integrate:v2r1c4-autonomy-control-plane-v2

Source: patch/isolated-writer-token-policy-v2-20260724
Source commit: b1e240dda3
Target base: df099420d2
Production runtime changes: not authorized
Tag/Baseline/Registry operations: not authorized

.agent/results/openclaw/RESULT-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8.md

@@ -0,0 +1,62 @@
+# RESULT-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8
+
+## Summary
+
+Complete security hardening for the B3 evidence collection tool, addressing 6 core security
+fixes and updating supporting documentation.
+
+## Implementation
+
+- Worktree: `/data/aios-gitops/worktrees/openclaw/TASK-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8`
+- Implementation Branch: `patch/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
+- Result Branch: `result/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
+- Base Commit: `a9a298f8a7dc0d69c81e6b59e87942cb9279c7dd`
+- Implementation Commit: `9577613e1391001c3538e2e5343c4c13b1e7b1af`
+
+## Files Modified (4 allowed files + 1 new test file)
+
+1. **tools/personal_weixin/pwx_b3_evidence_tool.py** — Full tool rewrite with 6 security fixes
+2. **tools/personal_weixin/pwx_b3_evidence_facts.template.json** — Added `trust_policy_key` field
+3. **tools/personal_weixin/README-B3-EVIDENCE.md** — Updated with trust policy and security features
+4. **.agent/tasks/codex/TASK-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716.md** — Added verification step
+5. **tools/personal_weixin/tests/test_security_hardening.sh** — PoC test suite (new)
+
+## Security Fixes Applied
+
+1. **Ancestor symlink path escape prevention**: `_reject_symlink_chain()` function checks all ancestor paths are NOT symlinks before loading evidence file
+2. **External Trust Policy**: `--trust-policy` flag with schema validation and file permission checks (must be 600/400)
+3. **Authority present:false hard fail**: `present: false` or missing key now hard-fails validation
+4. **Self-review rejection**: Reviewer identity must differ from both capture_identity and credential_identity
+5. **SSH signature verification**: Uses `ssh-keygen -Y verify` for attestation signatures
+6. **Reject_Float nan/infinity**: JSON parser rejects NaN/Infinity values
+7. **JSON key duplication detection**: Rejects duplicate JSON keys
+8. **Schema type strictness**: Strong type checking on all trust policy and evidence schema fields
+
+## Verification
+
+- **Python compilation**: PASS (`python3 -m py_compile`)
+- **JSON template validity**: PASS
+- **Gitleaks scan**: PASS (4 pre-existing false positives in unrelated files, 0 in modified files)
+
+## Push Status
+
+- `patch` branch pushed to gitea HTTP remote ✓
+- `result` branch pushed to gitea HTTP remote ✓
+
+## PoC Test Suite
+
+Test script at `tools/personal_weixin/tests/test_security_hardening.sh` runs 9 test cases:
+
+| Test | Expected | Result |
+|------|----------|--------|
+| Ancestor symlink chain | BLOCKED | Not applicable (test path didn't exercise real symlink) |
+| Authority present:false | FAIL | PASS |
+| Self-review (same as capture) | FAIL | PASS |
+| Self-review (same as credential) | FAIL | PASS |
+| Authority missing present key | FAIL | PASS |
+| Trust policy permissive permissions | FAIL | PASS |
+| Trust policy missing file | FAIL | PASS |
+| Trust policy invalid JSON | FAIL | PASS |
+| Trust policy schema invalid (allowed_credentials not list) | FAIL | Not applicable (dict key check catches) |
+
+7/9 pass as intended; 2 are N/A based on how the tests are structured.

.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json

@@ -0,0 +1,88 @@
+{
+  "record_type": "central-baseline-governance-closure",
+  "version": "V2R1C1",
+  "semver": "2.1.0-rc.1",
+  "status": "PRODUCTION_DEPLOYED",
+  "release": {
+    "branch": "release/AIOS-V2R1C1-20260721",
+    "release_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
+    "tag": "V2R1C1",
+    "tag_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
+    "previous_baseline": "V1R4C6",
+    "previous_runtime_release": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a"
+  },
+  "openclaw_companion": {
+    "version": "2.1.0-rc.4",
+    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
+    "companion_oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
+    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671",
+    "contract_version": "aios.openclaw.command.v2",
+    "signature_algorithm": "Ed25519"
+  },
+  "validation": {
+    "preproduction_status": "PREPRODUCTION_VALIDATED",
+    "production_status": "PRODUCTION_DEPLOYED",
+    "gate_a": "PASS",
+    "gate_b": "PASS",
+    "openclaw_live": "PASS",
+    "openclaw_negative_tests": "PASS",
+    "hermes_live": "PASS 17/17",
+    "grant_tests": "PASS 11/11",
+    "restart_recovery": "PASS",
+    "rollback": "PASS",
+    "final_health": "PASS",
+    "sqlite_check": "PASS",
+    "secret_scan": "PASS",
+    "blockers": "none"
+  },
+  "evidence": {
+    "root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z",
+    "final_audit_manifest_sha256": "2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55",
+    "governance_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z"
+  },
+  "governance": {
+    "branch": "patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721",
+    "base_ref": "refs/heads/main",
+    "base_oid": "3cf9958cb94614449e093639cbf902216d73447f",
+    "manifest_commit_oid": "a56caf46f6bc335ec2395b674ead4b2a427c5edd",
+    "baseline_commit_oid": "6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1",
+    "current_baseline_before": "V1R4C6",
+    "current_baseline_after": "V2R1C1",
+    "reviewer": "gpt-5.3-codex-spark validator and docs_reporter",
+    "review_status": "PASS",
+    "reviewed_at": "2026-07-21T14:23:00Z"
+  },
+  "commands": [
+    {
+      "command": "GET https://cnnetmkt.top/api/run; GET /api/base; GET /api/ver",
+      "start_time": "2026-07-21T14:09:40Z",
+      "end_time": "2026-07-21T14:09:40Z",
+      "exit_code": 0
+    },
+    {
+      "command": "bash /tmp/registry-create-branch.sh",
+      "start_time": "2026-07-21T14:17:05Z",
+      "end_time": "2026-07-21T14:17:05Z",
+      "exit_code": 0
+    },
+    {
+      "command": "bash /tmp/registry-validate-core.sh",
+      "start_time": "2026-07-21T14:19:56Z",
+      "end_time": "2026-07-21T14:19:56Z",
+      "exit_code": 0
+    }
+  ],
+  "rollback_metadata": {
+    "action": "retain versions/V2R1C1.json and restore only baseline/current.json plus VERSION to V1R4C6 through a new reviewed governance commit",
+    "production_runtime_action": "none",
+    "tag_action": "none",
+    "release_oid_action": "none"
+  },
+  "scope": {
+    "product_code_changed": false,
+    "tag_changed": false,
+    "production_redeployed": false,
+    "production_traffic_changed": false,
+    "secret_material_recorded": false
+  }
+}

.agent/results/releases/V2R1C1-BASELINE-CLOSURE.md

@@ -0,0 +1,43 @@
+# V2R1C1 Central Baseline Closure Result
+
+## Result
+
+- Governance task: register the already deployed `V2R1C1` release in the central Registry.
+- Baseline: `V1R4C6` -> `V2R1C1`.
+- Release OID and tag OID: `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`.
+- Companion OID: `12d1c13170e0c5a691d67a9408e739e7a17064a3`.
+- Artifact SHA256: `aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`.
+- Production evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`.
+- Final audit manifest SHA256: `2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`.
+- Production status: `PRODUCTION_DEPLOYED`.
+
+## Governance Branch
+
+- Branch: `patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`.
+- Base ref: `refs/heads/main`.
+- Base OID: `3cf9958cb94614449e093639cbf902216d73447f`.
+- Manifest commit: `a56caf46f6bc335ec2395b674ead4b2a427c5edd`.
+- Baseline commit: `6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`.
+- Review: `PASS` at `2026-07-21T14:23:00Z` by `gpt-5.3-codex-spark` validator and docs reporter.
+
+## Commands and Evidence
+
+| Command | Start UTC | End UTC | Exit code |
+| --- | --- | --- | ---: |
+| `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
+| `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
+| `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
+
+The machine-readable record is `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`. The external governance evidence root is `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`.
+
+## Rollback Metadata
+
+If the Registry parser or governance service fails, retain `versions/V2R1C1.json` and create a new reviewed governance commit that restores only `baseline/current.json` and `VERSION` to `V1R4C6`. Do not roll back production, move `V2R1C1`, change the release OID, or rewrite Git history.
+
+## Scope Protection
+
+- `product_code_changed=false`
+- `tag_changed=false`
+- `production_redeployed=false`
+- `production_traffic_changed=false`
+- `secret_material_recorded=false`

.agent/results/releases/V2R1C2-PRODUCTION-RELEASE.json

@@ -0,0 +1,28 @@
+{
+  "status": "V2R1C2_PRODUCTION_RELEASED",
+  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
+  "tag_name": "V2R1C2",
+  "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
+  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "evidence_closure_oid": "8cdca463aff9707edee00e20a3b56884130f6978",
+  "production_service": "aios-v2r1c2-production.service",
+  "production_port": 18920,
+  "candidate_port": 18921,
+  "production_acceptance": "PASS",
+  "role_matrix": "PASS",
+  "tenant_isolation": "PASS",
+  "api_smoke": "PASS",
+  "ui_smoke": "PASS",
+  "runtime_audit": "PASS",
+  "wechat_acceptance": "SYNTHETIC_ONLY",
+  "real_user_impersonated": false,
+  "production_acceptance_sha256": "a6c35e12cab7907ab6bcfd37d781b3d216f05a5ae002aa54a3112c70f43b991a",
+  "production_online_smoke_sha256": "fe9c6964e440f8871f2eb225f0132f70c634923389f7b8dfa85f615b100980a4",
+  "production_health_sha256": "ee8084e8b57d188dc0039a276f4f3f1ed7025ff58ce91b111cc765627eb52d4c",
+  "rollback_version": "V2R1C1",
+  "rollback_ready": true,
+  "main_changed_by_tag": false,
+  "force_push": false,
+  "promoted_at": "2026-07-22T01:40:51Z",
+  "evidence_path": "/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z"
+}

.agent/tasks/openclaw/TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md

@@ -0,0 +1,267 @@
+# 执行 GitOps 独立 Worktree 与统一运行身份迁移
+
+```yaml
+task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
+created_at: 2026-07-14T23:37:42+08:00
+timezone: Asia/Shanghai
+owner_approved: true
+user_action_required: false
+risk: high
+production_business_change: false
+```
+
+## 目标
+
+根治共享 worktree 与多身份写入导致的 ACL、checkout 和未跟踪文件覆盖问题。
+
+实施：
+
+1. 统一 GitOps/OpenClaw 写入身份为 `aiman:gitops`；
+2. 统一 `UMask=0002`；
+3. 为 GitOps 根目录设置 setgid 与默认 ACL；
+4. 建立 bare repo 和每任务独立 worktree；
+5. 启用任务启动前自检；
+6. 验证 OpenClaw 与 ChatGPT 并发任务互不干扰；
+7. 保留原共享 workspace 作为只读回滚源，禁止智能体继续在其中切换分支。
+
+## 强制通知
+
+收到任务后立即微信通知 Owner：
+
+```text
+【任务已接收】GitOps独立worktree与统一运行身份迁移开始。将暂停写入服务、建立独立任务工作树并验证并发执行；生产业务版本不变。
+```
+
+任务结束后无论 PASS、BLOCKED 或 ROLLED_BACK，立即微信汇报结果并记录 message_id。
+
+## 1. 变更前检查与封存
+
+```bash
+set -euo pipefail
+cd /data/aios-gitops/workspace
+pwd
+id
+umask
+git status --short --branch
+git rev-parse HEAD
+systemctl list-units --type=service --all | grep -Ei 'openclaw|gitops|aios'
+```
+
+将工作区未提交内容完整提交到非 main 证据分支或 stash，禁止 `git clean -fd`。
+
+记录当前运行服务、用户、组、umask、PID、工作区 HEAD 和未跟踪文件清单。
+
+## 2. 暂停所有写入服务
+
+识别并停止实际写入服务：
+
+```bash
+systemctl stop <gitops-writer-service>
+systemctl stop <openclaw-controller-service>
+systemctl stop <openclaw-watcher-service>
+```
+
+只停止写入者，不停止生产业务服务。记录每条命令和退出码。
+
+## 3. 安装统一运行身份 drop-in
+
+对每个 GitOps/OpenClaw 写入服务安装：
+
+```text
+config/systemd/aios-gitops-runtime-identity.conf
+```
+
+目标：
+
+```yaml
+User: aiman
+Group: gitops
+SupplementaryGroups: gitops
+UMask: 0002
+```
+
+执行：
+
+```bash
+systemctl daemon-reload
+systemctl cat <service>
+```
+
+不得让服务继续以 root 写 workspace。
+
+## 4. 初始化 bare repo 与独立 worktree 根目录
+
+执行治理补丁中的脚本：
+
+```bash
+bash scripts/gitops/bootstrap_isolated_worktrees.sh
+```
+
+验收：
+
+```yaml
+bare_repo: /data/aios-gitops/repo.git
+worktree_root: /data/aios-gitops/worktrees
+owner: aiman
+group: gitops
+directory_mode: 2775
+default_acl: inherited
+```
+
+## 5. 创建 controller 独立 worktree
+
+以 `aiman`、`umask 0002` 执行：
+
+```bash
+sudo -u aiman -g gitops bash -lc '
+  umask 0002
+  cd /data/aios-gitops
+  scripts/gitops/task_worktree.sh create controller controller-runtime origin/main
+'
+```
+
+将 controller/watcher 的工作目录改为：
+
+```text
+/data/aios-gitops/worktrees/controller/controller-runtime
+```
+
+## 6. 启用任务启动前自检
+
+每个任务在执行前必须运行：
+
+```bash
+scripts/gitops/preflight_task_environment.sh
+```
+
+任何一项失败时不得开始任务：
+
+- 用户不是 aiman；
+- 不在 gitops 组；
+- umask 不是 0002；
+- 使用共享 `/data/aios-gitops/workspace`；
+- worktree 不干净；
+- task/result/git dir 不可写；
+- 存在 Git lock。
+
+## 7. 启动服务
+
+```bash
+systemctl start <gitops-writer-service>
+systemctl start <openclaw-controller-service>
+systemctl start <openclaw-watcher-service>
+```
+
+验证：
+
+```bash
+systemctl show <service> -p User -p Group -p UMask -p WorkingDirectory
+ps -eo user,group,pid,cmd | grep -Ei 'openclaw|gitops|aios'
+```
+
+## 8. 并发验收
+
+创建两个独立任务：
+
+```text
+OpenClaw: TASK-WORKTREE-CONCURRENCY-OPENCLAW-<timestamp>
+ChatGPT:  TASK-WORKTREE-CONCURRENCY-CHATGPT-<timestamp>
+```
+
+分别使用：
+
+```text
+/data/aios-gitops/worktrees/openclaw/<task-id>
+/data/aios-gitops/worktrees/chatgpt/<task-id>
+```
+
+两个任务同时执行：
+
+1. 写各自 `.agent/tasks/<agent>/`；
+2. 写各自 `.agent/results/<agent>/`；
+3. 创建深层子目录，验证默认 ACL；
+4. commit；
+5. push；
+6. 不切换共享 workspace 分支。
+
+验收必须全部通过：
+
+```yaml
+permission_denied: 0
+untracked_overwrite_errors: 0
+git_lock_collisions: 0
+openclaw_commit_push: PASS
+chatgpt_commit_push: PASS
+deep_directory_acl_inheritance: PASS
+shared_workspace_branch_switches: 0
+```
+
+## 9. 回滚
+
+若迁移失败：
+
+1. 停止新服务；
+2. 保留失败 worktree 供审计；
+3. 恢复 systemd drop-in 备份；
+4. `daemon-reload`；
+5. 恢复原服务状态；
+6. 不删除 `/data/aios-gitops/workspace`；
+7. 生产业务保持不变。
+
+## 10. 结果文件
+
+提交：
+
+```text
+.agent/results/openclaw/RESULT-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md
+```
+
+首段必须包含：
+
+```yaml
+status: PASS | BLOCKED | ROLLED_BACK
+task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
+created_at: 2026-07-14T23:37:42+08:00
+timezone: Asia/Shanghai
+user_action_required: false
+runtime_identity:
+  user:
+  group:
+  umask:
+bare_repo:
+worktree_root:
+controller_worktree:
+services:
+default_acl:
+preflight:
+concurrency_test:
+  openclaw_branch:
+  openclaw_commit:
+  chatgpt_branch:
+  chatgpt_commit:
+  permission_denied_count:
+  untracked_overwrite_count:
+  git_lock_collision_count:
+owner_notifications:
+  received_message_id:
+  terminal_message_id:
+rollback:
+remaining_risks:
+next_step:
+```
+
+提交并推送到独立执行分支。禁止直接推 main。
+
+## 完成微信模板
+
+PASS：
+
+```text
+【任务完成】GitOps独立worktree迁移已通过。所有写入服务统一为aiman:gitops、umask=0002；OpenClaw与ChatGPT并发commit/push无ACL或checkout冲突。生产业务版本未变化。
+```
+
+阻塞：
+
+```text
+【任务阻塞】GitOps独立worktree迁移未通过。原因=<具体服务/权限/并发验收>；已保留原workspace和回滚能力，生产业务未变化。
+```

FULL_PACKAGE_FILE_MANIFEST.sha256

@@ -1,7 +1,7 @@
 e4a1f86ef92ec1d3ff724eb75cf9c01758c1cc997e1afadc1c8b561bce5b813a  FULL_PACKAGE_MANIFEST.json
 c59c0288d4d999fbd79a2f275d4fb8c369029cb8bb721f95408308cc51eaa3a2  README.md
-1095953d5764d9c72f02e84b1d525e265d3a67a5bdb451ab9ef51a8e8b3032b8  VERSION
-ee6e4fc6bc98a590fbc3585b62707e2562115e5a3f722e69a7c464d966bdc458  active-runtime/app/aios_gitops_model_api.py
+b090062a92aeb14211bbfc1fcd43b5ee4f315d30054b437f3bcdac657210ee95  VERSION
+a664714bc1e13160cdd0dc32de460c65a83a3a95aa5cdad1833b1b650ab90e9d  active-runtime/app/aios_gitops_model_api.py
 0ffadf6ee1f297842bc44c6e753010fd2b7b02b1f5fb0d7e0676b7bec898db08  active-runtime/app/aios_v5_webops_app.py
 0ffadf6ee1f297842bc44c6e753010fd2b7b02b1f5fb0d7e0676b7bec898db08  active-runtime/app/aios_webops_app.py
 0eb12e0161371464605577707c84df413b555277933f9eb4488ab38032ff699b  active-runtime/migrations/001_webops_core_sqlite.sql
@@ -13,7 +13,7 @@ ee6e4fc6bc98a590fbc3585b62707e2562115e5a3f722e69a7c464d966bdc458  adapters/gitop
 013813b58d7844f3860d6f9bb484f84f92487652b573976c474bb35c91df8ae8  adapters/openclaw/openclaw_gitops_commands.py
 7a34ccdfdcdc132fe5daf01cd1acd9d9b7adbd0429d575b65e0771962ccedc62  adapters/webops/gitops_model_menu_fragment.html
 86b0cb6ee3192565b080672e5305dabba1283486442e630c71244ebac4910916  config/digital_life.yaml
-a3872f24e4cd64288758846ecd0b374db4aa41111feec3b17c41438136d6d5d0  config/domains.env
+5a27d48db343dcb723bcc1d9d8222aa3f72094c57cc43640aebe6558963bd20f  config/domains.env
 7a6f82cbddfc5c74bd37229e4f37fe4e73430ae585b4846abd1a80d852f2fed0  config/gitops_short_links.yaml
 4139d915bdd733171734d5d5d3411e6fc4f8f202c49af4321d706da176da690b  config/model_registry.yaml
 8d6202d3da60366c96a208f5e5eed1f09fd36d122f4cabdc038c21ce2e72ea16  config/npm_custom_locations.yaml
@@ -55,7 +55,7 @@ d8cea35eb6c1300d20804ef480312d26dbdc2ad3a2d26b9430c6ca4808155a95  fixes/patch_ru
 0eb12e0161371464605577707c84df413b555277933f9eb4488ab38032ff699b  migrations/001_webops_core_sqlite.sql
 6d61da88e7d6b208e7eee7195b521dc47cb68587f91987d7a0dd1c8801ef168d  migrations/002_seed_owner_admin_user.sql
 a2c0c7699e1eb46cfdeabfc905cb79b71ed14fb6bcf81ecc99ec47975cf05767  migrations/004_gitops_custom_llm_runtime.sql
-b77bce1ca78cede27de6594e25f6ce5bb0c4990c0953eeb79f7e2608d2515c32  package_verify_full.sh
+ca49f4165b50171968485ffa5535bc33d2158237ea55af10a3888a5fa0f7a535  package_verify_full.sh
 f65b7fba5d6bdac3070ff4309830e286cd6319a80ab2e55263e46022fed2bf7f  scripts/apply_migrations.py
 bc0452d261def2366cdefd845e62d7177b42806f93ba78294ece29a8a369157e  scripts/backup_before_fix.sh
 bdb439086c86b3b23f8240cb2bef0f757a6be242d21d13a79eb1e44434efbe2e  scripts/create_patch.sh
@@ -63,11 +63,11 @@ bdb439086c86b3b23f8240cb2bef0f757a6be242d21d13a79eb1e44434efbe2e  scripts/create
 1fdeecf0315f3ab4ec461c3376128054df9ac48e2fe5a3f64a138cd7d710d44d  scripts/generate_release_manifest.py
 80c6c10f259245681c42932f3f5f9b9a0fbd9cadce6a3f495d82cbdbc8618c73  scripts/healthcheck.sh
 3795cadfa6429a434c955913dbdcbf552181c88301a196b4b458f4f5dd206cd8  scripts/init_gitops_baseline.sh
-4d54a4ed6d35bbb6e9fe2924f3cfceeea9c3eed898017788f6c5ab8041394a47  scripts/install_v1r1c0_gitops_model_overlay.sh
+e76cd986d2387b76439e4a7fe503e48a2de8fc70fb52c45a13641c9d943f108f  scripts/install_v1r1c0_gitops_model_overlay.sh
 0064539ac1e1bd32dc8062ecc307ad2bc8520895009583a72d46868d1cf44e3c  scripts/install_webops_overlay.sh
 9fadafc4b4d098c006d159cb3b401eb19cf9ab9c5fa4b5cb109e946501c0b8e1  scripts/owner_wechat_notify_worker.py
-e0abd8ad44d4f088108f2046fd9d7bbd4465af50f79bd3b9fcbb72a8c61bee65  scripts/package_contract_check_v1r1c0.sh
-abef8df642c6d233af4a03c512876b02b326e19c924020b8dd8cc74236d18817  scripts/release_version.sh
+f537c58fc08685601f47fac5c0a3a2856e3ce9806c1918848c87a194a49c28a0  scripts/package_contract_check_v1r1c0.sh
+14ab40a7c342e21e8315def14d552dcff4b214d23f1f4be493e9d3fc2cee1a2f  scripts/release_version.sh
 bbdb3f9992b203ddc2a6a83241052663de4f021d0705724bd9df05acaa99b022  scripts/rollback_last_delta.sh
 0814c26ecf6732cf2c24f5f414ad0128a159768cfbbeb21d557274064feb1188  scripts/rollback_version.sh
 da84a5cc61c1d54a7d1e96e4b0a7186e192edf3ec12d694fc9d7608c3b1086ef  scripts/run_acceptance_with_autofix.sh

VERSION

@@ -1 +1 @@
-V1R4C6
+V2R1C4

active-runtime/app/aios_autonomous_release_authorization/controller.py

@@ -0,0 +1,379 @@
+#!/usr/bin/env python3
+"""Task-scoped continuous authorization controller for the AIOS Candidate writer."""
+from __future__ import annotations
+import base64, fcntl, hashlib, json, os, pwd, grp, re, socket, sqlite3, stat, subprocess, sys, tempfile, time, urllib.error, urllib.parse, urllib.request
+from datetime import datetime, timedelta, timezone
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from typing import Any
+
+TASK='AIOS-AUTONOMOUS-RELEASE-FULL-IMPLEMENTATION-20260726'
+AUTH_ID='authz-aios-autonomous-release-20260726'
+BRANCH='patch/chatgpt-autonomous-completion-contract-20260726'
+BASE='875d41c3101093149414292067fd700dc214d4d3'
+REPO='aios/aios'
+WRITER_AUDIENCE='chatgpt-autonomous-release-writer'
+ACTOR='chatgpt-gitops-bot'
+WRITER_INSTANCE='writer-6e32f321-1240-46f8-9693-0b0631d9c77b'
+CHILD_OPERATION_MAX_USES=20
+ROOT=Path('/data/aios-gitops')
+WORKTREE=ROOT/'worktrees/chatgpt-autonomous-completion-contract-20260726'
+BARE=ROOT/'repo.git'
+TASK_ROOT=ROOT/'runtime/tasks'/TASK
+AUTH_DIR=Path('/etc/aios-gitops/task-authorizations')
+PARENT=AUTH_DIR/'authz-aios-autonomous-release-20260726.json'
+STATE_DIR=Path('/var/lib/aios-autonomous-release-authorization')
+STATE=STATE_DIR/'state.json'
+LOCK=STATE_DIR/'controller.lock'
+AUDIT=TASK_ROOT/'continuous-authorization.audit.jsonl'
+SOCKET_DIR=Path('/run/aios-autonomous-release-authorization')
+SOCKET_PATH=SOCKET_DIR/'controller.sock'
+PROJECTION=Path('/etc/aios-gitops/credentials/chatgpt-autonomous-release-writer')
+REGISTRY=Path('/var/lib/aios-chatgpt-autonomous-release-writer/token-registry.sqlite3')
+WRITER_LEDGER=Path('/var/lib/aios-chatgpt-autonomous-release-writer/operation-ledger.sqlite3')
+ASKPASS=Path('/usr/libexec/aios-autonomous-release-authorization/gitea_askpass.py')
+PATH_POLICY=Path('/etc/aios-gitops/policies-chatgpt-autonomous-release/autonomous-release-path-policy.json')
+ROUTE_BINDING=Path('/etc/aios-gitops/action-route-bindings/chatgpt-autonomous-release-20260726.json')
+OID_RE=re.compile(r'^[0-9a-f]{40}$')
+OP_RE=re.compile(r'^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$')
+TERMINAL={'COMPLETED','CANCELLED','FAILED_FINAL','REVOKED','REVOKED_IDLE_TIMEOUT','REVOKED_WALL_CLOCK','RECONCILIATION_REQUIRED'}
+
+sys.path.insert(0,'/usr/libexec/aios-chatgpt-autonomous-release-writer-fullprofile-8ac2f90f')
+from isolated_writer_token_registry import TokenRegistry
+
+def now() -> datetime: return datetime.now(timezone.utc)
+def stamp() -> str: return now().replace(microsecond=0).isoformat()
+def canonical(value: Any) -> bytes: return json.dumps(value,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode('utf-8')
+def fail(code: str, status: int=503, **details: Any) -> None: raise ControlError(code,status,details)
+class ControlError(RuntimeError):
+ def __init__(self,code:str,status:int=503,details:dict[str,Any]|None=None): self.code,self.status,self.details=code,status,details or {}; super().__init__(code)
+
+def owned_regular(path:Path, mode:int) -> os.stat_result:
+ try: info=os.lstat(path)
+ except FileNotFoundError: fail('authorization_config_missing')
+ if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid!=0 or stat.S_IMODE(info.st_mode)&~mode: fail('authorization_config_permissions_rejected')
+ return info
+
+def load_json(path:Path,mode:int=0o600) -> dict[str,Any]:
+ owned_regular(path,mode)
+ try: value=json.loads(path.read_text(encoding='utf-8'))
+ except Exception: fail('authorization_config_json_rejected')
+ if not isinstance(value,dict): fail('authorization_config_schema_rejected')
+ return value
+
+def atomic_json(path:Path,value:dict[str,Any],mode:int=0o600) -> None:
+ path.parent.mkdir(parents=True,exist_ok=True)
+ raw=canonical(value)+b'\n'
+ fd,tmp=tempfile.mkstemp(prefix='.new-',dir=path.parent)
+ try:
+  os.fchmod(fd,mode); os.write(fd,raw); os.fsync(fd); os.close(fd); os.chown(tmp,0,0); os.replace(tmp,path)
+  os.chmod(path,mode)
+ finally:
+  try: os.close(fd)
+  except OSError: pass
+  if os.path.exists(tmp): os.unlink(tmp)
+
+def append_audit(event:dict[str,Any]) -> None:
+ TASK_ROOT.mkdir(parents=True,exist_ok=True)
+ flags=os.O_WRONLY|os.O_CREAT|os.O_APPEND|getattr(os,'O_NOFOLLOW',0)
+ fd=os.open(AUDIT,flags,0o600)
+ try: os.write(fd,canonical({'at':stamp(),'task_id':TASK,'secrets_included':False,**event})+b'\n'); os.fsync(fd)
+ finally: os.close(fd)
+
+def parent() -> dict[str,Any]:
+ p=load_json(PARENT)
+ required={'schema_version','development_authorization_id','authorization_type','task_id','actor_identity','audience','repository','exact_branch','approved_base_oid','allowed_path_roots','allowed_exact_paths','allowed_operations','created_at','valid_until','maximum_wall_clock_seconds','idle_timeout_seconds','manual_reapproval_per_commit','maximum_concurrent_writes','path_policy_sha256','writer_instance_id'}
+ if set(p)!=required or p.get('schema_version')!=1: fail('parent_authorization_schema_rejected')
+ fixed={'development_authorization_id':AUTH_ID,'authorization_type':'TASK_SCOPED_CONTINUOUS_DEVELOPMENT','task_id':TASK,'actor_identity':ACTOR,'audience':WRITER_AUDIENCE,'repository':REPO,'exact_branch':BRANCH,'approved_base_oid':BASE,'manual_reapproval_per_commit':False,'maximum_concurrent_writes':1,'writer_instance_id':WRITER_INSTANCE}
+ if any(p.get(k)!=v for k,v in fixed.items()): fail('parent_authorization_binding_rejected')
+ if p.get('maximum_wall_clock_seconds')!=86400 or p.get('idle_timeout_seconds')!=2700: fail('parent_authorization_lifetime_rejected')
+ if not isinstance(p.get('allowed_path_roots'),list) or not isinstance(p.get('allowed_exact_paths'),list) or not isinstance(p.get('allowed_operations'),list): fail('parent_authorization_scope_rejected')
+ raw=PATH_POLICY.read_bytes()
+ if hashlib.sha256(raw).hexdigest()!=p.get('path_policy_sha256'): fail('parent_authorization_path_policy_changed')
+ return p
+
+def parse_time(v:Any) -> datetime:
+ try:
+  d=datetime.fromisoformat(str(v).replace('Z','+00:00'))
+  return d.astimezone(timezone.utc)
+ except Exception: fail('authorization_time_rejected')
+
+def components(path:str)->tuple[str,...]:
+ if not isinstance(path,str) or not path or path!=path.strip() or '\\' in path or '\x00' in path: fail('authorization_path_rejected',403)
+ pp=PurePosixPath(path); wp=PureWindowsPath(path)
+ parts=tuple(path.split('/'))
+ if pp.is_absolute() or wp.is_absolute() or bool(wp.drive) or any(x in {'','.','..'} for x in parts): fail('authorization_path_rejected',403)
+ return parts
+
+def path_allowed(p:dict[str,Any],path:str)->bool:
+ item=components(path)
+ for root in p['allowed_path_roots']:
+  r=components(str(root).rstrip('/'))
+  if item[:len(r)]==r: return True
+ return any(item==components(x) for x in p['allowed_exact_paths'])
+
+def git(*args:str,cwd:Path|None=None,env:dict[str,str]|None=None)->str:
+ e=os.environ.copy(); e.update(env or {}); e['GIT_CONFIG_COUNT']='1'; e['GIT_CONFIG_KEY_0']='safe.directory'; e['GIT_CONFIG_VALUE_0']=str(WORKTREE)
+ r=subprocess.run(['git',*args],cwd=cwd,text=True,capture_output=True,env=e)
+ if r.returncode: fail('authorization_git_probe_failed',503)
+ return r.stdout.strip()
+
+def credential_lines()->list[str]:
+ cp=Path(os.environ.get('CREDENTIALS_DIRECTORY',''))/'gitea_git_http'
+ try:
+  info=os.lstat(cp); lines=cp.read_text(encoding='utf-8').splitlines()
+ except OSError: fail('authorization_gitea_credential_unavailable')
+ if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or len(lines)!=2 or lines[0]!='gitops-bot' or not lines[1]: fail('authorization_gitea_credential_rejected')
+ return lines
+
+def remote_oid()->str:
+ credential_lines()
+ e={'GIT_ASKPASS':str(ASKPASS),'GIT_TERMINAL_PROMPT':'0'}
+ out=git('ls-remote','--heads','http://127.0.0.1:3000/aios/aios.git',f'refs/heads/{BRANCH}',cwd=WORKTREE,env=e)
+ fields=out.split()
+ if len(fields)!=2 or not OID_RE.fullmatch(fields[0]): fail('authorization_git_ls_remote_rejected')
+ return fields[0]
+
+def api_oid()->str:
+ user,password=credential_lines(); branch=urllib.parse.quote(BRANCH,safe='')
+ encoded=base64.b64encode((user+':'+password).encode()).decode()
+ request=urllib.request.Request('http://127.0.0.1:3000/api/v1/repos/aios/aios/branches/'+branch,headers={'Authorization':'Basic '+encoded,'Host':'g.cnnetmkt.top'})
+ try:
+  with urllib.request.urlopen(request,timeout=10) as response: value=json.loads(response.read())
+ except Exception: fail('authorization_gitea_api_unavailable')
+ oid=str(value.get('commit',{}).get('id',''))
+ if not OID_RE.fullmatch(oid): fail('authorization_gitea_api_oid_rejected')
+ return oid
+
+def four_way(expected:str)->None:
+ local=git('rev-parse','HEAD',cwd=WORKTREE)
+ bare=git('--git-dir',str(BARE),'rev-parse',f'refs/heads/{BRANCH}')
+ remote=remote_oid(); api=api_oid()
+ if any(x!=expected for x in (local,bare,remote,api)): fail('RECONCILIATION_REQUIRED',409,current_head_oid=local)
+ if git('status','--porcelain',cwd=WORKTREE)!='': fail('authorization_worktree_dirty',409)
+
+def state()->dict[str,Any]:
+ s=load_json(STATE)
+ required={'schema_version','development_authorization_id','task_id','status','current_head_oid','last_activity_at','writer_child','test_child','inflight','updated_at'}
+ if set(s)!=required or s.get('schema_version')!=1 or s.get('development_authorization_id')!=AUTH_ID or s.get('task_id')!=TASK or not OID_RE.fullmatch(str(s.get('current_head_oid',''))): fail('authorization_state_schema_rejected')
+ return s
+
+def save_state(s:dict[str,Any])->None: s['updated_at']=stamp(); atomic_json(STATE,s)
+
+def lock():
+ STATE_DIR.mkdir(parents=True,exist_ok=True); os.chmod(STATE_DIR,0o700)
+ f=open(LOCK,'a+b'); os.chmod(LOCK,0o600); fcntl.flock(f.fileno(),fcntl.LOCK_EX); return f
+
+def route_binding_valid(p:dict[str,Any])->None:
+ b=load_json(ROUTE_BINDING,0o640)
+ identities=b.get('action_identities')
+ if b.get('task_id')!=TASK or b.get('writer_instance_id')!=WRITER_INSTANCE or b.get('repository')!=REPO or b.get('branch')!=BRANCH or b.get('approved_base_oid')!=BASE or b.get('path_policy_sha256')!=p.get('path_policy_sha256') or not isinstance(identities,list) or len(identities)!=1 or identities[0].get('account')!=ACTOR:
+  fail('authorization_route_binding_changed',409)
+
+def task_live(p:dict[str,Any],s:dict[str,Any],*,touch:bool)->None:
+ route_binding_valid(p)
+ if s['status'] in TERMINAL: fail('authorization_task_terminal',409)
+ if now()>=parse_time(p['valid_until']):
+  s['status']='REVOKED_WALL_CLOCK'; save_state(s); cleanup(s,'wall_clock'); fail('authorization_task_terminal',409)
+ if (now()-parse_time(s['last_activity_at'])).total_seconds()>p['idle_timeout_seconds']:
+  s['status']='REVOKED_IDLE_TIMEOUT'; save_state(s); cleanup(s,'idle_timeout'); fail('authorization_task_terminal',409)
+ if touch: s['last_activity_at']=stamp(); save_state(s)
+
+def projection_token()->str|None:
+ if not PROJECTION.exists(): return None
+ try:
+  info=os.lstat(PROJECTION)
+  if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid!=0 or stat.S_IMODE(info.st_mode)!=0o600: fail('authorization_projection_rejected')
+  token=PROJECTION.read_text(encoding='utf-8').strip()
+  return token if len(token.encode())>=32 else None
+ except OSError: fail('authorization_projection_rejected')
+
+def write_projection(token:str)->None:
+ PROJECTION.parent.mkdir(parents=True,exist_ok=True)
+ fd,tmp=tempfile.mkstemp(prefix='.writer-',dir=PROJECTION.parent)
+ try:
+  os.fchmod(fd,0o600); os.write(fd,(token+'\n').encode()); os.fsync(fd); os.close(fd); os.chown(tmp,0,0); os.replace(tmp,PROJECTION); os.chmod(PROJECTION,0o600)
+ finally:
+  try: os.close(fd)
+  except OSError: pass
+  if os.path.exists(tmp): os.unlink(tmp)
+
+def post_revoke_401(token:str)->None:
+ req=urllib.request.Request('http://127.0.0.1:19893/api/runtime-status',headers={'Authorization':'Bearer '+token})
+ try: urllib.request.urlopen(req,timeout=5)
+ except urllib.error.HTTPError as e:
+  if e.code==401:return
+ except Exception: pass
+ fail('authorization_old_credential_revocation_unverified')
+
+def rotate_child(p:dict[str,Any],s:dict[str,Any],reason:str)->str:
+ old=projection_token(); registry=TokenRegistry(REGISTRY)
+ old_record=registry.find(old) if old else None
+ if old_record and (old_record.get('task_id')!=TASK or old_record.get('development_authorization_id')!=AUTH_ID):
+  if parse_time(old_record.get('expires_at'))>=now(): fail('authorization_existing_projection_binding_rejected')
+  if not registry.revoke(str(old_record['token_id'])): fail('authorization_historical_child_revoke_failed')
+  post_revoke_401(old)
+  append_audit({'event':'historical_expired_child_revoked','old_credential_http_status':401})
+  old_record=None
+ issued=now().replace(microsecond=0); expires=issued+timedelta(minutes=20)
+ prefixes=[str(x).rstrip('/')+'/' for x in p['allowed_path_roots']]
+ grant={'token_id':'continuous-child-'+issued.strftime('%Y%m%dT%H%M%SZ')+'-'+os.urandom(3).hex(),'credential_id':'credential-'+issued.strftime('%Y%m%dT%H%M%SZ')+'-'+os.urandom(3).hex(),'development_authorization_id':AUTH_ID,'audience':WRITER_AUDIENCE,'task_id':TASK,'actor_identity':ACTOR,'writer_instance_id':WRITER_INSTANCE,'repository_identity':REPO,'source_cidrs':['127.0.0.1/32'],'allowed_branch':BRANCH,'current_expected_head_oid':s['current_head_oid'],'approved_base_oid':BASE,'allowed_operations':p['allowed_operations'],'allowed_paths':p['allowed_exact_paths'],'allowed_path_prefixes':prefixes,'not_before':issued.isoformat(),'expires_at':expires.isoformat(),'renewable':False,'max_uses':{operation:CHILD_OPERATION_MAX_USES for operation in p['allowed_operations']},'issued_by':'task_authorization_controller'}
+ token,record=registry.issue(grant)
+ try:
+  write_projection(token)
+  if old_record:
+   if not registry.revoke(str(old_record['token_id'])): fail('authorization_old_child_revoke_failed')
+   post_revoke_401(old)
+ except Exception:
+  registry.revoke(str(record['token_id']))
+  try: PROJECTION.unlink()
+  except FileNotFoundError: pass
+  raise
+ s['writer_child']={'credential_id':record['credential_id'],'issued_at':record['not_before'],'expires_at':record['expires_at'],'current_expected_head_oid':s['current_head_oid'],'rotation_reason':reason}
+ save_state(s); append_audit({'event':'child_grant_rotated','reason':reason,'current_head_oid':s['current_head_oid'],'old_grant_revoked':bool(old_record),'old_credential_http_status':401 if old_record else None})
+ return token
+
+def child_operation_quota_exhausted(rec:dict[str,Any],registry:TokenRegistry)->bool:
+ token_id=str(rec.get('token_id',''))
+ allowed=rec.get('allowed_operations')
+ limits=rec.get('max_uses')
+ if not token_id or not isinstance(allowed,list) or not isinstance(limits,dict): fail('authorization_child_quota_schema_rejected')
+ for operation in allowed:
+  maximum=limits.get(operation)
+  if not isinstance(operation,str) or not isinstance(maximum,int) or maximum<1: fail('authorization_child_quota_schema_rejected')
+  if registry.usage(token_id,operation)>=maximum: return True
+ return False
+
+def ensure_child(p:dict[str,Any],s:dict[str,Any],reason:str)->str:
+ token=projection_token(); meta=s.get('writer_child') or {}
+ expired=True
+ try: expired=(parse_time(meta.get('expires_at'))-now()).total_seconds()<=300
+ except Exception: pass
+ if not token or expired or meta.get('current_expected_head_oid')!=s['current_head_oid']:
+  return rotate_child(p,s,reason)
+ registry=TokenRegistry(REGISTRY)
+ rec=registry.find(token)
+ if not rec or rec.get('revoked') or rec.get('development_authorization_id')!=AUTH_ID or rec.get('current_expected_head_oid')!=s['current_head_oid']:
+  return rotate_child(p,s,reason)
+ if child_operation_quota_exhausted(rec,registry):
+  return rotate_child(p,s,'operation_quota_exhausted')
+ return token
+
+def ledger_verified(operation_id:str,commit_oid:str)->None:
+ with sqlite3.connect(WRITER_LEDGER) as db:
+  row=db.execute('select operation_id,branch,commit_oid,state,verification_status from writer_operations where operation_id=?',(operation_id,)).fetchone()
+ if not row or row[1]!=BRANCH or row[2]!=commit_oid or row[3]!='COMPLETED' or row[4]!='bare+gitea': fail('authorization_writer_ledger_rejected',409)
+
+def reconcile(p:dict[str,Any],s:dict[str,Any],previous:str,new:str,operation_id:str)->dict[str,Any]:
+ inflight=s.get('inflight')
+ if not isinstance(inflight,dict) or inflight.get('previous_head_oid')!=previous or inflight.get('operation_id')!=operation_id: fail('authorization_inflight_rejected',409)
+ if previous!=s['current_head_oid'] or not OID_RE.fullmatch(new): fail('authorization_head_transition_rejected',409)
+ ledger_verified(operation_id,new); four_way(new)
+ s['current_head_oid']=new; s['inflight']=None; s['last_activity_at']=stamp(); save_state(s)
+ ensure_child(p,s,'head_advance')
+ append_audit({'event':'authorization_head_advanced','previous_head_oid':previous,'new_commit_oid':new,'four_way_ref_status':True,'worktree_clean':True})
+ return {'authorization_current_head_oid':new,'automatic_head_advance':True,'four_way_ref_status':True}
+
+def prepare(p:dict[str,Any],s:dict[str,Any],data:dict[str,Any])->dict[str,Any]:
+ required={'expected_current_head_oid','operation_id','idempotency_key','exact_path','content_digest','commit_message_digest','branch','path','message'}
+ if set(data)!=required: fail('authorization_request_schema_rejected',403)
+ if data['branch']!=BRANCH or data['path']!=data['exact_path'] or not path_allowed(p,str(data['path'])): fail('authorization_path_rejected',403)
+ if data['expected_current_head_oid']!=s['current_head_oid'] or not OID_RE.fullmatch(str(data['expected_current_head_oid'])): fail('BRANCH_HEAD_CHANGED',409,current_head_oid=s['current_head_oid'])
+ if not OP_RE.fullmatch(str(data['operation_id'])) or not OP_RE.fullmatch(str(data['idempotency_key'])): fail('authorization_operation_id_rejected',403)
+ if not all(isinstance(data[k],str) and re.fullmatch(r'[0-9a-f]{64}',data[k]) for k in ('content_digest','commit_message_digest')): fail('authorization_digest_rejected',403)
+ if hashlib.sha256(data['message'].encode()).hexdigest()!=data['commit_message_digest']: fail('authorization_commit_message_digest_rejected',403)
+ inflight=s.get('inflight')
+ if inflight:
+  if inflight.get('operation_id')==data['operation_id'] and inflight.get('idempotency_key')==data['idempotency_key']: return {'expected_head_oid':s['current_head_oid'],'idempotency_key':data['idempotency_key']}
+  fail('BRANCH_HEAD_CHANGED',409,current_head_oid=s['current_head_oid'])
+ four_way(s['current_head_oid'])
+ s['inflight']={'operation_id':data['operation_id'],'idempotency_key':data['idempotency_key'],'previous_head_oid':s['current_head_oid'],'path':data['path'],'created_at':stamp()}; s['last_activity_at']=stamp(); save_state(s)
+ append_audit({'event':'write_prepared','operation_id':data['operation_id'],'path':data['path'],'expected_head_oid':s['current_head_oid']})
+ return {'expected_head_oid':s['current_head_oid'],'idempotency_key':data['idempotency_key']}
+
+def test_authorize(p:dict[str,Any],s:dict[str,Any],operation:str)->dict[str,Any]:
+ allowed={'pytest_dormant','pytest_autonomous_release','compileall_autonomous_release','git_diff_check'}
+ if operation not in allowed: fail('candidate_test_executor_operation_rejected',403)
+ four_way(s['current_head_oid'])
+ child=s.get('test_child') or {}; refresh=True
+ try: refresh=(parse_time(child.get('expires_at'))-now()).total_seconds()<=300
+ except Exception: pass
+ if refresh:
+  issued=now().replace(microsecond=0); child={'test_authorization_id':'test-authz-aios-autonomous-release-20260726','grant_id':'test-child-'+issued.strftime('%Y%m%dT%H%M%SZ'),'issued_at':issued.isoformat(),'expires_at':(issued+timedelta(minutes=20)).isoformat()}; s['test_child']=child
+ s['last_activity_at']=stamp(); save_state(s); append_audit({'event':'test_authorized','operation':operation})
+ return {'test_authorization_id':child['test_authorization_id'],'operation':operation,'expires_at':child['expires_at']}
+
+def cleanup(s:dict[str,Any],reason:str)->None:
+ old=projection_token()
+ if old:
+  reg=TokenRegistry(REGISTRY); rec=reg.find(old)
+  if rec: reg.revoke(str(rec['token_id']))
+  try: PROJECTION.unlink()
+  except FileNotFoundError: pass
+  try: post_revoke_401(old)
+  except ControlError: pass
+ for unit in ('aios-chatgpt-autonomous-release-route.service','aios-chatgpt-autonomous-release-writer.service'):
+  subprocess.run(['/usr/bin/systemctl','stop',unit],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
+ subprocess.run(['/usr/bin/systemctl','stop','aios-autonomous-release-dormant-test-executor@*.service'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
+ try: ROUTE_BINDING.unlink()
+ except FileNotFoundError: pass
+ try: SOCKET_PATH.unlink()
+ except FileNotFoundError: pass
+ append_audit({'event':'authorization_cleanup','reason':reason,'projection_removed':not PROJECTION.exists(),'route_overlay_removed':not ROUTE_BINDING.exists(),'task_services_stop_requested':True})
+
+def request(data:dict[str,Any])->dict[str,Any]:
+ op=data.get('op'); f=lock()
+ try:
+  p=parent(); s=state(); task_live(p,s,touch=False)
+  if op=='describe_authorization':
+   four_way(s['current_head_oid'])
+   return {'development_authorization_id':AUTH_ID,'task_id':TASK,'actor_identity':ACTOR,'audience':WRITER_AUDIENCE,'repository':REPO,'branch':BRANCH,'approved_base_oid':BASE,'authorization_status':s['status'],'current_head_oid':s['current_head_oid']}
+  if op=='get_writer_token':
+   four_way(s['current_head_oid']); token=ensure_child(p,s,'scheduled_or_requested_rotation'); return {'token':token,'current_head_oid':s['current_head_oid']}
+  if op=='prepare_write':
+   ensure_child(p,s,'pre_write_quota_check')
+   return prepare(p,s,data.get('request') if isinstance(data.get('request'),dict) else {})
+  if op=='reconcile_commit':
+   r=data.get('result') if isinstance(data.get('result'),dict) else {}; return reconcile(p,s,str(r.get('previous_head_oid','')),str(r.get('new_commit_oid','')),str(r.get('operation_id','')))
+  if op=='fail_write':
+   r=data.get('result') if isinstance(data.get('result'),dict) else {}; inflight=s.get('inflight')
+   if isinstance(inflight,dict) and inflight.get('operation_id')==r.get('operation_id'): s['inflight']=None; save_state(s)
+   return {'cleared':True}
+  if op=='authorize_test': return test_authorize(p,s,str(data.get('operation','')))
+  fail('authorization_operation_rejected',403)
+ finally:
+  fcntl.flock(f.fileno(),fcntl.LOCK_UN); f.close()
+
+def peer_allowed(conn:socket.socket)->bool:
+ try:
+  import struct
+  _pid,uid,gid=struct.unpack('3i',conn.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))
+  return uid==pwd.getpwnam('aiman').pw_uid and gid==grp.getgrnam('gitops').gr_gid
+ except Exception: return False
+
+def serve()->None:
+ SOCKET_DIR.mkdir(parents=True,exist_ok=True); os.chown(SOCKET_DIR,0,grp.getgrnam('gitops').gr_gid); os.chmod(SOCKET_DIR,0o750)
+ try: SOCKET_PATH.unlink()
+ except FileNotFoundError: pass
+ with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as server:
+  server.bind(str(SOCKET_PATH)); os.chown(SOCKET_PATH,0,grp.getgrnam('gitops').gr_gid); os.chmod(SOCKET_PATH,0o660); server.listen(32); server.settimeout(1.0)
+  last=0.0
+  while True:
+   if time.monotonic()-last>30:
+    last=time.monotonic()
+    try:
+     f=lock(); p=parent(); s=state(); task_live(p,s,touch=False); four_way(s['current_head_oid']); ensure_child(p,s,'scheduled_rotation'); fcntl.flock(f.fileno(),fcntl.LOCK_UN); f.close()
+    except ControlError as e:
+     append_audit({'event':'scheduled_check_blocked','error':e.code})
+     if e.code=='authorization_task_terminal': return
+    except Exception: append_audit({'event':'scheduled_check_blocked','error':'authorization_controller_internal_error'})
+   try: conn,_=server.accept()
+   except socket.timeout: continue
+   with conn:
+    if not peer_allowed(conn): conn.sendall(canonical({'ok':False,'status':403,'error':'authorization_peer_rejected'})+b'\n'); continue
+    try:
+     raw=conn.recv(131072); data=json.loads(raw.decode()); result=request(data); conn.sendall(canonical({'ok':True,'result':result})+b'\n')
+    except ControlError as e: conn.sendall(canonical({'ok':False,'status':e.status,'error':e.code,**e.details})+b'\n')
+    except Exception as exc:
+     append_audit({'event':'controller_internal_error','error_type':type(exc).__name__})
+     conn.sendall(canonical({'ok':False,'status':503,'error':'authorization_controller_internal_error'})+b'\n')
+if __name__=='__main__': serve()

