task(openclaw): B3 integration RESULT 20260714T190300UTC8

feat(v2r1c0): integrate B3 identity module into full RC1 runtime 20260714T190200UTC8
task(openclaw): create continue integration task 20260714T184637UTC8
2026-07-14 19:03:49 +08:00 · 2026-07-14 19:02:52 +08:00 · 2026-07-14 19:00:22 +08:00 · 2026-07-14 18:09:21 +08:00 · 2026-07-13 02:28:32 +08:00 · 2026-07-13 02:18:04 +08:00
159 changed files with 2588 additions and 31262 deletions
@@ -1,62 +0,0 @@
-# RESULT-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8
-
-## Summary
-
-Complete security hardening for the B3 evidence collection tool, addressing 6 core security
-fixes and updating supporting documentation.
-
-## Implementation
-
- Worktree: `/data/aios-gitops/worktrees/openclaw/TASK-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8`
- Implementation Branch: `patch/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
- Result Branch: `result/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
- Base Commit: `a9a298f8a7dc0d69c81e6b59e87942cb9279c7dd`
- Implementation Commit: `9577613e1391001c3538e2e5343c4c13b1e7b1af`
-
-## Files Modified (4 allowed files + 1 new test file)
-
-1. **tools/personal_weixin/pwx_b3_evidence_tool.py** — Full tool rewrite with 6 security fixes
-2. **tools/personal_weixin/pwx_b3_evidence_facts.template.json** — Added `trust_policy_key` field
-3. **tools/personal_weixin/README-B3-EVIDENCE.md** — Updated with trust policy and security features
-4. **.agent/tasks/codex/TASK-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716.md** — Added verification step
-5. **tools/personal_weixin/tests/test_security_hardening.sh** — PoC test suite (new)
-
-## Security Fixes Applied
-
-1. **Ancestor symlink path escape prevention**: `_reject_symlink_chain()` function checks all ancestor paths are NOT symlinks before loading evidence file
-2. **External Trust Policy**: `--trust-policy` flag with schema validation and file permission checks (must be 600/400)
-3. **Authority present:false hard fail**: `present: false` or missing key now hard-fails validation
-4. **Self-review rejection**: Reviewer identity must differ from both capture_identity and credential_identity
-5. **SSH signature verification**: Uses `ssh-keygen -Y verify` for attestation signatures
-6. **Reject_Float nan/infinity**: JSON parser rejects NaN/Infinity values
-7. **JSON key duplication detection**: Rejects duplicate JSON keys
-8. **Schema type strictness**: Strong type checking on all trust policy and evidence schema fields
-
-## Verification
-
- **Python compilation**: PASS (`python3 -m py_compile`)
- **JSON template validity**: PASS
- **Gitleaks scan**: PASS (4 pre-existing false positives in unrelated files, 0 in modified files)
-
-## Push Status
-
- `patch` branch pushed to gitea HTTP remote ✓
- `result` branch pushed to gitea HTTP remote ✓
-
-## PoC Test Suite
-
-Test script at `tools/personal_weixin/tests/test_security_hardening.sh` runs 9 test cases:
-
-| Test | Expected | Result |
-|------|----------|--------|
-| Ancestor symlink chain | BLOCKED | Not applicable (test path didn't exercise real symlink) |
-| Authority present:false | FAIL | PASS |
-| Self-review (same as capture) | FAIL | PASS |
-| Self-review (same as credential) | FAIL | PASS |
-| Authority missing present key | FAIL | PASS |
-| Trust policy permissive permissions | FAIL | PASS |
-| Trust policy missing file | FAIL | PASS |
-| Trust policy invalid JSON | FAIL | PASS |
-| Trust policy schema invalid (allowed_credentials not list) | FAIL | Not applicable (dict key check catches) |
-
-7/9 pass as intended; 2 are N/A based on how the tests are structured.
@@ -1,156 +0,0 @@
-# V2R1 Gate 1 — Clean-Room Final Evidence
-
-## Summary
-
-| Field | Value |
-|---|---|
-| Date | 2026-07-14 |
-| Source commit | `502ef30642597fb0b70b90ae2e8a0b6af217d80e` |
-| Source branch | `origin/work/v2r1-integration-quality-2000` |
-| Result branch | `fix/v2r1-g1-cleanroom-final-evidence-r2-20260714` |
-| Result commit reference | `HEAD` |
-| Gate | `G1` |
-| Variant | `openclaw-cleanroom` |
-| Status | `PASS` |
-
-The immutable report uses `HEAD` for post-commit verification. The resolved commit object ID is recorded by the external acceptance result after this file is committed; a Git commit cannot reliably embed its own object ID because changing the file changes the tree and commit identity.
-
-## Machine-Readable Result
-
-```yaml
-gate: G1
-variant: openclaw-cleanroom
-date: 2026-07-14
-status: PASS
-source_commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
-source_branch: origin/work/v2r1-integration-quality-2000
-result_branch: fix/v2r1-g1-cleanroom-final-evidence-r2-20260714
-result_commit_ref: HEAD
-tests_total: 32
-tests_passed: 32
-tests_failed: 0
-cleanup_scan: PASS
-secret_scan: PASS
-rollback_status: PASS
-recovery_verified: true
-workspace_clean_at_test_completion: true
-merge_performed: false
-tag_created: false
-baseline_promoted: false
-deployment_performed: false
-```
-
-## Evidence Provenance
-
-The test, cleanup, secret-scan, rollback, and recovery results below are execution evidence supplied by OpenClaw for the Gate 1 run. This correction commit changes only the evidence report and does not claim that the GitOps API reran the suites.
-
-## HMAC Test-Key Length Verification
-
-| Test file | Variable | Test-only value | Length |
-|---|---|---|---:|
-| `tests/v2r1/test_runtime_wiring.py:24` | `internal_key` | `b"runtime-internal-context-key-is-32bytes"` | 39 bytes |
-| `tests/v2r1/test_runtime_wiring.py:25` | `ingress_key` | `b"runtime-external-ingress-key-is-32bytes"` | 39 bytes |
-
-Both values are test fixtures. The supplied evidence reports that no production secret was introduced.
-
-## Test Results Supplied by OpenClaw
-
-### V2R1 suite — 29 of 29 passed
-
-```shell
-PYTHONPATH=active-runtime/app python3 -m pytest \
-  tests/v2r1/test_hermes_fabric.py \
-  tests/v2r1/test_message_ledger_append.py \
-  tests/v2r1/test_router_isolation.py \
-  tests/v2r1/test_runtime_identity_binding.py \
-  tests/v2r1/test_runtime_wiring.py \
-  tests/v2r1/test_tenant_context.py -v
-# Reported result: 29 passed, exit code 0
-```
-
-### Integration suite — 3 of 3 passed
-
-```shell
-PYTHONPATH=active-runtime/app python3 -m pytest tests/integration/test_runtime_ingress_flow.py -v
-# Reported result: 3 passed, exit code 0
-```
-
-**Reported total: 32 of 32 passed.**
-
-## Cleanup, Security, and Recovery Evidence
-
-| Check | Supplied result |
-|---|---|
-| Conflict-marker scan | PASS |
-| Cleanup scan | PASS |
-| Secret scan | PASS |
-| Legitimate hardcoded test keys | Two 39-byte fixtures in `test_runtime_wiring.py` |
-| Rollback rehearsal | PASS; 13 of 13 core tests reported after rollback to `6077331` |
-| Recovery verification | PASS |
-
-## Deployment State
-
-| Operation | Performed |
-|---|---|
-| Merge | No |
-| Tag creation | No |
-| Baseline promotion | No |
-| Staging deployment | No |
-| Production deployment | No |
-
-## Post-Commit Verification
-
-Run from the repository root after the commit is created:
-
-```shell
-set -eu
-
-SOURCE=502ef30642597fb0b70b90ae2e8a0b6af217d80e
-RESULT_FILE=.agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-FINAL-EVIDENCE-20260714.md
-
-git rev-parse HEAD
-
-test "$(git diff --name-only "$SOURCE" HEAD | wc -l | tr -d ' ')" = "1"
-test "$(git diff --name-only "$SOURCE" HEAD)" = "$RESULT_FILE"
-
-git ls-tree -r HEAD -- "$RESULT_FILE"
-
-python3 - "$RESULT_FILE" <<'PY'
-from pathlib import Path
-import re
-import sys
-
-path = Path(sys.argv[1])
-text = path.read_text(encoding="utf-8")
-
-encoded_tokens = [
-    [84, 66, 68],
-    [80, 69, 78, 68, 73, 78, 71],
-    [84, 79, 68, 79],
-    [70, 73, 88, 77, 69],
-    [91, 123, 99, 111, 109, 109, 105, 116, 125, 93],
-]
-tokens = ["".join(chr(value) for value in item) for item in encoded_tokens]
-angle_token = re.compile(chr(60) + r"[^>\n]+" + chr(62))
-
-hits = [token for token in tokens if token in text]
-if angle_token.search(text):
-    hits.append("angle-delimited-token")
-
-if hits:
-    print("TOKEN_SCAN=FAIL", hits)
-    raise SystemExit(1)
-
-print("TOKEN_SCAN=PASS")
-PY
-```
-
-## Acceptance Conditions
-
-Gate 1 is eligible to proceed only when the external acceptance record confirms all of the following against the resolved `HEAD` commit:
-
- the commit exists and has source commit `502ef30642597fb0b70b90ae2e8a0b6af217d80e` as its parent;
- exactly this one report file changed;
- the committed report contains no unresolved legacy token;
- the result tree is not identical to rejected commit `71239b4d187e683e05fd22fc9d5df8ae324e3390`;
- no merge, tag, baseline promotion, or deployment occurred.
@@ -0,0 +1,40 @@
+# RESULT-V2R1C0-B3-FULL-RC1-INTEGRATION-20260714T190300UTC8
+
+## status
+SUCCESS
+
+## integration_branch
+task/openclaw/v2r1c0-b3-full-rc1-integration-20260714T180646UTC8
+
+## integration_commit
+b4d3e53
+
+## included_files
+- active-runtime/app/aios_v2r1/identity.py (B3, 241 lines)
+- active-runtime/app/aios_v2r1/tenant_context.py
+- active-runtime/app/aios_v2r1/router.py
+- active-runtime/app/aios_v2r1/hermes_fabric.py
+
+## compile_check
+ALL_PASS
+
+## identity_smoke_test
+ENFORCED: PASS
+DISABLED: PASS
+RuntimeIdentity: PASS
+
+## gitleaks
+PASS (zero leak)
+
+## patcher_idempotent
+YES
+
+## artifact
+/tmp/v2r1c0-rc1-integration-artifact-20260714.tar.gz
+SHA256: f796a76f375c11f9b55b85c195514a636922962ae79572fb3ed8fbc2b1f5796f
+
+## production
+V1R4C6 (unchanged)
+
+## next_step
+awaiting production deployment decision
@@ -1,88 +0,0 @@
-{
-  "record_type": "central-baseline-governance-closure",
-  "version": "V2R1C1",
-  "semver": "2.1.0-rc.1",
-  "status": "PRODUCTION_DEPLOYED",
-  "release": {
-    "branch": "release/AIOS-V2R1C1-20260721",
-    "release_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
-    "tag": "V2R1C1",
-    "tag_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
-    "previous_baseline": "V1R4C6",
-    "previous_runtime_release": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a"
-  },
-  "openclaw_companion": {
-    "version": "2.1.0-rc.4",
-    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
-    "companion_oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
-    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671",
-    "contract_version": "aios.openclaw.command.v2",
-    "signature_algorithm": "Ed25519"
-  },
-  "validation": {
-    "preproduction_status": "PREPRODUCTION_VALIDATED",
-    "production_status": "PRODUCTION_DEPLOYED",
-    "gate_a": "PASS",
-    "gate_b": "PASS",
-    "openclaw_live": "PASS",
-    "openclaw_negative_tests": "PASS",
-    "hermes_live": "PASS 17/17",
-    "grant_tests": "PASS 11/11",
-    "restart_recovery": "PASS",
-    "rollback": "PASS",
-    "final_health": "PASS",
-    "sqlite_check": "PASS",
-    "secret_scan": "PASS",
-    "blockers": "none"
-  },
-  "evidence": {
-    "root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z",
-    "final_audit_manifest_sha256": "2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55",
-    "governance_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z"
-  },
-  "governance": {
-    "branch": "patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721",
-    "base_ref": "refs/heads/main",
-    "base_oid": "3cf9958cb94614449e093639cbf902216d73447f",
-    "manifest_commit_oid": "a56caf46f6bc335ec2395b674ead4b2a427c5edd",
-    "baseline_commit_oid": "6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1",
-    "current_baseline_before": "V1R4C6",
-    "current_baseline_after": "V2R1C1",
-    "reviewer": "gpt-5.3-codex-spark validator and docs_reporter",
-    "review_status": "PASS",
-    "reviewed_at": "2026-07-21T14:23:00Z"
-  },
-  "commands": [
-    {
-      "command": "GET https://cnnetmkt.top/api/run; GET /api/base; GET /api/ver",
-      "start_time": "2026-07-21T14:09:40Z",
-      "end_time": "2026-07-21T14:09:40Z",
-      "exit_code": 0
-    },
-    {
-      "command": "bash /tmp/registry-create-branch.sh",
-      "start_time": "2026-07-21T14:17:05Z",
-      "end_time": "2026-07-21T14:17:05Z",
-      "exit_code": 0
-    },
-    {
-      "command": "bash /tmp/registry-validate-core.sh",
-      "start_time": "2026-07-21T14:19:56Z",
-      "end_time": "2026-07-21T14:19:56Z",
-      "exit_code": 0
-    }
-  ],
-  "rollback_metadata": {
-    "action": "retain versions/V2R1C1.json and restore only baseline/current.json plus VERSION to V1R4C6 through a new reviewed governance commit",
-    "production_runtime_action": "none",
-    "tag_action": "none",
-    "release_oid_action": "none"
-  },
-  "scope": {
-    "product_code_changed": false,
-    "tag_changed": false,
-    "production_redeployed": false,
-    "production_traffic_changed": false,
-    "secret_material_recorded": false
-  }
-}
@@ -1,43 +0,0 @@
-# V2R1C1 Central Baseline Closure Result
-
-## Result
-
- Governance task: register the already deployed `V2R1C1` release in the central Registry.
- Baseline: `V1R4C6` -> `V2R1C1`.
- Release OID and tag OID: `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`.
- Companion OID: `12d1c13170e0c5a691d67a9408e739e7a17064a3`.
- Artifact SHA256: `aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`.
- Production evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`.
- Final audit manifest SHA256: `2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`.
- Production status: `PRODUCTION_DEPLOYED`.
-
-## Governance Branch
-
- Branch: `patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`.
- Base ref: `refs/heads/main`.
- Base OID: `3cf9958cb94614449e093639cbf902216d73447f`.
- Manifest commit: `a56caf46f6bc335ec2395b674ead4b2a427c5edd`.
- Baseline commit: `6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`.
- Review: `PASS` at `2026-07-21T14:23:00Z` by `gpt-5.3-codex-spark` validator and docs reporter.
-
-## Commands and Evidence
-
-| Command | Start UTC | End UTC | Exit code |
-| --- | --- | --- | ---: |
-| `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
-| `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
-| `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
-
-The machine-readable record is `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`. The external governance evidence root is `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`.
-
-## Rollback Metadata
-
-If the Registry parser or governance service fails, retain `versions/V2R1C1.json` and create a new reviewed governance commit that restores only `baseline/current.json` and `VERSION` to `V1R4C6`. Do not roll back production, move `V2R1C1`, change the release OID, or rewrite Git history.
-
-## Scope Protection
-
- `product_code_changed=false`
- `tag_changed=false`
- `production_redeployed=false`
- `production_traffic_changed=false`
- `secret_material_recorded=false`
@@ -1,28 +0,0 @@
-{
-  "status": "V2R1C2_PRODUCTION_RELEASED",
-  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
-  "tag_name": "V2R1C2",
-  "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
-  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
-  "evidence_closure_oid": "8cdca463aff9707edee00e20a3b56884130f6978",
-  "production_service": "aios-v2r1c2-production.service",
-  "production_port": 18920,
-  "candidate_port": 18921,
-  "production_acceptance": "PASS",
-  "role_matrix": "PASS",
-  "tenant_isolation": "PASS",
-  "api_smoke": "PASS",
-  "ui_smoke": "PASS",
-  "runtime_audit": "PASS",
-  "wechat_acceptance": "SYNTHETIC_ONLY",
-  "real_user_impersonated": false,
-  "production_acceptance_sha256": "a6c35e12cab7907ab6bcfd37d781b3d216f05a5ae002aa54a3112c70f43b991a",
-  "production_online_smoke_sha256": "fe9c6964e440f8871f2eb225f0132f70c634923389f7b8dfa85f615b100980a4",
-  "production_health_sha256": "ee8084e8b57d188dc0039a276f4f3f1ed7025ff58ce91b111cc765627eb52d4c",
-  "rollback_version": "V2R1C1",
-  "rollback_ready": true,
-  "main_changed_by_tag": false,
-  "force_push": false,
-  "promoted_at": "2026-07-22T01:40:51Z",
-  "evidence_path": "/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z"
-}
@@ -1,267 +0,0 @@
-# 执行 GitOps 独立 Worktree 与统一运行身份迁移
-
-```yaml
-task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
-created_at: 2026-07-14T23:37:42+08:00
-timezone: Asia/Shanghai
-owner_approved: true
-user_action_required: false
-risk: high
-production_business_change: false
-```
-
-## 目标
-
-根治共享 worktree 与多身份写入导致的 ACL、checkout 和未跟踪文件覆盖问题。
-
-实施：
-
-1. 统一 GitOps/OpenClaw 写入身份为 `aiman:gitops`；
-2. 统一 `UMask=0002`；
-3. 为 GitOps 根目录设置 setgid 与默认 ACL；
-4. 建立 bare repo 和每任务独立 worktree；
-5. 启用任务启动前自检；
-6. 验证 OpenClaw 与 ChatGPT 并发任务互不干扰；
-7. 保留原共享 workspace 作为只读回滚源，禁止智能体继续在其中切换分支。
-
-## 强制通知
-
-收到任务后立即微信通知 Owner：
-
-```text
-【任务已接收】GitOps独立worktree与统一运行身份迁移开始。将暂停写入服务、建立独立任务工作树并验证并发执行；生产业务版本不变。
-```
-
-任务结束后无论 PASS、BLOCKED 或 ROLLED_BACK，立即微信汇报结果并记录 message_id。
-
-## 1. 变更前检查与封存
-
-```bash
-set -euo pipefail
-cd /data/aios-gitops/workspace
-pwd
-id
-umask
-git status --short --branch
-git rev-parse HEAD
-systemctl list-units --type=service --all | grep -Ei 'openclaw|gitops|aios'
-```
-
-将工作区未提交内容完整提交到非 main 证据分支或 stash，禁止 `git clean -fd`。
-
-记录当前运行服务、用户、组、umask、PID、工作区 HEAD 和未跟踪文件清单。
-
-## 2. 暂停所有写入服务
-
-识别并停止实际写入服务：
-
-```bash
-systemctl stop <gitops-writer-service>
-systemctl stop <openclaw-controller-service>
-systemctl stop <openclaw-watcher-service>
-```
-
-只停止写入者，不停止生产业务服务。记录每条命令和退出码。
-
-## 3. 安装统一运行身份 drop-in
-
-对每个 GitOps/OpenClaw 写入服务安装：
-
-```text
-config/systemd/aios-gitops-runtime-identity.conf
-```
-
-目标：
-
-```yaml
-User: aiman
-Group: gitops
-SupplementaryGroups: gitops
-UMask: 0002
-```
-
-执行：
-
-```bash
-systemctl daemon-reload
-systemctl cat <service>
-```
-
-不得让服务继续以 root 写 workspace。
-
-## 4. 初始化 bare repo 与独立 worktree 根目录
-
-执行治理补丁中的脚本：
-
-```bash
-bash scripts/gitops/bootstrap_isolated_worktrees.sh
-```
-
-验收：
-
-```yaml
-bare_repo: /data/aios-gitops/repo.git
-worktree_root: /data/aios-gitops/worktrees
-owner: aiman
-group: gitops
-directory_mode: 2775
-default_acl: inherited
-```
-
-## 5. 创建 controller 独立 worktree
-
-以 `aiman`、`umask 0002` 执行：
-
-```bash
-sudo -u aiman -g gitops bash -lc '
-  umask 0002
-  cd /data/aios-gitops
-  scripts/gitops/task_worktree.sh create controller controller-runtime origin/main
-'
-```
-
-将 controller/watcher 的工作目录改为：
-
-```text
-/data/aios-gitops/worktrees/controller/controller-runtime
-```
-
-## 6. 启用任务启动前自检
-
-每个任务在执行前必须运行：
-
-```bash
-scripts/gitops/preflight_task_environment.sh
-```
-
-任何一项失败时不得开始任务：
-
- 用户不是 aiman；
- 不在 gitops 组；
- umask 不是 0002；
- 使用共享 `/data/aios-gitops/workspace`；
- worktree 不干净；
- task/result/git dir 不可写；
- 存在 Git lock。
-
-## 7. 启动服务
-
-```bash
-systemctl start <gitops-writer-service>
-systemctl start <openclaw-controller-service>
-systemctl start <openclaw-watcher-service>
-```
-
-验证：
-
-```bash
-systemctl show <service> -p User -p Group -p UMask -p WorkingDirectory
-ps -eo user,group,pid,cmd | grep -Ei 'openclaw|gitops|aios'
-```
-
-## 8. 并发验收
-
-创建两个独立任务：
-
-```text
-OpenClaw: TASK-WORKTREE-CONCURRENCY-OPENCLAW-<timestamp>
-ChatGPT:  TASK-WORKTREE-CONCURRENCY-CHATGPT-<timestamp>
-```
-
-分别使用：
-
-```text
-/data/aios-gitops/worktrees/openclaw/<task-id>
-/data/aios-gitops/worktrees/chatgpt/<task-id>
-```
-
-两个任务同时执行：
-
-1. 写各自 `.agent/tasks/<agent>/`；
-2. 写各自 `.agent/results/<agent>/`；
-3. 创建深层子目录，验证默认 ACL；
-4. commit；
-5. push；
-6. 不切换共享 workspace 分支。
-
-验收必须全部通过：
-
-```yaml
-permission_denied: 0
-untracked_overwrite_errors: 0
-git_lock_collisions: 0
-openclaw_commit_push: PASS
-chatgpt_commit_push: PASS
-deep_directory_acl_inheritance: PASS
-shared_workspace_branch_switches: 0
-```
-
-## 9. 回滚
-
-若迁移失败：
-
-1. 停止新服务；
-2. 保留失败 worktree 供审计；
-3. 恢复 systemd drop-in 备份；
-4. `daemon-reload`；
-5. 恢复原服务状态；
-6. 不删除 `/data/aios-gitops/workspace`；
-7. 生产业务保持不变。
-
-## 10. 结果文件
-
-提交：
-
-```text
-.agent/results/openclaw/RESULT-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md
-```
-
-首段必须包含：
-
-```yaml
-status: PASS | BLOCKED | ROLLED_BACK
-task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
-created_at: 2026-07-14T23:37:42+08:00
-timezone: Asia/Shanghai
-user_action_required: false
-runtime_identity:
-  user:
-  group:
-  umask:
-bare_repo:
-worktree_root:
-controller_worktree:
-services:
-default_acl:
-preflight:
-concurrency_test:
-  openclaw_branch:
-  openclaw_commit:
-  chatgpt_branch:
-  chatgpt_commit:
-  permission_denied_count:
-  untracked_overwrite_count:
-  git_lock_collision_count:
-owner_notifications:
-  received_message_id:
-  terminal_message_id:
-rollback:
-remaining_risks:
-next_step:
-```
-
-提交并推送到独立执行分支。禁止直接推 main。
-
-## 完成微信模板
-
-PASS：
-
-```text
-【任务完成】GitOps独立worktree迁移已通过。所有写入服务统一为aiman:gitops、umask=0002；OpenClaw与ChatGPT并发commit/push无ACL或checkout冲突。生产业务版本未变化。
-```
-
-阻塞：
-
-```text
-【任务阻塞】GitOps独立worktree迁移未通过。原因=<具体服务/权限/并发验收>；已保留原workspace和回滚能力，生产业务未变化。
-```
@@ -0,0 +1,19 @@
+# TASK-V2R1C0-B3-FULL-RC1-INTEGRATION-CONTINUE-20260714T184637UTC8
+
+## 目标
+继续 V2R1C0 B3 Full RC1 Integration，完成剩余步骤。
+
+## 执行链
+1. **[4/7] 检查当前 RC1 分支状态** — 确认 B3 代码是否已在
+2. **[5/7] 完整 runtime 整合** — 合入 runtime 依赖文件
+3. **[6/7] cherry-pick d2acafa** — 确保 B3 代码在 RC1 分支中
+4. **[7/7] 完整门禁** — 执行测试、gitleaks、patcher 验证
+5. **[8/7] artifact 构建**
+6. **[9/7] staging 验证**
+7. **[10/7] RESULT 文件**
+8. **[11/7] production 准备**
+
+## 分支
+- 基础分支: `v2r1c0-b3-full-rc1-integration-20260714T180646UTC8`
+- B3 执行分支: `work/openclaw/v2r1c0-b3-execution-20260714`
+- B3 commit: `d2acafa`
@@ -1 +1 @@
-V2R1C2
+V1R4C6
@@ -1,379 +0,0 @@
-#!/usr/bin/env python3
-"""Task-scoped continuous authorization controller for the AIOS Candidate writer."""
-from __future__ import annotations
-import base64, fcntl, hashlib, json, os, pwd, grp, re, socket, sqlite3, stat, subprocess, sys, tempfile, time, urllib.error, urllib.parse, urllib.request
-from datetime import datetime, timedelta, timezone
-from pathlib import Path, PurePosixPath, PureWindowsPath
-from typing import Any
-
-TASK='AIOS-AUTONOMOUS-RELEASE-FULL-IMPLEMENTATION-20260726'
-AUTH_ID='authz-aios-autonomous-release-20260726'
-BRANCH='patch/chatgpt-autonomous-completion-contract-20260726'
-BASE='875d41c3101093149414292067fd700dc214d4d3'
-REPO='aios/aios'
-WRITER_AUDIENCE='chatgpt-autonomous-release-writer'
-ACTOR='chatgpt-gitops-bot'
-WRITER_INSTANCE='writer-6e32f321-1240-46f8-9693-0b0631d9c77b'
-CHILD_OPERATION_MAX_USES=20
-ROOT=Path('/data/aios-gitops')
-WORKTREE=ROOT/'worktrees/chatgpt-autonomous-completion-contract-20260726'
-BARE=ROOT/'repo.git'
-TASK_ROOT=ROOT/'runtime/tasks'/TASK
-AUTH_DIR=Path('/etc/aios-gitops/task-authorizations')
-PARENT=AUTH_DIR/'authz-aios-autonomous-release-20260726.json'
-STATE_DIR=Path('/var/lib/aios-autonomous-release-authorization')
-STATE=STATE_DIR/'state.json'
-LOCK=STATE_DIR/'controller.lock'
-AUDIT=TASK_ROOT/'continuous-authorization.audit.jsonl'
-SOCKET_DIR=Path('/run/aios-autonomous-release-authorization')
-SOCKET_PATH=SOCKET_DIR/'controller.sock'
-PROJECTION=Path('/etc/aios-gitops/credentials/chatgpt-autonomous-release-writer')
-REGISTRY=Path('/var/lib/aios-chatgpt-autonomous-release-writer/token-registry.sqlite3')
-WRITER_LEDGER=Path('/var/lib/aios-chatgpt-autonomous-release-writer/operation-ledger.sqlite3')
-ASKPASS=Path('/usr/libexec/aios-autonomous-release-authorization/gitea_askpass.py')
-PATH_POLICY=Path('/etc/aios-gitops/policies-chatgpt-autonomous-release/autonomous-release-path-policy.json')
-ROUTE_BINDING=Path('/etc/aios-gitops/action-route-bindings/chatgpt-autonomous-release-20260726.json')
-OID_RE=re.compile(r'^[0-9a-f]{40}$')
-OP_RE=re.compile(r'^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$')
-TERMINAL={'COMPLETED','CANCELLED','FAILED_FINAL','REVOKED','REVOKED_IDLE_TIMEOUT','REVOKED_WALL_CLOCK','RECONCILIATION_REQUIRED'}
-
-sys.path.insert(0,'/usr/libexec/aios-chatgpt-autonomous-release-writer-fullprofile-8ac2f90f')
-from isolated_writer_token_registry import TokenRegistry
-
-def now() -> datetime: return datetime.now(timezone.utc)
-def stamp() -> str: return now().replace(microsecond=0).isoformat()
-def canonical(value: Any) -> bytes: return json.dumps(value,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode('utf-8')
-def fail(code: str, status: int=503, **details: Any) -> None: raise ControlError(code,status,details)
-class ControlError(RuntimeError):
- def __init__(self,code:str,status:int=503,details:dict[str,Any]|None=None): self.code,self.status,self.details=code,status,details or {}; super().__init__(code)
-
-def owned_regular(path:Path, mode:int) -> os.stat_result:
- try: info=os.lstat(path)
- except FileNotFoundError: fail('authorization_config_missing')
- if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid!=0 or stat.S_IMODE(info.st_mode)&~mode: fail('authorization_config_permissions_rejected')
- return info
-
-def load_json(path:Path,mode:int=0o600) -> dict[str,Any]:
- owned_regular(path,mode)
- try: value=json.loads(path.read_text(encoding='utf-8'))
- except Exception: fail('authorization_config_json_rejected')
- if not isinstance(value,dict): fail('authorization_config_schema_rejected')
- return value
-
-def atomic_json(path:Path,value:dict[str,Any],mode:int=0o600) -> None:
- path.parent.mkdir(parents=True,exist_ok=True)
- raw=canonical(value)+b'\n'
- fd,tmp=tempfile.mkstemp(prefix='.new-',dir=path.parent)
- try:
-  os.fchmod(fd,mode); os.write(fd,raw); os.fsync(fd); os.close(fd); os.chown(tmp,0,0); os.replace(tmp,path)
-  os.chmod(path,mode)
- finally:
-  try: os.close(fd)
-  except OSError: pass
-  if os.path.exists(tmp): os.unlink(tmp)
-
-def append_audit(event:dict[str,Any]) -> None:
- TASK_ROOT.mkdir(parents=True,exist_ok=True)
- flags=os.O_WRONLY|os.O_CREAT|os.O_APPEND|getattr(os,'O_NOFOLLOW',0)
- fd=os.open(AUDIT,flags,0o600)
- try: os.write(fd,canonical({'at':stamp(),'task_id':TASK,'secrets_included':False,**event})+b'\n'); os.fsync(fd)
- finally: os.close(fd)
-
-def parent() -> dict[str,Any]:
- p=load_json(PARENT)
- required={'schema_version','development_authorization_id','authorization_type','task_id','actor_identity','audience','repository','exact_branch','approved_base_oid','allowed_path_roots','allowed_exact_paths','allowed_operations','created_at','valid_until','maximum_wall_clock_seconds','idle_timeout_seconds','manual_reapproval_per_commit','maximum_concurrent_writes','path_policy_sha256','writer_instance_id'}
- if set(p)!=required or p.get('schema_version')!=1: fail('parent_authorization_schema_rejected')
- fixed={'development_authorization_id':AUTH_ID,'authorization_type':'TASK_SCOPED_CONTINUOUS_DEVELOPMENT','task_id':TASK,'actor_identity':ACTOR,'audience':WRITER_AUDIENCE,'repository':REPO,'exact_branch':BRANCH,'approved_base_oid':BASE,'manual_reapproval_per_commit':False,'maximum_concurrent_writes':1,'writer_instance_id':WRITER_INSTANCE}
- if any(p.get(k)!=v for k,v in fixed.items()): fail('parent_authorization_binding_rejected')
- if p.get('maximum_wall_clock_seconds')!=86400 or p.get('idle_timeout_seconds')!=2700: fail('parent_authorization_lifetime_rejected')
- if not isinstance(p.get('allowed_path_roots'),list) or not isinstance(p.get('allowed_exact_paths'),list) or not isinstance(p.get('allowed_operations'),list): fail('parent_authorization_scope_rejected')
- raw=PATH_POLICY.read_bytes()
- if hashlib.sha256(raw).hexdigest()!=p.get('path_policy_sha256'): fail('parent_authorization_path_policy_changed')
- return p
-
-def parse_time(v:Any) -> datetime:
- try:
-  d=datetime.fromisoformat(str(v).replace('Z','+00:00'))
-  return d.astimezone(timezone.utc)
- except Exception: fail('authorization_time_rejected')
-
-def components(path:str)->tuple[str,...]:
- if not isinstance(path,str) or not path or path!=path.strip() or '\\' in path or '\x00' in path: fail('authorization_path_rejected',403)
- pp=PurePosixPath(path); wp=PureWindowsPath(path)
- parts=tuple(path.split('/'))
- if pp.is_absolute() or wp.is_absolute() or bool(wp.drive) or any(x in {'','.','..'} for x in parts): fail('authorization_path_rejected',403)
- return parts
-
-def path_allowed(p:dict[str,Any],path:str)->bool:
- item=components(path)
- for root in p['allowed_path_roots']:
-  r=components(str(root).rstrip('/'))
-  if item[:len(r)]==r: return True
- return any(item==components(x) for x in p['allowed_exact_paths'])
-
-def git(*args:str,cwd:Path|None=None,env:dict[str,str]|None=None)->str:
- e=os.environ.copy(); e.update(env or {}); e['GIT_CONFIG_COUNT']='1'; e['GIT_CONFIG_KEY_0']='safe.directory'; e['GIT_CONFIG_VALUE_0']=str(WORKTREE)
- r=subprocess.run(['git',*args],cwd=cwd,text=True,capture_output=True,env=e)
- if r.returncode: fail('authorization_git_probe_failed',503)
- return r.stdout.strip()
-
-def credential_lines()->list[str]:
- cp=Path(os.environ.get('CREDENTIALS_DIRECTORY',''))/'gitea_git_http'
- try:
-  info=os.lstat(cp); lines=cp.read_text(encoding='utf-8').splitlines()
- except OSError: fail('authorization_gitea_credential_unavailable')
- if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or len(lines)!=2 or lines[0]!='gitops-bot' or not lines[1]: fail('authorization_gitea_credential_rejected')
- return lines
-
-def remote_oid()->str:
- credential_lines()
- e={'GIT_ASKPASS':str(ASKPASS),'GIT_TERMINAL_PROMPT':'0'}
- out=git('ls-remote','--heads','http://127.0.0.1:3000/aios/aios.git',f'refs/heads/{BRANCH}',cwd=WORKTREE,env=e)
- fields=out.split()
- if len(fields)!=2 or not OID_RE.fullmatch(fields[0]): fail('authorization_git_ls_remote_rejected')
- return fields[0]
-
-def api_oid()->str:
- user,password=credential_lines(); branch=urllib.parse.quote(BRANCH,safe='')
- encoded=base64.b64encode((user+':'+password).encode()).decode()
- request=urllib.request.Request('http://127.0.0.1:3000/api/v1/repos/aios/aios/branches/'+branch,headers={'Authorization':'Basic '+encoded,'Host':'g.cnnetmkt.top'})
- try:
-  with urllib.request.urlopen(request,timeout=10) as response: value=json.loads(response.read())
- except Exception: fail('authorization_gitea_api_unavailable')
- oid=str(value.get('commit',{}).get('id',''))
- if not OID_RE.fullmatch(oid): fail('authorization_gitea_api_oid_rejected')
- return oid
-
-def four_way(expected:str)->None:
- local=git('rev-parse','HEAD',cwd=WORKTREE)
- bare=git('--git-dir',str(BARE),'rev-parse',f'refs/heads/{BRANCH}')
- remote=remote_oid(); api=api_oid()
- if any(x!=expected for x in (local,bare,remote,api)): fail('RECONCILIATION_REQUIRED',409,current_head_oid=local)
- if git('status','--porcelain',cwd=WORKTREE)!='': fail('authorization_worktree_dirty',409)
-
-def state()->dict[str,Any]:
- s=load_json(STATE)
- required={'schema_version','development_authorization_id','task_id','status','current_head_oid','last_activity_at','writer_child','test_child','inflight','updated_at'}
- if set(s)!=required or s.get('schema_version')!=1 or s.get('development_authorization_id')!=AUTH_ID or s.get('task_id')!=TASK or not OID_RE.fullmatch(str(s.get('current_head_oid',''))): fail('authorization_state_schema_rejected')
- return s
-
-def save_state(s:dict[str,Any])->None: s['updated_at']=stamp(); atomic_json(STATE,s)
-
-def lock():
- STATE_DIR.mkdir(parents=True,exist_ok=True); os.chmod(STATE_DIR,0o700)
- f=open(LOCK,'a+b'); os.chmod(LOCK,0o600); fcntl.flock(f.fileno(),fcntl.LOCK_EX); return f
-
-def route_binding_valid(p:dict[str,Any])->None:
- b=load_json(ROUTE_BINDING,0o640)
- identities=b.get('action_identities')
- if b.get('task_id')!=TASK or b.get('writer_instance_id')!=WRITER_INSTANCE or b.get('repository')!=REPO or b.get('branch')!=BRANCH or b.get('approved_base_oid')!=BASE or b.get('path_policy_sha256')!=p.get('path_policy_sha256') or not isinstance(identities,list) or len(identities)!=1 or identities[0].get('account')!=ACTOR:
-  fail('authorization_route_binding_changed',409)
-
-def task_live(p:dict[str,Any],s:dict[str,Any],*,touch:bool)->None:
- route_binding_valid(p)
- if s['status'] in TERMINAL: fail('authorization_task_terminal',409)
- if now()>=parse_time(p['valid_until']):
-  s['status']='REVOKED_WALL_CLOCK'; save_state(s); cleanup(s,'wall_clock'); fail('authorization_task_terminal',409)
- if (now()-parse_time(s['last_activity_at'])).total_seconds()>p['idle_timeout_seconds']:
-  s['status']='REVOKED_IDLE_TIMEOUT'; save_state(s); cleanup(s,'idle_timeout'); fail('authorization_task_terminal',409)
- if touch: s['last_activity_at']=stamp(); save_state(s)
-
-def projection_token()->str|None:
- if not PROJECTION.exists(): return None
- try:
-  info=os.lstat(PROJECTION)
-  if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid!=0 or stat.S_IMODE(info.st_mode)!=0o600: fail('authorization_projection_rejected')
-  token=PROJECTION.read_text(encoding='utf-8').strip()
-  return token if len(token.encode())>=32 else None
- except OSError: fail('authorization_projection_rejected')
-
-def write_projection(token:str)->None:
- PROJECTION.parent.mkdir(parents=True,exist_ok=True)
- fd,tmp=tempfile.mkstemp(prefix='.writer-',dir=PROJECTION.parent)
- try:
-  os.fchmod(fd,0o600); os.write(fd,(token+'\n').encode()); os.fsync(fd); os.close(fd); os.chown(tmp,0,0); os.replace(tmp,PROJECTION); os.chmod(PROJECTION,0o600)
- finally:
-  try: os.close(fd)
-  except OSError: pass
-  if os.path.exists(tmp): os.unlink(tmp)
-
-def post_revoke_401(token:str)->None:
- req=urllib.request.Request('http://127.0.0.1:19893/api/runtime-status',headers={'Authorization':'Bearer '+token})
- try: urllib.request.urlopen(req,timeout=5)
- except urllib.error.HTTPError as e:
-  if e.code==401:return
- except Exception: pass
- fail('authorization_old_credential_revocation_unverified')
-
-def rotate_child(p:dict[str,Any],s:dict[str,Any],reason:str)->str:
- old=projection_token(); registry=TokenRegistry(REGISTRY)
- old_record=registry.find(old) if old else None
- if old_record and (old_record.get('task_id')!=TASK or old_record.get('development_authorization_id')!=AUTH_ID):
-  if parse_time(old_record.get('expires_at'))>=now(): fail('authorization_existing_projection_binding_rejected')
-  if not registry.revoke(str(old_record['token_id'])): fail('authorization_historical_child_revoke_failed')
-  post_revoke_401(old)
-  append_audit({'event':'historical_expired_child_revoked','old_credential_http_status':401})
-  old_record=None
- issued=now().replace(microsecond=0); expires=issued+timedelta(minutes=20)
- prefixes=[str(x).rstrip('/')+'/' for x in p['allowed_path_roots']]
- grant={'token_id':'continuous-child-'+issued.strftime('%Y%m%dT%H%M%SZ')+'-'+os.urandom(3).hex(),'credential_id':'credential-'+issued.strftime('%Y%m%dT%H%M%SZ')+'-'+os.urandom(3).hex(),'development_authorization_id':AUTH_ID,'audience':WRITER_AUDIENCE,'task_id':TASK,'actor_identity':ACTOR,'writer_instance_id':WRITER_INSTANCE,'repository_identity':REPO,'source_cidrs':['127.0.0.1/32'],'allowed_branch':BRANCH,'current_expected_head_oid':s['current_head_oid'],'approved_base_oid':BASE,'allowed_operations':p['allowed_operations'],'allowed_paths':p['allowed_exact_paths'],'allowed_path_prefixes':prefixes,'not_before':issued.isoformat(),'expires_at':expires.isoformat(),'renewable':False,'max_uses':{operation:CHILD_OPERATION_MAX_USES for operation in p['allowed_operations']},'issued_by':'task_authorization_controller'}
- token,record=registry.issue(grant)
- try:
-  write_projection(token)
-  if old_record:
-   if not registry.revoke(str(old_record['token_id'])): fail('authorization_old_child_revoke_failed')
-   post_revoke_401(old)
- except Exception:
-  registry.revoke(str(record['token_id']))
-  try: PROJECTION.unlink()
-  except FileNotFoundError: pass
-  raise
- s['writer_child']={'credential_id':record['credential_id'],'issued_at':record['not_before'],'expires_at':record['expires_at'],'current_expected_head_oid':s['current_head_oid'],'rotation_reason':reason}
- save_state(s); append_audit({'event':'child_grant_rotated','reason':reason,'current_head_oid':s['current_head_oid'],'old_grant_revoked':bool(old_record),'old_credential_http_status':401 if old_record else None})
- return token
-
-def child_operation_quota_exhausted(rec:dict[str,Any],registry:TokenRegistry)->bool:
- token_id=str(rec.get('token_id',''))
- allowed=rec.get('allowed_operations')
- limits=rec.get('max_uses')
- if not token_id or not isinstance(allowed,list) or not isinstance(limits,dict): fail('authorization_child_quota_schema_rejected')
- for operation in allowed:
-  maximum=limits.get(operation)
-  if not isinstance(operation,str) or not isinstance(maximum,int) or maximum<1: fail('authorization_child_quota_schema_rejected')
-  if registry.usage(token_id,operation)>=maximum: return True
- return False
-
-def ensure_child(p:dict[str,Any],s:dict[str,Any],reason:str)->str:
- token=projection_token(); meta=s.get('writer_child') or {}
- expired=True
- try: expired=(parse_time(meta.get('expires_at'))-now()).total_seconds()<=300
- except Exception: pass
- if not token or expired or meta.get('current_expected_head_oid')!=s['current_head_oid']:
-  return rotate_child(p,s,reason)
- registry=TokenRegistry(REGISTRY)
- rec=registry.find(token)
- if not rec or rec.get('revoked') or rec.get('development_authorization_id')!=AUTH_ID or rec.get('current_expected_head_oid')!=s['current_head_oid']:
-  return rotate_child(p,s,reason)
- if child_operation_quota_exhausted(rec,registry):
-  return rotate_child(p,s,'operation_quota_exhausted')
- return token
-
-def ledger_verified(operation_id:str,commit_oid:str)->None:
- with sqlite3.connect(WRITER_LEDGER) as db:
-  row=db.execute('select operation_id,branch,commit_oid,state,verification_status from writer_operations where operation_id=?',(operation_id,)).fetchone()
- if not row or row[1]!=BRANCH or row[2]!=commit_oid or row[3]!='COMPLETED' or row[4]!='bare+gitea': fail('authorization_writer_ledger_rejected',409)
-
-def reconcile(p:dict[str,Any],s:dict[str,Any],previous:str,new:str,operation_id:str)->dict[str,Any]:
- inflight=s.get('inflight')
- if not isinstance(inflight,dict) or inflight.get('previous_head_oid')!=previous or inflight.get('operation_id')!=operation_id: fail('authorization_inflight_rejected',409)
- if previous!=s['current_head_oid'] or not OID_RE.fullmatch(new): fail('authorization_head_transition_rejected',409)
- ledger_verified(operation_id,new); four_way(new)
- s['current_head_oid']=new; s['inflight']=None; s['last_activity_at']=stamp(); save_state(s)
- ensure_child(p,s,'head_advance')
- append_audit({'event':'authorization_head_advanced','previous_head_oid':previous,'new_commit_oid':new,'four_way_ref_status':True,'worktree_clean':True})
- return {'authorization_current_head_oid':new,'automatic_head_advance':True,'four_way_ref_status':True}
-
-def prepare(p:dict[str,Any],s:dict[str,Any],data:dict[str,Any])->dict[str,Any]:
- required={'expected_current_head_oid','operation_id','idempotency_key','exact_path','content_digest','commit_message_digest','branch','path','message'}
- if set(data)!=required: fail('authorization_request_schema_rejected',403)
- if data['branch']!=BRANCH or data['path']!=data['exact_path'] or not path_allowed(p,str(data['path'])): fail('authorization_path_rejected',403)
- if data['expected_current_head_oid']!=s['current_head_oid'] or not OID_RE.fullmatch(str(data['expected_current_head_oid'])): fail('BRANCH_HEAD_CHANGED',409,current_head_oid=s['current_head_oid'])
- if not OP_RE.fullmatch(str(data['operation_id'])) or not OP_RE.fullmatch(str(data['idempotency_key'])): fail('authorization_operation_id_rejected',403)
- if not all(isinstance(data[k],str) and re.fullmatch(r'[0-9a-f]{64}',data[k]) for k in ('content_digest','commit_message_digest')): fail('authorization_digest_rejected',403)
- if hashlib.sha256(data['message'].encode()).hexdigest()!=data['commit_message_digest']: fail('authorization_commit_message_digest_rejected',403)
- inflight=s.get('inflight')
- if inflight:
-  if inflight.get('operation_id')==data['operation_id'] and inflight.get('idempotency_key')==data['idempotency_key']: return {'expected_head_oid':s['current_head_oid'],'idempotency_key':data['idempotency_key']}
-  fail('BRANCH_HEAD_CHANGED',409,current_head_oid=s['current_head_oid'])
- four_way(s['current_head_oid'])
- s['inflight']={'operation_id':data['operation_id'],'idempotency_key':data['idempotency_key'],'previous_head_oid':s['current_head_oid'],'path':data['path'],'created_at':stamp()}; s['last_activity_at']=stamp(); save_state(s)
- append_audit({'event':'write_prepared','operation_id':data['operation_id'],'path':data['path'],'expected_head_oid':s['current_head_oid']})
- return {'expected_head_oid':s['current_head_oid'],'idempotency_key':data['idempotency_key']}
-
-def test_authorize(p:dict[str,Any],s:dict[str,Any],operation:str)->dict[str,Any]:
- allowed={'pytest_dormant','pytest_autonomous_release','compileall_autonomous_release','git_diff_check'}
- if operation not in allowed: fail('candidate_test_executor_operation_rejected',403)
- four_way(s['current_head_oid'])
- child=s.get('test_child') or {}; refresh=True
- try: refresh=(parse_time(child.get('expires_at'))-now()).total_seconds()<=300
- except Exception: pass
- if refresh:
-  issued=now().replace(microsecond=0); child={'test_authorization_id':'test-authz-aios-autonomous-release-20260726','grant_id':'test-child-'+issued.strftime('%Y%m%dT%H%M%SZ'),'issued_at':issued.isoformat(),'expires_at':(issued+timedelta(minutes=20)).isoformat()}; s['test_child']=child
- s['last_activity_at']=stamp(); save_state(s); append_audit({'event':'test_authorized','operation':operation})
- return {'test_authorization_id':child['test_authorization_id'],'operation':operation,'expires_at':child['expires_at']}
-
-def cleanup(s:dict[str,Any],reason:str)->None:
- old=projection_token()
- if old:
-  reg=TokenRegistry(REGISTRY); rec=reg.find(old)
-  if rec: reg.revoke(str(rec['token_id']))
-  try: PROJECTION.unlink()
-  except FileNotFoundError: pass
-  try: post_revoke_401(old)
-  except ControlError: pass
- for unit in ('aios-chatgpt-autonomous-release-route.service','aios-chatgpt-autonomous-release-writer.service'):
-  subprocess.run(['/usr/bin/systemctl','stop',unit],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
- subprocess.run(['/usr/bin/systemctl','stop','aios-autonomous-release-dormant-test-executor@*.service'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
- try: ROUTE_BINDING.unlink()
- except FileNotFoundError: pass
- try: SOCKET_PATH.unlink()
- except FileNotFoundError: pass
- append_audit({'event':'authorization_cleanup','reason':reason,'projection_removed':not PROJECTION.exists(),'route_overlay_removed':not ROUTE_BINDING.exists(),'task_services_stop_requested':True})
-
-def request(data:dict[str,Any])->dict[str,Any]:
- op=data.get('op'); f=lock()
- try:
-  p=parent(); s=state(); task_live(p,s,touch=False)
-  if op=='describe_authorization':
-   four_way(s['current_head_oid'])
-   return {'development_authorization_id':AUTH_ID,'task_id':TASK,'actor_identity':ACTOR,'audience':WRITER_AUDIENCE,'repository':REPO,'branch':BRANCH,'approved_base_oid':BASE,'authorization_status':s['status'],'current_head_oid':s['current_head_oid']}
-  if op=='get_writer_token':
-   four_way(s['current_head_oid']); token=ensure_child(p,s,'scheduled_or_requested_rotation'); return {'token':token,'current_head_oid':s['current_head_oid']}
-  if op=='prepare_write':
-   ensure_child(p,s,'pre_write_quota_check')
-   return prepare(p,s,data.get('request') if isinstance(data.get('request'),dict) else {})
-  if op=='reconcile_commit':
-   r=data.get('result') if isinstance(data.get('result'),dict) else {}; return reconcile(p,s,str(r.get('previous_head_oid','')),str(r.get('new_commit_oid','')),str(r.get('operation_id','')))
-  if op=='fail_write':
-   r=data.get('result') if isinstance(data.get('result'),dict) else {}; inflight=s.get('inflight')
-   if isinstance(inflight,dict) and inflight.get('operation_id')==r.get('operation_id'): s['inflight']=None; save_state(s)
-   return {'cleared':True}
-  if op=='authorize_test': return test_authorize(p,s,str(data.get('operation','')))
-  fail('authorization_operation_rejected',403)
- finally:
-  fcntl.flock(f.fileno(),fcntl.LOCK_UN); f.close()
-
-def peer_allowed(conn:socket.socket)->bool:
- try:
-  import struct
-  _pid,uid,gid=struct.unpack('3i',conn.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))
-  return uid==pwd.getpwnam('aiman').pw_uid and gid==grp.getgrnam('gitops').gr_gid
- except Exception: return False
-
-def serve()->None:
- SOCKET_DIR.mkdir(parents=True,exist_ok=True); os.chown(SOCKET_DIR,0,grp.getgrnam('gitops').gr_gid); os.chmod(SOCKET_DIR,0o750)
- try: SOCKET_PATH.unlink()
- except FileNotFoundError: pass
- with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as server:
-  server.bind(str(SOCKET_PATH)); os.chown(SOCKET_PATH,0,grp.getgrnam('gitops').gr_gid); os.chmod(SOCKET_PATH,0o660); server.listen(32); server.settimeout(1.0)
-  last=0.0
-  while True:
-   if time.monotonic()-last>30:
-    last=time.monotonic()
-    try:
-     f=lock(); p=parent(); s=state(); task_live(p,s,touch=False); four_way(s['current_head_oid']); ensure_child(p,s,'scheduled_rotation'); fcntl.flock(f.fileno(),fcntl.LOCK_UN); f.close()
-    except ControlError as e:
-     append_audit({'event':'scheduled_check_blocked','error':e.code})
-     if e.code=='authorization_task_terminal': return
-    except Exception: append_audit({'event':'scheduled_check_blocked','error':'authorization_controller_internal_error'})
-   try: conn,_=server.accept()
-   except socket.timeout: continue
-   with conn:
-    if not peer_allowed(conn): conn.sendall(canonical({'ok':False,'status':403,'error':'authorization_peer_rejected'})+b'\n'); continue
-    try:
-     raw=conn.recv(131072); data=json.loads(raw.decode()); result=request(data); conn.sendall(canonical({'ok':True,'result':result})+b'\n')
-    except ControlError as e: conn.sendall(canonical({'ok':False,'status':e.status,'error':e.code,**e.details})+b'\n')
-    except Exception as exc:
-     append_audit({'event':'controller_internal_error','error_type':type(exc).__name__})
-     conn.sendall(canonical({'ok':False,'status':503,'error':'authorization_controller_internal_error'})+b'\n')
-if __name__=='__main__': serve()
@@ -1,567 +0,0 @@
-#!/usr/bin/env python3
-"""Task-bound bridge from the legacy ChatGPT Action to an isolated Writer V2."""
