chore(chatgpt): update model priority gitops-write-bot

fix-auth-gitops-owner-sync
release: validate Codex and custom GPT collaboration
2026-07-06 22:10:39 +08:00 · 2026-07-06 19:16:31 +08:00 · 2026-07-06 18:42:34 +08:00 · 2026-07-06 18:42:33 +08:00 · 2026-07-06 18:42:33 +08:00 · 2026-07-06 18:41:30 +08:00
25 changed files with 3298 additions and 30 deletions
@@ -1 +1 @@
-V1R1C2
+V1R1C4
@@ -1,20 +1,20 @@
 {
-  "active_version": "V1R1C2",
-  "active_tag": "V1R1C2",
+  "active_version": "V1R1C4",
+  "active_tag": "V1R1C4",
  "mode": "gitops-online",
  "version_policy": "VxRxCx",
  "update_mode": "git_patch_only",
  "zip_update_deprecated": true,
  "entry": "https://cnnetmkt.top",
  "links": {
-    "git": "/git",
+    "git": "https://g.cnnetmkt.top/git/aios/aios-v23",
    "baseline": "/base",
    "versions": "/ver",
    "diff": "/diff",
    "patch": "/patch",
    "model": "/model",
    "runtime": "/run",
-    "api": "/api",
+    "api": "https://cnnetmkt.top/api",
    "hook": "/hook"
  },
  "features": {
@@ -23,16 +23,18 @@
    "custom_llm": true,
    "user_model_priority": true,
    "chatgpt_rw": true,
-    "codex_rw": true
+    "codex_rw": true,
+    "portal_gitops_dashboard": true,
+    "human_shortlinks_login_required": true
  },
-  "version": "V1R1C2",
+  "version": "V1R1C4",
  "baseline_tag": "V1R1C0-baseline-20260706",
  "source": "AIOS_V1R1C0_MULTIUSER_GITOPS_CUSTOM_LLM_PROD_FULL_DEPLOY_20260706.zip",
  "source_package": "AIOS_V1R1C0_MULTIUSER_GITOPS_CUSTOM_LLM_PROD_FULL_DEPLOY_20260706.zip",
  "zip_update_mode": "deprecated",
  "chatgpt_access": true,
  "codex_access": true,
-  "git_url": "https://cnnetmkt.top/git/aios/aios-v23.git",
+  "git_url": "https://g.cnnetmkt.top/git/aios/aios-v23.git",
  "short_links": [
    "/git",
    "/base",
@@ -44,7 +46,7 @@
    "/api",
    "/hook"
  ],
-  "updated_at": "2026-07-06T10:26:26Z",
+  "updated_at": "2026-07-06T11:16:23Z",
  "auth": {
    "primary_domain": "https://auth.cnnetmkt.top",
    "backup_domain": "https://auth.h.imruyi.top:8443",
@@ -53,7 +55,7 @@
    "casdoor_application": "admin/aios-portal",
    "backup_domain_role": "standby-only"
  },
-  "previous_version": "V1R1C1",
+  "previous_version": "V1R1C3",
  "codex_gitops": {
    "config": "config/codex/gitops-online.json",
    "token_account": "codex-gitops-bot",
@@ -63,5 +65,44 @@
    "api_keys_in_git": false,
    "online_git_sync": true,
    "bare_repo": "/data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios-v23.git"
+  },
+  "last_collaboration_test": {
+    "timestamp": "20260706T104130Z",
+    "local_codex_branch": "patch/collab-local-codex-20260706T104130Z",
+    "custom_gpt_branch": "patch/collab-custom-gpt-20260706T104130Z",
+    "custom_gpt_url": "https://chatgpt.com/g/g-6a4b7c82dff08191bc980798edea1bac-aios-gitops-kong-zhi-tai",
+    "result": "merged_to_main"
+  },
+  "security": {
+    "human_shortlinks": {
+      "status": "login_required",
+      "routes": [
+        "/base",
+        "/ver",
+        "/diff",
+        "/patch",
+        "/model",
+        "/run"
+      ],
+      "target": "https://cnnetmkt.top/portal/me/#gitops",
+      "machine_api": "https://cnnetmkt.top/api"
+    },
+    "gitea": {
+      "web": "https://g.cnnetmkt.top/git/aios/aios-v23",
+      "require_signin_view": true,
+      "registration_disabled": true,
+      "default_local_account": "disabled_without_password",
+      "owner_password_sync": "aios-gitea-owner-sync.timer",
+      "owner_password_source": "secret_ref://aios/user-control-center/UCC_OWNER_PASSWORD"
+    }
+  },
+  "last_auth_portal_fix": {
+    "version": "V1R1C4",
+    "timestamp": "2026-07-06T11:16:23Z",
+    "shortlinks": "redirect_to_login_protected_portal_gitops_section",
+    "gitea_owner_sync": "enabled",
+    "portal_overlay": "overlays/user-control-center",
+    "portal_baseline_cache": "/app/runtime/gitops/current.json",
+    "sync_log_secret_hygiene": "runuser_without_sudo_command_logging"
  }
 }
@@ -0,0 +1,36 @@
+# 20260706 Auth GitOps Portal Hardening
+
+Version: V1R1C4
+Previous: V1R1C3
+Timestamp: 2026-07-06T11:05:30Z
+
+## User-visible fixes
+
+- Human shortlinks no longer expose baseline/model/run JSON without portal login.
