_release_query_payload(q),
+                )
             if path == '/api/release-acceptance':
-                request=publication_request_from_query(q)
-                return self.sendj(publication_publisher().run_release_acceptance(request))
+                return self.bridge_release(
+                    '/runReleaseAcceptance',
+                    governed_release_query_payload(q),
+                )
             if path in (
                 '/getReleaseCandidate',
                 '/getReleasePlan',
@@ -671,7 +737,8 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj(
                         service.get_capability_status(candidate_id)
                     )
-                return self.sendj(service.get_release_saga(candidate_id))
+                result = service.get_release_saga(candidate_id)
+                return self.sendj(result, 404 if result.get('status') == 'NOT_FOUND' else 200)
             if path == '/getRecoveryStatus':
                 return self.sendj(
                     silent_release_service().get_recovery_status()
@@ -703,6 +770,18 @@ class H(BaseHTTPRequestHandler):
         if reject_non_read_http(self, 'POST', path): return
         data=self.body()
         try:
+            if path == '/readRepositoryFile':
+                a=self.need('file:write')
+                if not a: return
+                return self.bridge_control(path, data)
+            if path == '/acquireWriterLease':
+                a=self.need('agent-task:control')
+                if not a: return
+                return self.bridge_control(path, data)
+            if path == '/commitFilesGoverned':
+                a=self.need('file:write')
+                if not a: return
+                return self.bridge_control(path, data)
             if path == '/createReleaseCandidate':
                 a=self.need('release:candidate')
                 if not a: return
@@ -822,7 +901,10 @@ class H(BaseHTTPRequestHandler):
         a=self.need('tag:create');
         if not a: return
         ver=data.get('version') or data.get('tag')
-        if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
+        try:
+            validate_version(ver)
+        except ValueError:
+            return self.sendj({'error':'version must match VxRxCx'},400)
         if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
             return self.sendj({
                 'error':'production_tag_evidence_required',
@@ -1016,7 +1098,7 @@ def api_spec():
 
 
 def main():
+    validate_gitea_api_url(os.getenv('AIOS_GITOPS_GITEA_API_URL', ''))
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()
-

active-runtime/app/aios_model_api_staging_list_patches_overlay.py

@@ -0,0 +1,229 @@
+#!/usr/bin/env python3
+"""Small staging-only response overlay for the legacy listPatches route.
+
+The base staging module remains the source of truth for routing, auth, and
+governed write behavior.  This entrypoint only replaces the handler's JSON
+serializer for the patch-read aliases, projecting the legacy payload into a
+bounded, cursor-pageable summary while leaving every other route untouched.
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import re
+import urllib.parse
+from typing import Any
+
+import aios_model_api_staging as base
+
+
+PATCH_PATHS = frozenset({"/api/patch", "/api/patches", "/api/branches", "/patch"})
+PATCH_DEFAULT_LIMIT = 20
+PATCH_MAX_LIMIT = 100
+PATCH_RESPONSE_BUDGET = 128 * 1024
+PATCH_FIELD_MAX_CHARS = 256
+PATCH_SUMMARY_MAX_CHARS = 1024
+PATCH_COMPAT_LIST_LIMIT = 20
+_TOKEN_RE = re.compile(r"(?i)(?:sk-|ghp_|bearer\s+)[A-Za-z0-9._:/+=-]{12,}")
+
+
+def _text(value: Any, limit: int = PATCH_FIELD_MAX_CHARS) -> str:
+    if value is None:
+        return ""
+    if isinstance(value, (dict, list)):
+        value = json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+    value = _TOKEN_RE.sub("[REDACTED]", str(value))
+    return value if len(value) <= limit else value[: max(1, limit - 1)] + "…"
+
+
+def _record_id(record: dict[str, Any], index: int) -> str:
+    return _text(
+        record.get("patch_id")
+        or record.get("id")
+        or record.get("patch_name")
+        or record.get("branch")
+        or f"patch-{index}",
+    )
+
+
+def _record_key(record: dict[str, Any], index: int) -> tuple[bool, str, str, int]:
+    timestamp = _text(
+        record.get("updated_at")
+        or record.get("updatedAt")
+        or record.get("created_at")
+        or record.get("createdAt")
+    )
+    return bool(timestamp), timestamp, _record_id(record, index), index
+
+
+def _summary(record: dict[str, Any], index: int, summary_limit: int) -> dict[str, Any]:
+    patch_id = _record_id(record, index)
+    raw_summary = next(
+        (
+            record.get(key)
+            for key in ("summary", "description", "text", "intent")
+            if record.get(key) not in (None, "")
+        ),
+        "",
+    )
+    summary = _text(raw_summary, summary_limit)
+    item = {
+        "patch_id": patch_id,
+        "name": _text(record.get("name") or record.get("title") or record.get("patch_name") or patch_id),
+        "branch": _text(record.get("branch")) or None,
+        "ref": _text(record.get("ref") or record.get("branch")) or None,
+        "status": _text(record.get("status") or record.get("state") or "recorded"),
+        "risk": _text(record.get("risk")) or None,
+        "created_at": _text(record.get("created_at") or record.get("createdAt")) or None,
+        "updated_at": _text(record.get("updated_at") or record.get("updatedAt")) or None,
+        "commit_oid": _text(record.get("commit_oid") or record.get("commit") or record.get("oid"), 128) or None,
+        "summary": summary,
+    }
+    if len(_text(raw_summary, PATCH_SUMMARY_MAX_CHARS + 1)) > summary_limit:
+        item["summary_truncated"] = True
+    return item
+
+
+def _branch_summary(record: Any, index: int) -> Any:
+    if not isinstance(record, dict):
+        return _text(record)
+    return {
+        "name": _text(record.get("name") or record.get("branch") or f"branch-{index}"),
+        "ref": _text(record.get("ref") or record.get("name") or record.get("branch")) or None,
+        "oid": _text(record.get("oid") or record.get("commit_oid") or record.get("commit"), 128) or None,
+        "updated_at": _text(record.get("updated_at") or record.get("updatedAt")) or None,
+    }
+
+
+def _encode_cursor(key: tuple[bool, str, str, int]) -> str:
+    raw = json.dumps(
+        {"has_timestamp": key[0], "timestamp": key[1], "patch_id": key[2], "index": key[3]},
+        separators=(",", ":"),
+    ).encode("utf-8")
+    return base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
+
+
+def _decode_cursor(value: Any) -> tuple[bool, str, str, int]:
+    if not isinstance(value, str) or not value or len(value) > 256 or re.fullmatch(r"[A-Za-z0-9_-]+", value) is None:
+        raise ValueError("invalid_cursor")
+    try:
+        padded = value + "=" * (-len(value) % 4)
+        decoded = json.loads(base64.urlsafe_b64decode(padded.encode("ascii")).decode("utf-8"))
+    except Exception as exc:
+        raise ValueError("invalid_cursor") from exc
+    if (
+        not isinstance(decoded, dict)
+        or set(decoded) != {"has_timestamp", "timestamp", "patch_id", "index"}
+        or not isinstance(decoded["has_timestamp"], bool)
+        or not isinstance(decoded["timestamp"], str)
+        or not isinstance(decoded["patch_id"], str)
+        or not isinstance(decoded["index"], int)
+        or decoded["index"] < 0
+    ):
+        raise ValueError("invalid_cursor")
+    return decoded["has_timestamp"], decoded["timestamp"], decoded["patch_id"], decoded["index"]
+
+
+def _limit(query: dict[str, list[str]]) -> int:
+    raw = (query.get("limit") or [str(PATCH_DEFAULT_LIMIT)])[0]
+    try:
+        result = int(raw)
+    except (TypeError, ValueError) as exc:
+        raise ValueError("invalid_limit") from exc
+    if not 1 <= result <= PATCH_MAX_LIMIT:
+        raise ValueError("invalid_limit")
+    return result
+
+
+def _page(records: list[Any], query: dict[str, list[str]], summary_limit: int = PATCH_SUMMARY_MAX_CHARS) -> dict[str, Any]:
+    limit = _limit(query)
+    rows = [
+        (record, index, _record_key(record, index))
+        for index, record in enumerate(records)
+        if isinstance(record, dict)
+    ]
+    rows.sort(key=lambda row: row[2], reverse=True)
+    cursor = (query.get("cursor") or [None])[0]
+    if cursor:
+        cursor_key = _decode_cursor(cursor)
+        if cursor_key not in {row[2] for row in rows}:
+            raise ValueError("invalid_cursor")
+        rows = [row for row in rows if row[2] < cursor_key]
+    selected = rows[:limit]
+    return {
+        "items": [_summary(record, index, summary_limit) for record, index, _ in selected],
+        "next_cursor": _encode_cursor(selected[-1][2]) if len(rows) > len(selected) and selected else None,
+        "has_more": len(rows) > len(selected),
+        "count": len(selected),
+        "_cursor_keys": [key for _, _, key in selected],
+    }
+
+
+def _bounded_payload(data: dict[str, Any], query: dict[str, list[str]]) -> dict[str, Any]:
+    records = data.get("metadata_patches")
+    if not isinstance(records, list):
+        records = data.get("patches") if isinstance(data.get("patches"), list) else []
+    page = _page(records, query)
+    cursor_keys = page.pop("_cursor_keys")
+    payload = {
+        key: data[key]
+        for key in ("repository_available", "query_error")
+        if key in data
+    }
+    payload["metadata_patches"] = page["items"]
+    payload["patches"] = page["items"]
+    for key in ("orphan_metadata", "branches_without_metadata"):
+        values = data.get(key)
+        payload[key] = [
+            _summary(value, index, PATCH_SUMMARY_MAX_CHARS)
+            if isinstance(value, dict)
+            else _text(value)
+            for index, value in enumerate(values[:PATCH_COMPAT_LIST_LIMIT])
+        ] if isinstance(values, list) else []
+    branches = data.get("authoritative_branches")
+    if isinstance(branches, list):
+        payload["authoritative_branches"] = [
+            _branch_summary(value, index) for index, value in enumerate(branches[:PATCH_COMPAT_LIST_LIMIT])
+        ]
+    if isinstance(data.get("branches"), list):
+        payload["branches"] = [_text(value) for value in data["branches"][:PATCH_COMPAT_LIST_LIMIT]]
+    payload.update(page)
+    payload["list_patches_overlay"] = "bounded-summary-v1"
+
+    while len(json.dumps(payload, ensure_ascii=False, indent=2).encode("utf-8")) > PATCH_RESPONSE_BUDGET and payload["items"]:
+        payload["items"] = payload["items"][:-1]
+        cursor_keys = cursor_keys[:-1]
+        payload["metadata_patches"] = payload["items"]
+        payload["patches"] = payload["items"]
+        payload["count"] = len(payload["items"])
+        payload["has_more"] = True
+        payload["next_cursor"] = (
+            _encode_cursor(cursor_keys[-1])
+            if cursor_keys
+            else None
+        )
+    return payload
+
+
+class ListPatchesOverlayHandler(base.H):
+    """Delegate all behavior except bounded serialization of patch reads."""
+
+    def sendj(self, data: Any, code: int = 200):
+        path = urllib.parse.urlparse(self.path).path.rstrip("/")
+        if path in PATCH_PATHS and code in (200, 503) and isinstance(data, dict):
+            try:
+                data = _bounded_payload(data, urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query))
+            except ValueError as exc:
+                return super().sendj(
+                    {"error": str(exc), "min_limit": 1, "max_limit": PATCH_MAX_LIMIT},
+                    400,
+                )
+        return super().sendj(data, code)
+
+
+base.H = ListPatchesOverlayHandler
+
+
+if __name__ == "__main__":
+    base.main()

active-runtime/app/authoritative_git.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 import os
 import re
 import subprocess
+import time
 import urllib.parse
 from pathlib import Path
 from typing import Iterable
@@ -306,14 +307,76 @@ def authoritative_diff(
     from_oid = validate_git_revision(from_revision, "from", git_dir=path)
     to_oid = validate_git_revision(to_revision, "to", git_dir=path)
     args = ["diff", "--no-ext-diff", "--no-textconv", from_oid, to_oid]
-    result = run_authoritative_git(args, git_dir=path)
+    patch_limit = max(1, min(_MAX_OUTPUT, 256 * 1024))
+    process = subprocess.Popen(
+        ["git", "--git-dir", str(path), *args],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
+    )
+    chunks: list[bytes] = []
+    stored_bytes = 0
+    total_bytes = 0
+    started = time.monotonic()
+    try:
+        while process.stdout is not None:
+            chunk = process.stdout.read(64 * 1024)
+            if not chunk:
+                break
+            total_bytes += len(chunk)
+            if stored_bytes < patch_limit:
+                remaining = patch_limit - stored_bytes
+                selected = chunk[:remaining]
+                chunks.append(selected)
+                stored_bytes += len(selected)
+            if time.monotonic() - started > _TIMEOUT:
+                process.kill()
+                raise AuthoritativeGitError("GIT_REF_QUERY_TIMEOUT")
+        stderr = (
+            process.stderr.read(8192).decode("utf-8", errors="replace")
+            if process.stderr is not None
+            else ""
+        )
+        returncode = process.wait(timeout=max(0.1, _TIMEOUT - (time.monotonic() - started)))
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        process.kill()
+        process.wait()
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED") from exc
+    if returncode != 0:
+        raise AuthoritativeGitError(_redact(stderr.strip() or "GIT_REF_QUERY_FAILED")[:200])
+    try:
+        names_result = run_authoritative_git(
+            ["diff", "--no-ext-diff", "--no-textconv", "--name-status", from_oid, to_oid],
+            git_dir=path,
+        )
+        changed_paths = [
+            line.split("\t", 1)[-1]
+            for line in names_result.stdout.splitlines()
+            if line.strip()
+        ]
+    except AuthoritativeGitOutputTooLarge:
+        changed_paths = []
+    try:
+        stats_result = run_authoritative_git(
+            ["diff", "--no-ext-diff", "--no-textconv", "--stat", from_oid, to_oid],
+            git_dir=path,
+        )
+        stats = stats_result.stdout.strip()
+    except AuthoritativeGitOutputTooLarge:
+        stats = "GIT_STAT_OUTPUT_TRUNCATED"
+    patch = b"".join(chunks).decode("utf-8", errors="replace")
     return {
         "code": 0,
-        "stdout": result.stdout,
+        "stdout": patch,
         "stderr": "",
         "cmd": ["git", f"--git-dir={path}", *args],
         "from_oid": from_oid,
         "to_oid": to_oid,
+        "changed_paths": changed_paths,
+        "stats": stats,
+        "total_size_bytes": total_bytes,
+        "truncated": total_bytes > patch_limit,
+        "patch_limit_bytes": patch_limit,
     }
 
 

active-runtime/app/gitea_tag_publication.py

@@ -8,6 +8,7 @@ import json
 import os
 import re
 import subprocess
+import sys
 import tempfile
 import time
 import urllib.error
@@ -23,10 +24,15 @@ try:
     from authoritative_git import AuthoritativeGitError, run_authoritative_git
 except ModuleNotFoundError:
     from .authoritative_git import AuthoritativeGitError, run_authoritative_git
+try:
+    from release_version import RELEASE_VERSION_RE, validate_release_version
+except ModuleNotFoundError:
+    sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
+    from release_version import RELEASE_VERSION_RE, validate_release_version
 
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
-VERSION_RE = re.compile(r"^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$")
+VERSION_RE = RELEASE_VERSION_RE
 DEPLOYMENT_EVIDENCE_RE = re.compile(r"^(?:sha256:[0-9a-f]{64}|git:[0-9a-f]{40})$")
 FINGERPRINT_FIELDS = (
     "version",
@@ -83,9 +89,14 @@ class PublicationManualOwnerReviewRequired(
 
 
 def validate_version(version: str) -> str:
-    value = str(version or "")
-    if not VERSION_RE.fullmatch(value):
-        raise ValueError("invalid release version")
+    return validate_release_version(version)
+
+
+def validate_gitea_api_url(api_url: str) -> str:
+    value = str(api_url or "").strip().rstrip("/")
+    parsed = urllib.parse.urlsplit(value)
+    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+        raise ValueError("Gitea API URL must be HTTP(S)")
     return value
 
 
@@ -411,13 +422,11 @@ class GiteaTagClient:
         timeout: float = 15,
         token_line: int = 1,
     ):
-        self.api_url = api_url.rstrip("/")
+        self.api_url = validate_gitea_api_url(api_url)
         self.repository = repository.strip("/")
         self.token_file = token_file
         self.timeout = timeout
         self.token_line = token_line
-        if not self.api_url.startswith(("https://", "http://")):
-            raise ValueError("Gitea API URL must be HTTP(S)")
         if self.repository.count("/") != 1:
             raise ValueError("Gitea repository must be owner/name")
 

active-runtime/app/governed_production_release.py

@@ -406,6 +406,14 @@ class GovernedProductionReleaseExecutor:
             config.remote_name,
             state_root=self.root / "tag-publication",
         )
+        # Release checks must use the same explicitly configured staging baseline
+        # as the Action/model runtime; do not fall back to the publication workspace.
+        self.publisher.baseline_path = Path(
+            os.environ.get("AIOS_GITOPS_BASELINE_AUTHORITY", str(config.baseline_path))
+        )
+        # The immutable runtime package is the source of the version projection;
+        # the mutable state workspace only stores publication state.
+        self.publisher.versions_root = Path(__file__).resolve().parents[1] / "versions"
 
     def _request(self, request: Mapping[str, Any]) -> PublicationRequest:
         binding = self.binding
@@ -511,7 +519,11 @@ class GovernedProductionReleaseExecutor:
 
     def acceptance(self, request: Mapping[str, Any]) -> dict[str, Any]:
         result = self.consistency(request)
-        result["accepted"] = result.get("status") == "PASS" and result.get("production_health", {}).get("status") == "ACTIVE_VERIFIED"
+        result["accepted"] = (
+            result.get("status") == "PASS"
+            and result.get("production_health", {}).get("verification_status")
+            == "ACTIVE_VERIFIED"
+        )
         self.state.record("ACCEPTED" if result["accepted"] else "RECONCILIATION_REQUIRED", "acceptance", result)
         return result
 
@@ -533,7 +545,11 @@ def _health(url: str, binding: ReleaseBinding, artifact: Mapping[str, Any]) -> d
             body = json.loads(response.read().decode("utf-8"))
             status = response.status
     except Exception as exc:
-        return {"status": "UNAVAILABLE", "error": type(exc).__name__}
+        return {
+            "status": "UNAVAILABLE",
+            "verification_status": "UNAVAILABLE",
+            "error": type(exc).__name__,
+        }
     expected_artifact = artifact.get("artifact_sha256")
     exact = (
         status == 200
@@ -543,7 +559,11 @@ def _health(url: str, binding: ReleaseBinding, artifact: Mapping[str, Any]) -> d
         and body.get("deployment_state") == "ACTIVE"
         and body.get("production_deployed") is True
     )
-    return {"status": "ACTIVE_VERIFIED" if exact else "CONFLICT", "http_status": status, **body}
+    return {
+        **body,
+        "http_status": status,
+        "verification_status": "ACTIVE_VERIFIED" if exact else "CONFLICT",
+    }
 
 
 def build_executor_config(config: Any) -> GovernedProductionReleaseExecutor:

active-runtime/app/governed_tag_adapter.py

@@ -34,6 +34,8 @@ from gitea_tag_publication import (
     TagPublisher,
 )
 
