Merge pull request '[OWNER BREAK-GLASS GOVERNANCE RESET] Single Owner with Machine Gates' (#26) from governance/request/single-owner-governance-migration-20260728T162246Z into governance/approvals

Reviewed-on: #26
Reviewed-by: codex <codex@imruyi.top>
Reviewed-by: gpt <gpt@imruyi.top>

approvals/control-plane-deployment/AIOS-INTEGRATION-REFRESH-CONTROL-PLANE-DEPLOYMENT-20260728T093428Z.json

@@ -0,0 +1,83 @@
+{
+  "approval_request_branch": "governance/request/integration-refresh-control-plane-deployment-20260728T093428Z",
+  "approval_type": "CONTROL_PLANE_DEPLOYMENT_APPROVAL_REQUEST",
+  "authorization_lineage": {
+    "execution_renewal_merge_oid": "3a22c3c7d86930efd4bd93ac05d80ad322050cb9",
+    "grant_id": "grant-11354281aafdd074df5899a3925dd2a0370cffa9edb06f5c7d7227ce8de00d91",
+    "source_mapping_approval_merge_oid": "9514062cf33e45941abe4a8c98377e0713b0b3f6"
+  },
+  "deployment_status": "NOT_EXECUTED",
+  "evidence": {
+    "control_plane_artifact": {
+      "path": "/var/lib/aios-integration-refresh-source-writer-v2/artifacts/control-plane-patch-112d995545e3e79126a062b2643a9f0c17ae7bd4.tar",
+      "sha256": "bf101ade1aaf956f40c0bba74ed4b347f5f38d0de6a0c1b7694ae107c4b43c14",
+      "size_bytes": 13363200
+    },
+    "rendered_systemd_config_sha256": "182a3cba48e752798cf24323a8c0249c53d7386371388a8db0435a29c43dc969",
+    "rollback_artifact": {
+      "path": "/var/lib/aios-gitops/runtime/tasks/AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726/implementation/rollback-to-85426f4f570e4d40b212318d47e52e4aed5cb06a.tar",
+      "sha256": "f12a2a95e475da5d02eaff99e93615cb0186019ca30edae013ab054a2c6418ce"
+    },
+    "source_map": {
+      "path": "docs/autonomous-release/INTEGRATION_REFRESH_SOURCE_MAP_20260728.json",
+      "sha256": "01ddd56cfa2a525559e2d174cf7df117a9465ffce44ef25bc7a15b8e74d06bf5"
+    },
+    "test_evidence": {
+      "collection_errors": 0,
+      "path": "/var/lib/aios-gitops/runtime/tasks/AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726/implementation/test-evidence.json",
+      "sha256": "d8933553f56462a3f1b3040dec989ff0adf717a17728d55ba0fe9e127d93c206",
+      "tests_failed": 0,
+      "tests_passed": 41
+    }
+  },
+  "execution_conditions": {
+    "candidate_only": true,
+    "integration_unchanged": true,
+    "main_unchanged": true,
+    "no_credentials_or_secrets_in_request": true,
+    "production_baseline_unchanged": true,
+    "registry_unchanged": true
+  },
+  "expected_governance_base_oid": "3a22c3c7d86930efd4bd93ac05d80ad322050cb9",
+  "expires_at": "2026-07-28T21:34:28Z",
+  "implementation": {
+    "commit_oid": "112d995545e3e79126a062b2643a9f0c17ae7bd4",
+    "tree_oid": "4ed88399fb8e7e4c235413ebbd783c9b6ad3c624"
+  },
+  "implementation_branch": "patch/integration-refresh-grant-provisioner-20260726",
+  "issued_at": "2026-07-28T09:34:28Z",
+  "prohibited_operations": [
+    "production-baseline.write",
+    "production-tag.write",
+    "main.write",
+    "integration.write",
+    "registry.write",
+    "force-push",
+    "direct-main-push",
+    "direct-tag-write"
+  ],
+  "repository": "aios/aios",
+  "request_status": "PENDING_HUMAN_APPROVAL",
+  "requested_operations": [
+    "control-plane.candidate.deploy",
+    "control-plane.candidate.verify",
+    "control-plane.candidate.rollback"
+  ],
+  "required_controls": [
+    "Two distinct human approvals, one Codex and one GPT, both APPROVED against the same current approval-request PR head.",
+    "Re-verify artifact, test evidence, source map, rendered systemd configuration, and rollback artifact paths and SHA-256 digests immediately before execution.",
+    "AIOS_GITOPS_WRITES_ENABLED=false throughout candidate deployment, verification, and rollback.",
+    "No force push, direct main write, or direct tag write."
+  ],
+  "required_reviewers": [
+    "codex",
+    "gpt"
+  ],
+  "schema": "aios.control-plane-deployment-approval-request/v1",
+  "target_governance": {
+    "approved_base_oid": "3a22c3c7d86930efd4bd93ac05d80ad322050cb9",
+    "binding_rule": "Human approvals must bind to the same approval-request PR head; its first parent must equal the active governance base."
+  },
+  "task_id": "AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726",
+  "validity_hours": 12
+}

approvals/governance-policy/SINGLE-OWNER-GOVERNANCE-MIGRATION-20260728T162246Z.json

