task(agent): 固化在线验收与回滚审查证据

.agent/blockers.json

@@ -1,7 +1,7 @@
 {
   "schema": "aios.v2.agent-blockers.v1",
   "task_id": "AIOS-V2R1-PRODUCTION-DEPLOY-20260720",
-  "updated_at": "2026-07-21T03:23:27Z",
+  "updated_at": "2026-07-21T04:30:00Z",
   "evidence_writer": "windows-chatgpt-owner",
   "blockers": [
     {

.agent/claim.json

@@ -7,10 +7,11 @@
   "candidate_commit": "ba7669c3b49f98cf3500af6ea966ba0db472ff3b",
   "claimed_at": "2026-07-20T08:24:30Z",
   "executor_instance": "openclaw-main-cn-network-mkt",
-  "owner_observation_at": "2026-07-21T03:23:27Z",
-  "owner_observation": "五项高风险 Blocker 已解除；Provenance Writer 真实写入、普通 Push、审计和越权拒绝通过。",
+  "owner_observation_at": "2026-07-21T04:30:00Z",
+  "owner_observation": "五项高风险 Blocker、Gate A/B、离线验收、OpenClaw 在线合同、双服务重启恢复与受控回滚均已形成真实证据；Hermes 完整在线 Worker 生命周期仍未暴露为服务端点。",
   "evidence_writer": "windows-chatgpt-owner",
   "previous_candidate_commit": "634f6b164f5b20372ab9ec8144bbf76df97de335",
   "candidate_merge_commit": "f55dfd975e9d716b690c7693742e7cf2beaa55e7",
   "candidate_updated_at": "2026-07-20T09:39:16Z"
+  ,"latest_task_commit_before_evidence": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a"
 }

.agent/credential-status.json

@@ -24,12 +24,12 @@
   "token_file_owner": "root:root",
   "token_file_mode": "0600",
   "secret_provider_contract_path": "/etc/openclaw/SECRET_PROVIDER_CONTRACT.json",
-  "last_verified": "2026-07-21T03:23:27Z",
+  "last_verified": "2026-07-21T04:30:00Z",
   "verification_result": "HTTPS Git push successful with new token",
   "env_file_reference": "AIOS_OPENCLAW_CREDENTIAL_REF=file:///etc/openclaw/secrets/openclaw-gitea-deploy-token",
   "env_file_path": "/etc/aios-v2/aios-v2.env",
   "env_file_mode": "0640 root:gitops",
-  "last_updated": "2026-07-21T03:23:27Z",
+  "last_updated": "2026-07-21T04:30:00Z",
   "old_credential_revoked": true,
   "revoked": true,
   "new_credential_name": "openclaw-deploy-cli-v2-20260720",
@@ -53,5 +53,9 @@
   "run_provenance_status": "resolved",
   "provenance_id": "openclaw-v2r1-20260721T031523Z",
   "provenance_public_key_configured": true,
-  "provenance_secret_values_recorded": false
+  "provenance_secret_values_recorded": false,
+  "openclaw_runtime_plugin_version": "2.1.0-rc.3",
+  "runtime_public_key_only_hot_path": true,
+  "runtime_http_contract_test": "passed",
+  "secret_values_recorded_in_runtime_evidence": false
 }

.agent/heartbeat.json

@@ -1,9 +1,9 @@
 {
-  "current_step": "GATE_A_PENDING",
-  "evidence_writer": "aios_evidence_write",
+  "current_step": "ONLINE_HERMES_WORKER_GAP",
+  "evidence_writer": "windows-chatgpt-owner",
   "executor": "openclaw",
-  "heartbeat_at": "2026-07-21T03:23:27Z",
-  "heartbeat_source": "owner-signed-provenance-writer",
+  "heartbeat_at": "2026-07-21T04:30:00Z",
+  "heartbeat_source": "owner-live-acceptance",
   "provenance_id": "openclaw-v2r1-20260721T031523Z",
   "schema": "aios.v2.agent-heartbeat.v1",
   "state": "running",

