chore(worktree): ignore registered child worktrees

.gitignore

@@ -11,3 +11,61 @@ runtime/tmp/
 runtime/cache/
 logs/
 config/test_write_perms
+
+# BEGIN AIOS REGISTERED CHILD WORKTREES (V2R1C1 2026-07-21)
+/A0-C1-WECHAT-BACKEND-LINEAGE-REMEDIATION-20260718/
+/A0-CALLBACK-TRANSPORT-PENDING-RECOVERY-20260718/
+/A0-CENTRAL-GPT-LIVE-CLOSURE-20260718/
+/A0-CODEX-AUTOMATION-CLOSURE-INTEGRATION-20260718/
+/A0-CODEX-AUTOMATION-CLOSURE-RESULT-20260718/
+/A0-CODEX-LOCAL-CENTRAL-CHANNEL-20260718/
+/A0-FINAL-AUTOMATION-INTEGRATION-20260718/
+/A0-PENDING-PLAN-READONLY-20260718/
+/A0-REMOTE-CODEX-BRAIN-192-168-88-6-20260719/
+/A0-REMOTE-CODEX-HOME-IMRUYI-20260719/
+/A0-WORKSPACE-TRIGGER-PROTOCOL-HARDENING-20260718/
+/AIOS-V2R1-PRODUCTION-SUPERVISOR-20260720/
+/RESULT-A0-CALLBACK-TRANSPORT-PENDING-RECOVERY-20260718/
+/RESULT-A0-WORKSPACE-TRIGGER-PROTOCOL-HARDENING-20260718/
+/RESULT-AIOS-SPARK-RUNNER-V2-OWNER-FIXES-20260717/
+/RESULT-CODEX-AIOS-ORCHESTRATOR-GATEWAY-V1-BLOCKED-20260718/
+/RESULT-CODEX-AIOS-SPARK-RUNNER-PROVISIONING-V2-20260717T174800UTC8/
+/RESULT-CODEX-V2R1-PWX-B3-REPAIR3-GATE0-20260717T214100UTC8/
+/TASK-CODEX-AIOS-ORCHESTRATOR-GATEWAY-V1-20260718T010100UTC8/
+/TASK-CODEX-AIOS-SPARK-RUNNER-PROVISIONING-RESULT-20260717T040314Z/
+/TASK-CODEX-AIOS-SPARK-RUNNER-PROVISIONING-V2-20260717T075800Z/
+/TASK-CODEX-V2R1-PERSONAL-WEIXIN-FOUNDATION-RETRY1-20260715T183951UTC8/
+/TASK-CODEX-V2R1-PWX-B3-REPAIR3-20260716/
+/TASK-CODEX-V2R1-PWX-B3-REPAIR3-EXECUTION-BLOCKED-20260717T041314UTC8/
+/TASK-CODEX-V2R1-PWX-B3-REPAIR3-GATE0-20260717T203000UTC8/
+/v2r1-personal-weixin-b3-b4-owner-authorization-20260716T120210UTC8/
+/v2r1-personal-weixin-b3-evidence-git-20260716T123454UTC8/
+/v2r1-personal-weixin-b3-evidence-git-worktree-20260716T124948UTC8/
+/v2r1-personal-weixin-b3-evidence-repair3-20260716T232732UTC8/
+/v2r1-personal-weixin-b3-evidence-source-20260716/
+/v2r1-personal-weixin-b3-evidence-source-result-20260716T140343UTC8/
+/v2r1-personal-weixin-foundation-result-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry1-result-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry10-20260716T092623UTC8/
+/v2r1-personal-weixin-foundation-retry10-result-20260716T092623UTC8/
+/v2r1-personal-weixin-foundation-retry2-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry2-result-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry3-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry3-result-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry4-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry4-result-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry5-result-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry6-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry6-result-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry7-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry7-result-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry8-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry8-result-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry9-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry9-result-20260715T183951UTC8/
+/v2r1-personal-weixin-foundation-retry9-resume-owner-patch-20260716T014714UTC8/
+/v2r1-personal-weixin-foundation-takeover-20260715T183951UTC8/
+/v2r1-personal-weixin-r10-b3-b4-evidence-gate-20260716T101002UTC8/
+/v2r1-personal-weixin-r10-lineage-amendment-20260716T095245UTC8/
+/v2r1-personal-weixin-upstream-protocol-evidence-20260716T105003UTC8/
+# END AIOS REGISTERED CHILD WORKTREES (V2R1C1 2026-07-21)

RESULT-CODEX-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260715T001652UTC8.md