@@ -0,0 +1,484 @@
+{
+  "allowed_human_approvers": [
+    "owner"
+  ],
+  "approval_expires_at": "2026-07-29T16:22:46Z",
+  "approval_request_branch": "governance/request/single-owner-governance-migration-20260728T162246Z",
+  "approval_type": "SINGLE_OWNER_GOVERNANCE_POLICY",
+  "approval_types_migrated_after_policy_effective_at": [
+    "SOURCE_MAPPING_AND_IMPORT_EXECUTION_RENEWAL",
+    "CONTROL_PLANE_DEPLOYMENT_APPROVAL",
+    "DEVELOPMENT_MERGE_APPROVAL",
+    "RELEASE_CANDIDATE_APPROVAL",
+    "PRODUCTION_RELEASE_APPROVAL",
+    "TAG_APPROVAL",
+    "REGISTRY_BASELINE_PROMOTION_APPROVAL",
+    "PRODUCTION_DEPLOYMENT_APPROVAL",
+    "ROLLBACK_APPROVAL"
+  ],
+  "atomic_migration": {
+    "backup_checksums_sha256": "72e2fe0b03d1011c872bb39a6cff489f08398ac7d52092f720cbbc63bcf6f753",
+    "backup_root": "/var/lib/aios-gitops/runtime/tasks/AIOS-SINGLE-OWNER-GOVERNANCE-MIGRATION-20260729/pre-migration-backup",
+    "direct_database_update": false,
+    "direct_ref_update": false,
+    "dual_capable_validator_shadow_required": true,
+    "identity_snapshot_sha256": "2d7b4e72d1fdf187425092089589547e0d76784c611d00f915a8c212f17d3b15",
+    "live_protection_canonical_sha256": "2bc353f34689242cabebf89856d3faab0e1c496b5d33761dfb7cbd47904516f7",
+    "maintenance_lock_required": true,
+    "old_rules_remain_active_until_owner_approval_and_machine_gates_pass": true,
+    "protected_branch_snapshot_sha256": "2bc353f34689242cabebf89856d3faab0e1c496b5d33761dfb7cbd47904516f7",
+    "protection_update_method": "authenticated_admin_API_compare_and_swap",
+    "reviewable_backup_file_hashes": {
+      "app.ini": "0693e4fa8296a22533429339faeee2ac1856b6c966c6c1009bb139ab4784f687",
+      "authoritative-aios.bundle": "4fb4ccc979c3061065cde451af0e733326cb56fa6f860124bb73f153a60907c9",
+      "authoritative-refs.txt": "85cb664c8edf3902bebfc6c2253a3ee16cff8534f86561ba771a73df160186c6",
+      "backup-metadata.json": "a38ef6dacb52ae61c4332bf8d087f479fb0d5f51d5f636a132a711bddd6e7732",
+      "checksums.sha256": "72e2fe0b03d1011c872bb39a6cff489f08398ac7d52092f720cbbc63bcf6f753",
+      "gitea-aios.bundle": "a343c7437f3a1a2aa842dd9d986a1d3cf80691058faae978565224320ff5ed90",
+      "gitea-refs.txt": "1792b2c4f1cf1f232704601ee968e16425f926a6eaab1bdcddf273525d046e4d",
+      "gitea.db": "aadcc1587a05827ed3b2c4ffc2403f26139020cd0328afaa03f7afbf6083a2f1",
+      "governance-identities.json": "2d7b4e72d1fdf187425092089589547e0d76784c611d00f915a8c212f17d3b15",
+      "protected-branch.json": "5cc4ae4fe5614baa3d4bb83d71872a4ad1ce3c5e39061e02b336be40d5b5b75d",
+      "protected-tag.json": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "repository/active-runtime/app/aios_isolated_writer_policy.py": "d86ec23fd5d8b7e9844c0895c50385b6f8f3071c3dac3c0f26c70768ae00a188",
+      "repository/active-runtime/app/isolated_writer_authz.py": "cfae1cdf70c1dabbe013e9365c308a45f11acf20035881a3bb6143774682bbf0",
+      "repository/active-runtime/app/isolated_writer_path_policy.py": "c6c9ea8e45dfc03c4703503f4dc9c92f887bbacdbf1c7779a487567eee6c257c",
+      "repository/active-runtime/app/silent_release_controller.py": "524a0a9961b15c2a35b669d1b89b2142377c13ddd3c721780f374331b7d2b6eb",
+      "repository/active-runtime/app/silent_release_hardening.py": "524aba7034f2cd89d897fe01e9799c835bae9f11ca738182ce469aa59e05cc1a",
+      "repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/approval.py": "cc937a81aef881206cb1d6fd2ad1feb1a1c2e0ad91c908095d56fd96402c3373",
+      "repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/models.py": "aa3b3dd41c03c17e4e116ce444d9f4f779694a9cde684e8329cf892bd319069a",
+      "repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/policy.py": "24b3f3326e6dcd1a4c376d892c53ad20c68e0dd6f861a3a34e11c9a2bba4c756",
+      "repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/release.py": "db535e5006f8e4a3ab80c2f689213045c120b01cda9b43ef461a3022096c9d19",
+      "repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/store.py": "31e1f3b904b0bfc8822d21bfd166a45388f122398d1ec76b803e90ee06dc92f0",
+      "repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/workflow.py": "5f6a8e3a4d66f47717e95842f2eaa443e3cfa321cb08026cc82d74c4ad353bcf",
+      "repository/tests/autonomous_release/test_core_contracts.py": "71852070db50a04901c141213cadc987ae17ec678fe27a901fee165b6d1c3e2a",
+      "repository/tests/autonomous_release/test_external_gates.py": "91cca37eb1d40f0cf9fc38b12e2123045ffebd794a34d6cdef3f1dec470fffd2",
+      "repository/tests/autonomous_release/test_release_gates.py": "d82b23ac00f5389f1a0de628bda9dff898d33f80d375cf6ff74f1531fd138134",
+      "repository/tests/autonomous_release/test_state_and_workflow.py": "c0395a901732adb0b2f1402e6a1cf5202d54aa597bcaec9584a7ea7589c53917"
+    },
+    "reviewable_pre_migration_governance_identity_snapshot": [
+      {
+        "created_unix": 1783321252,
+        "id": 1,
+        "is_active": 1,
+        "is_admin": 0,
+        "last_login_unix": 0,
+        "lower_name": "aios",
+        "prohibit_login": 1,
+        "type": 0
+      },
+      {
+        "created_unix": 1783335380,
+        "id": 2,
+        "is_active": 1,
+        "is_admin": 1,
+        "last_login_unix": 1785086126,
+        "lower_name": "owner",
+        "prohibit_login": 0,
+        "type": 0
+      },
+      {
+        "created_unix": 1783411566,
+        "id": 3,
+        "is_active": 1,
+        "is_admin": 1,
+        "last_login_unix": 0,
+        "lower_name": "gito",
+        "prohibit_login": 0,
+        "type": 0
+      },
+      {
+        "created_unix": 1785078826,
+        "id": 42,
+        "is_active": 1,
+        "is_admin": 0,
+        "last_login_unix": 1785206253,
+        "lower_name": "codex",
+        "prohibit_login": 0,
+        "type": 0
+      },
+      {
+        "created_unix": 1785078882,
+        "id": 43,
+        "is_active": 1,
+        "is_admin": 0,
+        "last_login_unix": 1785206380,
+        "lower_name": "gpt",
+        "prohibit_login": 0,
+        "type": 0
+      }
+    ],
+    "reviewable_pre_migration_protection_snapshot": {
+      "protected_branch": [
+        {
+          "approvals_whitelist_team_i_ds": "null",
+          "approvals_whitelist_user_i_ds": "[42,43]",
+          "block_on_official_review_requests": 1,
+          "block_on_outdated_branch": 1,
+          "block_on_rejected_reviews": 1,
+          "branch_name": "governance/approvals",
+          "can_push": 0,
+          "created_unix": 1785093201,
+          "dismiss_stale_approvals": 1,
+          "enable_approvals_whitelist": 1,
+          "enable_merge_whitelist": 1,
+          "enable_status_check": 0,
+          "enable_whitelist": 0,
+          "id": 1,
+          "ignore_stale_approvals": 0,
+          "merge_whitelist_team_i_ds": "null",
+          "merge_whitelist_user_i_ds": "[42,43]",
+          "protected_file_patterns": "",
+          "repo_id": 1,
+          "require_signed_commits": 0,
+          "required_approvals": 2,
+          "status_check_contexts": "[]",
+          "unprotected_file_patterns": "",
+          "updated_unix": 1785093422,
+          "whitelist_deploy_keys": 0,
+          "whitelist_team_i_ds": "null",
+          "whitelist_user_i_ds": "null"
+        },
+        {
+          "approvals_whitelist_team_i_ds": "null",
+          "approvals_whitelist_user_i_ds": "[42,43]",
+          "block_on_official_review_requests": 1,
+          "block_on_outdated_branch": 1,
+          "block_on_rejected_reviews": 1,
+          "branch_name": "integration/chatgpt-autonomous-completion-20260726",
+          "can_push": 0,
+          "created_unix": 1785093201,
+          "dismiss_stale_approvals": 1,
+          "enable_approvals_whitelist": 1,
+          "enable_merge_whitelist": 1,
+          "enable_status_check": 0,
+          "enable_whitelist": 0,
+          "id": 3,
+          "ignore_stale_approvals": 0,
+          "merge_whitelist_team_i_ds": "null",
+          "merge_whitelist_user_i_ds": "[42,43]",
+          "protected_file_patterns": "",
+          "repo_id": 1,
+          "require_signed_commits": 0,
+          "required_approvals": 2,
+          "status_check_contexts": "[]",
+          "unprotected_file_patterns": "",
+          "updated_unix": 1785093422,
+          "whitelist_deploy_keys": 0,
+          "whitelist_team_i_ds": "null",
+          "whitelist_user_i_ds": "null"
+        },
+        {
+          "approvals_whitelist_team_i_ds": "null",
+          "approvals_whitelist_user_i_ds": "[42,43]",
+          "block_on_official_review_requests": 1,
+          "block_on_outdated_branch": 1,
+          "block_on_rejected_reviews": 1,
+          "branch_name": "main",
+          "can_push": 0,
+          "created_unix": 1785093201,
+          "dismiss_stale_approvals": 1,
+          "enable_approvals_whitelist": 1,
+          "enable_merge_whitelist": 1,
+          "enable_status_check": 0,
+          "enable_whitelist": 0,
+          "id": 2,
+          "ignore_stale_approvals": 0,
+          "merge_whitelist_team_i_ds": "null",
+          "merge_whitelist_user_i_ds": "[42,43]",
+          "protected_file_patterns": "",
+          "repo_id": 1,
+          "require_signed_commits": 0,
+          "required_approvals": 2,
+          "status_check_contexts": "[]",
+          "unprotected_file_patterns": "",
+          "updated_unix": 1785093422,
+          "whitelist_deploy_keys": 0,
+          "whitelist_team_i_ds": "null",
+          "whitelist_user_i_ds": "null"
+        }
+      ],
+      "protected_tag": []
+    },
+    "rollback_archive_members": {
+      "pre-migration-backup/app.ini": "0693e4fa8296a22533429339faeee2ac1856b6c966c6c1009bb139ab4784f687",
+      "pre-migration-backup/authoritative-aios.bundle": "4fb4ccc979c3061065cde451af0e733326cb56fa6f860124bb73f153a60907c9",
+      "pre-migration-backup/authoritative-refs.txt": "85cb664c8edf3902bebfc6c2253a3ee16cff8534f86561ba771a73df160186c6",
+      "pre-migration-backup/backup-metadata.json": "a38ef6dacb52ae61c4332bf8d087f479fb0d5f51d5f636a132a711bddd6e7732",
+      "pre-migration-backup/checksums.sha256": "72e2fe0b03d1011c872bb39a6cff489f08398ac7d52092f720cbbc63bcf6f753",
+      "pre-migration-backup/gitea-aios.bundle": "a343c7437f3a1a2aa842dd9d986a1d3cf80691058faae978565224320ff5ed90",
+      "pre-migration-backup/gitea-refs.txt": "1792b2c4f1cf1f232704601ee968e16425f926a6eaab1bdcddf273525d046e4d",
+      "pre-migration-backup/gitea.db": "aadcc1587a05827ed3b2c4ffc2403f26139020cd0328afaa03f7afbf6083a2f1",
+      "pre-migration-backup/governance-identities.json": "2d7b4e72d1fdf187425092089589547e0d76784c611d00f915a8c212f17d3b15",
+      "pre-migration-backup/protected-branch.json": "5cc4ae4fe5614baa3d4bb83d71872a4ad1ce3c5e39061e02b336be40d5b5b75d",
+      "pre-migration-backup/protected-tag.json": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "pre-migration-backup/repository/active-runtime/app/aios_isolated_writer_policy.py": "d86ec23fd5d8b7e9844c0895c50385b6f8f3071c3dac3c0f26c70768ae00a188",