.agent/progress.json

@@ -3,9 +3,9 @@
   "task_id": "AIOS-V2R1-PRODUCTION-DEPLOY-20260720",
   "state": "running",
   "status": "PARTIAL",
-  "updated_at": "2026-07-21T03:23:27Z",
+  "updated_at": "2026-07-21T04:30:00Z",
   "candidate_commit": "ba7669c3b49f98cf3500af6ea966ba0db472ff3b",
-  "task_commit_before_owner_evidence": "558dc932fa200831045e0f2edebbc12d775232bc",
+  "task_commit_before_owner_evidence": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a",
   "gitea_sync": {
     "candidate_match": true,
     "openclaw_task_match_before_owner_evidence": true,
@@ -13,10 +13,10 @@
   },
   "credential_rotation_status": "passed",
   "executor_model_path": "passed",
-  "tests": "controller 12/12；provenance Node 9/9；真实签发/越权拒绝/heartbeat commit+push/审计通过；Gate A/B/离线 Acceptance 待执行",
-  "deployment": "aios-tenant-boundary rc2 已部署，runtime doctor 与 Gateway restart 通过",
-  "rollback": "两次验收脚本断言错误均实际触发备份回滚并恢复 rc1；修正后 rc2 部署成功",
-  "current_step": "GATE_A_PENDING",
+  "tests": "controller 12/12；provenance/Runtime Node 14/14；Candidate 10/10；Gate A 0错误0警告；Gate B 10/10；离线 8通过0失败1警告；OpenClaw 在线合同与 AIOS/Hermes 基础联调通过",
+  "deployment": "aios-tenant-boundary rc3 与隔离 Release b158041 已部署；仅监听 127.0.0.1:18921，未切流量",
+  "rollback": "Previous 2a2b702 与 Current b158041 双向切换通过；默认不恢复状态，业务状态、SQLite、Execution Evidence 均保留",
+  "current_step": "ONLINE_HERMES_WORKER_GAP",
   "evidence_writer": "windows-chatgpt-owner",
   "aios_v2_env_status": {
     "exists": true,
@@ -25,7 +25,7 @@
     "mode": "0640",
     "four_fields_nonempty": true,
     "credential_ref_target_exists": true,
-    "signing_material_target_exists": false
+    "signing_material_target_exists": true
   },
   "previous_candidate_commit": "634f6b164f5b20372ab9ec8144bbf76df97de335",
   "candidate_merge_commit": "f55dfd975e9d716b690c7693742e7cf2beaa55e7",
@@ -56,4 +56,15 @@
   },
   "provenance_id": "openclaw-v2r1-20260721T031523Z",
   "provenance_live_commit": "25c25abd3ed19091fe078d4d7a271c57f23e87fb"
+  ,"gate_a": "passed"
+  ,"gate_b": "passed_10_of_10"
+  ,"offline_acceptance": "passed_8_failed_0_warning_1"
+  ,"online_openclaw_contract": "passed"
+  ,"aios_restart_recovery": "passed"
+  ,"openclaw_restart_idempotency": "passed"
+  ,"rollback_drill": "passed"
+  ,"online_evidence_log": "/var/lib/aios-gitops/acceptance/aios-v2r1-20260721T0325Z/online-runtime-openclaw-final4.log"
+  ,"restart_evidence_log": "/var/lib/aios-gitops/acceptance/aios-v2r1-20260721T0325Z/restart-recovery.log"
+  ,"rollback_evidence_log": "/var/lib/aios-gitops/acceptance/aios-v2r1-20260721T0325Z/rollback-drill-final3.log"
+  ,"remaining_acceptance_gap": "Hermes claim/start/heartbeat/fail/cancel/lease-expiry/worker-crash-recovery 与 Cell/Profile 错误结果拒绝未暴露为在线服务端点"
 }

.agent/result.json

@@ -3,7 +3,7 @@
   "task_id": "AIOS-V2R1-PRODUCTION-DEPLOY-20260720",
   "final_status": "PARTIAL",
   "candidate_commit": "ba7669c3b49f98cf3500af6ea966ba0db472ff3b",
-  "task_commit_before_owner_evidence": "558dc932fa200831045e0f2edebbc12d775232bc",
+  "task_commit_before_owner_evidence": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a",
   "gitea_sync": {
     "candidate_match": true,
     "openclaw_task_match_before_owner_evidence": true,
@@ -11,10 +11,10 @@
   },
   "secret_reference_status": "resolved",
   "executor_status": "running",
-  "test_status": "controller 12/12；provenance 9/9；live write/push/audit/deny passed；Gate A/B/offline pending",
-  "deployment_status": "provenance plugin rc2 active",
-  "rollback_status": "automatic plugin/config rollback exercised and passed",
-  "documentation_sync_status": "updated before Gate A",
+  "test_status": "Gate A、Gate B 10/10、离线 8/0/1、OpenClaw 正式在线、重启恢复和回滚通过；Hermes 完整在线 Worker 生命周期未覆盖",
+  "deployment_status": "OpenClaw Runtime rc3 与 AIOS 隔离 Release b158041 active；无生产流量切换",
+  "rollback_status": "Previous 2a2b702 与 Current b158041 双向演练通过，业务状态保留",
+  "documentation_sync_status": "updated and Gate A passed",
   "changed_files": [
     ".agent/claim.json",
     ".agent/heartbeat.json",
@@ -26,14 +26,18 @@
   ],
   "open_blockers": [],
   "remaining_risks": [
-    "缺少 Owner-signed provenance issuer/store/writer 与越权拒绝证据"
+    "Hermes claim/start/heartbeat/fail/cancel/lease expiry/worker crash recovery/Cell/Profile 错误结果拒绝尚无在线服务端点证据"
   ],
-  "completed_at": "2026-07-21T03:23:27Z",
+  "completed_at": "2026-07-21T04:30:00Z",
   "evidence_writer": "windows-chatgpt-owner",
   "previous_candidate_commit": "634f6b164f5b20372ab9ec8144bbf76df97de335",
   "candidate_merge_commit": "f55dfd975e9d716b690c7693742e7cf2beaa55e7",
   "candidate_updated_at": "2026-07-20T09:39:16Z",
   "release_recommendation": "STOP_PREPRODUCTION",
   "provenance_id": "openclaw-v2r1-20260721T031523Z",
-  "provenance_live_commit": "25c25abd3ed19091fe078d4d7a271c57f23e87fb"
+  "provenance_live_commit": "25c25abd3ed19091fe078d4d7a271c57f23e87fb",
+  "online_openclaw_contract": "passed",
+  "restart_recovery": "passed",
+  "rollback_drill": "passed",
+  "formal_online_acceptance": "partial"
 }

