fix(online-agent): close automatic execution loop

active-runtime/app/agent_event_bus.py

@@ -13,6 +13,7 @@ from hashlib import sha256
 from pathlib import Path
 import json
 from typing import Any
+from message_handoff import stable_event_id
 
 
 def utc_now() -> str:
@@ -55,13 +56,18 @@ class AgentEventBus:
         payload: dict[str, Any],
         correlation_id: str | None = None,
     ) -> dict[str, Any]:
-        event_id = "evt_" + sha256(
-            json.dumps(
-                {"kind": kind, "source": source, "summary": summary, "payload": payload},
-                sort_keys=True,
-                ensure_ascii=False,
-            ).encode("utf-8")
-        ).hexdigest()[:16]
+        event_id = stable_event_id(
+            source=source, target=target, message_type=kind, payload=payload,
+            tenant_id=(payload.get('tenant_id') if isinstance(payload, dict) else None),
+            user_id=(payload.get('user_id') if isinstance(payload, dict) else None),
+            project_id=(payload.get('project_id') if isinstance(payload, dict) else None),
+            conversation_id=(payload.get('conversation_id') if isinstance(payload, dict) else None),
+            task_id=(payload.get('task_id') if isinstance(payload, dict) else None),
+            run_id=(payload.get('run_id') if isinstance(payload, dict) else None),
+            causation_id=(payload.get('causation_id') if isinstance(payload, dict) else None),
+            sequence=(payload.get('sequence') if isinstance(payload, dict) else None),
+            idempotency_key=(payload.get('idempotency_key') if isinstance(payload, dict) else None),
+        )
         event = AgentEvent(event_id, kind, source, target, summary, payload, correlation_id=correlation_id)
         self._write("pending", event.to_dict())
         self._audit("created", event.to_dict())

active-runtime/app/aios_agent_task_projection_recovery.py

@@ -1,811 +0,0 @@
-"""Canonical Task projection intent and same-identity recovery primitives.
-
-This module is intentionally Task-Plane-owned.  It does not open a network
-listener and it does not authenticate callers; existing control-plane services
-must enforce their normal service-side ``agent-task:control`` boundary before
-calling it.
-
-The recovery primitive has one purpose: converge a durable, complete
-ProjectionIntent to exactly one canonical Task row.  It never fabricates task
-semantics from a Bridge binding and it never generates a replacement task id.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-from datetime import datetime, timezone
-from enum import Enum
-import hashlib
-import json
-from pathlib import Path
-import re
-import sqlite3
-from typing import Any, Mapping, Sequence
-
-
-TASK_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-JOB_ID_RE = TASK_ID_RE
-SHA40_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA64_RE = re.compile(r"^[0-9a-f]{64}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9._/-]{1,220}$")
-SCHEMA = "aios.canonical-task-projection-intent.v1"
-RECEIPT_SCHEMA = "aios.canonical-task-projection-receipt.v1"
-
-
-class ProjectionRecoveryError(RuntimeError):
-    def __init__(self, code: str, status: int = 409) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-class ProjectionState(str, Enum):
-    PENDING = "PENDING"
-    CONVERGED = "CONVERGED"
-    DRIFT = "DRIFT"
-    FAILED = "FAILED"
-    BLOCKED = "BLOCKED"
-    UNKNOWN = "UNKNOWN"
-    BACKFILL_REQUIRED = "BACKFILL_REQUIRED"
-
-
-def _now() -> str:
-    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def _canonical(value: object) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def sha256_json(value: object) -> str:
-    return hashlib.sha256(_canonical(value)).hexdigest()
-
-
-def _string(value: object, code: str, pattern: re.Pattern[str] | None = None) -> str:
-    if not isinstance(value, str) or not value.strip():
-        raise ProjectionRecoveryError(code, 400)
-    result = value.strip()
-    if pattern is not None and pattern.fullmatch(result) is None:
-        raise ProjectionRecoveryError(code, 400)
-    return result
-
-
-def _integer(value: object, code: str, *, minimum: int = 0) -> int:
-    if isinstance(value, bool) or not isinstance(value, int) or value < minimum:
-        raise ProjectionRecoveryError(code, 400)
-    return value
-
-
-def _plain_mapping(value: object, code: str) -> dict[str, Any]:
-    if not isinstance(value, Mapping):
-        raise ProjectionRecoveryError(code, 400)
-    return {str(k): v for k, v in value.items()}
-
-
-def _plain_list(value: object, code: str) -> list[Any]:
-    if not isinstance(value, list):
-        raise ProjectionRecoveryError(code, 400)
-    return list(value)
-
-
-@dataclass(frozen=True, slots=True)
-class CanonicalTaskPayload:
-    task_id: str
-    goal: str
-    instructions: str
-    success_criteria: tuple[Mapping[str, Any], ...]
-    constraints: Mapping[str, Any]
-    required_capabilities: tuple[str, ...]
-    metadata: Mapping[str, Any]
-    priority: int = 100
-    max_attempts: int = 20
-    deadline: str | None = None
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "CanonicalTaskPayload":
-        allowed = {
-            "task_id",
-            "goal",
-            "instructions",
-            "success_criteria",
-            "constraints",
-            "required_capabilities",
-            "metadata",
-            "priority",
-            "max_attempts",
-            "deadline",
-        }
-        if set(value) - allowed:
-            raise ProjectionRecoveryError("TASK_PAYLOAD_UNKNOWN_FIELDS", 400)
-
-        task_id = _string(value.get("task_id"), "TASK_ID_INVALID", TASK_ID_RE)
-        goal = _string(value.get("goal"), "TASK_GOAL_INVALID")
-        instructions = _string(value.get("instructions"), "TASK_INSTRUCTIONS_INVALID")
-        if len(goal) > 8192 or len(instructions) > 65536:
-            raise ProjectionRecoveryError("TASK_TEXT_TOO_LARGE", 413)
-
-        criteria_raw = _plain_list(value.get("success_criteria"), "TASK_SUCCESS_CRITERIA_INVALID")
-        criteria: list[Mapping[str, Any]] = []
-        for item in criteria_raw:
-            if not isinstance(item, Mapping):
-                raise ProjectionRecoveryError("TASK_SUCCESS_CRITERIA_INVALID", 400)
-            criteria.append(dict(item))
-        if not criteria:
-            raise ProjectionRecoveryError("TASK_SUCCESS_CRITERIA_REQUIRED", 400)
-
-        constraints = _plain_mapping(value.get("constraints"), "TASK_CONSTRAINTS_INVALID")
-        capabilities_raw = _plain_list(
-            value.get("required_capabilities", []),
-            "TASK_CAPABILITIES_INVALID",
-        )
-        capabilities: list[str] = []
-        for item in capabilities_raw:
-            capabilities.append(_string(item, "TASK_CAPABILITY_INVALID"))
-
-        # Recovery recreates the pristine canonical row. Initial execution
-        # projection remains the sole owner of runtime capabilities.
-        if capabilities:
-            raise ProjectionRecoveryError(
-                "TASK_RECOVERY_REQUIRES_PRISTINE_CAPABILITIES",
-                409,
-            )
-
-        metadata = _plain_mapping(value.get("metadata", {}), "TASK_METADATA_INVALID")
-        if "execution" in metadata or "execution_projection" in metadata:
-            raise ProjectionRecoveryError(
-                "TASK_RECOVERY_REQUIRES_PRISTINE_METADATA",
-                409,
-            )
-
-        priority = _integer(value.get("priority", 100), "TASK_PRIORITY_INVALID", minimum=0)
-        max_attempts = _integer(
-            value.get("max_attempts", 20),
-            "TASK_MAX_ATTEMPTS_INVALID",
-            minimum=1,
-        )
-        deadline = value.get("deadline")
-        if deadline is not None:
-            deadline = _string(deadline, "TASK_DEADLINE_INVALID")
-
-        return cls(
-            task_id=task_id,
-            goal=goal,
-            instructions=instructions,
-            success_criteria=tuple(criteria),
-            constraints=constraints,
-            required_capabilities=tuple(capabilities),
-            metadata=metadata,
-            priority=priority,
-            max_attempts=max_attempts,
-            deadline=deadline,
-        )
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "task_id": self.task_id,
-            "goal": self.goal,
-            "instructions": self.instructions,
-            "success_criteria": [dict(x) for x in self.success_criteria],
-            "constraints": dict(self.constraints),
-            "required_capabilities": list(self.required_capabilities),
-            "metadata": dict(self.metadata),
-            "priority": self.priority,
-            "max_attempts": self.max_attempts,
-            "deadline": self.deadline,
-        }
-
-    @property
-    def payload_sha256(self) -> str:
-        return sha256_json(self.public())
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedProjectionBinding:
-    governed_task_id: str
-    bridge_job_id: str
-    repository: str
-    branch: str
-    generation: int
-    base_oid: str
-    expected_branch_oid: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "GovernedProjectionBinding":
-        allowed = {
-            "governed_task_id",
-            "bridge_job_id",
-            "repository",
-            "branch",
-            "generation",
-            "base_oid",
-            "expected_branch_oid",
-        }
-        if set(value) != allowed:
-            raise ProjectionRecoveryError("GOVERNED_BINDING_FIELDS_INVALID", 400)
-        repository = _string(value["repository"], "REPOSITORY_INVALID")
-        if repository != "aios/aios":
-            raise ProjectionRecoveryError("REPOSITORY_MISMATCH", 409)
-        return cls(
-            governed_task_id=_string(
-                value["governed_task_id"],
-                "GOVERNED_TASK_ID_INVALID",
-                TASK_ID_RE,
-            ),
-            bridge_job_id=_string(
-                value["bridge_job_id"],
-                "BRIDGE_JOB_ID_INVALID",
-                JOB_ID_RE,
-            ),
-            repository=repository,
-            branch=_string(value["branch"], "BRANCH_INVALID", BRANCH_RE),
-            generation=_integer(value["generation"], "GENERATION_INVALID", minimum=1),
-            base_oid=_string(value["base_oid"], "BASE_OID_INVALID", SHA40_RE),
-            expected_branch_oid=_string(
-                value["expected_branch_oid"],
-                "EXPECTED_OID_INVALID",
-                SHA40_RE,
-            ),
-        )
-
-    def public(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-@dataclass(frozen=True, slots=True)
-class ProjectionSourceArtifact:
-    ref: str
-    sha256: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "ProjectionSourceArtifact":
-        if set(value) != {"ref", "sha256"}:
-            raise ProjectionRecoveryError("SOURCE_ARTIFACT_FIELDS_INVALID", 400)
-        return cls(
-            ref=_string(value["ref"], "SOURCE_ARTIFACT_REF_INVALID"),
-            sha256=_string(value["sha256"], "SOURCE_ARTIFACT_SHA_INVALID", SHA64_RE),
-        )
-
-
-@dataclass(frozen=True, slots=True)
-class CanonicalTaskProjectionIntent:
-    projection_id: str
-    projection_generation: int
-    idempotency_key: str
-    task: CanonicalTaskPayload
-    binding: GovernedProjectionBinding
-    source_artifact: ProjectionSourceArtifact
-    schema: str = SCHEMA
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "CanonicalTaskProjectionIntent":
-        allowed = {
-            "schema",
-            "projection_id",
-            "projection_generation",
-            "idempotency_key",
-            "task",
-            "governed_binding",
-            "source_artifact",
-            "task_payload_sha256",
-        }
-        if set(value) != allowed:
-            raise ProjectionRecoveryError("PROJECTION_INTENT_FIELDS_INVALID", 400)
-        if value["schema"] != SCHEMA:
-            raise ProjectionRecoveryError("PROJECTION_INTENT_SCHEMA_INVALID", 400)
-
-        task = CanonicalTaskPayload.from_mapping(
-            _plain_mapping(value["task"], "TASK_PAYLOAD_INVALID")
-        )
-        binding = GovernedProjectionBinding.from_mapping(
-            _plain_mapping(value["governed_binding"], "GOVERNED_BINDING_INVALID")
-        )
-        source = ProjectionSourceArtifact.from_mapping(
-            _plain_mapping(value["source_artifact"], "SOURCE_ARTIFACT_INVALID")
-        )
-        if binding.governed_task_id != task.task_id:
-            raise ProjectionRecoveryError("PROJECTION_TASK_IDENTITY_MISMATCH", 409)
-
-        expected_hash = _string(
-            value["task_payload_sha256"],
-            "TASK_PAYLOAD_SHA_INVALID",
-            SHA64_RE,
-        )
-        if task.payload_sha256 != expected_hash:
-            raise ProjectionRecoveryError("TASK_PAYLOAD_SHA_MISMATCH", 409)
-
-        projection_id = _string(
-            value["projection_id"],
-            "PROJECTION_ID_INVALID",
-            TASK_ID_RE,
-        )
-        idempotency_key = _string(
-            value["idempotency_key"],
-            "IDEMPOTENCY_KEY_INVALID",
-            TASK_ID_RE,
-        )
-        generation = _integer(
-            value["projection_generation"],
-            "PROJECTION_GENERATION_INVALID",
-            minimum=1,
-        )
-        return cls(
-            projection_id=projection_id,
-            projection_generation=generation,
-            idempotency_key=idempotency_key,
-            task=task,
-            binding=binding,
-            source_artifact=source,
-        )
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "schema": self.schema,
-            "projection_id": self.projection_id,
-            "projection_generation": self.projection_generation,
-            "idempotency_key": self.idempotency_key,
-            "task": self.task.public(),
-            "governed_binding": self.binding.public(),
-            "source_artifact": asdict(self.source_artifact),
-            "task_payload_sha256": self.task.payload_sha256,
-        }
-
-    @property
-    def request_sha256(self) -> str:
-        return sha256_json(self.public())
-
-
-class CanonicalTaskProjectionStore:
-    """Task-Plane-owned intent/recovery store.
-
-    The caller must already be inside the Task Plane authorization boundary.
-    """
-
-    def __init__(self, db_path: Path | str) -> None:
-        self.db_path = Path(db_path)
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.db_path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    @staticmethod
-    def _columns(connection: sqlite3.Connection, table: str) -> dict[str, sqlite3.Row]:
-        return {
-            str(row["name"]): row
-            for row in connection.execute(f'PRAGMA table_info("{table}")')
-        }
-
-    @staticmethod
-    def _table_names(connection: sqlite3.Connection) -> set[str]:
-        return {
-            str(row[0])
-            for row in connection.execute(
-                "SELECT name FROM sqlite_master WHERE type='table'"
-            )
-        }
-
-    @classmethod
-    def _event_table(
-        cls,
-        connection: sqlite3.Connection,
-    ) -> tuple[str, dict[str, sqlite3.Row]]:
-        tables = cls._table_names(connection)
-        for name in ("task_events", "events"):
-            if name in tables:
-                columns = cls._columns(connection, name)
-                if "task_id" in columns and "event_type" in columns:
-                    return name, columns
-        raise ProjectionRecoveryError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
-
-    @staticmethod
-    def _ensure_control_tables(connection: sqlite3.Connection) -> None:
-        connection.execute(
-            """
-            CREATE TABLE IF NOT EXISTS task_projection_intents (
-              projection_id TEXT PRIMARY KEY,
-              task_id TEXT NOT NULL,
-              bridge_job_id TEXT NOT NULL,
-              projection_generation INTEGER NOT NULL,
-              idempotency_key TEXT NOT NULL,
-              request_sha256 TEXT NOT NULL,
-              task_payload_sha256 TEXT NOT NULL,
-              intent_json TEXT NOT NULL,
-              state TEXT NOT NULL,
-              last_error TEXT,
-              created_at TEXT NOT NULL,
-              updated_at TEXT NOT NULL,
-              UNIQUE(task_id, projection_generation),
-              UNIQUE(task_id, idempotency_key)
-            )
-            """
-        )
-        connection.execute(
-            """
-            CREATE TABLE IF NOT EXISTS task_projection_receipts (
-              projection_id TEXT PRIMARY KEY,
-              task_id TEXT NOT NULL,
-              bridge_job_id TEXT NOT NULL,
-              projection_generation INTEGER NOT NULL,
-              task_payload_sha256 TEXT NOT NULL,
-              canonical_revision INTEGER NOT NULL,
-              state TEXT NOT NULL,
-              created_new_row INTEGER NOT NULL,
-              observed_at TEXT NOT NULL,
-              receipt_json TEXT NOT NULL
-            )
-            """
-        )
-
-    def persist_intent(
-        self,
-        intent: CanonicalTaskProjectionIntent,
-    ) -> dict[str, Any]:
-        now = _now()
-        request_sha = intent.request_sha256
-        intent_text = _canonical(intent.public()).decode("utf-8")
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._ensure_control_tables(connection)
-            existing = connection.execute(
-                """
-                SELECT * FROM task_projection_intents
-                 WHERE task_id=? AND projection_generation=?
-                """,
-                (intent.task.task_id, intent.projection_generation),
-            ).fetchone()
-            if existing is not None:
-                if (
-                    str(existing["projection_id"]) != intent.projection_id
-                    or str(existing["idempotency_key"]) != intent.idempotency_key
-                    or str(existing["request_sha256"]) != request_sha
-                ):
-                    raise ProjectionRecoveryError(
-                        "PROJECTION_INTENT_IDEMPOTENCY_CONFLICT",
-                        409,
-                    )
-                connection.commit()
-                return {
-                    "projection_id": intent.projection_id,
-                    "task_id": intent.task.task_id,
-                    "state": str(existing["state"]),
-                    "idempotent": True,
-                }
-
-            connection.execute(
-                """
-                INSERT INTO task_projection_intents(
-                  projection_id,task_id,bridge_job_id,projection_generation,
-                  idempotency_key,request_sha256,task_payload_sha256,intent_json,
-                  state,last_error,created_at,updated_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    intent.projection_id,
-                    intent.task.task_id,
-                    intent.binding.bridge_job_id,
-                    intent.projection_generation,
-                    intent.idempotency_key,
-                    request_sha,
-                    intent.task.payload_sha256,
-                    intent_text,
-                    ProjectionState.PENDING.value,
-                    None,
-                    now,
-                    now,
-                ),
-            )
-            connection.commit()
-            return {
-                "projection_id": intent.projection_id,
-                "task_id": intent.task.task_id,
-                "state": ProjectionState.PENDING.value,
-                "idempotent": False,
-            }
-
-    def _task_row_payload(
-        self,
-        row: sqlite3.Row,
-    ) -> dict[str, Any]:
-        try:
-            success = json.loads(row["success_criteria_json"])
-            constraints = json.loads(row["constraints_json"])
-            capabilities = json.loads(row["required_capabilities_json"])
-            metadata = json.loads(row["metadata_json"])
-        except (TypeError, json.JSONDecodeError) as exc:
-            raise ProjectionRecoveryError("CANONICAL_TASK_JSON_INVALID", 409) from exc
-
-        if (
-            not isinstance(success, list)
-            or not isinstance(constraints, Mapping)
-            or not isinstance(capabilities, list)
-            or not isinstance(metadata, Mapping)
-        ):
-            raise ProjectionRecoveryError("CANONICAL_TASK_SHAPE_INVALID", 409)
-
-        return {
-            "task_id": str(row["task_id"]),
-            "goal": str(row["goal"]),
-            "instructions": str(row["instructions"]),
-            "success_criteria": success,
-            "constraints": dict(constraints),
-            "required_capabilities": capabilities,
-            "metadata": dict(metadata),
-            "priority": int(row["priority"]),
-            "max_attempts": int(row["max_attempts"]),
-            "deadline": row["deadline"],
-        }
-
-    def _verify_existing_task(
-        self,
-        row: sqlite3.Row,
-        intent: CanonicalTaskProjectionIntent,
-    ) -> int:
-        observed = self._task_row_payload(row)
-        observed_hash = sha256_json(observed)
-        if observed_hash != intent.task.payload_sha256:
-            raise ProjectionRecoveryError(
-                "CANONICAL_TASK_PROJECTION_IDENTITY_CONFLICT",
-                409,
-            )
-        return int(row["revision"])
-
-    @staticmethod
-    def _required_task_columns() -> set[str]:
-        return {
-            "task_id",
-            "goal",
-            "instructions",
-            "success_criteria_json",
-            "required_capabilities_json",
-            "constraints_json",
-            "metadata_json",
-            "priority",
-            "max_attempts",
-            "attempt",
-            "status",
-            "claimed_by",
-            "lease_token_hash",
-            "lease_expires_at",
-            "result_json",
-            "verification_json",
-            "revision",
-            "created_at",
-            "updated_at",
-        }
-
-    def _insert_task(
-        self,
-        connection: sqlite3.Connection,
-        intent: CanonicalTaskProjectionIntent,
-    ) -> int:
-        columns = self._columns(connection, "tasks")
-        if not self._required_task_columns().issubset(columns):
-            raise ProjectionRecoveryError("TASK_SCHEMA_RECOVERY_UNSUPPORTED", 503)
-
-        now = _now()
-        values: dict[str, Any] = {
-            "task_id": intent.task.task_id,
-            "goal": intent.task.goal,
-            "instructions": intent.task.instructions,
-            "success_criteria_json": _canonical(
-                [dict(x) for x in intent.task.success_criteria]
-            ).decode("utf-8"),
-            "required_capabilities_json": "[]",
-            "constraints_json": _canonical(dict(intent.task.constraints)).decode("utf-8"),
-            "metadata_json": _canonical(dict(intent.task.metadata)).decode("utf-8"),
-            "deadline": intent.task.deadline,
-            "priority": intent.task.priority,
-            "max_attempts": intent.task.max_attempts,
-            "attempt": 0,
-            "status": "QUEUED",
-            "claimed_by": None,
-            "lease_token_hash": None,
-            "lease_expires_at": None,
-            "result_json": None,
-            "verification_json": None,
-            "revision": 1,
-            "created_at": now,
-            "updated_at": now,
-        }
-        for optional in (
-            "result_digest",
-            "result_idempotency_key",
-        ):
-            if optional in columns:
-                values[optional] = None
-
-        names = [name for name in values if name in columns]
-        placeholders = ",".join("?" for _ in names)
-        connection.execute(
-            f'INSERT INTO tasks ({",".join(chr(34)+n+chr(34) for n in names)}) '
-            f"VALUES ({placeholders})",
-            tuple(values[name] for name in names),
-        )
-        self._insert_task_created_event(connection, intent)
-        return 1
-
-    def _insert_task_created_event(
-        self,
-        connection: sqlite3.Connection,
-        intent: CanonicalTaskProjectionIntent,
-    ) -> None:
-        table, columns = self._event_table(connection)
-        event = {
-            "schema": "aios.task-projection-recovery.event.v1",
-            "task_id": intent.task.task_id,
-            "bridge_job_id": intent.binding.bridge_job_id,
-            "projection_id": intent.projection_id,
-            "projection_generation": intent.projection_generation,
-            "task_payload_sha256": intent.task.payload_sha256,
-            "source_artifact_ref": intent.source_artifact.ref,
-            "source_artifact_sha256": intent.source_artifact.sha256,
-            "recovery": True,
-        }
-        values: dict[str, Any] = {
-            "task_id": intent.task.task_id,
-            "event_type": "TASK_CREATED",
-        }
-        payload_text = _canonical(event).decode("utf-8")
-        if "payload_json" in columns:
-            values["payload_json"] = payload_text
-        elif "payload" in columns:
-            values["payload"] = payload_text
-        else:
-            raise ProjectionRecoveryError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
-        if "created_at" in columns:
-            values["created_at"] = _now()
-        if "agent_id" in columns:
-            values["agent_id"] = "control-plane-projection-recovery"
-        if "actor_id" in columns:
-            values["actor_id"] = "control-plane-projection-recovery"
-
-        names = list(values)
-        connection.execute(
-            f'INSERT INTO "{table}" ({",".join(chr(34)+n+chr(34) for n in names)}) '
-            f'VALUES ({",".join("?" for _ in names)})',
-            tuple(values[name] for name in names),
-        )
-
-    def reconcile(
-        self,
-        intent: CanonicalTaskProjectionIntent,
-    ) -> dict[str, Any]:
-        # Persist first so a crash before Task creation leaves a durable PENDING
-        # intent for startup/supervisor reconciliation.
-        self.persist_intent(intent)
-
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._ensure_control_tables(connection)
-            existing_receipt = connection.execute(
-                "SELECT * FROM task_projection_receipts WHERE projection_id=?",
-                (intent.projection_id,),
-            ).fetchone()
-            if existing_receipt is not None:
-                if (
-                    str(existing_receipt["task_id"]) != intent.task.task_id
-                    or str(existing_receipt["bridge_job_id"]) != intent.binding.bridge_job_id
-                    or str(existing_receipt["task_payload_sha256"])
-                    != intent.task.payload_sha256
-                ):
-                    raise ProjectionRecoveryError(
-                        "PROJECTION_RECEIPT_IDENTITY_CONFLICT",
-                        409,
-                    )
-                connection.commit()
-                receipt = json.loads(existing_receipt["receipt_json"])
-                receipt["idempotent"] = True
-                return receipt
-
-            row = connection.execute(
-                "SELECT * FROM tasks WHERE task_id=?",
-                (intent.task.task_id,),
-            ).fetchone()
-            created_new = False
-            if row is None:
-                revision = self._insert_task(connection, intent)
-                created_new = True
-                row = connection.execute(
-                    "SELECT * FROM tasks WHERE task_id=?",
-                    (intent.task.task_id,),
-                ).fetchone()
-                if row is None:
-                    raise ProjectionRecoveryError(
-                        "TASK_RECOVERY_OBSERVATION_FAILED",
-                        503,
-                    )
-            else:
-                revision = self._verify_existing_task(row, intent)
-
-            # Observation after mutation is mandatory.
-            revision = self._verify_existing_task(row, intent)
-            observed_at = _now()
-            receipt = {
-                "schema": RECEIPT_SCHEMA,
-                "projection_id": intent.projection_id,
-                "governed_task_id": intent.binding.governed_task_id,
-                "canonical_task_id": intent.task.task_id,
-                "bridge_job_id": intent.binding.bridge_job_id,
-                "projection_generation": intent.projection_generation,
-                "task_payload_sha256": intent.task.payload_sha256,
-                "canonical_revision": revision,
-                "state": ProjectionState.CONVERGED.value,
-                "created_new_row": created_new,
-                "source_artifact": asdict(intent.source_artifact),
-                "observed_at": observed_at,
-                "idempotent": False,
-            }
-            connection.execute(
-                """
-                INSERT INTO task_projection_receipts(
-                  projection_id,task_id,bridge_job_id,projection_generation,
-                  task_payload_sha256,canonical_revision,state,created_new_row,
-                  observed_at,receipt_json
-                ) VALUES (?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    intent.projection_id,
-                    intent.task.task_id,
-                    intent.binding.bridge_job_id,
-                    intent.projection_generation,
-                    intent.task.payload_sha256,
-                    revision,
-                    ProjectionState.CONVERGED.value,
-                    1 if created_new else 0,
-                    observed_at,
-                    _canonical(receipt).decode("utf-8"),
-                ),
-            )
-            connection.execute(
-                """
-                UPDATE task_projection_intents
-                   SET state=?, last_error=NULL, updated_at=?
-                 WHERE projection_id=?
-                """,
-                (
-                    ProjectionState.CONVERGED.value,
-                    observed_at,
-                    intent.projection_id,
-                ),
-            )
-            connection.commit()
-            return receipt
-
-    def get_projection(
-        self,
-        task_id: str,
-    ) -> dict[str, Any] | None:
-        task_id = _string(task_id, "TASK_ID_INVALID", TASK_ID_RE)
-        with self._connect() as connection:
-            self._ensure_control_tables(connection)
-            intent = connection.execute(
-                """
-                SELECT * FROM task_projection_intents
-                 WHERE task_id=?
-                 ORDER BY projection_generation DESC
-                 LIMIT 1
-                """,
-                (task_id,),
-            ).fetchone()
-            if intent is None:
-                return None
-            receipt = connection.execute(
-                "SELECT receipt_json FROM task_projection_receipts WHERE projection_id=?",
-                (intent["projection_id"],),
-            ).fetchone()
-            return {
-                "projection_id": intent["projection_id"],
-                "task_id": task_id,
-                "bridge_job_id": intent["bridge_job_id"],
-                "projection_generation": int(intent["projection_generation"]),
-                "state": intent["state"],
-                "last_error": intent["last_error"],
-                "task_payload_sha256": intent["task_payload_sha256"],
-                "receipt": json.loads(receipt[0]) if receipt else None,
-            }

active-runtime/app/aios_agent_task_projection_recovery_http.py

@@ -1,44 +0,0 @@
-"""HTTP integration helpers for canonical Task projection recovery.
-
-This module intentionally contains no HTTP server. Existing Task Plane /
-projection-owner handlers should call ``recover_from_json`` only after their
-normal service-side ``agent-task:control`` authorization succeeds.
-"""
-from __future__ import annotations
-
-from pathlib import Path
-from typing import Any, Mapping
-
-from aios_agent_task_projection_recovery import (
-    CanonicalTaskProjectionIntent,
-    CanonicalTaskProjectionStore,
-    ProjectionRecoveryError,
-)
-
-
-def recover_from_json(
-    db_path: Path | str,
-    task_id: str,
-    body: Mapping[str, Any],
-) -> tuple[int, dict[str, Any]]:
-    try:
-        intent = CanonicalTaskProjectionIntent.from_mapping(body)
-        if intent.task.task_id != task_id:
-            raise ProjectionRecoveryError("PROJECTION_TASK_IDENTITY_MISMATCH", 409)
-        result = CanonicalTaskProjectionStore(db_path).reconcile(intent)
-        return (200 if result.get("idempotent") else 201), result
-    except ProjectionRecoveryError as exc:
-        return exc.status, {"error": exc.code}
-
-
-def get_projection(
-    db_path: Path | str,
-    task_id: str,
-) -> tuple[int, dict[str, Any]]:
-    try:
-        result = CanonicalTaskProjectionStore(db_path).get_projection(task_id)
-    except ProjectionRecoveryError as exc:
-        return exc.status, {"error": exc.code}
-    if result is None:
-        return 404, {"error": "TASK_PROJECTION_NOT_FOUND"}
-    return 200, result

active-runtime/app/aios_agent_task_retry_extension.py

@@ -0,0 +1,427 @@
+"""Owner-controlled, CAS-bound retry extension for exhausted Online Agent Tasks."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import hashlib
+import hmac
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import json
+import os
+from pathlib import Path
+import re
+import sqlite3
+from typing import Any, Mapping
+
+TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
+KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
+MAX_BODY = 64 * 1024
+AUTHORIZE_EXTENSION_ID_ENV = "AIOS_AGENT_TASK_AUTHORIZATION_ID"
+
+
+class RetryExtensionError(RuntimeError):
+    def __init__(self, code: str, status: int = 409) -> None:
+        super().__init__(code)
+        self.code = code
+        self.status = status
+
+
+def _canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def _sha(value: object) -> str:
+    return hashlib.sha256(_canonical(value)).hexdigest()
+
+
+def _required_authorization_id() -> str:
+    value = os.environ.get(AUTHORIZE_EXTENSION_ID_ENV, "").strip()
+    if not value:
+        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_MISSING")
+    if KEY_RE.fullmatch(value) is None:
+        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_INVALID")
+    return value
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _require_string(value: object, code: str, pattern: re.Pattern[str] | None = None) -> str:
+    if not isinstance(value, str) or not value.strip():
+        raise RetryExtensionError(code, 400)
+    value = value.strip()
+    if pattern is not None and pattern.fullmatch(value) is None:
+        raise RetryExtensionError(code, 400)
+    return value
+
+
+@dataclass(frozen=True)
+class RetryExtensionRequest:
+    expected_status: str
+    expected_revision: int
+    expected_attempt: int
+    expected_max_attempts: int
+    next_max_attempts: int
+    previous_verification_sha256: str
+    authorization_id: str
+    idempotency_key: str
+
+    @classmethod
+    def from_mapping(cls, value: Mapping[str, Any]) -> "RetryExtensionRequest":
+        allowed = {
+            "expected_status", "expected_revision", "expected_attempt", "expected_max_attempts",
+            "next_max_attempts", "previous_verification_sha256", "authorization_id", "idempotency_key",
+        }
+        if set(value) != allowed:
+            raise RetryExtensionError("RETRY_EXTENSION_FIELDS_INVALID", 400)
+        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
+        if status != "FAILED":
+            raise RetryExtensionError("EXPECTED_STATUS_INVALID", 400)
+        ints: dict[str, int] = {}
+        for field in ("expected_revision", "expected_attempt", "expected_max_attempts", "next_max_attempts"):
+            item = value[field]
+            if not isinstance(item, int) or isinstance(item, bool) or item < 0:
+                raise RetryExtensionError("RETRY_EXTENSION_INTEGER_INVALID", 400)
+            ints[field] = item
+        if ints["expected_attempt"] != ints["expected_max_attempts"]:
+            raise RetryExtensionError("RETRY_EXTENSION_NOT_EXHAUSTED", 409)
+        if ints["next_max_attempts"] != ints["expected_max_attempts"] + 1:
+            raise RetryExtensionError("RETRY_EXTENSION_MUST_BE_BOUNDED_ONE_STEP", 400)
+        if ints["next_max_attempts"] > 50:
+            raise RetryExtensionError("RETRY_EXTENSION_LIMIT_EXCEEDED", 400)
+        verification = _require_string(value["previous_verification_sha256"], "VERIFICATION_SHA256_INVALID")
+        if re.fullmatch(r"[0-9a-f]{64}", verification) is None:
+            raise RetryExtensionError("VERIFICATION_SHA256_INVALID", 400)
+        authorization = _require_string(value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE)
+        key = _require_string(value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE)
+        return cls(
+            status,
+            ints["expected_revision"],
+            ints["expected_attempt"],
+            ints["expected_max_attempts"],
+            ints["next_max_attempts"],
+            verification,
+            authorization,
+            key,
+        )
+
+    def public(self) -> dict[str, Any]:
+        return {
+            "expected_status": self.expected_status,
+            "expected_revision": self.expected_revision,
+            "expected_attempt": self.expected_attempt,
+            "expected_max_attempts": self.expected_max_attempts,
+            "next_max_attempts": self.next_max_attempts,
+            "previous_verification_sha256": self.previous_verification_sha256,
+            "authorization_id": self.authorization_id,
+            "idempotency_key": self.idempotency_key,
+        }
+
+
+class RetryExtensionStore:
+    """Owns the official mutation. Direct/manual DB edits remain forbidden."""
+
+    def __init__(self, db_path: Path) -> None:
+        self.db_path = Path(db_path)
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(self.db_path, timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA foreign_keys=ON")
+        connection.execute("PRAGMA busy_timeout=30000")
+        return connection
+
+    @staticmethod
+    def _columns(connection: sqlite3.Connection, table: str) -> dict[str, sqlite3.Row]:
+        return {str(row["name"]): row for row in connection.execute(f'PRAGMA table_info("{table}")')}
+
+    @staticmethod
+    def _event_table(connection: sqlite3.Connection) -> tuple[str, dict[str, sqlite3.Row]]:
+        tables = {
+            row["name"]
+            for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")
+        }
+        for name in ("task_events", "events"):
+            if name not in tables:
+                continue
+            columns = RetryExtensionStore._columns(connection, name)
+            if "task_id" in columns and ("event_type" in columns or "type" in columns):
+                return name, columns
+        raise RetryExtensionError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
+
+    @staticmethod
+    def _verification_hash(raw: object) -> str:
+        if raw in (None, ""):
+            value: object = {}
+        elif isinstance(raw, str):
+            try:
+                value = json.loads(raw)
+            except json.JSONDecodeError as exc:
+                raise RetryExtensionError("TASK_VERIFICATION_INVALID", 409) from exc
+        else:
+            value = raw
+        return _sha(value)
+
+    @staticmethod
+    def _ensure_extension_table(connection: sqlite3.Connection) -> None:
+        connection.execute(
+            """
+            CREATE TABLE IF NOT EXISTS task_retry_extensions (
+              task_id TEXT NOT NULL,
+              idempotency_key TEXT NOT NULL,
+              request_sha256 TEXT NOT NULL,
+              authorization_id TEXT NOT NULL,
+              previous_verification_sha256 TEXT NOT NULL,
+              previous_max_attempts INTEGER NOT NULL,
+              next_max_attempts INTEGER NOT NULL,
+              expected_revision INTEGER NOT NULL,
+              applied_revision INTEGER NOT NULL,
+              created_at TEXT NOT NULL,
+              PRIMARY KEY(task_id, idempotency_key)
+            )
+            """
+        )
+
+    @staticmethod
+    def _insert_event(
+        connection: sqlite3.Connection,
+        task_id: str,
+        payload: Mapping[str, Any],
+    ) -> None:
+        table, columns = RetryExtensionStore._event_table(connection)
+        values: dict[str, Any] = {"task_id": task_id}
+        if "event_type" in columns:
+            values["event_type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
+        else:
+            values["type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
+        payload_text = json.dumps(payload, sort_keys=True, separators=(",", ":"))
+        if "payload_json" in columns:
+            values["payload_json"] = payload_text
+        elif "payload" in columns:
+            values["payload"] = payload_text
+        else:
+            raise RetryExtensionError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
+        if "created_at" in columns:
+            values["created_at"] = _now()
+        if "agent_id" in columns:
+            values["agent_id"] = "owner-control"
+        if "actor_id" in columns:
+            values["actor_id"] = "owner-control"
+        names = list(values)
+        sql = f'INSERT INTO "{table}" ({",".join(f"""\"{name}\"""" for name in names)}) VALUES ({",".join("?" for _ in names)})'
+        connection.execute(sql, tuple(values[name] for name in names))
+
+    def extend(self, task_id: str, request: RetryExtensionRequest) -> dict[str, Any]:
+        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
+        required_authorization_id = _required_authorization_id()
+        if request.authorization_id != required_authorization_id:
+            raise RetryExtensionError("RETRY_EXTENSION_AUTHORIZATION_ID_MISMATCH", 403)
+        request_payload = request.public()
+        request_sha = _sha(request_payload)
+        with self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            self._ensure_extension_table(connection)
+            replay = connection.execute(
+                "SELECT * FROM task_retry_extensions WHERE task_id=? AND idempotency_key=?",
+                (task_id, request.idempotency_key),
+            ).fetchone()
+            if replay is not None:
+                if replay["request_sha256"] != request_sha:
+                    raise RetryExtensionError("RETRY_EXTENSION_IDEMPOTENCY_CONFLICT", 409)
+                connection.commit()
+                return {
+                    "task_id": task_id,
+                    "status": "QUEUED",
+                    "attempt": request.expected_attempt,
+                    "max_attempts": int(replay["next_max_attempts"]),
+                    "revision": int(replay["applied_revision"]),
+                    "idempotent": True,
+                    "authorization_id": replay["authorization_id"],
+                    "previous_verification_sha256": replay["previous_verification_sha256"],
+                }
+
+            columns = self._columns(connection, "tasks")
+            required = {
+                "task_id", "status", "attempt", "max_attempts", "revision", "claimed_by",
+                "lease_token_hash", "lease_expires_at", "verification_json",
+            }
+            if not required.issubset(columns):
+                raise RetryExtensionError("TASK_SCHEMA_RETRY_EXTENSION_UNSUPPORTED", 503)
+            task = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
+            if task is None:
+                raise RetryExtensionError("TASK_NOT_FOUND", 404)
+            actual_verification_sha = self._verification_hash(task["verification_json"])
+            if actual_verification_sha != request.previous_verification_sha256:
+                raise RetryExtensionError("RETRY_EXTENSION_VERIFICATION_DRIFT", 409)
+            if (
+                task["status"] != request.expected_status
+                or int(task["revision"]) != request.expected_revision
+                or int(task["attempt"]) != request.expected_attempt
+                or int(task["max_attempts"]) != request.expected_max_attempts
+            ):
+                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
+            for lease_field in ("lease_token_hash", "lease_expires_at"):
+                if lease_field in columns and task[lease_field] not in (None, ""):
+                    raise RetryExtensionError("RETRY_EXTENSION_ACTIVE_LEASE_DENY", 409)
+
+            previous_claimed_by = task["claimed_by"]
+            applied_revision = request.expected_revision + 1
+            cursor = connection.execute(
+                """
+                UPDATE tasks
+                   SET status='QUEUED', max_attempts=?, revision=?, claimed_by=NULL,
+                       lease_token_hash=NULL, lease_expires_at=NULL
+                 WHERE task_id=? AND status=? AND revision=? AND attempt=? AND max_attempts=?
+                   AND claimed_by IS ?
+                   AND lease_token_hash IS NULL AND lease_expires_at IS NULL
+                """,
+                (
+                    request.next_max_attempts,
+                    applied_revision,
+                    task_id,
+                    request.expected_status,
+                    request.expected_revision,
+                    request.expected_attempt,
+                    request.expected_max_attempts,
+                    previous_claimed_by,
+                ),
+            )
+            if cursor.rowcount != 1:
+                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
+
+            event_payload = {
+                "schema": "aios.task-retry-extension.event.v1",
+                "task_id": task_id,
+                "authorization_id": request.authorization_id,
+                "idempotency_key": request.idempotency_key,
+                "previous_verification_sha256": request.previous_verification_sha256,
+                "previous_max_attempts": request.expected_max_attempts,
+                "next_max_attempts": request.next_max_attempts,
+                "previous_revision": request.expected_revision,
+                "applied_revision": applied_revision,
+                "request_sha256": request_sha,
+                "previous_claimed_by": previous_claimed_by,
+                "stale_terminal_claim_normalized": previous_claimed_by not in (None, ""),
+            }
+            self._insert_event(connection, task_id, event_payload)
+            connection.execute(
+                """
+                INSERT INTO task_retry_extensions(
+                  task_id,idempotency_key,request_sha256,authorization_id,previous_verification_sha256,
+                  previous_max_attempts,next_max_attempts,expected_revision,applied_revision,created_at
+                ) VALUES (?,?,?,?,?,?,?,?,?,?)
+                """,
+                (
+                    task_id,
+                    request.idempotency_key,
+                    request_sha,
+                    request.authorization_id,
+                    request.previous_verification_sha256,
+                    request.expected_max_attempts,
+                    request.next_max_attempts,
+                    request.expected_revision,
+                    applied_revision,
+                    _now(),
+                ),
+            )
+            connection.commit()
+            return {
+                "task_id": task_id,
+                "status": "QUEUED",
+                "attempt": request.expected_attempt,
+                "max_attempts": request.next_max_attempts,
+                "revision": applied_revision,
+                "idempotent": False,
+                "authorization_id": request.authorization_id,
+                "previous_verification_sha256": request.previous_verification_sha256,
+            }
+
+
+class RetryExtensionHandler(BaseHTTPRequestHandler):
+    store: RetryExtensionStore | None = None
+    control_token: str = ""
+
+    def log_message(self, *_args: Any) -> None:
+        return
+
+    def _json(self, value: Mapping[str, Any], status: int) -> None:
+        data = json.dumps(dict(value), sort_keys=True, separators=(",", ":")).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def _authorized(self) -> bool:
+        header = self.headers.get("Authorization", "")
+        return (
+            header.startswith("Bearer ")
+            and bool(self.control_token)
+            and hmac.compare_digest(header[7:], self.control_token)
+        )
+
+    def do_GET(self) -> None:
+        if self.path == "/health":
+            self._json({"status": "ok", "service": "aios-agent-task-retry-extension"}, 200)
+        else:
+            self._json({"error": "NOT_FOUND"}, 404)
+
+    def do_POST(self) -> None:
+        match = re.fullmatch(r"/v1/tasks/([^/]+)/retry-extension", self.path)
+        if match is None:
+            self._json({"error": "NOT_FOUND"}, 404)
+            return
+        if not self._authorized():
+            self._json({"error": "UNAUTHORIZED"}, 401)
+            return
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+        except ValueError:
+            self._json({"error": "CONTENT_LENGTH_INVALID"}, 400)
+            return
+        if length < 1 or length > MAX_BODY:
+            self._json({"error": "REQUEST_SIZE_INVALID"}, 413)
+            return
+        try:
+            value = json.loads(self.rfile.read(length).decode("utf-8"))
+            if not isinstance(value, Mapping):
+                raise ValueError
+            request = RetryExtensionRequest.from_mapping(value)
+            if self.store is None:
+                raise RetryExtensionError("RUNTIME_UNAVAILABLE", 503)
+            result = self.store.extend(match.group(1), request)
+            self._json(result, 200 if result["idempotent"] else 201)
+        except RetryExtensionError as exc:
+            self._json({"error": exc.code}, exc.status)
+        except (UnicodeDecodeError, json.JSONDecodeError, ValueError):
+            self._json({"error": "REQUEST_INVALID"}, 400)
+
+
+def load_control_token(path: Path) -> str:
+    if path.is_symlink() or not path.is_file():
+        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_UNAVAILABLE")
+    value = path.read_text(encoding="utf-8").strip()
+    if len(value) < 32:
+        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_INVALID")
+    return value
+
+
+def serve() -> None:
+    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
+    _required_authorization_id()
+    token_path = Path(
+        os.environ.get(
+            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
+            str(Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials")) / "agent_task_control_token"),
+        )
+    )
+    host = os.environ.get("AIOS_TASK_RETRY_HOST", "127.0.0.1")
+    port = int(os.environ.get("AIOS_TASK_RETRY_PORT", "18941"))
+    RetryExtensionHandler.store = RetryExtensionStore(db)
+    RetryExtensionHandler.control_token = load_control_token(token_path)
+    ThreadingHTTPServer((host, port), RetryExtensionHandler).serve_forever()
+
+
+if __name__ == "__main__":
+    serve()

active-runtime/app/aios_authority_git_executor.py

@@ -94,23 +94,89 @@ class AuthorityGitExecutor:
         self._git(["worktree", "add", "--detach", str(path), base_oid])
         return path
 
-    def create_task_branch(self, branch: str, base_oid: str) -> str:
-        """Create an isolated agent branch once, using an empty-ref CAS."""
-        ref = branch if branch.startswith("refs/heads/") else "refs/heads/" + branch
-        if not TASK_BRANCH_RE.fullmatch(ref):
+    def recover_failed_detached_worktree_exact(
+        self,
+        *,
+        path: Path,
+        expected_oid: str,
+        stale_oid: str,
+        target_ref: str,
+    ) -> str:
+        """Recreate one exact clean, detached, single-attempt worktree at its durable head."""
+        _oid(expected_oid, "expected_oid")
+        _oid(stale_oid, "stale_oid")
+        if not TASK_BRANCH_RE.fullmatch(target_ref):
             raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
-        _oid(base_oid, "base_oid")
-        if not self.commit_exists(base_oid):
-            raise AuthorityGitError("BASE_COMMIT_NOT_FOUND")
-        current = self.read_ref(ref)
+        if self.read_ref(target_ref) is not None:
+            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
+        if (
+            not path.is_absolute()
+            or path.parent != self.worktree_root
+            or path.name in {"", ".", ".."}
+            or path.is_symlink()
+            or not path.is_dir()
+        ):
+            raise AuthorityGitError("WORKTREE_RECOVERY_PATH_INVALID")
+        head = subprocess.run(
+            ["git", "-C", str(path), "rev-parse", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if head.returncode != 0 or head.stdout.strip() != stale_oid or stale_oid == expected_oid:
+            raise AuthorityGitError("WORKTREE_RECOVERY_HEAD_INVALID")
+        symbolic = subprocess.run(
+            ["git", "-C", str(path), "symbolic-ref", "-q", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if symbolic.returncode != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_DETACHED")
+        status = subprocess.run(
+            ["git", "-C", str(path), "status", "--porcelain=v1", "--untracked-files=all"],
+            text=True, capture_output=True, check=False,
+        )
+        if status.returncode != 0 or status.stdout:
+            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_CLEAN")
+        parents = self._git(["rev-list", "--parents", "-n", "1", stale_oid]).split()
+        if parents != [stale_oid, expected_oid]:
+            raise AuthorityGitError("WORKTREE_RECOVERY_LINEAGE_INVALID")
+        registered = [
+            line.removeprefix("worktree ")
+            for line in self._git(["worktree", "list", "--porcelain"]).splitlines()
+            if line.startswith("worktree ")
+        ]
+        if registered.count(str(path)) != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_REGISTRATION_INVALID")
+        self._git(["worktree", "remove", "--force", str(path)])
+        if path.exists() or path.is_symlink():
+            raise AuthorityGitError("WORKTREE_RECOVERY_REMOVE_FAILED")
+        recreated = self.create_detached_worktree(expected_oid, path.name, path.parent)
+        readback = subprocess.run(
+            ["git", "-C", str(recreated), "rev-parse", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        detached = subprocess.run(
+            ["git", "-C", str(recreated), "symbolic-ref", "-q", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if readback.returncode != 0 or readback.stdout.strip() != expected_oid or detached.returncode != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_READBACK_MISMATCH")
+        return stale_oid
+
+    def create_task_branch_CAS(self, branch: str, expected_base_oid: str, new_oid: str) -> str:
+        if not TASK_BRANCH_RE.fullmatch(branch):
+            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
+        _oid(expected_base_oid, "expected_base_oid")
+        _oid(new_oid, "new_oid")
+        current = self.read_ref(branch)
         if current is not None:
-            if current == base_oid:
-                return current
-            raise AuthorityGitError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
-        self._git(["update-ref", ref, base_oid, "0" * 40])
-        readback = self.read_ref(ref)
-        if readback != base_oid:
-            raise AuthorityGitError("AUTHORITY_CAS_READBACK_MISMATCH")
+            if current == new_oid:
+                return new_oid
+            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
+        if not self.ancestry_check(expected_base_oid, new_oid):
+            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
+        self._git(["update-ref", branch, new_oid, "0" * 40])
+        readback = self.read_ref(branch)
+        if readback != new_oid:
+            raise AuthorityGitError("AUTHORITY_CREATE_READBACK_MISMATCH")
         return readback
 
     def advance_task_branch_CAS(self, branch: str, expected_oid: str, new_oid: str) -> str:

active-runtime/app/aios_chatgpt_actions_api.py

@@ -22,7 +22,6 @@ from gitea_tag_publication import (
     TagPublisher,
     redact,
     validate_version,
-    validate_gitea_api_url,
 )
 from orchestrator.action_monitor import ActionMonitor
 from silent_release_hardening import (
@@ -309,7 +308,8 @@ def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
         raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
 
 def existing_tag_target(tag: str) -> str | None:
-    validate_version(tag)
+    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
+        raise ValueError('invalid release version')
     try:
         result = run_authoritative_git(
             ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
@@ -344,7 +344,7 @@ def required_authoritative_git_dir() -> Path:
 
 def publication_publisher() -> TagPublisher:
     authoritative_repo = required_authoritative_git_dir()
-    publisher = TagPublisher(
+    return TagPublisher(
         WS,
         GitTagBackend(WS, authoritative_repo=authoritative_repo),
         GiteaTagClient(
@@ -355,10 +355,6 @@ def publication_publisher() -> TagPublisher:
         ),
         os.getenv('AIOS_GITOPS_GITEA_REMOTE','gitea'),
     )
-    publisher.baseline_path = Path(os.getenv(
-        'AIOS_GITOPS_BASELINE_AUTHORITY', str(WS / 'baseline' / 'current.json')
-    ))
-    return publisher
 
 def commit(paths, msg):
     ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
@@ -514,15 +510,7 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj({'error':redact(exc)},413)
                 except (AuthoritativeGitError, RuntimeError) as exc:
                     return self.sendj({'error':redact(exc)},503)
-                payload = {'from': frm, 'to': to, 'diff': diff}
-                payload.update({
-                    key: diff[key]
-                    for key in (
-                        'from_oid', 'to_oid', 'changed_paths', 'stats',
-                        'total_size_bytes', 'truncated', 'patch_limit_bytes',
-                    )
-                })
-                return self.sendj(payload)
+                return self.sendj({'from':frm,'to':to,'diff':diff})
             if path in ('/api/patch','/api/patches','/api/branches','/patch'):
                 snapshot = repository_snapshot(
                     git_dir=AUTHORITATIVE_GIT_DIR,
@@ -634,8 +622,7 @@ class H(BaseHTTPRequestHandler):
                     return self.sendj(
                         service.get_capability_status(candidate_id)
                     )
-                result = service.get_release_saga(candidate_id)
-                return self.sendj(result, 404 if result.get('status') == 'NOT_FOUND' else 200)
+                return self.sendj(service.get_release_saga(candidate_id))
             if path == '/getRecoveryStatus':
                 return self.sendj(
                     silent_release_service().get_recovery_status()
@@ -786,10 +773,7 @@ class H(BaseHTTPRequestHandler):
         a=self.need('tag:create');
         if not a: return
         ver=data.get('version') or data.get('tag')
-        try:
-            validate_version(ver)
-        except ValueError:
-            return self.sendj({'error':'version must match VxRxCx'},400)
+        if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
         if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
             return self.sendj({
                 'error':'production_tag_evidence_required',
@@ -963,7 +947,6 @@ def api_spec():
     return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
 
 def main():
-    validate_gitea_api_url(os.getenv('AIOS_GITOPS_GITEA_API_URL', ''))
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()

active-runtime/app/aios_chatgpt_bridge_v2.py

@@ -13,7 +13,10 @@ BRIDGE_OPERATIONS = (
     "getGovernedWriteCapabilities",
     "createGovernedTask",
     "projectOnlineAgentExecution",
+    "registerOnlineAgentExecutionPlan",
     "acquireWriterLease",
+    "bootstrapWriterLease",
+    "renewWriterLease",
     "commitFileGoverned",
     "commitFilesGoverned",
     "getGitOpsJob",
@@ -31,8 +34,14 @@ BRIDGE_OPERATIONS = (
 
 OPERATION_REQUIRED_FIELDS = {
     "createGovernedTask": ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key"),
-    "projectOnlineAgentExecution": ("task_id", "required_capabilities"),
+    "projectOnlineAgentExecution": ("task_id",),
+    "registerOnlineAgentExecutionPlan": (
+        "schema", "task_id", "job_id", "source_head_oid", "generation",
+        "idempotency_key", "execution",
+    ),
     "acquireWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
+    "bootstrapWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
+    "renewWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
     "commitFileGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "path", "content_base64", "message"),
     "commitFilesGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "files", "message"),
     "getGitOpsJob": ("job_id",),
@@ -48,77 +57,67 @@ OPERATION_REQUIRED_FIELDS = {
     "getControlPlaneSnapshot": (),
 }
 
-_OPERATION_PATHS = {
-    "createGovernedTask": "/v2/governed-task",
-    "projectOnlineAgentExecution": "/v2/execution-envelope",
-    "acquireWriterLease": "/v2/writer-lease",
-    "commitFileGoverned": "/v2/commit-file",
-    "commitFilesGoverned": "/v2/commit-files",
-    "getGitOpsJob": "/v2/job",
-    "resumeGitOpsJob": "/v2/job/resume",
-    "reconcileGitOpsJob": "/v2/job/reconcile",
-    "getTagPublicationStatus": "/v2/tag/status",
-    "getReleaseConsistency": "/v2/release/consistency",
-    "runReleaseAcceptance": "/v2/release/acceptance",
-}
-
-
-def operation_contracts() -> dict[str, dict[str, object]]:
-    """Return the runtime contract consumed by adapters and schema tooling."""
-    return {
-        operation: {
+BRIDGE_OPERATION_CONTRACTS = {
+    "projectOnlineAgentExecution": {
         "method": "POST",
-            "path": _OPERATION_PATHS.get(operation),
-            "required_fields": list(fields),
+        "path": "/v2/execution-envelope",
+        "required_fields": OPERATION_REQUIRED_FIELDS["projectOnlineAgentExecution"],
+        "response_fields": (
+            "schema", "task_id", "job_id", "repository", "base_oid",
+            "expected_branch_oid", "target_branch", "branch_mode", "generation",
+            "idempotency_key", "action", "execution_digest",
+        ),
+    },
+    "registerOnlineAgentExecutionPlan": {
+        "method": "POST",
+        "path": "/v2/execution-plan",
+        "required_fields": OPERATION_REQUIRED_FIELDS["registerOnlineAgentExecutionPlan"],
+        "response_fields": (
+            "schema", "task_id", "job_id", "source_head_oid", "generation",
+            "idempotency_key", "plan_digest", "execution", "execution_digest",
+        ),
+    },
+    "acquireWriterLease": {
+        "method": "POST",
+        "path": "/v2/writer-lease",
+        "required_fields": OPERATION_REQUIRED_FIELDS["acquireWriterLease"],
+        "response_fields": (
+            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
+            "create_target_branch", "worktree_mode", "cas_ref_update_required",
+        ),
+    },
+    "bootstrapWriterLease": {
+        "method": "POST",
+        "path": "/v2/writer-lease/bootstrap",
+        "required_fields": OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"],
+        "response_fields": (
+            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
+            "create_target_branch", "worktree_mode", "cas_ref_update_required",
+            "recovered", "bootstrapped", "runtime_rehydrated",
+            "durable_branch_lease_present", "idempotent",
+        ),
+    },
+    "renewWriterLease": {
+        "method": "POST",
+        "path": "/v2/writer-lease/renew",
+        "required_fields": OPERATION_REQUIRED_FIELDS["renewWriterLease"],
+        "response_fields": (
+            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
+            "recovered", "bootstrapped", "runtime_rehydrated",
+            "durable_branch_lease_present", "idempotent",
+        ),
+    },
+    "commitFileGoverned": {
+        "method": "POST", "path": "/v2/commit-file",
+        "required_fields": OPERATION_REQUIRED_FIELDS["commitFileGoverned"],
+        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
+    },
+    "commitFilesGoverned": {
+        "method": "POST", "path": "/v2/commit-files",
+        "required_fields": OPERATION_REQUIRED_FIELDS["commitFilesGoverned"],
+        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
+    },
 }
-        for operation, fields in OPERATION_REQUIRED_FIELDS.items()
-    }
-
-
-def render_openapi_contract_fragment() -> str:
-    required = "\n".join(
-        f"                - {field}"
-        for field in OPERATION_REQUIRED_FIELDS["commitFilesGoverned"]
-    )
-    return (
-        "  /v2/commit-files:\n"
-        "    post:\n"
-        "      operationId: commitFilesGoverned\n"
-        "      summary: Submit one atomic governed commit containing multiple files\n"
-        "      requestBody:\n"
-        "        required: true\n"
-        "        content:\n"
-        "          application/json:\n"
-        "            schema:\n"
-        "              type: object\n"
-        "              additionalProperties: false\n"
-        "              required:\n"
-        f"{required}\n"
-        "              properties:\n"
-        "                task_id: {type: string}\n"
-        "                job_id: {type: string, description: External durable Job identity for exact completed-replay reconciliation}\n"
-        "                source_lease_epoch: {type: integer, minimum: 1}\n"
-        "                repository: {type: string, example: aios/aios}\n"
-        "                expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}\n"
-        "                target_branch: {type: string, pattern: '^agent/[A-Za-z0-9._/-]+$'}\n"
-        "                generation: {type: integer, minimum: 1}\n"
-        "                idempotency_key: {type: string}\n"
-        "                files:\n"
-        "                  type: array\n"
-        "                  minItems: 1\n"
-        "                  items:\n"
-        "                    type: object\n"
-        "                    additionalProperties: false\n"
-        "                    required: [path, content_base64]\n"
-        "                    properties:\n"
-        "                      path: {type: string, minLength: 1, maxLength: 512}\n"
-        "                      content_base64: {type: string}\n"
-        "                message: {type: string, minLength: 1, maxLength: 200}\n"
-        "      responses:\n"
-        "        '200': {description: Governed commit job and verified branch result}\n"
-        "        '400': {description: Contract or policy rejection}\n"
-        "        '409': {description: Branch CAS or idempotency conflict}\n"
-    )
 
 
 class RuntimeDriftError(RuntimeError):
@@ -196,7 +195,14 @@ class BridgeV2Adapter:
             "legacy_writes_enabled": False,
             "governed_writes_enabled": True,
             "operations": list(BRIDGE_OPERATIONS),
-            "operation_contracts": operation_contracts(),
+            "operation_contracts": {
+                operation: {
+                    **contract,
+                    "required_fields": list(contract["required_fields"]),
+                    "response_fields": list(contract["response_fields"]),
+                }
+                for operation, contract in BRIDGE_OPERATION_CONTRACTS.items()
+            },
             "force_push": False,
             "main_write": False,
             "tag_write": False,
@@ -226,7 +232,10 @@ class BridgeV2Adapter:
 
     def createGovernedTask(self, request: Mapping[str, Any]) -> Any: return self._call("createGovernedTask", request)
     def projectOnlineAgentExecution(self, request: Mapping[str, Any]) -> Any: return self._call("projectOnlineAgentExecution", request)
+    def registerOnlineAgentExecutionPlan(self, request: Mapping[str, Any]) -> Any: return self._call("registerOnlineAgentExecutionPlan", request)
     def acquireWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("acquireWriterLease", request)
+    def bootstrapWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("bootstrapWriterLease", request)
+    def renewWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("renewWriterLease", request)
     def commitFileGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFileGoverned", request)
     def commitFilesGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFilesGoverned", request)
     def getGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("getGitOpsJob", request)

active-runtime/app/aios_continuation_executor.py

@@ -51,12 +51,14 @@ class AuthorityPort(Protocol):
     def branch_exists(self, branch: str) -> bool: ...
     def branch_head(self, branch: str) -> str: ...
     def is_ancestor(self, older: str, newer: str) -> bool: ...
+    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str: ...
     def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
 
 
 class RemotePort(Protocol):
     def repository_identity(self) -> str: ...
-    def push_exact(self, branch: str, expected: str, new: str, *, allow_absent: bool = False) -> None: ...
+    def push_new_exact(self, branch: str, new: str) -> None: ...
+    def push_exact(self, branch: str, expected: str, new: str) -> None: ...
     def read_git_ref(self, branch: str) -> str | None: ...
     def read_api_branch(self, branch: str) -> str | None: ...
     def commit_visible(self, oid: str) -> bool: ...
@@ -103,6 +105,9 @@ class AuthorityGitAdapter:
     def is_ancestor(self, older: str, newer: str) -> bool:
         return self.executor.ancestry_check(older, newer)
 
+    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str:
+        return self.executor.create_task_branch_CAS(self._ref(branch), expected_base, new)
+
     def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str:
         return self.executor.advance_task_branch_CAS(self._ref(branch), expected, new)
 
@@ -152,7 +157,7 @@ class DetachedGitWorkspace:
     def materialize_files(self, files: Mapping[str, bytes]) -> None:
         dirty = self._dirty_paths()
         expected_paths = set(files)
-        if dirty and dirty != expected_paths:
+        if dirty and not dirty.issubset(expected_paths):
             raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
         for relative, content in files.items():
             target = (self.path / relative).resolve()
@@ -258,11 +263,19 @@ class GiteaContinuationRemote:
             raise ContinuationExecutionError("GITEA_GIT_READBACK_INVALID")
         return oid
 
-    def push_exact(self, branch: str, expected: str, new: str, *, allow_absent: bool = False) -> None:
+    def push_new_exact(self, branch: str, new: str) -> None:
         self._require_projected()
         self.repository_identity()
-        current = self.read_git_ref(branch)
-        if current != expected and not (allow_absent and current is None):
+        if self.read_git_ref(branch) is not None:
+            raise ContinuationExecutionError("GITEA_TARGET_BRANCH_ALREADY_EXISTS")
+        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
+        if self.read_git_ref(branch) != new:
+            raise ContinuationExecutionError("GITEA_CREATE_READBACK_MISMATCH")
+
+    def push_exact(self, branch: str, expected: str, new: str) -> None:
+        self._require_projected()
+        self.repository_identity()
+        if self.read_git_ref(branch) != expected:
             raise ContinuationExecutionError("GITEA_BRANCH_EXPECTATION_MISMATCH")
         _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
 
@@ -330,16 +343,13 @@ class ContinuationPermissions:
 @dataclass(frozen=True, slots=True)
 class ContinuationRuntimeBinding:
     request: WriterLeaseRequestV2
+    job_id: str
     workspace_path: Path
     lease_not_before: datetime
     lease_expires_at: datetime
     original_receipt_valid: bool
     original_grant_consumed: bool
     permissions: ContinuationPermissions
-    remote_branch_create_allowed: bool = False
-    external_job_id: str | None = None
-    worker_principal: str = "aios-autonomy-agent"
-    worker_lineage: str = "governed-continuation"
 
 
 @dataclass(frozen=True, slots=True)
@@ -394,13 +404,20 @@ class ContinuationExecutor:
     def observe_generation(self, branch: str, generation: int) -> None:
         self._observed_generations[branch] = max(generation, self._observed_generations.get(branch, 0))
 
-    def _max_generation(self, branch: str) -> int:
+    def _max_generation(self, branch: str, *, exclude_job_id: str | None = None) -> int:
         observed = self._observed_generations.get(branch, 0)
         with self.controller.store._connect() as connection:
+            if exclude_job_id is None:
                 row = connection.execute(
                     "SELECT MAX(generation) AS generation FROM branch_leases WHERE branch=?",
                     (branch,),
                 ).fetchone()
+            else:
+                row = connection.execute(
+                    "SELECT MAX(generation) AS generation FROM branch_leases "
+                    "WHERE branch=? AND job_id!=?",
+                    (branch, exclude_job_id),
+                ).fetchone()
         durable = int(row["generation"] or 0)
         return max(observed, durable)
 
@@ -409,6 +426,7 @@ class ContinuationExecutor:
         return {
             "schema": WriterLeaseRequestV2.schema,
             "task_id": request.task_id,
+            "job_id": request.job_id,
             "repository": request.repository,
             "branch_mode": request.branch_mode,
             "base_oid": request.base_oid,
@@ -418,10 +436,21 @@ class ContinuationExecutor:
             "lease_seconds": request.lease_seconds,
         }
 
-    def _validate_preflight(self, binding: ContinuationRuntimeBinding) -> None:
+    def _validate_preflight(self, binding: ContinuationRuntimeBinding, *, job_id: str | None = None) -> None:
         request = binding.request
-        normalized = validate_writer_lease_request_v2(self._request_mapping(request), self.authority)
-        if normalized != {**self._request_mapping(request), "create_target_branch": False, "worktree_mode": "detached_at_expected_head", "cas_ref_update_required": True}:
+        request_mapping = self._request_mapping(request)
+        normalized = validate_writer_lease_request_v2(request_mapping, self.authority)
+        expected_normalized = {
+            **request_mapping,
+            "create_target_branch": request.branch_mode == "CREATE_NEW",
+            "worktree_mode": (
+                "detached_at_base_oid"
+                if request.branch_mode == "CREATE_NEW"
+                else "detached_at_expected_head"
+            ),
+            "cas_ref_update_required": True,
+        }
+        if normalized != expected_normalized:
             raise ContinuationExecutionError("CONTINUATION_NORMALIZATION_INVALID")
         if not binding.original_receipt_valid or not binding.original_grant_consumed:
             raise ContinuationExecutionError("ORIGINAL_GRANT_LINEAGE_INVALID")
@@ -431,7 +460,7 @@ class ContinuationExecutor:
             raise ContinuationExecutionError("LEASE_NOT_ACTIVE")
         if now >= binding.lease_expires_at:
             raise ContinuationExecutionError("LEASE_EXPIRED")
-        if request.generation <= self._max_generation(request.target_branch):
+        if request.generation <= self._max_generation(request.target_branch, exclude_job_id=job_id):
             raise ContinuationExecutionError("GENERATION_NOT_MONOTONIC")
         if not self.workspace.is_detached():
             raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
@@ -455,70 +484,129 @@ class ContinuationExecutor:
             "payload_digest": hashlib.sha256(payload).hexdigest(),
             "lineage_anchor_oid": request.base_oid,
             "generation": request.generation,
-            "remote_branch_create_allowed": binding.remote_branch_create_allowed,
-            "external_job_id": binding.external_job_id,
-            "files_digest": hashlib.sha256(
-                json.dumps(
-                    {path: hashlib.sha256(content).hexdigest() for path, content in sorted(commit.files.items())},
-                    sort_keys=True, separators=(",", ":"),
-                ).encode("utf-8")
-            ).hexdigest(),
-            "message_digest": hashlib.sha256(commit.message.encode("utf-8")).hexdigest(),
-            "worker_principal": binding.worker_principal,
-            "worker_lineage": binding.worker_lineage,
         }
 
-    def execute(self, binding: ContinuationRuntimeBinding, commit: ContinuationCommit) -> dict[str, object]:
-        payload = commit.payload()
-        submitted = self.controller.submit(self._job_request(binding, commit, payload), payload=payload)
-        current = self.controller.store.read(submitted.job_id)
-        if JobState(current["state"]) == JobState.COMPLETED:
-            return self.controller.store._receipt(current, duplicate=True).as_dict()
-        self._validate_preflight(binding)
+    def execute(
+        self,
+        binding: ContinuationRuntimeBinding,
+        commit: ContinuationCommit,
+        *,
+        before_complete: Callable[[str], None] | None = None,
+    ) -> dict[str, object]:
+        commit.payload()
+        if not binding.job_id or binding.request.job_id != binding.job_id:
+            raise ContinuationExecutionError("RUNTIME_LINEAGE_MISSING_JOB_ID")
+        current = self.controller.store.read(binding.job_id)
+        current_state = JobState(current["state"])
+        if current_state == JobState.COMPLETED:
+            cycle = self.controller.begin_continuation_cycle(
+                binding.job_id,
+                idempotency_key=commit.idempotency_key,
+                expected_head_oid=binding.request.expected_branch_oid,
+                generation=binding.request.generation,
+                expected_revision=int(current["revision"]),
+            )
+            if cycle.get("completed"):
+                return self.controller.store._receipt(
+                    self.controller.store.read(binding.job_id), duplicate=True
+                ).as_dict()
+            current = self.controller.store.read(binding.job_id)
+            current_state = JobState(current["state"])
+        if current_state == JobState.REMOTE_VERIFIED:
+            receipt = json.loads(str(current["receipt_json"] or "{}"))
+            commit_oid = str(receipt.get("authority_oid") or "")
+            if not OID_RE.fullmatch(commit_oid):
+                raise ContinuationExecutionError("GOVERNED_COMMIT_OID_INVALID")
+            if before_complete is not None:
+                before_complete(commit_oid)
+            result = self.controller.advance(
+                binding.job_id,
+                JobState.COMPLETED,
+                side_effect_state="REMOTE_VERIFIED",
+                receipt=receipt,
+            ).as_dict()
+            self.controller.complete_continuation_cycle(
+                binding.job_id,
+                idempotency_key=commit.idempotency_key,
+                commit_oid=commit_oid,
+            )
+            return result
+        self._validate_preflight(binding, job_id=binding.job_id)
         request = binding.request
         projected = False
         try:
             self.credential.project()
             projected = True
-            row = self.controller.store.read(submitted.job_id)
-            if JobState(row["state"]) == JobState.REQUESTED:
+            row = self.controller.store.read(binding.job_id)
+            state = JobState(row["state"])
+            if state == JobState.REQUESTED:
                 self.controller.advance(
-                    submitted.job_id,
+                    binding.job_id,
                     JobState.AUTHORIZED,
                     side_effect_state="AUTHORIZED",
                     receipt={"task_id": request.task_id, "original_grant_consumed": True},
+                    expected_revision=int(row["revision"]),
                 )
-                row = self.controller.store.read(submitted.job_id)
-            if JobState(row["state"]) == JobState.AUTHORIZED:
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.AUTHORIZED:
                 self.controller.lease_job(
-                    submitted.job_id,
-                    lease_id=f"lease-{submitted.job_id}",
+                    binding.job_id,
+                    lease_id=f"lease-{binding.job_id}",
                     lineage_anchor_oid=request.base_oid,
                     current_head_oid=request.expected_branch_oid,
                     generation=request.generation,
                     lease_expires_at=binding.lease_expires_at.astimezone(timezone.utc).isoformat(),
                     expected_revision=int(row["revision"]),
                 )
-            self.controller.advance(submitted.job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY")
-            self.controller.advance(submitted.job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.LEASED:
+                self.controller.advance(binding.job_id, JobState.WORKTREE_READY,
+                                        side_effect_state="WORKTREE_READY", expected_revision=int(row["revision"]))
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.WORKTREE_READY:
+                self.controller.advance(binding.job_id, JobState.EXECUTING,
+                                        side_effect_state="IN_PROGRESS", expected_revision=int(row["revision"]))
+            elif state != JobState.EXECUTING:
+                raise ContinuationExecutionError("JOB_EXECUTION_STATE_INVALID")
             new_oid = self.workspace.commit_files(commit.files, commit.message)
             if not OID_RE.fullmatch(new_oid) or not self.authority.is_ancestor(request.expected_branch_oid, new_oid):
                 raise ContinuationExecutionError("NON_FAST_FORWARD_COMMIT")
+            if request.branch_mode == "CREATE_NEW":
+                authority_oid = self.authority.create_task_branch_cas(request.target_branch, request.base_oid, new_oid)
+            else:
                 authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
             if authority_oid != new_oid:
                 raise ContinuationExecutionError("AUTHORITY_CAS_READBACK_MISMATCH")
             self.controller.advance(
-                submitted.job_id,
+                binding.job_id,
                 JobState.LOCAL_VERIFIED,
                 side_effect_state="LOCAL_VERIFIED",
                 receipt={"authority_oid": authority_oid, "force_push": False},
             )
             try:
-                self.controller.advance(submitted.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
-                self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid, allow_absent=binding.remote_branch_create_allowed)
+                self.controller.advance(binding.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
+                if request.branch_mode == "CREATE_NEW":
+                    self.remote.push_new_exact(request.target_branch, new_oid)
+                else:
+                    self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
             except Exception:
-                return self._remote_pending(submitted.job_id, authority_oid, new_oid)
-            return self._finish_remote_verification(submitted.job_id, authority_oid, new_oid)
+                return self._remote_pending(binding.job_id, authority_oid, new_oid)
+            result = self._finish_remote_verification(
+                binding.job_id,
+                authority_oid,
+                new_oid,
+                before_complete=before_complete,
+            )
+            if str(result.get("state") or "") == JobState.COMPLETED.value:
+                self.controller.complete_continuation_cycle(
+                    binding.job_id,
+                    idempotency_key=commit.idempotency_key,
+                    commit_oid=new_oid,
+                )
+            return result
         finally:
             if projected:
                 self.credential.revoke()
@@ -529,7 +617,6 @@ class ContinuationExecutor:
     def _remote_pending(self, job_id: str, authority_oid: str, new_oid: str) -> dict[str, object]:
         receipt = {
             "authority_oid": authority_oid,
-            "commit_oid": new_oid,
             "desired_remote_oid": new_oid,
             "remote_verified": False,
             "force_push": False,
@@ -542,7 +629,14 @@ class ContinuationExecutor:
         )
         return result.as_dict()
 
