feat(gitops): implement integration refresh provisioner

.gitleaks.toml

@@ -1,10 +0,0 @@
-title = "AIOS repository secret scan policy"
-
-[extend]
-useDefault = true
-
-[allowlist]
-description = "Exact non-secret Task Admission test idempotency fixture in the historical PR commit"
-condition = "AND"
-paths = ['''tests/test_task_admission_bootstrap_http\.py$''']
-regexes = ['''idempotency-1''']

AGENT_DEPLOYMENT_REQUIREMENTS.md

@@ -1,486 +0,0 @@
-# Agent Production Deployment Requirements
-
-## Status entering deployment
-
-```yaml
-code_development: COMPLETED
-repository_commit: NOT_CREATED
-production_deployment: NOT_STARTED
-reason_repository_commit_missing:
-  current ChatGPT GitOps runtime has AIOS_GITOPS_WRITES_ENABLED=false
-```
-
-The code bundle is an input artifact. The Agent must place it on a non-main
-integration branch, review it, run acceptance tests, merge it through protected
-main and deploy the API adapter. The Agent must not regenerate or materially
-rewrite the supplied implementation without recording the new diff and tests.
-
-## Frozen production state
-
-Before any change, verify:
-
-```yaml
-main_oid: 875d41c3101093149414292067fd700dc214d4d3
-
-V2R1C5:
-  tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-  peeled_target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-  baseline_version: V2R1C5
-  baseline_status: PRODUCTION_DEPLOYED
-  target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-  evidence_closure_oid: 5e2cf8276f5093f3352b9a3252c701a44c5ab807
-```
-
-If authoritative `main` no longer equals the approved base OID, stop with
-`MANUAL_OWNER_REVIEW_REQUIRED / AUTHORIZED_BASE_OID_DRIFT`. Do not silently
-rebase the bundle onto a different base.
-
-## Bootstrap sequence — no additional Owner interaction
-
-Use the following order so that the approved V2R1C6 base OID remains valid and
-the bridge does not create its own authorization deadlock:
-
-1. Verify the supplied archive/patch SHA-256.
-2. Install the bundle into a temporary root-owned staging directory outside the
-   Git worktrees.
-3. Start a localhost-only temporary instance of
-   `aios_authorized_task_writer_api.py` on a dedicated port or Unix socket.
-4. Bind it to the existing authenticated Owner registry and the exact
-   `writer:provision` scope. Do not expose it through the public gateway.
-5. Execute the live V2R1C6 provisioning request while `main` still equals
-   `875d41c3101093149414292067fd700dc214d4d3`.
-6. Verify `READY_FOR_CODE_AUTHORING`, the exact branch OID, writer scope and
-   negative policy tests.
-7. Use the newly created scoped writer to commit this reviewed bundle onto:
-   `agent/v2r1c6-mainline-reconciliation-20260805`.
-8. Stop and remove the temporary bootstrap service and revoke its temporary
-   runtime credential. Preserve its signed grant receipt and audit logs.
-9. Open a protected PR from the V2R1C6 branch. Deploy the permanent bridge only
-   from the reviewed merge commit.
-
-The temporary service is a control-plane bootstrap, not a production release.
-It must retain:
-
-```yaml
-listen_scope: localhost_only
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-This order avoids asking the Owner to approve a second base OID merely because
-the bridge implementation itself advanced `main`.
-
-### Alternative platform-maintenance path
-
-If policy prohibits a temporary localhost bootstrap service, use an existing
-Owner-approved platform-maintenance executor to create:
-
-```yaml
-branch: patch/owner-authorization-writer-bridge-20260806
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-direct_main_push: false
-force_push: false
-tag_write: false
-baseline_write: false
-production_deploy_during_integration: false
-```
-
-Merging that branch before V2R1C6 provisioning changes the authoritative base
-OID. In that alternative only, a new exact Owner base-OID amendment is required.
-The Agent must never substitute the newer `main` OID automatically.
-
-## Files to install on the branch
-
-Copy with the same relative paths:
-
-```text
-active-runtime/app/authorized_task_writer_provisioning.py
-active-runtime/app/aios_authorized_task_writer_api.py
-docs/gitops/authorized-task-writer-provisioning.md
-docs/gitops/openapi-authorized-task-writer-fragment.yaml
-deploy/systemd/aios-gitops-model-api-authorized-writer-bridge.conf.example
-scripts/smoke_authorized_task_writer_provisioning.py
-tests/test_authorized_task_writer_provisioning.py
-```
-
-Merge the OpenAPI fragment into:
-
-```text
-docs/gitops/openapi-chatgpt-actions.yaml
-```
-
-The final schema must expose:
-
-```yaml
-operationId: provisionAuthorizedTaskWriter
-path: POST /api/task-writer/provision-authorized
-x-openai-isConsequential: true
-```
-
-Do not deploy the fragment as a second standalone OpenAPI document.
-
-## Required review of existing API integration
-
-The adapter expects the existing API handler to provide:
-
-```python
-handler.need(scope)
-handler.body()
-handler.sendj(value, status=200)
-api.H.do_POST
-api.main()
-```
-
-Confirm these contracts against the branch before merge. If the live API has a
-different authentication object shape, make the smallest adapter-only change
-and rerun every test. The core provisioning policy must remain unchanged.
-
-The API authorization registry must grant `writer:provision` only to the
-authenticated Owner role. Agents and ordinary writer tokens must not receive
-this scope.
-
-## Privilege boundary
-
-The API service must remain non-root.
-
-Install a root-owned sudoers rule that allows the API service identity to run
-only these exact commands with `sudo -n --`:
-
-```text
-/usr/local/libexec/aios-grant-signer-adapter
-/usr/local/libexec/aios-grant-validator
-/usr/local/libexec/aios-task-writer-provisioner
-```
-
-Do not allow:
-
-```text
-/bin/sh
-/bin/bash
-/usr/bin/env
-/usr/bin/git
-wildcard executable paths
-SETENV
-arbitrary environment preservation
-```
-
-The governed tools themselves must validate their `--grant-dir` and
-`--result-json` paths. Their binaries must be root-owned, non-symlink, regular,
-executable and not group/world writable.
-
-The signer must access its private signing material only through a runtime
-secret reference. No signing key or token may enter Git, API output, the
-provisioning receipt or systemd environment text.
-
-## Runtime paths and permissions
-
-Create:
-
-```text
-/var/lib/aios-gitops/authorized-writer-bridge
-/var/lib/aios-gitops/authorized-writer-bridge/receipts
-/var/lib/aios-gitops/authorized-writer-bridge/locks
-```
-
-Required properties:
-
-```yaml
-owner: API service identity
-mode: "0700"
-symlink: false
-persistent: true
-```
-
-The directory contains redacted receipts only. Temporary signed grant
-directories are deleted after success or failure.
-
-## Required staging environment
-
-Configure the API service:
-
-```text
-AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
-AIOS_GITOPS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
-AIOS_GITOPS_AUTHORIZED_WRITER_STATE_ROOT=/var/lib/aios-gitops/authorized-writer-bridge
-AIOS_GITOPS_GRANT_SIGNER_ADAPTER=/usr/local/libexec/aios-grant-signer-adapter
-AIOS_GITOPS_GRANT_VALIDATOR=/usr/local/libexec/aios-grant-validator
-AIOS_GITOPS_TASK_WRITER_PROVISIONER=/usr/local/libexec/aios-task-writer-provisioner
-AIOS_GITOPS_OWNER_PROVISION_SCOPE=writer:provision
-AIOS_GITOPS_GOVERNED_USE_SUDO=true
-AIOS_GITOPS_SUDO_PATH=/usr/bin/sudo
-```
-
-Use `aios_authorized_task_writer_api.py` as the API entrypoint. It delegates
-all pre-existing routes and adds only the new endpoint.
-
-## Pre-merge tests
-
-Run from the repository root:
-
-```bash
-python3 -m unittest -v tests/test_authorized_task_writer_provisioning.py
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/aios_authorized_task_writer_api.py
-```
-
-Required result:
-
-```yaml
-unit_tests:
-  total: 9
-  failures: 0
-  errors: 0
-smoke: PASS
-py_compile: PASS
-```
-
-Also run all existing GitOps API and isolated writer tests affected by:
-
-```text
-aios_chatgpt_actions_api
-aios_isolated_writer_api
-isolated_writer_authz
-isolated_writer_token_registry
-single_owner_governance
-OpenAPI schema validation
-```
-
-Any regression blocks merge.
-
-## Staging API acceptance
-
-### Negative authentication
-
-An Agent or non-Owner credential calling the endpoint must receive:
-
-```yaml
-http_status: 403
-error: OWNER_AUTHORIZATION_REQUIRED
-```
-
-### Negative scope tests
-
-Requests enabling any of the following must be denied before signer execution:
-
-```text
-production_change_authorized=true
-tag_change_authorized=true
-baseline_change_authorized=true
-main_write_authorized=true
-allowed_operations containing tag/main/baseline/admin operations
-missing required denied operation
-one_time_use=false
-expiry over 1800 seconds
-```
-
-### Drift and conflict tests
-
-Verify:
-
-```yaml
-wrong_base_oid:
-  http_status: 409
-  error: AUTHORIZED_BASE_OID_DRIFT
-
-existing_unreceipted_target_branch:
-  http_status: 409
-  error: EXISTING_BRANCH_OID_CONFLICT
-```
-
-### Governed tool failures
-
-Independently inject and verify fail-closed behavior for:
-
-```text
-signer unavailable
-signer signature absent
-validator signature_valid=false
-validator signer_trusted=false
-validator plan expired
-provisioner grant_consumed=false
-provisioner writer scope enables main/tag/baseline/force push
-any required negative policy test false
-```
-
-None may create or modify a Git ref.
-
-## Live V2R1C6 provisioning request
-
-After protected merge and API deployment, authenticate as the Owner and submit
-exactly:
-
-```json
-{
-  "task_id": "V2R1C6_TASK_SCOPED_WRITER_PROVISIONING",
-  "repository": "aios/aios",
-  "base_ref": "refs/heads/main",
-  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
-  "target_branch": "agent/v2r1c6-mainline-reconciliation-20260805",
-  "owner_authorization_reference": "chat-owner-authorization:v2r1c6:20260806",
-  "one_time_use": true,
-  "expires_in_seconds": 900,
-  "production_change_authorized": false,
-  "tag_change_authorized": false,
-  "baseline_change_authorized": false,
-  "main_write_authorized": false,
-  "allowed_operations": [
-    "create_worktree",
-    "create_target_branch_if_absent",
-    "commit_to_target_branch",
-    "push_target_branch"
-  ],
-  "denied_operations": [
-    "direct_main_push",
-    "force_push",
-    "tag_create",
-    "tag_update",
-    "tag_delete",
-    "branch_delete",
-    "repository_admin",
-    "baseline_write",
-    "production_deploy",
-    "production_marker_write",
-    "history_rewrite"
-  ]
-}
-```
-
-This request must be executed by the localhost-only bootstrap instance before
-the bridge code advances `main`. The endpoint must never infer “current main”.
-
-If the Agent chooses the alternative merge-first path, it must stop after the
-merge and obtain an exact Owner amendment for the new merge OID. It must not
-silently replace the approved OID.
-
-## Success response
-
-Require:
-
-```yaml
-status: READY_FOR_CODE_AUTHORING
-grant_consumed: true
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-branch_oid: <exact amended authorized base OID>
-base_oid: <same exact OID>
-main_unchanged: true
-
-writer_scope:
-  workspace_role: task-scoped-isolated-writer
-  writes_enabled: true
-  allowed_branch: agent/v2r1c6-mainline-reconciliation-20260805
-  allowed_base_oid: <exact amended authorized base OID>
-  allowed_routes:
-    - POST /api/commit-file
-  allow_main_write: false
-  allow_tag_write: false
-  allow_baseline_write: false
-  allow_force_push: false
-```
-
-All seven negative policy results must be true.
-
-Submit the identical request a second time. It must return the same grant and
-branch attestation with:
-
-```yaml
-idempotent: true
-```
-
-It must not run the provisioner again.
-
-## Production postchecks
-
-After API deployment and writer provisioning, independently verify:
-
-```yaml
-existing_routes_regression: PASS
-new_endpoint: PASS
-main_ref: expected reviewed merge commit
-V2R1C5_tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-V2R1C5_peeled_target: aa60e891547abd7e215af7cf2bf3f21fd23541da
-V2R1C5_baseline_unchanged: true
-new_release_tag_created: false
-production_baseline_changed: false
-```
-
-The deployment of this control-plane bridge does not authorize a V2R1C6
-production release. It only enables scoped code authoring.
-
-## Rollback
-
-If the new API route fails:
-
-1. Stop accepting new provisioning calls.
-2. Restore the previous API entrypoint.
-3. Restart and verify all existing routes.
-4. Preserve receipts and logs.
-5. Revoke any task writer capability already minted.
-6. Do not delete a branch or rewrite a tag.
-7. Revert the protected-main bridge commit through an ordinary reviewed revert
-   PR if source rollback is required.
-
-## Required final Agent report
-
-```yaml
-STATUS: COMPLETED | PARTIALLY_COMPLETED | BLOCKED | FAILED
-
-INTEGRATION:
-  branch:
-  commit:
-  protected_pr:
-  merge_commit:
-  files_changed:
-
-TESTS:
-  unit:
-  smoke:
-  py_compile:
-  regression:
-  fault_injection:
-
-DEPLOYMENT:
-  service:
-  entrypoint:
-  runtime_status:
-  endpoint_status:
-  rollback_verified:
-
-PROVISIONING:
-  owner_authorization_reference:
-  approval_plan_id:
-  grant_id:
-  grant_digest_sha256:
-  signing_key_identity:
-  branch:
-  branch_oid:
-  workspace_path:
-  grant_consumed:
-  idempotent_replay:
-
-CONSISTENCY:
-  main_oid:
-  V2R1C5_tag_oid:
-  V2R1C5_peeled_target_oid:
-  baseline_version:
-  baseline_changed:
-  tags_changed:
-
-SECRETS:
-  runtime_secret_reference_used:
-  plaintext_secret_logged:
-  plaintext_secret_committed:
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```

AGENT_OWNER_AUTHORIZATION_BROKER_DEPLOYMENT.md

@@ -1,401 +0,0 @@
-# Agent Deployment Requirements: Owner Authorization Broker V2
-
-## Objective
-
-Deploy the audited Owner Authorization Broker that closes the bootstrap gap
-without issuing a new general-purpose Owner credential and without modifying
-`/data/aios-gitops/runtime/secrets/gitops.tokens`.
-
-The broker reuses one existing, non-wildcard Owner credential only to
-authenticate the Owner identity through one pre-existing exact scope. It then
-records an immutable task authorization event and directly invokes the
-existing signed grant -> validator -> one-shot provisioner chain.
-
-Production deployment of V2R1C6 is **not** authorized by this task.
-
-## Fixed bindings
-
-```yaml
-task_id: V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
-repository: aios/aios
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch: agent/v2r1c6-mainline-reconciliation-20260805
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-The existing V2R1C5 objects are frozen:
-
-```yaml
-tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-peeled_target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-baseline_version: V2R1C5
-baseline_status: PRODUCTION_DEPLOYED
-```
-
-## 1. Package verification
-
-Verify `MANIFEST.sha256` before installation. Reject any mismatch.
-
-Run:
-
-```bash
-python3 -m unittest -v \
-  tests/test_authorized_task_writer_provisioning.py \
-  tests/test_owner_authorization_broker.py
-
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 scripts/smoke_owner_authorization_broker.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/aios_authorized_task_writer_api.py \
-  active-runtime/app/owner_authorization_broker.py \
-  active-runtime/app/aios_owner_authorization_broker_api.py
-```
-
-All checks must pass.
-
-## 2. Existing Owner credential selection
-
-Read only the non-secret registry metadata. Select one existing credential
-that satisfies all of the following:
-
-```yaml
-role: owner
-wildcard_scope: false
-account: exact known Owner identity
-contains_exact_intake_scope: true
-```
-
-Use one existing exact scope such as `commit:create` or `file:write`. Prefer
-the narrowest scope already assigned to the intended Owner.
-
-Do not:
-
-- use the historical wildcard Owner credential;
-- add `writer:provision` to any bearer token;
-- create or modify a bearer credential;
-- print, copy or commit bearer-token material.
-
-Record only:
-
-```yaml
-owner_account: <non-secret account>
-credential_id: <non-secret ID, when available>
-intake_scope: <one exact existing scope>
-scope_readback_available: true|false
-```
-
-If `handler.need()` returns the exact scope set, configure the Owner account
-allowlist and leave the credential ID allowlist empty.
-
-If scope metadata is not returned, configure the exact non-secret credential
-ID allowlist. If neither exact scope metadata nor a stable non-secret
-credential ID can be proven, stop:
-
-```yaml
-STATUS: BLOCKED
-REASON: OWNER_CREDENTIAL_SCOPE_NOT_PROVABLE
-```
-
-## 3. Staging installation
-
-Install the four application modules in a root-owned staging directory:
-
-```text
-authorized_task_writer_provisioning.py
-aios_authorized_task_writer_api.py
-owner_authorization_broker.py
-aios_owner_authorization_broker_api.py
-```
-
-The directory and files must not be group/world writable.
-
-Prepare environment values:
-
-```yaml
-AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED: "true"
-AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES: <one exact existing scope>
-AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_IDENTITIES: <exact owner account>
-AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_CREDENTIAL_IDS: <exact ID or empty>
-AIOS_GITOPS_OWNER_AUTHORIZATION_MAX_EXPIRY_SECONDS: "900"
-AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT:
-  /var/lib/aios-gitops/owner-authorization-broker
-```
-
-Use the existing signer, validator and provisioner paths. Do not change their
-root governance configuration or disable signature checks.
-
-Start a localhost-only staging instance on a temporary port. Do not replace
-the production service yet.
-
-## 4. Authentication fail-closed tests
-
-The staging endpoint is:
-
-```text
-POST /api/governance/owner-authorizations
-```
-
-Required tests:
-
-```yaml
-unauthenticated:
-  expected: 401
-
-wrong_role:
-  expected: 403
-
-wrong_scope:
-  expected: 403
-
-wildcard_owner:
-  expected: 403
-  error: WILDCARD_OWNER_CREDENTIAL_REJECTED
-
-unallowlisted_owner:
-  expected: 403
-  error: OWNER_IDENTITY_NOT_ALLOWED
-
-production_capability_true:
-  expected: 403
-  error: PRODUCTION_CAPABILITY_REJECTED
-```
-
-A connection failure, 404 or 500 is not an authorization-policy pass.
-
-## 5. Formal provisioning request
-
-Use the selected existing non-wildcard Owner credential through its runtime
-secret reference. Never place the bearer token in the request body, command
-line, shell history, output report or Git.
-
-Request:
-
-```json
-{
-  "action": "AUTHORIZE_TASK_WRITER_PROVISIONING",
-  "task_id": "V2R1C6_TASK_SCOPED_WRITER_PROVISIONING",
-  "repository": "aios/aios",
-  "base_ref": "refs/heads/main",
-  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
-  "target_branch": "agent/v2r1c6-mainline-reconciliation-20260805",
-  "one_time_use": true,
-  "expires_in_seconds": 900,
-  "production_change_authorized": false,
-  "tag_change_authorized": false,
-  "baseline_change_authorized": false,
-  "main_write_authorized": false,
-  "allowed_operations": [
-    "create_worktree",
-    "create_target_branch_if_absent",
-    "commit_to_target_branch",
-    "push_target_branch"
-  ],
-  "denied_operations": [
-    "direct_main_push",
-    "force_push",
-    "tag_create",
-    "tag_update",
-    "tag_delete",
-    "branch_delete",
-    "repository_admin",
-    "baseline_write",
-    "production_deploy",
-    "production_marker_write",
-    "history_rewrite"
-  ]
-}
-```
-
-The Owner authorization reference is generated by the broker. The caller must
-not submit or invent one.
-
-Expected result:
-
-```yaml
-status: READY_FOR_CODE_AUTHORING
-owner_authorization_event_id: generated
-owner_authorization_reference: generated
-owner_authorization_digest_sha256: generated
-owner_authorization_consumed: true
-approval_plan_id: generated
-grant_digest_sha256: generated
-grant_consumed: true
-
-branch_oid: 875d41c3101093149414292067fd700dc214d4d3
-
-writer_scope:
-  workspace_role: task-scoped-isolated-writer
-  writes_enabled: true
-  allowed_branch: agent/v2r1c6-mainline-reconciliation-20260805
-  allowed_base_oid: 875d41c3101093149414292067fd700dc214d4d3
-  allow_main_write: false
-  allow_tag_write: false
-  allow_baseline_write: false
-  allow_force_push: false
-```
-
-## 6. Independent post-provisioning verification
-
-Verify the Authority ref:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git rev-parse \
-  refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-It must equal:
-
-```text
-875d41c3101093149414292067fd700dc214d4d3
-```
-
-Verify `main` remains unchanged, V2R1C5 tag object and peeled target remain
-unchanged, and the Production Baseline remains V2R1C5.
-
-Verify the broker audit event under:
-
-```text
-/var/lib/aios-gitops/owner-authorization-broker/events/
-```
-
-Requirements:
-
-```yaml
-status: CONSUMED
-wildcard_scope_used: false
-grant_consumed: true
-permissions:
-  directory: "0700"
-  json_files: "0600"
-```
-
-Do not return bearer-token material in the report.
-
-## 7. Commit the broker through the new writer
-
-After `READY_FOR_CODE_AUTHORING`, use only the writer's
-`POST /api/commit-file` route to put this code bundle on:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-Commit the bridge and broker as separate intentional commits when practical:
-
-1. Owner-authorized task-writer bridge.
-2. Audited Owner authorization broker and deployment docs.
-
-Do not merge to `main` directly. Create a protected PR after branch commits
-and tests are complete.
-
-## 8. Permanent service deployment
-
-Only after protected review and merge:
-
-1. Install the reviewed files from the merge commit.
-2. Apply a reviewed systemd drop-in based on the provided example.
-3. Start the wrapper entrypoint:
-   `aios_owner_authorization_broker_api.py`.
-4. Verify all existing API routes still work.
-5. Verify the broker remains localhost/reverse-proxy constrained as intended.
-6. Re-run authentication and policy tests.
-7. Remove the temporary staging instance.
-
-This permanent bridge deployment does not authorize a V2R1C6 production tag,
-Baseline update or application deployment.
-
-## 9. Fail-closed conditions
-
-Stop with `BLOCKED` for any of the following:
-
-- Authority `main` no longer equals the fixed base OID.
-- Target branch exists at a different OID.
-- Only a wildcard Owner credential can authenticate.
-- Exact credential scope cannot be proven.
-- Owner identity is not explicitly allow-listed.
-- Signer, validator or provisioner self-test fails.
-- Grant is not marked one-time and consumed.
-- Writer allows main, tag, Baseline, force-push or branch-delete operations.
-- Audit event contains sensitive material.
-- V2R1C5 tag or Baseline changes.
-
-## 10. Required Agent result
-
-```yaml
-STATUS: READY_FOR_CODE_AUTHORING | BLOCKED | FAILED
-
-PACKAGE:
-  manifest_verified:
-  unit_tests:
-  smoke_tests:
-  py_compile:
-
-OWNER_CREDENTIAL:
-  account:
-  credential_id:
-  intake_scope:
-  exact_scope_proven:
-  wildcard_used: false
-  token_logged: false
-
-BROKER:
-  staging_listener:
-  endpoint_status:
-  event_id:
-  authorization_reference:
-  authorization_digest_sha256:
-  event_consumed:
-  audit_permissions_valid:
-
-GRANT:
-  approval_plan_id:
-  grant_digest_sha256:
-  signer_identity:
-  signature_valid:
-  one_time_use:
-  consumed:
-
-BRANCH:
-  name:
-  oid:
-  base_oid:
-  ref_exists:
-  worktree_path:
-  worktree_clean:
-
-WRITER:
-  status:
-  writes_enabled:
-  allowed_branch:
-  allowed_base_oid:
-  allowed_routes:
-  main_write_denied:
-  tag_write_denied:
-  baseline_write_denied:
-  force_push_denied:
-
-POSTCHECK:
-  main_unchanged:
-  V2R1C5_tag_unchanged:
-  baseline_unchanged:
-
-REPOSITORY_INTEGRATION:
-  commit_oids:
-  protected_pr:
-  merged:
-  permanent_bridge_deployed:
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```

AGENT_TASK_IDENTITY_OVERLAY_DEPLOYMENT.md

@@ -1,562 +0,0 @@
-# Agent execution requirements: V2R1C6 task identity overlay
-
-## Required result
-
-The Agent must return one of:
-
-- `READY_FOR_CODE_AUTHORING`
-- `BLOCKED`
-- `FAILED`
-
-The Agent may not report success until the task branch, isolated worktree and
-task writer are independently verified.
-
-This stage is **not** a production deployment. It must not modify `main`,
-V2R1C5, tags, Registry, Production Baseline or production services.
-
-## Fixed authority
-
-```yaml
-task_id: V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
-repository: aios/aios
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch: agent/v2r1c6-mainline-reconciliation-20260805
-owner_identity: aiman
-one_time_use: true
-maximum_ttl_seconds: 900
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-## 1. Verify package
-
-Verify the externally supplied package against the published SHA-256 values and
-then verify every entry in `MANIFEST.sha256`.
-
-Do not synthesize a missing archive. Use either the verified ZIP or TAR.GZ.
-
-Required checks:
-
-```yaml
-package_hash_match: true
-manifest_entries_match: true
-unit_tests_pass: true
-smoke_tests_pass: true
-py_compile_pass: true
-```
-
-## 2. Create root-owned staging
-
-Extract to a fresh directory such as:
-
-```text
-/var/lib/aios-gitops/staging/v2r1c6-task-identity-overlay-<nonce>
-```
-
-Requirements:
-
-```yaml
-owner: root
-group: root
-directory_mode: "0700"
-files_not_world_writable: true
-symlinks_rejected: true
-```
-
-Do not overwrite the active runtime tree.
-
-## 3. Re-run target-host tests
-
-From the staging root:
-
-```bash
-python3 -m unittest discover -s tests -v
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 scripts/smoke_owner_authorization_broker.py
-python3 scripts/smoke_task_identity_overlay.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/owner_authorization_broker.py \
-  active-runtime/app/task_identity_overlay.py \
-  active-runtime/app/aios_authorized_task_writer_api.py \
-  active-runtime/app/aios_owner_authorization_broker_api.py \
-  active-runtime/app/aios_task_identity_overlay_api.py \
-  active-runtime/app/aios_task_identity_overlay_cli.py \
-  scripts/call_task_identity_overlay.py
-```
-
-Any failure is `BLOCKED`; do not proceed.
-
-## 4. Prestart Git and production freeze checks
-
-Read from the authority repository:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git rev-parse refs/heads/main
-git --git-dir=/data/aios-gitops/repo.git \
-  show-ref --verify --quiet \
-  refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-git --git-dir=/data/aios-gitops/repo.git rev-parse refs/tags/V2R1C5
-git --git-dir=/data/aios-gitops/repo.git rev-parse 'refs/tags/V2R1C5^{}'
-```
-
-Expected:
-
-```yaml
-main_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch_exists: false
-V2R1C5_tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-V2R1C5_peeled_target: aa60e891547abd7e215af7cf2bf3f21fd23541da
-```
-
-Read Baseline and require:
-
-```yaml
-version: V2R1C5
-status: PRODUCTION_DEPLOYED
-target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-evidence_closure_oid: 5e2cf8276f5093f3352b9a3252c701a44c5ab807
-```
-
-If `main` has drifted, return:
-
-```yaml
-STATUS: MANUAL_OWNER_REVIEW_REQUIRED
-REASON: AUTHORIZED_BASE_OID_DRIFT
-```
-
-If the target branch already exists at another OID, return:
-
-```yaml
-STATUS: MANUAL_OWNER_REVIEW_REQUIRED
-REASON: EXISTING_BRANCH_OID_CONFLICT
-```
-
-Do not delete, reset or force-push the branch.
-
-## 5. Discover active secret references
-
-The overlay does not read or modify `gitops.tokens`, but its issuer must compare
-the new random secret against all active bearer secret references.
-
-Discover references without printing secret contents. At minimum include the
-currently active ChatGPT/GitOps bearer secret reference and any other bearer
-files consumed by the active API.
-
-Pass them as a comma-separated list in:
-
-```text
-AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS
-```
-
-Evidence must contain only paths and SHA-256 match counts, not token values.
-
-If active secret references cannot be enumerated, return:
-
-```yaml
-STATUS: BLOCKED
-REASON: ACTIVE_SECRET_REFERENCE_SET_UNRESOLVED
-```
-
-## 6. Install the transient systemd service
-
-Use the provided template:
-
-```text
-deploy/systemd/aios-v2r1c6-task-identity-overlay.service.example
-```
-
-Substitute only:
-
-- verified root-owned staging directory;
-- verified active secret-ref path list.
-
-Do not change task ID, repository, base OID, target branch or denied
-capabilities.
-
-The service must listen only on:
-
-```text
-127.0.0.1:19864
-```
-
-Before start, run:
-
-```bash
-systemd-analyze verify \
-  /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
-```
-
-Then:
-
-```bash
-sudo systemctl daemon-reload
-sudo systemctl start aios-v2r1c6-task-identity-overlay.service
-```
-
-Confirm:
-
-```bash
-curl --fail --silent http://127.0.0.1:19864/healthz
-```
-
-Expected:
-
-```yaml
-service: aios-task-identity-overlay
-status: active
-global_token_registry_used: false
-loopback_only: true
-```
-
-Do not expose the port externally.
-
-## 7. Issue the one-time overlay
-
-Use the root-only CLI. The authorization assertion is an audit label for this
-already approved Owner task; it must not be described as an external signed
-event.
-
-Example:
-
-```bash
-sudo env \
-  PYTHONPATH=<staging>/active-runtime/app \
-  AIOS_GITOPS_IDENTITY_OVERLAY_STATE_ROOT=/var/lib/aios-gitops/task-identity-overlays \
-  AIOS_GITOPS_IDENTITY_OVERLAY_SECRET_ROOT=/run/aios-gitops/task-identity-overlays \
-  AIOS_GITOPS_IDENTITY_OVERLAY_TASK_ID=V2R1C6_TASK_SCOPED_WRITER_PROVISIONING \
-  AIOS_GITOPS_IDENTITY_OVERLAY_OWNER_IDENTITY=aiman \
-  AIOS_GITOPS_IDENTITY_OVERLAY_BASE_REF=refs/heads/main \
-  AIOS_GITOPS_IDENTITY_OVERLAY_BASE_OID=875d41c3101093149414292067fd700dc214d4d3 \
-  AIOS_GITOPS_IDENTITY_OVERLAY_TARGET_BRANCH=agent/v2r1c6-mainline-reconciliation-20260805 \
-  AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS=<verified-secret-ref-list> \
-  python3 <staging>/active-runtime/app/aios_task_identity_overlay_cli.py \
-    issue \
-    --ttl-seconds 900 \
-    --authorization-assertion-ref owner-session:V2R1C6:approved-20260806 \
-    --operator-identity <audited-agent-identity> \
-    --result-json /run/aios-gitops/v2r1c6-overlay-issued.json
-```
-
-The result must contain:
-
-```yaml
-status: OVERLAY_ACTIVE
-idempotent: false
-overlay_id: present
-secret_ref: under /run/aios-gitops/task-identity-overlays
-expires_at: within 900 seconds
-```
-
-It must not contain a token.
-
-Verify:
-
-```yaml
-secret_file_mode: "0600"
-metadata_contains_raw_token: false
-token_hash_unique_across_configured_secret_refs: true
-```
-
-## 8. Negative tests
-
-Before the valid request:
-
-1. No Authorization header must return HTTP 401.
-2. A random wrong bearer must return HTTP 401.
-3. A request with `production_change_authorized=true` must be rejected.
-4. A request with another base OID or branch must be rejected.
-5. The valid overlay must remain `ACTIVE` after pre-auth request-validation
-   failures.
-
-Do not use the global Owner or ChatGPT bearer credential for this endpoint.
-
-## 9. Send the valid request
-
-Use:
-
-```text
-deploy/v2r1c6-task-writer-authorization-request.json
-```
-
-Use the provided client so the bearer is not placed in argv, shell history or
-logs:
-
-```bash
-sudo python3 <staging>/scripts/call_task_identity_overlay.py \
-  --secret-ref <secret_ref_from_issue_result> \
-  --request-json <staging>/deploy/v2r1c6-task-writer-authorization-request.json \
-  --url http://127.0.0.1:19864/api/governance/owner-authorizations \
-  --result-json /var/lib/aios-gitops/v2r1c6-overlay-provision-result.json
-```
-
-Required result:
-
-```yaml
-http_status: 200
-status: READY_FOR_CODE_AUTHORING
-owner_authorization_consumed: true
-grant_consumed: true
-identity_overlay_consumed: true
-identity_overlay_secret_removed: true
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-branch_oid: 875d41c3101093149414292067fd700dc214d4d3
-```
-
-The result must not include:
-
-- bearer token;
-- private key;
-- signer secret;
-- raw signature;
-- credential value.
-
-## 10. Independent acceptance
-
-Verify the branch:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git \
-  rev-parse refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-It must equal:
-
-```text
-875d41c3101093149414292067fd700dc214d4d3
-```
-
-Verify worktree evidence returned by the provisioner:
-
-```yaml
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-head_oid: 875d41c3101093149414292067fd700dc214d4d3
-detached_head: false
-worktree_clean: true
-writer_status: active
-writes_enabled: true
-allowed_routes:
-  - POST /api/commit-file
-allow_main_write: false
-allow_tag_write: false
-allow_baseline_write: false
-allow_force_push: false
-```
-
-Run policy negative tests against the task writer and require explicit policy
-denials for:
-
-- main write;
-- another branch;
-- tag create/update;
-- Baseline write;
-- force push;
-- branch delete.
-
-Network errors, 404, 500 and stopped-service failures do not count as policy
-denials.
-
-## 11. Stop and clean up the overlay
-
-After `READY_FOR_CODE_AUTHORING`:
-
-```bash
-sudo systemctl stop aios-v2r1c6-task-identity-overlay.service
-sudo systemctl disable aios-v2r1c6-task-identity-overlay.service || true
-sudo rm -f /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
-sudo systemctl daemon-reload
-```
-
-Verify:
-
-```yaml
-overlay_listener_stopped: true
-overlay_secret_removed: true
-global_token_registry_unchanged: true
-disabled_owner_record_unchanged: true
-active_chatgpt_bot_record_unchanged: true
-audit_metadata_retained: true
-```
-
-The root-owned staging directory may be retained until the code is committed,
-then removed after checksum-confirmed repository integration.
-
-## 12. Commit the developed code through the task writer
-
-Only after writer acceptance, use `POST /api/commit-file` to commit the
-verified package contents to:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-Commit in reviewable groups:
-
-1. authorized task-writer bridge;
-2. Owner authorization broker;
-3. task identity overlay;
-4. tests, docs, OpenAPI and deployment templates.
-
-Do not include:
-
-- package archives;
-- runtime tokens;
-- `/run` or `/var/lib` state;
-- test result files containing host paths;
-- secret references containing values;
-- generated credentials.
-
-Run the complete 40-test suite from the branch after commits.
-
-## 13. Protected PR
-
-Create a protected PR from:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-to:
-
-```text
-main
-```
-
-The PR must state:
-
-- this change closes Owner authorization bootstrap gaps;
-- the overlay is localhost-only and one-time;
-- the global token registry is not modified;
-- no production release is authorized;
-- V2R1C5 tag and Baseline remain unchanged.
-
-The Agent must not merge without the repository's normal protected review.
-
-## 14. Required Agent report
-
-```yaml
-STATUS:
-  READY_FOR_CODE_AUTHORING | BLOCKED | FAILED
-
-PACKAGE:
-  zip_sha256:
-  tar_gz_sha256:
-  manifest_entries:
-  manifest_matched:
-
-TESTS:
-  unit_total:
-  unit_passed:
-  smoke_bridge:
-  smoke_broker:
-  smoke_overlay:
-  py_compile:
-
-PRESTART:
-  main_oid:
-  target_branch_previously_absent:
-  V2R1C5_tag_oid:
-  V2R1C5_peeled_target:
-  baseline_unchanged:
-
-OVERLAY:
-  overlay_id:
-  status:
-  secret_ref:
-  secret_file_mode:
-  token_hash_unique:
-  global_registry_used: false
-  listener:
-  expires_at:
-  consumed:
-  secret_removed:
-
-NEGATIVE_TESTS:
-  unauthenticated_401:
-  wrong_token_401:
-  production_capability_denied:
-  wrong_base_denied:
-  wrong_branch_denied:
-
-OWNER_AUTHORIZATION:
-  event_id:
-  reference:
-  consumed:
-
-GRANT:
-  approval_plan_id:
-  grant_id:
-  grant_digest_sha256:
-  signature_valid:
-  consumed:
-
-BRANCH:
-  name:
-  oid:
-  base_oid:
-  ref_exists:
-  worktree_path:
-  worktree_clean:
-
-WRITER:
-  status:
-  writes_enabled:
-  allowed_branch:
-  allowed_base_oid:
-  allowed_routes:
-  main_write_denied:
-  tag_write_denied:
-  baseline_write_denied:
-  force_push_denied:
-
-REPOSITORY_INTEGRATION:
-  commits:
-  tests_after_commit:
-  protected_pr:
-  merged: false
-
-POSTCHECK:
-  main_unchanged:
-  V2R1C5_tag_unchanged:
-  baseline_unchanged:
-  global_token_registry_unchanged:
-  overlay_listener_stopped:
-  overlay_secret_removed:
-
-SECRETS:
-  plaintext_logged: false
-  plaintext_committed: false
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```
-
-## Fail-closed conditions
-
-Return `BLOCKED` and stop on any of:
-
-- authoritative main OID drift;
-- target branch conflict;
-- inability to enumerate active secret references;
-- secret hash collision;
-- overlay not bound to the exact task/base/branch;
-- non-loopback listener;
-- raw secret in result or logs;
-- Owner Authorization Broker event not created;
-- signer/validator/provisioner failure;
-- grant not consumed;
-- branch OID mismatch;
-- writer exposes main/tag/Baseline/force-push permissions;
-- V2R1C5 tag or Baseline changes.
-
-Never fall back to the shared `gitops-write-bot.token`, a wildcard credential,
-manual `gitops.tokens` edits or a direct Git ref write.

BUILD_RECEIPT_V2R1C7.json

@@ -1,9 +0,0 @@
-{
-  "schema": "aios.v2r1c7.engineering-build-receipt.v1",
-  "version": "V2R1C7",
-  "base_oid": "b356dec2ac5bd2a5f721aa73f8fd1902f9c65632",
-  "production_deployed": false,
-  "tag_created": false,
-  "baseline_changed": false,
-  "deployable": true
-}

MANIFEST.sha256

@@ -1,21 +0,0 @@
-bec7da1adb75bf5feaa63c60ec6d03adf15d7508742a486207033d000f72d4ff  AGENT_DEPLOYMENT_REQUIREMENTS.md
-251b46e51ce09aa2fd843bee48ef24a5608f31d24c599841f086ceb25c1a1715  README.md
-783f68ec4f00a11d43ceed536196bfedccaf6614f6db9805f7b36d24e5fa7bc2  TEST_RESULTS.json
-9208325e5b2e6f5ba6b64e000bc21d14d9f2f214e3ad33dd79857e85218fd6c2  VERSION
-c4b24b65195077716983acdc8611f705324413a74453858994ba51541957afd4  active-runtime/app/aios_authorized_task_writer_api.py
-8a1935fa098d47ac02ce51bbd9fd5fad7cf9ab9374ea3de5f630679b96681d84  active-runtime/app/authorized_task_writer_provisioning.py
-0997ab8332985c7124f334c4e49735d8833326578acc61a61a389bf792424de3  active-runtime/app/deployment_state.py
-dd3f8b1cab88e005a291f077807873c381e8ca92fe863dc05817925f0dff9613  active-runtime/app/v2r1c6_privacy_tools.py
-9e45025c41068cafdea2f360edfc4146a5459b0a6bcfbf1403206fc0161e7bac  active-runtime/app/v2r1c7_health_service.py
-c96ba560d69f6c2eb700b9f2b42a32e394dadd00dffb23bbefdb9fb3e1571c0d  deploy/aios-v2/systemd/aios-v2r1c7-production.service
-a05d4e8038fdb866ce17d4fb8a54798a268a1e8d44ff2cbc559069fa6ab2a667  deploy/systemd/aios-gitops-model-api-authorized-writer-bridge.conf.example
-a60dac51802bff67c2cfff61acdeb0a3a05d74a4f6cb47e3f78295ceb5c6acd9  docs/gitops/authorized-task-writer-provisioning.md
-2690f76452bceddda90c728278c600bcebd533db24776e2966423c5a8655e4b5  docs/gitops/openapi-authorized-task-writer-fragment.yaml
-560e5d9af8a8e2ec60ec31cf8659a7982b93ea09b7adb486b738ea2fba460d70  release-manifests/V2R1C7.json
-81a423c7814f81cb888b60a538c153e549b2be9099c881c968d55ae84efddc57  scripts/build_v2r1c7_release_artifact.py
-64c78dabffb05c8851f87b2a27c43bd1f21728dca586397d03a6bc22906a906c  scripts/probe_v2r1c7_health.py
-5419dc7de0f50908ad0ef1dac74172fce811bb7b45f314a6e1c1bb9ce618324d  scripts/rollback_v2r1c7_release.sh
-54e2845d2c3c026323ad45515e082d661e3b461feb3bfefedf5adc52db2d7b78  scripts/smoke_authorized_task_writer_provisioning.py
-32a860e28d5afc105f413d878a13fb8600fa74874dbd3bc4c031ef3efa17896a  scripts/verify_v2r1c7_release.py
-3cce2b744326fe12b89bcad3cd352c77738950964bf8519e72cb5e9c7a5dfbfc  tests/test_authorized_task_writer_provisioning.py
-8f3153c625241f60b65109eeac045e8aed7661d95f3a10f0b32ba3e0e9ac0a85  versions/V2R1C7.json

TEST_RESULTS.json

@@ -1,25 +0,0 @@
-{
-  "git_branch_created": false,
-  "git_commit_created": false,
-  "production_mutation": false,
-  "py_compile": {
-    "files": [
-      "active-runtime/app/authorized_task_writer_provisioning.py",
-      "active-runtime/app/aios_authorized_task_writer_api.py"
-    ],
-    "status": "PASS"
-  },
-  "schema": "aios.authorized-task-writer-bridge-test-report.v1",
-  "secrets_included": false,
-  "smoke": {
-    "command": "python3 scripts/smoke_authorized_task_writer_provisioning.py",
-    "status": "PASS"
-  },
-  "status": "PASS",
-  "unit_tests": {
-    "command": "python3 -m unittest -v tests/test_authorized_task_writer_provisioning.py",
-    "errors": 0,
-    "failures": 0,
-    "total": 9
-  }
-}

VERSION

@@ -1 +1 @@
-V2R1C7
+V2R1C2

active-runtime/app/agent_pull_runner.py

@@ -1,201 +0,0 @@
-"""Fail-closed Agent Pull Runner primitives for AIOS autonomy v1.
-
-The runner owns task discovery and reporting only.  It never accepts shell
-strings: executors receive argv, an allowlisted cwd and an allowlisted env.
-Durable state is intentionally small so restart recovery and duplicate
-suppression can be verified without coupling the runner to one database.
-"""
-from __future__ import annotations
-
-import json
-import os
-import random
-import shutil
-import subprocess
-import tempfile
-import time
-from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol, Sequence
-
-
-class RunnerError(RuntimeError):
-    """Raised when a runner contract would be violated."""
-
-
-@dataclass(frozen=True)
-class RunnerConfig:
-    worker_id: str
-    capabilities: tuple[str, ...] = ()
-    long_poll_seconds: int = 30
-    fallback_seconds: int = 60
-    jitter_seconds: int = 5
-    max_backoff_seconds: int = 300
-    executable_allowlist: tuple[str, ...] = ()
-    working_directory_allowlist: tuple[str, ...] = ()
-    environment_allowlist: tuple[str, ...] = ()
-
-
-@dataclass
-class RunnerState:
-    inflight: dict[str, dict[str, Any]] = field(default_factory=dict)
-    terminal: dict[str, dict[str, Any]] = field(default_factory=dict)
-
-
-class RunnerTransport(Protocol):
-    def register_worker(self, worker_id: str, capabilities: Sequence[str]) -> Mapping[str, Any]: ...
-    def heartbeat(self, worker_id: str) -> Mapping[str, Any]: ...
-    def long_poll(self, worker_id: str, timeout_seconds: int) -> Mapping[str, Any] | None: ...
-    def poll(self, worker_id: str) -> Mapping[str, Any] | None: ...
-    def claim(self, worker_id: str, task: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def renew(self, worker_id: str, task_id: str) -> Mapping[str, Any]: ...
-    def report_progress(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def report_result(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def report_evidence(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-
-
-class JsonStateStore:
-    """Atomic JSON state store for restart recovery."""
-
-    def __init__(self, path: str | os.PathLike[str]) -> None:
-        self.path = Path(path)
-
-    def load(self) -> RunnerState:
-        if not self.path.exists():
-            return RunnerState()
-        value = json.loads(self.path.read_text(encoding="utf-8"))
-        if not isinstance(value, dict):
-            raise RunnerError("runner state must be an object")
-        return RunnerState(
-            inflight=dict(value.get("inflight", {})),
-            terminal=dict(value.get("terminal", {})),
-        )
-
-    def save(self, state: RunnerState) -> None:
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        fd, name = tempfile.mkstemp(prefix=self.path.name + ".", dir=self.path.parent)
-        try:
-            with os.fdopen(fd, "w", encoding="utf-8") as handle:
-                json.dump({"inflight": state.inflight, "terminal": state.terminal}, handle, sort_keys=True)
-                handle.write("\n")
-            os.chmod(name, 0o600)
-            os.replace(name, self.path)
-        finally:
-            if os.path.exists(name):
-                os.unlink(name)
-
-
-class AgentPullRunner:
-    """Pull, claim, execute and report one task at a time."""
-
-    def __init__(
-        self,
-        config: RunnerConfig,
-        transport: RunnerTransport,
-        state_store: JsonStateStore | None = None,
-        *,
-        random_fn: Callable[[], float] = random.random,
-    ) -> None:
-        if not config.worker_id.strip():
-            raise RunnerError("worker_id is required")
-        self.config = config
-        self.transport = transport
-        self.state_store = state_store
-        self.random_fn = random_fn
-        self.state = state_store.load() if state_store else RunnerState()
-
-    def _save(self) -> None:
-        if self.state_store:
-            self.state_store.save(self.state)
-
-    def register(self) -> Mapping[str, Any]:
-        return self.transport.register_worker(self.config.worker_id, self.config.capabilities)
-
-    def heartbeat(self) -> Mapping[str, Any]:
-        return self.transport.heartbeat(self.config.worker_id)
-
-    def discovery_delay(self, failures: int) -> float:
-        failures = max(0, int(failures))
-        base = min(self.config.max_backoff_seconds, self.config.fallback_seconds * (2**failures))
-        jitter = self.random_fn() * max(0, self.config.jitter_seconds)
-        return min(self.config.max_backoff_seconds, base + jitter)
-
-    def discover_once(self) -> Mapping[str, Any] | None:
-        try:
-            task = self.transport.long_poll(self.config.worker_id, self.config.long_poll_seconds)
-        except Exception:
-            task = None
-        if task is None:
-            task = self.transport.poll(self.config.worker_id)
-        if not task:
-            return None
-        task_id = str(task.get("task_id", ""))
-        if not task_id:
-            raise RunnerError("task_id is required")
-        if task_id in self.state.terminal:
-            return {"status": "duplicate_suppressed", "task_id": task_id}
-        claimed = dict(self.transport.claim(self.config.worker_id, task))
-        self.state.inflight[task_id] = claimed
-        self._save()
-        return claimed
-
-    def renew(self, task_id: str) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.renew(self.config.worker_id, task_id)
-
-    def report_progress(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.report_progress(self.config.worker_id, task_id, payload)
-
-    def report_evidence(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.report_evidence(self.config.worker_id, task_id, payload)
-
-    def report_result(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id in self.state.terminal:
-            return {"status": "duplicate_terminal_suppressed", "task_id": task_id}
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        result = dict(self.transport.report_result(self.config.worker_id, task_id, payload))
-        self.state.terminal[task_id] = {"result": result, "reported_at": time.time()}
-        self.state.inflight.pop(task_id, None)
-        self._save()
-        return result
-
-    def recover_after_restart(self) -> list[Mapping[str, Any]]:
-        recovered: list[Mapping[str, Any]] = []
-        for task_id in tuple(self.state.inflight):
-            recovered.append(self.renew(task_id))
-        return recovered
-
-    def validate_execution(self, argv: Sequence[str], cwd: str | os.PathLike[str], env: Mapping[str, str]) -> None:
-        if not argv or any(not isinstance(item, str) or not item for item in argv):
-            raise RunnerError("argv_only_execution_required")
-        if any(ch in argv[0] for ch in (";", "|", "&", "`", "\n")):
-            raise RunnerError("shell_syntax_denied")
-        executable = shutil.which(argv[0])
-        if not executable:
-            raise RunnerError("executable_not_found")
-        if self.config.executable_allowlist and not any(
-            os.path.realpath(executable).startswith(os.path.realpath(prefix).rstrip(os.sep) + os.sep)
-            or os.path.realpath(executable) == os.path.realpath(prefix)
-            for prefix in self.config.executable_allowlist
-        ):
-            raise RunnerError("executable_not_allowlisted")
-        real_cwd = os.path.realpath(os.fspath(cwd))
-        if self.config.working_directory_allowlist and not any(
-            real_cwd == os.path.realpath(prefix)
-            or real_cwd.startswith(os.path.realpath(prefix).rstrip(os.sep) + os.sep)
-            for prefix in self.config.working_directory_allowlist
-        ):
-            raise RunnerError("working_directory_not_allowlisted")
-        if self.config.environment_allowlist and any(key not in self.config.environment_allowlist for key in env):
-            raise RunnerError("environment_key_not_allowlisted")
-
-    def execute_argv(self, argv: Sequence[str], cwd: str | os.PathLike[str], env: Mapping[str, str]) -> Mapping[str, Any]:
-        self.validate_execution(argv, cwd, env)
-        completed = subprocess.run(list(argv), cwd=os.fspath(cwd), env=dict(env), shell=False, text=True, capture_output=True, check=False)
-        return {"returncode": completed.returncode, "stdout": completed.stdout, "stderr": completed.stderr}

active-runtime/app/agent_pull_runner_cli.py

@@ -1,36 +0,0 @@
-"""Small operational CLI for the Agent Pull Runner contract."""
-from __future__ import annotations
-
-import argparse
-import json
-
-from agent_pull_runner import AgentPullRunner, RunnerConfig
-
-
-class _NoopTransport:
-    def register_worker(self, worker_id, capabilities): return {"status": "registered", "worker_id": worker_id, "capabilities": list(capabilities)}
-    def heartbeat(self, worker_id): return {"status": "alive", "worker_id": worker_id}
-    def long_poll(self, worker_id, timeout_seconds): return None
-    def poll(self, worker_id): return None
-    def claim(self, worker_id, task): return task
-    def renew(self, worker_id, task_id): return {"status": "renewed", "task_id": task_id}
-    def report_progress(self, worker_id, task_id, payload): return {"status": "progress_recorded", "task_id": task_id}
-    def report_result(self, worker_id, task_id, payload): return {"status": "result_recorded", "task_id": task_id}
-    def report_evidence(self, worker_id, task_id, payload): return {"status": "evidence_recorded", "task_id": task_id}
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description="AIOS Agent Pull Runner")
-    parser.add_argument("--worker-id", default="self-test-worker")
-    parser.add_argument("--self-test", action="store_true")
-    args = parser.parse_args()
-    runner = AgentPullRunner(RunnerConfig(worker_id=args.worker_id, fallback_seconds=60), _NoopTransport())
-    if args.self_test:
-        print(json.dumps({"status": "PASS", "registration": runner.register(), "fallback_seconds": runner.config.fallback_seconds}, sort_keys=True))
-        return 0
-    print(json.dumps({"status": "READY", "worker_id": args.worker_id}, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

active-runtime/app/aios_agent_task_api_lineage_supersession.py

@@ -1,122 +0,0 @@
-"""Staging HTTP overlay for the exact Task lineage supersession capability."""
-from __future__ import annotations
-
-from http.server import ThreadingHTTPServer
-from typing import Any, Callable, Mapping
-from urllib.parse import urlparse
-
-from aios_task_lineage_supersession import (
-    DECISION_SCHEMA,
-    TaskLineageSupersessionController,
-    TaskLineageSupersessionError,
-)
-
-SUPERSESSION_ROUTE = "/v1/control/task-lineage-supersession"
-
-
-def _status(error: TaskLineageSupersessionError) -> int:
-    return error.http_status
-
-
-class LineageSupersessionEndpoint:
-    """Framework-neutral endpoint; authentication must precede all parsing/mutation."""
-
-    def __init__(
-        self,
-        db_path,
-        verifier,
-        authenticate_control: Callable[[Mapping[str, str]], Any],
-        *,
-        clock=None,
-        identity_digest=None,
-    ) -> None:
-        self.authenticate_control = authenticate_control
-        self.controller = TaskLineageSupersessionController(
-            db_path, verifier, clock=clock, identity_digest=identity_digest
-        )
-
-    def post(self, headers: Mapping[str, str], body: Mapping[str, Any]) -> tuple[int, dict[str, Any]]:
-        self.authenticate_control(headers)
-        try:
-            result = self.controller.supersede(body)
-        except TaskLineageSupersessionError as exc:
-            return _status(exc), {"error": exc.code}
-        return (200 if result.get("idempotent") else 201), result
-
-
-def build_runtime():
-    """Bind to the already-active recovery API and its formal Owner verifier lazily."""
-    try:
-        from aios_agent_task_api import APIConfig
-        from aios_agent_task_api_p0_failed_lease_recovery import (
-            P0FailedLeaseRecoveryHandler,
-            P0FailedLeaseRecoveryTaskApplication,
-        )
-        from aios_agent_task_protocol import TaskProtocolError
-        from aios_owner_approval_verifier import (
-            GrantRootOwnerApprovalVerifier,
-            OwnerApprovalVerifierError,
-        )
-    except ImportError as exc:
-        raise RuntimeError("LINEAGE_SUPERSESSION_RUNTIME_OVERLAY_UNAVAILABLE") from exc
-
-    # The active entrypoint layers failed- and active-lease recovery on top of
-    # expired recovery.  Inherit that current layer so adding lineage does not
-    # silently remove either already-deployed recovery route.
-    class Application(P0FailedLeaseRecoveryTaskApplication):
-        def __init__(self, config: Any) -> None:
-            super().__init__(config)
-            try:
-                verifier = GrantRootOwnerApprovalVerifier()
-            except OwnerApprovalVerifierError as exc:
-                raise TaskProtocolError(str(exc), 503) from exc
-            self.lineage_supersession = LineageSupersessionEndpoint(
-                config.db_path, verifier, self.authenticate_control
-            )
-
-        def health(self) -> dict[str, Any]:
-            value = dict(super().health())
-            value.update({
-                "task_lineage_supersession": True,
-                "task_lineage_supersession_schema": DECISION_SCHEMA,
-                "task_lineage_supersession_exact_scope": True,
-                "task_lineage_supersession_exact_cas": True,
-                "task_lineage_supersession_append_only": True,
-                "task_lineage_supersession_caller_payload": False,
-            })
-            return value
-
-    class Handler(P0FailedLeaseRecoveryHandler):
-        app: Application | None = None
-
-        def do_POST(self) -> None:
-            path = urlparse(self.path).path.rstrip("/") or "/"
-            if path != SUPERSESSION_ROUTE:
-                super().do_POST()
-                return
-
-            def action() -> None:
-                if self.app is None:
-                    raise TaskProtocolError("SERVICE_UNAVAILABLE", 503)
-                status, result = self.app.lineage_supersession.post(
-                    self._headers(), self._body()
-                )
-                if "error" in result:
-                    raise TaskProtocolError(str(result["error"]), status)
-                self._json(result, status)
-
-            self._run(action)
-
-    return APIConfig, Application, Handler
-
-
-def serve(config=None) -> None:
-    APIConfig, Application, Handler = build_runtime()
-    config = config or APIConfig.from_env()
-    application = Application(config)
-    Handler.app = application
-    ThreadingHTTPServer((config.host, config.port), Handler).serve_forever()
-
-
-if __name__ == "__main__":
-    serve()

active-runtime/app/aios_agent_task_projection_recovery.py

@@ -1,811 +0,0 @@
-"""Canonical Task projection intent and same-identity recovery primitives.
-
-This module is intentionally Task-Plane-owned.  It does not open a network
-listener and it does not authenticate callers; existing control-plane services
-must enforce their normal service-side ``agent-task:control`` boundary before
-calling it.
-
-The recovery primitive has one purpose: converge a durable, complete
-ProjectionIntent to exactly one canonical Task row.  It never fabricates task
-semantics from a Bridge binding and it never generates a replacement task id.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-from datetime import datetime, timezone
-from enum import Enum
-import hashlib
-import json
-from pathlib import Path
-import re
-import sqlite3
-from typing import Any, Mapping, Sequence
-
-
-TASK_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-JOB_ID_RE = TASK_ID_RE
-SHA40_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA64_RE = re.compile(r"^[0-9a-f]{64}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9._/-]{1,220}$")
-SCHEMA = "aios.canonical-task-projection-intent.v1"
-RECEIPT_SCHEMA = "aios.canonical-task-projection-receipt.v1"
-
-
-class ProjectionRecoveryError(RuntimeError):
-    def __init__(self, code: str, status: int = 409) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-class ProjectionState(str, Enum):
-    PENDING = "PENDING"
-    CONVERGED = "CONVERGED"
-    DRIFT = "DRIFT"
-    FAILED = "FAILED"
-    BLOCKED = "BLOCKED"
-    UNKNOWN = "UNKNOWN"
-    BACKFILL_REQUIRED = "BACKFILL_REQUIRED"
-
-
-def _now() -> str:
-    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def _canonical(value: object) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def sha256_json(value: object) -> str:
-    return hashlib.sha256(_canonical(value)).hexdigest()
-
-
-def _string(value: object, code: str, pattern: re.Pattern[str] | None = None) -> str:
-    if not isinstance(value, str) or not value.strip():
-        raise ProjectionRecoveryError(code, 400)
-    result = value.strip()
-    if pattern is not None and pattern.fullmatch(result) is None:
-        raise ProjectionRecoveryError(code, 400)
-    return result
-
-
-def _integer(value: object, code: str, *, minimum: int = 0) -> int:
-    if isinstance(value, bool) or not isinstance(value, int) or value < minimum:
-        raise ProjectionRecoveryError(code, 400)
-    return value
-
-
-def _plain_mapping(value: object, code: str) -> dict[str, Any]:
-    if not isinstance(value, Mapping):
-        raise ProjectionRecoveryError(code, 400)
-    return {str(k): v for k, v in value.items()}
-
-
-def _plain_list(value: object, code: str) -> list[Any]:
-    if not isinstance(value, list):
-        raise ProjectionRecoveryError(code, 400)
-    return list(value)
-
-
-@dataclass(frozen=True, slots=True)
-class CanonicalTaskPayload:
-    task_id: str
-    goal: str
-    instructions: str
-    success_criteria: tuple[Mapping[str, Any], ...]
-    constraints: Mapping[str, Any]
-    required_capabilities: tuple[str, ...]
-    metadata: Mapping[str, Any]
-    priority: int = 100
-    max_attempts: int = 20
-    deadline: str | None = None
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "CanonicalTaskPayload":
-        allowed = {
-            "task_id",
-            "goal",
-            "instructions",
-            "success_criteria",
-            "constraints",
-            "required_capabilities",
-            "metadata",
-            "priority",
-            "max_attempts",
-            "deadline",
-        }
-        if set(value) - allowed:
-            raise ProjectionRecoveryError("TASK_PAYLOAD_UNKNOWN_FIELDS", 400)
-
-        task_id = _string(value.get("task_id"), "TASK_ID_INVALID", TASK_ID_RE)
-        goal = _string(value.get("goal"), "TASK_GOAL_INVALID")
-        instructions = _string(value.get("instructions"), "TASK_INSTRUCTIONS_INVALID")
-        if len(goal) > 8192 or len(instructions) > 65536:
-            raise ProjectionRecoveryError("TASK_TEXT_TOO_LARGE", 413)
-
-        criteria_raw = _plain_list(value.get("success_criteria"), "TASK_SUCCESS_CRITERIA_INVALID")
-        criteria: list[Mapping[str, Any]] = []
-        for item in criteria_raw:
-            if not isinstance(item, Mapping):
-                raise ProjectionRecoveryError("TASK_SUCCESS_CRITERIA_INVALID", 400)
-            criteria.append(dict(item))
-        if not criteria:
-            raise ProjectionRecoveryError("TASK_SUCCESS_CRITERIA_REQUIRED", 400)
-
-        constraints = _plain_mapping(value.get("constraints"), "TASK_CONSTRAINTS_INVALID")
-        capabilities_raw = _plain_list(
-            value.get("required_capabilities", []),
-            "TASK_CAPABILITIES_INVALID",
-        )
-        capabilities: list[str] = []
-        for item in capabilities_raw:
-            capabilities.append(_string(item, "TASK_CAPABILITY_INVALID"))
-
-        # Recovery recreates the pristine canonical row. Initial execution
-        # projection remains the sole owner of runtime capabilities.
-        if capabilities:
-            raise ProjectionRecoveryError(
-                "TASK_RECOVERY_REQUIRES_PRISTINE_CAPABILITIES",
-                409,
-            )
-
-        metadata = _plain_mapping(value.get("metadata", {}), "TASK_METADATA_INVALID")
-        if "execution" in metadata or "execution_projection" in metadata:
-            raise ProjectionRecoveryError(
-                "TASK_RECOVERY_REQUIRES_PRISTINE_METADATA",
-                409,
-            )
-
-        priority = _integer(value.get("priority", 100), "TASK_PRIORITY_INVALID", minimum=0)
-        max_attempts = _integer(
-            value.get("max_attempts", 20),
-            "TASK_MAX_ATTEMPTS_INVALID",
-            minimum=1,
-        )
-        deadline = value.get("deadline")
-        if deadline is not None:
-            deadline = _string(deadline, "TASK_DEADLINE_INVALID")
-
-        return cls(
-            task_id=task_id,
-            goal=goal,
-            instructions=instructions,
-            success_criteria=tuple(criteria),
-            constraints=constraints,
-            required_capabilities=tuple(capabilities),
-            metadata=metadata,
-            priority=priority,
-            max_attempts=max_attempts,
-            deadline=deadline,
-        )
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "task_id": self.task_id,
-            "goal": self.goal,
-            "instructions": self.instructions,
-            "success_criteria": [dict(x) for x in self.success_criteria],
-            "constraints": dict(self.constraints),
-            "required_capabilities": list(self.required_capabilities),
-            "metadata": dict(self.metadata),
-            "priority": self.priority,
-            "max_attempts": self.max_attempts,
-            "deadline": self.deadline,
-        }
-
-    @property
-    def payload_sha256(self) -> str:
-        return sha256_json(self.public())
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedProjectionBinding:
-    governed_task_id: str
-    bridge_job_id: str
-    repository: str
-    branch: str
-    generation: int
-    base_oid: str
-    expected_branch_oid: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "GovernedProjectionBinding":
-        allowed = {
-            "governed_task_id",
-            "bridge_job_id",
-            "repository",
-            "branch",
-            "generation",
-            "base_oid",
-            "expected_branch_oid",
-        }
-        if set(value) != allowed:
-            raise ProjectionRecoveryError("GOVERNED_BINDING_FIELDS_INVALID", 400)
-        repository = _string(value["repository"], "REPOSITORY_INVALID")
-        if repository != "aios/aios":
-            raise ProjectionRecoveryError("REPOSITORY_MISMATCH", 409)
-        return cls(
-            governed_task_id=_string(
-                value["governed_task_id"],
-                "GOVERNED_TASK_ID_INVALID",
-                TASK_ID_RE,
-            ),
-            bridge_job_id=_string(
-                value["bridge_job_id"],
-                "BRIDGE_JOB_ID_INVALID",
-                JOB_ID_RE,
-            ),
-            repository=repository,
-            branch=_string(value["branch"], "BRANCH_INVALID", BRANCH_RE),
-            generation=_integer(value["generation"], "GENERATION_INVALID", minimum=1),
-            base_oid=_string(value["base_oid"], "BASE_OID_INVALID", SHA40_RE),
-            expected_branch_oid=_string(
-                value["expected_branch_oid"],
-                "EXPECTED_OID_INVALID",
-                SHA40_RE,
-            ),
-        )
-
-    def public(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-@dataclass(frozen=True, slots=True)
-class ProjectionSourceArtifact:
-    ref: str
-    sha256: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "ProjectionSourceArtifact":
-        if set(value) != {"ref", "sha256"}:
-            raise ProjectionRecoveryError("SOURCE_ARTIFACT_FIELDS_INVALID", 400)
-        return cls(
-            ref=_string(value["ref"], "SOURCE_ARTIFACT_REF_INVALID"),
-            sha256=_string(value["sha256"], "SOURCE_ARTIFACT_SHA_INVALID", SHA64_RE),
-        )
-
-
-@dataclass(frozen=True, slots=True)
-class CanonicalTaskProjectionIntent:
-    projection_id: str
-    projection_generation: int
-    idempotency_key: str
-    task: CanonicalTaskPayload
-    binding: GovernedProjectionBinding
-    source_artifact: ProjectionSourceArtifact
-    schema: str = SCHEMA
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "CanonicalTaskProjectionIntent":
-        allowed = {
-            "schema",
-            "projection_id",
-            "projection_generation",
-            "idempotency_key",
-            "task",
-            "governed_binding",
-            "source_artifact",
-            "task_payload_sha256",
-        }
-        if set(value) != allowed:
-            raise ProjectionRecoveryError("PROJECTION_INTENT_FIELDS_INVALID", 400)
-        if value["schema"] != SCHEMA:
-            raise ProjectionRecoveryError("PROJECTION_INTENT_SCHEMA_INVALID", 400)
-
-        task = CanonicalTaskPayload.from_mapping(
-            _plain_mapping(value["task"], "TASK_PAYLOAD_INVALID")
-        )
-        binding = GovernedProjectionBinding.from_mapping(
-            _plain_mapping(value["governed_binding"], "GOVERNED_BINDING_INVALID")
-        )
-        source = ProjectionSourceArtifact.from_mapping(
-            _plain_mapping(value["source_artifact"], "SOURCE_ARTIFACT_INVALID")
-        )
-        if binding.governed_task_id != task.task_id:
-            raise ProjectionRecoveryError("PROJECTION_TASK_IDENTITY_MISMATCH", 409)
-
-        expected_hash = _string(
-            value["task_payload_sha256"],
-            "TASK_PAYLOAD_SHA_INVALID",
-            SHA64_RE,
-        )
-        if task.payload_sha256 != expected_hash:
-            raise ProjectionRecoveryError("TASK_PAYLOAD_SHA_MISMATCH", 409)
-
-        projection_id = _string(
-            value["projection_id"],
-            "PROJECTION_ID_INVALID",
-            TASK_ID_RE,
-        )
-        idempotency_key = _string(
-            value["idempotency_key"],
-            "IDEMPOTENCY_KEY_INVALID",
-            TASK_ID_RE,
-        )
-        generation = _integer(
-            value["projection_generation"],
-            "PROJECTION_GENERATION_INVALID",
-            minimum=1,
-        )
-        return cls(
-            projection_id=projection_id,
-            projection_generation=generation,
-            idempotency_key=idempotency_key,
-            task=task,
-            binding=binding,
-            source_artifact=source,
-        )
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "schema": self.schema,
-            "projection_id": self.projection_id,
-            "projection_generation": self.projection_generation,
-            "idempotency_key": self.idempotency_key,
-            "task": self.task.public(),
-            "governed_binding": self.binding.public(),
-            "source_artifact": asdict(self.source_artifact),
-            "task_payload_sha256": self.task.payload_sha256,
-        }
-
-    @property
-    def request_sha256(self) -> str:
-        return sha256_json(self.public())
-
-
-class CanonicalTaskProjectionStore:
-    """Task-Plane-owned intent/recovery store.
-
-    The caller must already be inside the Task Plane authorization boundary.
-    """
-
-    def __init__(self, db_path: Path | str) -> None:
-        self.db_path = Path(db_path)
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.db_path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    @staticmethod
-    def _columns(connection: sqlite3.Connection, table: str) -> dict[str, sqlite3.Row]:
-        return {
-            str(row["name"]): row
-            for row in connection.execute(f'PRAGMA table_info("{table}")')
-        }
-
-    @staticmethod
-    def _table_names(connection: sqlite3.Connection) -> set[str]:
-        return {
-            str(row[0])
-            for row in connection.execute(
-                "SELECT name FROM sqlite_master WHERE type='table'"
-            )
-        }
-
-    @classmethod
-    def _event_table(
-        cls,
-        connection: sqlite3.Connection,
-    ) -> tuple[str, dict[str, sqlite3.Row]]:
-        tables = cls._table_names(connection)
-        for name in ("task_events", "events"):
-            if name in tables:
-                columns = cls._columns(connection, name)
-                if "task_id" in columns and "event_type" in columns:
-                    return name, columns
-        raise ProjectionRecoveryError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
-
-    @staticmethod
-    def _ensure_control_tables(connection: sqlite3.Connection) -> None:
-        connection.execute(
-            """
-            CREATE TABLE IF NOT EXISTS task_projection_intents (
-              projection_id TEXT PRIMARY KEY,
-              task_id TEXT NOT NULL,
-              bridge_job_id TEXT NOT NULL,
-              projection_generation INTEGER NOT NULL,
-              idempotency_key TEXT NOT NULL,
-              request_sha256 TEXT NOT NULL,
-              task_payload_sha256 TEXT NOT NULL,
-              intent_json TEXT NOT NULL,
-              state TEXT NOT NULL,
-              last_error TEXT,
-              created_at TEXT NOT NULL,
-              updated_at TEXT NOT NULL,
-              UNIQUE(task_id, projection_generation),
-              UNIQUE(task_id, idempotency_key)
-            )
-            """
-        )
-        connection.execute(
-            """
-            CREATE TABLE IF NOT EXISTS task_projection_receipts (
-              projection_id TEXT PRIMARY KEY,
-              task_id TEXT NOT NULL,
-              bridge_job_id TEXT NOT NULL,
-              projection_generation INTEGER NOT NULL,
-              task_payload_sha256 TEXT NOT NULL,
-              canonical_revision INTEGER NOT NULL,
-              state TEXT NOT NULL,
-              created_new_row INTEGER NOT NULL,
-              observed_at TEXT NOT NULL,
-              receipt_json TEXT NOT NULL
-            )
-            """
-        )
-
-    def persist_intent(
-        self,
-        intent: CanonicalTaskProjectionIntent,
-    ) -> dict[str, Any]:
-        now = _now()
-        request_sha = intent.request_sha256
-        intent_text = _canonical(intent.public()).decode("utf-8")
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._ensure_control_tables(connection)
-            existing = connection.execute(
-                """
-                SELECT * FROM task_projection_intents
-                 WHERE task_id=? AND projection_generation=?
-                """,
-                (intent.task.task_id, intent.projection_generation),
-            ).fetchone()
-            if existing is not None:
-                if (
-                    str(existing["projection_id"]) != intent.projection_id
-                    or str(existing["idempotency_key"]) != intent.idempotency_key
-                    or str(existing["request_sha256"]) != request_sha
-                ):
-                    raise ProjectionRecoveryError(
-                        "PROJECTION_INTENT_IDEMPOTENCY_CONFLICT",
-                        409,
-                    )
-                connection.commit()
-                return {
-                    "projection_id": intent.projection_id,
-                    "task_id": intent.task.task_id,
-                    "state": str(existing["state"]),
-                    "idempotent": True,
-                }
-
-            connection.execute(
-                """
-                INSERT INTO task_projection_intents(
-                  projection_id,task_id,bridge_job_id,projection_generation,
-                  idempotency_key,request_sha256,task_payload_sha256,intent_json,
-                  state,last_error,created_at,updated_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    intent.projection_id,
-                    intent.task.task_id,
-                    intent.binding.bridge_job_id,
-                    intent.projection_generation,
-                    intent.idempotency_key,
-                    request_sha,
-                    intent.task.payload_sha256,
-                    intent_text,
-                    ProjectionState.PENDING.value,
-                    None,
-                    now,
-                    now,
-                ),
-            )
-            connection.commit()
-            return {
-                "projection_id": intent.projection_id,
-                "task_id": intent.task.task_id,
-                "state": ProjectionState.PENDING.value,
-                "idempotent": False,
-            }
-
-    def _task_row_payload(
-        self,
-        row: sqlite3.Row,
-    ) -> dict[str, Any]:
-        try:
-            success = json.loads(row["success_criteria_json"])
-            constraints = json.loads(row["constraints_json"])
-            capabilities = json.loads(row["required_capabilities_json"])
-            metadata = json.loads(row["metadata_json"])
-        except (TypeError, json.JSONDecodeError) as exc:
-            raise ProjectionRecoveryError("CANONICAL_TASK_JSON_INVALID", 409) from exc
-
-        if (
-            not isinstance(success, list)
-            or not isinstance(constraints, Mapping)
-            or not isinstance(capabilities, list)
-            or not isinstance(metadata, Mapping)
-        ):
-            raise ProjectionRecoveryError("CANONICAL_TASK_SHAPE_INVALID", 409)
-
-        return {
-            "task_id": str(row["task_id"]),
-            "goal": str(row["goal"]),
-            "instructions": str(row["instructions"]),
-            "success_criteria": success,
-            "constraints": dict(constraints),
-            "required_capabilities": capabilities,
-            "metadata": dict(metadata),
-            "priority": int(row["priority"]),
-            "max_attempts": int(row["max_attempts"]),
-            "deadline": row["deadline"],
-        }
-
-    def _verify_existing_task(
-        self,
-        row: sqlite3.Row,
-        intent: CanonicalTaskProjectionIntent,
-    ) -> int:
-        observed = self._task_row_payload(row)
-        observed_hash = sha256_json(observed)
-        if observed_hash != intent.task.payload_sha256:
-            raise ProjectionRecoveryError(
-                "CANONICAL_TASK_PROJECTION_IDENTITY_CONFLICT",
-                409,
-            )
-        return int(row["revision"])
-
-    @staticmethod
-    def _required_task_columns() -> set[str]:
-        return {
-            "task_id",
-            "goal",
-            "instructions",
-            "success_criteria_json",
-            "required_capabilities_json",
-            "constraints_json",
-            "metadata_json",
-            "priority",
-            "max_attempts",
-            "attempt",
-            "status",
-            "claimed_by",
-            "lease_token_hash",
-            "lease_expires_at",
-            "result_json",
-            "verification_json",
-            "revision",
-            "created_at",
-            "updated_at",
-        }
-
-    def _insert_task(
-        self,
-        connection: sqlite3.Connection,
-        intent: CanonicalTaskProjectionIntent,
-    ) -> int:
-        columns = self._columns(connection, "tasks")
-        if not self._required_task_columns().issubset(columns):
-            raise ProjectionRecoveryError("TASK_SCHEMA_RECOVERY_UNSUPPORTED", 503)
-
-        now = _now()
-        values: dict[str, Any] = {
-            "task_id": intent.task.task_id,
-            "goal": intent.task.goal,
-            "instructions": intent.task.instructions,
-            "success_criteria_json": _canonical(
-                [dict(x) for x in intent.task.success_criteria]
-            ).decode("utf-8"),
-            "required_capabilities_json": "[]",
-            "constraints_json": _canonical(dict(intent.task.constraints)).decode("utf-8"),
-            "metadata_json": _canonical(dict(intent.task.metadata)).decode("utf-8"),
-            "deadline": intent.task.deadline,
-            "priority": intent.task.priority,
-            "max_attempts": intent.task.max_attempts,
-            "attempt": 0,
-            "status": "QUEUED",
-            "claimed_by": None,
-            "lease_token_hash": None,
-            "lease_expires_at": None,
-            "result_json": None,
-            "verification_json": None,
-            "revision": 1,
-            "created_at": now,
-            "updated_at": now,
-        }
-        for optional in (
-            "result_digest",
-            "result_idempotency_key",
-        ):
-            if optional in columns:
-                values[optional] = None
-
-        names = [name for name in values if name in columns]
-        placeholders = ",".join("?" for _ in names)
-        connection.execute(
-            f'INSERT INTO tasks ({",".join(chr(34)+n+chr(34) for n in names)}) '
-            f"VALUES ({placeholders})",
-            tuple(values[name] for name in names),
-        )
-        self._insert_task_created_event(connection, intent)
-        return 1
-
-    def _insert_task_created_event(
-        self,
-        connection: sqlite3.Connection,
-        intent: CanonicalTaskProjectionIntent,
-    ) -> None:
-        table, columns = self._event_table(connection)
-        event = {
-            "schema": "aios.task-projection-recovery.event.v1",
-            "task_id": intent.task.task_id,
-            "bridge_job_id": intent.binding.bridge_job_id,
-            "projection_id": intent.projection_id,
-            "projection_generation": intent.projection_generation,
-            "task_payload_sha256": intent.task.payload_sha256,
-            "source_artifact_ref": intent.source_artifact.ref,
-            "source_artifact_sha256": intent.source_artifact.sha256,
-            "recovery": True,
-        }
-        values: dict[str, Any] = {
-            "task_id": intent.task.task_id,
-            "event_type": "TASK_CREATED",
-        }
-        payload_text = _canonical(event).decode("utf-8")
-        if "payload_json" in columns:
-            values["payload_json"] = payload_text
-        elif "payload" in columns:
-            values["payload"] = payload_text
-        else:
-            raise ProjectionRecoveryError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
-        if "created_at" in columns:
-            values["created_at"] = _now()
-        if "agent_id" in columns:
-            values["agent_id"] = "control-plane-projection-recovery"
-        if "actor_id" in columns:
-            values["actor_id"] = "control-plane-projection-recovery"
-
-        names = list(values)
-        connection.execute(
-            f'INSERT INTO "{table}" ({",".join(chr(34)+n+chr(34) for n in names)}) '
-            f'VALUES ({",".join("?" for _ in names)})',
-            tuple(values[name] for name in names),
-        )
-
-    def reconcile(
-        self,
-        intent: CanonicalTaskProjectionIntent,
-    ) -> dict[str, Any]:
-        # Persist first so a crash before Task creation leaves a durable PENDING
-        # intent for startup/supervisor reconciliation.
-        self.persist_intent(intent)
-
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._ensure_control_tables(connection)
-            existing_receipt = connection.execute(
-                "SELECT * FROM task_projection_receipts WHERE projection_id=?",
-                (intent.projection_id,),
-            ).fetchone()
-            if existing_receipt is not None:
-                if (
-                    str(existing_receipt["task_id"]) != intent.task.task_id
-                    or str(existing_receipt["bridge_job_id"]) != intent.binding.bridge_job_id
-                    or str(existing_receipt["task_payload_sha256"])
-                    != intent.task.payload_sha256
-                ):
-                    raise ProjectionRecoveryError(
-                        "PROJECTION_RECEIPT_IDENTITY_CONFLICT",
-                        409,
-                    )
-                connection.commit()
-                receipt = json.loads(existing_receipt["receipt_json"])
-                receipt["idempotent"] = True
-                return receipt
-
-            row = connection.execute(
-                "SELECT * FROM tasks WHERE task_id=?",
-                (intent.task.task_id,),
-            ).fetchone()
-            created_new = False
-            if row is None:
-                revision = self._insert_task(connection, intent)
-                created_new = True
-                row = connection.execute(
-                    "SELECT * FROM tasks WHERE task_id=?",
-                    (intent.task.task_id,),
-                ).fetchone()
-                if row is None:
-                    raise ProjectionRecoveryError(
-                        "TASK_RECOVERY_OBSERVATION_FAILED",
-                        503,
-                    )
-            else:
-                revision = self._verify_existing_task(row, intent)
-
-            # Observation after mutation is mandatory.
-            revision = self._verify_existing_task(row, intent)
-            observed_at = _now()
-            receipt = {
-                "schema": RECEIPT_SCHEMA,
-                "projection_id": intent.projection_id,
-                "governed_task_id": intent.binding.governed_task_id,
-                "canonical_task_id": intent.task.task_id,
-                "bridge_job_id": intent.binding.bridge_job_id,
-                "projection_generation": intent.projection_generation,
-                "task_payload_sha256": intent.task.payload_sha256,
-                "canonical_revision": revision,
-                "state": ProjectionState.CONVERGED.value,
-                "created_new_row": created_new,
-                "source_artifact": asdict(intent.source_artifact),
-                "observed_at": observed_at,
-                "idempotent": False,
-            }
-            connection.execute(
-                """
-                INSERT INTO task_projection_receipts(
-                  projection_id,task_id,bridge_job_id,projection_generation,
-                  task_payload_sha256,canonical_revision,state,created_new_row,
-                  observed_at,receipt_json
-                ) VALUES (?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    intent.projection_id,
-                    intent.task.task_id,
-                    intent.binding.bridge_job_id,
-                    intent.projection_generation,
-                    intent.task.payload_sha256,
-                    revision,
-                    ProjectionState.CONVERGED.value,
-                    1 if created_new else 0,
-                    observed_at,
-                    _canonical(receipt).decode("utf-8"),
-                ),
-            )
-            connection.execute(
-                """
-                UPDATE task_projection_intents
-                   SET state=?, last_error=NULL, updated_at=?
-                 WHERE projection_id=?
-                """,
-                (
-                    ProjectionState.CONVERGED.value,
-                    observed_at,
-                    intent.projection_id,
-                ),
-            )
-            connection.commit()
-            return receipt
-
-    def get_projection(
-        self,
-        task_id: str,
-    ) -> dict[str, Any] | None:
-        task_id = _string(task_id, "TASK_ID_INVALID", TASK_ID_RE)
-        with self._connect() as connection:
-            self._ensure_control_tables(connection)
-            intent = connection.execute(
-                """
-                SELECT * FROM task_projection_intents
-                 WHERE task_id=?
-                 ORDER BY projection_generation DESC
-                 LIMIT 1
-                """,
-                (task_id,),
-            ).fetchone()
-            if intent is None:
-                return None
-            receipt = connection.execute(
-                "SELECT receipt_json FROM task_projection_receipts WHERE projection_id=?",
-                (intent["projection_id"],),
-            ).fetchone()
-            return {
-                "projection_id": intent["projection_id"],
-                "task_id": task_id,
-                "bridge_job_id": intent["bridge_job_id"],
-                "projection_generation": int(intent["projection_generation"]),
-                "state": intent["state"],
-                "last_error": intent["last_error"],
-                "task_payload_sha256": intent["task_payload_sha256"],
-                "receipt": json.loads(receipt[0]) if receipt else None,
-            }

active-runtime/app/aios_agent_task_projection_recovery_http.py

@@ -1,44 +0,0 @@
-"""HTTP integration helpers for canonical Task projection recovery.
-
-This module intentionally contains no HTTP server. Existing Task Plane /
-projection-owner handlers should call ``recover_from_json`` only after their
-normal service-side ``agent-task:control`` authorization succeeds.
-"""
-from __future__ import annotations
-
-from pathlib import Path
-from typing import Any, Mapping
-
-from aios_agent_task_projection_recovery import (
-    CanonicalTaskProjectionIntent,
-    CanonicalTaskProjectionStore,
-    ProjectionRecoveryError,
-)
-
-
-def recover_from_json(
-    db_path: Path | str,
-    task_id: str,
-    body: Mapping[str, Any],
-) -> tuple[int, dict[str, Any]]:
-    try:
-        intent = CanonicalTaskProjectionIntent.from_mapping(body)
-        if intent.task.task_id != task_id:
-            raise ProjectionRecoveryError("PROJECTION_TASK_IDENTITY_MISMATCH", 409)
-        result = CanonicalTaskProjectionStore(db_path).reconcile(intent)
-        return (200 if result.get("idempotent") else 201), result
-    except ProjectionRecoveryError as exc:
-        return exc.status, {"error": exc.code}
-
-
-def get_projection(
-    db_path: Path | str,
-    task_id: str,
-) -> tuple[int, dict[str, Any]]:
-    try:
-        result = CanonicalTaskProjectionStore(db_path).get_projection(task_id)
-    except ProjectionRecoveryError as exc:
-        return exc.status, {"error": exc.code}
-    if result is None:
-        return 404, {"error": "TASK_PROJECTION_NOT_FOUND"}
-    return 200, result

active-runtime/app/aios_authority_git_executor.py

@@ -1,192 +0,0 @@
-"""Fail-closed Authority Git side-effect boundary.
-
-Only this module may issue the narrowly scoped ref CAS primitives used by the
-durable executor. It never accepts force updates, arbitrary refs, tags, or
-direct production mutations.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-import os
-from pathlib import Path
-import re
-import subprocess
-import tempfile
-from typing import Mapping, Sequence
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TASK_BRANCH_RE = re.compile(r"^refs/heads/agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-
-
-class AuthorityGitError(RuntimeError):
-    pass
-
-
-def _oid(value: str, field: str) -> str:
-    if not isinstance(value, str) or not OID_RE.fullmatch(value):
-        raise AuthorityGitError(f"{field}_INVALID")
-    return value
-
-
-@dataclass(frozen=True, slots=True)
-class AuthorityGitExecutor:
-    git_dir: Path
-    worktree_root: Path = Path("/var/lib/aios-gitops/worktrees")
-
-    def __post_init__(self) -> None:
-        if not self.git_dir.is_absolute() or self.git_dir.is_symlink():
-            raise AuthorityGitError("AUTHORITY_GIT_DIR_INVALID")
-        if not self.worktree_root.is_absolute() or self.worktree_root.is_symlink():
-            raise AuthorityGitError("WORKTREE_ROOT_INVALID")
-
-    def _git(self, args: Sequence[str], *, check: bool = True) -> str:
-        result = subprocess.run(
-            ["git", f"--git-dir={self.git_dir}", *args],
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if check and result.returncode != 0:
-            raise AuthorityGitError("AUTHORITY_GIT_COMMAND_FAILED")
-        return result.stdout.strip()
-
-    def read_ref(self, ref: str) -> str | None:
-        if not ref.startswith("refs/") or ref.startswith(("refs/tags/", "refs/remotes/")):
-            raise AuthorityGitError("REF_READ_SCOPE_DENIED")
-        value = self._git(["rev-parse", "--verify", ref], check=False)
-        return value if value and OID_RE.fullmatch(value) else None
-
-    def commit_exists(self, oid: str) -> bool:
-        _oid(oid, "commit_oid")
-        result = subprocess.run(["git", f"--git-dir={self.git_dir}", "cat-file", "-e", oid + "^{commit}"], capture_output=True, check=False)
-        return result.returncode == 0
-
-    def ancestry_check(self, older_oid: str, newer_oid: str) -> bool:
-        _oid(older_oid, "older_oid")
-        _oid(newer_oid, "newer_oid")
-        result = subprocess.run(
-            ["git", f"--git-dir={self.git_dir}", "merge-base", "--is-ancestor", older_oid, newer_oid],
-            capture_output=True,
-            check=False,
-        )
-        if result.returncode not in (0, 1):
-            raise AuthorityGitError("ANCESTRY_CHECK_FAILED")
-        return result.returncode == 0
-
-    def create_detached_worktree(
-        self,
-        base_oid: str,
-        worktree_name: str,
-        root: Path | None = None,
-    ) -> Path:
-        _oid(base_oid, "base_oid")
-        if not worktree_name or "/" in worktree_name or "\\" in worktree_name or worktree_name in {".", ".."}:
-            raise AuthorityGitError("WORKTREE_NAME_INVALID")
-        parent = root or self.worktree_root
-        if not parent.is_absolute() or parent.is_symlink():
-            raise AuthorityGitError("WORKTREE_ROOT_INVALID")
-        path = parent / worktree_name
-        if path.exists() or path.is_symlink():
-            raise AuthorityGitError("WORKTREE_ALREADY_EXISTS")
-        parent.mkdir(parents=True, exist_ok=True)
-        self._git(["worktree", "add", "--detach", str(path), base_oid])
-        return path
-
-    def create_task_branch(self, branch: str, base_oid: str) -> str:
-        """Create an isolated agent branch once, using an empty-ref CAS."""
-        ref = branch if branch.startswith("refs/heads/") else "refs/heads/" + branch
-        if not TASK_BRANCH_RE.fullmatch(ref):
-            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
-        _oid(base_oid, "base_oid")
-        if not self.commit_exists(base_oid):
-            raise AuthorityGitError("BASE_COMMIT_NOT_FOUND")
-        current = self.read_ref(ref)
-        if current is not None:
-            if current == base_oid:
-                return current
-            raise AuthorityGitError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
-        self._git(["update-ref", ref, base_oid, "0" * 40])
-        readback = self.read_ref(ref)
-        if readback != base_oid:
-            raise AuthorityGitError("AUTHORITY_CAS_READBACK_MISMATCH")
-        return readback
-
-    def advance_task_branch_CAS(self, branch: str, expected_oid: str, new_oid: str) -> str:
-        if not TASK_BRANCH_RE.fullmatch(branch):
-            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
-        _oid(expected_oid, "expected_oid")
-        _oid(new_oid, "new_oid")
-        current = self.read_ref(branch)
-        if current != expected_oid:
-            if current == new_oid:
-                return new_oid
-            raise AuthorityGitError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
-        if not self.ancestry_check(expected_oid, new_oid):
-            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
-        self._git(["update-ref", branch, new_oid, expected_oid])
-        readback = self.read_ref(branch)
-        if readback != new_oid:
-            raise AuthorityGitError("AUTHORITY_CAS_READBACK_MISMATCH")
-        return readback
-
-    def ff_CAS_main_after_verified_protected_merge(self, expected_oid: str, new_oid: str) -> str:
-        _oid(expected_oid, "expected_oid")
-        _oid(new_oid, "new_oid")
-        if not self.ancestry_check(expected_oid, new_oid):
-            raise AuthorityGitError("MAIN_FF_REQUIRED")
-        current = self.read_ref("refs/heads/main")
-        if current != expected_oid:
-            if current == new_oid:
-                return new_oid
-            raise AuthorityGitError("AUTHORITY_MAIN_EXPECTATION_MISMATCH")
-        self._git(["update-ref", "refs/heads/main", new_oid, expected_oid])
-        readback = self.read_ref("refs/heads/main")
-        if readback != new_oid:
-            raise AuthorityGitError("AUTHORITY_MAIN_CAS_READBACK_MISMATCH")
-        return readback
-
-    def commit_file_in_isolated_worktree(
-        self,
-        *,
-        base_oid: str,
-        files: Mapping[str, bytes],
-        message: str,
-        worktree_name: str,
-    ) -> str:
-        _oid(base_oid, "base_oid")
-        if not worktree_name or "/" in worktree_name or "\\" in worktree_name or worktree_name in {".", ".."}:
-            raise AuthorityGitError("WORKTREE_NAME_INVALID")
-        root = self.worktree_root / worktree_name
-        if root.exists() or root.is_symlink():
-            raise AuthorityGitError("WORKTREE_ALREADY_EXISTS")
-        self.worktree_root.mkdir(parents=True, exist_ok=True)
-        self._git(["worktree", "add", "--detach", str(root), base_oid])
-        try:
-            for relative, content in files.items():
-                path = Path(relative)
-                if path.is_absolute() or ".." in path.parts or not path.parts or path.parts[0] == ".git":
-                    raise AuthorityGitError("FILE_PATH_INVALID")
-                target = root / path
-                target.parent.mkdir(parents=True, exist_ok=True)
-                target.write_bytes(content)
-            result = subprocess.run(
-                ["git", "-C", str(root), "add", "--", *files.keys()],
-                text=True,
-                capture_output=True,
-                check=False,
-            )
-            if result.returncode != 0:
-                raise AuthorityGitError("WORKTREE_ADD_FAILED")
-            result = subprocess.run(
-                ["git", "-C", str(root), "-c", "user.name=aios-durable-job", "-c", "user.email=aios-durable-job@localhost", "commit", "--no-verify", "-m", message],
-                text=True,
-                capture_output=True,
-                check=False,
-            )
-            if result.returncode != 0:
-                raise AuthorityGitError("WORKTREE_COMMIT_FAILED")
-            return subprocess.check_output(["git", "-C", str(root), "rev-parse", "HEAD"], text=True).strip()
-        finally:
-            subprocess.run(["git", f"--git-dir={self.git_dir}", "worktree", "remove", "--force", str(root)], capture_output=True, check=False)

active-runtime/app/aios_authorized_task_writer_api.py

@@ -1,73 +0,0 @@
-"""HTTP adapter for Owner-authorized task writer provisioning.
-
-Run this module instead of aios_chatgpt_actions_api.py. All existing routes are
-delegated unchanged; only POST /api/task-writer/provision-authorized is added.
-"""
-from __future__ import annotations
-
-import os
-import urllib.parse
-
-import aios_chatgpt_actions_api as api
-from authorized_task_writer_provisioning import (
-    AuthorizedTaskWriterProvisioner,
-    OwnerContext,
-    ProvisioningError,
-)
-
-
-_original_do_post = api.H.do_POST
-_ENDPOINT = "/api/task-writer/provision-authorized"
-
-
-def _owner_authorization(handler):
-    scope = os.getenv(
-        "AIOS_GITOPS_OWNER_PROVISION_SCOPE", "writer:provision"
-    )
-    auth = handler.need(scope)
-    if not auth:
-        return None
-    if auth.get("role") != "owner":
-        handler.sendj({"error": "OWNER_AUTHORIZATION_REQUIRED"}, 403)
-        return None
-    identity = str(auth.get("account") or "").strip()
-    if not identity:
-        handler.sendj({"error": "OWNER_IDENTITY_REQUIRED"}, 403)
-        return None
-    return auth
-
-
-def _authorized_do_post(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path != _ENDPOINT:
-        return _original_do_post(self)
-    auth = _owner_authorization(self)
-    if not auth:
-        return
-    data = self.body()
-    owner_reference = str(data.get("owner_authorization_reference") or "")
-    try:
-        result = AuthorizedTaskWriterProvisioner().provision(
-            data,
-            OwnerContext(
-                identity=str(auth["account"]),
-                role=str(auth["role"]),
-                authorization_reference=owner_reference,
-            ),
-        )
-        return self.sendj(result)
-    except ProvisioningError as exc:
-        body = {"error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        return self.sendj(body, exc.status)
-    except Exception:
-        # Do not expose tool output, paths containing credentials, or traceback data.
-        return self.sendj({"error": "AUTHORIZED_WRITER_BRIDGE_INTERNAL_ERROR"}, 500)
-
-
-api.H.do_POST = _authorized_do_post
-
-
-if __name__ == "__main__":
-    api.main()

active-runtime/app/aios_autonomous_release_authorization/controller.py

@@ -0,0 +1,379 @@
+#!/usr/bin/env python3
+"""Task-scoped continuous authorization controller for the AIOS Candidate writer."""
+from __future__ import annotations
+import base64, fcntl, hashlib, json, os, pwd, grp, re, socket, sqlite3, stat, subprocess, sys, tempfile, time, urllib.error, urllib.parse, urllib.request
+from datetime import datetime, timedelta, timezone
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from typing import Any
+
+TASK='AIOS-AUTONOMOUS-RELEASE-FULL-IMPLEMENTATION-20260726'
+AUTH_ID='authz-aios-autonomous-release-20260726'
+BRANCH='patch/chatgpt-autonomous-completion-contract-20260726'
+BASE='875d41c3101093149414292067fd700dc214d4d3'
+REPO='aios/aios'
+WRITER_AUDIENCE='chatgpt-autonomous-release-writer'
+ACTOR='chatgpt-gitops-bot'
+WRITER_INSTANCE='writer-6e32f321-1240-46f8-9693-0b0631d9c77b'
+CHILD_OPERATION_MAX_USES=20
+ROOT=Path('/data/aios-gitops')
+WORKTREE=ROOT/'worktrees/chatgpt-autonomous-completion-contract-20260726'
+BARE=ROOT/'repo.git'
+TASK_ROOT=ROOT/'runtime/tasks'/TASK
+AUTH_DIR=Path('/etc/aios-gitops/task-authorizations')
+PARENT=AUTH_DIR/'authz-aios-autonomous-release-20260726.json'
+STATE_DIR=Path('/var/lib/aios-autonomous-release-authorization')
+STATE=STATE_DIR/'state.json'
+LOCK=STATE_DIR/'controller.lock'
+AUDIT=TASK_ROOT/'continuous-authorization.audit.jsonl'
+SOCKET_DIR=Path('/run/aios-autonomous-release-authorization')
+SOCKET_PATH=SOCKET_DIR/'controller.sock'
+PROJECTION=Path('/etc/aios-gitops/credentials/chatgpt-autonomous-release-writer')
+REGISTRY=Path('/var/lib/aios-chatgpt-autonomous-release-writer/token-registry.sqlite3')
+WRITER_LEDGER=Path('/var/lib/aios-chatgpt-autonomous-release-writer/operation-ledger.sqlite3')
+ASKPASS=Path('/usr/libexec/aios-autonomous-release-authorization/gitea_askpass.py')
+PATH_POLICY=Path('/etc/aios-gitops/policies-chatgpt-autonomous-release/autonomous-release-path-policy.json')
+ROUTE_BINDING=Path('/etc/aios-gitops/action-route-bindings/chatgpt-autonomous-release-20260726.json')
+OID_RE=re.compile(r'^[0-9a-f]{40}$')
+OP_RE=re.compile(r'^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$')
+TERMINAL={'COMPLETED','CANCELLED','FAILED_FINAL','REVOKED','REVOKED_IDLE_TIMEOUT','REVOKED_WALL_CLOCK','RECONCILIATION_REQUIRED'}
+
+sys.path.insert(0,'/usr/libexec/aios-chatgpt-autonomous-release-writer-fullprofile-8ac2f90f')
+from isolated_writer_token_registry import TokenRegistry
+
+def now() -> datetime: return datetime.now(timezone.utc)
+def stamp() -> str: return now().replace(microsecond=0).isoformat()
+def canonical(value: Any) -> bytes: return json.dumps(value,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode('utf-8')
+def fail(code: str, status: int=503, **details: Any) -> None: raise ControlError(code,status,details)
+class ControlError(RuntimeError):
+ def __init__(self,code:str,status:int=503,details:dict[str,Any]|None=None): self.code,self.status,self.details=code,status,details or {}; super().__init__(code)
+
+def owned_regular(path:Path, mode:int) -> os.stat_result:
+ try: info=os.lstat(path)
+ except FileNotFoundError: fail('authorization_config_missing')
+ if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid!=0 or stat.S_IMODE(info.st_mode)&~mode: fail('authorization_config_permissions_rejected')
+ return info
+
+def load_json(path:Path,mode:int=0o600) -> dict[str,Any]:
+ owned_regular(path,mode)
+ try: value=json.loads(path.read_text(encoding='utf-8'))
+ except Exception: fail('authorization_config_json_rejected')
+ if not isinstance(value,dict): fail('authorization_config_schema_rejected')
+ return value
+
+def atomic_json(path:Path,value:dict[str,Any],mode:int=0o600) -> None:
+ path.parent.mkdir(parents=True,exist_ok=True)
+ raw=canonical(value)+b'\n'
+ fd,tmp=tempfile.mkstemp(prefix='.new-',dir=path.parent)
+ try:
+  os.fchmod(fd,mode); os.write(fd,raw); os.fsync(fd); os.close(fd); os.chown(tmp,0,0); os.replace(tmp,path)
+  os.chmod(path,mode)
+ finally:
+  try: os.close(fd)
+  except OSError: pass
+  if os.path.exists(tmp): os.unlink(tmp)
+
+def append_audit(event:dict[str,Any]) -> None:
+ TASK_ROOT.mkdir(parents=True,exist_ok=True)
+ flags=os.O_WRONLY|os.O_CREAT|os.O_APPEND|getattr(os,'O_NOFOLLOW',0)
+ fd=os.open(AUDIT,flags,0o600)
+ try: os.write(fd,canonical({'at':stamp(),'task_id':TASK,'secrets_included':False,**event})+b'\n'); os.fsync(fd)
+ finally: os.close(fd)
+
+def parent() -> dict[str,Any]:
+ p=load_json(PARENT)
+ required={'schema_version','development_authorization_id','authorization_type','task_id','actor_identity','audience','repository','exact_branch','approved_base_oid','allowed_path_roots','allowed_exact_paths','allowed_operations','created_at','valid_until','maximum_wall_clock_seconds','idle_timeout_seconds','manual_reapproval_per_commit','maximum_concurrent_writes','path_policy_sha256','writer_instance_id'}
+ if set(p)!=required or p.get('schema_version')!=1: fail('parent_authorization_schema_rejected')
+ fixed={'development_authorization_id':AUTH_ID,'authorization_type':'TASK_SCOPED_CONTINUOUS_DEVELOPMENT','task_id':TASK,'actor_identity':ACTOR,'audience':WRITER_AUDIENCE,'repository':REPO,'exact_branch':BRANCH,'approved_base_oid':BASE,'manual_reapproval_per_commit':False,'maximum_concurrent_writes':1,'writer_instance_id':WRITER_INSTANCE}
+ if any(p.get(k)!=v for k,v in fixed.items()): fail('parent_authorization_binding_rejected')
+ if p.get('maximum_wall_clock_seconds')!=86400 or p.get('idle_timeout_seconds')!=2700: fail('parent_authorization_lifetime_rejected')
+ if not isinstance(p.get('allowed_path_roots'),list) or not isinstance(p.get('allowed_exact_paths'),list) or not isinstance(p.get('allowed_operations'),list): fail('parent_authorization_scope_rejected')
+ raw=PATH_POLICY.read_bytes()
+ if hashlib.sha256(raw).hexdigest()!=p.get('path_policy_sha256'): fail('parent_authorization_path_policy_changed')
+ return p
+
+def parse_time(v:Any) -> datetime:
+ try:
+  d=datetime.fromisoformat(str(v).replace('Z','+00:00'))
+  return d.astimezone(timezone.utc)
+ except Exception: fail('authorization_time_rejected')
+
+def components(path:str)->tuple[str,...]:
+ if not isinstance(path,str) or not path or path!=path.strip() or '\\' in path or '\x00' in path: fail('authorization_path_rejected',403)
+ pp=PurePosixPath(path); wp=PureWindowsPath(path)
+ parts=tuple(path.split('/'))
+ if pp.is_absolute() or wp.is_absolute() or bool(wp.drive) or any(x in {'','.','..'} for x in parts): fail('authorization_path_rejected',403)
+ return parts
+
+def path_allowed(p:dict[str,Any],path:str)->bool:
+ item=components(path)
+ for root in p['allowed_path_roots']:
+  r=components(str(root).rstrip('/'))
+  if item[:len(r)]==r: return True
+ return any(item==components(x) for x in p['allowed_exact_paths'])
+
+def git(*args:str,cwd:Path|None=None,env:dict[str,str]|None=None)->str:
+ e=os.environ.copy(); e.update(env or {}); e['GIT_CONFIG_COUNT']='1'; e['GIT_CONFIG_KEY_0']='safe.directory'; e['GIT_CONFIG_VALUE_0']=str(WORKTREE)
+ r=subprocess.run(['git',*args],cwd=cwd,text=True,capture_output=True,env=e)
+ if r.returncode: fail('authorization_git_probe_failed',503)
+ return r.stdout.strip()
+
+def credential_lines()->list[str]:
+ cp=Path(os.environ.get('CREDENTIALS_DIRECTORY',''))/'gitea_git_http'
+ try:
+  info=os.lstat(cp); lines=cp.read_text(encoding='utf-8').splitlines()
+ except OSError: fail('authorization_gitea_credential_unavailable')
+ if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or len(lines)!=2 or lines[0]!='gitops-bot' or not lines[1]: fail('authorization_gitea_credential_rejected')
+ return lines
+
+def remote_oid()->str:
+ credential_lines()
+ e={'GIT_ASKPASS':str(ASKPASS),'GIT_TERMINAL_PROMPT':'0'}
+ out=git('ls-remote','--heads','http://127.0.0.1:3000/aios/aios.git',f'refs/heads/{BRANCH}',cwd=WORKTREE,env=e)
+ fields=out.split()
+ if len(fields)!=2 or not OID_RE.fullmatch(fields[0]): fail('authorization_git_ls_remote_rejected')
+ return fields[0]
+
+def api_oid()->str:
+ user,password=credential_lines(); branch=urllib.parse.quote(BRANCH,safe='')
+ encoded=base64.b64encode((user+':'+password).encode()).decode()
+ request=urllib.request.Request('http://127.0.0.1:3000/api/v1/repos/aios/aios/branches/'+branch,headers={'Authorization':'Basic '+encoded,'Host':'g.cnnetmkt.top'})
+ try:
+  with urllib.request.urlopen(request,timeout=10) as response: value=json.loads(response.read())
+ except Exception: fail('authorization_gitea_api_unavailable')
+ oid=str(value.get('commit',{}).get('id',''))
+ if not OID_RE.fullmatch(oid): fail('authorization_gitea_api_oid_rejected')
+ return oid
+
+def four_way(expected:str)->None:
+ local=git('rev-parse','HEAD',cwd=WORKTREE)
+ bare=git('--git-dir',str(BARE),'rev-parse',f'refs/heads/{BRANCH}')
+ remote=remote_oid(); api=api_oid()
+ if any(x!=expected for x in (local,bare,remote,api)): fail('RECONCILIATION_REQUIRED',409,current_head_oid=local)
+ if git('status','--porcelain',cwd=WORKTREE)!='': fail('authorization_worktree_dirty',409)
+
+def state()->dict[str,Any]:
+ s=load_json(STATE)
+ required={'schema_version','development_authorization_id','task_id','status','current_head_oid','last_activity_at','writer_child','test_child','inflight','updated_at'}
+ if set(s)!=required or s.get('schema_version')!=1 or s.get('development_authorization_id')!=AUTH_ID or s.get('task_id')!=TASK or not OID_RE.fullmatch(str(s.get('current_head_oid',''))): fail('authorization_state_schema_rejected')
+ return s
+
+def save_state(s:dict[str,Any])->None: s['updated_at']=stamp(); atomic_json(STATE,s)
+
+def lock():
+ STATE_DIR.mkdir(parents=True,exist_ok=True); os.chmod(STATE_DIR,0o700)
+ f=open(LOCK,'a+b'); os.chmod(LOCK,0o600); fcntl.flock(f.fileno(),fcntl.LOCK_EX); return f
+
+def route_binding_valid(p:dict[str,Any])->None:
+ b=load_json(ROUTE_BINDING,0o640)
+ identities=b.get('action_identities')
+ if b.get('task_id')!=TASK or b.get('writer_instance_id')!=WRITER_INSTANCE or b.get('repository')!=REPO or b.get('branch')!=BRANCH or b.get('approved_base_oid')!=BASE or b.get('path_policy_sha256')!=p.get('path_policy_sha256') or not isinstance(identities,list) or len(identities)!=1 or identities[0].get('account')!=ACTOR:
+  fail('authorization_route_binding_changed',409)
+
+def task_live(p:dict[str,Any],s:dict[str,Any],*,touch:bool)->None:
+ route_binding_valid(p)
+ if s['status'] in TERMINAL: fail('authorization_task_terminal',409)
+ if now()>=parse_time(p['valid_until']):
+  s['status']='REVOKED_WALL_CLOCK'; save_state(s); cleanup(s,'wall_clock'); fail('authorization_task_terminal',409)
+ if (now()-parse_time(s['last_activity_at'])).total_seconds()>p['idle_timeout_seconds']:
+  s['status']='REVOKED_IDLE_TIMEOUT'; save_state(s); cleanup(s,'idle_timeout'); fail('authorization_task_terminal',409)
+ if touch: s['last_activity_at']=stamp(); save_state(s)
+
+def projection_token()->str|None:
+ if not PROJECTION.exists(): return None
+ try:
+  info=os.lstat(PROJECTION)
+  if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid!=0 or stat.S_IMODE(info.st_mode)!=0o600: fail('authorization_projection_rejected')
+  token=PROJECTION.read_text(encoding='utf-8').strip()
+  return token if len(token.encode())>=32 else None
+ except OSError: fail('authorization_projection_rejected')
+
+def write_projection(token:str)->None:
+ PROJECTION.parent.mkdir(parents=True,exist_ok=True)
+ fd,tmp=tempfile.mkstemp(prefix='.writer-',dir=PROJECTION.parent)
+ try:
+  os.fchmod(fd,0o600); os.write(fd,(token+'\n').encode()); os.fsync(fd); os.close(fd); os.chown(tmp,0,0); os.replace(tmp,PROJECTION); os.chmod(PROJECTION,0o600)
+ finally:
+  try: os.close(fd)
+  except OSError: pass
+  if os.path.exists(tmp): os.unlink(tmp)
+
+def post_revoke_401(token:str)->None:
+ req=urllib.request.Request('http://127.0.0.1:19893/api/runtime-status',headers={'Authorization':'Bearer '+token})
+ try: urllib.request.urlopen(req,timeout=5)
+ except urllib.error.HTTPError as e:
+  if e.code==401:return
+ except Exception: pass
+ fail('authorization_old_credential_revocation_unverified')
+
+def rotate_child(p:dict[str,Any],s:dict[str,Any],reason:str)->str:
+ old=projection_token(); registry=TokenRegistry(REGISTRY)
+ old_record=registry.find(old) if old else None
+ if old_record and (old_record.get('task_id')!=TASK or old_record.get('development_authorization_id')!=AUTH_ID):
+  if parse_time(old_record.get('expires_at'))>=now(): fail('authorization_existing_projection_binding_rejected')
+  if not registry.revoke(str(old_record['token_id'])): fail('authorization_historical_child_revoke_failed')
+  post_revoke_401(old)
+  append_audit({'event':'historical_expired_child_revoked','old_credential_http_status':401})
+  old_record=None
+ issued=now().replace(microsecond=0); expires=issued+timedelta(minutes=20)
+ prefixes=[str(x).rstrip('/')+'/' for x in p['allowed_path_roots']]
+ grant={'token_id':'continuous-child-'+issued.strftime('%Y%m%dT%H%M%SZ')+'-'+os.urandom(3).hex(),'credential_id':'credential-'+issued.strftime('%Y%m%dT%H%M%SZ')+'-'+os.urandom(3).hex(),'development_authorization_id':AUTH_ID,'audience':WRITER_AUDIENCE,'task_id':TASK,'actor_identity':ACTOR,'writer_instance_id':WRITER_INSTANCE,'repository_identity':REPO,'source_cidrs':['127.0.0.1/32'],'allowed_branch':BRANCH,'current_expected_head_oid':s['current_head_oid'],'approved_base_oid':BASE,'allowed_operations':p['allowed_operations'],'allowed_paths':p['allowed_exact_paths'],'allowed_path_prefixes':prefixes,'not_before':issued.isoformat(),'expires_at':expires.isoformat(),'renewable':False,'max_uses':{operation:CHILD_OPERATION_MAX_USES for operation in p['allowed_operations']},'issued_by':'task_authorization_controller'}
+ token,record=registry.issue(grant)
+ try:
+  write_projection(token)
+  if old_record:
+   if not registry.revoke(str(old_record['token_id'])): fail('authorization_old_child_revoke_failed')
+   post_revoke_401(old)
+ except Exception:
+  registry.revoke(str(record['token_id']))
+  try: PROJECTION.unlink()
+  except FileNotFoundError: pass
+  raise
+ s['writer_child']={'credential_id':record['credential_id'],'issued_at':record['not_before'],'expires_at':record['expires_at'],'current_expected_head_oid':s['current_head_oid'],'rotation_reason':reason}
+ save_state(s); append_audit({'event':'child_grant_rotated','reason':reason,'current_head_oid':s['current_head_oid'],'old_grant_revoked':bool(old_record),'old_credential_http_status':401 if old_record else None})
+ return token
+
+def child_operation_quota_exhausted(rec:dict[str,Any],registry:TokenRegistry)->bool:
+ token_id=str(rec.get('token_id',''))
+ allowed=rec.get('allowed_operations')
+ limits=rec.get('max_uses')
+ if not token_id or not isinstance(allowed,list) or not isinstance(limits,dict): fail('authorization_child_quota_schema_rejected')
+ for operation in allowed:
+  maximum=limits.get(operation)
+  if not isinstance(operation,str) or not isinstance(maximum,int) or maximum<1: fail('authorization_child_quota_schema_rejected')
+  if registry.usage(token_id,operation)>=maximum: return True
+ return False
+
+def ensure_child(p:dict[str,Any],s:dict[str,Any],reason:str)->str:
+ token=projection_token(); meta=s.get('writer_child') or {}
+ expired=True
+ try: expired=(parse_time(meta.get('expires_at'))-now()).total_seconds()<=300
+ except Exception: pass
+ if not token or expired or meta.get('current_expected_head_oid')!=s['current_head_oid']:
+  return rotate_child(p,s,reason)
+ registry=TokenRegistry(REGISTRY)
+ rec=registry.find(token)
+ if not rec or rec.get('revoked') or rec.get('development_authorization_id')!=AUTH_ID or rec.get('current_expected_head_oid')!=s['current_head_oid']:
+  return rotate_child(p,s,reason)
+ if child_operation_quota_exhausted(rec,registry):
+  return rotate_child(p,s,'operation_quota_exhausted')
+ return token
+
+def ledger_verified(operation_id:str,commit_oid:str)->None:
+ with sqlite3.connect(WRITER_LEDGER) as db:
+  row=db.execute('select operation_id,branch,commit_oid,state,verification_status from writer_operations where operation_id=?',(operation_id,)).fetchone()
+ if not row or row[1]!=BRANCH or row[2]!=commit_oid or row[3]!='COMPLETED' or row[4]!='bare+gitea': fail('authorization_writer_ledger_rejected',409)
+
+def reconcile(p:dict[str,Any],s:dict[str,Any],previous:str,new:str,operation_id:str)->dict[str,Any]:
+ inflight=s.get('inflight')
+ if not isinstance(inflight,dict) or inflight.get('previous_head_oid')!=previous or inflight.get('operation_id')!=operation_id: fail('authorization_inflight_rejected',409)
+ if previous!=s['current_head_oid'] or not OID_RE.fullmatch(new): fail('authorization_head_transition_rejected',409)
+ ledger_verified(operation_id,new); four_way(new)
+ s['current_head_oid']=new; s['inflight']=None; s['last_activity_at']=stamp(); save_state(s)
+ ensure_child(p,s,'head_advance')
+ append_audit({'event':'authorization_head_advanced','previous_head_oid':previous,'new_commit_oid':new,'four_way_ref_status':True,'worktree_clean':True})
+ return {'authorization_current_head_oid':new,'automatic_head_advance':True,'four_way_ref_status':True}
+
+def prepare(p:dict[str,Any],s:dict[str,Any],data:dict[str,Any])->dict[str,Any]:
+ required={'expected_current_head_oid','operation_id','idempotency_key','exact_path','content_digest','commit_message_digest','branch','path','message'}
+ if set(data)!=required: fail('authorization_request_schema_rejected',403)
+ if data['branch']!=BRANCH or data['path']!=data['exact_path'] or not path_allowed(p,str(data['path'])): fail('authorization_path_rejected',403)
+ if data['expected_current_head_oid']!=s['current_head_oid'] or not OID_RE.fullmatch(str(data['expected_current_head_oid'])): fail('BRANCH_HEAD_CHANGED',409,current_head_oid=s['current_head_oid'])
+ if not OP_RE.fullmatch(str(data['operation_id'])) or not OP_RE.fullmatch(str(data['idempotency_key'])): fail('authorization_operation_id_rejected',403)
+ if not all(isinstance(data[k],str) and re.fullmatch(r'[0-9a-f]{64}',data[k]) for k in ('content_digest','commit_message_digest')): fail('authorization_digest_rejected',403)
+ if hashlib.sha256(data['message'].encode()).hexdigest()!=data['commit_message_digest']: fail('authorization_commit_message_digest_rejected',403)
+ inflight=s.get('inflight')
+ if inflight:
+  if inflight.get('operation_id')==data['operation_id'] and inflight.get('idempotency_key')==data['idempotency_key']: return {'expected_head_oid':s['current_head_oid'],'idempotency_key':data['idempotency_key']}
+  fail('BRANCH_HEAD_CHANGED',409,current_head_oid=s['current_head_oid'])
+ four_way(s['current_head_oid'])
+ s['inflight']={'operation_id':data['operation_id'],'idempotency_key':data['idempotency_key'],'previous_head_oid':s['current_head_oid'],'path':data['path'],'created_at':stamp()}; s['last_activity_at']=stamp(); save_state(s)
+ append_audit({'event':'write_prepared','operation_id':data['operation_id'],'path':data['path'],'expected_head_oid':s['current_head_oid']})
+ return {'expected_head_oid':s['current_head_oid'],'idempotency_key':data['idempotency_key']}
+
+def test_authorize(p:dict[str,Any],s:dict[str,Any],operation:str)->dict[str,Any]:
+ allowed={'pytest_dormant','pytest_autonomous_release','compileall_autonomous_release','git_diff_check'}
+ if operation not in allowed: fail('candidate_test_executor_operation_rejected',403)
+ four_way(s['current_head_oid'])
+ child=s.get('test_child') or {}; refresh=True
+ try: refresh=(parse_time(child.get('expires_at'))-now()).total_seconds()<=300
+ except Exception: pass
+ if refresh:
+  issued=now().replace(microsecond=0); child={'test_authorization_id':'test-authz-aios-autonomous-release-20260726','grant_id':'test-child-'+issued.strftime('%Y%m%dT%H%M%SZ'),'issued_at':issued.isoformat(),'expires_at':(issued+timedelta(minutes=20)).isoformat()}; s['test_child']=child
+ s['last_activity_at']=stamp(); save_state(s); append_audit({'event':'test_authorized','operation':operation})
+ return {'test_authorization_id':child['test_authorization_id'],'operation':operation,'expires_at':child['expires_at']}
+
+def cleanup(s:dict[str,Any],reason:str)->None:
+ old=projection_token()
+ if old:
+  reg=TokenRegistry(REGISTRY); rec=reg.find(old)
+  if rec: reg.revoke(str(rec['token_id']))
+  try: PROJECTION.unlink()
+  except FileNotFoundError: pass
+  try: post_revoke_401(old)
+  except ControlError: pass
+ for unit in ('aios-chatgpt-autonomous-release-route.service','aios-chatgpt-autonomous-release-writer.service'):
+  subprocess.run(['/usr/bin/systemctl','stop',unit],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
+ subprocess.run(['/usr/bin/systemctl','stop','aios-autonomous-release-dormant-test-executor@*.service'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
+ try: ROUTE_BINDING.unlink()
+ except FileNotFoundError: pass
+ try: SOCKET_PATH.unlink()
+ except FileNotFoundError: pass
+ append_audit({'event':'authorization_cleanup','reason':reason,'projection_removed':not PROJECTION.exists(),'route_overlay_removed':not ROUTE_BINDING.exists(),'task_services_stop_requested':True})
+
+def request(data:dict[str,Any])->dict[str,Any]:
+ op=data.get('op'); f=lock()
+ try:
+  p=parent(); s=state(); task_live(p,s,touch=False)
+  if op=='describe_authorization':
+   four_way(s['current_head_oid'])
+   return {'development_authorization_id':AUTH_ID,'task_id':TASK,'actor_identity':ACTOR,'audience':WRITER_AUDIENCE,'repository':REPO,'branch':BRANCH,'approved_base_oid':BASE,'authorization_status':s['status'],'current_head_oid':s['current_head_oid']}
+  if op=='get_writer_token':
+   four_way(s['current_head_oid']); token=ensure_child(p,s,'scheduled_or_requested_rotation'); return {'token':token,'current_head_oid':s['current_head_oid']}
+  if op=='prepare_write':
+   ensure_child(p,s,'pre_write_quota_check')
+   return prepare(p,s,data.get('request') if isinstance(data.get('request'),dict) else {})
+  if op=='reconcile_commit':
+   r=data.get('result') if isinstance(data.get('result'),dict) else {}; return reconcile(p,s,str(r.get('previous_head_oid','')),str(r.get('new_commit_oid','')),str(r.get('operation_id','')))
+  if op=='fail_write':
+   r=data.get('result') if isinstance(data.get('result'),dict) else {}; inflight=s.get('inflight')
+   if isinstance(inflight,dict) and inflight.get('operation_id')==r.get('operation_id'): s['inflight']=None; save_state(s)
+   return {'cleared':True}
+  if op=='authorize_test': return test_authorize(p,s,str(data.get('operation','')))
+  fail('authorization_operation_rejected',403)
+ finally:
+  fcntl.flock(f.fileno(),fcntl.LOCK_UN); f.close()
+
+def peer_allowed(conn:socket.socket)->bool:
+ try:
+  import struct
+  _pid,uid,gid=struct.unpack('3i',conn.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))
+  return uid==pwd.getpwnam('aiman').pw_uid and gid==grp.getgrnam('gitops').gr_gid
+ except Exception: return False
+
+def serve()->None:
+ SOCKET_DIR.mkdir(parents=True,exist_ok=True); os.chown(SOCKET_DIR,0,grp.getgrnam('gitops').gr_gid); os.chmod(SOCKET_DIR,0o750)
+ try: SOCKET_PATH.unlink()
+ except FileNotFoundError: pass
+ with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as server:
+  server.bind(str(SOCKET_PATH)); os.chown(SOCKET_PATH,0,grp.getgrnam('gitops').gr_gid); os.chmod(SOCKET_PATH,0o660); server.listen(32); server.settimeout(1.0)
+  last=0.0
+  while True:
+   if time.monotonic()-last>30:
+    last=time.monotonic()
+    try:
+     f=lock(); p=parent(); s=state(); task_live(p,s,touch=False); four_way(s['current_head_oid']); ensure_child(p,s,'scheduled_rotation'); fcntl.flock(f.fileno(),fcntl.LOCK_UN); f.close()
+    except ControlError as e:
+     append_audit({'event':'scheduled_check_blocked','error':e.code})
+     if e.code=='authorization_task_terminal': return
+    except Exception: append_audit({'event':'scheduled_check_blocked','error':'authorization_controller_internal_error'})
+   try: conn,_=server.accept()
+   except socket.timeout: continue
+   with conn:
+    if not peer_allowed(conn): conn.sendall(canonical({'ok':False,'status':403,'error':'authorization_peer_rejected'})+b'\n'); continue
+    try:
+     raw=conn.recv(131072); data=json.loads(raw.decode()); result=request(data); conn.sendall(canonical({'ok':True,'result':result})+b'\n')
+    except ControlError as e: conn.sendall(canonical({'ok':False,'status':e.status,'error':e.code,**e.details})+b'\n')
+    except Exception as exc:
+     append_audit({'event':'controller_internal_error','error_type':type(exc).__name__})
+     conn.sendall(canonical({'ok':False,'status':503,'error':'authorization_controller_internal_error'})+b'\n')
+if __name__=='__main__': serve()

active-runtime/app/aios_branch_repair_lease_api.py

@@ -1,89 +0,0 @@
-"""Governed API facade for branch-bound repair leases.
-
-The facade is transport-neutral so the permanent control plane can expose it
-through its existing authenticated loopback/API seam without creating a second
-Git writer or a global credential registry.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Mapping
-
-from branch_repair_lease import LeaseError, RepairLease, RepairLeaseManager, sanitized_lease_view
-
-
-class BranchRepairLeaseAPI:
-    """Validate operation envelopes and return sanitized lease metadata."""
-
-    def __init__(self, manager: RepairLeaseManager) -> None:
-        self.manager = manager
-
-    @staticmethod
-    def _required(request: Mapping[str, Any], name: str) -> Any:
-        value = request.get(name)
-        if value is None or value == "":
-            raise LeaseError(f"missing required field: {name}")
-        return value
-
-    @staticmethod
-    def _view(lease: RepairLease) -> dict[str, Any]:
-        return {"status": "ok", "lease": sanitized_lease_view(lease)}
-
-    def handle(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        try:
-            operation = self._required(request, "operation")
-            owner = str(self._required(request, "owner_identity"))
-            if operation == "issue":
-                lease = self.manager.issue(
-                    task_id=str(self._required(request, "task_id")),
-                    owner_identity=owner,
-                    branch=str(self._required(request, "branch")),
-                    description=str(self._required(request, "description")),
-                    allowed_paths=tuple(self._required(request, "allowed_paths")),
-                    ttl_seconds=int(request.get("ttl_seconds", 3600)),
-                )
-            elif operation == "attach_existing_branch":
-                lease = self.manager.attach_existing_branch(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                )
-            elif operation == "authorize_commit":
-                lease = self.manager.authorize_commit(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                    paths=tuple(self._required(request, "paths")),
-                    content=request.get("content"),
-                )
-            elif operation == "record_commit":
-                lease = self.manager.record_commit(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                    new_head_oid=str(self._required(request, "new_head_oid")),
-                    paths=tuple(self._required(request, "paths")),
-                )
-            elif operation == "recover":
-                lease = self.manager.recover(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            elif operation == "renew":
-                lease = self.manager.renew(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    ttl_seconds=int(self._required(request, "ttl_seconds")),
-                )
-            elif operation == "complete":
-                lease = self.manager.complete(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            elif operation == "revoke":
-                lease = self.manager.revoke(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            else:
-                raise LeaseError("unsupported lease operation")
-            return self._view(lease)
-        except (LeaseError, TypeError, ValueError):
-            return {"status": "blocked", "error": "lease_request_rejected"}

active-runtime/app/aios_branch_repair_lease_cli.py

@@ -1,48 +0,0 @@
-"""Root-only CLI for the branch-bound repair lease API."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import sys
-from pathlib import Path
-
-from aios_branch_repair_lease_api import BranchRepairLeaseAPI
-from branch_repair_lease import GitProbe, LeaseStore
-from branch_repair_lease import RepairLeaseManager
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description="AIOS branch repair lease CLI")
-    parser.add_argument("--store", required=True)
-    parser.add_argument("--bare-repo", required=True)
-    parser.add_argument("--request-file")
-    parser.add_argument("--request-json")
-    args = parser.parse_args()
-    if hasattr(os, "geteuid") and os.geteuid() != 0:
-        print(json.dumps({"status": "blocked", "error": "root_required"}))
-        return 2
-    if bool(args.request_file) == bool(args.request_json):
-        print(json.dumps({"status": "blocked", "error": "one_request_source_required"}))
-        return 2
-    try:
-        raw = (
-            Path(args.request_file).read_text(encoding="utf-8")
-            if args.request_file
-            else str(args.request_json)
-        )
-        request = json.loads(raw)
-        if not isinstance(request, dict):
-            raise ValueError("request must be an object")
-        api = BranchRepairLeaseAPI(RepairLeaseManager(LeaseStore(args.store), GitProbe(args.bare_repo)))
-        response = api.handle(request)
-        print(json.dumps(response, ensure_ascii=True, sort_keys=True, separators=(",", ":")))
-        return 0 if response.get("status") == "ok" else 1
-    except Exception:
-        print(json.dumps({"status": "blocked", "error": "lease_cli_failed"}))
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