+from release_version import validate_release_version
+
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
 
@@ -44,8 +46,10 @@ def load_request() -> dict[str, Any]:
         raise ValueError("request_object_required")
     if value.get("schema") != "aios.production-executor-request.v1":
         raise ValueError("request_schema_invalid")
-    if not re.fullmatch(r"V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?", str(value.get("version", ""))):
-        raise ValueError("version_invalid")
+    try:
+        validate_release_version(value.get("version", ""))
+    except ValueError as exc:
+        raise ValueError("version_invalid") from exc
     for name in ("target_oid", "evidence_closure_oid"):
         if not OID_RE.fullmatch(str(value.get(name, ""))):
             raise ValueError(f"{name}_invalid")

active-runtime/app/release_metadata_adapter.py

@@ -27,6 +27,8 @@ import urllib.request
 from pathlib import Path
 from typing import Any, Mapping
 
+from release_version import validate_release_version
+
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA_RE = re.compile(r"^[0-9a-f]{64}$")
 PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
@@ -86,8 +88,10 @@ def load_request() -> dict[str, Any]:
         raise ValueError("request_schema_invalid")
     if value.get("repository_identity") != "aios/aios":
         raise ValueError("repository_identity_invalid")
-    if not re.fullmatch(r"V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?", str(value.get("version", ""))):
-        raise ValueError("version_invalid")
+    try:
+        validate_release_version(value.get("version", ""))
+    except ValueError as exc:
+        raise ValueError("version_invalid") from exc
     for name in ("target_oid", "evidence_closure_oid"):
         if not OID_RE.fullmatch(str(value.get(name, ""))):
             raise ValueError(f"{name}_invalid")

active-runtime/app/scoped_lease_store.py

@@ -0,0 +1,184 @@
+"""Durable, generation-scoped leases for the staging governed writer."""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import hashlib
+import json
+from pathlib import Path
+import sqlite3
+from typing import Any, Mapping
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _iso(value: datetime) -> str:
+    return value.isoformat()
+
+
+def _expired(value: str) -> bool:
+    return datetime.fromisoformat(value).astimezone(timezone.utc) <= _now()
+
+
+class ScopedLeaseError(RuntimeError):
+    pass
+
+
+class ScopedLeaseStore:
+    """A small SQLite CAS boundary; no repository or filesystem writes."""
+
+    def __init__(self, path: Path) -> None:
+        if not path.is_absolute() or path.is_symlink():
+            raise ScopedLeaseError("LEASE_STORE_INVALID")
+        path.parent.mkdir(parents=True, exist_ok=True)
+        self.path = path
+        with self._connect() as db:
+            db.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS scoped_leases (
+                  lease_key TEXT PRIMARY KEY,
+                  task_id TEXT NOT NULL,
+                  repository TEXT NOT NULL,
+                  target_branch TEXT NOT NULL,
+                  expected_branch_oid TEXT NOT NULL,
+                  generation INTEGER NOT NULL,
+                  binding_json TEXT NOT NULL,
+                  expires_at TEXT NOT NULL,
+                  state TEXT NOT NULL,
+                  idempotency_key TEXT,
+                  result_json TEXT,
+                  created_at TEXT NOT NULL,
+                  updated_at TEXT NOT NULL
+                );
+                CREATE INDEX IF NOT EXISTS scoped_leases_binding
+                  ON scoped_leases(task_id, repository, target_branch, generation);
+                """
+            )
+
+    def _connect(self) -> sqlite3.Connection:
+        db = sqlite3.connect(self.path, timeout=30.0)
+        db.row_factory = sqlite3.Row
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        db.execute("PRAGMA busy_timeout=30000")
+        return db
+
+    @staticmethod
+    def key(request: Mapping[str, Any]) -> str:
+        binding = {
+            field: request[field]
+            for field in (
+                "task_id", "repository", "branch_mode", "base_oid",
+                "expected_branch_oid", "target_branch", "generation",
+                "lease_seconds",
+            )
+        }
+        return hashlib.sha256(
+            json.dumps(binding, sort_keys=True, separators=(",", ":")).encode()
+        ).hexdigest()
+
+    @staticmethod
+    def _row(row: sqlite3.Row) -> dict[str, Any]:
+        value = dict(row)
+        value["binding"] = json.loads(value.pop("binding_json"))
+        if value.get("result_json"):
+            value["result"] = json.loads(value.pop("result_json"))
+        else:
+            value.pop("result_json", None)
+        return value
+
+    def acquire(self, request: Mapping[str, Any]) -> tuple[dict[str, Any], bool]:
+        key = self.key(request)
+        now = _now()
+        expires = now.timestamp() + int(request["lease_seconds"])
+        expires_at = _iso(datetime.fromtimestamp(expires, timezone.utc))
+        binding_json = json.dumps(dict(request), sort_keys=True, separators=(",", ":"))
+        try:
+            with self._connect() as db:
+                db.execute("BEGIN IMMEDIATE")
+                exact = db.execute(
+                    "SELECT * FROM scoped_leases WHERE lease_key=?", (key,)
+                ).fetchone()
+                if exact is not None:
+                    if exact["state"] == "ACTIVE" and _expired(exact["expires_at"]):
+                        db.execute(
+                            "UPDATE scoped_leases SET state='EXPIRED',updated_at=? WHERE lease_key=?",
+                            (_iso(now), key),
+                        )
+                        exact = db.execute(
+                            "SELECT * FROM scoped_leases WHERE lease_key=?", (key,)
+                        ).fetchone()
+                    db.commit()
+                    return self._row(exact), False
+                active = db.execute(
+                    "SELECT * FROM scoped_leases WHERE task_id=? AND repository=? AND target_branch=? AND state='ACTIVE'",
+                    (str(request["task_id"]), str(request["repository"]), str(request["target_branch"])),
+                ).fetchall()
+                for row in active:
+                    if _expired(row["expires_at"]):
+                        db.execute(
+                            "UPDATE scoped_leases SET state='EXPIRED',updated_at=? WHERE lease_key=?",
+                            (_iso(now), row["lease_key"]),
+                        )
+                    else:
+                        raise ScopedLeaseError("LEASE_BINDING_CONFLICT")
+                db.execute(
+                    "INSERT INTO scoped_leases(lease_key,task_id,repository,target_branch,expected_branch_oid,generation,binding_json,expires_at,state,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?,?)",
+                    (
+                        key, request["task_id"], request["repository"],
+                        request["target_branch"], request["expected_branch_oid"],
+                        int(request["generation"]), binding_json, expires_at,
+                        "ACTIVE", _iso(now), _iso(now),
+                    ),
+                )
+                row = db.execute(
+                    "SELECT * FROM scoped_leases WHERE lease_key=?", (key,)
+                ).fetchone()
+                db.commit()
+                return self._row(row), True
+        except ScopedLeaseError:
+            raise
+        except sqlite3.Error as exc:
+            raise ScopedLeaseError("LEASE_STORE_UNAVAILABLE") from exc
+
+    def for_commit(self, request: Mapping[str, Any]) -> dict[str, Any] | None:
+        try:
+            with self._connect() as db:
+                row = db.execute(
+                    "SELECT * FROM scoped_leases WHERE task_id=? AND repository=? AND target_branch=? AND expected_branch_oid=? AND generation=? ORDER BY created_at DESC LIMIT 1",
+                    (
+                        request["task_id"], request["repository"],
+                        request["target_branch"], request["expected_branch_oid"],
+                        int(request["generation"]),
+                    ),
+                ).fetchone()
+                if row is None:
+                    return None
+                if row["state"] == "ACTIVE" and _expired(row["expires_at"]):
+                    db.execute(
+                        "UPDATE scoped_leases SET state='EXPIRED',updated_at=? WHERE lease_key=?",
+                        (_iso(_now()), row["lease_key"]),
+                    )
+                    row = db.execute(
+                        "SELECT * FROM scoped_leases WHERE lease_key=?", (row["lease_key"],)
+                    ).fetchone()
+                return self._row(row)
+        except sqlite3.Error as exc:
+            raise ScopedLeaseError("LEASE_STORE_UNAVAILABLE") from exc
+
+    def mark_used(self, lease_key: str, idempotency_key: str, result: Mapping[str, Any]) -> None:
+        with self._connect() as db:
+            updated = db.execute(
+                "UPDATE scoped_leases SET state='USED',idempotency_key=?,result_json=?,updated_at=? WHERE lease_key=? AND state='ACTIVE'",
+                (
+                    idempotency_key, json.dumps(dict(result), sort_keys=True),
+                    _iso(_now()), lease_key,
+                ),
+            )
+            if updated.rowcount != 1:
+                raise ScopedLeaseError("LEASE_ALREADY_USED")
+
+    def delete(self, lease_key: str) -> None:
+        with self._connect() as db:
+            db.execute("DELETE FROM scoped_leases WHERE lease_key=? AND state='ACTIVE'", (lease_key,))

active-runtime/app/silent_release_controller.py

@@ -22,11 +22,12 @@ from enum import Enum
 from pathlib import Path
 from typing import Any, Protocol
 
+from release_version import validate_release_version
+
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
 CANDIDATE_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]{2,127}$")
-VERSION_RE = re.compile(r"^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$")
 SECRET_PATTERNS = (
     re.compile(r"(?i)(authorization\s*[:=]\s*)(?:bearer|token)\s+\S+"),
     re.compile(r"(?i)((?:access_)?token\s*[:=]\s*)\S+"),
@@ -769,8 +770,10 @@ class TagApprovalEnvelope:
     def validate(self) -> None:
         if self.action != "production_tag":
             raise ApprovalError("approval does not authorize production tag")
-        if not VERSION_RE.fullmatch(self.version):
-            raise ApprovalError("invalid release version")
+        try:
+            validate_release_version(self.version)
+        except ValueError as exc:
+            raise ApprovalError("invalid release version") from exc
         _validate_oid("tag_oid", self.tag_oid)
         _validate_oid("target_oid", self.target_oid)
         if _parse_utc(self.expires_at) <= datetime.now(timezone.utc):

active-runtime/app/silent_release_hardening.py

@@ -3457,6 +3457,19 @@ class SilentReleaseActionService:
         }
 
     def get_release_saga(self, candidate_id: str) -> dict[str, Any]:
+        # A read of a never-created candidate is a normal empty-state.  Do
+        # not turn a missing journal into a durable manual-review snapshot.
+        saga_path = self.sagas._path(candidate_id)
+        journal_path = self.sagas._journal(candidate_id)
+        if not saga_path.exists() and not journal_path.exists():
+            return {
+                "candidate_id": candidate_id,
+                "status": "NOT_FOUND",
+                "state": "NOT_FOUND",
+                "execution_enabled": self.execution_enabled,
+                "shadow_mode": not self.execution_enabled,
+                "side_effects_executed": False,
+            }
         return {
             **self.sagas.load(candidate_id).to_dict(),
             "execution_enabled": self.execution_enabled,

deploy/systemd/aios-chatgpt-bridge-v2-staging-minimal-autonomous-loop.conf.template

@@ -0,0 +1,20 @@
+[Service]
+User=aiman
+Group=gitops
+WorkingDirectory=/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime
+ExecStart=
+ExecStart=/usr/bin/python3 -B /opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime/app/aios_chatgpt_bridge_v2_server.py
+Environment=AIOS_CONTROL_PLANE_TARGET_OID=@SOURCE_OID@
+Environment=AIOS_CONTROL_PLANE_TARGET_VERSION=V2R2C1
+Environment=AIOS_CONTROL_PLANE_RUNTIME_PATH=/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime
+Environment=AIOS_CONTROL_PLANE_ARTIFACT=/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime/manifest.json
+Environment=AIOS_CONTROL_PLANE_ARTIFACT_SHA256=@ARTIFACT_SHA256@
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED=true
+Environment=AIOS_GITOPS_TOKEN_FILE=%d/action_tokens
+Environment=AIOS_GITEA_API_BASE=https://g.cnnetmkt.top/git/api/v1
+Environment=AIOS_BRIDGE_V2_PORT=18892
+Environment=PYTHONPATH=/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime:/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime/app:/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime/runtime-agent-os
+LoadCredential=action_tokens:/data/aios-gitops/runtime/secrets/gitops.tokens
+ReadOnlyPaths=/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime /data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-gitops/bridge-v2-staging

deploy/systemd/aios-chatgpt-bridge-v2-staging.service

@@ -4,19 +4,32 @@ After=network-online.target
 
 [Service]
 Type=simple
-User=aios-bridge-staging
-Group=aios-bridge-staging
-WorkingDirectory=/opt/aios/gitops-control-plane/current
+User=aiman
+Group=gitops
+PermissionsStartOnly=true
+WorkingDirectory=@RUNTIME_ROOT@
 Environment=AIOS_BRIDGE_SCHEMA_VERSION=aios.chatgpt-gitops-bridge.v2
 Environment=AIOS_GITOPS_WRITES_ENABLED=false
 Environment=AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED=true
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_GITEA_API_BASE=https://g.cnnetmkt.top/git/api/v1
+Environment=AIOS_GITEA_TOKEN_FILE=/run/credentials/aios-chatgpt-bridge-v2-staging.service/gitea_token
+Environment=AIOS_GITEA_REMOTE=gitea-http
+Environment=AIOS_GITOPS_BASELINE_AUTHORITY=/var/lib/aios-gitops/model-api-staging/baseline/current.json
+Environment=AIOS_CONTROL_PLANE_TARGET_VERSION=V2R2C1
+Environment=AIOS_CONTROL_PLANE_TARGET_OID=@SOURCE_OID@
+Environment=AIOS_CONTROL_PLANE_ARTIFACT_SHA256=@ARTIFACT_SHA256@
+Environment=PYTHONPATH=@RUNTIME_ROOT@:@RUNTIME_ROOT@/app:@RUNTIME_ROOT@/runtime-agent-os
 Environment=AIOS_DEPLOYMENT_STATE=STAGING
-ExecStart=/usr/bin/python3 /opt/aios/gitops-control-plane/current/bridge-v2-staging-server.py
+LoadCredential=gitea_token:/run/credentials/aios-governance-executor.service/gitea-governance-executor-token
+ExecStartPre=/usr/bin/install -d -o aiman -g gitops -m 0750 /var/lib/aios-gitops/bridge-v2-staging
+ExecStartPre=/usr/bin/setfacl -m u:aiman:--x /usr/local/libexec
+ExecStart=/usr/bin/python3 -B @RUNTIME_ROOT@/app/aios_chatgpt_bridge_v2_server.py
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=true
-ReadWritePaths=/var/lib/aios-gitops/bridge-v2-staging
+ReadWritePaths=/var/lib/aios-gitops/bridge-v2-staging /data/aios-gitops/repo.git
 Restart=on-failure
 
 [Install]

deploy/systemd/aios-gitops-model-api-v2r2c1-staging-minimal-autonomous-loop.conf.template

@@ -0,0 +1,22 @@
+[Service]
+User=aiman
+Group=gitops
+WorkingDirectory=/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime
+ExecStart=
+ExecStart=/usr/bin/python3 -B /opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime/app/aios_model_api_staging_list_patches_overlay.py
+Environment=AIOS_GITOPS_WORKSPACE=/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime
+Environment=AIOS_GITOPS_RUNTIME_OID=@SOURCE_OID@
+Environment=AIOS_GITOPS_ARTIFACT=/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime/manifest.json
+Environment=AIOS_GITOPS_ARTIFACT_SHA256=@ARTIFACT_SHA256@
+Environment=AIOS_GITOPS_DEPLOYMENT_STATE=STAGING
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED=true
+Environment=AIOS_GITOPS_JOB_CONTROLLER_ENABLED=false
+Environment=AIOS_GITOPS_TOKEN_FILE=%d/action_tokens
+Environment=AIOS_GITOPS_GITEA_API_URL=https://g.cnnetmkt.top/git/api/v1
+Environment=AIOS_BRIDGE_V2_URL=http://127.0.0.1:18892
+Environment=AIOS_GITOPS_PORT=18893
+Environment=PYTHONPATH=/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime:/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime/app:/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime/runtime-agent-os
+LoadCredential=action_tokens:/data/aios-gitops/runtime/secrets/gitops.tokens
+ReadOnlyPaths=/opt/aios/gitops-model-api/@SOURCE_OID@-minimal-autonomous-loop/runtime /data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-gitops/model-api-staging

deploy/systemd/aios-gitops-model-api-v2r2c1-staging.service

@@ -7,6 +7,11 @@ Wants=network-online.target
 Type=simple
 User=aiman
 Group=gitops
+PermissionsStartOnly=true
+ExecStartPre=/usr/bin/install -d -o aiman -g gitops -m 0750 /var/lib/aios-gitops/model-api-staging
+ExecStartPre=/usr/bin/install -d -o aiman -g gitops -m 0750 /var/lib/aios-gitops/model-api-staging/silent-release
+ExecStartPre=/usr/bin/install -d -o root -g gitops -m 0750 /var/lib/aios-gitops/model-api-staging/baseline
+ExecStartPre=/usr/bin/setfacl -m u:aiman:--x /usr/local/libexec
 WorkingDirectory=@RUNTIME_ROOT@
 Environment=PYTHONUNBUFFERED=1
 Environment=PYTHONDONTWRITEBYTECODE=1
@@ -16,7 +21,7 @@ Environment=AIOS_GITOPS_REPO=/data/aios-gitops/repo.git
 Environment=AIOS_GITOPS_BARE_REPO=/data/aios-gitops/repo.git
 Environment=AIOS_GITOPS_AUTHORITATIVE_GIT_DIR=/data/aios-gitops/repo.git
 Environment=AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
-Environment=AIOS_GITOPS_BASELINE_AUTHORITY=/var/lib/aios-gitops-runtime-anchor/baseline/current.json
+Environment=AIOS_GITOPS_BASELINE_AUTHORITY=/var/lib/aios-gitops/model-api-staging/baseline/current.json
 Environment=AIOS_GITOPS_WRITES_ENABLED=false
 Environment=AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED=false
 Environment=AIOS_GITOPS_JOB_CONTROLLER_ENABLED=false
@@ -27,10 +32,21 @@ Environment=AIOS_GITOPS_DEPLOYMENT_STATE=STAGING
 Environment=AIOS_GITOPS_MODEL_API_SERVICE=aios-gitops-model-api-v2r2c1-staging.service
 Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
 Environment=AIOS_SILENT_RELEASE_STATE_ROOT=/var/lib/aios-gitops/model-api-staging/silent-release
+Environment=AIOS_GITOPS_GITEA_API_URL=https://g.cnnetmkt.top/git/api/v1
+Environment=AIOS_GITOPS_GITEA_REPOSITORY=aios/aios
+Environment=AIOS_GITOPS_GITEA_REMOTE=gitea-http
+Environment=AIOS_GITOPS_GITEA_TOKEN_FILE=/run/credentials/aios-gitops-model-api-v2r2c1-staging.service/gitea_token
+Environment=GIT_ASKPASS=/var/lib/aios-gitops/bridge-v2-staging/bridge-v2-askpass.sh
+Environment=GIT_ASKPASS_REQUIRE=force
+Environment=GIT_TERMINAL_PROMPT=0
+Environment=GITEA_MACHINE_ACTOR=aios-autonomy-agent
+Environment=CREDENTIAL_FILE=/run/credentials/aios-gitops-model-api-v2r2c1-staging.service/gitea_token
+Environment=AIOS_GITOPS_GITEA_TOKEN_LINE=1
+LoadCredential=gitea_token:/run/credentials/aios-governance-executor.service/gitea-governance-executor-token
 Environment=AIOS_BRIDGE_V2_URL=http://127.0.0.1:18892
 Environment=AIOS_GITOPS_HOST=127.0.0.1
 Environment=AIOS_GITOPS_PORT=18893
-Environment=PYTHONPATH=@RUNTIME_ROOT@/app:@RUNTIME_ROOT@/runtime-agent-os
+Environment=PYTHONPATH=@RUNTIME_ROOT@:@RUNTIME_ROOT@/app:@RUNTIME_ROOT@/runtime-agent-os
 ExecStart=/usr/bin/python3 @RUNTIME_ROOT@/app/aios_model_api_staging.py
 Restart=on-failure
 RestartSec=2