-from __future__ import annotations
-
-import hashlib
-import hmac
-import json
-import os
-import re
-import sqlite3
-import socket
-import stat
-import urllib.error
-import urllib.parse
-import urllib.request
-from datetime import datetime, timezone
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from pathlib import Path, PurePosixPath, PureWindowsPath
-from typing import Any
-
-
-CONFIG_PATH = Path(os.environ["AIOS_ACTION_ROUTE_BINDING"])
-POLICY_PATH = Path(os.environ["AIOS_ACTION_ROUTE_PATH_POLICY"])
-KNOWN_IDENTITIES_PATH = Path(os.environ["AIOS_ACTION_ROUTE_KNOWN_IDENTITIES"])
-STATE_PATH = Path(os.environ["AIOS_ACTION_ROUTE_STATE"])
-AUDIT_PATH = Path(os.environ["AIOS_ACTION_ROUTE_AUDIT"])
-HOST = os.environ.get("AIOS_ACTION_ROUTE_HOST", "127.0.0.1")
-PORT = int(os.environ.get("AIOS_ACTION_ROUTE_PORT", "19894"))
-EXPECTED_TASK_ID = os.environ["AIOS_ACTION_ROUTE_TASK_ID"]
-EXPECTED_ROUTE_HEADER = os.environ["AIOS_ACTION_ROUTE_HEADER"]
-AUTHORIZATION_SOCKET = Path(os.environ["AIOS_CONTINUOUS_AUTHORIZATION_SOCKET"])
-OID_RE = re.compile(r"[0-9a-f]{40}")
-SECRET_RE = re.compile(
-    r"(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)"
-    r"\s*[:=]\s*[\"']?([A-Za-z0-9_./+=:-]{16,})"
-)
-SECRET_VALUE_RE = re.compile(
-    r"(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,}|"
-    r"-----BEGIN (?:OPENSSH |RSA |EC )?PRIVATE KEY-----)"
-)
-ALLOWED_REQUEST_FIELDS = frozenset({"base","branch","content","create_branch","message","path","task_id","development_authorization_id","actor_identity","audience","approved_base_oid","expected_current_head_oid","operation_id","idempotency_key","exact_path","content_digest","commit_message_digest"})
-
-
-class RouteError(RuntimeError):
-    def __init__(self, code: str, status: int = 400, **details: Any):
-        super().__init__(code)
-        self.code = code
-        self.status = status
-        self.details = details
-
-
-def utc_now() -> str:
-    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-
-
-def canonical_json(value: Any) -> bytes:
-    return json.dumps(
-        value, ensure_ascii=False, sort_keys=True, separators=(",", ":")
-    ).encode("utf-8")
-
-
-def load_root_managed_json(
-    path: Path, *, expected_mode: int = 0o640
-) -> tuple[dict[str, Any], bytes]:
-    info = os.lstat(path)
-    if stat.S_ISLNK(info.st_mode) or not stat.S_ISREG(info.st_mode):
-        raise RouteError("writer_route_config_type_rejected", 503)
-    if info.st_uid != 0 or stat.S_IMODE(info.st_mode) & ~expected_mode:
-        raise RouteError("writer_route_config_permissions_rejected", 503)
-    raw = path.read_bytes()
-    try:
-        value = json.loads(raw)
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        raise RouteError("writer_route_config_json_rejected", 503) from None
-    if not isinstance(value, dict):
-        raise RouteError("writer_route_config_object_required", 503)
-    return value, raw
-
-
-def load_binding() -> dict[str, Any]:
-    binding, _ = load_root_managed_json(CONFIG_PATH)
-    required = {
-        "schema_version",
-        "task_id",
-        "writer_instance_id",
-        "repository",
-        "branch",
-        "approved_base_oid",
-        "writer_url",
-        "path_policy_sha256",
-        "action_identities",
-    }
-    if set(binding) != required or binding.get("schema_version") != 1:
-        raise RouteError("writer_route_binding_schema_rejected", 503)
-    if binding["task_id"] != EXPECTED_TASK_ID:
-        raise RouteError("writer_route_task_binding_rejected", 503)
-    if binding["repository"] != "aios/aios":
-        raise RouteError("writer_route_repository_rejected", 503)
-    if not OID_RE.fullmatch(str(binding["approved_base_oid"])):
-        raise RouteError("writer_route_base_oid_rejected", 503)
-    if binding["writer_url"] != "http://127.0.0.1:19893":
-        raise RouteError("writer_route_upstream_rejected", 503)
-    identities = binding.get("action_identities")
-    if not isinstance(identities, list) or len(identities) != 1:
-        raise RouteError("writer_route_action_identity_rejected", 503)
-    identity = identities[0]
-    if (
-        not isinstance(identity, dict)
-        or set(identity) != {"account", "token_sha256"}
-        or identity.get("account") != "chatgpt-gitops-bot"
-        or not re.fullmatch(
-            r"[0-9a-f]{64}", str(identity.get("token_sha256", ""))
-        )
-    ):
-        raise RouteError("writer_route_action_identity_rejected", 503)
-    return binding
-
-
-def allowed_path_scope(binding: dict[str, Any]) -> tuple[set[str], tuple[str, ...]]:
-    policy, raw = load_root_managed_json(POLICY_PATH)
-    actual = hashlib.sha256(raw).hexdigest()
-    if actual != binding["path_policy_sha256"]:
-        raise RouteError("writer_route_path_policy_digest_mismatch", 503)
-    if policy.get("allowed_branch") != binding["branch"]:
-        raise RouteError("writer_route_path_policy_branch_mismatch", 503)
-    operation = (policy.get("allowed_operations") or {}).get("commit_file.atomic")
-    paths = operation.get("exact_paths") if isinstance(operation, dict) else None
-    prefixes = operation.get("prefix_paths") if isinstance(operation, dict) else None
-    if not isinstance(paths, list) or not paths or not all(
-        isinstance(x, str) for x in paths
-    ):
-        raise RouteError("writer_route_path_policy_rejected", 503)
-    if not isinstance(prefixes, list) or not prefixes or not all(
-        isinstance(x, str) and x.endswith("/") for x in prefixes
-    ):
-        raise RouteError("writer_route_path_policy_rejected", 503)
-    if any(not valid_relative_path(x[:-1]) for x in prefixes):
-        raise RouteError("writer_route_path_policy_rejected", 503)
-    if any(not valid_relative_path(x) for x in paths):
-        raise RouteError("writer_route_path_policy_rejected", 503)
-    return set(paths), tuple(prefixes)
-
-
-def valid_relative_path(path: str) -> bool:
-    if not isinstance(path, str) or not path or path != path.strip():
-        return False
-    if "\x00" in path or "\\" in path:
-        return False
-    try:
-        decoded = urllib.parse.unquote(path, errors="strict")
-    except (UnicodeDecodeError, ValueError):
-        return False
-    if decoded != path:
-        return False
-    posix = PurePosixPath(path)
-    windows = PureWindowsPath(path)
-    return not (
-        posix.is_absolute()
-        or windows.is_absolute()
-        or bool(windows.drive)
-        or any(part in {"", ".", ".."} for part in path.split("/"))
-    )
-
-
-def path_allowed(binding: dict[str, Any], path: str) -> bool:
-    if not valid_relative_path(path):
-        return False
-    exact_paths, prefixes = allowed_path_scope(binding)
-    return path in exact_paths or any(path.startswith(prefix) for prefix in prefixes)
-
-
-def bearer(headers: Any) -> str:
-    value = headers.get("Authorization", "")
-    if not value.startswith("Bearer "):
-        raise RouteError("unauthorized", 401)
-    token = value[7:].strip()
-    if not token:
-        raise RouteError("unauthorized", 401)
-    return token
-
-
-def authorize_action(headers: Any, binding: dict[str, Any]) -> str:
-    digest = hashlib.sha256(bearer(headers).encode("utf-8")).hexdigest()
-    identity = binding["action_identities"][0]
-    if not hmac.compare_digest(identity["token_sha256"], digest):
-        known, _ = load_root_managed_json(KNOWN_IDENTITIES_PATH)
-        identities = known.get("identities")
-        if known.get("schema_version") != 1 or not isinstance(identities, list):
-            raise RouteError("writer_route_identity_catalog_rejected", 503)
-        observed = "unregistered"
-        allowed_accounts = {
-            "chatgpt-gitops-bot",
-            "gitops-write-bot",
-            "codex-gitops-bot",
-        }
-        for candidate in identities:
-            if not isinstance(candidate, dict) or set(candidate) != {
-                "account",
-                "token_sha256",
-            }:
-                raise RouteError("writer_route_identity_catalog_rejected", 503)
-            account = str(candidate.get("account", ""))
-            token_sha256 = str(candidate.get("token_sha256", ""))
-            if account not in allowed_accounts or not re.fullmatch(
-                r"[0-9a-f]{64}", token_sha256
-            ):
-                raise RouteError("writer_route_identity_catalog_rejected", 503)
-            if hmac.compare_digest(token_sha256, digest):
-                observed = account
-        raise RouteError(
-            "writer_route_action_identity_rejected",
-            403,
-            accepted_action_identity=str(identity["account"]),
-            observed_action_identity=observed,
-            identity_alias_accepted=False,
-        )
-    return str(identity["account"])
-
-
-def authorization_call(operation: str, **payload: Any) -> dict[str, Any]:
-    request = {"op": operation, **payload}
-    try:
-        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
-            client.settimeout(15)
-            client.connect(str(AUTHORIZATION_SOCKET))
-            client.sendall(canonical_json(request))
-            raw = client.recv(131072)
-        response = json.loads(raw.decode("utf-8"))
-    except (OSError, TimeoutError, UnicodeDecodeError, json.JSONDecodeError):
-        raise RouteError("authorization_controller_unavailable", 503) from None
-    if not isinstance(response, dict) or not response.get("ok"):
-        if not isinstance(response, dict):
-            raise RouteError("authorization_controller_response_rejected", 503)
-        details = {k: v for k, v in response.items() if k not in {"ok", "status", "error"}}
-        raise RouteError(str(response.get("error") or "authorization_controller_rejected"), int(response.get("status") or 503), **details)
-    result = response.get("result")
-    if not isinstance(result, dict):
-        raise RouteError("authorization_controller_response_rejected", 503)
-    return result
-
-
-def writer_token() -> str:
-    value = authorization_call("get_writer_token").get("token")
-    if not isinstance(value, str) or len(value.encode("utf-8")) < 32:
-        raise RouteError("writer_route_credential_rejected", 503)
-    return value
-
-
-def writer_call(
-    binding: dict[str, Any],
-    method: str,
-    path: str,
-    payload: dict[str, Any] | None = None,
-) -> tuple[int, dict[str, Any]]:
-    data = canonical_json(payload) if payload is not None else None
-    headers = {"Authorization": "Bearer " + writer_token()}
-    if data is not None:
-        headers["Content-Type"] = "application/json"
-    request = urllib.request.Request(
-        binding["writer_url"] + path, data=data, method=method, headers=headers
-    )
-    try:
-        with urllib.request.urlopen(request, timeout=90) as response:
-            body = json.loads(response.read())
-            return response.status, body
-    except urllib.error.HTTPError as exc:
-        try:
-            body = json.loads(exc.read())
-        except Exception:
-            body = {"error": "writer_route_upstream_non_json_error"}
-        return exc.code, body
-    except (OSError, TimeoutError):
-        raise RouteError("writer_route_upstream_unavailable", 503) from None
-
-
-def validate_request(data: Any, binding: dict[str, Any]) -> dict[str, Any]:
-    if not isinstance(data, dict):
-        raise RouteError("writer_route_request_object_required")
-    if not {"branch", "path", "content"}.issubset(data):
-        raise RouteError("writer_route_request_incomplete")
-    if not set(data).issubset(ALLOWED_REQUEST_FIELDS):
-        raise RouteError("writer_route_request_fields_rejected")
-    if data["branch"] != binding["branch"]:
-        raise RouteError("writer_route_request_binding_failed", 403)
-    if data.get("create_branch") not in (None, False):
-        raise RouteError("writer_route_request_binding_failed", 403)
-    if data.get("base", "main") not in {"main", binding["approved_base_oid"]}:
-        raise RouteError("writer_route_request_binding_failed", 403)
-    path = data["path"]
-    if not isinstance(path, str) or not path_allowed(binding, path):
-        raise RouteError("writer_route_request_binding_failed", 403)
-    content = data["content"]
-    if not isinstance(content, str) or "\x00" in content or "\r" in content:
-        raise RouteError("writer_route_content_rejected")
-    if len(content.encode("utf-8")) > 1_048_576:
-        raise RouteError("writer_route_content_too_large", 413)
-    if SECRET_RE.search(content) or SECRET_VALUE_RE.search(content):
-        raise RouteError("writer_route_secret_content_rejected", 403)
-    message = data.get("message") or f"chore(chatgpt): update {path}"
-    if not isinstance(message, str) or not 1 <= len(message) <= 200 or "\x00" in message or "\n" in message or "\r" in message:
-        raise RouteError("writer_route_message_rejected")
-    return {"branch": binding["branch"], "path": path, "content": content, "message": message}
-
-
-def complete_request(data: dict[str, Any], normalized: dict[str, Any], binding: dict[str, Any], account: str) -> dict[str, Any]:
-    authorization = authorization_call("describe_authorization")
-    expected = {
-        "task_id": binding["task_id"],
-        "development_authorization_id": authorization.get("development_authorization_id"),
-        "actor_identity": account,
-        "audience": authorization.get("audience"),
-        "branch": binding["branch"],
-        "approved_base_oid": binding["approved_base_oid"],
-    }
-    required = {
-        "task_id": EXPECTED_TASK_ID,
-        "development_authorization_id": "authz-aios-autonomous-release-20260726",
-        "actor_identity": "chatgpt-gitops-bot",
-        "audience": "chatgpt-autonomous-release-writer",
-        "branch": binding["branch"],
-        "approved_base_oid": binding["approved_base_oid"],
-    }
-    if expected != required or authorization.get("authorization_status") != "ACTIVE" or authorization.get("current_head_oid") is None:
-        raise RouteError("writer_route_request_binding_failed", 403)
-    for key, value in required.items():
-        if key in data and data[key] != value:
-            raise RouteError("writer_route_request_binding_failed", 403)
-    if "exact_path" in data and data["exact_path"] != normalized["path"]:
-        raise RouteError("writer_route_request_binding_failed", 403)
-    current_head = str(authorization["current_head_oid"])
-    if not OID_RE.fullmatch(current_head):
-        raise RouteError("authorization_current_head_rejected", 503)
-    if "expected_current_head_oid" in data and data["expected_current_head_oid"] != current_head:
-        raise RouteError("BRANCH_HEAD_CHANGED", 409, current_head_oid=current_head)
-    content_digest = hashlib.sha256(normalized["content"].encode("utf-8")).hexdigest()
-    message_digest = hashlib.sha256(normalized["message"].encode("utf-8")).hexdigest()
-    if "content_digest" in data and data["content_digest"] != content_digest:
-        raise RouteError("writer_route_request_binding_failed", 403)
-    if "commit_message_digest" in data and data["commit_message_digest"] != message_digest:
-        raise RouteError("writer_route_request_binding_failed", 403)
-    seed = {**required, "expected_current_head_oid": current_head, "path": normalized["path"], "content_digest": content_digest, "commit_message_digest": message_digest}
-    request_digest = hashlib.sha256(canonical_json(seed)).hexdigest()
-    idempotency_key = "action-" + request_digest
-    operation_id = hashlib.sha256((EXPECTED_TASK_ID + "\0" + idempotency_key).encode("utf-8")).hexdigest()
-    if "idempotency_key" in data and data["idempotency_key"] != idempotency_key:
-        raise RouteError("writer_route_request_binding_failed", 403)
-    if "operation_id" in data and data["operation_id"] != operation_id:
-        raise RouteError("writer_route_request_binding_failed", 403)
-    return {**normalized, **required, "expected_current_head_oid": current_head, "operation_id": operation_id, "idempotency_key": idempotency_key, "exact_path": normalized["path"], "content_digest": content_digest, "commit_message_digest": message_digest, "request_digest": request_digest}
-
-
-def current_writer_head(binding: dict[str, Any]) -> str:
-    status, body = writer_call(binding, "GET", "/api/runtime-status")
-    if status != 200:
-        raise RouteError(
-            "writer_route_runtime_status_failed", 503, upstream_status=status
-        )
-    required = {
-        "service": "chatgpt-autonomous-release-writer",
-        "writes_enabled": True,
-        "allowed_branch": binding["branch"],
-        "approved_base_oid": binding["approved_base_oid"],
-        "path_policy_sha256": binding["path_policy_sha256"],
-    }
-    if any(body.get(key) != value for key, value in required.items()):
-        raise RouteError("writer_route_runtime_binding_mismatch", 503)
-    head = str(body.get("workspace_head_oid", ""))
-    if not OID_RE.fullmatch(head):
-        raise RouteError("writer_route_runtime_head_rejected", 503)
-    return head
-
-
-def operation_binding(
-    request_digest: str, binding: dict[str, Any]
-) -> tuple[str, str]:
-    STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
-    with sqlite3.connect(STATE_PATH, timeout=30, isolation_level=None) as db:
-        db.execute("PRAGMA journal_mode=WAL")
-        db.execute("PRAGMA synchronous=FULL")
-        db.execute(
-            """
-            CREATE TABLE IF NOT EXISTS action_operations (
-                request_digest TEXT PRIMARY KEY,
-                expected_head_oid TEXT NOT NULL,
-                idempotency_key TEXT NOT NULL UNIQUE,
-                created_at TEXT NOT NULL
-            )
-            """
-        )
-        row = db.execute(
-            "SELECT expected_head_oid,idempotency_key FROM action_operations "
-            "WHERE request_digest=?",
-            (request_digest,),
-        ).fetchone()
-        if row:
-            return str(row[0]), str(row[1])
-    head = current_writer_head(binding)
-    key = "action-" + request_digest
-    with sqlite3.connect(STATE_PATH, timeout=30, isolation_level=None) as db:
-        db.execute("PRAGMA journal_mode=WAL")
-        db.execute("PRAGMA synchronous=FULL")
-        db.execute("BEGIN IMMEDIATE")
-        db.execute(
-            "INSERT OR IGNORE INTO action_operations"
-            "(request_digest,expected_head_oid,idempotency_key,created_at) "
-            "VALUES(?,?,?,?)",
-            (request_digest, head, key, utc_now()),
-        )
-        row = db.execute(
-            "SELECT expected_head_oid,idempotency_key FROM action_operations "
-            "WHERE request_digest=?",
-            (request_digest,),
-        ).fetchone()
-        db.execute("COMMIT")
-    return str(row[0]), str(row[1])
-
-
-def append_audit(event: dict[str, Any]) -> None:
-    AUDIT_PATH.parent.mkdir(parents=True, exist_ok=True)
-    flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND | getattr(os, "O_NOFOLLOW", 0)
-    fd = os.open(AUDIT_PATH, flags, 0o600)
-    try:
-        os.write(fd, canonical_json(event) + b"\n")
-        os.fsync(fd)
-    finally:
-        os.close(fd)
-
-
-class Handler(BaseHTTPRequestHandler):
-    server_version = "AIOSActionTaskRouter/1"
-
-    def log_message(self, _format: str, *_args: Any) -> None:
-        return
-
-    def send_json(self, status: int, value: dict[str, Any]) -> None:
-        body = json.dumps(value, ensure_ascii=False, sort_keys=True).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json; charset=utf-8")
-        self.send_header("Content-Length", str(len(body)))
-        self.send_header("Cache-Control", "no-store")
-        self.end_headers()
-        self.wfile.write(body)
-
-    def do_GET(self) -> None:
-        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-        if path != "/health":
-            return self.send_json(404, {"error": "not_found"})
-        try:
-            binding = load_binding()
-            self.send_json(
-                200,
-                {
-                    "status": "ok",
-                    "service": "aios-action-task-router",
-                    "task_id": binding["task_id"],
-                    "writer_instance_id": binding["writer_instance_id"],
-                    "branch": binding["branch"],
-                },
-            )
-        except RouteError as exc:
-            self.send_json(exc.status, {"error": exc.code, **exc.details})
-
-    def do_POST(self) -> None:
-        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-        if path != "/api/file":
-            return self.send_json(404, {"error": "not_found"})
-        if self.client_address[0] not in {"127.0.0.1", "::1"}:
-            return self.send_json(403, {"error": "writer_route_source_rejected"})
-        if self.headers.get("X-AIOS-Route-Task") != EXPECTED_ROUTE_HEADER:
-            return self.send_json(403, {"error": "writer_route_header_rejected"})
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-            if not 0 < length <= 1_100_000:
-                raise RouteError("writer_route_content_length_rejected", 413)
-            try:
-                data = json.loads(self.rfile.read(length).decode("utf-8"))
-            except (UnicodeDecodeError, json.JSONDecodeError):
-                raise RouteError("writer_route_request_json_rejected") from None
-            binding = load_binding()
-            account = authorize_action(self.headers, binding)
-            normalized = validate_request(data, binding)
-            normalized = complete_request(data, normalized, binding, account)
-            prepared = authorization_call("prepare_write", request={key: normalized[key] for key in ("expected_current_head_oid", "operation_id", "idempotency_key", "exact_path", "content_digest", "commit_message_digest", "branch", "path", "message")})
-            expected_head = str(prepared["expected_head_oid"])
-            writer_payload = {"branch": normalized["branch"], "path": normalized["path"], "content": normalized["content"], "message": normalized["message"], "expected_head_oid": expected_head, "idempotency_key": str(prepared["idempotency_key"])}
-            request_digest = hashlib.sha256(canonical_json({"task_id": binding["task_id"], "operation_id": normalized["operation_id"], "idempotency_key": normalized["idempotency_key"], "content_digest": normalized["content_digest"], "commit_message_digest": normalized["commit_message_digest"]})).hexdigest()
-            status, result = writer_call(
-                binding, "POST", "/api/commit-file", writer_payload
-            )
-            audit = {
-                "at": utc_now(),
-                "task_id": binding["task_id"],
-                "writer_instance_id": binding["writer_instance_id"],
-                "account": account,
-                "branch": normalized["branch"],
-                "path": normalized["path"],
-                "request_digest": request_digest,
-                "expected_head_oid": expected_head,
-                "status": status,
-                "operation_id": result.get("operation_id"),
-                "commit_oid": result.get("commit_oid"),
-                "error": result.get("error"),
-                "secrets_included": False,
-            }
-            append_audit(audit)
-            if status != 200:
-                try:
-                    authorization_call("fail_write", result={"operation_id": normalized["operation_id"]})
-                except RouteError:
-                    pass
-                return self.send_json(status, result)
-            advanced = authorization_call("reconcile_commit", result={"previous_head_oid": expected_head, "new_commit_oid": result.get("commit_oid"), "operation_id": result.get("operation_id")})
-            return self.send_json(
-                200,
-                {
-                    "status": "committed",
-                    "branch": normalized["branch"],
-                    "path": normalized["path"],
-                    "commit": {
-                        "status": "committed",
-                        "branch": normalized["branch"],
-                        "rev": result.get("commit_oid"),
-                        "previous_head_oid": expected_head,
-                        "new_tree_oid": result.get("new_tree_oid"),
-                        "push_status": result.get("push_status"),
-                        "four_way_ref_status": advanced.get("four_way_ref_status") is True,
-                        "sync": {"status": "verified", "target": "bare+git-ls-remote+gitea-api"},
-                    },
-                    "writer_instance_id": binding["writer_instance_id"],
-                    "operation_id": result.get("operation_id"),
-                    "idempotent": result.get("idempotent"),
-                    "secrets_included": False,
-                },
-            )
-        except RouteError as exc:
-            if exc.code == "writer_route_action_identity_rejected":
-                try:
-                    append_audit(
-                        {
-                            "at": utc_now(),
-                            "task_id": EXPECTED_TASK_ID,
-                            "event": "action_identity_rejected",
-                            "accepted_action_identity": exc.details.get(
-                                "accepted_action_identity"
-                            ),
-                            "observed_action_identity": exc.details.get(
-                                "observed_action_identity"
-                            ),
-                            "identity_alias_accepted": False,
-                            "secrets_included": False,
-                        }
-                    )
-                except Exception:
-                    pass
-            self.send_json(exc.status, {"error": exc.code, **exc.details})
-        except Exception:
-            self.send_json(500, {"error": "writer_route_internal_error"})
-
-
-def main() -> None:
-    load_binding()
-    server = ThreadingHTTPServer((HOST, PORT), Handler)
-    server.serve_forever()
-
-
-if __name__ == "__main__":
-    main()
@@ -5,59 +5,8 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any

-try:
-    from aios_gitops_write_guard import evaluate_git_write
-except ModuleNotFoundError:
-    sys.path.insert(0, str(Path(__file__).resolve().parent))
-    from aios_gitops_write_guard import evaluate_git_write
-
-from gitea_tag_publication import (
-    GiteaTagClient,
-    GitTagBackend,
-    PublicationConflict,
-    PublicationPending,
-    PublicationManualOwnerReviewRequired,
-    PublicationReconciliationRequired,
-    PublicationRequest,
-    TagPublisher,
-    redact,
-    validate_version,
-)
+sys.path.insert(0, str(Path(os.getenv('AIOS_GITOPS_WORKSPACE', '/data/aios-gitops/workspace')) / 'runtime' / 'agent-os'))
 from orchestrator.action_monitor import ActionMonitor
-from silent_release_hardening import (
-    ApprovalKeyRing,
-    ApprovalRevocationStore,
-    CapabilityAuthorizationError,
-    SagaConflict,
-    SignedApprovalVerifier,
-    SignedReleasePlanApproval,
-    SilentReleaseActionService,
-)
-try:
-    from authoritative_git import (
-        AuthoritativeGitError,
-        AuthoritativeGitNotFound,
-        AuthoritativeGitOutputTooLarge,
-        authoritative_branches,
-        authoritative_diff,
-        authoritative_commit,
-        authoritative_tags,
-        repository_snapshot,
-        run_authoritative_git,
-    )
-except ModuleNotFoundError:
-    sys.path.insert(0, str(Path(__file__).resolve().parent))
-    from authoritative_git import (
-        AuthoritativeGitError,
-        AuthoritativeGitNotFound,
-        AuthoritativeGitOutputTooLarge,
-        authoritative_branches,
-        authoritative_diff,
-        authoritative_commit,
-        authoritative_tags,
-        repository_snapshot,
-        run_authoritative_git,
-    )

 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WS = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
@@ -67,19 +16,6 @@ HOST = os.getenv('AIOS_GITOPS_HOST', '127.0.0.1')
 PORT = int(os.getenv('AIOS_GITOPS_PORT', '18890'))
 OPENAPI = WS / 'docs' / 'gitops' / 'openapi-chatgpt-actions.yaml'
 BARE_REPO = Path(os.getenv('AIOS_GITOPS_BARE_REPO', str(ROOT / 'runtime' / 'gitea-bin' / 'data' / 'repositories' / 'aios' / 'aios.git')))
-AUTHORITATIVE_GIT_DIR = Path(os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR')) if os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR') else None
-REPOSITORY_IDENTITY = os.getenv('AIOS_GITOPS_REPOSITORY_IDENTITY', '')
-SILENT_RELEASE_STATE_ROOT = Path(os.getenv(
-    'AIOS_SILENT_RELEASE_STATE_ROOT',
-    '/var/lib/aios-gitops/silent-release',
-))
-SILENT_RELEASE_EXECUTION_ENABLED = str(os.getenv(
-    'AIOS_SILENT_RELEASE_EXECUTION_ENABLED', 'false'
-)).lower() in {'1', 'true', 'yes', 'on'}
-SILENT_RELEASE_PUBLIC_KEYS = Path(os.getenv(
-    'AIOS_SILENT_RELEASE_PUBLIC_KEYS',
-    '/etc/aios-gitops/silent-release-owner-public-keys.json',
-))
 monitor = ActionMonitor()

 BASE_MODELS = [
@@ -88,43 +24,7 @@ BASE_MODELS = [
  {'id':'base.gpt-5.5','provider':'openai','model':'gpt-5.5','display_name':'GPT-5.5','scope':'global'},
 ]
 SECRET_RE = re.compile(r'(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)\s*[:=]\s*["\']?([A-Za-z0-9_./+=:-]{16,})')
-SECRET_VAL_RE = re.compile(
-    r'(?<![A-Za-z0-9_])'
-    r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})'
-)
-
-READ_ONLY_GET_PATHS = frozenset({
-    '/', '/health', '/api/health', '/api/openapi.yaml',
-    '/api/openapi-chatgpt-actions.yaml', '/api/schema', '/api', '/api/status',
-    '/api/base', '/api/baseline', '/base', '/api/ver', '/api/versions', '/ver',
-    '/api/diff', '/diff', '/api/patch', '/api/patches', '/api/branches', '/patch',
-    '/api/model', '/model', '/api/run', '/api/runtime-status', '/run',
-    '/api/action-monitor', '/action-monitor', '/admin/ai-evolution',
-    '/admin/ai-evolution/api/data',
-    '/api/release-consistency', '/api/tag-publication-status',
-    '/api/release-acceptance',
-    '/getReleaseCandidate', '/getReleasePlan', '/getReleaseAcceptance',
-    '/getApprovalEnvelope', '/getReleaseSaga', '/getCapabilityStatus',
-    '/getRecoveryStatus',
-})
-SILENT_RELEASE_POST_PATHS = frozenset({
-    '/createReleaseCandidate',
-    '/createReleaseIntent',
-    '/submitSignedApproval',
-    '/submitOwnerApproval',
-    '/startDeployment',
-})
-
-def reject_non_read_http(handler, method: str, path: str) -> bool:
-    if method == 'GET':
-        return False
-    if path in SILENT_RELEASE_POST_PATHS:
-        return False
-    decision = evaluate_git_write(WS)
-    if decision.allowed:
-        return False
-    handler.sendj(decision.payload(), decision.status_code)
-    return True
+SECRET_VAL_RE = re.compile(r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})')

 def now() -> str: return time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())
 def uid(p='id') -> str: return f'{p}-{int(time.time()*1000)}-{uuid.uuid4().hex[:8]}'
@@ -136,41 +36,6 @@ def sh(args, check=False):
 def jload(p: Path, default):
    try: return json.loads(p.read_text(encoding='utf-8'))
    except Exception: return default
-
-def _file_sha256(path: Path) -> str:
-    digest=hashlib.sha256()
-    with path.open('rb') as source:
-        for chunk in iter(lambda: source.read(1024 * 1024), b''):
-            digest.update(chunk)
-    return digest.hexdigest()
-
-def _build_silent_release_service() -> SilentReleaseActionService:
-    verifier=None
-    if SILENT_RELEASE_PUBLIC_KEYS.is_file():
-        verifier=SignedApprovalVerifier(
-            ApprovalKeyRing.from_file(SILENT_RELEASE_PUBLIC_KEYS),
-            ApprovalRevocationStore(
-                SILENT_RELEASE_STATE_ROOT / 'revocations'
-            ),
-        )
-    policy_path=WS / 'config' / 'gitops' / 'silent-release-policy.json'
-    policy_sha=_file_sha256(policy_path) if policy_path.is_file() else ''
-    return SilentReleaseActionService(
-        SILENT_RELEASE_STATE_ROOT,
-        execution_enabled=SILENT_RELEASE_EXECUTION_ENABLED,
-        approval_verifier=verifier,
-        expected_repository=REPOSITORY_IDENTITY,
-        policy_sha256=policy_sha,
-    )
-
-# Construct once during service startup. If production execution is enabled
-# without every trusted builder/orchestrator dependency, construction fails
-# closed before the HTTP server accepts traffic.
-_SILENT_RELEASE_SERVICE = _build_silent_release_service()
-
-
-def silent_release_service() -> SilentReleaseActionService:
-    return _SILENT_RELEASE_SERVICE
 def relpath(path: str) -> str:
    x = str(path or '').replace('\\','/').strip()
    if not x or x.startswith('/') or '..' in Path(x).parts or Path(x).parts[0] == '.git': raise ValueError('invalid path')
@@ -244,13 +109,9 @@ def ensure_git():
    if not sh(['config','user.name'])['stdout']: sh(['config','user.name','chatgpt-gitops-bot'], True)
 def checkout(branch, base='main', create=False):
    ensure_git(); b=branch_name(branch)
-    exists = sh(['rev-parse','--verify',f'refs/heads/{b}'])['code'] == 0
-    if exists:
-        sh(['checkout',b], True)
-    elif create:
-        sh(['checkout',base], True); sh(['checkout','-b',b], True)
-    else:
-        raise ValueError(f'branch does not exist: {b}')
+    if create or sh(['rev-parse','--verify',b])['code'] != 0:
+        sh(['checkout',base], True); sh(['checkout','-B',b], True)
+    else: sh(['checkout',b], True)
    return b
 def write_file(path, content):
    if content_has_secret(content): raise ValueError('secret_rejected: use secret_ref; plaintext API keys must not enter Git')
@@ -260,19 +121,6 @@ def sync_branch(branch: str) -> dict:
    if not branch or branch in ('main','master') or branch.startswith('main/') or branch.startswith('master/'):
        return {'status':'skipped','reason':'protected_branch','branch':branch}
    if BARE_REPO.exists():
-        common = sh(['rev-parse', '--path-format=absolute', '--git-common-dir'], True)['stdout']
-        if Path(common).resolve() == BARE_REPO.resolve():
-            head = sh(['rev-parse', 'HEAD'], True)['stdout']
-            stored = subprocess.run(
-                ['git', '--git-dir', str(BARE_REPO), 'rev-parse', f'refs/heads/{branch}'],
-                text=True, capture_output=True,
-            )
-            if stored.returncode != 0 or stored.stdout.strip() != head:
-                raise RuntimeError(f'linked-worktree branch verification failed for {branch}')
-            return {
-                'status':'verified', 'target':'authoritative-bare',
-                'branch':branch, 'oid':head,
-            }
        ref=f'refs/heads/{branch}:refs/heads/{branch}'
        p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
        if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git sync failed for {branch}')
@@ -282,68 +130,15 @@ def sync_branch(branch: str) -> dict:
    return {'status':'synced','target':'origin','branch':branch,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}

 def sync_tag(tag: str) -> dict:
-    raise RuntimeError(
-        'unsafe sync_tag disabled: use TagPublisher with expected tag_oid, '
-        'target_oid, Gitea remote verification, and authenticated API verification'
-    )
-
-def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
-    oid = str(value or '').strip().lower()
-    if not re.fullmatch(r'[0-9a-f]{40}', oid):
-        raise ValueError(f'{field} must be a full 40-character commit OID')
-    try:
-        return authoritative_commit(oid, git_dir=AUTHORITATIVE_GIT_DIR)
-    except (AuthoritativeGitError, ValueError) as exc:
-        raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
-
-def existing_tag_target(tag: str) -> str | None:
-    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
-        raise ValueError('invalid release version')
-    try:
-        result = run_authoritative_git(
-            ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
-            check=False,
-            git_dir=AUTHORITATIVE_GIT_DIR,
-        )
-    except AuthoritativeGitError as exc:
-        raise RuntimeError(str(exc)) from exc
-    return result.stdout.strip() if result.returncode == 0 else None
-
-def publication_request_from_query(q: dict[str, list[str]]) -> PublicationRequest:
-    required = ('version', 'target_oid', 'evidence_closure_oid', 'approval_plan_id')
-    missing = [name for name in required if not (q.get(name) or [''])[0]]
-    if missing:
-        raise ValueError('missing release governance fields: ' + ', '.join(missing))
-    return PublicationRequest(
-        (q['version'])[0],
-        (q['target_oid'])[0].lower(),
-        (q['evidence_closure_oid'])[0].lower(),
-        (q['approval_plan_id'])[0],
-    )
-
-def required_authoritative_git_dir() -> Path:
-    snapshot = repository_snapshot(
-        git_dir=AUTHORITATIVE_GIT_DIR,
-        repository_identity=REPOSITORY_IDENTITY,
-    )
-    if not snapshot["repository_available"]:
-        raise RuntimeError(str(snapshot["query_error"] or "AUTHORITATIVE_REPOSITORY_UNAVAILABLE"))
-    return Path(str(snapshot["authoritative_git_dir"]))
-
-
-def publication_publisher() -> TagPublisher:
-    authoritative_repo = required_authoritative_git_dir()
-    return TagPublisher(
-        WS,
-        GitTagBackend(WS, authoritative_repo=authoritative_repo),
-        GiteaTagClient(
-            os.getenv('AIOS_GITOPS_GITEA_API_URL',''),
-            os.getenv('AIOS_GITOPS_GITEA_REPOSITORY',''),
-            Path(os.getenv('AIOS_GITOPS_GITEA_TOKEN_FILE','')),
-            token_line=int(os.getenv('AIOS_GITOPS_GITEA_TOKEN_LINE','1')),
-        ),
-        os.getenv('AIOS_GITOPS_GITEA_REMOTE','gitea'),
-    )
+    if not tag: return {'status':'skipped','reason':'empty_tag'}
+    if BARE_REPO.exists():
+        ref=f'refs/tags/{tag}:refs/tags/{tag}'
+        p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
+        if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag sync failed for {tag}')
+        return {'status':'synced','target':'bare','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
+    p=subprocess.run(['git','push','origin',tag], cwd=str(WS), text=True, capture_output=True)
+    if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag push failed for {tag}')
+    return {'status':'synced','target':'origin','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}

 def commit(paths, msg):
    ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
@@ -363,16 +158,6 @@ def patches():
    for p in sorted((WS/'patches').glob('**/*.json')): out.append(jload(p, {'path':str(p.relative_to(WS))}))
    return out

-def runtime_release_info() -> dict[str, Any]:
-    for candidate in (WS / 'manifest.json', WS.parent / 'manifest.json'):
-        data = jload(candidate, {})
-        if data.get('target_commit'):
-            return {
-                'runtime_release_commit': data.get('target_commit'),
-                'runtime_release_path': str(WS),
-            }
-    return {'runtime_release_commit': None, 'runtime_release_path': str(WS)}
-
 class H(BaseHTTPRequestHandler):
    server_version='AIOSChatGPTGitOps/V1R1C0'
    def sendj(self, data, code=200):
@@ -394,236 +179,43 @@ class H(BaseHTTPRequestHandler):
        if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
        return a
    def do_GET(self):
-        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
-        if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
-        q=urllib.parse.parse_qs(u.query)
+        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path; q=urllib.parse.parse_qs(u.query)
        try:
            if path in ('/health','/api/health'): return self.sendj({'status':'ok','service':'chatgpt-gitops-adapter','workspace':str(WS)})
            if path in ('/api/openapi.yaml','/api/openapi-chatgpt-actions.yaml','/api/schema'):
                return self.sendt(OPENAPI.read_text(encoding='utf-8'), 'application/yaml; charset=utf-8') if OPENAPI.exists() else self.sendj({'error':'schema_missing'},404)
            if path in ('/api','/api/status'): return self.sendj(api_spec())
            if path in ('/api/base','/api/baseline','/base'):
-                data=jload(WS/'baseline'/'current.json', {})
-                data.setdefault('authoritative_repository', repository_snapshot(
-                    git_dir=AUTHORITATIVE_GIT_DIR,
-                    repository_identity=REPOSITORY_IDENTITY,
-                ))
-                return self.sendj(data)
+                data=jload(WS/'baseline'/'current.json', {}); data.setdefault('git', sh(['rev-parse','--short','HEAD'])['stdout']); return self.sendj(data)
            if path in ('/api/ver','/api/versions','/ver'):
-                snapshot = repository_snapshot(
-                    git_dir=AUTHORITATIVE_GIT_DIR,
-                    repository_identity=REPOSITORY_IDENTITY,
-                )
-                if not snapshot['repository_available']:
-                    return self.sendj({
-                        'repository_available': False,
-                        'query_error': snapshot['query_error'],
-                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
-                        'local_authoritative_tags': [],
-                    }, 503)
-                try:
-                    tags = authoritative_tags(git_dir=AUTHORITATIVE_GIT_DIR)
-                except AuthoritativeGitError as exc:
-                    return self.sendj({
-                        'repository_available': False,
-                        'query_error': str(exc),
-                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
-                        'local_authoritative_tags': [],
-                    }, 503)
-                registry = [p.name for p in (WS/'versions').glob('*')]
-                return self.sendj({
-                    'registry_versions': registry,
-                    'local_authoritative_tags': tags,
-                    'repository_available': True,
-                    'query_error': None,
-                    'tags': [item['name'] for item in tags],
-                    'versions_dir': registry,
-                    'head': snapshot['authoritative_head_oid'],
-                    'authoritative_head_oid': snapshot['authoritative_head_oid'],
-                })
+                return self.sendj({'tags':sh(['tag','--list','V*'])['stdout'].splitlines(),'versions_dir':[p.name for p in (WS/'versions').glob('*')],'head':sh(['rev-parse','--short','HEAD'])['stdout']})
            if path in ('/api/diff','/diff'):
-                frm=(q.get('from') or [''])[0]
-                to=(q.get('to') or [''])[0]
-                try:
-                    diff=authoritative_diff(frm, to, git_dir=required_authoritative_git_dir())
-                except ValueError as exc:
-                    return self.sendj({'error':redact(exc)},400)
-                except AuthoritativeGitNotFound as exc:
-                    return self.sendj({'error':redact(exc)},404)
-                except AuthoritativeGitOutputTooLarge as exc:
-                    return self.sendj({'error':redact(exc)},413)
-                except (AuthoritativeGitError, RuntimeError) as exc:
-                    return self.sendj({'error':redact(exc)},503)
-                return self.sendj({'from':frm,'to':to,'diff':diff})
-            if path in ('/api/patch','/api/patches','/api/branches','/patch'):
-                snapshot = repository_snapshot(
-                    git_dir=AUTHORITATIVE_GIT_DIR,
-                    repository_identity=REPOSITORY_IDENTITY,
-                )
-                if not snapshot['repository_available']:
-                    return self.sendj({
-                        'repository_available': False,
-                        'query_error': snapshot['query_error'],
-                        'metadata_patches': patches(),
-                        'authoritative_branches': [],
-                    }, 503)
-                try:
-                    branches = authoritative_branches(git_dir=AUTHORITATIVE_GIT_DIR)
-                except AuthoritativeGitError as exc:
-                    return self.sendj({
-                        'repository_available': False,
-                        'query_error': str(exc),
-                        'metadata_patches': patches(),
-                        'authoritative_branches': [],
-                    }, 503)
-                metadata = patches()
-                branch_names = {item['name'] for item in branches}
-                metadata_names = {
-                    item.get('branch') for item in metadata
-                    if isinstance(item, dict) and item.get('branch')
-                }
-                orphan = [
-                    item for item in metadata
-                    if item.get('branch') and item.get('branch') not in branch_names
-                ]
-                missing = [
-                    item for item in branches
-                    if item['name'] not in metadata_names
-                ]
-                return self.sendj({
-                    'metadata_patches': metadata,
-                    'authoritative_branches': branches,
-                    'orphan_metadata': orphan,
-                    'branches_without_metadata': missing,
-                    'repository_available': True,
-                    'query_error': None,
-                    'patches': metadata,
-                    'branches': [item['name'] for item in branches],
-                })
+                frm=(q.get('from') or ['HEAD~1'])[0]; to=(q.get('to') or ['HEAD'])[0]; return self.sendj({'from':frm,'to':to,'diff':sh(['diff',frm,to])})
+            if path in ('/api/patch','/api/patches','/api/branches','/patch'): return self.sendj({'patches':patches(),'branches':sh(['branch','--format','%(refname:short)'])['stdout'].splitlines()})
            if path in ('/api/model','/model'): return self.sendj({'base':BASE_MODELS,'custom':model_docs(),'priority':[jload(p,{}) for p in sorted((WS/'config'/'model_priority').glob('*.json'))]})
            if path in ('/api/run','/api/runtime-status','/run'):
                svc=subprocess.run(['systemctl','is-active','aios-gitops-model-api'], text=True, capture_output=True)
-                snapshot = repository_snapshot(
-                    git_dir=AUTHORITATIVE_GIT_DIR,
-                    repository_identity=REPOSITORY_IDENTITY,
-                )
-                workspace_branch = None
-                if (WS / '.git').exists():
-                    result = sh(['rev-parse','--abbrev-ref','HEAD'])
-                    workspace_branch = result['stdout'] or None
-                payload = {
-                    'service':'aios-gitops-model-api',
-                    'status':svc.stdout.strip() or svc.stderr.strip(),
-                    'workspace_branch':workspace_branch,
-                    **runtime_release_info(),
-                    **snapshot,
-                    'writes_enabled': str(os.getenv('AIOS_GITOPS_WRITES_ENABLED','false')).lower() in {'1','true','yes','on'},
-                }
-                return self.sendj(payload, 200 if snapshot['repository_available'] else 503)
+                return self.sendj({'service':'aios-gitops-model-api','status':svc.stdout.strip() or svc.stderr.strip(),'workspace_branch':sh(['rev-parse','--abbrev-ref','HEAD'])['stdout']})
            if path in ('/api/action-monitor','/action-monitor'):
                latest=monitor.latest()
                ldict={'event_id':latest.event_id,'action':latest.action,'error':latest.error,'context':latest.context,'created_at':latest.created_at} if latest else None
                return self.sendj({'events':[{"event_id":e.event_id,"action":e.action,"error":e.error,"context":e.context,"created_at":e.created_at} for e in monitor.list_events()],'latest':ldict})
-            if path == '/api/tag-publication-status':
-                version=(q.get('version') or [''])[0]
-                try:
-                    version=validate_version(version)
-                    status=publication_publisher().get_tag_publication_status(version)
-                except ValueError:
-                    return self.sendj({'error':'invalid release version'},400)
-                return self.sendj(status)
-            if path == '/api/release-consistency':
-                request=publication_request_from_query(q)
-                return self.sendj(publication_publisher().get_release_consistency(request))
-            if path == '/api/release-acceptance':
-                request=publication_request_from_query(q)
-                return self.sendj(publication_publisher().run_release_acceptance(request))
-            if path in (
-                '/getReleaseCandidate',
-                '/getReleasePlan',
-                '/getReleaseAcceptance',
-                '/getApprovalEnvelope',
-                '/getReleaseSaga',
-                '/getCapabilityStatus',
-            ):
-                candidate_id=(q.get('candidate_id') or [''])[0]
-                if not candidate_id:
-                    return self.sendj({'error':'candidate_id is required'},400)
-                service=silent_release_service()
-                if path == '/getReleaseCandidate':
-                    return self.sendj(
-                        service.get_release_candidate(candidate_id)
-                    )
-                if path == '/getApprovalEnvelope':
-                    return self.sendj(
-                        service.get_approval_envelope(candidate_id)
-                    )
-                if path == '/getReleasePlan':
-                    return self.sendj(service.get_release_plan(candidate_id))
-                if path == '/getReleaseAcceptance':
-                    return self.sendj(service.get_acceptance(candidate_id))
-                if path == '/getCapabilityStatus':
-                    return self.sendj(
-                        service.get_capability_status(candidate_id)
-                    )
-                return self.sendj(service.get_release_saga(candidate_id))
-            if path == '/getRecoveryStatus':
-                return self.sendj(
-                    silent_release_service().get_recovery_status()
-                )
                        # Admin AI Evolution Dashboard
            if path in ('/admin/ai-evolution','/admin/ai-evolution/'):
                return self.ai_evolution_page()
            if path in ('/admin/ai-evolution/api/data'):
                return self.ai_evolution_data()
            return self.sendj({'error':'not_found','path':path},404)
-        except FileNotFoundError:
-            return self.sendj({'error':'release candidate not found'},404)
-        except ValueError as e:
-            error=redact(e)
-            monitor.record_failure('do_GET', error, {'path':path})
-            return self.sendj({'error':error},400)
        except Exception as e:
-            error=redact(e)
-            monitor.record_failure('do_GET', error, {'path':path})
-            return self.sendj({'error':error},500)
+            monitor.record_failure('do_GET', str(e), {'path':path})
+            return self.sendj({'error':str(e)},500)
    def do_PUT(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/')
-        if reject_non_read_http(self, 'PUT', path): return
-        data=self.body()
+        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
        if path == '/api/model-priority': return self.model_priority(data)
        return self.sendj({'error':'not_found','path':path},404)
    def do_POST(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/')
-        if reject_non_read_http(self, 'POST', path): return
-        data=self.body()
+        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
        try:
-            if path == '/createReleaseCandidate':
-                a=self.need('release:candidate')
-                if not a: return
-                return self.sendj(
-                    silent_release_service().create_release_candidate(data)
-                )
-            if path == '/createReleaseIntent':
-                a=self.need('release:candidate')
-                if not a: return
-                return self.sendj(
-                    silent_release_service().create_release_intent(data)
-                )
-            if path in ('/submitOwnerApproval','/submitSignedApproval'):
-                a=self.need('release:approve')
-                if not a: return
-                return self.sendj(
-                    silent_release_service().submit_owner_approval(data)
-                )
-            if path == '/startDeployment':
-                a=self.need('release:deploy')
-                if not a: return
-                return self.sendj(
-                    silent_release_service().start_deployment(
-                        str(data.get('candidate_id') or '')
-                    )
-                )
            if path in ('/api/branch','/api/create-branch'): return self.branch(data)
            if path in ('/api/file','/api/commit-file'): return self.file(data)
            if path == '/api/commit': return self.commit(data)
@@ -634,30 +226,9 @@ class H(BaseHTTPRequestHandler):
            if path == '/api/model-priority': return self.model_priority(data)
            if path == '/api/nl': return self.nl(data)
            return self.sendj({'error':'not_found','path':path},404)
-        except (ValueError, FileNotFoundError) as e:
-            error=redact(e)
-            monitor.record_failure('do_POST', error, {'path':path})
-            return self.sendj({'error':error},400)
-        except CapabilityAuthorizationError as e:
-            error=redact(e)
-            monitor.record_failure('do_POST', error, {'path':path})
-            return self.sendj({'error':error},403)
-        except SagaConflict as e:
-            error=redact(e)
-            monitor.record_failure('do_POST', error, {'path':path})
-            return self.sendj({'error':error},409)
        except Exception as e:
-            error=redact(e)
-            monitor.record_failure('do_POST', error, {'path':path})
-            return self.sendj({'error':error},500)
-    def do_PATCH(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/')
-        if reject_non_read_http(self, 'PATCH', path): return
-        return self.sendj({'error':'not_found','path':path},404)
-    def do_DELETE(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/')
-        if reject_non_read_http(self, 'DELETE', path): return
-        return self.sendj({'error':'not_found','path':path},404)
+            monitor.record_failure('do_POST', str(e), {'path':path})
+            return self.sendj({'error':str(e)},500)
    def branch(self,data):
        a=self.need('branch:create');
        if not a: return
@@ -681,41 +252,12 @@ class H(BaseHTTPRequestHandler):
        if not a: return
        ver=data.get('version') or data.get('tag')
        if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
-        if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
-            return self.sendj({
-                'error':'production_tag_evidence_required',
-                'required':['version','target_oid','evidence_closure_oid','approval_plan_id'],
-            },400)
-        try:
-            target_oid=resolve_commit_oid(data.get('target_oid'))
-            evidence_oid=resolve_commit_oid(data.get('evidence_closure_oid'), 'evidence_closure_oid')
-        except ValueError as exc:
-            return self.sendj({'error':'invalid_tag_target','detail':str(exc)},400)
+        if data.get('confirm') != True:
+            self.sendj({'status':'confirm_required','operation':'tag','hint':'This operation creates a Git tag. Confirm to proceed.','x-openai-isConsequential':True}, 428)
+            return
        if a['role'] != 'owner' or not data.get('execute'):
-            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'request':req,'commit':c})
-        request=PublicationRequest(ver,target_oid,evidence_oid,str(data.get('approval_plan_id')))
-        main_before=sh(['rev-parse','refs/heads/main'], True)['stdout']
-        publisher=publication_publisher()
-        try:
-            publication=publisher.publish(request)
-        except PublicationManualOwnerReviewRequired as exc:
-            audit(a['account'],'tag_manual_owner_review_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':redact(exc)})
-            return self.sendj({'status':'MANUAL_OWNER_REVIEW_REQUIRED','error':redact(exc),'main_changed':False,'force_push':False},409)
-        except PublicationConflict as exc:
-            audit(a['account'],'tag_conflict',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
-            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},409)
-        except PublicationPending as exc:
-            audit(a['account'],'tag_pending',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
-            return self.sendj({'status':'REMOTE_PUSH_PENDING','error':str(exc),'main_changed':False,'force_push':False},503)
-        except PublicationReconciliationRequired as exc:
-            audit(a['account'],'tag_reconciliation_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
-            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},502)
-        main_after=sh(['rev-parse','refs/heads/main'], True)['stdout']
-        if main_after != main_before:
-            raise RuntimeError('main changed during tag operation')
-        result={'status':publication['state'],'version':ver,'tag_name':ver,'tag_oid':publication['tag_oid'],'target_oid':target_oid,'expected_target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'workspace_head':sh(['rev-parse','HEAD'],True)['stdout'],'main_oid_before':main_before,'main_oid_after':main_after,'main_changed':False,'force_push':False,'publication':publication}
-        audit(a['account'],'tag',ver,result)
-        self.sendj(result)
+            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'commit':c})
+        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver)})
    def rollback(self,data):
        a=self.need('rollback:request');
        if not a: return
@@ -810,10 +352,7 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
        cmd_filter=(params.get('command') or [None])[0]
        bl=jload(WS/'baseline'/'current.json',{})
        current_ver=bl.get('current_baseline','V1R3C1')
-        try:
-            tags=[item['name'] for item in authoritative_tags(git_dir=required_authoritative_git_dir()) if str(item['name']).startswith('V')]
-        except (AuthoritativeGitError, RuntimeError) as exc:
-            return self.sendj({'error':redact(exc),'repository_available':False},503)
+        tags=sh(['tag','--list','V*'])['stdout'].splitlines() if WS.exists() else []
        versions=[]
        if (WS/'baseline'/'promotions').exists():
            for p in sorted((WS/'baseline'/'promotions').glob('*.json')):
@@ -851,9 +390,9 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer


 def api_spec():
-    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
+    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True}}

 def main():
    print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
    ThreadingHTTPServer((HOST,PORT), H).serve_forever()
-if __name__ == '__main__': main()
+if __name__ == '__main__': main()
@@ -1,52 +0,0 @@
-#!/usr/bin/env python3
-"""Fail-closed policy for in-process Git mutation handlers."""
-from __future__ import annotations
-
-import os
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Mapping
-
-_TRUE = frozenset({"1", "true", "yes", "on"})
-
-
-@dataclass(frozen=True)
-class GitWriteDecision:
-    allowed: bool
-    status_code: int
-    error: str
-    reason: str
-    workspace: str
-
-    def payload(self) -> dict[str, str]:
-        return {
-            "status": "allowed" if self.allowed else "blocked",
-            "error": self.error,
-            "reason": self.reason,
-            "workspace": self.workspace,
-        }
-
-
-def _real(path: Path) -> Path:
-    return Path(os.path.realpath(os.path.abspath(str(path))))
-
-
-def evaluate_git_write(workspace: Path | str, env: Mapping[str, str] | None = None) -> GitWriteDecision:
-    values = os.environ if env is None else env
-    lexical = Path(os.path.abspath(str(workspace)))
-    canonical = _real(lexical)
-    shown = str(lexical)
-    if str(values.get("AIOS_GITOPS_WRITES_ENABLED", "false")).strip().lower() not in _TRUE:
-        return GitWriteDecision(False, 423, "gitops_writes_disabled", "AIOS_GITOPS_WRITES_ENABLED is false", shown)
-    if lexical != canonical:
-        return GitWriteDecision(False, 409, "workspace_symlink_forbidden", "workspace must be a canonical non-symlink path", shown)
-    controller = _real(Path(values.get("AIOS_GITOPS_CONTROLLER_PATH", "/data/aios-gitops/worktrees/controller")))
-    role = str(values.get("AIOS_GITOPS_WORKSPACE_ROLE", "")).strip().lower()
-    if canonical == controller or role == "runtime-anchor":
-        return GitWriteDecision(False, 423, "runtime_anchor_read_only", "controller/runtime-anchor is read-only", str(canonical))
-    writer_root = _real(Path(values.get("AIOS_GITOPS_APPROVED_WRITER_ROOT", "/data/aios-gitops/worktrees")))
-    try:
-        canonical.relative_to(writer_root)
-    except ValueError:
-        return GitWriteDecision(False, 409, "workspace_not_approved_writer", "workspace is outside the approved writer root", str(canonical))
-    return GitWriteDecision(True, 200, "", "approved isolated writer", str(canonical))
@@ -1,316 +0,0 @@
-"""Task-scoped hardened wrapper around the existing Action API."""
-from __future__ import annotations
-
-import json
-import os
-import subprocess
-from pathlib import Path
-import urllib.parse
-
-import aios_chatgpt_actions_api as api
-import aios_isolated_writer_policy as policy
-from isolated_writer_authz import AuthorizationError, authorize
-from isolated_writer_commit_file import AtomicCommitFile, CommitFileError, OperationLedger
-from isolated_writer_token_registry import TokenRegistry
-
-_reject = api.reject_non_read_http
-_write_file = api.write_file
-_sync_branch = api.sync_branch
-_original_do_get = api.H.do_GET
-api.OPENAPI = Path(os.getenv("AIOS_GITOPS_ISOLATED_WRITER_OPENAPI", str(api.OPENAPI)))
-
-
-def _registry() -> TokenRegistry:
-    return TokenRegistry(Path(os.environ["AIOS_GITOPS_TOKEN_REGISTRY_V2"]))
-
-
-def _atomic_writer() -> AtomicCommitFile:
-    return AtomicCommitFile(
-        workspace=api.WS,
-        bare_repo=api.BARE_REPO,
-        ledger=OperationLedger(Path(os.environ["AIOS_GITOPS_WRITER_OPERATION_LEDGER"])),
-        remote=os.getenv("AIOS_GITOPS_GITEA_PUSH_REMOTE", ""),
-        audit=policy.append_audit_record,
-    )
-
-
-def _bearer(handler) -> str:
-    value = handler.headers.get("Authorization", "")
-    return value[7:].strip() if value.startswith("Bearer ") else ""
-
-
-def _authorize(handler, *, method: str, path: str, branch=None, target_path=None):
-    grant = authorize(
-        _registry(),
-        _bearer(handler),
-        method=method,
-        path=path,
-        source_ip=str(handler.client_address[0]),
-        workspace=api.WS,
-        branch=branch,
-        target_path=target_path,
-    )
-    grant.record["_source_ip"] = str(handler.client_address[0])
-    return grant
-
-
-def _authorization_error(handler, exc: AuthorizationError):
-    return handler.sendj({"error": exc.code}, exc.status)
-
-
-def _isolated_runtime_status(handler):
-    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
-    head = api.sh(["rev-parse", "HEAD"], True)["stdout"]
-    return handler.sendj({
-        "service": os.getenv(
-            "AIOS_GITOPS_SERVICE_AUDIENCE",
-            "aios-isolated-writer.service",
-        ),
-        "status": "active",
-        "runtime_role": os.getenv("AIOS_GITOPS_RUNTIME_ROLE"),
-        "workspace_role": os.getenv("AIOS_GITOPS_WORKSPACE_ROLE"),
-        "writes_enabled": os.getenv("AIOS_GITOPS_WRITES_ENABLED", "").lower()
-        in {"1", "true", "yes", "on"},
-        "allowed_branch": policy.allowed_branch(),
-        "approved_base_oid": policy.allowed_base_oid(),
-        "workspace_branch": branch,
-        "workspace_head_oid": head,
-        "repository_identity": os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY"),
-        "token_policy_version": 2,
-        "atomic_commit_file": True,
-        "path_policy_sha256": policy.configured_path_policy_sha256(),
-    })
-
-
-def _isolated_do_get(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path in {"/health", "/api/health"}:
-        return self.sendj({
-            "status": "ok",
-            "service": os.getenv(
-                "AIOS_GITOPS_SERVICE_AUDIENCE",
-                "aios-isolated-writer.service",
-            ),
-        })
-    if path not in {"/api/runtime-status", "/api/baseline", "/api/patches"}:
-        return self.sendj({"error": "isolated_writer_operation_forbidden"}, 403)
-    try:
-        _authorize(self, method="GET", path=path)
-    except AuthorizationError as exc:
-        return _authorization_error(self, exc)
-    if path == "/api/runtime-status":
-        return _isolated_runtime_status(self)
-    return _original_do_get(self)
-
-
-def _read_commit_file_body(handler):
-    try:
-        length = int(handler.headers.get("Content-Length", "0"))
-    except ValueError:
-        raise CommitFileError("writer_content_length_rejected") from None
-    if length <= 0:
-        raise CommitFileError("writer_request_object_required")
-    if length > 1_100_000:
-        raise CommitFileError("writer_request_too_large", 413)
-    raw = handler.rfile.read(length)
-    try:
-        value = json.loads(raw.decode("utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        raise CommitFileError("writer_request_json_rejected") from None
-    if not isinstance(value, dict):
-        raise CommitFileError("writer_request_object_required")
-    return value
-
-
-def _isolated_do_post(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path != "/api/commit-file":
-        return self.sendj({"error": "isolated_writer_operation_forbidden"}, 403)
-    try:
-        data = _read_commit_file_body(self)
-        branch = str(data.get("branch") or "")
-        target_path = str(data.get("path") or "")
-        grant = _authorize(
-            self,
-            method="POST",
-            path=path,
-            branch=branch,
-            target_path=target_path,
-        )
-        if api.content_has_secret(str(data.get("content") or "")):
-            raise CommitFileError("writer_secret_content_rejected", 403)
-        result = _atomic_writer().execute(grant, data)
-        return self.sendj(result)
-    except AuthorizationError as exc:
-        return _authorization_error(self, exc)
-    except CommitFileError as exc:
-        return self.sendj({"error": exc.code}, exc.status)
-    except PermissionError:
-        return self.sendj({"error": "isolated_writer_policy_rejected"}, 403)
-
-
-def reject_non_read_http(handler, method: str, path: str) -> bool:
-    if _reject(handler, method, path):
-        return True
-    try:
-        policy.validate_endpoint(method, path, api.WS, api.BARE_REPO)
-        return False
-    except PermissionError as exc:
-        handler.sendj({"error": str(exc)}, 403)
-        return True
-
-
-def checkout(branch, base="main", create=False):
-    api.ensure_git()
-    target = api.branch_name(branch)
-    policy.validate_branch_request({"branch": target, "base": base})
-    exists = api.sh(["rev-parse", "--verify", target])["code"] == 0
-    if exists:
-        if api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"] != target:
-            api.sh(["checkout", target], True)
-    elif create:
-        api.sh(["checkout", "-b", target, base], True)
-    else:
-        raise PermissionError("isolated_writer_branch_missing")
-    policy.require_service_invariants(api.WS, api.BARE_REPO)
-    return target
-
-
-def write_file(path, content):
-    policy.validate_path(path, api.WS)
-    return _write_file(path, content)
-
-
-def sync_branch(branch: str):
-    policy.validate_sync_branch(branch)
-    local = _sync_branch(branch)
-    remote = os.getenv("AIOS_GITOPS_GITEA_PUSH_REMOTE", "").strip()
-    if remote != "gitea-http":
-        raise PermissionError("isolated_writer_gitea_remote_rejected")
-    head = api.sh(["rev-parse", "HEAD"], True)["stdout"]
-    pushed = subprocess.run(
-        ["git", "push", "--porcelain", remote, f"HEAD:refs/heads/{branch}"],
-        cwd=api.WS,
-        text=True,
-        capture_output=True,
-    )
-    if pushed.returncode != 0:
-        raise RuntimeError("isolated_writer_gitea_push_failed")
-    verified = subprocess.run(
-        ["git", "ls-remote", "--heads", remote, f"refs/heads/{branch}"],
-        cwd=api.WS,
-        text=True,
-        capture_output=True,
-    )
-    if verified.returncode != 0:
-        raise RuntimeError("isolated_writer_gitea_verification_failed")
-    fields = verified.stdout.strip().split()
-    if len(fields) != 2 or fields[0] != head or fields[1] != f"refs/heads/{branch}":
-        raise RuntimeError("isolated_writer_gitea_oid_mismatch")
-    return {
-        "status": "verified",
-        "target": "authoritative-bare+gitea",
-        "branch": branch,
-        "oid": head,
-        "local": local.get("status"),
-    }
-
-
-def commit(paths, msg):
-    policy.validate_commit_paths(paths, api.WS)
-    api.ensure_git()
-    selected = [api.relpath(p) for p in paths] if paths else ["."]