active-runtime/app/aios_campaign_recovery.py

@@ -1,104 +0,0 @@
-"""Read-only validation of recovered campaign authorization evidence."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-from pathlib import Path
-import stat
-from typing import Any
-
-
-class RecoveryEvidenceError(RuntimeError):
-    pass
-
-
-def _digest(path: Path) -> str:
-    h = hashlib.sha256()
-    with path.open("rb") as stream:
-        for block in iter(lambda: stream.read(1024 * 1024), b""):
-            h.update(block)
-    return h.hexdigest()
-
-
-def _secure_json(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_MISSING")
-    info = path.stat(follow_symlinks=False)
-    if info.st_uid != 0 or stat.S_IMODE(info.st_mode) & 0o022:
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_PERMISSIONS")
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_INVALID") from exc
-    if not isinstance(value, dict):
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_OBJECT_REQUIRED")
-    return value
-
-
-def load_recovered_authorization(path: str | Path) -> dict[str, Any]:
-    """Verify the recovery receipt, sidecar, and all referenced immutable files."""
-    receipt_path = Path(path)
-    receipt = _secure_json(receipt_path)
-    sidecar = receipt_path.with_suffix(receipt_path.suffix + ".sha256")
-    if sidecar.is_symlink() or not sidecar.is_file():
-        raise RecoveryEvidenceError("RECOVERY_DIGEST_SIDECAR_MISSING")
-    expected = sidecar.read_text(encoding="ascii").split()[0]
-    actual = _digest(receipt_path)
-    if expected != actual:
-        raise RecoveryEvidenceError("RECOVERY_DIGEST_MISMATCH")
-    required = {
-        "schema",
-        "campaign_id",
-        "original_event_id",
-        "original_authorization_digest",
-        "signed_grant_id",
-        "signed_grant_digest",
-        "task_id",
-        "repository",
-        "original_base_oid",
-        "branch",
-        "expected_branch_oid",
-        "recovered_from_existing_evidence",
-        "new_owner_interaction",
-        "recovery_state",
-        "production_side_effect_executed",
-        "global_writes_enabled",
-        "grant_consumed",
-        "owner_authorization_consumed",
-        "original_receipts_immutable",
-        "recovered_at",
-        "evidence_files",
-    }
-    if set(receipt) != required or receipt["schema"] != "aios.owner-authorization-recovery.v1":
-        raise RecoveryEvidenceError("RECOVERY_SCHEMA_INVALID")
-    if receipt["recovered_from_existing_evidence"] is not True or receipt["new_owner_interaction"] is not False:
-        raise RecoveryEvidenceError("RECOVERY_NOT_APPEND_ONLY")
-    if receipt["production_side_effect_executed"] is not False or receipt["global_writes_enabled"] is not False:
-        raise RecoveryEvidenceError("RECOVERY_SCOPE_INVALID")
-    if receipt["recovery_state"] != "RECOVERED_PENDING_CONTINUATION_LEASE":
-        raise RecoveryEvidenceError("RECOVERY_STATE_INVALID")
-    evidence = receipt["evidence_files"]
-    if not isinstance(evidence, list) or not evidence:
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_LIST_INVALID")
-    for item in evidence:
-        if not isinstance(item, dict) or set(item) != {"path", "sha256"}:
-            raise RecoveryEvidenceError("RECOVERY_EVIDENCE_ENTRY_INVALID")
-        target = Path(item["path"])
-        if _digest(target) != item["sha256"]:
-            raise RecoveryEvidenceError("RECOVERY_EVIDENCE_DIGEST_MISMATCH")
-    return {
-        "schema": receipt["schema"],
-        "state": receipt["recovery_state"],
-        "campaign_id": receipt["campaign_id"],
-        "original_event_id": receipt["original_event_id"],
-        "original_authorization_digest": receipt["original_authorization_digest"],
-        "signed_grant_id": receipt["signed_grant_id"],
-        "task_id": receipt["task_id"],
-        "repository": receipt["repository"],
-        "original_base_oid": receipt["original_base_oid"],
-        "branch": receipt["branch"],
-        "expected_branch_oid": receipt["expected_branch_oid"],
-        "digest": actual,
-        "new_owner_interaction": False,
-    }

active-runtime/app/aios_chatgpt_action_task_router/action_task_router.py

@@ -0,0 +1,567 @@
+#!/usr/bin/env python3
+"""Task-bound bridge from the legacy ChatGPT Action to an isolated Writer V2."""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import os
+import re
+import sqlite3
+import socket
+import stat
+import urllib.error
+import urllib.parse
+import urllib.request
+from datetime import datetime, timezone
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from typing import Any
+
+
+CONFIG_PATH = Path(os.environ["AIOS_ACTION_ROUTE_BINDING"])
+POLICY_PATH = Path(os.environ["AIOS_ACTION_ROUTE_PATH_POLICY"])
+KNOWN_IDENTITIES_PATH = Path(os.environ["AIOS_ACTION_ROUTE_KNOWN_IDENTITIES"])
+STATE_PATH = Path(os.environ["AIOS_ACTION_ROUTE_STATE"])
+AUDIT_PATH = Path(os.environ["AIOS_ACTION_ROUTE_AUDIT"])
+HOST = os.environ.get("AIOS_ACTION_ROUTE_HOST", "127.0.0.1")
+PORT = int(os.environ.get("AIOS_ACTION_ROUTE_PORT", "19894"))
+EXPECTED_TASK_ID = os.environ["AIOS_ACTION_ROUTE_TASK_ID"]
+EXPECTED_ROUTE_HEADER = os.environ["AIOS_ACTION_ROUTE_HEADER"]
+AUTHORIZATION_SOCKET = Path(os.environ["AIOS_CONTINUOUS_AUTHORIZATION_SOCKET"])
+OID_RE = re.compile(r"[0-9a-f]{40}")
+SECRET_RE = re.compile(
+    r"(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)"
+    r"\s*[:=]\s*[\"']?([A-Za-z0-9_./+=:-]{16,})"
+)
+SECRET_VALUE_RE = re.compile(
+    r"(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,}|"
+    r"-----BEGIN (?:OPENSSH |RSA |EC )?PRIVATE KEY-----)"
+)
+ALLOWED_REQUEST_FIELDS = frozenset({"base","branch","content","create_branch","message","path","task_id","development_authorization_id","actor_identity","audience","approved_base_oid","expected_current_head_oid","operation_id","idempotency_key","exact_path","content_digest","commit_message_digest"})
+
+
+class RouteError(RuntimeError):
+    def __init__(self, code: str, status: int = 400, **details: Any):
+        super().__init__(code)
+        self.code = code
+        self.status = status
+        self.details = details
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def canonical_json(value: Any) -> bytes:
+    return json.dumps(
+        value, ensure_ascii=False, sort_keys=True, separators=(",", ":")
+    ).encode("utf-8")
+
+
+def load_root_managed_json(
+    path: Path, *, expected_mode: int = 0o640
+) -> tuple[dict[str, Any], bytes]:
+    info = os.lstat(path)
+    if stat.S_ISLNK(info.st_mode) or not stat.S_ISREG(info.st_mode):
+        raise RouteError("writer_route_config_type_rejected", 503)
+    if info.st_uid != 0 or stat.S_IMODE(info.st_mode) & ~expected_mode:
+        raise RouteError("writer_route_config_permissions_rejected", 503)
+    raw = path.read_bytes()
+    try:
+        value = json.loads(raw)
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        raise RouteError("writer_route_config_json_rejected", 503) from None
+    if not isinstance(value, dict):
+        raise RouteError("writer_route_config_object_required", 503)
+    return value, raw
+
+
+def load_binding() -> dict[str, Any]:
+    binding, _ = load_root_managed_json(CONFIG_PATH)
+    required = {
+        "schema_version",
+        "task_id",
+        "writer_instance_id",
+        "repository",
+        "branch",
+        "approved_base_oid",
+        "writer_url",
+        "path_policy_sha256",
+        "action_identities",
+    }
+    if set(binding) != required or binding.get("schema_version") != 1:
+        raise RouteError("writer_route_binding_schema_rejected", 503)
+    if binding["task_id"] != EXPECTED_TASK_ID:
+        raise RouteError("writer_route_task_binding_rejected", 503)
+    if binding["repository"] != "aios/aios":
+        raise RouteError("writer_route_repository_rejected", 503)
+    if not OID_RE.fullmatch(str(binding["approved_base_oid"])):
+        raise RouteError("writer_route_base_oid_rejected", 503)
+    if binding["writer_url"] != "http://127.0.0.1:19893":
+        raise RouteError("writer_route_upstream_rejected", 503)
+    identities = binding.get("action_identities")
+    if not isinstance(identities, list) or len(identities) != 1:
+        raise RouteError("writer_route_action_identity_rejected", 503)
+    identity = identities[0]
+    if (
+        not isinstance(identity, dict)
+        or set(identity) != {"account", "token_sha256"}
+        or identity.get("account") != "chatgpt-gitops-bot"
+        or not re.fullmatch(
+            r"[0-9a-f]{64}", str(identity.get("token_sha256", ""))
+        )
+    ):
+        raise RouteError("writer_route_action_identity_rejected", 503)
+    return binding
+
+
+def allowed_path_scope(binding: dict[str, Any]) -> tuple[set[str], tuple[str, ...]]:
+    policy, raw = load_root_managed_json(POLICY_PATH)
+    actual = hashlib.sha256(raw).hexdigest()
+    if actual != binding["path_policy_sha256"]:
+        raise RouteError("writer_route_path_policy_digest_mismatch", 503)
+    if policy.get("allowed_branch") != binding["branch"]:
+        raise RouteError("writer_route_path_policy_branch_mismatch", 503)
+    operation = (policy.get("allowed_operations") or {}).get("commit_file.atomic")
+    paths = operation.get("exact_paths") if isinstance(operation, dict) else None
+    prefixes = operation.get("prefix_paths") if isinstance(operation, dict) else None
+    if not isinstance(paths, list) or not paths or not all(
+        isinstance(x, str) for x in paths
+    ):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    if not isinstance(prefixes, list) or not prefixes or not all(
+        isinstance(x, str) and x.endswith("/") for x in prefixes
+    ):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    if any(not valid_relative_path(x[:-1]) for x in prefixes):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    if any(not valid_relative_path(x) for x in paths):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    return set(paths), tuple(prefixes)
+
+
+def valid_relative_path(path: str) -> bool:
+    if not isinstance(path, str) or not path or path != path.strip():
+        return False
+    if "\x00" in path or "\\" in path:
+        return False
+    try:
+        decoded = urllib.parse.unquote(path, errors="strict")
+    except (UnicodeDecodeError, ValueError):
+        return False
+    if decoded != path:
+        return False
+    posix = PurePosixPath(path)
+    windows = PureWindowsPath(path)
+    return not (
+        posix.is_absolute()
+        or windows.is_absolute()
+        or bool(windows.drive)
+        or any(part in {"", ".", ".."} for part in path.split("/"))
+    )
+
+
+def path_allowed(binding: dict[str, Any], path: str) -> bool:
+    if not valid_relative_path(path):
+        return False
+    exact_paths, prefixes = allowed_path_scope(binding)
+    return path in exact_paths or any(path.startswith(prefix) for prefix in prefixes)
+
+
+def bearer(headers: Any) -> str:
+    value = headers.get("Authorization", "")
+    if not value.startswith("Bearer "):
+        raise RouteError("unauthorized", 401)
+    token = value[7:].strip()
+    if not token:
+        raise RouteError("unauthorized", 401)
+    return token
+
+
+def authorize_action(headers: Any, binding: dict[str, Any]) -> str:
+    digest = hashlib.sha256(bearer(headers).encode("utf-8")).hexdigest()
+    identity = binding["action_identities"][0]
+    if not hmac.compare_digest(identity["token_sha256"], digest):
+        known, _ = load_root_managed_json(KNOWN_IDENTITIES_PATH)
+        identities = known.get("identities")
+        if known.get("schema_version") != 1 or not isinstance(identities, list):
+            raise RouteError("writer_route_identity_catalog_rejected", 503)
+        observed = "unregistered"
+        allowed_accounts = {
+            "chatgpt-gitops-bot",
+            "gitops-write-bot",
+            "codex-gitops-bot",
+        }
+        for candidate in identities:
+            if not isinstance(candidate, dict) or set(candidate) != {
+                "account",
+                "token_sha256",
+            }:
+                raise RouteError("writer_route_identity_catalog_rejected", 503)
+            account = str(candidate.get("account", ""))
+            token_sha256 = str(candidate.get("token_sha256", ""))
+            if account not in allowed_accounts or not re.fullmatch(
+                r"[0-9a-f]{64}", token_sha256
+            ):
+                raise RouteError("writer_route_identity_catalog_rejected", 503)
+            if hmac.compare_digest(token_sha256, digest):
+                observed = account
+        raise RouteError(
+            "writer_route_action_identity_rejected",
+            403,
+            accepted_action_identity=str(identity["account"]),
+            observed_action_identity=observed,
+            identity_alias_accepted=False,
+        )
+    return str(identity["account"])
+
+
+def authorization_call(operation: str, **payload: Any) -> dict[str, Any]:
+    request = {"op": operation, **payload}
+    try:
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
+            client.settimeout(15)
+            client.connect(str(AUTHORIZATION_SOCKET))
+            client.sendall(canonical_json(request))
+            raw = client.recv(131072)
+        response = json.loads(raw.decode("utf-8"))
+    except (OSError, TimeoutError, UnicodeDecodeError, json.JSONDecodeError):
+        raise RouteError("authorization_controller_unavailable", 503) from None
+    if not isinstance(response, dict) or not response.get("ok"):
+        if not isinstance(response, dict):
+            raise RouteError("authorization_controller_response_rejected", 503)
+        details = {k: v for k, v in response.items() if k not in {"ok", "status", "error"}}
+        raise RouteError(str(response.get("error") or "authorization_controller_rejected"), int(response.get("status") or 503), **details)
+    result = response.get("result")
+    if not isinstance(result, dict):
+        raise RouteError("authorization_controller_response_rejected", 503)
+    return result
+
+
+def writer_token() -> str:
+    value = authorization_call("get_writer_token").get("token")
+    if not isinstance(value, str) or len(value.encode("utf-8")) < 32:
+        raise RouteError("writer_route_credential_rejected", 503)
+    return value
+
+
+def writer_call(
+    binding: dict[str, Any],
+    method: str,
+    path: str,
+    payload: dict[str, Any] | None = None,
+) -> tuple[int, dict[str, Any]]:
+    data = canonical_json(payload) if payload is not None else None
+    headers = {"Authorization": "Bearer " + writer_token()}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    request = urllib.request.Request(
+        binding["writer_url"] + path, data=data, method=method, headers=headers
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=90) as response:
+            body = json.loads(response.read())
+            return response.status, body
+    except urllib.error.HTTPError as exc:
+        try:
+            body = json.loads(exc.read())
+        except Exception:
+            body = {"error": "writer_route_upstream_non_json_error"}
+        return exc.code, body
+    except (OSError, TimeoutError):
+        raise RouteError("writer_route_upstream_unavailable", 503) from None
+
+
+def validate_request(data: Any, binding: dict[str, Any]) -> dict[str, Any]:
+    if not isinstance(data, dict):
+        raise RouteError("writer_route_request_object_required")
+    if not {"branch", "path", "content"}.issubset(data):
+        raise RouteError("writer_route_request_incomplete")
+    if not set(data).issubset(ALLOWED_REQUEST_FIELDS):
+        raise RouteError("writer_route_request_fields_rejected")
+    if data["branch"] != binding["branch"]:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if data.get("create_branch") not in (None, False):
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if data.get("base", "main") not in {"main", binding["approved_base_oid"]}:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    path = data["path"]
+    if not isinstance(path, str) or not path_allowed(binding, path):
+        raise RouteError("writer_route_request_binding_failed", 403)
+    content = data["content"]
+    if not isinstance(content, str) or "\x00" in content or "\r" in content:
+        raise RouteError("writer_route_content_rejected")
+    if len(content.encode("utf-8")) > 1_048_576:
+        raise RouteError("writer_route_content_too_large", 413)
+    if SECRET_RE.search(content) or SECRET_VALUE_RE.search(content):
+        raise RouteError("writer_route_secret_content_rejected", 403)
+    message = data.get("message") or f"chore(chatgpt): update {path}"
+    if not isinstance(message, str) or not 1 <= len(message) <= 200 or "\x00" in message or "\n" in message or "\r" in message:
+        raise RouteError("writer_route_message_rejected")
+    return {"branch": binding["branch"], "path": path, "content": content, "message": message}
+
+
+def complete_request(data: dict[str, Any], normalized: dict[str, Any], binding: dict[str, Any], account: str) -> dict[str, Any]:
+    authorization = authorization_call("describe_authorization")
+    expected = {
+        "task_id": binding["task_id"],
+        "development_authorization_id": authorization.get("development_authorization_id"),
+        "actor_identity": account,
+        "audience": authorization.get("audience"),
+        "branch": binding["branch"],
+        "approved_base_oid": binding["approved_base_oid"],
+    }
+    required = {
+        "task_id": EXPECTED_TASK_ID,
+        "development_authorization_id": "authz-aios-autonomous-release-20260726",
+        "actor_identity": "chatgpt-gitops-bot",
+        "audience": "chatgpt-autonomous-release-writer",
+        "branch": binding["branch"],
+        "approved_base_oid": binding["approved_base_oid"],
+    }
+    if expected != required or authorization.get("authorization_status") != "ACTIVE" or authorization.get("current_head_oid") is None:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    for key, value in required.items():
+        if key in data and data[key] != value:
+            raise RouteError("writer_route_request_binding_failed", 403)
+    if "exact_path" in data and data["exact_path"] != normalized["path"]:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    current_head = str(authorization["current_head_oid"])
+    if not OID_RE.fullmatch(current_head):
+        raise RouteError("authorization_current_head_rejected", 503)
+    if "expected_current_head_oid" in data and data["expected_current_head_oid"] != current_head:
+        raise RouteError("BRANCH_HEAD_CHANGED", 409, current_head_oid=current_head)
+    content_digest = hashlib.sha256(normalized["content"].encode("utf-8")).hexdigest()
+    message_digest = hashlib.sha256(normalized["message"].encode("utf-8")).hexdigest()
+    if "content_digest" in data and data["content_digest"] != content_digest:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if "commit_message_digest" in data and data["commit_message_digest"] != message_digest:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    seed = {**required, "expected_current_head_oid": current_head, "path": normalized["path"], "content_digest": content_digest, "commit_message_digest": message_digest}
+    request_digest = hashlib.sha256(canonical_json(seed)).hexdigest()
+    idempotency_key = "action-" + request_digest
+    operation_id = hashlib.sha256((EXPECTED_TASK_ID + "\0" + idempotency_key).encode("utf-8")).hexdigest()
+    if "idempotency_key" in data and data["idempotency_key"] != idempotency_key:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if "operation_id" in data and data["operation_id"] != operation_id:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    return {**normalized, **required, "expected_current_head_oid": current_head, "operation_id": operation_id, "idempotency_key": idempotency_key, "exact_path": normalized["path"], "content_digest": content_digest, "commit_message_digest": message_digest, "request_digest": request_digest}
+
+
+def current_writer_head(binding: dict[str, Any]) -> str:
+    status, body = writer_call(binding, "GET", "/api/runtime-status")
+    if status != 200:
+        raise RouteError(
+            "writer_route_runtime_status_failed", 503, upstream_status=status
+        )
+    required = {
+        "service": "chatgpt-autonomous-release-writer",
+        "writes_enabled": True,
+        "allowed_branch": binding["branch"],
+        "approved_base_oid": binding["approved_base_oid"],
+        "path_policy_sha256": binding["path_policy_sha256"],
+    }
+    if any(body.get(key) != value for key, value in required.items()):
+        raise RouteError("writer_route_runtime_binding_mismatch", 503)
+    head = str(body.get("workspace_head_oid", ""))
+    if not OID_RE.fullmatch(head):
+        raise RouteError("writer_route_runtime_head_rejected", 503)
+    return head
+
+
+def operation_binding(
+    request_digest: str, binding: dict[str, Any]
+) -> tuple[str, str]:
+    STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
+    with sqlite3.connect(STATE_PATH, timeout=30, isolation_level=None) as db:
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        db.execute(
+            """
+            CREATE TABLE IF NOT EXISTS action_operations (
+                request_digest TEXT PRIMARY KEY,
+                expected_head_oid TEXT NOT NULL,
+                idempotency_key TEXT NOT NULL UNIQUE,
+                created_at TEXT NOT NULL
+            )
+            """
+        )
+        row = db.execute(
+            "SELECT expected_head_oid,idempotency_key FROM action_operations "
+            "WHERE request_digest=?",
+            (request_digest,),
+        ).fetchone()
+        if row:
+            return str(row[0]), str(row[1])
+    head = current_writer_head(binding)
+    key = "action-" + request_digest
+    with sqlite3.connect(STATE_PATH, timeout=30, isolation_level=None) as db:
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        db.execute("BEGIN IMMEDIATE")
+        db.execute(
+            "INSERT OR IGNORE INTO action_operations"
+            "(request_digest,expected_head_oid,idempotency_key,created_at) "
+            "VALUES(?,?,?,?)",
+            (request_digest, head, key, utc_now()),
+        )
+        row = db.execute(
+            "SELECT expected_head_oid,idempotency_key FROM action_operations "
+            "WHERE request_digest=?",
+            (request_digest,),
+        ).fetchone()
+        db.execute("COMMIT")
+    return str(row[0]), str(row[1])
+
+
+def append_audit(event: dict[str, Any]) -> None:
+    AUDIT_PATH.parent.mkdir(parents=True, exist_ok=True)
+    flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND | getattr(os, "O_NOFOLLOW", 0)
+    fd = os.open(AUDIT_PATH, flags, 0o600)
+    try:
+        os.write(fd, canonical_json(event) + b"\n")
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "AIOSActionTaskRouter/1"
+
+    def log_message(self, _format: str, *_args: Any) -> None:
+        return
+
+    def send_json(self, status: int, value: dict[str, Any]) -> None:
+        body = json.dumps(value, ensure_ascii=False, sort_keys=True).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self) -> None:
+        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+        if path != "/health":
+            return self.send_json(404, {"error": "not_found"})
+        try:
+            binding = load_binding()
+            self.send_json(
+                200,
+                {
+                    "status": "ok",
+                    "service": "aios-action-task-router",
+                    "task_id": binding["task_id"],
+                    "writer_instance_id": binding["writer_instance_id"],
+                    "branch": binding["branch"],
+                },
+            )
+        except RouteError as exc:
+            self.send_json(exc.status, {"error": exc.code, **exc.details})
+
+    def do_POST(self) -> None:
+        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+        if path != "/api/file":
+            return self.send_json(404, {"error": "not_found"})
+        if self.client_address[0] not in {"127.0.0.1", "::1"}:
+            return self.send_json(403, {"error": "writer_route_source_rejected"})
+        if self.headers.get("X-AIOS-Route-Task") != EXPECTED_ROUTE_HEADER:
+            return self.send_json(403, {"error": "writer_route_header_rejected"})
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+            if not 0 < length <= 1_100_000:
+                raise RouteError("writer_route_content_length_rejected", 413)
+            try:
+                data = json.loads(self.rfile.read(length).decode("utf-8"))
+            except (UnicodeDecodeError, json.JSONDecodeError):
+                raise RouteError("writer_route_request_json_rejected") from None
+            binding = load_binding()
+            account = authorize_action(self.headers, binding)
+            normalized = validate_request(data, binding)
+            normalized = complete_request(data, normalized, binding, account)
+            prepared = authorization_call("prepare_write", request={key: normalized[key] for key in ("expected_current_head_oid", "operation_id", "idempotency_key", "exact_path", "content_digest", "commit_message_digest", "branch", "path", "message")})
+            expected_head = str(prepared["expected_head_oid"])
+            writer_payload = {"branch": normalized["branch"], "path": normalized["path"], "content": normalized["content"], "message": normalized["message"], "expected_head_oid": expected_head, "idempotency_key": str(prepared["idempotency_key"])}
+            request_digest = hashlib.sha256(canonical_json({"task_id": binding["task_id"], "operation_id": normalized["operation_id"], "idempotency_key": normalized["idempotency_key"], "content_digest": normalized["content_digest"], "commit_message_digest": normalized["commit_message_digest"]})).hexdigest()
+            status, result = writer_call(
+                binding, "POST", "/api/commit-file", writer_payload
+            )
+            audit = {
+                "at": utc_now(),
+                "task_id": binding["task_id"],
+                "writer_instance_id": binding["writer_instance_id"],
+                "account": account,
+                "branch": normalized["branch"],
+                "path": normalized["path"],
+                "request_digest": request_digest,
+                "expected_head_oid": expected_head,
+                "status": status,
+                "operation_id": result.get("operation_id"),
+                "commit_oid": result.get("commit_oid"),
+                "error": result.get("error"),
+                "secrets_included": False,
+            }
+            append_audit(audit)
+            if status != 200:
+                try:
+                    authorization_call("fail_write", result={"operation_id": normalized["operation_id"]})
+                except RouteError:
+                    pass
+                return self.send_json(status, result)
+            advanced = authorization_call("reconcile_commit", result={"previous_head_oid": expected_head, "new_commit_oid": result.get("commit_oid"), "operation_id": result.get("operation_id")})
+            return self.send_json(
+                200,
+                {
+                    "status": "committed",
+                    "branch": normalized["branch"],
+                    "path": normalized["path"],
+                    "commit": {
+                        "status": "committed",
+                        "branch": normalized["branch"],
+                        "rev": result.get("commit_oid"),
+                        "previous_head_oid": expected_head,
+                        "new_tree_oid": result.get("new_tree_oid"),
+                        "push_status": result.get("push_status"),
+                        "four_way_ref_status": advanced.get("four_way_ref_status") is True,
+                        "sync": {"status": "verified", "target": "bare+git-ls-remote+gitea-api"},
+                    },
+                    "writer_instance_id": binding["writer_instance_id"],
+                    "operation_id": result.get("operation_id"),
+                    "idempotent": result.get("idempotent"),
+                    "secrets_included": False,
+                },
+            )
+        except RouteError as exc:
+            if exc.code == "writer_route_action_identity_rejected":
+                try:
+                    append_audit(
+                        {
+                            "at": utc_now(),
+                            "task_id": EXPECTED_TASK_ID,
+                            "event": "action_identity_rejected",
+                            "accepted_action_identity": exc.details.get(
+                                "accepted_action_identity"
+                            ),
+                            "observed_action_identity": exc.details.get(
+                                "observed_action_identity"
+                            ),
+                            "identity_alias_accepted": False,
+                            "secrets_included": False,
+                        }
+                    )
+                except Exception:
+                    pass
+            self.send_json(exc.status, {"error": exc.code, **exc.details})
+        except Exception:
+            self.send_json(500, {"error": "writer_route_internal_error"})
+
+
+def main() -> None:
+    load_binding()
+    server = ThreadingHTTPServer((HOST, PORT), Handler)
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()

active-runtime/app/aios_chatgpt_actions_api.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 from __future__ import annotations
-import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, urllib.request, uuid
+import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, uuid
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
@@ -22,15 +22,8 @@ from gitea_tag_publication import (
     TagPublisher,
     redact,
     validate_version,
-    validate_gitea_api_url,
 )
-try:
-    from orchestrator.action_monitor import ActionMonitor
-except ModuleNotFoundError:
-    # The deployed service normally supplies runtime/agent-os on sys.path.
-    # Keep direct, isolated contract execution bound to the repository copy.
-    sys.path.insert(0, str(Path(__file__).resolve().parents[2] / "runtime" / "agent-os"))
-    from orchestrator.action_monitor import ActionMonitor
+from orchestrator.action_monitor import ActionMonitor
 from silent_release_hardening import (
     ApprovalKeyRing,
     ApprovalRevocationStore,
@@ -40,11 +33,6 @@ from silent_release_hardening import (
     SignedReleasePlanApproval,
     SilentReleaseActionService,
 )
-try:
-    from aios_gitops_job_controller import GitOpsJobController, JobError, ServiceUnavailable, JobStore
-except ModuleNotFoundError:
-    sys.path.insert(0, str(Path(__file__).resolve().parent))
-    from aios_gitops_job_controller import GitOpsJobController, JobError, ServiceUnavailable, JobStore
 try:
     from authoritative_git import (
         AuthoritativeGitError,
@@ -70,11 +58,6 @@ except ModuleNotFoundError:
         repository_snapshot,
         run_authoritative_git,
     )
-try:
-    from aios_repository_discovery import RepositoryDiscovery, RepositoryDiscoveryError
-except ModuleNotFoundError:
-    sys.path.insert(0, str(Path(__file__).resolve().parent))
-    from aios_repository_discovery import RepositoryDiscovery, RepositoryDiscoveryError
 
 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WS = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
@@ -120,8 +103,6 @@ READ_ONLY_GET_PATHS = frozenset({
     '/admin/ai-evolution/api/data',
     '/api/release-consistency', '/api/tag-publication-status',
     '/api/release-acceptance',
-    '/api/repository/tree', '/api/repository/search',
-    '/api/repository/diff-index', '/api/repository/file',
     '/getReleaseCandidate', '/getReleasePlan', '/getReleaseAcceptance',
     '/getApprovalEnvelope', '/getReleaseSaga', '/getCapabilityStatus',
     '/getRecoveryStatus',
@@ -139,12 +120,6 @@ def reject_non_read_http(handler, method: str, path: str) -> bool:
         return False
     if path in SILENT_RELEASE_POST_PATHS:
         return False
-    if (
-        method == 'POST'
-        and path in ('/api/file', '/api/commit-file')
-        and os.getenv('AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED', os.getenv('AIOS_GITOPS_JOB_CONTROLLER_ENABLED', 'false')).lower() in {'1', 'true', 'yes', 'on'}
-    ):
-        return False
     decision = evaluate_git_write(WS)
     if decision.allowed:
         return False
@@ -322,7 +297,8 @@ def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
         raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
 
 def existing_tag_target(tag: str) -> str | None:
-    validate_version(tag)
+    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
+        raise ValueError('invalid release version')
     try:
         result = run_authoritative_git(
             ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
@@ -355,80 +331,9 @@ def required_authoritative_git_dir() -> Path:
     return Path(str(snapshot["authoritative_git_dir"]))
 
 
-_DISCOVERY_ACTIONS = {
-    '/api/repository/tree': (
-        'list_repository_tree',
-        {'repository', 'ref', 'limit'},
-        {'prefix', 'depth', 'cursor'},
-    ),
-    '/api/repository/search': (
-        'search_repository_source',
-        {'repository', 'ref', 'query', 'max_matches', 'max_bytes'},
-        {'path_globs', 'cursor'},
-    ),
-    '/api/repository/diff-index': (
-        'get_diff_index',
-        {'repository', 'from', 'to', 'limit'},
-        {'path_prefix', 'cursor'},
-    ),
-    '/api/repository/file': (
-        'read_repository_file',
-        {'repository', 'ref', 'path'},
-        {'max_bytes'},
-    ),
-}
-
-
-def repository_discovery_request(
-    path: str, query: dict[str, list[str]]
-) -> dict[str, Any]:
-    operation, required, optional = _DISCOVERY_ACTIONS[path]
-    if set(query) - required - optional:
-        raise ValueError('unknown repository discovery query field')
-    request: dict[str, Any] = {}
-    for key, values in query.items():
-        if key == 'path_globs':
-            if not values:
-                raise ValueError('empty repository discovery path glob')
-            request[key] = list(values)
-            continue
-        if len(values) != 1:
-            raise ValueError('duplicate repository discovery query field')
-        value: Any = values[0]
-        if key in {'depth', 'limit', 'max_matches', 'max_bytes'}:
-            try:
-                value = int(value, 10)
-            except (TypeError, ValueError) as exc:
-                raise ValueError('invalid repository discovery integer') from exc
-        request[key] = value
-    if required - set(request):
-        raise ValueError('missing repository discovery query field')
-    if not REPOSITORY_IDENTITY:
-        raise RepositoryDiscoveryError('REPOSITORY_DISCOVERY_UNAVAILABLE')
-    try:
-        discovery = RepositoryDiscovery(
-            allowed_repositories=(REPOSITORY_IDENTITY,),
-            git_dir=required_authoritative_git_dir(),
-            cursor_secret=os.getenv('AIOS_REPOSITORY_DISCOVERY_CURSOR_SECRET'),
-        )
-    except RuntimeError as exc:
-        if isinstance(exc, RepositoryDiscoveryError):
-            raise
-        raise RepositoryDiscoveryError('REPOSITORY_DISCOVERY_UNAVAILABLE') from exc
-    public_to_internal = {
-        'ref': 'revision',
-        'path': 'file_path',
-        'path_prefix': 'prefix',
-    }
-    internal_request = {
-        public_to_internal.get(key, key): value for key, value in request.items()
-    }
-    return dict(getattr(discovery, operation)(internal_request))
-
-
 def publication_publisher() -> TagPublisher:
     authoritative_repo = required_authoritative_git_dir()
-    publisher = TagPublisher(
+    return TagPublisher(
         WS,
         GitTagBackend(WS, authoritative_repo=authoritative_repo),
         GiteaTagClient(
@@ -439,10 +344,6 @@ def publication_publisher() -> TagPublisher:
         ),
         os.getenv('AIOS_GITOPS_GITEA_REMOTE','gitea'),
     )
-    publisher.baseline_path = Path(os.getenv(
-        'AIOS_GITOPS_BASELINE_AUTHORITY', str(WS / 'baseline' / 'current.json')
-    ))
-    return publisher
 
 def commit(paths, msg):
     ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
@@ -492,71 +393,15 @@ class H(BaseHTTPRequestHandler):
         if not a['ok']: self.sendj({'error':'unauthorized','hint':'Bearer token required'},401); return None
         if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
         return a
-    def bridge_release(self, path, data):
-        route = {
-            '/createTagApprovalRequest': '/v2/tag/approval-request',
-            '/requestOrCreateTag': '/v2/tag/publish',
-            '/getTagPublicationStatus': '/v2/tag/status',
-            '/buildProductionArtifact': '/v2/release/artifact',
-            '/executeApprovedProductionRelease': '/v2/release/execute',
-            '/getReleaseConsistency': '/v2/release/consistency',
-            '/runReleaseAcceptance': '/v2/release/acceptance',
-        }.get(path)
-        if route is None:
-            raise ValueError('governed_release_route_invalid')
-        base = os.getenv('AIOS_BRIDGE_V2_URL', 'http://127.0.0.1:18892').rstrip('/')
-        request = urllib.request.Request(
-            base + route,
-            data=json.dumps(data, sort_keys=True, separators=(',', ':')).encode('utf-8'),
-            headers={'Content-Type': 'application/json'},
-            method='POST',
-        )
-        try:
-            with urllib.request.urlopen(request, timeout=30) as response:
-                result = json.loads(response.read().decode('utf-8'))
-                return self.sendj(result, response.status)
-        except urllib.error.HTTPError as exc:
-            try:
-                body = json.loads(exc.read().decode('utf-8'))
-            except Exception:
-                body = {'error': 'bridge_http_error'}
-            return self.sendj(body, exc.code)
-        except (urllib.error.URLError, TimeoutError) as exc:
-            return self.sendj({'error': 'GOVERNED_BRIDGE_UNAVAILABLE', 'detail': type(exc).__name__}, 503)
-    def do_POST(self):
-        path = urllib.parse.urlparse(self.path).path
-        if path in _DISCOVERY_ACTIONS:
-            return self.sendj({'error': 'method_not_allowed'},405)
-        if path in {
-            '/createTagApprovalRequest', '/requestOrCreateTag', '/getTagPublicationStatus',
-            '/buildProductionArtifact', '/executeApprovedProductionRelease',
-            '/getReleaseConsistency', '/runReleaseAcceptance',
-        }:
-            actor = self.need('tag:create')
-            if not actor:
-                return
-            return self.bridge_release(path, self.body())
-        if reject_non_read_http(self, 'POST', path):
-            return
-        return self.sendj({'error': 'not_found', 'path': path}, 404)
     def do_GET(self):
         u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
         if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
-        if len(self.path) > 8192:
-            return self.sendj({'error':'query_too_large'},413)
-        try:
-            q=urllib.parse.parse_qs(
-                u.query, keep_blank_values=True, max_num_fields=64
-            )
-        except ValueError:
-            return self.sendj({'error':'query_invalid'},400)
+        q=urllib.parse.parse_qs(u.query)
         try:
             if path in ('/health','/api/health'): return self.sendj({'status':'ok','service':'chatgpt-gitops-adapter','workspace':str(WS)})
             if path in ('/api/openapi.yaml','/api/openapi-chatgpt-actions.yaml','/api/schema'):
                 return self.sendt(OPENAPI.read_text(encoding='utf-8'), 'application/yaml; charset=utf-8') if OPENAPI.exists() else self.sendj({'error':'schema_missing'},404)
             if path in ('/api','/api/status'): return self.sendj(api_spec())
-            if path in _DISCOVERY_ACTIONS:
-                return self.sendj(repository_discovery_request(path, q))
             if path in ('/api/base','/api/baseline','/base'):
                 data=jload(WS/'baseline'/'current.json', {})
                 data.setdefault('authoritative_repository', repository_snapshot(
@@ -609,15 +454,7 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj({'error':redact(exc)},413)
                 except (AuthoritativeGitError, RuntimeError) as exc:
                     return self.sendj({'error':redact(exc)},503)
-                payload = {'from': frm, 'to': to, 'diff': diff}
-                payload.update({
-                    key: diff[key]
-                    for key in (
-                        'from_oid', 'to_oid', 'changed_paths', 'stats',
-                        'total_size_bytes', 'truncated', 'patch_limit_bytes',
-                    )
-                })
-                return self.sendj(payload)
+                return self.sendj({'from':frm,'to':to,'diff':diff})
             if path in ('/api/patch','/api/patches','/api/branches','/patch'):
                 snapshot = repository_snapshot(
                     git_dir=AUTHORITATIVE_GIT_DIR,
@@ -729,8 +566,7 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj(
                         service.get_capability_status(candidate_id)
                     )
-                result = service.get_release_saga(candidate_id)
-                return self.sendj(result, 404 if result.get('status') == 'NOT_FOUND' else 200)
+                return self.sendj(service.get_release_saga(candidate_id))
             if path == '/getRecoveryStatus':
                 return self.sendj(
                     silent_release_service().get_recovery_status()
@@ -743,8 +579,6 @@ class H(BaseHTTPRequestHandler):
             return self.sendj({'error':'not_found','path':path},404)
         except FileNotFoundError:
             return self.sendj({'error':'release candidate not found'},404)
-        except RepositoryDiscoveryError as e:
-            return self.sendj({'error': redact(e)}, getattr(e, 'status_code', 400))
         except ValueError as e:
             error=redact(e)
             monitor.record_failure('do_GET', error, {'path':path})
@@ -761,8 +595,6 @@ class H(BaseHTTPRequestHandler):
         return self.sendj({'error':'not_found','path':path},404)
     def do_POST(self):
         path=urllib.parse.urlparse(self.path).path.rstrip('/')
-        if path in _DISCOVERY_ACTIONS:
-            return self.sendj({'error':'method_not_allowed'},405)
         if reject_non_read_http(self, 'POST', path): return
         data=self.body()
         try:
@@ -834,44 +666,7 @@ class H(BaseHTTPRequestHandler):
     def file(self,data):
         a=self.need('file:write');
         if not a: return
-        if os.getenv('AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED', os.getenv('AIOS_GITOPS_JOB_CONTROLLER_ENABLED', 'false')).lower() not in {'1','true','yes','on'}:
-            return self.sendj({'error':'DURABLE_JOB_CONTROLLER_UNAVAILABLE','retryable':True},503)
-        try:
-            path = relpath(str(data.get('path') or ''))
-            branch = str(data.get('branch') or '')
-            expected = str(data.get('expected_branch_oid') or '')
-            campaign_id = str(data.get('campaign_id') or os.getenv('AIOS_GITOPS_CAMPAIGN_ID') or '')
-            supplied_digest = str(data.get('payload_digest') or '')
-            content = data.get('content')
-            payload_bytes = None
-            if content is not None:
-                payload_bytes = content.encode('utf-8') if isinstance(content, str) else json.dumps(content, sort_keys=True, ensure_ascii=False).encode('utf-8')
-            payload_digest = supplied_digest or hashlib.sha256(payload_bytes or b'').hexdigest()
-            if not campaign_id or not branch or not expected:
-                return self.sendj({'error':'JOB_BINDING_REQUIRED','retryable':False},409)
-            request = {
-                'campaign_id': campaign_id,
-                'repository': REPOSITORY_IDENTITY or 'aios/aios',
-                'operation': 'commit-file',
-                'branch': branch,
-                'expected_branch_oid': expected,
-                'payload_digest': payload_digest,
-                # The controller persists only the binding and digest. Raw
-                # content is never copied into durable state or logs.
-            }
-            receipt = GitOpsJobController(
-                JobStore(Path(os.getenv('AIOS_GITOPS_JOB_ROOT', '/var/lib/aios-gitops/jobs')))
-            ).submit(request, payload=payload_bytes)
-            return self.sendj({
-                'job_id': receipt.job_id,
-                'state': receipt.state.value,
-                'side_effect_state': receipt.side_effect_state,
-                'retryable': receipt.http_status == 503,
-            }, receipt.http_status)
-        except ServiceUnavailable as exc:
-            return self.sendj({'error':str(exc),'layer':'durable_job','retryable':True,'side_effect_state':'UNKNOWN'},503)
-        except JobError as exc:
-            return self.sendj({'error':str(exc),'retryable':False},409)
+        b=checkout(data.get('branch'), data.get('base','main'), bool(data.get('create_branch'))); r=write_file(data.get('path'), data.get('content','')); c=commit([r], data.get('message') or f'chore(chatgpt): update {r}'); audit(a['account'],'file',r,{'branch':b,'commit':c}); self.sendj({'status':'committed','branch':b,'path':r,'commit':c})
     def commit(self,data):
         a=self.need('commit:create');
         if not a: return
@@ -885,10 +680,7 @@ class H(BaseHTTPRequestHandler):
         a=self.need('tag:create');
         if not a: return
         ver=data.get('version') or data.get('tag')
-        try:
-            validate_version(ver)
-        except ValueError:
-            return self.sendj({'error':'version must match VxRxCx'},400)
+        if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
         if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
             return self.sendj({
                 'error':'production_tag_evidence_required',
@@ -1059,11 +851,9 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
 
 
 def api_spec():
-    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/repository/tree','GET /api/repository/search','GET /api/repository/diff-index','GET /api/repository/file','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
+    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
 
 def main():
-    validate_gitea_api_url(os.getenv('AIOS_GITOPS_GITEA_API_URL', ''))
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()
-

active-runtime/app/aios_chatgpt_bridge_v2.py

@@ -1,349 +0,0 @@
-"""ChatGPT GitOps Bridge v2 contract and governed release operations."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import hashlib
-from pathlib import Path
-from typing import Any, Callable, Mapping
-
-from aios_task_admission_bridge_contract import (
-    TASK_ADMISSION_OPERATION_OPTIONAL_FIELDS,
-    TASK_ADMISSION_OPERATION_REQUIRED_FIELDS,
-    TASK_ADMISSION_ROUTES,
-)
-
-
-BRIDGE_SCHEMA_VERSION = "aios.chatgpt-gitops-bridge.v2"
-BRIDGE_OPERATIONS = (
-    "getRuntimeStatus",
-    "getGovernedWriteCapabilities",
-    "createGovernedTask",
-    "projectOnlineAgentExecution",
-    "acquireWriterLease",
-    "commitFileGoverned",
-    "commitFilesGoverned",
-    "getGitOpsJob",
-    "resumeGitOpsJob",
-    "reconcileGitOpsJob",
-    "createTagApprovalRequest",
-    "requestOrCreateTag",
-    "getTagPublicationStatus",
-    "buildProductionArtifact",
-    "executeApprovedProductionRelease",
-    "getReleaseConsistency",
-    "runReleaseAcceptance",
-    "getControlPlaneSnapshot",
-    "listRepositoryTree",
-    "searchRepositorySource",
-    "getDiffIndex",
-    "readRepositoryFile",
-)
-
-TASK_ADMISSION_OPERATIONS = tuple(TASK_ADMISSION_OPERATION_REQUIRED_FIELDS)
-
-OPERATION_REQUIRED_FIELDS = {
-    "createGovernedTask": ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key"),
-    "projectOnlineAgentExecution": ("task_id", "required_capabilities"),
-    "acquireWriterLease": ("schema", "task_id", "job_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "lease_seconds"),
-    "commitFileGoverned": ("task_id", "job_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "path", "content_base64", "message"),
-    "commitFilesGoverned": ("task_id", "job_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "files", "message"),
-    "getGitOpsJob": ("task_id", "job_id"),
-    "resumeGitOpsJob": ("task_id", "job_id", "expected_revision"),
-    "reconcileGitOpsJob": ("task_id", "job_id", "expected_revision"),
-    "createTagApprovalRequest": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "owner_approval", "execute"),
-    "requestOrCreateTag": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
-    "getTagPublicationStatus": ("version",),
-    "buildProductionArtifact": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
-    "executeApprovedProductionRelease": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
-    "getReleaseConsistency": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
-    "runReleaseAcceptance": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
-    "getControlPlaneSnapshot": (),
-    **TASK_ADMISSION_OPERATION_REQUIRED_FIELDS,
-    "listRepositoryTree": ("repository", "ref", "limit"),
-    "searchRepositorySource": ("repository", "ref", "query", "max_matches", "max_bytes"),
-    "getDiffIndex": ("repository", "from", "to", "limit"),
-    "readRepositoryFile": ("repository", "ref", "path"),
-}
-
-OPERATION_OPTIONAL_FIELDS = {
-    "listRepositoryTree": ("prefix", "depth", "cursor"),
-    "searchRepositorySource": ("path_globs", "cursor"),
-    "getDiffIndex": ("path_prefix", "cursor"),
-    "readRepositoryFile": ("max_bytes",),
-}
-
-READ_ONLY_OPERATIONS = frozenset(
-    {
-        "getRuntimeStatus",
-        "getGovernedWriteCapabilities",
-        "getControlPlaneSnapshot",
-        "listRepositoryTree",
-        "searchRepositorySource",
-        "getDiffIndex",
-        "readRepositoryFile",
-    }
-)
-
-_OPERATION_PATHS = {
-    "createGovernedTask": "/v2/governed-task",
-    "projectOnlineAgentExecution": "/v2/execution-envelope",
-    "acquireWriterLease": "/v2/writer-lease",
-    "commitFileGoverned": "/v2/commit-file",
-    "commitFilesGoverned": "/v2/commit-files",
-    "getGitOpsJob": "/v2/job",
-    "resumeGitOpsJob": "/v2/job/resume",
-    "reconcileGitOpsJob": "/v2/job/reconcile",
-    "getTagPublicationStatus": "/v2/tag/status",
-    "getReleaseConsistency": "/v2/release/consistency",
-    "runReleaseAcceptance": "/v2/release/acceptance",
-    **{operation: path for path, operation in TASK_ADMISSION_ROUTES.items()},
-    "listRepositoryTree": "/v2/repository/tree",
-    "searchRepositorySource": "/v2/repository/search",
-    "getDiffIndex": "/v2/repository/diff-index",
-    "readRepositoryFile": "/v2/repository/file",
-}
-
-
-def _has_complete_task_admission_handlers(
-    handlers: Mapping[str, Callable[[Mapping[str, Any]], Any]] | None,
-) -> bool:
-    return handlers is not None and all(
-        callable(handlers.get(operation)) for operation in TASK_ADMISSION_OPERATIONS
-    )
-
-
-def operation_contracts(
-    handlers: Mapping[str, Callable[[Mapping[str, Any]], Any]] | None = None,
-) -> dict[str, dict[str, object]]:
-    """Return the runtime contract consumed by adapters and schema tooling."""
-    contracts = {
-        operation: {
-            "method": "GET" if operation in OPERATION_OPTIONAL_FIELDS else "POST",
-            "path": _OPERATION_PATHS.get(operation),
-            "required_fields": list(fields),
-            "optional_fields": list(OPERATION_OPTIONAL_FIELDS.get(operation, ())),
-            "read_only": operation in READ_ONLY_OPERATIONS,
-        }
-        for operation, fields in OPERATION_REQUIRED_FIELDS.items()
-        if operation not in TASK_ADMISSION_OPERATIONS
-    }
-    if _has_complete_task_admission_handlers(handlers):
-        contracts.update(
-            {
-                operation: {
-                    "method": "GET" if operation == "getTaskAdmissionStatus" else "POST",
-                    "path": _OPERATION_PATHS[operation],
-                    "required_fields": list(
-                        TASK_ADMISSION_OPERATION_REQUIRED_FIELDS[operation]
-                    ),
-                    "optional_fields": list(
-                        TASK_ADMISSION_OPERATION_OPTIONAL_FIELDS[operation]
-                    ),
-                }
-                for operation in TASK_ADMISSION_OPERATIONS
-            }
-        )
-    return contracts
-
-
-def render_openapi_contract_fragment() -> str:
-    required = "\n".join(
-        f"                - {field}"
-        for field in OPERATION_REQUIRED_FIELDS["commitFilesGoverned"]
-    )
-    return (
-        "  /v2/commit-files:\n"
-        "    post:\n"
-        "      operationId: commitFilesGoverned\n"
-        "      summary: Submit one atomic governed commit containing multiple files\n"
-        "      security: [{taskPrincipalAuth: []}]\n"
-        "      x-aios-task-principal: Bridge verifies a fresh aios.task-principal-assertion.v1 and exact task/job/repository/branch/generation/revision/attempt/execution-digest/capability binding; caller JSON cannot provide a principal and missing verification is denied.\n"
-        "      requestBody:\n"
-        "        required: true\n"
-        "        content:\n"
-        "          application/json:\n"
-        "            schema:\n"
-        "              type: object\n"
-        "              additionalProperties: false\n"
-        "              required:\n"
-        f"{required}\n"
-        "              properties:\n"
-        "                task_id: {type: string}\n"
-        "                job_id: {type: string, description: External durable Job identity for exact completed-replay reconciliation}\n"
-        "                source_lease_epoch: {type: integer, minimum: 1}\n"
-        "                repository: {type: string, example: aios/aios}\n"
-        "                expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}\n"
-        "                target_branch: {type: string, pattern: '^agent/[A-Za-z0-9._/-]+$'}\n"
-        "                generation: {type: integer, minimum: 1}\n"
-        "                idempotency_key: {type: string}\n"
-        "                files:\n"
-        "                  type: array\n"
-        "                  minItems: 1\n"
-        "                  items:\n"
-        "                    type: object\n"
-        "                    additionalProperties: false\n"
-        "                    required: [path, content_base64]\n"
-        "                    properties:\n"
-        "                      path: {type: string, minLength: 1, maxLength: 512}\n"
-        "                      content_base64: {type: string}\n"
-        "                message: {type: string, minLength: 1, maxLength: 200}\n"
-        "      responses:\n"
-        "        '200': {description: Governed commit job and verified branch result}\n"
-        "        '202': {description: Existing external Job alias requires authoritative reconciliation; no replacement Job is created}\n"
-        "        '401': {description: No verified Task principal is available}\n"
-        "        '403': {description: Verified Task principal lacks exact task, external Job, or capability scope}\n"
-        "        '400': {description: Contract or policy rejection}\n"
-        "        '409': {description: Branch CAS or idempotency conflict}\n"
-        "        '423': {description: Narrow P0 Task-principal mutation gate is frozen; assertion is not consumed}\n"
-    )
-
-
-class RuntimeDriftError(RuntimeError):
-    pass
-
-
-class BridgeV2Error(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True, slots=True)
-class ControlPlaneReleaseManifest:
-    control_plane_release_version: str
-    control_plane_target_oid: str
-    artifact_sha256: str
-    runtime_path: Path
-    bridge_schema_version: str
-    repository_identity: str
-    authoritative_git_dir: Path
-    deployment_state: str
-
-    def as_dict(self) -> dict[str, object]:
-        return {
-            "control_plane_release_version": self.control_plane_release_version,
-            "control_plane_target_oid": self.control_plane_target_oid,
-            "artifact_sha256": self.artifact_sha256,
-            "runtime_path": str(self.runtime_path),
-            "bridge_schema_version": self.bridge_schema_version,
-            "repository_identity": self.repository_identity,
-            "authoritative_git_dir": str(self.authoritative_git_dir),
-            "deployment_state": self.deployment_state,
-        }
-
-    def validate(self, artifact: Path, *, observed_oid: str, approved_root: Path = Path("/opt/aios/gitops-control-plane")) -> dict[str, object]:
-        try:
-            runtime = self.runtime_path.resolve(strict=True)
-            root = approved_root.resolve(strict=True)
-            artifact_path = artifact.resolve(strict=True)
-            runtime.relative_to(root)
-            artifact_path.relative_to(runtime)
-        except (OSError, ValueError):
-            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT") from None
-        mutable_markers = {"workspace", "workspaces", "worktree", "worktrees"}
-        if mutable_markers.intersection(part.lower() for part in runtime.parts):
-            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
-        valid = (
-            len(self.control_plane_target_oid) == 40
-            and observed_oid == self.control_plane_target_oid
-            and len(self.artifact_sha256) == 64
-            and hashlib.sha256(artifact_path.read_bytes()).hexdigest() == self.artifact_sha256
-            and self.bridge_schema_version == BRIDGE_SCHEMA_VERSION
-            and self.repository_identity == "aios/aios"
-            and self.authoritative_git_dir == Path("/data/aios-gitops/repo.git")
-            and self.authoritative_git_dir.is_absolute()
-            and self.deployment_state == "STAGING"
-        )
-        if not valid:
-            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
-        return {**self.as_dict(), "drift_status": "PASS"}
-
-
-class BridgeV2Adapter:
-    """Thin operation adapter; all mutating handlers are injected seams."""
-
-    def __init__(self, *, runtime_status: Mapping[str, Any] | Callable[[], Mapping[str, Any]], handlers: Mapping[str, Callable[[Mapping[str, Any]], Any]] | None = None) -> None:
-        self._runtime_status_source = runtime_status if callable(runtime_status) else dict(runtime_status)
-        self.handlers = dict(handlers or {})
-
-    def _runtime_status(self) -> dict[str, Any]:
-        value = self._runtime_status_source() if callable(self._runtime_status_source) else self._runtime_status_source
-        if not isinstance(value, Mapping):
-            raise BridgeV2Error("RUNTIME_STATUS_INVALID")
-        return dict(value)
-
-    def getRuntimeStatus(self) -> dict[str, Any]:
-        return {"bridge_schema_version": BRIDGE_SCHEMA_VERSION, **self._runtime_status()}
-
-    def getGovernedWriteCapabilities(self) -> dict[str, Any]:
-        runtime_status = self._runtime_status()
-        governed_writes_enabled = runtime_status.get("governed_writes_enabled") is True
-        return {
-            "bridge_schema_version": BRIDGE_SCHEMA_VERSION,
-            "legacy_writes_enabled": False,
-            "governed_writes_enabled": governed_writes_enabled,
-            "governed_write_blockers": list(
-                runtime_status.get("governed_write_blockers") or []
-            ),
-            "operations": [
-                *BRIDGE_OPERATIONS,
-                *(
-                    TASK_ADMISSION_OPERATIONS
-                    if _has_complete_task_admission_handlers(self.handlers)
-                    else ()
-                ),
-            ],
-            "operation_contracts": operation_contracts(self.handlers),
-            "force_push": False,
-            "main_write": False,
-            "tag_write": False,
-            "baseline_write": False,
-            "production_write": False,
-            "approved_release_operations": True,
-            "approved_release_scope": {
-                "version": "V2R2C1",
-                "target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
-                "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
-                "approval_plan_id": "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e",
-            },
-        }
-
-    @staticmethod
-    def legacy_write_disabled() -> dict[str, object]:
-        return {"error": "LEGACY_WRITE_DISABLED", "replacement": "createGovernedTask", "governed_writes_available": False}
-
-    def _call(self, operation: str, request: Mapping[str, Any]) -> Any:
-        required = OPERATION_REQUIRED_FIELDS[operation]
-        if any(key not in request for key in required):
-            raise BridgeV2Error("BRIDGE_REQUEST_FIELDS_MISSING")
-        if operation in OPERATION_OPTIONAL_FIELDS:
-            allowed = set(required) | set(OPERATION_OPTIONAL_FIELDS[operation])
-            if set(request) - allowed:
-                raise BridgeV2Error("BRIDGE_REQUEST_FIELDS_UNKNOWN")
-        handler = self.handlers.get(operation)
-        if handler is None:
-            raise BridgeV2Error("GOVERNED_HANDLER_UNAVAILABLE")
-        return handler(dict(request))
-
-    def createGovernedTask(self, request: Mapping[str, Any]) -> Any: return self._call("createGovernedTask", request)
-    def projectOnlineAgentExecution(self, request: Mapping[str, Any]) -> Any: return self._call("projectOnlineAgentExecution", request)
-    def acquireWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("acquireWriterLease", request)
-    def commitFileGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFileGoverned", request)
-    def commitFilesGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFilesGoverned", request)
-    def getGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("getGitOpsJob", request)
-    def resumeGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("resumeGitOpsJob", request)
-    def reconcileGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("reconcileGitOpsJob", request)
-    def createTagApprovalRequest(self, request: Mapping[str, Any]) -> Any: return self._call("createTagApprovalRequest", request)
-    def requestOrCreateTag(self, request: Mapping[str, Any]) -> Any: return self._call("requestOrCreateTag", request)
-    def getTagPublicationStatus(self, request: Mapping[str, Any]) -> Any: return self._call("getTagPublicationStatus", request)
-    def buildProductionArtifact(self, request: Mapping[str, Any]) -> Any: return self._call("buildProductionArtifact", request)
-    def executeApprovedProductionRelease(self, request: Mapping[str, Any]) -> Any: return self._call("executeApprovedProductionRelease", request)
-    def getReleaseConsistency(self, request: Mapping[str, Any]) -> Any: return self._call("getReleaseConsistency", request)
-    def runReleaseAcceptance(self, request: Mapping[str, Any]) -> Any: return self._call("runReleaseAcceptance", request)
-    def getTaskAdmissionEnvelope(self, request: Mapping[str, Any]) -> Any: return self._call("getTaskAdmissionEnvelope", request)
-    def submitTaskAdmissionAuthorization(self, request: Mapping[str, Any]) -> Any: return self._call("submitTaskAdmissionAuthorization", request)
-    def getTaskAdmissionStatus(self, request: Mapping[str, Any]) -> Any: return self._call("getTaskAdmissionStatus", request)
-    def listRepositoryTree(self, request: Mapping[str, Any]) -> Any: return self._call("listRepositoryTree", request)
-    def searchRepositorySource(self, request: Mapping[str, Any]) -> Any: return self._call("searchRepositorySource", request)
-    def getDiffIndex(self, request: Mapping[str, Any]) -> Any: return self._call("getDiffIndex", request)
-    def readRepositoryFile(self, request: Mapping[str, Any]) -> Any: return self._call("readRepositoryFile", request)
-
-    def getControlPlaneSnapshot(self, request: Mapping[str, Any] | None = None) -> Any: return self._call("getControlPlaneSnapshot", request or {})

active-runtime/app/aios_continuation_executor.py

@@ -1,615 +0,0 @@
-"""Governed continuation executor for exact existing task branches.
-
-The executor composes the existing continuation lease and durable Job store.
-All Git and Gitea side effects live behind injected narrow interfaces so the
-state machine can prove Authority, Git-network, API-branch, and commit-object
-agreement before it reports completion.
-"""
-
-from __future__ import annotations
-
-import base64
-from dataclasses import asdict, dataclass
-from datetime import datetime, timezone
-import hashlib
-import json
-import os
-from pathlib import Path, PurePosixPath
-import re
-import subprocess
-from typing import Callable, Mapping, Protocol
-from urllib.error import HTTPError, URLError
-from urllib.parse import quote, urlsplit
-from urllib.request import Request, urlopen
-
-from aios_authority_git_executor import AuthorityGitExecutor
-from aios_continuation_lease import WriterLeaseRequestV2
-from aios_gitops_job_controller import GitOpsJobController, JobState
-from aios_gitops_reconciliation_core import ReconciliationAction, RemoteObservation, decide_reconciliation
-from authorized_task_writer_provisioning import validate_writer_lease_request_v2
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SECRET_PATTERNS = (
-    re.compile(rb"gh[pousr]_[A-Za-z0-9]{20,}"),
-    re.compile(rb"(?i)(?:token|password|secret|api[_-]?key)\s*[:=]\s*[\"'][^\"'\s]{12,}[\"']"),
-    re.compile(rb"-----BEGIN " + rb"(?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
-)
-
-
-class ContinuationExecutionError(RuntimeError):
-    """Stable fail-closed continuation execution error."""
-
-
-class DetachedWorkspace(Protocol):
-    def is_detached(self) -> bool: ...
-    def head_oid(self) -> str: ...
-    def commit_files(self, files: Mapping[str, bytes], message: str) -> str: ...
-
-
-class AuthorityPort(Protocol):
-    def branch_exists(self, branch: str) -> bool: ...
-    def branch_head(self, branch: str) -> str: ...
-    def is_ancestor(self, older: str, newer: str) -> bool: ...
-    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
-
-
-class RemotePort(Protocol):
-    def repository_identity(self) -> str: ...
-    def push_exact(self, branch: str, expected: str, new: str, *, allow_absent: bool = False) -> None: ...
-    def read_git_ref(self, branch: str) -> str | None: ...
-    def read_api_branch(self, branch: str) -> str | None: ...
-    def commit_visible(self, oid: str) -> bool: ...
-
-
-class CredentialProjection(Protocol):
-    def project(self) -> None: ...
-    def revoke(self) -> None: ...
-
-
-def _run(argv: list[str], *, cwd: Path | None = None, environment: Mapping[str, str] | None = None) -> str:
-    result = subprocess.run(
-        argv,
-        cwd=cwd,
-        env=None if environment is None else dict(environment),
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise ContinuationExecutionError("SUBPROCESS_FAILED")
-    return result.stdout.strip()
-
-
-@dataclass(slots=True)
-class AuthorityGitAdapter:
-    """Branch-name adapter over the existing narrow AuthorityGitExecutor."""
-
-    executor: AuthorityGitExecutor
-
-    @staticmethod
-    def _ref(branch: str) -> str:
-        return f"refs/heads/{branch}"
-
-    def branch_exists(self, branch: str) -> bool:
-        return self.executor.read_ref(self._ref(branch)) is not None
-
-    def branch_head(self, branch: str) -> str:
-        value = self.executor.read_ref(self._ref(branch))
-        if value is None:
-            raise ContinuationExecutionError("EXISTING_BRANCH_MISSING")
-        return value
-
-    def is_ancestor(self, older: str, newer: str) -> bool:
-        return self.executor.ancestry_check(older, newer)
-
-    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str:
-        return self.executor.advance_task_branch_CAS(self._ref(branch), expected, new)
-
-
-@dataclass(slots=True)
-class DetachedGitWorkspace:
-    path: Path
-
-    def __post_init__(self) -> None:
-        if not self.path.is_absolute() or self.path.is_symlink() or not self.path.is_dir():
-            raise ContinuationExecutionError("WORKTREE_PATH_INVALID")
-        top = Path(_run(["git", "rev-parse", "--show-toplevel"], cwd=self.path)).resolve()
-        if top != self.path.resolve():
-            raise ContinuationExecutionError("WORKTREE_PATH_INVALID")
-
-    def is_detached(self) -> bool:
-        result = subprocess.run(
-            ["git", "symbolic-ref", "-q", "HEAD"],
-            cwd=self.path,
-            capture_output=True,
-            check=False,
-        )
-        return result.returncode == 1
-
-    def head_oid(self) -> str:
-        return _run(["git", "rev-parse", "HEAD"], cwd=self.path)
-
-    def _dirty_paths(self) -> set[str]:
-        command = subprocess.run(
-            ["git", "status", "--porcelain=v1", "--untracked-files=all"],
-            cwd=self.path,
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if command.returncode != 0:
-            raise ContinuationExecutionError("SUBPROCESS_FAILED")
-        output = command.stdout
-        result: set[str] = set()
-        for line in output.splitlines():
-            path = line[3:]
-            if " -> " in path:
-                path = path.split(" -> ", 1)[1]
-            result.add(path)
-        return result
-
-    def materialize_files(self, files: Mapping[str, bytes]) -> None:
-        dirty = self._dirty_paths()
-        expected_paths = set(files)
-        if dirty and dirty != expected_paths:
-            raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
-        for relative, content in files.items():
-            target = (self.path / relative).resolve()
-            try:
-                target.relative_to(self.path.resolve())
-            except ValueError as exc:
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED") from exc
-            if target.is_symlink():
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED")
-            target.parent.mkdir(parents=True, exist_ok=True)
-            target.write_bytes(content)
-
-    def commit_files(self, files: Mapping[str, bytes], message: str) -> str:
-        expected_paths = set(files)
-        if self._dirty_paths() != expected_paths:
-            raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
-        for relative, content in files.items():
-            target = (self.path / relative).resolve()
-            try:
-                target.relative_to(self.path.resolve())
-            except ValueError as exc:
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED") from exc
-            if not target.is_file() or target.is_symlink() or target.read_bytes() != content:
-                raise ContinuationExecutionError("AUTHORING_PAYLOAD_MISMATCH")
-        _run(["git", "add", "--", *sorted(expected_paths)], cwd=self.path)
-        staged = set(_run(["git", "diff", "--cached", "--name-only"], cwd=self.path).splitlines())
-        if staged != expected_paths:
-            raise ContinuationExecutionError("STAGED_SCOPE_MISMATCH")
-        environment = os.environ.copy()
-        environment.update(
-            {
-                "GIT_AUTHOR_NAME": "AIOS Governed Continuation",
-                "GIT_AUTHOR_EMAIL": "aios-governed-continuation@localhost",
-                "GIT_COMMITTER_NAME": "AIOS Governed Continuation",
-                "GIT_COMMITTER_EMAIL": "aios-governed-continuation@localhost",
-            }
-        )
-        _run(["git", "commit", "--no-gpg-sign", "-m", message, "--", *sorted(expected_paths)], cwd=self.path, environment=environment)
-        if not self.is_detached():
-            raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
-        return self.head_oid()
-
-
-@dataclass(slots=True)
-class ServerSideCredentialProjection:
-    ssh_key_path: Path
-    api_token_path: Path
-    active: bool = False
-
-    def project(self) -> None:
-        for path in (self.ssh_key_path, self.api_token_path):
-            if path.is_symlink() or not path.is_file() or path.stat().st_size < 32:
-                raise ContinuationExecutionError("CREDENTIAL_PROJECTION_MISSING")
-        self.active = True
-
-    def revoke(self) -> None:
-        self.active = False
-
-
-@dataclass(slots=True)
-class GiteaContinuationRemote:
-    workspace: Path
-    credential: ServerSideCredentialProjection
-    remote_name: str = "gitea"
-    repository: str = "aios/aios"
-    api_base: str = "https://g.cnnetmkt.top/git/api/v1"
-    expected_host: str = "g.cnnetmkt.top"
-
-    @staticmethod
-    def validate_remote_url(value: str, expected_host: str = "g.cnnetmkt.top") -> None:
-        if value.startswith(("/", "file:")) or value.endswith("/data/aios-gitops/repo.git"):
-            raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
-        if "://" in value:
-            parsed = urlsplit(value)
-            host, path = parsed.hostname, parsed.path
-        else:
-            location = value.split("@", 1)[-1]
-            host, separator, path = location.partition(":")
-            if not separator:
-                raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
-            path = "/" + path
-        if host != expected_host or path.rstrip("/") not in {"/aios/aios.git", "/git/aios/aios.git"}:
-            raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
-
-    def repository_identity(self) -> str:
-        url = _run(["git", "remote", "get-url", self.remote_name], cwd=self.workspace)
-        self.validate_remote_url(url, self.expected_host)
-        if self.repository != "aios/aios":
-            raise ContinuationExecutionError("REMOTE_REPOSITORY_IDENTITY_MISMATCH")
-        return self.repository
-
-    def _require_projected(self) -> None:
-        if not self.credential.active:
-            raise ContinuationExecutionError("CREDENTIAL_PROJECTION_MISSING")
-
-    def read_git_ref(self, branch: str) -> str | None:
-        self._require_projected()
-        output = _run(["git", "ls-remote", self.remote_name, f"refs/heads/{branch}"], cwd=self.workspace)
-        if not output:
-            return None
-        oid, ref = output.split(maxsplit=1)
-        if ref != f"refs/heads/{branch}" or not OID_RE.fullmatch(oid):
-            raise ContinuationExecutionError("GITEA_GIT_READBACK_INVALID")
-        return oid
-
-    def push_exact(self, branch: str, expected: str, new: str, *, allow_absent: bool = False) -> None:
-        self._require_projected()
-        self.repository_identity()
-        current = self.read_git_ref(branch)
-        if current != expected and not (allow_absent and current is None):
-            raise ContinuationExecutionError("GITEA_BRANCH_EXPECTATION_MISMATCH")
-        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
-
-    def _api(self, path: str) -> object:
-        self._require_projected()
-        token = self.credential.api_token_path.read_text(encoding="utf-8").strip()
-        request = Request(
-            self.api_base.rstrip("/") + path,
-            headers={"Accept": "application/json", "Authorization": f"token {token}"},
-        )
-        try:
-            with urlopen(request, timeout=20) as response:
-                return json.loads(response.read().decode("utf-8"))
-        except HTTPError as exc:
-            if exc.code == 404:
-                return None
-            raise ContinuationExecutionError(f"GITEA_API_HTTP_{exc.code}") from exc
-        except (URLError, TimeoutError, OSError, json.JSONDecodeError) as exc:
-            raise ContinuationExecutionError("GITEA_API_UNAVAILABLE") from exc
-
-    def read_api_branch(self, branch: str) -> str | None:
-        owner, name = self.repository.split("/", 1)
-        page = 1
-        while page <= 100:
-            value = self._api(f"/repos/{quote(owner)}/{quote(name)}/branches?page={page}&limit=50")
-            if value is None:
-                return None
-            if not isinstance(value, list):
-                raise ContinuationExecutionError("GITEA_API_BRANCH_COLLECTION_INVALID")
-            for item in value:
-                if not isinstance(item, dict) or item.get("name") != branch:
-                    continue
-                oid = item.get("commit", {}).get("id")
-                if not isinstance(oid, str) or not OID_RE.fullmatch(oid):
-                    raise ContinuationExecutionError("GITEA_API_BRANCH_INVALID")
-                return oid
-            if len(value) < 50:
-                return None
-            page += 1
-        raise ContinuationExecutionError("GITEA_API_BRANCH_PAGINATION_LIMIT")
-
-    def commit_visible(self, oid: str) -> bool:
-        owner, name = self.repository.split("/", 1)
-        value = self._api(f"/repos/{quote(owner)}/{quote(name)}/git/commits/{oid}")
-        if not isinstance(value, dict):
-            return False
-        observed = value.get("sha") or value.get("id")
-        return observed == oid
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationPermissions:
-    create_target_branch: bool = False
-    force_push: bool = False
-    tag_write: bool = False
-    baseline_write: bool = False
-    production_write: bool = False
-    main_write: bool = False
-
-    def validate(self) -> None:
-        if any(asdict(self).values()):
-            raise ContinuationExecutionError("MUTATION_PERMISSION_DENIED")
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationRuntimeBinding:
-    request: WriterLeaseRequestV2
-    workspace_path: Path
-    lease_not_before: datetime
-    lease_expires_at: datetime
-    original_receipt_valid: bool
-    original_grant_consumed: bool
-    permissions: ContinuationPermissions
-    remote_branch_create_allowed: bool = False
-    external_job_id: str | None = None
-    worker_principal: str = "aios-autonomy-agent"
-    worker_lineage: str = "governed-continuation"
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationCommit:
-    idempotency_key: str
-    files: Mapping[str, bytes]
-    message: str
-
-    def payload(self) -> bytes:
-        if not self.idempotency_key or not self.message.strip() or not self.files:
-            raise ContinuationExecutionError("COMMIT_REQUEST_INVALID")
-        normalized: dict[str, str] = {}
-        for path, content in self.files.items():
-            pure = PurePosixPath(path)
-            if (
-                not isinstance(path, str)
-                or pure.is_absolute()
-                or ".." in pure.parts
-                or path.startswith((".git/", "baseline/", "production/"))
-                or not isinstance(content, bytes)
-            ):
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED")
-            if any(pattern.search(content) for pattern in SECRET_PATTERNS):
-                raise ContinuationExecutionError("SECRET_LIKE_PAYLOAD_REJECTED")
-            normalized[path] = base64.b64encode(content).decode("ascii")
-        return json.dumps(
-            {"files_base64": normalized, "message": self.message},
-            sort_keys=True,
-            separators=(",", ":"),
-        ).encode("utf-8")
-
-
-class ContinuationExecutor:
-    def __init__(
-        self,
-        controller: GitOpsJobController,
-        authority: AuthorityPort,
-        workspace: DetachedWorkspace,
-        remote: RemotePort,
-        credential: CredentialProjection,
-        *,
-        now: Callable[[], datetime] = lambda: datetime.now(timezone.utc),
-    ) -> None:
-        self.controller = controller
-        self.authority = authority
-        self.workspace = workspace
-        self.remote = remote
-        self.credential = credential
-        self.now = now
-        self._observed_generations: dict[str, int] = {}
-
-    def observe_generation(self, branch: str, generation: int) -> None:
-        self._observed_generations[branch] = max(generation, self._observed_generations.get(branch, 0))
-
-    def _max_generation(self, branch: str) -> int:
-        observed = self._observed_generations.get(branch, 0)
-        with self.controller.store._connect() as connection:
-            row = connection.execute(
-                "SELECT MAX(generation) AS generation FROM branch_leases WHERE branch=?",
-                (branch,),
-            ).fetchone()
-        durable = int(row["generation"] or 0)
-        return max(observed, durable)
-
-    @staticmethod
-    def _request_mapping(request: WriterLeaseRequestV2) -> dict[str, object]:
-        return {
-            "schema": WriterLeaseRequestV2.schema,
-            "task_id": request.task_id,
-            "repository": request.repository,
-            "branch_mode": request.branch_mode,
-            "base_oid": request.base_oid,
-            "expected_branch_oid": request.expected_branch_oid,
-            "target_branch": request.target_branch,
-            "generation": request.generation,
-            "lease_seconds": request.lease_seconds,
-        }
-
-    def _validate_preflight(self, binding: ContinuationRuntimeBinding) -> None:
-        request = binding.request
-        normalized = validate_writer_lease_request_v2(self._request_mapping(request), self.authority)
-        if normalized != {**self._request_mapping(request), "create_target_branch": False, "worktree_mode": "detached_at_expected_head", "cas_ref_update_required": True}:
-            raise ContinuationExecutionError("CONTINUATION_NORMALIZATION_INVALID")
-        if not binding.original_receipt_valid or not binding.original_grant_consumed:
-            raise ContinuationExecutionError("ORIGINAL_GRANT_LINEAGE_INVALID")
-        binding.permissions.validate()
-        now = self.now()
-        if now < binding.lease_not_before:
-            raise ContinuationExecutionError("LEASE_NOT_ACTIVE")
-        if now >= binding.lease_expires_at:
-            raise ContinuationExecutionError("LEASE_EXPIRED")
-        if request.generation <= self._max_generation(request.target_branch):
-            raise ContinuationExecutionError("GENERATION_NOT_MONOTONIC")
-        if not self.workspace.is_detached():
-            raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
-        if self.workspace.head_oid() != request.expected_branch_oid:
-            raise ContinuationExecutionError("WORKTREE_HEAD_MISMATCH")
-        if self.remote.repository_identity() != request.repository:
-            raise ContinuationExecutionError("REMOTE_REPOSITORY_IDENTITY_MISMATCH")
-
-    def _job_request(self, binding: ContinuationRuntimeBinding, commit: ContinuationCommit, payload: bytes) -> dict[str, object]:
-        request = binding.request
-        return {
-            "idempotency_key": commit.idempotency_key,
-            "campaign_id": request.task_id,
-            "task_id": request.task_id,
-            "repository": request.repository,
-            "operation": "CONTINUATION_COMMIT_FILES",
-            "branch": request.target_branch,
-            "expected_branch_oid": request.expected_branch_oid,
-            "base_oid": request.base_oid,
-            "branch_mode": request.branch_mode,
-            "payload_digest": hashlib.sha256(payload).hexdigest(),
-            "lineage_anchor_oid": request.base_oid,
-            "generation": request.generation,
-            "remote_branch_create_allowed": binding.remote_branch_create_allowed,
-            "external_job_id": binding.external_job_id,
-            "files_digest": hashlib.sha256(
-                json.dumps(
-                    {path: hashlib.sha256(content).hexdigest() for path, content in sorted(commit.files.items())},
-                    sort_keys=True, separators=(",", ":"),
-                ).encode("utf-8")
-            ).hexdigest(),
-            "message_digest": hashlib.sha256(commit.message.encode("utf-8")).hexdigest(),
-            "worker_principal": binding.worker_principal,
-            "worker_lineage": binding.worker_lineage,
-        }
-
-    def execute(self, binding: ContinuationRuntimeBinding, commit: ContinuationCommit) -> dict[str, object]:
-        payload = commit.payload()
-        submitted = self.controller.submit(self._job_request(binding, commit, payload), payload=payload)
-        current = self.controller.store.read(submitted.job_id)
-        if JobState(current["state"]) == JobState.COMPLETED:
-            return self.controller.store._receipt(current, duplicate=True).as_dict()
-        self._validate_preflight(binding)
-        request = binding.request
-        projected = False
-        try:
-            self.credential.project()
-            projected = True
-            row = self.controller.store.read(submitted.job_id)
-            if JobState(row["state"]) == JobState.REQUESTED:
-                self.controller.advance(
-                    submitted.job_id,
-                    JobState.AUTHORIZED,
-                    side_effect_state="AUTHORIZED",
-                    receipt={"task_id": request.task_id, "original_grant_consumed": True},
-                )
-                row = self.controller.store.read(submitted.job_id)
-            if JobState(row["state"]) == JobState.AUTHORIZED:
-                self.controller.lease_job(
-                    submitted.job_id,
-                    lease_id=f"lease-{submitted.job_id}",
-                    lineage_anchor_oid=request.base_oid,
-                    current_head_oid=request.expected_branch_oid,
-                    generation=request.generation,
-                    lease_expires_at=binding.lease_expires_at.astimezone(timezone.utc).isoformat(),
-                    expected_revision=int(row["revision"]),
-                )
-            self.controller.advance(submitted.job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY")
-            self.controller.advance(submitted.job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
-            new_oid = self.workspace.commit_files(commit.files, commit.message)
-            if not OID_RE.fullmatch(new_oid) or not self.authority.is_ancestor(request.expected_branch_oid, new_oid):
-                raise ContinuationExecutionError("NON_FAST_FORWARD_COMMIT")
-            authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
-            if authority_oid != new_oid:
-                raise ContinuationExecutionError("AUTHORITY_CAS_READBACK_MISMATCH")
-            self.controller.advance(
-                submitted.job_id,
-                JobState.LOCAL_VERIFIED,
-                side_effect_state="LOCAL_VERIFIED",
-                receipt={"authority_oid": authority_oid, "force_push": False},
-            )
-            try:
-                self.controller.advance(submitted.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
-                self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid, allow_absent=binding.remote_branch_create_allowed)
-            except Exception:
-                return self._remote_pending(submitted.job_id, authority_oid, new_oid)
-            return self._finish_remote_verification(submitted.job_id, authority_oid, new_oid)
-        finally:
-            if projected:
-                self.credential.revoke()
-
-    def _observe_remote(self, branch: str, oid: str) -> tuple[str | None, str | None, bool]:
-        return self.remote.read_git_ref(branch), self.remote.read_api_branch(branch), self.remote.commit_visible(oid)
-
-    def _remote_pending(self, job_id: str, authority_oid: str, new_oid: str) -> dict[str, object]:
-        receipt = {
-            "authority_oid": authority_oid,
-            "commit_oid": new_oid,
-            "desired_remote_oid": new_oid,
-            "remote_verified": False,
-            "force_push": False,
-        }
-        result = self.controller.advance(
-            job_id,
-            JobState.RECONCILIATION_REQUIRED,
-            side_effect_state="REMOTE_PUSH_PENDING",
-            receipt=receipt,
-        )
-        return result.as_dict()
-
-    def _finish_remote_verification(self, job_id: str, authority_oid: str, new_oid: str) -> dict[str, object]:
-        row = self.controller.store.read(job_id)
-        branch = row["branch"]
-        request = json.loads(row["request_json"])["binding"]
-        git_oid, api_oid, visible = self._observe_remote(branch, new_oid)
-        decision = decide_reconciliation(RemoteObservation("aios/aios", branch, new_oid, authority_oid, git_oid, api_oid, visible, datetime.now(timezone.utc).isoformat(), request.get("expected_branch_oid")))
-        if decision.action is not ReconciliationAction.MARK_REMOTE_VERIFIED:
-            return self._remote_pending(job_id, authority_oid, new_oid)
-        receipt = {
-            "authority_oid": authority_oid,
-            "commit_oid": new_oid,
-            "git_remote_oid": git_oid,
-            "api_branch_oid": api_oid,
-            "commit_visible": True,
-            "remote_verified": True,
-            "reconciliation_decision": decision.action.value,
-            "force_push": False,
-        }
-        self.controller.advance(job_id, JobState.REMOTE_VERIFIED, side_effect_state="REMOTE_VERIFIED", receipt=receipt)
-        return self.controller.advance(job_id, JobState.COMPLETED, side_effect_state="REMOTE_VERIFIED", receipt=receipt).as_dict()
-
-    def reconcile(self, job_id: str) -> dict[str, object]:
-        row = self.controller.store.read(job_id)
-        state = JobState(row["state"])
-        if state == JobState.COMPLETED:
-            return self.controller.store._receipt(row, duplicate=True).as_dict()
-        if state != JobState.RECONCILIATION_REQUIRED:
-            raise ContinuationExecutionError("JOB_NOT_RECONCILABLE")
-        request = json.loads(row["request_json"])["binding"]
-        receipt = json.loads(row["receipt_json"])
-        new_oid = receipt["desired_remote_oid"]
-        authority_oid = self.authority.branch_head(row["branch"])
-        try:
-            generation = int(request.get("generation") or 0)
-        except (TypeError, ValueError) as exc:
-            raise ContinuationExecutionError("DURABLE_BINDING_GENERATION_INVALID") from exc
-        if generation > 0:
-            with self.controller.store._connect() as connection:
-                earlier = connection.execute(
-                    "SELECT 1 FROM jobs WHERE branch=? AND state=? "
-                    "AND CAST(json_extract(request_json, '$.binding.generation') AS INTEGER) < ? LIMIT 1",
-                    (row["branch"], JobState.RECONCILIATION_REQUIRED.value, generation),
-                ).fetchone()
-            if earlier is not None:
-                raise ContinuationExecutionError("EARLIER_RECONCILIATION_REQUIRED")
-        self.credential.project()
-        try:
-            git_oid, api_oid, visible = self._observe_remote(row["branch"], new_oid)
-            if authority_oid == git_oid == api_oid == new_oid and visible:
-                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST")
-                return self._finish_remote_verification(job_id, new_oid, new_oid)
-            expected_oid = request["expected_branch_oid"]
-            if (
-                self.authority.is_ancestor(new_oid, authority_oid)
-                and git_oid is not None
-                and git_oid == api_oid
-                and self.authority.is_ancestor(git_oid, new_oid)
-            ):
-                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_CHAIN")
-                self.remote.push_exact(row["branch"], git_oid, new_oid, allow_absent=bool(request.get("remote_branch_create_allowed")) or request.get("branch_mode") == "CREATE_NEW")
-                return self._finish_remote_verification(job_id, new_oid, new_oid)
-            allow_remote_create = bool(request.get("remote_branch_create_allowed")) or request.get("branch_mode") == "CREATE_NEW" or (git_oid is None and api_oid is None)
-            remote_matches_expected = git_oid == api_oid == expected_oid
-            remote_absent_for_create = git_oid is None and api_oid is None
-            if authority_oid == new_oid and (remote_matches_expected or remote_absent_for_create):
-                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_RETRY")
-                self.remote.push_exact(row["branch"], expected_oid, new_oid, allow_absent=allow_remote_create)
-                return self._finish_remote_verification(job_id, new_oid, new_oid)
-            return self.controller.store._receipt(row, duplicate=True).as_dict()
-        finally:
-            self.credential.revoke()

active-runtime/app/aios_continuation_lease.py

@@ -1,154 +0,0 @@
-"""Campaign-aware continuation leases for an existing Git branch.
-
-This module is deliberately transport-neutral. It validates branch lineage
-and hands ref mutation to an injected compare-and-swap broker; it does not run
-Git, inspect credentials, or create a branch itself.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass, replace
-from datetime import datetime, timedelta, timezone
-import re
-from typing import Protocol
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TARGET_BRANCH = "agent/autonomous-release-campaign-v1-20260807"
-LINEAGE_ANCHOR = "69b45e81dcd2c3707c367003b08c55fd361faae8"
-CAMPAIGN_HEAD = "bba675fab3b7e0c5fba7066720252b3c91b9f20d"
-
-
-class ContinuationError(RuntimeError):
-    """Stable fail-closed error for lease or branch binding violations."""
-
-
-class BranchProbe(Protocol):
-    def branch_exists(self, branch: str) -> bool: ...
-    def branch_head(self, branch: str) -> str: ...
-    def is_ancestor(self, older: str, newer: str) -> bool: ...
-
-
-class RefCAS(Protocol):
-    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
-
-
-def _oid(value: str, field: str) -> str:
-    if not isinstance(value, str) or not OID_RE.fullmatch(value):
-        raise ContinuationError(f"{field}_invalid")
-    return value
-
-
-@dataclass(frozen=True, slots=True)
-class WriterLeaseRequestV2:
-    task_id: str
-    repository: str
-    branch_mode: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    generation: int
-    lease_seconds: int = 900
-
-    schema = "aios.task-writer-lease.v2"
-    accepted_schemas = frozenset({"aios.task-writer-lease.v2", "aios.task-writer-lease-request.v2"})
-
-    def validate(self, probe: BranchProbe) -> None:
-        if not self.task_id or self.repository != "aios/aios":
-            raise ContinuationError("request_identity_invalid")
-        if self.branch_mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
-            raise ContinuationError("branch_mode_invalid")
-        _oid(self.base_oid, "base_oid")
-        _oid(self.expected_branch_oid, "expected_branch_oid")
-        if self.target_branch in {"main", "master"} or self.target_branch.startswith(("refs/", "tags/")):
-            raise ContinuationError("protected_branch_rejected")
-        if not isinstance(self.generation, int) or isinstance(self.generation, bool) or self.generation < 1:
-            raise ContinuationError("generation_invalid")
-        if not isinstance(self.lease_seconds, int) or not 1 <= self.lease_seconds <= 86_400:
-            raise ContinuationError("lease_duration_invalid")
-        if self.branch_mode == "CONTINUE_EXISTING":
-            if not probe.branch_exists(self.target_branch):
-                raise ContinuationError("EXISTING_BRANCH_MISSING")
-            actual = _oid(probe.branch_head(self.target_branch), "actual_branch_oid")
-            if actual != self.expected_branch_oid:
-                raise ContinuationError("EXISTING_BRANCH_OID_CONFLICT")
-            if not probe.is_ancestor(self.base_oid, actual):
-                raise ContinuationError("BASE_NOT_ANCESTOR_OF_BRANCH")
-        elif hasattr(probe, "commit_exists") and not probe.commit_exists(self.base_oid):
-            raise ContinuationError("BASE_COMMIT_NOT_FOUND")
-        elif self.branch_mode == "CREATE_NEW" and probe.branch_exists(self.target_branch):
-            raise ContinuationError("TARGET_BRANCH_ALREADY_EXISTS")
-        elif self.branch_mode == "CREATE_NEW" and self.base_oid != self.expected_branch_oid:
-            raise ContinuationError("CREATE_NEW_BASE_EXPECTATION_MISMATCH")
-
-
-@dataclass(frozen=True, slots=True)
-class CampaignWriterLease:
-    task_id: str
-    repository: str
-    branch: str
-    lineage_anchor_oid: str
-    current_head_oid: str
-    generation: int
-    lease_expires_at: datetime
-    append_only: bool = True
-    renewable: bool = True
-    multi_commit: bool = True
-    recoverable: bool = True
-    state: str = "ACTIVE"
-    branch_bound: bool = True
-
-    def __post_init__(self) -> None:
-        _oid(self.lineage_anchor_oid, "lineage_anchor_oid")
-        _oid(self.current_head_oid, "current_head_oid")
-        if not all((self.append_only, self.renewable, self.multi_commit, self.recoverable, self.branch_bound)):
-            raise ContinuationError("lease_capability_downgrade")
-
-
-class ContinuationLeaseManager:
-    """State machine for a multi-commit lease with CAS-only ref updates."""
-
-    def __init__(self, probe: BranchProbe, refs: RefCAS, *, now=datetime.now) -> None:
-        self.probe = probe
-        self.refs = refs
-        self.now = now
-
-    def open(self, request: WriterLeaseRequestV2) -> CampaignWriterLease:
-        request.validate(self.probe)
-        if request.branch_mode != "CONTINUE_EXISTING":
-            raise ContinuationError("CREATE_NEW_REQUIRES_SEPARATE_PROVISIONER")
-        return CampaignWriterLease(
-            task_id=request.task_id,
-            repository=request.repository,
-            branch=request.target_branch,
-            lineage_anchor_oid=request.base_oid,
-            current_head_oid=request.expected_branch_oid,
-            generation=request.generation,
-            lease_expires_at=self.now(timezone.utc) + timedelta(seconds=request.lease_seconds),
-        )
-
-    def renew(self, lease: CampaignWriterLease, seconds: int) -> CampaignWriterLease:
-        if lease.state != "ACTIVE" or not lease.renewable or seconds < 1:
-            raise ContinuationError("lease_not_renewable")
-        return replace(lease, lease_expires_at=self.now(timezone.utc) + timedelta(seconds=seconds))
-
-    def append_commit(self, lease: CampaignWriterLease, new_head_oid: str) -> CampaignWriterLease:
-        if lease.state != "ACTIVE":
-            raise ContinuationError("lease_not_active")
-        _oid(new_head_oid, "new_head_oid")
-        if not self.probe.is_ancestor(lease.current_head_oid, new_head_oid):
-            raise ContinuationError("NON_FAST_FORWARD_COMMIT")
-        try:
-            actual = self.refs.compare_and_swap_branch(
-                lease.branch, lease.current_head_oid, new_head_oid
-            )
-        except Exception as exc:
-            raise ContinuationError("BRANCH_LEASE_STALE") from exc
-        if actual != new_head_oid:
-            raise ContinuationError("BRANCH_LEASE_STALE")
-        return replace(lease, current_head_oid=new_head_oid)
-
-    def supersede(self, lease: CampaignWriterLease) -> CampaignWriterLease:
-        if lease.state not in {"ACTIVE", "RECOVERABLE_FAILURE", "RECONCILIATION_REQUIRED"}:
-            raise ContinuationError("lease_not_supersedable")
-        return replace(lease, generation=lease.generation + 1, state="SUPERSEDED")

active-runtime/app/aios_control_plane_runtime_status.py

@@ -1,25 +0,0 @@
-"""Separate read, write, and release plane readiness evaluation."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Mapping
-
-
-@dataclass(frozen=True, slots=True)
-class RuntimeStatus:
-    read_plane: Mapping[str, bool]
-    write_plane: Mapping[str, bool]
-    release_plane: Mapping[str, bool]
-
-    @property
-    def release_control_plane_ready(self) -> bool:
-        return all(self.read_plane.values()) and all(self.write_plane.values()) and all(self.release_plane.values())
-
-    def as_dict(self) -> dict[str, object]:
-        return {
-            "READ_PLANE": dict(self.read_plane),
-            "WRITE_PLANE": dict(self.write_plane),
-            "RELEASE_PLANE": dict(self.release_plane),
-            "release_control_plane_ready": self.release_control_plane_ready,
-        }

active-runtime/app/aios_control_plane_sentinel.py

@@ -1,58 +0,0 @@
-"""Workspace-independent authority/network/Gitea ref sentinel."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from pathlib import Path
-import subprocess
-from typing import Callable, Mapping
-
-
-class SentinelError(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True, slots=True)
-class SentinelInputs:
-    authority_git_dir: Path
-    gitea_remote: str
-    gitea_api: str
-    ref: str
-    expected_oid: str
-
-
-@dataclass(frozen=True, slots=True)
-class SentinelResult:
-    authority_oid: str | None
-    network_oid: str | None
-    gitea_oid: str | None
-    equal: bool
-    error: str | None = None
-
-
-def authority_oid(inputs: SentinelInputs) -> str:
-    result = subprocess.run(
-        ["git", "--git-dir", str(inputs.authority_git_dir), "rev-parse", inputs.ref],
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise SentinelError("AUTHORITY_REF_UNAVAILABLE")
-    return result.stdout.strip()
-
-
-def evaluate(
-    inputs: SentinelInputs,
-    *,
-    network_reader: Callable[[str, str], str | None],
-    gitea_reader: Callable[[str, str], str | None],
-) -> SentinelResult:
-    try:
-        local = authority_oid(inputs)
-        network = network_reader(inputs.gitea_remote, inputs.ref)
-        gitea = gitea_reader(inputs.gitea_api, inputs.ref)
-        equal = local == network == gitea == inputs.expected_oid
-        return SentinelResult(local, network, gitea, equal, None if equal else "OID_MISMATCH")
-    except SentinelError as exc:
-        return SentinelResult(None, None, None, False, str(exc))

active-runtime/app/aios_control_plane_snapshot.py

@@ -1,30 +0,0 @@
-"""Non-sensitive control-plane snapshot assembly."""
-from __future__ import annotations
-
-from typing import Any, Mapping
-
-
-def _copy(value: Mapping[str, Any] | None, keys: tuple[str, ...]) -> dict[str, Any]:
-    value = value or {}
-    return {key: value.get(key) for key in keys}
-
-
-def build_control_plane_snapshot(*, target_version: str, runtime: Mapping[str, Any] | None = None, repository: Mapping[str, Any] | None = None, production: Mapping[str, Any] | None = None, task: Mapping[str, Any] | None = None, capabilities: Mapping[str, Any] | None = None, credential_broker: Mapping[str, Any] | None = None) -> dict[str, Any]:
-    task_snapshot = _copy(task, ("task_id", "branch", "authority_branch_oid", "gitea_git_oid", "gitea_api_oid", "commit_visible", "generation", "reconciliation_state"))
-    for key in ("external_job_id", "commit_oid", "current_head_oid", "completed_replay_reconciliation_id", "receipt_authority_oid"):
-        if task is not None and key in task:
-            task_snapshot[key] = task[key]
-    return {
-        "version": {"target_release": target_version},
-        "runtime": _copy(runtime, ("bridge_schema_version", "control_plane_release_version", "runtime_release_commit", "runtime_path", "artifact_sha256", "drift_status")),
-        "repository": _copy(repository, ("identity", "authority_git_dir", "authority_main_oid")),
-        "production": _copy(production, ("baseline_version", "target_oid", "deployment_state")),
-        "task": task_snapshot,
-        "capabilities": _copy(capabilities, ("legacy_writes_enabled", "governed_writes_enabled", "force_push", "main_write", "tag_write", "baseline_write", "production_write")),
-        "credential_broker": _copy(credential_broker, ("status", "provider")),
-        "secret_material_exposed": False,
-    }
-
-
-def getControlPlaneSnapshot(**kwargs: Any) -> dict[str, Any]:
-    return build_control_plane_snapshot(**kwargs)

active-runtime/app/aios_convergence_contracts.py

@@ -1,478 +0,0 @@
-"""Minimal convergence contracts for AIOS V2R2C2.
-
-This module deliberately contains no external side effects.  It provides the shared
-data contracts and pure evaluation rules used by domain controllers.  Domain
-controllers remain authoritative for their own final states.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass, field
-from datetime import datetime, timezone
-from enum import Enum
-import hashlib
-import json
-from typing import Any, Iterable, Mapping, Sequence
-
-
-class ConvergenceContractError(ValueError):
-    """Raised when an invalid convergence contract is constructed."""
-
-
-class EvidenceState(str, Enum):
-    PASS = "PASS"
-    FAIL = "FAIL"
-    UNKNOWN = "UNKNOWN"
-    BLOCKED = "BLOCKED"
-    NOT_APPLICABLE = "NOT_APPLICABLE"
-
-
-class AcceptanceDecision(str, Enum):
-    ACCEPT = "ACCEPT"
-    REJECT = "REJECT"
-    BLOCKED = "BLOCKED"
-    UNKNOWN = "UNKNOWN"
-
-
-class ObservedHealth(str, Enum):
-    HEALTHY = "HEALTHY"
-    DEGRADED = "DEGRADED"
-    FAILED = "FAILED"
-    UNKNOWN = "UNKNOWN"
-
-
-class ReconciliationState(str, Enum):
-    PENDING = "PENDING"
-    OBSERVING = "OBSERVING"
-    DIFF_FOUND = "DIFF_FOUND"
-    APPLYING = "APPLYING"
-    VERIFYING = "VERIFYING"
-    CONVERGED = "CONVERGED"
-    DEGRADED = "DEGRADED"
-    BLOCKED = "BLOCKED"
-
-
-class ContinuationStopReason(str, Enum):
-    CONTEXT_BOUNDARY = "context_boundary"
-    WORKER_RESTART = "worker_restart"
-    HANDOFF = "handoff"
-    AUTHORITY_GATE = "authority_gate"
-    WAIT_EXTERNAL = "wait_external"
-
-
-def _utc_now() -> str:
-    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def _canonical_json(value: Mapping[str, Any]) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
-
-
-def _sha256(value: Mapping[str, Any]) -> str:
-    return "sha256:" + hashlib.sha256(_canonical_json(value)).hexdigest()
-
-
-def _nonempty(value: object, field_name: str) -> str:
-    text = str(value or "").strip()
-    if not text:
-        raise ConvergenceContractError(f"{field_name}_required")
-    return text
-
-
-def _generation(value: object, field_name: str = "generation") -> int:
-    try:
-        parsed = int(value)
-    except (TypeError, ValueError) as exc:
-        raise ConvergenceContractError(f"{field_name}_invalid") from exc
-    if parsed < 1:
-        raise ConvergenceContractError(f"{field_name}_invalid")
-    return parsed
-
-
-@dataclass(frozen=True, slots=True)
-class StateOwnership:
-    object_type: str
-    authoritative_service: str
-    authoritative_store: str
-    final_writer: str | None = None
-    projections: tuple[str, ...] = ()
-    schema_version: str = "aios.state-ownership.v1"
-
-    def __post_init__(self) -> None:
-        _nonempty(self.object_type, "object_type")
-        _nonempty(self.authoritative_service, "authoritative_service")
-        _nonempty(self.authoritative_store, "authoritative_store")
-        if self.final_writer is not None:
-            _nonempty(self.final_writer, "final_writer")
-
-    def as_dict(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-DEFAULT_STATE_OWNERSHIP: tuple[StateOwnership, ...] = (
-    StateOwnership(
-        object_type="goal",
-        authoritative_service="goal-kernel",
-        authoritative_store="goal-store",
-        final_writer="goal-kernel",
-        projections=("admin-web", "context-pack"),
-    ),
-    StateOwnership(
-        object_type="task_run",
-        authoritative_service="task-plane-18940",
-        authoritative_store="durable-task-store",
-        final_writer="task-plane-18940",
-        projections=("admin-web", "context-pack"),
-    ),
-    StateOwnership(
-        object_type="release",
-        authoritative_service="release-controller",
-        authoritative_store="release-registry",
-        final_writer="release-controller",
-        projections=("baseline-authority", "admin-web"),
-    ),
-    StateOwnership(
-        object_type="git_branch",
-        authoritative_service="authority-git-executor",
-        authoritative_store="authoritative-git",
-        final_writer="authority-git-executor",
-        projections=("gitea",),
-    ),
-    StateOwnership(
-        object_type="external_projection",
-        authoritative_service="projection-controller",
-        authoritative_store="projection-store",
-        final_writer="projection-controller",
-        projections=("openapi", "gpt-action", "nginx"),
-    ),
-)
-
-
-def ownership_index(
-    ownership: Iterable[StateOwnership] = DEFAULT_STATE_OWNERSHIP,
-) -> dict[str, StateOwnership]:
-    result: dict[str, StateOwnership] = {}
-    for row in ownership:
-        if row.object_type in result:
-            raise ConvergenceContractError(f"duplicate_state_owner:{row.object_type}")
-        result[row.object_type] = row
-    return result
-
-
-@dataclass(frozen=True, slots=True)
-class AcceptanceCriterion:
-    criterion_id: str
-    required: bool
-    state: EvidenceState
-    verifier_id: str
-    evidence_refs: tuple[str, ...] = ()
-
-    def __post_init__(self) -> None:
-        _nonempty(self.criterion_id, "criterion_id")
-        _nonempty(self.verifier_id, "verifier_id")
-
-
-@dataclass(frozen=True, slots=True)
-class AcceptanceInvariant:
-    invariant_id: str
-    state: EvidenceState
-    evidence_refs: tuple[str, ...] = ()
-
-    def __post_init__(self) -> None:
-        _nonempty(self.invariant_id, "invariant_id")
-
-
-@dataclass(frozen=True, slots=True)
-class AcceptanceVector:
-    subject_type: str
-    subject_id: str
-    subject_revision: int
-    criteria: tuple[AcceptanceCriterion, ...]
-    invariants: tuple[AcceptanceInvariant, ...] = ()
-    unresolved_side_effects: tuple[str, ...] = ()
-    unresolved_blockers: tuple[str, ...] = ()
-    runtime_proofs: tuple[str, ...] = ()
-    schema: str = "aios.acceptance-vector.v1"
-
-    def __post_init__(self) -> None:
-        _nonempty(self.subject_type, "subject_type")
-        _nonempty(self.subject_id, "subject_id")
-        _generation(self.subject_revision, "subject_revision")
-        ids = [row.criterion_id for row in self.criteria]
-        if len(ids) != len(set(ids)):
-            raise ConvergenceContractError("duplicate_acceptance_criterion")
-        invariant_ids = [row.invariant_id for row in self.invariants]
-        if len(invariant_ids) != len(set(invariant_ids)):
-            raise ConvergenceContractError("duplicate_acceptance_invariant")
-
-    def as_dict(self) -> dict[str, Any]:
-        value = asdict(self)
-        for row in value["criteria"]:
-            row["state"] = row["state"].value
-        for row in value["invariants"]:
-            row["state"] = row["state"].value
-        return value
-
-
-@dataclass(frozen=True, slots=True)
-class AcceptanceResult:
-    decision: AcceptanceDecision
-    reasons: tuple[str, ...]
-    vector_hash: str
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "decision": self.decision.value,
-            "reasons": list(self.reasons),
-            "vector_hash": self.vector_hash,
-        }
-
-
-def evaluate_acceptance(vector: AcceptanceVector) -> AcceptanceResult:
-    """Pure fail-closed acceptance evaluator.
-
-    The evaluator never writes a domain final state.  The domain owner consumes this
-    result and remains the only final writer for Goal/Release/Product state.
-    """
-    reasons: list[str] = []
-    required = [row for row in vector.criteria if row.required]
-
-    for row in required:
-        if row.state == EvidenceState.FAIL:
-            reasons.append(f"criterion_failed:{row.criterion_id}")
-        elif row.state == EvidenceState.BLOCKED:
-            reasons.append(f"criterion_blocked:{row.criterion_id}")
-        elif row.state == EvidenceState.UNKNOWN:
-            reasons.append(f"criterion_unknown:{row.criterion_id}")
-
-    for row in vector.invariants:
-        if row.state == EvidenceState.FAIL:
-            reasons.append(f"invariant_failed:{row.invariant_id}")
-        elif row.state in {EvidenceState.UNKNOWN, EvidenceState.BLOCKED}:
-            reasons.append(f"invariant_unknown:{row.invariant_id}")
-
-    if vector.unresolved_side_effects:
-        reasons.append("unresolved_side_effects")
-    if vector.unresolved_blockers:
-        reasons.append("unresolved_blockers")
-
-    digest = _sha256(vector.as_dict())
-
-    if any(reason.startswith(("criterion_failed:", "invariant_failed:")) for reason in reasons):
-        decision = AcceptanceDecision.REJECT
-    elif any(reason.startswith("criterion_blocked:") for reason in reasons) or vector.unresolved_blockers:
-        decision = AcceptanceDecision.BLOCKED
-    elif reasons:
-        decision = AcceptanceDecision.UNKNOWN
-    else:
-        decision = AcceptanceDecision.ACCEPT
-
-    return AcceptanceResult(decision=decision, reasons=tuple(reasons), vector_hash=digest)
-
-
-@dataclass(frozen=True, slots=True)
-class DesiredState:
-    resource_id: str
-    resource_type: str
-    desired_generation: int
-    desired_spec: Mapping[str, Any]
-    owner_goal_id: str | None = None
-    lifecycle: str = "active"
-    schema: str = "aios.desired-state.v1"
-
-    def __post_init__(self) -> None:
-        _nonempty(self.resource_id, "resource_id")
-        _nonempty(self.resource_type, "resource_type")
-        _generation(self.desired_generation, "desired_generation")
-        if self.lifecycle not in {"active", "suspended", "deleted"}:
-            raise ConvergenceContractError("desired_lifecycle_invalid")
-
-    def identity(self) -> tuple[str, int]:
-        return self.resource_id, self.desired_generation
-
-
-@dataclass(frozen=True, slots=True)
-class ObservedState:
-    resource_id: str
-    observed_generation: int | None
-    observed_spec: Mapping[str, Any]
-    health: ObservedHealth
-    source_identity: str
-    observed_at: str
-    evidence_refs: tuple[str, ...] = ()
-    schema: str = "aios.observed-state.v1"
-
-    def __post_init__(self) -> None:
-        _nonempty(self.resource_id, "resource_id")
-        _nonempty(self.source_identity, "source_identity")
-        _nonempty(self.observed_at, "observed_at")
-        if self.observed_generation is not None:
-            _generation(self.observed_generation, "observed_generation")
-
-
-@dataclass(frozen=True, slots=True)
-class ReconciliationPlan:
-    resource_id: str
-    desired_generation: int
-    state: ReconciliationState
-    diff: Mapping[str, Any]
-    observation_required: bool
-    idempotency_key: str
-    reason: str
-
-    def as_dict(self) -> dict[str, Any]:
-        value = asdict(self)
-        value["state"] = self.state.value
-        return value
-
-
-def plan_reconciliation(
-    desired: DesiredState,
-    observed: ObservedState | None,
-) -> ReconciliationPlan:
-    """Return a side-effect-free reconciliation decision.
-
-    UNKNOWN/missing observed state always requires observation and never converges.
-    """
-    identity = {
-        "resource_id": desired.resource_id,
-        "desired_generation": desired.desired_generation,
-        "desired_spec": desired.desired_spec,
-    }
-    key = _sha256(identity)
-
-    if observed is None:
-        return ReconciliationPlan(
-            desired.resource_id,
-            desired.desired_generation,
-            ReconciliationState.OBSERVING,
-            {"observed": None},
-            True,
-            key,
-            "observed_state_missing",
-        )
-    if observed.resource_id != desired.resource_id:
-        raise ConvergenceContractError("resource_identity_mismatch")
-    if observed.health == ObservedHealth.UNKNOWN:
-        return ReconciliationPlan(
-            desired.resource_id,
-            desired.desired_generation,
-            ReconciliationState.OBSERVING,
-            {"health": observed.health.value},
-            True,
-            key,
-            "observed_state_unknown",
-        )
-
-    same_generation = observed.observed_generation == desired.desired_generation
-    same_spec = dict(observed.observed_spec) == dict(desired.desired_spec)
-    if same_generation and same_spec and observed.health == ObservedHealth.HEALTHY:
-        return ReconciliationPlan(
-            desired.resource_id,
-            desired.desired_generation,
-            ReconciliationState.CONVERGED,
-            {},
-            False,
-            key,
-            "desired_equals_observed",
-        )
-
-    return ReconciliationPlan(
-        desired.resource_id,
-        desired.desired_generation,
-        ReconciliationState.DIFF_FOUND,
-        {
-            "desired_generation": desired.desired_generation,
-            "observed_generation": observed.observed_generation,
-            "desired_spec": dict(desired.desired_spec),
-            "observed_spec": dict(observed.observed_spec),
-            "observed_health": observed.health.value,
-        },
-        False,
-        key,
-        "desired_observed_drift",
-    )
-
-
-@dataclass(frozen=True, slots=True)
-class SideEffectReceipt:
-    mutation_id: str
-    external_system: str
-    state: str
-    observed_at: str
-    external_request_id: str | None = None
-    external_object_id: str | None = None
-    observed_result_hash: str | None = None
-    evidence_refs: tuple[str, ...] = ()
-    schema: str = "aios.side-effect-receipt.v1"
-
-    def __post_init__(self) -> None:
-        _nonempty(self.mutation_id, "mutation_id")
-        _nonempty(self.external_system, "external_system")
-        _nonempty(self.observed_at, "observed_at")
-        if self.state not in {
-            "confirmed_applied",
-            "confirmed_not_applied",
-            "unknown",
-        }:
-            raise ConvergenceContractError("side_effect_receipt_state_invalid")
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationManifest:
-    trace_id: str
-    goal_id: str
-    goal_revision: int
-    task_id: str
-    run_id: str
-    current_node_id: str
-    acceptance_vector_ref: str
-    next_action: str
-    stop_reason: ContinuationStopReason
-    checkpoint_ref: str | None = None
-    unresolved_blocker_refs: tuple[str, ...] = ()
-    authoritative_decision_refs: tuple[str, ...] = ()
-    resource_refs: tuple[str, ...] = ()
-    artifact_refs: tuple[str, ...] = ()
-    evidence_refs: tuple[str, ...] = ()
-    created_at: str = field(default_factory=_utc_now)
-    schema: str = "aios.continuation-manifest.v1"
-
-    def __post_init__(self) -> None:
-        for name in (
-            "trace_id",
-            "goal_id",
-            "task_id",
-            "run_id",
-            "current_node_id",
-            "acceptance_vector_ref",
-            "next_action",
-            "created_at",
-        ):
-            _nonempty(getattr(self, name), name)
-        _generation(self.goal_revision, "goal_revision")
-
-    def as_dict(self) -> dict[str, Any]:
-        value = asdict(self)
-        value["stop_reason"] = self.stop_reason.value
-        return value
-
-    @property
-    def content_hash(self) -> str:
-        return _sha256(self.as_dict())
-
-
-def validate_state_ownership(
-    object_type: str,
-    writer: str,
-    ownership: Iterable[StateOwnership] = DEFAULT_STATE_OWNERSHIP,
-    *,
-    final_state: bool = False,
-) -> None:
-    row = ownership_index(ownership).get(object_type)
-    if row is None:
-        raise ConvergenceContractError(f"state_owner_missing:{object_type}")
-    expected = row.final_writer if final_state and row.final_writer else row.authoritative_service
-    if writer != expected:
-        raise ConvergenceContractError(
-            f"STATE_OWNERSHIP_VIOLATION:{object_type}:{writer}:{expected}"
-        )

active-runtime/app/aios_credential_broker.py

@@ -1,78 +0,0 @@
-"""Metadata-only, server-side credential lease broker."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-import os
-from pathlib import Path
-import secrets
-from typing import Any, Callable, Mapping
-
-
-@dataclass(frozen=True, slots=True)
-class CredentialLease:
-    lease_id: str
-    task_id: str
-    repository: str
-    target_branch: str
-    generation: int
-    issued_at: str
-    expires_at: str
-    scopes: tuple[str, ...]
-    provider: str
-    state: str = "ACTIVE"
-
-    def as_dict(self) -> dict[str, Any]:
-        return {"lease_id": self.lease_id, "task_id": self.task_id, "repository": self.repository, "target_branch": self.target_branch, "generation": self.generation, "issued_at": self.issued_at, "expires_at": self.expires_at, "scopes": list(self.scopes), "provider": self.provider, "state": self.state}
-
-
-class FileCredentialProvider:
-    def __init__(self, token_path: str | os.PathLike[str], *, actor: str = "aios-autonomy-agent") -> None:
-        self.token_path = Path(token_path)
-        self.actor = actor
-
-    def environment(self, lease: CredentialLease) -> dict[str, str]:
-        if not self.token_path.is_file():
-            raise RuntimeError("CREDENTIAL_PROVIDER_UNAVAILABLE")
-        return {"CREDENTIAL_FILE": str(self.token_path), "GITEA_MACHINE_ACTOR": self.actor}
-
-
-class CredentialBroker:
-    def __init__(self, provider: Any, *, now: Callable[[], datetime] | None = None) -> None:
-        self.provider = provider
-        self.now = now or (lambda: datetime.now(timezone.utc))
-        self._leases: dict[str, CredentialLease] = {}
-
-    def issue(self, *, task_id: str, repository: str, target_branch: str, generation: int, scopes: tuple[str, ...] = ("git:push", "gitea:read"), lease_seconds: int = 900) -> dict[str, Any]:
-        if repository != "aios/aios" or not target_branch.startswith("agent/") or generation < 1 or not 1 <= lease_seconds <= 86400:
-            raise ValueError("CREDENTIAL_LEASE_BINDING_INVALID")
-        now = self.now().astimezone(timezone.utc)
-        lease = CredentialLease("lease-" + secrets.token_hex(16), task_id, repository, target_branch, generation, now.isoformat(), (now + timedelta(seconds=lease_seconds)).isoformat(), tuple(scopes), type(self.provider).__name__)
-        self._leases[lease.lease_id] = lease
-        return lease.as_dict()
-
-    def _get(self, lease_id: str) -> CredentialLease:
-        lease = self._leases.get(lease_id)
-        if lease is None:
-            raise KeyError("CREDENTIAL_LEASE_NOT_FOUND")
-        if lease.state == "ACTIVE" and self.now().astimezone(timezone.utc) >= datetime.fromisoformat(lease.expires_at):
-            lease = CredentialLease(**{**lease.as_dict(), "scopes": tuple(lease.scopes), "state": "EXPIRED"})
-            self._leases[lease_id] = lease
-        return lease
-
-    def environment(self, lease_id: str) -> Mapping[str, str]:
-        lease = self._get(lease_id)
-        if lease.state != "ACTIVE":
-            raise RuntimeError("CREDENTIAL_LEASE_NOT_ACTIVE")
-        return self.provider.environment(lease)
-
-    def status(self, lease_id: str) -> dict[str, Any]:
-        return self._get(lease_id).as_dict()
-
-    def revoke(self, lease_id: str) -> dict[str, Any]:
-        lease = self._get(lease_id)
-        if lease.state == "REVOKED":
-            return lease.as_dict()
-        updated = CredentialLease(**{**lease.as_dict(), "scopes": tuple(lease.scopes), "state": "REVOKED"})
-        self._leases[lease_id] = updated
-        return updated.as_dict()

active-runtime/app/aios_gitea_machine_broker.py

@@ -1,125 +0,0 @@
-"""Non-Owner Gitea machine capability and branch reconciliation boundary."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Any, Mapping, Protocol
-
-
-class MachineBrokerError(RuntimeError):
-    pass
-
-
-class GiteaTransport(Protocol):
-    def compare_and_swap_branch(self, branch: str, expected_oid: str, new_oid: str) -> str: ...
-    def create_or_update_pr(self, branch: str, target: str, title: str, body: str) -> Mapping[str, Any]: ...
-    def publish_status(self, branch: str, state: str, description: str) -> Mapping[str, Any]: ...
-    def protected_merge(self, pr_number: int) -> Mapping[str, Any]: ...
-    def read_branch(self, branch: str) -> str | None: ...
-    def whoami(self) -> Mapping[str, Any]: ...
-    def repository(self, owner: str, name: str) -> Mapping[str, Any]: ...
-
-
-@dataclass(frozen=True, slots=True)
-class MachineCredentialProjection:
-    """Opaque systemd credential reference; the credential value is never accepted."""
-
-    reference: str
-    account: str
-    owner_account: str = "aiman"
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "MachineCredentialProjection":
-        if set(value) != {"scheme", "name", "account"}:
-            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
-        if value["scheme"] != "systemd-credential" or value["name"] != "gitea-machine-token":
-            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
-        return cls(f"{value['scheme']}:{value['name']}", str(value["account"]))
-
-    def __post_init__(self) -> None:
-        if self.reference != "systemd-credential:gitea-machine-token":
-            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
-        if not self.account or self.account == self.owner_account:
-            raise MachineBrokerError("OWNER_MACHINE_IDENTITY_REJECTED")
-
-
-@dataclass(frozen=True, slots=True)
-class CampaignCapabilityReceipt:
-    campaign_id: str
-    task_id: str
-    repository: str
-    branch: str
-    expected_oid: str
-    capabilities: frozenset[str]
-    denied: frozenset[str]
-
-    def require(self, capability: str) -> None:
-        if capability in self.denied or capability not in self.capabilities:
-            raise MachineBrokerError("CAPABILITY_DENIED")
-        if self.branch in {"main", "master"}:
-            raise MachineBrokerError("PROTECTED_BRANCH_DENIED")
-
-
-class GiteaMachineBroker:
-    def __init__(self, transport: GiteaTransport, credential: MachineCredentialProjection, receipt: CampaignCapabilityReceipt) -> None:
-        self.transport = transport
-        self.credential = credential
-        self.receipt = receipt
-
-    def verify_identity(self) -> Mapping[str, Any]:
-        identity = dict(self.transport.whoami())
-        login = identity.get("login") or identity.get("username")
-        if not isinstance(login, str) or not login or login == self.credential.owner_account or login != self.credential.account:
-            raise MachineBrokerError("GITEA_MACHINE_IDENTITY_INVALID")
-        owner, name = self.receipt.repository.split("/", 1)
-        repo = dict(self.transport.repository(owner, name))
-        if repo.get("full_name") != self.receipt.repository:
-            raise MachineBrokerError("GITEA_REPOSITORY_MISMATCH")
-        return {"login": login, "repository": self.receipt.repository, "owner_account": self.credential.owner_account}
-
-    def push_branch(self, new_oid: str) -> str:
-        self.receipt.require("exact_task_branch_push")
-        return self.transport.compare_and_swap_branch(self.receipt.branch, self.receipt.expected_oid, new_oid)
-
-    def create_pr(self, title: str, body: str) -> Mapping[str, Any]:
-        self.receipt.require("pr_create_update")
-        return self.transport.create_or_update_pr(self.receipt.branch, "main", title, body)
-
-    def status(self, state: str, description: str, context: str = "aios/durable-release") -> Mapping[str, Any]:
-        self.receipt.require("status_publish")
-        return self.transport.publish_status(self.receipt.branch, state, description, context)
-
-    def merge(self, pr_number: int) -> Mapping[str, Any]:
-        self.receipt.require("protected_merge")
-        return self.transport.protected_merge(pr_number)
-
-    def readback(self) -> str | None:
-        self.receipt.require("remote_readback")
-        return self.transport.read_branch(self.receipt.branch)
-
-
-def reconcile_exact_branch(authority_oid: str, gitea_oid: str | None, expected_oid: str) -> str:
-    if authority_oid != expected_oid:
-        return "AUTHORITY_EXPECTATION_MISMATCH"
-    if gitea_oid is None:
-        return "CREATE_REQUIRED"
-    if gitea_oid == expected_oid:
-        return "ALREADY_IN_SYNC"
-    return "MANUAL_OWNER_REVIEW_REQUIRED"
-
-
-def reconcile_fast_forward(
-    remote_oid: str | None,
-    expected_old_oid: str,
-    new_oid: str,
-    *,
-    old_is_ancestor_of_new: bool,
-) -> str:
-    """Return a bounded action for an active Job/lease branch scope."""
-    if remote_oid is None:
-        return "CREATE_REQUIRED"
-    if remote_oid == new_oid:
-        return "ALREADY_IN_SYNC"
-    if remote_oid == expected_old_oid and old_is_ancestor_of_new:
-        return "FAST_FORWARD_REQUIRED"
-    return "MANUAL_OWNER_REVIEW_REQUIRED"

active-runtime/app/aios_gitea_machine_transport.py

@@ -1,208 +0,0 @@
-"""Gitea HTTP/Git transport using only a projected systemd credential."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-import json
-import os
-from pathlib import Path
-import subprocess
-import tempfile
-from typing import Any, Mapping
-from urllib.error import HTTPError, URLError
-from urllib.parse import quote, urlencode
-from urllib.request import Request, urlopen
-
-
-class GiteaTransportError(RuntimeError):
-    pass
-
-
-def _safe_oid(value: str, field: str) -> str:
-    if not isinstance(value, str) or len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
-        raise GiteaTransportError(f"{field}_INVALID")
-    return value
-
-
-@dataclass(slots=True)
-class GiteaMachineTransport:
-    api_base: str
-    repository_id: str
-    remote_url: str
-    authority_git_dir: Path
-    credential_name: str = "gitea-machine-token"
-    actor: str = "aios-autonomy-agent"
-    timeout: int = 20
-    expected_merge_head: str | None = None
-    expected_merge_base: str | None = None
-
-    def __post_init__(self) -> None:
-        if self.credential_name != "gitea-machine-token":
-            raise GiteaTransportError("CREDENTIAL_NAME_INVALID")
-        if "/" not in self.repository_id or self.repository_id.startswith("/"):
-            raise GiteaTransportError("REPOSITORY_INVALID")
-        if not self.api_base.startswith("https://") and not self.api_base.startswith("http://127.0.0.1"):
-            raise GiteaTransportError("GITEA_API_SCOPE_INVALID")
-        if not self.remote_url.startswith("https://"):
-            raise GiteaTransportError("GITEA_REMOTE_SCOPE_INVALID")
-
-    @property
-    def _credential_path(self) -> Path:
-        directory = os.environ.get("CREDENTIALS_DIRECTORY", "")
-        if not directory:
-            raise GiteaTransportError("CREDENTIAL_PROJECTION_MISSING")
-        path = Path(directory) / self.credential_name
-        if path.is_symlink() or not path.is_file():
-            raise GiteaTransportError("CREDENTIAL_PROJECTION_MISSING")
-        return path
-
-    def _token(self) -> str:
-        value = self._credential_path.read_text(encoding="utf-8").strip()
-        if not value:
-            raise GiteaTransportError("CREDENTIAL_EMPTY")
-        return value
-
-    def _request(self, method: str, path: str, body: Mapping[str, Any] | None = None) -> tuple[int, Any]:
-        data = None if body is None else json.dumps(dict(body), separators=(",", ":")).encode()
-        headers = {"Accept": "application/json", "Authorization": f"token {self._token()}"}
-        if data is not None:
-            headers["Content-Type"] = "application/json"
-        request = Request(self.api_base.rstrip("/") + path, data=data, headers=headers, method=method)
-        try:
-            with urlopen(request, timeout=self.timeout) as response:
-                raw = response.read()
-                return response.status, json.loads(raw.decode()) if raw else {}
-        except HTTPError as exc:
-            # Never include response bodies: Gitea may echo sensitive request context.
-            raise GiteaTransportError(f"GITEA_HTTP_{exc.code}") from exc
-        except (URLError, TimeoutError, OSError) as exc:
-            raise GiteaTransportError("GITEA_NETWORK_ERROR") from exc
-
-    def whoami(self) -> Mapping[str, Any]:
-        return self._request("GET", "/user")[1]
-
-    def repository_info(self) -> Mapping[str, Any]:
-        owner, name = self.repository_id.split("/", 1)
-        return self._request("GET", f"/repos/{quote(owner)}/{quote(name)}")[1]
-
-    def repository(self, owner: str, name: str) -> Mapping[str, Any]:
-        if f"{owner}/{name}" != self.repository_id:
-            raise GiteaTransportError("REPOSITORY_SCOPE_DENIED")
-        return self.repository_info()
-
-    def read_branch(self, branch: str) -> str | None:
-        owner, name = self.repository_id.split("/", 1)
-        try:
-            value = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/branches/{quote(branch, safe='/')}")[1]
-        except GiteaTransportError as exc:
-            if str(exc) == "GITEA_HTTP_404":
-                return None
-            raise
-        sha = value.get("commit", {}).get("id") if isinstance(value, dict) else None
-        return _safe_oid(sha, "remote_branch_oid")
-
-    def _askpass(self) -> tuple[Path, dict[str, str]]:
-        credential = self._credential_path
-        fd, name = tempfile.mkstemp(prefix="aios-gitea-askpass-", dir="/tmp")
-        path = Path(name)
-        os.fchmod(fd, 0o700)
-        script = "#!/bin/sh\ncase \"$1\" in *Username*) printf '%s\\n' \"$GITEA_MACHINE_ACTOR\" ;; *) cat \"$CREDENTIAL_FILE\" ;; esac\n"
-        with os.fdopen(fd, "w", encoding="utf-8") as stream:
-            stream.write(script)
-            stream.flush()
-            os.fsync(stream.fileno())
-        return path, {
-            "GIT_ASKPASS": str(path),
-            "GIT_TERMINAL_PROMPT": "0",
-            "GITEA_MACHINE_ACTOR": self.actor,
-            "CREDENTIAL_FILE": str(credential),
-        }
-
-    def _push_branch_fast_forward(self, branch: str, new_oid: str) -> None:
-        askpass, additions = self._askpass()
-        environment = os.environ.copy()
-        environment.update(additions)
-        try:
-            result = subprocess.run(
-                ["git", f"--git-dir={self.authority_git_dir}", "push", self.remote_url, f"{new_oid}:refs/heads/{branch}"],
-                text=True,
-                capture_output=True,
-                check=False,
-                env=environment,
-                timeout=self.timeout,
-            )
-            if result.returncode != 0:
-                raise GiteaTransportError("GITEA_BRANCH_CREATE_FAILED")
-        finally:
-            askpass.unlink(missing_ok=True)
-
-    def compare_and_swap_branch(self, branch: str, expected_oid: str, new_oid: str) -> str:
-        _safe_oid(expected_oid, "expected_oid")
-        _safe_oid(new_oid, "new_oid")
-        current = self.read_branch(branch)
-        if current == new_oid:
-            return new_oid
-        if current is None:
-            self._push_branch_fast_forward(branch, new_oid)
-            readback = self.read_branch(branch)
-            if readback != new_oid:
-                raise GiteaTransportError("GITEA_BRANCH_CREATE_READBACK_MISMATCH")
-            return readback
-        if current != expected_oid:
-            raise GiteaTransportError("GITEA_BRANCH_EXPECTATION_MISMATCH")
-        # The preflight read binds the expected old tip. The Git receive-pack
-        # then enforces the actual fast-forward CAS while transferring the new
-        # objects; no force/lease override or arbitrary ref is permitted.
-        self._push_branch_fast_forward(branch, new_oid)
-        readback = self.read_branch(branch)
-        if readback != new_oid:
-            raise GiteaTransportError("GITEA_BRANCH_CAS_READBACK_MISMATCH")
-        return readback
-
-    def _pulls(self) -> list[Mapping[str, Any]]:
-        owner, name = self.repository_id.split("/", 1)
-        query = urlencode({"state": "all", "base_branch": "main", "limit": 100})
-        value = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/pulls?{query}")[1]
-        return value if isinstance(value, list) else []
-
-    def create_or_update_pr(self, branch: str, target: str, title: str, body: str) -> Mapping[str, Any]:
-        if target != "main":
-            raise GiteaTransportError("PR_BASE_SCOPE_DENIED")
-        head = self.read_branch(branch)
-        if head is None:
-            raise GiteaTransportError("PR_HEAD_MISSING")
-        matches = [p for p in self._pulls() if (p.get("head") or {}).get("ref") == branch and (p.get("base") or {}).get("ref") == target]
-        open_matches = [p for p in matches if p.get("state") == "open"]
-        if len(open_matches) > 1:
-            raise GiteaTransportError("MULTIPLE_MATCHING_PRS")
-        if open_matches:
-            if (open_matches[0].get("head") or {}).get("sha") != head:
-                raise GiteaTransportError("PR_HEAD_CONFLICT")
-            return open_matches[0]
-        owner, name = self.repository_id.split("/", 1)
-        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/pulls", {"head": branch, "base": target, "title": title, "body": body, "allow_maintainer_edit": False})[1]
-
-    def publish_status(self, branch: str, state: str, description: str, context: str = "aios/durable-release") -> Mapping[str, Any]:
-        oid = self.read_branch(branch)
-        if oid is None:
-            raise GiteaTransportError("STATUS_BRANCH_MISSING")
-        owner, name = self.repository_id.split("/", 1)
-        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/statuses/{oid}", {"state": state, "context": context, "description": description})[1]
-
-    def protected_merge(self, pr_number: int) -> Mapping[str, Any]:
-        if not isinstance(pr_number, int) or pr_number < 1:
-            raise GiteaTransportError("PR_NUMBER_INVALID")
-        owner, name = self.repository_id.split("/", 1)
-        pr = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/pulls/{pr_number}")[1]
-        if pr.get("state") != "open" or (pr.get("base") or {}).get("ref") != "main":
-            raise GiteaTransportError("PR_MERGE_BINDING_INVALID")
-        if pr.get("mergeable") is False:
-            raise GiteaTransportError("PR_NOT_MERGEABLE")
-        head_oid = (pr.get("head") or {}).get("sha")
-        base_oid = (pr.get("base") or {}).get("sha")
-        if self.expected_merge_head is not None and head_oid != self.expected_merge_head:
-            raise GiteaTransportError("PR_HEAD_EXPECTATION_MISMATCH")
-        if self.expected_merge_base is not None and base_oid != self.expected_merge_base:
-            raise GiteaTransportError("PR_BASE_EXPECTATION_MISMATCH")
-        body = {"do": "fast-forward-only", "force_merge": False, "merge_when_checks_succeed": False, "head_commit_id": head_oid}
-        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/pulls/{pr_number}/merge", body)[1]