+      "pre-migration-backup/repository/active-runtime/app/isolated_writer_authz.py": "cfae1cdf70c1dabbe013e9365c308a45f11acf20035881a3bb6143774682bbf0",
+      "pre-migration-backup/repository/active-runtime/app/isolated_writer_path_policy.py": "c6c9ea8e45dfc03c4703503f4dc9c92f887bbacdbf1c7779a487567eee6c257c",
+      "pre-migration-backup/repository/active-runtime/app/silent_release_controller.py": "524a0a9961b15c2a35b669d1b89b2142377c13ddd3c721780f374331b7d2b6eb",
+      "pre-migration-backup/repository/active-runtime/app/silent_release_hardening.py": "524aba7034f2cd89d897fe01e9799c835bae9f11ca738182ce469aa59e05cc1a",
+      "pre-migration-backup/repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/approval.py": "cc937a81aef881206cb1d6fd2ad1feb1a1c2e0ad91c908095d56fd96402c3373",
+      "pre-migration-backup/repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/models.py": "aa3b3dd41c03c17e4e116ce444d9f4f779694a9cde684e8329cf892bd319069a",
+      "pre-migration-backup/repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/policy.py": "24b3f3326e6dcd1a4c376d892c53ad20c68e0dd6f861a3a34e11c9a2bba4c756",
+      "pre-migration-backup/repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/release.py": "db535e5006f8e4a3ab80c2f689213045c120b01cda9b43ef461a3022096c9d19",
+      "pre-migration-backup/repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/store.py": "31e1f3b904b0bfc8822d21bfd166a45388f122398d1ec76b803e90ee06dc92f0",
+      "pre-migration-backup/repository/services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/workflow.py": "5f6a8e3a4d66f47717e95842f2eaa443e3cfa321cb08026cc82d74c4ad353bcf",
+      "pre-migration-backup/repository/tests/autonomous_release/test_core_contracts.py": "71852070db50a04901c141213cadc987ae17ec678fe27a901fee165b6d1c3e2a",
+      "pre-migration-backup/repository/tests/autonomous_release/test_external_gates.py": "91cca37eb1d40f0cf9fc38b12e2123045ffebd794a34d6cdef3f1dec470fffd2",
+      "pre-migration-backup/repository/tests/autonomous_release/test_release_gates.py": "d82b23ac00f5389f1a0de628bda9dff898d33f80d375cf6ff74f1531fd138134",
+      "pre-migration-backup/repository/tests/autonomous_release/test_state_and_workflow.py": "c0395a901732adb0b2f1402e6a1cf5202d54aa597bcaec9584a7ea7589c53917"
+    },
+    "rollback_configuration_path": "/var/lib/aios-gitops/runtime/tasks/AIOS-SINGLE-OWNER-GOVERNANCE-MIGRATION-20260729/rollback-configuration.tar",
+    "rollback_configuration_sha256": "fc8dcf68aaf53edb0cda45833ee45ba5b8b205791af9073258ca617c8b8187d6",
+    "rollback_restores_protection_before_validator": true
+  },
+  "auto_merge_after_owner_approval": false,
+  "auto_merge_machine_conditions": [
+    "owner_approval_valid",
+    "head_oid_unchanged",
+    "required_checks_pass",
+    "secret_scan_pass",
+    "evidence_closure_pass",
+    "approval_not_expired",
+    "protected_branch_rules_pass"
+  ],
+  "automatic_renewal_policy": {
+    "approval_ref_fast_forward_descendant_required": true,
+    "changed_condition_fallback": "HUMAN_OWNER_APPROVAL_PENDING",
+    "secret_scan": "PASS_REQUIRED",
+    "single_renewal_max_hours": 12,
+    "status": "PROPOSED_AFTER_MIGRATION",
+    "total_window_max_days": 7,
+    "unchanged_fields_required": [
+      "original_policy_sha256",
+      "allowed_paths",
+      "allowed_operations",
+      "denied_operations",
+      "source_sha256",
+      "source_blob_oid"
+    ]
+  },
+  "break_glass_executor_may_merge_only_after_owner_approval_machine_gates_and_atomic_cutover_preconditions": true,
+  "break_glass_expires_at": "2026-07-29T16:22:46Z",
+  "desired_branch_protection": {
+    "approval_whitelist_user_ids": [
+      2
+    ],
+    "approval_whitelist_usernames": [
+      "owner"
+    ],
+    "block_on_official_review_requests": true,
+    "block_on_outdated_branch": true,
+    "block_on_rejected_reviews": true,
+    "branch_deletion": false,
+    "branch_patterns": [
+      "governance/approvals",
+      "main",
+      "release/**",
+      "integration/**"
+    ],
+    "direct_push": false,
+    "dismiss_stale_approvals": true,
+    "force_push": false,
+    "require_status_checks": true,
+    "required_approvals": 1,
+    "required_status_contexts": [
+      "aios/machine-gates",
+      "aios/secret-scan",
+      "aios/evidence-closure"
+    ],
+    "wip_blocks_merge": true
+  },
+  "executor_must_not_approve": true,
+  "expected_governance_base_oid": "ac2dc5c30eb35748ef11c98297812729d0fd5828",
+  "expires_at": "2026-07-29T16:22:46Z",
+  "global_constraints": {
+    "AIOS_GITOPS_WRITES_ENABLED": false,
+    "approval_impersonation": false,
+    "direct_main_push": false,
+    "fake_review": false,
+    "force_push": false,
+    "production_change_without_owner_approval": false,
+    "secret_commit": false,
+    "tag_rewrite": false
+  },
+  "governance_model": "SINGLE_OWNER_WITH_MACHINE_GATES_V1",
+  "historical_policy": {
+    "historical_manifests_modified": false,
+    "old_policy_decoder_retained_read_only": true,
+    "requests_created_before_policy_effective_at_use_old_policy": true
+  },
+  "issued_at": "2026-07-28T16:22:46Z",
+  "machine_gates": {
+    "development_branch": [
+      "allowed_branch",
+      "allowed_paths",
+      "compileall",
+      "targeted_tests",
+      "secret_scan",
+      "git_diff_check"
+    ],
+    "production": [
+      "owner_approval",
+      "tag_consistency",
+      "registry_consistency",
+      "deployment_plan",
+      "rollback_plan",
+      "artifact_integrity",
+      "production_preflight"
+    ],
+    "protected_branch_merge": [
+      "expected_base_oid",
+      "current_head_oid",
+      "ordinary_merge_commit",
+      "parent_order_verified",
+      "artifact_binding",
+      "audit_chain_valid"
+    ],
+    "release": [
+      "version_manifest",
+      "explicit_release_target_oid",
+      "artifact_sha256",
+      "rollback_artifact_sha256",
+      "sbom",
+      "test_evidence",
+      "evidence_closure"
+    ]
+  },
+  "merge_mode": "CREATE_MERGE_COMMIT",
+  "migration_acceptance_tests": [
+    "agent_request_pass",
+    "owner_current_head_approval_pass",
+    "machine_gates_then_merge_commit_pass",
+    "agent_self_approval_denied",
+    "non_owner_approval_denied",
+    "stale_head_approval_denied",
+    "wip_merge_denied",
+    "machine_test_failure_merge_denied",
+    "secret_scan_failure_merge_denied",
+    "main_direct_write_denied",
+    "tag_direct_write_denied",
+    "force_push_denied",
+    "missing_tag_target_oid_denied",
+    "missing_evidence_closure_oid_denied",
+    "production_without_owner_denied",
+    "dormant_only_production_activation_denied"
+  ],
+  "migration_mode": "OWNER_BREAK_GLASS_GOVERNANCE_RESET",
+  "new_policy": "SINGLE_OWNER_WITH_MACHINE_GATES_V1",
+  "old_policy": "DUAL_HUMAN_APPROVAL",
+  "owner_approval_contract": {
+    "dismissed": false,
+    "does_not_claim_old_dual_approval_compliance": true,
+    "head_change_invalidates_owner_approval": true,
+    "owner_review_is_break_glass_signature": true,
+    "review_created_before_approval_expires_at": true,
+    "review_state": "APPROVED",
+    "reviewed_head_oid_must_equal_current_pr_head_oid": true,
+    "reviewer_must_equal": "owner",
+    "stale": false
+  },
+  "owner_break_glass_declaration_to_be_attested_by_review": {
+    "attestation_status": "PENDING_OWNER_REVIEW",
+    "expires_at": "2026-07-29T16:22:46Z",
+    "new_policy": "SINGLE_OWNER_WITH_MACHINE_GATES_V1",
+    "old_policy": "DUAL_HUMAN_APPROVAL",
+    "owner_acknowledges_old_policy_exception": true,
+    "reason": "single-maintainer-system",
+    "scope": "governance-policy-migration-only"
+  },
+  "owner_is_only_human_approver": true,
+  "policy_effective_at": null,
+  "pre_approval_non_authorizations": {
+    "approval_validator_update_allowed": false,
+    "gitea_branch_protection_update_allowed": false,
+    "merge_allowed": false,
+    "old_dual_rule_disable_allowed": false,
+    "production_change_allowed": false,
+    "state_machine_update_allowed": false,
+    "writer_credential_issue_allowed": false
+  },
+  "prohibited_merge_modes": [
+    "squash",
+    "rebase",
+    "force",
+    "fast_forward_policy_bypass"
+  ],
+  "reason": "single-maintainer-system",
+  "repository": "aios/aios",
+  "request_status": "HUMAN_OWNER_APPROVAL_PENDING",
+  "requester_must_not_approve": true,
+  "requesters": [
+    "codex-chartgpt-bridge",
+    "aios-governance-agent",
+    "aios-release-agent",
+    "aios-governed-development-writer"
+  ],
+  "required_distinct_human_approvers": 1,
+  "required_human_approvals": 1,
+  "required_owner_approvals": 1,
+  "resolved_owner": {
+    "confidence_before_review": "MEDIUM",
+    "confirmation_rule": "valid APPROVED review by owner on this exact immutable head",
+    "email_sha256": "f5dc2928f6202c24fa4db8bb33db84e1b77c6eff30d1b95abdadeaae209bc4c9",
+    "identity_source": [
+      "gitea_repository_owner_account_aios_is_login_prohibited",
+      "all_login_enabled_site_admins_enumerated_owner_and_never_logged_in_service_gito",
+      "only_interactive_site_admin_named_owner",
+      "gitea_owner_last_login_present",
+      "historical_governance_records_use_approved_by_role_owner",
+      "user_declared_single_natural_person_maintainer"
+    ],
+    "login_enabled_site_admins": [
+      {
+        "observed_prior_login": true,
+        "user_id": 2,
+        "username": "owner"
+      },
+      {
+        "classification": "service_admin_not_human_approver",
+        "observed_prior_login": false,
+        "user_id": 3,
+        "username": "gito"
+      }
+    ],
+    "user_id": 2,
+    "username": "owner"
+  },
+  "schema": "aios.single-owner-governance-policy/v1",
+  "scope": "governance-policy-migration-only",
+  "standing_autonomous_development_policy": {
+    "allowed_without_repeated_owner_approval": [
+      "patch_branch_create",
+      "allowlisted_development_write",
+      "patch_branch_commit_and_push",
+      "test_execute",
+      "artifact_build",
+      "approval_pr_create",
+      "read_only_evidence",
+      "task_writer_renewal"
+    ],
+    "owner_approval_still_required": [
+      "protected_branch_merge",
+      "tag",
+      "registry_update",
+      "production_baseline_update",
+      "production_deploy",
+      "production_rollback",
+      "governance_policy_change"
+    ],
+    "status": "PROPOSED_AFTER_MIGRATION"
+  },
+  "standing_single_owner_governance_migration_authorization": true,
+  "state_machine": {
+    "auto_merge_ready_state": "AUTO_MERGE_READY",
+    "execution_ready_state": "OWNER_APPROVED_EXECUTION_READY",
+    "machine_verified_state": "MACHINE_GATES_VERIFIED",
+    "owner_approval_alone_is_not_execution_ready": true,
+    "owner_verified_state": "OWNER_APPROVAL_VERIFIED",
+    "pending_state": "HUMAN_OWNER_APPROVAL_PENDING"
+  },
+  "task_id": "AIOS-SINGLE-OWNER-GOVERNANCE-MIGRATION-20260729",
+  "this_manifest_authorizes_only_governance_policy_migration": true,
+  "this_manifest_grants_standing_development_authorization": false
+}