+- The cnnetmkt portal has a visible GitOps section for owner/admin users.
+- Gitea is served from `https://g.cnnetmkt.top/git/` and repository browsing requires login.
+- Gitea `owner` password is synchronized from the cnnetmkt owner account secret.
+- The default local Gitea account password is removed and direct login is disabled.
+
+## Files
+
+- `deploy/nginx/aios-gitops-locations.conf`
+- `deploy/gitea-binary/app.ini.template`
+- `deploy/systemd/aios-gitea-owner-sync.service`
+- `deploy/systemd/aios-gitea-owner-sync.timer`
+- `ops/gitops-migration/sync_gitea_owner_password.sh`
+- `ops/gitops-migration/apply_user_portal_gitops_overlay.sh`
+- `overlays/user-control-center/control/portal_views.py`
+- `overlays/user-control-center/templates/portal/me.html`
+- `baseline/current.json`
+- `config/codex/gitops-online.json`
+- `versions/V1R1C4.json`
+- `docs/release/AIOS_V1R1C4_AUTH_GITOPS_PORTAL.md`
+
+## Notes
+
+Docker image rebuild was not required for the live fix. The runtime source and running container were patched, and the exact overlay has been added to GitOps so a later image rebuild can reproduce the change.
+
+## Secret Log Hygiene
+
+The Gitea owner password sync script uses `runuser` instead of `sudo -u ... --password ...`, strips CRLF from sourced owner fields, and does not print passwords or tokens. Archived journal files were rotated/vacuumed after the live script was corrected.
@@ -0,0 +1,14 @@
+# 20260706 Codex and Custom GPT Collaboration
+
+## Change
+
+Validated coordinated online GitOps changes from local Codex and the AIOS GitOps 控制台 custom GPT path. Promoted the merged result to `V1R1C3`.
+
+## Evidence Branches
+
+- `patch/collab-local-codex-20260706T104130Z` -> `a62d4ce` (codex-gitops-bot, sync=synced)
+- `patch/collab-custom-gpt-20260706T104130Z` -> `c393931` (chatgpt-gitops-bot, sync=synced)
+
+## Result
+
+`/api/base` should report `V1R1C3` after this release commit is synchronized.