-    api.sh(["add", *selected], True)
-    policy.validate_staged_paths(api.WS)
-    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
-    if not api.sh(["status", "--short"])["stdout"]:
-        return {"status": "no_changes", "branch": branch, "sync": sync_branch(branch)}
-    out = api.sh(["commit", "-m", msg], True)
-    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
-    return {
-        "status": "committed",
-        "branch": branch,
-        "rev": api.sh(["rev-parse", "--short", "HEAD"], True)["stdout"],
-        "git": out,
-        "sync": sync_branch(branch),
-    }
-
-
-def audit(actor, action, target, payload):
-    policy.append_audit_record(
-        {
-            "at": api.now(),
-            "actor": actor,
-            "action": action,
-            "target": target,
-            "payload": api.sanitize(payload),
-        }
-    )
-
-
-def _validate_request(self, data, validate):
-    try:
-        validate(data)
-        return True
-    except PermissionError as exc:
-        self.sendj({"error": str(exc)}, 403)
-        return False
-
-
-def _checked_branch(self, data):
-    if not _validate_request(self, data, policy.validate_branch_request):
-        return
-    return _branch(self, data)
-
-
-def _checked_file(self, data):
-    data = dict(data)
-    data.setdefault("branch", policy.allowed_branch())
-    if not _validate_request(self, data, policy.validate_branch_request):
-        return
-    if not _validate_request(
-        self,
-        {"path": data.get("path", "")},
-        lambda item: policy.validate_path(item["path"], api.WS),
-    ):
-        return
-    return _file(self, data)
-
-
-def _checked_commit(self, data):
-    data = dict(data)
-    data.setdefault("branch", policy.allowed_branch())
-    if not _validate_request(self, data, policy.validate_branch_request):
-        return
-    return _commit(self, data)
-
-
-def _checked_patch(self, data):
-    data = dict(data)
-    data["branch"] = policy.allowed_branch()
-    if not _validate_request(self, data, policy.validate_branch_request):
-        return
-    return _patch(self, data)
-
-
-_branch, _file, _commit, _patch = api.H.branch, api.H.file, api.H.commit, api.H.patch
-api.reject_non_read_http = reject_non_read_http
-api.checkout, api.write_file, api.sync_branch, api.commit, api.audit = (
-    checkout,
-    write_file,
-    sync_branch,
-    commit,
-    audit,
-)
-api.H.branch, api.H.file, api.H.commit, api.H.patch = (
-    _checked_branch,
-    _checked_file,
-    _checked_commit,
-    _checked_patch,
-)
-api.H.do_GET = _isolated_do_get
-api.H.do_POST = _isolated_do_post
-
-if __name__ == "__main__":
-    policy.require_service_invariants(api.WS, api.BARE_REPO)
-    api.ThreadingHTTPServer((api.HOST, api.PORT), api.H).serve_forever()
@@ -1,23 +0,0 @@
-"""Task-bound Integration Refresh control-plane primitives."""
-
-from .integration_merge_writer import IntegrationMergeWriter, MergeError, MergeRequest
-from .integration_refresh import (
-    AppendOnlyAudit,
-    Binding,
-    GiteaBranchReadProjection,
-    GrantStore,
-    IntegrationRefreshProvisioner,
-    ProvisioningError,
-)
-
-__all__ = [
-    "AppendOnlyAudit",
-    "Binding",
-    "GiteaBranchReadProjection",
-    "GrantStore",
-    "IntegrationMergeWriter",
-    "IntegrationRefreshProvisioner",
-    "MergeError",
-    "MergeRequest",
-    "ProvisioningError",
-]
@@ -1,90 +0,0 @@
-"""Constrained integration-only merge writer with rollback and reconciliation states."""
-from __future__ import annotations
-
-import subprocess
-from dataclasses import dataclass
-from pathlib import Path
-import re
-
-
-class MergeError(RuntimeError):
-    def __init__(self, code: str, status: int = 409):
-        super().__init__(code); self.code, self.status = code, status
-
-
-@dataclass(frozen=True)
-class MergeRequest:
-    integration_branch: str
-    source_branch: str
-    approved_source_oid: str
-
-
-class IntegrationMergeWriter:
-    def __init__(self, workspace: Path | str, remote: str, projection):
-        self.workspace, self.remote, self.projection = Path(workspace), remote, projection
-
-    def _git(self, *args: str, check=True) -> str:
-        p = subprocess.run(["git", *args], cwd=self.workspace, text=True, capture_output=True)
-        if check and p.returncode:
-            raise MergeError("git_operation_failed", 500)
-        return p.stdout.strip()
-
-    def merge(self, request: MergeRequest) -> dict:
-        def bad(value: str) -> bool:
-            return (
-                value == "main"
-                or value.startswith("main/")
-                or value == "governance"
-                or value.startswith("governance/")
-                or value == "approvals"
-                or value.startswith("refs/")
-                or value.startswith("tags/")
-            )
-        if (bad(request.integration_branch) or bad(request.source_branch) or
-                not request.integration_branch.startswith("integration/") or
-                re.fullmatch(r"[0-9a-fA-F]{40}", request.approved_source_oid) is None):
-            raise MergeError("integration_merge_scope_rejected", 403)
-        for branch in (request.integration_branch, request.source_branch):
-            if subprocess.run(["git", "check-ref-format", "--branch", branch], cwd=self.workspace,
-                              text=True, capture_output=True).returncode:
-                raise MergeError("integration_merge_scope_rejected", 403)
-        if self._git("rev-parse", "--abbrev-ref", "HEAD") != request.integration_branch:
-            raise MergeError("integration_branch_checkout_required")
-        before = self._git("rev-parse", "HEAD")
-        remote_before = self.projection(request.integration_branch)
-        if remote_before != before:
-            raise MergeError("integration_remote_advanced")
-        source = self._git("rev-parse", "--verify", f"refs/heads/{request.source_branch}^{{commit}}")
-        if source != request.approved_source_oid:
-            raise MergeError("integration_source_not_approved", 403)
-        attempt = subprocess.run(["git", "merge", "--no-ff", "--no-commit", request.source_branch], cwd=self.workspace, text=True, capture_output=True)
-        if attempt.returncode:
-            subprocess.run(["git", "merge", "--abort"], cwd=self.workspace, text=True, capture_output=True)
-            raise MergeError("integration_merge_conflict")
-        try:
-            self._git("commit", "-m", "merge(integration): approved source")
-            merged = self._git("rev-parse", "HEAD")
-            parents = self._git("show", "-s", "--format=%P", "HEAD").split()
-            if parents != [before, source]:
-                raise MergeError("integration_parent_invariant_failed", 500)
-            pushed = subprocess.run(["git", "push", "--porcelain", self.remote, f"HEAD:refs/heads/{request.integration_branch}"], cwd=self.workspace, text=True, capture_output=True)
-            if pushed.returncode:
-                try:
-                    observed = self.projection(request.integration_branch)
-                except Exception:
-                    return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
-                if observed == before:
-                    self._git("reset", "--hard", before)
-                    return {"state": "PUSH_FAILED_RESTORED", "pre_merge_oid": before}
-                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
-            try:
-                observed = self.projection(request.integration_branch)
-            except Exception:
-                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
-            if observed != merged:
-                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
-            return {"state": "COMPLETED", "pre_merge_oid": before, "merge_oid": merged}
-        except MergeError:
-            if self._git("rev-parse", "HEAD") != before:
-                self._git("reset", "--hard", before)
-            raise
@@ -1,257 +0,0 @@
-"""Fail-closed, task-bound integration refresh provisioning primitives.
-
-This module deliberately has no HTTP or credential-provider dependency.  The
-caller supplies a branch-read projection and an apply callback, making the
-authorization and recovery boundary independently testable.
-"""
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import argparse
-import secrets
-import sqlite3
-import threading
-import re
-from contextlib import contextmanager
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Callable
-
-
-class ProvisioningError(RuntimeError):
-    def __init__(self, code: str, status: int = 403):
-        super().__init__(code)
-        self.code, self.status = code, status
-
-
-def _now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def _digest(secret: str) -> str:
-    return hashlib.sha256(secret.encode("utf-8")).hexdigest()
-
-
-def _canonical(value: dict) -> str:
-    return hashlib.sha256(json.dumps(value, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
-
-
-def _is_oid(value: object) -> bool:
-    return isinstance(value, str) and re.fullmatch(r"[0-9a-fA-F]{40}", value) is not None
-
-
-@dataclass(frozen=True)
-class Binding:
-    task_id: str
-    repository: str
-    branch: str
-    actor_identity: str
-    audience: str
-    paths: tuple[str, ...]
-    quota: int
-
-
-class AppendOnlyAudit:
-    """Append only redacted JSONL audit, durable before a result is returned."""
-    def __init__(self, path: Path | str):
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        self._lock = threading.Lock()
-
-    def append(self, event: dict) -> None:
-        with self._lock:
-            safe = {key: value for key, value in event.items() if key not in {"token", "credential", "authorization"}}
-            previous = "0" * 64
-            if self.path.exists():
-                lines = self.path.read_text(encoding="utf-8").splitlines()
-                if lines:
-                    previous = json.loads(lines[-1])["event_hash"]
-            safe["previous_event_hash"] = previous
-            safe["event_hash"] = _canonical(safe)
-            encoded = (json.dumps(safe, sort_keys=True, separators=(",", ":")) + "\n").encode()
-            fd = os.open(self.path, os.O_APPEND | os.O_CREAT | os.O_WRONLY, 0o600)
-            try:
-                os.write(fd, encoded)
-                os.fsync(fd)
-            finally:
-                os.close(fd)
-
-
-class GrantStore:
-    """Digest-only short grant registry; SQLite transactions serialize quota use."""
-    def __init__(self, path: Path | str):
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        with self._db() as db:
-            db.execute("""CREATE TABLE IF NOT EXISTS grants(
-                token_digest TEXT PRIMARY KEY, binding_json TEXT NOT NULL,
-                expires_at TEXT NOT NULL, quota INTEGER NOT NULL, uses INTEGER NOT NULL,
-                revoked INTEGER NOT NULL DEFAULT 0)""")
-
-    @contextmanager
-    def _db(self):
-        db = sqlite3.connect(self.path, timeout=15, isolation_level=None)
-        db.row_factory = sqlite3.Row
-        try:
-            yield db
-        finally:
-            db.close()
-
-    def issue(self, binding: Binding, *, ttl_seconds: int = 300) -> str:
-        if ttl_seconds < 1 or ttl_seconds > 1800 or binding.quota < 1 or not binding.paths:
-            raise ValueError("invalid_short_grant")
-        token = secrets.token_urlsafe(32)
-        payload = json.dumps(binding.__dict__ | {"paths": list(binding.paths)}, sort_keys=True)
-        with self._db() as db:
-            db.execute("INSERT INTO grants VALUES(?,?,?,?,?,0)", (_digest(token), payload,
-                (_now() + timedelta(seconds=ttl_seconds)).isoformat(), binding.quota, 0))
-        return token
-
-    def rotate(self, old_token: str, binding: Binding, *, revocation_probe, ttl_seconds: int = 300) -> str:
-        self.revoke(old_token)
-        try: status = revocation_probe(old_token)
-        except TimeoutError as exc: raise ProvisioningError("revocation_probe_timeout", 503) from exc
-        if status != 401: raise ProvisioningError("revocation_probe_rejected", 503)
-        return self.issue(binding, ttl_seconds=ttl_seconds)
-
-    def revoke(self, token: str) -> None:
-        with self._db() as db:
-            db.execute("BEGIN IMMEDIATE")
-            db.execute("UPDATE grants SET revoked=1 WHERE token_digest=?", (_digest(token),))
-            db.execute("COMMIT")
-
-    def consume(self, token: str, binding: Binding, path: str) -> None:
-        with self._db() as db:
-            db.execute("BEGIN IMMEDIATE")
-            row = db.execute("SELECT * FROM grants WHERE token_digest=?", (_digest(token),)).fetchone()
-            if not row or row["revoked"]:
-                db.execute("ROLLBACK"); raise ProvisioningError("credential_rejected", 401)
-            if _now() >= datetime.fromisoformat(row["expires_at"]):
-                db.execute("ROLLBACK"); raise ProvisioningError("credential_expired", 401)
-            stored = json.loads(row["binding_json"])
-            requested = binding.__dict__ | {"paths": list(binding.paths)}
-            if stored != requested or path not in stored["paths"]:
-                db.execute("ROLLBACK"); raise ProvisioningError("grant_binding_rejected")
-            if row["uses"] >= row["quota"]:
-                db.execute("ROLLBACK"); raise ProvisioningError("grant_quota_exhausted")
-            db.execute("UPDATE grants SET uses=uses+1 WHERE token_digest=?", (_digest(token),))
-            db.execute("COMMIT")
-
-
-class GiteaBranchReadProjection:
-    """Normalizes a trusted task-scoped Gitea reader; every ambiguity fails closed."""
-    def __init__(self, reader: Callable[[str, str], dict]):
-        self.reader = reader
-
-    def head(self, repository: str, branch: str) -> str:
-        try:
-            reply = self.reader(repository, branch)
-        except TimeoutError as exc:
-            raise ProvisioningError("gitea_projection_timeout", 503) from exc
-        except Exception as exc:
-            raise ProvisioningError("gitea_projection_unavailable", 503) from exc
-        if not isinstance(reply, dict) or reply.get("status") in {401, 403}:
-            raise ProvisioningError("gitea_projection_forbidden", 503)
-        oid = reply.get("oid")
-        if reply.get("status") != 200 or not _is_oid(oid):
-            raise ProvisioningError("gitea_projection_invalid", 503)
-        return oid.lower()
-
-
-class IntegrationRefreshProvisioner:
-    _locks: dict[tuple[str, str], threading.Lock] = {}
-    _locks_guard = threading.Lock()
-
-    def __init__(self, *, grants: GrantStore, projection: GiteaBranchReadProjection,
-                 ledger_path: Path | str, audit: AppendOnlyAudit, approved_binding: Binding):
-        self.grants, self.projection, self.audit, self.approved_binding = grants, projection, audit, approved_binding
-        self.ledger_path = Path(ledger_path); self.ledger_path.parent.mkdir(parents=True, exist_ok=True)
-        with self._ledger() as db:
-            db.execute("CREATE TABLE IF NOT EXISTS refreshes(operation_id TEXT PRIMARY KEY, digest TEXT NOT NULL, state TEXT NOT NULL, result_oid TEXT)")
-
-    @contextmanager
-    def _ledger(self):
-        db = sqlite3.connect(self.ledger_path)
-        try:
-            yield db
-            db.commit()
-        finally:
-            db.close()
-
-    def refresh(self, *, token: str, binding: Binding, path: str, operation_id: str,
-                target_head_oid: str, apply: Callable[[], str]) -> dict:
-        if not operation_id or not _is_oid(target_head_oid):
-            raise ProvisioningError("refresh_request_rejected")
-        if binding != self.approved_binding:
-            raise ProvisioningError("grant_binding_rejected")
-        request = {"binding": binding.__dict__ | {"paths": list(binding.paths)}, "path": path, "target": target_head_oid}
-        digest = _canonical(request)
-        with self._locks_guard:
-            lock = self._locks.setdefault((binding.repository, binding.branch), threading.Lock())
-        with lock, self._ledger() as db:
-            db.execute("BEGIN IMMEDIATE")
-            row = db.execute("SELECT * FROM refreshes WHERE operation_id=?", (operation_id,)).fetchone()
-            new_operation = row is None
-            if row:
-                if row[1] != digest:
-                    db.execute("ROLLBACK"); raise ProvisioningError("operation_id_reuse_rejected", 409)
-                if row[2] == "COMPLETED":
-                    db.execute("COMMIT")
-                    return {"state": row[2], "operation_id": operation_id, "oid": row[3], "idempotent": True}
-                if row[2] not in {"PENDING", "RECOVERABLE"}:
-                    db.execute("COMMIT")
-                    return {"state": row[2], "operation_id": operation_id, "oid": row[3], "idempotent": True}
-            else:
-                db.execute("INSERT INTO refreshes VALUES(?,?,?,NULL)", (operation_id, digest, "PENDING"))
-            db.execute("COMMIT")
-            if new_operation:
-                self.grants.consume(token, binding, path)
-            current = self.projection.head(binding.repository, binding.branch)
-            if current != target_head_oid.lower():
-                self._state(operation_id, "STALE_TARGET")
-                raise ProvisioningError("stale_target_head", 409)
-            try:
-                oid = apply()
-                if not _is_oid(oid):
-                    raise ProvisioningError("apply_result_invalid", 500)
-                # Detect a competing remote advancement before claiming completion.
-                observed = self.projection.head(binding.repository, binding.branch)
-                if observed != oid.lower():
-                    self._state(operation_id, "RECONCILIATION_REQUIRED")
-                    raise ProvisioningError("remote_concurrent_advance", 409)
-                self._state(operation_id, "COMPLETED", oid)
-                self.audit.append({"operation_id": operation_id, "task_id": binding.task_id, "repository": binding.repository,
-                                   "branch": binding.branch, "actor_identity": binding.actor_identity, "audience": binding.audience, "path": path, "state": "COMPLETED"})
-                return {"state": "COMPLETED", "operation_id": operation_id, "oid": oid, "idempotent": False}
-            except ProvisioningError:
-                raise
-            except Exception as exc:
-                self._state(operation_id, "RECOVERABLE")
-                self.audit.append({"operation_id": operation_id, "task_id": binding.task_id, "repository": binding.repository,
-                                   "branch": binding.branch, "actor_identity": binding.actor_identity, "audience": binding.audience, "path": path, "state": "RECOVERABLE"})
-                raise ProvisioningError("refresh_apply_failed", 503) from exc
-
-    def _state(self, operation_id: str, state: str, oid: str | None = None) -> None:
-        with self._ledger() as db:
-            db.execute("UPDATE refreshes SET state=?, result_oid=COALESCE(?,result_oid) WHERE operation_id=?", (state, oid, operation_id))
-
-
-def _sandbox_preflight(state_dir: Path) -> int:
-    if os.environ.get("AIOS_GITOPS_WRITES_ENABLED") != "false":
-        raise ProvisioningError("global_gitops_writes_must_remain_disabled", 500)
-    state_dir.mkdir(parents=True, exist_ok=True)
-    audit = AppendOnlyAudit(state_dir / "preflight-audit.jsonl")
-    audit.append({"event": "SANDBOX_PREFLIGHT", "writes_enabled": False})
-    print(json.dumps({"status": "READY", "mode": "sandbox", "writes_enabled": False}, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--sandbox-preflight", action="store_true", required=True)
-    parser.add_argument("--state-dir", type=Path, required=True)
-    options = parser.parse_args()
-    raise SystemExit(_sandbox_preflight(options.state_dir))
@@ -1,310 +0,0 @@
-"""Fail-closed policy used only by the task-scoped Action writer."""
-from __future__ import annotations
-
-import os
-import json
-import stat
-import subprocess
-import re
-from pathlib import Path, PurePosixPath, PureWindowsPath
-from urllib.parse import unquote
-
-import isolated_writer_path_policy as path_policy
-
-WRITE_ENDPOINTS = frozenset({"/api/commit-file"})
-ALLOWED_ROOTS = (
-    "active-runtime",
-    "docs",
-    "patches",
-    "reports",
-    "scripts",
-    "test",
-    "tests",
-)
-DENIED_ROOTS = ("baseline", "config", "deploy", "deployments", "ops", "runtime", "services")
-_TRUE = frozenset({"1", "true", "yes", "on"})
-_FALSE = frozenset({"0", "false", "no", "off"})
-_DENY_FLAGS = (
-    "AIOS_GITOPS_ALLOW_MAIN_WRITE",
-    "AIOS_GITOPS_ALLOW_TAG_WRITE",
-    "AIOS_GITOPS_ALLOW_BASELINE_WRITE",
-    "AIOS_GITOPS_ALLOW_REGISTRY_WRITE",
-    "AIOS_GITOPS_ALLOW_ROLLBACK",
-    "AIOS_GITOPS_ALLOW_DEPLOYMENT",
-)
-
-
-def enforcement_required() -> bool:
-    return os.getenv("AIOS_GITOPS_ISOLATED_WRITER_ENFORCEMENT", "") == "required"
-
-
-def allowed_branch() -> str:
-    value = os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", "").strip()
-    if not value:
-        raise PermissionError("isolated_writer_missing_allowed_branch")
-    return value
-
-
-def allowed_base_oid() -> str:
-    value = os.getenv("AIOS_GITOPS_ALLOWED_BASE_OID", "").strip().lower()
-    if len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
-        raise PermissionError("isolated_writer_invalid_allowed_base_oid")
-    return value
-
-
-def _git(workspace: Path, *args: str) -> str:
-    result = subprocess.run(["git", *args], cwd=workspace, text=True, capture_output=True)
-    if result.returncode != 0:
-        raise PermissionError("isolated_writer_git_validation_failed")
-    return result.stdout.strip()
-
-
-def require_service_invariants(workspace: Path, bare_repo: Path) -> None:
-    if not enforcement_required():
-        return
-    if os.getenv("AIOS_GITOPS_WRITES_ENABLED", "").strip().lower() not in _TRUE:
-        raise PermissionError("isolated_writer_write_gate_required")
-    if os.getenv("AIOS_GITOPS_RUNTIME_ROLE", "") != "isolated-writer":
-        raise PermissionError("isolated_writer_role_required")
-    if os.getenv("AIOS_GITOPS_WORKSPACE_ROLE", "") != "isolated-writer":
-        raise PermissionError("isolated_writer_workspace_role_required")
-    if os.getenv("AIOS_GITOPS_TOKEN_POLICY_VERSION_REQUIRED", "") != "2":
-        raise PermissionError("isolated_writer_token_policy_v2_required")
-    if not os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", "").strip():
-        raise PermissionError("isolated_writer_service_audience_required")
-    if not os.getenv("AIOS_GITOPS_TOKEN_REGISTRY_V2", "").strip():
-        raise PermissionError("isolated_writer_token_registry_required")
-    if not os.getenv("AIOS_GITOPS_WRITER_OPERATION_LEDGER", "").strip():
-        raise PermissionError("isolated_writer_operation_ledger_required")
-    path_policy.configured_path_policy()
-    for name in _DENY_FLAGS:
-        if os.getenv(name, "").strip().lower() not in _FALSE:
-            raise PermissionError("isolated_writer_forbidden_capability_flag")
-    if os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "") != "aios/aios":
-        raise PermissionError("isolated_writer_repository_identity_rejected")
-    configured_bare_value = os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "").strip()
-    if not configured_bare_value:
-        raise PermissionError("isolated_writer_authoritative_repo_rejected")
-    configured_bare = Path(configured_bare_value)
-    if configured_bare.resolve(strict=True) != bare_repo.resolve(strict=True):
-        raise PermissionError("isolated_writer_authoritative_repo_rejected")
-    writer_root_value = os.getenv("AIOS_GITOPS_APPROVED_WRITER_ROOT", "").strip()
-    if not writer_root_value:
-        raise PermissionError("isolated_writer_workspace_outside_approved_root")
-    writer_root = Path(writer_root_value).resolve(strict=True)
-    lexical_workspace = Path(os.path.abspath(str(workspace)))
-    canonical_workspace = lexical_workspace.resolve(strict=True)
-    if lexical_workspace != canonical_workspace:
-        raise PermissionError("isolated_writer_workspace_symlink_rejected")
-    try:
-        canonical_workspace.relative_to(writer_root)
-    except (ValueError, FileNotFoundError):
-        raise PermissionError("isolated_writer_workspace_outside_approved_root") from None
-    if _git(workspace, "rev-parse", "--abbrev-ref", "HEAD") != allowed_branch():
-        raise PermissionError("isolated_writer_current_branch_rejected")
-    approved_base = allowed_base_oid()
-    try:
-        _git(workspace, "cat-file", "-e", f"{approved_base}^{{commit}}")
-        subprocess.run(
-            ["git", "merge-base", "--is-ancestor", approved_base, "HEAD"],
-            cwd=workspace,
-            check=True,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-        )
-    except (PermissionError, subprocess.CalledProcessError):
-        raise PermissionError("isolated_writer_approved_base_not_ancestor") from None
-    if _git(workspace, "merge-base", approved_base, "HEAD") != approved_base:
-        raise PermissionError("isolated_writer_merge_base_rejected")
-    common = Path(_git(workspace, "rev-parse", "--git-common-dir"))
-    if not common.is_absolute():
-        common = (workspace / common).resolve()
-    if common.resolve() != bare_repo.resolve():
-        raise PermissionError("isolated_writer_common_repo_rejected")
-
-
-def approved_audit_log_path() -> Path:
-    root_value = os.getenv("AIOS_GITOPS_APPROVED_AUDIT_ROOT", "").strip()
-    log_value = os.getenv("AIOS_GITOPS_AUDIT_LOG", "").strip()
-    if not root_value or not log_value:
-        raise PermissionError("isolated_writer_audit_path_missing")
-    lexical_root = Path(os.path.abspath(root_value))
-    lexical_log = Path(os.path.abspath(log_value))
-    root = lexical_root.resolve(strict=True)
-    if lexical_root != root or root.is_symlink() or not root.is_dir():
-        raise PermissionError("isolated_writer_audit_root_rejected")
-    try:
-        lexical_log.relative_to(root)
-    except ValueError:
-        raise PermissionError("isolated_writer_audit_path_outside_approved_root") from None
-    if lexical_log.parent.resolve(strict=True) != lexical_log.parent:
-        raise PermissionError("isolated_writer_audit_parent_symlink_rejected")
-    if lexical_log.exists() and lexical_log.is_symlink():
-        raise PermissionError("isolated_writer_audit_log_symlink_rejected")
-    os.chmod(root, 0o750)
-    os.chmod(lexical_log.parent, 0o750)
-    return lexical_log
-
-
-def append_audit_record(record: dict) -> None:
-    path = approved_audit_log_path()
-    flags = os.O_WRONLY | os.O_APPEND | os.O_CREAT
-    if hasattr(os, "O_NOFOLLOW"):
-        flags |= os.O_NOFOLLOW
-    descriptor = os.open(path, flags, 0o600)
-    try:
-        info = os.fstat(descriptor)
-        if not stat.S_ISREG(info.st_mode):
-            raise PermissionError("isolated_writer_audit_log_not_regular")
-        os.fchmod(descriptor, 0o600)
-        line = json.dumps(
-            _audit_sanitize(record),
-            ensure_ascii=False,
-            sort_keys=True,
-            separators=(",", ":"),
-        ).encode("utf-8") + b"\n"
-        os.write(descriptor, line)
-        os.fsync(descriptor)
-    finally:
-        os.close(descriptor)
-    parent_fd = os.open(path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
-    try:
-        os.fsync(parent_fd)
-    finally:
-        os.close(parent_fd)
-
-
-def _audit_sanitize(value):
-    if isinstance(value, dict):
-        return {
-            key: (
-                "[REDACTED]"
-                if any(
-                    marker in str(key).lower()
-                    for marker in (
-                        "authorization",
-                        "credential",
-                        "password",
-                        "secret",
-                        "token",
-                        "private_key",
-                    )
-                )
-                and str(key).lower() != "token_id"
-                else _audit_sanitize(inner)
-            )
-            for key, inner in value.items()
-        }
-    if isinstance(value, list):
-        return [_audit_sanitize(item) for item in value]
-    if isinstance(value, str) and re.search(
-        r"(?i)(authorization\s*:\s*bearer|(?:token|password|secret)\s*[:=])",
-        value,
-    ):
-        return "[REDACTED]"
-    return value
-
-
-def validate_endpoint(method: str, path: str, workspace: Path, bare_repo: Path) -> None:
-    if not enforcement_required():
-        return
-    if method != "POST" or path not in WRITE_ENDPOINTS:
-        raise PermissionError("isolated_writer_operation_forbidden")
-    require_service_invariants(workspace, bare_repo)
-
-
-def validate_branch_request(data: dict) -> None:
-    if not enforcement_required():
-        return
-    branch = allowed_branch() if "branch" not in data else str(data.get("branch") or "").strip()
-    if branch != allowed_branch():
-        raise PermissionError("isolated_writer_branch_rejected")
-    if str(data.get("base", "main")).strip() != "main":
-        raise PermissionError("isolated_writer_base_rejected")
-    if data.get("force") or data.get("force_push"):
-        raise PermissionError("isolated_writer_force_rejected")
-
-
-def validate_path(path: str, workspace: Path | None = None) -> str:
-    if not isinstance(path, str):
-        raise PermissionError("isolated_writer_path_rejected")
-    value = path
-    if not value or value != value.strip() or "\x00" in value or "\\" in value:
-        raise PermissionError("isolated_writer_path_rejected")
-    try:
-        decoded = unquote(value, errors="strict")
-    except (UnicodeDecodeError, ValueError):
-        raise PermissionError("isolated_writer_path_rejected") from None
-    if decoded != value:
-        raise PermissionError("isolated_writer_path_rejected")
-    windows = PureWindowsPath(value)
-    posix = PurePosixPath(value)
-    parts = value.split("/")
-    if (
-        posix.is_absolute()
-        or windows.is_absolute()
-        or bool(windows.drive)
-        or any(part in {"", ".", ".."} for part in parts)
-    ):
-        raise PermissionError("isolated_writer_path_rejected")
-    first = parts[0]
-    service_exact_path = False
-    if first in DENIED_ROOTS:
-        try:
-            path_policy.require_service_path("commit_file.atomic", value)
-            service_exact_path = True
-        except path_policy.PathPolicyError as exc:
-            raise PermissionError(str(exc)) from None
-    if value != "README.md" and first not in ALLOWED_ROOTS and not service_exact_path:
-        raise PermissionError("isolated_writer_path_outside_allowed_roots")
-    if workspace is not None:
-        lexical_root = Path(os.path.abspath(str(workspace)))
-        root = lexical_root.resolve(strict=True)
-        if lexical_root != root:
-            raise PermissionError("isolated_writer_workspace_symlink_rejected")
-        current = root
-        for part in parts:
-            current = current / part
-            if current.is_symlink():
-                raise PermissionError("isolated_writer_path_symlink_rejected")
-        candidate = (root / value).resolve(strict=False)
-        try:
-            candidate.relative_to(root)
-        except ValueError:
-            raise PermissionError("isolated_writer_path_escapes_workspace") from None
-    return value
-
-
-def validate_content_for_path(path: str, content: str) -> None:
-    if path.split("/", 1)[0] not in DENIED_ROOTS:
-        return
-    try:
-        path_policy.validate_content("commit_file.atomic", path, content)
-    except path_policy.PathPolicyError as exc:
-        raise PermissionError(str(exc)) from None
-
-
-def configured_path_policy_sha256() -> str | None:
-    try:
-        return path_policy.configured_path_policy_sha256()
-    except path_policy.PathPolicyError as exc:
-        raise PermissionError(str(exc)) from None
-
-
-def validate_commit_paths(paths: list[str], workspace: Path | None = None) -> None:
-    if enforcement_required():
-        for path in paths:
-            if str(path).strip() != ".":
-                validate_path(str(path), workspace)
-
-
-def validate_staged_paths(workspace: Path) -> None:
-    if not enforcement_required():
-        return
-    for path in _git(workspace, "diff", "--cached", "--name-only").splitlines():
-        validate_path(path, workspace)
-
-
-def validate_sync_branch(branch: str) -> None:
-    if enforcement_required() and branch != allowed_branch():
-        raise PermissionError("isolated_writer_sync_branch_rejected")
@@ -0,0 +1,89 @@
+"""Append-only audit chain for AIOS V2R1."""
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+import sqlite3
+from typing import Any
+
+from .tenant_context import canonical_json, isoformat, require_ident
+
+
+class AuditLog:
+    def __init__(self, database: str | Path) -> None:
+        self.database = str(database)
+        with sqlite3.connect(self.database) as db:
+            db.execute("PRAGMA journal_mode=WAL")
+            db.execute(
+                """
+                CREATE TABLE IF NOT EXISTS audit_events (
+                    seq INTEGER PRIMARY KEY AUTOINCREMENT,
+                    tenant_id TEXT NOT NULL,
+                    trace_id TEXT NOT NULL,
+                    event_type TEXT NOT NULL,
+                    payload TEXT NOT NULL,
+                    previous_hash TEXT NOT NULL,
+                    event_hash TEXT NOT NULL UNIQUE,
+                    created_at TEXT NOT NULL
+                )
+                """
+            )
+
+    def append(self, *, tenant_id: str, trace_id: str, event_type: str, payload: dict[str, Any]) -> str:
+        tenant_id = require_ident("tenant_id", tenant_id, tenant=True)
+        trace_id = require_ident("trace_id", trace_id)
+        event_type = require_ident("event_type", event_type)
+        with sqlite3.connect(self.database) as db:
+            previous = db.execute(
+                "SELECT event_hash FROM audit_events ORDER BY seq DESC LIMIT 1"
+            ).fetchone()
+            previous_hash = previous[0] if previous else "GENESIS"
+            body = {
+                "tenant_id": tenant_id,
+                "trace_id": trace_id,
+                "event_type": event_type,
+                "payload": payload,
+                "previous_hash": previous_hash,
+                "created_at": isoformat(),
+            }
+            digest = hashlib.sha256(
+                canonical_json(body)
+            ).hexdigest()
+            db.execute(
+                "INSERT INTO audit_events VALUES(NULL,?,?,?,?,?,?,?)",
+                (
+                    tenant_id,
+                    trace_id,
+                    event_type,
+                    json.dumps(payload, ensure_ascii=False),
+                    previous_hash,
+                    digest,
+                    body["created_at"],
+                ),
+            )
+            return digest
+
+    def verify(self) -> bool:
+        previous = "GENESIS"
+        with sqlite3.connect(self.database) as db:
+            rows = db.execute(
+                "SELECT tenant_id,trace_id,event_type,payload,previous_hash,event_hash,created_at "
+                "FROM audit_events ORDER BY seq"
+            )
+            for row in rows:
+                body = {
+                    "tenant_id": row[0],
+                    "trace_id": row[1],
+                    "event_type": row[2],
+                    "payload": json.loads(row[3]),
+                    "previous_hash": row[4],
+                    "created_at": row[6],
+                }
+                if row[4] != previous:
+                    return False
+                digest = hashlib.sha256(canonical_json(body)).hexdigest()
+                if digest != row[5]:
+                    return False
+                previous = digest
+        return True
@@ -0,0 +1,73 @@
+"""AIOS V2R1 Tenant Cell lifecycle CLI primitives."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import json
+from pathlib import Path
+
+from .tenant_context import ValidationError, require_ident
+
+
+@dataclass(frozen=True)
+class CellRecord:
+    tenant_id: str
+    cell_id: str
+    version: str
+    state: str
+    config_digest: str
+    created_at: str
+
+
+class CellManager:
+    def __init__(self, registry: str | Path) -> None:
+        self.registry = Path(registry)
+        self.registry.parent.mkdir(parents=True, exist_ok=True)
+        if not self.registry.exists():
+            self.registry.write_text("{\"cells\":{}}\n", encoding="utf-8")
+
+    def _load(self) -> dict:
+        return json.loads(self.registry.read_text(encoding="utf-8"))
+
+    def _save(self, value: dict) -> None:
+        self.registry.write_text(
+            json.dumps(value, ensure_ascii=False, indent=2) + "\n",
+            encoding="utf-8",
+        )
+
+    def create(self, tenant_id: str, cell_id: str, version: str, digest: str) -> CellRecord:
+        tenant_id = require_ident("tenant_id", tenant_id, tenant=True)
+        cell_id = require_ident("cell_id", cell_id)
+        data = self._load()
+        if tenant_id in data["cells"]:
+            raise ValidationError("tenant already has a cell")
+        record = CellRecord(
+            tenant_id,
+            cell_id,
+            version,
+            "created",
+            digest,
+            datetime.now(timezone.utc).isoformat(),
+        )
+        data["cells"][tenant_id] = record.__dict__
+        self._save(data)
+        return record
+
+    def status(self, tenant_id: str) -> CellRecord:
+        data = self._load()
+        item = data["cells"].get(tenant_id)
+        if not item:
+            raise ValidationError("unknown tenant")
+        return CellRecord(**item)
+
+    def transition(self, tenant_id: str, state: str) -> CellRecord:
+        allowed = {"created", "starting", "healthy", "upgrading", "rollback", "failed"}
+        if state not in allowed:
+            raise ValidationError("invalid cell state")
+        data = self._load()
+        item = data["cells"].get(tenant_id)
+        if not item:
+            raise ValidationError("unknown tenant")
+        item["state"] = state
+        self._save(data)
+        return CellRecord(**item)
@@ -0,0 +1,48 @@
+"""aios-cell command implementation for V2R1 Cell lifecycle."""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from .cell_manager import CellManager
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="aios-cell")
+    parser.add_argument("registry")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    create = sub.add_parser("create")
+    create.add_argument("tenant_id")
+    create.add_argument("cell_id")
+    create.add_argument("version")
+    create.add_argument("digest")
+
+    status = sub.add_parser("status")
+    status.add_argument("tenant_id")
+
+    transition = sub.add_parser("transition")
+    transition.add_argument("tenant_id")
+    transition.add_argument("state")
+
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    manager = CellManager(args.registry)
+    if args.command == "create":
+        result = manager.create(args.tenant_id, args.cell_id, args.version, args.digest)
+    elif args.command == "status":
+        result = manager.status(args.tenant_id)
+    elif args.command == "transition":
+        result = manager.transition(args.tenant_id, args.state)
+    else:
+        return 2
+    print(json.dumps(result.__dict__, ensure_ascii=False, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -0,0 +1,106 @@
+"""OpenClaw Cell lifecycle adapter for AIOS V2R1."""
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass, field
+import json
+from pathlib import Path
+import subprocess
+from typing import Any, Mapping
+
+from .tenant_context import ValidationError, V2R1Error, require_ident
+
+
+@dataclass(frozen=True)
+class CellSpec:
+    tenant_id: str
+    image: str
+    runtime: str = "docker"
+    port: int | None = None
+    memory: str = "2g"
+    cpus: str = "2"
+    pids_limit: int = 512
+    network: str = "bridge"
+    env: tuple[str, ...] = field(default_factory=tuple)
+
+    def __post_init__(self) -> None:
+        require_ident("tenant_id", self.tenant_id, tenant=True)
+        if self.runtime not in {"docker", "podman"}:
+            raise ValidationError("unsupported runtime")
+        if not self.image:
+            raise ValidationError("image required")
+
+
+class OpenClawFleet:
+    def __init__(self, binary: str = "openclaw") -> None:
+        self.binary = binary
+
+    def _run(self, args: list[str]) -> dict[str, Any]:
+        proc = subprocess.run(
+            [self.binary, *args],
+            check=False,
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        if proc.returncode:
+            raise V2R1Error(proc.stderr.strip() or "openclaw command failed")
+        data = json.loads(proc.stdout or "{}")
+        if isinstance(data, dict):
+            return data
+        return {"result": data}
+
+    def create(self, spec: CellSpec) -> dict[str, Any]:
+        return self._run([
+            "fleet", "create", spec.tenant_id,
+            "--image", spec.image,
+            "--runtime", spec.runtime,
+            "--json",
+        ])
+
+    def status(self, tenant_id: str) -> dict[str, Any]:
+        require_ident("tenant_id", tenant_id, tenant=True)
+        return self._run(["fleet", "status", tenant_id, "--json"])
+
+    def doctor(self, tenant_id: str | None = None) -> dict[str, Any]:
+        args = ["fleet", "doctor"]
+        if tenant_id:
+            require_ident("tenant_id", tenant_id, tenant=True)
+            args.append(tenant_id)
+        args.append("--json")
+        return self._run(args)
+
+    def backup(self, tenant_id: str, output: str | Path) -> dict[str, Any]:
+        return self._run(["fleet", "backup", tenant_id, "--out", str(output), "--json"])
+
+    def restore(self, tenant_id: str, archive: str | Path) -> dict[str, Any]:
+        return self._run(["fleet", "restore", tenant_id, "--from", str(archive), "--json"])
+
+    def upgrade(self, tenant_id: str, image: str) -> dict[str, Any]:
+        return self._run(["fleet", "upgrade", tenant_id, "--image", image, "--json"])
+
+
+def load_inventory(path: str | Path) -> list[CellSpec]:
+    raw = json.loads(Path(path).read_text(encoding="utf-8"))
+    if raw.get("schema_version") != "aios.cells.v1":
+        raise ValidationError("invalid inventory schema")
+    result: list[CellSpec] = []
+    seen: set[str] = set()
+    for item in raw.get("cells", []):
+        spec = CellSpec(
+            tenant_id=item["tenant_id"],
+            image=item["image"],
+            runtime=item.get("runtime", "docker"),
+            port=item.get("port"),
+            env=tuple(item.get("env", [])),
+        )
+        if spec.tenant_id in seen:
+            raise ValidationError("duplicate tenant")
+        seen.add(spec.tenant_id)
+        result.append(spec)
+    if not result:
+        raise ValidationError("no cells")
+    return result
+
+
+def inventory_as_dict(items: list[CellSpec]) -> dict[str, Any]:
+    return {"schema_version": "aios.cells.v1", "cells": [asdict(x) for x in items]}
@@ -0,0 +1,142 @@
+"""Tenant-partitioned Hermes shared agent fabric primitives."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+import sqlite3
+from typing import Any
+
+from .tenant_context import (
+    CanonicalMessage,
+    ConflictError,
+    ScopeError,
+    ValidationError,
+    isoformat,
+    require_ident,
+)
+
+
+@dataclass(frozen=True)
+class FabricJob:
+    job_id: str
+    tenant_id: str
+    cell_id: str
+    profile_id: str
+    session_id: str
+    event_id: str
+    status: str = "queued"
+
+    def __post_init__(self) -> None:
+        for name in (
+            "job_id", "cell_id", "profile_id", "session_id", "event_id"
+        ):
+            require_ident(name, getattr(self, name))
+        require_ident("tenant_id", self.tenant_id, tenant=True)
+        if self.status not in {"queued", "running", "completed", "failed", "cancelled"}:
+            raise ValidationError("invalid job status")
+
+
+class HermesFabric:
+    """Shared scheduler storage with mandatory tenant partition keys."""
+
+    def __init__(self, database: str | Path) -> None:
+        self.database = str(database)
+        with sqlite3.connect(self.database) as db:
+            db.execute("PRAGMA journal_mode=WAL")
+            db.execute("PRAGMA synchronous=FULL")
+            db.execute(
+                """
+                CREATE TABLE IF NOT EXISTS fabric_jobs (
+                    job_id TEXT PRIMARY KEY,
+                    tenant_id TEXT NOT NULL,
+                    cell_id TEXT NOT NULL,
+                    profile_id TEXT NOT NULL,
+                    session_id TEXT NOT NULL,
+                    event_id TEXT NOT NULL UNIQUE,
+                    status TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    updated_at TEXT NOT NULL
+                )
+                """
+            )
+            db.execute(
+                "CREATE INDEX IF NOT EXISTS idx_fabric_tenant_queue "
+                "ON fabric_jobs(tenant_id, cell_id, status)"
+            )
+
+    def enqueue(
+        self,
+        *,
+        message: CanonicalMessage,
+        profile_id: str,
+    ) -> FabricJob:
+        profile_id = require_ident("profile_id", profile_id)
+        if not message.command_capable:
+            raise ScopeError("non-command events cannot create execution jobs")
+        if not message.is_authenticated_human_command:
+            raise ScopeError("only authenticated human commands can create jobs")
+        job = FabricJob(
+            job_id=f"job-{message.event_id}",
+            tenant_id=message.tenant_id,
+            cell_id=message.cell_id,
+            profile_id=profile_id,
+            session_id=message.session_id,
+            event_id=message.event_id,
+        )
+        now = isoformat()
+        conflict: ConflictError | None = None
+        try:
+            with sqlite3.connect(self.database) as db:
+                db.execute("PRAGMA journal_mode=WAL")
+                db.execute(
+                    "INSERT INTO fabric_jobs VALUES(?,?,?,?,?,?,?,?,?)",
+                    (
+                        job.job_id,
+                        job.tenant_id,
+                        job.cell_id,
+                        job.profile_id,
+                        job.session_id,
+                        job.event_id,
+                        job.status,
+                        now,
+                        now,
+                    ),
+                )
+        except sqlite3.IntegrityError:
+            conflict = ConflictError(
+                "fabric event already exists or violates queue uniqueness"
+            )
+        if conflict is not None:
+            raise conflict
+        return job
+
+    def claim(self, tenant_id: str, cell_id: str, profile_id: str) -> FabricJob | None:
+        require_ident("tenant_id", tenant_id, tenant=True)
+        require_ident("cell_id", cell_id)
+        require_ident("profile_id", profile_id)
+        with sqlite3.connect(self.database) as db:
+            db.execute("BEGIN IMMEDIATE")
+            row = db.execute(
+                "SELECT * FROM fabric_jobs WHERE tenant_id=? AND cell_id=? "
+                "AND profile_id=? AND status='queued' ORDER BY created_at LIMIT 1",
+                (tenant_id, cell_id, profile_id),
+            ).fetchone()
+            if not row:
+                db.commit()
+                return None
+            db.execute(
+                "UPDATE fabric_jobs SET status='running', updated_at=? WHERE job_id=?",
+                (isoformat(), row[0]),
+            )
+            db.commit()
+        return FabricJob(*row[:7])
+
+    def health(self) -> dict[str, Any]:
+        with sqlite3.connect(self.database) as db:
+            count = db.execute("SELECT count(*) FROM fabric_jobs").fetchone()[0]
+        return {
+            "component": "hermes_fabric",
+            "jobs": count,
+            "checked_at": datetime.now(timezone.utc).isoformat(),
+        }
@@ -0,0 +1,47 @@
+"""Hermes shared fabric profile isolation primitives."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+import os
+
+from .tenant_context import ValidationError, require_ident
+
+
+@dataclass(frozen=True)
+class HermesProfile:
+    tenant_id: str
+    cell_id: str
+    profile_id: str
+    hermes_home: Path
+    workspace: Path
+
+    def __post_init__(self) -> None:
+        require_ident("tenant_id", self.tenant_id, tenant=True)
+        for name in ("cell_id", "profile_id"):
+            require_ident(name, getattr(self, name))
+        if not self.hermes_home.is_absolute() or not self.workspace.is_absolute():
+            raise ValidationError("profile paths must be absolute")
+
+    @property
+    def environment(self) -> dict[str, str]:
+        return {
+            "HERMES_HOME": str(self.hermes_home),
+            "HOME": str(self.hermes_home),
+            "AIOS_TENANT_ID": self.tenant_id,
+            "AIOS_CELL_ID": self.cell_id,
+            "AIOS_PROFILE_ID": self.profile_id,
+        }
+
+    def prepare(self) -> None:
+        self.hermes_home.mkdir(parents=True, exist_ok=True)
+        self.workspace.mkdir(parents=True, exist_ok=True)
+        os.chmod(self.hermes_home, 0o700)
+        os.chmod(self.workspace, 0o700)
+
+    def assert_path_allowed(self, path: str | Path) -> None:
+        target = Path(path).resolve()
+        for root in (self.hermes_home.resolve(), self.workspace.resolve()):
+            if target == root or root in target.parents:
+                return
+        raise ValidationError("path escapes profile isolation boundary")
@@ -0,0 +1,241 @@
+"""Fail-closed identity binding for authenticated external ingress.
+
+External payload claims are not authority.  An HMAC-authenticated envelope is
+the sole factory for :class:`AuthenticatedPrincipal`; the resolver then checks
+every claim against the authoritative ``TenantRouter`` before the runtime signs
+an internal ``TenantContext``.
+
+B3 development adds ``disabled/enforced`` mode selection and a
+bridge-ingress / receipt-read dual credential for external-side splits.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+import enum
+import hashlib
+import hmac
+import re
+from typing import Any, Mapping, Sequence
+
+from .router import Route, TenantRouter
+from .tenant_context import ScopeError, ValidationError, canonical_json, require_ident
+
+
+_PROVENANCE = object()
+_SIGNATURE_RE = re.compile(r"^[0-9a-f]{64}$")
+_HEX_RE = re.compile(r"^[0-9a-f]+$", re.IGNORECASE)
+
+_SCOPE_FIELDS = (
+    "principal_id", "tenant_id", "cell_id", "channel",
+    "channel_account_id", "session_id", "message",
+)
+_SCOPE_FIELDS_RECEIPT = (
+    "principal_id", "tenant_id", "cell_id", "channel",
+    "channel_account_id", "session_id", "receipt", "message",
+)
+_ALLOWED_MESSAGE_FIELDS = frozenset({"agent_id", "type", "payload"})
+
+
+class AuthenticationError(ValidationError):
+    pass
+
+
+class IngressMode(enum.Enum):
+    DISABLED = "disabled"
+    ENFORCED = "enforced"
+
+
+@dataclass(frozen=True, init=False)
+class AuthenticatedPrincipal:
+    principal_id: str
+
+    def __init__(self, principal_id: str, *, _provenance: object) -> None:
+        if _provenance is not _PROVENANCE:
+            raise TypeError("AuthenticatedPrincipal is created by authenticated ingress only")
+        object.__setattr__(self, "principal_id", require_ident("principal_id", principal_id))
+
+    @classmethod
+    def _verified(cls, principal_id: str) -> "AuthenticatedPrincipal":
+        return cls(principal_id, _provenance=_PROVENANCE)
+
+
+@dataclass(frozen=True)
+class IdentityClaims:
+    tenant_id: str
+    cell_id: str
+    channel: str
+    channel_account_id: str
+    session_id: str
+
+    def __post_init__(self) -> None:
+        require_ident("tenant_id", self.tenant_id, tenant=True)
+        for field in ("cell_id", "channel", "channel_account_id", "session_id"):
+            require_ident(field, getattr(self, field))
+
+
+@dataclass(frozen=True)
+class BridgeIngressClaims:
+    tenant_id: str
+    cell_id: str
+    channel: str
+    channel_account_id: str
+    session_id: str
+    receipt: str
+
+    def __post_init__(self) -> None:
+        require_ident("tenant_id", self.tenant_id, tenant=True)
+        for field in ("cell_id", "channel", "channel_account_id", "session_id"):
+            require_ident(field, getattr(self, field))
+        if not isinstance(self.receipt, str) or not self.receipt:
+            raise ValidationError("bridge ingress receipt must be a non-empty string")
+
+
+@dataclass(frozen=True)
+class AuthenticatedIngress:
+    principal: AuthenticatedPrincipal
+    claims: IdentityClaims
+    message: Mapping[str, Any]
+
+
+@dataclass(frozen=True)
+class BridgeAuthenticatedIngress:
+    principal: AuthenticatedPrincipal
+    claims: BridgeIngressClaims
+    message: Mapping[str, Any]
+
+
+@dataclass(frozen=True)
+class RuntimeIdentity:
+    tenant_id: str
+    cell_id: str
+    principal_id: str
+    channel: str
+    channel_account_id: str
+    session_id: str
+
+
+class IngressAuthenticator:
+    def __init__(self, hmac_key: bytes, *, mode: IngressMode = IngressMode.ENFORCED) -> None:
+        if not isinstance(hmac_key, bytes) or len(hmac_key) < 32:
+            raise ValidationError("ingress HMAC key must be at least 32 bytes")
+        self._hmac_key = hmac_key
+        self._mode = mode
+
+    @staticmethod
+    def _signed_payload(request: Mapping[str, Any]) -> dict[str, Any]:
+        if not isinstance(request, Mapping):
+            raise ValidationError("ingress request must be an object")
+        if set(request) != {*_SCOPE_FIELDS, "signature"}:
+            raise ValidationError("ingress request fields are invalid")
+        values = {field: request[field] for field in _SCOPE_FIELDS}
+        if not isinstance(values["message"], Mapping):
+            raise ValidationError("ingress message must be an object")
+        return values
+
+    @staticmethod
+    def _bridge_signed_payload(request: Mapping[str, Any]) -> dict[str, Any]:
+        if not isinstance(request, Mapping):
+            raise ValidationError("bridge ingress request must be an object")
+        allowed = {*_SCOPE_FIELDS_RECEIPT, "signature"}
+        if set(request) != allowed:
+            raise ValidationError(
+                f"bridge ingress request fields are invalid; "
+                f"expected {sorted(allowed)}, got {sorted(request)}"
+            )
+        values = {field: request[field] for field in _SCOPE_FIELDS_RECEIPT}
+        if not isinstance(values["message"], Mapping):
+            raise ValidationError("bridge ingress message must be an object")
+        return values
+
+    def _verify(self, values: dict[str, Any], signature: str) -> None:
+        if not isinstance(signature, str) or not _SIGNATURE_RE.fullmatch(signature):
+            raise AuthenticationError("invalid ingress signature")
+        expected = hmac.new(
+            self._hmac_key, canonical_json(values), hashlib.sha256
+        ).hexdigest()
+        if not hmac.compare_digest(expected, signature):
+            raise AuthenticationError("invalid ingress signature")
+
+    def authenticate(self, request: Mapping[str, Any]) -> AuthenticatedIngress:
+        values = self._signed_payload(request)
+        signature = request["signature"]
+        if self._mode == IngressMode.ENFORCED:
+            self._verify(values, signature)
+        elif self._mode == IngressMode.DISABLED:
+            if not isinstance(signature, str) or not _SIGNATURE_RE.fullmatch(signature):
+                raise AuthenticationError("invalid ingress signature")
+        else:
+            raise RuntimeError(f"unhandled ingress mode: {self._mode}")
+        return AuthenticatedIngress(
+            principal=AuthenticatedPrincipal._verified(values["principal_id"]),
+            claims=IdentityClaims(
+                tenant_id=values["tenant_id"],
+                cell_id=values["cell_id"],
+                channel=values["channel"],
+                channel_account_id=values["channel_account_id"],
+                session_id=values["session_id"],
+            ),
+            message=dict(values["message"]),
+        )
+
+    def authenticate_bridge(self, request: Mapping[str, Any]) -> BridgeAuthenticatedIngress:
+        values = self._bridge_signed_payload(request)
+        signature = request["signature"]
+        if self._mode == IngressMode.ENFORCED:
+            self._verify(values, signature)
+        elif self._mode == IngressMode.DISABLED:
+            if not isinstance(signature, str) or not _SIGNATURE_RE.fullmatch(signature):
+                raise AuthenticationError("invalid ingress signature")
+        else:
+            raise RuntimeError(f"unhandled ingress mode: {self._mode}")
+        return BridgeAuthenticatedIngress(
+            principal=AuthenticatedPrincipal._verified(values["principal_id"]),
+            claims=BridgeIngressClaims(
+                tenant_id=values["tenant_id"],
+                cell_id=values["cell_id"],
+                channel=values["channel"],
+                channel_account_id=values["channel_account_id"],
+                session_id=values["session_id"],
+                receipt=values["receipt"],
+            ),
+            message=dict(values["message"]),
+        )
+
+class RuntimeIdentityResolver:
+    """Resolve authenticated ingress identity through ``TenantRouter`` only."""
+
+    def __init__(self, router: TenantRouter) -> None:
+        self._router = router
+
+    def resolve(
+        self, principal: AuthenticatedPrincipal, claims: IdentityClaims
+    ) -> RuntimeIdentity:
+        if not isinstance(principal, AuthenticatedPrincipal):
+            raise AuthenticationError("untrusted principal type")
+        try:
+            route: Route = self._router.resolve(
+                channel=claims.channel,
+                channel_account_id=claims.channel_account_id,
+                principal_id=principal.principal_id,
+                session_id=claims.session_id,
+            )
+        except (ScopeError, ValidationError) as exc:
+            raise AuthenticationError("identity is not registered") from None
+        expected = (
+            claims.tenant_id, claims.cell_id, claims.channel,
+            claims.channel_account_id, principal.principal_id, claims.session_id,
+        )
+        actual = (
+            route.tenant_id, route.cell_id, route.channel,
+            route.channel_account_id, route.principal_id, route.session_id,
+        )
+        if actual != expected:
+            raise AuthenticationError("identity claims do not match authoritative route")
+        return RuntimeIdentity(
+            tenant_id=route.tenant_id,
+            cell_id=route.cell_id,
+            principal_id=route.principal_id,
+            channel=route.channel,
+            channel_account_id=route.channel_account_id,
+            session_id=route.session_id or "",
+        )
@@ -0,0 +1,60 @@
+"""Tenant-scoped memory namespace and access policy for AIOS V2R1."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import PurePosixPath
+from typing import Literal
+
+from .tenant_context import ScopeError, ValidationError, require_ident
+
+
+MemoryKind = Literal["session", "profile", "cell", "tenant", "shared_artifact"]
+
+
+@dataclass(frozen=True)
+class MemoryScope:
+    tenant_id: str
+    cell_id: str
+    profile_id: str
+    session_id: str | None
+    kind: MemoryKind
+
+    def __post_init__(self) -> None:
+        require_ident("tenant_id", self.tenant_id, tenant=True)
+        for name in ("cell_id", "profile_id"):
+            require_ident(name, getattr(self, name))
+        if self.session_id is not None:
+            require_ident("session_id", self.session_id)
+        if self.kind not in {"session", "profile", "cell", "tenant", "shared_artifact"}:
+            raise ValidationError("invalid memory kind")
+        if self.kind == "session" and self.session_id is None:
+            raise ValidationError("session memory requires session_id")
+
+    @property
+    def namespace(self) -> str:
+        parts = ["tenant", self.tenant_id, "cell", self.cell_id]
+        if self.kind in {"profile", "session"}:
+            parts.extend(["profile", self.profile_id])
+        if self.kind == "session":
+            parts.extend(["session", str(self.session_id)])
+        parts.extend(["memory", self.kind])
+        return str(PurePosixPath(*parts))
+
+    def assert_access(self, requested: "MemoryScope", *, write: bool = False) -> None:
+        if self.tenant_id != requested.tenant_id:
+            raise ScopeError("cross-tenant memory access denied")
+        if self.cell_id != requested.cell_id:
+            raise ScopeError("cross-cell memory access denied")
+        if requested.kind == "shared_artifact":
+            if write:
+                raise ScopeError("shared artifacts are immutable")
+            return
+        if self.profile_id != requested.profile_id and requested.kind in {"profile", "session"}:
+            raise ScopeError("cross-profile memory access denied")
+        if requested.kind == "session" and self.session_id != requested.session_id:
+            raise ScopeError("cross-session memory access denied")
+
+
+def qualify_memory_key(scope: MemoryScope, key: str) -> str:
+    key = require_ident("memory_key", key)
+    return f"{scope.namespace}/{key}"
@@ -0,0 +1,172 @@
+"""Tenant-scoped append-only message ledger and exact quote resolver."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import timedelta
+import os
+from pathlib import Path
+import sqlite3
+from typing import Iterable
+
+from .tenant_context import (
+    CanonicalMessage,
+    ConflictError,
+    ScopeError,
+    ValidationError,
+    isoformat,
+    normalize_message_id,
+    parse_time,
+    utc_now,
+)
+
+
+@dataclass(frozen=True)
+class LedgerRecord:
+    tenant_id: str
+    cell_id: str
+    channel: str
+    channel_account_id: str
+    peer_id: str
+    direction: str
+    message_id: str
+    event_id: str
+    body: str
+    occurred_at: str
+    expires_at: str
+
+
+class MessageLedger:
+    """Exact-ID ledger.
+
+    The resolver never uses time windows, prefixes, similarity, or nearest-message
+    fallbacks. Ambiguity and absence fail closed.
