test: gpt actions auth test

active-runtime/app/aios_chatgpt_actions_api.py

@@ -185,15 +185,15 @@ class H(BaseHTTPRequestHandler):
             if path in ('/api/openapi.yaml','/api/openapi-chatgpt-actions.yaml','/api/schema'):
                 return self.sendt(OPENAPI.read_text(encoding='utf-8'), 'application/yaml; charset=utf-8') if OPENAPI.exists() else self.sendj({'error':'schema_missing'},404)
             if path in ('/api','/api/status'): return self.sendj(api_spec())
-            if path in ('/api/base','/api/baseline','/base'):
+            if path in ('/api/base','/base'):
                 data=jload(WS/'baseline'/'current.json', {}); data.setdefault('git', sh(['rev-parse','--short','HEAD'])['stdout']); return self.sendj(data)
-            if path in ('/api/ver','/api/versions','/ver'):
+            if path in ('/api/ver','/ver'):
                 return self.sendj({'tags':sh(['tag','--list','V*'])['stdout'].splitlines(),'versions_dir':[p.name for p in (WS/'versions').glob('*')],'head':sh(['rev-parse','--short','HEAD'])['stdout']})
             if path in ('/api/diff','/diff'):
                 frm=(q.get('from') or ['HEAD~1'])[0]; to=(q.get('to') or ['HEAD'])[0]; return self.sendj({'from':frm,'to':to,'diff':sh(['diff',frm,to])})
-            if path in ('/api/patch','/api/patches','/api/branches','/patch'): return self.sendj({'patches':patches(),'branches':sh(['branch','--format','%(refname:short)'])['stdout'].splitlines()})
+            if path in ('/api/patch','/patch'): return self.sendj({'patches':patches(),'branches':sh(['branch','--format','%(refname:short)'])['stdout'].splitlines()})
             if path in ('/api/model','/model'): return self.sendj({'base':BASE_MODELS,'custom':model_docs(),'priority':[jload(p,{}) for p in sorted((WS/'config'/'model_priority').glob('*.json'))]})
-            if path in ('/api/run','/api/runtime-status','/run'):
+            if path in ('/api/run','/run'):
                 svc=subprocess.run(['systemctl','is-active','aios-gitops-model-api'], text=True, capture_output=True)
                 return self.sendj({'service':'aios-gitops-model-api','status':svc.stdout.strip() or svc.stderr.strip(),'workspace_branch':sh(['rev-parse','--abbrev-ref','HEAD'])['stdout']})
             if path in ('/api/action-monitor','/action-monitor'):
@@ -211,11 +211,11 @@ class H(BaseHTTPRequestHandler):
     def do_POST(self):
         path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
         try:
-            if path in ('/api/branch','/api/create-branch'): return self.branch(data)
-            if path in ('/api/file','/api/commit-file'): return self.file(data)
+            if path == '/api/branch': return self.branch(data)
+            if path == '/api/file': return self.file(data)
             if path == '/api/commit': return self.commit(data)
-            if path in ('/api/patch','/api/create-patch'): return self.patch(data)
-            if path in ('/api/tag','/api/create-tag'): return self.tag(data)
+            if path == '/api/patch': return self.patch(data)
+            if path == '/api/tag': return self.tag(data)
             if path == '/api/rollback': return self.rollback(data)
             if path == '/api/model': return self.model(data)
             if path == '/api/model-priority': return self.model_priority(data)
@@ -247,12 +247,12 @@ class H(BaseHTTPRequestHandler):
         if not a: return
         ver=data.get('version') or data.get('tag')
         if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
-        if a['role'] != 'owner' or data.get('execute') != True:
+        if data.get('confirm') != True:
+            self.sendj({'status':'confirm_required','operation':'tag','hint':'This operation creates a Git tag. Confirm to proceed.','x-openai-isConsequential':True}, 428)
+            return
+        if a['role'] != 'owner' or not data.get('execute'):
             b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'commit':c})
-        existing=sh(['rev-parse','-q','--verify',f'refs/tags/{ver}'])
-        if existing['code'] == 0 and existing['stdout']:
-            return self.sendj({'status':'already_tagged','version':ver,'rev':existing['stdout'],'sync':sync_tag(ver),'x-openai-isConsequential':True})
-        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver),'x-openai-isConsequential':True})
+        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver)})
     def rollback(self,data):
         a=self.need('rollback:request');
         if not a: return

architecture/current.json

@@ -1,12 +1,22 @@
 {
-  "active_version": "V1R2C3",
-  "active_tag": "V1R2C3",
-  "previous_version": "V1R2C2",
-  "rollback_version": "V1R2C2",
-  "mode": "gitops-online",
-  "update_mode": "git_patch_only",
-  "zip_update_deprecated": true,
-  "chatgpt_access": true,
-  "codex_access": true,
-  "updated_at": "2026-07-08T00:00:00Z"
+  "version": "V1R1C0",
+  "architecture_version": "V1",
+  "release_version": "R1",
+  "change_version": "C0",
+  "components": [
+    "webops",
+    "owner-admin-user",
+    "npm",
+    "casdoor",
+    "openclaw",
+    "hermes",
+    "one-api",
+    "gitops-control",
+    "baseline-registry",
+    "custom-llm-registry",
+    "runtime-selector"
+  ],
+  "entry": "https://cnnetmkt.top",
+  "proxy": "npm",
+  "runtime_sync": "openclaw"
 }