.agent/status.json

@@ -5,14 +5,22 @@
   "state": "running",
   "status": "running",
   "claimed_at": "2026-07-20T08:24:30Z",
-  "updated_at": "2026-07-21T03:23:27Z",
-  "last_heartbeat": "2026-07-21T03:23:27Z",
+  "updated_at": "2026-07-21T04:30:00Z",
+  "last_heartbeat": "2026-07-21T04:30:00Z",
   "heartbeat_valid_for_running": true,
-  "current_step": "GATE_A_PENDING",
+  "current_step": "ONLINE_HERMES_WORKER_GAP",
   "candidate_commit": "ba7669c3b49f98cf3500af6ea966ba0db472ff3b",
   "release_recommendation": "STOP_PREPRODUCTION",
   "evidence_writer": "windows-chatgpt-owner",
   "previous_candidate_commit": "634f6b164f5b20372ab9ec8144bbf76df97de335",
   "candidate_merge_commit": "f55dfd975e9d716b690c7693742e7cf2beaa55e7",
   "candidate_updated_at": "2026-07-20T09:39:16Z"
+  ,"task_commit_before_evidence": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a"
+  ,"gate_a": "passed"
+  ,"gate_b": "passed_10_of_10"
+  ,"offline_acceptance": "passed_8_failed_0_warning_1"
+  ,"online_openclaw": "passed"
+  ,"restart_recovery": "passed"
+  ,"rollback_drill": "passed"
+  ,"hermes_full_online_worker_lifecycle": "not_exposed"
 }

.aios-evidence/acceptance/20260721T042451Z/summary.json

@@ -0,0 +1,67 @@
+{
+  "schema": "aios.v2.acceptance.v1",
+  "generated_at": "2026-07-21T04:24:51.586289Z",
+  "branch": "task/openclaw/AIOS-V2R1-PRODUCTION-DEPLOY-20260720",
+  "commit": "2a2b702eb8f9501a637b9f9b5f033482eec7cc75",
+  "workspace_dirty": false,
+  "passed": 8,
+  "failed": 0,
+  "warnings": 1,
+  "steps": [
+    {
+      "name": "文档与代码匹配",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042451Z/文档与代码匹配.log"
+    },
+    {
+      "name": "Python 语法编译",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042451Z/Python_语法编译.log"
+    },
+    {
+      "name": "候选单元与集成测试",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042451Z/候选单元与集成测试.log"
+    },
+    {
+      "name": "Shell 脚本语法",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042451Z/Shell_脚本语法.log"
+    },
+    {
+      "name": "文档 Git 冲突标记",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042451Z/文档_Git_冲突标记.log"
+    },
+    {
+      "name": "明文密钥基础扫描",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042451Z/明文密钥基础扫描.log"
+    },
+    {
+      "name": "systemd 单元验证",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042451Z/systemd_单元验证.log"
+    },
+    {
+      "name": "Docker Compose 配置验证",
+      "status": "通过",
+      "exit_code": 0,
+      "log": "/data/aios-gitops/worktrees/aios-v2r1-deploy-20260720/.aios-evidence/acceptance/20260721T042451Z/Docker_Compose_配置验证.log"
+    },
+    {
+      "name": "在线健康检查",
+      "status": "警告",
+      "exit_code": 0,
+      "log": "未启用 AIOS_RUN_LIVE_HEALTHCHECK=1"
+    }
+  ],
+  "final_status": "passed"
+}