+    """
+
+    def __init__(self, database: str | Path, *, ttl_days: int = 7) -> None:
+        if not 1 <= ttl_days <= 365:
+            raise ValidationError("ttl_days must be between 1 and 365")
+        self.database = Path(database)
+        self.ttl_days = ttl_days
+        self.database.parent.mkdir(parents=True, exist_ok=True)
+        self._initialize()
+        try:
+            os.chmod(self.database, 0o600)
+        except OSError:
+            pass
+
+    def _connect(self) -> sqlite3.Connection:
+        db = sqlite3.connect(str(self.database), timeout=30)
+        db.row_factory = sqlite3.Row
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        db.execute("PRAGMA busy_timeout=30000")
+        return db
+
+    def _initialize(self) -> None:
+        with self._connect() as db:
+            db.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS message_ledger (
+                    tenant_id TEXT NOT NULL,
+                    cell_id TEXT NOT NULL,
+                    channel TEXT NOT NULL,
+                    channel_account_id TEXT NOT NULL,
+                    peer_id TEXT NOT NULL,
+                    direction TEXT NOT NULL CHECK(direction IN ('inbound','outbound','internal')),
+                    message_id TEXT NOT NULL,
+                    event_id TEXT NOT NULL,
+                    body TEXT NOT NULL,
+                    occurred_at TEXT NOT NULL,
+                    expires_at TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    PRIMARY KEY(
+                      tenant_id, cell_id, channel, channel_account_id,
+                      peer_id, direction, message_id
+                    ),
+                    UNIQUE(tenant_id, cell_id, event_id)
+                );
+                CREATE INDEX IF NOT EXISTS idx_message_reply_lookup ON message_ledger(
+                    tenant_id, cell_id, channel, channel_account_id,
+                    peer_id, message_id, expires_at
+                );
+                """
+            )
+
+    def remember(self, message: CanonicalMessage) -> LedgerRecord:
+        message_id = normalize_message_id(message.message_id)
+        now = utc_now()
+        expires = isoformat(now + timedelta(days=self.ttl_days))
+        key = (
+            message.tenant_id,
+            message.cell_id,
+            message.channel,
+            message.channel_account_id,
+            message.peer_id,
+            message.direction,
+            message_id,
+        )
+        with self._connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            existing = db.execute(
+                "SELECT event_id, body, occurred_at, expires_at FROM message_ledger "
+                "WHERE tenant_id=? AND cell_id=? AND channel=? AND channel_account_id=? "
+                "AND peer_id=? AND direction=? AND message_id=?",
+                key,
+            ).fetchone()
+            if existing:
+                if existing["event_id"] != message.event_id or existing["body"] != message.body:
+                    db.rollback()
+                    raise ConflictError("message ID collision with different content")
+                db.commit()
+                return LedgerRecord(*key, existing["event_id"], existing["body"], existing["occurred_at"], existing["expires_at"])
+            db.execute(
+                "INSERT INTO message_ledger VALUES(?,?,?,?,?,?,?,?,?,?,?,?)",
+                (*key, message.event_id, message.body, message.occurred_at, expires, isoformat(now)),
+            )
+            db.commit()
+        return LedgerRecord(*key, message.event_id, message.body, message.occurred_at, expires)
+
+    def resolve_quote(self, message: CanonicalMessage) -> str:
+        if message.quoted_body is not None:
+            return message.quoted_body
+        if message.reply_to_message_id is None:
+            raise ScopeError("quoted_text_unavailable")
+        reply_id = normalize_message_id(
+            message.reply_to_message_id,
+            field_name="reply_to_message_id",
+        )
+        with self._connect() as db:
+            rows = db.execute(
+                "SELECT direction, body, event_id FROM message_ledger "
+                "WHERE tenant_id=? AND cell_id=? AND channel=? AND channel_account_id=? "
+                "AND peer_id=? AND message_id=? AND expires_at>?",
+                (
+                    message.tenant_id,
+                    message.cell_id,
+                    message.channel,
+                    message.channel_account_id,
+                    message.peer_id,
+                    reply_id,
+                    isoformat(),
+                ),
+            ).fetchall()
+        if len(rows) == 1:
+            return str(rows[0]["body"])
+        if len(rows) > 1:
+            raise ConflictError("ambiguous reply ID across message directions")
+        raise ScopeError("quoted_text_unavailable")
+
+    def purge_expired(self) -> int:
+        with self._connect() as db:
+            cursor = db.execute(
+                "DELETE FROM message_ledger WHERE expires_at<=?", (isoformat(),)
+            )
+            return cursor.rowcount
+
+    def integrity_check(self) -> str:
+        with self._connect() as db:
+            return str(db.execute("PRAGMA integrity_check").fetchone()[0])
+
+    def count(self) -> int:
+        with self._connect() as db:
+            return int(db.execute("SELECT count(*) FROM message_ledger").fetchone()[0])
@@ -0,0 +1,335 @@
+"""Authoritative tenant registry and fail-closed message router."""
+from __future__ import annotations
+
+from contextlib import contextmanager
+from dataclasses import dataclass
+from datetime import datetime, timedelta
+import sqlite3
+from pathlib import Path
+from typing import Callable, Iterator
+
+from .tenant_context import (
+    CanonicalMessage,
+    ConflictError,
+    ScopeError,
+    TenantContext,
+    ValidationError,
+    isoformat,
+    parse_time,
+    require_ident,
+    utc_now,
+)
+
+
+@dataclass(frozen=True)
+class Route:
+    tenant_id: str
+    cell_id: str
+    channel: str
+    channel_account_id: str
+    principal_id: str
+    session_id: str | None
+
+
+class TenantRouter:
+    """SQLite-backed routing registry.
+
+    Channel accounts are authoritative tenant ownership boundaries. Principal and
+    session bindings may narrow a route, but can never move traffic to another
+    tenant or Cell.
+    """
+
+    def __init__(
+        self, database: str | Path, *, clock: Callable[[], datetime] = utc_now
+    ) -> None:
+        self.database = str(database)
+        self._clock = clock
+        self._initialize()
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(self.database, timeout=30, isolation_level=None)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA foreign_keys=ON")
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        connection.execute("PRAGMA busy_timeout=30000")
+        return connection
+
+    @contextmanager
+    def _transaction(self) -> Iterator[sqlite3.Connection]:
+        connection = self._connect()
+        try:
+            connection.execute("BEGIN IMMEDIATE")
+            yield connection
+            connection.execute("COMMIT")
+        except Exception:
+            connection.execute("ROLLBACK")
+            raise
+        finally:
+            connection.close()
+
+    def _initialize(self) -> None:
+        with self._connect() as db:
+            db.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS tenants (
+                    tenant_id TEXT PRIMARY KEY,
+                    cell_id TEXT NOT NULL UNIQUE,
+                    status TEXT NOT NULL CHECK(status IN ('active','suspended','retired')),
+                    created_at TEXT NOT NULL,
+                    updated_at TEXT NOT NULL
+                );
+                CREATE TABLE IF NOT EXISTS channel_routes (
+                    channel TEXT NOT NULL,
+                    channel_account_id TEXT NOT NULL,
+                    tenant_id TEXT NOT NULL,
+                    cell_id TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    PRIMARY KEY(channel, channel_account_id),
+                    FOREIGN KEY(tenant_id) REFERENCES tenants(tenant_id)
+                );
+                CREATE TABLE IF NOT EXISTS principal_routes (
+                    channel TEXT NOT NULL,
+                    channel_account_id TEXT NOT NULL,
+                    principal_id TEXT NOT NULL,
+                    tenant_id TEXT NOT NULL,
+                    cell_id TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    PRIMARY KEY(channel, channel_account_id, principal_id),
+                    FOREIGN KEY(channel, channel_account_id)
+                      REFERENCES channel_routes(channel, channel_account_id)
+                );
+                CREATE TABLE IF NOT EXISTS session_bindings (
+                    tenant_id TEXT NOT NULL,
+                    session_id TEXT NOT NULL,
+                    cell_id TEXT NOT NULL,
+                    principal_id TEXT NOT NULL,
+                    expires_at TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    PRIMARY KEY(tenant_id, session_id),
+                    FOREIGN KEY(tenant_id) REFERENCES tenants(tenant_id)
+                );
+                CREATE INDEX IF NOT EXISTS idx_session_expiry
+                  ON session_bindings(expires_at);
+                """
+            )
+
+    def register_tenant(self, tenant_id: str, cell_id: str) -> None:
+        tenant_id = require_ident("tenant_id", tenant_id, tenant=True)
+        cell_id = require_ident("cell_id", cell_id)
+        now = isoformat(self._clock())
+        with self._transaction() as db:
+            row = db.execute(
+                "SELECT cell_id, status FROM tenants WHERE tenant_id=?", (tenant_id,)
+            ).fetchone()
+            if row:
+                if row["cell_id"] != cell_id:
+                    raise ConflictError("tenant already bound to another cell")
+                db.execute(
+                    "UPDATE tenants SET status='active', updated_at=? WHERE tenant_id=?",
+                    (now, tenant_id),
+                )
+                return
+            conflict = db.execute(
+                "SELECT tenant_id FROM tenants WHERE cell_id=?", (cell_id,)
+            ).fetchone()
+            if conflict:
+                raise ConflictError("cell already belongs to another tenant")
+            db.execute(
+                "INSERT INTO tenants VALUES(?,?,?,?,?)",
+                (tenant_id, cell_id, "active", now, now),
+            )
+
+    def set_tenant_status(self, tenant_id: str, status: str) -> None:
+        tenant_id = require_ident("tenant_id", tenant_id, tenant=True)
+        if status not in {"active", "suspended", "retired"}:
+            raise ValidationError("invalid tenant status")
+        with self._transaction() as db:
+            cursor = db.execute(
+                "UPDATE tenants SET status=?, updated_at=? WHERE tenant_id=?",
+                (status, isoformat(self._clock()), tenant_id),
+            )
+            if cursor.rowcount != 1:
+                raise ValidationError("unknown tenant")
+
+    def bind_channel(
+        self,
+        *,
+        tenant_id: str,
+        channel: str,
+        channel_account_id: str,
+    ) -> None:
+        tenant_id = require_ident("tenant_id", tenant_id, tenant=True)
+        channel = require_ident("channel", channel)
+        channel_account_id = require_ident("channel_account_id", channel_account_id)
+        with self._transaction() as db:
+            tenant = db.execute(
+                "SELECT cell_id, status FROM tenants WHERE tenant_id=?", (tenant_id,)
+            ).fetchone()
+            if not tenant or tenant["status"] != "active":
+                raise ValidationError("tenant is not active")
+            existing = db.execute(
+                "SELECT tenant_id, cell_id FROM channel_routes "
+                "WHERE channel=? AND channel_account_id=?",
+                (channel, channel_account_id),
+            ).fetchone()
+            if existing:
+                if existing["tenant_id"] != tenant_id or existing["cell_id"] != tenant["cell_id"]:
+                    raise ConflictError("channel account already belongs to another tenant")
+                return
+            db.execute(
+                "INSERT INTO channel_routes VALUES(?,?,?,?,?)",
+                (channel, channel_account_id, tenant_id, tenant["cell_id"], isoformat(self._clock())),
+            )
+
+    def bind_principal(
+        self,
+        *,
+        tenant_id: str,
+        channel: str,
+        channel_account_id: str,
+        principal_id: str,
+    ) -> None:
+        principal_id = require_ident("principal_id", principal_id)
+        route = self.resolve_channel(channel, channel_account_id)
+        if route.tenant_id != tenant_id:
+            raise ScopeError("principal cannot cross tenant boundary")
+        with self._transaction() as db:
+            existing = db.execute(
+                "SELECT tenant_id, cell_id FROM principal_routes WHERE "
+                "channel=? AND channel_account_id=? AND principal_id=?",
+                (channel, channel_account_id, principal_id),
+            ).fetchone()
+            if existing:
+                if existing["tenant_id"] != tenant_id or existing["cell_id"] != route.cell_id:
+                    raise ConflictError("principal route conflict")
+                return
+            db.execute(
+                "INSERT INTO principal_routes VALUES(?,?,?,?,?,?)",
+                (
+                    channel,
+                    channel_account_id,
+                    principal_id,
+                    tenant_id,
+                    route.cell_id,
+                    isoformat(self._clock()),
+                ),
+            )
+
+    def bind_session(
+        self,
+        *,
+        tenant_id: str,
+        session_id: str,
+        cell_id: str,
+        principal_id: str,
+        ttl_seconds: int = 86400,
+    ) -> None:
+        tenant_id = require_ident("tenant_id", tenant_id, tenant=True)
+        session_id = require_ident("session_id", session_id)
+        cell_id = require_ident("cell_id", cell_id)
+        principal_id = require_ident("principal_id", principal_id)
+        if not 60 <= ttl_seconds <= 31 * 86400:
+            raise ValidationError("invalid session TTL")
+        now = self._clock()
+        expires = isoformat(now + timedelta(seconds=ttl_seconds))
+        with self._transaction() as db:
+            tenant = db.execute(
+                "SELECT cell_id, status FROM tenants WHERE tenant_id=?", (tenant_id,)
+            ).fetchone()
+            if not tenant or tenant["status"] != "active" or tenant["cell_id"] != cell_id:
+                raise ScopeError("session cell does not match tenant")
+            existing = db.execute(
+                "SELECT cell_id, principal_id FROM session_bindings "
+                "WHERE tenant_id=? AND session_id=?",
+                (tenant_id, session_id),
+            ).fetchone()
+            if existing and (
+                existing["cell_id"] != cell_id or existing["principal_id"] != principal_id
+            ):
+                raise ConflictError("session is already bound to another principal or cell")
+            db.execute(
+                "INSERT INTO session_bindings VALUES(?,?,?,?,?,?) "
+                "ON CONFLICT(tenant_id,session_id) DO UPDATE SET expires_at=excluded.expires_at",
+                (tenant_id, session_id, cell_id, principal_id, expires, isoformat(now)),
+            )
+
+    def resolve_channel(self, channel: str, channel_account_id: str) -> Route:
+        channel = require_ident("channel", channel)
+        channel_account_id = require_ident("channel_account_id", channel_account_id)
+        with self._connect() as db:
+            row = db.execute(
+                "SELECT r.tenant_id, r.cell_id, t.status FROM channel_routes r "
+                "JOIN tenants t ON t.tenant_id=r.tenant_id "
+                "WHERE r.channel=? AND r.channel_account_id=?",
+                (channel, channel_account_id),
+            ).fetchone()
+        if not row:
+            raise ScopeError("unknown channel account")
+        if row["status"] != "active":
+            raise ScopeError("tenant is not active")
+        return Route(row["tenant_id"], row["cell_id"], channel, channel_account_id, "", None)
+
+    def resolve(
+        self,
+        *,
+        channel: str,
+        channel_account_id: str,
+        principal_id: str,
+        session_id: str | None = None,
+    ) -> Route:
+        principal_id = require_ident("principal_id", principal_id)
+        base = self.resolve_channel(channel, channel_account_id)
+        with self._connect() as db:
+            principal = db.execute(
+                "SELECT tenant_id, cell_id FROM principal_routes WHERE "
+                "channel=? AND channel_account_id=? AND principal_id=?",
+                (channel, channel_account_id, principal_id),
+            ).fetchone()
+            if principal and (
+                principal["tenant_id"] != base.tenant_id or principal["cell_id"] != base.cell_id
+            ):
+                raise ScopeError("principal route violates channel ownership")
+            if session_id is not None:
+                session_id = require_ident("session_id", session_id)
+                session = db.execute(
+                    "SELECT cell_id, principal_id, expires_at FROM session_bindings "
+                    "WHERE tenant_id=? AND session_id=?",
+                    (base.tenant_id, session_id),
+                ).fetchone()
+                if not session:
+                    raise ScopeError("unknown session")
+                if parse_time(session["expires_at"]) <= self._clock():
+                    raise ScopeError("session expired")
+                if session["cell_id"] != base.cell_id or session["principal_id"] != principal_id:
+                    raise ScopeError("session scope mismatch")
+        return Route(
+            base.tenant_id,
+            base.cell_id,
+            channel,
+            channel_account_id,
+            principal_id,
+            session_id,
+        )
+
+    def assert_message_route(self, message: CanonicalMessage) -> Route:
+        route = self.resolve(
+            channel=message.channel,
+            channel_account_id=message.channel_account_id,
+            principal_id=message.principal_id,
+            session_id=message.session_id,
+        )
+        if message.tenant_id != route.tenant_id or message.cell_id != route.cell_id:
+            raise ScopeError("message claims do not match authoritative route")
+        return route
+
+    def assert_context_route(self, context: TenantContext) -> Route:
+        route = self.resolve(
+            channel=context.channel,
+            channel_account_id=context.channel_account_id,
+            principal_id=context.principal_id,
+            session_id=context.session_id,
+        )
+        if context.tenant_id != route.tenant_id or context.cell_id != route.cell_id:
+            raise ScopeError("context claims do not match authoritative route")
+        return route
@@ -0,0 +1,33 @@
+"""Tenant and Cell scoped secret reference model.
+
+This module never stores secret values. It stores ownership and retrieval scope
+metadata for integration with a real secret broker.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Literal
+
+from .tenant_context import ValidationError, require_ident
+
+
+@dataclass(frozen=True)
+class SecretRef:
+    secret_id: str
+    tenant_id: str
+    cell_id: str
+    kind: Literal["channel", "model", "tool", "runtime"]
+    version: str
+    broker_path: str
+
+    def __post_init__(self) -> None:
+        for name in ("secret_id", "cell_id", "version"):
+            require_ident(name, getattr(self, name))
+        require_ident("tenant_id", self.tenant_id, tenant=True)
+        if self.kind not in {"channel", "model", "tool", "runtime"}:
+            raise ValidationError("invalid secret kind")
+        if not self.broker_path.startswith("secret://"):
+            raise ValidationError("secret broker path required")
+
+    def can_be_used_by(self, *, tenant_id: str, cell_id: str) -> bool:
+        return self.tenant_id == tenant_id and self.cell_id == cell_id
@@ -0,0 +1,316 @@
+"""Signed tenant context and canonical message contract for AIOS V2R1."""
+from __future__ import annotations
+
+import base64
+from dataclasses import asdict, dataclass
+from datetime import datetime, timedelta, timezone
+import hashlib
+import hmac
+import json
+import re
+import secrets
+from typing import Any, Mapping
+
+VERSION = "V2R1C0"
+MAX_SAFE_INTEGER = 9_007_199_254_740_991
+TENANT_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$")
+IDENT_RE = re.compile(r"^[A-Za-z0-9](?:[A-Za-z0-9._:@-]{0,126}[A-Za-z0-9])?$")
+
+
+class V2R1Error(RuntimeError):
+    pass
+
+
+class ValidationError(V2R1Error):
+    pass
+
+
+class ScopeError(V2R1Error):
+    pass
+
+
+class ConflictError(V2R1Error):
+    pass
+
+
+def utc_now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def isoformat(value: datetime | None = None) -> str:
+    return (value or utc_now()).astimezone(timezone.utc).isoformat()
+
+
+def parse_time(value: str) -> datetime:
+    if not isinstance(value, str) or not value.strip():
+        raise ValidationError("timestamp must be a non-empty string")
+    text = value.strip()
+    if text.endswith("Z"):
+        text = text[:-1] + "+00:00"
+    try:
+        parsed = datetime.fromisoformat(text)
+    except ValueError as exc:
+        raise ValidationError(f"invalid timestamp: {value!r}") from exc
+    if parsed.tzinfo is None:
+        raise ValidationError("timestamp must include timezone")
+    return parsed.astimezone(timezone.utc)
+
+
+def require_ident(name: str, value: Any, *, tenant: bool = False) -> str:
+    if not isinstance(value, str):
+        raise ValidationError(f"{name} must be a string")
+    value = value.strip()
+    pattern = TENANT_RE if tenant else IDENT_RE
+    if not pattern.fullmatch(value):
+        raise ValidationError(f"invalid {name}: {value!r}")
+    return value
+
+
+def normalize_message_id(value: Any, *, field_name: str = "message_id") -> str:
+    if isinstance(value, bool):
+        raise ValidationError(f"{field_name} cannot be boolean")
+    if isinstance(value, str):
+        value = value.strip()
+        if not value or len(value) > 256 or any(ord(ch) < 32 for ch in value):
+            raise ValidationError(f"invalid {field_name}")
+        return value
+    if isinstance(value, int):
+        if abs(value) > MAX_SAFE_INTEGER:
+            raise ValidationError(f"{field_name} is an unsafe numeric ID")
+        return str(value)
+    raise ValidationError(f"{field_name} must be a lossless string or safe integer")
+
+
+def canonical_json(value: Any) -> bytes:
+    return json.dumps(
+        value, ensure_ascii=False, separators=(",", ":"), sort_keys=True
+    ).encode("utf-8")
+
+
+def _b64(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _unb64(value: str) -> bytes:
+    return base64.urlsafe_b64decode(value + "=" * (-len(value) % 4))
+
+
+@dataclass(frozen=True)
+class TenantContext:
+    tenant_id: str
+    cell_id: str
+    principal_id: str
+    principal_type: str
+    session_id: str
+    task_id: str | None
+    channel: str
+    channel_account_id: str
+    issued_at: str
+    expires_at: str
+    nonce: str
+
+    def __post_init__(self) -> None:
+        require_ident("tenant_id", self.tenant_id, tenant=True)
+        for name in (
+            "cell_id", "principal_id", "principal_type", "session_id",
+            "channel", "channel_account_id", "nonce",
+        ):
+            require_ident(name, getattr(self, name))
+        if self.task_id is not None:
+            require_ident("task_id", self.task_id)
+        issued = parse_time(self.issued_at)
+        expires = parse_time(self.expires_at)
+        if expires <= issued or expires - issued > timedelta(hours=1):
+            raise ValidationError("invalid tenant context lifetime")
+
+    @classmethod
+    def issue(cls, *, lifetime_seconds: int = 300, now: datetime | None = None, **scope: Any) -> "TenantContext":
+        if not 1 <= lifetime_seconds <= 3600:
+            raise ValidationError("lifetime_seconds must be between 1 and 3600")
+        current = (now or utc_now()).astimezone(timezone.utc)
+        return cls(
+            **scope,
+            issued_at=isoformat(current),
+            expires_at=isoformat(current + timedelta(seconds=lifetime_seconds)),
+            nonce=secrets.token_hex(16),
+        )
+
+    def sign(self, key: bytes) -> str:
+        if len(key) < 32:
+            raise ValidationError("signing key must be at least 32 bytes")
+        payload = _b64(canonical_json(asdict(self)))
+        signature = _b64(hmac.new(key, payload.encode("ascii"), hashlib.sha256).digest())
+        return f"{payload}.{signature}"
+
+    @classmethod
+    def verify(
+        cls,
+        token: str,
+        key: bytes,
+        *,
+        now: datetime | None = None,
+        expected_tenant_id: str | None = None,
+        expected_cell_id: str | None = None,
+    ) -> "TenantContext":
+        if len(key) < 32:
+            raise ValidationError("signing key must be at least 32 bytes")
+        try:
+            payload, encoded_signature = token.split(".", 1)
+            actual = _unb64(encoded_signature)
+            if encoded_signature != _b64(actual):
+                raise ValidationError("non-canonical tenant context signature")
+            data = json.loads(_unb64(payload))
+        except Exception as exc:
+            raise ValidationError("malformed tenant context token") from exc
+        expected = hmac.new(key, payload.encode("ascii"), hashlib.sha256).digest()
+        if not hmac.compare_digest(actual, expected):
+            raise ValidationError("tenant context signature mismatch")
+        context = cls(**data)
+        current = (now or utc_now()).astimezone(timezone.utc)
+        if current < parse_time(context.issued_at) - timedelta(seconds=60):
+            raise ValidationError("tenant context issued in future")
+        if current >= parse_time(context.expires_at):
+            raise ValidationError("tenant context expired")
+        if expected_tenant_id and context.tenant_id != expected_tenant_id:
+            raise ScopeError("tenant mismatch")
+        if expected_cell_id and context.cell_id != expected_cell_id:
+            raise ScopeError("cell mismatch")
+        return context
+
+
+@dataclass(frozen=True)
+class CanonicalMessage:
+    tenant_id: str
+    cell_id: str
+    principal_id: str
+    principal_type: str
+    origin_type: str
+    channel: str
+    channel_account_id: str
+    peer_id: str
+    conversation_id: str
+    session_id: str
+    task_id: str | None
+    event_id: str
+    message_id: str
+    reply_to_message_id: str | None
+    direction: str
+    command_capable: bool
+    occurred_at: str
+    received_at: str
+    body: str
+    quoted_body: str | None
+    adapter_name: str
+    adapter_version: str
+    schema_version: str = "aios.message.v1"
+
+    def __post_init__(self) -> None:
+        if self.schema_version != "aios.message.v1":
+            raise ValidationError("unsupported message schema version")
+        require_ident("tenant_id", self.tenant_id, tenant=True)
+        for name in (
+            "cell_id", "principal_id", "principal_type", "origin_type", "channel",
+            "channel_account_id", "peer_id", "conversation_id", "session_id",
+            "event_id", "adapter_name", "adapter_version",
+        ):
+            require_ident(name, getattr(self, name))
+        if self.task_id is not None:
+            require_ident("task_id", self.task_id)
+        normalize_message_id(self.message_id)
+        if self.reply_to_message_id is not None:
+            normalize_message_id(self.reply_to_message_id, field_name="reply_to_message_id")
+        if self.direction not in {"inbound", "outbound", "internal"}:
+            raise ValidationError("invalid direction")
+        if not isinstance(self.command_capable, bool):
+            raise ValidationError("command_capable must be boolean")
+        parse_time(self.occurred_at)
+        parse_time(self.received_at)
+        if not isinstance(self.body, str):
+            raise ValidationError("body must be a string")
+        if self.quoted_body is not None and not isinstance(self.quoted_body, str):
+            raise ValidationError("quoted_body must be a string or null")
+
+    @classmethod
+    def from_mapping(cls, data: Mapping[str, Any]) -> "CanonicalMessage":
+        content = data.get("content") or {}
+        adapter = data.get("adapter") or {}
+        if not isinstance(content, Mapping) or not isinstance(adapter, Mapping):
+            raise ValidationError("content and adapter must be objects")
+        values = dict(data)
+        return cls(
+            schema_version=values.get("schema_version", "aios.message.v1"),
+            tenant_id=values["tenant_id"],
+            cell_id=values["cell_id"],
+            principal_id=values["principal_id"],
+            principal_type=values["principal_type"],
+            origin_type=values["origin_type"],
+            channel=values["channel"],
+            channel_account_id=values["channel_account_id"],
+            peer_id=values["peer_id"],
+            conversation_id=values["conversation_id"],
+            session_id=values["session_id"],
+            task_id=values.get("task_id"),
+            event_id=values["event_id"],
+            message_id=normalize_message_id(values["message_id"]),
+            reply_to_message_id=(
+                normalize_message_id(values["reply_to_message_id"], field_name="reply_to_message_id")
+                if values.get("reply_to_message_id") is not None else None
+            ),
+            direction=values["direction"],
+            command_capable=values["command_capable"],
+            occurred_at=values["occurred_at"],
+            received_at=values["received_at"],
+            body=content.get("body", ""),
+            quoted_body=content.get("quoted_body"),
+            adapter_name=adapter["name"],
+            adapter_version=adapter["version"],
+        )
+
+    def assert_context(self, context: TenantContext) -> None:
+        fields = (
+            "tenant_id", "cell_id", "principal_id", "session_id", "task_id",
+            "channel", "channel_account_id",
+        )
+        mismatches = [name for name in fields if getattr(self, name) != getattr(context, name)]
+        if mismatches:
+            raise ScopeError("message/context mismatch: " + ", ".join(mismatches))
+
+    @property
+    def is_authenticated_human_command(self) -> bool:
+        return (
+            self.direction == "inbound"
+            and self.command_capable
+            and self.principal_type == "authenticated_user"
+            and self.origin_type == "channel_user"
+        )
+
+
+@dataclass(frozen=True)
+class PolicyDecision:
+    allowed: bool
+    approval_required: bool
+    code: str
+    reason: str
+
+
+READ_ONLY_TOOLS = frozenset({
+    "read", "grep", "glob", "find", "ls", "web_search", "web_fetch",
+    "memory_search", "sessions_list", "sessions_history", "session_status",
+})
+
+
+def evaluate_tool_call(tool_name: str, message: CanonicalMessage) -> PolicyDecision:
+    normalized = tool_name.strip().lower() if isinstance(tool_name, str) else ""
+    if not normalized:
+        return PolicyDecision(False, False, "invalid_tool", "tool name missing")
+    if normalized in READ_ONLY_TOOLS:
+        return PolicyDecision(True, False, "read_only", "read-only operation")
+    if not message.is_authenticated_human_command:
+        return PolicyDecision(
+            False, False, "origin_denied",
+            "side effects require an authenticated current human command",
+        )
+    return PolicyDecision(
+        True, True, "approval_required",
+        "authenticated human side effect requires explicit approval",
+    )
@@ -1,355 +0,0 @@
-"""Fail-closed access to the authoritative bare Git repository."""
-from __future__ import annotations
-
-import os
-import re
-import subprocess
-import urllib.parse
-from pathlib import Path
-from typing import Iterable
-
-_ALLOWED_COMMANDS = frozenset(
-    {
-        "cat-file",
-        "config",
-        "diff",
-        "for-each-ref",
-        "ls-remote",
-        "merge-base",
-        "push",
-        "remote",
-        "rev-parse",
-        "show-ref",
-        "tag",
-    }
-)
-_OID_RE = re.compile(r"^[0-9a-f]{40}$")
-_MAX_OUTPUT = 1_048_576
-_TIMEOUT = 8.0
-
-
-class AuthoritativeGitError(RuntimeError):
-    """A fail-closed authoritative repository or ref query error."""
-
-
-class AuthoritativeGitNotFound(AuthoritativeGitError):
-    """A validated revision does not exist in the authoritative repository."""
-
-
-class AuthoritativeGitOutputTooLarge(AuthoritativeGitError):
-    """A controlled Git query exceeded the response-size boundary."""
-
-
-def _redact(text: str) -> str:
-    value = str(text or "")
-    value = re.sub(r"(?i)(authorization\s*[:=]\s*)(?:bearer|token)\s+\S+", r"\1REDACTED", value)
-    value = re.sub(r"(?i)((?:access_)?token\s*[:=]\s*)\S+", r"\1REDACTED", value)
-    value = re.sub(r"(?i)(https?://[^/\s:@]+:)[^@\s/]+@", r"\1REDACTED@", value)
-    return value
-
-
-def _configured_path(git_dir: str | Path | None = None) -> Path:
-    raw = str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
-    if not raw:
-        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
-    path = Path(raw)
-    if not path.is_absolute() or ".." in path.parts:
-        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
-    try:
-        resolved = path.resolve(strict=True)
-    except OSError as exc:
-        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE") from exc
-    if not resolved.is_dir():
-        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
-    return resolved
-
-
-def _run(
-    git_dir: Path,
-    args: list[str],
-    *,
-    check: bool,
-    timeout: float = _TIMEOUT,
-) -> subprocess.CompletedProcess[str]:
-    if not args or args[0] not in _ALLOWED_COMMANDS:
-        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-    try:
-        result = subprocess.run(
-            ["git", "--git-dir", str(git_dir), *args],
-            text=True,
-            capture_output=True,
-            timeout=timeout,
-            env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
-        )
-    except (OSError, subprocess.TimeoutExpired) as exc:
-        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED") from exc
-    if len(result.stdout) + len(result.stderr) > _MAX_OUTPUT:
-        raise AuthoritativeGitOutputTooLarge("GIT_OUTPUT_LIMIT_EXCEEDED")
-    if check and result.returncode != 0:
-        detail = _redact(result.stderr.strip() or result.stdout.strip())
-        raise AuthoritativeGitError(
-            "GIT_REF_QUERY_FAILED" + (f": {detail[:160]}" if detail else "")
-        )
-    return result
-
-
-def _repository_identity_from_remote(url: str) -> str:
-    value = str(url or "").strip().split("?", 1)[0].rstrip("/")
-    if not value:
-        return ""
-    if "://" in value:
-        value = urllib.parse.urlparse(value).path
-    elif ":" in value:
-        value = value.rsplit(":", 1)[1]
-    value = value.rsplit("@", 1)[-1].strip("/")
-    value = re.sub(r"\.git$", "", value, flags=re.IGNORECASE)
-    parts = [part for part in value.split("/") if part]
-    if len(parts) >= 2:
-        value = "/".join(parts[-2:])
-    return value.strip("/").lower()
-
-
-def verify_repository(
-    git_dir: str | Path | None = None,
-    repository_identity: str | None = None,
-) -> tuple[Path, str]:
-    path = _configured_path(git_dir)
-    expected = str(
-        repository_identity
-        or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
-    ).strip().strip("/")
-    if not expected or expected.count("/") != 1:
-        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
-    bare = _run(path, ["rev-parse", "--is-bare-repository"], check=True)
-    if bare.stdout.strip().lower() != "true":
-        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
-    remote = _run(path, ["config", "--get", "remote.gitea.url"], check=False)
-    actual = _repository_identity_from_remote(remote.stdout)
-    if actual != expected.lower():
-        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
-    return path, expected
-
-
-def run_authoritative_git(
-    args: list[str],
-    *,
-    check: bool = True,
-    git_dir: str | Path | None = None,
-    timeout: float = _TIMEOUT,
-) -> subprocess.CompletedProcess[str]:
-    path, _ = verify_repository(git_dir=git_dir)
-    return _run(path, list(args), check=check, timeout=timeout)
-
-
-def authoritative_head_oid(
-    *,
-    git_dir: str | Path | None = None,
-) -> str:
-    result = run_authoritative_git(["rev-parse", "--verify", "refs/heads/main"], git_dir=git_dir)
-    oid = result.stdout.strip().lower()
-    if not _OID_RE.fullmatch(oid):
-        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-    return oid
-
-
-def authoritative_tags(
-    *,
-    git_dir: str | Path | None = None,
-) -> list[dict[str, str | None]]:
-    result = run_authoritative_git(
-        [
-            "for-each-ref",
-            "refs/tags",
-            "--format=%(refname:strip=2)\t%(objectname)\t%(objecttype)",
-        ],
-        git_dir=git_dir,
-    )
-    tags: list[dict[str, str | None]] = []
-    for line in result.stdout.splitlines():
-        name, oid, object_type = (line.split("\t", 2) + ["", ""])[:3]
-        if not name or not _OID_RE.fullmatch(oid.lower()):
-            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-        peeled_result = run_authoritative_git(
-            ["rev-parse", "--verify", f"refs/tags/{name}^{{commit}}"],
-            git_dir=git_dir,
-        )
-        peeled = peeled_result.stdout.strip().lower()
-        if not _OID_RE.fullmatch(peeled):
-            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-        tags.append(
-            {
-                "name": name,
-                "tag_oid": oid.lower(),
-                "object_type": object_type,
-                "peeled_target_oid": peeled,
-            }
-        )
-    return tags
-
-
-def authoritative_branches(
-    *,
-    git_dir: str | Path | None = None,
-) -> list[dict[str, str]]:
-    result = run_authoritative_git(
-        [
-            "for-each-ref",
-            "refs/heads",
-            "--format=%(refname:strip=2)\t%(objectname)",
-        ],
-        git_dir=git_dir,
-    )
-    branches: list[dict[str, str]] = []
-    for line in result.stdout.splitlines():
-        name, oid = (line.split("\t", 1) + [""])[:2]
-        if not name or not _OID_RE.fullmatch(oid.lower()):
-            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-        branches.append({"name": name, "oid": oid.lower()})
-    return branches
-
-
-def authoritative_commit(
-    oid: str,
-    *,
-    git_dir: str | Path | None = None,
-) -> str:
-    value = str(oid or "").strip().lower()
-    if not _OID_RE.fullmatch(value):
-        raise ValueError("commit OID must be a full 40-character value")
-    result = run_authoritative_git(
-        ["rev-parse", "--verify", f"{value}^{{commit}}"],
-        git_dir=git_dir,
-    )
-    resolved = result.stdout.strip().lower()
-    if resolved != value:
-        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-    return resolved
-
-
-def authoritative_lineage(
-    ancestor: str,
-    descendant: str,
-    *,
-    git_dir: str | Path | None = None,
-) -> None:
-    authoritative_commit(ancestor, git_dir=git_dir)
-    authoritative_commit(descendant, git_dir=git_dir)
-    result = run_authoritative_git(
-        ["merge-base", "--is-ancestor", ancestor, descendant],
-        check=False,
-        git_dir=git_dir,
-    )
-    if result.returncode != 0:
-        raise AuthoritativeGitError("evidence lineage mismatch")
-
-
-_SAFE_REF_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{0,239}$")
-
-
-def _safe_ref_name(value: str) -> bool:
-    return bool(
-        _SAFE_REF_RE.fullmatch(value)
-        and ".." not in value
-        and "//" not in value
-        and "@{" not in value
-        and not value.endswith(("/", ".", ".lock"))
-        and not any(part in {"", ".", ".."} for part in value.split("/"))
-    )
-
-
-def validate_git_revision(
-    value: str,
-    field: str,
-    *,
-    git_dir: str | Path | None = None,
-) -> str:
-    revision = str(value or "").strip()
-    if not revision or revision != str(value or "") or revision.startswith("-"):
-        raise ValueError(f"invalid {field} revision")
-    if _OID_RE.fullmatch(revision.lower()):
-        try:
-            return authoritative_commit(revision.lower(), git_dir=git_dir)
-        except AuthoritativeGitError as exc:
-            raise AuthoritativeGitNotFound(f"{field} revision not found") from exc
-    if not _safe_ref_name(revision) or any(token in revision for token in ("^", "~", ":", "\\")):
-        raise ValueError(f"invalid {field} revision")
-    if revision.startswith("refs/"):
-        if not revision.startswith(("refs/heads/", "refs/tags/")):
-            raise ValueError(f"invalid {field} revision")
-        candidates = [revision]
-    else:
-        candidates = [f"refs/heads/{revision}", f"refs/tags/{revision}"]
-    matches: list[str] = []
-    for candidate in candidates:
-        result = run_authoritative_git(
-            ["rev-parse", "--verify", f"{candidate}^{{commit}}"],
-            check=False,
-            git_dir=git_dir,
-        )
-        oid = result.stdout.strip().lower()
-        if result.returncode == 0 and _OID_RE.fullmatch(oid):
-            matches.append(oid)
-    if not matches:
-        raise AuthoritativeGitNotFound(f"{field} revision not found")
-    if len(set(matches)) != 1 or len(matches) != 1:
-        raise ValueError(f"ambiguous {field} revision")
-    return matches[0]
-
-
-def authoritative_diff(
-    from_revision: str,
-    to_revision: str,
-    *,
-    git_dir: str | Path | None = None,
-) -> dict[str, object]:
-    path, _ = verify_repository(git_dir=git_dir)
-    from_oid = validate_git_revision(from_revision, "from", git_dir=path)
-    to_oid = validate_git_revision(to_revision, "to", git_dir=path)
-    args = ["diff", "--no-ext-diff", "--no-textconv", from_oid, to_oid]
-    result = run_authoritative_git(args, git_dir=path)
-    return {
-        "code": 0,
-        "stdout": result.stdout,
-        "stderr": "",
-        "cmd": ["git", f"--git-dir={path}", *args],
-        "from_oid": from_oid,
-        "to_oid": to_oid,
-    }
-
-
-def repository_snapshot(
-    *,
-    git_dir: str | Path | None = None,
-    repository_identity: str | None = None,
-) -> dict[str, object]:
-    configured = bool(
-        str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
-    )
-    try:
-        path, identity = verify_repository(
-            git_dir=git_dir,
-            repository_identity=repository_identity,
-        )
-        head = authoritative_head_oid(git_dir=path)
-        return {
-            "repository_available": True,
-            "authoritative_git_dir_configured": configured,
-            "authoritative_git_dir_readable": True,
-            "authoritative_git_dir": str(path),
-            "authoritative_head_oid": head,
-            "repository_identity": identity,
-            "query_error": None,
-        }
-    except (AuthoritativeGitError, ValueError) as exc:
-        return {
-            "repository_available": False,
-            "authoritative_git_dir_configured": configured,
-            "authoritative_git_dir_readable": False,
-            "authoritative_git_dir": None,
-            "authoritative_head_oid": None,
-            "repository_identity": str(
-                repository_identity
-                or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
-            ).strip() or None,
-            "query_error": _redact(str(exc)),
-        }
@@ -1,167 +0,0 @@
-"""Fail-closed operation authorization for an isolated Git writer."""
-from __future__ import annotations
-
-import ipaddress
-import os
-import re
-import subprocess
-from dataclasses import dataclass
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any
-
-from isolated_writer_token_registry import TokenRegistry
-
-
-ROUTE_OPERATIONS = {
-    ("GET", "/api/runtime-status"): "runtime.status.read",
-    ("GET", "/api/baseline"): "baseline.read",
-    ("GET", "/api/patches"): "patches.read",
-    ("POST", "/api/commit-file"): "commit_file.atomic",
-}
-OID_RE = re.compile(r"[0-9a-f]{40}")
-
-
-class AuthorizationError(PermissionError):
-    def __init__(self, code: str, status: int = 403):
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-@dataclass(frozen=True)
-class AuthorizedGrant:
-    record: dict[str, Any]
-    operation: str
-    use_count: int
-
-    @property
-    def token_id(self) -> str:
-        return str(self.record["token_id"])
-
-    @property
-    def task_id(self) -> str:
-        return str(self.record["task_id"])
-
-
-def operation_for(method: str, path: str) -> str:
-    operation = ROUTE_OPERATIONS.get((method.upper(), path))
-    if not operation:
-        raise AuthorizationError("isolated_writer_operation_forbidden")
-    return operation
-
-
-def _parse_time(value: Any) -> datetime:
-    try:
-        parsed = datetime.fromisoformat(str(value).replace("Z", "+00:00"))
-    except (TypeError, ValueError):
-        raise AuthorizationError("writer_token_time_invalid") from None
-    if parsed.tzinfo is None:
-        raise AuthorizationError("writer_token_time_invalid")
-    return parsed.astimezone(timezone.utc)
-
-
-def _git_is_ancestor(workspace: Path, base: str, branch: str) -> bool:
-    result = subprocess.run(
-        ["git", "merge-base", "--is-ancestor", base, branch],
-        cwd=workspace,
-        stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
-    )
-    return result.returncode == 0
-
-
-def _validate_grant(
-    grant: dict[str, Any],
-    *,
-    audience: str,
-    source_ip: str,
-    operation: str,
-    branch: str | None,
-    path: str | None,
-    workspace: Path,
-    current_time: datetime,
-) -> None:
-    if int(grant.get("schema_version", 0)) != 2:
-        raise AuthorizationError("writer_token_policy_v2_required", 401)
-    if str(grant.get("audience") or "") != audience:
-        raise AuthorizationError("writer_token_audience_rejected")
-    try:
-        peer = ipaddress.ip_address(source_ip)
-        networks = [ipaddress.ip_network(str(value), strict=True) for value in grant.get("source_cidrs", [])]
-    except ValueError:
-        raise AuthorizationError("writer_token_source_rejected") from None
-    if not networks or not any(peer in network for network in networks):
-        raise AuthorizationError("writer_token_source_rejected")
-    created = _parse_time(grant.get("created_at"))
-    not_before = _parse_time(grant.get("not_before"))
-    expires = _parse_time(grant.get("expires_at"))
-    if expires <= not_before or (expires - created).total_seconds() > 1800:
-        raise AuthorizationError("writer_token_lifetime_rejected")
-    if current_time < not_before:
-        raise AuthorizationError("writer_token_not_yet_valid", 401)
-    if current_time >= expires:
-        raise AuthorizationError("writer_token_expired", 401)
-    if bool(grant.get("revoked")):
-        raise AuthorizationError("writer_token_revoked", 401)
-    operations = grant.get("allowed_operations")
-    if not isinstance(operations, list) or operation not in operations:
-        raise AuthorizationError("writer_token_operation_rejected")
-    expected_branch = str(grant.get("allowed_branch") or "")
-    configured_branch = os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", "")
-    if expected_branch != configured_branch:
-        raise AuthorizationError("writer_token_branch_rejected")
-    if branch is not None and branch != expected_branch:
-        raise AuthorizationError("writer_token_branch_rejected")
-    if path is not None:
-        paths = grant.get("allowed_paths")
-        if not isinstance(paths, list) or path not in paths:
-            raise AuthorizationError("writer_token_path_rejected")
-    base = str(grant.get("approved_base_oid") or "").lower()
-    if not OID_RE.fullmatch(base):
-        raise AuthorizationError("writer_token_base_rejected")
-    if not _git_is_ancestor(workspace, base, expected_branch):
-        raise AuthorizationError("writer_token_base_not_ancestor")
-
-
-def authorize(
-    registry: TokenRegistry,
-    token: str,
-    *,
-    method: str,
-    path: str,
-    source_ip: str,
-    workspace: Path,
-    branch: str | None = None,
-    target_path: str | None = None,
-    current_time: datetime | None = None,
-) -> AuthorizedGrant:
-    if os.getenv("AIOS_GITOPS_TOKEN_POLICY_VERSION_REQUIRED", "") != "2":
-        raise AuthorizationError("writer_token_policy_v2_not_required")
-    if not token:
-        raise AuthorizationError("unauthorized", 401)
-    grant = registry.find(token)
-    if grant is None:
-        raise AuthorizationError("unauthorized", 401)
-    operation = operation_for(method, path)
-    _validate_grant(
-        grant,
-        audience=os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", ""),
-        source_ip=source_ip,
-        operation=operation,
-        branch=branch,
-        path=target_path,
-        workspace=workspace,
-        current_time=current_time or datetime.now(timezone.utc),
-    )
-    limits = grant.get("max_uses")
-    if not isinstance(limits, dict):
-        raise AuthorizationError("writer_token_use_limit_missing")
-    try:
-        used = registry.consume(str(grant["token_id"]), operation, int(limits[operation]))
-    except (KeyError, TypeError, ValueError):
-        raise AuthorizationError("writer_token_use_limit_missing") from None
-    except PermissionError as exc:
-        code = str(exc)
-        raise AuthorizationError(code, 401 if code == "writer_token_revoked" else 403) from None
-    return AuthorizedGrant(grant, operation, used)
@@ -1,403 +0,0 @@
-"""Atomic, idempotent commit-file Saga for the isolated writer."""
-from __future__ import annotations
-
-import fcntl
-import hashlib
-import json
-import os
-import re
-import sqlite3
-import subprocess
-import tempfile
-import threading
-from pathlib import Path
-from typing import Any
-
-import aios_isolated_writer_policy as policy
-
-
-OID_RE = re.compile(r"[0-9a-f]{40}")
-IDEMPOTENCY_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{7,127}")
-STATES = frozenset({
-    "PENDING", "FILE_WRITTEN", "COMMITTED", "PUSHED", "VERIFIED", "COMPLETED",
-    "FAILED_RECOVERABLE", "MANUAL_REVIEW_REQUIRED",
-})
-_LOCKS: dict[str, threading.Lock] = {}
-_LOCKS_GUARD = threading.Lock()
-_LEDGER_INIT_LOCK = threading.Lock()
-
-
-class CommitFileError(RuntimeError):
-    def __init__(self, code: str, status: int = 400):
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-class SimulatedCrash(RuntimeError):
-    pass
-
-
-def canonical_digest(data: dict[str, Any]) -> str:
-    payload = {
-        "branch": data["branch"],
-        "path": data["path"],
-        "content_sha256": hashlib.sha256(data["content"].encode("utf-8")).hexdigest(),
-        "message": data["message"],
-        "expected_head_oid": data["expected_head_oid"],
-    }
-    encoded = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    return hashlib.sha256(encoded).hexdigest()
-
-
-class OperationLedger:
-    def __init__(self, path: Path | str):
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        if self.path.parent.is_symlink() or self.path.is_symlink():
-            raise PermissionError("writer_operation_ledger_symlink_rejected")
-        with _LEDGER_INIT_LOCK:
-            with self.connect() as db:
-                db.execute(
-                    """
-                    CREATE TABLE IF NOT EXISTS writer_operations (
-                        operation_id TEXT PRIMARY KEY,
-                        token_id TEXT NOT NULL,
-                        task_id TEXT NOT NULL,
-                        idempotency_key TEXT NOT NULL UNIQUE,
-                        operation_digest TEXT NOT NULL,
-                        branch TEXT NOT NULL,
-                        path TEXT NOT NULL,
-                        content_sha256 TEXT NOT NULL,
-                        pre_head_oid TEXT NOT NULL,
-                        commit_oid TEXT,
-                        push_status TEXT,
-                        verification_status TEXT,
-                        state TEXT NOT NULL,
-                        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-                        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-                        error_code TEXT
-                    )
-                    """
-                )
-        os.chmod(self.path, 0o600)
-
-    def connect(self) -> sqlite3.Connection:
-        db = sqlite3.connect(self.path, timeout=30)
-        db.row_factory = sqlite3.Row
-        db.execute("PRAGMA journal_mode=WAL")
-        db.execute("PRAGMA synchronous=FULL")
-        return db
-
-    def get_or_create(self, grant: Any, data: dict[str, Any], digest: str) -> dict[str, Any]:
-        key = data["idempotency_key"]
-        with self.connect() as db:
-            db.execute("BEGIN IMMEDIATE")
-            row = db.execute(
-                "SELECT * FROM writer_operations WHERE idempotency_key=?", (key,)
-            ).fetchone()
-            if row:
-                db.commit()
-                record = dict(row)
-                if record["operation_digest"] != digest:
-                    raise CommitFileError("writer_idempotency_conflict", 409)
-                if (
-                    record["token_id"] != grant.token_id
-                    or record["task_id"] != grant.task_id
-                ):
-                    raise CommitFileError("writer_idempotency_owner_conflict", 409)
-                return record
-            operation_id = hashlib.sha256(
-                f"{grant.task_id}\0{key}".encode("utf-8")
-            ).hexdigest()
-            content_sha = hashlib.sha256(data["content"].encode("utf-8")).hexdigest()
-            db.execute(
-                """
-                INSERT INTO writer_operations(
-                    operation_id,token_id,task_id,idempotency_key,operation_digest,
-                    branch,path,content_sha256,pre_head_oid,state
-                ) VALUES(?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    operation_id, grant.token_id, grant.task_id, key, digest,
-                    data["branch"], data["path"], content_sha,
-                    data["expected_head_oid"], "PENDING",
-                ),
-            )
-            db.commit()
-        return self.get(key)
-
-    def get(self, key: str) -> dict[str, Any]:
-        with self.connect() as db:
-            row = db.execute(
-                "SELECT * FROM writer_operations WHERE idempotency_key=?", (key,)
-            ).fetchone()
-        if row is None:
-            raise KeyError(key)
-        return dict(row)
-
-    def update(self, key: str, state: str, **fields: Any) -> dict[str, Any]:
-        if state not in STATES:
-            raise ValueError("invalid writer operation state")
-        allowed = {"commit_oid", "push_status", "verification_status", "error_code"}
-        assignments = ["state=?", "updated_at=CURRENT_TIMESTAMP"]
-        values: list[Any] = [state]
-        for name, value in fields.items():
-            if name not in allowed:
-                raise ValueError("invalid ledger field")
-            assignments.append(f"{name}=?")
-            values.append(value)
-        values.append(key)
-        with self.connect() as db:
-            db.execute("BEGIN IMMEDIATE")
-            db.execute(
-                f"UPDATE writer_operations SET {','.join(assignments)} WHERE idempotency_key=?",
-                values,
-            )
-            db.commit()
-        return self.get(key)
-
-
-class AtomicCommitFile:
-    def __init__(
-        self,
-        *,
-        workspace: Path,
-        bare_repo: Path,
-        ledger: OperationLedger,
-        remote: str,
-        audit,
-        crash_after_state: str | None = None,
-    ):
-        self.workspace = workspace
-        self.bare_repo = bare_repo
-        self.ledger = ledger
-        self.remote = remote
-        self.audit = audit
-        self.crash_after_state = crash_after_state
-
-    def _git(self, *args: str, check: bool = True) -> str:
-        result = subprocess.run(
-            ["git", *args], cwd=self.workspace, text=True, capture_output=True
-        )
-        if check and result.returncode != 0:
-            raise CommitFileError("writer_git_operation_failed", 500)
-        return result.stdout.strip()
-
-    def _transition(self, key: str, state: str, **fields: Any) -> dict[str, Any]:
-        record = self.ledger.update(key, state, **fields)
-        if self.crash_after_state == state:
-            raise SimulatedCrash(state)
-        return record
-
-    def _validate(self, data: Any) -> dict[str, Any]:
-        if not isinstance(data, dict):
-            raise CommitFileError("writer_request_object_required")
-        required = ("branch", "path", "content", "message", "expected_head_oid", "idempotency_key")
-        if any(field not in data for field in required):
-            raise CommitFileError("writer_request_incomplete")
-        if data.get("force") or data.get("force_push"):
-            raise CommitFileError("isolated_writer_force_rejected", 403)
-        if set(data) != set(required):
-            raise CommitFileError("writer_request_fields_rejected")
-        item = {field: data[field] for field in required}
-        if item["branch"] != policy.allowed_branch():
-            raise CommitFileError("isolated_writer_branch_rejected", 403)
-        try:
-            item["path"] = policy.validate_path(item["path"], self.workspace)
-        except PermissionError as exc:
-            raise CommitFileError(str(exc), 403) from None
-        if not isinstance(item["content"], str) or "\x00" in item["content"]:
-            raise CommitFileError("writer_content_rejected")
-        try:
-            policy.validate_content_for_path(item["path"], item["content"])
-        except PermissionError as exc:
-            raise CommitFileError(str(exc), 403) from None
-        if len(item["content"].encode("utf-8")) > 1_048_576:
-            raise CommitFileError("writer_content_too_large", 413)
-        message = item["message"]
-        if (
-            not isinstance(message, str)
-            or not 1 <= len(message) <= 200
-            or "\x00" in message
-            or "\n" in message
-            or "\r" in message
-        ):
-            raise CommitFileError("writer_message_rejected")
-        if not isinstance(item["expected_head_oid"], str) or not OID_RE.fullmatch(item["expected_head_oid"]):
-            raise CommitFileError("writer_expected_head_rejected")
-        if not isinstance(item["idempotency_key"], str) or not IDEMPOTENCY_RE.fullmatch(item["idempotency_key"]):
-            raise CommitFileError("writer_idempotency_key_rejected")
-        return item
-
-    def _atomic_write(self, relative: str, content: str) -> None:
-        target = self.workspace / relative
-        target.parent.mkdir(parents=True, exist_ok=True)
-        fd, temporary = tempfile.mkstemp(prefix=".writer-", dir=target.parent)
-        try:
-            with os.fdopen(fd, "wb", closefd=True) as stream:
-                stream.write(content.encode("utf-8"))
-                stream.flush()
-                os.fsync(stream.fileno())
-            os.replace(temporary, target)
-            parent_fd = os.open(target.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
-            try:
-                os.fsync(parent_fd)
-            finally:
-                os.close(parent_fd)
-        finally:
-            if os.path.exists(temporary):
-                os.unlink(temporary)
-
-    def _verify_remote(self, branch: str, oid: str) -> None:
-        bare = subprocess.run(
-            ["git", "--git-dir", str(self.bare_repo), "rev-parse", f"refs/heads/{branch}"],
-            text=True, capture_output=True,
-        )
-        if bare.returncode != 0 or bare.stdout.strip() != oid:
-            raise CommitFileError("writer_authoritative_bare_oid_mismatch", 500)
-        remote = subprocess.run(
-            ["git", "ls-remote", "--heads", self.remote, f"refs/heads/{branch}"],
-            cwd=self.workspace, text=True, capture_output=True,
-        )
-        if remote.returncode != 0:
-            raise CommitFileError("writer_gitea_verification_failed", 503)
-        fields = remote.stdout.strip().split()
-        if len(fields) != 2:
-            raise CommitFileError("writer_gitea_ref_missing", 503)
-        if fields[0] != oid:
-            raise CommitFileError("writer_gitea_oid_conflict", 409)
-
-    def execute(self, grant: Any, raw_data: Any) -> dict[str, Any]:
-        data = self._validate(raw_data)
-        digest = canonical_digest(data)
-        branch = data["branch"]
-        with _LOCKS_GUARD:
-            lock = _LOCKS.setdefault(branch, threading.Lock())
-        lock_path = self.ledger.path.parent / f"{hashlib.sha256(branch.encode()).hexdigest()}.lock"
-        with lock, open(lock_path, "a+b") as branch_lock:
-            fcntl.flock(branch_lock.fileno(), fcntl.LOCK_EX)
-            return self._execute_locked(grant, data, digest)
-
-    def _execute_locked(self, grant: Any, data: dict[str, Any], digest: str) -> dict[str, Any]:
-        key = data["idempotency_key"]
-        record = self.ledger.get_or_create(grant, data, digest)
-        if record["state"] == "COMPLETED":
-            return self._result(record, idempotent=True)
-        if self._git("rev-parse", "--abbrev-ref", "HEAD") != data["branch"]:
-            record = self._transition(
-                key, "MANUAL_REVIEW_REQUIRED", error_code="writer_current_branch_conflict"
-            )
-            self._audit(grant, data, digest, record, "manual_review_required")
-            raise CommitFileError("writer_current_branch_conflict", 409)
-        head = self._git("rev-parse", "HEAD")
-        commit_oid = record.get("commit_oid")
-        if head != record["pre_head_oid"] and head != commit_oid:
-            record = self._transition(
-                key, "MANUAL_REVIEW_REQUIRED", error_code="writer_branch_head_conflict"
-            )
-            self._audit(grant, data, digest, record, "manual_review_required")
-            raise CommitFileError("writer_branch_head_conflict", 409)
-        try:
-            state = record["state"]
-            if state == "MANUAL_REVIEW_REQUIRED":
-                raise CommitFileError("writer_manual_review_required", 409)
-            if state == "FAILED_RECOVERABLE":
-                if record.get("push_status") == "confirmed":
-                    state = "PUSHED"
-                else:
-                    state = "COMMITTED" if commit_oid else "FILE_WRITTEN"
-            if state == "PENDING":
-                self._atomic_write(data["path"], data["content"])
-                record = self._transition(key, "FILE_WRITTEN")
-                state = record["state"]
-            if state == "FILE_WRITTEN":
-                actual_sha = hashlib.sha256(
-                    (self.workspace / data["path"]).read_bytes()
-                ).hexdigest()
-                if actual_sha != record["content_sha256"]:
-                    raise CommitFileError("writer_file_content_conflict", 409)
-                staged_before = self._git("diff", "--cached", "--name-only", check=False).splitlines()
-                if staged_before:
-                    raise CommitFileError("writer_extra_staged_files_rejected", 409)
-                self._git("add", "--", data["path"])
-                staged = self._git("diff", "--cached", "--name-only").splitlines()
-                if staged != [data["path"]]:
-                    raise CommitFileError("writer_extra_staged_files_rejected", 409)
-                self._git("commit", "-m", data["message"])
-                commit_oid = self._git("rev-parse", "HEAD")
-                record = self._transition(key, "COMMITTED", commit_oid=commit_oid)
-                state = record["state"]
-            if state == "COMMITTED":
-                commit_oid = str(record["commit_oid"])
-                pushed = subprocess.run(
-                    ["git", "push", "--porcelain", self.remote, f"HEAD:refs/heads/{data['branch']}"],
-                    cwd=self.workspace, text=True, capture_output=True,
-                )
-                if pushed.returncode != 0:
-                    self._transition(
-                        key, "FAILED_RECOVERABLE",
-                        push_status="failed", error_code="writer_gitea_push_failed",
-                    )
-                    raise CommitFileError("writer_gitea_push_failed", 503)
-                record = self._transition(key, "PUSHED", push_status="confirmed")
-                state = record["state"]
-            if state == "PUSHED":
-                commit_oid = str(record["commit_oid"])
-                self._verify_remote(data["branch"], commit_oid)
-                record = self._transition(
-                    key, "VERIFIED", verification_status="bare+gitea"
-                )
-                state = record["state"]
-            if state == "VERIFIED":
-                record = self._transition(key, "COMPLETED", error_code=None)
-            self._audit(grant, data, digest, record, "completed")
-            return self._result(record, idempotent=False)
-        except SimulatedCrash:
-            raise
-        except CommitFileError as exc:
-            latest = self.ledger.get(key)
-            if latest["state"] not in {"FAILED_RECOVERABLE", "MANUAL_REVIEW_REQUIRED"}:
-                failure_state = (
-                    "MANUAL_REVIEW_REQUIRED"
-                    if exc.code in {
-                        "writer_gitea_oid_conflict",
-                        "writer_file_content_conflict",
-                        "writer_current_branch_conflict",
-                    }
-                    else "FAILED_RECOVERABLE"
-                )
-                latest = self._transition(key, failure_state, error_code=exc.code)
-            self._audit(grant, data, digest, latest, "failed")
-            raise
-
-    def _audit(self, grant: Any, data: dict[str, Any], digest: str, record: dict[str, Any], result: str) -> None:
-        self.audit({
-            "token_id": grant.token_id,
-            "task_id": grant.task_id,
-            "audience": grant.record["audience"],
-            "source_ip": grant.record.get("_source_ip", "socket-peer"),
-            "operation": grant.operation,
-            "branch": data["branch"],
-            "path": data["path"],
-            "idempotency_key": data["idempotency_key"],
-            "operation_digest": digest,
-            "path_policy_sha256": policy.configured_path_policy_sha256(),
-            "pre_head_oid": record["pre_head_oid"],
-            "commit_oid": record.get("commit_oid"),
-            "result": result,
-        })
-
-    @staticmethod
-    def _result(record: dict[str, Any], *, idempotent: bool) -> dict[str, Any]:
-        return {
-            "status": "completed",
-            "state": record["state"],
-            "operation_id": record["operation_id"],
-            "branch": record["branch"],
-            "path": record["path"],
-            "commit_oid": record.get("commit_oid"),
-            "push_status": record.get("push_status"),
-            "verification_status": record.get("verification_status"),
-            "idempotent": idempotent,
-        }
@@ -1,422 +0,0 @@
-"""Strict service-level exact-path policy for isolated Git writers."""