active-runtime/app/aios_chatgpt_action_task_router/action_task_router.py

@@ -0,0 +1,567 @@
+#!/usr/bin/env python3
+"""Task-bound bridge from the legacy ChatGPT Action to an isolated Writer V2."""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import os
+import re
+import sqlite3
+import socket
+import stat
+import urllib.error
+import urllib.parse
+import urllib.request
+from datetime import datetime, timezone
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from typing import Any
+
+
+CONFIG_PATH = Path(os.environ["AIOS_ACTION_ROUTE_BINDING"])
+POLICY_PATH = Path(os.environ["AIOS_ACTION_ROUTE_PATH_POLICY"])
+KNOWN_IDENTITIES_PATH = Path(os.environ["AIOS_ACTION_ROUTE_KNOWN_IDENTITIES"])
+STATE_PATH = Path(os.environ["AIOS_ACTION_ROUTE_STATE"])
+AUDIT_PATH = Path(os.environ["AIOS_ACTION_ROUTE_AUDIT"])
+HOST = os.environ.get("AIOS_ACTION_ROUTE_HOST", "127.0.0.1")
+PORT = int(os.environ.get("AIOS_ACTION_ROUTE_PORT", "19894"))
+EXPECTED_TASK_ID = os.environ["AIOS_ACTION_ROUTE_TASK_ID"]
+EXPECTED_ROUTE_HEADER = os.environ["AIOS_ACTION_ROUTE_HEADER"]
+AUTHORIZATION_SOCKET = Path(os.environ["AIOS_CONTINUOUS_AUTHORIZATION_SOCKET"])
+OID_RE = re.compile(r"[0-9a-f]{40}")
+SECRET_RE = re.compile(
+    r"(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)"
+    r"\s*[:=]\s*[\"']?([A-Za-z0-9_./+=:-]{16,})"
+)
+SECRET_VALUE_RE = re.compile(
+    r"(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,}|"
+    r"-----BEGIN (?:OPENSSH |RSA |EC )?PRIVATE KEY-----)"
+)
+ALLOWED_REQUEST_FIELDS = frozenset({"base","branch","content","create_branch","message","path","task_id","development_authorization_id","actor_identity","audience","approved_base_oid","expected_current_head_oid","operation_id","idempotency_key","exact_path","content_digest","commit_message_digest"})
+
+
+class RouteError(RuntimeError):
+    def __init__(self, code: str, status: int = 400, **details: Any):
+        super().__init__(code)
+        self.code = code
+        self.status = status
+        self.details = details
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def canonical_json(value: Any) -> bytes:
+    return json.dumps(
+        value, ensure_ascii=False, sort_keys=True, separators=(",", ":")
+    ).encode("utf-8")
+
+
+def load_root_managed_json(
+    path: Path, *, expected_mode: int = 0o640
+) -> tuple[dict[str, Any], bytes]:
+    info = os.lstat(path)
+    if stat.S_ISLNK(info.st_mode) or not stat.S_ISREG(info.st_mode):
+        raise RouteError("writer_route_config_type_rejected", 503)
+    if info.st_uid != 0 or stat.S_IMODE(info.st_mode) & ~expected_mode:
+        raise RouteError("writer_route_config_permissions_rejected", 503)
+    raw = path.read_bytes()
+    try:
+        value = json.loads(raw)
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        raise RouteError("writer_route_config_json_rejected", 503) from None
+    if not isinstance(value, dict):
+        raise RouteError("writer_route_config_object_required", 503)
+    return value, raw
+
+
+def load_binding() -> dict[str, Any]:
+    binding, _ = load_root_managed_json(CONFIG_PATH)
+    required = {
+        "schema_version",
+        "task_id",
+        "writer_instance_id",
+        "repository",
+        "branch",
+        "approved_base_oid",
+        "writer_url",
+        "path_policy_sha256",
+        "action_identities",
+    }
+    if set(binding) != required or binding.get("schema_version") != 1:
+        raise RouteError("writer_route_binding_schema_rejected", 503)
+    if binding["task_id"] != EXPECTED_TASK_ID:
+        raise RouteError("writer_route_task_binding_rejected", 503)
+    if binding["repository"] != "aios/aios":
+        raise RouteError("writer_route_repository_rejected", 503)
+    if not OID_RE.fullmatch(str(binding["approved_base_oid"])):
+        raise RouteError("writer_route_base_oid_rejected", 503)
+    if binding["writer_url"] != "http://127.0.0.1:19893":
+        raise RouteError("writer_route_upstream_rejected", 503)
+    identities = binding.get("action_identities")
+    if not isinstance(identities, list) or len(identities) != 1:
+        raise RouteError("writer_route_action_identity_rejected", 503)
+    identity = identities[0]
+    if (
+        not isinstance(identity, dict)
+        or set(identity) != {"account", "token_sha256"}
+        or identity.get("account") != "chatgpt-gitops-bot"
+        or not re.fullmatch(
+            r"[0-9a-f]{64}", str(identity.get("token_sha256", ""))
+        )
+    ):
+        raise RouteError("writer_route_action_identity_rejected", 503)
+    return binding
+
+
+def allowed_path_scope(binding: dict[str, Any]) -> tuple[set[str], tuple[str, ...]]:
+    policy, raw = load_root_managed_json(POLICY_PATH)
+    actual = hashlib.sha256(raw).hexdigest()
+    if actual != binding["path_policy_sha256"]:
+        raise RouteError("writer_route_path_policy_digest_mismatch", 503)
+    if policy.get("allowed_branch") != binding["branch"]:
+        raise RouteError("writer_route_path_policy_branch_mismatch", 503)
+    operation = (policy.get("allowed_operations") or {}).get("commit_file.atomic")
+    paths = operation.get("exact_paths") if isinstance(operation, dict) else None
+    prefixes = operation.get("prefix_paths") if isinstance(operation, dict) else None
+    if not isinstance(paths, list) or not paths or not all(
+        isinstance(x, str) for x in paths
+    ):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    if not isinstance(prefixes, list) or not prefixes or not all(
+        isinstance(x, str) and x.endswith("/") for x in prefixes
+    ):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    if any(not valid_relative_path(x[:-1]) for x in prefixes):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    if any(not valid_relative_path(x) for x in paths):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    return set(paths), tuple(prefixes)
+
+
+def valid_relative_path(path: str) -> bool:
+    if not isinstance(path, str) or not path or path != path.strip():
+        return False
+    if "\x00" in path or "\\" in path:
+        return False
+    try:
+        decoded = urllib.parse.unquote(path, errors="strict")
+    except (UnicodeDecodeError, ValueError):
+        return False
+    if decoded != path:
+        return False
+    posix = PurePosixPath(path)
+    windows = PureWindowsPath(path)
+    return not (
+        posix.is_absolute()
+        or windows.is_absolute()
+        or bool(windows.drive)
+        or any(part in {"", ".", ".."} for part in path.split("/"))
+    )
+
+
+def path_allowed(binding: dict[str, Any], path: str) -> bool:
+    if not valid_relative_path(path):
+        return False
+    exact_paths, prefixes = allowed_path_scope(binding)
+    return path in exact_paths or any(path.startswith(prefix) for prefix in prefixes)
+
+
+def bearer(headers: Any) -> str:
+    value = headers.get("Authorization", "")
+    if not value.startswith("Bearer "):
+        raise RouteError("unauthorized", 401)
+    token = value[7:].strip()
+    if not token:
+        raise RouteError("unauthorized", 401)
+    return token
+
+
+def authorize_action(headers: Any, binding: dict[str, Any]) -> str:
+    digest = hashlib.sha256(bearer(headers).encode("utf-8")).hexdigest()
+    identity = binding["action_identities"][0]
+    if not hmac.compare_digest(identity["token_sha256"], digest):
+        known, _ = load_root_managed_json(KNOWN_IDENTITIES_PATH)
+        identities = known.get("identities")
+        if known.get("schema_version") != 1 or not isinstance(identities, list):
+            raise RouteError("writer_route_identity_catalog_rejected", 503)
+        observed = "unregistered"
+        allowed_accounts = {
+            "chatgpt-gitops-bot",
+            "gitops-write-bot",
+            "codex-gitops-bot",
+        }
+        for candidate in identities:
+            if not isinstance(candidate, dict) or set(candidate) != {
+                "account",
+                "token_sha256",
+            }:
+                raise RouteError("writer_route_identity_catalog_rejected", 503)
+            account = str(candidate.get("account", ""))
+            token_sha256 = str(candidate.get("token_sha256", ""))
+            if account not in allowed_accounts or not re.fullmatch(
+                r"[0-9a-f]{64}", token_sha256
+            ):
+                raise RouteError("writer_route_identity_catalog_rejected", 503)
+            if hmac.compare_digest(token_sha256, digest):
+                observed = account
+        raise RouteError(
+            "writer_route_action_identity_rejected",
+            403,
+            accepted_action_identity=str(identity["account"]),
+            observed_action_identity=observed,
+            identity_alias_accepted=False,
+        )
+    return str(identity["account"])
+
+
+def authorization_call(operation: str, **payload: Any) -> dict[str, Any]:
+    request = {"op": operation, **payload}
+    try:
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
+            client.settimeout(15)
+            client.connect(str(AUTHORIZATION_SOCKET))
+            client.sendall(canonical_json(request))
+            raw = client.recv(131072)
+        response = json.loads(raw.decode("utf-8"))
+    except (OSError, TimeoutError, UnicodeDecodeError, json.JSONDecodeError):
+        raise RouteError("authorization_controller_unavailable", 503) from None
+    if not isinstance(response, dict) or not response.get("ok"):
+        if not isinstance(response, dict):
+            raise RouteError("authorization_controller_response_rejected", 503)
+        details = {k: v for k, v in response.items() if k not in {"ok", "status", "error"}}
+        raise RouteError(str(response.get("error") or "authorization_controller_rejected"), int(response.get("status") or 503), **details)
+    result = response.get("result")
+    if not isinstance(result, dict):
+        raise RouteError("authorization_controller_response_rejected", 503)
+    return result
+
+
+def writer_token() -> str:
+    value = authorization_call("get_writer_token").get("token")
+    if not isinstance(value, str) or len(value.encode("utf-8")) < 32:
+        raise RouteError("writer_route_credential_rejected", 503)
+    return value
+
+
+def writer_call(
+    binding: dict[str, Any],
+    method: str,
+    path: str,
+    payload: dict[str, Any] | None = None,
+) -> tuple[int, dict[str, Any]]:
+    data = canonical_json(payload) if payload is not None else None
+    headers = {"Authorization": "Bearer " + writer_token()}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    request = urllib.request.Request(
+        binding["writer_url"] + path, data=data, method=method, headers=headers
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=90) as response:
+            body = json.loads(response.read())
+            return response.status, body
+    except urllib.error.HTTPError as exc:
+        try:
+            body = json.loads(exc.read())
+        except Exception:
+            body = {"error": "writer_route_upstream_non_json_error"}
+        return exc.code, body
+    except (OSError, TimeoutError):
+        raise RouteError("writer_route_upstream_unavailable", 503) from None
+
+
+def validate_request(data: Any, binding: dict[str, Any]) -> dict[str, Any]:
+    if not isinstance(data, dict):
+        raise RouteError("writer_route_request_object_required")
+    if not {"branch", "path", "content"}.issubset(data):
+        raise RouteError("writer_route_request_incomplete")
+    if not set(data).issubset(ALLOWED_REQUEST_FIELDS):
+        raise RouteError("writer_route_request_fields_rejected")
+    if data["branch"] != binding["branch"]:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if data.get("create_branch") not in (None, False):
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if data.get("base", "main") not in {"main", binding["approved_base_oid"]}:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    path = data["path"]
+    if not isinstance(path, str) or not path_allowed(binding, path):
+        raise RouteError("writer_route_request_binding_failed", 403)
+    content = data["content"]
+    if not isinstance(content, str) or "\x00" in content or "\r" in content:
+        raise RouteError("writer_route_content_rejected")
+    if len(content.encode("utf-8")) > 1_048_576:
+        raise RouteError("writer_route_content_too_large", 413)
+    if SECRET_RE.search(content) or SECRET_VALUE_RE.search(content):
+        raise RouteError("writer_route_secret_content_rejected", 403)
+    message = data.get("message") or f"chore(chatgpt): update {path}"
+    if not isinstance(message, str) or not 1 <= len(message) <= 200 or "\x00" in message or "\n" in message or "\r" in message:
+        raise RouteError("writer_route_message_rejected")
+    return {"branch": binding["branch"], "path": path, "content": content, "message": message}
+
+
+def complete_request(data: dict[str, Any], normalized: dict[str, Any], binding: dict[str, Any], account: str) -> dict[str, Any]:
+    authorization = authorization_call("describe_authorization")
+    expected = {
+        "task_id": binding["task_id"],
+        "development_authorization_id": authorization.get("development_authorization_id"),
+        "actor_identity": account,
+        "audience": authorization.get("audience"),
+        "branch": binding["branch"],
+        "approved_base_oid": binding["approved_base_oid"],
+    }
+    required = {
+        "task_id": EXPECTED_TASK_ID,
+        "development_authorization_id": "authz-aios-autonomous-release-20260726",
+        "actor_identity": "chatgpt-gitops-bot",
+        "audience": "chatgpt-autonomous-release-writer",
+        "branch": binding["branch"],
+        "approved_base_oid": binding["approved_base_oid"],
+    }
+    if expected != required or authorization.get("authorization_status") != "ACTIVE" or authorization.get("current_head_oid") is None:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    for key, value in required.items():
+        if key in data and data[key] != value:
+            raise RouteError("writer_route_request_binding_failed", 403)
+    if "exact_path" in data and data["exact_path"] != normalized["path"]:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    current_head = str(authorization["current_head_oid"])
+    if not OID_RE.fullmatch(current_head):
+        raise RouteError("authorization_current_head_rejected", 503)
+    if "expected_current_head_oid" in data and data["expected_current_head_oid"] != current_head:
+        raise RouteError("BRANCH_HEAD_CHANGED", 409, current_head_oid=current_head)
+    content_digest = hashlib.sha256(normalized["content"].encode("utf-8")).hexdigest()
+    message_digest = hashlib.sha256(normalized["message"].encode("utf-8")).hexdigest()
+    if "content_digest" in data and data["content_digest"] != content_digest:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if "commit_message_digest" in data and data["commit_message_digest"] != message_digest:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    seed = {**required, "expected_current_head_oid": current_head, "path": normalized["path"], "content_digest": content_digest, "commit_message_digest": message_digest}
+    request_digest = hashlib.sha256(canonical_json(seed)).hexdigest()
+    idempotency_key = "action-" + request_digest
+    operation_id = hashlib.sha256((EXPECTED_TASK_ID + "\0" + idempotency_key).encode("utf-8")).hexdigest()
+    if "idempotency_key" in data and data["idempotency_key"] != idempotency_key:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if "operation_id" in data and data["operation_id"] != operation_id:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    return {**normalized, **required, "expected_current_head_oid": current_head, "operation_id": operation_id, "idempotency_key": idempotency_key, "exact_path": normalized["path"], "content_digest": content_digest, "commit_message_digest": message_digest, "request_digest": request_digest}
+
+
+def current_writer_head(binding: dict[str, Any]) -> str:
+    status, body = writer_call(binding, "GET", "/api/runtime-status")
+    if status != 200:
+        raise RouteError(
+            "writer_route_runtime_status_failed", 503, upstream_status=status
+        )
+    required = {
+        "service": "chatgpt-autonomous-release-writer",
+        "writes_enabled": True,
+        "allowed_branch": binding["branch"],
+        "approved_base_oid": binding["approved_base_oid"],
+        "path_policy_sha256": binding["path_policy_sha256"],
+    }
+    if any(body.get(key) != value for key, value in required.items()):
+        raise RouteError("writer_route_runtime_binding_mismatch", 503)
+    head = str(body.get("workspace_head_oid", ""))
+    if not OID_RE.fullmatch(head):
+        raise RouteError("writer_route_runtime_head_rejected", 503)
+    return head
+
+
+def operation_binding(
+    request_digest: str, binding: dict[str, Any]
+) -> tuple[str, str]:
+    STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
+    with sqlite3.connect(STATE_PATH, timeout=30, isolation_level=None) as db:
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        db.execute(
+            """
+            CREATE TABLE IF NOT EXISTS action_operations (
+                request_digest TEXT PRIMARY KEY,
+                expected_head_oid TEXT NOT NULL,
+                idempotency_key TEXT NOT NULL UNIQUE,
+                created_at TEXT NOT NULL
+            )
+            """
+        )
+        row = db.execute(
+            "SELECT expected_head_oid,idempotency_key FROM action_operations "
+            "WHERE request_digest=?",
+            (request_digest,),
+        ).fetchone()
+        if row:
+            return str(row[0]), str(row[1])
+    head = current_writer_head(binding)
+    key = "action-" + request_digest
+    with sqlite3.connect(STATE_PATH, timeout=30, isolation_level=None) as db:
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        db.execute("BEGIN IMMEDIATE")
+        db.execute(
+            "INSERT OR IGNORE INTO action_operations"
+            "(request_digest,expected_head_oid,idempotency_key,created_at) "
+            "VALUES(?,?,?,?)",
+            (request_digest, head, key, utc_now()),
+        )
+        row = db.execute(
+            "SELECT expected_head_oid,idempotency_key FROM action_operations "
+            "WHERE request_digest=?",
+            (request_digest,),
+        ).fetchone()
+        db.execute("COMMIT")
+    return str(row[0]), str(row[1])
+
+
+def append_audit(event: dict[str, Any]) -> None:
+    AUDIT_PATH.parent.mkdir(parents=True, exist_ok=True)
+    flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND | getattr(os, "O_NOFOLLOW", 0)
+    fd = os.open(AUDIT_PATH, flags, 0o600)
+    try:
+        os.write(fd, canonical_json(event) + b"\n")
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "AIOSActionTaskRouter/1"
+
+    def log_message(self, _format: str, *_args: Any) -> None:
+        return
+
+    def send_json(self, status: int, value: dict[str, Any]) -> None:
+        body = json.dumps(value, ensure_ascii=False, sort_keys=True).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self) -> None:
+        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+        if path != "/health":
+            return self.send_json(404, {"error": "not_found"})
+        try:
+            binding = load_binding()
+            self.send_json(
+                200,
+                {
+                    "status": "ok",
+                    "service": "aios-action-task-router",
+                    "task_id": binding["task_id"],
+                    "writer_instance_id": binding["writer_instance_id"],
+                    "branch": binding["branch"],
+                },
+            )
+        except RouteError as exc:
+            self.send_json(exc.status, {"error": exc.code, **exc.details})
+
+    def do_POST(self) -> None:
+        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+        if path != "/api/file":
+            return self.send_json(404, {"error": "not_found"})
+        if self.client_address[0] not in {"127.0.0.1", "::1"}:
+            return self.send_json(403, {"error": "writer_route_source_rejected"})
+        if self.headers.get("X-AIOS-Route-Task") != EXPECTED_ROUTE_HEADER:
+            return self.send_json(403, {"error": "writer_route_header_rejected"})
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+            if not 0 < length <= 1_100_000:
+                raise RouteError("writer_route_content_length_rejected", 413)
+            try:
+                data = json.loads(self.rfile.read(length).decode("utf-8"))
+            except (UnicodeDecodeError, json.JSONDecodeError):
+                raise RouteError("writer_route_request_json_rejected") from None
+            binding = load_binding()
+            account = authorize_action(self.headers, binding)
+            normalized = validate_request(data, binding)
+            normalized = complete_request(data, normalized, binding, account)
+            prepared = authorization_call("prepare_write", request={key: normalized[key] for key in ("expected_current_head_oid", "operation_id", "idempotency_key", "exact_path", "content_digest", "commit_message_digest", "branch", "path", "message")})
+            expected_head = str(prepared["expected_head_oid"])
+            writer_payload = {"branch": normalized["branch"], "path": normalized["path"], "content": normalized["content"], "message": normalized["message"], "expected_head_oid": expected_head, "idempotency_key": str(prepared["idempotency_key"])}
+            request_digest = hashlib.sha256(canonical_json({"task_id": binding["task_id"], "operation_id": normalized["operation_id"], "idempotency_key": normalized["idempotency_key"], "content_digest": normalized["content_digest"], "commit_message_digest": normalized["commit_message_digest"]})).hexdigest()
+            status, result = writer_call(
+                binding, "POST", "/api/commit-file", writer_payload
+            )
+            audit = {
+                "at": utc_now(),
+                "task_id": binding["task_id"],
+                "writer_instance_id": binding["writer_instance_id"],
+                "account": account,
+                "branch": normalized["branch"],
+                "path": normalized["path"],
+                "request_digest": request_digest,
+                "expected_head_oid": expected_head,
+                "status": status,
+                "operation_id": result.get("operation_id"),
+                "commit_oid": result.get("commit_oid"),
+                "error": result.get("error"),
+                "secrets_included": False,
+            }
+            append_audit(audit)
+            if status != 200:
+                try:
+                    authorization_call("fail_write", result={"operation_id": normalized["operation_id"]})
+                except RouteError:
+                    pass
+                return self.send_json(status, result)
+            advanced = authorization_call("reconcile_commit", result={"previous_head_oid": expected_head, "new_commit_oid": result.get("commit_oid"), "operation_id": result.get("operation_id")})
+            return self.send_json(
+                200,
+                {
+                    "status": "committed",
+                    "branch": normalized["branch"],
+                    "path": normalized["path"],
+                    "commit": {
+                        "status": "committed",
+                        "branch": normalized["branch"],
+                        "rev": result.get("commit_oid"),
+                        "previous_head_oid": expected_head,
+                        "new_tree_oid": result.get("new_tree_oid"),
+                        "push_status": result.get("push_status"),
+                        "four_way_ref_status": advanced.get("four_way_ref_status") is True,
+                        "sync": {"status": "verified", "target": "bare+git-ls-remote+gitea-api"},
+                    },
+                    "writer_instance_id": binding["writer_instance_id"],
+                    "operation_id": result.get("operation_id"),
+                    "idempotent": result.get("idempotent"),
+                    "secrets_included": False,
+                },
+            )
+        except RouteError as exc:
+            if exc.code == "writer_route_action_identity_rejected":
+                try:
+                    append_audit(
+                        {
+                            "at": utc_now(),
+                            "task_id": EXPECTED_TASK_ID,
+                            "event": "action_identity_rejected",
+                            "accepted_action_identity": exc.details.get(
+                                "accepted_action_identity"
+                            ),
+                            "observed_action_identity": exc.details.get(
+                                "observed_action_identity"
+                            ),
+                            "identity_alias_accepted": False,
+                            "secrets_included": False,
+                        }
+                    )
+                except Exception:
+                    pass
+            self.send_json(exc.status, {"error": exc.code, **exc.details})
+        except Exception:
+            self.send_json(500, {"error": "writer_route_internal_error"})
+
+
+def main() -> None:
+    load_binding()
+    server = ThreadingHTTPServer((HOST, PORT), Handler)
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()

active-runtime/app/aios_chatgpt_actions_api.py

@@ -5,8 +5,59 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
 
-sys.path.insert(0, str(Path(os.getenv('AIOS_GITOPS_WORKSPACE', '/data/aios-gitops/workspace')) / 'runtime' / 'agent-os'))
+try:
+    from aios_gitops_write_guard import evaluate_git_write
+except ModuleNotFoundError:
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+    from aios_gitops_write_guard import evaluate_git_write
+
+from gitea_tag_publication import (
+    GiteaTagClient,
+    GitTagBackend,
+    PublicationConflict,
+    PublicationPending,
+    PublicationManualOwnerReviewRequired,
+    PublicationReconciliationRequired,
+    PublicationRequest,
+    TagPublisher,
+    redact,
+    validate_version,
+)
 from orchestrator.action_monitor import ActionMonitor
+from silent_release_hardening import (
+    ApprovalKeyRing,
+    ApprovalRevocationStore,
+    CapabilityAuthorizationError,
+    SagaConflict,
+    SignedApprovalVerifier,
+    SignedReleasePlanApproval,
+    SilentReleaseActionService,
+)
+try:
+    from authoritative_git import (
+        AuthoritativeGitError,
+        AuthoritativeGitNotFound,
+        AuthoritativeGitOutputTooLarge,
+        authoritative_branches,
+        authoritative_diff,
+        authoritative_commit,
+        authoritative_tags,
+        repository_snapshot,
+        run_authoritative_git,
+    )
+except ModuleNotFoundError:
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+    from authoritative_git import (
+        AuthoritativeGitError,
+        AuthoritativeGitNotFound,
+        AuthoritativeGitOutputTooLarge,
+        authoritative_branches,
+        authoritative_diff,
+        authoritative_commit,
+        authoritative_tags,
+        repository_snapshot,
+        run_authoritative_git,
+    )
 
 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WS = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
@@ -16,6 +67,19 @@ HOST = os.getenv('AIOS_GITOPS_HOST', '127.0.0.1')
 PORT = int(os.getenv('AIOS_GITOPS_PORT', '18890'))
 OPENAPI = WS / 'docs' / 'gitops' / 'openapi-chatgpt-actions.yaml'
 BARE_REPO = Path(os.getenv('AIOS_GITOPS_BARE_REPO', str(ROOT / 'runtime' / 'gitea-bin' / 'data' / 'repositories' / 'aios' / 'aios.git')))
+AUTHORITATIVE_GIT_DIR = Path(os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR')) if os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR') else None
+REPOSITORY_IDENTITY = os.getenv('AIOS_GITOPS_REPOSITORY_IDENTITY', '')
+SILENT_RELEASE_STATE_ROOT = Path(os.getenv(
+    'AIOS_SILENT_RELEASE_STATE_ROOT',
+    '/var/lib/aios-gitops/silent-release',
+))
+SILENT_RELEASE_EXECUTION_ENABLED = str(os.getenv(
+    'AIOS_SILENT_RELEASE_EXECUTION_ENABLED', 'false'
+)).lower() in {'1', 'true', 'yes', 'on'}
+SILENT_RELEASE_PUBLIC_KEYS = Path(os.getenv(
+    'AIOS_SILENT_RELEASE_PUBLIC_KEYS',
+    '/etc/aios-gitops/silent-release-owner-public-keys.json',
+))
 monitor = ActionMonitor()
 
 BASE_MODELS = [
@@ -24,7 +88,43 @@ BASE_MODELS = [
   {'id':'base.gpt-5.5','provider':'openai','model':'gpt-5.5','display_name':'GPT-5.5','scope':'global'},
 ]
 SECRET_RE = re.compile(r'(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)\s*[:=]\s*["\']?([A-Za-z0-9_./+=:-]{16,})')
-SECRET_VAL_RE = re.compile(r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})')
+SECRET_VAL_RE = re.compile(
+    r'(?<![A-Za-z0-9_])'
+    r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})'
+)
+
+READ_ONLY_GET_PATHS = frozenset({
+    '/', '/health', '/api/health', '/api/openapi.yaml',
+    '/api/openapi-chatgpt-actions.yaml', '/api/schema', '/api', '/api/status',
+    '/api/base', '/api/baseline', '/base', '/api/ver', '/api/versions', '/ver',
+    '/api/diff', '/diff', '/api/patch', '/api/patches', '/api/branches', '/patch',
+    '/api/model', '/model', '/api/run', '/api/runtime-status', '/run',
+    '/api/action-monitor', '/action-monitor', '/admin/ai-evolution',
+    '/admin/ai-evolution/api/data',
+    '/api/release-consistency', '/api/tag-publication-status',
+    '/api/release-acceptance',
+    '/getReleaseCandidate', '/getReleasePlan', '/getReleaseAcceptance',
+    '/getApprovalEnvelope', '/getReleaseSaga', '/getCapabilityStatus',
+    '/getRecoveryStatus',
+})
+SILENT_RELEASE_POST_PATHS = frozenset({
+    '/createReleaseCandidate',
+    '/createReleaseIntent',
+    '/submitSignedApproval',
+    '/submitOwnerApproval',
+    '/startDeployment',
+})
+
+def reject_non_read_http(handler, method: str, path: str) -> bool:
+    if method == 'GET':
+        return False
+    if path in SILENT_RELEASE_POST_PATHS:
+        return False
+    decision = evaluate_git_write(WS)
+    if decision.allowed:
+        return False
+    handler.sendj(decision.payload(), decision.status_code)
+    return True
 
 def now() -> str: return time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())
 def uid(p='id') -> str: return f'{p}-{int(time.time()*1000)}-{uuid.uuid4().hex[:8]}'
@@ -36,6 +136,41 @@ def sh(args, check=False):
 def jload(p: Path, default):
     try: return json.loads(p.read_text(encoding='utf-8'))
     except Exception: return default
+
+def _file_sha256(path: Path) -> str:
+    digest=hashlib.sha256()
+    with path.open('rb') as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b''):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+def _build_silent_release_service() -> SilentReleaseActionService:
+    verifier=None
+    if SILENT_RELEASE_PUBLIC_KEYS.is_file():
+        verifier=SignedApprovalVerifier(
+            ApprovalKeyRing.from_file(SILENT_RELEASE_PUBLIC_KEYS),
+            ApprovalRevocationStore(
+                SILENT_RELEASE_STATE_ROOT / 'revocations'
+            ),
+        )
+    policy_path=WS / 'config' / 'gitops' / 'silent-release-policy.json'
+    policy_sha=_file_sha256(policy_path) if policy_path.is_file() else ''
+    return SilentReleaseActionService(
+        SILENT_RELEASE_STATE_ROOT,
+        execution_enabled=SILENT_RELEASE_EXECUTION_ENABLED,
+        approval_verifier=verifier,
+        expected_repository=REPOSITORY_IDENTITY,
+        policy_sha256=policy_sha,
+    )
+
+# Construct once during service startup. If production execution is enabled
+# without every trusted builder/orchestrator dependency, construction fails
+# closed before the HTTP server accepts traffic.
+_SILENT_RELEASE_SERVICE = _build_silent_release_service()
+
+
+def silent_release_service() -> SilentReleaseActionService:
+    return _SILENT_RELEASE_SERVICE
 def relpath(path: str) -> str:
     x = str(path or '').replace('\\','/').strip()
     if not x or x.startswith('/') or '..' in Path(x).parts or Path(x).parts[0] == '.git': raise ValueError('invalid path')
@@ -109,9 +244,13 @@ def ensure_git():
     if not sh(['config','user.name'])['stdout']: sh(['config','user.name','chatgpt-gitops-bot'], True)
 def checkout(branch, base='main', create=False):
     ensure_git(); b=branch_name(branch)
-    if create or sh(['rev-parse','--verify',b])['code'] != 0:
-        sh(['checkout',base], True); sh(['checkout','-B',b], True)
-    else: sh(['checkout',b], True)
+    exists = sh(['rev-parse','--verify',f'refs/heads/{b}'])['code'] == 0
+    if exists:
+        sh(['checkout',b], True)
+    elif create:
+        sh(['checkout',base], True); sh(['checkout','-b',b], True)
+    else:
+        raise ValueError(f'branch does not exist: {b}')
     return b
 def write_file(path, content):
     if content_has_secret(content): raise ValueError('secret_rejected: use secret_ref; plaintext API keys must not enter Git')
@@ -121,6 +260,19 @@ def sync_branch(branch: str) -> dict:
     if not branch or branch in ('main','master') or branch.startswith('main/') or branch.startswith('master/'):
         return {'status':'skipped','reason':'protected_branch','branch':branch}
     if BARE_REPO.exists():
+        common = sh(['rev-parse', '--path-format=absolute', '--git-common-dir'], True)['stdout']
+        if Path(common).resolve() == BARE_REPO.resolve():
+            head = sh(['rev-parse', 'HEAD'], True)['stdout']
+            stored = subprocess.run(
+                ['git', '--git-dir', str(BARE_REPO), 'rev-parse', f'refs/heads/{branch}'],
+                text=True, capture_output=True,
+            )
+            if stored.returncode != 0 or stored.stdout.strip() != head:
+                raise RuntimeError(f'linked-worktree branch verification failed for {branch}')
+            return {
+                'status':'verified', 'target':'authoritative-bare',
+                'branch':branch, 'oid':head,
+            }
         ref=f'refs/heads/{branch}:refs/heads/{branch}'
         p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
         if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git sync failed for {branch}')
@@ -130,15 +282,68 @@ def sync_branch(branch: str) -> dict:
     return {'status':'synced','target':'origin','branch':branch,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
 
 def sync_tag(tag: str) -> dict:
-    if not tag: return {'status':'skipped','reason':'empty_tag'}
-    if BARE_REPO.exists():
-        ref=f'refs/tags/{tag}:refs/tags/{tag}'
-        p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
-        if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag sync failed for {tag}')
-        return {'status':'synced','target':'bare','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
-    p=subprocess.run(['git','push','origin',tag], cwd=str(WS), text=True, capture_output=True)
-    if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag push failed for {tag}')
-    return {'status':'synced','target':'origin','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
+    raise RuntimeError(
+        'unsafe sync_tag disabled: use TagPublisher with expected tag_oid, '
+        'target_oid, Gitea remote verification, and authenticated API verification'
+    )
+
+def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
+    oid = str(value or '').strip().lower()
+    if not re.fullmatch(r'[0-9a-f]{40}', oid):
+        raise ValueError(f'{field} must be a full 40-character commit OID')
+    try:
+        return authoritative_commit(oid, git_dir=AUTHORITATIVE_GIT_DIR)
+    except (AuthoritativeGitError, ValueError) as exc:
+        raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
+
+def existing_tag_target(tag: str) -> str | None:
+    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
+        raise ValueError('invalid release version')
+    try:
+        result = run_authoritative_git(
+            ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
+            check=False,
+            git_dir=AUTHORITATIVE_GIT_DIR,
+        )
+    except AuthoritativeGitError as exc:
+        raise RuntimeError(str(exc)) from exc
+    return result.stdout.strip() if result.returncode == 0 else None
+
+def publication_request_from_query(q: dict[str, list[str]]) -> PublicationRequest:
+    required = ('version', 'target_oid', 'evidence_closure_oid', 'approval_plan_id')
+    missing = [name for name in required if not (q.get(name) or [''])[0]]
+    if missing:
+        raise ValueError('missing release governance fields: ' + ', '.join(missing))
+    return PublicationRequest(
+        (q['version'])[0],
+        (q['target_oid'])[0].lower(),
+        (q['evidence_closure_oid'])[0].lower(),
+        (q['approval_plan_id'])[0],
+    )
+
+def required_authoritative_git_dir() -> Path:
+    snapshot = repository_snapshot(
+        git_dir=AUTHORITATIVE_GIT_DIR,
+        repository_identity=REPOSITORY_IDENTITY,
+    )
+    if not snapshot["repository_available"]:
+        raise RuntimeError(str(snapshot["query_error"] or "AUTHORITATIVE_REPOSITORY_UNAVAILABLE"))
+    return Path(str(snapshot["authoritative_git_dir"]))
+
+
+def publication_publisher() -> TagPublisher:
+    authoritative_repo = required_authoritative_git_dir()
+    return TagPublisher(
+        WS,
+        GitTagBackend(WS, authoritative_repo=authoritative_repo),
+        GiteaTagClient(
+            os.getenv('AIOS_GITOPS_GITEA_API_URL',''),
+            os.getenv('AIOS_GITOPS_GITEA_REPOSITORY',''),
+            Path(os.getenv('AIOS_GITOPS_GITEA_TOKEN_FILE','')),
+            token_line=int(os.getenv('AIOS_GITOPS_GITEA_TOKEN_LINE','1')),
+        ),
+        os.getenv('AIOS_GITOPS_GITEA_REMOTE','gitea'),
+    )
 
 def commit(paths, msg):
     ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
@@ -158,6 +363,16 @@ def patches():
     for p in sorted((WS/'patches').glob('**/*.json')): out.append(jload(p, {'path':str(p.relative_to(WS))}))
     return out
 