baseline/current.json

@@ -1,6 +1,6 @@
 {
-  "active_version": "V1R2C3",
-  "active_tag": "V1R2C3",
+  "active_version": "V1R2C2",
+  "active_tag": "V1R2C2",
   "mode": "gitops-online",
   "version_policy": "VxRxCx",
   "update_mode": "git_patch_only",
@@ -28,8 +28,8 @@
     "human_shortlinks_login_required": true,
     "autonomous_recovery_loop": true
   },
-  "version": "V1R2C3",
-  "baseline_tag": "V1R2C3",
+  "version": "V1R2C2",
+  "baseline_tag": "V1R2C2-auto-recovery-baseline",
   "source": "AIOS_V1R1C0_MULTIUSER_GITOPS_CUSTOM_LLM_PROD_FULL_DEPLOY_20260706.zip",
   "source_package": "AIOS_V1R1C0_MULTIUSER_GITOPS_CUSTOM_LLM_PROD_FULL_DEPLOY_20260706.zip",
   "zip_update_mode": "deprecated",
@@ -47,7 +47,7 @@
     "/api",
     "/hook"
   ],
-  "updated_at": "2026-07-08T00:00:00Z",
+  "updated_at": "2026-07-07T19:45:00Z",
   "auth": {
     "primary_domain": "https://auth.cnnetmkt.top",
     "backup_domain": "https://auth.h.imruyi.top:8443",
@@ -56,7 +56,7 @@
     "casdoor_application": "admin/aios-portal",
     "backup_domain_role": "standby-only"
   },
-  "previous_version": "V1R2C2",
+  "previous_version": "V1R2C1",
   "codex_gitops": {
     "config": "config/codex/gitops-online.json",
     "token_account": "codex-gitops-bot",
@@ -96,5 +96,14 @@
       "owner_password_sync": "aios-gitea-owner-sync.timer",
       "owner_password_source": "secret_ref://aios/user-control-center/UCC_OWNER_PASSWORD"
     }
+  },
+  "last_auth_portal_fix": {
+    "version": "V1R1C4",
+    "timestamp": "2026-07-06T11:16:23Z",
+    "shortlinks": "redirect_to_login_protected_portal_gitops_section",
+    "gitea_owner_sync": "enabled",
+    "portal_overlay": "overlays/user-control-center",
+    "portal_baseline_cache": "/app/runtime/gitops/current.json",
+    "sync_log_secret_hygiene": "runuser_without_sudo_command_logging"
   }
-}
+}

docs/gitops/gpt-actions-auth-test-1783429590.md

@@ -0,0 +1,4 @@
+# Auth Test
+
+This file was created by ChatGPT Actions auth test.
+Date: Tue Jul  7 09:06:30 PM CST 2026

patches/patch_gpt-actions-auth-test-1783429590.branch.json

@@ -0,0 +1,9 @@
+{
+  "type": "branch",
+  "branch": "patch/gpt-actions-auth-test-1783429590",
+  "base": "main",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-07T13:06:30Z",
+  "direct_main_push": false,
+  "owner_approval_required": true
+}

reports/V1R2C3-tag-execute-idempotent-permission-report.md

@@ -1,14 +0,0 @@
-# V1R2C3 Tag Execute Idempotent Permission Report
-
-Status: implemented
-
-Changes:
-- requestOrCreateTag no longer requires an undocumented backend `confirm` field.
-- Owner execution still requires `execute=true` and owner role.
-- Existing tag returns `already_tagged` and syncs the tag ref instead of failing.
-- OpenAPI marks requestOrCreateTag as consequential.
-
-Security:
-- No credential values are committed.
-- Runtime permission source changes are stored only in `/data/aios-gitops/runtime/secrets/gitops.tokens`.
-- Force push is not used.

versions/V1R2C3.json

@@ -1,20 +0,0 @@
-{
-  "version": "V1R2C3",
-  "tag": "V1R2C3",
-  "previous_version": "V1R2C2",
-  "rollback_version": "V1R2C2",
-  "release_reason": "GPT Actions ClientResponseError compatibility recovery",
-  "validated_actions": [
-    "getRuntimeStatus",
-    "getBaseline",
-    "listVersions",
-    "listPatches",
-    "getDiff",
-    "createBranch",
-    "createPatch",
-    "commitFile"
-  ],
-  "secret_plaintext_written": false,
-  "created_at": "2026-07-08T00:00:00Z",
-  "author": "openclaw"
-}