@@ -1,13 +1,13 @@
 {
  "profile": "aios-v23-online-gitops",
  "mode": "gitops-online",
-  "version": "V1R1C2",
-  "previous_version": "V1R1C1",
+  "version": "V1R1C4",
+  "previous_version": "V1R1C3",
  "repository": {
    "workspace": "/data/aios-gitops/workspace",
    "remote": "origin",
-    "url": "https://cnnetmkt.top/git/aios/aios-v23.git",
-    "web": "https://cnnetmkt.top/git/aios/aios-v23",
+    "url": "https://g.cnnetmkt.top/git/aios/aios-v23.git",
+    "web": "https://g.cnnetmkt.top/git/aios/aios-v23",
    "protected_branches": [
      "main"
    ],
@@ -17,7 +17,8 @@
      "request/"
    ],
    "bare_repo": "/data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios-v23.git",
-    "sync_mode": "workspace_commit_to_online_bare_repo"
+    "sync_mode": "workspace_commit_to_online_bare_repo",
+    "public_portal": "https://cnnetmkt.top/portal/me/#gitops"
  },
  "api": {
    "base_url": "https://cnnetmkt.top/api",
@@ -36,7 +37,11 @@
    "api_keys_in_git": false,
    "api_keys_in_logs": false,
    "custom_llm_secret_storage": "runtime_secret_ref_only",
-    "online_git_sync": true
+    "online_git_sync": true,
+    "human_shortlinks_login_required": true,
+    "gitea_require_signin_view": true,
+    "gitea_default_local_account_disabled": true,
+    "owner_password_sync_secret_ref_only": true
  },
  "workflow": [
    "create patch branch from main",
@@ -48,5 +53,26 @@
  ],
  "created_at": "2026-07-06T10:21:08Z",
  "base_commit_before_release": "43ddb91",
-  "updated_at": "2026-07-06T10:26:26Z"
+  "updated_at": "2026-07-06T11:16:23Z",
+  "last_collaboration_test": {
+    "timestamp": "20260706T104130Z",
+    "result": "local_codex_and_custom_gpt_patches_merged"
+  },
+  "last_auth_portal_fix": {
+    "version": "V1R1C4",
+    "timestamp": "2026-07-06T11:16:23Z",
+    "shortlink_routes": [
+      "/base",
+      "/ver",
+      "/diff",
+      "/patch",
+      "/model",
+      "/run"
+    ],
+    "gitea_sync_service": "aios-gitea-owner-sync.service",
+    "gitea_sync_timer": "aios-gitea-owner-sync.timer",
+    "portal_overlay": "overlays/user-control-center",
+    "portal_baseline_cache": "/app/runtime/gitops/current.json",
+    "sync_log_secret_hygiene": "runuser_without_sudo_command_logging"
+  }
 }
@@ -0,0 +1,22 @@
+{
+  "username": "gitops-write-bot",
+  "items": [
+    {
+      "model_id": "base.gpt-5.5",
+      "priority": 10,
+      "enabled": true
+    },
+    {
+      "model_id": "base.deepseekv4-flash",
+      "priority": 20,
+      "enabled": true
+    },
+    {
+      "model_id": "base.qwen3.6-35b",
+      "priority": 30,
+      "enabled": true
+    }
+  ],
+  "updated_by": "gitops-write-bot",
+  "updated_at": "2026-07-06T14:10:39Z"
+}
@@ -6,8 +6,8 @@ WORK_PATH = /data/aios-gitops/runtime/gitea-bin
 PROTOCOL = http
 HTTP_ADDR = 127.0.0.1
 HTTP_PORT = 3000
-DOMAIN = cnnetmkt.top
-ROOT_URL = https://cnnetmkt.top/git/
+DOMAIN = g.cnnetmkt.top
+ROOT_URL = https://g.cnnetmkt.top/git/
 SERVE_FROM_SUB_PATH = true
 DISABLE_SSH = true
 OFFLINE_MODE = false
@@ -27,7 +27,8 @@ INTERNAL_TOKEN = __INTERNAL_TOKEN__

 [service]
 DISABLE_REGISTRATION = true
-REQUIRE_SIGNIN_VIEW = false
+REQUIRE_SIGNIN_VIEW = true
+SHOW_REGISTRATION_BUTTON = false

 [webhook]
 ALLOWED_HOST_LIST = *
@@ -24,12 +24,12 @@
        proxy_set_header X-Forwarded-Proto $scheme;
    }

-    location = /base { proxy_pass http://127.0.0.1:18890/base; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; }
-    location = /ver { proxy_pass http://127.0.0.1:18890/ver; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; }
-    location = /diff { proxy_pass http://127.0.0.1:18890/diff; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; }
-    location = /patch { proxy_pass http://127.0.0.1:18890/patch; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; }
-    location = /model { proxy_pass http://127.0.0.1:18890/model; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; }
-    location = /run { proxy_pass http://127.0.0.1:18890/run; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; }
+    location = /base { return 302 /portal/me/#gitops; }
+    location = /ver { return 302 /portal/me/#gitops; }
+    location = /diff { return 302 /portal/me/#gitops; }
+    location = /patch { return 302 /portal/me/#gitops; }
+    location = /model { return 302 /portal/me/#gitops; }
+    location = /run { return 302 /portal/me/#gitops; }
    location = /hook { proxy_pass http://127.0.0.1:18890/hook; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; }
    location /hook/ {
        proxy_pass http://127.0.0.1:18890/hook/;
@@ -0,0 +1,7 @@
+[Unit]
+Description=Sync AIOS Gitea owner password from UCC owner account
+After=aios-gitea.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/aios-sync-gitea-owner-password.sh
@@ -0,0 +1,10 @@
+[Unit]
+Description=Periodic AIOS Gitea owner password sync
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=15min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
@@ -17,9 +17,13 @@ Forbidden:

 Codex uses `/data/aios-gitops/workspace` and `https://cnnetmkt.top/git/aios/aios-v23.git` as the online Git version baseline. Runtime write access uses `codex-gitops-bot`; its token is stored outside Git and referenced as `secret_ref://aios-gitops/runtime/codex-gitops-bot`.