-    def _finish_remote_verification(self, job_id: str, authority_oid: str, new_oid: str) -> dict[str, object]:
+    def _finish_remote_verification(
+        self,
+        job_id: str,
+        authority_oid: str,
+        new_oid: str,
+        *,
+        before_complete: Callable[[str], None] | None = None,
+    ) -> dict[str, object]:
         row = self.controller.store.read(job_id)
         branch = row["branch"]
         request = json.loads(row["request_json"])["binding"]
@@ -552,7 +646,6 @@ class ContinuationExecutor:
             return self._remote_pending(job_id, authority_oid, new_oid)
         receipt = {
             "authority_oid": authority_oid,
-            "commit_oid": new_oid,
             "git_remote_oid": git_oid,
             "api_branch_oid": api_oid,
             "commit_visible": True,
@@ -560,8 +653,20 @@ class ContinuationExecutor:
             "reconciliation_decision": decision.action.value,
             "force_push": False,
         }
-        self.controller.advance(job_id, JobState.REMOTE_VERIFIED, side_effect_state="REMOTE_VERIFIED", receipt=receipt)
-        return self.controller.advance(job_id, JobState.COMPLETED, side_effect_state="REMOTE_VERIFIED", receipt=receipt).as_dict()
+        self.controller.advance(
+            job_id,
+            JobState.REMOTE_VERIFIED,
+            side_effect_state="REMOTE_VERIFIED",
+            receipt=receipt,
+        )
+        if before_complete is not None:
+            before_complete(new_oid)
+        return self.controller.advance(
+            job_id,
+            JobState.COMPLETED,
+            side_effect_state="REMOTE_VERIFIED",
+            receipt=receipt,
+        ).as_dict()
 
     def reconcile(self, job_id: str) -> dict[str, object]:
         row = self.controller.store.read(job_id)
@@ -601,14 +706,11 @@ class ContinuationExecutor:
                 and self.authority.is_ancestor(git_oid, new_oid)
             ):
                 self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_CHAIN")
-                self.remote.push_exact(row["branch"], git_oid, new_oid, allow_absent=bool(request.get("remote_branch_create_allowed")) or request.get("branch_mode") == "CREATE_NEW")
+                self.remote.push_exact(row["branch"], git_oid, new_oid)
                 return self._finish_remote_verification(job_id, new_oid, new_oid)
-            allow_remote_create = bool(request.get("remote_branch_create_allowed")) or request.get("branch_mode") == "CREATE_NEW" or (git_oid is None and api_oid is None)
-            remote_matches_expected = git_oid == api_oid == expected_oid
-            remote_absent_for_create = git_oid is None and api_oid is None
-            if authority_oid == new_oid and (remote_matches_expected or remote_absent_for_create):
+            if authority_oid == new_oid and git_oid == api_oid == expected_oid:
                 self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_RETRY")
-                self.remote.push_exact(row["branch"], expected_oid, new_oid, allow_absent=allow_remote_create)
+                self.remote.push_exact(row["branch"], expected_oid, new_oid)
                 return self._finish_remote_verification(job_id, new_oid, new_oid)
             return self.controller.store._receipt(row, duplicate=True).as_dict()
         finally:

active-runtime/app/aios_continuation_lease.py

@@ -49,6 +49,7 @@ class WriterLeaseRequestV2:
     target_branch: str
     generation: int
     lease_seconds: int = 900
+    job_id: str = ""
 
     schema = "aios.task-writer-lease.v2"
     accepted_schemas = frozenset({"aios.task-writer-lease.v2", "aios.task-writer-lease-request.v2"})
@@ -56,6 +57,8 @@ class WriterLeaseRequestV2:
     def validate(self, probe: BranchProbe) -> None:
         if not self.task_id or self.repository != "aios/aios":
             raise ContinuationError("request_identity_invalid")
+        if not self.job_id or not self.job_id.startswith("job-"):
+            raise ContinuationError("job_id_invalid")
         if self.branch_mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
             raise ContinuationError("branch_mode_invalid")
         _oid(self.base_oid, "base_oid")

active-runtime/app/aios_control_plane_snapshot.py

@@ -10,16 +10,12 @@ def _copy(value: Mapping[str, Any] | None, keys: tuple[str, ...]) -> dict[str, A
 
 
 def build_control_plane_snapshot(*, target_version: str, runtime: Mapping[str, Any] | None = None, repository: Mapping[str, Any] | None = None, production: Mapping[str, Any] | None = None, task: Mapping[str, Any] | None = None, capabilities: Mapping[str, Any] | None = None, credential_broker: Mapping[str, Any] | None = None) -> dict[str, Any]:
-    task_snapshot = _copy(task, ("task_id", "branch", "authority_branch_oid", "gitea_git_oid", "gitea_api_oid", "commit_visible", "generation", "reconciliation_state"))
-    for key in ("external_job_id", "commit_oid", "current_head_oid", "completed_replay_reconciliation_id", "receipt_authority_oid"):
-        if task is not None and key in task:
-            task_snapshot[key] = task[key]
     return {
         "version": {"target_release": target_version},
         "runtime": _copy(runtime, ("bridge_schema_version", "control_plane_release_version", "runtime_release_commit", "runtime_path", "artifact_sha256", "drift_status")),
         "repository": _copy(repository, ("identity", "authority_git_dir", "authority_main_oid")),
         "production": _copy(production, ("baseline_version", "target_oid", "deployment_state")),
-        "task": task_snapshot,
+        "task": _copy(task, ("task_id", "branch", "authority_branch_oid", "gitea_git_oid", "gitea_api_oid", "commit_visible", "generation", "reconciliation_state")),
         "capabilities": _copy(capabilities, ("legacy_writes_enabled", "governed_writes_enabled", "force_push", "main_write", "tag_write", "baseline_write", "production_write")),
         "credential_broker": _copy(credential_broker, ("status", "provider")),
         "secret_material_exposed": False,

active-runtime/app/aios_convergence_contracts.py

@@ -1,478 +0,0 @@
-"""Minimal convergence contracts for AIOS V2R2C2.
-
-This module deliberately contains no external side effects.  It provides the shared
-data contracts and pure evaluation rules used by domain controllers.  Domain
-controllers remain authoritative for their own final states.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass, field
-from datetime import datetime, timezone
-from enum import Enum
-import hashlib
-import json
-from typing import Any, Iterable, Mapping, Sequence
-
-
-class ConvergenceContractError(ValueError):
-    """Raised when an invalid convergence contract is constructed."""
-
-
-class EvidenceState(str, Enum):
-    PASS = "PASS"
-    FAIL = "FAIL"
-    UNKNOWN = "UNKNOWN"
-    BLOCKED = "BLOCKED"
-    NOT_APPLICABLE = "NOT_APPLICABLE"
-
-
-class AcceptanceDecision(str, Enum):
-    ACCEPT = "ACCEPT"
-    REJECT = "REJECT"
-    BLOCKED = "BLOCKED"
-    UNKNOWN = "UNKNOWN"
-
-
-class ObservedHealth(str, Enum):
-    HEALTHY = "HEALTHY"
-    DEGRADED = "DEGRADED"
-    FAILED = "FAILED"
-    UNKNOWN = "UNKNOWN"
-
-
-class ReconciliationState(str, Enum):
-    PENDING = "PENDING"
-    OBSERVING = "OBSERVING"
-    DIFF_FOUND = "DIFF_FOUND"
-    APPLYING = "APPLYING"
-    VERIFYING = "VERIFYING"
-    CONVERGED = "CONVERGED"
-    DEGRADED = "DEGRADED"
-    BLOCKED = "BLOCKED"
-
-
-class ContinuationStopReason(str, Enum):
-    CONTEXT_BOUNDARY = "context_boundary"
-    WORKER_RESTART = "worker_restart"
-    HANDOFF = "handoff"
-    AUTHORITY_GATE = "authority_gate"
-    WAIT_EXTERNAL = "wait_external"
-
-
-def _utc_now() -> str:
-    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def _canonical_json(value: Mapping[str, Any]) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
-
-
-def _sha256(value: Mapping[str, Any]) -> str:
-    return "sha256:" + hashlib.sha256(_canonical_json(value)).hexdigest()
-
-
-def _nonempty(value: object, field_name: str) -> str:
-    text = str(value or "").strip()
-    if not text:
-        raise ConvergenceContractError(f"{field_name}_required")
-    return text
-
-
-def _generation(value: object, field_name: str = "generation") -> int:
-    try:
-        parsed = int(value)
-    except (TypeError, ValueError) as exc:
-        raise ConvergenceContractError(f"{field_name}_invalid") from exc
-    if parsed < 1:
-        raise ConvergenceContractError(f"{field_name}_invalid")
-    return parsed
-
-
-@dataclass(frozen=True, slots=True)
-class StateOwnership:
-    object_type: str
-    authoritative_service: str
-    authoritative_store: str
-    final_writer: str | None = None
-    projections: tuple[str, ...] = ()
-    schema_version: str = "aios.state-ownership.v1"
-
-    def __post_init__(self) -> None:
-        _nonempty(self.object_type, "object_type")
-        _nonempty(self.authoritative_service, "authoritative_service")
-        _nonempty(self.authoritative_store, "authoritative_store")
-        if self.final_writer is not None:
-            _nonempty(self.final_writer, "final_writer")
-
-    def as_dict(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-DEFAULT_STATE_OWNERSHIP: tuple[StateOwnership, ...] = (
-    StateOwnership(
-        object_type="goal",
-        authoritative_service="goal-kernel",
-        authoritative_store="goal-store",
-        final_writer="goal-kernel",
-        projections=("admin-web", "context-pack"),
-    ),
-    StateOwnership(
-        object_type="task_run",
-        authoritative_service="task-plane-18940",
-        authoritative_store="durable-task-store",
-        final_writer="task-plane-18940",
-        projections=("admin-web", "context-pack"),
-    ),
-    StateOwnership(
-        object_type="release",
-        authoritative_service="release-controller",
-        authoritative_store="release-registry",
-        final_writer="release-controller",
-        projections=("baseline-authority", "admin-web"),
-    ),
-    StateOwnership(
-        object_type="git_branch",
-        authoritative_service="authority-git-executor",
-        authoritative_store="authoritative-git",
-        final_writer="authority-git-executor",
-        projections=("gitea",),
-    ),
-    StateOwnership(
-        object_type="external_projection",
-        authoritative_service="projection-controller",
-        authoritative_store="projection-store",
-        final_writer="projection-controller",
-        projections=("openapi", "gpt-action", "nginx"),
-    ),
-)
-
-
-def ownership_index(
-    ownership: Iterable[StateOwnership] = DEFAULT_STATE_OWNERSHIP,
-) -> dict[str, StateOwnership]:
-    result: dict[str, StateOwnership] = {}
-    for row in ownership:
-        if row.object_type in result:
-            raise ConvergenceContractError(f"duplicate_state_owner:{row.object_type}")
-        result[row.object_type] = row
-    return result
-
-
-@dataclass(frozen=True, slots=True)
-class AcceptanceCriterion:
-    criterion_id: str
-    required: bool
-    state: EvidenceState
-    verifier_id: str
-    evidence_refs: tuple[str, ...] = ()
-
-    def __post_init__(self) -> None:
-        _nonempty(self.criterion_id, "criterion_id")
-        _nonempty(self.verifier_id, "verifier_id")
-
-
-@dataclass(frozen=True, slots=True)
-class AcceptanceInvariant:
-    invariant_id: str
-    state: EvidenceState
-    evidence_refs: tuple[str, ...] = ()
-
-    def __post_init__(self) -> None:
-        _nonempty(self.invariant_id, "invariant_id")
-
-
-@dataclass(frozen=True, slots=True)
-class AcceptanceVector:
-    subject_type: str
-    subject_id: str
-    subject_revision: int
-    criteria: tuple[AcceptanceCriterion, ...]
-    invariants: tuple[AcceptanceInvariant, ...] = ()
-    unresolved_side_effects: tuple[str, ...] = ()
-    unresolved_blockers: tuple[str, ...] = ()
-    runtime_proofs: tuple[str, ...] = ()
-    schema: str = "aios.acceptance-vector.v1"
-
-    def __post_init__(self) -> None:
-        _nonempty(self.subject_type, "subject_type")
-        _nonempty(self.subject_id, "subject_id")
-        _generation(self.subject_revision, "subject_revision")
-        ids = [row.criterion_id for row in self.criteria]
-        if len(ids) != len(set(ids)):
-            raise ConvergenceContractError("duplicate_acceptance_criterion")
-        invariant_ids = [row.invariant_id for row in self.invariants]
-        if len(invariant_ids) != len(set(invariant_ids)):
-            raise ConvergenceContractError("duplicate_acceptance_invariant")
-
-    def as_dict(self) -> dict[str, Any]:
-        value = asdict(self)
-        for row in value["criteria"]:
-            row["state"] = row["state"].value
-        for row in value["invariants"]:
-            row["state"] = row["state"].value
-        return value
-
-
-@dataclass(frozen=True, slots=True)
-class AcceptanceResult:
-    decision: AcceptanceDecision
-    reasons: tuple[str, ...]
-    vector_hash: str
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "decision": self.decision.value,
-            "reasons": list(self.reasons),
-            "vector_hash": self.vector_hash,
-        }
-
-
-def evaluate_acceptance(vector: AcceptanceVector) -> AcceptanceResult:
-    """Pure fail-closed acceptance evaluator.
-
-    The evaluator never writes a domain final state.  The domain owner consumes this
-    result and remains the only final writer for Goal/Release/Product state.
-    """
-    reasons: list[str] = []
-    required = [row for row in vector.criteria if row.required]
-
-    for row in required:
-        if row.state == EvidenceState.FAIL:
-            reasons.append(f"criterion_failed:{row.criterion_id}")
-        elif row.state == EvidenceState.BLOCKED:
-            reasons.append(f"criterion_blocked:{row.criterion_id}")
-        elif row.state == EvidenceState.UNKNOWN:
-            reasons.append(f"criterion_unknown:{row.criterion_id}")
-
-    for row in vector.invariants:
-        if row.state == EvidenceState.FAIL:
-            reasons.append(f"invariant_failed:{row.invariant_id}")
-        elif row.state in {EvidenceState.UNKNOWN, EvidenceState.BLOCKED}:
-            reasons.append(f"invariant_unknown:{row.invariant_id}")
-
-    if vector.unresolved_side_effects:
-        reasons.append("unresolved_side_effects")
-    if vector.unresolved_blockers:
-        reasons.append("unresolved_blockers")
-
-    digest = _sha256(vector.as_dict())
-
-    if any(reason.startswith(("criterion_failed:", "invariant_failed:")) for reason in reasons):
-        decision = AcceptanceDecision.REJECT
-    elif any(reason.startswith("criterion_blocked:") for reason in reasons) or vector.unresolved_blockers:
-        decision = AcceptanceDecision.BLOCKED
-    elif reasons:
-        decision = AcceptanceDecision.UNKNOWN
-    else:
-        decision = AcceptanceDecision.ACCEPT
-
-    return AcceptanceResult(decision=decision, reasons=tuple(reasons), vector_hash=digest)
-
-
-@dataclass(frozen=True, slots=True)
-class DesiredState:
-    resource_id: str
-    resource_type: str
-    desired_generation: int
-    desired_spec: Mapping[str, Any]
-    owner_goal_id: str | None = None
-    lifecycle: str = "active"
-    schema: str = "aios.desired-state.v1"
-
-    def __post_init__(self) -> None:
-        _nonempty(self.resource_id, "resource_id")
-        _nonempty(self.resource_type, "resource_type")
-        _generation(self.desired_generation, "desired_generation")
-        if self.lifecycle not in {"active", "suspended", "deleted"}:
-            raise ConvergenceContractError("desired_lifecycle_invalid")
-
-    def identity(self) -> tuple[str, int]:
-        return self.resource_id, self.desired_generation
-
-
-@dataclass(frozen=True, slots=True)
-class ObservedState:
-    resource_id: str
-    observed_generation: int | None
-    observed_spec: Mapping[str, Any]
-    health: ObservedHealth
-    source_identity: str
-    observed_at: str
-    evidence_refs: tuple[str, ...] = ()
-    schema: str = "aios.observed-state.v1"
-
-    def __post_init__(self) -> None:
-        _nonempty(self.resource_id, "resource_id")
-        _nonempty(self.source_identity, "source_identity")
-        _nonempty(self.observed_at, "observed_at")
-        if self.observed_generation is not None:
-            _generation(self.observed_generation, "observed_generation")
-
-
-@dataclass(frozen=True, slots=True)
-class ReconciliationPlan:
-    resource_id: str
-    desired_generation: int
-    state: ReconciliationState
-    diff: Mapping[str, Any]
-    observation_required: bool
-    idempotency_key: str
-    reason: str
-
-    def as_dict(self) -> dict[str, Any]:
-        value = asdict(self)
-        value["state"] = self.state.value
-        return value
-
-
-def plan_reconciliation(
-    desired: DesiredState,
-    observed: ObservedState | None,
-) -> ReconciliationPlan:
-    """Return a side-effect-free reconciliation decision.
-
-    UNKNOWN/missing observed state always requires observation and never converges.
-    """
-    identity = {
-        "resource_id": desired.resource_id,
-        "desired_generation": desired.desired_generation,
-        "desired_spec": desired.desired_spec,
-    }
-    key = _sha256(identity)
-
-    if observed is None:
-        return ReconciliationPlan(
-            desired.resource_id,
-            desired.desired_generation,
-            ReconciliationState.OBSERVING,
-            {"observed": None},
-            True,
-            key,
-            "observed_state_missing",
-        )
-    if observed.resource_id != desired.resource_id:
-        raise ConvergenceContractError("resource_identity_mismatch")
-    if observed.health == ObservedHealth.UNKNOWN:
-        return ReconciliationPlan(
-            desired.resource_id,
-            desired.desired_generation,
-            ReconciliationState.OBSERVING,
-            {"health": observed.health.value},
-            True,
-            key,
-            "observed_state_unknown",
-        )
-
-    same_generation = observed.observed_generation == desired.desired_generation
-    same_spec = dict(observed.observed_spec) == dict(desired.desired_spec)
-    if same_generation and same_spec and observed.health == ObservedHealth.HEALTHY:
-        return ReconciliationPlan(
-            desired.resource_id,
-            desired.desired_generation,
-            ReconciliationState.CONVERGED,
-            {},
-            False,
-            key,
-            "desired_equals_observed",
-        )
-
-    return ReconciliationPlan(
-        desired.resource_id,
-        desired.desired_generation,
-        ReconciliationState.DIFF_FOUND,
-        {
-            "desired_generation": desired.desired_generation,
-            "observed_generation": observed.observed_generation,
-            "desired_spec": dict(desired.desired_spec),
-            "observed_spec": dict(observed.observed_spec),
-            "observed_health": observed.health.value,
-        },
-        False,
-        key,
-        "desired_observed_drift",
-    )
-
-
-@dataclass(frozen=True, slots=True)
-class SideEffectReceipt:
-    mutation_id: str
-    external_system: str
-    state: str
-    observed_at: str
-    external_request_id: str | None = None
-    external_object_id: str | None = None
-    observed_result_hash: str | None = None
-    evidence_refs: tuple[str, ...] = ()
-    schema: str = "aios.side-effect-receipt.v1"
-
-    def __post_init__(self) -> None:
-        _nonempty(self.mutation_id, "mutation_id")
-        _nonempty(self.external_system, "external_system")
-        _nonempty(self.observed_at, "observed_at")
-        if self.state not in {
-            "confirmed_applied",
-            "confirmed_not_applied",
-            "unknown",
-        }:
-            raise ConvergenceContractError("side_effect_receipt_state_invalid")
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationManifest:
-    trace_id: str
-    goal_id: str
-    goal_revision: int
-    task_id: str
-    run_id: str
-    current_node_id: str
-    acceptance_vector_ref: str
-    next_action: str
-    stop_reason: ContinuationStopReason
-    checkpoint_ref: str | None = None
-    unresolved_blocker_refs: tuple[str, ...] = ()
-    authoritative_decision_refs: tuple[str, ...] = ()
-    resource_refs: tuple[str, ...] = ()
-    artifact_refs: tuple[str, ...] = ()
-    evidence_refs: tuple[str, ...] = ()
-    created_at: str = field(default_factory=_utc_now)
-    schema: str = "aios.continuation-manifest.v1"
-
-    def __post_init__(self) -> None:
-        for name in (
-            "trace_id",
-            "goal_id",
-            "task_id",
-            "run_id",
-            "current_node_id",
-            "acceptance_vector_ref",
-            "next_action",
-            "created_at",
-        ):
-            _nonempty(getattr(self, name), name)
-        _generation(self.goal_revision, "goal_revision")
-
-    def as_dict(self) -> dict[str, Any]:
-        value = asdict(self)
-        value["stop_reason"] = self.stop_reason.value
-        return value
-
-    @property
-    def content_hash(self) -> str:
-        return _sha256(self.as_dict())
-
-
-def validate_state_ownership(
-    object_type: str,
-    writer: str,
-    ownership: Iterable[StateOwnership] = DEFAULT_STATE_OWNERSHIP,
-    *,
-    final_state: bool = False,
-) -> None:
-    row = ownership_index(ownership).get(object_type)
-    if row is None:
-        raise ConvergenceContractError(f"state_owner_missing:{object_type}")
-    expected = row.final_writer if final_state and row.final_writer else row.authoritative_service
-    if writer != expected:
-        raise ConvergenceContractError(
-            f"STATE_OWNERSHIP_VIOLATION:{object_type}:{writer}:{expected}"
-        )

active-runtime/app/aios_gitops_job_controller.py

@@ -27,6 +27,19 @@ class ServiceUnavailable(JobError):
     pass
 
 
+@dataclass(frozen=True, slots=True)
+class LeaseRenewalResult:
+    """Durable outcome of one writer-lease recovery attempt."""
+
+    renewed: bool
+    idempotent: bool
+    durable: bool
+    lease_expires_at: str | None
+
+    def __bool__(self) -> bool:
+        return self.renewed or self.idempotent
+
+
 class BindingConflict(JobError):
     pass
 
@@ -41,8 +54,6 @@ class JobState(str, Enum):
     REMOTE_SYNCING = "REMOTE_SYNCING"
     REMOTE_VERIFIED = "REMOTE_VERIFIED"
     COMPLETED = "COMPLETED"
-    FAILED = "FAILED"
-    CANCELLED = "CANCELLED"
     RECOVERABLE_FAILURE = "RECOVERABLE_FAILURE"
     RECONCILING = "RECONCILING"
     RECONCILIATION_REQUIRED = "RECONCILIATION_REQUIRED"
@@ -61,18 +72,21 @@ _ORDER = {
     JobState.COMPLETED: 8,
 }
 _RECOVERABLE = {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}
-_TERMINAL = {
-    JobState.COMPLETED,
-    JobState.FAILED,
-    JobState.CANCELLED,
-    JobState.MANUAL_OWNER_REVIEW_REQUIRED,
-}
+_TERMINAL = {JobState.COMPLETED, JobState.MANUAL_OWNER_REVIEW_REQUIRED}
 
 
 def utc_now() -> str:
     return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
 
 
+def parse_utc(value: str) -> datetime:
+    normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
+    parsed = datetime.fromisoformat(normalized)
+    if parsed.tzinfo is None:
+        raise ValueError("LEASE_EXPIRY_INVALID")
+    return parsed.astimezone(timezone.utc)
+
+
 def canonical_json(value: Any) -> bytes:
     return (
         json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n"
@@ -178,63 +192,6 @@ class JobStore:
         connection.execute("PRAGMA busy_timeout=30000")
         return connection
 
-    @classmethod
-    def for_existing_append(cls, root: str | os.PathLike[str]) -> "JobStore":
-        """Open an existing job database without initialization side effects."""
-        path = Path(root)
-        if (
-            not path.is_absolute()
-            or path.is_symlink()
-            or not path.is_dir()
-            or not (path / "state.sqlite3").is_file()
-            or (path / "state.sqlite3").is_symlink()
-        ):
-            raise JobError("JOB_ROOT_NOT_FOUND")
-        instance = cls.__new__(cls)
-        instance.root = path
-        instance.db_path = path / "state.sqlite3"
-        return instance
-
-    @staticmethod
-    def _ensure_completed_replay_schema(connection: sqlite3.Connection) -> None:
-        connection.executescript(
-            """
-            CREATE TABLE IF NOT EXISTS completed_replay_reconciliations (
-              reconciliation_id TEXT PRIMARY KEY, job_id TEXT NOT NULL,
-              identity_digest TEXT NOT NULL UNIQUE,
-              source_lease_epoch INTEGER NOT NULL,
-              task_id TEXT NOT NULL, external_job_id TEXT NOT NULL,
-              internal_job_id TEXT NOT NULL, repository TEXT NOT NULL,
-              target_branch TEXT NOT NULL, generation INTEGER NOT NULL,
-              branch_mode TEXT NOT NULL, payload_digest TEXT NOT NULL,
-              files_digest TEXT NOT NULL, message_digest TEXT NOT NULL,
-              commit_oid TEXT NOT NULL, authority_head_oid TEXT NOT NULL,
-              current_head_oid TEXT NOT NULL, historical_lease_head_oid TEXT NOT NULL,
-              worker_principal TEXT NOT NULL, worker_lineage TEXT NOT NULL,
-              durable_revision INTEGER NOT NULL, completion_identity TEXT NOT NULL,
-              reason TEXT NOT NULL, provenance_json TEXT NOT NULL,
-              created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-            );
-            CREATE INDEX IF NOT EXISTS completed_replay_job_idx
-              ON completed_replay_reconciliations(job_id);
-            CREATE TRIGGER IF NOT EXISTS completed_replay_no_update
-              BEFORE UPDATE ON completed_replay_reconciliations
-              BEGIN SELECT RAISE(ABORT, 'COMPLETED_REPLAY_APPEND_ONLY'); END;
-            CREATE TRIGGER IF NOT EXISTS completed_replay_no_delete
-              BEFORE DELETE ON completed_replay_reconciliations
-              BEGIN SELECT RAISE(ABORT, 'COMPLETED_REPLAY_APPEND_ONLY'); END;
-            """
-        )
-        columns = {
-            str(item[1]) for item in connection.execute(
-                "PRAGMA table_info(completed_replay_reconciliations)"
-            ).fetchall()
-        }
-        if columns and "historical_lease_head_oid" not in columns:
-            connection.execute(
-                "ALTER TABLE completed_replay_reconciliations ADD COLUMN historical_lease_head_oid TEXT"
-            )
-
     def _initialize(self) -> None:
         try:
             with self._connect() as connection:
@@ -273,43 +230,17 @@ class JobStore:
                       kind TEXT NOT NULL, digest TEXT NOT NULL, payload_json TEXT NOT NULL,
                       created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
                     );
-                    CREATE TABLE IF NOT EXISTS completed_replay_reconciliations (
-                      reconciliation_id TEXT PRIMARY KEY, job_id TEXT NOT NULL,
-                      identity_digest TEXT NOT NULL UNIQUE,
-                      source_lease_epoch INTEGER NOT NULL,
-                      task_id TEXT NOT NULL, external_job_id TEXT NOT NULL,
-                      internal_job_id TEXT NOT NULL, repository TEXT NOT NULL,
-                      target_branch TEXT NOT NULL, generation INTEGER NOT NULL,
-                      branch_mode TEXT NOT NULL, payload_digest TEXT NOT NULL,
-                      files_digest TEXT NOT NULL, message_digest TEXT NOT NULL,
-                      commit_oid TEXT NOT NULL, authority_head_oid TEXT NOT NULL,
-                      current_head_oid TEXT NOT NULL, historical_lease_head_oid TEXT NOT NULL,
-                      worker_principal TEXT NOT NULL, worker_lineage TEXT NOT NULL,
-                      durable_revision INTEGER NOT NULL, completion_identity TEXT NOT NULL,
-                      reason TEXT NOT NULL, provenance_json TEXT NOT NULL,
-                      created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
+                    CREATE TABLE IF NOT EXISTS continuation_cycles (
+                      job_id TEXT NOT NULL, idempotency_key TEXT NOT NULL,
+                      sequence INTEGER NOT NULL, expected_head_oid TEXT NOT NULL,
+                      generation INTEGER NOT NULL, state TEXT NOT NULL,
+                      commit_oid TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+                      PRIMARY KEY(job_id,idempotency_key), UNIQUE(job_id,sequence),
+                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
                     );
-                    CREATE INDEX IF NOT EXISTS completed_replay_job_idx
-                      ON completed_replay_reconciliations(job_id);
-                    CREATE TRIGGER IF NOT EXISTS completed_replay_no_update
-                      BEFORE UPDATE ON completed_replay_reconciliations
-                      BEGIN SELECT RAISE(ABORT, 'COMPLETED_REPLAY_APPEND_ONLY'); END;
-                    CREATE TRIGGER IF NOT EXISTS completed_replay_no_delete
-                      BEFORE DELETE ON completed_replay_reconciliations
-                      BEGIN SELECT RAISE(ABORT, 'COMPLETED_REPLAY_APPEND_ONLY'); END;
-                    INSERT OR REPLACE INTO metadata(key, value) VALUES('schema_version', '1');
+                    INSERT OR REPLACE INTO metadata(key, value) VALUES('schema_version', '2');
                     """
                 )
-                columns = {
-                    str(item[1]) for item in connection.execute(
-                        "PRAGMA table_info(completed_replay_reconciliations)"
-                    ).fetchall()
-                }
-                if columns and "historical_lease_head_oid" not in columns:
-                    connection.execute(
-                        "ALTER TABLE completed_replay_reconciliations "
-                        "ADD COLUMN historical_lease_head_oid TEXT"
-                    )
         except sqlite3.Error as exc:
             raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
 
@@ -342,227 +273,6 @@ class JobStore:
             raise JobError("JOB_NOT_FOUND")
         return dict(row)
 
-    @staticmethod
-    def _completed_replay_identity(envelope: Mapping[str, Any]) -> dict[str, Any]:
-        required = (
-            "task_id", "external_job_id", "internal_job_id", "repository",
-            "target_branch", "generation", "branch_mode", "payload_digest",
-            "files_digest", "message_digest", "commit_oid", "authority_head_oid",
-            "historical_lease_head_oid", "worker_principal", "worker_lineage", "source_lease_epoch",
-            "durable_revision", "completion_identity", "reason", "provenance",
-        )
-        if any(key not in envelope for key in required):
-            raise BindingConflict("COMPLETED_REPLAY_BINDING_INCOMPLETE")
-        text_fields = (
-            "task_id", "external_job_id", "internal_job_id", "repository",
-            "target_branch", "branch_mode", "payload_digest", "files_digest",
-            "message_digest", "commit_oid", "authority_head_oid", "worker_principal",
-            "worker_lineage", "historical_lease_head_oid", "completion_identity", "reason",
-        )
-        result: dict[str, Any] = {}
-        for key in text_fields:
-            value = envelope[key]
-            if not isinstance(value, str) or not value.strip():
-                raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-            result[key] = value
-        for key in ("generation", "source_lease_epoch", "durable_revision"):
-            value = envelope[key]
-            if isinstance(value, bool) or not isinstance(value, int) or value < 1:
-                raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-            result[key] = value
-        for key in ("commit_oid", "authority_head_oid", "historical_lease_head_oid"):
-            if len(result[key]) != 40 or any(ch not in "0123456789abcdef" for ch in result[key]):
-                raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-        for key in ("payload_digest", "files_digest", "message_digest"):
-            if len(result[key]) != 64 or any(ch not in "0123456789abcdef" for ch in result[key]):
-                raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-        if result["repository"] != "aios/aios" or result["branch_mode"] not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
-            raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-        if not result["target_branch"].startswith("agent/") or result["target_branch"] in {"main", "master"}:
-            raise BindingConflict("COMPLETED_REPLAY_BINDING_INVALID")
-        provenance = envelope["provenance"]
-        if not isinstance(provenance, Mapping) or not provenance:
-            raise BindingConflict("COMPLETED_REPLAY_PROVENANCE_INVALID")
-        result["provenance"] = dict(provenance)
-        if result["commit_oid"] != result["authority_head_oid"]:
-            raise BindingConflict("COMPLETED_REPLAY_AUTHORITY_CONFLICT")
-        return result
-
-    def append_completed_replay_reconciliation(
-        self,
-        job_id: str,
-        envelope: Mapping[str, Any],
-        *,
-        authority_head_oid: str,
-    ) -> dict[str, Any]:
-        """Append exact completed-replay evidence without rewriting history."""
-        identity = self._completed_replay_identity(envelope)
-        if authority_head_oid != identity["authority_head_oid"]:
-            raise BindingConflict("COMPLETED_REPLAY_AUTHORITY_CONFLICT")
-        if identity["internal_job_id"] != job_id:
-            raise BindingConflict("COMPLETED_REPLAY_INTERNAL_JOB_CONFLICT")
-        identity_digest = sha256_json(identity)
-        reconciliation_id = "reconcile-" + identity_digest[:32]
-        now = utc_now()
-        try:
-            with self._connect() as connection:
-                self._ensure_completed_replay_schema(connection)
-                connection.execute("BEGIN IMMEDIATE")
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-                if row is None:
-                    raise JobError("JOB_NOT_FOUND")
-                if JobState(row["state"]) != JobState.COMPLETED:
-                    raise BindingConflict("COMPLETED_REPLAY_JOB_NOT_COMPLETED")
-                durable_request = json.loads(row["request_json"])
-                binding = durable_request.get("binding", durable_request)
-                exact_binding = {
-                    "task_id": binding.get("task_id") or binding.get("campaign_id"),
-                    "external_job_id": binding.get("external_job_id"),
-                    "internal_job_id": job_id,
-                    "repository": binding.get("repository") or row["repository"],
-                    "target_branch": binding.get("target_branch") or binding.get("branch"),
-                    "generation": binding.get("generation"),
-                    "branch_mode": binding.get("branch_mode"),
-                    "payload_digest": binding.get("payload_digest") or row["payload_digest"],
-                    "files_digest": binding.get("files_digest"),
-                    "message_digest": binding.get("message_digest"),
-                    "worker_principal": binding.get("worker_principal"),
-                    "worker_lineage": binding.get("worker_lineage"),
-                }
-                for key, value in exact_binding.items():
-                    if str(value) != str(identity[key]):
-                        raise BindingConflict("COMPLETED_REPLAY_BINDING_CONFLICT")
-                receipt = json.loads(row["receipt_json"]) if row["receipt_json"] else None
-                if not isinstance(receipt, Mapping):
-                    raise BindingConflict("COMPLETED_REPLAY_RECEIPT_MISSING")
-                if receipt.get("commit_oid") != identity["commit_oid"] or receipt.get("authority_oid") != identity["authority_head_oid"]:
-                    raise BindingConflict("COMPLETED_REPLAY_RECEIPT_AUTHORITY_CONFLICT")
-                completion_identity = sha256_json({
-                    "job_id": row["job_id"],
-                    "revision": int(row["revision"]),
-                    "receipt": receipt,
-                })
-                if identity["completion_identity"] != completion_identity:
-                    raise BindingConflict("COMPLETED_REPLAY_COMPLETION_IDENTITY_CONFLICT")
-                lease_columns = {
-                    str(item[1]) for item in connection.execute("PRAGMA table_info(branch_leases)").fetchall()
-                }
-                if "epoch" in lease_columns:
-                    lease = connection.execute(
-                        "SELECT lease_id, state, current_head_oid, generation FROM branch_leases WHERE job_id=? AND epoch=? ORDER BY rowid DESC LIMIT 1",
-                        (job_id, identity["source_lease_epoch"]),
-                    ).fetchone()
-                else:
-                    if identity["source_lease_epoch"] != 1:
-                        raise BindingConflict("COMPLETED_REPLAY_LEASE_EPOCH_UNAVAILABLE")
-                    lease = connection.execute(
-                        "SELECT lease_id, state, current_head_oid, generation FROM branch_leases WHERE job_id=? ORDER BY rowid DESC LIMIT 1",
-                        (job_id,),
-                    ).fetchone()
-                if lease is None:
-                    raise BindingConflict("COMPLETED_REPLAY_LEASE_MISSING")
-                lease_state = str(lease["state"])
-                lease_head = str(lease["current_head_oid"])
-                lease_generation = int(lease["generation"])
-                event_tables = {
-                    str(item[0]) for item in connection.execute(
-                        "SELECT name FROM sqlite_master WHERE type='table' AND name='branch_lease_events'"
-                    ).fetchall()
-                }
-                if "branch_lease_events" in event_tables:
-                    event = connection.execute(
-                        "SELECT state, current_head_oid, generation FROM branch_lease_events WHERE lease_id=? ORDER BY rowid DESC LIMIT 1",
-                        (lease["lease_id"],),
-                    ).fetchone()
-                    if event is not None:
-                        lease_state = str(event["state"])
-                        lease_head = str(event["current_head_oid"])
-                        lease_generation = int(event["generation"])
-                if lease_state not in {"ACTIVE", "USED", "EXPIRED"}:
-                    raise BindingConflict("COMPLETED_REPLAY_LEASE_STATE_INVALID")
-                if lease_generation != identity["generation"]:
-                    raise BindingConflict("COMPLETED_REPLAY_LEASE_GENERATION_CONFLICT")
-                if len(lease_head) != 40 or any(ch not in "0123456789abcdef" for ch in lease_head):
-                    raise BindingConflict("COMPLETED_REPLAY_LEASE_HEAD_INVALID")
-                if lease_head != identity["historical_lease_head_oid"]:
-                    raise BindingConflict("COMPLETED_REPLAY_HISTORICAL_LEASE_CONFLICT")
-                if identity["commit_oid"] == identity["historical_lease_head_oid"]:
-                    raise BindingConflict("COMPLETED_REPLAY_EVIDENCE_INCOHERENT")
-                existing = connection.execute(
-                    "SELECT * FROM completed_replay_reconciliations WHERE job_id=? ORDER BY created_at ASC",
-                    (job_id,),
-                ).fetchall()
-                for prior in existing:
-                    if prior["identity_digest"] != identity_digest:
-                        raise BindingConflict("COMPLETED_REPLAY_AMBIGUOUS")
-                if existing:
-                    result = dict(existing[0])
-                    connection.commit()
-                    return result
-                provenance_json = json.dumps(identity["provenance"], sort_keys=True, separators=(",", ":"))
-                connection.execute(
-                    "INSERT INTO completed_replay_reconciliations(reconciliation_id,job_id,identity_digest,source_lease_epoch,task_id,external_job_id,internal_job_id,repository,target_branch,generation,branch_mode,payload_digest,files_digest,message_digest,commit_oid,authority_head_oid,worker_principal,worker_lineage,current_head_oid,historical_lease_head_oid,durable_revision,completion_identity,reason,provenance_json,created_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
-                    (
-                        reconciliation_id, job_id, identity["identity_digest"] if "identity_digest" in identity else identity_digest, identity["source_lease_epoch"],
-                        identity["task_id"], identity["external_job_id"], identity["internal_job_id"],
-                        identity["repository"], identity["target_branch"], identity["generation"],
-                        identity["branch_mode"], identity["payload_digest"], identity["files_digest"],
-                        identity["message_digest"], identity["commit_oid"], identity["authority_head_oid"],
-                        identity["worker_principal"], identity["worker_lineage"], identity["authority_head_oid"], identity["historical_lease_head_oid"], identity["durable_revision"],
-                        identity["completion_identity"], identity["reason"], provenance_json, now,
-                    ),
-                )
-                result = dict(connection.execute(
-                    "SELECT * FROM completed_replay_reconciliations WHERE reconciliation_id=?",
-                    (reconciliation_id,),
-                ).fetchone())
-                connection.commit()
-                return result
-        except (JobError, BindingConflict):
-            raise
-        except sqlite3.IntegrityError as exc:
-            try:
-                with self._connect() as connection:
-                    existing = connection.execute(
-                        "SELECT * FROM completed_replay_reconciliations WHERE identity_digest=?",
-                        (identity_digest,),
-                    ).fetchone()
-                if existing is not None:
-                    return dict(existing)
-            except sqlite3.Error:
-                pass
-            raise BindingConflict("COMPLETED_REPLAY_IDEMPOTENCY_CONFLICT") from exc
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-
-    def completed_replay_evidence(self, job_id: str) -> dict[str, Any] | None:
-        try:
-            with self._connect() as connection:
-                rows = connection.execute(
-                    "SELECT * FROM completed_replay_reconciliations WHERE job_id=? ORDER BY created_at ASC",
-                    (job_id,),
-                ).fetchall()
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        if not rows:
-            return None
-        if len({str(row["identity_digest"]) for row in rows}) != 1:
-            raise BindingConflict("COMPLETED_REPLAY_AMBIGUOUS")
-        first = dict(rows[0])
-        immutable_fields = tuple(
-            key for key in first
-            if key != "created_at"
-        )
-        for row in rows[1:]:
-            if any(row[key] != first[key] for key in immutable_fields):
-                raise BindingConflict("COMPLETED_REPLAY_AMBIGUOUS")
-        if not (
-            first["commit_oid"] == first["authority_head_oid"] == first["current_head_oid"]
-            and first["commit_oid"] != first["historical_lease_head_oid"]
-        ):
-            raise BindingConflict("COMPLETED_REPLAY_EVIDENCE_INCOHERENT")
-        return first
-
     def _receipt(self, row: Mapping[str, Any], *, duplicate: bool) -> JobReceipt:
         state = JobState(row["state"])
         if state == JobState.COMPLETED:
@@ -614,11 +324,6 @@ class GitOpsJobController:
             "check_context",
             "check_state",
             "check_description",
-            "external_job_id",
-            "files_digest",
-            "message_digest",
-            "worker_principal",
-            "worker_lineage",
         )
         for field in optional:
             value = request.get(field)
@@ -728,13 +433,16 @@ class GitOpsJobController:
         self.store._mirror(result)
         return self.store._receipt(result, duplicate=True)
 
-    def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE") -> None:
+    def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE", lease_expires_at: str | None = None) -> None:
         if len(current_head_oid) != 40 or generation < 1:
             raise JobError("LEASE_BINDING_INVALID")
         try:
             with self.store._connect() as connection:
                 connection.execute("BEGIN IMMEDIATE")
+                if lease_expires_at is None:
                     updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, state, lease_id, expected_revision))
+                else:
+                    updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,lease_expires_at=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, lease_expires_at, state, lease_id, expected_revision))
                 if updated.rowcount != 1:
                     raise JobError("LEASE_REVISION_CAS_CONFLICT")
                 connection.commit()
@@ -743,6 +451,271 @@ class GitOpsJobController:
         except sqlite3.Error as exc:
             raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
 
+    def renew_lease(
+        self,
+        *,
+        branch: str,
+        lineage_anchor_oid: str,
+        current_head_oid: str,
+        generation: int,
+        lease_expires_at: str,
+    ) -> LeaseRenewalResult:
+        if (
+            not branch
+            or len(lineage_anchor_oid) != 40
+            or len(current_head_oid) != 40
+            or generation < 1
+            or not lease_expires_at.strip()
+        ):
+            raise JobError("LEASE_BINDING_INVALID")
+        try:
+            with self.store._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
+                rows = connection.execute(
+                    "SELECT lease_id, revision, generation, state, lease_expires_at "
+                    "FROM branch_leases "
+                    "WHERE branch=? AND lineage_anchor_oid=? AND current_head_oid=? "
+                    "AND generation=? AND state='ACTIVE' ORDER BY revision DESC",
+                    (branch, lineage_anchor_oid, current_head_oid, generation),
+                ).fetchall()
+                if not rows:
+                    connection.commit()
+                    return LeaseRenewalResult(False, False, False, None)
+                if len(rows) != 1:
+                    raise JobError("LEASE_BINDING_CONFLICT")
+                row = rows[0]
+                try:
+                    current_expires_at = parse_utc(str(row["lease_expires_at"]))
+                    requested_expires_at = parse_utc(lease_expires_at)
+                except (TypeError, ValueError) as exc:
+                    raise JobError("LEASE_EXPIRY_INVALID") from exc
+                now = datetime.now(timezone.utc)
+                if requested_expires_at <= now:
+                    raise JobError("LEASE_EXPIRY_INVALID")
+                if current_expires_at > now:
+                    connection.commit()
+                    return LeaseRenewalResult(
+                        False,
+                        True,
+                        True,
+                        str(row["lease_expires_at"]),
+                    )
+                updated = connection.execute(
+                    "UPDATE branch_leases SET lease_expires_at=?,revision=revision+1 "
+                    "WHERE lease_id=? AND revision=? AND generation=? "
+                    "AND state='ACTIVE' AND lease_expires_at=?",
+                    (
+                        lease_expires_at,
+                        row["lease_id"],
+                        int(row["revision"]),
+                        generation,
+                        row["lease_expires_at"],
+                    ),
+                )
+                if updated.rowcount != 1:
+                    current = connection.execute(
+                        "SELECT lease_expires_at, generation, state FROM branch_leases "
+                        "WHERE lease_id=?",
+                        (row["lease_id"],),
+                    ).fetchone()
+                    if (
+                        current is not None
+                        and int(current["generation"]) == generation
+                        and current["state"] == "ACTIVE"
+                        and parse_utc(str(current["lease_expires_at"])) > now
+                    ):
+                        connection.commit()
+                        return LeaseRenewalResult(
+                            False,
+                            True,
+                            True,
+                            str(current["lease_expires_at"]),
+                        )
+                    raise JobError("LEASE_REVISION_CAS_CONFLICT")
+                connection.commit()
+                return LeaseRenewalResult(True, False, True, lease_expires_at)
+        except JobError:
+            raise
+        except sqlite3.Error as exc:
+            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
+
+    def begin_continuation_cycle(
+        self,
+        job_id: str,
+        *,
+        idempotency_key: str,
+        expected_head_oid: str,
+        generation: int,
+        expected_revision: int,
+    ) -> dict[str, Any]:
+        if (
+            not idempotency_key
+            or len(idempotency_key) > 128
+            or not all(character.isalnum() or character in "._:-" for character in idempotency_key)
+            or len(expected_head_oid) != 40
+            or any(character not in "0123456789abcdef" for character in expected_head_oid)
+            or generation < 1
+        ):
+            raise JobError("CONTINUATION_CYCLE_BINDING_INVALID")
+        try:
+            with self.store._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
+                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
+                if row is None:
+                    raise JobError("JOB_NOT_FOUND")
+                existing = connection.execute(
+                    "SELECT * FROM continuation_cycles WHERE job_id=? AND idempotency_key=?",
+                    (job_id, idempotency_key),
+                ).fetchone()
+                if existing is not None:
+                    if str(existing["expected_head_oid"]) != expected_head_oid or int(existing["generation"]) != generation:
+                        raise JobError("CONTINUATION_CYCLE_BINDING_CONFLICT")
+                    if str(existing["state"]) == "COMPLETED":
+                        connection.commit()
+                        return {"completed": True, "commit_oid": str(existing["commit_oid"] or ""), "idempotent": True}
+                    if str(row["state"]) == JobState.COMPLETED.value:
+                        receipt = json.loads(str(row["receipt_json"] or "{}"))
+                        commit_oid = str(receipt.get("authority_oid") or "")
+                        lease = connection.execute(
+                            "SELECT current_head_oid FROM branch_leases WHERE job_id=? AND generation=? AND state='ACTIVE'",
+                            (job_id, generation),
+                        ).fetchall()
+                        if (
+                            len(lease) == 1
+                            and len(commit_oid) == 40
+                            and str(lease[0]["current_head_oid"] or "") == commit_oid
+                            and receipt.get("remote_verified") is True
+                        ):
+                            now = utc_now()
+                            connection.execute(
+                                "UPDATE continuation_cycles SET state='COMPLETED',commit_oid=?,updated_at=? "
+                                "WHERE job_id=? AND idempotency_key=? AND state='ACTIVE'",
+                                (commit_oid, now, job_id, idempotency_key),
+                            )
+                            connection.commit()
+                            return {"completed": True, "commit_oid": commit_oid, "idempotent": True}
+                        raise JobError("CONTINUATION_CYCLE_RECOVERY_REQUIRED")
+                    connection.commit()
+                    return {"completed": False, "commit_oid": None, "idempotent": True}
+                if int(row["revision"]) != expected_revision:
+                    raise JobError("REVISION_CAS_CONFLICT")
+                if str(row["state"]) != JobState.COMPLETED.value:
+                    raise JobError("CONTINUATION_CYCLE_JOB_STATE_INVALID")
+                if str(row["branch"]) in {"main", "master"} or str(row["branch"]).startswith(("refs/", "tags/")):
+                    raise JobError("PROTECTED_BRANCH_REJECTED")
+                receipt = json.loads(str(row["receipt_json"] or "{}"))
+                if receipt.get("remote_verified") is not True or any(
+                    str(receipt.get(field) or "") != expected_head_oid
+                    for field in ("authority_oid", "api_branch_oid", "git_remote_oid")
+                ):
+                    raise JobError("CONTINUATION_CYCLE_RECEIPT_INVALID")
+                leases = connection.execute(
+                    "SELECT * FROM branch_leases WHERE job_id=? AND branch=? AND generation=? AND state='ACTIVE'",
+                    (job_id, str(row["branch"]), generation),
+                ).fetchall()
+                if len(leases) != 1 or str(leases[0]["current_head_oid"] or "") != expected_head_oid:
+                    raise JobError("CONTINUATION_CYCLE_LEASE_INVALID")
+                if connection.execute(
+                    "SELECT 1 FROM continuation_cycles WHERE job_id=? AND state='ACTIVE' LIMIT 1",
+                    (job_id,),
+                ).fetchone() is not None:
+                    raise JobError("CONTINUATION_CYCLE_ACTIVE_CONFLICT")
+                sequence = int(connection.execute(
+                    "SELECT COALESCE(MAX(sequence),0)+1 FROM continuation_cycles WHERE job_id=?",
+                    (job_id,),
+                ).fetchone()[0])
+                now = utc_now()
+                connection.execute(
+                    "INSERT INTO continuation_cycles(job_id,idempotency_key,sequence,expected_head_oid,generation,state,commit_oid,created_at,updated_at) "
+                    "VALUES(?,?,?,?,?,'ACTIVE',NULL,?,?)",
+                    (job_id, idempotency_key, sequence, expected_head_oid, generation, now, now),
+                )
+                next_revision = expected_revision + 1
+                updated = connection.execute(
+                    "UPDATE jobs SET state=?,side_effect_state=?,revision=?,updated_at=? WHERE job_id=? AND revision=?",
+                    (JobState.LEASED.value, "CONTINUATION_LEASED", next_revision, now, job_id, expected_revision),
+                )
+                if updated.rowcount != 1:
+                    raise JobError("REVISION_CAS_CONFLICT")
+                connection.execute(
+                    "INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)",
+                    (job_id, JobState.COMPLETED.value, JobState.LEASED.value, next_revision, "CONTINUATION_LEASED", now),
+                )
+                cycle_receipt = {
+                    "idempotency_key": idempotency_key,
+                    "expected_head_oid": expected_head_oid,
+                    "generation": generation,
+                    "sequence": sequence,
+                }
+                connection.execute(
+                    "INSERT INTO receipts(receipt_id,job_id,kind,digest,payload_json,created_at) VALUES(?,?,?,?,?,?)",
+                    (
+                        f"receipt-{job_id}-{next_revision}",
+                        job_id,
+                        "CONTINUATION_LEASED",
+                        hashlib.sha256(canonical_json(cycle_receipt)).hexdigest(),
+                        json.dumps(cycle_receipt, sort_keys=True),
+                        now,
+                    ),
+                )
+                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
+                connection.commit()
+        except (JobError, BindingConflict):
+            raise
+        except sqlite3.Error as exc:
+            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
+        result["request"] = json.loads(result["request_json"])
+        self.store._mirror(result)
+        return {"completed": False, "commit_oid": None, "idempotent": False}
+
+    def complete_continuation_cycle(self, job_id: str, *, idempotency_key: str, commit_oid: str) -> bool:
+        if len(commit_oid) != 40 or any(character not in "0123456789abcdef" for character in commit_oid):
+            raise JobError("CONTINUATION_CYCLE_COMMIT_OID_INVALID")
+        try:
+            with self.store._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
+                cycle = connection.execute(
+                    "SELECT * FROM continuation_cycles WHERE job_id=? AND idempotency_key=?",
+                    (job_id, idempotency_key),
+                ).fetchone()
+                if cycle is None:
+                    connection.commit()
+                    return False
+                if str(cycle["state"]) == "COMPLETED":
+                    if str(cycle["commit_oid"] or "") != commit_oid:
+                        raise JobError("CONTINUATION_CYCLE_COMMIT_CONFLICT")
+                    connection.commit()
+                    return True
+                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
+                leases = connection.execute(
+                    "SELECT current_head_oid FROM branch_leases WHERE job_id=? AND generation=? AND state='ACTIVE'",
+                    (job_id, int(cycle["generation"])),
+                ).fetchall()
+                receipt = json.loads(str(row["receipt_json"] or "{}")) if row is not None else {}
+                if (
+                    row is None
+                    or str(row["state"]) != JobState.COMPLETED.value
+                    or receipt.get("remote_verified") is not True
+                    or str(receipt.get("authority_oid") or "") != commit_oid
+                    or len(leases) != 1
+                    or str(leases[0]["current_head_oid"] or "") != commit_oid
+                ):
+                    raise JobError("CONTINUATION_CYCLE_COMPLETION_EVIDENCE_INVALID")
+                now = utc_now()
+                updated = connection.execute(
+                    "UPDATE continuation_cycles SET state='COMPLETED',commit_oid=?,updated_at=? "
+                    "WHERE job_id=? AND idempotency_key=? AND state='ACTIVE'",
+                    (commit_oid, now, job_id, idempotency_key),
+                )
+                if updated.rowcount != 1:
+                    raise JobError("CONTINUATION_CYCLE_CAS_CONFLICT")
+                connection.commit()
+                return True
+        except (JobError, BindingConflict):
+            raise
+        except sqlite3.Error as exc:
+            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
+
     def advance(self, job_id: str, state: JobState, *, side_effect_state: str, receipt: Mapping[str, Any] | None = None, expected_revision: int | None = None) -> JobReceipt:
         return self._advance(
             job_id,

active-runtime/app/aios_gitops_model_api.py

@@ -5,8 +5,6 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
 
-from release_version import validate_release_version
-
 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WORKSPACE = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
 DB_PATH = Path(os.getenv('AIOS_GITOPS_DB', str(ROOT / 'runtime' / 'gitops_model.sqlite3')))
@@ -220,11 +218,7 @@ class Handler(BaseHTTPRequestHandler):
                 a = self.require_write(['owner']);
                 if not a: return
                 ver=data.get('version') or data.get('tag')
-                try:
-                    validate_release_version(ver)
-                except ValueError:
-                    self.send_json({'error':'version must match VxRxCx'},400)
-                    return
+                if not re.match(r'^V\d+R\d+C\d+(-[a-zA-Z0-9_.-]+)?$', ver or ''): self.send_json({'error':'version must match VxRxCx'},400); return
                 msg=data.get('message') or f'release {ver}'; out=git_cmd(['tag','-a',ver,'-m',msg]);
                 if data.get('push',False): git_cmd(['push','origin',ver])
                 level='V' if re.match(r'^V[1-9]\d*R0C0', ver) else ('R' if re.match(r'^V\d+R[1-9]\d*C0', ver) else 'C'); exec_sql('INSERT OR REPLACE INTO gitops_versions(version,tag,level,summary,status,created_by,created_at) VALUES(?,?,?,?,?,?,?)',(ver,ver,level,msg,'ready',a['username'],now())); exec_sql('UPDATE gitops_baseline SET active_version=?,active_tag=?,updated_at=? WHERE id=?',(ver,ver,now(),'current')); audit(a['username'],'git_tag',ver,{'level':level}); self.send_json({'status':'tagged','version':ver,'git':out}); return

active-runtime/app/aios_governed_task_bootstrap.py

@@ -2,6 +2,8 @@
 from __future__ import annotations
 
 from dataclasses import dataclass, asdict
+from contextlib import contextmanager
+import fcntl
 import hashlib
 import json
 from pathlib import Path
@@ -9,7 +11,11 @@ import re
 from typing import Any, Mapping
 
 from aios_gitops_job_controller import GitOpsJobController, JobStore
-from aios_online_agent_execution import GovernedExecutionBinding, project_execution_envelope
+from aios_online_agent_execution import (
+    GovernedExecutionBinding,
+    project_execution_envelope,
+    project_online_task,
+)
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
@@ -37,42 +43,103 @@ class GovernedTaskBinding:
         return {"task_id": self.task_id, "repository": self.repository, "base_oid": self.base_oid, "target_branch": self.target_branch, "expected_branch_oid": self.expected_branch_oid, "generation": self.generation, "branch_mode": self.branch_mode, "create_target_branch": self.branch_mode == "CREATE_NEW", "worktree_mode": "detached_at_base_oid" if self.branch_mode == "CREATE_NEW" else "detached_at_expected_head", "cas_ref_update_required": True, "idempotent": idempotent, "state": "BOUND", "job_id": self.job_id}
 
 
-def _safe(value: str) -> str:
+def _legacy_safe(value: str) -> str:
     return re.sub(r"[^A-Za-z0-9_.-]+", "-", value).strip("-")[:120] or "task"
 
 
+def _task_key(value: str) -> str:
+    readable = _legacy_safe(value)[:72]
+    return f"{readable}-{hashlib.sha256(value.encode('utf-8')).hexdigest()[:24]}"
+
+
 class GovernedTaskBootstrap:
     def __init__(self, authority: Any, root: Path, *, remote_name: str, token_path: Path, ssh_key_path: Path, api_base: str = "https://g.cnnetmkt.top/git/api/v1") -> None:
-        self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.task_meta_root.mkdir(parents=True, exist_ok=True); self.job_root.mkdir(parents=True, exist_ok=True)
+        self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.lock_root = self.root / "task-locks"; self.task_meta_root.mkdir(parents=True, exist_ok=True); self.job_root.mkdir(parents=True, exist_ok=True); self.lock_root.mkdir(parents=True, exist_ok=True)
 
     def _store(self, task_id: str) -> tuple[JobStore, GitOpsJobController]:
-        root = self.job_root / _safe(task_id); store = JobStore(root, payload_root=root / "payloads"); return store, GitOpsJobController(store)
+        legacy = self.job_root / _legacy_safe(task_id)
+        keyed = self.job_root / _task_key(task_id)
+        root = legacy if legacy.is_dir() and not keyed.exists() else keyed
+        store = JobStore(root, payload_root=root / "payloads"); return store, GitOpsJobController(store)
 
     def _metadata(self, task_id: str) -> Path:
-        return self.task_meta_root / (_safe(task_id) + ".json")
+        return self.task_meta_root / (_task_key(task_id) + ".json")
+
+    def _legacy_metadata(self, task_id: str) -> Path:
+        return self.task_meta_root / (_legacy_safe(task_id) + ".json")
+
+    @contextmanager
+    def _task_lock(self, task_id: str):
+        path = self.lock_root / (_task_key(task_id) + ".lock")
+        with path.open("a+b") as handle:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+
+    @contextmanager
+    def _branch_lock(self, repository: str, target_branch: str):
+        key = hashlib.sha256((repository + "\0" + target_branch).encode("utf-8")).hexdigest()
+        path = self.lock_root / ("branch-" + key + ".lock")
+        with path.open("a+b") as handle:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
 
     def _read_existing(self, task_id: str) -> GovernedTaskBinding | None:
         path = self._metadata(task_id)
+        if not path.exists():
+            path = self._legacy_metadata(task_id)
         if not path.is_file() or path.is_symlink(): return None
-
-        return GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
-    def get_binding(self, task_id: str) -> GovernedTaskBinding:
-        """Read the exact durable binding; never synthesize missing lineage."""
-        binding = self._read_existing(str(task_id))
-        if binding is None or not binding.job_id:
-            raise BootstrapError("TASK_EXECUTION_PROJECTION_MISSING")
+        binding = GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
+        if binding.task_id != task_id:
+            raise BootstrapError("TASK_BINDING_KEY_COLLISION")
         return binding
 
+    def get_binding(self, task_id: str) -> GovernedTaskBinding:
+        """Return the exact durable binding; never synthesize missing lineage."""
+        existing = self._read_existing(str(task_id))
+        if existing is None or not existing.job_id:
+            raise BootstrapError("TASK_EXECUTION_PROJECTION_MISSING")
+        return existing
+
     def execution_binding(self, binding: GovernedTaskBinding) -> GovernedExecutionBinding:
+        expected = binding.expected_branch_oid
+        mode = binding.branch_mode
+        if mode == "CREATE_NEW":
+            current = self.authority.read_ref("refs/heads/" + binding.target_branch)
+            if current is not None:
+                store, _ = self._store(binding.task_id)
+                with store._connect() as connection:
+                    rows = connection.execute(
+                        "SELECT current_head_oid,generation,state,lineage_anchor_oid "
+                        "FROM branch_leases WHERE job_id=? AND branch=? AND state='ACTIVE' "
+                        "ORDER BY revision DESC",
+                        (binding.job_id, binding.target_branch),
+                    ).fetchall()
+                if len(rows) != 1:
+                    raise BootstrapError("SAME_JOB_CONTINUATION_LEASE_INVALID")
+                row = rows[0]
+                if (
+                    str(row["current_head_oid"] or "") != current
+                    or int(row["generation"] or 0) != binding.generation
+                    or str(row["lineage_anchor_oid"] or "") != binding.base_oid
+                ):
+                    raise BootstrapError("SAME_JOB_CONTINUATION_BINDING_INVALID")
+                expected = current
+                mode = "CONTINUE_EXISTING"
         return GovernedExecutionBinding.from_mapping(
             {
                 "task_id": binding.task_id,
                 "job_id": binding.job_id,
                 "repository": binding.repository,
                 "base_oid": binding.base_oid,
-                "expected_branch_oid": binding.expected_branch_oid,
+                "expected_branch_oid": expected,
                 "target_branch": binding.target_branch,
-                "branch_mode": binding.branch_mode,
+                "branch_mode": mode,
                 "generation": binding.generation,
                 "idempotency_key": binding.idempotency_key,
             }
@@ -95,16 +162,42 @@ class GovernedTaskBootstrap:
             required_capabilities=required_capabilities,
         )
 
+    def online_task_projection(
+        self,
+        task_id: str,
+        task_request: Mapping[str, Any],
+        execution_request: Mapping[str, Any] | None = None,
+        *,
+        expected_job_id: str | None = None,
+    ) -> dict[str, Any]:
+        binding = self.get_binding(task_id)
+        if expected_job_id and binding.job_id != expected_job_id:
+            raise BootstrapError("JOB_BINDING_CONFLICT")
+        return project_online_task(self.execution_binding(binding), task_request, execution_request)
+
     def _write(self, binding: GovernedTaskBinding) -> None:
         path = self._metadata(binding.task_id); temporary = path.with_suffix(".tmp"); temporary.write_text(json.dumps(asdict(binding), sort_keys=True), encoding="utf-8"); temporary.replace(path)
 
     def create(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        task_id = str(request.get("task_id") or "")
+        if not task_id:
+            raise BootstrapError("TASK_BINDING_INVALID")
+        repository = str(request.get("repository") or "")
+        target_branch = str(request.get("target_branch") or "")
+        with self._task_lock(task_id):
+            with self._branch_lock(repository, target_branch):
+                return self._create_locked(request)
+
+    def _create_locked(self, request: Mapping[str, Any]) -> dict[str, Any]:
         values = {key: str(request[key]) for key in ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")}
         if values["repository"] != "aios/aios" or not OID_RE.fullmatch(values["base_oid"]): raise BootstrapError("TASK_BINDING_INVALID")
         if not BRANCH_RE.fullmatch(values["target_branch"]): raise BootstrapError("TARGET_BRANCH_INVALID")
         existing = self._read_existing(values["task_id"])
         if existing is not None:
-            if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description")): raise BootstrapError("TASK_BINDING_CONFLICT")
+            if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")): raise BootstrapError("TASK_BINDING_CONFLICT")
+            optional = {"expected_branch_oid": existing.expected_branch_oid, "branch_mode": existing.branch_mode, "generation": existing.generation}
+            for key, durable in optional.items():
+                if key in request and str(request[key]) != str(durable): raise BootstrapError("TASK_BINDING_CONFLICT")
             return existing.response(idempotent=True)
         if not self.authority.commit_exists(values["base_oid"]): raise BootstrapError("BASE_COMMIT_NOT_FOUND")
         current = self.authority.read_ref("refs/heads/" + values["target_branch"])
@@ -114,8 +207,24 @@ class GovernedTaskBootstrap:
             if expected != values["base_oid"]: raise BootstrapError("EXPECTED_BASE_CONFLICT")
         else:
             if expected != current: raise BootstrapError("EXISTING_BRANCH_OID_CONFLICT")
-            mode, generation = "CONTINUE_EXISTING", int(request.get("generation", 2))
-            if generation < 1: raise BootstrapError("GENERATION_INVALID")
+            parent_task_id = str(request.get("parent_task_id") or "")
+            parent_job_id = str(request.get("parent_job_id") or "")
+            if not parent_task_id or not parent_job_id:
+                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_REQUIRED")
+            parent = self._read_existing(parent_task_id)
+            if parent is None or parent.job_id != parent_job_id or parent.repository != values["repository"] or parent.target_branch != values["target_branch"]:
+                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_CONFLICT")
+            store, _ = self._store(parent_task_id)
+            with store._connect() as connection:
+                rows = connection.execute(
+                    "SELECT current_head_oid,generation,state FROM branch_leases WHERE job_id=? AND branch=? AND state='ACTIVE' ORDER BY revision DESC",
+                    (parent_job_id, values["target_branch"]),
+                ).fetchall()
+            if len(rows) != 1 or str(rows[0]["current_head_oid"] or "") != current:
+                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_CONFLICT")
+            mode, generation = "CONTINUE_EXISTING", int(rows[0]["generation"]) + 1
+            if "generation" in request and int(request["generation"]) != generation:
+                raise BootstrapError("GENERATION_BINDING_CONFLICT")
         payload = json.dumps(values, sort_keys=True, separators=(",", ":")).encode()
         _, controller = self._store(values["task_id"])
         receipt = controller.submit({"idempotency_key": values["idempotency_key"], "campaign_id": values["task_id"], "task_id": values["task_id"], "repository": values["repository"], "operation": "GOVERNED_TASK_CREATE", "branch": values["target_branch"], "expected_branch_oid": expected, "payload_digest": hashlib.sha256(payload).hexdigest(), "lineage_anchor_oid": values["base_oid"]}, payload=payload)

active-runtime/app/aios_isolated_executor.py

@@ -0,0 +1,306 @@
+"""Uncredentialed deterministic executor for governed Online Agent changes.
+
+This process never receives Agent/Owner/Bridge credentials and never writes Git refs.
+It operates only on an exchange bundle and returns hash-bound changed files + test evidence.
+"""
+from __future__ import annotations
+
+import base64
+from dataclasses import dataclass
+import errno
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import socket
+import subprocess
+import tarfile
+import tempfile
+import time
+from typing import Any, Mapping, Sequence
+
+ALLOWED_PROGRAMS = {"/usr/bin/python3", "/usr/bin/git", "/bin/true", "/usr/bin/true"}
+MAX_ARCHIVE_BYTES = 64 * 1024 * 1024
+MAX_FILE_BYTES = 4 * 1024 * 1024
+SECRET_ENV_TOKENS = ("TOKEN", "SECRET", "PASSWORD", "CREDENTIAL", "AUTHORIZATION", "PRIVATE_KEY")
+REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{15,254}$")
+SENSITIVE_VALUE_RE = re.compile(
+    r"(?i)(authorization\s*[:=]\s*bearer\s+\S+|authorization\s+bearer\s+\S+|"
+    r"(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+)"
+)
+
+
+class IsolatedExecutorError(RuntimeError):
+    pass
+
+
+def sha256(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def safe_relative(value: object) -> str:
+    if not isinstance(value, str) or not value or value.startswith("/"):
+        raise IsolatedExecutorError("PATH_INVALID")
+    path = Path(value)
+    if ".." in path.parts or "." in path.parts or any(part in {"", ".git"} for part in path.parts):
+        raise IsolatedExecutorError("PATH_INVALID")
+    return path.as_posix()
+
+
+def resolve_under(root: Path, relative: str) -> Path:
+    root = root.resolve()
+    path = (root / safe_relative(relative)).resolve(strict=False)
+    if path == root or root not in path.parents:
+        raise IsolatedExecutorError("PATH_ESCAPE")
+    return path
+
+
+def _credential_exposure(directory: Path) -> str | None:
+    """Return an exposure code; EACCES is the intended credential isolation proof."""
+    try:
+        if not directory.exists():
+            return None
+        if directory.is_symlink():
+            return "CREDENTIAL_MOUNT_SYMLINK"
+        if os.access(directory, os.R_OK):
+            return "CREDENTIAL_MOUNT_ACCESSIBLE"
+        if directory.is_dir():
+            for child in directory.iterdir():
+                if child.is_file() and os.access(child, os.R_OK):
+                    return "CREDENTIAL_FILE_ACCESSIBLE"
+    except PermissionError:
+        return None
+    return None
+
+
+def assert_uncredentialed() -> None:
+    credentials = Path("/run/credentials")
+    candidates = {credentials}
+    credentials_directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
+    candidates.add(credentials_directory)
+    leaked = sorted(
+        key for key, value in os.environ.items()
+        if value
+        and (any(token in key.upper() for token in SECRET_ENV_TOKENS) or SENSITIVE_VALUE_RE.search(str(value)))
+    )
+    if leaked:
+        raise IsolatedExecutorError("CREDENTIAL_ENV_EXPOSED:" + ",".join(leaked))
+    for directory in candidates:
+        exposure = _credential_exposure(directory)
+        if exposure is not None:
+            raise IsolatedExecutorError(exposure)
+    # In the intended PrivateNetwork namespace host loopback services are unreachable.
+    try:
+        probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    except OSError as exc:
+        if exc.errno in {errno.EACCES, errno.EPERM, errno.EAFNOSUPPORT}:
+            return
+        raise IsolatedExecutorError("NETWORK_ISOLATION_PROBE_FAILED") from exc
+    probe.settimeout(0.15)
+    try:
+        if probe.connect_ex(("127.0.0.1", 18892)) == 0:
+            raise IsolatedExecutorError("GOVERNED_BRIDGE_REACHABLE")
+    finally:
+        probe.close()
+
+
+def extract_source(archive: Path, root: Path) -> None:
+    if archive.is_symlink() or not archive.is_file() or archive.stat().st_size > MAX_ARCHIVE_BYTES:
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_INVALID")
+    with tarfile.open(archive, "r:gz") as tf:
+        for member in tf.getmembers():
+            path = Path(member.name)
+            if path.is_absolute() or ".." in path.parts or ".git" in path.parts:
+                raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
+            if member.issym() or member.islnk():
+                raise IsolatedExecutorError("SOURCE_ARCHIVE_LINK_DENY")
+        tf.extractall(root, filter="data")
+
+
+def run_command(item: Mapping[str, Any], root: Path) -> dict[str, Any]:
+    argv = item.get("argv")
+    if not isinstance(argv, Sequence) or isinstance(argv, (str, bytes)) or not argv:
+        raise IsolatedExecutorError("COMMAND_INVALID")
+    argv = [str(part) for part in argv]
+    if argv[0] not in ALLOWED_PROGRAMS:
+        raise IsolatedExecutorError("COMMAND_PROGRAM_DENY")
+    if argv[0] == "/usr/bin/python3" and "-m" in argv:
+        index = argv.index("-m")
+        if index + 1 >= len(argv) or argv[index + 1] not in {"pytest", "py_compile"}:
+            raise IsolatedExecutorError("PYTHON_MODULE_DENY")
+    if argv[0] == "/usr/bin/git" and any(
+        token in {"push", "update-ref", "commit", "merge", "rebase", "reset", "clean", "branch"}
+        for token in argv[1:]
+    ):
+        raise IsolatedExecutorError("GIT_MUTATION_DENY")
+    timeout = int(item.get("timeout_seconds") or 300)
+    if not 1 <= timeout <= 1800:
+        raise IsolatedExecutorError("COMMAND_TIMEOUT_INVALID")
+    cwd = root if item.get("cwd", ".") == "." else resolve_under(root, str(item.get("cwd")))
+    started = time.monotonic()
+    completed = subprocess.run(
+        argv,
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=timeout,
+        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
+    )
+    result = {
+        "label": str(item.get("label") or "command"),
+        "exit_code": completed.returncode,
+        "stdout_sha256": sha256(completed.stdout.encode("utf-8", "replace")),
+        "stderr_sha256": sha256(completed.stderr.encode("utf-8", "replace")),
+        "duration_ms": int((time.monotonic() - started) * 1000),
+    }
+    if completed.returncode != 0:
+        raise IsolatedExecutorError(
+            "COMMAND_FAILED:" + result["label"] + ":" + str(completed.returncode)
+        )
+    return result
+
+
+def apply_changes(request: Mapping[str, Any], root: Path) -> list[str]:
+    changes = request.get("change_set")
+    if not isinstance(changes, list) or not changes:
+        raise IsolatedExecutorError("CHANGE_SET_INVALID")
+    changed: list[str] = []
+    for change in changes:
+        if not isinstance(change, Mapping):
+            raise IsolatedExecutorError("CHANGE_INVALID")
+        relative = safe_relative(change.get("path"))
+        path = resolve_under(root, relative)
+        current = path.read_bytes() if path.is_file() else None
+        expected = change.get("expected_sha256")
+        if expected is not None and (current is None or sha256(current) != expected):
+            raise IsolatedExecutorError("SOURCE_DRIFT:" + relative)
+        operation = change.get("operation")
+        if operation == "write_file":
+            content = change.get("content")
+            if not isinstance(content, str):
+                raise IsolatedExecutorError("WRITE_CONTENT_INVALID")
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(content, encoding="utf-8")
+        elif operation == "replace_text":
+            if current is None:
+                raise IsolatedExecutorError("REPLACE_SOURCE_MISSING")
+            old = str(change.get("old"))
+            new = str(change.get("new"))
+            count = int(change.get("count", 1))
+            text = current.decode("utf-8")
+            if text.count(old) != count:
+                raise IsolatedExecutorError("REPLACE_COUNT_INVALID:" + relative)
+            path.write_text(text.replace(old, new), encoding="utf-8")
+        elif operation == "delete_file":
+            if path.exists():
+                path.unlink()
+        else:
+            raise IsolatedExecutorError("CHANGE_OPERATION_INVALID")
+        changed.append(relative)
+    return sorted(set(changed))
+
+
+def changed_bundle(root: Path, changed: list[str]) -> list[dict[str, Any]]:
+    files = []
+    for relative in changed:
+        path = resolve_under(root, relative)
+        if path.exists():
+            data = path.read_bytes()
+            if len(data) > MAX_FILE_BYTES:
+                raise IsolatedExecutorError("CHANGED_FILE_TOO_LARGE:" + relative)
+            files.append({
+                "path": relative,
+                "deleted": False,
+                "sha256": sha256(data),
+                "content_b64": base64.b64encode(data).decode("ascii"),
+            })
+        else:
+            files.append({"path": relative, "deleted": True, "sha256": None, "content_b64": None})
+    return files
+
+
+def execute_request(request_path: Path, result_path: Path) -> None:
+    assert_uncredentialed()
+    request = json.loads(request_path.read_text(encoding="utf-8"))
+    if request.get("schema") != "aios.isolated-execution.request.v1":
+        raise IsolatedExecutorError("REQUEST_SCHEMA_INVALID")
+    request_id = request.get("request_id")
+    if not isinstance(request_id, str) or not REQUEST_ID_RE.fullmatch(request_id):
+        raise IsolatedExecutorError("REQUEST_ID_INVALID")
+    source_archive = Path(str(request.get("source_archive") or ""))
+    if not source_archive.is_absolute():
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
+    expected_archive_sha = str(request.get("source_archive_sha256") or "")
+    if sha256(source_archive.read_bytes()) != expected_archive_sha:
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_SHA_MISMATCH")
+    with tempfile.TemporaryDirectory(prefix="aios-isolated-executor-") as temporary:
+        root = Path(temporary) / "workspace"
+        root.mkdir()
+        extract_source(source_archive, root)
+        changed = apply_changes(request, root)
+        commands = [
+            run_command(item, root)
+            for item in request.get("verification", [])
+            if isinstance(item, Mapping)
+        ]
+        result = {
+            "schema": "aios.isolated-execution.result.v1",
+            "request_id": request_id,
+            "request_sha256": sha256(canonical(request)),
+            "changed_files": changed_bundle(root, changed),
+            "verification": commands,
+            "credential_isolation": {
+                "credential_env_absent": True,
+                "credential_mount_inaccessible": True,
+                "governed_bridge_unreachable": True,
+            },
+        }
+        result["result_sha256"] = sha256(canonical(result))
+        temporary_result = result_path.with_suffix(".tmp")
+        temporary_result.write_text(json.dumps(result, sort_keys=True, separators=(",", ":")), encoding="utf-8")
+        os.replace(temporary_result, result_path)
+
+
+def serve(root: Path) -> None:
+    assert_uncredentialed()
+    requests = root / "requests"
+    results = root / "results"
+    failed = root / "failed"
+    for path in (requests, results, failed):
+        path.mkdir(parents=True, exist_ok=True)
+    while True:
+        for request in sorted(requests.glob("*.json")):
+            if request.is_symlink():
+                continue
+            result = results / request.name
+            try:
+                execute_request(request, result)
+                request.unlink()
+            except Exception as exc:
+                (failed / request.name).write_text(
+                    json.dumps({"error": str(exc) or type(exc).__name__}, sort_keys=True),
+                    encoding="utf-8",
+                )
+                request.unlink(missing_ok=True)
+        time.sleep(0.5)
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--root", default="/var/lib/aios-online-agent-executor")
+    parser.add_argument("--request")
+    parser.add_argument("--result")
+    args = parser.parse_args()
+    if args.request and args.result:
+        execute_request(Path(args.request), Path(args.result))
+    else:
+        serve(Path(args.root))

active-runtime/app/aios_model_api_staging.py

@@ -4,7 +4,6 @@ import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, urllib.
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from baseline_authority import BaselineAuthority, BaselineAuthorityError
-from silent_release_controller import ReleaseCandidate
 from typing import Any
 
 try:
@@ -29,18 +28,11 @@ from orchestrator.action_monitor import ActionMonitor
 from silent_release_hardening import (
     ApprovalKeyRing,
     ApprovalRevocationStore,
-    BuilderAttestation,
-    BuilderAttestationKeyRing,
-    BuilderAttestationVerifier,
     CapabilityAuthorizationError,
-    ReleasePlan,
     SagaConflict,
     SignedApprovalVerifier,
     SignedReleasePlanApproval,
     SilentReleaseActionService,
-    TrustedCandidateBuilderUnavailable,
-    TrustedCandidateBundle,
-    TrustedReleasePolicy,
 )
 try:
     from aios_gitops_job_controller import GitOpsJobController, JobError, ServiceUnavailable, JobStore
@@ -90,34 +82,13 @@ SILENT_RELEASE_STATE_ROOT = Path(os.getenv(
     'AIOS_SILENT_RELEASE_STATE_ROOT',
     '/var/lib/aios-gitops/silent-release',
 ))
-# This immutable staging API can prepare only a shadow candidate.  An
-# environment value must not turn its HTTP process into a release executor.
-SILENT_RELEASE_EXECUTION_ENABLED = False
+SILENT_RELEASE_EXECUTION_ENABLED = str(os.getenv(
+    'AIOS_SILENT_RELEASE_EXECUTION_ENABLED', 'false'
+)).lower() in {'1', 'true', 'yes', 'on'}
 SILENT_RELEASE_PUBLIC_KEYS = Path(os.getenv(
     'AIOS_SILENT_RELEASE_PUBLIC_KEYS',
     '/etc/aios-gitops/silent-release-owner-public-keys.json',
 ))
-TRUSTED_BUILDER_ENABLED = str(os.getenv(
-    'AIOS_TRUSTED_CANDIDATE_BUILDER_ENABLED', 'false'
-)).lower() in {'1', 'true', 'yes', 'on'}
-TRUSTED_BUILDER_POLICY = Path(os.getenv(
-    'AIOS_TRUSTED_CANDIDATE_BUILDER_POLICY', ''
-))
-TRUSTED_BUILDER_CREDENTIALS_DIRECTORY = Path(os.getenv(
-    'AIOS_TRUSTED_CANDIDATE_BUILDER_CREDENTIALS_DIRECTORY',
-    os.getenv('CREDENTIALS_DIRECTORY', ''),
-))
-TRUSTED_BUILDER_SOCKET = Path(os.getenv(
-    'AIOS_TRUSTED_CANDIDATE_BUILDER_SOCKET',
-    '/run/aios-trusted-candidate-builder.sock',
-))
-TRUSTED_BUILDER_PUBLIC_KEYRING = Path(os.getenv(
-    'AIOS_TRUSTED_CANDIDATE_BUILDER_PUBLIC_KEYRING', ''
-))
-TRUSTED_RELEASE_POLICY = Path(os.getenv(
-    'AIOS_SILENT_RELEASE_TRUSTED_POLICY',
-    str(WS / 'config' / 'gitops' / 'silent-release-policy.json'),
-))
 monitor = ActionMonitor()
 
 BASE_MODELS = [
@@ -195,86 +166,6 @@ def _file_sha256(path: Path) -> str:
             digest.update(chunk)
     return digest.hexdigest()
 
-
-def _trusted_release_policy_from_file(path: Path) -> TrustedReleasePolicy:
-    payload = json.loads(path.read_text(encoding='utf-8'))
-    required = {
-        'services', 'release_roots', 'cutover_links', 'dropin_paths',
-        'authoritative_git_dirs', 'repository_identities',
-    }
-    if not isinstance(payload, dict) or set(payload) != required:
-        raise ValueError('trusted release policy schema is invalid')
-    values = {}
-    for name in required:
-        raw = payload[name]
-        if not isinstance(raw, list) or not raw or not all(
-            isinstance(item, str) and item for item in raw
-        ):
-            raise ValueError('trusted release policy values are invalid')
-        values[name] = frozenset(raw)
-    return TrustedReleasePolicy(**values)
-
-
-class _HostTrustedCandidateBuilderAdapter:
-    """Maps only a complete host-owned silent-release bundle response.
-
-    The API never manufactures candidate evidence or a builder signature.  A
-    host builder protocol that returns a different response is therefore
-    unavailable, rather than silently downgraded to caller-owned evidence.
-    """
-
-    def __init__(self, client):
-        self._client = client
-
-    def build(self, intent):
-        import secrets
-        from aios_trusted_candidate_builder import BuilderError
-
-        try:
-            if not isinstance(intent, dict):
-                raise TypeError('intent must be a mapping')
-            version = str(intent.get('version') or 'V2R2C2')
-            # A createReleaseIntent request is intentionally identity-light.
-            # Candidate identity is resolved by the host builder policy, not by
-            # the caller.  Explicit release-worker requests may still carry it.
-            candidate_id = str(intent.get('candidate_id') or '')
-            source_commit = str(intent.get('source_commit') or '')
-            if not version or not source_commit:
-                raise KeyError('version/source_commit')
-        except (KeyError, TypeError) as exc:
-            raise CapabilityAuthorizationError(
-                'trusted builder requires a release intent or worker request'
-            ) from exc
-        try:
-            response = self._client.build(
-                version,
-                candidate_id,
-                source_commit,
-                nonce=secrets.token_hex(32),
-            )
-        except BuilderError as exc:
-            raise TrustedCandidateBuilderUnavailable(
-                'trusted builder request failed'
-            ) from exc
-        raw_bundle = response.get('silent_release_bundle')
-        if not isinstance(raw_bundle, dict):
-            raise CapabilityAuthorizationError(
-                'trusted builder response is not a silent release bundle'
-            )
-        try:
-            return TrustedCandidateBundle(
-                candidate=ReleaseCandidate.from_dict(raw_bundle['candidate']),
-                release_plan=ReleasePlan.from_dict(raw_bundle['release_plan']),
-                checks=raw_bundle['checks'],
-                attestation=BuilderAttestation.from_dict(
-                    raw_bundle['attestation'], require_fingerprint=True
-                ),
-            )
-        except (KeyError, TypeError, ValueError) as exc:
-            raise CapabilityAuthorizationError(
-                'trusted builder response is invalid'
-            ) from exc
-
 def _build_silent_release_service() -> SilentReleaseActionService:
     verifier=None
     if SILENT_RELEASE_PUBLIC_KEYS.is_file():
@@ -284,88 +175,12 @@ def _build_silent_release_service() -> SilentReleaseActionService:
                 SILENT_RELEASE_STATE_ROOT / 'revocations'
             ),
         )
-    policy_path=TRUSTED_RELEASE_POLICY
+    policy_path=WS / 'config' / 'gitops' / 'silent-release-policy.json'
     policy_sha=_file_sha256(policy_path) if policy_path.is_file() else ''
-    candidate_builder = None
-    builder_attestation_verifier = None
-    trusted_policy = None
-    builder_readiness_probe = None
-    if TRUSTED_BUILDER_ENABLED:
-        # Every path is opt-in.  In particular, this API receives its own
-        # client HMAC credential, never the builder's signing private key.
-        if not (
-            TRUSTED_BUILDER_POLICY.is_file()
-            and TRUSTED_BUILDER_CREDENTIALS_DIRECTORY.is_dir()
-            and TRUSTED_BUILDER_PUBLIC_KEYRING.is_file()
-            and TRUSTED_RELEASE_POLICY.is_file()
-        ):
-            raise CapabilityAuthorizationError(
-                'trusted builder configuration is incomplete'
-            )
-        try:
-            from aios_trusted_candidate_builder import (
-                BuilderKeyring,
-                TrustedCandidateBuilderConfig,
-                UnixTrustedCandidateBuilderClient,
-                load_builder_policy,
-                readiness_probe,
-            )
-            builder_policy = load_builder_policy(TRUSTED_BUILDER_POLICY)
-            builder_config = TrustedCandidateBuilderConfig.from_policy(
-                builder_policy
-            )
-            client_hmac = (
-                TRUSTED_BUILDER_CREDENTIALS_DIRECTORY / 'builder_hmac'
-            ).read_bytes().strip()
-            client_keyring = BuilderKeyring(builder_hmac=client_hmac)
-            client = UnixTrustedCandidateBuilderClient(
-                builder_config,
-                client_keyring,
-                socket_path=TRUSTED_BUILDER_SOCKET,
-            )
-            candidate_builder = _HostTrustedCandidateBuilderAdapter(client)
-            builder_attestation_verifier = BuilderAttestationVerifier(
-                BuilderAttestationKeyRing.from_file(
-                    TRUSTED_BUILDER_PUBLIC_KEYRING
-                )
-            )
-            trusted_policy = _trusted_release_policy_from_file(
-                TRUSTED_RELEASE_POLICY
-            )
-
-            def builder_readiness_probe():
-                if not TRUSTED_BUILDER_SOCKET.exists():
-                    return {'status': 'UNAVAILABLE'}
-                remote = dict(readiness_probe(client))
-                if remote.get('policy_sha256') != builder_config.policy_sha256:
-                    return {'status': 'UNAVAILABLE'}
-                builder_attestation_verifier.keyring.require_active_identity(
-                    key_id=str(remote.get('builder_key_id') or ''),
-                    generation=remote.get('builder_key_generation'),
-                    algorithm=str(remote.get('signature_algorithm') or ''),
-                    purpose=str(remote.get('signature_purpose') or ''),
-                )
-                return {
-                    **remote,
-                    'hmac_credential_loaded': True,
-                    'peer_verification_configured': True,
-                    'public_key_trusted': True,
-                    'policy_loaded': True,
-                }
-
-        except Exception as exc:
-            raise CapabilityAuthorizationError(
-                'trusted builder configuration is invalid'
-            ) from exc
     return SilentReleaseActionService(
         SILENT_RELEASE_STATE_ROOT,
         execution_enabled=SILENT_RELEASE_EXECUTION_ENABLED,
         approval_verifier=verifier,
-        candidate_builder=candidate_builder,
-        builder_attestation_verifier=builder_attestation_verifier,
-        trusted_policy=trusted_policy,
-        builder_readiness_probe=builder_readiness_probe,
-        allow_legacy_candidate_input=False,
         expected_repository=REPOSITORY_IDENTITY,
         policy_sha256=policy_sha,
     )
@@ -528,15 +343,6 @@ def publication_request_from_query(q: dict[str, list[str]]) -> PublicationReques
         (q['approval_plan_id'])[0],
     )
 