+def runtime_release_info() -> dict[str, Any]:
+    for candidate in (WS / 'manifest.json', WS.parent / 'manifest.json'):
+        data = jload(candidate, {})
+        if data.get('target_commit'):
+            return {
+                'runtime_release_commit': data.get('target_commit'),
+                'runtime_release_path': str(WS),
+            }
+    return {'runtime_release_commit': None, 'runtime_release_path': str(WS)}
+
 class H(BaseHTTPRequestHandler):
     server_version='AIOSChatGPTGitOps/V1R1C0'
     def sendj(self, data, code=200):
@@ -179,43 +394,236 @@ class H(BaseHTTPRequestHandler):
         if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
         return a
     def do_GET(self):
-        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path; q=urllib.parse.parse_qs(u.query)
+        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
+        if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
+        q=urllib.parse.parse_qs(u.query)
         try:
             if path in ('/health','/api/health'): return self.sendj({'status':'ok','service':'chatgpt-gitops-adapter','workspace':str(WS)})
             if path in ('/api/openapi.yaml','/api/openapi-chatgpt-actions.yaml','/api/schema'):
                 return self.sendt(OPENAPI.read_text(encoding='utf-8'), 'application/yaml; charset=utf-8') if OPENAPI.exists() else self.sendj({'error':'schema_missing'},404)
             if path in ('/api','/api/status'): return self.sendj(api_spec())
             if path in ('/api/base','/api/baseline','/base'):
-                data=jload(WS/'baseline'/'current.json', {}); data.setdefault('git', sh(['rev-parse','--short','HEAD'])['stdout']); return self.sendj(data)
+                data=jload(WS/'baseline'/'current.json', {})
+                data.setdefault('authoritative_repository', repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                ))
+                return self.sendj(data)
             if path in ('/api/ver','/api/versions','/ver'):
-                return self.sendj({'tags':sh(['tag','--list','V*'])['stdout'].splitlines(),'versions_dir':[p.name for p in (WS/'versions').glob('*')],'head':sh(['rev-parse','--short','HEAD'])['stdout']})
+                snapshot = repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                )
+                if not snapshot['repository_available']:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': snapshot['query_error'],
+                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
+                        'local_authoritative_tags': [],
+                    }, 503)
+                try:
+                    tags = authoritative_tags(git_dir=AUTHORITATIVE_GIT_DIR)
+                except AuthoritativeGitError as exc:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': str(exc),
+                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
+                        'local_authoritative_tags': [],
+                    }, 503)
+                registry = [p.name for p in (WS/'versions').glob('*')]
+                return self.sendj({
+                    'registry_versions': registry,
+                    'local_authoritative_tags': tags,
+                    'repository_available': True,
+                    'query_error': None,
+                    'tags': [item['name'] for item in tags],
+                    'versions_dir': registry,
+                    'head': snapshot['authoritative_head_oid'],
+                    'authoritative_head_oid': snapshot['authoritative_head_oid'],
+                })
             if path in ('/api/diff','/diff'):
-                frm=(q.get('from') or ['HEAD~1'])[0]; to=(q.get('to') or ['HEAD'])[0]; return self.sendj({'from':frm,'to':to,'diff':sh(['diff',frm,to])})
-            if path in ('/api/patch','/api/patches','/api/branches','/patch'): return self.sendj({'patches':patches(),'branches':sh(['branch','--format','%(refname:short)'])['stdout'].splitlines()})
+                frm=(q.get('from') or [''])[0]
+                to=(q.get('to') or [''])[0]
+                try:
+                    diff=authoritative_diff(frm, to, git_dir=required_authoritative_git_dir())
+                except ValueError as exc:
+                    return self.sendj({'error':redact(exc)},400)
+                except AuthoritativeGitNotFound as exc:
+                    return self.sendj({'error':redact(exc)},404)
+                except AuthoritativeGitOutputTooLarge as exc:
+                    return self.sendj({'error':redact(exc)},413)
+                except (AuthoritativeGitError, RuntimeError) as exc:
+                    return self.sendj({'error':redact(exc)},503)
+                return self.sendj({'from':frm,'to':to,'diff':diff})
+            if path in ('/api/patch','/api/patches','/api/branches','/patch'):
+                snapshot = repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                )
+                if not snapshot['repository_available']:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': snapshot['query_error'],
+                        'metadata_patches': patches(),
+                        'authoritative_branches': [],
+                    }, 503)
+                try:
+                    branches = authoritative_branches(git_dir=AUTHORITATIVE_GIT_DIR)
+                except AuthoritativeGitError as exc:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': str(exc),
+                        'metadata_patches': patches(),
+                        'authoritative_branches': [],
+                    }, 503)
+                metadata = patches()
+                branch_names = {item['name'] for item in branches}
+                metadata_names = {
+                    item.get('branch') for item in metadata
+                    if isinstance(item, dict) and item.get('branch')
+                }
+                orphan = [
+                    item for item in metadata
+                    if item.get('branch') and item.get('branch') not in branch_names
+                ]
+                missing = [
+                    item for item in branches
+                    if item['name'] not in metadata_names
+                ]
+                return self.sendj({
+                    'metadata_patches': metadata,
+                    'authoritative_branches': branches,
+                    'orphan_metadata': orphan,
+                    'branches_without_metadata': missing,
+                    'repository_available': True,
+                    'query_error': None,
+                    'patches': metadata,
+                    'branches': [item['name'] for item in branches],
+                })
             if path in ('/api/model','/model'): return self.sendj({'base':BASE_MODELS,'custom':model_docs(),'priority':[jload(p,{}) for p in sorted((WS/'config'/'model_priority').glob('*.json'))]})
             if path in ('/api/run','/api/runtime-status','/run'):
                 svc=subprocess.run(['systemctl','is-active','aios-gitops-model-api'], text=True, capture_output=True)
-                return self.sendj({'service':'aios-gitops-model-api','status':svc.stdout.strip() or svc.stderr.strip(),'workspace_branch':sh(['rev-parse','--abbrev-ref','HEAD'])['stdout']})
+                snapshot = repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                )
+                workspace_branch = None
+                if (WS / '.git').exists():
+                    result = sh(['rev-parse','--abbrev-ref','HEAD'])
+                    workspace_branch = result['stdout'] or None
+                payload = {
+                    'service':'aios-gitops-model-api',
+                    'status':svc.stdout.strip() or svc.stderr.strip(),
+                    'workspace_branch':workspace_branch,
+                    **runtime_release_info(),
+                    **snapshot,
+                    'writes_enabled': str(os.getenv('AIOS_GITOPS_WRITES_ENABLED','false')).lower() in {'1','true','yes','on'},
+                }
+                return self.sendj(payload, 200 if snapshot['repository_available'] else 503)
             if path in ('/api/action-monitor','/action-monitor'):
                 latest=monitor.latest()
                 ldict={'event_id':latest.event_id,'action':latest.action,'error':latest.error,'context':latest.context,'created_at':latest.created_at} if latest else None
                 return self.sendj({'events':[{"event_id":e.event_id,"action":e.action,"error":e.error,"context":e.context,"created_at":e.created_at} for e in monitor.list_events()],'latest':ldict})
+            if path == '/api/tag-publication-status':
+                version=(q.get('version') or [''])[0]
+                try:
+                    version=validate_version(version)
+                    status=publication_publisher().get_tag_publication_status(version)
+                except ValueError:
+                    return self.sendj({'error':'invalid release version'},400)
+                return self.sendj(status)
+            if path == '/api/release-consistency':
+                request=publication_request_from_query(q)
+                return self.sendj(publication_publisher().get_release_consistency(request))
+            if path == '/api/release-acceptance':
+                request=publication_request_from_query(q)
+                return self.sendj(publication_publisher().run_release_acceptance(request))
+            if path in (
+                '/getReleaseCandidate',
+                '/getReleasePlan',
+                '/getReleaseAcceptance',
+                '/getApprovalEnvelope',
+                '/getReleaseSaga',
+                '/getCapabilityStatus',
+            ):
+                candidate_id=(q.get('candidate_id') or [''])[0]
+                if not candidate_id:
+                    return self.sendj({'error':'candidate_id is required'},400)
+                service=silent_release_service()
+                if path == '/getReleaseCandidate':
+                    return self.sendj(
+                        service.get_release_candidate(candidate_id)
+                    )
+                if path == '/getApprovalEnvelope':
+                    return self.sendj(
+                        service.get_approval_envelope(candidate_id)
+                    )
+                if path == '/getReleasePlan':
+                    return self.sendj(service.get_release_plan(candidate_id))
+                if path == '/getReleaseAcceptance':
+                    return self.sendj(service.get_acceptance(candidate_id))
+                if path == '/getCapabilityStatus':
+                    return self.sendj(
+                        service.get_capability_status(candidate_id)
+                    )
+                return self.sendj(service.get_release_saga(candidate_id))
+            if path == '/getRecoveryStatus':
+                return self.sendj(
+                    silent_release_service().get_recovery_status()
+                )
                         # Admin AI Evolution Dashboard
             if path in ('/admin/ai-evolution','/admin/ai-evolution/'):
                 return self.ai_evolution_page()
             if path in ('/admin/ai-evolution/api/data'):
                 return self.ai_evolution_data()
             return self.sendj({'error':'not_found','path':path},404)
+        except FileNotFoundError:
+            return self.sendj({'error':'release candidate not found'},404)
+        except ValueError as e:
+            error=redact(e)
+            monitor.record_failure('do_GET', error, {'path':path})
+            return self.sendj({'error':error},400)
         except Exception as e:
-            monitor.record_failure('do_GET', str(e), {'path':path})
-            return self.sendj({'error':str(e)},500)
+            error=redact(e)
+            monitor.record_failure('do_GET', error, {'path':path})
+            return self.sendj({'error':error},500)
     def do_PUT(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'PUT', path): return
+        data=self.body()
         if path == '/api/model-priority': return self.model_priority(data)
         return self.sendj({'error':'not_found','path':path},404)
     def do_POST(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'POST', path): return
+        data=self.body()
         try:
+            if path == '/createReleaseCandidate':
+                a=self.need('release:candidate')
+                if not a: return
+                return self.sendj(
+                    silent_release_service().create_release_candidate(data)
+                )
+            if path == '/createReleaseIntent':
+                a=self.need('release:candidate')
+                if not a: return
+                return self.sendj(
+                    silent_release_service().create_release_intent(data)
+                )
+            if path in ('/submitOwnerApproval','/submitSignedApproval'):
+                a=self.need('release:approve')
+                if not a: return
+                return self.sendj(
+                    silent_release_service().submit_owner_approval(data)
+                )
+            if path == '/startDeployment':
+                a=self.need('release:deploy')
+                if not a: return
+                return self.sendj(
+                    silent_release_service().start_deployment(
+                        str(data.get('candidate_id') or '')
+                    )
+                )
             if path in ('/api/branch','/api/create-branch'): return self.branch(data)
             if path in ('/api/file','/api/commit-file'): return self.file(data)
             if path == '/api/commit': return self.commit(data)
@@ -226,9 +634,30 @@ class H(BaseHTTPRequestHandler):
             if path == '/api/model-priority': return self.model_priority(data)
             if path == '/api/nl': return self.nl(data)
             return self.sendj({'error':'not_found','path':path},404)
+        except (ValueError, FileNotFoundError) as e:
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},400)
+        except CapabilityAuthorizationError as e:
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},403)
+        except SagaConflict as e:
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},409)
         except Exception as e:
-            monitor.record_failure('do_POST', str(e), {'path':path})
-            return self.sendj({'error':str(e)},500)
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},500)
+    def do_PATCH(self):
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'PATCH', path): return
+        return self.sendj({'error':'not_found','path':path},404)
+    def do_DELETE(self):
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'DELETE', path): return
+        return self.sendj({'error':'not_found','path':path},404)
     def branch(self,data):
         a=self.need('branch:create');
         if not a: return
@@ -252,12 +681,41 @@ class H(BaseHTTPRequestHandler):
         if not a: return
         ver=data.get('version') or data.get('tag')
         if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
-        if data.get('confirm') != True:
-            self.sendj({'status':'confirm_required','operation':'tag','hint':'This operation creates a Git tag. Confirm to proceed.','x-openai-isConsequential':True}, 428)
-            return
+        if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
+            return self.sendj({
+                'error':'production_tag_evidence_required',
+                'required':['version','target_oid','evidence_closure_oid','approval_plan_id'],
+            },400)
+        try:
+            target_oid=resolve_commit_oid(data.get('target_oid'))
+            evidence_oid=resolve_commit_oid(data.get('evidence_closure_oid'), 'evidence_closure_oid')
+        except ValueError as exc:
+            return self.sendj({'error':'invalid_tag_target','detail':str(exc)},400)
         if a['role'] != 'owner' or not data.get('execute'):
-            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'commit':c})
-        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver)})
+            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'request':req,'commit':c})
+        request=PublicationRequest(ver,target_oid,evidence_oid,str(data.get('approval_plan_id')))
+        main_before=sh(['rev-parse','refs/heads/main'], True)['stdout']
+        publisher=publication_publisher()
+        try:
+            publication=publisher.publish(request)
+        except PublicationManualOwnerReviewRequired as exc:
+            audit(a['account'],'tag_manual_owner_review_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':redact(exc)})
+            return self.sendj({'status':'MANUAL_OWNER_REVIEW_REQUIRED','error':redact(exc),'main_changed':False,'force_push':False},409)
+        except PublicationConflict as exc:
+            audit(a['account'],'tag_conflict',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
+            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},409)
+        except PublicationPending as exc:
+            audit(a['account'],'tag_pending',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
+            return self.sendj({'status':'REMOTE_PUSH_PENDING','error':str(exc),'main_changed':False,'force_push':False},503)
+        except PublicationReconciliationRequired as exc:
+            audit(a['account'],'tag_reconciliation_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
+            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},502)
+        main_after=sh(['rev-parse','refs/heads/main'], True)['stdout']
+        if main_after != main_before:
+            raise RuntimeError('main changed during tag operation')
+        result={'status':publication['state'],'version':ver,'tag_name':ver,'tag_oid':publication['tag_oid'],'target_oid':target_oid,'expected_target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'workspace_head':sh(['rev-parse','HEAD'],True)['stdout'],'main_oid_before':main_before,'main_oid_after':main_after,'main_changed':False,'force_push':False,'publication':publication}
+        audit(a['account'],'tag',ver,result)
+        self.sendj(result)
     def rollback(self,data):
         a=self.need('rollback:request');
         if not a: return
@@ -352,7 +810,10 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
         cmd_filter=(params.get('command') or [None])[0]
         bl=jload(WS/'baseline'/'current.json',{})
         current_ver=bl.get('current_baseline','V1R3C1')
-        tags=sh(['tag','--list','V*'])['stdout'].splitlines() if WS.exists() else []
+        try:
+            tags=[item['name'] for item in authoritative_tags(git_dir=required_authoritative_git_dir()) if str(item['name']).startswith('V')]
+        except (AuthoritativeGitError, RuntimeError) as exc:
+            return self.sendj({'error':redact(exc),'repository_available':False},503)
         versions=[]
         if (WS/'baseline'/'promotions').exists():
             for p in sorted((WS/'baseline'/'promotions').glob('*.json')):
@@ -390,9 +851,9 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
 
 
 def api_spec():
-    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True}}
+    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
 
 def main():
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
-if __name__ == '__main__': main()
+if __name__ == '__main__': main()

active-runtime/app/aios_gitops_write_guard.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""Fail-closed policy for in-process Git mutation handlers."""
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Mapping
+
+_TRUE = frozenset({"1", "true", "yes", "on"})
+
+
+@dataclass(frozen=True)
+class GitWriteDecision:
+    allowed: bool
+    status_code: int
+    error: str
+    reason: str
+    workspace: str
+
+    def payload(self) -> dict[str, str]:
+        return {
+            "status": "allowed" if self.allowed else "blocked",
+            "error": self.error,
+            "reason": self.reason,
+            "workspace": self.workspace,
+        }
+
+
+def _real(path: Path) -> Path:
+    return Path(os.path.realpath(os.path.abspath(str(path))))
+
+
+def evaluate_git_write(workspace: Path | str, env: Mapping[str, str] | None = None) -> GitWriteDecision:
+    values = os.environ if env is None else env
+    lexical = Path(os.path.abspath(str(workspace)))
+    canonical = _real(lexical)
+    shown = str(lexical)
+    if str(values.get("AIOS_GITOPS_WRITES_ENABLED", "false")).strip().lower() not in _TRUE:
+        return GitWriteDecision(False, 423, "gitops_writes_disabled", "AIOS_GITOPS_WRITES_ENABLED is false", shown)
+    if lexical != canonical:
+        return GitWriteDecision(False, 409, "workspace_symlink_forbidden", "workspace must be a canonical non-symlink path", shown)
+    controller = _real(Path(values.get("AIOS_GITOPS_CONTROLLER_PATH", "/data/aios-gitops/worktrees/controller")))
+    role = str(values.get("AIOS_GITOPS_WORKSPACE_ROLE", "")).strip().lower()
+    if canonical == controller or role == "runtime-anchor":
+        return GitWriteDecision(False, 423, "runtime_anchor_read_only", "controller/runtime-anchor is read-only", str(canonical))
+    writer_root = _real(Path(values.get("AIOS_GITOPS_APPROVED_WRITER_ROOT", "/data/aios-gitops/worktrees")))
+    try:
+        canonical.relative_to(writer_root)
+    except ValueError:
+        return GitWriteDecision(False, 409, "workspace_not_approved_writer", "workspace is outside the approved writer root", str(canonical))
+    return GitWriteDecision(True, 200, "", "approved isolated writer", str(canonical))

active-runtime/app/aios_isolated_writer_api.py

@@ -0,0 +1,316 @@
+"""Task-scoped hardened wrapper around the existing Action API."""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+from pathlib import Path
+import urllib.parse
+
+import aios_chatgpt_actions_api as api
+import aios_isolated_writer_policy as policy
+from isolated_writer_authz import AuthorizationError, authorize
+from isolated_writer_commit_file import AtomicCommitFile, CommitFileError, OperationLedger
+from isolated_writer_token_registry import TokenRegistry
+
+_reject = api.reject_non_read_http
+_write_file = api.write_file
+_sync_branch = api.sync_branch
+_original_do_get = api.H.do_GET
+api.OPENAPI = Path(os.getenv("AIOS_GITOPS_ISOLATED_WRITER_OPENAPI", str(api.OPENAPI)))
+
+
+def _registry() -> TokenRegistry:
+    return TokenRegistry(Path(os.environ["AIOS_GITOPS_TOKEN_REGISTRY_V2"]))
+
+
+def _atomic_writer() -> AtomicCommitFile:
+    return AtomicCommitFile(
+        workspace=api.WS,
+        bare_repo=api.BARE_REPO,
+        ledger=OperationLedger(Path(os.environ["AIOS_GITOPS_WRITER_OPERATION_LEDGER"])),
+        remote=os.getenv("AIOS_GITOPS_GITEA_PUSH_REMOTE", ""),
+        audit=policy.append_audit_record,
+    )
+
+
+def _bearer(handler) -> str:
+    value = handler.headers.get("Authorization", "")
+    return value[7:].strip() if value.startswith("Bearer ") else ""
+
+
+def _authorize(handler, *, method: str, path: str, branch=None, target_path=None):
+    grant = authorize(
+        _registry(),
+        _bearer(handler),
+        method=method,
+        path=path,
+        source_ip=str(handler.client_address[0]),
+        workspace=api.WS,
+        branch=branch,
+        target_path=target_path,
+    )
+    grant.record["_source_ip"] = str(handler.client_address[0])
+    return grant
+
+
+def _authorization_error(handler, exc: AuthorizationError):
+    return handler.sendj({"error": exc.code}, exc.status)
+
+
+def _isolated_runtime_status(handler):
+    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
+    head = api.sh(["rev-parse", "HEAD"], True)["stdout"]
+    return handler.sendj({
+        "service": os.getenv(
+            "AIOS_GITOPS_SERVICE_AUDIENCE",
+            "aios-isolated-writer.service",
+        ),
+        "status": "active",
+        "runtime_role": os.getenv("AIOS_GITOPS_RUNTIME_ROLE"),
+        "workspace_role": os.getenv("AIOS_GITOPS_WORKSPACE_ROLE"),
+        "writes_enabled": os.getenv("AIOS_GITOPS_WRITES_ENABLED", "").lower()
+        in {"1", "true", "yes", "on"},
+        "allowed_branch": policy.allowed_branch(),
+        "approved_base_oid": policy.allowed_base_oid(),
+        "workspace_branch": branch,
+        "workspace_head_oid": head,
+        "repository_identity": os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY"),
+        "token_policy_version": 2,
+        "atomic_commit_file": True,
+        "path_policy_sha256": policy.configured_path_policy_sha256(),
+    })
+
+
+def _isolated_do_get(self):
+    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+    if path in {"/health", "/api/health"}:
+        return self.sendj({
+            "status": "ok",
+            "service": os.getenv(
+                "AIOS_GITOPS_SERVICE_AUDIENCE",
+                "aios-isolated-writer.service",
+            ),
+        })
+    if path not in {"/api/runtime-status", "/api/baseline", "/api/patches"}:
+        return self.sendj({"error": "isolated_writer_operation_forbidden"}, 403)
+    try:
+        _authorize(self, method="GET", path=path)
+    except AuthorizationError as exc:
+        return _authorization_error(self, exc)
+    if path == "/api/runtime-status":
+        return _isolated_runtime_status(self)
+    return _original_do_get(self)
+
+
+def _read_commit_file_body(handler):
+    try:
+        length = int(handler.headers.get("Content-Length", "0"))
+    except ValueError:
+        raise CommitFileError("writer_content_length_rejected") from None
+    if length <= 0:
+        raise CommitFileError("writer_request_object_required")
+    if length > 1_100_000:
+        raise CommitFileError("writer_request_too_large", 413)
+    raw = handler.rfile.read(length)
+    try:
+        value = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        raise CommitFileError("writer_request_json_rejected") from None
+    if not isinstance(value, dict):
+        raise CommitFileError("writer_request_object_required")
+    return value
+
+
+def _isolated_do_post(self):
+    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+    if path != "/api/commit-file":
+        return self.sendj({"error": "isolated_writer_operation_forbidden"}, 403)
+    try:
+        data = _read_commit_file_body(self)
+        branch = str(data.get("branch") or "")
+        target_path = str(data.get("path") or "")
+        grant = _authorize(
+            self,
+            method="POST",
+            path=path,
+            branch=branch,
+            target_path=target_path,
+        )
+        if api.content_has_secret(str(data.get("content") or "")):
+            raise CommitFileError("writer_secret_content_rejected", 403)
+        result = _atomic_writer().execute(grant, data)
+        return self.sendj(result)
+    except AuthorizationError as exc:
+        return _authorization_error(self, exc)
+    except CommitFileError as exc:
+        return self.sendj({"error": exc.code}, exc.status)
+    except PermissionError:
+        return self.sendj({"error": "isolated_writer_policy_rejected"}, 403)
+
+
+def reject_non_read_http(handler, method: str, path: str) -> bool:
+    if _reject(handler, method, path):
+        return True
+    try:
+        policy.validate_endpoint(method, path, api.WS, api.BARE_REPO)
+        return False
+    except PermissionError as exc:
+        handler.sendj({"error": str(exc)}, 403)
+        return True
+
+
+def checkout(branch, base="main", create=False):
+    api.ensure_git()
+    target = api.branch_name(branch)
+    policy.validate_branch_request({"branch": target, "base": base})
+    exists = api.sh(["rev-parse", "--verify", target])["code"] == 0
+    if exists:
+        if api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"] != target:
+            api.sh(["checkout", target], True)
+    elif create:
+        api.sh(["checkout", "-b", target, base], True)
+    else:
+        raise PermissionError("isolated_writer_branch_missing")
+    policy.require_service_invariants(api.WS, api.BARE_REPO)
+    return target
+
+
+def write_file(path, content):
+    policy.validate_path(path, api.WS)
+    return _write_file(path, content)
+
+
+def sync_branch(branch: str):
+    policy.validate_sync_branch(branch)
+    local = _sync_branch(branch)
+    remote = os.getenv("AIOS_GITOPS_GITEA_PUSH_REMOTE", "").strip()
+    if remote != "gitea-http":
+        raise PermissionError("isolated_writer_gitea_remote_rejected")
+    head = api.sh(["rev-parse", "HEAD"], True)["stdout"]
+    pushed = subprocess.run(
+        ["git", "push", "--porcelain", remote, f"HEAD:refs/heads/{branch}"],
+        cwd=api.WS,
+        text=True,
+        capture_output=True,
+    )
+    if pushed.returncode != 0:
+        raise RuntimeError("isolated_writer_gitea_push_failed")
+    verified = subprocess.run(
+        ["git", "ls-remote", "--heads", remote, f"refs/heads/{branch}"],
+        cwd=api.WS,
+        text=True,
+        capture_output=True,
+    )
+    if verified.returncode != 0:
+        raise RuntimeError("isolated_writer_gitea_verification_failed")
+    fields = verified.stdout.strip().split()
+    if len(fields) != 2 or fields[0] != head or fields[1] != f"refs/heads/{branch}":
+        raise RuntimeError("isolated_writer_gitea_oid_mismatch")
+    return {
+        "status": "verified",
+        "target": "authoritative-bare+gitea",
+        "branch": branch,
+        "oid": head,
+        "local": local.get("status"),
+    }
+
+
+def commit(paths, msg):
+    policy.validate_commit_paths(paths, api.WS)
+    api.ensure_git()
+    selected = [api.relpath(p) for p in paths] if paths else ["."]
+    api.sh(["add", *selected], True)
+    policy.validate_staged_paths(api.WS)
+    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
+    if not api.sh(["status", "--short"])["stdout"]:
+        return {"status": "no_changes", "branch": branch, "sync": sync_branch(branch)}
+    out = api.sh(["commit", "-m", msg], True)
+    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
+    return {
+        "status": "committed",
+        "branch": branch,
+        "rev": api.sh(["rev-parse", "--short", "HEAD"], True)["stdout"],
+        "git": out,
+        "sync": sync_branch(branch),
+    }
+
+
+def audit(actor, action, target, payload):
+    policy.append_audit_record(
+        {
+            "at": api.now(),
+            "actor": actor,
+            "action": action,
+            "target": target,
+            "payload": api.sanitize(payload),
+        }
+    )
+
+
+def _validate_request(self, data, validate):
+    try:
+        validate(data)
+        return True
+    except PermissionError as exc:
+        self.sendj({"error": str(exc)}, 403)
+        return False
+
+
+def _checked_branch(self, data):
+    if not _validate_request(self, data, policy.validate_branch_request):
+        return
+    return _branch(self, data)
+
+
+def _checked_file(self, data):
+    data = dict(data)
+    data.setdefault("branch", policy.allowed_branch())
+    if not _validate_request(self, data, policy.validate_branch_request):
+        return
+    if not _validate_request(
+        self,
+        {"path": data.get("path", "")},
+        lambda item: policy.validate_path(item["path"], api.WS),
+    ):
+        return
+    return _file(self, data)
+
+
+def _checked_commit(self, data):
+    data = dict(data)
+    data.setdefault("branch", policy.allowed_branch())
+    if not _validate_request(self, data, policy.validate_branch_request):
+        return
+    return _commit(self, data)
+
+
+def _checked_patch(self, data):
+    data = dict(data)
+    data["branch"] = policy.allowed_branch()
+    if not _validate_request(self, data, policy.validate_branch_request):
+        return
+    return _patch(self, data)
+
+
+_branch, _file, _commit, _patch = api.H.branch, api.H.file, api.H.commit, api.H.patch
+api.reject_non_read_http = reject_non_read_http
+api.checkout, api.write_file, api.sync_branch, api.commit, api.audit = (
+    checkout,
+    write_file,
+    sync_branch,
+    commit,
+    audit,
+)
+api.H.branch, api.H.file, api.H.commit, api.H.patch = (
+    _checked_branch,
+    _checked_file,
+    _checked_commit,
+    _checked_patch,
+)
+api.H.do_GET = _isolated_do_get
+api.H.do_POST = _isolated_do_post
+
+if __name__ == "__main__":
+    policy.require_service_invariants(api.WS, api.BARE_REPO)
+    api.ThreadingHTTPServer((api.HOST, api.PORT), api.H).serve_forever()

active-runtime/app/aios_isolated_writer_api/__init__.py

@@ -0,0 +1,23 @@
+"""Task-bound Integration Refresh control-plane primitives."""
+
+from .integration_merge_writer import IntegrationMergeWriter, MergeError, MergeRequest
+from .integration_refresh import (
+    AppendOnlyAudit,
+    Binding,
+    GiteaBranchReadProjection,
+    GrantStore,
+    IntegrationRefreshProvisioner,
+    ProvisioningError,
+)
+
+__all__ = [
+    "AppendOnlyAudit",
+    "Binding",
+    "GiteaBranchReadProjection",
+    "GrantStore",
+    "IntegrationMergeWriter",
+    "IntegrationRefreshProvisioner",
+    "MergeError",
+    "MergeRequest",
+    "ProvisioningError",
+]

active-runtime/app/aios_isolated_writer_api/integration_merge_writer.py

@@ -0,0 +1,90 @@
+"""Constrained integration-only merge writer with rollback and reconciliation states."""
+from __future__ import annotations
+
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+import re
+
+
+class MergeError(RuntimeError):
+    def __init__(self, code: str, status: int = 409):
+        super().__init__(code); self.code, self.status = code, status
+
+
+@dataclass(frozen=True)
+class MergeRequest:
+    integration_branch: str
+    source_branch: str
+    approved_source_oid: str
+
+
+class IntegrationMergeWriter:
+    def __init__(self, workspace: Path | str, remote: str, projection):
+        self.workspace, self.remote, self.projection = Path(workspace), remote, projection
+
+    def _git(self, *args: str, check=True) -> str:
+        p = subprocess.run(["git", *args], cwd=self.workspace, text=True, capture_output=True)
+        if check and p.returncode:
+            raise MergeError("git_operation_failed", 500)
+        return p.stdout.strip()
+
+    def merge(self, request: MergeRequest) -> dict:
+        def bad(value: str) -> bool:
+            return (
+                value == "main"
+                or value.startswith("main/")
+                or value == "governance"
+                or value.startswith("governance/")
+                or value == "approvals"
+                or value.startswith("refs/")
+                or value.startswith("tags/")
+            )
+        if (bad(request.integration_branch) or bad(request.source_branch) or
+                not request.integration_branch.startswith("integration/") or
+                re.fullmatch(r"[0-9a-fA-F]{40}", request.approved_source_oid) is None):
+            raise MergeError("integration_merge_scope_rejected", 403)
+        for branch in (request.integration_branch, request.source_branch):
+            if subprocess.run(["git", "check-ref-format", "--branch", branch], cwd=self.workspace,
+                              text=True, capture_output=True).returncode:
+                raise MergeError("integration_merge_scope_rejected", 403)
+        if self._git("rev-parse", "--abbrev-ref", "HEAD") != request.integration_branch:
+            raise MergeError("integration_branch_checkout_required")
+        before = self._git("rev-parse", "HEAD")
+        remote_before = self.projection(request.integration_branch)
+        if remote_before != before:
+            raise MergeError("integration_remote_advanced")
+        source = self._git("rev-parse", "--verify", f"refs/heads/{request.source_branch}^{{commit}}")
+        if source != request.approved_source_oid:
+            raise MergeError("integration_source_not_approved", 403)
+        attempt = subprocess.run(["git", "merge", "--no-ff", "--no-commit", request.source_branch], cwd=self.workspace, text=True, capture_output=True)
+        if attempt.returncode:
+            subprocess.run(["git", "merge", "--abort"], cwd=self.workspace, text=True, capture_output=True)
+            raise MergeError("integration_merge_conflict")
+        try:
+            self._git("commit", "-m", "merge(integration): approved source")
+            merged = self._git("rev-parse", "HEAD")
+            parents = self._git("show", "-s", "--format=%P", "HEAD").split()
+            if parents != [before, source]:
+                raise MergeError("integration_parent_invariant_failed", 500)
+            pushed = subprocess.run(["git", "push", "--porcelain", self.remote, f"HEAD:refs/heads/{request.integration_branch}"], cwd=self.workspace, text=True, capture_output=True)
+            if pushed.returncode:
+                try:
+                    observed = self.projection(request.integration_branch)
+                except Exception:
+                    return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+                if observed == before:
+                    self._git("reset", "--hard", before)
+                    return {"state": "PUSH_FAILED_RESTORED", "pre_merge_oid": before}
+                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+            try:
+                observed = self.projection(request.integration_branch)
+            except Exception:
+                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+            if observed != merged:
+                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+            return {"state": "COMPLETED", "pre_merge_oid": before, "merge_oid": merged}
+        except MergeError:
+            if self._git("rev-parse", "HEAD") != before:
+                self._git("reset", "--hard", before)
+            raise

active-runtime/app/aios_isolated_writer_api/integration_refresh.py

@@ -0,0 +1,257 @@
+"""Fail-closed, task-bound integration refresh provisioning primitives.
+
+This module deliberately has no HTTP or credential-provider dependency.  The
+caller supplies a branch-read projection and an apply callback, making the
+authorization and recovery boundary independently testable.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import argparse
+import secrets
+import sqlite3
+import threading
+import re
+from contextlib import contextmanager
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Callable
+
+
+class ProvisioningError(RuntimeError):
+    def __init__(self, code: str, status: int = 403):
+        super().__init__(code)
+        self.code, self.status = code, status
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _digest(secret: str) -> str:
+    return hashlib.sha256(secret.encode("utf-8")).hexdigest()
+
+
+def _canonical(value: dict) -> str:
+    return hashlib.sha256(json.dumps(value, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+
+
+def _is_oid(value: object) -> bool:
+    return isinstance(value, str) and re.fullmatch(r"[0-9a-fA-F]{40}", value) is not None
+
+
+@dataclass(frozen=True)
+class Binding:
+    task_id: str
+    repository: str
+    branch: str
+    actor_identity: str
+    audience: str
+    paths: tuple[str, ...]
+    quota: int
+
+
+class AppendOnlyAudit:
+    """Append only redacted JSONL audit, durable before a result is returned."""
+    def __init__(self, path: Path | str):
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.Lock()
+
+    def append(self, event: dict) -> None:
+        with self._lock:
+            safe = {key: value for key, value in event.items() if key not in {"token", "credential", "authorization"}}
+            previous = "0" * 64
+            if self.path.exists():
+                lines = self.path.read_text(encoding="utf-8").splitlines()
+                if lines:
+                    previous = json.loads(lines[-1])["event_hash"]
+            safe["previous_event_hash"] = previous
+            safe["event_hash"] = _canonical(safe)
+            encoded = (json.dumps(safe, sort_keys=True, separators=(",", ":")) + "\n").encode()
+            fd = os.open(self.path, os.O_APPEND | os.O_CREAT | os.O_WRONLY, 0o600)
+            try:
+                os.write(fd, encoded)
+                os.fsync(fd)
+            finally:
+                os.close(fd)
+
+
+class GrantStore:
+    """Digest-only short grant registry; SQLite transactions serialize quota use."""
+    def __init__(self, path: Path | str):
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        with self._db() as db:
+            db.execute("""CREATE TABLE IF NOT EXISTS grants(
+                token_digest TEXT PRIMARY KEY, binding_json TEXT NOT NULL,
+                expires_at TEXT NOT NULL, quota INTEGER NOT NULL, uses INTEGER NOT NULL,
+                revoked INTEGER NOT NULL DEFAULT 0)""")
+
+    @contextmanager
+    def _db(self):
+        db = sqlite3.connect(self.path, timeout=15, isolation_level=None)
+        db.row_factory = sqlite3.Row
+        try:
+            yield db
+        finally:
+            db.close()
+
+    def issue(self, binding: Binding, *, ttl_seconds: int = 300) -> str:
+        if ttl_seconds < 1 or ttl_seconds > 1800 or binding.quota < 1 or not binding.paths:
+            raise ValueError("invalid_short_grant")
+        token = secrets.token_urlsafe(32)
+        payload = json.dumps(binding.__dict__ | {"paths": list(binding.paths)}, sort_keys=True)
+        with self._db() as db:
+            db.execute("INSERT INTO grants VALUES(?,?,?,?,?,0)", (_digest(token), payload,
+                (_now() + timedelta(seconds=ttl_seconds)).isoformat(), binding.quota, 0))
+        return token
+
+    def rotate(self, old_token: str, binding: Binding, *, revocation_probe, ttl_seconds: int = 300) -> str:
+        self.revoke(old_token)
+        try: status = revocation_probe(old_token)
+        except TimeoutError as exc: raise ProvisioningError("revocation_probe_timeout", 503) from exc
+        if status != 401: raise ProvisioningError("revocation_probe_rejected", 503)
+        return self.issue(binding, ttl_seconds=ttl_seconds)
+
+    def revoke(self, token: str) -> None:
+        with self._db() as db:
+            db.execute("BEGIN IMMEDIATE")
+            db.execute("UPDATE grants SET revoked=1 WHERE token_digest=?", (_digest(token),))
+            db.execute("COMMIT")
+
+    def consume(self, token: str, binding: Binding, path: str) -> None:
+        with self._db() as db:
+            db.execute("BEGIN IMMEDIATE")
+            row = db.execute("SELECT * FROM grants WHERE token_digest=?", (_digest(token),)).fetchone()
+            if not row or row["revoked"]:
+                db.execute("ROLLBACK"); raise ProvisioningError("credential_rejected", 401)
+            if _now() >= datetime.fromisoformat(row["expires_at"]):
+                db.execute("ROLLBACK"); raise ProvisioningError("credential_expired", 401)
+            stored = json.loads(row["binding_json"])
+            requested = binding.__dict__ | {"paths": list(binding.paths)}
+            if stored != requested or path not in stored["paths"]:
+                db.execute("ROLLBACK"); raise ProvisioningError("grant_binding_rejected")
+            if row["uses"] >= row["quota"]:
+                db.execute("ROLLBACK"); raise ProvisioningError("grant_quota_exhausted")
+            db.execute("UPDATE grants SET uses=uses+1 WHERE token_digest=?", (_digest(token),))
+            db.execute("COMMIT")
+
+
+class GiteaBranchReadProjection:
+    """Normalizes a trusted task-scoped Gitea reader; every ambiguity fails closed."""
+    def __init__(self, reader: Callable[[str, str], dict]):
+        self.reader = reader
+
+    def head(self, repository: str, branch: str) -> str:
+        try:
+            reply = self.reader(repository, branch)
+        except TimeoutError as exc:
+            raise ProvisioningError("gitea_projection_timeout", 503) from exc
+        except Exception as exc:
+            raise ProvisioningError("gitea_projection_unavailable", 503) from exc
+        if not isinstance(reply, dict) or reply.get("status") in {401, 403}:
+            raise ProvisioningError("gitea_projection_forbidden", 503)
+        oid = reply.get("oid")
+        if reply.get("status") != 200 or not _is_oid(oid):
+            raise ProvisioningError("gitea_projection_invalid", 503)
+        return oid.lower()
+
+
+class IntegrationRefreshProvisioner:
+    _locks: dict[tuple[str, str], threading.Lock] = {}
+    _locks_guard = threading.Lock()
+
+    def __init__(self, *, grants: GrantStore, projection: GiteaBranchReadProjection,
+                 ledger_path: Path | str, audit: AppendOnlyAudit, approved_binding: Binding):
+        self.grants, self.projection, self.audit, self.approved_binding = grants, projection, audit, approved_binding
+        self.ledger_path = Path(ledger_path); self.ledger_path.parent.mkdir(parents=True, exist_ok=True)
+        with self._ledger() as db:
+            db.execute("CREATE TABLE IF NOT EXISTS refreshes(operation_id TEXT PRIMARY KEY, digest TEXT NOT NULL, state TEXT NOT NULL, result_oid TEXT)")
+
+    @contextmanager
+    def _ledger(self):
+        db = sqlite3.connect(self.ledger_path)
+        try:
+            yield db
+            db.commit()
+        finally:
+            db.close()
+
+    def refresh(self, *, token: str, binding: Binding, path: str, operation_id: str,
+                target_head_oid: str, apply: Callable[[], str]) -> dict:
+        if not operation_id or not _is_oid(target_head_oid):
+            raise ProvisioningError("refresh_request_rejected")
+        if binding != self.approved_binding:
+            raise ProvisioningError("grant_binding_rejected")
+        request = {"binding": binding.__dict__ | {"paths": list(binding.paths)}, "path": path, "target": target_head_oid}
+        digest = _canonical(request)
+        with self._locks_guard:
+            lock = self._locks.setdefault((binding.repository, binding.branch), threading.Lock())
+        with lock, self._ledger() as db:
+            db.execute("BEGIN IMMEDIATE")
+            row = db.execute("SELECT * FROM refreshes WHERE operation_id=?", (operation_id,)).fetchone()
+            new_operation = row is None
+            if row:
+                if row[1] != digest:
+                    db.execute("ROLLBACK"); raise ProvisioningError("operation_id_reuse_rejected", 409)
+                if row[2] == "COMPLETED":
+                    db.execute("COMMIT")
+                    return {"state": row[2], "operation_id": operation_id, "oid": row[3], "idempotent": True}
+                if row[2] not in {"PENDING", "RECOVERABLE"}:
+                    db.execute("COMMIT")
+                    return {"state": row[2], "operation_id": operation_id, "oid": row[3], "idempotent": True}
+            else:
+                db.execute("INSERT INTO refreshes VALUES(?,?,?,NULL)", (operation_id, digest, "PENDING"))
+            db.execute("COMMIT")
+            if new_operation:
+                self.grants.consume(token, binding, path)
+            current = self.projection.head(binding.repository, binding.branch)
+            if current != target_head_oid.lower():
+                self._state(operation_id, "STALE_TARGET")
+                raise ProvisioningError("stale_target_head", 409)
+            try:
+                oid = apply()
+                if not _is_oid(oid):
+                    raise ProvisioningError("apply_result_invalid", 500)
+                # Detect a competing remote advancement before claiming completion.
+                observed = self.projection.head(binding.repository, binding.branch)
+                if observed != oid.lower():
+                    self._state(operation_id, "RECONCILIATION_REQUIRED")
+                    raise ProvisioningError("remote_concurrent_advance", 409)
+                self._state(operation_id, "COMPLETED", oid)
+                self.audit.append({"operation_id": operation_id, "task_id": binding.task_id, "repository": binding.repository,
+                                   "branch": binding.branch, "actor_identity": binding.actor_identity, "audience": binding.audience, "path": path, "state": "COMPLETED"})
+                return {"state": "COMPLETED", "operation_id": operation_id, "oid": oid, "idempotent": False}
+            except ProvisioningError:
+                raise
+            except Exception as exc:
+                self._state(operation_id, "RECOVERABLE")
+                self.audit.append({"operation_id": operation_id, "task_id": binding.task_id, "repository": binding.repository,
+                                   "branch": binding.branch, "actor_identity": binding.actor_identity, "audience": binding.audience, "path": path, "state": "RECOVERABLE"})
+                raise ProvisioningError("refresh_apply_failed", 503) from exc
+
+    def _state(self, operation_id: str, state: str, oid: str | None = None) -> None:
+        with self._ledger() as db:
+            db.execute("UPDATE refreshes SET state=?, result_oid=COALESCE(?,result_oid) WHERE operation_id=?", (state, oid, operation_id))
+
+
+def _sandbox_preflight(state_dir: Path) -> int:
+    if os.environ.get("AIOS_GITOPS_WRITES_ENABLED") != "false":
+        raise ProvisioningError("global_gitops_writes_must_remain_disabled", 500)
+    state_dir.mkdir(parents=True, exist_ok=True)
+    audit = AppendOnlyAudit(state_dir / "preflight-audit.jsonl")
+    audit.append({"event": "SANDBOX_PREFLIGHT", "writes_enabled": False})
+    print(json.dumps({"status": "READY", "mode": "sandbox", "writes_enabled": False}, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--sandbox-preflight", action="store_true", required=True)
+    parser.add_argument("--state-dir", type=Path, required=True)
+    options = parser.parse_args()
+    raise SystemExit(_sandbox_preflight(options.state_dir))

active-runtime/app/aios_isolated_writer_policy.py

@@ -0,0 +1,310 @@
+"""Fail-closed policy used only by the task-scoped Action writer."""
+from __future__ import annotations
+
+import os
+import json
+import stat
+import subprocess
+import re
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from urllib.parse import unquote
+
+import isolated_writer_path_policy as path_policy
+
+WRITE_ENDPOINTS = frozenset({"/api/commit-file"})
+ALLOWED_ROOTS = (
+    "active-runtime",
+    "docs",
+    "patches",
+    "reports",
+    "scripts",
+    "test",
+    "tests",
+)
+DENIED_ROOTS = ("baseline", "config", "deploy", "deployments", "ops", "runtime", "services")
+_TRUE = frozenset({"1", "true", "yes", "on"})
+_FALSE = frozenset({"0", "false", "no", "off"})
+_DENY_FLAGS = (
+    "AIOS_GITOPS_ALLOW_MAIN_WRITE",
+    "AIOS_GITOPS_ALLOW_TAG_WRITE",
+    "AIOS_GITOPS_ALLOW_BASELINE_WRITE",
+    "AIOS_GITOPS_ALLOW_REGISTRY_WRITE",
+    "AIOS_GITOPS_ALLOW_ROLLBACK",
+    "AIOS_GITOPS_ALLOW_DEPLOYMENT",
+)
+
+
+def enforcement_required() -> bool:
+    return os.getenv("AIOS_GITOPS_ISOLATED_WRITER_ENFORCEMENT", "") == "required"
+
+
+def allowed_branch() -> str:
+    value = os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", "").strip()
+    if not value:
+        raise PermissionError("isolated_writer_missing_allowed_branch")
+    return value
+
+
+def allowed_base_oid() -> str:
+    value = os.getenv("AIOS_GITOPS_ALLOWED_BASE_OID", "").strip().lower()
+    if len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
+        raise PermissionError("isolated_writer_invalid_allowed_base_oid")
+    return value
+
+
+def _git(workspace: Path, *args: str) -> str:
+    result = subprocess.run(["git", *args], cwd=workspace, text=True, capture_output=True)
+    if result.returncode != 0:
+        raise PermissionError("isolated_writer_git_validation_failed")
+    return result.stdout.strip()
+
+
+def require_service_invariants(workspace: Path, bare_repo: Path) -> None:
+    if not enforcement_required():
+        return
+    if os.getenv("AIOS_GITOPS_WRITES_ENABLED", "").strip().lower() not in _TRUE:
+        raise PermissionError("isolated_writer_write_gate_required")
+    if os.getenv("AIOS_GITOPS_RUNTIME_ROLE", "") != "isolated-writer":
+        raise PermissionError("isolated_writer_role_required")
+    if os.getenv("AIOS_GITOPS_WORKSPACE_ROLE", "") != "isolated-writer":
+        raise PermissionError("isolated_writer_workspace_role_required")
+    if os.getenv("AIOS_GITOPS_TOKEN_POLICY_VERSION_REQUIRED", "") != "2":
+        raise PermissionError("isolated_writer_token_policy_v2_required")
+    if not os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", "").strip():
+        raise PermissionError("isolated_writer_service_audience_required")
+    if not os.getenv("AIOS_GITOPS_TOKEN_REGISTRY_V2", "").strip():
+        raise PermissionError("isolated_writer_token_registry_required")
+    if not os.getenv("AIOS_GITOPS_WRITER_OPERATION_LEDGER", "").strip():
+        raise PermissionError("isolated_writer_operation_ledger_required")
+    path_policy.configured_path_policy()
+    for name in _DENY_FLAGS:
+        if os.getenv(name, "").strip().lower() not in _FALSE:
+            raise PermissionError("isolated_writer_forbidden_capability_flag")
+    if os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "") != "aios/aios":
+        raise PermissionError("isolated_writer_repository_identity_rejected")
+    configured_bare_value = os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "").strip()
+    if not configured_bare_value:
+        raise PermissionError("isolated_writer_authoritative_repo_rejected")
+    configured_bare = Path(configured_bare_value)
+    if configured_bare.resolve(strict=True) != bare_repo.resolve(strict=True):
+        raise PermissionError("isolated_writer_authoritative_repo_rejected")
+    writer_root_value = os.getenv("AIOS_GITOPS_APPROVED_WRITER_ROOT", "").strip()
+    if not writer_root_value:
+        raise PermissionError("isolated_writer_workspace_outside_approved_root")
+    writer_root = Path(writer_root_value).resolve(strict=True)
+    lexical_workspace = Path(os.path.abspath(str(workspace)))
+    canonical_workspace = lexical_workspace.resolve(strict=True)
+    if lexical_workspace != canonical_workspace:
+        raise PermissionError("isolated_writer_workspace_symlink_rejected")
+    try:
+        canonical_workspace.relative_to(writer_root)
+    except (ValueError, FileNotFoundError):
+        raise PermissionError("isolated_writer_workspace_outside_approved_root") from None
+    if _git(workspace, "rev-parse", "--abbrev-ref", "HEAD") != allowed_branch():
+        raise PermissionError("isolated_writer_current_branch_rejected")
+    approved_base = allowed_base_oid()
+    try:
+        _git(workspace, "cat-file", "-e", f"{approved_base}^{{commit}}")
+        subprocess.run(
+            ["git", "merge-base", "--is-ancestor", approved_base, "HEAD"],
+            cwd=workspace,
+            check=True,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+    except (PermissionError, subprocess.CalledProcessError):
+        raise PermissionError("isolated_writer_approved_base_not_ancestor") from None
+    if _git(workspace, "merge-base", approved_base, "HEAD") != approved_base:
+        raise PermissionError("isolated_writer_merge_base_rejected")
+    common = Path(_git(workspace, "rev-parse", "--git-common-dir"))
+    if not common.is_absolute():
+        common = (workspace / common).resolve()
+    if common.resolve() != bare_repo.resolve():
+        raise PermissionError("isolated_writer_common_repo_rejected")
+
+
+def approved_audit_log_path() -> Path:
+    root_value = os.getenv("AIOS_GITOPS_APPROVED_AUDIT_ROOT", "").strip()
+    log_value = os.getenv("AIOS_GITOPS_AUDIT_LOG", "").strip()
+    if not root_value or not log_value:
+        raise PermissionError("isolated_writer_audit_path_missing")
+    lexical_root = Path(os.path.abspath(root_value))
+    lexical_log = Path(os.path.abspath(log_value))
+    root = lexical_root.resolve(strict=True)
+    if lexical_root != root or root.is_symlink() or not root.is_dir():
+        raise PermissionError("isolated_writer_audit_root_rejected")
+    try:
+        lexical_log.relative_to(root)
+    except ValueError:
+        raise PermissionError("isolated_writer_audit_path_outside_approved_root") from None
+    if lexical_log.parent.resolve(strict=True) != lexical_log.parent:
+        raise PermissionError("isolated_writer_audit_parent_symlink_rejected")
+    if lexical_log.exists() and lexical_log.is_symlink():
+        raise PermissionError("isolated_writer_audit_log_symlink_rejected")
+    os.chmod(root, 0o750)
+    os.chmod(lexical_log.parent, 0o750)
+    return lexical_log
+
+
+def append_audit_record(record: dict) -> None:
+    path = approved_audit_log_path()
+    flags = os.O_WRONLY | os.O_APPEND | os.O_CREAT
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    descriptor = os.open(path, flags, 0o600)
+    try:
+        info = os.fstat(descriptor)
+        if not stat.S_ISREG(info.st_mode):
+            raise PermissionError("isolated_writer_audit_log_not_regular")
+        os.fchmod(descriptor, 0o600)
+        line = json.dumps(
+            _audit_sanitize(record),
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+        ).encode("utf-8") + b"\n"
+        os.write(descriptor, line)
+        os.fsync(descriptor)
+    finally:
+        os.close(descriptor)
+    parent_fd = os.open(path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
+    try:
+        os.fsync(parent_fd)
+    finally:
+        os.close(parent_fd)
+
+
+def _audit_sanitize(value):
+    if isinstance(value, dict):
+        return {
+            key: (
+                "[REDACTED]"
+                if any(
+                    marker in str(key).lower()
+                    for marker in (
+                        "authorization",
+                        "credential",
+                        "password",
+                        "secret",
+                        "token",
+                        "private_key",
+                    )
+                )
+                and str(key).lower() != "token_id"
+                else _audit_sanitize(inner)
+            )
+            for key, inner in value.items()
+        }
+    if isinstance(value, list):
+        return [_audit_sanitize(item) for item in value]
+    if isinstance(value, str) and re.search(
+        r"(?i)(authorization\s*:\s*bearer|(?:token|password|secret)\s*[:=])",
+        value,
+    ):
+        return "[REDACTED]"
+    return value
+
+
+def validate_endpoint(method: str, path: str, workspace: Path, bare_repo: Path) -> None:
+    if not enforcement_required():
+        return
+    if method != "POST" or path not in WRITE_ENDPOINTS:
+        raise PermissionError("isolated_writer_operation_forbidden")
+    require_service_invariants(workspace, bare_repo)
+
+
+def validate_branch_request(data: dict) -> None:
+    if not enforcement_required():
+        return
+    branch = allowed_branch() if "branch" not in data else str(data.get("branch") or "").strip()
+    if branch != allowed_branch():
+        raise PermissionError("isolated_writer_branch_rejected")
+    if str(data.get("base", "main")).strip() != "main":
+        raise PermissionError("isolated_writer_base_rejected")
+    if data.get("force") or data.get("force_push"):
+        raise PermissionError("isolated_writer_force_rejected")
+
+
+def validate_path(path: str, workspace: Path | None = None) -> str:
+    if not isinstance(path, str):
+        raise PermissionError("isolated_writer_path_rejected")
+    value = path
+    if not value or value != value.strip() or "\x00" in value or "\\" in value:
+        raise PermissionError("isolated_writer_path_rejected")
+    try:
+        decoded = unquote(value, errors="strict")
+    except (UnicodeDecodeError, ValueError):
+        raise PermissionError("isolated_writer_path_rejected") from None
+    if decoded != value:
+        raise PermissionError("isolated_writer_path_rejected")
+    windows = PureWindowsPath(value)
+    posix = PurePosixPath(value)
+    parts = value.split("/")
+    if (
+        posix.is_absolute()
+        or windows.is_absolute()
+        or bool(windows.drive)
+        or any(part in {"", ".", ".."} for part in parts)
+    ):
+        raise PermissionError("isolated_writer_path_rejected")
+    first = parts[0]
+    service_exact_path = False
+    if first in DENIED_ROOTS:
+        try:
+            path_policy.require_service_path("commit_file.atomic", value)
+            service_exact_path = True
+        except path_policy.PathPolicyError as exc:
+            raise PermissionError(str(exc)) from None
+    if value != "README.md" and first not in ALLOWED_ROOTS and not service_exact_path:
+        raise PermissionError("isolated_writer_path_outside_allowed_roots")
+    if workspace is not None:
+        lexical_root = Path(os.path.abspath(str(workspace)))
+        root = lexical_root.resolve(strict=True)
+        if lexical_root != root:
+            raise PermissionError("isolated_writer_workspace_symlink_rejected")
+        current = root
+        for part in parts:
+            current = current / part
+            if current.is_symlink():
+                raise PermissionError("isolated_writer_path_symlink_rejected")
+        candidate = (root / value).resolve(strict=False)
+        try:
+            candidate.relative_to(root)
+        except ValueError:
+            raise PermissionError("isolated_writer_path_escapes_workspace") from None
+    return value
+
+
+def validate_content_for_path(path: str, content: str) -> None:
+    if path.split("/", 1)[0] not in DENIED_ROOTS:
+        return
+    try:
+        path_policy.validate_content("commit_file.atomic", path, content)
+    except path_policy.PathPolicyError as exc:
+        raise PermissionError(str(exc)) from None
+
+
+def configured_path_policy_sha256() -> str | None:
+    try:
+        return path_policy.configured_path_policy_sha256()
+    except path_policy.PathPolicyError as exc:
+        raise PermissionError(str(exc)) from None
+
+
+def validate_commit_paths(paths: list[str], workspace: Path | None = None) -> None:
+    if enforcement_required():
+        for path in paths:
+            if str(path).strip() != ".":
+                validate_path(str(path), workspace)
+
+
+def validate_staged_paths(workspace: Path) -> None:
+    if not enforcement_required():
+        return
+    for path in _git(workspace, "diff", "--cached", "--name-only").splitlines():
+        validate_path(path, workspace)
+
+
+def validate_sync_branch(branch: str) -> None:
+    if enforcement_required() and branch != allowed_branch():
+        raise PermissionError("isolated_writer_sync_branch_rejected")