docs/gitops/governed-action-loop-smoke.txt

@@ -0,0 +1,5 @@
+AIOS governed Action loop smoke
+task=fix-action-contracts-20260825-1407
+generation=5
+expected_parent=f104e1244fcbc36d1debf1aa0c6720f734ea04cf
+purpose=verify read-lease-commit-idempotency-cas

docs/gitops/openapi-chatgpt-actions.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: AIOS GitOps Controlled Access API
-  version: V1R1C0-chatgpt-actions
+  version: V2R2C1-chatgpt-actions-28ops
   description: Controlled ChatGPT Actions API for AIOS online GitOps baseline. Read endpoints are public. Write endpoints require Bearer token and create Git commits on non-main branches.
 servers:
   - url: https://cnnetmkt.top
@@ -241,6 +241,102 @@ components:
       properties:
         candidate_id: {type: string}
 paths:
+  /readRepositoryFile:
+    post:
+      operationId: readRepositoryFile
+      summary: Read one bounded file from an approved repository ref
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required: [repository, ref, path, max_bytes]
+              properties:
+                repository: {type: string, enum: [aios/aios]}
+                ref: {type: string, description: agent branch, main, V2R2C1, or full commit OID}
+                path: {type: string, minLength: 1, maxLength: 512}
+                max_bytes: {type: integer, minimum: 1, maximum: 262144}
+      responses:
+        '200': {description: Bounded read-only source content}
+        '400': {description: Invalid repository, ref, path, or size}
+        '404': {description: Ref or file not found}
+      x-openai-isConsequential: false
+  /acquireWriterLease:
+    post:
+      operationId: acquireWriterLease
+      summary: Acquire a short-lived generation-scoped writer lease
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required: [schema, task_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds]
+              properties:
+                schema: {type: string, enum: [aios.task-writer-lease.v2]}
+                task_id: {type: string, minLength: 1, maxLength: 200}
+                repository: {type: string, enum: [aios/aios]}
+                branch_mode: {type: string, enum: [CONTINUE_EXISTING]}
+                base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+                expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+                target_branch: {type: string, pattern: '^agent/[A-Za-z0-9._/-]+$'}
+                generation: {type: integer, minimum: 1}
+                lease_seconds: {type: integer, minimum: 1, maximum: 3600}
+      responses:
+        '200': {description: Acquired or idempotently replayed scoped lease}
+        '409': {description: Binding, stale, expired, or already-used lease}
+        '423': {description: Governed writes disabled}
+      x-openai-isConsequential: true
+  /v2/commit-files:
+    post:
+      operationId: commitFilesGoverned
+      summary: Submit one atomic governed commit containing multiple files
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+                - task_id
+                - repository
+                - expected_branch_oid
+                - target_branch
+                - generation
+                - idempotency_key
+                - files
+                - message
+              properties:
+                task_id: {type: string}
+                repository: {type: string, example: aios/aios}
+                expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+                target_branch: {type: string, pattern: '^agent/[A-Za-z0-9._/-]+$'}
+                generation: {type: integer, minimum: 1}
+                idempotency_key: {type: string, minLength: 8, maxLength: 128, pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$'}
+                files:
+                  type: array
+                  minItems: 1
+                  maxItems: 50
+                  items:
+                    type: object
+                    additionalProperties: false
+                    required: [path, content_base64]
+                    properties:
+                      path: {type: string, minLength: 1, maxLength: 512}
+                      content_base64: {type: string}
+                message: {type: string, minLength: 1, maxLength: 200}
+      responses:
+        '200': {description: Governed commit job and verified branch result}
+        '400': {description: Contract or policy rejection}
+        '409': {description: Branch CAS or idempotency conflict}
+      x-openai-isConsequential: true
   /createReleaseIntent:
     post:
       operationId: createReleaseIntent
@@ -320,20 +416,6 @@ paths:
         '403': {description: Signature, key, expiry, or revocation failure}
         '409': {description: Conflicting release plan}
       x-openai-isConsequential: true
-  /submitSignedApproval:
-    post:
-      operationId: submitSignedApproval
-      summary: Alias for immutable signed owner approval submission
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/SignedReleasePlanApproval'}
-      responses:
-        '200': {description: Signature verified and approval stored}
-        '403': {description: Production approval backend unavailable or signature invalid}
-      x-openai-isConsequential: true
   /startDeployment:
     post:
       operationId: startDeployment
@@ -397,17 +479,6 @@ paths:
       operationId: listPatches
       summary: List patch records
       responses: {'200': {description: OK}}
-    post:
-      operationId: createPatch
-      summary: Create a patch branch and commit metadata
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/PatchRequest'}
-      responses: {'200': {description: Patch branch committed}, '401': {description: Unauthorized}, '403': {description: Forbidden}}
-      x-openai-isConsequential: true
   /api/model:
     get:
       operationId: readModelRegistry
@@ -429,61 +500,6 @@ paths:
       operationId: getRuntimeStatus
       summary: Read runtime status
       responses: {'200': {description: OK}}
-  /api/branch:
-    post:
-      operationId: createBranch
-      summary: Create a non-main branch and commit branch metadata
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/BranchRequest'}
-      responses: {'200': {description: Branch created}, '401': {description: Unauthorized}, '403': {description: Forbidden}}
-      x-openai-isConsequential: true
-  /api/file:
-    post:
-      operationId: commitFile
-      summary: Write a file and create a Git commit on a non-main branch
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/FileCommitRequest'}
-      responses: {'200': {description: File committed}, '400': {description: Secret rejected or invalid path}, '401': {description: Unauthorized}}
-      x-openai-isConsequential: true
-  /api/commit-file:
-    post:
-      operationId: commitFileAtomic
-      summary: Atomically write one allowlisted file, commit, push, and verify using Token Policy V2
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/AtomicFileCommitRequest'}
-      responses:
-        '200': {description: Completed or idempotently replayed}
-        '400': {description: Invalid canonical request}
-        '401': {description: Missing, invalid, expired, or revoked Token Policy V2 grant}
-        '403': {description: Audience, source, branch, operation, path, or policy denied}
-        '409': {description: Idempotency conflict or manual review required}
-        '413': {description: Request too large}
-        '503': {description: Push or remote verification unavailable; recoverable}
-      x-openai-isConsequential: true
-  /api/commit:
-    post:
-      operationId: commitChanges
-      summary: Commit existing workspace changes on a non-main branch
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: false
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/CommitRequest'}
-      responses: {'200': {description: Commit result}, '401': {description: Unauthorized}}
-      x-openai-isConsequential: true
   /api/tag-publication-status:
     get:
       operationId: getTagPublicationStatus

ops/gitops-migration/bind_external_action_surface_final_staging.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 027
+
+ROOT="/data/aios-gitops"
+NGINX_SITE="/etc/nginx/sites-enabled/aios-user-portal.conf"
+STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
+BACKUP_DIR="$ROOT/backups/action-surface-final-$STAMP"
+LOG="$ROOT/logs/action-surface-final-$STAMP.log"
+
+mkdir -p "$BACKUP_DIR" "$ROOT/logs"
+exec > >(tee -a "$LOG") 2>&1
+
+sudo cp -a "$NGINX_SITE" "$BACKUP_DIR/aios-user-portal.conf"
+SITE_BACKUP="$BACKUP_DIR/aios-user-portal.conf"
+
+python3 - "$SITE_BACKUP" "$BACKUP_DIR/aios-user-portal.conf.next" <<'PY'
+from pathlib import Path
+import sys
+
+source, output = map(Path, sys.argv[1:])
+text = source.read_text(encoding="utf-8")
+bridge_marker = "    # AIOS external Action Bridge v2 staging route"
+bridge_block = r'''    # AIOS external Action Bridge v2 staging route
+    # The published Action schema uses the site-root /v2 paths and must reach
+    # the non-production Bridge v2 listener, never the production 18920 unit.
+    location ^~ /v2/ {
+        proxy_pass http://127.0.0.1:18892;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header Authorization $http_authorization;
+        proxy_set_header X-AIOS-Token $http_x_aios_token;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        client_max_body_size 1100k;
+        proxy_connect_timeout 5s;
+        proxy_send_timeout 120s;
+        proxy_read_timeout 120s;
+    }
+'''
+if bridge_marker not in text:
+    needle = "    # BEGIN AIOS CHATGPT AUTONOMOUS RELEASE TASK ROUTE"
+    if text.count(needle) != 1:
+        raise SystemExit("expected exactly one legacy Action route marker")
+    text = text.replace(needle, bridge_block + "\n" + needle, 1)
+elif "location ^~ /v2/" not in text or "proxy_pass http://127.0.0.1:18892;" not in text:
+    raise SystemExit("staging Bridge v2 route marker exists but route is incomplete")
+
+marker = "    # AIOS external Action governed-read ownership"
+block = r'''    # AIOS external Action governed-read ownership
+    # These reads are owned by the authenticated 18890 facade, not the 18893 model API.
+    location = /api/governed-write-capabilities {
+        proxy_pass http://127.0.0.1:18890/api/governed-write-capabilities;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Authorization $http_authorization;
+        proxy_set_header X-AIOS-Token $http_x_aios_token;
+    }
+    location = /api/control-plane-snapshot {
+        proxy_pass http://127.0.0.1:18890/api/control-plane-snapshot;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Authorization $http_authorization;
+        proxy_set_header X-AIOS-Token $http_x_aios_token;
+    }
+    location = /api/online-agent-task {
+        proxy_pass http://127.0.0.1:18890/api/online-agent-task;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Authorization $http_authorization;
+        proxy_set_header X-AIOS-Token $http_x_aios_token;
+    }
+    location = /api/online-agent-task-events {
+        proxy_pass http://127.0.0.1:18890/api/online-agent-task-events;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Authorization $http_authorization;
+        proxy_set_header X-AIOS-Token $http_x_aios_token;
+    }
+'''
+needle = "    location /api/ {"
+if text.count(needle) != 1:
+    raise SystemExit("expected exactly one generic /api/ location")
+if marker not in text:
+    text = text.replace(needle, block + "\n" + needle, 1)
+output.write_text(text, encoding="utf-8")
+PY
+
+sudo cp "$BACKUP_DIR/aios-user-portal.conf.next" "$NGINX_SITE"
+sudo nginx -t
+sudo systemctl reload nginx
+
+printf 'ACTION_SURFACE_FINAL_OK backup=%s log=%s\n' "$BACKUP_DIR" "$LOG"

release_version.py

@@ -0,0 +1,21 @@
+"""Canonical AIOS release-version parser shared by runtime and release tools."""
+from __future__ import annotations
+
+import re
+
+
+# The suffix preserves already-supported annotated release names while the
+# canonical VnRnCn namespace remains accepted exactly.
+RELEASE_VERSION_PATTERN = r"^V[0-9]+R[0-9]+C[0-9]+(?:-[A-Za-z0-9_.-]+)?$"
+RELEASE_VERSION_RE = re.compile(RELEASE_VERSION_PATTERN)
+
+
+def parse_release_version(version: object) -> str:
+    value = str(version or "").strip()
+    if not RELEASE_VERSION_RE.fullmatch(value):
+        raise ValueError("invalid release version")
+    return value
+
+
+def validate_release_version(version: object) -> str:
+    return parse_release_version(version)

reports/action-connector-schema-final-closure-20260825.md

@@ -0,0 +1,98 @@
+# AIOS Action Connector Schema Final Closure — 2026-08-25
+
+## Disposition
+
+`NEEDS_REWORK`.
+
+The staging runtime and published OpenAPI contract are repaired and the public `/v2` staging route is now reachable. The final P0-C acceptance cannot be claimed because this execution environment has no callable ChatGPT Action/connector inspection or registration tool, and the deployed repository intentionally has no connector acknowledgement/write endpoint. Therefore the required proof of the actual callable tool schema, a real public two-file batch commit, and its public terminal reconcile are not available. The task must not be marked `SUCCEEDED`.
+
+No main, protected tag, baseline registry, or production write was performed.
+
+## Scope and live identity
+
+- Repository: `aios/aios`
+- Task: `fix-action-contracts-20260825-1407`
+- Branch: `agent/fix-action-contracts-20260825-1407`
+- Source worktree: `/var/lib/aios-gitops/bridge-v2-staging/worktrees/fix-action-contracts-20260825-1407`
+- Source HEAD before this closure patch: `eb72fcd8dce242abaef15f03a21b43ba2c5197fd`
+- Deployed staging Bridge runtime commit: `2ec49005bde44f6981b14351500847d594e0276c`
+- Deployed Bridge artifact SHA-256: `f67aed6cc0cce1f08197485c3eea204d3ef4d3989f44dc98e8ea2691e5886cbf`
+- Bridge unit: `aios-chatgpt-bridge-v2-staging.service`, `aiman:gitops`, `127.0.0.1:18892`
+- Model API unit: `aios-gitops-model-api-v2r2c1-staging.service`, `127.0.0.1:18893`
+- Gitea API base projected by staging systemd: `https://g.cnnetmkt.top/git/api/v1`
+- Runtime state: `STAGING`, `drift_status=PASS`, `legacy_global_writes_enabled=false`, `main_write=false`, `tag_write=false`, `baseline_write=false`, `production_write=false`
+
+## Root causes and contract chain
+
+1. Runtime source was already repaired to require `files` for `commitFilesGoverned`. `active-runtime/app/aios_chatgpt_bridge_v2.py` declares the canonical required tuple and `render_openapi_contract_fragment()` emits the operation fragment.
+2. `scripts/build_v2r2c1_model_api_staging.py` copies the canonical `docs/gitops/openapi-chatgpt-actions.yaml` into the immutable staging artifact and rejects a build missing `/v2/commit-files`.
+3. The deployed public OpenAPI is served from the model API workspace at `/api/openapi-chatgpt-actions.yaml`; its SHA-256 was `a0775b0719a76e08a95f3257a3d3b2a73b70e1c55c162914250f80dd28da022d`. It contains `/v2/commit-files`, `files`, and item fields `path` and `content_base64`.
+4. The missing deployment link was Nginx: OpenAPI `servers.url` is `https://cnnetmkt.top` and its operation paths are `/v2/...`, but the live site had no `/v2/` location and the old `/api/v2/` location pointed at absent production port `18920`. The old `/api/file` route is an inactive legacy single-file router.
+5. A repository-wide and host-side inspection found no formal external ChatGPT connector registration source, schema cache, re-registration command, or acknowledgement endpoint. The existing durable-owner design explicitly states that no connector acknowledgement/write endpoint is provided and the only valid state is `PENDING_EXTERNAL_CONNECTOR`. This is the remaining external blocker, not a reason to create a parallel local schema or reuse another credential.
+
+## Changes made
+
+- `ops/gitops-migration/bind_external_action_surface_final_staging.sh`
+  - added an idempotent exact `/v2/` route to staging Bridge `127.0.0.1:18892`;
+  - forwards `Authorization` and `X-AIOS-Token`;
+  - keeps the existing exact governed-read routes on `18890` and generic `/api/` on `18893`;
+  - refuses an incomplete existing staging route and never adds a route to production `18920`.
+- `tests/test_action_contract_regressions.py`
+  - added a parity/deployment test tying published `/v2/commit-files` to the staging route and asserting no `18920` target in the staging installer.
+- `runbooks/action-connector-schema-refresh-20260825.md`
+  - added the durable connector refresh and fail-closed acceptance procedure.
+- `reports/action-connector-schema-final-closure-20260825.md`
+  - this evidence report.
+
+The source/runtime contract parity test remains in place and still compares runtime required fields, generated fragment, and published schema. The live connector layer cannot be parity-tested because no connector layer is deployed or callable from this environment; the gate therefore remains fail-closed rather than accepting a fixture as proof.
+
+## Deployment and restart evidence
+
+The existing staging installer was run after `git diff --check` and focused tests. It created the Nginx backup `/data/aios-gitops/backups/action-surface-final-20260825T105656Z`, passed `nginx -t`, and reloaded Nginx. Public readback then returned HTTP 200 for:
+
+- `https://cnnetmkt.top/v2/runtime`
+- `https://cnnetmkt.top/v2/capabilities`
+- `https://cnnetmkt.top/api/openapi-chatgpt-actions.yaml`
+
+The staging Bridge and Model API were subsequently restarted once. Both `systemctl is-active` checks returned `active`. Post-restart `/v2/runtime` retained the staging identity and artifact SHA above; `/v2/capabilities` retained `commitFilesGoverned.required_fields` including `files`.
+
+## Tests and live smoke
+
+Passing results:
+
+- `python3 -m pytest -q tests/test_action_contract_regressions.py tests/test_bridge_v2_governed_http_bootstrap.py` — `17 passed`.
+- Mandatory suite — `264 passed, 28 subtests passed in 4.81s`.
+- Full repository suite — `720 passed, 2 skipped, 2 failed, 154 subtests passed in 34.02s`. The two failures are unchanged known failures: stale `/tmp/aios-agent-events-test` fixture and deployed signer self-test return code `42`.
+
+Post-restart live results:
+
+- `getReleaseConsistency(V2R2C1, ...)`: HTTP 200 structured consistency response; no Gitea URL validation failure. Gitea listing and peeled target readback were visible.
+- `runReleaseAcceptance(V2R2C1, ...)`: HTTP 200 structured policy result with `accepted=false`; it reached policy evaluation rather than failing URL validation.
+- `getTagPublicationStatus("V2R2C1")`: HTTP 200 structured state (`REMOTE_PUSH_PENDING` on Bridge v2; the legacy model read surface returned structured `UNKNOWN`).
+- `getReleaseSaga(nonexistent)`: HTTP 404, normal NOT_FOUND behavior.
+- Existing terminal job `job-93138017f3afd7f709f691fd05c77923`: HTTP 200, `COMPLETED`, revision `8`; terminal `/v2/job/reconcile` returned HTTP 200 with the same `COMPLETED` receipt and Authority/API/Git remote OID `904e7ea0cd376d204bad19628c36a9dd90ca6621`.
+- Empty diff: HTTP 200, zero paths/size, `truncated=false`.
+- Non-empty diff: HTTP 200 with identities, changed paths, stats, total size, patch limit `262144`, and bounded response fields.
+- Public `POST /v2/commit-files` probes returned `BRIDGE_REQUEST_FIELDS_MISSING` for incomplete bodies; the body containing `files` was not rejected as an unknown field. No write side effect occurred.
+
+## Missing final acceptance
+
+The following required evidence is not available and is intentionally not inferred:
+
+- actual ChatGPT callable Action tool schema showing required `files`;
+- formal connector re-register/cache invalidation acknowledgement;
+- an authorized public `commitFilesGoverned` request containing two files;
+- Authority/Gitea/API remote OID equality for that new batch commit;
+- its batch Job `COMPLETED` readback and public terminal reconcile;
+- post-batch connector callable smoke.
+
+The prior single-file public commit `904e7ea0cd376d204bad19628c36a9dd90ca6621` and its terminal reconcile are preserved as baseline evidence only; they are not substituted for the required batch proof.
+
+## Protected boundaries and rollback
+
+No source or deployment operation wrote `main`, a protected tag, the baseline registry, or production. The production-facing `18920` route was not changed; the new `/v2/` location targets only the staging Bridge listener. No secret value was printed, rotated, or reused. Automatic rollback was not triggered because Nginx syntax, staging service health, runtime identity, Gitea readback, and protected-ref boundaries remained valid. If a future connector refresh breaks these checks, restore the Nginx backup and the preceding staging artifact through the existing governed installer, then re-run the same probes.
+
+## Next required owner/platform action
+
+Provide the supported staging external Action connector lifecycle (registration/re-registration/cache invalidation) and an authorized staging Action bearer, or have the legitimate external Agent claim the existing continuation task and produce its durable callable-schema and batch-commit evidence. Until then the correct disposition remains `NEEDS_REWORK`; do not mark `SUCCEEDED` based on the server-side OpenAPI alone.
+