-from __future__ import annotations
-
-import grp
-import hashlib
-import json
-import os
-import re
-import stat
-from dataclasses import dataclass
-from functools import lru_cache
-from pathlib import Path, PurePosixPath, PureWindowsPath
-from typing import Any
-from urllib.parse import unquote
-
-
-MAX_POLICY_BYTES = 65_536
-POLICY_FIELDS = frozenset(
-    {
-        "schema_version",
-        "policy_id",
-        "audience",
-        "repository_identity",
-        "allowed_branch",
-        "allowed_operations",
-    }
-)
-OPERATION_FIELDS = frozenset({"exact_paths", "max_content_bytes", "content_profile"})
-SUPPORTED_OPERATIONS = frozenset({"commit_file.atomic"})
-SUPPORTED_CONTENT_PROFILES = frozenset({"systemd-codex-review-worker-v1"})
-_SECRET_RE = re.compile(
-    r"(?i)(authorization\s*:|bearer\s+|(?:token|password|secret)\s*[:=])"
-)
-_SYSTEMD_NAME_RE = re.compile(r"[A-Za-z][A-Za-z0-9]*\Z")
-_SYSTEMD_MAX_LINE_BYTES = 4096
-_SYSTEMD_ALLOWED_DIRECTIVES = {
-    "Unit": frozenset({"Description", "After", "Wants"}),
-    "Service": frozenset(
-        {
-            "Type",
-            "User",
-            "Group",
-            "WorkingDirectory",
-            "Environment",
-            "ExecStart",
-            "Restart",
-            "RestartSec",
-            "NoNewPrivileges",
-            "PrivateTmp",
-            "PrivateDevices",
-            "ProtectSystem",
-            "ProtectHome",
-            "ProtectKernelTunables",
-            "ProtectKernelModules",
-            "ProtectControlGroups",
-            "LockPersonality",
-            "RestrictSUIDSGID",
-            "RestrictRealtime",
-            "MemoryDenyWriteExecute",
-            "RuntimeDirectory",
-            "StateDirectory",
-            "CacheDirectory",
-            "ReadOnlyPaths",
-            "ReadWritePaths",
-            "UMask",
-        }
-    ),
-    "Install": frozenset({"WantedBy"}),
-}
-_SYSTEMD_MULTI_DIRECTIVES = frozenset(
-    {
-        ("Service", "Environment"),
-        ("Service", "ReadOnlyPaths"),
-        ("Service", "ReadWritePaths"),
-    }
-)
-_SYSTEMD_EXACT_SINGLE_VALUES = {
-    ("Unit", "Description"): "AIOS Codex Review/Test Worker",
-    ("Unit", "After"): "network-online.target",
-    ("Unit", "Wants"): "network-online.target",
-    ("Service", "Type"): "simple",
-    ("Service", "User"): "aiman",
-    ("Service", "Group"): "gitops",
-    (
-        "Service",
-        "WorkingDirectory",
-    ): "/usr/libexec/aios-codex-review-test-worker/current",
-    (
-        "Service",
-        "ExecStart",
-    ): "/usr/bin/python3 -m task_plane.workers.codex_review_test",
-    ("Service", "Restart"): "on-failure",
-    ("Service", "RestartSec"): "2",
-    ("Service", "NoNewPrivileges"): "true",
-    ("Service", "PrivateTmp"): "true",
-    ("Service", "PrivateDevices"): "true",
-    ("Service", "ProtectSystem"): "strict",
-    ("Service", "ProtectHome"): "true",
-    ("Service", "ProtectKernelTunables"): "true",
-    ("Service", "ProtectKernelModules"): "true",
-    ("Service", "ProtectControlGroups"): "true",
-    ("Service", "LockPersonality"): "true",
-    ("Service", "RestrictSUIDSGID"): "true",
-    ("Service", "RestrictRealtime"): "true",
-    ("Service", "MemoryDenyWriteExecute"): "true",
-    ("Service", "RuntimeDirectory"): "aios-codex-review-test-worker",
-    ("Service", "StateDirectory"): "aios-codex-review-test-worker",
-    ("Service", "CacheDirectory"): "aios-codex-review-test-worker",
-    ("Service", "UMask"): "0077",
-    ("Install", "WantedBy"): "multi-user.target",
-}
-_SYSTEMD_EXACT_MULTI_VALUES = {
-    ("Service", "Environment"): (
-        "AIOS_CODEX_WORKER_MODE=shadow",
-        "AIOS_TASK_PLANE_EXECUTION_ENABLED=false",
-        "PYTHONDONTWRITEBYTECODE=1",
-    ),
-    ("Service", "ReadOnlyPaths"): (
-        "/data/aios-gitops/repo.git",
-        "/usr/libexec/aios-codex-review-test-worker",
-    ),
-    ("Service", "ReadWritePaths"): (
-        "/run/aios-codex-review-test-worker",
-        "/var/lib/aios-codex-review-test-worker",
-        "/var/cache/aios-codex-review-test-worker",
-    ),
-}
-
-
-class PathPolicyError(PermissionError):
-    pass
-
-
-@dataclass(frozen=True)
-class OperationPolicy:
-    exact_paths: tuple[str, ...]
-    max_content_bytes: int
-    content_profile: str
-
-
-@dataclass(frozen=True)
-class ServicePathPolicy:
-    schema_version: int
-    policy_id: str
-    audience: str
-    repository_identity: str
-    allowed_branch: str
-    allowed_operations: dict[str, OperationPolicy]
-    sha256: str
-
-    def operation(self, name: str) -> OperationPolicy:
-        try:
-            return self.allowed_operations[name]
-        except KeyError:
-            raise PathPolicyError("isolated_writer_service_operation_rejected") from None
-
-    def require_exact_path(self, operation: str, path: str) -> OperationPolicy:
-        selected = self.operation(operation)
-        if path not in selected.exact_paths:
-            raise PathPolicyError("isolated_writer_service_path_rejected")
-        return selected
-
-
-def _canonical_json(value: Any) -> bytes:
-    return (
-        json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
-        + "\n"
-    ).encode("utf-8")
-
-
-def validate_relative_path_syntax(path: str) -> str:
-    if not isinstance(path, str):
-        raise PathPolicyError("isolated_writer_path_rejected")
-    if not path or path != path.strip() or "\x00" in path or "\\" in path:
-        raise PathPolicyError("isolated_writer_path_rejected")
-    try:
-        decoded = unquote(path, errors="strict")
-    except (UnicodeDecodeError, ValueError):
-        raise PathPolicyError("isolated_writer_path_rejected") from None
-    if decoded != path:
-        raise PathPolicyError("isolated_writer_path_rejected")
-    posix = PurePosixPath(path)
-    windows = PureWindowsPath(path)
-    parts = path.split("/")
-    if (
-        posix.is_absolute()
-        or windows.is_absolute()
-        or bool(windows.drive)
-        or any(part in {"", ".", ".."} for part in parts)
-    ):
-        raise PathPolicyError("isolated_writer_path_rejected")
-    return path
-
-
-def _require_fields(value: dict[str, Any], allowed: frozenset[str], code: str) -> None:
-    if set(value) != allowed:
-        raise PathPolicyError(code)
-
-
-def _parse_policy(document: Any, canonical: bytes) -> ServicePathPolicy:
-    if not isinstance(document, dict):
-        raise PathPolicyError("isolated_writer_path_policy_object_required")
-    _require_fields(document, POLICY_FIELDS, "isolated_writer_path_policy_fields_rejected")
-    if document["schema_version"] != 1:
-        raise PathPolicyError("isolated_writer_path_policy_schema_rejected")
-    text_fields = (
-        "policy_id",
-        "audience",
-        "repository_identity",
-        "allowed_branch",
-    )
-    if any(
-        not isinstance(document[field], str) or not document[field].strip()
-        for field in text_fields
-    ):
-        raise PathPolicyError("isolated_writer_path_policy_value_rejected")
-    raw_operations = document["allowed_operations"]
-    if not isinstance(raw_operations, dict) or not raw_operations:
-        raise PathPolicyError("isolated_writer_path_policy_operations_rejected")
-    if not set(raw_operations).issubset(SUPPORTED_OPERATIONS):
-        raise PathPolicyError("isolated_writer_path_policy_operations_rejected")
-    operations: dict[str, OperationPolicy] = {}
-    for name, raw in raw_operations.items():
-        if not isinstance(raw, dict):
-            raise PathPolicyError("isolated_writer_path_policy_operation_rejected")
-        _require_fields(
-            raw,
-            OPERATION_FIELDS,
-            "isolated_writer_path_policy_operation_fields_rejected",
-        )
-        paths = raw["exact_paths"]
-        if (
-            not isinstance(paths, list)
-            or not paths
-            or any(not isinstance(item, str) for item in paths)
-        ):
-            raise PathPolicyError("isolated_writer_path_policy_paths_rejected")
-        validated = tuple(validate_relative_path_syntax(item) for item in paths)
-        if len(set(validated)) != len(validated):
-            raise PathPolicyError("isolated_writer_path_policy_paths_rejected")
-        maximum = raw["max_content_bytes"]
-        if not isinstance(maximum, int) or isinstance(maximum, bool) or not 1 <= maximum <= 1_048_576:
-            raise PathPolicyError("isolated_writer_path_policy_size_rejected")
-        profile = raw["content_profile"]
-        if profile not in SUPPORTED_CONTENT_PROFILES:
-            raise PathPolicyError("isolated_writer_path_policy_profile_rejected")
-        operations[name] = OperationPolicy(validated, maximum, profile)
-    return ServicePathPolicy(
-        schema_version=1,
-        policy_id=document["policy_id"],
-        audience=document["audience"],
-        repository_identity=document["repository_identity"],
-        allowed_branch=document["allowed_branch"],
-        allowed_operations=operations,
-        sha256=hashlib.sha256(canonical).hexdigest(),
-    )
-
-
-def load_path_policy(
-    path: Path,
-    *,
-    expected_owner_uid: int = 0,
-    expected_group_gid: int | None = None,
-    expected_parent_mode: int = 0o750,
-    expected_file_mode: int = 0o640,
-) -> ServicePathPolicy:
-    lexical = Path(os.path.abspath(str(path)))
-    if lexical.is_symlink():
-        raise PathPolicyError("isolated_writer_path_policy_symlink_rejected")
-    try:
-        parent_info = lexical.parent.stat(follow_symlinks=False)
-        file_info = lexical.stat(follow_symlinks=False)
-    except FileNotFoundError:
-        raise PathPolicyError("isolated_writer_path_policy_missing") from None
-    if stat.S_ISLNK(parent_info.st_mode) or not stat.S_ISDIR(parent_info.st_mode):
-        raise PathPolicyError("isolated_writer_path_policy_parent_rejected")
-    if stat.S_ISLNK(file_info.st_mode) or not stat.S_ISREG(file_info.st_mode):
-        raise PathPolicyError("isolated_writer_path_policy_file_rejected")
-    if lexical.resolve(strict=True) != lexical:
-        raise PathPolicyError("isolated_writer_path_policy_symlink_rejected")
-    if (
-        parent_info.st_uid != expected_owner_uid
-        or stat.S_IMODE(parent_info.st_mode) != expected_parent_mode
-    ):
-        raise PathPolicyError("isolated_writer_path_policy_parent_permissions_rejected")
-    if (
-        file_info.st_uid != expected_owner_uid
-        or stat.S_IMODE(file_info.st_mode) != expected_file_mode
-    ):
-        raise PathPolicyError("isolated_writer_path_policy_permissions_rejected")
-    if expected_group_gid is not None and (
-        parent_info.st_gid != expected_group_gid or file_info.st_gid != expected_group_gid
-    ):
-        raise PathPolicyError("isolated_writer_path_policy_group_rejected")
-    if file_info.st_size <= 0 or file_info.st_size > MAX_POLICY_BYTES:
-        raise PathPolicyError("isolated_writer_path_policy_file_size_rejected")
-    raw = lexical.read_bytes()
-    try:
-        document = json.loads(raw.decode("utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        raise PathPolicyError("isolated_writer_path_policy_json_rejected") from None
-    canonical = _canonical_json(document)
-    if raw != canonical:
-        raise PathPolicyError("isolated_writer_path_policy_not_canonical")
-    return _parse_policy(document, canonical)
-
-
-@lru_cache(maxsize=1)
-def configured_path_policy() -> ServicePathPolicy | None:
-    configured = os.getenv("AIOS_GITOPS_PATH_POLICY_FILE", "").strip()
-    if not configured:
-        return None
-    if not Path(configured).is_absolute():
-        raise PathPolicyError("isolated_writer_path_policy_path_rejected")
-    try:
-        gitops_gid = grp.getgrnam("gitops").gr_gid
-    except KeyError:
-        raise PathPolicyError("isolated_writer_path_policy_group_rejected") from None
-    loaded = load_path_policy(Path(configured), expected_group_gid=gitops_gid)
-    if loaded.audience != os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", ""):
-        raise PathPolicyError("isolated_writer_path_policy_audience_rejected")
-    if loaded.repository_identity != os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", ""):
-        raise PathPolicyError("isolated_writer_path_policy_repository_rejected")
-    if loaded.allowed_branch != os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", ""):
-        raise PathPolicyError("isolated_writer_path_policy_branch_rejected")
-    return loaded
-
-
-def clear_path_policy_cache() -> None:
-    configured_path_policy.cache_clear()
-
-
-def require_service_path(operation: str, path: str) -> OperationPolicy:
-    loaded = configured_path_policy()
-    if loaded is None:
-        raise PathPolicyError("isolated_writer_service_path_policy_required")
-    return loaded.require_exact_path(operation, path)
-
-
-def configured_path_policy_sha256() -> str | None:
-    loaded = configured_path_policy()
-    return None if loaded is None else loaded.sha256
-
-
-def validate_content(operation: str, path: str, content: str) -> None:
-    selected = require_service_path(operation, path)
-    try:
-        encoded = content.encode("utf-8", errors="strict")
-    except (AttributeError, UnicodeEncodeError):
-        raise PathPolicyError("isolated_writer_systemd_profile_rejected") from None
-    if len(encoded) > selected.max_content_bytes:
-        raise PathPolicyError("isolated_writer_service_content_too_large")
-    if selected.content_profile == "systemd-codex-review-worker-v1":
-        _validate_systemd_codex_review_worker(content)
-        return
-    raise PathPolicyError("isolated_writer_path_policy_profile_rejected")
-
-
-def _validate_systemd_codex_review_worker(content: str) -> None:
-    if not isinstance(content, str):
-        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-    try:
-        content.encode("utf-8", errors="strict")
-    except UnicodeEncodeError:
-        raise PathPolicyError("isolated_writer_systemd_profile_rejected") from None
-    if (
-        "\x00" in content
-        or "\r" in content
-        or _SECRET_RE.search(content)
-        or not content.endswith("\n")
-    ):
-        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-
-    sections: set[str] = set()
-    values: dict[tuple[str, str], list[str]] = {}
-    section: str | None = None
-    for line in content.splitlines():
-        if len(line.encode("utf-8")) > _SYSTEMD_MAX_LINE_BYTES:
-            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-        if not line:
-            continue
-        if line[0].isspace() or line.startswith(("#", ";")):
-            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-        if line.startswith("[") and line.endswith("]"):
-            candidate = line[1:-1]
-            if (
-                not _SYSTEMD_NAME_RE.fullmatch(candidate)
-                or candidate not in _SYSTEMD_ALLOWED_DIRECTIVES
-                or candidate in sections
-            ):
-                raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-            sections.add(candidate)
-            section = candidate
-            continue
-        if section is None or "=" not in line:
-            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-        directive, value = line.split("=", 1)
-        if (
-            not _SYSTEMD_NAME_RE.fullmatch(directive)
-            or directive not in _SYSTEMD_ALLOWED_DIRECTIVES[section]
-            or not value
-            or value != value.strip()
-        ):
-            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-        key = (section, directive)
-        if key in values and key not in _SYSTEMD_MULTI_DIRECTIVES:
-            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-        values.setdefault(key, []).append(value)
-
-    if sections != set(_SYSTEMD_ALLOWED_DIRECTIVES):
-        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-    if set(values) != set(_SYSTEMD_EXACT_SINGLE_VALUES) | set(
-        _SYSTEMD_EXACT_MULTI_VALUES
-    ):
-        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-    for key, expected in _SYSTEMD_EXACT_SINGLE_VALUES.items():
-        if values.get(key) != [expected]:
-            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
-    for key, expected in _SYSTEMD_EXACT_MULTI_VALUES.items():
-        observed = values.get(key, [])
-        if len(observed) != len(set(observed)) or tuple(observed) != expected:
-            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
@@ -1,241 +0,0 @@
-"""Digest-only, task-scoped token registry for isolated writers."""
-from __future__ import annotations
-
-import argparse
-import hashlib
-import hmac
-import json
-import os
-import grp
-import pwd
-import secrets
-import sqlite3
-import stat
-import threading
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any
-
-_REGISTRY_INIT_LOCK = threading.Lock()
-
-
-def utc_now() -> str:
-    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-
-
-def token_digest(token: str) -> str:
-    return hashlib.sha256(token.encode("utf-8")).hexdigest()
-
-
-class TokenRegistry:
-    def __init__(self, path: Path | str):
-        self.path = Path(path)
-        self._prepare()
-
-    def _prepare(self) -> None:
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        if self.path.parent.is_symlink() or self.path.is_symlink():
-            raise PermissionError("writer_token_registry_symlink_rejected")
-        with _REGISTRY_INIT_LOCK:
-            with self._connect() as db:
-                db.executescript(
-                    """
-                    CREATE TABLE IF NOT EXISTS token_grants (
-                        token_id TEXT PRIMARY KEY,
-                        token_digest TEXT NOT NULL UNIQUE,
-                        grant_json TEXT NOT NULL,
-                        revoked INTEGER NOT NULL DEFAULT 0,
-                        created_at TEXT NOT NULL
-                    );
-                    CREATE TABLE IF NOT EXISTS token_uses (
-                        token_id TEXT NOT NULL,
-                        operation TEXT NOT NULL,
-                        use_count INTEGER NOT NULL DEFAULT 0,
-                        PRIMARY KEY(token_id, operation),
-                        FOREIGN KEY(token_id) REFERENCES token_grants(token_id)
-                    );
-                    """
-                )
-        os.chmod(self.path, 0o600)
-
-    def _connect(self) -> sqlite3.Connection:
-        db = sqlite3.connect(self.path, timeout=30, isolation_level=None)
-        db.row_factory = sqlite3.Row
-        db.execute("PRAGMA journal_mode=WAL")
-        db.execute("PRAGMA synchronous=FULL")
-        db.execute("PRAGMA foreign_keys=ON")
-        return db
-
-    def issue(self, grant: dict[str, Any], token: str | None = None) -> tuple[str, dict[str, Any]]:
-        value = token or secrets.token_urlsafe(32)
-        if len(value.encode("utf-8")) < 32:
-            raise ValueError("writer_token_entropy_insufficient")
-        record = dict(grant)
-        record["schema_version"] = 2
-        record["token_digest"] = token_digest(value)
-        record["revoked"] = False
-        record.setdefault("created_at", utc_now())
-        required = (
-            "token_id",
-            "audience",
-            "task_id",
-            "source_cidrs",
-            "allowed_branch",
-            "approved_base_oid",
-            "allowed_operations",
-            "allowed_paths",
-            "not_before",
-            "expires_at",
-            "max_uses",
-            "issued_by",
-        )
-        if any(not record.get(field) for field in required):
-            raise ValueError("writer_token_grant_incomplete")
-        encoded = json.dumps(record, sort_keys=True, separators=(",", ":"))
-        with self._connect() as db:
-            db.execute("BEGIN IMMEDIATE")
-            try:
-                db.execute(
-                    """
-                    INSERT INTO token_grants(token_id, token_digest, grant_json, revoked, created_at)
-                    VALUES(?,?,?,?,?)
-                    """,
-                    (
-                        str(record["token_id"]),
-                        str(record["token_digest"]),
-                        encoded,
-                        0,
-                        str(record["created_at"]),
-                    ),
-                )
-                db.execute("COMMIT")
-            except Exception:
-                db.execute("ROLLBACK")
-                raise
-        return value, record
-
-    def find(self, token: str) -> dict[str, Any] | None:
-        candidate = token_digest(token)
-        with self._connect() as db:
-            rows = db.execute(
-                "SELECT token_digest, grant_json, revoked FROM token_grants"
-            ).fetchall()
-        match = None
-        for row in rows:
-            if hmac.compare_digest(str(row["token_digest"]), candidate):
-                match = dict(json.loads(str(row["grant_json"])))
-                match["revoked"] = bool(row["revoked"])
-        return match
-
-    def consume(self, token_id: str, operation: str, maximum: int) -> int:
-        if maximum < 1:
-            raise PermissionError("writer_token_operation_exhausted")
-        with self._connect() as db:
-            db.execute("BEGIN IMMEDIATE")
-            try:
-                row = db.execute(
-                    "SELECT revoked FROM token_grants WHERE token_id=?",
-                    (token_id,),
-                ).fetchone()
-                if row is None or bool(row["revoked"]):
-                    raise PermissionError("writer_token_revoked")
-                used_row = db.execute(
-                    "SELECT use_count FROM token_uses WHERE token_id=? AND operation=?",
-                    (token_id, operation),
-                ).fetchone()
-                used = int(used_row["use_count"]) if used_row else 0
-                if used >= maximum:
-                    raise PermissionError("writer_token_operation_exhausted")
-                current = used + 1
-                db.execute(
-                    """
-                    INSERT INTO token_uses(token_id, operation, use_count)
-                    VALUES(?,?,?)
-                    ON CONFLICT(token_id, operation)
-                    DO UPDATE SET use_count=excluded.use_count
-                    """,
-                    (token_id, operation, current),
-                )
-                db.execute("COMMIT")
-                return current
-            except Exception:
-                db.execute("ROLLBACK")
-                raise
-
-    def revoke(self, token_id: str) -> bool:
-        with self._connect() as db:
-            db.execute("BEGIN IMMEDIATE")
-            changed = db.execute(
-                "UPDATE token_grants SET revoked=1 WHERE token_id=? AND revoked=0",
-                (token_id,),
-            ).rowcount
-            db.execute("COMMIT")
-        return bool(changed)
-
-    def usage(self, token_id: str, operation: str) -> int:
-        with self._connect() as db:
-            row = db.execute(
-                "SELECT use_count FROM token_uses WHERE token_id=? AND operation=?",
-                (token_id, operation),
-            ).fetchone()
-        return int(row["use_count"]) if row else 0
-
-
-def _write_secret_file(
-    path: Path,
-    token: str,
-    *,
-    owner: str | None = None,
-    group: str | None = None,
-) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    if path.parent.is_symlink() or path.is_symlink():
-        raise PermissionError("writer_token_file_symlink_rejected")
-    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
-    if hasattr(os, "O_NOFOLLOW"):
-        flags |= os.O_NOFOLLOW
-    fd = os.open(path, flags, 0o600)
-    try:
-        if not stat.S_ISREG(os.fstat(fd).st_mode):
-            raise PermissionError("writer_token_file_not_regular")
-        if owner is not None or group is not None:
-            uid = pwd.getpwnam(owner).pw_uid if owner is not None else -1
-            gid = grp.getgrnam(group).gr_gid if group is not None else -1
-            os.fchown(fd, uid, gid)
-        os.write(fd, token.encode("utf-8"))
-        os.fsync(fd)
-    finally:
-        os.close(fd)
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--registry", required=True)
-    sub = parser.add_subparsers(dest="command", required=True)
-    issue = sub.add_parser("issue")
-    issue.add_argument("--grant-file", required=True)
-    issue.add_argument("--token-file", required=True)
-    issue.add_argument("--owner")
-    issue.add_argument("--group")
-    revoke = sub.add_parser("revoke")
-    revoke.add_argument("--token-id", required=True)
-    args = parser.parse_args(argv)
-    registry = TokenRegistry(args.registry)
-    if args.command == "issue":
-        grant = json.loads(Path(args.grant_file).read_text(encoding="utf-8"))
-        token, record = registry.issue(grant)
-        _write_secret_file(
-            Path(args.token_file),
-            token,
-            owner=args.owner,
-            group=args.group,
-        )
-        print(json.dumps({"token_id": record["token_id"], "created": True}, sort_keys=True))
-        return 0
-    changed = registry.revoke(args.token_id)
-    print(json.dumps({"token_id": args.token_id, "revoked": changed}, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,564 +0,0 @@
-#!/usr/bin/env python3
-"""Execution-readiness adapters and the fail-closed Shadow controller service."""
-from __future__ import annotations
-
-import argparse
-import base64
-import dataclasses
-import hashlib
-import json
-import os
-import subprocess
-import threading
-import time
-from http import HTTPStatus
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol
-from urllib.parse import parse_qs, urlparse
-
-from cryptography.hazmat.primitives.asymmetric.ed25519 import (
-    Ed25519PrivateKey,
-)
-
-from silent_release_controller import _sanitize, utc_now
-from silent_release_hardening import (
-    BuilderAttestation,
-    CapabilityAuthorizationError,
-    ReleaseRecoveryWorker,
-    SignedApprovalVerifier,
-    SignedReleasePlanApproval,
-    SilentReleaseActionService,
-    TrustedCandidateBundle,
-    _canonical_json,
-    _durable_json,
-    _safe_child,
-)
-
-
-class BuilderSigner(Protocol):
-    @property
-    def key_id(self) -> str:
-        ...
-
-    def sign(self, payload: bytes) -> bytes:
-        ...
-
-
-class LocalTestBuilderSigner:
-    """Ephemeral in-memory signer. It is forbidden for production execution."""
-
-    test_only = True
-
-    def __init__(self, key_id: str, private_key: Ed25519PrivateKey):
-        self._key_id = str(key_id)
-        self._private_key = private_key
-
-    @property
-    def key_id(self) -> str:
-        return self._key_id
-
-    @classmethod
-    def generate(
-        cls, key_id: str = "shadow-builder-test-key"
-    ) -> "LocalTestBuilderSigner":
-        return cls(key_id, Ed25519PrivateKey.generate())
-
-    @property
-    def public_key(self):
-        return self._private_key.public_key()
-
-    def sign(self, payload: bytes) -> bytes:
-        return self._private_key.sign(payload)
-
-
-class ExternalKmsBuilderSigner:
-    """Signer facade whose private operation remains in KMS/HSM."""
-
-    def __init__(
-        self,
-        key_id: str,
-        credential_reference: str,
-        sign_callback: Callable[[str, bytes], bytes],
-    ):
-        if not str(credential_reference).startswith(
-            ("kms://", "hsm://", "secret-manager://")
-        ):
-            raise ValueError("production builder requires a KMS/HSM reference")
-        self._key_id = str(key_id)
-        self.credential_reference = str(credential_reference)
-        self._sign_callback = sign_callback
-
-    @property
-    def key_id(self) -> str:
-        return self._key_id
-
-    def sign(self, payload: bytes) -> bytes:
-        return bytes(self._sign_callback(self.credential_reference, payload))
-
-
-class SignedTrustedBuilderAdapter:
-    """Signs evidence produced by a trusted collector, never caller evidence."""
-
-    def __init__(
-        self,
-        collector: Callable[[Mapping[str, Any]], TrustedCandidateBundle],
-        signer: BuilderSigner,
-    ):
-        self.collector = collector
-        self.signer = signer
-
-    def build(self, intent: Mapping[str, Any]) -> TrustedCandidateBundle:
-        forbidden = {
-            "artifact_sha256",
-            "canary",
-            "checks",
-            "manifest_sha256",
-            "tests",
-            "tree_oid",
-        }
-        if forbidden.intersection(intent):
-            raise CapabilityAuthorizationError(
-                "trusted builder rejects caller-supplied evidence"
-            )
-        unsigned = self.collector(dict(intent))
-        if unsigned.attestation is not None:
-            raise CapabilityAuthorizationError(
-                "collector cannot self-attest its evidence"
-            )
-        candidate = unsigned.candidate
-        test_sha = hashlib.sha256(
-            _canonical_json(_sanitize(candidate.tests))
-        ).hexdigest()
-        canary_sha = hashlib.sha256(
-            _canonical_json(_sanitize(candidate.canary))
-        ).hexdigest()
-        attestation_id = "builder-attestation-" + hashlib.sha256(
-            (
-                candidate.candidate_id
-                + "\0"
-                + candidate.source_commit
-                + "\0"
-                + candidate.artifact_sha256
-            ).encode("utf-8")
-        ).hexdigest()[:24]
-        attestation = BuilderAttestation(
-            builder_attestation_id=attestation_id,
-            builder_key_id=self.signer.key_id,
-            source_commit=candidate.source_commit,
-            tree_oid=candidate.tree_oid,
-            artifact_sha256=candidate.artifact_sha256,
-            manifest_sha256=candidate.manifest_sha256,
-            package_closure_sha256=(
-                unsigned.release_plan.deployment.package_closure_sha256
-            ),
-            test_evidence_sha256=test_sha,
-            canary_evidence_sha256=canary_sha,
-            issued_at=utc_now(),
-            signature="",
-        )
-        attestation = dataclasses.replace(
-            attestation,
-            signature=base64.b64encode(
-                self.signer.sign(attestation.canonical_bytes())
-            ).decode("ascii"),
-        )
-        return dataclasses.replace(unsigned, attestation=attestation)
-
-
-class ApprovalBackendAdapter(Protocol):
-    @property
-    def available(self) -> bool:
-        ...
-
-    def verify(
-        self,
-        approval: SignedReleasePlanApproval,
-        *,
-        candidate,
-        release_plan,
-        policy_sha256: str,
-    ) -> SignedReleasePlanApproval:
-        ...
-
-
-class LocalTestApprovalSigner:
-    """Test-only approval signer used solely for Shadow acceptance."""
-
-    test_only = True
-
-    def __init__(self, key_id: str, private_key: Ed25519PrivateKey):
-        self.key_id = str(key_id)
-        self.private_key = private_key
-
-    @classmethod
-    def generate(
-        cls, key_id: str = "shadow-owner-test-key"
-    ) -> "LocalTestApprovalSigner":
-        return cls(key_id, Ed25519PrivateKey.generate())
-
-    def sign(
-        self, approval: SignedReleasePlanApproval
-    ) -> SignedReleasePlanApproval:
-        unsigned = dataclasses.replace(
-            approval, key_id=self.key_id, signature=""
-        )
-        return dataclasses.replace(
-            unsigned,
-            signature=base64.b64encode(
-                self.private_key.sign(unsigned.canonical_bytes())
-            ).decode("ascii"),
-        )
-
-
-class ProductionApprovalBackendAdapter:
-    """Verification-only production adapter configured by a secret/KMS ref."""
-
-    def __init__(
-        self,
-        verifier: SignedApprovalVerifier,
-        credential_reference: str,
-    ):
-        if not str(credential_reference).startswith(
-            ("kms://", "hsm://", "secret-manager://")
-        ):
-            raise ValueError(
-                "production approval backend requires a KMS/secret reference"
-            )
-        self.verifier = verifier
-        self.credential_reference = str(credential_reference)
-
-    @property
-    def available(self) -> bool:
-        return True
-
-    def verify(
-        self,
-        approval: SignedReleasePlanApproval,
-        *,
-        candidate,
-        release_plan,
-        policy_sha256: str,
-    ) -> SignedReleasePlanApproval:
-        return self.verifier.verify_release_plan(
-            approval, candidate, release_plan, policy_sha256
-        )
-
-
-class UnavailableProductionApprovalBackend:
-    credential_reference = None
-
-    @property
-    def available(self) -> bool:
-        return False
-
-    def verify(self, *args, **kwargs):
-        raise CapabilityAuthorizationError(
-            "production approval backend is not configured"
-        )
-
-
-class LeaderLock:
-    def __init__(self, path: Path):
-        self.path = Path(path)
-        self.handle = None
-
-    def __enter__(self):
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        os.chmod(self.path.parent, 0o700)
-        self.handle = self.path.open("a+", encoding="utf-8")
-        os.chmod(self.path, 0o600)
-        try:
-            import fcntl
-
-            fcntl.flock(
-                self.handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB
-            )
-        except BlockingIOError as exc:
-            self.handle.close()
-            self.handle = None
-            raise RuntimeError("silent release leader is already active") from exc
-        return self
-
-    def __exit__(self, exc_type, exc, tb):
-        if self.handle is not None:
-            try:
-                import fcntl
-
-                fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
-            finally:
-                self.handle.close()
-                self.handle = None
-
-
-class PersistentSilentReleaseController:
-    """Idempotent main-event controller with durable startup/recovery reports."""
-
-    def __init__(
-        self,
-        root: Path,
-        service: SilentReleaseActionService,
-        *,
-        main_probe: Callable[[], str],
-        recovery_worker: ReleaseRecoveryWorker | None = None,
-    ):
-        self.root = Path(root)
-        self.service = service
-        self.main_probe = main_probe
-        self.recovery_worker = recovery_worker
-        self.leader_path = self.root / "controller.leader.lock"
-        self.status_path = self.root / "controller-status.json"
-
-    def startup_verify(self) -> dict[str, Any]:
-        checked = 0
-        failed = 0
-        for journal in sorted(self.service.sagas.root.glob("*.events.jsonl")):
-            candidate_id = journal.name[: -len(".events.jsonl")]
-            saga = self.service.sagas.load(candidate_id)
-            checked += 1
-            if not saga.journal_integrity:
-                failed += 1
-        status = {
-            "checked_sagas": checked,
-            "execution_enabled": self.service.execution_enabled,
-            "failed_closed": failed,
-            "shadow_mode": not self.service.execution_enabled,
-            "side_effects_executed": False,
-            "status": "READY" if failed == 0 else "FAIL_CLOSED",
-        }
-        _durable_json(self.status_path, status)
-        return status
-
-    def run_once(self) -> dict[str, Any]:
-        with LeaderLock(self.leader_path):
-            startup = self.startup_verify()
-            if startup["status"] != "READY":
-                result = {
-                    "execution_enabled": self.service.execution_enabled,
-                    "intent": None,
-                    "notification": None,
-                    "recovery": None,
-                    "shadow_mode": not self.service.execution_enabled,
-                    "side_effects_executed": False,
-                    "startup": startup,
-                    "status": "FAIL_CLOSED",
-                }
-                _durable_json(self.status_path, result)
-                return _sanitize(result)
-            source_commit = str(self.main_probe())
-            event_id = f"main-{source_commit}"
-            intent = self.service.create_release_intent(
-                {"event_id": event_id, "source_commit": source_commit}
-            )
-            notification = None
-            if intent.get("candidate_id"):
-                notification = self.service.ensure_owner_notification(
-                    str(intent["candidate_id"])
-                )
-            recovery = (
-                self.recovery_worker.run_once()
-                if self.recovery_worker is not None
-                else self.service.get_recovery_status()
-            )
-            result = {
-                "execution_enabled": self.service.execution_enabled,
-                "intent": intent,
-                "notification": notification,
-                "recovery": recovery,
-                "shadow_mode": not self.service.execution_enabled,
-                "side_effects_executed": False,
-                "startup": startup,
-            }
-            _durable_json(self.status_path, result)
-            return _sanitize(result)
-
-
-class ShadowActionHandler(BaseHTTPRequestHandler):
-    service: SilentReleaseActionService
-    controller: PersistentSilentReleaseController
-
-    def log_message(self, fmt, *args):
-        return
-
-    def _json(self, payload: Mapping[str, Any], status=HTTPStatus.OK):
-        body = json.dumps(_sanitize(dict(payload)), sort_keys=True).encode()
-        self.send_response(int(status))
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(body)))
-        self.end_headers()
-        self.wfile.write(body)
-
-    def _body(self) -> dict[str, Any]:
-        size = int(self.headers.get("Content-Length", "0"))
-        if size > 1024 * 1024:
-            raise ValueError("request body is too large")
-        return json.loads(self.rfile.read(size) or b"{}")
-
-    def do_GET(self):
-        parsed = urlparse(self.path)
-        query = parse_qs(parsed.query)
-        candidate_id = str((query.get("candidate_id") or [""])[0])
-        try:
-            if parsed.path == "/healthz":
-                return self._json(
-                    {
-                        "execution_enabled": False,
-                        "shadow_mode": True,
-                        "side_effects_executed": False,
-                        "status": "ok",
-                    }
-                )
-            routes = {
-                "/getReleaseCandidate": self.service.get_release_candidate,
-                "/getReleasePlan": self.service.get_release_plan,
-                "/getReleaseAcceptance": self.service.get_acceptance,
-                "/getReleaseSaga": self.service.get_release_saga,
-                "/getCapabilityStatus": self.service.get_capability_status,
-            }
-            if parsed.path in routes:
-                return self._json(routes[parsed.path](candidate_id))
-            if parsed.path == "/getRecoveryStatus":
-                return self._json(self.service.get_recovery_status())
-            self._json({"error": "not_found"}, HTTPStatus.NOT_FOUND)
-        except (ValueError, FileNotFoundError) as exc:
-            self._json(
-                {"error": type(exc).__name__}, HTTPStatus.BAD_REQUEST
-            )
-
-    def do_POST(self):
-        parsed = urlparse(self.path)
-        try:
-            body = self._body()
-            if parsed.path == "/createReleaseIntent":
-                return self._json(self.service.create_release_intent(body))
-            if parsed.path in {
-                "/submitSignedApproval",
-                "/submitOwnerApproval",
-            }:
-                return self._json(self.service.submit_owner_approval(body))
-            if parsed.path == "/startDeployment":
-                return self._json(
-                    self.service.start_deployment(
-                        str(body.get("candidate_id") or "")
-                    )
-                )
-            self._json({"error": "not_found"}, HTTPStatus.NOT_FOUND)
-        except (ValueError, FileNotFoundError, CapabilityAuthorizationError) as exc:
-            self._json(
-                {"error": type(exc).__name__}, HTTPStatus.BAD_REQUEST
-            )
-
-
-def git_main_probe(repository: Path) -> Callable[[], str]:
-    repository = Path(repository)
-
-    def probe() -> str:
-        completed = subprocess.run(
-            [
-                "git",
-                f"--git-dir={repository}",
-                "rev-parse",
-                "refs/heads/main",
-            ],
-            check=True,
-            capture_output=True,
-            text=True,
-            timeout=15,
-            env={"PATH": os.environ.get("PATH", "")},
-        )
-        return completed.stdout.strip()
-
-    return probe
-
-
-def serve_shadow(
-    *,
-    state_root: Path,
-    repository: Path,
-    host: str,
-    port: int,
-    poll_seconds: float,
-) -> None:
-    service = SilentReleaseActionService.shadow(state_root)
-    controller = PersistentSilentReleaseController(
-        state_root,
-        service,
-        main_probe=git_main_probe(repository),
-    )
-    controller.run_once()
-    stop = threading.Event()
-
-    def controller_loop() -> None:
-        while not stop.wait(poll_seconds):
-            try:
-                controller.run_once()
-            except Exception as exc:  # fail closed and keep the API available
-                _durable_json(
-                    controller.status_path,
-                    {
-                        "error": type(exc).__name__,
-                        "execution_enabled": False,
-                        "shadow_mode": True,
-                        "side_effects_executed": False,
-                        "status": "FAIL_CLOSED",
-                    },
-                )
-
-    handler = type(
-        "ConfiguredShadowActionHandler",
-        (ShadowActionHandler,),
-        {"service": service, "controller": controller},
-    )
-    server = ThreadingHTTPServer((host, port), handler)
-    api_thread = threading.Thread(
-        target=server.serve_forever,
-        name="silent-release-shadow-api",
-        daemon=False,
-    )
-    controller_thread = threading.Thread(
-        target=controller_loop,
-        name="silent-release-shadow-controller",
-        daemon=True,
-    )
-    api_thread.start()
-    controller_thread.start()
-    try:
-        while api_thread.is_alive():
-            api_thread.join(timeout=1)
-    finally:
-        stop.set()
-        server.shutdown()
-        server.server_close()
-        controller_thread.join(timeout=max(1.0, poll_seconds + 1.0))
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--state-root", required=True, type=Path)
-    parser.add_argument("--repository", required=True, type=Path)
-    parser.add_argument("--host", default="127.0.0.1")
-    parser.add_argument("--port", default=18891, type=int)
-    parser.add_argument("--poll-seconds", default=30.0, type=float)
-    arguments = parser.parse_args()
-    if arguments.poll_seconds <= 0:
-        raise SystemExit("poll seconds must be positive")
-    if os.environ.get("AIOS_GITOPS_WRITES_ENABLED", "false").lower() != "false":
-        raise SystemExit("GitOps writes must remain disabled")
-    if (
-        os.environ.get(
-            "AIOS_SILENT_RELEASE_EXECUTION_ENABLED", "false"
-        ).lower()
-        != "false"
-    ):
-        raise SystemExit("Silent Release execution must remain disabled")
-    serve_shadow(
-        state_root=arguments.state_root,
-        repository=arguments.repository,
-        host=arguments.host,
-        port=arguments.port,
-        poll_seconds=arguments.poll_seconds,
-    )
-
-
-if __name__ == "__main__":
-    main()
@@ -1,21 +0,0 @@
-"""Task Plane runtime package."""
-
-from .models import (
-    EvidenceEnvelope,
-    ProbeEvidence,
-    ProbeOutcome,
-    TaskPlan,
-    TaskRecord,
-    TaskStatus,
-    TaskStateTransitionError,
-)
-
-__all__ = [
-    "EvidenceEnvelope",
-    "ProbeEvidence",
-    "ProbeOutcome",
-    "TaskPlan",
-    "TaskRecord",
-    "TaskStatus",
-    "TaskStateTransitionError",
-]
@@ -1,17 +0,0 @@
-"""Adapters for executing tasks via worker backends."""
-
-from .base import WorkerAdapter
-from .openclaw import OpenClawAdapter
-from .codex import CodexAdapter
-from .hermes import HermesAdapter
-from .a2a import A2AAdapter
-from .systemd_worker import SystemdWorkerAdapter
-
-__all__ = [
-    "WorkerAdapter",
-    "OpenClawAdapter",
-    "CodexAdapter",
-    "HermesAdapter",
-    "A2AAdapter",
-    "SystemdWorkerAdapter",
-]
@@ -1,31 +0,0 @@
-from __future__ import annotations
-
-from .base import WorkerAdapter
-
-
-class A2AAdapter(WorkerAdapter):
-    worker_name = "a2a"
-
-    def capabilities(self) -> list[str]:
-        return ["task.exchange", "agent.handoff"]
-
-    def claim(self, task):
-        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
-
-    def execute(self, task, claim):
-        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
-
-    def heartbeat(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
-
-    def report_progress(self, claim, progress):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
-
-    def probe(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
-
-    def cancel(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
-
-    def collect_result(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}
@@ -1,41 +0,0 @@
-"""Base worker adapter contract."""
-
-from __future__ import annotations
-
-import abc
-
-
-class WorkerAdapter(abc.ABC):
-    worker_name = "base"
-
-    @abc.abstractmethod
-    def capabilities(self) -> list[str]:
-        raise NotImplementedError
-
-    @abc.abstractmethod
-    def claim(self, task):
-        raise NotImplementedError
-
-    @abc.abstractmethod
-    def execute(self, task, claim):
-        raise NotImplementedError
-
-    @abc.abstractmethod
-    def heartbeat(self, claim):
-        raise NotImplementedError
-
-    @abc.abstractmethod
-    def report_progress(self, claim, progress):
-        raise NotImplementedError
-
-    @abc.abstractmethod
-    def probe(self, claim):
-        raise NotImplementedError
-
-    @abc.abstractmethod
-    def cancel(self, claim):
-        raise NotImplementedError
-
-    @abc.abstractmethod
-    def collect_result(self, claim):
-        raise NotImplementedError
@@ -1,31 +0,0 @@
-from __future__ import annotations
-
-from .base import WorkerAdapter
-
-
-class CodexAdapter(WorkerAdapter):
-    worker_name = "codex"
-
-    def capabilities(self) -> list[str]:
-        return ["code.read", "code.write.patch", "test.python", "review.security"]
-
-    def claim(self, task):
-        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
-
-    def execute(self, task, claim):
-        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
-
-    def heartbeat(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
-
-    def report_progress(self, claim, progress):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
-
-    def probe(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
-
-    def cancel(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
-
-    def collect_result(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}
@@ -1,31 +0,0 @@
-from __future__ import annotations
-
-from .base import WorkerAdapter
-
-
-class HermesAdapter(WorkerAdapter):
-    worker_name = "hermes"
-
-    def capabilities(self) -> list[str]:
-        return ["architecture.review", "policy.review", "threat.model"]
-
-    def claim(self, task):
-        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
-
-    def execute(self, task, claim):
-        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
-
-    def heartbeat(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
-
-    def report_progress(self, claim, progress):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
-
-    def probe(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
-
-    def cancel(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
-
-    def collect_result(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}
@@ -1,31 +0,0 @@
-from __future__ import annotations
-
-from .base import WorkerAdapter
-
-
-class OpenClawAdapter(WorkerAdapter):
-    worker_name = "openclaw"
-
-    def capabilities(self) -> list[str]:
-        return ["code.read", "code.write.patch", "test.execute", "runtime.shadow"]
-
-    def claim(self, task):
-        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
-
-    def execute(self, task, claim):
-        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
-
-    def heartbeat(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
-
-    def report_progress(self, claim, progress):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
-
-    def probe(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
-
-    def cancel(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
-
-    def collect_result(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}
@@ -1,31 +0,0 @@
-from __future__ import annotations
-
-from .base import WorkerAdapter
-
-
-class SystemdWorkerAdapter(WorkerAdapter):
-    worker_name = "systemd_worker"
-
-    def capabilities(self) -> list[str]:
-        return ["systemd.exec", "runtime.shell"]
-
-    def claim(self, task):
-        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
-
-    def execute(self, task, claim):
-        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
-
-    def heartbeat(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
-
-    def report_progress(self, claim, progress):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
-
-    def probe(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
-
-    def cancel(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
-
-    def collect_result(self, claim):
-        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}
@@ -1,27 +0,0 @@
-"""Agent registry abstraction."""
-
-from __future__ import annotations
-
-from .errors import NotFoundError
-
-
-class AgentRegistry:
-    def __init__(self):
-        self._agents: dict[str, dict] = {}
-
-    def register(self, agent_id: str, metadata: dict) -> None:
-        self._agents[agent_id] = {"agent_id": agent_id, **metadata}
-
-    def unregister(self, agent_id: str) -> None:
-        if agent_id not in self._agents:
-            raise NotFoundError("agent")
-        del self._agents[agent_id]
-
-    def list(self) -> list[dict]:
-        return list(self._agents.values())
-
-    def get(self, agent_id: str) -> dict:
-        try:
-            return self._agents[agent_id]
-        except KeyError:
-            raise NotFoundError("agent")
@@ -1,557 +0,0 @@
-"""Task Plane HTTP API implementation (stdlib-only)."""
-
-from __future__ import annotations
-
-import json
-import os
-import time
-import uuid
-import urllib.parse
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from typing import Any, Callable
-
-from .delegation import DelegationEngine
-from .errors import (
-    ConflictError,
-    ForbiddenError,
-    NotFoundError,
-    PayloadTooLargeError,
-    TaskPlaneHTTPError,
-    UnauthorizedError,
-    ValidationError,
-)
-from .evidence import EvidenceService
-from .journal import TaskJournal
-from .lease import LeaseManager
-from .models import (
-    EvidenceEnvelope,
-    ResultEnvelope,
-    TaskPlan,
-    TaskRecord,
-    iso8601_now,
-    contains_secret_text,
-    validate_identifier,
-)
-from .policy import PolicyEngine
-from .store import TaskPlaneStore
-from .worker_registry import WorkerRegistry
-
-
-def _json_payload(data: dict[str, Any], status: int = 200) -> tuple[int, bytes]:
-    body = json.dumps(data, ensure_ascii=False).encode("utf-8")
-    return status, body
-
-
-def _bounded_int(value: Any, name: str, minimum: int, maximum: int) -> int:
-    try:
-        number = int(value)
-    except (TypeError, ValueError) as exc:
-        raise ValidationError(f"invalid {name}") from exc
-    if not minimum <= number <= maximum:
-        raise ValidationError(f"invalid {name}")
-    return number
-
-
-class TaskPlaneService:
-    def __init__(self, store: TaskPlaneStore, policy: PolicyEngine | None = None):
-        self.store = store
-        self.policy = policy or PolicyEngine(
-            execution_enabled=False,
-            identity_capabilities={
-                "anon": {"task.creator", "task.read", "task.audit"}
-            },
-        )
-        self.journal = TaskJournal(store)
-        self.lease = LeaseManager(store)
-        self.workers = WorkerRegistry(store)
-        self.evidence = EvidenceService(store)
-        self.delegation = DelegationEngine(store)
-        self.store.probe_attestation_verifier = self.policy.probe_attestation_verifier
-
-    def create_task(self, body: dict[str, Any], idempotency_key: str | None = None) -> dict[str, Any]:
-        if body.get("parent_task_id"):
-            raise ForbiddenError("child tasks must use the delegate endpoint")
-        issuer = body.get("issuer", {})
-        actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
-        self.policy.assert_allowed("create", actor)
-        try:
-            plan = TaskPlan.from_dict(body)
-        except (TypeError, ValueError) as exc:
-            raise ValidationError("invalid task plan") from exc
-        task = self.store.create_task_with_event(plan, idempotency_key=idempotency_key)
-        return task.to_dict()
-
-    def list_tasks(self, actor: str | None = None) -> list[dict[str, Any]]:
-        if actor is not None:
-            self.policy.assert_allowed("read", actor)
-        return [task.to_dict(include_task=False) for task in self.store.list_tasks()]
-
-    def get_task(self, task_id: str, actor: str | None = None) -> dict[str, Any]:
-        if actor is not None:
-            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
-        return self.store.get_task(task_id).to_dict()
-
-    def get_worker(self, worker_id: str, actor: str | None = None) -> dict[str, Any]:
-        if actor is not None:
-            self.policy.assert_allowed("read", actor)
-        return self.workers.get(worker_id).to_dict()
-
-    def list_workers(self, actor: str | None = None) -> list[dict[str, Any]]:
-        if actor is not None:
-            self.policy.assert_allowed("read", actor)
-        return [w.to_dict() for w in self.workers.list()]
-
-    def register_worker(self, body: dict[str, Any]) -> dict[str, Any]:
-        actor = str(body.get("actor_identity") or body.get("identity") or "")
-        is_admin = actor in self.policy.admin_identities
-        try:
-            existing = self.store.get_worker(str(body.get("worker_id") or ""))
-        except NotFoundError:
-            existing = None
-        if existing is not None and str(body.get("identity") or "") != existing.identity:
-            raise ConflictError("worker identity takeover rejected")
-        self.policy.assert_readonly_worker_registration(actor, body)
-        self.policy.assert_allowed(
-            "worker.admin" if is_admin else "worker.register", actor
-        )
-        try:
-            worker = self.workers.register(
-                body,
-                actor_identity=actor,
-                is_admin=is_admin,
-                expected_revision=body.get("expected_revision"),
-            )
-        except (TypeError, ValueError, KeyError) as exc:
-            raise ValidationError("invalid worker registration") from exc
-        return worker.to_dict()
-
-    def worker_heartbeat(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
-        interval = payload.get("heartbeat_interval_seconds")
-        actor = str(payload.get("actor_identity") or "")
-        self.policy.assert_readonly_worker_binding(actor, worker_id)
-        self.policy.assert_allowed("worker.register", actor)
-        return self.workers.heartbeat(
-            worker_id,
-            heartbeat_interval_seconds=interval,
-            actor_identity=actor,
-            expected_revision=payload.get("expected_revision"),
-        ).to_dict()
-
-    def disable_worker(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
-        actor = str(payload.get("actor_identity") or "")
-        self.policy.assert_allowed("worker.admin", actor)
-        return self.store.disable_worker(
-            worker_id,
-            actor_identity=actor,
-            expected_revision=int(payload.get("expected_revision")),
-            reason=str(payload.get("reason") or "disabled by administrator"),
-        ).to_dict()
-
-    def restore_worker(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
-        actor = str(payload.get("actor_identity") or "")
-        self.policy.assert_allowed("worker.admin", actor)
-        return self.store.restore_worker(
-            worker_id,
-            actor_identity=actor,
-            expected_revision=int(payload.get("expected_revision")),
-        ).to_dict()
-
-    def claim(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
-        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        self.policy.assert_allowed("claim", actor)
-        worker_id = body.get("worker_id")
-        if not worker_id:
-            raise ValidationError("worker_id required")
-
-        task = self.store.get_task(task_id)
-        self.policy.assert_readonly_worker_binding(actor, str(worker_id))
-        self.policy.assert_allowed("claim", actor, task=task)
-        lease_seconds = _bounded_int(
-            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
-        )
-        claim = self.lease.claim(
-            task_id=task_id,
-            worker_id=worker_id,
-            worker_identity=actor,
-            lease_seconds=lease_seconds,
-            expected_revision=task.revision,
-            operation_digest=task.task_plan.operation_digest(),
-        )
-        return {"claim_id": claim.claim_id, **claim.to_dict()}
-
-    def heartbeat(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
-        claim_id = body.get("claim_id")
-        if not claim_id:
-            raise ValidationError("claim_id required")
-        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        task = self.store.get_task(task_id)
-        claim = self.store.get_claim(claim_id)
-        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("heartbeat", actor, task=task)
-        if claim.worker_identity != actor:
-            raise ForbiddenError("claim identity mismatch")
-        lease_seconds = _bounded_int(
-            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
-        )
-        claim = self.lease.heartbeat(task_id, claim_id, lease_seconds)
-        return {"claim_id": claim_id, "lease_until": claim.lease_until}
-
-    def progress(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
-        claim_id = body.get("claim_id")
-        if not claim_id:
-            raise ValidationError("claim_id required")
-        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        progress = body.get("progress")
-        stage = body.get("stage", "RUNNING")
-        message = body.get("message")
-        if progress is None:
-            raise ValidationError("progress required")
-        task = self.store.get_task(task_id)
-        claim = self.store.get_claim(claim_id)
-        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("progress", actor, task=task)
-        if task.task_plan.data_classification == "credential-secret":
-            if message not in {None, ""} or contains_secret_text(stage):
-                raise ValidationError(
-                    "credential-secret progress must contain metadata only"
-                )
-        lease_seconds = _bounded_int(
-            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
-        )
-        claim = self.store.record_progress(
-            task_id,
-            claim_id,
-            actor,
-            progress=progress,
-            stage=str(stage),
-            message=None if message is None else str(message),
-            lease_seconds=lease_seconds,
-        )
-        return {"claim_id": claim.claim_id, "status": claim.status, "progress": progress}
-
-    def complete(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
-        claim_id = body.get("claim_id")
-        if not claim_id:
-            raise ValidationError("claim_id required")
-        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        task = self.store.get_task(task_id)
-
-        status = body.get("status", "COMPLETED")
-        outputs = body.get("outputs", [])
-        evidences = body.get("evidence", [])
-        if not isinstance(outputs, list):
-            raise ValidationError("outputs must be list")
-        if not isinstance(evidences, list):
-            raise ValidationError("evidence must be list")
-        if any(not isinstance(ev, dict) for ev in evidences):
-            raise ValidationError("evidence items must be objects")
-        claim = self.store.get_claim(claim_id)
-        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("result", actor, task=task)
-        if claim.worker_identity != actor:
-            raise ForbiddenError("claim identity mismatch")
-        if task.task_plan.data_classification == "credential-secret":
-            allowed_result_keys = {
-                "kind",
-                "hash",
-                "sha256",
-                "count",
-                "status",
-                "error_code",
-                "signature",
-                "attestation_ref",
-            }
-            for entry in [*outputs, *evidences]:
-                if (
-                    not isinstance(entry, dict)
-                    or set(entry) - allowed_result_keys
-                    or contains_secret_text(entry)
-                ):
-                    raise ValidationError(
-                        "credential-secret result must contain hash/count/status only"
-                    )
-
-        result = ResultEnvelope(
-            task_id=task_id,
-            claim_id=claim_id,
-            worker_identity=actor,
-            status=status,
-            outputs=outputs,
-            evidence=evidences,
-            started_at=str(body.get("started_at") or iso8601_now()),
-            completed_at=str(body.get("completed_at") or iso8601_now()),
-            result_digest=body.get("result_digest"),
-            signature=body.get("signature"),
-            attestation_ref=body.get("attestation_ref"),
-            operation_digest=claim.operation_digest,
-        )
-        evidence_decision = self.policy.evidence_verifier.verify(task, evidences)
-        if not evidence_decision.allowed:
-            raise ForbiddenError(evidence_decision.reason)
-        result_decision = self.policy.verify_result(result, task)
-        if not result_decision.allowed:
-            raise ForbiddenError(result_decision.reason)
-        result.result_digest = result.computed_digest()
-        previous = self.store._last_evidence_hash(task_id)
-        evidence_entries = []
-        for evidence in evidences:
-            envelope = EvidenceEnvelope.create(
-                task_id=task_id,
-                claim_id=claim_id,
-                kind=str(evidence.get("kind") or evidence.get("type") or "generic"),
-                worker_identity=actor,
-                payload=evidence,
-                previous_evidence_hash=previous,
-                signature=evidence.get("signature"),
-                attestation_ref=evidence.get("attestation_ref"),
-            )
-            evidence_entries.append(envelope)
-            previous = envelope.evidence_digest
-        self.store.complete_claim_with_evidence_and_event(
-            task_id,
-            claim_id,
-            status
-            if status
-            in {"COMPLETED", "FAILED_FINAL", "FAILED_RECOVERABLE", "CANCELLED"}
-            else "COMPLETED",
-            result.to_dict(),
-            evidence_entries,
-        )
-        return result.to_dict()
-
-    def fail(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
-        claim_id = body.get("claim_id")
-        if not claim_id:
-            raise ValidationError("claim_id required")
-        reason = body.get("reason", "failed")
-        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        self.policy.assert_allowed("fail", actor)
-        task = self.store.get_task(task_id)
-        self.policy.assert_allowed("fail", actor, task=task)
-        claim = self.store.get_claim(claim_id)
-        if claim.worker_identity != actor:
-            raise ForbiddenError("claim identity mismatch")
-        status = "FAILED_RECOVERABLE" if body.get("recoverable", False) else "FAILED_FINAL"
-        self.store.fail_claim_with_event(task_id, claim_id, status, str(reason))
-        return {"task_id": task_id, "status": status, "reason": reason}
-
-    def cancel(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
-        actor = body.get("actor_identity") or body.get("worker_identity") or "owner"
-        self.policy.assert_allowed("cancel", actor)
-        reason = body.get("reason", "cancelled")
-        task = self.store.get_task(task_id)
-        self.policy.assert_allowed("cancel", actor, task=task)
-        updated = self.store.cancel_task_with_event(
-            task_id, task.revision, reason=reason
-        )
-        return updated.to_dict()
-
-    def delegate(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
-        actor = body.get("actor_identity") or "owner"
-        self.policy.assert_allowed("delegate", actor)
-        parent = self.store.get_task(task_id)
-        self.policy.assert_allowed("delegate", actor, task=parent)
-        if "task" in body:
-            try:
-                child_plan = TaskPlan.from_dict(body["task"])
-            except (TypeError, ValueError) as exc:
-                raise ValidationError("invalid child task plan") from exc
-        else:
-            plan_body = dict(body)
-            plan_body.pop("actor_identity", None)
-            try:
-                child_plan = TaskPlan.from_dict(plan_body)
-            except (TypeError, ValueError) as exc:
-                raise ValidationError("invalid child task plan") from exc
-        child_plan.parent_task_id = task_id
-        child = self.delegation.delegate(task_id, child_plan, caller=actor)
-        return child.to_dict()
-
-    def get_events(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
-        if actor is not None:
-            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
-        self.store.get_task(task_id)
-        return self.store.list_events(task_id)
-
-    def get_evidence(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
-        if actor is not None:
-            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
-        self.store.get_task(task_id)
-        return self.evidence.list(task_id)
-
-    def get_children(self, task_id: str, actor: str | None = None) -> list[str]:
-        if actor is not None:
-            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
-        self.store.get_task(task_id)
-        return self.store.list_children(task_id)
-
-
-class TaskPlaneRequestHandler(BaseHTTPRequestHandler):
-    service: TaskPlaneService | None = None
-    authenticator: Callable[[str], str | None] | None = None
-    max_body_bytes = 1_000_000
-
-    def log_message(self, format: str, *args: Any) -> None:
-        # BaseHTTPRequestHandler logs the raw request target; suppress it so
-        # attacker-controlled paths or query strings cannot leak credentials.