-def governed_release_query_payload(q: dict[str, list[str]]) -> dict[str, str]:
-    request = publication_request_from_query(q)
-    return {
-        'version': request.version,
-        'target_oid': request.target_oid,
-        'evidence_closure_oid': request.evidence_closure_oid,
-        'approval_plan_id': request.approval_plan_id,
-    }
-
 def required_authoritative_git_dir() -> Path:
     snapshot = repository_snapshot(
         git_dir=AUTHORITATIVE_GIT_DIR,
@@ -660,11 +466,8 @@ class H(BaseHTTPRequestHandler):
         q=urllib.parse.parse_qs(u.query)
         try:
             if path in ('/health','/api/health'):
-                builder_readiness = silent_release_service().get_builder_readiness()
                 return self.sendj({
                     'status': 'ok',
-                    'process_liveness': 'PASS',
-                    'builder_readiness': builder_readiness,
                     'service': os.getenv('AIOS_GITOPS_MODEL_API_SERVICE', 'aios-gitops-model-api-v2r2c1-staging.service'),
                     'workspace': str(WS),
                     'version': 'V2R2C1',
@@ -903,15 +706,8 @@ class H(BaseHTTPRequestHandler):
             if path == '/createReleaseCandidate':
                 a=self.need('release:candidate')
                 if not a: return
-                service = silent_release_service()
-                readiness = service.get_builder_readiness()
-                if readiness.get('status') != 'READY':
-                    return self.sendj({
-                        'error': 'TRUSTED_BUILDER_UNAVAILABLE',
-                        'builder_readiness': readiness,
-                    }, 503)
                 return self.sendj(
-                    service.create_release_candidate(data)
+                    silent_release_service().create_release_candidate(data)
                 )
             if path == '/createReleaseIntent':
                 a=self.need('release:candidate')
@@ -951,13 +747,6 @@ class H(BaseHTTPRequestHandler):
             error=redact(e)
             monitor.record_failure('do_POST', error, {'path':path})
             return self.sendj({'error':error},403)
-        except TrustedCandidateBuilderUnavailable:
-            monitor.record_failure(
-                'do_POST', 'TRUSTED_BUILDER_UNAVAILABLE', {'path': path}
-            )
-            return self.sendj(
-                {'error': 'TRUSTED_BUILDER_UNAVAILABLE'}, 503
-            )
         except SagaConflict as e:
             error=redact(e)
             monitor.record_failure('do_POST', error, {'path':path})
@@ -1230,3 +1019,4 @@ def main():
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()
+

active-runtime/app/aios_online_agent_execution.py

@@ -24,10 +24,7 @@ BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
 KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
 PROTECTED_PREFIXES = ("main", "master", "refs/", "tags/", "tag/", "release/", "baseline/", "production/")
 MUTATION_ACTIONS = frozenset({"deterministic"})
-READ_ONLY_ACTIONS = frozenset({"source_capture", "agent_runtime"})
-SUPPORTED_ACTIONS = frozenset({"deterministic", "source_capture", "agent_runtime"})
-AGENT_RUNTIME_ADAPTERS = frozenset({"hermes", "openclaw"})
-MAX_AGENT_RUNTIME_INPUT_BYTES = 64 * 1024
+SUPPORTED_ACTIONS = frozenset({"deterministic", "source_capture"})
 
 
 class ExecutionProjectionError(RuntimeError):
@@ -175,76 +172,6 @@ def _source_signals(value: object) -> tuple[str, ...]:
     return tuple(result)
 
 
-def _agent_runtime_input(value: object) -> dict[str, Any]:
-    if not isinstance(value, Mapping):
-        _error("AGENT_RUNTIME_INPUT_REQUIRED")
-    raw = dict(value)
-    allowed = {
-        "goal", "instructions", "success_criteria", "constraints",
-        "scope", "trace_id",
-    }
-    if set(raw) - allowed:
-        _error("AGENT_RUNTIME_INPUT_FIELDS_INVALID")
-    goal = _string(raw.get("goal"), "AGENT_RUNTIME_GOAL_REQUIRED")
-    instructions = raw.get("instructions", "")
-    if not isinstance(instructions, str):
-        _error("AGENT_RUNTIME_INSTRUCTIONS_INVALID")
-    criteria = raw.get("success_criteria", [])
-    if not isinstance(criteria, list) or len(criteria) > 32:
-        _error("AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-    normalized_criteria: list[dict[str, str]] = []
-    for item in criteria:
-        if not isinstance(item, Mapping):
-            _error("AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-        criterion_id = _string(item.get("id"), "AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-        description = _string(
-            item.get("description"), "AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID"
-        )
-        normalized_criteria.append(
-            {"id": criterion_id[:120], "description": description[:1000]}
-        )
-    constraints = raw.get("constraints", {})
-    if not isinstance(constraints, Mapping):
-        _error("AGENT_RUNTIME_CONSTRAINTS_INVALID")
-    sensitive_markers = ("token", "secret", "password", "credential", "authorization", "api_key", "apikey")
-    for key in constraints:
-        lowered = str(key).lower()
-        if any(marker in lowered for marker in sensitive_markers):
-            _error("AGENT_RUNTIME_SECRET_FIELD_DENY")
-
-    scope = raw.get("scope", {})
-    if not isinstance(scope, Mapping):
-        _error("AGENT_RUNTIME_SCOPE_INVALID")
-    scope = {
-        "scope_type": str(scope.get("scope_type") or "legacy"),
-        "tenant_id": scope.get("tenant_id"),
-        "project_id": scope.get("project_id"),
-    }
-    if scope["scope_type"] not in {"legacy", "system", "tenant"}:
-        _error("AGENT_RUNTIME_SCOPE_INVALID")
-    if scope["scope_type"] == "tenant":
-        if not isinstance(scope["tenant_id"], str) or not scope["tenant_id"].strip():
-            _error("AGENT_RUNTIME_SCOPE_INVALID")
-    elif scope["tenant_id"] not in (None, "") or scope["project_id"] not in (None, ""):
-        _error("AGENT_RUNTIME_SCOPE_INVALID")
-
-    trace_id = str(raw.get("trace_id") or "").strip()
-    if not trace_id or len(trace_id) > 255:
-        _error("AGENT_RUNTIME_TRACE_ID_INVALID")
-
-    normalized = {
-        "goal": goal[:12000],
-        "instructions": instructions[:32000],
-        "success_criteria": normalized_criteria,
-        "constraints": dict(constraints),
-        "scope": scope,
-        "trace_id": trace_id,
-    }
-    if len(_canonical(normalized).encode("utf-8")) > MAX_AGENT_RUNTIME_INPUT_BYTES:
-        _error("AGENT_RUNTIME_INPUT_TOO_LARGE")
-    return normalized
-
-
 def _capabilities(value: object) -> tuple[str, ...]:
     if value is None:
         return ()
@@ -361,22 +288,6 @@ def validate_execution_envelope(
         signals = list(_source_signals(envelope.get("source_signals") or []))
         if envelope.get("source_signals") != signals:
             _error("SOURCE_CAPTURE_SIGNALS_INVALID")
-        if envelope.get("runtime_input") not in (None, {}):
-            _error("SOURCE_CAPTURE_RUNTIME_INPUT_DENY")
-    elif action == "agent_runtime":
-        if changes or verification:
-            _error("AGENT_RUNTIME_MUTATION_DENY")
-        adapter = str(envelope.get("adapter") or "")
-        if adapter not in AGENT_RUNTIME_ADAPTERS:
-            _error("AGENT_RUNTIME_ADAPTER_INVALID")
-        runtime_input = _agent_runtime_input(envelope.get("runtime_input"))
-        if envelope.get("runtime_input") != runtime_input:
-            _error("AGENT_RUNTIME_INPUT_NOT_CANONICAL")
-        required_runtime_capability = f"agent.runtime.{adapter}"
-        if required_runtime_capability not in capability_scope:
-            _error("AGENT_RUNTIME_CAPABILITY_REQUIRED")
-        if envelope.get("source_signals") not in (None, []):
-            _error("AGENT_RUNTIME_SOURCE_SIGNALS_DENY")
     elif not changes:
         _error("CHANGE_SET_INVALID")
     declared = str(envelope.get("execution_digest") or "")
@@ -418,15 +329,11 @@ def project_execution_envelope(
         "schema": EXECUTION_SCHEMA,
         **binding.public(),
         "action": action,
-        "adapter": str(
-            request.get("adapter")
-            or ("deterministic" if action == "deterministic" else "source_capture")
-        ),
+        "adapter": str(request.get("adapter") or ("deterministic" if action == "deterministic" else "source_capture")),
         "capability_scope": list(capabilities),
         "change_set": list(request.get("change_set") or []),
         "verification": list(request.get("verification") or []),
         "source_signals": list(_source_signals(request.get("source_signals") or [])) if action == "source_capture" else [],
-        "runtime_input": _agent_runtime_input(request.get("runtime_input")) if action == "agent_runtime" else {},
         "governance": governance,
         "workspace": {
             "authority_git_dir": "/data/aios-gitops/repo.git",
@@ -445,45 +352,7 @@ def project_online_task(
 ) -> dict[str, Any]:
     request = dict(task_request)
     required = _capabilities(request.get("required_capabilities"))
-    execution_value = dict(execution_request or {})
-    if str(execution_value.get("action") or "source_capture") == "agent_runtime":
-        adapter = str(execution_value.get("adapter") or "")
-        if adapter not in AGENT_RUNTIME_ADAPTERS:
-            _error("AGENT_RUNTIME_ADAPTER_INVALID")
-        runtime_input = execution_value.get("runtime_input")
-        tenant_id = request.get("tenant_id")
-        project_id = request.get("project_id")
-        declared_scope = str(
-            request.get("scope_type")
-            or ("tenant" if isinstance(tenant_id, str) and tenant_id.strip() else "legacy")
-        )
-        if runtime_input is None:
-            runtime_input = {
-                "goal": request.get("goal"),
-                "instructions": request.get("instructions") or "",
-                "success_criteria": request.get("success_criteria") or [],
-                "constraints": request.get("constraints") or {},
-            }
-        elif not isinstance(runtime_input, Mapping):
-            _error("AGENT_RUNTIME_INPUT_REQUIRED")
-        runtime_input = dict(runtime_input)
-        # Scope/trace are authoritative Task identity, never caller-selected runtime hints.
-        runtime_input["scope"] = {
-            "scope_type": declared_scope,
-            "tenant_id": tenant_id,
-            "project_id": project_id,
-        }
-        runtime_input["trace_id"] = str(
-            request.get("trace_id")
-            or request.get("run_id")
-            or binding.task_id
-        )
-        execution_value["runtime_input"] = runtime_input
-    execution = project_execution_envelope(
-        binding,
-        execution_value,
-        required_capabilities=required,
-    )
+    execution = project_execution_envelope(binding, execution_request, required_capabilities=required)
     metadata = dict(request.get("metadata") or {})
     if "execution" in metadata:
         validate_execution_envelope(_object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"), binding=binding)

active-runtime/app/aios_online_agent_plan_store.py

@@ -0,0 +1,187 @@
+"""Durable, authority-bound deterministic execution plans for Online Agent Tasks."""
+from __future__ import annotations
+
+from contextlib import contextmanager
+from dataclasses import dataclass
+import fcntl
+import hashlib
+import json
+from pathlib import Path
+from typing import Any, Mapping
+
+from aios_online_agent_execution import (
+    GovernedExecutionBinding,
+    project_execution_envelope,
+)
+
+
+class ExecutionPlanError(RuntimeError):
+    pass
+
+
+def _canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def _digest(value: object) -> str:
+    return hashlib.sha256(_canonical(value)).hexdigest()
+
+
+def _task_key(task_id: str) -> str:
+    readable = "".join(ch if ch.isalnum() or ch in "._-" else "-" for ch in task_id).strip("-")[:72] or "task"
+    return readable + "-" + hashlib.sha256(task_id.encode("utf-8")).hexdigest()[:24]
+
+
+@dataclass(frozen=True)
+class ExecutionPlanRecord:
+    task_id: str
+    job_id: str
+    source_head_oid: str
+    generation: int
+    idempotency_key: str
+    plan_digest: str
+    execution: dict[str, Any]
+
+    def public(self) -> dict[str, Any]:
+        return {
+            "schema": "aios.online-agent.plan-record.v1",
+            "task_id": self.task_id,
+            "job_id": self.job_id,
+            "source_head_oid": self.source_head_oid,
+            "generation": self.generation,
+            "idempotency_key": self.idempotency_key,
+            "plan_digest": self.plan_digest,
+            "execution": dict(self.execution),
+        }
+
+
+class ExecutionPlanStore:
+    def __init__(self, root: Path) -> None:
+        self.root = Path(root)
+        self.root.mkdir(parents=True, exist_ok=True)
+
+    def _path(self, task_id: str) -> Path:
+        return self.root / (_task_key(task_id) + ".json")
+
+    @contextmanager
+    def _lock(self, task_id: str):
+        path = self.root / (_task_key(task_id) + ".lock")
+        with path.open("a+b") as handle:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+
+    @staticmethod
+    def _source_head(binding: GovernedExecutionBinding) -> str:
+        return binding.expected_branch_oid if binding.branch_mode == "CONTINUE_EXISTING" else binding.base_oid
+
+    def _read(self, task_id: str) -> ExecutionPlanRecord | None:
+        path = self._path(task_id)
+        if not path.is_file() or path.is_symlink():
+            return None
+        value = json.loads(path.read_text(encoding="utf-8"))
+        if not isinstance(value, Mapping) or value.get("schema") != "aios.online-agent.plan-record.v1":
+            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
+        execution = value.get("execution")
+        if not isinstance(execution, Mapping):
+            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
+        return ExecutionPlanRecord(
+            task_id=str(value.get("task_id") or ""),
+            job_id=str(value.get("job_id") or ""),
+            source_head_oid=str(value.get("source_head_oid") or ""),
+            generation=int(value.get("generation") or 0),
+            idempotency_key=str(value.get("idempotency_key") or ""),
+            plan_digest=str(value.get("plan_digest") or ""),
+            execution=dict(execution),
+        )
+
+    def register(
+        self,
+        binding: GovernedExecutionBinding,
+        request: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        with self._lock(binding.task_id):
+            return self._register_locked(binding, request)
+
+    def _register_locked(
+        self,
+        binding: GovernedExecutionBinding,
+        request: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        if request.get("schema") != "aios.online-agent.plan.v1":
+            raise ExecutionPlanError("EXECUTION_PLAN_SCHEMA_INVALID")
+        if request.get("task_id") != binding.task_id or request.get("job_id") != binding.job_id:
+            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
+        if int(request.get("generation") or 0) != binding.generation:
+            raise ExecutionPlanError("EXECUTION_PLAN_GENERATION_CONFLICT")
+        source_head = str(request.get("source_head_oid") or "")
+        if source_head != self._source_head(binding):
+            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_CONFLICT")
+        key = str(request.get("idempotency_key") or "")
+        if len(key) < 8:
+            raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_INVALID")
+        execution_request = request.get("execution")
+        if not isinstance(execution_request, Mapping) or execution_request.get("action") != "deterministic":
+            raise ExecutionPlanError("EXECUTION_PLAN_DETERMINISTIC_REQUIRED")
+        envelope = project_execution_envelope(binding, execution_request)
+        material = {
+            "task_id": binding.task_id,
+            "job_id": binding.job_id,
+            "source_head_oid": source_head,
+            "generation": binding.generation,
+            "idempotency_key": key,
+            "execution": dict(execution_request),
+        }
+        plan_digest = _digest(material)
+        existing = self._read(binding.task_id)
+        expected_previous = request.get("expected_previous_plan_digest")
+        if existing is not None:
+            if existing.idempotency_key == key:
+                if existing.plan_digest != plan_digest:
+                    raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_CONFLICT")
+                return {**existing.public(), "idempotent": True, "execution_digest": envelope["execution_digest"]}
+            if expected_previous != existing.plan_digest:
+                raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
+            if existing.source_head_oid != source_head:
+                raise ExecutionPlanError("EXECUTION_PLAN_STALE_REPLACEMENT_DENY")
+        elif expected_previous not in (None, ""):
+            raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
+
+        record = ExecutionPlanRecord(
+            task_id=binding.task_id,
+            job_id=binding.job_id,
+            source_head_oid=source_head,
+            generation=binding.generation,
+            idempotency_key=key,
+            plan_digest=plan_digest,
+            execution=dict(execution_request),
+        )
+        path = self._path(binding.task_id)
+        temporary = path.with_suffix(".tmp")
+        temporary.write_text(
+            json.dumps(record.public(), sort_keys=True, separators=(",", ":")),
+            encoding="utf-8",
+        )
+        temporary.replace(path)
+        return {**record.public(), "idempotent": False, "execution_digest": envelope["execution_digest"]}
+
+    def resolve(self, binding: GovernedExecutionBinding) -> dict[str, Any] | None:
+        record = self._read(binding.task_id)
+        if record is None:
+            return None
+        if (
+            record.task_id != binding.task_id
+            or record.job_id != binding.job_id
+            or record.generation != binding.generation
+        ):
+            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
+        if record.source_head_oid != self._source_head(binding):
+            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_DRIFT")
+        envelope = project_execution_envelope(binding, record.execution)
+        return {
+            "execution": dict(record.execution),
+            "plan_digest": record.plan_digest,
+            "execution_digest": envelope["execution_digest"],
+        }

active-runtime/app/aios_task_deterministic_execution_amendment.py

@@ -1,148 +0,0 @@
-"""Fail-closed signed deterministic execution amendment for R7."""
-from datetime import datetime, timezone
-import hashlib, json, sqlite3
-from pathlib import Path
-from typing import Mapping
-from aios_task_terminal_recovery import DeterministicPlan, RecoveryError, canonical_json
-
-AMENDMENT_SCHEMA="aios.deterministic-execution-amendment.v1"
-APPLY_SCHEMA="aios.deterministic-execution-amendment-apply.v1"
-NAMESPACE="aios-owner-approval-v1"
-EVENT="TASK_RECOVERY_EXECUTION_AMENDMENT_APPLIED"
-APPLY_STATES=frozenset({"FAILED", "QUEUED"})
-
-
-def _err(code): raise RecoveryError(code)
-def _sha(v): return hashlib.sha256(canonical_json(v).encode()).hexdigest()
-def amendment_body(x):
-    return {k:v for k,v in x.items() if k not in {"signature","amendment_id"}}
-def amendment_id(x): return "sha256:"+_sha(amendment_body(x))
-def signed_payload(x):
-    return canonical_json({"amendment_id":x["amendment_id"],**amendment_body(x)}).encode()
-
-
-def parse_amendment(raw):
-    x=dict(raw)
-    required={"schema","amendment_id","nonce","task_id","job_id","generation",
-      "repository","branch","expected_branch_oid","recovery_epoch","decision_id",
-      "plan_id","plan_sha256","expected_apply_status","expected_apply_revision",
-      "expected_apply_attempt","expected_current_capabilities","envelope",
-      "owner_identity","key_id","issued_at","not_before","expires_at",
-      "one_time_use","signature"}
-    if set(x)<required or x.get("schema")!=AMENDMENT_SCHEMA: _err("AMENDMENT_SCHEMA_INVALID")
-    if x["expected_apply_status"] not in APPLY_STATES: _err("AMENDMENT_APPLY_STATUS_INVALID")
-    if x.get("one_time_use") is not True: _err("AMENDMENT_ONE_TIME_REQUIRED")
-    if not isinstance(x["envelope"],Mapping): _err("AMENDMENT_ENVELOPE_INVALID")
-    if not isinstance(x["expected_current_capabilities"],list): _err("AMENDMENT_CAPABILITIES_INVALID")
-    for k in ("generation","expected_apply_revision","expected_apply_attempt"):
-        if isinstance(x[k],bool) or not isinstance(x[k],int) or x[k]<0: _err("AMENDMENT_CAS_INVALID")
-    for k in ("issued_at","not_before","expires_at"):
-        try:d=datetime.fromisoformat(str(x[k]).replace("Z","+00:00"))
-        except ValueError as e: raise RecoveryError("AMENDMENT_TIME_INVALID") from e
-        if d.tzinfo is None:_err("AMENDMENT_TIME_INVALID")
-        x[k]=d.astimezone(timezone.utc).isoformat().replace("+00:00","Z")
-    x["expected_current_capabilities"]=sorted(set(x["expected_current_capabilities"]))
-    x["envelope"]=dict(x["envelope"])
-    return x
-
-
-def _validate_envelope(env,plan,x):
-    try:
-        from aios_online_agent_execution import GovernedExecutionBinding,validate_execution_envelope
-        binding=GovernedExecutionBinding.from_mapping(env)
-        e=dict(validate_execution_envelope(env,binding=binding,worker_capabilities=plan.required_capabilities))
-    except Exception as z: raise RecoveryError("AMENDMENT_EXECUTION_ENVELOPE_INVALID") from z
-    if e.get("action")!="deterministic" or e.get("adapter")!="deterministic":_err("AMENDMENT_EXECUTION_ACTION_INVALID")
-    if tuple(sorted(e.get("capability_scope") or ()))!=plan.required_capabilities:_err("AMENDMENT_EXECUTION_CAPABILITIES_MISMATCH")
-    if not e.get("change_set") or not e.get("verification"):_err("AMENDMENT_EXECUTION_OPERATIONS_REQUIRED")
-    if e.get("runtime_input") not in (None,{}) or e.get("source_signals") not in (None,[]):_err("AMENDMENT_STALE_RUNTIME_FIELDS_FORBIDDEN")
-    for k,w in (("task_id",x["task_id"]),("job_id",x["job_id"]),("repository",x["repository"]),
-      ("generation",x["generation"]),("target_branch",x["branch"]),
-      ("expected_branch_oid",x["expected_branch_oid"]),("base_oid",x["expected_branch_oid"]),
-      ("plan_id",x["plan_id"]),("plan_sha256",x["plan_sha256"]),("recovery_epoch",x["recovery_epoch"])):
-        if e.get(k)!=w:_err("AMENDMENT_EXECUTION_BINDING_MISMATCH")
-    g=e.get("governance") or {}
-    if g.get("writer_lease") is not True:_err("AMENDMENT_WRITER_LEASE_REQUIRED")
-    if any(g.get(k,False) for k in ("main_write","production_write","tag_write","baseline_write","force_push","protected_ref_bypass")):_err("AMENDMENT_PROTECTED_WRITE_FORBIDDEN")
-    return e
-
-
-class DeterministicExecutionAmendmentController:
-    def __init__(self,db_path,verifier,*,clock=None,envelope_validator=None):
-        self.db_path=Path(db_path); self.verifier=verifier
-        self.clock=clock or (lambda:datetime.now(timezone.utc)); self._init()
-
-    def _db(self):
-        c=sqlite3.connect(self.db_path,timeout=10,isolation_level=None); c.row_factory=sqlite3.Row
-        c.execute("PRAGMA busy_timeout=10000"); return c
-
-    def _now(self): return self.clock().astimezone(timezone.utc).isoformat().replace("+00:00","Z")
-
-    def _init(self):
-        with self._db() as c:
-            c.execute("DROP TRIGGER IF EXISTS aios_r7_recovery_capability_projection")
-            c.executescript("""
-CREATE TABLE IF NOT EXISTS deterministic_execution_amendments(
- amendment_id TEXT PRIMARY KEY,nonce TEXT UNIQUE NOT NULL,task_id TEXT NOT NULL,
- decision_id TEXT NOT NULL,plan_id TEXT NOT NULL,plan_sha256 TEXT NOT NULL,
- envelope_digest TEXT NOT NULL,envelope_json TEXT NOT NULL,payload_json TEXT NOT NULL,
- created_at TEXT NOT NULL,UNIQUE(task_id,decision_id));
-DROP TRIGGER IF EXISTS aios_r7_recovery_requires_executable_amendment;
-CREATE TRIGGER aios_r7_recovery_requires_executable_amendment
-BEFORE UPDATE OF status ON tasks
-WHEN OLD.status='FAILED' AND NEW.status='QUEUED' BEGIN
- SELECT CASE WHEN NOT EXISTS(
-  SELECT 1 FROM deterministic_execution_amendments a
-  WHERE a.task_id=OLD.task_id
-   AND a.decision_id=json_extract(NEW.metadata_json,'$.recovery.decision_id')
-   AND a.amendment_id=json_extract(OLD.metadata_json,'$.recovery.execution_amendment_id')
-   AND a.envelope_digest=json_extract(OLD.metadata_json,'$.execution.execution_digest')
- ) THEN RAISE(ABORT,'SIGNED_EXECUTION_AMENDMENT_REQUIRED') END;
-END;""")
-
-    def _plan(self,c,x):
-        r=c.execute("SELECT * FROM deterministic_plans WHERE plan_id=?",(x["plan_id"],)).fetchone()
-        if r is None or r["plan_sha256"]!=x["plan_sha256"]:_err("AMENDMENT_PLAN_NOT_FOUND_OR_MISMATCH")
-        p=DeterministicPlan.from_dict(json.loads(r["payload_json"]))
-        if (p.task_id,p.job_id,p.generation,p.repository,p.branch,p.expected_branch_oid,p.recovery_epoch)!=(x["task_id"],x["job_id"],x["generation"],x["repository"],x["branch"],x["expected_branch_oid"],x["recovery_epoch"]):_err("AMENDMENT_PLAN_BINDING_MISMATCH")
-        return p
-
-    def persist(self,raw):
-        x=parse_amendment(raw)
-        if x["amendment_id"]!=amendment_id(x):_err("AMENDMENT_ID_DIGEST_MISMATCH")
-        now=self._now()
-        if now<x["not_before"] or now>=x["expires_at"]:_err("AMENDMENT_EXPIRED_OR_NOT_YET_VALID")
-        if not self.verifier.verify(namespace=NAMESPACE,payload=signed_payload(x),signature=x["signature"],key_id=x["key_id"]):_err("AMENDMENT_SIGNATURE_INVALID")
-        with self._db() as c:
-            c.execute("BEGIN IMMEDIATE"); e=_validate_envelope(x["envelope"],self._plan(c,x),x)
-            ej=canonical_json(e); ed=e["execution_digest"]; stored=dict(x); stored["signature"]="<present>"
-            old=c.execute("SELECT * FROM deterministic_execution_amendments WHERE amendment_id=?",(x["amendment_id"],)).fetchone()
-            if old:
-                if old["envelope_json"]!=ej:_err("AMENDMENT_ID_REUSE_MISMATCH")
-                c.commit(); return {"status":"PRESENT","amendment_id":x["amendment_id"],"task_id":x["task_id"],"decision_id":x["decision_id"],"plan_id":x["plan_id"],"execution_digest":ed}
-            if c.execute("SELECT 1 FROM deterministic_execution_amendments WHERE nonce=? OR (task_id=? AND decision_id=?)",(x["nonce"],x["task_id"],x["decision_id"])).fetchone():_err("AMENDMENT_REPLAY_OR_DECISION_REUSE")
-            c.execute("INSERT INTO deterministic_execution_amendments VALUES(?,?,?,?,?,?,?,?,?,?)",(x["amendment_id"],x["nonce"],x["task_id"],x["decision_id"],x["plan_id"],x["plan_sha256"],ed,ej,canonical_json(stored),now)); c.commit()
-        return {"status":"PERSISTED","amendment_id":x["amendment_id"],"task_id":x["task_id"],"decision_id":x["decision_id"],"plan_id":x["plan_id"],"execution_digest":ed}
-
-    def apply(self,raw):
-        if raw.get("schema")!=APPLY_SCHEMA:_err("AMENDMENT_APPLY_SCHEMA_INVALID")
-        aid=raw.get("amendment_id"); tid=raw.get("task_id")
-        with self._db() as c:
-            c.execute("BEGIN IMMEDIATE"); a=c.execute("SELECT * FROM deterministic_execution_amendments WHERE amendment_id=? AND task_id=?",(aid,tid)).fetchone()
-            if a is None:_err("AMENDMENT_NOT_FOUND")
-            x=json.loads(a["payload_json"]); d=json.loads(a["envelope_json"])
-            t=c.execute("SELECT * FROM tasks WHERE task_id=?",(tid,)).fetchone()
-            if t is None:_err("TASK_NOT_FOUND")
-            m=json.loads(t["metadata_json"] or "{}"); cp=tuple(sorted(json.loads(t["required_capabilities_json"] or "[]"))); dc=tuple(sorted(d.get("capability_scope") or ()))
-            rec=m.get("recovery"); rec=dict(rec) if isinstance(rec,Mapping) else {}
-            old=m.get("execution")
-            if isinstance(old,Mapping) and old.get("execution_digest")==a["envelope_digest"] and cp==dc and rec.get("execution_amendment_id")==aid:
-                c.commit(); return {"status":"PRESENT","task_id":tid,"amendment_id":aid,"execution_digest":a["envelope_digest"],"revision":int(t["revision"]),"attempt":int(t["attempt"])}
-            if t["status"]!=x["expected_apply_status"] or int(t["revision"])!=x["expected_apply_revision"] or int(t["attempt"])!=x["expected_apply_attempt"] or cp!=tuple(x["expected_current_capabilities"]) or t["claimed_by"] is not None or t["lease_token_hash"] is not None:_err("AMENDMENT_APPLY_TASK_CAS_MISMATCH")
-            if t["status"]=="QUEUED" and rec.get("decision_id")!=x["decision_id"]:_err("AMENDMENT_DECISION_BINDING_MISMATCH")
-            m["execution"]=d; m["execution_projection"]={"schema":"aios.online-agent.task-projection.v1","task_id":tid,"job_id":d.get("job_id"),"execution_digest":a["envelope_digest"]}
-            rec["execution_amendment_id"]=aid; m["recovery"]=rec; now=self._now()
-            q=c.execute("""UPDATE tasks SET required_capabilities_json=?,metadata_json=?,revision=revision+1,updated_at=? WHERE task_id=? AND status=? AND revision=? AND attempt=? AND claimed_by IS NULL AND lease_token_hash IS NULL""",(canonical_json(list(dc)),canonical_json(m),now,tid,x["expected_apply_status"],x["expected_apply_revision"],x["expected_apply_attempt"]))
-            if q.rowcount!=1:_err("AMENDMENT_APPLY_TASK_CAS_FAILED")
-            c.execute("INSERT INTO events(task_id,agent_id,event_type,payload_json,created_at) VALUES(?,?,?,?,?)",(tid,None,EVENT,canonical_json({"amendment_id":aid,"decision_id":x["decision_id"],"plan_id":x["plan_id"],"execution_digest":a["envelope_digest"],"required_capabilities":list(dc)}),now)); c.commit()
-        return {"status":"APPLIED","task_id":tid,"amendment_id":aid,"decision_id":x["decision_id"],"plan_id":x["plan_id"],"execution_digest":a["envelope_digest"],"required_capabilities":list(dc),"revision":x["expected_apply_revision"]+1,"attempt":x["expected_apply_attempt"]}

active-runtime/app/aios_trusted_candidate_builder.py

@@ -1,798 +0,0 @@
-#!/usr/bin/env python3
-"""Fail-closed AF_UNIX builder for server-owned trusted candidate evidence."""
-from __future__ import annotations
-
-import argparse
-import base64
-import hashlib
-import hmac
-import json
-import os
-import secrets
-import socket
-import stat
-import struct
-import subprocess
-import time
-from datetime import datetime, timezone
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol
-
-
-class BuilderError(RuntimeError):
-    """A stable, non-sensitive error code returned by the builder boundary."""
-
-
-def _canonical_json(value: Mapping[str, Any]) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode("utf-8")
-
-
-def _sha256(*parts: str) -> str:
-    return hashlib.sha256("\0".join(parts).encode("utf-8")).hexdigest()
-
-
-@dataclass(frozen=True)
-class PeerIdentity:
-    pid: int
-    uid: int
-    gid: int
-
-
-class DomainPurposeSigner(Protocol):
-    """A signer deliberately limited to the builder's one domain purpose."""
-
-    @property
-    def key_id(self) -> str:
-        ...
-
-    @property
-    def key_generation(self) -> int:
-        ...
-
-    def sign_for_purpose(self, purpose: str, payload: bytes) -> bytes:
-        ...
-
-
-class CredentialPathEd25519Signer:
-    """Reads a systemd-mounted credential path; never exports or logs key bytes."""
-
-    def __init__(self, credential_path: Path, *, key_id: str, key_generation: int, allowed_purpose: str):
-        self._credential_path = Path(credential_path)
-        self._key_id = str(key_id)
-        self._key_generation = key_generation
-        self._allowed_purpose = str(allowed_purpose)
-        if not self._key_id or not isinstance(key_generation, int) or key_generation < 1:
-            raise BuilderError("SIGNING_IDENTITY_INVALID")
-        if not self._credential_path.is_file():
-            raise BuilderError("SIGNING_CREDENTIAL_UNAVAILABLE")
-        try:
-            from cryptography.hazmat.primitives.serialization import load_pem_private_key
-            from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
-            self._private_key = load_pem_private_key(self._credential_path.read_bytes(), password=None)
-            if not isinstance(self._private_key, Ed25519PrivateKey):
-                raise TypeError("signing key is not Ed25519")
-        except Exception as exc:  # do not expose parse/key material details
-            raise BuilderError("SIGNING_CREDENTIAL_INVALID") from exc
-
-    @property
-    def key_id(self) -> str:
-        return self._key_id
-
-    @property
-    def key_generation(self) -> int:
-        return self._key_generation
-
-    def sign_for_purpose(self, purpose: str, payload: bytes) -> bytes:
-        if purpose != self._allowed_purpose:
-            raise BuilderError("SIGNING_PURPOSE_DENIED")
-        return self._private_key.sign(payload)
-
-
-@dataclass(frozen=True)
-class BuilderKeyring:
-    builder_hmac: bytes
-    signing_private_key_path: Path | None = None
-
-    def __post_init__(self) -> None:
-        if len(self.builder_hmac) < 32:
-            raise BuilderError("BUILDER_HMAC_INVALID")
-
-    @classmethod
-    def from_credentials_directory(cls, credentials_directory: Path) -> "BuilderKeyring":
-        root = Path(credentials_directory)
-        hmac_path = root / "builder_hmac"
-        signing_path = root / "signing_private_key"
-        try:
-            secret = hmac_path.read_bytes().strip()
-        except OSError as exc:
-            raise BuilderError("BUILDER_HMAC_UNAVAILABLE") from exc
-        if not signing_path.is_file():
-            raise BuilderError("SIGNING_CREDENTIAL_UNAVAILABLE")
-        return cls(builder_hmac=secret, signing_private_key_path=signing_path)
-
-
-@dataclass(frozen=True)
-class TrustedCandidateBuilderConfig:
-    policy_schema: str
-    repository: str
-    request_schema: str
-    response_schema: str
-    operation: str
-    readiness_operation: str
-    maximum_request_age_seconds: int
-    request_timeout_seconds: int
-    allowed_peer_uid: int
-    allowed_peer_cgroups: tuple[str, ...]
-    allowed_peer_executable_prefix: str
-    allowed_peer_runtime_prefix: str
-    allowed_peer_runtime_suffix: str
-    required_checks: tuple[str, ...]
-    evidence_layout: Mapping[str, str]
-    recipes: Mapping[str, Mapping[str, str]]
-    governed_recipes: Mapping[str, Mapping[str, str]]
-    policy_sha256: str
-
-    @classmethod
-    def from_policy(cls, policy: Mapping[str, Any]) -> "TrustedCandidateBuilderConfig":
-        required = {
-            "schema", "repository", "request_schema", "response_schema", "operation",
-            "readiness_operation", "maximum_request_age_seconds", "request_timeout_seconds",
-            "allowed_peer_uid", "allowed_peer_cgroups", "allowed_peer_executable_prefix",
-            "allowed_peer_runtime_prefix", "allowed_peer_runtime_suffix",
-            "required_checks", "evidence_layout", "recipes", "governed_recipes",
-        }
-        if set(policy) != required or policy.get("schema") != "aios.trusted-candidate-builder-policy.v1":
-            raise BuilderError("POLICY_SCHEMA_INVALID")
-        recipes = policy.get("recipes")
-        if not isinstance(recipes, Mapping) or set(recipes) != {"V2R2C2", "V2R2C3"}:
-            raise BuilderError("POLICY_RECIPES_INVALID")
-        c2, c3 = recipes["V2R2C2"], recipes["V2R2C3"]
-        if not isinstance(c2, Mapping) or set(c2) != {"mode", "task_id", "candidate_id", "base_oid", "source_commit", "version", "purpose"} or c2.get("mode") != "fixed":
-            raise BuilderError("POLICY_V2R2C2_INVALID")
-        if not isinstance(c3, Mapping) or set(c3) != {"mode", "derives_from", "version", "purpose"} or c3.get("mode") != "governed-derived-only" or c3.get("derives_from") != "V2R2C2":
-            raise BuilderError("POLICY_V2R2C3_INVALID")
-        if (
-            policy["repository"] != "aios/aios"
-            or policy["operation"] != "BuildTrustedCandidateV1"
-            or policy["readiness_operation"] != "ProbeTrustedCandidateBuilderV1"
-        ):
-            raise BuilderError("POLICY_SCOPE_INVALID")
-        if not isinstance(policy["maximum_request_age_seconds"], int) or not 1 <= policy["maximum_request_age_seconds"] <= 300:
-            raise BuilderError("POLICY_FRESHNESS_INVALID")
-        if not isinstance(policy["request_timeout_seconds"], int) or not 1 <= policy["request_timeout_seconds"] <= 120:
-            raise BuilderError("POLICY_TIMEOUT_INVALID")
-        if not isinstance(policy["allowed_peer_uid"], int) or policy["allowed_peer_uid"] != 1000:
-            raise BuilderError("POLICY_PEER_UID_INVALID")
-        cgroups, checks = policy["allowed_peer_cgroups"], policy["required_checks"]
-        if not isinstance(cgroups, list) or not cgroups or not all(isinstance(value, str) and value.startswith("/") for value in cgroups):
-            raise BuilderError("POLICY_CGROUPS_INVALID")
-        for field in (
-            "allowed_peer_executable_prefix",
-            "allowed_peer_runtime_prefix",
-            "allowed_peer_runtime_suffix",
-        ):
-            if not isinstance(policy[field], str) or not policy[field].startswith("/"):
-                raise BuilderError("POLICY_PROCESS_IDENTITY_INVALID")
-        if not isinstance(checks, list) or not checks or len(set(checks)) != len(checks) or not all(isinstance(value, str) for value in checks):
-            raise BuilderError("POLICY_CHECKS_INVALID")
-        layout = policy["evidence_layout"]
-        evidence_names = {
-            "artifact", "manifest", "package_closure", "tests", "canary",
-            "gitea", "rollback", "policy", "secret_scan",
-        }
-        if (
-            not isinstance(layout, Mapping)
-            or set(layout) != evidence_names
-            or not all(
-                isinstance(value, str)
-                and value.startswith("{version}/")
-                and ".." not in Path(value).parts
-                and not Path(value).is_absolute()
-                for value in layout.values()
-            )
-        ):
-            raise BuilderError("POLICY_EVIDENCE_LAYOUT_INVALID")
-        return cls(
-            policy_schema=str(policy["schema"]), repository=str(policy["repository"]),
-            request_schema=str(policy["request_schema"]), response_schema=str(policy["response_schema"]),
-            operation=str(policy["operation"]), readiness_operation=str(policy["readiness_operation"]),
-            maximum_request_age_seconds=policy["maximum_request_age_seconds"],
-            request_timeout_seconds=policy["request_timeout_seconds"],
-            allowed_peer_uid=policy["allowed_peer_uid"], allowed_peer_cgroups=tuple(cgroups),
-            allowed_peer_executable_prefix=policy["allowed_peer_executable_prefix"],
-            allowed_peer_runtime_prefix=policy["allowed_peer_runtime_prefix"],
-            allowed_peer_runtime_suffix=policy["allowed_peer_runtime_suffix"],
-            required_checks=tuple(checks), evidence_layout=dict(layout),
-            recipes={name: dict(value) for name, value in recipes.items()},
-            governed_recipes={name: dict(value) for name, value in policy["governed_recipes"].items()} if isinstance(policy["governed_recipes"], Mapping) else _invalid_governed_recipes(),
-            policy_sha256=hashlib.sha256(_canonical_json(dict(policy))).hexdigest(),
-        )
-
-    def fixed_recipe(self, name: str) -> Mapping[str, str]:
-        recipe = self.recipes.get(name)
-        if recipe is None:
-            raise BuilderError("RECIPE_UNKNOWN")
-        if recipe["mode"] == "governed-derived-only":
-            derived = self.governed_recipes.get(name)
-            required = {"mode", "task_id", "candidate_id", "base_oid", "source_commit", "version", "purpose", "derived_from_v2r2c2_attestation", "builder_engineering_oid"}
-            if not isinstance(derived, Mapping) or set(derived) != required or derived.get("mode") != "governed-derived" or derived.get("version") != name or derived.get("purpose") != recipe.get("purpose"):
-                raise BuilderError("GOVERNED_V2R2C3_DERIVATION_REQUIRED")
-            for name in ("base_oid", "source_commit", "builder_engineering_oid"):
-                value = derived.get(name)
-                if not isinstance(value, str) or len(value) != 40 or any(char not in "0123456789abcdef" for char in value.lower()):
-                    raise BuilderError("GOVERNED_V2R2C3_DERIVATION_REQUIRED")
-            return dict(derived)
-        return recipe
-
-    def resolve_recipe(self, version: str, candidate_id: str | None, source_commit: str) -> Mapping[str, str]:
-        recipe = self.fixed_recipe(version)
-        # Intent-only callers do not choose a candidate identity.  The
-        # policy-owned recipe supplies it; explicit worker requests are
-        # still checked against the same immutable recipe.
-        effective_candidate_id = str(candidate_id or recipe.get("candidate_id") or "")
-        if {"version": recipe.get("version"), "candidate_id": recipe.get("candidate_id"), "source_commit": recipe.get("source_commit")} != {"version": version, "candidate_id": effective_candidate_id, "source_commit": source_commit}:
-            raise BuilderError("REQUEST_RELEASE_BINDING_INVALID")
-        return recipe
-
-
-def _invalid_governed_recipes() -> Mapping[str, Mapping[str, str]]:
-    raise BuilderError("POLICY_GOVERNED_RECIPES_INVALID")
-
-
-def load_builder_policy(path: Path) -> Mapping[str, Any]:
-    try:
-        decoded = json.loads(Path(path).read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError) as exc:
-        raise BuilderError("POLICY_UNAVAILABLE") from exc
-    if not isinstance(decoded, Mapping):
-        raise BuilderError("POLICY_SCHEMA_INVALID")
-    TrustedCandidateBuilderConfig.from_policy(decoded)
-    return decoded
-
-
-class ServerOwnedEvidenceSource:
-    """Recomputes a fixed on-host evidence closure without caller-owned paths."""
-
-    def __init__(
-        self,
-        config: TrustedCandidateBuilderConfig,
-        authority_git_dir: Path,
-        evidence_root: Path,
-        *,
-        expected_owner_uid: int | None = 0,
-        git_runner: Callable[..., Any] = subprocess.run,
-    ):
-        self._config = config
-        self._authority_git_dir = Path(authority_git_dir)
-        self._evidence_root = Path(evidence_root)
-        self._expected_owner_uid = expected_owner_uid
-        self._git_runner = git_runner
-
-    def _regular_path(self, relative: str) -> Path:
-        root = self._evidence_root.resolve(strict=True)
-        candidate = self._evidence_root / relative
-        current = self._evidence_root
-        for part in Path(relative).parts:
-            current = current / part
-            if current.is_symlink():
-                raise BuilderError("COLLECTOR_SYMLINK_DENIED")
-        try:
-            resolved = candidate.resolve(strict=True)
-            resolved.relative_to(root)
-            metadata = resolved.stat(follow_symlinks=False)
-        except (OSError, ValueError) as exc:
-            raise BuilderError("COLLECTOR_EVIDENCE_UNAVAILABLE") from exc
-        if not stat.S_ISREG(metadata.st_mode):
-            raise BuilderError("COLLECTOR_SPECIAL_FILE_DENIED")
-        if os.name != "nt" and metadata.st_mode & 0o022:
-            raise BuilderError("COLLECTOR_EVIDENCE_MODE_DENIED")
-        if (
-            os.name != "nt"
-            and
-            self._expected_owner_uid is not None
-            and metadata.st_uid != self._expected_owner_uid
-        ):
-            raise BuilderError("COLLECTOR_EVIDENCE_OWNER_DENIED")
-        return resolved
-
-    def _digest(self, path: Path) -> str:
-        digest = hashlib.sha256()
-        with path.open("rb") as handle:
-            for chunk in iter(lambda: handle.read(1024 * 1024), b""):
-                digest.update(chunk)
-        return digest.hexdigest()
-
-    def _json(self, path: Path) -> Mapping[str, Any]:
-        try:
-            if path.stat().st_size > 2 * 1024 * 1024:
-                raise BuilderError("COLLECTOR_EVIDENCE_SIZE_INVALID")
-            value = json.loads(path.read_text(encoding="utf-8"))
-        except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID") from exc
-        if not isinstance(value, Mapping):
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        return value
-
-    def __call__(self, recipe_name: str, recipe: Mapping[str, str]) -> Mapping[str, Any]:
-        try:
-            tree_result = self._git_runner(
-                ["git", f"--git-dir={self._authority_git_dir}", "rev-parse", f"{recipe['source_commit']}^{{tree}}"],
-                check=True, capture_output=True, text=True, timeout=15,
-                env={"PATH": os.environ.get("PATH", "")},
-            )
-            ancestry_result = self._git_runner(
-                ["git", f"--git-dir={self._authority_git_dir}", "merge-base", "--is-ancestor", recipe["base_oid"], recipe["source_commit"]],
-                check=False, capture_output=True, text=True, timeout=15,
-                env={"PATH": os.environ.get("PATH", "")},
-            )
-            tree_oid = tree_result.stdout.strip().lower()
-        except (OSError, subprocess.SubprocessError) as exc:
-            raise BuilderError("COLLECTOR_EVIDENCE_UNAVAILABLE") from exc
-        if getattr(ancestry_result, "returncode", 1) != 0:
-            raise BuilderError("COLLECTOR_GIT_MISMATCH")
-
-        receipt = self._json(self._regular_path(f"{recipe_name}/receipt.json"))
-        if set(receipt) != {"schema", "version", "candidate", "release_plan"}:
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        if (
-            receipt.get("schema") != "aios.trusted-candidate-builder.evidence.v1"
-            or receipt.get("version") != recipe_name
-        ):
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        candidate = receipt.get("candidate")
-        release_plan = receipt.get("release_plan")
-        if not isinstance(candidate, Mapping) or not isinstance(release_plan, Mapping):
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        if (
-            candidate.get("candidate_id") != recipe["candidate_id"]
-            or candidate.get("source_commit") != recipe["source_commit"]
-            or candidate.get("tree_oid") != tree_oid
-        ):
-            raise BuilderError("COLLECTOR_GIT_MISMATCH")
-        git_consistency = candidate.get("git_consistency")
-        if (
-            not isinstance(git_consistency, Mapping)
-            or git_consistency.get("consistent") is not True
-            or git_consistency.get("source_commit") != recipe["source_commit"]
-            or git_consistency.get("tree_oid") != tree_oid
-            or git_consistency.get("repository") != self._config.repository
-        ):
-            raise BuilderError("COLLECTOR_GIT_MISMATCH")
-
-        paths = {
-            name: self._regular_path(template.format(version=recipe_name))
-            for name, template in self._config.evidence_layout.items()
-        }
-        deployment = release_plan.get("deployment")
-        if not isinstance(deployment, Mapping):
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        digests = {name: self._digest(path) for name, path in paths.items()}
-        if (
-            digests["artifact"] != candidate.get("artifact_sha256")
-            or digests["manifest"] != candidate.get("manifest_sha256")
-            or digests["package_closure"] != deployment.get("package_closure_sha256")
-            or digests["policy"] != release_plan.get("policy_sha256")
-            or digests["policy"] != deployment.get("policy_sha256")
-        ):
-            raise BuilderError("COLLECTOR_DIGEST_MISMATCH")
-
-        tests = self._json(paths["tests"])
-        canary = self._json(paths["canary"])
-        gitea = self._json(paths["gitea"])
-        rollback = self._json(paths["rollback"])
-        secret_scan = self._json(paths["secret_scan"])
-        if tests != candidate.get("tests") or tests.get("passed") is not True:
-            raise BuilderError("COLLECTOR_TESTS_MISMATCH")
-        if canary != candidate.get("canary") or canary.get("passed") is not True:
-            raise BuilderError("COLLECTOR_CANARY_MISMATCH")
-        if (
-            digests["tests"] != hashlib.sha256(_canonical_json(dict(tests))).hexdigest()
-            or digests["canary"] != hashlib.sha256(_canonical_json(dict(canary))).hexdigest()
-        ):
-            raise BuilderError("COLLECTOR_EVIDENCE_CANONICALIZATION_MISMATCH")
-        if (
-            gitea != candidate.get("gitea_consistency")
-            or gitea.get("consistent") is not True
-            or gitea.get("repository") != self._config.repository
-            or gitea.get("source_commit") != recipe["source_commit"]
-            or gitea.get("tree_oid") != tree_oid
-            or gitea.get("remote_ref_oid") != recipe["source_commit"]
-        ):
-            raise BuilderError("COLLECTOR_GITEA_MISMATCH")
-        if (
-            candidate.get("rollback_ready") is not True
-            or rollback.get("ready") is not True
-            or rollback.get("source_commit") != recipe["source_commit"]
-            or rollback.get("rollback_sha256") != deployment.get("rollback_sha256")
-        ):
-            raise BuilderError("COLLECTOR_ROLLBACK_MISMATCH")
-        if (
-            digests["gitea"] != hashlib.sha256(_canonical_json(dict(gitea))).hexdigest()
-            or digests["rollback"] != hashlib.sha256(_canonical_json(dict(rollback))).hexdigest()
-        ):
-            raise BuilderError("COLLECTOR_EVIDENCE_CANONICALIZATION_MISMATCH")
-        if (
-            secret_scan.get("passed") is not True
-            or secret_scan.get("artifact_sha256") != candidate.get("artifact_sha256")
-        ):
-            raise BuilderError("COLLECTOR_SECRET_SCAN_MISMATCH")
-        checks = {name: True for name in self._config.required_checks}
-        return {
-            "candidate": dict(candidate),
-            "release_plan": dict(release_plan),
-            "checks": checks,
-            "evidence_digests": digests,
-        }
-
-
-class DeterministicEvidenceCollector:
-    """Validates a server-owned source; request fields never influence collection."""
-
-    _BUNDLE_FIELDS = {"candidate", "release_plan", "checks", "evidence_digests"}
-
-    def __init__(self, config: TrustedCandidateBuilderConfig, *, evidence_source: Callable[[str, Mapping[str, str]], Mapping[str, Any]] | None = None):
-        self._config = config
-        self._evidence_source = evidence_source
-
-    def collect(self, recipe_name: str, recipe: Mapping[str, str]) -> Mapping[str, Any]:
-        if self._evidence_source is None:
-            raise BuilderError("COLLECTOR_UNCONFIGURED")
-        bundle = self._evidence_source(recipe_name, recipe)
-        if not isinstance(bundle, Mapping) or set(bundle) != self._BUNDLE_FIELDS:
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID")
-        raw_checks = bundle.get("checks")
-        if (
-            not isinstance(raw_checks, Mapping)
-            or set(raw_checks) != set(self._config.required_checks)
-            or any(raw_checks.get(name) is not True for name in self._config.required_checks)
-        ):
-            raise BuilderError("COLLECTOR_CHECKS_INCOMPLETE")
-        evidence_digests = bundle.get("evidence_digests")
-        if (
-            not isinstance(evidence_digests, Mapping)
-            or set(evidence_digests) != set(self._config.evidence_layout)
-            or any(
-                not isinstance(value, str)
-                or len(value) != 64
-                or any(char not in "0123456789abcdef" for char in value.lower())
-                for value in evidence_digests.values()
-            )
-        ):
-            raise BuilderError("COLLECTOR_EVIDENCE_DIGESTS_INVALID")
-        try:
-            from silent_release_controller import ReleaseCandidate
-            from silent_release_hardening import ReleasePlan, TrustedCandidateBundle
-
-            candidate = ReleaseCandidate.from_dict(dict(bundle["candidate"]))
-            release_plan = ReleasePlan.from_dict(dict(bundle["release_plan"]))
-            checks = dict(raw_checks)
-            TrustedCandidateBundle(candidate, release_plan, checks).validate()
-        except (ImportError, KeyError, TypeError, ValueError, RuntimeError) as exc:
-            raise BuilderError("COLLECTOR_EVIDENCE_INVALID") from exc
-        if candidate.source_commit != recipe["source_commit"] or candidate.candidate_id != recipe["candidate_id"]:
-            raise BuilderError("COLLECTOR_SOURCE_MISMATCH")
-        return {
-            "candidate": candidate.to_dict(),
-            "release_plan": release_plan.to_dict(),
-            "checks": checks,
-            "evidence_digests": dict(evidence_digests),
-        }
-
-
-def _extract_peer_identity(connection: socket.socket) -> PeerIdentity:
-    if not hasattr(socket, "SO_PEERCRED"):
-        raise BuilderError("SO_PEERCRED_UNAVAILABLE")
-    raw = connection.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, struct.calcsize("3i"))
-    if len(raw) != struct.calcsize("3i"):
-        raise BuilderError("SO_PEERCRED_INVALID")
-    return PeerIdentity(*struct.unpack("3i", raw))
-
-
-def _resolve_cgroups(pid: int) -> tuple[str, ...]:
-    try:
-        return tuple(
-            line.rsplit(":", 1)[1].strip()
-            for line in Path(f"/proc/{pid}/cgroup").read_text(encoding="utf-8").splitlines()
-            if ":" in line and line.rsplit(":", 1)[1].strip().startswith("/")
-        )
-    except OSError as exc:
-        raise BuilderError("PEER_CGROUP_UNAVAILABLE") from exc
-
-
-def _resolve_process_identity(pid: int) -> tuple[str, tuple[str, ...]]:
-    try:
-        executable = os.path.realpath(f"/proc/{pid}/exe")
-        argv = tuple(
-            item.decode("utf-8", "strict")
-            for item in Path(f"/proc/{pid}/cmdline").read_bytes().split(b"\0")
-            if item
-        )
-    except (OSError, UnicodeDecodeError) as exc:
-        raise BuilderError("PEER_PROCESS_UNAVAILABLE") from exc
-    if not executable or not argv:
-        raise BuilderError("PEER_PROCESS_UNAVAILABLE")
-    return executable, argv
-
-
-class TrustedCandidateBuilder:
-    def __init__(
-        self, config: TrustedCandidateBuilderConfig, keyring: BuilderKeyring, *,
-        collector: DeterministicEvidenceCollector, signer: DomainPurposeSigner,
-        peer_identity_resolver: Callable[[socket.socket], PeerIdentity] = _extract_peer_identity,
-        cgroup_resolver: Callable[[int], tuple[str, ...] | str] = _resolve_cgroups,
-        process_identity_resolver: Callable[[int], tuple[str, tuple[str, ...]]] = _resolve_process_identity,
-        clock: Callable[[], float] = time.time, nonce_ledger_path: Path | None = None,
-    ) -> None:
-        self.config, self.keyring, self.collector, self.signer = config, keyring, collector, signer
-        self.peer_identity_resolver, self.cgroup_resolver, self.clock = peer_identity_resolver, cgroup_resolver, clock
-        self.process_identity_resolver = process_identity_resolver
-        self._nonce_ledger_path = Path(nonce_ledger_path) if nonce_ledger_path else None
-        self._nonce_ledger: dict[str, tuple[bytes, dict[str, Any]]] = self._load_nonce_ledger()
-
-    def _load_nonce_ledger(self) -> dict[str, tuple[bytes, dict[str, Any]]]:
-        if self._nonce_ledger_path is None or not self._nonce_ledger_path.exists():
-            return {}
-        if self._nonce_ledger_path.is_symlink():
-            raise BuilderError("NONCE_LEDGER_INVALID")
-        try:
-            raw = json.loads(self._nonce_ledger_path.read_text(encoding="utf-8"))
-            return {nonce: (bytes.fromhex(value["request_sha256"]), dict(value["result"])) for nonce, value in raw.items()}
-        except (OSError, ValueError, TypeError, KeyError, json.JSONDecodeError) as exc:
-            raise BuilderError("NONCE_LEDGER_INVALID") from exc
-
-    def _persist_nonce_ledger(self) -> None:
-        if self._nonce_ledger_path is None:
-            return
-        try:
-            self._nonce_ledger_path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
-            temporary = self._nonce_ledger_path.with_suffix(".tmp")
-            payload = {nonce: {"request_sha256": digest.hex(), "result": result} for nonce, (digest, result) in self._nonce_ledger.items()}
-            with temporary.open("wb") as handle:
-                handle.write(_canonical_json(payload))
-                handle.flush()
-                os.fsync(handle.fileno())
-            os.chmod(temporary, 0o600)
-            os.replace(temporary, self._nonce_ledger_path)
-            if os.name != "nt":
-                descriptor = os.open(self._nonce_ledger_path.parent, os.O_RDONLY)
-                try:
-                    os.fsync(descriptor)
-                finally:
-                    os.close(descriptor)
-        except OSError as exc:
-            raise BuilderError("NONCE_LEDGER_PERSIST_FAILED") from exc
-
-    def _verify_peer(self, connection: socket.socket) -> None:
-        peer = self.peer_identity_resolver(connection)
-        if peer.uid != self.config.allowed_peer_uid or peer.pid <= 0:
-            raise BuilderError("PEER_IDENTITY_DENIED")
-        resolved = self.cgroup_resolver(peer.pid)
-        cgroups = (resolved,) if isinstance(resolved, str) else tuple(resolved)
-        if not cgroups or not any(item in self.config.allowed_peer_cgroups for item in cgroups):
-            raise BuilderError("PEER_CGROUP_DENIED")
-        executable, argv = self.process_identity_resolver(peer.pid)
-        if not executable.startswith(self.config.allowed_peer_executable_prefix):
-            raise BuilderError("PEER_PROCESS_DENIED")
-        runtime_arguments = [
-            value
-            for value in argv
-            if value.startswith(self.config.allowed_peer_runtime_prefix)
-            and value.endswith(self.config.allowed_peer_runtime_suffix)
-        ]
-        if len(runtime_arguments) != 1:
-            raise BuilderError("PEER_PROCESS_DENIED")
-
-    def handle_request(self, request: Mapping[str, Any], *, connection: socket.socket) -> dict[str, Any]:
-        if not isinstance(request, Mapping):
-            raise BuilderError("REQUEST_SCHEMA_INVALID")
-        expected_keys = {"schema", "operation", "recipe", "repository", "task_id", "candidate_id", "base_oid", "source_commit", "version", "purpose", "issued_at", "nonce", "hmac"}
-        if (
-            set(request) != expected_keys
-            or request.get("schema") != self.config.request_schema
-            or request.get("operation") not in {
-                self.config.operation,
-                self.config.readiness_operation,
-            }
-        ):
-            raise BuilderError("REQUEST_SCHEMA_INVALID")
-        supplied_mac = request.get("hmac")
-        unsigned = {key: value for key, value in request.items() if key != "hmac"}
-        if not isinstance(supplied_mac, str) or not hmac.compare_digest(hmac.new(self.keyring.builder_hmac, _canonical_json(unsigned), hashlib.sha256).hexdigest(), supplied_mac):
-            raise BuilderError("REQUEST_HMAC_INVALID")
-        issued_at, nonce = request.get("issued_at"), request.get("nonce")
-        if not isinstance(issued_at, int) or not isinstance(nonce, str) or len(nonce) < 16 or len(nonce) > 256:
-            raise BuilderError("REQUEST_SCHEMA_INVALID")
-        self._verify_peer(connection)
-        request_bytes = _canonical_json(dict(request))
-        replay = self._nonce_ledger.get(nonce)
-        if replay is not None:
-            if hmac.compare_digest(replay[0], hashlib.sha256(request_bytes).digest()):
-                return dict(replay[1])
-            raise BuilderError("REPLAY_CONFLICT")
-        if abs(int(self.clock()) - issued_at) > self.config.maximum_request_age_seconds:
-            raise BuilderError("REQUEST_STALE")
-        recipe_name = request.get("recipe")
-        if not isinstance(recipe_name, str):
-            raise BuilderError("REQUEST_SCHEMA_INVALID")
-        recipe = self.config.resolve_recipe(str(request.get("version") or ""), str(request.get("candidate_id") or ""), str(request.get("source_commit") or ""))
-        if recipe_name != recipe.get("version"):
-            raise BuilderError("REQUEST_RELEASE_BINDING_INVALID")
-        bound = {"repository": self.config.repository, "task_id": recipe["task_id"], "candidate_id": recipe["candidate_id"], "base_oid": recipe["base_oid"], "source_commit": recipe["source_commit"], "version": recipe["version"], "purpose": recipe["purpose"]}
-        if {key: request.get(key) for key in bound} != bound:
-            raise BuilderError("REQUEST_SCOPE_INVALID")
-        bundle = dict(self.collector.collect(recipe_name, recipe))
-        candidate = bundle["candidate"]
-        release_plan = bundle["release_plan"]
-        checks = bundle.get("checks")
-        evidence_digests = bundle["evidence_digests"]
-        if not isinstance(checks, Mapping) or set(checks) != set(self.config.required_checks) or not all(value is True for value in checks.values()):
-            raise BuilderError("COLLECTOR_CHECKS_INCOMPLETE")
-        if request["operation"] == self.config.readiness_operation:
-            result = {
-                "schema": self.config.response_schema,
-                "status": "READY",
-                "repository": self.config.repository,
-                "recipe": recipe_name,
-                "candidate_id": recipe["candidate_id"],
-                "source_commit": recipe["source_commit"],
-                "builder_key_id": self.signer.key_id,
-                "builder_key_generation": self.signer.key_generation,
-                "signature_algorithm": "Ed25519",
-                "signature_purpose": "AIOS_TRUSTED_RELEASE_BUILDER",
-                "policy_sha256": self.config.policy_sha256,
-                "collector_ready": True,
-                "signer_ready": True,
-            }
-            if len(self._nonce_ledger) >= 2048:
-                self._nonce_ledger.pop(next(iter(self._nonce_ledger)))
-            self._nonce_ledger[nonce] = (
-                hashlib.sha256(request_bytes).digest(),
-                dict(result),
-            )
-            self._persist_nonce_ledger()
-            return result
-        issued = datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
-        attestation = {
-            "builder_attestation_id": "builder-attestation-" + _sha256(recipe_name, recipe["task_id"], candidate["artifact_sha256"])[:24],
-            "builder_key_id": self.signer.key_id,
-            "builder_key_generation": self.signer.key_generation,
-            "signature_algorithm": "Ed25519",
-            "signature_purpose": "AIOS_TRUSTED_RELEASE_BUILDER",
-            "source_commit": candidate["source_commit"], "tree_oid": candidate["tree_oid"],
-            "artifact_sha256": candidate["artifact_sha256"], "manifest_sha256": candidate["manifest_sha256"],
-            "package_closure_sha256": release_plan["deployment"]["package_closure_sha256"],
-            "test_evidence_sha256": evidence_digests["tests"],
-            "canary_evidence_sha256": evidence_digests["canary"],
-            "gitea_evidence_sha256": evidence_digests["gitea"],
-            "rollback_evidence_sha256": evidence_digests["rollback"],
-            "policy_evidence_sha256": evidence_digests["policy"],
-            "secret_scan_evidence_sha256": evidence_digests["secret_scan"],
-            "issued_at": issued, "trust_domain": "aios.trusted-builder.attestation.v1",
-        }
-        canonical_attestation = _canonical_json(attestation)
-        fingerprint = hashlib.sha256(canonical_attestation).hexdigest()
-        signature = base64.b64encode(self.signer.sign_for_purpose("AIOS_TRUSTED_RELEASE_BUILDER", canonical_attestation)).decode("ascii")
-        result = {
-            "schema": self.config.response_schema, "status": "BUILT", "recipe": recipe_name,
-            "repository": self.config.repository, "task_id": recipe["task_id"], "base_oid": recipe["base_oid"],
-            "purpose": recipe["purpose"], "checks": dict(checks),
-            "evidence": {"candidate_id": candidate["candidate_id"], "source_commit": candidate["source_commit"], "tree_oid": candidate["tree_oid"], "artifact_sha256": candidate["artifact_sha256"], "manifest_sha256": candidate["manifest_sha256"], "package_closure_sha256": release_plan["deployment"]["package_closure_sha256"], "test_evidence_sha256": attestation["test_evidence_sha256"], "canary_evidence_sha256": attestation["canary_evidence_sha256"]},
-            "attestation": {**attestation, "fingerprint": fingerprint, "signature": signature},
-        }
-        result["silent_release_bundle"] = {"candidate": candidate, "release_plan": release_plan, "checks": dict(checks), "attestation": result["attestation"]}
-        if len(self._nonce_ledger) >= 2048:
-            self._nonce_ledger.pop(next(iter(self._nonce_ledger)))
-        self._nonce_ledger[nonce] = (hashlib.sha256(request_bytes).digest(), dict(result))
-        self._persist_nonce_ledger()
-        return result
-
-    def serve_forever(self, listener: socket.socket) -> None:
-        while True:
-            connection, _ = listener.accept()
-            with connection:
-                try:
-                    raw = connection.makefile("rb").readline(65537)
-                    if not raw or len(raw) > 65536:
-                        raise BuilderError("REQUEST_SIZE_INVALID")
-                    result = self.handle_request(json.loads(raw), connection=connection)
-                except (BuilderError, UnicodeDecodeError, json.JSONDecodeError):
-                    result = {"schema": self.config.response_schema, "status": "REJECTED", "error_code": "REQUEST_REJECTED"}
-                connection.sendall(_canonical_json(result) + b"\n")
-
-
-class UnixTrustedCandidateBuilderClient:
-    def __init__(self, config: TrustedCandidateBuilderConfig, keyring: BuilderKeyring, *, socket_path: Path | None = None, clock: Callable[[], float] = time.time) -> None:
-        self.config, self.keyring, self.socket_path, self.clock = config, keyring, socket_path, clock
-
-    def create_request(self, version: str, candidate_id: str | None, source_commit: str, *, nonce: str, operation: str | None = None) -> dict[str, Any]:
-        selected = self.config.resolve_recipe(version, candidate_id, source_commit)
-        selected_operation = operation or self.config.operation
-        if selected_operation not in {self.config.operation, self.config.readiness_operation}:
-            raise BuilderError("REQUEST_OPERATION_INVALID")
-        request = {"schema": self.config.request_schema, "operation": selected_operation, "recipe": version, "repository": self.config.repository, "task_id": selected["task_id"], "candidate_id": selected["candidate_id"], "base_oid": selected["base_oid"], "source_commit": selected["source_commit"], "version": selected["version"], "purpose": selected["purpose"], "issued_at": int(self.clock()), "nonce": nonce}
-        request["hmac"] = hmac.new(self.keyring.builder_hmac, _canonical_json(request), hashlib.sha256).hexdigest()
-        return request
-
-    def _exchange(self, request: Mapping[str, Any]) -> Mapping[str, Any]:
-        if self.socket_path is None:
-            raise BuilderError("BUILDER_SOCKET_UNCONFIGURED")
-        try:
-            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as connection:
-                connection.settimeout(self.config.request_timeout_seconds)
-                connection.connect(os.fspath(self.socket_path))
-                connection.sendall(_canonical_json(dict(request)) + b"\n")
-                raw = connection.makefile("rb").readline(65537)
-        except (OSError, TimeoutError) as exc:
-            raise BuilderError("BUILDER_TRANSPORT_UNAVAILABLE") from exc
-        try:
-            result = json.loads(raw)
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise BuilderError("BUILDER_RESPONSE_INVALID") from exc
-        if not isinstance(result, Mapping) or result.get("schema") != self.config.response_schema:
-            raise BuilderError("BUILDER_RESPONSE_INVALID")
-        return result
-
-    def build(self, version: str, candidate_id: str | None, source_commit: str, *, nonce: str) -> Mapping[str, Any]:
-        result = self._exchange(
-            self.create_request(version, candidate_id, source_commit, nonce=nonce)
-        )
-        if result.get("status") != "BUILT":
-            raise BuilderError("BUILDER_REQUEST_REJECTED")
-        return result
-
-    def probe(self, *, nonce: str | None = None) -> Mapping[str, Any]:
-        recipe = self.config.fixed_recipe("V2R2C2")
-        result = self._exchange(
-            self.create_request(
-                "V2R2C2",
-                recipe["candidate_id"],
-                recipe["source_commit"],
-                nonce=nonce or secrets.token_hex(32),
-                operation=self.config.readiness_operation,
-            )
-        )
-        if result.get("status") != "READY":
-            raise BuilderError("BUILDER_NOT_READY")
-        return result
-
-
-def readiness_probe(client: UnixTrustedCandidateBuilderClient) -> Mapping[str, Any]:
-    result = dict(client.probe())
-    required_true = {"collector_ready", "signer_ready"}
-    if any(result.get(name) is not True for name in required_true):
-        raise BuilderError("BUILDER_NOT_READY")
-    return result
-
-
-def _main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--socket-fd", required=True, type=int)
-    parser.add_argument("--policy", required=True, type=Path)
-    arguments = parser.parse_args()
-    config = TrustedCandidateBuilderConfig.from_policy(load_builder_policy(arguments.policy))
-    credentials = os.environ.get("CREDENTIALS_DIRECTORY")
-    if not credentials:
-        raise SystemExit("CREDENTIALS_DIRECTORY is required")
-    keyring = BuilderKeyring.from_credentials_directory(Path(credentials))
-    signer = CredentialPathEd25519Signer(
-        keyring.signing_private_key_path,
-        key_id=os.environ["AIOS_TRUSTED_BUILDER_KEY_ID"],
-        key_generation=int(os.environ["AIOS_TRUSTED_BUILDER_KEY_GENERATION"]),
-        allowed_purpose="AIOS_TRUSTED_RELEASE_BUILDER",
-    )
-    listener = socket.fromfd(arguments.socket_fd, socket.AF_UNIX, socket.SOCK_STREAM)
-    collector = DeterministicEvidenceCollector(
-        config,
-        evidence_source=ServerOwnedEvidenceSource(
-            config,
-            Path(os.environ["AIOS_TRUSTED_BUILDER_GIT_DIR"]),
-            Path(os.environ["AIOS_TRUSTED_BUILDER_EVIDENCE_ROOT"]),
-        ),
-    )
-    TrustedCandidateBuilder(config, keyring, collector=collector, signer=signer, nonce_ledger_path=Path(os.environ["AIOS_TRUSTED_BUILDER_NONCE_LEDGER"])).serve_forever(listener)
-
-
-if __name__ == "__main__":
-    _main()

active-runtime/app/approved_release_executor.py

@@ -31,8 +31,6 @@ import time
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 
-from trusted_release_execution_plan import PlanError, TrustedReleasePlan
-
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA_RE = re.compile(r"^[0-9a-f]{64}$")
 PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
@@ -75,24 +73,6 @@ class Binding:
     production_port: int
     repository_identity: str = "aios/aios"
 
-    candidate_id: str | None = None
-    release_plan_sha256: str | None = None
-
-    @classmethod
-    def from_trusted_plan(cls, plan: TrustedReleasePlan) -> "Binding":
-        value = plan.value
-        adapter = value["adapter_policy"]
-        binding = cls(
-            version=str(value["version"]), target_oid=str(value["source_commit"]),
-            evidence_closure_oid=str(value["evidence_closure_oid"]), artifact_sha256=str(value["artifact_sha256"]),
-            approval_plan_id=str(value["approval_plan_id"]), artifact_path=str(value["artifact"]["path"]),
-            artifact_size=int(value["artifact"]["size"]), production_service=str(adapter["service"]),
-            production_port=int(adapter["port"]), candidate_id=str(value["candidate_id"]),
-            release_plan_sha256=plan.release_plan_sha256,
-        )
-        plan.assert_binding(dataclasses.asdict(binding))
-        return binding
-
     def __post_init__(self) -> None:
         if not self.version or not OID_RE.fullmatch(self.target_oid):
             raise ValueError("invalid release target binding")
@@ -127,8 +107,6 @@ class Binding:
             "production_service": self.production_service,
             "production_port": self.production_port,
             "repository_identity": self.repository_identity,
-            "candidate_id": self.candidate_id,
-            "release_plan_sha256": self.release_plan_sha256,
         }
         return hashlib.sha256(canonical_json(payload)).hexdigest()
 
@@ -148,12 +126,9 @@ class Binding:
             "production_service": self.production_service,
             "production_port": self.production_port,
             "repository_identity": self.repository_identity,
-            "candidate_id": self.candidate_id,
-            "release_plan_sha256": self.release_plan_sha256,
         }
 
 
-
 def canonical_json(value: object) -> bytes:
     return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
 
@@ -307,12 +282,6 @@ def verify_authorization(receipt: Mapping[str, Any], binding: Binding) -> dict[s
         "artifact_sha256": binding.artifact_sha256,
         "approval_plan_id": binding.approval_plan_id,
     }
-    if binding.candidate_id is not None:
-        expected["candidate_id"] = binding.candidate_id
-    if binding.release_plan_sha256 is not None:
-        expected["release_plan_sha256"] = binding.release_plan_sha256
-        if receipt.get("candidate_binding_sha256") is None:
-            raise ManualOwnerReviewRequired("Owner authorization missing candidate binding")
     for key, value in expected.items():
         if receipt.get(key) != value:
             raise ManualOwnerReviewRequired(f"Owner authorization mismatch: {key}")
@@ -529,14 +498,7 @@ def execute(
     deploy_command: Sequence[str],
     registry_command: Sequence[str],
     baseline_command: Sequence[str],
-    release_plan_path: Path | None = None,
 ) -> dict[str, Any]:
-    plan = TrustedReleasePlan.load(release_plan_path) if release_plan_path is not None else None
-    if plan is not None:
-        try:
-            plan.assert_binding(dataclasses.asdict(binding))
-        except PlanError as exc:
-            raise ReleaseBlocked(f"trusted release plan mismatch: {exc}") from exc
     authorization = verify_authorization(secure_json(authorization_path), binding)
     lineage = verify_git_lineage(repository, binding)
     artifact = verify_artifact(binding)
@@ -629,18 +591,17 @@ def execute(
 def parser() -> argparse.ArgumentParser:
     p = argparse.ArgumentParser()
     p.add_argument("--authorization", required=True, type=Path)
-    p.add_argument("--release-plan", type=Path)
     p.add_argument("--repository", required=True, type=Path)
     p.add_argument("--state-root", required=True, type=Path)
-    p.add_argument("--artifact", type=Path)
-    p.add_argument("--artifact-size", type=int)
-    p.add_argument("--version")
-    p.add_argument("--target-oid")
-    p.add_argument("--evidence-closure-oid")
-    p.add_argument("--artifact-sha256")
-    p.add_argument("--approval-plan-id")
-    p.add_argument("--production-service")
-    p.add_argument("--production-port", type=int)
+    p.add_argument("--artifact", required=True, type=Path)
+    p.add_argument("--artifact-size", required=True, type=int)
+    p.add_argument("--version", required=True)
+    p.add_argument("--target-oid", required=True)
+    p.add_argument("--evidence-closure-oid", required=True)
+    p.add_argument("--artifact-sha256", required=True)
+    p.add_argument("--approval-plan-id", required=True)
+    p.add_argument("--production-service", required=True)
+    p.add_argument("--production-port", required=True, type=int)
     p.add_argument("--repository-identity", default="aios/aios")
     p.add_argument("--tag-adapter", required=True, nargs="+")
     p.add_argument("--deploy-adapter", required=True, nargs="+")
@@ -651,13 +612,18 @@ def parser() -> argparse.ArgumentParser:
 
 def main() -> int:
     args = parser().parse_args()
-    plan = TrustedReleasePlan.load(args.release_plan) if args.release_plan else None
-    if plan is not None:
-        binding = Binding.from_trusted_plan(plan)
-    else:
-        legacy=(args.artifact,args.artifact_size,args.version,args.target_oid,args.evidence_closure_oid,args.artifact_sha256,args.approval_plan_id,args.production_service,args.production_port)
-        if any(value is None for value in legacy): raise SystemExit("legacy binding is incomplete")
-        binding = Binding(version=args.version,target_oid=args.target_oid,evidence_closure_oid=args.evidence_closure_oid,artifact_sha256=args.artifact_sha256,approval_plan_id=args.approval_plan_id,artifact_path=str(args.artifact),artifact_size=args.artifact_size,production_service=args.production_service,production_port=args.production_port,repository_identity=args.repository_identity)
+    binding = Binding(
+        version=args.version,
+        target_oid=args.target_oid,
+        evidence_closure_oid=args.evidence_closure_oid,
+        artifact_sha256=args.artifact_sha256,
+        approval_plan_id=args.approval_plan_id,
+        artifact_path=str(args.artifact),
+        artifact_size=args.artifact_size,
+        production_service=args.production_service,
+        production_port=args.production_port,
+        repository_identity=args.repository_identity,
+    )
     try:
         result = execute(
             binding=binding,
@@ -668,7 +634,6 @@ def main() -> int:
             deploy_command=parse_command(args.deploy_adapter),
             registry_command=parse_command(args.registry_adapter),
             baseline_command=parse_command(args.baseline_adapter),
-            release_plan_path=args.release_plan,
         )
         print(json.dumps(result, sort_keys=True))
         return 0

active-runtime/app/authoritative_git.py

@@ -4,7 +4,6 @@ from __future__ import annotations
 import os
 import re
 import subprocess
-import time
 import urllib.parse
 from pathlib import Path
 from typing import Iterable
@@ -307,76 +306,14 @@ def authoritative_diff(
     from_oid = validate_git_revision(from_revision, "from", git_dir=path)
     to_oid = validate_git_revision(to_revision, "to", git_dir=path)
     args = ["diff", "--no-ext-diff", "--no-textconv", from_oid, to_oid]
-    patch_limit = max(1, min(_MAX_OUTPUT, 256 * 1024))
-    process = subprocess.Popen(
-        ["git", "--git-dir", str(path), *args],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
-        env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
-    )
-    chunks: list[bytes] = []
-    stored_bytes = 0
-    total_bytes = 0
-    started = time.monotonic()
-    try:
-        while process.stdout is not None:
-            chunk = process.stdout.read(64 * 1024)
-            if not chunk:
-                break
-            total_bytes += len(chunk)
-            if stored_bytes < patch_limit:
-                remaining = patch_limit - stored_bytes
-                selected = chunk[:remaining]
-                chunks.append(selected)
-                stored_bytes += len(selected)
-            if time.monotonic() - started > _TIMEOUT:
-                process.kill()
-                raise AuthoritativeGitError("GIT_REF_QUERY_TIMEOUT")
-        stderr = (
-            process.stderr.read(8192).decode("utf-8", errors="replace")
-            if process.stderr is not None
-            else ""
-        )
-        returncode = process.wait(timeout=max(0.1, _TIMEOUT - (time.monotonic() - started)))
-    except (OSError, subprocess.TimeoutExpired) as exc:
-        process.kill()
-        process.wait()
-        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED") from exc
-    if returncode != 0:
-        raise AuthoritativeGitError(_redact(stderr.strip() or "GIT_REF_QUERY_FAILED")[:200])
-    try:
-        names_result = run_authoritative_git(
-            ["diff", "--no-ext-diff", "--no-textconv", "--name-status", from_oid, to_oid],
-            git_dir=path,
-        )
-        changed_paths = [
-            line.split("\t", 1)[-1]
-            for line in names_result.stdout.splitlines()
-            if line.strip()
-        ]
-    except AuthoritativeGitOutputTooLarge:
-        changed_paths = []
-    try:
-        stats_result = run_authoritative_git(
-            ["diff", "--no-ext-diff", "--no-textconv", "--stat", from_oid, to_oid],
-            git_dir=path,
-        )
-        stats = stats_result.stdout.strip()
-    except AuthoritativeGitOutputTooLarge:
-        stats = "GIT_STAT_OUTPUT_TRUNCATED"
-    patch = b"".join(chunks).decode("utf-8", errors="replace")
+    result = run_authoritative_git(args, git_dir=path)
     return {
         "code": 0,
-        "stdout": patch,
+        "stdout": result.stdout,
         "stderr": "",
         "cmd": ["git", f"--git-dir={path}", *args],
         "from_oid": from_oid,
         "to_oid": to_oid,
-        "changed_paths": changed_paths,
-        "stats": stats,
-        "total_size_bytes": total_bytes,
-        "truncated": total_bytes > patch_limit,
-        "patch_limit_bytes": patch_limit,
     }
 
 

active-runtime/app/authorized_task_writer_provisioning.py

@@ -964,6 +964,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
     required = {
         "schema",
         "task_id",
+        "job_id",
         "repository",
         "branch_mode",
         "base_oid",
@@ -976,6 +977,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
         raise ProvisioningError("LEASE_REQUEST_V2_FIELDS_REJECTED", 409)
     request = WriterLeaseRequestV2(
         task_id=str(raw["task_id"]),
+        job_id=str(raw["job_id"]),
         repository=str(raw["repository"]),
         branch_mode=str(raw["branch_mode"]),
         base_oid=str(raw["base_oid"]),
@@ -988,6 +990,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
     return {
         "schema": WriterLeaseRequestV2.schema,
         "task_id": request.task_id,
+        "job_id": request.job_id,
         "repository": request.repository,
         "branch_mode": request.branch_mode,
         "base_oid": request.base_oid,

active-runtime/app/campaign_release_acceptance.py

@@ -12,7 +12,6 @@ import tempfile
 from typing import Any, Mapping
 
 from release_campaign_authorization import CampaignAuthorization, CampaignError
-from trusted_release_execution_plan import PlanError, TrustedReleasePlan
 
 
 class AcceptanceError(RuntimeError):
@@ -62,7 +61,6 @@ def evaluate(
     staging: Mapping[str, Any],
     main: Mapping[str, Any],
     tag: Mapping[str, Any],
-    release_plan: Mapping[str, Any] | None = None,
 ) -> dict[str, Any]:
     required_binding = {
         "version",
@@ -100,27 +98,8 @@ def evaluate(
         raise AcceptanceError("rollback_readiness_failed")
     if tag.get("conflict") is not False:
         raise AcceptanceError("tag_conflict")
-    trusted_plan: TrustedReleasePlan | None = None
-    if release_plan is not None:
-        try:
-            trusted_plan = TrustedReleasePlan.from_mapping(release_plan)
-            trusted_plan.assert_binding(binding)
-        except PlanError as exc:
-            raise AcceptanceError(f"trusted_release_plan_invalid:{exc}") from exc
-        if trusted_plan.value["campaign_authorization_sha256"] != campaign.digest:
-            raise AcceptanceError("campaign_authorization_digest_mismatch")
-        if int(trusted_plan.value["campaign_generation"]) != int(campaign.data["generation"]):
-            raise AcceptanceError("campaign_generation_mismatch")
-        if main.get("tree_oid") not in (None, trusted_plan.value["tree_oid"]):
-            raise AcceptanceError("tree_oid_mismatch")
-        if evidence.get("release_plan_sha256") not in (None, trusted_plan.release_plan_sha256):
-            raise AcceptanceError("evidence_release_plan_mismatch")
-        if artifact.get("manifest_sha256") not in (None, trusted_plan.value["manifest_sha256"]):
-            raise AcceptanceError("manifest_digest_mismatch")
-        if artifact.get("package_closure_sha256") not in (None, trusted_plan.value["package_closure_sha256"]):
-            raise AcceptanceError("package_closure_digest_mismatch")
     campaign.assert_operation("derive_campaign_acceptance")
-    result = {
+    return {
         "schema": "aios.campaign-release-acceptance.v1",
         "accepted": True,
         "binding_replaced": False,
@@ -129,22 +108,6 @@ def evaluate(
         **dict(binding),
         "owner_interaction_required": False,
     }
-    if trusted_plan is not None:
-        result.update({
-            "candidate_id": trusted_plan.value["candidate_id"],
-            "release_plan_sha256": trusted_plan.release_plan_sha256,
-            "candidate_binding_sha256": trusted_plan.candidate_binding_sha256,
-            "campaign_authorization_sha256": trusted_plan.value["campaign_authorization_sha256"],
-            "campaign_generation": trusted_plan.value["campaign_generation"],
-            "tree_oid": trusted_plan.value["tree_oid"],
-            "manifest_sha256": trusted_plan.value["manifest_sha256"],
-            "package_closure_sha256": trusted_plan.value["package_closure_sha256"],
-            "deployment_plan_sha256": trusted_plan.value["deployment_plan_sha256"],
-            "policy_sha256": trusted_plan.value["policy_sha256"],
-            "rollback": trusted_plan.value["rollback"],
-            "baseline": trusted_plan.value["baseline"],
-        })
-    return result
 
 
 def main() -> int:
@@ -157,7 +120,6 @@ def main() -> int:
     p.add_argument("--staging", type=Path, required=True)
     p.add_argument("--main-facts", type=Path, required=True)
     p.add_argument("--tag-facts", type=Path, required=True)
-    p.add_argument("--release-plan", type=Path)
     p.add_argument("--output", type=Path, required=True)
     a = p.parse_args()
 
@@ -174,7 +136,6 @@ def main() -> int:
         secure_json(a.staging),
         secure_json(a.main_facts),
         secure_json(a.tag_facts),
-        secure_json(a.release_plan) if a.release_plan else None,
     )
     atomic_new(a.output, receipt)
     print(json.dumps(receipt, sort_keys=True))

active-runtime/app/gitea_tag_publication.py

@@ -8,7 +8,6 @@ import json
 import os
 import re
 import subprocess
-import sys
 import tempfile
 import time
 import urllib.error
@@ -24,15 +23,10 @@ try:
     from authoritative_git import AuthoritativeGitError, run_authoritative_git
 except ModuleNotFoundError:
     from .authoritative_git import AuthoritativeGitError, run_authoritative_git
-try:
-    from release_version import RELEASE_VERSION_RE, validate_release_version
-except ModuleNotFoundError:
-    sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
-    from release_version import RELEASE_VERSION_RE, validate_release_version
 
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
-VERSION_RE = RELEASE_VERSION_RE
+VERSION_RE = re.compile(r"^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$")
 DEPLOYMENT_EVIDENCE_RE = re.compile(r"^(?:sha256:[0-9a-f]{64}|git:[0-9a-f]{40})$")
 FINGERPRINT_FIELDS = (
     "version",
@@ -89,14 +83,9 @@ class PublicationManualOwnerReviewRequired(
 
 
 def validate_version(version: str) -> str:
-    return validate_release_version(version)
-
-
-def validate_gitea_api_url(api_url: str) -> str:
-    value = str(api_url or "").strip().rstrip("/")
-    parsed = urllib.parse.urlsplit(value)
-    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
-        raise ValueError("Gitea API URL must be HTTP(S)")
+    value = str(version or "")
+    if not VERSION_RE.fullmatch(value):
+        raise ValueError("invalid release version")
     return value
 
 
@@ -422,11 +411,13 @@ class GiteaTagClient:
         timeout: float = 15,
         token_line: int = 1,
     ):
-        self.api_url = validate_gitea_api_url(api_url)
+        self.api_url = api_url.rstrip("/")
         self.repository = repository.strip("/")
         self.token_file = token_file
         self.timeout = timeout
         self.token_line = token_line
+        if not self.api_url.startswith(("https://", "http://")):
+            raise ValueError("Gitea API URL must be HTTP(S)")
         if self.repository.count("/") != 1:
             raise ValueError("Gitea repository must be owner/name")
 

active-runtime/app/governed_production_release.py

@@ -1,7 +1,4 @@
-"""Governed release orchestration with a trusted-plan V2R2C2 path.
-
-The legacy V2R2C1 implementation remains available only for compatibility;
-new release requests are dispatched to the plan-driven executor below.
+"""Governed V2R2C1 production release orchestration.
 