reports/action-contract-regression-remediation-20260825.md

@@ -0,0 +1,75 @@
+# Action Contract Regression Remediation — 2026-08-25
+
+## Scope
+
+Governed task: `fix-action-contracts-20260825-1407`
+Base: `3244f0f17f8845592ac94d585f5ebd65693c9f29`
+Target branch: `agent/fix-action-contracts-20260825-1407`
+
+## Verified regressions
+
+1. `getReleaseConsistency` and `runReleaseAcceptance` fail before evaluation with:
+   `Gitea API URL must be HTTP(S)`.
+   V2R2C1 release evidence at `a8b906d1bc24088c19647e98de6a679268f6d0a2`
+   proves Gitea API readback passed for target `998d30304787e31e5ae607c0bd86b5edb2b0e5ad`.
+   Therefore current staging/contract overlay configuration has regressed.
+
+2. `getReleaseSaga` fails with:
+   `Permission denied: '/var/lib/aios-gitops/silent-release'`.
+   Runtime service identity must have read/traverse access to the durable release state root.
+   Fix ownership/group/ACL at deployment time; do not broaden to world-writable permissions.
+
+3. `getTagPublicationStatus` rejects the authoritative approved version `V2R2C1`
+   as `invalid release version`, while `getGovernedWriteCapabilities` returns the same
+   version as the approved release scope. The two Action contracts are internally inconsistent.
+   Release-version validation must accept the canonical AIOS `^V[0-9]+R[0-9]+C[0-9]+$`
+   namespace (or, preferably, use one shared validator for all release Actions).
+
+4. `commitFilesGoverned` is unusable from the published Action schema.
+   Runtime capability metadata declares required fields:
+   `task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, files, message`,
+   but the exposed tool contract has no `files` input. Regenerate/publish the Action schema from
+   the same operation contract source and add a contract-parity test.
+
+5. `reconcileGitOpsJob` returned `DURABLE_BINDING_INVALID` for a completed governed
+   single-file job that was otherwise read back as `COMPLETED`.
+   Reconciliation of a valid terminal job should be idempotent/read-only and must not require
+   a stale or absent active lease. Add a regression case for terminal completed jobs.
+
+6. `getDiff` returns `ResponseTooLargeError` / `GIT_OUTPUT_LIMIT_EXCEEDED` for large diffs.
+   Add server-side bounded output: path/stat summary plus truncation metadata, or pagination.
+   The Action must never fail merely because a valid repository diff is large.
+
+## Required implementation changes
+
+- Centralize release-version parsing and reuse it in tag status, candidate, consistency, and acceptance.
+- Validate/normalize Gitea API URL at service startup and fail health checks with a configuration-specific diagnostic.
+- Ensure the deployment unit projects a valid HTTP(S) Gitea API base URL into the staging overlay.
+- Correct durable release-state directory ownership/ACL for the runtime service account.
+- Generate the external Action schema from the runtime operation contract; parity-test required fields.
+- Make terminal reconciliation idempotent and independent of expired active writer leases.
+- Bound diff output and return `truncated=true` with deterministic metadata rather than transport failure.
+
+## Acceptance gates
+
+All must pass on the same deployed overlay:
+
+- `getReleaseConsistency(V2R2C1, 998d303..., a8b906d..., approved_plan)` returns a structured result, not URL error.
+- `runReleaseAcceptance(...)` reaches policy evaluation, not URL error.
+- `getTagPublicationStatus("V2R2C1")` returns structured publication state.
+- `getReleaseSaga(nonexistent_candidate)` returns NOT_FOUND/empty-state semantics, never filesystem permission failure.
+- Published `commitFilesGoverned` schema exposes `files` and a two-file isolated branch commit succeeds.
+- Reconcile of a completed governed job is idempotent.
+- Large diff returns bounded/truncated data rather than transport exception.
+- Existing protected-ref controls remain unchanged: no direct main/tag/baseline/production write.
+
+## Proven stable reference
+
+V2R2C1 evidence closure (`a8b906d1bc24088c19647e98de6a679268f6d0a2`) records:
+- Gitea Git/API readback PASS
+- staging runtime PASS
+- restart recovery PASS
+- 59 mandatory tests passed / 0 failed
+
+This evidence should be used as the compatibility baseline when repairing the current
+`contract-overlay-v2` / `scheme-a-323b615b...` staging layer.

reports/action-contract-repair-evidence-20260825.md

@@ -0,0 +1,119 @@
+# AIOS Action contract repair evidence — 2026-08-25
+
+## Disposition
+
+Final disposition: `NEEDS_REWORK`.
+
+The contract repair is deployed to staging and the focused acceptance checks are green. The task is not eligible for `SUCCEEDED`: `runReleaseAcceptance` returns structured policy output with `accepted=false` because the existing publication state for protected tag `V2R2C1` is `REMOTE_PUSH_PENDING`, and the repository-wide suite still has the two pre-existing signer/event-bus failures recorded below. The online Task API row is still `QUEUED`; it was not changed by direct database manipulation or an unauthorized synthetic claim/result.
+
+No production release, `main`, release tag, baseline registry, or production service was directly modified.
+
+## Scope and pre-change facts
+
+- Repository: `aios/aios`; governed branch: `agent/fix-action-contracts-20260825-1407`.
+- Initial task branch HEAD: `35eec9afe1432e8466d60040b2fb1049bb41242a`.
+- Stable reference: `V2R2C1`; source commit `998d30304787e31e5ae607c0bd86b5edb2b0e5ad`; evidence closure `a8b906d1bc24088c19647e98de6a679268f6d0a2`.
+- Pre-change refs: authority `main=3244f0f17f8845592ac94d585f5ebd65693c9f29`, tag `V2R2C1=07fc2746b688f5f243f29b39de39f32edc3dd9d2`; these remained unchanged.
+- Staging services run as `User=aiman`, `Group=gitops`. The actual staging Gitea API base is `https://g.cnnetmkt.top/git/api/v1`, supplied by systemd environment rather than business-code host constants.
+- Pre-change full test baseline: `707 passed, 2 skipped, 154 subtests passed, 2 failed`. The failures were the stale `/tmp/aios-agent-events-test` event-bus fixture and the real signer self-test.
+
+## Root causes and repairs
+
+1. Gitea URL validation occurred at release-operation time while the staging overlay's API environment was not consistently projected into all runtime paths. The canonical HTTP(S) validator is now called during model and Bridge startup; `getReleaseConsistency` and `runReleaseAcceptance` use the actual staging environment URL.
+
+2. `silent-release` was not consistently writable by the real service identity, and the credential helper parent directory blocked `aiman` traversal. The persisted staging systemd overlay creates the state directory as `aiman:gitops` mode `0750` and grants only `u:aiman:--x` on `/usr/local/libexec`; no world-writable mode was used. The staging bridge also has the minimum repository write path required by the governed AuthorityGitExecutor/CAS flow.
+
+3. Release version parsing was split across callers and rejected `V2R2C1`. A shared canonical parser now accepts `^V[0-9]+R[0-9]+C[0-9]+$` plus the existing bounded suffix form, and is used by capabilities, release candidate, consistency, acceptance, tag publication, and release/tag queries.
+
+4. The runtime operation contract required `files` but the published Action schema omitted it. `commitFilesGoverned` now has one contract source and published schema projection, with parity tests. A real governed two-file commit completed on isolated branch `agent/action-contract-integration-20260825-1407`; authority, Git remote, and Gitea API all read back OID `0345cd8c70967940bc8e9132dff7d6ea11efa304`.
+
+5. `reconcileGitOpsJob` reconstructed active lease state before checking terminal state. Terminal `COMPLETED`, `FAILED`, and `CANCELLED` jobs now short-circuit to idempotent read-back; active jobs retain strict lease validation. The two-file job reconciled as `COMPLETED` and a second reconcile returned the same receipt.
+
+6. `getDiff` returned unbounded patch data and could fail the transport. It now returns identities, changed paths, stats, total bytes, bounded patch output, patch limit, and `truncated`. The large smoke returned `total_size_bytes=350222`, `stdout_bytes=262144`, `patch_limit_bytes=262144`, `truncated=true`; no `ResponseTooLargeError` or `GIT_OUTPUT_LIMIT_EXCEEDED` escaped.
+
+During live integration, two additional staging-only contract defects were found and repaired: CREATE_NEW branch normalization/CAS recovery, and release executor projection of the configured staging baseline plus immutable runtime `versions/V2R2C1.json`. The latter removed the missing publication-workspace baseline/version errors without writing production state.
+
+## Source, test, and operational changes
+
+Source commits on the governed branch include the six contract repairs, focused regression tests, `versions/V2R2C1.json`, governed CREATE_NEW/reconcile recovery, and final runtime projection commits. The final source before this evidence commit is `2ec49005bde44f6981b14351500847d594e0276c`.
+
+The runbook update is in `runbooks/agent-fix-action-contracts-20260825.md`. This report is the required durable evidence artifact. Existing untracked `runtime/agent-observability/` and `runtime/task-center/` directories were preserved and were not staged.
+
+Tests run on the final source:
+
+```text
+PYTHONPATH=active-runtime/app python3 -m pytest -q tests/test_silent_release_execution_readiness.py tests/test_silent_release_controller.py tests/test_silent_release_hardening.py tests/test_silent_release_production_contract.py tests/test_chatgpt_actions_tag.py tests/test_gitea_tag_publication.py tests/test_authoritative_git_context.py
+264 passed, 28 subtests passed in 4.78s
+
+PYTHONPATH=active-runtime/app python3 -m pytest -q tests
+717 passed, 2 skipped, 154 subtests passed, 2 failed in 33.98s
+```
+
+The full-suite failures remain the known event-bus fixture failure and the real signer adapter self-test (`returncode=42`); no new mandatory-suite regression was observed. Focused contract/reconcile tests and the exact mandatory suite passed.
+
+## Staging deployment identity
+
+- Final deployed source OID at the last completed runtime smoke: `2ec49005bde44f6981b14351500847d594e0276c`.
+- Final deployed artifact: `/opt/aios/gitops-model-api/2ec49005bde44f6981b14351500847d594e0276c-action-contract-repair/runtime`.
+- Artifact SHA256: `f67aed6cc0cce1f08197485c3eea204d3ef4d3989f44dc98e8ea2691e5886cbf`.
+- Deployment state: `STAGING`; production-deployed flag: `false`.
+- A lexically highest staging-only systemd drop-in was installed for each affected service, followed by `daemon-reload` and restart. `systemctl is-active` returned `active` for both services, and `systemctl show` confirmed the final OID, artifact SHA, API URL, and baseline authority.
+
+## Runtime smoke evidence
+
+- Model health returned `status=ok`, `version=V2R2C1`, final commit/artifact identity, `deployment_state=STAGING`, and `production_deployed=false`.
+- Bridge/API readback was available; the bridge's `/health` path is not exposed by this runtime and returned `404`, while its governed endpoints were healthy.
+- `getReleaseConsistency("V2R2C1", ...)` returned structured `status=PASS`, with Gitea listing/peeled target and tag object matching the stable reference.
+- `runReleaseAcceptance(...)` entered policy evaluation and returned structured `accepted=false`; it did not fail URL validation. The independent pre-existing tag publication state is `REMOTE_PUSH_PENDING`, with the remote rejection explicitly reporting protected tag `V2R2C1`.
+- `getTagPublicationStatus("V2R2C1")` returned structured `REMOTE_PUSH_PENDING`, not `invalid release version`.
+- `getReleaseSaga` for a nonexistent candidate returned HTTP `404` with `status=NOT_FOUND`, `state=NOT_FOUND`, `execution_enabled=false`, and no filesystem permission error.
+- `commitFilesGoverned` published schema includes required `files`, with per-file `path` and `content_base64`.
+- Two-file governed commit: branch `agent/action-contract-integration-20260825-1407`, OID `0345cd8c70967940bc8e9132dff7d6ea11efa304` at authority/Git remote/API; protected-ref flags remained false.
+- Terminal reconcile: `COMPLETED` read-back was idempotent across two calls; focused tests cover `FAILED` and `CANCELLED` terminal semantics.
+- Small diff returned bounded non-truncated output; empty diff returned zero paths and zero bytes; large diff returned bounded/truncated output as recorded above.
+- Main, protected tag, baseline registry, and production OIDs were re-read after deployment and remained unchanged.
+
+## Restart persistence and remaining risk
+
+The final staging services were restarted after deployment and health/runtime identity were re-read. The post-restart `systemctl is-active` result was `active` for both services; model health again reported OID `2ec49005bde44f6981b14351500847d594e0276c`, artifact SHA `f67aed6cc0cce1f08197485c3eea204d3ef4d3989f44dc98e8ea2691e5886cbf`, staging mode, and `production_deployed=false`. Post-restart consistency remained `PASS`, acceptance remained structured `accepted=false` for the pre-existing protected-tag publication state, saga remained `NOT_FOUND` for the nonexistent candidate, and the large diff remained bounded/truncated. The task cannot be promoted to `SUCCEEDED` until the protected-tag publication state and the two known repository-wide failures are resolved through their respective governed owners. No automatic rollback was performed because the staging services stayed healthy, mandatory tests passed, Gitea readback passed, and protected-ref boundaries remained intact.
+
+Task disposition is `NEEDS_REWORK`, not `SUCCEEDED`: the staging contract repair is materially complete, but the deployed acceptance result is not all-green and the task row has not been legitimately claimed/verified by the online task worker.
+
+## External Action Surface final closure evidence — 2026-08-25
+
+### Disposition
+NEEDS_REWORK. Staging is deployed and P0-A/P0-B have live closure evidence. P0-C is blocked: no formal staging external Action bearer issuance path was available, so the required real public two-file commit and terminal reconcile were not authorized or executed. Do not mark SUCCEEDED. No main, tag, baseline, or production write occurred; untracked runtime/agent-observability and runtime/task-center were preserved.
+
+### Identity and before-change facts
+Authority /data/aios-gitops/repo.git; worktree /var/lib/aios-gitops/bridge-v2-staging/worktrees/fix-action-contracts-20260825-1407; branch agent/fix-action-contracts-20260825-1407; initial HEAD 35eec9afe1432e8466d60040b2fb1049bb41242a1. Stable V2R2C1 source 998d30304787e31e5ae607c0bd86b5edb2b0e5ad; evidence closure a8b906d1bc24088c19647e98de6a679268f6d0a2. Repair commit 174e64dd0218cef6d49dd13d58bbd90c78fecadd; protected refs unchanged.
+
+### P0-A governed-read ownership
+Root cause: generic /api/ sent governed-write-capabilities to model API 18893 (404), while governed facade 18890 owned it. Fix: ops/gitops-migration/bind_external_action_surface_final_staging.sh installs exact locations for governed-write-capabilities, control-plane-snapshot, online-agent-task, and online-agent-task-events to 18890; generic /api/ remains 18893; auth headers forward and no business host is hard-coded. Backup /data/aios-gitops/backups/action-surface-final-20260825T101714Z; log /data/aios-gitops/logs/action-surface-final-20260825T101714Z.log. nginx -t passed, Nginx active, public GET /api/governed-write-capabilities HTTP 200. Contract reports governed writes enabled but legacy/main/tag/baseline/production writes false.
+
+### P0-B release semantics
+Root cause: public model GET used local TagPublisher/PublicationStore lacking tag object binding, so consistency was FAIL/tag_object=false; Bridge v2 had authoritative durable binding. Fix: active-runtime/app/aios_model_api_staging.py constructs one canonical publication request and routes release-consistency/release-acceptance through Bridge v2 getReleaseConsistency/runReleaseAcceptance; tests/test_action_contract_regressions.py covers this. Live V2R2C1 consistency with target 998d30304787e31e5ae607c0bd86b5edb2b0e5ad, closure a8b906d1bc24088c19647e98de6a679268f6d0a2, plan sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e returned HTTP 200 PASS, all checks true, tag object 07fc2746b688f5f243f29b39de39f32edc3dd9d2 and peeled target correct. Acceptance entered structured policy evaluation with accepted=false, not URL failure. Tag publication V2R2C1 returned structured UNKNOWN, not invalid version.
+
+### P0-C credential and commit blocker
+Hash-only Action record: account chatgpt-gitops-bot; id chatgpt-action-0a3e55b7659a4d4e8125feabce5e8bf5; kind gpt_action_api_key; consumer aios-gitops-model-api.service; issuer owner_ssh_breakglass_rotation; issued 2026-08-10T04:51:58.900488Z; expires 2026-09-09T04:51:58.900488Z; scopes file:write and agent-task:control; disabled false; owner approval required true. Plaintext was not printed/reused. agent_task_control_token is not an Action bearer. Inspected Writer grants, Gitea consumer, SSH, task broker and old token candidates provide no formal issuer; no unrelated credential substituted. Empty public POST /api/commitFilesGoverned reached staging and returned HTTP 423 gitops_writes_disabled with AIOS_GITOPS_WRITES_ENABLED=false. Writes were not enabled. No real public two-file commit or COMPLETED reconcile is claimed. Blocker: FORMAL_STAGING_ACTION_BEARER_ISSUANCE_NOT_AVAILABLE.
+
+### Schema/deployment/runtime
+Source 174e64dd0218cef6d49dd13d58bbd90c78fecadd. Artifact /data/aios-gitops/artifacts/action-contract-final-174e64d/aios-v2r2c1-model-api-174e64dd0218cef6d49dd13d58bbd90c78fecadd.tar.gz; SHA256 8fc811cfb9dbb22d6eb7ca418d58f9ada1d6fdd12e566e3e8f5a02bec47c4f37. Runtime /opt/aios/gitops-model-api/174e64dd0218cef6d49dd13d58bbd90c78fecadd-action-surface-final/runtime. Drop-in /etc/systemd/system/aios-gitops-model-api-v2r2c1-staging.service.d/zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-action-contract-zzzz-final-999.conf; backup /data/aios-gitops/backups/action-contract-final-deploy-20260825T101959Z/drop-in-directory. User/Group aiman:gitops; API base from systemd https://g.cnnetmkt.top/git/api/v1; writes false; Bridge 18892; STAGING; production_deployed=false. /api/run proved active runtime/readable authority /data/aios-gitops/repo.git and main 3244f0f17f8845592ac94d585f5ebd65693c9f29. /api/openapi.yaml required commitFilesGoverned files, each with path/content_base64.
+
+### Tests
+Before mandatory: 264 passed, 28 subtests, 4.82s. After mandatory: 264 passed, 28 subtests, 4.80s. Focused action regression: 11 passed, 0.12s. Full: 719 passed, 2 skipped, 154 subtests, 2 failed, 34.03s. Same known failures: stale /tmp/aios-agent-events-test in test_unified_event_flow; signer adapter self-test return 42 in test_real_signer_help_and_self_test_are_available.
+
+### Restart and smoke
+After first deployment, model and Bridge staging services were restarted and remained active. Post-restart health retained source/artifact identity, V2R2C1, STAGING, production false. Capability HTTP 200; consistency HTTP 200/PASS; tag status structured UNKNOWN; nonexistent saga HTTP 404/NOT_FOUND with execution false, shadow true, side effects false. Empty diff HTTP 200, zero paths/size, truncated false. Bounded non-empty diff returned identities, paths/stats, bounded output and patch limit 262144; local pipe-to-head caused only expected curl broken-pipe. Existing large-diff behavior remains bounded/truncated with no transport exception. Gitea readback proven by consistency PASS; protected-ref boundary remained fail-closed.
+
+### Task continuity and remaining work
+Earlier execution observed TASK_NOT_FOUND and created continuation fix-action-contracts-20260825-1407-external-surface-closure with parent/source/OID and staging constraints. Later recheck returned parent HTTP 200 QUEUED; continuation also QUEUED, revision 1, claimed_by null, result null. Neither has claim, execution, terminal result, or success evidence. Required rework is formal bearer lifecycle, isolated real two-file public commit and OID/reconcile verification, disposition of the two pre-existing full-suite failures, then full smoke before SUCCEEDED.
+### Health endpoint clarification
+
+The service health contract is /api/health: local model port 18893 and public https://cnnetmkt.top/api/health both returned HTTP 200 with the deployed source/artifact identity, STAGING, and production_deployed=false. Public root /health returned HTTP 502 because the existing Nginx root location proxies the separate portal upstream on 127.0.0.1:3000; it is not the Action model health route. This unrelated portal-ingress 502 is recorded as an observed remaining staging risk, and was not changed because this task scope is the Action/Bridge/release surface.
+
+\n
+### Formal task-state boundary
+
+The deployed Task API exposes verification decisions SUCCEEDED, NEEDS_REWORK, and FAILED only through POST /v1/tasks/{id}/verify while the task is VERIFYING. Both the parent and continuation were QUEUED with no claim, so a direct NEEDS_REWORK transition was not a legal API operation. No cancel, database edit, fake claim, or lifecycle bypass was performed. This report is the authoritative disposition for this run: NEEDS_REWORK.
+
+\n