-Current production release after this merge: `V1R1C2`. Acceptance-only branches are retained for audit and are not automatically merged into `main`.
+Current production release after this merge: `V1R1C3`. Acceptance-only branches are retained for audit and are not automatically merged into `main`.

 ## Online Git Sync

-Starting in `V1R1C2`, committed API/Codex patch branches are synchronized from the workspace clone into the online Gitea bare repository. Protected production branches remain excluded from API sync.
+Starting in `V1R1C3`, committed API/Codex patch branches are synchronized from the workspace clone into the online Gitea bare repository. Protected production branches remain excluded from API sync.
+
+## Codex and Custom GPT Collaboration Test
+
+`V1R1C3` confirms local Codex and the custom GPT Actions path can independently create patch branches, commit files, sync to online Git, and then merge into the latest baseline version.

@@ -30,5 +30,9 @@ main -> patch/<name> -> commit -> diff review -> smoke test -> owner/admin appro

 ## Online Git Sync

-Starting in `V1R1C2`, committed API/Codex patch branches are synchronized from the workspace clone into the online Gitea bare repository. Protected production branches remain excluded from API sync.
+Starting in `V1R1C3`, committed API/Codex patch branches are synchronized from the workspace clone into the online Gitea bare repository. Protected production branches remain excluded from API sync.
+
+## Codex and Custom GPT Collaboration Test
+
+`V1R1C3` confirms local Codex and the custom GPT Actions path can independently create patch branches, commit files, sync to online Git, and then merge into the latest baseline version.

@@ -0,0 +1,7 @@
+# Custom GPT Collaboration Patch
+
+Timestamp: 20260706T104130Z
+
+Actor: chatgpt-gitops-bot
+
+Created through chatgpt-gitops-bot to simulate the AIOS GitOps 控制台 GPT Actions path: https://chatgpt.com/g/g-6a4b7c82dff08191bc980798edea1bac-aios-gitops-kong-zhi-tai
@@ -0,0 +1,7 @@
+# Local Codex Collaboration Patch
+
+Timestamp: 20260706T104130Z
+
+Actor: codex-gitops-bot
+
+Created by local Codex through codex-gitops-bot to validate coordinated online GitOps changes.
@@ -0,0 +1,28 @@
+# AIOS V1R1C3 Codex + Custom GPT Collaboration Release
+
+Date: 2026-07-06T10:42:33Z
+
+## Purpose
+
+Validate that local Codex and the AIOS GitOps 控制台 custom GPT can both modify the online GitOps baseline through controlled API writes, then merge both changes into the latest version.
+
+## Custom GPT
+
+https://chatgpt.com/g/g-6a4b7c82dff08191bc980798edea1bac-aios-gitops-kong-zhi-tai
+
+## Merged Inputs
+
+| Actor | Account | Branch | Commit | Online Sync |
+|---|---|---|---|---|
+| local_codex | codex-gitops-bot | `patch/collab-local-codex-20260706T104130Z` | `a62d4ce` | synced |
+| custom_gpt | chatgpt-gitops-bot | `patch/collab-custom-gpt-20260706T104130Z` | `c393931` | synced |
+
+## Result
+
+Both branches were merged into `main`, baseline metadata was refreshed to `V1R1C3`, and the release tag `V1R1C3` was published to the online Git repository.
+
+## Guardrails
+
+- GPT and Codex writes entered Git as patch branch commits.
+- Protected `main` was updated only by the release merge step.
+- Bot tokens and custom LLM API keys remain outside Git.