 This module is deliberately scoped to the Owner-approved V2R2C1 binding.  It
 uses the existing TagPublisher and metadata adapters; it does not introduce a
@@ -23,8 +20,6 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Mapping
 
-from trusted_release_execution_plan import PlanError, TrustedReleasePlan
-
 from gitea_tag_publication import (
     GiteaTagClient,
     GitTagBackend,
@@ -411,14 +406,6 @@ class GovernedProductionReleaseExecutor:
             config.remote_name,
             state_root=self.root / "tag-publication",
         )
-        # Release checks must use the same explicitly configured staging baseline
-        # as the Action/model runtime; do not fall back to the publication workspace.
-        self.publisher.baseline_path = Path(
-            os.environ.get("AIOS_GITOPS_BASELINE_AUTHORITY", str(config.baseline_path))
-        )
-        # The immutable runtime package is the source of the version projection;
-        # the mutable state workspace only stores publication state.
-        self.publisher.versions_root = Path(__file__).resolve().parents[1] / "versions"
 
     def _request(self, request: Mapping[str, Any]) -> PublicationRequest:
         binding = self.binding
@@ -559,139 +546,7 @@ def _health(url: str, binding: ReleaseBinding, artifact: Mapping[str, Any]) -> d
     return {"status": "ACTIVE_VERIFIED" if exact else "CONFLICT", "http_status": status, **body}
 
 
-
-class TrustedPlanReleaseExecutor:
-    """Release handler whose identity comes only from an immutable trusted plan.
-
-    The bridge may prepare/read evidence and request tag publication, but it does
-    not perform production side effects.  The privileged approved-release
-    service consumes the same plan and exact Owner approval envelope.
-    """
-
-    def __init__(self, config: Any):
-        self.config = config
-        configured = getattr(config, "release_plan_path", None)
-        self.plan_path = Path(configured) if configured else None
-        self.state_root = Path(config.state_root) / "trusted-release"
-        self.state_root.mkdir(parents=True, exist_ok=True)
-        self._approval: dict[str, Any] | None = None
-        self._tag: dict[str, Any] | None = None
-
-    def _plan(self) -> TrustedReleasePlan:
-        path = self.plan_path
-        if path is None:
-            env_path = os.environ.get("AIOS_RELEASE_PLAN_PATH", "")
-            path = Path(env_path) if env_path else None
-        if path is None:
-            raise ReleaseBlocked("TRUSTED_RELEASE_PLAN_REQUIRED")
-        try:
-            return TrustedReleasePlan.load(path)
-        except PlanError as exc:
-            raise ReleaseBlocked(f"TRUSTED_RELEASE_PLAN_INVALID:{exc}") from exc
-
-    @staticmethod
-    def _binding(plan: TrustedReleasePlan) -> dict[str, Any]:
-        value = plan.value
-        return {
-            "version": value["version"],
-            "target_oid": value["source_commit"],
-            "evidence_closure_oid": value["evidence_closure_oid"],
-            "artifact_sha256": value["artifact_sha256"],
-            "artifact_size": value["artifact"]["size"],
-            "approval_plan_id": value["approval_plan_id"],
-            "candidate_id": value["candidate_id"],
-            "release_plan_sha256": plan.release_plan_sha256,
-        }
-
-    def _request(self, request: Mapping[str, Any]) -> tuple[TrustedReleasePlan, dict[str, Any]]:
-        plan = self._plan()
-        binding = self._binding(plan)
-        for key, expected in binding.items():
-            if key in request and request[key] != expected:
-                raise ManualOwnerReviewRequired("trusted release request binding mismatch:" + key)
-        return plan, binding
-
-    def approval_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        if request.get("execute") is not False:
-            raise ReleaseBlocked("TAG_APPROVAL_REQUEST_MUST_BE_DRY_RUN")
-        plan, binding = self._request(request)
-        approval = request.get("owner_approval")
-        if not isinstance(approval, Mapping) or approval.get("approved") is not True:
-            raise ReleaseBlocked("OWNER_RELEASE_APPROVAL_REQUIRED")
-        for key in ("candidate_id", "release_plan_sha256", "approval_plan_id"):
-            if approval.get(key) != binding[key]:
-                raise ManualOwnerReviewRequired("OWNER_APPROVAL_BINDING_MISMATCH:" + key)
-        record = {"plan": plan.as_dict(), "owner_approval": dict(approval)}
-        digest = hashlib.sha256(canonical(record)).hexdigest()
-        if self._approval is not None and self._approval != record:
-            raise ManualOwnerReviewRequired("OWNER_APPROVAL_REPLAY_CONFLICT")
-        self._approval = record
-        return {"status": "RECORDED", "execute": False, "release_plan_sha256": plan.release_plan_sha256, "approval_digest_sha256": digest}
-
-    def _require_approval(self, plan: TrustedReleasePlan) -> None:
-        if self._approval is None or self._approval.get("plan") != plan.as_dict():
-            raise ReleaseBlocked("OWNER_RELEASE_APPROVAL_NOT_RECORDED")
-
-    def build_artifact(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        plan, _ = self._request(request)
-        artifact = dict(plan.value["artifact"])
-        path = Path(str(artifact["path"]))
-        if path.is_symlink() or not path.is_file() or path.stat().st_size != artifact["size"]:
-            raise ReleaseBlocked("TRUSTED_ARTIFACT_NOT_PRESENT")
-        actual = hashlib.sha256(path.read_bytes()).hexdigest()
-        if actual != plan.value["artifact_sha256"]:
-            raise ReleaseBlocked("TRUSTED_ARTIFACT_DIGEST_MISMATCH")
-        return {"status": "VERIFIED", "version": plan.value["version"], "source_commit": plan.value["source_commit"], "tree_oid": plan.value["tree_oid"], "artifact": str(path), "artifact_size": artifact["size"], "artifact_sha256": actual, "manifest_sha256": plan.value["manifest_sha256"], "package_closure_sha256": plan.value["package_closure_sha256"], "release_plan_sha256": plan.release_plan_sha256}
-
-    def _publisher(self, plan: TrustedReleasePlan) -> TagPublisher:
-        root = self.state_root / plan.value["candidate_id"]
-        root.mkdir(parents=True, exist_ok=True)
-        publisher = TagPublisher(root / "publication-workspace", GitTagBackend(root / "publication-workspace", authoritative_repo=Path(self.config.authoritative_git_dir)), GiteaTagClient(self.config.api_base, "aios/aios", Path(self.config.token_path)), self.config.remote_name, state_root=root / "tag-publication")
-        publisher.baseline_path = Path(os.environ.get("AIOS_GITOPS_BASELINE_AUTHORITY", str(self.config.baseline_path)))
-        publisher.versions_root = Path(__file__).resolve().parents[1] / "versions"
-        return publisher
-
-    def publish_tag(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        if request.get("execute") is not True:
-            raise ReleaseBlocked("TAG_PUBLICATION_REQUIRES_EXECUTE_TRUE")
-        plan, _ = self._request(request)
-        self._require_approval(plan)
-        publication = PublicationRequest(plan.value["version"], plan.value["source_commit"], plan.value["evidence_closure_oid"], plan.value["approval_plan_id"])
-        try:
-            result = self._publisher(plan)._verify_publication(publication, allow_push=True, previously_deployed=False)
-        except (PublicationManualOwnerReviewRequired, PublicationPending, PublicationReconciliationRequired) as exc:
-            raise ReconciliationRequired(str(exc)) from exc
-        self._tag = dict(result)
-        return {"status": "REMOTE_VERIFIED", **result, "release_plan_sha256": plan.release_plan_sha256}
-
-    def tag_status(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        plan, _ = self._request(request)
-        return self._publisher(plan).get_tag_publication_status(plan.value["version"])
-
-    def execute_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        plan, _ = self._request(request)
-        self._require_approval(plan)
-        raise ReleaseBlocked("PRODUCTION_EXECUTION_REQUIRES_APPROVED_RELEASE_EXECUTOR")
-
-    def consistency(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        plan, binding = self._request(request)
-        result = {"status": "PASS", "release_binding": binding, "trusted_plan": plan.as_dict(), "production_mutation": False}
-        result["baseline"] = _read_json(Path(self.config.baseline_path))
-        result["registry"] = _read_json(Path(self.config.registry_root) / f"{plan.value['version']}.json")
-        return result
-
-    def acceptance(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        result = self.consistency(request)
-        result["accepted"] = result["status"] == "PASS"
-        return result
-
-
-def build_executor_config(config: Any) -> Any:
-    """Select legacy compatibility only when no trusted new-release plan exists."""
-    plan_path = getattr(config, "release_plan_path", None) or os.environ.get("AIOS_RELEASE_PLAN_PATH", "")
-    target_version = getattr(config, "target_version", "")
-    if plan_path or target_version != VERSION:
-        return TrustedPlanReleaseExecutor(config)
+def build_executor_config(config: Any) -> GovernedProductionReleaseExecutor:
     return GovernedProductionReleaseExecutor(config)
 
 

active-runtime/app/governed_tag_adapter.py

@@ -34,8 +34,6 @@ from gitea_tag_publication import (
     TagPublisher,
 )
 
-from release_version import validate_release_version
-
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
 
@@ -46,10 +44,8 @@ def load_request() -> dict[str, Any]:
         raise ValueError("request_object_required")
     if value.get("schema") != "aios.production-executor-request.v1":
         raise ValueError("request_schema_invalid")
-    try:
-        validate_release_version(value.get("version", ""))
-    except ValueError as exc:
-        raise ValueError("version_invalid") from exc
+    if not re.fullmatch(r"V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?", str(value.get("version", ""))):
+        raise ValueError("version_invalid")
     for name in ("target_oid", "evidence_closure_oid"):
         if not OID_RE.fullmatch(str(value.get(name, ""))):
             raise ValueError(f"{name}_invalid")

active-runtime/app/message_handoff.py

@@ -0,0 +1,413 @@
+from __future__ import annotations
+
+import dataclasses
+import datetime as dt
+import hashlib
+import json
+import sqlite3
+from pathlib import Path
+from typing import Any, Iterable, Mapping
+
+UTC = dt.timezone.utc
+_ALLOWED_CONFIDENTIALITY = frozenset({"public", "tenant", "project", "private", "run"})
+_PRIVILEGED = frozenset({"*", "admin", "system.admin", "message.admin", "task.admin"})
+
+
+class HandoffError(RuntimeError):
+    code = "HANDOFF_ERROR"
+
+
+class MessageScopeMismatch(HandoffError):
+    code = "MESSAGE_SCOPE_MISMATCH_DENY"
+
+
+class ConfidentialityScopeDenied(HandoffError):
+    code = "MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"
+
+
+class MessageExpired(HandoffError):
+    code = "MESSAGE_EXPIRED"
+
+
+class SequenceGap(HandoffError):
+    code = "MESSAGE_SEQUENCE_GAP_DETECT"
+
+
+class SequenceConflict(HandoffError):
+    code = "MESSAGE_SEQUENCE_CONFLICT"
+
+
+class IdempotencyConflict(HandoffError):
+    code = "MESSAGE_IDEMPOTENCY_CONFLICT"
+
+
+def _utcnow() -> dt.datetime:
+    return dt.datetime.now(UTC)
+
+
+def _iso(value: dt.datetime | str | None) -> str | None:
+    if value is None:
+        return None
+    parsed = dt.datetime.fromisoformat(value.replace("Z", "+00:00")) if isinstance(value, str) else value
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=UTC)
+    return parsed.astimezone(UTC).isoformat()
+
+
+def _canonical(value: Any) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str)
+
+
+def _sha(value: Any) -> str:
+    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
+
+
+def _clean(value: Any) -> str | None:
+    if value is None:
+        return None
+    text = str(value).strip()
+    return text or None
+
+
+def _tuple_scope(value: Iterable[str] | str | None) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if isinstance(value, str):
+        value = value.split(",")
+    return tuple(sorted({str(item).strip() for item in value if str(item).strip()}))
+
+
+@dataclasses.dataclass(frozen=True)
+class DeliveryContext:
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
+    capabilities: tuple[str, ...] = ()
+
+    @classmethod
+    def from_actor(cls, actor: Any) -> "DeliveryContext":
+        def get(name: str) -> Any:
+            if isinstance(actor, Mapping):
+                return actor.get(name)
+            return getattr(actor, name, None)
+        return cls(
+            tenant_id=_clean(get("tenant_id")),
+            user_id=_clean(get("user_id")),
+            project_id=_clean(get("project_id")),
+            conversation_id=_clean(get("conversation_id")),
+            run_id=_clean(get("run_id")),
+            capabilities=_tuple_scope(get("capabilities") or get("capability_scope")),
+        )
+
+    @property
+    def privileged(self) -> bool:
+        return bool(set(self.capabilities) & _PRIVILEGED)
+
+
+@dataclasses.dataclass(frozen=True)
+class MessageEnvelope:
+    source: str
+    target: str
+    message_type: str
+    payload: Mapping[str, Any]
+    sequence: int
+    idempotency_key: str
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    task_id: str | None = None
+    run_id: str | None = None
+    causation_id: str | None = None
+    capability_scope: tuple[str, ...] = ()
+    confidentiality_scope: str = "private"
+    expires_at: str | None = None
+    created_at: str = dataclasses.field(default_factory=lambda: _iso(_utcnow()) or "")
+    envelope_id: str = ""
+
+    def __post_init__(self) -> None:
+        for field in ("source", "target", "message_type", "idempotency_key", "tenant_id", "user_id",
+                      "project_id", "conversation_id", "task_id", "run_id", "causation_id"):
+            object.__setattr__(self, field, _clean(getattr(self, field)) if field not in {
+                "source", "target", "message_type", "idempotency_key"
+            } else (_clean(getattr(self, field)) or ""))
+        object.__setattr__(self, "capability_scope", _tuple_scope(self.capability_scope))
+        object.__setattr__(self, "confidentiality_scope", (_clean(self.confidentiality_scope) or "private").lower())
+        object.__setattr__(self, "expires_at", _iso(self.expires_at))
+        object.__setattr__(self, "created_at", _iso(self.created_at) or "")
+        if not self.source or not self.target or not self.message_type or not self.idempotency_key:
+            raise ValueError("MESSAGE_ENVELOPE_IDENTITY_REQUIRED")
+        if not isinstance(self.sequence, int) or self.sequence < 1:
+            raise ValueError("MESSAGE_SEQUENCE_MUST_BE_POSITIVE")
+        if self.confidentiality_scope not in _ALLOWED_CONFIDENTIALITY:
+            raise ValueError("MESSAGE_CONFIDENTIALITY_SCOPE_INVALID")
+        if self.confidentiality_scope != "public" and self.tenant_id is None:
+            raise ValueError("MESSAGE_TENANT_REQUIRED")
+        if self.confidentiality_scope in {"project", "private", "run"} and self.project_id is None:
+            raise ValueError("MESSAGE_PROJECT_REQUIRED")
+        if self.confidentiality_scope in {"private", "run"} and self.user_id is None:
+            raise ValueError("MESSAGE_USER_REQUIRED")
+        if self.confidentiality_scope == "run" and self.run_id is None:
+            raise ValueError("MESSAGE_RUN_REQUIRED")
+        expected = stable_event_id(
+            source=self.source, target=self.target, message_type=self.message_type, payload=self.payload,
+            tenant_id=self.tenant_id, user_id=self.user_id, project_id=self.project_id,
+            conversation_id=self.conversation_id, task_id=self.task_id, run_id=self.run_id,
+            causation_id=self.causation_id, sequence=self.sequence, idempotency_key=self.idempotency_key,
+        )
+        if self.envelope_id and self.envelope_id != expected:
+            raise ValueError("MESSAGE_ENVELOPE_ID_MISMATCH")
+        object.__setattr__(self, "envelope_id", expected)
+
+    @property
+    def payload_sha256(self) -> str:
+        return _sha(self.payload)
+
+    @property
+    def stream_key(self) -> str:
+        return _sha({
+            "tenant_id": self.tenant_id, "source": self.source, "target": self.target,
+            "conversation_id": self.conversation_id, "task_id": self.task_id, "run_id": self.run_id,
+        })
+
+    def is_expired(self, *, now: dt.datetime | None = None) -> bool:
+        if self.expires_at is None:
+            return False
+        return dt.datetime.fromisoformat(self.expires_at) <= (now or _utcnow()).astimezone(UTC)
+
+    def as_record(self) -> dict[str, Any]:
+        return {
+            "envelope_id": self.envelope_id, "stream_key": self.stream_key, "source": self.source,
+            "target": self.target, "message_type": self.message_type, "payload_json": _canonical(self.payload),
+            "payload_sha256": self.payload_sha256, "tenant_id": self.tenant_id, "user_id": self.user_id,
+            "project_id": self.project_id, "conversation_id": self.conversation_id, "task_id": self.task_id,
+            "run_id": self.run_id, "causation_id": self.causation_id, "sequence": self.sequence,
+            "capability_scope_json": _canonical(self.capability_scope),
+            "confidentiality_scope": self.confidentiality_scope, "idempotency_key": self.idempotency_key,
+            "expires_at": self.expires_at, "created_at": self.created_at,
+        }
+
+
+def stable_event_id(*, source: Any, target: Any, message_type: Any, payload: Any,
+                    tenant_id: Any = None, user_id: Any = None, project_id: Any = None,
+                    conversation_id: Any = None, task_id: Any = None, run_id: Any = None,
+                    causation_id: Any = None, sequence: Any = None, idempotency_key: Any = None) -> str:
+    return _sha({
+        "source": _clean(source), "target": _clean(target), "message_type": _clean(message_type),
+        "payload_sha256": _sha(payload), "tenant_id": _clean(tenant_id), "user_id": _clean(user_id),
+        "project_id": _clean(project_id), "conversation_id": _clean(conversation_id),
+        "task_id": _clean(task_id), "run_id": _clean(run_id), "causation_id": _clean(causation_id),
+        "sequence": sequence, "idempotency_key": _clean(idempotency_key),
+    })
+
+
+def bind_envelope_scope(envelope: MessageEnvelope, actor: Any) -> MessageEnvelope:
+    ctx = DeliveryContext.from_actor(actor)
+    if ctx.privileged:
+        return envelope
+    if ctx.tenant_id is None:
+        if envelope.tenant_id is not None:
+            raise MessageScopeMismatch(MessageScopeMismatch.code)
+        return envelope
+    updates: dict[str, Any] = {}
+    for field in ("tenant_id", "user_id", "project_id", "conversation_id", "run_id"):
+        trusted = getattr(ctx, field)
+        requested = getattr(envelope, field)
+        if requested is not None and requested != trusted:
+            raise MessageScopeMismatch(f"{MessageScopeMismatch.code}:{field}")
+        if requested is None and trusted is not None:
+            updates[field] = trusted
+    if not updates:
+        return envelope
+    data = dataclasses.asdict(envelope)
+    data.update(updates)
+    data["envelope_id"] = ""
+    return MessageEnvelope(**data)
+
+
+def authorize_delivery(actor: Any, envelope: MessageEnvelope) -> None:
+    ctx = DeliveryContext.from_actor(actor)
+    if ctx.privileged:
+        return
+    if not set(envelope.capability_scope).issubset(set(ctx.capabilities)):
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:capability")
+    if envelope.confidentiality_scope == "public":
+        return
+    if ctx.tenant_id != envelope.tenant_id:
+        raise MessageScopeMismatch(f"{MessageScopeMismatch.code}:tenant_id")
+    if envelope.confidentiality_scope in {"project", "private", "run"} and ctx.project_id != envelope.project_id:
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:project_id")
+    if envelope.confidentiality_scope in {"private", "run"} and ctx.user_id != envelope.user_id:
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:user_id")
+    if envelope.confidentiality_scope == "run" and ctx.run_id != envelope.run_id:
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:run_id")
+
+
+_SCHEMA = """
+CREATE TABLE IF NOT EXISTS message_handoff (
+  envelope_id TEXT PRIMARY KEY,
+  stream_key TEXT NOT NULL,
+  source TEXT NOT NULL,
+  target TEXT NOT NULL,
+  message_type TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  payload_sha256 TEXT NOT NULL,
+  tenant_id TEXT,
+  user_id TEXT,
+  project_id TEXT,
+  conversation_id TEXT,
+  task_id TEXT,
+  run_id TEXT,
+  causation_id TEXT,
+  sequence INTEGER NOT NULL CHECK(sequence >= 1),
+  capability_scope_json TEXT NOT NULL,
+  confidentiality_scope TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  expires_at TEXT,
+  created_at TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'PENDING',
+  delivered_at TEXT,
+  acked_at TEXT,
+  UNIQUE(stream_key, idempotency_key),
+  UNIQUE(stream_key, sequence)
+);
+CREATE INDEX IF NOT EXISTS idx_message_handoff_target_status
+  ON message_handoff(target, status, created_at);
+CREATE INDEX IF NOT EXISTS idx_message_handoff_scope
+  ON message_handoff(tenant_id, project_id, user_id, conversation_id, run_id);
+"""
+
+
+class DurableHandoffStore:
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        with self._connect() as conn:
+            conn.executescript(_SCHEMA)
+
+    def _connect(self) -> sqlite3.Connection:
+        conn = sqlite3.connect(self.path, timeout=30.0)
+        conn.row_factory = sqlite3.Row
+        conn.execute("PRAGMA foreign_keys=ON")
+        conn.execute("PRAGMA busy_timeout=30000")
+        return conn
+
+    @staticmethod
+    def _from_row(row: sqlite3.Row) -> MessageEnvelope:
+        return MessageEnvelope(
+            source=row["source"], target=row["target"], message_type=row["message_type"],
+            payload=json.loads(row["payload_json"]), tenant_id=row["tenant_id"], user_id=row["user_id"],
+            project_id=row["project_id"], conversation_id=row["conversation_id"], task_id=row["task_id"],
+            run_id=row["run_id"], causation_id=row["causation_id"], sequence=int(row["sequence"]),
+            capability_scope=tuple(json.loads(row["capability_scope_json"])),
+            confidentiality_scope=row["confidentiality_scope"], idempotency_key=row["idempotency_key"],
+            expires_at=row["expires_at"], created_at=row["created_at"], envelope_id=row["envelope_id"],
+        )
+
+    def put(self, envelope: MessageEnvelope) -> tuple[str, MessageEnvelope]:
+        if envelope.is_expired():
+            raise MessageExpired(MessageExpired.code)
+        record = envelope.as_record()
+        with self._connect() as conn:
+            conn.execute("BEGIN IMMEDIATE")
+            replay = conn.execute(
+                "SELECT * FROM message_handoff WHERE stream_key=? AND idempotency_key=?",
+                (envelope.stream_key, envelope.idempotency_key),
+            ).fetchone()
+            if replay is not None:
+                existing = self._from_row(replay)
+                if existing.envelope_id != envelope.envelope_id or existing.payload_sha256 != envelope.payload_sha256:
+                    raise IdempotencyConflict(IdempotencyConflict.code)
+                conn.commit()
+                return "REPLAY", existing
+            seq = conn.execute(
+                "SELECT * FROM message_handoff WHERE stream_key=? AND sequence=?",
+                (envelope.stream_key, envelope.sequence),
+            ).fetchone()
+            if seq is not None:
+                existing = self._from_row(seq)
+                if existing.envelope_id == envelope.envelope_id:
+                    conn.commit()
+                    return "REPLAY", existing
+                raise SequenceConflict(SequenceConflict.code)
+            maximum = int(conn.execute(
+                "SELECT COALESCE(MAX(sequence),0) FROM message_handoff WHERE stream_key=?",
+                (envelope.stream_key,),
+            ).fetchone()[0])
+            expected = maximum + 1
+            if envelope.sequence != expected:
+                raise SequenceGap(f"{SequenceGap.code}:expected={expected}:actual={envelope.sequence}")
+            columns = tuple(record)
+            placeholders = ",".join("?" for _ in columns)
+            conn.execute(
+                f"INSERT INTO message_handoff ({','.join(columns)}) VALUES ({placeholders})",
+                tuple(record[column] for column in columns),
+            )
+            conn.commit()
+            return "CREATED", envelope
+
+    def get(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
+        with self._connect() as conn:
+            row = conn.execute("SELECT * FROM message_handoff WHERE envelope_id=?", (envelope_id,)).fetchone()
+            if row is None:
+                raise KeyError(envelope_id)
+            envelope = self._from_row(row)
+            if envelope.is_expired():
+                conn.execute("UPDATE message_handoff SET status='EXPIRED' WHERE envelope_id=?", (envelope_id,))
+                conn.commit()
+                raise MessageExpired(MessageExpired.code)
+            authorize_delivery(actor, envelope)
+            return envelope
+
+    def pending(self, *, target: str, actor: Any, limit: int = 100) -> list[MessageEnvelope]:
+        if not 1 <= limit <= 1000:
+            raise ValueError("MESSAGE_PENDING_LIMIT_INVALID")
+        visible: list[MessageEnvelope] = []
+        with self._connect() as conn:
+            rows = conn.execute(
+                "SELECT * FROM message_handoff WHERE target=? AND status='PENDING' ORDER BY created_at, sequence LIMIT ?",
+                (target, limit),
+            ).fetchall()
+            for row in rows:
+                envelope = self._from_row(row)
+                if envelope.is_expired():
+                    conn.execute("UPDATE message_handoff SET status='EXPIRED' WHERE envelope_id=?", (envelope.envelope_id,))
+                    continue
+                try:
+                    authorize_delivery(actor, envelope)
+                except HandoffError:
+                    continue
+                visible.append(envelope)
+            conn.commit()
+        return visible
+
+    def mark_delivered(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
+        envelope = self.get(envelope_id, actor=actor)
+        with self._connect() as conn:
+            conn.execute(
+                "UPDATE message_handoff SET status='DELIVERED', delivered_at=? "
+                "WHERE envelope_id=? AND status='PENDING'",
+                (_iso(_utcnow()), envelope_id),
+            )
+            conn.commit()
+        return envelope
+
+    def acknowledge(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
+        envelope = self.get(envelope_id, actor=actor)
+        with self._connect() as conn:
+            conn.execute(
+                "UPDATE message_handoff SET status='ACKED', acked_at=? WHERE envelope_id=?",
+                (_iso(_utcnow()), envelope_id),
+            )
+            conn.commit()
+        return envelope
+
+
+class HandoffFabric:
+    def __init__(self, store: DurableHandoffStore) -> None:
+        self.store = store
+
+    def publish(self, envelope: MessageEnvelope, *, actor: Any | None = None) -> tuple[str, MessageEnvelope]:
+        return self.store.put(bind_envelope_scope(envelope, actor) if actor is not None else envelope)

active-runtime/app/message_handoff_adapters.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+from message_handoff import MessageEnvelope
+
+
+def _get(value: Any, *names: str, default: Any = None) -> Any:
+    for name in names:
+        if isinstance(value, Mapping) and name in value:
+            return value[name]
+        if hasattr(value, name):
+            return getattr(value, name)
+    return default
+
+
+def agent_event_to_envelope(event: Any, *, target: str | None = None, sequence: int = 1,
+                            idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
+    payload = _get(event, "payload", "data", default={}) or {}
+    target = target or _get(event, "target", "recipient")
+    if not target:
+        raise ValueError("MESSAGE_TARGET_REQUIRED")
+    return MessageEnvelope(
+        source=str(_get(event, "source", "producer", "agent_id", default="agent-event")),
+        target=str(target),
+        message_type=str(_get(event, "event_type", "type", "message_type", default="agent.event")),
+        payload=dict(payload),
+        sequence=sequence,
+        idempotency_key=idempotency_key or str(_get(event, "id", "event_id", default="")) or f"agent-event:{sequence}",
+        causation_id=_get(event, "causation_id"),
+        **scope,
+    )
+
+
+def taskplane_event_to_envelope(event: Any, *, target: str, sequence: int = 1,
+                                idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
+    data = _get(event, "data", "payload", default={}) or {}
+    event_id = str(_get(event, "id", "event_id", default=""))
+    return MessageEnvelope(
+        source=str(_get(event, "source", default="task-plane")),
+        target=target,
+        message_type=str(_get(event, "type", "event_type", default="task.event")),
+        payload=dict(data),
+        sequence=sequence,
+        idempotency_key=idempotency_key or event_id or f"task-event:{sequence}",
+        causation_id=event_id or None,
+        **scope,
+    )
+
+
+def legacy_message_to_envelope(message: Any, *, target: str | None = None, sequence: int = 1,
+                               idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
+    payload = _get(message, "payload", "data", "body", "content", default={})
+    if not isinstance(payload, Mapping):
+        payload = {"value": payload}
+    target = target or _get(message, "target", "recipient", "receiver")
+    if not target:
+        raise ValueError("MESSAGE_TARGET_REQUIRED")
+    source = _get(message, "source", "sender", "agent_id", default="legacy-message-bus")
+    kind = _get(message, "message_type", "type", "kind", default="legacy.message")
+    identifier = _get(message, "id", "message_id", "event_id")
+    return MessageEnvelope(
+        source=str(source), target=str(target), message_type=str(kind), payload=dict(payload),
+        sequence=sequence,
+        idempotency_key=idempotency_key or (str(identifier) if identifier else f"legacy:{sequence}"),
+        causation_id=str(identifier) if identifier else None,
+        **scope,
+    )

active-runtime/app/release_metadata_adapter.py

@@ -27,8 +27,6 @@ import urllib.request
 from pathlib import Path
 from typing import Any, Mapping
 
-from release_version import validate_release_version
-
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA_RE = re.compile(r"^[0-9a-f]{64}$")
 PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
@@ -88,10 +86,8 @@ def load_request() -> dict[str, Any]:
         raise ValueError("request_schema_invalid")
     if value.get("repository_identity") != "aios/aios":
         raise ValueError("repository_identity_invalid")
-    try:
-        validate_release_version(value.get("version", ""))
-    except ValueError as exc:
-        raise ValueError("version_invalid") from exc
+    if not re.fullmatch(r"V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?", str(value.get("version", ""))):
+        raise ValueError("version_invalid")
     for name in ("target_oid", "evidence_closure_oid"):
         if not OID_RE.fullmatch(str(value.get(name, ""))):
             raise ValueError(f"{name}_invalid")

active-runtime/app/silent_release_controller.py

@@ -22,12 +22,11 @@ from enum import Enum
 from pathlib import Path
 from typing import Any, Protocol
 
-from release_version import validate_release_version
-
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
 CANDIDATE_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]{2,127}$")
+VERSION_RE = re.compile(r"^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$")
 SECRET_PATTERNS = (
     re.compile(r"(?i)(authorization\s*[:=]\s*)(?:bearer|token)\s+\S+"),
     re.compile(r"(?i)((?:access_)?token\s*[:=]\s*)\S+"),
@@ -770,10 +769,8 @@ class TagApprovalEnvelope:
     def validate(self) -> None:
         if self.action != "production_tag":
             raise ApprovalError("approval does not authorize production tag")
-        try:
-            validate_release_version(self.version)
-        except ValueError as exc:
-            raise ApprovalError("invalid release version") from exc
+        if not VERSION_RE.fullmatch(self.version):
+            raise ApprovalError("invalid release version")
         _validate_oid("tag_oid", self.tag_oid)
         _validate_oid("target_oid", self.target_oid)
         if _parse_utc(self.expires_at) <= datetime.now(timezone.utc):

active-runtime/app/silent_release_hardening.py

@@ -9,7 +9,6 @@ from __future__ import annotations
 
 import base64
 import hashlib
-import hmac
 import json
 import os
 import re
@@ -41,8 +40,6 @@ from silent_release_controller import (
 
 IDENTIFIER_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.:-]{2,255}$")
 NONCE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.:-]{15,255}$")
-BUILDER_ATTESTATION_TRUST_DOMAIN = "aios.trusted-builder.attestation.v1"
-BUILDER_ATTESTATION_PURPOSE = "AIOS_TRUSTED_RELEASE_BUILDER"
 ALLOWED_CAPABILITIES = frozenset(
     {
         "runtime_switch",
@@ -65,10 +62,6 @@ class CapabilityAuthorizationError(RuntimeError):
     """The signed plan cannot authorize the requested operation."""
 
 
-class TrustedCandidateBuilderUnavailable(RuntimeError):
-    """The purpose-bound builder dependency cannot currently serve a build."""
-
-
 class StaleApprovalError(CapabilityAuthorizationError):
     """Live release evidence no longer matches the signed approval."""
 
@@ -229,10 +222,6 @@ JOURNAL_GENESIS_HASH = "0" * 64
 
 
 def _fsync_directory(path: Path) -> None:
-    if os.name == "nt":
-        # Windows does not permit opening a directory with os.open.  Durable
-        # Linux host execution retains the directory fsync below.
-        return
     descriptor = os.open(Path(path), os.O_RDONLY)
     try:
         os.fsync(descriptor)
@@ -726,14 +715,6 @@ class BuilderAttestation:
     canary_evidence_sha256: str
     issued_at: str
     signature: str
-    trust_domain: str = BUILDER_ATTESTATION_TRUST_DOMAIN
-    builder_key_generation: int | None = None
-    signature_algorithm: str | None = None
-    signature_purpose: str | None = None
-    gitea_evidence_sha256: str = ""
-    rollback_evidence_sha256: str = ""
-    policy_evidence_sha256: str = ""
-    secret_scan_evidence_sha256: str = ""
 
     def __post_init__(self) -> None:
         _validate_identifier(
@@ -750,35 +731,7 @@ class BuilderAttestation:
             "canary_evidence_sha256",
         ):
             _validate_sha(name, getattr(self, name))
-        for name in (
-            "gitea_evidence_sha256",
-            "rollback_evidence_sha256",
-            "policy_evidence_sha256",
-            "secret_scan_evidence_sha256",
-        ):
-            if getattr(self, name):
-                _validate_sha(name, getattr(self, name))
         _parse_utc(self.issued_at)
-        if self.trust_domain != BUILDER_ATTESTATION_TRUST_DOMAIN:
-            raise CapabilityAuthorizationError(
-                "builder attestation trust domain is invalid"
-            )
-        metadata = (
-            self.builder_key_generation,
-            self.signature_algorithm,
-            self.signature_purpose,
-        )
-        if any(value is not None for value in metadata):
-            if (
-                not isinstance(self.builder_key_generation, int)
-                or isinstance(self.builder_key_generation, bool)
-                or self.builder_key_generation < 0
-                or self.signature_algorithm != "Ed25519"
-                or self.signature_purpose != BUILDER_ATTESTATION_PURPOSE
-            ):
-                raise CapabilityAuthorizationError(
-                    "builder attestation signing metadata is invalid"
-                )
 
     @property
     def canonical_payload(self) -> dict[str, Any]:
@@ -801,290 +754,20 @@ class BuilderAttestation:
         }
 
     @classmethod
-    def from_dict(
-        cls,
-        payload: Mapping[str, Any],
-        *,
-        require_fingerprint: bool = False,
-    ) -> "BuilderAttestation":
+    def from_dict(cls, payload: Mapping[str, Any]) -> "BuilderAttestation":
         values = dict(payload)
-        supplied_fingerprint = values.pop("fingerprint", None)
-        # Older local records did not spell out the domain.  They are only
-        # usable when re-signed by the current builder; their original
-        # signatures cannot validate against this domain-separated payload.
-        values.setdefault("trust_domain", BUILDER_ATTESTATION_TRUST_DOMAIN)
-        value = cls(**values)
-        if supplied_fingerprint is None:
-            if require_fingerprint:
-                raise CapabilityAuthorizationError(
-                    "builder attestation digest is required"
-                )
-            return value
-        expected = _validate_sha(
-            "builder attestation digest", str(supplied_fingerprint)
-        )
-        if not hmac.compare_digest(expected, value.fingerprint):
-            raise CapabilityAuthorizationError(
-                "builder attestation digest is invalid"
-            )
-        return value
-
-
-@dataclass(frozen=True)
-class BuilderAttestationKeyRecord:
-    """One purpose-bound public verification key from the host keyring."""
-
-    key_id: str
-    public_key: bytes
-    algorithm: str
-    purpose: str
-    generation: int
-    not_before: str
-    expires_at: str
-    status: str
-
-    def __post_init__(self) -> None:
-        _validate_identifier("builder_key_id", self.key_id)
-        if self.algorithm != "Ed25519":
-            raise ValueError("unsupported builder signature algorithm")
-        if self.purpose != BUILDER_ATTESTATION_PURPOSE:
-            raise ValueError("builder key purpose is invalid")
-        if not isinstance(self.generation, int) or isinstance(
-            self.generation, bool
-        ) or self.generation < 0:
-            raise ValueError("builder key generation is invalid")
-        if self.status not in {"ACTIVE", "REVOKED"}:
-            raise ValueError("builder key status is invalid")
-        if len(self.public_key) != 32:
-            raise ValueError("Ed25519 public key must contain 32 bytes")
-        Ed25519PublicKey.from_public_bytes(self.public_key)
-        if _parse_utc(self.not_before) >= _parse_utc(self.expires_at):
-            raise ValueError("builder key validity window is invalid")
-
-    @property
-    def public_key_sha256(self) -> str:
-        return hashlib.sha256(self.public_key).hexdigest()
-
-    def validate_at(self, instant: datetime) -> None:
-        if self.status != "ACTIVE":
-            raise CapabilityAuthorizationError(
-                "builder attestation key is unavailable or revoked"
-            )
-        if instant.tzinfo is None:
-            raise CapabilityAuthorizationError(
-                "builder attestation verification time is invalid"
-            )
-        if not _parse_utc(self.not_before) <= instant <= _parse_utc(
-            self.expires_at
-        ):
-            raise CapabilityAuthorizationError(
-                "builder attestation key is outside its validity window"
-            )
-
-    @classmethod
-    def from_dict(
-        cls, payload: Mapping[str, Any]
-    ) -> "BuilderAttestationKeyRecord":
-        values = dict(payload)
-        encoded = values.pop("public_key", values.pop("public_key_b64", None))
-        if not isinstance(encoded, str):
-            raise ValueError("builder public key is missing")
-        try:
-            public_key = base64.b64decode(encoded, validate=True)
-        except (TypeError, ValueError) as exc:
-            raise ValueError("builder public key encoding is invalid") from exc
-        supplied_digest = values.pop(
-            "public_key_sha256",
-            values.pop("key_sha256", values.pop("digest", None)),
-        )
-        if not isinstance(supplied_digest, str):
-            raise ValueError("builder public key digest is missing")
-        digest = _validate_sha("builder public key digest", supplied_digest)
-        if not hmac.compare_digest(
-            digest, hashlib.sha256(public_key).hexdigest()
-        ):
-            raise ValueError("builder public key digest is invalid")
-        allowed = {
-            "algorithm",
-            "purpose",
-            "key_id",
-            "generation",
-            "not_before",
-            "expires_at",
-            "status",
-        }
-        unknown = set(values).difference(allowed)
-        if unknown:
-            raise ValueError("builder key record contains unknown fields")
-        return cls(public_key=public_key, **values)
-
-
-class BuilderAttestationKeyRing:
-    """Validated, public-only keyring for builder attestations.
-
-    The file format deliberately cannot carry Owner approval keys: both the
-    keyring and every record must declare the builder-attestation purpose.
-    """
-
-    def __init__(
-        self,
-        records: Iterable[BuilderAttestationKeyRecord],
-        *,
-        require_attestation_metadata: bool = False,
-    ):
-        self._records: dict[str, BuilderAttestationKeyRecord] = {}
-        self._require_attestation_metadata = require_attestation_metadata
-        for record in records:
-            if record.key_id in self._records:
-                raise ValueError("duplicate builder key id")
-            self._records[record.key_id] = record
-
-    @classmethod
-    def from_public_keys(
-        cls, public_keys: Mapping[str, bytes]
-    ) -> "BuilderAttestationKeyRing":
-        """Compatibility adapter for explicit in-process builder key maps.
-
-        This is intentionally not used for host configuration; host keyrings
-        must use :meth:`from_file` so purpose, digest, validity and status are
-        checked before the API accepts traffic.
-        """
-        return cls(
-            BuilderAttestationKeyRecord(
-                key_id=_validate_identifier("builder_key_id", key_id),
-                public_key=bytes(public_key),
-                algorithm="Ed25519",
-                purpose=BUILDER_ATTESTATION_PURPOSE,
-                generation=0,
-                not_before="1970-01-01T00:00:00Z",
-                expires_at="9999-12-31T23:59:59Z",
-                status="ACTIVE",
-            )
-            for key_id, public_key in public_keys.items()
-        )
-
-    @classmethod
-    def from_file(cls, path: Path) -> "BuilderAttestationKeyRing":
-        payload = json.loads(Path(path).read_text(encoding="utf-8"))
-        if payload.get("algorithm") != "Ed25519":
-            raise ValueError("unsupported builder keyring algorithm")
-        if payload.get("purpose") != BUILDER_ATTESTATION_PURPOSE:
-            raise ValueError("builder keyring purpose is invalid")
-        raw_records = payload.get("keys")
-        if not isinstance(raw_records, list) or not raw_records:
-            raise ValueError("builder keyring keys are invalid")
-        allowed = {"algorithm", "purpose", "keys", "keyring_sha256"}
-        if set(payload).difference(allowed):
-            raise ValueError("builder keyring contains unknown fields")
-        if "keyring_sha256" not in payload:
-            raise ValueError("builder keyring digest is missing")
-        expected = _validate_sha(
-            "builder keyring digest", str(payload["keyring_sha256"])
-        )
-        canonical = _canonical_json(
-            {
-                "algorithm": payload["algorithm"],
-                "purpose": payload["purpose"],
-                "keys": raw_records,
-            }
-        )
-        if not hmac.compare_digest(
-            expected, hashlib.sha256(canonical).hexdigest()
-        ):
-            raise ValueError("builder keyring digest is invalid")
-        if not all(isinstance(record, Mapping) for record in raw_records):
-            raise ValueError("builder keyring record is invalid")
-        return cls(
-            (
-                BuilderAttestationKeyRecord.from_dict(record)
-                for record in raw_records
-            ),
-            require_attestation_metadata=True,
-        )
-
-    def verify(
-        self,
-        key_id: str,
-        signature: bytes,
-        message: bytes,
-        *,
-        at: datetime,
-        generation: int | None,
-        algorithm: str | None,
-        purpose: str | None,
-    ) -> BuilderAttestationKeyRecord:
-        record = self._records.get(key_id)
-        if record is None:
-            raise CapabilityAuthorizationError(
-                "builder attestation key is not trusted"
-            )
-        record.validate_at(at)
-        metadata = (generation, algorithm, purpose)
-        if self._require_attestation_metadata and any(
-            value is None for value in metadata
-        ):
-            raise CapabilityAuthorizationError(
-                "builder attestation signing metadata is required"
-            )
-        if any(value is not None for value in metadata) and metadata != (
-            record.generation,
-            record.algorithm,
-            record.purpose,
-        ):
-            raise CapabilityAuthorizationError(
-                "builder attestation signing metadata does not match key"
-            )
-        try:
-            Ed25519PublicKey.from_public_bytes(record.public_key).verify(
-                signature, message
-            )
-        except InvalidSignature as exc:
-            raise CapabilityAuthorizationError(
-                "builder attestation signature is invalid"
-            ) from exc
-        return record
-
-    def require_active_identity(
-        self,
-        *,
-        key_id: str,
-        generation: int,
-        algorithm: str,
-        purpose: str,
-        at: datetime | None = None,
-    ) -> BuilderAttestationKeyRecord:
-        record = self._records.get(key_id)
-        if record is None:
-            raise CapabilityAuthorizationError(
-                "builder attestation key is not trusted"
-            )
-        if (
-            record.generation != generation
-            or record.algorithm != algorithm
-            or record.purpose != purpose
-        ):
-            raise CapabilityAuthorizationError(
-                "builder attestation key metadata is invalid"
-            )
-        record.validate_at(at or datetime.now(timezone.utc))
-        return record
+        values.pop("fingerprint", None)
+        return cls(**values)
 
 
 class BuilderAttestationVerifier:
     """Public-key-only verifier; no builder private material is accepted."""
 
-    def __init__(
-        self,
-        public_keys: BuilderAttestationKeyRing | Mapping[str, bytes],
-    ):
-        if isinstance(public_keys, BuilderAttestationKeyRing):
-            self.keyring = public_keys
-        elif isinstance(public_keys, Mapping):
-            self.keyring = BuilderAttestationKeyRing.from_public_keys(
-                public_keys
-            )
-        else:
-            raise TypeError("builder verifier requires a builder keyring")
+    def __init__(self, public_keys: Mapping[str, bytes]):
+        self.public_keys = {
+            _validate_identifier("builder_key_id", key_id): bytes(value)
+            for key_id, value in public_keys.items()
+        }
 
     def verify(
         self,
@@ -1110,54 +793,22 @@ class BuilderAttestationVerifier:
             raise CapabilityAuthorizationError(
                 "builder attestation does not bind candidate evidence"
             )
+        key = self.public_keys.get(attestation.builder_key_id)
+        if key is None:
+            raise CapabilityAuthorizationError(
+                "builder attestation key is not trusted"
+            )
         try:
             signature = base64.b64decode(
                 attestation.signature, validate=True
             )
-            key_record = self.keyring.verify(
-                attestation.builder_key_id,
-                signature,
-                attestation.canonical_bytes(),
-                at=_parse_utc(attestation.issued_at),
-                generation=attestation.builder_key_generation,
-                algorithm=attestation.signature_algorithm,
-                purpose=attestation.signature_purpose,
+            Ed25519PublicKey.from_public_bytes(key).verify(
+                signature, attestation.canonical_bytes()
             )
         except (InvalidSignature, ValueError, TypeError) as exc:
             raise CapabilityAuthorizationError(
                 "builder attestation signature is invalid"
             ) from exc
-        if key_record.generation >= 1:
-            expected_gitea = hashlib.sha256(
-                _canonical_json(candidate.gitea_consistency)
-            ).hexdigest()
-            expected_rollback = hashlib.sha256(
-                _canonical_json(
-                    {
-                        "ready": candidate.rollback_ready,
-                        "rollback_sha256": release_plan.deployment.rollback_sha256,
-                        "source_commit": candidate.source_commit,
-                    }
-                )
-            ).hexdigest()
-            production_evidence = (
-                attestation.gitea_evidence_sha256,
-                attestation.rollback_evidence_sha256,
-                attestation.policy_evidence_sha256,
-                attestation.secret_scan_evidence_sha256,
-            )
-            if any(not value for value in production_evidence):
-                raise CapabilityAuthorizationError(
-                    "builder attestation production evidence is incomplete"
-                )
-            if (
-                attestation.gitea_evidence_sha256 != expected_gitea
-                or attestation.rollback_evidence_sha256 != expected_rollback
-                or attestation.policy_evidence_sha256 != release_plan.policy_sha256
-            ):
-                raise CapabilityAuthorizationError(
-                    "builder attestation production evidence is invalid"
-                )
         return attestation
 
 
@@ -3530,12 +3181,9 @@ class SilentReleaseActionService:
         builder_attestation_verifier: BuilderAttestationVerifier | None = None,
         trusted_policy: TrustedReleasePolicy | None = None,
         orchestrator: ReleaseOrchestrator | None = None,
-        builder_readiness_probe: Callable[[], Mapping[str, Any]] | None = None,
         allow_legacy_candidate_input: bool = False,
         expected_repository: str = "",
         policy_sha256: str = "",
-        max_builder_attempts: int = 3,
-        builder_attempt_timeout_seconds: int = 180,
     ):
         self.root = Path(root)
         self.execution_enabled = bool(execution_enabled)
@@ -3546,28 +3194,11 @@ class SilentReleaseActionService:
         self.builder_attestation_verifier = builder_attestation_verifier
         self.trusted_policy = trusted_policy
         self.orchestrator = orchestrator
-        self.builder_readiness_probe = builder_readiness_probe
         self.allow_legacy_candidate_input = bool(
             allow_legacy_candidate_input
         )
         self.expected_repository = expected_repository
         self.policy_sha256 = policy_sha256
-        if (
-            not isinstance(max_builder_attempts, int)
-            or isinstance(max_builder_attempts, bool)
-            or not 1 <= max_builder_attempts <= 10
-        ):
-            raise ValueError("max_builder_attempts must be between 1 and 10")
-        self.max_builder_attempts = max_builder_attempts
-        if (
-            not isinstance(builder_attempt_timeout_seconds, int)
-            or isinstance(builder_attempt_timeout_seconds, bool)
-            or not 1 <= builder_attempt_timeout_seconds <= 3600
-        ):
-            raise ValueError(
-                "builder_attempt_timeout_seconds must be between 1 and 3600"
-            )
-        self.builder_attempt_timeout_seconds = builder_attempt_timeout_seconds
         self.candidates = ReleaseCandidateStore(
             self.root / "candidates"
         )
@@ -3604,26 +3235,10 @@ class SilentReleaseActionService:
                     + ", ".join(missing)
                 )
 
-    def get_builder_readiness(self) -> dict[str, Any]:
-        """Report dependency readiness without conflating it with API liveness."""
-        if self.candidate_builder is None:
-            return {"status": "UNAVAILABLE"}
-        if self.builder_readiness_probe is None:
-            # Explicit in-process test/adaptor construction remains usable;
-            # production wiring provides a probe backed by its credentials.
-            return {"status": "READY"}
-        try:
-            value = dict(self.builder_readiness_probe())
-        except Exception:
-            return {"status": "UNAVAILABLE"}
-        if value.get("status") != "READY":
-            return {"status": "UNAVAILABLE"}
-        return _sanitize(value)
-
     def create_release_intent(
         self, payload: Mapping[str, Any]
     ) -> dict[str, Any]:
-        allowed = {"event_id", "source_commit", "version"}
+        allowed = {"event_id", "source_commit"}
         unknown = set(payload).difference(allowed)
         if unknown:
             raise CapabilityAuthorizationError(
@@ -3635,17 +3250,12 @@ class SilentReleaseActionService:
         source_commit = _validate_oid(
             "source_commit", str(payload.get("source_commit") or "")
         )
-        version = str(payload.get("version") or "")
-        if version:
-            _validate_identifier("version", version)
         intent_id = "intent-" + hashlib.sha256(
             f"{event_id}\0{source_commit}".encode("utf-8")
         ).hexdigest()[:24]
         path = _safe_child(self.intents_root, intent_id)
-        was_existing = path.exists()
         record = {
             "created_at": utc_now(),
-            "attempt_count": 0,
             "event_id": event_id,
             "intent_id": intent_id,
             "source_commit": source_commit,
@@ -3655,153 +3265,42 @@ class SilentReleaseActionService:
                 else "BUILDER_UNAVAILABLE"
             ),
         }
-        if version:
-            record["version"] = version
-        if was_existing:
+        if path.exists():
             existing = json.loads(path.read_text(encoding="utf-8"))
             if (
                 existing.get("event_id") != event_id
                 or existing.get("source_commit") != source_commit
-                or str(existing.get("version") or "") != version
             ):
                 raise SagaConflict(
                     "release intent id is bound to different evidence"
                 )
-            if existing.get("status") == "BUILDING":
-                try:
-                    started_at = _parse_utc(
-                        str(existing.get("attempt_started_at") or "")
-                    )
-                    elapsed = (
-                        datetime.now(timezone.utc) - started_at
-                    ).total_seconds()
-                except (TypeError, ValueError):
-                    elapsed = self.builder_attempt_timeout_seconds + 1
-                if elapsed <= self.builder_attempt_timeout_seconds:
-                    return self._intent_response(existing, idempotent=True)
-                existing.update(
-                    {
-                        "failure_code": "TRUSTED_BUILDER_CRASH_RECOVERED",
-                        "last_recovery_code": "TRUSTED_BUILDER_CRASH_RECOVERED",
-                        "recovery_count": int(existing.get("recovery_count") or 0) + 1,
-                        "retryable": int(existing.get("attempt_count") or 0)
-                        < self.max_builder_attempts,
-                        "status": "BUILDER_RETRYABLE_FAILURE",
-                        "updated_at": utc_now(),
+            return {
+                **_sanitize(existing),
+                "idempotent": True,
+                "execution_enabled": self.execution_enabled,
+                "shadow_mode": not self.execution_enabled,
+                "side_effects_executed": False,
             }
-                )
-                _durable_json(path, existing)
-            if (
-                existing.get("status") != "BUILDER_RETRYABLE_FAILURE"
-                or int(existing.get("attempt_count") or 0)
-                >= self.max_builder_attempts
-            ):
-                return self._intent_response(existing, idempotent=True)
-            record = dict(existing)
-        if self.candidate_builder is None:
-            record.update(
-                {
-                    "retryable": False,
-                    "status": "BUILDER_UNAVAILABLE",
-                }
-            )
         _durable_json(path, record)
-            return self._intent_response(record, idempotent=was_existing)
-
-        record.update(
-            {
-                "attempt_count": int(record.get("attempt_count") or 0) + 1,
-                "attempt_started_at": utc_now(),
-                "retryable": False,
-                "status": "BUILDING",
-                "updated_at": utc_now(),
-            }
-        )
-        _durable_json(path, record)
-        try:
+        result = dict(record)
+        if self.candidate_builder is not None:
             candidate = self.create_release_candidate(
                 {
                     "event_id": event_id,
                     "intent_id": intent_id,
                     "source_commit": source_commit,
-                    **({"version": version} if version else {}),
                 }
             )
-        except TrustedCandidateBuilderUnavailable:
-            record.update(
-                {
-                    "failure_code": "TRUSTED_BUILDER_UNAVAILABLE",
-                    "retryable": record["attempt_count"]
-                    < self.max_builder_attempts,
-                    "status": (
-                        "BUILDER_RETRYABLE_FAILURE"
-                        if record["attempt_count"] < self.max_builder_attempts
-                        else "BUILDER_TERMINAL_FAILURE"
-                    ),
-                }
-            )
-            _durable_json(path, record)
-            return self._intent_response(record, idempotent=False)
-        except CapabilityAuthorizationError:
-            record.update(
-                {
-                    "failure_code": "TRUSTED_BUILDER_REJECTED",
-                    "retryable": False,
-                    "status": "BUILDER_TERMINAL_FAILURE",
-                }
-            )
-            _durable_json(path, record)
-            return self._intent_response(record, idempotent=False)
-        except (ConnectionError, OSError, TimeoutError):
-            record.update(
-                {
-                    "failure_code": "TRUSTED_BUILDER_UNAVAILABLE",
-                    "retryable": record["attempt_count"]
-                    < self.max_builder_attempts,
-                    "status": (
-                        "BUILDER_RETRYABLE_FAILURE"
-                        if record["attempt_count"] < self.max_builder_attempts
-                        else "BUILDER_TERMINAL_FAILURE"
-                    ),
-                }
-            )
-            _durable_json(path, record)
-            return self._intent_response(record, idempotent=False)
-        except Exception:
-            # The durable intent is recoverable without serializing an
-            # arbitrary exception (which may contain a credential or host
-            # path).  Repeated requests consume the small fixed retry budget.
-            record.update(
-                {
-                    "failure_code": "TRUSTED_BUILDER_FAILURE",
-                    "retryable": record["attempt_count"]
-                    < self.max_builder_attempts,
-                    "status": (
-                        "BUILDER_RETRYABLE_FAILURE"
-                        if record["attempt_count"] < self.max_builder_attempts
-                        else "BUILDER_TERMINAL_FAILURE"
-                    ),
-                }
-            )
-            _durable_json(path, record)
-            return self._intent_response(record, idempotent=False)
-        result = dict(record)
             result.update(
                 {
                     "candidate_id": candidate["candidate_id"],
-                "retryable": False,
                     "status": candidate["saga_state"],
                 }
             )
             _durable_json(path, result)
-        return self._intent_response(result, idempotent=False)
-
-    def _intent_response(
-        self, record: Mapping[str, Any], *, idempotent: bool
-    ) -> dict[str, Any]:
         return {
-            **_sanitize(dict(record)),
-            "idempotent": idempotent,
+            **_sanitize(result),
+            "idempotent": False,
             "execution_enabled": self.execution_enabled,
             "shadow_mode": not self.execution_enabled,
             "side_effects_executed": False,
@@ -3822,7 +3321,6 @@ class SilentReleaseActionService:
         self, payload: Mapping[str, Any]
     ) -> dict[str, Any]:
         if self.candidate_builder is not None:
-            values = dict(payload)
             forbidden_evidence = {
                 "artifact_sha256",
                 "canary",
@@ -3835,69 +3333,13 @@ class SilentReleaseActionService:
                 "tests",
                 "tree_oid",
             }
-            if forbidden_evidence.intersection(values):
+            if forbidden_evidence.intersection(payload):
                 raise CapabilityAuthorizationError(
                     "candidate evidence must come from the trusted builder"
                 )
-            worker_fields = {"candidate_id", "source_commit", "version"}
-            intent_fields = {"event_id", "intent_id", "source_commit", "version"}
-            supplied = set(values)
-            is_worker_request = worker_fields.issubset(supplied)
-            if is_worker_request:
-                if supplied != worker_fields:
-                    raise ValueError("release worker request contains unknown fields")
-                _validate_identifier(
-                    "candidate_id", str(values.get("candidate_id") or "")
-                )
-                _validate_identifier(
-                    "version", str(values.get("version") or "")
-                )
-            else:
-                if not supplied.issubset(intent_fields):
-                    raise ValueError("trusted builder intent contains unknown fields")
-                # Preserve the established internal intent contract
-                # (source_commit + version) while allowing newer callers to
-                # add an event/intent identifier.  Neither form can supply
-                # acceptance evidence; the host builder owns all collectors.
-                if values.get("event_id"):
-                    _validate_identifier(
-                        "event_id", str(values["event_id"])
-                    )
-                if values.get("intent_id"):
-                    _validate_identifier(
-                        "intent_id", str(values["intent_id"])
-                    )
-                if values.get("version"):
-                    _validate_identifier(
-                        "version", str(values["version"])
-                    )
-            _validate_oid(
-                "source_commit", str(values.get("source_commit") or "")
-            )
-            readiness = self.get_builder_readiness()
-            if readiness.get("status") != "READY":
-                raise TrustedCandidateBuilderUnavailable(
-                    "trusted builder dependency is unavailable"
-                )
             bundle = self.candidate_builder.build(dict(payload)).validate(
                 self.builder_attestation_verifier
             )
-            requested_source = str(payload.get("source_commit") or "")
-            if (
-                requested_source
-                and bundle.candidate.source_commit != requested_source
-            ):
-                raise CapabilityAuthorizationError(
-                    "trusted builder source commit does not match intent"
-                )
-            if (
-                is_worker_request
-                and bundle.candidate.candidate_id
-                != str(values["candidate_id"])
-            ):
-                raise CapabilityAuthorizationError(
-                    "trusted builder candidate id does not match request"
-                )
             if self.trusted_policy is None:
                 raise CapabilityAuthorizationError(
                     "trusted release policy is not configured"
@@ -4015,19 +3457,6 @@ class SilentReleaseActionService:
         }
 
     def get_release_saga(self, candidate_id: str) -> dict[str, Any]:
-        # A read of a never-created candidate is a normal empty-state.  Do
-        # not turn a missing journal into a durable manual-review snapshot.
-        saga_path = self.sagas._path(candidate_id)
-        journal_path = self.sagas._journal(candidate_id)
-        if not saga_path.exists() and not journal_path.exists():
-            return {
-                "candidate_id": candidate_id,
-                "status": "NOT_FOUND",
-                "state": "NOT_FOUND",
-                "execution_enabled": self.execution_enabled,
-                "shadow_mode": not self.execution_enabled,
-                "side_effects_executed": False,
-            }
         return {
             **self.sagas.load(candidate_id).to_dict(),
             "execution_enabled": self.execution_enabled,

active-runtime/app/task_plane/api.py

@@ -34,6 +34,7 @@ from .models import (
 )
 from .policy import PolicyEngine
 from .store import TaskPlaneStore
+from .scope import bind_task_scope
 from .worker_registry import WorkerRegistry
 
 
@@ -68,28 +69,54 @@ class TaskPlaneService:
         self.delegation = DelegationEngine(store)
         self.store.probe_attestation_verifier = self.policy.probe_attestation_verifier
 
-    def create_task(self, body: dict[str, Any], idempotency_key: str | None = None) -> dict[str, Any]:
+    def _authorized_task(self, task_id: str, actor: str, action: str) -> TaskRecord:
+        task = self.store.get_task(task_id, self.policy.actor_context(actor))
+        self.policy.assert_allowed(action, actor, task=task)
+        return task
+
+    def create_task(
+        self,
+        body: dict[str, Any],
+        idempotency_key: str | None = None,
+        *,
+        actor_identity: str | None = None,
+    ) -> dict[str, Any]:
         if body.get("parent_task_id"):
             raise ForbiddenError("child tasks must use the delegate endpoint")
         issuer = body.get("issuer", {})
-        actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
+        declared_actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
+        actor = actor_identity or declared_actor
         self.policy.assert_allowed("create", actor)
         try:
             plan = TaskPlan.from_dict(body)
         except (TypeError, ValueError) as exc:
             raise ValidationError("invalid task plan") from exc
+        if actor_identity is not None:
+            plan = bind_task_scope(
+                plan, self.policy.actor_context(actor_identity), public_create=True
+            )
         task = self.store.create_task_with_event(plan, idempotency_key=idempotency_key)
         return task.to_dict()
 
     def list_tasks(self, actor: str | None = None) -> list[dict[str, Any]]:
+        context = None
         if actor is not None:
             self.policy.assert_allowed("read", actor)
-        return [task.to_dict(include_task=False) for task in self.store.list_tasks()]
+            context = self.policy.actor_context(actor)
+        return [
+            task.to_dict(include_task=False)
+            for task in self.store.list_tasks(context)
+        ]
 
     def get_task(self, task_id: str, actor: str | None = None) -> dict[str, Any]:
+        context = None
         if actor is not None:
-            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
-        return self.store.get_task(task_id).to_dict()
+            self.policy.assert_allowed("read", actor)
+            context = self.policy.actor_context(actor)
+        task = self.store.get_task(task_id, context)
+        if actor is not None:
+            self.policy.assert_allowed("read", actor, task=task)
+        return task.to_dict()
 
     def get_worker(self, worker_id: str, actor: str | None = None) -> dict[str, Any]:
         if actor is not None:
@@ -163,9 +190,8 @@ class TaskPlaneService:
         if not worker_id:
             raise ValidationError("worker_id required")
 
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "claim")
         self.policy.assert_readonly_worker_binding(actor, str(worker_id))
-        self.policy.assert_allowed("claim", actor, task=task)
         lease_seconds = _bounded_int(
             body.get("lease_seconds", 30), "lease_seconds", 1, 3600
         )
@@ -184,10 +210,9 @@ class TaskPlaneService:
         if not claim_id:
             raise ValidationError("claim_id required")
         actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "heartbeat")
         claim = self.store.get_claim(claim_id)
         self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("heartbeat", actor, task=task)
         if claim.worker_identity != actor:
             raise ForbiddenError("claim identity mismatch")
         lease_seconds = _bounded_int(
@@ -206,10 +231,9 @@ class TaskPlaneService:
         message = body.get("message")
         if progress is None:
             raise ValidationError("progress required")
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "progress")
         claim = self.store.get_claim(claim_id)
         self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("progress", actor, task=task)
         if task.task_plan.data_classification == "credential-secret":
             if message not in {None, ""} or contains_secret_text(stage):
                 raise ValidationError(
@@ -234,7 +258,7 @@ class TaskPlaneService:
         if not claim_id:
             raise ValidationError("claim_id required")
         actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "result")
 
         status = body.get("status", "COMPLETED")
         outputs = body.get("outputs", [])
@@ -247,7 +271,6 @@ class TaskPlaneService:
             raise ValidationError("evidence items must be objects")
         claim = self.store.get_claim(claim_id)
         self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("result", actor, task=task)
         if claim.worker_identity != actor:
             raise ForbiddenError("claim identity mismatch")
         if task.task_plan.data_classification == "credential-secret":
@@ -326,8 +349,7 @@ class TaskPlaneService:
         reason = body.get("reason", "failed")
         actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
         self.policy.assert_allowed("fail", actor)
-        task = self.store.get_task(task_id)
-        self.policy.assert_allowed("fail", actor, task=task)
+        task = self._authorized_task(task_id, actor, "fail")
         claim = self.store.get_claim(claim_id)
         if claim.worker_identity != actor:
             raise ForbiddenError("claim identity mismatch")
@@ -339,8 +361,7 @@ class TaskPlaneService:
         actor = body.get("actor_identity") or body.get("worker_identity") or "owner"
         self.policy.assert_allowed("cancel", actor)
         reason = body.get("reason", "cancelled")
-        task = self.store.get_task(task_id)
-        self.policy.assert_allowed("cancel", actor, task=task)
+        task = self._authorized_task(task_id, actor, "cancel")
         updated = self.store.cancel_task_with_event(
             task_id, task.revision, reason=reason
         )
@@ -349,8 +370,7 @@ class TaskPlaneService:
     def delegate(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
         actor = body.get("actor_identity") or "owner"
         self.policy.assert_allowed("delegate", actor)
-        parent = self.store.get_task(task_id)
-        self.policy.assert_allowed("delegate", actor, task=parent)
+        parent = self._authorized_task(task_id, actor, "delegate")
         if "task" in body:
             try:
                 child_plan = TaskPlan.from_dict(body["task"])
@@ -364,24 +384,30 @@ class TaskPlaneService:
             except (TypeError, ValueError) as exc:
                 raise ValidationError("invalid child task plan") from exc
         child_plan.parent_task_id = task_id
+        child_plan = bind_task_scope(
+            child_plan, self.policy.actor_context(actor), public_create=False
+        )
         child = self.delegation.delegate(task_id, child_plan, caller=actor)
         return child.to_dict()
 
     def get_events(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
         if actor is not None:
-            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
+            self._authorized_task(task_id, actor, "audit")
+        else:
             self.store.get_task(task_id)
         return self.store.list_events(task_id)
 
     def get_evidence(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
         if actor is not None:
-            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
+            self._authorized_task(task_id, actor, "audit")
+        else:
             self.store.get_task(task_id)
         return self.evidence.list(task_id)
 
     def get_children(self, task_id: str, actor: str | None = None) -> list[str]:
         if actor is not None:
-            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
+            self._authorized_task(task_id, actor, "read")
+        else:
             self.store.get_task(task_id)
         return self.store.list_children(task_id)
 
@@ -506,7 +532,11 @@ class TaskPlaneRequestHandler(BaseHTTPRequestHandler):
                 ):
                     raise ForbiddenError("issuer identity mismatch")
                 body["issuer"] = {"type": "authenticated", "id": identity}
-                return 201, self.service.create_task(body or {}, headers.get("idempotency-key"))
+                return 201, self.service.create_task(
+                    body or {},
+                    headers.get("idempotency-key"),
+                    actor_identity=identity,
+                )
             if body.get("actor_identity") not in {None, identity}:
                 raise ForbiddenError("actor identity mismatch")
             body["actor_identity"] = identity

active-runtime/app/task_plane/events.py

@@ -106,3 +106,8 @@ class DurableOutboxDispatcher:
             receipt=str(receipt) if receipt else None,
             error=None if receipt else f"{adapter.name} receipt unavailable",
         )
+
+# R4.2 P0-B compatibility adapter.
+def to_handoff_envelope(event, *, target, sequence=1, idempotency_key=None, **scope):
+    from message_handoff_adapters import taskplane_event_to_envelope
+    return taskplane_event_to_envelope(event, target=target, sequence=sequence, idempotency_key=idempotency_key, **scope)

active-runtime/app/task_plane/models.py

@@ -13,6 +13,8 @@ from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from typing import Any
 
+from .scope import normalize_task_scope
+
 
 SENSITIVE_KEYS = {
     "secret",
@@ -66,6 +68,12 @@ TASK_PLAN_KEYS = {
     "allowed_input_paths",
     "allowed_output_paths",
     "output_policy",
+    "scope_type",
+    "tenant_id",
+    "user_id",
+    "project_id",
+    "conversation_id",
+    "run_id",
 }
 
 
@@ -237,6 +245,12 @@ class TaskPlan:
     schema_version: int = 1
     task_id: str | None = None
     task_type: str = "code.change"
+    scope_type: str = "legacy"
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
     issuer: dict[str, Any] = field(default_factory=dict)
     intent: str | None = None
     required_capabilities: list[str] = field(default_factory=list)
@@ -311,10 +325,17 @@ class TaskPlan:
                 raise ValueError("credential-secret requires metadata-only logging")
             if output_policy != "hash-count-status-only":
                 raise ValueError("credential-secret requires restricted output")
+        scope = normalize_task_scope(data)
         return cls(
             schema_version=schema_version,
             task_id=validate_identifier(data["task_id"], "task_id"),
             task_type=validate_type(data.get("task_type", "code.change"), "task_type"),
+            scope_type=scope.scope_type,
+            tenant_id=scope.tenant_id,
+            user_id=scope.user_id,
+            project_id=scope.project_id,
+            conversation_id=scope.conversation_id,
+            run_id=scope.run_id,
             issuer=issuer,
             intent=data.get("intent"),
             required_capabilities=_normalize_list(data.get("required_capabilities", [])),
@@ -348,6 +369,12 @@ class TaskPlan:
             "schema_version": self.schema_version,
             "task_id": self.task_id,
             "task_type": self.task_type,
+            "scope_type": self.scope_type,
+            "tenant_id": self.tenant_id,
+            "user_id": self.user_id,
+            "project_id": self.project_id,
+            "conversation_id": self.conversation_id,
+            "run_id": self.run_id,
             "issuer": self.issuer,
             "intent": self.intent,
             "required_capabilities": list(self.required_capabilities),

active-runtime/app/task_plane/policy.py

@@ -3,10 +3,11 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
-from typing import Callable
+from typing import Any, Callable, Mapping
 
 from .errors import ForbiddenError, LockedError
 from .models import ProbeEvidence, ResultEnvelope, TaskRecord
+from .scope import TaskActorContext, actor_context as build_actor_context
 
 
 RISK_RANK = {"low": 1, "medium": 2, "high": 3}
@@ -93,6 +94,10 @@ class PolicyEngine:
         result_signature_verifier: Callable[[ResultEnvelope], bool] | None = None,
         probe_attestation_verifier: Callable[[ProbeEvidence], bool] | None = None,
         identity_capabilities: dict[str, set[str]] | None = None,
+        identity_actor_contexts: Mapping[
+            str, TaskActorContext | Mapping[str, Any]
+        ]
+        | None = None,
         admin_identities: set[str] | None = None,
         readonly_worker_execution_enabled: bool = False,
         readonly_worker_profiles: list[ReadonlyWorkerProfile] | None = None,
@@ -109,12 +114,26 @@ class PolicyEngine:
             identity: set(capabilities)
             for identity, capabilities in (identity_capabilities or {}).items()
         }
+        self.identity_actor_contexts = dict(identity_actor_contexts or {})
         self.admin_identities = set(admin_identities or ())
         self.readonly_worker_execution_enabled = readonly_worker_execution_enabled
         self.readonly_worker_profiles = {
             profile.identity: profile for profile in (readonly_worker_profiles or [])
         }
 