approvals/implementation/AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726.json

@@ -0,0 +1,49 @@
+{
+  "schema": "aios.gitea-native-approval/v1",
+  "approval_type": "IMPLEMENTATION",
+  "task_id": "AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726",
+  "repository": "aios/aios",
+  "branch": "patch/integration-refresh-grant-provisioner-20260726",
+  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
+  "actor_identity": "chatgpt-gitops-bot",
+  "writer_audience": "aios-integration-refresh-provisioner-development-writer",
+  "risk": "high",
+  "allowed_paths": [
+    "active-runtime/app/**",
+    "tests/test_integration_refresh_provisioner.py",
+    "tests/test_isolated_writer_integration_merge.py",
+    "tests/test_gitea_branch_read_projection.py",
+    "tests/test_isolated_writer_token_policy_v2.py",
+    "deploy/systemd/aios-integration-refresh-*.service",
+    "docs/autonomous-release/**"
+  ],
+  "allowed_operations": [
+    "repository.source_map.read",
+    "runtime.unit_metadata.read",
+    "git.ref.read",
+    "git.diff.read",
+    "git.branch.patch.create",
+    "commit_file.atomic",
+    "git.push.patch_branch",
+    "test.execute.allowlisted",
+    "artifact.build.control_plane_patch",
+    "evidence.write.task_runtime"
+  ],
+  "denied_operations": [
+    "main.write",
+    "main.merge",
+    "tag.write",
+    "tag.delete",
+    "tag.rewrite",
+    "force_push",
+    "history.rewrite",
+    "baseline.write",
+    "registry.write",
+    "production.deploy",
+    "production.rollback",
+    "secret.read",
+    "secret.export",
+    "bare_ref_direct_write"
+  ],
+  "expires_at": "2026-07-27T03:35:55Z"
+}