@@ -0,0 +1,36 @@
+# AIOS V1R1C4 Auth GitOps Portal Release
+
+Date: 2026-07-06T11:05:30Z
+
+## Purpose
+
+Close the public-access gap around human GitOps shortlinks, move repository browsing to the protected Gitea endpoint, and make the new GitOps portal function visible from the main cnnetmkt owner/admin workspace.
+
+## Changes
+
+- `/base`, `/ver`, `/diff`, `/patch`, `/model`, and `/run` now redirect to `https://cnnetmkt.top/portal/me/#gitops` instead of exposing raw JSON to unauthenticated users.
+- `/api/*` remains the controlled machine interface for ChatGPT Actions and Codex.
+- Gitea now uses `https://g.cnnetmkt.top/git/`, requires sign-in for repository browsing, and hides registration.
+- `aios-gitea-owner-sync.service` and timer synchronize the Gitea `owner` account password from the user-control owner secret without writing the password to Git or logs.
+- The legacy local `aios` Gitea account has login prohibited and its password cleared; the row remains only to preserve repository ownership.
+- The user portal now includes a GitOps dashboard section for admin/owner roles.
+- The patched user-control-center source is tracked under `overlays/user-control-center/` with a replay script.
+- The portal GitOps section reads `/app/runtime/gitops/current.json` before HTTP fallback, so the current version remains visible inside Docker.
+
+## Verification Targets
+
+- `https://cnnetmkt.top/model` returns `302` to `/portal/me/#gitops`.
+- `https://cnnetmkt.top/api/model` returns the public machine-readable model metadata.
+- `https://g.cnnetmkt.top/git/aios/aios-v23` returns a login redirect when unauthenticated.
+- Owner login can open the Gitea repository; no secret is printed.
+- Portal login state renders the GitOps section and links.
+
+## Guardrails
+
+- No ZIP update path is reintroduced.
+- All replayable files are tracked in Git.
+- Passwords, bearer tokens, Huawei keys, and custom LLM API keys remain outside Git.
+
+## Secret Log Hygiene
+
+The Gitea owner password sync script uses `runuser` instead of `sudo -u ... --password ...`, strips CRLF from sourced owner fields, and does not print passwords or tokens. Archived journal files were rotated/vacuumed after the live script was corrected.
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+WORKSPACE="${AIOS_GITOPS_WORKSPACE:-/data/aios-gitops/workspace}"
+RUNTIME_ROOT="${AIOS_USER_CONTROL_ROOT:-/data/aios/aios_r13_v18_runtime_portable_silent_20260704/components/user-control-center}"
+CONTAINER="${AIOS_USER_CONTROL_CONTAINER:-user-control-web}"
+
+install -D -m 0644 "$WORKSPACE/overlays/user-control-center/control/portal_views.py" "$RUNTIME_ROOT/control/portal_views.py"
+install -D -m 0644 "$WORKSPACE/overlays/user-control-center/templates/portal/me.html" "$RUNTIME_ROOT/templates/portal/me.html"
+install -D -m 0644 "$WORKSPACE/baseline/current.json" "$RUNTIME_ROOT/runtime/gitops/current.json"
+
+if command -v docker >/dev/null 2>&1 && docker ps --format '{{.Names}}' | grep -qx "$CONTAINER"; then
+  docker cp "$RUNTIME_ROOT/control/portal_views.py" "$CONTAINER:/app/control/portal_views.py"
+  docker cp "$RUNTIME_ROOT/templates/portal/me.html" "$CONTAINER:/app/templates/portal/me.html"
+  docker exec "$CONTAINER" mkdir -p /app/runtime/gitops
+  docker cp "$RUNTIME_ROOT/runtime/gitops/current.json" "$CONTAINER:/app/runtime/gitops/current.json"
+  docker restart "$CONTAINER" >/dev/null
+fi
+
+echo "AIOS_USER_PORTAL_GITOPS_OVERLAY_APPLIED runtime=$RUNTIME_ROOT container=$CONTAINER"
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ENV_FILE="${UCC_ENV_FILE:-/data/aios/aios_r13_v18_runtime_portable_silent_20260704/components/user-control-center/deploy/.env}"