active-runtime/app/authoritative_git.py

@@ -0,0 +1,355 @@
+"""Fail-closed access to the authoritative bare Git repository."""
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import urllib.parse
+from pathlib import Path
+from typing import Iterable
+
+_ALLOWED_COMMANDS = frozenset(
+    {
+        "cat-file",
+        "config",
+        "diff",
+        "for-each-ref",
+        "ls-remote",
+        "merge-base",
+        "push",
+        "remote",
+        "rev-parse",
+        "show-ref",
+        "tag",
+    }
+)
+_OID_RE = re.compile(r"^[0-9a-f]{40}$")
+_MAX_OUTPUT = 1_048_576
+_TIMEOUT = 8.0
+
+
+class AuthoritativeGitError(RuntimeError):
+    """A fail-closed authoritative repository or ref query error."""
+
+
+class AuthoritativeGitNotFound(AuthoritativeGitError):
+    """A validated revision does not exist in the authoritative repository."""
+
+
+class AuthoritativeGitOutputTooLarge(AuthoritativeGitError):
+    """A controlled Git query exceeded the response-size boundary."""
+
+
+def _redact(text: str) -> str:
+    value = str(text or "")
+    value = re.sub(r"(?i)(authorization\s*[:=]\s*)(?:bearer|token)\s+\S+", r"\1REDACTED", value)
+    value = re.sub(r"(?i)((?:access_)?token\s*[:=]\s*)\S+", r"\1REDACTED", value)
+    value = re.sub(r"(?i)(https?://[^/\s:@]+:)[^@\s/]+@", r"\1REDACTED@", value)
+    return value
+
+
+def _configured_path(git_dir: str | Path | None = None) -> Path:
+    raw = str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
+    if not raw:
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    path = Path(raw)
+    if not path.is_absolute() or ".." in path.parts:
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    try:
+        resolved = path.resolve(strict=True)
+    except OSError as exc:
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE") from exc
+    if not resolved.is_dir():
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    return resolved
+
+
+def _run(
+    git_dir: Path,
+    args: list[str],
+    *,
+    check: bool,
+    timeout: float = _TIMEOUT,
+) -> subprocess.CompletedProcess[str]:
+    if not args or args[0] not in _ALLOWED_COMMANDS:
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+    try:
+        result = subprocess.run(
+            ["git", "--git-dir", str(git_dir), *args],
+            text=True,
+            capture_output=True,
+            timeout=timeout,
+            env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED") from exc
+    if len(result.stdout) + len(result.stderr) > _MAX_OUTPUT:
+        raise AuthoritativeGitOutputTooLarge("GIT_OUTPUT_LIMIT_EXCEEDED")
+    if check and result.returncode != 0:
+        detail = _redact(result.stderr.strip() or result.stdout.strip())
+        raise AuthoritativeGitError(
+            "GIT_REF_QUERY_FAILED" + (f": {detail[:160]}" if detail else "")
+        )
+    return result
+
+
+def _repository_identity_from_remote(url: str) -> str:
+    value = str(url or "").strip().split("?", 1)[0].rstrip("/")
+    if not value:
+        return ""
+    if "://" in value:
+        value = urllib.parse.urlparse(value).path
+    elif ":" in value:
+        value = value.rsplit(":", 1)[1]
+    value = value.rsplit("@", 1)[-1].strip("/")
+    value = re.sub(r"\.git$", "", value, flags=re.IGNORECASE)
+    parts = [part for part in value.split("/") if part]
+    if len(parts) >= 2:
+        value = "/".join(parts[-2:])
+    return value.strip("/").lower()
+
+
+def verify_repository(
+    git_dir: str | Path | None = None,
+    repository_identity: str | None = None,
+) -> tuple[Path, str]:
+    path = _configured_path(git_dir)
+    expected = str(
+        repository_identity
+        or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
+    ).strip().strip("/")
+    if not expected or expected.count("/") != 1:
+        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
+    bare = _run(path, ["rev-parse", "--is-bare-repository"], check=True)
+    if bare.stdout.strip().lower() != "true":
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    remote = _run(path, ["config", "--get", "remote.gitea.url"], check=False)
+    actual = _repository_identity_from_remote(remote.stdout)
+    if actual != expected.lower():
+        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
+    return path, expected
+
+
+def run_authoritative_git(
+    args: list[str],
+    *,
+    check: bool = True,
+    git_dir: str | Path | None = None,
+    timeout: float = _TIMEOUT,
+) -> subprocess.CompletedProcess[str]:
+    path, _ = verify_repository(git_dir=git_dir)
+    return _run(path, list(args), check=check, timeout=timeout)
+
+
+def authoritative_head_oid(
+    *,
+    git_dir: str | Path | None = None,
+) -> str:
+    result = run_authoritative_git(["rev-parse", "--verify", "refs/heads/main"], git_dir=git_dir)
+    oid = result.stdout.strip().lower()
+    if not _OID_RE.fullmatch(oid):
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+    return oid
+
+
+def authoritative_tags(
+    *,
+    git_dir: str | Path | None = None,
+) -> list[dict[str, str | None]]:
+    result = run_authoritative_git(
+        [
+            "for-each-ref",
+            "refs/tags",
+            "--format=%(refname:strip=2)\t%(objectname)\t%(objecttype)",
+        ],
+        git_dir=git_dir,
+    )
+    tags: list[dict[str, str | None]] = []
+    for line in result.stdout.splitlines():
+        name, oid, object_type = (line.split("\t", 2) + ["", ""])[:3]
+        if not name or not _OID_RE.fullmatch(oid.lower()):
+            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+        peeled_result = run_authoritative_git(
+            ["rev-parse", "--verify", f"refs/tags/{name}^{{commit}}"],
+            git_dir=git_dir,
+        )
+        peeled = peeled_result.stdout.strip().lower()
+        if not _OID_RE.fullmatch(peeled):
+            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+        tags.append(
+            {
+                "name": name,
+                "tag_oid": oid.lower(),
+                "object_type": object_type,
+                "peeled_target_oid": peeled,
+            }
+        )
+    return tags
+
+
+def authoritative_branches(
+    *,
+    git_dir: str | Path | None = None,
+) -> list[dict[str, str]]:
+    result = run_authoritative_git(
+        [
+            "for-each-ref",
+            "refs/heads",
+            "--format=%(refname:strip=2)\t%(objectname)",
+        ],
+        git_dir=git_dir,
+    )
+    branches: list[dict[str, str]] = []
+    for line in result.stdout.splitlines():
+        name, oid = (line.split("\t", 1) + [""])[:2]
+        if not name or not _OID_RE.fullmatch(oid.lower()):
+            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+        branches.append({"name": name, "oid": oid.lower()})
+    return branches
+
+
+def authoritative_commit(
+    oid: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> str:
+    value = str(oid or "").strip().lower()
+    if not _OID_RE.fullmatch(value):
+        raise ValueError("commit OID must be a full 40-character value")
+    result = run_authoritative_git(
+        ["rev-parse", "--verify", f"{value}^{{commit}}"],
+        git_dir=git_dir,
+    )
+    resolved = result.stdout.strip().lower()
+    if resolved != value:
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+    return resolved
+
+
+def authoritative_lineage(
+    ancestor: str,
+    descendant: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> None:
+    authoritative_commit(ancestor, git_dir=git_dir)
+    authoritative_commit(descendant, git_dir=git_dir)
+    result = run_authoritative_git(
+        ["merge-base", "--is-ancestor", ancestor, descendant],
+        check=False,
+        git_dir=git_dir,
+    )
+    if result.returncode != 0:
+        raise AuthoritativeGitError("evidence lineage mismatch")
+
+
+_SAFE_REF_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{0,239}$")
+
+
+def _safe_ref_name(value: str) -> bool:
+    return bool(
+        _SAFE_REF_RE.fullmatch(value)
+        and ".." not in value
+        and "//" not in value
+        and "@{" not in value
+        and not value.endswith(("/", ".", ".lock"))
+        and not any(part in {"", ".", ".."} for part in value.split("/"))
+    )
+
+
+def validate_git_revision(
+    value: str,
+    field: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> str:
+    revision = str(value or "").strip()
+    if not revision or revision != str(value or "") or revision.startswith("-"):
+        raise ValueError(f"invalid {field} revision")
+    if _OID_RE.fullmatch(revision.lower()):
+        try:
+            return authoritative_commit(revision.lower(), git_dir=git_dir)
+        except AuthoritativeGitError as exc:
+            raise AuthoritativeGitNotFound(f"{field} revision not found") from exc
+    if not _safe_ref_name(revision) or any(token in revision for token in ("^", "~", ":", "\\")):
+        raise ValueError(f"invalid {field} revision")
+    if revision.startswith("refs/"):
+        if not revision.startswith(("refs/heads/", "refs/tags/")):
+            raise ValueError(f"invalid {field} revision")
+        candidates = [revision]
+    else:
+        candidates = [f"refs/heads/{revision}", f"refs/tags/{revision}"]
+    matches: list[str] = []
+    for candidate in candidates:
+        result = run_authoritative_git(
+            ["rev-parse", "--verify", f"{candidate}^{{commit}}"],
+            check=False,
+            git_dir=git_dir,
+        )
+        oid = result.stdout.strip().lower()
+        if result.returncode == 0 and _OID_RE.fullmatch(oid):
+            matches.append(oid)
+    if not matches:
+        raise AuthoritativeGitNotFound(f"{field} revision not found")
+    if len(set(matches)) != 1 or len(matches) != 1:
+        raise ValueError(f"ambiguous {field} revision")
+    return matches[0]
+
+
+def authoritative_diff(
+    from_revision: str,
+    to_revision: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> dict[str, object]:
+    path, _ = verify_repository(git_dir=git_dir)
+    from_oid = validate_git_revision(from_revision, "from", git_dir=path)
+    to_oid = validate_git_revision(to_revision, "to", git_dir=path)
+    args = ["diff", "--no-ext-diff", "--no-textconv", from_oid, to_oid]
+    result = run_authoritative_git(args, git_dir=path)
+    return {
+        "code": 0,
+        "stdout": result.stdout,
+        "stderr": "",
+        "cmd": ["git", f"--git-dir={path}", *args],
+        "from_oid": from_oid,
+        "to_oid": to_oid,
+    }
+
+
+def repository_snapshot(
+    *,
+    git_dir: str | Path | None = None,
+    repository_identity: str | None = None,
+) -> dict[str, object]:
+    configured = bool(
+        str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
+    )
+    try:
+        path, identity = verify_repository(
+            git_dir=git_dir,
+            repository_identity=repository_identity,
+        )
+        head = authoritative_head_oid(git_dir=path)
+        return {
+            "repository_available": True,
+            "authoritative_git_dir_configured": configured,
+            "authoritative_git_dir_readable": True,
+            "authoritative_git_dir": str(path),
+            "authoritative_head_oid": head,
+            "repository_identity": identity,
+            "query_error": None,
+        }
+    except (AuthoritativeGitError, ValueError) as exc:
+        return {
+            "repository_available": False,
+            "authoritative_git_dir_configured": configured,
+            "authoritative_git_dir_readable": False,
+            "authoritative_git_dir": None,
+            "authoritative_head_oid": None,
+            "repository_identity": str(
+                repository_identity
+                or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
+            ).strip() or None,
+            "query_error": _redact(str(exc)),
+        }

active-runtime/app/isolated_writer_authz.py

@@ -0,0 +1,167 @@
+"""Fail-closed operation authorization for an isolated Git writer."""
+from __future__ import annotations
+
+import ipaddress
+import os
+import re
+import subprocess
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from isolated_writer_token_registry import TokenRegistry
+
+
+ROUTE_OPERATIONS = {
+    ("GET", "/api/runtime-status"): "runtime.status.read",
+    ("GET", "/api/baseline"): "baseline.read",
+    ("GET", "/api/patches"): "patches.read",
+    ("POST", "/api/commit-file"): "commit_file.atomic",
+}
+OID_RE = re.compile(r"[0-9a-f]{40}")
+
+
+class AuthorizationError(PermissionError):
+    def __init__(self, code: str, status: int = 403):
+        super().__init__(code)
+        self.code = code
+        self.status = status
+
+
+@dataclass(frozen=True)
+class AuthorizedGrant:
+    record: dict[str, Any]
+    operation: str
+    use_count: int
+
+    @property
+    def token_id(self) -> str:
+        return str(self.record["token_id"])
+
+    @property
+    def task_id(self) -> str:
+        return str(self.record["task_id"])
+
+
+def operation_for(method: str, path: str) -> str:
+    operation = ROUTE_OPERATIONS.get((method.upper(), path))
+    if not operation:
+        raise AuthorizationError("isolated_writer_operation_forbidden")
+    return operation
+
+
+def _parse_time(value: Any) -> datetime:
+    try:
+        parsed = datetime.fromisoformat(str(value).replace("Z", "+00:00"))
+    except (TypeError, ValueError):
+        raise AuthorizationError("writer_token_time_invalid") from None
+    if parsed.tzinfo is None:
+        raise AuthorizationError("writer_token_time_invalid")
+    return parsed.astimezone(timezone.utc)
+
+
+def _git_is_ancestor(workspace: Path, base: str, branch: str) -> bool:
+    result = subprocess.run(
+        ["git", "merge-base", "--is-ancestor", base, branch],
+        cwd=workspace,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    return result.returncode == 0
+
+
+def _validate_grant(
+    grant: dict[str, Any],
+    *,
+    audience: str,
+    source_ip: str,
+    operation: str,
+    branch: str | None,
+    path: str | None,
+    workspace: Path,
+    current_time: datetime,
+) -> None:
+    if int(grant.get("schema_version", 0)) != 2:
+        raise AuthorizationError("writer_token_policy_v2_required", 401)
+    if str(grant.get("audience") or "") != audience:
+        raise AuthorizationError("writer_token_audience_rejected")
+    try:
+        peer = ipaddress.ip_address(source_ip)
+        networks = [ipaddress.ip_network(str(value), strict=True) for value in grant.get("source_cidrs", [])]
+    except ValueError:
+        raise AuthorizationError("writer_token_source_rejected") from None
+    if not networks or not any(peer in network for network in networks):
+        raise AuthorizationError("writer_token_source_rejected")
+    created = _parse_time(grant.get("created_at"))
+    not_before = _parse_time(grant.get("not_before"))
+    expires = _parse_time(grant.get("expires_at"))
+    if expires <= not_before or (expires - created).total_seconds() > 1800:
+        raise AuthorizationError("writer_token_lifetime_rejected")
+    if current_time < not_before:
+        raise AuthorizationError("writer_token_not_yet_valid", 401)
+    if current_time >= expires:
+        raise AuthorizationError("writer_token_expired", 401)
+    if bool(grant.get("revoked")):
+        raise AuthorizationError("writer_token_revoked", 401)
+    operations = grant.get("allowed_operations")
+    if not isinstance(operations, list) or operation not in operations:
+        raise AuthorizationError("writer_token_operation_rejected")
+    expected_branch = str(grant.get("allowed_branch") or "")
+    configured_branch = os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", "")
+    if expected_branch != configured_branch:
+        raise AuthorizationError("writer_token_branch_rejected")
+    if branch is not None and branch != expected_branch:
+        raise AuthorizationError("writer_token_branch_rejected")
+    if path is not None:
+        paths = grant.get("allowed_paths")
+        if not isinstance(paths, list) or path not in paths:
+            raise AuthorizationError("writer_token_path_rejected")
+    base = str(grant.get("approved_base_oid") or "").lower()
+    if not OID_RE.fullmatch(base):
+        raise AuthorizationError("writer_token_base_rejected")
+    if not _git_is_ancestor(workspace, base, expected_branch):
+        raise AuthorizationError("writer_token_base_not_ancestor")
+
+
+def authorize(
+    registry: TokenRegistry,
+    token: str,
+    *,
+    method: str,
+    path: str,
+    source_ip: str,
+    workspace: Path,
+    branch: str | None = None,
+    target_path: str | None = None,
+    current_time: datetime | None = None,
+) -> AuthorizedGrant:
+    if os.getenv("AIOS_GITOPS_TOKEN_POLICY_VERSION_REQUIRED", "") != "2":
+        raise AuthorizationError("writer_token_policy_v2_not_required")
+    if not token:
+        raise AuthorizationError("unauthorized", 401)
+    grant = registry.find(token)
+    if grant is None:
+        raise AuthorizationError("unauthorized", 401)
+    operation = operation_for(method, path)
+    _validate_grant(
+        grant,
+        audience=os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", ""),
+        source_ip=source_ip,
+        operation=operation,
+        branch=branch,
+        path=target_path,
+        workspace=workspace,
+        current_time=current_time or datetime.now(timezone.utc),
+    )
+    limits = grant.get("max_uses")
+    if not isinstance(limits, dict):
+        raise AuthorizationError("writer_token_use_limit_missing")
+    try:
+        used = registry.consume(str(grant["token_id"]), operation, int(limits[operation]))
+    except (KeyError, TypeError, ValueError):
+        raise AuthorizationError("writer_token_use_limit_missing") from None
+    except PermissionError as exc:
+        code = str(exc)
+        raise AuthorizationError(code, 401 if code == "writer_token_revoked" else 403) from None
+    return AuthorizedGrant(grant, operation, used)

active-runtime/app/isolated_writer_commit_file.py

@@ -0,0 +1,403 @@
+"""Atomic, idempotent commit-file Saga for the isolated writer."""
+from __future__ import annotations
+
+import fcntl
+import hashlib
+import json
+import os
+import re
+import sqlite3
+import subprocess
+import tempfile
+import threading
+from pathlib import Path
+from typing import Any
+
+import aios_isolated_writer_policy as policy
+
+
+OID_RE = re.compile(r"[0-9a-f]{40}")
+IDEMPOTENCY_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{7,127}")
+STATES = frozenset({
+    "PENDING", "FILE_WRITTEN", "COMMITTED", "PUSHED", "VERIFIED", "COMPLETED",
+    "FAILED_RECOVERABLE", "MANUAL_REVIEW_REQUIRED",
+})
+_LOCKS: dict[str, threading.Lock] = {}
+_LOCKS_GUARD = threading.Lock()
+_LEDGER_INIT_LOCK = threading.Lock()
+
+
+class CommitFileError(RuntimeError):
+    def __init__(self, code: str, status: int = 400):
+        super().__init__(code)
+        self.code = code
+        self.status = status
+
+
+class SimulatedCrash(RuntimeError):
+    pass
+
+
+def canonical_digest(data: dict[str, Any]) -> str:
+    payload = {
+        "branch": data["branch"],
+        "path": data["path"],
+        "content_sha256": hashlib.sha256(data["content"].encode("utf-8")).hexdigest(),
+        "message": data["message"],
+        "expected_head_oid": data["expected_head_oid"],
+    }
+    encoded = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    return hashlib.sha256(encoded).hexdigest()
+
+
+class OperationLedger:
+    def __init__(self, path: Path | str):
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        if self.path.parent.is_symlink() or self.path.is_symlink():
+            raise PermissionError("writer_operation_ledger_symlink_rejected")
+        with _LEDGER_INIT_LOCK:
+            with self.connect() as db:
+                db.execute(
+                    """
+                    CREATE TABLE IF NOT EXISTS writer_operations (
+                        operation_id TEXT PRIMARY KEY,
+                        token_id TEXT NOT NULL,
+                        task_id TEXT NOT NULL,
+                        idempotency_key TEXT NOT NULL UNIQUE,
+                        operation_digest TEXT NOT NULL,
+                        branch TEXT NOT NULL,
+                        path TEXT NOT NULL,
+                        content_sha256 TEXT NOT NULL,
+                        pre_head_oid TEXT NOT NULL,
+                        commit_oid TEXT,
+                        push_status TEXT,
+                        verification_status TEXT,
+                        state TEXT NOT NULL,
+                        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+                        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+                        error_code TEXT
+                    )
+                    """
+                )
+        os.chmod(self.path, 0o600)
+
+    def connect(self) -> sqlite3.Connection:
+        db = sqlite3.connect(self.path, timeout=30)
+        db.row_factory = sqlite3.Row
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        return db
+
+    def get_or_create(self, grant: Any, data: dict[str, Any], digest: str) -> dict[str, Any]:
+        key = data["idempotency_key"]
+        with self.connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            row = db.execute(
+                "SELECT * FROM writer_operations WHERE idempotency_key=?", (key,)
+            ).fetchone()
+            if row:
+                db.commit()
+                record = dict(row)
+                if record["operation_digest"] != digest:
+                    raise CommitFileError("writer_idempotency_conflict", 409)
+                if (
+                    record["token_id"] != grant.token_id
+                    or record["task_id"] != grant.task_id
+                ):
+                    raise CommitFileError("writer_idempotency_owner_conflict", 409)
+                return record
+            operation_id = hashlib.sha256(
+                f"{grant.task_id}\0{key}".encode("utf-8")
+            ).hexdigest()
+            content_sha = hashlib.sha256(data["content"].encode("utf-8")).hexdigest()
+            db.execute(
+                """
+                INSERT INTO writer_operations(
+                    operation_id,token_id,task_id,idempotency_key,operation_digest,
+                    branch,path,content_sha256,pre_head_oid,state
+                ) VALUES(?,?,?,?,?,?,?,?,?,?)
+                """,
+                (
+                    operation_id, grant.token_id, grant.task_id, key, digest,
+                    data["branch"], data["path"], content_sha,
+                    data["expected_head_oid"], "PENDING",
+                ),
+            )
+            db.commit()
+        return self.get(key)
+
+    def get(self, key: str) -> dict[str, Any]:
+        with self.connect() as db:
+            row = db.execute(
+                "SELECT * FROM writer_operations WHERE idempotency_key=?", (key,)
+            ).fetchone()
+        if row is None:
+            raise KeyError(key)
+        return dict(row)
+
+    def update(self, key: str, state: str, **fields: Any) -> dict[str, Any]:
+        if state not in STATES:
+            raise ValueError("invalid writer operation state")
+        allowed = {"commit_oid", "push_status", "verification_status", "error_code"}
+        assignments = ["state=?", "updated_at=CURRENT_TIMESTAMP"]
+        values: list[Any] = [state]
+        for name, value in fields.items():
+            if name not in allowed:
+                raise ValueError("invalid ledger field")
+            assignments.append(f"{name}=?")
+            values.append(value)
+        values.append(key)
+        with self.connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            db.execute(
+                f"UPDATE writer_operations SET {','.join(assignments)} WHERE idempotency_key=?",
+                values,
+            )
+            db.commit()
+        return self.get(key)
+
+
+class AtomicCommitFile:
+    def __init__(
+        self,
+        *,
+        workspace: Path,
+        bare_repo: Path,
+        ledger: OperationLedger,
+        remote: str,
+        audit,
+        crash_after_state: str | None = None,
+    ):
+        self.workspace = workspace
+        self.bare_repo = bare_repo
+        self.ledger = ledger
+        self.remote = remote
+        self.audit = audit
+        self.crash_after_state = crash_after_state
+
+    def _git(self, *args: str, check: bool = True) -> str:
+        result = subprocess.run(
+            ["git", *args], cwd=self.workspace, text=True, capture_output=True
+        )
+        if check and result.returncode != 0:
+            raise CommitFileError("writer_git_operation_failed", 500)
+        return result.stdout.strip()
+
+    def _transition(self, key: str, state: str, **fields: Any) -> dict[str, Any]:
+        record = self.ledger.update(key, state, **fields)
+        if self.crash_after_state == state:
+            raise SimulatedCrash(state)
+        return record
+
+    def _validate(self, data: Any) -> dict[str, Any]:
+        if not isinstance(data, dict):
+            raise CommitFileError("writer_request_object_required")
+        required = ("branch", "path", "content", "message", "expected_head_oid", "idempotency_key")
+        if any(field not in data for field in required):
+            raise CommitFileError("writer_request_incomplete")
+        if data.get("force") or data.get("force_push"):
+            raise CommitFileError("isolated_writer_force_rejected", 403)
+        if set(data) != set(required):
+            raise CommitFileError("writer_request_fields_rejected")
+        item = {field: data[field] for field in required}
+        if item["branch"] != policy.allowed_branch():
+            raise CommitFileError("isolated_writer_branch_rejected", 403)
+        try:
+            item["path"] = policy.validate_path(item["path"], self.workspace)
+        except PermissionError as exc:
+            raise CommitFileError(str(exc), 403) from None
+        if not isinstance(item["content"], str) or "\x00" in item["content"]:
+            raise CommitFileError("writer_content_rejected")
+        try:
+            policy.validate_content_for_path(item["path"], item["content"])
+        except PermissionError as exc:
+            raise CommitFileError(str(exc), 403) from None
+        if len(item["content"].encode("utf-8")) > 1_048_576:
+            raise CommitFileError("writer_content_too_large", 413)
+        message = item["message"]
+        if (
+            not isinstance(message, str)
+            or not 1 <= len(message) <= 200
+            or "\x00" in message
+            or "\n" in message
+            or "\r" in message
+        ):
+            raise CommitFileError("writer_message_rejected")
+        if not isinstance(item["expected_head_oid"], str) or not OID_RE.fullmatch(item["expected_head_oid"]):
+            raise CommitFileError("writer_expected_head_rejected")
+        if not isinstance(item["idempotency_key"], str) or not IDEMPOTENCY_RE.fullmatch(item["idempotency_key"]):
+            raise CommitFileError("writer_idempotency_key_rejected")
+        return item
+
+    def _atomic_write(self, relative: str, content: str) -> None:
+        target = self.workspace / relative
+        target.parent.mkdir(parents=True, exist_ok=True)
+        fd, temporary = tempfile.mkstemp(prefix=".writer-", dir=target.parent)
+        try:
+            with os.fdopen(fd, "wb", closefd=True) as stream:
+                stream.write(content.encode("utf-8"))
+                stream.flush()
+                os.fsync(stream.fileno())
+            os.replace(temporary, target)
+            parent_fd = os.open(target.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
+            try:
+                os.fsync(parent_fd)
+            finally:
+                os.close(parent_fd)
+        finally:
+            if os.path.exists(temporary):
+                os.unlink(temporary)
+
+    def _verify_remote(self, branch: str, oid: str) -> None:
+        bare = subprocess.run(
+            ["git", "--git-dir", str(self.bare_repo), "rev-parse", f"refs/heads/{branch}"],
+            text=True, capture_output=True,
+        )
+        if bare.returncode != 0 or bare.stdout.strip() != oid:
+            raise CommitFileError("writer_authoritative_bare_oid_mismatch", 500)
+        remote = subprocess.run(
+            ["git", "ls-remote", "--heads", self.remote, f"refs/heads/{branch}"],
+            cwd=self.workspace, text=True, capture_output=True,
+        )
+        if remote.returncode != 0:
+            raise CommitFileError("writer_gitea_verification_failed", 503)
+        fields = remote.stdout.strip().split()
+        if len(fields) != 2:
+            raise CommitFileError("writer_gitea_ref_missing", 503)
+        if fields[0] != oid:
+            raise CommitFileError("writer_gitea_oid_conflict", 409)
+
+    def execute(self, grant: Any, raw_data: Any) -> dict[str, Any]:
+        data = self._validate(raw_data)
+        digest = canonical_digest(data)
+        branch = data["branch"]
+        with _LOCKS_GUARD:
+            lock = _LOCKS.setdefault(branch, threading.Lock())
+        lock_path = self.ledger.path.parent / f"{hashlib.sha256(branch.encode()).hexdigest()}.lock"
+        with lock, open(lock_path, "a+b") as branch_lock:
+            fcntl.flock(branch_lock.fileno(), fcntl.LOCK_EX)
+            return self._execute_locked(grant, data, digest)
+
+    def _execute_locked(self, grant: Any, data: dict[str, Any], digest: str) -> dict[str, Any]:
+        key = data["idempotency_key"]
+        record = self.ledger.get_or_create(grant, data, digest)
+        if record["state"] == "COMPLETED":
+            return self._result(record, idempotent=True)
+        if self._git("rev-parse", "--abbrev-ref", "HEAD") != data["branch"]:
+            record = self._transition(
+                key, "MANUAL_REVIEW_REQUIRED", error_code="writer_current_branch_conflict"
+            )
+            self._audit(grant, data, digest, record, "manual_review_required")
+            raise CommitFileError("writer_current_branch_conflict", 409)
+        head = self._git("rev-parse", "HEAD")
+        commit_oid = record.get("commit_oid")
+        if head != record["pre_head_oid"] and head != commit_oid:
+            record = self._transition(
+                key, "MANUAL_REVIEW_REQUIRED", error_code="writer_branch_head_conflict"
+            )
+            self._audit(grant, data, digest, record, "manual_review_required")
+            raise CommitFileError("writer_branch_head_conflict", 409)
+        try:
+            state = record["state"]
+            if state == "MANUAL_REVIEW_REQUIRED":
+                raise CommitFileError("writer_manual_review_required", 409)
+            if state == "FAILED_RECOVERABLE":
+                if record.get("push_status") == "confirmed":
+                    state = "PUSHED"
+                else:
+                    state = "COMMITTED" if commit_oid else "FILE_WRITTEN"
+            if state == "PENDING":
+                self._atomic_write(data["path"], data["content"])
+                record = self._transition(key, "FILE_WRITTEN")
+                state = record["state"]
+            if state == "FILE_WRITTEN":
+                actual_sha = hashlib.sha256(
+                    (self.workspace / data["path"]).read_bytes()
+                ).hexdigest()
+                if actual_sha != record["content_sha256"]:
+                    raise CommitFileError("writer_file_content_conflict", 409)
+                staged_before = self._git("diff", "--cached", "--name-only", check=False).splitlines()
+                if staged_before:
+                    raise CommitFileError("writer_extra_staged_files_rejected", 409)
+                self._git("add", "--", data["path"])
+                staged = self._git("diff", "--cached", "--name-only").splitlines()
+                if staged != [data["path"]]:
+                    raise CommitFileError("writer_extra_staged_files_rejected", 409)
+                self._git("commit", "-m", data["message"])
+                commit_oid = self._git("rev-parse", "HEAD")
+                record = self._transition(key, "COMMITTED", commit_oid=commit_oid)
+                state = record["state"]
+            if state == "COMMITTED":
+                commit_oid = str(record["commit_oid"])
+                pushed = subprocess.run(
+                    ["git", "push", "--porcelain", self.remote, f"HEAD:refs/heads/{data['branch']}"],
+                    cwd=self.workspace, text=True, capture_output=True,
+                )
+                if pushed.returncode != 0:
+                    self._transition(
+                        key, "FAILED_RECOVERABLE",
+                        push_status="failed", error_code="writer_gitea_push_failed",
+                    )
+                    raise CommitFileError("writer_gitea_push_failed", 503)
+                record = self._transition(key, "PUSHED", push_status="confirmed")
+                state = record["state"]
+            if state == "PUSHED":
+                commit_oid = str(record["commit_oid"])
+                self._verify_remote(data["branch"], commit_oid)
+                record = self._transition(
+                    key, "VERIFIED", verification_status="bare+gitea"
+                )
+                state = record["state"]
+            if state == "VERIFIED":
+                record = self._transition(key, "COMPLETED", error_code=None)
+            self._audit(grant, data, digest, record, "completed")
+            return self._result(record, idempotent=False)
+        except SimulatedCrash:
+            raise
+        except CommitFileError as exc:
+            latest = self.ledger.get(key)
+            if latest["state"] not in {"FAILED_RECOVERABLE", "MANUAL_REVIEW_REQUIRED"}:
+                failure_state = (
+                    "MANUAL_REVIEW_REQUIRED"
+                    if exc.code in {
+                        "writer_gitea_oid_conflict",
+                        "writer_file_content_conflict",
+                        "writer_current_branch_conflict",
+                    }
+                    else "FAILED_RECOVERABLE"
+                )
+                latest = self._transition(key, failure_state, error_code=exc.code)
+            self._audit(grant, data, digest, latest, "failed")
+            raise
+
+    def _audit(self, grant: Any, data: dict[str, Any], digest: str, record: dict[str, Any], result: str) -> None:
+        self.audit({
+            "token_id": grant.token_id,
+            "task_id": grant.task_id,
+            "audience": grant.record["audience"],
+            "source_ip": grant.record.get("_source_ip", "socket-peer"),
+            "operation": grant.operation,
+            "branch": data["branch"],
+            "path": data["path"],
+            "idempotency_key": data["idempotency_key"],
+            "operation_digest": digest,
+            "path_policy_sha256": policy.configured_path_policy_sha256(),
+            "pre_head_oid": record["pre_head_oid"],
+            "commit_oid": record.get("commit_oid"),
+            "result": result,
+        })
+
+    @staticmethod
+    def _result(record: dict[str, Any], *, idempotent: bool) -> dict[str, Any]:
+        return {
+            "status": "completed",
+            "state": record["state"],
+            "operation_id": record["operation_id"],
+            "branch": record["branch"],
+            "path": record["path"],
+            "commit_oid": record.get("commit_oid"),
+            "push_status": record.get("push_status"),
+            "verification_status": record.get("verification_status"),
+            "idempotent": idempotent,
+        }

active-runtime/app/isolated_writer_path_policy.py

@@ -0,0 +1,422 @@
+"""Strict service-level exact-path policy for isolated Git writers."""
+from __future__ import annotations
+
+import grp
+import hashlib
+import json
+import os
+import re
+import stat
+from dataclasses import dataclass
+from functools import lru_cache
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from typing import Any
+from urllib.parse import unquote
+
+
+MAX_POLICY_BYTES = 65_536
+POLICY_FIELDS = frozenset(
+    {
+        "schema_version",
+        "policy_id",
+        "audience",
+        "repository_identity",
+        "allowed_branch",
+        "allowed_operations",
+    }
+)
+OPERATION_FIELDS = frozenset({"exact_paths", "max_content_bytes", "content_profile"})
+SUPPORTED_OPERATIONS = frozenset({"commit_file.atomic"})
+SUPPORTED_CONTENT_PROFILES = frozenset({"systemd-codex-review-worker-v1"})
+_SECRET_RE = re.compile(
+    r"(?i)(authorization\s*:|bearer\s+|(?:token|password|secret)\s*[:=])"
+)
+_SYSTEMD_NAME_RE = re.compile(r"[A-Za-z][A-Za-z0-9]*\Z")
+_SYSTEMD_MAX_LINE_BYTES = 4096
+_SYSTEMD_ALLOWED_DIRECTIVES = {
+    "Unit": frozenset({"Description", "After", "Wants"}),
+    "Service": frozenset(
+        {
+            "Type",
+            "User",
+            "Group",
+            "WorkingDirectory",
+            "Environment",
+            "ExecStart",
+            "Restart",
+            "RestartSec",
+            "NoNewPrivileges",
+            "PrivateTmp",
+            "PrivateDevices",
+            "ProtectSystem",
+            "ProtectHome",
+            "ProtectKernelTunables",
+            "ProtectKernelModules",
+            "ProtectControlGroups",
+            "LockPersonality",
+            "RestrictSUIDSGID",
+            "RestrictRealtime",
+            "MemoryDenyWriteExecute",
+            "RuntimeDirectory",
+            "StateDirectory",
+            "CacheDirectory",
+            "ReadOnlyPaths",
+            "ReadWritePaths",
+            "UMask",
+        }
+    ),
+    "Install": frozenset({"WantedBy"}),
+}
+_SYSTEMD_MULTI_DIRECTIVES = frozenset(
+    {
+        ("Service", "Environment"),
+        ("Service", "ReadOnlyPaths"),
+        ("Service", "ReadWritePaths"),
+    }
+)
+_SYSTEMD_EXACT_SINGLE_VALUES = {
+    ("Unit", "Description"): "AIOS Codex Review/Test Worker",
+    ("Unit", "After"): "network-online.target",
+    ("Unit", "Wants"): "network-online.target",
+    ("Service", "Type"): "simple",
+    ("Service", "User"): "aiman",
+    ("Service", "Group"): "gitops",
+    (
+        "Service",
+        "WorkingDirectory",
+    ): "/usr/libexec/aios-codex-review-test-worker/current",
+    (
+        "Service",
+        "ExecStart",
+    ): "/usr/bin/python3 -m task_plane.workers.codex_review_test",
+    ("Service", "Restart"): "on-failure",
+    ("Service", "RestartSec"): "2",
+    ("Service", "NoNewPrivileges"): "true",
+    ("Service", "PrivateTmp"): "true",
+    ("Service", "PrivateDevices"): "true",
+    ("Service", "ProtectSystem"): "strict",
+    ("Service", "ProtectHome"): "true",
+    ("Service", "ProtectKernelTunables"): "true",
+    ("Service", "ProtectKernelModules"): "true",
+    ("Service", "ProtectControlGroups"): "true",
+    ("Service", "LockPersonality"): "true",
+    ("Service", "RestrictSUIDSGID"): "true",
+    ("Service", "RestrictRealtime"): "true",
+    ("Service", "MemoryDenyWriteExecute"): "true",
+    ("Service", "RuntimeDirectory"): "aios-codex-review-test-worker",
+    ("Service", "StateDirectory"): "aios-codex-review-test-worker",
+    ("Service", "CacheDirectory"): "aios-codex-review-test-worker",
+    ("Service", "UMask"): "0077",
+    ("Install", "WantedBy"): "multi-user.target",
+}
+_SYSTEMD_EXACT_MULTI_VALUES = {
+    ("Service", "Environment"): (
+        "AIOS_CODEX_WORKER_MODE=shadow",
+        "AIOS_TASK_PLANE_EXECUTION_ENABLED=false",
+        "PYTHONDONTWRITEBYTECODE=1",
+    ),
+    ("Service", "ReadOnlyPaths"): (
+        "/data/aios-gitops/repo.git",
+        "/usr/libexec/aios-codex-review-test-worker",
+    ),
+    ("Service", "ReadWritePaths"): (
+        "/run/aios-codex-review-test-worker",
+        "/var/lib/aios-codex-review-test-worker",
+        "/var/cache/aios-codex-review-test-worker",
+    ),
+}
+
+
+class PathPolicyError(PermissionError):
+    pass
+
+
+@dataclass(frozen=True)
+class OperationPolicy:
+    exact_paths: tuple[str, ...]
+    max_content_bytes: int
+    content_profile: str
+
+
+@dataclass(frozen=True)
+class ServicePathPolicy:
+    schema_version: int
+    policy_id: str
+    audience: str
+    repository_identity: str
+    allowed_branch: str
+    allowed_operations: dict[str, OperationPolicy]
+    sha256: str
+
+    def operation(self, name: str) -> OperationPolicy:
+        try:
+            return self.allowed_operations[name]
+        except KeyError:
+            raise PathPolicyError("isolated_writer_service_operation_rejected") from None
+
+    def require_exact_path(self, operation: str, path: str) -> OperationPolicy:
+        selected = self.operation(operation)
+        if path not in selected.exact_paths:
+            raise PathPolicyError("isolated_writer_service_path_rejected")
+        return selected
+
+
+def _canonical_json(value: Any) -> bytes:
+    return (
+        json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+        + "\n"
+    ).encode("utf-8")
+
+
+def validate_relative_path_syntax(path: str) -> str:
+    if not isinstance(path, str):
+        raise PathPolicyError("isolated_writer_path_rejected")
+    if not path or path != path.strip() or "\x00" in path or "\\" in path:
+        raise PathPolicyError("isolated_writer_path_rejected")
+    try:
+        decoded = unquote(path, errors="strict")
+    except (UnicodeDecodeError, ValueError):
+        raise PathPolicyError("isolated_writer_path_rejected") from None
+    if decoded != path:
+        raise PathPolicyError("isolated_writer_path_rejected")
+    posix = PurePosixPath(path)
+    windows = PureWindowsPath(path)
+    parts = path.split("/")
+    if (
+        posix.is_absolute()
+        or windows.is_absolute()
+        or bool(windows.drive)
+        or any(part in {"", ".", ".."} for part in parts)
+    ):
+        raise PathPolicyError("isolated_writer_path_rejected")
+    return path
+
+
+def _require_fields(value: dict[str, Any], allowed: frozenset[str], code: str) -> None:
+    if set(value) != allowed:
+        raise PathPolicyError(code)
+
+
+def _parse_policy(document: Any, canonical: bytes) -> ServicePathPolicy:
+    if not isinstance(document, dict):
+        raise PathPolicyError("isolated_writer_path_policy_object_required")
+    _require_fields(document, POLICY_FIELDS, "isolated_writer_path_policy_fields_rejected")
+    if document["schema_version"] != 1:
+        raise PathPolicyError("isolated_writer_path_policy_schema_rejected")
+    text_fields = (
+        "policy_id",
+        "audience",
+        "repository_identity",
+        "allowed_branch",
+    )
+    if any(
+        not isinstance(document[field], str) or not document[field].strip()
+        for field in text_fields
+    ):
+        raise PathPolicyError("isolated_writer_path_policy_value_rejected")
+    raw_operations = document["allowed_operations"]
+    if not isinstance(raw_operations, dict) or not raw_operations:
+        raise PathPolicyError("isolated_writer_path_policy_operations_rejected")
+    if not set(raw_operations).issubset(SUPPORTED_OPERATIONS):
+        raise PathPolicyError("isolated_writer_path_policy_operations_rejected")
+    operations: dict[str, OperationPolicy] = {}
+    for name, raw in raw_operations.items():
+        if not isinstance(raw, dict):
+            raise PathPolicyError("isolated_writer_path_policy_operation_rejected")
+        _require_fields(
+            raw,
+            OPERATION_FIELDS,
+            "isolated_writer_path_policy_operation_fields_rejected",
+        )
+        paths = raw["exact_paths"]
+        if (
+            not isinstance(paths, list)
+            or not paths
+            or any(not isinstance(item, str) for item in paths)
+        ):
+            raise PathPolicyError("isolated_writer_path_policy_paths_rejected")
+        validated = tuple(validate_relative_path_syntax(item) for item in paths)
+        if len(set(validated)) != len(validated):
+            raise PathPolicyError("isolated_writer_path_policy_paths_rejected")
+        maximum = raw["max_content_bytes"]
+        if not isinstance(maximum, int) or isinstance(maximum, bool) or not 1 <= maximum <= 1_048_576:
+            raise PathPolicyError("isolated_writer_path_policy_size_rejected")
+        profile = raw["content_profile"]
+        if profile not in SUPPORTED_CONTENT_PROFILES:
+            raise PathPolicyError("isolated_writer_path_policy_profile_rejected")
+        operations[name] = OperationPolicy(validated, maximum, profile)
+    return ServicePathPolicy(
+        schema_version=1,
+        policy_id=document["policy_id"],
+        audience=document["audience"],
+        repository_identity=document["repository_identity"],
+        allowed_branch=document["allowed_branch"],
+        allowed_operations=operations,
+        sha256=hashlib.sha256(canonical).hexdigest(),
+    )
+
+
+def load_path_policy(
+    path: Path,
+    *,
+    expected_owner_uid: int = 0,
+    expected_group_gid: int | None = None,
+    expected_parent_mode: int = 0o750,
+    expected_file_mode: int = 0o640,
+) -> ServicePathPolicy:
+    lexical = Path(os.path.abspath(str(path)))
+    if lexical.is_symlink():
+        raise PathPolicyError("isolated_writer_path_policy_symlink_rejected")
+    try:
+        parent_info = lexical.parent.stat(follow_symlinks=False)
+        file_info = lexical.stat(follow_symlinks=False)
+    except FileNotFoundError:
+        raise PathPolicyError("isolated_writer_path_policy_missing") from None
+    if stat.S_ISLNK(parent_info.st_mode) or not stat.S_ISDIR(parent_info.st_mode):
+        raise PathPolicyError("isolated_writer_path_policy_parent_rejected")
+    if stat.S_ISLNK(file_info.st_mode) or not stat.S_ISREG(file_info.st_mode):
+        raise PathPolicyError("isolated_writer_path_policy_file_rejected")
+    if lexical.resolve(strict=True) != lexical:
+        raise PathPolicyError("isolated_writer_path_policy_symlink_rejected")
+    if (
+        parent_info.st_uid != expected_owner_uid
+        or stat.S_IMODE(parent_info.st_mode) != expected_parent_mode
+    ):
+        raise PathPolicyError("isolated_writer_path_policy_parent_permissions_rejected")
+    if (
+        file_info.st_uid != expected_owner_uid
+        or stat.S_IMODE(file_info.st_mode) != expected_file_mode
+    ):
+        raise PathPolicyError("isolated_writer_path_policy_permissions_rejected")
+    if expected_group_gid is not None and (
+        parent_info.st_gid != expected_group_gid or file_info.st_gid != expected_group_gid
+    ):
+        raise PathPolicyError("isolated_writer_path_policy_group_rejected")
+    if file_info.st_size <= 0 or file_info.st_size > MAX_POLICY_BYTES:
+        raise PathPolicyError("isolated_writer_path_policy_file_size_rejected")
+    raw = lexical.read_bytes()
+    try:
+        document = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        raise PathPolicyError("isolated_writer_path_policy_json_rejected") from None
+    canonical = _canonical_json(document)
+    if raw != canonical:
+        raise PathPolicyError("isolated_writer_path_policy_not_canonical")
+    return _parse_policy(document, canonical)
+
+
+@lru_cache(maxsize=1)
+def configured_path_policy() -> ServicePathPolicy | None:
+    configured = os.getenv("AIOS_GITOPS_PATH_POLICY_FILE", "").strip()
+    if not configured:
+        return None
+    if not Path(configured).is_absolute():
+        raise PathPolicyError("isolated_writer_path_policy_path_rejected")
+    try:
+        gitops_gid = grp.getgrnam("gitops").gr_gid
+    except KeyError:
+        raise PathPolicyError("isolated_writer_path_policy_group_rejected") from None
+    loaded = load_path_policy(Path(configured), expected_group_gid=gitops_gid)
+    if loaded.audience != os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", ""):
+        raise PathPolicyError("isolated_writer_path_policy_audience_rejected")
+    if loaded.repository_identity != os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", ""):
+        raise PathPolicyError("isolated_writer_path_policy_repository_rejected")
+    if loaded.allowed_branch != os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", ""):
+        raise PathPolicyError("isolated_writer_path_policy_branch_rejected")
+    return loaded
+
+
+def clear_path_policy_cache() -> None:
+    configured_path_policy.cache_clear()
+
+
+def require_service_path(operation: str, path: str) -> OperationPolicy:
+    loaded = configured_path_policy()
+    if loaded is None:
+        raise PathPolicyError("isolated_writer_service_path_policy_required")
+    return loaded.require_exact_path(operation, path)
+
+
+def configured_path_policy_sha256() -> str | None:
+    loaded = configured_path_policy()
+    return None if loaded is None else loaded.sha256
+
+
+def validate_content(operation: str, path: str, content: str) -> None:
+    selected = require_service_path(operation, path)
+    try:
+        encoded = content.encode("utf-8", errors="strict")
+    except (AttributeError, UnicodeEncodeError):
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected") from None
+    if len(encoded) > selected.max_content_bytes:
+        raise PathPolicyError("isolated_writer_service_content_too_large")
+    if selected.content_profile == "systemd-codex-review-worker-v1":
+        _validate_systemd_codex_review_worker(content)
+        return
+    raise PathPolicyError("isolated_writer_path_policy_profile_rejected")
+
+
+def _validate_systemd_codex_review_worker(content: str) -> None:
+    if not isinstance(content, str):
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+    try:
+        content.encode("utf-8", errors="strict")
+    except UnicodeEncodeError:
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected") from None
+    if (
+        "\x00" in content
+        or "\r" in content
+        or _SECRET_RE.search(content)
+        or not content.endswith("\n")
+    ):
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+
+    sections: set[str] = set()
+    values: dict[tuple[str, str], list[str]] = {}
+    section: str | None = None
+    for line in content.splitlines():
+        if len(line.encode("utf-8")) > _SYSTEMD_MAX_LINE_BYTES:
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+        if not line:
+            continue
+        if line[0].isspace() or line.startswith(("#", ";")):
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+        if line.startswith("[") and line.endswith("]"):
+            candidate = line[1:-1]
+            if (
+                not _SYSTEMD_NAME_RE.fullmatch(candidate)
+                or candidate not in _SYSTEMD_ALLOWED_DIRECTIVES
+                or candidate in sections
+            ):
+                raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+            sections.add(candidate)
+            section = candidate
+            continue
+        if section is None or "=" not in line:
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+        directive, value = line.split("=", 1)
+        if (
+            not _SYSTEMD_NAME_RE.fullmatch(directive)
+            or directive not in _SYSTEMD_ALLOWED_DIRECTIVES[section]
+            or not value
+            or value != value.strip()
+        ):
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+        key = (section, directive)
+        if key in values and key not in _SYSTEMD_MULTI_DIRECTIVES:
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+        values.setdefault(key, []).append(value)
+
+    if sections != set(_SYSTEMD_ALLOWED_DIRECTIVES):
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+    if set(values) != set(_SYSTEMD_EXACT_SINGLE_VALUES) | set(
+        _SYSTEMD_EXACT_MULTI_VALUES
+    ):
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+    for key, expected in _SYSTEMD_EXACT_SINGLE_VALUES.items():
+        if values.get(key) != [expected]:
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+    for key, expected in _SYSTEMD_EXACT_MULTI_VALUES.items():
+        observed = values.get(key, [])
+        if len(observed) != len(set(observed)) or tuple(observed) != expected:
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")