approvals/implementation/AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-RENEWAL-20260727.json

@@ -0,0 +1,49 @@
+{
+  "schema": "aios.gitea-native-approval/v1",
+  "approval_type": "IMPLEMENTATION",
+  "task_id": "AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726",
+  "repository": "aios/aios",
+  "branch": "patch/integration-refresh-grant-provisioner-20260726",
+  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
+  "actor_identity": "chatgpt-gitops-bot",
+  "writer_audience": "aios-integration-refresh-provisioner-development-writer",
+  "risk": "high",
+  "allowed_paths": [
+    "active-runtime/app/**",
+    "tests/test_integration_refresh_provisioner.py",
+    "tests/test_isolated_writer_integration_merge.py",
+    "tests/test_gitea_branch_read_projection.py",
+    "tests/test_isolated_writer_token_policy_v2.py",
+    "deploy/systemd/aios-integration-refresh-*.service",
+    "docs/autonomous-release/**"
+  ],
+  "allowed_operations": [
+    "repository.source_map.read",
+    "runtime.unit_metadata.read",
+    "git.ref.read",
+    "git.diff.read",
+    "git.branch.patch.create",
+    "commit_file.atomic",
+    "git.push.patch_branch",
+    "test.execute.allowlisted",
+    "artifact.build.control_plane_patch",
+    "evidence.write.task_runtime"
+  ],
+  "denied_operations": [
+    "main.write",
+    "main.merge",
+    "tag.write",
+    "tag.delete",
+    "tag.rewrite",
+    "force_push",
+    "history.rewrite",
+    "baseline.write",
+    "registry.write",
+    "production.deploy",
+    "production.rollback",
+    "secret.read",
+    "secret.export",
+    "bare_ref_direct_write"
+  ],
+  "expires_at": "2026-07-27T13:00:11Z"
+}

approvals/source-remediation/AIOS-INTEGRATION-REFRESH-SOURCE-CANONICALIZATION-20260727.json