reports/action-minimum-autonomous-loop-evidence-20260825.md

@@ -0,0 +1,92 @@
+# Action 最小自治修复闭环证据（2026-08-25）
+
+## 最终状态
+
+`BLOCKED`（staging 代码/配置已部署并健康，但缺少本次可用的正式 Action bearer，未宣称真实 governed commit 或完整外部 smoke 成功）。
+
+本轮没有写入 production、`main`、release tag 或 baseline。
+
+## 修改前事实
+
+- repository: `aios/aios`
+- branch: `agent/fix-action-contracts-20260825-1407`
+- 修改前 HEAD: `d7a0d0db09826d513cb19451a4f018c998c00191`
+- production baseline: `V2R2C1`
+- baseline source commit: `998d30304787e31e5ae607c0bd86b5edb2b0e5ad`
+- Action schema 已限制为 26 operations，但没有外部 read-source/lease 入口；Bridge lease 主要是进程内 runtime binding；Bridge 未做 operation-specific bearer 校验。
+- 真实 staging model-api source/artifact 在本轮前为 `7e5525cfcbbaa3898c2e5ed3dc9c13e321908e61` / `2163c2e0467f3bd0a97f8d2b95e3277391c47dcf3ebafb8fa372a01c3f530ac0`。
+
+## 根因与修复
+
+1. Autonomous Agent 没有安全 read seam：增加 `AuthorityGitExecutor.read_file` 和 `readRepositoryFile`，只读 authoritative bare Git object database，固定响应上限并返回 resolved commit/OID、size、SHA-256、base64。
+2. Lease 没有跨重启 durable binding：增加 `ScopedLeaseStore` SQLite CAS 状态，绑定 task/repository/branch/expected OID/generation/TTL，支持同 binding 幂等、冲突、过期和 USED replay；commit 先校验 lease，再走既有 detached worktree/Job Controller/Authority CAS chain。
+3. Lease 曾可由调用者声明治理身份：现在必须命中 durable task binding，公开路径只接受 `CONTINUE_EXISTING`，并要求 expected OID 等于当前 authority branch head。
+4. Auth scope 曾混合：Bridge 按 read/lease/commit operation 分别检查 scope；model-api facade 认证后透传 bearer。
+5. runtime contract 与 published schema：增加 read/lease operation，保留 `commitFilesGoverned.files[] = {path, content_base64}`，builder 将 `scoped_lease_store.py` 纳入 immutable artifact。
+
+## 修改文件与配置
+
+- `active-runtime/app/aios_authority_git_executor.py`：安全 ref/path/size/read helper。
+- `active-runtime/app/scoped_lease_store.py`：SQLite durable lease state。
+- `active-runtime/app/aios_chatgpt_bridge_v2.py`：read operation contract。
+- `active-runtime/app/aios_chatgpt_bridge_v2_server.py`：read route、task binding、lease store、Bearer/scope matrix、structured errors。
+- `active-runtime/app/aios_model_api_staging.py`：认证 facade 与 Bridge control proxy。
+- `docs/gitops/openapi-chatgpt-actions.yaml`：新增 `readRepositoryFile`、`acquireWriterLease`，公开 operation 数 28。
+- `scripts/build_v2r2c1_model_api_staging.py`：纳入 `scoped_lease_store.py`。
+- `tests/test_minimum_autonomous_loop.py`：read/path/size、contract、lease 幂等/冲突测试。
+- `runbooks/agent-minimum-autonomous-loop-20260825.md`：部署与验收手册。
+- `deploy/*minimal-autonomous-loop.conf`：待随最终 source OID 渲染的 staging unit 配置模板；实际 drop-in 使用 systemd `LoadCredential` 投影 `/data/aios-gitops/runtime/secrets/gitops.tokens`，不复制 token。
+
+## Git 与构建结果
+
+- 第一实现提交：`f3a4485be7c803c3769c518578cf4bf86db32c6e`。
+- 绑定与 scope 收紧提交：`04b69beb369365a1522268e16c3ac7cd1dd745ce`。
+- 最终实现/部署 source OID：`9f32b26eba5bdaaa0e7c89042ce336426d465dbd`。
+- build artifact：`/var/lib/aios-gitops/bridge-v2-staging/candidate-artifacts/min-autonomous-9f32b26/aios-v2r2c1-model-api-9f32b26eba5bdaaa0e7c89042ce336426d465dbd.tar.gz`
+- artifact SHA-256：`ff2031b9ef8a39811c15086c2577d33cc6f187fd060136b7be7a8d6b4152e9f1`
+- artifact source OID：`9f32b26eba5bdaaa0e7c89042ce336426d465dbd`
+
+## 测试与真实 staging 结果
+
+已通过：
+
+```text
+pytest -q tests/test_minimum_autonomous_loop.py tests/test_action_contract_regressions.py tests/test_bridge_v2_governed_http_bootstrap.py
+21 passed
+python3 -m py_compile ...  # changed runtime modules
+git diff --check
+```
+
+完整 mandatory suite（使用仓库需要的 `PYTHONPATH=.:services/aios-release-controller`）结果：
+
+`724 passed, 2 skipped, 2 failed, 154 subtests passed`。
+
+两个失败与本轮改动无关，和修改前已知基线一致：`tests/test_agent_event_bus.py::test_unified_event_flow` 受残留 `/tmp/aios-agent-events-test` 数据污染；`tests/test_signer_contract_compatibility.py::SignerContractCompatibilityTests::test_real_signer_help_and_self_test_are_available` 的已部署 signer self-test 返回码为 `42`。
+
+已验证：
+
+- `aios-chatgpt-bridge-v2-staging.service`: restart 后 active，ExecStart 指向 source `9f32b26...` runtime，PID `2061371`。
+- `aios-gitops-model-api-v2r2c1-staging.service`: restart 后 active，ExecStart 指向 source `9f32b26...` runtime，PID `2061686`。
+- `/api/health` 与 `/v2/runtime`: restart 后 HTTP 200，`STAGING`、`production_deployed=false`、runtime OID `9f32b26...`、artifact SHA `ff2031...`，`drift_status=PASS`。
+- 实际 staging `/api/openapi-chatgpt-actions.yaml`: HTTP 200，版本 `V2R2C1-chatgpt-actions-28ops`，28 个 `operationId`，含 `readRepositoryFile`、`acquireWriterLease`、`commitFilesGoverned`；`commitFilesGoverned.files` required 且每项 required `path`、`content_base64`。
+- 无 Bearer 的 model-api read 请求和 loopback Bridge read 请求均返回 HTTP 401；writes runtime flag 保持 false。
+- systemd effective User/Group 为 `aiman:gitops`；Gitea API 来源为 staging service effective `AIOS_GITOPS_GITEA_API_URL=https://g.cnnetmkt.top/git/api/v1` 与 Bridge `AIOS_GITEA_API_BASE=https://g.cnnetmkt.top/git/api/v1`，不是业务代码硬编码。
+- effective silent-release root 为 `/var/lib/aios-gitops/model-api-staging/silent-release`，ownership/mode 为 `aiman:gitops 750`，父目录同为 `aiman:gitops 750`；旧报错路径 `/var/lib/aios-gitops/silent-release` 不存在，未被错误地当作当前 runtime 路径。
+- systemd 使用 `LoadCredential=action_tokens:/data/aios-gitops/runtime/secrets/gitops.tokens` 和 `%d/action_tokens` 投影；registry 文件 `root:root 600`，未打印或复制 bearer。
+- 当前 token registry 是 hash-only 记录；本次没有打印、重用 Gitea/SSH/service token，也没有启用 dev auth bypass。
+
+重启后的 service restart acceptance 已完成：URL、权限、Action schema、version parser 代码产物和 writes=false 均保持有效；production service 未重启。
+
+未通过/未执行：
+
+- 无法执行正式 bearer 下的 `read -> lease -> commitFilesGoverned`，因此没有伪造两文件 commit OID、lease USED、Gitea Git/API readback 或 idempotency replay 证据。
+- 未执行临时 writes=true governed commit；staging 最终保持 `AIOS_GITOPS_WRITES_ENABLED=false`。
+- 未宣称完整 Action smoke、restart 后 governed commit 或 `TASK_VERIFIED`。
+
+## 保护边界
+
+本轮只安装 staging artifact/drop-in；production service 未重启。`main`、`V2R2C1` tag、baseline target/evidence closure 未写入。两个既有 untracked 目录 `runtime/agent-observability/`、`runtime/task-center/` 原样保留。
+
+## 剩余风险与下一步
+
+主要闭环阻塞是：需要 Owner/正式 Action broker 提供当前有效 bearer（不在聊天中传递）。此外 mandatory suite 仍有上述两个已知环境/部署失败。拿到 bearer 后应从当前 branch HEAD 重新读取 source OID，按 runbook 执行一次真实两文件 governed commit、Gitea 三方 OID readback、idempotency/stale-OID 负例、staging restart 后复测；在此之前 Task 必须保持 `BLOCKED/NEEDS_REWORK`，不能标记 `SUCCEEDED`。

reports/action-openapi-operation-limit-evidence-20260825.md

@@ -0,0 +1,224 @@
+# AIOS Action OpenAPI 操作数上限修复证据
+
+## 结论
+
+staging 上的 `https://cnnetmkt.top/api/openapi-chatgpt-actions.yaml` 已从 32 个
+实际 OpenAPI operations 收缩到 26 个，低于 ChatGPT Action 的 30 操作限制。
+公网重新抓取返回 HTTP 200，schema version 为
+`V2R2C1-chatgpt-actions-26ops`。`commitFilesGoverned` 仍是公开的批量 governed
+writer，并且现在在 OpenAPI 中显式要求 `bearerAuth`、标记为
+`x-openai-isConsequential: true`，required `files` 契约保持一致。
+
+本次只修改 branch/staging overlay；没有写入 production service、main、release
+tag 或 baseline registry。ChatGPT Action 编辑器仍需要重新导入或刷新这个 URL，
+因为客户端可能缓存旧的 32-operation schema。
+
+## 修改前事实
+
+- Repository：`aios/aios`
+- Branch：`agent/fix-action-contracts-20260825-1407`
+- 修复前 branch tip：`767c7ff6a975fe18a701b95cd6dacca8600eddc0`
+- 本轮最终 HEAD：`7e5525cfcbbaa3898c2e5ed3dc9c13e321908e61`
+- staging model-api unit：`aios-gitops-model-api-v2r2c1-staging.service`
+- staging model-api port：`127.0.0.1:18893`
+- staging Bridge port：`127.0.0.1:18892`
+- systemd Gitea API URL：`https://g.cnnetmkt.top/git/api/v1`
+- 当前 service User/Group：`aiman:gitops`
+- 修复前公网 schema：HTTP 200，24,721 bytes，SHA256
+  `a0775b0719a76e08a95f3257a3d3b2a73b70e1c55c162914250f80dd28da022d`；30 paths、
+  32 operations。两个 path 同时有多个 method，因此 path 数不是 operation 数。
+- 修复前触发错误：`OpenAPI 规范最多可以包含 30 个操作`。
+
+## 根因与决策
+
+根因不是 URL host 或 YAML 传输错误，而是公开 Action projection 中混入了旧式
+Git 写原语和同义 approval alias。公开 schema 同时暴露 legacy primitives 与
+`commitFilesGoverned`，最终 operation 数为 32。
+
+本次投影收缩为 26 个 operation：
+
+- 先前修复中移除粗粒度旧别名 `POST /api/file` (`commitFile`)；
+- 先前修复中移除当前 isolated-writer policy 明确禁止的 `POST /api/commit`
+  (`commitChanges`)；
+- 本轮移除 `submitSignedApproval`，因为它是 `submitOwnerApproval` 的 alias；
+- 本轮从 Actions projection 隐藏 `createPatch`、`createBranch`、
+  `commitFileAtomic` 三个旧式 Git 写原语。runtime 兼容处理没有删除，canonical
+  对外批量写入为 `/v2/commit-files`；
+- 保留 release candidate、release consistency、release acceptance、tag
+  publication status、release saga、getDiff 和 recovery 相关既有能力，满足本任务
+  的既有 smoke contract。尚未实现的 `getReleaseSnapshot`/`getReleaseVerification`
+  聚合 API 不在本次冒险重构范围内。
+
+此外，`commitFilesGoverned` 的 runtime fragment 生成器现在生成：
+
+- `security: [{bearerAuth: []}]`；
+- `x-openai-isConsequential: true`；
+- `files.maxItems: 50`；
+- `idempotency_key` 的长度和字符约束。
+
+## 修改文件与提交
+
+- `docs/gitops/openapi-chatgpt-actions.yaml`：canonical Action projection，26-op
+  allowlist、移除 legacy/alias、补齐 batch writer security。
+- `active-runtime/app/aios_chatgpt_bridge_v2.py`：runtime contract fragment 的
+  单一生成来源与公开 security/batch constraints。
+- `tests/test_action_contract_regressions.py`：26-operation gate、legacy operation
+  negative assertions、runtime/schema parity、bearer/consequential assertions。
+- `runbooks/action-openapi-operation-limit-20260825.md`：操作上限、projection
+  allowlist、构建和刷新手册。
+- `ops/gitops-migration/bind_external_action_surface_final_staging.sh` 及先前的
+  staging binding 测试/报告：本任务分支已将 `/v2/` 公开路由绑定到 staging Bridge
+  `127.0.0.1:18892`，没有使用 production `18920`。
+
+提交：
+
+- `4313f3e44a1e4be69d2608fb1fc18833aa0c82e8`
+  `fix(action): keep public schema within operation limit`
+- `7e5525cfcbbaa3898c2e5ed3dc9c13e321908e61`
+  `fix(action): project governed core within 26 operations`
+
+保留的未跟踪目录 `runtime/agent-observability/`、`runtime/task-center/` 未被加入
+提交或删除。
+
+## 测试结果
+
+修改后 focused regression：
+
+```text
+13 passed in 0.15s
+```
+
+包含既有 Action/release/staging focused tests：
+
+```text
+32 passed, 11 subtests passed in 0.36s
+```
+
+mandatory suite：
+
+```text
+264 passed, 28 subtests passed in 4.79s
+```
+
+完整 suite：
+
+```text
+721 passed, 2 skipped, 2 failed, 154 subtests passed in 34.02s
+```
+
+两个失败与本次变更无关且在修改前已复现：
+
+1. `tests/test_agent_event_bus.py::test_unified_event_flow` 使用了残留的
+   `/tmp/aios-agent-events-test`，已有 1 个旧 event，断言得到 2；
+2. `tests/test_signer_contract_compatibility.py::test_real_signer_help_and_self_test_are_available`
+   的已部署 signer `self-test` 返回 42。`sign --help` 仍正常，live signer integration
+   另行 skip。
+
+没有出现由本次 schema/runtime 改动引入的 mandatory regression。
+
+## staging 构建与部署
+
+使用仓库现有流程：
+
+```text
+scripts/build_v2r2c1_model_api_staging.py
+source_oid: 7e5525cfcbbaa3898c2e5ed3dc9c13e321908e61
+artifact: /data/aios-gitops/artifacts/action-openapi-limit-20260825-7e5525cf/aios-v2r2c1-model-api-7e5525cfcbbaa3898c2e5ed3dc9c13e321908e61.tar.gz
+artifact_sha256: 2163c2e0467f3bd0a97f8d2b95e3277391c47dcf3ebafb8fa372a01c3f530ac0
+deployment_state: STAGING
+```
+
+systemd 新 drop-in 持久化了 artifact/runtime identity、Gitea URL、`STAGING`、
+`AIOS_GITOPS_WRITES_ENABLED=false`、`aiman:gitops` 和精确的 read/write paths。
+当前生效 runtime：
+
+```text
+/opt/aios/gitops-model-api/7e5525cfcbbaa3898c2e5ed3dc9c13e321908e61-action-openapi-limit/runtime
+```
+
+silent-release 权限在两次重启后均为：
+
+```text
+/var/lib/aios-gitops/model-api-staging/silent-release aiman:gitops 750
+ACL: user::rwx, group::r-x, other::---
+```
+
+部署前的原生 final drop-in 已备份至：
+
+```text
+/data/aios-gitops/backups/action-openapi-limit-deploy-20260825T112700Z/
+```
+
+第一次 restart 后 MainPID 为 `1775067`；第二次按要求 restart 后 MainPID 为
+`1788253`，两次均 active/running。
+
+## 公网 Action smoke
+
+最终公网抓取：
+
+```text
+HTTP 200
+Content-Type: application/yaml; charset=utf-8
+bytes: 21553
+SHA256: 798cac0ebd40097c63e5e01ab52c9fdbc255707c4f3820b77161c83349cd5199
+info.version: V2R2C1-chatgpt-actions-26ops
+paths: 25
+operations: 26
+```
+
+关键 operation contract：
+
+```text
+commitFilesGoverned required:
+task_id, repository, expected_branch_oid, target_branch, generation,
+idempotency_key, files, message
+files item required: path, content_base64
+security: bearerAuth
+x-openai-isConsequential: true
+```
+
+restart 后复测：
+
+- `/api/health`：200，`status=ok`，`deployment_state=STAGING`，runtime OID 为
+  `7e5525cf…`，artifact SHA 与 receipt 一致，`production_deployed=false`；
+- `/v2/runtime`：200，active，Bridge schema `aios.chatgpt-gitops-bridge.v2`；
+- `/v2/capabilities`：200，governed writes enabled、legacy/main/baseline writes
+  false；
+- `/api/release-consistency?version=V2R2C1...`：200，`status=PASS`，包含
+  Gitea listing/tag/OID readback；
+- `/api/release-acceptance?version=V2R2C1...`：200，进入 policy evaluation，
+  `accepted=false` 是既有 acceptance policy 结果，不是 URL 校验错误；
+- `/api/tag-publication-status?version=V2R2C1`：200，结构化 `UNKNOWN` 状态；
+- `/getReleaseSaga?candidate_id=nonexistent-action-limit-20260825`：404，结构化
+  `NOT_FOUND`/empty-state，不是权限错误；
+- empty diff：200，`total_size_bytes=0`、`truncated=false`；
+- non-empty diff：200，31 changed paths、208,639 bytes；
+- large diff：200，732 changed paths、3,577,251 bytes、`truncated=true`、patch
+  bounded at 262,144 bytes，无 transport exception。
+
+保护边界复测：
+
+```text
+refs/heads/main = 3244f0f17f8845592ac94d585f5ebd65693c9f29
+refs/tags/V2R2C1 = 07fc2746b688f5f243f29b39de39f32edc3dd9d2
+service writes_enabled = false
+service deployment_state = STAGING
+```
+
+main/tag/baseline registry/production 未被本次部署写入。
+
+## 剩余风险与后续动作
+
+- ChatGPT 客户端是否已刷新不能由 staging 服务端证明；请在 Action 编辑器重新导入
+  URL。若仍显示旧数量，删除旧 schema 后重新导入，确认 `V2R2C1-chatgpt-actions-26ops`。
+- 完整 suite 的两个环境失败仍待独立清理 `/tmp` fixture 和修复 signer self-test；
+  它们不是本次 Action schema 修复的回归。
+- 未来若实现正式 `getReleaseSnapshot`、`getReleaseVerification` 和 governed task
+  Action projection，应单独设计/测试，不应通过隐藏本任务仍要求的 release read paths
+  来制造假收缩。
+
+## 状态
+
+`STAGING_REPAIR_PASS`：公网 staging schema、runtime、release/Gitea readback、
+restart 后 smoke 和保护边界均通过；production 未触碰。外部 ChatGPT Action UI
+刷新仍是客户端侧动作，不作为服务端部署失败。