+    def actor_context(self, identity: str) -> TaskActorContext:
+        configured = self.identity_actor_contexts.get(
+            identity, self.identity_actor_contexts.get("*")
+        )
+        capabilities = set(
+            self.identity_capabilities.get(
+                identity, self.identity_capabilities.get("*", set())
+            )
+        )
+        if identity in self.admin_identities:
+            capabilities.add("task.admin")
+        return build_actor_context(identity, configured, capabilities)
+
     def _readonly_worker_allows(
         self, action: str, actor: str, task: TaskRecord | None
     ) -> bool:

active-runtime/app/task_plane/scope.py

@@ -0,0 +1,181 @@
+"""Trusted TaskPlane scope model and SQL authorization helpers."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, replace
+from typing import Any, Mapping
+
+from .errors import ForbiddenError, ValidationError
+
+SCOPE_FIELDS = ("tenant_id", "user_id", "project_id", "conversation_id", "run_id")
+PRIVILEGED_CAPABILITIES = frozenset(
+    {"*", "admin", "system.admin", "task.admin", "task.read.all"}
+)
+
+
+def _value(value: Any, field: str) -> Any:
+    if hasattr(value, "task_plan"):
+        value = value.task_plan
+    if isinstance(value, Mapping):
+        return value.get(field)
+    return getattr(value, field, None)
+
+
+def _text(value: Any) -> str | None:
+    if value is None:
+        return None
+    result = str(value).strip()
+    return result or None
+
+
+@dataclass(frozen=True)
+class TaskScope:
+    scope_type: str
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
+
+
+@dataclass(frozen=True)
+class TaskActorContext:
+    identity: str
+    scope_type: str = "legacy"
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
+    capabilities: frozenset[str] = frozenset()
+
+
+def normalize_task_scope(value: Any) -> TaskScope:
+    fields = {field: _text(_value(value, field)) for field in SCOPE_FIELDS}
+    declared = _text(_value(value, "scope_type"))
+    if declared is None:
+        declared = "tenant" if fields["tenant_id"] else "legacy"
+    if declared == "tenant":
+        if fields["tenant_id"] is None:
+            raise ValidationError(
+                "tenant scope requires tenant_id", code="TASK_SCOPE_TENANT_ID_REQUIRED"
+            )
+    elif declared == "legacy":
+        if any(fields.values()):
+            raise ValidationError(
+                "legacy scope cannot contain scoped ownership",
+                code="TASK_SCOPE_LEGACY_WITH_SCOPED_FIELDS",
+            )
+    elif declared == "system":
+        if any(fields[field] for field in ("tenant_id", "user_id", "project_id", "conversation_id")):
+            raise ValidationError(
+                "system scope cannot contain tenant ownership",
+                code="TASK_SCOPE_SYSTEM_WITH_TENANT_FIELDS",
+            )
+    else:
+        raise ValidationError("invalid task scope type", code="TASK_SCOPE_TYPE_INVALID")
+    return TaskScope(declared, **fields)
+
+
+def actor_is_privileged(actor: TaskActorContext) -> bool:
+    return bool(actor.capabilities & PRIVILEGED_CAPABILITIES)
+
+
+def actor_context(
+    identity: str,
+    configured: TaskActorContext | Mapping[str, Any] | None,
+    capabilities: set[str] | frozenset[str],
+) -> TaskActorContext:
+    if isinstance(configured, TaskActorContext):
+        context = configured
+    else:
+        data = dict(configured or {})
+        data.pop("identity", None)
+        data.pop("capabilities", None)
+        context = TaskActorContext(identity=str(identity), **data)
+    scope = normalize_task_scope(context)
+    return replace(
+        context,
+        identity=str(identity),
+        scope_type=scope.scope_type,
+        tenant_id=scope.tenant_id,
+        user_id=scope.user_id,
+        project_id=scope.project_id,
+        conversation_id=scope.conversation_id,
+        run_id=scope.run_id,
+        capabilities=frozenset(str(item) for item in capabilities),
+    )
+
+
+def bind_task_scope(plan: Any, actor: TaskActorContext, *, public_create: bool) -> Any:
+    requested = normalize_task_scope(plan)
+    if actor_is_privileged(actor):
+        trusted = normalize_task_scope(actor)
+        if requested.scope_type == "legacy" and trusted.scope_type != "legacy":
+            plan.scope_type = trusted.scope_type
+            for field in SCOPE_FIELDS:
+                setattr(plan, field, getattr(actor, field))
+        return plan
+    trusted = normalize_task_scope(actor)
+    if public_create and trusted.scope_type == "legacy":
+        raise ForbiddenError(
+            "authenticated identity has no tenant scope",
+            code="TASK_ACTOR_SCOPE_UNAVAILABLE",
+        )
+    if trusted.scope_type != "tenant":
+        if requested.scope_type == "legacy":
+            plan.scope_type = trusted.scope_type
+            for field in SCOPE_FIELDS:
+                setattr(plan, field, getattr(actor, field))
+            return plan
+        if requested.scope_type != trusted.scope_type:
+            raise ForbiddenError("task scope mismatch", code="TASK_SCOPE_MISMATCH_DENY")
+        return plan
+    if requested.scope_type not in {"legacy", "tenant"}:
+        raise ForbiddenError("task scope mismatch", code="TASK_SCOPE_MISMATCH_DENY")
+    updates: dict[str, Any] = {"scope_type": "tenant"}
+    for field in SCOPE_FIELDS:
+        declared = getattr(requested, field)
+        authoritative = getattr(actor, field)
+        if declared is not None and declared != authoritative:
+            raise ForbiddenError(
+                "task scope mismatch",
+                code="TASK_SCOPE_MISMATCH_DENY",
+                details={"field": field},
+            )
+        updates[field] = authoritative
+    for field, item in updates.items():
+        setattr(plan, field, item)
+    return plan
+
+
+def actor_scope_sql(actor: TaskActorContext | None) -> tuple[str, tuple[Any, ...]]:
+    if actor is None or actor_is_privileged(actor):
+        return "", ()
+    scope = normalize_task_scope(actor)
+    if scope.scope_type == "legacy":
+        return "scope_type = 'legacy'", ()
+    if scope.scope_type == "system":
+        return "scope_type = 'system'", ()
+    clauses = ["scope_type = 'tenant'", "tenant_id = ?"]
+    params: list[Any] = [scope.tenant_id]
+    for field in ("user_id", "project_id", "conversation_id", "run_id"):
+        value = getattr(scope, field)
+        if value is None:
+            clauses.append(f"{field} IS NULL")
+        else:
+            clauses.append(f"({field} IS NULL OR {field} = ?)")
+            params.append(value)
+    return " AND ".join(clauses), tuple(params)
+
+
+def task_scope_values(value: Any) -> tuple[str | None, ...]:
+    scope = normalize_task_scope(value)
+    return (
+        scope.scope_type,
+        scope.tenant_id,
+        scope.user_id,
+        scope.project_id,
+        scope.conversation_id,
+        scope.run_id,
+    )

active-runtime/app/task_plane/store.py

@@ -32,6 +32,7 @@ from .models import (
     redact_value,
     validate_identifier,
 )
+from .scope import TaskActorContext, actor_scope_sql, task_scope_values
 
 
 EventEnvelope = tuple[str, str, str, str, str, float]
@@ -134,6 +135,12 @@ class TaskPlaneStore:
                     status TEXT NOT NULL,
                     task_json TEXT NOT NULL,
                     task_type TEXT NOT NULL,
+                    scope_type TEXT NOT NULL DEFAULT 'legacy',
+                    tenant_id TEXT,
+                    user_id TEXT,
+                    project_id TEXT,
+                    conversation_id TEXT,
+                    run_id TEXT,
                     root_task_id TEXT NOT NULL,
                     parent_task_id TEXT,
                     correlation_id TEXT,
@@ -272,6 +279,21 @@ class TaskPlaneStore:
                 )
                 """
             )
+            self._ensure_columns(
+                "tasks",
+                {
+                    "scope_type": "TEXT NOT NULL DEFAULT 'legacy'",
+                    "tenant_id": "TEXT",
+                    "user_id": "TEXT",
+                    "project_id": "TEXT",
+                    "conversation_id": "TEXT",
+                    "run_id": "TEXT",
+                },
+            )
+            self.conn.execute(
+                "UPDATE tasks SET scope_type='legacy' "
+                "WHERE scope_type IS NULL OR TRIM(scope_type)=''"
+            )
             self._ensure_columns(
                 "workers",
                 {
@@ -299,6 +321,14 @@ class TaskPlaneStore:
             )
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_tasks_status ON tasks(status)")
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_tasks_parent ON tasks(parent_task_id)")
+            self.conn.execute(
+                "CREATE INDEX IF NOT EXISTS ix_tasks_scope_tenant_project "
+                "ON tasks(scope_type, tenant_id, project_id)"
+            )
+            self.conn.execute(
+                "CREATE INDEX IF NOT EXISTS ix_tasks_scope_owner "
+                "ON tasks(scope_type, tenant_id, user_id, conversation_id, run_id)"
+            )
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_workers_status ON workers(status)")
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_claims_task ON claims(task_id)")
             self.conn.execute(
@@ -347,6 +377,42 @@ class TaskPlaneStore:
             raise NotFoundError("task")
         task_json = json.loads(row["task_json"])
         task_plan = TaskPlan.from_dict(task_json)
+        stored_scope = tuple(
+            row[field]
+            for field in (
+                "scope_type",
+                "tenant_id",
+                "user_id",
+                "project_id",
+                "conversation_id",
+                "run_id",
+            )
+        )
+        json_has_scope = any(
+            field in task_json
+            for field in (
+                "scope_type",
+                "tenant_id",
+                "user_id",
+                "project_id",
+                "conversation_id",
+                "run_id",
+            )
+        )
+        if json_has_scope and stored_scope != task_scope_values(task_plan):
+            raise ConflictError(
+                "task scope persistence mismatch",
+                code="TASK_SCOPE_PERSISTENCE_MISMATCH",
+            )
+        if not json_has_scope:
+            (
+                task_plan.scope_type,
+                task_plan.tenant_id,
+                task_plan.user_id,
+                task_plan.project_id,
+                task_plan.conversation_id,
+                task_plan.run_id,
+            ) = stored_scope
         task_plan.parent_task_id = row["parent_task_id"]
         task_plan.correlation_id = row["correlation_id"]
         return TaskRecord(
@@ -389,6 +455,7 @@ class TaskPlaneStore:
         task_id = task_plan.task_id or f"task-{uuid.uuid4()}"
         task_plan.task_id = task_id
         task_json = redact_value(task_plan.to_dict(redact=False))
+        scope_values = task_scope_values(task_plan)
         now = _now()
         with self._transaction():
             if idempotency_key:
@@ -397,7 +464,11 @@ class TaskPlaneStore:
                     (idempotency_key,),
                 ).fetchone()
                 if existing:
-                    if _canonical(json.loads(existing["task_json"])) != _canonical(task_json):
+                    existing_plan = TaskPlan.from_dict(
+                        json.loads(existing["task_json"])
+                    )
+                    existing_json = redact_value(existing_plan.to_dict(redact=False))
+                    if _canonical(existing_json) != _canonical(task_json):
                         raise ConflictError("idempotency key payload mismatch")
                     return self.get_task(existing["task_id"])
             root_task_id = task_id
@@ -412,14 +483,18 @@ class TaskPlaneStore:
             self.conn.execute(
                 """
                 INSERT INTO tasks
-                (task_id, revision, status, task_json, task_type, root_task_id, parent_task_id, correlation_id, idempotency_key, created_at, updated_at, failure_reason)
-                VALUES (?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
+                (task_id, revision, status, task_json, task_type,
+                 scope_type, tenant_id, user_id, project_id, conversation_id, run_id,
+                 root_task_id, parent_task_id, correlation_id, idempotency_key,
+                 created_at, updated_at, failure_reason)
+                VALUES (?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
                 """,
                 (
                     task_id,
                     "CREATED",
                     json.dumps(task_json, ensure_ascii=False),
                     task_plan.task_type,
+                    *scope_values,
                     root_task_id,
                     task_plan.parent_task_id,
                     task_plan.correlation_id,
@@ -451,21 +526,30 @@ class TaskPlaneStore:
                 )
             return self.get_task(task.task_id)
 
-    def get_task(self, task_id: str) -> TaskRecord:
+    def get_task(
+        self, task_id: str, actor_context: TaskActorContext | None = None
+    ) -> TaskRecord:
         task_id = _validated_id(task_id, "task_id")
+        predicate, scope_params = actor_scope_sql(actor_context)
+        sql = "SELECT * FROM tasks WHERE task_id=?"
+        if predicate:
+            sql += f" AND ({predicate})"
         with self._lock:
-            row = self.conn.execute(
-                "SELECT * FROM tasks WHERE task_id=?", (task_id,)
-            ).fetchone()
+            row = self.conn.execute(sql, (task_id, *scope_params)).fetchone()
         if row is None:
             raise NotFoundError(f"task {task_id} not found")
         return self._row_to_task(row)
 
-    def list_tasks(self) -> list[TaskRecord]:
+    def list_tasks(
+        self, actor_context: TaskActorContext | None = None
+    ) -> list[TaskRecord]:
+        predicate, scope_params = actor_scope_sql(actor_context)
+        sql = "SELECT * FROM tasks"
+        if predicate:
+            sql += f" WHERE ({predicate})"
+        sql += " ORDER BY created_at DESC"
         with self._lock:
-            rows = self.conn.execute(
-                "SELECT * FROM tasks ORDER BY created_at DESC"
-            ).fetchall()
+            rows = self.conn.execute(sql, scope_params).fetchall()
         return [self._row_to_task(row) for row in rows]
 
     def get_task_budget(self, task_id: str) -> Budget:

active-runtime/app/trusted_production_adapter.py

@@ -1,117 +0,0 @@
-#!/usr/bin/env python3
-"""Plan-bound production adapter for releases newer than the legacy baseline.
-
-All identity comes from the already verified executor request.  The adapter has
-no Git/ref/tag authority and refuses a missing candidate/release-plan binding.
-"""
-from __future__ import annotations
-import hashlib, json, os, shutil, subprocess, sys, tempfile, urllib.error, urllib.request
-from pathlib import Path
-from typing import Any, Mapping
-
-class AdapterBlocked(RuntimeError): pass
-
-ALLOWED_SERVICE_PORTS = {"aios-v2r2c2-production.service": 18928}
-
-def _safe(value: str) -> str:
-    if not value or any(ch not in "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.-" for ch in value):
-        raise AdapterBlocked("invalid_release_identity")
-    return value
-
-def _run(*args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
-    result = subprocess.run(args, check=False, capture_output=True, text=True, timeout=60, env={"PATH": os.environ.get("PATH", "")})
-    if check and result.returncode != 0: raise AdapterBlocked(result.stderr.strip() or "system_command_failed")
-    return result
-
-def _sha(path: Path) -> str:
-    if path.is_symlink() or not path.is_file(): raise AdapterBlocked("artifact_must_be_regular_file")
-    digest=hashlib.sha256()
-    with path.open("rb") as stream:
-        for block in iter(lambda: stream.read(1024*1024), b""): digest.update(block)
-    return digest.hexdigest()
-
-def _binding(value: Mapping[str, Any]) -> dict[str, Any]:
-    required=("version","target_oid","artifact_sha256","artifact_path","artifact_size","production_service","production_port","candidate_id","release_plan_sha256")
-    if any(key not in value for key in required): raise AdapterBlocked("trusted_binding_incomplete")
-    if str(value["version"]).startswith("V2R1") or not value["candidate_id"] or not value["release_plan_sha256"]: raise AdapterBlocked("legacy_or_unbound_release_rejected")
-    service = str(value["production_service"])
-    port = int(value["production_port"])
-    if ALLOWED_SERVICE_PORTS.get(service) != port:
-        raise AdapterBlocked("production_adapter_policy_rejected")
-    return {key:value[key] for key in required}
-
-def _paths(binding: Mapping[str, Any]) -> dict[str, Path]:
-    version=_safe(str(binding["version"])); service=_safe(str(binding["production_service"]))
-    root=Path(os.environ.get("AIOS_RELEASE_ROOT", "/opt/aios/releases"))
-    slug=version.lower()
-    return {"release_dir":root/(version+"-"+str(binding["target_oid"])[:12]+"-"+str(binding["artifact_sha256"])[:12]),"current_link":Path("/opt/aios")/slug,"env_file":Path("/etc/aios")/(slug+".env"),"state_file":Path("/var/lib/aios")/slug/"deployment-state.json","unit_file":Path("/etc/systemd/system")/(service+".service" if not service.endswith(".service") else service),"health_url":f"http://127.0.0.1:{int(binding['production_port'])}/health"}
-
-def _health(url: str, binding: Mapping[str, Any]) -> dict[str, Any]:
-    try:
-        with urllib.request.urlopen(url, timeout=5) as response: body=json.loads(response.read().decode()); status=response.status
-    except (OSError, ValueError, urllib.error.URLError): return {"status":"UNAVAILABLE"}
-    exact=(status==200 and body.get("version")==binding["version"] and body.get("commit_oid")==binding["target_oid"] and body.get("artifact_sha256")==binding["artifact_sha256"] and body.get("deployment_state")=="ACTIVE" and body.get("production_deployed") is True)
-    return {"status":"ACTIVE_VERIFIED" if exact else "CONFLICT", "http_status":status, **body}
-
-def _extract(artifact: Path, destination: Path) -> None:
-    import tarfile
-    with tarfile.open(artifact, "r:*") as archive:
-        for member in archive.getmembers():
-            name=Path(member.name)
-            if name.is_absolute() or ".." in name.parts or member.issym() or member.islnk() or not member.isfile() or not member.name.startswith("payload/"):
-                raise AdapterBlocked("unsafe_artifact_member")
-            rel=name.relative_to("payload"); target=destination/rel; target.parent.mkdir(parents=True,exist_ok=True)
-            source=archive.extractfile(member)
-            if source is None: raise AdapterBlocked("artifact_member_unreadable")
-            target.write_bytes(source.read()); os.chmod(target,0o755 if rel.parts and rel.parts[0]=="scripts" else 0o644)
-
-def probe(value: Mapping[str, Any]) -> dict[str, Any]:
-    binding=_binding(value); p=_paths(binding); active=_run("systemctl","is-active","--quiet",str(binding["production_service"]),check=False).returncode==0
-    return _health(str(p["health_url"]),binding) if active else {"status":"NOT_APPLIED","version":binding["version"],"target_oid":binding["target_oid"],"artifact_sha256":binding["artifact_sha256"],"production_deployed":False,"deployment_state":"ABSENT"}
-
-def apply(value: Mapping[str, Any]) -> dict[str, Any]:
-    binding=_binding(value); p=_paths(binding); p["release_dir"].parent.mkdir(parents=True, exist_ok=True); artifact=Path(str(binding["artifact_path"]))
-    if artifact.stat().st_size != int(binding["artifact_size"]) or _sha(artifact)!=binding["artifact_sha256"]: raise AdapterBlocked("artifact_binding_mismatch")
-    marker={"schema":"aios.trusted-runtime-release-binding.v1",**binding}
-    marker_path=p["release_dir"]/"DEPLOYMENT-BINDING.json"
-    if p["release_dir"].exists():
-        if not marker_path.is_file() or json.loads(marker_path.read_text())!=marker: raise AdapterBlocked("existing_release_binding_conflict")
-    else:
-        temp=Path(tempfile.mkdtemp(prefix=p["release_dir"].name+".",dir=str(p["release_dir"].parent)))
-        try:
-            _extract(artifact,temp); (temp/"DEPLOYMENT-BINDING.json").write_text(json.dumps(marker,sort_keys=True,separators=(",",":"))+"\n"); os.rename(temp,p["release_dir"])
-        except Exception:
-            shutil.rmtree(temp,ignore_errors=True); raise
-    version_file=p["release_dir"] / "VERSION"
-    if not version_file.is_file() or version_file.read_text().strip()!=binding["version"]: raise AdapterBlocked("release_version_mismatch")
-    unit_source=p["release_dir"] / "deploy" / "aios-v2" / "systemd" / str(binding["production_service"])
-    if not unit_source.is_file(): raise AdapterBlocked("release_unit_missing")
-    p["unit_file"].parent.mkdir(parents=True,exist_ok=True); shutil.copyfile(unit_source,p["unit_file"])
-    p["current_link"].parent.mkdir(parents=True,exist_ok=True)
-    if p["current_link"].exists() and not p["current_link"].is_symlink(): raise AdapterBlocked("current_release_path_conflict")
-    if not p["current_link"].is_symlink(): p["current_link"].symlink_to(p["release_dir"])
-    p["state_file"].parent.mkdir(parents=True,exist_ok=True); p["state_file"].write_text(json.dumps({"version":binding["version"],"commit_oid":binding["target_oid"],"artifact_sha256":binding["artifact_sha256"],"candidate_id":binding["candidate_id"],"release_plan_sha256":binding["release_plan_sha256"],"deployment_state":"ACTIVE","production_deployed":True},sort_keys=True)+"\n")
-    env=(f"RELEASE_VERSION={binding['version']}\n" f"TARGET_OID={binding['target_oid']}\n"
-        f"ARTIFACT_SHA256={binding['artifact_sha256']}\n" f"CANDIDATE_ID={binding['candidate_id']}\n"
-        f"RELEASE_PLAN_SHA256={binding['release_plan_sha256']}\n" f"DEPLOYMENT_STATE=ACTIVE\n"
-        f"DEPLOYMENT_STATE_FILE={p['state_file']}\n" f"AIOS_V2R2C2_PORT={binding['production_port']}\n"
-        "AIOS_GITOPS_WRITES_ENABLED=false\n")
-    p["env_file"].parent.mkdir(parents=True,exist_ok=True); p["env_file"].write_text(env)
-    _run("systemctl","daemon-reload"); _run("systemctl","enable",str(binding["production_service"])); _run("systemctl","restart",str(binding["production_service"]))
-    result=_health(str(p["health_url"]),binding)
-    if result["status"]!="ACTIVE_VERIFIED": raise AdapterBlocked("production_health_binding_mismatch")
-    return result
-
-def rollback(value: Mapping[str, Any]) -> dict[str, Any]:
-    binding=_binding(value); _run("systemctl","stop",str(binding["production_service"]),check=False); _run("systemctl","disable",str(binding["production_service"]),check=False)
-    p=_paths(binding); p["state_file"].parent.mkdir(parents=True,exist_ok=True); p["state_file"].write_text(json.dumps({"version":binding["version"],"commit_oid":binding["target_oid"],"artifact_sha256":binding["artifact_sha256"],"deployment_state":"ROLLED_BACK","production_deployed":False},sort_keys=True)+"\n")
-    return {"status":"ROLLED_BACK","version":binding["version"],"target_oid":binding["target_oid"],"artifact_sha256":binding["artifact_sha256"],"production_deployed":False,"deployment_state":"ROLLED_BACK"}
-
-def main() -> int:
-    value=json.loads(sys.stdin.read()); operation=value.get("operation")
-    result=probe(value) if operation=="probe" else apply(value) if operation=="apply" else rollback(value) if operation=="rollback" else (_ for _ in ()).throw(AdapterBlocked("unsupported_operation"))
-    print(json.dumps(result,sort_keys=True)); return 0
-
-if __name__=="__main__":
-    try: raise SystemExit(main())
-    except Exception as exc: print(json.dumps({"status":"FAIL_CLOSED","error":type(exc).__name__,"reason":str(exc)},sort_keys=True)); raise SystemExit(2)

active-runtime/app/trusted_release_execution_plan.py

@@ -1,101 +0,0 @@
-#!/usr/bin/env python3
-"""Canonical, fail-closed projection for trusted release execution plans.
-
-A release plan is the only authority for candidate, source, artifact, policy,
-rollback, and release identity. Callers may not provide executable paths or
-replace individual fields after the plan has been accepted.
-"""
-from __future__ import annotations
-import hashlib, json, re, stat
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any, Mapping
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA_RE = re.compile(r"^[0-9a-f]{64}$")
-PLAN_ID_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
-IDENTIFIER_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.:-]{2,255}$")
-TOP_LEVEL_KEYS = frozenset({"schema","version","candidate_id","source_commit","tree_oid","artifact_sha256","manifest_sha256","package_closure_sha256","deployment_plan_sha256","policy_sha256","release_plan_id","approval_plan_id","evidence_closure_oid","campaign_authorization_sha256","campaign_generation","artifact","rollback","baseline","adapter_policy","release_plan_sha256"})
-FORBIDDEN_KEYS = frozenset({"command","commands","executable","exec","shell","argv","adapter_command","tag_command","deploy_command","registry_command","baseline_command","sudo","force_push","direct_main_push"})
-class PlanError(ValueError):
-    """A release plan is malformed, inconsistent, or unsafe."""
-def canonical_json(value: object) -> bytes:
-    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
-def _sha(value: Any, label: str) -> str:
-    if not isinstance(value, str) or not SHA_RE.fullmatch(value): raise PlanError(f"{label}_invalid")
-    return value
-def _oid(value: Any, label: str) -> str:
-    if not isinstance(value, str) or not OID_RE.fullmatch(value): raise PlanError(f"{label}_invalid")
-    return value
-def _walk_forbidden(value: Any) -> None:
-    if isinstance(value, Mapping):
-        for key, item in value.items():
-            if str(key).lower() in FORBIDDEN_KEYS: raise PlanError(f"forbidden_plan_key:{key}")
-            _walk_forbidden(item)
-    elif isinstance(value, list):
-        for item in value: _walk_forbidden(item)
-def _exact_mapping(value: Any, required: set[str], label: str) -> Mapping[str, Any]:
-    if not isinstance(value, Mapping) or set(value) != required: raise PlanError(f"{label}_fields_invalid")
-    return value
-def _secure_json(path: Path) -> dict[str, Any]:
-    try: st = path.lstat()
-    except OSError as exc: raise PlanError(f"plan_unreadable:{path}") from exc
-    if path.is_symlink() or not stat.S_ISREG(st.st_mode): raise PlanError("plan_must_be_regular_file")
-    if st.st_uid != 0 or st.st_mode & 0o022: raise PlanError("plan_ownership_or_mode_invalid")
-    try: value = json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, ValueError) as exc: raise PlanError("plan_json_invalid") from exc
-    if not isinstance(value, dict): raise PlanError("plan_object_required")
-    return value
-@dataclass(frozen=True)
-class TrustedReleasePlan:
-    value: Mapping[str, Any]
-    release_plan_sha256: str
-    @classmethod
-    def from_mapping(cls, raw: Mapping[str, Any]) -> "TrustedReleasePlan":
-        if not isinstance(raw, Mapping) or set(raw) - TOP_LEVEL_KEYS: raise PlanError("release_plan_fields_invalid")
-        required = TOP_LEVEL_KEYS - {"release_plan_sha256"}
-        if set(raw) not in (required, TOP_LEVEL_KEYS): raise PlanError("release_plan_fields_incomplete")
-        _walk_forbidden(raw)
-        if raw.get("schema") != "aios.trusted-release-execution-plan.v1": raise PlanError("release_plan_schema_invalid")
-        version = raw.get("version")
-        if not isinstance(version, str) or not re.fullmatch(r"V[0-9]+R[0-9]+C[0-9]+", version): raise PlanError("version_invalid")
-        if not isinstance(raw.get("candidate_id"), str) or not IDENTIFIER_RE.fullmatch(raw["candidate_id"]): raise PlanError("candidate_id_invalid")
-        for key in ("source_commit","tree_oid","evidence_closure_oid"): _oid(raw.get(key), key)
-        for key in ("artifact_sha256","manifest_sha256","package_closure_sha256","deployment_plan_sha256","policy_sha256","campaign_authorization_sha256"): _sha(raw.get(key), key)
-        for key in ("release_plan_id","approval_plan_id"):
-            if not isinstance(raw.get(key), str) or not PLAN_ID_RE.fullmatch(raw[key]): raise PlanError(f"{key}_invalid")
-        if not isinstance(raw.get("campaign_generation"), int) or raw["campaign_generation"] < 1: raise PlanError("campaign_generation_invalid")
-        artifact = _exact_mapping(raw.get("artifact"), {"path","size"}, "artifact")
-        if not isinstance(artifact["path"], str) or not artifact["path"].startswith("/") or "\\" in artifact["path"]: raise PlanError("artifact_path_invalid")
-        if not isinstance(artifact["size"], int) or artifact["size"] <= 0: raise PlanError("artifact_size_invalid")
-        rollback = _exact_mapping(raw.get("rollback"), {"version","target_oid","artifact_sha256"}, "rollback")
-        if not isinstance(rollback["version"], str) or not rollback["version"] or rollback["version"] == version: raise PlanError("rollback_version_invalid")
-        _oid(rollback["target_oid"], "rollback_target_oid"); _sha(rollback["artifact_sha256"], "rollback_artifact_sha256")
-        baseline = _exact_mapping(raw.get("baseline"), {"version","target_oid"}, "baseline")
-        if baseline["version"] != rollback["version"]: raise PlanError("baseline_rollback_version_mismatch")
-        _oid(baseline["target_oid"], "baseline_target_oid")
-        adapter = _exact_mapping(raw.get("adapter_policy"), {"policy_id","service","port"}, "adapter_policy")
-        if adapter["policy_id"] != "aios.production-adapter.allowlisted.v1": raise PlanError("adapter_policy_invalid")
-        if not isinstance(adapter["service"], str) or not IDENTIFIER_RE.fullmatch(adapter["service"]): raise PlanError("adapter_service_invalid")
-        if not isinstance(adapter["port"], int) or not 1024 <= adapter["port"] <= 65535: raise PlanError("adapter_port_invalid")
-        payload = {key: raw[key] for key in TOP_LEVEL_KEYS if key != "release_plan_sha256"}
-        digest = hashlib.sha256(canonical_json(payload)).hexdigest()
-        if raw.get("release_plan_sha256") is not None and raw["release_plan_sha256"] != digest: raise PlanError("release_plan_sha256_mismatch")
-        return cls(value=dict(payload), release_plan_sha256=digest)
-    @classmethod
-    def load(cls, path: Path) -> "TrustedReleasePlan": return cls.from_mapping(_secure_json(path))
-    @property
-    def candidate_binding_sha256(self) -> str:
-        value = {key: self.value[key] for key in ("candidate_id","source_commit","tree_oid","artifact_sha256","manifest_sha256")}
-        return hashlib.sha256(canonical_json(value)).hexdigest()
-    def as_dict(self) -> dict[str, Any]: return {**dict(self.value),"release_plan_sha256":self.release_plan_sha256,"candidate_binding_sha256":self.candidate_binding_sha256}
-    def assert_binding(self, binding: Mapping[str, Any]) -> None:
-        expected={"version":self.value["version"],"target_oid":self.value["source_commit"],"evidence_closure_oid":self.value["evidence_closure_oid"],"artifact_sha256":self.value["artifact_sha256"],"artifact_size":self.value["artifact"]["size"],"approval_plan_id":self.value["approval_plan_id"]}
-        for key,value in expected.items():
-            if binding.get(key) != value: raise PlanError(f"binding_plan_mismatch:{key}")
-        if binding.get("candidate_id") is not None and binding.get("candidate_id") != self.value["candidate_id"]:
-            raise PlanError("binding_plan_mismatch:candidate_id")
-    def assert_artifact(self, artifact: Mapping[str, Any]) -> None:
-        expected=self.value["artifact"]
-        if artifact.get("sha256") != self.value["artifact_sha256"] or artifact.get("size") != expected["size"]: raise PlanError("artifact_plan_mismatch")
-        if artifact.get("manifest_sha256") != self.value["manifest_sha256"]: raise PlanError("manifest_plan_mismatch")
-        if artifact.get("package_closure_sha256") != self.value["package_closure_sha256"]: raise PlanError("package_closure_plan_mismatch")

active-runtime/app/v2r2c2_health_service.py

@@ -1,5 +0,0 @@
-"""V2R2C2 production health entry point; all identity is plan supplied."""
-from v2r1c6_privacy_tools import main
-
-if __name__ == "__main__":
-    raise SystemExit(main())

config/gitops/trusted-candidate-builder-policy.json

@@ -1,57 +0,0 @@
-{
-  "allowed_peer_cgroups": [
-    "/system.slice/aios-gitops-model-api-v2r2c1-staging.service"
-  ],
-  "allowed_peer_executable_prefix": "/usr/bin/python3",
-  "allowed_peer_runtime_prefix": "/opt/aios/gitops-model-api/",
-  "allowed_peer_runtime_suffix": "/runtime/app/aios_model_api_staging.py",
-  "allowed_peer_uid": 1000,
-  "evidence_layout": {
-    "artifact": "{version}/artifact.tar.gz",
-    "canary": "{version}/canary.json",
-    "gitea": "{version}/gitea.json",
-    "manifest": "{version}/manifest.json",
-    "package_closure": "{version}/checksums.sha256",
-    "policy": "{version}/trusted-release-policy.json",
-    "rollback": "{version}/rollback.json",
-    "secret_scan": "{version}/secret-scan.json",
-    "tests": "{version}/tests.json"
-  },
-  "governed_recipes": {},
-  "maximum_request_age_seconds": 60,
-  "operation": "BuildTrustedCandidateV1",
-  "readiness_operation": "ProbeTrustedCandidateBuilderV1",
-  "recipes": {
-    "V2R2C2": {
-      "base_oid": "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6",
-      "candidate_id": "rc-v2r2c2-d2b5a8339a34",
-      "mode": "fixed",
-      "purpose": "AIOS_TRUSTED_RELEASE_BUILDER",
-      "source_commit": "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6",
-      "task_id": "v12-durable-trusted-release-controller-activation-20260829",
-      "version": "V2R2C2"
-    },
-    "V2R2C3": {
-      "derives_from": "V2R2C2",
-      "mode": "governed-derived-only",
-      "purpose": "AIOS_TRUSTED_RELEASE_BUILDER",
-      "version": "V2R2C3"
-    }
-  },
-  "repository": "aios/aios",
-  "request_schema": "aios.trusted-candidate-builder.request.v1",
-  "request_timeout_seconds": 30,
-  "required_checks": [
-    "authoritative_git",
-    "artifact",
-    "canary",
-    "gitea",
-    "manifest",
-    "package_closure",
-    "rollback",
-    "secret_scan",
-    "tests"
-  ],
-  "response_schema": "aios.trusted-candidate-builder.response.v1",
-  "schema": "aios.trusted-candidate-builder-policy.v1"
-}

config/gitops/trusted-release-policy.json

@@ -1,20 +0,0 @@
-{
-  "authoritative_git_dirs": [
-    "/data/aios-gitops/repo.git"
-  ],
-  "cutover_links": [
-    "/opt/aios/v2r2c2"
-  ],
-  "dropin_paths": [
-    "/var/lib/aios-gitops/release-only/v2r2c2-d2b5a8339a34/payload/deploy/aios-v2/systemd/aios-v2r2c2-production.service"
-  ],
-  "release_roots": [
-    "/var/lib/aios-gitops/release-only"
-  ],
-  "repository_identities": [
-    "aios/aios"
-  ],
-  "services": [
-    "aios-v2r2c2-production.service"
-  ]
-}

db/migrations/20260817_message_handoff.sql

@@ -0,0 +1,36 @@
+-- R4.2 P0-B durable Message/Handoff Fabric.
+-- Forward-only. The existing 20260707 message_outbox remains a compatibility source.
+
+CREATE TABLE IF NOT EXISTS message_handoff (
+  envelope_id TEXT PRIMARY KEY,
+  stream_key TEXT NOT NULL,
+  source TEXT NOT NULL,
+  target TEXT NOT NULL,
+  message_type TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  payload_sha256 TEXT NOT NULL,
+  tenant_id TEXT,
+  user_id TEXT,
+  project_id TEXT,
+  conversation_id TEXT,
+  task_id TEXT,
+  run_id TEXT,
+  causation_id TEXT,
+  sequence INTEGER NOT NULL CHECK(sequence >= 1),
+  capability_scope_json TEXT NOT NULL,
+  confidentiality_scope TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  expires_at TEXT,
+  created_at TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'PENDING',
+  delivered_at TEXT,
+  acked_at TEXT,
+  UNIQUE(stream_key, idempotency_key),
+  UNIQUE(stream_key, sequence)
+);
+
+CREATE INDEX IF NOT EXISTS idx_message_handoff_target_status
+  ON message_handoff(target, status, created_at);
+
+CREATE INDEX IF NOT EXISTS idx_message_handoff_scope
+  ON message_handoff(tenant_id, project_id, user_id, conversation_id, run_id);

deploy/aios-v2/systemd/aios-v2r2c2-production.service

@@ -1,28 +0,0 @@
-[Unit]
-Description=AIOS V2R2C2 governed trusted release health service
-After=network.target
-
-[Service]
-Type=simple
-User=aios-v2r1c7
-Group=aios-v2r1c7
-WorkingDirectory=/opt/aios/v2r2c2
-EnvironmentFile=/etc/aios/v2r2c2.env
-ExecStart=/usr/bin/python3 /opt/aios/v2r2c2/active-runtime/app/v2r2c2_health_service.py --serve --host 127.0.0.1 --port ${AIOS_V2R2C2_PORT}
-Restart=on-failure
-RestartSec=5
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectHome=true
-ProtectSystem=strict
-ProtectKernelLogs=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectControlGroups=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-IPAddressDeny=any
-IPAddressAllow=localhost
-UMask=0077
-
-[Install]
-WantedBy=multi-user.target

deploy/systemd/aios-agent-task-retry-extension.service

@@ -1,20 +1,19 @@
 [Unit]
-Description=AIOS owner-controlled Task initial execution projection API
-After=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
-Wants=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+Description=AIOS owner-controlled Task retry-extension API
+After=aios-agent-task-api.service
+Wants=aios-agent-task-api.service
 
 [Service]
 Type=simple
 User=aios-agent-task
 Group=aios-agent-task
 LoadCredential=agent_task_control_token:/etc/aios-gitops/agent-task-control.token
+EnvironmentFile=/etc/aios-gitops/agent-task-retry-extension.env
 Environment=AIOS_AGENT_TASK_DB=/var/lib/aios-agent-task/state.sqlite3
 Environment=AIOS_AGENT_TASK_CONTROL_TOKEN_FILE=%d/agent_task_control_token
-Environment=AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:18892
-Environment=AIOS_AGENT_TASK_INITIAL_EXECUTION_PROJECTION_AUTHORIZATION_ID=owner-initial-execution-projection-recovery-20260820
-Environment=AIOS_TASK_INITIAL_EXECUTION_PROJECTION_HOST=127.0.0.1
-Environment=AIOS_TASK_INITIAL_EXECUTION_PROJECTION_PORT=18943
-ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_agent_task_initial_execution_projection.py
+Environment=AIOS_TASK_RETRY_HOST=127.0.0.1
+Environment=AIOS_TASK_RETRY_PORT=18941
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_agent_task_retry_extension.py
 Restart=on-failure
 RestartSec=2
 NoNewPrivileges=true

deploy/systemd/aios-approved-release-executor.service

@@ -15,9 +15,17 @@ ExecStart=/usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/a
   --authorization ${AIOS_RELEASE_AUTHORIZATION} \
   --repository ${AIOS_GITOPS_AUTHORITATIVE_GIT_DIR} \
   --state-root ${AIOS_RELEASE_EXECUTION_STATE_ROOT} \
-  --release-plan ${AIOS_RELEASE_PLAN} \
+  --artifact ${AIOS_RELEASE_ARTIFACT} \
+  --artifact-size ${AIOS_RELEASE_ARTIFACT_SIZE} \
+  --version ${AIOS_RELEASE_VERSION} \
+  --target-oid ${AIOS_RELEASE_TARGET_OID} \
+  --evidence-closure-oid ${AIOS_RELEASE_EVIDENCE_CLOSURE_OID} \
+  --artifact-sha256 ${AIOS_RELEASE_ARTIFACT_SHA256} \
+  --approval-plan-id ${AIOS_RELEASE_APPROVAL_PLAN_ID} \
+  --production-service aios-v2r1c7-production.service \
+  --production-port 18927 \
   --tag-adapter /usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/active-runtime/app/governed_tag_adapter.py \
-  --deploy-adapter /usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/active-runtime/app/trusted_production_adapter.py \
+  --deploy-adapter /usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/active-runtime/app/v2r1c7_production_adapter.py \
   --registry-adapter /usr/bin/env AIOS_RELEASE_METADATA_MODE=registry /usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/active-runtime/app/release_metadata_adapter.py \
   --baseline-adapter /usr/bin/env AIOS_RELEASE_METADATA_MODE=baseline /usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/active-runtime/app/release_metadata_adapter.py
 NoNewPrivileges=true

deploy/systemd/aios-chatgpt-bridge-v2-agent-task-projection.conf

@@ -0,0 +1,5 @@
+[Service]
+LoadCredential=agent_task_control_token:/etc/aios-gitops/agent-task-control.token
+Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
+Environment=AIOS_ONLINE_TASK_PROJECTION_ENABLED=1
+Environment=AIOS_AGENT_TASK_CONTROL_TOKEN_FILE=%d/agent_task_control_token

deploy/systemd/aios-chatgpt-bridge-v2-staging.service

@@ -4,32 +4,19 @@ After=network-online.target
 
 [Service]
 Type=simple
-User=aiman
-Group=gitops
-PermissionsStartOnly=true
-WorkingDirectory=@RUNTIME_ROOT@
+User=aios-bridge-staging
+Group=aios-bridge-staging
+WorkingDirectory=/opt/aios/gitops-control-plane/current
 Environment=AIOS_BRIDGE_SCHEMA_VERSION=aios.chatgpt-gitops-bridge.v2
 Environment=AIOS_GITOPS_WRITES_ENABLED=false
 Environment=AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED=true
-Environment=AIOS_GITOPS_WRITES_ENABLED=false
-Environment=AIOS_GITEA_API_BASE=https://g.cnnetmkt.top/git/api/v1
-Environment=AIOS_GITEA_TOKEN_FILE=/run/credentials/aios-chatgpt-bridge-v2-staging.service/gitea_token
-Environment=AIOS_GITEA_REMOTE=gitea-http
-Environment=AIOS_GITOPS_BASELINE_AUTHORITY=/var/lib/aios-gitops/model-api-staging/baseline/current.json
-Environment=AIOS_CONTROL_PLANE_TARGET_VERSION=V2R2C1
-Environment=AIOS_CONTROL_PLANE_TARGET_OID=@SOURCE_OID@
-Environment=AIOS_CONTROL_PLANE_ARTIFACT_SHA256=@ARTIFACT_SHA256@
-Environment=PYTHONPATH=@RUNTIME_ROOT@:@RUNTIME_ROOT@/app:@RUNTIME_ROOT@/runtime-agent-os
 Environment=AIOS_DEPLOYMENT_STATE=STAGING
-LoadCredential=gitea_token:/run/credentials/aios-governance-executor.service/gitea-governance-executor-token
-ExecStartPre=/usr/bin/install -d -o aiman -g gitops -m 0750 /var/lib/aios-gitops/bridge-v2-staging
-ExecStartPre=/usr/bin/setfacl -m u:aiman:--x /usr/local/libexec
-ExecStart=/usr/bin/python3 -B @RUNTIME_ROOT@/app/aios_chatgpt_bridge_v2_server.py
+ExecStart=/usr/bin/python3 /opt/aios/gitops-control-plane/current/bridge-v2-staging-server.py
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=true
-ReadWritePaths=/var/lib/aios-gitops/bridge-v2-staging /data/aios-gitops/repo.git /data/aios-gitops/repo.git/worktrees
+ReadWritePaths=/var/lib/aios-gitops/bridge-v2-staging
 Restart=on-failure
 
 [Install]

deploy/systemd/aios-gitops-model-api-trusted-builder.conf.example

@@ -1,14 +0,0 @@
-# Non-secret activation template for a verified immutable model-api package.
-# Install only through the governed runtime activation procedure.
-[Service]
-Environment=AIOS_GITOPS_WORKSPACE=/opt/aios/gitops-model-api/<VERIFIED_PACKAGE_OID>/runtime
-Environment=AIOS_TRUSTED_CANDIDATE_BUILDER_ENABLED=true
-Environment=AIOS_TRUSTED_CANDIDATE_BUILDER_SOCKET=/run/aios-trusted-candidate-builder.sock
-Environment=AIOS_TRUSTED_CANDIDATE_BUILDER_POLICY=/opt/aios/gitops-model-api/<VERIFIED_PACKAGE_OID>/runtime/config/gitops/trusted-candidate-builder-policy.json
-Environment=AIOS_TRUSTED_CANDIDATE_BUILDER_PUBLIC_KEYRING=/etc/aios-gitops/trusted-builder/public-keyring.json
-Environment=AIOS_TRUSTED_CANDIDATE_BUILDER_CREDENTIALS_DIRECTORY=%d
-Environment=AIOS_SILENT_RELEASE_TRUSTED_POLICY=/opt/aios/gitops-model-api/<VERIFIED_PACKAGE_OID>/runtime/config/gitops/trusted-release-policy.json
-LoadCredential=builder_hmac:/etc/aios-gitops/credential-references/trusted-candidate-builder-hmac
-# The credential source above is a reference only; no secret value belongs here.
-# Keep execution shadow-disabled and do not add Owner/deploy/tag/baseline switches.
-Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false

deploy/systemd/aios-online-agent-isolated-executor.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=AIOS uncredentialed deterministic Planner/Executor
+After=local-fs.target
+
+[Service]
+Type=simple
+User=aios-engineering-executor
+Group=aios-executor-exchange
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_isolated_executor.py --root /var/lib/aios-online-agent-executor
+Restart=always
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateNetwork=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET
+IPAddressDeny=any
+IPAddressAllow=localhost
+InaccessiblePaths=/run/credentials
+ReadWritePaths=/var/lib/aios-online-agent-executor
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-online-agent-worker.service

@@ -0,0 +1,45 @@
+[Unit]
+Description=AIOS governed Online Agent Worker
+After=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+Wants=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+
+[Service]
+Type=simple
+User=aios-engineering-worker
+Group=aios-engineering-worker
+SupplementaryGroups=gitops aios-executor-exchange
+LoadCredentialEncrypted=agent_token:/etc/credstore.encrypted/aios-online-agent-worker-20260815/agent_token
+Environment=PYTHONUNBUFFERED=1
+Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
+Environment=AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:18892
+Environment=AIOS_AGENT_ID=online-engineering-worker
+Environment=AIOS_AGENT_TYPE=trusted-online-engineering-worker
+Environment=AIOS_AGENT_VERSION=2026-08-17.1-dynamic
+Environment=AIOS_WORKER_CAPABILITIES=git.read,git.test,governed.write.branch,governed.write.file
+Environment=AIOS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
+Environment=AIOS_ISOLATED_EXECUTOR_ROOT=/var/lib/aios-online-agent-executor
+Environment=AIOS_WORKER_STATE_ROOT=/var/lib/aios-online-agent-worker
+Environment=AIOS_WORKER_WORKSPACE_ROOT=/var/lib/aios-online-agent-worker/workspaces
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_online_agent_worker.py
+Restart=always
+RestartSec=5
+TimeoutStopSec=20
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadOnlyPaths=/data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-online-agent-worker
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-online-engineering-consumer.service

@@ -0,0 +1,45 @@
+[Unit]
+Description=AIOS trusted dynamic engineering consumer
+After=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+Wants=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+
+[Service]
+Type=simple
+User=aios-engineering-worker
+Group=aios-engineering-worker
+SupplementaryGroups=gitops aios-executor-exchange
+LoadCredentialEncrypted=agent_token:/etc/credstore.encrypted/aios-online-engineering-20260815/agent_token
+Environment=PYTHONUNBUFFERED=1
+Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
+Environment=AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:18892
+Environment=AIOS_AGENT_ID=online-engineering-consumer
+Environment=AIOS_AGENT_TYPE=trusted-online-engineering-worker
+Environment=AIOS_AGENT_VERSION=2026-08-17.1-dynamic
+Environment=AIOS_WORKER_CAPABILITIES=git.read,git.test,governed.write.branch,governed.write.file
+Environment=AIOS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
+Environment=AIOS_ISOLATED_EXECUTOR_ROOT=/var/lib/aios-online-agent-executor
+Environment=AIOS_WORKER_STATE_ROOT=/var/lib/aios-online-engineering-consumer
+Environment=AIOS_WORKER_WORKSPACE_ROOT=/var/lib/aios-online-engineering-consumer/workspaces
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_online_agent_worker.py
+Restart=always
+RestartSec=5
+TimeoutStopSec=20
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadOnlyPaths=/data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-online-engineering-consumer
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-trusted-candidate-builder.service

@@ -1,44 +0,0 @@
-[Unit]
-Description=AIOS trusted candidate builder
-Requires=aios-trusted-candidate-builder.socket
-After=aios-trusted-candidate-builder.socket
-
-[Service]
-Type=simple
-User=root
-Group=root
-UMask=0077
-LoadCredentialEncrypted=signing_private_key:/etc/credstore.encrypted/aios-trusted-candidate-builder/signing_private_key
-LoadCredentialEncrypted=builder_hmac:/etc/credstore.encrypted/aios-trusted-candidate-builder/builder_hmac
-Environment=AIOS_TRUSTED_BUILDER_POLICY=/opt/aios/trusted-candidate-builder/current/config/gitops/trusted-candidate-builder-policy.json
-Environment=AIOS_TRUSTED_BUILDER_GIT_DIR=/data/aios-gitops/repo.git
-Environment=AIOS_TRUSTED_BUILDER_EVIDENCE_ROOT=/var/lib/aios-trusted-candidate-builder/evidence
-Environment=AIOS_TRUSTED_BUILDER_NONCE_LEDGER=/var/lib/aios-trusted-candidate-builder/nonce-ledger.json
-Environment=AIOS_TRUSTED_BUILDER_KEY_ID=builder-attestation-ed25519-g1
-Environment=AIOS_TRUSTED_BUILDER_KEY_GENERATION=1
-Environment=PYTHONDONTWRITEBYTECODE=1
-ExecStart=/usr/bin/python3 -B /opt/aios/trusted-candidate-builder/current/app/aios_trusted_candidate_builder.py --socket-fd 3 --policy ${AIOS_TRUSTED_BUILDER_POLICY}
-Restart=on-failure
-RestartSec=2
-StateDirectory=aios-trusted-candidate-builder
-StateDirectoryMode=0700
-NoNewPrivileges=true
-PrivateTmp=true
-PrivateNetwork=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectControlGroups=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectKernelLogs=true
-RestrictAddressFamilies=AF_UNIX
-LockPersonality=true
-MemoryDenyWriteExecute=true
-RestrictSUIDSGID=true
-SystemCallArchitectures=native
-CapabilityBoundingSet=
-ReadOnlyPaths=/opt/aios/trusted-candidate-builder /data/aios-gitops/repo.git /var/lib/aios-trusted-candidate-builder/evidence
-ReadWritePaths=/var/lib/aios-trusted-candidate-builder
-
-[Install]
-WantedBy=multi-user.target

deploy/systemd/aios-trusted-candidate-builder.socket

@@ -1,13 +0,0 @@
-[Unit]
-Description=AIOS trusted candidate builder AF_UNIX socket
-
-[Socket]
-ListenStream=/run/aios-trusted-candidate-builder.sock
-SocketUser=root
-SocketGroup=gitops
-SocketMode=0660
-RemoveOnStop=yes
-Accept=no
-
-[Install]
-WantedBy=sockets.target

deploy/sysusers.d/aios-online-agent-executor.conf

@@ -0,0 +1,4 @@
+g aios-executor-exchange -
+u aios-engineering-executor - "AIOS isolated engineering executor" /var/lib/aios-online-agent-executor /usr/sbin/nologin
+m aios-engineering-executor aios-executor-exchange
+m aios-engineering-worker aios-executor-exchange

deploy/tmpfiles.d/aios-online-agent-executor.conf

@@ -0,0 +1,5 @@
+d /var/lib/aios-online-agent-executor 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/requests 2770 aios-engineering-worker aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/results 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/failed 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/sources 2770 aios-engineering-worker aios-executor-exchange -

docs/gitops/openapi-chatgpt-actions.yaml

@@ -240,51 +240,115 @@ components:
       additionalProperties: false
       properties:
         candidate_id: {type: string}
-paths:
-  /v2/commit-files:
-    post:
-      operationId: commitFilesGoverned
-      summary: Submit one atomic governed commit containing multiple files
-      requestBody:
-        required: true
-        content:
-          application/json:
+    BridgeWriterLeaseRecoveryRequest:
+      type: object
+      additionalProperties: false
+      required: [schema, task_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds]
+      properties:
         schema:
-              type: object
-              additionalProperties: false
-              required:
-                - task_id
-                - repository
-                - expected_branch_oid
-                - target_branch
-                - generation
-                - idempotency_key
-                - files
-                - message
-              properties:
-                task_id: {type: string}
-                job_id: {type: string, description: External durable Job identity for exact completed-replay reconciliation}
-                source_lease_epoch: {type: integer, minimum: 1}
-                repository: {type: string, example: aios/aios}
+          type: string
+          enum: [aios.task-writer-lease.v2, aios.task-writer-lease-request.v2]
+        task_id: {type: string, minLength: 1, maxLength: 256}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
+        base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
         expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
-                target_branch: {type: string, pattern: '^agent/[A-Za-z0-9._/-]+$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
         generation: {type: integer, minimum: 1}
-                idempotency_key: {type: string}
-                files:
-                  type: array
-                  minItems: 1
-                  items:
+        lease_seconds: {type: integer, minimum: 1, maximum: 86400}
+    BridgeWriterLeaseResponse:
       type: object
       additionalProperties: false
-                    required: [path, content_base64]
+      required: [schema, task_id, job_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds, create_target_branch, worktree_mode, cas_ref_update_required]
       properties:
+        schema: {type: string, enum: [aios.task-writer-lease.v2]}
+        task_id: {type: string}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
+        base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        lease_seconds: {type: integer, minimum: 1, maximum: 86400}
+        create_target_branch: {type: boolean}
+        worktree_mode: {type: string, enum: [detached_at_base_oid, detached_at_expected_head]}
+        cas_ref_update_required: {type: boolean, const: true}
+        lease_expires_at: {type: string, format: date-time}
+    BridgeWriterLeaseRecoveryResponse:
+      type: object
+      additionalProperties: false
+      required: [schema, task_id, job_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds, lease_expires_at, create_target_branch, worktree_mode, cas_ref_update_required, recovered, bootstrapped, idempotent, runtime_rehydrated, durable_branch_lease_present]
+      properties:
+        schema: {type: string, enum: [aios.task-writer-lease.v2]}
+        task_id: {type: string}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
+        base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        lease_seconds: {type: integer, minimum: 1, maximum: 86400}
+        lease_expires_at: {type: string, format: date-time}
+        create_target_branch: {type: boolean, const: false}
+        worktree_mode: {type: string, enum: [detached_at_base_oid, detached_at_expected_head]}
+        cas_ref_update_required: {type: boolean, const: true}
+        recovered: {type: boolean}
+        bootstrapped: {type: boolean}
+        idempotent: {type: boolean}
+        runtime_rehydrated: {type: boolean}
+        durable_branch_lease_present: {type: boolean}
+    BridgeCommitFileRequest:
+      type: object
+      additionalProperties: false
+      required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, path, content_base64, message]
+      properties:
+        task_id: {type: string, minLength: 1}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        idempotency_key: {type: string, minLength: 1, maxLength: 256}
         path: {type: string, minLength: 1, maxLength: 512}
-                      content_base64: {type: string}
+        content_base64: {type: string, format: byte}
         message: {type: string, minLength: 1, maxLength: 200}
-      responses:
-        '200': {description: Governed commit job and verified branch result}
-        '400': {description: Contract or policy rejection}
-        '409': {description: Branch CAS or idempotency conflict}
+    BridgeCommitFilesRequest:
+      type: object
+      additionalProperties: false
+      required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, files, message]
+      properties:
+        task_id: {type: string, minLength: 1}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        idempotency_key: {type: string, minLength: 1, maxLength: 256}
+        files: {type: object, additionalProperties: {type: string, format: byte}, minProperties: 1}
+        message: {type: string, minLength: 1, maxLength: 200}
+    BridgeCommitResponse:
+      type: object
+      additionalProperties: true
+      required: [job_id, commit_oid, commit_visible, branch_mode, target_branch, generation]
+      properties:
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        commit_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        commit_visible: {type: boolean}
+        branch_mode: {type: string, enum: [CONTINUE_EXISTING]}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+    BridgeGovernedCapabilities:
+      type: object
+      required: [bridge_schema_version, governed_writes_enabled, operations, operation_contracts]
+      properties:
+        bridge_schema_version: {type: string, const: aios.chatgpt-gitops-bridge.v2}
+        governed_writes_enabled: {type: boolean, const: true}
+        operations: {type: array, items: {type: string}}
+        operation_contracts: {type: object, additionalProperties: true}
+paths:
   /createReleaseIntent:
     post:
       operationId: createReleaseIntent
@@ -611,3 +675,118 @@ paths:
         '200': {description: Safe GitOps plan}
         '401': {description: Unauthorized}
       x-openai-isConsequential: true
+  /v2/capabilities:
+    get:
+      operationId: getGovernedWriteCapabilities
+      summary: Read the governed Bridge v2 capability contract
+      responses:
+        '200':
+          description: Governed operations and their request/response contracts
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeGovernedCapabilities'}
+  /v2/writer-lease:
+    post:
+      operationId: acquireWriterLease
+      summary: Acquire the exact governed writer lease for a task generation
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
+      responses:
+        '200':
+          description: Exact detached worktree lease binding
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeWriterLeaseResponse'}
+        '400': {description: Invalid lease binding}
+        '409': {description: Branch, base, or generation conflict}
+      x-openai-isConsequential: true
+  /v2/writer-lease/bootstrap:
+    post:
+      operationId: bootstrapWriterLease
+      summary: Bootstrap a governed writer runtime without creating a durable lease
+      description: >
+        Staging-only runtime recovery. It validates the exact task, repository,
+        base OID, expected branch OID, target branch, and generation. It must
+        not create a branch, insert a branch lease, or consume a generation.
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
+      responses:
+        '200':
+          description: Runtime binding bootstrapped or returned idempotently
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryResponse'}
+        '400': {description: Invalid lease binding}
+        '409': {description: A matching durable lease already exists or binding conflicts}
+        '503': {description: Runtime or durable state unavailable}
+      x-openai-isConsequential: true
+  /v2/writer-lease/renew:
+    post:
+      operationId: renewWriterLease
+      summary: Recover an expired governed writer lease without changing its binding
+      description: >
+        Renews only the current task generation and exact repository, base OID,
+        expected branch OID, and target branch. Durable renewal is revision-CAS
+        protected; runtime rehydration is reported separately.
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
+      responses:
+        '200':
+          description: Lease recovered or idempotently observed as already active
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryResponse'}
+        '400': {description: Invalid schema, generation, or lease duration}
+        '409': {description: Task, base, repository, branch, generation, or durable lease conflict}
+        '503': {description: Durable job store or runtime unavailable}
+      x-openai-isConsequential: true
+  /v2/commit-file:
+    post:
+      operationId: commitFileGoverned
+      summary: Commit one file through the governed writer lease
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeCommitFileRequest'}
+      responses:
+        '200':
+          description: Authority and remote visibility receipt
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeCommitResponse'}
+        '409': {description: Lease, expected-head, idempotency, or repository conflict}
+        '503': {description: Reconciliation required}
+      x-openai-isConsequential: true
+  /v2/commit-files:
+    post:
+      operationId: commitFilesGoverned
+      summary: Atomically commit a bounded set of files through the governed writer lease
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeCommitFilesRequest'}
+      responses:
+        '200':
+          description: Authority and remote visibility receipt
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeCommitResponse'}
+        '409': {description: Lease, expected-head, idempotency, or repository conflict}
+        '503': {description: Reconciliation required}
+      x-openai-isConsequential: true

docs/superpowers/specs/2026-08-16-r42-p0a-taskplane-scope-isolation-design.md

@@ -0,0 +1,54 @@
+# R4.2 P0-A TaskPlane Scope Isolation Design
+
+Status: approved candidate design. This document is not evidence of a protected-main merge or production deployment.
+
+## Boundary
+
+- Task: `r42-p0a-taskplane-scope-isolation-20260816`
+- Governed Job: `job-3fd743b51971c6007923699c1233f84c`
+- Repository: `aios/aios`
+- Base: `0eb6e1a864edfdaeef37b438991707a110e21558`
+- Target branch: `agent/r42-p0a-taskplane-scope-isolation-20260816`
+- Generation: `1`
+
+The implementation reuses this exact boundary. It does not create a replacement Task, Job, branch, generation, or idempotency key.
+
+## Model and invariants
+
+`TaskPlan` gains first-class `scope_type`, `tenant_id`, `user_id`, `project_id`, `conversation_id`, and `run_id` fields. The fields participate in accepted-key validation, parsing, serialization, persistence, and authorization.
+
+Historical rows without scope data normalize to `scope_type=legacy`; no tenant is inferred. Tenant-scoped tasks require a non-empty `tenant_id`. System/global resources use an explicit `scope_type=system` invariant and do not receive a fabricated tenant. A task may add user, project, conversation, and run ownership within its tenant.
+
+## Trusted ActorContext
+
+TaskPlane defines a small immutable `TaskActorContext` used only for authorization. The HTTP authenticator returns an identity. `PolicyEngine` resolves that identity through server-owned policy configuration into the effective context and capabilities. Request fields such as `tenant_id`, `user_id`, `group_id`, and `role` are declarations only and never expand authority.
+
+Public create, list, and get paths always use the resolved context. Internal compatibility calls may omit a context and retain explicit legacy behavior, but the HTTP adapter never uses that path.
+
+## Persistence
+
+SQLite remains the current runtime. `_create_schema()` performs an idempotent forward migration that adds the six scope columns and indexes, then backfills only missing `scope_type` values to `legacy`.
+
+New writes persist scope in both the canonical `task_json` representation and first-class columns. Reads accept historical JSON without scope, using legacy columns, but reject a new-row mismatch between JSON and columns. SQL list/get predicates are parameterized and applied before row hydration.
+
+PostgreSQL remains a separate migration target and is not claimed by this change.
+
+## Authorization flow
+
+1. HTTP bearer authentication yields an identity.
+2. `PolicyEngine` verifies capability and resolves the identity to `TaskActorContext`.
+3. Create binds the requested scope to the trusted context and rejects mismatches.
+4. List/get pass the trusted context to `TaskPlaneStore`.
+5. Store applies tenant and ownership predicates in SQL; privileged capabilities may explicitly cross scope.
+
+Tenant actors cannot read legacy tasks, another tenant, or mismatched owned resources. Legacy actors can only read legacy tasks. System actors require explicit privileged capability for cross-scope access.
+
+## Failure behavior
+
+Missing tenant scope, forged scope, unknown scope types, JSON/column divergence, and unauthorized list/get operations fail closed with canonical TaskPlane errors. Public get does not reveal whether an out-of-scope task exists.
+
+## Verification
+
+Tests exercise real model round trips, SQLite migration/restart, Service/Policy/Store wiring, tenant A versus tenant B list/get denial, ownership filtering, forged create payload rejection, legacy isolation, privileged access, and SQL parameterization. Existing TaskPlane API, RBAC, recovery/security, and security-contract suites remain mandatory.
+
+The candidate is complete only after real `TASK_CLAIMED`, `TASK_HEARTBEAT`, exact WriterLease, governed commit, OID convergence, result submission, and `TASK_VERIFIED`. Protected main and production remain unchanged.

docs/superpowers/specs/2026-08-17-online-agent-auto-claim-design.md

@@ -0,0 +1,134 @@
+# Online Agent Automatic Claim Infrastructure
+
+## Status and fixed boundary
+
+This candidate targets `p0-claim-online-agent-auto-execution-20260817` on governed Job
+`job-2031a9e5682a4238f98e3ac7aee8a593`, base
+`a642b045775b9154a00ae78543037fbef4fb447b`, target branch
+`agent/p0-claim-online-agent-auto-execution-20260817`, generation 1.
+
+It does not authorize protected-main, Production, tag, baseline, raw Git, Task DB, or
+credential mutations.
+
+## Considered approaches
+
+1. Require every caller to write `metadata.execution`. This is simple but preserves the
+   current operational gap: a valid governed Job can still project an unexecutable Online
+   Task.
+2. Let workers infer repository and WriterLease coordinates from natural-language Task
+   fields. This removes the skip but violates fail-closed lineage and can bind the wrong Job,
+   branch, base, or generation.
+3. Use a canonical server-side projector plus a task-agnostic worker resolver. This is the
+   selected approach. The governed binding remains the only authority for repository, Job,
+   branch, base, expected head, generation, and idempotency. Producers can persist the
+   projected envelope when creating the Online Task. A worker may recover an omitted envelope
+   only from the same canonical projector and durable binding; it never guesses coordinates.
+
+## Components
+
+### Canonical execution contract
+
+`aios_online_agent_execution.py` owns schema `aios.online-agent.execution.v2`. It validates
+the complete governed lineage and supports two explicit actions:
+
+- `deterministic`: a hash-bound change set, verification commands, and governed commit;
+- `source_capture`: a read-only first attempt that returns `NEEDS_REWORK_SOURCE_CAPTURE` and
+  cannot acquire WriterLease or mutate Git.
+
+Wrong task, Job, repository, base, expected head, branch, generation, capability scope, or
+governance policy fails closed with a canonical diagnostic.
+
+### Governed Job to Online Task projection
+
+`GovernedTaskBootstrap` exposes an exact durable binding lookup and builds Online Task
+projection data through the canonical contract. When the Bridge is configured with the
+official Agent Task control credential reference, governed Job creation submits that complete
+projection through the official Task HTTP API. The Bridge also exposes a loopback envelope
+projection operation used for recovery. The persisted projection includes the versioned
+envelope rather than relying on manual metadata edits.
+
+Projection delivery is a durable outbox, not a best-effort tail call. The outbox record is
+written before HTTP delivery and a Bridge reconciler retries it after transient API failure or
+process restart. A response is accepted only when its complete execution envelope equals the
+submitted projection. Requests that explicitly require projection are rejected before governed
+bootstrap when the projection principal is unavailable.
+
+Loopback is not treated as an identity boundary. Every POST route requires an exact
+runtime-principal bearer credential supplied by systemd credential projection; unauthenticated
+local callers are denied before request dispatch. The control-plane credential used to create
+Online Tasks remains a separate Bridge-only reference and is never projected into the worker.
+
+For legacy Online Tasks with an omitted envelope, the generic worker asks the same Bridge
+operation for a read-only `source_capture` envelope. Projection succeeds only when the exact
+durable binding exists. An omitted envelope is therefore recoverable; an invalid envelope is
+never replaced or weakened.
+
+Persisted envelopes are also reprojected through the Bridge before claim and compared by exact
+digest and Job lineage. A self-consistent client-generated envelope is therefore not authority.
+
+### Dynamic worker and trusted consumer
+
+The repository gains a deployable generic worker and systemd unit definitions as governed
+source files. The worker validates or
+resolves an envelope before claim, revalidates after atomic claim, starts heartbeat, and then
+executes the selected action. The trusted engineering consumer uses this same task-agnostic
+entrypoint. No compiled worker contains a Task ID, base OID, branch, generation, or plan path.
+
+Skip observability distinguishes:
+
+- `TASK_SKIPPED_PROJECTION_MISSING`;
+- `TASK_SKIPPED_ENVELOPE_INVALID`;
+- `TASK_SKIPPED_CAPABILITY_MISMATCH`;
+- `TASK_SKIPPED_POLICY_DENY`;
+- `TASK_POLL_FAILED` / worker unavailable.
+
+## State flow
+
+```text
+Governed Job BOUND
+  -> canonical durable binding
+  -> Online Task projection with execution.v2
+  -> capability-filtered poll
+  -> envelope and lineage validation
+  -> atomic claim
+  -> initial heartbeat/start
+  -> refetch Task and re-resolve envelope
+  -> compare execution digest and Job
+  -> source capture OR deterministic governed execution
+  -> result construction
+  -> result submission
+  -> external server-side verification gate
+```
+
+Legacy omission uses `binding -> source_capture projection` between poll and validation. It
+does not write Task metadata and does not convert a malformed envelope into a valid one.
+
+## Recovery and safety
+
+- Projection is deterministic and digest-bound.
+- Governed Task creation is serialized by a cross-process, Task-ID-digest lock. Durable paths
+  use collision-resistant exact Task keys while retaining read compatibility with verified
+  legacy bindings.
+- A new Task cannot adopt an existing branch from caller-selected generation data. It must name
+  an exact durable parent Task/Job whose single ACTIVE lease owns the branch head; generation is
+  then derived from that lease.
+- Claim is attempted only after validation; claimed payload drift is denied.
+- Source capture has no WriterLease or commit path.
+- Deterministic execution retains detached worktree, exact WriterLease, governed commit,
+  durable current-head CAS, and receipt convergence.
+- Local deterministic recovery is keyed by Task and execution digest; live acceptance must
+  independently reconverge Job, lease, receipt, and branch OIDs before verification.
+- An ambiguous commit transport or server outcome becomes `RECONCILIATION_REQUIRED`; the
+  worker does not submit a canonical failure until exact Job receipt and head evidence is
+  observed.
+- A completed read-only `source_capture` state is ignored when a later attempt has a changed
+  digest and no governed state exists; all other digest drift is denied.
+- Protected refs are never worker targets.
+
+## Acceptance
+
+The implementation must pass the named projection, schema, claimability, dynamic-binding,
+wrong-lineage, capability, P0-A, and P0-B tests. Runtime acceptance additionally requires a
+real Online Task to be claimed and heartbeated without per-task worker or systemd plan
+injection, plus governed receipt/OID/CAS convergence for this implementation Task.
+Unit tests and deployable unit definitions do not by themselves satisfy runtime acceptance.

docs/superpowers/specs/2026-08-17-p0-claim-scheme-a-followup.md

@@ -0,0 +1,56 @@
+# P0-CLAIM Scheme A follow-up
+
+This follow-up continues the existing candidate `71523aef6e48b1e2fa516c456ca189b7a039104b`.
+It does not create a replacement Task, Job, branch or generation.
+
+## Retry extension
+
+A versioned Owner-controlled loopback API provides
+`POST /v1/tasks/{task_id}/retry-extension`.
+
+The request binds FAILED status, revision, exhausted attempt/max_attempts, next max attempts,
+previous verification SHA256, Owner authorization ID and idempotency key. The service performs one
+SQLite `BEGIN IMMEDIATE` transaction containing the CAS update, durable retry-extension record and
+Task event. Each authorization extends the boundary by exactly one attempt.
+
+## Same-Job continuation
+
+The durable GovernedTask binding remains the lineage anchor. After the first CREATE_NEW commit,
+`execution_binding()` may normalize that SAME Job to `CONTINUE_EXISTING` only when exactly one
+ACTIVE WriterLease for the Job owns the current authority branch head, generation and lineage
+anchor. The lineage `base_oid` stays unchanged; only `expected_branch_oid` becomes the current head.
+
+GovernedTask creation is also serialized by a branch-digest lock, preventing sibling continuation
+tasks from racing generation admission.
+
+## Projection and recovery
+
+Natural-language source signals are normalized server-side to at most 16 unique 512-byte values.
+Malformed persisted envelopes still fail closed.
+
+Fresh commits and recovery require a COMPLETED Job, `remote_verified=true`, exact
+authority/API/remote receipt OIDs, and exactly one ACTIVE WriterLease whose durable current head
+matches the commit. Delayed local ref visibility becomes `RECONCILIATION_REQUIRED`, not a terminal
+canonical failure.
+
+## Credential isolation
+
+The credentialed Coordinator performs only Task/Bridge coordination and governed commit. All
+deterministic repository modification and test commands run in
+`aios-online-agent-isolated-executor` under a separate system user with:
+
+- no Agent/Owner credential projection;
+- no gitops supplementary group;
+- `PrivateNetwork=true`;
+- `RestrictAddressFamilies=AF_UNIX AF_INET`, with `IPAddressDeny=any` and
+  `IPAddressAllow=localhost`, so regression tests may use an isolated loopback
+  HTTP server without gaining host or external network reachability;
+- `InaccessiblePaths=/run/credentials`.
+
+The executor receives a hash-bound source archive and deterministic change set through a filesystem
+exchange and returns only changed file bytes/hashes plus command evidence. The Coordinator validates
+that response before materializing exact allowed files and calling the governed Bridge.
+
+Codex/Hermes mutation adapters remain disabled until a separately audited uncredentialed planner
+backend exists. Under the current operating model, implementation code is authored before Online
+Agent execution and is carried as a deterministic plan.

docs/task-plane/r42-p0a-scope-isolation.md

@@ -0,0 +1,9 @@
+# R4.2 P0-A TaskPlane Scope Isolation
+
+Status: candidate implementation. This is not proof of protected-main promotion or production deployment.
+
+Task scope is now represented by `scope_type`, `tenant_id`, `user_id`, `project_id`, `conversation_id`, and `run_id` in the model and SQLite persistence. Historical rows become `legacy`; their tenant is never guessed. Tenant tasks require `tenant_id`. System resources use `scope_type=system` without a fabricated tenant.
+
+The HTTP adapter uses the authenticated identity. `PolicyEngine` resolves that identity through server-owned `identity_actor_contexts`; request payload fields do not grant scope. Public create binds the trusted scope, and public list/get apply parameterized scope predicates in `TaskPlaneStore`.
+
+SQLite is the current runtime database. PostgreSQL remains a separate migration and runtime-acceptance gate.

docs/task-plane/r42-p0b-message-handoff-fabric.md

@@ -0,0 +1,38 @@
+# R4.2 P0-B — Durable Message / Handoff Fabric
+
+Status: candidate implementation; not evidence of protected-main merge or Production deployment.
+
+`MessageEnvelope` is the single durable handoff identity and carries source/target/type, tenant/user/
+project/conversation/task/run scope, causation, sequence, capability scope, confidentiality scope,
+idempotency key, expiry and delivery state.
+
+Identity includes **target + scope + sequence + idempotency key + payload hash**, fixing the existing
+AgentEventBus target collision. Server ActorContext is authoritative; caller scope may narrow but may
+not widen/forge trusted tenant/user/project/conversation/run fields.
+
+`DurableHandoffStore` provides SQLite durability in the current runtime. Each logical stream has
+unique `(stream_key, idempotency_key)` and `(stream_key, sequence)`. Exact retry returns `REPLAY`;
+changed payload under the same key is rejected; sequence gaps are rejected; expired messages are not
+delivered.
+
+Confidentiality scopes:
+
+- public: no tenant requirement
+- tenant: same tenant
+- project: same tenant + project
+- private: same tenant + project + user
+- run: same tenant + project + user + run
+
+Required `capability_scope` must be present on the authenticated delivery actor unless the actor is
+explicitly administrative.
+
+Compatibility adapters convert AgentEventBus events, TaskPlane CloudEvents and legacy Agent OS
+MessageBus messages into the durable envelope. Existing message_outbox remains intact as a migration
+source; P0-B does not delete or silently rewrite it.
+
+Required gates:
+`MESSAGE_SCOPE_MISMATCH_DENY`, `MESSAGE_TARGET_COLLISION_DENY`, `MESSAGE_IDEMPOTENCY_REPLAY`,
+`MESSAGE_SEQUENCE_GAP_DETECT`, `MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE`,
+`HANDOFF_CROSS_TENANT_DENY`, plus existing P0-A TaskPlane scope/security regressions.
+
+SQLite remains current runtime persistence. PostgreSQL remains a separate migration gate.

ops/gitops-migration/bind_external_action_surface_final_staging.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-umask 027
-
-ROOT="/data/aios-gitops"
-NGINX_SITE="/etc/nginx/sites-enabled/aios-user-portal.conf"
-STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
-BACKUP_DIR="$ROOT/backups/action-surface-final-$STAMP"
-LOG="$ROOT/logs/action-surface-final-$STAMP.log"
-
-mkdir -p "$BACKUP_DIR" "$ROOT/logs"
-exec > >(tee -a "$LOG") 2>&1
-
-sudo cp -a "$NGINX_SITE" "$BACKUP_DIR/aios-user-portal.conf"
-SITE_BACKUP="$BACKUP_DIR/aios-user-portal.conf"
-
-python3 - "$SITE_BACKUP" "$BACKUP_DIR/aios-user-portal.conf.next" <<'PY'
-from pathlib import Path
-import sys
-
-source, output = map(Path, sys.argv[1:])
-text = source.read_text(encoding="utf-8")
-marker = "    # AIOS external Action governed-read ownership"
-if marker in text:
-    raise SystemExit("governed-read locations already present in backup")
-block = r'''    # AIOS external Action governed-read ownership
-    # These reads are owned by the authenticated 18890 facade, not the 18893 model API.
-    location = /api/governed-write-capabilities {
-        proxy_pass http://127.0.0.1:18890/api/governed-write-capabilities;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Authorization $http_authorization;
-        proxy_set_header X-AIOS-Token $http_x_aios_token;
-    }
-    location = /api/control-plane-snapshot {
-        proxy_pass http://127.0.0.1:18890/api/control-plane-snapshot;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Authorization $http_authorization;
-        proxy_set_header X-AIOS-Token $http_x_aios_token;
-    }
-    location = /api/online-agent-task {
-        proxy_pass http://127.0.0.1:18890/api/online-agent-task;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Authorization $http_authorization;
-        proxy_set_header X-AIOS-Token $http_x_aios_token;
-    }
-    location = /api/online-agent-task-events {
-        proxy_pass http://127.0.0.1:18890/api/online-agent-task-events;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Authorization $http_authorization;
-        proxy_set_header X-AIOS-Token $http_x_aios_token;
-    }
-'''
-needle = "    location /api/ {"
-if text.count(needle) != 1:
-    raise SystemExit("expected exactly one generic /api/ location")
-text = text.replace(needle, block + "\n" + needle, 1)
-output.write_text(text, encoding="utf-8")
-PY
-
-sudo cp "$BACKUP_DIR/aios-user-portal.conf.next" "$NGINX_SITE"
-sudo nginx -t
-sudo systemctl reload nginx
-
-printf 'ACTION_SURFACE_FINAL_OK backup=%s log=%s\n' "$BACKUP_DIR" "$LOG"

recovery/v2r2c2-canonical-task-projection-recovery.json

@@ -1,121 +0,0 @@
-{
-  "schema": "aios.canonical-task-projection-intent.v1",
-  "projection_id": "projection-v2r2c2-parent-recovery-20260826",
-  "projection_generation": 1,
-  "idempotency_key": "projection-v2r2c2-parent-recovery-20260826-v1",
-  "task": {
-    "task_id": "TASK-CONV-V2R2C2-RECONCILE-SNAPSHOT-20260826",
-    "goal": "Complete V2R2C2 staging-only control-plane convergence and repair the control-plane self-recovery defect exposed by the missing canonical Task projection.",
-    "instructions": "Resume the immutable runbook at runbooks/agent-v2r2c2-control-plane-convergence-20260825.md from branch agent/v2r2c2-convergence-integration-20260825. Preserve the parent task/job/generation/branch/OID. Complete canonical projection, worker claim, execution binding, heartbeat, WriterLease/CAS, required convergence code, tests, immutable staging build/deploy, first acceptance, restart-persistent second acceptance, and governed Evidence Closure. Recovery subgraphs must return to the parent goal. Never mutate main, V2R2C1 protected tag, production baseline, or production services.",
-    "success_criteria": [
-      {
-        "id": "control_plane_self_recovery",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "canonical_task_projection",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "worker_execution_path",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "writer_path",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "governed_mutation",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "v2r2c2_code",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "tests",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "staging_deployment",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "runtime_component_drift",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "release_consistency",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "tag_publication",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "release_acceptance",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "restart_persistence",
-        "required": true,
-        "expected": "PASS"
-      },
-      {
-        "id": "evidence_closure",
-        "required": true,
-        "expected": "PASS"
-      }
-    ],
-    "constraints": {
-      "staging_only": true,
-      "production_write": false,
-      "main_direct_write": false,
-      "protected_tag_write": false,
-      "baseline_write": false,
-      "force_push": false,
-      "direct_task_db_write_outside_task_plane": false,
-      "secret_exposure": false,
-      "return_to_parent_after_recovery": true
-    },
-    "required_capabilities": [],
-    "metadata": {
-      "parent_goal": "V2R2C2 staging-only control-plane convergence",
-      "governed_task_id": "TASK-CONV-V2R2C2-RECONCILE-SNAPSHOT-20260826",
-      "bridge_job_id": "job-9eee1142f2fc8bb7b571d065c01f40e0",
-      "recovery_reason": "MISSING_DURABLE_CANONICAL_TASK_PROJECTION_RECOVERY",
-      "runbook_ref": "runbooks/agent-v2r2c2-control-plane-convergence-20260825.md",
-      "runbook_oid": "2afc2cf41fc9090cf01e3882d1b8db8d54cf1844",
-      "runbook_sha256": "a500504a76fb99b26541eaf4edd842a942992ae170fc0f3838530189ca672320"
-    },
-    "priority": 100,
-    "max_attempts": 20,
-    "deadline": null
-  },
-  "governed_binding": {
-    "governed_task_id": "TASK-CONV-V2R2C2-RECONCILE-SNAPSHOT-20260826",
-    "bridge_job_id": "job-9eee1142f2fc8bb7b571d065c01f40e0",
-    "repository": "aios/aios",
-    "branch": "agent/v2r2c2-convergence-integration-20260825",
-    "generation": 2,
-    "base_oid": "2afc2cf41fc9090cf01e3882d1b8db8d54cf1844",
-    "expected_branch_oid": "2afc2cf41fc9090cf01e3882d1b8db8d54cf1844"
-  },
-  "source_artifact": {
-    "ref": "git:2afc2cf41fc9090cf01e3882d1b8db8d54cf1844:runbooks/agent-v2r2c2-control-plane-convergence-20260825.md",
-    "sha256": "a500504a76fb99b26541eaf4edd842a942992ae170fc0f3838530189ca672320"
-  },
-  "task_payload_sha256": "dcc293ffcd9db36ea8dd35b79a15e77cca57ee4ad5d6f976e24ee454d46eb0c9"
-}

release_version.py

@@ -1,21 +0,0 @@
-"""Canonical AIOS release-version parser shared by runtime and release tools."""
-from __future__ import annotations
-
-import re
-
-
-# The suffix preserves already-supported annotated release names while the
-# canonical VnRnCn namespace remains accepted exactly.
-RELEASE_VERSION_PATTERN = r"^V[0-9]+R[0-9]+C[0-9]+(?:-[A-Za-z0-9_.-]+)?$"
-RELEASE_VERSION_RE = re.compile(RELEASE_VERSION_PATTERN)
-
-
-def parse_release_version(version: object) -> str:
-    value = str(version or "").strip()
-    if not RELEASE_VERSION_RE.fullmatch(value):
-        raise ValueError("invalid release version")
-    return value
-
-
-def validate_release_version(version: object) -> str:
-    return parse_release_version(version)

reports/action-contract-regression-remediation-20260825.md

@@ -1,75 +0,0 @@
-# Action Contract Regression Remediation — 2026-08-25
-
-## Scope
-
-Governed task: `fix-action-contracts-20260825-1407`
-Base: `3244f0f17f8845592ac94d585f5ebd65693c9f29`
-Target branch: `agent/fix-action-contracts-20260825-1407`
-
-## Verified regressions
-
-1. `getReleaseConsistency` and `runReleaseAcceptance` fail before evaluation with:
-   `Gitea API URL must be HTTP(S)`.
-   V2R2C1 release evidence at `a8b906d1bc24088c19647e98de6a679268f6d0a2`
-   proves Gitea API readback passed for target `998d30304787e31e5ae607c0bd86b5edb2b0e5ad`.
-   Therefore current staging/contract overlay configuration has regressed.
-
-2. `getReleaseSaga` fails with:
-   `Permission denied: '/var/lib/aios-gitops/silent-release'`.
-   Runtime service identity must have read/traverse access to the durable release state root.
-   Fix ownership/group/ACL at deployment time; do not broaden to world-writable permissions.
-
-3. `getTagPublicationStatus` rejects the authoritative approved version `V2R2C1`
-   as `invalid release version`, while `getGovernedWriteCapabilities` returns the same
-   version as the approved release scope. The two Action contracts are internally inconsistent.
-   Release-version validation must accept the canonical AIOS `^V[0-9]+R[0-9]+C[0-9]+$`
-   namespace (or, preferably, use one shared validator for all release Actions).
-
-4. `commitFilesGoverned` is unusable from the published Action schema.
-   Runtime capability metadata declares required fields:
-   `task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, files, message`,
-   but the exposed tool contract has no `files` input. Regenerate/publish the Action schema from
-   the same operation contract source and add a contract-parity test.
-
-5. `reconcileGitOpsJob` returned `DURABLE_BINDING_INVALID` for a completed governed
-   single-file job that was otherwise read back as `COMPLETED`.
-   Reconciliation of a valid terminal job should be idempotent/read-only and must not require
-   a stale or absent active lease. Add a regression case for terminal completed jobs.
-
-6. `getDiff` returns `ResponseTooLargeError` / `GIT_OUTPUT_LIMIT_EXCEEDED` for large diffs.
-   Add server-side bounded output: path/stat summary plus truncation metadata, or pagination.
-   The Action must never fail merely because a valid repository diff is large.
-
-## Required implementation changes
-
-- Centralize release-version parsing and reuse it in tag status, candidate, consistency, and acceptance.
-- Validate/normalize Gitea API URL at service startup and fail health checks with a configuration-specific diagnostic.
-- Ensure the deployment unit projects a valid HTTP(S) Gitea API base URL into the staging overlay.
-- Correct durable release-state directory ownership/ACL for the runtime service account.
-- Generate the external Action schema from the runtime operation contract; parity-test required fields.
-- Make terminal reconciliation idempotent and independent of expired active writer leases.
-- Bound diff output and return `truncated=true` with deterministic metadata rather than transport failure.
-
-## Acceptance gates
-
-All must pass on the same deployed overlay:
-
-- `getReleaseConsistency(V2R2C1, 998d303..., a8b906d..., approved_plan)` returns a structured result, not URL error.
-- `runReleaseAcceptance(...)` reaches policy evaluation, not URL error.
-- `getTagPublicationStatus("V2R2C1")` returns structured publication state.
-- `getReleaseSaga(nonexistent_candidate)` returns NOT_FOUND/empty-state semantics, never filesystem permission failure.
-- Published `commitFilesGoverned` schema exposes `files` and a two-file isolated branch commit succeeds.
-- Reconcile of a completed governed job is idempotent.
-- Large diff returns bounded/truncated data rather than transport exception.
-- Existing protected-ref controls remain unchanged: no direct main/tag/baseline/production write.
-
-## Proven stable reference
-
-V2R2C1 evidence closure (`a8b906d1bc24088c19647e98de6a679268f6d0a2`) records:
-- Gitea Git/API readback PASS
-- staging runtime PASS
-- restart recovery PASS
-- 59 mandatory tests passed / 0 failed
-
-This evidence should be used as the compatibility baseline when repairing the current
-`contract-overlay-v2` / `scheme-a-323b615b...` staging layer.