active-runtime/app/aios_gitea_publisher.py

@@ -1,93 +0,0 @@
-"""Canonical Gitea transport and slash-branch verification."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import json
-import os
-from pathlib import Path
-import subprocess
-from typing import Any, Callable, Mapping, Optional
-from urllib.parse import quote
-from urllib.request import Request, urlopen
-
-from aios_gitops_reconciliation_core import RemoteObservation
-
-
-@dataclass(frozen=True, slots=True)
-class GiteaPublisherConfig:
-    repository: str = "aios/aios"
-    api_base: str = "https://g.cnnetmkt.top/git/api/v1"
-    remote_name: str = "gitea-http"
-
-
-class GiteaPublisher:
-    def __init__(self, workspace: Path, *, config: GiteaPublisherConfig = GiteaPublisherConfig(), credential: Any = None, api_get: Callable[[str], Any] | None = None, git_ref: Callable[[str], Optional[str]] | None = None) -> None:
-        self.workspace = Path(workspace)
-        self.config = config
-        self.credential = credential
-        self._api_get = api_get
-        self._git_ref = git_ref
-
-    @staticmethod
-    def validate_repository(repository: str) -> None:
-        if repository != "aios/aios":
-            raise ValueError("REPOSITORY_IDENTITY_MISMATCH")
-
-    @staticmethod
-    def validate_branch(branch: str) -> None:
-        if not isinstance(branch, str) or not branch.startswith("agent/") or branch in {"main", "master"}:
-            raise ValueError("BRANCH_SCOPE_DENIED")
-
-    def repository_identity(self) -> str:
-        self.validate_repository(self.config.repository)
-        return self.config.repository
-
-    def _environment(self) -> dict[str, str]:
-        if self.credential is not None and hasattr(self.credential, "environment"):
-            return dict(self.credential.environment())
-        return {}
-
-    def read_git_ref(self, branch: str) -> Optional[str]:
-        self.validate_branch(branch)
-        if self._git_ref is not None:
-            return self._git_ref(branch)
-        result = subprocess.run(["git", "-C", str(self.workspace), "ls-remote", self.config.remote_name, f"refs/heads/{branch}"], text=True, capture_output=True, check=False, env={**os.environ, **self._environment(), "GIT_TERMINAL_PROMPT": "0"})
-        if result.returncode != 0 or not result.stdout.strip():
-            return None
-        return result.stdout.split()[0]
-
-    def _api(self, path: str) -> Any:
-        if self._api_get is not None:
-            return self._api_get(path)
-        headers = {"Accept": "application/json"}
-        env = self._environment()
-        if env.get("AIOS_GITEA_TOKEN"):
-            headers["Authorization"] = "token " + env["AIOS_GITEA_TOKEN"]
-        with urlopen(Request(self.config.api_base.rstrip("/") + path, headers=headers), timeout=20) as response:
-            return json.loads(response.read() or b"{}")
-
-    def read_api_branch(self, branch: str) -> Optional[str]:
-        self.validate_branch(branch)
-        for page in range(1, 101):
-            value = self._api(f"/repos/aios/aios/branches?page={page}&limit=50")
-            if not isinstance(value, list):
-                return None
-            for item in value:
-                if isinstance(item, Mapping) and item.get("name") == branch:
-                    commit = item.get("commit")
-                    return commit.get("id") if isinstance(commit, Mapping) else None
-            if len(value) < 50:
-                return None
-        raise RuntimeError("GITEA_BRANCH_PAGINATION_LIMIT")
-
-    def commit_visible(self, oid: str) -> bool:
-        if not isinstance(oid, str) or len(oid) != 40:
-            return False
-        try:
-            value = self._api(f"/repos/aios/aios/git/commits/{quote(oid, safe='')}")
-            return isinstance(value, Mapping) and value.get("sha", oid) == oid
-        except Exception:
-            return False
-
-    def observe(self, branch: str, desired_oid: str, authority_oid: Optional[str], *, expected_oid: Optional[str] = None, observed_at: str = "") -> RemoteObservation:
-        return RemoteObservation(self.repository_identity(), branch, desired_oid, authority_oid, self.read_git_ref(branch), self.read_api_branch(branch), self.commit_visible(desired_oid), observed_at, expected_oid)

active-runtime/app/aios_gitops_job_controller.py

@@ -1,919 +0,0 @@
-"""SQLite-backed durable GitOps Job Controller.
-
-The controller owns durable intent, idempotency, lease metadata, state
-transitions, receipts, and payload references. A worker owns Git side effects
-behind the campaign capability and branch-CAS boundaries.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from enum import Enum
-import hashlib
-import json
-import os
-from pathlib import Path
-import sqlite3
-import tempfile
-from datetime import datetime, timezone
-from typing import Any, Callable, Mapping
-
-
-class JobError(RuntimeError):
-    pass
-
-
-class ServiceUnavailable(JobError):
-    pass
-
-
-class BindingConflict(JobError):
-    pass
-
-
-class JobState(str, Enum):
-    REQUESTED = "REQUESTED"
-    AUTHORIZED = "AUTHORIZED"
-    LEASED = "LEASED"
-    WORKTREE_READY = "WORKTREE_READY"
-    EXECUTING = "EXECUTING"
-    LOCAL_VERIFIED = "LOCAL_VERIFIED"
-    REMOTE_SYNCING = "REMOTE_SYNCING"
-    REMOTE_VERIFIED = "REMOTE_VERIFIED"
-    COMPLETED = "COMPLETED"
-    FAILED = "FAILED"
-    CANCELLED = "CANCELLED"
-    RECOVERABLE_FAILURE = "RECOVERABLE_FAILURE"
-    RECONCILING = "RECONCILING"
-    RECONCILIATION_REQUIRED = "RECONCILIATION_REQUIRED"
-    MANUAL_OWNER_REVIEW_REQUIRED = "MANUAL_OWNER_REVIEW_REQUIRED"
-
-
-_ORDER = {
-    JobState.REQUESTED: 0,
-    JobState.AUTHORIZED: 1,
-    JobState.LEASED: 2,
-    JobState.WORKTREE_READY: 3,
-    JobState.EXECUTING: 4,
-    JobState.LOCAL_VERIFIED: 5,
-    JobState.REMOTE_SYNCING: 6,
-    JobState.REMOTE_VERIFIED: 7,
-    JobState.COMPLETED: 8,
-}
-_RECOVERABLE = {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}
-_TERMINAL = {
-    JobState.COMPLETED,
-    JobState.FAILED,
-    JobState.CANCELLED,
-    JobState.MANUAL_OWNER_REVIEW_REQUIRED,
-}
-
-
-def utc_now() -> str:
-    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def canonical_json(value: Any) -> bytes:
-    return (
-        json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n"
-    ).encode("utf-8")
-
-
-def sha256_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json(value)).hexdigest()
-
-
-class PayloadStore:
-    """Content-addressed filesystem payloads; raw content never enters SQLite."""
-
-    def __init__(self, root: str | os.PathLike[str]) -> None:
-        self.root = Path(root)
-        if not self.root.is_absolute() or self.root.is_symlink():
-            raise JobError("PAYLOAD_ROOT_INVALID")
-        self.root.mkdir(parents=True, exist_ok=True, mode=0o700)
-        os.chmod(self.root, 0o700)
-
-    def put(self, content: bytes, expected_digest: str) -> tuple[str, int]:
-        digest = hashlib.sha256(content).hexdigest()
-        if digest != expected_digest:
-            raise JobError("PAYLOAD_DIGEST_MISMATCH")
-        if len(expected_digest) != 64 or any(ch not in "0123456789abcdef" for ch in expected_digest):
-            raise JobError("PAYLOAD_DIGEST_INVALID")
-        target = self.root / expected_digest
-        if target.is_symlink():
-            raise JobError("PAYLOAD_PATH_SYMLINK")
-        if target.is_file():
-            if target.stat().st_size != len(content) or hashlib.sha256(target.read_bytes()).hexdigest() != digest:
-                raise JobError("PAYLOAD_EXISTING_MISMATCH")
-            return f"sha256/{digest}", len(content)
-        fd, temporary = tempfile.mkstemp(prefix=".payload-", dir=self.root)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "wb") as stream:
-                stream.write(content)
-                stream.flush()
-                os.fsync(stream.fileno())
-            os.replace(temporary, target)
-            os.chmod(target, 0o600)
-        finally:
-            if os.path.exists(temporary):
-                os.unlink(temporary)
-        return f"sha256/{digest}", len(content)
-
-    def read_verified(self, reference: str, expected_digest: str, expected_size: int) -> bytes:
-        if reference != f"sha256/{expected_digest}":
-            raise JobError("PAYLOAD_REFERENCE_MISMATCH")
-        path = self.root / expected_digest
-        if path.is_symlink() or not path.is_file():
-            raise JobError("PAYLOAD_MISSING")
-        content = path.read_bytes()
-        if len(content) != expected_size or hashlib.sha256(content).hexdigest() != expected_digest:
-            raise JobError("PAYLOAD_VERIFY_FAILED")
-        return content
-
-
-@dataclass(frozen=True, slots=True)
-class JobReceipt:
-    job_id: str
-    idempotency_key: str
-    state: JobState
-    side_effect_state: str
-    http_status: int
-    revision: int
-    receipt: Mapping[str, Any] | None = None
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "job_id": self.job_id,
-            "idempotency_key": self.idempotency_key,
-            "state": self.state.value,
-            "side_effect_state": self.side_effect_state,
-            "http_status": self.http_status,
-            "revision": self.revision,
-            "receipt": dict(self.receipt) if self.receipt else None,
-        }
-
-
-class JobStore:
-    SCHEMA_VERSION = 1
-
-    def __init__(self, root: str | os.PathLike[str], *, payload_root: str | os.PathLike[str] | None = None) -> None:
-        self.root = Path(root)
-        if not self.root.is_absolute() or self.root.is_symlink():
-            raise JobError("JOB_ROOT_INVALID")
-        self.root.mkdir(parents=True, exist_ok=True, mode=0o700)
-        os.chmod(self.root, 0o700)
-        self.db_path = self.root / "state.sqlite3"
-        self.payloads = PayloadStore(payload_root or self.root.parent / "payloads" / "sha256")
-        self._initialize()
-
-    def _connect(self) -> sqlite3.Connection:
-        if self.db_path.is_symlink():
-            raise ServiceUnavailable("JOB_DB_SYMLINK")
-        connection = sqlite3.connect(self.db_path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA journal_mode=WAL")
-        connection.execute("PRAGMA synchronous=FULL")
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    @classmethod
-    def for_existing_append(cls, root: str | os.PathLike[str]) -> "JobStore":
-        """Open an existing job database without initialization side effects."""
-        path = Path(root)
-        if (
-            not path.is_absolute()
-            or path.is_symlink()
-            or not path.is_dir()
-            or not (path / "state.sqlite3").is_file()
-            or (path / "state.sqlite3").is_symlink()
-        ):
-            raise JobError("JOB_ROOT_NOT_FOUND")
-        instance = cls.__new__(cls)
-        instance.root = path
-        instance.db_path = path / "state.sqlite3"
-        return instance
-
-    @staticmethod
-    def _ensure_completed_replay_schema(connection: sqlite3.Connection) -> None:
-        connection.executescript(
-            """
-            CREATE TABLE IF NOT EXISTS completed_replay_reconciliations (
-              reconciliation_id TEXT PRIMARY KEY, job_id TEXT NOT NULL,
-              identity_digest TEXT NOT NULL UNIQUE,
-              source_lease_epoch INTEGER NOT NULL,
-              task_id TEXT NOT NULL, external_job_id TEXT NOT NULL,
-              internal_job_id TEXT NOT NULL, repository TEXT NOT NULL,
-              target_branch TEXT NOT NULL, generation INTEGER NOT NULL,
-              branch_mode TEXT NOT NULL, payload_digest TEXT NOT NULL,
-              files_digest TEXT NOT NULL, message_digest TEXT NOT NULL,
-              commit_oid TEXT NOT NULL, authority_head_oid TEXT NOT NULL,
-              current_head_oid TEXT NOT NULL, historical_lease_head_oid TEXT NOT NULL,
-              worker_principal TEXT NOT NULL, worker_lineage TEXT NOT NULL,
-              durable_revision INTEGER NOT NULL, completion_identity TEXT NOT NULL,
-              reason TEXT NOT NULL, provenance_json TEXT NOT NULL,
-              created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-            );
-            CREATE INDEX IF NOT EXISTS completed_replay_job_idx
-              ON completed_replay_reconciliations(job_id);
-            CREATE TRIGGER IF NOT EXISTS completed_replay_no_update
-              BEFORE UPDATE ON completed_replay_reconciliations
-              BEGIN SELECT RAISE(ABORT, 'COMPLETED_REPLAY_APPEND_ONLY'); END;
-            CREATE TRIGGER IF NOT EXISTS completed_replay_no_delete
-              BEFORE DELETE ON completed_replay_reconciliations
-              BEGIN SELECT RAISE(ABORT, 'COMPLETED_REPLAY_APPEND_ONLY'); END;
-            """
-        )
-        columns = {
-            str(item[1]) for item in connection.execute(
-                "PRAGMA table_info(completed_replay_reconciliations)"
-            ).fetchall()
-        }
-        if columns and "historical_lease_head_oid" not in columns:
-            connection.execute(
-                "ALTER TABLE completed_replay_reconciliations ADD COLUMN historical_lease_head_oid TEXT"
-            )
-
-    def _initialize(self) -> None:
-        try:
-            with self._connect() as connection:
-                connection.executescript(
-                    """
-                    CREATE TABLE IF NOT EXISTS metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL);
-                    CREATE TABLE IF NOT EXISTS jobs (
-                      job_id TEXT PRIMARY KEY, idempotency_key TEXT NOT NULL UNIQUE,
-                      campaign_id TEXT NOT NULL, repository TEXT NOT NULL, operation TEXT NOT NULL,
-                      branch TEXT NOT NULL, expected_branch_oid TEXT NOT NULL,
-                      payload_digest TEXT NOT NULL, payload_ref TEXT, payload_size INTEGER,
-                      state TEXT NOT NULL, side_effect_state TEXT NOT NULL,
-                      revision INTEGER NOT NULL, request_json TEXT NOT NULL,
-                      receipt_json TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
-                    );
-                    CREATE TABLE IF NOT EXISTS idempotency_keys (
-                      key TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE,
-                      binding_json TEXT NOT NULL, created_at TEXT NOT NULL,
-                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE TABLE IF NOT EXISTS branch_leases (
-                      lease_id TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE,
-                      branch TEXT NOT NULL, lineage_anchor_oid TEXT NOT NULL,
-                      current_head_oid TEXT NOT NULL, generation INTEGER NOT NULL,
-                      lease_expires_at TEXT NOT NULL, state TEXT NOT NULL,
-                      revision INTEGER NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE TABLE IF NOT EXISTS state_transitions (
-                      sequence INTEGER PRIMARY KEY AUTOINCREMENT, job_id TEXT NOT NULL,
-                      from_state TEXT, to_state TEXT NOT NULL, revision INTEGER NOT NULL,
-                      side_effect_state TEXT NOT NULL, created_at TEXT NOT NULL,
-                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE TABLE IF NOT EXISTS receipts (
-                      receipt_id TEXT PRIMARY KEY, job_id TEXT NOT NULL,
-                      kind TEXT NOT NULL, digest TEXT NOT NULL, payload_json TEXT NOT NULL,
-                      created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE TABLE IF NOT EXISTS completed_replay_reconciliations (
-                      reconciliation_id TEXT PRIMARY KEY, job_id TEXT NOT NULL,
-                      identity_digest TEXT NOT NULL UNIQUE,
-                      source_lease_epoch INTEGER NOT NULL,
-                      task_id TEXT NOT NULL, external_job_id TEXT NOT NULL,
-                      internal_job_id TEXT NOT NULL, repository TEXT NOT NULL,
-                      target_branch TEXT NOT NULL, generation INTEGER NOT NULL,
-                      branch_mode TEXT NOT NULL, payload_digest TEXT NOT NULL,
-                      files_digest TEXT NOT NULL, message_digest TEXT NOT NULL,
-                      commit_oid TEXT NOT NULL, authority_head_oid TEXT NOT NULL,
-                      current_head_oid TEXT NOT NULL, historical_lease_head_oid TEXT NOT NULL,
-                      worker_principal TEXT NOT NULL, worker_lineage TEXT NOT NULL,
-                      durable_revision INTEGER NOT NULL, completion_identity TEXT NOT NULL,
-                      reason TEXT NOT NULL, provenance_json TEXT NOT NULL,
-                      created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE INDEX IF NOT EXISTS completed_replay_job_idx
-                      ON completed_replay_reconciliations(job_id);
-                    CREATE TRIGGER IF NOT EXISTS completed_replay_no_update
-                      BEFORE UPDATE ON completed_replay_reconciliations
-                      BEGIN SELECT RAISE(ABORT, 'COMPLETED_REPLAY_APPEND_ONLY'); END;
-                    CREATE TRIGGER IF NOT EXISTS completed_replay_no_delete
-                      BEFORE DELETE ON completed_replay_reconciliations
-                      BEGIN SELECT RAISE(ABORT, 'COMPLETED_REPLAY_APPEND_ONLY'); END;
-                    INSERT OR REPLACE INTO metadata(key, value) VALUES('schema_version', '1');
-                    """
-                )
-                columns = {
-                    str(item[1]) for item in connection.execute(
-                        "PRAGMA table_info(completed_replay_reconciliations)"
-                    ).fetchall()
-                }
-                if columns and "historical_lease_head_oid" not in columns:
-                    connection.execute(
-                        "ALTER TABLE completed_replay_reconciliations "
-                        "ADD COLUMN historical_lease_head_oid TEXT"
-                    )
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-
-    def _mirror(self, job: Mapping[str, Any]) -> None:
-        directory = self.root / str(job["job_id"])
-        directory.mkdir(mode=0o700, exist_ok=True)
-        (directory / "receipts").mkdir(mode=0o700, exist_ok=True)
-        (directory / "logs-digest").mkdir(mode=0o700, exist_ok=True)
-        for name, value in (("request.json", job["request"]), ("state.json", job)):
-            target = directory / name
-            fd, temporary = tempfile.mkstemp(prefix=".mirror-", dir=directory)
-            try:
-                os.fchmod(fd, 0o600)
-                with os.fdopen(fd, "wb") as stream:
-                    stream.write(canonical_json(value))
-                    stream.flush()
-                    os.fsync(stream.fileno())
-                os.replace(temporary, target)
-            finally:
-                if os.path.exists(temporary):
-                    os.unlink(temporary)
-
-    def read(self, job_id: str) -> dict[str, Any]:
-        try:
-            with self._connect() as connection:
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        if row is None:
-            raise JobError("JOB_NOT_FOUND")
-        return dict(row)
-
-    @staticmethod
-    def _completed_replay_identity(envelope: Mapping[str, Any]) -> dict[str, Any]:
-        required = (
-            "task_id", "external_job_id", "internal_job_id", "repository",
-            "target_branch", "generation", "branch_mode", "payload_digest",
-            "files_digest", "message_digest", "commit_oid", "authority_head_oid",
-            "historical_lease_head_oid", "worker_principal", "worker_lineage", "source_lease_epoch",
-            "durable_revision", "completion_identity", "reason", "provenance",
-        )
-        if any(key not in envelope for key in required):
-            raise BindingConflict("COMPLETED_REPLAY_BINDING_INCOMPLETE")
-        text_fields = (
-            "task_id", "external_job_id", "internal_job_id", "repository",
-            "target_branch", "branch_mode", "payload_digest", "files_digest",
-            "message_digest", "commit_oid", "authority_head_oid", "worker_principal",
-            "worker_lineage", "historical_lease_head_oid", "completion_identity", "reason",
-        )
-        result: dict[str, Any] = {}
-        for key in text_fields:
-            value = envelope[key]
-            if not isinstance(value, str) or not value.strip():
-                raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-            result[key] = value
-        for key in ("generation", "source_lease_epoch", "durable_revision"):
-            value = envelope[key]
-            if isinstance(value, bool) or not isinstance(value, int) or value < 1:
-                raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-            result[key] = value
-        for key in ("commit_oid", "authority_head_oid", "historical_lease_head_oid"):
-            if len(result[key]) != 40 or any(ch not in "0123456789abcdef" for ch in result[key]):
-                raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-        for key in ("payload_digest", "files_digest", "message_digest"):
-            if len(result[key]) != 64 or any(ch not in "0123456789abcdef" for ch in result[key]):
-                raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-        if result["repository"] != "aios/aios" or result["branch_mode"] not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
-            raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-        if not result["target_branch"].startswith("agent/") or result["target_branch"] in {"main", "master"}:
-            raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-        provenance = envelope["provenance"]
-        if not isinstance(provenance, Mapping) or not provenance:
-            raise BindingConflict("COMPLETED_REPLAY_PROVENANCE_INVALID")
-        result["provenance"] = dict(provenance)
-        if result["commit_oid"] != result["authority_head_oid"]:
-            raise BindingConflict("COMPLETED_REPLAY_AUTHORITY_CONFLICT")
-        return result
-
-    def append_completed_replay_reconciliation(
-        self,
-        job_id: str,
-        envelope: Mapping[str, Any],
-        *,
-        authority_head_oid: str,
-    ) -> dict[str, Any]:
-        """Append exact completed-replay evidence without rewriting history."""
-        identity = self._completed_replay_identity(envelope)
-        if authority_head_oid != identity["authority_head_oid"]:
-            raise BindingConflict("COMPLETED_REPLAY_AUTHORITY_CONFLICT")
-        if identity["internal_job_id"] != job_id:
-            raise BindingConflict("COMPLETED_REPLAY_INTERNAL_JOB_CONFLICT")
-        identity_digest = sha256_json(identity)
-        reconciliation_id = "reconcile-" + identity_digest[:32]
-        now = utc_now()
-        try:
-            with self._connect() as connection:
-                self._ensure_completed_replay_schema(connection)
-                connection.execute("BEGIN IMMEDIATE")
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-                if row is None:
-                    raise JobError("JOB_NOT_FOUND")
-                if JobState(row["state"]) != JobState.COMPLETED:
-                    raise BindingConflict("COMPLETED_REPLAY_JOB_NOT_COMPLETED")
-                durable_request = json.loads(row["request_json"])
-                binding = durable_request.get("binding", durable_request)
-                exact_binding = {
-                    "task_id": binding.get("task_id") or binding.get("campaign_id"),
-                    "external_job_id": binding.get("external_job_id"),
-                    "internal_job_id": job_id,
-                    "repository": binding.get("repository") or row["repository"],
-                    "target_branch": binding.get("target_branch") or binding.get("branch"),
-                    "generation": binding.get("generation"),
-                    "branch_mode": binding.get("branch_mode"),
-                    "payload_digest": binding.get("payload_digest") or row["payload_digest"],
-                    "files_digest": binding.get("files_digest"),
-                    "message_digest": binding.get("message_digest"),
-                    "worker_principal": binding.get("worker_principal"),
-                    "worker_lineage": binding.get("worker_lineage"),
-                }
-                for key, value in exact_binding.items():
-                    if str(value) != str(identity[key]):
-                        raise BindingConflict("COMPLETED_REPLAY_BINDING_CONFLICT")
-                receipt = json.loads(row["receipt_json"]) if row["receipt_json"] else None
-                if not isinstance(receipt, Mapping):
-                    raise BindingConflict("COMPLETED_REPLAY_RECEIPT_MISSING")
-                if receipt.get("commit_oid") != identity["commit_oid"] or receipt.get("authority_oid") != identity["authority_head_oid"]:
-                    raise BindingConflict("COMPLETED_REPLAY_RECEIPT_AUTHORITY_CONFLICT")
-                completion_identity = sha256_json({
-                    "job_id": row["job_id"],
-                    "revision": int(row["revision"]),
-                    "receipt": receipt,
-                })
-                if identity["completion_identity"] != completion_identity:
-                    raise BindingConflict("COMPLETED_REPLAY_COMPLETION_IDENTITY_CONFLICT")
-                lease_columns = {
-                    str(item[1]) for item in connection.execute("PRAGMA table_info(branch_leases)").fetchall()
-                }
-                if "epoch" in lease_columns:
-                    lease = connection.execute(
-                        "SELECT lease_id, state, current_head_oid, generation FROM branch_leases WHERE job_id=? AND epoch=? ORDER BY rowid DESC LIMIT 1",
-                        (job_id, identity["source_lease_epoch"]),
-                    ).fetchone()
-                else:
-                    if identity["source_lease_epoch"] != 1:
-                        raise BindingConflict("COMPLETED_REPLAY_LEASE_EPOCH_UNAVAILABLE")
-                    lease = connection.execute(
-                        "SELECT lease_id, state, current_head_oid, generation FROM branch_leases WHERE job_id=? ORDER BY rowid DESC LIMIT 1",
-                        (job_id,),
-                    ).fetchone()
-                if lease is None:
-                    raise BindingConflict("COMPLETED_REPLAY_LEASE_MISSING")
-                lease_state = str(lease["state"])
-                lease_head = str(lease["current_head_oid"])
-                lease_generation = int(lease["generation"])
-                event_tables = {
-                    str(item[0]) for item in connection.execute(
-                        "SELECT name FROM sqlite_master WHERE type='table' AND name='branch_lease_events'"
-                    ).fetchall()
-                }
-                if "branch_lease_events" in event_tables:
-                    event = connection.execute(
-                        "SELECT state, current_head_oid, generation FROM branch_lease_events WHERE lease_id=? ORDER BY rowid DESC LIMIT 1",
-                        (lease["lease_id"],),
-                    ).fetchone()
-                    if event is not None:
-                        lease_state = str(event["state"])
-                        lease_head = str(event["current_head_oid"])
-                        lease_generation = int(event["generation"])
-                if lease_state not in {"ACTIVE", "USED", "EXPIRED"}:
-                    raise BindingConflict("COMPLETED_REPLAY_LEASE_STATE_INVALID")
-                if lease_generation != identity["generation"]:
-                    raise BindingConflict("COMPLETED_REPLAY_LEASE_GENERATION_CONFLICT")
-                if len(lease_head) != 40 or any(ch not in "0123456789abcdef" for ch in lease_head):
-                    raise BindingConflict("COMPLETED_REPLAY_LEASE_HEAD_INVALID")
-                if lease_head != identity["historical_lease_head_oid"]:
-                    raise BindingConflict("COMPLETED_REPLAY_HISTORICAL_LEASE_CONFLICT")
-                if identity["commit_oid"] == identity["historical_lease_head_oid"]:
-                    raise BindingConflict("COMPLETED_REPLAY_EVIDENCE_INCOHERENT")
-                existing = connection.execute(
-                    "SELECT * FROM completed_replay_reconciliations WHERE job_id=? ORDER BY created_at ASC",
-                    (job_id,),
-                ).fetchall()
-                for prior in existing:
-                    if prior["identity_digest"] != identity_digest:
-                        raise BindingConflict("COMPLETED_REPLAY_AMBIGUOUS")
-                if existing:
-                    result = dict(existing[0])
-                    connection.commit()
-                    return result
-                provenance_json = json.dumps(identity["provenance"], sort_keys=True, separators=(",", ":"))
-                connection.execute(
-                    "INSERT INTO completed_replay_reconciliations(reconciliation_id,job_id,identity_digest,source_lease_epoch,task_id,external_job_id,internal_job_id,repository,target_branch,generation,branch_mode,payload_digest,files_digest,message_digest,commit_oid,authority_head_oid,worker_principal,worker_lineage,current_head_oid,historical_lease_head_oid,durable_revision,completion_identity,reason,provenance_json,created_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
-                    (
-                        reconciliation_id, job_id, identity["identity_digest"] if "identity_digest" in identity else identity_digest, identity["source_lease_epoch"],
-                        identity["task_id"], identity["external_job_id"], identity["internal_job_id"],
-                        identity["repository"], identity["target_branch"], identity["generation"],
-                        identity["branch_mode"], identity["payload_digest"], identity["files_digest"],
-                        identity["message_digest"], identity["commit_oid"], identity["authority_head_oid"],
-                        identity["worker_principal"], identity["worker_lineage"], identity["authority_head_oid"], identity["historical_lease_head_oid"], identity["durable_revision"],
-                        identity["completion_identity"], identity["reason"], provenance_json, now,
-                    ),
-                )
-                result = dict(connection.execute(
-                    "SELECT * FROM completed_replay_reconciliations WHERE reconciliation_id=?",
-                    (reconciliation_id,),
-                ).fetchone())
-                connection.commit()
-                return result
-        except (JobError, BindingConflict):
-            raise
-        except sqlite3.IntegrityError as exc:
-            try:
-                with self._connect() as connection:
-                    existing = connection.execute(
-                        "SELECT * FROM completed_replay_reconciliations WHERE identity_digest=?",
-                        (identity_digest,),
-                    ).fetchone()
-                if existing is not None:
-                    return dict(existing)
-            except sqlite3.Error:
-                pass
-            raise BindingConflict("COMPLETED_REPLAY_IDEMPOTENCY_CONFLICT") from exc
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-
-    def completed_replay_evidence(self, job_id: str) -> dict[str, Any] | None:
-        try:
-            with self._connect() as connection:
-                rows = connection.execute(
-                    "SELECT * FROM completed_replay_reconciliations WHERE job_id=? ORDER BY created_at ASC",
-                    (job_id,),
-                ).fetchall()
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        if not rows:
-            return None
-        if len({str(row["identity_digest"]) for row in rows}) != 1:
-            raise BindingConflict("COMPLETED_REPLAY_AMBIGUOUS")
-        first = dict(rows[0])
-        immutable_fields = tuple(
-            key for key in first
-            if key != "created_at"
-        )
-        for row in rows[1:]:
-            if any(row[key] != first[key] for key in immutable_fields):
-                raise BindingConflict("COMPLETED_REPLAY_AMBIGUOUS")
-        if not (
-            first["commit_oid"] == first["authority_head_oid"] == first["current_head_oid"]
-            and first["commit_oid"] != first["historical_lease_head_oid"]
-        ):
-            raise BindingConflict("COMPLETED_REPLAY_EVIDENCE_INCOHERENT")
-        return first
-
-    def _receipt(self, row: Mapping[str, Any], *, duplicate: bool) -> JobReceipt:
-        state = JobState(row["state"])
-        if state == JobState.COMPLETED:
-            status, side = 200, "COMPLETED"
-        elif state in _RECOVERABLE:
-            status = 202
-            side = row["side_effect_state"] if row["side_effect_state"] == "REMOTE_PUSH_PENDING" else "RESUME_SAME_JOB"
-        elif row["side_effect_state"] == "UNKNOWN":
-            status, side = 503, "UNKNOWN"
-        else:
-            status, side = 202, "SAME_JOB" if duplicate else "QUEUED"
-        receipt = json.loads(row["receipt_json"]) if row["receipt_json"] else None
-        return JobReceipt(row["job_id"], row["idempotency_key"], state, side, status, int(row["revision"]), receipt)
-
-
-class GitOpsJobController:
-    def __init__(self, store: JobStore) -> None:
-        self.store = store
-
-    @staticmethod
-    def _binding(request: Mapping[str, Any]) -> dict[str, str]:
-        fields = ("campaign_id", "repository", "operation", "branch", "expected_branch_oid", "payload_digest")
-        if any(not isinstance(request.get(field), str) or not request[field].strip() for field in fields):
-            raise JobError("JOB_BINDING_INVALID")
-        oid = request["expected_branch_oid"]
-        digest = request["payload_digest"]
-        if len(oid) != 40 or any(ch not in "0123456789abcdef" for ch in oid):
-            raise JobError("EXPECTED_BRANCH_OID_INVALID")
-        if len(digest) != 64 or any(ch not in "0123456789abcdef" for ch in digest):
-            raise JobError("PAYLOAD_DIGEST_INVALID")
-        if request["branch"] in {"main", "master"} or request["branch"].startswith(("refs/", "tags/")):
-            raise JobError("PROTECTED_BRANCH_REJECTED")
-        binding = {field: str(request[field]) for field in fields}
-        # Operation-specific, non-secret binding inputs must survive the
-        # durable round trip and participate in idempotency. Arbitrary request
-        # fields are intentionally discarded rather than persisted.
-        optional = (
-            "idempotency_key",
-            "task_id",
-            "new_branch_oid",
-            "authorization_recovery_digest",
-            "lineage_anchor_oid",
-            "base_oid",
-            "branch_mode",
-            "generation",
-            "expected_main_oid",
-            "pr_number",
-            "target_branch",
-            "check_context",
-            "check_state",
-            "check_description",
-            "external_job_id",
-            "files_digest",
-            "message_digest",
-            "worker_principal",
-            "worker_lineage",
-        )
-        for field in optional:
-            value = request.get(field)
-            if value is None:
-                continue
-            if isinstance(value, bool) or not isinstance(value, (str, int)):
-                raise JobError("JOB_BINDING_OPTION_INVALID")
-            text = str(value).strip()
-            if not text or len(text) > 512:
-                raise JobError("JOB_BINDING_OPTION_INVALID")
-            binding[field] = text
-        return binding
-
-    def submit(self, request: Mapping[str, Any], *, payload: bytes | None = None) -> JobReceipt:
-        binding = self._binding(request)
-        payload_ref = request.get("payload_ref")
-        payload_size = request.get("payload_size")
-        if payload is not None:
-            payload_ref, payload_size = self.store.payloads.put(payload, binding["payload_digest"])
-        if payload_ref is not None and payload_ref != f"sha256/{binding['payload_digest']}":
-            raise JobError("PAYLOAD_REFERENCE_MISMATCH")
-        if payload_ref is not None and (not isinstance(payload_size, int) or payload_size < 0):
-            raise JobError("PAYLOAD_SIZE_INVALID")
-        client_idempotency_key = binding.get("idempotency_key")
-        if client_idempotency_key is not None:
-            if len(client_idempotency_key) > 128 or not all(
-                character.isalnum() or character in "._:-" for character in client_idempotency_key
-            ):
-                raise JobError("IDEMPOTENCY_KEY_INVALID")
-            key = sha256_json({"client_idempotency_key": client_idempotency_key})
-        else:
-            key = sha256_json(binding)
-        job_id = "job-" + key[:32]
-        durable_request = dict(binding)
-        if payload_ref is not None:
-            durable_request.update({"payload_ref": str(payload_ref), "payload_size": int(payload_size)})
-        now = utc_now()
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                existing = connection.execute("SELECT * FROM jobs WHERE idempotency_key=?", (key,)).fetchone()
-                if existing is not None:
-                    if json.loads(existing["request_json"]).get("binding") != binding:
-                        raise BindingConflict("BINDING_CONFLICT")
-                    row = dict(existing)
-                    connection.commit()
-                    return self.store._receipt(row, duplicate=True)
-                connection.execute(
-                    "INSERT INTO jobs(job_id,idempotency_key,campaign_id,repository,operation,branch,expected_branch_oid,payload_digest,payload_ref,payload_size,state,side_effect_state,revision,request_json,receipt_json,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
-                    (job_id, key, binding["campaign_id"], binding["repository"], binding["operation"], binding["branch"], binding["expected_branch_oid"], binding["payload_digest"], payload_ref, payload_size, JobState.REQUESTED.value, "NONE", 0, json.dumps({"binding": binding, **durable_request}, sort_keys=True), None, now, now),
-                )
-                connection.execute("INSERT INTO idempotency_keys(key,job_id,binding_json,created_at) VALUES(?,?,?,?)", (key, job_id, json.dumps(binding, sort_keys=True), now))
-                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, None, JobState.REQUESTED.value, 0, "NONE", now))
-                row = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
-                connection.commit()
-        except BindingConflict:
-            raise
-        except sqlite3.IntegrityError:
-            row = self.store.read(job_id)
-            return self.store._receipt(row, duplicate=True)
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        row["request"] = json.loads(row["request_json"])
-        self.store._mirror(row)
-        return self.store._receipt(row, duplicate=False)
-
-    def lease_job(
-        self,
-        job_id: str,
-        *,
-        lease_id: str,
-        lineage_anchor_oid: str,
-        current_head_oid: str,
-        generation: int,
-        lease_expires_at: str,
-        expected_revision: int,
-    ) -> JobReceipt:
-        """Atomically create a branch lease and move its Job to LEASED."""
-        if generation < 1 or any(len(oid) != 40 for oid in (lineage_anchor_oid, current_head_oid)):
-            raise JobError("LEASE_BINDING_INVALID")
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-                if row is None:
-                    raise JobError("JOB_NOT_FOUND")
-                if int(row["revision"]) != expected_revision:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                if row["branch"] in {"main", "master"}:
-                    raise JobError("PROTECTED_BRANCH_REJECTED")
-                now = utc_now()
-                connection.execute("INSERT INTO branch_leases(lease_id,job_id,branch,lineage_anchor_oid,current_head_oid,generation,lease_expires_at,state,revision) VALUES(?,?,?,?,?,?,?,?,?)", (lease_id, job_id, row["branch"], lineage_anchor_oid, current_head_oid, generation, lease_expires_at, "ACTIVE", 0))
-                next_revision = expected_revision + 1
-                updated = connection.execute("UPDATE jobs SET state=?,side_effect_state=?,revision=?,updated_at=? WHERE job_id=? AND revision=?", (JobState.LEASED.value, "LEASED", next_revision, now, job_id, expected_revision))
-                if updated.rowcount != 1:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, row["state"], JobState.LEASED.value, next_revision, "LEASED", now))
-                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
-                connection.commit()
-        except sqlite3.IntegrityError as exc:
-            raise JobError("LEASE_CONFLICT") from exc
-        except (JobError, BindingConflict):
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        result["request"] = json.loads(result["request_json"])
-        self.store._mirror(result)
-        return self.store._receipt(result, duplicate=True)
-
-    def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE") -> None:
-        if len(current_head_oid) != 40 or generation < 1:
-            raise JobError("LEASE_BINDING_INVALID")
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, state, lease_id, expected_revision))
-                if updated.rowcount != 1:
-                    raise JobError("LEASE_REVISION_CAS_CONFLICT")
-                connection.commit()
-        except JobError:
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-
-    def advance(self, job_id: str, state: JobState, *, side_effect_state: str, receipt: Mapping[str, Any] | None = None, expected_revision: int | None = None) -> JobReceipt:
-        return self._advance(
-            job_id,
-            state,
-            side_effect_state=side_effect_state,
-            receipt=receipt,
-            expected_revision=expected_revision,
-        )
-
-    def _advance(
-        self,
-        job_id: str,
-        state: JobState,
-        *,
-        side_effect_state: str,
-        receipt: Mapping[str, Any] | None = None,
-        expected_revision: int | None = None,
-        _allow_verified_external_recovery: bool = False,
-    ) -> JobReceipt:
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-                if row is None:
-                    raise JobError("JOB_NOT_FOUND")
-                previous = JobState(row["state"])
-                revision = int(row["revision"])
-                if expected_revision is not None and expected_revision != revision:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                recovery_transition = (
-                    _allow_verified_external_recovery
-                    and previous == JobState.MANUAL_OWNER_REVIEW_REQUIRED
-                    and state == JobState.COMPLETED
-                )
-                if previous in _TERMINAL and state != previous and not recovery_transition:
-                    raise JobError("JOB_TERMINAL")
-                if state not in _RECOVERABLE | {JobState.RECONCILING, JobState.MANUAL_OWNER_REVIEW_REQUIRED}:
-                    if previous in _RECOVERABLE:
-                        raise JobError("RECONCILE_REQUIRED")
-                    if previous != JobState.RECONCILING and _ORDER.get(state, -1) < _ORDER.get(previous, -1):
-                        raise JobError("JOB_STATE_REGRESSION")
-                next_revision = revision + 1
-                receipt_json = json.dumps(dict(receipt), sort_keys=True) if receipt is not None else row["receipt_json"]
-                now = utc_now()
-                updated = connection.execute("UPDATE jobs SET state=?,side_effect_state=?,revision=?,receipt_json=?,updated_at=? WHERE job_id=? AND revision=?", (state.value, side_effect_state, next_revision, receipt_json, now, job_id, revision))
-                if updated.rowcount != 1:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, previous.value, state.value, next_revision, side_effect_state, now))
-                if receipt is not None:
-                    digest = hashlib.sha256(canonical_json(receipt)).hexdigest()
-                    connection.execute("INSERT INTO receipts(receipt_id,job_id,kind,digest,payload_json,created_at) VALUES(?,?,?,?,?,?)", (f"receipt-{job_id}-{next_revision}", job_id, state.value, digest, json.dumps(dict(receipt), sort_keys=True), now))
-                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
-                connection.commit()
-        except (JobError, BindingConflict):
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        result["request"] = json.loads(result["request_json"])
-        self.store._mirror(result)
-        return self.store._receipt(result, duplicate=True)
-
-    @staticmethod
-    def _validate_verified_external_merge_proof(
-        job_id: str,
-        binding: Mapping[str, Any],
-        proof: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        if not isinstance(proof, Mapping):
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
-
-        def require_oid(field: str) -> str:
-            value = proof.get(field)
-            if not isinstance(value, str) or len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
-                raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
-            return value
-
-        if proof.get("proof_schema") != "aios.job-recovery.v1":
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
-        if proof.get("job_id") != job_id:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("operation") != "PROTECTED_MERGE" or binding.get("operation") != "PROTECTED_MERGE":
-            raise JobError("EXTERNAL_SIDE_EFFECT_OPERATION_REJECTED")
-        if proof.get("pr_number") != 53 or str(binding.get("pr_number")) != "53":
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("pr_merged") is not True or proof.get("protected_merge") is not True:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("force_push") is not False:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("machine_actor") != "aios-autonomy-agent":
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-
-        expected_head = str(binding.get("expected_branch_oid", ""))
-        expected_base = str(binding.get("expected_main_oid", ""))
-        head_oid = require_oid("head_oid")
-        base_oid = require_oid("base_oid")
-        merged_main = require_oid("main_oid_after_protected_merge")
-        gitea_merged_main = require_oid("gitea_main_oid_after_protected_merge")
-        authority_merged_main = require_oid("authority_main_oid_after_protected_merge")
-        current_gitea = require_oid("current_gitea_main_oid")
-        current_authority = require_oid("current_authority_main_oid")
-        if head_oid != expected_head or base_oid != expected_base:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if not (merged_main == gitea_merged_main == authority_merged_main == head_oid):
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if current_gitea != current_authority or proof.get("current_main_descends_from_protected_merge") is not True:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        return dict(proof)
-
-    def complete_verified_external_side_effect(
-        self,
-        job_id: str,
-        proof: Mapping[str, Any],
-        *,
-        expected_revision: int | None = None,
-    ) -> JobReceipt:
-        """Close one historical manual job from independently verified proof.
-
-        This is deliberately narrower than advance: it is only valid for the
-        known protected PR53 recovery shape and preserves the old receipt.
-        The actual state change still uses the normal revision-CAS path.
-        """
-        current = self.store.read(job_id)
-        revision = int(current["revision"])
-        if expected_revision is not None and expected_revision != revision:
-            raise JobError("REVISION_CAS_CONFLICT")
-        request = json.loads(current["request_json"])
-        binding = request.get("binding", request)
-        normalized_proof = self._validate_verified_external_merge_proof(job_id, binding, proof)
-        existing_receipt = json.loads(current["receipt_json"]) if current["receipt_json"] else None
-        if JobState(current["state"]) == JobState.COMPLETED:
-            if (
-                existing_receipt
-                and existing_receipt.get("recovered_from_historical_manual") is True
-                and existing_receipt.get("proof") == normalized_proof
-            ):
-                return self.store._receipt(current, duplicate=True)
-            raise JobError("JOB_TERMINAL")
-        if JobState(current["state"]) != JobState.MANUAL_OWNER_REVIEW_REQUIRED:
-            raise JobError("EXTERNAL_SIDE_EFFECT_RECOVERY_STATE_INVALID")
-        recovery_receipt = {
-            "recovered_from_historical_manual": True,
-            "recovery_kind": "VERIFIED_EXTERNAL_SIDE_EFFECT",
-            "historical_receipt": existing_receipt,
-            "proof": normalized_proof,
-        }
-        return self._advance(
-            job_id,
-            JobState.COMPLETED,
-            side_effect_state="REMOTE_VERIFIED",
-            receipt=recovery_receipt,
-            expected_revision=revision,
-            _allow_verified_external_recovery=True,
-        )
-
-    def reconcile(self, job_id: str, observer: Callable[[Mapping[str, Any]], Mapping[str, Any]]) -> JobReceipt:
-        current = self.store.read(job_id)
-        if JobState(current["state"]) not in _RECOVERABLE:
-            return self.store._receipt(current, duplicate=True)
-        self.advance(job_id, JobState.RECONCILING, side_effect_state="IN_PROGRESS")
-        try:
-            observed = dict(observer(current))
-            stable = JobState(observed.get("state", JobState.REQUESTED.value))
-            if stable in {JobState.RECOVERABLE_FAILURE, JobState.RECONCILING}:
-                raise JobError("RECONCILIATION_UNSTABLE")
-            return self.advance(job_id, stable, side_effect_state=str(observed.get("side_effect_state", "NONE")), receipt=observed.get("receipt"))
-        except Exception as exc:
-            self.advance(job_id, JobState.RECONCILIATION_REQUIRED, side_effect_state="UNKNOWN", receipt={"error_code": type(exc).__name__})
-            raise JobError("RECONCILIATION_REQUIRED") from exc
-
-    def resume(self, job_id: str) -> JobReceipt:
-        current = self.store.read(job_id)
-        if JobState(current["state"]) in _TERMINAL:
-            raise JobError("JOB_TERMINAL")
-        return self.reconcile(job_id, lambda _current: {"state": JobState.REQUESTED.value, "side_effect_state": "RESUME_SAME_JOB"})

active-runtime/app/aios_gitops_job_executor.py

@@ -1,279 +0,0 @@
-"""Durable Job side-effect executor for the AIOS campaign control plane."""
-
-from __future__ import annotations
-
-import argparse
-import base64
-from dataclasses import dataclass, replace
-import json
-from pathlib import Path
-from typing import Any, Mapping
-
-from aios_authority_git_executor import AuthorityGitExecutor, AuthorityGitError
-from aios_campaign_recovery import RecoveryEvidenceError, load_recovered_authorization
-from aios_gitea_machine_broker import CampaignCapabilityReceipt, GiteaMachineBroker, MachineBrokerError
-from aios_gitops_job_controller import GitOpsJobController, JobError, JobState, JobStore
-
-
-TASK_ID = "AIOS_AUTONOMOUS_RELEASE_CAMPAIGN_V1"
-CAMPAIGN_ID = "AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807"
-REPOSITORY = "aios/aios"
-BRANCH = "agent/autonomous-release-campaign-v1-20260807"
-EXPECTED_BRANCH_OID = "bba675fab3b7e0c5fba7066720252b3c91b9f20d"
-AUTHORIZATION_DIGEST = "6b0bf550eb702126e967eeff2d561fa808444b924d8a71f5399accad508ed3b2"
-LINEAGE_ANCHOR = "69b45e81dcd2c3707c367003b08c55fd361faae8"
-
-
-class JobExecutionError(RuntimeError):
-    pass
-
-
-@dataclass(slots=True)
-class DurableJobExecutor:
-    controller: GitOpsJobController
-    authority: AuthorityGitExecutor
-    broker: GiteaMachineBroker
-    recovery_path: Path
-
-    def _request(self, job_id: str) -> tuple[dict[str, Any], dict[str, Any]]:
-        row = self.controller.store.read(job_id)
-        try:
-            request = json.loads(row["request_json"])
-        except (KeyError, TypeError, json.JSONDecodeError) as exc:
-            raise JobExecutionError("JOB_REQUEST_INVALID") from exc
-        return row, dict(request.get("binding") or {})
-
-    def _validate_campaign(self, request: Mapping[str, Any]) -> str:
-        operation = str(request.get("operation", ""))
-        expected_branch_oid = request.get("expected_branch_oid")
-        required = {
-            "task_id": TASK_ID,
-            "campaign_id": CAMPAIGN_ID,
-            "repository": REPOSITORY,
-            "branch": BRANCH,
-            "authorization_recovery_digest": AUTHORIZATION_DIGEST,
-        }
-        for key, expected in required.items():
-            if request.get(key) != expected:
-                raise JobExecutionError(f"JOB_{key.upper()}_MISMATCH")
-        new_oid = request.get("new_branch_oid")
-        if not isinstance(new_oid, str) or len(new_oid) != 40 or any(ch not in "0123456789abcdef" for ch in new_oid):
-            raise JobExecutionError("NEW_BRANCH_OID_INVALID")
-        if not isinstance(expected_branch_oid, str) or len(expected_branch_oid) != 40 or any(ch not in "0123456789abcdef" for ch in expected_branch_oid):
-            raise JobExecutionError("EXPECTED_BRANCH_OID_INVALID")
-        if operation == "ADVANCE_EXISTING_CAMPAIGN_BRANCH" and expected_branch_oid == new_oid:
-            raise JobExecutionError("EXPECTED_BRANCH_OID_INVALID")
-        if operation != "ADVANCE_EXISTING_CAMPAIGN_BRANCH" and expected_branch_oid != new_oid:
-            raise JobExecutionError("POST_ADVANCE_HEAD_BINDING_INVALID")
-        try:
-            recovery = load_recovered_authorization(self.recovery_path)
-        except RecoveryEvidenceError as exc:
-            raise JobExecutionError(str(exc)) from exc
-        if recovery["digest"] != AUTHORIZATION_DIGEST:
-            raise JobExecutionError("RECOVERY_DIGEST_MISMATCH")
-        for key, expected in required.items():
-            if key == "campaign_id":
-                actual = recovery.get(key)
-            elif key == "authorization_recovery_digest":
-                continue
-            else:
-                actual = recovery.get({"expected_branch_oid": "expected_branch_oid"}.get(key, key))
-            if actual is not None and actual != expected:
-                raise JobExecutionError("RECOVERY_BINDING_MISMATCH")
-        if recovery.get("expected_branch_oid") != EXPECTED_BRANCH_OID:
-            raise JobExecutionError("RECOVERY_BRANCH_OID_MISMATCH")
-        authority_head = self.authority.read_ref(f"refs/heads/{BRANCH}")
-        if authority_head not in {expected_branch_oid, new_oid}:
-            raise JobExecutionError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
-        if not self.authority.ancestry_check(expected_branch_oid, new_oid):
-            raise JobExecutionError("NEW_OID_NOT_DESCENDANT")
-        if not self.authority.ancestry_check(EXPECTED_BRANCH_OID, new_oid):
-            raise JobExecutionError("NEW_OID_OUTSIDE_AUTHORIZED_LINEAGE")
-        identity = self.broker.verify_identity()
-        if identity.get("repository") != REPOSITORY or identity.get("login") == "aiman":
-            raise JobExecutionError("MACHINE_IDENTITY_SCOPE_INVALID")
-        return new_oid
-
-    def dry_run(self, job_id: str) -> dict[str, Any]:
-        _row, request = self._request(job_id)
-        new_oid = self._validate_campaign(request)
-        remote = self.broker.readback()
-        if remote is None:
-            action = "CREATE_REQUIRED"
-        elif remote == new_oid:
-            action = "ALREADY_IN_SYNC"
-        elif remote == request["expected_branch_oid"]:
-            action = "FAST_FORWARD_REQUIRED"
-        else:
-            action = "MANUAL_OWNER_REVIEW_REQUIRED"
-        if action == "MANUAL_OWNER_REVIEW_REQUIRED":
-            raise JobExecutionError("GITEA_BRANCH_CONFLICT")
-        return {
-            "decision": "SAFE_TO_ADVANCE",
-            "authority_action": "CAS_REQUIRED",
-            "gitea_action": action,
-            "previous_branch_oid": request["expected_branch_oid"],
-            "final_branch_oid": new_oid,
-            "force_push": False,
-        }
-
-    def _recover_requested(self, job_id: str) -> dict[str, Any]:
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) in {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}:
-            self.controller.resume(job_id)
-            row = self.controller.store.read(job_id)
-        return row
-
-    def execute(self, job_id: str, *, dry_run: bool = False) -> dict[str, Any]:
-        try:
-            return self._execute_unprotected(job_id, dry_run=dry_run)
-        except Exception as exc:
-            try:
-                row = self.controller.store.read(job_id)
-                state = JobState(row["state"])
-                if state not in {JobState.COMPLETED, JobState.MANUAL_OWNER_REVIEW_REQUIRED, JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}:
-                    self.controller.advance(job_id, JobState.RECOVERABLE_FAILURE, side_effect_state="UNKNOWN", receipt={"error_code": type(exc).__name__})
-            except Exception:
-                pass
-            raise
-
-    def _execute_unprotected(self, job_id: str, *, dry_run: bool = False) -> dict[str, Any]:
-        row, request = self._request(job_id)
-        operation = request.get("operation")
-        if operation == "ADVANCE_EXISTING_CAMPAIGN_BRANCH":
-            if dry_run:
-                return self.dry_run(job_id)
-            return self._advance_campaign(job_id)
-        if operation == "COMMIT_FILE":
-            return self._commit_file(job_id, request)
-        if operation == "SYNC_TASK_BRANCH_TO_GITEA":
-            new_oid = self._validate_campaign(request)
-            final = self.broker.push_branch(new_oid)
-            return {"operation": operation, "remote_verified": final == new_oid, "final_network_oid": final}
-        if operation == "CREATE_PR":
-            self._validate_campaign(request)
-            return dict(self.broker.create_pr("AIOS autonomous release control plane", "Durable campaign continuation; exact head and recovery evidence are bound in the Job."))
-        if operation == "PUBLISH_CHECK":
-            self._validate_campaign(request)
-            context = request.get("check_context", "aios/durable-release")
-            state = request.get("check_state", "success")
-            description = request.get("check_description", "Durable campaign control-plane check passed")
-            return dict(self.broker.status(str(state), str(description), str(context)))
-        if operation == "PROTECTED_MERGE":
-            self._validate_campaign(request)
-            number = int(request.get("pr_number", "0"))
-            self.broker.transport.expected_merge_head = request["expected_branch_oid"]
-            expected_main = request.get("expected_main_oid")
-            if expected_main is not None:
-                self.broker.transport.expected_merge_base = expected_main
-            return dict(self.broker.merge(number))
-        if operation == "RECONCILE_AUTHORITY_MAIN":
-            self._validate_campaign(request)
-            old = request.get("expected_main_oid")
-            new = request.get("new_branch_oid")
-            if not isinstance(old, str) or not isinstance(new, str):
-                raise JobExecutionError("MAIN_RECONCILIATION_BINDING_INVALID")
-            gitea_main = self.broker.transport.read_branch("main")
-            if gitea_main != new:
-                raise JobExecutionError("GITEA_MAIN_EXPECTATION_MISMATCH")
-            if not self.authority.ancestry_check(old, new):
-                raise JobExecutionError("MAIN_OID_NOT_DESCENDANT")
-            return {"authority_main": self.authority.ff_CAS_main_after_verified_protected_merge(old, new)}
-        raise JobExecutionError("OPERATION_NOT_ALLOWED")
-
-    def _advance_campaign(self, job_id: str) -> dict[str, Any]:
-        self._recover_requested(job_id)
-        row, request = self._request(job_id)
-        new_oid = self._validate_campaign(request)
-        expected_oid = request["expected_branch_oid"]
-        state = JobState(row["state"])
-        if state == JobState.REQUESTED:
-            receipt = self.controller.advance(job_id, JobState.AUTHORIZED, side_effect_state="AUTHORIZED", receipt={"authorization_digest": AUTHORIZATION_DIGEST, "task_id": TASK_ID})
-            row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.AUTHORIZED:
-            self.controller.lease_job(job_id, lease_id=f"lease-{job_id}", lineage_anchor_oid=LINEAGE_ANCHOR, current_head_oid=expected_oid, generation=1, lease_expires_at="2099-01-01T00:00:00Z", expected_revision=int(row["revision"]))
-            row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.LEASED:
-            self.controller.advance(job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY", receipt={"branch": BRANCH, "expected_oid": expected_oid})
-            row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.WORKTREE_READY:
-            self.controller.advance(job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
-            row = self.controller.store.read(job_id)
-        authority_before = self.authority.read_ref(f"refs/heads/{BRANCH}")
-        if authority_before == expected_oid:
-            authority_oid = self.authority.advance_task_branch_CAS(f"refs/heads/{BRANCH}", expected_oid, new_oid)
-        elif authority_before == new_oid:
-            authority_oid = new_oid
-        else:
-            raise JobExecutionError("AUTHORITY_BRANCH_CONFLICT")
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.EXECUTING:
-            self.controller.advance(job_id, JobState.LOCAL_VERIFIED, side_effect_state="LOCAL_VERIFIED", receipt={"authority": {"branch": BRANCH, "previous_oid": expected_oid, "new_oid": new_oid, "CAS_success": True, "readback_oid": authority_oid}})
-        row = self.controller.store.read(job_id)
-        remote_before = self.broker.readback()
-        if remote_before != new_oid:
-            if remote_before not in {None, expected_oid}:
-                raise JobExecutionError("GITEA_BRANCH_CONFLICT")
-            if JobState(row["state"]) == JobState.LOCAL_VERIFIED:
-                if hasattr(self.broker, "receipt"):
-                    self.broker.receipt = replace(self.broker.receipt, expected_oid=expected_oid)
-                self.controller.advance(job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS", receipt={"gitea": {"previous_oid": remote_before, "desired_oid": new_oid, "force_push": False}})
-            final_network = self.broker.push_branch(new_oid)
-        else:
-            final_network = new_oid
-        final_api = self.broker.readback()
-        if final_api != new_oid:
-            raise JobExecutionError("GITEA_BRANCH_READBACK_MISMATCH")
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) in {JobState.LOCAL_VERIFIED, JobState.REMOTE_SYNCING}:
-            self.controller.advance(job_id, JobState.REMOTE_VERIFIED, side_effect_state="REMOTE_VERIFIED", receipt={"gitea": {"machine_actor": "aios-autonomy-agent", "previous_oid": remote_before, "desired_oid": new_oid, "final_network_oid": final_network, "final_API_oid": final_api, "force_push": False}})
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.REMOTE_VERIFIED:
-            self.controller.advance(job_id, JobState.COMPLETED, side_effect_state="REMOTE_VERIFIED", receipt={"authority_oid": authority_oid, "network_oid": final_network, "gitea_api_oid": final_api, "force_push": False})
-        return self.controller.store._receipt(self.controller.store.read(job_id), duplicate=True).as_dict()
-
-    def _commit_file(self, job_id: str, request: Mapping[str, Any]) -> dict[str, Any]:
-        row = self.controller.store.read(job_id)
-        payload_ref = request.get("payload_ref")
-        if not payload_ref:
-            raise JobExecutionError("PAYLOAD_REQUIRED")
-        payload = self.controller.store.payloads.read_verified(payload_ref, row["payload_digest"], int(request["payload_size"]))
-        try:
-            spec = json.loads(payload.decode())
-            path = str(spec["path"])
-            content = base64.b64decode(spec["content_base64"], validate=True)
-        except Exception as exc:
-            raise JobExecutionError("COMMIT_FILE_PAYLOAD_INVALID") from exc
-        new_oid = self.authority.commit_file_in_isolated_worktree(base_oid=row["expected_branch_oid"], files={path: content}, message="chore(gitops): durable commit-file", worktree_name=job_id)
-        return {"operation": "COMMIT_FILE", "new_oid": new_oid}
-
-
-def build_from_environment(job_root: Path) -> DurableJobExecutor:
-    from aios_gitea_machine_transport import GiteaMachineTransport
-    from aios_gitea_machine_broker import MachineCredentialProjection
-
-    account = __import__("os").environ.get("AIOS_GITEA_MACHINE_ACCOUNT", "aios-autonomy-agent")
-    api = __import__("os").environ.get("AIOS_GITEA_API", "https://g.cnnetmkt.top/git/api/v1")
-    remote = __import__("os").environ.get("AIOS_GITEA_REMOTE", "https://g.cnnetmkt.top/git/aios/aios.git")
-    authority_dir = Path(__import__("os").environ.get("AIOS_GITOPS_AUTHORITY_GIT_DIR", "/data/aios-gitops/repo.git"))
-    worktree_root = Path(__import__("os").environ.get("AIOS_GITOPS_WORKTREE_ROOT", "/var/lib/aios-gitops/worktrees"))
-    recovery = Path(__import__("os").environ.get("AIOS_RELEASE_RECOVERY_RECEIPT", "/var/lib/aios-gitops/release-campaigns/AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807/authorization-recovery.json"))
-    transport = GiteaMachineTransport(api, REPOSITORY, remote, authority_dir)
-    credential = MachineCredentialProjection.from_mapping({"scheme": "systemd-credential", "name": "gitea-machine-token", "account": account})
-    receipt = CampaignCapabilityReceipt(CAMPAIGN_ID, TASK_ID, REPOSITORY, BRANCH, EXPECTED_BRANCH_OID, frozenset({"exact_task_branch_push", "pr_create_update", "status_publish", "protected_merge", "remote_readback"}), frozenset({"direct_main_push", "force_push", "tag_update", "tag_delete", "baseline_write", "production_deploy"}))
-    return DurableJobExecutor(GitOpsJobController(JobStore(job_root)), AuthorityGitExecutor(authority_dir, worktree_root), GiteaMachineBroker(transport, credential, receipt), recovery)
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--job-root", required=True, type=Path)
-    parser.add_argument("--job-id", required=True)
-    parser.add_argument("--dry-run", action="store_true")
-    args = parser.parse_args(argv)
-    result = build_from_environment(args.job_root).execute(args.job_id, dry_run=args.dry_run)
-    print(json.dumps(result, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

active-runtime/app/aios_gitops_job_identity.py

@@ -1,32 +0,0 @@
-"""Collision-resistant storage keys for durable governed Task state."""
-from __future__ import annotations
-
-import hashlib
-import re
-
-
-class JobIdentityError(RuntimeError):
-    pass
-
-
-def legacy_task_storage_key(task_id: str) -> str:
-    """Return the historical lossy key solely to detect migration conflicts."""
-    if not isinstance(task_id, str) or not task_id:
-        raise JobIdentityError("TASK_ID_INVALID")
-    return re.sub(r"[^A-Za-z0-9_.-]+", "-", task_id).strip("-")[:120] or "task"
-
-
-def task_storage_key(task_id: str) -> str:
-    """Return a canonical collision-resistant key for every Task state sink."""
-    if (
-        not isinstance(task_id, str)
-        or not task_id
-        or task_id != task_id.strip()
-        or len(task_id) > 512
-    ):
-        raise JobIdentityError("TASK_ID_INVALID")
-    readable = re.sub(r"[^A-Za-z0-9_.-]+", "-", task_id).strip("-")[:48] or "task"
-    digest = hashlib.sha256(
-        ("aios-task-storage-v1\0" + task_id).encode("utf-8")
-    ).hexdigest()
-    return f"{readable}-{digest}"

active-runtime/app/aios_gitops_model_api.py

@@ -5,8 +5,6 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
 
-from release_version import validate_release_version
-
 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WORKSPACE = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
 DB_PATH = Path(os.getenv('AIOS_GITOPS_DB', str(ROOT / 'runtime' / 'gitops_model.sqlite3')))
@@ -220,11 +218,7 @@ class Handler(BaseHTTPRequestHandler):
                 a = self.require_write(['owner']);
                 if not a: return
                 ver=data.get('version') or data.get('tag')
-                try:
-                    validate_release_version(ver)
-                except ValueError:
-                    self.send_json({'error':'version must match VxRxCx'},400)
-                    return
+                if not re.match(r'^V\d+R\d+C\d+(-[a-zA-Z0-9_.-]+)?$', ver or ''): self.send_json({'error':'version must match VxRxCx'},400); return
                 msg=data.get('message') or f'release {ver}'; out=git_cmd(['tag','-a',ver,'-m',msg]);
                 if data.get('push',False): git_cmd(['push','origin',ver])
                 level='V' if re.match(r'^V[1-9]\d*R0C0', ver) else ('R' if re.match(r'^V\d+R[1-9]\d*C0', ver) else 'C'); exec_sql('INSERT OR REPLACE INTO gitops_versions(version,tag,level,summary,status,created_by,created_at) VALUES(?,?,?,?,?,?,?)',(ver,ver,level,msg,'ready',a['username'],now())); exec_sql('UPDATE gitops_baseline SET active_version=?,active_tag=?,updated_at=? WHERE id=?',(ver,ver,now(),'current')); audit(a['username'],'git_tag',ver,{'level':level}); self.send_json({'status':'tagged','version':ver,'git':out}); return

active-runtime/app/aios_gitops_reconciliation_core.py

@@ -1,80 +0,0 @@
-"""Pure, observation-first decisions for governed GitOps reconciliation."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from enum import Enum
-import re
-from typing import Optional
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-
-
-class ReconciliationAction(str, Enum):
-    NOOP = "NOOP"
-    PUSH_EXACT = "PUSH_EXACT"
-    VERIFY_REMOTE = "VERIFY_REMOTE"
-    MARK_REMOTE_VERIFIED = "MARK_REMOTE_VERIFIED"
-    MARK_RECONCILIATION_REQUIRED = "MARK_RECONCILIATION_REQUIRED"
-    FAIL_CONFLICT = "FAIL_CONFLICT"
-
-
-@dataclass(frozen=True, slots=True)
-class RemoteObservation:
-    repository_identity: str
-    branch: str
-    desired_oid: str
-    authority_oid: Optional[str]
-    remote_git_oid: Optional[str]
-    remote_api_oid: Optional[str]
-    commit_visible: bool
-    observed_at: str
-    expected_oid: Optional[str] = None
-
-    @property
-    def all_equal(self) -> bool:
-        values = (self.authority_oid, self.remote_git_oid, self.remote_api_oid, self.desired_oid)
-        return all(isinstance(value, str) for value in values) and len(set(values)) == 1
-
-
-@dataclass(frozen=True, slots=True)
-class ReconciliationDecision:
-    action: ReconciliationAction
-    state: str
-    reason: str
-    retry_safe: bool = False
-
-
-def _valid_oid(value: Optional[str]) -> bool:
-    return value is None or bool(OID_RE.fullmatch(value))
-
-
-def decide_reconciliation(observation: RemoteObservation) -> ReconciliationDecision:
-    """Decide from a fresh observation; never complete on a missing remote."""
-    if observation.repository_identity != "aios/aios":
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "REPOSITORY_IDENTITY_MISMATCH")
-    if not observation.branch.startswith("agent/"):
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "BRANCH_SCOPE_DENIED")
-    if not _valid_oid(observation.desired_oid) or not _valid_oid(observation.expected_oid):
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "OID_INVALID")
-    if observation.authority_oid is None:
-        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "AUTHORITY_UNAVAILABLE")
-    if observation.authority_oid != observation.desired_oid:
-        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "AUTHORITY_CONFLICT")
-    present = [oid for oid in (observation.remote_git_oid, observation.remote_api_oid) if oid is not None]
-    if any(oid not in {observation.desired_oid, observation.expected_oid} for oid in present):
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "REMOTE_OID_CONFLICT")
-    if observation.all_equal and observation.commit_visible:
-        return ReconciliationDecision(ReconciliationAction.MARK_REMOTE_VERIFIED, "REMOTE_VERIFIED", "ALL_OIDS_EQUAL_AND_VISIBLE")
-    if observation.remote_git_oid is None and observation.remote_api_oid is None:
-        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "REMOTE_PUSH_PENDING", "AUTHORITY_DESIRED_REMOTE_MISSING")
-    if observation.remote_git_oid == observation.desired_oid or observation.remote_api_oid == observation.desired_oid:
-        return ReconciliationDecision(ReconciliationAction.VERIFY_REMOTE, "REMOTE_VERIFY_PENDING", "REMOTE_PROOF_PARTIAL")
-    if observation.expected_oid is not None and observation.remote_git_oid == observation.expected_oid and observation.remote_api_oid == observation.expected_oid:
-        return ReconciliationDecision(ReconciliationAction.PUSH_EXACT, "REMOTE_PUSH_PENDING", "SAFE_EXACT_FAST_FORWARD_RETRY", retry_safe=True)
-    if not observation.commit_visible:
-        return ReconciliationDecision(ReconciliationAction.VERIFY_REMOTE, "COMMIT_VISIBILITY_PENDING", "COMMIT_VISIBILITY_LAG")
-    return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "PARTIAL_REMOTE_OBSERVATION")
-
-
-def reconcile_observation(**kwargs: object) -> ReconciliationDecision:
-    return decide_reconciliation(RemoteObservation(**kwargs))

active-runtime/app/aios_gitops_writer_worker.py

@@ -1,100 +0,0 @@
-"""Single supervised socket-activated worker for durable GitOps Jobs.
-
-The worker consumes durable requests and reconciliation queries. Repository
-mutation is a separate injected executor and remains impossible while the
-legacy global write gate is false.
-"""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-from pathlib import Path
-import signal
-import socket
-import threading
-from typing import Any, Mapping
-
-from aios_gitops_job_controller import GitOpsJobController, JobError, JobState, JobStore, ServiceUnavailable
-
-
-def runtime_policy(environment: Mapping[str, str] | None = None) -> dict[str, bool]:
-    env = environment or os.environ
-    legacy = env.get("AIOS_GITOPS_WRITES_ENABLED", "false").lower() in {"1", "true", "yes", "on"}
-    durable = env.get("AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED", "false").lower() in {"1", "true", "yes", "on"}
-    # Legacy direct Git mutation remains disabled. Authorized durable Jobs use
-    # their own campaign/task capability and may mutate only through the
-    # worker's lease/CAS path while the legacy gate stays false.
-    return {"legacy_global_write": legacy, "durable_job_execution": durable, "repository_mutation_allowed": durable}
-
-
-def handle_request(controller: GitOpsJobController, request: Mapping[str, Any], executor: Any | None = None) -> dict[str, Any]:
-    job_id = str(request.get("job_id") or "")
-    if not job_id:
-        raise JobError("JOB_ID_REQUIRED")
-    if request.get("action") == "execute":
-        if executor is None:
-            raise JobError("JOB_EXECUTOR_UNAVAILABLE")
-        result = executor.execute(job_id, dry_run=bool(request.get("dry_run", False)))
-        receipt = controller.store._receipt(controller.store.read(job_id), duplicate=True)
-        return {"job": result, **receipt.as_dict()}
-    if request.get("action") == "resume":
-        receipt = controller.resume(job_id)
-    else:
-        row = controller.store.read(job_id)
-        receipt = controller.store._receipt(row, duplicate=True)
-    return receipt.as_dict()
-
-
-def serve_socket(sock: socket.socket, controller: GitOpsJobController, stopping: threading.Event, executor: Any | None = None) -> None:
-    sock.listen(32)
-    sock.settimeout(1.0)
-    while not stopping.is_set():
-        try:
-            connection, _ = sock.accept()
-        except socket.timeout:
-            continue
-        with connection:
-            try:
-                raw = connection.makefile("rb").readline(1_048_576)
-                request = json.loads(raw.decode("utf-8"))
-                response = {"status": "ok", **handle_request(controller, request, executor)}
-            except ServiceUnavailable as exc:
-                response = {"status": "error", "error": str(exc), "retryable": True, "side_effect_state": "UNKNOWN"}
-            except Exception as exc:
-                response = {"status": "error", "error": type(exc).__name__, "retryable": False}
-            connection.sendall((json.dumps(response, sort_keys=True) + "\n").encode("utf-8"))
-
-
-def socket_from_systemd() -> socket.socket:
-    if os.environ.get("LISTEN_FDS") != "1":
-        raise RuntimeError("SOCKET_ACTIVATION_REQUIRED")
-    return socket.fromfd(3, socket.AF_UNIX, socket.SOCK_STREAM)
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--job-root", required=True, type=Path)
-    args = parser.parse_args(argv)
-    policy = runtime_policy()
-    if policy["legacy_global_write"]:
-        raise RuntimeError("LEGACY_GLOBAL_WRITES_MUST_REMAIN_FALSE")
-    if not policy["durable_job_execution"]:
-        raise RuntimeError("DURABLE_JOB_EXECUTION_GATE_CLOSED")
-    controller = GitOpsJobController(JobStore(args.job_root))
-    from aios_gitops_job_executor import build_from_environment
-    executor = build_from_environment(args.job_root)
-    stopping = threading.Event()
-    signal.signal(signal.SIGTERM, lambda *_: stopping.set())
-    signal.signal(signal.SIGINT, lambda *_: stopping.set())
-    sock = socket_from_systemd()
-    try:
-        serve_socket(sock, controller, stopping, executor)
-    finally:
-        sock.close()
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

active-runtime/app/aios_governed_local_writer_cli.py

@@ -1,69 +0,0 @@
-"""CLI client for the governed local writer service."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import socket
-import sys
-
-
-def _parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="Send one governed-local-writer request")
-    parser.add_argument("--socket", required=True, help="AF_UNIX socket path")
-    group = parser.add_mutually_exclusive_group(required=True)
-    group.add_argument("--request", help="Request JSON string")
-    group.add_argument("--request-file", help="Path to JSON request file")
-    return parser.parse_args()
-
-
-def _load_request_text(args: argparse.Namespace) -> str:
-    if args.request is not None:
-        return args.request
-    request_path = os.fspath(args.request_file)
-    with open(request_path, "r", encoding="utf-8") as request_file:
-        return request_file.read()
-
-
-def send_request(socket_path: str, request_text: str) -> dict[str, object]:
-    """Open one Unix socket, send one NDJSON request, and parse one NDJSON response."""
-    payload = json.loads(request_text)
-    if not isinstance(payload, dict):
-        raise ValueError("request must be a JSON object")
-
-    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
-        client.connect(socket_path)
-        client.sendall((json.dumps(payload) + "\n").encode("utf-8"))
-        response_chunks: list[str] = []
-        while True:
-            chunk = client.recv(1024 * 1024).decode("utf-8")
-            if not chunk:
-                break
-            response_chunks.append(chunk)
-            if "\n" in chunk:
-                break
-        response_text = "".join(response_chunks)
-
-    response_line = response_text.split("\n", 1)[0].strip()
-    if not response_line:
-        raise RuntimeError("empty response")
-    response = json.loads(response_line)
-    if not isinstance(response, dict):
-        raise RuntimeError("invalid response")
-    return response
-
-
-def main() -> None:
-    args = _parse_args()
-    request_text = _load_request_text(args)
-    response = send_request(args.socket, request_text)
-    print(json.dumps(response, separators=(",", ":"), sort_keys=True))
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except Exception as exc:  # pragma: no cover - CLI entrypoint behavior
-        print(json.dumps({"status": "error", "error": str(exc)}), file=sys.stderr)
-        raise SystemExit(1)

active-runtime/app/aios_governed_local_writer_service.py

@@ -1,931 +0,0 @@
-"""Unix-socket service for governed local writer operations."""
-
-from __future__ import annotations
-
-import json
-import hashlib
-import argparse
-import importlib.util
-import os
-import re
-import socket
-import subprocess
-import sys
-import tempfile
-import uuid
-from dataclasses import dataclass, field
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol
-
-from governed_local_writer import (
-    AppendCommitRequest,
-    AuthorizationError,
-    BranchPolicy,
-    CreateBranchRequest,
-    GovernedAuthorization,
-    PeerIdentity,
-    PRINCIPAL,
-    TASK_ID,
-    extract_peer_identity,
-    contains_secret_like_content,
-    load_authorization_file,
-    validate_file_changes,
-)
-
-
-class ExistingGitOpsHandler:
-    """Delegate repository mutations to the installed GitOps handler seam."""
-
-    def __init__(
-        self,
-        *,
-        workspace_by_branch: Mapping[str, str | os.PathLike[str]],
-        bare_repo: str | os.PathLike[str],
-        api_source: str | os.PathLike[str],
-    ) -> None:
-        self.workspace_by_branch = {str(k): Path(v) for k, v in workspace_by_branch.items()}
-        self.bare_repo = Path(bare_repo)
-        self.api_source = Path(api_source)
-
-    @staticmethod
-    def _restore_env(previous: Mapping[str, str | None]) -> None:
-        for key, value in previous.items():
-            if value is None:
-                os.environ.pop(key, None)
-            else:
-                os.environ[key] = value
-
-    def _load_api(self, workspace: Path):
-        if not self.api_source.is_file() or self.api_source.is_symlink():
-            raise RuntimeError("installed GitOps handler source is unavailable")
-        keys = (
-            "AIOS_GITOPS_WORKSPACE",
-            "AIOS_GITOPS_BARE_REPO",
-            "AIOS_GITOPS_WRITES_ENABLED",
-            "PYTHONDONTWRITEBYTECODE",
-            "GIT_CONFIG_COUNT",
-            "GIT_CONFIG_KEY_0",
-            "GIT_CONFIG_VALUE_0",
-            "GIT_CONFIG_KEY_1",
-            "GIT_CONFIG_VALUE_1",
-        )
-        previous = {key: os.environ.get(key) for key in keys}
-        os.environ.update(
-            {
-                "AIOS_GITOPS_WORKSPACE": str(workspace),
-                "AIOS_GITOPS_BARE_REPO": str(self.bare_repo),
-                "AIOS_GITOPS_WRITES_ENABLED": "true",
-                "PYTHONDONTWRITEBYTECODE": "1",
-                "GIT_CONFIG_COUNT": "2",
-                "GIT_CONFIG_KEY_0": "safe.directory",
-                "GIT_CONFIG_VALUE_0": str(workspace),
-                "GIT_CONFIG_KEY_1": "safe.directory",
-                "GIT_CONFIG_VALUE_1": str(self.bare_repo),
-            }
-        )
-        module_name = f"_governed_gitops_api_{uuid.uuid4().hex}"
-        try:
-            spec = importlib.util.spec_from_file_location(module_name, self.api_source)
-            if spec is None or spec.loader is None:
-                raise RuntimeError("unable to load installed GitOps handler")
-            module = importlib.util.module_from_spec(spec)
-            sys.modules[module_name] = module
-            spec.loader.exec_module(module)
-            decision = module.evaluate_git_write(module.WS)
-            if not decision.allowed:
-                raise RuntimeError("existing GitOps write gate denied bootstrap")
-            return module, previous, module_name
-        except Exception:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-            raise
-
-    def _workspace(self, branch: str) -> Path:
-        workspace = self.workspace_by_branch.get(branch)
-        if workspace is None or not workspace.is_dir():
-            raise RuntimeError("branch workspace is not authorized")
-        return workspace
-
-    @staticmethod
-    def _git(workspace: Path, args: list[str]) -> str:
-        result = subprocess.run(
-            ["git", *args], cwd=workspace, text=True, capture_output=True, check=False
-        )
-        if result.returncode != 0:
-            raise RuntimeError("governed handler git probe failed")
-        return result.stdout.strip()
-
-    def create_branch(self, request: CreateBranchRequest) -> Mapping[str, object]:
-        workspace = self._workspace(request.branch)
-        # A prior handler call may have completed the fast-forward sync before
-        # the process observed a post-commit error. Reconcile only an exact,
-        # metadata-only result; never overwrite or move an existing ref here.
-        try:
-            existing = self._git(
-                workspace,
-                [
-                    "--git-dir",
-                    str(self.bare_repo),
-                    "rev-parse",
-                    f"refs/heads/{request.branch}",
-                ],
-            )
-        except RuntimeError:
-            existing = ""
-        if existing:
-            parent = self._git(workspace, ["--git-dir", str(self.bare_repo), "rev-parse", f"{existing}^1"])
-            changed = self._git(
-                workspace,
-                [
-                    "--git-dir",
-                    str(self.bare_repo),
-                    "diff-tree",
-                    "--no-commit-id",
-                    "--name-only",
-                    "-r",
-                    existing,
-                ],
-            ).splitlines()
-            safe_branch = re.sub(r"[^A-Za-z0-9_.-]+", "-", request.branch).strip("-")
-            if parent != request.base_oid or changed != [f"patches/{safe_branch}.branch.json"]:
-                raise RuntimeError("existing branch is not an exact metadata-only bootstrap")
-            return {"head_oid": existing, "parent_oid": parent, "handler_status": "reconciled"}
-        module, previous, module_name = self._load_api(workspace)
-        phase = "loaded"
-        try:
-            phase = "verify_base"
-            parent = self._git(
-                workspace,
-                ["--git-dir", str(self.bare_repo), "rev-parse", "refs/heads/main"],
-            )
-            if parent != request.base_oid:
-                raise RuntimeError("authorized base OID drift")
-            phase = "checkout"
-            module.checkout(request.branch, base=request.base_oid, create=True)
-            phase = "write_metadata"
-            safe_branch = re.sub(r"[^A-Za-z0-9_.-]+", "-", request.branch).strip("-")
-            metadata_path = f"patches/{safe_branch}.branch.json"
-            module.write_json(
-                metadata_path,
-                {
-                    "schema": "aios.governed-local-writer-bootstrap.v1",
-                    "task_id": TASK_ID,
-                    "principal": PRINCIPAL,
-                    "branch": request.branch,
-                    "parent_oid": request.base_oid,
-                    "authorization_sha256": request.authorization_digest,
-                },
-            )
-            phase = "commit_and_sync"
-            result = module.commit(
-                [metadata_path], "chore(governance): bootstrap repair lease branch"
-            )
-            head_oid = self._git(workspace, ["rev-parse", "HEAD"])
-            first_parent = self._git(workspace, ["rev-parse", "HEAD^1"])
-            if first_parent != request.base_oid or (request.head_oid and head_oid != request.head_oid):
-                raise RuntimeError("bootstrap branch lineage check failed")
-            return {
-                "head_oid": head_oid,
-                "parent_oid": first_parent,
-                "handler_status": str(result.get("status")),
-            }
-        except Exception as exc:
-            raise RuntimeError(f"handler_phase={phase};error={exc.__class__.__name__}") from exc
-        finally:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-
-    def append_commit(self, request: AppendCommitRequest) -> Mapping[str, object]:
-        workspace = self._workspace(request.branch)
-        module, previous, module_name = self._load_api(workspace)
-        phase = "loaded"
-        try:
-            phase = "verify_head"
-            current = self._git(workspace, ["rev-parse", "HEAD"])
-            if current != request.expected_head_oid:
-                raise RuntimeError("branch head advanced or is stale")
-            phase = "checkout"
-            module.checkout(request.branch, base=request.expected_head_oid, create=False)
-            phase = "write_files"
-            paths: list[str] = []
-            for change in request.changes:
-                paths.append(module.write_file(change.path, change.content))
-            phase = "commit_and_sync"
-            result = module.commit(paths, request.commit_message)
-            head_oid = self._git(workspace, ["rev-parse", "HEAD"])
-            first_parent = self._git(workspace, ["rev-parse", "HEAD^1"])
-            if first_parent != request.expected_head_oid or head_oid == first_parent:
-                raise RuntimeError("append commit lineage check failed")
-            return {
-                "head_oid": head_oid,
-                "parent_oid": first_parent,
-                "handler_status": str(result.get("status")),
-            }
-        except Exception as exc:
-            raise RuntimeError(f"handler_phase={phase};error={exc.__class__.__name__}") from exc
-        finally:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-
-
-class GovernedWriterHandler(Protocol):
-    """Small adapter interface for real writer backend handlers."""
-
-    def create_branch(self, request: CreateBranchRequest) -> Mapping[str, object]:
-        """Create a branch using internal repo services."""
-
-    def append_commit(self, request: AppendCommitRequest) -> Mapping[str, object]:
-        """Append a commit using internal repo services."""
-
-
-class AuditSink(Protocol):
-    """Pluggable sink for sanitized audit records."""
-
-    def append(self, record: "AuditRecord") -> None:
-        """Persist one audit record."""
-
-
-@dataclass
-class AuditRecord:
-    """Sanitized audit log entry."""
-
-    authorization_digest: str
-    peer_pid: int
-    peer_uid: int
-    peer_gid: int
-    peer_executable: str | None
-    timestamp: datetime
-    operation: str
-    branch: str
-    result: str
-
-
-class InMemoryAuditSink:
-    """Simple in-memory audit log used by tests."""
-
-    def __init__(self) -> None:
-        self.records: list[AuditRecord] = []
-
-    def append(self, record: AuditRecord) -> None:
-        self.records.append(record)
-
-
-@dataclass
-class _AuthorizationState:
-    """Tracks one-shot operation consumption."""
-
-    create_done: set[str] = field(default_factory=set)
-    append_done: set[str] = field(default_factory=set)
-    consumed: bool = False
-
-
-class GovernedLocalWriterService:
-    """Policy-aware AF_UNIX service that calls an injected handler."""
-
-    def __init__(
-        self,
-        socket_path: str | os.PathLike[str],
-        authorization: GovernedAuthorization,
-        handler: GovernedWriterHandler,
-        *,
-        audit_sink: AuditSink | None = None,
-        peer_identity_fn: Callable[[socket.socket], PeerIdentity] | None = None,
-        state_path: str | os.PathLike[str] | None = None,
-    ) -> None:
-        self.socket_path = Path(socket_path)
-        self.authorization = authorization
-        self.handler = handler
-        self.peer_identity_fn = peer_identity_fn or extract_peer_identity
-        self.state = _AuthorizationState()
-        self.audit_sink = audit_sink or InMemoryAuditSink()
-        self.state_path = Path(state_path) if state_path is not None else None
-        self._load_state()
-
-    def _load_state(self) -> None:
-        """Restore one-shot state without restoring request or secret material."""
-        if self.state_path is None or not self.state_path.exists():
-            return
-        try:
-            raw = json.loads(self.state_path.read_text(encoding="utf-8"))
-            if not isinstance(raw, dict):
-                raise ValueError("state must be an object")
-            if raw.get("authorization_sha256") != self.authorization.authorization_sha256:
-                raise ValueError("state authorization digest mismatch")
-            self.state.create_done = {str(v) for v in raw.get("create_done", [])}
-            self.state.append_done = {str(v) for v in raw.get("append_done", [])}
-            self.state.consumed = bool(raw.get("consumed", False))
-        except (OSError, ValueError, TypeError, json.JSONDecodeError) as exc:
-            raise AuthorizationError("authorization state is invalid") from exc
-
-    def _persist_state(self) -> None:
-        if self.state_path is None:
-            return
-        self.state_path.parent.mkdir(parents=True, exist_ok=True)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "create_done": sorted(self.state.create_done),
-            "append_done": sorted(self.state.append_done),
-            "consumed": self.state.consumed,
-        }
-        fd, temp_name = tempfile.mkstemp(prefix=".writer-state-", dir=self.state_path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            os.replace(temp_name, self.state_path)
-            os.chmod(self.state_path, 0o600)
-        finally:
-            if os.path.exists(temp_name):
-                os.unlink(temp_name)
-
-    def _new_audit(self, peer: PeerIdentity, operation: str, branch: str, result: str) -> None:
-        self.audit_sink.append(
-            AuditRecord(
-                authorization_digest=self.authorization.authorization_sha256,
-                peer_pid=peer.pid,
-                peer_uid=peer.uid,
-                peer_gid=peer.gid,
-                peer_executable=peer.executable,
-                timestamp=datetime.now(tz=timezone.utc),
-                operation=operation,
-                branch=branch,
-                result=result,
-            )
-        )
-
-    def _require_request_field(self, request: Mapping[str, Any], field_name: str) -> str:
-        value = request.get(field_name)
-        if not isinstance(value, str) or not value:
-            raise AuthorizationError(f"{field_name} must be a non-empty string")
-        return value
-
-    def _branch_policy(self, branch: str) -> BranchPolicy:
-        policy = self.authorization.branch_operations.get(branch)
-        if policy is None:
-            raise AuthorizationError("branch is not authorized")
-        return policy
-
-    def _ensure_not_consumed(self) -> None:
-        if self.state.consumed:
-            raise AuthorizationError("authorization consumed")
-        if datetime.now(tz=timezone.utc) >= self.authorization.expires_at:
-            raise AuthorizationError("authorization expired")
-
-    def _mark_success(self, op: str, branch: str) -> None:
-        if op == "create_branch":
-            self.state.create_done.add(branch)
-        elif op == "append_commit":
-            self.state.append_done.add(branch)
-
-        if self.state.create_done.issuperset(self.authorization.create_branches) and self.state.append_done.issuperset(
-            self.authorization.append_branches
-        ):
-            self.state.consumed = True
-        self._persist_state()
-
-    def _validate_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        task_id = self._require_request_field(request, "task_id")
-        if task_id != TASK_ID:
-            raise AuthorizationError("invalid task_id")
-
-        principal = self._require_request_field(request, "principal")
-        if principal != PRINCIPAL:
-            raise AuthorizationError("invalid principal")
-
-        operation = self._require_request_field(request, "op")
-        if operation not in {"create_branch", "append_commit"}:
-            raise AuthorizationError("unsupported operation")
-        if operation in self.authorization.denied_operations:
-            raise AuthorizationError("operation denied by policy")
-
-        branch = self._require_request_field(request, "branch")
-        self._ensure_not_consumed()
-        policy = self._branch_policy(branch)
-
-        if operation == "create_branch":
-            if policy.create_branch is None:
-                raise AuthorizationError("branch does not allow create_branch")
-            if branch in self.state.create_done:
-                raise AuthorizationError("create_branch already used for this branch")
-
-            base_oid = self._require_request_field(request, "base_oid")
-            raw_head_oid = request.get("head_oid")
-            if raw_head_oid is not None and (not isinstance(raw_head_oid, str) or not raw_head_oid):
-                raise AuthorizationError("head_oid must be a non-empty string when supplied")
-            head_oid = str(raw_head_oid) if raw_head_oid is not None else None
-            if base_oid != policy.create_branch.base_oid:
-                raise AuthorizationError("base_oid mismatch")
-            if policy.create_branch.head_oid is not None and head_oid != policy.create_branch.head_oid:
-                raise AuthorizationError("head_oid mismatch")
-
-            return {
-                "operation": operation,
-                "branch": branch,
-                "base_oid": base_oid,
-                "head_oid": head_oid,
-            }
-
-        if policy.append_commit is None:
-            raise AuthorizationError("branch does not allow append_commit")
-        if policy.create_branch is not None and branch not in self.state.create_done:
-            raise AuthorizationError("append_commit requires prior successful create_branch")
-        if branch in self.state.append_done:
-            raise AuthorizationError("append_commit already used for this branch")
-
-        expected_head = policy.append_commit.expected_head_oid
-        if "expected_head_oid" in request:
-            supplied_head = self._require_request_field(request, "expected_head_oid")
-        elif "current_head_oid" in request:
-            supplied_head = self._require_request_field(request, "current_head_oid")
-        else:
-            raise AuthorizationError("expected_head_oid or current_head_oid required")
-        if not re.fullmatch(r"[0-9a-fA-F]{40}", supplied_head):
-            raise AuthorizationError("head check must be a full commit OID")
-        if expected_head is not None and supplied_head != expected_head:
-            raise AuthorizationError("head check failed")
-
-        if request.get("force") is True or request.get("non_fast_forward") is True:
-            raise AuthorizationError("non-fast-forward operations are not allowed")
-        if request.get("history_rewrite") is True:
-            raise AuthorizationError("history rewrite is not allowed")
-        parent_oids = request.get("parent_oids")
-        if parent_oids is not None:
-            if not isinstance(parent_oids, list) or parent_oids != [supplied_head]:
-                raise AuthorizationError("parent_oids must contain exactly expected_head_oid")
-
-        changes = request.get("changes")
-        if not isinstance(changes, list):
-            raise AuthorizationError("changes must be a list")
-        validated_changes = validate_file_changes(changes, policy.append_commit.allowed_paths)
-        commit_message = request.get("commit_message", "chore(governance): append governed commit")
-        if not isinstance(commit_message, str) or not commit_message.strip() or len(commit_message) > 200:
-            raise AuthorizationError("commit_message must be a short non-empty string")
-        if "\n" in commit_message or "\r" in commit_message or contains_secret_like_content(commit_message):
-            raise AuthorizationError("commit_message failed policy")
-
-        return {
-            "operation": operation,
-            "branch": branch,
-            "expected_head_oid": supplied_head,
-            "changes": validated_changes,
-            "commit_message": commit_message.strip(),
-        }
-
-    def process_request(self, raw_request: Mapping[str, Any], peer: PeerIdentity) -> Mapping[str, Any]:
-        """Run one request through policy checks and handler adapter."""
-        operation = raw_request.get("op") if isinstance(raw_request.get("op"), str) else "unknown"
-        branch = raw_request.get("branch") if isinstance(raw_request.get("branch"), str) else ""
-        try:
-            details = self._validate_request(raw_request)
-            operation = str(details["operation"])
-            branch = str(details["branch"])
-
-            if operation == "create_branch":
-                self.handler.create_branch(
-                    CreateBranchRequest(
-                        branch=branch,
-                        base_oid=str(details["base_oid"]),
-                        head_oid=(
-                            str(details["head_oid"])
-                            if details.get("head_oid") is not None
-                            else None
-                        ),
-                        authorization_digest=self.authorization.authorization_sha256,
-                    )
-                )
-                self._mark_success("create_branch", branch)
-                self._new_audit(peer, operation, branch, "ok")
-                return {
-                    "status": "ok",
-                    "operation": operation,
-                    "branch": branch,
-                    "result": "applied",
-                }
-
-            self.handler.append_commit(
-                AppendCommitRequest(
-                    branch=branch,
-                    expected_head_oid=str(details["expected_head_oid"]),
-                    changes=tuple(details["changes"]),
-                    authorization_digest=self.authorization.authorization_sha256,
-                    commit_message=str(details["commit_message"]),
-                )
-            )
-            self._mark_success("append_commit", branch)
-            self._new_audit(peer, operation, branch, "ok")
-            return {
-                "status": "ok",
-                "operation": operation,
-                "branch": branch,
-                "result": "applied",
-            }
-        except Exception as error:
-            self._new_audit(peer, operation or "unknown", branch, f"error:{error.__class__.__name__}")
-            if isinstance(error, PermissionError):
-                code = "permission_denied"
-            elif isinstance(error, AuthorizationError):
-                code = "request_denied"
-            else:
-                code = "handler_failed"
-            if code == "handler_failed" and str(error).startswith("handler_phase="):
-                code = str(error)
-            return {
-                "status": "error",
-                "operation": operation or "unknown",
-                "branch": branch,
-                "error": code,
-            }
-
-    def _write_json(self, connection: socket.socket, payload: Mapping[str, Any]) -> None:
-        connection.sendall((json.dumps(payload) + "\n").encode("utf-8"))
-
-    def _handle_client(self, connection: socket.socket) -> None:
-        with connection:
-            try:
-                peer = self.peer_identity_fn(connection)
-            except Exception:
-                self._write_json(
-                    connection,
-                    {
-                        "status": "error",
-                        "operation": "connection",
-                        "branch": "",
-                        "error": "peer identity validation failed",
-                    },
-                )
-                return
-
-            with connection.makefile("r", encoding="utf-8") as stream:
-                for raw_line in stream:
-                    line = raw_line.strip()
-                    if not line:
-                        continue
-                    try:
-                        request = json.loads(line)
-                    except json.JSONDecodeError:
-                        self._write_json(
-                            connection,
-                            {
-                                "status": "error",
-                                "operation": "request",
-                                "branch": "",
-                                "error": "invalid json",
-                            },
-                        )
-                        continue
-                    if not isinstance(request, Mapping):
-                        self._write_json(
-                            connection,
-                            {
-                                "status": "error",
-                                "operation": "request",
-                                "branch": "",
-                                "error": "request must be a JSON object",
-                            },
-                        )
-                        continue
-                    self._write_json(connection, self.process_request(request, peer))
-
-    def _bind_socket(self) -> socket.socket:
-        if self.socket_path.exists():
-            raise RuntimeError("governed writer socket already exists")
-        parent = self.socket_path.parent
-        if not parent.is_dir():
-            raise RuntimeError("governed writer socket parent is missing")
-        if parent.is_symlink():
-            raise RuntimeError("governed writer socket parent must not be a symlink")
-        server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        server.bind(str(self.socket_path))
-        os.chmod(self.socket_path, 0o600)
-        server.listen(16)
-        return server
-
-    def serve(self) -> None:
-        """Serve newline-delimited JSON over a filesystem AF_UNIX socket."""
-        server = self._bind_socket()
-        try:
-            while True:
-                connection, _ = server.accept()
-                self._handle_client(connection)
-        finally:
-            server.close()
-            if self.socket_path.exists():
-                self.socket_path.unlink()
-
-
-class JsonAuditSink:
-    """Append-only root-owned audit sink containing no request payloads."""
-
-    def __init__(self, path: str | os.PathLike[str]) -> None:
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-
-    def append(self, record: AuditRecord) -> None:
-        payload = {
-            "authorization_sha256": record.authorization_digest,
-            "peer_pid": record.peer_pid,
-            "peer_uid": record.peer_uid,
-            "peer_gid": record.peer_gid,
-            "peer_executable": record.peer_executable,
-            "timestamp": record.timestamp.isoformat(),
-            "operation": record.operation,
-            "branch": record.branch,
-            "result": record.result,
-        }
-        line = (json.dumps(payload, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
-        fd = os.open(self.path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
-        try:
-            os.fchmod(fd, 0o600)
-            os.write(fd, line)
-        finally:
-            os.close(fd)
-
-
-
-# V2R1C6 durable receipt overlay.  This subclasses the original root-only
-# writer in-place so the existing AF_UNIX/SO_PEERCRED and handler policy remain
-# the only mutation path.
-_LegacyGovernedLocalWriterService = GovernedLocalWriterService
-
-class GovernedLocalWriterService(_LegacyGovernedLocalWriterService):
-    """Existing writer with durable request receipts and safe recovery."""
-
-    def _load_state(self) -> None:
-        super()._load_state()
-        self.state.receipts = {}
-        if self.state_path is None or not self.state_path.exists():
-            return
-        raw = json.loads(self.state_path.read_text(encoding="utf-8"))
-        if not isinstance(raw, dict):
-            raise AuthorizationError("authorization state is invalid")
-        receipts = raw.get("receipts", {})
-        if not isinstance(receipts, dict):
-            raise AuthorizationError("authorization receipts are invalid")
-        self.state.receipts = {
-            str(key): dict(value)
-            for key, value in receipts.items()
-            if isinstance(value, dict)
-        }
-
-    def _persist_state(self) -> None:
-        if self.state_path is None:
-            return
-        self.state_path.parent.mkdir(parents=True, exist_ok=True)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "create_done": sorted(self.state.create_done),
-            "append_done": sorted(self.state.append_done),
-            "consumed": bool(self.state.consumed),
-            "receipts": self.state.receipts,
-        }
-        fd, temp_name = tempfile.mkstemp(prefix=".writer-state-", dir=self.state_path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            os.replace(temp_name, self.state_path)
-            os.chmod(self.state_path, 0o600)
-        finally:
-            if os.path.exists(temp_name):
-                os.unlink(temp_name)
-
-    def _request_identity(self, request: Mapping[str, Any]) -> dict[str, str]:
-        canonical = json.dumps(dict(request), sort_keys=True, separators=(",", ":"), ensure_ascii=True)
-        fallback = hashlib.sha256(canonical.encode("utf-8")).hexdigest()
-        request_id = request.get("request_id")
-        idempotency_key = request.get("idempotency_key")
-        request_id = request_id.strip() if isinstance(request_id, str) and request_id.strip() else "legacy-" + fallback
-        idempotency_key = idempotency_key.strip() if isinstance(idempotency_key, str) and idempotency_key.strip() else "legacy-" + fallback
-        for field_name, value in (("request_id", request_id), ("idempotency_key", idempotency_key)):
-            if len(value) > 200 or "\n" in value or "\r" in value:
-                raise AuthorizationError(field_name + " is invalid")
-        return {
-            "request_id": request_id,
-            "idempotency_key": idempotency_key,
-            "request_fingerprint": fallback,
-        }
-
-    def _find_receipt(self, details: Mapping[str, Any], compare_fingerprint: bool = True):
-        request_id = str(details["request_id"])
-        idempotency_key = str(details["idempotency_key"])
-        fingerprint = str(details.get("request_fingerprint", ""))
-        for receipt in self.state.receipts.values():
-            if receipt.get("request_id") == request_id or receipt.get("idempotency_key") == idempotency_key:
-                if compare_fingerprint and receipt.get("request_fingerprint") != fingerprint:
-                    raise AuthorizationError("idempotency key reused with different request")
-                return receipt
-        return None
-
-    @staticmethod
-    def _receipt_response(receipt: Mapping[str, object], status: str = "receipt") -> dict[str, object]:
-        response = {
-            "status": status,
-            "request_id": receipt.get("request_id"),
-            "idempotency_key": receipt.get("idempotency_key"),
-            "operation": receipt.get("operation"),
-            "branch": receipt.get("branch", ""),
-            "receipt_status": receipt.get("status"),
-        }
-        for field_name in ("commit_oid", "final_head", "parent_oid", "audit_sha256", "error_code", "safe_to_retry"):
-            if field_name in receipt:
-                response[field_name] = receipt[field_name]
-        return response
-
-    def _new_receipt(self, details: Mapping[str, Any]) -> dict[str, object]:
-        return {
-            "request_id": str(details["request_id"]),
-            "idempotency_key": str(details["idempotency_key"]),
-            "request_fingerprint": str(details["request_fingerprint"]),
-            "operation": str(details["operation"]),
-            "branch": str(details.get("branch", "")),
-            "expected_head_oid": str(details.get("expected_head_oid", "")),
-            "status": "accepted",
-            "created_at": datetime.now(tz=timezone.utc).isoformat(),
-            "safe_to_retry": False,
-        }
-
-    def _new_audit(self, peer: PeerIdentity, operation: str, branch: str, result: str) -> str:
-        super()._new_audit(peer, operation, branch, result)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "peer_pid": peer.pid,
-            "peer_uid": peer.uid,
-            "peer_gid": peer.gid,
-            "peer_executable": peer.executable,
-            "operation": operation,
-            "branch": branch,
-            "result": result,
-        }
-        return hashlib.sha256(json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")).hexdigest()
-
-    def _mark_success(self, op: str, branch: str) -> None:
-        if op == "create_branch":
-            self.state.create_done.add(branch)
-        elif op in {"append_commit", "append_files", "append_batch"}:
-            self.state.append_done.add(branch)
-        # The provisioning grant is one-shot; the task writer lease itself must
-        # support multiple append receipts for the exact authorized branches.
-        self.state.consumed = False
-        self._persist_state()
-
-    def _validate_durable(self, raw_request: Mapping[str, Any]) -> dict[str, Any]:
-        operation = self._require_request_field(raw_request, "op")
-        identity = self._request_identity(raw_request)
-        if operation == "query_receipt":
-            return {"operation": operation, **identity}
-        if operation == "recover_request":
-            branch = self._require_request_field(raw_request, "branch")
-            policy = self._branch_policy(branch)
-            if policy.append_commit is None:
-                raise AuthorizationError("branch does not allow recovery")
-            expected = raw_request.get("expected_head_oid") or policy.append_commit.expected_head_oid
-            if not isinstance(expected, str) or not re.fullmatch(r"[0-9a-fA-F]{40}", expected):
-                raise AuthorizationError("recovery requires expected_head_oid")
-            return {"operation": operation, "branch": branch, "expected_head_oid": expected.lower(), **identity}
-        if operation not in {"create_branch", "append_commit", "append_files", "append_batch"}:
-            raise AuthorizationError("unsupported operation")
-        request = dict(raw_request)
-        if operation in {"append_files", "append_batch"}:
-            request["op"] = "append_commit"
-        if operation in {"append_commit", "append_files", "append_batch"}:
-            self.state.consumed = False
-        branch = request.get("branch")
-        removed = False
-        dynamic_expected = False
-        if isinstance(branch, str) and branch in self.state.append_done:
-            self.state.append_done.remove(branch)
-            removed = True
-            policy = self.authorization.branch_operations.get(branch)
-            if policy is not None and policy.append_commit is not None and policy.append_commit.expected_head_oid is not None:
-                from governed_local_writer import BranchAppendPolicy, BranchPolicy
-                self.authorization.branch_operations[branch] = BranchPolicy(create_branch=policy.create_branch, append_commit=BranchAppendPolicy(branch=branch, expected_head_oid=None, allowed_paths=policy.append_commit.allowed_paths))
-                dynamic_expected = True
-        try:
-            details = super()._validate_request(request)
-        finally:
-            if dynamic_expected:
-                policy = self.authorization.branch_operations.get(str(branch))
-                if policy is not None and policy.append_commit is not None:
-                    from governed_local_writer import BranchAppendPolicy, BranchPolicy
-                    self.authorization.branch_operations[str(branch)] = BranchPolicy(create_branch=policy.create_branch, append_commit=BranchAppendPolicy(branch=str(branch), expected_head_oid=str(raw_request.get("expected_head_oid") or ""), allowed_paths=policy.append_commit.allowed_paths))
-            if removed:
-                self.state.append_done.add(str(branch))
-        details.update(identity)
-        details["operation"] = operation
-        return details
-
-    def _recover_backend(self, details: Mapping[str, Any]) -> dict[str, object]:
-        if not hasattr(self.handler, "_workspace") or not hasattr(self.handler, "_git"):
-            raise RuntimeError("recovery backend unavailable")
-        workspace = self.handler._workspace(str(details["branch"]))
-        expected = str(details["expected_head_oid"])
-        current = self.handler._git(workspace, ["rev-parse", "HEAD"])
-        if current == expected:
-            return {"status": "not_started", "final_head": current}
-        parent = self.handler._git(workspace, ["rev-parse", "HEAD^1"])
-        if parent != expected:
-            raise RuntimeError("external branch advance during recovery")
-        return {"status": "applied", "commit_oid": current, "final_head": current, "parent_oid": parent}
-
-    def process_request(self, raw_request: Mapping[str, Any], peer: PeerIdentity) -> Mapping[str, Any]:
-        operation = raw_request.get("op") if isinstance(raw_request.get("op"), str) else "unknown"
-        branch = raw_request.get("branch") if isinstance(raw_request.get("branch"), str) else ""
-        try:
-            details = self._validate_durable(raw_request)
-            operation = str(details["operation"])
-            branch = str(details.get("branch", ""))
-            if operation == "query_receipt":
-                receipt = self._find_receipt(details, compare_fingerprint=False)
-                return self._receipt_response(receipt) if receipt is not None else {"status": "not_found", "request_id": details["request_id"], "idempotency_key": details["idempotency_key"]}
-            if operation == "recover_request":
-                receipt = self._find_receipt(details, compare_fingerprint=False)
-                if receipt is None:
-                    return {"status": "not_found", "request_id": details["request_id"], "idempotency_key": details["idempotency_key"], "safe_to_retry": True}
-                if receipt.get("status") == "applied":
-                    return self._receipt_response(receipt)
-                recovered = self._recover_backend(details)
-                if recovered.get("status") == "applied":
-                    receipt.update({"status": "applied", "commit_oid": recovered.get("commit_oid"), "final_head": recovered.get("final_head"), "parent_oid": recovered.get("parent_oid"), "safe_to_retry": False})
-                    self._mark_success("append_commit", branch)
-                    return self._receipt_response(receipt)
-                receipt["safe_to_retry"] = True
-                self._persist_state()
-                return self._receipt_response(receipt)
-            receipt = self._find_receipt(details)
-            if receipt is not None:
-                return self._receipt_response(receipt)
-            receipt = self._new_receipt(details)
-            self.state.receipts[str(details["request_id"])] = receipt
-            self._persist_state()
-            if operation == "create_branch":
-                result = self.handler.create_branch(CreateBranchRequest(branch=branch, base_oid=str(details["base_oid"]), head_oid=str(details["head_oid"]) if details.get("head_oid") is not None else None, authorization_digest=self.authorization.authorization_sha256))
-                commit_oid = str(result.get("head_oid", ""))
-                parent_oid = str(result.get("parent_oid", ""))
-                audit_sha = self._new_audit(peer, operation, branch, "ok")
-                receipt.update({"status": "applied", "commit_oid": commit_oid, "final_head": commit_oid, "parent_oid": parent_oid, "audit_sha256": audit_sha, "safe_to_retry": False})
-                self._mark_success("create_branch", branch)
-                return self._receipt_response(receipt, status="ok") | {"result": "applied"}
-            result = self.handler.append_commit(AppendCommitRequest(branch=branch, expected_head_oid=str(details["expected_head_oid"]), changes=tuple(details["changes"]), authorization_digest=self.authorization.authorization_sha256, commit_message=str(details["commit_message"])))
-            commit_oid = str(result.get("head_oid", ""))
-            parent_oid = str(result.get("parent_oid", ""))
-            audit_sha = self._new_audit(peer, operation, branch, "ok")
-            receipt.update({"status": "applied", "commit_oid": commit_oid, "final_head": commit_oid, "parent_oid": parent_oid, "audit_sha256": audit_sha, "safe_to_retry": False})
-            self._mark_success("append_commit", branch)
-            return self._receipt_response(receipt, status="ok") | {"result": "applied"}
-        except Exception as error:
-            try:
-                identity = self._request_identity(raw_request)
-                receipt = self.state.receipts.get(identity["request_id"])
-                if receipt is not None and receipt.get("status") == "accepted":
-                    receipt.update({"status": "failed", "error_code": error.__class__.__name__, "safe_to_retry": False})
-                    self._persist_state()
-            except Exception:
-                pass
-            self._new_audit(peer, operation, branch, "error:" + error.__class__.__name__)
-            return {"status": "error", "operation": operation, "branch": branch, "error": "request_denied" if isinstance(error, AuthorizationError) else "handler_failed"}
-
-def _parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="AIOS governed local writer")
-    parser.add_argument("--socket", required=True)
-    parser.add_argument("--authorization", required=True)
-    parser.add_argument("--state", required=True)
-    parser.add_argument("--audit", required=True)
-    parser.add_argument("--repair-branch", required=True)
-    parser.add_argument("--repair-workspace", required=True)
-    parser.add_argument("--candidate-branch", required=True)
-    parser.add_argument("--candidate-workspace", required=True)
-    parser.add_argument("--bare-repo", required=True)
-    parser.add_argument("--api-source", required=True)
-    return parser.parse_args()
-
-
-def main() -> int:
-    if hasattr(os, "geteuid") and os.geteuid() != 0:
-        print("governed local writer requires uid 0", file=sys.stderr)
-        return 2
-    args = _parse_args()
-    authorization = load_authorization_file(args.authorization)
-    handler = ExistingGitOpsHandler(
-        workspace_by_branch={
-            args.repair_branch: args.repair_workspace,
-            args.candidate_branch: args.candidate_workspace,
-        },
-        bare_repo=args.bare_repo,
-        api_source=args.api_source,
-    )
-    service = GovernedLocalWriterService(
-        args.socket,
-        authorization,
-        handler,
-        audit_sink=JsonAuditSink(args.audit),
-        state_path=args.state,
-    )
-    service.serve()
-    return 0
-
-
-if __name__ == "__main__":  # pragma: no cover - systemd entrypoint
-    raise SystemExit(main())

active-runtime/app/aios_governed_policy.py

@@ -1,59 +0,0 @@
-"""Central fail-closed policy seam for governed task and continuation requests."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import re
-from typing import Any, Mapping
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedPolicyInput:
-    identity: str
-    task_id: str
-    repository: str
-    operation: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    generation: int
-    risk: str = "engineering"
-    requested_capabilities: tuple[str, ...] = ()
-    previous_generation: int | None = None
-
-
-@dataclass(frozen=True, slots=True)
-class PolicyDecision:
-    decision: str
-    reason: str
-
-    def as_dict(self) -> dict[str, str]:
-        return {"decision": self.decision, "reason": self.reason}
-
-
-def evaluate_policy(value: GovernedPolicyInput | Mapping[str, Any]) -> PolicyDecision:
-    if isinstance(value, Mapping):
-        value = GovernedPolicyInput(**value)
-    if value.repository != "aios/aios":
-        return PolicyDecision("DENY", "REPOSITORY_IDENTITY_MISMATCH")
-    if not OID_RE.fullmatch(value.base_oid) or not OID_RE.fullmatch(value.expected_branch_oid):
-        return PolicyDecision("DENY", "OID_INVALID")
-    if not value.target_branch.startswith("agent/") or value.target_branch in {"main", "master"}:
-        return PolicyDecision("DENY", "BRANCH_SCOPE_DENIED")
-    if "force_push" in value.requested_capabilities or "force" in value.operation.lower():
-        return PolicyDecision("DENY", "FORCE_PUSH_DENIED")
-    if {"main_write", "tag_write", "baseline_write", "production_write", "production_deploy", "tag_mutation", "baseline_mutation"}.intersection(value.requested_capabilities):
-        return PolicyDecision("DENY", "MUTATION_SCOPE_DENIED")
-    if not isinstance(value.generation, int) or isinstance(value.generation, bool) or value.generation < 1:
-        return PolicyDecision("DENY", "GENERATION_INVALID")
-    if value.previous_generation is not None and value.generation <= value.previous_generation:
-        return PolicyDecision("MANUAL_OWNER_REVIEW_REQUIRED", "GENERATION_NOT_MONOTONIC")
-    if not value.task_id:
-        return PolicyDecision("DENY", "TASK_ID_INVALID")
-    return PolicyDecision("ALLOW", "GOVERNED_ENGINEERING_SCOPE")
-
-
-class GovernedPolicy:
-    def decide(self, request: GovernedPolicyInput | Mapping[str, Any]) -> PolicyDecision:
-        return evaluate_policy(request)

active-runtime/app/aios_governed_task_bootstrap.py

@@ -1,303 +0,0 @@
-"""Durable governed task binding for CREATE_NEW and CONTINUE_EXISTING."""
-from __future__ import annotations
-
-from dataclasses import dataclass, asdict
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import stat
-import tempfile
-from typing import Any, Mapping
-
-from aios_gitops_job_controller import GitOpsJobController, JobStore
-from aios_gitops_job_identity import legacy_task_storage_key, task_storage_key
-from aios_online_agent_execution import GovernedExecutionBinding, project_execution_envelope
-
-try:  # pragma: no cover - exercised on the Linux activation host
-    import fcntl
-except ImportError:  # pragma: no cover - non-POSIX execution stays fail closed
-    fcntl = None  # type: ignore[assignment]
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-
-
-class BootstrapError(RuntimeError):
-    pass
-
-
-def _lexists(path: Path) -> bool:
-    try:
-        path.lstat()
-        return True
-    except FileNotFoundError:
-        return False
-
-
-def _require_runtime_directory(path: Path) -> None:
-    try:
-        metadata = path.lstat()
-    except OSError as exc:
-        raise BootstrapError("TASK_STORAGE_PARENT_INVALID") from exc
-    expected_uid = getattr(os, "geteuid", lambda: metadata.st_uid)()
-    if (
-        stat.S_ISLNK(metadata.st_mode)
-        or not stat.S_ISDIR(metadata.st_mode)
-        or metadata.st_mode & 0o022
-        or metadata.st_uid != expected_uid
-    ):
-        raise BootstrapError("TASK_STORAGE_PARENT_INVALID")
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedTaskBinding:
-    task_id: str
-    repository: str
-    base_oid: str
-    target_branch: str
-    risk: str
-    description: str
-    idempotency_key: str
-    expected_branch_oid: str
-    branch_mode: str
-    generation: int
-    job_id: str | None = None
-
-    def response(self, *, idempotent: bool = False) -> dict[str, Any]:
-        return {"task_id": self.task_id, "repository": self.repository, "base_oid": self.base_oid, "target_branch": self.target_branch, "expected_branch_oid": self.expected_branch_oid, "generation": self.generation, "branch_mode": self.branch_mode, "create_target_branch": self.branch_mode == "CREATE_NEW", "worktree_mode": "detached_at_base_oid" if self.branch_mode == "CREATE_NEW" else "detached_at_expected_head", "cas_ref_update_required": True, "idempotent": idempotent, "state": "BOUND", "job_id": self.job_id}
-
-
-
-# ===== AIOS Formal Lineage producer-native reservation v12 =====
-import re as _fl_re
-
-_FL_PRODUCER_KEY = _fl_re.compile(r"^[0-9a-f]{64}$")
-
-def _formal_lineage_reservation_receipt(
-    value,
-    *,
-    request_idempotency_key: str,
-    expected_side_effect_state: str,
-):
-    if callable(getattr(value, "as_dict", None)):
-        raw=value.as_dict()
-    elif isinstance(value, dict):
-        raw=dict(value)
-    else:
-        raise RuntimeError("GOVERNED_TASK_SUBMIT_RECEIPT_TYPE_INVALID")
-
-    producer_key=raw.get("idempotency_key")
-    job_id=raw.get("job_id")
-    if not isinstance(job_id,str) or not job_id:
-        raise RuntimeError("GOVERNED_TASK_SUBMIT_RECEIPT_JOB_ID_INVALID")
-    if raw.get("state")!="REQUESTED":
-        raise RuntimeError("GOVERNED_TASK_SUBMIT_RECEIPT_STATE_INVALID")
-    if raw.get("side_effect_state")!=expected_side_effect_state:
-        raise RuntimeError("GOVERNED_TASK_SUBMIT_RECEIPT_SIDE_EFFECT_STATE_INVALID")
-    if not isinstance(producer_key,str) or not _FL_PRODUCER_KEY.fullmatch(producer_key):
-        raise RuntimeError("GOVERNED_TASK_SUBMIT_RECEIPT_PRODUCER_IDEMPOTENCY_INVALID")
-    if job_id!="job-"+producer_key[:32]:
-        raise RuntimeError("GOVERNED_TASK_SUBMIT_RECEIPT_JOB_PRODUCER_KEY_CONFLICT")
-    if not isinstance(request_idempotency_key,str) or not request_idempotency_key:
-        raise RuntimeError("GOVERNED_TASK_REQUEST_IDEMPOTENCY_INVALID")
-
-    return {
-        "job_id":job_id,
-        "state":"REQUESTED",
-        "side_effect_state":raw["side_effect_state"],
-        "producer_idempotency_key":producer_key,
-        "request_idempotency_key":request_idempotency_key,
-    }
-
-def _formal_lineage_attach_receipt(response, receipt):
-    if not isinstance(response, dict):
-        raise RuntimeError("GOVERNED_TASK_BINDING_RESPONSE_INVALID")
-    if response.get("state")!="BOUND":
-        raise RuntimeError("GOVERNED_TASK_BINDING_STATE_INVALID")
-    if response.get("job_id")!=receipt.get("job_id"):
-        raise RuntimeError("GOVERNED_TASK_BINDING_RECEIPT_JOB_CONFLICT")
-    result=dict(response)
-    result["reservation_receipt"]=dict(receipt)
-    return result
-
-class GovernedTaskBootstrap:
-    def __init__(self, authority: Any, root: Path, *, remote_name: str, token_path: Path, ssh_key_path: Path, api_base: str = "https://g.cnnetmkt.top/git/api/v1") -> None:
-        self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.lock_root = self.root / "task-binding-locks"; self.task_meta_root.mkdir(parents=True, exist_ok=True, mode=0o700); self.job_root.mkdir(parents=True, exist_ok=True, mode=0o700); self.lock_root.mkdir(parents=True, exist_ok=True, mode=0o700); _require_runtime_directory(self.task_meta_root); _require_runtime_directory(self.job_root); _require_runtime_directory(self.lock_root)
-
-    def _store(self, task_id: str) -> tuple[JobStore, GitOpsJobController]:
-        root = self.job_root / task_storage_key(task_id)
-        legacy = self.job_root / legacy_task_storage_key(task_id)
-        if legacy != root and _lexists(legacy):
-            if _lexists(root):
-                raise BootstrapError("TASK_STORAGE_LEGACY_CONFLICT")
-            raise BootstrapError("TASK_STORAGE_LEGACY_MIGRATION_REQUIRED")
-        store = JobStore(root, payload_root=root / "payloads")
-        return store, GitOpsJobController(store)
-
-    def _metadata(self, task_id: str) -> Path:
-        return self.task_meta_root / (task_storage_key(task_id) + ".json")
-
-    def _legacy_metadata(self, task_id: str) -> Path:
-        return self.task_meta_root / (legacy_task_storage_key(task_id) + ".json")
-
-    def _read_existing(self, task_id: str) -> GovernedTaskBinding | None:
-        path = self._metadata(task_id)
-        legacy = self._legacy_metadata(task_id)
-        if legacy != path and _lexists(legacy):
-            if _lexists(path):
-                raise BootstrapError("TASK_BINDING_LEGACY_CONFLICT")
-            raise BootstrapError("TASK_BINDING_LEGACY_MIGRATION_REQUIRED")
-        if not _lexists(path):
-            return None
-        if not path.is_file() or path.is_symlink():
-            raise BootstrapError("TASK_BINDING_PATH_INVALID")
-
-        binding = GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
-        if binding.task_id != task_id:
-            raise BootstrapError("TASK_BINDING_IDENTITY_CONFLICT")
-        return binding
-    def get_binding(self, task_id: str) -> GovernedTaskBinding:
-        """Read the exact durable binding; never synthesize missing lineage."""
-        binding = self._read_existing(str(task_id))
-        if binding is None or not binding.job_id:
-            raise BootstrapError("TASK_EXECUTION_PROJECTION_MISSING")
-        return binding
-
-    def execution_binding(self, binding: GovernedTaskBinding) -> GovernedExecutionBinding:
-        return GovernedExecutionBinding.from_mapping(
-            {
-                "task_id": binding.task_id,
-                "job_id": binding.job_id,
-                "repository": binding.repository,
-                "base_oid": binding.base_oid,
-                "expected_branch_oid": binding.expected_branch_oid,
-                "target_branch": binding.target_branch,
-                "branch_mode": binding.branch_mode,
-                "generation": binding.generation,
-                "idempotency_key": binding.idempotency_key,
-            }
-        )
-
-    def execution_envelope(
-        self,
-        task_id: str,
-        execution_request: Mapping[str, Any] | None = None,
-        *,
-        required_capabilities: tuple[str, ...] = (),
-        expected_job_id: str | None = None,
-    ) -> dict[str, Any]:
-        binding = self.get_binding(task_id)
-        if expected_job_id and binding.job_id != expected_job_id:
-            raise BootstrapError("JOB_BINDING_CONFLICT")
-        return project_execution_envelope(
-            self.execution_binding(binding),
-            execution_request,
-            required_capabilities=required_capabilities,
-        )
-
-    def _write(self, binding: GovernedTaskBinding) -> None:
-        path = self._metadata(binding.task_id)
-        descriptor, temporary_name = tempfile.mkstemp(
-            prefix=".task-binding-", dir=self.task_meta_root,
-        )
-        temporary = Path(temporary_name)
-        try:
-            os.fchmod(descriptor, 0o600)
-            with os.fdopen(descriptor, "w", encoding="utf-8", newline="\n") as stream:
-                stream.write(json.dumps(asdict(binding), sort_keys=True) + "\n")
-                stream.flush()
-                os.fsync(stream.fileno())
-            os.replace(temporary, path)
-            os.chmod(path, 0o600)
-            parent = os.open(self.task_meta_root, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
-            try:
-                os.fsync(parent)
-            finally:
-                os.close(parent)
-        except BaseException:
-            temporary.unlink(missing_ok=True)
-            raise
-
-    def _task_lock(self, task_id: str) -> int:
-        if fcntl is None:
-            raise BootstrapError("TASK_BINDING_LOCK_UNAVAILABLE")
-        path = self.lock_root / (task_storage_key(task_id) + ".lock")
-        descriptor = os.open(
-            path,
-            os.O_RDWR | os.O_CREAT | getattr(os, "O_NOFOLLOW", 0),
-            0o600,
-        )
-        metadata = os.fstat(descriptor)
-        expected_uid = getattr(os, "geteuid", lambda: metadata.st_uid)()
-        if (
-            not stat.S_ISREG(metadata.st_mode)
-            or metadata.st_nlink != 1
-            or metadata.st_uid != expected_uid
-        ):
-            os.close(descriptor)
-            raise BootstrapError("TASK_BINDING_LOCK_INVALID")
-        os.fchmod(descriptor, 0o600)
-        try:
-            fcntl.flock(descriptor, fcntl.LOCK_EX | fcntl.LOCK_NB)
-        except OSError as exc:
-            os.close(descriptor)
-            raise BootstrapError("TASK_BINDING_BUSY") from exc
-        return descriptor
-
-    @staticmethod
-    def _unlock_task(descriptor: int) -> None:
-        if fcntl is not None:
-            fcntl.flock(descriptor, fcntl.LOCK_UN)
-        os.close(descriptor)
-
-    def create(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        values = {key: str(request[key]) for key in ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")}
-        if values["repository"] != "aios/aios" or not OID_RE.fullmatch(values["base_oid"]): raise BootstrapError("TASK_BINDING_INVALID")
-        if not BRANCH_RE.fullmatch(values["target_branch"]): raise BootstrapError("TARGET_BRANCH_INVALID")
-        descriptor = self._task_lock(values["task_id"])
-        try:
-            existing = self._read_existing(values["task_id"])
-            if existing is not None:
-                if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")): raise BootstrapError("TASK_BINDING_CONFLICT")
-                expected = str(request.get('expected_branch_oid') or values['base_oid'])
-                payload = json.dumps(values, sort_keys=True, separators=(',', ':')).encode()
-                _, controller = self._store(values['task_id'])
-                _fl_submit_receipt = controller.submit({'idempotency_key': values['idempotency_key'], 'campaign_id': values['task_id'], 'task_id': values['task_id'], 'repository': values['repository'], 'operation': 'GOVERNED_TASK_CREATE', 'branch': values['target_branch'], 'expected_branch_oid': expected, 'payload_digest': hashlib.sha256(payload).hexdigest(), 'lineage_anchor_oid': values['base_oid']}, payload=payload)
-                _fl_receipt = _formal_lineage_reservation_receipt(
-                    _fl_submit_receipt, request_idempotency_key=request["idempotency_key"],
-                    expected_side_effect_state='SAME_JOB'
-                )
-                _fl_response = existing.response(idempotent=True)
-                return _formal_lineage_attach_receipt(_fl_response,_fl_receipt)
-            if not self.authority.commit_exists(values["base_oid"]): raise BootstrapError("BASE_COMMIT_NOT_FOUND")
-            current = self.authority.read_ref("refs/heads/" + values["target_branch"])
-            expected = str(request.get("expected_branch_oid") or values["base_oid"])
-            if current is None:
-                mode, generation = "CREATE_NEW", 1
-                if expected != values["base_oid"]: raise BootstrapError("EXPECTED_BASE_CONFLICT")
-            else:
-                if expected != current: raise BootstrapError("EXISTING_BRANCH_OID_CONFLICT")
-                mode, generation = "CONTINUE_EXISTING", int(request.get("generation", 2))
-                if generation < 1: raise BootstrapError("GENERATION_INVALID")
-            payload = json.dumps(values, sort_keys=True, separators=(",", ":")).encode()
-            _, controller = self._store(values["task_id"])
-            expected_job_id = controller.internal_job_id_for_idempotency_key(values["idempotency_key"])
-            with controller.store._connect() as connection:
-                bootstrap_jobs = connection.execute(
-                    "SELECT job_id FROM jobs WHERE operation='GOVERNED_TASK_CREATE' ORDER BY job_id"
-                ).fetchall()
-            if bootstrap_jobs and [str(row[0]) for row in bootstrap_jobs] != [expected_job_id]:
-                raise BootstrapError("TASK_BINDING_RECOVERY_CONFLICT")
-            receipt = controller.submit({"idempotency_key": values["idempotency_key"], "campaign_id": values["task_id"], "task_id": values["task_id"], "repository": values["repository"], "operation": "GOVERNED_TASK_CREATE", "branch": values["target_branch"], "expected_branch_oid": expected, "payload_digest": hashlib.sha256(payload).hexdigest(), "lineage_anchor_oid": values["base_oid"]}, payload=payload)
-            binding = GovernedTaskBinding(**values, expected_branch_oid=expected, branch_mode=mode, generation=generation, job_id=receipt.job_id)
-            self._write(binding)
-            _fl_receipt = _formal_lineage_reservation_receipt(
-                receipt, request_idempotency_key=request["idempotency_key"],
-                expected_side_effect_state="QUEUED"
-            )
-            _fl_response = binding.response()
-            return _formal_lineage_attach_receipt(_fl_response,_fl_receipt)
-        finally:
-            self._unlock_task(descriptor)

