result(openclaw): close isolated worktree migration

.agent/results/openclaw/RESULT-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md

@@ -0,0 +1,95 @@
+# GitOps 独立 Worktree 与统一运行身份迁移结果
+
+```yaml
+status: BLOCKED
+technical_status: PASS
+task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
+created_at: 2026-07-14T23:37:42+08:00
+completed_at: 2026-07-15T06:24:00+08:00
+timezone: Asia/Shanghai
+user_action_required: false
+runtime_identity:
+  user: aiman
+  group: gitops
+  umask: "0002"
+bare_repo: /data/aios-gitops/repo.git
+worktree_root: /data/aios-gitops/worktrees
+controller_worktree: /data/aios-gitops/worktrees/controller
+services:
+  aios-gitops-model-api:
+    state: active/running
+    pid: 1254370
+    user: aiman
+    group: gitops
+    umask: "0002"
+    working_directory: /data/aios-gitops/worktrees/controller
+    health_http_code: 200
+  aios-autonomous-controller: inactive/dead (pre-state preserved)
+  aios-autonomous-daemon: inactive/dead (pre-state preserved)
+  aios-agent-command-watcher: inactive/dead (pre-state preserved)
+  openclaw-gateway:
+    state: active/running
+    pid: 1333116
+    user: root
+    group: gitops
+    umask: "0002"
+    working_directory: /var/lib/aios/openclaw-home
+    resumed_at: 2026-07-15T06:21:19+08:00
+    listener: 127.0.0.1:18789
+    health_http_code: 200
+    weixin_accounts_running: 4
+    weixin_last_error: null
+    identity_changed: false
+    config_or_db_mutated: false
+default_acl: PASS
+preflight: PASS
+concurrency_test:
+  status: PASS
+  run_id: 20260715T061051UTC8
+  openclaw_branch: task/openclaw/TASK-WORKTREE-CONCURRENCY-OPENCLAW-20260715T061051UTC8
+  openclaw_commit: dbe9284a49bccb664d042789b3deb3b21669ea0f
+  openclaw_interval_ns: "[1784067525001763595,1784067525404170029]"
+  chatgpt_branch: task/chatgpt/TASK-WORKTREE-CONCURRENCY-CHATGPT-20260715T061051UTC8
+  chatgpt_commit: fe85f051655afbf1e3ee69496f51f2ea64dc1100
+  chatgpt_interval_ns: "[1784067525005911896,1784067525404756753]"
+  overlap_ns: 398258133
+  push_mode: non-force
+  permission_denied_count: 0
+  untracked_overwrite_count: 0
+  git_lock_collision_count: 0
+  openclaw_commit_push: PASS
+  chatgpt_commit_push: PASS
+  deep_directory_acl_inheritance: PASS
+  shared_workspace_branch_switches: 0
+owner_notifications:
+  received_message_id: null
+  terminal_message_id: null
+  received_status: NOT_SENT
+  terminal_status: NOT_SENT
+  gate_status: BLOCKED
+  reason: current operator directive prohibited WeChat; no safe verifiable target/message_id evidence exists
+rollback:
+  triggered: false
+  source: /data/aios-gitops/workspace
+  source_head: b05eb1babe9c657e8776c09eec71302166902cc3
+  source_branch: task/codex/gitops-isolated-worktree-migration-20260715T001652UTC8
+  source_status_sha256_before: dd4c4d4e23faeda7f097bd9eadc24112be9da1c6b564a1682b4148061fe8d5f2
+  source_status_sha256_after: dd4c4d4e23faeda7f097bd9eadc24112be9da1c6b564a1682b4148061fe8d5f2
+remaining_risks:
+  - Mandatory Owner notification evidence is absent; overall PASS is prohibited.
+  - Two invalid concurrency attempts are retained as audit evidence and are not acceptance runs.
+next_step: Owner may explicitly waive the notification gate or authorize a verifiable notification; the technical migration does not require rerun.
+```
+
+## 技术执行证据
+
+- 实际 Git 写入者为 `aios-gitops-model-api.service`。迁移前为 active/running、PID `621772`；安装 canonical identity 与 controller workdir drop-in 后，已恢复为 active/running、PID `1254370`，`aiman:gitops`、`UMask=0002`、controller worktree、`/health=200`。
+- 四个写入服务的 `92-runtime-identity.conf` 均为 `root:root 0644`，SHA256 均为 `e37651f9e98869bcc0a295577ca240be0950214abbccfc9f94182bebebaf99c4`，与 task commit 中 canonical 文件一致。model-api 的 `93-controller-workdir.conf` SHA256 为 `d0a6ac1cbe48abf63a045eb2078c4582a3d05604e6821f765ad15587f5cc2613`。
+- Gateway 未参与 Git writer identity 变更；迁移窗口内释放生产运行占用，验收后按原 identity 恢复。当前 active/running，18789 监听，`/health=200`，4 个 Weixin account running 且 `lastError=null`；未改 gateway config/DB。
+- bare repo 与 worktree 根为 `aiman:gitops`、目录 `2775`、setgid/default ACL 继承有效。修复的 1 个 root-owned 目录与 2 个文件仅变更属主；两文件 SHA256 保持 `d83b843fd54eccfaf68a43fbe18e1c61542eeb17cc957979c04fa0e5c8dce126`、`7f58e4f7de5c72a5fdc88a56eee40aad6fa3047bc48e9b7e5a6d14f2692cfa63`，worktrees 内 root-owned remaining 为 0。
+- 有效并发轮次 `20260715T061051UTC8` 由两个预启动 barrier worker 在同一 `execute_at_epoch` 执行。两条 commit+non-force push 区间真实重叠 `398258133 ns`；两侧 local OID 与 Gitea OID 一致，各自仅提交 3 个文件、worktree clean、深层 ACL PASS，权限拒绝/未跟踪覆盖/Git lock 均为 0。
+- shared workspace 未切分支、未清理、未 stash、未提交；HEAD、branch 与 NUL-delimited `status --porcelain=v1 -z -uall` 哈希前后完全一致。
+
+## 终态判定
+
+技术迁移与并发硬门均为 PASS；但任务原文要求收到任务与终态均提供可验证 Owner 微信 `message_id`。当前操作指令明确禁止 WeChat，且不存在可安全验证的 target/message_id，因此不伪造通知，整体状态按强制门保守记为 BLOCKED。