@@ -0,0 +1,151 @@
+{
+  "actor_identity": "chatgpt-gitops-bot",
+  "allowed_operations": [
+    "runtime.source.read.exact",
+    "runtime.source.hash",
+    "runtime.unit_metadata.read",
+    "package.ownership.read",
+    "git.object.lookup.by_blob_oid",
+    "secret.scan.local_source",
+    "repository.source_import.byte_exact",
+    "repository.module.create",
+    "source_map.evidence.write",
+    "git.branch.patch.create",
+    "commit_file.atomic",
+    "git.push.patch_branch",
+    "test.execute.allowlisted",
+    "artifact.build.control_plane_patch",
+    "evidence.write.task_runtime"
+  ],
+  "allowed_paths": [
+    "active-runtime/app/aios_autonomous_release_authorization/**",
+    "active-runtime/app/aios_chatgpt_action_task_router/**",
+    "active-runtime/app/aios_isolated_writer_api/**",
+    "tests/test_integration_refresh_provisioner.py",
+    "tests/test_isolated_writer_integration_merge.py",
+    "tests/test_gitea_branch_read_projection.py",
+    "tests/test_isolated_writer_token_policy_v2.py",
+    "deploy/systemd/aios-integration-refresh-*.service",
+    "docs/autonomous-release/**"
+  ],
+  "allowed_runtime_reads": [
+    "/usr/libexec/aios-autonomous-release-authorization/controller.py",
+    "/usr/libexec/aios-chatgpt-action-task-router-continuous-20260726/action_task_router.py"
+  ],
+  "approval_type": "SOURCE_MAPPING_AND_IMPORT",
+  "canonical_paths": {
+    "controller": "active-runtime/app/aios_autonomous_release_authorization/controller.py",
+    "isolated_writer_api": "active-runtime/app/aios_isolated_writer_api/**",
+    "router": "active-runtime/app/aios_chatgpt_action_task_router/action_task_router.py"
+  },
+  "denied_operations": [
+    "secret.value.return",
+    "secret.matching_line.return",
+    "secret.context.return",
+    "runtime.source.modify",
+    "runtime.unit.modify",
+    "arbitrary_path.read",
+    "secret.read.by_agent",
+    "secret.export",
+    "main.write",
+    "main.merge",
+    "governance.approvals.direct_write",
+    "integration.write",
+    "tag.write",
+    "tag.delete",
+    "tag.rewrite",
+    "force_push",
+    "history.rewrite",
+    "bare_ref_direct_write",
+    "baseline.write",
+    "registry.write",
+    "production.deploy",
+    "production.rollback"
+  ],
+  "expires_at": "2026-07-27T22:36:27Z",
+  "extends_approval_merge_oid": "45f3226662965c8d41ec1775e8c8857f2b986397",
+  "finding_policy": {
+    "controller_byte_exact_import_allowed": true,
+    "controller_finding_status": "PASS",
+    "controller_sanitized_source_creation_allowed": false,
+    "finding_classification_by_automation": "PROHIBITED",
+    "isolated_writer_api_module_create_allowed": true,
+    "matching_source_lines_disclosed": false,
+    "router_byte_exact_import_allowed": true,
+    "router_finding_status": "PASS",
+    "router_sanitized_source_creation_allowed": false,
+    "scan_decision": "MAPPING_IMPORT_ONLY",
+    "secret_content_disclosed": false
+  },
+  "implementation_base_oid": "875d41c3101093149414292067fd700dc214d4d3",
+  "implementation_branch": "patch/integration-refresh-grant-provisioner-20260726",
+  "issued_at": "2026-07-27T10:36:27Z",
+  "repository": "aios/aios",
+  "required_controls": {
+    "controller_finding_must_be_resolved": false,
+    "controller_import_blob_must_equal_runtime_blob": true,
+    "controller_import_must_be_byte_exact": true,
+    "controller_import_sha256_must_equal_runtime_sha256": true,
+    "dual_human_approval_required": true,
+    "global_gitops_writes_must_remain_disabled": true,
+    "new_task_bound_grant_required": true,
+    "old_implementation_token_auth_status": 401,
+    "old_implementation_writer_revoked": true,
+    "old_secret_revocation_must_be_verified": false,
+    "router_finding_must_be_resolved": false,
+    "router_import_blob_must_equal_runtime_blob": true,
+    "router_import_must_be_byte_exact": true,
+    "router_import_sha256_must_equal_runtime_sha256": true,
+    "sanitized_source_behavioral_equivalence_required": false,
+    "sanitized_source_secret_scan_must_pass": false,
+    "true_positive_requires_rotation": false
+  },
+  "risk": "high",
+  "runtime_source_evidence": {
+    "controller": {
+      "finding_count": 0,
+      "findings": [],
+      "git_blob_oid": "9c68be36e0b6a18260e3099e3d7b0dcab6d814aa",
+      "group_gid": 0,
+      "mode": "0o700",
+      "mtime_ns": 1785043975531298047,
+      "owner_uid": 0,
+      "package_owner": "UNPACKAGED",
+      "referencing_systemd_units": [
+        "aios-autonomous-release-authorization-controller.service"
+      ],
+      "resolved_path": "/usr/libexec/aios-autonomous-release-authorization/controller.py",
+      "secret_content_returned": false,
+      "secret_scan": "PASS",
+      "sha256": "39b532c3058c4ae49ed691d7c66c3b7745a25111fa61039f388c8335fd262c50",
+      "size": 24204,
+      "utf8_python": true
+    },
+    "isolated_writer_api": {
+      "canonical_source_path": "NOT_ESTABLISHED",
+      "runtime_module_status": "ABSENT"
+    },
+    "router": {
+      "finding_count": 0,
+      "findings": [],
+      "git_blob_oid": "ee0595ca61a0598f8cb3dc10865a255e21679b2a",
+      "group_gid": 0,
+      "mode": "0o644",
+      "mtime_ns": 1785042222580725999,
+      "owner_uid": 0,
+      "package_owner": "UNPACKAGED",
+      "referencing_systemd_units": [
+        "aios-chatgpt-autonomous-release-route.service"
+      ],
+      "resolved_path": "/usr/libexec/aios-chatgpt-action-task-router-continuous-20260726/action_task_router.py",
+      "secret_content_returned": false,
+      "secret_scan": "PASS",
+      "sha256": "738fb7035a6b792115d6467b4d1e4ffd47a8c5d5646f7032ebc68ea587cbd554",
+      "size": 25952,
+      "utf8_python": true
+    }
+  },
+  "schema": "aios.gitea-native-approval/v1",
+  "task_id": "AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726",
+  "writer_audience": "aios-integration-refresh-provisioner-development-writer"
+}

approvals/source-remediation/AIOS-INTEGRATION-REFRESH-SOURCE-MAPPING-EXECUTION-RENEWAL-20260728T061044Z.json