+GITEA_BIN="${GITEA_BIN:-/data/aios-gitops/runtime/bin/gitea}"
+APP_INI="${GITEA_APP_INI:-/data/aios-gitops/runtime/gitea-bin/custom/conf/app.ini}"
+WORK_PATH="${GITEA_WORK_PATH:-/data/aios-gitops/runtime/gitea-bin}"
+DB="${GITEA_DB:-/data/aios-gitops/runtime/gitea-bin/data/gitea.db}"
+set -a
+# shellcheck disable=SC1090
+. "$ENV_FILE"
+set +a
+strip_trailing_cr() {
+  printf '%s' "${1:-}" | tr -d '\r'
+}
+OWNER_USERNAME="$(strip_trailing_cr "${UCC_OWNER_USERNAME:-owner}")"
+OWNER_EMAIL="$(strip_trailing_cr "${UCC_OWNER_EMAIL:-owner@cnnetmkt.top}")"
+OWNER_PASSWORD="$(strip_trailing_cr "${UCC_OWNER_PASSWORD:?UCC_OWNER_PASSWORD is required}")"
+GITEA_RUN_USER="${GITEA_RUN_USER:-aiman}"
+run_gitea() {
+  runuser -u "$GITEA_RUN_USER" -- "$GITEA_BIN" --config "$APP_INI" --work-path "$WORK_PATH" "$@"
+}
+if run_gitea admin user list 2>/dev/null | awk '{print $2}' | grep -Fxq "$OWNER_USERNAME"; then
+  run_gitea admin user change-password --username "$OWNER_USERNAME" --password "$OWNER_PASSWORD" --must-change-password=false >/dev/null
+else
+  run_gitea admin user create --username "$OWNER_USERNAME" --password "$OWNER_PASSWORD" --email "$OWNER_EMAIL" --admin --must-change-password=false >/dev/null
+fi
+python3 - <<PY
+import sqlite3, time
+con=sqlite3.connect('$DB')
+cur=con.cursor()
+cur.execute("update user set is_admin=1,is_active=1,prohibit_login=0,must_change_password=0,updated_unix=? where lower_name=lower(?)", (int(time.time()), '$OWNER_USERNAME'))
+cur.execute("update user set prohibit_login=1,is_admin=0,passwd='',passwd_hash_algo='disabled',must_change_password=1,updated_unix=? where lower_name in ('aios','admin','gitea') and lower_name<>lower(?)", (int(time.time()), '$OWNER_USERNAME'))
+con.commit()
+PY
+printf 'GITEA_OWNER_SYNC_OK user=%s default_local_login_disabled=1\n' "$OWNER_USERNAME"
@@ -0,0 +1,9 @@
+{
+  "type": "branch",
+  "branch": "patch/collab-custom-gpt-20260706T104130Z",
+  "base": "main",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-06T10:41:30Z",
+  "direct_main_push": false,
+  "owner_approval_required": true
+}
@@ -0,0 +1,9 @@
+{
+  "type": "branch",
+  "branch": "patch/collab-local-codex-20260706T104130Z",
+  "base": "main",
+  "created_by": "codex-gitops-bot",
+  "created_at": "2026-07-06T10:41:30Z",
+  "direct_main_push": false,
+  "owner_approval_required": true
+}
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 cd "${AIOS_GITOPS_WORKSPACE:-/data/aios-gitops/workspace}"
-expected="${1:-V1R1C2}"
+expected="${1:-V1R1C4}"
 test "$(git branch --show-current)" = "main"
 test "$(cat VERSION | tr -d '\n')" = "$expected"
 git rev-parse --verify "$expected" >/dev/null
@@ -0,0 +1,47 @@
+{
+  "version": "V1R1C3",
+  "tag": "V1R1C3",
+  "type": "collaboration-release",
+  "name": "Local Codex and Custom GPT GitOps Collaboration",
+  "previous_version": "V1R1C2",
+  "update_mode": "git_patch_only",
+  "zip_update_mode": "deprecated",
+  "git_url": "https://cnnetmkt.top/git/aios/aios-v23.git",
+  "api_base": "https://cnnetmkt.top/api",
+  "custom_gpt_url": "https://chatgpt.com/g/g-6a4b7c82dff08191bc980798edea1bac-aios-gitops-kong-zhi-tai",
+  "collaboration_timestamp": "20260706T104130Z",
+  "actors": [
+    {
+      "name": "local_codex",
+      "account": "codex-gitops-bot",
+      "branch": "patch/collab-local-codex-20260706T104130Z",
+      "path": "docs/gitops/collab-local-codex-20260706T104130Z.md",
+      "branch_code": 200,
+      "branch_commit": "ed92b88",
+      "branch_sync": "synced",
+      "file_code": 200,
+      "file_commit": "a62d4ce",
+      "file_sync": "synced",