runbooks/action-connector-schema-refresh-20260825.md

@@ -0,0 +1,21 @@
+# Runbook Addendum — External Action Connector Schema Refresh
+
+This addendum is staging-only and applies to the `fix-action-contracts-20260825-1407` closure.
+
+## Contract source
+
+Use `active-runtime/app/aios_chatgpt_bridge_v2.py` as the runtime source of required fields. Use `render_openapi_contract_fragment()` and `docs/gitops/openapi-chatgpt-actions.yaml` for the generated/published projection. `commitFilesGoverned` must require `files`, and each item must require `path` and `content_base64`.
+
+The public OpenAPI server is the site root and its Bridge v2 paths are `/v2/...`. Install the route with `ops/gitops-migration/bind_external_action_surface_final_staging.sh`; it must target `127.0.0.1:18892`, preserve the Authorization headers, pass `nginx -t`, reload Nginx, and never target production `18920`.
+
+## Connector lifecycle gate
+
+The external Action connector must be refreshed through its supported registration or re-registration lifecycle. Record the connector identity, schema source URL, fetched schema digest, cache invalidation or registration acknowledgement, and a callable-tool inspection showing required `files`. Do not make a local fixture or a second hand-written schema a substitute for this evidence.
+
+If the connector registration API, cache lifecycle, callable inspection, or formal staging Action bearer is unavailable, stop at `PENDING_EXTERNAL_CONNECTOR` and record `FORMAL_STAGING_ACTION_BEARER_ISSUANCE_NOT_AVAILABLE`. Never reuse Gitea, SSH, task-control, Writer, or old token credentials.
+
+## Acceptance
+
+After connector refresh, use the actual callable Action once to submit two files through `commitFilesGoverned` on an isolated `agent/*` branch. Verify the task/lease lineage, Authority ref, Git remote ref, and Gitea API branch OID are equal. Read the durable job, require `COMPLETED`, then call terminal reconcile and require an idempotent successful read-back. Restart only staging Action/Bridge/model services and repeat callable schema inspection and the batch/reconcile smoke.
+
+Do not mark `SUCCEEDED` until the callable schema and batch evidence exist. If refresh breaks health, routes, auth, schema, or protected-ref boundaries, restore the recorded Nginx backup and previous staging artifact through the governed deployment procedure, then diagnose.

runbooks/action-openapi-operation-limit-20260825.md

@@ -0,0 +1,58 @@
+# ChatGPT Action OpenAPI 操作数上限运行手册
+
+## 目的
+
+`https://cnnetmkt.top/api/openapi-chatgpt-actions.yaml` 必须保持不超过 ChatGPT
+Action 导入支持的 30 个实际操作；当前投影硬门槛收紧为 26，为未来治理、诊断
+和任务协议保留余量。OpenAPI 中同一路径的多个 HTTP method 分别计数；路径数量
+不等于操作数量。
+
+## 单一来源与构建
+
+规范唯一来源是 `docs/gitops/openapi-chatgpt-actions.yaml`。模型 API staging
+构建脚本 `scripts/build_v2r2c1_model_api_staging.py` 将该文件复制到 immutable
+artifact，并同时校验 `/v2/commit-files` runtime contract。禁止直接编辑已部署
+artifact 或 production 文件。
+
+变更后至少执行：
+
+```bash
+python3 - <<'PY'
+import yaml
+from pathlib import Path
+doc = yaml.safe_load(Path('docs/gitops/openapi-chatgpt-actions.yaml').read_text())
+methods = {'get', 'post', 'put', 'patch', 'delete', 'head', 'options'}
+operations = [(p, m) for p, item in doc['paths'].items() for m in item if m in methods]
+assert len(operations) <= 26, len(operations)
+print(f'paths={len(doc["paths"])} operations={len(operations)}')
+PY
+PYTHONPATH=active-runtime/app python3 -m pytest -q tests/test_action_contract_regressions.py
+```
+
+## 公开面选择
+
+公开 schema 保留受治理的 `/v2/commit-files` 以及 release、
+tag publication、consistency、acceptance、saga 和 diff 操作。粗粒度旧别名
+`/api/file`、`/api/commit`、`/api/branch`、`/api/patch` POST、`/api/commit-file`
+以及 `/submitSignedApproval` 等旧别名/旧写原语不得重新加入公开 Action schema；
+批量写入使用 `/v2/commit-files`。完整 runtime 兼容路由不因此删除。
+
+`commitFilesGoverned` 必须显式声明 `security: [{bearerAuth: []}]` 和
+`x-openai-isConsequential: true`；schema 与 Bridge runtime 的 required fields、
+batch limits 必须由同一生成链维护。
+
+## 部署与复验
+
+只使用 `scripts/build_v2r2c1_model_api_staging.py` 生成 staging artifact，保留
+当前 systemd drop-in 备份，更新 staging model-api 的 artifact 路径后执行
+`daemon-reload` 和 staging unit restart。部署后从公网重新抓取 schema，验证：
+
+- HTTP 200，Content-Type 为 YAML；
+- 实际操作数为 30 或更少；
+- `commitFilesGoverned` 仍包含 required `files`，每项包含 `path`、`content_base64`；
+- `/v2/runtime`、capabilities、release consistency/acceptance、tag status、
+  saga empty-state、diff small/empty/large smoke 均正常；
+- staging unit active，production/main/tag/baseline 未写入。
+
+Action 客户端可能缓存旧规范。公网 schema 复验通过后，在 ChatGPT Action 编辑器
+重新导入该 URL 或执行刷新；服务端无法替代客户端已保存的旧 schema cache。

runbooks/agent-fix-action-contracts-20260825.md

@@ -0,0 +1,225 @@
+# Agent Execution Contract — Action Contract Regression Repair
+
+## Objective
+
+Fully repair the current AIOS Action runtime/contract overlay regressions on the single server, without modifying protected refs directly and without introducing new infrastructure. The task is not complete until the deployed staging/action overlay passes all acceptance gates.
+
+## Authority and scope
+
+- Repository: `aios/aios`
+- Base at task creation: `3244f0f17f8845592ac94d585f5ebd65693c9f29`
+- Governed task: `fix-action-contracts-20260825-1407`
+- Target branch: `agent/fix-action-contracts-20260825-1407`
+- Protected refs must not be directly written: `main`, release tags, baseline registry, production runtime.
+- No new SaaS, database, agent framework, or monitoring platform may be introduced.
+
+## Non-interactive rules
+
+The Agent must run the whole flow unnattended:
+
+1. Collect facts.
+2. Determine root causes.
+3. Make the smallest correct changes.
+4. Run unit/integration/contract tests.
+5. Deploy to staging only.
+6. Restart only the affected non-production services.
+7. Run the full Action smoke suite.
+8. On failure, automatically collect logs, diagnose, fix, and retry.
+9. If a change causes a new regression, automatically roll back the staging change to the previous known-good configuration and record the failure.
+10. Stop only if an owner decision is required for a high-risk, irreversible, or production-boundary action.
+
+## Fact collection — required before editing
+
+Record all of the following in the final evidence bundle:
+
+- `id`, `hostname`, `uname -a`, `date --iso-seconds`
+- `git rev-parse --show HEAD` for authority worktree and running overlay source
+- `git status --porcelaine=v2`
+- `git remote -v`
+- current systemd service unit(s), drop-ins, Environment/EnvironmentFile sources for GitOps/Bredge/release services
+- `systemctl show <affected-service>` including `User=`, `Group=`, `Environment=`, `EnvironmentFile=`, `ExecStart=`
+- resolved Gitea API base URL after env/config expansion; redact secrets but not scheme/host
+- `stat -c, `namei -l`, `getfacl`, als -ld on `/var/lib/aios-gitops/silent-release` and its parents
+- find Action OpenAPI/schema generator and runtime operation definitions for `commitFilesGoverned`
+- find the release version validator(s) and all callers of `getTagPublicationStatus`
+- find `reconcileGitOpsJob` implementation and durable binding validation logic
+- find `getDiff  implementation and transport output limits
+
+Do not edit any file until the actual implementation and configuration sources have been located.
+
+## Repair 1 — Gitea API URL
+
+Symptoms:
+
+- `getReleaseConsistency` → `Gitea API URL must be HTTP(S)`
+- `runReleaseAcceptance` → `Gitea API URL must be HTTP(ÊX
+
+Required behavior:
+
+- Determine which env/config key is projected into the current contract overlay.
+- Compare the deployed overlay with V2R2C1 known-good configuration/deployment manifests.
+- Restore a valid `HTTP://` or `HTTPS://` Gitea API base URL.
+- Add startup config validation so invalid schemes fail at health/startup with a config-specific message, not during a release check.
+- Never hard-code a different Gitea host if the existing deployment already has a single authoritative source.
+
+## Repair 2 — durable release state permissions
+
+Symptom:
+
+- `getReleaseSaga` → `Permission denied: '/var/lib/aios-gitops/silent-release'`
+
+Required behavior:
+
+- Identify the actual runtime service User/Group.
+- Grant only the required traverse/read/write permissions for the durable state directories the service must use.
+- Prefer ownership + group mode or a specific ACL; keep the directory non-world-writable.
+- Persist the permission in deployment/install logic so restart/reboot does not regress.
+- Verify create/read/update of a staging-only saga state file under the service identity.
+
+## Repair 3 — release version contract
+
+Symptom:
+
+- `getTagPublicationStatus("V2R2C1")` → `invalid release version`
+- The same runtime exposes `V2R2C1` as `approved_release_version`.
+
+Required behavior:
+
+- Locate all version validators; consolidate onto one canonical parser.
+- Accept the AIOS canonical namespace `^V[0-9]+R[0-9]+C[0-9]+$`.
+- Preserve any additional already-supported legacy formats unless they are security-sensitive.
+ - Add contract tests proving that the version accepted by capabilities is accepted by status, candidate, consistency, acceptance, and tag publication.
+
+## Repair 4 — `commitFilesGoverned` schema parity
+
+Symptom:
+
+- Runtime capability metadata requires `files`.
+- Published Action tool schema does not expose `files`.
+- Call reaches Bridge and fails `BRIDGE_REQUEST_FIELDS_MISSING`.
+
+Required behavior:
+
+- Find the canonical runtime operation contract.
+- Generate the external tool schema from the same source of truth; do not manually copy a parallel schema.
+- `files` must be required and must represent a list of file objects with at least `path` and `content_base64`.
+- Add a parity test that compares runtime required fields with published Action required fields.
+- Add a real governed commit test that writes two test files to an isolated `agent/` ibranch and verifies remote OID.
+
+## Repair 5 — terminal reconciliation
+
+Symptom:
+
+- A governed job read back as `COMPLETED' but `reconcileGitOpsJob` failed `DURABLE_BINDING_INVALID`.
+
+Required behavior:
+
+- Reconciling a terminal successful job must be idempotent.
+- An expired writer lease must not invalidate a durable binding for a job that is already terminal.
+- Active-job reconciliation may require a live lease; terminal read-back must not.
+- Add cases for COMPLETED, FAILED, CANCELLED / equivalent terminal states.
+
+## Repair 6 — bounded `getDiff` output
+
+Symptom:
+
+- Large valid diffs fail with `ResponseTooLargeError` or `GIT_OUTPUT_LIMIT_EXCEEDED`.
+
+Required behavior:
+
+- Do not load unbounded diff text into the Action response.
+- Return bounded summary data: commit identities, changed paths/stats, total bytes, and `truncated: true` when the full patch exceeds the safe limit.
+- If pagination already exists in the contract use it; otherwise prefer deterministic truncation over a breaking schema change.
+- Add tests for small, empty, and oversize diffs.
+
+## Staging deployment procedure
+
+1. Run the existing mandatory test suite before modification; record baseline.
+2. Apply code and config changes only on the governed branch/worktree.
+3. Run focused regression tests.
+4. Run the full mandatory suite.
+5. Build the staging contract overlay using the repository's existing build/deploy path.
+6. Deploy to staging/non-production only.
+7. If systemd units are changed: `systemctl daemon-reload`, then restart only the affected staging services.
+8. Wait for the existing health endpoint/runtime status to become healthy.
+9. Run the acceptance suite below.
+
+If any step fails:
+- collect `journalctl` logs and relevant app logs;
+- diagnose root cause;
+- automatically repair and retry when non-destructive;
+- if a new change breaks staging, restore the previous staging artifact/config and restart the affected service;
+- never silently continue after a failed gate.
+
+## Acceptance suite
+
+All of the following must pass on the same deployed staging overlay:
+
+- Runtime status is `active` and healthy after restart.
+- Gitea Git/API readback works from the runtime service identity.
+- `getReleaseConsistency(V2R2C1, 998d30304787e31e5ae607c0bd86b5edb2b0e5ad, a8b906d1bc24088c19647e98de6a679268f6d0a2, approved_plan) returns a structured result and reaches evaluation.
+- `runReleaseAcceptance` for the same identities reaches policy evaluation, not URL validation error.
+- `getTagPublicationStatus("V2R2C1")` returns structured state, not `invalid release version`.
+- `getReleaseSaga` for a nonexistent candidate returns NOT_FOUND/empty-state semantics, not filesystem permission failure.
+- `commitFilesGoverned` exposes its required `files` parameter in the published Action schema.
+ - A real two-file governed commit to an isolated `agent/` branch succeeds and remote branch OID matches.
+- Resuming a COMPLETED job returns the existing `JOB_TERMINAL` semantics or idempotent success as designed.
+- Reconciling a COMPLETED governed job is successful/idempotent and does not require an active lease.
+- Small/empty `getDiff  still works.
+- Large `getDiff` returns bounded output with truncation metadata instead of a transport exception.
+- Existing protected-ref controls remain unchange: no direct main/tag/baseline/production write.
+
+## Restart / reboot persistence
+
+After the first full pass:
+
+- Restart the staging Action/Bridge/release services one more time without changing files.
+- Rerun the acceptance suite.
+- Permissions, Gitea URL, and schema must still be correct after restart.
+- If the repository already has a safe staging reboot test, run it as well.
+
+## Evidence and completion
+
+Create a single durable report in the repository, e.g. `reports/action-contract-repair-evidence-20260825.md`, containing:
+
+- pre-change facts
+- root cause for each regression
+- files changed and why
+- config/permission changes
+- test commands and exact results
+- staging deployment identity (commit/artifact/config digest)
+- restart-persistence results
+- final Action smoke results
+- any remaining risks
+
+Commit all source, test, deployment config, and runbook changes to the governed task branch. Do not mark the task SUCCEEDED until all acceptance gates pass on the actually deployed staging overlay.
+
+## Automatic rollback conditions
+
+Automatically roll back the staging deployment if any of the following occur:
+
+- service fails to become healthy after restart
+- protected-ref write boundary is broken
+- Gitea readback that worked before the change stops working
+- durable saga state cannot be read or recovered
+- mandatory test suite regresses below the pre-change baseline
+
+Do not automatically roll back an existing production release. Rollback here refers only to the staging overlay/service configuration changes made by this task.
+
+## 2026-08-25 execution record
+
+The repair branch was deployed through the existing immutable staging builder. The final source code before the evidence commit was `2ec49005bde44f6981b14351500847d594e0276c`; the deployed artifact was built from that source with SHA256 `f67aed6cc0cce1f08197485c3eea204d3ef4d3989f44dc98e8ea2691e5886cbf`. The final staging drop-ins use a lexically highest `zzzz...-999.conf` layer so they override earlier diagnostic overlays.
+
+The runtime configuration is staging-only: `User=aiman`, `Group=gitops`, API base `https://g.cnnetmkt.top/git/api/v1`, baseline authority `/var/lib/aios-gitops/model-api-staging/baseline/current.json`, and read/write access to the staging state plus the authoritative bare repository required by the governed Writer/CAS path. No `main`, protected tag, baseline registry, or production write is enabled.
+
+The release executor now binds both the configured staging baseline and the immutable runtime package's `versions/V2R2C1.json` projection. The bridge passes `AIOS_GITOPS_BASELINE_AUTHORITY` into `RuntimeConfig`; this prevents release consistency and acceptance from falling back to missing publication-workspace files.
+
+The final acceptance result is recorded in `reports/action-contract-repair-evidence-20260825.md`. Contract smoke is green, and release consistency is `PASS`; release acceptance is structured policy output but remains `accepted=false` because the pre-existing publication state is `REMOTE_PUSH_PENDING` for the protected `V2R2C1` tag. The task must therefore remain `NEEDS_REWORK` until an authorized owner resolves that independent protected-tag state.
+
+## External Action Surface final closure attempt (2026-08-25)
+
+本轮仅部署 staging/non-production；没有直接写入 main�release tag�baseline registry 或 production。
+
+Public route ownership: /api/governed-write-capabilities, /api/control-plane-snapshot, /api/online-agent-task, and /api/online-agent-task-events are exact-location proxied to 127.0.0.1:18890; generic /api/ remains on 127.0.0.1:18893. The durable installer is ops/gitops-migration/bind_external_action_surface_final_staging.sh; it backs up Nginx, runs nginx -t, reloads, and forwards Authorization/X-AIOS-Token.
+
+A task-control token, local Writer grant, Gitea consumer, SSH credential, or old token file is not an external Action bearer. If formal issuance is unavailable, do not print or rotate secrets, enable disabled writes, or manufacture commit evidence; record FORMAL_STAGING_ACTION_BEARER_ISSUANCE_NOT_AVAILABLE. Public release-consistency and release-acceptance use the canonical Bridge v2 evaluator. A Task API continuation remains QUEUED until a legitimate Agent claims it and gives durable result evidence.