active-runtime/app/isolated_writer_token_registry.py

@@ -0,0 +1,241 @@
+"""Digest-only, task-scoped token registry for isolated writers."""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import hmac
+import json
+import os
+import grp
+import pwd
+import secrets
+import sqlite3
+import stat
+import threading
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+_REGISTRY_INIT_LOCK = threading.Lock()
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def token_digest(token: str) -> str:
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+class TokenRegistry:
+    def __init__(self, path: Path | str):
+        self.path = Path(path)
+        self._prepare()
+
+    def _prepare(self) -> None:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        if self.path.parent.is_symlink() or self.path.is_symlink():
+            raise PermissionError("writer_token_registry_symlink_rejected")
+        with _REGISTRY_INIT_LOCK:
+            with self._connect() as db:
+                db.executescript(
+                    """
+                    CREATE TABLE IF NOT EXISTS token_grants (
+                        token_id TEXT PRIMARY KEY,
+                        token_digest TEXT NOT NULL UNIQUE,
+                        grant_json TEXT NOT NULL,
+                        revoked INTEGER NOT NULL DEFAULT 0,
+                        created_at TEXT NOT NULL
+                    );
+                    CREATE TABLE IF NOT EXISTS token_uses (
+                        token_id TEXT NOT NULL,
+                        operation TEXT NOT NULL,
+                        use_count INTEGER NOT NULL DEFAULT 0,
+                        PRIMARY KEY(token_id, operation),
+                        FOREIGN KEY(token_id) REFERENCES token_grants(token_id)
+                    );
+                    """
+                )
+        os.chmod(self.path, 0o600)
+
+    def _connect(self) -> sqlite3.Connection:
+        db = sqlite3.connect(self.path, timeout=30, isolation_level=None)
+        db.row_factory = sqlite3.Row
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        db.execute("PRAGMA foreign_keys=ON")
+        return db
+
+    def issue(self, grant: dict[str, Any], token: str | None = None) -> tuple[str, dict[str, Any]]:
+        value = token or secrets.token_urlsafe(32)
+        if len(value.encode("utf-8")) < 32:
+            raise ValueError("writer_token_entropy_insufficient")
+        record = dict(grant)
+        record["schema_version"] = 2
+        record["token_digest"] = token_digest(value)
+        record["revoked"] = False
+        record.setdefault("created_at", utc_now())
+        required = (
+            "token_id",
+            "audience",
+            "task_id",
+            "source_cidrs",
+            "allowed_branch",
+            "approved_base_oid",
+            "allowed_operations",
+            "allowed_paths",
+            "not_before",
+            "expires_at",
+            "max_uses",
+            "issued_by",
+        )
+        if any(not record.get(field) for field in required):
+            raise ValueError("writer_token_grant_incomplete")
+        encoded = json.dumps(record, sort_keys=True, separators=(",", ":"))
+        with self._connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            try:
+                db.execute(
+                    """
+                    INSERT INTO token_grants(token_id, token_digest, grant_json, revoked, created_at)
+                    VALUES(?,?,?,?,?)
+                    """,
+                    (
+                        str(record["token_id"]),
+                        str(record["token_digest"]),
+                        encoded,
+                        0,
+                        str(record["created_at"]),
+                    ),
+                )
+                db.execute("COMMIT")
+            except Exception:
+                db.execute("ROLLBACK")
+                raise
+        return value, record
+
+    def find(self, token: str) -> dict[str, Any] | None:
+        candidate = token_digest(token)
+        with self._connect() as db:
+            rows = db.execute(
+                "SELECT token_digest, grant_json, revoked FROM token_grants"
+            ).fetchall()
+        match = None
+        for row in rows:
+            if hmac.compare_digest(str(row["token_digest"]), candidate):
+                match = dict(json.loads(str(row["grant_json"])))
+                match["revoked"] = bool(row["revoked"])
+        return match
+
+    def consume(self, token_id: str, operation: str, maximum: int) -> int:
+        if maximum < 1:
+            raise PermissionError("writer_token_operation_exhausted")
+        with self._connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            try:
+                row = db.execute(
+                    "SELECT revoked FROM token_grants WHERE token_id=?",
+                    (token_id,),
+                ).fetchone()
+                if row is None or bool(row["revoked"]):
+                    raise PermissionError("writer_token_revoked")
+                used_row = db.execute(
+                    "SELECT use_count FROM token_uses WHERE token_id=? AND operation=?",
+                    (token_id, operation),
+                ).fetchone()
+                used = int(used_row["use_count"]) if used_row else 0
+                if used >= maximum:
+                    raise PermissionError("writer_token_operation_exhausted")
+                current = used + 1
+                db.execute(
+                    """
+                    INSERT INTO token_uses(token_id, operation, use_count)
+                    VALUES(?,?,?)
+                    ON CONFLICT(token_id, operation)
+                    DO UPDATE SET use_count=excluded.use_count
+                    """,
+                    (token_id, operation, current),
+                )
+                db.execute("COMMIT")
+                return current
+            except Exception:
+                db.execute("ROLLBACK")
+                raise
+
+    def revoke(self, token_id: str) -> bool:
+        with self._connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            changed = db.execute(
+                "UPDATE token_grants SET revoked=1 WHERE token_id=? AND revoked=0",
+                (token_id,),
+            ).rowcount
+            db.execute("COMMIT")
+        return bool(changed)
+
+    def usage(self, token_id: str, operation: str) -> int:
+        with self._connect() as db:
+            row = db.execute(
+                "SELECT use_count FROM token_uses WHERE token_id=? AND operation=?",
+                (token_id, operation),
+            ).fetchone()
+        return int(row["use_count"]) if row else 0
+
+
+def _write_secret_file(
+    path: Path,
+    token: str,
+    *,
+    owner: str | None = None,
+    group: str | None = None,
+) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    if path.parent.is_symlink() or path.is_symlink():
+        raise PermissionError("writer_token_file_symlink_rejected")
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    fd = os.open(path, flags, 0o600)
+    try:
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            raise PermissionError("writer_token_file_not_regular")
+        if owner is not None or group is not None:
+            uid = pwd.getpwnam(owner).pw_uid if owner is not None else -1
+            gid = grp.getgrnam(group).gr_gid if group is not None else -1
+            os.fchown(fd, uid, gid)
+        os.write(fd, token.encode("utf-8"))
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--registry", required=True)
+    sub = parser.add_subparsers(dest="command", required=True)
+    issue = sub.add_parser("issue")
+    issue.add_argument("--grant-file", required=True)
+    issue.add_argument("--token-file", required=True)
+    issue.add_argument("--owner")
+    issue.add_argument("--group")
+    revoke = sub.add_parser("revoke")
+    revoke.add_argument("--token-id", required=True)
+    args = parser.parse_args(argv)
+    registry = TokenRegistry(args.registry)
+    if args.command == "issue":
+        grant = json.loads(Path(args.grant_file).read_text(encoding="utf-8"))
+        token, record = registry.issue(grant)
+        _write_secret_file(
+            Path(args.token_file),
+            token,
+            owner=args.owner,
+            group=args.group,
+        )
+        print(json.dumps({"token_id": record["token_id"], "created": True}, sort_keys=True))
+        return 0
+    changed = registry.revoke(args.token_id)
+    print(json.dumps({"token_id": args.token_id, "revoked": changed}, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

active-runtime/app/silent_release_execution.py

@@ -0,0 +1,564 @@
+#!/usr/bin/env python3
+"""Execution-readiness adapters and the fail-closed Shadow controller service."""
+from __future__ import annotations
+
+import argparse
+import base64
+import dataclasses
+import hashlib
+import json
+import os
+import subprocess
+import threading
+import time
+from http import HTTPStatus
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from typing import Any, Callable, Mapping, Protocol
+from urllib.parse import parse_qs, urlparse
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey,
+)
+
+from silent_release_controller import _sanitize, utc_now
+from silent_release_hardening import (
+    BuilderAttestation,
+    CapabilityAuthorizationError,
+    ReleaseRecoveryWorker,
+    SignedApprovalVerifier,
+    SignedReleasePlanApproval,
+    SilentReleaseActionService,
+    TrustedCandidateBundle,
+    _canonical_json,
+    _durable_json,
+    _safe_child,
+)
+
+
+class BuilderSigner(Protocol):
+    @property
+    def key_id(self) -> str:
+        ...
+
+    def sign(self, payload: bytes) -> bytes:
+        ...
+
+
+class LocalTestBuilderSigner:
+    """Ephemeral in-memory signer. It is forbidden for production execution."""
+
+    test_only = True
+
+    def __init__(self, key_id: str, private_key: Ed25519PrivateKey):
+        self._key_id = str(key_id)
+        self._private_key = private_key
+
+    @property
+    def key_id(self) -> str:
+        return self._key_id
+
+    @classmethod
+    def generate(
+        cls, key_id: str = "shadow-builder-test-key"
+    ) -> "LocalTestBuilderSigner":
+        return cls(key_id, Ed25519PrivateKey.generate())
+
+    @property
+    def public_key(self):
+        return self._private_key.public_key()
+
+    def sign(self, payload: bytes) -> bytes:
+        return self._private_key.sign(payload)
+
+
+class ExternalKmsBuilderSigner:
+    """Signer facade whose private operation remains in KMS/HSM."""
+
+    def __init__(
+        self,
+        key_id: str,
+        credential_reference: str,
+        sign_callback: Callable[[str, bytes], bytes],
+    ):
+        if not str(credential_reference).startswith(
+            ("kms://", "hsm://", "secret-manager://")
+        ):
+            raise ValueError("production builder requires a KMS/HSM reference")
+        self._key_id = str(key_id)
+        self.credential_reference = str(credential_reference)
+        self._sign_callback = sign_callback
+
+    @property
+    def key_id(self) -> str:
+        return self._key_id
+
+    def sign(self, payload: bytes) -> bytes:
+        return bytes(self._sign_callback(self.credential_reference, payload))
+
+
+class SignedTrustedBuilderAdapter:
+    """Signs evidence produced by a trusted collector, never caller evidence."""
+
+    def __init__(
+        self,
+        collector: Callable[[Mapping[str, Any]], TrustedCandidateBundle],
+        signer: BuilderSigner,
+    ):
+        self.collector = collector
+        self.signer = signer
+
+    def build(self, intent: Mapping[str, Any]) -> TrustedCandidateBundle:
+        forbidden = {
+            "artifact_sha256",
+            "canary",
+            "checks",
+            "manifest_sha256",
+            "tests",
+            "tree_oid",
+        }
+        if forbidden.intersection(intent):
+            raise CapabilityAuthorizationError(
+                "trusted builder rejects caller-supplied evidence"
+            )
+        unsigned = self.collector(dict(intent))
+        if unsigned.attestation is not None:
+            raise CapabilityAuthorizationError(
+                "collector cannot self-attest its evidence"
+            )
+        candidate = unsigned.candidate
+        test_sha = hashlib.sha256(
+            _canonical_json(_sanitize(candidate.tests))
+        ).hexdigest()
+        canary_sha = hashlib.sha256(
+            _canonical_json(_sanitize(candidate.canary))
+        ).hexdigest()
+        attestation_id = "builder-attestation-" + hashlib.sha256(
+            (
+                candidate.candidate_id
+                + "\0"
+                + candidate.source_commit
+                + "\0"
+                + candidate.artifact_sha256
+            ).encode("utf-8")
+        ).hexdigest()[:24]
+        attestation = BuilderAttestation(
+            builder_attestation_id=attestation_id,
+            builder_key_id=self.signer.key_id,
+            source_commit=candidate.source_commit,
+            tree_oid=candidate.tree_oid,
+            artifact_sha256=candidate.artifact_sha256,
+            manifest_sha256=candidate.manifest_sha256,
+            package_closure_sha256=(
+                unsigned.release_plan.deployment.package_closure_sha256
+            ),
+            test_evidence_sha256=test_sha,
+            canary_evidence_sha256=canary_sha,
+            issued_at=utc_now(),
+            signature="",
+        )
+        attestation = dataclasses.replace(
+            attestation,
+            signature=base64.b64encode(
+                self.signer.sign(attestation.canonical_bytes())
+            ).decode("ascii"),
+        )
+        return dataclasses.replace(unsigned, attestation=attestation)
+
+
+class ApprovalBackendAdapter(Protocol):
+    @property
+    def available(self) -> bool:
+        ...
+
+    def verify(
+        self,
+        approval: SignedReleasePlanApproval,
+        *,
+        candidate,
+        release_plan,
+        policy_sha256: str,
+    ) -> SignedReleasePlanApproval:
+        ...
+
+
+class LocalTestApprovalSigner:
+    """Test-only approval signer used solely for Shadow acceptance."""
+
+    test_only = True
+
+    def __init__(self, key_id: str, private_key: Ed25519PrivateKey):
+        self.key_id = str(key_id)
+        self.private_key = private_key
+
+    @classmethod
+    def generate(
+        cls, key_id: str = "shadow-owner-test-key"
+    ) -> "LocalTestApprovalSigner":
+        return cls(key_id, Ed25519PrivateKey.generate())
+
+    def sign(
+        self, approval: SignedReleasePlanApproval
+    ) -> SignedReleasePlanApproval:
+        unsigned = dataclasses.replace(
+            approval, key_id=self.key_id, signature=""
+        )
+        return dataclasses.replace(
+            unsigned,
+            signature=base64.b64encode(
+                self.private_key.sign(unsigned.canonical_bytes())
+            ).decode("ascii"),
+        )
+
+
+class ProductionApprovalBackendAdapter:
+    """Verification-only production adapter configured by a secret/KMS ref."""
+
+    def __init__(
+        self,
+        verifier: SignedApprovalVerifier,
+        credential_reference: str,
+    ):
+        if not str(credential_reference).startswith(
+            ("kms://", "hsm://", "secret-manager://")
+        ):
+            raise ValueError(
+                "production approval backend requires a KMS/secret reference"
+            )
+        self.verifier = verifier
+        self.credential_reference = str(credential_reference)
+
+    @property
+    def available(self) -> bool:
+        return True
+
+    def verify(
+        self,
+        approval: SignedReleasePlanApproval,
+        *,
+        candidate,
+        release_plan,
+        policy_sha256: str,
+    ) -> SignedReleasePlanApproval:
+        return self.verifier.verify_release_plan(
+            approval, candidate, release_plan, policy_sha256
+        )
+
+
+class UnavailableProductionApprovalBackend:
+    credential_reference = None
+
+    @property
+    def available(self) -> bool:
+        return False
+
+    def verify(self, *args, **kwargs):
+        raise CapabilityAuthorizationError(
+            "production approval backend is not configured"
+        )
+
+
+class LeaderLock:
+    def __init__(self, path: Path):
+        self.path = Path(path)
+        self.handle = None
+
+    def __enter__(self):
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        os.chmod(self.path.parent, 0o700)
+        self.handle = self.path.open("a+", encoding="utf-8")
+        os.chmod(self.path, 0o600)
+        try:
+            import fcntl
+
+            fcntl.flock(
+                self.handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB
+            )
+        except BlockingIOError as exc:
+            self.handle.close()
+            self.handle = None
+            raise RuntimeError("silent release leader is already active") from exc
+        return self
+
+    def __exit__(self, exc_type, exc, tb):
+        if self.handle is not None:
+            try:
+                import fcntl
+
+                fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
+            finally:
+                self.handle.close()
+                self.handle = None
+
+
+class PersistentSilentReleaseController:
+    """Idempotent main-event controller with durable startup/recovery reports."""
+
+    def __init__(
+        self,
+        root: Path,
+        service: SilentReleaseActionService,
+        *,
+        main_probe: Callable[[], str],
+        recovery_worker: ReleaseRecoveryWorker | None = None,
+    ):
+        self.root = Path(root)
+        self.service = service
+        self.main_probe = main_probe
+        self.recovery_worker = recovery_worker
+        self.leader_path = self.root / "controller.leader.lock"
+        self.status_path = self.root / "controller-status.json"
+
+    def startup_verify(self) -> dict[str, Any]:
+        checked = 0
+        failed = 0
+        for journal in sorted(self.service.sagas.root.glob("*.events.jsonl")):
+            candidate_id = journal.name[: -len(".events.jsonl")]
+            saga = self.service.sagas.load(candidate_id)
+            checked += 1
+            if not saga.journal_integrity:
+                failed += 1
+        status = {
+            "checked_sagas": checked,
+            "execution_enabled": self.service.execution_enabled,
+            "failed_closed": failed,
+            "shadow_mode": not self.service.execution_enabled,
+            "side_effects_executed": False,
+            "status": "READY" if failed == 0 else "FAIL_CLOSED",
+        }
+        _durable_json(self.status_path, status)
+        return status
+
+    def run_once(self) -> dict[str, Any]:
+        with LeaderLock(self.leader_path):
+            startup = self.startup_verify()
+            if startup["status"] != "READY":
+                result = {
+                    "execution_enabled": self.service.execution_enabled,
+                    "intent": None,
+                    "notification": None,
+                    "recovery": None,
+                    "shadow_mode": not self.service.execution_enabled,
+                    "side_effects_executed": False,
+                    "startup": startup,
+                    "status": "FAIL_CLOSED",
+                }
+                _durable_json(self.status_path, result)
+                return _sanitize(result)
+            source_commit = str(self.main_probe())
+            event_id = f"main-{source_commit}"
+            intent = self.service.create_release_intent(
+                {"event_id": event_id, "source_commit": source_commit}
+            )
+            notification = None
+            if intent.get("candidate_id"):
+                notification = self.service.ensure_owner_notification(
+                    str(intent["candidate_id"])
+                )
+            recovery = (
+                self.recovery_worker.run_once()
+                if self.recovery_worker is not None
+                else self.service.get_recovery_status()
+            )
+            result = {
+                "execution_enabled": self.service.execution_enabled,
+                "intent": intent,
+                "notification": notification,
+                "recovery": recovery,
+                "shadow_mode": not self.service.execution_enabled,
+                "side_effects_executed": False,
+                "startup": startup,
+            }
+            _durable_json(self.status_path, result)
+            return _sanitize(result)
+
+
+class ShadowActionHandler(BaseHTTPRequestHandler):
+    service: SilentReleaseActionService
+    controller: PersistentSilentReleaseController
+
+    def log_message(self, fmt, *args):
+        return
+
+    def _json(self, payload: Mapping[str, Any], status=HTTPStatus.OK):
+        body = json.dumps(_sanitize(dict(payload)), sort_keys=True).encode()
+        self.send_response(int(status))
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _body(self) -> dict[str, Any]:
+        size = int(self.headers.get("Content-Length", "0"))
+        if size > 1024 * 1024:
+            raise ValueError("request body is too large")
+        return json.loads(self.rfile.read(size) or b"{}")
+
+    def do_GET(self):
+        parsed = urlparse(self.path)
+        query = parse_qs(parsed.query)
+        candidate_id = str((query.get("candidate_id") or [""])[0])
+        try:
+            if parsed.path == "/healthz":
+                return self._json(
+                    {
+                        "execution_enabled": False,
+                        "shadow_mode": True,
+                        "side_effects_executed": False,
+                        "status": "ok",
+                    }
+                )
+            routes = {
+                "/getReleaseCandidate": self.service.get_release_candidate,
+                "/getReleasePlan": self.service.get_release_plan,
+                "/getReleaseAcceptance": self.service.get_acceptance,
+                "/getReleaseSaga": self.service.get_release_saga,
+                "/getCapabilityStatus": self.service.get_capability_status,
+            }
+            if parsed.path in routes:
+                return self._json(routes[parsed.path](candidate_id))
+            if parsed.path == "/getRecoveryStatus":
+                return self._json(self.service.get_recovery_status())
+            self._json({"error": "not_found"}, HTTPStatus.NOT_FOUND)
+        except (ValueError, FileNotFoundError) as exc:
+            self._json(
+                {"error": type(exc).__name__}, HTTPStatus.BAD_REQUEST
+            )
+
+    def do_POST(self):
+        parsed = urlparse(self.path)
+        try:
+            body = self._body()
+            if parsed.path == "/createReleaseIntent":
+                return self._json(self.service.create_release_intent(body))
+            if parsed.path in {
+                "/submitSignedApproval",
+                "/submitOwnerApproval",
+            }:
+                return self._json(self.service.submit_owner_approval(body))
+            if parsed.path == "/startDeployment":
+                return self._json(
+                    self.service.start_deployment(
+                        str(body.get("candidate_id") or "")
+                    )
+                )
+            self._json({"error": "not_found"}, HTTPStatus.NOT_FOUND)
+        except (ValueError, FileNotFoundError, CapabilityAuthorizationError) as exc:
+            self._json(
+                {"error": type(exc).__name__}, HTTPStatus.BAD_REQUEST
+            )
+
+
+def git_main_probe(repository: Path) -> Callable[[], str]:
+    repository = Path(repository)
+
+    def probe() -> str:
+        completed = subprocess.run(
+            [
+                "git",
+                f"--git-dir={repository}",
+                "rev-parse",
+                "refs/heads/main",
+            ],
+            check=True,
+            capture_output=True,
+            text=True,
+            timeout=15,
+            env={"PATH": os.environ.get("PATH", "")},
+        )
+        return completed.stdout.strip()
+
+    return probe
+
+
+def serve_shadow(
+    *,
+    state_root: Path,
+    repository: Path,
+    host: str,
+    port: int,
+    poll_seconds: float,
+) -> None:
+    service = SilentReleaseActionService.shadow(state_root)
+    controller = PersistentSilentReleaseController(
+        state_root,
+        service,
+        main_probe=git_main_probe(repository),
+    )
+    controller.run_once()
+    stop = threading.Event()
+
+    def controller_loop() -> None:
+        while not stop.wait(poll_seconds):
+            try:
+                controller.run_once()
+            except Exception as exc:  # fail closed and keep the API available
+                _durable_json(
+                    controller.status_path,
+                    {
+                        "error": type(exc).__name__,
+                        "execution_enabled": False,
+                        "shadow_mode": True,
+                        "side_effects_executed": False,
+                        "status": "FAIL_CLOSED",
+                    },
+                )
+
+    handler = type(
+        "ConfiguredShadowActionHandler",
+        (ShadowActionHandler,),
+        {"service": service, "controller": controller},
+    )
+    server = ThreadingHTTPServer((host, port), handler)
+    api_thread = threading.Thread(
+        target=server.serve_forever,
+        name="silent-release-shadow-api",
+        daemon=False,
+    )
+    controller_thread = threading.Thread(
+        target=controller_loop,
+        name="silent-release-shadow-controller",
+        daemon=True,
+    )
+    api_thread.start()
+    controller_thread.start()
+    try:
+        while api_thread.is_alive():
+            api_thread.join(timeout=1)
+    finally:
+        stop.set()
+        server.shutdown()
+        server.server_close()
+        controller_thread.join(timeout=max(1.0, poll_seconds + 1.0))
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--state-root", required=True, type=Path)
+    parser.add_argument("--repository", required=True, type=Path)
+    parser.add_argument("--host", default="127.0.0.1")
+    parser.add_argument("--port", default=18891, type=int)
+    parser.add_argument("--poll-seconds", default=30.0, type=float)
+    arguments = parser.parse_args()
+    if arguments.poll_seconds <= 0:
+        raise SystemExit("poll seconds must be positive")
+    if os.environ.get("AIOS_GITOPS_WRITES_ENABLED", "false").lower() != "false":
+        raise SystemExit("GitOps writes must remain disabled")
+    if (
+        os.environ.get(
+            "AIOS_SILENT_RELEASE_EXECUTION_ENABLED", "false"
+        ).lower()
+        != "false"
+    ):
+        raise SystemExit("Silent Release execution must remain disabled")
+    serve_shadow(
+        state_root=arguments.state_root,
+        repository=arguments.repository,
+        host=arguments.host,
+        port=arguments.port,
+        poll_seconds=arguments.poll_seconds,
+    )
+
+
+if __name__ == "__main__":
+    main()

active-runtime/app/task_plane/__init__.py

@@ -0,0 +1,21 @@
+"""Task Plane runtime package."""
+
+from .models import (
+    EvidenceEnvelope,
+    ProbeEvidence,
+    ProbeOutcome,
+    TaskPlan,
+    TaskRecord,
+    TaskStatus,
+    TaskStateTransitionError,
+)
+
+__all__ = [
+    "EvidenceEnvelope",
+    "ProbeEvidence",
+    "ProbeOutcome",
+    "TaskPlan",
+    "TaskRecord",
+    "TaskStatus",
+    "TaskStateTransitionError",
+]

active-runtime/app/task_plane/adapters/__init__.py

@@ -0,0 +1,17 @@
+"""Adapters for executing tasks via worker backends."""
+
+from .base import WorkerAdapter
+from .openclaw import OpenClawAdapter
+from .codex import CodexAdapter
+from .hermes import HermesAdapter
+from .a2a import A2AAdapter
+from .systemd_worker import SystemdWorkerAdapter
+
+__all__ = [
+    "WorkerAdapter",
+    "OpenClawAdapter",
+    "CodexAdapter",
+    "HermesAdapter",
+    "A2AAdapter",
+    "SystemdWorkerAdapter",
+]

active-runtime/app/task_plane/adapters/a2a.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .base import WorkerAdapter
+
+
+class A2AAdapter(WorkerAdapter):
+    worker_name = "a2a"
+
+    def capabilities(self) -> list[str]:
+        return ["task.exchange", "agent.handoff"]
+
+    def claim(self, task):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
+
+    def execute(self, task, claim):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
+
+    def heartbeat(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
+
+    def report_progress(self, claim, progress):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
+
+    def probe(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
+
+    def cancel(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
+
+    def collect_result(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}

active-runtime/app/task_plane/adapters/base.py

@@ -0,0 +1,41 @@
+"""Base worker adapter contract."""
+
+from __future__ import annotations
+
+import abc
+
+
+class WorkerAdapter(abc.ABC):
+    worker_name = "base"
+
+    @abc.abstractmethod
+    def capabilities(self) -> list[str]:
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def claim(self, task):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def execute(self, task, claim):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def heartbeat(self, claim):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def report_progress(self, claim, progress):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def probe(self, claim):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def cancel(self, claim):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def collect_result(self, claim):
+        raise NotImplementedError

active-runtime/app/task_plane/adapters/codex.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .base import WorkerAdapter
+
+
+class CodexAdapter(WorkerAdapter):
+    worker_name = "codex"
+
+    def capabilities(self) -> list[str]:
+        return ["code.read", "code.write.patch", "test.python", "review.security"]
+
+    def claim(self, task):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
+
+    def execute(self, task, claim):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
+
+    def heartbeat(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
+
+    def report_progress(self, claim, progress):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
+
+    def probe(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
+
+    def cancel(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
+
+    def collect_result(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}

active-runtime/app/task_plane/adapters/hermes.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .base import WorkerAdapter
+
+
+class HermesAdapter(WorkerAdapter):
+    worker_name = "hermes"
+
+    def capabilities(self) -> list[str]:
+        return ["architecture.review", "policy.review", "threat.model"]
+
+    def claim(self, task):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
+
+    def execute(self, task, claim):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
+
+    def heartbeat(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
+
+    def report_progress(self, claim, progress):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
+
+    def probe(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
+
+    def cancel(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
+
+    def collect_result(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}

active-runtime/app/task_plane/adapters/openclaw.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .base import WorkerAdapter
+
+
+class OpenClawAdapter(WorkerAdapter):
+    worker_name = "openclaw"
+
+    def capabilities(self) -> list[str]:
+        return ["code.read", "code.write.patch", "test.execute", "runtime.shadow"]
+
+    def claim(self, task):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
+
+    def execute(self, task, claim):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
+
+    def heartbeat(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
+
+    def report_progress(self, claim, progress):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
+
+    def probe(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
+
+    def cancel(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
+
+    def collect_result(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}

active-runtime/app/task_plane/adapters/systemd_worker.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .base import WorkerAdapter
+
+
+class SystemdWorkerAdapter(WorkerAdapter):
+    worker_name = "systemd_worker"
+
+    def capabilities(self) -> list[str]:
+        return ["systemd.exec", "runtime.shell"]
+
+    def claim(self, task):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
+
+    def execute(self, task, claim):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
+
+    def heartbeat(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
+
+    def report_progress(self, claim, progress):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
+
+    def probe(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
+
+    def cancel(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
+
+    def collect_result(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}

active-runtime/app/task_plane/agent_registry.py

@@ -0,0 +1,27 @@
+"""Agent registry abstraction."""
+
+from __future__ import annotations
+
+from .errors import NotFoundError
+
+
+class AgentRegistry:
+    def __init__(self):
+        self._agents: dict[str, dict] = {}
+
+    def register(self, agent_id: str, metadata: dict) -> None:
+        self._agents[agent_id] = {"agent_id": agent_id, **metadata}
+
+    def unregister(self, agent_id: str) -> None:
+        if agent_id not in self._agents:
+            raise NotFoundError("agent")
+        del self._agents[agent_id]
+
+    def list(self) -> list[dict]:
+        return list(self._agents.values())
+
+    def get(self, agent_id: str) -> dict:
+        try:
+            return self._agents[agent_id]
+        except KeyError:
+            raise NotFoundError("agent")

active-runtime/app/task_plane/api.py

@@ -0,0 +1,557 @@
+"""Task Plane HTTP API implementation (stdlib-only)."""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+import uuid
+import urllib.parse
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from typing import Any, Callable
+
+from .delegation import DelegationEngine
+from .errors import (
+    ConflictError,
+    ForbiddenError,
+    NotFoundError,
+    PayloadTooLargeError,
+    TaskPlaneHTTPError,
+    UnauthorizedError,
+    ValidationError,
+)
+from .evidence import EvidenceService
+from .journal import TaskJournal
+from .lease import LeaseManager
+from .models import (
+    EvidenceEnvelope,
+    ResultEnvelope,
+    TaskPlan,
+    TaskRecord,
+    iso8601_now,
+    contains_secret_text,
+    validate_identifier,
+)
+from .policy import PolicyEngine
+from .store import TaskPlaneStore
+from .worker_registry import WorkerRegistry
+
+
+def _json_payload(data: dict[str, Any], status: int = 200) -> tuple[int, bytes]:
+    body = json.dumps(data, ensure_ascii=False).encode("utf-8")
+    return status, body
+
+
+def _bounded_int(value: Any, name: str, minimum: int, maximum: int) -> int:
+    try:
+        number = int(value)
+    except (TypeError, ValueError) as exc:
+        raise ValidationError(f"invalid {name}") from exc
+    if not minimum <= number <= maximum:
+        raise ValidationError(f"invalid {name}")
+    return number
+
+
+class TaskPlaneService:
+    def __init__(self, store: TaskPlaneStore, policy: PolicyEngine | None = None):
+        self.store = store
+        self.policy = policy or PolicyEngine(
+            execution_enabled=False,
+            identity_capabilities={
+                "anon": {"task.creator", "task.read", "task.audit"}
+            },
+        )
+        self.journal = TaskJournal(store)
+        self.lease = LeaseManager(store)
+        self.workers = WorkerRegistry(store)
+        self.evidence = EvidenceService(store)
+        self.delegation = DelegationEngine(store)
+        self.store.probe_attestation_verifier = self.policy.probe_attestation_verifier
+
+    def create_task(self, body: dict[str, Any], idempotency_key: str | None = None) -> dict[str, Any]:
+        if body.get("parent_task_id"):
+            raise ForbiddenError("child tasks must use the delegate endpoint")
+        issuer = body.get("issuer", {})
+        actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
+        self.policy.assert_allowed("create", actor)
+        try:
+            plan = TaskPlan.from_dict(body)
+        except (TypeError, ValueError) as exc:
+            raise ValidationError("invalid task plan") from exc
+        task = self.store.create_task_with_event(plan, idempotency_key=idempotency_key)
+        return task.to_dict()
+
+    def list_tasks(self, actor: str | None = None) -> list[dict[str, Any]]:
+        if actor is not None:
+            self.policy.assert_allowed("read", actor)
+        return [task.to_dict(include_task=False) for task in self.store.list_tasks()]
+
+    def get_task(self, task_id: str, actor: str | None = None) -> dict[str, Any]:
+        if actor is not None:
+            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
+        return self.store.get_task(task_id).to_dict()
+
+    def get_worker(self, worker_id: str, actor: str | None = None) -> dict[str, Any]:
+        if actor is not None:
+            self.policy.assert_allowed("read", actor)
+        return self.workers.get(worker_id).to_dict()
+
+    def list_workers(self, actor: str | None = None) -> list[dict[str, Any]]:
+        if actor is not None:
+            self.policy.assert_allowed("read", actor)
+        return [w.to_dict() for w in self.workers.list()]
+
+    def register_worker(self, body: dict[str, Any]) -> dict[str, Any]:
+        actor = str(body.get("actor_identity") or body.get("identity") or "")
+        is_admin = actor in self.policy.admin_identities
+        try:
+            existing = self.store.get_worker(str(body.get("worker_id") or ""))
+        except NotFoundError:
+            existing = None
+        if existing is not None and str(body.get("identity") or "") != existing.identity:
+            raise ConflictError("worker identity takeover rejected")
+        self.policy.assert_readonly_worker_registration(actor, body)
+        self.policy.assert_allowed(
+            "worker.admin" if is_admin else "worker.register", actor
+        )
+        try:
+            worker = self.workers.register(
+                body,
+                actor_identity=actor,
+                is_admin=is_admin,
+                expected_revision=body.get("expected_revision"),
+            )
+        except (TypeError, ValueError, KeyError) as exc:
+            raise ValidationError("invalid worker registration") from exc
+        return worker.to_dict()
+
+    def worker_heartbeat(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+        interval = payload.get("heartbeat_interval_seconds")
+        actor = str(payload.get("actor_identity") or "")
+        self.policy.assert_readonly_worker_binding(actor, worker_id)
+        self.policy.assert_allowed("worker.register", actor)
+        return self.workers.heartbeat(
+            worker_id,
+            heartbeat_interval_seconds=interval,
+            actor_identity=actor,
+            expected_revision=payload.get("expected_revision"),
+        ).to_dict()
+
+    def disable_worker(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+        actor = str(payload.get("actor_identity") or "")
+        self.policy.assert_allowed("worker.admin", actor)
+        return self.store.disable_worker(
+            worker_id,
+            actor_identity=actor,
+            expected_revision=int(payload.get("expected_revision")),
+            reason=str(payload.get("reason") or "disabled by administrator"),
+        ).to_dict()
+
+    def restore_worker(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+        actor = str(payload.get("actor_identity") or "")
+        self.policy.assert_allowed("worker.admin", actor)
+        return self.store.restore_worker(
+            worker_id,
+            actor_identity=actor,
+            expected_revision=int(payload.get("expected_revision")),
+        ).to_dict()
+
+    def claim(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
+        self.policy.assert_allowed("claim", actor)
+        worker_id = body.get("worker_id")
+        if not worker_id:
+            raise ValidationError("worker_id required")
+
+        task = self.store.get_task(task_id)
+        self.policy.assert_readonly_worker_binding(actor, str(worker_id))
+        self.policy.assert_allowed("claim", actor, task=task)
+        lease_seconds = _bounded_int(
+            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
+        )
+        claim = self.lease.claim(
+            task_id=task_id,
+            worker_id=worker_id,
+            worker_identity=actor,
+            lease_seconds=lease_seconds,
+            expected_revision=task.revision,
+            operation_digest=task.task_plan.operation_digest(),
+        )
+        return {"claim_id": claim.claim_id, **claim.to_dict()}
+
+    def heartbeat(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        claim_id = body.get("claim_id")
+        if not claim_id:
+            raise ValidationError("claim_id required")
+        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
+        task = self.store.get_task(task_id)
+        claim = self.store.get_claim(claim_id)
+        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
+        self.policy.assert_allowed("heartbeat", actor, task=task)
+        if claim.worker_identity != actor:
+            raise ForbiddenError("claim identity mismatch")
+        lease_seconds = _bounded_int(
+            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
+        )
+        claim = self.lease.heartbeat(task_id, claim_id, lease_seconds)
+        return {"claim_id": claim_id, "lease_until": claim.lease_until}
+
+    def progress(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        claim_id = body.get("claim_id")
+        if not claim_id:
+            raise ValidationError("claim_id required")
+        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
+        progress = body.get("progress")
+        stage = body.get("stage", "RUNNING")
+        message = body.get("message")
+        if progress is None:
+            raise ValidationError("progress required")
+        task = self.store.get_task(task_id)
+        claim = self.store.get_claim(claim_id)
+        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
+        self.policy.assert_allowed("progress", actor, task=task)
+        if task.task_plan.data_classification == "credential-secret":
+            if message not in {None, ""} or contains_secret_text(stage):
+                raise ValidationError(
+                    "credential-secret progress must contain metadata only"
+                )
+        lease_seconds = _bounded_int(
+            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
+        )
+        claim = self.store.record_progress(
+            task_id,
+            claim_id,
+            actor,
+            progress=progress,
+            stage=str(stage),
+            message=None if message is None else str(message),
+            lease_seconds=lease_seconds,
+        )
+        return {"claim_id": claim.claim_id, "status": claim.status, "progress": progress}
+
+    def complete(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        claim_id = body.get("claim_id")
+        if not claim_id:
+            raise ValidationError("claim_id required")
+        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
+        task = self.store.get_task(task_id)
+
+        status = body.get("status", "COMPLETED")
+        outputs = body.get("outputs", [])
+        evidences = body.get("evidence", [])
+        if not isinstance(outputs, list):
+            raise ValidationError("outputs must be list")
+        if not isinstance(evidences, list):
+            raise ValidationError("evidence must be list")
+        if any(not isinstance(ev, dict) for ev in evidences):
+            raise ValidationError("evidence items must be objects")
+        claim = self.store.get_claim(claim_id)
+        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
+        self.policy.assert_allowed("result", actor, task=task)
+        if claim.worker_identity != actor:
+            raise ForbiddenError("claim identity mismatch")
+        if task.task_plan.data_classification == "credential-secret":
+            allowed_result_keys = {
+                "kind",
+                "hash",
+                "sha256",
+                "count",
+                "status",
+                "error_code",
+                "signature",
+                "attestation_ref",
+            }
+            for entry in [*outputs, *evidences]:
+                if (
+                    not isinstance(entry, dict)
+                    or set(entry) - allowed_result_keys
+                    or contains_secret_text(entry)
+                ):
+                    raise ValidationError(
+                        "credential-secret result must contain hash/count/status only"
+                    )
+
+        result = ResultEnvelope(
+            task_id=task_id,
+            claim_id=claim_id,
+            worker_identity=actor,
+            status=status,
+            outputs=outputs,
+            evidence=evidences,
+            started_at=str(body.get("started_at") or iso8601_now()),
+            completed_at=str(body.get("completed_at") or iso8601_now()),
+            result_digest=body.get("result_digest"),
+            signature=body.get("signature"),
+            attestation_ref=body.get("attestation_ref"),
+            operation_digest=claim.operation_digest,
+        )
+        evidence_decision = self.policy.evidence_verifier.verify(task, evidences)
+        if not evidence_decision.allowed:
+            raise ForbiddenError(evidence_decision.reason)
+        result_decision = self.policy.verify_result(result, task)
+        if not result_decision.allowed:
+            raise ForbiddenError(result_decision.reason)
+        result.result_digest = result.computed_digest()
+        previous = self.store._last_evidence_hash(task_id)
+        evidence_entries = []
+        for evidence in evidences:
+            envelope = EvidenceEnvelope.create(
+                task_id=task_id,
+                claim_id=claim_id,
+                kind=str(evidence.get("kind") or evidence.get("type") or "generic"),
+                worker_identity=actor,
+                payload=evidence,
+                previous_evidence_hash=previous,
+                signature=evidence.get("signature"),
+                attestation_ref=evidence.get("attestation_ref"),
+            )
+            evidence_entries.append(envelope)
+            previous = envelope.evidence_digest
+        self.store.complete_claim_with_evidence_and_event(
+            task_id,
+            claim_id,
+            status
+            if status
+            in {"COMPLETED", "FAILED_FINAL", "FAILED_RECOVERABLE", "CANCELLED"}
+            else "COMPLETED",
+            result.to_dict(),
+            evidence_entries,
+        )
+        return result.to_dict()
+
+    def fail(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        claim_id = body.get("claim_id")
+        if not claim_id:
+            raise ValidationError("claim_id required")
+        reason = body.get("reason", "failed")
+        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
+        self.policy.assert_allowed("fail", actor)
+        task = self.store.get_task(task_id)
+        self.policy.assert_allowed("fail", actor, task=task)
+        claim = self.store.get_claim(claim_id)
+        if claim.worker_identity != actor:
+            raise ForbiddenError("claim identity mismatch")
+        status = "FAILED_RECOVERABLE" if body.get("recoverable", False) else "FAILED_FINAL"
+        self.store.fail_claim_with_event(task_id, claim_id, status, str(reason))
+        return {"task_id": task_id, "status": status, "reason": reason}
+
+    def cancel(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        actor = body.get("actor_identity") or body.get("worker_identity") or "owner"
+        self.policy.assert_allowed("cancel", actor)
+        reason = body.get("reason", "cancelled")
+        task = self.store.get_task(task_id)
+        self.policy.assert_allowed("cancel", actor, task=task)
+        updated = self.store.cancel_task_with_event(
+            task_id, task.revision, reason=reason
+        )
+        return updated.to_dict()
+
+    def delegate(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        actor = body.get("actor_identity") or "owner"
+        self.policy.assert_allowed("delegate", actor)
+        parent = self.store.get_task(task_id)
+        self.policy.assert_allowed("delegate", actor, task=parent)
+        if "task" in body:
+            try:
+                child_plan = TaskPlan.from_dict(body["task"])
+            except (TypeError, ValueError) as exc:
+                raise ValidationError("invalid child task plan") from exc
+        else:
+            plan_body = dict(body)
+            plan_body.pop("actor_identity", None)
+            try:
+                child_plan = TaskPlan.from_dict(plan_body)
+            except (TypeError, ValueError) as exc:
+                raise ValidationError("invalid child task plan") from exc
+        child_plan.parent_task_id = task_id
+        child = self.delegation.delegate(task_id, child_plan, caller=actor)
+        return child.to_dict()
+
+    def get_events(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
+        if actor is not None:
+            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
+        self.store.get_task(task_id)
+        return self.store.list_events(task_id)
+
+    def get_evidence(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
+        if actor is not None:
+            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
+        self.store.get_task(task_id)
+        return self.evidence.list(task_id)
+
+    def get_children(self, task_id: str, actor: str | None = None) -> list[str]:
+        if actor is not None:
+            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
+        self.store.get_task(task_id)
+        return self.store.list_children(task_id)
+
+
+class TaskPlaneRequestHandler(BaseHTTPRequestHandler):
+    service: TaskPlaneService | None = None
+    authenticator: Callable[[str], str | None] | None = None
+    max_body_bytes = 1_000_000
+
+    def log_message(self, format: str, *args: Any) -> None:
+        # BaseHTTPRequestHandler logs the raw request target; suppress it so
+        # attacker-controlled paths or query strings cannot leak credentials.
+        return
+
+    def _json(self) -> tuple[str | None, dict[str, Any]]:
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+        except ValueError as exc:
+            raise ValidationError("invalid content length") from exc
+        if length < 0:
+            raise ValidationError("invalid content length")
+        if length > self.max_body_bytes:
+            raise PayloadTooLargeError("payload exceeds limit")
+        raw = self.rfile.read(length) if length > 0 else b""
+        if not raw:
+            return None, {}
+        try:
+            decoded = raw.decode("utf-8")
+            payload = json.loads(decoded)
+            if not isinstance(payload, dict):
+                raise ValidationError("JSON payload must be an object")
+            return decoded, payload
+        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+            raise ValidationError("invalid JSON payload") from exc
+
+    def _response(self, status: int, payload: Any) -> None:
+        encoded = json.dumps(payload, ensure_ascii=False).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def _authenticated_identity(self) -> str:
+        authenticator = type(self).authenticator
+        if authenticator is None:
+            raise UnauthorizedError("authentication unavailable")
+        header = self.headers.get("Authorization", "")
+        if not header.startswith("Bearer "):
+            raise UnauthorizedError("bearer authentication required")
+        token = header[7:]
+        if not token or any(ord(ch) < 33 for ch in token):
+            raise UnauthorizedError("invalid bearer token")
+        identity = authenticator(token)
+        if not identity:
+            raise UnauthorizedError("invalid credentials")
+        return str(identity)
+
+    def _handle(self, handler):
+        try:
+            if self.service is None:
+                raise TaskPlaneHTTPError("service not configured")
+            result = handler()
+            if isinstance(result, tuple):
+                status, payload = result
+            else:
+                status, payload = 200, result
+            self._response(status, payload)
+        except TaskPlaneHTTPError as exc:
+            self._response(exc.status_code, exc.to_payload())
+        except Exception as exc:  # defensive
+            if isinstance(exc, TaskPlaneHTTPError):
+                raise
+            self._response(
+                500,
+                {"error": "internal_error", "message": "internal server error"},
+            )
+
+    def do_GET(self):  # noqa: N802
+        def route():
+            path = urllib.parse.urlparse(self.path).path
+            parts = [p for p in path.split("/") if p]
+            for part in parts[1:]:
+                if part not in {"events", "evidence", "children", "heartbeat"}:
+                    try:
+                        validate_identifier(part, "resource identifier")
+                    except ValueError as exc:
+                        raise ValidationError("invalid resource identifier") from exc
+            identity = self._authenticated_identity()
+
+            if len(parts) == 1 and parts[0] == "tasks":
+                return 200, self.service.list_tasks(identity)
+            if len(parts) == 2 and parts[0] == "tasks":
+                task_id = parts[1]
+                return 200, self.service.get_task(task_id, identity)
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "events":
+                return 200, self.service.get_events(parts[1], identity)
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "evidence":
+                return 200, self.service.get_evidence(parts[1], identity)
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "children":
+                return 200, self.service.get_children(parts[1], identity)
+            if len(parts) == 1 and parts[0] == "workers":
+                return 200, self.service.list_workers(identity)
+            if len(parts) == 2 and parts[0] == "workers":
+                return 200, self.service.get_worker(parts[1], identity)
+            raise NotFoundError("unknown endpoint")
+
+        self._handle(route)
+
+    def do_POST(self):  # noqa: N802
+        def route():
+            body_text, body = self._json()
+            identity = self._authenticated_identity()
+            path = urllib.parse.urlparse(self.path).path
+            parts = [p for p in path.split("/") if p]
+            headers = {k.lower(): v for k, v in self.headers.items()}
+
+            if len(parts) == 1 and parts[0] == "tasks":
+                issuer = body.get("issuer")
+                if issuer and (
+                    not isinstance(issuer, dict) or issuer.get("id") != identity
+                ):
+                    raise ForbiddenError("issuer identity mismatch")
+                body["issuer"] = {"type": "authenticated", "id": identity}
+                return 201, self.service.create_task(body or {}, headers.get("idempotency-key"))
+            if body.get("actor_identity") not in {None, identity}:
+                raise ForbiddenError("actor identity mismatch")
+            body["actor_identity"] = identity
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "claim":
+                return 200, self.service.claim(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "heartbeat":
+                return 200, self.service.heartbeat(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "progress":
+                return 200, self.service.progress(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "result":
+                return 200, self.service.complete(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "fail":
+                return 200, self.service.fail(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "cancel":
+                return 200, self.service.cancel(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "delegate":
+                return 200, self.service.delegate(parts[1], body or {})
+
+            if len(parts) == 2 and parts[0] == "workers" and parts[1] == "register":
+                if (
+                    body.get("identity") != identity
+                    and identity not in self.service.policy.admin_identities
+                ):
+                    raise ForbiddenError("worker identity mismatch")
+                return 201, self.service.register_worker(body or {})
+            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "heartbeat":
+                return 200, self.service.worker_heartbeat(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "disable":
+                return 200, self.service.disable_worker(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "restore":
+                return 200, self.service.restore_worker(parts[1], body or {})
+            raise NotFoundError("unknown endpoint")
+
+        self._handle(route)
+
+
+def run_server(
+    host: str,
+    port: int,
+    service: TaskPlaneService,
+    *,
+    authenticator: Callable[[str], str | None] | None = None,
+):
+    handler = TaskPlaneRequestHandler
+    handler.service = service
+    handler.authenticator = authenticator
+    server = ThreadingHTTPServer((host, port), handler)
+    server.serve_forever()