active-runtime/app/aios_isolated_writer_api/__init__.py

@@ -0,0 +1,23 @@
+"""Task-bound Integration Refresh control-plane primitives."""
+
+from .integration_merge_writer import IntegrationMergeWriter, MergeError, MergeRequest
+from .integration_refresh import (
+    AppendOnlyAudit,
+    Binding,
+    GiteaBranchReadProjection,
+    GrantStore,
+    IntegrationRefreshProvisioner,
+    ProvisioningError,
+)
+
+__all__ = [
+    "AppendOnlyAudit",
+    "Binding",
+    "GiteaBranchReadProjection",
+    "GrantStore",
+    "IntegrationMergeWriter",
+    "IntegrationRefreshProvisioner",
+    "MergeError",
+    "MergeRequest",
+    "ProvisioningError",
+]

active-runtime/app/aios_isolated_writer_api/integration_merge_writer.py

@@ -0,0 +1,90 @@
+"""Constrained integration-only merge writer with rollback and reconciliation states."""
+from __future__ import annotations
+
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+import re
+
+
+class MergeError(RuntimeError):
+    def __init__(self, code: str, status: int = 409):
+        super().__init__(code); self.code, self.status = code, status
+
+
+@dataclass(frozen=True)
+class MergeRequest:
+    integration_branch: str
+    source_branch: str
+    approved_source_oid: str
+
+
+class IntegrationMergeWriter:
+    def __init__(self, workspace: Path | str, remote: str, projection):
+        self.workspace, self.remote, self.projection = Path(workspace), remote, projection
+
+    def _git(self, *args: str, check=True) -> str:
+        p = subprocess.run(["git", *args], cwd=self.workspace, text=True, capture_output=True)
+        if check and p.returncode:
+            raise MergeError("git_operation_failed", 500)
+        return p.stdout.strip()
+
+    def merge(self, request: MergeRequest) -> dict:
+        def bad(value: str) -> bool:
+            return (
+                value == "main"
+                or value.startswith("main/")
+                or value == "governance"
+                or value.startswith("governance/")
+                or value == "approvals"
+                or value.startswith("refs/")
+                or value.startswith("tags/")
+            )
+        if (bad(request.integration_branch) or bad(request.source_branch) or
+                not request.integration_branch.startswith("integration/") or
+                re.fullmatch(r"[0-9a-fA-F]{40}", request.approved_source_oid) is None):
+            raise MergeError("integration_merge_scope_rejected", 403)
+        for branch in (request.integration_branch, request.source_branch):
+            if subprocess.run(["git", "check-ref-format", "--branch", branch], cwd=self.workspace,
+                              text=True, capture_output=True).returncode:
+                raise MergeError("integration_merge_scope_rejected", 403)
+        if self._git("rev-parse", "--abbrev-ref", "HEAD") != request.integration_branch:
+            raise MergeError("integration_branch_checkout_required")
+        before = self._git("rev-parse", "HEAD")
+        remote_before = self.projection(request.integration_branch)
+        if remote_before != before:
+            raise MergeError("integration_remote_advanced")
+        source = self._git("rev-parse", "--verify", f"refs/heads/{request.source_branch}^{{commit}}")
+        if source != request.approved_source_oid:
+            raise MergeError("integration_source_not_approved", 403)
+        attempt = subprocess.run(["git", "merge", "--no-ff", "--no-commit", request.source_branch], cwd=self.workspace, text=True, capture_output=True)
+        if attempt.returncode:
+            subprocess.run(["git", "merge", "--abort"], cwd=self.workspace, text=True, capture_output=True)
+            raise MergeError("integration_merge_conflict")
+        try:
+            self._git("commit", "-m", "merge(integration): approved source")
+            merged = self._git("rev-parse", "HEAD")
+            parents = self._git("show", "-s", "--format=%P", "HEAD").split()
+            if parents != [before, source]:
+                raise MergeError("integration_parent_invariant_failed", 500)
+            pushed = subprocess.run(["git", "push", "--porcelain", self.remote, f"HEAD:refs/heads/{request.integration_branch}"], cwd=self.workspace, text=True, capture_output=True)
+            if pushed.returncode:
+                try:
+                    observed = self.projection(request.integration_branch)
+                except Exception:
+                    return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+                if observed == before:
+                    self._git("reset", "--hard", before)
+                    return {"state": "PUSH_FAILED_RESTORED", "pre_merge_oid": before}
+                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+            try:
+                observed = self.projection(request.integration_branch)
+            except Exception:
+                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+            if observed != merged:
+                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+            return {"state": "COMPLETED", "pre_merge_oid": before, "merge_oid": merged}
+        except MergeError:
+            if self._git("rev-parse", "HEAD") != before:
+                self._git("reset", "--hard", before)
+            raise

active-runtime/app/aios_isolated_writer_api/integration_refresh.py

@@ -0,0 +1,257 @@
+"""Fail-closed, task-bound integration refresh provisioning primitives.
+
+This module deliberately has no HTTP or credential-provider dependency.  The
+caller supplies a branch-read projection and an apply callback, making the
+authorization and recovery boundary independently testable.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import argparse
+import secrets
+import sqlite3
+import threading
+import re
+from contextlib import contextmanager
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Callable
+
+
+class ProvisioningError(RuntimeError):
+    def __init__(self, code: str, status: int = 403):
+        super().__init__(code)
+        self.code, self.status = code, status
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _digest(secret: str) -> str:
+    return hashlib.sha256(secret.encode("utf-8")).hexdigest()
+
+
+def _canonical(value: dict) -> str:
+    return hashlib.sha256(json.dumps(value, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+
+
+def _is_oid(value: object) -> bool:
+    return isinstance(value, str) and re.fullmatch(r"[0-9a-fA-F]{40}", value) is not None
+
+
+@dataclass(frozen=True)
+class Binding:
+    task_id: str
+    repository: str
+    branch: str
+    actor_identity: str
+    audience: str
+    paths: tuple[str, ...]
+    quota: int
+
+
+class AppendOnlyAudit:
+    """Append only redacted JSONL audit, durable before a result is returned."""
+    def __init__(self, path: Path | str):
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.Lock()
+
+    def append(self, event: dict) -> None:
+        with self._lock:
+            safe = {key: value for key, value in event.items() if key not in {"token", "credential", "authorization"}}
+            previous = "0" * 64
+            if self.path.exists():
+                lines = self.path.read_text(encoding="utf-8").splitlines()
+                if lines:
+                    previous = json.loads(lines[-1])["event_hash"]
+            safe["previous_event_hash"] = previous
+            safe["event_hash"] = _canonical(safe)
+            encoded = (json.dumps(safe, sort_keys=True, separators=(",", ":")) + "\n").encode()
+            fd = os.open(self.path, os.O_APPEND | os.O_CREAT | os.O_WRONLY, 0o600)
+            try:
+                os.write(fd, encoded)
+                os.fsync(fd)
+            finally:
+                os.close(fd)
+
+
+class GrantStore:
+    """Digest-only short grant registry; SQLite transactions serialize quota use."""
+    def __init__(self, path: Path | str):
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        with self._db() as db:
+            db.execute("""CREATE TABLE IF NOT EXISTS grants(
+                token_digest TEXT PRIMARY KEY, binding_json TEXT NOT NULL,
+                expires_at TEXT NOT NULL, quota INTEGER NOT NULL, uses INTEGER NOT NULL,
+                revoked INTEGER NOT NULL DEFAULT 0)""")
+
+    @contextmanager
+    def _db(self):
+        db = sqlite3.connect(self.path, timeout=15, isolation_level=None)
+        db.row_factory = sqlite3.Row
+        try:
+            yield db
+        finally:
+            db.close()
+
+    def issue(self, binding: Binding, *, ttl_seconds: int = 300) -> str:
+        if ttl_seconds < 1 or ttl_seconds > 1800 or binding.quota < 1 or not binding.paths:
+            raise ValueError("invalid_short_grant")
+        token = secrets.token_urlsafe(32)
+        payload = json.dumps(binding.__dict__ | {"paths": list(binding.paths)}, sort_keys=True)
+        with self._db() as db:
+            db.execute("INSERT INTO grants VALUES(?,?,?,?,?,0)", (_digest(token), payload,
+                (_now() + timedelta(seconds=ttl_seconds)).isoformat(), binding.quota, 0))
+        return token
+
+    def rotate(self, old_token: str, binding: Binding, *, revocation_probe, ttl_seconds: int = 300) -> str:
+        self.revoke(old_token)
+        try: status = revocation_probe(old_token)
+        except TimeoutError as exc: raise ProvisioningError("revocation_probe_timeout", 503) from exc
+        if status != 401: raise ProvisioningError("revocation_probe_rejected", 503)
+        return self.issue(binding, ttl_seconds=ttl_seconds)
+
+    def revoke(self, token: str) -> None:
+        with self._db() as db:
+            db.execute("BEGIN IMMEDIATE")
+            db.execute("UPDATE grants SET revoked=1 WHERE token_digest=?", (_digest(token),))
+            db.execute("COMMIT")
+
+    def consume(self, token: str, binding: Binding, path: str) -> None:
+        with self._db() as db:
+            db.execute("BEGIN IMMEDIATE")
+            row = db.execute("SELECT * FROM grants WHERE token_digest=?", (_digest(token),)).fetchone()
+            if not row or row["revoked"]:
+                db.execute("ROLLBACK"); raise ProvisioningError("credential_rejected", 401)
+            if _now() >= datetime.fromisoformat(row["expires_at"]):
+                db.execute("ROLLBACK"); raise ProvisioningError("credential_expired", 401)
+            stored = json.loads(row["binding_json"])
+            requested = binding.__dict__ | {"paths": list(binding.paths)}
+            if stored != requested or path not in stored["paths"]:
+                db.execute("ROLLBACK"); raise ProvisioningError("grant_binding_rejected")
+            if row["uses"] >= row["quota"]:
+                db.execute("ROLLBACK"); raise ProvisioningError("grant_quota_exhausted")
+            db.execute("UPDATE grants SET uses=uses+1 WHERE token_digest=?", (_digest(token),))
+            db.execute("COMMIT")
+
+
+class GiteaBranchReadProjection:
+    """Normalizes a trusted task-scoped Gitea reader; every ambiguity fails closed."""
+    def __init__(self, reader: Callable[[str, str], dict]):
+        self.reader = reader
+
+    def head(self, repository: str, branch: str) -> str:
+        try:
+            reply = self.reader(repository, branch)
+        except TimeoutError as exc:
+            raise ProvisioningError("gitea_projection_timeout", 503) from exc
+        except Exception as exc:
+            raise ProvisioningError("gitea_projection_unavailable", 503) from exc
+        if not isinstance(reply, dict) or reply.get("status") in {401, 403}:
+            raise ProvisioningError("gitea_projection_forbidden", 503)
+        oid = reply.get("oid")
+        if reply.get("status") != 200 or not _is_oid(oid):
+            raise ProvisioningError("gitea_projection_invalid", 503)
+        return oid.lower()
+
+
+class IntegrationRefreshProvisioner:
+    _locks: dict[tuple[str, str], threading.Lock] = {}
+    _locks_guard = threading.Lock()
+
+    def __init__(self, *, grants: GrantStore, projection: GiteaBranchReadProjection,
+                 ledger_path: Path | str, audit: AppendOnlyAudit, approved_binding: Binding):
+        self.grants, self.projection, self.audit, self.approved_binding = grants, projection, audit, approved_binding
+        self.ledger_path = Path(ledger_path); self.ledger_path.parent.mkdir(parents=True, exist_ok=True)
+        with self._ledger() as db:
+            db.execute("CREATE TABLE IF NOT EXISTS refreshes(operation_id TEXT PRIMARY KEY, digest TEXT NOT NULL, state TEXT NOT NULL, result_oid TEXT)")
+
+    @contextmanager
+    def _ledger(self):
+        db = sqlite3.connect(self.ledger_path)
+        try:
+            yield db
+            db.commit()
+        finally:
+            db.close()
+
+    def refresh(self, *, token: str, binding: Binding, path: str, operation_id: str,
+                target_head_oid: str, apply: Callable[[], str]) -> dict:
+        if not operation_id or not _is_oid(target_head_oid):
+            raise ProvisioningError("refresh_request_rejected")
+        if binding != self.approved_binding:
+            raise ProvisioningError("grant_binding_rejected")
+        request = {"binding": binding.__dict__ | {"paths": list(binding.paths)}, "path": path, "target": target_head_oid}
+        digest = _canonical(request)
+        with self._locks_guard:
+            lock = self._locks.setdefault((binding.repository, binding.branch), threading.Lock())
+        with lock, self._ledger() as db:
+            db.execute("BEGIN IMMEDIATE")
+            row = db.execute("SELECT * FROM refreshes WHERE operation_id=?", (operation_id,)).fetchone()
+            new_operation = row is None
+            if row:
+                if row[1] != digest:
+                    db.execute("ROLLBACK"); raise ProvisioningError("operation_id_reuse_rejected", 409)
+                if row[2] == "COMPLETED":
+                    db.execute("COMMIT")
+                    return {"state": row[2], "operation_id": operation_id, "oid": row[3], "idempotent": True}
+                if row[2] not in {"PENDING", "RECOVERABLE"}:
+                    db.execute("COMMIT")
+                    return {"state": row[2], "operation_id": operation_id, "oid": row[3], "idempotent": True}
+            else:
+                db.execute("INSERT INTO refreshes VALUES(?,?,?,NULL)", (operation_id, digest, "PENDING"))
+            db.execute("COMMIT")
+            if new_operation:
+                self.grants.consume(token, binding, path)
+            current = self.projection.head(binding.repository, binding.branch)
+            if current != target_head_oid.lower():
+                self._state(operation_id, "STALE_TARGET")
+                raise ProvisioningError("stale_target_head", 409)
+            try:
+                oid = apply()
+                if not _is_oid(oid):
+                    raise ProvisioningError("apply_result_invalid", 500)
+                # Detect a competing remote advancement before claiming completion.
+                observed = self.projection.head(binding.repository, binding.branch)
+                if observed != oid.lower():
+                    self._state(operation_id, "RECONCILIATION_REQUIRED")
+                    raise ProvisioningError("remote_concurrent_advance", 409)
+                self._state(operation_id, "COMPLETED", oid)
+                self.audit.append({"operation_id": operation_id, "task_id": binding.task_id, "repository": binding.repository,
+                                   "branch": binding.branch, "actor_identity": binding.actor_identity, "audience": binding.audience, "path": path, "state": "COMPLETED"})
+                return {"state": "COMPLETED", "operation_id": operation_id, "oid": oid, "idempotent": False}
+            except ProvisioningError:
+                raise
+            except Exception as exc:
+                self._state(operation_id, "RECOVERABLE")
+                self.audit.append({"operation_id": operation_id, "task_id": binding.task_id, "repository": binding.repository,
+                                   "branch": binding.branch, "actor_identity": binding.actor_identity, "audience": binding.audience, "path": path, "state": "RECOVERABLE"})
+                raise ProvisioningError("refresh_apply_failed", 503) from exc
+
+    def _state(self, operation_id: str, state: str, oid: str | None = None) -> None:
+        with self._ledger() as db:
+            db.execute("UPDATE refreshes SET state=?, result_oid=COALESCE(?,result_oid) WHERE operation_id=?", (state, oid, operation_id))
+
+
+def _sandbox_preflight(state_dir: Path) -> int:
+    if os.environ.get("AIOS_GITOPS_WRITES_ENABLED") != "false":
+        raise ProvisioningError("global_gitops_writes_must_remain_disabled", 500)
+    state_dir.mkdir(parents=True, exist_ok=True)
+    audit = AppendOnlyAudit(state_dir / "preflight-audit.jsonl")
+    audit.append({"event": "SANDBOX_PREFLIGHT", "writes_enabled": False})
+    print(json.dumps({"status": "READY", "mode": "sandbox", "writes_enabled": False}, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--sandbox-preflight", action="store_true", required=True)
+    parser.add_argument("--state-dir", type=Path, required=True)
+    options = parser.parse_args()
+    raise SystemExit(_sandbox_preflight(options.state_dir))

active-runtime/app/aios_online_agent_execution.py

@@ -1,528 +0,0 @@
-"""Canonical governed execution projection for Online Agent Tasks.
-
-The durable governed binding is authoritative.  Natural-language task fields and
-worker configuration are never allowed to invent repository, ref, generation, or
-idempotency coordinates.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-import hashlib
-import json
-import re
-from pathlib import Path
-from typing import Any, Mapping, Sequence
-import urllib.error
-import urllib.request
-
-
-EXECUTION_SCHEMA = "aios.online-agent.execution.v2"
-PROJECTION_SCHEMA = "aios.online-agent.task-projection.v1"
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
-PROTECTED_PREFIXES = ("main", "master", "refs/", "tags/", "tag/", "release/", "baseline/", "production/")
-MUTATION_ACTIONS = frozenset({"deterministic"})
-READ_ONLY_ACTIONS = frozenset({"source_capture", "agent_runtime"})
-SUPPORTED_ACTIONS = frozenset({"deterministic", "source_capture", "agent_runtime"})
-AGENT_RUNTIME_ADAPTERS = frozenset({"hermes", "openclaw"})
-MAX_AGENT_RUNTIME_INPUT_BYTES = 64 * 1024
-
-
-class ExecutionProjectionError(RuntimeError):
-    """A canonical fail-closed projection or validation error."""
-
-
-class OnlineTaskProjectionClient:
-    """Official HTTP projection client using only a control credential reference."""
-
-    def __init__(self, api_base: str, control_token_path: Path) -> None:
-        self.api_base = api_base.rstrip("/")
-        self.control_token_path = Path(control_token_path)
-
-    def _token(self) -> str:
-        path = self.control_token_path
-        if path.is_symlink() or not path.is_file():
-            _error("ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE")
-        value = path.read_text(encoding="utf-8").strip()
-        if len(value) < 32:
-            _error("ONLINE_TASK_PROJECTION_CONTROL_INVALID")
-        return value
-
-    def create(
-        self,
-        projected_task: Mapping[str, Any],
-        *,
-        binding: "GovernedExecutionBinding",
-    ) -> dict[str, Any]:
-        body = dict(projected_task)
-        payload = _canonical(body).encode("utf-8")
-        request = urllib.request.Request(
-            self.api_base + "/v1/tasks",
-            method="POST",
-            data=payload,
-            headers={
-                "Authorization": "Bearer " + self._token(),
-                "Content-Type": "application/json",
-                "Accept": "application/json",
-            },
-        )
-        try:
-            with urllib.request.urlopen(request, timeout=15) as response:
-                result = json.loads(response.read().decode("utf-8"))
-                status = response.status
-        except urllib.error.HTTPError as exc:
-            raw = exc.read(8192).decode("utf-8", "replace")
-            try:
-                error = json.loads(raw).get("error")
-            except (AttributeError, json.JSONDecodeError):
-                error = "HTTP_ERROR"
-            raise ExecutionProjectionError(f"ONLINE_TASK_PROJECTION_FAILED:{exc.code}:{error}") from exc
-        except (OSError, urllib.error.URLError, TimeoutError) as exc:
-            raise ExecutionProjectionError("ONLINE_TASK_PROJECTION_UNAVAILABLE") from exc
-        if status not in {200, 201} or not isinstance(result, dict):
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
-        if result.get("task_id") != binding.task_id or result.get("status") not in {"QUEUED", "VERIFYING", "SUCCEEDED"}:
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
-        metadata = result.get("metadata")
-        if not isinstance(metadata, Mapping):
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
-        returned_execution = validate_execution_envelope(
-            _object(metadata.get("execution"), "ONLINE_TASK_PROJECTION_RESPONSE_INVALID"),
-            binding=binding,
-        )
-        submitted_metadata = _object(body.get("metadata"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID")
-        submitted_execution = validate_execution_envelope(
-            _object(submitted_metadata.get("execution"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID"),
-            binding=binding,
-        )
-        if _canonical(returned_execution) != _canonical(submitted_execution):
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_BINDING_INVALID")
-        return result
-
-
-def _error(code: str) -> None:
-    raise ExecutionProjectionError(code)
-
-
-def _object(value: object, code: str) -> dict[str, Any]:
-    if not isinstance(value, Mapping):
-        _error(code)
-    return dict(value)
-
-
-def _string(value: object, code: str) -> str:
-    if not isinstance(value, str) or not value.strip():
-        _error(code)
-    return value.strip()
-
-
-def _task_id(value: object) -> str:
-    value = _string(value, "TASK_ID_INVALID")
-    if TASK_RE.fullmatch(value) is None:
-        _error("TASK_ID_INVALID")
-    return value
-
-
-def _oid(value: object, code: str) -> str:
-    value = _string(value, code)
-    if OID_RE.fullmatch(value) is None:
-        _error(code)
-    return value
-
-
-def _branch(value: object) -> str:
-    value = _string(value, "TARGET_BRANCH_INVALID")
-    if BRANCH_RE.fullmatch(value) is None or value.startswith(PROTECTED_PREFIXES):
-        _error("TARGET_BRANCH_INVALID")
-    return value
-
-
-def _generation(value: object) -> int:
-    if not isinstance(value, int) or isinstance(value, bool) or value < 1:
-        _error("GENERATION_INVALID")
-    return value
-
-
-def _canonical(value: object) -> str:
-    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
-
-
-def _digest(value: object) -> str:
-    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
-
-
-def _source_signals(value: object) -> tuple[str, ...]:
-    """Normalize untrusted natural-language hints before they enter a signed envelope."""
-    if value is None:
-        return ()
-    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
-        _error("SOURCE_CAPTURE_SIGNALS_INVALID")
-    result: list[str] = []
-    for item in value:
-        if not isinstance(item, str):
-            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
-        text = " ".join(item.split()).strip()
-        if not text:
-            continue
-        # Projection may accept long task prose, but execution envelopes stay bounded.
-        text = text[:512].rstrip()
-        if text not in result:
-            result.append(text)
-        if len(result) == 16:
-            break
-    return tuple(result)
-
-
-def _agent_runtime_input(value: object) -> dict[str, Any]:
-    if not isinstance(value, Mapping):
-        _error("AGENT_RUNTIME_INPUT_REQUIRED")
-    raw = dict(value)
-    allowed = {
-        "goal", "instructions", "success_criteria", "constraints",
-        "scope", "trace_id",
-    }
-    if set(raw) - allowed:
-        _error("AGENT_RUNTIME_INPUT_FIELDS_INVALID")
-    goal = _string(raw.get("goal"), "AGENT_RUNTIME_GOAL_REQUIRED")
-    instructions = raw.get("instructions", "")
-    if not isinstance(instructions, str):
-        _error("AGENT_RUNTIME_INSTRUCTIONS_INVALID")
-    criteria = raw.get("success_criteria", [])
-    if not isinstance(criteria, list) or len(criteria) > 32:
-        _error("AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-    normalized_criteria: list[dict[str, str]] = []
-    for item in criteria:
-        if not isinstance(item, Mapping):
-            _error("AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-        criterion_id = _string(item.get("id"), "AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-        description = _string(
-            item.get("description"), "AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID"
-        )
-        normalized_criteria.append(
-            {"id": criterion_id[:120], "description": description[:1000]}
-        )
-    constraints = raw.get("constraints", {})
-    if not isinstance(constraints, Mapping):
-        _error("AGENT_RUNTIME_CONSTRAINTS_INVALID")
-    sensitive_markers = ("token", "secret", "password", "credential", "authorization", "api_key", "apikey")
-    for key in constraints:
-        lowered = str(key).lower()
-        if any(marker in lowered for marker in sensitive_markers):
-            _error("AGENT_RUNTIME_SECRET_FIELD_DENY")
-
-    scope = raw.get("scope", {})
-    if not isinstance(scope, Mapping):
-        _error("AGENT_RUNTIME_SCOPE_INVALID")
-    scope = {
-        "scope_type": str(scope.get("scope_type") or "legacy"),
-        "tenant_id": scope.get("tenant_id"),
-        "project_id": scope.get("project_id"),
-    }
-    if scope["scope_type"] not in {"legacy", "system", "tenant"}:
-        _error("AGENT_RUNTIME_SCOPE_INVALID")
-    if scope["scope_type"] == "tenant":
-        if not isinstance(scope["tenant_id"], str) or not scope["tenant_id"].strip():
-            _error("AGENT_RUNTIME_SCOPE_INVALID")
-    elif scope["tenant_id"] not in (None, "") or scope["project_id"] not in (None, ""):
-        _error("AGENT_RUNTIME_SCOPE_INVALID")
-
-    trace_id = str(raw.get("trace_id") or "").strip()
-    if not trace_id or len(trace_id) > 255:
-        _error("AGENT_RUNTIME_TRACE_ID_INVALID")
-
-    normalized = {
-        "goal": goal[:12000],
-        "instructions": instructions[:32000],
-        "success_criteria": normalized_criteria,
-        "constraints": dict(constraints),
-        "scope": scope,
-        "trace_id": trace_id,
-    }
-    if len(_canonical(normalized).encode("utf-8")) > MAX_AGENT_RUNTIME_INPUT_BYTES:
-        _error("AGENT_RUNTIME_INPUT_TOO_LARGE")
-    return normalized
-
-
-def _capabilities(value: object) -> tuple[str, ...]:
-    if value is None:
-        return ()
-    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
-        _error("CAPABILITY_SCOPE_INVALID")
-    result = tuple(sorted({_string(item, "CAPABILITY_SCOPE_INVALID") for item in value}))
-    if any(len(item) > 120 for item in result):
-        _error("CAPABILITY_SCOPE_INVALID")
-    return result
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedExecutionBinding:
-    task_id: str
-    job_id: str
-    repository: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    branch_mode: str
-    generation: int
-    idempotency_key: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "GovernedExecutionBinding":
-        data = dict(value)
-        task_id = _task_id(data.get("task_id"))
-        job_id = _string(data.get("job_id"), "JOB_ID_REQUIRED")
-        if TASK_RE.fullmatch(job_id) is None:
-            _error("JOB_ID_INVALID")
-        repository = _string(data.get("repository"), "REPOSITORY_INVALID")
-        if repository != "aios/aios":
-            _error("WRONG_REPOSITORY_ENVELOPE_DENY")
-        base_oid = _oid(data.get("base_oid"), "BASE_OID_INVALID")
-        expected = _oid(data.get("expected_branch_oid"), "EXPECTED_BRANCH_OID_INVALID")
-        target = _branch(data.get("target_branch"))
-        mode = _string(data.get("branch_mode"), "BRANCH_MODE_MISSING")
-        if mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
-            _error("BRANCH_MODE_INVALID")
-        generation = _generation(data.get("generation"))
-        if mode == "CREATE_NEW" and expected != base_oid:
-            _error("EXPECTED_BASE_CONFLICT")
-        key = _string(data.get("idempotency_key"), "IDEMPOTENCY_KEY_INVALID")
-        if KEY_RE.fullmatch(key) is None:
-            _error("IDEMPOTENCY_KEY_INVALID")
-        return cls(task_id, job_id, repository, base_oid, expected, target, mode, generation, key)
-
-    def public(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-def binding_from_bootstrap(value: Mapping[str, Any]) -> GovernedExecutionBinding:
-    return GovernedExecutionBinding.from_mapping(value)
-
-
-def validate_execution_envelope(
-    value: Mapping[str, Any],
-    *,
-    binding: GovernedExecutionBinding | None = None,
-    worker_capabilities: Sequence[str] | None = None,
-) -> dict[str, Any]:
-    envelope = dict(value)
-    if envelope.get("schema") != EXECUTION_SCHEMA:
-        _error("EXECUTION_ENVELOPE_SCHEMA_VALIDATION")
-    candidate = GovernedExecutionBinding.from_mapping(envelope)
-    if binding is not None and candidate != binding:
-        comparisons = (
-            (candidate.task_id, binding.task_id, "TASK_BINDING_CONFLICT"),
-            (candidate.job_id, binding.job_id, "JOB_BINDING_CONFLICT"),
-            (candidate.repository, binding.repository, "WRONG_REPOSITORY_ENVELOPE_DENY"),
-            (candidate.base_oid, binding.base_oid, "WRONG_BASE_ENVELOPE_DENY"),
-            (candidate.expected_branch_oid, binding.expected_branch_oid, "WRONG_EXPECTED_HEAD_ENVELOPE_DENY"),
-            (candidate.target_branch, binding.target_branch, "WRONG_BRANCH_ENVELOPE_DENY"),
-            (candidate.generation, binding.generation, "WRONG_GENERATION_ENVELOPE_DENY"),
-            (candidate.branch_mode, binding.branch_mode, "BRANCH_MODE_BINDING_CONFLICT"),
-            (candidate.idempotency_key, binding.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
-        )
-        for actual, expected, code in comparisons:
-            if actual != expected:
-                _error(code)
-    action = _string(envelope.get("action"), "EXECUTION_ACTION_MISSING")
-    if action not in SUPPORTED_ACTIONS:
-        _error("EXECUTION_ACTION_UNSUPPORTED")
-    capability_scope = _capabilities(envelope.get("capability_scope"))
-    if worker_capabilities is not None and not set(capability_scope).issubset(set(worker_capabilities)):
-        _error("CAPABILITY_MISMATCH_DENY")
-    workspace = _object(envelope.get("workspace"), "WORKSPACE_POLICY_REQUIRED")
-    if workspace.get("authority_git_dir") != "/data/aios-gitops/repo.git" or workspace.get("read_only_repository") is not True:
-        _error("WORKSPACE_POLICY_DENY")
-    governance = _object(envelope.get("governance"), "GOVERNANCE_POLICY_REQUIRED")
-    governed_coordinates = (
-        (governance.get("task_id"), candidate.task_id, "TASK_BINDING_CONFLICT"),
-        (governance.get("job_id"), candidate.job_id, "JOB_BINDING_CONFLICT"),
-        (governance.get("idempotency_key"), candidate.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
-    )
-    for actual_coordinate, expected_coordinate, code in governed_coordinates:
-        if actual_coordinate != expected_coordinate:
-            _error(code)
-    commit_key = _string(governance.get("commit_idempotency_key"), "COMMIT_IDEMPOTENCY_KEY_INVALID")
-    if KEY_RE.fullmatch(commit_key) is None:
-        _error("COMMIT_IDEMPOTENCY_KEY_INVALID")
-    if governance.get("writer_lease") is not (action in MUTATION_ACTIONS):
-        _error("WRITER_LEASE_POLICY_DENY")
-    for field in ("main_write", "production_write", "tag_write", "baseline_write", "force_push", "protected_ref_bypass"):
-        if governance.get(field, False) is not False:
-            _error("POLICY_DENY")
-    changes = envelope.get("change_set")
-    verification = envelope.get("verification")
-    if not isinstance(changes, list) or not isinstance(verification, list):
-        _error("EXECUTION_OPERATIONS_INVALID")
-    if action == "source_capture":
-        if changes or verification:
-            _error("SOURCE_CAPTURE_MUTATION_DENY")
-        signals = list(_source_signals(envelope.get("source_signals") or []))
-        if envelope.get("source_signals") != signals:
-            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
-        if envelope.get("runtime_input") not in (None, {}):
-            _error("SOURCE_CAPTURE_RUNTIME_INPUT_DENY")
-    elif action == "agent_runtime":
-        if changes or verification:
-            _error("AGENT_RUNTIME_MUTATION_DENY")
-        adapter = str(envelope.get("adapter") or "")
-        if adapter not in AGENT_RUNTIME_ADAPTERS:
-            _error("AGENT_RUNTIME_ADAPTER_INVALID")
-        runtime_input = _agent_runtime_input(envelope.get("runtime_input"))
-        if envelope.get("runtime_input") != runtime_input:
-            _error("AGENT_RUNTIME_INPUT_NOT_CANONICAL")
-        required_runtime_capability = f"agent.runtime.{adapter}"
-        if required_runtime_capability not in capability_scope:
-            _error("AGENT_RUNTIME_CAPABILITY_REQUIRED")
-        if envelope.get("source_signals") not in (None, []):
-            _error("AGENT_RUNTIME_SOURCE_SIGNALS_DENY")
-    elif not changes:
-        _error("CHANGE_SET_INVALID")
-    declared = str(envelope.get("execution_digest") or "")
-    material = {key: item for key, item in envelope.items() if key != "execution_digest"}
-    actual = _digest(material)
-    if declared != actual:
-        _error("EXECUTION_DIGEST_INVALID")
-    return {**material, "execution_digest": actual}
-
-
-def project_execution_envelope(
-    binding: GovernedExecutionBinding,
-    execution_request: Mapping[str, Any] | None = None,
-    *,
-    required_capabilities: Sequence[str] = (),
-) -> dict[str, Any]:
-    request = dict(execution_request or {})
-    action = str(request.get("action") or "source_capture")
-    if action not in SUPPORTED_ACTIONS:
-        _error("EXECUTION_ACTION_UNSUPPORTED")
-    capabilities = _capabilities(request.get("capability_scope", required_capabilities))
-    governance = {
-        "task_id": binding.task_id,
-        "job_id": binding.job_id,
-        "idempotency_key": binding.idempotency_key,
-        "commit_idempotency_key": str(request.get("commit_idempotency_key") or f"{binding.task_id}-commit-g{binding.generation}"),
-        "writer_lease": action in MUTATION_ACTIONS,
-        "main_write": False,
-        "production_write": False,
-        "tag_write": False,
-        "baseline_write": False,
-        "force_push": False,
-        "protected_ref_bypass": False,
-    }
-    supplied_governance = request.get("governance")
-    if supplied_governance is not None:
-        governance.update(_object(supplied_governance, "GOVERNANCE_POLICY_REQUIRED"))
-    material: dict[str, Any] = {
-        "schema": EXECUTION_SCHEMA,
-        **binding.public(),
-        "action": action,
-        "adapter": str(
-            request.get("adapter")
-            or ("deterministic" if action == "deterministic" else "source_capture")
-        ),
-        "capability_scope": list(capabilities),
-        "change_set": list(request.get("change_set") or []),
-        "verification": list(request.get("verification") or []),
-        "source_signals": list(_source_signals(request.get("source_signals") or [])) if action == "source_capture" else [],
-        "runtime_input": _agent_runtime_input(request.get("runtime_input")) if action == "agent_runtime" else {},
-        "governance": governance,
-        "workspace": {
-            "authority_git_dir": "/data/aios-gitops/repo.git",
-            "read_only_repository": True,
-            "cleanup_policy": "always",
-        },
-    }
-    envelope = {**material, "execution_digest": _digest(material)}
-    return validate_execution_envelope(envelope, binding=binding)
-
-
-def project_online_task(
-    binding: GovernedExecutionBinding,
-    task_request: Mapping[str, Any],
-    execution_request: Mapping[str, Any] | None = None,
-) -> dict[str, Any]:
-    request = dict(task_request)
-    required = _capabilities(request.get("required_capabilities"))
-    execution_value = dict(execution_request or {})
-    if str(execution_value.get("action") or "source_capture") == "agent_runtime":
-        adapter = str(execution_value.get("adapter") or "")
-        if adapter not in AGENT_RUNTIME_ADAPTERS:
-            _error("AGENT_RUNTIME_ADAPTER_INVALID")
-        runtime_input = execution_value.get("runtime_input")
-        tenant_id = request.get("tenant_id")
-        project_id = request.get("project_id")
-        declared_scope = str(
-            request.get("scope_type")
-            or ("tenant" if isinstance(tenant_id, str) and tenant_id.strip() else "legacy")
-        )
-        if runtime_input is None:
-            runtime_input = {
-                "goal": request.get("goal"),
-                "instructions": request.get("instructions") or "",
-                "success_criteria": request.get("success_criteria") or [],
-                "constraints": request.get("constraints") or {},
-            }
-        elif not isinstance(runtime_input, Mapping):
-            _error("AGENT_RUNTIME_INPUT_REQUIRED")
-        runtime_input = dict(runtime_input)
-        # Scope/trace are authoritative Task identity, never caller-selected runtime hints.
-        runtime_input["scope"] = {
-            "scope_type": declared_scope,
-            "tenant_id": tenant_id,
-            "project_id": project_id,
-        }
-        runtime_input["trace_id"] = str(
-            request.get("trace_id")
-            or request.get("run_id")
-            or binding.task_id
-        )
-        execution_value["runtime_input"] = runtime_input
-    execution = project_execution_envelope(
-        binding,
-        execution_value,
-        required_capabilities=required,
-    )
-    metadata = dict(request.get("metadata") or {})
-    if "execution" in metadata:
-        validate_execution_envelope(_object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"), binding=binding)
-        if metadata["execution"] != execution:
-            _error("EXECUTION_PROJECTION_CONFLICT")
-    metadata["execution"] = execution
-    metadata["execution_projection"] = {
-        "schema": PROJECTION_SCHEMA,
-        "task_id": binding.task_id,
-        "job_id": binding.job_id,
-        "execution_digest": execution["execution_digest"],
-    }
-    return {
-        **request,
-        "task_id": binding.task_id,
-        "metadata": metadata,
-        "required_capabilities": list(required),
-        "idempotency_key": str(request.get("idempotency_key") or f"online-task:{binding.idempotency_key}"),
-    }
-
-
-def resolve_task_execution(
-    task: Mapping[str, Any],
-    binding: GovernedExecutionBinding,
-    *,
-    worker_capabilities: Sequence[str] | None = None,
-) -> tuple[dict[str, Any], str]:
-    metadata = task.get("metadata")
-    if isinstance(metadata, Mapping) and "execution" in metadata:
-        value = validate_execution_envelope(
-            _object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"),
-            binding=binding,
-            worker_capabilities=worker_capabilities,
-        )
-        return value, "persisted"
-    projected = project_execution_envelope(
-        binding,
-        {"action": "source_capture", "capability_scope": task.get("required_capabilities") or []},
-        required_capabilities=task.get("required_capabilities") or [],
-    )
-    validate_execution_envelope(projected, binding=binding, worker_capabilities=worker_capabilities)
-    return projected, "recovered_projection"

active-runtime/app/aios_owner_authorization_broker_api.py

@@ -1,144 +0,0 @@
-"""HTTP adapter for audited Owner authorization and writer provisioning.
-
-This module layers on top of ``aios_authorized_task_writer_api`` so existing
-routes and the legacy exact ``writer:provision`` route remain available. The
-new endpoint does not mint or modify bearer credentials. It authenticates an
-existing, non-wildcard, explicitly allow-listed Owner credential and then
-invokes the audited broker.
-
-Endpoint:
-    POST /api/governance/owner-authorizations
-"""
-from __future__ import annotations
-
-import os
-import urllib.parse
-from typing import Any, Mapping
-
-import aios_authorized_task_writer_api as bridge_api
-from authorized_task_writer_provisioning import ProvisioningError
-from owner_authorization_broker import (
-    OwnerAuthorizationBroker,
-    OwnerAuthorizationError,
-    OwnerPrincipal,
-)
-
-
-api = bridge_api.api
-_original_do_post = api.H.do_POST
-_ENDPOINT = "/api/governance/owner-authorizations"
-
-
-def _enabled() -> bool:
-    return os.getenv(
-        "AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED", ""
-    ).strip().lower() in {"1", "true", "yes", "on"}
-
-
-def _configured_intake_scope() -> str:
-    scopes = [
-        item.strip()
-        for item in os.getenv(
-            "AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES", ""
-        ).split(",")
-        if item.strip()
-    ]
-    if len(scopes) != 1:
-        raise OwnerAuthorizationError(
-            "EXACTLY_ONE_HTTP_INTAKE_SCOPE_REQUIRED", 503
-        )
-    scope = scopes[0]
-    if scope == "writer:provision" or scope == "*" or scope.endswith(":*"):
-        raise OwnerAuthorizationError("HTTP_INTAKE_SCOPE_REJECTED", 503)
-    return scope
-
-
-def _scope_set(auth: Mapping[str, Any]) -> frozenset[str]:
-    raw = auth.get("scopes")
-    if raw is None:
-        raw = auth.get("scope")
-    if raw is None:
-        return frozenset()
-    if isinstance(raw, str):
-        candidates = raw.replace(",", " ").split()
-    elif isinstance(raw, (list, tuple, set, frozenset)):
-        candidates = [str(item) for item in raw]
-    else:
-        raise OwnerAuthorizationError("OWNER_SCOPE_EVIDENCE_INVALID", 403)
-    return frozenset(item.strip() for item in candidates if item.strip())
-
-
-def _credential_id(auth: Mapping[str, Any]) -> str:
-    for name in (
-        "credential_id",
-        "token_id",
-        "key_id",
-        "auth_id",
-    ):
-        value = str(auth.get(name) or "").strip()
-        if value:
-            return value
-    return ""
-
-
-def _authenticate_existing_owner(handler) -> OwnerPrincipal | None:
-    scope = _configured_intake_scope()
-    auth = handler.need(scope)
-    if not auth:
-        return None
-    if auth.get("role") != "owner":
-        handler.sendj({"error": "OWNER_ROLE_REQUIRED"}, 403)
-        return None
-    identity = str(auth.get("account") or auth.get("identity") or "").strip()
-    if not identity:
-        handler.sendj({"error": "OWNER_IDENTITY_REQUIRED"}, 403)
-        return None
-    scopes = _scope_set(auth)
-    if any(item == "*" or item.endswith(":*") for item in scopes):
-        handler.sendj(
-            {"error": "WILDCARD_OWNER_CREDENTIAL_REJECTED"}, 403
-        )
-        return None
-    return OwnerPrincipal(
-        identity=identity,
-        role="owner",
-        authenticated_scope=scope,
-        token_scopes=scopes,
-        credential_id=_credential_id(auth),
-    )
-
-
-def _broker_do_post(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path != _ENDPOINT:
-        return _original_do_post(self)
-    if not _enabled():
-        return self.sendj(
-            {"error": "OWNER_AUTHORIZATION_BROKER_DISABLED"}, 503
-        )
-    try:
-        principal = _authenticate_existing_owner(self)
-        if principal is None:
-            return
-        data = self.body()
-        result = OwnerAuthorizationBroker().authorize_and_provision(
-            data, principal
-        )
-        return self.sendj(result)
-    except (OwnerAuthorizationError, ProvisioningError) as exc:
-        body = {"error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        return self.sendj(body, exc.status)
-    except Exception:
-        # Never expose registry data, bearer tokens, signer output or traceback.
-        return self.sendj(
-            {"error": "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR"}, 500
-        )
-
-
-api.H.do_POST = _broker_do_post
-
-
-if __name__ == "__main__":
-    api.main()

active-runtime/app/aios_repository_discovery.py

@@ -1,967 +0,0 @@
-"""Bounded, read-only discovery over a verified immutable Git repository.
-
-The module is deliberately independent from Task, lease, credential, worktree,
-and write code. Every public operation verifies the exact repository identity,
-resolves a floating ref once to a full commit OID, and then reads only that
-immutable snapshot.
-"""
-from __future__ import annotations
-
-import base64
-from collections.abc import Iterable, Iterator, Mapping
-import fnmatch
-import hashlib
-import hmac
-import json
-import os
-from pathlib import Path
-import re
-import subprocess
-import time
-
-from authoritative_git import AuthoritativeGitError, verify_repository
-
-
-_OID_RE = re.compile(r"^[0-9a-f]{40}$")
-_REF_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{0,239}$")
-_IDENTITY_RE = re.compile(
-    r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
-)
-_READ_ONLY_COMMANDS = frozenset({"cat-file", "diff", "ls-tree", "rev-parse"})
-_MAX_COMMAND_OUTPUT = 1_048_576
-_MAX_RECORD_BYTES = 1_048_576
-_MAX_LIMIT = 1_000
-_MAX_DEPTH = 32
-_MAX_BYTES = 1_048_576
-_MAX_GLOBS = 16
-_MAX_QUERY_LENGTH = 512
-_MAX_CURSOR_LENGTH = 4_096
-_GIT_TIMEOUT_SECONDS = 8.0
-
-
-class RepositoryDiscoveryError(RuntimeError):
-    """A fail-closed repository discovery request error."""
-
-    def __init__(self, code: str, *, status_code: int | None = None) -> None:
-        self.code = str(code)
-        self.status_code = (
-            status_code if status_code is not None else self._status_for(self.code)
-        )
-        super().__init__(self.code)
-
-    @staticmethod
-    def _status_for(code: str) -> int:
-        if "OUTPUT_LIMIT" in code:
-            return 413
-        if code.endswith("_NOT_FOUND"):
-            return 404
-        if code in {"REPOSITORY_NOT_ALLOWED", "REPOSITORY_IDENTITY_MISMATCH"}:
-            return 403
-        if code in {
-            "REPOSITORY_DISCOVERY_UNAVAILABLE",
-            "REPOSITORY_DISCOVERY_GIT_FAILED",
-            "REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID",
-            "REPOSITORY_DISCOVERY_CURSOR_SECRET_REQUIRED",
-        }:
-            return 503
-        return 400
-
-
-class RepositoryDiscoveryNotFound(RepositoryDiscoveryError):
-    """A validated immutable object or path was not found."""
-
-
-class RepositoryDiscoveryOutputTooLarge(RepositoryDiscoveryError):
-    """A fixed read-only Git query exceeded its collection boundary."""
-
-
-def _error(code: str) -> RepositoryDiscoveryError:
-    return RepositoryDiscoveryError(code)
-
-
-def _request_mapping(request: Mapping[str, object]) -> Mapping[str, object]:
-    if not isinstance(request, Mapping):
-        raise _error("REPOSITORY_DISCOVERY_REQUEST_INVALID")
-    return request
-
-
-def _required_request_value(request: Mapping[str, object], field: str) -> object:
-    value = request.get(field)
-    if value is None:
-        raise _error("REPOSITORY_DISCOVERY_REQUEST_INVALID")
-    return value
-
-
-def _canonical(value: Mapping[str, object]) -> bytes:
-    return json.dumps(
-        value, sort_keys=True, separators=(",", ":"), ensure_ascii=True
-    ).encode("ascii")
-
-
-def _positive_int(value: object, field: str, maximum: int) -> int:
-    if isinstance(value, bool) or not isinstance(value, int) or not 1 <= value <= maximum:
-        raise _error(f"REPOSITORY_DISCOVERY_INVALID_{field.upper()}")
-    return value
-
-
-def _safe_relative_path(
-    value: object,
-    field: str,
-    *,
-    allow_empty: bool,
-    allow_glob: bool = False,
-) -> str:
-    if not isinstance(value, str) or value != value.strip() or "\x00" in value:
-        raise _error("REPOSITORY_DISCOVERY_PATH_INVALID")
-    if "\\" in value:
-        raise _error("REPOSITORY_DISCOVERY_PATH_INVALID")
-    if value in ("", "."):
-        if allow_empty:
-            return ""
-        raise _error("REPOSITORY_DISCOVERY_PATH_INVALID")
-    if value.startswith(("/", "-")) or "//" in value or ":" in value:
-        raise _error("REPOSITORY_DISCOVERY_PATH_INVALID")
-    if not allow_glob and any(character in value for character in "*?["):
-        raise _error("REPOSITORY_DISCOVERY_PATH_INVALID")
-    parts = value.split("/")
-    if any(part in ("", ".", "..") for part in parts):
-        raise _error("REPOSITORY_DISCOVERY_PATH_INVALID")
-    if len(value) > 512:
-        raise _error("REPOSITORY_DISCOVERY_PATH_INVALID")
-    return value
-
-
-def _safe_glob(value: object) -> str:
-    return _safe_relative_path(value, "path_glob", allow_empty=False, allow_glob=True)
-
-
-def _safe_ref(value: str) -> bool:
-    return bool(
-        _REF_RE.fullmatch(value)
-        and ".." not in value
-        and "//" not in value
-        and "@{" not in value
-        and not value.endswith(("/", ".", ".lock"))
-        and not any(part in ("", ".", "..") for part in value.split("/"))
-    )
-
-
-def _parse_tree_record(record: bytes) -> dict[str, str] | None:
-    try:
-        header, raw_path = record.split(b"\t", 1)
-        mode, kind, oid = header.decode("ascii").split(" ", 2)
-        path = raw_path.decode("utf-8")
-    except (UnicodeDecodeError, ValueError) as exc:
-        raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID") from exc
-    if kind not in {"blob", "tree", "commit"} or not _OID_RE.fullmatch(oid.lower()):
-        raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID")
-    try:
-        _safe_relative_path(path, "tree_path", allow_empty=False)
-    except RepositoryDiscoveryError:
-        # Git permits filenames outside the public POSIX-relative contract.
-        # They are not exposed as usable discovery paths.
-        return None
-    return {"mode": mode, "type": kind, "object_oid": oid.lower(), "path": path}
-
-
-def _decode_output_path(raw: bytes) -> str:
-    try:
-        value = raw.decode("utf-8")
-    except UnicodeDecodeError as exc:
-        raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID") from exc
-    return _safe_relative_path(value, "git_output_path", allow_empty=False)
-
-
-class RepositoryDiscovery:
-    """Repository-scoped immutable Git discovery with signed cursors."""
-
-    def __init__(
-        self,
-        *,
-        allowed_repositories: Iterable[str] | None = None,
-        git_dir: str | Path | None = None,
-        cursor_secret: str | bytes | None = None,
-    ) -> None:
-        configured = allowed_repositories
-        if configured is None:
-            configured = (os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", ""),)
-        identities = tuple(configured)
-        if not identities or any(
-            not isinstance(item, str) or not _IDENTITY_RE.fullmatch(item)
-            for item in identities
-        ):
-            raise _error("REPOSITORY_DISCOVERY_ALLOWLIST_INVALID")
-        self._allowed_repositories = frozenset(identities)
-        self._git_dir = git_dir
-        secret = (
-            cursor_secret
-            if cursor_secret is not None
-            else os.getenv("AIOS_REPOSITORY_DISCOVERY_CURSOR_SECRET", "")
-        )
-        if isinstance(secret, str):
-            secret = secret.encode("utf-8")
-        if not isinstance(secret, bytes) or len(secret) < 16:
-            raise _error("REPOSITORY_DISCOVERY_CURSOR_SECRET_REQUIRED")
-        self._cursor_secret = secret
-
-    def _repository_path(self, repository: object) -> Path:
-        if not isinstance(repository, str) or repository not in self._allowed_repositories:
-            raise _error("REPOSITORY_NOT_ALLOWED")
-        try:
-            path, actual_identity = verify_repository(
-                git_dir=self._git_dir,
-                repository_identity=repository,
-            )
-        except AuthoritativeGitError as exc:
-            code = (
-                "REPOSITORY_IDENTITY_MISMATCH"
-                if "REPOSITORY_IDENTITY_MISMATCH" in str(exc)
-                else "REPOSITORY_DISCOVERY_UNAVAILABLE"
-            )
-            raise _error(code) from exc
-        if actual_identity != repository:
-            raise _error("REPOSITORY_IDENTITY_MISMATCH")
-        return path
-
-    @staticmethod
-    def _git_env() -> dict[str, str]:
-        return {
-            **os.environ,
-            "GIT_OPTIONAL_LOCKS": "0",
-            "GIT_CONFIG_NOSYSTEM": "1",
-            "GIT_TERMINAL_PROMPT": "0",
-        }
-
-    @staticmethod
-    def _run(
-        path: Path,
-        args: list[str],
-        *,
-        max_output: int = _MAX_COMMAND_OUTPUT,
-    ) -> bytes:
-        if not args or args[0] not in _READ_ONLY_COMMANDS:
-            raise _error("REPOSITORY_DISCOVERY_GIT_COMMAND_REJECTED")
-        output_limit = min(max_output, _MAX_COMMAND_OUTPUT)
-        process: subprocess.Popen[bytes] | None = None
-        try:
-            process = subprocess.Popen(
-                ["git", "--git-dir", str(path), *args],
-                shell=False,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.DEVNULL,
-                env=RepositoryDiscovery._git_env(),
-            )
-            assert process.stdout is not None
-            output = process.stdout.read(output_limit + 1)
-            if len(output) > output_limit:
-                process.kill()
-                process.wait(timeout=1)
-                raise RepositoryDiscoveryOutputTooLarge(
-                    "REPOSITORY_DISCOVERY_OUTPUT_LIMIT"
-                )
-            returncode = process.wait(timeout=_GIT_TIMEOUT_SECONDS)
-        except RepositoryDiscoveryError:
-            raise
-        except (OSError, subprocess.TimeoutExpired) as exc:
-            if process is not None:
-                try:
-                    process.kill()
-                    process.wait(timeout=1)
-                except (OSError, subprocess.TimeoutExpired):
-                    pass
-            raise _error("REPOSITORY_DISCOVERY_GIT_FAILED") from exc
-        if returncode != 0:
-            raise _error("REPOSITORY_DISCOVERY_GIT_FAILED")
-        return output
-
-    @staticmethod
-    def _read_blob_prefix(path: Path, oid: str, maximum: int) -> tuple[bytes, bool]:
-        """Read at most maximum bytes plus one sentinel byte."""
-        process: subprocess.Popen[bytes] | None = None
-        try:
-            process = subprocess.Popen(
-                ["git", "--git-dir", str(path), "cat-file", "blob", oid],
-                shell=False,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.DEVNULL,
-                env=RepositoryDiscovery._git_env(),
-            )
-            assert process.stdout is not None
-            content = process.stdout.read(maximum + 1)
-            truncated = len(content) > maximum
-            if truncated:
-                process.kill()
-                process.wait(timeout=1)
-                return content[:maximum], True
-            if process.wait(timeout=_GIT_TIMEOUT_SECONDS) != 0:
-                raise _error("REPOSITORY_DISCOVERY_GIT_FAILED")
-            return content, False
-        except RepositoryDiscoveryError:
-            raise
-        except (OSError, subprocess.TimeoutExpired) as exc:
-            if process is not None:
-                try:
-                    process.kill()
-                    process.wait(timeout=1)
-                except (OSError, subprocess.TimeoutExpired):
-                    pass
-            raise _error("REPOSITORY_DISCOVERY_GIT_FAILED") from exc
-
-    def _iter_nul_records(self, path: Path, args: list[str]) -> Iterator[bytes]:
-        if not args or args[0] not in _READ_ONLY_COMMANDS:
-            raise _error("REPOSITORY_DISCOVERY_GIT_COMMAND_REJECTED")
-        process: subprocess.Popen[bytes] | None = None
-        buffer = b""
-        started = time.monotonic()
-        try:
-            process = subprocess.Popen(
-                ["git", "--git-dir", str(path), *args],
-                shell=False,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.DEVNULL,
-                env=self._git_env(),
-            )
-            assert process.stdout is not None
-            while True:
-                if time.monotonic() - started > _GIT_TIMEOUT_SECONDS:
-                    raise _error("REPOSITORY_DISCOVERY_GIT_FAILED")
-                chunk = process.stdout.read(64 * 1024)
-                if not chunk:
-                    break
-                buffer += chunk
-                if len(buffer) > _MAX_RECORD_BYTES and b"\0" not in buffer:
-                    raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID")
-                while b"\0" in buffer:
-                    record, buffer = buffer.split(b"\0", 1)
-                    if len(record) > _MAX_RECORD_BYTES:
-                        raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID")
-                    yield record
-            if buffer:
-                raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID")
-            if process.wait(
-                timeout=max(0.1, _GIT_TIMEOUT_SECONDS - (time.monotonic() - started))
-            ) != 0:
-                raise _error("REPOSITORY_DISCOVERY_GIT_FAILED")
-        except RepositoryDiscoveryError:
-            raise
-        except (OSError, subprocess.TimeoutExpired) as exc:
-            raise _error("REPOSITORY_DISCOVERY_GIT_FAILED") from exc
-        finally:
-            if process is not None and process.poll() is None:
-                try:
-                    process.kill()
-                    process.wait(timeout=1)
-                except (OSError, subprocess.TimeoutExpired):
-                    pass
-
-    def _resolve_at(self, path: Path, revision: object, field: str) -> str:
-        if (
-            not isinstance(revision, str)
-            or revision != revision.strip()
-            or not revision
-            or revision.startswith("-")
-        ):
-            raise _error("REPOSITORY_DISCOVERY_INVALID_REVISION")
-        if _OID_RE.fullmatch(revision.lower()):
-            candidates = [revision.lower()]
-        elif revision == "HEAD":
-            candidates = ["HEAD"]
-        elif _safe_ref(revision) and not any(
-            token in revision for token in ("^", "~", ":", "\\")
-        ):
-            if revision.startswith("refs/"):
-                if not revision.startswith(("refs/heads/", "refs/tags/")):
-                    raise _error("REPOSITORY_DISCOVERY_INVALID_REVISION")
-                candidates = [revision]
-            else:
-                candidates = [f"refs/heads/{revision}", f"refs/tags/{revision}"]
-        else:
-            raise _error("REPOSITORY_DISCOVERY_INVALID_REVISION")
-        resolved: list[str] = []
-        for candidate in candidates:
-            try:
-                output = self._run(
-                    path,
-                    ["rev-parse", "--verify", f"{candidate}^{{commit}}"],
-                    max_output=256,
-                )
-            except RepositoryDiscoveryError:
-                continue
-            oid = output.decode("ascii", errors="ignore").strip().lower()
-            if _OID_RE.fullmatch(oid):
-                resolved.append(oid)
-        if not resolved:
-            raise RepositoryDiscoveryNotFound(
-                f"REPOSITORY_DISCOVERY_{field.upper()}_NOT_FOUND"
-            )
-        if len(set(resolved)) != 1:
-            raise _error("REPOSITORY_DISCOVERY_AMBIGUOUS_REVISION")
-        return resolved[0]
-
-    def resolve_revision(self, repository: str, revision: str) -> str:
-        return self._resolve_at(self._repository_path(repository), revision, "revision")
-
-    def _cursor_offset(
-        self,
-        cursor: str | None,
-        *,
-        operation: str,
-        repository: str,
-        resolved_oid: str,
-        query: Mapping[str, object],
-    ) -> int:
-        if cursor is None:
-            return 0
-        if (
-            not isinstance(cursor, str)
-            or not cursor
-            or len(cursor) > _MAX_CURSOR_LENGTH
-            or "." not in cursor
-        ):
-            raise _error("REPOSITORY_DISCOVERY_CURSOR_INVALID")
-        encoded, supplied_signature = cursor.split(".", 1)
-        try:
-            padded = encoded + "=" * (-len(encoded) % 4)
-            payload = json.loads(
-                base64.urlsafe_b64decode(padded.encode("ascii")).decode("ascii")
-            )
-        except (UnicodeError, ValueError, json.JSONDecodeError) as exc:
-            raise _error("REPOSITORY_DISCOVERY_CURSOR_INVALID") from exc
-        expected_signature = hmac.new(
-            self._cursor_secret, encoded.encode("ascii"), hashlib.sha256
-        ).hexdigest()
-        if not hmac.compare_digest(supplied_signature, expected_signature):
-            raise _error("REPOSITORY_DISCOVERY_CURSOR_INVALID")
-        expected = {
-            "operation": operation,
-            "repository": repository,
-            "resolved_oid": resolved_oid,
-            "query": dict(query),
-        }
-        if (
-            not isinstance(payload, dict)
-            or payload.get("v") != 1
-            or any(payload.get(key) != value for key, value in expected.items())
-        ):
-            raise _error("REPOSITORY_DISCOVERY_CURSOR_INVALID")
-        offset = payload.get("offset")
-        if isinstance(offset, bool) or not isinstance(offset, int) or offset < 0:
-            raise _error("REPOSITORY_DISCOVERY_CURSOR_INVALID")
-        return offset
-
-    def _next_cursor(
-        self,
-        *,
-        operation: str,
-        repository: str,
-        resolved_oid: str,
-        query: Mapping[str, object],
-        offset: int,
-    ) -> str:
-        payload = {
-            "v": 1,
-            "operation": operation,
-            "repository": repository,
-            "resolved_oid": resolved_oid,
-            "query": dict(query),
-            "offset": offset,
-        }
-        encoded = base64.urlsafe_b64encode(_canonical(payload)).decode("ascii").rstrip("=")
-        signature = hmac.new(
-            self._cursor_secret, encoded.encode("ascii"), hashlib.sha256
-        ).hexdigest()
-        return f"{encoded}.{signature}"
-
-    def _iter_tree_entries(
-        self,
-        path: Path,
-        oid: str,
-        prefix: str,
-        *,
-        include_trees: bool,
-    ) -> Iterator[dict[str, str]]:
-        args = ["ls-tree", "-z", "-r", "--full-tree"]
-        if include_trees:
-            args.append("-t")
-        args.append(oid)
-        if prefix:
-            args.extend(["--", prefix])
-        for record in self._iter_nul_records(path, args):
-            entry = _parse_tree_record(record)
-            if entry is None:
-                continue
-            if not prefix or entry["path"] == prefix or entry["path"].startswith(prefix + "/"):
-                yield entry
-
-    def list_tree(
-        self,
-        *,
-        repository: str,
-        revision: str,
-        prefix: str = "",
-        depth: int = 8,
-        limit: int = 100,
-        cursor: str | None = None,
-    ) -> dict[str, object]:
-        prefix = _safe_relative_path(prefix, "prefix", allow_empty=True)
-        depth = _positive_int(depth, "depth", _MAX_DEPTH)
-        limit = _positive_int(limit, "limit", _MAX_LIMIT)
-        path = self._repository_path(repository)
-        resolved_oid = self._resolve_at(path, revision, "revision")
-        query = {"prefix": prefix, "depth": depth, "limit": limit}
-        offset = self._cursor_offset(
-            cursor,
-            operation="list_tree",
-            repository=repository,
-            resolved_oid=resolved_oid,
-            query=query,
-        )
-        page: list[dict[str, str]] = []
-        matched = 0
-        for entry in self._iter_tree_entries(path, resolved_oid, prefix, include_trees=True):
-            relative = entry["path"][len(prefix):].lstrip("/") if prefix else entry["path"]
-            if relative.count("/") + 1 > depth:
-                continue
-            if matched >= offset and len(page) < limit:
-                page.append(entry)
-            matched += 1
-        has_more = offset + len(page) < matched
-        return {
-            "repository": repository,
-            "resolved_oid": resolved_oid,
-            "entries": page,
-            "truncated": has_more,
-            "next_cursor": (
-                self._next_cursor(
-                    operation="list_tree",
-                    repository=repository,
-                    resolved_oid=resolved_oid,
-                    query=query,
-                    offset=offset + len(page),
-                )
-                if has_more
-                else None
-            ),
-        }
-
-    def list_repository_tree(self, request: Mapping[str, object]) -> dict[str, object]:
-        request = _request_mapping(request)
-        return self.list_tree(
-            repository=_required_request_value(request, "repository"),  # type: ignore[arg-type]
-            revision=request.get("revision", request.get("ref", "HEAD")),  # type: ignore[arg-type]
-            prefix=request.get("prefix", ""),  # type: ignore[arg-type]
-            depth=request.get("depth", 8),  # type: ignore[arg-type]
-            limit=request.get("limit", 100),  # type: ignore[arg-type]
-            cursor=request.get("cursor"),  # type: ignore[arg-type]
-        )
-
-    def _blob_size(self, path: Path, oid: str) -> int:
-        output = self._run(path, ["cat-file", "-s", oid], max_output=128)
-        try:
-            size = int(output.decode("ascii").strip())
-        except (UnicodeDecodeError, ValueError) as exc:
-            raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID") from exc
-        if size < 0:
-            raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID")
-        return size
-
-    def search_source(
-        self,
-        *,
-        repository: str,
-        revision: str,
-        query: str,
-        path_globs: Iterable[str] | None = None,
-        max_matches: int = 100,
-        max_bytes: int = 262_144,
-        cursor: str | None = None,
-    ) -> dict[str, object]:
-        if (
-            not isinstance(query, str)
-            or not query
-            or "\x00" in query
-            or len(query) > _MAX_QUERY_LENGTH
-        ):
-            raise _error("REPOSITORY_DISCOVERY_QUERY_INVALID")
-        max_matches = _positive_int(max_matches, "max_matches", _MAX_LIMIT)
-        max_bytes = _positive_int(max_bytes, "max_bytes", _MAX_BYTES)
-        if path_globs is None:
-            globs = ("*",)
-        else:
-            if isinstance(path_globs, (str, bytes)) or not isinstance(path_globs, Iterable):
-                raise _error("REPOSITORY_DISCOVERY_PATH_INVALID")
-            globs = tuple(_safe_glob(item) for item in path_globs)
-        if not globs or len(globs) > _MAX_GLOBS:
-            raise _error("REPOSITORY_DISCOVERY_PATH_INVALID")
-        path = self._repository_path(repository)
-        resolved_oid = self._resolve_at(path, revision, "revision")
-        query_binding = {
-            "query": query,
-            "path_globs": list(globs),
-            "max_matches": max_matches,
-            "max_bytes": max_bytes,
-        }
-        offset = self._cursor_offset(
-            cursor,
-            operation="search_source",
-            repository=repository,
-            resolved_oid=resolved_oid,
-            query=query_binding,
-        )
-        scanned_bytes = 0
-        skipped_for_bound = False
-        binary_blobs = 0
-        matched = 0
-        matches: list[dict[str, object]] = []
-        has_more = False
-        for entry in self._iter_tree_entries(path, resolved_oid, "", include_trees=False):
-            if entry["type"] != "blob" or not any(
-                fnmatch.fnmatchcase(entry["path"], pattern) for pattern in globs
-            ):
-                continue
-            blob_size = self._blob_size(path, entry["object_oid"])
-            remaining = max_bytes - scanned_bytes
-            if blob_size > remaining:
-                skipped_for_bound = True
-                continue
-            raw, clipped = self._read_blob_prefix(path, entry["object_oid"], blob_size)
-            if clipped:
-                raise _error("REPOSITORY_DISCOVERY_GIT_FAILED")
-            scanned_bytes += len(raw)
-            if b"\0" in raw:
-                binary_blobs += 1
-                continue
-            text = raw.decode("utf-8", errors="replace")
-            for number, line in enumerate(text.splitlines(), start=1):
-                if query not in line:
-                    continue
-                if matched < offset:
-                    matched += 1
-                    continue
-                if len(matches) >= max_matches:
-                    has_more = True
-                    break
-                matches.append(
-                    {
-                        "path": entry["path"],
-                        "line_start": number,
-                        "line_end": number,
-                        "blob_oid": entry["object_oid"],
-                        "snippet": line[:512],
-                    }
-                )
-                matched += 1
-            if has_more:
-                break
-        return {
-            "repository": repository,
-            "resolved_oid": resolved_oid,
-            "matches": matches,
-            "scanned_bytes": scanned_bytes,
-            "max_bytes": max_bytes,
-            "binary_blobs_skipped": binary_blobs,
-            "truncated": bool(has_more or skipped_for_bound),
-            "next_cursor": (
-                self._next_cursor(
-                    operation="search_source",
-                    repository=repository,
-                    resolved_oid=resolved_oid,
-                    query=query_binding,
-                    offset=offset + len(matches),
-                )
-                if has_more
-                else None
-            ),
-        }
-
-    def search_repository_source(self, request: Mapping[str, object]) -> dict[str, object]:
-        request = _request_mapping(request)
-        path_globs = request.get("path_globs")
-        if path_globs is not None and (
-            isinstance(path_globs, (str, bytes)) or not isinstance(path_globs, Iterable)
-        ):
-            raise _error("REPOSITORY_DISCOVERY_PATH_INVALID")
-        return self.search_source(
-            repository=_required_request_value(request, "repository"),  # type: ignore[arg-type]
-            revision=request.get("revision", request.get("ref", "HEAD")),  # type: ignore[arg-type]
-            query=_required_request_value(request, "query"),  # type: ignore[arg-type]
-            path_globs=path_globs,  # type: ignore[arg-type]
-            max_matches=request.get("max_matches", 100),  # type: ignore[arg-type]
-            max_bytes=request.get("max_bytes", 262_144),  # type: ignore[arg-type]
-            cursor=request.get("cursor"),  # type: ignore[arg-type]
-        )
-
-    def _iter_diff_name_entries(
-        self,
-        path: Path,
-        from_oid: str,
-        to_oid: str,
-        prefix: str,
-    ) -> Iterator[dict[str, object]]:
-        suffix = ["--", prefix] if prefix else []
-        records = self._iter_nul_records(
-            path,
-            [
-                "diff",
-                "--no-ext-diff",
-                "--no-textconv",
-                "--find-renames=50%",
-                "--name-status",
-                "-z",
-                from_oid,
-                to_oid,
-                *suffix,
-            ],
-        )
-        iterator = iter(records)
-        while True:
-            try:
-                status_raw = next(iterator)
-            except StopIteration:
-                return
-            try:
-                status = status_raw.decode("ascii")
-            except UnicodeDecodeError as exc:
-                raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID") from exc
-            if not status or status[0] not in {"A", "C", "D", "M", "R", "T", "U", "X"}:
-                raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID")
-            try:
-                if status[0] in {"R", "C"}:
-                    old_path = _decode_output_path(next(iterator))
-                    new_path = _decode_output_path(next(iterator))
-                    yield {
-                        "status": status,
-                        "path": new_path,
-                        "old_path": old_path,
-                    }
-                else:
-                    yield {
-                        "status": status,
-                        "path": _decode_output_path(next(iterator)),
-                        "old_path": None,
-                    }
-            except StopIteration as exc:
-                raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID") from exc
-
-    @staticmethod
-    def _parse_numstat_count(value: bytes) -> int | None:
-        if value == b"-":
-            return None
-        try:
-            parsed = int(value.decode("ascii"), 10)
-        except (UnicodeDecodeError, ValueError) as exc:
-            raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID") from exc
-        if parsed < 0:
-            raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID")
-        return parsed
-
-    def _diff_stats(
-        self,
-        path: Path,
-        from_oid: str,
-        to_oid: str,
-        prefix: str,
-        wanted_paths: set[str],
-    ) -> dict[str, tuple[int | None, int | None]]:
-        suffix = ["--", prefix] if prefix else []
-        records = self._iter_nul_records(
-            path,
-            [
-                "diff",
-                "--no-ext-diff",
-                "--no-textconv",
-                "--find-renames=50%",
-                "--numstat",
-                "-z",
-                from_oid,
-                to_oid,
-                *suffix,
-            ],
-        )
-        iterator = iter(records)
-        stats: dict[str, tuple[int | None, int | None]] = {}
-        for row in iterator:
-            if not row:
-                continue
-            fields = row.split(b"\t", 2)
-            if len(fields) != 3:
-                raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID")
-            additions = self._parse_numstat_count(fields[0])
-            deletions = self._parse_numstat_count(fields[1])
-            if fields[2]:
-                stat_path = _decode_output_path(fields[2])
-            else:
-                try:
-                    next(iterator)  # old path
-                    stat_path = _decode_output_path(next(iterator))
-                except StopIteration as exc:
-                    raise _error("REPOSITORY_DISCOVERY_GIT_OUTPUT_INVALID") from exc
-            if stat_path in wanted_paths:
-                stats[stat_path] = (additions, deletions)
-                if wanted_paths <= set(stats):
-                    break
-        return stats
-
-    def diff_index(
-        self,
-        *,
-        repository: str,
-        from_revision: str,
-        to_revision: str,
-        prefix: str = "",
-        limit: int = 100,
-        cursor: str | None = None,
-    ) -> dict[str, object]:
-        prefix = _safe_relative_path(prefix, "prefix", allow_empty=True)
-        limit = _positive_int(limit, "limit", _MAX_LIMIT)
-        path = self._repository_path(repository)
-        from_oid = self._resolve_at(path, from_revision, "from")
-        to_oid = self._resolve_at(path, to_revision, "to")
-        query = {
-            "from_oid": from_oid,
-            "to_oid": to_oid,
-            "prefix": prefix,
-            "limit": limit,
-        }
-        offset = self._cursor_offset(
-            cursor,
-            operation="diff_index",
-            repository=repository,
-            resolved_oid=to_oid,
-            query=query,
-        )
-        page: list[dict[str, object]] = []
-        total = 0
-        for entry in self._iter_diff_name_entries(path, from_oid, to_oid, prefix):
-            if total >= offset and len(page) < limit:
-                page.append(entry)
-            total += 1
-        wanted_paths = {str(entry["path"]) for entry in page}
-        stat_by_path = (
-            self._diff_stats(path, from_oid, to_oid, prefix, wanted_paths)
-            if page
-            else {}
-        )
-        for entry in page:
-            additions, deletions = stat_by_path.get(
-                str(entry["path"]), (None, None)
-            )
-            entry["additions"] = additions
-            entry["deletions"] = deletions
-        has_more = offset + len(page) < total
-        return {
-            "repository": repository,
-            "resolved_from_oid": from_oid,
-            "resolved_to_oid": to_oid,
-            "entries": page,
-            "truncated": has_more,
-            "next_cursor": (
-                self._next_cursor(
-                    operation="diff_index",
-                    repository=repository,
-                    resolved_oid=to_oid,
-                    query=query,
-                    offset=offset + len(page),
-                )
-                if has_more
-                else None
-            ),
-        }
-
-    def get_diff_index(self, request: Mapping[str, object]) -> dict[str, object]:
-        request = _request_mapping(request)
-        from_revision = request.get("from_revision", request.get("from"))
-        to_revision = request.get("to_revision", request.get("to"))
-        prefix = request.get("prefix", request.get("path_prefix", ""))
-        if from_revision is None or to_revision is None:
-            raise _error("REPOSITORY_DISCOVERY_REQUEST_INVALID")
-        return self.diff_index(
-            repository=_required_request_value(request, "repository"),  # type: ignore[arg-type]
-            from_revision=from_revision,  # type: ignore[arg-type]
-            to_revision=to_revision,  # type: ignore[arg-type]
-            prefix=prefix,  # type: ignore[arg-type]
-            limit=request.get("limit", 100),  # type: ignore[arg-type]
-            cursor=request.get("cursor"),  # type: ignore[arg-type]
-        )
-
-    def read_file(
-        self,
-        *,
-        repository: str,
-        revision: str,
-        file_path: str,
-        max_bytes: int = 262_144,
-    ) -> dict[str, object]:
-        file_path = _safe_relative_path(file_path, "file_path", allow_empty=False)
-        max_bytes = _positive_int(max_bytes, "max_bytes", _MAX_BYTES)
-        path = self._repository_path(repository)
-        resolved_oid = self._resolve_at(path, revision, "revision")
-        exact: list[dict[str, str]] = []
-        for entry in self._iter_tree_entries(
-            path, resolved_oid, file_path, include_trees=False
-        ):
-            if entry["path"] == file_path and entry["type"] == "blob":
-                exact.append(entry)
-        if len(exact) != 1:
-            raise RepositoryDiscoveryNotFound("REPOSITORY_DISCOVERY_FILE_NOT_FOUND")
-        blob_oid = exact[0]["object_oid"]
-        content, truncated = self._read_blob_prefix(path, blob_oid, max_bytes)
-        return {
-            "repository": repository,
-            "resolved_oid": resolved_oid,
-            "blob_oid": blob_oid,
-            "path": file_path,
-            "content": content.decode("utf-8", errors="replace"),
-            "content_base64": base64.b64encode(content).decode("ascii"),
-            "content_bytes": len(content),
-            "truncated": truncated,
-        }
-
-    def read_repository_file(self, request: Mapping[str, object]) -> dict[str, object]:
-        request = _request_mapping(request)
-        file_path = request.get("file_path", request.get("path"))
-        if file_path is None:
-            raise _error("REPOSITORY_DISCOVERY_REQUEST_INVALID")
-        return self.read_file(
-            repository=_required_request_value(request, "repository"),  # type: ignore[arg-type]
-            revision=request.get("revision", request.get("ref", "HEAD")),  # type: ignore[arg-type]
-            file_path=file_path,  # type: ignore[arg-type]
-            max_bytes=request.get("max_bytes", 262_144),  # type: ignore[arg-type]
-        )
-
-
-def create_repository_discovery(
-    *,
-    allowed_repositories: Iterable[str] | None = None,
-    git_dir: str | Path | None = None,
-    cursor_secret: str | bytes | None = None,
-) -> RepositoryDiscovery:
-    return RepositoryDiscovery(
-        allowed_repositories=allowed_repositories,
-        git_dir=git_dir,
-        cursor_secret=cursor_secret,
-    )
-
-
-def list_repository_tree(
-    request: Mapping[str, object], *, discovery: RepositoryDiscovery | None = None
-) -> dict[str, object]:
-    return (discovery or create_repository_discovery()).list_repository_tree(request)
-
-
-def search_repository_source(
-    request: Mapping[str, object], *, discovery: RepositoryDiscovery | None = None
-) -> dict[str, object]:
-    return (discovery or create_repository_discovery()).search_repository_source(request)
-
-
-def get_diff_index(
-    request: Mapping[str, object], *, discovery: RepositoryDiscovery | None = None
-) -> dict[str, object]:
-    return (discovery or create_repository_discovery()).get_diff_index(request)
-
-
-def read_repository_file(
-    request: Mapping[str, object], *, discovery: RepositoryDiscovery | None = None
-) -> dict[str, object]:
-    return (discovery or create_repository_discovery()).read_repository_file(request)

active-runtime/app/aios_single_host_operational_authority.py

@@ -1,707 +0,0 @@
-"""Single-host operational delegation for AIOS migration.
-
-This module is deliberately narrow:
-* Owner signs only OperationalDelegation and ExpiredTaskRecoveryDecision.
-* Machine signer signs only WorkerRuntimeBinding and WorkerRuntimeProof.
-* Every object is bound to one immutable Task identity and a narrow capability set.
-* There is no arbitrary sign-bytes API.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-import hashlib
-import json
-from pathlib import Path
-import re
-import time
-from typing import Any, Mapping, Sequence
-
-from aios_single_host_authority import (
-    DEFAULT_MACHINE_SIGNER_ID,
-    DEFAULT_OWNER_SIGNER_ID,
-    MACHINE_NAMESPACE,
-    OWNER_IDENTITY,
-    OWNER_NAMESPACE,
-    LocalFileSigner,
-    RegistryOwnerApprovalVerifier,
-    SignerRegistry,
-    SingleHostAuthorityError,
-    canonical_json_bytes,
-    sha256_json,
-    verify_sshsig,
-)
-
-OPERATIONAL_POLICY_SCHEMA = "aios.single-host-operational-policy.v1"
-OPERATIONAL_DELEGATION_SCHEMA = "aios.owner-operational-delegation.v1"
-RECOVERY_DECISION_SCHEMA = "aios.expired-task-recovery-decision.v1"
-WORKER_BINDING_SCHEMA = "aios.worker-runtime-binding.v1"
-WORKER_PROOF_SCHEMA = "aios.worker-runtime-proof.v1"
-REVOCATION_SCHEMA = "aios.operational-revocations.v1"
-
-ALLOWED_OPERATIONAL_CAPABILITIES = frozenset({
-    "task.recovery",
-    "worker.runtime.bind",
-    "worker.runtime.proof",
-    "task.claim.guard",
-})
-ALLOWED_EXPECTED_STATE = "EXPIRED"
-HEX40 = re.compile(r"^[0-9a-f]{40}$")
-HEX64 = re.compile(r"^[0-9a-f]{64}$")
-SAFE_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:@/+:-]{2,511}$")
-CAP = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{1,127}$")
-
-
-class OperationalAuthorityError(RuntimeError):
-    def __init__(self, code: str):
-        super().__init__(code)
-        self.code = code
-
-
-def fail(code: str) -> None:
-    raise OperationalAuthorityError(code)
-
-
-def _exact_fields(value: Mapping[str, Any], fields: set[str], code: str) -> None:
-    if not isinstance(value, Mapping) or set(value) != fields:
-        fail(code)
-
-
-def _safe_id(value: str, code: str) -> str:
-    if not isinstance(value, str) or not SAFE_ID.fullmatch(value):
-        fail(code)
-    return value
-
-
-def _hex(value: str, n: int, code: str) -> str:
-    regex = HEX40 if n == 40 else HEX64
-    if not isinstance(value, str) or not regex.fullmatch(value):
-        fail(code)
-    return value
-
-
-def _caps(value: Sequence[str], code: str) -> tuple[str, ...]:
-    if not isinstance(value, (list, tuple)) or not value:
-        fail(code)
-    out = tuple(sorted(set(value)))
-    if len(out) != len(value) or any(not isinstance(x, str) or not CAP.fullmatch(x) for x in out):
-        fail(code)
-    return out
-
-
-def task_identity_sha256(task: Mapping[str, Any]) -> str:
-    """Digest only immutable recovery/claim identity fields.
-
-    Revision, state, attempt and deadline are intentionally excluded.
-    """
-    fields = (
-        "task_id", "repository", "target_branch", "base_oid", "generation",
-        "execution_plan_sha256", "external_job_identity",
-    )
-    try:
-        value = {name: task[name] for name in fields}
-    except KeyError as exc:
-        raise OperationalAuthorityError("TASK_IDENTITY_FIELD_MISSING") from exc
-    _safe_id(str(value["task_id"]), "TASK_ID_INVALID")
-    _safe_id(str(value["repository"]), "REPOSITORY_INVALID")
-    _safe_id(str(value["target_branch"]), "TARGET_BRANCH_INVALID")
-    _hex(str(value["base_oid"]), 40, "BASE_OID_INVALID")
-    if type(value["generation"]) is not int or value["generation"] < 1:
-        fail("GENERATION_INVALID")
-    _hex(str(value["execution_plan_sha256"]), 64, "EXECUTION_PLAN_DIGEST_INVALID")
-    _safe_id(str(value["external_job_identity"]), "EXTERNAL_JOB_IDENTITY_INVALID")
-    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
-
-
-@dataclass(frozen=True, slots=True)
-class OperationalPolicy:
-    repository: str
-    task_id: str
-    task_identity_sha256: str
-    target_branch: str
-    base_oid: str
-    generation: int
-    execution_plan_sha256: str
-    external_job_identity: str
-    allowed_capabilities: tuple[str, ...]
-    allowed_worker_ids: tuple[str, ...]
-    maximum_delegation_ttl_seconds: int
-    maximum_recovery_decision_ttl_seconds: int
-    maximum_binding_ttl_seconds: int
-    maximum_proof_ttl_seconds: int
-    maximum_heartbeat_age_seconds: int
-    maximum_task_deadline_extension_seconds: int
-    schema: str = OPERATIONAL_POLICY_SCHEMA
-
-    def validate(self) -> None:
-        if self.schema != OPERATIONAL_POLICY_SCHEMA:
-            fail("OPERATIONAL_POLICY_SCHEMA_INVALID")
-        _safe_id(self.repository, "OPERATIONAL_POLICY_REPOSITORY_INVALID")
-        _safe_id(self.task_id, "OPERATIONAL_POLICY_TASK_ID_INVALID")
-        _hex(self.task_identity_sha256, 64, "OPERATIONAL_POLICY_TASK_IDENTITY_INVALID")
-        _safe_id(self.target_branch, "OPERATIONAL_POLICY_BRANCH_INVALID")
-        _hex(self.base_oid, 40, "OPERATIONAL_POLICY_BASE_OID_INVALID")
-        if type(self.generation) is not int or self.generation < 1:
-            fail("OPERATIONAL_POLICY_GENERATION_INVALID")
-        _hex(self.execution_plan_sha256, 64, "OPERATIONAL_POLICY_PLAN_INVALID")
-        _safe_id(self.external_job_identity, "OPERATIONAL_POLICY_JOB_INVALID")
-        caps = _caps(self.allowed_capabilities, "OPERATIONAL_POLICY_CAPABILITIES_INVALID")
-        if not set(caps).issubset(ALLOWED_OPERATIONAL_CAPABILITIES):
-            fail("OPERATIONAL_POLICY_CAPABILITY_WIDENING")
-        if not self.allowed_worker_ids or any(not SAFE_ID.fullmatch(x) for x in self.allowed_worker_ids):
-            fail("OPERATIONAL_POLICY_WORKERS_INVALID")
-        bounds = (
-            (self.maximum_delegation_ttl_seconds, 300, 7 * 24 * 3600),
-            (self.maximum_recovery_decision_ttl_seconds, 30, 900),
-            (self.maximum_binding_ttl_seconds, 60, 24 * 3600),
-            (self.maximum_proof_ttl_seconds, 15, 900),
-            (self.maximum_heartbeat_age_seconds, 5, 300),
-            (self.maximum_task_deadline_extension_seconds, 300, 24 * 3600),
-        )
-        if any(type(v) is not int or not lo <= v <= hi for v, lo, hi in bounds):
-            fail("OPERATIONAL_POLICY_TTL_INVALID")
-
-    @property
-    def digest(self) -> str:
-        self.validate()
-        return sha256_json(asdict(self))
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "OperationalPolicy":
-        fields = set(cls.__dataclass_fields__)
-        _exact_fields(value, fields, "OPERATIONAL_POLICY_FIELDS_INVALID")
-        try:
-            policy = cls(
-                repository=value["repository"],
-                task_id=value["task_id"],
-                task_identity_sha256=value["task_identity_sha256"],
-                target_branch=value["target_branch"],
-                base_oid=value["base_oid"],
-                generation=value["generation"],
-                execution_plan_sha256=value["execution_plan_sha256"],
-                external_job_identity=value["external_job_identity"],
-                allowed_capabilities=tuple(value["allowed_capabilities"]),
-                allowed_worker_ids=tuple(value["allowed_worker_ids"]),
-                maximum_delegation_ttl_seconds=value["maximum_delegation_ttl_seconds"],
-                maximum_recovery_decision_ttl_seconds=value["maximum_recovery_decision_ttl_seconds"],
-                maximum_binding_ttl_seconds=value["maximum_binding_ttl_seconds"],
-                maximum_proof_ttl_seconds=value["maximum_proof_ttl_seconds"],
-                maximum_heartbeat_age_seconds=value["maximum_heartbeat_age_seconds"],
-                maximum_task_deadline_extension_seconds=value["maximum_task_deadline_extension_seconds"],
-                schema=value["schema"],
-            )
-        except Exception as exc:
-            raise OperationalAuthorityError("OPERATIONAL_POLICY_FIELDS_INVALID") from exc
-        policy.validate()
-        return policy
-
-
-def build_exact_policy(
-    task: Mapping[str, Any],
-    *,
-    worker_id: str,
-    allowed_capabilities: Sequence[str] = tuple(sorted(ALLOWED_OPERATIONAL_CAPABILITIES)),
-) -> OperationalPolicy:
-    identity = task_identity_sha256(task)
-    policy = OperationalPolicy(
-        repository=str(task["repository"]),
-        task_id=str(task["task_id"]),
-        task_identity_sha256=identity,
-        target_branch=str(task["target_branch"]),
-        base_oid=str(task["base_oid"]),
-        generation=int(task["generation"]),
-        execution_plan_sha256=str(task["execution_plan_sha256"]),
-        external_job_identity=str(task["external_job_identity"]),
-        allowed_capabilities=tuple(sorted(allowed_capabilities)),
-        allowed_worker_ids=(worker_id,),
-        maximum_delegation_ttl_seconds=24 * 3600,
-        maximum_recovery_decision_ttl_seconds=300,
-        maximum_binding_ttl_seconds=4 * 3600,
-        maximum_proof_ttl_seconds=300,
-        maximum_heartbeat_age_seconds=30,
-        maximum_task_deadline_extension_seconds=4 * 3600,
-    )
-    policy.validate()
-    return policy
-
-
-def _signed_payload_dict(payload: Mapping[str, Any], *, key_id: str, namespace: str) -> dict[str, Any]:
-    value = dict(payload)
-    value["signature_namespace"] = namespace
-    value["signature_key_id"] = key_id
-    value["canonical_payload_digest"] = sha256_json(value)
-    return value
-
-
-def _verify_digest_field(payload: Mapping[str, Any]) -> bool:
-    if not isinstance(payload, Mapping) or "canonical_payload_digest" not in payload:
-        return False
-    value = dict(payload)
-    supplied = value.pop("canonical_payload_digest", None)
-    return isinstance(supplied, str) and supplied == sha256_json(value)
-
-
-@dataclass(frozen=True, slots=True)
-class SignedOperationalArtifact:
-    payload: dict[str, Any]
-    signature: str
-    key_id: str
-    namespace: str
-
-    @property
-    def canonical_payload(self) -> bytes:
-        return canonical_json_bytes(self.payload)
-
-    @property
-    def payload_sha256(self) -> str:
-        return hashlib.sha256(self.canonical_payload).hexdigest()
-
-    def to_dict(self) -> dict[str, Any]:
-        return {
-            "payload": dict(self.payload),
-            "signature": self.signature,
-            "key_id": self.key_id,
-            "namespace": self.namespace,
-        }
-
-
-class OperationalOwnerAuthority:
-    def __init__(self, key_path: Path, policy: OperationalPolicy, *, require_root_owner: bool = True, clock: Any = time.time):
-        policy.validate()
-        self.policy = policy
-        self.signer = LocalFileSigner(
-            Path(key_path),
-            signer_id=DEFAULT_OWNER_SIGNER_ID,
-            namespace=OWNER_NAMESPACE,
-            require_root_owner=require_root_owner,
-        )
-        self.clock = clock
-
-    @property
-    def fingerprint(self) -> str:
-        return self.signer.fingerprint
-
-    def _sign(self, payload: Mapping[str, Any]) -> SignedOperationalArtifact:
-        full = _signed_payload_dict(payload, key_id=self.fingerprint, namespace=OWNER_NAMESPACE)
-        art = self.signer._sign_canonical(full)
-        return SignedOperationalArtifact(dict(art.payload), art.signature, art.key_id, art.namespace)
-
-    def issue_operational_delegation(self, *, delegation_id: str, nonce: str, ttl_seconds: int) -> SignedOperationalArtifact:
-        now = int(self.clock())
-        p = self.policy
-        if not SAFE_ID.fullmatch(delegation_id) or not SAFE_ID.fullmatch(nonce):
-            fail("OPERATIONAL_DELEGATION_ID_INVALID")
-        if type(ttl_seconds) is not int or not 60 <= ttl_seconds <= p.maximum_delegation_ttl_seconds:
-            fail("OPERATIONAL_DELEGATION_TTL_INVALID")
-        payload = {
-            "schema": OPERATIONAL_DELEGATION_SCHEMA,
-            "delegation_id": delegation_id,
-            "nonce": nonce,
-            "owner_identity": OWNER_IDENTITY,
-            "repository": p.repository,
-            "task_id": p.task_id,
-            "task_identity_sha256": p.task_identity_sha256,
-            "target_branch": p.target_branch,
-            "base_oid": p.base_oid,
-            "generation": p.generation,
-            "execution_plan_sha256": p.execution_plan_sha256,
-            "external_job_identity": p.external_job_identity,
-            "allowed_capabilities": list(p.allowed_capabilities),
-            "allowed_worker_ids": list(p.allowed_worker_ids),
-            "policy_digest": p.digest,
-            "issued_at": now,
-            "not_before": max(0, now - 5),
-            "expires_at": now + ttl_seconds,
-            "revocation_epoch": 0,
-            "status": "ACTIVE",
-        }
-        return self._sign(payload)
-
-    def issue_recovery_decision(
-        self,
-        delegation: Mapping[str, Any],
-        *,
-        decision_id: str,
-        nonce: str,
-        expected_revision: int,
-        expected_attempt: int,
-        original_deadline: int,
-        new_deadline: int,
-        ttl_seconds: int,
-    ) -> SignedOperationalArtifact:
-        now = int(self.clock())
-        verify_delegation_scope(delegation, self.policy, now=now)
-        if "task.recovery" not in delegation["allowed_capabilities"]:
-            fail("RECOVERY_CAPABILITY_NOT_DELEGATED")
-        if not SAFE_ID.fullmatch(decision_id) or not SAFE_ID.fullmatch(nonce):
-            fail("RECOVERY_DECISION_ID_INVALID")
-        if type(expected_revision) is not int or expected_revision < 0 or type(expected_attempt) is not int or expected_attempt < 0:
-            fail("RECOVERY_CAS_INVALID")
-        if type(original_deadline) is not int or type(new_deadline) is not int:
-            fail("RECOVERY_DEADLINE_INVALID")
-        if new_deadline <= now or new_deadline <= original_deadline:
-            fail("RECOVERY_DEADLINE_INVALID")
-        if new_deadline - now > self.policy.maximum_task_deadline_extension_seconds:
-            fail("RECOVERY_DEADLINE_WIDENING")
-        if type(ttl_seconds) is not int or not 15 <= ttl_seconds <= self.policy.maximum_recovery_decision_ttl_seconds:
-            fail("RECOVERY_DECISION_TTL_INVALID")
-        payload = {
-            "schema": RECOVERY_DECISION_SCHEMA,
-            "decision_id": decision_id,
-            "nonce": nonce,
-            "parent_delegation_id": delegation["delegation_id"],
-            "parent_delegation_digest": hashlib.sha256(canonical_json_bytes(dict(delegation))).hexdigest(),
-            "task_id": self.policy.task_id,
-            "task_identity_sha256": self.policy.task_identity_sha256,
-            "expected_state": ALLOWED_EXPECTED_STATE,
-            "expected_revision": expected_revision,
-            "expected_attempt": expected_attempt,
-            "original_deadline": original_deadline,
-            "new_deadline": new_deadline,
-            "repository": self.policy.repository,
-            "target_branch": self.policy.target_branch,
-            "base_oid": self.policy.base_oid,
-            "generation": self.policy.generation,
-            "execution_plan_sha256": self.policy.execution_plan_sha256,
-            "external_job_identity": self.policy.external_job_identity,
-            "policy_digest": self.policy.digest,
-            "one_time_use": True,
-            "issued_at": now,
-            "not_before": max(0, now - 5),
-            "expires_at": now + ttl_seconds,
-        }
-        return self._sign(payload)
-
-
-class OperationalMachineAuthority:
-    def __init__(self, key_path: Path, policy: OperationalPolicy, *, require_root_owner: bool = True, clock: Any = time.time):
-        policy.validate()
-        self.policy = policy
-        self.signer = LocalFileSigner(
-            Path(key_path),
-            signer_id=DEFAULT_MACHINE_SIGNER_ID,
-            namespace=MACHINE_NAMESPACE,
-            require_root_owner=require_root_owner,
-        )
-        self.clock = clock
-
-    @property
-    def fingerprint(self) -> str:
-        return self.signer.fingerprint
-
-    def _sign(self, payload: Mapping[str, Any]) -> SignedOperationalArtifact:
-        full = _signed_payload_dict(payload, key_id=self.fingerprint, namespace=MACHINE_NAMESPACE)
-        art = self.signer._sign_canonical(full)
-        return SignedOperationalArtifact(dict(art.payload), art.signature, art.key_id, art.namespace)
-
-    def issue_runtime_binding(
-        self,
-        delegation: Mapping[str, Any],
-        *,
-        binding_id: str,
-        nonce: str,
-        worker_id: str,
-        runtime_id: str,
-        runtime_sha256: str,
-        task_contract_version: str,
-        supported_contract_versions: Sequence[str],
-        required_capabilities: Sequence[str],
-        worker_capabilities: Sequence[str],
-        max_concurrency: int,
-        ttl_seconds: int,
-    ) -> SignedOperationalArtifact:
-        now = int(self.clock())
-        p = self.policy
-        verify_delegation_scope(delegation, p, now=now)
-        if "worker.runtime.bind" not in delegation["allowed_capabilities"]:
-            fail("RUNTIME_BIND_CAPABILITY_NOT_DELEGATED")
-        if worker_id not in p.allowed_worker_ids:
-            fail("WORKER_ID_NOT_DELEGATED")
-        for val, code in [(binding_id, "BINDING_ID_INVALID"), (nonce, "BINDING_NONCE_INVALID"), (worker_id, "WORKER_ID_INVALID"), (runtime_id, "RUNTIME_ID_INVALID"), (task_contract_version, "CONTRACT_VERSION_INVALID")]:
-            _safe_id(val, code)
-        _hex(runtime_sha256, 64, "RUNTIME_SHA256_INVALID")
-        supported = tuple(sorted(set(supported_contract_versions)))
-        if task_contract_version not in supported or not supported or any(not SAFE_ID.fullmatch(x) for x in supported):
-            fail("CONTRACT_INCOMPATIBLE")
-        required = _caps(required_capabilities, "REQUIRED_CAPABILITIES_INVALID")
-        worker_caps = _caps(worker_capabilities, "WORKER_CAPABILITIES_INVALID")
-        if not set(required).issubset(set(worker_caps)):
-            fail("CAPABILITY_MISMATCH")
-        if type(max_concurrency) is not int or not 1 <= max_concurrency <= 64:
-            fail("MAX_CONCURRENCY_INVALID")
-        if type(ttl_seconds) is not int or not 30 <= ttl_seconds <= p.maximum_binding_ttl_seconds:
-            fail("BINDING_TTL_INVALID")
-        if now + ttl_seconds > int(delegation["expires_at"]):
-            fail("BINDING_EXCEEDS_PARENT")
-        payload = {
-            "schema": WORKER_BINDING_SCHEMA,
-            "binding_id": binding_id,
-            "nonce": nonce,
-            "parent_delegation_id": delegation["delegation_id"],
-            "parent_delegation_digest": hashlib.sha256(canonical_json_bytes(dict(delegation))).hexdigest(),
-            "repository": p.repository,
-            "task_id": p.task_id,
-            "task_identity_sha256": p.task_identity_sha256,
-            "target_branch": p.target_branch,
-            "base_oid": p.base_oid,
-            "generation": p.generation,
-            "execution_plan_sha256": p.execution_plan_sha256,
-            "external_job_identity": p.external_job_identity,
-            "worker_id": worker_id,
-            "runtime_id": runtime_id,
-            "runtime_sha256": runtime_sha256,
-            "task_contract_version": task_contract_version,
-            "supported_contract_versions": list(supported),
-            "required_capabilities": list(required),
-            "worker_capabilities": list(worker_caps),
-            "max_concurrency": max_concurrency,
-            "policy_digest": p.digest,
-            "issued_at": now,
-            "not_before": max(0, now - 5),
-            "expires_at": now + ttl_seconds,
-        }
-        return self._sign(payload)
-
-    def issue_runtime_proof(
-        self,
-        delegation: Mapping[str, Any],
-        binding: Mapping[str, Any],
-        *,
-        proof_id: str,
-        nonce: str,
-        heartbeat_at: int,
-        adapter_readiness: bool,
-        resource_readiness: bool,
-        active_claim_count: int,
-        ttl_seconds: int,
-    ) -> SignedOperationalArtifact:
-        now = int(self.clock())
-        p = self.policy
-        verify_delegation_scope(delegation, p, now=now)
-        verify_binding_scope(binding, delegation, p, now=now)
-        if "worker.runtime.proof" not in delegation["allowed_capabilities"]:
-            fail("RUNTIME_PROOF_CAPABILITY_NOT_DELEGATED")
-        _safe_id(proof_id, "PROOF_ID_INVALID")
-        _safe_id(nonce, "PROOF_NONCE_INVALID")
-        if type(heartbeat_at) is not int or heartbeat_at > now + 5 or now - heartbeat_at > p.maximum_heartbeat_age_seconds:
-            fail("HEARTBEAT_STALE")
-        if adapter_readiness is not True or resource_readiness is not True:
-            fail("RUNTIME_NOT_READY")
-        if type(active_claim_count) is not int or active_claim_count < 0 or active_claim_count >= int(binding["max_concurrency"]):
-            fail("MAX_CONCURRENCY_REACHED")
-        if type(ttl_seconds) is not int or not 10 <= ttl_seconds <= p.maximum_proof_ttl_seconds:
-            fail("PROOF_TTL_INVALID")
-        if now + ttl_seconds > min(int(binding["expires_at"]), int(delegation["expires_at"])):
-            fail("PROOF_EXCEEDS_PARENT")
-        payload = {
-            "schema": WORKER_PROOF_SCHEMA,
-            "proof_id": proof_id,
-            "nonce": nonce,
-            "parent_delegation_id": delegation["delegation_id"],
-            "parent_delegation_digest": hashlib.sha256(canonical_json_bytes(dict(delegation))).hexdigest(),
-            "binding_id": binding["binding_id"],
-            "binding_digest": hashlib.sha256(canonical_json_bytes(dict(binding))).hexdigest(),
-            "repository": p.repository,
-            "task_id": p.task_id,
-            "task_identity_sha256": p.task_identity_sha256,
-            "generation": p.generation,
-            "execution_plan_sha256": p.execution_plan_sha256,
-            "worker_id": binding["worker_id"],
-            "runtime_id": binding["runtime_id"],
-            "runtime_sha256": binding["runtime_sha256"],
-            "heartbeat_at": heartbeat_at,
-            "adapter_readiness": True,
-            "resource_readiness": True,
-            "active_claim_count": active_claim_count,
-            "max_concurrency": binding["max_concurrency"],
-            "policy_digest": p.digest,
-            "issued_at": now,
-            "expires_at": now + ttl_seconds,
-        }
-        return self._sign(payload)
-
-
-DELEGATION_FIELDS = {
-    "schema","delegation_id","nonce","owner_identity","repository","task_id",
-    "task_identity_sha256","target_branch","base_oid","generation","execution_plan_sha256",
-    "external_job_identity","allowed_capabilities","allowed_worker_ids","policy_digest",
-    "issued_at","not_before","expires_at","revocation_epoch","status",
-    "signature_namespace","signature_key_id","canonical_payload_digest",
-}
-BINDING_FIELDS = {
-    "schema","binding_id","nonce","parent_delegation_id","parent_delegation_digest",
-    "repository","task_id","task_identity_sha256","target_branch","base_oid","generation",
-    "execution_plan_sha256","external_job_identity","worker_id","runtime_id","runtime_sha256",
-    "task_contract_version","supported_contract_versions","required_capabilities","worker_capabilities",
-    "max_concurrency","policy_digest","issued_at","not_before","expires_at",
-    "signature_namespace","signature_key_id","canonical_payload_digest",
-}
-PROOF_FIELDS = {
-    "schema","proof_id","nonce","parent_delegation_id","parent_delegation_digest",
-    "binding_id","binding_digest","repository","task_id","task_identity_sha256","generation",
-    "execution_plan_sha256","worker_id","runtime_id","runtime_sha256","heartbeat_at",
-    "adapter_readiness","resource_readiness","active_claim_count","max_concurrency",
-    "policy_digest","issued_at","expires_at","signature_namespace","signature_key_id",
-    "canonical_payload_digest",
-}
-RECOVERY_FIELDS = {
-    "schema","decision_id","nonce","parent_delegation_id","parent_delegation_digest",
-    "task_id","task_identity_sha256","expected_state","expected_revision","expected_attempt",
-    "original_deadline","new_deadline","repository","target_branch","base_oid","generation",
-    "execution_plan_sha256","external_job_identity","policy_digest","one_time_use",
-    "issued_at","not_before","expires_at","signature_namespace","signature_key_id",
-    "canonical_payload_digest",
-}
-
-
-def verify_delegation_scope(value: Mapping[str, Any], policy: OperationalPolicy, *, now: int | None = None) -> None:
-    policy.validate()
-    _exact_fields(value, DELEGATION_FIELDS, "OPERATIONAL_DELEGATION_FIELDS_INVALID")
-    now = int(time.time()) if now is None else int(now)
-    if (
-        value["schema"] != OPERATIONAL_DELEGATION_SCHEMA
-        or value["status"] != "ACTIVE"
-        or value["revocation_epoch"] != 0
-        or value["owner_identity"] != OWNER_IDENTITY
-        or value["repository"] != policy.repository
-        or value["task_id"] != policy.task_id
-        or value["task_identity_sha256"] != policy.task_identity_sha256
-        or value["target_branch"] != policy.target_branch
-        or value["base_oid"] != policy.base_oid
-        or value["generation"] != policy.generation
-        or value["execution_plan_sha256"] != policy.execution_plan_sha256
-        or value["external_job_identity"] != policy.external_job_identity
-        or value["policy_digest"] != policy.digest
-        or not set(value["allowed_capabilities"]).issubset(set(policy.allowed_capabilities))
-        or not set(value["allowed_worker_ids"]).issubset(set(policy.allowed_worker_ids))
-        or value["signature_namespace"] != OWNER_NAMESPACE
-        or not _verify_digest_field(value)
-        or not int(value["not_before"]) <= now < int(value["expires_at"])
-    ):
-        fail("OPERATIONAL_DELEGATION_SCOPE_INVALID")
-
-
-def verify_binding_scope(binding: Mapping[str, Any], delegation: Mapping[str, Any], policy: OperationalPolicy, *, now: int | None = None) -> None:
-    _exact_fields(binding, BINDING_FIELDS, "WORKER_BINDING_FIELDS_INVALID")
-    now = int(time.time()) if now is None else int(now)
-    expected_parent = hashlib.sha256(canonical_json_bytes(dict(delegation))).hexdigest()
-    if (
-        binding["schema"] != WORKER_BINDING_SCHEMA
-        or binding["parent_delegation_id"] != delegation["delegation_id"]
-        or binding["parent_delegation_digest"] != expected_parent
-        or binding["repository"] != policy.repository
-        or binding["task_id"] != policy.task_id
-        or binding["task_identity_sha256"] != policy.task_identity_sha256
-        or binding["target_branch"] != policy.target_branch
-        or binding["base_oid"] != policy.base_oid
-        or binding["generation"] != policy.generation
-        or binding["execution_plan_sha256"] != policy.execution_plan_sha256
-        or binding["external_job_identity"] != policy.external_job_identity
-        or binding["worker_id"] not in policy.allowed_worker_ids
-        or binding["policy_digest"] != policy.digest
-        or binding["signature_namespace"] != MACHINE_NAMESPACE
-        or not _verify_digest_field(binding)
-        or not int(binding["not_before"]) <= now < int(binding["expires_at"])
-    ):
-        fail("WORKER_BINDING_SCOPE_INVALID")
-    required = set(binding["required_capabilities"])
-    worker = set(binding["worker_capabilities"])
-    if not required.issubset(worker) or binding["task_contract_version"] not in binding["supported_contract_versions"]:
-        fail("WORKER_BINDING_COMPATIBILITY_INVALID")
-
-
-def verify_proof_scope(proof: Mapping[str, Any], binding: Mapping[str, Any], delegation: Mapping[str, Any], policy: OperationalPolicy, *, now: int | None = None) -> None:
-    _exact_fields(proof, PROOF_FIELDS, "WORKER_PROOF_FIELDS_INVALID")
-    now = int(time.time()) if now is None else int(now)
-    if (
-        proof["schema"] != WORKER_PROOF_SCHEMA
-        or proof["parent_delegation_id"] != delegation["delegation_id"]
-        or proof["parent_delegation_digest"] != hashlib.sha256(canonical_json_bytes(dict(delegation))).hexdigest()
-        or proof["binding_id"] != binding["binding_id"]
-        or proof["binding_digest"] != hashlib.sha256(canonical_json_bytes(dict(binding))).hexdigest()
-        or proof["repository"] != policy.repository
-        or proof["task_id"] != policy.task_id
-        or proof["task_identity_sha256"] != policy.task_identity_sha256
-        or proof["generation"] != policy.generation
-        or proof["execution_plan_sha256"] != policy.execution_plan_sha256
-        or proof["worker_id"] != binding["worker_id"]
-        or proof["runtime_id"] != binding["runtime_id"]
-        or proof["runtime_sha256"] != binding["runtime_sha256"]
-        or proof["max_concurrency"] != binding["max_concurrency"]
-        or proof["policy_digest"] != policy.digest
-        or proof["signature_namespace"] != MACHINE_NAMESPACE
-        or proof["adapter_readiness"] is not True
-        or proof["resource_readiness"] is not True
-        or not _verify_digest_field(proof)
-        or not now < int(proof["expires_at"])
-        or now - int(proof["heartbeat_at"]) > policy.maximum_heartbeat_age_seconds
-        or int(proof["active_claim_count"]) >= int(proof["max_concurrency"])
-    ):
-        fail("WORKER_PROOF_SCOPE_INVALID")
-
-
-def verify_recovery_scope(decision: Mapping[str, Any], delegation: Mapping[str, Any], policy: OperationalPolicy, *, now: int | None = None) -> None:
-    _exact_fields(decision, RECOVERY_FIELDS, "RECOVERY_DECISION_FIELDS_INVALID")
-    now = int(time.time()) if now is None else int(now)
-    if (
-        decision["schema"] != RECOVERY_DECISION_SCHEMA
-        or decision["parent_delegation_id"] != delegation["delegation_id"]
-        or decision["parent_delegation_digest"] != hashlib.sha256(canonical_json_bytes(dict(delegation))).hexdigest()
-        or decision["task_id"] != policy.task_id
-        or decision["task_identity_sha256"] != policy.task_identity_sha256
-        or decision["expected_state"] != "EXPIRED"
-        or decision["repository"] != policy.repository
-        or decision["target_branch"] != policy.target_branch
-        or decision["base_oid"] != policy.base_oid
-        or decision["generation"] != policy.generation
-        or decision["execution_plan_sha256"] != policy.execution_plan_sha256
-        or decision["external_job_identity"] != policy.external_job_identity
-        or decision["policy_digest"] != policy.digest
-        or decision["one_time_use"] is not True
-        or decision["signature_namespace"] != OWNER_NAMESPACE
-        or not _verify_digest_field(decision)
-        or not int(decision["not_before"]) <= now < int(decision["expires_at"])
-        or int(decision["new_deadline"]) <= now
-    ):
-        fail("RECOVERY_DECISION_SCOPE_INVALID")
-
-
-class OperationalVerifier:
-    """Verify signatures through the public root-owned SignerRegistry."""
-
-    def __init__(self, registry_path: Path, *, require_root_owner: bool = True):
-        self.registry_path = Path(registry_path)
-        self.require_root_owner = require_root_owner
-
-    def _verify(self, artifact: SignedOperationalArtifact | Mapping[str, Any], *, role: str, signer_id: str, namespace: str) -> dict[str, Any]:
-        if isinstance(artifact, SignedOperationalArtifact):
-            payload, signature, key_id, artifact_namespace = artifact.payload, artifact.signature, artifact.key_id, artifact.namespace
-        else:
-            _exact_fields(artifact, {"payload","signature","key_id","namespace"}, "SIGNED_ARTIFACT_FIELDS_INVALID")
-            payload, signature, key_id, artifact_namespace = artifact["payload"], artifact["signature"], artifact["key_id"], artifact["namespace"]
-        if artifact_namespace != namespace:
-            fail("SIGNED_ARTIFACT_NAMESPACE_INVALID")
-        registry = SignerRegistry(self.registry_path, require_root_owner=self.require_root_owner)
-        rec = registry.require(signer_id, role=role)
-        if rec.fingerprint != key_id:
-            fail("SIGNED_ARTIFACT_KEY_ID_INVALID")
-        if role == "MACHINE_OPERATIONAL":
-            owner_rec = registry.require(DEFAULT_OWNER_SIGNER_ID, role="OWNER_AUTHORITY")
-            if rec.parent_signer_id != owner_rec.signer_id or rec.parent_fingerprint != owner_rec.fingerprint:
-                fail("MACHINE_PARENT_BINDING_INVALID")
-        # RegistryOwnerApprovalVerifier handles Owner namespace; generic machine uses registry public key.
-        if role == "OWNER_AUTHORITY":
-            verifier = RegistryOwnerApprovalVerifier(self.registry_path, require_root_owner=self.require_root_owner, signer_id=signer_id)
-            ok = verifier.verify(namespace=namespace, payload=canonical_json_bytes(payload), signature=signature, key_id=key_id)
-        else:
-            from aios_single_host_authority import _load_public_key_line
-            pub = _load_public_key_line(rec.public_key)
-            ok = verify_sshsig(pub, canonical_json_bytes(payload), signature, namespace=namespace, expected_key_id=key_id)
-        if not ok:
-            fail("SIGNED_ARTIFACT_SIGNATURE_INVALID")
-        return dict(payload)
-
-    def owner(self, artifact: SignedOperationalArtifact | Mapping[str, Any]) -> dict[str, Any]:
-        return self._verify(artifact, role="OWNER_AUTHORITY", signer_id=DEFAULT_OWNER_SIGNER_ID, namespace=OWNER_NAMESPACE)
-
-    def machine(self, artifact: SignedOperationalArtifact | Mapping[str, Any]) -> dict[str, Any]:
-        return self._verify(artifact, role="MACHINE_OPERATIONAL", signer_id=DEFAULT_MACHINE_SIGNER_ID, namespace=MACHINE_NAMESPACE)

active-runtime/app/aios_single_host_operational_authority_server.py

@@ -1,410 +0,0 @@
-"""Unix-domain fixed-schema service for operational migration authority."""
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-import os
-import re
-from pathlib import Path
-import socket
-import sqlite3
-import struct
-import stat
-import sys
-import time
-from typing import Any, Mapping
-
-from aios_single_host_authority import (
-    DEFAULT_REGISTRY_PATH,
-    OWNER_NAMESPACE,
-    MACHINE_NAMESPACE,
-    SingleHostAuthorityError,
-)
-from aios_single_host_operational_authority import (
-    OperationalAuthorityError,
-    OperationalMachineAuthority,
-    OperationalOwnerAuthority,
-    OperationalPolicy,
-    OperationalVerifier,
-    SignedOperationalArtifact,
-    verify_binding_scope,
-    verify_delegation_scope,
-)
-
-DEFAULT_POLICY = Path("/etc/aios/single-host-operational-policy.json")
-DEFAULT_OWNER_KEY = Path("/var/lib/aios-owner-authority/owner-authority.key")
-DEFAULT_MACHINE_KEY = Path("/var/lib/aios-machine-signer/machine-operational.key")
-DEFAULT_OWNER_SOCKET = Path("/run/aios/owner-authority.sock")
-DEFAULT_MACHINE_SOCKET = Path("/run/aios/machine-signer.sock")
-DEFAULT_LEDGER = Path("/var/lib/aios-operational-authority/issuance-ledger.sqlite3")
-MAX_REQUEST = 128 * 1024
-READINESS_SCHEMA = "aios.signer-readiness-challenge.v1"
-
-
-class OperationalServiceError(RuntimeError):
-    def __init__(self, code: str):
-        super().__init__(code)
-        self.code = code
-
-
-def fail(code: str) -> None:
-    raise OperationalServiceError(code)
-
-
-def _read_policy(path: Path, *, require_root_owner: bool = True) -> OperationalPolicy:
-    path=Path(path)
-    if not path.is_absolute():
-        fail("OPERATIONAL_POLICY_PATH_INVALID")
-    flags=os.O_RDONLY
-    if hasattr(os,"O_NOFOLLOW"):
-        flags |= os.O_NOFOLLOW
-    try:
-        fd=os.open(path,flags)
-    except OSError as exc:
-        raise OperationalServiceError("OPERATIONAL_POLICY_UNAVAILABLE") from exc
-    try:
-        st=os.fstat(fd)
-        if not stat.S_ISREG(st.st_mode):
-            fail("OPERATIONAL_POLICY_NOT_REGULAR")
-        mode=stat.S_IMODE(st.st_mode)
-        if mode & 0o022:
-            fail("OPERATIONAL_POLICY_WRITABLE_BY_GROUP_OR_OTHER")
-        if require_root_owner and st.st_uid != 0:
-            fail("OPERATIONAL_POLICY_NOT_ROOT_OWNED")
-        raw=bytearray()
-        while len(raw) <= MAX_REQUEST:
-            chunk=os.read(fd,min(65536,MAX_REQUEST+1-len(raw)))
-            if not chunk: break
-            raw.extend(chunk)
-        if not raw or len(raw)>MAX_REQUEST:
-            fail("OPERATIONAL_POLICY_UNAVAILABLE")
-    finally:
-        os.close(fd)
-    try:
-        obj=json.loads(bytes(raw).decode("utf-8"))
-    except Exception as exc:
-        raise OperationalServiceError("OPERATIONAL_POLICY_INVALID") from exc
-    return OperationalPolicy.from_mapping(obj)
-
-
-def _artifact(value: Mapping[str, Any]) -> SignedOperationalArtifact:
-    if not isinstance(value, Mapping) or set(value) != {"payload","signature","key_id","namespace"}:
-        fail("SIGNED_ARTIFACT_INVALID")
-    if not isinstance(value["payload"], Mapping):
-        fail("SIGNED_ARTIFACT_INVALID")
-    return SignedOperationalArtifact(
-        payload=dict(value["payload"]),
-        signature=str(value["signature"]),
-        key_id=str(value["key_id"]),
-        namespace=str(value["namespace"]),
-    )
-
-
-def _peer_uid(conn: socket.socket) -> int:
-    if not hasattr(socket, "SO_PEERCRED"):
-        fail("PEER_CREDENTIALS_UNAVAILABLE")
-    pid, uid, gid = struct.unpack("3i", conn.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, struct.calcsize("3i")))
-    return uid
-
-
-
-class DurableIssuanceLedger:
-    """Root-owned exact-idempotent structured signing ledger."""
-
-    def __init__(self, path: Path):
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        if os.name == "posix": os.chmod(self.path.parent, 0o700)
-        if self.path.exists() and self.path.is_symlink():
-            fail("ISSUANCE_LEDGER_SYMLINK_FORBIDDEN")
-        conn = sqlite3.connect(self.path)
-        try:
-            conn.execute("PRAGMA journal_mode=DELETE")
-            conn.execute("""
-                CREATE TABLE IF NOT EXISTS issuance (
-                  role TEXT NOT NULL,
-                  operation TEXT NOT NULL,
-                  nonce TEXT NOT NULL,
-                  request_sha256 TEXT NOT NULL,
-                  response_json TEXT NOT NULL,
-                  created_at INTEGER NOT NULL,
-                  PRIMARY KEY(role, operation, nonce)
-                )
-            """)
-            conn.commit()
-        finally:
-            conn.close()
-        os.chmod(self.path, 0o600)
-
-    def issue(self, *, role: str, operation: str, nonce: str, request: Mapping[str, Any], issuer: Any) -> dict[str, Any]:
-        request_sha = hashlib.sha256(
-            json.dumps(request, sort_keys=True, separators=(",",":"), ensure_ascii=False).encode("utf-8")
-        ).hexdigest()
-        conn = sqlite3.connect(self.path, timeout=5, isolation_level=None)
-        try:
-            conn.execute("BEGIN IMMEDIATE")
-            row = conn.execute(
-                "SELECT request_sha256,response_json FROM issuance WHERE role=? AND operation=? AND nonce=?",
-                (role, operation, nonce),
-            ).fetchone()
-            if row is not None:
-                if row[0] != request_sha:
-                    conn.rollback()
-                    fail("NONCE_REUSE_WITH_DIFFERENT_REQUEST")
-                result = json.loads(row[1])
-                conn.commit()
-                return result
-            result = issuer()
-            encoded = json.dumps(result, sort_keys=True, separators=(",",":"), ensure_ascii=False)
-            conn.execute(
-                "INSERT INTO issuance(role,operation,nonce,request_sha256,response_json,created_at) VALUES(?,?,?,?,?,?)",
-                (role, operation, nonce, request_sha, encoded, int(time.time())),
-            )
-            conn.commit()
-            return result
-        except sqlite3.IntegrityError:
-            conn.rollback()
-            fail("ISSUANCE_LEDGER_RACE")
-        finally:
-            conn.close()
-
-class OperationalAuthorityService:
-    def __init__(
-        self,
-        *,
-        role: str,
-        policy_path: Path = DEFAULT_POLICY,
-        registry_path: Path = DEFAULT_REGISTRY_PATH,
-        owner_key_path: Path = DEFAULT_OWNER_KEY,
-        machine_key_path: Path = DEFAULT_MACHINE_KEY,
-        socket_path: Path | None = None,
-        ledger_path: Path = DEFAULT_LEDGER,
-        allowed_uids: tuple[int, ...] = (0,),
-        clock: Any = time.time,
-        require_root_owner: bool = True,
-    ):
-        if role not in {"owner","machine"}:
-            fail("ROLE_INVALID")
-        self.role = role
-        self.policy_path = Path(policy_path)
-        self.registry_path = Path(registry_path)
-        self.owner_key_path = Path(owner_key_path)
-        self.machine_key_path = Path(machine_key_path)
-        self.socket_path = Path(socket_path or (DEFAULT_OWNER_SOCKET if role == "owner" else DEFAULT_MACHINE_SOCKET))
-        self.allowed_uids = tuple(allowed_uids)
-        self.ledger = DurableIssuanceLedger(ledger_path)
-        self.clock = clock
-        self.require_root_owner = require_root_owner
-
-    def _components(self):
-        policy = _read_policy(self.policy_path, require_root_owner=self.require_root_owner)
-        verifier = OperationalVerifier(self.registry_path, require_root_owner=self.require_root_owner)
-        if self.role == "owner":
-            signer = OperationalOwnerAuthority(self.owner_key_path, policy, require_root_owner=self.require_root_owner, clock=self.clock)
-        else:
-            signer = OperationalMachineAuthority(self.machine_key_path, policy, require_root_owner=self.require_root_owner, clock=self.clock)
-        return policy, verifier, signer
-
-    def handle(self, request: Mapping[str, Any], *, peer_uid: int) -> dict[str, Any]:
-        if peer_uid not in self.allowed_uids:
-            fail("PEER_UID_FORBIDDEN")
-        if not isinstance(request, Mapping) or set(request) != {"operation","payload"} or not isinstance(request["payload"], Mapping):
-            fail("REQUEST_INVALID")
-        op = request["operation"]
-        p = request["payload"]
-        policy, verifier, signer = self._components()
-
-        if op == "identity":
-            return {
-                "status":"PASS",
-                "role":self.role,
-                "policy_digest":policy.digest,
-                "key_id":signer.fingerprint,
-                "socket":str(self.socket_path),
-                "arbitrary_signing":False,
-            }
-
-        if op == "readiness_challenge":
-            if set(p) != {"challenge_id","challenge_sha256"}:
-                fail("REQUEST_FIELDS_INVALID")
-            challenge_id = str(p["challenge_id"])
-            challenge_sha256 = str(p["challenge_sha256"])
-            if not challenge_id or len(challenge_id) > 160:
-                fail("READINESS_CHALLENGE_ID_INVALID")
-            if not isinstance(challenge_sha256, str) or not re.fullmatch(r"[0-9a-f]{64}", challenge_sha256):
-                fail("READINESS_CHALLENGE_SHA256_INVALID")
-            namespace = OWNER_NAMESPACE if self.role == "owner" else MACHINE_NAMESPACE
-            def issue():
-                art = signer._sign({
-                    "schema": READINESS_SCHEMA,
-                    "role": self.role,
-                    "challenge_id": challenge_id,
-                    "challenge_sha256": challenge_sha256,
-                    "policy_digest": policy.digest,
-                    "issued_at": int(self.clock()),
-                })
-                return {"status":"PASS","artifact":art.to_dict()}
-            return self.ledger.issue(
-                role=self.role,
-                operation=op,
-                nonce=challenge_id,
-                request=p,
-                issuer=issue,
-            )
-
-        if self.role == "owner":
-            if op == "issue_operational_delegation":
-                if set(p) != {"delegation_id","nonce","ttl_seconds"}:
-                    fail("REQUEST_FIELDS_INVALID")
-                def issue():
-                    art = signer.issue_operational_delegation(
-                        delegation_id=str(p["delegation_id"]),
-                        nonce=str(p["nonce"]),
-                        ttl_seconds=p["ttl_seconds"],
-                    )
-                    return {"status":"PASS","artifact":art.to_dict()}
-                return self.ledger.issue(role=self.role, operation=op, nonce=str(p["nonce"]), request=p, issuer=issue)
-            if op == "issue_expired_task_recovery":
-                if set(p) != {"delegation","decision_id","nonce","expected_revision","expected_attempt","original_deadline","new_deadline","ttl_seconds"}:
-                    fail("REQUEST_FIELDS_INVALID")
-                parent_art = _artifact(p["delegation"])
-                parent = verifier.owner(parent_art)
-                verify_delegation_scope(parent, policy, now=int(self.clock()))
-                def issue():
-                    art = signer.issue_recovery_decision(
-                        parent,
-                        decision_id=str(p["decision_id"]),
-                        nonce=str(p["nonce"]),
-                        expected_revision=p["expected_revision"],
-                        expected_attempt=p["expected_attempt"],
-                        original_deadline=p["original_deadline"],
-                        new_deadline=p["new_deadline"],
-                        ttl_seconds=p["ttl_seconds"],
-                    )
-                    return {"status":"PASS","artifact":art.to_dict()}
-                return self.ledger.issue(role=self.role, operation=op, nonce=str(p["nonce"]), request=p, issuer=issue)
-            fail("OWNER_OPERATION_FORBIDDEN")
-
-        if op == "issue_worker_runtime_binding":
-            if set(p) != {
-                "delegation","binding_id","nonce","worker_id","runtime_id","runtime_sha256",
-                "task_contract_version","supported_contract_versions","required_capabilities",
-                "worker_capabilities","max_concurrency","ttl_seconds"
-            }:
-                fail("REQUEST_FIELDS_INVALID")
-            parent_art = _artifact(p["delegation"])
-            parent = verifier.owner(parent_art)
-            verify_delegation_scope(parent, policy, now=int(self.clock()))
-            def issue():
-                art = signer.issue_runtime_binding(
-                    parent,
-                    binding_id=str(p["binding_id"]), nonce=str(p["nonce"]),
-                    worker_id=str(p["worker_id"]), runtime_id=str(p["runtime_id"]),
-                    runtime_sha256=str(p["runtime_sha256"]),
-                    task_contract_version=str(p["task_contract_version"]),
-                    supported_contract_versions=tuple(p["supported_contract_versions"]),
-                    required_capabilities=tuple(p["required_capabilities"]),
-                    worker_capabilities=tuple(p["worker_capabilities"]),
-                    max_concurrency=p["max_concurrency"], ttl_seconds=p["ttl_seconds"],
-                )
-                return {"status":"PASS","artifact":art.to_dict()}
-            return self.ledger.issue(role=self.role, operation=op, nonce=str(p["nonce"]), request=p, issuer=issue)
-
-        if op == "issue_worker_runtime_proof":
-            if set(p) != {
-                "delegation","binding","proof_id","nonce","heartbeat_at","adapter_readiness",
-                "resource_readiness","active_claim_count","ttl_seconds"
-            }:
-                fail("REQUEST_FIELDS_INVALID")
-            parent_art = _artifact(p["delegation"])
-            binding_art = _artifact(p["binding"])
-            parent = verifier.owner(parent_art)
-            binding = verifier.machine(binding_art)
-            verify_delegation_scope(parent, policy, now=int(self.clock()))
-            verify_binding_scope(binding, parent, policy, now=int(self.clock()))
-            def issue():
-                art = signer.issue_runtime_proof(
-                    parent, binding,
-                    proof_id=str(p["proof_id"]), nonce=str(p["nonce"]),
-                    heartbeat_at=p["heartbeat_at"],
-                    adapter_readiness=p["adapter_readiness"],
-                    resource_readiness=p["resource_readiness"],
-                    active_claim_count=p["active_claim_count"],
-                    ttl_seconds=p["ttl_seconds"],
-                )
-                return {"status":"PASS","artifact":art.to_dict()}
-            return self.ledger.issue(role=self.role, operation=op, nonce=str(p["nonce"]), request=p, issuer=issue)
-
-        fail("MACHINE_OPERATION_FORBIDDEN")
-
-    def serve_forever(self) -> None:
-        path = self.socket_path
-        path.parent.mkdir(parents=True, exist_ok=True)
-        if path.exists() or path.is_symlink():
-            if path.is_socket():
-                path.unlink()
-            else:
-                fail("SOCKET_PATH_OCCUPIED")
-        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        try:
-            sock.bind(str(path))
-            os.chmod(path, 0o600)
-            sock.listen(16)
-            while True:
-                conn, _ = sock.accept()
-                with conn:
-                    try:
-                        uid = _peer_uid(conn)
-                        chunks = []
-                        total = 0
-                        while True:
-                            data = conn.recv(65536)
-                            if not data:
-                                break
-                            total += len(data)
-                            if total > MAX_REQUEST:
-                                fail("REQUEST_TOO_LARGE")
-                            chunks.append(data)
-                            if b"\n" in data:
-                                break
-                        raw = b"".join(chunks)
-                        line = raw.split(b"\n",1)[0]
-                        req = json.loads(line.decode("utf-8"))
-                        result = self.handle(req, peer_uid=uid)
-                        out = {"ok":True,"result":result}
-                    except (OperationalServiceError, OperationalAuthorityError, SingleHostAuthorityError) as exc:
-                        out = {"ok":False,"error":getattr(exc,"code",str(exc))}
-                    except Exception:
-                        out = {"ok":False,"error":"INTERNAL_FAIL_CLOSED"}
-                    conn.sendall(json.dumps(out, sort_keys=True, separators=(",",":")).encode("utf-8")+b"\n")
-        finally:
-            sock.close()
-            try:
-                path.unlink()
-            except FileNotFoundError:
-                pass
-
-
-def main() -> int:
-    ap = argparse.ArgumentParser()
-    ap.add_argument("--role", choices=("owner","machine"), required=True)
-    ap.add_argument("--policy", default=str(DEFAULT_POLICY))
-    ap.add_argument("--registry", default=str(DEFAULT_REGISTRY_PATH))
-    ap.add_argument("--owner-key", default=str(DEFAULT_OWNER_KEY))
-    ap.add_argument("--machine-key", default=str(DEFAULT_MACHINE_KEY))
-    ap.add_argument("--socket")
-    ns = ap.parse_args()
-    service = OperationalAuthorityService(
-        role=ns.role,
-        policy_path=Path(ns.policy),
-        registry_path=Path(ns.registry),
-        owner_key_path=Path(ns.owner_key),
-        machine_key_path=Path(ns.machine_key),
-        socket_path=Path(ns.socket) if ns.socket else None,
-    )
-    service.serve_forever()
-    return 0
-
-if __name__ == "__main__":
-    raise SystemExit(main())