reports/action-contract-repair-evidence-20260825.md

@@ -1,80 +0,0 @@
-# AIOS Action contract repair evidence — 2026-08-25
-
-## Disposition
-
-Final disposition: `NEEDS_REWORK`.
-
-The contract repair is deployed to staging and the focused acceptance checks are green. The task is not eligible for `SUCCEEDED`: `runReleaseAcceptance` returns structured policy output with `accepted=false` because the existing publication state for protected tag `V2R2C1` is `REMOTE_PUSH_PENDING`, and the repository-wide suite still has the two pre-existing signer/event-bus failures recorded below. The online Task API row is still `QUEUED`; it was not changed by direct database manipulation or an unauthorized synthetic claim/result.
-
-No production release, `main`, release tag, baseline registry, or production service was directly modified.
-
-## Scope and pre-change facts
-
-- Repository: `aios/aios`; governed branch: `agent/fix-action-contracts-20260825-1407`.
-- Initial task branch HEAD: `35eec9afe1432e8466d60040b2fb1049bb41242a`.
-- Stable reference: `V2R2C1`; source commit `998d30304787e31e5ae607c0bd86b5edb2b0e5ad`; evidence closure `a8b906d1bc24088c19647e98de6a679268f6d0a2`.
-- Pre-change refs: authority `main=3244f0f17f8845592ac94d585f5ebd65693c9f29`, tag `V2R2C1=07fc2746b688f5f243f29b39de39f32edc3dd9d2`; these remained unchanged.
-- Staging services run as `User=aiman`, `Group=gitops`. The actual staging Gitea API base is `https://g.cnnetmkt.top/git/api/v1`, supplied by systemd environment rather than business-code host constants.
-- Pre-change full test baseline: `707 passed, 2 skipped, 154 subtests passed, 2 failed`. The failures were the stale `/tmp/aios-agent-events-test` event-bus fixture and the real signer self-test.
-
-## Root causes and repairs
-
-1. Gitea URL validation occurred at release-operation time while the staging overlay's API environment was not consistently projected into all runtime paths. The canonical HTTP(S) validator is now called during model and Bridge startup; `getReleaseConsistency` and `runReleaseAcceptance` use the actual staging environment URL.
-
-2. `silent-release` was not consistently writable by the real service identity, and the credential helper parent directory blocked `aiman` traversal. The persisted staging systemd overlay creates the state directory as `aiman:gitops` mode `0750` and grants only `u:aiman:--x` on `/usr/local/libexec`; no world-writable mode was used. The staging bridge also has the minimum repository write path required by the governed AuthorityGitExecutor/CAS flow.
-
-3. Release version parsing was split across callers and rejected `V2R2C1`. A shared canonical parser now accepts `^V[0-9]+R[0-9]+C[0-9]+$` plus the existing bounded suffix form, and is used by capabilities, release candidate, consistency, acceptance, tag publication, and release/tag queries.
-
-4. The runtime operation contract required `files` but the published Action schema omitted it. `commitFilesGoverned` now has one contract source and published schema projection, with parity tests. A real governed two-file commit completed on isolated branch `agent/action-contract-integration-20260825-1407`; authority, Git remote, and Gitea API all read back OID `0345cd8c70967940bc8e9132dff7d6ea11efa304`.
-
-5. `reconcileGitOpsJob` reconstructed active lease state before checking terminal state. Terminal `COMPLETED`, `FAILED`, and `CANCELLED` jobs now short-circuit to idempotent read-back; active jobs retain strict lease validation. The two-file job reconciled as `COMPLETED` and a second reconcile returned the same receipt.
-
-6. `getDiff` returned unbounded patch data and could fail the transport. It now returns identities, changed paths, stats, total bytes, bounded patch output, patch limit, and `truncated`. The large smoke returned `total_size_bytes=350222`, `stdout_bytes=262144`, `patch_limit_bytes=262144`, `truncated=true`; no `ResponseTooLargeError` or `GIT_OUTPUT_LIMIT_EXCEEDED` escaped.
-
-During live integration, two additional staging-only contract defects were found and repaired: CREATE_NEW branch normalization/CAS recovery, and release executor projection of the configured staging baseline plus immutable runtime `versions/V2R2C1.json`. The latter removed the missing publication-workspace baseline/version errors without writing production state.
-
-## Source, test, and operational changes
-
-Source commits on the governed branch include the six contract repairs, focused regression tests, `versions/V2R2C1.json`, governed CREATE_NEW/reconcile recovery, and final runtime projection commits. The final source before this evidence commit is `2ec49005bde44f6981b14351500847d594e0276c`.
-
-The runbook update is in `runbooks/agent-fix-action-contracts-20260825.md`. This report is the required durable evidence artifact. Existing untracked `runtime/agent-observability/` and `runtime/task-center/` directories were preserved and were not staged.
-
-Tests run on the final source:
-
-```text
-PYTHONPATH=active-runtime/app python3 -m pytest -q tests/test_silent_release_execution_readiness.py tests/test_silent_release_controller.py tests/test_silent_release_hardening.py tests/test_silent_release_production_contract.py tests/test_chatgpt_actions_tag.py tests/test_gitea_tag_publication.py tests/test_authoritative_git_context.py
-264 passed, 28 subtests passed in 4.78s
-
-PYTHONPATH=active-runtime/app python3 -m pytest -q tests
-717 passed, 2 skipped, 154 subtests passed, 2 failed in 33.98s
-```
-
-The full-suite failures remain the known event-bus fixture failure and the real signer adapter self-test (`returncode=42`); no new mandatory-suite regression was observed. Focused contract/reconcile tests and the exact mandatory suite passed.
-
-## Staging deployment identity
-
-- Final deployed source OID at the last completed runtime smoke: `2ec49005bde44f6981b14351500847d594e0276c`.
-- Final deployed artifact: `/opt/aios/gitops-model-api/2ec49005bde44f6981b14351500847d594e0276c-action-contract-repair/runtime`.
-- Artifact SHA256: `f67aed6cc0cce1f08197485c3eea204d3ef4d3989f44dc98e8ea2691e5886cbf`.
-- Deployment state: `STAGING`; production-deployed flag: `false`.
-- A lexically highest staging-only systemd drop-in was installed for each affected service, followed by `daemon-reload` and restart. `systemctl is-active` returned `active` for both services, and `systemctl show` confirmed the final OID, artifact SHA, API URL, and baseline authority.
-
-## Runtime smoke evidence
-
-- Model health returned `status=ok`, `version=V2R2C1`, final commit/artifact identity, `deployment_state=STAGING`, and `production_deployed=false`.
-- Bridge/API readback was available; the bridge's `/health` path is not exposed by this runtime and returned `404`, while its governed endpoints were healthy.
-- `getReleaseConsistency("V2R2C1", ...)` returned structured `status=PASS`, with Gitea listing/peeled target and tag object matching the stable reference.
-- `runReleaseAcceptance(...)` entered policy evaluation and returned structured `accepted=false`; it did not fail URL validation. The independent pre-existing tag publication state is `REMOTE_PUSH_PENDING`, with the remote rejection explicitly reporting protected tag `V2R2C1`.
-- `getTagPublicationStatus("V2R2C1")` returned structured `REMOTE_PUSH_PENDING`, not `invalid release version`.
-- `getReleaseSaga` for a nonexistent candidate returned HTTP `404` with `status=NOT_FOUND`, `state=NOT_FOUND`, `execution_enabled=false`, and no filesystem permission error.
-- `commitFilesGoverned` published schema includes required `files`, with per-file `path` and `content_base64`.
-- Two-file governed commit: branch `agent/action-contract-integration-20260825-1407`, OID `0345cd8c70967940bc8e9132dff7d6ea11efa304` at authority/Git remote/API; protected-ref flags remained false.
-- Terminal reconcile: `COMPLETED` read-back was idempotent across two calls; focused tests cover `FAILED` and `CANCELLED` terminal semantics.
-- Small diff returned bounded non-truncated output; empty diff returned zero paths and zero bytes; large diff returned bounded/truncated output as recorded above.
-- Main, protected tag, baseline registry, and production OIDs were re-read after deployment and remained unchanged.
-
-## Restart persistence and remaining risk
-
-The final staging services were restarted after deployment and health/runtime identity were re-read. The post-restart `systemctl is-active` result was `active` for both services; model health again reported OID `2ec49005bde44f6981b14351500847d594e0276c`, artifact SHA `f67aed6cc0cce1f08197485c3eea204d3ef4d3989f44dc98e8ea2691e5886cbf`, staging mode, and `production_deployed=false`. Post-restart consistency remained `PASS`, acceptance remained structured `accepted=false` for the pre-existing protected-tag publication state, saga remained `NOT_FOUND` for the nonexistent candidate, and the large diff remained bounded/truncated. The task cannot be promoted to `SUCCEEDED` until the protected-tag publication state and the two known repository-wide failures are resolved through their respective governed owners. No automatic rollback was performed because the staging services stayed healthy, mandatory tests passed, Gitea readback passed, and protected-ref boundaries remained intact.
-
-Task disposition is `NEEDS_REWORK`, not `SUCCEEDED`: the staging contract repair is materially complete, but the deployed acceptance result is not all-green and the task row has not been legitimately claimed/verified by the online task worker.

runbooks/agent-fix-action-contracts-20260825.md

@@ -1,217 +0,0 @@
-# Agent Execution Contract — Action Contract Regression Repair
-
-## Objective
-
-Fully repair the current AIOS Action runtime/contract overlay regressions on the single server, without modifying protected refs directly and without introducing new infrastructure. The task is not complete until the deployed staging/action overlay passes all acceptance gates.
-
-## Authority and scope
-
-- Repository: `aios/aios`
-- Base at task creation: `3244f0f17f8845592ac94d585f5ebd65693c9f29`
-- Governed task: `fix-action-contracts-20260825-1407`
-- Target branch: `agent/fix-action-contracts-20260825-1407`
-- Protected refs must not be directly written: `main`, release tags, baseline registry, production runtime.
-- No new SaaS, database, agent framework, or monitoring platform may be introduced.
-
-## Non-interactive rules
-
-The Agent must run the whole flow unnattended:
-
-1. Collect facts.
-2. Determine root causes.
-3. Make the smallest correct changes.
-4. Run unit/integration/contract tests.
-5. Deploy to staging only.
-6. Restart only the affected non-production services.
-7. Run the full Action smoke suite.
-8. On failure, automatically collect logs, diagnose, fix, and retry.
-9. If a change causes a new regression, automatically roll back the staging change to the previous known-good configuration and record the failure.
-10. Stop only if an owner decision is required for a high-risk, irreversible, or production-boundary action.
-
-## Fact collection — required before editing
-
-Record all of the following in the final evidence bundle:
-
-- `id`, `hostname`, `uname -a`, `date --iso-seconds`
-- `git rev-parse --show HEAD` for authority worktree and running overlay source
-- `git status --porcelaine=v2`
-- `git remote -v`
-- current systemd service unit(s), drop-ins, Environment/EnvironmentFile sources for GitOps/Bredge/release services
-- `systemctl show <affected-service>` including `User=`, `Group=`, `Environment=`, `EnvironmentFile=`, `ExecStart=`
-- resolved Gitea API base URL after env/config expansion; redact secrets but not scheme/host
-- `stat -c, `namei -l`, `getfacl`, als -ld on `/var/lib/aios-gitops/silent-release` and its parents
-- find Action OpenAPI/schema generator and runtime operation definitions for `commitFilesGoverned`
-- find the release version validator(s) and all callers of `getTagPublicationStatus`
-- find `reconcileGitOpsJob` implementation and durable binding validation logic
-- find `getDiff  implementation and transport output limits
-
-Do not edit any file until the actual implementation and configuration sources have been located.
-
-## Repair 1 — Gitea API URL
-
-Symptoms:
-
-- `getReleaseConsistency` → `Gitea API URL must be HTTP(S)`
-- `runReleaseAcceptance` → `Gitea API URL must be HTTP(ÊX
-
-Required behavior:
-
-- Determine which env/config key is projected into the current contract overlay.
-- Compare the deployed overlay with V2R2C1 known-good configuration/deployment manifests.
-- Restore a valid `HTTP://` or `HTTPS://` Gitea API base URL.
-- Add startup config validation so invalid schemes fail at health/startup with a config-specific message, not during a release check.
-- Never hard-code a different Gitea host if the existing deployment already has a single authoritative source.
-
-## Repair 2 — durable release state permissions
-
-Symptom:
-
-- `getReleaseSaga` → `Permission denied: '/var/lib/aios-gitops/silent-release'`
-
-Required behavior:
-
-- Identify the actual runtime service User/Group.
-- Grant only the required traverse/read/write permissions for the durable state directories the service must use.
-- Prefer ownership + group mode or a specific ACL; keep the directory non-world-writable.
-- Persist the permission in deployment/install logic so restart/reboot does not regress.
-- Verify create/read/update of a staging-only saga state file under the service identity.
-
-## Repair 3 — release version contract
-
-Symptom:
-
-- `getTagPublicationStatus("V2R2C1")` → `invalid release version`
-- The same runtime exposes `V2R2C1` as `approved_release_version`.
-
-Required behavior:
-
-- Locate all version validators; consolidate onto one canonical parser.
-- Accept the AIOS canonical namespace `^V[0-9]+R[0-9]+C[0-9]+$`.
-- Preserve any additional already-supported legacy formats unless they are security-sensitive.
- - Add contract tests proving that the version accepted by capabilities is accepted by status, candidate, consistency, acceptance, and tag publication.
-
-## Repair 4 — `commitFilesGoverned` schema parity
-
-Symptom:
-
-- Runtime capability metadata requires `files`.
-- Published Action tool schema does not expose `files`.
-- Call reaches Bridge and fails `BRIDGE_REQUEST_FIELDS_MISSING`.
-
-Required behavior:
-
-- Find the canonical runtime operation contract.
-- Generate the external tool schema from the same source of truth; do not manually copy a parallel schema.
-- `files` must be required and must represent a list of file objects with at least `path` and `content_base64`.
-- Add a parity test that compares runtime required fields with published Action required fields.
-- Add a real governed commit test that writes two test files to an isolated `agent/` ibranch and verifies remote OID.
-
-## Repair 5 — terminal reconciliation
-
-Symptom:
-
-- A governed job read back as `COMPLETED' but `reconcileGitOpsJob` failed `DURABLE_BINDING_INVALID`.
-
-Required behavior:
-
-- Reconciling a terminal successful job must be idempotent.
-- An expired writer lease must not invalidate a durable binding for a job that is already terminal.
-- Active-job reconciliation may require a live lease; terminal read-back must not.
-- Add cases for COMPLETED, FAILED, CANCELLED / equivalent terminal states.
-
-## Repair 6 — bounded `getDiff` output
-
-Symptom:
-
-- Large valid diffs fail with `ResponseTooLargeError` or `GIT_OUTPUT_LIMIT_EXCEEDED`.
-
-Required behavior:
-
-- Do not load unbounded diff text into the Action response.
-- Return bounded summary data: commit identities, changed paths/stats, total bytes, and `truncated: true` when the full patch exceeds the safe limit.
-- If pagination already exists in the contract use it; otherwise prefer deterministic truncation over a breaking schema change.
-- Add tests for small, empty, and oversize diffs.
-
-## Staging deployment procedure
-
-1. Run the existing mandatory test suite before modification; record baseline.
-2. Apply code and config changes only on the governed branch/worktree.
-3. Run focused regression tests.
-4. Run the full mandatory suite.
-5. Build the staging contract overlay using the repository's existing build/deploy path.
-6. Deploy to staging/non-production only.
-7. If systemd units are changed: `systemctl daemon-reload`, then restart only the affected staging services.
-8. Wait for the existing health endpoint/runtime status to become healthy.
-9. Run the acceptance suite below.
-
-If any step fails:
-- collect `journalctl` logs and relevant app logs;
-- diagnose root cause;
-- automatically repair and retry when non-destructive;
-- if a new change breaks staging, restore the previous staging artifact/config and restart the affected service;
-- never silently continue after a failed gate.
-
-## Acceptance suite
-
-All of the following must pass on the same deployed staging overlay:
-
-- Runtime status is `active` and healthy after restart.
-- Gitea Git/API readback works from the runtime service identity.
-- `getReleaseConsistency(V2R2C1, 998d30304787e31e5ae607c0bd86b5edb2b0e5ad, a8b906d1bc24088c19647e98de6a679268f6d0a2, approved_plan) returns a structured result and reaches evaluation.
-- `runReleaseAcceptance` for the same identities reaches policy evaluation, not URL validation error.
-- `getTagPublicationStatus("V2R2C1")` returns structured state, not `invalid release version`.
-- `getReleaseSaga` for a nonexistent candidate returns NOT_FOUND/empty-state semantics, not filesystem permission failure.
-- `commitFilesGoverned` exposes its required `files` parameter in the published Action schema.
- - A real two-file governed commit to an isolated `agent/` branch succeeds and remote branch OID matches.
-- Resuming a COMPLETED job returns the existing `JOB_TERMINAL` semantics or idempotent success as designed.
-- Reconciling a COMPLETED governed job is successful/idempotent and does not require an active lease.
-- Small/empty `getDiff  still works.
-- Large `getDiff` returns bounded output with truncation metadata instead of a transport exception.
-- Existing protected-ref controls remain unchange: no direct main/tag/baseline/production write.
-
-## Restart / reboot persistence
-
-After the first full pass:
-
-- Restart the staging Action/Bridge/release services one more time without changing files.
-- Rerun the acceptance suite.
-- Permissions, Gitea URL, and schema must still be correct after restart.
-- If the repository already has a safe staging reboot test, run it as well.
-
-## Evidence and completion
-
-Create a single durable report in the repository, e.g. `reports/action-contract-repair-evidence-20260825.md`, containing:
-
-- pre-change facts
-- root cause for each regression
-- files changed and why
-- config/permission changes
-- test commands and exact results
-- staging deployment identity (commit/artifact/config digest)
-- restart-persistence results
-- final Action smoke results
-- any remaining risks
-
-Commit all source, test, deployment config, and runbook changes to the governed task branch. Do not mark the task SUCCEEDED until all acceptance gates pass on the actually deployed staging overlay.
-
-## Automatic rollback conditions
-
-Automatically roll back the staging deployment if any of the following occur:
-
-- service fails to become healthy after restart
-- protected-ref write boundary is broken
-- Gitea readback that worked before the change stops working
-- durable saga state cannot be read or recovered
-- mandatory test suite regresses below the pre-change baseline
-
-Do not automatically roll back an existing production release. Rollback here refers only to the staging overlay/service configuration changes made by this task.
-
-## 2026-08-25 execution record
-
-The repair branch was deployed through the existing immutable staging builder. The final source code before the evidence commit was `2ec49005bde44f6981b14351500847d594e0276c`; the deployed artifact was built from that source with SHA256 `f67aed6cc0cce1f08197485c3eea204d3ef4d3989f44dc98e8ea2691e5886cbf`. The final staging drop-ins use a lexically highest `zzzz...-999.conf` layer so they override earlier diagnostic overlays.
-
-The runtime configuration is staging-only: `User=aiman`, `Group=gitops`, API base `https://g.cnnetmkt.top/git/api/v1`, baseline authority `/var/lib/aios-gitops/model-api-staging/baseline/current.json`, and read/write access to the staging state plus the authoritative bare repository required by the governed Writer/CAS path. No `main`, protected tag, baseline registry, or production write is enabled.
-
-The release executor now binds both the configured staging baseline and the immutable runtime package's `versions/V2R2C1.json` projection. The bridge passes `AIOS_GITOPS_BASELINE_AUTHORITY` into `RuntimeConfig`; this prevents release consistency and acceptance from falling back to missing publication-workspace files.
-
-The final acceptance result is recorded in `reports/action-contract-repair-evidence-20260825.md`. Contract smoke is green, and release consistency is `PASS`; release acceptance is structured policy output but remains `accepted=false` because the pre-existing publication state is `REMOTE_PUSH_PENDING` for the protected `V2R2C1` tag. The task must therefore remain `NEEDS_REWORK` until an authorized owner resolves that independent protected-tag state.

runbooks/agent-v2r2c2-control-plane-convergence-20260825.md

@@ -1,311 +0,0 @@
-# Agent Execution Contract — V2R2C2 Control-Plane Convergence
-
-## Objective
-
-Complete the AIOS Phase -1 authority/runtime/contract convergence on the existing
-single server with no interactive prompts. The source integration branch already
-contains the staging-validated Action contract repair lineage plus the new minimal
-convergence contracts. The Agent's job is to verify, finish the one remaining
-release-publication reconciliation defect if it is still reproducible, build and
-deploy **staging only**, prove the same-source runtime, and return machine evidence.
-
-This is not authorization to modify production, protected tags, production baseline,
-or `main` directly.
-
-## Canonical identities
-
-- Repository: `aios/aios`
-- Authoritative main observed at task start:
-  `3244f0f17f8845592ac94d585f5ebd65693c9f29`
-- Production baseline: `V2R2C1`
-- Production target:
-  `998d30304787e31e5ae607c0bd86b5edb2b0e5ad`
-- Production evidence closure:
-  `a8b906d1bc24088c19647e98de6a679268f6d0a2`
-- Approval plan:
-  `sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e`
-- Staging repair source lineage:
-  `174e64dd0218cef6d49dd13d58bbd90c78fecadd`
-- Integration branch:
-  `agent/v2r2c2-convergence-integration-20260825`
-- Integration branch OID at handoff:
-  `7526fef619edd8170c03c31a87e32cd1ea52a4ec`
-
-## Code already completed
-
-The integration branch includes the complete governed staging repair lineage rooted
-at the authoritative main revision, including:
-
-- canonical release-version validation;
-- startup-safe Gitea API URL validation;
-- operation contract metadata and `commitFilesGoverned` schema parity;
-- bounded `getDiff`;
-- idempotent terminal job reconciliation;
-- CREATE_NEW branch CAS recovery;
-- release baseline/version projection;
-- external governed-read routing;
-- canonical release consistency routing;
-- durable NOT_FOUND release-saga semantics.
-
-It also adds:
-
-- `active-runtime/app/aios_convergence_contracts.py`
-- `tests/test_convergence_contracts.py`
-
-The new convergence contracts deliberately have no external side effects. They add:
-
-- fail-closed `AcceptanceVector` / `AcceptanceResult`;
-- domain-preserving final-writer ownership validation;
-- `DesiredState` / `ObservedState`;
-- pure reconciliation planning with stable idempotency identity;
-- `SideEffectReceipt`;
-- `ContinuationManifest`.
-
-Local isolated validation before handoff: `8 passed`.
-
-## Current observed runtime facts
-
-At handoff:
-
-- model API staging service is active at source
-  `174e64dd0218cef6d49dd13d58bbd90c78fecadd`;
-- external `getControlPlaneSnapshot` is reachable;
-- external `getGovernedWriteCapabilities` is reachable;
-- `getReleaseConsistency(V2R2C1, ...)` returns `status=PASS` and all checks true;
-- remote/local tag object is
-  `07fc2746b688f5f243f29b39de39f32edc3dd9d2`;
-- peeled target is
-  `998d30304787e31e5ae607c0bd86b5edb2b0e5ad`;
-- production health returns HTTP 200 and the same target/artifact identity;
-- `runReleaseAcceptance` still returns `accepted=false` despite consistency PASS;
-- `getTagPublicationStatus(V2R2C1)` currently returns `UNKNOWN`;
-- `getControlPlaneSnapshot.runtime.runtime_release_commit` reports
-  `2ec49005bde44f6981b14351500847d594e0276c`, while the model API runtime
-  reports `174e64dd0218cef6d49dd13d58bbd90c78fecadd`.
-
-Those last two facts are the remaining convergence defects.
-
-## Non-interactive execution policy
-
-Run continuously without asking the Owner to type "continue".
-
-Automatically:
-
-1. collect facts;
-2. run tests;
-3. diagnose failures;
-4. make the smallest correct repair;
-5. rebuild immutable staging artifacts;
-6. deploy/restart only affected staging services;
-7. observe external truth;
-8. retry recoverable failures;
-9. roll back newly introduced staging regressions;
-10. produce final evidence.
-
-Stop only for:
-
-- authority/approval that cannot be satisfied by existing bindings;
-- irreversible production change;
-- protected-ref mutation;
-- security-boundary change;
-- genuine goal ambiguity;
-- no-progress after bounded diagnosis/repair attempts.
-
-## Phase A — pre-edit facts
-
-Before any further edit, persist:
-
-- current authoritative HEAD;
-- integration branch OID and remote readback;
-- `git merge-base --is-ancestor 3244f0f... 7526fef...`;
-- staging service source/artifact identity for both model API and Bridge;
-- systemd unit + drop-in ordering for both services;
-- exact environment sources for baseline, Gitea API, state roots and PYTHONPATH;
-- current release consistency, acceptance and tag-publication status;
-- current control-plane snapshot;
-- current governed-write capabilities operation contracts.
-
-Do not trust a report if a direct runtime observation is available.
-
-## Phase B — mandatory tests
-
-Run at minimum:
-
-```text
-PYTHONPATH=active-runtime/app python3 -m pytest -q   tests/test_convergence_contracts.py   tests/test_action_contract_regressions.py   tests/test_bridge_v2_governed_http_bootstrap.py
-
-PYTHONPATH=active-runtime/app python3 -m pytest -q   tests/test_silent_release_execution_readiness.py   tests/test_silent_release_controller.py   tests/test_silent_release_hardening.py   tests/test_silent_release_production_contract.py   tests/test_chatgpt_actions_tag.py   tests/test_gitea_tag_publication.py   tests/test_authoritative_git_context.py
-```
-
-Then run the repository-wide suite. Compare failures to the persisted pre-existing
-baseline. No new regression is allowed.
-
-## Phase C — release-publication truth reconciliation
-
-Only execute this code repair if the following remains simultaneously true on the
-same staging runtime:
-
-```text
-getReleaseConsistency.status == PASS
-runReleaseAcceptance.accepted == false
-getTagPublicationStatus(V2R2C1) in {UNKNOWN, REMOTE_PUSH_PENDING}
-```
-
-### Required semantics
-
-Do **not** hard-code `accepted=true` and do not reinterpret UNKNOWN as PASS.
-
-The publication controller must reconcile durable publication state from observed
-external truth:
-
-1. Resolve the approved version binding.
-2. Read authoritative local tag object and peeled commit.
-3. Read Gitea tag object and peeled commit.
-4. Read registry/baseline approved tag object and target.
-5. Compare all identities to the approved release binding.
-6. If every required observation is present and exactly equal:
-   - persist the existing terminal-success publication state used by the codebase
-     (`PUBLISHED`/equivalent);
-   - mark the transition as observation-only/reconciled;
-   - record the observed tag object, peeled target, repository identity and evidence;
-   - perform **no tag create/push**.
-7. If any identity differs:
-   - fail closed as drift/conflict;
-   - never mutate the protected tag.
-8. If any required observation is unavailable:
-   - remain `UNKNOWN`/reconciling;
-   - do not mark accepted.
-9. Replaying reconciliation must be idempotent and must not create a second
-   side effect.
-
-`runReleaseAcceptance` may return accepted only after both:
-
-```text
-release consistency == PASS
-AND reconciled publication state == terminal success
-```
-
-### Mandatory regression tests
-
-Add focused tests for:
-
-- missing local publication journal + exact observed remote tag -> terminal success;
-- stale `REMOTE_PUSH_PENDING` + exact observed remote tag -> terminal success;
-- remote tag object mismatch -> fail closed;
-- peeled target mismatch -> fail closed;
-- Gitea observation unavailable -> UNKNOWN, not accepted;
-- replay after reconciled success -> identical durable receipt, no tag write/push;
-- existing protected tag is never force-updated or deleted.
-
-Use the existing `TagPublisher`/publication store and existing reconciliation/state
-model. Do not create a second release database or a second release controller.
-
-## Phase D — same-source staging convergence
-
-Build from integration branch OID after tests. Deploy the same immutable artifact
-lineage to every staging component participating in these Actions.
-
-Acceptance requires the externally visible snapshot to stop presenting mixed
-source identity. At minimum model API and Bridge must report the same intended
-source/build identity or explicitly report component-level identities without
-claiming a single aggregate runtime commit.
-
-Do not hide component drift by overwriting the snapshot value.
-
-Preferred fix if the snapshot currently has only one `runtime_release_commit`:
-extent it to expose component identities, for example:
-
-```text
-runtime.components.model_api.source_oid
-runtime.components.bridge.source_oid
-runtime.aggregate_drift_status
-```
-
-Aggregate PASS is legal only if the required components are on the approved
-compatible source set.
-
-## Phase E — staging smoke
-
-On the deployed staging artifact run:
-
-- runtime status;
-- control-plane snapshot;
-- governed-write capabilities;
-- release consistency;
-- release acceptance;
-- tag publication status;
-- nonexistent release saga;
-- bounded large diff;
-- completed-job reconcile idempotency;
-- isolated two-file governed commit on a throwaway `agent/` branch.
-
-Required end state:
-
-```text
-release_consistency = PASS
-release_acceptance.accepted = true
-tag_publication = terminal success
-control_plane_snapshot = reachable
-governed_capabilities = reachable
-runtime_component_drift = PASS
-legacy_writes = false
-force_push = false
-main_write = false
-tag_write = false
-baseline_write = false
-production_write = false
-```
-
-## Phase F — restart persistence
-
-Restart only affected staging services, without changing files.
-
-Rerun Phase E. All identities and outcomes must remain stable.
-
-## Governance and branch handling
-
-Do not directly modify `main`, `V2R2C1`, the production baseline registry or
-production services.
-
-The current Bridge writer binding has a known limitation: after a successful
-single-file CAS commit, reacquiring the same task lease can return the original
-expected branch OID, and rebinding the same task/generation can conflict.
-
-Do not work around that with direct Git writes.
-
-For source changes use the existing governed task/lease/commit flow. If the platform
-requires one governed task binding per branch advance, create an explicitly named
-follow-up governed task on the **same branch**, with:
-
-- `base_oid` = previously verified branch OID;
-- `expected_branch_oid` = same previously verified branch OID;
-- same repository and branch;
-- no protected-ref write.
-
-Record this as `TASK_BINDING_EXPECTED_OID_NOT_ADVANCING` evidence.
-
-## Final evidence
-
-Commit a durable report:
-
-`reports/v2r2c2-control-plane-convergence-evidence-20260825.md`
-
-It must contain:
-
-- pre-change facts;
-- exact commits and changed paths;
-- all test commands/results;
-- release-publication reconciliation proof;
-- proof that no protected tag write occurred during observation reconciliation;
-- build artifact SHA;
-- staging component source identities;
-- pre/post restart smoke;
-- branch authority/Git remote/API readback;
-- remaining known risks;
-- final disposition.
-
-Do not declare `SUCCEEDED` unless every required end-state line in Phase E is
-proven from the actually deployed staging runtime.
-
-Production promotion is a separate Owner-approved release step and is **not** part
-of this execution contract.

runtime/agent-os/message_bus.py

@@ -48,3 +48,8 @@ class MessageBus:
         messages = list(self.queue)
         self.queue.clear()
         return messages
+
+# R4.2 P0-B compatibility adapter.
+def to_handoff_envelope(message, *, target=None, sequence=1, idempotency_key=None, **scope):
+    from message_handoff_adapters import legacy_message_to_envelope
+    return legacy_message_to_envelope(message, target=target, sequence=sequence, idempotency_key=idempotency_key, **scope)

scripts/autonomous-release/build_trusted_release_artifact.py

@@ -1,90 +0,0 @@
-#!/usr/bin/env python3
-"""Build a deterministic plan-bound production payload from one clean source tree."""
-from __future__ import annotations
-import argparse, hashlib, json, shutil, tarfile, tempfile
-from pathlib import Path
-
-SOURCE_FILES = (
-    "active-runtime/app/deployment_state.py",
-    "active-runtime/app/v2r1c6_privacy_tools.py",
-    "active-runtime/app/v2r2c2_health_service.py",
-    "deploy/aios-v2/systemd/aios-v2r2c2-production.service",
-)
-
-def canon(value: object) -> bytes:
-    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode()
-
-def digest(path: Path) -> str:
-    h = hashlib.sha256()
-    with path.open("rb") as f:
-        for block in iter(lambda: f.read(1024 * 1024), b""): h.update(block)
-    return h.hexdigest()
-
-def require_oid(value: str, label: str) -> str:
-    if len(value) != 40 or any(c not in "0123456789abcdef" for c in value): raise SystemExit(label + "_invalid")
-    return value
-
-def require_sha(value: str, label: str) -> str:
-    if len(value) != 64 or any(c not in "0123456789abcdef" for c in value): raise SystemExit(label + "_invalid")
-    return value
-
-def build(source: Path, output: Path, *, version: str, source_oid: str, tree_oid: str,
-          rollback_version: str, rollback_target_oid: str, rollback_artifact_sha256: str,
-          service: str, port: int) -> dict[str, object]:
-    if not source.is_dir() or source.is_symlink(): raise SystemExit("source_directory_invalid")
-    require_oid(source_oid, "source_oid"); require_oid(tree_oid, "tree_oid")
-    require_oid(rollback_target_oid, "rollback_target_oid"); require_sha(rollback_artifact_sha256, "rollback_artifact_sha256")
-    if version != "V2R2C2" or rollback_version == version: raise SystemExit("release_version_binding_invalid")
-    if service != "aios-v2r2c2-production.service" or port != 18928: raise SystemExit("adapter_policy_binding_invalid")
-    if output.exists(): raise SystemExit("output_exists")
-    output.parent.mkdir(parents=True, exist_ok=True)
-    with tempfile.TemporaryDirectory(prefix="trusted-release-build-") as td:
-        payload = Path(td) / "payload"; payload.mkdir()
-        for rel in SOURCE_FILES:
-            source_file = source / rel
-            if not source_file.is_file() or source_file.is_symlink(): raise SystemExit("required_source_missing:" + rel)
-            dest = payload / rel; dest.parent.mkdir(parents=True, exist_ok=True); shutil.copyfile(source_file, dest)
-        (payload / "VERSION").write_text(version + "\n", encoding="utf-8")
-        build_meta = {"schema": "aios.trusted-release-artifact-build.v1", "version": version,
-                      "source_commit": source_oid, "tree_oid": tree_oid, "production_deployed": False,
-                      "tag_created": False, "baseline_changed": False, "adapter_service": service, "adapter_port": port}
-        (payload / "BUILD-METADATA.json").write_bytes(canon(build_meta))
-        rollback = {"schema": "aios.trusted-release-rollback.v1", "version": rollback_version,
-                    "target_oid": rollback_target_oid, "artifact_sha256": rollback_artifact_sha256,
-                    "automatic_rollback": False}
-        (payload / "ROLLBACK-METADATA.json").write_bytes(canon(rollback))
-        files = []
-        for item in sorted(p for p in payload.rglob("*") if p.is_file()):
-            if item.name != "ARTIFACT-MANIFEST.json":
-                files.append({"path": "payload/" + item.relative_to(payload).as_posix(), "sha256": digest(item), "size": item.stat().st_size})
-        manifest = {"schema": "aios.trusted-release-artifact-manifest.v1", "version": version,
-                    "source_commit": source_oid, "tree_oid": tree_oid, "files": files,
-                    "deployable": True, "production_deployed": False}
-        (payload / "ARTIFACT-MANIFEST.json").write_bytes(canon(manifest))
-        files.append({"path": "payload/ARTIFACT-MANIFEST.json", "sha256": digest(payload / "ARTIFACT-MANIFEST.json"), "size": (payload / "ARTIFACT-MANIFEST.json").stat().st_size})
-        tar_path = Path(td) / "artifact.tar"
-        with tarfile.open(tar_path, "w") as archive:
-            for item in sorted(p for p in payload.rglob("*") if p.is_file()):
-                info = archive.gettarinfo(str(item), arcname="payload/" + item.relative_to(payload).as_posix())
-                info.uid = 0; info.gid = 0; info.uname = "root"; info.gname = "root"; info.mtime = 0; info.mode = 0o644
-                with item.open("rb") as stream: archive.addfile(info, stream)
-        shutil.copyfile(tar_path, output)
-    receipt = {"schema": "aios.trusted-release-artifact-receipt.v1", "version": version,
-               "source_commit": source_oid, "tree_oid": tree_oid, "artifact_sha256": digest(output),
-               "artifact_size": output.stat().st_size, "manifest_sha256": hashlib.sha256(canon(manifest)).hexdigest(),
-               "package_closure_sha256": hashlib.sha256(canon({"source_commit": source_oid, "tree_oid": tree_oid, "files": files})).hexdigest(),
-               "production_deployed": False, "tag_created": False, "baseline_changed": False,
-               "service": service, "port": port}
-    output.with_suffix(".manifest.json").write_bytes(canon(receipt))
-    return receipt
-
-def main() -> int:
-    p = argparse.ArgumentParser(); p.add_argument("--source", type=Path, required=True); p.add_argument("--output", type=Path, required=True)
-    p.add_argument("--version", required=True); p.add_argument("--source-oid", required=True); p.add_argument("--tree-oid", required=True)
-    p.add_argument("--rollback-version", required=True); p.add_argument("--rollback-target-oid", required=True); p.add_argument("--rollback-artifact-sha256", required=True)
-    p.add_argument("--service", required=True); p.add_argument("--port", type=int, required=True); a = p.parse_args()
-    result = build(a.source, a.output, version=a.version, source_oid=a.source_oid, tree_oid=a.tree_oid,
-                   rollback_version=a.rollback_version, rollback_target_oid=a.rollback_target_oid,
-                   rollback_artifact_sha256=a.rollback_artifact_sha256, service=a.service, port=a.port)
-    print(json.dumps(result, sort_keys=True)); return 0
-if __name__ == "__main__": raise SystemExit(main())

scripts/build_v2r2c1_model_api_staging.py

@@ -5,7 +5,6 @@ import hashlib
 import json
 import os
 from pathlib import Path
-import sys
 import tarfile
 import tempfile
 
@@ -19,18 +18,6 @@ REQUIRED_APP = (
     'silent_release_controller.py',
     'silent_release_hardening.py',
     'aios_gitops_job_controller.py',
-    'aios_chatgpt_bridge_v2.py',
-    'aios_chatgpt_bridge_v2_server.py',
-    'governed_production_release.py',
-    'v2r2c1_production_adapter.py',
-    'v2r1c7_production_adapter.py',
-    'aios_governed_task_bootstrap.py',
-    'aios_continuation_executor.py',
-    'aios_continuation_lease.py',
-    'aios_authority_git_executor.py',
-    'aios_gitops_reconciliation_core.py',
-    'authorized_task_writer_provisioning.py',
-    'signer_contract_compatibility.py',
 )
 OPTIONAL_APP = (
     'aios_chatgpt_actions_api.py',
@@ -69,18 +56,11 @@ def main() -> int:
     source = args.source_root.resolve(strict=True)
     output = args.output_root.resolve()
     app = source / 'active-runtime' / 'app'
-    sys.path.insert(0, str(app))
-    from aios_chatgpt_bridge_v2 import render_openapi_contract_fragment
-
     runtime = source / 'runtime' / 'agent-os'
     docs = source / 'docs' / 'gitops'
     if not app.is_dir():
         raise SystemExit('active-runtime/app missing')
     paths = []
-    root_version = source / 'release_version.py'
-    if not root_version.is_file():
-        raise SystemExit('required source dependency missing: release_version.py')
-    paths.append((Path('release_version.py'), root_version))
     for name in REQUIRED_APP:
         path = app / name
         if not path.is_file():
@@ -97,8 +77,6 @@ def main() -> int:
         paths.append((Path('runtime-agent-os') / rel, path))
     openapi = docs / 'openapi-chatgpt-actions.yaml'
     if openapi.is_file():
-        if '  /v2/commit-files:' not in openapi.read_text(encoding='utf-8'):
-            raise SystemExit('published OpenAPI is missing generated commitFilesGoverned contract')
         paths.append((Path('docs') / 'gitops' / 'openapi-chatgpt-actions.yaml', openapi))
     for folder in ('config/model_registry', 'config/model_priority', 'patches', 'versions'):
         root = source / folder

scripts/release_version.sh

@@ -9,16 +9,10 @@ WORKSPACE="${AIOS_GITOPS_WORKSPACE:-/data/aios-gitops/workspace}"
 TAG_REMOTE="${AIOS_GITOPS_GITEA_REMOTE:-gitea}"
 BRANCH_REMOTE="${AIOS_GITOPS_BRANCH_REMOTE:-gitea}"
 
-SCRIPT_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
-if ! PYTHONPATH="$SCRIPT_ROOT:${PYTHONPATH:-}" python3 - "$VERSION" <<'PY'
-import sys
-from release_version import validate_release_version
-validate_release_version(sys.argv[1])
-PY
-then
-  echo "ERROR: version must match VxRxCx" >&2
-  exit 64
-fi
+case "$VERSION" in
+  V[0-9]*R[0-9]*C[0-9]*) ;;
+  *) echo "ERROR: version must match VxRxCx" >&2; exit 64 ;;
+esac
 
 for value in "$TARGET_OID" "$EVIDENCE_CLOSURE_OID"; do
   [[ "$value" =~ ^[0-9a-f]{40}$ ]] || {

services/aios-release-controller/aios_release_controller/manifest.py

@@ -1,9 +1,8 @@
 from __future__ import annotations
 import hashlib,json,re,tarfile
-from release_version import RELEASE_VERSION_RE
 from pathlib import Path
 from typing import Any
-OID_RE=re.compile(r"^[0-9a-f]{40}$"); SHA_RE=re.compile(r"^[0-9a-f]{64}$"); VERSION_RE=RELEASE_VERSION_RE
+OID_RE=re.compile(r"^[0-9a-f]{40}$"); SHA_RE=re.compile(r"^[0-9a-f]{64}$"); VERSION_RE=re.compile(r"^V[0-9]+R[0-9]+C[0-9]+(?:-[A-Za-z0-9_.-]+)?$")
 REQUIRED_SOURCE={"schema","version","repository","base_ref","base_oid","binding_mode","release_readiness","production_deployed","tag_created","baseline_changed","production_service","production_port","rollback_metadata","controller_schema","required_checks"}
 REQUEST_KEYS={"schema","version","repository","base_oid","target_oid","artifact_uri","artifact_sha256","artifact_size","evidence_closure_oid","approval_plan_id","execute","production_deployed","production_service","production_port","rollback_metadata","current_tag_oid","source_manifest_sha256"}
 class ManifestValidationError(ValueError):

tests/task_plane/public_interface/test_shadow_client_rbac.py

@@ -45,6 +45,9 @@ class ShadowClientRBACPublicInterfaceTests(unittest.TestCase):
             identity_verifier=self.IdentityVerifier({"shadow-client"}),
             execution_enabled=False,
             identity_capabilities={"shadow-client": set(capabilities)},
+            identity_actor_contexts={
+                "shadow-client": {"scope_type": "system"}
+            },
         )
         service = self.TaskPlaneService(store, policy=policy)
 

tests/task_plane/public_interface/test_task_plane_scope_isolation.py

@@ -0,0 +1,298 @@
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+import sys
+import threading
+import urllib.error
+import urllib.request
+from http.server import ThreadingHTTPServer
+
+import pytest
+
+ROOT = os.getcwd()
+if os.path.join(ROOT, "active-runtime") not in sys.path:
+    sys.path.append(os.path.join(ROOT, "active-runtime"))
+
+from app.task_plane.api import TaskPlaneRequestHandler, TaskPlaneService
+from app.task_plane.errors import ForbiddenError, NotFoundError, ValidationError
+from app.task_plane.models import TaskPlan
+from app.task_plane.policy import PolicyEngine
+from app.task_plane.store import TaskPlaneStore
+
+
+def _policy() -> PolicyEngine:
+    return PolicyEngine(
+        identity_capabilities={
+            "actor-a": {"task.creator", "task.read"},
+            "actor-b": {"task.creator", "task.read"},
+            "reader-a": {"task.read"},
+            "reader-b": {"task.read"},
+            "owner": {"task.creator", "task.read", "task.read.all"},
+            "unbound": {"task.creator", "task.read"},
+        },
+        identity_actor_contexts={
+            "actor-a": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-a",
+                "user_id": "user-a",
+                "project_id": "project-a",
+                "conversation_id": "conversation-a",
+                "run_id": "run-a",
+            },
+            "reader-a": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-a",
+                "user_id": "user-a",
+                "project_id": "project-a",
+                "conversation_id": "conversation-a",
+                "run_id": "run-a",
+            },
+            "actor-b": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-b",
+                "user_id": "user-b",
+                "project_id": "project-b",
+            },
+            "reader-b": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-b",
+                "user_id": "user-b",
+                "project_id": "project-b",
+            },
+            "owner": {"scope_type": "system"},
+        },
+    )
+
+
+def _service() -> TaskPlaneService:
+    return TaskPlaneService(TaskPlaneStore(":memory:"), policy=_policy())
+
+
+def test_taskplan_scope_fields_round_trip_as_first_class_values() -> None:
+    plan = TaskPlan.from_dict(
+        {
+            "task_id": "task-scope-roundtrip",
+            "scope_type": "tenant",
+            "tenant_id": "tenant-a",
+            "user_id": "user-a",
+            "project_id": "project-a",
+            "conversation_id": "conversation-a",
+            "run_id": "run-a",
+        }
+    )
+    payload = plan.to_dict()
+    assert TaskPlan.from_dict(payload).to_dict() == payload
+
+
+def test_tenant_scope_requires_tenant_id_and_system_scope_does_not() -> None:
+    with pytest.raises(ValidationError) as exc:
+        TaskPlan.from_dict({"task_id": "task-missing-tenant", "scope_type": "tenant"})
+    assert exc.value.error_code == "TASK_SCOPE_TENANT_ID_REQUIRED"
+    system = TaskPlan.from_dict(
+        {"task_id": "task-system", "scope_type": "system", "run_id": "system-run"}
+    )
+    assert system.tenant_id is None
+
+
+def test_ACTOR_BINDING_AUTHZ_MERGE_uses_server_scope() -> None:
+    service = _service()
+    created = service.create_task(
+        {"task_id": "task-a", "task_type": "code.change"},
+        actor_identity="actor-a",
+    )
+    assert created["plan"]["tenant_id"] == "tenant-a"
+    assert created["plan"]["user_id"] == "user-a"
+    assert created["plan"]["project_id"] == "project-a"
+    declared = service.create_task(
+        {
+            "task_id": "task-a-declared",
+            "tenant_id": "tenant-a",
+            "user_id": "user-a",
+            "project_id": "project-a",
+            "conversation_id": "conversation-a",
+            "run_id": "run-a",
+        },
+        actor_identity="actor-a",
+    )
+    assert declared["plan"]["scope_type"] == "tenant"
+
+
+def test_TASK_SCOPE_MISMATCH_DENY_rejects_forged_client_scope() -> None:
+    service = _service()
+    with pytest.raises(ForbiddenError) as exc:
+        service.create_task(
+            {
+                "task_id": "task-forged",
+                "scope_type": "tenant",
+                "tenant_id": "tenant-b",
+                "user_id": "user-b",
+                "project_id": "project-b",
+            },
+            actor_identity="actor-a",
+        )
+    assert exc.value.error_code == "TASK_SCOPE_MISMATCH_DENY"
+
+
+def test_public_create_fails_closed_without_server_actor_scope() -> None:
+    service = _service()
+    with pytest.raises(ForbiddenError) as exc:
+        service.create_task(
+            {"task_id": "task-unbound"}, actor_identity="unbound"
+        )
+    assert exc.value.error_code == "TASK_ACTOR_SCOPE_UNAVAILABLE"
+
+
+def test_TASKPLANE_LIST_AUTHZ_DENY_and_TASK_OWNERSHIP_FILTER() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    service.create_task({"task_id": "task-b"}, actor_identity="actor-b")
+    assert [item["task_id"] for item in service.list_tasks("reader-a")] == ["task-a"]
+    assert [item["task_id"] for item in service.list_tasks("reader-b")] == ["task-b"]
+
+
+def test_TASKPLANE_GET_AUTHZ_DENY_does_not_disclose_cross_tenant_task() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    with pytest.raises(NotFoundError):
+        service.get_task("task-a", "reader-b")
+
+
+def test_http_authentication_drives_server_scope_and_cross_tenant_404() -> None:
+    service = _service()
+
+    class Handler(TaskPlaneRequestHandler):
+        pass
+
+    Handler.service = service
+    Handler.authenticator = lambda token: {
+        "token-a": "actor-a",
+        "token-b": "reader-b",
+    }.get(token)
+    server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    base = f"http://127.0.0.1:{server.server_port}"
+    try:
+        request = urllib.request.Request(
+            base + "/tasks",
+            data=json.dumps({"task_id": "task-http-a"}).encode(),
+            headers={
+                "Authorization": "Bearer token-a",
+                "Content-Type": "application/json",
+            },
+            method="POST",
+        )
+        with urllib.request.urlopen(request, timeout=3) as response:
+            created = json.loads(response.read())
+        assert created["plan"]["tenant_id"] == "tenant-a"
+
+        denied = urllib.request.Request(
+            base + "/tasks/task-http-a",
+            headers={"Authorization": "Bearer token-b"},
+        )
+        with pytest.raises(urllib.error.HTTPError) as exc:
+            urllib.request.urlopen(denied, timeout=3)
+        assert exc.value.code == 404
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=3)
+
+
+def test_mutating_endpoint_is_scoped_before_cancel() -> None:
+    policy = PolicyEngine(
+        execution_enabled=True,
+        identity_capabilities={
+            "actor-a": {"task.creator", "task.read"},
+            "actor-b": {"task.cancel"},
+        },
+        identity_actor_contexts={
+            "actor-a": {"scope_type": "tenant", "tenant_id": "tenant-a"},
+            "actor-b": {"scope_type": "tenant", "tenant_id": "tenant-b"},
+        },
+    )
+    service = TaskPlaneService(TaskPlaneStore(":memory:"), policy=policy)
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    with pytest.raises(NotFoundError):
+        service.cancel("task-a", {"actor_identity": "actor-b"})
+
+
+def test_privileged_server_actor_can_cross_scope() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    service.create_task({"task_id": "task-b"}, actor_identity="actor-b")
+    assert {item["task_id"] for item in service.list_tasks("owner")} == {
+        "task-a",
+        "task-b",
+    }
+
+
+def test_scope_sql_parameters_do_not_interpolate_tenant_values() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    policy = PolicyEngine(
+        identity_capabilities={"attacker": {"task.read"}},
+        identity_actor_contexts={
+            "attacker": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-a' OR 1=1 --",
+            }
+        },
+    )
+    attacker_service = TaskPlaneService(service.store, policy=policy)
+    assert attacker_service.list_tasks("attacker") == []
+
+
+def test_existing_sqlite_rows_migrate_to_legacy_without_tenant_guess(tmp_path) -> None:
+    path = tmp_path / "legacy.sqlite3"
+    connection = sqlite3.connect(path)
+    connection.execute(
+        """
+        CREATE TABLE tasks (
+            task_id TEXT PRIMARY KEY, revision INTEGER NOT NULL, status TEXT NOT NULL,
+            task_json TEXT NOT NULL, task_type TEXT NOT NULL, root_task_id TEXT NOT NULL,
+            parent_task_id TEXT, correlation_id TEXT, idempotency_key TEXT UNIQUE,
+            created_at REAL NOT NULL, updated_at REAL NOT NULL, failure_reason TEXT
+        )
+        """
+    )
+    connection.execute(
+        "INSERT INTO tasks VALUES (?,?,?,?,?,?,?,?,?,?,?,?)",
+        (
+            "task-legacy",
+            1,
+            "CREATED",
+            json.dumps({"task_id": "task-legacy"}),
+            "code.change",
+            "task-legacy",
+            None,
+            None,
+            "legacy-key",
+            1.0,
+            1.0,
+            None,
+        ),
+    )
+    connection.commit()
+    connection.close()
+
+    store = TaskPlaneStore(str(path))
+    task = store.get_task("task-legacy")
+    assert task.task_plan.scope_type == "legacy"
+    assert task.task_plan.tenant_id is None
+    replay = store.create_task(
+        TaskPlan.from_dict({"task_id": "task-legacy"}),
+        idempotency_key="legacy-key",
+    )
+    assert replay.task_id == "task-legacy"
+    assert tuple(
+        store.conn.execute(
+            "SELECT scope_type,tenant_id FROM tasks WHERE task_id='task-legacy'"
+        ).fetchone()
+    ) == ("legacy", None)
+    tenant_context = _policy().actor_context("reader-a")
+    with pytest.raises(NotFoundError):
+        store.get_task("task-legacy", tenant_context)
+    store.close()

tests/test_action_contract_regressions.py

@@ -1,165 +0,0 @@
-from __future__ import annotations
-
-import inspect
-import json
-import sys
-from pathlib import Path
-
-import pytest
-
-ROOT = Path(__file__).resolve().parents[1]
-sys.path.insert(0, str(ROOT))
-sys.path.insert(0, str(ROOT / "runtime/agent-os"))
-
-from aios_chatgpt_bridge_v2 import (  # noqa: E402
-    OPERATION_REQUIRED_FIELDS,
-    operation_contracts,
-    render_openapi_contract_fragment,
-)
-from aios_chatgpt_bridge_v2_server import GovernedRuntime  # noqa: E402
-from aios_gitops_job_controller import JobState  # noqa: E402
-from gitea_tag_publication import validate_gitea_api_url  # noqa: E402
-from silent_release_hardening import ReleaseSagaStore, SilentReleaseActionService  # noqa: E402
-from release_version import validate_release_version  # noqa: E402
-import aios_model_api_staging as model_api  # noqa: E402
-
-
-def test_canonical_release_version_is_shared_and_accepts_v2r2c1():
-    assert validate_release_version("V2R2C1") == "V2R2C1"
-    assert validate_release_version("V2R2C1-repair") == "V2R2C1-repair"
-    with pytest.raises(ValueError):
-        validate_release_version("v2r2c1")
-
-
-def test_gitea_url_validation_is_startup_safe():
-    assert validate_gitea_api_url("https://g.cnnetmkt.top/git/api/v1") == (
-        "https://g.cnnetmkt.top/git/api/v1"
-    )
-    with pytest.raises(ValueError, match="HTTP"):
-        validate_gitea_api_url("g.cnnetmkt.top/git/api/v1")
-
-
-def test_public_release_reads_use_the_bridge_canonical_evaluator():
-    query = {
-        "version": ["V2R2C1"],
-        "target_oid": ["998d30304787e31e5ae607c0bd86b5edb2b0e5ad"],
-        "evidence_closure_oid": ["a8b906d1bc24088c19647e98de6a679268f6d0a2"],
-        "approval_plan_id": ["sha256:plan"],
-    }
-    assert model_api.governed_release_query_payload(query) == {
-        "version": "V2R2C1",
-        "target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
-        "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
-        "approval_plan_id": "sha256:plan",
-    }
-    source = inspect.getsource(model_api.H.do_GET)
-    assert "publication_publisher()" in source
-    assert "get_release_consistency" in source
-    assert "run_release_acceptance" in source
-
-
-def test_governed_read_routes_are_bound_to_authenticated_facade():
-    route_script = (
-        ROOT / "ops/gitops-migration/bind_external_action_surface_final_staging.sh"
-    ).read_text()
-    for path in (
-        "/api/governed-write-capabilities",
-        "/api/control-plane-snapshot",
-        "/api/online-agent-task",
-        "/api/online-agent-task-events",
-    ):
-        assert f"location = {path}" in route_script
-        assert f"proxy_pass http://127.0.0.1:18890{path};" in route_script
-    assert "location /api/ {" in route_script
-    assert "Authorization $http_authorization" in route_script
-
-
-def test_commit_files_runtime_and_published_schema_have_same_required_fields():
-    runtime = operation_contracts()["commitFilesGoverned"]["required_fields"]
-    assert runtime == list(OPERATION_REQUIRED_FIELDS["commitFilesGoverned"])
-    fragment = render_openapi_contract_fragment()
-    published = (ROOT / "docs/gitops/openapi-chatgpt-actions.yaml").read_text()
-    assert fragment in published
-    for field in runtime:
-        assert f"                - {field}" in fragment
-    assert "required: [path, content_base64]" in fragment
-
-
-class _Store:
-    def __init__(self, row):
-        self.row = row
-        self.receipt_calls = 0
-
-    def read(self, _job_id):
-        return self.row
-
-    def _receipt(self, row, duplicate=False):
-        self.receipt_calls += 1
-        return type("Receipt", (), {"as_dict": lambda _self: {
-            "job_id": row["job_id"],
-            "state": row["state"],
-            "duplicate": duplicate,
-        }})()
-
-
-class _Controller:
-    def __init__(self, row):
-        self.store = _Store(row)
-
-
-def _runtime_for(row):
-    runtime = object.__new__(GovernedRuntime)
-    controller = _Controller(row)
-    runtime._controller_for_job = lambda _job_id: controller
-    runtime._executor_from_row = lambda *_args: (_ for _ in ()).throw(
-        AssertionError("terminal reconcile must not reconstruct an executor")
-    )
-    return runtime, controller
-
-
-@pytest.mark.parametrize(
-    "state",
-    [
-        JobState.COMPLETED.value,
-        JobState.FAILED.value,
-        JobState.CANCELLED.value,
-        JobState.MANUAL_OWNER_REVIEW_REQUIRED.value,
-    ],
-)
-def test_terminal_reconcile_is_idempotent_without_durable_binding(state):
-    row = {
-        "job_id": "job-terminal",
-        "state": state,
-        "request_json": json.dumps({}),
-    }
-    runtime, controller = _runtime_for(row)
-    result = GovernedRuntime.job(runtime, {"job_id": row["job_id"]}, "reconcile")
-    assert result["duplicate"] is True
-    assert controller.store.receipt_calls == 1
-
-
-def test_active_reconcile_still_uses_executor():
-    row = {
-        "job_id": "job-active",
-        "state": JobState.RECONCILIATION_REQUIRED.value,
-        "request_json": json.dumps({}),
-    }
-    runtime, controller = _runtime_for(row)
-    class Executor:
-        def reconcile(self, job_id):
-            return {"job_id": job_id, "state": "COMPLETED"}
-    runtime._executor_from_row = lambda *_args: Executor()
-    assert GovernedRuntime.job(runtime, {"job_id": row["job_id"]}, "reconcile") == {
-        "job_id": "job-active",
-        "state": "COMPLETED",
-    }
-
-
-def test_missing_release_saga_is_a_not_found_empty_state(tmp_path):
-    service = object.__new__(SilentReleaseActionService)
-    service.sagas = ReleaseSagaStore(tmp_path)
-    service.execution_enabled = False
-    result = service.get_release_saga("never-created-action-contract")
-    assert result["status"] == "NOT_FOUND"
-    assert result["state"] == "NOT_FOUND"
-    assert not list(tmp_path.rglob("*"))

tests/test_agent_event_bus.py

@@ -20,3 +20,12 @@ def test_unified_event_flow():
 
     dashboard = AgentEventDashboard(bus).overview()
     assert dashboard["audit"]["enabled"] is True
+
+
+def test_target_changes_event_identity(tmp_path):
+    bus = AgentEventBus(tmp_path)
+    first = bus.publish('test', 'same', 'user-a', 'same summary', {'value': 1})
+    second = bus.publish('test', 'same', 'user-b', 'same summary', {'value': 1})
+    first_id = first.get('id') if isinstance(first, dict) else getattr(first, 'id', first)
+    second_id = second.get('id') if isinstance(second, dict) else getattr(second, 'id', second)
+    assert first_id != second_id

tests/test_agent_task_initial_execution_projection.py

@@ -1,452 +0,0 @@
-from __future__ import annotations
-
-from pathlib import Path
-import hashlib
-import json
-import sqlite3
-import sys
-
-import pytest
-
-ROOT=Path(__file__).resolve().parents[1]
-sys.path.insert(0,str(ROOT/"active-runtime/app"))
-
-from aios_agent_task_initial_execution_projection import (
-    InitialExecutionProjectionError,
-    InitialExecutionProjectionRequest,
-    InitialExecutionProjectionStore,
-    SourceCaptureProjectionRecoveryRequest,
-)
-from aios_online_agent_execution import (
-    GovernedExecutionBinding,
-    project_execution_envelope,
-)
-
-AUTHORIZATION="owner-initial-execution-projection-recovery-20260820"
-TASK_ID="task-initial-projection-a"
-JOB_ID="job-initial-projection-a"
-BASE="a"*40
-BRANCH="agent/task-initial-projection-a"
-IDEMPOTENCY="task-initial-projection-binding-v1"
-CAPABILITY="agent.runtime.openclaw"
-
-
-@pytest.fixture(autouse=True)
-def _auth(monkeypatch):
-    monkeypatch.setenv(
-        "AIOS_AGENT_TASK_INITIAL_EXECUTION_PROJECTION_AUTHORIZATION_ID",
-        AUTHORIZATION,
-    )
-
-
-def canon(value):
-    return hashlib.sha256(
-        json.dumps(value,sort_keys=True,separators=(",",":")).encode()
-    ).hexdigest()
-
-
-def binding():
-    return GovernedExecutionBinding.from_mapping({
-        "task_id":TASK_ID,
-        "job_id":JOB_ID,
-        "repository":"aios/aios",
-        "base_oid":BASE,
-        "expected_branch_oid":BASE,
-        "target_branch":BRANCH,
-        "branch_mode":"CREATE_NEW",
-        "generation":1,
-        "idempotency_key":IDEMPOTENCY,
-    })
-
-
-def runtime_input():
-    return {
-        "goal":"Supervise release preparation",
-        "instructions":"Observe and resume only the same lineage.",
-        "success_criteria":[{"id":"heartbeat","description":"Heartbeat observed"}],
-        "constraints":{"production_write":False},
-        "scope":{"scope_type":"legacy","tenant_id":None,"project_id":None},
-        "trace_id":TASK_ID,
-    }
-
-
-def envelope(*, job_id=JOB_ID, action="agent_runtime", capability=CAPABILITY):
-    bound=binding()
-    if job_id != JOB_ID:
-        bound=GovernedExecutionBinding.from_mapping({**bound.public(),"job_id":job_id})
-    return project_execution_envelope(
-        bound,
-        {
-            "action":action,
-            "adapter":"openclaw" if action=="agent_runtime" else "source_capture",
-            "capability_scope":[capability],
-            "runtime_input":runtime_input() if action=="agent_runtime" else None,
-        },
-    )
-
-
-def make_db(tmp_path, *, claimed_by=None, lease=False, metadata=None, caps=None, event="TASK_CREATED"):
-    path=tmp_path/"state.sqlite3"
-    con=sqlite3.connect(path)
-    con.executescript("""
-    CREATE TABLE tasks(
-      task_id TEXT PRIMARY KEY,
-      goal TEXT NOT NULL,
-      instructions TEXT NOT NULL,
-      success_criteria_json TEXT NOT NULL,
-      required_capabilities_json TEXT NOT NULL,
-      constraints_json TEXT NOT NULL,
-      metadata_json TEXT NOT NULL,
-      deadline TEXT,
-      priority INTEGER NOT NULL,
-      max_attempts INTEGER NOT NULL,
-      attempt INTEGER NOT NULL DEFAULT 0,
-      status TEXT NOT NULL,
-      claimed_by TEXT,
-      lease_token_hash TEXT,
-      lease_expires_at TEXT,
-      result_json TEXT,
-      result_digest TEXT,
-      result_idempotency_key TEXT,
-      verification_json TEXT,
-      revision INTEGER NOT NULL DEFAULT 1,
-      created_at TEXT NOT NULL,
-      updated_at TEXT NOT NULL
-    );
-    CREATE TABLE events(
-      event_id INTEGER PRIMARY KEY AUTOINCREMENT,
-      task_id TEXT,
-      agent_id TEXT,
-      event_type TEXT NOT NULL,
-      payload_json TEXT NOT NULL,
-      created_at TEXT NOT NULL
-    );
-    """)
-    metadata={} if metadata is None else metadata
-    caps=[] if caps is None else caps
-    con.execute(
-        "INSERT INTO tasks VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
-        (
-            TASK_ID,"Supervise release preparation",
-            "Observe and resume only the same lineage.",
-            json.dumps([{"id":"heartbeat","description":"Heartbeat observed"}]),
-            json.dumps(caps),json.dumps({"production_write":False}),json.dumps(metadata),
-            None,100,20,0,"QUEUED",claimed_by,
-            "lease-hash" if lease else None,
-            "2099-01-01T00:00:00Z" if lease else None,
-            None,None,None,None,1,"2026-08-20T00:00:00Z","2026-08-20T00:00:00Z",
-        ),
-    )
-    con.execute(
-        "INSERT INTO events(task_id,agent_id,event_type,payload_json,created_at) VALUES (?,?,?,?,?)",
-        (TASK_ID,None,event,"{}","2026-08-20T00:00:00Z"),
-    )
-    con.commit();con.close()
-    return path
-
-
-def request(*, digest=None, key="initial-projection-a-v1"):
-    return InitialExecutionProjectionRequest.from_mapping({
-        "expected_status":"QUEUED",
-        "expected_revision":1,
-        "expected_attempt":0,
-        "expected_metadata_sha256":canon({}),
-        "expected_required_capabilities_sha256":canon([]),
-        "expected_job_id":JOB_ID,
-        "expected_execution_digest":digest or envelope()["execution_digest"],
-        "required_capability":CAPABILITY,
-        "adapter":"openclaw",
-        "authorization_id":AUTHORIZATION,
-        "idempotency_key":key,
-        "reason":"initial governed supervisor runtime projection",
-    })
-
-
-def resolver(_task_id,_job_id,_capability,_adapter,received_runtime_input):
-    assert received_runtime_input==runtime_input()
-    return envelope()
-
-
-def source_capture_result():
-    old=envelope(action="source_capture",capability="git.read")
-    return {
-        "task_id":TASK_ID,
-        "job_id":JOB_ID,
-        "repository":"aios/aios",
-        "base_oid":BASE,
-        "expected_branch_oid":BASE,
-        "target_branch":BRANCH,
-        "generation":1,
-        "status":"SUCCEEDED",
-        "classification":"NEEDS_REWORK_SOURCE_CAPTURE",
-        "execution_mode":"source_capture",
-        "execution_digest":old["execution_digest"],
-        "changed_files":[],
-        "writer_lease":"NONE",
-        "verification_state":"NEEDS_REWORK",
-        "direct_main_write":False,
-        "production_write":False,
-        "force_push":False,
-        "protected_ref_bypass":False,
-        "secret_material_exposed":False,
-        "source_snapshot":{"schema":"test.snapshot.v1","payload_sha256":"d"*64},
-    }
-
-
-def make_source_capture_rework_db(tmp_path, *, mutate=None, events=None):
-    path=make_db(tmp_path)
-    result=source_capture_result()
-    verification={
-        "decision":"NEEDS_REWORK",
-        "reason":"SOURCE_CAPTURE_COMPLETE_RUNTIME_PROJECTION_REQUIRED",
-    }
-    if mutate:
-        mutate(result,verification)
-    event_types=events or [
-        "TASK_CLAIMED","TASK_HEARTBEAT","RESULT_SUBMITTED","TASK_VERIFIED"
-    ]
-    con=sqlite3.connect(path)
-    con.execute(
-        "UPDATE tasks SET attempt=1,status='QUEUED',claimed_by=NULL,revision=5,"
-        "result_json=?,result_digest=?,result_idempotency_key=?,verification_json=?",
-        (
-            json.dumps(result,sort_keys=True,separators=(",",":")),
-            canon(result),"source-capture-result-v1",
-            json.dumps(verification,sort_keys=True,separators=(",",":")),
-        ),
-    )
-    for event_type in event_types:
-        payload={}
-        if event_type=="TASK_VERIFIED":
-            payload={"decision":"NEEDS_REWORK","next_state":"QUEUED"}
-        con.execute(
-            "INSERT INTO events(task_id,agent_id,event_type,payload_json,created_at) "
-            "VALUES (?,?,?,?,?)",
-            (TASK_ID,"generic-worker",event_type,json.dumps(payload),"2026-08-20T00:01:00Z"),
-        )
-    con.commit();con.close()
-    return path,result,verification
-
-
-def recovery_request(result,verification,*,digest=None,key="source-capture-recovery-a-v1"):
-    return SourceCaptureProjectionRecoveryRequest.from_mapping({
-        "expected_status":"QUEUED",
-        "expected_revision":5,
-        "expected_attempt":1,
-        "expected_metadata_sha256":canon({}),
-        "expected_required_capabilities_sha256":canon([]),
-        "previous_verification_sha256":canon(verification),
-        "expected_source_capture_result_sha256":canon(result),
-        "expected_source_capture_execution_digest":result["execution_digest"],
-        "expected_job_id":JOB_ID,
-        "expected_execution_digest":digest or envelope()["execution_digest"],
-        "required_capability":CAPABILITY,
-        "adapter":"openclaw",
-        "authorization_id":AUTHORIZATION,
-        "idempotency_key":key,
-        "reason":"first durable runtime projection after governed source capture",
-    })
-
-
-def test_initial_projection_cas_persists_envelope_capability_and_event(tmp_path):
-    path=make_db(tmp_path)
-    result=InitialExecutionProjectionStore(path,resolver).project(TASK_ID,request())
-    assert result["revision"]==2
-    assert result["attempt"]==0
-    assert result["idempotent"] is False
-    con=sqlite3.connect(path)
-    row=con.execute(
-        "SELECT status,attempt,revision,claimed_by,metadata_json,required_capabilities_json FROM tasks"
-    ).fetchone()
-    assert row[:4]==("QUEUED",0,2,None)
-    metadata=json.loads(row[4])
-    assert metadata["execution"]["action"]=="agent_runtime"
-    assert metadata["execution"]["adapter"]=="openclaw"
-    assert metadata["execution"]["governance"]["writer_lease"] is False
-    assert json.loads(row[5])==[CAPABILITY]
-    events=con.execute("SELECT event_type,payload_json FROM events ORDER BY event_id").fetchall()
-    assert [event[0] for event in events]==[
-        "TASK_CREATED","TASK_INITIAL_EXECUTION_PROJECTION_AUTHORIZED"
-    ]
-    payload=json.loads(events[-1][1])
-    assert payload["job_id"]==JOB_ID
-    assert payload["main_write"] is False
-    assert payload["production_write"] is False
-
-
-def test_initial_projection_idempotent_exact_replay(tmp_path):
-    path=make_db(tmp_path)
-    store=InitialExecutionProjectionStore(path,resolver)
-    first=store.project(TASK_ID,request())
-    second=store.project(TASK_ID,request())
-    assert first["idempotent"] is False
-    assert second["idempotent"] is True
-    assert second["execution_digest"]==first["execution_digest"]
-    con=sqlite3.connect(path)
-    assert con.execute("SELECT COUNT(*) FROM task_initial_execution_projections").fetchone()[0]==1
-    assert con.execute("SELECT COUNT(*) FROM events").fetchone()[0]==2
-
-
-def test_source_capture_recovery_projects_first_runtime_envelope(tmp_path):
-    path,result,verification=make_source_capture_rework_db(tmp_path)
-    response=InitialExecutionProjectionStore(path,resolver).project_from_source_capture(
-        TASK_ID,recovery_request(result,verification)
-    )
-    assert response["revision"]==6
-    assert response["attempt"]==1
-    assert response["recovery_from_source_capture"] is True
-    assert response["idempotent"] is False
-    con=sqlite3.connect(path)
-    row=con.execute(
-        "SELECT status,attempt,revision,claimed_by,metadata_json,"
-        "required_capabilities_json,result_json,verification_json FROM tasks"
-    ).fetchone()
-    assert row[:4]==("QUEUED",1,6,None)
-    metadata=json.loads(row[4])
-    assert metadata["execution"]["action"]=="agent_runtime"
-    assert metadata["execution"]["adapter"]=="openclaw"
-    assert metadata["execution"]["governance"]["writer_lease"] is False
-    assert json.loads(row[5])==[CAPABILITY]
-    assert json.loads(row[6])==result
-    assert json.loads(row[7])==verification
-    events=con.execute("SELECT event_type,payload_json FROM events ORDER BY event_id").fetchall()
-    assert [event[0] for event in events]==[
-        "TASK_CREATED","TASK_CLAIMED","TASK_HEARTBEAT","RESULT_SUBMITTED",
-        "TASK_VERIFIED","TASK_INITIAL_EXECUTION_PROJECTION_AUTHORIZED",
-    ]
-    payload=json.loads(events[-1][1])
-    assert payload["recovery_from_source_capture"] is True
-    assert payload["source_capture_execution_digest"]==result["execution_digest"]
-    assert payload["main_write"] is False
-    assert payload["production_write"] is False
-
-
-def test_source_capture_recovery_idempotent_exact_replay(tmp_path):
-    path,result,verification=make_source_capture_rework_db(tmp_path)
-    store=InitialExecutionProjectionStore(path,resolver)
-    first=store.project_from_source_capture(TASK_ID,recovery_request(result,verification))
-    second=store.project_from_source_capture(TASK_ID,recovery_request(result,verification))
-    assert first["idempotent"] is False
-    assert second["idempotent"] is True
-    assert second["execution_digest"]==first["execution_digest"]
-    con=sqlite3.connect(path)
-    assert con.execute(
-        "SELECT COUNT(*) FROM task_source_capture_projection_recoveries"
-    ).fetchone()[0]==1
-    assert con.execute("SELECT COUNT(*) FROM events").fetchone()[0]==6
-
-
-@pytest.mark.parametrize(
-    "mutate,error",
-    [
-        (lambda result,verification: result.__setitem__("changed_files",["x"]),
-         "SOURCE_CAPTURE_RESULT_CONTRACT_INVALID"),
-        (lambda result,verification: result.__setitem__("job_id","job-other"),
-         "SOURCE_CAPTURE_RESULT_CONTRACT_INVALID"),
-        (lambda result,verification: verification.__setitem__("decision","SUCCEEDED"),
-         "SOURCE_CAPTURE_NEEDS_REWORK_VERIFICATION_REQUIRED"),
-    ],
-)
-def test_source_capture_recovery_rejects_unsafe_result_or_verification(
-    tmp_path,mutate,error
-):
-    path,result,verification=make_source_capture_rework_db(tmp_path,mutate=mutate)
-    with pytest.raises(InitialExecutionProjectionError,match=error):
-        InitialExecutionProjectionStore(path,resolver).project_from_source_capture(
-            TASK_ID,recovery_request(result,verification)
-        )
-
-
-@pytest.mark.parametrize(
-    "events",
-    [
-        ["TASK_CLAIMED","RESULT_SUBMITTED","TASK_VERIFIED"],
-        ["TASK_CLAIMED","TASK_HEARTBEAT","RESULT_SUBMITTED","TASK_VERIFIED","TASK_CLAIMED"],
-        ["TASK_CLAIMED","TASK_HEARTBEAT","TASK_VERIFIED","RESULT_SUBMITTED"],
-    ],
-)
-def test_source_capture_recovery_rejects_invalid_event_chain(tmp_path,events):
-    path,result,verification=make_source_capture_rework_db(tmp_path,events=events)
-    with pytest.raises(
-        InitialExecutionProjectionError,match="SOURCE_CAPTURE_RECOVERY_EVENT_CHAIN_INVALID"
-    ):
-        InitialExecutionProjectionStore(path,resolver).project_from_source_capture(
-            TASK_ID,recovery_request(result,verification)
-        )
-
-
-def test_source_capture_recovery_rejects_execution_digest_drift(tmp_path):
-    path,result,verification=make_source_capture_rework_db(tmp_path)
-    with pytest.raises(InitialExecutionProjectionError,match="EXECUTION_DIGEST_DRIFT"):
-        InitialExecutionProjectionStore(path,resolver).project_from_source_capture(
-            TASK_ID,recovery_request(result,verification,digest="f"*64)
-        )
-
-
-def test_source_capture_recovery_request_is_strict(tmp_path):
-    _path,result,verification=make_source_capture_rework_db(tmp_path)
-    data=recovery_request(result,verification).public()
-    data["metadata_patch"]={"execution":"forbidden"}
-    with pytest.raises(InitialExecutionProjectionError,match="FIELDS_INVALID"):
-        SourceCaptureProjectionRecoveryRequest.from_mapping(data)
-
-
-@pytest.mark.parametrize(
-    "kwargs,error",
-    [
-        ({"claimed_by":"worker-a"},"TASK_ALREADY_CLAIMED"),
-        ({"lease":True},"ACTIVE_LEASE_DENY"),
-        ({"metadata":{"execution":{}}},"TASK_EXECUTION_ALREADY_PROJECTED"),
-        ({"caps":["git.read"]},"TASK_INITIAL_CAPABILITIES_MUST_BE_EMPTY"),
-        ({"event":"TASK_CLAIMED"},"TASK_INITIAL_EVENT_CHAIN_REQUIRED"),
-    ],
-)
-def test_initial_projection_rejects_noninitial_state(tmp_path,kwargs,error):
-    path=make_db(tmp_path,**kwargs)
-    with pytest.raises(InitialExecutionProjectionError,match=error):
-        InitialExecutionProjectionStore(path,resolver).project(TASK_ID,request())
-
-
-def test_initial_projection_rejects_binding_drift(tmp_path):
-    path=make_db(tmp_path)
-    def wrong(*_args):
-        return envelope(job_id="job-other")
-    with pytest.raises(InitialExecutionProjectionError,match="GOVERNED_BINDING_CONFLICT"):
-        InitialExecutionProjectionStore(path,wrong).project(TASK_ID,request())
-
-
-def test_initial_projection_rejects_nonruntime_envelope(tmp_path):
-    path=make_db(tmp_path)
-    def wrong(*_args):
-        return envelope(action="source_capture",capability="git.read")
-    with pytest.raises(InitialExecutionProjectionError):
-        InitialExecutionProjectionStore(path,wrong).project(TASK_ID,request())
-
-
-def test_initial_projection_rejects_execution_digest_drift(tmp_path):
-    path=make_db(tmp_path)
-    with pytest.raises(InitialExecutionProjectionError,match="EXECUTION_DIGEST_DRIFT"):
-        InitialExecutionProjectionStore(path,resolver).project(
-            TASK_ID,request(digest="f"*64)
-        )
-
-
-def test_request_is_narrow_and_initial_state_bound():
-    data=request().public()
-    data["arbitrary_metadata"]={"x":1}
-    with pytest.raises(InitialExecutionProjectionError,match="FIELDS_INVALID"):
-        InitialExecutionProjectionRequest.from_mapping(data)
-    data=request().public();data["expected_attempt"]=1
-    with pytest.raises(InitialExecutionProjectionError,match="INITIAL_STATE_REQUIRED"):
-        InitialExecutionProjectionRequest.from_mapping(data)
-
-
-def test_initial_projection_unit_is_unprivileged_and_owner_credential_bound():
-    unit=(ROOT/"deploy/systemd/aios-agent-task-initial-execution-projection.service").read_text()
-    assert "User=aios-agent-task" in unit
-    assert "Group=aios-agent-task" in unit
-    assert "LoadCredential=agent_task_control_token:" in unit
-    assert "Environment=AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:18892" in unit
-    assert "RestrictAddressFamilies=AF_UNIX AF_INET" in unit
-    assert "ReadWritePaths=/var/lib/aios-agent-task" in unit
-    assert "User=root" not in unit

tests/test_agent_task_retry_extension.py

@@ -0,0 +1,117 @@
+from pathlib import Path
+import hashlib, json, sqlite3, sys
+
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+from aios_agent_task_retry_extension import RetryExtensionRequest, RetryExtensionStore, RetryExtensionError
+
+AUTHORIZATION_ID="owner-scheme-a-20260817"
+
+
+@pytest.fixture(autouse=True)
+def _authorization_id(monkeypatch):
+    monkeypatch.setenv("AIOS_AGENT_TASK_AUTHORIZATION_ID", AUTHORIZATION_ID)
+
+
+def canon(v):
+    return hashlib.sha256(json.dumps(v,sort_keys=True,separators=(",",":")).encode()).hexdigest()
+
+
+def db(tmp_path):
+    p=tmp_path/"state.sqlite3"
+    c=sqlite3.connect(p)
+    c.executescript("""
+    CREATE TABLE tasks(
+      task_id TEXT PRIMARY KEY,status TEXT,attempt INTEGER,max_attempts INTEGER,revision INTEGER,
+      claimed_by TEXT,lease_token_hash TEXT,lease_expires_at TEXT,verification_json TEXT,result_json TEXT
+    );
+    CREATE TABLE task_events(
+      event_id INTEGER PRIMARY KEY AUTOINCREMENT,task_id TEXT,event_type TEXT,agent_id TEXT,
+      payload_json TEXT,created_at TEXT
+    );
+    """)
+    verification={"decision":"NEEDS_REWORK","reason":"BASE_OID_BINDING_INVALID"}
+    c.execute("INSERT INTO tasks VALUES (?,?,?,?,?,?,?,?,?,?)",
+              ("task-a","FAILED",10,10,41,None,None,None,json.dumps(verification),json.dumps({"status":"FAILED"})))
+    c.commit(); c.close()
+    return p,verification
+
+
+def request(v):
+    return RetryExtensionRequest.from_mapping({
+      "expected_status":"FAILED","expected_revision":41,"expected_attempt":10,"expected_max_attempts":10,
+      "next_max_attempts":11,"previous_verification_sha256":canon(v),
+      "authorization_id":AUTHORIZATION_ID,"idempotency_key":"retry-task-a-attempt11",
+    })
+
+
+def test_retry_extension_cas_and_audit(tmp_path):
+    p,v=db(tmp_path)
+    out=RetryExtensionStore(p).extend("task-a",request(v))
+    assert out["status"]=="QUEUED" and out["max_attempts"]==11 and out["revision"]==42
+    c=sqlite3.connect(p)
+    assert c.execute("select status,attempt,max_attempts,revision from tasks").fetchone()==("QUEUED",10,11,42)
+    event=c.execute("select event_type,payload_json from task_events").fetchone()
+    assert event[0]=="TASK_RETRY_EXTENSION_AUTHORIZED"
+    assert json.loads(event[1])["authorization_id"]=="owner-scheme-a-20260817"
+
+
+def test_retry_extension_idempotent_replay(tmp_path):
+    p,v=db(tmp_path); store=RetryExtensionStore(p); req=request(v)
+    first=store.extend("task-a",req); second=store.extend("task-a",req)
+    assert first["idempotent"] is False and second["idempotent"] is True
+    c=sqlite3.connect(p)
+    assert c.execute("select count(*) from task_retry_extensions").fetchone()[0]==1
+
+
+def test_retry_extension_normalizes_stale_terminal_claim_without_active_lease(tmp_path):
+    p,v=db(tmp_path)
+    c=sqlite3.connect(p)
+    c.execute("update tasks set claimed_by='previous-worker'")
+    c.commit(); c.close()
+    out=RetryExtensionStore(p).extend("task-a",request(v))
+    assert out["status"]=="QUEUED"
+    c=sqlite3.connect(p)
+    assert c.execute(
+        "select claimed_by,lease_token_hash,lease_expires_at from tasks"
+    ).fetchone()==(None,None,None)
+    payload=json.loads(c.execute("select payload_json from task_events").fetchone()[0])
+    assert payload["previous_claimed_by"]=="previous-worker"
+    assert payload["stale_terminal_claim_normalized"] is True
+    assert c.execute("select count(*) from task_events").fetchone()[0]==1
+
+
+def test_retry_extension_verification_drift_denied(tmp_path):
+    p,v=db(tmp_path)
+    bad=request({"decision":"NEEDS_REWORK","reason":"other"})
+    with pytest.raises(RetryExtensionError,match="RETRY_EXTENSION_VERIFICATION_DRIFT"):
+        RetryExtensionStore(p).extend("task-a",bad)
+
+
+def test_retry_extension_authorization_id_mismatch_rejected(tmp_path, monkeypatch):
+    p,v=db(tmp_path)
+    monkeypatch.setenv("AIOS_AGENT_TASK_AUTHORIZATION_ID", "other-owner-id")
+    with pytest.raises(RetryExtensionError,match="RETRY_EXTENSION_AUTHORIZATION_ID_MISMATCH"):
+        RetryExtensionStore(p).extend("task-a",request(v))
+
+
+def test_retry_extension_bounded_one_step():
+    v={"decision":"NEEDS_REWORK"}
+    data={
+      "expected_status":"FAILED","expected_revision":41,"expected_attempt":10,"expected_max_attempts":10,
+      "next_max_attempts":12,"previous_verification_sha256":canon(v),
+      "authorization_id":"owner-scheme-a-20260817","idempotency_key":"retry-task-a-attempt11",
+    }
+    with pytest.raises(RetryExtensionError,match="RETRY_EXTENSION_MUST_BE_BOUNDED_ONE_STEP"):
+        RetryExtensionRequest.from_mapping(data)
+
+
+def test_retry_extension_unit_is_unprivileged_and_requires_owner_binding():
+    unit=(ROOT/"deploy/systemd/aios-agent-task-retry-extension.service").read_text()
+    assert "User=aios-agent-task" in unit
+    assert "Group=aios-agent-task" in unit
+    assert "LoadCredential=agent_task_control_token:" in unit
+    assert "EnvironmentFile=/etc/aios-gitops/agent-task-retry-extension.env" in unit
+    assert "User=root" not in unit

tests/test_bridge_v2_governed_http_bootstrap.py

@@ -1,8 +1,8 @@
 import base64
-import subprocess
 from pathlib import Path
 
 from aios_authority_git_executor import AuthorityGitExecutor
+from aios_chatgpt_bridge_v2 import BridgeV2Adapter, OPERATION_REQUIRED_FIELDS
 from aios_chatgpt_bridge_v2_server import BridgeHandler, RuntimeConfig
 from aios_continuation_executor import GiteaContinuationRemote, ServerSideCredentialProjection
 from aios_continuation_lease import WriterLeaseRequestV2
@@ -25,24 +25,9 @@ class Probe:
         return True
 