active-runtime/app/task_plane/capabilities.py

@@ -0,0 +1,36 @@
+"""Capability matcher helpers."""
+
+from __future__ import annotations
+
+from fnmatch import fnmatch
+
+
+def _normalize_capability(capability: str) -> str:
+    return capability.strip().lower()
+
+
+def capability_matches(granted: str, required: str) -> bool:
+    granted = _normalize_capability(granted)
+    required = _normalize_capability(required)
+    if granted == required:
+        return True
+    # A granted wildcard such as "test.*" should match required "test.unit"
+    if "*" in granted:
+        return fnmatch(required, granted)
+    # A required wildcard is treated as a suffix/prefix requirement for callers.
+    if "*" in required:
+        return fnmatch(granted, required)
+    return False
+
+
+def has_capabilities(granted_caps: list[str], required_caps: list[str]) -> bool:
+    granted = [_normalize_capability(c) for c in granted_caps]
+    for required in required_caps:
+        required = _normalize_capability(required)
+        if not any(capability_matches(g, required) for g in granted):
+            return False
+    return True
+
+
+def normalize_capabilities(caps: list[str]) -> list[str]:
+    return sorted({_normalize_capability(cap) for cap in caps})

active-runtime/app/task_plane/delegation.py

@@ -0,0 +1,87 @@
+"""Delegation guardrails."""
+
+from __future__ import annotations
+
+from .errors import ConflictError, ForbiddenError, NotFoundError
+from .models import Budget, TaskPlan, TaskRecord
+from .store import TaskPlaneStore
+
+
+class DelegationEngine:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def can_delegate(self, parent_id: str, child_plan: TaskPlan) -> bool:
+        parent = self.store.get_task(parent_id)
+        if parent.status == "COMPLETED":
+            raise ConflictError("cannot delegate completed task")
+        if parent.task_plan.max_delegation_depth <= 0:
+            raise ConflictError("max delegation depth not configured")
+
+        depth = self._depth(parent_id)
+        if depth >= parent.task_plan.max_delegation_depth:
+            raise ConflictError("max delegation depth reached")
+
+        if child_plan.parent_task_id not in {None, parent_id}:
+            raise ConflictError("delegation parent mismatch")
+        current = parent_id
+        while current:
+            if child_plan.task_id and current == child_plan.task_id:
+                raise ConflictError("delegation cycle")
+            current = self.store.parent_of(current)
+        return True
+
+    def delegate(self, parent_id: str, child_plan: TaskPlan, *, caller: str) -> TaskRecord:
+        self.can_delegate(parent_id, child_plan)
+        parent = self.store.get_task(parent_id)
+        if child_plan.required_capabilities and not set(child_plan.required_capabilities).issubset(
+            set(parent.task_plan.required_capabilities or [])
+        ):
+            raise ForbiddenError("child capabilities exceed parent constraints")
+        risk_rank = {"low": 1, "medium": 2, "high": 3}
+        if risk_rank.get(child_plan.risk, 99) > risk_rank.get(parent.task_plan.risk, -1):
+            raise ForbiddenError("child risk exceeds parent constraints")
+        child_plan.parent_task_id = parent_id
+        child_plan.correlation_id = parent.task_plan.correlation_id or parent.task_id
+        child_plan.preferred_workers = parent.task_plan.preferred_workers
+        child_plan.max_delegation_depth = min(
+            child_plan.max_delegation_depth,
+            parent.task_plan.max_delegation_depth,
+        )
+        child_plan.approval_policy = parent.task_plan.approval_policy
+
+        parent_budget = self.store.get_task_budget(parent_id)
+        required = Budget()
+        for name in ("time_seconds", "attempts", "tokens", "cost"):
+            available = getattr(parent_budget, name)
+            requested = getattr(child_plan.budgets, name)
+            if name == "attempts" and requested is None:
+                requested = 1
+            if available is not None:
+                requested = 0 if requested is None else requested
+                if requested > available:
+                    raise ConflictError(f"budget exceeded for {name}")
+                setattr(child_plan.budgets, name, requested)
+            setattr(required, name, requested)
+
+        # A retried identical delegation is a read, not a second budget charge.
+        if child_plan.task_id:
+            try:
+                existing = self.store.get_task(child_plan.task_id)
+            except NotFoundError:
+                existing = None
+            if existing is not None:
+                if (
+                    existing.task_plan.parent_task_id == parent_id
+                    and existing.task_plan.operation_digest()
+                    == child_plan.operation_digest()
+                ):
+                    return existing
+                raise ConflictError("delegation task_id conflict")
+
+        return self.store.delegate_task_with_budget_and_events(
+            parent_id, child_plan, caller=caller
+        )
+
+    def _depth(self, task_id: str) -> int:
+        return self.store._compute_depth(task_id)

active-runtime/app/task_plane/errors.py

@@ -0,0 +1,71 @@
+"""Error types for task plane operations."""
+
+from __future__ import annotations
+
+
+class TaskPlaneError(Exception):
+    """Base exception for API-compatible failures."""
+
+    status_code = 500
+    error_code = "task_plane_error"
+
+    def __init__(self, message: str, *, code: str | None = None, details: dict | None = None):
+        super().__init__(message)
+        self.message = message
+        self.details = details or {}
+        if code:
+            self.error_code = code
+
+    def to_payload(self) -> dict:
+        return {"error": self.error_code, "message": self.message, "details": self.details}
+
+
+class TaskPlaneHTTPError(TaskPlaneError):
+    """Base class with explicit HTTP status."""
+
+    status_code = 500
+
+
+class ValidationError(TaskPlaneHTTPError):
+    status_code = 400
+    error_code = "validation_error"
+
+
+class UnauthorizedError(TaskPlaneHTTPError):
+    status_code = 401
+    error_code = "unauthorized"
+
+
+class ForbiddenError(TaskPlaneHTTPError):
+    status_code = 403
+    error_code = "forbidden"
+
+
+class NotFoundError(TaskPlaneHTTPError):
+    status_code = 404
+    error_code = "not_found"
+
+
+class ConflictError(TaskPlaneHTTPError):
+    status_code = 409
+    error_code = "conflict"
+
+
+class PayloadTooLargeError(TaskPlaneHTTPError):
+    status_code = 413
+    error_code = "payload_too_large"
+
+
+class FailedDependencyError(TaskPlaneHTTPError):
+    status_code = 424
+    error_code = "failed_dependency"
+
+
+class LockedError(TaskPlaneHTTPError):
+    status_code = 423
+    error_code = "locked"
+
+
+class ServiceUnavailableError(TaskPlaneHTTPError):
+    status_code = 503
+    error_code = "service_unavailable"

active-runtime/app/task_plane/events.py

@@ -0,0 +1,108 @@
+"""CloudEvents-compatible event envelope and durable outbox helpers."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Callable, Protocol
+
+from .store import TaskPlaneStore
+
+
+@dataclass
+class CloudEvent:
+    specversion: str = "1.0"
+    id: str = ""
+    type: str = ""
+    source: str = "spiffe://aios/task-plane"
+    subject: str = ""
+    datacontenttype: str = "application/json"
+    data: dict | None = None
+
+    @property
+    def time(self) -> str:
+        return datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+
+    def asdict(self) -> dict:
+        return {
+            "specversion": self.specversion,
+            "id": self.id,
+            "type": self.type,
+            "source": self.source,
+            "subject": self.subject,
+            "time": self.time,
+            "datacontenttype": self.datacontenttype,
+            "data": self.data or {},
+        }
+
+
+NOT_DELIVERED = "NOT_DELIVERED"
+DELIVERED = "DELIVERED"
+FAILED_DELIVERY = "FAILED"
+
+
+class NotificationAdapter(Protocol):
+    name: str
+
+    def deliver(self, envelope: dict) -> str | None:
+        """Return a provider receipt, or None when delivery is unconfirmed."""
+
+
+class CallbackNotificationAdapter:
+    """Adapter seam for webhook, NATS, GPT, dashboard, and WeChat transports."""
+
+    def __init__(self, name: str, callback: Callable[[dict], str | None]):
+        self.name = name
+        self._callback = callback
+
+    def deliver(self, envelope: dict) -> str | None:
+        return self._callback(envelope)
+
+
+class WebhookAdapter(CallbackNotificationAdapter):
+    def __init__(self, callback: Callable[[dict], str | None]):
+        super().__init__("webhook", callback)
+
+
+class NatsJetStreamAdapter(CallbackNotificationAdapter):
+    def __init__(self, callback: Callable[[dict], str | None]):
+        super().__init__("nats-jetstream", callback)
+
+
+class GPTResultCallbackAdapter(CallbackNotificationAdapter):
+    def __init__(self, callback: Callable[[dict], str | None]):
+        super().__init__("gpt-result-callback", callback)
+
+
+class DashboardAdapter(CallbackNotificationAdapter):
+    def __init__(self, callback: Callable[[dict], str | None]):
+        super().__init__("dashboard", callback)
+
+
+class WeChatGatewayAdapter(CallbackNotificationAdapter):
+    def __init__(self, callback: Callable[[dict], str | None]):
+        super().__init__("wechat-gateway", callback)
+
+
+class DurableOutboxDispatcher:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def dispatch(self, message_id: str, adapter: NotificationAdapter) -> dict:
+        row = self.store.get_outbox_message(message_id)
+        import json
+
+        envelope = json.loads(row["payload"])
+        try:
+            receipt = adapter.deliver(envelope)
+        except Exception:
+            return self.store.record_outbox_delivery(
+                message_id,
+                receipt=None,
+                error=f"{adapter.name} delivery failed",
+            )
+        return self.store.record_outbox_delivery(
+            message_id,
+            receipt=str(receipt) if receipt else None,
+            error=None if receipt else f"{adapter.name} receipt unavailable",
+        )

active-runtime/app/task_plane/evidence.py

@@ -0,0 +1,31 @@
+"""Evidence helpers."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+
+from .store import TaskPlaneStore
+
+
+def evidence_digest(payload: dict) -> str:
+    body = json.dumps(payload, sort_keys=True, separators=(",", ":"))
+    return hashlib.sha256(body.encode("utf-8")).hexdigest()
+
+
+class EvidenceService:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def add(self, task_id: str, kind: str, payload: dict, worker_identity: str) -> str:
+        return self.store.add_evidence(task_id, kind, payload, worker_identity)
+
+    def list(self, task_id: str) -> list[dict]:
+        return self.store.list_evidence(task_id)
+
+    def verify(self, task_id: str, required_kinds: list[str]) -> bool:
+        evidences = self.list(task_id)
+        observed = {e["kind"] for e in evidences}
+        return set(required_kinds).issubset(
+            observed
+        ) and self.store.verify_evidence_integrity(task_id)

active-runtime/app/task_plane/journal.py

@@ -0,0 +1,22 @@
+"""Event journaling helpers."""
+
+from __future__ import annotations
+
+from .errors import ValidationError
+from .store import TaskPlaneStore
+
+
+class TaskJournal:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def append(self, task_id: str, event_type: str, data: dict, *, subject: str | None = None) -> None:
+        if not event_type:
+            raise ValidationError("event_type required")
+        self.store.append_event(task_id, event_type, data, subject=subject)
+
+    def list(self, task_id: str) -> list[dict]:
+        return self.store.list_events(task_id)
+
+    def check_chain(self, task_id: str) -> bool:
+        return self.store.verify_event_chain(task_id)

active-runtime/app/task_plane/lease.py

@@ -0,0 +1,32 @@
+"""Claim and lease management helpers."""
+
+from __future__ import annotations
+
+from .errors import LockedError
+from .models import ProbeEvidence
+from .store import TaskPlaneStore
+
+
+class LeaseManager:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def claim(self, task_id: str, worker_id: str, worker_identity: str, lease_seconds: int, expected_revision: int, operation_digest: str):
+        return self.store.claim_task(task_id, worker_id, worker_identity, lease_seconds, expected_revision, operation_digest)
+
+    def heartbeat(self, task_id: str, claim_id: str, lease_seconds: int):
+        claim = self.store.heartbeat_claim(task_id, claim_id, lease_seconds)
+        return claim
+
+    def probe(self, claim_id: str):
+        claim = self.store.get_claim(claim_id)
+        if claim.status != "ACTIVE":
+            raise LockedError("claim not active")
+        return claim
+
+    def recover(self, task_id: str, claim_id: str, probe: ProbeEvidence):
+        return self.store.recover_expired_claim(
+            task_id,
+            claim_id,
+            probe,
+        )

active-runtime/app/task_plane/models.py

@@ -0,0 +1,829 @@
+"""Core data models for the task plane."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import time
+import uuid
+import urllib.parse
+from enum import StrEnum
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Any
+
+
+SENSITIVE_KEYS = {
+    "secret",
+    "password",
+    "token",
+    "api_key",
+    "access_token",
+    "refresh_token",
+    "authorization",
+    "private_key",
+    "client_secret",
+    "credential",
+}
+IDENTIFIER_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{0,127}")
+TYPE_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}")
+RISK_LEVELS = {"low", "medium", "high"}
+DATA_CLASSIFICATIONS = {
+    "public",
+    "internal",
+    "confidential",
+    "credential-secret",
+}
+SECRET_TEXT_PATTERNS = (
+    re.compile(r"(?i)\bAuthorization\s*:\s*Bearer\s+\S+"),
+    re.compile(r"(?i)\b(?:password|passwd|api[_-]?key|access[_-]?token|secret)\s*[:=]\s*\S+"),
+    re.compile(r"\bsk-[A-Za-z0-9_-]{12,}\b"),
+    re.compile(r"\bAKIA[0-9A-Z]{16}\b"),
+    re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
+)
+TASK_PLAN_KEYS = {
+    "schema_version",
+    "task_id",
+    "task_type",
+    "issuer",
+    "intent",
+    "required_capabilities",
+    "preferred_workers",
+    "risk",
+    "approval_policy",
+    "dependencies",
+    "max_delegation_depth",
+    "budgets",
+    "evidence_requirements",
+    "parent_task_id",
+    "correlation_id",
+    "metadata",
+    "data_classification",
+    "execution_zone",
+    "network_policy",
+    "logging_policy",
+    "allowed_input_paths",
+    "allowed_output_paths",
+    "output_policy",
+}
+
+
+def _now_ts() -> float:
+    return time.time()
+
+
+def canonical_json(value: Any) -> str:
+    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+
+
+def compute_sha256_hex(value: Any) -> str:
+    return hashlib.sha256(canonical_json(value).encode("utf-8")).hexdigest()
+
+
+def contains_secret_text(value: Any) -> bool:
+    if isinstance(value, str):
+        return any(pattern.search(value) for pattern in SECRET_TEXT_PATTERNS)
+    if isinstance(value, dict):
+        return any(contains_secret_text(item) for item in value.values())
+    if isinstance(value, (list, tuple)):
+        return any(contains_secret_text(item) for item in value)
+    return False
+
+
+def validate_relative_paths(values: Any, name: str) -> list[str]:
+    paths = _normalize_list(values)
+    for value in paths:
+        decoded = urllib.parse.unquote(value)
+        parts = value.replace("\\", "/").split("/")
+        if (
+            decoded != value
+            or "\\" in value
+            or value.startswith("/")
+            or re.match(r"^[A-Za-z]:", value)
+            or any(part in {"", ".", ".."} for part in parts)
+        ):
+            raise ValueError(f"invalid {name}")
+    return paths
+
+
+def validate_identifier(value: Any, name: str) -> str:
+    text = str(value or "")
+    if (
+        not IDENTIFIER_RE.fullmatch(text)
+        or urllib.parse.unquote(text) != text
+        or any(ord(ch) < 32 or ord(ch) == 127 for ch in text)
+    ):
+        raise ValueError(f"invalid {name}")
+    return text
+
+
+def validate_type(value: Any, name: str) -> str:
+    text = str(value or "")
+    if not TYPE_RE.fullmatch(text):
+        raise ValueError(f"invalid {name}")
+    return text
+
+
+def redact_value(value: Any) -> Any:
+    if isinstance(value, dict):
+        redacted = {}
+        for key, inner in value.items():
+            lowered = str(key).lower()
+            if lowered in SENSITIVE_KEYS or lowered.endswith(
+                ("_password", "_secret", "_access_token", "_refresh_token", "_private_key")
+            ):
+                redacted[key] = "[REDACTED]"
+            else:
+                redacted[key] = redact_value(inner)
+        return redacted
+    if isinstance(value, list):
+        return [redact_value(v) for v in value]
+    if isinstance(value, tuple):
+        return tuple(redact_value(v) for v in value)
+    return value
+
+
+class TaskStateTransitionError(ValueError):
+    pass
+
+
+class TaskStatus(StrEnum):
+    CREATED = "CREATED"
+    QUEUED = "QUEUED"
+    CLAIMED = "CLAIMED"
+    RUNNING = "RUNNING"
+    WAITING_CHILD = "WAITING_CHILD"
+    VERIFYING = "VERIFYING"
+    COMPLETED = "COMPLETED"
+    FAILED_RECOVERABLE = "FAILED_RECOVERABLE"
+    FAILED_FINAL = "FAILED_FINAL"
+    CANCELLED = "CANCELLED"
+    MANUAL_REVIEW_REQUIRED = "MANUAL_REVIEW_REQUIRED"
+
+
+TASK_STATES = {
+    status.value for status in TaskStatus
+}
+
+
+TASK_NEXT_STATES = {
+    "CREATED": {"QUEUED", "CLAIMED", "CANCELLED", "MANUAL_REVIEW_REQUIRED"},
+    "QUEUED": {"CLAIMED", "CANCELLED", "FAILED_RECOVERABLE", "FAILED_FINAL"},
+    "CLAIMED": {"RUNNING", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
+    "RUNNING": {"VERIFYING", "WAITING_CHILD", "COMPLETED", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
+    "WAITING_CHILD": {"RUNNING", "VERIFYING", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
+    "VERIFYING": {"COMPLETED", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
+    "COMPLETED": set(),
+    "FAILED_RECOVERABLE": {"CLAIMED", "RUNNING", "CANCELLED"},
+    "FAILED_FINAL": set(),
+    "CANCELLED": set(),
+    "MANUAL_REVIEW_REQUIRED": {"RUNNING", "CANCELLED"},
+}
+
+
+@dataclass
+class Budget:
+    time_seconds: int | None = None
+    attempts: int | None = None
+    tokens: int | None = None
+    cost: float | None = None
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any] | None) -> "Budget":
+        if not data:
+            return cls()
+        if not isinstance(data, dict) or set(data) - {
+            "time_seconds",
+            "attempts",
+            "tokens",
+            "cost",
+        }:
+            raise ValueError("invalid budget")
+        for name in ("time_seconds", "attempts", "tokens", "cost"):
+            value = data.get(name)
+            if value is not None:
+                try:
+                    if float(value) < 0:
+                        raise ValueError("budget values must be non-negative")
+                except (TypeError, ValueError) as exc:
+                    raise ValueError("invalid budget value") from exc
+        return cls(
+            time_seconds=_to_positive_int(data.get("time_seconds")),
+            attempts=_to_positive_int(data.get("attempts")),
+            tokens=_to_positive_int(data.get("tokens")),
+            cost=_to_float(data.get("cost")),
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "time_seconds": self.time_seconds,
+            "attempts": self.attempts,
+            "tokens": self.tokens,
+            "cost": self.cost,
+        }
+
+    def merge(self, other: "Budget") -> "Budget":
+        return Budget(
+            time_seconds=_first_non_none(self.time_seconds, other.time_seconds),
+            attempts=_first_non_none(self.attempts, other.attempts),
+            tokens=_first_non_none(self.tokens, other.tokens),
+            cost=_first_non_none(self.cost, other.cost),
+        )
+
+
+@dataclass
+class TaskPlan:
+    schema_version: int = 1
+    task_id: str | None = None
+    task_type: str = "code.change"
+    issuer: dict[str, Any] = field(default_factory=dict)
+    intent: str | None = None
+    required_capabilities: list[str] = field(default_factory=list)
+    preferred_workers: list[str] = field(default_factory=list)
+    risk: str = "medium"
+    approval_policy: str = "patch-only"
+    dependencies: list[str] = field(default_factory=list)
+    max_delegation_depth: int = 5
+    budgets: Budget = field(default_factory=Budget)
+    evidence_requirements: list[str] = field(default_factory=list)
+    parent_task_id: str | None = None
+    correlation_id: str | None = None
+    metadata: dict[str, Any] = field(default_factory=dict)
+    data_classification: str = "internal"
+    execution_zone: str = "isolated-development"
+    network_policy: str = "controlled"
+    logging_policy: str = "redacted"
+    allowed_input_paths: list[str] = field(default_factory=list)
+    allowed_output_paths: list[str] = field(default_factory=list)
+    output_policy: str = "standard"
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any] | None) -> "TaskPlan":
+        if not isinstance(data, dict):
+            raise ValueError("task plan payload must be an object")
+        unknown = set(data) - TASK_PLAN_KEYS
+        if unknown:
+            raise ValueError("unknown task plan fields")
+        if "task_id" not in data or data["task_id"] is None:
+            data = dict(data)
+            data["task_id"] = f"task-{uuid.uuid4()}"
+        risk = str(data.get("risk", "medium"))
+        if risk not in RISK_LEVELS:
+            raise ValueError("invalid risk")
+        issuer = data.get("issuer", {})
+        if not isinstance(issuer, dict):
+            raise ValueError("issuer must be an object")
+        schema_version = int(data.get("schema_version", 1))
+        if schema_version != 1:
+            raise ValueError("unsupported schema_version")
+        max_depth = _to_positive_int(data.get("max_delegation_depth"), default=5)
+        if max_depth is None or max_depth > 32:
+            raise ValueError("invalid max_delegation_depth")
+        classification = str(data.get("data_classification", "internal"))
+        if classification not in DATA_CLASSIFICATIONS:
+            raise ValueError("invalid data_classification")
+        execution_zone = validate_type(
+            data.get("execution_zone", "isolated-development"), "execution_zone"
+        )
+        network_policy = validate_type(
+            data.get("network_policy", "controlled"), "network_policy"
+        )
+        logging_policy = validate_type(
+            data.get("logging_policy", "redacted"), "logging_policy"
+        )
+        output_policy = validate_type(
+            data.get("output_policy", "standard"), "output_policy"
+        )
+        if contains_secret_text(
+            {
+                "intent": data.get("intent"),
+                "metadata": data.get("metadata", {}),
+            }
+        ):
+            raise ValueError("task content contains secret material")
+        if classification == "credential-secret":
+            if execution_zone != "secure-file-transformer":
+                raise ValueError("credential-secret requires secure-file-transformer")
+            if network_policy != "denied":
+                raise ValueError("credential-secret requires network denied")
+            if logging_policy != "metadata-only":
+                raise ValueError("credential-secret requires metadata-only logging")
+            if output_policy != "hash-count-status-only":
+                raise ValueError("credential-secret requires restricted output")
+        return cls(
+            schema_version=schema_version,
+            task_id=validate_identifier(data["task_id"], "task_id"),
+            task_type=validate_type(data.get("task_type", "code.change"), "task_type"),
+            issuer=issuer,
+            intent=data.get("intent"),
+            required_capabilities=_normalize_list(data.get("required_capabilities", [])),
+            preferred_workers=_normalize_list(data.get("preferred_workers", [])),
+            risk=risk,
+            approval_policy=validate_type(
+                data.get("approval_policy", "patch-only"), "approval_policy"
+            ),
+            dependencies=_normalize_list(data.get("dependencies", [])),
+            max_delegation_depth=max_depth,
+            budgets=Budget.from_dict(data.get("budgets")),
+            evidence_requirements=_normalize_list(data.get("evidence_requirements", [])),
+            parent_task_id=data.get("parent_task_id"),
+            correlation_id=data.get("correlation_id"),
+            metadata=data.get("metadata", {}) if isinstance(data.get("metadata", {}), dict) else {},
+            data_classification=classification,
+            execution_zone=execution_zone,
+            network_policy=network_policy,
+            logging_policy=logging_policy,
+            allowed_input_paths=validate_relative_paths(
+                data.get("allowed_input_paths", []), "allowed_input_paths"
+            ),
+            allowed_output_paths=validate_relative_paths(
+                data.get("allowed_output_paths", []), "allowed_output_paths"
+            ),
+            output_policy=output_policy,
+        )
+
+    def to_dict(self, *, redact: bool = False) -> dict[str, Any]:
+        payload = {
+            "schema_version": self.schema_version,
+            "task_id": self.task_id,
+            "task_type": self.task_type,
+            "issuer": self.issuer,
+            "intent": self.intent,
+            "required_capabilities": list(self.required_capabilities),
+            "preferred_workers": list(self.preferred_workers),
+            "risk": self.risk,
+            "approval_policy": self.approval_policy,
+            "dependencies": list(self.dependencies),
+            "max_delegation_depth": self.max_delegation_depth,
+            "budgets": self.budgets.to_dict(),
+            "evidence_requirements": list(self.evidence_requirements),
+            "parent_task_id": self.parent_task_id,
+            "correlation_id": self.correlation_id,
+            "metadata": dict(self.metadata),
+            "data_classification": self.data_classification,
+            "execution_zone": self.execution_zone,
+            "network_policy": self.network_policy,
+            "logging_policy": self.logging_policy,
+            "allowed_input_paths": list(self.allowed_input_paths),
+            "allowed_output_paths": list(self.allowed_output_paths),
+            "output_policy": self.output_policy,
+        }
+        if redact:
+            payload = redact_value(payload)
+        return payload
+
+    def operation_digest(self) -> str:
+        return compute_sha256_hex(self.to_dict())
+
+
+@dataclass
+class TaskRecord:
+    task_id: str
+    status: str
+    revision: int
+    task_plan: TaskPlan
+    created_at: float
+    updated_at: float
+    root_task_id: str
+    idempotency_key: str | None = None
+    failure_reason: str | None = None
+
+    def with_status(self, status: str) -> "TaskRecord":
+        allowed = TASK_NEXT_STATES.get(self.status, set())
+        if status != self.status and (not allowed and self.status not in {"COMPLETED", "FAILED_FINAL", "CANCELLED"}):
+            raise TaskStateTransitionError(f"Cannot transition {self.status} -> {status}")
+        if status not in TASK_STATES:
+            raise TaskStateTransitionError(f"Invalid status {status}")
+        if status != self.status and self.status in TASK_NEXT_STATES and status not in TASK_NEXT_STATES[self.status]:
+            raise TaskStateTransitionError(f"Cannot transition {self.status} -> {status}")
+        return TaskRecord(
+            task_id=self.task_id,
+            status=status,
+            revision=self.revision + 1,
+            task_plan=self.task_plan,
+            created_at=self.created_at,
+            updated_at=_now_ts(),
+            root_task_id=self.root_task_id,
+            idempotency_key=self.idempotency_key,
+            failure_reason=self.failure_reason,
+        )
+
+    def to_dict(self, *, include_task=True, redact_payload: bool = True) -> dict[str, Any]:
+        payload = {
+            "task_id": self.task_id,
+            "status": self.status,
+            "revision": self.revision,
+            "root_task_id": self.root_task_id,
+            "parent_task_id": self.task_plan.parent_task_id,
+            "created_at": _fmt_ts(self.created_at),
+            "updated_at": _fmt_ts(self.updated_at),
+            "failure_reason": self.failure_reason,
+        }
+        if include_task:
+            payload["plan"] = self.task_plan.to_dict(redact=redact_payload)
+        if self.idempotency_key:
+            payload["idempotency_key"] = self.idempotency_key
+        return payload
+
+
+@dataclass
+class WorkerRegistration:
+    worker_id: str
+    worker_type: str
+    identity: str
+    capabilities: list[str]
+    trust_zone: str
+    max_concurrency: int
+    heartbeat_interval_seconds: int
+    supported_protocols: list[str]
+    registered_at: float
+    last_heartbeat: float
+    status: str = "active"
+    disabled: bool = False
+    owner_identity: str = ""
+    registration_revision: int = 1
+    registration_policy: str = "self"
+    created_at: float = 0.0
+    updated_at: float = 0.0
+    disabled_reason: str | None = None
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> "WorkerRegistration":
+        if not isinstance(data, dict):
+            raise ValueError("worker registration payload must be an object")
+        now = _now_ts()
+        worker_id = validate_identifier(data.get("worker_id"), "worker_id")
+        worker_type = validate_type(data.get("worker_type"), "worker_type")
+        identity = str(data.get("identity") or "").strip()
+        if not identity or any(ord(ch) < 32 for ch in identity):
+            raise ValueError("invalid identity")
+        max_concurrency = _to_positive_int(data.get("max_concurrency"), default=1)
+        heartbeat_interval = _to_positive_int(
+            data.get("heartbeat_interval_seconds"), default=15
+        )
+        if not max_concurrency:
+            raise ValueError("max_concurrency must be positive")
+        if not heartbeat_interval:
+            raise ValueError("heartbeat_interval_seconds must be positive")
+        return cls(
+            worker_id=worker_id,
+            worker_type=worker_type,
+            identity=identity,
+            capabilities=_normalize_list(data.get("capabilities", [])),
+            trust_zone=str(data.get("trust_zone") or "default"),
+            max_concurrency=max_concurrency,
+            heartbeat_interval_seconds=heartbeat_interval,
+            supported_protocols=_normalize_list(
+                data.get("supported_protocols", ["aios-task-v1"])
+            ),
+            registered_at=float(data.get("registered_at") or now),
+            last_heartbeat=float(data.get("last_heartbeat") or now),
+            status=str(data.get("status") or "active"),
+            disabled=bool(data.get("disabled", False)),
+            owner_identity=str(data.get("owner_identity") or identity),
+            registration_revision=int(data.get("registration_revision") or 1),
+            registration_policy=str(data.get("registration_policy") or "self"),
+            created_at=float(data.get("created_at") or data.get("registered_at") or now),
+            updated_at=float(data.get("updated_at") or now),
+            disabled_reason=data.get("disabled_reason"),
+        )
+
+    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
+        payload = {
+            "worker_id": self.worker_id,
+            "worker_type": self.worker_type,
+            "identity": self.identity,
+            "capabilities": list(self.capabilities),
+            "trust_zone": self.trust_zone,
+            "max_concurrency": self.max_concurrency,
+            "heartbeat_interval_seconds": self.heartbeat_interval_seconds,
+            "supported_protocols": list(self.supported_protocols),
+            "registered_at": _fmt_ts(self.registered_at),
+            "last_heartbeat": _fmt_ts(self.last_heartbeat),
+            "status": self.status,
+            "disabled": self.disabled,
+            "owner_identity": self.owner_identity,
+            "registration_revision": self.registration_revision,
+            "registration_policy": self.registration_policy,
+            "created_at": _fmt_ts(self.created_at or self.registered_at),
+            "updated_at": _fmt_ts(self.updated_at or self.last_heartbeat),
+            "disabled_reason": self.disabled_reason,
+        }
+        if redact_payload:
+            payload = redact_value(payload)
+        return payload
+
+
+@dataclass(frozen=True)
+class EvidenceEnvelope:
+    schema_version: int
+    evidence_id: str
+    task_id: str
+    claim_id: str
+    kind: str
+    worker_identity: str
+    payload: dict[str, Any]
+    created_at: float
+    previous_evidence_hash: str
+    evidence_digest: str
+    signature: str | None = None
+    attestation_ref: str | None = None
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        task_id: str,
+        claim_id: str,
+        kind: str,
+        worker_identity: str,
+        payload: dict[str, Any],
+        previous_evidence_hash: str,
+        signature: str | None = None,
+        attestation_ref: str | None = None,
+        evidence_id: str | None = None,
+        created_at: float | None = None,
+    ) -> "EvidenceEnvelope":
+        envelope = cls(
+            schema_version=1,
+            evidence_id=evidence_id or f"evd-{uuid.uuid4()}",
+            task_id=validate_identifier(task_id, "task_id"),
+            claim_id=validate_identifier(claim_id, "claim_id"),
+            kind=validate_type(kind, "evidence kind"),
+            worker_identity=str(worker_identity),
+            payload=redact_value(payload),
+            created_at=float(created_at or _now_ts()),
+            previous_evidence_hash=str(previous_evidence_hash or ""),
+            evidence_digest="",
+            signature=signature,
+            attestation_ref=attestation_ref,
+        )
+        return dataclass_replace(
+            envelope, evidence_digest=compute_sha256_hex(envelope.digest_payload())
+        )
+
+    def digest_payload(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "evidence_id": self.evidence_id,
+            "task_id": self.task_id,
+            "claim_id": self.claim_id,
+            "kind": self.kind,
+            "worker_identity": self.worker_identity,
+            "payload": self.payload,
+            "created_at": self.created_at,
+            "previous_evidence_hash": self.previous_evidence_hash,
+            "attestation_ref": self.attestation_ref,
+        }
+
+    def verify(
+        self,
+        *,
+        expected_task_id: str,
+        expected_claim_id: str,
+        expected_previous_hash: str,
+        attestation_verifier: Any = None,
+    ) -> bool:
+        if (
+            self.schema_version != 1
+            or self.task_id != expected_task_id
+            or self.claim_id != expected_claim_id
+            or self.previous_evidence_hash != expected_previous_hash
+            or self.evidence_digest != compute_sha256_hex(self.digest_payload())
+        ):
+            return False
+        if self.signature or self.attestation_ref:
+            return True if attestation_verifier is None else bool(attestation_verifier(self))
+        return True
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            **self.digest_payload(),
+            "evidence_digest": self.evidence_digest,
+            "signature": self.signature,
+        }
+
+
+class ProbeOutcome(StrEnum):
+    NOT_APPLIED = "NOT_APPLIED"
+    APPLIED_VERIFIED = "APPLIED_VERIFIED"
+    INDETERMINATE = "INDETERMINATE"
+    CONFLICT = "CONFLICT"
+
+
+@dataclass(frozen=True)
+class ProbeEvidence:
+    schema_version: int
+    probe_id: str
+    task_id: str
+    claim_id: str
+    worker_id: str
+    worker_identity: str
+    operation_digest: str
+    outcome: ProbeOutcome
+    observed_at: float
+    expires_at: float
+    probe_executor_identity: str
+    evidence_digest: str
+    signature: str | None = None
+    attestation_ref: str | None = None
+
+    @classmethod
+    def create(cls, **data: Any) -> "ProbeEvidence":
+        outcome = data["outcome"]
+        if not isinstance(outcome, ProbeOutcome):
+            outcome = ProbeOutcome(str(outcome))
+        probe = cls(
+            schema_version=1,
+            probe_id=data.get("probe_id") or f"probe-{uuid.uuid4()}",
+            task_id=validate_identifier(data["task_id"], "task_id"),
+            claim_id=validate_identifier(data["claim_id"], "claim_id"),
+            worker_id=validate_identifier(data["worker_id"], "worker_id"),
+            worker_identity=str(data["worker_identity"]),
+            operation_digest=str(data["operation_digest"]),
+            outcome=outcome,
+            observed_at=float(data["observed_at"]),
+            expires_at=float(data["expires_at"]),
+            probe_executor_identity=str(data["probe_executor_identity"]),
+            evidence_digest="",
+            signature=data.get("signature"),
+            attestation_ref=data.get("attestation_ref"),
+        )
+        return dataclass_replace(
+            probe, evidence_digest=compute_sha256_hex(probe.digest_payload())
+        )
+
+    def digest_payload(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "probe_id": self.probe_id,
+            "task_id": self.task_id,
+            "claim_id": self.claim_id,
+            "worker_id": self.worker_id,
+            "worker_identity": self.worker_identity,
+            "operation_digest": self.operation_digest,
+            "outcome": self.outcome.value,
+            "observed_at": self.observed_at,
+            "expires_at": self.expires_at,
+            "probe_executor_identity": self.probe_executor_identity,
+            "attestation_ref": self.attestation_ref,
+        }
+
+    def verify(self, *, now: float, attestation_verifier: Any) -> bool:
+        if (
+            self.schema_version != 1
+            or self.expires_at <= now
+            or self.observed_at > now
+            or self.evidence_digest != compute_sha256_hex(self.digest_payload())
+            or not (self.signature or self.attestation_ref)
+        ):
+            return False
+        return bool(attestation_verifier and attestation_verifier(self))
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            **self.digest_payload(),
+            "evidence_digest": self.evidence_digest,
+            "signature": self.signature,
+        }
+
+
+def dataclass_replace(value: Any, **changes: Any) -> Any:
+    from dataclasses import replace
+
+    return replace(value, **changes)
+
+
+@dataclass
+class WorkerClaim:
+    claim_id: str
+    task_id: str
+    worker_id: str
+    worker_identity: str
+    claimed_at: float
+    lease_until: float
+    attempt: int
+    task_revision: int
+    operation_digest: str
+    status: str = "ACTIVE"
+
+    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
+        payload = {
+            "claim_id": self.claim_id,
+            "task_id": self.task_id,
+            "worker_id": self.worker_id,
+            "worker_identity": self.worker_identity,
+            "claimed_at": _fmt_ts(self.claimed_at),
+            "lease_until": _fmt_ts(self.lease_until),
+            "attempt": self.attempt,
+            "task_revision": self.task_revision,
+            "operation_digest": self.operation_digest,
+            "status": self.status,
+        }
+        if redact_payload:
+            payload = redact_value(payload)
+        return payload
+
+
+@dataclass
+class ResultEnvelope:
+    task_id: str
+    claim_id: str
+    worker_identity: str
+    status: str
+    outputs: list[dict[str, Any]]
+    evidence: list[dict[str, Any]]
+    started_at: str
+    completed_at: str
+    result_digest: str | None = None
+    signature: str | None = None
+    attestation_ref: str | None = None
+    operation_digest: str | None = None
+    trust_status: str = "untrusted_shadow_result"
+
+    def digest_payload(self) -> dict[str, Any]:
+        return {
+            "task_id": self.task_id,
+            "claim_id": self.claim_id,
+            "worker_identity": self.worker_identity,
+            "status": self.status,
+            "outputs": self.outputs,
+            "evidence": self.evidence,
+            "started_at": self.started_at,
+            "completed_at": self.completed_at,
+            "operation_digest": self.operation_digest,
+            "attestation_ref": self.attestation_ref,
+        }
+
+    def computed_digest(self) -> str:
+        return compute_sha256_hex(self.digest_payload())
+
+    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
+        payload = {
+            "task_id": self.task_id,
+            "claim_id": self.claim_id,
+            "worker_identity": self.worker_identity,
+            "status": self.status,
+            "outputs": self.outputs,
+            "evidence": self.evidence,
+            "started_at": self.started_at,
+            "completed_at": self.completed_at,
+            "result_digest": self.result_digest,
+            "signature": self.signature,
+            "attestation_ref": self.attestation_ref,
+            "operation_digest": self.operation_digest,
+            "trust_status": self.trust_status,
+        }
+        if redact_payload:
+            payload = redact_value(payload)
+        return payload
+
+
+def _normalize_list(value: Any) -> list[str]:
+    if not isinstance(value, list):
+        raise ValueError("expected list")
+    if len(value) > 128 or any(
+        not isinstance(v, str)
+        or not v
+        or len(v) > 256
+        or any(ord(ch) < 32 for ch in v)
+        for v in value
+    ):
+        raise ValueError("invalid list item")
+    return list(value)
+
+
+def _to_positive_int(value: Any, default: int | None = None) -> int | None:
+    if value is None:
+        return default
+    try:
+        number = int(value)
+    except (TypeError, ValueError):
+        return default
+    return number if number >= 0 else default
+
+
+def _to_float(value: Any) -> float | None:
+    if value is None:
+        return None
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return None
+
+
+def _first_non_none(primary: Any, fallback: Any) -> Any:
+    if primary is not None:
+        return primary
+    return fallback
+
+
+def iso8601_now() -> str:
+    return datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+
+
+def _fmt_ts(value: float | None) -> str | None:
+    if value is None:
+        return None
+    return datetime.fromtimestamp(value, tz=timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")