active-runtime/app/aios_task_admission_bootstrap.py

@@ -1,945 +0,0 @@
-"""Fail-closed bootstrap for narrow Owner-delegated Agent Task admission.
-
-This module solves the authorization bootstrap problem without turning the
-runtime anchor into a writer and without weakening TaskPrincipal semantics.
-
-Security model:
-
-* A task-admission envelope is created from a server-normalized request.
-* The envelope is authorized either by an already-valid OwnerDelegationEpoch
-  or by an Owner signature verified by an injected trust backend.
-* The derived TaskAdmissionGrant can only narrow the parent authorization.
-* The grant is handed to the existing Agent Task control plane through an
-  injected TaskAdmissionPort. This module never writes the Task database.
-* TaskPrincipal issuance remains downstream of a real Task claim/TaskLease.
-* Exact idempotent replay returns the same admitted Task; conflicting reuse is
-  rejected.
-"""
-
-from __future__ import annotations
-
-import base64
-from contextlib import closing, contextmanager
-from dataclasses import asdict, dataclass
-from datetime import datetime, timezone
-import hashlib
-import json
-from pathlib import Path, PurePosixPath
-import re
-import secrets
-import sqlite3
-import threading
-from typing import Any, Callable, Mapping, Protocol, Sequence
-
-
-SCHEMA_ENVELOPE = "aios.task-admission-envelope.v1"
-SCHEMA_GRANT = "aios.task-admission-grant.v1"
-SCHEMA_EPOCH = "aios.owner-delegation-epoch.v1"
-SCHEMA_RECEIPT = "aios.task-admission-receipt.v1"
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-IDEMPOTENCY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:@/-]{7,255}$")
-CAPABILITY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{1,127}$")
-KEY_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:@+-]{2,255}$")
-
-PROHIBITED_CAPABILITIES = frozenset(
-    {
-        "git.global_write",
-        "git.main_write",
-        "git.force_push",
-        "tag.publish",
-        "baseline.finalize",
-        "production.write",
-        "production.switch",
-        "runtime_anchor.write",
-        "shell.arbitrary",
-        "credential.export",
-    }
-)
-
-
-class TaskAdmissionError(RuntimeError):
-    """Stable fail-closed task-admission error."""
-
-    def __init__(
-        self,
-        code: str,
-        status: int = 400,
-        *,
-        details: Mapping[str, Any] | None = None,
-    ) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-        self.details = dict(details or {})
-
-
-@dataclass(frozen=True, slots=True)
-class TaskAdmissionPolicy:
-    repository: str = "aios/aios"
-    trust_domain: str = "aios.owner"
-    branch_prefix: str = "agent/"
-    allowed_capabilities: frozenset[str] = frozenset(
-        {
-            "governed.task.create",
-            "agent-task:control",
-            "task.principal.issue",
-            "writer.lease",
-            "governed.write.files",
-            "git.read",
-            "git.test",
-            "governed.write.branch",
-            "governed.write.file",
-            "testing",
-            "verification",
-        }
-    )
-    max_file_count: int = 64
-    max_task_ttl_seconds: int = 3600
-    max_envelope_ttl_seconds: int = 900
-    max_risk: str = "medium"
-    policy_digest: str = ""
-
-    def normalized_policy_digest(self) -> str:
-        if self.policy_digest:
-            return self.policy_digest
-        return sha256_json(
-            {
-                "repository": self.repository,
-                "trust_domain": self.trust_domain,
-                "branch_prefix": self.branch_prefix,
-                "allowed_capabilities": sorted(self.allowed_capabilities),
-                "max_file_count": self.max_file_count,
-                "max_task_ttl_seconds": self.max_task_ttl_seconds,
-                "max_envelope_ttl_seconds": self.max_envelope_ttl_seconds,
-                "max_risk": self.max_risk,
-                "prohibited_capabilities": sorted(PROHIBITED_CAPABILITIES),
-            }
-        )
-
-
-@dataclass(frozen=True, slots=True)
-class OwnerDelegationEpoch:
-    """Already-verified durable Owner authorization.
-
-    The verifier/backend is responsible for authenticating the epoch before
-    returning it to this service.
-    """
-
-    epoch_id: str
-    owner_identity: str
-    trust_domain: str
-    repository: str
-    allowed_branch_prefixes: tuple[str, ...]
-    allowed_capabilities: frozenset[str]
-    allowed_file_prefixes: tuple[str, ...]
-    risk_ceiling: str
-    issued_at: int
-    not_before: int
-    expires_at: int
-    revocation_epoch: int
-    policy_digest: str
-    schema: str = SCHEMA_EPOCH
-
-    def as_public_dict(self) -> dict[str, Any]:
-        value = asdict(self)
-        value["allowed_capabilities"] = sorted(self.allowed_capabilities)
-        value["allowed_branch_prefixes"] = list(self.allowed_branch_prefixes)
-        value["allowed_file_prefixes"] = list(self.allowed_file_prefixes)
-        return value
-
-
-@dataclass(frozen=True, slots=True)
-class TaskAdmissionEnvelope:
-    envelope_id: str
-    idempotency_key: str
-    task_id: str
-    repository: str
-    authority_base_oid: str
-    target_branch: str
-    generation: int
-    execution_digest: str
-    requested_capabilities: tuple[str, ...]
-    file_allowlist: tuple[str, ...]
-    risk: str
-    trust_domain: str
-    policy_digest: str
-    issued_at: int
-    not_before: int
-    expires_at: int
-    nonce: str
-    request_digest: str
-    schema: str = SCHEMA_ENVELOPE
-
-    def as_dict(self) -> dict[str, Any]:
-        value = asdict(self)
-        value["requested_capabilities"] = list(self.requested_capabilities)
-        value["file_allowlist"] = list(self.file_allowlist)
-        return value
-
-
-@dataclass(frozen=True, slots=True)
-class TaskAdmissionGrant:
-    grant_id: str
-    envelope_id: str
-    task_id: str
-    repository: str
-    authority_base_oid: str
-    target_branch: str
-    generation: int
-    execution_digest: str
-    capabilities: tuple[str, ...]
-    file_allowlist: tuple[str, ...]
-    risk: str
-    trust_domain: str
-    policy_digest: str
-    authorization_kind: str
-    owner_identity: str
-    parent_epoch_id: str | None
-    issued_at: int
-    expires_at: int
-    one_time_use: bool = True
-    schema: str = SCHEMA_GRANT
-
-    def as_dict(self) -> dict[str, Any]:
-        value = asdict(self)
-        value["capabilities"] = list(self.capabilities)
-        value["file_allowlist"] = list(self.file_allowlist)
-        return value
-
-
-class OwnerAuthorizationBackend(Protocol):
-    """Bridge to existing trusted Owner authorization.
-
-    No permissive default implementation is provided.
-    """
-
-    def verify_delegation_epoch(self, epoch_id: str) -> OwnerDelegationEpoch:
-        ...
-
-    def verify_owner_signature(
-        self,
-        *,
-        key_id: str,
-        canonical_payload: bytes,
-        signature_b64: str,
-    ) -> str:
-        """Return the verified Owner identity or raise."""
-        ...
-
-
-class TaskAdmissionPort(Protocol):
-    """Existing Agent Task control-plane port."""
-
-    def admit(self, grant: TaskAdmissionGrant) -> Mapping[str, Any]:
-        ...
-
-
-def utc_seconds() -> int:
-    return int(datetime.now(timezone.utc).timestamp())
-
-
-def canonical_json_bytes(value: Any) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def sha256_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
-
-
-def _normalize_files(raw: Sequence[object], *, maximum: int) -> tuple[str, ...]:
-    if not isinstance(raw, (list, tuple)):
-        raise TaskAdmissionError("TASK_ADMISSION_FILE_ALLOWLIST_REJECTED", 403)
-    if not raw or len(raw) > maximum:
-        raise TaskAdmissionError("TASK_ADMISSION_FILE_ALLOWLIST_REJECTED", 403)
-    normalized: list[str] = []
-    seen: set[str] = set()
-    for item in raw:
-        if (
-            not isinstance(item, str)
-            or not item
-            or "\\" in item
-            or any(ord(char) < 32 or ord(char) == 127 for char in item)
-        ):
-            raise TaskAdmissionError("TASK_ADMISSION_FILE_PATH_INVALID", 403)
-        path = PurePosixPath(item)
-        if path.is_absolute() or ".." in path.parts or "." in path.parts:
-            raise TaskAdmissionError("TASK_ADMISSION_FILE_PATH_INVALID", 403)
-        text = path.as_posix()
-        # Do not normalize a caller supplied path.  A signature must bind the
-        # exact spelling, not a convenient equivalent such as ``a//b``.
-        if text != item:
-            raise TaskAdmissionError("TASK_ADMISSION_FILE_PATH_INVALID", 403)
-        if text.startswith(".git/") or text == ".git":
-            raise TaskAdmissionError("TASK_ADMISSION_FILE_PATH_INVALID", 403)
-        if text not in seen:
-            normalized.append(text)
-            seen.add(text)
-    if not normalized:
-        raise TaskAdmissionError("TASK_ADMISSION_FILE_ALLOWLIST_REJECTED", 403)
-    return tuple(sorted(normalized))
-
-
-def _normalize_capabilities(
-    raw: Sequence[object],
-    *,
-    policy: TaskAdmissionPolicy,
-) -> tuple[str, ...]:
-    if not raw:
-        raise TaskAdmissionError("TASK_ADMISSION_CAPABILITIES_REQUIRED", 403)
-    values: set[str] = set()
-    for item in raw:
-        if not isinstance(item, str) or not CAPABILITY_RE.fullmatch(item):
-            raise TaskAdmissionError("TASK_ADMISSION_CAPABILITY_INVALID", 403)
-        if "*" in item:
-            raise TaskAdmissionError("TASK_ADMISSION_WILDCARD_CAPABILITY_REJECTED", 403)
-        values.add(item)
-    if values & PROHIBITED_CAPABILITIES:
-        raise TaskAdmissionError("TASK_ADMISSION_PROHIBITED_CAPABILITY", 403)
-    if not values.issubset(policy.allowed_capabilities):
-        raise TaskAdmissionError("TASK_ADMISSION_CAPABILITY_OUT_OF_POLICY", 403)
-    return tuple(sorted(values))
-
-
-def _risk_rank(value: str) -> int:
-    ranks = {"low": 0, "medium": 1, "high": 2}
-    try:
-        return ranks[value]
-    except KeyError:
-        raise TaskAdmissionError("TASK_ADMISSION_RISK_INVALID", 403) from None
-
-
-def _request_for_digest(
-    *,
-    task_id: str,
-    repository: str,
-    authority_base_oid: str,
-    target_branch: str,
-    generation: int,
-    execution_digest: str,
-    requested_capabilities: tuple[str, ...],
-    file_allowlist: tuple[str, ...],
-    risk: str,
-    trust_domain: str,
-    policy_digest: str,
-) -> dict[str, Any]:
-    return {
-        "task_id": task_id,
-        "repository": repository,
-        "authority_base_oid": authority_base_oid,
-        "target_branch": target_branch,
-        "generation": generation,
-        "execution_digest": execution_digest,
-        "requested_capabilities": list(requested_capabilities),
-        "file_allowlist": list(file_allowlist),
-        "risk": risk,
-        "trust_domain": trust_domain,
-        "policy_digest": policy_digest,
-    }
-
-
-class TaskAdmissionStore:
-    """Portable durable state; all replay decisions are transactionally stored."""
-
-    def __init__(self, path: Path) -> None:
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        self.lock_root = Path(str(self.path) + ".locks")
-        self.lock_root.mkdir(parents=True, exist_ok=True)
-        self._lock = threading.RLock()
-        with self._connection() as con:
-            con.executescript(
-                """
-                PRAGMA journal_mode=WAL;
-                CREATE TABLE IF NOT EXISTS task_admission_envelopes(
-                    idempotency_key TEXT PRIMARY KEY,
-                    envelope_id TEXT NOT NULL UNIQUE,
-                    request_digest TEXT NOT NULL,
-                    envelope_json TEXT NOT NULL,
-                    status TEXT NOT NULL,
-                    created_at INTEGER NOT NULL
-                );
-                CREATE TABLE IF NOT EXISTS task_admission_grants(
-                    envelope_id TEXT PRIMARY KEY,
-                    grant_id TEXT NOT NULL UNIQUE,
-                    grant_digest TEXT NOT NULL,
-                    grant_json TEXT NOT NULL,
-                    authorization_digest TEXT NOT NULL DEFAULT '',
-                    created_at INTEGER NOT NULL
-                );
-                CREATE TABLE IF NOT EXISTS task_admission_receipts(
-                    envelope_id TEXT PRIMARY KEY,
-                    task_id TEXT NOT NULL UNIQUE,
-                    receipt_json TEXT NOT NULL,
-                    created_at INTEGER NOT NULL
-                );
-                """
-            )
-            columns = {
-                row["name"] for row in con.execute("PRAGMA table_info(task_admission_grants)")
-            }
-            if "authorization_digest" not in columns:
-                con.execute(
-                    "ALTER TABLE task_admission_grants ADD COLUMN authorization_digest TEXT NOT NULL DEFAULT ''"
-                )
-
-    def _connect(self) -> sqlite3.Connection:
-        con = sqlite3.connect(self.path, timeout=30, isolation_level=None)
-        con.row_factory = sqlite3.Row
-        return con
-
-    @contextmanager
-    def _connection(self):
-        """Yield an owned main-store connection and close it deterministically."""
-        with closing(self._connect()) as con:
-            try:
-                yield con
-            finally:
-                if con.in_transaction:
-                    con.rollback()
-
-    @contextmanager
-    def admission_lock(self, envelope_id: str, *, timeout_seconds: float = 5.0):
-        """Hold a crash-releasing lock for one envelope, outside the main DB."""
-        lock_name = hashlib.sha256(envelope_id.encode("utf-8")).hexdigest() + ".sqlite3"
-        lock_path = self.lock_root / lock_name
-        with closing(sqlite3.connect(lock_path, timeout=timeout_seconds, isolation_level=None)) as con:
-            try:
-                con.execute("BEGIN EXCLUSIVE")
-            except sqlite3.OperationalError as exc:
-                raise TaskAdmissionError("TASK_ADMISSION_IN_PROGRESS", 503) from exc
-            try:
-                yield
-                con.execute("COMMIT")
-            finally:
-                if con.in_transaction:
-                    con.rollback()
-
-    def get_by_idempotency(self, key: str) -> dict[str, Any] | None:
-        with self._connection() as con:
-            row = con.execute(
-                "SELECT * FROM task_admission_envelopes WHERE idempotency_key=?",
-                (key,),
-            ).fetchone()
-        return dict(row) if row else None
-
-    def get_envelope(self, envelope_id: str) -> dict[str, Any] | None:
-        with self._connection() as con:
-            row = con.execute(
-                "SELECT * FROM task_admission_envelopes WHERE envelope_id=?",
-                (envelope_id,),
-            ).fetchone()
-        return dict(row) if row else None
-
-    def save_envelope(
-        self,
-        *,
-        idempotency_key: str,
-        envelope_id: str,
-        request_digest: str,
-        envelope_json: str,
-        created_at: int,
-    ) -> dict[str, Any]:
-        with self._lock, self._connection() as con:
-            con.execute("BEGIN IMMEDIATE")
-            row = con.execute(
-                "SELECT request_digest,envelope_id FROM task_admission_envelopes WHERE idempotency_key=?",
-                (idempotency_key,),
-            ).fetchone()
-            if row is not None:
-                con.execute("ROLLBACK")
-                if row["request_digest"] != request_digest:
-                    raise TaskAdmissionError("TASK_ADMISSION_IDEMPOTENCY_CONFLICT", 409)
-                return json.loads(
-                    con.execute(
-                        "SELECT envelope_json FROM task_admission_envelopes WHERE idempotency_key=?",
-                        (idempotency_key,),
-                    ).fetchone()["envelope_json"]
-                )
-            con.execute(
-                """
-                INSERT INTO task_admission_envelopes(
-                    idempotency_key,envelope_id,request_digest,envelope_json,status,created_at
-                ) VALUES(?,?,?,?,?,?)
-                """,
-                (
-                    idempotency_key,
-                    envelope_id,
-                    request_digest,
-                    envelope_json,
-                    "PENDING_AUTHORIZATION",
-                    created_at,
-                ),
-            )
-            con.execute("COMMIT")
-        return json.loads(envelope_json)
-
-    def claim_grant(
-        self,
-        *,
-        envelope_id: str,
-        grant: TaskAdmissionGrant,
-        authorization_digest: str,
-        created_at: int,
-    ) -> tuple[TaskAdmissionGrant, bool]:
-        """Persist the immutable grant before the external Task side effect.
-
-        ``BEGIN IMMEDIATE`` serializes only this SQLite writer transaction;
-        it does not serialize unrelated envelopes.  A second proof cannot
-        replace the winning proof/grant for the same envelope.
-        """
-        grant_json = canonical_json_bytes(grant.as_dict()).decode("utf-8")
-        grant_digest = hashlib.sha256(grant_json.encode("utf-8")).hexdigest()
-        with self._lock, self._connection() as con:
-            con.execute("BEGIN IMMEDIATE")
-            row = con.execute(
-                "SELECT grant_json,authorization_digest FROM task_admission_grants WHERE envelope_id=?",
-                (envelope_id,),
-            ).fetchone()
-            if row is not None:
-                con.execute("ROLLBACK")
-                if row["authorization_digest"] != authorization_digest:
-                    raise TaskAdmissionError("TASK_ADMISSION_AUTHORIZATION_CONFLICT", 409)
-                raw = json.loads(row["grant_json"])
-                return (
-                    TaskAdmissionGrant(
-                        **{
-                            **raw,
-                            "capabilities": tuple(raw["capabilities"]),
-                            "file_allowlist": tuple(raw["file_allowlist"]),
-                        }
-                    ),
-                    False,
-                )
-            con.execute(
-                "INSERT INTO task_admission_grants(envelope_id,grant_id,grant_digest,grant_json,authorization_digest,created_at) VALUES(?,?,?,?,?,?)",
-                (envelope_id, grant.grant_id, grant_digest, grant_json, authorization_digest, created_at),
-            )
-            con.execute(
-                "UPDATE task_admission_envelopes SET status='ADMITTING' WHERE envelope_id=?",
-                (envelope_id,),
-            )
-            con.execute("COMMIT")
-        return grant, True
-
-    def receipt(self, envelope_id: str) -> dict[str, Any] | None:
-        with self._connection() as con:
-            row = con.execute(
-                "SELECT receipt_json FROM task_admission_receipts WHERE envelope_id=?",
-                (envelope_id,),
-            ).fetchone()
-        return json.loads(row["receipt_json"]) if row else None
-
-    def save_grant_and_receipt(
-        self,
-        *,
-        envelope_id: str,
-        grant: TaskAdmissionGrant,
-        receipt: Mapping[str, Any],
-        created_at: int,
-    ) -> dict[str, Any]:
-        grant_json = canonical_json_bytes(grant.as_dict()).decode("utf-8")
-        grant_digest = hashlib.sha256(grant_json.encode("utf-8")).hexdigest()
-        receipt_json = canonical_json_bytes(dict(receipt)).decode("utf-8")
-        with self._lock, self._connection() as con:
-            con.execute("BEGIN IMMEDIATE")
-            existing = con.execute(
-                "SELECT receipt_json FROM task_admission_receipts WHERE envelope_id=?",
-                (envelope_id,),
-            ).fetchone()
-            if existing is not None:
-                con.execute("ROLLBACK")
-                return json.loads(existing["receipt_json"])
-            stored = con.execute(
-                "SELECT grant_id,grant_digest FROM task_admission_grants WHERE envelope_id=?",
-                (envelope_id,),
-            ).fetchone()
-            if stored is None:
-                con.execute(
-                    "INSERT INTO task_admission_grants(envelope_id,grant_id,grant_digest,grant_json,authorization_digest,created_at) VALUES(?,?,?,?,?,?)",
-                    (envelope_id, grant.grant_id, grant_digest, grant_json, "", created_at),
-                )
-            elif stored["grant_id"] != grant.grant_id or stored["grant_digest"] != grant_digest:
-                con.execute("ROLLBACK")
-                raise TaskAdmissionError("TASK_ADMISSION_GRANT_CONFLICT", 409)
-            con.execute(
-                """
-                INSERT INTO task_admission_receipts(
-                    envelope_id,task_id,receipt_json,created_at
-                ) VALUES(?,?,?,?)
-                """,
-                (
-                    envelope_id,
-                    grant.task_id,
-                    receipt_json,
-                    created_at,
-                ),
-            )
-            con.execute(
-                "UPDATE task_admission_envelopes SET status='ADMITTED' WHERE envelope_id=?",
-                (envelope_id,),
-            )
-            con.execute("COMMIT")
-        return dict(receipt)
-
-    def status(self, envelope_id: str) -> dict[str, Any]:
-        row = self.get_envelope(envelope_id)
-        if row is None:
-            raise TaskAdmissionError("TASK_ADMISSION_ENVELOPE_NOT_FOUND", 404)
-        receipt = self.receipt(envelope_id)
-        return {
-            "envelope_id": envelope_id,
-            "status": row["status"],
-            "task": receipt,
-        }
-
-
-class TaskAdmissionBootstrapService:
-    def __init__(
-        self,
-        *,
-        store: TaskAdmissionStore,
-        authorization: OwnerAuthorizationBackend,
-        task_port: TaskAdmissionPort,
-        policy: TaskAdmissionPolicy | None = None,
-        clock=utc_seconds,
-        post_admission: Callable[[TaskAdmissionGrant, Mapping[str, Any]], Any] | None = None,
-    ) -> None:
-        self.store = store
-        self.authorization = authorization
-        self.task_port = task_port
-        self.policy = policy or TaskAdmissionPolicy()
-        self.clock = clock
-        # This is a narrow server-side projection boundary. The official
-        # Agent Task port remains the admission authority; a projection may
-        # only establish local execution state after its exact Task readback.
-        self.post_admission = post_admission
-        self._admit_lock = threading.RLock()
-
-    def create_envelope(self, raw: Mapping[str, Any]) -> dict[str, Any]:
-        required = {
-            "idempotency_key",
-            "task_id",
-            "repository",
-            "authority_base_oid",
-            "target_branch",
-            "generation",
-            "execution_digest",
-            "requested_capabilities",
-            "file_allowlist",
-            "risk",
-        }
-        optional = {"expires_in_seconds"}
-        if set(raw) - (required | optional) or not required.issubset(raw):
-            raise TaskAdmissionError("TASK_ADMISSION_REQUEST_FIELDS_INVALID")
-        idempotency_key = str(raw["idempotency_key"])
-        task_id = str(raw["task_id"])
-        repository = str(raw["repository"])
-        authority_base_oid = str(raw["authority_base_oid"])
-        target_branch = str(raw["target_branch"])
-        execution_digest = str(raw["execution_digest"])
-        if not IDEMPOTENCY_RE.fullmatch(idempotency_key):
-            raise TaskAdmissionError("TASK_ADMISSION_IDEMPOTENCY_KEY_INVALID")
-        if not TASK_RE.fullmatch(task_id):
-            raise TaskAdmissionError("TASK_ADMISSION_TASK_ID_INVALID")
-        if repository != self.policy.repository:
-            raise TaskAdmissionError("TASK_ADMISSION_REPOSITORY_REJECTED", 403)
-        if not OID_RE.fullmatch(authority_base_oid):
-            raise TaskAdmissionError("TASK_ADMISSION_BASE_OID_INVALID")
-        if (
-            not BRANCH_RE.fullmatch(target_branch)
-            or not target_branch.startswith(self.policy.branch_prefix)
-            or "//" in target_branch
-            or ".." in target_branch
-            or "@{" in target_branch
-            or target_branch.endswith(("/", "."))
-            or any(
-                not component
-                or component.startswith(".")
-                or component.endswith(".lock")
-                for component in target_branch.split("/")
-            )
-        ):
-            raise TaskAdmissionError("TASK_ADMISSION_BRANCH_REJECTED", 403)
-        generation = raw["generation"]
-        if not isinstance(generation, int) or isinstance(generation, bool):
-            raise TaskAdmissionError("TASK_ADMISSION_GENERATION_INVALID")
-        if generation < 1:
-            raise TaskAdmissionError("TASK_ADMISSION_GENERATION_INVALID")
-        if not re.fullmatch(r"^[0-9a-f]{64}$", execution_digest):
-            raise TaskAdmissionError("TASK_ADMISSION_EXECUTION_DIGEST_INVALID")
-        requested_capabilities = _normalize_capabilities(
-            raw["requested_capabilities"],
-            policy=self.policy,
-        )
-        file_allowlist = _normalize_files(
-            raw["file_allowlist"],
-            maximum=self.policy.max_file_count,
-        )
-        risk = str(raw["risk"])
-        if _risk_rank(risk) > _risk_rank(self.policy.max_risk):
-            raise TaskAdmissionError("TASK_ADMISSION_RISK_OUT_OF_POLICY", 403)
-        ttl = raw.get("expires_in_seconds", self.policy.max_envelope_ttl_seconds)
-        if (
-            not isinstance(ttl, int)
-            or isinstance(ttl, bool)
-            or ttl < 60
-            or ttl > self.policy.max_envelope_ttl_seconds
-        ):
-            raise TaskAdmissionError("TASK_ADMISSION_ENVELOPE_TTL_INVALID")
-        now = int(self.clock())
-        policy_digest = self.policy.normalized_policy_digest()
-        request_value = _request_for_digest(
-            task_id=task_id,
-            repository=repository,
-            authority_base_oid=authority_base_oid,
-            target_branch=target_branch,
-            generation=generation,
-            execution_digest=execution_digest,
-            requested_capabilities=requested_capabilities,
-            file_allowlist=file_allowlist,
-            risk=risk,
-            trust_domain=self.policy.trust_domain,
-            policy_digest=policy_digest,
-        )
-        request_digest = sha256_json(request_value)
-        nonce = secrets.token_urlsafe(24)
-        envelope_id = "task-admission-" + hashlib.sha256(
-            (idempotency_key + "\0" + request_digest + "\0" + nonce).encode("utf-8")
-        ).hexdigest()[:32]
-        envelope = TaskAdmissionEnvelope(
-            envelope_id=envelope_id,
-            idempotency_key=idempotency_key,
-            task_id=task_id,
-            repository=repository,
-            authority_base_oid=authority_base_oid,
-            target_branch=target_branch,
-            generation=generation,
-            execution_digest=execution_digest,
-            requested_capabilities=requested_capabilities,
-            file_allowlist=file_allowlist,
-            risk=risk,
-            trust_domain=self.policy.trust_domain,
-            policy_digest=policy_digest,
-            issued_at=now,
-            not_before=now,
-            expires_at=now + ttl,
-            nonce=nonce,
-            request_digest=request_digest,
-        )
-        envelope_dict = envelope.as_dict()
-        persisted = self.store.save_envelope(
-            idempotency_key=idempotency_key,
-            envelope_id=envelope_id,
-            request_digest=request_digest,
-            envelope_json=canonical_json_bytes(envelope_dict).decode("utf-8"),
-            created_at=now,
-        )
-        won = persisted["envelope_id"] == envelope_id
-        return {
-            "schema": SCHEMA_ENVELOPE,
-            "envelope": persisted,
-            "canonical_payload_base64": base64.b64encode(
-                canonical_json_bytes(persisted)
-            ).decode("ascii"),
-            "idempotent": not won,
-        }
-
-    def _load_envelope(self, envelope_id: str) -> TaskAdmissionEnvelope:
-        row = self.store.get_envelope(envelope_id)
-        if row is None:
-            raise TaskAdmissionError("TASK_ADMISSION_ENVELOPE_NOT_FOUND", 404)
-        raw = json.loads(row["envelope_json"])
-        return TaskAdmissionEnvelope(
-            **{
-                **raw,
-                "requested_capabilities": tuple(raw["requested_capabilities"]),
-                "file_allowlist": tuple(raw["file_allowlist"]),
-            }
-        )
-
-    def _verify_epoch(
-        self,
-        *,
-        epoch_id: str,
-        envelope: TaskAdmissionEnvelope,
-        now: int,
-    ) -> OwnerDelegationEpoch:
-        epoch = self.authorization.verify_delegation_epoch(epoch_id)
-        if epoch.schema != SCHEMA_EPOCH:
-            raise TaskAdmissionError("TASK_ADMISSION_EPOCH_SCHEMA_INVALID", 403)
-        if epoch.epoch_id != epoch_id:
-            raise TaskAdmissionError("TASK_ADMISSION_EPOCH_ID_MISMATCH", 403)
-        if (
-            epoch.trust_domain != envelope.trust_domain
-            or epoch.repository != envelope.repository
-            or epoch.policy_digest != envelope.policy_digest
-        ):
-            raise TaskAdmissionError("TASK_ADMISSION_EPOCH_BINDING_MISMATCH", 403)
-        if epoch.revocation_epoch != 0:
-            raise TaskAdmissionError("TASK_ADMISSION_EPOCH_REVOKED", 403)
-        if not epoch.not_before <= now < epoch.expires_at:
-            raise TaskAdmissionError("TASK_ADMISSION_EPOCH_EXPIRED", 403)
-        if not any(
-            envelope.target_branch.startswith(prefix)
-            for prefix in epoch.allowed_branch_prefixes
-        ):
-            raise TaskAdmissionError("TASK_ADMISSION_EPOCH_BRANCH_REJECTED", 403)
-        caps = set(envelope.requested_capabilities)
-        if not caps.issubset(epoch.allowed_capabilities):
-            raise TaskAdmissionError("TASK_ADMISSION_EPOCH_CAPABILITY_WIDENING", 403)
-        if _risk_rank(envelope.risk) > _risk_rank(epoch.risk_ceiling):
-            raise TaskAdmissionError("TASK_ADMISSION_EPOCH_RISK_WIDENING", 403)
-        for path in envelope.file_allowlist:
-            if not any(
-                path == prefix.rstrip("/")
-                or path.startswith(prefix.rstrip("/") + "/")
-                for prefix in epoch.allowed_file_prefixes
-            ):
-                raise TaskAdmissionError("TASK_ADMISSION_EPOCH_FILE_WIDENING", 403)
-        return epoch
-
-    def authorize_and_admit(self, raw: Mapping[str, Any]) -> dict[str, Any]:
-        required = {"envelope_id", "authorization_kind"}
-        allowed = required | {
-            "delegation_epoch_id",
-            "owner_key_id",
-            "signature_base64",
-        }
-        if set(raw) - allowed or not required.issubset(raw):
-            raise TaskAdmissionError("TASK_ADMISSION_AUTH_FIELDS_INVALID")
-        envelope_id = str(raw["envelope_id"])
-        with self.store.admission_lock(envelope_id):
-            # Every replay revalidates policy, temporal bounds, revocation and
-            # proof after the crash-releasing lock is owned.
-            envelope = self._load_envelope(envelope_id)
-            now = int(self.clock())
-            if envelope.policy_digest != self.policy.normalized_policy_digest():
-                raise TaskAdmissionError("TASK_ADMISSION_POLICY_DIGEST_DRIFT", 403)
-            if now < envelope.not_before or now >= envelope.expires_at:
-                raise TaskAdmissionError("TASK_ADMISSION_ENVELOPE_EXPIRED", 403)
-
-            kind = str(raw["authorization_kind"])
-            parent_epoch: OwnerDelegationEpoch | None = None
-            if kind == "delegation_epoch":
-                epoch_id = str(raw.get("delegation_epoch_id") or "")
-                if not epoch_id:
-                    raise TaskAdmissionError("TASK_ADMISSION_EPOCH_REQUIRED")
-                parent_epoch = self._verify_epoch(epoch_id=epoch_id, envelope=envelope, now=now)
-                owner_identity = parent_epoch.owner_identity
-                parent_epoch_id: str | None = parent_epoch.epoch_id
-            elif kind == "owner_signature":
-                key_id = str(raw.get("owner_key_id") or "")
-                signature = str(raw.get("signature_base64") or "")
-                if not KEY_ID_RE.fullmatch(key_id) or not signature:
-                    raise TaskAdmissionError("TASK_ADMISSION_OWNER_SIGNATURE_REQUIRED")
-                owner_identity = self.authorization.verify_owner_signature(
-                    key_id=key_id,
-                    canonical_payload=canonical_json_bytes(envelope.as_dict()),
-                    signature_b64=signature,
-                )
-                if not isinstance(owner_identity, str) or not owner_identity:
-                    raise TaskAdmissionError("TASK_ADMISSION_OWNER_SIGNATURE_INVALID", 403)
-                parent_epoch_id = None
-            else:
-                raise TaskAdmissionError("TASK_ADMISSION_AUTHORIZATION_KIND_REJECTED", 403)
-
-            authorization_digest = sha256_json(dict(raw))
-            grant_id = "task-grant-" + hashlib.sha256(
-                (envelope.envelope_id + "\0" + kind + "\0" + owner_identity + "\0" + (parent_epoch_id or "")).encode("utf-8")
-            ).hexdigest()[:32]
-            grant = TaskAdmissionGrant(
-                grant_id=grant_id, envelope_id=envelope.envelope_id, task_id=envelope.task_id,
-                repository=envelope.repository, authority_base_oid=envelope.authority_base_oid,
-                target_branch=envelope.target_branch, generation=envelope.generation,
-                execution_digest=envelope.execution_digest, capabilities=envelope.requested_capabilities,
-                file_allowlist=envelope.file_allowlist, risk=envelope.risk,
-                trust_domain=envelope.trust_domain, policy_digest=envelope.policy_digest,
-                authorization_kind=kind, owner_identity=owner_identity,
-                parent_epoch_id=parent_epoch_id, issued_at=now,
-                expires_at=min(
-                    envelope.expires_at,
-                    now + self.policy.max_task_ttl_seconds,
-                    parent_epoch.expires_at if parent_epoch is not None else envelope.expires_at,
-                ),
-            )
-            persisted_grant, _ = self.store.claim_grant(
-                envelope_id=envelope_id, grant=grant,
-                authorization_digest=authorization_digest, created_at=now,
-            )
-            if now >= persisted_grant.expires_at:
-                raise TaskAdmissionError("TASK_ADMISSION_GRANT_EXPIRED", 403)
-            if parent_epoch is not None and persisted_grant.expires_at > parent_epoch.expires_at:
-                raise TaskAdmissionError("TASK_ADMISSION_GRANT_PARENT_EXPIRY_CONFLICT", 409)
-            existing_receipt = self.store.receipt(envelope_id)
-            if existing_receipt is not None:
-                return {**existing_receipt, "idempotent": True}
-
-            try:
-                result = self.task_port.admit(persisted_grant)
-            except TaskAdmissionError:
-                raise
-            except Exception as exc:
-                raise TaskAdmissionError("TASK_ADMISSION_TASK_STATE_UNKNOWN", 503) from exc
-            if not isinstance(result, Mapping):
-                raise TaskAdmissionError("TASK_ADMISSION_PORT_RESPONSE_INVALID", 502)
-            state = str(result.get("state") or result.get("status") or "")
-            if str(result.get("task_id") or "") != persisted_grant.task_id:
-                raise TaskAdmissionError("TASK_ADMISSION_PORT_TASK_MISMATCH", 502)
-            if state not in {"QUEUED", "CLAIMED", "RUNNING"}:
-                raise TaskAdmissionError("TASK_ADMISSION_PORT_STATE_INVALID", 502, details={"state": state})
-            if self.post_admission is not None:
-                projection_result: Mapping[str, Any] = result
-                projection_reader = getattr(self.task_port, "projection_result", None)
-                if callable(projection_reader):
-                    try:
-                        candidate = projection_reader(persisted_grant, result)
-                    except TaskAdmissionError:
-                        raise
-                    except Exception as exc:
-                        raise TaskAdmissionError(
-                            "TASK_ADMISSION_EXECUTION_PROJECTION_FAILED", 503
-                        ) from exc
-                    if not isinstance(candidate, Mapping):
-                        raise TaskAdmissionError(
-                            "TASK_ADMISSION_EXECUTION_PROJECTION_INVALID", 503
-                        )
-                    projection_result = candidate
-                try:
-                    projection = self.post_admission(
-                        persisted_grant, projection_result
-                    )
-                except TaskAdmissionError:
-                    raise
-                except Exception as exc:
-                    raise TaskAdmissionError(
-                        "TASK_ADMISSION_EXECUTION_PROJECTION_FAILED", 503
-                    ) from exc
-                if projection is not None and not isinstance(projection, Mapping):
-                    raise TaskAdmissionError(
-                        "TASK_ADMISSION_EXECUTION_PROJECTION_INVALID", 503
-                    )
-            receipt = {
-                "schema": SCHEMA_RECEIPT, "envelope_id": persisted_grant.envelope_id,
-                "grant_id": persisted_grant.grant_id, "task_id": persisted_grant.task_id,
-                "task_state": state, "authorization_kind": persisted_grant.authorization_kind,
-                "owner_identity": persisted_grant.owner_identity, "parent_epoch_id": persisted_grant.parent_epoch_id,
-                "authority_base_oid": persisted_grant.authority_base_oid,
-                "target_branch": persisted_grant.target_branch, "generation": persisted_grant.generation,
-                "execution_digest": persisted_grant.execution_digest,
-                "grant_digest_sha256": sha256_json(persisted_grant.as_dict()),
-                "admitted_at": now, "idempotent": False,
-            }
-            return self.store.save_grant_and_receipt(
-                envelope_id=envelope_id, grant=persisted_grant, receipt=receipt, created_at=now,
-            )
-
-    def status(self, envelope_id: str) -> dict[str, Any]:
-        return self.store.status(envelope_id)

active-runtime/app/aios_task_admission_bridge_contract.py

@@ -1,87 +0,0 @@
-"""Bridge contract surface for Task Admission Bootstrap.
-
-This module is intentionally transport-agnostic. The live Bridge may merge
-these routes/operations into its existing authenticated/HTTPS surface, but the
-authorization proof for the authorize operation is the verified delegation
-epoch or Owner signature carried by the request itself.
-
-No handler here can issue TaskPrincipal assertions or WriterLeases. Those remain
-strictly downstream of a real admitted/claimed Agent Task.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Mapping
-
-from aios_task_admission_bootstrap import TaskAdmissionBootstrapService
-
-
-TASK_ADMISSION_ROUTES = {
-    "/v2/task-admission/envelope": "getTaskAdmissionEnvelope",
-    "/v2/task-admission/authorize": "submitTaskAdmissionAuthorization",
-    "/v2/task-admission/status": "getTaskAdmissionStatus",
-}
-
-TASK_ADMISSION_OPERATION_REQUIRED_FIELDS = {
-    "getTaskAdmissionEnvelope": (
-        "idempotency_key",
-        "task_id",
-        "repository",
-        "authority_base_oid",
-        "target_branch",
-        "generation",
-        "execution_digest",
-        "requested_capabilities",
-        "file_allowlist",
-        "risk",
-    ),
-    "submitTaskAdmissionAuthorization": (
-        "envelope_id",
-        "authorization_kind",
-    ),
-    "getTaskAdmissionStatus": ("envelope_id",),
-}
-
-TASK_ADMISSION_OPERATION_OPTIONAL_FIELDS = {
-    "getTaskAdmissionEnvelope": ("expires_in_seconds",),
-    "submitTaskAdmissionAuthorization": (
-        "delegation_epoch_id",
-        "owner_key_id",
-        "signature_base64",
-    ),
-    "getTaskAdmissionStatus": (),
-}
-
-
-class TaskAdmissionBridgeContract:
-    def __init__(self, service: TaskAdmissionBootstrapService) -> None:
-        self.service = service
-
-    @staticmethod
-    def _validate_fields(operation: str, request: Mapping[str, Any]) -> None:
-        required = set(TASK_ADMISSION_OPERATION_REQUIRED_FIELDS[operation])
-        allowed = required | set(TASK_ADMISSION_OPERATION_OPTIONAL_FIELDS[operation])
-        if not required.issubset(request):
-            raise ValueError("TASK_ADMISSION_BRIDGE_REQUIRED_FIELDS_MISSING")
-        if set(request) - allowed:
-            raise ValueError("TASK_ADMISSION_BRIDGE_UNKNOWN_FIELDS")
-
-    def dispatch(self, operation: str, request: Mapping[str, Any]) -> dict[str, Any]:
-        if operation not in TASK_ADMISSION_OPERATION_REQUIRED_FIELDS:
-            raise ValueError("TASK_ADMISSION_BRIDGE_OPERATION_NOT_FOUND")
-        self._validate_fields(operation, request)
-        if operation == "getTaskAdmissionEnvelope":
-            return self.service.create_envelope(request)
-        if operation == "submitTaskAdmissionAuthorization":
-            return self.service.authorize_and_admit(request)
-        if operation == "getTaskAdmissionStatus":
-            return self.service.status(str(request["envelope_id"]))
-        raise ValueError("TASK_ADMISSION_BRIDGE_OPERATION_NOT_FOUND")
-
-    def handlers(self) -> dict[str, Any]:
-        return {
-            operation: (
-                lambda request, operation=operation: self.dispatch(operation, request)
-            )
-            for operation in TASK_ADMISSION_OPERATION_REQUIRED_FIELDS
-        }

active-runtime/app/aios_task_claim_guard_binding_v2.py

@@ -1,394 +0,0 @@
-"""Append-only ClaimGuard binding for the superseded Single-Host child Task."""
-from __future__ import annotations
-
-from datetime import datetime, timezone
-import hashlib
-import json
-import re
-import sqlite3
-from typing import Any, Callable, Mapping
-
-from aios_task_lineage_supersession_initial_projection import (
-    PROJECTION_RECEIPT_SCHEMA,
-    PROJECTION_TABLE,
-    SOURCE_BUSINESS_EXECUTION_DIGEST,
-)
-
-SOURCE_TASK_ID = "TASK-SINGLEHOST-TRUSTROOT-P0-20260904"
-CHILD_TASK_ID = SOURCE_TASK_ID + "-S1"
-WORKER_ID = "p0-task-principal-v15-20260830"
-REPOSITORY = "aios/aios"
-TARGET_BRANCH = "agent/single-host-trust-root-p0-20260904"
-GENERATION = 1
-EXTERNAL_JOB_ID = "job-4e10f92a6a5742518a9f1d8745c845ab"
-BINDING_SCHEMA = "aios.task-claim-guard-binding.v2"
-RECEIPT_SCHEMA = "aios.task-claim-guard-binding-receipt.v2"
-HEX64 = re.compile(r"^[0-9a-f]{64}$")
-
-
-class ClaimGuardBindingError(RuntimeError):
-    def __init__(self, code: str, http_status: int = 409):
-        super().__init__(code)
-        self.code = code
-        self.http_status = int(http_status)
-
-
-def _fail(code: str, status: int = 409) -> None:
-    raise ClaimGuardBindingError(code, status)
-
-
-def canonical_json(value: Any) -> str:
-    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"), allow_nan=False)
-
-
-def _sha_text(value: str) -> str:
-    return hashlib.sha256(value.encode("utf-8")).hexdigest()
-
-
-def _sha_json(value: Any) -> str:
-    return _sha_text(canonical_json(value))
-
-
-def _now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def _row_dict(row: Any) -> dict[str, Any]:
-    if row is None:
-        return {}
-    if hasattr(row, "keys"):
-        return {str(key): row[key] for key in row.keys()}
-    _fail("TASK_ROW_MAPPING_UNAVAILABLE", 500)
-
-
-def _json(raw: Any, code: str) -> Any:
-    if not isinstance(raw, str):
-        _fail(code)
-    try:
-        return json.loads(raw)
-    except (TypeError, ValueError) as exc:
-        raise ClaimGuardBindingError(code) from exc
-
-
-def _default_policy_factory(value: Mapping[str, Any]):
-    try:
-        from aios_single_host_operational_authority import OperationalPolicy
-    except ImportError as exc:
-        raise ClaimGuardBindingError("OPERATIONAL_POLICY_RUNTIME_UNAVAILABLE", 503) from exc
-    return OperationalPolicy.from_mapping(value)
-
-
-def _policy_value(policy: Any, name: str) -> Any:
-    try:
-        return getattr(policy, name)
-    except AttributeError as exc:
-        raise ClaimGuardBindingError("OPERATIONAL_POLICY_FIELDS_INVALID") from exc
-
-
-def _load_projection_evidence(connection, relation) -> dict[str, Any]:
-    try:
-        row = connection.execute(
-            f"SELECT * FROM {PROJECTION_TABLE} WHERE task_id=? AND source_task_id=? "
-            "AND supersession_ordinal=?",
-            (CHILD_TASK_ID, SOURCE_TASK_ID, 1),
-        ).fetchone()
-    except sqlite3.OperationalError as exc:
-        raise ClaimGuardBindingError(
-            "FORMAL_CHILD_INITIAL_PROJECTION_SCHEMA_UNAVAILABLE", 503
-        ) from exc
-    if row is None:
-        _fail("FORMAL_CHILD_INITIAL_PROJECTION_REQUIRED")
-    value = _row_dict(row)
-    receipt = _json(value.get("receipt_json"), "CHILD_PROJECTION_RECEIPT_INVALID")
-    canonical_digest = value.get("canonical_child_execution_digest")
-    source_digest = value.get("source_business_execution_digest")
-    exact = {
-        "task_id": CHILD_TASK_ID,
-        "source_task_id": SOURCE_TASK_ID,
-        "supersession_ordinal": 1,
-        "source_business_execution_digest": SOURCE_BUSINESS_EXECUTION_DIGEST,
-        "external_job_id": EXTERNAL_JOB_ID,
-        "repository": REPOSITORY,
-        "target_branch": TARGET_BRANCH,
-        "generation": GENERATION,
-        "owner_decision_sha256": relation["owner_decision_sha256"],
-    }
-    if any(value.get(key) != expected for key, expected in exact.items()):
-        _fail("CHILD_PROJECTION_LINEAGE_MISMATCH")
-    if (
-        not isinstance(canonical_digest, str)
-        or HEX64.fullmatch(canonical_digest) is None
-        or canonical_digest == SOURCE_BUSINESS_EXECUTION_DIGEST
-        or source_digest != SOURCE_BUSINESS_EXECUTION_DIGEST
-        or _sha_text(value["receipt_json"]) != value.get("receipt_sha256")
-        or not isinstance(receipt, Mapping)
-        or receipt.get("schema") != PROJECTION_RECEIPT_SCHEMA
-        or receipt.get("canonical_child_execution_digest") != canonical_digest
-        or receipt.get("source_business_execution_digest") != source_digest
-        or receipt.get("owner_supersession_decision_sha256")
-        != relation["owner_decision_sha256"]
-    ):
-        _fail("CHILD_PROJECTION_RECEIPT_MISMATCH")
-    return {
-        **value,
-        "canonical_child_execution_digest": canonical_digest,
-        "source_business_execution_digest": source_digest,
-    }
-
-
-def install_child_binding(
-    connection,
-    *,
-    policy: Mapping[str, Any],
-    runtime_id: str,
-    runtime_observation_digest: str,
-    task_contract_version: str,
-    policy_factory: Callable[[Mapping[str, Any]], Any] = _default_policy_factory,
-    now: str | None = None,
-) -> dict[str, Any]:
-    """Generate and persist the only permitted child binding from current DB state."""
-    if not isinstance(policy, Mapping):
-        _fail("OPERATIONAL_POLICY_INVALID")
-    if not isinstance(runtime_id, str) or not runtime_id or len(runtime_id) > 512:
-        _fail("RUNTIME_ID_INVALID")
-    if not isinstance(runtime_observation_digest, str) or HEX64.fullmatch(runtime_observation_digest) is None:
-        _fail("RUNTIME_OBSERVATION_DIGEST_INVALID")
-    if not isinstance(task_contract_version, str) or not task_contract_version or len(task_contract_version) > 128:
-        _fail("TASK_CONTRACT_VERSION_INVALID")
-    relation = connection.execute(
-        "SELECT * FROM task_lineage_supersessions WHERE source_task_id=? AND supersession_ordinal=1 AND child_task_id=?",
-        (SOURCE_TASK_ID, CHILD_TASK_ID),
-    ).fetchone()
-    if relation is None:
-        _fail("FORMAL_SUPERSESSION_REQUIRED")
-    projection = _load_projection_evidence(connection, relation)
-    canonical_execution_digest = projection["canonical_child_execution_digest"]
-    task_row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (CHILD_TASK_ID,)).fetchone()
-    if task_row is None:
-        _fail("CHILD_TASK_NOT_FOUND", 404)
-    task = _row_dict(task_row)
-    if (
-        task.get("status") != "QUEUED" or int(task.get("revision", -1)) < 2
-        or int(task.get("attempt", -1)) != 0 or task.get("claimed_by") is not None
-        or task.get("lease_token_hash") is not None or task.get("lease_expires_at") is not None
-        or task.get("result_json") is not None or task.get("verification_json") is not None
-    ):
-        _fail("CHILD_PROJECTED_CLAIMABLE_STATE_REQUIRED")
-    event_rows = connection.execute(
-        "SELECT event_type,payload_json FROM events WHERE task_id=? ORDER BY event_id",
-        (CHILD_TASK_ID,),
-    ).fetchall()
-    if [row[0] for row in event_rows] != [
-        "TASK_CREATED",
-        "TASK_INITIAL_EXECUTION_PROJECTION_AUTHORIZED",
-    ]:
-        _fail("CANONICAL_INITIAL_PROJECTION_REQUIRED")
-    projection_event = _json(
-        event_rows[-1][1], "CANONICAL_INITIAL_PROJECTION_EVENT_INVALID"
-    )
-    if (
-        projection_event.get("source_business_execution_digest")
-        != SOURCE_BUSINESS_EXECUTION_DIGEST
-        or projection_event.get("canonical_child_execution_digest")
-        != canonical_execution_digest
-        or projection_event.get("owner_supersession_decision_sha256")
-        != relation["owner_decision_sha256"]
-        or _sha_json(projection_event) != projection["projection_event_sha256"]
-    ):
-        _fail("CANONICAL_INITIAL_PROJECTION_EVENT_MISMATCH")
-    metadata_raw = task.get("metadata_json")
-    capabilities_raw = task.get("required_capabilities_json")
-    metadata = _json(metadata_raw, "CHILD_METADATA_INVALID")
-    capabilities = _json(capabilities_raw, "CHILD_CAPABILITIES_INVALID")
-    if (
-        _sha_text(metadata_raw) != projection["metadata_sha256"]
-        or _sha_text(capabilities_raw)
-        != projection["required_capabilities_sha256"]
-    ):
-        _fail("CHILD_PROJECTION_TASK_DIGEST_MISMATCH")
-    if not isinstance(metadata, Mapping) or not isinstance(capabilities, list) or not capabilities:
-        _fail("CHILD_PROJECTION_INVALID")
-    if any(not isinstance(value, str) or not value for value in capabilities) or len(set(capabilities)) != len(capabilities):
-        _fail("CHILD_CAPABILITIES_INVALID")
-    execution = metadata.get("execution")
-    if not isinstance(execution, Mapping):
-        _fail("CHILD_EXECUTION_PROJECTION_MISSING")
-    exact_execution = {
-        "task_id": CHILD_TASK_ID, "repository": REPOSITORY,
-        "target_branch": TARGET_BRANCH, "generation": GENERATION,
-        "execution_digest": canonical_execution_digest, "job_id": EXTERNAL_JOB_ID,
-    }
-    if any(execution.get(key) != value for key, value in exact_execution.items()):
-        _fail("CHILD_EXECUTION_BINDING_MISMATCH")
-    parsed_policy = policy_factory(dict(policy))
-    if hasattr(parsed_policy, "validate"):
-        parsed_policy.validate()
-    policy_exact = {
-        "task_id": CHILD_TASK_ID, "repository": REPOSITORY,
-        "target_branch": TARGET_BRANCH, "generation": GENERATION,
-        "execution_plan_sha256": canonical_execution_digest,
-        "external_job_identity": EXTERNAL_JOB_ID,
-    }
-    if any(_policy_value(parsed_policy, key) != value for key, value in policy_exact.items()):
-        _fail("OPERATIONAL_POLICY_SCOPE_MISMATCH")
-    if tuple(_policy_value(parsed_policy, "allowed_worker_ids")) != (WORKER_ID,):
-        _fail("OPERATIONAL_POLICY_WORKER_MISMATCH")
-    expected_oid = execution.get("expected_branch_oid", execution.get("base_oid"))
-    if expected_oid is not None and _policy_value(parsed_policy, "base_oid") != expected_oid:
-        _fail("OPERATIONAL_POLICY_BASE_OID_MISMATCH")
-    policy_json = canonical_json(dict(policy))
-    policy_sha = _sha_text(policy_json)
-    policy_digest = str(_policy_value(parsed_policy, "digest"))
-    if policy_digest != policy_sha:
-        _fail("OPERATIONAL_POLICY_DIGEST_MISMATCH")
-    binding = {
-        "schema": BINDING_SCHEMA, "task_id": CHILD_TASK_ID,
-        "source_task_id": SOURCE_TASK_ID, "supersession_ordinal": 1,
-        "expected_revision": int(task["revision"]),
-        "metadata_sha256": _sha_text(metadata_raw),
-        "required_capabilities_sha256": _sha_json(sorted(capabilities)),
-        "worker_id": WORKER_ID,
-        "execution_digest": canonical_execution_digest,
-        "canonical_child_execution_digest": canonical_execution_digest,
-        "source_business_execution_digest": SOURCE_BUSINESS_EXECUTION_DIGEST,
-        "repository": REPOSITORY, "target_branch": TARGET_BRANCH, "generation": GENERATION,
-        "external_job_id": EXTERNAL_JOB_ID, "policy_sha256": policy_sha,
-        "policy_digest": policy_digest, "runtime_id": runtime_id,
-        "runtime_observation_digest": runtime_observation_digest,
-        "task_contract_version": task_contract_version,
-        "owner_supersession_decision_sha256": relation["owner_decision_sha256"],
-    }
-    binding_json = canonical_json(binding)
-    binding_sha = _sha_text(binding_json)
-    binding_id = "sha256:" + binding_sha
-    existing = connection.execute(
-        "SELECT binding_sha256 FROM task_claim_guard_bindings_v2 WHERE task_id=?", (CHILD_TASK_ID,)
-    ).fetchone()
-    if existing is not None:
-        if existing[0] != binding_sha:
-            _fail("CLAIM_GUARD_BINDING_ALREADY_EXISTS")
-        receipt = connection.execute(
-            "SELECT receipt_json FROM task_claim_guard_binding_receipts_v2 WHERE binding_id=?", (binding_id,)
-        ).fetchone()
-        if receipt is None:
-            _fail("CLAIM_GUARD_BINDING_RECEIPT_MISSING", 500)
-        return {**json.loads(receipt[0]), "idempotent": True}
-    created_at = now or _now()
-    connection.execute(
-        """INSERT INTO task_claim_guard_bindings_v2(
-        binding_id,task_id,source_task_id,supersession_ordinal,expected_revision,
-        metadata_sha256,required_capabilities_sha256,worker_id,execution_digest,
-        repository,target_branch,generation,policy_json,policy_sha256,binding_json,
-        binding_sha256,created_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)""",
-        (binding_id, CHILD_TASK_ID, SOURCE_TASK_ID, 1, binding["expected_revision"],
-         binding["metadata_sha256"], binding["required_capabilities_sha256"], WORKER_ID,
-         canonical_execution_digest, REPOSITORY, TARGET_BRANCH, GENERATION, policy_json, policy_sha,
-         binding_json, binding_sha, created_at),
-    )
-    receipt = {
-        "schema": RECEIPT_SCHEMA, "status": "BOUND", "binding_id": binding_id,
-        "binding_sha256": binding_sha, "task_id": CHILD_TASK_ID,
-        "expected_revision": binding["expected_revision"],
-        "metadata_sha256": binding["metadata_sha256"], "worker_id": WORKER_ID,
-        "execution_digest": canonical_execution_digest,
-        "canonical_child_execution_digest": canonical_execution_digest,
-        "source_business_execution_digest": SOURCE_BUSINESS_EXECUTION_DIGEST,
-        "repository": REPOSITORY,
-        "target_branch": TARGET_BRANCH, "generation": GENERATION,
-        "owner_supersession_decision_sha256": relation["owner_decision_sha256"],
-    }
-    receipt_sha = _sha_json(receipt)
-    receipt_id = "sha256:" + receipt_sha
-    connection.execute(
-        "INSERT INTO task_claim_guard_binding_receipts_v2 VALUES(?,?,?,?,?,?)",
-        (receipt_id, binding_id, CHILD_TASK_ID, canonical_json(receipt), receipt_sha, created_at),
-    )
-    return {**receipt, "receipt_id": receipt_id, "receipt_sha256": receipt_sha, "idempotent": False}
-
-
-def _load_child_binding(connection) -> tuple[dict[str, Any], dict[str, Any]]:
-    row = connection.execute(
-        "SELECT * FROM task_claim_guard_bindings_v2 WHERE task_id=?", (CHILD_TASK_ID,)
-    ).fetchone()
-    if row is None:
-        _fail("CHILD_CLAIM_GUARD_BINDING_MISSING")
-    value = _row_dict(row)
-    binding = _json(value["binding_json"], "CLAIM_GUARD_BINDING_INVALID")
-    policy = _json(value["policy_json"], "OPERATIONAL_POLICY_INVALID")
-    relation = connection.execute(
-        "SELECT * FROM task_lineage_supersessions WHERE source_task_id=? "
-        "AND supersession_ordinal=1 AND child_task_id=?",
-        (SOURCE_TASK_ID, CHILD_TASK_ID),
-    ).fetchone()
-    if relation is None:
-        _fail("FORMAL_SUPERSESSION_REQUIRED")
-    projection = _load_projection_evidence(connection, relation)
-    canonical_execution_digest = projection["canonical_child_execution_digest"]
-    if (
-        _sha_text(value["binding_json"]) != value["binding_sha256"]
-        or binding.get("schema") != BINDING_SCHEMA
-        or value.get("execution_digest") != canonical_execution_digest
-        or binding.get("execution_digest") != canonical_execution_digest
-        or binding.get("canonical_child_execution_digest")
-        != canonical_execution_digest
-        or binding.get("source_business_execution_digest")
-        != SOURCE_BUSINESS_EXECUTION_DIGEST
-        or binding.get("owner_supersession_decision_sha256")
-        != relation["owner_decision_sha256"]
-        or policy.get("execution_plan_sha256") != canonical_execution_digest
-    ):
-        _fail("CLAIM_GUARD_BINDING_DIGEST_MISMATCH")
-    task = connection.execute("SELECT * FROM tasks WHERE task_id=?", (CHILD_TASK_ID,)).fetchone()
-    task = _row_dict(task)
-    if (
-        task.get("status") != "QUEUED" or int(task.get("revision", -1)) != int(binding["expected_revision"])
-        or int(task.get("attempt", -1)) != 0 or task.get("claimed_by") is not None
-        or task.get("lease_token_hash") is not None or task.get("lease_expires_at") is not None
-        or _sha_text(task.get("metadata_json", "")) != binding["metadata_sha256"]
-        or task.get("result_json") is not None or task.get("verification_json") is not None
-    ):
-        _fail("CHILD_CLAIM_GUARD_TASK_CAS_MISMATCH")
-    return binding, policy
-
-
-def _run_child_guard(connection, binding, policy_value, agent_id):
-    try:
-        from aios_single_host_operational_authority import OperationalPolicy, OperationalVerifier
-        from aios_singlehost_claim_guard_stage1 import _LiveReader, REGISTRY_PATH
-        from aios_task_claim_guard import ClaimGuard, ClaimGuardError as CoreError
-    except ImportError as exc:
-        raise ClaimGuardBindingError("CLAIM_GUARD_RUNTIME_UNAVAILABLE", 503) from exc
-    policy = OperationalPolicy.from_mapping(policy_value)
-    cfg = {
-        "task_id": CHILD_TASK_ID, "expected_claim_revision": binding["expected_revision"],
-        "task_metadata_sha256": binding["metadata_sha256"],
-        "required_capabilities_sha256": binding["required_capabilities_sha256"],
-        "task_contract_version": binding["task_contract_version"], "worker_id": WORKER_ID,
-        "policy_digest": binding["policy_digest"], "runtime_id": binding["runtime_id"],
-        "runtime_observation_digest": binding["runtime_observation_digest"],
-    }
-    reader = _LiveReader(connection, policy, cfg, now=int(datetime.now(timezone.utc).timestamp()))
-    try:
-        ClaimGuard(policy, OperationalVerifier(REGISTRY_PATH, require_root_owner=True)).validate_in_transaction(
-            reader, task_id=CHILD_TASK_ID,
-            expected_revision=int(binding["expected_revision"]), worker_id=agent_id,
-        )
-    except CoreError as exc:
-        raise ClaimGuardBindingError(exc.code) from exc
-
-
-def enforce_claim_guard(connection, *, task_id: str, agent_id: str) -> None:
-    """Exact two-lineage dispatcher; unrelated Tasks retain their prior behavior."""
-    if task_id == SOURCE_TASK_ID:
-        try:
-            from aios_singlehost_claim_guard_stage1 import enforce_claim_guard as frozen_guard
-        except ImportError as exc:
-            raise ClaimGuardBindingError("FROZEN_SOURCE_CLAIM_GUARD_UNAVAILABLE", 503) from exc
-        frozen_guard(connection, task_id=task_id, agent_id=agent_id)
-        return
-    if task_id != CHILD_TASK_ID:
-        return
-    if agent_id != WORKER_ID:
-        _fail("WORKER_ID_MISMATCH", 403)
-    binding, policy = _load_child_binding(connection)
-    _run_child_guard(connection, binding, policy, agent_id)

active-runtime/app/aios_task_deterministic_execution_amendment.py

@@ -1,148 +0,0 @@
-"""Fail-closed signed deterministic execution amendment for R7."""
-from datetime import datetime, timezone
-import hashlib, json, sqlite3
-from pathlib import Path
-from typing import Mapping
-from aios_task_terminal_recovery import DeterministicPlan, RecoveryError, canonical_json
-
-AMENDMENT_SCHEMA="aios.deterministic-execution-amendment.v1"
-APPLY_SCHEMA="aios.deterministic-execution-amendment-apply.v1"
-NAMESPACE="aios-owner-approval-v1"
-EVENT="TASK_RECOVERY_EXECUTION_AMENDMENT_APPLIED"
-APPLY_STATES=frozenset({"FAILED", "QUEUED"})
-
-
-def _err(code): raise RecoveryError(code)
-def _sha(v): return hashlib.sha256(canonical_json(v).encode()).hexdigest()
-def amendment_body(x):
-    return {k:v for k,v in x.items() if k not in {"signature","amendment_id"}}
-def amendment_id(x): return "sha256:"+_sha(amendment_body(x))
-def signed_payload(x):
-    return canonical_json({"amendment_id":x["amendment_id"],**amendment_body(x)}).encode()
-
-
-def parse_amendment(raw):
-    x=dict(raw)
-    required={"schema","amendment_id","nonce","task_id","job_id","generation",
-      "repository","branch","expected_branch_oid","recovery_epoch","decision_id",
-      "plan_id","plan_sha256","expected_apply_status","expected_apply_revision",
-      "expected_apply_attempt","expected_current_capabilities","envelope",
-      "owner_identity","key_id","issued_at","not_before","expires_at",
-      "one_time_use","signature"}
-    if set(x)<required or x.get("schema")!=AMENDMENT_SCHEMA: _err("AMENDMENT_SCHEMA_INVALID")
-    if x["expected_apply_status"] not in APPLY_STATES: _err("AMENDMENT_APPLY_STATUS_INVALID")
-    if x.get("one_time_use") is not True: _err("AMENDMENT_ONE_TIME_REQUIRED")
-    if not isinstance(x["envelope"],Mapping): _err("AMENDMENT_ENVELOPE_INVALID")
-    if not isinstance(x["expected_current_capabilities"],list): _err("AMENDMENT_CAPABILITIES_INVALID")
-    for k in ("generation","expected_apply_revision","expected_apply_attempt"):
-        if isinstance(x[k],bool) or not isinstance(x[k],int) or x[k]<0: _err("AMENDMENT_CAS_INVALID")
-    for k in ("issued_at","not_before","expires_at"):
-        try:d=datetime.fromisoformat(str(x[k]).replace("Z","+00:00"))
-        except ValueError as e: raise RecoveryError("AMENDMENT_TIME_INVALID") from e
-        if d.tzinfo is None:_err("AMENDMENT_TIME_INVALID")
-        x[k]=d.astimezone(timezone.utc).isoformat().replace("+00:00","Z")
-    x["expected_current_capabilities"]=sorted(set(x["expected_current_capabilities"]))
-    x["envelope"]=dict(x["envelope"])
-    return x
-
-
-def _validate_envelope(env,plan,x):
-    try:
-        from aios_online_agent_execution import GovernedExecutionBinding,validate_execution_envelope
-        binding=GovernedExecutionBinding.from_mapping(env)
-        e=dict(validate_execution_envelope(env,binding=binding,worker_capabilities=plan.required_capabilities))
-    except Exception as z: raise RecoveryError("AMENDMENT_EXECUTION_ENVELOPE_INVALID") from z
-    if e.get("action")!="deterministic" or e.get("adapter")!="deterministic":_err("AMENDMENT_EXECUTION_ACTION_INVALID")
-    if tuple(sorted(e.get("capability_scope") or ()))!=plan.required_capabilities:_err("AMENDMENT_EXECUTION_CAPABILITIES_MISMATCH")
-    if not e.get("change_set") or not e.get("verification"):_err("AMENDMENT_EXECUTION_OPERATIONS_REQUIRED")
-    if e.get("runtime_input") not in (None,{}) or e.get("source_signals") not in (None,[]):_err("AMENDMENT_STALE_RUNTIME_FIELDS_FORBIDDEN")
-    for k,w in (("task_id",x["task_id"]),("job_id",x["job_id"]),("repository",x["repository"]),
-      ("generation",x["generation"]),("target_branch",x["branch"]),
-      ("expected_branch_oid",x["expected_branch_oid"]),("base_oid",x["expected_branch_oid"]),
-      ("plan_id",x["plan_id"]),("plan_sha256",x["plan_sha256"]),("recovery_epoch",x["recovery_epoch"])):
-        if e.get(k)!=w:_err("AMENDMENT_EXECUTION_BINDING_MISMATCH")
-    g=e.get("governance") or {}
-    if g.get("writer_lease") is not True:_err("AMENDMENT_WRITER_LEASE_REQUIRED")
-    if any(g.get(k,False) for k in ("main_write","production_write","tag_write","baseline_write","force_push","protected_ref_bypass")):_err("AMENDMENT_PROTECTED_WRITE_FORBIDDEN")
-    return e
-
-
-class DeterministicExecutionAmendmentController:
-    def __init__(self,db_path,verifier,*,clock=None,envelope_validator=None):
-        self.db_path=Path(db_path); self.verifier=verifier
-        self.clock=clock or (lambda:datetime.now(timezone.utc)); self._init()
-
-    def _db(self):
-        c=sqlite3.connect(self.db_path,timeout=10,isolation_level=None); c.row_factory=sqlite3.Row
-        c.execute("PRAGMA busy_timeout=10000"); return c
-
-    def _now(self): return self.clock().astimezone(timezone.utc).isoformat().replace("+00:00","Z")
-
-    def _init(self):
-        with self._db() as c:
-            c.execute("DROP TRIGGER IF EXISTS aios_r7_recovery_capability_projection")
-            c.executescript("""
-CREATE TABLE IF NOT EXISTS deterministic_execution_amendments(
- amendment_id TEXT PRIMARY KEY,nonce TEXT UNIQUE NOT NULL,task_id TEXT NOT NULL,
- decision_id TEXT NOT NULL,plan_id TEXT NOT NULL,plan_sha256 TEXT NOT NULL,
- envelope_digest TEXT NOT NULL,envelope_json TEXT NOT NULL,payload_json TEXT NOT NULL,
- created_at TEXT NOT NULL,UNIQUE(task_id,decision_id));
-DROP TRIGGER IF EXISTS aios_r7_recovery_requires_executable_amendment;
-CREATE TRIGGER aios_r7_recovery_requires_executable_amendment
-BEFORE UPDATE OF status ON tasks
-WHEN OLD.status='FAILED' AND NEW.status='QUEUED' BEGIN
- SELECT CASE WHEN NOT EXISTS(
-  SELECT 1 FROM deterministic_execution_amendments a
-  WHERE a.task_id=OLD.task_id
-   AND a.decision_id=json_extract(NEW.metadata_json,'$.recovery.decision_id')
-   AND a.amendment_id=json_extract(OLD.metadata_json,'$.recovery.execution_amendment_id')
-   AND a.envelope_digest=json_extract(OLD.metadata_json,'$.execution.execution_digest')
- ) THEN RAISE(ABORT,'SIGNED_EXECUTION_AMENDMENT_REQUIRED') END;
-END;""")
-
-    def _plan(self,c,x):
-        r=c.execute("SELECT * FROM deterministic_plans WHERE plan_id=?",(x["plan_id"],)).fetchone()
-        if r is None or r["plan_sha256"]!=x["plan_sha256"]:_err("AMENDMENT_PLAN_NOT_FOUND_OR_MISMATCH")
-        p=DeterministicPlan.from_dict(json.loads(r["payload_json"]))
-        if (p.task_id,p.job_id,p.generation,p.repository,p.branch,p.expected_branch_oid,p.recovery_epoch)!=(x["task_id"],x["job_id"],x["generation"],x["repository"],x["branch"],x["expected_branch_oid"],x["recovery_epoch"]):_err("AMENDMENT_PLAN_BINDING_MISMATCH")
-        return p
-
-    def persist(self,raw):
-        x=parse_amendment(raw)
-        if x["amendment_id"]!=amendment_id(x):_err("AMENDMENT_ID_DIGEST_MISMATCH")
-        now=self._now()
-        if now<x["not_before"] or now>=x["expires_at"]:_err("AMENDMENT_EXPIRED_OR_NOT_YET_VALID")
-        if not self.verifier.verify(namespace=NAMESPACE,payload=signed_payload(x),signature=x["signature"],key_id=x["key_id"]):_err("AMENDMENT_SIGNATURE_INVALID")
-        with self._db() as c:
-            c.execute("BEGIN IMMEDIATE"); e=_validate_envelope(x["envelope"],self._plan(c,x),x)
-            ej=canonical_json(e); ed=e["execution_digest"]; stored=dict(x); stored["signature"]="<present>"
-            old=c.execute("SELECT * FROM deterministic_execution_amendments WHERE amendment_id=?",(x["amendment_id"],)).fetchone()
-            if old:
-                if old["envelope_json"]!=ej:_err("AMENDMENT_ID_REUSE_MISMATCH")
-                c.commit(); return {"status":"PRESENT","amendment_id":x["amendment_id"],"task_id":x["task_id"],"decision_id":x["decision_id"],"plan_id":x["plan_id"],"execution_digest":ed}
-            if c.execute("SELECT 1 FROM deterministic_execution_amendments WHERE nonce=? OR (task_id=? AND decision_id=?)",(x["nonce"],x["task_id"],x["decision_id"])).fetchone():_err("AMENDMENT_REPLAY_OR_DECISION_REUSE")
-            c.execute("INSERT INTO deterministic_execution_amendments VALUES(?,?,?,?,?,?,?,?,?,?)",(x["amendment_id"],x["nonce"],x["task_id"],x["decision_id"],x["plan_id"],x["plan_sha256"],ed,ej,canonical_json(stored),now)); c.commit()
-        return {"status":"PERSISTED","amendment_id":x["amendment_id"],"task_id":x["task_id"],"decision_id":x["decision_id"],"plan_id":x["plan_id"],"execution_digest":ed}
-
-    def apply(self,raw):
-        if raw.get("schema")!=APPLY_SCHEMA:_err("AMENDMENT_APPLY_SCHEMA_INVALID")
-        aid=raw.get("amendment_id"); tid=raw.get("task_id")
-        with self._db() as c:
-            c.execute("BEGIN IMMEDIATE"); a=c.execute("SELECT * FROM deterministic_execution_amendments WHERE amendment_id=? AND task_id=?",(aid,tid)).fetchone()
-            if a is None:_err("AMENDMENT_NOT_FOUND")
-            x=json.loads(a["payload_json"]); d=json.loads(a["envelope_json"])
-            t=c.execute("SELECT * FROM tasks WHERE task_id=?",(tid,)).fetchone()
-            if t is None:_err("TASK_NOT_FOUND")
-            m=json.loads(t["metadata_json"] or "{}"); cp=tuple(sorted(json.loads(t["required_capabilities_json"] or "[]"))); dc=tuple(sorted(d.get("capability_scope") or ()))
-            rec=m.get("recovery"); rec=dict(rec) if isinstance(rec,Mapping) else {}
-            old=m.get("execution")
-            if isinstance(old,Mapping) and old.get("execution_digest")==a["envelope_digest"] and cp==dc and rec.get("execution_amendment_id")==aid:
-                c.commit(); return {"status":"PRESENT","task_id":tid,"amendment_id":aid,"execution_digest":a["envelope_digest"],"revision":int(t["revision"]),"attempt":int(t["attempt"])}
-            if t["status"]!=x["expected_apply_status"] or int(t["revision"])!=x["expected_apply_revision"] or int(t["attempt"])!=x["expected_apply_attempt"] or cp!=tuple(x["expected_current_capabilities"]) or t["claimed_by"] is not None or t["lease_token_hash"] is not None:_err("AMENDMENT_APPLY_TASK_CAS_MISMATCH")
-            if t["status"]=="QUEUED" and rec.get("decision_id")!=x["decision_id"]:_err("AMENDMENT_DECISION_BINDING_MISMATCH")
-            m["execution"]=d; m["execution_projection"]={"schema":"aios.online-agent.task-projection.v1","task_id":tid,"job_id":d.get("job_id"),"execution_digest":a["envelope_digest"]}
-            rec["execution_amendment_id"]=aid; m["recovery"]=rec; now=self._now()
-            q=c.execute("""UPDATE tasks SET required_capabilities_json=?,metadata_json=?,revision=revision+1,updated_at=? WHERE task_id=? AND status=? AND revision=? AND attempt=? AND claimed_by IS NULL AND lease_token_hash IS NULL""",(canonical_json(list(dc)),canonical_json(m),now,tid,x["expected_apply_status"],x["expected_apply_revision"],x["expected_apply_attempt"]))
-            if q.rowcount!=1:_err("AMENDMENT_APPLY_TASK_CAS_FAILED")
-            c.execute("INSERT INTO events(task_id,agent_id,event_type,payload_json,created_at) VALUES(?,?,?,?,?)",(tid,None,EVENT,canonical_json({"amendment_id":aid,"decision_id":x["decision_id"],"plan_id":x["plan_id"],"execution_digest":a["envelope_digest"],"required_capabilities":list(dc)}),now)); c.commit()
-        return {"status":"APPLIED","task_id":tid,"amendment_id":aid,"decision_id":x["decision_id"],"plan_id":x["plan_id"],"execution_digest":a["envelope_digest"],"required_capabilities":list(dc),"revision":x["expected_apply_revision"]+1,"attempt":x["expected_apply_attempt"]}

active-runtime/app/aios_task_identity_overlay_api.py

@@ -1,160 +0,0 @@
-#!/usr/bin/env python3
-"""Loopback-only HTTP API for the task identity overlay.
-
-Endpoints:
-  GET  /healthz
-  POST /api/governance/owner-authorizations
-
-The API authenticates only the short-lived overlay credential. It does not read
-or modify the global bearer-token registry.
-"""
-from __future__ import annotations
-
-import json
-import os
-import urllib.parse
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from typing import Any
-
-from authorized_task_writer_provisioning import ProvisioningError
-from owner_authorization_broker import OwnerAuthorizationError
-from task_identity_overlay import (
-    MAX_BODY_BYTES,
-    IdentityOverlayConfig,
-    IdentityOverlayError,
-    TaskIdentityOverlayService,
-)
-
-
-_ENDPOINT = "/api/governance/owner-authorizations"
-
-
-def _enabled() -> bool:
-    return os.getenv(
-        "AIOS_GITOPS_IDENTITY_OVERLAY_ENABLED", ""
-    ).strip().lower() in {"1", "true", "yes", "on"}
-
-
-def _bearer(header: str) -> str:
-    prefix = "Bearer "
-    if not header.startswith(prefix):
-        raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
-    token = header[len(prefix):].strip()
-    if not token or len(token) > 4096:
-        raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
-    return token
-
-
-class OverlayHandler(BaseHTTPRequestHandler):
-    server_version = "aios-task-identity-overlay/1"
-    sys_version = ""
-
-    @property
-    def overlay(self) -> TaskIdentityOverlayService:
-        return self.server.overlay  # type: ignore[attr-defined]
-
-    def log_message(self, format: str, *args: Any) -> None:
-        # Never log Authorization or request bodies.
-        return
-
-    def _send(self, status: int, value: dict[str, Any]) -> None:
-        payload = (
-            json.dumps(
-                value,
-                ensure_ascii=False,
-                sort_keys=True,
-                separators=(",", ":"),
-            )
-            + "\n"
-        ).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("Content-Length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def _body(self) -> dict[str, Any]:
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-        except ValueError:
-            raise IdentityOverlayError("OVERLAY_CONTENT_LENGTH_INVALID") from None
-        if length <= 0 or length > MAX_BODY_BYTES:
-            raise IdentityOverlayError("OVERLAY_BODY_SIZE_REJECTED", 413)
-        raw = self.rfile.read(length)
-        try:
-            value = json.loads(raw)
-        except (UnicodeDecodeError, json.JSONDecodeError):
-            raise IdentityOverlayError("OVERLAY_BODY_JSON_INVALID") from None
-        if not isinstance(value, dict):
-            raise IdentityOverlayError("OVERLAY_BODY_OBJECT_REQUIRED")
-        return value
-
-    def do_GET(self) -> None:
-        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-        if path != "/healthz":
-            self._send(404, {"error": "NOT_FOUND"})
-            return
-        self._send(
-            200,
-            {
-                "service": "aios-task-identity-overlay",
-                "status": "active" if _enabled() else "disabled",
-                "global_token_registry_used": False,
-                "loopback_only": True,
-            },
-        )
-
-    def do_POST(self) -> None:
-        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-        if path != _ENDPOINT:
-            self._send(404, {"error": "NOT_FOUND"})
-            return
-        if not _enabled():
-            self._send(503, {"error": "IDENTITY_OVERLAY_DISABLED"})
-            return
-        try:
-            token = _bearer(self.headers.get("Authorization", ""))
-            result = self.overlay.provision(self._body(), token)
-            self._send(200, result)
-        except (IdentityOverlayError, OwnerAuthorizationError, ProvisioningError) as exc:
-            body: dict[str, Any] = {"error": exc.code}
-            if getattr(exc, "details", None):
-                body["details"] = exc.details
-            self._send(exc.status, body)
-        except Exception:
-            self._send(500, {"error": "IDENTITY_OVERLAY_API_INTERNAL_ERROR"})
-
-
-class OverlayServer(ThreadingHTTPServer):
-    allow_reuse_address = True
-
-    def __init__(
-        self,
-        address: tuple[str, int],
-        overlay: TaskIdentityOverlayService,
-    ) -> None:
-        super().__init__(address, OverlayHandler)
-        self.overlay = overlay
-
-
-def main() -> None:
-    host = os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_HOST", "127.0.0.1")
-    if host not in {"127.0.0.1", "::1", "localhost"}:
-        raise SystemExit("identity overlay must listen on loopback")
-    try:
-        port = int(os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_PORT", "19864"))
-    except ValueError:
-        raise SystemExit("invalid overlay port") from None
-    if not 1024 <= port <= 65535:
-        raise SystemExit("invalid overlay port")
-    config = IdentityOverlayConfig.from_environment()
-    server = OverlayServer(
-        (host, port),
-        TaskIdentityOverlayService(config),
-    )
-    server.serve_forever(poll_interval=0.25)
-
-
-if __name__ == "__main__":
-    main()

active-runtime/app/aios_task_identity_overlay_cli.py

@@ -1,92 +0,0 @@
-#!/usr/bin/env python3
-"""Root-governed CLI for issuing and revoking task identity overlays.
-
-The CLI never prints the bearer token. It returns only the root-owned secret
-reference and non-secret metadata.
-"""
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import sys
-from pathlib import Path
-
-from task_identity_overlay import (
-    IdentityOverlayConfig,
-    IdentityOverlayError,
-    TaskIdentityOverlayStore,
-)
-
-
-def _write_result(path: str, value: dict) -> None:
-    data = json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n"
-    if path == "-":
-        sys.stdout.write(data)
-        return
-    target = Path(path)
-    target.parent.mkdir(parents=True, exist_ok=True)
-    target.write_text(data, encoding="utf-8")
-    os.chmod(target, 0o600)
-
-
-def parser() -> argparse.ArgumentParser:
-    value = argparse.ArgumentParser(
-        description="Issue/status/revoke a task-scoped identity overlay"
-    )
-    sub = value.add_subparsers(dest="command", required=True)
-
-    issue = sub.add_parser("issue")
-    issue.add_argument("--ttl-seconds", type=int, default=900)
-    issue.add_argument("--authorization-assertion-ref", required=True)
-    issue.add_argument(
-        "--operator-identity",
-        default=os.getenv("SUDO_USER") or os.getenv("USER") or "root",
-    )
-    issue.add_argument("--result-json", default="-")
-
-    status = sub.add_parser("status")
-    status.add_argument("--overlay-id", required=True)
-    status.add_argument("--result-json", default="-")
-
-    revoke = sub.add_parser("revoke")
-    revoke.add_argument("--overlay-id", required=True)
-    revoke.add_argument("--reason", required=True)
-    revoke.add_argument("--result-json", default="-")
-    return value
-
-
-def main() -> int:
-    args = parser().parse_args()
-    try:
-        store = TaskIdentityOverlayStore(
-            IdentityOverlayConfig.from_environment()
-        )
-        if args.command == "issue":
-            result = store.issue(
-                ttl_seconds=args.ttl_seconds,
-                authorization_assertion_ref=args.authorization_assertion_ref,
-                operator_identity=args.operator_identity,
-            )
-        elif args.command == "status":
-            result = store.status(args.overlay_id)
-        else:
-            result = store.revoke(args.overlay_id, reason=args.reason)
-        _write_result(args.result_json, result)
-        return 0
-    except IdentityOverlayError as exc:
-        body = {"status": "BLOCKED", "error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        _write_result(getattr(args, "result_json", "-"), body)
-        return 2
-    except Exception:
-        _write_result(
-            getattr(args, "result_json", "-"),
-            {"status": "FAILED", "error": "IDENTITY_OVERLAY_CLI_INTERNAL_ERROR"},
-        )
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

active-runtime/app/aios_task_lineage_supersession.py

@@ -1,339 +0,0 @@
-"""One-time, Owner-signed, append-only supersession for one exact Task lineage."""
-from __future__ import annotations
-
-from contextlib import closing
-from datetime import datetime, timedelta, timezone
-import hashlib
-import json
-from pathlib import Path
-import re
-import sqlite3
-from typing import Any, Callable, Mapping, Protocol
-
-DECISION_SCHEMA = "aios.task-lineage-supersession-decision.v1"
-RECEIPT_SCHEMA = "aios.task-lineage-supersession-receipt.v1"
-OWNER_NAMESPACE = "aios-owner-approval-v1"
-OWNER_PRINCIPAL = "aios-task-grant-signer"
-OWNER_KEY_ID = "SHA256:rPqpxfPHtaZPM3zSWojX8Q7VxzCknsYqOokyo/aAM3A"
-SOURCE_TASK_ID = "TASK-SINGLEHOST-TRUSTROOT-P0-20260904"
-CHILD_TASK_ID = SOURCE_TASK_ID + "-S1"
-REPOSITORY = "aios/aios"
-TARGET_BRANCH = "agent/single-host-trust-root-p0-20260904"
-GENERATION = 1
-EXECUTION_DIGEST = "e99bda6a251832eb3865271eb5687af7eea44dd261144cdcdfa57104c0780536"
-EXTERNAL_JOB_ID = "job-4e10f92a6a5742518a9f1d8745c845ab"
-SUPERSESSION_ORDINAL = 1
-CANONICAL_PROFILE = "aios.task-initial-execution.v1"
-CANONICAL_PROFILE_VERSION = 1
-SUPERSESSION_REASON = "formal-lineage-supersession-after-expired-unclaimed-source"
-MAX_TTL = timedelta(minutes=5)
-HEX64 = re.compile(r"^[0-9a-f]{64}$")
-SAFE_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:@/+:-]{2,511}$")
-
-
-class TaskLineageSupersessionError(RuntimeError):
-    def __init__(self, code: str, http_status: int = 409):
-        super().__init__(code)
-        self.code = code
-        self.http_status = int(http_status)
-
-
-class SignatureVerifier(Protocol):
-    def verify(self, *, namespace: str, payload: bytes, signature: str, key_id: str) -> bool: ...
-
-
-def canonical_json(value: Any) -> str:
-    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"), allow_nan=False)
-
-
-def sha256_text(value: str) -> str:
-    return hashlib.sha256(value.encode("utf-8")).hexdigest()
-
-
-def _fail(code: str, status: int = 409) -> None:
-    raise TaskLineageSupersessionError(code, status)
-
-
-def _utc(value: Any, field: str) -> datetime:
-    if not isinstance(value, str) or not value or len(value) > 80:
-        _fail(field.upper() + "_INVALID", 400)
-    try:
-        result = datetime.fromisoformat(value.replace("Z", "+00:00"))
-    except ValueError as exc:
-        raise TaskLineageSupersessionError(field.upper() + "_INVALID", 400) from exc
-    if result.tzinfo is None:
-        _fail(field.upper() + "_INVALID", 400)
-    return result.astimezone(timezone.utc)
-
-
-def _text(value: Any, field: str, *, maximum: int = 1024) -> str:
-    if not isinstance(value, str) or not value or len(value) > maximum:
-        _fail(field.upper() + "_INVALID", 400)
-    return value
-
-
-def decision_payload(raw: Mapping[str, Any]) -> dict[str, Any]:
-    return {key: raw[key] for key in raw if key != "signature"}
-
-
-DECISION_FIELDS = {
-    "schema", "decision_id", "nonce", "source_task_id",
-    "source_task_identity_sha256", "source_metadata_sha256",
-    "source_expected_status", "source_expected_revision", "source_expected_attempt",
-    "source_expected_claimed_by", "source_expected_lease_token_hash",
-    "source_expected_lease_expires_at", "repository", "target_branch", "generation",
-    "execution_digest", "external_job_id", "child_task_id", "supersession_ordinal",
-    "canonical_projection_profile", "canonical_projection_version", "supersession_reason",
-    "owner_identity", "signature_namespace", "signature_principal", "key_id",
-    "issued_at", "not_before", "expires_at", "one_time_use", "signature",
-}
-
-
-def validate_decision(raw: Mapping[str, Any], *, now: datetime) -> dict[str, Any]:
-    if not isinstance(raw, Mapping) or set(raw) != DECISION_FIELDS:
-        _fail("DECISION_FIELDS_INVALID", 400)
-    exact = {
-        "schema": DECISION_SCHEMA,
-        "source_task_id": SOURCE_TASK_ID,
-        "source_expected_status": "EXPIRED",
-        "source_expected_attempt": 0,
-        "source_expected_claimed_by": None,
-        "source_expected_lease_token_hash": None,
-        "source_expected_lease_expires_at": None,
-        "repository": REPOSITORY,
-        "target_branch": TARGET_BRANCH,
-        "generation": GENERATION,
-        "execution_digest": EXECUTION_DIGEST,
-        "external_job_id": EXTERNAL_JOB_ID,
-        "child_task_id": CHILD_TASK_ID,
-        "supersession_ordinal": SUPERSESSION_ORDINAL,
-        "canonical_projection_profile": CANONICAL_PROFILE,
-        "canonical_projection_version": CANONICAL_PROFILE_VERSION,
-        "supersession_reason": SUPERSESSION_REASON,
-        "owner_identity": OWNER_PRINCIPAL,
-        "signature_namespace": OWNER_NAMESPACE,
-        "signature_principal": OWNER_PRINCIPAL,
-        "key_id": OWNER_KEY_ID,
-        "one_time_use": True,
-    }
-    for field, expected in exact.items():
-        if raw[field] != expected:
-            _fail(field.upper() + "_MISMATCH", 403 if field.startswith(("owner", "signature", "key")) else 409)
-    for field in ("decision_id", "nonce"):
-        value = _text(raw[field], field, maximum=256)
-        if SAFE_ID.fullmatch(value) is None:
-            _fail(field.upper() + "_INVALID", 400)
-    for field in ("source_task_identity_sha256", "source_metadata_sha256"):
-        if not isinstance(raw[field], str) or HEX64.fullmatch(raw[field]) is None:
-            _fail(field.upper() + "_INVALID", 400)
-    if type(raw["source_expected_revision"]) is not int or raw["source_expected_revision"] < 1:
-        _fail("SOURCE_EXPECTED_REVISION_INVALID", 400)
-    _text(raw["signature"], "signature", maximum=32768)
-    issued_at = _utc(raw["issued_at"], "issued_at")
-    not_before = _utc(raw["not_before"], "not_before")
-    expires_at = _utc(raw["expires_at"], "expires_at")
-    if issued_at > expires_at or not_before > expires_at:
-        _fail("DECISION_TIME_ORDER_INVALID", 403)
-    if expires_at - issued_at > MAX_TTL or expires_at <= issued_at:
-        _fail("DECISION_TTL_INVALID", 403)
-    now = now.astimezone(timezone.utc)
-    if now < not_before or now >= expires_at:
-        _fail("DECISION_EXPIRED_OR_NOT_YET_VALID", 403)
-    if issued_at > now + timedelta(seconds=5) or now - issued_at > MAX_TTL:
-        _fail("DECISION_ISSUED_AT_INVALID", 403)
-    return {**dict(raw), "issued_at_dt": issued_at, "not_before_dt": not_before, "expires_at_dt": expires_at}
-
-
-def _default_identity_digest(row: sqlite3.Row) -> str:
-    try:
-        from aios_expired_task_recovery import task_identity_digest
-    except ImportError as exc:
-        raise TaskLineageSupersessionError("FORMAL_TASK_IDENTITY_HELPER_UNAVAILABLE", 503) from exc
-    return str(task_identity_digest(row))
-
-
-def _json_object(row: sqlite3.Row, field: str) -> dict[str, Any]:
-    try:
-        value = json.loads(row[field])
-    except (TypeError, ValueError, KeyError) as exc:
-        raise TaskLineageSupersessionError("SOURCE_TASK_JSON_INVALID", 409) from exc
-    if not isinstance(value, Mapping):
-        _fail("SOURCE_TASK_JSON_INVALID")
-    return dict(value)
-
-
-def _verify_source(row: sqlite3.Row, d: Mapping[str, Any], identity_digest: Callable[[sqlite3.Row], str]) -> None:
-    if row["task_id"] != SOURCE_TASK_ID:
-        _fail("SOURCE_TASK_ID_MISMATCH")
-    cas = (
-        row["status"] == "EXPIRED"
-        and int(row["revision"]) == d["source_expected_revision"]
-        and int(row["attempt"]) == 0
-        and row["claimed_by"] is None
-        and row["lease_token_hash"] is None
-        and row["lease_expires_at"] is None
-    )
-    if not cas:
-        _fail("SOURCE_TASK_EXACT_CAS_MISMATCH")
-    metadata_raw = row["metadata_json"]
-    if not isinstance(metadata_raw, str) or sha256_text(metadata_raw) != d["source_metadata_sha256"]:
-        _fail("SOURCE_METADATA_DIGEST_MISMATCH")
-    if identity_digest(row) != d["source_task_identity_sha256"]:
-        _fail("SOURCE_TASK_IDENTITY_DIGEST_MISMATCH")
-    metadata = _json_object(row, "metadata_json")
-    execution = metadata.get("execution")
-    constraints = _json_object(row, "constraints_json")
-    if not isinstance(execution, Mapping):
-        _fail("SOURCE_EXECUTION_BINDING_INVALID")
-    expected = {
-        "repository": REPOSITORY,
-        "target_branch": TARGET_BRANCH,
-        "generation": GENERATION,
-        "execution_digest": EXECUTION_DIGEST,
-        "external_job_id": EXTERNAL_JOB_ID,
-        "task_id": SOURCE_TASK_ID,
-    }
-    if any(execution.get(key) != value for key, value in expected.items()):
-        _fail("SOURCE_EXECUTION_BINDING_MISMATCH")
-    if constraints.get("generation") != GENERATION:
-        _fail("SOURCE_GENERATION_CONSTRAINT_MISMATCH")
-
-
-class TaskLineageSupersessionController:
-    def __init__(self, db_path: str | Path, verifier: SignatureVerifier, *, clock=None, identity_digest=None):
-        self.db_path = Path(db_path)
-        self.verifier = verifier
-        self.clock = clock or (lambda: datetime.now(timezone.utc))
-        self.identity_digest = identity_digest or _default_identity_digest
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.db_path, timeout=30, isolation_level=None)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    def _now(self) -> datetime:
-        value = self.clock()
-        if value.tzinfo is None:
-            value = value.replace(tzinfo=timezone.utc)
-        return value.astimezone(timezone.utc)
-
-    @staticmethod
-    def _assert_schema(connection: sqlite3.Connection) -> None:
-        required = {"tasks", "events", "task_lineage_supersessions", "task_lineage_supersession_receipts"}
-        actual = {row[0] for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
-        if not required.issubset(actual):
-            _fail("SUPERSESSION_SCHEMA_UNAVAILABLE", 503)
-        columns = {row[1] for row in connection.execute("PRAGMA table_info(tasks)")}
-        task_columns = {
-            "task_id", "goal", "instructions", "success_criteria_json",
-            "required_capabilities_json", "constraints_json", "metadata_json", "deadline",
-            "priority", "max_attempts", "attempt", "status", "claimed_by",
-            "lease_token_hash", "lease_expires_at", "result_json", "result_digest",
-            "result_idempotency_key", "verification_json", "revision", "created_at", "updated_at",
-        }
-        if not task_columns.issubset(columns):
-            _fail("TASK_SCHEMA_UNSUPPORTED", 503)
-
-    def supersede(self, raw: Mapping[str, Any]) -> dict[str, Any]:
-        now = self._now()
-        decision = validate_decision(raw, now=now)
-        payload_bytes = canonical_json(decision_payload(raw)).encode("utf-8")
-        if not self.verifier.verify(
-            namespace=OWNER_NAMESPACE, payload=payload_bytes,
-            signature=decision["signature"], key_id=decision["key_id"],
-        ):
-            _fail("DECISION_SIGNATURE_INVALID", 403)
-        decision_sha = hashlib.sha256(payload_bytes).hexdigest()
-        now_text = now.isoformat()
-        with closing(self._connect()) as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            try:
-                self._assert_schema(connection)
-                replay = connection.execute(
-                    "SELECT owner_decision_sha256,receipt_json FROM task_lineage_supersession_receipts WHERE decision_id=? OR nonce=?",
-                    (decision["decision_id"], decision["nonce"]),
-                ).fetchone()
-                if replay is not None:
-                    if replay["owner_decision_sha256"] != decision_sha:
-                        _fail("DECISION_REPLAY_MISMATCH")
-                    result = json.loads(replay["receipt_json"])
-                    connection.commit()
-                    return {**result, "idempotent": True}
-                source = connection.execute("SELECT * FROM tasks WHERE task_id=?", (SOURCE_TASK_ID,)).fetchone()
-                if source is None:
-                    _fail("SOURCE_TASK_NOT_FOUND", 404)
-                _verify_source(source, decision, self.identity_digest)
-                if connection.execute(
-                    "SELECT 1 FROM task_lineage_supersessions WHERE source_task_id=? AND supersession_ordinal=?",
-                    (SOURCE_TASK_ID, SUPERSESSION_ORDINAL),
-                ).fetchone():
-                    _fail("SUPERSESSION_ALREADY_EXISTS")
-                if connection.execute("SELECT 1 FROM tasks WHERE task_id=?", (CHILD_TASK_ID,)).fetchone():
-                    _fail("CHILD_TASK_ALREADY_EXISTS")
-                connection.execute(
-                    """INSERT INTO tasks(
-                    task_id,goal,instructions,success_criteria_json,required_capabilities_json,
-                    constraints_json,metadata_json,deadline,priority,max_attempts,attempt,status,
-                    claimed_by,lease_token_hash,lease_expires_at,result_json,result_digest,
-                    result_idempotency_key,verification_json,revision,created_at,updated_at)
-                    VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)""",
-                    (
-                        CHILD_TASK_ID, source["goal"], source["instructions"], source["success_criteria_json"],
-                        "[]", source["constraints_json"], "{}", None, source["priority"], source["max_attempts"],
-                        0, "QUEUED", None, None, None, None, None, None, None, 1, now_text, now_text,
-                    ),
-                )
-                connection.execute(
-                    """INSERT INTO task_lineage_supersessions(
-                    source_task_id,supersession_ordinal,child_task_id,source_task_identity_sha256,
-                    source_metadata_sha256,owner_decision_sha256,decision_id,created_at)
-                    VALUES(?,?,?,?,?,?,?,?)""",
-                    (SOURCE_TASK_ID, SUPERSESSION_ORDINAL, CHILD_TASK_ID,
-                     decision["source_task_identity_sha256"], decision["source_metadata_sha256"],
-                     decision_sha, decision["decision_id"], now_text),
-                )
-                event_payload = {
-                    "task_id": CHILD_TASK_ID, "supersedes_task_id": SOURCE_TASK_ID,
-                    "supersession_ordinal": SUPERSESSION_ORDINAL,
-                    "source_task_identity_sha256": decision["source_task_identity_sha256"],
-                    "source_metadata_sha256": decision["source_metadata_sha256"],
-                    "owner_supersession_decision_sha256": decision_sha,
-                    "canonical_projection_profile": CANONICAL_PROFILE,
-                    "canonical_projection_version": CANONICAL_PROFILE_VERSION,
-                }
-                connection.execute(
-                    "INSERT INTO events(task_id,agent_id,event_type,payload_json,created_at) VALUES(?,?,?,?,?)",
-                    (CHILD_TASK_ID, None, "TASK_CREATED", canonical_json(event_payload), now_text),
-                )
-                receipt = {
-                    "schema": RECEIPT_SCHEMA, "status": "SUPERSEDED",
-                    "decision_id": decision["decision_id"], "owner_decision_sha256": decision_sha,
-                    "source_task_id": SOURCE_TASK_ID, "source_task_identity_sha256": decision["source_task_identity_sha256"],
-                    "source_metadata_sha256": decision["source_metadata_sha256"],
-                    "source_status": "EXPIRED", "source_revision": decision["source_expected_revision"],
-                    "source_attempt": 0, "source_history_preserved": True,
-                    "child_task_id": CHILD_TASK_ID, "supersession_ordinal": SUPERSESSION_ORDINAL,
-                    "child_status": "QUEUED", "child_revision": 1, "child_attempt": 0,
-                    "canonical_projection_profile": CANONICAL_PROFILE,
-                    "canonical_projection_version": CANONICAL_PROFILE_VERSION,
-                    "exact_identity_cas": True, "one_time_use": True,
-                    "owner_signature_namespace": OWNER_NAMESPACE,
-                    "owner_signature_principal": OWNER_PRINCIPAL,
-                    "owner_signature_key_id": OWNER_KEY_ID,
-                    "owner_signature_sha256": sha256_text(decision["signature"]),
-                }
-                connection.execute(
-                    """INSERT INTO task_lineage_supersession_receipts(
-                    decision_id,nonce,source_task_id,supersession_ordinal,child_task_id,
-                    owner_decision_sha256,decision_json,receipt_json,consumed_at)
-                    VALUES(?,?,?,?,?,?,?,?,?)""",
-                    (decision["decision_id"], decision["nonce"], SOURCE_TASK_ID, SUPERSESSION_ORDINAL,
-                     CHILD_TASK_ID, decision_sha, canonical_json(dict(raw)), canonical_json(receipt), now_text),
-                )
-                connection.commit()
-                return {**receipt, "idempotent": False}
-            except Exception:
-                connection.rollback()
-                raise

active-runtime/app/aios_task_lineage_supersession_initial_projection.py

@@ -1,548 +0,0 @@
-"""Canonical initial projection for the exact Single-Host supersession child.
-
-The source business execution digest is lineage evidence.  It is deliberately
-not used as the child execution-envelope digest: the canonical envelope binds
-the child Task id and therefore has its own server-derived digest.
-"""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import hashlib
-import json
-import sqlite3
-from typing import Any, Mapping
-
-from aios_agent_task_initial_execution_projection import (
-    InitialExecutionProjectionError,
-    InitialExecutionProjectionRequest,
-    InitialExecutionProjectionStore,
-    RUNTIME_CAPABILITY_RE,
-    _now,
-    _require_string,
-    _required_authorization_id,
-)
-from aios_online_agent_execution import (
-    ExecutionProjectionError,
-    GovernedExecutionBinding,
-    validate_execution_envelope,
-)
-from aios_task_lineage_supersession import (
-    CANONICAL_PROFILE,
-    CANONICAL_PROFILE_VERSION,
-    CHILD_TASK_ID,
-    DECISION_SCHEMA,
-    EXECUTION_DIGEST as SOURCE_BUSINESS_EXECUTION_DIGEST,
-    EXTERNAL_JOB_ID,
-    GENERATION,
-    OWNER_KEY_ID,
-    OWNER_NAMESPACE,
-    OWNER_PRINCIPAL,
-    RECEIPT_SCHEMA as SUPERSESSION_RECEIPT_SCHEMA,
-    REPOSITORY,
-    SOURCE_TASK_ID,
-    SUPERSESSION_ORDINAL,
-    TARGET_BRANCH,
-    canonical_json,
-    decision_payload,
-)
-
-
-PROJECTION_INTENT_SCHEMA = "aios.task-lineage-supersession-initial-projection-intent.v1"
-PROJECTION_RECEIPT_SCHEMA = "aios.task-lineage-supersession-initial-projection-receipt.v1"
-PROJECTION_IDEMPOTENCY_KEY = "task-lineage-supersession-s1-initial-projection-v1"
-PROJECTION_REASON = "canonical-initial-projection-for-formal-supersession-child"
-PROJECTION_TABLE = "task_lineage_supersession_initial_projections"
-
-
-def _sha_text(value: str) -> str:
-    return hashlib.sha256(value.encode("utf-8")).hexdigest()
-
-
-def _sha_json(value: Any) -> str:
-    return _sha_text(canonical_json(value))
-
-
-def _json_object(raw: Any, code: str) -> dict[str, Any]:
-    if not isinstance(raw, str):
-        raise InitialExecutionProjectionError(code, 409)
-    try:
-        value = json.loads(raw)
-    except (TypeError, ValueError) as exc:
-        raise InitialExecutionProjectionError(code, 409) from exc
-    if not isinstance(value, Mapping):
-        raise InitialExecutionProjectionError(code, 409)
-    return dict(value)
-
-
-@dataclass(frozen=True)
-class SupersessionChildProjectionIntent:
-    """Caller-selectable portion of the exact child projection.
-
-    Task identity, CAS values, Job identity, projection profile, reason and
-    idempotency are intentionally absent from the request and server-owned.
-    """
-
-    adapter: str
-    required_capability: str
-    authorization_id: str
-
-    @classmethod
-    def from_mapping(
-        cls, value: Mapping[str, Any]
-    ) -> "SupersessionChildProjectionIntent":
-        if not isinstance(value, Mapping) or set(value) != {
-            "adapter",
-            "required_capability",
-            "authorization_id",
-        }:
-            raise InitialExecutionProjectionError(
-                "SUPERSESSION_INITIAL_PROJECTION_FIELDS_INVALID", 400
-            )
-        adapter = _require_string(value["adapter"], "RUNTIME_ADAPTER_INVALID")
-        capability = _require_string(
-            value["required_capability"],
-            "RUNTIME_CAPABILITY_INVALID",
-            RUNTIME_CAPABILITY_RE,
-        )
-        if adapter not in {"hermes", "openclaw"} or capability != f"agent.runtime.{adapter}":
-            raise InitialExecutionProjectionError("RUNTIME_CAPABILITY_MISMATCH", 400)
-        authorization_id = _require_string(
-            value["authorization_id"], "AUTHORIZATION_ID_INVALID"
-        )
-        return cls(adapter, capability, authorization_id)
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "schema": PROJECTION_INTENT_SCHEMA,
-            "source_task_id": SOURCE_TASK_ID,
-            "child_task_id": CHILD_TASK_ID,
-            "supersession_ordinal": SUPERSESSION_ORDINAL,
-            "canonical_projection_profile": CANONICAL_PROFILE,
-            "canonical_projection_version": CANONICAL_PROFILE_VERSION,
-            "expected_status": "QUEUED",
-            "expected_revision": 1,
-            "expected_attempt": 0,
-            "expected_metadata_sha256": _sha_json({}),
-            "expected_required_capabilities_sha256": _sha_json([]),
-            "expected_job_id": EXTERNAL_JOB_ID,
-            "adapter": self.adapter,
-            "required_capability": self.required_capability,
-            "authorization_id": self.authorization_id,
-            "idempotency_key": PROJECTION_IDEMPOTENCY_KEY,
-            "reason": PROJECTION_REASON,
-        }
-
-    def initial_request(self, canonical_execution_digest: str) -> InitialExecutionProjectionRequest:
-        return InitialExecutionProjectionRequest.from_mapping(
-            {
-                "expected_status": "QUEUED",
-                "expected_revision": 1,
-                "expected_attempt": 0,
-                "expected_metadata_sha256": _sha_json({}),
-                "expected_required_capabilities_sha256": _sha_json([]),
-                "expected_job_id": EXTERNAL_JOB_ID,
-                "expected_execution_digest": canonical_execution_digest,
-                "required_capability": self.required_capability,
-                "adapter": self.adapter,
-                "authorization_id": self.authorization_id,
-                "idempotency_key": PROJECTION_IDEMPOTENCY_KEY,
-                "reason": PROJECTION_REASON,
-            }
-        )
-
-
-def _table_names(connection: sqlite3.Connection) -> set[str]:
-    return {
-        str(row[0])
-        for row in connection.execute(
-            "SELECT name FROM sqlite_master WHERE type='table'"
-        )
-    }
-
-
-def _load_lineage_context(
-    connection: sqlite3.Connection, *, expect_projected: bool
-) -> dict[str, Any]:
-    required_tables = {
-        "tasks",
-        "events",
-        "task_lineage_supersessions",
-        "task_lineage_supersession_receipts",
-        PROJECTION_TABLE,
-    }
-    if not required_tables.issubset(_table_names(connection)):
-        raise InitialExecutionProjectionError(
-            "SUPERSESSION_INITIAL_PROJECTION_SCHEMA_UNAVAILABLE", 503
-        )
-    relation = connection.execute(
-        "SELECT * FROM task_lineage_supersessions "
-        "WHERE source_task_id=? AND supersession_ordinal=? AND child_task_id=?",
-        (SOURCE_TASK_ID, SUPERSESSION_ORDINAL, CHILD_TASK_ID),
-    ).fetchone()
-    if relation is None:
-        raise InitialExecutionProjectionError("FORMAL_SUPERSESSION_REQUIRED", 409)
-    receipt_row = connection.execute(
-        "SELECT * FROM task_lineage_supersession_receipts "
-        "WHERE decision_id=? AND source_task_id=? AND supersession_ordinal=? "
-        "AND child_task_id=?",
-        (
-            relation["decision_id"],
-            SOURCE_TASK_ID,
-            SUPERSESSION_ORDINAL,
-            CHILD_TASK_ID,
-        ),
-    ).fetchone()
-    if receipt_row is None:
-        raise InitialExecutionProjectionError("SUPERSESSION_RECEIPT_REQUIRED", 409)
-    decision = _json_object(receipt_row["decision_json"], "SUPERSESSION_DECISION_INVALID")
-    receipt = _json_object(receipt_row["receipt_json"], "SUPERSESSION_RECEIPT_INVALID")
-    decision_sha256 = _sha_text(canonical_json(decision_payload(decision)))
-    exact_decision = {
-        "schema": DECISION_SCHEMA,
-        "source_task_id": SOURCE_TASK_ID,
-        "child_task_id": CHILD_TASK_ID,
-        "supersession_ordinal": SUPERSESSION_ORDINAL,
-        "repository": REPOSITORY,
-        "target_branch": TARGET_BRANCH,
-        "generation": GENERATION,
-        "execution_digest": SOURCE_BUSINESS_EXECUTION_DIGEST,
-        "external_job_id": EXTERNAL_JOB_ID,
-        "canonical_projection_profile": CANONICAL_PROFILE,
-        "canonical_projection_version": CANONICAL_PROFILE_VERSION,
-        "owner_identity": OWNER_PRINCIPAL,
-        "signature_namespace": OWNER_NAMESPACE,
-        "signature_principal": OWNER_PRINCIPAL,
-        "key_id": OWNER_KEY_ID,
-        "one_time_use": True,
-    }
-    if any(decision.get(key) != expected for key, expected in exact_decision.items()):
-        raise InitialExecutionProjectionError(
-            "SUPERSESSION_DECISION_SCOPE_MISMATCH", 409
-        )
-    if (
-        decision_sha256 != relation["owner_decision_sha256"]
-        or decision_sha256 != receipt_row["owner_decision_sha256"]
-        or decision.get("source_task_identity_sha256")
-        != relation["source_task_identity_sha256"]
-        or decision.get("source_metadata_sha256") != relation["source_metadata_sha256"]
-        or receipt.get("schema") != SUPERSESSION_RECEIPT_SCHEMA
-        or receipt.get("owner_decision_sha256") != decision_sha256
-        or receipt.get("source_task_id") != SOURCE_TASK_ID
-        or receipt.get("child_task_id") != CHILD_TASK_ID
-        or receipt.get("supersession_ordinal") != SUPERSESSION_ORDINAL
-    ):
-        raise InitialExecutionProjectionError(
-            "SUPERSESSION_LINEAGE_EVIDENCE_MISMATCH", 409
-        )
-    events = connection.execute(
-        "SELECT event_type,payload_json FROM events WHERE task_id=? ORDER BY event_id",
-        (CHILD_TASK_ID,),
-    ).fetchall()
-    expected_events = ["TASK_CREATED"]
-    if expect_projected:
-        expected_events.append("TASK_INITIAL_EXECUTION_PROJECTION_AUTHORIZED")
-    if [str(row["event_type"]) for row in events] != expected_events:
-        raise InitialExecutionProjectionError(
-            "SUPERSESSION_CHILD_EVENT_CHAIN_INVALID", 409
-        )
-    created = _json_object(events[0]["payload_json"], "SUPERSESSION_CREATED_EVENT_INVALID")
-    exact_created = {
-        "task_id": CHILD_TASK_ID,
-        "supersedes_task_id": SOURCE_TASK_ID,
-        "supersession_ordinal": SUPERSESSION_ORDINAL,
-        "source_task_identity_sha256": relation["source_task_identity_sha256"],
-        "source_metadata_sha256": relation["source_metadata_sha256"],
-        "owner_supersession_decision_sha256": decision_sha256,
-        "canonical_projection_profile": CANONICAL_PROFILE,
-        "canonical_projection_version": CANONICAL_PROFILE_VERSION,
-    }
-    if any(created.get(key) != expected for key, expected in exact_created.items()):
-        raise InitialExecutionProjectionError(
-            "SUPERSESSION_CREATED_EVENT_SCOPE_MISMATCH", 409
-        )
-    return {
-        "source_task_identity_sha256": relation["source_task_identity_sha256"],
-        "source_metadata_sha256": relation["source_metadata_sha256"],
-        "owner_decision_sha256": decision_sha256,
-    }
-
-
-def _validate_canonical_child_execution(
-    resolved: Mapping[str, Any],
-    *,
-    intent: SupersessionChildProjectionIntent,
-    runtime_input: Mapping[str, Any],
-) -> dict[str, Any]:
-    try:
-        binding = GovernedExecutionBinding.from_mapping(resolved)
-        execution = validate_execution_envelope(resolved, binding=binding)
-    except ExecutionProjectionError as exc:
-        raise InitialExecutionProjectionError(
-            "SUPERSESSION_CANONICAL_EXECUTION_INVALID", 409
-        ) from exc
-    exact_binding = {
-        "task_id": CHILD_TASK_ID,
-        "job_id": EXTERNAL_JOB_ID,
-        "repository": REPOSITORY,
-        "target_branch": TARGET_BRANCH,
-        "generation": GENERATION,
-    }
-    if any(execution.get(key) != expected for key, expected in exact_binding.items()):
-        raise InitialExecutionProjectionError(
-            "SUPERSESSION_CANONICAL_EXECUTION_BINDING_MISMATCH", 409
-        )
-    if (
-        execution.get("action") != "agent_runtime"
-        or execution.get("adapter") != intent.adapter
-        or execution.get("capability_scope") != [intent.required_capability]
-        or execution.get("runtime_input") != dict(runtime_input)
-        or execution.get("change_set") != []
-        or execution.get("verification") != []
-        or execution.get("governance", {}).get("writer_lease") is not False
-    ):
-        raise InitialExecutionProjectionError(
-            "SUPERSESSION_AGENT_RUNTIME_ENVELOPE_INVALID", 409
-        )
-    if execution["execution_digest"] == SOURCE_BUSINESS_EXECUTION_DIGEST:
-        raise InitialExecutionProjectionError(
-            "CHILD_CANONICAL_DIGEST_COLLIDES_WITH_SOURCE_BUSINESS_DIGEST", 409
-        )
-    return execution
-
-
-class _SupersessionProjectionTransactionStore(InitialExecutionProjectionStore):
-    """Per-invocation store that adds immutable lineage evidence atomically."""
-
-    allows_supersession_child = True
-
-    def __init__(self, db_path, resolved: Mapping[str, Any], intent):
-        self._resolved = dict(resolved)
-        self.intent = intent
-        super().__init__(db_path, self._resolve_once)
-
-    def _resolve_once(self, *_args):
-        return dict(self._resolved)
-
-    def _projection_event_extension(
-        self, connection, task_id, request, execution, applied_revision
-    ):
-        if task_id != CHILD_TASK_ID:
-            raise InitialExecutionProjectionError(
-                "SUPERSESSION_CHILD_TASK_ID_MISMATCH", 409
-            )
-        context = _load_lineage_context(connection, expect_projected=False)
-        return {
-            "source_task_id": SOURCE_TASK_ID,
-            "supersession_ordinal": SUPERSESSION_ORDINAL,
-            "source_task_identity_sha256": context["source_task_identity_sha256"],
-            "source_metadata_sha256": context["source_metadata_sha256"],
-            "owner_supersession_decision_sha256": context["owner_decision_sha256"],
-            "source_business_execution_digest": SOURCE_BUSINESS_EXECUTION_DIGEST,
-            "canonical_child_execution_digest": execution["execution_digest"],
-            "canonical_projection_profile": CANONICAL_PROFILE,
-            "canonical_projection_version": CANONICAL_PROFILE_VERSION,
-        }
-
-    def _insert_projection_extension(
-        self,
-        connection,
-        task_id,
-        request,
-        execution,
-        event_payload,
-        applied_revision,
-    ):
-        context = _load_lineage_context(connection, expect_projected=True)
-        task = connection.execute(
-            "SELECT metadata_json,required_capabilities_json FROM tasks WHERE task_id=?",
-            (CHILD_TASK_ID,),
-        ).fetchone()
-        if task is None:
-            raise InitialExecutionProjectionError("TASK_NOT_FOUND", 404)
-        intent_json = canonical_json(self.intent.public())
-        intent_sha256 = _sha_text(intent_json)
-        receipt = {
-            "schema": PROJECTION_RECEIPT_SCHEMA,
-            "projection_id": "sha256:" + intent_sha256,
-            "task_id": CHILD_TASK_ID,
-            "source_task_id": SOURCE_TASK_ID,
-            "supersession_ordinal": SUPERSESSION_ORDINAL,
-            "source_task_identity_sha256": context["source_task_identity_sha256"],
-            "source_metadata_sha256": context["source_metadata_sha256"],
-            "owner_supersession_decision_sha256": context["owner_decision_sha256"],
-            "source_business_execution_digest": SOURCE_BUSINESS_EXECUTION_DIGEST,
-            "canonical_child_execution_digest": execution["execution_digest"],
-            "external_job_id": EXTERNAL_JOB_ID,
-            "repository": REPOSITORY,
-            "target_branch": TARGET_BRANCH,
-            "generation": GENERATION,
-            "adapter": self.intent.adapter,
-            "required_capability": self.intent.required_capability,
-            "expected_revision": 1,
-            "applied_revision": applied_revision,
-            "attempt": 0,
-            "metadata_sha256": _sha_text(task["metadata_json"]),
-            "required_capabilities_sha256": _sha_text(
-                task["required_capabilities_json"]
-            ),
-            "projection_event_sha256": _sha_json(dict(event_payload)),
-        }
-        receipt_json = canonical_json(receipt)
-        receipt_sha256 = _sha_text(receipt_json)
-        connection.execute(
-            f"""INSERT INTO {PROJECTION_TABLE}(
-            projection_id,task_id,source_task_id,supersession_ordinal,
-            intent_sha256,intent_json,owner_decision_sha256,
-            source_task_identity_sha256,source_metadata_sha256,
-            source_business_execution_digest,canonical_child_execution_digest,
-            external_job_id,repository,target_branch,generation,adapter,
-            required_capability,expected_revision,applied_revision,metadata_sha256,
-            required_capabilities_sha256,projection_event_sha256,receipt_json,
-            receipt_sha256,created_at)
-            VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)""",
-            (
-                receipt["projection_id"],
-                CHILD_TASK_ID,
-                SOURCE_TASK_ID,
-                SUPERSESSION_ORDINAL,
-                intent_sha256,
-                intent_json,
-                context["owner_decision_sha256"],
-                context["source_task_identity_sha256"],
-                context["source_metadata_sha256"],
-                SOURCE_BUSINESS_EXECUTION_DIGEST,
-                execution["execution_digest"],
-                EXTERNAL_JOB_ID,
-                REPOSITORY,
-                TARGET_BRANCH,
-                GENERATION,
-                self.intent.adapter,
-                self.intent.required_capability,
-                1,
-                applied_revision,
-                receipt["metadata_sha256"],
-                receipt["required_capabilities_sha256"],
-                receipt["projection_event_sha256"],
-                receipt_json,
-                receipt_sha256,
-                _now(),
-            ),
-        )
-
-
-class SupersessionChildInitialProjectionStore:
-    """Server-owned adapter from exact supersession lineage to current ABI."""
-
-    def __init__(self, db_path, resolver):
-        self.db_path = db_path
-        self.resolver = resolver
-
-    def _connect(self):
-        connection = sqlite3.connect(self.db_path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    @staticmethod
-    def _replay(connection, intent: SupersessionChildProjectionIntent):
-        if PROJECTION_TABLE not in _table_names(connection):
-            raise InitialExecutionProjectionError(
-                "SUPERSESSION_INITIAL_PROJECTION_SCHEMA_UNAVAILABLE", 503
-            )
-        row = connection.execute(
-            f"SELECT * FROM {PROJECTION_TABLE} WHERE task_id=?", (CHILD_TASK_ID,)
-        ).fetchone()
-        if row is None:
-            tables = _table_names(connection)
-            if "task_initial_execution_projections" in tables:
-                generic = connection.execute(
-                    "SELECT 1 FROM task_initial_execution_projections "
-                    "WHERE task_id=? AND idempotency_key=?",
-                    (CHILD_TASK_ID, PROJECTION_IDEMPOTENCY_KEY),
-                ).fetchone()
-                if generic is not None:
-                    raise InitialExecutionProjectionError(
-                        "SUPERSESSION_PROJECTION_RECEIPT_MISSING", 500
-                    )
-            return None
-        intent_sha256 = _sha_json(intent.public())
-        if row["intent_sha256"] != intent_sha256:
-            raise InitialExecutionProjectionError(
-                "SUPERSESSION_INITIAL_PROJECTION_INTENT_CONFLICT", 409
-            )
-        receipt = _json_object(
-            row["receipt_json"], "SUPERSESSION_PROJECTION_RECEIPT_INVALID"
-        )
-        if (
-            _sha_text(row["receipt_json"]) != row["receipt_sha256"]
-            or receipt.get("schema") != PROJECTION_RECEIPT_SCHEMA
-            or receipt.get("canonical_child_execution_digest")
-            != row["canonical_child_execution_digest"]
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERSESSION_PROJECTION_RECEIPT_DIGEST_MISMATCH", 500
-            )
-        _load_lineage_context(connection, expect_projected=True)
-        task = connection.execute(
-            "SELECT * FROM tasks WHERE task_id=?", (CHILD_TASK_ID,)
-        ).fetchone()
-        if (
-            task is None
-            or task["status"] != "QUEUED"
-            or int(task["revision"]) != int(row["applied_revision"])
-            or int(task["attempt"]) != 0
-            or task["claimed_by"] is not None
-            or task["lease_token_hash"] is not None
-            or task["lease_expires_at"] is not None
-            or _sha_text(task["metadata_json"]) != row["metadata_sha256"]
-            or _sha_text(task["required_capabilities_json"])
-            != row["required_capabilities_sha256"]
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERSESSION_PROJECTED_TASK_CAS_MISMATCH", 409
-            )
-        return {**receipt, "idempotent": True}
-
-    def project(self, value: Mapping[str, Any]) -> dict[str, Any]:
-        intent = SupersessionChildProjectionIntent.from_mapping(value)
-        if intent.authorization_id != _required_authorization_id():
-            raise InitialExecutionProjectionError("AUTHORIZATION_ID_MISMATCH", 403)
-        with self._connect() as connection:
-            replay = self._replay(connection, intent)
-            if replay is not None:
-                return replay
-            probe_request = intent.initial_request("0" * 64)
-            probe_store = _SupersessionProjectionTransactionStore(
-                self.db_path, {}, intent
-            )
-            task, _, _, _ = probe_store._load_and_validate(
-                connection, CHILD_TASK_ID, probe_request
-            )
-            _load_lineage_context(connection, expect_projected=False)
-            runtime_input = probe_store._runtime_input(task)
-        resolved = dict(
-            self.resolver(
-                CHILD_TASK_ID,
-                EXTERNAL_JOB_ID,
-                intent.required_capability,
-                intent.adapter,
-                runtime_input,
-            )
-        )
-        execution = _validate_canonical_child_execution(
-            resolved, intent=intent, runtime_input=runtime_input
-        )
-        store = _SupersessionProjectionTransactionStore(
-            self.db_path, resolved, intent
-        )
-        result = store.project(
-            CHILD_TASK_ID, intent.initial_request(execution["execution_digest"])
-        )
-        with self._connect() as connection:
-            receipt = self._replay(connection, intent)
-            if receipt is None:
-                raise InitialExecutionProjectionError(
-                    "SUPERSESSION_PROJECTION_RECEIPT_MISSING", 500
-                )
-        return {**receipt, "idempotent": bool(result["idempotent"])}