 
-def test_authority_create_task_branch_is_agent_scoped_and_idempotent(tmp_path):
-    bare = tmp_path / "repo.git"
-    subprocess.run(["git", "init", "--bare", str(bare)], check=True, capture_output=True)
-    source = tmp_path / "source"
-    subprocess.run(["git", "init", str(source)], check=True, capture_output=True)
-    (source / "README.md").write_text("fixture\n", encoding="utf-8")
-    subprocess.run(["git", "-C", str(source), "add", "README.md"], check=True)
-    subprocess.run(["git", "-C", str(source), "-c", "user.name=test", "-c", "user.email=test@example.invalid", "commit", "-m", "fixture"], check=True, capture_output=True)
-    base = subprocess.check_output(["git", "-C", str(source), "rev-parse", "HEAD"], text=True).strip()
-    executor = AuthorityGitExecutor(bare, tmp_path / "worktrees")
-    subprocess.run(["git", "-C", str(source), "push", str(bare), "HEAD:refs/heads/main"], check=True, capture_output=True)
-    assert executor.create_task_branch("refs/heads/agent/contract-test", base) == base
-    assert executor.create_task_branch("refs/heads/agent/contract-test", base) == base
-    assert executor.read_ref("refs/heads/agent/contract-test") == base
-
-
 def test_create_new_lease_is_exact_base_and_absent():
     request = WriterLeaseRequestV2(
+        job_id="job-bridge-runtime-lineage-test",
         task_id="TASK-P0-BRIDGE-V21-DURABLE-RECONCILIATION-20260809",
         repository="aios/aios",
         branch_mode="CREATE_NEW",
@@ -56,6 +41,7 @@ def test_create_new_lease_is_exact_base_and_absent():
 
 def test_create_new_lease_rejects_existing_target():
     request = WriterLeaseRequestV2(
+        job_id="job-bridge-runtime-lineage-test",
         task_id="task",
         repository="aios/aios",
         branch_mode="CREATE_NEW",
@@ -91,9 +77,8 @@ def test_slash_branch_uses_paginated_collection():
 
 def test_http_route_contract_is_complete():
     expected = {
-        "/v2/runtime", "/v2/capabilities", "/v2/governed-task",
-        "/v2/execution-envelope",
-        "/v2/writer-lease", "/v2/commit-file", "/v2/commit-files",
+            "/v2/runtime", "/v2/capabilities", "/v2/governed-task", "/v2/execution-envelope", "/v2/execution-plan",
+        "/v2/writer-lease", "/v2/writer-lease/bootstrap", "/v2/writer-lease/renew", "/v2/commit-file", "/v2/commit-files",
         "/v2/job", "/v2/job/resume", "/v2/job/reconcile",
         "/v2/tag/approval-request",
         "/v2/tag/publish",
@@ -106,3 +91,134 @@ def test_http_route_contract_is_complete():
     from aios_chatgpt_bridge_v2_server import ROUTES
 
     assert set(ROUTES) == expected
+
+
+def test_renew_writer_lease_is_exposed_in_action_and_capability_contracts():
+    adapter = BridgeV2Adapter(runtime_status={})
+    capabilities = adapter.getGovernedWriteCapabilities()
+    contract = capabilities["operation_contracts"]["renewWriterLease"]
+
+    assert contract["method"] == "POST"
+    assert contract["path"] == "/v2/writer-lease/renew"
+    assert tuple(contract["required_fields"]) == OPERATION_REQUIRED_FIELDS["renewWriterLease"]
+    assert "runtime_rehydrated" in contract["response_fields"]
+
+    action_schema = Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
+    assert "/v2/writer-lease/renew:" in action_schema
+    assert "operationId: renewWriterLease" in action_schema
+    assert "BridgeWriterLeaseRecoveryRequest" in action_schema
+    assert "BridgeWriterLeaseRecoveryResponse" in action_schema
+    assert {
+        capabilities["operation_contracts"][operation]["path"]
+        for operation in (
+            "acquireWriterLease",
+            "renewWriterLease",
+            "commitFileGoverned",
+            "commitFilesGoverned",
+        )
+    } == {
+        "/v2/writer-lease",
+        "/v2/writer-lease/renew",
+        "/v2/commit-file",
+        "/v2/commit-files",
+    }
+
+
+def test_bootstrap_writer_lease_is_exposed_in_action_and_capability_contracts():
+    adapter = BridgeV2Adapter(runtime_status={})
+    capabilities = adapter.getGovernedWriteCapabilities()
+    contract = capabilities["operation_contracts"]["bootstrapWriterLease"]
+
+    assert contract["method"] == "POST"
+    assert contract["path"] == "/v2/writer-lease/bootstrap"
+    assert tuple(contract["required_fields"]) == OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"]
+    assert "bootstrapped" in contract["response_fields"]
+    assert "durable_branch_lease_present" in contract["response_fields"]
+
+    action_schema = Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
+    assert "/v2/writer-lease/bootstrap:" in action_schema
+    assert "operationId: bootstrapWriterLease" in action_schema
+    assert "bootstrapped: {type: boolean}" in action_schema
+    assert "durable_branch_lease_present: {type: boolean}" in action_schema
+
+
+
+def test_http_allows_explicit_job_id_on_lease_and_commit_requests():
+    handler = BridgeHandler.__new__(BridgeHandler)
+    lease_body = {
+        "schema": WriterLeaseRequestV2.schema,
+        "task_id": "task",
+        "job_id": "job-explicit-runtime-lineage",
+        "repository": "aios/aios",
+        "branch_mode": "CONTINUE_EXISTING",
+        "base_oid": "a" * 40,
+        "expected_branch_oid": "a" * 40,
+        "target_branch": "agent/explicit-runtime-lineage",
+        "generation": 2,
+        "lease_seconds": 120,
+    }
+    handler._allowed("acquireWriterLease", lease_body)
+    handler._allowed(
+        "commitFilesGoverned",
+        {
+            "task_id": "task",
+            "job_id": "job-explicit-runtime-lineage",
+            "repository": "aios/aios",
+            "expected_branch_oid": "a" * 40,
+            "target_branch": "agent/explicit-runtime-lineage",
+            "generation": 2,
+            "idempotency_key": "commit-explicit-runtime-lineage",
+            "files": {"docs/x.txt": "eA=="},
+            "message": "test",
+        },
+    )
+
+
+def test_http_allows_omitted_job_id_for_durable_server_resolution():
+    handler = BridgeHandler.__new__(BridgeHandler)
+    lease_body = {
+        "schema": WriterLeaseRequestV2.schema,
+        "task_id": "task",
+        "repository": "aios/aios",
+        "branch_mode": "CONTINUE_EXISTING",
+        "base_oid": "a" * 40,
+        "expected_branch_oid": "a" * 40,
+        "target_branch": "agent/implicit-runtime-lineage",
+        "generation": 2,
+        "lease_seconds": 120,
+    }
+    handler._allowed("acquireWriterLease", lease_body)
+    handler._allowed(
+        "commitFilesGoverned",
+        {
+            "task_id": "task",
+            "repository": "aios/aios",
+            "expected_branch_oid": "a" * 40,
+            "target_branch": "agent/implicit-runtime-lineage",
+            "generation": 2,
+            "idempotency_key": "commit-implicit-runtime-lineage",
+            "files": {"docs/x.txt": "eA=="},
+            "message": "test",
+        },
+    )
+
+
+def test_http_mutation_routes_require_exact_runtime_principal():
+    handler = BridgeHandler.__new__(BridgeHandler)
+    runtime_principal = "runtime-" "agent-principal-token-1234"
+    handler.control_token = runtime_principal
+    handler.agent_task_api_url = "http://127.0.0.1:1"
+    handler.headers = {"Authorization": f"Bearer {runtime_principal}"}
+    assert handler._authorized("createGovernedTask", {}) is True
+    handler.headers = {"Authorization": "Bearer wrong-runtime-principal-token"}
+    assert handler._authorized("createGovernedTask", {}) is False
+    handler.headers = {}
+    assert handler._authorized("createGovernedTask", {}) is False
+
+
+def test_capability_contracts_return_exact_job_id_lineage():
+    contracts = BridgeV2Adapter(runtime_status={}).getGovernedWriteCapabilities()["operation_contracts"]
+    for operation in ("acquireWriterLease", "bootstrapWriterLease", "renewWriterLease"):
+        assert "job_id" in contracts[operation]["response_fields"]
+    for operation in ("commitFileGoverned", "commitFilesGoverned"):
+        assert "job_id" in contracts[operation]["response_fields"]

tests/test_canonical_task_projection_recovery.py

@@ -1,260 +0,0 @@
-from __future__ import annotations
-
-import json
-from pathlib import Path
-import sqlite3
-import sys
-
-import pytest
-
-ROOT = Path(__file__).resolve().parents[1]
-sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
-
-from aios_agent_task_projection_recovery import (
-    CanonicalTaskProjectionIntent,
-    CanonicalTaskProjectionStore,
-    ProjectionRecoveryError,
-    ProjectionState,
-    sha256_json,
-)
-from aios_agent_task_projection_recovery_http import recover_from_json
-
-
-TASK_ID = "TASK-CONV-V2R2C2-RECONCILE-SNAPSHOT-20260826"
-JOB_ID = "job-9eee1142f2fc8bb7b571d065c01f40e0"
-OID = "2afc2cf41fc9090cf01e3882d1b8db8d54cf1844"
-RUNBOOK_SHA = "a500504a76fb99b26541eaf4edd842a942992ae170fc0f3838530189ca672320"
-
-
-def make_db(tmp_path: Path) -> Path:
-    path = tmp_path / "state.sqlite3"
-    con = sqlite3.connect(path)
-    con.executescript(
-        """
-        CREATE TABLE tasks(
-          task_id TEXT PRIMARY KEY,
-          goal TEXT NOT NULL,
-          instructions TEXT NOT NULL,
-          success_criteria_json TEXT NOT NULL,
-          required_capabilities_json TEXT NOT NULL,
-          constraints_json TEXT NOT NULL,
-          metadata_json TEXT NOT NULL,
-          deadline TEXT,
-          priority INTEGER NOT NULL,
-          max_attempts INTEGER NOT NULL,
-          attempt INTEGER NOT NULL DEFAULT 0,
-          status TEXT NOT NULL,
-          claimed_by TEXT,
-          lease_token_hash TEXT,
-          lease_expires_at TEXT,
-          result_json TEXT,
-          result_digest TEXT,
-          result_idempotency_key TEXT,
-          verification_json TEXT,
-          revision INTEGER NOT NULL DEFAULT 1,
-          created_at TEXT NOT NULL,
-          updated_at TEXT NOT NULL
-        );
-        CREATE TABLE events(
-          event_id INTEGER PRIMARY KEY AUTOINCREMENT,
-          task_id TEXT,
-          agent_id TEXT,
-          event_type TEXT NOT NULL,
-          payload_json TEXT NOT NULL,
-          created_at TEXT NOT NULL
-        );
-        """
-    )
-    con.commit()
-    con.close()
-    return path
-
-
-def manifest() -> dict:
-    task = {
-        "task_id": TASK_ID,
-        "goal": "Complete V2R2C2 staging convergence",
-        "instructions": "Resume the immutable runbook and close the parent goal.",
-        "success_criteria": [{"id": "closure", "required": True, "expected": "PASS"}],
-        "constraints": {
-            "staging_only": True,
-            "production_write": False,
-            "main_direct_write": False,
-        },
-        "required_capabilities": [],
-        "metadata": {
-            "governed_task_id": TASK_ID,
-            "bridge_job_id": JOB_ID,
-            "runbook_sha256": RUNBOOK_SHA,
-        },
-        "priority": 100,
-        "max_attempts": 20,
-        "deadline": None,
-    }
-    return {
-        "schema": "aios.canonical-task-projection-intent.v1",
-        "projection_id": "projection-v2r2c2-parent-recovery-20260826",
-        "projection_generation": 1,
-        "idempotency_key": "projection-v2r2c2-parent-recovery-20260826-v1",
-        "task": task,
-        "governed_binding": {
-            "governed_task_id": TASK_ID,
-            "bridge_job_id": JOB_ID,
-            "repository": "aios/aios",
-            "branch": "agent/v2r2c2-convergence-integration-20260825",
-            "generation": 2,
-            "base_oid": OID,
-            "expected_branch_oid": OID,
-        },
-        "source_artifact": {
-            "ref": f"git:{OID}:runbooks/agent-v2r2c2-control-plane-convergence-20260825.md",
-            "sha256": RUNBOOK_SHA,
-        },
-        "task_payload_sha256": sha256_json(task),
-    }
-
-
-def test_missing_task_is_recovered_with_same_identity(tmp_path):
-    db = make_db(tmp_path)
-    intent = CanonicalTaskProjectionIntent.from_mapping(manifest())
-    result = CanonicalTaskProjectionStore(db).reconcile(intent)
-
-    assert result["state"] == ProjectionState.CONVERGED.value
-    assert result["canonical_task_id"] == TASK_ID
-    assert result["bridge_job_id"] == JOB_ID
-    assert result["created_new_row"] is True
-
-    con = sqlite3.connect(db)
-    row = con.execute(
-        "SELECT task_id,status,attempt,revision,claimed_by,"
-        "required_capabilities_json,metadata_json FROM tasks WHERE task_id=?",
-        (TASK_ID,),
-    ).fetchone()
-    assert row[:5] == (TASK_ID, "QUEUED", 0, 1, None)
-    assert json.loads(row[5]) == []
-    metadata = json.loads(row[6])
-    assert "execution" not in metadata
-    assert "execution_projection" not in metadata
-    events = con.execute(
-        "SELECT event_type FROM events WHERE task_id=? ORDER BY event_id",
-        (TASK_ID,),
-    ).fetchall()
-    assert events == [("TASK_CREATED",)]
-
-
-def test_replay_is_idempotent_and_creates_no_duplicate_event(tmp_path):
-    db = make_db(tmp_path)
-    intent = CanonicalTaskProjectionIntent.from_mapping(manifest())
-    store = CanonicalTaskProjectionStore(db)
-    first = store.reconcile(intent)
-    second = store.reconcile(intent)
-
-    assert first["idempotent"] is False
-    assert second["idempotent"] is True
-    con = sqlite3.connect(db)
-    assert con.execute("SELECT COUNT(*) FROM tasks").fetchone()[0] == 1
-    assert con.execute("SELECT COUNT(*) FROM events").fetchone()[0] == 1
-    assert con.execute(
-        "SELECT COUNT(*) FROM task_projection_receipts"
-    ).fetchone()[0] == 1
-
-
-def test_existing_matching_row_converges_without_second_task_created_event(tmp_path):
-    db = make_db(tmp_path)
-    intent = CanonicalTaskProjectionIntent.from_mapping(manifest())
-    store = CanonicalTaskProjectionStore(db)
-    store.reconcile(intent)
-
-    con = sqlite3.connect(db)
-    con.execute("DELETE FROM task_projection_receipts")
-    con.execute("DELETE FROM task_projection_intents")
-    con.commit()
-    con.close()
-
-    result = store.reconcile(intent)
-    assert result["created_new_row"] is False
-
-    con = sqlite3.connect(db)
-    assert con.execute("SELECT COUNT(*) FROM tasks").fetchone()[0] == 1
-    assert con.execute("SELECT COUNT(*) FROM events").fetchone()[0] == 1
-
-
-def test_existing_different_task_payload_fails_closed(tmp_path):
-    db = make_db(tmp_path)
-    intent = CanonicalTaskProjectionIntent.from_mapping(manifest())
-    store = CanonicalTaskProjectionStore(db)
-    store.reconcile(intent)
-
-    con = sqlite3.connect(db)
-    con.execute("DELETE FROM task_projection_receipts")
-    con.execute("DELETE FROM task_projection_intents")
-    con.execute("UPDATE tasks SET goal='drifted'")
-    con.commit()
-    con.close()
-
-    with pytest.raises(
-        ProjectionRecoveryError,
-        match="CANONICAL_TASK_PROJECTION_IDENTITY_CONFLICT",
-    ):
-        store.reconcile(intent)
-
-
-def test_intent_replay_with_same_generation_but_different_request_conflicts(tmp_path):
-    db = make_db(tmp_path)
-    first = manifest()
-    intent = CanonicalTaskProjectionIntent.from_mapping(first)
-    store = CanonicalTaskProjectionStore(db)
-    store.persist_intent(intent)
-
-    other = manifest()
-    other["task"]["instructions"] = "different"
-    other["task_payload_sha256"] = sha256_json(other["task"])
-    other_intent = CanonicalTaskProjectionIntent.from_mapping(other)
-    with pytest.raises(
-        ProjectionRecoveryError,
-        match="PROJECTION_INTENT_IDEMPOTENCY_CONFLICT",
-    ):
-        store.persist_intent(other_intent)
-
-
-def test_recovery_refuses_non_pristine_execution_metadata(tmp_path):
-    value = manifest()
-    value["task"]["metadata"]["execution"] = {"action": "agent_runtime"}
-    value["task_payload_sha256"] = sha256_json(value["task"])
-    with pytest.raises(
-        ProjectionRecoveryError,
-        match="TASK_RECOVERY_REQUIRES_PRISTINE_METADATA",
-    ):
-        CanonicalTaskProjectionIntent.from_mapping(value)
-
-
-def test_recovery_refuses_runtime_capability_in_pristine_row(tmp_path):
-    value = manifest()
-    value["task"]["required_capabilities"] = ["agent.runtime.openclaw"]
-    value["task_payload_sha256"] = sha256_json(value["task"])
-    with pytest.raises(
-        ProjectionRecoveryError,
-        match="TASK_RECOVERY_REQUIRES_PRISTINE_CAPABILITIES",
-    ):
-        CanonicalTaskProjectionIntent.from_mapping(value)
-
-
-def test_http_adapter_rejects_path_body_task_mismatch(tmp_path):
-    db = make_db(tmp_path)
-    status, body = recover_from_json(db, "TASK-other-123", manifest())
-    assert status == 409
-    assert body["error"] == "PROJECTION_TASK_IDENTITY_MISMATCH"
-
-
-def test_projection_readback_contains_durable_mapping_and_receipt(tmp_path):
-    db = make_db(tmp_path)
-    intent = CanonicalTaskProjectionIntent.from_mapping(manifest())
-    store = CanonicalTaskProjectionStore(db)
-    store.reconcile(intent)
-
-    projection = store.get_projection(TASK_ID)
-    assert projection is not None
-    assert projection["task_id"] == TASK_ID
-    assert projection["bridge_job_id"] == JOB_ID
-    assert projection["state"] == "CONVERGED"
-    assert projection["receipt"]["canonical_task_id"] == TASK_ID

tests/test_completed_replay_reconciliation_v7.py

@@ -1,333 +0,0 @@
-from __future__ import annotations
-
-import json
-import sqlite3
-from concurrent.futures import ThreadPoolExecutor
-from pathlib import Path
-from types import SimpleNamespace
-
-import pytest
-
-from aios_gitops_job_controller import BindingConflict, GitOpsJobController, JobError, JobState, JobStore, sha256_json
-
-
-TASK = "TASK-CONV-V2R2C2-RECONCILE-SNAPSHOT-20260826"
-EXTERNAL = "job-external-v7"
-BRANCH = "agent/v2r2c2-convergence-integration-20260825"
-BASE = "e" * 40
-COMMIT = "1" * 40
-
-
-def make_store(tmp_path: Path) -> tuple[GitOpsJobController, str, dict]:
-    store = JobStore(tmp_path / "job-root")
-    controller = GitOpsJobController(store)
-    request = {
-        "idempotency_key": "v7-replay",
-        "campaign_id": TASK,
-        "task_id": TASK,
-        "external_job_id": EXTERNAL,
-        "repository": "aios/aios",
-        "operation": "CONTINUATION_COMMIT_FILES",
-        "branch": BRANCH,
-        "target_branch": BRANCH,
-        "branch_mode": "CONTINUE_EXISTING",
-        "base_oid": BASE,
-        "lineage_anchor_oid": BASE,
-        "expected_branch_oid": BASE,
-        "generation": 2,
-        "payload_digest": "a" * 64,
-        "files_digest": "b" * 64,
-        "message_digest": "c" * 64,
-        "worker_principal": "aios-autonomy-agent",
-        "worker_lineage": "governed-continuation",
-    }
-    receipt = controller.submit(request)
-    controller.advance(receipt.job_id, JobState.AUTHORIZED, side_effect_state="AUTHORIZED")
-    row = store.read(receipt.job_id)
-    controller.lease_job(
-        receipt.job_id,
-        lease_id="lease-v7-epoch-3",
-        lineage_anchor_oid=BASE,
-        current_head_oid=BASE,
-        generation=2,
-        lease_expires_at="2099-01-01T00:00:00Z",
-        expected_revision=row["revision"],
-    )
-    with store._connect() as connection:
-        connection.execute("ALTER TABLE branch_leases ADD COLUMN epoch INTEGER")
-        connection.execute("UPDATE branch_leases SET epoch=3, state='USED' WHERE job_id=?", (receipt.job_id,))
-        connection.execute("CREATE TABLE branch_lease_events (lease_id TEXT NOT NULL, state TEXT NOT NULL, current_head_oid TEXT NOT NULL, generation INTEGER NOT NULL)")
-        connection.execute("INSERT INTO branch_lease_events VALUES (?, 'USED', ?, 2)", ("lease-v7-epoch-3", BASE))
-    controller.advance(receipt.job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY")
-    controller.advance(receipt.job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
-    completed = {
-        "commit_oid": COMMIT,
-        "authority_oid": COMMIT,
-        "remote_verified": True,
-        "worker_principal": request["worker_principal"],
-        "worker_lineage": request["worker_lineage"],
-    }
-    controller.advance(receipt.job_id, JobState.REMOTE_VERIFIED, side_effect_state="REMOTE_VERIFIED", receipt=completed)
-    final = controller.advance(receipt.job_id, JobState.COMPLETED, side_effect_state="REMOTE_VERIFIED", receipt=completed)
-    row = store.read(receipt.job_id)
-    envelope = {
-        "task_id": TASK,
-        "external_job_id": EXTERNAL,
-        "internal_job_id": receipt.job_id,
-        "repository": "aios/aios",
-        "target_branch": BRANCH,
-        "generation": 2,
-        "branch_mode": "CONTINUE_EXISTING",
-        "payload_digest": request["payload_digest"],
-        "files_digest": request["files_digest"],
-        "message_digest": request["message_digest"],
-        "commit_oid": COMMIT,
-        "authority_head_oid": COMMIT,
-        "worker_principal": request["worker_principal"],
-        "worker_lineage": request["worker_lineage"],
-        "source_lease_epoch": 3,
-        "historical_lease_head_oid": BASE,
-        "durable_revision": row["revision"],
-        "completion_identity": sha256_json({"job_id": receipt.job_id, "revision": row["revision"], "receipt": completed}),
-        "reason": "COMPLETED_REPLAY_LEASE_EVIDENCE_RECONCILIATION",
-        "provenance": {"source": "v7-test", "authority_readback": True},
-    }
-    assert final.state is JobState.COMPLETED
-    return controller, receipt.job_id, envelope
-
-
-def test_completed_replay_is_append_only_and_exactly_idempotent(tmp_path: Path):
-    controller, job_id, envelope = make_store(tmp_path)
-    with controller.store._connect() as connection:
-        before = dict(connection.execute("SELECT * FROM branch_leases WHERE job_id=?", (job_id,)).fetchone())
-        before_events = [dict(row) for row in connection.execute("SELECT * FROM branch_lease_events WHERE lease_id=?", ("lease-v7-epoch-3",)).fetchall()]
-        old_receipt = connection.execute("SELECT receipt_json FROM jobs WHERE job_id=?", (job_id,)).fetchone()[0]
-    first = controller.store.append_completed_replay_reconciliation(job_id, envelope, authority_head_oid=COMMIT)
-    second = controller.store.append_completed_replay_reconciliation(job_id, envelope, authority_head_oid=COMMIT)
-    restarted = GitOpsJobController(JobStore(controller.store.root))
-    third = restarted.store.append_completed_replay_reconciliation(job_id, envelope, authority_head_oid=COMMIT)
-    assert first["reconciliation_id"] == second["reconciliation_id"] == third["reconciliation_id"]
-    assert first["current_head_oid"] == COMMIT
-    with controller.store._connect() as connection:
-        after = dict(connection.execute("SELECT * FROM branch_leases WHERE job_id=?", (job_id,)).fetchone())
-        after_events = [dict(row) for row in connection.execute("SELECT * FROM branch_lease_events WHERE lease_id=?", ("lease-v7-epoch-3",)).fetchall()]
-        new_receipt = connection.execute("SELECT receipt_json FROM jobs WHERE job_id=?", (job_id,)).fetchone()[0]
-        count = connection.execute("SELECT COUNT(*) FROM completed_replay_reconciliations WHERE job_id=?", (job_id,)).fetchone()[0]
-    assert before == after
-    assert before_events == after_events
-    assert old_receipt == new_receipt
-    assert count == 1
-    with pytest.raises(sqlite3.IntegrityError, match="COMPLETED_REPLAY_APPEND_ONLY"):
-        with controller.store._connect() as connection:
-            connection.execute(
-                "UPDATE completed_replay_reconciliations SET reason='tampered' WHERE job_id=?",
-                (job_id,),
-            )
-    with pytest.raises(sqlite3.IntegrityError, match="COMPLETED_REPLAY_APPEND_ONLY"):
-        with controller.store._connect() as connection:
-            connection.execute(
-                "DELETE FROM completed_replay_reconciliations WHERE job_id=?",
-                (job_id,),
-            )
-
-
-def test_completed_replay_authority_conflict_fails_closed(tmp_path: Path):
-    controller, job_id, envelope = make_store(tmp_path)
-    with pytest.raises(BindingConflict, match="AUTHORITY_CONFLICT"):
-        controller.store.append_completed_replay_reconciliation(job_id, envelope, authority_head_oid="2" * 40)
-
-
-def test_completed_replay_binding_conflict_fails_closed(tmp_path: Path):
-    controller, job_id, envelope = make_store(tmp_path)
-    conflicting = {**envelope, "files_digest": "d" * 64}
-    with pytest.raises(BindingConflict, match="BINDING_CONFLICT"):
-        controller.store.append_completed_replay_reconciliation(job_id, conflicting, authority_head_oid=COMMIT)
-
-
-def test_identical_reconciliation_converges_under_contention(tmp_path: Path):
-    controller, job_id, envelope = make_store(tmp_path)
-
-    def run(_: int) -> str:
-        return controller.store.append_completed_replay_reconciliation(
-            job_id, envelope, authority_head_oid=COMMIT
-        )["reconciliation_id"]
-
-    with ThreadPoolExecutor(max_workers=8) as pool:
-        values = list(pool.map(run, range(16)))
-    assert set(values) == {values[0]}
-    assert controller.store.completed_replay_evidence(job_id)["commit_oid"] == COMMIT
-
-
-
-def test_public_job_projection_exposes_external_reconciled_head(tmp_path: Path):
-    from aios_chatgpt_bridge_v2_server import GovernedRuntime
-
-    controller, job_id, envelope = make_store(tmp_path)
-    reconciliation = controller.store.append_completed_replay_reconciliation(
-        job_id, envelope, authority_head_oid=COMMIT
-    )
-
-    class Authority:
-        def read_ref(self, ref: str):
-            assert ref == "refs/heads/" + BRANCH
-            return COMMIT
-
-    runtime = object.__new__(GovernedRuntime)
-    runtime.authority = Authority()
-    runtime._controller_for_job = lambda _job_id: controller
-    result = GovernedRuntime.job(runtime, {"job_id": job_id}, "get")
-    assert result["job_id"] == EXTERNAL
-    assert result["current_head_oid"] == COMMIT
-    assert result["completed_replay_reconciliation_id"] == reconciliation["reconciliation_id"]
-    assert result["receipt"]["commit_oid"] == result["receipt"]["authority_oid"] == COMMIT
-
-
-def test_writer_lease_admits_exact_completed_replay_without_new_lease(tmp_path: Path):
-    from aios_chatgpt_bridge_v2_server import GovernedRuntime
-
-    controller, job_id, envelope = make_store(tmp_path)
-    controller.store.append_completed_replay_reconciliation(
-        job_id, envelope, authority_head_oid=COMMIT
-    )
-
-    class Authority:
-        def read_ref(self, ref: str):
-            assert ref == "refs/heads/" + BRANCH
-            return COMMIT
-
-    runtime = object.__new__(GovernedRuntime)
-    runtime.config = SimpleNamespace(state_root=tmp_path)
-    runtime.controllers = {"job": controller}
-    runtime.authority = Authority()
-    body = {
-        "task_id": TASK,
-        "job_id": EXTERNAL,
-        "repository": "aios/aios",
-        "branch_mode": "CONTINUE_EXISTING",
-        "base_oid": BASE,
-        "expected_branch_oid": BASE,
-        "target_branch": BRANCH,
-        "generation": 2,
-        "lease_seconds": 900,
-    }
-    result = GovernedRuntime.acquire_lease(runtime, body)
-    assert result["completed_replay"] is True
-    assert result["lease_created"] is False
-    assert result["expected_branch_oid"] == BASE
-    assert result["current_head_oid"] == COMMIT
-    assert result["completed_replay_reconciliation_id"].startswith("reconcile-")
-    with controller.store._connect() as connection:
-        assert connection.execute(
-            "SELECT COUNT(*) FROM branch_leases WHERE job_id=?", (job_id,)
-        ).fetchone()[0] == 1
-
-
-def test_conflicting_reconciliation_has_no_ambiguous_winner(tmp_path: Path):
-    controller, job_id, envelope = make_store(tmp_path)
-    conflicting = {**envelope, "reason": "CONFLICTING_PROVENANCE"}
-    values = [envelope, conflicting] * 8
-
-    def run(candidate: dict) -> str:
-        try:
-            result = controller.store.append_completed_replay_reconciliation(
-                job_id, candidate, authority_head_oid=COMMIT
-            )
-            return "ok:" + result["identity_digest"]
-        except BindingConflict:
-            return "conflict"
-
-    with ThreadPoolExecutor(max_workers=8) as pool:
-        outcomes = list(pool.map(run, values))
-    winners = {item for item in outcomes if item.startswith("ok:")}
-    assert len(winners) == 1
-    assert "conflict" in outcomes
-    with controller.store._connect() as connection:
-        assert connection.execute(
-            "SELECT COUNT(*) FROM completed_replay_reconciliations WHERE job_id=?", (job_id,)
-        ).fetchone()[0] == 1
-
-
-def test_reconciliation_rejects_head_alias_before_append(tmp_path: Path):
-    controller, job_id, envelope = make_store(tmp_path)
-    conflicting = {**envelope, "historical_lease_head_oid": COMMIT}
-    with pytest.raises(BindingConflict, match="HISTORICAL_LEASE_CONFLICT"):
-        controller.store.append_completed_replay_reconciliation(
-            job_id, conflicting, authority_head_oid=COMMIT
-        )
-    with controller.store._connect() as connection:
-        assert connection.execute(
-            "SELECT COUNT(*) FROM completed_replay_reconciliations WHERE job_id=?",
-            (job_id,),
-        ).fetchone()[0] == 0
-
-
-def test_http_commit_allowlist_carries_replay_identity(tmp_path: Path):
-    from aios_chatgpt_bridge_v2_server import BridgeHandler
-
-    handler = object.__new__(BridgeHandler)
-    body = {
-        "task_id": TASK,
-        "job_id": EXTERNAL,
-        "source_lease_epoch": 3,
-        "repository": "aios/aios",
-        "expected_branch_oid": BASE,
-        "target_branch": BRANCH,
-        "generation": 2,
-        "idempotency_key": "v7-replay",
-        "files": [{"path": "x.txt", "content_base64": "eA=="}],
-        "message": "replay",
-    }
-    handler._allowed("commitFilesGoverned", body)
-
-
-def test_cold_append_requires_existing_database(tmp_path: Path):
-    missing = tmp_path / "missing-job-root"
-    with pytest.raises(JobError, match="JOB_ROOT_NOT_FOUND"):
-        JobStore.for_existing_append(missing)
-    assert not missing.exists()
-
-
-def test_real_http_post_carries_external_replay_identity(tmp_path: Path):
-    from http.client import HTTPConnection
-    from http.server import HTTPServer
-    from threading import Thread
-    from aios_chatgpt_bridge_v2_server import BridgeHandler
-
-    observed = {}
-    class Adapter:
-        def commitFilesGoverned(self, body):
-            observed.update(body)
-            return {"job_id": body["job_id"], "current_head_oid": COMMIT}
-
-    server = HTTPServer(("127.0.0.1", 0), BridgeHandler)
-    BridgeHandler.adapter = Adapter()
-    thread = Thread(target=server.serve_forever, daemon=True)
-    thread.start()
-    body = {
-        "task_id": TASK,
-        "job_id": EXTERNAL,
-        "source_lease_epoch": 3,
-        "repository": "aios/aios",
-        "expected_branch_oid": BASE,
-        "target_branch": BRANCH,
-        "generation": 2,
-        "idempotency_key": "v7-replay",
-        "files": [{"path": "x.txt", "content_base64": "eA=="}],
-        "message": "replay",
-    }
-    try:
-        connection = HTTPConnection("127.0.0.1", server.server_port, timeout=5)
-        connection.request("POST", "/v2/commit-files", body=json.dumps(body), headers={"Content-Type": "application/json"})
-        response = connection.getresponse()
-        payload = json.loads(response.read().decode())
-        connection.close()
-    finally:
-        server.shutdown()
-        server.server_close()
-        thread.join(timeout=5)
-        BridgeHandler.adapter = None
-    assert response.status == 200
-    assert observed["job_id"] == EXTERNAL
-    assert observed["source_lease_epoch"] == 3
-    assert payload["job_id"] == EXTERNAL
-    assert payload["current_head_oid"] == COMMIT

tests/test_continuation_runtime_normalization.py

@@ -0,0 +1,304 @@
+from __future__ import annotations
+
+from pathlib import Path
+import re
+import json
+from types import SimpleNamespace
+
+import pytest
+import yaml
+
+from aios_chatgpt_bridge_v2_server import GovernedRuntime
+from aios_continuation_executor import ContinuationExecutor
+from aios_continuation_lease import WriterLeaseRequestV2
+from aios_gitops_job_controller import JobState
+
+
+TASK = "continuation-normalization-test"
+JOB = "job-continuation-normalization-test"
+REPO = "aios/aios"
+BASE = "a" * 40
+BRANCH = "agent/continuation-normalization-test"
+
+
+class Authority:
+    def __init__(self, head: str | None) -> None:
+        self.head = head
+
+    def read_ref(self, ref: str) -> str | None:
+        assert ref == "refs/heads/" + BRANCH
+        return self.head
+
+    def commit_exists(self, oid: str) -> bool:
+        return oid == BASE
+
+    def branch_exists(self, branch: str) -> bool:
+        assert branch == BRANCH
+        return self.head is not None
+
+    def branch_head(self, branch: str) -> str:
+        assert branch == BRANCH and self.head is not None
+        return self.head
+
+    def is_ancestor(self, older: str, newer: str) -> bool:
+        return older == BASE and newer == BASE
+
+
+def lease(**overrides: object) -> WriterLeaseRequestV2:
+    values = {
+        "task_id": TASK,
+        "job_id": JOB,
+        "repository": REPO,
+        "branch_mode": "CREATE_NEW",
+        "base_oid": BASE,
+        "expected_branch_oid": BASE,
+        "target_branch": BRANCH,
+        "generation": 1,
+        "lease_seconds": 120,
+    }
+    values.update(overrides)
+    return WriterLeaseRequestV2(**values)
+
+
+def runtime(*, head: str | None = BASE, **binding_overrides: object) -> GovernedRuntime:
+    value = GovernedRuntime.__new__(GovernedRuntime)
+    value.authority = Authority(head)
+    binding = {
+        "task_id": TASK,
+        "job_id": JOB,
+        "repository": REPO,
+        "base_oid": BASE,
+        "expected_branch_oid": BASE,
+        "target_branch": BRANCH,
+        "generation": 1,
+        "branch_mode": "CREATE_NEW",
+    }
+    binding.update(binding_overrides)
+    value.bindings = {TASK: binding}
+    return value
+
+
+def test_same_lineage_create_new_normalizes_to_continue_existing() -> None:
+    normalized = runtime()._normalize_runtime_lease(lease())
+    assert normalized.branch_mode == "CONTINUE_EXISTING"
+    assert normalized.task_id == TASK
+    assert normalized.job_id == JOB
+    assert normalized.repository == REPO
+    assert normalized.target_branch == BRANCH
+    assert normalized.expected_branch_oid == BASE
+    assert normalized.generation == 1
+
+
+def test_unprovisioned_create_new_stays_create_new() -> None:
+    assert runtime(head=None)._normalize_runtime_lease(lease()).branch_mode == "CREATE_NEW"
+
+
+@pytest.mark.parametrize(
+    ("field", "value"),
+    (
+        ("repository", "other/repo"),
+        ("base_oid", "b" * 40),
+        ("expected_branch_oid", "b" * 40),
+        ("target_branch", "agent/foreign"),
+        ("generation", 2),
+    ),
+)
+def test_binding_mismatch_fails_closed(field: str, value: object) -> None:
+    with pytest.raises(RuntimeError, match="LEASE_BINDING_CONFLICT"):
+        runtime(**{field: value})._normalize_runtime_lease(lease())
+
+
+def test_drifted_existing_head_fails_closed() -> None:
+    with pytest.raises(RuntimeError, match="EXPECTED_BRANCH_OID_CONFLICT"):
+        runtime(head="b" * 40)._normalize_runtime_lease(lease())
+
+
+def test_openapi_contract_parses_and_requires_exact_commit_lineage() -> None:
+    document = yaml.safe_load(
+        Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
+    )
+    schema = document["components"]["schemas"]["BridgeCommitResponse"]
+    assert {
+        "job_id",
+        "commit_oid",
+        "commit_visible",
+        "branch_mode",
+        "target_branch",
+        "generation",
+    } <= set(schema["required"])
+
+
+def test_changed_production_files_pass_secret_scan() -> None:
+    paths = [
+        Path("active-runtime/app/aios_authority_git_executor.py"),
+        Path("active-runtime/app/aios_chatgpt_bridge_v2_server.py"),
+        Path("active-runtime/app/aios_continuation_executor.py"),
+        Path("active-runtime/app/aios_continuation_lease.py"),
+        Path("active-runtime/app/authorized_task_writer_provisioning.py"),
+        Path("active-runtime/app/aios_chatgpt_bridge_v2.py"),
+        Path("docs/gitops/openapi-chatgpt-actions.yaml"),
+    ]
+    expression = re.compile(
+        r"(?i)(BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|"
+        r"authorization:\\s*bearer\\s+[A-Za-z0-9._-]{12,}|"
+        r"api[_-]?key\\s*[:=]\\s*['\\\"][^'\\\"]{12,})"
+    )
+    hits = []
+    for path in paths:
+        for number, line in enumerate(
+            path.read_text(encoding="utf-8", errors="replace").splitlines(), 1
+        ):
+            if expression.search(line):
+                hits.append(f"{path}:{number}")
+    assert hits == []
+
+
+def test_remote_verified_job_is_not_completed_when_head_cas_callback_fails() -> None:
+    class Store:
+        def read(self, _job_id):
+            return {
+                "branch": BRANCH,
+                "request_json": json.dumps(
+                    {"binding": {"expected_branch_oid": BASE}}
+                ),
+            }
+
+    class Controller:
+        def __init__(self):
+            self.store = Store()
+            self.states = []
+
+        def advance(self, _job_id, state, **_kwargs):
+            self.states.append(state)
+            return SimpleNamespace(as_dict=lambda: {"state": state.value})
+
+    executor = ContinuationExecutor.__new__(ContinuationExecutor)
+    executor.controller = Controller()
+    executor._observe_remote = lambda _branch, oid: (oid, oid, True)
+
+    def fail_cas(_oid):
+        raise RuntimeError("LEASE_CAS_CONFLICT")
+
+    with pytest.raises(RuntimeError, match="LEASE_CAS_CONFLICT"):
+        executor._finish_remote_verification(
+            JOB,
+            "b" * 40,
+            "b" * 40,
+            before_complete=fail_cas,
+        )
+
+    assert executor.controller.states == [JobState.REMOTE_VERIFIED]
+
+
+@pytest.mark.parametrize("branch_mode", ("CREATE_NEW", "CONTINUE_EXISTING"))
+def test_executor_preflight_accepts_the_exact_mode_dependent_normalized_shape(
+    branch_mode: str,
+) -> None:
+    from datetime import datetime, timedelta, timezone
+    from aios_continuation_executor import (
+        ContinuationPermissions,
+        ContinuationRuntimeBinding,
+    )
+
+    request = lease(branch_mode=branch_mode)
+    now = datetime.now(timezone.utc)
+    executor = ContinuationExecutor.__new__(ContinuationExecutor)
+    executor.authority = Authority(None if branch_mode == "CREATE_NEW" else BASE)
+    executor.now = lambda: now
+    executor._max_generation = lambda _branch, *, exclude_job_id=None: 0
+    executor.workspace = SimpleNamespace(
+        is_detached=lambda: True,
+        head_oid=lambda: BASE,
+    )
+    executor.remote = SimpleNamespace(repository_identity=lambda: REPO)
+    binding = ContinuationRuntimeBinding(
+        request=request,
+        job_id=JOB,
+        workspace_path=Path("/tmp/continuation-normalization-test"),
+        lease_not_before=now - timedelta(seconds=1),
+        lease_expires_at=now + timedelta(seconds=60),
+        original_receipt_valid=True,
+        original_grant_consumed=True,
+        permissions=ContinuationPermissions(),
+    )
+
+    executor._validate_preflight(binding, job_id=JOB)
+
+
+def test_create_new_executor_resumes_executing_and_uses_absence_bound_writers() -> None:
+    from datetime import datetime, timedelta, timezone
+    from aios_continuation_executor import (
+        ContinuationCommit,
+        ContinuationPermissions,
+        ContinuationRuntimeBinding,
+    )
+
+    new_oid = "b" * 40
+
+    class Store:
+        def read(self, _job_id: str) -> dict[str, object]:
+            return {"state": "EXECUTING", "revision": 4}
+
+    class Controller:
+        def __init__(self) -> None:
+            self.store = Store()
+            self.advanced: list[str] = []
+
+        def advance(self, _job_id: str, state: JobState, **_kwargs: object) -> object:
+            self.advanced.append(state.value)
+            return SimpleNamespace(as_dict=lambda: {"state": state.value})
+
+    class Workspace:
+        def commit_files(self, _files: object, _message: str) -> str:
+            return new_oid
+
+    class CreateAuthority:
+        def __init__(self) -> None:
+            self.created: list[tuple[str, str, str]] = []
+
+        def is_ancestor(self, older: str, newer: str) -> bool:
+            return older == BASE and newer == new_oid
+
+        def create_task_branch_cas(self, branch: str, base: str, new: str) -> str:
+            self.created.append((branch, base, new))
+            return new
+
+        def compare_and_swap_branch(self, *_args: object) -> str:
+            raise AssertionError("existing-branch CAS must not serve CREATE_NEW")
+
+    class CreateRemote:
+        def __init__(self) -> None:
+            self.created: list[tuple[str, str]] = []
+
+        def push_new_exact(self, branch: str, new: str) -> None:
+            self.created.append((branch, new))
+
+        def push_exact(self, *_args: object) -> None:
+            raise AssertionError("existing-branch push must not serve CREATE_NEW")
+
+    class Credential:
+        def project(self) -> None: pass
+        def revoke(self) -> None: pass
+
+    controller=Controller(); authority=CreateAuthority(); remote=CreateRemote()
+    executor=ContinuationExecutor(controller,authority,Workspace(),remote,Credential())
+    executor._validate_preflight=lambda *_args,**_kwargs: None
+    executor._finish_remote_verification=lambda *_args,**_kwargs: {
+        "job_id":JOB,"state":"COMPLETED","receipt":{"authority_oid":new_oid,"commit_visible":True}
+    }
+    now=datetime.now(timezone.utc)
+    binding=ContinuationRuntimeBinding(
+        request=lease(branch_mode="CREATE_NEW"),job_id=JOB,
+        workspace_path=Path("/tmp/create-new-executor-resume"),
+        lease_not_before=now-timedelta(seconds=1),lease_expires_at=now+timedelta(seconds=60),
+        original_receipt_valid=True,original_grant_consumed=True,
+        permissions=ContinuationPermissions(),
+    )
+    result=executor.execute(
+        binding,ContinuationCommit("create-new-test",{"docs/test.txt":b"ok"},"test")
+    )
+
+    assert result["state"]=="COMPLETED"
+    assert authority.created==[(BRANCH,BASE,new_oid)]
+    assert remote.created==[(BRANCH,new_oid)]
+    assert controller.advanced==["LOCAL_VERIFIED","REMOTE_SYNCING"]

tests/test_convergence_contracts.py

@@ -1,157 +0,0 @@
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-import pytest
-
-ROOT = Path(__file__).resolve().parents[1]
-sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
-
-from aios_convergence_contracts import (
-    AcceptanceCriterion,
-    AcceptanceDecision,
-    AcceptanceInvariant,
-    AcceptanceVector,
-    ContinuationManifest,
-    ContinuationStopReason,
-    ConvergenceContractError,
-    DesiredState,
-    EvidenceState,
-    ObservedHealth,
-    ObservedState,
-    ReconciliationState,
-    StateOwnership,
-    evaluate_acceptance,
-    ownership_index,
-    plan_reconciliation,
-    validate_state_ownership,
-)
-
-
-def test_acceptance_never_promotes_required_unknown():
-    vector = AcceptanceVector(
-        subject_type="goal",
-        subject_id="goal-1",
-        subject_revision=1,
-        criteria=(
-            AcceptanceCriterion(
-                criterion_id="runtime",
-                required=True,
-                state=EvidenceState.UNKNOWN,
-                verifier_id="runtime-proof",
-            ),
-        ),
-    )
-    result = evaluate_acceptance(vector)
-    assert result.decision == AcceptanceDecision.UNKNOWN
-    assert result.reasons == ("criterion_unknown:runtime",)
-
-
-def test_acceptance_rejects_failed_invariant():
-    vector = AcceptanceVector(
-        subject_type="release",
-        subject_id="V2R2C2",
-        subject_revision=1,
-        criteria=(
-            AcceptanceCriterion("tests", True, EvidenceState.PASS, "pytest"),
-        ),
-        invariants=(
-            AcceptanceInvariant("protected-ref", EvidenceState.FAIL),
-        ),
-    )
-    assert evaluate_acceptance(vector).decision == AcceptanceDecision.REJECT
-
-
-def test_acceptance_blocks_on_unresolved_blocker():
-    vector = AcceptanceVector(
-        subject_type="goal",
-        subject_id="goal-1",
-        subject_revision=1,
-        criteria=(AcceptanceCriterion("code", True, EvidenceState.PASS, "ci"),),
-        unresolved_blockers=("blocker-1",),
-    )
-    assert evaluate_acceptance(vector).decision == AcceptanceDecision.BLOCKED
-
-
-def test_state_ownership_is_unique_and_final_writer_is_enforced():
-    custom = (
-        StateOwnership(
-            object_type="goal",
-            authoritative_service="goal-kernel",
-            authoritative_store="goal-store",
-            final_writer="goal-kernel",
-        ),
-    )
-    validate_state_ownership("goal", "goal-kernel", custom, final_state=True)
-    with pytest.raises(ConvergenceContractError, match="STATE_OWNERSHIP_VIOLATION"):
-        validate_state_ownership("goal", "worker", custom, final_state=True)
-    with pytest.raises(ConvergenceContractError, match="duplicate_state_owner"):
-        ownership_index(custom + custom)
-
-
-def test_missing_or_unknown_observation_never_converges():
-    desired = DesiredState("contract:gpt", "external_projection", 2, {"hash": "abc"})
-    missing = plan_reconciliation(desired, None)
-    assert missing.state == ReconciliationState.OBSERVING
-    assert missing.observation_required is True
-
-    unknown = ObservedState(
-        resource_id="contract:gpt",
-        observed_generation=None,
-        observed_spec={},
-        health=ObservedHealth.UNKNOWN,
-        source_identity="gpt-action",
-        observed_at="2026-08-25T00:00:00Z",
-    )
-    result = plan_reconciliation(desired, unknown)
-    assert result.state == ReconciliationState.OBSERVING
-
-
-def test_equal_healthy_observation_converges_and_key_is_stable():
-    desired = DesiredState("worker:a", "worker_binding", 3, {"build": "x"})
-    observed = ObservedState(
-        resource_id="worker:a",
-        observed_generation=3,
-        observed_spec={"build": "x"},
-        health=ObservedHealth.HEALTHY,
-        source_identity="worker-registry",
-        observed_at="2026-08-25T00:00:00Z",
-    )
-    one = plan_reconciliation(desired, observed)
-    two = plan_reconciliation(desired, observed)
-    assert one.state == ReconciliationState.CONVERGED
-    assert one.idempotency_key == two.idempotency_key
-
-
-def test_drift_is_diff_found_not_auto_applied():
-    desired = DesiredState("projection:openapi", "external_projection", 4, {"hash": "new"})
-    observed = ObservedState(
-        resource_id="projection:openapi",
-        observed_generation=3,
-        observed_spec={"hash": "old"},
-        health=ObservedHealth.HEALTHY,
-        source_identity="published-openapi",
-        observed_at="2026-08-25T00:00:00Z",
-    )
-    result = plan_reconciliation(desired, observed)
-    assert result.state == ReconciliationState.DIFF_FOUND
-    assert result.observation_required is False
-
-
-def test_continuation_manifest_is_durable_and_hashable():
-    manifest = ContinuationManifest(
-        trace_id="trace-1",
-        goal_id="goal-1",
-        goal_revision=1,
-        task_id="task-1",
-        run_id="run-1",
-        current_node_id="node-4",
-        acceptance_vector_ref="acceptance:goal-1:1",
-        next_action="resume node-4",
-        stop_reason=ContinuationStopReason.CONTEXT_BOUNDARY,
-        checkpoint_ref="checkpoint-9",
-        unresolved_blocker_refs=("blocker-a",),
-    )
-    assert manifest.as_dict()["stop_reason"] == "context_boundary"
-    assert manifest.content_hash.startswith("sha256:")

tests/test_isolated_executor.py

@@ -0,0 +1,67 @@
+from pathlib import Path
+import hashlib,json,os,tarfile,sys,tempfile
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+import aios_isolated_executor as mod
+
+def make_archive(tmp_path):
+    root=tmp_path/"src"; root.mkdir()
+    (root/"hello.py").write_text("VALUE = 1\n")
+    archive=tmp_path/"source.tgz"
+    with tarfile.open(archive,"w:gz") as tf: tf.add(root/"hello.py",arcname="hello.py")
+    return archive
+
+def test_isolated_executor_applies_hash_bound_change(tmp_path,monkeypatch):
+    archive=make_archive(tmp_path)
+    monkeypatch.delenv("CREDENTIALS_DIRECTORY",raising=False)
+    monkeypatch.setattr(mod,"assert_uncredentialed",lambda:None)
+    request={
+      "schema":"aios.isolated-execution.request.v1",
+      "request_id":"task-req-0000000000000000",
+      "source_archive":str(archive),
+      "source_archive_sha256":mod.sha256(archive.read_bytes()),
+      "change_set":[{
+        "path":"hello.py","operation":"replace_text","old":"VALUE = 1","new":"VALUE = 2","count":1,
+        "expected_sha256":mod.sha256(b"VALUE = 1\n")
+      }],
+      "verification":[{"label":"compile","argv":["/usr/bin/python3","-m","py_compile","hello.py"],"cwd":".","timeout_seconds":30}]
+    }
+    req=tmp_path/"req.json"; res=tmp_path/"res.json"
+    req.write_text(json.dumps(request))
+    mod.execute_request(req,res)
+    out=json.loads(res.read_text())
+    assert out["request_id"]=="task-req-0000000000000000"
+    assert out["credential_isolation"]["credential_env_absent"] is True
+    changed=out["changed_files"][0]
+    assert changed["path"]=="hello.py" and changed["deleted"] is False
+
+def test_isolated_executor_source_drift_denied(tmp_path,monkeypatch):
+    archive=make_archive(tmp_path); monkeypatch.setattr(mod,"assert_uncredentialed",lambda:None)
+    request={
+      "schema":"aios.isolated-execution.request.v1","request_id":"task-req-0000000000000001",
+      "source_archive":str(archive),
+      "source_archive_sha256":mod.sha256(archive.read_bytes()),
+      "change_set":[{"path":"hello.py","operation":"write_file","content":"x\n","expected_sha256":"0"*64}],
+      "verification":[]
+    }
+    req=tmp_path/"req.json"; res=tmp_path/"res.json"; req.write_text(json.dumps(request))
+    with pytest.raises(mod.IsolatedExecutorError,match="SOURCE_DRIFT"):
+        mod.execute_request(req,res)
+
+def test_credential_boundary_eacces_is_accepted(monkeypatch):
+    class DeniedDirectory:
+        def exists(self): return True
+        def is_symlink(self): return False
+        def is_dir(self): return True
+        def iterdir(self): raise PermissionError(13,"permission denied")
+    monkeypatch.setattr(mod.os,"access",lambda *_args,**_kwargs:False)
+    assert mod._credential_exposure(DeniedDirectory()) is None
+
+def test_systemd_unit_has_no_credentials_and_private_network():
+    unit=(ROOT/"deploy/systemd/aios-online-agent-isolated-executor.service").read_text()
+    assert "PrivateNetwork=true" in unit
+    assert "InaccessiblePaths=/run/credentials" in unit
+    assert "LoadCredential" not in unit
+    assert "SupplementaryGroups=gitops" not in unit

tests/test_message_handoff.py

@@ -0,0 +1,127 @@
+from __future__ import annotations
+
+import datetime as dt
+import pathlib
+import sys
+
+import pytest
+
+APP = pathlib.Path(__file__).resolve().parents[1] / "active-runtime" / "app"
+if str(APP) not in sys.path:
+    sys.path.insert(0, str(APP))
+
+from message_handoff import (
+    ConfidentialityScopeDenied,
+    DeliveryContext,
+    DurableHandoffStore,
+    HandoffFabric,
+    IdempotencyConflict,
+    MessageEnvelope,
+    MessageExpired,
+    MessageScopeMismatch,
+    SequenceGap,
+    authorize_delivery,
+    bind_envelope_scope,
+    stable_event_id,
+)
+
+
+def actor(**overrides):
+    values = dict(
+        tenant_id="tenant-a", user_id="user-a", project_id="project-a",
+        conversation_id="conversation-a", run_id="run-a",
+        capabilities=("task.read", "message.read"),
+    )
+    values.update(overrides)
+    return DeliveryContext(**values)
+
+
+def envelope(**overrides):
+    values = dict(
+        source="agent-a", target="agent-b", message_type="handoff.request", payload={"value": 1},
+        tenant_id="tenant-a", user_id="user-a", project_id="project-a",
+        conversation_id="conversation-a", task_id="task-a", run_id="run-a",
+        sequence=1, idempotency_key="idem-1", capability_scope=("message.read",),
+        confidentiality_scope="private",
+    )
+    values.update(overrides)
+    return MessageEnvelope(**values)
+
+
+def test_MESSAGE_TARGET_COLLISION_DENY():
+    a = stable_event_id(source="a", target="user-a", message_type="event", payload={"x": 1},
+                        tenant_id="tenant-a", sequence=1, idempotency_key="same")
+    b = stable_event_id(source="a", target="user-b", message_type="event", payload={"x": 1},
+                        tenant_id="tenant-a", sequence=1, idempotency_key="same")
+    assert a != b
+
+
+def test_MESSAGE_SCOPE_MISMATCH_DENY():
+    with pytest.raises(MessageScopeMismatch, match="MESSAGE_SCOPE_MISMATCH_DENY"):
+        bind_envelope_scope(envelope(tenant_id="tenant-b"), actor())
+
+
+def test_HANDOFF_CROSS_TENANT_DENY(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    env = envelope()
+    store.put(env)
+    with pytest.raises(MessageScopeMismatch, match="MESSAGE_SCOPE_MISMATCH_DENY"):
+        store.get(env.envelope_id, actor=actor(tenant_id="tenant-b"))
+
+
+def test_MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE():
+    with pytest.raises(ConfidentialityScopeDenied, match="MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"):
+        authorize_delivery(actor(project_id="project-b"), envelope(confidentiality_scope="project"))
+    with pytest.raises(ConfidentialityScopeDenied, match="MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"):
+        authorize_delivery(actor(), envelope(capability_scope=("message.read", "secret.read")))
+
+
+def test_MESSAGE_IDEMPOTENCY_REPLAY(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    env = envelope()
+    assert store.put(env)[0] == "CREATED"
+    status, replay = store.put(env)
+    assert status == "REPLAY"
+    assert replay.envelope_id == env.envelope_id
+    with pytest.raises(IdempotencyConflict, match="MESSAGE_IDEMPOTENCY_CONFLICT"):
+        store.put(envelope(payload={"value": 2}))
+
+
+def test_MESSAGE_SEQUENCE_GAP_DETECT(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    store.put(envelope(sequence=1, idempotency_key="one"))
+    with pytest.raises(SequenceGap, match="MESSAGE_SEQUENCE_GAP_DETECT"):
+        store.put(envelope(sequence=3, idempotency_key="three"))
+
+
+def test_sequence_advances_and_scope_filters_pending(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    store.put(envelope(sequence=1, idempotency_key="one"))
+    store.put(envelope(sequence=2, idempotency_key="two", payload={"value": 2}))
+    assert [item.sequence for item in store.pending(target="agent-b", actor=actor())] == [1, 2]
+    assert store.pending(target="agent-b", actor=actor(tenant_id="tenant-b")) == []
+
+
+def test_expired_message_rejected(tmp_path):
+    expired = (dt.datetime.now(dt.timezone.utc) - dt.timedelta(seconds=1)).isoformat()
+    with pytest.raises(MessageExpired, match="MESSAGE_EXPIRED"):
+        DurableHandoffStore(tmp_path / "handoff.sqlite3").put(envelope(expires_at=expired))
+
+
+def test_server_actor_binding_fills_scope_and_recomputes_identity():
+    public = MessageEnvelope(
+        source="agent-a", target="agent-b", message_type="handoff.request", payload={"value": 1},
+        sequence=1, idempotency_key="bind-1", confidentiality_scope="public",
+    )
+    bound = bind_envelope_scope(public, actor())
+    assert (bound.tenant_id, bound.user_id, bound.project_id, bound.run_id) == (
+        "tenant-a", "user-a", "project-a", "run-a"
+    )
+    assert bound.envelope_id != public.envelope_id
+
+
+def test_handoff_fabric_publish_is_durable(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    status, env = HandoffFabric(store).publish(envelope(), actor=actor())
+    assert status == "CREATED"
+    assert store.get(env.envelope_id, actor=actor()).payload == {"value": 1}

tests/test_model_api_trusted_candidate_builder.py

@@ -1,506 +0,0 @@
-from __future__ import annotations
-
-import base64
-import dataclasses
-import hashlib
-import importlib
-import importlib.util
-import json
-import socket
-import sys
-import threading
-import urllib.error
-import urllib.request
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from types import SimpleNamespace
-
-import pytest
-from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
-
-APP = Path(__file__).resolve().parents[1] / "active-runtime" / "app"
-AGENT_OS = Path(__file__).resolve().parents[1] / "runtime" / "agent-os"
-for import_root in (APP, AGENT_OS):
-    if str(import_root) not in sys.path:
-        sys.path.insert(0, str(import_root))
-
-from silent_release_hardening import (  # noqa: E402
-    BuilderAttestation,
-    BuilderAttestationKeyRing,
-    BuilderAttestationVerifier,
-    CapabilityAuthorizationError,
-    SilentReleaseActionService,
-    TrustedCandidateBuilderUnavailable,
-)
-import silent_release_hardening as hardening  # noqa: E402
-
-
-COMMIT = "a" * 40
-TREE = "b" * 40
-SHA = "c" * 64
-GITEA = {"consistent": True}
-
-
-def _af_inet_available() -> bool:
-    try:
-        probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-    except OSError:
-        return False
-    probe.close()
-    return True
-
-
-def _canonical_digest(value: dict) -> str:
-    return hashlib.sha256(
-        json.dumps(value, sort_keys=True, separators=(",", ":")).encode()
-    ).hexdigest()
-
-
-def _instant(delta: timedelta = timedelta()) -> str:
-    return (datetime.now(timezone.utc) + delta).isoformat().replace(
-        "+00:00", "Z"
-    )
-
-
-def _keyring_payload(private: Ed25519PrivateKey, *, purpose: str) -> dict:
-    public = private.public_key().public_bytes(
-        serialization.Encoding.Raw, serialization.PublicFormat.Raw
-    )
-    record = {
-        "algorithm": "Ed25519",
-        "purpose": purpose,
-        "key_id": "builder-key-001",
-        "generation": 1,
-        "not_before": _instant(timedelta(minutes=-1)),
-        "expires_at": _instant(timedelta(days=1)),
-        "status": "ACTIVE",
-        "public_key": base64.b64encode(public).decode("ascii"),
-        "public_key_sha256": hashlib.sha256(public).hexdigest(),
-    }
-    payload = {
-        "algorithm": "Ed25519",
-        "purpose": "AIOS_TRUSTED_RELEASE_BUILDER",
-        "keys": [record],
-    }
-    payload["keyring_sha256"] = hashlib.sha256(
-        json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    ).hexdigest()
-    return payload
-
-
-def _refresh_keyring_digest(payload: dict) -> dict:
-    canonical = {
-        "algorithm": payload["algorithm"],
-        "purpose": payload["purpose"],
-        "keys": payload["keys"],
-    }
-    payload["keyring_sha256"] = hashlib.sha256(
-        json.dumps(canonical, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    ).hexdigest()
-    return payload
-
-
-def _attestation(private: Ed25519PrivateKey) -> BuilderAttestation:
-    unsigned = BuilderAttestation(
-        builder_attestation_id="builder-attestation-001",
-        builder_key_id="builder-key-001",
-        source_commit=COMMIT,
-        tree_oid=TREE,
-        artifact_sha256=SHA,
-        manifest_sha256=SHA,
-        package_closure_sha256=SHA,
-        test_evidence_sha256=SHA,
-        canary_evidence_sha256=SHA,
-        issued_at=_instant(),
-        signature="",
-        builder_key_generation=1,
-        signature_algorithm="Ed25519",
-        signature_purpose="AIOS_TRUSTED_RELEASE_BUILDER",
-        gitea_evidence_sha256=_canonical_digest(GITEA),
-        rollback_evidence_sha256=_canonical_digest({
-            "ready": True,
-            "rollback_sha256": SHA,
-            "source_commit": COMMIT,
-        }),
-        policy_evidence_sha256=SHA,
-        secret_scan_evidence_sha256=SHA,
-    )
-    return BuilderAttestation(
-        **{
-            **unsigned.canonical_payload,
-            "signature": base64.b64encode(
-                private.sign(unsigned.canonical_bytes())
-            ).decode("ascii"),
-        }
-    )
-
-
-def test_builder_verifier_rejects_owner_key_record_cross_purpose(tmp_path):
-    private = Ed25519PrivateKey.generate()
-    payload = _keyring_payload(private, purpose="owner_approval")
-    path = tmp_path / "builder-keyring.json"
-    path.write_text(json.dumps(payload), encoding="utf-8")
-
-    with pytest.raises(ValueError, match="purpose"):
-        BuilderAttestationKeyRing.from_file(path)
-
-
-def test_builder_verifier_checks_domain_key_window_digest_and_signature(tmp_path):
-    private = Ed25519PrivateKey.generate()
-    path = tmp_path / "builder-keyring.json"
-    path.write_text(
-        json.dumps(_keyring_payload(private, purpose="AIOS_TRUSTED_RELEASE_BUILDER")),
-        encoding="utf-8",
-    )
-    verifier = BuilderAttestationVerifier(
-        BuilderAttestationKeyRing.from_file(path)
-    )
-    candidate = SimpleNamespace(
-        source_commit=COMMIT,
-        tree_oid=TREE,
-        artifact_sha256=SHA,
-        manifest_sha256=SHA,
-        gitea_consistency=GITEA,
-        rollback_ready=True,
-    )
-    plan = SimpleNamespace(
-        deployment=SimpleNamespace(
-            package_closure_sha256=SHA,
-            rollback_sha256=SHA,
-        ),
-        policy_sha256=SHA,
-    )
-    assert verifier.verify(_attestation(private), candidate, plan).builder_key_id == "builder-key-001"
-
-
-@pytest.mark.parametrize("state", ["REVOKED", "EXPIRED", "FUTURE"])
-def test_builder_verifier_rejects_unavailable_key_lifecycle_states(tmp_path, state):
-    private = Ed25519PrivateKey.generate()
-    payload = _keyring_payload(private, purpose="AIOS_TRUSTED_RELEASE_BUILDER")
-    record = payload["keys"][0]
-    if state == "REVOKED":
-        record["status"] = "REVOKED"
-    elif state == "EXPIRED":
-        record["not_before"] = _instant(timedelta(days=-2))
-        record["expires_at"] = _instant(timedelta(days=-1))
-    else:
-        record["not_before"] = _instant(timedelta(days=1))
-        record["expires_at"] = _instant(timedelta(days=2))
-    path = tmp_path / "builder-keyring.json"
-    path.write_text(json.dumps(_refresh_keyring_digest(payload)), encoding="utf-8")
-    verifier = BuilderAttestationVerifier(BuilderAttestationKeyRing.from_file(path))
-    candidate = SimpleNamespace(
-        source_commit=COMMIT, tree_oid=TREE,
-        artifact_sha256=SHA, manifest_sha256=SHA,
-        gitea_consistency=GITEA, rollback_ready=True,
-    )
-    plan = SimpleNamespace(deployment=SimpleNamespace(package_closure_sha256=SHA, rollback_sha256=SHA), policy_sha256=SHA)
-    with pytest.raises(CapabilityAuthorizationError, match="validity|revoked|unavailable"):
-        verifier.verify(_attestation(private), candidate, plan)
-
-
-def test_builder_verifier_rejects_unknown_key_invalid_signature_and_keyring_digest(tmp_path):
-    private = Ed25519PrivateKey.generate()
-    payload = _keyring_payload(private, purpose="AIOS_TRUSTED_RELEASE_BUILDER")
-    path = tmp_path / "builder-keyring.json"
-    path.write_text(json.dumps(payload), encoding="utf-8")
-    verifier = BuilderAttestationVerifier(BuilderAttestationKeyRing.from_file(path))
-    candidate = SimpleNamespace(
-        source_commit=COMMIT, tree_oid=TREE,
-        artifact_sha256=SHA, manifest_sha256=SHA,
-        gitea_consistency=GITEA, rollback_ready=True,
-    )
-    plan = SimpleNamespace(deployment=SimpleNamespace(package_closure_sha256=SHA, rollback_sha256=SHA), policy_sha256=SHA)
-    with pytest.raises(CapabilityAuthorizationError, match="not trusted"):
-        verifier.verify(
-            dataclasses.replace(_attestation(private), builder_key_id="unknown-builder-key"),
-            candidate,
-            plan,
-        )
-    with pytest.raises(CapabilityAuthorizationError, match="signature"):
-        verifier.verify(
-            dataclasses.replace(_attestation(private), signature=base64.b64encode(b"x" * 64).decode()),
-            candidate,
-            plan,
-        )
-
-    payload["keyring_sha256"] = "0" * 64
-    path.write_text(json.dumps(payload), encoding="utf-8")
-    with pytest.raises(ValueError, match="keyring digest"):
-        BuilderAttestationKeyRing.from_file(path)
-
-
-def test_builder_attestation_rejects_tampered_digest_and_signing_metadata():
-    private = Ed25519PrivateKey.generate()
-    raw = _attestation(private).to_dict()
-    raw["fingerprint"] = "0" * 64
-    with pytest.raises(CapabilityAuthorizationError, match="digest is invalid"):
-        BuilderAttestation.from_dict(raw, require_fingerprint=True)
-
-
-@pytest.mark.parametrize(
-    "field,value",
-    [
-        ("builder_key_generation", 2),
-        ("signature_algorithm", "RSA"),
-        ("signature_purpose", "owner_approval"),
-    ],
-)
-def test_builder_keyring_rejects_attestation_metadata_mismatch(tmp_path, field, value):
-    private = Ed25519PrivateKey.generate()
-    path = tmp_path / "builder-keyring.json"
-    path.write_text(
-        json.dumps(_keyring_payload(private, purpose="AIOS_TRUSTED_RELEASE_BUILDER")),
-        encoding="utf-8",
-    )
-    verifier = BuilderAttestationVerifier(
-        BuilderAttestationKeyRing.from_file(path)
-    )
-    candidate = SimpleNamespace(
-        source_commit=COMMIT, tree_oid=TREE,
-        artifact_sha256=SHA, manifest_sha256=SHA,
-        gitea_consistency=GITEA, rollback_ready=True,
-    )
-    plan = SimpleNamespace(deployment=SimpleNamespace(package_closure_sha256=SHA, rollback_sha256=SHA), policy_sha256=SHA)
-    with pytest.raises(CapabilityAuthorizationError, match="metadata"):
-        verifier.verify(
-            dataclasses.replace(_attestation(private), **{field: value}),
-            candidate,
-            plan,
-        )
-    raw = _attestation(private).to_dict()
-    raw["builder_key_generation"] = 2
-    with pytest.raises(CapabilityAuthorizationError, match="digest is invalid"):
-        BuilderAttestation.from_dict(raw, require_fingerprint=True)
-
-
-def test_builder_unavailable_intent_is_bounded_retryable_and_recovers_without_secret(tmp_path, monkeypatch):
-    class UnavailableBuilder:
-        def build(self, intent):
-            raise TrustedCandidateBuilderUnavailable("socket token=should-not-leak")
-
-    monkeypatch.setattr(hardening, "_fsync_directory", lambda _path: None)
-    service = SilentReleaseActionService(
-        tmp_path,
-        candidate_builder=UnavailableBuilder(),
-        max_builder_attempts=2,
-    )
-    payload = {"event_id": "event-builder-001", "source_commit": COMMIT}
-
-    first = service.create_release_intent(payload)
-    second = service.create_release_intent(payload)
-
-    assert first["status"] == "BUILDER_RETRYABLE_FAILURE"
-    assert first["retryable"] is True
-    assert first["attempt_count"] == 1
-    assert "should-not-leak" not in json.dumps(first)
-    assert second["status"] == "BUILDER_TERMINAL_FAILURE"
-    assert second["retryable"] is False
-    assert second["attempt_count"] == 2
-
-
-def test_stale_building_intent_recovers_after_restart_without_double_running_active_attempt(tmp_path, monkeypatch):
-    class CountingUnavailableBuilder:
-        calls = 0
-
-        def build(self, intent):
-            self.calls += 1
-            raise TrustedCandidateBuilderUnavailable("nonsecret")
-
-    monkeypatch.setattr(hardening, "_fsync_directory", lambda _path: None)
-    builder = CountingUnavailableBuilder()
-    service = SilentReleaseActionService(
-        tmp_path,
-        candidate_builder=builder,
-        max_builder_attempts=3,
-        builder_attempt_timeout_seconds=1,
-    )
-    payload = {"event_id": "event-builder-crash-001", "source_commit": COMMIT}
-    intent_id = "intent-" + hashlib.sha256(
-        f"{payload['event_id']}\0{COMMIT}".encode()
-    ).hexdigest()[:24]
-    intent_path = tmp_path / "intents" / f"{intent_id}.json"
-    intent_path.parent.mkdir(parents=True)
-    active_record = {
-        "attempt_count": 1,
-        "attempt_started_at": _instant(),
-        "created_at": _instant(timedelta(minutes=-1)),
-        "event_id": payload["event_id"],
-        "intent_id": intent_id,
-        "source_commit": COMMIT,
-        "status": "BUILDING",
-    }
-    intent_path.write_text(json.dumps(active_record), encoding="utf-8")
-
-    active = service.create_release_intent(payload)
-    assert active["status"] == "BUILDING"
-    assert active["idempotent"] is True
-    assert builder.calls == 0
-
-    active_record["attempt_started_at"] = _instant(timedelta(minutes=-5))
-    intent_path.write_text(json.dumps(active_record), encoding="utf-8")
-    recovered = service.create_release_intent(payload)
-    assert recovered["status"] == "BUILDER_RETRYABLE_FAILURE"
-    assert recovered["attempt_count"] == 2
-    assert recovered["failure_code"] == "TRUSTED_BUILDER_UNAVAILABLE"
-    assert recovered["last_recovery_code"] == "TRUSTED_BUILDER_CRASH_RECOVERED"
-    assert recovered["recovery_count"] == 1
-    assert builder.calls == 1
-
-
-@pytest.mark.skipif(sys.platform == "win32", reason="model API runtime requires POSIX fcntl")
-@pytest.mark.skipif(
-    not _af_inet_available(),
-    reason="isolated executor permits AF_UNIX only; live HTTP probe runs at activation",
-)
-def test_model_api_keeps_process_liveness_separate_from_builder_readiness(monkeypatch):
-    api = importlib.import_module("aios_model_api_staging")
-
-    class FakeService:
-        ready = False
-
-        def get_builder_readiness(self):
-            return {"status": "READY" if self.ready else "UNAVAILABLE"}
-
-        def create_release_candidate(self, payload):
-            if not payload:
-                raise ValueError("event_id is required")
-            return {"status": "READY_FOR_APPROVAL"}
-
-    service = FakeService()
-    monkeypatch.setattr(api, "silent_release_service", lambda: service)
-    monkeypatch.setattr(
-        api,
-        "authenticate",
-        lambda token: (
-            {"account": "test", "role": "owner", "scopes": ["release:candidate"]}
-            if token == "test-token"
-            else None
-        ),
-    )
-    server = api.ThreadingHTTPServer(("127.0.0.1", 0), api.H)
-    thread = threading.Thread(target=server.serve_forever, daemon=True)
-    thread.start()
-    base = f"http://127.0.0.1:{server.server_port}"
-
-    def request(path, body=None):
-        data = None if body is None else json.dumps(body).encode("utf-8")
-        value = urllib.request.Request(
-            base + path,
-            data=data,
-            headers={"Authorization": "Bearer test-token"},
-            method="POST" if body is not None else "GET",
-        )
-        try:
-            with urllib.request.urlopen(value, timeout=5) as response:
-                return response.status, json.load(response)
-        except urllib.error.HTTPError as error:
-            return error.code, json.load(error)
-
-    try:
-        health_code, health = request("/health")
-        unavailable_code, unavailable = request("/createReleaseCandidate", {})
-        service.ready = True
-        invalid_code, invalid = request("/createReleaseCandidate", {})
-    finally:
-        server.shutdown()
-        server.server_close()
-        thread.join(timeout=5)
-
-    assert health_code == 200
-    assert health["process_liveness"] == "PASS"
-    assert health["builder_readiness"]["status"] == "UNAVAILABLE"
-    assert unavailable_code == 503
-    assert unavailable["error"] == "TRUSTED_BUILDER_UNAVAILABLE"
-    assert invalid_code == 400
-    assert invalid["error"] == "event_id is required"
-
-
-@pytest.mark.skipif(sys.platform == "win32", reason="model API runtime requires POSIX fcntl")
-def test_host_adapter_accepts_a_real_builder_bundle_response():
-    spec = importlib.util.spec_from_file_location(
-        "trusted_builder_public_seam",
-        APP.parents[1] / "tests" / "test_trusted_candidate_builder.py",
-    )
-    assert spec and spec.loader
-    backend_seam = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(backend_seam)
-    server, client, _ = backend_seam.make_seam()
-    candidate_id = "rc-v2r2c2-d2b5a8339a34"
-    source_commit = "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6"
-    response = server.handle_request(
-        client.create_request(
-            "V2R2C2", candidate_id, source_commit, nonce="z" * 32
-        ),
-        connection=object(),
-    )
-
-    class ResponseClient:
-        def build(self, version, supplied_candidate_id, supplied_source, *, nonce):
-            assert version == "V2R2C2"
-            assert supplied_candidate_id == candidate_id
-            assert supplied_source == source_commit
-            assert len(nonce) >= 32
-            return response
-
-    api = importlib.import_module("aios_model_api_staging")
-    bundle = api._HostTrustedCandidateBuilderAdapter(ResponseClient()).build(
-        {
-            "candidate_id": candidate_id,
-            "source_commit": source_commit,
-            "version": "V2R2C2",
-        }
-    )
-
-    assert bundle.validate().candidate.source_commit == response["base_oid"]
-    assert bundle.attestation.builder_key_id == response["attestation"]["builder_key_id"]
-
-
-@pytest.mark.skipif(sys.platform == "win32", reason="model API runtime requires POSIX fcntl")
-def test_host_adapter_forwards_v2r2c3_to_the_policy_and_fails_closed_when_unavailable():
-    from aios_trusted_candidate_builder import BuilderError
-    api = importlib.import_module("aios_model_api_staging")
-    calls = []
-
-    class DerivedOnlyClient:
-        def build(self, version, candidate_id, source_commit, *, nonce):
-            calls.append((version, candidate_id, source_commit, nonce))
-            raise BuilderError("GOVERNED_V2R2C3_DERIVATION_REQUIRED")
-
-    with pytest.raises(TrustedCandidateBuilderUnavailable):
-        api._HostTrustedCandidateBuilderAdapter(DerivedOnlyClient()).build(
-            {
-                "candidate_id": "r42-release-candidate-v2r2c3-20260820",
-                "source_commit": COMMIT,
-                "version": "V2R2C3",
-            }
-        )
-    assert calls[0][:3] == (
-        "V2R2C3",
-        "r42-release-candidate-v2r2c3-20260820",
-        COMMIT,
-    )
-
-
-def test_host_adapter_accepts_intent_only_without_caller_candidate_id():
-    api = importlib.import_module('aios_model_api_staging')
-    calls = []
-
-    class IntentClient:
-        def build(self, version, candidate_id, source_commit, *, nonce):
-            calls.append((version, candidate_id, source_commit, nonce))
-            raise RuntimeError('intent-only probe')
-
-    with pytest.raises(RuntimeError, match='intent-only probe'):
-        api._HostTrustedCandidateBuilderAdapter(IntentClient()).build({
-            'event_id': 'event-intent-only',
-            'intent_id': 'intent-intent-only',
-            'source_commit': COMMIT,
-            'version': 'V2R2C2',
-        })
-    assert calls[0][0] == 'V2R2C2'
-    assert calls[0][1] == ''
-    assert calls[0][2] == COMMIT
-    assert len(calls[0][3]) >= 32