-        return
-
-    def _json(self) -> tuple[str | None, dict[str, Any]]:
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-        except ValueError as exc:
-            raise ValidationError("invalid content length") from exc
-        if length < 0:
-            raise ValidationError("invalid content length")
-        if length > self.max_body_bytes:
-            raise PayloadTooLargeError("payload exceeds limit")
-        raw = self.rfile.read(length) if length > 0 else b""
-        if not raw:
-            return None, {}
-        try:
-            decoded = raw.decode("utf-8")
-            payload = json.loads(decoded)
-            if not isinstance(payload, dict):
-                raise ValidationError("JSON payload must be an object")
-            return decoded, payload
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise ValidationError("invalid JSON payload") from exc
-
-    def _response(self, status: int, payload: Any) -> None:
-        encoded = json.dumps(payload, ensure_ascii=False).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json; charset=utf-8")
-        self.send_header("Content-Length", str(len(encoded)))
-        self.end_headers()
-        self.wfile.write(encoded)
-
-    def _authenticated_identity(self) -> str:
-        authenticator = type(self).authenticator
-        if authenticator is None:
-            raise UnauthorizedError("authentication unavailable")
-        header = self.headers.get("Authorization", "")
-        if not header.startswith("Bearer "):
-            raise UnauthorizedError("bearer authentication required")
-        token = header[7:]
-        if not token or any(ord(ch) < 33 for ch in token):
-            raise UnauthorizedError("invalid bearer token")
-        identity = authenticator(token)
-        if not identity:
-            raise UnauthorizedError("invalid credentials")
-        return str(identity)
-
-    def _handle(self, handler):
-        try:
-            if self.service is None:
-                raise TaskPlaneHTTPError("service not configured")
-            result = handler()
-            if isinstance(result, tuple):
-                status, payload = result
-            else:
-                status, payload = 200, result
-            self._response(status, payload)
-        except TaskPlaneHTTPError as exc:
-            self._response(exc.status_code, exc.to_payload())
-        except Exception as exc:  # defensive
-            if isinstance(exc, TaskPlaneHTTPError):
-                raise
-            self._response(
-                500,
-                {"error": "internal_error", "message": "internal server error"},
-            )
-
-    def do_GET(self):  # noqa: N802
-        def route():
-            path = urllib.parse.urlparse(self.path).path
-            parts = [p for p in path.split("/") if p]
-            for part in parts[1:]:
-                if part not in {"events", "evidence", "children", "heartbeat"}:
-                    try:
-                        validate_identifier(part, "resource identifier")
-                    except ValueError as exc:
-                        raise ValidationError("invalid resource identifier") from exc
-            identity = self._authenticated_identity()
-
-            if len(parts) == 1 and parts[0] == "tasks":
-                return 200, self.service.list_tasks(identity)
-            if len(parts) == 2 and parts[0] == "tasks":
-                task_id = parts[1]
-                return 200, self.service.get_task(task_id, identity)
-            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "events":
-                return 200, self.service.get_events(parts[1], identity)
-            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "evidence":
-                return 200, self.service.get_evidence(parts[1], identity)
-            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "children":
-                return 200, self.service.get_children(parts[1], identity)
-            if len(parts) == 1 and parts[0] == "workers":
-                return 200, self.service.list_workers(identity)
-            if len(parts) == 2 and parts[0] == "workers":
-                return 200, self.service.get_worker(parts[1], identity)
-            raise NotFoundError("unknown endpoint")
-
-        self._handle(route)
-
-    def do_POST(self):  # noqa: N802
-        def route():
-            body_text, body = self._json()
-            identity = self._authenticated_identity()
-            path = urllib.parse.urlparse(self.path).path
-            parts = [p for p in path.split("/") if p]
-            headers = {k.lower(): v for k, v in self.headers.items()}
-
-            if len(parts) == 1 and parts[0] == "tasks":
-                issuer = body.get("issuer")
-                if issuer and (
-                    not isinstance(issuer, dict) or issuer.get("id") != identity
-                ):
-                    raise ForbiddenError("issuer identity mismatch")
-                body["issuer"] = {"type": "authenticated", "id": identity}
-                return 201, self.service.create_task(body or {}, headers.get("idempotency-key"))
-            if body.get("actor_identity") not in {None, identity}:
-                raise ForbiddenError("actor identity mismatch")
-            body["actor_identity"] = identity
-            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "claim":
-                return 200, self.service.claim(parts[1], body or {})
-            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "heartbeat":
-                return 200, self.service.heartbeat(parts[1], body or {})
-            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "progress":
-                return 200, self.service.progress(parts[1], body or {})
-            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "result":
-                return 200, self.service.complete(parts[1], body or {})
-            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "fail":
-                return 200, self.service.fail(parts[1], body or {})
-            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "cancel":
-                return 200, self.service.cancel(parts[1], body or {})
-            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "delegate":
-                return 200, self.service.delegate(parts[1], body or {})
-
-            if len(parts) == 2 and parts[0] == "workers" and parts[1] == "register":
-                if (
-                    body.get("identity") != identity
-                    and identity not in self.service.policy.admin_identities
-                ):
-                    raise ForbiddenError("worker identity mismatch")
-                return 201, self.service.register_worker(body or {})
-            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "heartbeat":
-                return 200, self.service.worker_heartbeat(parts[1], body or {})
-            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "disable":
-                return 200, self.service.disable_worker(parts[1], body or {})
-            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "restore":
-                return 200, self.service.restore_worker(parts[1], body or {})
-            raise NotFoundError("unknown endpoint")
-
-        self._handle(route)
-
-
-def run_server(
-    host: str,
-    port: int,
-    service: TaskPlaneService,
-    *,
-    authenticator: Callable[[str], str | None] | None = None,
-):
-    handler = TaskPlaneRequestHandler
-    handler.service = service
-    handler.authenticator = authenticator
-    server = ThreadingHTTPServer((host, port), handler)
-    server.serve_forever()
@@ -1,36 +0,0 @@
-"""Capability matcher helpers."""
-
-from __future__ import annotations
-
-from fnmatch import fnmatch
-
-
-def _normalize_capability(capability: str) -> str:
-    return capability.strip().lower()
-
-
-def capability_matches(granted: str, required: str) -> bool:
-    granted = _normalize_capability(granted)
-    required = _normalize_capability(required)
-    if granted == required:
-        return True
-    # A granted wildcard such as "test.*" should match required "test.unit"
-    if "*" in granted:
-        return fnmatch(required, granted)
-    # A required wildcard is treated as a suffix/prefix requirement for callers.
-    if "*" in required:
-        return fnmatch(granted, required)
-    return False
-
-
-def has_capabilities(granted_caps: list[str], required_caps: list[str]) -> bool:
-    granted = [_normalize_capability(c) for c in granted_caps]
-    for required in required_caps:
-        required = _normalize_capability(required)
-        if not any(capability_matches(g, required) for g in granted):
-            return False
-    return True
-
-
-def normalize_capabilities(caps: list[str]) -> list[str]:
-    return sorted({_normalize_capability(cap) for cap in caps})
@@ -1,87 +0,0 @@
-"""Delegation guardrails."""
-
-from __future__ import annotations
-
-from .errors import ConflictError, ForbiddenError, NotFoundError
-from .models import Budget, TaskPlan, TaskRecord
-from .store import TaskPlaneStore
-
-
-class DelegationEngine:
-    def __init__(self, store: TaskPlaneStore):
-        self.store = store
-
-    def can_delegate(self, parent_id: str, child_plan: TaskPlan) -> bool:
-        parent = self.store.get_task(parent_id)
-        if parent.status == "COMPLETED":
-            raise ConflictError("cannot delegate completed task")
-        if parent.task_plan.max_delegation_depth <= 0:
-            raise ConflictError("max delegation depth not configured")
-
-        depth = self._depth(parent_id)
-        if depth >= parent.task_plan.max_delegation_depth:
-            raise ConflictError("max delegation depth reached")
-
-        if child_plan.parent_task_id not in {None, parent_id}:
-            raise ConflictError("delegation parent mismatch")
-        current = parent_id
-        while current:
-            if child_plan.task_id and current == child_plan.task_id:
-                raise ConflictError("delegation cycle")
-            current = self.store.parent_of(current)
-        return True
-
-    def delegate(self, parent_id: str, child_plan: TaskPlan, *, caller: str) -> TaskRecord:
-        self.can_delegate(parent_id, child_plan)
-        parent = self.store.get_task(parent_id)
-        if child_plan.required_capabilities and not set(child_plan.required_capabilities).issubset(
-            set(parent.task_plan.required_capabilities or [])
-        ):
-            raise ForbiddenError("child capabilities exceed parent constraints")
-        risk_rank = {"low": 1, "medium": 2, "high": 3}
-        if risk_rank.get(child_plan.risk, 99) > risk_rank.get(parent.task_plan.risk, -1):
-            raise ForbiddenError("child risk exceeds parent constraints")
-        child_plan.parent_task_id = parent_id
-        child_plan.correlation_id = parent.task_plan.correlation_id or parent.task_id
-        child_plan.preferred_workers = parent.task_plan.preferred_workers
-        child_plan.max_delegation_depth = min(
-            child_plan.max_delegation_depth,
-            parent.task_plan.max_delegation_depth,
-        )
-        child_plan.approval_policy = parent.task_plan.approval_policy
-
-        parent_budget = self.store.get_task_budget(parent_id)
-        required = Budget()
-        for name in ("time_seconds", "attempts", "tokens", "cost"):
-            available = getattr(parent_budget, name)
-            requested = getattr(child_plan.budgets, name)
-            if name == "attempts" and requested is None:
-                requested = 1
-            if available is not None:
-                requested = 0 if requested is None else requested
-                if requested > available:
-                    raise ConflictError(f"budget exceeded for {name}")
-                setattr(child_plan.budgets, name, requested)
-            setattr(required, name, requested)
-
-        # A retried identical delegation is a read, not a second budget charge.
-        if child_plan.task_id:
-            try:
-                existing = self.store.get_task(child_plan.task_id)
-            except NotFoundError:
-                existing = None
-            if existing is not None:
-                if (
-                    existing.task_plan.parent_task_id == parent_id
-                    and existing.task_plan.operation_digest()
-                    == child_plan.operation_digest()
-                ):
-                    return existing
-                raise ConflictError("delegation task_id conflict")
-
-        return self.store.delegate_task_with_budget_and_events(
-            parent_id, child_plan, caller=caller
-        )
-
-    def _depth(self, task_id: str) -> int:
-        return self.store._compute_depth(task_id)
@@ -1,71 +0,0 @@
-"""Error types for task plane operations."""
-
-from __future__ import annotations
-
-
-class TaskPlaneError(Exception):
-    """Base exception for API-compatible failures."""
-
-    status_code = 500
-    error_code = "task_plane_error"
-
-    def __init__(self, message: str, *, code: str | None = None, details: dict | None = None):
-        super().__init__(message)
-        self.message = message
-        self.details = details or {}
-        if code:
-            self.error_code = code
-
-    def to_payload(self) -> dict:
-        return {"error": self.error_code, "message": self.message, "details": self.details}
-
-
-class TaskPlaneHTTPError(TaskPlaneError):
-    """Base class with explicit HTTP status."""
-
-    status_code = 500
-
-
-class ValidationError(TaskPlaneHTTPError):
-    status_code = 400
-    error_code = "validation_error"
-
-
-class UnauthorizedError(TaskPlaneHTTPError):
-    status_code = 401
-    error_code = "unauthorized"
-
-
-class ForbiddenError(TaskPlaneHTTPError):
-    status_code = 403
-    error_code = "forbidden"
-
-
-class NotFoundError(TaskPlaneHTTPError):
-    status_code = 404
-    error_code = "not_found"
-
-
-class ConflictError(TaskPlaneHTTPError):
-    status_code = 409
-    error_code = "conflict"
-
-
-class PayloadTooLargeError(TaskPlaneHTTPError):
-    status_code = 413
-    error_code = "payload_too_large"
-
-
-class FailedDependencyError(TaskPlaneHTTPError):
-    status_code = 424
-    error_code = "failed_dependency"
-
-
-class LockedError(TaskPlaneHTTPError):
-    status_code = 423
-    error_code = "locked"
-
-
-class ServiceUnavailableError(TaskPlaneHTTPError):
-    status_code = 503
-    error_code = "service_unavailable"
@@ -1,108 +0,0 @@
-"""CloudEvents-compatible event envelope and durable outbox helpers."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-from typing import Callable, Protocol
-
-from .store import TaskPlaneStore
-
-
-@dataclass
-class CloudEvent:
-    specversion: str = "1.0"
-    id: str = ""
-    type: str = ""
-    source: str = "spiffe://aios/task-plane"
-    subject: str = ""
-    datacontenttype: str = "application/json"
-    data: dict | None = None
-
-    @property
-    def time(self) -> str:
-        return datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
-
-    def asdict(self) -> dict:
-        return {
-            "specversion": self.specversion,
-            "id": self.id,
-            "type": self.type,
-            "source": self.source,
-            "subject": self.subject,
-            "time": self.time,
-            "datacontenttype": self.datacontenttype,
-            "data": self.data or {},
-        }
-
-
-NOT_DELIVERED = "NOT_DELIVERED"
-DELIVERED = "DELIVERED"
-FAILED_DELIVERY = "FAILED"
-
-
-class NotificationAdapter(Protocol):
-    name: str
-
-    def deliver(self, envelope: dict) -> str | None:
-        """Return a provider receipt, or None when delivery is unconfirmed."""
-
-
-class CallbackNotificationAdapter:
-    """Adapter seam for webhook, NATS, GPT, dashboard, and WeChat transports."""
-
-    def __init__(self, name: str, callback: Callable[[dict], str | None]):
-        self.name = name
-        self._callback = callback
-
-    def deliver(self, envelope: dict) -> str | None:
-        return self._callback(envelope)
-
-
-class WebhookAdapter(CallbackNotificationAdapter):
-    def __init__(self, callback: Callable[[dict], str | None]):
-        super().__init__("webhook", callback)
-
-
-class NatsJetStreamAdapter(CallbackNotificationAdapter):
-    def __init__(self, callback: Callable[[dict], str | None]):
-        super().__init__("nats-jetstream", callback)
-
-
-class GPTResultCallbackAdapter(CallbackNotificationAdapter):
-    def __init__(self, callback: Callable[[dict], str | None]):
-        super().__init__("gpt-result-callback", callback)
-
-
-class DashboardAdapter(CallbackNotificationAdapter):
-    def __init__(self, callback: Callable[[dict], str | None]):
-        super().__init__("dashboard", callback)
-
-
-class WeChatGatewayAdapter(CallbackNotificationAdapter):
-    def __init__(self, callback: Callable[[dict], str | None]):
-        super().__init__("wechat-gateway", callback)
-
-
-class DurableOutboxDispatcher:
-    def __init__(self, store: TaskPlaneStore):
-        self.store = store
-
-    def dispatch(self, message_id: str, adapter: NotificationAdapter) -> dict:
-        row = self.store.get_outbox_message(message_id)
-        import json
-
-        envelope = json.loads(row["payload"])
-        try:
-            receipt = adapter.deliver(envelope)
-        except Exception:
-            return self.store.record_outbox_delivery(
-                message_id,
-                receipt=None,
-                error=f"{adapter.name} delivery failed",
-            )
-        return self.store.record_outbox_delivery(
-            message_id,
-            receipt=str(receipt) if receipt else None,
-            error=None if receipt else f"{adapter.name} receipt unavailable",
-        )
@@ -1,31 +0,0 @@
-"""Evidence helpers."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-
-from .store import TaskPlaneStore
-
-
-def evidence_digest(payload: dict) -> str:
-    body = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-    return hashlib.sha256(body.encode("utf-8")).hexdigest()
-
-
-class EvidenceService:
-    def __init__(self, store: TaskPlaneStore):
-        self.store = store
-
-    def add(self, task_id: str, kind: str, payload: dict, worker_identity: str) -> str:
-        return self.store.add_evidence(task_id, kind, payload, worker_identity)
-
-    def list(self, task_id: str) -> list[dict]:
-        return self.store.list_evidence(task_id)
-
-    def verify(self, task_id: str, required_kinds: list[str]) -> bool:
-        evidences = self.list(task_id)
-        observed = {e["kind"] for e in evidences}
-        return set(required_kinds).issubset(
-            observed
-        ) and self.store.verify_evidence_integrity(task_id)
@@ -1,22 +0,0 @@
-"""Event journaling helpers."""
-
-from __future__ import annotations
-
-from .errors import ValidationError
-from .store import TaskPlaneStore
-
-
-class TaskJournal:
-    def __init__(self, store: TaskPlaneStore):
-        self.store = store
-
-    def append(self, task_id: str, event_type: str, data: dict, *, subject: str | None = None) -> None:
-        if not event_type:
-            raise ValidationError("event_type required")
-        self.store.append_event(task_id, event_type, data, subject=subject)
-
-    def list(self, task_id: str) -> list[dict]:
-        return self.store.list_events(task_id)
-
-    def check_chain(self, task_id: str) -> bool:
-        return self.store.verify_event_chain(task_id)
@@ -1,32 +0,0 @@
-"""Claim and lease management helpers."""
-
-from __future__ import annotations
-
-from .errors import LockedError
-from .models import ProbeEvidence
-from .store import TaskPlaneStore
-
-
-class LeaseManager:
-    def __init__(self, store: TaskPlaneStore):
-        self.store = store
-
-    def claim(self, task_id: str, worker_id: str, worker_identity: str, lease_seconds: int, expected_revision: int, operation_digest: str):
-        return self.store.claim_task(task_id, worker_id, worker_identity, lease_seconds, expected_revision, operation_digest)
-
-    def heartbeat(self, task_id: str, claim_id: str, lease_seconds: int):
-        claim = self.store.heartbeat_claim(task_id, claim_id, lease_seconds)
-        return claim
-
-    def probe(self, claim_id: str):
-        claim = self.store.get_claim(claim_id)
-        if claim.status != "ACTIVE":
-            raise LockedError("claim not active")
-        return claim
-
-    def recover(self, task_id: str, claim_id: str, probe: ProbeEvidence):
-        return self.store.recover_expired_claim(
-            task_id,
-            claim_id,
-            probe,
-        )
@@ -1,829 +0,0 @@
-"""Core data models for the task plane."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import re
-import time
-import uuid
-import urllib.parse
-from enum import StrEnum
-from dataclasses import dataclass, field
-from datetime import datetime, timezone
-from typing import Any
-
-
-SENSITIVE_KEYS = {
-    "secret",
-    "password",
-    "token",
-    "api_key",
-    "access_token",
-    "refresh_token",
-    "authorization",
-    "private_key",
-    "client_secret",
-    "credential",
-}
-IDENTIFIER_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{0,127}")
-TYPE_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}")
-RISK_LEVELS = {"low", "medium", "high"}
-DATA_CLASSIFICATIONS = {
-    "public",
-    "internal",
-    "confidential",
-    "credential-secret",
-}
-SECRET_TEXT_PATTERNS = (
-    re.compile(r"(?i)\bAuthorization\s*:\s*Bearer\s+\S+"),
-    re.compile(r"(?i)\b(?:password|passwd|api[_-]?key|access[_-]?token|secret)\s*[:=]\s*\S+"),
-    re.compile(r"\bsk-[A-Za-z0-9_-]{12,}\b"),
-    re.compile(r"\bAKIA[0-9A-Z]{16}\b"),
-    re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
-)
-TASK_PLAN_KEYS = {
-    "schema_version",
-    "task_id",
-    "task_type",
-    "issuer",
-    "intent",
-    "required_capabilities",
-    "preferred_workers",
-    "risk",
-    "approval_policy",
-    "dependencies",
-    "max_delegation_depth",
-    "budgets",
-    "evidence_requirements",
-    "parent_task_id",
-    "correlation_id",
-    "metadata",
-    "data_classification",
-    "execution_zone",
-    "network_policy",
-    "logging_policy",
-    "allowed_input_paths",
-    "allowed_output_paths",
-    "output_policy",
-}
-
-
-def _now_ts() -> float:
-    return time.time()
-
-
-def canonical_json(value: Any) -> str:
-    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
-
-
-def compute_sha256_hex(value: Any) -> str:
-    return hashlib.sha256(canonical_json(value).encode("utf-8")).hexdigest()
-
-
-def contains_secret_text(value: Any) -> bool:
-    if isinstance(value, str):
-        return any(pattern.search(value) for pattern in SECRET_TEXT_PATTERNS)
-    if isinstance(value, dict):
-        return any(contains_secret_text(item) for item in value.values())
-    if isinstance(value, (list, tuple)):
-        return any(contains_secret_text(item) for item in value)
-    return False
-
-
-def validate_relative_paths(values: Any, name: str) -> list[str]:
-    paths = _normalize_list(values)
-    for value in paths:
-        decoded = urllib.parse.unquote(value)
-        parts = value.replace("\\", "/").split("/")
-        if (
-            decoded != value
-            or "\\" in value
-            or value.startswith("/")
-            or re.match(r"^[A-Za-z]:", value)
-            or any(part in {"", ".", ".."} for part in parts)
-        ):
-            raise ValueError(f"invalid {name}")
-    return paths
-
-
-def validate_identifier(value: Any, name: str) -> str:
-    text = str(value or "")
-    if (
-        not IDENTIFIER_RE.fullmatch(text)
-        or urllib.parse.unquote(text) != text
-        or any(ord(ch) < 32 or ord(ch) == 127 for ch in text)
-    ):
-        raise ValueError(f"invalid {name}")
-    return text
-
-
-def validate_type(value: Any, name: str) -> str:
-    text = str(value or "")
-    if not TYPE_RE.fullmatch(text):
-        raise ValueError(f"invalid {name}")
-    return text
-
-
-def redact_value(value: Any) -> Any:
-    if isinstance(value, dict):
-        redacted = {}
-        for key, inner in value.items():
-            lowered = str(key).lower()
-            if lowered in SENSITIVE_KEYS or lowered.endswith(
-                ("_password", "_secret", "_access_token", "_refresh_token", "_private_key")
-            ):
-                redacted[key] = "[REDACTED]"
-            else:
-                redacted[key] = redact_value(inner)
-        return redacted
-    if isinstance(value, list):
-        return [redact_value(v) for v in value]
-    if isinstance(value, tuple):
-        return tuple(redact_value(v) for v in value)
-    return value
-
-
-class TaskStateTransitionError(ValueError):
-    pass
-
-
-class TaskStatus(StrEnum):
-    CREATED = "CREATED"
-    QUEUED = "QUEUED"
-    CLAIMED = "CLAIMED"
-    RUNNING = "RUNNING"
-    WAITING_CHILD = "WAITING_CHILD"
-    VERIFYING = "VERIFYING"
-    COMPLETED = "COMPLETED"
-    FAILED_RECOVERABLE = "FAILED_RECOVERABLE"
-    FAILED_FINAL = "FAILED_FINAL"
-    CANCELLED = "CANCELLED"
-    MANUAL_REVIEW_REQUIRED = "MANUAL_REVIEW_REQUIRED"
-
-
-TASK_STATES = {
-    status.value for status in TaskStatus
-}
-
-
-TASK_NEXT_STATES = {
-    "CREATED": {"QUEUED", "CLAIMED", "CANCELLED", "MANUAL_REVIEW_REQUIRED"},
-    "QUEUED": {"CLAIMED", "CANCELLED", "FAILED_RECOVERABLE", "FAILED_FINAL"},
-    "CLAIMED": {"RUNNING", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
-    "RUNNING": {"VERIFYING", "WAITING_CHILD", "COMPLETED", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
-    "WAITING_CHILD": {"RUNNING", "VERIFYING", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
-    "VERIFYING": {"COMPLETED", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
-    "COMPLETED": set(),
-    "FAILED_RECOVERABLE": {"CLAIMED", "RUNNING", "CANCELLED"},
-    "FAILED_FINAL": set(),
-    "CANCELLED": set(),
-    "MANUAL_REVIEW_REQUIRED": {"RUNNING", "CANCELLED"},
-}
-
-
-@dataclass
-class Budget:
-    time_seconds: int | None = None
-    attempts: int | None = None
-    tokens: int | None = None
-    cost: float | None = None
-
-    @classmethod
-    def from_dict(cls, data: dict[str, Any] | None) -> "Budget":
-        if not data:
-            return cls()
-        if not isinstance(data, dict) or set(data) - {
-            "time_seconds",
-            "attempts",
-            "tokens",
-            "cost",
-        }:
-            raise ValueError("invalid budget")
-        for name in ("time_seconds", "attempts", "tokens", "cost"):
-            value = data.get(name)
-            if value is not None:
-                try:
-                    if float(value) < 0:
-                        raise ValueError("budget values must be non-negative")
-                except (TypeError, ValueError) as exc:
-                    raise ValueError("invalid budget value") from exc
-        return cls(
-            time_seconds=_to_positive_int(data.get("time_seconds")),
-            attempts=_to_positive_int(data.get("attempts")),
-            tokens=_to_positive_int(data.get("tokens")),
-            cost=_to_float(data.get("cost")),
-        )
-
-    def to_dict(self) -> dict[str, Any]:
-        return {
-            "time_seconds": self.time_seconds,
-            "attempts": self.attempts,
-            "tokens": self.tokens,
-            "cost": self.cost,
-        }
-
-    def merge(self, other: "Budget") -> "Budget":
-        return Budget(
-            time_seconds=_first_non_none(self.time_seconds, other.time_seconds),
-            attempts=_first_non_none(self.attempts, other.attempts),
-            tokens=_first_non_none(self.tokens, other.tokens),
-            cost=_first_non_none(self.cost, other.cost),
-        )
-
-
-@dataclass
-class TaskPlan:
-    schema_version: int = 1
-    task_id: str | None = None
-    task_type: str = "code.change"
-    issuer: dict[str, Any] = field(default_factory=dict)
-    intent: str | None = None
-    required_capabilities: list[str] = field(default_factory=list)
-    preferred_workers: list[str] = field(default_factory=list)
-    risk: str = "medium"
-    approval_policy: str = "patch-only"
-    dependencies: list[str] = field(default_factory=list)
-    max_delegation_depth: int = 5
-    budgets: Budget = field(default_factory=Budget)
-    evidence_requirements: list[str] = field(default_factory=list)
-    parent_task_id: str | None = None
-    correlation_id: str | None = None
-    metadata: dict[str, Any] = field(default_factory=dict)
-    data_classification: str = "internal"
-    execution_zone: str = "isolated-development"
-    network_policy: str = "controlled"
-    logging_policy: str = "redacted"
-    allowed_input_paths: list[str] = field(default_factory=list)
-    allowed_output_paths: list[str] = field(default_factory=list)
-    output_policy: str = "standard"
-
-    @classmethod
-    def from_dict(cls, data: dict[str, Any] | None) -> "TaskPlan":
-        if not isinstance(data, dict):
-            raise ValueError("task plan payload must be an object")
-        unknown = set(data) - TASK_PLAN_KEYS
-        if unknown:
-            raise ValueError("unknown task plan fields")
-        if "task_id" not in data or data["task_id"] is None:
-            data = dict(data)
-            data["task_id"] = f"task-{uuid.uuid4()}"
-        risk = str(data.get("risk", "medium"))
-        if risk not in RISK_LEVELS:
-            raise ValueError("invalid risk")
-        issuer = data.get("issuer", {})
-        if not isinstance(issuer, dict):
-            raise ValueError("issuer must be an object")
-        schema_version = int(data.get("schema_version", 1))
-        if schema_version != 1:
-            raise ValueError("unsupported schema_version")
-        max_depth = _to_positive_int(data.get("max_delegation_depth"), default=5)
-        if max_depth is None or max_depth > 32:
-            raise ValueError("invalid max_delegation_depth")
-        classification = str(data.get("data_classification", "internal"))
-        if classification not in DATA_CLASSIFICATIONS:
-            raise ValueError("invalid data_classification")
-        execution_zone = validate_type(
-            data.get("execution_zone", "isolated-development"), "execution_zone"
-        )
-        network_policy = validate_type(
-            data.get("network_policy", "controlled"), "network_policy"
-        )
-        logging_policy = validate_type(
-            data.get("logging_policy", "redacted"), "logging_policy"
-        )
-        output_policy = validate_type(
-            data.get("output_policy", "standard"), "output_policy"
-        )
-        if contains_secret_text(
-            {
-                "intent": data.get("intent"),
-                "metadata": data.get("metadata", {}),
-            }
-        ):
-            raise ValueError("task content contains secret material")
-        if classification == "credential-secret":
-            if execution_zone != "secure-file-transformer":
-                raise ValueError("credential-secret requires secure-file-transformer")
-            if network_policy != "denied":
-                raise ValueError("credential-secret requires network denied")
-            if logging_policy != "metadata-only":
-                raise ValueError("credential-secret requires metadata-only logging")
-            if output_policy != "hash-count-status-only":
-                raise ValueError("credential-secret requires restricted output")
-        return cls(
-            schema_version=schema_version,
-            task_id=validate_identifier(data["task_id"], "task_id"),
-            task_type=validate_type(data.get("task_type", "code.change"), "task_type"),
-            issuer=issuer,
-            intent=data.get("intent"),
-            required_capabilities=_normalize_list(data.get("required_capabilities", [])),
-            preferred_workers=_normalize_list(data.get("preferred_workers", [])),
-            risk=risk,
-            approval_policy=validate_type(
-                data.get("approval_policy", "patch-only"), "approval_policy"
-            ),
-            dependencies=_normalize_list(data.get("dependencies", [])),
-            max_delegation_depth=max_depth,
-            budgets=Budget.from_dict(data.get("budgets")),
-            evidence_requirements=_normalize_list(data.get("evidence_requirements", [])),
-            parent_task_id=data.get("parent_task_id"),
-            correlation_id=data.get("correlation_id"),
-            metadata=data.get("metadata", {}) if isinstance(data.get("metadata", {}), dict) else {},
-            data_classification=classification,
-            execution_zone=execution_zone,
-            network_policy=network_policy,
-            logging_policy=logging_policy,
-            allowed_input_paths=validate_relative_paths(
-                data.get("allowed_input_paths", []), "allowed_input_paths"
-            ),
-            allowed_output_paths=validate_relative_paths(
-                data.get("allowed_output_paths", []), "allowed_output_paths"
-            ),
-            output_policy=output_policy,
-        )
-
-    def to_dict(self, *, redact: bool = False) -> dict[str, Any]:
-        payload = {
-            "schema_version": self.schema_version,
-            "task_id": self.task_id,
-            "task_type": self.task_type,
-            "issuer": self.issuer,
-            "intent": self.intent,
-            "required_capabilities": list(self.required_capabilities),
-            "preferred_workers": list(self.preferred_workers),
-            "risk": self.risk,
-            "approval_policy": self.approval_policy,
-            "dependencies": list(self.dependencies),
-            "max_delegation_depth": self.max_delegation_depth,
-            "budgets": self.budgets.to_dict(),
-            "evidence_requirements": list(self.evidence_requirements),
-            "parent_task_id": self.parent_task_id,
-            "correlation_id": self.correlation_id,
-            "metadata": dict(self.metadata),
-            "data_classification": self.data_classification,
-            "execution_zone": self.execution_zone,
-            "network_policy": self.network_policy,
-            "logging_policy": self.logging_policy,
-            "allowed_input_paths": list(self.allowed_input_paths),
-            "allowed_output_paths": list(self.allowed_output_paths),
-            "output_policy": self.output_policy,
-        }
-        if redact:
-            payload = redact_value(payload)
-        return payload
-
-    def operation_digest(self) -> str:
-        return compute_sha256_hex(self.to_dict())
-
-
-@dataclass
-class TaskRecord:
-    task_id: str
-    status: str
-    revision: int
-    task_plan: TaskPlan
-    created_at: float
-    updated_at: float
-    root_task_id: str
-    idempotency_key: str | None = None
-    failure_reason: str | None = None
-
-    def with_status(self, status: str) -> "TaskRecord":
-        allowed = TASK_NEXT_STATES.get(self.status, set())
-        if status != self.status and (not allowed and self.status not in {"COMPLETED", "FAILED_FINAL", "CANCELLED"}):
-            raise TaskStateTransitionError(f"Cannot transition {self.status} -> {status}")
-        if status not in TASK_STATES:
-            raise TaskStateTransitionError(f"Invalid status {status}")
-        if status != self.status and self.status in TASK_NEXT_STATES and status not in TASK_NEXT_STATES[self.status]:
-            raise TaskStateTransitionError(f"Cannot transition {self.status} -> {status}")
-        return TaskRecord(
-            task_id=self.task_id,
-            status=status,
-            revision=self.revision + 1,
-            task_plan=self.task_plan,
-            created_at=self.created_at,
-            updated_at=_now_ts(),
-            root_task_id=self.root_task_id,
-            idempotency_key=self.idempotency_key,
-            failure_reason=self.failure_reason,
-        )
-
-    def to_dict(self, *, include_task=True, redact_payload: bool = True) -> dict[str, Any]:
-        payload = {
-            "task_id": self.task_id,
-            "status": self.status,
-            "revision": self.revision,
-            "root_task_id": self.root_task_id,
-            "parent_task_id": self.task_plan.parent_task_id,
-            "created_at": _fmt_ts(self.created_at),
-            "updated_at": _fmt_ts(self.updated_at),
-            "failure_reason": self.failure_reason,
-        }
-        if include_task:
-            payload["plan"] = self.task_plan.to_dict(redact=redact_payload)
-        if self.idempotency_key:
-            payload["idempotency_key"] = self.idempotency_key
-        return payload
-
-
-@dataclass
-class WorkerRegistration:
-    worker_id: str
-    worker_type: str
-    identity: str
-    capabilities: list[str]
-    trust_zone: str
-    max_concurrency: int
-    heartbeat_interval_seconds: int
-    supported_protocols: list[str]
-    registered_at: float
-    last_heartbeat: float
-    status: str = "active"
-    disabled: bool = False
-    owner_identity: str = ""
-    registration_revision: int = 1
-    registration_policy: str = "self"
-    created_at: float = 0.0
-    updated_at: float = 0.0
-    disabled_reason: str | None = None
-
-    @classmethod
-    def from_dict(cls, data: dict[str, Any]) -> "WorkerRegistration":
-        if not isinstance(data, dict):
-            raise ValueError("worker registration payload must be an object")
-        now = _now_ts()
-        worker_id = validate_identifier(data.get("worker_id"), "worker_id")
-        worker_type = validate_type(data.get("worker_type"), "worker_type")
-        identity = str(data.get("identity") or "").strip()
-        if not identity or any(ord(ch) < 32 for ch in identity):
-            raise ValueError("invalid identity")
-        max_concurrency = _to_positive_int(data.get("max_concurrency"), default=1)
-        heartbeat_interval = _to_positive_int(
-            data.get("heartbeat_interval_seconds"), default=15
-        )
-        if not max_concurrency:
-            raise ValueError("max_concurrency must be positive")
-        if not heartbeat_interval:
-            raise ValueError("heartbeat_interval_seconds must be positive")
-        return cls(
-            worker_id=worker_id,
-            worker_type=worker_type,
-            identity=identity,
-            capabilities=_normalize_list(data.get("capabilities", [])),
-            trust_zone=str(data.get("trust_zone") or "default"),
-            max_concurrency=max_concurrency,
-            heartbeat_interval_seconds=heartbeat_interval,
-            supported_protocols=_normalize_list(
-                data.get("supported_protocols", ["aios-task-v1"])
-            ),
-            registered_at=float(data.get("registered_at") or now),
-            last_heartbeat=float(data.get("last_heartbeat") or now),
-            status=str(data.get("status") or "active"),
-            disabled=bool(data.get("disabled", False)),
-            owner_identity=str(data.get("owner_identity") or identity),
-            registration_revision=int(data.get("registration_revision") or 1),
-            registration_policy=str(data.get("registration_policy") or "self"),
-            created_at=float(data.get("created_at") or data.get("registered_at") or now),
-            updated_at=float(data.get("updated_at") or now),
-            disabled_reason=data.get("disabled_reason"),
-        )
-
-    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
-        payload = {
-            "worker_id": self.worker_id,
-            "worker_type": self.worker_type,
-            "identity": self.identity,
-            "capabilities": list(self.capabilities),
-            "trust_zone": self.trust_zone,
-            "max_concurrency": self.max_concurrency,
-            "heartbeat_interval_seconds": self.heartbeat_interval_seconds,
-            "supported_protocols": list(self.supported_protocols),
-            "registered_at": _fmt_ts(self.registered_at),
-            "last_heartbeat": _fmt_ts(self.last_heartbeat),
-            "status": self.status,
-            "disabled": self.disabled,
-            "owner_identity": self.owner_identity,
-            "registration_revision": self.registration_revision,
-            "registration_policy": self.registration_policy,
-            "created_at": _fmt_ts(self.created_at or self.registered_at),
-            "updated_at": _fmt_ts(self.updated_at or self.last_heartbeat),
-            "disabled_reason": self.disabled_reason,
-        }
-        if redact_payload:
-            payload = redact_value(payload)
-        return payload
-
-
-@dataclass(frozen=True)
-class EvidenceEnvelope:
-    schema_version: int
-    evidence_id: str
-    task_id: str
-    claim_id: str
-    kind: str
-    worker_identity: str
-    payload: dict[str, Any]
-    created_at: float
-    previous_evidence_hash: str
-    evidence_digest: str
-    signature: str | None = None
-    attestation_ref: str | None = None
-
-    @classmethod
-    def create(
-        cls,
-        *,
-        task_id: str,
-        claim_id: str,
-        kind: str,
-        worker_identity: str,
-        payload: dict[str, Any],
-        previous_evidence_hash: str,
-        signature: str | None = None,
-        attestation_ref: str | None = None,
-        evidence_id: str | None = None,
-        created_at: float | None = None,
-    ) -> "EvidenceEnvelope":
-        envelope = cls(
-            schema_version=1,
-            evidence_id=evidence_id or f"evd-{uuid.uuid4()}",
-            task_id=validate_identifier(task_id, "task_id"),
-            claim_id=validate_identifier(claim_id, "claim_id"),
-            kind=validate_type(kind, "evidence kind"),
-            worker_identity=str(worker_identity),
-            payload=redact_value(payload),
-            created_at=float(created_at or _now_ts()),
-            previous_evidence_hash=str(previous_evidence_hash or ""),
-            evidence_digest="",
-            signature=signature,
-            attestation_ref=attestation_ref,
-        )
-        return dataclass_replace(
-            envelope, evidence_digest=compute_sha256_hex(envelope.digest_payload())
-        )
-
-    def digest_payload(self) -> dict[str, Any]:
-        return {
-            "schema_version": self.schema_version,
-            "evidence_id": self.evidence_id,
-            "task_id": self.task_id,
-            "claim_id": self.claim_id,
-            "kind": self.kind,
-            "worker_identity": self.worker_identity,
-            "payload": self.payload,
-            "created_at": self.created_at,
-            "previous_evidence_hash": self.previous_evidence_hash,
-            "attestation_ref": self.attestation_ref,
-        }
-
-    def verify(
-        self,
-        *,
-        expected_task_id: str,
-        expected_claim_id: str,
-        expected_previous_hash: str,
-        attestation_verifier: Any = None,
-    ) -> bool:
-        if (
-            self.schema_version != 1
-            or self.task_id != expected_task_id
-            or self.claim_id != expected_claim_id
-            or self.previous_evidence_hash != expected_previous_hash
-            or self.evidence_digest != compute_sha256_hex(self.digest_payload())
-        ):
-            return False
-        if self.signature or self.attestation_ref:
-            return True if attestation_verifier is None else bool(attestation_verifier(self))
-        return True
-
-    def to_dict(self) -> dict[str, Any]:
-        return {
-            **self.digest_payload(),
-            "evidence_digest": self.evidence_digest,
-            "signature": self.signature,
-        }
-
-
-class ProbeOutcome(StrEnum):
-    NOT_APPLIED = "NOT_APPLIED"
-    APPLIED_VERIFIED = "APPLIED_VERIFIED"
-    INDETERMINATE = "INDETERMINATE"
-    CONFLICT = "CONFLICT"
-
-
-@dataclass(frozen=True)
-class ProbeEvidence:
-    schema_version: int
-    probe_id: str
-    task_id: str
-    claim_id: str
-    worker_id: str
-    worker_identity: str
-    operation_digest: str
-    outcome: ProbeOutcome
-    observed_at: float
-    expires_at: float
-    probe_executor_identity: str
-    evidence_digest: str
-    signature: str | None = None
-    attestation_ref: str | None = None
-
-    @classmethod
-    def create(cls, **data: Any) -> "ProbeEvidence":
-        outcome = data["outcome"]
-        if not isinstance(outcome, ProbeOutcome):
-            outcome = ProbeOutcome(str(outcome))
-        probe = cls(
-            schema_version=1,
-            probe_id=data.get("probe_id") or f"probe-{uuid.uuid4()}",
-            task_id=validate_identifier(data["task_id"], "task_id"),
-            claim_id=validate_identifier(data["claim_id"], "claim_id"),
-            worker_id=validate_identifier(data["worker_id"], "worker_id"),
-            worker_identity=str(data["worker_identity"]),
-            operation_digest=str(data["operation_digest"]),
-            outcome=outcome,
-            observed_at=float(data["observed_at"]),
-            expires_at=float(data["expires_at"]),
-            probe_executor_identity=str(data["probe_executor_identity"]),
-            evidence_digest="",
-            signature=data.get("signature"),
-            attestation_ref=data.get("attestation_ref"),
-        )
-        return dataclass_replace(
-            probe, evidence_digest=compute_sha256_hex(probe.digest_payload())
-        )
-
-    def digest_payload(self) -> dict[str, Any]:
-        return {
-            "schema_version": self.schema_version,
-            "probe_id": self.probe_id,
-            "task_id": self.task_id,
-            "claim_id": self.claim_id,
-            "worker_id": self.worker_id,
-            "worker_identity": self.worker_identity,
-            "operation_digest": self.operation_digest,
-            "outcome": self.outcome.value,
-            "observed_at": self.observed_at,
-            "expires_at": self.expires_at,
-            "probe_executor_identity": self.probe_executor_identity,
-            "attestation_ref": self.attestation_ref,
-        }
-
-    def verify(self, *, now: float, attestation_verifier: Any) -> bool:
-        if (
-            self.schema_version != 1
-            or self.expires_at <= now
-            or self.observed_at > now
-            or self.evidence_digest != compute_sha256_hex(self.digest_payload())
-            or not (self.signature or self.attestation_ref)
-        ):
-            return False
-        return bool(attestation_verifier and attestation_verifier(self))
-
-    def to_dict(self) -> dict[str, Any]:
-        return {
-            **self.digest_payload(),
-            "evidence_digest": self.evidence_digest,
-            "signature": self.signature,
-        }
-
-
-def dataclass_replace(value: Any, **changes: Any) -> Any:
-    from dataclasses import replace
-
-    return replace(value, **changes)
-
-
-@dataclass
-class WorkerClaim:
-    claim_id: str
-    task_id: str
-    worker_id: str
-    worker_identity: str
-    claimed_at: float
-    lease_until: float
-    attempt: int
-    task_revision: int
-    operation_digest: str
-    status: str = "ACTIVE"
-
-    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
-        payload = {
-            "claim_id": self.claim_id,
-            "task_id": self.task_id,
-            "worker_id": self.worker_id,
-            "worker_identity": self.worker_identity,
-            "claimed_at": _fmt_ts(self.claimed_at),
-            "lease_until": _fmt_ts(self.lease_until),
-            "attempt": self.attempt,
-            "task_revision": self.task_revision,
-            "operation_digest": self.operation_digest,
-            "status": self.status,
-        }
-        if redact_payload:
-            payload = redact_value(payload)
-        return payload
-
-
-@dataclass
-class ResultEnvelope:
-    task_id: str
-    claim_id: str
-    worker_identity: str
-    status: str
-    outputs: list[dict[str, Any]]
-    evidence: list[dict[str, Any]]
-    started_at: str
-    completed_at: str
-    result_digest: str | None = None
-    signature: str | None = None
-    attestation_ref: str | None = None
-    operation_digest: str | None = None
-    trust_status: str = "untrusted_shadow_result"
-
-    def digest_payload(self) -> dict[str, Any]:
-        return {
-            "task_id": self.task_id,
-            "claim_id": self.claim_id,
-            "worker_identity": self.worker_identity,
-            "status": self.status,
-            "outputs": self.outputs,
-            "evidence": self.evidence,
-            "started_at": self.started_at,
-            "completed_at": self.completed_at,
-            "operation_digest": self.operation_digest,
-            "attestation_ref": self.attestation_ref,
-        }
-
-    def computed_digest(self) -> str:
-        return compute_sha256_hex(self.digest_payload())
-
-    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
-        payload = {
-            "task_id": self.task_id,
-            "claim_id": self.claim_id,
-            "worker_identity": self.worker_identity,
-            "status": self.status,
-            "outputs": self.outputs,
-            "evidence": self.evidence,
-            "started_at": self.started_at,
-            "completed_at": self.completed_at,
-            "result_digest": self.result_digest,
-            "signature": self.signature,
-            "attestation_ref": self.attestation_ref,
-            "operation_digest": self.operation_digest,
-            "trust_status": self.trust_status,
-        }
-        if redact_payload:
-            payload = redact_value(payload)
-        return payload
-
-
-def _normalize_list(value: Any) -> list[str]:
-    if not isinstance(value, list):
-        raise ValueError("expected list")
-    if len(value) > 128 or any(
-        not isinstance(v, str)
-        or not v
-        or len(v) > 256
-        or any(ord(ch) < 32 for ch in v)
-        for v in value
-    ):
-        raise ValueError("invalid list item")
-    return list(value)
-
-
-def _to_positive_int(value: Any, default: int | None = None) -> int | None:
-    if value is None:
-        return default
-    try:
-        number = int(value)
-    except (TypeError, ValueError):
-        return default
-    return number if number >= 0 else default
-
-
-def _to_float(value: Any) -> float | None:
-    if value is None:
-        return None
-    try:
-        return float(value)
-    except (TypeError, ValueError):
-        return None
-
-
-def _first_non_none(primary: Any, fallback: Any) -> Any:
-    if primary is not None:
-        return primary
-    return fallback
-
-
-def iso8601_now() -> str:
-    return datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
-
-
-def _fmt_ts(value: float | None) -> str | None:
-    if value is None:
-        return None
-    return datetime.fromtimestamp(value, tz=timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
@@ -1,226 +0,0 @@
-"""Policy and verification logic (fail-closed)."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Callable
-
-from .errors import ForbiddenError, LockedError
-from .models import ProbeEvidence, ResultEnvelope, TaskRecord
-
-
-RISK_RANK = {"low": 1, "medium": 2, "high": 3}
-READONLY_WORKER_ACTIONS = frozenset(
-    {"claim", "result", "fail", "progress", "heartbeat"}
-)
-ALL_ACTION_CAPABILITIES = frozenset(
-    {
-        "task.creator",
-        "worker.self_register",
-        "worker.admin",
-        "task.claim",
-        "task.cancel",
-        "task.delegate",
-        "task.read",
-        "task.audit",
-    }
-)
-
-
-@dataclass
-class PolicyDecision:
-    allowed: bool
-    reason: str = ""
-
-
-@dataclass(frozen=True)
-class ReadonlyWorkerProfile:
-    """A narrowly-scoped identity allowed to process safe Shadow tasks only."""
-
-    worker_id: str
-    identity: str
-    capabilities: frozenset[str]
-    task_types: frozenset[str] = frozenset({"code.review", "test.execute"})
-
-    def permits_task(self, task: TaskRecord) -> bool:
-        plan = task.task_plan
-        if plan.task_type not in self.task_types or plan.risk != "low":
-            return False
-        if plan.data_classification not in {"public", "internal"}:
-            return False
-        if plan.metadata.get("production_side_effects") is not False:
-            return False
-        return set(plan.required_capabilities).issubset(self.capabilities)
-
-
-class IdentityVerifier:
-    def __init__(self, trusted_identities: set[str] | None = None):
-        self.trusted_identities = trusted_identities
-
-    def verify(self, identity: str) -> bool:
-        if self.trusted_identities is None:
-            return True
-        return identity in self.trusted_identities
-
-
-class EvidenceVerifier:
-    def __init__(self, mandatory: list[str] | None = None):
-        self.mandatory = set(mandatory or [])
-
-    def verify(self, task: TaskRecord, evidences: list[dict]) -> PolicyDecision:
-        required = set(task.task_plan.evidence_requirements or [])
-        if not required and not self.mandatory:
-            return PolicyDecision(True)
-        observed = {e.get("kind") for e in evidences}
-        missing = required.union(self.mandatory) - observed
-        if missing:
-            return PolicyDecision(False, f"missing evidence: {', '.join(sorted(missing))}")
-        return PolicyDecision(True)
-
-
-class PolicyEngine:
-    """
-    Fail-closed policy engine with minimal but explicit decisions.
-    """
-
-    def __init__(
-        self,
-        *,
-        identity_verifier: IdentityVerifier | None = None,
-        evidence_verifier: EvidenceVerifier | None = None,
-        execution_enabled: bool = False,
-        max_risk: str = "medium",
-        result_signature_verifier: Callable[[ResultEnvelope], bool] | None = None,
-        probe_attestation_verifier: Callable[[ProbeEvidence], bool] | None = None,
-        identity_capabilities: dict[str, set[str]] | None = None,
-        admin_identities: set[str] | None = None,
-        readonly_worker_execution_enabled: bool = False,
-        readonly_worker_profiles: list[ReadonlyWorkerProfile] | None = None,
-    ) -> None:
-        if max_risk not in RISK_RANK:
-            raise ValueError("invalid max_risk")
-        self.identity_verifier = identity_verifier or IdentityVerifier()
-        self.evidence_verifier = evidence_verifier or EvidenceVerifier()
-        self.execution_enabled = execution_enabled
-        self.max_risk = max_risk
-        self.result_signature_verifier = result_signature_verifier
-        self.probe_attestation_verifier = probe_attestation_verifier
-        self.identity_capabilities = {
-            identity: set(capabilities)
-            for identity, capabilities in (identity_capabilities or {}).items()
-        }
-        self.admin_identities = set(admin_identities or ())
-        self.readonly_worker_execution_enabled = readonly_worker_execution_enabled
-        self.readonly_worker_profiles = {
-            profile.identity: profile for profile in (readonly_worker_profiles or [])
-        }
-
-    def _readonly_worker_allows(
-        self, action: str, actor: str, task: TaskRecord | None
-    ) -> bool:
-        profile = self.readonly_worker_profiles.get(actor)
-        return bool(
-            self.readonly_worker_execution_enabled
-            and action in READONLY_WORKER_ACTIONS
-            and profile is not None
-            and (task is None or profile.permits_task(task))
-        )
-
-    def assert_readonly_worker_binding(self, actor: str, worker_id: str) -> None:
-        profile = self.readonly_worker_profiles.get(actor)
-        if profile is not None and profile.worker_id != worker_id:
-            raise ForbiddenError("worker identity binding mismatch")
-
-    def assert_readonly_worker_registration(self, actor: str, payload: dict) -> None:
-        profile = self.readonly_worker_profiles.get(actor)
-        if profile is None:
-            return
-        if (
-            str(payload.get("worker_id") or "") != profile.worker_id
-            or str(payload.get("identity") or "") != profile.identity
-            or set(payload.get("capabilities") or []) != set(profile.capabilities)
-            or str(payload.get("trust_zone") or "") != "isolated-review"
-            or int(payload.get("max_concurrency") or 0) != 1
-            or int(payload.get("heartbeat_interval_seconds") or 0) != 15
-        ):
-            raise ForbiddenError("readonly worker registration mismatch")
-
-    def verify_result(
-        self, result: ResultEnvelope, task: TaskRecord | None = None
-    ) -> PolicyDecision:
-        computed = result.computed_digest()
-        if result.result_digest and result.result_digest != computed:
-            return PolicyDecision(False, "result digest mismatch")
-        sensitive = bool(
-            task
-            and (
-                task.task_plan.data_classification
-                in {"confidential", "credential-secret"}
-                or any(
-                    capability.startswith(
-                        ("code.write", "deploy", "secret", "production")
-                    )
-                    for capability in task.task_plan.required_capabilities
-                )
-            )
-        )
-        if sensitive and not (result.signature or result.attestation_ref):
-            return PolicyDecision(False, "trusted result proof required")
-        if result.signature is not None or result.attestation_ref is not None:
-            if self.result_signature_verifier is None:
-                return PolicyDecision(False, "result signature verifier unavailable")
-            if not self.result_signature_verifier(result):
-                return PolicyDecision(False, "result signature invalid")
-            result.trust_status = "trusted_result"
-        else:
-            result.trust_status = "untrusted_shadow_result"
-        return PolicyDecision(True)
-
-    def authorize(self, action: str, actor: str, task: TaskRecord | None = None, context: dict | None = None) -> PolicyDecision:
-        context = context or {}
-        if not self.identity_verifier.verify(actor):
-            return PolicyDecision(False, "identity untrusted")
-
-        action_capabilities = {
-            "create": "task.creator",
-            "read": "task.read",
-            "audit": "task.audit",
-            "claim": "task.claim",
-            "result": "task.claim",
-            "fail": "task.claim",
-            "progress": "task.claim",
-            "heartbeat": "task.claim",
-            "cancel": "task.cancel",
-            "delegate": "task.delegate",
-            "worker.register": "worker.self_register",
-            "worker.admin": "worker.admin",
-        }
-        required_capability = action_capabilities.get(action)
-        if required_capability:
-            granted = set(
-                self.identity_capabilities.get(
-                    actor, self.identity_capabilities.get("*", set())
-                )
-            )
-            if required_capability not in granted:
-                return PolicyDecision(False, f"action {action} not permitted")
-
-        if action in {"claim", "result", "fail", "cancel", "progress", "delegate", "heartbeat"} and not self.execution_enabled:
-            if not self._readonly_worker_allows(action, actor, task):
-                return PolicyDecision(False, "execution disabled")
-
-        if action == "delegate" and task and task.status not in {"COMPLETED", "FAILED_FINAL", "CANCELLED"}:
-            risk = str(context.get("risk", task.task_plan.risk))
-            if RISK_RANK.get(risk, 2) > RISK_RANK.get(self.max_risk, 1):
-                return PolicyDecision(False, f"risk {risk} exceeds policy")
-
-        return PolicyDecision(True)
-
-    def assert_allowed(self, action: str, actor: str, task: TaskRecord | None = None, context: dict | None = None):
-        decision = self.authorize(action, actor, task, context=context)
-        if not decision.allowed:
-            if decision.reason == "identity untrusted":
-                raise ForbiddenError(decision.reason)
-            if decision.reason == "execution disabled":
-                raise LockedError("execution disabled")
-            raise ForbiddenError(decision.reason)
@@ -1,76 +0,0 @@
-"""Task scheduler primitives."""
-
-from __future__ import annotations
-
-import time
-from .errors import NotFoundError
-from .capabilities import has_capabilities
-from .models import WorkerClaim
-from .store import TaskPlaneStore
-
-
-class TaskScheduler:
-    def __init__(self, store: TaskPlaneStore):
-        self.store = store
-
-    def next_queued_task(self, worker_id: str):
-        worker = self.store.get_worker(worker_id)
-        tasks = sorted(
-            self.store.list_tasks(),
-            key=lambda task: (
-                -int(task.task_plan.metadata.get("priority", 0)),
-                task.created_at,
-                task.task_id,
-            ),
-        )
-        for task in tasks:
-            if task.status not in {"CREATED", "QUEUED", "FAILED_RECOVERABLE"}:
-                continue
-            if task.task_plan.task_type == "worker.registry.audit":
-                continue
-            if task.status == "FAILED_RECOVERABLE" and not self.store.task_has_retryable_probe(
-                task.task_id
-            ):
-                continue
-            if not has_capabilities(
-                worker.capabilities, task.task_plan.required_capabilities
-            ):
-                continue
-            if any(
-                self.store.get_task(dependency).status != "COMPLETED"
-                for dependency in task.task_plan.dependencies
-            ):
-                continue
-            if (
-                task.task_plan.data_classification == "credential-secret"
-                and worker.worker_type != "secure_file_transformer"
-                and "secure_file_transformer" not in worker.capabilities
-            ):
-                continue
-            return task
-        return None
-
-    def schedule_for_worker(self, worker_id: str, lease_seconds: int = 15) -> WorkerClaim:
-        worker = self.store.get_worker(worker_id)
-        if worker.disabled:
-            from .errors import LockedError
-
-            raise LockedError("worker disabled")
-        if time.time() > worker.last_heartbeat + (
-            worker.heartbeat_interval_seconds * 3
-        ):
-            from .errors import LockedError
-
-            raise LockedError("worker offline")
-        task = self.next_queued_task(worker_id)
-        if task is None:
-            raise NotFoundError("no queued tasks available")
-        claim = self.store.claim_task(
-            task.task_id,
-            worker_id,
-            worker.identity,
-            lease_seconds=lease_seconds,
-            expected_revision=task.revision,
-            operation_digest=task.task_plan.operation_digest(),
-        )
-        return claim
@@ -1,68 +0,0 @@
-"""Worker registry abstraction and read helpers."""