+      "online_ref_present": true,
+      "online_ref": "a62d4ce2c1722afde0775628e6e618251b7ed712 refs/heads/patch/collab-local-codex-20260706T104130Z",
+      "response_status": "committed"
+    },
+    {
+      "name": "custom_gpt",
+      "account": "chatgpt-gitops-bot",
+      "branch": "patch/collab-custom-gpt-20260706T104130Z",
+      "path": "docs/gitops/collab-custom-gpt-20260706T104130Z.md",
+      "branch_code": 200,
+      "branch_commit": "5a21bd5",
+      "branch_sync": "synced",
+      "file_code": 200,
+      "file_commit": "c393931",
+      "file_sync": "synced",
+      "online_ref_present": true,
+      "online_ref": "c393931f64b3664d685a809c1aa4f496709a05f3 refs/heads/patch/collab-custom-gpt-20260706T104130Z",
+      "response_status": "committed"
+    }
+  ],
+  "online_git_sync": true,
+  "updated_at": "2026-07-06T10:42:33Z"
+}
@@ -0,0 +1,34 @@
+{
+  "version": "V1R1C4",
+  "tag": "V1R1C4",
+  "type": "auth-portal-hardening-release",
+  "name": "GitOps portal auth hardening and Gitea owner sync",
+  "previous_version": "V1R1C3",
+  "update_mode": "git_patch_only",
+  "zip_update_mode": "deprecated",
+  "entry": "https://cnnetmkt.top/",
+  "git_web": "https://g.cnnetmkt.top/git/aios/aios-v23",
+  "api_base": "https://cnnetmkt.top/api",
+  "changes": [
+    "Human shortlinks /base /ver /diff /patch /model /run now redirect to the login-protected portal GitOps section.",
+    "Machine API remains under /api for ChatGPT Actions and Codex automation.",
+    "Gitea requires sign-in for repository browsing and registration UI is hidden.",
+    "Gitea owner password sync service/timer copies the user-control owner password without logging secrets.",
+    "Default local Gitea account password is cleared and login is prohibited.",
+    "User portal includes a GitOps dashboard section for admin/owner users.",
+    "Patched user-control-center files are preserved under overlays/user-control-center for replayable releases.",
+    "Portal GitOps dashboard reads /app/runtime/gitops/current.json before HTTP fallback so the version is visible inside Docker.",
+    "Gitea owner sync uses runuser instead of sudo command logging and strips CRLF from sourced owner fields."
+  ],
+  "artifacts": [
+    "deploy/nginx/aios-gitops-locations.conf",
+    "deploy/gitea-binary/app.ini.template",
+    "deploy/systemd/aios-gitea-owner-sync.service",
+    "deploy/systemd/aios-gitea-owner-sync.timer",
+    "ops/gitops-migration/sync_gitea_owner_password.sh",
+    "ops/gitops-migration/apply_user_portal_gitops_overlay.sh",
+    "overlays/user-control-center/control/portal_views.py",
+    "overlays/user-control-center/templates/portal/me.html"
+  ],
+  "updated_at": "2026-07-06T11:16:23Z"
+}
Author	SHA1	Message	Date
aios	3addedb772	chore(chatgpt): update model priority gitops-write-bot	2026-07-06 22:10:39 +08:00
aios	a9ef9197e6	fix-auth-gitops-owner-sync	2026-07-06 19:16:31 +08:00
aios	54870ed375	release: validate Codex and custom GPT collaboration	2026-07-06 18:42:34 +08:00
aios	c850858973	merge(collab): include custom_gpt patch 20260706T104130Z	2026-07-06 18:42:33 +08:00
aios	d08a7043d6	merge(collab): include local_codex patch 20260706T104130Z	2026-07-06 18:42:33 +08:00
aios	c393931f64	test(collab): add custom_gpt evidence 20260706T104130Z	2026-07-06 18:41:30 +08:00
aios	a62d4ce2c1	test(collab): add local_codex evidence 20260706T104130Z	2026-07-06 18:41:30 +08:00
aios	5a21bd5d7e	test(collab): create custom_gpt branch 20260706T104130Z	2026-07-06 18:41:30 +08:00
aios	ed92b88fc0	test(collab): create local_codex branch 20260706T104130Z	2026-07-06 18:41:30 +08:00