tests/test_online_agent_auto_claim.py

@@ -0,0 +1,524 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+import sys
+from types import SimpleNamespace
+
+import pytest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+APP = ROOT / "active-runtime" / "app"
+sys.path.insert(0, str(APP))
+
+from aios_chatgpt_bridge_v2 import (  # noqa: E402
+    BRIDGE_OPERATION_CONTRACTS,
+    BridgeV2Adapter,
+)
+from aios_chatgpt_bridge_v2_server import GovernedRuntime  # noqa: E402
+from aios_governed_task_bootstrap import BootstrapError, GovernedTaskBinding, GovernedTaskBootstrap, _task_key  # noqa: E402
+from aios_online_agent_execution import (  # noqa: E402
+    ExecutionProjectionError,
+    GovernedExecutionBinding,
+    OnlineTaskProjectionClient,
+    project_execution_envelope,
+    project_online_task,
+    validate_execution_envelope,
+)
+import aios_online_agent_worker as worker_module  # noqa: E402
+from aios_online_agent_worker import ExecutionEnvelope, WorkerError, WorkerSupervisor, governed_commit, load_task_state  # noqa: E402
+
+
+BASE = "a642b045775b9154a00ae78543037fbef4fb447b"
+TASK = "p0-claim-online-agent-auto-execution-20260817"
+JOB = "job-2031a9e5682a4238f98e3ac7aee8a593"
+BRANCH = "agent/p0-claim-online-agent-auto-execution-20260817"
+
+
+def binding() -> GovernedExecutionBinding:
+    return GovernedExecutionBinding.from_mapping(
+        {
+            "task_id": TASK,
+            "job_id": JOB,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "expected_branch_oid": BASE,
+            "target_branch": BRANCH,
+            "branch_mode": "CREATE_NEW",
+            "generation": 1,
+            "idempotency_key": "p0-claim-online-agent-auto-execution-v1",
+        }
+    )
+
+
+def task_without_envelope() -> dict:
+    return {
+        "task_id": TASK,
+        "goal": "make governed Online Tasks automatically executable",
+        "instructions": "project, claim, heartbeat, and preserve exact lineage",
+        "required_capabilities": ["git.read", "git.test"],
+        "metadata": {},
+    }
+
+
+def test_project_online_task_builds_execution_metadata_from_binding() -> None:
+    projected = project_online_task(binding(), task_without_envelope())
+    execution = projected["metadata"]["execution"]
+    assert execution["schema"] == "aios.online-agent.execution.v2"
+    assert execution["job_id"] == JOB
+    assert execution["task_id"] == TASK
+    assert execution["repository"] == "aios/aios"
+    assert execution["base_oid"] == BASE
+    assert execution["expected_branch_oid"] == BASE
+    assert execution["target_branch"] == BRANCH
+    assert execution["generation"] == 1
+    assert projected["metadata"]["execution_projection"]["execution_digest"] == execution["execution_digest"]
+
+
+def test_job_to_task_execution_projection(tmp_path: Path) -> None:
+    exact = binding()
+    durable = GovernedTaskBinding(
+        task_id=exact.task_id,
+        job_id=exact.job_id,
+        repository=exact.repository,
+        base_oid=exact.base_oid,
+        expected_branch_oid=exact.expected_branch_oid,
+        target_branch=exact.target_branch,
+        branch_mode=exact.branch_mode,
+        generation=exact.generation,
+        idempotency_key=exact.idempotency_key,
+        risk="engineering",
+        description="automatic claim infrastructure",
+    )
+
+    class Bootstrap:
+        def create(self, _request: dict) -> dict:
+            return durable.response()
+
+        def online_task_projection(self, _task_id: str, online: dict, execution: dict | None, **_kwargs: object) -> dict:
+            return project_online_task(exact, online, execution)
+
+        def get_binding(self, _task_id: str) -> GovernedTaskBinding:
+            return durable
+
+        def execution_binding(self, _binding: GovernedTaskBinding) -> GovernedExecutionBinding:
+            return exact
+
+    class Projector:
+        def __init__(self) -> None:
+            self.calls = 0
+
+        def create(self, projected: dict, *, binding: GovernedExecutionBinding) -> dict:
+            self.calls += 1
+            assert binding == exact
+            return {**projected, "status": "QUEUED"}
+
+    runtime = GovernedRuntime.__new__(GovernedRuntime)
+    runtime.bootstrap = Bootstrap()
+    runtime.bindings = {}
+    runtime.online_task_projector = Projector()
+    runtime.projection_outbox_root = tmp_path / "projection-outbox"
+    runtime.projection_outbox_root.mkdir()
+    response = GovernedRuntime.create_task(
+        runtime,
+        {
+            "task_id": TASK,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "target_branch": BRANCH,
+            "risk": "engineering",
+            "description": "automatic claim infrastructure",
+            "idempotency_key": exact.idempotency_key,
+            "online_task": task_without_envelope(),
+        },
+    )
+    assert response["online_task_projection"]["status"] == "PROJECTED"
+    assert response["online_task_projection"]["task_status"] == "QUEUED"
+    assert runtime.online_task_projector.calls == 1
+
+
+def test_execution_envelope_schema_validation() -> None:
+    envelope = project_execution_envelope(binding())
+    validate_execution_envelope(envelope, binding=binding())
+    malformed = dict(envelope)
+    malformed["schema"] = "aios.online-agent.execution.v1"
+    with pytest.raises(ExecutionProjectionError, match="EXECUTION_ENVELOPE_SCHEMA_VALIDATION"):
+        validate_execution_envelope(malformed, binding=binding())
+
+
+def test_projection_response_must_equal_submitted_execution(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    submitted = project_online_task(binding(), task_without_envelope(), {"action": "source_capture", "source_signals": ["submitted"]})
+    returned = project_online_task(binding(), task_without_envelope(), {"action": "source_capture", "source_signals": ["different"]})
+    returned.update({"status": "QUEUED"})
+
+    class Response:
+        status = 201
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_args: object) -> None:
+            return None
+
+        def read(self) -> bytes:
+            return json.dumps(returned).encode("utf-8")
+
+    monkeypatch.setattr("aios_online_agent_execution.urllib.request.urlopen", lambda *_args, **_kwargs: Response())
+    token = tmp_path / "control.token"
+    token.write_text("x" * 40, encoding="utf-8")
+    with pytest.raises(ExecutionProjectionError, match="ONLINE_TASK_PROJECTION_RESPONSE_BINDING_INVALID"):
+        OnlineTaskProjectionClient("http://127.0.0.1:1", token).create(submitted, binding=binding())
+
+
+class _ProjectedBridge:
+    def __init__(self, value: dict) -> None:
+        self.value = value
+        self.calls = 0
+
+    def project_execution(self, _task: dict, _execution: dict | None = None) -> tuple[int, dict]:
+        self.calls += 1
+        return 200, self.value
+
+
+class _FakeAgent:
+    def __init__(self, tasks: list[dict]) -> None:
+        self.tasks = tasks
+        self.claimed: list[str] = []
+
+    def poll(self) -> list[dict]:
+        return self.tasks
+
+    def claim(self, task_id: str) -> tuple[int, dict]:
+        self.claimed.append(task_id)
+        return 200, {"task_id": task_id, "lease_token": "x" * 32, "attempt": 1, "revision": 2}
+
+
+def test_task_visible_to_worker_claimable(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path)
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    envelope, source = supervisor.resolve_envelope(task_without_envelope())
+    assert source == "recovered_projection"
+    assert envelope.task_id == TASK
+    assert envelope.job_id == JOB
+    assert envelope.action == "source_capture"
+
+
+def test_task_claim_after_projection(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path)
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    fake_agent = _FakeAgent([task_without_envelope()])
+    supervisor.agent = fake_agent
+    supervisor.bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    processed: list[tuple[str, str]] = []
+    supervisor.process_claim = lambda task, claim, envelope: processed.append((task["task_id"], envelope.execution_digest if hasattr(envelope, "execution_digest") else envelope.digest))  # type: ignore[method-assign]
+    assert supervisor.once() == 0
+    assert fake_agent.claimed == [TASK]
+    assert processed and processed[0][0] == TASK
+
+
+def test_claim_heartbeat_source_capture_and_result_lifecycle(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    execution = project_execution_envelope(binding(), {"action": "source_capture", "source_signals": ["agent"]})
+    task = task_without_envelope()
+    task["metadata"] = {"execution": execution}
+
+    class Agent:
+        def __init__(self) -> None:
+            self.heartbeats: list[str] = []
+            self.results: list[dict] = []
+
+        def heartbeat(self, _task_id: str, _lease_token: str, stage: str) -> tuple[int, dict]:
+            self.heartbeats.append(stage)
+            return 200, {}
+
+        def get(self, _task_id: str) -> tuple[int, dict]:
+            return 200, task
+
+        def result(self, _task_id: str, _lease_token: str, _key: str, result: dict) -> tuple[int, dict]:
+            self.results.append(result)
+            return 200, {}
+
+    worktree = tmp_path / "worktree"
+    source = worktree / "active-runtime" / "app" / "agent_auto_fixture.py"
+    source.parent.mkdir(parents=True)
+    source.write_text("VALUE = 1\n", encoding="utf-8")
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path / "state")
+    monkeypatch.setattr(worker_module, "new_run_root", lambda: tmp_path / "run")
+    monkeypatch.setattr(worker_module, "prepare_worktree", lambda *_args, **_kwargs: worktree)
+    monkeypatch.setattr(worker_module, "cleanup_run_root", lambda *_args, **_kwargs: None)
+    agent = Agent()
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.agent = agent
+    supervisor.bridge = _ProjectedBridge(execution)
+    envelope, _ = supervisor.resolve_envelope(task)
+    supervisor.process_claim(task, {"task_id": TASK, "lease_token": "l" * 32, "attempt": 2, "revision": 8}, envelope)
+    assert agent.heartbeats and agent.heartbeats[0] == "claimed"
+    assert len(agent.results) == 1
+    assert agent.results[0]["status"] == "SUCCEEDED"
+    assert agent.results[0]["classification"] == "NEEDS_REWORK_SOURCE_CAPTURE"
+
+
+def test_dynamic_task_binding_no_hardcoded_task_id() -> None:
+    worker = (APP / "aios_online_agent_worker.py").read_text(encoding="utf-8")
+    assert TASK not in worker
+    assert BASE not in worker
+    for name in ("aios-online-agent-worker.service", "aios-online-engineering-consumer.service"):
+        unit = (ROOT / "deploy" / "systemd" / name).read_text(encoding="utf-8")
+        assert TASK not in unit
+        assert JOB not in unit
+        assert BASE not in unit
+        assert BRANCH not in unit
+        assert "AIOS_ENGINEERING_PLAN_FILE" not in unit
+        assert "aios_online_agent_worker.py" in unit
+    projection = (ROOT / "deploy" / "systemd" / "aios-chatgpt-bridge-v2-agent-task-projection.conf").read_text(encoding="utf-8")
+    assert "AIOS_ONLINE_TASK_PROJECTION_ENABLED=1" in projection
+    assert "LoadCredential=agent_task_control_token:" in projection
+    assert "LoadCredentialEncrypted=" not in projection
+    assert "Bearer " not in projection
+
+
+def test_durable_task_key_has_collision_resistant_exact_identity() -> None:
+    assert _task_key("task:a") != _task_key("task-a")
+    assert _task_key("x" * 140 + "a") != _task_key("x" * 140 + "b")
+
+
+def test_existing_binding_rejects_idempotency_head_and_generation_drift(tmp_path: Path) -> None:
+    class Authority:
+        @staticmethod
+        def commit_exists(_oid: str) -> bool:
+            return True
+
+        @staticmethod
+        def read_ref(_ref: str) -> None:
+            return None
+
+    bootstrap = GovernedTaskBootstrap(Authority(), tmp_path, remote_name="origin", token_path=tmp_path / "token", ssh_key_path=tmp_path / "key")
+    request = {
+        "task_id": TASK,
+        "repository": "aios/aios",
+        "base_oid": BASE,
+        "target_branch": BRANCH,
+        "risk": "engineering",
+        "description": "automatic claim infrastructure",
+        "idempotency_key": "p0-claim-online-agent-auto-execution-v1",
+        "expected_branch_oid": BASE,
+        "generation": 1,
+    }
+    bootstrap.create(request)
+    for drift in (
+        {"idempotency_key": "p0-claim-online-agent-auto-execution-v2"},
+        {"expected_branch_oid": "b" * 40},
+        {"generation": 2},
+    ):
+        with pytest.raises(BootstrapError, match="TASK_BINDING_CONFLICT"):
+            bootstrap.create({**request, **drift})
+
+
+def test_existing_branch_without_durable_parent_ownership_is_denied(tmp_path: Path) -> None:
+    class Authority:
+        @staticmethod
+        def commit_exists(_oid: str) -> bool:
+            return True
+
+        @staticmethod
+        def read_ref(_ref: str) -> str:
+            return BASE
+
+    bootstrap = GovernedTaskBootstrap(Authority(), tmp_path, remote_name="origin", token_path=tmp_path / "token", ssh_key_path=tmp_path / "key")
+    with pytest.raises(BootstrapError, match="EXISTING_BRANCH_OWNERSHIP_REQUIRED"):
+        bootstrap.create({
+            "task_id": TASK,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "target_branch": BRANCH,
+            "risk": "engineering",
+            "description": "automatic claim infrastructure",
+            "idempotency_key": "p0-claim-online-agent-auto-execution-v1",
+            "expected_branch_oid": BASE,
+            "generation": 2,
+        })
+
+
+@pytest.mark.parametrize(
+    ("field", "value", "error"),
+    [
+        ("repository", "other/repo", "WRONG_REPOSITORY_ENVELOPE_DENY"),
+        ("target_branch", "agent/wrong-branch", "WRONG_BRANCH_ENVELOPE_DENY"),
+        ("generation", 2, "WRONG_GENERATION_ENVELOPE_DENY"),
+    ],
+)
+def test_wrong_lineage_envelope_deny(field: str, value: object, error: str) -> None:
+    envelope = project_execution_envelope(binding())
+    envelope[field] = value
+    with pytest.raises(ExecutionProjectionError, match=error):
+        validate_execution_envelope(envelope, binding=binding())
+
+
+def test_capability_mismatch_deny() -> None:
+    envelope = project_execution_envelope(
+        binding(),
+        {"action": "source_capture", "capability_scope": ["git.read", "governed.write.file"]},
+    )
+    with pytest.raises(ExecutionProjectionError, match="CAPABILITY_MISMATCH_DENY"):
+        validate_execution_envelope(envelope, binding=binding(), worker_capabilities=["git.read"])
+
+
+def test_governance_lineage_override_deny() -> None:
+    envelope = project_execution_envelope(binding())
+    envelope["governance"] = {**envelope["governance"], "job_id": "job-wrong-lineage"}
+    with pytest.raises(ExecutionProjectionError, match="JOB_BINDING_CONFLICT"):
+        validate_execution_envelope(envelope, binding=binding())
+
+
+def test_malformed_persisted_envelope_does_not_fallback() -> None:
+    task = task_without_envelope()
+    task["metadata"] = {"execution": {"schema": "broken"}}
+    bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.bridge = bridge
+    with pytest.raises(WorkerError, match="EXECUTION_ENVELOPE_SCHEMA_VALIDATION"):
+        supervisor.resolve_envelope(task)
+    assert bridge.calls == 0
+
+
+def test_self_consistent_persisted_wrong_lineage_is_denied_by_authority() -> None:
+    task = task_without_envelope()
+    wrong = binding()
+    wrong = GovernedExecutionBinding.from_mapping({**wrong.public(), "job_id": "job-00000000000000000000000000000000"})
+    task["metadata"] = {"execution": project_execution_envelope(wrong)}
+    supervisor = WorkerSupervisor("runtime-token-not-secret")
+    supervisor.bridge = _ProjectedBridge(project_execution_envelope(binding()))
+    with pytest.raises(WorkerError, match="TASK_PERSISTED_BINDING_CONFLICT"):
+        supervisor.resolve_envelope(task)
+
+
+def test_projection_control_missing_denies_before_governed_side_effect() -> None:
+    class Bootstrap:
+        called = False
+
+        def create(self, _request: dict) -> dict:
+            self.called = True
+            raise AssertionError("must not create governed state")
+
+    runtime = GovernedRuntime.__new__(GovernedRuntime)
+    runtime.bootstrap = Bootstrap()
+    runtime.online_task_projector = None
+    with pytest.raises(RuntimeError, match="ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE"):
+        GovernedRuntime.create_task(runtime, {"task_id": TASK, "require_online_task_projection": True})
+    assert runtime.bootstrap.called is False
+
+
+def test_source_capture_projection_cannot_write() -> None:
+    envelope = project_execution_envelope(binding())
+    assert envelope["action"] == "source_capture"
+    assert envelope["change_set"] == []
+    assert envelope["verification"] == []
+    assert envelope["governance"]["writer_lease"] is False
+    assert all(envelope["governance"][field] is False for field in ("main_write", "production_write", "tag_write", "baseline_write", "force_push", "protected_ref_bypass"))
+
+
+def test_source_capture_state_allows_next_attempt_deterministic_digest(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(worker_module, "STATE_ROOT", tmp_path)
+    state_path = tmp_path / "tasks" / f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({"task_id": TASK, "execution_digest": "a" * 64, "phase": "source_capture_done"}), encoding="utf-8")
+    assert load_task_state(TASK, "b" * 64) is None
+
+
+def test_bridge_exposes_controlled_projection_operation() -> None:
+    seen: list[dict] = []
+    adapter = BridgeV2Adapter(
+        runtime_status={},
+        handlers={"projectOnlineAgentExecution": lambda request: seen.append(dict(request)) or project_execution_envelope(binding())},
+    )
+    response = adapter.projectOnlineAgentExecution({"task_id": TASK})
+    assert response["job_id"] == JOB
+    assert seen == [{"task_id": TASK}]
+    assert BRIDGE_OPERATION_CONTRACTS["projectOnlineAgentExecution"]["path"] == "/v2/execution-envelope"
+
+
+def test_execution_digest_is_canonical() -> None:
+    envelope = project_execution_envelope(binding())
+    material = {key: value for key, value in envelope.items() if key != "execution_digest"}
+    expected = hashlib.sha256(json.dumps(material, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    assert envelope["execution_digest"] == expected
+
+
+def test_governed_commit_uses_existing_exact_job_without_recreating(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    execution = project_execution_envelope(
+        binding(),
+        {
+            "action": "deterministic",
+            "change_set": [{"operation": "write_file", "path": "result.txt", "content": "ok\n"}],
+            "governance": {"allowed_files": ["result.txt"]},
+        },
+    )
+    envelope = ExecutionEnvelope.from_task({"task_id": TASK, "metadata": {"execution": execution}})
+    (tmp_path / "result.txt").write_text("ok\n", encoding="utf-8")
+    commit_oid = "b" * 40
+
+    class Bridge:
+        def __init__(self) -> None:
+            self.routes: list[str] = []
+
+        def call(self, route: str, body: dict) -> tuple[int, dict]:
+            self.routes.append(route)
+            if route == "/v2/job":
+                assert body == {"job_id": JOB}
+            else:
+                assert body["task_id"] == TASK
+                assert body["job_id"] == JOB
+            if route == "/v2/writer-lease":
+                return 200, {
+                    "task_id": TASK,
+                    "job_id": JOB,
+                    "repository": "aios/aios",
+                    "base_oid": BASE,
+                    "expected_branch_oid": BASE,
+                    "branch_mode": "CREATE_NEW",
+                    "generation": 1,
+                    "target_branch": BRANCH,
+                }
+            if route == "/v2/commit-files":
+                return 200, {
+                    "job_id": JOB,
+                    "target_branch": BRANCH,
+                    "generation": 1,
+                    "branch_mode": "CONTINUE_EXISTING",
+                    "commit_oid": commit_oid,
+                    "commit_visible": True,
+                    "receipt": {
+                        "remote_verified": True,
+                        "authority_oid": commit_oid,
+                        "api_branch_oid": commit_oid,
+                        "git_remote_oid": commit_oid,
+                    },
+                }
+            if route == "/v2/job":
+                return 200, {
+                    "state": "COMPLETED",
+                    "receipt": {
+                        "remote_verified": True,
+                        "authority_oid": commit_oid,
+                        "api_branch_oid": commit_oid,
+                        "git_remote_oid": commit_oid,
+                    },
+                    "branch_leases": [{
+                        "job_id": JOB,
+                        "branch": BRANCH,
+                        "state": "ACTIVE",
+                        "generation": 1,
+                        "current_head_oid": commit_oid,
+                    }],
+                }
+            raise AssertionError(route)
+
+    bridge = Bridge()
+    monkeypatch.setattr(worker_module.subprocess, "run", lambda *args, **kwargs: SimpleNamespace(returncode=0, stdout=commit_oid + "\n", stderr=""))
+    heartbeat = SimpleNamespace(ensure=lambda: None)
+    result = governed_commit(envelope, tmp_path, bridge, heartbeat)
+    assert bridge.routes == ["/v2/writer-lease", "/v2/commit-files", "/v2/job"]
+    assert result["job_id"] == JOB
+    assert result["commit_oid"] == commit_oid

tests/test_online_agent_plan_store.py

@@ -0,0 +1,60 @@
+from pathlib import Path
+import sys
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+
+from aios_online_agent_execution import GovernedExecutionBinding
+from aios_online_agent_plan_store import ExecutionPlanStore, ExecutionPlanError
+
+BASE="a642b045775b9154a00ae78543037fbef4fb447b"
+HEAD="71523aef6e48b1e2fa516c456ca189b7a039104b"
+
+def binding(head=HEAD):
+    return GovernedExecutionBinding.from_mapping({
+      "task_id":"task-plan-a","job_id":"job-plan-a","repository":"aios/aios","base_oid":BASE,
+      "expected_branch_oid":head,"target_branch":"agent/task-plan-a","branch_mode":"CONTINUE_EXISTING",
+      "generation":1,"idempotency_key":"governed-plan-a",
+    })
+
+def request():
+    return {
+      "schema":"aios.online-agent.plan.v1","task_id":"task-plan-a","job_id":"job-plan-a",
+      "source_head_oid":HEAD,"generation":1,"idempotency_key":"plan-task-a-v1",
+      "execution":{
+        "action":"deterministic",
+        "change_set":[{"path":"x.py","operation":"write_file","content":"x=1\n"}],
+        "verification":[{"label":"compile","argv":["/usr/bin/python3","-m","py_compile","x.py"],"cwd":".","timeout_seconds":30}],
+        "capability_scope":["git.read","git.test"],
+      }
+    }
+
+def test_plan_register_and_resolve(tmp_path):
+    store=ExecutionPlanStore(tmp_path)
+    created=store.register(binding(),request())
+    assert created["idempotent"] is False
+    resolved=store.resolve(binding())
+    assert resolved["plan_digest"]==created["plan_digest"]
+    assert resolved["execution"]["action"]=="deterministic"
+
+def test_plan_is_idempotent(tmp_path):
+    store=ExecutionPlanStore(tmp_path); req=request()
+    first=store.register(binding(),req); second=store.register(binding(),req)
+    assert second["idempotent"] is True
+    assert first["plan_digest"]==second["plan_digest"]
+
+def test_plan_source_head_drift_denied(tmp_path):
+    store=ExecutionPlanStore(tmp_path); store.register(binding(),request())
+    with pytest.raises(ExecutionPlanError,match="SOURCE_HEAD_DRIFT"):
+        store.resolve(binding("b"*40))
+
+def test_plan_replacement_requires_cas(tmp_path):
+    store=ExecutionPlanStore(tmp_path); first=store.register(binding(),request())
+    changed=request(); changed["idempotency_key"]="plan-task-a-v2"
+    changed["execution"]["change_set"][0]["content"]="x=2\n"
+    with pytest.raises(ExecutionPlanError,match="REPLACEMENT_CAS_MISMATCH"):
+        store.register(binding(),changed)
+    changed["expected_previous_plan_digest"]=first["plan_digest"]
+    second=store.register(binding(),changed)
+    assert second["plan_digest"]!=first["plan_digest"]

tests/test_online_agent_scheme_a.py

@@ -0,0 +1,245 @@
+from __future__ import annotations
+
+from pathlib import Path
+from types import SimpleNamespace
+import json
+import sys
+
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+APP=ROOT/"active-runtime/app"
+sys.path.insert(0,str(APP))
+
+from aios_online_agent_execution import GovernedExecutionBinding, project_execution_envelope
+from aios_governed_task_bootstrap import GovernedTaskBinding, GovernedTaskBootstrap
+from aios_gitops_job_controller import GitOpsJobController, JobState, JobStore
+from aios_continuation_executor import ContinuationExecutionError, DetachedGitWorkspace
+from aios_online_agent_worker import (
+    BridgeClient,
+    IsolatedDeterministicExecutor,
+    load_task_state,
+    _claim_order,
+    _isolated_executor_wait_seconds,
+    _verify_converged_job,
+    WorkerError,
+)
+
+
+BASE="a642b045775b9154a00ae78543037fbef4fb447b"
+HEAD="71523aef6e48b1e2fa516c456ca189b7a039104b"
+TASK="p0-claim-online-agent-auto-execution-20260817"
+JOB="job-2031a9e5682a4238f98e3ac7aee8a593"
+BRANCH="agent/p0-claim-online-agent-auto-execution-20260817"
+
+
+def test_source_signals_are_bounded_by_projection():
+    binding=GovernedExecutionBinding.from_mapping({
+      "task_id":TASK,"job_id":JOB,"repository":"aios/aios","base_oid":BASE,
+      "expected_branch_oid":BASE,"target_branch":BRANCH,"branch_mode":"CREATE_NEW",
+      "generation":1,"idempotency_key":"p0-claim-online-agent-auto-execution-a642b04-v1",
+    })
+    execution=project_execution_envelope(binding,{
+      "action":"source_capture",
+      "source_signals":["x"*5000,"x"*5000,"trace credential tool "*100],
+    })
+    assert len(execution["source_signals"]) <= 16
+    assert all(0 < len(item) <= 512 for item in execution["source_signals"])
+
+
+def test_same_job_create_new_binding_normalizes_to_current_head():
+    binding=GovernedTaskBinding(
+      task_id=TASK,job_id=JOB,repository="aios/aios",base_oid=BASE,
+      expected_branch_oid=BASE,target_branch=BRANCH,branch_mode="CREATE_NEW",
+      generation=1,idempotency_key="p0-claim-online-agent-auto-execution-a642b04-v1",
+      risk="engineering",description="automatic claim",
+    )
+    bootstrap=GovernedTaskBootstrap.__new__(GovernedTaskBootstrap)
+    bootstrap.authority=SimpleNamespace(read_ref=lambda ref: HEAD)
+    class Connection:
+        def __enter__(self): return self
+        def __exit__(self,*a): return False
+        def execute(self,*a,**k):
+            return SimpleNamespace(fetchall=lambda:[{
+              "current_head_oid":HEAD,"generation":1,"state":"ACTIVE","lineage_anchor_oid":BASE
+            }])
+    bootstrap._store=lambda _task:(SimpleNamespace(_connect=lambda:Connection()),None)
+    normalized=bootstrap.execution_binding(binding)
+    assert normalized.base_oid == BASE
+    assert normalized.expected_branch_oid == HEAD
+    assert normalized.branch_mode == "CONTINUE_EXISTING"
+    assert normalized.generation == 1
+
+
+def test_recovery_receipt_requires_exact_oid_and_active_lease():
+    envelope=SimpleNamespace(job_id=JOB,target_branch=BRANCH,generation=1)
+    response={
+      "state":"COMPLETED",
+      "receipt":{"remote_verified":True,"authority_oid":HEAD,"api_branch_oid":HEAD,"git_remote_oid":HEAD},
+      "branch_leases":[{
+        "job_id":JOB,"branch":BRANCH,"state":"ACTIVE","generation":1,"current_head_oid":HEAD
+      }],
+    }
+    _verify_converged_job(response,envelope,HEAD)
+    bad={**response,"receipt":{**response["receipt"],"git_remote_oid":BASE}}
+    with pytest.raises(WorkerError,match="GOVERNED_RECEIPT_OID_MISMATCH"):
+        _verify_converged_job(bad,envelope,HEAD)
+
+
+def test_executor_unit_is_uncredentialed():
+    unit=(ROOT/"deploy/systemd/aios-online-agent-isolated-executor.service").read_text()
+    assert "PrivateNetwork=true" in unit
+    assert "RestrictAddressFamilies=AF_UNIX AF_INET" in unit
+    assert "IPAddressDeny=any" in unit
+    assert "IPAddressAllow=localhost" in unit
+    assert "InaccessiblePaths=/run/credentials" in unit
+    assert "LoadCredential" not in unit
+    assert "SupplementaryGroups=gitops" not in unit
+
+
+def test_isolated_executor_wait_budget_includes_safety_margin():
+    assert _isolated_executor_wait_seconds(({"timeout_seconds":1200},)) == 1230
+
+
+def test_prepared_deterministic_plan_precedes_source_capture_at_same_priority():
+    deterministic=SimpleNamespace(action="deterministic",task_id="task-deterministic")
+    source_capture=SimpleNamespace(action="source_capture",task_id="task-source-capture")
+    task={"priority":100,"created_at":"2026-08-17T00:00:00Z"}
+    ordered=sorted(((task,source_capture),(task,deterministic)),key=_claim_order)
+    assert ordered[0][1] is deterministic
+
+
+def test_plan_registry_gets_precedence_when_task_has_no_execution(monkeypatch):
+    client=BridgeClient("agent-token-placeholder")
+    seen=[]
+    monkeypatch.setattr(client,"call",lambda route,body:(seen.append((route,body)) or (200,{})))
+    task={"task_id":TASK,"required_capabilities":["git.read"]}
+    client.project_execution(task)
+    assert seen == [("/v2/execution-envelope",{"task_id":TASK,"required_capabilities":["git.read"]})]
+    client.project_execution(task,{"action":"source_capture","source_signals":["trace"]})
+    assert seen[-1][1]["execution"]["action"] == "source_capture"
+
+
+def test_executor_exchange_files_are_group_readable_and_directories_setgid(tmp_path):
+    request=tmp_path/"request.json"
+    IsolatedDeterministicExecutor._atomic(request,b"{}")
+    assert request.stat().st_mode & 0o777 == 0o640
+    tmpfiles=(ROOT/"deploy/tmpfiles.d/aios-online-agent-executor.conf").read_text()
+    assert tmpfiles.count(" 2770 ") == 5
+
+
+def test_precommit_state_recovery_requires_a_later_official_attempt(monkeypatch,tmp_path):
+    import aios_online_agent_worker as worker_module
+    monkeypatch.setattr(worker_module,"STATE_ROOT",tmp_path)
+    state_path=tmp_path/"tasks"/f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({"task_id":TASK,"execution_digest":"a"*64,"phase":"workspace_prepared"}))
+    assert load_task_state(TASK,"b"*64) is None
+    state_path.write_text(json.dumps({"task_id":TASK,"execution_digest":"a"*64,"phase":"verification_passed","attempt":16}))
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=16)
+    assert load_task_state(TASK,"b"*64,attempt=17) is None
+
+
+def test_reconciliation_state_recovery_requires_later_attempt_and_same_job(monkeypatch,tmp_path):
+    import aios_online_agent_worker as worker_module
+    monkeypatch.setattr(worker_module,"STATE_ROOT",tmp_path)
+    state_path=tmp_path/"tasks"/f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({
+        "task_id":TASK,
+        "execution_digest":"a"*64,
+        "phase":"reconciliation_required",
+        "attempt":18,
+        "job_id":JOB,
+        "details":{"api_status":503,"error":"WORKTREE_DIRTY_SCOPE_MISMATCH"},
+    }))
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=18,continuation_job_id=JOB,continuation_head_oid=HEAD)
+    assert load_task_state(TASK,"b"*64,attempt=19,continuation_job_id=JOB,continuation_head_oid=HEAD) is None
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=19,continuation_job_id="job-other",continuation_head_oid=HEAD)
+
+
+def test_legacy_dirty_scope_reconciliation_state_is_exactly_bounded(monkeypatch,tmp_path):
+    import aios_online_agent_worker as worker_module
+    monkeypatch.setattr(worker_module,"STATE_ROOT",tmp_path)
+    state_path=tmp_path/"tasks"/f"{TASK}.json"
+    state_path.parent.mkdir(parents=True)
+    state_path.write_text(json.dumps({
+        "task_id":TASK,
+        "execution_digest":"a"*64,
+        "phase":"reconciliation_required",
+        "job_id":JOB,
+        "details":{"api_status":503,"error":"WORKTREE_DIRTY_SCOPE_MISMATCH"},
+    }))
+    assert load_task_state(TASK,"b"*64,attempt=19,continuation_job_id=JOB,continuation_head_oid=HEAD) is None
+    with pytest.raises(WorkerError,match="TASK_PAYLOAD_DRIFT"):
+        load_task_state(TASK,"b"*64,attempt=19,continuation_job_id=JOB,continuation_head_oid="not-an-oid")
+
+
+def test_completed_same_job_begins_one_idempotent_continuation_cycle(tmp_path):
+    controller=GitOpsJobController(JobStore(tmp_path/"jobs",payload_root=tmp_path/"payloads"))
+    submitted=controller.submit({
+        "idempotency_key":"same-job-continuation-test",
+        "campaign_id":TASK,
+        "task_id":TASK,
+        "repository":"aios/aios",
+        "operation":"GOVERNED_TASK_CREATE",
+        "branch":BRANCH,
+        "expected_branch_oid":HEAD,
+        "payload_digest":"a"*64,
+    })
+    job_id=submitted.job_id
+    controller.advance(job_id,JobState.AUTHORIZED,side_effect_state="AUTHORIZED",expected_revision=0)
+    controller.lease_job(
+        job_id,
+        lease_id="lease-"+job_id,
+        lineage_anchor_oid=BASE,
+        current_head_oid=HEAD,
+        generation=1,
+        lease_expires_at="2099-01-01T00:00:00+00:00",
+        expected_revision=1,
+    )
+    controller.advance(job_id,JobState.WORKTREE_READY,side_effect_state="WORKTREE_READY",expected_revision=2)
+    controller.advance(job_id,JobState.EXECUTING,side_effect_state="IN_PROGRESS",expected_revision=3)
+    controller.advance(job_id,JobState.LOCAL_VERIFIED,side_effect_state="LOCAL_VERIFIED",receipt={"authority_oid":HEAD},expected_revision=4)
+    controller.advance(job_id,JobState.REMOTE_SYNCING,side_effect_state="IN_PROGRESS",expected_revision=5)
+    receipt={
+        "remote_verified":True,
+        "commit_visible":True,
+        "authority_oid":HEAD,
+        "api_branch_oid":HEAD,
+        "git_remote_oid":HEAD,
+    }
+    controller.advance(job_id,JobState.REMOTE_VERIFIED,side_effect_state="REMOTE_VERIFIED",receipt=receipt,expected_revision=6)
+    controller.advance(job_id,JobState.COMPLETED,side_effect_state="REMOTE_VERIFIED",receipt=receipt,expected_revision=7)
+    first=controller.begin_continuation_cycle(
+        job_id,
+        idempotency_key="same-job-continuation-commit-v1",
+        expected_head_oid=HEAD,
+        generation=1,
+        expected_revision=8,
+    )
+    assert first == {"completed":False,"commit_oid":None,"idempotent":False}
+    assert controller.store.read(job_id)["state"] == "LEASED"
+    replay=controller.begin_continuation_cycle(
+        job_id,
+        idempotency_key="same-job-continuation-commit-v1",
+        expected_head_oid=HEAD,
+        generation=1,
+        expected_revision=8,
+    )
+    assert replay == {"completed":False,"commit_oid":None,"idempotent":True}
+
+
+def test_deterministic_materialization_recovers_only_an_in_scope_dirty_subset(monkeypatch,tmp_path):
+    workspace=object.__new__(DetachedGitWorkspace)
+    workspace.path=tmp_path
+    monkeypatch.setattr(DetachedGitWorkspace,"_dirty_paths",lambda _self:{"old.py"})
+    workspace.materialize_files({"old.py":b"new-old\n","new.py":b"new\n"})
+    assert (tmp_path/"old.py").read_bytes() == b"new-old\n"
+    assert (tmp_path/"new.py").read_bytes() == b"new\n"
+    monkeypatch.setattr(DetachedGitWorkspace,"_dirty_paths",lambda _self:{"outside.py"})
+    with pytest.raises(ContinuationExecutionError,match="WORKTREE_DIRTY_SCOPE_MISMATCH"):
+        workspace.materialize_files({"old.py":b"again\n"})

tests/test_projection_recovery_patcher.py

@@ -1,46 +0,0 @@
-from __future__ import annotations
-
-from pathlib import Path
-import subprocess
-import sys
-
-FIXTURE_SOURCE = '"""x"""\nimport re\nfrom aios_online_agent_execution import (\n    GovernedExecutionBinding,\n    validate_execution_envelope,\n)\n\nclass InitialExecutionProjectionHandler:\n    store = None\n    def _authorized(self):\n        return True\n    def _json(self, value, status):\n        pass\n    def do_GET(self):\n        if self.path == "/health":\n            self._json(\n                {"status": "ok", "service": "aios-agent-task-initial-execution-projection"},\n                200,\n            )\n        else:\n            self._json({"error": "NOT_FOUND"}, 404)\n\n    def do_POST(self):\n        initial_match = re.fullmatch(\n            r"/v1/tasks/([^/]+)/initial-execution-projection", self.path\n        )\n        recovery_match = re.fullmatch(\n            r"/v1/tasks/([^/]+)/source-capture-projection-recovery", self.path\n        )\n        if initial_match is None and recovery_match is None:\n            self._json({"error": "NOT_FOUND"}, 404)\n            return\n        if not self._authorized():\n            self._json({"error": "UNAUTHORIZED"}, 401)\n            return\n        try:\n            value = {}\n            if self.store is None:\n                raise RuntimeError("RUNTIME_UNAVAILABLE")\n            if initial_match is not None:\n                request = InitialExecutionProjectionRequest.from_mapping(value)\n                result = self.store.project(initial_match.group(1), request)\n            else:\n                recovery_request = SourceCaptureProjectionRecoveryRequest.from_mapping(value)\n                result = self.store.project_from_source_capture(\n                    recovery_match.group(1), recovery_request\n                )\n            self._json(result, 200 if result["idempotent"] else 201)\n        except Exception:\n            pass\n'
-
-
-def test_patcher_is_strict_and_idempotent(tmp_path):
-    source = tmp_path / "aios_agent_task_initial_execution_projection.py"
-    source.write_text(FIXTURE_SOURCE, encoding="utf-8")
-    patcher = Path(__file__).resolve().parents[1] / "tools" / "integrate_projection_recovery.py"
-
-    first = subprocess.run(
-        [sys.executable, str(patcher), str(source)],
-        capture_output=True,
-        text=True,
-    )
-    assert first.returncode == 0, first.stderr
-    assert first.stdout.strip() == "CHANGED"
-    text = source.read_text()
-    assert "/canonical-projection-recovery" in text
-    assert "/canonical-projection" in text
-    assert "recover_canonical_projection" in text
-
-    second = subprocess.run(
-        [sys.executable, str(patcher), str(source)],
-        capture_output=True,
-        text=True,
-    )
-    assert second.returncode == 0
-    assert second.stdout.strip() == "ALREADY_APPLIED"
-
-
-def test_patcher_fails_closed_on_unexpected_source(tmp_path):
-    source = tmp_path / "wrong.py"
-    source.write_text("print('different')\n")
-    patcher = Path(__file__).resolve().parents[1] / "tools" / "integrate_projection_recovery.py"
-    result = subprocess.run(
-        [sys.executable, str(patcher), str(source)],
-        capture_output=True,
-        text=True,
-    )
-    assert result.returncode == 2
-    assert "ANCHOR_COUNT" in result.stderr

tests/test_r7_atomic_recovery_and_bridge_sandbox.py

@@ -1,32 +0,0 @@
-from pathlib import Path
-import ast
-
-ROOT = Path(__file__).resolve().parents[1]
-
-
-def test_r7_amendment_module_is_valid_and_fail_closed():
-    text = (
-        ROOT
-        / "active-runtime/app/aios_task_deterministic_execution_amendment.py"
-    ).read_text()
-    ast.parse(text)
-    assert "validate_execution_envelope" in text
-    assert "SIGNED_EXECUTION_AMENDMENT_REQUIRED" in text
-    assert "BEFORE UPDATE OF status ON tasks" in text
-    assert "APPLY_STATES" in text
-    assert '"FAILED"' in text and '"QUEUED"' in text
-    assert "AMENDMENT_EXECUTION_OPERATIONS_REQUIRED" in text
-    assert "AMENDMENT_PROTECTED_WRITE_FORBIDDEN" in text
-
-
-def test_bridge_unit_keeps_strict_sandbox_and_required_projection():
-    text = (
-        ROOT
-        / "deploy/systemd/aios-chatgpt-bridge-v2-staging.service"
-    ).read_text()
-    assert "ProtectSystem=strict" in text
-    assert "ProtectHome=true" in text
-    assert (
-        "LoadCredential=gitea_token:"
-    ) in text
-    assert "/data/aios-gitops/repo.git/worktrees" in text

tests/test_signer_contract_compatibility.py

@@ -110,8 +110,6 @@ class SignerContractCompatibilityTests(unittest.TestCase):
         signer = "/usr/local/libexec/aios-grant-signer-adapter"
         if not Path(signer).is_file():
             self.skipTest("deployed signer is not present")
-        if os.geteuid() != 0:
-            self.skipTest("deployed signer self-test requires root")
         help_result = subprocess.run([signer, "sign", "--help"], capture_output=True, text=True, check=False)
         self.assertEqual(help_result.returncode, 0)
         self.assertTrue(deployed_signer_help(help_result.stdout, help_result.stderr))

tests/test_trusted_candidate_builder.py

@@ -1,592 +0,0 @@
-from __future__ import annotations
-
-import dataclasses
-import hashlib
-import hmac
-import json
-import sys
-from pathlib import Path
-from types import SimpleNamespace
-
-import pytest
-from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
-
-ROOT = Path(__file__).resolve().parents[1]
-sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
-
-import aios_trusted_candidate_builder as builder_runtime  # noqa: E402
-from aios_trusted_candidate_builder import (  # noqa: E402
-    BuilderError,
-    BuilderKeyring,
-    DeterministicEvidenceCollector,
-    PeerIdentity,
-    ServerOwnedEvidenceSource,
-    TrustedCandidateBuilder,
-    TrustedCandidateBuilderConfig,
-    UnixTrustedCandidateBuilderClient,
-    load_builder_policy,
-)
-from silent_release_controller import ReleaseCandidate, ReleaseState  # noqa: E402
-from silent_release_hardening import (  # noqa: E402
-    BuilderAttestation,
-    BuilderAttestationKeyRecord,
-    BuilderAttestationKeyRing,
-    BuilderAttestationVerifier,
-    DeploymentPlan,
-    FinalizationPlan,
-    ReleasePlan,
-    TagPlan,
-    TrustedCandidateBundle,
-)
-
-
-POLICY_PATH = ROOT / "config" / "gitops" / "trusted-candidate-builder-policy.json"
-NOW = 1_725_000_000
-
-
-class RecordingDomainSigner:
-    key_id = "test-builder-key"
-    key_generation = 1
-
-    def __init__(self) -> None:
-        self.calls: list[tuple[str, bytes]] = []
-
-    def sign_for_purpose(self, purpose: str, payload: bytes) -> bytes:
-        self.calls.append((purpose, payload))
-        return hashlib.sha256(b"test-signature\0" + payload).digest()
-
-
-def make_seam(*, peer: PeerIdentity | None = None, cgroup: str = "/system.slice/aios-gitops-model-api-v2r2c1-staging.service", process=("/usr/bin/python3.12", ("/usr/bin/python3", "/opt/aios/gitops-model-api/test/runtime/app/aios_model_api_staging.py")), server_clock=lambda: NOW, client_clock=lambda: NOW, collector=None, nonce_ledger_path=None, signer_override=None) -> tuple[TrustedCandidateBuilder, UnixTrustedCandidateBuilderClient, RecordingDomainSigner]:
-    policy = load_builder_policy(POLICY_PATH)
-    config = TrustedCandidateBuilderConfig.from_policy(policy)
-    keyring = BuilderKeyring(builder_hmac=b"h" * 32)
-    signer = signer_override or RecordingDomainSigner()
-    server = TrustedCandidateBuilder(
-        config,
-        keyring,
-        collector=collector or DeterministicEvidenceCollector(config, evidence_source=passing_bundle),
-        signer=signer,
-        peer_identity_resolver=lambda _connection: peer or PeerIdentity(pid=77, uid=1000, gid=1000),
-        cgroup_resolver=lambda _pid: cgroup,
-        process_identity_resolver=lambda _pid: process,
-        clock=server_clock,
-        nonce_ledger_path=nonce_ledger_path,
-    )
-    return server, UnixTrustedCandidateBuilderClient(config, keyring, clock=client_clock), signer
-
-
-def passing_bundle(recipe_name, recipe):
-    base_oid = recipe["base_oid"]
-    digest = lambda label: hashlib.sha256(f"{label}\0{base_oid}".encode()).hexdigest()
-    candidate = ReleaseCandidate(
-        candidate_id=recipe["candidate_id"], source_commit=base_oid,
-        tree_oid=digest("tree")[:40], artifact_sha256=digest("artifact"),
-        manifest_sha256=digest("manifest"), tests={"passed": True, "receipt": digest("tests")},
-        canary={"passed": True, "receipt": digest("canary")}, rollback_ready=True,
-        git_consistency={"consistent": True}, gitea_consistency={"consistent": True},
-        state=ReleaseState.READY_FOR_APPROVAL,
-    )
-    policy_sha = digest("policy")
-    plan = ReleasePlan(
-        deployment=DeploymentPlan(
-            service="aios-silent-release-controller", release_path="/srv/release/r1",
-            release_root="/srv/release", cutover_link="/srv/release/current",
-            dropin_path="/srv/release/r1/deploy/systemd/controller.service",
-            dropin_sha256=digest("dropin"), systemd_unit_sha256=digest("unit"),
-            rollback_path="/srv/release/rollback-r1", rollback_sha256=digest("rollback"),
-            source_commit=base_oid, tree_oid=candidate.tree_oid,
-            artifact_sha256=candidate.artifact_sha256, manifest_sha256=candidate.manifest_sha256,
-            package_closure_sha256=digest("closure"), authoritative_git_dir="/data/aios-gitops/repo.git",
-            repository_identity="aios/aios", baseline_before_sha256=digest("baseline"),
-            registry_before_sha256=digest("registry"), production_tag_refset_before_sha256=digest("tagset"),
-            health_contract_version="trusted-builder/v1", timeout_policy={"seconds": 10},
-            retry_policy={"attempts": 1}, policy_sha256=policy_sha, health_contract={"checked": True},
-        ),
-        tag=TagPlan(
-            version="trusted-v2r2c2-001", tag_type="annotated", expected_tag_oid=digest("tag")[:40],
-            expected_target_oid=base_oid, evidence_closure_oid=digest("closure-oid")[:40],
-            approval_plan_id="owner-plan-trusted-v2r2c2", repository_identity="aios/aios",
-            gitea_owner="aios", gitea_repository="aios", current_remote_tag_oid=None,
-            remote_absent_evidence_sha256=digest("tag-absence"), verification_contract="trusted-builder/v1",
-        ),
-        finalization=FinalizationPlan(
-            version="trusted-v2r2c2-001", expected_tag_oid=digest("tag")[:40], expected_target_oid=base_oid,
-            expected_previous_baseline_sha256=digest("baseline"), registry_expected_record={"base": base_oid},
-            baseline_expected_record={"base": base_oid}, final_consistency_contract="trusted-builder/v1",
-        ), policy_sha256=policy_sha,
-    )
-    checks = {name: True for name in [
-        "authoritative_git", "artifact", "canary", "gitea", "manifest",
-        "package_closure", "rollback", "secret_scan", "tests",
-    ]}
-    TrustedCandidateBundle(candidate, plan, checks).validate()
-    canonical_digest = lambda value: hashlib.sha256(
-        json.dumps(value, sort_keys=True, separators=(",", ":")).encode()
-    ).hexdigest()
-    evidence_digests = {
-        "artifact": candidate.artifact_sha256,
-        "manifest": candidate.manifest_sha256,
-        "package_closure": plan.deployment.package_closure_sha256,
-        "tests": canonical_digest(candidate.tests),
-        "canary": canonical_digest(candidate.canary),
-        "gitea": canonical_digest(candidate.gitea_consistency),
-        "rollback": canonical_digest({
-            "ready": True,
-            "rollback_sha256": plan.deployment.rollback_sha256,
-            "source_commit": candidate.source_commit,
-        }),
-        "policy": plan.policy_sha256,
-        "secret_scan": digest("secret-scan"),
-    }
-    return {
-        "candidate": candidate.to_dict(),
-        "release_plan": plan.to_dict(),
-        "checks": checks,
-        "evidence_digests": evidence_digests,
-    }
-
-
-def rehmac(request: dict) -> None:
-    unsigned = {key: value for key, value in request.items() if key != "hmac"}
-    request["hmac"] = hmac.new(
-        b"h" * 32,
-        json.dumps(unsigned, sort_keys=True, separators=(",", ":")).encode(),
-        hashlib.sha256,
-    ).hexdigest()
-
-
-def test_public_build_seam_accepts_only_the_fixed_v2r2c2_recipe_and_returns_server_owned_evidence() -> None:
-    server, client, signer = make_seam()
-
-    request = client.create_request("V2R2C2", "rc-v2r2c2-d2b5a8339a34", "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6", nonce="a" * 32)
-    result = server.handle_request(request, connection=object())
-
-    assert result["schema"] == "aios.trusted-candidate-builder.response.v1"
-    assert result["status"] == "BUILT"
-    assert result["recipe"] == "V2R2C2"
-    assert result["repository"] == "aios/aios"
-    assert result["task_id"] == "v12-durable-trusted-release-controller-activation-20260829"
-    assert result["silent_release_bundle"]["candidate"]["candidate_id"] == "rc-v2r2c2-d2b5a8339a34"
-    assert result["base_oid"] == "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6"
-    assert set(result["checks"]) == set(server.config.required_checks)
-    assert all(result["checks"].values())
-    assert result["attestation"]["trust_domain"] == "aios.trusted-builder.attestation.v1"
-    assert signer.calls and signer.calls[0][0] == "AIOS_TRUSTED_RELEASE_BUILDER"
-    assert result["attestation"]["fingerprint"] == hashlib.sha256(signer.calls[0][1]).hexdigest()
-    assert BuilderAttestation.from_dict(result["attestation"]).canonical_bytes() == signer.calls[0][1]
-    silent_bundle = result["silent_release_bundle"]
-    round_trip = TrustedCandidateBundle(
-        ReleaseCandidate.from_dict(silent_bundle["candidate"]),
-        ReleasePlan.from_dict(silent_bundle["release_plan"]),
-        silent_bundle["checks"],
-    )
-    assert round_trip.validate().candidate.candidate_id == result["evidence"]["candidate_id"]
-
-
-@pytest.mark.parametrize(
-    "mutate, error",
-    [
-        (lambda request: request.update({"base_oid": "f" * 40}), "REQUEST_HMAC_INVALID"),
-        (lambda request: request.update({"artifact_sha256": "0" * 64}), "REQUEST_SCHEMA_INVALID"),
-    ],
-)
-def test_public_build_seam_rejects_tampering_and_caller_owned_evidence(mutate, error) -> None:
-    server, client, _ = make_seam()
-    request = client.create_request("V2R2C2", "rc-v2r2c2-d2b5a8339a34", "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6", nonce="b" * 32)
-    mutate(request)
-
-    with pytest.raises(BuilderError, match=error):
-        server.handle_request(request, connection=object())
-
-
-@pytest.mark.parametrize("field,value", [
-    ("repository", "other/repository"),
-    ("task_id", "other-task"),
-    ("base_oid", "f" * 40),
-    ("purpose", "owner_approval"),
-])
-def test_public_build_seam_rejects_reauthenticated_scope_rebinding(field, value) -> None:
-    server, client, _ = make_seam()
-    request = client.create_request(
-        "V2R2C2",
-        "rc-v2r2c2-d2b5a8339a34",
-        "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6",
-        nonce="s" * 32,
-    )
-    request[field] = value
-    rehmac(request)
-    with pytest.raises(BuilderError, match="REQUEST_SCOPE_INVALID"):
-        server.handle_request(request, connection=object())
-
-
-def test_public_build_seam_rejects_wrong_hmac() -> None:
-    server, client, _ = make_seam()
-    request = client.create_request(
-        "V2R2C2",
-        "rc-v2r2c2-d2b5a8339a34",
-        "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6",
-        nonce="w" * 32,
-    )
-    request["hmac"] = "0" * 64
-    with pytest.raises(BuilderError, match="REQUEST_HMAC_INVALID"):
-        server.handle_request(request, connection=object())
-
-
-def test_public_build_seam_returns_the_original_result_for_exact_nonce_replay_and_rejects_conflicts() -> None:
-    server, client, _ = make_seam()
-    request = client.create_request("V2R2C2", "rc-v2r2c2-d2b5a8339a34", "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6", nonce="c" * 32)
-    first = server.handle_request(request, connection=object())
-    assert server.handle_request(request, connection=object()) == first
-
-    conflict = client.create_request("V2R2C2", "rc-v2r2c2-d2b5a8339a34", "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6", nonce="c" * 32)
-    conflict["issued_at"] += 1
-    unsigned = {key: value for key, value in conflict.items() if key != "hmac"}
-    conflict["hmac"] = hmac.new(b"h" * 32, json.dumps(unsigned, sort_keys=True, separators=(",", ":")).encode(), hashlib.sha256).hexdigest()
-
-    with pytest.raises(BuilderError, match="REPLAY_CONFLICT"):
-        server.handle_request(conflict, connection=object())
-
-
-def test_exact_replay_survives_restart_and_the_original_freshness_window(tmp_path) -> None:
-    ledger = tmp_path / "nonce-ledger.json"
-    server, client, _ = make_seam(nonce_ledger_path=ledger)
-    request = client.create_request(
-        "V2R2C2",
-        "rc-v2r2c2-d2b5a8339a34",
-        "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6",
-        nonce="r" * 32,
-    )
-    first = server.handle_request(request, connection=object())
-
-    restarted, _, _ = make_seam(
-        server_clock=lambda: NOW + 3600,
-        nonce_ledger_path=ledger,
-    )
-    assert restarted.handle_request(request, connection=object()) == first
-
-
-def test_readiness_probe_checks_collector_and_signer_without_signing() -> None:
-    server, client, signer = make_seam()
-    request = client.create_request(
-        "V2R2C2",
-        "rc-v2r2c2-d2b5a8339a34",
-        "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6",
-        nonce="q" * 32,
-        operation=server.config.readiness_operation,
-    )
-    result = server.handle_request(request, connection=object())
-
-    assert result["status"] == "READY"
-    assert result["collector_ready"] is True
-    assert result["signer_ready"] is True
-    assert result["builder_key_id"] == signer.key_id
-    assert result["policy_sha256"] == server.config.policy_sha256
-    assert "signature" not in result
-    assert "silent_release_bundle" not in result
-    assert signer.calls == []
-
-
-def test_readiness_fails_closed_when_signer_is_unavailable() -> None:
-    class UnavailableSigner:
-        @property
-        def key_id(self):
-            raise BuilderError("SIGNER_UNAVAILABLE")
-
-        @property
-        def key_generation(self):
-            return 1
-
-        def sign_for_purpose(self, purpose, payload):
-            raise AssertionError("readiness must not attempt signing")
-
-    server, client, _ = make_seam(signer_override=UnavailableSigner())
-    request = client.create_request(
-        "V2R2C2",
-        "rc-v2r2c2-d2b5a8339a34",
-        "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6",
-        nonce="u" * 32,
-        operation=server.config.readiness_operation,
-    )
-    with pytest.raises(BuilderError, match="SIGNER_UNAVAILABLE"):
-        server.handle_request(request, connection=object())
-
-
-def test_unix_client_applies_bounded_timeout_and_fails_closed(monkeypatch) -> None:
-    observed = {}
-
-    class TimeoutSocket:
-        def __enter__(self):
-            return self
-
-        def __exit__(self, *_args):
-            return False
-
-        def settimeout(self, seconds):
-            observed["timeout"] = seconds
-
-        def connect(self, _path):
-            raise TimeoutError("bounded test timeout")
-
-    monkeypatch.setattr(builder_runtime.socket, "socket", lambda *_args: TimeoutSocket())
-    monkeypatch.setattr(builder_runtime.socket, "AF_UNIX", 1, raising=False)
-    monkeypatch.setattr(builder_runtime.socket, "SOCK_STREAM", 1, raising=False)
-    config = TrustedCandidateBuilderConfig.from_policy(load_builder_policy(POLICY_PATH))
-    client = UnixTrustedCandidateBuilderClient(
-        config,
-        BuilderKeyring(builder_hmac=b"h" * 32),
-        socket_path=Path("/run/aios-trusted-candidate-builder.sock"),
-        clock=lambda: NOW,
-    )
-    with pytest.raises(BuilderError, match="BUILDER_TRANSPORT_UNAVAILABLE"):
-        client.build(
-            "V2R2C2",
-            "rc-v2r2c2-d2b5a8339a34",
-            "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6",
-            nonce="t" * 32,
-        )
-    assert observed["timeout"] == config.request_timeout_seconds
-
-
-def test_backend_attestation_round_trip_verifies_with_production_keyring() -> None:
-    private = Ed25519PrivateKey.generate()
-
-    class Ed25519Signer:
-        key_id = "builder-key-001"
-        key_generation = 1
-
-        def sign_for_purpose(self, purpose, payload):
-            assert purpose == "AIOS_TRUSTED_RELEASE_BUILDER"
-            return private.sign(payload)
-
-    server, client, _ = make_seam(signer_override=Ed25519Signer())
-    response = server.handle_request(
-        client.create_request(
-            "V2R2C2",
-            "rc-v2r2c2-d2b5a8339a34",
-            "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6",
-            nonce="v" * 32,
-        ),
-        connection=object(),
-    )
-    public_key = private.public_key().public_bytes(
-        serialization.Encoding.Raw,
-        serialization.PublicFormat.Raw,
-    )
-    verifier = BuilderAttestationVerifier(
-        BuilderAttestationKeyRing(
-            [BuilderAttestationKeyRecord(
-                key_id="builder-key-001",
-                public_key=public_key,
-                algorithm="Ed25519",
-                purpose="AIOS_TRUSTED_RELEASE_BUILDER",
-                generation=1,
-                not_before="2020-01-01T00:00:00Z",
-                expires_at="2099-01-01T00:00:00Z",
-                status="ACTIVE",
-            )],
-            require_attestation_metadata=True,
-        )
-    )
-    raw = response["silent_release_bundle"]
-    bundle = TrustedCandidateBundle(
-        ReleaseCandidate.from_dict(raw["candidate"]),
-        ReleasePlan.from_dict(raw["release_plan"]),
-        raw["checks"],
-        BuilderAttestation.from_dict(raw["attestation"], require_fingerprint=True),
-    )
-    assert bundle.validate(verifier).candidate.candidate_id == response["evidence"]["candidate_id"]
-
-
-def test_public_build_seam_rejects_direct_unbound_v2r2c3_and_authentication_boundaries() -> None:
-    server, client, _ = make_seam()
-    with pytest.raises(BuilderError, match="GOVERNED_V2R2C3_DERIVATION_REQUIRED"):
-        client.create_request("V2R2C3", "unknown", "f" * 40, nonce="d" * 32)
-    denied_peer, denied_client, _ = make_seam(peer=PeerIdentity(pid=77, uid=0, gid=0))
-    with pytest.raises(BuilderError, match="PEER_IDENTITY_DENIED"):
-        denied_peer.handle_request(denied_client.create_request("V2R2C2", "rc-v2r2c2-d2b5a8339a34", "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6", nonce="e" * 32), connection=object())
-    denied_cgroup, denied_client, _ = make_seam(cgroup="/system.slice/untrusted.service")
-    with pytest.raises(BuilderError, match="PEER_CGROUP_DENIED"):
-        denied_cgroup.handle_request(denied_client.create_request("V2R2C2", "rc-v2r2c2-d2b5a8339a34", "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6", nonce="f" * 32), connection=object())
-    denied_process, denied_client, _ = make_seam(
-        process=("/usr/bin/python3.12", ("/usr/bin/python3", "/tmp/aios_model_api_staging.py"))
-    )
-    with pytest.raises(BuilderError, match="PEER_PROCESS_DENIED"):
-        denied_process.handle_request(denied_client.create_request("V2R2C2", "rc-v2r2c2-d2b5a8339a34", "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6", nonce="p" * 32), connection=object())
-    stale_server, stale_client, _ = make_seam(client_clock=lambda: NOW - 61)
-    with pytest.raises(BuilderError, match="REQUEST_STALE"):
-        stale_server.handle_request(stale_client.create_request("V2R2C2", "rc-v2r2c2-d2b5a8339a34", "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6", nonce="g" * 32), connection=object())
-
-
-def test_public_build_seam_fails_closed_when_server_owned_collector_is_incomplete() -> None:
-    def incomplete_evidence(recipe_name, recipe):
-        value = passing_bundle(recipe_name, recipe)
-        value["checks"]["canary"] = False
-        return value
-
-    policy = load_builder_policy(POLICY_PATH)
-    config = TrustedCandidateBuilderConfig.from_policy(policy)
-    server, client, _ = make_seam(
-        collector=DeterministicEvidenceCollector(config, evidence_source=incomplete_evidence)
-    )
-    with pytest.raises(BuilderError, match="COLLECTOR_CHECKS_INCOMPLETE"):
-        server.handle_request(client.create_request("V2R2C2", "rc-v2r2c2-d2b5a8339a34", "d2b5a8339a34a8f958a177f8a3b9e8296a57a7a6", nonce="h" * 32), connection=object())
-
-
-def test_server_owned_source_rehashes_every_fixed_evidence_file_and_rejects_tampering(tmp_path) -> None:
-    config = TrustedCandidateBuilderConfig.from_policy(load_builder_policy(POLICY_PATH))
-    recipe = config.fixed_recipe("V2R2C2")
-    raw = passing_bundle("V2R2C2", recipe)
-    candidate = ReleaseCandidate.from_dict(raw["candidate"])
-    plan = ReleasePlan.from_dict(raw["release_plan"])
-    evidence_root = tmp_path / "evidence"
-    version_root = evidence_root / "V2R2C2"
-    version_root.mkdir(parents=True)
-
-    def write_bytes(name: str, value: bytes) -> str:
-        path = version_root / name
-        path.write_bytes(value)
-        path.chmod(0o600)
-        return hashlib.sha256(value).hexdigest()
-
-    def canonical(value: dict) -> bytes:
-        return json.dumps(value, sort_keys=True, separators=(",", ":")).encode()
-
-    tests = {"passed": True, "receipt": "tests-fixed"}
-    canary = {"passed": True, "receipt": "canary-fixed"}
-    gitea = {
-        "consistent": True,
-        "remote_ref_oid": recipe["source_commit"],
-        "repository": "aios/aios",
-        "source_commit": recipe["source_commit"],
-        "tree_oid": candidate.tree_oid,
-    }
-    git_consistency = {
-        "consistent": True,
-        "repository": "aios/aios",
-        "source_commit": recipe["source_commit"],
-        "tree_oid": candidate.tree_oid,
-    }
-    rollback = {
-        "ready": True,
-        "rollback_sha256": plan.deployment.rollback_sha256,
-        "source_commit": recipe["source_commit"],
-    }
-    artifact_bytes = b"immutable-artifact"
-    manifest_bytes = b'{"manifest":"fixed"}\n'
-    closure_bytes = b"closure  artifact.tar.gz\n"
-    policy_bytes = b'{"policy":"fixed"}\n'
-    artifact_sha = write_bytes("artifact.tar.gz", artifact_bytes)
-    manifest_sha = write_bytes("manifest.json", manifest_bytes)
-    closure_sha = write_bytes("checksums.sha256", closure_bytes)
-    tests_sha = write_bytes("tests.json", canonical(tests))
-    canary_sha = write_bytes("canary.json", canonical(canary))
-    gitea_sha = write_bytes("gitea.json", canonical(gitea))
-    rollback_sha = write_bytes("rollback.json", canonical(rollback))
-    policy_sha = write_bytes("trusted-release-policy.json", policy_bytes)
-    secret_scan = {"artifact_sha256": artifact_sha, "passed": True}
-    secret_sha = write_bytes("secret-scan.json", canonical(secret_scan))
-
-    candidate.artifact_sha256 = artifact_sha
-    candidate.manifest_sha256 = manifest_sha
-    candidate.tests = tests
-    candidate.canary = canary
-    candidate.git_consistency = git_consistency
-    candidate.gitea_consistency = gitea
-    deployment = dataclasses.replace(
-        plan.deployment,
-        artifact_sha256=artifact_sha,
-        manifest_sha256=manifest_sha,
-        package_closure_sha256=closure_sha,
-        policy_sha256=policy_sha,
-    )
-    plan = dataclasses.replace(plan, deployment=deployment, policy_sha256=policy_sha)
-    receipt = {
-        "schema": "aios.trusted-candidate-builder.evidence.v1",
-        "version": "V2R2C2",
-        "candidate": candidate.to_dict(),
-        "release_plan": plan.to_dict(),
-    }
-    write_bytes("receipt.json", canonical(receipt))
-
-    git_state = {"tree": candidate.tree_oid, "ancestry": 0}
-
-    def git_runner(argv, **_kwargs):
-        if "rev-parse" in argv:
-            return SimpleNamespace(stdout=git_state["tree"] + "\n", returncode=0)
-        return SimpleNamespace(stdout="", returncode=git_state["ancestry"])
-
-    source = ServerOwnedEvidenceSource(
-        config,
-        tmp_path / "repo.git",
-        evidence_root,
-        expected_owner_uid=None,
-        git_runner=git_runner,
-    )
-    collected = source("V2R2C2", recipe)
-    assert collected["candidate"]["artifact_sha256"] == artifact_sha
-    assert collected["evidence_digests"] == {
-        "artifact": artifact_sha,
-        "manifest": manifest_sha,
-        "package_closure": closure_sha,
-        "tests": tests_sha,
-        "canary": canary_sha,
-        "gitea": gitea_sha,
-        "rollback": rollback_sha,
-        "policy": policy_sha,
-        "secret_scan": secret_sha,
-    }
-
-    (version_root / "manifest.json").write_bytes(b"tampered")
-    with pytest.raises(BuilderError, match="COLLECTOR_DIGEST_MISMATCH"):
-        source("V2R2C2", recipe)
-    (version_root / "manifest.json").write_bytes(manifest_bytes)
-
-    for name, tampered, expected in (
-        ("artifact.tar.gz", b"tampered", "COLLECTOR_DIGEST_MISMATCH"),
-        ("checksums.sha256", b"tampered", "COLLECTOR_DIGEST_MISMATCH"),
-        ("trusted-release-policy.json", b"tampered", "COLLECTOR_DIGEST_MISMATCH"),
-        ("tests.json", canonical({"passed": True, "receipt": "wrong"}), "COLLECTOR_TESTS_MISMATCH"),
-        ("canary.json", canonical({"passed": True, "receipt": "wrong"}), "COLLECTOR_CANARY_MISMATCH"),
-        ("gitea.json", canonical({**gitea, "consistent": False}), "COLLECTOR_GITEA_MISMATCH"),
-        ("rollback.json", canonical({**rollback, "ready": False}), "COLLECTOR_ROLLBACK_MISMATCH"),
-        ("secret-scan.json", canonical({**secret_scan, "passed": False}), "COLLECTOR_SECRET_SCAN_MISMATCH"),
-    ):
-        path = version_root / name
-        original = path.read_bytes()
-        path.write_bytes(tampered)
-        with pytest.raises(BuilderError, match=expected):
-            source("V2R2C2", recipe)
-        path.write_bytes(original)
-
-    git_state["tree"] = "f" * 40
-    with pytest.raises(BuilderError, match="COLLECTOR_GIT_MISMATCH"):
-        source("V2R2C2", recipe)
-    git_state["tree"] = candidate.tree_oid
-    git_state["ancestry"] = 1
-    with pytest.raises(BuilderError, match="COLLECTOR_GIT_MISMATCH"):
-        source("V2R2C2", recipe)
-
-
-def test_systemd_socket_and_service_are_af_unix_hardened_and_credential_bound() -> None:
-    socket_unit = (ROOT / "deploy/systemd/aios-trusted-candidate-builder.socket").read_text()
-    service_unit = (ROOT / "deploy/systemd/aios-trusted-candidate-builder.service").read_text()
-
-    assert "ListenStream=/run/aios-trusted-candidate-builder.sock" in socket_unit
-    assert "SocketMode=0660" in socket_unit
-    assert "LoadCredentialEncrypted=signing_private_key:" in service_unit
-    assert "LoadCredentialEncrypted=builder_hmac:" in service_unit
-    assert "NoNewPrivileges=true" in service_unit
-    assert "ProtectSystem=strict" in service_unit
-    assert "PrivateNetwork=true" in service_unit
-    assert "RestrictAddressFamilies=AF_UNIX" in service_unit
-    assert "StateDirectory=aios-trusted-candidate-builder" in service_unit
-    assert "AIOS_TRUSTED_BUILDER_KEY_GENERATION=1" in service_unit
-    assert "aios-approved-release-executor" not in service_unit
-    assert "--socket-fd 3" in service_unit
-    policy = load_builder_policy(POLICY_PATH)
-    assert policy["allowed_peer_uid"] == 1000
-    assert policy["allowed_peer_cgroups"] == [
-        "/system.slice/aios-gitops-model-api-v2r2c1-staging.service"
-    ]

tests/test_trusted_plan_release_path.py

@@ -1,60 +0,0 @@
-from __future__ import annotations
-
-from pathlib import Path
-from types import SimpleNamespace
-import sys
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "active-runtime" / "app"))
-from governed_production_release import ReleaseBlocked, TrustedPlanReleaseExecutor, build_executor_config
-from trusted_production_adapter import AdapterBlocked, _binding
-
-
-def config(tmp_path: Path, version: str = "V2R2C2") -> SimpleNamespace:
-    return SimpleNamespace(
-        state_root=tmp_path,
-        target_version=version,
-        release_plan_path=None,
-        authoritative_git_dir=tmp_path,
-        baseline_path=tmp_path / "baseline.json",
-        registry_root=tmp_path / "registry",
-        api_base="http://127.0.0.1:3000/api/v1",
-        token_path=tmp_path / "token",
-        remote_name="gitea-http",
-    )
-
-
-def test_non_legacy_runtime_selects_trusted_plan_handler(tmp_path: Path):
-    handler = build_executor_config(config(tmp_path))
-    assert isinstance(handler, TrustedPlanReleaseExecutor)
-
-
-def test_trusted_handler_requires_server_side_plan(tmp_path: Path):
-    handler = build_executor_config(config(tmp_path))
-    with pytest.raises(ReleaseBlocked, match="TRUSTED_RELEASE_PLAN_REQUIRED"):
-        handler.consistency({"version": "V2R2C2"})
-
-
-def test_legacy_runtime_keeps_compatibility_path(tmp_path: Path):
-    handler = build_executor_config(config(tmp_path, "V2R2C1"))
-    assert handler.__class__.__name__ == "GovernedProductionReleaseExecutor"
-
-
-def test_generic_adapter_requires_candidate_and_plan_binding():
-    value = {
-        "version": "V2R2C2",
-        "target_oid": "1" * 40,
-        "artifact_sha256": "2" * 64,
-        "artifact_path": "/opt/aios/releases/V2R2C2.tar",
-        "artifact_size": 1,
-        "production_service": "aios-v2r2c2-production.service",
-        "production_port": 18928,
-        "candidate_id": "rc-v2r2c2-001",
-        "release_plan_sha256": "sha256:" + "3" * 64,
-    }
-    assert _binding(value)["candidate_id"] == "rc-v2r2c2-001"
-    with pytest.raises(AdapterBlocked, match="legacy_or_unbound_release_rejected"):
-        _binding({**value, "version": "V2R1C7"})
-    with pytest.raises(AdapterBlocked, match="trusted_binding_incomplete"):
-        _binding({key: item for key, item in value.items() if key != "release_plan_sha256"})