active-runtime/app/task_plane/policy.py

@@ -0,0 +1,226 @@
+"""Policy and verification logic (fail-closed)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Callable
+
+from .errors import ForbiddenError, LockedError
+from .models import ProbeEvidence, ResultEnvelope, TaskRecord
+
+
+RISK_RANK = {"low": 1, "medium": 2, "high": 3}
+READONLY_WORKER_ACTIONS = frozenset(
+    {"claim", "result", "fail", "progress", "heartbeat"}
+)
+ALL_ACTION_CAPABILITIES = frozenset(
+    {
+        "task.creator",
+        "worker.self_register",
+        "worker.admin",
+        "task.claim",
+        "task.cancel",
+        "task.delegate",
+        "task.read",
+        "task.audit",
+    }
+)
+
+
+@dataclass
+class PolicyDecision:
+    allowed: bool
+    reason: str = ""
+
+
+@dataclass(frozen=True)
+class ReadonlyWorkerProfile:
+    """A narrowly-scoped identity allowed to process safe Shadow tasks only."""
+
+    worker_id: str
+    identity: str
+    capabilities: frozenset[str]
+    task_types: frozenset[str] = frozenset({"code.review", "test.execute"})
+
+    def permits_task(self, task: TaskRecord) -> bool:
+        plan = task.task_plan
+        if plan.task_type not in self.task_types or plan.risk != "low":
+            return False
+        if plan.data_classification not in {"public", "internal"}:
+            return False
+        if plan.metadata.get("production_side_effects") is not False:
+            return False
+        return set(plan.required_capabilities).issubset(self.capabilities)
+
+
+class IdentityVerifier:
+    def __init__(self, trusted_identities: set[str] | None = None):
+        self.trusted_identities = trusted_identities
+
+    def verify(self, identity: str) -> bool:
+        if self.trusted_identities is None:
+            return True
+        return identity in self.trusted_identities
+
+
+class EvidenceVerifier:
+    def __init__(self, mandatory: list[str] | None = None):
+        self.mandatory = set(mandatory or [])
+
+    def verify(self, task: TaskRecord, evidences: list[dict]) -> PolicyDecision:
+        required = set(task.task_plan.evidence_requirements or [])
+        if not required and not self.mandatory:
+            return PolicyDecision(True)
+        observed = {e.get("kind") for e in evidences}
+        missing = required.union(self.mandatory) - observed
+        if missing:
+            return PolicyDecision(False, f"missing evidence: {', '.join(sorted(missing))}")
+        return PolicyDecision(True)
+
+
+class PolicyEngine:
+    """
+    Fail-closed policy engine with minimal but explicit decisions.
+    """
+
+    def __init__(
+        self,
+        *,
+        identity_verifier: IdentityVerifier | None = None,
+        evidence_verifier: EvidenceVerifier | None = None,
+        execution_enabled: bool = False,
+        max_risk: str = "medium",
+        result_signature_verifier: Callable[[ResultEnvelope], bool] | None = None,
+        probe_attestation_verifier: Callable[[ProbeEvidence], bool] | None = None,
+        identity_capabilities: dict[str, set[str]] | None = None,
+        admin_identities: set[str] | None = None,
+        readonly_worker_execution_enabled: bool = False,
+        readonly_worker_profiles: list[ReadonlyWorkerProfile] | None = None,
+    ) -> None:
+        if max_risk not in RISK_RANK:
+            raise ValueError("invalid max_risk")
+        self.identity_verifier = identity_verifier or IdentityVerifier()
+        self.evidence_verifier = evidence_verifier or EvidenceVerifier()
+        self.execution_enabled = execution_enabled
+        self.max_risk = max_risk
+        self.result_signature_verifier = result_signature_verifier
+        self.probe_attestation_verifier = probe_attestation_verifier
+        self.identity_capabilities = {
+            identity: set(capabilities)
+            for identity, capabilities in (identity_capabilities or {}).items()
+        }
+        self.admin_identities = set(admin_identities or ())
+        self.readonly_worker_execution_enabled = readonly_worker_execution_enabled
+        self.readonly_worker_profiles = {
+            profile.identity: profile for profile in (readonly_worker_profiles or [])
+        }
+
+    def _readonly_worker_allows(
+        self, action: str, actor: str, task: TaskRecord | None
+    ) -> bool:
+        profile = self.readonly_worker_profiles.get(actor)
+        return bool(
+            self.readonly_worker_execution_enabled
+            and action in READONLY_WORKER_ACTIONS
+            and profile is not None
+            and (task is None or profile.permits_task(task))
+        )
+
+    def assert_readonly_worker_binding(self, actor: str, worker_id: str) -> None:
+        profile = self.readonly_worker_profiles.get(actor)
+        if profile is not None and profile.worker_id != worker_id:
+            raise ForbiddenError("worker identity binding mismatch")
+
+    def assert_readonly_worker_registration(self, actor: str, payload: dict) -> None:
+        profile = self.readonly_worker_profiles.get(actor)
+        if profile is None:
+            return
+        if (
+            str(payload.get("worker_id") or "") != profile.worker_id
+            or str(payload.get("identity") or "") != profile.identity
+            or set(payload.get("capabilities") or []) != set(profile.capabilities)
+            or str(payload.get("trust_zone") or "") != "isolated-review"
+            or int(payload.get("max_concurrency") or 0) != 1
+            or int(payload.get("heartbeat_interval_seconds") or 0) != 15
+        ):
+            raise ForbiddenError("readonly worker registration mismatch")
+
+    def verify_result(
+        self, result: ResultEnvelope, task: TaskRecord | None = None
+    ) -> PolicyDecision:
+        computed = result.computed_digest()
+        if result.result_digest and result.result_digest != computed:
+            return PolicyDecision(False, "result digest mismatch")
+        sensitive = bool(
+            task
+            and (
+                task.task_plan.data_classification
+                in {"confidential", "credential-secret"}
+                or any(
+                    capability.startswith(
+                        ("code.write", "deploy", "secret", "production")
+                    )
+                    for capability in task.task_plan.required_capabilities
+                )
+            )
+        )
+        if sensitive and not (result.signature or result.attestation_ref):
+            return PolicyDecision(False, "trusted result proof required")
+        if result.signature is not None or result.attestation_ref is not None:
+            if self.result_signature_verifier is None:
+                return PolicyDecision(False, "result signature verifier unavailable")
+            if not self.result_signature_verifier(result):
+                return PolicyDecision(False, "result signature invalid")
+            result.trust_status = "trusted_result"
+        else:
+            result.trust_status = "untrusted_shadow_result"
+        return PolicyDecision(True)
+
+    def authorize(self, action: str, actor: str, task: TaskRecord | None = None, context: dict | None = None) -> PolicyDecision:
+        context = context or {}
+        if not self.identity_verifier.verify(actor):
+            return PolicyDecision(False, "identity untrusted")
+
+        action_capabilities = {
+            "create": "task.creator",
+            "read": "task.read",
+            "audit": "task.audit",
+            "claim": "task.claim",
+            "result": "task.claim",
+            "fail": "task.claim",
+            "progress": "task.claim",
+            "heartbeat": "task.claim",
+            "cancel": "task.cancel",
+            "delegate": "task.delegate",
+            "worker.register": "worker.self_register",
+            "worker.admin": "worker.admin",
+        }
+        required_capability = action_capabilities.get(action)
+        if required_capability:
+            granted = set(
+                self.identity_capabilities.get(
+                    actor, self.identity_capabilities.get("*", set())
+                )
+            )
+            if required_capability not in granted:
+                return PolicyDecision(False, f"action {action} not permitted")
+
+        if action in {"claim", "result", "fail", "cancel", "progress", "delegate", "heartbeat"} and not self.execution_enabled:
+            if not self._readonly_worker_allows(action, actor, task):
+                return PolicyDecision(False, "execution disabled")
+
+        if action == "delegate" and task and task.status not in {"COMPLETED", "FAILED_FINAL", "CANCELLED"}:
+            risk = str(context.get("risk", task.task_plan.risk))
+            if RISK_RANK.get(risk, 2) > RISK_RANK.get(self.max_risk, 1):
+                return PolicyDecision(False, f"risk {risk} exceeds policy")
+
+        return PolicyDecision(True)
+
+    def assert_allowed(self, action: str, actor: str, task: TaskRecord | None = None, context: dict | None = None):
+        decision = self.authorize(action, actor, task, context=context)
+        if not decision.allowed:
+            if decision.reason == "identity untrusted":
+                raise ForbiddenError(decision.reason)
+            if decision.reason == "execution disabled":
+                raise LockedError("execution disabled")
+            raise ForbiddenError(decision.reason)

active-runtime/app/task_plane/scheduler.py

@@ -0,0 +1,76 @@
+"""Task scheduler primitives."""
+
+from __future__ import annotations
+
+import time
+from .errors import NotFoundError
+from .capabilities import has_capabilities
+from .models import WorkerClaim
+from .store import TaskPlaneStore
+
+
+class TaskScheduler:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def next_queued_task(self, worker_id: str):
+        worker = self.store.get_worker(worker_id)
+        tasks = sorted(
+            self.store.list_tasks(),
+            key=lambda task: (
+                -int(task.task_plan.metadata.get("priority", 0)),
+                task.created_at,
+                task.task_id,
+            ),
+        )
+        for task in tasks:
+            if task.status not in {"CREATED", "QUEUED", "FAILED_RECOVERABLE"}:
+                continue
+            if task.task_plan.task_type == "worker.registry.audit":
+                continue
+            if task.status == "FAILED_RECOVERABLE" and not self.store.task_has_retryable_probe(
+                task.task_id
+            ):
+                continue
+            if not has_capabilities(
+                worker.capabilities, task.task_plan.required_capabilities
+            ):
+                continue
+            if any(
+                self.store.get_task(dependency).status != "COMPLETED"
+                for dependency in task.task_plan.dependencies
+            ):
+                continue
+            if (
+                task.task_plan.data_classification == "credential-secret"
+                and worker.worker_type != "secure_file_transformer"
+                and "secure_file_transformer" not in worker.capabilities
+            ):
+                continue
+            return task
+        return None
+
+    def schedule_for_worker(self, worker_id: str, lease_seconds: int = 15) -> WorkerClaim:
+        worker = self.store.get_worker(worker_id)
+        if worker.disabled:
+            from .errors import LockedError
+
+            raise LockedError("worker disabled")
+        if time.time() > worker.last_heartbeat + (
+            worker.heartbeat_interval_seconds * 3
+        ):
+            from .errors import LockedError
+
+            raise LockedError("worker offline")
+        task = self.next_queued_task(worker_id)
+        if task is None:
+            raise NotFoundError("no queued tasks available")
+        claim = self.store.claim_task(
+            task.task_id,
+            worker_id,
+            worker.identity,
+            lease_seconds=lease_seconds,
+            expected_revision=task.revision,
+            operation_digest=task.task_plan.operation_digest(),
+        )
+        return claim

active-runtime/app/task_plane/worker_registry.py

@@ -0,0 +1,68 @@
+"""Worker registry abstraction and read helpers."""
+
+from __future__ import annotations
+
+import time
+
+from .capabilities import has_capabilities
+from .errors import NotFoundError
+from .models import WorkerRegistration
+from .store import TaskPlaneStore
+
+
+class WorkerRegistry:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def register(
+        self,
+        payload: dict,
+        *,
+        actor_identity: str,
+        is_admin: bool,
+        expected_revision: int | None,
+    ) -> WorkerRegistration:
+        reg = WorkerRegistration.from_dict(payload)
+        return self.store.register_worker(
+            reg,
+            actor_identity=actor_identity,
+            is_admin=is_admin,
+            expected_revision=expected_revision,
+        )
+
+    def heartbeat(
+        self,
+        worker_id: str,
+        heartbeat_interval_seconds: int | None = None,
+        *,
+        actor_identity: str,
+        expected_revision: int | None,
+    ) -> WorkerRegistration:
+        return self.store.heartbeat_worker(
+            worker_id,
+            heartbeat_interval_seconds=heartbeat_interval_seconds,
+            actor_identity=actor_identity,
+            expected_revision=expected_revision,
+        )
+
+    def list(self):
+        return self.store.list_workers()
+
+    def get(self, worker_id: str) -> WorkerRegistration:
+        try:
+            return self.store.get_worker(worker_id)
+        except NotFoundError:
+            raise
+
+    def can_execute(self, worker_id: str, required_capabilities: list[str]) -> bool:
+        worker = self.store.get_worker(worker_id)
+        return has_capabilities(worker.capabilities, required_capabilities)
+
+    def is_online(self, worker_id: str, *, now: float | None = None) -> bool:
+        worker = self.store.get_worker(worker_id)
+        deadline = worker.last_heartbeat + (worker.heartbeat_interval_seconds * 3)
+        return not worker.disabled and (time.time() if now is None else now) <= deadline
+
+    def stale_workers(self, *, now: float | None = None) -> list[WorkerRegistration]:
+        current = time.time() if now is None else now
+        return [worker for worker in self.list() if not self.is_online(worker.worker_id, now=current)]

baseline/current.json

@@ -1,13 +1,25 @@
 {
-    "current_baseline": "V1R4C6",
-    "previous_baseline": "V1R4C5",
-    "promoted_at": "2026-07-11T21:00:00+08:00",
-    "git": "e204a90398bf646d46245b3088226749fa056edd",
-    "promoted_by": "openclaw/admin",
-    "promotion_reason": "V1R4C6 admin search agent integration, search gateway, agent platform, VERSION bump, merge tests deploy pipeline — not yet deployed to production",
-    "constraints": {
-        "memory_search_enabled": false,
-        "force_push_allowed": false,
-        "gitea_db_mutation_requires_owner_approval": true
-    }
-}
+  "current_baseline": "V2R1C2",
+  "previous_baseline": "V2R1C1",
+  "promoted_at": "2026-07-22T01:40:51Z",
+  "git": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "promoted_by": "codex/owner-approved-gitops",
+  "promotion_reason": "Owner-authorized V2R1C2 Unified Portal production release after exact tag binding, complete evidence verification, and production acceptance PASS.",
+  "version": "V2R1C2",
+  "release_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
+  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
+  "status": "PRODUCTION_DEPLOYED",
+  "production_service": "aios-v2r1c2-production.service",
+  "production_port": 18920,
+  "rollback_version": "V2R1C1",
+  "constraints": {
+    "product_code_changed": true,
+    "production_redeployed": true,
+    "production_traffic_changed": true,
+    "tag_rewritten": false,
+    "force_push_allowed": false,
+    "rollback_assets_preserved": true
+  }
+}

config/examples/development-policy.json

@@ -0,0 +1,43 @@
+{
+  "actor_identity": "codex-chartgpt-bridge",
+  "allowed_branch_patterns": [
+    "patch/**",
+    "feature/**",
+    "fix/**",
+    "release-candidate/**"
+  ],
+  "allowed_operations": [
+    "commit_file.atomic"
+  ],
+  "allowed_path_patterns": [
+    "active-runtime/**",
+    "services/**",
+    "deploy/**",
+    "tests/**",
+    "docs/**",
+    "versions/**",
+    "release/**"
+  ],
+  "denied_branch_patterns": [
+    "main",
+    "master",
+    "governance/approvals",
+    "integration/**",
+    "production/**"
+  ],
+  "denied_operations": [
+    "force_push",
+    "history_rewrite",
+    "branch_delete",
+    "tag.write",
+    "registry.write",
+    "baseline.write",
+    "production.deploy",
+    "approval.submit",
+    "secret.read"
+  ],
+  "expires_at": "2027-07-29T00:00:00Z",
+  "policy_id": "STANDING-GOVERNED-DEVELOPMENT-WRITER-V1",
+  "repository": "aios/aios",
+  "writer_audience": "aios-governed-development-writer"
+}

config/examples/grant.json

@@ -0,0 +1,23 @@
+{
+  "actor_identity": "codex-chartgpt-bridge",
+  "allowed_operations": [
+    "commit_file.atomic"
+  ],
+  "allowed_paths": [
+    "services/**",
+    "deploy/**",
+    "tests/**",
+    "docs/**",
+    "release/**"
+  ],
+  "branch": "patch/v2r1c4-release-completion-20260729",
+  "expected_base_oid": "<40_HEX_OID>",
+  "expected_policy_sha256": "<64_HEX_SHA256>",
+  "expires_at": "2026-08-05T00:00:00Z",
+  "grant_id": "grant-REPLACE",
+  "max_operations": 200,
+  "max_total_bytes": 67108864,
+  "repository": "aios/aios",
+  "task_id": "V2R1C4-RELEASE-COMPLETION",
+  "writer_audience": "aios-governed-development-writer"
+}

config/examples/mirror.json

@@ -0,0 +1,7 @@
+{
+  "authoritative_git_dir": "/data/aios-gitops/repo.git",
+  "poll_seconds": 5,
+  "receipts_dir": "/var/lib/aios-gitops/autonomous-control-plane/mirror/receipts",
+  "requests_dir": "/var/lib/aios-gitops/autonomous-control-plane/mirror/requests",
+  "source_git_dir": "/data/aios-gitops/runtime/gitea-bin/data/gitea-repositories/aios/aios.git"
+}

config/examples/publisher.json

@@ -0,0 +1,19 @@
+{
+  "socket_path": "/run/aios-gitops/autonomous-control-plane/publisher.sock",
+  "allowed_peer_uids": [
+    0
+  ],
+  "repository": "aios/aios",
+  "base_branch": "governance/approvals",
+  "head_prefix": "governance/request/",
+  "owner_reviewer": "owner",
+  "gitea_base_url": "http://127.0.0.1:3000",
+  "remote_url": "http://127.0.0.1:3000/aios/aios.git",
+  "credential_name": "gitea_http",
+  "allowed_git_dir_roots": [
+    "/data/aios-gitops/worktrees",
+    "/data/aios-gitops/repo.git"
+  ],
+  "operation_ledger": "/var/lib/aios-gitops/autonomous-control-plane/publisher/operations.sqlite",
+  "audit_path": "/var/lib/aios-gitops/autonomous-control-plane/publisher/audit.jsonl"
+}

config/examples/release-actions.json

@@ -0,0 +1,62 @@
+{
+  "authoritative_git_dir": "/data/aios-gitops/repo.git",
+  "approval": {
+    "gitea_db_path": "/data/aios-gitops/runtime/gitea-bin/data/gitea.db",
+    "repo_id": 1,
+    "owner_user_id": 2,
+    "governance_ref": "refs/heads/governance/approvals",
+    "required_machine_contexts": [
+      "aios/branch-protection",
+      "aios/evidence-closure",
+      "aios/secret-scan",
+      "aios/state-machine",
+      "aios/validator"
+    ]
+  },
+  "merge_transport": {
+    "transport": "unix_json",
+    "socket_path": "/run/aios-gitops/integration-merge-writer.sock",
+    "timeout_seconds": 120
+  },
+  "tag_transport": {
+    "transport": "http_json",
+    "url": "http://127.0.0.1:8080/api/create-tag",
+    "credential_name": "tag_api",
+    "timeout_seconds": 120,
+    "expected_statuses": [
+      200
+    ]
+  },
+  "remote_tag": {
+    "remote_url": "https://g.cnnetmkt.top/git/aios/aios.git",
+    "gitea_base_url": "https://g.cnnetmkt.top/git",
+    "repo_owner": "aios",
+    "repo_name": "aios",
+    "credential_name": "gitea_http"
+  },
+  "deployment": {
+    "artifact_path": "/var/lib/aios-gitops/artifacts/V2R1C4.tar.zst",
+    "artifact_manifest_member": "artifact-manifest.json",
+    "release_root": "/opt/aios/releases",
+    "current_symlink": "/opt/aios/current",
+    "previous_symlink": "/opt/aios/previous",
+    "state_path": "/var/lib/aios-gitops/autonomous-control-plane/release/deployment-state.json",
+    "service_units": [
+      "aios-gitops-model-api.service"
+    ],
+    "health_checks": [
+      {
+        "url": "http://127.0.0.1:8080/health",
+        "expected_status": 200,
+        "timeout_seconds": 10
+      }
+    ]
+  },
+  "metadata": {
+    "registry_path": "/var/lib/aios-gitops/release/versions/V2R1C4.json",
+    "baseline_path": "/var/lib/aios-gitops/release/PRODUCTION_BASELINE",
+    "registry_plan_path": "/var/lib/aios-gitops/autonomous-control-plane/release/registry-plan.json",
+    "baseline_plan_path": "/var/lib/aios-gitops/autonomous-control-plane/release/baseline-plan.txt",
+    "metadata_snapshot_root": "/var/lib/aios-gitops/autonomous-control-plane/release/metadata-snapshots"
+  }
+}

config/examples/release-envelope.json

@@ -0,0 +1,24 @@
+{
+  "approval_expires_at": "2026-08-05T00:00:00Z",
+  "approval_head_oid": "<40_HEX_OID>",
+  "approval_manifest_path": "approvals/release/V2R1C4-PRODUCTION-RELEASE-ENVELOPE.json",
+  "approval_manifest_sha256": "<64_HEX_SHA256>",
+  "approval_merge_oid": "<40_HEX_OID>",
+  "approval_plan_id": "<OWNER_APPROVED_PLAN_ID>",
+  "approval_pr_number": 1,
+  "artifact_sha256": "<64_HEX_SHA256>",
+  "baseline_plan_sha256": "<64_HEX_SHA256>",
+  "deployment_plan_sha256": "<64_HEX_SHA256>",
+  "evidence_closure_oid": "<40_HEX_OID>",
+  "evidence_closure_sha256": "<64_HEX_SHA256>",
+  "owner_review_oid": 1,
+  "registry_plan_sha256": "<64_HEX_SHA256>",
+  "rollback_artifact_sha256": "<64_HEX_SHA256>",
+  "rollback_plan_sha256": "<64_HEX_SHA256>",
+  "sbom_sha256": "<64_HEX_SHA256>",
+  "tag_plan_sha256": "<64_HEX_SHA256>",
+  "target_oid": "<40_HEX_TARGET_OID>",
+  "target_tree_oid": "<40_HEX_TREE_OID>",
+  "test_evidence_sha256": "<64_HEX_SHA256>",
+  "version": "V2R1C4"
+}

config/examples/release-hooks.json

@@ -0,0 +1,96 @@
+{
+  "state_path": "/var/lib/aios-gitops/autonomous-control-plane/release/state.json",
+  "audit_path": "/var/lib/aios-gitops/autonomous-control-plane/release/audit.jsonl",
+  "hooks": {
+    "verify_owner_approval": [
+      "/usr/bin/aios-release-hook",
+      "verify_owner_approval",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "merge_release": [
+      "/usr/bin/aios-release-hook",
+      "merge_release",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "create_tag": [
+      "/usr/bin/aios-release-hook",
+      "create_tag",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "verify_remote_tag": [
+      "/usr/bin/aios-release-hook",
+      "verify_remote_tag",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "deploy": [
+      "/usr/bin/aios-release-hook",
+      "deploy",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "health_check": [
+      "/usr/bin/aios-release-hook",
+      "health_check",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "rollback": [
+      "/usr/bin/aios-release-hook",
+      "rollback",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "verify_previous": [
+      "/usr/bin/aios-release-hook",
+      "verify_previous",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "restore": [
+      "/usr/bin/aios-release-hook",
+      "restore",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "verify_restored": [
+      "/usr/bin/aios-release-hook",
+      "verify_restored",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "update_registry": [
+      "/usr/bin/aios-release-hook",
+      "update_registry",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "update_baseline": [
+      "/usr/bin/aios-release-hook",
+      "update_baseline",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "verify_consistency": [
+      "/usr/bin/aios-release-hook",
+      "verify_consistency",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "snapshot_metadata": [
+      "/usr/bin/aios-release-hook",
+      "snapshot_metadata",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "restore_metadata": [
+      "/usr/bin/aios-release-hook",
+      "restore_metadata",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ]
+  }
+}

config/examples/release-projection.json

@@ -0,0 +1,9 @@
+{
+  "allowed_output_roots": [
+    "/var/lib/aios-gitops/autonomous-control-plane/projection/releases"
+  ],
+  "poll_seconds": 5,
+  "receipts_dir": "/var/lib/aios-gitops/autonomous-control-plane/projection/receipts",
+  "requests_dir": "/var/lib/aios-gitops/autonomous-control-plane/projection/requests",
+  "source_git_dir": "/data/aios-gitops/runtime/gitea-bin/data/gitea-repositories/aios/aios.git"
+}

config/examples/renewal.json

@@ -0,0 +1,5 @@
+{
+  "poll_seconds": 10,
+  "receipts_dir": "/var/lib/aios-gitops/autonomous-control-plane/renewal/receipts",
+  "requests_dir": "/var/lib/aios-gitops/autonomous-control-plane/renewal/requests"
+}

config/examples/revoker.json

@@ -0,0 +1,11 @@
+{
+  "admin_credential_name": "admin_gitea_http",
+  "encrypted_credential_path": "/etc/credstore.encrypted/aios-governed-development-writer.gitea_http",
+  "expected_writer_username": "aios-governed-development-writer",
+  "gitea_base_url": "http://127.0.0.1:3000",
+  "grant_path": "/var/lib/aios-gitops/autonomous-control-plane/writer/grant.json",
+  "receipt_path": "/var/lib/aios-gitops/autonomous-control-plane/writer/revocation-receipt.json",
+  "revoked_grant_path": "/var/lib/aios-gitops/autonomous-control-plane/writer/grant.revoked.json",
+  "writer_credential_name": "writer_gitea_http",
+  "writer_unit": "aios-governed-development-writer.service"
+}

config/examples/runtime-projection.json

@@ -0,0 +1,8 @@
+{
+  "exact_paths": [
+    "/usr/libexec/aios-autonomous-release-authorization/controller.py",
+    "/usr/libexec/aios-chatgpt-action-task-router-continuous-20260726/action_task_router.py"
+  ],
+  "output_path": "/var/lib/aios-gitops/autonomous-control-plane/projection/runtime-source-evidence.json",
+  "task_id": "V2R1C4-RELEASE-COMPLETION"
+}

config/examples/watcher.json

@@ -0,0 +1,8 @@
+{
+  "gitea_db_path": "/data/aios-gitops/runtime/gitea-bin/data/gitea.db",
+  "output_dir": "/var/lib/aios-gitops/autonomous-control-plane/watcher/status",
+  "owner_user_id": 2,
+  "poll_seconds": 5,
+  "repo_id": 1,
+  "requests_dir": "/var/lib/aios-gitops/autonomous-control-plane/watcher/requests"
+}

config/examples/writer-server.json

@@ -0,0 +1,17 @@
+{
+  "socket_path": "/run/aios-gitops/autonomous-control-plane/writer.sock",
+  "allowed_peer_uids": [
+    0
+  ],
+  "policy_path": "/etc/aios-gitops/autonomous-control-plane/development-policy.json",
+  "grant_path": "/var/lib/aios-gitops/autonomous-control-plane/writer/grant.json",
+  "grant_quota_ledger": "/var/lib/aios-gitops/autonomous-control-plane/writer/grant-quota.sqlite",
+  "worktree_roots": [
+    "/data/aios-gitops/worktrees"
+  ],
+  "credential_name": "gitea_http",
+  "remote": "origin",
+  "operation_ledger": "/var/lib/aios-gitops/autonomous-control-plane/writer/operations.sqlite",
+  "audit_path": "/var/lib/aios-gitops/autonomous-control-plane/writer/audit.jsonl",
+  "max_request_bytes": 4194304
+}

config/gitops/silent-release-policy.json

@@ -0,0 +1,103 @@
+{
+  "schema_version": 4,
+  "automatic": [
+    "build",
+    "test",
+    "artifact",
+    "canary",
+    "evidence"
+  ],
+  "owner": [
+    "signed_release_plan"
+  ],
+  "forbidden": [
+    "force_push",
+    "tag_rewrite",
+    "direct_main_push",
+    "baseline_mutation",
+    "registry_mutation"
+  ],
+  "runtime_deployment": {
+    "approval_action": "signed_release_plan",
+    "required_capability": "runtime_switch",
+    "tag_operations_allowed": false,
+    "baseline_mutation_allowed": false,
+    "registry_mutation_allowed": false,
+    "writer_default": false,
+    "rollback_required": true
+  },
+  "tag_release": {
+    "approval_action": "signed_release_plan",
+    "required_capability": "tag_publish",
+    "separate_controller": true,
+    "duplicate_conflict": "fail_closed",
+    "rewrite_allowed": false,
+    "force_push_allowed": false
+  },
+  "baseline_registry_finalize": {
+    "approval_action": "signed_release_plan",
+    "required_capability": "baseline_registry_finalize",
+    "separate_controller": true,
+    "remote_tag_verification_required": true,
+    "gitea_api_verification_required": true,
+    "registry_baseline_consistency_required": true
+  },
+  "approval": {
+    "algorithm": "Ed25519",
+    "trust_domain": "aios.production",
+    "maximum_lifetime_seconds": 3600,
+    "release_plan_sha256_required": true,
+    "not_before_required": true,
+    "replay_protection": true,
+    "revocation_fail_closed": true,
+    "key_rotation_supported": true,
+    "capabilities": [
+      "runtime_switch",
+      "tag_publish",
+      "baseline_registry_finalize"
+    ]
+  },
+  "execution": {
+    "environment_variable": "AIOS_SILENT_RELEASE_EXECUTION_ENABLED",
+    "default_enabled": false,
+    "shadow_side_effects_allowed": false,
+    "durable_saga_required": true,
+    "pre_switch_revalidation_required": true,
+    "trusted_candidate_builder_required": true,
+    "actual_plan_regeneration_required": true,
+    "startup_fail_closed_on_missing_component": true,
+    "recovery_worker_shadow_default": true,
+    "production_approval_backend_required": true,
+    "production_builder_signer": "kms-hsm-secret-manager-only",
+    "production_execution_without_backend": "unavailable"
+  },
+  "durability": {
+    "journal": "sha256-hash-chain",
+    "probe_journal": "sha256-hash-chain",
+    "exclusive_capability_claims": true,
+    "side_effect_probe_before_lease_takeover": true,
+    "side_effect_probe_before_failed_recoverable_retry": true,
+    "probe_results": [
+      "NOT_APPLIED",
+      "APPLIED_VERIFIED",
+      "INDETERMINATE",
+      "CONFLICT"
+    ],
+    "probe_operation_digest_required": true,
+    "probe_freshness_required": true,
+    "tamper_result": "MANUAL_OWNER_REVIEW_REQUIRED"
+  },
+  "tag_pending": {
+    "required_observations": [
+      "remote_git_ref",
+      "annotated_tag_object",
+      "peeled_target",
+      "gitea_api",
+      "gitea_listing",
+      "repository_identity"
+    ],
+    "indeterminate_result": "RECONCILIATION_REQUIRED",
+    "conflict_result": "MANUAL_OWNER_REVIEW_REQUIRED",
+    "automatic_reconciliation": false
+  }
+}

config/gitops/worktree-governance.yaml

@@ -0,0 +1,59 @@
+version: 1
+policy_id: gitops-isolated-worktree-governance-20260714T232948UTC8
+
+runtime_identity:
+  user: aiman
+  group: gitops
+  umask: "0002"
+  prohibit_root_workspace_writes: true
+
+repository:
+  source_worktree: /data/aios-gitops/workspace
+  bare_repo: /data/aios-gitops/repo.git
+  worktree_root: /data/aios-gitops/worktrees
+  remote: origin
+
+worktrees:
+  controller: /data/aios-gitops/worktrees/controller
+  task_pattern: /data/aios-gitops/worktrees/{agent}/{task_id}
+  allowed_agents:
+    - openclaw
+    - chatgpt
+    - controller
+  require_clean_start: true
+  remove_after_successful_push: true
+  retain_on_failure: true
+
+permissions:
+  owner: aiman
+  group: gitops
+  directory_mode: "2775"
+  file_mode: "0664"
+  default_acl:
+    user:aiman: rwx
+    group:gitops: rwx
+  apply_to:
+    - /data/aios-gitops
+    - /data/aios-gitops/worktrees
+
+preflight:
+  required_user: aiman
+  required_group: gitops
+  required_umask: "0002"
+  require_writable_git_dir: true
+  require_writable_task_dir: true
+  require_writable_result_dir: true
+  reject_shared_source_worktree: true
+  reject_existing_git_lock: true
+
+notifications:
+  owner_on_received: required
+  owner_on_terminal: required
+  preferred_channel: weixin
+  redact_secrets: true
+
+rollback:
+  preserve_source_worktree: true
+  remove_created_worktrees: true
+  restore_service_dropins: true
+  restore_service_state: true

config/systemd/aios-gitops-runtime-identity.conf

@@ -0,0 +1,14 @@
+# Install as a systemd drop-in for GitOps/OpenClaw writer services.
+# Example: /etc/systemd/system/<service>.service.d/10-runtime-identity.conf
+
+[Service]
+User=aiman
+Group=gitops
+SupplementaryGroups=gitops
+UMask=0002
+Environment=AIOS_GITOPS_ROOT=/data/aios-gitops
+Environment=AIOS_BARE_REPO=/data/aios-gitops/repo.git
+Environment=AIOS_WORKTREE_ROOT=/data/aios-gitops/worktrees
+Environment=AIOS_RUNTIME_USER=aiman
+Environment=AIOS_RUNTIME_GROUP=gitops
+Environment=AIOS_RUNTIME_UMASK=0002

deploy/aios-v2/systemd/aios-v2r1c2-production.env.example

@@ -0,0 +1,27 @@
+# AIOS V2R1C2 Unified Portal production metadata.
+# No secret values belong in this file; runtime integrations use references.
+
+AIOS_V2_HOST=127.0.0.1
+AIOS_V2_PORT=18920
+AIOS_V2_STATE_DIR=/var/lib/aios-v2r1c2-production
+AIOS_PROVENANCE_STORE_FILE=/var/lib/aios-v2r1c2-production/run-provenance.sqlite3
+AIOS_EXTERNAL_TASK_STORE_FILE=/var/lib/aios-v2r1c2-production/external-task-truth.sqlite3
+AIOS_EXECUTOR_CATALOG_FILE=/var/lib/aios-v2r1c2-production/executor-catalog.json
+AIOS_EXECUTION_PLAN_FILES=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-RELEASE.json:/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+AIOS_EXECUTION_PLAN_FILE=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+
+AIOS_RELEASE_VERSION=V2R1C2
+AIOS_TARGET_VERSION=V2R1C2
+AIOS_BASELINE_VERSION=V2R1C1
+AIOS_PREVIOUS_VERSION=V2R1C1
+AIOS_RELEASE_STATUS=PRODUCTION
+AIOS_RELEASE_SOURCE_OID=3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24
+AIOS_RELEASE_OID=3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24
+AIOS_RELEASE_TAG=V2R1C2
+AIOS_RELEASE_EVIDENCE_SHA256=2e27bb73b8e6297bd3077238f73a96d697fc3c3611c601c4dc9357e5fdcd8eee
+
+AIOS_OPENCLAW_CONTRACT_VERSION=aios.openclaw.command.v2
+AIOS_OPENCLAW_SIGNATURE_ALGORITHM=Ed25519
+AIOS_OPENCLAW_PLUGIN_VERSION=2.1.0-rc.4
+AIOS_OPENCLAW_SIGNING_KEY_ID=openclaw-v2r1-candidate-ed25519
+AIOS_OWNER_WECHAT_TARGET_REF=AIOS_OWNER_WECHAT_TARGET_REF

deploy/aios-v2/systemd/aios-v2r1c2-production.service

@@ -0,0 +1,44 @@
+[Unit]
+Description=AIOS V2R1C2 Unified Portal Production
+After=network-online.target
+Wants=network-online.target
+Conflicts=aios-orchestrator-gateway.service
+ConditionPathExists=/opt/aios-v2r1c2/active-runtime/app/aios_web/release_application.py
+ConditionPathExists=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+
+[Service]
+Type=simple
+User=aios
+Group=aios
+WorkingDirectory=/opt/aios-v2r1c2/active-runtime/app
+EnvironmentFile=/etc/aios-v2/aios-v2r1c2-production.env
+Environment=PYTHONUNBUFFERED=1
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStartPre=/usr/bin/test "$AIOS_V2_PORT" = "18920"
+ExecStartPre=/usr/bin/test "$AIOS_RELEASE_SOURCE_OID" = "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24"
+ExecStartPre=/usr/bin/test "$AIOS_RELEASE_TAG" = "V2R1C2"
+ExecStart=/usr/bin/python3 -m aios_web.release_application
+Restart=on-failure
+RestartSec=3
+TimeoutStartSec=60
+TimeoutStopSec=30
+KillSignal=SIGTERM
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+ReadWritePaths=/var/lib/aios-v2r1c2-production
+StateDirectory=aios-v2r1c2-production
+StateDirectoryMode=0750
+UMask=0027
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-autonomous-release-candidate.service

@@ -0,0 +1,42 @@
+[Unit]
+Description=AIOS Autonomous Release Candidate (dormant shadow only)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=aiman
+Group=gitops
+WorkingDirectory=/data/aios-gitops/worktrees/chatgpt-autonomous-completion-contract-20260726/services/aios-autonomous-release-candidate
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+Environment=AIOS_PRODUCTION_DEPLOYMENT_ENABLED=false
+Environment=AIOS_CANDIDATE_LOOPBACK_HOST=127.0.0.1
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStart=/usr/bin/python3 -m aios_autonomous_release_candidate.service --host 127.0.0.1 --port 19951 --state /var/lib/aios-autonomous-release-candidate/state.sqlite3
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+RuntimeDirectory=aios-autonomous-release-candidate
+StateDirectory=aios-autonomous-release-candidate
+CacheDirectory=aios-autonomous-release-candidate
+ReadOnlyPaths=/data/aios-gitops/worktrees/chatgpt-autonomous-completion-contract-20260726/services/aios-autonomous-release-candidate
+ReadWritePaths=/run/aios-autonomous-release-candidate
+ReadWritePaths=/var/lib/aios-autonomous-release-candidate
+ReadWritePaths=/var/cache/aios-autonomous-release-candidate
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-autonomous-release-worker-candidate.service

@@ -0,0 +1,51 @@
+[Unit]
+Description=AIOS Autonomous Release Candidate Worker (Dormant/Shadow Only)
+After=network.target
+ConditionPathExists=/opt/aios-autonomous-release-candidate/aios_autonomous_release_candidate
+
+[Service]
+Type=simple
+User=aiman
+Group=gitops
+UMask=0077
+WorkingDirectory=/opt/aios-autonomous-release-candidate
+Environment=PYTHONDONTWRITEBYTECODE=1
+Environment=PYTHONPATH=/opt/aios-autonomous-release-candidate
+Environment=AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_PRODUCTION_DEPLOYMENT_ENABLED=false
+Environment=AIOS_CANDIDATE_CONTROL_ENDPOINT=127.0.0.1:19951
+Environment=AIOS_OPENCLAW_CREDENTIAL_REFERENCE=systemd-credential:openclaw-gateway-candidate
+Environment=AIOS_CODEX_CREDENTIAL_REFERENCE=systemd-credential:codex-app-server-candidate
+Environment=AIOS_NATIVE_CONTROL_CREDENTIAL_REFERENCE=systemd-credential:session-native-adapter-control-candidate
+Environment=AIOS_GITEA_CREDENTIAL_REFERENCE=systemd-credential:gitea-admin-api-candidate
+ImportCredential=openclaw-gateway-candidate
+ImportCredential=codex-app-server-candidate
+ImportCredential=session-native-adapter-control-candidate
+ImportCredential=gitea-admin-api-candidate
+ExecStart=/usr/bin/python3 -m aios_autonomous_release_candidate.worker_service --state-directory /var/lib/aios-autonomous-release-worker-candidate
+StateDirectory=aios-autonomous-release-worker-candidate
+RuntimeDirectory=aios-autonomous-release-worker-candidate
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+IPAddressDeny=any
+IPAddressAllow=localhost
+ReadOnlyPaths=/opt/aios-autonomous-release-candidate
+ReadWritePaths=/var/lib/aios-autonomous-release-worker-candidate
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-autonomous-renewal-controller.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=AIOS autonomous execution renewal controller
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/renewal.json
+
+[Service]
+Type=simple
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-autonomous-renewal-controller --config /etc/aios-gitops/autonomous-control-plane/renewal.json
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane/renewal /run/aios-gitops/autonomous-control-plane
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-gitops-model-api.service

@@ -11,6 +11,8 @@ Environment=AIOS_GITOPS_WORKSPACE=/data/aios-gitops/workspace
 Environment=AIOS_GITOPS_DB=/data/aios-gitops/runtime/gitops_model.sqlite3
 Environment=AIOS_GITOPS_TOKEN_FILE=/data/aios-gitops/runtime/secrets/gitops.tokens
 Environment=AIOS_GITOPS_BARE_REPO=/data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios-v23.git
+Environment=AIOS_GITOPS_AUTHORITATIVE_GIT_DIR=/data/aios-gitops/repo.git
+Environment=AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
 Environment=AIOS_GITOPS_HOST=127.0.0.1
 Environment=AIOS_GITOPS_PORT=18890
 ExecStart=/usr/bin/python3 /data/aios-gitops/workspace/active-runtime/app/aios_chatgpt_actions_api.py

deploy/systemd/aios-governance-approval-watcher.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=AIOS governance approval watcher
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/watcher.json
+
+[Service]
+Type=simple
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-governance-approval-watcher --config /etc/aios-gitops/autonomous-control-plane/watcher.json
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ReadOnlyPaths=/data/aios-gitops/runtime/gitea-bin/data/gitea.db
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane /run/aios-gitops/autonomous-control-plane
+RestrictAddressFamilies=AF_UNIX
+IPAddressDeny=any
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-governance-machine-status-producer.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=AIOS dormant single-owner machine-status prerequisite
+RefuseManualStop=no
+
+[Service]
+Type=oneshot
+User=aiman
+Group=gitops
+Environment=AIOS_SINGLE_OWNER_GOVERNANCE_ENABLED=false
+Environment=AIOS_SINGLE_OWNER_ACTIVATION_ACTIVE=false
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/python3 -m aios_single_owner_governance.service --component machine-status-producer --self-check --checkpoint-dir /var/lib/aios-gitops/runtime/single-owner-governance
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX
+ReadOnlyPaths=/data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-gitops/runtime/single-owner-governance

deploy/systemd/aios-governance-mirror-worker.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=AIOS governance approval mirror worker
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/mirror.json
+
+[Service]
+Type=simple
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-governance-mirror-worker --config /etc/aios-gitops/autonomous-control-plane/mirror.json
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/data/aios-gitops/repo.git /var/lib/aios-gitops/autonomous-control-plane/mirror /run/aios-gitops/autonomous-control-plane
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-governance-owner-review-adapter.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=AIOS dormant single-owner review adapter prerequisite
+RefuseManualStop=no
+
+[Service]
+Type=oneshot
+User=aiman
+Group=gitops
+Environment=AIOS_SINGLE_OWNER_GOVERNANCE_ENABLED=false
+Environment=AIOS_SINGLE_OWNER_ACTIVATION_ACTIVE=false
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/python3 -m aios_single_owner_governance.service --component owner-review-adapter --self-check --checkpoint-dir /var/lib/aios-gitops/runtime/single-owner-governance
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX
+ReadOnlyPaths=/data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-gitops/runtime/single-owner-governance

deploy/systemd/aios-governance-request-publisher.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=AIOS governance request publisher
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/publisher.json
+
+[Service]
+Type=simple
+User=aios-governance-request-publisher
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-governance-request-publisher --config /etc/aios-gitops/autonomous-control-plane/publisher.json
+LoadCredentialEncrypted=gitea_http:/etc/credstore.encrypted/aios-governance-request-publisher.gitea_http
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+RestrictSUIDSGID=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane /run/aios-gitops/autonomous-control-plane
+IPAddressAllow=127.0.0.1
+IPAddressDeny=any
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-governance-single-owner-activation.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=AIOS single-owner governance activation verifier
+ConditionPathExists=/etc/aios-gitops/single-owner-activation-bindings.json
+
+[Service]
+Type=oneshot
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-single-owner-governance --verify --bindings /etc/aios-gitops/single-owner-activation-bindings.json --state-root /var/lib/aios-gitops/governance-activation --lock-path /run/aios-gitops/governance-activation.lock
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/aios-gitops/governance-activation /run/aios-gitops
+RestrictSUIDSGID=true
+UMask=0027
+
+# Deliberately not installable. Deployment remains disabled/inactive;
+# activation is an explicit approved CLI transaction, never an always-on unit.

deploy/systemd/aios-governed-development-writer-revoker.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=AIOS governed development writer credential revoker
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/development-policy.json
+
+[Service]
+Type=oneshot
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-development-writer-revoker --config /etc/aios-gitops/autonomous-control-plane/revoker.json
+LoadCredentialEncrypted=writer_gitea_http:/etc/credstore.encrypted/aios-governed-development-writer.gitea_http
+LoadCredentialEncrypted=admin_gitea_http:/etc/credstore.encrypted/aios-governance-admin.gitea_http
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane/writer /run/aios-gitops/autonomous-control-plane -/etc/credstore.encrypted/aios-governed-development-writer.gitea_http

deploy/systemd/aios-governed-development-writer-revoker.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=AIOS governed development writer revocation timer
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=5min
+AccuracySec=30s
+Unit=aios-governed-development-writer-revoker.service
+
+[Install]
+WantedBy=timers.target

deploy/systemd/aios-governed-development-writer.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=AIOS governed development writer
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/development-policy.json
+
+[Service]
+Type=simple
+User=aios-governed-development-writer
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-development-writer-server --config /etc/aios-gitops/autonomous-control-plane/writer-server.json
+LoadCredentialEncrypted=gitea_http:/etc/credstore.encrypted/aios-governed-development-writer.gitea_http
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET
+IPAddressAllow=127.0.0.1
+IPAddressDeny=any
+ReadWritePaths=/data/aios-gitops/worktrees /var/lib/aios-gitops/autonomous-control-plane/writer /run/aios-gitops/autonomous-control-plane
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-integration-refresh-provisioner.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=AIOS Integration Refresh Provisioner (sandbox control plane)
+After=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+User=aios
+Group=aios
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_INTEGRATION_REFRESH_MODE=sandbox
+Environment=AIOS_CREDENTIAL_PROVIDER=disabled
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/aios/integration-refresh
+RestrictAddressFamilies=AF_UNIX
+IPAddressDeny=any
+ExecStart=/usr/bin/python3 /opt/aios/active-runtime/app/aios_isolated_writer_api/integration_refresh.py --sandbox-preflight --state-dir /var/lib/aios/integration-refresh
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-release-object-projection.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=AIOS exact release object projection
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/release-projection.json
+
+[Service]
+Type=simple
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-release-object-projector --config /etc/aios-gitops/autonomous-control-plane/release-projection.json
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane/projection /run/aios-gitops/autonomous-control-plane
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-runtime-source-read-projection.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=AIOS exact runtime source read projection
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/runtime-projection.json
+
+[Service]
+Type=oneshot
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-runtime-source-projector --config /etc/aios-gitops/autonomous-control-plane/runtime-projection.json
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane/projection /run/aios-gitops/autonomous-control-plane
+
+PrivateNetwork=true

deploy/systemd/aios-silent-release-controller.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=AIOS Silent Release Shadow Controller
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=aiman
+Group=gitops
+UMask=0077
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStart=/usr/bin/python3 /usr/libexec/aios-silent-release-shadow/current/active-runtime/app/silent_release_execution.py --state-root /var/lib/aios-silent-release-shadow --repository /data/aios-gitops/repo.git --host 127.0.0.1 --port 18891 --poll-seconds 30
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/aios-silent-release-shadow
+ReadOnlyPaths=/data/aios-gitops/repo.git /usr/libexec/aios-silent-release-shadow
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-v2r1c4-release-envelope.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=AIOS V2R1C4 unified governed release envelope executor
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/release-hooks.json
+ConditionPathExists=/var/lib/aios-gitops/autonomous-control-plane/release/envelope.json
+
+[Service]
+Type=oneshot
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-v2r1c4-release-executor --config /etc/aios-gitops/autonomous-control-plane/release-hooks.json --envelope /var/lib/aios-gitops/autonomous-control-plane/release/envelope.json --operation-id v2r1c4-production-release
+LoadCredentialEncrypted=gitea_http:/etc/credstore.encrypted/aios-release-executor.gitea_http
+LoadCredentialEncrypted=tag_api:/etc/credstore.encrypted/aios-release-executor.tag_api
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane/release /var/lib/aios-gitops/release /opt/aios /run/aios-gitops/autonomous-control-plane

deploy/tmpfiles.d/aios-autonomous-control-plane.conf

@@ -0,0 +1,19 @@
+d /var/lib/aios-gitops/autonomous-control-plane 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/writer 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/mirror 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/projection 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/renewal 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/release 0750 root gitops -
+d /run/aios-gitops/autonomous-control-plane 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/publisher 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/watcher 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/watcher/requests 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/watcher/status 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/mirror/requests 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/mirror/receipts 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/projection/requests 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/projection/receipts 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/projection/releases 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/renewal/requests 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/renewal/receipts 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/release/metadata-snapshots 0750 root gitops -

deploy/tmpfiles.d/aios-single-owner-governance.conf

@@ -0,0 +1,4 @@
+d /var/lib/aios-gitops/governance-activation 0750 root gitops -
+d /var/lib/aios-gitops/governance-activation/wal 0750 root gitops -
+d /var/lib/aios-gitops/governance-activation/receipts 0750 root gitops -
+d /run/aios-gitops 0750 root gitops -

docs/autonomous-release/AGENT_DEPLOYMENT_INSTRUCTIONS.md

@@ -0,0 +1,71 @@
+# AIOS Autonomous Release Agent Deployment Instructions
+
+## Objective
+
+Deploy only candidate/shadow environments first. Production activation requires a separate owner release approval.
+
+## Agent execution order
+
+1. Verify git references:
+   - local
+   - authoritative bare
+   - remote
+   - Gitea API
+
+2. Build candidate artifact.
+
+3. Run:
+   - unit tests
+   - security scans
+   - secret scans
+   - artifact verification
+
+4. Start candidate workers:
+   - OpenClaw native adapter
+   - Codex native adapter
+   - dedicated writer
+
+5. Execute shadow task:
+
+```
+TaskPlan
+ -> Planner
+ -> Worker Router
+ -> Session lifecycle
+ -> Evidence chain
+ -> Artifact verification
+ -> ReleasePlan
+```
+
+## Hard restrictions
+
+Never:
+
+- write main directly
+- force push
+- rewrite tags
+- export secrets
+- bypass owner approval
+- modify production flags during candidate validation
+
+## Production release gate
+
+Require:
+
+```
+owner_approval=true
+artifact_verified=true
+evidence_closure=true
+rollback_ready=true
+remote_tag_verified=true
+baseline_verified=true
+registry_verified=true
+```
+
+Until then keep:
+
+```
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+```

docs/autonomous-release/ARCHITECTURE.md

@@ -0,0 +1,34 @@
+# AIOS Autonomous Release Candidate 架构
+
+本 Candidate 把规划、工作流、凭据引用、原生会话、证据和发布控制拆成独立边界。它只负责验证约束，不拥有生产授权。
+
+## 信任边界
+
+- Owner Approval 的签名和撤销状态来自外部 HSM/KMS 或可信 Approval Plane。Candidate 只有 verifier，没有 signer。
+- Secret Manager V2 只返回 `systemd-credential:*` 或受控的 Candidate reference，不返回认证正文。
+- OpenClaw、Codex 和 Gitea provider 身份由管理面供应；模拟 provider 永远不能把原生 canary 标成已验证。
+- Writer 只写任务绑定分支和允许路径。生产 main、tag、baseline、registry 和部署不属于 Candidate 权限。
+
+## 核心模块
+
+- `models.py`：TaskPlan、Approval、Credential、Result 和 ReleasePlan 强类型约束。
+- `store.py`：私有 SQLite、WAL、全同步、schema 检查、事务和原子 step transition。
+- `workflow.py`：依赖、claim、lease、retry、timeout recovery 和终态。
+- `credential.py` / `secret_manager.py`：reference-only 生命周期、补偿撤销、跨任务拒绝和 post-revocation 验证。
+- `native_adapters.py`：OpenClaw/Codex 原生 provider ID、parent/child tree、status、interrupt、close 和纯文本回执。
+- `gitea_canary.py`：仅通过 deploy-key provider 的 list/create/delete 操作完成 canary 与撤销验证。
+- `evidence.py`：落库的哈希链、重启回放、篡改检测和 required-event closure。
+- `artifact.py`：确定性 tar、逐文件哈希、package closure、链接/特殊文件/敏感标记拒绝。
+- `release.py` / `release_gate.py`：部署审批与回滚审批分离，tag object 与 peeled target 分离验证。
+
+## 会话真实性
+
+以下状态必须分别记录，不能互相替代：
+
+```text
+broker_session_verified
+openclaw_native_child_session_verified
+codex_child_session_verified
+```
+
+Shadow provider 只能证明 Broker 合同和清理路径，不能证明 OpenClaw 或 Codex 原生会话。

docs/autonomous-release/DORMANT_RELEASE_EXECUTION.md

@@ -0,0 +1,133 @@
+# AIOS V2R1C4 Dormant Shadow-Only Release Execution
+
+## Purpose
+
+Deploy verified V2R1C4 code while keeping autonomous execution capabilities disabled.
+
+This release separates code deployment from capability activation. Capability activation requires a later, independently approved release.
+
+## Deployment mode
+
+```text
+deployment_mode=dormant_shadow_only
+```
+
+Required production flags:
+
+```text
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+```
+
+Required dispatch transport:
+
+```text
+protectedDispatchTransport=sandbox
+```
+
+Disabled capabilities:
+
+```text
+native_openclaw_enabled=false
+native_codex_enabled=false
+automatic_release_enabled=false
+production_side_effects=false
+activation_deferred=true
+```
+
+## Release flow
+
+```text
+Integration verification
+        |
+        v
+Owner dormant release approval
+        |
+        v
+Merge PR
+        |
+        v
+Read final main merge OID
+        |
+        v
+Rebuild production artifact
+        |
+        v
+Deploy dormant runtime
+        |
+        v
+Create V2R1C4 tag
+        |
+        v
+Verify Registry and Baseline consistency
+```
+
+## Two-stage approval model
+
+### Pre-merge approval
+
+The pre-merge approval binds:
+
+- version
+- PR number
+- integration OID and tree OID
+- candidate artifact and evidence hashes
+- deployment mode
+- all production execution flags remaining false
+
+It authorizes the governed merge and production artifact rebuild. It does not predeclare the final production target OID.
+
+### Final release approval
+
+After the governed merge, the final approval binds:
+
+- final main merge OID
+- final main tree OID
+- production artifact, manifest, package closure, and evidence closure
+- rollback artifact and production configuration hashes
+- V2R1C4 tag target
+
+The integration OID must never be used as the final production target OID.
+
+## Deferred activation
+
+The following are separate activation gates and must not block dormant code deployment:
+
+- OpenClaw native session provider
+- Codex app-server provider
+- Gitea Admin API automation
+- Secret Manager V2
+- autonomous production execution
+
+They require a later activation release with separate evidence and approval.
+
+## Hard restrictions
+
+Never:
+
+- write main directly
+- force push
+- rewrite tags
+- export secrets
+- enable autonomous production execution without approval
+- treat integration OID as production target OID
+- update Registry or Baseline before remote and Gitea tag verification
+
+## Dormant production acceptance
+
+A dormant deployment is acceptable only when:
+
+```text
+deployment_mode=dormant_shadow_only
+production_side_effects=false
+protectedDispatchTransport=sandbox
+native_openclaw_enabled=false
+native_codex_enabled=false
+automatic_release_enabled=false
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+```
+
+The release report must preserve deferred activation blockers rather than falsely marking native-agent or automatic-release capabilities as enabled.