active-runtime/app/aios_task_lineage_supersession_owner_authority.py

@@ -1,221 +0,0 @@
-"""Fixed Owner operation for one exact Task-lineage supersession.
-
-This staging overlay deliberately extends the installed single-host operational
-authority instead of exposing a generic signing primitive.  The caller can
-only provide the three live CAS values which cannot be known at build time.
-Every authority, lineage and execution field is constructed server-side.
-"""
-from __future__ import annotations
-
-import re
-import secrets
-from typing import Any, Callable, Mapping
-
-from aios_single_host_authority import OWNER_IDENTITY, OWNER_NAMESPACE, sha256_json
-from aios_single_host_operational_authority import (
-    OperationalAuthorityError,
-    OperationalOwnerAuthority,
-    OperationalPolicy,
-    SignedOperationalArtifact,
-)
-
-TASK_LINEAGE_SUPERSESSION_OPERATION = "issue_task_lineage_supersession"
-TASK_LINEAGE_SUPERSESSION_SCHEMA = "aios.task-lineage-supersession-decision.v1"
-SOURCE_TASK_ID = "TASK-SINGLEHOST-TRUSTROOT-P0-20260904"
-CHILD_TASK_ID = SOURCE_TASK_ID + "-S1"
-SUPERSESSION_ORDINAL = 1
-REPOSITORY = "aios/aios"
-TARGET_BRANCH = "agent/single-host-trust-root-p0-20260904"
-GENERATION = 1
-SOURCE_BUSINESS_EXECUTION_DIGEST = (
-    "e99bda6a251832eb3865271eb5687af7eea44dd261144cdcdfa57104c0780536"
-)
-EXTERNAL_JOB_IDENTITY = "job-4e10f92a6a5742518a9f1d8745c845ab"
-CANONICAL_PROJECTION_PROFILE = "aios.task-initial-execution.v1"
-CANONICAL_PROJECTION_VERSION = 1
-SUPERSESSION_REASON = "formal-lineage-supersession-after-expired-unclaimed-source"
-DECISION_TTL_SECONDS = 300
-
-HEX64 = re.compile(r"^[0-9a-f]{64}$")
-SAFE_TOKEN = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:@/+:-]{2,511}$")
-
-
-def _fail(code: str) -> None:
-    raise OperationalAuthorityError(code)
-
-
-def _assert_fixed_policy(policy: OperationalPolicy) -> None:
-    """Refuse issuance if the live policy is not the approved source scope."""
-    policy.validate()
-    exact = {
-        "task_id": SOURCE_TASK_ID,
-        "repository": REPOSITORY,
-        "target_branch": TARGET_BRANCH,
-        "generation": GENERATION,
-        "execution_plan_sha256": SOURCE_BUSINESS_EXECUTION_DIGEST,
-        "external_job_identity": EXTERNAL_JOB_IDENTITY,
-    }
-    if any(getattr(policy, field) != expected for field, expected in exact.items()):
-        _fail("TASK_LINEAGE_SUPERSESSION_POLICY_MISMATCH")
-    if policy.maximum_recovery_decision_ttl_seconds < DECISION_TTL_SECONDS:
-        _fail("TASK_LINEAGE_SUPERSESSION_POLICY_TTL_TOO_NARROW")
-
-
-TASK_LINEAGE_SUPERSESSION_FIELDS = {
-    "schema",
-    "decision_id",
-    "nonce",
-    "source_task_id",
-    "source_task_identity_sha256",
-    "source_metadata_sha256",
-    "source_expected_status",
-    "source_expected_revision",
-    "source_expected_attempt",
-    "source_expected_claimed_by",
-    "source_expected_lease_token_hash",
-    "source_expected_lease_expires_at",
-    "repository",
-    "target_branch",
-    "generation",
-    "source_business_execution_digest",
-    "external_job_identity",
-    "child_task_id",
-    "supersession_ordinal",
-    "canonical_projection_profile",
-    "canonical_projection_version",
-    "supersession_reason",
-    "owner_identity",
-    "policy_digest",
-    "one_time_use",
-    "issued_at",
-    "not_before",
-    "expires_at",
-    "signature_namespace",
-    "signature_key_id",
-    "canonical_payload_digest",
-}
-
-
-def verify_task_lineage_supersession_scope(
-    decision: Mapping[str, Any],
-    policy: OperationalPolicy,
-    *,
-    now: int,
-) -> None:
-    """Validate a signature-verified decision against the fixed source scope."""
-    _assert_fixed_policy(policy)
-    if not isinstance(decision, Mapping) or set(decision) != TASK_LINEAGE_SUPERSESSION_FIELDS:
-        _fail("TASK_LINEAGE_SUPERSESSION_FIELDS_INVALID")
-    exact = {
-        "schema": TASK_LINEAGE_SUPERSESSION_SCHEMA,
-        "source_task_id": SOURCE_TASK_ID,
-        "source_expected_status": "EXPIRED",
-        "source_expected_attempt": 0,
-        "source_expected_claimed_by": None,
-        "source_expected_lease_token_hash": None,
-        "source_expected_lease_expires_at": None,
-        "repository": REPOSITORY,
-        "target_branch": TARGET_BRANCH,
-        "generation": GENERATION,
-        "source_business_execution_digest": SOURCE_BUSINESS_EXECUTION_DIGEST,
-        "external_job_identity": EXTERNAL_JOB_IDENTITY,
-        "child_task_id": CHILD_TASK_ID,
-        "supersession_ordinal": SUPERSESSION_ORDINAL,
-        "canonical_projection_profile": CANONICAL_PROJECTION_PROFILE,
-        "canonical_projection_version": CANONICAL_PROJECTION_VERSION,
-        "supersession_reason": SUPERSESSION_REASON,
-        "owner_identity": OWNER_IDENTITY,
-        "policy_digest": policy.digest,
-        "one_time_use": True,
-        "signature_namespace": OWNER_NAMESPACE,
-    }
-    if any(decision.get(field) != expected for field, expected in exact.items()):
-        _fail("TASK_LINEAGE_SUPERSESSION_SCOPE_INVALID")
-    if decision.get("source_task_identity_sha256") != policy.task_identity_sha256:
-        _fail("TASK_LINEAGE_SUPERSESSION_SOURCE_IDENTITY_INVALID")
-    for field in ("source_task_identity_sha256", "source_metadata_sha256"):
-        if not isinstance(decision.get(field), str) or HEX64.fullmatch(decision[field]) is None:
-            _fail("TASK_LINEAGE_SUPERSESSION_DIGEST_INVALID")
-    if type(decision.get("source_expected_revision")) is not int or not 1 <= decision["source_expected_revision"] < 2**63:
-        _fail("TASK_LINEAGE_SUPERSESSION_REVISION_INVALID")
-    for field in ("decision_id", "nonce"):
-        if not isinstance(decision.get(field), str) or SAFE_TOKEN.fullmatch(decision[field]) is None:
-            _fail("TASK_LINEAGE_SUPERSESSION_GENERATED_ID_INVALID")
-    for field in ("issued_at", "not_before", "expires_at"):
-        if type(decision.get(field)) is not int:
-            _fail("TASK_LINEAGE_SUPERSESSION_TIME_INVALID")
-    if not decision["not_before"] <= now < decision["expires_at"]:
-        _fail("TASK_LINEAGE_SUPERSESSION_TIME_INVALID")
-    if decision["issued_at"] > now + 5 or now - decision["issued_at"] > DECISION_TTL_SECONDS:
-        _fail("TASK_LINEAGE_SUPERSESSION_TIME_INVALID")
-    if decision["expires_at"] - decision["issued_at"] != DECISION_TTL_SECONDS:
-        _fail("TASK_LINEAGE_SUPERSESSION_TIME_INVALID")
-    digest_value = dict(decision)
-    supplied_digest = digest_value.pop("canonical_payload_digest", None)
-    if supplied_digest != sha256_json(digest_value):
-        _fail("TASK_LINEAGE_SUPERSESSION_CANONICAL_DIGEST_INVALID")
-
-
-class TaskLineageSupersessionOwnerAuthority(OperationalOwnerAuthority):
-    """Owner signer with one bounded constructor and no caller-defined message."""
-
-    def __init__(
-        self,
-        *args: Any,
-        token_hex: Callable[[int], str] = secrets.token_hex,
-        **kwargs: Any,
-    ) -> None:
-        super().__init__(*args, **kwargs)
-        self._token_hex = token_hex
-
-    def issue_task_lineage_supersession(
-        self,
-        *,
-        source_expected_revision: int,
-        source_task_identity_sha256: str,
-        source_metadata_sha256: str,
-    ) -> SignedOperationalArtifact:
-        _assert_fixed_policy(self.policy)
-        if type(source_expected_revision) is not int or not 1 <= source_expected_revision < 2**63:
-            _fail("TASK_LINEAGE_SUPERSESSION_REVISION_INVALID")
-        if source_task_identity_sha256 != self.policy.task_identity_sha256:
-            _fail("TASK_LINEAGE_SUPERSESSION_SOURCE_IDENTITY_INVALID")
-        if not isinstance(source_metadata_sha256, str) or HEX64.fullmatch(source_metadata_sha256) is None:
-            _fail("TASK_LINEAGE_SUPERSESSION_METADATA_DIGEST_INVALID")
-
-        decision_id = "task-lineage-supersession-" + self._token_hex(16)
-        nonce = "task-lineage-supersession-nonce-" + self._token_hex(16)
-        if SAFE_TOKEN.fullmatch(decision_id) is None or SAFE_TOKEN.fullmatch(nonce) is None:
-            _fail("TASK_LINEAGE_SUPERSESSION_GENERATED_ID_INVALID")
-        now = int(self.clock())
-        payload = {
-            "schema": TASK_LINEAGE_SUPERSESSION_SCHEMA,
-            "decision_id": decision_id,
-            "nonce": nonce,
-            "source_task_id": SOURCE_TASK_ID,
-            "source_task_identity_sha256": source_task_identity_sha256,
-            "source_metadata_sha256": source_metadata_sha256,
-            "source_expected_status": "EXPIRED",
-            "source_expected_revision": source_expected_revision,
-            "source_expected_attempt": 0,
-            "source_expected_claimed_by": None,
-            "source_expected_lease_token_hash": None,
-            "source_expected_lease_expires_at": None,
-            "repository": REPOSITORY,
-            "target_branch": TARGET_BRANCH,
-            "generation": GENERATION,
-            "source_business_execution_digest": SOURCE_BUSINESS_EXECUTION_DIGEST,
-            "external_job_identity": EXTERNAL_JOB_IDENTITY,
-            "child_task_id": CHILD_TASK_ID,
-            "supersession_ordinal": SUPERSESSION_ORDINAL,
-            "canonical_projection_profile": CANONICAL_PROJECTION_PROFILE,
-            "canonical_projection_version": CANONICAL_PROJECTION_VERSION,
-            "supersession_reason": SUPERSESSION_REASON,
-            "owner_identity": OWNER_IDENTITY,
-            "policy_digest": self.policy.digest,
-            "one_time_use": True,
-            "issued_at": now,
-            "not_before": max(0, now - 5),
-            "expires_at": now + DECISION_TTL_SECONDS,
-        }
-        return self._sign(payload)

active-runtime/app/aios_task_lineage_supersession_owner_authority_server.py

@@ -1,190 +0,0 @@
-"""Staging-only server overlay for the fixed lineage Owner operation."""
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-from pathlib import Path
-import sqlite3
-import time
-from typing import Any, Callable, Mapping
-
-from aios_single_host_authority import DEFAULT_REGISTRY_PATH
-from aios_single_host_operational_authority import (
-    OperationalMachineAuthority,
-    OperationalVerifier,
-)
-from aios_single_host_operational_authority_server import (
-    DEFAULT_LEDGER,
-    DEFAULT_MACHINE_KEY,
-    DEFAULT_OWNER_KEY,
-    DEFAULT_POLICY,
-    DurableIssuanceLedger,
-    OperationalAuthorityService as BaseOperationalAuthorityService,
-    _read_policy,
-    fail,
-)
-from aios_task_lineage_supersession_owner_authority import (
-    TASK_LINEAGE_SUPERSESSION_OPERATION,
-    TaskLineageSupersessionOwnerAuthority,
-)
-
-REQUEST_FIELDS = {
-    "source_expected_revision",
-    "source_task_identity_sha256",
-    "source_metadata_sha256",
-}
-
-
-class TaskLineageSupersessionIssuanceLedger(DurableIssuanceLedger):
-    """Operation-scoped one-time fence layered on the existing durable ledger."""
-
-    def issue_once(
-        self,
-        *,
-        role: str,
-        operation: str,
-        request: Mapping[str, Any],
-        issuer: Callable[[], dict[str, Any]],
-    ) -> dict[str, Any]:
-        request_sha = hashlib.sha256(
-            json.dumps(
-                request,
-                sort_keys=True,
-                separators=(",", ":"),
-                ensure_ascii=False,
-                allow_nan=False,
-            ).encode("utf-8")
-        ).hexdigest()
-        connection = sqlite3.connect(self.path, timeout=5, isolation_level=None)
-        try:
-            connection.execute("BEGIN IMMEDIATE")
-            existing = connection.execute(
-                "SELECT 1 FROM issuance WHERE role=? AND operation=? LIMIT 1",
-                (role, operation),
-            ).fetchone()
-            if existing is not None:
-                connection.rollback()
-                fail("TASK_LINEAGE_SUPERSESSION_ALREADY_ISSUED")
-            result = issuer()
-            artifact = result.get("artifact")
-            nonce = artifact.get("payload", {}).get("nonce") if isinstance(artifact, Mapping) else None
-            if not isinstance(nonce, str) or not nonce:
-                connection.rollback()
-                fail("TASK_LINEAGE_SUPERSESSION_ISSUER_RESULT_INVALID")
-            encoded = json.dumps(
-                result,
-                sort_keys=True,
-                separators=(",", ":"),
-                ensure_ascii=False,
-                allow_nan=False,
-            )
-            connection.execute(
-                "INSERT INTO issuance(role,operation,nonce,request_sha256,response_json,created_at) "
-                "VALUES(?,?,?,?,?,?)",
-                (role, operation, nonce, request_sha, encoded, int(time.time())),
-            )
-            connection.commit()
-            return result
-        except sqlite3.IntegrityError:
-            connection.rollback()
-            fail("ISSUANCE_LEDGER_RACE")
-        except Exception:
-            connection.rollback()
-            raise
-        finally:
-            connection.close()
-
-
-class OperationalAuthorityService(BaseOperationalAuthorityService):
-    """Preserve all existing operations and add one exact Owner-only operation."""
-
-    def __init__(self, *args: Any, token_hex=None, **kwargs: Any) -> None:
-        super().__init__(*args, **kwargs)
-        self.ledger = TaskLineageSupersessionIssuanceLedger(self.ledger.path)
-        self._token_hex = token_hex
-
-    def _components(self):
-        policy = _read_policy(
-            self.policy_path,
-            require_root_owner=self.require_root_owner,
-        )
-        verifier = OperationalVerifier(
-            self.registry_path,
-            require_root_owner=self.require_root_owner,
-        )
-        if self.role == "owner":
-            kwargs = {}
-            if self._token_hex is not None:
-                kwargs["token_hex"] = self._token_hex
-            signer = TaskLineageSupersessionOwnerAuthority(
-                self.owner_key_path,
-                policy,
-                require_root_owner=self.require_root_owner,
-                clock=self.clock,
-                **kwargs,
-            )
-        else:
-            signer = OperationalMachineAuthority(
-                self.machine_key_path,
-                policy,
-                require_root_owner=self.require_root_owner,
-                clock=self.clock,
-            )
-        return policy, verifier, signer
-
-    def handle(self, request: Mapping[str, Any], *, peer_uid: int) -> dict[str, Any]:
-        if peer_uid not in self.allowed_uids:
-            fail("PEER_UID_FORBIDDEN")
-        if not isinstance(request, Mapping) or set(request) != {"operation", "payload"}:
-            fail("REQUEST_INVALID")
-        if request.get("operation") != TASK_LINEAGE_SUPERSESSION_OPERATION:
-            return super().handle(request, peer_uid=peer_uid)
-        if self.role != "owner":
-            fail("MACHINE_OPERATION_FORBIDDEN")
-        payload = request.get("payload")
-        if not isinstance(payload, Mapping) or set(payload) != REQUEST_FIELDS:
-            fail("REQUEST_FIELDS_INVALID")
-        _policy, _verifier, signer = self._components()
-
-        def issue() -> dict[str, Any]:
-            artifact = signer.issue_task_lineage_supersession(
-                source_expected_revision=payload["source_expected_revision"],
-                source_task_identity_sha256=payload["source_task_identity_sha256"],
-                source_metadata_sha256=payload["source_metadata_sha256"],
-            )
-            return {"status": "PASS", "artifact": artifact.to_dict()}
-
-        return self.ledger.issue_once(
-            role=self.role,
-            operation=TASK_LINEAGE_SUPERSESSION_OPERATION,
-            request=payload,
-            issuer=issue,
-        )
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--role", choices=("owner", "machine"), required=True)
-    parser.add_argument("--policy", default=str(DEFAULT_POLICY))
-    parser.add_argument("--registry", default=str(DEFAULT_REGISTRY_PATH))
-    parser.add_argument("--owner-key", default=str(DEFAULT_OWNER_KEY))
-    parser.add_argument("--machine-key", default=str(DEFAULT_MACHINE_KEY))
-    parser.add_argument("--socket")
-    parser.add_argument("--ledger", default=str(DEFAULT_LEDGER))
-    arguments = parser.parse_args()
-    service = OperationalAuthorityService(
-        role=arguments.role,
-        policy_path=Path(arguments.policy),
-        registry_path=Path(arguments.registry),
-        owner_key_path=Path(arguments.owner_key),
-        machine_key_path=Path(arguments.machine_key),
-        socket_path=Path(arguments.socket) if arguments.socket else None,
-        ledger_path=Path(arguments.ledger),
-    )
-    service.serve_forever()
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

active-runtime/app/aios_trusted_candidate_builder.py

@@ -1,798 +0,0 @@
-#!/usr/bin/env python3
-"""Fail-closed AF_UNIX builder for server-owned trusted candidate evidence."""
-from __future__ import annotations
-
-import argparse
-import base64
-import hashlib
-import hmac
-import json
-import os
-import secrets
-import socket
-import stat
-import struct
-import subprocess
-import time
-from datetime import datetime, timezone
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol
-
-
-class BuilderError(RuntimeError):
-    """A stable, non-sensitive error code returned by the builder boundary."""
-
-
-def _canonical_json(value: Mapping[str, Any]) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode("utf-8")
-
-
-def _sha256(*parts: str) -> str:
-    return hashlib.sha256("\0".join(parts).encode("utf-8")).hexdigest()
-
-
-@dataclass(frozen=True)
-class PeerIdentity:
-    pid: int
-    uid: int
-    gid: int
-
-
-class DomainPurposeSigner(Protocol):
-    """A signer deliberately limited to the builder's one domain purpose."""
-
-    @property
-    def key_id(self) -> str:
-        ...
-
-    @property
-    def key_generation(self) -> int:
-        ...
-
-    def sign_for_purpose(self, purpose: str, payload: bytes) -> bytes:
-        ...
-
-
-class CredentialPathEd25519Signer:
-    """Reads a systemd-mounted credential path; never exports or logs key bytes."""
-
-    def __init__(self, credential_path: Path, *, key_id: str, key_generation: int, allowed_purpose: str):
-        self._credential_path = Path(credential_path)
-        self._key_id = str(key_id)
-        self._key_generation = key_generation
-        self._allowed_purpose = str(allowed_purpose)
-        if not self._key_id or not isinstance(key_generation, int) or key_generation < 1:
-            raise BuilderError("SIGNING_IDENTITY_INVALID")
-        if not self._credential_path.is_file():
-            raise BuilderError("SIGNING_CREDENTIAL_UNAVAILABLE")
-        try:
-            from cryptography.hazmat.primitives.serialization import load_pem_private_key
-            from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
-            self._private_key = load_pem_private_key(self._credential_path.read_bytes(), password=None)
-            if not isinstance(self._private_key, Ed25519PrivateKey):
-                raise TypeError("signing key is not Ed25519")
-        except Exception as exc:  # do not expose parse/key material details
-            raise BuilderError("SIGNING_CREDENTIAL_INVALID") from exc
-
-    @property
-    def key_id(self) -> str:
-        return self._key_id
-
-    @property
-    def key_generation(self) -> int:
-        return self._key_generation
-
-    def sign_for_purpose(self, purpose: str, payload: bytes) -> bytes:
-        if purpose != self._allowed_purpose:
-            raise BuilderError("SIGNING_PURPOSE_DENIED")
-        return self._private_key.sign(payload)
-
-
-@dataclass(frozen=True)
-class BuilderKeyring:
-    builder_hmac: bytes
-    signing_private_key_path: Path | None = None
-
-    def __post_init__(self) -> None:
-        if len(self.builder_hmac) < 32:
-            raise BuilderError("BUILDER_HMAC_INVALID")
-
-    @classmethod
-    def from_credentials_directory(cls, credentials_directory: Path) -> "BuilderKeyring":
-        root = Path(credentials_directory)
-        hmac_path = root / "builder_hmac"
-        signing_path = root / "signing_private_key"
-        try:
-            secret = hmac_path.read_bytes().strip()
-        except OSError as exc:
-            raise BuilderError("BUILDER_HMAC_UNAVAILABLE") from exc
-        if not signing_path.is_file():
-            raise BuilderError("SIGNING_CREDENTIAL_UNAVAILABLE")
-        return cls(builder_hmac=secret, signing_private_key_path=signing_path)
-
-
-@dataclass(frozen=True)
-class TrustedCandidateBuilderConfig:
-    policy_schema: str
-    repository: str
-    request_schema: str
-    response_schema: str
-    operation: str
-    readiness_operation: str
-    maximum_request_age_seconds: int
-    request_timeout_seconds: int
-    allowed_peer_uid: int
-    allowed_peer_cgroups: tuple[str, ...]
-    allowed_peer_executable_prefix: str
-    allowed_peer_runtime_prefix: str
-    allowed_peer_runtime_suffix: str
-    required_checks: tuple[str, ...]
-    evidence_layout: Mapping[str, str]
-    recipes: Mapping[str, Mapping[str, str]]
-    governed_recipes: Mapping[str, Mapping[str, str]]
-    policy_sha256: str
-
-    @classmethod
-    def from_policy(cls, policy: Mapping[str, Any]) -> "TrustedCandidateBuilderConfig":
-        required = {
-            "schema", "repository", "request_schema", "response_schema", "operation",
-            "readiness_operation", "maximum_request_age_seconds", "request_timeout_seconds",
-            "allowed_peer_uid", "allowed_peer_cgroups", "allowed_peer_executable_prefix",
-            "allowed_peer_runtime_prefix", "allowed_peer_runtime_suffix",
-            "required_checks", "evidence_layout", "recipes", "governed_recipes",
-        }
-        if set(policy) != required or policy.get("schema") != "aios.trusted-candidate-builder-policy.v1":
-            raise BuilderError("POLICY_SCHEMA_INVALID")
-        recipes = policy.get("recipes")
-        if not isinstance(recipes, Mapping) or set(recipes) != {"V2R2C2", "V2R2C3"}:
-            raise BuilderError("POLICY_RECIPES_INVALID")
-        c2, c3 = recipes["V2R2C2"], recipes["V2R2C3"]
-        if not isinstance(c2, Mapping) or set(c2) != {"mode", "task_id", "candidate_id", "base_oid", "source_commit", "version", "purpose"} or c2.get("mode") != "fixed":
-            raise BuilderError("POLICY_V2R2C2_INVALID")
-        if not isinstance(c3, Mapping) or set(c3) != {"mode", "derives_from", "version", "purpose"} or c3.get("mode") != "governed-derived-only" or c3.get("derives_from") != "V2R2C2":
-            raise BuilderError("POLICY_V2R2C3_INVALID")
-        if (
-            policy["repository"] != "aios/aios"
-            or policy["operation"] != "BuildTrustedCandidateV1"
-            or policy["readiness_operation"] != "ProbeTrustedCandidateBuilderV1"
-        ):
-            raise BuilderError("POLICY_SCOPE_INVALID")
-        if not isinstance(policy["maximum_request_age_seconds"], int) or not 1 <= policy["maximum_request_age_seconds"] <= 300:
-            raise BuilderError("POLICY_FRESHNESS_INVALID")
-        if not isinstance(policy["request_timeout_seconds"], int) or not 1 <= policy["request_timeout_seconds"] <= 120:
-            raise BuilderError("POLICY_TIMEOUT_INVALID")
-        if not isinstance(policy["allowed_peer_uid"], int) or policy["allowed_peer_uid"] != 1000:
-            raise BuilderError("POLICY_PEER_UID_INVALID")
-        cgroups, checks = policy["allowed_peer_cgroups"], policy["required_checks"]
-        if not isinstance(cgroups, list) or not cgroups or not all(isinstance(value, str) and value.startswith("/") for value in cgroups):
-            raise BuilderError("POLICY_CGROUPS_INVALID")
-        for field in (
-            "allowed_peer_executable_prefix",
-            "allowed_peer_runtime_prefix",
-            "allowed_peer_runtime_suffix",
-        ):
-            if not isinstance(policy[field], str) or not policy[field].startswith("/"):
-                raise BuilderError("POLICY_PROCESS_IDENTITY_INVALID")
-        if not isinstance(checks, list) or not checks or len(set(checks)) != len(checks) or not all(isinstance(value, str) for value in checks):
-            raise BuilderError("POLICY_CHECKS_INVALID")
-        layout = policy["evidence_layout"]
-        evidence_names = {
-            "artifact", "manifest", "package_closure", "tests", "canary",
-            "gitea", "rollback", "policy", "secret_scan",
-        }
-        if (
-            not isinstance(layout, Mapping)
-            or set(layout) != evidence_names
-            or not all(
-                isinstance(value, str)
-                and value.startswith("{version}/")
-                and ".." not in Path(value).parts
-                and not Path(value).is_absolute()
-                for value in layout.values()
-            )
-        ):
-            raise BuilderError("POLICY_EVIDENCE_LAYOUT_INVALID")
-        return cls(
-            policy_schema=str(policy["schema"]), repository=str(policy["repository"]),
-            request_schema=str(policy["request_schema"]), response_schema=str(policy["response_schema"]),
-            operation=str(policy["operation"]), readiness_operation=str(policy["readiness_operation"]),
-            maximum_request_age_seconds=policy["maximum_request_age_seconds"],
-            request_timeout_seconds=policy["request_timeout_seconds"],
-            allowed_peer_uid=policy["allowed_peer_uid"], allowed_peer_cgroups=tuple(cgroups),
-            allowed_peer_executable_prefix=policy["allowed_peer_executable_prefix"],
-            allowed_peer_runtime_prefix=policy["allowed_peer_runtime_prefix"],
-            allowed_peer_runtime_suffix=policy["allowed_peer_runtime_suffix"],
-            required_checks=tuple(checks), evidence_layout=dict(layout),
-            recipes={name: dict(value) for name, value in recipes.items()},
-            governed_recipes={name: dict(value) for name, value in policy["governed_recipes"].items()} if isinstance(policy["governed_recipes"], Mapping) else _invalid_governed_recipes(),
-            policy_sha256=hashlib.sha256(_canonical_json(dict(policy))).hexdigest(),
-        )
-
-    def fixed_recipe(self, name: str) -> Mapping[str, str]:
-        recipe = self.recipes.get(name)
-        if recipe is None:
-            raise BuilderError("RECIPE_UNKNOWN")
-        if recipe["mode"] == "governed-derived-only":
-            derived = self.governed_recipes.get(name)
-            required = {"mode", "task_id", "candidate_id", "base_oid", "source_commit", "version", "purpose", "derived_from_v2r2c2_attestation", "builder_engineering_oid"}
-            if not isinstance(derived, Mapping) or set(derived) != required or derived.get("mode") != "governed-derived" or derived.get("version") != name or derived.get("purpose") != recipe.get("purpose"):
-                raise BuilderError("GOVERNED_V2R2C3_DERIVATION_REQUIRED")
-            for name in ("base_oid", "source_commit", "builder_engineering_oid"):
-                value = derived.get(name)
-                if not isinstance(value, str) or len(value) != 40 or any(char not in "0123456789abcdef" for char in value.lower()):
-                    raise BuilderError("GOVERNED_V2R2C3_DERIVATION_REQUIRED")
-            return dict(derived)
-        return recipe
-
-    def resolve_recipe(self, version: str, candidate_id: str | None, source_commit: str) -> Mapping[str, str]:
-        recipe = self.fixed_recipe(version)
-        # Intent-only callers do not choose a candidate identity.  The
-        # policy-owned recipe supplies it; explicit worker requests are
-        # still checked against the same immutable recipe.
-        effective_candidate_id = str(candidate_id or recipe.get("candidate_id") or "")
-        if {"version": recipe.get("version"), "candidate_id": recipe.get("candidate_id"), "source_commit": recipe.get("source_commit")} != {"version": version, "candidate_id": effective_candidate_id, "source_commit": source_commit}:
-            raise BuilderError("REQUEST_RELEASE_BINDING_INVALID")
-        return recipe
-
-
-def _invalid_governed_recipes() -> Mapping[str, Mapping[str, str]]:
-    raise BuilderError("POLICY_GOVERNED_RECIPES_INVALID")
-
-
-def load_builder_policy(path: Path) -> Mapping[str, Any]:
-    try:
-        decoded = json.loads(Path(path).read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError) as exc:
-        raise BuilderError("POLICY_UNAVAILABLE") from exc
-    if not isinstance(decoded, Mapping):
-        raise BuilderError("POLICY_SCHEMA_INVALID")
-    TrustedCandidateBuilderConfig.from_policy(decoded)
-    return decoded
-
-
-class ServerOwnedEvidenceSource:
-    """Recomputes a fixed on-host evidence closure without caller-owned paths."""
-
-    def __init__(
-        self,
-        config: TrustedCandidateBuilderConfig,
-        authority_git_dir: Path,
-        evidence_root: Path,
-        *,
-        expected_owner_uid: int | None = 0,
-        git_runner: Callable[..., Any] = subprocess.run,
-    ):
-        self._config = config
-        self._authority_git_dir = Path(authority_git_dir)
-        self._evidence_root = Path(evidence_root)
-        self._expected_owner_uid = expected_owner_uid
-        self._git_runner = git_runner
-
-    def _regular_path(self, relative: str) -> Path:
-        root = self._evidence_root.resolve(strict=True)
-        candidate = self._evidence_root / relative
-        current = self._evidence_root
-        for part in Path(relative).parts:
-            current = current / part
-            if current.is_symlink():
-                raise BuilderError("COLLECTOR_SYMLINK_DENIED")
-        try:
-            resolved = candidate.resolve(strict=True)
-            resolved.relative_to(root)
-            metadata = resolved.stat(follow_symlinks=False)
-        except (OSError, ValueError) as exc:
-            raise BuilderError("COLLECTOR_EVIDENCE_UNAVAILABLE") from exc
-        if not stat.S_ISREG(metadata.st_mode):
-            raise BuilderError("COLLECTOR_SPECIAL_FILE_DENIED")
-        if os.name != "nt" and metadata.st_mode & 0o022:
-            raise BuilderError("COLLECTOR_EVIDENCE_MODE_DENIED")
-        if (
-            os.name != "nt"
-            and
-            self._expected_owner_uid is not None
-            and metadata.st_uid != self._expected_owner_uid
-        ):
-            raise BuilderError("COLLECTOR_EVIDENCE_OWNER_DENIED")
-        return resolved
-
-    def _digest(self, path: Path) -> str:
-        digest = hashlib.sha256()
-        with path.open("rb") as handle:
-            for chunk in iter(lambda: handle.read(1024 * 1024), b""):
-                digest.update(chunk)
-        return digest.hexdigest()
-
-    def _json(self, path: Path) -> Mapping[str, Any]:
-        try:
-            if path.stat().st_size > 2 * 1024 * 1024:
-                raise BuilderError("COLLECTOR_EVIDENCE_SIZE_INVALID")
-            value = json.loads(path.read_text(encoding="utf-8"))
-        except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID") from exc
-        if not isinstance(value, Mapping):
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        return value
-
-    def __call__(self, recipe_name: str, recipe: Mapping[str, str]) -> Mapping[str, Any]:
-        try:
-            tree_result = self._git_runner(
-                ["git", f"--git-dir={self._authority_git_dir}", "rev-parse", f"{recipe['source_commit']}^{{tree}}"],
-                check=True, capture_output=True, text=True, timeout=15,
-                env={"PATH": os.environ.get("PATH", "")},
-            )
-            ancestry_result = self._git_runner(
-                ["git", f"--git-dir={self._authority_git_dir}", "merge-base", "--is-ancestor", recipe["base_oid"], recipe["source_commit"]],
-                check=False, capture_output=True, text=True, timeout=15,
-                env={"PATH": os.environ.get("PATH", "")},
-            )
-            tree_oid = tree_result.stdout.strip().lower()
-        except (OSError, subprocess.SubprocessError) as exc:
-            raise BuilderError("COLLECTOR_EVIDENCE_UNAVAILABLE") from exc
-        if getattr(ancestry_result, "returncode", 1) != 0:
-            raise BuilderError("COLLECTOR_GIT_MISMATCH")
-
-        receipt = self._json(self._regular_path(f"{recipe_name}/receipt.json"))
-        if set(receipt) != {"schema", "version", "candidate", "release_plan"}:
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        if (
-            receipt.get("schema") != "aios.trusted-candidate-builder.evidence.v1"
-            or receipt.get("version") != recipe_name
-        ):
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        candidate = receipt.get("candidate")
-        release_plan = receipt.get("release_plan")
-        if not isinstance(candidate, Mapping) or not isinstance(release_plan, Mapping):
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        if (
-            candidate.get("candidate_id") != recipe["candidate_id"]
-            or candidate.get("source_commit") != recipe["source_commit"]
-            or candidate.get("tree_oid") != tree_oid
-        ):
-            raise BuilderError("COLLECTOR_GIT_MISMATCH")
-        git_consistency = candidate.get("git_consistency")
-        if (
-            not isinstance(git_consistency, Mapping)
-            or git_consistency.get("consistent") is not True
-            or git_consistency.get("source_commit") != recipe["source_commit"]
-            or git_consistency.get("tree_oid") != tree_oid
-            or git_consistency.get("repository") != self._config.repository
-        ):
-            raise BuilderError("COLLECTOR_GIT_MISMATCH")
-
-        paths = {
-            name: self._regular_path(template.format(version=recipe_name))
-            for name, template in self._config.evidence_layout.items()
-        }
-        deployment = release_plan.get("deployment")
-        if not isinstance(deployment, Mapping):
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        digests = {name: self._digest(path) for name, path in paths.items()}
-        if (
-            digests["artifact"] != candidate.get("artifact_sha256")
-            or digests["manifest"] != candidate.get("manifest_sha256")
-            or digests["package_closure"] != deployment.get("package_closure_sha256")
-            or digests["policy"] != release_plan.get("policy_sha256")
-            or digests["policy"] != deployment.get("policy_sha256")
-        ):
-            raise BuilderError("COLLECTOR_DIGEST_MISMATCH")
-
-        tests = self._json(paths["tests"])
-        canary = self._json(paths["canary"])
-        gitea = self._json(paths["gitea"])
-        rollback = self._json(paths["rollback"])
-        secret_scan = self._json(paths["secret_scan"])
-        if tests != candidate.get("tests") or tests.get("passed") is not True:
-            raise BuilderError("COLLECTOR_TESTS_MISMATCH")
-        if canary != candidate.get("canary") or canary.get("passed") is not True:
-            raise BuilderError("COLLECTOR_CANARY_MISMATCH")
-        if (
-            digests["tests"] != hashlib.sha256(_canonical_json(dict(tests))).hexdigest()
-            or digests["canary"] != hashlib.sha256(_canonical_json(dict(canary))).hexdigest()
-        ):
-            raise BuilderError("COLLECTOR_EVIDENCE_CANONICALIZATION_MISMATCH")
-        if (
-            gitea != candidate.get("gitea_consistency")
-            or gitea.get("consistent") is not True
-            or gitea.get("repository") != self._config.repository
-            or gitea.get("source_commit") != recipe["source_commit"]
-            or gitea.get("tree_oid") != tree_oid
-            or gitea.get("remote_ref_oid") != recipe["source_commit"]
-        ):
-            raise BuilderError("COLLECTOR_GITEA_MISMATCH")
-        if (
-            candidate.get("rollback_ready") is not True
-            or rollback.get("ready") is not True
-            or rollback.get("source_commit") != recipe["source_commit"]
-            or rollback.get("rollback_sha256") != deployment.get("rollback_sha256")
-        ):
-            raise BuilderError("COLLECTOR_ROLLBACK_MISMATCH")
-        if (
-            digests["gitea"] != hashlib.sha256(_canonical_json(dict(gitea))).hexdigest()
-            or digests["rollback"] != hashlib.sha256(_canonical_json(dict(rollback))).hexdigest()
-        ):
-            raise BuilderError("COLLECTOR_EVIDENCE_CANONICALIZATION_MISMATCH")
-        if (
-            secret_scan.get("passed") is not True
-            or secret_scan.get("artifact_sha256") != candidate.get("artifact_sha256")
-        ):
-            raise BuilderError("COLLECTOR_SECRET_SCAN_MISMATCH")
-        checks = {name: True for name in self._config.required_checks}
-        return {
-            "candidate": dict(candidate),
-            "release_plan": dict(release_plan),
-            "checks": checks,
-            "evidence_digests": digests,
-        }
-
-
-class DeterministicEvidenceCollector:
-    """Validates a server-owned source; request fields never influence collection."""
-
-    _BUNDLE_FIELDS = {"candidate", "release_plan", "checks", "evidence_digests"}
-
-    def __init__(self, config: TrustedCandidateBuilderConfig, *, evidence_source: Callable[[str, Mapping[str, str]], Mapping[str, Any]] | None = None):
-        self._config = config
-        self._evidence_source = evidence_source
-
-    def collect(self, recipe_name: str, recipe: Mapping[str, str]) -> Mapping[str, Any]:
-        if self._evidence_source is None:
-            raise BuilderError("COLLECTOR_UNCONFIGURED")
-        bundle = self._evidence_source(recipe_name, recipe)
-        if not isinstance(bundle, Mapping) or set(bundle) != self._BUNDLE_FIELDS:
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        raw_checks = bundle.get("checks")
-        if (
-            not isinstance(raw_checks, Mapping)
-            or set(raw_checks) != set(self._config.required_checks)
-            or any(raw_checks.get(name) is not True for name in self._config.required_checks)
-        ):
-            raise BuilderError("COLLECTOR_CHECKS_INCOMPLETE")
-        evidence_digests = bundle.get("evidence_digests")
-        if (
-            not isinstance(evidence_digests, Mapping)
-            or set(evidence_digests) != set(self._config.evidence_layout)
-            or any(
-                not isinstance(value, str)
-                or len(value) != 64
-                or any(char not in "0123456789abcdef" for char in value.lower())
-                for value in evidence_digests.values()
-            )
-        ):
-            raise BuilderError("COLLECTOR_EVIDENCE_DIGESTS_INVALID")
-        try:
-            from silent_release_controller import ReleaseCandidate
-            from silent_release_hardening import ReleasePlan, TrustedCandidateBundle
-
-            candidate = ReleaseCandidate.from_dict(dict(bundle["candidate"]))
-            release_plan = ReleasePlan.from_dict(dict(bundle["release_plan"]))
-            checks = dict(raw_checks)
-            TrustedCandidateBundle(candidate, release_plan, checks).validate()
-        except (ImportError, KeyError, TypeError, ValueError, RuntimeError) as exc:
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID") from exc
-        if candidate.source_commit != recipe["source_commit"] or candidate.candidate_id != recipe["candidate_id"]:
-            raise BuilderError("COLLECTOR_SOURCE_MISMATCH")
-        return {
-            "candidate": candidate.to_dict(),
-            "release_plan": release_plan.to_dict(),
-            "checks": checks,
-            "evidence_digests": dict(evidence_digests),
-        }
-
-
-def _extract_peer_identity(connection: socket.socket) -> PeerIdentity:
-    if not hasattr(socket, "SO_PEERCRED"):
-        raise BuilderError("SO_PEERCRED_UNAVAILABLE")
-    raw = connection.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, struct.calcsize("3i"))
-    if len(raw) != struct.calcsize("3i"):
-        raise BuilderError("SO_PEERCRED_INVALID")
-    return PeerIdentity(*struct.unpack("3i", raw))
-
-
-def _resolve_cgroups(pid: int) -> tuple[str, ...]:
-    try:
-        return tuple(
-            line.rsplit(":", 1)[1].strip()
-            for line in Path(f"/proc/{pid}/cgroup").read_text(encoding="utf-8").splitlines()
-            if ":" in line and line.rsplit(":", 1)[1].strip().startswith("/")
-        )
-    except OSError as exc:
-        raise BuilderError("PEER_CGROUP_UNAVAILABLE") from exc
-
-
-def _resolve_process_identity(pid: int) -> tuple[str, tuple[str, ...]]:
-    try:
-        executable = os.path.realpath(f"/proc/{pid}/exe")
-        argv = tuple(
-            item.decode("utf-8", "strict")
-            for item in Path(f"/proc/{pid}/cmdline").read_bytes().split(b"\0")
-            if item
-        )
-    except (OSError, UnicodeDecodeError) as exc:
-        raise BuilderError("PEER_PROCESS_UNAVAILABLE") from exc
-    if not executable or not argv:
-        raise BuilderError("PEER_PROCESS_UNAVAILABLE")
-    return executable, argv
-
-
-class TrustedCandidateBuilder:
-    def __init__(
-        self, config: TrustedCandidateBuilderConfig, keyring: BuilderKeyring, *,
-        collector: DeterministicEvidenceCollector, signer: DomainPurposeSigner,
-        peer_identity_resolver: Callable[[socket.socket], PeerIdentity] = _extract_peer_identity,
-        cgroup_resolver: Callable[[int], tuple[str, ...] | str] = _resolve_cgroups,
-        process_identity_resolver: Callable[[int], tuple[str, tuple[str, ...]]] = _resolve_process_identity,
-        clock: Callable[[], float] = time.time, nonce_ledger_path: Path | None = None,
-    ) -> None:
-        self.config, self.keyring, self.collector, self.signer = config, keyring, collector, signer
-        self.peer_identity_resolver, self.cgroup_resolver, self.clock = peer_identity_resolver, cgroup_resolver, clock
-        self.process_identity_resolver = process_identity_resolver
-        self._nonce_ledger_path = Path(nonce_ledger_path) if nonce_ledger_path else None
-        self._nonce_ledger: dict[str, tuple[bytes, dict[str, Any]]] = self._load_nonce_ledger()
-
-    def _load_nonce_ledger(self) -> dict[str, tuple[bytes, dict[str, Any]]]:
-        if self._nonce_ledger_path is None or not self._nonce_ledger_path.exists():
-            return {}
-        if self._nonce_ledger_path.is_symlink():
-            raise BuilderError("NONCE_LEDGER_INVALID")
-        try:
-            raw = json.loads(self._nonce_ledger_path.read_text(encoding="utf-8"))
-            return {nonce: (bytes.fromhex(value["request_sha256"]), dict(value["result"])) for nonce, value in raw.items()}
-        except (OSError, ValueError, TypeError, KeyError, json.JSONDecodeError) as exc:
-            raise BuilderError("NONCE_LEDGER_INVALID") from exc
-
-    def _persist_nonce_ledger(self) -> None:
-        if self._nonce_ledger_path is None:
-            return
-        try:
-            self._nonce_ledger_path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
-            temporary = self._nonce_ledger_path.with_suffix(".tmp")
-            payload = {nonce: {"request_sha256": digest.hex(), "result": result} for nonce, (digest, result) in self._nonce_ledger.items()}
-            with temporary.open("wb") as handle:
-                handle.write(_canonical_json(payload))
-                handle.flush()
-                os.fsync(handle.fileno())
-            os.chmod(temporary, 0o600)
-            os.replace(temporary, self._nonce_ledger_path)
-            if os.name != "nt":
-                descriptor = os.open(self._nonce_ledger_path.parent, os.O_RDONLY)
-                try:
-                    os.fsync(descriptor)
-                finally:
-                    os.close(descriptor)
-        except OSError as exc:
-            raise BuilderError("NONCE_LEDGER_PERSIST_FAILED") from exc
-
-    def _verify_peer(self, connection: socket.socket) -> None:
-        peer = self.peer_identity_resolver(connection)
-        if peer.uid != self.config.allowed_peer_uid or peer.pid <= 0:
-            raise BuilderError("PEER_IDENTITY_DENIED")
-        resolved = self.cgroup_resolver(peer.pid)
-        cgroups = (resolved,) if isinstance(resolved, str) else tuple(resolved)
-        if not cgroups or not any(item in self.config.allowed_peer_cgroups for item in cgroups):
-            raise BuilderError("PEER_CGROUP_DENIED")
-        executable, argv = self.process_identity_resolver(peer.pid)
-        if not executable.startswith(self.config.allowed_peer_executable_prefix):
-            raise BuilderError("PEER_PROCESS_DENIED")
-        runtime_arguments = [
-            value
-            for value in argv
-            if value.startswith(self.config.allowed_peer_runtime_prefix)
-            and value.endswith(self.config.allowed_peer_runtime_suffix)
-        ]
-        if len(runtime_arguments) != 1:
-            raise BuilderError("PEER_PROCESS_DENIED")
-
-    def handle_request(self, request: Mapping[str, Any], *, connection: socket.socket) -> dict[str, Any]:
-        if not isinstance(request, Mapping):
-            raise BuilderError("REQUEST_SCHEMA_INVALID")
-        expected_keys = {"schema", "operation", "recipe", "repository", "task_id", "candidate_id", "base_oid", "source_commit", "version", "purpose", "issued_at", "nonce", "hmac"}
-        if (
-            set(request) != expected_keys
-            or request.get("schema") != self.config.request_schema
-            or request.get("operation") not in {
-                self.config.operation,
-                self.config.readiness_operation,
-            }
-        ):
-            raise BuilderError("REQUEST_SCHEMA_INVALID")
-        supplied_mac = request.get("hmac")
-        unsigned = {key: value for key, value in request.items() if key != "hmac"}
-        if not isinstance(supplied_mac, str) or not hmac.compare_digest(hmac.new(self.keyring.builder_hmac, _canonical_json(unsigned), hashlib.sha256).hexdigest(), supplied_mac):
-            raise BuilderError("REQUEST_HMAC_INVALID")
-        issued_at, nonce = request.get("issued_at"), request.get("nonce")
-        if not isinstance(issued_at, int) or not isinstance(nonce, str) or len(nonce) < 16 or len(nonce) > 256:
-            raise BuilderError("REQUEST_SCHEMA_INVALID")
-        self._verify_peer(connection)
-        request_bytes = _canonical_json(dict(request))
-        replay = self._nonce_ledger.get(nonce)
-        if replay is not None:
-            if hmac.compare_digest(replay[0], hashlib.sha256(request_bytes).digest()):
-                return dict(replay[1])
-            raise BuilderError("REPLAY_CONFLICT")
-        if abs(int(self.clock()) - issued_at) > self.config.maximum_request_age_seconds:
-            raise BuilderError("REQUEST_STALE")
-        recipe_name = request.get("recipe")
-        if not isinstance(recipe_name, str):
-            raise BuilderError("REQUEST_SCHEMA_INVALID")
-        recipe = self.config.resolve_recipe(str(request.get("version") or ""), str(request.get("candidate_id") or ""), str(request.get("source_commit") or ""))
-        if recipe_name != recipe.get("version"):
-            raise BuilderError("REQUEST_RELEASE_BINDING_INVALID")
-        bound = {"repository": self.config.repository, "task_id": recipe["task_id"], "candidate_id": recipe["candidate_id"], "base_oid": recipe["base_oid"], "source_commit": recipe["source_commit"], "version": recipe["version"], "purpose": recipe["purpose"]}
-        if {key: request.get(key) for key in bound} != bound:
-            raise BuilderError("REQUEST_SCOPE_INVALID")
-        bundle = dict(self.collector.collect(recipe_name, recipe))
-        candidate = bundle["candidate"]
-        release_plan = bundle["release_plan"]
-        checks = bundle.get("checks")
-        evidence_digests = bundle["evidence_digests"]
-        if not isinstance(checks, Mapping) or set(checks) != set(self.config.required_checks) or not all(value is True for value in checks.values()):
-            raise BuilderError("COLLECTOR_CHECKS_INCOMPLETE")
-        if request["operation"] == self.config.readiness_operation:
-            result = {
-                "schema": self.config.response_schema,
-                "status": "READY",
-                "repository": self.config.repository,
-                "recipe": recipe_name,
-                "candidate_id": recipe["candidate_id"],
-                "source_commit": recipe["source_commit"],
-                "builder_key_id": self.signer.key_id,
-                "builder_key_generation": self.signer.key_generation,
-                "signature_algorithm": "Ed25519",
-                "signature_purpose": "AIOS_TRUSTED_RELEASE_BUILDER",
-                "policy_sha256": self.config.policy_sha256,
-                "collector_ready": True,
-                "signer_ready": True,
-            }
-            if len(self._nonce_ledger) >= 2048:
-                self._nonce_ledger.pop(next(iter(self._nonce_ledger)))
-            self._nonce_ledger[nonce] = (
-                hashlib.sha256(request_bytes).digest(),
-                dict(result),
-            )
-            self._persist_nonce_ledger()
-            return result
-        issued = datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
-        attestation = {
-            "builder_attestation_id": "builder-attestation-" + _sha256(recipe_name, recipe["task_id"], candidate["artifact_sha256"])[:24],
-            "builder_key_id": self.signer.key_id,
-            "builder_key_generation": self.signer.key_generation,
-            "signature_algorithm": "Ed25519",
-            "signature_purpose": "AIOS_TRUSTED_RELEASE_BUILDER",
-            "source_commit": candidate["source_commit"], "tree_oid": candidate["tree_oid"],
-            "artifact_sha256": candidate["artifact_sha256"], "manifest_sha256": candidate["manifest_sha256"],
-            "package_closure_sha256": release_plan["deployment"]["package_closure_sha256"],
-            "test_evidence_sha256": evidence_digests["tests"],
-            "canary_evidence_sha256": evidence_digests["canary"],
-            "gitea_evidence_sha256": evidence_digests["gitea"],
-            "rollback_evidence_sha256": evidence_digests["rollback"],
-            "policy_evidence_sha256": evidence_digests["policy"],
-            "secret_scan_evidence_sha256": evidence_digests["secret_scan"],
-            "issued_at": issued, "trust_domain": "aios.trusted-builder.attestation.v1",
-        }
-        canonical_attestation = _canonical_json(attestation)
-        fingerprint = hashlib.sha256(canonical_attestation).hexdigest()
-        signature = base64.b64encode(self.signer.sign_for_purpose("AIOS_TRUSTED_RELEASE_BUILDER", canonical_attestation)).decode("ascii")
-        result = {
-            "schema": self.config.response_schema, "status": "BUILT", "recipe": recipe_name,
-            "repository": self.config.repository, "task_id": recipe["task_id"], "base_oid": recipe["base_oid"],
-            "purpose": recipe["purpose"], "checks": dict(checks),
-            "evidence": {"candidate_id": candidate["candidate_id"], "source_commit": candidate["source_commit"], "tree_oid": candidate["tree_oid"], "artifact_sha256": candidate["artifact_sha256"], "manifest_sha256": candidate["manifest_sha256"], "package_closure_sha256": release_plan["deployment"]["package_closure_sha256"], "test_evidence_sha256": attestation["test_evidence_sha256"], "canary_evidence_sha256": attestation["canary_evidence_sha256"]},
-            "attestation": {**attestation, "fingerprint": fingerprint, "signature": signature},
-        }
-        result["silent_release_bundle"] = {"candidate": candidate, "release_plan": release_plan, "checks": dict(checks), "attestation": result["attestation"]}
-        if len(self._nonce_ledger) >= 2048:
-            self._nonce_ledger.pop(next(iter(self._nonce_ledger)))
-        self._nonce_ledger[nonce] = (hashlib.sha256(request_bytes).digest(), dict(result))
-        self._persist_nonce_ledger()
-        return result
-
-    def serve_forever(self, listener: socket.socket) -> None:
-        while True:
-            connection, _ = listener.accept()
-            with connection:
-                try:
-                    raw = connection.makefile("rb").readline(65537)
-                    if not raw or len(raw) > 65536:
-                        raise BuilderError("REQUEST_SIZE_INVALID")
-                    result = self.handle_request(json.loads(raw), connection=connection)
-                except (BuilderError, UnicodeDecodeError, json.JSONDecodeError):
-                    result = {"schema": self.config.response_schema, "status": "REJECTED", "error_code": "REQUEST_REJECTED"}
-                connection.sendall(_canonical_json(result) + b"\n")
-
-
-class UnixTrustedCandidateBuilderClient:
-    def __init__(self, config: TrustedCandidateBuilderConfig, keyring: BuilderKeyring, *, socket_path: Path | None = None, clock: Callable[[], float] = time.time) -> None:
-        self.config, self.keyring, self.socket_path, self.clock = config, keyring, socket_path, clock
-
-    def create_request(self, version: str, candidate_id: str | None, source_commit: str, *, nonce: str, operation: str | None = None) -> dict[str, Any]:
-        selected = self.config.resolve_recipe(version, candidate_id, source_commit)
-        selected_operation = operation or self.config.operation
-        if selected_operation not in {self.config.operation, self.config.readiness_operation}:
-            raise BuilderError("REQUEST_OPERATION_INVALID")
-        request = {"schema": self.config.request_schema, "operation": selected_operation, "recipe": version, "repository": self.config.repository, "task_id": selected["task_id"], "candidate_id": selected["candidate_id"], "base_oid": selected["base_oid"], "source_commit": selected["source_commit"], "version": selected["version"], "purpose": selected["purpose"], "issued_at": int(self.clock()), "nonce": nonce}
-        request["hmac"] = hmac.new(self.keyring.builder_hmac, _canonical_json(request), hashlib.sha256).hexdigest()
-        return request
-
-    def _exchange(self, request: Mapping[str, Any]) -> Mapping[str, Any]:
-        if self.socket_path is None:
-            raise BuilderError("BUILDER_SOCKET_UNCONFIGURED")
-        try:
-            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as connection:
-                connection.settimeout(self.config.request_timeout_seconds)
-                connection.connect(os.fspath(self.socket_path))
-                connection.sendall(_canonical_json(dict(request)) + b"\n")
-                raw = connection.makefile("rb").readline(65537)
-        except (OSError, TimeoutError) as exc:
-            raise BuilderError("BUILDER_TRANSPORT_UNAVAILABLE") from exc
-        try:
-            result = json.loads(raw)
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise BuilderError("BUILDER_RESPONSE_INVALID") from exc
-        if not isinstance(result, Mapping) or result.get("schema") != self.config.response_schema:
-            raise BuilderError("BUILDER_RESPONSE_INVALID")
-        return result
-
-    def build(self, version: str, candidate_id: str | None, source_commit: str, *, nonce: str) -> Mapping[str, Any]:
-        result = self._exchange(
-            self.create_request(version, candidate_id, source_commit, nonce=nonce)
-        )
-        if result.get("status") != "BUILT":
-            raise BuilderError("BUILDER_REQUEST_REJECTED")
-        return result
-
-    def probe(self, *, nonce: str | None = None) -> Mapping[str, Any]:
-        recipe = self.config.fixed_recipe("V2R2C2")
-        result = self._exchange(
-            self.create_request(
-                "V2R2C2",
-                recipe["candidate_id"],
-                recipe["source_commit"],
-                nonce=nonce or secrets.token_hex(32),
-                operation=self.config.readiness_operation,
-            )
-        )
-        if result.get("status") != "READY":
-            raise BuilderError("BUILDER_NOT_READY")
-        return result
-
-
-def readiness_probe(client: UnixTrustedCandidateBuilderClient) -> Mapping[str, Any]:
-    result = dict(client.probe())
-    required_true = {"collector_ready", "signer_ready"}
-    if any(result.get(name) is not True for name in required_true):
-        raise BuilderError("BUILDER_NOT_READY")
-    return result
-
-
-def _main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--socket-fd", required=True, type=int)
-    parser.add_argument("--policy", required=True, type=Path)
-    arguments = parser.parse_args()
-    config = TrustedCandidateBuilderConfig.from_policy(load_builder_policy(arguments.policy))
-    credentials = os.environ.get("CREDENTIALS_DIRECTORY")
-    if not credentials:
-        raise SystemExit("CREDENTIALS_DIRECTORY is required")
-    keyring = BuilderKeyring.from_credentials_directory(Path(credentials))
-    signer = CredentialPathEd25519Signer(
-        keyring.signing_private_key_path,
-        key_id=os.environ["AIOS_TRUSTED_BUILDER_KEY_ID"],
-        key_generation=int(os.environ["AIOS_TRUSTED_BUILDER_KEY_GENERATION"]),
-        allowed_purpose="AIOS_TRUSTED_RELEASE_BUILDER",
-    )
-    listener = socket.fromfd(arguments.socket_fd, socket.AF_UNIX, socket.SOCK_STREAM)
-    collector = DeterministicEvidenceCollector(
-        config,
-        evidence_source=ServerOwnedEvidenceSource(
-            config,
-            Path(os.environ["AIOS_TRUSTED_BUILDER_GIT_DIR"]),
-            Path(os.environ["AIOS_TRUSTED_BUILDER_EVIDENCE_ROOT"]),
-        ),
-    )
-    TrustedCandidateBuilder(config, keyring, collector=collector, signer=signer, nonce_ledger_path=Path(os.environ["AIOS_TRUSTED_BUILDER_NONCE_LEDGER"])).serve_forever(listener)
-
-
-if __name__ == "__main__":
-    _main()

active-runtime/app/approved_release_executor.py

@@ -1,687 +0,0 @@
-#!/usr/bin/env python3
-"""One-shot governed executor for an already approved exact release binding.
-
-This module deliberately does not build release artifacts. The build/staging
-evidence is completed before Owner production approval. Production execution
-consumes that immutable binding, revalidates it, and performs narrow
-side-effects through adapters in a durable fail-closed order.
-
-Adapter protocol:
-  stdin: JSON request with operation = "probe" | "apply" | "rollback"
-  stdout: one JSON object on the final non-empty line
-  shell: never used
-
-The executor never rewrites tags, never writes refs/heads/main, and records
-Baseline last.
-"""
-from __future__ import annotations
-
-import argparse
-import dataclasses
-import fcntl
-import hashlib
-import json
-import os
-import re
-import stat
-import subprocess
-import sys
-import tempfile
-import time
-from pathlib import Path
-from typing import Any, Mapping, Sequence
-
-from trusted_release_execution_plan import PlanError, TrustedReleasePlan
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA_RE = re.compile(r"^[0-9a-f]{64}$")
-PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
-
-REQUIRED_V2R1C7_MEMBERS = {
-    "payload/VERSION",
-    "payload/active-runtime/app/deployment_state.py",
-    "payload/active-runtime/app/v2r1c6_privacy_tools.py",
-    "payload/active-runtime/app/v2r1c7_health_service.py",
-    "payload/deploy/aios-v2/systemd/aios-v2r1c7-production.service",
-    "payload/deploy/aios-v2/v2r1c7-runtime-config.json",
-    "payload/deploy/aios-v2/v2r1c7-rollback.json",
-    "payload/scripts/probe_v2r1c7_health.py",
-    "payload/scripts/rollback_v2r1c7_release.sh",
-    "payload/BUILD-METADATA.json",
-    "payload/ARTIFACT-MANIFEST.json",
-    "payload/ROLLBACK-METADATA.json",
-}
-
-class ReleaseBlocked(RuntimeError):
-    pass
-
-class ManualOwnerReviewRequired(ReleaseBlocked):
-    pass
-
-class ReconciliationRequired(ReleaseBlocked):
-    pass
-
-
-@dataclasses.dataclass(frozen=True)
-class Binding:
-    version: str
-    target_oid: str
-    evidence_closure_oid: str
-    artifact_sha256: str
-    approval_plan_id: str
-    artifact_path: str
-    artifact_size: int
-    production_service: str
-    production_port: int
-    repository_identity: str = "aios/aios"
-
-    candidate_id: str | None = None
-    release_plan_sha256: str | None = None
-
-    @classmethod
-    def from_trusted_plan(cls, plan: TrustedReleasePlan) -> "Binding":
-        value = plan.value
-        adapter = value["adapter_policy"]
-        binding = cls(
-            version=str(value["version"]), target_oid=str(value["source_commit"]),
-            evidence_closure_oid=str(value["evidence_closure_oid"]), artifact_sha256=str(value["artifact_sha256"]),
-            approval_plan_id=str(value["approval_plan_id"]), artifact_path=str(value["artifact"]["path"]),
-            artifact_size=int(value["artifact"]["size"]), production_service=str(adapter["service"]),
-            production_port=int(adapter["port"]), candidate_id=str(value["candidate_id"]),
-            release_plan_sha256=plan.release_plan_sha256,
-        )
-        plan.assert_binding(dataclasses.asdict(binding))
-        return binding
-
-    def __post_init__(self) -> None:
-        if not self.version or not OID_RE.fullmatch(self.target_oid):
-            raise ValueError("invalid release target binding")
-        if not OID_RE.fullmatch(self.evidence_closure_oid):
-            raise ValueError("invalid evidence closure OID")
-        if not SHA_RE.fullmatch(self.artifact_sha256):
-            raise ValueError("invalid artifact SHA-256")
-        if not PLAN_RE.fullmatch(self.approval_plan_id):
-            raise ValueError("invalid approval plan id")
-        if self.artifact_size <= 0:
-            raise ValueError("invalid artifact size")
-        if not self.production_service:
-            raise ValueError("production service is required")
-        if not 1024 <= self.production_port <= 65535:
-            raise ValueError("invalid production port")
-        if self.repository_identity != "aios/aios":
-            raise ValueError("unexpected repository identity")
-
-    @property
-    def tag(self) -> str:
-        return self.version
-
-    @property
-    def fingerprint(self) -> str:
-        payload = {
-            "version": self.version,
-            "target_oid": self.target_oid,
-            "evidence_closure_oid": self.evidence_closure_oid,
-            "artifact_sha256": self.artifact_sha256,
-            "approval_plan_id": self.approval_plan_id,
-            "artifact_size": self.artifact_size,
-            "production_service": self.production_service,
-            "production_port": self.production_port,
-            "repository_identity": self.repository_identity,
-            "candidate_id": self.candidate_id,
-            "release_plan_sha256": self.release_plan_sha256,
-        }
-        return hashlib.sha256(canonical_json(payload)).hexdigest()
-
-    def request(self, operation: str) -> dict[str, Any]:
-        return {
-            "schema": "aios.production-executor-request.v1",
-            "operation": operation,
-            "binding_fingerprint": self.fingerprint,
-            "version": self.version,
-            "tag": self.tag,
-            "target_oid": self.target_oid,
-            "evidence_closure_oid": self.evidence_closure_oid,
-            "artifact_sha256": self.artifact_sha256,
-            "artifact_path": self.artifact_path,
-            "artifact_size": self.artifact_size,
-            "approval_plan_id": self.approval_plan_id,
-            "production_service": self.production_service,
-            "production_port": self.production_port,
-            "repository_identity": self.repository_identity,
-            "candidate_id": self.candidate_id,
-            "release_plan_sha256": self.release_plan_sha256,
-        }
-
-
-
-def canonical_json(value: object) -> bytes:
-    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
-
-
-def secure_json(path: Path) -> dict[str, Any]:
-    st = path.lstat()
-    if not stat.S_ISREG(st.st_mode) or path.is_symlink():
-        raise ReleaseBlocked(f"non-regular authorization file: {path}")
-    if st.st_uid != 0:
-        raise ReleaseBlocked(f"authorization file must be root-owned: {path}")
-    if st.st_mode & 0o022:
-        raise ReleaseBlocked(f"authorization file is group/world writable: {path}")
-    data = json.loads(path.read_text(encoding="utf-8"))
-    if not isinstance(data, dict):
-        raise ReleaseBlocked("authorization receipt must be a JSON object")
-    return data
-
-
-def sha256_file(path: Path) -> str:
-    if path.is_symlink() or not path.is_file():
-        raise ReleaseBlocked("artifact must be a regular non-symlink file")
-    digest = hashlib.sha256()
-    with path.open("rb") as source:
-        for block in iter(lambda: source.read(1024 * 1024), b""):
-            digest.update(block)
-    return digest.hexdigest()
-
-
-def run_git(git_dir: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        ["git", f"--git-dir={git_dir}", *args],
-        check=check,
-        capture_output=True,
-        text=True,
-        timeout=30,
-        env={"PATH": os.environ.get("PATH", "")},
-    )
-
-
-def verify_git_lineage(git_dir: Path, binding: Binding) -> dict[str, Any]:
-    authority_main = run_git(git_dir, "rev-parse", "refs/heads/main").stdout.strip()
-    if not OID_RE.fullmatch(authority_main):
-        raise ReleaseBlocked("Authority main OID is invalid")
-
-    target_type = run_git(git_dir, "cat-file", "-t", binding.target_oid).stdout.strip()
-    if target_type != "commit":
-        raise ReleaseBlocked("target_oid is not a commit")
-
-    evidence_type = run_git(
-        git_dir, "cat-file", "-t", binding.evidence_closure_oid
-    ).stdout.strip()
-    if evidence_type != "commit":
-        raise ReleaseBlocked("evidence_closure_oid is not a commit")
-
-    # A control-plane-only patch may advance main after release approval.
-    # The approved release target remains valid only while it is still on main.
-    target_on_main = run_git(
-        git_dir,
-        "merge-base",
-        "--is-ancestor",
-        binding.target_oid,
-        authority_main,
-        check=False,
-    ).returncode == 0
-    if not target_on_main:
-        raise ManualOwnerReviewRequired(
-            "approved target is no longer an ancestor of Authority main"
-        )
-
-    target_in_evidence = run_git(
-        git_dir,
-        "merge-base",
-        "--is-ancestor",
-        binding.target_oid,
-        binding.evidence_closure_oid,
-        check=False,
-    ).returncode == 0
-    if not target_in_evidence:
-        raise ReleaseBlocked("approved target is not an ancestor of evidence closure")
-
-    return {
-        "authority_main_oid": authority_main,
-        "target_oid": binding.target_oid,
-        "target_is_ancestor_of_main": True,
-        "evidence_closure_oid": binding.evidence_closure_oid,
-        "evidence_object_type": evidence_type,
-        "target_is_ancestor_of_evidence": True,
-    }
-
-
-def verify_artifact(binding: Binding) -> dict[str, Any]:
-    path = Path(binding.artifact_path)
-    if path.stat().st_size != binding.artifact_size:
-        raise ReleaseBlocked("artifact size mismatch")
-    actual = sha256_file(path)
-    if actual != binding.artifact_sha256:
-        raise ReleaseBlocked("artifact SHA-256 mismatch")
-
-    if binding.version == "V2R1C7":
-        # Python tarfile may not have zstd support on the target host, so
-        # decompress into a private temporary tar and inspect it there.
-        with tempfile.TemporaryDirectory(prefix="aios-artifact-verify-") as temp_dir:
-            tar_path = Path(temp_dir) / "release.tar"
-            with tar_path.open("wb") as output:
-                completed = subprocess.run(
-                    ["zstd", "-dc", str(path)],
-                    check=False,
-                    stdout=output,
-                    stderr=subprocess.PIPE,
-                    timeout=60,
-                    env={"PATH": os.environ.get("PATH", "")},
-                )
-            if completed.returncode != 0:
-                raise ReleaseBlocked("artifact zstd decompression failed")
-            import tarfile
-            with tarfile.open(tar_path, "r:") as archive:
-                names: set[str] = set()
-                for member in archive.getmembers():
-                    candidate = Path(member.name)
-                    if (
-                        candidate.is_absolute()
-                        or ".." in candidate.parts
-                        or member.issym()
-                        or member.islnk()
-                        or not (member.isfile() or member.isdir())
-                    ):
-                        raise ReleaseBlocked(f"unsafe artifact member: {member.name}")
-                    names.add(member.name)
-            missing = sorted(REQUIRED_V2R1C7_MEMBERS - names)
-            if missing:
-                raise ReleaseBlocked(
-                    "artifact missing required members: " + ",".join(missing)
-                )
-    return {
-        "artifact_path": str(path),
-        "artifact_sha256": actual,
-        "artifact_size": binding.artifact_size,
-        "verified": True,
-    }
-
-
-def verify_authorization(receipt: Mapping[str, Any], binding: Binding) -> dict[str, Any]:
-    if receipt.get("accepted") is not True:
-        raise ReleaseBlocked("Owner production authorization is not accepted")
-    if receipt.get("binding_replaced") not in (None, False):
-        raise ManualOwnerReviewRequired("Owner binding was replaced")
-    expected = {
-        "version": binding.version,
-        "target_oid": binding.target_oid,
-        "evidence_closure_oid": binding.evidence_closure_oid,
-        "artifact_sha256": binding.artifact_sha256,
-        "approval_plan_id": binding.approval_plan_id,
-    }
-    if binding.candidate_id is not None:
-        expected["candidate_id"] = binding.candidate_id
-    if binding.release_plan_sha256 is not None:
-        expected["release_plan_sha256"] = binding.release_plan_sha256
-        if receipt.get("candidate_binding_sha256") is None:
-            raise ManualOwnerReviewRequired("Owner authorization missing candidate binding")
-    for key, value in expected.items():
-        if receipt.get(key) != value:
-            raise ManualOwnerReviewRequired(f"Owner authorization mismatch: {key}")
-    return {"accepted": True, **expected}
-
-
-class DurableState:
-    def __init__(self, root: Path, binding: Binding):
-        self.root = root
-        self.root.mkdir(parents=True, exist_ok=True)
-        os.chmod(self.root, 0o700)
-        self.path = self.root / "execution.json"
-        self.binding = binding
-        self.value: dict[str, Any]
-        if self.path.exists():
-            existing = json.loads(self.path.read_text(encoding="utf-8"))
-            if existing.get("binding_fingerprint") != binding.fingerprint:
-                raise ManualOwnerReviewRequired(
-                    "state root contains a different production binding"
-                )
-            self.value = existing
-        else:
-            self.value = {
-                "schema": "aios.production-execution-state.v1",
-                "binding_fingerprint": binding.fingerprint,
-                "version": binding.version,
-                "target_oid": binding.target_oid,
-                "state": "AUTHORIZED",
-                "completed": {},
-                "history": [],
-            }
-            self.save()
-
-    def save(self) -> None:
-        temporary = self.path.with_suffix(".tmp")
-        temporary.write_bytes(canonical_json(self.value))
-        os.chmod(temporary, 0o600)
-        os.replace(temporary, self.path)
-
-    def record(self, state: str, step: str, result: Mapping[str, Any]) -> None:
-        now = time.time()
-        sanitized = json.loads(json.dumps(result))
-        self.value["state"] = state
-        self.value["completed"][step] = sanitized
-        self.value["history"].append(
-            {"at": now, "state": state, "step": step, "result": sanitized}
-        )
-        self.save()
-
-    def fail(self, state: str, reason: str) -> None:
-        self.value["state"] = state
-        self.value["history"].append(
-            {"at": time.time(), "state": state, "reason": reason}
-        )
-        self.save()
-
-
-class FileLock:
-    def __init__(self, path: Path):
-        self.path = path
-        self.handle = None
-
-    def __enter__(self) -> "FileLock":
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        self.handle = self.path.open("a+", encoding="utf-8")
-        os.chmod(self.path, 0o600)
-        try:
-            fcntl.flock(
-                self.handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB
-            )
-        except BlockingIOError as exc:
-            raise ReleaseBlocked("production executor is already running") from exc
-        return self
-
-    def __exit__(self, exc_type, exc, tb) -> None:
-        if self.handle is not None:
-            fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
-            self.handle.close()
-
-
-def parse_command(values: Sequence[str]) -> list[str]:
-    command = [str(x) for x in values if str(x)]
-    if not command:
-        raise ValueError("adapter command is required")
-    if not os.path.isabs(command[0]):
-        raise ValueError("adapter executable must be an absolute path")
-    return command
-
-
-def run_adapter(command: Sequence[str], request: Mapping[str, Any]) -> dict[str, Any]:
-    completed = subprocess.run(
-        list(command),
-        input=canonical_json(request),
-        check=False,
-        capture_output=True,
-        timeout=180,
-        env={"PATH": os.environ.get("PATH", "")},
-    )
-    if completed.returncode != 0:
-        raise ReleaseBlocked(
-            f"adapter failed: {Path(command[0]).name} rc={completed.returncode}"
-        )
-    lines = [line for line in completed.stdout.decode("utf-8").splitlines() if line.strip()]
-    if not lines:
-        raise ReleaseBlocked("adapter returned no JSON result")
-    try:
-        value = json.loads(lines[-1])
-    except ValueError as exc:
-        raise ReleaseBlocked("adapter returned invalid JSON") from exc
-    if not isinstance(value, dict):
-        raise ReleaseBlocked("adapter result must be an object")
-    return value
-
-
-def require_exact_response(result: Mapping[str, Any], binding: Binding) -> None:
-    for key, expected in {
-        "version": binding.version,
-        "target_oid": binding.target_oid,
-        "evidence_closure_oid": binding.evidence_closure_oid,
-        "artifact_sha256": binding.artifact_sha256,
-        "approval_plan_id": binding.approval_plan_id,
-    }.items():
-        if key in result and result[key] != expected:
-            raise ManualOwnerReviewRequired(f"adapter binding mismatch: {key}")
-
-
-def tag_step(command: Sequence[str], binding: Binding) -> dict[str, Any]:
-    request = binding.request("probe")
-    probe = run_adapter(command, request)
-    require_exact_response(probe, binding)
-    state = probe.get("status")
-    if state == "CONFLICT":
-        raise ManualOwnerReviewRequired("same-name tag conflicts with approved binding")
-    if state == "INDETERMINATE":
-        raise ReconciliationRequired("tag publication state is indeterminate")
-    if state not in {"APPLIED_VERIFIED", "NOT_APPLIED", "PARTIAL_LOCAL"}:
-        raise ReleaseBlocked(f"unsupported tag probe status: {state}")
-    if state != "APPLIED_VERIFIED":
-        applied = run_adapter(command, binding.request("apply"))
-        require_exact_response(applied, binding)
-        if applied.get("status") == "CONFLICT":
-            raise ManualOwnerReviewRequired("tag conflict during publication")
-        probe = run_adapter(command, request)
-        require_exact_response(probe, binding)
-    if probe.get("status") != "APPLIED_VERIFIED":
-        raise ReconciliationRequired("tag was not independently verified")
-    if probe.get("peeled_target_oid") != binding.target_oid:
-        raise ManualOwnerReviewRequired("published tag peeled target mismatch")
-    tag_oid = probe.get("tag_oid")
-    if not isinstance(tag_oid, str) or not OID_RE.fullmatch(tag_oid):
-        raise ReleaseBlocked("verified annotated tag object OID missing")
-    return dict(probe)
-
-
-def deploy_step(command: Sequence[str], binding: Binding) -> dict[str, Any]:
-    probe = run_adapter(command, binding.request("probe"))
-    require_exact_response(probe, binding)
-    if probe.get("status") == "ACTIVE_VERIFIED":
-        return dict(probe)
-    if probe.get("status") == "CONFLICT":
-        raise ManualOwnerReviewRequired("production runtime has conflicting binding")
-    applied = run_adapter(command, binding.request("apply"))
-    require_exact_response(applied, binding)
-    probe = run_adapter(command, binding.request("probe"))
-    require_exact_response(probe, binding)
-    if probe.get("status") != "ACTIVE_VERIFIED":
-        try:
-            run_adapter(command, binding.request("rollback"))
-        except Exception:
-            pass
-        raise ReconciliationRequired("production runtime did not verify after apply")
-    if (
-        probe.get("deployment_state") != "ACTIVE"
-        or probe.get("production_deployed") is not True
-    ):
-        raise ReconciliationRequired("production health contract is not ACTIVE")
-    return dict(probe)
-
-
-def finalize_step(
-    command: Sequence[str],
-    binding: Binding,
-    *,
-    name: str,
-    tag_oid: str,
-) -> dict[str, Any]:
-    request = binding.request("probe")
-    request["tag_oid"] = tag_oid
-    probe = run_adapter(command, request)
-    require_exact_response(probe, binding)
-    if probe.get("status") == "CONFLICT":
-        raise ManualOwnerReviewRequired(f"{name} has conflicting release binding")
-    if probe.get("status") != "VERIFIED":
-        apply_request = binding.request("apply")
-        apply_request["tag_oid"] = tag_oid
-        applied = run_adapter(command, apply_request)
-        require_exact_response(applied, binding)
-        probe = run_adapter(command, request)
-        require_exact_response(probe, binding)
-    if probe.get("status") != "VERIFIED":
-        raise ReconciliationRequired(f"{name} did not verify after apply")
-    if probe.get("tag_oid") not in (None, tag_oid):
-        raise ManualOwnerReviewRequired(f"{name} tag object mismatch")
-    return dict(probe)
-
-
-def execute(
-    *,
-    binding: Binding,
-    authorization_path: Path,
-    repository: Path,
-    state_root: Path,
-    tag_command: Sequence[str],
-    deploy_command: Sequence[str],
-    registry_command: Sequence[str],
-    baseline_command: Sequence[str],
-    release_plan_path: Path | None = None,
-) -> dict[str, Any]:
-    plan = TrustedReleasePlan.load(release_plan_path) if release_plan_path is not None else None
-    if plan is not None:
-        try:
-            plan.assert_binding(dataclasses.asdict(binding))
-        except PlanError as exc:
-            raise ReleaseBlocked(f"trusted release plan mismatch: {exc}") from exc
-    authorization = verify_authorization(secure_json(authorization_path), binding)
-    lineage = verify_git_lineage(repository, binding)
-    artifact = verify_artifact(binding)
-    state = DurableState(state_root, binding)
-    with FileLock(state_root / "executor.lock"):
-        state.record(
-            "PREFLIGHT_VERIFIED",
-            "preflight",
-            {"authorization": authorization, "lineage": lineage, "artifact": artifact},
-        )
-        tag: dict[str, Any] | None = None
-        runtime: dict[str, Any] | None = None
-        try:
-            tag = tag_step(tag_command, binding)
-            state.record("TAG_VERIFIED", "tag", tag)
-
-            runtime = deploy_step(deploy_command, binding)
-            state.record("RUNTIME_VERIFIED", "runtime", runtime)
-
-            registry = finalize_step(
-                registry_command,
-                binding,
-                name="registry",
-                tag_oid=tag["tag_oid"],
-            )
-            state.record("REGISTRY_VERIFIED", "registry", registry)
-
-            baseline = finalize_step(
-                baseline_command,
-                binding,
-                name="baseline",
-                tag_oid=tag["tag_oid"],
-            )
-            state.record("BASELINE_VERIFIED", "baseline", baseline)
-
-            # Final readback: no mutation, all four planes must still agree.
-            final_tag = tag_step(tag_command, binding)
-            final_runtime = run_adapter(deploy_command, binding.request("probe"))
-            final_registry_request = binding.request("probe")
-            final_registry_request["tag_oid"] = tag["tag_oid"]
-            final_registry = run_adapter(registry_command, final_registry_request)
-            final_baseline_request = binding.request("probe")
-            final_baseline_request["tag_oid"] = tag["tag_oid"]
-            final_baseline = run_adapter(baseline_command, final_baseline_request)
-            for value in (final_runtime, final_registry, final_baseline):
-                require_exact_response(value, binding)
-            if final_runtime.get("status") != "ACTIVE_VERIFIED":
-                raise ReconciliationRequired("final runtime readback failed")
-            if final_registry.get("status") != "VERIFIED":
-                raise ReconciliationRequired("final Registry readback failed")
-            if final_baseline.get("status") != "VERIFIED":
-                raise ReconciliationRequired("final Baseline readback failed")
-            final = {
-                "status": "PRODUCTION_ACCEPTED",
-                "version": binding.version,
-                "target_oid": binding.target_oid,
-                "evidence_closure_oid": binding.evidence_closure_oid,
-                "artifact_sha256": binding.artifact_sha256,
-                "approval_plan_id": binding.approval_plan_id,
-                "tag_oid": tag["tag_oid"],
-                "tag": final_tag,
-                "runtime": final_runtime,
-                "registry": final_registry,
-                "baseline": final_baseline,
-                "force_push_used": False,
-                "tag_rewritten": False,
-                "direct_main_push": False,
-                "secrets_committed": False,
-            }
-            state.record("COMPLETED", "final_consistency", final)
-            return final
-        except ManualOwnerReviewRequired as exc:
-            state.fail("MANUAL_OWNER_REVIEW_REQUIRED", str(exc))
-            raise
-        except ReconciliationRequired as exc:
-            state.fail("RECONCILIATION_REQUIRED", str(exc))
-            raise
-        except Exception as exc:
-            # Once a formal tag has been verified, no later error is a clean
-            # pre-side-effect failure. Preserve the tag and require idempotent
-            # reconciliation rather than pretending the release never started.
-            if tag is not None:
-                reason = f"{type(exc).__name__}: {exc}"
-                state.fail("RECONCILIATION_REQUIRED", reason)
-                raise ReconciliationRequired(reason) from exc
-            state.fail("FAIL_CLOSED", f"{type(exc).__name__}: {exc}")
-            raise
-
-
-def parser() -> argparse.ArgumentParser:
-    p = argparse.ArgumentParser()
-    p.add_argument("--authorization", required=True, type=Path)
-    p.add_argument("--release-plan", type=Path)
-    p.add_argument("--repository", required=True, type=Path)
-    p.add_argument("--state-root", required=True, type=Path)
-    p.add_argument("--artifact", type=Path)
-    p.add_argument("--artifact-size", type=int)
-    p.add_argument("--version")
-    p.add_argument("--target-oid")
-    p.add_argument("--evidence-closure-oid")
-    p.add_argument("--artifact-sha256")
-    p.add_argument("--approval-plan-id")
-    p.add_argument("--production-service")
-    p.add_argument("--production-port", type=int)
-    p.add_argument("--repository-identity", default="aios/aios")
-    p.add_argument("--tag-adapter", required=True, nargs="+")
-    p.add_argument("--deploy-adapter", required=True, nargs="+")
-    p.add_argument("--registry-adapter", required=True, nargs="+")
-    p.add_argument("--baseline-adapter", required=True, nargs="+")
-    return p
-
-
-def main() -> int:
-    args = parser().parse_args()
-    plan = TrustedReleasePlan.load(args.release_plan) if args.release_plan else None
-    if plan is not None:
-        binding = Binding.from_trusted_plan(plan)
-    else:
-        legacy=(args.artifact,args.artifact_size,args.version,args.target_oid,args.evidence_closure_oid,args.artifact_sha256,args.approval_plan_id,args.production_service,args.production_port)
-        if any(value is None for value in legacy): raise SystemExit("legacy binding is incomplete")
-        binding = Binding(version=args.version,target_oid=args.target_oid,evidence_closure_oid=args.evidence_closure_oid,artifact_sha256=args.artifact_sha256,approval_plan_id=args.approval_plan_id,artifact_path=str(args.artifact),artifact_size=args.artifact_size,production_service=args.production_service,production_port=args.production_port,repository_identity=args.repository_identity)
-    try:
-        result = execute(
-            binding=binding,
-            authorization_path=args.authorization,
-            repository=args.repository,
-            state_root=args.state_root,
-            tag_command=parse_command(args.tag_adapter),
-            deploy_command=parse_command(args.deploy_adapter),
-            registry_command=parse_command(args.registry_adapter),
-            baseline_command=parse_command(args.baseline_adapter),
-            release_plan_path=args.release_plan,
-        )
-        print(json.dumps(result, sort_keys=True))
-        return 0
-    except ManualOwnerReviewRequired as exc:
-        print(json.dumps({"status": "MANUAL_OWNER_REVIEW_REQUIRED", "reason": str(exc)}, sort_keys=True))
-        return 20
-    except ReconciliationRequired as exc:
-        print(json.dumps({"status": "RECONCILIATION_REQUIRED", "reason": str(exc)}, sort_keys=True))
-        return 21
-    except Exception as exc:
-        print(json.dumps({"status": "FAIL_CLOSED", "error": type(exc).__name__, "reason": str(exc)}, sort_keys=True))
-        return 22
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

active-runtime/app/authoritative_git.py

@@ -4,7 +4,6 @@ from __future__ import annotations
 import os
 import re
 import subprocess
-import time
 import urllib.parse
 from pathlib import Path
 from typing import Iterable
@@ -307,76 +306,14 @@ def authoritative_diff(
     from_oid = validate_git_revision(from_revision, "from", git_dir=path)
     to_oid = validate_git_revision(to_revision, "to", git_dir=path)
     args = ["diff", "--no-ext-diff", "--no-textconv", from_oid, to_oid]
-    patch_limit = max(1, min(_MAX_OUTPUT, 256 * 1024))
-    process = subprocess.Popen(
-        ["git", "--git-dir", str(path), *args],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
-        env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
-    )
-    chunks: list[bytes] = []
-    stored_bytes = 0
-    total_bytes = 0
-    started = time.monotonic()
-    try:
-        while process.stdout is not None:
-            chunk = process.stdout.read(64 * 1024)
-            if not chunk:
-                break
-            total_bytes += len(chunk)
-            if stored_bytes < patch_limit:
-                remaining = patch_limit - stored_bytes
-                selected = chunk[:remaining]
-                chunks.append(selected)
-                stored_bytes += len(selected)
-            if time.monotonic() - started > _TIMEOUT:
-                process.kill()
-                raise AuthoritativeGitError("GIT_REF_QUERY_TIMEOUT")
-        stderr = (
-            process.stderr.read(8192).decode("utf-8", errors="replace")
-            if process.stderr is not None
-            else ""
-        )
-        returncode = process.wait(timeout=max(0.1, _TIMEOUT - (time.monotonic() - started)))
-    except (OSError, subprocess.TimeoutExpired) as exc:
-        process.kill()
-        process.wait()
-        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED") from exc
-    if returncode != 0:
-        raise AuthoritativeGitError(_redact(stderr.strip() or "GIT_REF_QUERY_FAILED")[:200])
-    try:
-        names_result = run_authoritative_git(
-            ["diff", "--no-ext-diff", "--no-textconv", "--name-status", from_oid, to_oid],
-            git_dir=path,
-        )
-        changed_paths = [
-            line.split("\t", 1)[-1]
-            for line in names_result.stdout.splitlines()
-            if line.strip()
-        ]
-    except AuthoritativeGitOutputTooLarge:
-        changed_paths = []
-    try:
-        stats_result = run_authoritative_git(
-            ["diff", "--no-ext-diff", "--no-textconv", "--stat", from_oid, to_oid],
-            git_dir=path,
-        )
-        stats = stats_result.stdout.strip()
-    except AuthoritativeGitOutputTooLarge:
-        stats = "GIT_STAT_OUTPUT_TRUNCATED"
-    patch = b"".join(chunks).decode("utf-8", errors="replace")
+    result = run_authoritative_git(args, git_dir=path)
     return {
         "code": 0,
-        "stdout": patch,
+        "stdout": result.stdout,
         "stderr": "",
         "cmd": ["git", f"--git-dir={path}", *args],
         "from_oid": from_oid,
         "to_oid": to_oid,
-        "changed_paths": changed_paths,
-        "stats": stats,
-        "total_size_bytes": total_bytes,
-        "truncated": total_bytes > patch_limit,
-        "patch_limit_bytes": patch_limit,
     }
 
 

active-runtime/app/autonomy_notification_plane.py

@@ -1,89 +0,0 @@
-"""Durable Owner/GPT notification outbox with retry and acknowledgement."""
-from __future__ import annotations
-
-import json
-import sqlite3
-import time
-import uuid
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any, Callable, Mapping
-
-
-@dataclass(frozen=True)
-class OutboxEvent:
-    event_id: str
-    recipient: str
-    kind: str
-    payload: Mapping[str, Any]
-    attempts: int
-    available_at: float
-    acknowledged: bool
-
-
-class DurableOutbox:
-    RECIPIENTS = ("owner", "gpt")
-
-    def __init__(self, path: str | Path) -> None:
-        self.path = str(path)
-        self.db = sqlite3.connect(self.path)
-        self.db.execute("PRAGMA journal_mode=WAL")
-        self.db.execute("CREATE TABLE IF NOT EXISTS outbox (event_id TEXT PRIMARY KEY, recipient TEXT NOT NULL, kind TEXT NOT NULL, payload TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, available_at REAL NOT NULL, delivered_at REAL, acknowledged INTEGER NOT NULL DEFAULT 0, last_error TEXT)")
-        self.db.commit()
-
-    def enqueue(self, kind: str, payload: Mapping[str, Any], *, event_id: str | None = None, recipients: tuple[str, ...] = RECIPIENTS) -> list[str]:
-        ids: list[str] = []
-        for recipient in recipients:
-            if recipient not in self.RECIPIENTS:
-                raise ValueError("recipient is outside the governed notification plane")
-            eid = event_id or str(uuid.uuid4())
-            if event_id is not None and len(recipients) > 1:
-                eid = f"{event_id}:{recipient}"
-            self.db.execute("INSERT OR IGNORE INTO outbox(event_id,recipient,kind,payload,available_at) VALUES(?,?,?,?,?)", (eid, recipient, kind, json.dumps(dict(payload), sort_keys=True), time.time()))
-            ids.append(eid)
-        self.db.commit()
-        return ids
-
-    def due(self, *, now: float | None = None, limit: int = 20) -> list[OutboxEvent]:
-        now = time.time() if now is None else now
-        rows = self.db.execute("SELECT event_id,recipient,kind,payload,attempts,available_at,acknowledged FROM outbox WHERE delivered_at IS NULL AND available_at<=? ORDER BY available_at,event_id LIMIT ?", (now, limit)).fetchall()
-        return [OutboxEvent(r[0], r[1], r[2], json.loads(r[3]), r[4], r[5], bool(r[6])) for r in rows]
-
-    def delivered(self, event_id: str, *, now: float | None = None) -> None:
-        self.db.execute("UPDATE outbox SET delivered_at=? WHERE event_id=?", (time.time() if now is None else now, event_id))
-        self.db.commit()
-
-    def failed(self, event_id: str, error: str, *, now: float | None = None, max_backoff: float = 300.0) -> None:
-        now = time.time() if now is None else now
-        row = self.db.execute("SELECT attempts FROM outbox WHERE event_id=?", (event_id,)).fetchone()
-        attempts = int(row[0]) + 1 if row else 1
-        delay = min(max_backoff, 2 ** min(attempts, 8))
-        self.db.execute("UPDATE outbox SET attempts=?,available_at=?,last_error=? WHERE event_id=?", (attempts, now + delay, error[:200], event_id))
-        self.db.commit()
-
-    def acknowledge(self, event_id: str) -> None:
-        self.db.execute("UPDATE outbox SET acknowledged=1 WHERE event_id=?", (event_id,))
-        self.db.commit()
-
-    def close(self) -> None:
-        self.db.close()
-
-
-class NotificationPlane:
-    def __init__(self, outbox: DurableOutbox) -> None:
-        self.outbox = outbox
-
-    def emit(self, kind: str, payload: Mapping[str, Any], *, event_id: str | None = None) -> list[str]:
-        return self.outbox.enqueue(kind, payload, event_id=event_id)
-
-    def deliver_once(self, send: Callable[[OutboxEvent], None], *, now: float | None = None) -> list[str]:
-        delivered: list[str] = []
-        for event in self.outbox.due(now=now):
-            try:
-                send(event)
-            except Exception as exc:
-                self.outbox.failed(event.event_id, type(exc).__name__, now=now)
-            else:
-                self.outbox.delivered(event.event_id, now=now)
-                delivered.append(event.event_id)
-        return delivered

active-runtime/app/baseline_authority.py

@@ -1,84 +0,0 @@
-#!/usr/bin/env python3
-"""Single canonical Production Baseline authority for the GitOps reader.
-
-The API and the one-shot writer import this module.  Workspace and release
-copies are projections only; they are never selected as a fallback source.
-"""
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-from pathlib import Path
-from typing import Any
-
-
-AUTHORITY_PATH = Path(os.getenv(
-    "AIOS_GITOPS_BASELINE_AUTHORITY",
-    "/var/lib/aios-gitops-runtime-anchor/baseline/current.json",
-))
-AUTHORITY_SHA_PATH = AUTHORITY_PATH.with_suffix(".sha256")
-
-
-class BaselineAuthorityError(RuntimeError):
-    """Fail-closed error raised for an unavailable or inconsistent authority."""
-
-
-class BaselineAuthority:
-    def __init__(self, path: Path | str = AUTHORITY_PATH):
-        self.path = Path(path)
-        self.sha_path = self.path.with_suffix(".sha256")
-
-    def _raw(self) -> bytes:
-        try:
-            raw = self.path.read_bytes()
-        except OSError as exc:
-            raise BaselineAuthorityError(f"authority_unavailable:{exc}") from exc
-        if not raw:
-            raise BaselineAuthorityError("authority_empty")
-        return raw
-
-    def read(self) -> dict[str, Any]:
-        raw = self._raw()
-        digest = hashlib.sha256(raw).hexdigest()
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise BaselineAuthorityError("authority_invalid_json") from exc
-        if not isinstance(value, dict):
-            raise BaselineAuthorityError("authority_not_object")
-        expected = str(value.get("authority_sha256", ""))
-        if expected and expected != digest:
-            raise BaselineAuthorityError("authority_embedded_digest_mismatch")
-        if self.sha_path.exists():
-            sidecar = self.sha_path.read_text(encoding="utf-8").strip().split()[0]
-            if sidecar != digest:
-                raise BaselineAuthorityError("authority_sidecar_digest_mismatch")
-        required = {
-            "current_baseline", "previous_baseline", "target_oid", "tag_oid",
-            "evidence_closure_oid", "approval_plan_id", "status", "generation",
-            "source_identity",
-        }
-        missing = sorted(required.difference(value))
-        if missing:
-            raise BaselineAuthorityError("authority_missing:" + ",".join(missing))
-        value = dict(value)
-        value["authority_sha256"] = digest
-        value["authority_path"] = str(self.path)
-        return value
-
-    def read_consistent(self, policy: dict[str, Any] | None = None) -> dict[str, Any]:
-        value = self.read()
-        if policy:
-            expected = policy.get("release_binding", policy)
-            for key, field in (("version", "current_baseline"),
-                               ("previous_version", "previous_baseline"),
-                               ("target_oid", "target_oid"),
-                               ("tag_oid", "tag_oid"),
-                               ("evidence_closure_oid", "evidence_closure_oid"),
-                               ("approval_plan_id", "approval_plan_id")):
-                wanted = expected.get(key)
-                if wanted is not None and value.get(field) != wanted:
-                    raise BaselineAuthorityError(f"authority_binding_mismatch:{field}")
-        return value
-

active-runtime/app/branch_repair_lease.py

@@ -1,491 +0,0 @@
-"""Fail-closed, branch-bound repair leases for governed AIOS GitOps work."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import posixpath
-import re
-import secrets
-import subprocess
-import tempfile
-import uuid
-from dataclasses import asdict, dataclass, field
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any, Iterable, Mapping, Protocol, Sequence
-
-
-TASK_ID = "V2R1C6_GOVERNED_LOCAL_BOOTSTRAP"
-MAX_LEASE_SECONDS = 86_400
-OID_RE = re.compile(r"^[0-9a-fA-F]{40}$")
-DENIED_BRANCHES = {"main", "master", "HEAD"}
-PROTECTED_PREFIXES = (
-    ".git",
-    "VERSION",
-    "versions/V2R1C5.json",
-    "artifacts/V2R1C5",
-    "baseline",
-    "config/gitops.tokens",
-    "gitops.tokens",
-    "secrets",
-    "credentials",
-)
-SECRET_PATTERNS = (
-    re.compile(r"(?i)-----BEGIN [A-Z ]*PRIVATE KEY-----"),
-    re.compile(r"(?i)(?:api[_-]?key|secret|password|token)\s*[:=]\s*\S+"),
-    re.compile(r"\b(?:sk|HPUA|SDC)-[A-Za-z0-9_-]{16,}\b"),
-)
-
-
-class LeaseError(Exception):
-    """Raised for any invalid, stale, expired, or prohibited lease action."""
-
-
-class GitProbeProtocol(Protocol):
-    """Read-only Git seam used by the lease manager."""
-
-    def branch_head(self, branch: str) -> str: ...
-
-    def parent(self, commit: str) -> str: ...
-
-    def is_ancestor(self, older: str, newer: str) -> bool: ...
-
-    def changed_paths(self, commit: str) -> tuple[str, ...]: ...
-
-    def commits_between(self, older: str, newer: str) -> tuple[str, ...]: ...
-
-
-def _now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def _ts(value: datetime) -> str:
-    return value.astimezone(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
-
-
-def _parse_ts(value: str) -> datetime:
-    if value.endswith("Z"):
-        value = value[:-1] + "+00:00"
-    parsed = datetime.fromisoformat(value)
-    return parsed if parsed.tzinfo else parsed.replace(tzinfo=timezone.utc)
-
-
-def _oid(value: str, field: str = "oid") -> str:
-    if not isinstance(value, str) or not OID_RE.fullmatch(value):
-        raise LeaseError(f"{field} must be a full commit OID")
-    return value.lower()
-
-
-def normalize_path(path: str) -> str:
-    """Normalize a repository-relative path without resolving through the FS."""
-    if not isinstance(path, str) or not path.strip():
-        raise LeaseError("path must be a non-empty string")
-    value = path.replace("\\", "/").strip()
-    if value.startswith("/") or "\x00" in value:
-        raise LeaseError("path must be relative")
-    parts = value.split("/")
-    if any(part in {"", ".", ".."} for part in parts):
-        raise LeaseError("path contains a prohibited component")
-    normalized = posixpath.normpath(value)
-    if normalized == "." or normalized.startswith("../"):
-        raise LeaseError("path is not normalized")
-    return normalized
-
-
-def path_is_protected(path: str) -> bool:
-    normalized = normalize_path(path)
-    lower = normalized.lower()
-    return any(
-        lower == prefix.lower() or lower.startswith(prefix.lower().rstrip("/") + "/")
-        for prefix in PROTECTED_PREFIXES
-    ) or lower.startswith("refs/")
-
-
-def contains_secret_like_content(content: str) -> bool:
-    return any(pattern.search(content or "") for pattern in SECRET_PATTERNS)
-
-
-def validate_paths(paths: Iterable[str], allowed_paths: Sequence[str]) -> tuple[str, ...]:
-    allowed = tuple(normalize_path(path) for path in allowed_paths)
-    if not allowed:
-        raise LeaseError("allowed_paths must not be empty")
-    result: list[str] = []
-    for raw in paths:
-        path = normalize_path(raw)
-        if path_is_protected(path):
-            raise LeaseError("protected path is not lease-writable")
-        if not any(path == prefix or path.startswith(prefix + "/") for prefix in allowed):
-            raise LeaseError("path is outside the lease allowlist")
-        if path not in result:
-            result.append(path)
-    if not result:
-        raise LeaseError("at least one changed path is required")
-    return tuple(result)
-
-
-@dataclass
-class CommitEntry:
-    commit_oid: str
-    parent_oid: str
-    paths: tuple[str, ...]
-    recorded_at: str
-
-
-@dataclass
-class RepairLease:
-    lease_id: str
-    task_id: str
-    owner_identity: str
-    branch: str
-    description: str
-    allowed_paths: tuple[str, ...]
-    initial_head_oid: str
-    current_head_oid: str
-    created_at: str
-    expires_at: str
-    max_expires_at: str
-    state: str = "ACTIVE"
-    revision: int = 0
-    commits: list[CommitEntry] = field(default_factory=list)
-    attached: bool = False
-
-    def to_json(self) -> dict[str, Any]:
-        payload = asdict(self)
-        payload["allowed_paths"] = list(self.allowed_paths)
-        payload["commits"] = [asdict(entry) for entry in self.commits]
-        return payload
-
-    @classmethod
-    def from_json(cls, raw: dict[str, Any]) -> "RepairLease":
-        commits = tuple(
-            CommitEntry(
-                commit_oid=_oid(item["commit_oid"], "commit_oid"),
-                parent_oid=_oid(item["parent_oid"], "parent_oid"),
-                paths=tuple(normalize_path(path) for path in item["paths"]),
-                recorded_at=str(item["recorded_at"]),
-            )
-            for item in raw.get("commits", [])
-        )
-        return cls(
-            lease_id=str(raw["lease_id"]),
-            task_id=str(raw["task_id"]),
-            owner_identity=str(raw["owner_identity"]),
-            branch=str(raw["branch"]),
-            description=str(raw["description"]),
-            allowed_paths=tuple(normalize_path(path) for path in raw["allowed_paths"]),
-            initial_head_oid=_oid(raw["initial_head_oid"], "initial_head_oid"),
-            current_head_oid=_oid(raw["current_head_oid"], "current_head_oid"),
-            created_at=str(raw["created_at"]),
-            expires_at=str(raw["expires_at"]),
-            max_expires_at=str(raw["max_expires_at"]),
-            state=str(raw.get("state", "ACTIVE")),
-            revision=int(raw.get("revision", 0)),
-            commits=list(commits),
-            attached=bool(raw.get("attached", False)),
-        )
-
-
-class LeaseStore:
-    """Atomic JSON store for restart-recoverable lease state."""
-
-    def __init__(self, directory: str | os.PathLike[str]) -> None:
-        self.directory = Path(directory)
-        self.directory.mkdir(parents=True, exist_ok=True)
-        if self.directory.is_symlink():
-            raise LeaseError("lease store must not be a symlink")
-        os.chmod(self.directory, 0o700)
-
-    def _path(self, lease_id: str) -> Path:
-        if not re.fullmatch(r"lease-[0-9a-f]{32}", lease_id):
-            raise LeaseError("invalid lease id")
-        return self.directory / f"{lease_id}.json"
-
-    def create(self, lease: RepairLease) -> None:
-        path = self._path(lease.lease_id)
-        if path.exists() or path.is_symlink():
-            raise LeaseError("lease already exists")
-        self._write(path, lease.to_json(), exclusive=True)
-
-    def load(self, lease_id: str) -> RepairLease:
-        path = self._path(lease_id)
-        try:
-            raw = json.loads(path.read_text(encoding="utf-8"))
-        except (OSError, json.JSONDecodeError, TypeError) as exc:
-            raise LeaseError("lease state is unavailable or invalid") from exc
-        if not isinstance(raw, dict):
-            raise LeaseError("lease state must be an object")
-        return RepairLease.from_json(raw)
-
-    def save(self, lease: RepairLease) -> None:
-        self._write(self._path(lease.lease_id), lease.to_json())
-
-    @staticmethod
-    def _write(path: Path, payload: dict[str, Any], *, exclusive: bool = False) -> None:
-        flags = os.O_WRONLY | os.O_CREAT | (os.O_EXCL if exclusive else 0)
-        fd, temp_name = tempfile.mkstemp(prefix=".lease-", dir=path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, ensure_ascii=True, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            if exclusive:
-                os.link(temp_name, path)
-                os.unlink(temp_name)
-            else:
-                os.replace(temp_name, path)
-            os.chmod(path, 0o600)
-        except Exception:
-            try:
-                os.unlink(temp_name)
-            except FileNotFoundError:
-                pass
-            raise
-
-
-class GitProbe:
-    """Read-only Git implementation; it never changes a ref or working tree."""
-
-    def __init__(self, bare_repo: str | os.PathLike[str]) -> None:
-        self.bare_repo = Path(bare_repo)
-
-    def _run(self, args: list[str]) -> str:
-        result = subprocess.run(
-            ["git", "--git-dir", str(self.bare_repo), *args],
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if result.returncode != 0:
-            raise LeaseError("read-only Git probe failed")
-        return result.stdout.strip()
-
-    def branch_head(self, branch: str) -> str:
-        return _oid(self._run(["rev-parse", f"refs/heads/{branch}"]), "branch_head")
-
-    def parent(self, commit: str) -> str:
-        return _oid(self._run(["rev-parse", f"{_oid(commit)}^1"]), "parent")
-
-    def is_ancestor(self, older: str, newer: str) -> bool:
-        old, new = _oid(older), _oid(newer)
-        result = subprocess.run(
-            ["git", "--git-dir", str(self.bare_repo), "merge-base", "--is-ancestor", old, new],
-            check=False,
-        )
-        return result.returncode == 0
-
-    def changed_paths(self, commit: str) -> tuple[str, ...]:
-        raw = self._run(["diff-tree", "--no-commit-id", "--name-only", "-r", _oid(commit)])
-        return tuple(normalize_path(line) for line in raw.splitlines() if line.strip())
-
-    def commits_between(self, older: str, newer: str) -> tuple[str, ...]:
-        raw = self._run(["rev-list", "--reverse", f"{_oid(older)}..{_oid(newer)}"])
-        return tuple(_oid(line, "commit") for line in raw.splitlines() if line.strip())
-
-
-class RepairLeaseManager:
-    """Issue, recover, renew, and close branch-bound repair leases."""
-
-    def __init__(self, store: LeaseStore, git: GitProbeProtocol, *, clock=_now) -> None:
-        self.store = store
-        self.git = git
-        self.clock = clock
-
-    def _require_owner(self, lease: RepairLease, owner_identity: str) -> None:
-        if owner_identity != lease.owner_identity:
-            raise LeaseError("lease identity mismatch")
-
-    def _active(self, lease: RepairLease) -> RepairLease:
-        now = self.clock()
-        if lease.state != "ACTIVE":
-            raise LeaseError(f"lease is {lease.state.lower()}")
-        if now >= _parse_ts(lease.expires_at):
-            lease.state = "EXPIRED"
-            self.store.save(lease)
-            raise LeaseError("lease expired")
-        return lease
-
-    def issue(
-        self,
-        *,
-        task_id: str,
-        owner_identity: str,
-        branch: str,
-        description: str,
-        allowed_paths: Sequence[str],
-        ttl_seconds: int = 3600,
-    ) -> RepairLease:
-        if task_id != TASK_ID:
-            raise LeaseError("unexpected task id")
-        if not owner_identity or not description or len(description) > 240:
-            raise LeaseError("owner identity and description are required")
-        if "\n" in description or "\r" in description:
-            raise LeaseError("description must be a single line")
-        if branch in DENIED_BRANCHES or branch.startswith(("main/", "refs/", "tags/")):
-            raise LeaseError("protected branch cannot receive a repair lease")
-        if not isinstance(ttl_seconds, int) or not 0 < ttl_seconds <= MAX_LEASE_SECONDS:
-            raise LeaseError("lease TTL exceeds the maximum")
-        allowed = tuple(normalize_path(path) for path in allowed_paths)
-        if any(path_is_protected(path) for path in allowed):
-            raise LeaseError("protected path in lease allowlist")
-        head = self.git.branch_head(branch)
-        created = self.clock()
-        expires = created + timedelta(seconds=ttl_seconds)
-        max_expires = created + timedelta(seconds=MAX_LEASE_SECONDS)
-        lease_id = "lease-" + secrets.token_hex(16)
-        lease = RepairLease(
-            lease_id=lease_id,
-            task_id=task_id,
-            owner_identity=owner_identity,
-            branch=branch,
-            description=description,
-            allowed_paths=allowed,
-            initial_head_oid=head,
-            current_head_oid=head,
-            created_at=_ts(created),
-            expires_at=_ts(expires),
-            max_expires_at=_ts(max_expires),
-        )
-        self.store.create(lease)
-        return lease
-
-    def attach_existing_branch(
-        self, lease_id: str, *, owner_identity: str, expected_head_oid: str
-    ) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        current = self.git.branch_head(lease.branch)
-        expected = _oid(expected_head_oid, "expected_head_oid")
-        if current != expected or current != lease.current_head_oid:
-            raise LeaseError("branch head does not match the lease")
-        lease.attached = True
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def authorize_commit(
-        self,
-        lease_id: str,
-        *,
-        owner_identity: str,
-        expected_head_oid: str,
-        paths: Sequence[str],
-        content: Mapping[str, str] | None = None,
-    ) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        expected = _oid(expected_head_oid, "expected_head_oid")
-        current = self.git.branch_head(lease.branch)
-        if current != expected or current != lease.current_head_oid:
-            raise LeaseError("stale or externally advanced branch head")
-        if not lease.attached:
-            raise LeaseError("lease is not attached")
-        validate_paths(paths, lease.allowed_paths)
-        if content and any(contains_secret_like_content(value) for value in content.values()):
-            raise LeaseError("secret-like content rejected")
-        return lease
-
-    def record_commit(
-        self,
-        lease_id: str,
-        *,
-        owner_identity: str,
-        expected_head_oid: str,
-        new_head_oid: str,
-        paths: Sequence[str],
-    ) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        new_head = _oid(new_head_oid, "new_head_oid")
-        expected = _oid(expected_head_oid, "expected_head_oid")
-        if not lease.attached or lease.current_head_oid != expected:
-            raise LeaseError("stale lease head")
-        if self.git.branch_head(lease.branch) != new_head:
-            raise LeaseError("branch head does not match committed head")
-        validate_paths(paths, lease.allowed_paths)
-        if self.git.parent(new_head) != expected or not self.git.is_ancestor(expected, new_head):
-            raise LeaseError("commit is not a fast-forward child of the expected head")
-        actual_paths = self.git.changed_paths(new_head)
-        allowed = validate_paths(actual_paths, lease.allowed_paths)
-        requested = set(validate_paths(paths, lease.allowed_paths))
-        if not set(allowed).issubset(requested):
-            raise LeaseError("commit changed an unrequested path")
-        lease.current_head_oid = new_head
-        lease.revision += 1
-        lease.commits.append(
-            CommitEntry(
-                commit_oid=new_head,
-                parent_oid=expected,
-                paths=allowed,
-                recorded_at=_ts(self.clock()),
-            )
-        )
-        self.store.save(lease)
-        return lease
-
-    def recover(self, lease_id: str, *, owner_identity: str) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        current = self.git.branch_head(lease.branch)
-        if current == lease.current_head_oid:
-            return lease
-        if not self.git.is_ancestor(lease.current_head_oid, current):
-            raise LeaseError("branch moved non-fast-forward")
-        commits = self.git.commits_between(lease.current_head_oid, current)
-        for commit in commits:
-            actual = self.git.changed_paths(commit)
-            validate_paths(actual, lease.allowed_paths)
-        lease.current_head_oid = current
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def renew(self, lease_id: str, *, owner_identity: str, ttl_seconds: int) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        if not isinstance(ttl_seconds, int) or ttl_seconds <= 0:
-            raise LeaseError("renewal TTL must be positive")
-        candidate = self.clock() + timedelta(seconds=ttl_seconds)
-        maximum = _parse_ts(lease.max_expires_at)
-        if candidate > maximum:
-            raise LeaseError("renewal exceeds maximum lease lifetime")
-        lease.expires_at = _ts(candidate)
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def complete(self, lease_id: str, *, owner_identity: str) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        lease.state = "COMPLETED"
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def revoke(self, lease_id: str, *, owner_identity: str) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        lease.state = "REVOKED"
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-
-def sanitized_lease_view(lease: RepairLease) -> dict[str, Any]:
-    """Return lease metadata only; no content, token, or credential values."""
-    return {
-        "lease_id": lease.lease_id,
-        "task_id": lease.task_id,
-        "owner_identity": lease.owner_identity,
-        "branch": lease.branch,
-        "description": lease.description,
-        "initial_head_oid": lease.initial_head_oid,
-        "current_head_oid": lease.current_head_oid,
-        "created_at": lease.created_at,
-        "expires_at": lease.expires_at,
-        "state": lease.state,
-        "revision": lease.revision,
-        "commit_count": len(lease.commits),
-        "attached": lease.attached,
-    }

active-runtime/app/campaign_activation.py

@@ -1,108 +0,0 @@
-"""Atomic, predicate-bound activation of the durable release campaign."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import tempfile
-from typing import Any, Mapping
-
-from release_campaign_authorization import CampaignError, validate_policy
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-CAMPAIGN_ID = "AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807"
-
-
-class CampaignActivationError(CampaignError):
-    pass
-
-
-def canonical_json(value: Any) -> bytes:
-    return (json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n").encode("utf-8")
-
-
-def digest_bytes(value: bytes) -> str:
-    return hashlib.sha256(value).hexdigest()
-
-
-def build_active_policy(current: Mapping[str, Any], facts: Mapping[str, Any]) -> dict[str, Any]:
-    policy = validate_policy(dict(current))
-    required = {
-        "campaign_id",
-        "repository",
-        "source_main_oid",
-        "gitea_main_oid",
-        "authority_main_oid",
-        "runtime_source_oid",
-        "durable_job_state",
-        "writer_ready",
-        "gitea_machine_authenticated",
-        "governance_executor_ready",
-        "preapproval_publisher_ready",
-        "runtime_exact_main",
-        "main_lineage_verified",
-        "campaign_revoked",
-    }
-    if set(facts) != required:
-        raise CampaignActivationError("ACTIVATION_FACTS_SCHEMA_INVALID")
-    if policy["activation_state"] != "PENDING_CONTROL_PLANE_MERGE" or policy["active"] is not False:
-        raise CampaignActivationError("CAMPAIGN_NOT_PENDING")
-    if policy["campaign_id"] != CAMPAIGN_ID or facts["campaign_id"] != CAMPAIGN_ID:
-        raise CampaignActivationError("CAMPAIGN_ID_MISMATCH")
-    if facts["repository"] != "aios/aios" or policy["repository"] != facts["repository"]:
-        raise CampaignActivationError("REPOSITORY_MISMATCH")
-    for name in ("source_main_oid", "gitea_main_oid", "authority_main_oid", "runtime_source_oid"):
-        if not isinstance(facts[name], str) or not OID_RE.fullmatch(facts[name]):
-            raise CampaignActivationError("ACTIVATION_OID_INVALID")
-    if not (
-        facts["source_main_oid"]
-        == facts["gitea_main_oid"]
-        == facts["authority_main_oid"]
-        == facts["runtime_source_oid"]
-    ):
-        raise CampaignActivationError("ACTIVATION_MAIN_DIVERGENCE")
-    if facts["durable_job_state"] != "COMPLETED":
-        raise CampaignActivationError("DURABLE_JOB_NOT_COMPLETED")
-    boolean_fields = (
-        "writer_ready",
-        "gitea_machine_authenticated",
-        "governance_executor_ready",
-        "preapproval_publisher_ready",
-        "runtime_exact_main",
-        "main_lineage_verified",
-    )
-    if any(facts[name] is not True for name in boolean_fields) or facts["campaign_revoked"] is not False:
-        raise CampaignActivationError("ACTIVATION_PREDICATE_FAILED")
-    activated = dict(policy)
-    activated["activation_state"] = "ACTIVE"
-    activated["active"] = True
-    return validate_policy(activated)
-
-
-def atomic_write_policy(path: Path, sidecar: Path, receipt_path: Path, policy: Mapping[str, Any], receipt: Mapping[str, Any]) -> str:
-    if path.is_symlink() or sidecar.is_symlink() or receipt_path.exists() or receipt_path.is_symlink():
-        raise CampaignActivationError("ACTIVATION_PATH_INVALID")
-    path.parent.mkdir(parents=True, exist_ok=True)
-    raw = canonical_json(dict(policy))
-    digest = digest_bytes(raw)
-    for target, data, mode in (
-        (path, raw, "wb"),
-        (sidecar, f"{digest}  {path.name}\n".encode("ascii"), "wb"),
-        (receipt_path, canonical_json(dict(receipt)), "wb"),
-    ):
-        fd, temporary = tempfile.mkstemp(prefix=f".{target.name}.", dir=target.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, mode) as stream:
-                stream.write(data)
-                stream.flush()
-                os.fsync(stream.fileno())
-            os.replace(temporary, target)
-            os.chmod(target, 0o600)
-        finally:
-            if os.path.exists(temporary):
-                os.unlink(temporary)
-    return digest

active-runtime/app/campaign_approval_gate.py

@@ -1,106 +0,0 @@
-#!/usr/bin/env python3
-"""Machine campaign approval gate for protected engineering PRs."""
-from __future__ import annotations
-
-import argparse
-import json
-from pathlib import Path
-import subprocess
-from typing import Any, Mapping
-
-from release_campaign_authorization import CampaignAuthorization, CampaignError
-
-
-class GateError(RuntimeError):
-    pass
-
-
-def git_is_ancestor(repository: Path, ancestor: str, descendant: str) -> bool:
-    result = subprocess.run(
-        [
-            "git",
-            f"--git-dir={repository}",
-            "merge-base",
-            "--is-ancestor",
-            ancestor,
-            descendant,
-        ],
-        check=False,
-        capture_output=True,
-    )
-    if result.returncode == 0:
-        return True
-    if result.returncode == 1:
-        return False
-    raise GateError("git_ancestor_check_failed")
-
-
-def evaluate(
-    campaign: CampaignAuthorization,
-    facts: Mapping[str, Any],
-    repository: Path,
-) -> dict[str, Any]:
-    required = {
-        "repository",
-        "pr_number",
-        "base_ref",
-        "base_oid",
-        "head_oid",
-        "required_checks_all_success",
-        "required_checks_same_head",
-        "unresolved_conversations",
-        "mergeable",
-        "protected_target",
-    }
-    if set(facts) != required:
-        raise GateError("pr_facts_fields_invalid")
-    if facts["repository"] != "aios/aios":
-        raise GateError("repository_mismatch")
-    if facts["base_ref"] != "refs/heads/main" or facts["protected_target"] != "main":
-        raise GateError("protected_main_required")
-    if facts["required_checks_all_success"] is not True:
-        raise GateError("required_checks_not_success")
-    if facts["required_checks_same_head"] is not True:
-        raise GateError("required_checks_stale")
-    if facts["unresolved_conversations"] != 0:
-        raise GateError("unresolved_conversations")
-    if facts["mergeable"] is not True:
-        raise GateError("pr_not_mergeable")
-    if not git_is_ancestor(repository, campaign.anchor_oid, str(facts["base_oid"])):
-        raise GateError("base_outside_campaign_lineage")
-    if not git_is_ancestor(repository, str(facts["base_oid"]), str(facts["head_oid"])):
-        raise GateError("head_outside_pr_lineage")
-    campaign.assert_operation("protected_merge")
-    return {
-        "schema": "aios.campaign-approval-gate-result.v1",
-        "status": "SUCCESS",
-        "campaign_id": campaign.campaign_id,
-        "pr_number": facts["pr_number"],
-        "head_oid": facts["head_oid"],
-        "owner_ui_interaction_required": False,
-    }
-
-
-def main() -> int:
-    p = argparse.ArgumentParser()
-    p.add_argument("--campaign", type=Path, required=True)
-    p.add_argument("--revocation", type=Path)
-    p.add_argument("--pr-facts", type=Path, required=True)
-    p.add_argument("--repository", type=Path, required=True)
-    a = p.parse_args()
-    campaign = CampaignAuthorization.load(
-        a.campaign,
-        revocation=a.revocation,
-        require_active=True,
-    )
-    facts = json.loads(a.pr_facts.read_text(encoding="utf-8"))
-    print(json.dumps(evaluate(campaign, facts, a.repository), sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    try:
-        raise SystemExit(main())
-    except (CampaignError, GateError) as exc:
-        print(json.dumps({"status": "FAILURE", "reason": str(exc)}, sort_keys=True))
-        raise SystemExit(2)

active-runtime/app/campaign_release_acceptance.py

@@ -1,189 +0,0 @@
-#!/usr/bin/env python3
-"""Automatically accept an exact release binding under an ACTIVE campaign."""
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-import os
-from pathlib import Path
-import stat
-import tempfile
-from typing import Any, Mapping
-
-from release_campaign_authorization import CampaignAuthorization, CampaignError
-from trusted_release_execution_plan import PlanError, TrustedReleasePlan
-
-
-class AcceptanceError(RuntimeError):
-    pass
-
-
-def secure_json(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise AcceptanceError(f"invalid_file:{path}")
-    st = path.lstat()
-    if st.st_uid != 0 or stat.S_IMODE(st.st_mode) & 0o022:
-        raise AcceptanceError(f"unsafe_file:{path}")
-    value = json.loads(path.read_text(encoding="utf-8"))
-    if not isinstance(value, dict):
-        raise AcceptanceError(f"json_object_required:{path}")
-    return value
-
-
-def atomic_new(path: Path, value: Mapping[str, Any]) -> None:
-    if path.exists() or path.is_symlink():
-        raise AcceptanceError("acceptance_receipt_exists")
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
-    try:
-        os.fchmod(fd, 0o600)
-        if os.geteuid() == 0:
-            os.fchown(fd, 0, 0)
-        with os.fdopen(fd, "w", encoding="utf-8", closefd=True) as stream:
-            json.dump(dict(value), stream, sort_keys=True, indent=2)
-            stream.write("\n")
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(name, path)
-        os.chmod(path, 0o600)
-    finally:
-        try:
-            os.unlink(name)
-        except FileNotFoundError:
-            pass
-
-
-def evaluate(
-    campaign: CampaignAuthorization,
-    binding: Mapping[str, Any],
-    evidence: Mapping[str, Any],
-    artifact: Mapping[str, Any],
-    staging: Mapping[str, Any],
-    main: Mapping[str, Any],
-    tag: Mapping[str, Any],
-    release_plan: Mapping[str, Any] | None = None,
-) -> dict[str, Any]:
-    required_binding = {
-        "version",
-        "target_oid",
-        "evidence_closure_oid",
-        "artifact_sha256",
-        "artifact_size",
-        "approval_plan_id",
-    }
-    if set(binding) != required_binding:
-        raise AcceptanceError("binding_fields_invalid")
-    if main.get("repository") != "aios/aios":
-        raise AcceptanceError("repository_identity_mismatch")
-    if main.get("target_in_main_lineage") is not True:
-        raise AcceptanceError("target_outside_main_lineage")
-    if evidence.get("object_type") != "commit":
-        raise AcceptanceError("evidence_not_commit")
-    if evidence.get("target_is_ancestor") is not True:
-        raise AcceptanceError("target_not_evidence_ancestor")
-    if evidence.get("closure_oid") != binding["evidence_closure_oid"]:
-        raise AcceptanceError("evidence_oid_mismatch")
-    if artifact.get("sha256") != binding["artifact_sha256"]:
-        raise AcceptanceError("artifact_digest_mismatch")
-    if artifact.get("size") != binding["artifact_size"]:
-        raise AcceptanceError("artifact_size_mismatch")
-    if artifact.get("retained") is not True:
-        raise AcceptanceError("artifact_not_retained")
-    if staging.get("install") != "PASS":
-        raise AcceptanceError("staging_install_failed")
-    if staging.get("health") != "PASS":
-        raise AcceptanceError("staging_health_failed")
-    if staging.get("restart") != "PASS":
-        raise AcceptanceError("staging_restart_failed")
-    if staging.get("rollback_readiness") != "PASS":
-        raise AcceptanceError("rollback_readiness_failed")
-    if tag.get("conflict") is not False:
-        raise AcceptanceError("tag_conflict")
-    trusted_plan: TrustedReleasePlan | None = None
-    if release_plan is not None:
-        try:
-            trusted_plan = TrustedReleasePlan.from_mapping(release_plan)
-            trusted_plan.assert_binding(binding)
-        except PlanError as exc:
-            raise AcceptanceError(f"trusted_release_plan_invalid:{exc}") from exc
-        if trusted_plan.value["campaign_authorization_sha256"] != campaign.digest:
-            raise AcceptanceError("campaign_authorization_digest_mismatch")
-        if int(trusted_plan.value["campaign_generation"]) != int(campaign.data["generation"]):
-            raise AcceptanceError("campaign_generation_mismatch")
-        if main.get("tree_oid") not in (None, trusted_plan.value["tree_oid"]):
-            raise AcceptanceError("tree_oid_mismatch")
-        if evidence.get("release_plan_sha256") not in (None, trusted_plan.release_plan_sha256):
-            raise AcceptanceError("evidence_release_plan_mismatch")
-        if artifact.get("manifest_sha256") not in (None, trusted_plan.value["manifest_sha256"]):
-            raise AcceptanceError("manifest_digest_mismatch")
-        if artifact.get("package_closure_sha256") not in (None, trusted_plan.value["package_closure_sha256"]):
-            raise AcceptanceError("package_closure_digest_mismatch")
-    campaign.assert_operation("derive_campaign_acceptance")
-    result = {
-        "schema": "aios.campaign-release-acceptance.v1",
-        "accepted": True,
-        "binding_replaced": False,
-        "campaign_id": campaign.campaign_id,
-        "campaign_generation": campaign.data["generation"],
-        **dict(binding),
-        "owner_interaction_required": False,
-    }
-    if trusted_plan is not None:
-        result.update({
-            "candidate_id": trusted_plan.value["candidate_id"],
-            "release_plan_sha256": trusted_plan.release_plan_sha256,
-            "candidate_binding_sha256": trusted_plan.candidate_binding_sha256,
-            "campaign_authorization_sha256": trusted_plan.value["campaign_authorization_sha256"],
-            "campaign_generation": trusted_plan.value["campaign_generation"],
-            "tree_oid": trusted_plan.value["tree_oid"],
-            "manifest_sha256": trusted_plan.value["manifest_sha256"],
-            "package_closure_sha256": trusted_plan.value["package_closure_sha256"],
-            "deployment_plan_sha256": trusted_plan.value["deployment_plan_sha256"],
-            "policy_sha256": trusted_plan.value["policy_sha256"],
-            "rollback": trusted_plan.value["rollback"],
-            "baseline": trusted_plan.value["baseline"],
-        })
-    return result
-
-
-def main() -> int:
-    p = argparse.ArgumentParser()
-    p.add_argument("--campaign", type=Path, required=True)
-    p.add_argument("--revocation", type=Path)
-    p.add_argument("--binding", type=Path, required=True)
-    p.add_argument("--evidence", type=Path, required=True)
-    p.add_argument("--artifact", type=Path, required=True)
-    p.add_argument("--staging", type=Path, required=True)
-    p.add_argument("--main-facts", type=Path, required=True)
-    p.add_argument("--tag-facts", type=Path, required=True)
-    p.add_argument("--release-plan", type=Path)
-    p.add_argument("--output", type=Path, required=True)
-    a = p.parse_args()
-
-    campaign = CampaignAuthorization.load(
-        a.campaign,
-        revocation=a.revocation,
-        require_active=True,
-    )
-    receipt = evaluate(
-        campaign,
-        secure_json(a.binding),
-        secure_json(a.evidence),
-        secure_json(a.artifact),
-        secure_json(a.staging),
-        secure_json(a.main_facts),
-        secure_json(a.tag_facts),
-        secure_json(a.release_plan) if a.release_plan else None,
-    )
-    atomic_new(a.output, receipt)
-    print(json.dumps(receipt, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    try:
-        raise SystemExit(main())
-    except (CampaignError, AcceptanceError) as exc:
-        print(json.dumps({"status": "BLOCKED", "reason": str(exc)}, sort_keys=True))
-        raise SystemExit(2)

active-runtime/app/deployment_state.py

@@ -1,67 +0,0 @@
-"""Runtime deployment-state provider for governed health contracts."""
-from __future__ import annotations
-
-import datetime as dt
-import json
-import os
-import re
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any, Mapping
-
-_OID = re.compile(r"^[0-9a-f]{40}$")
-_SHA = re.compile(r"^[0-9a-f]{64}$")
-_STATES = {"STAGED", "ACTIVE", "ROLLED_BACK"}
-
-@dataclass(frozen=True)
-class RuntimeDeploymentState:
-    version: str
-    commit_oid: str
-    artifact_sha256: str
-    deployment_state: str
-
-    @property
-    def production_deployed(self) -> bool:
-        return self.deployment_state == "ACTIVE"
-
-    def health_payload(self) -> dict[str, Any]:
-        return {
-            "status": "ok",
-            "version": self.version,
-            "commit_oid": self.commit_oid,
-            "artifact_sha256": self.artifact_sha256,
-            "deployment_state": self.deployment_state,
-            "production_deployed": self.production_deployed,
-            "health_timestamp": dt.datetime.now(dt.timezone.utc).isoformat(),
-        }
-
-    @classmethod
-    def from_environment(cls, environ: Mapping[str, str] | None = None) -> "RuntimeDeploymentState":
-        env = dict(environ or os.environ)
-        values: dict[str, Any] = {}
-        state_file = env.get("DEPLOYMENT_STATE_FILE", "").strip()
-        if state_file:
-            path = Path(state_file)
-            if path.is_file() and not path.is_symlink():
-                loaded = json.loads(path.read_text(encoding="utf-8"))
-                if not isinstance(loaded, dict):
-                    raise ValueError("deployment_state_file_object_required")
-                values.update(loaded)
-        file_deployment_state = values.get("deployment_state")
-        values.update({k: v for k, v in {
-            "version": env.get("RELEASE_VERSION", values.get("version", "")),
-            "commit_oid": env.get("TARGET_OID", values.get("commit_oid", "")),
-            "artifact_sha256": env.get("ARTIFACT_SHA256", values.get("artifact_sha256", "")),
-            "deployment_state": env.get("DEPLOYMENT_STATE", values.get("deployment_state", "")),
-        }.items() if v != ""})
-        if file_deployment_state not in (None, ""):
-            values["deployment_state"] = file_deployment_state
-        version = str(values.get("version", ""))
-        commit_oid = str(values.get("commit_oid", ""))
-        artifact_sha256 = str(values.get("artifact_sha256", ""))
-        deployment_state = str(values.get("deployment_state", ""))
-        if not version or not _OID.fullmatch(commit_oid) or not _SHA.fullmatch(artifact_sha256):
-            raise ValueError("deployment_binding_invalid")
-        if deployment_state not in _STATES:
-            raise ValueError("deployment_state_invalid")
-        return cls(version, commit_oid, artifact_sha256, deployment_state)

active-runtime/app/gitea_tag_publication.py

@@ -8,7 +8,6 @@ import json
 import os
 import re
 import subprocess
-import sys
 import tempfile
 import time
 import urllib.error
@@ -24,15 +23,10 @@ try:
     from authoritative_git import AuthoritativeGitError, run_authoritative_git
 except ModuleNotFoundError:
     from .authoritative_git import AuthoritativeGitError, run_authoritative_git
-try:
-    from release_version import RELEASE_VERSION_RE, validate_release_version
-except ModuleNotFoundError:
-    sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
-    from release_version import RELEASE_VERSION_RE, validate_release_version
 
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
-VERSION_RE = RELEASE_VERSION_RE
+VERSION_RE = re.compile(r"^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$")
 DEPLOYMENT_EVIDENCE_RE = re.compile(r"^(?:sha256:[0-9a-f]{64}|git:[0-9a-f]{40})$")
 FINGERPRINT_FIELDS = (
     "version",
@@ -89,14 +83,9 @@ class PublicationManualOwnerReviewRequired(
 
 
 def validate_version(version: str) -> str:
-    return validate_release_version(version)
-
-
-def validate_gitea_api_url(api_url: str) -> str:
-    value = str(api_url or "").strip().rstrip("/")
-    parsed = urllib.parse.urlsplit(value)
-    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
-        raise ValueError("Gitea API URL must be HTTP(S)")
+    value = str(version or "")
+    if not VERSION_RE.fullmatch(value):
+        raise ValueError("invalid release version")
     return value
 
 
@@ -422,11 +411,13 @@ class GiteaTagClient:
         timeout: float = 15,
         token_line: int = 1,
     ):
-        self.api_url = validate_gitea_api_url(api_url)
+        self.api_url = api_url.rstrip("/")
         self.repository = repository.strip("/")
         self.token_file = token_file
         self.timeout = timeout
         self.token_line = token_line
+        if not self.api_url.startswith(("https://", "http://")):
+            raise ValueError("Gitea API URL must be HTTP(S)")
         if self.repository.count("/") != 1:
             raise ValueError("Gitea repository must be owner/name")
 

active-runtime/app/governance/__init__.py

@@ -1 +0,0 @@
-"""Permanent AIOS governance source components."""