@@ -0,0 +1,157 @@
+{
+  "actor_identity": "chatgpt-gitops-bot",
+  "allowed_operations": [
+    "runtime.source.read.exact",
+    "runtime.source.hash",
+    "runtime.unit_metadata.read",
+    "package.ownership.read",
+    "git.object.lookup.by_blob_oid",
+    "secret.scan.local_source",
+    "repository.source_import.byte_exact",
+    "repository.module.create",
+    "source_map.evidence.write",
+    "git.branch.patch.create",
+    "commit_file.atomic",
+    "git.push.patch_branch",
+    "test.execute.allowlisted",
+    "artifact.build.control_plane_patch",
+    "evidence.write.task_runtime"
+  ],
+  "allowed_paths": [
+    "active-runtime/app/aios_autonomous_release_authorization/**",
+    "active-runtime/app/aios_chatgpt_action_task_router/**",
+    "active-runtime/app/aios_isolated_writer_api/**",
+    "tests/test_integration_refresh_provisioner.py",
+    "tests/test_isolated_writer_integration_merge.py",
+    "tests/test_gitea_branch_read_projection.py",
+    "tests/test_isolated_writer_token_policy_v2.py",
+    "deploy/systemd/aios-integration-refresh-*.service",
+    "docs/autonomous-release/**"
+  ],
+  "allowed_runtime_reads": [
+    "/usr/libexec/aios-autonomous-release-authorization/controller.py",
+    "/usr/libexec/aios-chatgpt-action-task-router-continuous-20260726/action_task_router.py"
+  ],
+  "approval_type": "SOURCE_MAPPING_AND_IMPORT_EXECUTION_RENEWAL",
+  "canonical_paths": {
+    "controller": "active-runtime/app/aios_autonomous_release_authorization/controller.py",
+    "isolated_writer_api": "active-runtime/app/aios_isolated_writer_api/**",
+    "router": "active-runtime/app/aios_chatgpt_action_task_router/action_task_router.py"
+  },
+  "denied_operations": [
+    "secret.value.return",
+    "secret.matching_line.return",
+    "secret.context.return",
+    "runtime.source.modify",
+    "runtime.unit.modify",
+    "arbitrary_path.read",
+    "secret.read.by_agent",
+    "secret.export",
+    "main.write",
+    "main.merge",
+    "governance.approvals.direct_write",
+    "integration.write",
+    "tag.write",
+    "tag.delete",
+    "tag.rewrite",
+    "force_push",
+    "history.rewrite",
+    "bare_ref_direct_write",
+    "baseline.write",
+    "registry.write",
+    "production.deploy",
+    "production.rollback"
+  ],
+  "expected_governance_base_oid": "9514062cf33e45941abe4a8c98377e0713b0b3f6",
+  "expires_at": "2026-07-28T18:10:44Z",
+  "extends_approval_merge_oid": "45f3226662965c8d41ec1775e8c8857f2b986397",
+  "finding_policy": {
+    "controller_byte_exact_import_allowed": true,
+    "controller_finding_status": "PASS",
+    "controller_sanitized_source_creation_allowed": false,
+    "finding_classification_by_automation": "PROHIBITED",
+    "isolated_writer_api_module_create_allowed": true,
+    "matching_source_lines_disclosed": false,
+    "router_byte_exact_import_allowed": true,
+    "router_finding_status": "PASS",
+    "router_sanitized_source_creation_allowed": false,
+    "scan_decision": "MAPPING_IMPORT_ONLY",
+    "secret_content_disclosed": false
+  },
+  "implementation_base_oid": "875d41c3101093149414292067fd700dc214d4d3",
+  "implementation_branch": "patch/integration-refresh-grant-provisioner-20260726",
+  "issued_at": "2026-07-28T06:10:44Z",
+  "renews_source_mapping_approval_merge_oid": "9514062cf33e45941abe4a8c98377e0713b0b3f6",
+  "renews_source_mapping_manifest_blob_oid": "00c5e90e529cb98c7750a5761b0a0d6ccf507174",
+  "renews_source_mapping_manifest_sha256": "17af8ebc43673c0e46bb9ab1bf44497e8c147f1b4a9d7a8a404edd5c0abd6f21",
+  "repository": "aios/aios",
+  "required_controls": {
+    "controller_finding_must_be_resolved": false,
+    "controller_import_blob_must_equal_runtime_blob": true,
+    "controller_import_must_be_byte_exact": true,
+    "controller_import_sha256_must_equal_runtime_sha256": true,
+    "dual_human_approval_required": true,
+    "global_gitops_writes_must_remain_disabled": true,
+    "new_task_bound_grant_required": true,
+    "old_implementation_token_auth_status": 401,
+    "old_implementation_writer_revoked": true,
+    "old_secret_revocation_must_be_verified": false,
+    "router_finding_must_be_resolved": false,
+    "router_import_blob_must_equal_runtime_blob": true,
+    "router_import_must_be_byte_exact": true,
+    "router_import_sha256_must_equal_runtime_sha256": true,
+    "sanitized_source_behavioral_equivalence_required": false,
+    "sanitized_source_secret_scan_must_pass": false,
+    "true_positive_requires_rotation": false
+  },
+  "risk": "high",
+  "runtime_source_evidence": {
+    "controller": {
+      "finding_count": 0,
+      "findings": [],
+      "git_blob_oid": "9c68be36e0b6a18260e3099e3d7b0dcab6d814aa",
+      "group_gid": 0,
+      "mode": "0o700",
+      "mtime_ns": 1785043975531298047,
+      "owner_uid": 0,
+      "package_owner": "UNPACKAGED",
+      "referencing_systemd_units": [
+        "aios-autonomous-release-authorization-controller.service"
+      ],
+      "resolved_path": "/usr/libexec/aios-autonomous-release-authorization/controller.py",
+      "secret_content_returned": false,
+      "secret_scan": "PASS",
+      "sha256": "39b532c3058c4ae49ed691d7c66c3b7745a25111fa61039f388c8335fd262c50",
+      "size": 24204,
+      "utf8_python": true
+    },
+    "isolated_writer_api": {
+      "canonical_source_path": "NOT_ESTABLISHED",
+      "runtime_module_status": "ABSENT"
+    },
+    "observed_at": "2026-07-28T05:53:01.253909Z",
+    "router": {
+      "finding_count": 0,
+      "findings": [],
+      "git_blob_oid": "ee0595ca61a0598f8cb3dc10865a255e21679b2a",
+      "group_gid": 0,
+      "mode": "0o644",
+      "mtime_ns": 1785042222580725999,
+      "owner_uid": 0,
+      "package_owner": "UNPACKAGED",
+      "referencing_systemd_units": [
+        "aios-chatgpt-autonomous-release-route.service"
+      ],
+      "resolved_path": "/usr/libexec/aios-chatgpt-action-task-router-continuous-20260726/action_task_router.py",
+      "secret_content_returned": false,
+      "secret_scan": "PASS",
+      "sha256": "738fb7035a6b792115d6467b4d1e4ffd47a8c5d5646f7032ebc68ea587cbd554",
+      "size": 25952,
+      "utf8_python": true
+    }
+  },
+  "runtime_source_read_projection_evidence_sha256": "23f03d9c6abe6f11e1acda5210b8708696e3b77caa0083b6bfaef30a44b2a35f",
+  "schema": "aios.gitea-native-approval/v1",
+  "task_id": "AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726",
+  "writer_audience": "aios-integration-refresh-provisioner-development-writer"
+}

deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.self-test.json

@@ -1 +0,0 @@
-{"checks": {"72h_acceptance_gate": true, "approle_implemented": true, "approle_secret_not_persisted_in_hcl": true, "approle_secret_survives_isolated_restore": true, "audit_implemented": true, "autonomy_tls_readers_use_ca_only_bind": true, "backup_implemented": true, "backup_restore_share_without_openbao_private_key_group": true, "branch_protection_gate_not_bypassable": true, "charter_store_sign_verify": true, "continuous_optimization_implemented": true, "controller_uses_charter_only_bind": true, "declarative_self_initialization": true, "embedded_shell_syntax": true, "exact_checksum_duplicate_rejected": true, "exact_checksum_good_fixture": true, "exact_checksum_missing_rejected": true, "fault_injection_does_not_require_service_it_kills": true, "fault_injection_failure_phase_evidence": true, "fault_injection_implemented": true, "fault_injection_missing_seal_reaches_static_seal_validation": true, "fault_injection_systemd_sandbox": true, "gitea_1_22_6_rejected": true, "gitea_1_23_0_accepted": true, "gitea_1_27_nonempty_tag_allowlist": true, "gitea_probe_traversal_and_cleanup": true, "gitea_tag_api_version_gate": true, "isolated_restore_implemented": true, "isolated_restore_uses_private_ephemeral_audit_sink": true, "kv_v2_implemented": true, "machine_credential_persisted": true, "masked_systemd_units_do_not_change_dev_null": true, "no_git_force_push": true, "no_git_tag_mutation": true, "openbao_2_6_heredoc_compatible": true, "openbao_2_6_runtime_verifier": true, "openbao_config_memfd_injection": true, "openbao_ready_gate_not_bypassable": true, "outer_bash_syntax": true, "policy_implemented": true, "ready_not_predeclared": true, "restored_approle_login_has_bounded_readiness_retry": true, "root_token_not_persisted": true, "runtime_state_directory_remains_writable": true, "self_contained_no_sibling_preflight": true, "self_init_marker_bound_to_raft_lifecycle": true, "self_init_secret_removal_implemented": true, "systemd_credentials_mandatory": true, "systemd_runtime_directories": true, "tag_protection_gate_implemented": true, "transit_charter_key_implemented": true, "transit_runtime_key_implemented": true}, "passed": 52, "runtime_claims": false, "schema": "AIOS_OPENBAO_BOOTSTRAP_STATIC_SELF_TEST_V3", "scope": "static_and_fixture_only", "script_sha256": "f687e17b1806e4f4265013b85e2cc3b4472f508720856fc8374607e7d20dbcc6", "total": 52}

deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sha256

@@ -1 +0,0 @@
-f687e17b1806e4f4265013b85e2cc3b4472f508720856fc8374607e7d20dbcc6  admin-bootstrap-openbao-autonomy-v1-v3.sh

deploy/openbao-autonomy/checksums.sha256

@@ -1,4 +0,0 @@
-6bd0d51fbdd1c90df2f6ea8c667edecfaf892aaf76744c41757979407af0d424  admin-bootstrap-openbao-autonomy-v1-v3.self-test.json
-f687e17b1806e4f4265013b85e2cc3b4472f508720856fc8374607e7d20dbcc6  admin-bootstrap-openbao-autonomy-v1-v3.sh
-b7aa70280a417cebaa0363380024dc378714267de5d2eeb681b16a4f610a6ce5  admin-bootstrap-openbao-autonomy-v1-v3.sha256
-c355df01c83c2801ae3a0df43806c562ee70f97c9aa558e3f67dd097efa5ac99  test-admin-bootstrap-openbao-autonomy-v1-v3.sh

deploy/openbao-autonomy/test-admin-bootstrap-openbao-autonomy-v1-v3.sh

@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-umask 077
-
-script="${1:-$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/admin-bootstrap-openbao-autonomy-v1-v3.sh}"
-report="${2:-$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/admin-bootstrap-openbao-autonomy-v1-v3.self-test.json}"
-
-[[ -f "$script" ]] || {
-  printf 'missing script: %s\n' "$script" >&2
-  exit 66
-}
-
-bash -n "$script"
-tmp="$(mktemp)"
-trap 'rm -f "$tmp"' EXIT
-bash "$script" --self-test >"$tmp"
-
-python3 - "$script" "$tmp" <<'PY'
-import hashlib
-import json
-import pathlib
-import sys
-
-script, report = map(pathlib.Path, sys.argv[1:])
-data = json.loads(report.read_text())
-actual_hash = hashlib.sha256(script.read_bytes()).hexdigest()
-
-assert data["schema"] == "AIOS_OPENBAO_BOOTSTRAP_STATIC_SELF_TEST_V3"
-assert data["scope"] == "static_and_fixture_only"
-assert data["runtime_claims"] is False
-assert data["script_sha256"] == actual_hash
-assert data["passed"] == data["total"]
-assert all(data["checks"].values())
-PY
-
-install -m 0600 "$tmp" "$report"
-printf 'PASS bash-n + embedded static/fixture tests\n'
-printf 'report=%s\n' "$report"
-sha256sum "$script"