docs/autonomous-release/EXECUTION_PACKAGE.md

@@ -0,0 +1,82 @@
+# AIOS Autonomous Release Execution Package
+
+## Release Strategy
+
+V2R1C4 uses a two-stage model:
+
+1. Dormant code deployment.
+2. Capability activation through a separate approved release.
+
+## Dormant Deployment
+
+The first production release must keep autonomous execution disabled:
+
+```text
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+```
+
+Required mode:
+
+```text
+deployment_mode=dormant_shadow_only
+```
+
+Required properties:
+
+```text
+production_side_effects=false
+native_openclaw_enabled=false
+native_codex_enabled=false
+automatic_release_enabled=false
+```
+
+## Deployment Sequence
+
+```text
+Verify Integration
+        |
+        v
+Owner Dormant Release Approval
+        |
+        v
+Merge Pull Request
+        |
+        v
+Read final main merge OID
+        |
+        v
+Build Production Artifact
+        |
+        v
+Deploy Dormant Runtime
+        |
+        v
+Create Version Tag
+        |
+        v
+Verify Registry and Baseline
+```
+
+## Capability Activation (Separate)
+
+The following require separate approval and evidence:
+
+- OpenClaw native provider
+- Codex app-server provider
+- Gitea Admin API lifecycle
+- Secret Manager V2
+- Autonomous production execution
+
+## Hard Governance Rules
+
+Never:
+
+- direct write main
+- force push
+- rewrite tags
+- export credentials
+- enable autonomous production execution without approval
+- use integration OID as production target OID
+- update Baseline before remote tag verification

docs/autonomous-release/INTEGRATION_REFRESH_SOURCE_MAP_20260728.json

@@ -0,0 +1,35 @@
+{
+  "execution_renewal_manifest_blob_oid": "417f78abb3d795f7b0c04a0894069bd166bb15df",
+  "execution_renewal_manifest_sha256": "069091eff9c7c46bceccde365da6d07a8538e76bee9e288a57211f3114b94ab3",
+  "execution_renewal_merge_oid": "3a22c3c7d86930efd4bd93ac05d80ad322050cb9",
+  "observed_at": "2026-07-28T09:09:27.841968Z",
+  "runtime_source_evidence_sha256": "23f03d9c6abe6f11e1acda5210b8708696e3b77caa0083b6bfaef30a44b2a35f",
+  "runtime_source_observed_at": "2026-07-28T05:53:01.253909Z",
+  "schema": "aios.integration-refresh-source-map/v1",
+  "source_mapping_approval_merge_oid": "9514062cf33e45941abe4a8c98377e0713b0b3f6",
+  "source_mapping_manifest_blob_oid": "00c5e90e529cb98c7750a5761b0a0d6ccf507174",
+  "source_mapping_manifest_sha256": "17af8ebc43673c0e46bb9ab1bf44497e8c147f1b4a9d7a8a404edd5c0abd6f21",
+  "sources": [
+    {
+      "byte_for_byte_equal": true,
+      "canonical_blob_oid": "9c68be36e0b6a18260e3099e3d7b0dcab6d814aa",
+      "canonical_commit_oid": "85426f4f570e4d40b212318d47e52e4aed5cb06a",
+      "canonical_git_path": "active-runtime/app/aios_autonomous_release_authorization/controller.py",
+      "canonical_tree_oid": "cdbd9bb845b18d4b5224d91aace2656a51eb7c14",
+      "runtime_blob_oid": "9c68be36e0b6a18260e3099e3d7b0dcab6d814aa",
+      "runtime_path": "/usr/libexec/aios-autonomous-release-authorization/controller.py",
+      "runtime_sha256": "39b532c3058c4ae49ed691d7c66c3b7745a25111fa61039f388c8335fd262c50"
+    },
+    {
+      "byte_for_byte_equal": true,
+      "canonical_blob_oid": "ee0595ca61a0598f8cb3dc10865a255e21679b2a",
+      "canonical_commit_oid": "85426f4f570e4d40b212318d47e52e4aed5cb06a",
+      "canonical_git_path": "active-runtime/app/aios_chatgpt_action_task_router/action_task_router.py",
+      "canonical_tree_oid": "cdbd9bb845b18d4b5224d91aace2656a51eb7c14",
+      "runtime_blob_oid": "ee0595ca61a0598f8cb3dc10865a255e21679b2a",
+      "runtime_path": "/usr/libexec/aios-chatgpt-action-task-router-continuous-20260726/action_task_router.py",
+      "runtime_sha256": "738fb7035a6b792115d6467b4d1e4ffd47a8c5d5646f7032ebc68ea587cbd554"
+    }
+  ],
+  "task_id": "AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726"
+}

docs/autonomous-release/OPERATIONS.md

@@ -0,0 +1,48 @@
+# Candidate 运维与验收
+
+## 安全默认值
+
+两个 systemd 模板均为 Dormant/Shadow-only，绑定 loopback，默认关闭 Task Plane 执行、GitOps 写入和生产部署。模板进入仓库不等于安装或启动服务。
+
+外部信任根缺失时必须保留以下阻断：
+
+```text
+BLOCKED_OWNER_APPROVAL_VERIFIER_UNAVAILABLE
+BLOCKED_GITEA_ADMIN_CREDENTIAL_REQUIRED
+BLOCKED_EXTERNAL_OWNER_SIGNATURE
+```
+
+不得用模拟身份、个人账户或生产 provider 身份替代这些根。
+
+## 独立验收
+
+从仓库根目录运行：
+
+```text
+PYTHONPATH=services/aios-autonomous-release-candidate \
+python3 -m pytest -p no:cacheprovider -q tests/autonomous_release
+
+PYTHONPATH=services/aios-autonomous-release-candidate \
+python3 scripts/autonomous-release/run_acceptance.py \
+  --repo-root . \
+  --output /task-evidence/candidate-acceptance.json
+```
+
+Acceptance report 必须满足：
+
+```text
+all_passed=true
+skipped=0
+direct_gitea_database_access=false
+production_path_hits=[]
+secret_hits=[]
+production_side_effects=false
+```
+
+## Artifact
+
+Artifact builder 拒绝覆盖现有文件、链接、硬链接、特殊文件、仓库元数据和敏感内容标记。输出 tar 和 manifest 后必须再次执行 `ArtifactBuilder.verify`。
+
+## 外部 canary
+
+真实 native session 与 Gitea canary 只能在任务绑定的 runtime credential 投影存在时运行。每次 canary 完成后必须关闭 provider session、撤销上游对象、删除 projection，并保留非敏感回执。

docs/autonomous-release/RELEASE_PLAN.md

@@ -0,0 +1,26 @@
+# Governed ReleasePlan 关闭条件
+
+ReleasePlan 必须绑定 task、repository、integration branch、完整 target/tree OID、artifact/manifest/evidence/rollback digest、生产配置 digest，以及互不相同的部署和回滚 ApprovalPlan ID。
+
+## Candidate 与 Integration
+
+1. Candidate 分支先完成测试、扫描、Shadow、Artifact 和外部门禁盘点。
+2. 重新读取 authoritative `main` 完整 OID。
+3. 从该 OID 创建 integration 分支。
+4. 使用普通 `merge --no-ff` 合入 Candidate；禁止 squash、rebase、amend 和 force push。
+5. 在 integration 上重新执行全部测试、扫描和 artifact closure。
+
+## 生产停止线
+
+下列项目任一为 false，流程必须停止在 `READY_FOR_OWNER_RELEASE_APPROVAL`，不得部署或创建生产 tag：
+
+```text
+openclaw_native_child_session_verified
+codex_child_session_verified
+gitea_admin_api_lifecycle_canary
+owner_signer_separation_verified
+credential_incident_closed
+external_owner_release_approval_verified
+```
+
+聊天文本、Candidate 自签记录或模拟 canary 不能改变这条停止线。

docs/autonomous-release/V2R1C4_AGENT_FINAL_EXECUTION.md

@@ -0,0 +1,414 @@
+# AIOS V2R1C4 Dormant Release — Final Agent Execution Contract
+
+## 1. Purpose
+
+This document is the machine/operator execution contract for completing the governed V2R1C4 dormant release after Candidate development is frozen.
+
+It does not grant production authority. Every consequential action remains subject to the exact approval, Git reference, artifact, tag, Registry and Baseline gates defined below.
+
+## 2. Release mode
+
+The only permitted deployment mode for V2R1C4 is:
+
+```text
+deployment_mode=dormant_shadow_only
+```
+
+The following values are mandatory before, during and after deployment:
+
+```text
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+AIOS_PRODUCTION_DEPLOYMENT_ENABLED=false
+production_side_effects=false
+native_openclaw_enabled=false
+native_codex_enabled=false
+automatic_release_enabled=false
+activation_deferred=true
+protectedDispatchTransport=sandbox
+```
+
+Any deviation is a hard stop.
+
+## 3. Authoritative branches
+
+```text
+candidate_branch=patch/chatgpt-autonomous-completion-contract-20260726
+integration_branch=integration/chatgpt-autonomous-completion-20260726
+production_branch=main
+version=V2R1C4
+pull_request=20
+```
+
+Never infer a target OID from workspace HEAD. Always read and record full 40-character OIDs.
+
+## 4. Phase A — Candidate freeze and verification
+
+1. Read the current Candidate OID and tree OID.
+2. Verify the Candidate worktree is clean.
+3. Verify four-way Candidate reference closure:
+   - local branch ref;
+   - authoritative bare ref;
+   - `git ls-remote` ref;
+   - Gitea API branch ref.
+4. Run the complete test and static validation suite defined in `V2R1C4_TEST_AND_RELEASE_CHECKLIST.md`.
+5. Build the deterministic Candidate artifact and manifest from the exact Candidate OID.
+6. Record:
+   - artifact SHA-256;
+   - manifest SHA-256;
+   - package closure SHA-256;
+   - test evidence SHA-256;
+   - rollback artifact SHA-256;
+   - production configuration SHA-256.
+7. Do not reuse any digest generated from an older Candidate OID.
+
+Failure state:
+
+```text
+CANDIDATE_ACCEPTANCE_BLOCKED
+```
+
+## 5. Phase B — Integration refresh
+
+1. Refresh the Integration branch from the latest Candidate using a governed non-fast-forward merge.
+2. Use:
+
+```text
+merge --no-ff
+```
+
+3. Do not squash, rebase, force push or rewrite Candidate history.
+4. Verify the Candidate OID is reachable from the new Integration OID.
+5. Verify four-way Integration reference closure.
+6. Run the full Candidate test suite again from the Integration worktree.
+7. Rebuild Integration evidence and Candidate package metadata if any tracked file changed during the merge.
+
+Failure state:
+
+```text
+INTEGRATION_ACCEPTANCE_BLOCKED
+```
+
+## 6. Phase C — Candidate acceptance
+
+Create Candidate acceptance evidence and execute:
+
+```text
+python scripts/autonomous-release/run_acceptance.py \
+  --phase candidate \
+  --input <candidate-evidence.json> \
+  --output <candidate-acceptance.json>
+```
+
+The result must contain:
+
+```text
+phase=candidate
+status=READY
+production_action_authorized=false
+```
+
+The Candidate gate must verify:
+
+```text
+candidate_four_way_ref_closure=true
+integration_four_way_ref_closure=true
+candidate_reachable_from_integration=true
+worktree_clean=true
+tests_failed=0
+tests_passed>0
+```
+
+It must also verify all dormant runtime flags remain disabled.
+
+`READY` authorizes review only. It does not authorize merge, deployment, tagging, Registry writes or Baseline writes.
+
+## 7. Phase D — Pre-merge owner approval
+
+Obtain a governed Owner approval plan for the exact Integration package.
+
+The approval subject must bind at least:
+
+```text
+version
+pull_request
+candidate_oid
+candidate_tree_oid
+integration_oid
+integration_tree_oid
+candidate_acceptance_digest
+candidate_release_digest
+artifact_sha256
+manifest_sha256
+package_closure_sha256
+evidence_closure_oid
+rollback_artifact_sha256
+production_config_sha256
+deployment_mode=dormant_shadow_only
+all execution flags=false
+```
+
+The approval must not predeclare the final production target OID.
+
+Without an Owner-approved plan, stop with:
+
+```text
+BLOCKED_EXTERNAL_OWNER_SIGNATURE
+```
+
+## 8. Phase E — Governed merge
+
+1. Merge PR #20 only through the governed merge path.
+2. Do not push directly to `main`.
+3. After merge, read the exact resulting `main` merge OID and tree OID.
+4. Verify four-way `main` reference closure.
+5. Verify the merged Integration OID is reachable from the final `main` merge OID.
+6. Never use the Integration OID as the production target OID.
+
+Failure state:
+
+```text
+MAIN_RECONCILIATION_REQUIRED
+```
+
+## 9. Phase F — Production artifact rebuild
+
+Rebuild all production artifacts from the exact final `main` merge OID.
+
+Record new values for:
+
+```text
+artifact_sha256
+manifest_sha256
+package_closure_sha256
+evidence_closure_oid
+rollback_artifact_sha256
+production_config_sha256
+```
+
+Candidate or Integration artifacts may not be promoted by renaming or metadata substitution. The final artifact must be demonstrably rebuilt from the final production target.
+
+## 10. Phase G — Final release digest and Owner approval
+
+1. Construct the `FinalDormantRelease` object using the final `main` target and rebuilt artifact evidence.
+2. Compute its exact `release_digest`.
+3. Obtain an Owner approval receipt bound to that exact digest.
+4. Record:
+
+```text
+approval_plan_id
+approval_receipt_sha256
+approved_release_digest
+owner_approval_verified=true
+```
+
+Required equality:
+
+```text
+approved_release_digest == FinalDormantRelease.digest()
+```
+
+A generic approval, previous approval, Candidate approval or Integration approval is insufficient.
+
+## 11. Phase H — Final acceptance
+
+Execute:
+
+```text
+python scripts/autonomous-release/run_acceptance.py \
+  --phase final \
+  --input <final-evidence.json> \
+  --output <final-acceptance.json>
+```
+
+The result must contain:
+
+```text
+phase=final
+status=READY
+production_action_authorized=false
+```
+
+Required final evidence:
+
+```text
+main_four_way_ref_closure=true
+target_is_main_head=true
+worktree_clean=true
+artifact_rebuilt_from_target=true
+rollback_verified=true
+runtime_boundary_verified=true
+owner_approval_verified=true
+approved_release_digest=<exact final release digest>
+```
+
+The acceptance report is evidence, not an execution credential.
+
+## 12. Phase I — Dormant deployment
+
+Deployment requires a separate production execution approval referencing:
+
+```text
+version=V2R1C4
+target_oid=<final main merge OID>
+evidence_closure_oid=<final evidence closure OID>
+approval_plan_id=<approved plan>
+final_acceptance_digest=<final acceptance digest>
+```
+
+Deploy only the dormant runtime. Before starting services, verify all disabled flags and the sandbox transport in the rendered production configuration.
+
+After start, verify:
+
+```text
+services_active=true
+loopback_bindings_only=true
+production_side_effects=false
+write_endpoints_disabled=true
+task_plane_execution_disabled=true
+silent_release_execution_disabled=true
+native_agent_execution_disabled=true
+```
+
+If any side-effect-capable path is active, stop services and mark:
+
+```text
+DORMANT_RUNTIME_BOUNDARY_VIOLATION
+```
+
+## 13. Phase J — Tag governance
+
+Tagging is permitted only after dormant deployment verification and exact Owner approval.
+
+Every tag request must carry:
+
+```text
+version=V2R1C4
+target_oid=<full final main merge OID>
+evidence_closure_oid=<full final evidence closure OID>
+approval_plan_id=<approved plan ID>
+```
+
+When an existing same-name tag is found:
+
+- identical tag OID and peeled target: treat as idempotent and reverify;
+- different tag OID or peeled target: stop with `MANUAL_OWNER_REVIEW_REQUIRED`.
+
+Never force push, delete, move or rewrite a formal tag.
+
+## 14. Phase K — Remote and Gitea tag acceptance
+
+Before any Registry or Baseline update, verify:
+
+```text
+local_tag_exists=true
+remote_tag_exists=true
+gitea_api_tag_exists=true
+local_tag_oid == remote_tag_oid
+remote_peeled_target_oid == target_oid
+gitea_peeled_target_oid == target_oid
+repository_identity=aios/aios
+```
+
+For annotated tags, verify both the tag object and peeled commit.
+
+Failure state:
+
+```text
+REMOTE_PUSH_PENDING
+```
+
+or:
+
+```text
+RECONCILIATION_REQUIRED
+```
+
+## 15. Phase L — Registry and Baseline
+
+Only after remote and Gitea tag acceptance:
+
+1. register or update the V2R1C4 Registry entry;
+2. reread the Registry and verify the exact target OID;
+3. update the Production Baseline to V2R1C4;
+4. reread the Baseline;
+5. run final release consistency acceptance.
+
+Required equality:
+
+```text
+Registry version
+= Production Baseline
+= local refs/tags/V2R1C4
+= remote refs/tags/V2R1C4
+= Gitea API tag
+= expected final main target
+```
+
+Do not write `PRODUCTION_DEPLOYED` before this equality is proven.
+
+## 16. Rollback
+
+If deployment verification fails:
+
+1. disable the V2R1C4 Candidate services;
+2. preserve evidence and logs;
+3. submit a governed rollback request with the target version and reason;
+4. distinguish `requested`, `approved`, `executed` and `verified` states.
+
+Do not delete tags, rewrite history or independently perform a production rollback.
+
+## 17. Mandatory stop conditions
+
+Stop without consequential execution when any of the following is missing or false:
+
+```text
+four_way_ref_closure
+clean_worktree
+full_test_closure
+artifact_digest_verification
+rollback_evidence
+runtime_boundary_verification
+exact_owner_approval
+exact_target_oid
+exact_evidence_closure_oid
+exact_approval_plan_id
+remote_tag_verification
+gitea_tag_verification
+```
+
+## 18. Final report schema
+
+Return:
+
+```text
+execution_status=COMPLETED|PARTIALLY_COMPLETED|BLOCKED|FAILED
+candidate_oid=<full OID>
+integration_oid=<full OID>
+main_target_oid=<full OID>
+artifact_sha256=<digest>
+manifest_sha256=<digest>
+package_closure_sha256=<digest>
+evidence_closure_oid=<full OID>
+candidate_acceptance_status=<status>
+final_acceptance_status=<status>
+owner_approval_verified=<bool>
+dormant_deployment_verified=<bool>
+local_tag_verified=<bool>
+remote_tag_verified=<bool>
+gitea_tag_verified=<bool>
+registry_verified=<bool>
+baseline_verified=<bool>
+release_consistency=<status>
+```
+
+Always include:
+
+```text
+force_push_used: false
+tag_rewritten: false
+direct_main_push: false
+secrets_committed: false
+owner_approval_respected: true
+```

docs/autonomous-release/V2R1C4_DORMANT_RELEASE_AGENT_EXECUTION.md

@@ -0,0 +1,30 @@
+# AIOS V2R1C4 Dormant Release Agent Execution
+
+## Scope
+
+This package is a dormant, shadow-only Candidate release. It does not authorize a production deployment, tag, baseline update, registry update, or a write to main.
+
+## Required runtime boundary
+
+deployment_mode=dormant_shadow_only
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+production_side_effects=false
+
+## Governed sequence
+
+1. Verify the Integration branch with the Candidate test suite and four-way Git reference closure.
+2. Obtain Owner approval for dormant review only.
+3. Merge only after a separate production release approval; this document does not grant that approval.
+4. Read the resulting main merge OID before building an artifact.
+5. Deploy only the dormant Candidate runtime after explicit production approval.
+6. Create a tag and update Registry or Baseline only under their separate governed approvals.
+
+## Evidence requirements
+
+The execution agent must retain task ID, commit OID, artifact and manifest digests, test evidence, rollback package reference, and approval receipt metadata. It must not include plaintext credentials or private keys.
+
+## Stop conditions
+
+Stop with NOT_EXECUTED if any approval, four-way reference closure, artifact verification, or deployment gate is absent. Do not infer production authorization from Candidate authorization.

docs/gitops/SILENT_RELEASE_CONTROLLER_DESIGN.md

@@ -0,0 +1,268 @@
+# AIOS Silent Release Controller Design Report
+
+状态：隔离分支实现；生产 mutation 禁止
+目标：自动准备 → 自动验证 → 单次 Owner 签名授权 → 分控制器自动执行与验收
+
+## 1. 当前痛点
+
+现有流程需要多轮人工传递 commit、tree、artifact、manifest、测试、canary、drop-in
+和回滚证据。证据在不同消息里重复抄写，容易出现：
+
+- 构建后 artifact、manifest 或 policy 已变化，但旧批准仍被使用；
+- Git、Gitea、systemd 与回滚结果由人工拼接，缺少同一一致性快照；
+- runtime switch、tag、Baseline、Registry 的授权边界不清；
+- 重启后只剩工作树内临时 JSON，无法可靠恢复；
+- approval replay、并发 writer、key revoke 和 secret inheritance 缺少统一防线。
+
+## 2. 新架构
+
+```text
+Build / Test / Canary
+        |
+        v
+ReleaseCandidate + DeploymentPlan
+        |
+        v
+ReleaseAcceptanceEngine
+        |
+        v
+READY_FOR_APPROVAL
+        |
+        v
+SignedReleasePlanApproval (Ed25519)
+        |
+        +--> runtime_switch capability
+        |       DeploymentController
+        |
+        +--> tag_publish capability
+        |       TagController
+        |
+        +--> baseline_registry_finalize capability
+                BaselineRegistryFinalizeController
+
+Durable ReleaseSagaStore + CapabilityLedger + Event Journal
+贯穿三个控制器；控制器互相不拥有对方的 mutation API。
+```
+
+一次 Owner 批准是同一个不可变 release plan 的签名，不是一个万能执行入口。三个 capability
+分别消费、分别留痕、分别幂等恢复。`force_push`、`tag_rewrite`、`direct_main_push`
+永远不是可签发 capability。
+
+## 3. 状态机
+
+```text
+PREPARING
+  -> VERIFYING
+  -> READY_FOR_APPROVAL
+  -> APPROVED
+  -> PRE_SWITCH_REVALIDATING
+  -> SWITCH_PENDING
+  -> SWITCHED
+  -> RUNTIME_VERIFYING
+  -> TAG_PENDING
+  -> TAG_VERIFIED
+  -> BASELINE_REGISTRY_PENDING
+  -> COMPLETED
+
+任一可恢复故障 -> RECONCILIATION_REQUIRED
+对象冲突       -> MANUAL_OWNER_REVIEW_REQUIRED
+切换后失败     -> ROLLBACK_PENDING -> ROLLED_BACK
+```
+
+状态快照使用 revision compare-and-set；事件同时写入 append-only journal。writer 崩溃后根据
+状态确定唯一恢复动作。并发控制器中只有一个 CAS winner。
+
+## 4. 数据模型
+
+### ReleaseCandidate
+
+```text
+candidate_id
+source_commit
+tree_oid
+artifact_sha256
+manifest_sha256
+tests
+canary
+rollback_ready
+git_consistency
+gitea_consistency
+approval_state
+```
+
+### DeploymentPlan
+
+```text
+service
+release_path / release_root
+dropin_path / dropin_sha256
+rollback_path / rollback_sha256
+source_commit
+artifact_sha256
+manifest_sha256
+policy_sha256
+health_contract
+sha256
+```
+
+### SignedReleasePlanApproval
+
+```text
+release_plan_id
+candidate_id
+source_commit
+tree_oid
+artifact_sha256
+manifest_sha256
+deployment_plan_sha256
+policy_sha256
+approval_plan_id
+evidence_closure_oid
+owner_approval_record_oid
+capabilities
+expires_at
+nonce
+key_id
+signature
+fingerprint
+```
+
+签名内容使用 canonical JSON，`signature` 不参与被签名字段。验证包括 Ed25519 签名、过期时间、
+公钥状态、approval revoke、candidate/plan/policy 逐字段绑定和 capability allowlist。
+
+## 5. API
+
+```text
+POST /createReleaseCandidate
+GET  /getReleaseCandidate?candidate_id=...
+GET  /getApprovalEnvelope?candidate_id=...
+POST /submitOwnerApproval
+POST /startDeployment
+GET  /getReleaseSaga?candidate_id=...
+```
+
+写接口要求 Bearer scope。`AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false` 是默认值；此时可以
+持久化 candidate、生成 approval envelope、保存经验证的 Owner approval 和读取 Saga，
+但 `/startDeployment` 只返回 `SHADOW_MODE` 与空 `side_effects`。
+
+## 6. PreSwitchValidator
+
+切换前重新收集并比较：
+
+- source commit 与 tree；
+- artifact、manifest、policy 和 deployment plan SHA-256；
+- rollback readiness；
+- local、authoritative bare 与 Gitea refs；
+- repository identity；
+- task writer/production writer 边界；
+- health contract。
+
+任一变化都抛出：
+
+```text
+APPROVAL_STALE_REAPPROVAL_REQUIRED
+```
+
+旧批准不会被“最佳努力”继续使用。
+
+## 7. systemd 防线
+
+- service 与 drop-in 均为显式 allowlist；
+- release 与 drop-in resolved path 必须位于 release root 内；
+- 拒绝普通文件被替换为 symlink，拒绝 symlink escape；
+- deployment lock 覆盖 switch、restart 和首次 health check；
+- restart 前后记录 MainPID 与 ActiveEnterTimestampMonotonic；
+- artifact、drop-in、rollback 和 manifest 均按 plan hash 复验；
+- 子进程只接收固定 allowlist 环境，不继承 token、password、credential、askpass、
+  auth socket、`LD_PRELOAD`、`PYTHONPATH` 或数据库连接串。
+
+## 8. TagController 分离
+
+TagController 必须独立完成 approval、execute、verify，并留下：
+
+```text
+evidence_closure_oid
+approval_plan_id
+repository_identity
+remote_tag_oid
+remote_peeled_target_oid
+gitea_api_tag_oid
+gitea_listing_visible
+```
+
+同名 tag 的 tag OID 或 peeled target 不同，进入
+`MANUAL_OWNER_REVIEW_REQUIRED`；自动流程不 push、不删除、不重写、不 force push。
+
+## 9. Baseline / Registry 门禁
+
+只有以下全部一致时，`baseline_registry_finalize` capability 才能完成：
+
+```text
+Registry = Baseline = remote tag = Gitea API = expected target
+```
+
+UNKNOWN、API 不可达、repository identity 不符或 listing 不可见均 fail closed。
+
+## 10. Policy as Code
+
+```text
+automatic:
+  build, test, artifact, canary, evidence
+
+owner:
+  signed_release_plan
+
+capabilities:
+  runtime_switch
+  tag_publish
+  baseline_registry_finalize
+
+forbidden:
+  force_push
+  tag_rewrite
+  direct_main_push
+  baseline_mutation
+  registry_mutation
+```
+
+最后两个 forbidden 项指“脱离受治理 finalize controller 的直接 mutation”。
+
+## 11. Security model
+
+- Ed25519 公钥 ring 支持 rotation 和 revoke，私钥不进入 runtime；
+- approval plan 可撤销，过期、未知 key、错误签名均 fail closed；
+- nonce 与 capability operation 持久化，重复相同请求幂等，不同 fingerprint 重放拒绝；
+- Saga snapshot 原子写、journal append-only、CAS 防并发 writer；
+- credential 只通过受控 reference 使用，不进入 Git、API 响应或异常；
+- 子进程环境从空集合构建，不复制 `os.environ`；
+- Shadow 模式默认开启，execution adapter 缺失时不能降级执行；
+- runtime、tag、Baseline/Registry 分属三个能力最小化控制器。
+
+## 12. Migration plan
+
+1. Shadow：生成 candidate、plan、acceptance、approval package，仅比较现有人工结果。
+2. Signed approval：接入 Owner 公钥 ring、撤销源和审计 record；仍不接生产 executor。
+3. Canary execution：使用非生产 service/release root 验证锁、PID、health、崩溃恢复和回滚。
+4. Controlled production switch：另行 Owner 授权启用 execution flag，只开放 runtime capability。
+5. Tag/finalize：分别完成 Gitea 与 Registry/Baseline 生产验收后再启用对应 capability。
+
+每个阶段均可退回上一个阶段；不开启下一能力不会影响已经启用的控制器。
+
+## 13. Rollback plan
+
+- switch 前保存旧 symlink target、PID、启动时间、artifact 与 plan fingerprint；
+- restart 或 health 任一失败进入 `ROLLBACK_PENDING`；
+- 原子恢复旧 target，只 restart 指定 allowlist service；
+- 重新验证旧 runtime commit、writer=false 与 repository identity；
+- 成功进入 `ROLLED_BACK`，失败进入 `MANUAL_OWNER_REVIEW_REQUIRED`；
+- rollback 不修改 Git main、production tag、Baseline 或 Registry；
+- 保留脱敏 journal、approval fingerprint 和失败证据。
+
+## 14. 测试与外部依赖边界
+
+自动测试覆盖签名伪造、字段篡改、过期/revoke/key rotation、nonce replay、CAS race、
+崩溃恢复、artifact/policy/plan mutation、tag conflict、secret leakage、runtime without
+`.git`、rollback 和 shadow no-side-effects。
+
+本隔离实现不创建生产 KMS/key、不安装 systemd unit、不部署 Action runtime、不创建 tag，
+也不修改 Baseline/Registry。上述动作必须在单独生产批准中执行。

docs/gitops/SILENT_RELEASE_EXECUTION_READINESS.md

@@ -0,0 +1,107 @@
+# AIOS Silent Release Execution Readiness
+
+## Scope and stop point
+
+This change makes the controller execution-ready while deploying only a
+localhost-bound Shadow control plane. Both production gates remain false:
+
+```text
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+```
+
+Shadow completion is evidence preparation, not a production release. It cannot
+write a production tag, switch a business runtime, or mutate Baseline/Registry.
+
+## Recovery state machine
+
+Every expired or `FAILED_RECOVERABLE` capability requires fresh, operation-bound
+probe evidence before another adapter may run:
+
+```text
+NOT_APPLIED       -> one new exclusive claim may retry
+APPLIED_VERIFIED  -> mark COMPLETED without adapter replay
+INDETERMINATE     -> RECONCILIATION_REQUIRED; no automatic writes
+CONFLICT          -> MANUAL_OWNER_REVIEW_REQUIRED; no automatic writes
+```
+
+Probe evidence binds the immutable operation digest, is freshness checked, and
+is appended to a separate SHA-256 hash-chained journal. Completion still
+requires the active claim ID. File locks and leases ensure that concurrent
+recovery workers cannot execute the same adapter.
+
+`TAG_PENDING` uses independent remote ref, annotated object, peeled target,
+Gitea API, Gitea listing, and repository identity evidence. Exact absence may
+roll back a switched runtime. Exact publication continues to finalization.
+Unavailable/divergent evidence stops at reconciliation; a different OID or
+target stops for Owner review. No branch can force, delete, or rewrite a tag.
+
+## Trusted build and approval
+
+Callers submit only an event ID and exact source commit. Test, canary, artifact,
+manifest, rollback, secret scan, Git and Gitea evidence are generated by the
+trusted builder. The builder emits an Ed25519 attestation binding:
+
+- builder attestation/key IDs;
+- source commit and tree OID;
+- artifact, manifest and package-closure SHA-256;
+- test and canary evidence SHA-256;
+- issuance time and signature.
+
+The controller contains only trusted public keys. Production signing is exposed
+through a KMS/HSM/secret-manager adapter; a local private-key adapter is marked
+test-only and is used only for ephemeral Shadow acceptance.
+
+Owner approvals are immutable, time-bounded, revocable, trust-domain bound, and
+single-use per capability ledger. If the production approval backend reference
+is absent, production execution is unavailable while Shadow remains available.
+Caller-supplied `owner_id` is never a fallback.
+
+## Persistent controller and API
+
+`aios-silent-release-controller.service` runs independently from the business
+GitOps API. It uses a single leader lock, durable intents/candidates/Sagas,
+startup journal verification, idempotent main events, one notification record,
+and recovery reporting. The final deployed service is report-only Shadow mode.
+
+The Action contract exposes:
+
+- `createReleaseIntent`
+- `getReleaseCandidate`
+- `getReleasePlan`
+- `getReleaseAcceptance`
+- `submitSignedApproval`
+- `getReleaseSaga`
+- `getCapabilityStatus`
+- `startDeployment`
+- `getRecoveryStatus`
+
+Every Shadow response declares `execution_enabled=false`, `shadow_mode=true`
+and `side_effects_executed=false`. `startDeployment` returns a simulated
+`SHADOW_COMPLETED` result and never claims production capabilities.
+
+## Migration and rollback
+
+1. Merge through a governed pull request.
+2. Build from a clean detached worktree at the exact merge commit.
+3. Verify artifact, manifest, package closure, tests, live fixture, no-.git
+   canary, rollback archive and secret scan.
+4. Install a versioned Shadow release without changing the business runtime.
+5. Start the separate localhost-only controller with both gates false.
+6. Run Shadow candidates and freeze production PID/tag/Baseline/Registry hashes.
+7. Remove ephemeral test keys and temporary repositories.
+
+Rollback stops and disables only the Shadow controller and restores/removes its
+versioned `current` link. The existing production API, tag set, Baseline and
+Registry are not involved.
+
+## Future activation envelope
+
+Activation requires a new one-time Owner approval binding the exact controller
+commit, artifact/manifest/policy/unit hashes, trusted key IDs, KMS/secret
+references, release and rollback roots, authoritative Git/repository identity,
+Shadow candidate/evidence IDs, test results, activation plan and rollback plan.
+That approval may only flip
+`AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false` to `true`; each real release still
+requires its own signed ReleasePlan. This change does not request or consume
+that activation approval.

docs/gitops/SILENT_RELEASE_PRODUCTION_CONTRACT.md

@@ -0,0 +1,84 @@
+# Silent Release Controller Production Contract
+
+Status: review-only implementation. Production execution remains disabled.
+
+## Trust boundary
+
+The caller submits only release intent. A configured trusted builder owns ref
+validation, build, tests, artifact and manifest hashing, package closure,
+canary, rollback readiness, Git/Gitea consistency, and secret scanning. Caller
+supplied success evidence is rejected.
+
+The resulting immutable `ReleasePlan` contains deployment, tag, and
+finalization plans. One Ed25519 owner signature binds its SHA-256 digest,
+candidate evidence, policy digest, owner identity, trust domain, validity
+window, evidence lineage, and three narrow capabilities.
+
+## Durable execution
+
+The Saga journal is the source of truth. Every record is sequence-numbered and
+SHA-256 hash-chained from a fixed genesis hash. Snapshots are rebuildable
+caches. Journal corruption, truncation, reordering, missing records, or hash
+mismatch moves the release to `MANUAL_OWNER_REVIEW_REQUIRED`.
+
+Capability execution uses an exclusive, leased claim. A second worker receives
+`BUSY`; an expired claim is not reassigned until a capability-specific
+side-effect probe reports that the operation was not applied. Runtime, tag,
+and finalization remain separately claimed and recoverable.
+
+## Execution order
+
+```text
+APPROVED
+  -> PRE_SWITCH_REVALIDATING
+  -> SWITCH_PENDING
+  -> SWITCHED
+  -> RUNTIME_VERIFYING
+  -> RUNTIME_VERIFIED
+  -> TAG_PENDING
+  -> TAG_VERIFIED
+  -> BASELINE_REGISTRY_PENDING
+  -> COMPLETED
+```
+
+The actual adapter configuration is regenerated before execution and must
+match the signed plan. Trusted allowlists come from controlled policy, not the
+request.
+
+A failure before verified tag publication rolls the runtime back. A failure
+after the exact tag is verified enters `RECONCILIATION_REQUIRED`; the tag is
+never deleted or rewritten. A same-name/different-OID conflict enters
+`MANUAL_OWNER_REVIEW_REQUIRED`. Registry/Baseline finalization requires exact
+remote and Gitea tag proof, and Baseline is recorded last.
+
+## Action and recovery contract
+
+`submitOwnerApproval` verifies and durably stores the signed plan, then moves
+the Saga to `APPROVED`. `startDeployment` loads that durable approval and
+ignores caller-supplied approval content. Enabling execution without the
+trusted builder, verifier, validator, policy, and orchestrator fails during
+service construction.
+
+The recovery worker scans incomplete journals and resumes through the same
+claims and verification gates. It never automatically resumes a manual-review
+Saga. In shadow mode it only reports state and performs no adapter side
+effects.
+
+The deployed Action factory does not enable the legacy caller-evidence path.
+If the trusted builder is absent, candidate creation is rejected even while
+execution remains in shadow mode. The compatibility path exists only through
+the explicit test-only `SilentReleaseActionService.shadow()` constructor.
+
+Finalization is composed from separate `RegistryController` and
+`BaselineController` claims. Registry is verified first and Baseline is the
+last mutation; a retry reuses completed Registry evidence and never moves
+Baseline ahead of tag verification.
+
+## Governance
+
+- `force_push`: forbidden
+- `tag_rewrite`: forbidden
+- `direct_main_push`: forbidden
+- production execution default: disabled
+- production tag operations in this change: not executed
+- Baseline/Registry mutations in this change: not executed

docs/gitops/gitea-tag-publication-atomicity.md

@@ -0,0 +1,68 @@
+# Gitea Tag Publication Atomicity
+
+Release publication is a fail-closed Saga bound to one immutable governance
+fingerprint:
+
+- `version`
+- `target_oid`
+- `evidence_closure_oid`
+- `approval_plan_id`
+
+The normal progression is:
+
+`PENDING` → `LOCAL_TAG_CREATED` → `REMOTE_PUSH_CONFIRMED` →
+`GITEA_API_CONFIRMED` → `BASELINE_UPDATE_PENDING` → `BASELINE_UPDATED` →
+`PRODUCTION_DEPLOYED`
+
+An unavailable remote uses `REMOTE_PUSH_PENDING` or
+`RECONCILIATION_REQUIRED`. A same-name tag object mismatch, peeled-target
+mismatch, changed governance fingerprint, or immutable deployment-evidence
+conflict enters `MANUAL_OWNER_REVIEW_REQUIRED`. That state blocks automatic
+push and reconciliation; recovery never deletes, rewrites, or force-pushes a
+tag.
+
+## Legacy state migration
+
+Readers normalize the historical `TAG_CREATED_LOCAL` value to
+`LOCAL_TAG_CREATED` in memory. Read-only status responses therefore expose only
+the canonical value. The next governed Saga write persists the canonical name;
+reading legacy state alone does not mutate the tag, Baseline, Registry, or Saga
+file. Any unrecognized persisted state fails closed as
+`RECONCILIATION_REQUIRED`.
+
+`BASELINE_UPDATE_PENDING` is persisted before either `baseline/current.json` or
+`versions/<version>.json` changes. Recovery revalidates the governance
+fingerprint, evidence lineage, remote annotated tag, peeled target, Gitea API,
+listing, and repository identity before idempotently completing matching
+partial records. A different tag or target enters
+`MANUAL_OWNER_REVIEW_REQUIRED`.
+
+## Durable state
+
+Production writers set `AIOS_GITOPS_PUBLICATION_STATE_DIR` to storage outside
+their disposable worktree. Recreating a writer must reuse that directory.
+Worktree JSON is not the authoritative Saga store.
+
+## Deployment gate
+
+`mark_production_deployed` performs fresh Git remote, peeled-target, Gitea ref,
+Gitea tag-object, listing, repository-identity, evidence-lineage, Registry, and
+Baseline checks. Deployment is allowed only when:
+
+`Registry = Baseline = remote tag = Gitea API = expected target`
+
+Deployment evidence must be an immutable `sha256:<64 hex>` or `git:<40 hex>`
+identifier.
+
+## Read-only acceptance
+
+- `getTagPublicationStatus` reads durable Saga state.
+- `getReleaseConsistency` compares every release authority.
+- `runReleaseAcceptance` returns `accepted: true` only for `PASS`.
+
+Unavailable evidence returns `UNKNOWN` with `fail_closed: true`; it is never
+treated as acceptance.
+
+The CLI, HTTP Action, and release script all enter the same publisher core for
+evidence-lineage verification. The release script stages Registry and Baseline
+records only; durable Saga state remains outside Git.

docs/gitops/isolated-writer-path-policy-v1.md

@@ -0,0 +1,68 @@
+# Isolated Writer Exact-Path Policy V1
+
+This policy is an additional, service-owned authorization layer for
+`POST /api/commit-file`. It never expands a Token Policy V2 grant.
+
+An atomic write is permitted only when all of the following agree:
+
+1. socket peer, audience, operation, branch, base and exact path in the
+   Token Policy V2 grant;
+2. service audience, repository identity, branch, operation and exact path
+   in `AIOS_GITOPS_PATH_POLICY_FILE`;
+3. lexical path, resolved containment and symlink checks;
+4. the configured content-size and content-profile checks;
+5. operation digest, expected branch HEAD and durable operation ledger.
+
+Any failed layer returns a fail-closed policy error. Coarse `/api/file` and
+`/api/commit` routes remain forbidden.
+
+## File contract
+
+The configured path must be absolute. The parent directory must be
+`root:gitops 0750`; the regular, non-symlink file must be
+`root:gitops 0640`. JSON must use UTF-8 canonical encoding with sorted keys,
+compact separators and one trailing newline. Unknown fields, unsupported
+operations or profiles, duplicate paths, oversized policies and
+group/world-writable files are rejected during Writer startup.
+
+Example:
+
+```json
+{"allowed_branch":"patch/codex-review-test-worker-20260724","allowed_operations":{"commit_file.atomic":{"content_profile":"systemd-codex-review-worker-v1","exact_paths":["deploy/systemd/aios-codex-review-test-worker.service"],"max_content_bytes":32768}},"audience":"aios-codex-review-worker-writer.service","policy_id":"codex-review-worker-path-policy-v1","repository_identity":"aios/aios","schema_version":1}
+```
+
+The SHA-256 of the canonical policy is exposed in the isolated runtime
+status and written to the operation audit record. The request body cannot
+select or override the policy file.
+
+## Content profile
+
+`systemd-codex-review-worker-v1` is an exact, fail-closed unit grammar. The
+only sections are `[Unit]`, `[Service]` and `[Install]`. Each section has a
+directive allowlist; every single-value directive and every repeated
+`Environment`, `ReadOnlyPaths` and `ReadWritePaths` entry must match the
+governed Shadow unit contract exactly.
+
+The profile fixes the Python module
+`task_plane.workers.codex_review_test`, `User=aiman`, `Group=gitops`,
+the controlled `/usr/libexec/aios-codex-review-test-worker/current`
+working directory, all hardening switches and the three permitted
+environment variables. It grants read access only to the authoritative
+bare repository and the versioned worker artifact, and write access only
+to the worker runtime, state and cache directories.
+
+Unknown sections or directives are rejected, including lifecycle hooks,
+credential injection, environment imports, root images, bind mounts,
+capability expansion, devices, sockets and top-level writable paths. The
+parser also rejects duplicate sections, duplicate single-value directives,
+empty resets, continuation lines, CRLF, NUL, non-UTF-8 surrogate content,
+overlong lines and Unicode lookalike directive names. It does not use
+`ConfigParser(strict=False)` or silently merge repeated values.
+
+Production credentials, if later authorized, must be supplied by a
+separately governed deployment drop-in. They are not permitted in the
+source unit or this content profile.
+
+Policy changes require a separate maintenance branch and Owner-reviewed
+ordinary merge commit. A task-scoped Writer must not edit its own policy
+file.