runbooks/agent-minimum-autonomous-loop-20260825.md

@@ -0,0 +1,81 @@
+# AIOS 最小自治修复闭环运行手册
+
+## 范围
+
+本手册只覆盖 staging/non-production 的最小链路：
+
+```text
+readRepositoryFile -> acquireWriterLease -> commitFilesGoverned
+-> immutable staging build/reload -> runtime/read-back
+```
+
+不覆盖 release/recovery/listPatches 语义，不得写入 `main`、release tag、baseline
+或 production。
+
+## Action contract
+
+公开 Action schema 的 canonical URL 是：
+`https://cnnetmkt.top/api/openapi-chatgpt-actions.yaml`。
+
+本轮增加两个 operation，公开面共 28 个，保留 30 个上限余量：
+
+- `readRepositoryFile`：`POST /readRepositoryFile`，必填 `repository`, `ref`, `path`, `max_bytes`；只从 authoritative bare Git object database 读取，禁止绝对路径、`..`、反斜线、NUL 和 `.git`，单次最多 262144 bytes。
+- `acquireWriterLease`：`POST /acquireWriterLease`，只接受 `CONTINUE_EXISTING`，必须绑定 durable task、repository、target branch、base OID、当前 expected branch OID、generation 和短 TTL。
+- `commitFilesGoverned`：既有 `POST /v2/commit-files`，必须先有同一 task/generation/expected OID 的 lease；`files` 为数组，每项必须含 `path` 与 `content_base64`。
+
+model-api facade 对上述三个入口执行 Action bearer 认证，并把 Authorization/X-AIOS-Token 透传给 loopback Bridge。Bridge 再执行 operation-specific scope：read 允许 `repository:read` 或兼容的 `file:write`，lease 需要 `agent-task:control`，commit 需要 `file:write`。
+
+## 构建与部署
+
+从当前隔离 agent branch 的完整 source OID 构建：
+
+```bash
+python3 scripts/build_v2r2c1_model_api_staging.py \
+  --source-root . \
+  --output-root /var/lib/aios-gitops/bridge-v2-staging/candidate-artifacts/<id> \
+  --source-oid <40-hex-source-oid>
+```
+
+构建 receipt 必须声明 `STAGING`、`aios/aios`、`legacy_global_writes_enabled=false`，并记录 artifact SHA-256。使用 versioned systemd drop-in template，将 source OID、artifact SHA-256 和 immutable runtime path 渲染到 staging 两个 unit；同时使用：
+
+```ini
+LoadCredential=action_tokens:/data/aios-gitops/runtime/secrets/gitops.tokens
+Environment=AIOS_GITOPS_TOKEN_FILE=%d/action_tokens
+```
+
+这样由 systemd 投影已有 Action token registry，不复制或打印 token，不使用 Gitea token 代替 Action bearer。部署后只执行：
+
+```bash
+systemctl daemon-reload
+systemctl restart aios-chatgpt-bridge-v2-staging.service
+systemctl restart aios-gitops-model-api-v2r2c1-staging.service
+```
+
+## 验收顺序
+
+1. `systemctl is-active` 两个 staging unit；读取 `/api/health`、`/v2/runtime`。
+2. 从公网 URL 重新抓取 YAML，解析 operation 数量，确认 `<=30`，并确认 `files`/`path`/`content_base64` required parity。
+3. 使用正式 Action bearer：
+
+```text
+readRepositoryFile(repository, ref=agent/<branch> or exact OID, path, max_bytes)
+acquireWriterLease(task_id, repository, CONTINUE_EXISTING, base_oid,
+                   expected_branch_oid=<read resolved OID>, target_branch,
+                   generation, lease_seconds)
+commitFilesGoverned(task_id, repository, expected_branch_oid, target_branch,
+                    generation, idempotency_key, two files, message)
+```
+
+4. 校验 authority branch OID、Gitea Git ref OID、Gitea API branch OID 和 `commit_visible` 一致；重复相同 idempotency key 不得生成第二个 commit，旧 expected OID 必须拒绝。
+5. 验证 staging runtime source OID/artifact SHA-256 与 build receipt 一致，再重复完整 smoke。
+6. 若 bearer 不可用，状态必须是 `BLOCKED`，不能用 SSH、root、Gitea、旧 token、service credential 或 dev bypass 代替。
+
+完整 suite 使用：
+
+```bash
+PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=.:services/aios-release-controller pytest -p no:cacheprovider -q
+```
+
+## 回滚边界
+
+只回滚本轮创建的 staging artifact/drop-in；不得回滚 production release。若 health、Gitea readback、protected-ref boundary 或 mandatory suite 回归，恢复前一份 staging drop-in，采集 `journalctl -u` 日志，再继续诊断。

scripts/build_v2r2c1_model_api_staging.py

@@ -5,6 +5,7 @@ import hashlib
 import json
 import os
 from pathlib import Path
+import sys
 import tarfile
 import tempfile
 
@@ -18,9 +19,23 @@ REQUIRED_APP = (
     'silent_release_controller.py',
     'silent_release_hardening.py',
     'aios_gitops_job_controller.py',
+    'aios_chatgpt_bridge_v2.py',
+    'aios_chatgpt_bridge_v2_server.py',
+    'governed_production_release.py',
+    'v2r2c1_production_adapter.py',
+    'v2r1c7_production_adapter.py',
+    'aios_governed_task_bootstrap.py',
+    'aios_continuation_executor.py',
+    'aios_continuation_lease.py',
+    'aios_authority_git_executor.py',
+    'scoped_lease_store.py',
+    'aios_gitops_reconciliation_core.py',
+    'authorized_task_writer_provisioning.py',
+    'signer_contract_compatibility.py',
 )
 OPTIONAL_APP = (
     'aios_chatgpt_actions_api.py',
+    'aios_model_api_staging_list_patches_overlay.py',
     'aios_continuation_executor.py',
     'aios_continuation_lease.py',
     'aios_control_plane_snapshot.py',
@@ -56,11 +71,18 @@ def main() -> int:
     source = args.source_root.resolve(strict=True)
     output = args.output_root.resolve()
     app = source / 'active-runtime' / 'app'
+    sys.path.insert(0, str(app))
+    from aios_chatgpt_bridge_v2 import render_openapi_contract_fragment
+
     runtime = source / 'runtime' / 'agent-os'
     docs = source / 'docs' / 'gitops'
     if not app.is_dir():
         raise SystemExit('active-runtime/app missing')
     paths = []
+    root_version = source / 'release_version.py'
+    if not root_version.is_file():
+        raise SystemExit('required source dependency missing: release_version.py')
+    paths.append((Path('release_version.py'), root_version))
     for name in REQUIRED_APP:
         path = app / name
         if not path.is_file():
@@ -77,6 +99,8 @@ def main() -> int:
         paths.append((Path('runtime-agent-os') / rel, path))
     openapi = docs / 'openapi-chatgpt-actions.yaml'
     if openapi.is_file():
+        if '  /v2/commit-files:' not in openapi.read_text(encoding='utf-8'):
+            raise SystemExit('published OpenAPI is missing generated commitFilesGoverned contract')
         paths.append((Path('docs') / 'gitops' / 'openapi-chatgpt-actions.yaml', openapi))
     for folder in ('config/model_registry', 'config/model_priority', 'patches', 'versions'):
         root = source / folder
@@ -95,7 +119,7 @@ def main() -> int:
         'repository_identity': 'aios/aios',
         'deployment_state': 'STAGING',
         'runtime_mode': 'IMMUTABLE_STAGING',
-        'runtime_entrypoint': 'app/aios_model_api_staging.py',
+        'runtime_entrypoint': 'app/aios_model_api_staging_list_patches_overlay.py',
         'legacy_global_writes_enabled': False,
         'governed_release_routing': 'bridge-v2',
         'artifact_sha256': 'provided-by-build-receipt-and-install-manifest',

scripts/release_version.sh

@@ -9,10 +9,16 @@ WORKSPACE="${AIOS_GITOPS_WORKSPACE:-/data/aios-gitops/workspace}"
 TAG_REMOTE="${AIOS_GITOPS_GITEA_REMOTE:-gitea}"
 BRANCH_REMOTE="${AIOS_GITOPS_BRANCH_REMOTE:-gitea}"
 
-case "$VERSION" in
-  V[0-9]*R[0-9]*C[0-9]*) ;;
-  *) echo "ERROR: version must match VxRxCx" >&2; exit 64 ;;
-esac
+SCRIPT_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+if ! PYTHONPATH="$SCRIPT_ROOT:${PYTHONPATH:-}" python3 - "$VERSION" <<'PY'
+import sys
+from release_version import validate_release_version
+validate_release_version(sys.argv[1])
+PY
+then
+  echo "ERROR: version must match VxRxCx" >&2
+  exit 64
+fi
 
 for value in "$TARGET_OID" "$EVIDENCE_CLOSURE_OID"; do
   [[ "$value" =~ ^[0-9a-f]{40}$ ]] || {

services/aios-release-controller/aios_release_controller/manifest.py

@@ -1,8 +1,9 @@
 from __future__ import annotations
 import hashlib,json,re,tarfile
+from release_version import RELEASE_VERSION_RE
 from pathlib import Path
 from typing import Any
-OID_RE=re.compile(r"^[0-9a-f]{40}$"); SHA_RE=re.compile(r"^[0-9a-f]{64}$"); VERSION_RE=re.compile(r"^V[0-9]+R[0-9]+C[0-9]+(?:-[A-Za-z0-9_.-]+)?$")
+OID_RE=re.compile(r"^[0-9a-f]{40}$"); SHA_RE=re.compile(r"^[0-9a-f]{64}$"); VERSION_RE=RELEASE_VERSION_RE
 REQUIRED_SOURCE={"schema","version","repository","base_ref","base_oid","binding_mode","release_readiness","production_deployed","tag_created","baseline_changed","production_service","production_port","rollback_metadata","controller_schema","required_checks"}
 REQUEST_KEYS={"schema","version","repository","base_oid","target_oid","artifact_uri","artifact_sha256","artifact_size","evidence_closure_oid","approval_plan_id","execute","production_deployed","production_service","production_port","rollback_metadata","current_tag_oid","source_manifest_sha256"}
 class ManifestValidationError(ValueError):

tests/test_action_contract_regressions.py

@@ -0,0 +1,217 @@
+from __future__ import annotations
+
+import inspect
+import json
+import sys
+from pathlib import Path
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+sys.path.insert(0, str(ROOT / "runtime/agent-os"))
+
+from aios_chatgpt_bridge_v2 import (  # noqa: E402
+    OPERATION_REQUIRED_FIELDS,
+    operation_contracts,
+    render_openapi_contract_fragment,
+)
+from aios_chatgpt_bridge_v2_server import GovernedRuntime  # noqa: E402
+from aios_gitops_job_controller import JobState  # noqa: E402
+from gitea_tag_publication import validate_gitea_api_url  # noqa: E402
+from silent_release_hardening import ReleaseSagaStore, SilentReleaseActionService  # noqa: E402
+from release_version import validate_release_version  # noqa: E402
+import aios_model_api_staging as model_api  # noqa: E402
+
+
+def test_canonical_release_version_is_shared_and_accepts_v2r2c1():
+    assert validate_release_version("V2R2C1") == "V2R2C1"
+    assert validate_release_version("V2R2C1-repair") == "V2R2C1-repair"
+    with pytest.raises(ValueError):
+        validate_release_version("v2r2c1")
+
+
+def test_gitea_url_validation_is_startup_safe():
+    assert validate_gitea_api_url("https://g.cnnetmkt.top/git/api/v1") == (
+        "https://g.cnnetmkt.top/git/api/v1"
+    )
+    with pytest.raises(ValueError, match="HTTP"):
+        validate_gitea_api_url("g.cnnetmkt.top/git/api/v1")
+
+
+def test_public_release_reads_use_the_bridge_canonical_evaluator():
+    query = {
+        "version": ["V2R2C1"],
+        "target_oid": ["998d30304787e31e5ae607c0bd86b5edb2b0e5ad"],
+        "evidence_closure_oid": ["a8b906d1bc24088c19647e98de6a679268f6d0a2"],
+        "approval_plan_id": ["sha256:plan"],
+    }
+    assert model_api.governed_release_query_payload(query) == {
+        "version": "V2R2C1",
+        "target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
+        "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
+        "approval_plan_id": "sha256:plan",
+    }
+    source = inspect.getsource(model_api.H.do_GET)
+    assert "self.bridge_release(" in source
+    assert "'/getReleaseConsistency'" in source
+    assert "'/runReleaseAcceptance'" in source
+
+
+def test_governed_read_routes_are_bound_to_authenticated_facade():
+    route_script = (
+        ROOT / "ops/gitops-migration/bind_external_action_surface_final_staging.sh"
+    ).read_text()
+    for path in (
+        "/api/governed-write-capabilities",
+        "/api/control-plane-snapshot",
+        "/api/online-agent-task",
+        "/api/online-agent-task-events",
+    ):
+        assert f"location = {path}" in route_script
+        assert f"proxy_pass http://127.0.0.1:18890{path};" in route_script
+    assert "location /api/ {" in route_script
+    assert "Authorization $http_authorization" in route_script
+
+
+def test_published_action_v2_paths_are_bound_to_staging_bridge():
+    route_script = (
+        ROOT / "ops/gitops-migration/bind_external_action_surface_final_staging.sh"
+    ).read_text()
+    schema = (ROOT / "docs/gitops/openapi-chatgpt-actions.yaml").read_text()
+    assert "servers:" in schema
+    assert "- url: https://cnnetmkt.top" in schema
+    assert "  /v2/commit-files:" in schema
+    assert "location ^~ /v2/" in route_script
+    assert "proxy_pass http://127.0.0.1:18892;" in route_script
+    assert "proxy_pass http://127.0.0.1:18920;" not in route_script
+    assert "Authorization $http_authorization" in route_script
+
+
+def test_published_action_schema_stays_within_chatgpt_operation_limit():
+    schema = yaml.safe_load(
+        (ROOT / "docs/gitops/openapi-chatgpt-actions.yaml").read_text()
+    )
+    operations = [
+        (path, method, operation)
+        for path, item in schema["paths"].items()
+        for method, operation in item.items()
+        if method.lower() in {"get", "post", "put", "patch", "delete", "head", "options"}
+    ]
+    assert len(operations) <= 30
+    assert len(operations) == 28
+    assert "commitFilesGoverned" in {
+        operation["operationId"] for _, _, operation in operations
+    }
+    assert {"readRepositoryFile", "acquireWriterLease"}.issubset(
+        {operation["operationId"] for _, _, operation in operations}
+    )
+    assert "/api/file" not in schema["paths"]
+    assert "/api/commit" not in schema["paths"]
+    operation_ids = {operation["operationId"] for _, _, operation in operations}
+    assert {
+        "submitSignedApproval",
+        "createPatch",
+        "createBranch",
+        "commitFileAtomic",
+        "commitFile",
+        "commitChanges",
+    }.isdisjoint(operation_ids)
+    governed = next(
+        operation for _, _, operation in operations
+        if operation["operationId"] == "commitFilesGoverned"
+    )
+    assert governed["security"] == [{"bearerAuth": []}]
+    assert governed["x-openai-isConsequential"] is True
+
+
+def test_commit_files_runtime_and_published_schema_have_same_required_fields():
+    runtime = operation_contracts()["commitFilesGoverned"]["required_fields"]
+    assert runtime == list(OPERATION_REQUIRED_FIELDS["commitFilesGoverned"])
+    fragment = render_openapi_contract_fragment()
+    published = (ROOT / "docs/gitops/openapi-chatgpt-actions.yaml").read_text()
+    assert fragment in published
+    for field in runtime:
+        assert f"                - {field}" in fragment
+    assert "required: [path, content_base64]" in fragment
+
+
+class _Store:
+    def __init__(self, row):
+        self.row = row
+        self.receipt_calls = 0
+
+    def read(self, _job_id):
+        return self.row
+
+    def _receipt(self, row, duplicate=False):
+        self.receipt_calls += 1
+        return type("Receipt", (), {"as_dict": lambda _self: {
+            "job_id": row["job_id"],
+            "state": row["state"],
+            "duplicate": duplicate,
+        }})()
+
+
+class _Controller:
+    def __init__(self, row):
+        self.store = _Store(row)
+
+
+def _runtime_for(row):
+    runtime = object.__new__(GovernedRuntime)
+    controller = _Controller(row)
+    runtime._controller_for_job = lambda _job_id: controller
+    runtime._executor_from_row = lambda *_args: (_ for _ in ()).throw(
+        AssertionError("terminal reconcile must not reconstruct an executor")
+    )
+    return runtime, controller
+
+
+@pytest.mark.parametrize(
+    "state",
+    [
+        JobState.COMPLETED.value,
+        JobState.FAILED.value,
+        JobState.CANCELLED.value,
+        JobState.MANUAL_OWNER_REVIEW_REQUIRED.value,
+    ],
+)
+def test_terminal_reconcile_is_idempotent_without_durable_binding(state):
+    row = {
+        "job_id": "job-terminal",
+        "state": state,
+        "request_json": json.dumps({}),
+    }
+    runtime, controller = _runtime_for(row)
+    result = GovernedRuntime.job(runtime, {"job_id": row["job_id"]}, "reconcile")
+    assert result["duplicate"] is True
+    assert controller.store.receipt_calls == 1
+
+
+def test_active_reconcile_still_uses_executor():
+    row = {
+        "job_id": "job-active",
+        "state": JobState.RECONCILIATION_REQUIRED.value,
+        "request_json": json.dumps({}),
+    }
+    runtime, controller = _runtime_for(row)
+    class Executor:
+        def reconcile(self, job_id):
+            return {"job_id": job_id, "state": "COMPLETED"}
+    runtime._executor_from_row = lambda *_args: Executor()
+    assert GovernedRuntime.job(runtime, {"job_id": row["job_id"]}, "reconcile") == {
+        "job_id": "job-active",
+        "state": "COMPLETED",
+    }
+
+
+def test_missing_release_saga_is_a_not_found_empty_state(tmp_path):
+    service = object.__new__(SilentReleaseActionService)
+    service.sagas = ReleaseSagaStore(tmp_path)
+    service.execution_enabled = False
+    result = service.get_release_saga("never-created-action-contract")
+    assert result["status"] == "NOT_FOUND"
+    assert result["state"] == "NOT_FOUND"
+    assert not list(tmp_path.rglob("*"))