active-runtime/app/governance/aios-governance-drift-monitor

@@ -1,75 +0,0 @@
-#!/usr/bin/env python3
-import json
-import pathlib
-import socket
-import time
-
-SOCKET = '/run/aios-governance-executor/executor.sock'
-STATE = pathlib.Path('/var/lib/aios-gitops/governance-executor/drift-monitor.json')
-APPROVED = pathlib.Path('/var/lib/aios-gitops/runtime/tasks/AIOS-PROTECTION-SNAPSHOT-DRIFT-FORENSICS-V1/protection-drift/semantic-analysis.json')
-
-
-def call():
-    sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    sock.settimeout(20)
-    sock.connect(SOCKET)
-    request = {'operation': 'GET_BRANCH_PROTECTION', 'payload': {'repository': 'aios/aios', 'branch': 'main'}}
-    sock.sendall((json.dumps(request, separators=(',', ':')) + '\n').encode())
-    chunks = []
-    while True:
-        part = sock.recv(1024 * 1024)
-        if not part:
-            break
-        chunks.append(part)
-        if b'\n' in part:
-            break
-    sock.close()
-    return json.loads(b''.join(chunks).splitlines()[0])
-
-
-def main():
-    try:
-        result = call()
-        if result.get('status') != 'PASS':
-            raise RuntimeError(str(result.get('code') or 'EXECUTOR_GET_FAILED'))
-        approved = json.loads(APPROVED.read_text(encoding='utf-8'))
-        approved_transport = approved['approved_transport_digest_from_evidence']
-        approved_semantic = approved['approved_semantic_digest']
-        transport = result['transport_digest']
-        semantic = result['semantic_digest']
-        if semantic != approved_semantic:
-            state = 'GOVERNANCE_POLICY_DRIFT'
-        elif transport != approved_transport:
-            state = 'GOVERNANCE_TRANSPORT_METADATA_CHANGED'
-        else:
-            state = 'NO_DRIFT'
-        payload = {
-            'schema': 'aios.governance-drift-monitor.v1',
-            'observed_at_unix': int(time.time()),
-            'status': state,
-            'release_blocking': False,
-            'approved_transport_digest': approved_transport,
-            'observed_transport_digest': transport,
-            'approved_semantic_digest': approved_semantic,
-            'observed_semantic_digest': semantic,
-            'semantic_schema': result.get('semantic_schema'),
-            'source': 'Dedicated Governance Executor GET_BRANCH_PROTECTION',
-        }
-    except Exception as exc:
-        payload = {
-            'schema': 'aios.governance-drift-monitor.v1',
-            'observed_at_unix': int(time.time()),
-            'status': 'MONITOR_UNAVAILABLE',
-            'release_blocking': False,
-            'error_code': str(exc),
-        }
-    STATE.parent.mkdir(parents=True, exist_ok=True)
-    temporary = STATE.with_suffix('.tmp')
-    temporary.write_text(json.dumps(payload, sort_keys=True, separators=(',', ':'), ensure_ascii=False) + '\n', encoding='utf-8')
-    temporary.replace(STATE)
-    STATE.chmod(0o640)
-    print(json.dumps(payload, sort_keys=True, separators=(',', ':'), ensure_ascii=False))
-
-
-if __name__ == '__main__':
-    main()

active-runtime/app/governance/aios-governance-executor

@@ -1,417 +0,0 @@
-#!/usr/bin/env python3
-import base64
-import copy
-import hashlib
-import json
-import os
-import pathlib
-import socket
-import time
-import urllib.error
-import urllib.parse
-import urllib.request
-
-SOURCE_GOVERNANCE = "/opt/aios/aios-control-plane/current/active-runtime/app/governance"
-if SOURCE_GOVERNANCE not in __import__("sys").path:
-    __import__("sys").path.insert(0, SOURCE_GOVERNANCE)
-from stage2_gate_migration import (
-    CAMPAIGN_GATE,
-    CAMPAIGN_ID,
-    OWNER_GATE,
-    STAGE1_SEMANTIC_SHA,
-    Stage2GateError,
-    build_target,
-    semantic_digest as stage2_semantic_digest,
-    validate_stage2_facts,
-)
-
-API = "http://127.0.0.1:3000"
-REPO = "aios/aios"
-SOCKET = "/run/aios-governance-executor/executor.sock"
-JOURNAL = pathlib.Path("/var/lib/aios-gitops/governance-executor/executor-journal.jsonl")
-RECONCILIATION_BINDING_PATH = pathlib.Path("/var/lib/aios-gitops/governance-executor/reconciliation-binding.json")
-PR54_HEAD = "015185d7e5191d18c5c1596160807ac228782a0a"
-PR54_REVIEW = 104
-PR54_MANIFEST_SHA = "1b11ee42d53a9f6c1646e5f5ddd8ce5b7ecf301483b9f3d47a068290d541ba4b"
-PR54_PREVIOUS_PROTECTION_SHA = "8b3370add21cd23c2b4f41d8d84d3eaaa09ddf0451549b72c7941bbd92d5d60a"
-SEMANTIC_SCHEMA = "aios.semantic-protection.v1"
-APPROVED_SEMANTIC_SHA = "ba15d512ed8c1f43e5f72c84125a3a71a7347ef59e18000bbfca24d6e69f1b19"
-STAGE1_SEMANTIC_SHA = "d911e856f71de6105b8efa08e13338a448e0b6d37536332decd80c9f409ecf27"
-USER_IDS = {"owner": 2, "aios-autonomy-agent": 153}
-
-
-def canon(value):
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
-
-
-def sha(value):
-    return hashlib.sha256(canon(value)).hexdigest()
-
-
-def token():
-    value = (pathlib.Path(os.environ["CREDENTIALS_DIRECTORY"]) / "gitea-governance-executor-token").read_text().strip()
-    if len(value) < 16:
-        raise RuntimeError("EXECUTOR_CREDENTIAL_INVALID")
-    return value
-
-
-def api(method, path, value, body=None, expected=(200,)):
-    raw = None if body is None else json.dumps(body, separators=(",", ":")).encode()
-    req = urllib.request.Request(API + path, data=raw, method=method)
-    req.add_header("Authorization", "token " + value)
-    req.add_header("Accept", "application/json")
-    if raw is not None:
-        req.add_header("Content-Type", "application/json")
-    try:
-        with urllib.request.urlopen(req, timeout=20) as response:
-            status = response.status
-            payload = response.read()
-    except urllib.error.HTTPError as exc:
-        if exc.code in expected:
-            payload = exc.read()
-            return exc.code, json.loads(payload) if payload else None
-        raise RuntimeError("GITEA_HTTP_" + str(exc.code))
-    if status not in expected:
-        raise RuntimeError("GITEA_HTTP_" + str(status))
-    if not payload or not payload.strip():
-        raise RuntimeError("GITEA_EMPTY_JSON:" + path)
-    try:
-        decoded = json.loads(payload)
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise RuntimeError("GITEA_INVALID_JSON:" + path) from exc
-    return status, decoded
-
-
-def journal(event, **fields):
-    JOURNAL.parent.mkdir(parents=True, exist_ok=True)
-    record = {"schema": "aios.governance-executor-journal.v2", "event": event, "unix": int(time.time()), **fields}
-    with JOURNAL.open("a", encoding="utf-8") as stream:
-        stream.write(json.dumps(record, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n")
-        stream.flush()
-        os.fsync(stream.fileno())
-
-
-def typed_json(value):
-    if value in (None, "null"):
-        return []
-    if isinstance(value, str):
-        return json.loads(value)
-    return value
-
-
-def user_ids(names):
-    result = []
-    for name in names or []:
-        if name not in USER_IDS:
-            raise RuntimeError("UNKNOWN_GOVERNANCE_USER:" + str(name))
-        result.append(USER_IDS[name])
-    return sorted(result)
-
-
-def semantic_policy(value):
-    policy = {
-        "schema_version": SEMANTIC_SCHEMA,
-        "repo_id": 1,
-        "protection_id": 2,
-        "branch_name": value.get("branch_name"),
-        "can_push": value.get("enable_push"),
-        "can_force_push": value.get("enable_force_push"),
-        "enable_merge_whitelist": value.get("enable_merge_whitelist"),
-        "merge_whitelist_user_ids": user_ids(value.get("merge_whitelist_usernames")),
-        "merge_whitelist_team_ids": [],
-        "required_approvals": value.get("required_approvals"),
-        "enable_status_check": value.get("enable_status_check"),
-        "status_check_contexts": sorted(value.get("status_check_contexts") or []),
-        "block_admin_merge_override": value.get("block_admin_merge_override"),
-        "block_on_official_review_requests": value.get("block_on_official_review_requests"),
-        "block_on_outdated_branch": value.get("block_on_outdated_branch"),
-        "block_on_rejected_reviews": value.get("block_on_rejected_reviews"),
-        "dismiss_stale_approvals": value.get("dismiss_stale_approvals"),
-        "ignore_stale_approvals": value.get("ignore_stale_approvals"),
-        "enable_approvals_whitelist": value.get("enable_approvals_whitelist"),
-        "approvals_whitelist_user_ids": user_ids(value.get("approvals_whitelist_username")),
-        "approvals_whitelist_team_ids": [],
-        "enable_bypass_allowlist": value.get("enable_bypass_allowlist"),
-        "bypass_allowlist_user_ids": user_ids(value.get("bypass_allowlist_usernames")),
-        "bypass_allowlist_team_ids": [],
-        "enable_force_push_allowlist": value.get("enable_force_push_allowlist"),
-        "force_push_allowlist_user_ids": user_ids(value.get("force_push_allowlist_usernames")),
-        "force_push_allowlist_team_ids": [],
-        "enable_whitelist": value.get("enable_push_whitelist"),
-        "whitelist_user_ids": user_ids(value.get("push_whitelist_usernames")),
-        "whitelist_team_ids": [],
-        "force_push_allowlist_deploy_keys": value.get("force_push_allowlist_deploy_keys"),
-        "whitelist_deploy_keys": value.get("push_whitelist_deploy_keys"),
-        "require_signed_commits": value.get("require_signed_commits"),
-        "priority": value.get("priority"),
-        "protected_file_patterns": value.get("protected_file_patterns"),
-        "unprotected_file_patterns": value.get("unprotected_file_patterns"),
-    }
-    return policy
-
-
-def semantic_sha(value):
-    return sha(semantic_policy(value))
-
-
-def verify_binding(binding, value):
-    required = {
-        "governance_request_PR", "exact_request_head", "Owner_review_id", "Owner_review_exact_head",
-        "manifest_sha256", "expected_previous_snapshot_sha256", "approved_delta",
-        "semantic_reconciliation_request_id", "semantic_reconciliation_head",
-        "semantic_reconciliation_review_id", "semantic_reconciliation_review_head",
-        "approved_semantic_digest",
-    }
-    if set(binding) != required:
-        raise RuntimeError("GOVERNANCE_BINDING_SCHEMA_INVALID")
-    if binding["governance_request_PR"] != 54 or binding["exact_request_head"] != PR54_HEAD:
-        raise RuntimeError("GOVERNANCE_BINDING_PR54_MISMATCH")
-    if binding["Owner_review_id"] != PR54_REVIEW or binding["Owner_review_exact_head"] != PR54_HEAD:
-        raise RuntimeError("GOVERNANCE_BINDING_REVIEW_MISMATCH")
-    if binding["manifest_sha256"] != PR54_MANIFEST_SHA:
-        raise RuntimeError("GOVERNANCE_BINDING_MANIFEST_MISMATCH")
-    if binding["expected_previous_snapshot_sha256"] != PR54_PREVIOUS_PROTECTION_SHA:
-        raise RuntimeError("GOVERNANCE_BINDING_SNAPSHOT_MISMATCH")
-    if binding["approved_delta"] != {"add_merge_whitelist_user_id": 153}:
-        raise RuntimeError("GOVERNANCE_BINDING_DELTA_DENIED")
-    if binding["approved_semantic_digest"] != APPROVED_SEMANTIC_SHA:
-        raise RuntimeError("GOVERNANCE_BINDING_SEMANTIC_DIGEST_MISMATCH")
-    if not RECONCILIATION_BINDING_PATH.is_file():
-        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_REQUIRED")
-    try:
-        reconciliation = json.loads(RECONCILIATION_BINDING_PATH.read_text(encoding="utf-8"))
-    except (OSError, ValueError):
-        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_INVALID") from None
-    required_reconciliation = {
-        "schema", "request_id", "pr_number", "request_head", "owner_review_id",
-        "owner_review_head", "approved_semantic_digest", "approved_delta",
-    }
-    if set(reconciliation) != required_reconciliation or reconciliation.get("schema") != "aios.semantic-reconciliation-binding.v1":
-        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_INVALID")
-    if reconciliation["approved_semantic_digest"] != APPROVED_SEMANTIC_SHA or reconciliation["approved_delta"] != binding["approved_delta"]:
-        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_MISMATCH")
-    if (
-        reconciliation["request_id"] != binding["semantic_reconciliation_request_id"]
-        or reconciliation["request_head"] != binding["semantic_reconciliation_head"]
-        or reconciliation["owner_review_id"] != binding["semantic_reconciliation_review_id"]
-        or reconciliation["owner_review_head"] != binding["semantic_reconciliation_review_head"]
-    ):
-        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_MISMATCH")
-    _, reconciliation_pr = api("GET", f"/api/v1/repos/{REPO}/pulls/{reconciliation['pr_number']}", value)
-    if (
-        reconciliation_pr.get("state") != "open"
-        or reconciliation_pr.get("merged")
-        or reconciliation_pr.get("head", {}).get("sha") != reconciliation["request_head"]
-        or reconciliation_pr.get("base", {}).get("ref") != "governance/approvals"
-    ):
-        raise RuntimeError("SEMANTIC_RECONCILIATION_REQUEST_STALE")
-    _, reconciliation_reviews = api("GET", f"/api/v1/repos/{REPO}/pulls/{reconciliation['pr_number']}/reviews", value)
-    reconciliation_review = next((x for x in reconciliation_reviews if x.get("id") == reconciliation["owner_review_id"]), None)
-    if (
-        not reconciliation_review
-        or reconciliation_review.get("user", {}).get("id") != 2
-        or reconciliation_review.get("state") != "APPROVED"
-        or reconciliation_review.get("commit_id") != reconciliation["owner_review_head"]
-        or reconciliation_review.get("dismissed") is not False
-    ):
-        raise RuntimeError("SEMANTIC_RECONCILIATION_OWNER_REVIEW_STALE")
-    _, pr = api("GET", f"/api/v1/repos/{REPO}/pulls/54", value)
-    if pr.get("state") != "open" or pr.get("merged") or pr.get("head", {}).get("sha") != PR54_HEAD:
-        raise RuntimeError("PR54_APPROVAL_STALE")
-    _, reviews = api("GET", f"/api/v1/repos/{REPO}/pulls/54/reviews", value)
-    review = next((x for x in reviews if x.get("id") == PR54_REVIEW), None)
-    if not review or review.get("user", {}).get("id") != 2 or review.get("state") != "APPROVED" or review.get("commit_id") != PR54_HEAD or review.get("dismissed") is not False:
-        raise RuntimeError("PR54_APPROVAL_STALE")
-    manifest_path = "approvals/governance-policy/AIOS-AUTONOMOUS-MERGE-GOVERNANCE-SCOPE-EXTENSION-V1.json"
-    _, content = api("GET", f"/api/v1/repos/{REPO}/contents/{urllib.parse.quote(manifest_path, safe='/')}?ref={PR54_HEAD}", value)
-    raw = base64.b64decode("".join(content.get("content", "").split()))
-    if hashlib.sha256(raw).hexdigest() != PR54_MANIFEST_SHA:
-        raise RuntimeError("PR54_MANIFEST_STALE")
-
-
-def get_protection(value, branch):
-    if branch not in {"main", "governance/approvals"}:
-        raise RuntimeError("BRANCH_DENIED")
-    _, protection = api("GET", f"/api/v1/repos/{REPO}/branch_protections/{urllib.parse.quote(branch, safe='')}", value)
-    return protection
-
-
-def mutation_receipt(before, after, binding, target_semantic):
-    return {
-        "before": {"transport_digest": sha(before), "semantic_digest": semantic_sha(before)},
-        "approved": {
-            "mutation_predicate_digest": sha({"operation": "ADD_MERGE_EXECUTOR", "subject_user_id": 153, "preserve_all_unmodified_security_fields": True}),
-            "Owner_review_id": binding["Owner_review_id"],
-            "semantic_policy_digest": APPROVED_SEMANTIC_SHA,
-        },
-        "after": {"transport_digest": sha(after), "semantic_digest": semantic_sha(after)},
-        "delta": {"add_merge_whitelist_user_id": 153},
-        "target_semantic_digest": sha(target_semantic),
-        "unmodified_security_fields": {"verified": True},
-    }
-
-
-def apply_stage1(binding, value):
-    verify_binding(binding, value)
-    before = get_protection(value, "main")
-    before_semantic = semantic_policy(before)
-    before_semantic_sha = sha(before_semantic)
-    names = list(before.get("merge_whitelist_usernames") or [])
-    name_ids = user_ids(names)
-    if name_ids not in ([2], [2, 153]):
-        raise RuntimeError("PROTECTION_WHITELIST_PRESTATE_INVALID")
-    target_names = ["owner", "aios-autonomy-agent"]
-    target_semantic = copy.deepcopy(before_semantic)
-    target_semantic["merge_whitelist_user_ids"] = [2, 153]
-    if name_ids == [2, 153]:
-        if before_semantic_sha != STAGE1_SEMANTIC_SHA:
-            journal("APPLY_BLOCKED_STAGE1_IDEMPOTENCY_SEMANTIC_CONFLICT", transport_digest=sha(before), semantic_digest=before_semantic_sha, expected_semantic_digest=STAGE1_SEMANTIC_SHA)
-            raise RuntimeError("PROTECTION_STAGE1_SEMANTIC_CONFLICT")
-        receipt = mutation_receipt(before, before, binding, target_semantic)
-        journal("APPLY_APPROVED_PROTECTION_DELTA_IDEMPOTENT_SUCCESS", receipt=receipt)
-        return {"status": "IDEMPOTENT_SUCCESS", "protection": before, "transport_digest": sha(before), "semantic_digest": before_semantic_sha, "target_semantic_digest": sha(target_semantic)}
-    if before_semantic_sha != APPROVED_SEMANTIC_SHA:
-        journal("APPLY_BLOCKED_SEMANTIC_CAS", transport_digest=sha(before), semantic_digest=before_semantic_sha, expected_semantic_digest=APPROVED_SEMANTIC_SHA)
-        raise RuntimeError("PROTECTION_SEMANTIC_CAS_CONFLICT")
-    after_api = api("PATCH", f"/api/v1/repos/{REPO}/branch_protections/main", value, {"merge_whitelist_usernames": target_names})[1]
-    after = get_protection(value, "main")
-    for key in before:
-        if key in {"updated_at", "merge_whitelist_usernames"}:
-            continue
-        if after.get(key) != before.get(key):
-            raise RuntimeError("PROTECTION_UNAPPROVED_FIELD_CHANGED:" + key)
-    if user_ids(after.get("merge_whitelist_usernames")) != [2, 153]:
-        raise RuntimeError("PROTECTION_TARGET_READBACK_FAILED")
-    after_semantic = semantic_policy(after)
-    if after_semantic != target_semantic:
-        raise RuntimeError("PROTECTION_SEMANTIC_TARGET_READBACK_FAILED")
-    receipt = mutation_receipt(before, after, binding, target_semantic)
-    journal("APPLY_APPROVED_PROTECTION_DELTA_COMPLETED", receipt=receipt)
-    return {"status": "APPLIED", "protection": after, "previous_transport_digest": sha(before), "previous_semantic_digest": before_semantic_sha, "transport_digest": sha(after), "semantic_digest": sha(after_semantic), "receipt": receipt}
-
-
-def apply_stage2(binding, facts, value):
-    verify_binding(binding, value)
-    validate_stage2_facts(facts)
-    before = get_protection(value, "main")
-    if OWNER_GATE in (before.get("status_check_contexts") or []) and stage2_semantic_digest(before) != STAGE1_SEMANTIC_SHA:
-        raise RuntimeError("STAGE2_SEMANTIC_PRECONDITION_INVALID")
-    try:
-        status, target = build_target(before)
-    except Stage2GateError as exc:
-        journal("MIGRATE_APPROVED_GATE_BLOCKED", reason=str(exc), semantic_digest=stage2_semantic_digest(before))
-        raise RuntimeError(str(exc)) from exc
-    target_digest = stage2_semantic_digest(target)
-    if status == "IDEMPOTENT_SUCCESS":
-        journal(
-            "MIGRATE_APPROVED_GATE_IDEMPOTENT_SUCCESS",
-            before_semantic_digest=stage2_semantic_digest(before),
-            target_semantic_digest=target_digest,
-            campaign_id=CAMPAIGN_ID,
-        )
-        return {
-            "status": status,
-            "protection": before,
-            "transport_digest": sha(before),
-            "semantic_digest": stage2_semantic_digest(before),
-            "target_semantic_digest": target_digest,
-            "gate_transition": {"removed": OWNER_GATE, "required": CAMPAIGN_GATE},
-        }
-    after_api = api(
-        "PATCH",
-        f"/api/v1/repos/{REPO}/branch_protections/main",
-        value,
-        {"status_check_contexts": target["status_check_contexts"]},
-    )[1]
-    after = get_protection(value, "main")
-    for key in before:
-        if key in {"updated_at", "status_check_contexts"}:
-            continue
-        if after.get(key) != before.get(key):
-            raise RuntimeError("PROTECTION_UNAPPROVED_FIELD_CHANGED:" + key)
-    if after.get("status_check_contexts") != target["status_check_contexts"]:
-        raise RuntimeError("STAGE2_GATE_TARGET_READBACK_FAILED")
-    if stage2_semantic_digest(after) != target_digest:
-        raise RuntimeError("STAGE2_SEMANTIC_TARGET_READBACK_FAILED")
-    receipt = {
-        "before_transport_digest": sha(before),
-        "before_semantic_digest": stage2_semantic_digest(before),
-        "after_transport_digest": sha(after),
-        "after_semantic_digest": stage2_semantic_digest(after),
-        "target_semantic_digest": target_digest,
-        "campaign_id": CAMPAIGN_ID,
-        "gate_transition": {"removed": OWNER_GATE, "required": CAMPAIGN_GATE},
-        "preserved_security_fields": True,
-        "facts_digest": sha(facts),
-    }
-    journal("MIGRATE_APPROVED_GATE_COMPLETED", receipt=receipt)
-    return {
-        "status": "APPLIED",
-        "protection": after,
-        "previous_transport_digest": sha(before),
-        "previous_semantic_digest": stage2_semantic_digest(before),
-        "transport_digest": sha(after),
-        "semantic_digest": stage2_semantic_digest(after),
-        "target_semantic_digest": target_digest,
-        "receipt": receipt,
-    }
-
-
-def handle(request, value):
-    if not isinstance(request, dict) or set(request) != {"operation", "payload"}:
-        raise RuntimeError("REQUEST_SCHEMA_INVALID")
-    operation = request["operation"]
-    payload = request["payload"]
-    if not isinstance(payload, dict) or payload.get("repository") != REPO:
-        raise RuntimeError("REPOSITORY_DENIED")
-    if operation == "GET_BRANCH_PROTECTION":
-        protection = get_protection(value, payload.get("branch"))
-        journal("GET_BRANCH_PROTECTION", branch=payload.get("branch"), transport_digest=sha(protection), semantic_digest=semantic_sha(protection))
-        return {"status": "PASS", "protection": protection, "snapshot_sha256": sha(protection), "transport_digest": sha(protection), "semantic_digest": semantic_sha(protection), "semantic_schema": SEMANTIC_SCHEMA}
-    if operation == "READBACK_BRANCH_PROTECTION":
-        protection = get_protection(value, payload.get("branch"))
-        return {"status": "PASS", "protection": protection, "snapshot_sha256": sha(protection), "transport_digest": sha(protection), "semantic_digest": semantic_sha(protection), "semantic_schema": SEMANTIC_SCHEMA}
-    if operation == "APPLY_APPROVED_PROTECTION_DELTA":
-        binding = payload.get("GovernanceExecutionBinding")
-        if not isinstance(binding, dict):
-            raise RuntimeError("GOVERNANCE_BINDING_REQUIRED")
-        return apply_stage1(binding, value)
-    if operation == "MIGRATE_APPROVED_GATE":
-        binding = payload.get("GovernanceExecutionBinding")
-        facts = payload.get("Stage2Facts")
-        if not isinstance(binding, dict) or not isinstance(facts, dict):
-            raise RuntimeError("STAGE2_BINDING_OR_FACTS_REQUIRED")
-        return apply_stage2(binding, facts, value)
-    raise RuntimeError("OPERATION_DENIED")
-
-
-def main():
-    value = token()
-    sock_path = pathlib.Path(SOCKET)
-    sock_path.unlink(missing_ok=True)
-    server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    server.bind(SOCKET)
-    os.chmod(SOCKET, 0o660)
-    server.listen(16)
-    journal("EXECUTOR_STARTED", api_surface=["GET_BRANCH_PROTECTION", "APPLY_APPROVED_PROTECTION_DELTA", "MIGRATE_APPROVED_GATE", "READBACK_BRANCH_PROTECTION"], semantic_schema=SEMANTIC_SCHEMA, approved_semantic_digest=APPROVED_SEMANTIC_SHA, stage1_semantic_digest=STAGE1_SEMANTIC_SHA, campaign_gate=CAMPAIGN_GATE)
-    try:
-        while True:
-            conn, _ = server.accept()
-            with conn:
-                data = conn.recv(1024 * 1024 + 1)
-                if len(data) > 1024 * 1024:
-                    result = {"status": "FAIL", "code": "REQUEST_TOO_LARGE"}
-                else:
-                    try:
-                        request = json.loads(data.decode())
-                        result = handle(request, value)
-                    except Exception as exc:
-                        result = {"status": "FAIL", "code": str(exc)}
-                conn.sendall((json.dumps(result, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n").encode())
-    finally:
-        server.close()
-        sock_path.unlink(missing_ok=True)
-
-
-if __name__ == "__main__":
-    main()

active-runtime/app/governance/aios-governance-preapproval-publisher

@@ -1,347 +0,0 @@
-#!/usr/bin/env python3
-import base64
-import hashlib
-import json
-import os
-import pathlib
-import shutil
-import socket
-import subprocess
-import tempfile
-import time
-import urllib.error
-import urllib.parse
-import urllib.request
-
-LOCAL_API = 'http://127.0.0.1:3000/api/v1'
-NETWORK_API = 'https://g.cnnetmkt.top/git/api/v1'
-NETWORK_REMOTE = 'https://g.cnnetmkt.top/git/aios/aios.git'
-REPO = 'aios/aios'
-BASE_BRANCH = 'governance/approvals'
-REQUEST_BRANCH = 'governance/request/protection-semantic-reconciliation-v1-20260808'
-SOCKET_PATH = '/run/aios-governance-preapproval-publisher/publisher.sock'
-CREDENTIAL_NAME = 'gitea-machine-token'
-AUTHORITY_REPO = '/data/aios-gitops/repo.git'
-TASK_ROOT = pathlib.Path('/var/lib/aios-gitops/runtime/tasks/AIOS-PROTECTION-SNAPSHOT-DRIFT-FORENSICS-V1')
-INPUT_ROOT = TASK_ROOT / 'publication-input'
-RECEIPT = TASK_ROOT / 'publication-receipt.json'
-MANIFEST_REL = 'approvals/governance-policy/AIOS-PROTECTION-SEMANTIC-SNAPSHOT-RECONCILIATION-V1.json'
-EVIDENCE_REL = 'approvals/governance-policy/AIOS-PROTECTION-SEMANTIC-SNAPSHOT-RECONCILIATION-V1.evidence.json'
-
-
-def digest_bytes(data):
-    return hashlib.sha256(data).hexdigest()
-
-
-def digest_json(value):
-    return digest_bytes(json.dumps(value, sort_keys=True, separators=(',', ':'), ensure_ascii=False).encode())
-
-
-def load_token():
-    path = pathlib.Path(os.environ['CREDENTIALS_DIRECTORY']) / CREDENTIAL_NAME
-    value = path.read_text(encoding='utf-8').strip()
-    if len(value) < 16:
-        raise RuntimeError('MACHINE_CREDENTIAL_INVALID')
-    return value
-
-
-def api(base, method, path, token, body=None, expected=(200,)):
-    raw = None if body is None else json.dumps(body, separators=(',', ':'), ensure_ascii=False).encode()
-    request = urllib.request.Request(base + path, data=raw, method=method)
-    request.add_header('Authorization', 'token ' + token)
-    request.add_header('Accept', 'application/json')
-    if raw is not None:
-        request.add_header('Content-Type', 'application/json')
-    try:
-        with urllib.request.urlopen(request, timeout=20) as response:
-            payload = response.read()
-            if response.status not in expected:
-                raise RuntimeError('GITEA_HTTP_' + str(response.status))
-            return response.status, json.loads(payload) if payload else None
-    except urllib.error.HTTPError as exc:
-        payload = exc.read()
-        if exc.code in expected:
-            return exc.code, json.loads(payload) if payload else None
-        raise RuntimeError('GITEA_HTTP_' + str(exc.code) + ':' + method + ':' + path) from None
-
-
-def authority_head():
-    result = subprocess.run(
-        ['git', '--git-dir=' + AUTHORITY_REPO, 'rev-parse', 'refs/heads/' + BASE_BRANCH],
-        text=True, capture_output=True, check=False,
-    )
-    if result.returncode != 0:
-        raise RuntimeError('AUTHORITY_BASE_UNAVAILABLE')
-    return result.stdout.strip()
-
-
-def branch_api(base, token, branch, expected=(200,)):
-    return api(base, 'GET', '/repos/' + REPO + '/branches/' + urllib.parse.quote(branch, safe=''), token, expected=expected)
-
-
-def verify_base(token):
-    authority = authority_head()
-    _, local = branch_api(LOCAL_API, token, BASE_BRANCH)
-    _, network = branch_api(NETWORK_API, token, BASE_BRANCH)
-    local_oid = local.get('commit', {}).get('id')
-    network_oid = network.get('commit', {}).get('id')
-    if not authority or authority != local_oid or authority != network_oid:
-        raise RuntimeError('RECONCILIATION_REQUIRED')
-    return authority
-
-
-def verify_identity(token):
-    _, user = api(LOCAL_API, 'GET', '/user', token)
-    if user.get('login') != 'aios-autonomy-agent' or user.get('id') != 153 or user.get('is_admin') is not False:
-        raise RuntimeError('MACHINE_IDENTITY_REJECTED')
-    return {'login': user['login'], 'id': user['id'], 'owner': user.get('is_admin')}
-
-
-def load_inputs():
-    manifest = json.dumps(json.loads((INPUT_ROOT / 'manifest.json').read_text(encoding='utf-8')), sort_keys=True, separators=(',', ':'), ensure_ascii=False).encode()
-    evidence = json.dumps(json.loads((INPUT_ROOT / 'evidence.json').read_text(encoding='utf-8')), sort_keys=True, separators=(',', ':'), ensure_ascii=False).encode()
-    for data in (manifest, evidence):
-        if any(secret in data.lower() for secret in (b'authorization:', b'ghp_', b'github_pat_', b'secret=', b'token=')):
-            raise RuntimeError('SECRET_CONTENT_REJECTED')
-    return manifest, evidence
-
-
-def publication_key(base_oid, manifest_sha, evidence_sha):
-    payload = REPO + base_oid + REQUEST_BRANCH + manifest_sha + evidence_sha
-    return hashlib.sha256(payload.encode()).hexdigest()
-
-
-def write_receipt(state, **fields):
-    record = {
-        'schema': 'aios.governance-preapproval-publication.v1',
-        'operation': 'SEMANTIC_RECONCILIATION_REQUEST',
-        'state': state,
-        'recorded_unix': int(time.time()),
-        'request_branch': REQUEST_BRANCH,
-        'manifest_path': MANIFEST_REL,
-        'evidence_path': EVIDENCE_REL,
-        'machine_actor': 'aios-autonomy-agent',
-        'owner': False,
-        'credential_ref': {'scheme': 'systemd-credential', 'name': CREDENTIAL_NAME},
-        'governance_capability_executed': False,
-        'protection_mutation': False,
-        'force_push': False,
-        **fields,
-    }
-    RECEIPT.parent.mkdir(parents=True, exist_ok=True)
-    temporary = RECEIPT.with_suffix('.tmp')
-    temporary.write_text(json.dumps(record, sort_keys=True, separators=(',', ':'), ensure_ascii=False) + '\n', encoding='utf-8')
-    temporary.replace(RECEIPT)
-    RECEIPT.chmod(0o640)
-    return record
-
-
-def existing_prs(token):
-    _, prs = api(LOCAL_API, 'GET', '/repos/' + REPO + '/pulls?state=all&base=' + urllib.parse.quote(BASE_BRANCH, safe='') + '&limit=100', token)
-    return [pr for pr in prs if pr.get('head', {}).get('ref') == REQUEST_BRANCH and pr.get('base', {}).get('ref') == BASE_BRANCH]
-
-
-def verify_existing_branch(token, branch_oid, manifest, evidence):
-    _, commit = api(LOCAL_API, 'GET', '/repos/' + REPO + '/git/commits/' + branch_oid, token)
-    if commit.get('parents', [{}])[0].get('sha') is None:
-        raise RuntimeError('REQUEST_BRANCH_COMMIT_INVALID')
-    for relative, expected in ((MANIFEST_REL, manifest), (EVIDENCE_REL, evidence)):
-        _, content = api(LOCAL_API, 'GET', '/repos/' + REPO + '/contents/' + urllib.parse.quote(relative, safe='/') + '?ref=' + branch_oid, token)
-        actual = base64.b64decode(''.join(content.get('content', '').split()))
-        if actual != expected:
-            raise RuntimeError('GOVERNANCE_REQUEST_BRANCH_CONFLICT')
-
-
-def push_one_commit(token, base_oid, manifest, evidence):
-    work_root = TASK_ROOT / 'publisher-work'
-    work_root.mkdir(parents=True, exist_ok=True)
-    temporary = pathlib.Path(tempfile.mkdtemp(prefix='semantic-reconciliation-', dir=work_root))
-    askpass = temporary / 'askpass.sh'
-    clone = temporary / 'repo'
-    credential_path = pathlib.Path(os.environ['CREDENTIALS_DIRECTORY']) / CREDENTIAL_NAME
-    askpass.write_text(
-        '#!/bin/sh\ncase "$1" in *Username*) printf "%s\\n" "$GITEA_MACHINE_ACTOR";; *) cat "$CREDENTIAL_FILE";; esac\n',
-        encoding='utf-8',
-    )
-    askpass.chmod(0o700)
-    env = os.environ.copy()
-    env.update({
-        'GIT_ASKPASS': str(askpass),
-        'GIT_TERMINAL_PROMPT': '0',
-        'GITEA_MACHINE_ACTOR': 'aios-autonomy-agent',
-        'CREDENTIAL_FILE': str(credential_path),
-        'GIT_CONFIG_COUNT': '1',
-        'GIT_CONFIG_KEY_0': 'safe.directory',
-        'GIT_CONFIG_VALUE_0': AUTHORITY_REPO,
-    })
-    try:
-        run = subprocess.run(
-            ['git', 'clone', '--branch', BASE_BRANCH, '--single-branch', '--quiet', NETWORK_REMOTE, str(clone)],
-            text=True, capture_output=True, env=env, check=False,
-        )
-        if run.returncode != 0:
-            detail = ' '.join(run.stderr.strip().split())[:240]
-            raise RuntimeError('PUBLISHER_CLONE_FAILED:' + detail)
-        def git(*args, push_env=None):
-            result = subprocess.run(['git', *args], cwd=clone, text=True, capture_output=True, env=push_env or env, check=False)
-            if result.returncode != 0:
-                raise RuntimeError('PUBLISHER_GIT_OPERATION_FAILED')
-            return result.stdout.strip()
-        git('checkout', '--detach', base_oid)
-        git('switch', '--create', REQUEST_BRANCH)
-        manifest_path = clone / MANIFEST_REL
-        evidence_path = clone / EVIDENCE_REL
-        manifest_path.parent.mkdir(parents=True, exist_ok=True)
-        evidence_path.parent.mkdir(parents=True, exist_ok=True)
-        manifest_path.write_bytes(manifest)
-        evidence_path.write_bytes(evidence)
-        git('add', '--', MANIFEST_REL, EVIDENCE_REL)
-        staged = git('diff', '--cached', '--name-only').splitlines()
-        if staged != sorted([MANIFEST_REL, EVIDENCE_REL]):
-            raise RuntimeError('PUBLISHER_PATH_ALLOWLIST_FAILED')
-        git('-c', 'user.name=aios-autonomy-agent', '-c', 'user.email=aios-autonomy-agent@aios.invalid', 'commit', '--quiet', '-m', '[governance] publish semantic reconciliation evidence')
-        if git('rev-list', '--count', base_oid + '..HEAD') != '1':
-            raise RuntimeError('PUBLISHER_COMMIT_COUNT_FAILED')
-        git('push', '--porcelain', NETWORK_REMOTE, 'HEAD:refs/heads/' + REQUEST_BRANCH, push_env=env)
-        head = git('rev-parse', 'HEAD')
-        return head
-    finally:
-        shutil.rmtree(temporary, ignore_errors=True)
-
-
-def publish():
-    token = load_token()
-    identity = verify_identity(token)
-    base_oid = verify_base(token)
-    manifest, evidence = load_inputs()
-    manifest_sha = digest_bytes(manifest)
-    evidence_sha = digest_bytes(evidence)
-    key = publication_key(base_oid, manifest_sha, evidence_sha)
-    write_receipt('REQUESTED', governance_base_oid=base_oid, manifest_sha256=manifest_sha, evidence_sha256=evidence_sha, idempotency_key=key, machine_identity=identity)
-    write_receipt('LOCAL_CANDIDATE_VERIFIED', governance_base_oid=base_oid, manifest_sha256=manifest_sha, evidence_sha256=evidence_sha, idempotency_key=key, machine_identity=identity)
-
-    branch_status, branch = branch_api(LOCAL_API, token, REQUEST_BRANCH, expected=(200, 404))
-    if branch_status == 200:
-        branch_oid = branch.get('commit', {}).get('id')
-        verify_existing_branch(token, branch_oid, manifest, evidence)
-    else:
-        branch_oid = push_one_commit(token, base_oid, manifest, evidence)
-        verify_existing_branch(token, branch_oid, manifest, evidence)
-    write_receipt('BRANCH_PUSHED', governance_base_oid=base_oid, manifest_sha256=manifest_sha, evidence_sha256=evidence_sha, idempotency_key=key, request_head_oid=branch_oid, machine_identity=identity)
-
-    prs = existing_prs(token)
-    if len(prs) > 1:
-        raise RuntimeError('MULTIPLE_MATCHING_APPROVAL_PRS')
-    if prs:
-        pr = prs[0]
-        if pr.get('head', {}).get('sha') != branch_oid:
-            raise RuntimeError('APPROVAL_PR_HEAD_MISMATCH')
-        pr_number = pr.get('number')
-    else:
-        _, pr = api(LOCAL_API, 'POST', '/repos/' + REPO + '/pulls', token, {
-            'title': '[GOVERNANCE RECONCILIATION] Semantic protection snapshot schema migration',
-            'head': REQUEST_BRANCH,
-            'base': BASE_BRANCH,
-            'body': 'Schema-only reconciliation for the existing PR54 Stage-1 and Stage-2 predicates. No new governance capability; Owner exact-head re-attestation required.',
-        }, expected=(201,))
-        pr_number = pr.get('number')
-    write_receipt('PR_CREATED', governance_base_oid=base_oid, manifest_sha256=manifest_sha, evidence_sha256=evidence_sha, idempotency_key=key, request_head_oid=branch_oid, pr_number=pr_number, machine_identity=identity)
-
-    _, remote_branch = branch_api(NETWORK_API, token, REQUEST_BRANCH)
-    if remote_branch.get('commit', {}).get('id') != branch_oid:
-        raise RuntimeError('NETWORK_BRANCH_READBACK_MISMATCH')
-    _, read_pr = api(LOCAL_API, 'GET', '/repos/' + REPO + '/pulls/' + str(pr_number), token)
-    if read_pr.get('head', {}).get('sha') != branch_oid or read_pr.get('base', {}).get('ref') != BASE_BRANCH:
-        raise RuntimeError('PR_READBACK_MISMATCH')
-    result = write_receipt('COMPLETED', governance_base_oid=base_oid, manifest_sha256=manifest_sha, evidence_sha256=evidence_sha, idempotency_key=key, request_head_oid=branch_oid, pr_number=pr_number, pr_head_oid=read_pr.get('head', {}).get('sha'), machine_identity=identity)
-    return result
-
-
-def self_test():
-    token = load_token()
-    identity = verify_identity(token)
-    base_oid = verify_base(token)
-    branch_status, _ = branch_api(LOCAL_API, token, REQUEST_BRANCH, expected=(200, 404))
-    return {
-        'status': 'PASS',
-        'governance_base_oid': base_oid,
-        'machine_identity': identity,
-        'credential_ref': {'scheme': 'systemd-credential', 'name': CREDENTIAL_NAME},
-        'branch_namespace': 'refs/heads/governance/request/*',
-        'target_base': BASE_BRANCH,
-        'request_branch_status': 'EXISTS' if branch_status == 200 else 'ABSENT',
-        'operation_allowlist': ['READ_BASE', 'CREATE_ONE_REQUEST_BRANCH', 'WRITE_TWO_EVIDENCE_PATHS_ONE_COMMIT', 'CREATE_OR_READ_ONE_APPROVAL_PR', 'READBACK'],
-        'denied': ['MAIN_WRITE', 'DIRECT_APPROVALS_WRITE', 'BRANCH_PROTECTION', 'MERGE', 'FORCE_PUSH', 'TAG', 'PRODUCTION', 'CREDENTIAL_MUTATION'],
-        'governance_capability_executed': False,
-    }
-
-
-def read_publication_status():
-    token = load_token()
-    receipt = json.loads(RECEIPT.read_text(encoding='utf-8'))
-    pr_number = receipt.get('pr_number')
-    if not pr_number:
-        raise RuntimeError('PUBLICATION_RECEIPT_PR_MISSING')
-    _, pr = api(LOCAL_API, 'GET', '/repos/' + REPO + '/pulls/' + str(pr_number), token)
-    _, reviews = api(LOCAL_API, 'GET', '/repos/' + REPO + '/pulls/' + str(pr_number) + '/reviews', token)
-    _, branch = branch_api(LOCAL_API, token, REQUEST_BRANCH)
-    _, network_branch = branch_api(NETWORK_API, token, REQUEST_BRANCH)
-    return {
-        'status': 'PASS',
-        'request_branch': REQUEST_BRANCH,
-        'branch_head': branch.get('commit', {}).get('id'),
-        'network_branch_head': network_branch.get('commit', {}).get('id'),
-        'pr_number': pr.get('number'),
-        'pr_state': pr.get('state'),
-        'pr_merged': pr.get('merged'),
-        'pr_head': pr.get('head', {}).get('sha'),
-        'pr_base': pr.get('base', {}).get('ref'),
-        'reviews': [
-            {
-                'id': item.get('id'),
-                'reviewer_id': item.get('user', {}).get('id'),
-                'state': item.get('state'),
-                'commit_id': item.get('commit_id'),
-                'dismissed': item.get('dismissed'),
-            }
-            for item in reviews
-        ],
-        'governance_capability_executed': False,
-        'protection_mutation': False,
-    }
-
-
-def handle(request):
-    if not isinstance(request, dict) or set(request) != {'operation'}:
-        raise RuntimeError('REQUEST_SCHEMA_INVALID')
-    if request['operation'] == 'DRY_RUN_SELF_TEST':
-        return self_test()
-    if request['operation'] == 'PUBLISH_SEMANTIC_RECONCILIATION':
-        return publish()
-    if request['operation'] == 'READ_SEMANTIC_RECONCILIATION_STATUS':
-        return read_publication_status()
-    raise RuntimeError('OPERATION_DENIED')
-
-
-def serve(listener):
-    conn, _ = listener.accept()
-    with conn:
-        try:
-            data = conn.recv(1024 * 1024 + 1)
-            if len(data) > 1024 * 1024:
-                raise RuntimeError('REQUEST_TOO_LARGE')
-            result = handle(json.loads(data.decode()))
-        except Exception as exc:
-            result = {'status': 'FAIL', 'code': str(exc)}
-        conn.sendall((json.dumps(result, sort_keys=True, separators=(',', ':'), ensure_ascii=False) + '\n').encode())
-
-
-def main():
-    if os.environ.get('LISTEN_FDS') != '1':
-        raise SystemExit('SOCKET_ACTIVATION_REQUIRED')
-    listener = socket.fromfd(3, socket.AF_UNIX, socket.SOCK_STREAM)
-    serve(listener)
-
-
-if __name__ == '__main__':
-    main()

active-runtime/app/governance/ref_reconciler.py

@@ -1,73 +0,0 @@
-"""Fail-closed Authority/Gitea ref reconciliation after protected merge."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from pathlib import Path
-import subprocess
-
-
-class RefReconciliationError(RuntimeError):
-    pass
-
-
-def _oid(value: str, field: str) -> str:
-    if not isinstance(value, str) or len(value) != 40 or any(char not in "0123456789abcdef" for char in value):
-        raise RefReconciliationError(field + "_INVALID")
-    return value
-
-
-@dataclass(frozen=True, slots=True)
-class RefReconciler:
-    git_dir: Path
-
-    def read(self, ref: str) -> str:
-        result = subprocess.run(
-            ["git", f"--git-dir={self.git_dir}", "rev-parse", "--verify", ref],
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if result.returncode != 0:
-            raise RefReconciliationError("AUTHORITY_REF_UNAVAILABLE")
-        return result.stdout.strip()
-
-    def is_ancestor(self, ancestor: str, descendant: str) -> bool:
-        _oid(ancestor, "ancestor")
-        _oid(descendant, "descendant")
-        result = subprocess.run(
-            ["git", f"--git-dir={self.git_dir}", "merge-base", "--is-ancestor", ancestor, descendant],
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if result.returncode == 0:
-            return True
-        if result.returncode == 1:
-            return False
-        raise RefReconciliationError("AUTHORITY_ANCESTRY_CHECK_FAILED")
-
-    def reconcile_main(self, *, expected_oid: str, merged_oid: str, gitea_main_oid: str) -> str:
-        _oid(expected_oid, "expected_oid")
-        _oid(merged_oid, "merged_oid")
-        _oid(gitea_main_oid, "gitea_main_oid")
-        if gitea_main_oid != merged_oid:
-            raise RefReconciliationError("GITEA_MAIN_EXPECTATION_MISMATCH")
-        if not self.is_ancestor(expected_oid, merged_oid):
-            raise RefReconciliationError("MAIN_FF_REQUIRED")
-        current = self.read("refs/heads/main")
-        if current == merged_oid:
-            return merged_oid
-        if current != expected_oid:
-            raise RefReconciliationError("AUTHORITY_MAIN_EXPECTATION_MISMATCH")
-        result = subprocess.run(
-            ["git", f"--git-dir={self.git_dir}", "update-ref", "refs/heads/main", merged_oid, expected_oid],
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if result.returncode != 0:
-            raise RefReconciliationError("AUTHORITY_MAIN_CAS_FAILED")
-        if self.read("refs/heads/main") != merged_oid:
-            raise RefReconciliationError("AUTHORITY_MAIN_CAS_READBACK_MISMATCH")
-        return merged_oid

active-runtime/app/governance/semantic_protection.py

@@ -1,81 +0,0 @@
-"""Canonical semantic branch-protection model used by AIOS governance gates."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-from typing import Any, Mapping
-
-
-SCHEMA = "aios.semantic-protection.v1"
-USER_IDS = {"owner": 2, "aios-autonomy-agent": 153}
-
-
-def canonical_json(value: Any) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
-
-
-def _typed_json(value: Any) -> list[Any]:
-    if value in (None, "null"):
-        return []
-    if isinstance(value, str):
-        return json.loads(value)
-    return list(value)
-
-
-def _user_ids(names: Any) -> list[int]:
-    result = []
-    for name in names or []:
-        if name not in USER_IDS:
-            raise ValueError("UNKNOWN_GOVERNANCE_USER:" + str(name))
-        result.append(USER_IDS[name])
-    return sorted(result)
-
-
-def semantic_policy(protection: Mapping[str, Any]) -> dict[str, Any]:
-    """Drop transport metadata and canonicalize semantic security fields."""
-    return {
-        "schema_version": SCHEMA,
-        "repo_id": 1,
-        "protection_id": 2,
-        "branch_name": protection.get("branch_name"),
-        "can_push": protection.get("enable_push"),
-        "can_force_push": protection.get("enable_force_push"),
-        "enable_merge_whitelist": protection.get("enable_merge_whitelist"),
-        "merge_whitelist_user_ids": _user_ids(protection.get("merge_whitelist_usernames")),
-        "merge_whitelist_team_ids": [],
-        "required_approvals": protection.get("required_approvals"),
-        "enable_status_check": protection.get("enable_status_check"),
-        "status_check_contexts": sorted(protection.get("status_check_contexts") or []),
-        "block_admin_merge_override": protection.get("block_admin_merge_override"),
-        "block_on_official_review_requests": protection.get("block_on_official_review_requests"),
-        "block_on_outdated_branch": protection.get("block_on_outdated_branch"),
-        "block_on_rejected_reviews": protection.get("block_on_rejected_reviews"),
-        "dismiss_stale_approvals": protection.get("dismiss_stale_approvals"),
-        "ignore_stale_approvals": protection.get("ignore_stale_approvals"),
-        "enable_approvals_whitelist": protection.get("enable_approvals_whitelist"),
-        "approvals_whitelist_user_ids": _user_ids(protection.get("approvals_whitelist_username")),
-        "approvals_whitelist_team_ids": [],
-        "enable_bypass_allowlist": protection.get("enable_bypass_allowlist"),
-        "bypass_allowlist_user_ids": _user_ids(protection.get("bypass_allowlist_usernames")),
-        "bypass_allowlist_team_ids": [],
-        "enable_force_push_allowlist": protection.get("enable_force_push_allowlist"),
-        "force_push_allowlist_user_ids": _user_ids(protection.get("force_push_allowlist_usernames")),
-        "enable_whitelist": protection.get("enable_push_whitelist"),
-        "whitelist_user_ids": _user_ids(protection.get("push_whitelist_usernames")),
-        "whitelist_team_ids": [],
-        "force_push_allowlist_deploy_keys": protection.get("force_push_allowlist_deploy_keys"),
-        "whitelist_deploy_keys": protection.get("push_whitelist_deploy_keys"),
-        "require_signed_commits": protection.get("require_signed_commits"),
-        "priority": protection.get("priority"),
-        "protected_file_patterns": _typed_json(protection.get("protected_file_patterns")),
-        "unprotected_file_patterns": _typed_json(protection.get("unprotected_file_patterns")),
-    }
-
-
-def semantic_digest(protection: Mapping[str, Any]) -> str:
-    return hashlib.sha256(canonical_json(semantic_policy(protection))).hexdigest()
-
-
-def transport_digest(protection: Mapping[str, Any]) -> str:
-    return hashlib.sha256(canonical_json(protection)).hexdigest()

active-runtime/app/governance/stage2_gate_migration.py

@@ -1,141 +0,0 @@
-"""Fail-closed Stage-2 campaign gate migration predicates."""
-
-from __future__ import annotations
-
-import copy
-import hashlib
-import json
-import re
-from typing import Any, Mapping
-
-SEMANTIC_SCHEMA = "aios.semantic-protection.v1"
-STAGE1_SEMANTIC_SHA = "d911e856f71de6105b8efa08e13338a448e0b6d37536332decd80c9f409ecf27"
-CAMPAIGN_ID = "AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807"
-OWNER_GATE = "owner-approval-gate"
-CAMPAIGN_GATE = "campaign-approval-gate"
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-
-
-class Stage2GateError(RuntimeError):
-    pass
-
-
-def canonical_json(value: Any) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
-
-
-def _typed_json(value: Any) -> list[Any]:
-    if value in (None, "", "null"):
-        return []
-    if isinstance(value, str):
-        return json.loads(value)
-    return list(value)
-
-
-def _user_ids(names: Any) -> list[int]:
-    mapping = {"owner": 2, "aios-autonomy-agent": 153}
-    result = []
-    for name in names or []:
-        if name not in mapping:
-            raise Stage2GateError("UNKNOWN_GOVERNANCE_USER")
-        result.append(mapping[name])
-    return sorted(result)
-
-
-def semantic_policy(protection: Mapping[str, Any]) -> dict[str, Any]:
-    return {
-        "schema_version": SEMANTIC_SCHEMA,
-        "repo_id": 1,
-        "protection_id": 2,
-        "branch_name": protection.get("branch_name"),
-        "can_push": protection.get("enable_push"),
-        "can_force_push": protection.get("enable_force_push"),
-        "enable_merge_whitelist": protection.get("enable_merge_whitelist"),
-        "merge_whitelist_user_ids": _user_ids(protection.get("merge_whitelist_usernames")),
-        "merge_whitelist_team_ids": [],
-        "required_approvals": protection.get("required_approvals"),
-        "enable_status_check": protection.get("enable_status_check"),
-        "status_check_contexts": sorted(protection.get("status_check_contexts") or []),
-        "block_admin_merge_override": protection.get("block_admin_merge_override"),
-        "block_on_official_review_requests": protection.get("block_on_official_review_requests"),
-        "block_on_outdated_branch": protection.get("block_on_outdated_branch"),
-        "block_on_rejected_reviews": protection.get("block_on_rejected_reviews"),
-        "dismiss_stale_approvals": protection.get("dismiss_stale_approvals"),
-        "ignore_stale_approvals": protection.get("ignore_stale_approvals"),
-        "enable_approvals_whitelist": protection.get("enable_approvals_whitelist"),
-        "approvals_whitelist_user_ids": _user_ids(protection.get("approvals_whitelist_username")),
-        "approvals_whitelist_team_ids": [],
-        "enable_bypass_allowlist": protection.get("enable_bypass_allowlist"),
-        "bypass_allowlist_user_ids": _user_ids(protection.get("bypass_allowlist_usernames")),
-        "bypass_allowlist_team_ids": [],
-        "enable_force_push_allowlist": protection.get("enable_force_push_allowlist"),
-        "force_push_allowlist_user_ids": _user_ids(protection.get("force_push_allowlist_usernames")),
-        "force_push_allowlist_team_ids": [],
-        "enable_whitelist": protection.get("enable_push_whitelist"),
-        "whitelist_user_ids": _user_ids(protection.get("push_whitelist_usernames")),
-        "whitelist_team_ids": [],
-        "force_push_allowlist_deploy_keys": protection.get("force_push_allowlist_deploy_keys"),
-        "whitelist_deploy_keys": protection.get("push_whitelist_deploy_keys"),
-        "require_signed_commits": protection.get("require_signed_commits"),
-        "priority": protection.get("priority"),
-        "protected_file_patterns": protection.get("protected_file_patterns"),
-        "unprotected_file_patterns": protection.get("unprotected_file_patterns"),
-    }
-
-
-def semantic_digest(protection: Mapping[str, Any]) -> str:
-    return hashlib.sha256(canonical_json(semantic_policy(protection))).hexdigest()
-
-
-def build_target(protection: Mapping[str, Any]) -> tuple[str, dict[str, Any]]:
-    current = list(protection.get("status_check_contexts") or [])
-    has_owner = OWNER_GATE in current
-    has_campaign = CAMPAIGN_GATE in current
-    if has_owner and has_campaign:
-        raise Stage2GateError("GATE_PRESTATE_CONFLICT")
-    if not has_owner and not has_campaign:
-        raise Stage2GateError("OWNER_GATE_MISSING")
-    if has_campaign:
-        return "IDEMPOTENT_SUCCESS", copy.deepcopy(dict(protection))
-    if semantic_digest(protection) != STAGE1_SEMANTIC_SHA:
-        raise Stage2GateError("SEMANTIC_PRECONDITION_INVALID")
-    target = copy.deepcopy(dict(protection))
-    target["status_check_contexts"] = sorted(
-        [gate for gate in current if gate != OWNER_GATE] + [CAMPAIGN_GATE]
-    )
-    return "READY", target
-
-
-def validate_stage2_facts(facts: Mapping[str, Any]) -> None:
-    required = {
-        "campaign_id",
-        "campaign_active",
-        "campaign_revoked",
-        "machine_actor",
-        "required_checks_all_success",
-        "required_checks_same_head",
-        "unresolved_conversations",
-        "mergeable",
-        "protected_target",
-        "current_main_oid",
-        "gitea_main_oid",
-        "current_main_lineage_verified",
-    }
-    if set(facts) != required:
-        raise Stage2GateError("STAGE2_FACTS_SCHEMA_INVALID")
-    if facts["campaign_id"] != CAMPAIGN_ID or facts["campaign_active"] is not True or facts["campaign_revoked"] is not False:
-        raise Stage2GateError("CAMPAIGN_NOT_ACTIVE")
-    if facts["machine_actor"] != "aios-autonomy-agent":
-        raise Stage2GateError("MACHINE_ACTOR_MISMATCH")
-    if facts["required_checks_all_success"] is not True or facts["required_checks_same_head"] is not True:
-        raise Stage2GateError("REQUIRED_CHECKS_NOT_CURRENT")
-    if facts["unresolved_conversations"] != 0 or facts["mergeable"] is not True:
-        raise Stage2GateError("CAMPAIGN_GATE_FACTS_INVALID")
-    if facts["protected_target"] != "main" or facts["current_main_lineage_verified"] is not True:
-        raise Stage2GateError("PROTECTED_TARGET_OR_LINEAGE_INVALID")
-    if (
-        not isinstance(facts["current_main_oid"], str)
-        or not OID_RE.fullmatch(facts["current_main_oid"])
-        or facts["gitea_main_oid"] != facts["current_main_oid"]
-    ):
-        raise Stage2GateError("MAIN_READBACK_MISMATCH")

active-runtime/app/governed_local_writer.py

@@ -1,473 +0,0 @@
-"""Shared primitives for the V2R1C6 governed local writer contract."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import posixpath
-import re
-import socket
-import stat
-import struct
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any, Mapping, Sequence
-
-
-TASK_ID = "V2R1C6_GOVERNED_LOCAL_BOOTSTRAP"
-REPO = "aios/aios"
-PRINCIPAL = "governed-local-bootstrap"
-OIDSIZ = 40
-AUTHORIZATION_TTL = timedelta(hours=2)
-
-
-class GovernedLocalWriterError(Exception):
-    """Base error for governed-local-writer validation and runtime failures."""
-
-
-class AuthorizationError(GovernedLocalWriterError):
-    """Raised when authorization input is invalid, expired, or tampered."""
-
-
-@dataclass(frozen=True)
-class BranchCreatePolicy:
-    """Exact branch creation contract."""
-
-    branch: str
-    base_oid: str
-    head_oid: str
-
-
-@dataclass(frozen=True)
-class BranchAppendPolicy:
-    """Exact append-commit contract for candidate branch updates."""
-
-    branch: str
-    expected_head_oid: str | None
-    allowed_paths: tuple[str, ...]
-
-
-@dataclass(frozen=True)
-class BranchPolicy:
-    """Per-branch operation policies loaded from authorization."""
-
-    create_branch: BranchCreatePolicy | None
-    append_commit: BranchAppendPolicy | None
-
-
-@dataclass(frozen=True)
-class GovernedAuthorization:
-    """Parsed and validated authorization object."""
-
-    task_id: str
-    repo: str
-    created_at: datetime
-    expires_at: datetime
-    authorization_sha256: str
-    one_time_use: bool
-    branch_operations: dict[str, BranchPolicy]
-    denied_operations: tuple[str, ...]
-
-    @property
-    def create_branches(self) -> set[str]:
-        """Branches that are allowed for branch-creation operations."""
-        return {
-            branch
-            for branch, policy in self.branch_operations.items()
-            if policy.create_branch is not None
-        }
-
-    @property
-    def append_branches(self) -> set[str]:
-        """Branches that are allowed for commit-append operations."""
-        return {
-            branch
-            for branch, policy in self.branch_operations.items()
-            if policy.append_commit is not None
-        }
-
-
-@dataclass(frozen=True)
-class PeerIdentity:
-    """Verified peer identity from SO_PEERCRED."""
-
-    pid: int
-    uid: int
-    gid: int
-    executable: str | None
-
-
-@dataclass(frozen=True)
-class FileChange:
-    """Single file modification payload."""
-
-    path: str
-    content: str
-
-
-@dataclass(frozen=True)
-class CreateBranchRequest:
-    """Validated create-branch request payload."""
-
-    branch: str
-    base_oid: str
-    head_oid: str | None
-    authorization_digest: str
-
-
-@dataclass(frozen=True)
-class AppendCommitRequest:
-    """Validated append-commit request payload."""
-
-    branch: str
-    expected_head_oid: str
-    changes: tuple[FileChange, ...]
-    authorization_digest: str
-    commit_message: str = "chore(governance): append governed commit"
-
-
-_OID_RE = re.compile(r"^[0-9a-fA-F]{40}$")
-_DENIED_PATH_SEGMENTS = (
-    "main",
-    "tag",
-    "baseline",
-    "credential",
-    "credentials",
-    "secret",
-    "registry",
-)
-_SECRET_PATTERNS = (
-    re.compile(r"(?i)-----BEGIN [A-Z ]*PRIVATE KEY-----"),
-    re.compile(r"(?i)api[_-]?key\s*[:=]\s*\S+"),
-    re.compile(r"(?i)secret\s*[:=]\s*\S+"),
-    re.compile(r"(?i)password\s*[:=]\s*\S+"),
-    re.compile(r"(?i)token\s*[:=]\s*\S+"),
-)
-_SAFE_SECRET_MARKERS = re.compile(
-    r"(?i)(?:api[_-]?key|secret|password|token)\s*[:=]\s*(?:REDACTED|TEST_FIXTURE|NOT_A_SECRET)"
-)
-
-
-def canonicalize_authorization_payload(payload: Mapping[str, Any]) -> str:
-    """Serialize authorization payload without the signature hash, in canonical form."""
-    canonical = dict(payload)
-    canonical.pop("authorization_sha256", None)
-    return json.dumps(
-        canonical, sort_keys=True, separators=(",", ":"), ensure_ascii=True
-    )
-
-
-def compute_authorization_sha256(payload: Mapping[str, Any]) -> str:
-    """Compute canonical sha256 over authorization payload."""
-    digest = hashlib.sha256()
-    digest.update(canonicalize_authorization_payload(payload).encode("utf-8"))
-    return digest.hexdigest()
-
-
-def _assert_authorization_file_permissions(path: Path) -> None:
-    """Fail-closed checks for root-only secret-like authorization files."""
-    if path.is_symlink():
-        raise AuthorizationError("authorization path must not be a symlink")
-
-    st = path.stat()
-    if not stat.S_ISREG(st.st_mode):
-        raise AuthorizationError("authorization path must be a regular file")
-
-    if (st.st_mode & 0o777) != 0o600:
-        raise AuthorizationError("authorization file mode must be exactly 0600")
-
-    if hasattr(st, "st_uid") and os.name != "nt" and st.st_uid != 0:
-        raise AuthorizationError("authorization file owner must be uid 0")
-
-
-def _parse_iso8601(value: str) -> datetime:
-    """Parse ISO 8601 timestamps used by authorization payloads."""
-    try:
-        if value.endswith("Z"):
-            value = value[:-1] + "+00:00"
-        parsed = datetime.fromisoformat(value)
-    except (TypeError, ValueError) as exc:
-        raise AuthorizationError("created_at must be an ISO 8601 timestamp") from exc
-
-    if parsed.tzinfo is None:
-        parsed = parsed.replace(tzinfo=timezone.utc)
-    return parsed
-
-
-def _require_type(value: Any, expected: type, *, key: str) -> None:
-    if not isinstance(value, expected):
-        raise AuthorizationError(f"{key} must be {expected.__name__}")
-
-
-def _parse_oid(value: Any, *, field: str) -> str:
-    if not isinstance(value, str):
-        raise AuthorizationError(f"{field} must be a string")
-    if not _OID_RE.fullmatch(value):
-        raise AuthorizationError(f"{field} must be a 40-char hex object id")
-    return value.lower()
-
-
-def _parse_allowed_paths(paths: Any) -> tuple[str, ...]:
-    if not isinstance(paths, list) or not paths:
-        raise AuthorizationError("allowed_paths must be a non-empty list")
-    normalized: list[str] = []
-    for path in paths:
-        if not isinstance(path, str) or not path.strip():
-            raise AuthorizationError("allowed_paths entries must be non-empty strings")
-        normalized.append(path.strip())
-    return tuple(normalized)
-
-
-def parse_authorization(
-    raw: Mapping[str, Any], *, now: datetime | None = None
-) -> GovernedAuthorization:
-    """Validate an authorization payload and return a typed object."""
-    _require_type(raw.get("task_id"), str, key="task_id")
-    if raw["task_id"] != TASK_ID:
-        raise AuthorizationError("unexpected task_id")
-
-    _require_type(raw.get("repo"), str, key="repo")
-    if raw["repo"] != REPO:
-        raise AuthorizationError("unexpected repo value")
-
-    created_at = _parse_iso8601(raw.get("created_at"))
-    check_time = now or datetime.now(tz=timezone.utc)
-    if created_at.tzinfo is None:
-        created_at = created_at.replace(tzinfo=timezone.utc)
-    if created_at - check_time > timedelta(seconds=30):
-        raise AuthorizationError("authorization created_at is in the future")
-    if check_time - created_at > AUTHORIZATION_TTL:
-        raise AuthorizationError("authorization expired")
-    raw_expires_at = raw.get("expires_at")
-    expires_at = (
-        _parse_iso8601(raw_expires_at)
-        if raw_expires_at is not None
-        else created_at + AUTHORIZATION_TTL
-    )
-    if expires_at <= check_time:
-        raise AuthorizationError("authorization expiry is in the past")
-    if expires_at > created_at + AUTHORIZATION_TTL:
-        raise AuthorizationError("authorization expiry exceeds two-hour maximum")
-
-    _require_type(raw.get("one_time_use"), bool, key="one_time_use")
-    if raw["one_time_use"] is not True:
-        raise AuthorizationError("one_time_use must be true")
-
-    _require_type(raw.get("authorization_sha256"), str, key="authorization_sha256")
-    expected_hash = compute_authorization_sha256(raw)
-    provided_hash = str(raw["authorization_sha256"]).lower()
-    if provided_hash != expected_hash:
-        raise AuthorizationError("authorization_sha256 mismatch")
-
-    op_map = raw.get("allowed_branch_operations")
-    if not isinstance(op_map, dict) or not op_map:
-        raise AuthorizationError("allowed_branch_operations must be a non-empty object")
-
-    branch_operations: dict[str, BranchPolicy] = {}
-    for branch, operation in op_map.items():
-        if not isinstance(branch, str) or not branch.strip():
-            raise AuthorizationError("branch names must be non-empty strings")
-
-        if not isinstance(operation, dict):
-            raise AuthorizationError("operation policy must be an object")
-
-        create_block = operation.get("create_branch")
-        append_block = operation.get("append_commit")
-
-        create_policy: BranchCreatePolicy | None = None
-        append_policy: BranchAppendPolicy | None = None
-
-        if create_block is not None:
-            if not isinstance(create_block, dict):
-                raise AuthorizationError("create_branch block must be an object")
-            raw_head_oid = create_block.get("head_oid")
-            create_policy = BranchCreatePolicy(
-                branch=branch,
-                base_oid=_parse_oid(create_block.get("base_oid"), field="create_branch.base_oid"),
-                head_oid=(
-                    _parse_oid(raw_head_oid, field="create_branch.head_oid")
-                    if raw_head_oid is not None
-                    else None
-                ),
-            )
-
-        if append_block is not None:
-            if not isinstance(append_block, dict):
-                raise AuthorizationError("append_commit block must be an object")
-            raw_expected_head_oid = append_block.get("expected_head_oid")
-            append_policy = BranchAppendPolicy(
-                branch=branch,
-                expected_head_oid=(
-                    _parse_oid(
-                        raw_expected_head_oid,
-                        field="append_commit.expected_head_oid",
-                    )
-                    if raw_expected_head_oid is not None
-                    else None
-                ),
-                allowed_paths=_parse_allowed_paths(append_block.get("allowed_paths")),
-            )
-
-        if create_policy is None and append_policy is None:
-            raise AuthorizationError("branch policy must define at least one operation")
-
-        branch_operations[branch] = BranchPolicy(
-            create_branch=create_policy, append_commit=append_policy
-        )
-
-    denied_raw = raw.get("denied_operations", ())
-    if not isinstance(denied_raw, list):
-        raise AuthorizationError("denied_operations must be a list")
-    denied_operations: list[str] = []
-    for value in denied_raw:
-        if not isinstance(value, str):
-            raise AuthorizationError("denied operations must be strings")
-        denied_operations.append(value.lower())
-
-    return GovernedAuthorization(
-        task_id=raw["task_id"],
-        repo=raw["repo"],
-        created_at=created_at,
-        expires_at=expires_at,
-        authorization_sha256=provided_hash,
-        one_time_use=True,
-        branch_operations=branch_operations,
-        denied_operations=tuple(denied_operations),
-    )
-
-
-def load_authorization_file(
-    path: str | os.PathLike[str], *, now: datetime | None = None
-) -> GovernedAuthorization:
-    """Load and validate the root-only authorization file."""
-    auth_path = Path(path)
-    _assert_authorization_file_permissions(auth_path)
-    try:
-        raw_text = auth_path.read_text(encoding="utf-8")
-    except (OSError, ValueError) as exc:
-        raise AuthorizationError("unable to read authorization file") from exc
-
-    try:
-        raw_obj = json.loads(raw_text)
-    except json.JSONDecodeError as exc:
-        raise AuthorizationError("authorization must be JSON") from exc
-
-    if not isinstance(raw_obj, dict):
-        raise AuthorizationError("authorization top-level must be an object")
-
-    return parse_authorization(raw_obj, now=now)
-
-
-def _resolve_peer_executable(pid: int) -> str | None:
-    """Resolve peer executable from /proc/<pid>/exe when available."""
-    if pid <= 0:
-        return None
-    exe_path = f"/proc/{pid}/exe"
-    try:
-        return os.readlink(exe_path)
-    except OSError:
-        return None
-
-
-def extract_peer_identity(
-    connection: socket.socket, *, require_root_uid: bool = True
-) -> PeerIdentity:
-    """Validate SO_PEERCRED and return peer identity."""
-    if not hasattr(socket, "SO_PEERCRED"):
-        raise AuthorizationError("SO_PEERCRED not available on this platform")
-
-    data = connection.getsockopt(
-        socket.SOL_SOCKET,
-        socket.SO_PEERCRED,
-        struct.calcsize("3i"),
-    )
-    if len(data) != struct.calcsize("3i"):
-        raise AuthorizationError("SO_PEERCRED payload size mismatch")
-
-    pid, uid, gid = struct.unpack("3i", data)
-    if require_root_uid and uid != 0:
-        raise PermissionError("peer uid must be 0")
-
-    return PeerIdentity(
-        pid=pid,
-        uid=uid,
-        gid=gid,
-        executable=_resolve_peer_executable(pid),
-    )
-
-
-def _normalize_file_path(path: str) -> str:
-    normalized = posixpath.normpath(path.replace("\\", "/").strip())
-    return normalized.lstrip("/")
-
-
-def _path_has_disallowed_segment(path: str) -> bool:
-    lowered = path.lower()
-    if ".." in path.split("/"):
-        return True
-    parts = [p for p in lowered.split("/") if p]
-    for part in parts:
-        for segment in _DENIED_PATH_SEGMENTS:
-            if part == segment or part.startswith(f"{segment}.") or segment in part:
-                return True
-    return False
-
-
-def _is_allowed_path(path: str, allowed_paths: Sequence[str]) -> bool:
-    normalized = _normalize_file_path(path)
-    for prefix in allowed_paths:
-        normalized_prefix = _normalize_file_path(prefix)
-        if normalized == normalized_prefix:
-            return True
-        if normalized.startswith(normalized_prefix + "/"):
-            return True
-    return False
-
-
-def contains_secret_like_content(content: str) -> bool:
-    """Heuristic detector for obvious secret-like strings."""
-    content = _SAFE_SECRET_MARKERS.sub("", content or "")
-    for pattern in _SECRET_PATTERNS:
-        if pattern.search(content):
-            return True
-    return False
-
-
-def validate_file_changes(
-    changes: Any, allowed_paths: Sequence[str]
-) -> tuple[FileChange, ...]:
-    """Validate append-commit file changes against path and content policy."""
-    if not isinstance(changes, list):
-        raise AuthorizationError("changes must be a list")
-    result: list[FileChange] = []
-
-    for change in changes:
-        if not isinstance(change, Mapping):
-            raise AuthorizationError("each file change must be an object")
-        raw_path = change.get("path")
-        raw_content = change.get("content")
-        if not isinstance(raw_path, str) or not raw_path.strip():
-            raise AuthorizationError("file change path must be a non-empty string")
-        if raw_path.startswith(("/", "\\")):
-            raise AuthorizationError("file change path must be relative")
-        if not isinstance(raw_content, str):
-            raise AuthorizationError("file change content must be a string")
-
-        normalized = _normalize_file_path(raw_path)
-        if not normalized or normalized.startswith("../") or normalized == "..":
-            raise AuthorizationError("file paths must be normalized relative paths")
-
-        if not _is_allowed_path(normalized, allowed_paths):
-            raise AuthorizationError("file path outside allowed_paths")
-
-        if _path_has_disallowed_segment(normalized):
-            raise AuthorizationError("file path uses denied segment")
-
-        if contains_secret_like_content(raw_content):
-            raise AuthorizationError("file content failed secret-like scan")
-
-        result.append(FileChange(path=normalized, content=raw_content))
-
-    return tuple(result)

active-runtime/app/governed_merge_gate.py

@@ -1,47 +0,0 @@
-"""Supplement Gitea native protection when review identity is not expressible."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Any, Mapping, Sequence
-
-
-class MergeGateDenied(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True)
-class MergeGateDecision:
-    allowed: bool
-    owner_review_id: int
-    required_contexts: tuple[str, ...]
-
-
-def validate_protected_merge(
-    pull_request: Mapping[str, Any],
-    reviews: Sequence[Mapping[str, Any]],
-    statuses: Mapping[str, str],
-    *,
-    required_contexts: Sequence[str],
-    unresolved_conversations: int,
-    owner_login: str = "owner",
-    owner_id: int = 2,
-) -> MergeGateDecision:
-    if pull_request.get("state") != "open" or pull_request.get("mergeable") is not True:
-        raise MergeGateDenied("pull_request_not_mergeable")
-    author = (pull_request.get("user") or {}).get("login")
-    owner_review = None
-    for review in reviews:
-        user = review.get("user") or {}
-        if review.get("state") == "APPROVED" and user.get("login") == owner_login and user.get("id") == owner_id:
-            if author == owner_login or (pull_request.get("author_id") == owner_id):
-                raise MergeGateDenied("pr_author_self_approval_denied")
-            owner_review = review
-    if owner_review is None:
-        raise MergeGateDenied("owner_review_required")
-    if unresolved_conversations != 0:
-        raise MergeGateDenied("unresolved_conversations_block_merge")
-    missing = [context for context in required_contexts if statuses.get(context) != "success"]
-    if missing:
-        raise MergeGateDenied("required_checks_missing:" + ",".join(missing))
-    return MergeGateDecision(True, int(owner_review.get("id", 0)), tuple(required_contexts))
-

active-runtime/app/governed_production_release.py

@@ -1,713 +0,0 @@
-"""Governed release orchestration with a trusted-plan V2R2C2 path.
-
-The legacy V2R2C1 implementation remains available only for compatibility;
-new release requests are dispatched to the plan-driven executor below.
-
-This module is deliberately scoped to the Owner-approved V2R2C1 binding.  It
-uses the existing TagPublisher and metadata adapters; it does not introduce a
-second Git writer, a second durable job store, or an alternate baseline.
-"""
-from __future__ import annotations
-
-import argparse
-import fcntl
-import hashlib
-import json
-import os
-import re
-import subprocess
-import tarfile
-import tempfile
-import time
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any, Mapping
-
-from trusted_release_execution_plan import PlanError, TrustedReleasePlan
-
-from gitea_tag_publication import (
-    GiteaTagClient,
-    GitTagBackend,
-    PublicationManualOwnerReviewRequired,
-    PublicationPending,
-    PublicationReconciliationRequired,
-    PublicationRequest,
-    TagPublisher,
-)
-
-
-VERSION = "V2R2C1"
-TARGET_OID = "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
-EVIDENCE_CLOSURE_OID = "a8b906d1bc24088c19647e98de6a679268f6d0a2"
-APPROVAL_PLAN_ID = "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e"
-REPOSITORY = "aios/aios"
-SERVICE = "aios-v2r1c7-production.service"
-PORT = 18927
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA_RE = re.compile(r"^[0-9a-f]{64}$")
-
-
-class ReleaseBlocked(RuntimeError):
-    """A release gate failed and no unsafe recovery is permitted."""
-
-
-class ManualOwnerReviewRequired(ReleaseBlocked):
-    pass
-
-
-class ReconciliationRequired(ReleaseBlocked):
-    pass
-
-
-def canonical(value: object) -> bytes:
-    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode()
-
-
-def sha256_file(path: Path) -> str:
-    if path.is_symlink() or not path.is_file():
-        raise ReleaseBlocked("artifact must be a regular file")
-    digest = hashlib.sha256()
-    with path.open("rb") as stream:
-        for block in iter(lambda: stream.read(1024 * 1024), b""):
-            digest.update(block)
-    return digest.hexdigest()
-
-
-def atomic_json(path: Path, value: Mapping[str, Any], mode: int = 0o600) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    temporary = path.with_name(path.name + ".tmp")
-    temporary.write_bytes(canonical(dict(value)))
-    os.chmod(temporary, mode)
-    os.replace(temporary, path)
-
-
-@dataclass(frozen=True)
-class ReleaseBinding:
-    version: str = VERSION
-    target_oid: str = TARGET_OID
-    evidence_closure_oid: str = EVIDENCE_CLOSURE_OID
-    approval_plan_id: str = APPROVAL_PLAN_ID
-    repository: str = REPOSITORY
-    production_service: str = SERVICE
-    production_port: int = PORT
-
-    def validate(self) -> None:
-        if self.version != VERSION or self.repository != REPOSITORY:
-            raise ManualOwnerReviewRequired("release binding is outside V2R2C1 scope")
-        if not OID_RE.fullmatch(self.target_oid) or self.target_oid != TARGET_OID:
-            raise ManualOwnerReviewRequired("V2R2C1 target_oid mismatch")
-        if not OID_RE.fullmatch(self.evidence_closure_oid) or self.evidence_closure_oid != EVIDENCE_CLOSURE_OID:
-            raise ManualOwnerReviewRequired("V2R2C1 evidence closure mismatch")
-        if self.approval_plan_id != APPROVAL_PLAN_ID:
-            raise ManualOwnerReviewRequired("V2R2C1 approval plan mismatch")
-        if self.production_service != SERVICE or int(self.production_port) != PORT:
-            raise ManualOwnerReviewRequired("production service binding mismatch")
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "version": self.version,
-            "target_oid": self.target_oid,
-            "evidence_closure_oid": self.evidence_closure_oid,
-            "approval_plan_id": self.approval_plan_id,
-            "repository": self.repository,
-            "production_service": self.production_service,
-            "production_port": self.production_port,
-        }
-
-
-class StateLock:
-    def __init__(self, path: Path):
-        self.path = path
-        self.handle = None
-
-    def __enter__(self) -> "StateLock":
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        self.handle = self.path.open("a+", encoding="utf-8")
-        fcntl.flock(self.handle.fileno(), fcntl.LOCK_EX)
-        return self
-
-    def __exit__(self, exc_type, exc, tb) -> None:
-        if self.handle is not None:
-            fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
-            self.handle.close()
-
-
-class ReleaseState:
-    def __init__(self, root: Path, binding: ReleaseBinding):
-        self.root = root
-        self.path = root / "release-state.json"
-        self.binding = binding
-        root.mkdir(parents=True, exist_ok=True)
-        if self.path.exists():
-            value = json.loads(self.path.read_text(encoding="utf-8"))
-            if value.get("binding") != binding.as_dict():
-                raise ManualOwnerReviewRequired("persisted release binding conflict")
-            self.value = value
-        else:
-            self.value = {
-                "schema": "aios.v2r2c1.governed-production-release-state.v1",
-                "binding": binding.as_dict(),
-                "state": "INITIAL",
-                "completed": {},
-                "history": [],
-            }
-            self.save()
-
-    def save(self) -> None:
-        atomic_json(self.path, self.value)
-
-    def record(self, state: str, step: str, result: Mapping[str, Any]) -> None:
-        safe = json.loads(json.dumps(dict(result)))
-        self.value["state"] = state
-        self.value.setdefault("completed", {})[step] = safe
-        self.value.setdefault("history", []).append(
-            {"at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "state": state, "step": step, "result": safe}
-        )
-        self.save()
-
-    def fail(self, state: str, reason: str) -> None:
-        self.value["state"] = state
-        self.value.setdefault("history", []).append(
-            {"at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "state": state, "reason": str(reason)[:500]}
-        )
-        self.save()
-
-
-def _git(git_dir: Path, *args: str, check: bool = True) -> str:
-    completed = subprocess.run(
-        ["git", f"--git-dir={git_dir}", *args],
-        check=False,
-        capture_output=True,
-        text=True,
-        timeout=45,
-        env={"PATH": os.environ.get("PATH", "")},
-    )
-    if check and completed.returncode != 0:
-        raise ReconciliationRequired(completed.stderr.strip() or "authoritative git query failed")
-    return completed.stdout.strip()
-
-
-def _ancestor(git_dir: Path, ancestor: str, descendant: str) -> bool:
-    return subprocess.run(
-        ["git", f"--git-dir={git_dir}", "merge-base", "--is-ancestor", ancestor, descendant],
-        check=False,
-        capture_output=True,
-        timeout=45,
-        env={"PATH": os.environ.get("PATH", "")},
-    ).returncode == 0
-
-
-def verify_lineage(git_dir: Path, binding: ReleaseBinding) -> dict[str, Any]:
-    binding.validate()
-    if _git(git_dir, "cat-file", "-t", binding.target_oid) != "commit":
-        raise ReleaseBlocked("approved target_oid is not a commit")
-    if _git(git_dir, "cat-file", "-t", binding.evidence_closure_oid) != "commit":
-        raise ReleaseBlocked("evidence closure is not a commit")
-    if not _ancestor(git_dir, binding.target_oid, binding.evidence_closure_oid):
-        raise ManualOwnerReviewRequired("approved target is not an ancestor of evidence closure")
-    return {
-        "target_oid": binding.target_oid,
-        "evidence_closure_oid": binding.evidence_closure_oid,
-        "target_is_ancestor_of_evidence": True,
-        "main_oid": _git(git_dir, "rev-parse", "refs/heads/main"),
-    }
-
-
-def verify_owner_approval(value: Mapping[str, Any], binding: ReleaseBinding) -> dict[str, Any]:
-    approval = value.get("owner_approval")
-    if not isinstance(approval, Mapping):
-        raise ReleaseBlocked("OWNER_APPROVAL_RECEIPT_REQUIRED")
-    if approval.get("approved") is not True or approval.get("status") != "APPROVED":
-        raise ReleaseBlocked("OWNER_APPROVAL_NOT_ACCEPTED")
-    if approval.get("approved_by") != "aiman":
-        raise ManualOwnerReviewRequired("OWNER_APPROVAL_ACTOR_MISMATCH")
-    if approval.get("approval_source") != "explicit_owner_approval_in_chat":
-        raise ManualOwnerReviewRequired("OWNER_APPROVAL_SOURCE_MISMATCH")
-    for key, expected in binding.as_dict().items():
-        if key in {"repository", "production_service", "production_port"}:
-            continue
-        if approval.get(key) != expected:
-            raise ManualOwnerReviewRequired("OWNER_APPROVAL_BINDING_MISMATCH:" + key)
-    return dict(approval)
-
-
-def _payload_file(git_dir: Path, oid: str, path: str) -> bytes:
-    completed = subprocess.run(
-        ["git", f"--git-dir={git_dir}", "show", f"{oid}:{path}"],
-        check=False,
-        capture_output=True,
-        timeout=45,
-        env={"PATH": os.environ.get("PATH", "")},
-    )
-    if completed.returncode != 0:
-        raise ReleaseBlocked("required release source missing:" + path)
-    return completed.stdout
-
-
-def _commit_epoch(git_dir: Path, oid: str) -> int:
-    return int(_git(git_dir, "show", "-s", "--format=%ct", oid))
-
-
-def build_production_artifact(
-    git_dir: Path,
-    binding: ReleaseBinding,
-    output_root: Path,
-) -> dict[str, Any]:
-    """Build a deterministic executable V2R2C1 health artifact from target_oid."""
-    binding.validate()
-    verify_lineage(git_dir, binding)
-    epoch = _commit_epoch(git_dir, binding.target_oid)
-    output_root.mkdir(parents=True, exist_ok=True)
-    stem = f"aios-{VERSION}-{binding.target_oid[:12]}"
-    output = output_root / (stem + ".tar.zst")
-    with tempfile.TemporaryDirectory(prefix="v2r2c1-artifact-") as temp:
-        root = Path(temp) / "payload"
-        root.mkdir(parents=True)
-        source_paths = {
-            "active-runtime/app/deployment_state.py": "active-runtime/app/deployment_state.py",
-            "active-runtime/app/v2r1c6_privacy_tools.py": "active-runtime/app/v2r1c6_privacy_tools.py",
-        }
-        for destination, source in source_paths.items():
-            target = root / destination
-            target.parent.mkdir(parents=True, exist_ok=True)
-            target.write_bytes(_payload_file(git_dir, binding.target_oid, source))
-        generated: dict[str, str] = {
-            "VERSION": VERSION + "\n",
-            "active-runtime/app/v2r2c1_health_service.py": (
-                "from v2r1c6_privacy_tools import main\n\n"
-                "if __name__ == '__main__':\n    raise SystemExit(main())\n"
-            ),
-            "deploy/aios-v2/systemd/aios-v2r1c7-production.service": (
-                "[Unit]\nDescription=AIOS V2R2C1 governed health contract service\n"
-                "After=network.target\n\n[Service]\nType=simple\n"
-                "User=aios-v2r1c7\nGroup=aios-v2r1c7\n"
-                "WorkingDirectory=/opt/aios/v2r2c1\n"
-                "EnvironmentFile=/etc/aios/aios-v2r2c1.env\n"
-                "ExecStart=/usr/bin/python3 /opt/aios/v2r2c1/active-runtime/app/v2r2c1_health_service.py --serve --host 127.0.0.1 --port ${AIOS_V2R1C7_PORT}\n"
-                "Restart=on-failure\nRestartSec=5\nNoNewPrivileges=true\nPrivateTmp=true\n"
-                "ProtectHome=true\nProtectSystem=strict\nProtectKernelLogs=true\n"
-                "ProtectKernelModules=true\nProtectKernelTunables=true\nProtectControlGroups=true\n"
-                "RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6\nIPAddressDeny=any\n"
-                "IPAddressAllow=localhost\nUMask=0077\n\n[Install]\nWantedBy=multi-user.target\n"
-            ),
-            "deploy/aios-v2/v2r2c1-runtime-config.json": json.dumps({
-                "schema": "aios.v2r2c1.production-runtime.v1",
-                "version": VERSION,
-                "target_oid": binding.target_oid,
-                "service": SERVICE,
-                "port": PORT,
-                "health_path": "/health",
-                "deployment_state_source": "environment_and_state_file",
-            }, sort_keys=True, separators=(",", ":")) + "\n",
-            "deploy/aios-v2/v2r2c1-rollback.json": json.dumps({
-                "schema": "aios.v2r2c1.rollback-metadata.v1",
-                "rollback_version": "V2R1C7",
-                "rollback_service": SERVICE,
-                "rollback_target_is_previous_production": True,
-                "automatic_rollback": False,
-            }, sort_keys=True, separators=(",", ":")) + "\n",
-            "scripts/probe_v2r2c1_health.py": (
-                "import json,sys,urllib.request\n"
-                "url=sys.argv[1] if len(sys.argv)>1 else 'http://127.0.0.1:18927/health'\n"
-                "with urllib.request.urlopen(url, timeout=5) as r: print(json.dumps(json.load(r), sort_keys=True))\n"
-            ),
-            "scripts/rollback_v2r2c1_release.sh": "#!/bin/sh\nset -eu\nprintf '%s\\n' 'rollback requires governed owner-approved executor'\nexit 2\n",
-            "release-manifests/V2R2C1.json": json.dumps({
-                "schema": "aios.release-source.v2",
-                "version": VERSION,
-                "repository": REPOSITORY,
-                "target_oid": binding.target_oid,
-                "evidence_closure_oid": binding.evidence_closure_oid,
-                "production_deployed": False,
-                "deployment_state": "STAGING",
-                "artifact_kind": "executable-production-health",
-            }, sort_keys=True, separators=(",", ":")) + "\n",
-        }
-        for rel, text in generated.items():
-            target = root / rel
-            target.parent.mkdir(parents=True, exist_ok=True)
-            target.write_text(text, encoding="utf-8")
-            if rel.startswith("scripts/"):
-                target.chmod(0o755)
-        metadata = {
-            "schema": "aios.release-artifact-build.v3",
-            "version": VERSION,
-            "repository": REPOSITORY,
-            "source_head_oid": binding.target_oid,
-            "evidence_closure_oid": binding.evidence_closure_oid,
-            "source_date_epoch": epoch,
-            "clean_source": True,
-            "executable_payload": True,
-            "production_deployed": False,
-            "tag_created": False,
-            "baseline_changed": False,
-            "secrets_included": False,
-        }
-        (root / "BUILD-METADATA.json").write_bytes(canonical(metadata))
-        (root / "ROLLBACK-METADATA.json").write_bytes(canonical(json.loads((root / "deploy/aios-v2/v2r2c1-rollback.json").read_text(encoding="utf-8"))))
-        names = sorted("payload/" + str(path.relative_to(root)).replace(os.sep, "/") for path in root.rglob("*") if path.is_file())
-        (root / "ARTIFACT-MANIFEST.json").write_bytes(canonical({
-            "schema": "aios.release-artifact-manifest.v3",
-            "version": VERSION,
-            "source_head_oid": binding.target_oid,
-            "evidence_closure_oid": binding.evidence_closure_oid,
-            "repository": REPOSITORY,
-            "files": names + ["payload/ARTIFACT-MANIFEST.json"],
-            "deployable": True,
-            "executable_payload": True,
-            "production_deployed": False,
-            "tag_created": False,
-            "baseline_changed": False,
-        }))
-        tar_path = Path(temp) / "release.tar"
-        with tarfile.open(tar_path, "w") as archive:
-            for path in sorted(root.rglob("*")):
-                relative = str(path.relative_to(root)).replace(os.sep, "/")
-                info = archive.gettarinfo(str(path), arcname="payload/" + relative)
-                info.uid = info.gid = 0
-                info.uname = "root"
-                info.gname = "root"
-                info.mtime = epoch
-                info.mode = 0o755 if path.is_dir() or path.suffix == ".sh" else 0o644
-                if path.is_file():
-                    with path.open("rb") as stream:
-                        archive.addfile(info, stream)
-                else:
-                    archive.addfile(info)
-        subprocess.run(["zstd", "-T1", "-19", "--no-progress", "-q", "-f", str(tar_path), "-o", str(output)], check=True, timeout=120)
-    digest = sha256_file(output)
-    receipt = {
-        "schema": "aios.release-artifact-receipt.v3",
-        "version": VERSION,
-        "repository": REPOSITORY,
-        "source_head_oid": binding.target_oid,
-        "evidence_closure_oid": binding.evidence_closure_oid,
-        "artifact": str(output),
-        "artifact_sha256": digest,
-        "artifact_size": output.stat().st_size,
-        "deployable": True,
-        "executable_payload": True,
-        "production_deployed": False,
-        "tag_created": False,
-        "baseline_changed": False,
-    }
-    atomic_json(output.with_suffix(output.suffix + ".receipt.json"), receipt, mode=0o640)
-    return receipt
-
-
-class GovernedProductionReleaseExecutor:
-    def __init__(self, config: Any):
-        self.config = config
-        self.binding = ReleaseBinding()
-        self.binding.validate()
-        self.root = Path(config.state_root) / "v2r2c1-governed-production-release"
-        self.state = ReleaseState(self.root, self.binding)
-        workspace = self.root / "publication-workspace"
-        workspace.mkdir(parents=True, exist_ok=True)
-        self.publisher = TagPublisher(
-            workspace,
-            GitTagBackend(workspace, authoritative_repo=Path(config.authoritative_git_dir)),
-            GiteaTagClient(config.api_base, REPOSITORY, Path(config.token_path)),
-            config.remote_name,
-            state_root=self.root / "tag-publication",
-        )
-        # Release checks must use the same explicitly configured staging baseline
-        # as the Action/model runtime; do not fall back to the publication workspace.
-        self.publisher.baseline_path = Path(
-            os.environ.get("AIOS_GITOPS_BASELINE_AUTHORITY", str(config.baseline_path))
-        )
-        # The immutable runtime package is the source of the version projection;
-        # the mutable state workspace only stores publication state.
-        self.publisher.versions_root = Path(__file__).resolve().parents[1] / "versions"
-
-    def _request(self, request: Mapping[str, Any]) -> PublicationRequest:
-        binding = self.binding
-        for key, expected in binding.as_dict().items():
-            if key in request and request[key] != expected:
-                raise ManualOwnerReviewRequired("release request binding mismatch:" + key)
-        return PublicationRequest(binding.version, binding.target_oid, binding.evidence_closure_oid, binding.approval_plan_id)
-
-    def approval_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        if request.get("execute") is not False:
-            raise ReleaseBlocked("TAG_APPROVAL_REQUEST_MUST_BE_DRY_RUN")
-        owner = verify_owner_approval(request, self.binding)
-        with StateLock(self.root / "release.lock"):
-            current = self.state.value.get("approval")
-            approval_digest = hashlib.sha256(canonical(owner)).hexdigest()
-            record = {
-                "schema": "aios.v2r2c1.tag-approval-request.v1",
-                "binding": self.binding.as_dict(),
-                "owner_approval": owner,
-                "owner_approval_digest_sha256": approval_digest,
-                "execute": False,
-                "recorded_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-            }
-            if current and current != record:
-                raise ManualOwnerReviewRequired("persisted Owner approval differs")
-            self.state.value["approval"] = record
-            self.state.record("APPROVAL_REQUEST_RECORDED", "tag_approval_request", record)
-            return {"status": "RECORDED", "execute": False, "binding": self.binding.as_dict(), "owner_approval_digest_sha256": approval_digest}
-
-    def _require_approval(self) -> None:
-        approval = self.state.value.get("approval")
-        if not isinstance(approval, Mapping) or approval.get("binding") != self.binding.as_dict():
-            raise ReleaseBlocked("OWNER_APPROVAL_REQUEST_NOT_RECORDED")
-
-    def publish_tag(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        if request.get("execute") is not True:
-            raise ReleaseBlocked("TAG_PUBLICATION_REQUIRES_EXECUTE_TRUE")
-        self._require_approval()
-        publication = self._request(request)
-        with StateLock(self.root / "release.lock"):
-            try:
-                verified = self.publisher._verify_publication(publication, allow_push=True, previously_deployed=False)
-            except PublicationManualOwnerReviewRequired as exc:
-                self.state.fail("MANUAL_OWNER_REVIEW_REQUIRED", str(exc))
-                raise ManualOwnerReviewRequired(str(exc)) from exc
-            except PublicationPending as exc:
-                self.state.fail("REMOTE_PUSH_PENDING", str(exc))
-                raise ReconciliationRequired(str(exc)) from exc
-            except PublicationReconciliationRequired as exc:
-                self.state.fail("RECONCILIATION_REQUIRED", str(exc))
-                raise ReconciliationRequired(str(exc)) from exc
-            result = dict(verified)
-            self.state.record("TAG_VERIFIED", "tag", result)
-            return {"status": "REMOTE_VERIFIED", **result}
-
-    def tag_status(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        self._request(request)
-        return self.publisher.get_tag_publication_status(VERSION)
-
-    def build_artifact(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        self._require_approval()
-        self._request(request)
-        receipt = build_production_artifact(Path(self.config.authoritative_git_dir), self.binding, self.root / "artifacts")
-        self.state.record("ARTIFACT_VERIFIED", "production_artifact", receipt)
-        return {"status": "VERIFIED", **receipt}
-
-    def execute_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        self._require_approval()
-        publication = self._request(request)
-        tag_state = self.state.value.get("completed", {}).get("tag")
-        if not isinstance(tag_state, Mapping) or tag_state.get("state") not in {"GITEA_API_CONFIRMED", "REMOTE_VERIFIED"}:
-            raise ReleaseBlocked("REMOTE_TAG_PROOF_REQUIRED")
-        artifact = self.state.value.get("completed", {}).get("production_artifact")
-        if not isinstance(artifact, Mapping):
-            artifact = self.build_artifact(request)
-        value = {
-            **self.binding.as_dict(),
-            "tag_oid": tag_state.get("tag_oid") or tag_state.get("gitea_tag_oid"),
-            "artifact_path": artifact["artifact"],
-            "artifact_size": int(artifact["artifact_size"]),
-            "artifact_sha256": artifact["artifact_sha256"],
-        }
-        # The production adapter is privileged and is run through the root
-        # approved-release service boundary by the caller.  This handler is
-        # still useful for a root-owned staging invocation and remains
-        # fail-closed when the adapter is not available.
-        import v2r2c1_production_adapter
-        runtime = v2r2c1_production_adapter.execute_request({"schema": "aios.production-executor-request.v1", "operation": "apply", **value})
-        if runtime.get("status") != "ACTIVE_VERIFIED":
-            self.state.fail("RECONCILIATION_REQUIRED", "production health did not verify")
-            raise ReconciliationRequired("production health did not verify")
-        self.state.record("PRODUCTION_VERIFIED", "production", runtime)
-        return {"status": "PRODUCTION_VERIFIED", "runtime": runtime, "artifact": artifact, "tag_oid": value["tag_oid"]}
-
-    def consistency(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        publication = self._request(request)
-        result = self.publisher.get_release_consistency(publication)
-        result["release_binding"] = self.binding.as_dict()
-        result["production_health"] = _health(self.config.health_url, self.binding, self.state.value.get("completed", {}).get("production_artifact", {}))
-        result["registry"] = _read_json(Path(self.config.registry_root) / f"{VERSION}.json")
-        result["baseline"] = _read_json(Path(self.config.baseline_path))
-        return result
-
-    def acceptance(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        result = self.consistency(request)
-        result["accepted"] = result.get("status") == "PASS" and result.get("production_health", {}).get("status") == "ACTIVE_VERIFIED"
-        self.state.record("ACCEPTED" if result["accepted"] else "RECONCILIATION_REQUIRED", "acceptance", result)
-        return result
-
-
-def _read_json(path: Path) -> dict[str, Any]:
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except FileNotFoundError:
-        return {"status": "MISSING", "path": str(path)}
-    if not isinstance(value, dict):
-        return {"status": "INVALID", "path": str(path)}
-    return {"status": "PRESENT", "path": str(path), **value}
-
-
-def _health(url: str, binding: ReleaseBinding, artifact: Mapping[str, Any]) -> dict[str, Any]:
-    import urllib.request
-    try:
-        with urllib.request.urlopen(url, timeout=5) as response:
-            body = json.loads(response.read().decode("utf-8"))
-            status = response.status
-    except Exception as exc:
-        return {"status": "UNAVAILABLE", "error": type(exc).__name__}
-    expected_artifact = artifact.get("artifact_sha256")
-    exact = (
-        status == 200
-        and body.get("version") == binding.version
-        and body.get("commit_oid") == binding.target_oid
-        and (not expected_artifact or body.get("artifact_sha256") == expected_artifact)
-        and body.get("deployment_state") == "ACTIVE"
-        and body.get("production_deployed") is True
-    )
-    return {"status": "ACTIVE_VERIFIED" if exact else "CONFLICT", "http_status": status, **body}
-
-
-
-class TrustedPlanReleaseExecutor:
-    """Release handler whose identity comes only from an immutable trusted plan.
-
-    The bridge may prepare/read evidence and request tag publication, but it does
-    not perform production side effects.  The privileged approved-release
-    service consumes the same plan and exact Owner approval envelope.
-    """
-
-    def __init__(self, config: Any):
-        self.config = config
-        configured = getattr(config, "release_plan_path", None)
-        self.plan_path = Path(configured) if configured else None
-        self.state_root = Path(config.state_root) / "trusted-release"
-        self.state_root.mkdir(parents=True, exist_ok=True)
-        self._approval: dict[str, Any] | None = None
-        self._tag: dict[str, Any] | None = None
-
-    def _plan(self) -> TrustedReleasePlan:
-        path = self.plan_path
-        if path is None:
-            env_path = os.environ.get("AIOS_RELEASE_PLAN_PATH", "")
-            path = Path(env_path) if env_path else None
-        if path is None:
-            raise ReleaseBlocked("TRUSTED_RELEASE_PLAN_REQUIRED")
-        try:
-            return TrustedReleasePlan.load(path)
-        except PlanError as exc:
-            raise ReleaseBlocked(f"TRUSTED_RELEASE_PLAN_INVALID:{exc}") from exc
-
-    @staticmethod
-    def _binding(plan: TrustedReleasePlan) -> dict[str, Any]:
-        value = plan.value
-        return {
-            "version": value["version"],
-            "target_oid": value["source_commit"],
-            "evidence_closure_oid": value["evidence_closure_oid"],
-            "artifact_sha256": value["artifact_sha256"],
-            "artifact_size": value["artifact"]["size"],
-            "approval_plan_id": value["approval_plan_id"],
-            "candidate_id": value["candidate_id"],
-            "release_plan_sha256": plan.release_plan_sha256,
-        }
-
-    def _request(self, request: Mapping[str, Any]) -> tuple[TrustedReleasePlan, dict[str, Any]]:
-        plan = self._plan()
-        binding = self._binding(plan)
-        for key, expected in binding.items():
-            if key in request and request[key] != expected:
-                raise ManualOwnerReviewRequired("trusted release request binding mismatch:" + key)
-        return plan, binding
-
-    def approval_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        if request.get("execute") is not False:
-            raise ReleaseBlocked("TAG_APPROVAL_REQUEST_MUST_BE_DRY_RUN")
-        plan, binding = self._request(request)
-        approval = request.get("owner_approval")
-        if not isinstance(approval, Mapping) or approval.get("approved") is not True:
-            raise ReleaseBlocked("OWNER_RELEASE_APPROVAL_REQUIRED")
-        for key in ("candidate_id", "release_plan_sha256", "approval_plan_id"):
-            if approval.get(key) != binding[key]:
-                raise ManualOwnerReviewRequired("OWNER_APPROVAL_BINDING_MISMATCH:" + key)
-        record = {"plan": plan.as_dict(), "owner_approval": dict(approval)}
-        digest = hashlib.sha256(canonical(record)).hexdigest()
-        if self._approval is not None and self._approval != record:
-            raise ManualOwnerReviewRequired("OWNER_APPROVAL_REPLAY_CONFLICT")
-        self._approval = record
-        return {"status": "RECORDED", "execute": False, "release_plan_sha256": plan.release_plan_sha256, "approval_digest_sha256": digest}
-
-    def _require_approval(self, plan: TrustedReleasePlan) -> None:
-        if self._approval is None or self._approval.get("plan") != plan.as_dict():
-            raise ReleaseBlocked("OWNER_RELEASE_APPROVAL_NOT_RECORDED")
-
-    def build_artifact(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        plan, _ = self._request(request)
-        artifact = dict(plan.value["artifact"])
-        path = Path(str(artifact["path"]))
-        if path.is_symlink() or not path.is_file() or path.stat().st_size != artifact["size"]:
-            raise ReleaseBlocked("TRUSTED_ARTIFACT_NOT_PRESENT")
-        actual = hashlib.sha256(path.read_bytes()).hexdigest()
-        if actual != plan.value["artifact_sha256"]:
-            raise ReleaseBlocked("TRUSTED_ARTIFACT_DIGEST_MISMATCH")
-        return {"status": "VERIFIED", "version": plan.value["version"], "source_commit": plan.value["source_commit"], "tree_oid": plan.value["tree_oid"], "artifact": str(path), "artifact_size": artifact["size"], "artifact_sha256": actual, "manifest_sha256": plan.value["manifest_sha256"], "package_closure_sha256": plan.value["package_closure_sha256"], "release_plan_sha256": plan.release_plan_sha256}
-
-    def _publisher(self, plan: TrustedReleasePlan) -> TagPublisher:
-        root = self.state_root / plan.value["candidate_id"]
-        root.mkdir(parents=True, exist_ok=True)
-        publisher = TagPublisher(root / "publication-workspace", GitTagBackend(root / "publication-workspace", authoritative_repo=Path(self.config.authoritative_git_dir)), GiteaTagClient(self.config.api_base, "aios/aios", Path(self.config.token_path)), self.config.remote_name, state_root=root / "tag-publication")
-        publisher.baseline_path = Path(os.environ.get("AIOS_GITOPS_BASELINE_AUTHORITY", str(self.config.baseline_path)))
-        publisher.versions_root = Path(__file__).resolve().parents[1] / "versions"
-        return publisher
-
-    def publish_tag(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        if request.get("execute") is not True:
-            raise ReleaseBlocked("TAG_PUBLICATION_REQUIRES_EXECUTE_TRUE")
-        plan, _ = self._request(request)
-        self._require_approval(plan)
-        publication = PublicationRequest(plan.value["version"], plan.value["source_commit"], plan.value["evidence_closure_oid"], plan.value["approval_plan_id"])
-        try:
-            result = self._publisher(plan)._verify_publication(publication, allow_push=True, previously_deployed=False)
-        except (PublicationManualOwnerReviewRequired, PublicationPending, PublicationReconciliationRequired) as exc:
-            raise ReconciliationRequired(str(exc)) from exc
-        self._tag = dict(result)
-        return {"status": "REMOTE_VERIFIED", **result, "release_plan_sha256": plan.release_plan_sha256}
-
-    def tag_status(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        plan, _ = self._request(request)
-        return self._publisher(plan).get_tag_publication_status(plan.value["version"])
-
-    def execute_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        plan, _ = self._request(request)
-        self._require_approval(plan)
-        raise ReleaseBlocked("PRODUCTION_EXECUTION_REQUIRES_APPROVED_RELEASE_EXECUTOR")
-
-    def consistency(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        plan, binding = self._request(request)
-        result = {"status": "PASS", "release_binding": binding, "trusted_plan": plan.as_dict(), "production_mutation": False}
-        result["baseline"] = _read_json(Path(self.config.baseline_path))
-        result["registry"] = _read_json(Path(self.config.registry_root) / f"{plan.value['version']}.json")
-        return result
-
-    def acceptance(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        result = self.consistency(request)
-        result["accepted"] = result["status"] == "PASS"
-        return result
-
-
-def build_executor_config(config: Any) -> Any:
-    """Select legacy compatibility only when no trusted new-release plan exists."""
-    plan_path = getattr(config, "release_plan_path", None) or os.environ.get("AIOS_RELEASE_PLAN_PATH", "")
-    target_version = getattr(config, "target_version", "")
-    if plan_path or target_version != VERSION:
-        return TrustedPlanReleaseExecutor(config)
-    return GovernedProductionReleaseExecutor(config)
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("operation", choices=("build-artifact", "status"))
-    parser.add_argument("--git-dir", type=Path, default=Path("/data/aios-gitops/repo.git"))
-    parser.add_argument("--output-root", type=Path, default=Path("/var/lib/aios-gitops/approved-artifacts/V2R2C1"))
-    args = parser.parse_args()
-    binding = ReleaseBinding()
-    if args.operation == "build-artifact":
-        print(json.dumps(build_production_artifact(args.git_dir, binding, args.output_root), sort_keys=True))
-    else:
-        print(json.dumps({"binding": binding.as_dict(), "status": "READY"}, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

active-runtime/app/governed_tag_adapter.py

@@ -1,297 +0,0 @@
-#!/usr/bin/env python3
-"""Thin production tag adapter over AIOS's existing mature TagPublisher.
-
-This adapter deliberately does not call TagPublisher.publish(), because that
-legacy method also mutates Registry/Baseline. The production executor requires:
-Tag -> runtime ACTIVE -> Registry -> Baseline.
-
-`apply` reuses TagPublisher._verify_publication() under the publisher's durable
-per-version lock. That method performs the existing fail-closed annotated-tag,
-network remote, Gitea API, peeled-target and listing verification, but stops
-before Registry/Baseline mutation.
-
-`probe` is read-only.
-"""
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import re
-import sys
-from pathlib import Path
-from typing import Any, Mapping
-
-from gitea_tag_publication import (
-    GiteaTagClient,
-    GitTagBackend,
-    PublicationConflict,
-    PublicationManualOwnerReviewRequired,
-    PublicationPending,
-    PublicationReconciliationRequired,
-    PublicationRequest,
-    PublicationState,
-    TagPublisher,
-)
-
-from release_version import validate_release_version
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
-
-
-def load_request() -> dict[str, Any]:
-    value = json.load(sys.stdin)
-    if not isinstance(value, dict):
-        raise ValueError("request_object_required")
-    if value.get("schema") != "aios.production-executor-request.v1":
-        raise ValueError("request_schema_invalid")
-    try:
-        validate_release_version(value.get("version", ""))
-    except ValueError as exc:
-        raise ValueError("version_invalid") from exc
-    for name in ("target_oid", "evidence_closure_oid"):
-        if not OID_RE.fullmatch(str(value.get(name, ""))):
-            raise ValueError(f"{name}_invalid")
-    if not PLAN_RE.fullmatch(str(value.get("approval_plan_id", ""))):
-        raise ValueError("approval_plan_id_invalid")
-    if value.get("repository_identity") != "aios/aios":
-        raise ValueError("repository_identity_invalid")
-    return value
-
-
-def publication_request(value: Mapping[str, Any]) -> PublicationRequest:
-    return PublicationRequest(
-        str(value["version"]),
-        str(value["target_oid"]),
-        str(value["evidence_closure_oid"]),
-        str(value["approval_plan_id"]),
-    )
-
-
-def response(value: Mapping[str, Any], status: str, **extra: Any) -> dict[str, Any]:
-    return {
-        "status": status,
-        "version": value["version"],
-        "target_oid": value["target_oid"],
-        "evidence_closure_oid": value["evidence_closure_oid"],
-        "artifact_sha256": value["artifact_sha256"],
-        "approval_plan_id": value["approval_plan_id"],
-        **extra,
-    }
-
-
-def build(args: argparse.Namespace) -> tuple[TagPublisher, GitTagBackend, GiteaTagClient]:
-    git = GitTagBackend(args.workspace, authoritative_repo=args.repository)
-    gitea = GiteaTagClient(
-        args.gitea_api,
-        args.gitea_repo,
-        args.gitea_token_file,
-        token_line=args.gitea_token_line,
-    )
-    publisher = TagPublisher(
-        args.workspace,
-        git,
-        gitea,
-        args.remote,
-        state_root=args.state_root,
-    )
-    return publisher, git, gitea
-
-
-def _gitea_lookup(gitea: GiteaTagClient, version: str) -> tuple[str, str] | None:
-    try:
-        return gitea.lookup_tag(version)
-    except RuntimeError as exc:
-        if "HTTP 404" in str(exc):
-            return None
-        raise
-
-
-def probe(
-    args: argparse.Namespace,
-    value: Mapping[str, Any],
-    publisher: TagPublisher,
-    git: GitTagBackend,
-    gitea: GiteaTagClient,
-) -> dict[str, Any]:
-    request = publication_request(value)
-    request.validate()
-    git.validate_evidence_lineage(request)
-
-    local_oid = git._rev(f"refs/tags/{request.version}")
-    local_target = git._rev(f"refs/tags/{request.version}^{{commit}}")
-    remote = git.remote_tag(args.remote, request.version)
-    api = _gitea_lookup(gitea, request.version)
-    listing = False
-    if api is not None:
-        listing = gitea.tag_visible_in_listing(request.version, request.target_oid)
-
-    if local_oid is None and remote is None and api is None:
-        return response(value, "NOT_APPLIED")
-
-    if local_oid is not None:
-        if local_target is None or local_oid == local_target:
-            return response(value, "CONFLICT", reason="local_tag_not_annotated")
-        if local_target != request.target_oid:
-            return response(
-                value,
-                "CONFLICT",
-                reason="local_peeled_target_mismatch",
-                tag_oid=local_oid,
-                peeled_target_oid=local_target,
-            )
-
-    # A remote/Gitea tag without the Authority tag object is not safe to
-    # recreate, because a new annotated tag would have a different object OID.
-    if local_oid is None and (remote is not None or api is not None):
-        return response(
-            value,
-            "INDETERMINATE",
-            reason="remote_or_gitea_tag_exists_without_authority_tag_object",
-        )
-
-    if remote is not None:
-        if remote[0] != local_oid or remote[1] != request.target_oid:
-            return response(
-                value,
-                "CONFLICT",
-                reason="network_remote_tag_mismatch",
-                tag_oid=local_oid,
-                peeled_target_oid=local_target,
-                remote_tag_oid=remote[0],
-                remote_peeled_target_oid=remote[1],
-            )
-
-    if api is not None:
-        if api[0] != local_oid or api[1] != request.target_oid:
-            return response(
-                value,
-                "CONFLICT",
-                reason="gitea_api_tag_mismatch",
-                tag_oid=local_oid,
-                peeled_target_oid=local_target,
-                gitea_tag_oid=api[0],
-                gitea_peeled_target_oid=api[1],
-            )
-
-    if (
-        local_oid is not None
-        and remote is not None
-        and api is not None
-        and listing
-    ):
-        return response(
-            value,
-            "APPLIED_VERIFIED",
-            tag_oid=local_oid,
-            peeled_target_oid=local_target,
-            remote_tag_oid=remote[0],
-            remote_peeled_target_oid=remote[1],
-            gitea_tag_oid=api[0],
-            gitea_peeled_target_oid=api[1],
-            gitea_listing_visible=True,
-        )
-
-    if local_oid is not None and remote is None and api is None:
-        return response(
-            value,
-            "PARTIAL_LOCAL",
-            tag_oid=local_oid,
-            peeled_target_oid=local_target,
-        )
-
-    return response(
-        value,
-        "INDETERMINATE",
-        reason="tag_visibility_partial",
-        tag_oid=local_oid,
-        peeled_target_oid=local_target,
-    )
-
-
-def apply(
-    args: argparse.Namespace,
-    value: Mapping[str, Any],
-    publisher: TagPublisher,
-    git: GitTagBackend,
-    gitea: GiteaTagClient,
-) -> dict[str, Any]:
-    before = probe(args, value, publisher, git, gitea)
-    if before["status"] in {"APPLIED_VERIFIED", "CONFLICT", "INDETERMINATE"}:
-        return before
-
-    request = publication_request(value)
-    with publisher.store.lock(request.version):
-        request.validate()
-        publisher._assert_fingerprint(request)
-        publisher.store.record(request, PublicationState.PENDING)
-        publisher._verify_publication(
-            request,
-            allow_push=True,
-            previously_deployed=False,
-        )
-    return probe(args, value, publisher, git, gitea)
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--workspace", type=Path, default=Path(os.environ["AIOS_GITOPS_CONTROLLER_WORKSPACE"]))
-    parser.add_argument("--repository", type=Path, default=Path(os.environ["AIOS_GITOPS_AUTHORITATIVE_GIT_DIR"]))
-    parser.add_argument("--remote", default=os.getenv("AIOS_GITOPS_GITEA_REMOTE", "gitea"))
-    parser.add_argument("--gitea-api", default=os.getenv("AIOS_GITOPS_GITEA_API_URL", ""))
-    parser.add_argument("--gitea-repo", default=os.getenv("AIOS_GITOPS_GITEA_REPOSITORY", ""))
-    parser.add_argument(
-        "--gitea-token-file",
-        type=Path,
-        default=Path(os.getenv("AIOS_GITOPS_GITEA_TOKEN_FILE", "")),
-    )
-    parser.add_argument(
-        "--gitea-token-line",
-        type=int,
-        default=int(os.getenv("AIOS_GITOPS_GITEA_TOKEN_LINE", "1")),
-    )
-    parser.add_argument(
-        "--state-root",
-        type=Path,
-        default=Path(
-            os.getenv(
-                "AIOS_GITOPS_PUBLICATION_STATE_DIR",
-                "/var/lib/aios-gitops/tag-publications",
-            )
-        ),
-    )
-    args = parser.parse_args()
-    value = load_request()
-    publisher, git, gitea = build(args)
-    operation = value.get("operation")
-    if operation == "probe":
-        result = probe(args, value, publisher, git, gitea)
-    elif operation == "apply":
-        result = apply(args, value, publisher, git, gitea)
-    else:
-        raise ValueError("unsupported_operation")
-    print(json.dumps(result, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    try:
-        raise SystemExit(main())
-    except PublicationManualOwnerReviewRequired as exc:
-        print(json.dumps({"status": "CONFLICT", "reason": str(exc)}, sort_keys=True))
-        raise SystemExit(20)
-    except PublicationConflict as exc:
-        print(json.dumps({"status": "CONFLICT", "reason": str(exc)}, sort_keys=True))
-        raise SystemExit(20)
-    except (PublicationPending, PublicationReconciliationRequired) as exc:
-        print(json.dumps({"status": "INDETERMINATE", "reason": str(exc)}, sort_keys=True))
-        raise SystemExit(21)
-    except Exception as exc:
-        print(
-            json.dumps(
-                {"status": "INDETERMINATE", "error": type(exc).__name__, "reason": str(exc)},
-                sort_keys=True,
-            )
-        )
-        raise SystemExit(22)