@@ -0,0 +1,62 @@
+# CODEX GitOps isolated worktree migration result
+
+- Run: `20260715T001652UTC8`
+- Host: `cn-network-mkt`
+- Source rollback workspace: `/data/aios-gitops/workspace` (preserved; no reset, clean, force-push, or prune performed)
+- Source head/branch: `b05eb1babe9c657e8776c09eec71302166902cc3` / `task/codex/gitops-isolated-worktree-migration-20260715T001652UTC8`
+- Untracked snapshot: `/data/aios-gitops/artifacts/worktree-untracked-backups/migration-20260715T001652UTC8/workspace-untracked-51-files.tar.gz`
+- Snapshot SHA256: `d5cf772d1badec5a9582e366ac4709d6aaa7613a2d091372d35787e7152d9b2a`
+- Untracked files archived: `51`
+
+## Isolated roots
+
+| role | path | branch | HEAD |
+|---|---|---|---|
+| bare remote | `/data/aios-gitops/repo.git` | n/a | `b05eb1babe9c657e8776c09eec71302166902cc3` |
+| controller | `/data/aios-gitops/worktrees/controller` | `agent/controller/gitops-isolated-worktree-migration-20260715T001652UTC8` | `b05eb1babe9c657e8776c09eec71302166902cc3` |
+| openclaw | `/data/aios-gitops/worktrees/openclaw` | `agent/openclaw/gitops-isolated-worktree-migration-20260715T001652UTC8` | `6483e34892f56daa2abdd11f6a73fc4f99648841` |
+| codex acceptance | `/data/aios-gitops/worktrees/codex` | `agent/codex/gitops-isolated-worktree-migration-20260715T001652UTC8` | `bcbda0d048dad164414c05740736d252652fc927` |
+
+The bare root, worktree root, and controller/openclaw/codex worktree roots are `aiman:gitops`, mode `2775` for directories, with default ACL entries `user:aiman:rwx`, `group:gitops:rwx`, and mask `rwx`. Recursive inheritance was tested as `aiman`: a new file retains named ACL `rwx` with effective `rw-` due to its file mask. Bare `core.sharedRepository=group`.
+
+## Cutover
+
+Actual GitOps writers were drained before cutover. Systemd drop-ins route controller, autonomous daemon, agent command watcher, and active model API to `/data/aios-gitops/worktrees/controller`; OpenClaw receives `/data/aios-gitops/worktrees/openclaw` through safe environment overrides and remains stopped because it was inactive before this migration. All migrated writer units use `UMask=0002`; controller/daemon/watcher/model API use `aiman:gitops`, and root-run OpenClaw has primary group `gitops` to preserve its root-owned production home access.
+
+Model API restart health response:
+
+```json
+
+{
+  "status": "ok",
+  "service": "chatgpt-gitops-adapter",
+  "workspace": "/data/aios-gitops/worktrees/controller"
+}
+
+```
+
+Gitea and its branch-consistency sentinel were not modified. The sentinel still references the preserved rollback source and was already failed/inactive at preflight; this report therefore makes no claim that every non-writer reference on the host is source-free.
+
+Scope note: normalizing the existing `/data/aios-gitops/worktrees` parent recursively applied the requested aiman:gitops ACL/group policy to pre-existing worktrees below that parent. No repository contents, source workspace refs, source worktree files, reset/clean, force-push, or prune were changed.
+During final verification, ACL normalization was found to have removed Git-tracked executable bits in the three new worktrees only. The diffs were mode-only (no content delta), and every tracked file mode was restored from its Git index; all three worktrees then returned clean. The preserved source workspace was never touched.
+
+## Concurrent acceptance
+
+OpenClaw and Codex jobs ran concurrently on distinct branches/worktrees; each committed and pushed to the isolated bare remote without retry and without `GIT_OPTIONAL_LOCKS=0`.
+
+| job | local OID | bare remote OID | verified |
+|---|---|---|---|
+| OpenClaw | `6483e34892f56daa2abdd11f6a73fc4f99648841` | `6483e34892f56daa2abdd11f6a73fc4f99648841` | yes |
+| Codex acceptance | `bcbda0d048dad164414c05740736d252652fc927` | `bcbda0d048dad164414c05740736d252652fc927` | yes |
+
+## Raw-log collision/error counts
+
+| pattern | count |
+|---|---:|
+| permission denied | 3 |
+| checkout collision | 0 |
+| lock collision / index.lock | 0 |
+
+The three `permission denied` matches are from the first malformed report generator attempting to execute Markdown-backticked paths; they are not Git/ACL/checkout permission failures. That report was replaced by a literal-format correction without rewriting history. Count scope is the two persisted orchestration logs plus the two acceptance logs; report-correction output is excluded to avoid self-counting the explanatory text.
+
+Persisted raw logs: `/data/aios-gitops/logs/CODEX-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260715T001652UTC8.raw.log`, `/data/aios-gitops/logs/CODEX-GITOPS-OpenClaw-ACCEPTANCE-20260715T001652UTC8.raw.log`, and `/data/aios-gitops/logs/CODEX-GITOPS-Codex-ACCEPTANCE-20260715T001652UTC8.raw.log`.

