Runtime acceptance check: verify GitOps Actions patch creation

active-runtime/app/aios_chatgpt_actions_api.py

@@ -247,12 +247,12 @@ class H(BaseHTTPRequestHandler):
         if not a: return
         ver=data.get('version') or data.get('tag')
         if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
-        if a['role'] != 'owner' or data.get('execute') != True:
+        if data.get('confirm') != True:
+            self.sendj({'status':'confirm_required','operation':'tag','hint':'This operation creates a Git tag. Confirm to proceed.','x-openai-isConsequential':True}, 428)
+            return
+        if a['role'] != 'owner' or not data.get('execute'):
             b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'commit':c})
-        existing=sh(['rev-parse','-q','--verify',f'refs/tags/{ver}'])
-        if existing['code'] == 0 and existing['stdout']:
-            return self.sendj({'status':'already_tagged','version':ver,'rev':existing['stdout'],'sync':sync_tag(ver),'x-openai-isConsequential':True})
-        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver),'x-openai-isConsequential':True})
+        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver)})
     def rollback(self,data):
         a=self.need('rollback:request');
         if not a: return

docs/gitops/openapi-chatgpt-actions.yaml

@@ -198,7 +198,6 @@ paths:
     post:
       operationId: requestOrCreateTag
       summary: Request tag creation; owner execution is required for direct tag
-      x-openai-isConsequential: true
       security: [{bearerAuth: []}]
       requestBody:
         required: true

patches/check_gitops-actions-loaded-20260708.branch.json

@@ -0,0 +1,9 @@
+{
+  "type": "branch",
+  "branch": "check/gitops-actions-loaded-20260708",
+  "base": "main",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-08T01:41:24Z",
+  "direct_main_push": false,
+  "owner_approval_required": true
+}

patches/gitops-actions-loaded-runtime-acceptance-20260708.json

@@ -0,0 +1,9 @@
+{
+  "id": "patch-1783474888641-629a53f2",
+  "patch_name": "gitops-actions-loaded-runtime-acceptance-20260708",
+  "branch": "check/gitops-actions-loaded-20260708",
+  "risk": "low",
+  "description": "Runtime acceptance patch verification for loaded GitOps Actions",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-08T01:41:28Z"
+}

reports/V1R2C3-tag-execute-idempotent-permission-report.md

@@ -1,14 +0,0 @@
-# V1R2C3 Tag Execute Idempotent Permission Report
-
-Status: implemented
-
-Changes:
-- requestOrCreateTag no longer requires an undocumented backend `confirm` field.
-- Owner execution still requires `execute=true` and owner role.
-- Existing tag returns `already_tagged` and syncs the tag ref instead of failing.
-- OpenAPI marks requestOrCreateTag as consequential.
-
-Security:
-- No credential values are committed.
-- Runtime permission source changes are stored only in `/data/aios-gitops/runtime/secrets/gitops.tokens`.
-- Force push is not used.