active-runtime/app/owner_authorization_broker.py

@@ -1,611 +0,0 @@
-"""Audited Owner authorization broker for task-scoped writer provisioning.
-
-The broker closes the bootstrap gap without minting a new general-purpose
-Owner token and without modifying the bearer-token registry. It accepts an
-already-authenticated, explicitly allow-listed Owner principal, records a
-tamper-evident authorization event, and invokes the existing
-AuthorizedTaskWriterProvisioner with a generated authorization reference.
-
-The broker never writes Git refs itself. The governed signer, validator and
-one-shot provisioner remain the only components allowed to create the task
-branch/worktree/writer.
-"""
-from __future__ import annotations
-
-import fcntl
-import hashlib
-import json
-import os
-import re
-import tempfile
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any, Mapping, Protocol
-
-from authorized_task_writer_provisioning import (
-    AuthorizedTaskWriterProvisioner,
-    BRANCH_RE,
-    OID_RE,
-    OwnerContext,
-    ProvisioningError,
-    REQUIRED_ALLOWED_OPERATIONS,
-    REQUIRED_DENIED_OPERATIONS,
-    TASK_RE,
-)
-
-
-ACTION = "AUTHORIZE_TASK_WRITER_PROVISIONING"
-SCHEMA = "aios.owner-authorization-event.v1"
-BROKER_REQUEST_FIELDS = frozenset(
-    {
-        "action",
-        "task_id",
-        "repository",
-        "base_ref",
-        "base_oid",
-        "target_branch",
-        "one_time_use",
-        "expires_in_seconds",
-        "production_change_authorized",
-        "tag_change_authorized",
-        "baseline_change_authorized",
-        "main_write_authorized",
-        "allowed_operations",
-        "denied_operations",
-    }
-)
-IDENTITY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._@:+/-]{1,254}$")
-SCOPE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{1,127}$")
-CREDENTIAL_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:@+-]{1,255}$")
-WILDCARD_SCOPE_RE = re.compile(r"(^\*$)|(^.+:\*$)")
-
-
-class OwnerAuthorizationError(RuntimeError):
-    """Stable fail-closed broker error."""
-
-    def __init__(
-        self,
-        code: str,
-        status: int = 400,
-        *,
-        details: Mapping[str, Any] | None = None,
-    ) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-        self.details = dict(details or {})
-
-
-@dataclass(frozen=True)
-class OwnerPrincipal:
-    """Non-secret authentication evidence returned by the existing API."""
-
-    identity: str
-    role: str
-    authenticated_scope: str
-    token_scopes: frozenset[str]
-    credential_id: str = ""
-
-
-@dataclass(frozen=True)
-class OwnerAuthorizationBrokerConfig:
-    repository_identity: str
-    state_root: Path
-    allowed_owner_identities: frozenset[str]
-    allowed_intake_scopes: frozenset[str]
-    allowed_credential_ids: frozenset[str] = frozenset()
-    max_expiry_seconds: int = 900
-
-    @classmethod
-    def from_environment(cls) -> "OwnerAuthorizationBrokerConfig":
-        identities = _csv_set(
-            os.getenv("AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_IDENTITIES", "")
-        )
-        scopes = _csv_set(
-            os.getenv("AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES", "")
-        )
-        credential_ids = _csv_set(
-            os.getenv("AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_CREDENTIAL_IDS", "")
-        )
-        if not identities:
-            raise OwnerAuthorizationError(
-                "OWNER_IDENTITY_ALLOWLIST_REQUIRED", 503
-            )
-        if not scopes:
-            raise OwnerAuthorizationError(
-                "OWNER_INTAKE_SCOPE_ALLOWLIST_REQUIRED", 503
-            )
-        if any(_is_wildcard_scope(item) for item in scopes):
-            raise OwnerAuthorizationError(
-                "WILDCARD_INTAKE_SCOPE_REJECTED", 503
-            )
-        if "writer:provision" in scopes:
-            raise OwnerAuthorizationError(
-                "WRITER_PROVISION_SCOPE_BOOTSTRAP_REJECTED", 503
-            )
-        try:
-            maximum = int(
-                os.getenv(
-                    "AIOS_GITOPS_OWNER_AUTHORIZATION_MAX_EXPIRY_SECONDS", "900"
-                )
-            )
-        except ValueError:
-            raise OwnerAuthorizationError(
-                "BROKER_MAX_EXPIRY_INVALID", 503
-            ) from None
-        if maximum < 60 or maximum > 1800:
-            raise OwnerAuthorizationError("BROKER_MAX_EXPIRY_INVALID", 503)
-        return cls(
-            repository_identity=os.getenv(
-                "AIOS_GITOPS_REPOSITORY_IDENTITY", "aios/aios"
-            ).strip(),
-            state_root=Path(
-                os.getenv(
-                    "AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT",
-                    "/var/lib/aios-gitops/owner-authorization-broker",
-                )
-            ),
-            allowed_owner_identities=identities,
-            allowed_intake_scopes=scopes,
-            allowed_credential_ids=credential_ids,
-            max_expiry_seconds=maximum,
-        )
-
-
-class TaskWriterProvisioner(Protocol):
-    def provision(
-        self, raw: Mapping[str, Any], owner: OwnerContext
-    ) -> dict[str, Any]:
-        ...
-
-
-def utc_now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def iso_utc(value: datetime) -> str:
-    return value.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def canonical_json_bytes(value: Any) -> bytes:
-    return (
-        json.dumps(
-            value,
-            ensure_ascii=False,
-            sort_keys=True,
-            separators=(",", ":"),
-        )
-        + "\n"
-    ).encode("utf-8")
-
-
-def sha256_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
-
-
-def _csv_set(value: str) -> frozenset[str]:
-    return frozenset(
-        item.strip() for item in value.split(",") if item.strip()
-    )
-
-
-def _is_wildcard_scope(scope: str) -> bool:
-    return bool(WILDCARD_SCOPE_RE.fullmatch(scope.strip()))
-
-
-def _atomic_write_json(path: Path, value: Any, mode: int = 0o600) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    if path.parent.is_symlink() or path.is_symlink():
-        raise OwnerAuthorizationError("BROKER_STATE_SYMLINK_REJECTED", 500)
-    fd, temporary = tempfile.mkstemp(prefix=".tmp-", dir=path.parent)
-    try:
-        os.fchmod(fd, mode)
-        with os.fdopen(fd, "wb", closefd=True) as stream:
-            stream.write(canonical_json_bytes(value))
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(temporary, path)
-        os.chmod(path, mode)
-        parent_fd = os.open(
-            path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
-        )
-        try:
-            os.fsync(parent_fd)
-        finally:
-            os.close(parent_fd)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def _read_json(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise OwnerAuthorizationError("BROKER_RECEIPT_INVALID", 500)
-    if path.stat().st_size <= 0 or path.stat().st_size > 1_048_576:
-        raise OwnerAuthorizationError("BROKER_RECEIPT_INVALID", 500)
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        raise OwnerAuthorizationError(
-            "BROKER_RECEIPT_JSON_INVALID", 500
-        ) from None
-    if not isinstance(value, dict):
-        raise OwnerAuthorizationError("BROKER_RECEIPT_INVALID", 500)
-    return value
-
-
-def _prepare_state_root(root: Path) -> None:
-    if root.is_symlink():
-        raise OwnerAuthorizationError("BROKER_STATE_SYMLINK_REJECTED", 500)
-    root.mkdir(parents=True, exist_ok=True, mode=0o700)
-    os.chmod(root, 0o700)
-    if root.stat().st_mode & 0o077:
-        raise OwnerAuthorizationError(
-            "BROKER_STATE_PERMISSIONS_REJECTED", 500
-        )
-
-
-def _event_id(
-    principal: OwnerPrincipal, request_digest: str
-) -> str:
-    material = (
-        f"{principal.identity}\0{principal.authenticated_scope}\0"
-        f"{request_digest}"
-    ).encode("utf-8")
-    return "owner-auth-" + hashlib.sha256(material).hexdigest()[:32]
-
-
-def _authorization_reference(event_id: str, request_digest: str) -> str:
-    return f"owner-auth:{event_id}:{request_digest[:16]}"
-
-
-def _validate_principal(
-    principal: OwnerPrincipal,
-    config: OwnerAuthorizationBrokerConfig,
-) -> None:
-    if principal.role != "owner":
-        raise OwnerAuthorizationError("OWNER_ROLE_REQUIRED", 403)
-    if (
-        not principal.identity
-        or not IDENTITY_RE.fullmatch(principal.identity)
-        or principal.identity not in config.allowed_owner_identities
-    ):
-        raise OwnerAuthorizationError("OWNER_IDENTITY_NOT_ALLOWED", 403)
-    if (
-        not principal.authenticated_scope
-        or not SCOPE_RE.fullmatch(principal.authenticated_scope)
-        or principal.authenticated_scope
-        not in config.allowed_intake_scopes
-    ):
-        raise OwnerAuthorizationError("OWNER_INTAKE_SCOPE_REJECTED", 403)
-    if principal.authenticated_scope == "writer:provision":
-        raise OwnerAuthorizationError(
-            "WRITER_PROVISION_SCOPE_BOOTSTRAP_REJECTED", 403
-        )
-
-    scopes = principal.token_scopes
-    if any(_is_wildcard_scope(scope) for scope in scopes):
-        raise OwnerAuthorizationError(
-            "WILDCARD_OWNER_CREDENTIAL_REJECTED", 403
-        )
-    if scopes:
-        if principal.authenticated_scope not in scopes:
-            raise OwnerAuthorizationError(
-                "OWNER_SCOPE_EVIDENCE_MISMATCH", 403
-            )
-    elif (
-        not principal.credential_id
-        or principal.credential_id not in config.allowed_credential_ids
-    ):
-        # handler.need(scope) proves authorization but may hide whether the
-        # credential was wildcard. When scope metadata is absent, require an
-        # exact non-secret credential ID allowlist as the alternative proof.
-        raise OwnerAuthorizationError(
-            "OWNER_CREDENTIAL_SCOPE_NOT_PROVABLE", 403
-        )
-    if principal.credential_id:
-        if not CREDENTIAL_ID_RE.fullmatch(principal.credential_id):
-            raise OwnerAuthorizationError("OWNER_CREDENTIAL_ID_INVALID", 403)
-        if (
-            config.allowed_credential_ids
-            and principal.credential_id not in config.allowed_credential_ids
-        ):
-            raise OwnerAuthorizationError(
-                "OWNER_CREDENTIAL_ID_NOT_ALLOWED", 403
-            )
-
-
-def _validate_request(
-    raw: Mapping[str, Any],
-    config: OwnerAuthorizationBrokerConfig,
-) -> dict[str, Any]:
-    if set(raw) != BROKER_REQUEST_FIELDS:
-        raise OwnerAuthorizationError("BROKER_REQUEST_FIELDS_REJECTED")
-    if raw["action"] != ACTION:
-        raise OwnerAuthorizationError("BROKER_ACTION_REJECTED")
-    if raw["repository"] != config.repository_identity:
-        raise OwnerAuthorizationError(
-            "REPOSITORY_IDENTITY_MISMATCH", 409
-        )
-    if raw["base_ref"] != "refs/heads/main":
-        raise OwnerAuthorizationError("BASE_REF_REJECTED", 409)
-    if (
-        not isinstance(raw["base_oid"], str)
-        or not OID_RE.fullmatch(raw["base_oid"])
-    ):
-        raise OwnerAuthorizationError("BASE_OID_REJECTED")
-    if (
-        not isinstance(raw["target_branch"], str)
-        or not BRANCH_RE.fullmatch(raw["target_branch"])
-        or raw["target_branch"] in {"main", "master"}
-    ):
-        raise OwnerAuthorizationError("TARGET_BRANCH_REJECTED")
-    if (
-        not isinstance(raw["task_id"], str)
-        or not TASK_RE.fullmatch(raw["task_id"])
-    ):
-        raise OwnerAuthorizationError("TASK_ID_REJECTED")
-    if raw["one_time_use"] is not True:
-        raise OwnerAuthorizationError("ONE_TIME_USE_REQUIRED")
-    expiry = raw["expires_in_seconds"]
-    if (
-        not isinstance(expiry, int)
-        or isinstance(expiry, bool)
-        or not 60 <= expiry <= config.max_expiry_seconds
-    ):
-        raise OwnerAuthorizationError("GRANT_LIFETIME_REJECTED")
-    for field in (
-        "production_change_authorized",
-        "tag_change_authorized",
-        "baseline_change_authorized",
-        "main_write_authorized",
-    ):
-        if raw[field] is not False:
-            raise OwnerAuthorizationError(
-                "PRODUCTION_CAPABILITY_REJECTED", 403
-            )
-    allowed = raw["allowed_operations"]
-    denied = raw["denied_operations"]
-    if (
-        not isinstance(allowed, list)
-        or frozenset(allowed) != REQUIRED_ALLOWED_OPERATIONS
-    ):
-        raise OwnerAuthorizationError("ALLOWED_OPERATIONS_MISMATCH", 403)
-    if (
-        not isinstance(denied, list)
-        or frozenset(denied) != REQUIRED_DENIED_OPERATIONS
-    ):
-        raise OwnerAuthorizationError("DENIED_OPERATIONS_MISMATCH", 403)
-    return dict(raw)
-
-
-def _response_is_safe(value: Any) -> bool:
-    """Reject accidental credential material before writing a receipt."""
-
-    sensitive_markers = (
-        "access_token",
-        "bearer",
-        "client_secret",
-        "private_key",
-        "raw_token",
-        "secret_value",
-    )
-    if isinstance(value, Mapping):
-        for key, inner in value.items():
-            lowered = str(key).lower()
-            if any(marker in lowered for marker in sensitive_markers):
-                return False
-            if not _response_is_safe(inner):
-                return False
-    elif isinstance(value, list):
-        return all(_response_is_safe(item) for item in value)
-    return True
-
-
-class OwnerAuthorizationBroker:
-    """Create an audited Owner event and invoke the governed bridge."""
-
-    def __init__(
-        self,
-        config: OwnerAuthorizationBrokerConfig | None = None,
-        provisioner: TaskWriterProvisioner | None = None,
-    ) -> None:
-        self.config = (
-            config or OwnerAuthorizationBrokerConfig.from_environment()
-        )
-        self.provisioner = provisioner or AuthorizedTaskWriterProvisioner()
-
-    def authorize_and_provision(
-        self,
-        raw: Mapping[str, Any],
-        principal: OwnerPrincipal,
-    ) -> dict[str, Any]:
-        config = self.config
-        _validate_principal(principal, config)
-        request = _validate_request(raw, config)
-        _prepare_state_root(config.state_root)
-
-        request_digest = sha256_json(request)
-        event_id = _event_id(principal, request_digest)
-        reference = _authorization_reference(event_id, request_digest)
-        event_dir = config.state_root / "events" / event_id
-        event_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
-        os.chmod(event_dir, 0o700)
-
-        lock_path = event_dir / "event.lock"
-        lock_path.touch(mode=0o600, exist_ok=True)
-        os.chmod(lock_path, 0o600)
-        with lock_path.open("r+b") as lock:
-            fcntl.flock(lock.fileno(), fcntl.LOCK_EX)
-            response_path = event_dir / "response.json"
-            event_path = event_dir / "event.json"
-
-            if response_path.exists():
-                response = _read_json(response_path)
-                response["owner_authorization_idempotent"] = True
-                return response
-
-            issued_at = utc_now()
-            expires_at = issued_at + timedelta(
-                seconds=int(request["expires_in_seconds"])
-            )
-            event: dict[str, Any] = {
-                "schema": SCHEMA,
-                "event_id": event_id,
-                "authorization_reference": reference,
-                "status": "AUTHORIZED",
-                "owner": {
-                    "identity": principal.identity,
-                    "role": principal.role,
-                    "authenticated_scope": principal.authenticated_scope,
-                    "credential_id": principal.credential_id or None,
-                    "token_scope_digest_sha256": sha256_json(
-                        sorted(principal.token_scopes)
-                    ),
-                    "wildcard_scope_used": False,
-                },
-                "request": {
-                    "task_id": request["task_id"],
-                    "repository": request["repository"],
-                    "base_ref": request["base_ref"],
-                    "base_oid": request["base_oid"],
-                    "target_branch": request["target_branch"],
-                    "one_time_use": True,
-                    "production_change_authorized": False,
-                    "tag_change_authorized": False,
-                    "baseline_change_authorized": False,
-                    "main_write_authorized": False,
-                    "allowed_operations": sorted(
-                        REQUIRED_ALLOWED_OPERATIONS
-                    ),
-                    "denied_operations": sorted(
-                        REQUIRED_DENIED_OPERATIONS
-                    ),
-                },
-                "request_digest_sha256": request_digest,
-                "issued_at": iso_utc(issued_at),
-                "expires_at": iso_utc(expires_at),
-            }
-            event["event_digest_sha256"] = sha256_json(event)
-            _atomic_write_json(event_path, event)
-
-            bridge_request = dict(request)
-            bridge_request.pop("action")
-            bridge_request["owner_authorization_reference"] = reference
-            try:
-                result = self.provisioner.provision(
-                    bridge_request,
-                    OwnerContext(
-                        identity=principal.identity,
-                        role=principal.role,
-                        authorization_reference=reference,
-                    ),
-                )
-                if not isinstance(result, dict):
-                    raise OwnerAuthorizationError(
-                        "PROVISIONER_RESPONSE_INVALID", 502
-                    )
-                if result.get("status") != "READY_FOR_CODE_AUTHORING":
-                    raise OwnerAuthorizationError(
-                        "PROVISIONER_NOT_READY",
-                        409,
-                        details={"status": result.get("status")},
-                    )
-                if not _response_is_safe(result):
-                    raise OwnerAuthorizationError(
-                        "PROVISIONER_RESPONSE_CONTAINS_SENSITIVE_DATA", 500
-                    )
-            except ProvisioningError as exc:
-                event.update(
-                    {
-                        "status": "PROVISIONING_BLOCKED",
-                        "failed_at": iso_utc(utc_now()),
-                        "error": exc.code,
-                        "error_status": exc.status,
-                    }
-                )
-                event["event_digest_sha256"] = sha256_json(
-                    {
-                        key: value
-                        for key, value in event.items()
-                        if key != "event_digest_sha256"
-                    }
-                )
-                _atomic_write_json(event_path, event)
-                raise
-            except OwnerAuthorizationError as exc:
-                event.update(
-                    {
-                        "status": "PROVISIONING_BLOCKED",
-                        "failed_at": iso_utc(utc_now()),
-                        "error": exc.code,
-                        "error_status": exc.status,
-                    }
-                )
-                event["event_digest_sha256"] = sha256_json(
-                    {
-                        key: value
-                        for key, value in event.items()
-                        if key != "event_digest_sha256"
-                    }
-                )
-                _atomic_write_json(event_path, event)
-                raise
-            except Exception as exc:
-                event.update(
-                    {
-                        "status": "PROVISIONING_FAILED",
-                        "failed_at": iso_utc(utc_now()),
-                        "error": "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR",
-                    }
-                )
-                event["event_digest_sha256"] = sha256_json(
-                    {
-                        key: value
-                        for key, value in event.items()
-                        if key != "event_digest_sha256"
-                    }
-                )
-                _atomic_write_json(event_path, event)
-                raise OwnerAuthorizationError(
-                    "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR", 500
-                ) from exc
-
-            completed_at = utc_now()
-            event.update(
-                {
-                    "status": "CONSUMED",
-                    "consumed_at": iso_utc(completed_at),
-                    "approval_plan_id": result.get("approval_plan_id"),
-                    "grant_id": result.get("grant_id"),
-                    "grant_digest_sha256": result.get(
-                        "grant_digest_sha256"
-                    ),
-                    "branch_oid": result.get("branch_oid"),
-                    "grant_consumed": result.get("grant_consumed") is True,
-                }
-            )
-            event["event_digest_sha256"] = sha256_json(
-                {
-                    key: value
-                    for key, value in event.items()
-                    if key != "event_digest_sha256"
-                }
-            )
-            _atomic_write_json(event_path, event)
-
-            response = dict(result)
-            response.update(
-                {
-                    "owner_authorization_event_id": event_id,
-                    "owner_authorization_reference": reference,
-                    "owner_authorization_digest_sha256": event[
-                        "event_digest_sha256"
-                    ],
-                    "owner_authorization_consumed": True,
-                    "owner_authorization_idempotent": False,
-                }
-            )
-            _atomic_write_json(response_path, response)
-            return response

active-runtime/app/owner_local_auth_ingress.py

@@ -1,642 +0,0 @@
-#!/usr/bin/env python3
-"""One-shot local Owner authentication ingress for AIOS.
-
-This module deliberately does not mint a reusable Owner token.
-
-Authentication is based on a real local login session:
-- a root-run one-shot server owns a Unix socket;
-- the client must run as the configured Owner OS account;
-- the server validates SO_PEERCRED, Linux audit loginuid and the controlling TTY;
-- the Owner must interactively confirm the exact task/branch/base request;
-- the server constructs a narrow OwnerPrincipal and invokes the existing
-  OwnerAuthorizationBroker;
-- one successful authorization consumes the service lifetime.
-
-The resulting principal is fixed to one non-wildcard intake scope
-(`commit:create` for the current deployment) and cannot carry production,
-tag, baseline, main or history-rewrite capability.
-
-This is a trust-root ingress, not a Git writer and not a production executor.
-"""
-from __future__ import annotations
-
-import argparse
-import fcntl
-import hashlib
-import json
-import os
-from pathlib import Path
-import pwd
-import re
-import secrets
-import socket
-import stat
-import struct
-import sys
-import tempfile
-import time
-from typing import Any, Mapping
-
-
-BINDING_SCHEMA = "aios.local-owner-auth-ingress.v1"
-CLIENT_BEGIN_SCHEMA = "aios.local-owner-auth-client-begin.v1"
-CHALLENGE_SCHEMA = "aios.local-owner-auth-challenge.v1"
-CLIENT_CONFIRM_SCHEMA = "aios.local-owner-auth-client-confirm.v1"
-RESULT_SCHEMA = "aios.local-owner-auth-result.v1"
-
-ACTION = "AUTHORIZE_TASK_WRITER_PROVISIONING"
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-IDENTITY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._@:+/-]{1,254}$")
-SCOPE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{1,127}$")
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{1,255}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9._/-]{1,220}$")
-
-MAX_FRAME = 64 * 1024
-CHALLENGE_TTL_SECONDS = 120
-
-EXPECTED_ALLOWED_OPERATIONS = frozenset(
-    {
-        "create_worktree",
-        "create_target_branch_if_absent",
-        "commit_to_target_branch",
-        "push_target_branch",
-    }
-)
-EXPECTED_DENIED_OPERATIONS = frozenset(
-    {
-        "direct_main_push",
-        "force_push",
-        "tag_create",
-        "tag_update",
-        "tag_delete",
-        "branch_delete",
-        "repository_admin",
-        "baseline_write",
-        "production_deploy",
-        "production_marker_write",
-        "history_rewrite",
-    }
-)
-
-SENSITIVE_FRAGMENTS = (
-    "authorization_header",
-    "bearer",
-    "client_secret",
-    "password",
-    "private_key",
-    "raw_secret",
-    "raw_token",
-    "secret_value",
-)
-
-
-class BootstrapError(RuntimeError):
-    def __init__(self, code: str, status: int = 1) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-def canonical_json(value: Any) -> bytes:
-    return (
-        json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
-        + "\n"
-    ).encode("utf-8")
-
-
-def sha256_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json(value)).hexdigest()
-
-
-def atomic_json(path: Path, value: Mapping[str, Any], mode: int = 0o600) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    if path.parent.is_symlink() or path.is_symlink():
-        raise BootstrapError("STATE_SYMLINK_REJECTED")
-    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=str(path.parent))
-    try:
-        os.fchmod(fd, mode)
-        with os.fdopen(fd, "wb", closefd=True) as stream:
-            stream.write(canonical_json(dict(value)))
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(name, path)
-        os.chmod(path, mode)
-        dfd = os.open(path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
-        try:
-            os.fsync(dfd)
-        finally:
-            os.close(dfd)
-    finally:
-        try:
-            os.unlink(name)
-        except FileNotFoundError:
-            pass
-
-
-def secure_root_file(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise BootstrapError("BINDING_FILE_INVALID")
-    st = path.lstat()
-    if st.st_uid != 0:
-        raise BootstrapError("BINDING_FILE_ROOT_OWNER_REQUIRED")
-    if stat.S_IMODE(st.st_mode) & 0o077:
-        raise BootstrapError("BINDING_FILE_PERMISSIONS_INVALID")
-    if st.st_size <= 0 or st.st_size > 1_048_576:
-        raise BootstrapError("BINDING_FILE_SIZE_INVALID")
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise BootstrapError("BINDING_JSON_INVALID") from exc
-    if not isinstance(value, dict):
-        raise BootstrapError("BINDING_JSON_INVALID")
-    return value
-
-
-def validate_binding(value: Mapping[str, Any]) -> dict[str, Any]:
-    if set(value) != {
-        "schema",
-        "owner_identity",
-        "owner_role",
-        "authenticated_scope",
-        "request",
-    }:
-        raise BootstrapError("BINDING_FIELDS_REJECTED")
-    if value["schema"] != BINDING_SCHEMA:
-        raise BootstrapError("BINDING_SCHEMA_REJECTED")
-    identity = value["owner_identity"]
-    if not isinstance(identity, str) or not IDENTITY_RE.fullmatch(identity):
-        raise BootstrapError("OWNER_IDENTITY_INVALID")
-    if value["owner_role"] != "owner":
-        raise BootstrapError("OWNER_ROLE_INVALID")
-    scope = value["authenticated_scope"]
-    if (
-        not isinstance(scope, str)
-        or not SCOPE_RE.fullmatch(scope)
-        or scope == "writer:provision"
-        or scope == "*"
-        or scope.endswith(":*")
-    ):
-        raise BootstrapError("OWNER_SCOPE_INVALID")
-
-    request = value["request"]
-    if not isinstance(request, dict):
-        raise BootstrapError("REQUEST_INVALID")
-    expected_fields = {
-        "action",
-        "task_id",
-        "repository",
-        "base_ref",
-        "base_oid",
-        "target_branch",
-        "one_time_use",
-        "expires_in_seconds",
-        "production_change_authorized",
-        "tag_change_authorized",
-        "baseline_change_authorized",
-        "main_write_authorized",
-        "allowed_operations",
-        "denied_operations",
-    }
-    if set(request) != expected_fields:
-        raise BootstrapError("REQUEST_FIELDS_REJECTED")
-    if request["action"] != ACTION:
-        raise BootstrapError("REQUEST_ACTION_REJECTED")
-    if request["repository"] != "aios/aios":
-        raise BootstrapError("REPOSITORY_REJECTED")
-    if request["base_ref"] != "refs/heads/main":
-        raise BootstrapError("BASE_REF_REJECTED")
-    if not isinstance(request["base_oid"], str) or not OID_RE.fullmatch(request["base_oid"]):
-        raise BootstrapError("BASE_OID_REJECTED")
-    if (
-        not isinstance(request["target_branch"], str)
-        or not BRANCH_RE.fullmatch(request["target_branch"])
-    ):
-        raise BootstrapError("TARGET_BRANCH_REJECTED")
-    if (
-        not isinstance(request["task_id"], str)
-        or not TASK_RE.fullmatch(request["task_id"])
-    ):
-        raise BootstrapError("TASK_ID_REJECTED")
-    if request["one_time_use"] is not True:
-        raise BootstrapError("ONE_TIME_USE_REQUIRED")
-    expiry = request["expires_in_seconds"]
-    if (
-        not isinstance(expiry, int)
-        or isinstance(expiry, bool)
-        or not 60 <= expiry <= 900
-    ):
-        raise BootstrapError("EXPIRY_REJECTED")
-    for field in (
-        "production_change_authorized",
-        "tag_change_authorized",
-        "baseline_change_authorized",
-        "main_write_authorized",
-    ):
-        if request[field] is not False:
-            raise BootstrapError("CONSEQUENTIAL_CAPABILITY_REJECTED")
-    if (
-        not isinstance(request["allowed_operations"], list)
-        or frozenset(request["allowed_operations"]) != EXPECTED_ALLOWED_OPERATIONS
-    ):
-        raise BootstrapError("ALLOWED_OPERATIONS_MISMATCH")
-    if (
-        not isinstance(request["denied_operations"], list)
-        or frozenset(request["denied_operations"]) != EXPECTED_DENIED_OPERATIONS
-    ):
-        raise BootstrapError("DENIED_OPERATIONS_MISMATCH")
-    return {
-        "schema": BINDING_SCHEMA,
-        "owner_identity": identity,
-        "owner_role": "owner",
-        "authenticated_scope": scope,
-        "request": dict(request),
-    }
-
-
-def _status_uids(pid: int) -> tuple[int, int, int, int]:
-    try:
-        lines = Path(f"/proc/{pid}/status").read_text(encoding="utf-8").splitlines()
-    except OSError as exc:
-        raise BootstrapError("PEER_STATUS_UNAVAILABLE") from exc
-    for line in lines:
-        if line.startswith("Uid:"):
-            fields = line.split()[1:]
-            if len(fields) != 4:
-                break
-            return tuple(int(item) for item in fields)  # type: ignore[return-value]
-    raise BootstrapError("PEER_UID_STATUS_INVALID")
-
-
-def _loginuid(pid: int) -> int:
-    try:
-        raw = Path(f"/proc/{pid}/loginuid").read_text(encoding="ascii").strip()
-        value = int(raw)
-    except (OSError, ValueError) as exc:
-        raise BootstrapError("PEER_LOGINUID_UNAVAILABLE") from exc
-    if value == 4294967295:
-        raise BootstrapError("PEER_LOGIN_SESSION_REQUIRED")
-    return value
-
-
-def _tty_path(pid: int) -> Path:
-    try:
-        value = os.readlink(f"/proc/{pid}/fd/0")
-    except OSError as exc:
-        raise BootstrapError("PEER_INTERACTIVE_TTY_REQUIRED") from exc
-    if not (value.startswith("/dev/pts/") or value.startswith("/dev/tty")):
-        raise BootstrapError("PEER_INTERACTIVE_TTY_REQUIRED")
-    path = Path(value)
-    try:
-        if not stat.S_ISCHR(path.stat().st_mode):
-            raise BootstrapError("PEER_INTERACTIVE_TTY_REQUIRED")
-    except OSError as exc:
-        raise BootstrapError("PEER_INTERACTIVE_TTY_REQUIRED") from exc
-    return path
-
-
-def verify_peer_session(pid: int, uid: int, gid: int, owner_identity: str) -> dict[str, Any]:
-    try:
-        owner = pwd.getpwnam(owner_identity)
-    except KeyError as exc:
-        raise BootstrapError("OWNER_OS_ACCOUNT_MISSING") from exc
-    if uid != owner.pw_uid:
-        raise BootstrapError("PEER_OWNER_UID_MISMATCH")
-    uids = _status_uids(pid)
-    if any(item != owner.pw_uid for item in uids):
-        raise BootstrapError("PEER_UID_TRANSITION_REJECTED")
-    loginuid = _loginuid(pid)
-    if loginuid != owner.pw_uid:
-        # This deliberately rejects sudo/runuser from another authenticated
-        # account; the session itself must have logged in as the Owner.
-        raise BootstrapError("PEER_LOGINUID_OWNER_MISMATCH")
-    tty = _tty_path(pid)
-    if tty.stat().st_uid != owner.pw_uid:
-        raise BootstrapError("PEER_TTY_OWNER_MISMATCH")
-    return {
-        "pid": pid,
-        "uid": uid,
-        "gid": gid,
-        "loginuid": loginuid,
-        "tty": str(tty),
-        "owner_identity": owner_identity,
-    }
-
-
-def read_frame(connection: socket.socket) -> dict[str, Any]:
-    data = bytearray()
-    while len(data) <= MAX_FRAME:
-        block = connection.recv(4096)
-        if not block:
-            break
-        data.extend(block)
-        if b"\n" in block:
-            break
-    if not data or len(data) > MAX_FRAME:
-        raise BootstrapError("PROTOCOL_FRAME_INVALID")
-    raw = bytes(data).split(b"\n", 1)[0]
-    try:
-        value = json.loads(raw)
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise BootstrapError("PROTOCOL_JSON_INVALID") from exc
-    if not isinstance(value, dict):
-        raise BootstrapError("PROTOCOL_JSON_INVALID")
-    return value
-
-
-def write_frame(connection: socket.socket, value: Mapping[str, Any]) -> None:
-    connection.sendall(canonical_json(dict(value)))
-
-
-def safe_result(value: Mapping[str, Any]) -> dict[str, Any]:
-    for key in value:
-        lowered = str(key).lower()
-        if any(fragment in lowered for fragment in SENSITIVE_FRAGMENTS):
-            raise BootstrapError("BROKER_RESPONSE_SENSITIVE_DATA_REJECTED")
-    allowed = {
-        "status",
-        "approval_plan_id",
-        "grant_id",
-        "grant_digest_sha256",
-        "branch_oid",
-        "branch_ref_created",
-        "grant_consumed",
-        "owner_authorization_event_id",
-        "owner_authorization_reference",
-        "owner_authorization_digest_sha256",
-        "owner_authorization_consumed",
-        "owner_authorization_idempotent",
-    }
-    return {key: value.get(key) for key in sorted(allowed) if key in value}
-
-
-def request_summary(binding: Mapping[str, Any]) -> dict[str, Any]:
-    request = binding["request"]
-    return {
-        "owner_identity": binding["owner_identity"],
-        "authenticated_scope": binding["authenticated_scope"],
-        "task_id": request["task_id"],
-        "repository": request["repository"],
-        "base_ref": request["base_ref"],
-        "base_oid": request["base_oid"],
-        "target_branch": request["target_branch"],
-        "expires_in_seconds": request["expires_in_seconds"],
-        "allowed_operations": sorted(request["allowed_operations"]),
-        "denied_operations": sorted(request["denied_operations"]),
-        "production_change_authorized": False,
-        "tag_change_authorized": False,
-        "baseline_change_authorized": False,
-        "main_write_authorized": False,
-    }
-
-
-def _ensure_runtime_paths(socket_path: Path, state_root: Path, owner_identity: str) -> None:
-    if os.geteuid() != 0:
-        raise BootstrapError("SERVER_ROOT_REQUIRED")
-    owner = pwd.getpwnam(owner_identity)
-    for directory, mode, uid, gid in (
-        (socket_path.parent, 0o750, 0, owner.pw_gid),
-        (state_root, 0o700, 0, 0),
-    ):
-        if directory.is_symlink():
-            raise BootstrapError("RUNTIME_DIRECTORY_SYMLINK_REJECTED")
-        directory.mkdir(parents=True, exist_ok=True)
-        os.chown(directory, uid, gid)
-        os.chmod(directory, mode)
-    if socket_path.exists() or socket_path.is_symlink():
-        raise BootstrapError("SOCKET_ALREADY_EXISTS")
-
-
-def _lock(path: Path):
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd = os.open(path, os.O_RDWR | os.O_CREAT | getattr(os, "O_NOFOLLOW", 0), 0o600)
-    os.fchmod(fd, 0o600)
-    fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
-    return fd
-
-
-def invoke_broker(binding: Mapping[str, Any]) -> dict[str, Any]:
-    # Import only on the root server side. The bootstrap package does not carry
-    # a second broker/provisioner implementation; it reuses current main.
-    from owner_authorization_broker import (  # type: ignore
-        OwnerAuthorizationBroker,
-        OwnerAuthorizationBrokerConfig,
-        OwnerPrincipal,
-    )
-
-    config = OwnerAuthorizationBrokerConfig.from_environment()
-    identity = str(binding["owner_identity"])
-    scope = str(binding["authenticated_scope"])
-    if identity not in config.allowed_owner_identities:
-        raise BootstrapError("OWNER_IDENTITY_NOT_ALLOWED_BY_LIVE_BROKER")
-    if scope not in config.allowed_intake_scopes:
-        raise BootstrapError("OWNER_SCOPE_NOT_ALLOWED_BY_LIVE_BROKER")
-    if config.max_expiry_seconds < int(binding["request"]["expires_in_seconds"]):
-        raise BootstrapError("LIVE_BROKER_EXPIRY_TOO_SMALL")
-    principal = OwnerPrincipal(
-        identity=identity,
-        role="owner",
-        authenticated_scope=scope,
-        token_scopes=frozenset({scope}),
-        credential_id="",
-    )
-    return OwnerAuthorizationBroker(config=config).authorize_and_provision(
-        binding["request"], principal
-    )
-
-
-def serve(binding_path: Path, socket_path: Path, state_root: Path, timeout: int) -> int:
-    binding = validate_binding(secure_root_file(binding_path))
-    identity = str(binding["owner_identity"])
-    _ensure_runtime_paths(socket_path, state_root, identity)
-    lock_fd = _lock(state_root / "bootstrap.lock")
-    listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    try:
-        listener.bind(str(socket_path))
-        owner = pwd.getpwnam(identity)
-        os.chown(socket_path, 0, owner.pw_gid)
-        os.chmod(socket_path, 0o660)
-        listener.listen(1)
-        listener.settimeout(timeout)
-
-        connection, _ = listener.accept()
-        with connection:
-            raw_peer = connection.getsockopt(
-                socket.SOL_SOCKET, socket.SO_PEERCRED, struct.calcsize("3i")
-            )
-            pid, uid, gid = struct.unpack("3i", raw_peer)
-            session = verify_peer_session(pid, uid, gid, identity)
-
-            begin = read_frame(connection)
-            if begin != {"schema": CLIENT_BEGIN_SCHEMA, "action": "BEGIN"}:
-                raise BootstrapError("CLIENT_BEGIN_REJECTED")
-
-            challenge = secrets.token_hex(12)
-            challenge_issued = time.monotonic()
-            summary = request_summary(binding)
-            write_frame(
-                connection,
-                {
-                    "schema": CHALLENGE_SCHEMA,
-                    "challenge": challenge,
-                    "expires_in_seconds": CHALLENGE_TTL_SECONDS,
-                    "request_digest_sha256": sha256_json(binding["request"]),
-                    "summary": summary,
-                },
-            )
-
-            confirm = read_frame(connection)
-            expected_confirmation = f"AUTHORIZE {challenge}"
-            if (
-                confirm.get("schema") != CLIENT_CONFIRM_SCHEMA
-                or confirm.get("challenge") != challenge
-                or confirm.get("confirmation") != expected_confirmation
-            ):
-                raise BootstrapError("OWNER_INTERACTIVE_CONFIRMATION_REJECTED")
-            if time.monotonic() - challenge_issued > CHALLENGE_TTL_SECONDS:
-                raise BootstrapError("OWNER_CONFIRMATION_EXPIRED")
-
-            result = safe_result(invoke_broker(binding))
-            receipt = {
-                "schema": "aios.local-owner-auth-ingress-receipt.v1",
-                "status": "CONSUMED",
-                "owner_identity": identity,
-                "owner_role": "owner",
-                "authenticated_scope": binding["authenticated_scope"],
-                "peer": session,
-                "request_digest_sha256": sha256_json(binding["request"]),
-                "binding_digest_sha256": sha256_json(binding),
-                "challenge_digest_sha256": hashlib.sha256(
-                    challenge.encode("ascii")
-                ).hexdigest(),
-                "broker": result,
-                "completed_at_unix": int(time.time()),
-            }
-            event_id = str(
-                result.get("owner_authorization_event_id")
-                or hashlib.sha256(
-                    canonical_json(
-                        {
-                            "peer": session,
-                            "request": sha256_json(binding["request"]),
-                        }
-                    )
-                ).hexdigest()[:32]
-            )
-            atomic_json(state_root / "events" / f"{event_id}.json", receipt)
-            write_frame(
-                connection,
-                {
-                    "schema": RESULT_SCHEMA,
-                    "ok": True,
-                    "result": result,
-                },
-            )
-            return 0
-    except (BootstrapError, TimeoutError, socket.timeout) as exc:
-        code = exc.code if isinstance(exc, BootstrapError) else "OWNER_BOOTSTRAP_TIMEOUT"
-        try:
-            if "connection" in locals():
-                write_frame(
-                    connection,
-                    {
-                        "schema": RESULT_SCHEMA,
-                        "ok": False,
-                        "error": code,
-                    },
-                )
-        except Exception:
-            pass
-        atomic_json(
-            state_root / "last-failure.json",
-            {
-                "schema": "aios.local-owner-auth-ingress-failure.v1",
-                "status": "FAILED",
-                "error": code,
-                "binding_digest_sha256": sha256_json(binding),
-                "failed_at_unix": int(time.time()),
-            },
-        )
-        return 2
-    finally:
-        listener.close()
-        try:
-            socket_path.unlink()
-        except FileNotFoundError:
-            pass
-        try:
-            fcntl.flock(lock_fd, fcntl.LOCK_UN)
-        finally:
-            os.close(lock_fd)
-
-
-def client(socket_path: Path) -> int:
-    # The server performs the authoritative peer/session checks. The client
-    # also refuses non-interactive execution to make accidental automation hard.
-    if not sys.stdin.isatty() or not sys.stdout.isatty():
-        raise BootstrapError("CLIENT_INTERACTIVE_TTY_REQUIRED")
-    connection = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    connection.connect(str(socket_path))
-    with connection:
-        write_frame(connection, {"schema": CLIENT_BEGIN_SCHEMA, "action": "BEGIN"})
-        challenge = read_frame(connection)
-        if challenge.get("schema") != CHALLENGE_SCHEMA:
-            raise BootstrapError("CHALLENGE_INVALID")
-        summary = challenge.get("summary")
-        if not isinstance(summary, dict):
-            raise BootstrapError("CHALLENGE_INVALID")
-
-        print("\nAIOS one-shot Owner authorization request:")
-        print(json.dumps(summary, indent=2, sort_keys=True))
-        print("\nThis authorizes only the task writer shown above.")
-        phrase = f"AUTHORIZE {challenge['challenge']}"
-        typed = input(f"Type exactly:\n{phrase}\n> ").strip()
-        if typed != phrase:
-            raise BootstrapError("OWNER_CONFIRMATION_MISMATCH")
-        write_frame(
-            connection,
-            {
-                "schema": CLIENT_CONFIRM_SCHEMA,
-                "challenge": challenge["challenge"],
-                "confirmation": typed,
-            },
-        )
-        result = read_frame(connection)
-        print(json.dumps(result, indent=2, sort_keys=True))
-        return 0 if result.get("ok") is True else 3
-
-
-def parser() -> argparse.ArgumentParser:
-    value = argparse.ArgumentParser()
-    mode = value.add_mutually_exclusive_group(required=True)
-    mode.add_argument("--serve", action="store_true")
-    mode.add_argument("--client", action="store_true")
-    value.add_argument("--binding", type=Path)
-    value.add_argument(
-        "--socket",
-        type=Path,
-        default=Path("/run/aios-owner-bootstrap/owner.sock"),
-    )
-    value.add_argument(
-        "--state-root",
-        type=Path,
-        default=Path("/var/lib/aios-gitops/owner-local-auth-ingress"),
-    )
-    value.add_argument("--timeout", type=int, default=300)
-    return value
-
-
-def main(argv: list[str] | None = None) -> int:
-    args = parser().parse_args(argv)
-    if args.serve:
-        if args.binding is None:
-            raise SystemExit("--binding is required with --serve")
-        return serve(args.binding, args.socket, args.state_root, args.timeout)
-    return client(args.socket)
-
-
-if __name__ == "__main__":
-    try:
-        raise SystemExit(main())
-    except BootstrapError as exc:
-        print(json.dumps({"status": "BLOCKED", "error": exc.code}), file=sys.stderr)
-        raise SystemExit(exc.status)

active-runtime/app/reconciliation_controller.py

@@ -1,32 +0,0 @@
-"""Read-only release reconciliation and durable follow-up intent."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Any, Mapping
-
-
-@dataclass(frozen=True)
-class ReconciliationReport:
-    healthy: bool
-    drift: tuple[str, ...]
-    actions: tuple[str, ...]
-
-
-class ReconciliationController:
-    CHECKS = (
-        ("authority_main", "gitea_main", "main_drift"),
-        ("local_tag_oid", "remote_tag_oid", "tag_drift"),
-        ("remote_peeled_target", "approved_target_oid", "peeled_target_drift"),
-        ("registry_version", "baseline_version", "registry_baseline_drift"),
-        ("approved_artifact_digest", "deployed_artifact_digest", "artifact_drift"),
-        ("declared_production_state", "service_healthy", "service_health_drift"),
-    )
-
-    def reconcile(self, actual: Mapping[str, Any]) -> ReconciliationReport:
-        drift: list[str] = []
-        for left, right, label in self.CHECKS:
-            if actual.get(left) != actual.get(right):
-                drift.append(label)
-        actions = () if not drift else ("open_reconciliation_task", "open_reconciliation_pr", "attach_evidence", "notify_owner")
-        return ReconciliationReport(not drift, tuple(drift), actions)
-

active-runtime/app/recurring_task_scheduler.py

@@ -1,65 +0,0 @@
-"""Durable-friendly recurring task scheduling primitives."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from typing import Any
-
-
-class RecurringTaskError(ValueError):
-    pass
-
-
-@dataclass
-class RecurringTask:
-    task_id: str
-    interval_seconds: int
-    next_run_at: datetime
-    run_count: int = 0
-    max_runs: int | None = None
-    cancelled: bool = False
-
-    def due(self, now: datetime) -> bool:
-        return not self.cancelled and (self.max_runs is None or self.run_count < self.max_runs) and now >= self.next_run_at
-
-
-class RecurringTaskScheduler:
-    def __init__(self) -> None:
-        self.tasks: dict[str, RecurringTask] = {}
-        self.successors: set[str] = set()
-
-    def schedule(self, task_id: str, interval_seconds: int, *, now: datetime | None = None, max_runs: int | None = None) -> RecurringTask:
-        if task_id in self.tasks:
-            raise RecurringTaskError("task already exists")
-        if interval_seconds <= 0 or (max_runs is not None and max_runs <= 0):
-            raise RecurringTaskError("invalid recurring task bounds")
-        now = now or datetime.now(timezone.utc)
-        task = RecurringTask(task_id, interval_seconds, now, 0, max_runs, False)
-        self.tasks[task_id] = task
-        return task
-
-    def due(self, *, now: datetime | None = None) -> list[RecurringTask]:
-        now = now or datetime.now(timezone.utc)
-        return [task for task in self.tasks.values() if task.due(now)]
-
-    def mark_run(self, task_id: str, *, now: datetime | None = None) -> RecurringTask:
-        task = self.tasks[task_id]
-        now = now or datetime.now(timezone.utc)
-        if not task.due(now):
-            raise RecurringTaskError("task is not due")
-        task.run_count += 1
-        task.next_run_at = now + timedelta(seconds=task.interval_seconds)
-        return task
-
-    def cancel(self, task_id: str) -> None:
-        self.tasks[task_id].cancelled = True
-
-    def create_successor_once(self, predecessor: str, successor: str, *, interval_seconds: int, now: datetime | None = None) -> RecurringTask:
-        key = f"{predecessor}->{successor}"
-        if key in self.successors:
-            return self.tasks[successor]
-        self.successors.add(key)
-        if successor not in self.tasks:
-            return self.schedule(successor, interval_seconds, now=now)
-        return self.tasks[successor]
-

active-runtime/app/release_campaign_authorization.py

@@ -1,225 +0,0 @@
-#!/usr/bin/env python3
-"""AIOS durable autonomous release-campaign authorization.
-
-The campaign receipt represents one explicit Owner policy delegation. It is not
-a reusable Owner credential and it is not an unrestricted Git/production token.
-
-Normal release operations are allowed only when all machine gates in the
-campaign policy succeed. Formal tag conflicts, non-fast-forward main divergence,
-history rewrite, private-signing-material exposure, repository identity conflict
-or campaign revocation remain fail-closed/manual-review conditions.
-"""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import stat
-from typing import Any, Mapping
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-CAMPAIGN_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{3,127}$")
-SCHEMA = "aios.release-campaign-authorization.v1"
-
-ALLOWED_ENGINEERING = frozenset({
-    "create_task_branch",
-    "create_worktree",
-    "append_commit",
-    "push_task_branch",
-    "repair_task_branch",
-    "create_pr",
-    "update_pr",
-    "run_required_checks",
-    "publish_truthful_status",
-    "protected_merge",
-})
-ALLOWED_RECONCILIATION = frozenset({
-    "fetch_gitea_main",
-    "verify_ancestor",
-    "authority_main_ff_cas",
-    "refresh_runtime_context",
-})
-ALLOWED_RELEASE = frozenset({
-    "deterministic_build",
-    "retain_artifact",
-    "materialize_approved_artifact",
-    "staging_install",
-    "health_check",
-    "restart_test",
-    "rollback_readiness_test",
-    "create_evidence_commit",
-    "generate_exact_binding",
-    "derive_campaign_acceptance",
-})
-ALLOWED_PRODUCTION = frozenset({
-    "create_annotated_tag",
-    "publish_tag",
-    "verify_tag",
-    "deploy_exact_artifact",
-    "verify_production_health",
-    "update_runtime_registry",
-    "update_production_baseline",
-    "update_baseline_sidecar",
-})
-DENIED = frozenset({
-    "force_push",
-    "non_fast_forward_main_write",
-    "direct_main_push",
-    "published_history_rewrite",
-    "formal_tag_rewrite",
-    "formal_tag_delete",
-    "overwrite_conflicting_same_name_tag",
-    "expose_private_signing_material",
-    "commit_plaintext_secret",
-    "repository_identity_change",
-    "weaken_branch_protection",
-})
-
-
-class CampaignError(RuntimeError):
-    pass
-
-
-def canonical_json(value: Any) -> bytes:
-    return (
-        json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
-        + "\n"
-    ).encode("utf-8")
-
-
-def sha256_bytes(value: bytes) -> str:
-    return hashlib.sha256(value).hexdigest()
-
-
-def secure_json(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise CampaignError(f"invalid_file:{path}")
-    st = path.lstat()
-    if st.st_uid != 0:
-        raise CampaignError(f"root_owner_required:{path}")
-    if stat.S_IMODE(st.st_mode) & 0o022:
-        raise CampaignError(f"group_world_writable_rejected:{path}")
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise CampaignError(f"invalid_json:{path}") from exc
-    if not isinstance(value, dict):
-        raise CampaignError(f"json_object_required:{path}")
-    return value
-
-
-def _exact_set(value: Any, expected: frozenset[str], name: str) -> None:
-    if not isinstance(value, list) or frozenset(value) != expected:
-        raise CampaignError(f"{name}_mismatch")
-
-
-def validate_policy(value: Mapping[str, Any]) -> dict[str, Any]:
-    required = {
-        "schema",
-        "campaign_id",
-        "generation",
-        "owner_identity",
-        "owner_role",
-        "repository",
-        "lineage_anchor_oid",
-        "control_plane_branch",
-        "activation_state",
-        "active",
-        "revoked",
-        "valid_until_revoked",
-        "allowed_engineering",
-        "allowed_reconciliation",
-        "allowed_release",
-        "allowed_production",
-        "denied",
-        "normal_owner_interaction_required",
-    }
-    if set(value) != required:
-        raise CampaignError("campaign_fields_invalid")
-    if value["schema"] != SCHEMA:
-        raise CampaignError("campaign_schema_invalid")
-    if not isinstance(value["campaign_id"], str) or not CAMPAIGN_RE.fullmatch(value["campaign_id"]):
-        raise CampaignError("campaign_id_invalid")
-    if value["generation"] != 1:
-        raise CampaignError("campaign_generation_invalid")
-    if value["owner_identity"] != "aiman" or value["owner_role"] != "owner":
-        raise CampaignError("campaign_owner_invalid")
-    if value["repository"] != "aios/aios":
-        raise CampaignError("campaign_repository_invalid")
-    if not isinstance(value["lineage_anchor_oid"], str) or not OID_RE.fullmatch(value["lineage_anchor_oid"]):
-        raise CampaignError("campaign_anchor_invalid")
-    branch = value["control_plane_branch"]
-    if branch != "agent/autonomous-release-campaign-v1-20260807":
-        raise CampaignError("campaign_branch_invalid")
-    if value["activation_state"] not in {"PENDING_CONTROL_PLANE_MERGE", "ACTIVE"}:
-        raise CampaignError("campaign_activation_state_invalid")
-    if value["revoked"] is not False or value["valid_until_revoked"] is not True:
-        raise CampaignError("campaign_lifecycle_invalid")
-    if value["normal_owner_interaction_required"] is not False:
-        raise CampaignError("campaign_owner_interaction_policy_invalid")
-    if value["activation_state"] == "ACTIVE" and value["active"] is not True:
-        raise CampaignError("campaign_active_state_invalid")
-    if value["activation_state"] == "PENDING_CONTROL_PLANE_MERGE" and value["active"] is not False:
-        raise CampaignError("campaign_pending_state_invalid")
-    _exact_set(value["allowed_engineering"], ALLOWED_ENGINEERING, "allowed_engineering")
-    _exact_set(value["allowed_reconciliation"], ALLOWED_RECONCILIATION, "allowed_reconciliation")
-    _exact_set(value["allowed_release"], ALLOWED_RELEASE, "allowed_release")
-    _exact_set(value["allowed_production"], ALLOWED_PRODUCTION, "allowed_production")
-    _exact_set(value["denied"], DENIED, "denied")
-    return dict(value)
-
-
-@dataclass(frozen=True)
-class CampaignAuthorization:
-    path: Path
-    data: dict[str, Any]
-    digest: str
-
-    @classmethod
-    def load(
-        cls,
-        path: Path,
-        *,
-        sidecar: Path | None = None,
-        revocation: Path | None = None,
-        require_active: bool = True,
-    ) -> "CampaignAuthorization":
-        data = validate_policy(secure_json(path))
-        raw = path.read_bytes()
-        digest = sha256_bytes(raw)
-        sidecar = sidecar or path.with_suffix(path.suffix + ".sha256")
-        if not sidecar.is_file() or sidecar.is_symlink():
-            raise CampaignError("campaign_digest_sidecar_missing")
-        token = sidecar.read_text(encoding="ascii").strip().split()[0]
-        if token != digest:
-            raise CampaignError("campaign_digest_sidecar_mismatch")
-        if revocation and revocation.exists():
-            revoked = secure_json(revocation)
-            if revoked.get("campaign_id") == data["campaign_id"] and revoked.get("revoked") is True:
-                raise CampaignError("campaign_revoked")
-        if require_active and (data["activation_state"] != "ACTIVE" or data["active"] is not True):
-            raise CampaignError("campaign_not_active")
-        return cls(path=path, data=data, digest=digest)
-
-    @property
-    def campaign_id(self) -> str:
-        return str(self.data["campaign_id"])
-
-    @property
-    def anchor_oid(self) -> str:
-        return str(self.data["lineage_anchor_oid"])
-
-    def assert_operation(self, operation: str) -> None:
-        if operation in DENIED:
-            raise CampaignError(f"campaign_operation_denied:{operation}")
-        universe = (
-            ALLOWED_ENGINEERING
-            | ALLOWED_RECONCILIATION
-            | ALLOWED_RELEASE
-            | ALLOWED_PRODUCTION
-        )
-        if operation not in universe:
-            raise CampaignError(f"campaign_operation_out_of_scope:{operation}")

active-runtime/app/release_campaign_bootstrap.py

@@ -1,427 +0,0 @@
-#!/usr/bin/env python3
-"""One-interaction bootstrap for the AIOS autonomous release campaign.
-
-A single real local `aiman` login confirmation does two things atomically at the
-policy layer:
-
-1. Writes a root-owned, digest-sidecar protected campaign authorization receipt
-   in PENDING_CONTROL_PLANE_MERGE state. It grants no immediate production side
-   effect; the campaign becomes ACTIVE only after the campaign control-plane PR
-   is merged and machine activation verifies lineage and implementation.
-2. Invokes the existing OwnerAuthorizationBroker to issue only the narrow
-   engineering writer needed to implement that control-plane PR.
-
-No reusable Owner token is minted.
-"""
-from __future__ import annotations
-
-import argparse
-import fcntl
-import hashlib
-import json
-import os
-from pathlib import Path
-import secrets
-import socket
-import struct
-import tempfile
-import time
-from typing import Any, Mapping
-
-from owner_local_auth_ingress import (
-    BootstrapError,
-    canonical_json,
-    read_frame,
-    verify_peer_session,
-    write_frame,
-)
-from release_campaign_authorization import (
-    ALLOWED_ENGINEERING,
-    ALLOWED_PRODUCTION,
-    ALLOWED_RECONCILIATION,
-    ALLOWED_RELEASE,
-    DENIED,
-    SCHEMA,
-    validate_policy,
-)
-
-BEGIN = "aios.release-campaign-bootstrap.begin.v1"
-CHALLENGE = "aios.release-campaign-bootstrap.challenge.v1"
-CONFIRM = "aios.release-campaign-bootstrap.confirm.v1"
-RESULT = "aios.release-campaign-bootstrap.result.v1"
-
-TASK_ID = "AIOS_AUTONOMOUS_RELEASE_CAMPAIGN_V1"
-TARGET_BRANCH = "agent/autonomous-release-campaign-v1-20260807"
-REPOSITORY = "aios/aios"
-
-
-class CampaignBootstrapError(RuntimeError):
-    pass
-
-
-def sha256_file(path: Path) -> str:
-    h = hashlib.sha256()
-    with path.open("rb") as stream:
-        for block in iter(lambda: stream.read(1024 * 1024), b""):
-            h.update(block)
-    return h.hexdigest()
-
-
-def atomic_json_new(path: Path, value: Mapping[str, Any]) -> None:
-    if path.exists() or path.is_symlink():
-        raise CampaignBootstrapError(f"target_exists:{path}")
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
-    try:
-        os.fchmod(fd, 0o600)
-        if os.geteuid() == 0:
-            os.fchown(fd, 0, 0)
-        with os.fdopen(fd, "wb", closefd=True) as stream:
-            stream.write(canonical_json(dict(value)))
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(name, path)
-        os.chmod(path, 0o600)
-        dfd = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
-        try:
-            os.fsync(dfd)
-        finally:
-            os.close(dfd)
-    finally:
-        try:
-            os.unlink(name)
-        except FileNotFoundError:
-            pass
-
-
-def atomic_sidecar(path: Path, digest: str, target_name: str) -> None:
-    if path.exists() or path.is_symlink():
-        raise CampaignBootstrapError(f"sidecar_exists:{path}")
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
-    try:
-        os.fchmod(fd, 0o600)
-        if os.geteuid() == 0:
-            os.fchown(fd, 0, 0)
-        with os.fdopen(fd, "w", encoding="ascii", closefd=True) as stream:
-            stream.write(f"{digest}  {target_name}\n")
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(name, path)
-        os.chmod(path, 0o600)
-        dfd = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
-        try:
-            os.fsync(dfd)
-        finally:
-            os.close(dfd)
-    finally:
-        try:
-            os.unlink(name)
-        except FileNotFoundError:
-            pass
-
-
-def writer_request(base_oid: str) -> dict[str, Any]:
-    return {
-        "action": "AUTHORIZE_TASK_WRITER_PROVISIONING",
-        "task_id": TASK_ID,
-        "repository": REPOSITORY,
-        "base_ref": "refs/heads/main",
-        "base_oid": base_oid,
-        "target_branch": TARGET_BRANCH,
-        "one_time_use": True,
-        "expires_in_seconds": 300,
-        "production_change_authorized": False,
-        "tag_change_authorized": False,
-        "baseline_change_authorized": False,
-        "main_write_authorized": False,
-        "allowed_operations": [
-            "create_worktree",
-            "create_target_branch_if_absent",
-            "commit_to_target_branch",
-            "push_target_branch",
-        ],
-        "denied_operations": [
-            "direct_main_push",
-            "force_push",
-            "tag_create",
-            "tag_update",
-            "tag_delete",
-            "branch_delete",
-            "repository_admin",
-            "baseline_write",
-            "production_deploy",
-            "production_marker_write",
-            "history_rewrite",
-        ],
-    }
-
-
-def campaign_policy(campaign_id: str, base_oid: str) -> dict[str, Any]:
-    value = {
-        "schema": SCHEMA,
-        "campaign_id": campaign_id,
-        "generation": 1,
-        "owner_identity": "aiman",
-        "owner_role": "owner",
-        "repository": REPOSITORY,
-        "lineage_anchor_oid": base_oid,
-        "control_plane_branch": TARGET_BRANCH,
-        "activation_state": "PENDING_CONTROL_PLANE_MERGE",
-        "active": False,
-        "revoked": False,
-        "valid_until_revoked": True,
-        "allowed_engineering": sorted(ALLOWED_ENGINEERING),
-        "allowed_reconciliation": sorted(ALLOWED_RECONCILIATION),
-        "allowed_release": sorted(ALLOWED_RELEASE),
-        "allowed_production": sorted(ALLOWED_PRODUCTION),
-        "denied": sorted(DENIED),
-        "normal_owner_interaction_required": False,
-    }
-    return validate_policy(value)
-
-
-def invoke_writer_broker(base_oid: str) -> dict[str, Any]:
-    from owner_authorization_broker import (
-        OwnerAuthorizationBroker,
-        OwnerAuthorizationBrokerConfig,
-        OwnerPrincipal,
-    )
-
-    config = OwnerAuthorizationBrokerConfig.from_environment()
-    if "aiman" not in config.allowed_owner_identities:
-        raise CampaignBootstrapError("aiman_not_allowed_by_live_broker")
-    if "commit:create" not in config.allowed_intake_scopes:
-        raise CampaignBootstrapError("commit_create_not_allowed_by_live_broker")
-    principal = OwnerPrincipal(
-        identity="aiman",
-        role="owner",
-        authenticated_scope="commit:create",
-        token_scopes=frozenset({"commit:create"}),
-        credential_id="",
-    )
-    return OwnerAuthorizationBroker(config=config).authorize_and_provision(
-        writer_request(base_oid),
-        principal,
-    )
-
-
-def safe_broker_result(value: Mapping[str, Any]) -> dict[str, Any]:
-    allowed = {
-        "status",
-        "approval_plan_id",
-        "grant_id",
-        "grant_digest_sha256",
-        "branch_oid",
-        "branch_ref_created",
-        "grant_consumed",
-        "owner_authorization_event_id",
-        "owner_authorization_reference",
-        "owner_authorization_digest_sha256",
-        "owner_authorization_consumed",
-        "owner_authorization_idempotent",
-    }
-    lowered = " ".join(str(k).lower() for k in value)
-    for secret_word in ("token", "password", "private_key", "secret_value", "bearer"):
-        if secret_word in lowered:
-            raise CampaignBootstrapError("broker_response_sensitive_field_rejected")
-    return {k: value[k] for k in sorted(allowed) if k in value}
-
-
-def serve(
-    *,
-    socket_path: Path,
-    state_root: Path,
-    base_oid: str,
-    campaign_id: str,
-    timeout: int,
-) -> int:
-    if os.geteuid() != 0:
-        raise CampaignBootstrapError("server_root_required")
-    if len(base_oid) != 40 or any(c not in "0123456789abcdef" for c in base_oid):
-        raise CampaignBootstrapError("base_oid_invalid")
-
-    policy = campaign_policy(campaign_id, base_oid)
-    campaign_dir = state_root / campaign_id
-    campaign_path = campaign_dir / "authorization.json"
-    sidecar_path = campaign_dir / "authorization.json.sha256"
-
-    socket_path.parent.mkdir(parents=True, exist_ok=True)
-    if socket_path.exists() or socket_path.is_symlink():
-        raise CampaignBootstrapError("socket_already_exists")
-
-    import pwd
-    owner = pwd.getpwnam("aiman")
-    os.chown(socket_path.parent, 0, owner.pw_gid)
-    os.chmod(socket_path.parent, 0o750)
-
-    listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    try:
-        listener.bind(str(socket_path))
-        os.chown(socket_path, 0, owner.pw_gid)
-        os.chmod(socket_path, 0o660)
-        listener.listen(1)
-        listener.settimeout(timeout)
-
-        conn, _ = listener.accept()
-        with conn:
-            raw = conn.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, struct.calcsize("3i"))
-            pid, uid, gid = struct.unpack("3i", raw)
-            peer = verify_peer_session(pid, uid, gid, "aiman")
-            if read_frame(conn) != {"schema": BEGIN, "action": "BEGIN"}:
-                raise CampaignBootstrapError("client_begin_invalid")
-
-            challenge = secrets.token_hex(12)
-            issued = time.monotonic()
-            summary = {
-                "campaign_id": campaign_id,
-                "repository": REPOSITORY,
-                "lineage_anchor_oid": base_oid,
-                "control_plane_branch": TARGET_BRANCH,
-                "normal_owner_interaction_after_activation": False,
-                "allowed_engineering": sorted(ALLOWED_ENGINEERING),
-                "allowed_reconciliation": sorted(ALLOWED_RECONCILIATION),
-                "allowed_release": sorted(ALLOWED_RELEASE),
-                "allowed_production": sorted(ALLOWED_PRODUCTION),
-                "denied": sorted(DENIED),
-                "writer_request": writer_request(base_oid),
-            }
-            write_frame(
-                conn,
-                {
-                    "schema": CHALLENGE,
-                    "challenge": challenge,
-                    "expires_in_seconds": 120,
-                    "summary": summary,
-                },
-            )
-            confirm = read_frame(conn)
-            phrase = f"AUTHORIZE CAMPAIGN {campaign_id} {challenge}"
-            if (
-                confirm.get("schema") != CONFIRM
-                or confirm.get("challenge") != challenge
-                or confirm.get("confirmation") != phrase
-            ):
-                raise CampaignBootstrapError("campaign_confirmation_invalid")
-            if time.monotonic() - issued > 120:
-                raise CampaignBootstrapError("campaign_confirmation_expired")
-
-            # First issue the narrow engineering writer. If this fails, do not
-            # persist a campaign authorization that cannot be implemented.
-            broker = safe_broker_result(invoke_writer_broker(base_oid))
-            if broker.get("status") != "READY_FOR_CODE_AUTHORING":
-                raise CampaignBootstrapError("writer_not_ready")
-
-            atomic_json_new(campaign_path, policy)
-            digest = sha256_file(campaign_path)
-            atomic_sidecar(sidecar_path, digest, campaign_path.name)
-
-            receipt = {
-                "schema": "aios.release-campaign-bootstrap-receipt.v1",
-                "status": "CAMPAIGN_PENDING_CONTROL_PLANE_MERGE",
-                "campaign_id": campaign_id,
-                "campaign_authorization_path": str(campaign_path),
-                "campaign_authorization_sha256": digest,
-                "owner_identity": "aiman",
-                "owner_role": "owner",
-                "authentication": {
-                    "method": "local_so_peercred_loginuid_tty",
-                    "uid": peer["uid"],
-                    "loginuid": peer["loginuid"],
-                    "tty": peer["tty"],
-                },
-                "writer": broker,
-                "reusable_owner_token_created": False,
-                "production_side_effect_executed": False,
-                "completed_at_unix": int(time.time()),
-            }
-            receipt_path = campaign_dir / "bootstrap-receipt.json"
-            atomic_json_new(receipt_path, receipt)
-            write_frame(
-                conn,
-                {
-                    "schema": RESULT,
-                    "ok": True,
-                    "campaign_id": campaign_id,
-                    "campaign_authorization_path": str(campaign_path),
-                    "campaign_authorization_sha256": digest,
-                    "writer": broker,
-                },
-            )
-            return 0
-    finally:
-        listener.close()
-        try:
-            socket_path.unlink()
-        except FileNotFoundError:
-            pass
-
-
-def client(socket_path: Path) -> int:
-    import sys
-    if not sys.stdin.isatty() or not sys.stdout.isatty():
-        raise CampaignBootstrapError("interactive_tty_required")
-    conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    conn.connect(str(socket_path))
-    with conn:
-        write_frame(conn, {"schema": BEGIN, "action": "BEGIN"})
-        challenge = read_frame(conn)
-        if challenge.get("schema") != CHALLENGE:
-            raise CampaignBootstrapError("challenge_invalid")
-        print("\nAIOS Autonomous Release Campaign authorization")
-        print(json.dumps(challenge["summary"], indent=2, sort_keys=True))
-        phrase = (
-            f"AUTHORIZE CAMPAIGN "
-            f"{challenge['summary']['campaign_id']} "
-            f"{challenge['challenge']}"
-        )
-        typed = input(f"\nType exactly:\n{phrase}\n> ").strip()
-        if typed != phrase:
-            raise CampaignBootstrapError("confirmation_mismatch")
-        write_frame(
-            conn,
-            {
-                "schema": CONFIRM,
-                "challenge": challenge["challenge"],
-                "confirmation": typed,
-            },
-        )
-        result = read_frame(conn)
-        print(json.dumps(result, indent=2, sort_keys=True))
-        return 0 if result.get("ok") is True else 3
-
-
-def main() -> int:
-    p = argparse.ArgumentParser()
-    mode = p.add_mutually_exclusive_group(required=True)
-    mode.add_argument("--serve", action="store_true")
-    mode.add_argument("--client", action="store_true")
-    p.add_argument("--socket", type=Path, default=Path("/run/aios-release-campaign/owner.sock"))
-    p.add_argument(
-        "--state-root",
-        type=Path,
-        default=Path("/var/lib/aios-gitops/release-campaigns"),
-    )
-    p.add_argument("--base-oid")
-    p.add_argument("--campaign-id")
-    p.add_argument("--timeout", type=int, default=300)
-    a = p.parse_args()
-    if a.serve:
-        if not a.base_oid or not a.campaign_id:
-            raise CampaignBootstrapError("server_binding_required")
-        return serve(
-            socket_path=a.socket,
-            state_root=a.state_root,
-            base_oid=a.base_oid,
-            campaign_id=a.campaign_id,
-            timeout=a.timeout,
-        )
-    return client(a.socket)
-
-
-if __name__ == "__main__":
-    try:
-        raise SystemExit(main())
-    except (CampaignBootstrapError, BootstrapError) as exc:
-        print(json.dumps({"status": "BLOCKED", "reason": str(exc)}, sort_keys=True))
-        raise SystemExit(2)

active-runtime/app/release_campaign_orchestrator.py

@@ -1,113 +0,0 @@
-#!/usr/bin/env python3
-"""Durable state model for the AIOS autonomous release campaign."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import json
-import os
-from pathlib import Path
-import tempfile
-from typing import Any
-
-STATES = (
-    "DEVELOPMENT",
-    "VALIDATING",
-    "PR_READY",
-    "MERGING",
-    "MAIN_RECONCILING",
-    "POSTMERGE_BUILDING",
-    "STAGING",
-    "EVIDENCE_CLOSING",
-    "BINDING_ACCEPTING",
-    "TAGGING",
-    "DEPLOYING",
-    "VERIFYING",
-    "REGISTRY_FINALIZING",
-    "BASELINE_FINALIZING",
-    "PRODUCTION_DEPLOYED",
-)
-RECOVERABLE = "RECOVERABLE_FAILURE"
-RECONCILIATION = "RECONCILIATION_REQUIRED"
-MANUAL = "MANUAL_OWNER_REVIEW_REQUIRED"
-
-NEXT = {STATES[i]: STATES[i + 1] for i in range(len(STATES) - 1)}
-
-MANUAL_REASONS = frozenset({
-    "formal_same_name_tag_conflict",
-    "force_push_required",
-    "published_history_rewrite_required",
-    "non_fast_forward_main_divergence",
-    "private_signing_material_exposure_required",
-    "repository_identity_conflict",
-    "campaign_revoked",
-    "operation_outside_campaign_scope",
-})
-
-
-class OrchestratorError(RuntimeError):
-    pass
-
-
-@dataclass
-class ReleaseState:
-    version: str
-    state: str = "DEVELOPMENT"
-    last_stable_state: str = "DEVELOPMENT"
-    recoverable_reason: str | None = None
-
-    def advance(self) -> None:
-        if self.state not in NEXT:
-            raise OrchestratorError(f"cannot_advance:{self.state}")
-        self.last_stable_state = self.state
-        self.state = NEXT[self.state]
-        self.recoverable_reason = None
-
-    def recoverable_failure(self, reason: str) -> None:
-        self.last_stable_state = self.state
-        self.state = RECOVERABLE
-        self.recoverable_reason = reason
-
-    def reconciliation_required(self, reason: str) -> None:
-        self.last_stable_state = self.state
-        self.state = RECONCILIATION
-        self.recoverable_reason = reason
-
-    def manual_review(self, reason: str) -> None:
-        if reason not in MANUAL_REASONS:
-            raise OrchestratorError("reason_not_manual_red_line")
-        self.last_stable_state = self.state
-        self.state = MANUAL
-        self.recoverable_reason = reason
-
-    def resume(self) -> None:
-        if self.state not in {RECOVERABLE, RECONCILIATION}:
-            raise OrchestratorError("state_not_resumable")
-        self.state = self.last_stable_state
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "schema": "aios.autonomous-release-state.v1",
-            "version": self.version,
-            "state": self.state,
-            "last_stable_state": self.last_stable_state,
-            "recoverable_reason": self.recoverable_reason,
-            "owner_interaction_required": self.state == MANUAL,
-        }
-
-
-def atomic_state(path: Path, state: ReleaseState) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
-    try:
-        os.fchmod(fd, 0o600)
-        with os.fdopen(fd, "w", encoding="utf-8", closefd=True) as stream:
-            json.dump(state.as_dict(), stream, sort_keys=True, indent=2)
-            stream.write("\n")
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(name, path)
-    finally:
-        try:
-            os.unlink(name)
-        except FileNotFoundError:
-            pass

active-runtime/app/release_metadata_adapter.py

@@ -1,414 +0,0 @@
-#!/usr/bin/env python3
-"""Atomic Registry/Baseline finalizer for an already ACTIVE exact release.
-
-This adapter never writes Git refs. It is intended for the AIOS runtime
-Registry and authoritative runtime-anchor Baseline only.
-
-Registry is finalized before Baseline. Baseline apply independently verifies:
-- exact Authority annotated tag and peeled target
-- exact ACTIVE production health
-- exact V2R1C7 Registry record
-- exact previous Baseline file SHA-256 (CAS)
-"""
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-import os
-import re
-import stat
-import subprocess
-import sys
-import tempfile
-import time
-import urllib.error
-import urllib.request
-from pathlib import Path
-from typing import Any, Mapping
-
-from release_version import validate_release_version
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA_RE = re.compile(r"^[0-9a-f]{64}$")
-PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
-
-
-def sha256_file(path: Path) -> str:
-    digest = hashlib.sha256()
-    with path.open("rb") as source:
-        for block in iter(lambda: source.read(1024 * 1024), b""):
-            digest.update(block)
-    return digest.hexdigest()
-
-
-def atomic_json(path: Path, value: Mapping[str, Any], mode: int = 0o640) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    # Existing runtime-authority files may be root:gitops and read-only to
-    # non-root readers. Preserve their owner/group/mode across os.replace().
-    if path.exists():
-        metadata = path.lstat()
-        if not stat.S_ISREG(metadata.st_mode) or path.is_symlink():
-            raise RuntimeError("ATOMIC_TARGET_NOT_REGULAR")
-        target_mode = stat.S_IMODE(metadata.st_mode)
-        target_uid = metadata.st_uid
-        target_gid = metadata.st_gid
-    else:
-        parent = path.parent.stat()
-        target_mode = mode
-        target_uid = 0 if os.geteuid() == 0 else os.geteuid()
-        target_gid = parent.st_gid
-
-    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=str(path.parent))
-    try:
-        with os.fdopen(fd, "w", encoding="utf-8") as output:
-            json.dump(dict(value), output, sort_keys=True, indent=2)
-            output.write("\n")
-            output.flush()
-            os.fsync(output.fileno())
-        os.chmod(name, target_mode)
-        if os.geteuid() == 0:
-            os.chown(name, target_uid, target_gid)
-        os.replace(name, path)
-        dfd = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
-        try:
-            os.fsync(dfd)
-        finally:
-            os.close(dfd)
-    finally:
-        try:
-            os.unlink(name)
-        except FileNotFoundError:
-            pass
-
-
-def load_request() -> dict[str, Any]:
-    value = json.load(sys.stdin)
-    if not isinstance(value, dict) or value.get("schema") != "aios.production-executor-request.v1":
-        raise ValueError("request_schema_invalid")
-    if value.get("repository_identity") != "aios/aios":
-        raise ValueError("repository_identity_invalid")
-    try:
-        validate_release_version(value.get("version", ""))
-    except ValueError as exc:
-        raise ValueError("version_invalid") from exc
-    for name in ("target_oid", "evidence_closure_oid"):
-        if not OID_RE.fullmatch(str(value.get(name, ""))):
-            raise ValueError(f"{name}_invalid")
-    if not SHA_RE.fullmatch(str(value.get("artifact_sha256", ""))):
-        raise ValueError("artifact_sha256_invalid")
-    if not PLAN_RE.fullmatch(str(value.get("approval_plan_id", ""))):
-        raise ValueError("approval_plan_id_invalid")
-    if "tag_oid" in value and not OID_RE.fullmatch(str(value["tag_oid"])):
-        raise ValueError("tag_oid_invalid")
-    return value
-
-
-def exact_response(value: Mapping[str, Any], status: str, **extra: Any) -> dict[str, Any]:
-    return {
-        "status": status,
-        "version": value["version"],
-        "target_oid": value["target_oid"],
-        "evidence_closure_oid": value["evidence_closure_oid"],
-        "artifact_sha256": value["artifact_sha256"],
-        "approval_plan_id": value["approval_plan_id"],
-        **extra,
-    }
-
-
-def git(repository: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        ["git", f"--git-dir={repository}", *args],
-        check=check,
-        capture_output=True,
-        text=True,
-        timeout=30,
-        env={"PATH": os.environ.get("PATH", "")},
-    )
-
-
-def verify_local_tag(repository: Path, value: Mapping[str, Any]) -> tuple[str, str]:
-    tag_oid = git(repository, "rev-parse", "--verify", f"refs/tags/{value['version']}").stdout.strip()
-    peeled = git(repository, "rev-parse", "--verify", f"refs/tags/{value['version']}^{{commit}}").stdout.strip()
-    if tag_oid == peeled or peeled != value["target_oid"]:
-        raise RuntimeError("FORMAL_TAG_BINDING_MISMATCH")
-    requested = value.get("tag_oid")
-    if requested and requested != tag_oid:
-        raise RuntimeError("FORMAL_TAG_OBJECT_MISMATCH")
-    return tag_oid, peeled
-
-
-def health(url: str, value: Mapping[str, Any]) -> dict[str, Any]:
-    try:
-        with urllib.request.urlopen(url, timeout=5) as response:
-            body = json.loads(response.read().decode("utf-8"))
-            status = response.status
-    except (urllib.error.URLError, TimeoutError, ValueError) as exc:
-        raise RuntimeError("PRODUCTION_HEALTH_UNAVAILABLE") from exc
-    if not (
-        status == 200
-        and body.get("version") == value["version"]
-        and body.get("commit_oid") == value["target_oid"]
-        and body.get("artifact_sha256") == value["artifact_sha256"]
-        and body.get("deployment_state") == "ACTIVE"
-        and body.get("production_deployed") is True
-    ):
-        raise RuntimeError("PRODUCTION_HEALTH_BINDING_MISMATCH")
-    return body
-
-
-def registry_record(value: Mapping[str, Any], tag_oid: str, production_health: Mapping[str, Any]) -> dict[str, Any]:
-    return {
-        "schema": "aios.production-registry.v2",
-        "version": value["version"],
-        "repository": "aios/aios",
-        "target_oid": value["target_oid"],
-        "tag": value["version"],
-        "tag_oid": tag_oid,
-        "tag_object": tag_oid,
-        "peeled_target_oid": value["target_oid"],
-        "evidence_closure_oid": value["evidence_closure_oid"],
-        "artifact_sha256": value["artifact_sha256"],
-        "approval_plan_id": value["approval_plan_id"],
-        "production_service": value["production_service"],
-        "production_port": value["production_port"],
-        "registered": True,
-        "enabled": True,
-        "production_deployed": True,
-        "status": "PRODUCTION_DEPLOYED",
-        "deployment_state": production_health["deployment_state"],
-        "updated_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-    }
-
-
-def registry_matches(record: Mapping[str, Any], value: Mapping[str, Any], tag_oid: str) -> bool:
-    return all(
-        record.get(key) == expected
-        for key, expected in {
-            "version": value["version"],
-            "target_oid": value["target_oid"],
-            "tag_oid": tag_oid,
-            "evidence_closure_oid": value["evidence_closure_oid"],
-            "artifact_sha256": value["artifact_sha256"],
-            "approval_plan_id": value["approval_plan_id"],
-            "production_service": value["production_service"],
-            "production_port": value["production_port"],
-            "production_deployed": True,
-        }.items()
-    ) and record.get("registered") is True and record.get("enabled") is True
-
-
-def baseline_matches(record: Mapping[str, Any], value: Mapping[str, Any], tag_oid: str) -> bool:
-    current = record.get("current_baseline") or record.get("version")
-    return current == value["version"] and all(
-        record.get(key) == expected
-        for key, expected in {
-            "target_oid": value["target_oid"],
-            "tag_oid": tag_oid,
-            "evidence_closure_oid": value["evidence_closure_oid"],
-            "artifact_sha256": value["artifact_sha256"],
-            "approval_plan_id": value["approval_plan_id"],
-            "production_service": value["production_service"],
-            "production_port": value["production_port"],
-            "status": "PRODUCTION_DEPLOYED",
-        }.items()
-    )
-
-
-def registry_probe(args: argparse.Namespace, value: Mapping[str, Any]) -> dict[str, Any]:
-    tag_oid, _ = verify_local_tag(args.repository, value)
-    path = args.registry_root / f"{value['version']}.json"
-    if not path.exists():
-        return exact_response(value, "NOT_APPLIED", tag_oid=tag_oid)
-    record = json.loads(path.read_text(encoding="utf-8"))
-    if registry_matches(record, value, tag_oid):
-        return exact_response(
-            value,
-            "VERIFIED",
-            tag_oid=tag_oid,
-            registry_path=str(path),
-            registry_sha256=sha256_file(path),
-        )
-    return exact_response(value, "CONFLICT", tag_oid=tag_oid, reason="registry_binding_mismatch")
-
-
-def registry_apply(args: argparse.Namespace, value: Mapping[str, Any]) -> dict[str, Any]:
-    existing = registry_probe(args, value)
-    if existing["status"] in {"VERIFIED", "CONFLICT"}:
-        return existing
-    tag_oid, _ = verify_local_tag(args.repository, value)
-    production_health = health(args.health_url, value)
-    path = args.registry_root / f"{value['version']}.json"
-    atomic_json(path, registry_record(value, tag_oid, production_health))
-    return registry_probe(args, value)
-
-
-def secure_baseline_authority_file(path: Path) -> None:
-    if not path.is_file() or path.is_symlink():
-        raise RuntimeError("BASELINE_AUTHORITY_FILE_INVALID")
-    baseline_stat = path.lstat()
-    if baseline_stat.st_uid != 0 or baseline_stat.st_mode & 0o022:
-        raise RuntimeError("BASELINE_AUTHORITY_PERMISSIONS_INVALID")
-
-
-def baseline_probe(args: argparse.Namespace, value: Mapping[str, Any]) -> dict[str, Any]:
-    tag_oid, _ = verify_local_tag(args.repository, value)
-    secure_baseline_authority_file(args.baseline_path)
-    record = json.loads(args.baseline_path.read_text(encoding="utf-8"))
-    if baseline_matches(record, value, tag_oid):
-        return exact_response(
-            value,
-            "VERIFIED",
-            tag_oid=tag_oid,
-            baseline_path=str(args.baseline_path),
-            baseline_sha256=sha256_file(args.baseline_path),
-        )
-    current = record.get("current_baseline") or record.get("version")
-    current_sha = sha256_file(args.baseline_path)
-    if (
-        current == args.expected_previous_baseline
-        and current_sha == args.expected_previous_baseline_sha256
-    ):
-        return exact_response(
-            value,
-            "NOT_APPLIED",
-            tag_oid=tag_oid,
-            previous_baseline=current,
-            previous_baseline_sha256=current_sha,
-        )
-    return exact_response(
-        value,
-        "CONFLICT",
-        tag_oid=tag_oid,
-        reason="baseline_precondition_or_binding_mismatch",
-        observed_baseline=current,
-        observed_sha256=current_sha,
-    )
-
-
-def baseline_apply(args: argparse.Namespace, value: Mapping[str, Any]) -> dict[str, Any]:
-    existing = baseline_probe(args, value)
-    if existing["status"] in {"VERIFIED", "CONFLICT"}:
-        return existing
-
-    tag_oid, _ = verify_local_tag(args.repository, value)
-    production_health = health(args.health_url, value)
-
-    registry_path = args.registry_root / f"{value['version']}.json"
-    if not registry_path.is_file():
-        raise RuntimeError("REGISTRY_NOT_FINALIZED")
-    registry = json.loads(registry_path.read_text(encoding="utf-8"))
-    if not registry_matches(registry, value, tag_oid):
-        raise RuntimeError("REGISTRY_BINDING_NOT_VERIFIED")
-
-    previous = json.loads(args.baseline_path.read_text(encoding="utf-8"))
-    if sha256_file(args.baseline_path) != args.expected_previous_baseline_sha256:
-        raise RuntimeError("BASELINE_CAS_MISMATCH")
-
-    generation = max(
-        int(previous.get("generation", 0) or 0),
-        int(previous.get("authority_generation", 0) or 0),
-    ) + 1
-    record = {
-        "schema": "aios.production-baseline.v2",
-        "source_identity": "aios-gitops-runtime-anchor-baseline-authority-v1",
-        "current_baseline": value["version"],
-        "version": value["version"],
-        "previous_baseline": args.expected_previous_baseline,
-        "previous_version": args.expected_previous_baseline,
-        "status": "PRODUCTION_DEPLOYED",
-        "target_oid": value["target_oid"],
-        "peeled_target_oid": value["target_oid"],
-        "tag_oid": tag_oid,
-        "evidence_closure_oid": value["evidence_closure_oid"],
-        "approval_plan_id": value["approval_plan_id"],
-        "artifact_sha256": value["artifact_sha256"],
-        "production_artifact_sha256": value["artifact_sha256"],
-        "production_service": value["production_service"],
-        "production_port": value["production_port"],
-        "production_deployed": True,
-        "deployment_state": production_health["deployment_state"],
-        "registry_digest": sha256_file(registry_path),
-        "registry_source": str(registry_path),
-        "generation": generation,
-        "authority_generation": generation,
-        # The actual previously deployed production baseline is the rollback
-        # target. V2R1C6 has a formal tag but was never production-deployed.
-        "rollback_version": args.expected_previous_baseline,
-        "rollback_tag_oid": previous.get("tag_oid"),
-        "rollback_target_oid": previous.get("target_oid"),
-        "promoted_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-        "promoted_by": "aios-approved-production-release-executor",
-    }
-    atomic_json(args.baseline_path, record)
-    return baseline_probe(args, value)
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument(
-        "--mode",
-        choices=("registry", "baseline"),
-        default=os.environ.get("AIOS_RELEASE_METADATA_MODE"),
-        required=os.environ.get("AIOS_RELEASE_METADATA_MODE") is None,
-    )
-    parser.add_argument(
-        "--repository",
-        type=Path,
-        default=Path(os.environ["AIOS_GITOPS_AUTHORITATIVE_GIT_DIR"]),
-    )
-    parser.add_argument(
-        "--registry-root",
-        type=Path,
-        default=Path(os.environ["AIOS_RUNTIME_REGISTRY_ROOT"]),
-    )
-    parser.add_argument(
-        "--baseline-path",
-        type=Path,
-        default=Path(os.environ["AIOS_RUNTIME_BASELINE_PATH"]),
-    )
-    parser.add_argument(
-        "--expected-previous-baseline",
-        default=os.environ.get("AIOS_PREVIOUS_BASELINE", "V2R1C5"),
-    )
-    parser.add_argument(
-        "--expected-previous-baseline-sha256",
-        default=os.environ.get("AIOS_PREVIOUS_BASELINE_SHA256"),
-        required=os.environ.get("AIOS_PREVIOUS_BASELINE_SHA256") is None,
-    )
-    parser.add_argument(
-        "--health-url",
-        default=os.environ.get("AIOS_RELEASE_HEALTH_URL", "http://127.0.0.1:18927/health"),
-    )
-    args = parser.parse_args()
-    value = load_request()
-    operation = value.get("operation")
-    if args.mode == "registry":
-        if operation == "probe":
-            result = registry_probe(args, value)
-        elif operation == "apply":
-            result = registry_apply(args, value)
-        else:
-            raise ValueError("unsupported_operation")
-    else:
-        if operation == "probe":
-            result = baseline_probe(args, value)
-        elif operation == "apply":
-            result = baseline_apply(args, value)
-        else:
-            raise ValueError("unsupported_operation")
-    print(json.dumps(result, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    try:
-        raise SystemExit(main())
-    except Exception as exc:
-        print(
-            json.dumps(
-                {"status": "FAIL_CLOSED", "error": type(exc).__name__, "reason": str(exc)},
-                sort_keys=True,
-            )
-        )
-        raise SystemExit(2)

active-runtime/app/release_state_machine.py

@@ -1,53 +0,0 @@
-"""Release state machine with explicit fail-closed production gates."""
-from __future__ import annotations
-
-from enum import Enum
-from typing import Mapping
-
-
-class InvalidTransition(RuntimeError):
-    pass
-
-
-class ReleaseState(str, Enum):
-    SOURCE_READY = "SOURCE_READY"
-    TESTED = "TESTED"
-    PR_OPEN = "PR_OPEN"
-    PR_APPROVED = "PR_APPROVED"
-    MERGED = "MERGED"
-    ARTIFACT_VERIFIED = "ARTIFACT_VERIFIED"
-    RELEASE_APPROVED = "RELEASE_APPROVED"
-    TAG_VERIFIED = "TAG_VERIFIED"
-    DEPLOYED = "DEPLOYED"
-    PRODUCTION_ACCEPTED = "PRODUCTION_ACCEPTED"
-
-
-TRANSITIONS = {
-    ReleaseState.SOURCE_READY: (ReleaseState.TESTED,),
-    ReleaseState.TESTED: (ReleaseState.PR_OPEN,),
-    ReleaseState.PR_OPEN: (ReleaseState.PR_APPROVED,),
-    ReleaseState.PR_APPROVED: (ReleaseState.MERGED,),
-    ReleaseState.MERGED: (ReleaseState.ARTIFACT_VERIFIED,),
-    ReleaseState.ARTIFACT_VERIFIED: (ReleaseState.RELEASE_APPROVED,),
-    ReleaseState.RELEASE_APPROVED: (ReleaseState.TAG_VERIFIED,),
-    ReleaseState.TAG_VERIFIED: (ReleaseState.DEPLOYED,),
-    ReleaseState.DEPLOYED: (ReleaseState.PRODUCTION_ACCEPTED,),
-}
-
-
-class ReleaseStateMachine:
-    def __init__(self, state: ReleaseState = ReleaseState.SOURCE_READY) -> None:
-        self.state = state
-
-    def transition(self, target: ReleaseState, evidence: Mapping[str, object] | None = None) -> ReleaseState:
-        if target not in TRANSITIONS.get(self.state, ()):
-            raise InvalidTransition(f"{self.state.value}_to_{target.value}_denied")
-        evidence = evidence or {}
-        if target is ReleaseState.PRODUCTION_ACCEPTED:
-            if evidence.get("tag_verified") is not True or evidence.get("remote_tag_readback") is not True or evidence.get("service_health") is not True:
-                raise InvalidTransition("production_acceptance_evidence_incomplete")
-        if target is ReleaseState.DEPLOYED and evidence.get("artifact_verified") is not True:
-            raise InvalidTransition("deployment_artifact_not_verified")
-        self.state = target
-        return self.state
-

active-runtime/app/signer_contract_compatibility.py

@@ -1,520 +0,0 @@
-"""Compatibility adapter for the deployed signer and validator contracts.
-
-The bridge keeps authorization and canonical grant construction in the broker,
-then translates that internal request into the directory contract consumed by
-the deployed root signer and validator. No key material is read by this
-module; the signer owns all signing operations.
-"""
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import re
-import subprocess
-from pathlib import Path
-from typing import Any, Mapping, Sequence
-
-
-_SIGNER_FLAGS = (
-    "--namespace",
-    "--input",
-    "--signature-out",
-    "--key-id-out",
-)
-
-
-class SignerContractError(RuntimeError):
-    """Raised when the deployed contract cannot be normalized safely."""
-
-
-def canonical_json_bytes(value: Any) -> bytes:
-    return (
-        json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
-        + "\n"
-    ).encode("utf-8")
-
-
-def sha256_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
-
-
-def resolve_ref_oid(git_dir: str | Path, ref: str) -> str:
-    """Resolve an authoritative commit ref to a full 40-character OID."""
-    if not isinstance(ref, str) or not re.fullmatch(r"refs/[A-Za-z0-9._/-]+", ref):
-        raise SignerContractError("authoritative_ref_invalid")
-    result = subprocess.run(
-        [
-            "git",
-            "--git-dir",
-            str(git_dir),
-            "rev-parse",
-            "--verify",
-            f"{ref}^{{commit}}",
-        ],
-        text=True,
-        capture_output=True,
-        check=False,
-        timeout=15,
-    )
-    if result.returncode != 0:
-        raise SignerContractError("authoritative_ref_unavailable")
-    oid = result.stdout.strip().lower()
-    if not re.fullmatch(r"[0-9a-f]{40}", oid):
-        raise SignerContractError("authoritative_ref_invalid_oid")
-    return oid
-
-
-def _read(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise SignerContractError("contract_input_missing")
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise SignerContractError("contract_input_invalid") from exc
-    if not isinstance(value, dict):
-        raise SignerContractError("contract_object_required")
-    return value
-
-
-def _write(path: Path, value: Any) -> None:
-    if path.is_symlink():
-        raise SignerContractError("contract_output_symlink")
-    path.parent.mkdir(parents=True, exist_ok=True)
-    temporary = path.with_name(path.name + ".tmp")
-    temporary.write_bytes(canonical_json_bytes(value))
-    os.chmod(temporary, 0o600)
-    os.replace(temporary, path)
-    os.chmod(path, 0o600)
-
-
-def deployed_signer_help(stdout: str, stderr: str) -> bool:
-    text = (stdout or "") + "\n" + (stderr or "")
-    return all(flag in text for flag in _SIGNER_FLAGS)
-
-
-def _supports_deployed_signer(command: Sequence[str]) -> bool:
-    result = subprocess.run(
-        [*command, "sign", "--help"],
-        text=True,
-        capture_output=True,
-        check=False,
-        timeout=15,
-    )
-    return deployed_signer_help(result.stdout, result.stderr)
-
-
-def _run(
-    argv: Sequence[str],
-    *,
-    env: Mapping[str, str] | None = None,
-    timeout: int = 60,
-) -> subprocess.CompletedProcess[str]:
-    result = subprocess.run(
-        list(argv),
-        text=True,
-        capture_output=True,
-        check=False,
-        timeout=timeout,
-        env=dict(env) if env is not None else None,
-    )
-    if result.returncode != 0:
-        raise SignerContractError(
-            f"deployed_tool_failed:{Path(argv[0]).name}:{result.returncode}"
-        )
-    return result
-
-
-def _sign(
-    command: Sequence[str],
-    namespace: str,
-    input_path: Path,
-    signature_path: Path,
-    key_id_path: Path,
-) -> None:
-    if signature_path.exists() or key_id_path.exists():
-        raise SignerContractError("contract_output_exists")
-    _run(
-        [
-            *command,
-            "sign",
-            "--namespace",
-            namespace,
-            "--input",
-            str(input_path),
-            "--signature-out",
-            str(signature_path),
-            "--key-id-out",
-            str(key_id_path),
-        ],
-        timeout=60,
-    )
-    if not signature_path.is_file() or not key_id_path.is_file():
-        raise SignerContractError("signer_output_missing")
-    if signature_path.stat().st_size <= 0 or key_id_path.stat().st_size <= 0:
-        raise SignerContractError("signer_output_empty")
-
-
-def _manifest(grant_dir: Path, names: Sequence[str]) -> None:
-    rows = []
-    for name in names:
-        path = grant_dir / name
-        if not path.is_file() or path.is_symlink():
-            raise SignerContractError("manifest_input_missing")
-        rows.append(
-            f"{hashlib.sha256(path.read_bytes()).hexdigest()}  {name}"
-        )
-    (grant_dir / "MANIFEST.sha256").write_text(
-        "\n".join(rows) + "\n",
-        encoding="utf-8",
-    )
-    os.chmod(grant_dir / "MANIFEST.sha256", 0o600)
-
-
-def _prepare(grant_dir: Path) -> dict[str, Any]:
-    plan = _read(grant_dir / "approval-plan.json")
-    request = _read(grant_dir / "grant-request.json")
-    base = request.get("base")
-    target = request.get("target")
-    owner = request.get("owner_authorization")
-    authorization = request.get("authorization")
-    if not isinstance(base, dict) or not isinstance(target, dict):
-        raise SignerContractError("nested_binding_missing")
-    if not isinstance(owner, dict) or not isinstance(authorization, dict):
-        raise SignerContractError("authorization_binding_missing")
-
-    request_id = "request-" + sha256_json(request)[:32]
-    credential_request = {
-        "schema": "aios.credential-request.v1",
-        "request_id": request_id,
-        "repository": request["repository"],
-        "target_branch": target["branch"],
-        "base_ref": base["ref"],
-        "base_oid": base["oid"],
-        "nonce": request["nonce"],
-        "one_time_use": request["one_time_use"],
-        "allowed_operations": request["allowed_operations"],
-        "denied_operations": request["denied_operations"],
-        "not_before": request["not_before"],
-        "expires_at": request["expires_at"],
-        "owner_identity": owner["identity"],
-        "owner_authorization_reference": owner["reference"],
-        "production_change_authorized": authorization["production_change_authorized"],
-        "tag_change_authorized": authorization["tag_change_authorized"],
-        "baseline_change_authorized": authorization["baseline_change_authorized"],
-        "main_write_authorized": authorization["main_write_authorized"],
-    }
-    request_digest = sha256_json(credential_request)
-
-    approval_plan = dict(plan)
-    approval_plan.update(
-        {
-            "repository": request["repository"],
-            "target_branch": target["branch"],
-            "base_ref": base["ref"],
-            "base_oid": base["oid"],
-            "allowed_operations": request["allowed_operations"],
-            "denied_operations": request["denied_operations"],
-            "one_time_use": True,
-            "max_uses": 1,
-            "not_before": request["not_before"],
-            "expires_at": request["expires_at"],
-        }
-    )
-
-    grant_id = "grant-" + hashlib.sha256(
-        (request_id + "\0" + request["nonce"]).encode("utf-8")
-    ).hexdigest()[:32]
-    grant_payload = {
-        "schema": "aios.grant-payload.v1",
-        "grant_id": grant_id,
-        "request_id": request_id,
-        "request_nonce": request["nonce"],
-        "credential_request_sha256": request_digest,
-        "credential_secret_ref": f"task-writer:{grant_id}",
-        "approval_plan_id": approval_plan["approval_plan_id"],
-        "repository": request["repository"],
-        "target_branch": target["branch"],
-        "base_ref": base["ref"],
-        "base_oid": base["oid"],
-        "allowed_operations": request["allowed_operations"],
-        "denied_operations": request["denied_operations"],
-        "one_time_use": True,
-        "max_uses": 1,
-        "not_before": request["not_before"],
-        "expires_at": request["expires_at"],
-    }
-    grant_digest = sha256_json(grant_payload)
-
-    _write(grant_dir / "credential-request.json", credential_request)
-    (grant_dir / "credential-request.canonical.json").write_bytes(
-        canonical_json_bytes(credential_request)
-    )
-    os.chmod(grant_dir / "credential-request.canonical.json", 0o600)
-    _write(grant_dir / "approval-plan.json", approval_plan)
-    (grant_dir / "approval-plan.canonical.json").write_bytes(
-        canonical_json_bytes(approval_plan)
-    )
-    os.chmod(grant_dir / "approval-plan.canonical.json", 0o600)
-    _write(grant_dir / "grant-payload.json", grant_payload)
-    (grant_dir / "grant-payload.canonical.json").write_bytes(
-        canonical_json_bytes(grant_payload)
-    )
-    os.chmod(grant_dir / "grant-payload.canonical.json", 0o600)
-    _write(
-        grant_dir / "signed-grant.json",
-        {
-            "schema": "aios.signed-grant.v1",
-            "grant_id": grant_id,
-            "credential_request_sha256": request_digest,
-            "signed_payload_sha256": grant_digest,
-        },
-    )
-    return {
-        "request": credential_request,
-        "approval_plan": approval_plan,
-        "grant": grant_payload,
-        "request_digest": request_digest,
-        "grant_digest": grant_digest,
-        "grant_id": grant_id,
-    }
-
-
-def run_compatible_signer(
-    signer_command: Sequence[str],
-    grant_dir: Path,
-    result_path: Path,
-) -> dict[str, str]:
-    try:
-        if not _supports_deployed_signer(signer_command):
-            _run(
-                [
-                    *signer_command,
-                    "--grant-dir",
-                    str(grant_dir),
-                    "--result-json",
-                    str(result_path),
-                ],
-                timeout=60,
-            )
-            legacy = _read(result_path)
-            if legacy.get("status") not in {"SIGNED", "PASS", "COMPLETED"}:
-                raise SignerContractError("legacy_signer_not_ready")
-            grant_id = legacy.get("grant_id")
-            digest = legacy.get("grant_digest_sha256")
-            signer = legacy.get("signing_key_identity") or legacy.get(
-                "signer_identity"
-            )
-            if not all(
-                isinstance(value, str) and value.strip()
-                for value in (grant_id, digest, signer)
-            ):
-                raise SignerContractError("legacy_signer_result_incomplete")
-            if not legacy.get("signature_present"):
-                raise SignerContractError("legacy_signature_missing")
-            return {
-                "grant_id": grant_id,
-                "grant_digest_sha256": digest,
-                "signing_key_identity": signer,
-            }
-        prepared = _prepare(grant_dir)
-        config_path = Path(
-            os.environ.get("AIOS_GRANT_ROOT_CONFIG", "/etc/aios/grant-root/config.json")
-        )
-        config = _read(config_path)
-        grant_namespace = str(config["grant_namespace"])
-        approval_namespace = str(config["approval_namespace"])
-        _sign(
-            signer_command,
-            approval_namespace,
-            grant_dir / "approval-plan.canonical.json",
-            grant_dir / "approval-plan.sig",
-            grant_dir / "approval-plan.key-id",
-        )
-        _sign(
-            signer_command,
-            grant_namespace,
-            grant_dir / "grant-payload.canonical.json",
-            grant_dir / "signed-grant.sig",
-            grant_dir / "signed-grant.key-id",
-        )
-        key_identity = (
-            grant_dir / "signed-grant.key-id"
-        ).read_text(encoding="utf-8").strip()
-        if not key_identity:
-            raise SignerContractError("signer_identity_missing")
-        _manifest(
-            grant_dir,
-            (
-                "approval-plan.json",
-                "approval-plan.canonical.json",
-                "approval-plan.sig",
-                "approval-plan.key-id",
-                "credential-request.json",
-                "credential-request.canonical.json",
-                "grant-payload.json",
-                "grant-payload.canonical.json",
-                "signed-grant.json",
-                "signed-grant.sig",
-                "signed-grant.key-id",
-            ),
-        )
-        result = {
-            "schema": "aios.compatible-signer-result.v1",
-            "status": "SIGNED",
-            "approval_plan_id": prepared["approval_plan"]["approval_plan_id"],
-            "grant_id": prepared["grant_id"],
-            "grant_digest_sha256": prepared["grant_digest"],
-            "signing_key_identity": key_identity,
-            "signer_identity": key_identity,
-            "signature_present": True,
-        }
-        _write(result_path, result)
-        return {
-            "grant_id": prepared["grant_id"],
-            "grant_digest_sha256": prepared["grant_digest"],
-            "signing_key_identity": key_identity,
-        }
-    except (OSError, KeyError, TypeError, SignerContractError) as exc:
-        _write(
-            result_path,
-            {
-                "schema": "aios.compatible-signer-result.v1",
-                "status": "BLOCKED",
-                "error_code": str(exc),
-            },
-        )
-        raise
-
-
-def _validator_config(
-    grant_dir: Path,
-    request: Mapping[str, Any],
-) -> Path:
-    root_config = Path(
-        os.environ.get("AIOS_GRANT_ROOT_CONFIG", "/etc/aios/grant-root/config.json")
-    )
-    config = _read(root_config)
-    repo_path = (
-        os.environ.get("AIOS_GITOPS_VALIDATOR_REPO_PATH")
-        or os.environ.get("AIOS_GITOPS_WORKSPACE")
-        or config.get("repo_path")
-    )
-    config.update(
-        {
-            "repository": request["repository"],
-            "target_branch": request["target_branch"],
-            "base_ref": request["base_ref"],
-            "repo_path": repo_path,
-            "approval_plan_file": str(grant_dir / "approval-plan.json"),
-            "approval_plan_canonical_file": str(
-                grant_dir / "approval-plan.canonical.json"
-            ),
-            "approval_plan_signature_file": str(grant_dir / "approval-plan.sig"),
-            "consumed_grants_ledger": str(
-                grant_dir / "consumed-grants.jsonl"
-            ),
-        }
-    )
-    path = grant_dir.parent / "compat-validator-config.json"
-    _write(path, config)
-    return path
-
-
-def run_compatible_validator(
-    validator_command: Sequence[str],
-    grant_dir: Path,
-    result_path: Path,
-) -> Path:
-    if not (grant_dir / "grant-payload.json").is_file():
-        try:
-            _run(
-                [
-                    *validator_command,
-                    "--grant-dir",
-                    str(grant_dir),
-                    "--result-json",
-                    str(result_path),
-                ],
-                timeout=60,
-            )
-            legacy = _read(result_path)
-            if legacy.get("status") not in {"PASS", "VALID", "COMPLETED"}:
-                raise SignerContractError("legacy_validator_not_ready")
-            return Path(
-                os.environ.get(
-                    "AIOS_GRANT_ROOT_CONFIG", "/etc/aios/grant-root/config.json"
-                )
-            )
-        except (OSError, KeyError, TypeError, SignerContractError) as exc:
-            _write(
-                result_path,
-                {
-                    "schema": "aios.compatible-validator-result.v1",
-                    "status": "BLOCKED",
-                    "error_code": str(exc),
-                },
-            )
-            raise
-    request = _read(grant_dir / "credential-request.json")
-    config_path = _validator_config(grant_dir, request)
-    env = os.environ.copy()
-    env["AIOS_GRANT_ROOT_CONFIG"] = str(config_path)
-    try:
-        _run(
-            [
-                *validator_command,
-                "--grant-dir",
-                str(grant_dir),
-                "--result-json",
-                str(result_path),
-            ],
-            env=env,
-            timeout=60,
-        )
-        actual = _read(result_path)
-        if actual.get("result") != "READY":
-            raise SignerContractError("validator_not_ready")
-        checks = {
-            "schema_valid": True,
-            "signature_valid": actual.get("signature_verified") is True,
-            "signer_trusted": actual.get("signature_verified") is True,
-            "approval_plan_active": actual.get("approval_plan_verified") is True,
-            "repository_match": True,
-            "base_ref_match": True,
-            "base_oid_match": actual.get("remote_base_verified") is True,
-            "target_branch_match": actual.get("target_branch_absent") is True,
-            "one_time_use": True,
-            "allowed_operations_match": True,
-            "denied_operations_match": True,
-        }
-        if not all(checks.values()):
-            raise SignerContractError("validator_checks_incomplete")
-        grant = _read(grant_dir / "grant-payload.json")
-        result = {
-            "schema": "aios.compatible-validator-result.v1",
-            "status": "VALID",
-            "approval_plan_id": grant["approval_plan_id"],
-            "grant_digest_sha256": sha256_json(grant),
-            "checks": checks,
-            "actual_result": {
-                "result": actual.get("result"),
-                "signature_verified": actual.get("signature_verified"),
-                "approval_plan_verified": actual.get("approval_plan_verified"),
-                "remote_base_verified": actual.get("remote_base_verified"),
-                "target_branch_absent": actual.get("target_branch_absent"),
-                "grant_unused": actual.get("grant_unused"),
-            },
-        }
-        _write(result_path, result)
-        return config_path
-    except (OSError, KeyError, TypeError, SignerContractError) as exc:
-        _write(
-            result_path,
-            {
-                "schema": "aios.compatible-validator-result.v1",
-                "status": "BLOCKED",
-                "error_code": str(exc),
-            },
-        )
-        raise

active-runtime/app/silent_release_controller.py

@@ -22,12 +22,11 @@ from enum import Enum
 from pathlib import Path
 from typing import Any, Protocol
 
-from release_version import validate_release_version
-
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
 CANDIDATE_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]{2,127}$")
+VERSION_RE = re.compile(r"^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$")
 SECRET_PATTERNS = (
     re.compile(r"(?i)(authorization\s*[:=]\s*)(?:bearer|token)\s+\S+"),
     re.compile(r"(?i)((?:access_)?token\s*[:=]\s*)\S+"),
@@ -770,10 +769,8 @@ class TagApprovalEnvelope:
     def validate(self) -> None:
         if self.action != "production_tag":
             raise ApprovalError("approval does not authorize production tag")
-        try:
-            validate_release_version(self.version)
-        except ValueError as exc:
-            raise ApprovalError("invalid release version") from exc
+        if not VERSION_RE.fullmatch(self.version):
+            raise ApprovalError("invalid release version")
         _validate_oid("tag_oid", self.tag_oid)
         _validate_oid("target_oid", self.target_oid)
         if _parse_utc(self.expires_at) <= datetime.now(timezone.utc):

active-runtime/app/silent_release_hardening.py

@@ -9,7 +9,6 @@ from __future__ import annotations
 
 import base64
 import hashlib
-import hmac
 import json
 import os
 import re
@@ -41,8 +40,6 @@ from silent_release_controller import (
 
 IDENTIFIER_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.:-]{2,255}$")
 NONCE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.:-]{15,255}$")
-BUILDER_ATTESTATION_TRUST_DOMAIN = "aios.trusted-builder.attestation.v1"
-BUILDER_ATTESTATION_PURPOSE = "AIOS_TRUSTED_RELEASE_BUILDER"
 ALLOWED_CAPABILITIES = frozenset(
     {
         "runtime_switch",
@@ -65,10 +62,6 @@ class CapabilityAuthorizationError(RuntimeError):
     """The signed plan cannot authorize the requested operation."""
 
 
-class TrustedCandidateBuilderUnavailable(RuntimeError):
-    """The purpose-bound builder dependency cannot currently serve a build."""
-
-
 class StaleApprovalError(CapabilityAuthorizationError):
     """Live release evidence no longer matches the signed approval."""
 
@@ -229,10 +222,6 @@ JOURNAL_GENESIS_HASH = "0" * 64
 
 
 def _fsync_directory(path: Path) -> None:
-    if os.name == "nt":
-        # Windows does not permit opening a directory with os.open.  Durable
-        # Linux host execution retains the directory fsync below.
-        return
     descriptor = os.open(Path(path), os.O_RDONLY)
     try:
         os.fsync(descriptor)
@@ -726,14 +715,6 @@ class BuilderAttestation:
     canary_evidence_sha256: str
     issued_at: str
     signature: str
-    trust_domain: str = BUILDER_ATTESTATION_TRUST_DOMAIN
-    builder_key_generation: int | None = None
-    signature_algorithm: str | None = None
-    signature_purpose: str | None = None
-    gitea_evidence_sha256: str = ""
-    rollback_evidence_sha256: str = ""
-    policy_evidence_sha256: str = ""
-    secret_scan_evidence_sha256: str = ""
 
     def __post_init__(self) -> None:
         _validate_identifier(
@@ -750,35 +731,7 @@ class BuilderAttestation:
             "canary_evidence_sha256",
         ):
             _validate_sha(name, getattr(self, name))
-        for name in (
-            "gitea_evidence_sha256",
-            "rollback_evidence_sha256",
-            "policy_evidence_sha256",
-            "secret_scan_evidence_sha256",
-        ):
-            if getattr(self, name):
-                _validate_sha(name, getattr(self, name))
         _parse_utc(self.issued_at)
-        if self.trust_domain != BUILDER_ATTESTATION_TRUST_DOMAIN:
-            raise CapabilityAuthorizationError(
-                "builder attestation trust domain is invalid"
-            )
-        metadata = (
-            self.builder_key_generation,
-            self.signature_algorithm,
-            self.signature_purpose,
-        )
-        if any(value is not None for value in metadata):
-            if (
-                not isinstance(self.builder_key_generation, int)
-                or isinstance(self.builder_key_generation, bool)
-                or self.builder_key_generation < 0
-                or self.signature_algorithm != "Ed25519"
-                or self.signature_purpose != BUILDER_ATTESTATION_PURPOSE
-            ):
-                raise CapabilityAuthorizationError(
-                    "builder attestation signing metadata is invalid"
-                )
 
     @property
     def canonical_payload(self) -> dict[str, Any]:
@@ -801,290 +754,20 @@ class BuilderAttestation:
         }
 
     @classmethod
-    def from_dict(
-        cls,
-        payload: Mapping[str, Any],
-        *,
-        require_fingerprint: bool = False,
-    ) -> "BuilderAttestation":
+    def from_dict(cls, payload: Mapping[str, Any]) -> "BuilderAttestation":
         values = dict(payload)
-        supplied_fingerprint = values.pop("fingerprint", None)
-        # Older local records did not spell out the domain.  They are only
-        # usable when re-signed by the current builder; their original
-        # signatures cannot validate against this domain-separated payload.
-        values.setdefault("trust_domain", BUILDER_ATTESTATION_TRUST_DOMAIN)
-        value = cls(**values)
-        if supplied_fingerprint is None:
-            if require_fingerprint:
-                raise CapabilityAuthorizationError(
-                    "builder attestation digest is required"
-                )
-            return value
-        expected = _validate_sha(
-            "builder attestation digest", str(supplied_fingerprint)
-        )
-        if not hmac.compare_digest(expected, value.fingerprint):
-            raise CapabilityAuthorizationError(
-                "builder attestation digest is invalid"
-            )
-        return value
-
-
-@dataclass(frozen=True)
-class BuilderAttestationKeyRecord:
-    """One purpose-bound public verification key from the host keyring."""
-
-    key_id: str
-    public_key: bytes
-    algorithm: str
-    purpose: str
-    generation: int
-    not_before: str
-    expires_at: str
-    status: str
-
-    def __post_init__(self) -> None:
-        _validate_identifier("builder_key_id", self.key_id)
-        if self.algorithm != "Ed25519":
-            raise ValueError("unsupported builder signature algorithm")
-        if self.purpose != BUILDER_ATTESTATION_PURPOSE:
-            raise ValueError("builder key purpose is invalid")
-        if not isinstance(self.generation, int) or isinstance(
-            self.generation, bool
-        ) or self.generation < 0:
-            raise ValueError("builder key generation is invalid")
-        if self.status not in {"ACTIVE", "REVOKED"}:
-            raise ValueError("builder key status is invalid")
-        if len(self.public_key) != 32:
-            raise ValueError("Ed25519 public key must contain 32 bytes")
-        Ed25519PublicKey.from_public_bytes(self.public_key)
-        if _parse_utc(self.not_before) >= _parse_utc(self.expires_at):
-            raise ValueError("builder key validity window is invalid")
-
-    @property
-    def public_key_sha256(self) -> str:
-        return hashlib.sha256(self.public_key).hexdigest()
-
-    def validate_at(self, instant: datetime) -> None:
-        if self.status != "ACTIVE":
-            raise CapabilityAuthorizationError(
-                "builder attestation key is unavailable or revoked"
-            )
-        if instant.tzinfo is None:
-            raise CapabilityAuthorizationError(
-                "builder attestation verification time is invalid"
-            )
-        if not _parse_utc(self.not_before) <= instant <= _parse_utc(
-            self.expires_at
-        ):
-            raise CapabilityAuthorizationError(
-                "builder attestation key is outside its validity window"
-            )
-
-    @classmethod
-    def from_dict(
-        cls, payload: Mapping[str, Any]
-    ) -> "BuilderAttestationKeyRecord":
-        values = dict(payload)
-        encoded = values.pop("public_key", values.pop("public_key_b64", None))
-        if not isinstance(encoded, str):
-            raise ValueError("builder public key is missing")
-        try:
-            public_key = base64.b64decode(encoded, validate=True)
-        except (TypeError, ValueError) as exc:
-            raise ValueError("builder public key encoding is invalid") from exc
-        supplied_digest = values.pop(
-            "public_key_sha256",
-            values.pop("key_sha256", values.pop("digest", None)),
-        )
-        if not isinstance(supplied_digest, str):
-            raise ValueError("builder public key digest is missing")
-        digest = _validate_sha("builder public key digest", supplied_digest)
-        if not hmac.compare_digest(
-            digest, hashlib.sha256(public_key).hexdigest()
-        ):
-            raise ValueError("builder public key digest is invalid")
-        allowed = {
-            "algorithm",
-            "purpose",
-            "key_id",
-            "generation",
-            "not_before",
-            "expires_at",
-            "status",
-        }
-        unknown = set(values).difference(allowed)
-        if unknown:
-            raise ValueError("builder key record contains unknown fields")
-        return cls(public_key=public_key, **values)
-
-
-class BuilderAttestationKeyRing:
-    """Validated, public-only keyring for builder attestations.
-
-    The file format deliberately cannot carry Owner approval keys: both the
-    keyring and every record must declare the builder-attestation purpose.
-    """
-
-    def __init__(
-        self,
-        records: Iterable[BuilderAttestationKeyRecord],
-        *,
-        require_attestation_metadata: bool = False,
-    ):
-        self._records: dict[str, BuilderAttestationKeyRecord] = {}
-        self._require_attestation_metadata = require_attestation_metadata
-        for record in records:
-            if record.key_id in self._records:
-                raise ValueError("duplicate builder key id")
-            self._records[record.key_id] = record
-
-    @classmethod
-    def from_public_keys(
-        cls, public_keys: Mapping[str, bytes]
-    ) -> "BuilderAttestationKeyRing":
-        """Compatibility adapter for explicit in-process builder key maps.
-
-        This is intentionally not used for host configuration; host keyrings
-        must use :meth:`from_file` so purpose, digest, validity and status are
-        checked before the API accepts traffic.
-        """
-        return cls(
-            BuilderAttestationKeyRecord(
-                key_id=_validate_identifier("builder_key_id", key_id),
-                public_key=bytes(public_key),
-                algorithm="Ed25519",
-                purpose=BUILDER_ATTESTATION_PURPOSE,
-                generation=0,
-                not_before="1970-01-01T00:00:00Z",
-                expires_at="9999-12-31T23:59:59Z",
-                status="ACTIVE",
-            )
-            for key_id, public_key in public_keys.items()
-        )
-
-    @classmethod
-    def from_file(cls, path: Path) -> "BuilderAttestationKeyRing":
-        payload = json.loads(Path(path).read_text(encoding="utf-8"))
-        if payload.get("algorithm") != "Ed25519":
-            raise ValueError("unsupported builder keyring algorithm")
-        if payload.get("purpose") != BUILDER_ATTESTATION_PURPOSE:
-            raise ValueError("builder keyring purpose is invalid")
-        raw_records = payload.get("keys")
-        if not isinstance(raw_records, list) or not raw_records:
-            raise ValueError("builder keyring keys are invalid")
-        allowed = {"algorithm", "purpose", "keys", "keyring_sha256"}
-        if set(payload).difference(allowed):
-            raise ValueError("builder keyring contains unknown fields")
-        if "keyring_sha256" not in payload:
-            raise ValueError("builder keyring digest is missing")
-        expected = _validate_sha(
-            "builder keyring digest", str(payload["keyring_sha256"])
-        )
-        canonical = _canonical_json(
-            {
-                "algorithm": payload["algorithm"],
-                "purpose": payload["purpose"],
-                "keys": raw_records,
-            }
-        )
-        if not hmac.compare_digest(
-            expected, hashlib.sha256(canonical).hexdigest()
-        ):
-            raise ValueError("builder keyring digest is invalid")
-        if not all(isinstance(record, Mapping) for record in raw_records):
-            raise ValueError("builder keyring record is invalid")
-        return cls(
-            (
-                BuilderAttestationKeyRecord.from_dict(record)
-                for record in raw_records
-            ),
-            require_attestation_metadata=True,
-        )
-
-    def verify(
-        self,
-        key_id: str,
-        signature: bytes,
-        message: bytes,
-        *,
-        at: datetime,
-        generation: int | None,
-        algorithm: str | None,
-        purpose: str | None,
-    ) -> BuilderAttestationKeyRecord:
-        record = self._records.get(key_id)
-        if record is None:
-            raise CapabilityAuthorizationError(
-                "builder attestation key is not trusted"
-            )
-        record.validate_at(at)
-        metadata = (generation, algorithm, purpose)
-        if self._require_attestation_metadata and any(
-            value is None for value in metadata
-        ):
-            raise CapabilityAuthorizationError(
-                "builder attestation signing metadata is required"
-            )
-        if any(value is not None for value in metadata) and metadata != (
-            record.generation,
-            record.algorithm,
-            record.purpose,
-        ):
-            raise CapabilityAuthorizationError(
-                "builder attestation signing metadata does not match key"
-            )
-        try:
-            Ed25519PublicKey.from_public_bytes(record.public_key).verify(
-                signature, message
-            )
-        except InvalidSignature as exc:
-            raise CapabilityAuthorizationError(
-                "builder attestation signature is invalid"
-            ) from exc
-        return record
-
-    def require_active_identity(
-        self,
-        *,
-        key_id: str,
-        generation: int,
-        algorithm: str,
-        purpose: str,
-        at: datetime | None = None,
-    ) -> BuilderAttestationKeyRecord:
-        record = self._records.get(key_id)
-        if record is None:
-            raise CapabilityAuthorizationError(
-                "builder attestation key is not trusted"
-            )
-        if (
-            record.generation != generation
-            or record.algorithm != algorithm
-            or record.purpose != purpose
-        ):
-            raise CapabilityAuthorizationError(
-                "builder attestation key metadata is invalid"
-            )
-        record.validate_at(at or datetime.now(timezone.utc))
-        return record
+        values.pop("fingerprint", None)
+        return cls(**values)
 
 
 class BuilderAttestationVerifier:
     """Public-key-only verifier; no builder private material is accepted."""
 
-    def __init__(
-        self,
-        public_keys: BuilderAttestationKeyRing | Mapping[str, bytes],
-    ):
-        if isinstance(public_keys, BuilderAttestationKeyRing):
-            self.keyring = public_keys
-        elif isinstance(public_keys, Mapping):
-            self.keyring = BuilderAttestationKeyRing.from_public_keys(
-                public_keys
-            )
-        else:
-            raise TypeError("builder verifier requires a builder keyring")
+    def __init__(self, public_keys: Mapping[str, bytes]):
+        self.public_keys = {
+            _validate_identifier("builder_key_id", key_id): bytes(value)
+            for key_id, value in public_keys.items()
+        }
 
     def verify(
         self,
@@ -1110,54 +793,22 @@ class BuilderAttestationVerifier:
             raise CapabilityAuthorizationError(
                 "builder attestation does not bind candidate evidence"
             )
+        key = self.public_keys.get(attestation.builder_key_id)
+        if key is None:
+            raise CapabilityAuthorizationError(
+                "builder attestation key is not trusted"
+            )
         try:
             signature = base64.b64decode(
                 attestation.signature, validate=True
             )
-            key_record = self.keyring.verify(
-                attestation.builder_key_id,
-                signature,
-                attestation.canonical_bytes(),
-                at=_parse_utc(attestation.issued_at),
-                generation=attestation.builder_key_generation,
-                algorithm=attestation.signature_algorithm,
-                purpose=attestation.signature_purpose,
+            Ed25519PublicKey.from_public_bytes(key).verify(
+                signature, attestation.canonical_bytes()
             )
         except (InvalidSignature, ValueError, TypeError) as exc:
             raise CapabilityAuthorizationError(
                 "builder attestation signature is invalid"
             ) from exc
-        if key_record.generation >= 1:
-            expected_gitea = hashlib.sha256(
-                _canonical_json(candidate.gitea_consistency)
-            ).hexdigest()
-            expected_rollback = hashlib.sha256(
-                _canonical_json(
-                    {
-                        "ready": candidate.rollback_ready,
-                        "rollback_sha256": release_plan.deployment.rollback_sha256,
-                        "source_commit": candidate.source_commit,
-                    }
-                )
-            ).hexdigest()
-            production_evidence = (
-                attestation.gitea_evidence_sha256,
-                attestation.rollback_evidence_sha256,
-                attestation.policy_evidence_sha256,
-                attestation.secret_scan_evidence_sha256,
-            )
-            if any(not value for value in production_evidence):
-                raise CapabilityAuthorizationError(
-                    "builder attestation production evidence is incomplete"
-                )
-            if (
-                attestation.gitea_evidence_sha256 != expected_gitea
-                or attestation.rollback_evidence_sha256 != expected_rollback
-                or attestation.policy_evidence_sha256 != release_plan.policy_sha256
-            ):
-                raise CapabilityAuthorizationError(
-                    "builder attestation production evidence is invalid"
-                )
         return attestation
 
 
@@ -3530,12 +3181,9 @@ class SilentReleaseActionService:
         builder_attestation_verifier: BuilderAttestationVerifier | None = None,
         trusted_policy: TrustedReleasePolicy | None = None,
         orchestrator: ReleaseOrchestrator | None = None,
-        builder_readiness_probe: Callable[[], Mapping[str, Any]] | None = None,
         allow_legacy_candidate_input: bool = False,
         expected_repository: str = "",
         policy_sha256: str = "",
-        max_builder_attempts: int = 3,
-        builder_attempt_timeout_seconds: int = 180,
     ):
         self.root = Path(root)
         self.execution_enabled = bool(execution_enabled)
@@ -3546,28 +3194,11 @@ class SilentReleaseActionService:
         self.builder_attestation_verifier = builder_attestation_verifier
         self.trusted_policy = trusted_policy
         self.orchestrator = orchestrator
-        self.builder_readiness_probe = builder_readiness_probe
         self.allow_legacy_candidate_input = bool(
             allow_legacy_candidate_input
         )
         self.expected_repository = expected_repository
         self.policy_sha256 = policy_sha256
-        if (
-            not isinstance(max_builder_attempts, int)
-            or isinstance(max_builder_attempts, bool)
-            or not 1 <= max_builder_attempts <= 10
-        ):
-            raise ValueError("max_builder_attempts must be between 1 and 10")
-        self.max_builder_attempts = max_builder_attempts
-        if (
-            not isinstance(builder_attempt_timeout_seconds, int)
-            or isinstance(builder_attempt_timeout_seconds, bool)
-            or not 1 <= builder_attempt_timeout_seconds <= 3600
-        ):
-            raise ValueError(
-                "builder_attempt_timeout_seconds must be between 1 and 3600"
-            )
-        self.builder_attempt_timeout_seconds = builder_attempt_timeout_seconds
         self.candidates = ReleaseCandidateStore(
             self.root / "candidates"
         )
@@ -3604,26 +3235,10 @@ class SilentReleaseActionService:
                     + ", ".join(missing)
                 )
 
-    def get_builder_readiness(self) -> dict[str, Any]:
-        """Report dependency readiness without conflating it with API liveness."""
-        if self.candidate_builder is None:
-            return {"status": "UNAVAILABLE"}
-        if self.builder_readiness_probe is None:
-            # Explicit in-process test/adaptor construction remains usable;
-            # production wiring provides a probe backed by its credentials.
-            return {"status": "READY"}
-        try:
-            value = dict(self.builder_readiness_probe())
-        except Exception:
-            return {"status": "UNAVAILABLE"}
-        if value.get("status") != "READY":
-            return {"status": "UNAVAILABLE"}
-        return _sanitize(value)
-
     def create_release_intent(
         self, payload: Mapping[str, Any]
     ) -> dict[str, Any]:
-        allowed = {"event_id", "source_commit", "version"}
+        allowed = {"event_id", "source_commit"}
         unknown = set(payload).difference(allowed)
         if unknown:
             raise CapabilityAuthorizationError(
@@ -3635,17 +3250,12 @@ class SilentReleaseActionService:
         source_commit = _validate_oid(
             "source_commit", str(payload.get("source_commit") or "")
         )
-        version = str(payload.get("version") or "")
-        if version:
-            _validate_identifier("version", version)
         intent_id = "intent-" + hashlib.sha256(
             f"{event_id}\0{source_commit}".encode("utf-8")
         ).hexdigest()[:24]
         path = _safe_child(self.intents_root, intent_id)
-        was_existing = path.exists()
         record = {
             "created_at": utc_now(),
-            "attempt_count": 0,
             "event_id": event_id,
             "intent_id": intent_id,
             "source_commit": source_commit,
@@ -3655,153 +3265,42 @@ class SilentReleaseActionService:
                 else "BUILDER_UNAVAILABLE"
             ),
         }
-        if version:
-            record["version"] = version
-        if was_existing:
+        if path.exists():
             existing = json.loads(path.read_text(encoding="utf-8"))
             if (
                 existing.get("event_id") != event_id
                 or existing.get("source_commit") != source_commit
-                or str(existing.get("version") or "") != version
             ):
                 raise SagaConflict(
                     "release intent id is bound to different evidence"
                 )
-            if existing.get("status") == "BUILDING":
-                try:
-                    started_at = _parse_utc(
-                        str(existing.get("attempt_started_at") or "")
-                    )
-                    elapsed = (
-                        datetime.now(timezone.utc) - started_at
-                    ).total_seconds()
-                except (TypeError, ValueError):
-                    elapsed = self.builder_attempt_timeout_seconds + 1
-                if elapsed <= self.builder_attempt_timeout_seconds:
-                    return self._intent_response(existing, idempotent=True)
-                existing.update(
-                    {
-                        "failure_code": "TRUSTED_BUILDER_CRASH_RECOVERED",
-                        "last_recovery_code": "TRUSTED_BUILDER_CRASH_RECOVERED",
-                        "recovery_count": int(existing.get("recovery_count") or 0) + 1,
-                        "retryable": int(existing.get("attempt_count") or 0)
-                        < self.max_builder_attempts,
-                        "status": "BUILDER_RETRYABLE_FAILURE",
-                        "updated_at": utc_now(),
-                    }
-                )
-                _durable_json(path, existing)
-            if (
-                existing.get("status") != "BUILDER_RETRYABLE_FAILURE"
-                or int(existing.get("attempt_count") or 0)
-                >= self.max_builder_attempts
-            ):
-                return self._intent_response(existing, idempotent=True)
-            record = dict(existing)
-        if self.candidate_builder is None:
-            record.update(
-                {
-                    "retryable": False,
-                    "status": "BUILDER_UNAVAILABLE",
-                }
-            )
-            _durable_json(path, record)
-            return self._intent_response(record, idempotent=was_existing)
-
-        record.update(
-            {
-                "attempt_count": int(record.get("attempt_count") or 0) + 1,
-                "attempt_started_at": utc_now(),
-                "retryable": False,
-                "status": "BUILDING",
-                "updated_at": utc_now(),
+            return {
+                **_sanitize(existing),
+                "idempotent": True,
+                "execution_enabled": self.execution_enabled,
+                "shadow_mode": not self.execution_enabled,
+                "side_effects_executed": False,
             }
-        )
         _durable_json(path, record)
-        try:
+        result = dict(record)
+        if self.candidate_builder is not None:
             candidate = self.create_release_candidate(
                 {
                     "event_id": event_id,
                     "intent_id": intent_id,
                     "source_commit": source_commit,
-                    **({"version": version} if version else {}),
                 }
             )
-        except TrustedCandidateBuilderUnavailable:
-            record.update(
+            result.update(
                 {
-                    "failure_code": "TRUSTED_BUILDER_UNAVAILABLE",
-                    "retryable": record["attempt_count"]
-                    < self.max_builder_attempts,
-                    "status": (
-                        "BUILDER_RETRYABLE_FAILURE"
-                        if record["attempt_count"] < self.max_builder_attempts
-                        else "BUILDER_TERMINAL_FAILURE"
-                    ),
+                    "candidate_id": candidate["candidate_id"],
+                    "status": candidate["saga_state"],
                 }
             )
-            _durable_json(path, record)
-            return self._intent_response(record, idempotent=False)
-        except CapabilityAuthorizationError:
-            record.update(
-                {
-                    "failure_code": "TRUSTED_BUILDER_REJECTED",
-                    "retryable": False,
-                    "status": "BUILDER_TERMINAL_FAILURE",
-                }
-            )
-            _durable_json(path, record)
-            return self._intent_response(record, idempotent=False)
-        except (ConnectionError, OSError, TimeoutError):
-            record.update(
-                {
-                    "failure_code": "TRUSTED_BUILDER_UNAVAILABLE",
-                    "retryable": record["attempt_count"]
-                    < self.max_builder_attempts,
-                    "status": (
-                        "BUILDER_RETRYABLE_FAILURE"
-                        if record["attempt_count"] < self.max_builder_attempts
-                        else "BUILDER_TERMINAL_FAILURE"
-                    ),
-                }
-            )
-            _durable_json(path, record)
-            return self._intent_response(record, idempotent=False)
-        except Exception:
-            # The durable intent is recoverable without serializing an
-            # arbitrary exception (which may contain a credential or host
-            # path).  Repeated requests consume the small fixed retry budget.
-            record.update(
-                {
-                    "failure_code": "TRUSTED_BUILDER_FAILURE",
-                    "retryable": record["attempt_count"]
-                    < self.max_builder_attempts,
-                    "status": (
-                        "BUILDER_RETRYABLE_FAILURE"
-                        if record["attempt_count"] < self.max_builder_attempts
-                        else "BUILDER_TERMINAL_FAILURE"
-                    ),
-                }
-            )
-            _durable_json(path, record)
-            return self._intent_response(record, idempotent=False)
-        result = dict(record)
-        result.update(
-            {
-                "candidate_id": candidate["candidate_id"],
-                "retryable": False,
-                "status": candidate["saga_state"],
-            }
-        )
-        _durable_json(path, result)
-        return self._intent_response(result, idempotent=False)
-
-    def _intent_response(
-        self, record: Mapping[str, Any], *, idempotent: bool
-    ) -> dict[str, Any]:
+            _durable_json(path, result)
         return {
-            **_sanitize(dict(record)),
-            "idempotent": idempotent,
+            **_sanitize(result),
+            "idempotent": False,
             "execution_enabled": self.execution_enabled,
             "shadow_mode": not self.execution_enabled,
             "side_effects_executed": False,
@@ -3822,7 +3321,6 @@ class SilentReleaseActionService:
         self, payload: Mapping[str, Any]
     ) -> dict[str, Any]:
         if self.candidate_builder is not None:
-            values = dict(payload)
             forbidden_evidence = {
                 "artifact_sha256",
                 "canary",
@@ -3835,69 +3333,13 @@ class SilentReleaseActionService:
                 "tests",
                 "tree_oid",
             }
-            if forbidden_evidence.intersection(values):
+            if forbidden_evidence.intersection(payload):
                 raise CapabilityAuthorizationError(
                     "candidate evidence must come from the trusted builder"
                 )
-            worker_fields = {"candidate_id", "source_commit", "version"}
-            intent_fields = {"event_id", "intent_id", "source_commit", "version"}
-            supplied = set(values)
-            is_worker_request = worker_fields.issubset(supplied)
-            if is_worker_request:
-                if supplied != worker_fields:
-                    raise ValueError("release worker request contains unknown fields")
-                _validate_identifier(
-                    "candidate_id", str(values.get("candidate_id") or "")
-                )
-                _validate_identifier(
-                    "version", str(values.get("version") or "")
-                )
-            else:
-                if not supplied.issubset(intent_fields):
-                    raise ValueError("trusted builder intent contains unknown fields")
-                # Preserve the established internal intent contract
-                # (source_commit + version) while allowing newer callers to
-                # add an event/intent identifier.  Neither form can supply
-                # acceptance evidence; the host builder owns all collectors.
-                if values.get("event_id"):
-                    _validate_identifier(
-                        "event_id", str(values["event_id"])
-                    )
-                if values.get("intent_id"):
-                    _validate_identifier(
-                        "intent_id", str(values["intent_id"])
-                    )
-                if values.get("version"):
-                    _validate_identifier(
-                        "version", str(values["version"])
-                    )
-            _validate_oid(
-                "source_commit", str(values.get("source_commit") or "")
-            )
-            readiness = self.get_builder_readiness()
-            if readiness.get("status") != "READY":
-                raise TrustedCandidateBuilderUnavailable(
-                    "trusted builder dependency is unavailable"
-                )
             bundle = self.candidate_builder.build(dict(payload)).validate(
                 self.builder_attestation_verifier
             )
-            requested_source = str(payload.get("source_commit") or "")
-            if (
-                requested_source
-                and bundle.candidate.source_commit != requested_source
-            ):
-                raise CapabilityAuthorizationError(
-                    "trusted builder source commit does not match intent"
-                )
-            if (
-                is_worker_request
-                and bundle.candidate.candidate_id
-                != str(values["candidate_id"])
-            ):
-                raise CapabilityAuthorizationError(
-                    "trusted builder candidate id does not match request"
-                )
             if self.trusted_policy is None:
                 raise CapabilityAuthorizationError(
                     "trusted release policy is not configured"
@@ -4015,19 +3457,6 @@ class SilentReleaseActionService:
         }
 
     def get_release_saga(self, candidate_id: str) -> dict[str, Any]:
-        # A read of a never-created candidate is a normal empty-state.  Do
-        # not turn a missing journal into a durable manual-review snapshot.
-        saga_path = self.sagas._path(candidate_id)
-        journal_path = self.sagas._journal(candidate_id)
-        if not saga_path.exists() and not journal_path.exists():
-            return {
-                "candidate_id": candidate_id,
-                "status": "NOT_FOUND",
-                "state": "NOT_FOUND",
-                "execution_enabled": self.execution_enabled,
-                "shadow_mode": not self.execution_enabled,
-                "side_effects_executed": False,
-            }
         return {
             **self.sagas.load(candidate_id).to_dict(),
             "execution_enabled": self.execution_enabled,