tests/test_bridge_v2_governed_http_bootstrap.py

@@ -1,4 +1,5 @@
 import base64
+import subprocess
 from pathlib import Path
 
 from aios_authority_git_executor import AuthorityGitExecutor
@@ -24,6 +25,22 @@ class Probe:
         return True
 
 
+def test_authority_create_task_branch_is_agent_scoped_and_idempotent(tmp_path):
+    bare = tmp_path / "repo.git"
+    subprocess.run(["git", "init", "--bare", str(bare)], check=True, capture_output=True)
+    source = tmp_path / "source"
+    subprocess.run(["git", "init", str(source)], check=True, capture_output=True)
+    (source / "README.md").write_text("fixture\n", encoding="utf-8")
+    subprocess.run(["git", "-C", str(source), "add", "README.md"], check=True)
+    subprocess.run(["git", "-C", str(source), "-c", "user.name=test", "-c", "user.email=test@example.invalid", "commit", "-m", "fixture"], check=True, capture_output=True)
+    base = subprocess.check_output(["git", "-C", str(source), "rev-parse", "HEAD"], text=True).strip()
+    executor = AuthorityGitExecutor(bare, tmp_path / "worktrees")
+    subprocess.run(["git", "-C", str(source), "push", str(bare), "HEAD:refs/heads/main"], check=True, capture_output=True)
+    assert executor.create_task_branch("refs/heads/agent/contract-test", base) == base
+    assert executor.create_task_branch("refs/heads/agent/contract-test", base) == base
+    assert executor.read_ref("refs/heads/agent/contract-test") == base
+
+
 def test_create_new_lease_is_exact_base_and_absent():
     request = WriterLeaseRequestV2(
         task_id="TASK-P0-BRIDGE-V21-DURABLE-RECONCILIATION-20260809",
@@ -75,7 +92,8 @@ def test_slash_branch_uses_paginated_collection():
 def test_http_route_contract_is_complete():
     expected = {
         "/v2/runtime", "/v2/capabilities", "/v2/governed-task",
-        "/v2/writer-lease", "/v2/commit-file", "/v2/commit-files",
+            "/v2/writer-lease", "/v2/commit-file", "/v2/commit-files",
+            "/v2/source/file",
         "/v2/job", "/v2/job/resume", "/v2/job/reconcile",
         "/v2/tag/approval-request",
         "/v2/tag/publish",

tests/test_governed_production_release_acceptance_status.py

@@ -0,0 +1,169 @@
+import importlib.util
+import json
+import sys
+from copy import deepcopy
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+
+
+MODULE_PATH = (
+    Path(__file__).parents[1]
+    / "active-runtime"
+    / "app"
+    / "governed_production_release.py"
+)
+
+
+def _load_module():
+    dependency = types.ModuleType("gitea_tag_publication")
+    for name in (
+        "GiteaTagClient",
+        "GitTagBackend",
+        "PublicationManualOwnerReviewRequired",
+        "PublicationPending",
+        "PublicationReconciliationRequired",
+        "PublicationRequest",
+        "TagPublisher",
+    ):
+        setattr(dependency, name, type(name, (), {}))
+    sys.modules["gitea_tag_publication"] = dependency
+
+    spec = importlib.util.spec_from_file_location(
+        "governed_production_release_under_test", MODULE_PATH
+    )
+    module = importlib.util.module_from_spec(spec)
+    assert spec.loader is not None
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+release_module = _load_module()
+
+
+class FakeResponse:
+    status = 200
+
+    def __init__(self, body):
+        self._payload = json.dumps(body).encode("utf-8")
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc_value, traceback):
+        return False
+
+    def read(self):
+        return self._payload
+
+
+def _health_body(binding, artifact_sha256):
+    return {
+        "status": "ok",
+        "version": binding.version,
+        "commit_oid": binding.target_oid,
+        "artifact_sha256": artifact_sha256,
+        "deployment_state": "ACTIVE",
+        "production_deployed": True,
+    }
+
+
+def _run_acceptance(result):
+    executor = object.__new__(release_module.GovernedProductionReleaseExecutor)
+    records = []
+    executor.state = SimpleNamespace(
+        record=lambda *args: records.append(args),
+    )
+    executor.consistency = lambda request: deepcopy(result)
+    return executor.acceptance({}), records
+
+
+def test_all_checks_true_preserves_health_status_and_accepts():
+    binding = release_module.ReleaseBinding()
+    artifact_sha256 = "a" * 64
+
+    with patch(
+        "urllib.request.urlopen",
+        return_value=FakeResponse(_health_body(binding, artifact_sha256)),
+    ):
+        health = release_module._health(
+            "https://example.test/health",
+            binding,
+            {"artifact_sha256": artifact_sha256},
+        )
+
+    assert health["status"] == "ok"
+    assert health["verification_status"] == "ACTIVE_VERIFIED"
+    assert health["http_status"] == 200
+
+    result, records = _run_acceptance(
+        {"status": "PASS", "production_health": health}
+    )
+    assert result["accepted"] is True
+    assert records[-1][0] == "ACCEPTED"
+
+
+@pytest.mark.parametrize(
+    ("field", "value", "artifact_sha256"),
+    [
+        ("commit_oid", "0" * 40, "a" * 64),
+        ("artifact_sha256", "b" * 64, "a" * 64),
+        ("deployment_state", "STAGING", "a" * 64),
+    ],
+    ids=["commit-mismatch", "artifact-mismatch", "deployment-not-active"],
+)
+def test_health_conflicts_keep_external_status_and_reject(field, value, artifact_sha256):
+    binding = release_module.ReleaseBinding()
+    body = _health_body(binding, artifact_sha256)
+    body[field] = value
+
+    with patch("urllib.request.urlopen", return_value=FakeResponse(body)):
+        health = release_module._health(
+            "https://example.test/health",
+            binding,
+            {"artifact_sha256": artifact_sha256},
+        )
+
+    assert health["status"] == "ok"
+    assert health["verification_status"] == "CONFLICT"
+    result, _ = _run_acceptance(
+        {"status": "PASS", "production_health": health}
+    )
+    assert result["accepted"] is False
+
+
+def test_health_unavailable_has_internal_verdict_and_rejects():
+    binding = release_module.ReleaseBinding()
+
+    with patch("urllib.request.urlopen", side_effect=TimeoutError("boom")):
+        health = release_module._health(
+            "https://example.test/health",
+            binding,
+            {"artifact_sha256": "a" * 64},
+        )
+
+    assert health["status"] == "UNAVAILABLE"
+    assert health["verification_status"] == "UNAVAILABLE"
+    assert health["error"] == "TimeoutError"
+    result, _ = _run_acceptance(
+        {"status": "PASS", "production_health": health}
+    )
+    assert result["accepted"] is False
+
+
+def test_acceptance_rejects_when_overall_check_is_not_pass():
+    result, records = _run_acceptance(
+        {
+            "status": "CONFLICT",
+            "production_health": {
+                "status": "ok",
+                "verification_status": "ACTIVE_VERIFIED",
+            },
+        }
+    )
+
+    assert result["accepted"] is False
+    assert records[-1][0] == "RECONCILIATION_REQUIRED"

tests/test_list_patches_staging_overlay.py

@@ -0,0 +1,116 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+import sys
+from pathlib import Path
+from types import ModuleType
+
+
+ROOT = Path(__file__).resolve().parents[1]
+OVERLAY = ROOT / "active-runtime" / "app" / "aios_model_api_staging_list_patches_overlay.py"
+
+
+class StubHandler:
+    def sendj(self, data, code=200):
+        self.sent = (data, code)
+        return self.sent
+
+
+def load_overlay() -> ModuleType:
+    base = ModuleType("aios_model_api_staging")
+    base.H = StubHandler
+    base.main = lambda: None
+    previous = sys.modules.get("aios_model_api_staging")
+    sys.modules["aios_model_api_staging"] = base
+    try:
+        spec = importlib.util.spec_from_file_location("list_patches_overlay_test", OVERLAY)
+        assert spec and spec.loader
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        return module
+    finally:
+        if previous is None:
+            sys.modules.pop("aios_model_api_staging", None)
+        else:
+            sys.modules["aios_model_api_staging"] = previous
+
+
+def test_overlay_keeps_legacy_keys_but_only_emits_bounded_summaries():
+    overlay = load_overlay()
+    records = [
+        {
+            "id": "oversized",
+            "branch": "agent/oversized",
+            "created_at": "2026-08-26T15:00:00Z",
+            "text": "X" * 2_000_000,
+            "body": "B" * 2_000_000,
+            "diff": "D" * 2_000_000,
+            "evidence": {"raw": "E" * 2_000_000},
+        }
+    ] + [
+        {"id": f"patch-{index:03d}", "created_at": f"2026-08-25T{index % 24:02d}:00:00Z", "description": "summary"}
+        for index in range(1, 25)
+    ]
+    handler = overlay.ListPatchesOverlayHandler.__new__(overlay.ListPatchesOverlayHandler)
+    handler.path = "/api/patch"
+    result = handler.sendj(
+        {
+            "metadata_patches": records,
+            "patches": records,
+            "authoritative_branches": [{"name": "agent/example", "oid": "a" * 40, "secret": "drop"}],
+            "orphan_metadata": records,
+            "branches_without_metadata": records,
+            "branches": [f"agent/{index}" for index in range(40)],
+            "repository_available": True,
+            "query_error": None,
+        }
+    )
+    payload, code = result
+    assert code == 200
+    assert payload["list_patches_overlay"] == "bounded-summary-v1"
+    assert payload["count"] <= overlay.PATCH_DEFAULT_LIMIT
+    assert payload["has_more"] is True
+    assert payload["next_cursor"]
+    encoded = json.dumps(payload, ensure_ascii=False).encode("utf-8")
+    assert len(encoded) <= overlay.PATCH_RESPONSE_BUDGET
+    assert all(set(item) <= {
+        "patch_id", "name", "branch", "ref", "status", "risk", "created_at", "updated_at",
+        "commit_oid", "summary", "summary_truncated",
+    } for item in payload["items"])
+    assert "body" not in json.dumps(payload, ensure_ascii=False)
+    assert len(payload["branches"]) <= overlay.PATCH_COMPAT_LIST_LIMIT
+
+
+def test_overlay_cursor_pagination_and_invalid_limit_are_deterministic():
+    overlay = load_overlay()
+    records = [
+        {"id": f"p-{index:02d}", "created_at": f"2026-08-26T{index:02d}:00:00Z"}
+        for index in range(1, 26)
+    ]
+    first = overlay._page(records, {"limit": ["1"]})
+    second = overlay._page(records, {"limit": ["1"], "cursor": [first["next_cursor"]]})
+    assert first["count"] == second["count"] == 1
+    assert first["items"][0]["patch_id"] != second["items"][0]["patch_id"]
+    assert first["has_more"] and second["has_more"]
+    for value in ("0", "101", "not-an-int"):
+        try:
+            overlay._page(records, {"limit": [value]})
+        except ValueError as exc:
+            assert str(exc) == "invalid_limit"
+        else:
+            raise AssertionError("invalid limit accepted")
+    try:
+        overlay._page(records, {"limit": ["1"], "cursor": ["bad"]})
+    except ValueError as exc:
+        assert str(exc) == "invalid_cursor"
+    else:
+        raise AssertionError("invalid cursor accepted")
+
+
+def test_overlay_delegates_non_patch_routes_unchanged():
+    overlay = load_overlay()
+    handler = overlay.ListPatchesOverlayHandler.__new__(overlay.ListPatchesOverlayHandler)
+    handler.path = "/api/health"
+    result = handler.sendj({"status": "ok"}, 200)
+    assert result == ({"status": "ok"}, 200)

tests/test_minimum_autonomous_loop.py

@@ -0,0 +1,77 @@
+from __future__ import annotations
+
+import base64
+import json
+from pathlib import Path
+import subprocess
+import sys
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
+
+from aios_authority_git_executor import AuthorityGitError, AuthorityGitExecutor
+from aios_chatgpt_bridge_v2 import OPERATION_REQUIRED_FIELDS, operation_contracts
+from scoped_lease_store import ScopedLeaseStore, ScopedLeaseError
+
+
+def _fixture_repo(tmp_path: Path) -> tuple[Path, str]:
+    bare = tmp_path / "repo.git"
+    source = tmp_path / "source"
+    subprocess.run(["git", "init", "--bare", str(bare)], check=True, capture_output=True)
+    subprocess.run(["git", "init", str(source)], check=True, capture_output=True)
+    (source / "README.md").write_text("fixture\n", encoding="utf-8")
+    subprocess.run(["git", "-C", str(source), "add", "README.md"], check=True)
+    subprocess.run(
+        ["git", "-C", str(source), "-c", "user.name=test", "-c", "user.email=test@example.invalid", "commit", "-m", "fixture"],
+        check=True, capture_output=True,
+    )
+    oid = subprocess.check_output(["git", "-C", str(source), "rev-parse", "HEAD"], text=True).strip()
+    subprocess.run(["git", "-C", str(source), "push", str(bare), "HEAD:refs/heads/main"], check=True, capture_output=True)
+    return bare, oid
+
+
+def test_read_repository_file_is_bounded_and_ref_scoped(tmp_path):
+    bare, oid = _fixture_repo(tmp_path)
+    executor = AuthorityGitExecutor(bare, tmp_path / "worktrees")
+    result = executor.read_file("main", "README.md", 1024)
+    assert result["resolved_commit_oid"] == oid
+    assert base64.b64decode(result["content_base64"]) == b"fixture\n"
+    assert result["read_only"] is True
+    with pytest.raises(AuthorityGitError, match="SOURCE_PATH_INVALID"):
+        executor.read_file("main", "../README.md", 1024)
+    with pytest.raises(AuthorityGitError, match="SOURCE_FILE_TOO_LARGE"):
+        executor.read_file("main", "README.md", 1)
+    with pytest.raises(AuthorityGitError, match="SOURCE_REF_SCOPE_DENIED"):
+        executor.read_file("refs/remotes/origin/main", "README.md", 1024)
+
+
+def test_runtime_and_published_contract_keep_read_and_commit_fields_explicit():
+    contracts = operation_contracts()
+    assert set(OPERATION_REQUIRED_FIELDS["readRepositoryFile"]) == {"repository", "ref", "path", "max_bytes"}
+    assert contracts["commitFilesGoverned"]["required_fields"] == list(OPERATION_REQUIRED_FIELDS["commitFilesGoverned"])
+    assert "files" in contracts["commitFilesGoverned"]["required_fields"]
+
+
+def test_scoped_lease_is_idempotent_and_rejects_cross_binding(tmp_path):
+    store = ScopedLeaseStore(tmp_path / "leases.sqlite3")
+    request = {
+        "schema": "aios.task-writer-lease.v2",
+        "task_id": "task-min-loop",
+        "repository": "aios/aios",
+        "branch_mode": "CONTINUE_EXISTING",
+        "base_oid": "a" * 40,
+        "expected_branch_oid": "a" * 40,
+        "target_branch": "agent/min-loop",
+        "generation": 1,
+        "lease_seconds": 60,
+    }
+    first, created = store.acquire(request)
+    assert created is True and first["state"] == "ACTIVE"
+    replay, created = store.acquire(request)
+    assert created is False and replay["lease_key"] == first["lease_key"]
+    conflict = dict(request, expected_branch_oid="b" * 40)
+    with pytest.raises(ScopedLeaseError, match="LEASE_BINDING_CONFLICT"):
+        store.acquire(conflict)
+

versions/V2R2C1.json

@@ -0,0 +1,21 @@
+{
+  "approval_plan_id": "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e",
+  "artifact_sha256": "ab4ae257346c82863f05abf5e309381a1c86612957608c3a4f4ab5cc9233f052",
+  "deployment_state": "ACTIVE",
+  "enabled": true,
+  "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
+  "peeled_target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
+  "production_deployed": true,
+  "production_port": 18927,
+  "production_service": "aios-v2r1c7-production.service",
+  "registered": true,
+  "repository": "aios/aios",
+  "schema": "aios.production-registry.v2",
+  "status": "PRODUCTION_DEPLOYED",
+  "tag": "V2R2C1",
+  "tag_object": "07fc2746b688f5f243f29b39de39f32edc3dd9d2",
+  "tag_oid": "07fc2746b688f5f243f29b39de39f32edc3dd9d2",
+  "target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
+  "updated_at": "2026-08-09T09:13:13Z",
+  "version": "V2R2C1"
+}