-
-from __future__ import annotations
-
-import time
-
-from .capabilities import has_capabilities
-from .errors import NotFoundError
-from .models import WorkerRegistration
-from .store import TaskPlaneStore
-
-
-class WorkerRegistry:
-    def __init__(self, store: TaskPlaneStore):
-        self.store = store
-
-    def register(
-        self,
-        payload: dict,
-        *,
-        actor_identity: str,
-        is_admin: bool,
-        expected_revision: int | None,
-    ) -> WorkerRegistration:
-        reg = WorkerRegistration.from_dict(payload)
-        return self.store.register_worker(
-            reg,
-            actor_identity=actor_identity,
-            is_admin=is_admin,
-            expected_revision=expected_revision,
-        )
-
-    def heartbeat(
-        self,
-        worker_id: str,
-        heartbeat_interval_seconds: int | None = None,
-        *,
-        actor_identity: str,
-        expected_revision: int | None,
-    ) -> WorkerRegistration:
-        return self.store.heartbeat_worker(
-            worker_id,
-            heartbeat_interval_seconds=heartbeat_interval_seconds,
-            actor_identity=actor_identity,
-            expected_revision=expected_revision,
-        )
-
-    def list(self):
-        return self.store.list_workers()
-
-    def get(self, worker_id: str) -> WorkerRegistration:
-        try:
-            return self.store.get_worker(worker_id)
-        except NotFoundError:
-            raise
-
-    def can_execute(self, worker_id: str, required_capabilities: list[str]) -> bool:
-        worker = self.store.get_worker(worker_id)
-        return has_capabilities(worker.capabilities, required_capabilities)
-
-    def is_online(self, worker_id: str, *, now: float | None = None) -> bool:
-        worker = self.store.get_worker(worker_id)
-        deadline = worker.last_heartbeat + (worker.heartbeat_interval_seconds * 3)
-        return not worker.disabled and (time.time() if now is None else now) <= deadline
-
-    def stale_workers(self, *, now: float | None = None) -> list[WorkerRegistration]:
-        current = time.time() if now is None else now
-        return [worker for worker in self.list() if not self.is_online(worker.worker_id, now=current)]
@@ -1,25 +1,13 @@
 {
-  "current_baseline": "V2R1C2",
-  "previous_baseline": "V2R1C1",
-  "promoted_at": "2026-07-22T01:40:51Z",
-  "git": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
-  "promoted_by": "codex/owner-approved-gitops",
-  "promotion_reason": "Owner-authorized V2R1C2 Unified Portal production release after exact tag binding, complete evidence verification, and production acceptance PASS.",
-  "version": "V2R1C2",
-  "release_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
-  "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
-  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
-  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
-  "status": "PRODUCTION_DEPLOYED",
-  "production_service": "aios-v2r1c2-production.service",
-  "production_port": 18920,
-  "rollback_version": "V2R1C1",
-  "constraints": {
-    "product_code_changed": true,
-    "production_redeployed": true,
-    "production_traffic_changed": true,
-    "tag_rewritten": false,
-    "force_push_allowed": false,
-    "rollback_assets_preserved": true
-  }
-}
+    "current_baseline": "V1R4C6",
+    "previous_baseline": "V1R4C5",
+    "promoted_at": "2026-07-11T21:00:00+08:00",
+    "git": "e204a90398bf646d46245b3088226749fa056edd",
+    "promoted_by": "openclaw/admin",
+    "promotion_reason": "V1R4C6 admin search agent integration, search gateway, agent platform, VERSION bump, merge tests deploy pipeline — not yet deployed to production",
+    "constraints": {
+        "memory_search_enabled": false,
+        "force_push_allowed": false,
+        "gitea_db_mutation_requires_owner_approval": true
+    }
+}
@@ -1,103 +0,0 @@
-{
-  "schema_version": 4,
-  "automatic": [
-    "build",
-    "test",
-    "artifact",
-    "canary",
-    "evidence"
-  ],
-  "owner": [
-    "signed_release_plan"
-  ],
-  "forbidden": [
-    "force_push",
-    "tag_rewrite",
-    "direct_main_push",
-    "baseline_mutation",
-    "registry_mutation"
-  ],
-  "runtime_deployment": {
-    "approval_action": "signed_release_plan",
-    "required_capability": "runtime_switch",
-    "tag_operations_allowed": false,
-    "baseline_mutation_allowed": false,
-    "registry_mutation_allowed": false,
-    "writer_default": false,
-    "rollback_required": true
-  },
-  "tag_release": {
-    "approval_action": "signed_release_plan",
-    "required_capability": "tag_publish",
-    "separate_controller": true,
-    "duplicate_conflict": "fail_closed",
-    "rewrite_allowed": false,
-    "force_push_allowed": false
-  },
-  "baseline_registry_finalize": {
-    "approval_action": "signed_release_plan",
-    "required_capability": "baseline_registry_finalize",
-    "separate_controller": true,
-    "remote_tag_verification_required": true,
-    "gitea_api_verification_required": true,
-    "registry_baseline_consistency_required": true
-  },
-  "approval": {
-    "algorithm": "Ed25519",
-    "trust_domain": "aios.production",
-    "maximum_lifetime_seconds": 3600,
-    "release_plan_sha256_required": true,
-    "not_before_required": true,
-    "replay_protection": true,
-    "revocation_fail_closed": true,
-    "key_rotation_supported": true,
-    "capabilities": [
-      "runtime_switch",
-      "tag_publish",
-      "baseline_registry_finalize"
-    ]
-  },
-  "execution": {
-    "environment_variable": "AIOS_SILENT_RELEASE_EXECUTION_ENABLED",
-    "default_enabled": false,
-    "shadow_side_effects_allowed": false,
-    "durable_saga_required": true,
-    "pre_switch_revalidation_required": true,
-    "trusted_candidate_builder_required": true,
-    "actual_plan_regeneration_required": true,
-    "startup_fail_closed_on_missing_component": true,
-    "recovery_worker_shadow_default": true,
-    "production_approval_backend_required": true,
-    "production_builder_signer": "kms-hsm-secret-manager-only",
-    "production_execution_without_backend": "unavailable"
-  },
-  "durability": {
-    "journal": "sha256-hash-chain",
-    "probe_journal": "sha256-hash-chain",
-    "exclusive_capability_claims": true,
-    "side_effect_probe_before_lease_takeover": true,
-    "side_effect_probe_before_failed_recoverable_retry": true,
-    "probe_results": [
-      "NOT_APPLIED",
-      "APPLIED_VERIFIED",
-      "INDETERMINATE",
-      "CONFLICT"
-    ],
-    "probe_operation_digest_required": true,
-    "probe_freshness_required": true,
-    "tamper_result": "MANUAL_OWNER_REVIEW_REQUIRED"
-  },
-  "tag_pending": {
-    "required_observations": [
-      "remote_git_ref",
-      "annotated_tag_object",
-      "peeled_target",
-      "gitea_api",
-      "gitea_listing",
-      "repository_identity"
-    ],
-    "indeterminate_result": "RECONCILIATION_REQUIRED",
-    "conflict_result": "MANUAL_OWNER_REVIEW_REQUIRED",
-    "automatic_reconciliation": false
-  }
-}
@@ -1,59 +0,0 @@
-version: 1
-policy_id: gitops-isolated-worktree-governance-20260714T232948UTC8
-
-runtime_identity:
-  user: aiman
-  group: gitops
-  umask: "0002"
-  prohibit_root_workspace_writes: true
-
-repository:
-  source_worktree: /data/aios-gitops/workspace
-  bare_repo: /data/aios-gitops/repo.git
-  worktree_root: /data/aios-gitops/worktrees
-  remote: origin
-
-worktrees:
-  controller: /data/aios-gitops/worktrees/controller
-  task_pattern: /data/aios-gitops/worktrees/{agent}/{task_id}
-  allowed_agents:
-    - openclaw
-    - chatgpt
-    - controller
-  require_clean_start: true
-  remove_after_successful_push: true
-  retain_on_failure: true
-
-permissions:
-  owner: aiman
-  group: gitops
-  directory_mode: "2775"
-  file_mode: "0664"
-  default_acl:
-    user:aiman: rwx
-    group:gitops: rwx
-  apply_to:
-    - /data/aios-gitops
-    - /data/aios-gitops/worktrees
-
-preflight:
-  required_user: aiman
-  required_group: gitops
-  required_umask: "0002"
-  require_writable_git_dir: true
-  require_writable_task_dir: true
-  require_writable_result_dir: true
-  reject_shared_source_worktree: true
-  reject_existing_git_lock: true
-
-notifications:
-  owner_on_received: required
-  owner_on_terminal: required
-  preferred_channel: weixin
-  redact_secrets: true
-
-rollback:
-  preserve_source_worktree: true
-  remove_created_worktrees: true
-  restore_service_dropins: true
-  restore_service_state: true
@@ -1,14 +0,0 @@
-# Install as a systemd drop-in for GitOps/OpenClaw writer services.
-# Example: /etc/systemd/system/<service>.service.d/10-runtime-identity.conf
-
-[Service]
-User=aiman
-Group=gitops
-SupplementaryGroups=gitops
-UMask=0002
-Environment=AIOS_GITOPS_ROOT=/data/aios-gitops
-Environment=AIOS_BARE_REPO=/data/aios-gitops/repo.git
-Environment=AIOS_WORKTREE_ROOT=/data/aios-gitops/worktrees
-Environment=AIOS_RUNTIME_USER=aiman
-Environment=AIOS_RUNTIME_GROUP=gitops
-Environment=AIOS_RUNTIME_UMASK=0002
@@ -1,27 +0,0 @@
-# AIOS V2R1C2 Unified Portal production metadata.
-# No secret values belong in this file; runtime integrations use references.
-
-AIOS_V2_HOST=127.0.0.1
-AIOS_V2_PORT=18920
-AIOS_V2_STATE_DIR=/var/lib/aios-v2r1c2-production
-AIOS_PROVENANCE_STORE_FILE=/var/lib/aios-v2r1c2-production/run-provenance.sqlite3
-AIOS_EXTERNAL_TASK_STORE_FILE=/var/lib/aios-v2r1c2-production/external-task-truth.sqlite3
-AIOS_EXECUTOR_CATALOG_FILE=/var/lib/aios-v2r1c2-production/executor-catalog.json
-AIOS_EXECUTION_PLAN_FILES=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-RELEASE.json:/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
-AIOS_EXECUTION_PLAN_FILE=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
-
-AIOS_RELEASE_VERSION=V2R1C2
-AIOS_TARGET_VERSION=V2R1C2
-AIOS_BASELINE_VERSION=V2R1C1
-AIOS_PREVIOUS_VERSION=V2R1C1
-AIOS_RELEASE_STATUS=PRODUCTION
-AIOS_RELEASE_SOURCE_OID=3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24
-AIOS_RELEASE_OID=3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24
-AIOS_RELEASE_TAG=V2R1C2
-AIOS_RELEASE_EVIDENCE_SHA256=2e27bb73b8e6297bd3077238f73a96d697fc3c3611c601c4dc9357e5fdcd8eee
-
-AIOS_OPENCLAW_CONTRACT_VERSION=aios.openclaw.command.v2
-AIOS_OPENCLAW_SIGNATURE_ALGORITHM=Ed25519
-AIOS_OPENCLAW_PLUGIN_VERSION=2.1.0-rc.4
-AIOS_OPENCLAW_SIGNING_KEY_ID=openclaw-v2r1-candidate-ed25519
-AIOS_OWNER_WECHAT_TARGET_REF=AIOS_OWNER_WECHAT_TARGET_REF
@@ -1,44 +0,0 @@
-[Unit]
-Description=AIOS V2R1C2 Unified Portal Production
-After=network-online.target
-Wants=network-online.target
-Conflicts=aios-orchestrator-gateway.service
-ConditionPathExists=/opt/aios-v2r1c2/active-runtime/app/aios_web/release_application.py
-ConditionPathExists=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
-
-[Service]
-Type=simple
-User=aios
-Group=aios
-WorkingDirectory=/opt/aios-v2r1c2/active-runtime/app
-EnvironmentFile=/etc/aios-v2/aios-v2r1c2-production.env
-Environment=PYTHONUNBUFFERED=1
-Environment=PYTHONDONTWRITEBYTECODE=1
-ExecStartPre=/usr/bin/test "$AIOS_V2_PORT" = "18920"
-ExecStartPre=/usr/bin/test "$AIOS_RELEASE_SOURCE_OID" = "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24"
-ExecStartPre=/usr/bin/test "$AIOS_RELEASE_TAG" = "V2R1C2"
-ExecStart=/usr/bin/python3 -m aios_web.release_application
-Restart=on-failure
-RestartSec=3
-TimeoutStartSec=60
-TimeoutStopSec=30
-KillSignal=SIGTERM
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-RestrictSUIDSGID=true
-RestrictRealtime=true
-LockPersonality=true
-MemoryDenyWriteExecute=true
-ReadWritePaths=/var/lib/aios-v2r1c2-production
-StateDirectory=aios-v2r1c2-production
-StateDirectoryMode=0750
-UMask=0027
-LimitNOFILE=65536
-
-[Install]
-WantedBy=multi-user.target
@@ -11,8 +11,6 @@ Environment=AIOS_GITOPS_WORKSPACE=/data/aios-gitops/workspace
 Environment=AIOS_GITOPS_DB=/data/aios-gitops/runtime/gitops_model.sqlite3
 Environment=AIOS_GITOPS_TOKEN_FILE=/data/aios-gitops/runtime/secrets/gitops.tokens
 Environment=AIOS_GITOPS_BARE_REPO=/data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios-v23.git
-Environment=AIOS_GITOPS_AUTHORITATIVE_GIT_DIR=/data/aios-gitops/repo.git
-Environment=AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
 Environment=AIOS_GITOPS_HOST=127.0.0.1
 Environment=AIOS_GITOPS_PORT=18890
 ExecStart=/usr/bin/python3 /data/aios-gitops/workspace/active-runtime/app/aios_chatgpt_actions_api.py
@@ -1,23 +0,0 @@
-[Unit]
-Description=AIOS Integration Refresh Provisioner (sandbox control plane)
-After=network-online.target
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-User=aios
-Group=aios
-Environment=AIOS_GITOPS_WRITES_ENABLED=false
-Environment=AIOS_INTEGRATION_REFRESH_MODE=sandbox
-Environment=AIOS_CREDENTIAL_PROVIDER=disabled
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ProtectHome=yes
-ReadWritePaths=/var/lib/aios/integration-refresh
-RestrictAddressFamilies=AF_UNIX
-IPAddressDeny=any
-ExecStart=/usr/bin/python3 /opt/aios/active-runtime/app/aios_isolated_writer_api/integration_refresh.py --sandbox-preflight --state-dir /var/lib/aios/integration-refresh
-
-[Install]
-WantedBy=multi-user.target
@@ -1,25 +0,0 @@
-[Unit]
-Description=AIOS Silent Release Shadow Controller
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=aiman
-Group=gitops
-UMask=0077
-Environment=AIOS_GITOPS_WRITES_ENABLED=false
-Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
-Environment=PYTHONDONTWRITEBYTECODE=1
-ExecStart=/usr/bin/python3 /usr/libexec/aios-silent-release-shadow/current/active-runtime/app/silent_release_execution.py --state-root /var/lib/aios-silent-release-shadow --repository /data/aios-gitops/repo.git --host 127.0.0.1 --port 18891 --poll-seconds 30
-Restart=on-failure
-RestartSec=5
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ReadWritePaths=/var/lib/aios-silent-release-shadow
-ReadOnlyPaths=/data/aios-gitops/repo.git /usr/libexec/aios-silent-release-shadow
-
-[Install]
-WantedBy=multi-user.target
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+printf 'AIOS V2R1C0 RC1 health check\n'
+
+python3 - <<'PY'
+from pathlib import Path
+required = [
+ 'active-runtime/app/aios_v2r1/tenant_context.py',
+ 'active-runtime/app/aios_v2r1/router.py',
+ 'active-runtime/app/aios_v2r1/hermes_fabric.py',
+ 'openclaw/plugins/aios-tenant-boundary/openclaw.plugin.json',
+]
+missing=[p for p in required if not Path(p).exists()]
+if missing:
+    raise SystemExit('missing: '+','.join(missing))
+print('artifact presence PASS')
+PY
+
+echo 'runtime health requires OpenClaw environment probe'
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/../.." && pwd)
+EXPECTED_BRANCH="release/v2r1c0-tenant-cell-fabric-20260712"
+
+if [[ "$(git -C "$ROOT" branch --show-current)" != "$EXPECTED_BRANCH" ]]; then
+  echo "wrong release branch"
+  exit 1
+fi
+
+COMMIT=$(git -C "$ROOT" rev-parse HEAD)
+echo "Installing AIOS V2R1C0 RC1 commit=$COMMIT"
+
+python3 - <<'PY'
+import compileall
+if not compileall.compile_dir('active-runtime/app/aios_v2r1', quiet=1):
+    raise SystemExit(1)
+print('python compile PASS')
+PY
+
+if [[ -f openclaw/plugins/aios-tenant-boundary/package.json ]]; then
+  echo "plugin package PASS"
+else
+  echo "plugin package missing"
+  exit 1
+fi
+
+echo "Installation preflight PASS"
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+MODE=${1:---check}
+
+case "$MODE" in
+  --check)
+    echo "V2R1C0 RC1 validation mode"
+    ;;
+  --install)
+    echo "Install requires approved OpenClaw Cell target"
+    ;;
+  --rollback)
+    echo "Rollback requires recorded Cell backup"
+    ;;
+  *)
+    echo "Usage: $0 [--check|--install|--rollback]"
+    exit 2
+    ;;
+esac
+
+python3 - <<'PY'
+import compileall
+raise SystemExit(0 if compileall.compile_dir('active-runtime/app/aios_v2r1', quiet=1) else 1)
+PY
+
+echo "python runtime syntax: PASS"
@@ -1,7 +0,0 @@
-# V1R4C6 Backup Result
-
- version: V1R4C6
- status: NOT_STARTED
- reason: No confirmed production Stack, persistent volume, database migration target, or V1R4C5 image digest is bound to this source release. A backup cannot be claimed or executed safely without an identified target datastore.
- prohibited_actions_not_performed: production database deletion; persistent-volume deletion; docker system prune --volumes; direct copy of live database files.
- required_before_resume: confirmed Stack identity and its documented backup/restore command.
@@ -1,14 +0,0 @@
-# V1R4C6 Deployment Result
-
- version: V1R4C6
- source_commit: e204a90398bf646d46245b3088226749fa056edd
- tag_commit: d8cf6058e99f5c7f2dfd2b45a406c0a7edf955b2
- image_repository: UNRESOLVED
- image_digest: UNRESOLVED
- previous_image_digest: UNRESOLVED
- portainer_environment: UNRESOLVED
- portainer_stack: UNRESOLVED
- deployment_action: NOT_EXECUTED
- reason: No source-to-image-to-Portainer-Stack mapping exists. Existing Portainer containers and known Docker workloads do not expose a V1R4C6/e204 deployment target or Portainer stack labels. The active GitOps API is a direct systemd Python process, not a Portainer-managed Docker Stack.
- rollback_status: NOT_APPLICABLE_NO_CHANGE
- final_status: BLOCKED_MISSING_CONFIRMED_PRODUCTION_STACK
@@ -1,15 +0,0 @@
-# V1R4C6 Production Preflight Result
-
- version: V1R4C6
- started_at_utc: 2026-07-11T16:57:04.0596039Z
- source_tag_object: 356a8a8c1860b94b7d61a456c29228c88e57d963
- source_tag_commit: d8cf6058e99f5c7f2dfd2b45a406c0a7edf955b2
- source_commit: e204a90398bf646d46245b3088226749fa056edd
- tag_to_source_relation: tag commit is direct parent of source commit (verified)
- production_host_identifier: cn-network-mkt (hw / 1.95.164.183)
- host_preflight: Docker 29.5.3; root filesystem 29 percent used; memory available approximately 56 GiB
- GitOps_runtime: active at /data/aios-gitops/workspace via aios-gitops-model-api.service
- runtime_base: current_baseline V1R4C6; previous_baseline V1R4C5; git e204a90398bf646d46245b3088226749fa056edd; service status ok
- Portainer discovery: Portainer instances are reachable on ubuntu-admin and ubuntu-aihost, but no confirmed Portainer Environment/Stack maps to V1R4C6 or e204a90398bf646d46245b3088226749fa056edd.
- source_build_contract: target source contains only deploy/gitea/docker-compose.yml and no application Dockerfile/Containerfile or V1R4C6 image repository declaration.
- status: BLOCKED_MISSING_CONFIRMED_PRODUCTION_STACK
@@ -1,7 +0,0 @@
-# V1R4C6 Rollback Result
-
- version: V1R4C6
- rollback_required: No
- rollback_executed: No
- reason: No container, Stack, database, image, or production configuration was changed during this run.
- captured_v1r4c5_digest: UNRESOLVED because no matching current production Stack was confirmed.
@@ -1,11 +0,0 @@
-# V1R4C6 Verification Result
-
- version: V1R4C6
- healthcheck_result: GitOps adapter /health = 200 and /api/base = 200; this verifies the control-plane API only, not a V1R4C6 production deployment.
- gate_a_result: NOT_RUN (production admin workbench target and authenticated test path unresolved)
- gate_b_result: NOT_RUN (production Search Gateway target/provider binding unresolved)
- gate_c_result: NOT_RUN (production Agent Platform target/runtime request path unresolved)
- runtime_acceptance_result: NOT_RUN (0/8; cannot reuse non-production results)
- critical_control_plane_finding: gitea-branch-consistency-sentinel is failed with five Git-ref-to-Gitea-metadata drift entries and autonomous safe mode emitted. This is a hard safety gate failure.
- no_unresolved_critical_errors: false
- final_status: BLOCKED_MISSING_CONFIRMED_PRODUCTION_STACK
@@ -0,0 +1,26 @@
+# AIOS V1R5 to V2R1 Migration Plan
+
+## Goal
+
+Move from shared Gateway assumptions to Tenant Cell isolation.
+
+## Order
+
+1. Establish Tenant Registry and signed Tenant Context.
+2. Implement Tenant Router.
+3. Implement OpenClaw Cell lifecycle management.
+4. Introduce canonical message envelope.
+5. Add provenance and execution policy enforcement.
+6. Migrate Hermes into shared fabric with isolated profiles.
+7. Migrate memory, secrets and audit storage.
+
+## Do Not
+
+- Do not modify Hermes first.
+- Do not share production credentials across tenants.
+- Do not treat workspace separation as a sandbox.
+- Do not allow unknown message origins to execute tools.
+
+## Acceptance
+
+Each migration stage requires automated tests and runtime evidence before promotion.
@@ -0,0 +1,49 @@
+# AIOS V2R1 OpenClaw Tenant Cell + Hermes Shared Agent Fabric Architecture
+
+## Status
+
+Release train: V2R1C0
+
+Purpose: replace shared runtime trust assumptions with tenant-isolated Cell architecture.
+
+## Principles
+
+1. OpenClaw Gateway is a trust boundary.
+2. Each production tenant receives an isolated Cell.
+3. Hermes provides shared scheduling/fabric capability but not shared tenant state.
+4. Tenant identity, origin, session and task scope are mandatory in every event.
+5. Unknown provenance fails closed.
+
+## Target Components
+
+- Tenant Router
+- OpenClaw Cell Manager
+- Canonical Message Envelope
+- Tenant Inbox/Outbox Ledger
+- Secret Scope Manager
+- Memory Namespace Manager
+- Hermes Profile Worker Fabric
+- Sandbox Execution Layer
+- Audit Event Pipeline
+
+## Migration Order
+
+Phase 1: Tenant Router + Cell Manager
+
+Phase 2: Canonical Message and Policy Layer
+
+Phase 3: Hermes Shared Agent Fabric
+
+Phase 4: Memory, Secret and Audit isolation
+
+Phase 5: Production tenant migration
+
+## Release Gate
+
+A V2R1 production release requires:
+
+- tenant isolation tests passed
+- message provenance tests passed
+- runtime commit matches release commit
+- OpenClaw plugin runtime inspection passed
+- rollback verified
@@ -1,35 +0,0 @@
-{
-  "execution_renewal_manifest_blob_oid": "417f78abb3d795f7b0c04a0894069bd166bb15df",
-  "execution_renewal_manifest_sha256": "069091eff9c7c46bceccde365da6d07a8538e76bee9e288a57211f3114b94ab3",
-  "execution_renewal_merge_oid": "3a22c3c7d86930efd4bd93ac05d80ad322050cb9",
-  "observed_at": "2026-07-28T09:09:27.841968Z",
-  "runtime_source_evidence_sha256": "23f03d9c6abe6f11e1acda5210b8708696e3b77caa0083b6bfaef30a44b2a35f",
-  "runtime_source_observed_at": "2026-07-28T05:53:01.253909Z",
-  "schema": "aios.integration-refresh-source-map/v1",
-  "source_mapping_approval_merge_oid": "9514062cf33e45941abe4a8c98377e0713b0b3f6",
-  "source_mapping_manifest_blob_oid": "00c5e90e529cb98c7750a5761b0a0d6ccf507174",
-  "source_mapping_manifest_sha256": "17af8ebc43673c0e46bb9ab1bf44497e8c147f1b4a9d7a8a404edd5c0abd6f21",
-  "sources": [
-    {
-      "byte_for_byte_equal": true,
-      "canonical_blob_oid": "9c68be36e0b6a18260e3099e3d7b0dcab6d814aa",
-      "canonical_commit_oid": "85426f4f570e4d40b212318d47e52e4aed5cb06a",
-      "canonical_git_path": "active-runtime/app/aios_autonomous_release_authorization/controller.py",
-      "canonical_tree_oid": "cdbd9bb845b18d4b5224d91aace2656a51eb7c14",
-      "runtime_blob_oid": "9c68be36e0b6a18260e3099e3d7b0dcab6d814aa",
-      "runtime_path": "/usr/libexec/aios-autonomous-release-authorization/controller.py",
-      "runtime_sha256": "39b532c3058c4ae49ed691d7c66c3b7745a25111fa61039f388c8335fd262c50"
-    },
-    {
-      "byte_for_byte_equal": true,
-      "canonical_blob_oid": "ee0595ca61a0598f8cb3dc10865a255e21679b2a",
-      "canonical_commit_oid": "85426f4f570e4d40b212318d47e52e4aed5cb06a",
-      "canonical_git_path": "active-runtime/app/aios_chatgpt_action_task_router/action_task_router.py",
-      "canonical_tree_oid": "cdbd9bb845b18d4b5224d91aace2656a51eb7c14",
-      "runtime_blob_oid": "ee0595ca61a0598f8cb3dc10865a255e21679b2a",
-      "runtime_path": "/usr/libexec/aios-chatgpt-action-task-router-continuous-20260726/action_task_router.py",
-      "runtime_sha256": "738fb7035a6b792115d6467b4d1e4ffd47a8c5d5646f7032ebc68ea587cbd554"
-    }
-  ],
-  "task_id": "AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726"
-}
@@ -1,268 +0,0 @@
-# AIOS Silent Release Controller Design Report
-
-状态：隔离分支实现；生产 mutation 禁止
-目标：自动准备 → 自动验证 → 单次 Owner 签名授权 → 分控制器自动执行与验收
-
-## 1. 当前痛点
-
-现有流程需要多轮人工传递 commit、tree、artifact、manifest、测试、canary、drop-in
-和回滚证据。证据在不同消息里重复抄写，容易出现：
-
- 构建后 artifact、manifest 或 policy 已变化，但旧批准仍被使用；
- Git、Gitea、systemd 与回滚结果由人工拼接，缺少同一一致性快照；
- runtime switch、tag、Baseline、Registry 的授权边界不清；
- 重启后只剩工作树内临时 JSON，无法可靠恢复；
- approval replay、并发 writer、key revoke 和 secret inheritance 缺少统一防线。
-
-## 2. 新架构
-
-```text
-Build / Test / Canary
-        |
-        v
-ReleaseCandidate + DeploymentPlan
-        |
-        v
-ReleaseAcceptanceEngine
-        |
-        v
-READY_FOR_APPROVAL
-        |
-        v
-SignedReleasePlanApproval (Ed25519)
-        |
-        +--> runtime_switch capability
-        |       DeploymentController
-        |
-        +--> tag_publish capability
-        |       TagController
-        |
-        +--> baseline_registry_finalize capability
-                BaselineRegistryFinalizeController
-
-Durable ReleaseSagaStore + CapabilityLedger + Event Journal
-贯穿三个控制器；控制器互相不拥有对方的 mutation API。
-```
-
-一次 Owner 批准是同一个不可变 release plan 的签名，不是一个万能执行入口。三个 capability
-分别消费、分别留痕、分别幂等恢复。`force_push`、`tag_rewrite`、`direct_main_push`
-永远不是可签发 capability。
-
-## 3. 状态机
-
-```text
-PREPARING
-  -> VERIFYING
-  -> READY_FOR_APPROVAL
-  -> APPROVED
-  -> PRE_SWITCH_REVALIDATING
-  -> SWITCH_PENDING
-  -> SWITCHED
-  -> RUNTIME_VERIFYING
-  -> TAG_PENDING
-  -> TAG_VERIFIED
-  -> BASELINE_REGISTRY_PENDING
-  -> COMPLETED
-
-任一可恢复故障 -> RECONCILIATION_REQUIRED
-对象冲突       -> MANUAL_OWNER_REVIEW_REQUIRED
-切换后失败     -> ROLLBACK_PENDING -> ROLLED_BACK
-```
-
-状态快照使用 revision compare-and-set；事件同时写入 append-only journal。writer 崩溃后根据
-状态确定唯一恢复动作。并发控制器中只有一个 CAS winner。
-
-## 4. 数据模型
-
-### ReleaseCandidate
-
-```text
-candidate_id
-source_commit
-tree_oid
-artifact_sha256
-manifest_sha256
-tests
-canary
-rollback_ready
-git_consistency
-gitea_consistency
-approval_state
-```
-
-### DeploymentPlan
-
-```text
-service
-release_path / release_root
-dropin_path / dropin_sha256
-rollback_path / rollback_sha256
-source_commit
-artifact_sha256
-manifest_sha256
-policy_sha256
-health_contract
-sha256
-```
-
-### SignedReleasePlanApproval
-
-```text
-release_plan_id
-candidate_id
-source_commit
-tree_oid
-artifact_sha256
-manifest_sha256
-deployment_plan_sha256
-policy_sha256
-approval_plan_id
-evidence_closure_oid
-owner_approval_record_oid
-capabilities
-expires_at
-nonce
-key_id
-signature
-fingerprint
-```
-
-签名内容使用 canonical JSON，`signature` 不参与被签名字段。验证包括 Ed25519 签名、过期时间、
-公钥状态、approval revoke、candidate/plan/policy 逐字段绑定和 capability allowlist。
-
-## 5. API
-
-```text
-POST /createReleaseCandidate
-GET  /getReleaseCandidate?candidate_id=...
-GET  /getApprovalEnvelope?candidate_id=...
-POST /submitOwnerApproval
-POST /startDeployment
-GET  /getReleaseSaga?candidate_id=...
-```
-
-写接口要求 Bearer scope。`AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false` 是默认值；此时可以
-持久化 candidate、生成 approval envelope、保存经验证的 Owner approval 和读取 Saga，
-但 `/startDeployment` 只返回 `SHADOW_MODE` 与空 `side_effects`。
-
-## 6. PreSwitchValidator
-
-切换前重新收集并比较：
-
- source commit 与 tree；
- artifact、manifest、policy 和 deployment plan SHA-256；
- rollback readiness；
- local、authoritative bare 与 Gitea refs；
- repository identity；
- task writer/production writer 边界；
- health contract。
-
-任一变化都抛出：
-
-```text
-APPROVAL_STALE_REAPPROVAL_REQUIRED
-```
-
-旧批准不会被“最佳努力”继续使用。
-
-## 7. systemd 防线
-
- service 与 drop-in 均为显式 allowlist；
- release 与 drop-in resolved path 必须位于 release root 内；
- 拒绝普通文件被替换为 symlink，拒绝 symlink escape；
- deployment lock 覆盖 switch、restart 和首次 health check；
- restart 前后记录 MainPID 与 ActiveEnterTimestampMonotonic；
- artifact、drop-in、rollback 和 manifest 均按 plan hash 复验；
- 子进程只接收固定 allowlist 环境，不继承 token、password、credential、askpass、
-  auth socket、`LD_PRELOAD`、`PYTHONPATH` 或数据库连接串。
-
-## 8. TagController 分离
-
-TagController 必须独立完成 approval、execute、verify，并留下：
-
-```text
-evidence_closure_oid
-approval_plan_id
-repository_identity
-remote_tag_oid
-remote_peeled_target_oid
-gitea_api_tag_oid
-gitea_listing_visible
-```
-
-同名 tag 的 tag OID 或 peeled target 不同，进入
-`MANUAL_OWNER_REVIEW_REQUIRED`；自动流程不 push、不删除、不重写、不 force push。
-
-## 9. Baseline / Registry 门禁
-
-只有以下全部一致时，`baseline_registry_finalize` capability 才能完成：
-
-```text
-Registry = Baseline = remote tag = Gitea API = expected target
-```
-
-UNKNOWN、API 不可达、repository identity 不符或 listing 不可见均 fail closed。
-
-## 10. Policy as Code
-
-```text
-automatic:
-  build, test, artifact, canary, evidence
-
-owner:
-  signed_release_plan
-
-capabilities:
-  runtime_switch
-  tag_publish
-  baseline_registry_finalize
-
-forbidden:
-  force_push
-  tag_rewrite
-  direct_main_push
-  baseline_mutation
-  registry_mutation
-```
-
-最后两个 forbidden 项指“脱离受治理 finalize controller 的直接 mutation”。
-
-## 11. Security model
-
- Ed25519 公钥 ring 支持 rotation 和 revoke，私钥不进入 runtime；
- approval plan 可撤销，过期、未知 key、错误签名均 fail closed；
- nonce 与 capability operation 持久化，重复相同请求幂等，不同 fingerprint 重放拒绝；
- Saga snapshot 原子写、journal append-only、CAS 防并发 writer；
- credential 只通过受控 reference 使用，不进入 Git、API 响应或异常；
- 子进程环境从空集合构建，不复制 `os.environ`；
- Shadow 模式默认开启，execution adapter 缺失时不能降级执行；
- runtime、tag、Baseline/Registry 分属三个能力最小化控制器。
-
-## 12. Migration plan
-
-1. Shadow：生成 candidate、plan、acceptance、approval package，仅比较现有人工结果。
-2. Signed approval：接入 Owner 公钥 ring、撤销源和审计 record；仍不接生产 executor。
-3. Canary execution：使用非生产 service/release root 验证锁、PID、health、崩溃恢复和回滚。
-4. Controlled production switch：另行 Owner 授权启用 execution flag，只开放 runtime capability。
-5. Tag/finalize：分别完成 Gitea 与 Registry/Baseline 生产验收后再启用对应 capability。
-
-每个阶段均可退回上一个阶段；不开启下一能力不会影响已经启用的控制器。
-
-## 13. Rollback plan
-
- switch 前保存旧 symlink target、PID、启动时间、artifact 与 plan fingerprint；
- restart 或 health 任一失败进入 `ROLLBACK_PENDING`；
- 原子恢复旧 target，只 restart 指定 allowlist service；
- 重新验证旧 runtime commit、writer=false 与 repository identity；
- 成功进入 `ROLLED_BACK`，失败进入 `MANUAL_OWNER_REVIEW_REQUIRED`；
- rollback 不修改 Git main、production tag、Baseline 或 Registry；
- 保留脱敏 journal、approval fingerprint 和失败证据。
-
-## 14. 测试与外部依赖边界
-
-自动测试覆盖签名伪造、字段篡改、过期/revoke/key rotation、nonce replay、CAS race、
-崩溃恢复、artifact/policy/plan mutation、tag conflict、secret leakage、runtime without
-`.git`、rollback 和 shadow no-side-effects。
-
-本隔离实现不创建生产 KMS/key、不安装 systemd unit、不部署 Action runtime、不创建 tag，
-也不修改 Baseline/Registry。上述动作必须在单独生产批准中执行。
@@ -1,107 +0,0 @@
-# AIOS Silent Release Execution Readiness
-
-## Scope and stop point
-
-This change makes the controller execution-ready while deploying only a
-localhost-bound Shadow control plane. Both production gates remain false:
-
-```text
-AIOS_GITOPS_WRITES_ENABLED=false
-AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
-```
-
-Shadow completion is evidence preparation, not a production release. It cannot
-write a production tag, switch a business runtime, or mutate Baseline/Registry.
-
-## Recovery state machine
-
-Every expired or `FAILED_RECOVERABLE` capability requires fresh, operation-bound
-probe evidence before another adapter may run:
-
-```text
-NOT_APPLIED       -> one new exclusive claim may retry
-APPLIED_VERIFIED  -> mark COMPLETED without adapter replay
-INDETERMINATE     -> RECONCILIATION_REQUIRED; no automatic writes
-CONFLICT          -> MANUAL_OWNER_REVIEW_REQUIRED; no automatic writes
-```
-
-Probe evidence binds the immutable operation digest, is freshness checked, and
-is appended to a separate SHA-256 hash-chained journal. Completion still
-requires the active claim ID. File locks and leases ensure that concurrent
-recovery workers cannot execute the same adapter.
-
-`TAG_PENDING` uses independent remote ref, annotated object, peeled target,
-Gitea API, Gitea listing, and repository identity evidence. Exact absence may
-roll back a switched runtime. Exact publication continues to finalization.
-Unavailable/divergent evidence stops at reconciliation; a different OID or
-target stops for Owner review. No branch can force, delete, or rewrite a tag.
-
-## Trusted build and approval
-
-Callers submit only an event ID and exact source commit. Test, canary, artifact,
-manifest, rollback, secret scan, Git and Gitea evidence are generated by the
-trusted builder. The builder emits an Ed25519 attestation binding:
-
- builder attestation/key IDs;
- source commit and tree OID;
- artifact, manifest and package-closure SHA-256;
- test and canary evidence SHA-256;
- issuance time and signature.
-
-The controller contains only trusted public keys. Production signing is exposed
-through a KMS/HSM/secret-manager adapter; a local private-key adapter is marked
-test-only and is used only for ephemeral Shadow acceptance.
-
-Owner approvals are immutable, time-bounded, revocable, trust-domain bound, and
-single-use per capability ledger. If the production approval backend reference
-is absent, production execution is unavailable while Shadow remains available.
-Caller-supplied `owner_id` is never a fallback.
-
-## Persistent controller and API
-
-`aios-silent-release-controller.service` runs independently from the business
-GitOps API. It uses a single leader lock, durable intents/candidates/Sagas,
-startup journal verification, idempotent main events, one notification record,
-and recovery reporting. The final deployed service is report-only Shadow mode.
-
-The Action contract exposes:
-
- `createReleaseIntent`
- `getReleaseCandidate`
- `getReleasePlan`
- `getReleaseAcceptance`
- `submitSignedApproval`
- `getReleaseSaga`
- `getCapabilityStatus`
- `startDeployment`
- `getRecoveryStatus`
-
-Every Shadow response declares `execution_enabled=false`, `shadow_mode=true`
-and `side_effects_executed=false`. `startDeployment` returns a simulated
-`SHADOW_COMPLETED` result and never claims production capabilities.
-
-## Migration and rollback
-
-1. Merge through a governed pull request.
-2. Build from a clean detached worktree at the exact merge commit.
-3. Verify artifact, manifest, package closure, tests, live fixture, no-.git
-   canary, rollback archive and secret scan.
-4. Install a versioned Shadow release without changing the business runtime.
-5. Start the separate localhost-only controller with both gates false.
-6. Run Shadow candidates and freeze production PID/tag/Baseline/Registry hashes.
-7. Remove ephemeral test keys and temporary repositories.
-
-Rollback stops and disables only the Shadow controller and restores/removes its
-versioned `current` link. The existing production API, tag set, Baseline and
-Registry are not involved.
-
-## Future activation envelope
-
-Activation requires a new one-time Owner approval binding the exact controller
-commit, artifact/manifest/policy/unit hashes, trusted key IDs, KMS/secret
-references, release and rollback roots, authoritative Git/repository identity,
-Shadow candidate/evidence IDs, test results, activation plan and rollback plan.
-That approval may only flip
-`AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false` to `true`; each real release still
-requires its own signed ReleasePlan. This change does not request or consume
-that activation approval.
@@ -1,84 +0,0 @@
-# Silent Release Controller Production Contract
-
-Status: review-only implementation. Production execution remains disabled.
-
-## Trust boundary
-
-The caller submits only release intent. A configured trusted builder owns ref
-validation, build, tests, artifact and manifest hashing, package closure,
-canary, rollback readiness, Git/Gitea consistency, and secret scanning. Caller
-supplied success evidence is rejected.
-
-The resulting immutable `ReleasePlan` contains deployment, tag, and
-finalization plans. One Ed25519 owner signature binds its SHA-256 digest,
-candidate evidence, policy digest, owner identity, trust domain, validity
-window, evidence lineage, and three narrow capabilities.
-
-## Durable execution
-
-The Saga journal is the source of truth. Every record is sequence-numbered and
-SHA-256 hash-chained from a fixed genesis hash. Snapshots are rebuildable
-caches. Journal corruption, truncation, reordering, missing records, or hash
-mismatch moves the release to `MANUAL_OWNER_REVIEW_REQUIRED`.
-
-Capability execution uses an exclusive, leased claim. A second worker receives
-`BUSY`; an expired claim is not reassigned until a capability-specific
-side-effect probe reports that the operation was not applied. Runtime, tag,
-and finalization remain separately claimed and recoverable.
-
-## Execution order
-
-```text
-APPROVED
-  -> PRE_SWITCH_REVALIDATING
-  -> SWITCH_PENDING
-  -> SWITCHED
-  -> RUNTIME_VERIFYING
-  -> RUNTIME_VERIFIED
-  -> TAG_PENDING
-  -> TAG_VERIFIED
-  -> BASELINE_REGISTRY_PENDING
-  -> COMPLETED
-```
-
-The actual adapter configuration is regenerated before execution and must
-match the signed plan. Trusted allowlists come from controlled policy, not the
-request.
-
-A failure before verified tag publication rolls the runtime back. A failure
-after the exact tag is verified enters `RECONCILIATION_REQUIRED`; the tag is
-never deleted or rewritten. A same-name/different-OID conflict enters
-`MANUAL_OWNER_REVIEW_REQUIRED`. Registry/Baseline finalization requires exact
-remote and Gitea tag proof, and Baseline is recorded last.
-
-## Action and recovery contract
-
-`submitOwnerApproval` verifies and durably stores the signed plan, then moves
-the Saga to `APPROVED`. `startDeployment` loads that durable approval and
-ignores caller-supplied approval content. Enabling execution without the
-trusted builder, verifier, validator, policy, and orchestrator fails during
-service construction.
-
-The recovery worker scans incomplete journals and resumes through the same
-claims and verification gates. It never automatically resumes a manual-review
-Saga. In shadow mode it only reports state and performs no adapter side
-effects.
-
-The deployed Action factory does not enable the legacy caller-evidence path.
-If the trusted builder is absent, candidate creation is rejected even while
-execution remains in shadow mode. The compatibility path exists only through
-the explicit test-only `SilentReleaseActionService.shadow()` constructor.
-
-Finalization is composed from separate `RegistryController` and
-`BaselineController` claims. Registry is verified first and Baseline is the
-last mutation; a retry reuses completed Registry evidence and never moves
-Baseline ahead of tag verification.
-
-## Governance
-
- `force_push`: forbidden
- `tag_rewrite`: forbidden
- `direct_main_push`: forbidden
- production execution default: disabled
- production tag operations in this change: not executed
- Baseline/Registry mutations in this change: not executed
@@ -1,68 +0,0 @@
-# Gitea Tag Publication Atomicity
-
-Release publication is a fail-closed Saga bound to one immutable governance
-fingerprint:
-
- `version`
- `target_oid`
- `evidence_closure_oid`
- `approval_plan_id`
-
-The normal progression is:
-
-`PENDING` → `LOCAL_TAG_CREATED` → `REMOTE_PUSH_CONFIRMED` →
-`GITEA_API_CONFIRMED` → `BASELINE_UPDATE_PENDING` → `BASELINE_UPDATED` →
-`PRODUCTION_DEPLOYED`
-
-An unavailable remote uses `REMOTE_PUSH_PENDING` or
-`RECONCILIATION_REQUIRED`. A same-name tag object mismatch, peeled-target
-mismatch, changed governance fingerprint, or immutable deployment-evidence
-conflict enters `MANUAL_OWNER_REVIEW_REQUIRED`. That state blocks automatic
-push and reconciliation; recovery never deletes, rewrites, or force-pushes a
-tag.
-
-## Legacy state migration
-
-Readers normalize the historical `TAG_CREATED_LOCAL` value to
-`LOCAL_TAG_CREATED` in memory. Read-only status responses therefore expose only
-the canonical value. The next governed Saga write persists the canonical name;
-reading legacy state alone does not mutate the tag, Baseline, Registry, or Saga
-file. Any unrecognized persisted state fails closed as
-`RECONCILIATION_REQUIRED`.
-
-`BASELINE_UPDATE_PENDING` is persisted before either `baseline/current.json` or
-`versions/<version>.json` changes. Recovery revalidates the governance
-fingerprint, evidence lineage, remote annotated tag, peeled target, Gitea API,
-listing, and repository identity before idempotently completing matching
-partial records. A different tag or target enters
-`MANUAL_OWNER_REVIEW_REQUIRED`.
-
-## Durable state
-
-Production writers set `AIOS_GITOPS_PUBLICATION_STATE_DIR` to storage outside
-their disposable worktree. Recreating a writer must reuse that directory.
-Worktree JSON is not the authoritative Saga store.
-
-## Deployment gate
-
-`mark_production_deployed` performs fresh Git remote, peeled-target, Gitea ref,
-Gitea tag-object, listing, repository-identity, evidence-lineage, Registry, and
-Baseline checks. Deployment is allowed only when:
-
-`Registry = Baseline = remote tag = Gitea API = expected target`
-
-Deployment evidence must be an immutable `sha256:<64 hex>` or `git:<40 hex>`
-identifier.
-
-## Read-only acceptance
-
- `getTagPublicationStatus` reads durable Saga state.
- `getReleaseConsistency` compares every release authority.
- `runReleaseAcceptance` returns `accepted: true` only for `PASS`.
-
-Unavailable evidence returns `UNKNOWN` with `fail_closed: true`; it is never
-treated as acceptance.
-
-The CLI, HTTP Action, and release script all enter the same publisher core for
-evidence-lineage verification. The release script stages Registry and Baseline
-records only; durable Saga state remains outside Git.
@@ -1,68 +0,0 @@
-# Isolated Writer Exact-Path Policy V1
-
-This policy is an additional, service-owned authorization layer for
-`POST /api/commit-file`. It never expands a Token Policy V2 grant.
-
-An atomic write is permitted only when all of the following agree:
-
-1. socket peer, audience, operation, branch, base and exact path in the
-   Token Policy V2 grant;
-2. service audience, repository identity, branch, operation and exact path
-   in `AIOS_GITOPS_PATH_POLICY_FILE`;
-3. lexical path, resolved containment and symlink checks;
-4. the configured content-size and content-profile checks;
-5. operation digest, expected branch HEAD and durable operation ledger.
-
-Any failed layer returns a fail-closed policy error. Coarse `/api/file` and
-`/api/commit` routes remain forbidden.
-
-## File contract
-
-The configured path must be absolute. The parent directory must be
-`root:gitops 0750`; the regular, non-symlink file must be
-`root:gitops 0640`. JSON must use UTF-8 canonical encoding with sorted keys,
-compact separators and one trailing newline. Unknown fields, unsupported
-operations or profiles, duplicate paths, oversized policies and
-group/world-writable files are rejected during Writer startup.
-
-Example:
-
-```json
-{"allowed_branch":"patch/codex-review-test-worker-20260724","allowed_operations":{"commit_file.atomic":{"content_profile":"systemd-codex-review-worker-v1","exact_paths":["deploy/systemd/aios-codex-review-test-worker.service"],"max_content_bytes":32768}},"audience":"aios-codex-review-worker-writer.service","policy_id":"codex-review-worker-path-policy-v1","repository_identity":"aios/aios","schema_version":1}
-```
-
-The SHA-256 of the canonical policy is exposed in the isolated runtime
-status and written to the operation audit record. The request body cannot
-select or override the policy file.
-
-## Content profile
-
-`systemd-codex-review-worker-v1` is an exact, fail-closed unit grammar. The
-only sections are `[Unit]`, `[Service]` and `[Install]`. Each section has a
-directive allowlist; every single-value directive and every repeated
-`Environment`, `ReadOnlyPaths` and `ReadWritePaths` entry must match the
-governed Shadow unit contract exactly.
-
-The profile fixes the Python module
-`task_plane.workers.codex_review_test`, `User=aiman`, `Group=gitops`,
-the controlled `/usr/libexec/aios-codex-review-test-worker/current`
-working directory, all hardening switches and the three permitted
-environment variables. It grants read access only to the authoritative
-bare repository and the versioned worker artifact, and write access only
-to the worker runtime, state and cache directories.
-
-Unknown sections or directives are rejected, including lifecycle hooks,
-credential injection, environment imports, root images, bind mounts,
-capability expansion, devices, sockets and top-level writable paths. The
-parser also rejects duplicate sections, duplicate single-value directives,
-empty resets, continuation lines, CRLF, NUL, non-UTF-8 surrogate content,
-overlong lines and Unicode lookalike directive names. It does not use
-`ConfigParser(strict=False)` or silently merge repeated values.
-
-Production credentials, if later authorized, must be supplied by a
-separately governed deployment drop-in. They are not permitted in the
-source unit or this content profile.
-
-Policy changes require a separate maintenance branch and Owner-reviewed
-ordinary merge commit. A task-scoped Writer must not edit its own policy
-file.
@@ -13,27 +13,6 @@ components:
      scheme: bearer
      bearerFormat: opaque-token
  schemas:
-    PublicationState:
-      type: string
-      description: Canonical durable publication state. Legacy TAG_CREATED_LOCAL is normalized on read and is never emitted by new writes.
-      enum:
-        - PENDING
-        - LOCAL_TAG_CREATED
-        - REMOTE_PUSH_PENDING
-        - REMOTE_PUSH_CONFIRMED
-        - GITEA_API_CONFIRMED
-        - BASELINE_UPDATE_PENDING
-        - BASELINE_UPDATED
-        - PRODUCTION_DEPLOYED
-        - RECONCILIATION_REQUIRED
-        - MANUAL_OWNER_REVIEW_REQUIRED
-    PublicationStatus:
-      type: object
-      required: [version, state]
-      properties:
-        version: {type: string}
-        state: {$ref: '#/components/schemas/PublicationState'}
-        fail_closed: {type: boolean}
    BranchRequest:
      type: object
      required: [branch]
@@ -51,31 +30,6 @@ components:
        path: {type: string, example: docs/gitops/chatgpt-change.md}
        content: {type: string}
        message: {type: string}
-    AtomicFileCommitRequest:
-      type: object
-      additionalProperties: false
-      required: [branch, path, content, message, expected_head_oid, idempotency_key]
-      properties:
-        branch:
-          type: string
-          pattern: '^patch/[A-Za-z0-9._/-]+$'
-        path:
-          type: string
-          minLength: 1
-          maxLength: 512
-        content:
-          type: string
-          maxLength: 1048576
-        message:
-          type: string
-          minLength: 1
-          maxLength: 200
-        expected_head_oid:
-          type: string
-          pattern: '^[0-9a-f]{40}$'
-        idempotency_key:
-          type: string
-          pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$'
    CommitRequest:
      type: object
      properties:
@@ -96,20 +50,9 @@ components:
        message: {type: string}
    TagRequest:
      type: object
-      required: [version, target_oid, evidence_closure_oid, approval_plan_id]
+      required: [version]
      properties:
        version: {type: string, example: V1R1C1}
-        target_oid:
-          type: string
-          pattern: '^[0-9a-fA-F]{40}$'
-          description: Full approved commit OID. The tag is created explicitly at this commit, never implicitly at workspace HEAD.
-        evidence_closure_oid:
-          type: string
-          pattern: '^[0-9a-fA-F]{40}$'
-          description: Required evidence closure commit. target_oid must be its ancestor.