evidence/RESULT-CODEX-GITOPS-SECRET-ACL-AND-IDENTITY-HARDENING-20260715T004818UTC8.md

@@ -0,0 +1,57 @@
+# GitOps secret ACL and identity hardening
+
+task_id=TASK-CODEX-GITOPS-SECRET-ACL-AND-IDENTITY-HARDENING-20260715T004818UTC8
+phase=precheck_complete
+acl_owner_group=root:gitops
+acl_mode=750
+acl_named_aiman=rwx_effective_rx
+acl_default_entries=absent
+acl_negative_probe_scope=two_nonsecret_write_vectors
+acl_negative_probe_result=expected_rejection_checksum_preserved
+negative_probe_artifact=restricted_outside_repository
+openclaw_gateway_identity=unchanged_root
+openclaw_writer_unit=openclaw-git-writer@.service
+openclaw_writer_identity=aiman:gitops
+openclaw_writer_worktree=/data/aios-gitops/worktrees/openclaw
+openclaw_writer_secret_environment=absent
+acceptance=scheduled
+prior_attempt_identity_guard=primary_group_mismatch
+prior_attempt_git_operation_started=0
+final_acceptance_task=TASK-CODEX-GITOPS-SECRET-ACL-AND-IDENTITY-HARDENING-20260715T004818UTC8-FINAL
+final_acceptance_concurrent_launch=scheduled
+final_acceptance_codex_branch=acceptance/codex/TASK-CODEX-GITOPS-SECRET-ACL-AND-IDENTITY-HARDENING-20260715T004818UTC8-FINAL
+final_acceptance_codex_oid=7c4236305848dbb47c7134cafb3376fb713f8e03
+final_acceptance_openclaw_branch=acceptance/openclaw/TASK-CODEX-GITOPS-SECRET-ACL-AND-IDENTITY-HARDENING-20260715T004818UTC8-FINAL
+final_acceptance_openclaw_oid=6cd0f5aa0ad28f767ffd5396c29d1a9182f88c43
+final_bare_oid_match_codex=1
+final_bare_oid_match_openclaw=1
+openclaw_writer_systemd_result=success
+openclaw_writer_proc_identity=Uid:	1000	1000	1000	1000;Gid:	1001	1001	1001	1001
+openclaw_writer_proc_command=aiman    gitops   bash /usr/local/libexec/openclaw-git-writer TASK-CODEX-GITOPS-SECRET-ACL-AND-IDENTITY-HARDENING-20260715T004818UTC8-FINAL
+model_api_active=1
+model_api_health_http_code=200
+worktree_mode_codex=2775 aiman:gitops
+worktree_mode_openclaw=2775 aiman:gitops
+clean_log_sha256=cc7def630ab998fc2363c8cebe8c6e9d44769a6a418b4a0a18d2873806164c85
+
+## Documentation gate supplement
+
+negative_acl_probe_artifact_path=/data/aios-gitops/runtime/secrets/acl-negative-probe-TASK-CODEX-GITOPS-SECRET-ACL-AND-IDENTITY-HARDENING-20260715T004818UTC8.log
+negative_acl_probe_artifact_sha256=a4ca7dd2a9801d2254c019b99354882617290d2739281c204db1c1ef4a8c8039
+negative_acl_probe_artifact_mode=600 root:root
+negative_acl_probe_artifact_content=not_embedded
+clean_final_log_path=/data/aios-gitops/runtime/verification/clean-TASK-CODEX-GITOPS-SECRET-ACL-AND-IDENTITY-HARDENING-20260715T004818UTC8.log
+clean_final_log_sha256=cc7def630ab998fc2363c8cebe8c6e9d44769a6a418b4a0a18d2873806164c85
+clean_final_log_scope=final_clean_corpus_only
+permission_denied_count: 0
+checkout_collision_count: 0
+git_lock_collision_count: 0
+codex_acceptance_commit_oid=7c4236305848dbb47c7134cafb3376fb713f8e03
+codex_acceptance_commit_local_verified=1
+codex_acceptance_commit_bare_verified=1
+report_commit_tip_before_documentation_correction=c0d82846151d577b3d80a95d20a6917228457272
+report_commit_tip_before_documentation_correction_local_bare_verified=1
+openclaw_gateway_identity=root:gitops
+openclaw_gateway_root_credentials_boundary=unchanged
+model_api_health_endpoint=http://127.0.0.1:resolved-local-port/health
+model_api_health_http_status=200

reports/migration-codex-isolated-worktree-acceptance.md

@@ -0,0 +1,5 @@
+# Codex isolated-worktree acceptance
+
+branch: `agent/codex/gitops-isolated-worktree-migration-20260715T001652UTC8`
+
+base: `b05eb1babe9c657e8776c09eec71302166902cc3`