deploy/aios-v2/rollback/rollback.sh

@@ -8,12 +8,28 @@ STATE_DIR="${AIOS_V2_STATE_DIR:-/var/lib/aios-v2}"
 BACKUP_ROOT="${AIOS_V2_BACKUP_ROOT:-/var/backups/aios-v2}"
 TARGET_RELEASE="${1:-}"
 RESTORE_STATE="${AIOS_V2_RESTORE_STATE:-0}"
+HEALTH_RETRIES="${AIOS_V2_ROLLBACK_HEALTH_RETRIES:-30}"
+HEALTH_RETRY_DELAY="${AIOS_V2_ROLLBACK_HEALTH_RETRY_DELAY:-1}"
 
 fail() {
   echo "ERROR: $*" >&2
   exit 1
 }
 
+run_healthcheck() {
+  local release="$1"
+  local attempt
+  for ((attempt = 1; attempt <= HEALTH_RETRIES; attempt++)); do
+    if AIOS_V2_SERVICE="$SERVICE" \
+       AIOS_V2_STATE_DIR="$STATE_DIR" \
+       "$release/deploy/aios-v2/healthcheck/check.sh"; then
+      return 0
+    fi
+    [[ "$attempt" -lt "$HEALTH_RETRIES" ]] && sleep "$HEALTH_RETRY_DELAY"
+  done
+  return 1
+}
+
 [[ "${EUID}" -eq 0 ]] || fail "rollback must run as root"
 [[ -n "$TARGET_RELEASE" ]] || fail "usage: $0 <release-name-or-absolute-path>"
 
@@ -53,9 +69,7 @@ mv -Tf "${CURRENT_LINK}.next" "$CURRENT_LINK"
 systemctl daemon-reload
 systemctl start "$SERVICE"
 
-if AIOS_V2_SERVICE="$SERVICE" \
-   AIOS_V2_STATE_DIR="$STATE_DIR" \
-   "$TARGET_PATH/deploy/aios-v2/healthcheck/check.sh"; then
+if run_healthcheck "$TARGET_PATH"; then
   echo "ROLLBACK_COMPLETE target=$TARGET_PATH backup=$BACKUP_DIR"
   exit 0
 fi
@@ -78,9 +92,7 @@ systemctl daemon-reload
 systemctl start "$SERVICE" || true
 
 if [[ -n "$PREVIOUS_PATH" && -x "$PREVIOUS_PATH/deploy/aios-v2/healthcheck/check.sh" ]]; then
-  AIOS_V2_SERVICE="$SERVICE" \
-  AIOS_V2_STATE_DIR="$STATE_DIR" \
-  "$PREVIOUS_PATH/deploy/aios-v2/healthcheck/check.sh" || true
+  run_healthcheck "$PREVIOUS_PATH" || true
 fi
 
 fail "rollback target failed; previous release restored; evidence=$BACKUP_DIR"

docs/aios-v2/04-MODULE-CONTRACTS.md

@@ -492,6 +492,8 @@ POST /api/v2/hermes/results/reconcile
 - 回滚后必须执行 healthcheck。
 - Release Archive 必须保留 `rollback.sh` 与 `healthcheck/check.sh` 的 executable bit；
   验收测试必须阻止非执行模式进入候选包。
+- `systemctl start` 后的回滚健康检查必须执行有界 readiness 重试，默认最多 30 次、
+  每次间隔 1 秒；不得因服务尚未监听的一次瞬时拒绝误判目标 Release 失败。
 
 ## 14. 契约变更规则
 

tests/aios_v2_candidate/test_candidate_flow.py

@@ -79,6 +79,12 @@ class CandidateFlowTests(unittest.TestCase):
             mode = (REPO_ROOT / relative).stat().st_mode
             self.assertTrue(mode & stat.S_IXUSR, relative)
 
+    def test_rollback_waits_for_bounded_service_readiness(self) -> None:
+        script = (REPO_ROOT / "deploy/aios-v2/rollback/rollback.sh").read_text()
+        self.assertIn("AIOS_V2_ROLLBACK_HEALTH_RETRIES", script)
+        self.assertIn("run_healthcheck", script)
+        self.assertIn("HEALTH_RETRY_DELAY", script)
+
     def test_build_application_propagates_openclaw_signing_key_id(self) -> None:
         with tempfile.TemporaryDirectory() as temp_dir:
             material_path = Path(temp_dir) / "signing-material.bin"