-        approval_plan_id:
-          type: string
-          description: Audited owner-approved release or tag plan identifier.
        message: {type: string}
        execute:
          type: boolean
@@ -160,216 +103,7 @@ components:
      properties:
        text: {type: string}
        branch: {type: string}
-    DeploymentPlan:
-      type: object
-      required: [service, release_path, release_root, cutover_link, dropin_path, dropin_sha256, systemd_unit_sha256, rollback_path, rollback_sha256, source_commit, tree_oid, artifact_sha256, manifest_sha256, package_closure_sha256, authoritative_git_dir, repository_identity, writer_expected, baseline_before_sha256, registry_before_sha256, production_tag_refset_before_sha256, health_contract_version, timeout_policy, retry_policy, policy_sha256, health_contract]
-      properties:
-        service: {type: string}
-        release_path: {type: string}
-        release_root: {type: string}
-        cutover_link: {type: string}
-        dropin_path: {type: string}
-        dropin_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        systemd_unit_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        rollback_path: {type: string}
-        rollback_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        source_commit: {type: string, pattern: '^[0-9a-f]{40}$'}
-        tree_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
-        artifact_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        manifest_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        package_closure_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        authoritative_git_dir: {type: string}
-        repository_identity: {type: string}
-        writer_expected: {type: boolean, enum: [false]}
-        baseline_before_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        registry_before_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        production_tag_refset_before_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        health_contract_version: {type: string}
-        timeout_policy: {type: object}
-        retry_policy: {type: object}
-        policy_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        health_contract: {type: object, additionalProperties: true}
-    ReleaseCandidateInput:
-      type: object
-      required: [source_commit, version]
-      additionalProperties: false
-      properties:
-        candidate_id: {type: string, pattern: '^[A-Za-z0-9][A-Za-z0-9_.-]{2,127}$'}
-        source_commit: {type: string, pattern: '^[0-9a-f]{40}$'}
-        version: {type: string, pattern: '^V[0-9]+R[0-9]+C[0-9]+(?:[-.][A-Za-z0-9][A-Za-z0-9.-]*)?$'}
-    ReleaseIntentInput:
-      type: object
-      required: [event_id, source_commit]
-      additionalProperties: false
-      properties:
-        event_id: {type: string, pattern: '^[A-Za-z0-9][A-Za-z0-9_.:-]{2,255}$'}
-        source_commit: {type: string, pattern: '^[0-9a-f]{40}$'}
-    SignedReleasePlanApproval:
-      type: object
-      required: [release_plan_id, candidate_id, source_commit, tree_oid, artifact_sha256, manifest_sha256, deployment_plan_sha256, release_plan_sha256, policy_sha256, approval_plan_id, evidence_closure_oid, owner_approval_record_oid, capabilities, owner_identity, trust_domain, issued_at, not_before, expires_at, nonce, key_id, signature]
-      properties:
-        release_plan_id: {type: string}
-        candidate_id: {type: string}
-        source_commit: {type: string, pattern: '^[0-9a-f]{40}$'}
-        tree_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
-        artifact_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        manifest_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        deployment_plan_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        release_plan_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        policy_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        approval_plan_id: {type: string}
-        evidence_closure_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
-        owner_approval_record_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
-        owner_identity: {type: string}
-        trust_domain: {type: string}
-        issued_at: {type: string, format: date-time}
-        not_before: {type: string, format: date-time}
-        capabilities:
-          type: array
-          uniqueItems: true
-          items:
-            type: string
-            enum: [runtime_switch, tag_publish, baseline_registry_finalize]
-        expires_at: {type: string, format: date-time}
-        nonce: {type: string, minLength: 16}
-        key_id: {type: string}
-        signature: {type: string, format: byte, writeOnly: true}
-    StartDeploymentRequest:
-      type: object
-      required: [candidate_id]
-      additionalProperties: false
-      properties:
-        candidate_id: {type: string}
 paths:
-  /createReleaseIntent:
-    post:
-      operationId: createReleaseIntent
-      summary: Create an idempotent intent; all build evidence comes from the trusted builder
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/ReleaseIntentInput'}
-      responses:
-        '200': {description: Intent created or idempotently returned}
-        '400': {description: Caller evidence or invalid intent rejected}
-      x-openai-isConsequential: true
-  /createReleaseCandidate:
-    post:
-      operationId: createReleaseCandidate
-      summary: Submit release intent to the trusted builder; caller evidence is rejected
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/ReleaseCandidateInput'}
-      responses:
-        '200': {description: Candidate created or idempotently returned}
-        '400': {description: Invalid or conflicting candidate evidence}
-        '401': {description: Unauthorized}
-      x-openai-isConsequential: true
-  /getReleaseCandidate:
-    get:
-      operationId: getReleaseCandidate
-      summary: Read a durable release candidate
-      parameters:
-        - {in: query, name: candidate_id, required: true, schema: {type: string}}
-      responses:
-        '200': {description: Candidate}
-        '404': {description: Candidate not found}
-  /getReleasePlan:
-    get:
-      operationId: getReleasePlan
-      parameters:
-        - {in: query, name: candidate_id, required: true, schema: {type: string}}
-      responses:
-        '200': {description: Immutable release plan}
-        '404': {description: Candidate not found}
-  /getReleaseAcceptance:
-    get:
-      operationId: getReleaseAcceptance
-      parameters:
-        - {in: query, name: candidate_id, required: true, schema: {type: string}}
-      responses:
-        '200': {description: Builder attestation and acceptance checks}
-        '404': {description: Candidate not found}
-  /getApprovalEnvelope:
-    get:
-      operationId: getApprovalEnvelope
-      summary: Generate the immutable owner-signature payload
-      parameters:
-        - {in: query, name: candidate_id, required: true, schema: {type: string}}
-      responses:
-        '200': {description: Approval envelope fingerprint inputs}
-        '404': {description: Candidate not found}
-  /submitOwnerApproval:
-    post:
-      operationId: submitOwnerApproval
-      summary: Verify and durably store a signed owner release plan
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/SignedReleasePlanApproval'}
-      responses:
-        '200': {description: Signature verified and approval stored}
-        '400': {description: Invalid approval}
-        '403': {description: Signature, key, expiry, or revocation failure}
-        '409': {description: Conflicting release plan}
-      x-openai-isConsequential: true
-  /submitSignedApproval:
-    post:
-      operationId: submitSignedApproval
-      summary: Alias for immutable signed owner approval submission
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/SignedReleasePlanApproval'}
-      responses:
-        '200': {description: Signature verified and approval stored}
-        '403': {description: Production approval backend unavailable or signature invalid}
-      x-openai-isConsequential: true
-  /startDeployment:
-    post:
-      operationId: startDeployment
-      summary: Resume the durable approved Saga; caller cannot replace approval
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/StartDeploymentRequest'}
-      responses:
-        '200': {description: Shadow result or deployment Saga result}
-        '403': {description: Execution disabled or approval invalid}
-        '409': {description: Saga conflict}
-      x-openai-isConsequential: true
-  /getReleaseSaga:
-    get:
-      operationId: getReleaseSaga
-      summary: Read durable Saga state and event journal
-      parameters:
-        - {in: query, name: candidate_id, required: true, schema: {type: string}}
-      responses:
-        '200': {description: Saga snapshot}
-        '404': {description: Saga not found}
-  /getCapabilityStatus:
-    get:
-      operationId: getCapabilityStatus
-      parameters:
-        - {in: query, name: candidate_id, required: true, schema: {type: string}}
-      responses:
-        '200': {description: Durable single-use capability records}
-  /getRecoveryStatus:
-    get:
-      operationId: getRecoveryStatus
-      responses:
-        '200': {description: Fail-closed recovery classification}
  /api/base:
    get:
      operationId: getBaseline
@@ -453,25 +187,6 @@ paths:
            schema: {$ref: '#/components/schemas/FileCommitRequest'}
      responses: {'200': {description: File committed}, '400': {description: Secret rejected or invalid path}, '401': {description: Unauthorized}}
      x-openai-isConsequential: true
-  /api/commit-file:
-    post:
-      operationId: commitFileAtomic
-      summary: Atomically write one allowlisted file, commit, push, and verify using Token Policy V2
-      security: [{bearerAuth: []}]
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/AtomicFileCommitRequest'}
-      responses:
-        '200': {description: Completed or idempotently replayed}
-        '400': {description: Invalid canonical request}
-        '401': {description: Missing, invalid, expired, or revoked Token Policy V2 grant}
-        '403': {description: Audience, source, branch, operation, path, or policy denied}
-        '409': {description: Idempotency conflict or manual review required}
-        '413': {description: Request too large}
-        '503': {description: Push or remote verification unavailable; recoverable}
-      x-openai-isConsequential: true
  /api/commit:
    post:
      operationId: commitChanges
@@ -484,39 +199,6 @@ paths:
            schema: {$ref: '#/components/schemas/CommitRequest'}
      responses: {'200': {description: Commit result}, '401': {description: Unauthorized}}
      x-openai-isConsequential: true
-  /api/tag-publication-status:
-    get:
-      operationId: getTagPublicationStatus
-      summary: Read durable publication Saga status without mutation
-      parameters:
-        - {in: query, name: version, required: true, schema: {type: string, pattern: '^V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$'}}
-      responses:
-        '200':
-          description: Canonical publication state or fail-closed UNKNOWN
-          content:
-            application/json:
-              schema: {$ref: '#/components/schemas/PublicationStatus'}
-        '400': {description: Version required}
-  /api/release-consistency:
-    get:
-      operationId: getReleaseConsistency
-      summary: Compare Registry, Baseline, remote tag, Gitea API, listing, repository identity, and expected target
-      parameters:
-        - {in: query, name: version, required: true, schema: {type: string}}
-        - {in: query, name: target_oid, required: true, schema: {type: string, pattern: '^[0-9a-fA-F]{40}$'}}
-        - {in: query, name: evidence_closure_oid, required: true, schema: {type: string, pattern: '^[0-9a-fA-F]{40}$'}}
-        - {in: query, name: approval_plan_id, required: true, schema: {type: string}}
-      responses: {'200': {description: PASS, FAIL, or fail-closed UNKNOWN}}
-  /api/release-acceptance:
-    get:
-      operationId: runReleaseAcceptance
-      summary: Run read-only release acceptance; UNKNOWN is not accepted
-      parameters:
-        - {in: query, name: version, required: true, schema: {type: string}}
-        - {in: query, name: target_oid, required: true, schema: {type: string, pattern: '^[0-9a-fA-F]{40}$'}}
-        - {in: query, name: evidence_closure_oid, required: true, schema: {type: string, pattern: '^[0-9a-fA-F]{40}$'}}
-        - {in: query, name: approval_plan_id, required: true, schema: {type: string}}
-      responses: {'200': {description: Acceptance result with accepted boolean}}
  /api/tag:
    post:
      operationId: requestOrCreateTag
@@ -527,7 +209,7 @@ paths:
        content:
          application/json:
            schema: {$ref: '#/components/schemas/TagRequest'}
-      responses: {'200': {description: Gitea-confirmed tag and fail-closed baseline result}, '400': {description: Missing governance evidence or invalid OID}, '403': {description: Forbidden}, '409': {description: Existing tag target conflict or evidence lineage mismatch}, '502': {description: Gitea reconciliation required}, '503': {description: Remote push pending}}
+      responses: {'200': {description: Tag request committed or tag created}, '403': {description: Forbidden}}
      x-openai-isConsequential: true
  /api/rollback:
    post:
@@ -563,7 +245,4 @@ paths:
        content:
          application/json:
            schema: {$ref: '#/components/schemas/NLRequest'}
-      responses:
-        '200': {description: Safe GitOps plan}
-        '401': {description: Unauthorized}
-      x-openai-isConsequential: true
+      responses: {'
@@ -1,113 +0,0 @@
-# 微信文本-图片缓存隔离事故报告
-
-## 结论
-
-本次事故已经按最新备份链路回滚并完成第二轮评审修复。`3d9782fc346d1e7defde090ab8637e62ab28ab8a` 进一步修复了英文诊断文本和未确认引用文本误入图片路径的问题，`706c0b0` 则是后续最小修复提交。当前文档只记录证据、部署和验收边界，不把“真实 owner inbound 已完成”写成结论。
-
-## 现象
-
- 纯文本消息被误答成旧图片回复，属于 stale-image reply on pure text。
- 现场证据显示 `types=1` 且 `hasMedia=false`，但后续又进入 `message_type=image`、`image_count=0`、`implicit_image_message`，最终落到 `cached_image_expired`。
- 这说明“诊断文本”被误判成图片意图后，又继承了 sender 级旧图缓存。
-
-## 根因
-
- `fixes/patch_openclaw_weixin_hermes.py:768-839` 把文本意图判断和缓存回退放在同一条链上。
- `looksLikeHermesImageFollowup()` 会把含图片关键字的诊断文本推进 image intent。
- `resolveHermesFollowupImageContext()` 随后会读取 sender 级缓存；一旦缓存命中失败或过期，就会落到 `cached_image_expired`，从而让纯文本沾上旧图上下文。
- `handleHermesImplicitImage()` 继续把消息送入 `handleHermes(..., "implicit_image_message")`，所以误判会沿着同一条图片处理通道传播。
-
-## 护栏不变量
-
- 图片处理上下文必须来自当前消息图片、已确认的引用图片，或精确匹配的缓存图片 ID；缺少这三类证据时，纯文本不能进入 `handleHermesImplicitImage()`。
- 未确认的引用文本不能继承 sender 级旧图缓存，必须返回 `referenced_image_not_confirmed`。
- 只有精确缓存图片 ID 命中且缓存仍有效时，才允许走 `resolveHermesCachedImageEntry()` 的 `cached_image_matched` 路径。
- `/hermes` 这类 slash 路径保持原有分流，slash/channel 面不变。
- 这次修复的守卫目标，是把中英文诊断文本、未确认引用文本与图片缓存回退拆开，避免再把普通文本提升成图片意图。
-
-## TDD 与幂等性
-
- `66d637fc0364a617c7b9fd8cd9baa68fb0368675`（`fix(weixin): isolate text from stale image cache`）引入了隔离修复和 `tests/test_weixin_image_followup_intent.py`。
- `2de29c59bb946cc3db3e14e8a06270391ede8401`（`fix(weixin): add process-only runtime patch mode`）继续收紧 process-only 运行模式，保持回放幂等。
- `3d9782fc346d1e7defde090ab8637e62ab28ab8a`（`fix(weixin): require confirmed image reference context`）补齐英文诊断文本和未确认引用文本用例，并把图片引用收紧到已确认上下文。
- 用户实测的 TDD 路径为 RED `8 PASS / 1 FAIL`，随后 GREEN `9 PASS`。
- 最小修复提交为 `706c0b0`，对应 quoted pure text 的最后一层收敛修复。
- 第二轮回归结果为 `8 PASS`；node check 同样通过，重复应用补丁保持幂等。
- 生产 npm 分发侧本身缺少 `tsconfig/tests`，baseline 与 patched 共享这一限制，所以这里不把分发目录的缺口当成回归点；验收以 node check 和 8 tests 为准。
-
-## 用户实测补充
-
- 普通文本两项为 PASS。
- quoted pure text 为 FAIL，日志证据包含 `ref_msg.message_item.type=0/NONE`、quoted id、`implicit_image_message`、`referenced_image_unresolved`。
- 这组证据说明 quoted pure text 没有被当成真正的图片 follow-up，且没有越过引用确认边界。
-
-## 回滚与备份
-
- 回滚按最新备份执行，基线指向 `/data/aios-gitops/runtime/latest-backup-dir.txt` 所示的最新备份目录。
- 备份路径链路按供给证据记录为 `T064506Z`、`T074212Z`、`T081658Z`。
- 第一轮恢复后的部署过程哈希记录为 `e9625d12` 和 `c00c58f8`。
- v2 部署备份为 `/var/backups/aios/weixin-text-cache-isolation-20260711T094908Z`。
- v2 部署文件哈希为 TS `024c6498284d1871b048f6157d5d3dbd4d34e54b53a05afd744b00458ceeb79f`、JS `d73b15d6752056192a1d1939b04107334419785b41175b39f1cbc1132ac65c47`；slash/channel 口径保持不变。
- 首次部署因为 `-- No entries --` 门禁误判而回滚，随后纠正部署在线，PID 为 `2496603`。
- 在线修复后的 hashes 为 `86dfe...` / `a9b854...`，`channel 4` accounts healthy，cache unchanged。
-
-## 主线合并与生产发布
-
- 主线 fast-forward source rev 为 `9269e819972c2e709e0c27bed7eab590da6961c9`，本次不 tag、不 baseline。
- 生产发布结论为 PASS，release dir 为 `/var/backups/aios/weixin-mainline-release-20260711T181842Z`。
- old PID 为 `2655072`，new PID 为 `2656106`。
- TS hash 为 `86dfe4543c4414bc86778a4b218c244a742a139c66e3c9f19cf6f0de871234c3`，JS hash 为 `a9b854015108020458ce6f31b9d9187eff82e170c4c214259b0afb9be6a7336f`。
- `18789` 监听，`channel 4` accounts healthy，`error_count=0`，cache unchanged。
- 一次参数门禁失败已回滚，且不影响最终发布。
- owner quoted-text live acceptance 仍为 PENDING。
-
-## 运行态验证
-
- 第一轮 gateway PID 由 `4025932` 变为 `1723576`；v2 部署后由 `1723576` 变为 `1876713`。
- v2 现场/供给证据为 `active`、监听 `18789`、`error_count=0`、`channel gate pass`、`cache preserved`。
- 最终 read-only gate 通过，说明部署后运行态未出现新的插件错误，channel 状态和缓存均保持预期。
- quoted pure text 的第二次 owner live acceptance 仍为 PENDING。
-
-## 未完成的真实验收
-
- owner 纯文本
- diagnostic text
- genuine image-followup message
- quoted pure text 的第二次 owner live acceptance
-
-以上四类消息仍需要由 owner 真实 inbound 到达，才能把这次“文本隔离”结论升格为完整的线上接受；本报告明确保留该项为 pending，不把它们写成已经完成。
-
-## 引用文字语义修复与发布（2026-07-12）
-
- 后续 owner 实测证明图片误路由已消失，但模型在没有被引正文时根据 `chat_id/message_id/timestamp` 编造解释，因此图片隔离 PASS、语义验收 FAIL。
- 现场 payload 的 `ref_msg.message_item.type=0/NONE` 只有 quoted ID 与时间字段，没有 `text_item`；session transcript 又没有原始 Weixin 数字 message ID，不能精确回表。
- 出站 `clientId` 与引用的 19 位数字 `msg_id` 格式不同，发送 API 也不返回服务端 message ID。本次明确禁止 recent-message、时间窗口、session 顺序和近似 ID 猜测。
- `1136b4186d7578cd77f255297204b10152c47dab` 增加证据优先处理：payload 明确含 `text_item.text` 时才构造引用上下文；引用存在但正文缺失时，经标准 dispatcher 确定性回复“无法读取被引用文字，请复制原文后再提问。”，并在模型 dispatch 前返回。
- TDD 先出现两项预期 RED（quoted-text resolver 不存在），最终 GREEN 为 `17 passed`；`py_compile`、`git diff --check`、`node --check` 均通过。
- Scratch 双跑验证只改变 `src/messaging/process-message.ts` 与 `dist/src/messaging/process-message.js`，第二次应用 diff 为 0；slash/channel 文件保持不变。
- 主线为 `1136b4186d7578cd77f255297204b10152c47dab`，生产发布目录为 `/var/backups/aios/weixin-quoted-text-failclosed-release-20260712T054451Z`。
- 发布后 PID 从 `2656106` 变为 `3670157`；TS hash 为 `1a73e735e9c8fb40a1f82d2a66bc022396c8105ed989aac95e11b66326e9fdf1`，JS hash 为 `1c76bf6ec3b45021e68b932cbf52222ba2130a867b95e41d7a91f261b991a304`。
- `18789`、4 个 Weixin accounts、post-start error 0 和图片 cache unchanged 均通过。新的 owner live acceptance 仍为 PENDING。
-
-## Owner 引用文字 Fail-Closed 验收（2026-07-12）
-
- Owner 引用一条微信未提供正文的文字消息并发送“是什么意思”，收到固定回复“无法读取被引用文字，请复制原文后再提问。”。
- 日志窗口为 `2026-07-12 14:06:23.424-14:06:23.893 +08:00`：入站 `types=1`、`bodyLen=6`、`hasMedia=false`，出站 `textLen=20` 且发送成功。
- 同一窗口 `model-fetch=0`、`implicit_image_message=0`、Hermes route=0，`quoted_text_unavailable=1` 且 `quoted_message_id=present`。
- 该证据确认无正文引用不会进入模型猜测或图片缓存路径。Owner quoted-text no-body live acceptance 为 **PASS**。
- 微信 payload 明确携带 `text_item.text` 时的 grounded explanation 和 genuine image follow-up 仍作为独立兼容性验收项保留。
-
-## 可见引用摘要解析修复（2026-07-12）
-
- Owner 进一步确认微信客户端能够显示被引用正文，因此上一节的“未提供正文”只适用于旧 resolver 的观察结果，不代表协议 payload 没有可用文本。
- 根因是插件 `inbound.ts` 已将协议字段 `ref_msg.title` 定义为引用摘要并拼入 `ctx.Body`，而 `extractHermesReferencedText()` 只读取 `ref_msg.message_item.text_item.text`，导致客户端可见摘要被错误丢弃。
- `13c2a182860131abcad0f5a70ae8263477578588` 在真实 `text_item.text` 缺失时，仅从 reference envelope 读取 `ref_msg.title`；不会读取 `message_item.title` 或任意嵌套通用 `title`，也不改变图片、slash 或 channel 路由。
- TDD 先得到 `18 passed / 1 failed`，失败项为可见 `ref_msg.title` 仍落到 `quoted_text_unavailable`；修复后为 `19 passed`，`py_compile`、`node --check` 与 `git diff --check` 通过。
- 生产发布目录为 `/var/backups/aios/weixin-quoted-text-title-resolution-20260712T155112+0800`，PID 从 `3859376` 变为 `3860863`，post-start error 为 0，图片 cache unchanged。
- 部署后 TS hash 为 `8e77ce61214688a2507b07f0cf1ee85401b58198b8271bebd69efc2681872726`，JS hash 为 `663db8d30a5cd5eb80fe46cf941cce6e6f5d04cb7e4b8d9b4d0086d87faba290`。
- 可见正文引用的 owner live acceptance 尚待下一条真实微信消息确认；预期日志必须命中 `quoted_text_resolved`，且同一窗口不得出现 `quoted_text_unavailable` 或图片路由。
-
-## 安全说明
-
- 本次仅更新本报告，没有修改代码、runtime、services 或 secrets。
- 报告里没有任何凭据、密钥或原始敏感 ID。
@@ -1,56 +0,0 @@
-# V2R1C1 中央 Baseline 治理收口
-
-## 收口范围
-
-本次变更只登记已经完成生产验证并上线的 `V2R1C1`。它新增中央版本 Manifest、把中央 Baseline Pointer 从 `V1R4C6` 切换为 `V2R1C1`，并建立 Release、Companion、Artifact 与最终生产 Evidence 的追溯关系。
-
-本次不修改产品实现，不移动或重建 `V2R1C1` Tag，不改变 Release OID，不重新部署生产，不切换生产流量，也不重写历史证据。
-
-## 权威标识
-
- Release：`release/AIOS-V2R1C1-20260721`
- Release OID：`4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`
- Tag / Tag OID：`V2R1C1` / `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`
- SemVer：`2.1.0-rc.1`
- OpenClaw Companion：`2.1.0-rc.4`
- Companion Source OID：`83f8f878c7da5dd8263f2af2efa80750492e5cb3`
- Companion OID：`12d1c13170e0c5a691d67a9408e739e7a17064a3`
- Artifact SHA256：`aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`
- Contract：`aios.openclaw.command.v2` / `Ed25519`
- Evidence Root：`/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`
- Final Audit Manifest SHA256：`2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`
- Production Status：`PRODUCTION_DEPLOYED`
-
-## 治理路径
-
- Governance Branch：`patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`
- Base Ref：`refs/heads/main`
- Base OID：`3cf9958cb94614449e093639cbf902216d73447f`
- Manifest Commit：`a56caf46f6bc335ec2395b674ead4b2a427c5edd`
- Baseline Commit：`6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`
- Reviewer：`gpt-5.3-codex-spark validator and docs_reporter`
- Review：`PASS`（`2026-07-21T14:23:00Z`）
-
-## 命令与退出码
-
-| 阶段 | 命令 | 开始 UTC | 结束 UTC | Exit Code |
-| --- | --- | --- | --- | ---: |
-| 中央只读核对 | `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
-| 创建治理分支 | `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
-| 核心元数据验证 | `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
-
-完整机读记录位于 `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`，治理运行证据位于 `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`。
-
-## 元数据回滚
-
-若中央 Registry 解析或治理服务异常，保留 `versions/V2R1C1.json`，通过新的受审治理提交把 `baseline/current.json` 和 `VERSION` 临时恢复到 `V1R4C6`。该操作不得回滚生产系统、移动 Tag、修改 Release OID 或重写历史。
-
-## 范围证明
-
-```text
-product_code_changed=false
-tag_changed=false
-production_redeployed=false
-production_traffic_changed=false
-secret_material_recorded=false
-```
@@ -1,35 +0,0 @@
-# V2R1C2 Production Release
-
- Release Run ID: `AIOS-V2R1C2-PRODUCTION-20260722T011836Z`
- Previous production baseline: `V2R1C1`
- Tag: `V2R1C2`
- Tag object: `a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36`
- Approved target: `3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24`
- Evidence closure: `8cdca463aff9707edee00e20a3b56884130f6978`
- Initial registry status: `TAG_CREATED_NOT_PROMOTED`
- Final status: `PRODUCTION_DEPLOYED`
- Production service: `aios-v2r1c2-production.service`
- Production port: `18920`
- Production acceptance SHA256: `a6c35e12cab7907ab6bcfd37d781b3d216f05a5ae002aa54a3112c70f43b991a`
- Production online smoke SHA256: `fe9c6964e440f8871f2eb225f0132f70c634923389f7b8dfa85f615b100980a4`
- Production health SHA256: `ee8084e8b57d188dc0039a276f4f3f1ed7025ff58ce91b111cc765627eb52d4c`
- Live evidence directory: `/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z`
- Evidence hash index: `/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z/production-evidence.sha256`
-
-## Production gates
-
-Promotion may proceed only when the 18921 candidate remains healthy, the committed evidence checksum file verifies without drift, the 18920 baseline is healthy, required secret references are available without exposing secret values, and the V2R1C1 rollback service/configuration remains intact.
-
-The obsolete release-plan `DECLARED` rows are not authoritative for this run. The production gate must explicitly select `AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER-20260722` and require its three required stages to be `SUCCEEDED`; an unqualified aggregate across stale plan rows fails closed.
-
-## Synthetic WeChat scope
-
-WeChat-facing acceptance for this release used synthetic/mock receipts and transcripts only. It did not impersonate a real user and does not claim a real-user WeChat session. The relevant committed evidence entries are `wechat_simulated_receipts` and `wechat_simulated_transcript`; the production online smoke also records `simulation: true` and `real_user_impersonated: false`.
-
-## Rollback rule
-
-If Health, API, UI, Role Matrix, Tenant Isolation, Runtime, or Audit verification fails after the 18920 switch, stop the V2R1C2 production unit and restart the preserved V2R1C1 18920 service. Do not delete or rewrite either release tag or rollback asset.
-
-## Result
-
-The production switch completed at `2026-07-22T01:40:51Z`. Full acceptance and the production online smoke passed, including Health, API, UI, Role Matrix, Tenant Isolation, Runtime, Audit and the selected takeover release gate. The previous `aios-orchestrator-gateway.service` unit, configuration and Release Run backup remain available for rollback.
@@ -1,67 +0,0 @@
-# Weixin Quoted Text Fail-Closed Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Resolve explicit quoted text safely and fail closed without a model call when Weixin omits the quoted body.
-
-**Architecture:** Add pure JS/TS reference-text helpers and one process hook guard to the existing patcher. Keep the patch surface limited to generated `process-message.ts/js`; do not introduce a persistent cache or modify send/monitor/API modules.
-
-**Tech Stack:** Python patch generator, TypeScript/JavaScript, Node test harness, pytest.
-
-## Global Constraints
-
- Sub-agents use `gpt-5.3-codex-spark`.
- No force push, tag, baseline promotion, credential persistence, recent-message fallback, or approximate text matching.
- Existing confirmed image and ordinary text behavior must remain unchanged.
-
---
-
-### Task 1: Add Quoted Text Resolver With TDD
-
-**Files:**
- Modify: `tests/test_weixin_image_followup_intent.py`
- Modify: `fixes/patch_openclaw_weixin_hermes.py`
-
-**Interfaces:**
- Produces: `extractHermesReferencedText(items)` and `resolveHermesQuotedTextContext(items, currentText)` in TS and JS helper templates.
-
- [ ] Add a Node-backed failing test with `ref_msg.message_item.type=1` and explicit `text_item.text="被引用的正文"`; assert `reason="quoted_text_resolved"`, `handled=false`, and a prompt containing only delimited quoted/current text.
- [ ] Add a Node-backed failing test with `type=0`, quoted ID, no text, and no confirmed image; assert `reason="quoted_text_unavailable"`, `handled=true`, and exact deterministic `replyText`.
- [ ] Run `pytest -q tests/test_weixin_image_followup_intent.py -k 'quoted_text'` and record expected RED because the resolver is absent.
- [ ] Implement the smallest recursive explicit-text extractor. Accept only known referenced text fields; cap each extracted string at 4000 characters and reject blank values.
- [ ] Implement the resolver in both TS and JS templates. Do not read session history, image latest cache, timestamps, or metadata values.
- [ ] Re-run the focused tests and record GREEN.
- [ ] Commit with `fix(weixin): fail closed on unavailable quoted text`.
-
-### Task 2: Guard The Real Process Hook
-
-**Files:**
- Modify: `tests/test_weixin_image_followup_intent.py`
- Modify: `fixes/patch_openclaw_weixin_hermes.py`
-
-**Interfaces:**
- Consumes: `resolveHermesQuotedTextContext(items, currentText)`.
- Produces: process hook behavior that replies deterministically or replaces only the ordinary text prompt.
-
- [ ] Add a failing JS hook test that stubs the ordinary model dispatch and reply function. For type 0 without text, assert reply called once and model called zero times.
- [ ] Add a failing JS hook test for explicit quoted text. Assert model called once with delimited context and no message metadata.
- [ ] Add regression assertions for plain text, current image, and exact quoted image.
- [ ] Run focused tests and record RED for the missing guard.
- [ ] Insert the resolver after reference/image evidence extraction and before ordinary model dispatch. Confirmed image references must bypass the text fail-closed branch.
- [ ] Emit structured reason-only diagnostics without message bodies.
- [ ] Run focused tests and record GREEN.
- [ ] Commit with `fix(weixin): guard quoted text model dispatch`.
-
-### Task 3: Idempotence, Review, And Release
-
-**Files:**
- Modify: `docs/incidents/WEIXIN_TEXT_IMAGE_CACHE_ISOLATION_20260711.md`
-
- [ ] Run `pytest -q tests/test_weixin_image_followup_intent.py` and require all tests pass.
- [ ] Run `python3 -m py_compile fixes/patch_openclaw_weixin_hermes.py tests/test_weixin_image_followup_intent.py`.
- [ ] Run `git diff --check`.
- [ ] Apply `--process-only` twice to a scratch production-plugin copy and require identical second-run hashes; require slash/channel files unchanged.
- [ ] Obtain independent spec and code review.
- [ ] Update the incident document with RED/GREEN evidence, main revision, production hashes, rollback directory, and owner live acceptance state.
- [ ] Merge by non-force fast-forward from a clean main-based branch, deploy only the two generated process-message files, restart only `openclaw-gateway.service`, and verify service, port 18789, four accounts, zero post-start errors, and unchanged image cache.
- [ ] Owner live acceptance: quote a type 0 text message and verify deterministic no-body response; quote a payload that includes explicit text and verify grounded explanation.
@@ -1,45 +0,0 @@
-# Weixin Quoted Text Fail-Closed Design
-
-## Goal
-
-Prevent quoted-text questions from being answered with invented message metadata when Weixin does not provide the quoted body. Preserve normal text and confirmed image behavior.
-
-## Evidence
-
- A quoted text event can arrive as `ref_msg.message_item.type=0` with only `msg_id` and timestamps.
- Session transcripts retain text but not the original Weixin numeric message ID.
- Outbound `clientId` values are not the same format as quoted numeric `msg_id` values, and the send API does not expose a server message ID.
- Therefore recent-message, timestamp, session, and outbound-client-ID matching are not exact evidence and must not be used.
-
-## Decision
-
-Use an evidence-only resolver in `process-message`:
-
-1. If reference payload contains an explicit text item, extract that text and build a bounded quoted-text context for the ordinary text model path.
-2. If reference context exists but has no explicit text and is not a confirmed image, return a deterministic response: `无法读取被引用文字，请复制原文后再提问。`
-3. The unresolved branch is handled before ordinary model dispatch and before Hermes image dispatch.
-4. Do not infer quoted text from metadata, recent messages, session order, timestamps, or approximate IDs.
-
-No persistent text cache is introduced in this change. Outbound ID aliasing remains a separate observation task because an exact mapping has not been proved.
-
-## Interfaces
-
- `extractHermesReferencedText(items): string` returns only explicit referenced text, otherwise an empty string.
- `resolveHermesQuotedTextContext(items, currentText)` returns one of:
-  - `{ referenced: false, handled: false, prompt: currentText, reason: "none" }`
-  - `{ referenced: true, handled: false, prompt, reason: "quoted_text_resolved" }`
-  - `{ referenced: true, handled: true, replyText: "无法读取被引用文字，请复制原文后再提问。", reason: "quoted_text_unavailable" }`
- Confirmed referenced images bypass this text resolver and keep the existing exact image path.
-
-## Privacy And Logging
-
- Do not log quoted or current text.
- Log only `reason`, account ID, a one-way bounded hash of quoted ID when available, and boolean evidence flags.
- Do not persist tokens, credentials, full payloads, or message text.
-
-## Acceptance
-
- Explicit quoted text is supplied to the ordinary text model with a clear delimiter.
- Type 0 reference without text returns the deterministic Chinese response and does not call the model.
- Plain text, current image, and exact quoted image behavior remain unchanged.
- Generated TS and JS remain byte-idempotent under `--process-only`.
@@ -1,42 +0,0 @@
-# AIOS Task Plane
-
-该模块是与任务发起方、Worker 类型和通知后端解耦的持久化任务控制平面。当前交付仅用于隔离开发与 Shadow 验收；默认 `execution_enabled=false`，不会修改生产、tag、Baseline 或 Registry。
-
-## 架构
-
- `TaskPlaneService`：统一服务边界和 HTTP 路由。
- `TaskPlaneStore`：SQLite WAL、revision/CAS、串行事务、租约、hash-chained journal、evidence 和 durable outbox。
- `WorkerRegistry` / `LeaseManager`：身份绑定、capability、并发额度、心跳、过期探测后恢复。
- `DelegationEngine`：父子 DAG、全局深度、capability/risk/approval/budget 单调约束和幂等重放。
- `PolicyEngine`：默认关闭执行；身份、证据、结果摘要和可插拔签名验签均 fail-closed。
- `WorkerAdapter`：OpenClaw、Codex、Hermes、A2A 和 systemd Worker 的统一契约。默认实现只返回 `SHADOW_VERIFIED`，不执行外部命令。
- `DurableOutboxDispatcher`：Webhook、NATS JetStream、GPT callback、Dashboard 和 WeChat 的回执式通知接口。没有真实回执时始终保留 `NOT_DELIVERED`。
-
-## 状态与恢复
-
-正常路径为 `CREATED → QUEUED/CLAIMED → RUNNING → VERIFYING/COMPLETED`；失败路径使用 `FAILED_RECOVERABLE`、`FAILED_FINAL`、`CANCELLED` 或 `MANUAL_REVIEW_REQUIRED`。每次状态事件都进入同一事务中的 append-only hash chain。
-
-租约过期不会自动重放副作用。控制平面必须先调用 Worker probe，只有明确确认原执行已停止，才可将 claim 标记为 `EXPIRED` 并把任务转为 `FAILED_RECOVERABLE`。结果必须匹配 task、claim、Worker identity、未过期 lease 和 operation digest；重复结果返回冲突。
-
-## 安全模型
-
- task/worker/claim/message ID 使用 allowlist pattern，拒绝 URL 编码差异、路径分隔符和控制字符。
- HTTP body 最大 1 MB，非对象 JSON、异常 Content-Length 和非法参数返回 400/413。
- 内部异常响应不回显路径、payload 或凭据；默认 HTTP access log 不记录原始 request target。
- secret-like 字段在 durable task、event、evidence 和 outbox 写入前脱敏。
- 结果签名存在但没有配置验签器时拒绝；摘要、evidence 或 event 被篡改时验收失败。
- SQLite 文件创建为 0600；新建状态目录使用 0700。
-
-## 验收
-
-```bash
-PYTHONPATH=active-runtime \
-  bash scripts/task-plane/run_task_plane_acceptance.sh
-
-PYTHONPATH=active-runtime \
-  python3 scripts/task-plane/create_shadow_tasks.py \
-    --database reports/task-plane-shadow.sqlite3 \
-    --report reports/task-plane-shadow.json
-```
-
-上述脚本只使用本地 SQLite 和 Shadow adapter，不触发真实 OpenClaw、Codex、Hermes、微信或生产执行。
@@ -1,314 +0,0 @@
-openapi: 3.0.3
-info:
-  title: AIOS Task Plane API
-  version: 1.0.0
-  description: >
-    Durable control-plane APIs for task orchestration with fail-closed policy.
-    Every POST operation requires bearerAuth; read-only GET operations may be
-    exposed according to the surrounding runtime policy.
-servers:
-  - url: /
-paths:
-  /tasks:
-    get:
-      summary: List tasks
-      responses:
-        "200":
-          description: Task list
-    post:
-      security: [ { bearerAuth: [] } ]
-      summary: Create task
-      parameters:
-        - in: header
-          name: Idempotency-Key
-          required: false
-          schema:
-            type: string
-            minLength: 1
-            maxLength: 128
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/TaskPlan"
-      responses:
-        "201": { description: Created }
-        "400": { description: Bad request }
-        "401": { description: Unauthorized }
-        "403": { description: Forbidden }
-        "409": { description: Conflict }
-        "413": { description: Payload too large }
-        "423": { description: Execution or resource locked }
-        "503": { description: Authentication or service unavailable }
-  /tasks/{task_id}:
-    get:
-      summary: Get task
-      parameters:
-        - $ref: "#/components/parameters/TaskId"
-      responses:
-        "200": { description: OK }
-        "404": { description: Not found }
-  /tasks/{task_id}/claim:
-    post:
-      security: [ { bearerAuth: [] } ]
-      summary: Claim a task
-      parameters:
-        - $ref: "#/components/parameters/TaskId"
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/TaskClaimRequest"
-      responses:
-        "200": { description: Claimed }
-        "401": { description: Unauthorized }
-        "403": { description: Forbidden }
-        "404": { description: Not found }
-        "409": { description: Conflict }
-        "423": { description: Execution disabled }
-  /tasks/{task_id}/heartbeat:
-    post:
-      security: [ { bearerAuth: [] } ]
-      summary: Renew task claim lease
-      parameters: [ $ref: "#/components/parameters/TaskId" ]
-      responses:
-        "200": { description: Leased }
-        "400": { description: Bad request }
-        "401": { description: Unauthorized }
-        "403": { description: Forbidden }
-        "404": { description: Task or claim not found }
-        "409": { description: Claim conflict }
-        "413": { description: Payload too large }
-        "423": { description: Lease or execution locked }
-        "503": { description: Service unavailable }
-  /tasks/{task_id}/progress:
-    post:
-      security: [ { bearerAuth: [] } ]
-      summary: Report task progress
-      parameters: [ $ref: "#/components/parameters/TaskId" ]
-      responses:
-        "200": { description: Progress saved }
-        "400": { description: Bad request }
-        "401": { description: Unauthorized }
-        "403": { description: Forbidden }
-        "404": { description: Task or claim not found }
-        "409": { description: Claim conflict }
-        "413": { description: Payload too large }
-        "423": { description: Lease or execution locked }
-        "503": { description: Service unavailable }
-  /tasks/{task_id}/result:
-    post:
-      security: [ { bearerAuth: [] } ]
-      summary: Submit task result
-      parameters: [ $ref: "#/components/parameters/TaskId" ]
-      responses:
-        "200": { description: Result accepted }
-        "400": { description: Bad request }
-        "401": { description: Unauthorized }
-        "403": { description: Result policy rejected }
-        "404": { description: Task or claim not found }
-        "409": { description: Duplicate or mismatched result }
-        "413": { description: Payload too large }
-        "423": { description: Lease or execution locked }
-        "503": { description: Verification service unavailable }
-  /tasks/{task_id}/fail:
-    post:
-      security: [ { bearerAuth: [] } ]
-      summary: Mark task failed
-      parameters: [ $ref: "#/components/parameters/TaskId" ]
-      responses:
-        "200": { description: Failure recorded }
-        "400": { description: Bad request }
-        "401": { description: Unauthorized }
-        "403": { description: Forbidden }
-        "404": { description: Task or claim not found }
-        "409": { description: Claim conflict }
-        "413": { description: Payload too large }
-        "423": { description: Lease or execution locked }
-        "503": { description: Service unavailable }
-  /tasks/{task_id}/cancel:
-    post:
-      security: [ { bearerAuth: [] } ]
-      summary: Cancel task
-      parameters: [ $ref: "#/components/parameters/TaskId" ]
-      responses:
-        "200": { description: Cancelled }
-        "400": { description: Bad request }
-        "401": { description: Unauthorized }
-        "403": { description: Forbidden }
-        "404": { description: Task not found }
-        "409": { description: Revision or state conflict }
-        "413": { description: Payload too large }
-        "423": { description: Resource locked }
-        "503": { description: Service unavailable }
-  /tasks/{task_id}/delegate:
-    post:
-      security: [ { bearerAuth: [] } ]
-      summary: Delegate task
-      parameters: [ $ref: "#/components/parameters/TaskId" ]
-      responses:
-        "200": { description: Delegated }
-        "400": { description: Bad request }
-        "401": { description: Unauthorized }
-        "403": { description: Forbidden }
-        "404": { description: Parent task not found }
-        "409": { description: Conflict }
-        "413": { description: Payload too large }
-        "423": { description: Execution locked }
-        "503": { description: Service unavailable }
-  /workers/register:
-    post:
-      security: [ { bearerAuth: [] } ]
-      summary: Register worker
-      responses:
-        "201": { description: Worker registered }
-        "400": { description: Bad request }
-        "401": { description: Unauthorized }
-        "403": { description: Worker identity mismatch }
-        "409": { description: Registration conflict }
-        "413": { description: Payload too large }
-        "423": { description: Resource locked }
-        "503": { description: Service unavailable }
-  /workers/{worker_id}/heartbeat:
-    post:
-      security: [ { bearerAuth: [] } ]
-      summary: Worker heartbeat
-      parameters: [ $ref: "#/components/parameters/WorkerId" ]
-      responses:
-        "200": { description: Heartbeat accepted }
-        "400": { description: Bad request }
-        "401": { description: Unauthorized }
-        "403": { description: Forbidden }
-        "404": { description: Worker not found }
-        "409": { description: Worker state conflict }
-        "413": { description: Payload too large }
-        "423": { description: Worker locked }
-        "503": { description: Service unavailable }
-  /workers:
-    get:
-      summary: List workers
-      responses:
-        "200": { description: Worker list }
-  /workers/{worker_id}:
-    get:
-      summary: Get worker
-      parameters: [ $ref: "#/components/parameters/WorkerId" ]
-      responses:
-        "200": { description: Worker details }
-  /tasks/{task_id}/events:
-    get:
-      summary: Task events
-      parameters: [ $ref: "#/components/parameters/TaskId" ]
-      responses:
-        "200": { description: Event list }
-  /tasks/{task_id}/evidence:
-    get:
-      summary: Task evidence
-      parameters: [ $ref: "#/components/parameters/TaskId" ]
-      responses:
-        "200": { description: Evidence list }
-  /tasks/{task_id}/children:
-    get:
-      summary: Task child tasks
-      parameters: [ $ref: "#/components/parameters/TaskId" ]
-      responses:
-        "200": { description: Child list }
-components:
-  securitySchemes:
-    bearerAuth:
-      type: http
-      scheme: bearer
-      bearerFormat: opaque
-  parameters:
-    TaskId:
-      name: task_id
-      in: path
-      required: true
-      schema:
-        type: string
-        minLength: 1
-        maxLength: 128
-        pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
-    WorkerId:
-      name: worker_id
-      in: path
-      required: true
-      schema:
-        type: string
-        minLength: 1
-        maxLength: 128
-        pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
-  schemas:
-    TaskPlan:
-      type: object
-      additionalProperties: false
-      properties:
-        schema_version: { type: integer, enum: [1] }
-        task_id:
-          type: string
-          minLength: 1
-          maxLength: 128
-          pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
-        task_type:
-          type: string
-          minLength: 1
-          maxLength: 128
-          pattern: '^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$'
-        issuer: { type: object }
-        intent: { type: string, maxLength: 16384 }
-        required_capabilities:
-          type: array
-          maxItems: 128
-          items: { type: string }
-        preferred_workers:
-          type: array
-          maxItems: 64
-          items: { type: string }
-        risk: { type: string, enum: [low, medium, high] }
-        approval_policy:
-          type: string
-          maxLength: 128
-        dependencies:
-          type: array
-          maxItems: 128
-          items: { type: string }
-        max_delegation_depth: { type: integer, minimum: 0, maximum: 32 }
-        budgets:
-          type: object
-          additionalProperties: false
-          properties:
-            time_seconds: { type: integer, minimum: 0 }
-            attempts: { type: integer, minimum: 0 }
-            tokens: { type: integer, minimum: 0 }
-            cost: { type: number, minimum: 0 }
-        evidence_requirements:
-          type: array
-          maxItems: 128
-          items: { type: string }
-        parent_task_id:
-          type: string
-          maxLength: 128
-        correlation_id:
-          type: string
-          maxLength: 128
-        metadata:
-          type: object
-    TaskClaimRequest:
-      type: object
-      additionalProperties: false
-      required: [worker_id, actor_identity]
-      properties:
-        worker_id:
-          type: string
-          maxLength: 128
-          pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
-        lease_seconds:
-          type: integer
-          minimum: 1
-          maximum: 3600
-        actor_identity:
-          type: string
-          minLength: 1
-          maxLength: 512
@@ -1,112 +0,0 @@
-from __future__ import annotations
-
-import argparse
-import json
-from pathlib import Path
-
-
-TS_HELPER = '''// AIOS Weixin lossless getUpdates JSON begin
-const WEIXIN_EXACT_ID_FIELDS = new Set(["message_id", "msg_id", "root_id", "parent_id", "server_msg_id", "new_msg_id"]);
-function parseWeixinGetUpdatesJson(rawText: string): GetUpdatesResp {
-  return JSON.parse(rawText, (key: string, value: unknown, context?: { source?: string }) => {
-    if (!WEIXIN_EXACT_ID_FIELDS.has(key) || value == null || typeof value === "string") return value;
-    if (typeof value !== "number") throw new Error(`invalid ${key} type in getUpdates response`);
-    const source = context?.source;
-    if (!source || !/^(?:0|[1-9]\\d*)$/.test(source)) throw new Error(`unsafe numeric ${key} in getUpdates response`);
-    return source;
-  }) as GetUpdatesResp;
-}
-// AIOS Weixin lossless getUpdates JSON end'''
-
-JS_HELPER = '''// AIOS Weixin lossless getUpdates JSON begin
-const WEIXIN_EXACT_ID_FIELDS = new Set(["message_id", "msg_id", "root_id", "parent_id", "server_msg_id", "new_msg_id"]);
-function parseWeixinGetUpdatesJson(rawText) {
-    return JSON.parse(rawText, (key, value, context) => {
-        if (!WEIXIN_EXACT_ID_FIELDS.has(key) || value == null || typeof value === "string")
-            return value;
-        if (typeof value !== "number")
-            throw new Error(`invalid ${key} type in getUpdates response`);
-        const source = context?.source;
-        if (!source || !/^(?:0|[1-9]\\d*)$/.test(source))
-            throw new Error(`unsafe numeric ${key} in getUpdates response`);
-        return source;
-    });
-}
-// AIOS Weixin lossless getUpdates JSON end'''
-
-
-def insert_once(text: str, marker: str, addition: str) -> str:
-    if addition in text:
-        return text
-    if marker not in text:
-        raise RuntimeError(f'marker not found: {marker}')
-    return text.replace(marker, marker + '\n' + addition, 1)
-
-
-def patch_api_ts(text: str) -> str:
-    text = insert_once(text, 'import { redactBody, redactUrl } from "../util/redact.js";', '\n' + TS_HELPER)
-    old = 'const resp: GetUpdatesResp = JSON.parse(rawText);'
-    new = 'const resp: GetUpdatesResp = parseWeixinGetUpdatesJson(rawText);'
-    if new not in text:
-        if old not in text:
-            raise RuntimeError('TypeScript getUpdates parser marker not found')
-        text = text.replace(old, new, 1)
-    return text
-
-
-def patch_api_js(text: str) -> str:
-    text = insert_once(text, 'import { redactBody, redactUrl } from "../util/redact.js";', '\n' + JS_HELPER)
-    old = 'const resp = JSON.parse(rawText);'
-    new = 'const resp = parseWeixinGetUpdatesJson(rawText);'
-    if new not in text:
-        if old not in text:
-            raise RuntimeError('JavaScript getUpdates parser marker not found')
-        text = text.replace(old, new, 1)
-    return text
-
-
-def patch_types_ts(text: str) -> str:
-    new = 'message_id?: string | number;'
-    if new in text:
-        return text
-    old = 'message_id?: number;'
-    if old not in text:
-        raise RuntimeError('message_id type marker not found')
-    return text.replace(old, new, 1)
-
-
-def write_if_changed(path: Path, content: str) -> bool:
-    original = path.read_text(encoding='utf-8')
-    if original == content:
-        return False
-    path.write_text(content, encoding='utf-8')
-    return True
-
-
-def apply(plugin_root: Path) -> dict[str, bool]:
-    paths = {
-        'src/api/api.ts': patch_api_ts,
-        'dist/src/api/api.js': patch_api_js,
-        'src/api/types.ts': patch_types_ts,
-    }
-    changed: dict[str, bool] = {}
-    for relative, transform in paths.items():
-        path = plugin_root / relative
-        if not path.exists():
-            raise RuntimeError(f'missing plugin file: {path}')
-        original = path.read_text(encoding='utf-8')
-        changed[relative] = write_if_changed(path, transform(original))
-    return changed
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument('plugin_root', type=Path)
-    args = parser.parse_args()
-    changed = apply(args.plugin_root.resolve())
-    print(json.dumps({'plugin_root': str(args.plugin_root.resolve()), 'changed': changed}, ensure_ascii=False))
-    return 0
-
-
-if __name__ == '__main__':
-    raise SystemExit(main())
@@ -1,156 +0,0 @@
-from __future__ import annotations
-
-import argparse
-import json
-from pathlib import Path
-
-
-def replace_required(text: str, old: str, new: str, label: str) -> str:
-    if new in text:
-        return text
-    if old not in text:
-        raise RuntimeError(f'{label} marker not found')
-    return text.replace(old, new, 1)
-
-
-def patch_send_ts(text: str) -> str:
-    text = replace_required(
-        text,
-        '}): Promise<{ messageId: string }> {\n  const { to, text, opts } = params;\n',
-        '}): Promise<{ messageId: string; createTimeMs: number }> {\n  const { to, text, opts } = params;\n',
-        'TS send return type',
-    )
-    text = replace_required(
-        text,
-        '  const clientId = generateClientId();\n  const req = buildSendMessageReq({',
-        '  const clientId = generateClientId();\n  const createTimeMs = Date.now();\n  const req = buildSendMessageReq({',
-        'TS create time',
-    )
-    text = replace_required(
-        text,
-        '  });\n  try {\n    await sendMessageApi({',
-        '  });\n  if (!req.msg?.item_list?.[0]) throw new Error("sendMessageWeixin: text item missing");\n  req.msg.item_list[0].create_time_ms = createTimeMs;\n  try {\n    await sendMessageApi({',
-        'TS request timestamp',
-    )
-    text = replace_required(
-        text,
-        '  return { messageId: clientId };\n}\n\n/** Send a single structured MessageItem downstream. */',
-        '  return { messageId: clientId, createTimeMs };\n}\n\n/** Send a single structured MessageItem downstream. */',
-        'TS send result',
-    )
-    return text
-
-
-def patch_send_js(text: str) -> str:
-    text = replace_required(
-        text,
-        '    const clientId = generateClientId();\n    const req = buildSendMessageReq({',
-        '    const clientId = generateClientId();\n    const createTimeMs = Date.now();\n    const req = buildSendMessageReq({',
-        'JS create time',
-    )
-    text = replace_required(
-        text,
-        '    });\n    try {\n        await sendMessageApi({',
-        '    });\n    if (!req.msg?.item_list?.[0])\n        throw new Error("sendMessageWeixin: text item missing");\n    req.msg.item_list[0].create_time_ms = createTimeMs;\n    try {\n        await sendMessageApi({',
-        'JS request timestamp',
-    )
-    text = replace_required(
-        text,
-        '    return { messageId: clientId };\n}\n/** Send a single structured MessageItem downstream. */',
-        '    return { messageId: clientId, createTimeMs };\n}\n/** Send a single structured MessageItem downstream. */',
-        'JS send result',
-    )
-    return text
-
-
-def patch_process_ts(text: str) -> str:
-    old = '''await sendMessageWeixin({ to: ctx.To, text, opts: {
-                baseUrl: deps.baseUrl,
-                token: deps.token,
-                contextToken,
-                runId,
-              }});'''
-    new = '''const sentText = await sendMessageWeixin({ to: ctx.To, text, opts: {
-                baseUrl: deps.baseUrl,
-                token: deps.token,
-                contextToken,
-                runId,
-              }});
-              rememberHermesOutboundTextMessage(deps.accountId, ctx.To, text, sentText.createTimeMs);'''
-    text = replace_required(text, old, new, 'TS fallback text send')
-    old = '''await sendMessageWeixin({ to: ctx.To, text, opts: {
-              baseUrl: deps.baseUrl,
-              token: deps.token,
-              contextToken,
-              runId,
-            }});'''
-    new = '''const sentText = await sendMessageWeixin({ to: ctx.To, text, opts: {
-              baseUrl: deps.baseUrl,
-              token: deps.token,
-              contextToken,
-              runId,
-            }});
-            rememberHermesOutboundTextMessage(deps.accountId, ctx.To, text, sentText.createTimeMs);'''
-    return replace_required(text, old, new, 'TS normal text send')
-
-
-def patch_process_js(text: str) -> str:
-    old = '''await sendMessageWeixin({ to: ctx.To, text, opts: {
-                                baseUrl: deps.baseUrl,
-                                token: deps.token,
-                                contextToken,
-                                runId,
-                            } });'''
-    new = '''const sentText = await sendMessageWeixin({ to: ctx.To, text, opts: {
-                                baseUrl: deps.baseUrl,
-                                token: deps.token,
-                                contextToken,
-                                runId,
-                            } });
-                        rememberHermesOutboundTextMessage(deps.accountId, ctx.To, text, sentText.createTimeMs);'''
-    text = replace_required(text, old, new, 'JS fallback text send')
-    old = '''await sendMessageWeixin({ to: ctx.To, text, opts: {
-                            baseUrl: deps.baseUrl,
-                            token: deps.token,
-                            contextToken,
-                            runId,
-                        } });'''
-    new = '''const sentText = await sendMessageWeixin({ to: ctx.To, text, opts: {
-                            baseUrl: deps.baseUrl,
-                            token: deps.token,
-                            contextToken,
-                            runId,
-                        } });
-                    rememberHermesOutboundTextMessage(deps.accountId, ctx.To, text, sentText.createTimeMs);'''
-    return replace_required(text, old, new, 'JS normal text send')
-
-
-def apply(root: Path) -> dict[str, bool]:
-    transforms = {
-        'src/messaging/send.ts': patch_send_ts,
-        'dist/src/messaging/send.js': patch_send_js,
-        'src/messaging/process-message.ts': patch_process_ts,
-        'dist/src/messaging/process-message.js': patch_process_js,
-    }
-    changed = {}
-    for relative, transform in transforms.items():
-        path = root / relative
-        original = path.read_text(encoding='utf-8')
-        updated = transform(original)
-        changed[relative] = updated != original
-        if updated != original:
-            path.write_text(updated, encoding='utf-8')
-    return changed
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument('plugin_root', type=Path)
-    args = parser.parse_args()
-    root = args.plugin_root.resolve()
-    print(json.dumps({'plugin_root': str(root), 'changed': apply(root)}, ensure_ascii=False))
-    return 0
-
-
-if __name__ == '__main__':
-    raise SystemExit(main())
@@ -0,0 +1,86 @@
+import {
+  classifyRun,
+  decideToolCall,
+  runKey,
+} from "./policy.js";
+
+const activeRuns = new Map();
+const MAX_RUN_AGE_MS = 60 * 60 * 1000;
+
+function prune(now = Date.now()) {
+  for (const [key, value] of activeRuns.entries()) {
+    if (now - value.recordedAt > MAX_RUN_AGE_MS) activeRuns.delete(key);
+  }
+}
+
+export default {
+  id: "aios-tenant-boundary",
+  name: "AIOS Tenant Boundary",
+  description: "Fail-closed user-origin and side-effect policy for Tenant Cells.",
+
+  register(api) {
+    api.on(
+      "before_agent_run",
+      async (event, ctx) => {
+        prune();
+        const config = event.context?.pluginConfig ?? api.pluginConfig ?? {};
+        const trust = classifyRun(ctx, config);
+        const key = runKey(event, ctx);
+        if (key) {
+          activeRuns.set(key, { ...trust, recordedAt: Date.now() });
+        }
+
+        if (
+          config.blockUnknownAgentRuns === true &&
+          trust.trusted !== true &&
+          trust.reason !== "job_id_present"
+        ) {
+          return {
+            outcome: "block",
+            reason: trust.reason,
+            message: "This message cannot be verified as coming from the active authenticated user.",
+          };
+        }
+        return { outcome: "pass" };
+      },
+      { priority: 100 },
+    );
+
+    api.on(
+      "before_tool_call",
+      async (event, ctx) => {
+        prune();
+        const config = event.context?.pluginConfig ?? api.pluginConfig ?? {};
+        const key = runKey(event, ctx);
+        const trust = key ? activeRuns.get(key) : undefined;
+        const decision = decideToolCall(event.toolName, trust, config);
+
+        if (decision.action === "block") {
+          return {
+            block: true,
+            blockReason: `AIOS V2R1 origin policy denied tool call: ${decision.code}`,
+          };
+        }
+        if (decision.action === "approval") {
+          return {
+            requireApproval: {
+              title: `Approve ${String(event.toolName)}`,
+              description: "Authenticated user requested a side-effecting tool call in this Tenant Cell.",
+              severity: "warning",
+              timeoutMs: Number(config.approvalTimeoutMs ?? 60000),
+              allowedDecisions: ["allow-once", "deny"],
+              pluginId: "aios-tenant-boundary",
+            },
+          };
+        }
+        return undefined;
+      },
+      { priority: 100 },
+    );
+
+    api.on("agent_end", async (event, ctx) => {
+      const key = runKey(event, ctx);
+      if (key) activeRuns.delete(key);
+    });
+  },
+};
@@ -0,0 +1,71 @@
+const DEFAULT_READ_ONLY_TOOLS = Object.freeze([
+  "read", "grep", "glob", "find", "ls", "web_search", "web_fetch",
+  "memory_search", "sessions_list", "sessions_history", "session_status",
+]);
+
+function strings(value) {
+  return Array.isArray(value)
+    ? value.filter((item) => typeof item === "string" && item.trim())
+        .map((item) => item.trim())
+    : [];
+}
+
+export function resolveSenderId(ctx = {}) {
+  const direct = typeof ctx.senderId === "string" ? ctx.senderId.trim() : "";
+  const nested = typeof ctx.channelContext?.sender?.id === "string"
+    ? ctx.channelContext.sender.id.trim()
+    : "";
+  return direct || nested || undefined;
+}
+
+export function classifyRun(ctx = {}, config = {}) {
+  const senderId = resolveSenderId(ctx);
+  const trusted = new Set(strings(config.trustedSenderIds));
+  const blocked = new Set(strings(config.blockedSenderIds));
+
+  if (typeof ctx.jobId === "string" && ctx.jobId) {
+    return { trusted: false, origin: "automation", reason: "job_id_present" };
+  }
+  if (!senderId) {
+    return { trusted: false, origin: "system_or_unknown", reason: "sender_id_missing" };
+  }
+  if (blocked.has(senderId)) {
+    return { trusted: false, origin: "blocked_sender", reason: "sender_blocked", senderId };
+  }
+  if (config.requireExplicitTrustedSenders !== false && !trusted.has(senderId)) {
+    return { trusted: false, origin: "untrusted_sender", reason: "sender_not_allowlisted", senderId };
+  }
+  return {
+    trusted: true,
+    origin: "authenticated_channel_user",
+    reason: "sender_verified",
+    senderId,
+  };
+}
+
+export function decideToolCall(toolName, runTrust, config = {}) {
+  const name = typeof toolName === "string" ? toolName.trim().toLowerCase() : "";
+  const configured = strings(config.readOnlyTools).map((item) => item.toLowerCase());
+  const readOnly = new Set(configured.length ? configured : DEFAULT_READ_ONLY_TOOLS);
+  if (!name) {
+    return { action: "block", code: "tool_name_missing" };
+  }
+  if (readOnly.has(name)) {
+    return { action: "allow", code: "read_only" };
+  }
+  if (!runTrust || runTrust.trusted !== true) {
+    return {
+      action: "block",
+      code: runTrust?.reason || "run_provenance_missing",
+    };
+  }
+  if (config.requireApprovalForHumanSideEffects === false) {
+    return { action: "allow", code: "trusted_side_effect" };
+  }
+  return { action: "approval", code: "human_side_effect" };
+}
+
+export function runKey(event = {}, ctx = {}) {
+  const key = event.runId || ctx.runId;
+  return typeof key === "string" && key.trim() ? key.trim() : undefined;
+}
@@ -0,0 +1,18 @@
+{
+  "id": "aios-tenant-boundary",
+  "name": "AIOS Tenant Boundary",
+  "description": "Enforces AIOS V2R1 tenant provenance and tool policy boundaries.",
+  "version": "2.1.0-rc1",
+  "entry": "dist/index.js",
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "requireExplicitTrustedSenders": { "type": "boolean", "default": true },
+      "trustedSenderIds": { "type": "array", "items": { "type": "string" }, "default": [] },
+      "blockedSenderIds": { "type": "array", "items": { "type": "string" }, "default": [] },
+      "readOnlyTools": { "type": "array", "items": { "type": "string" } },
+      "requireApprovalForHumanSideEffects": { "type": "boolean", "default": true }
+    }
+  }
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
openclaw	ce7aa08249	task(openclaw): B3 integration RESULT 20260714T190300UTC8	2026-07-14 19:03:49 +08:00
openclaw	b4d3e53167	feat(v2r1c0): integrate B3 identity module into full RC1 runtime 20260714T190200UTC8	2026-07-14 19:02:52 +08:00
openclaw	0c5a268548	task(openclaw): create continue integration task 20260714T184637UTC8	2026-07-14 19:00:22 +08:00
openclaw	02682d27a5	task(openclaw): integrate B3 into full V2R1C0 RC1 runtime 20260714T180646UTC8	2026-07-14 18:09:21 +08:00
openclaw	6077331add	test(v2r1): make router isolation contracts authoritative	2026-07-13 02:28:32 +08:00
openclaw	75f61ac0e6	test(v2r1): cover tenant router isolation contracts	2026-07-13 02:18:04 +08:00
openclaw	0b41a3952a	fix-v2r1-suppress-hermes-conflict-context	2026-07-13 02:10:23 +08:00
openclaw	8f205c0d87	test-v2r1-cover-hermes-command-provenance	2026-07-13 02:05:03 +08:00
openclaw	d2a4a765ac	test-v2r1-enforce-sanitized-hermes-replay-conflicts	2026-07-13 02:03:49 +08:00
openclaw	b1110cad62	fix(v2r1): reject noncanonical tenant signatures	2026-07-13 01:52:00 +08:00
openclaw	b483dfadbf	test(v2r1): define Hermes contract acceptance evidence	2026-07-13 01:25:28 +08:00
openclaw	1e5e144318	fix(v2r1): convert duplicate Hermes events to ConflictError	2026-07-13 01:25:23 +08:00
openclaw	d552876a80	release(v2r1): add single source live status page	2026-07-13 00:12:28 +08:00
openclaw	6569065198	ops(v2r1): add RC1 health check	2026-07-12 23:41:01 +08:00
openclaw	2b80c50415	test(v2r1): add RC1 acceptance gate manifest	2026-07-12 23:40:56 +08:00
openclaw	954982647e	fix(v2r1): align plugin package entry with OpenClaw SDK contract	2026-07-12 23:40:52 +08:00
openclaw	8074eb31b1	ops(v2r1): add RC1 install preflight	2026-07-12 23:37:42 +08:00
openclaw	90138221ee	fix(v2r1): add OpenClaw runtime extension package metadata	2026-07-12 23:37:37 +08:00
openclaw	729c7bb23b	fix(v2r1): bind OpenClaw trust only to authoritative runId	2026-07-12 23:37:33 +08:00
openclaw	d2de7f23d1	ops(v2r1): add RC1 validation gate	2026-07-12 23:32:51 +08:00
openclaw	73c0a233ce	feat(v2r1): add aios-cell lifecycle CLI	2026-07-12 23:32:47 +08:00
openclaw	00816a13c1	feat(v2r1): register OpenClaw runtime provenance and tool hooks	2026-07-12 23:32:42 +08:00
openclaw	4920ac6192	release: define AIOS V2R1C0 RC1 manifest	2026-07-12 23:26:05 +08:00
openclaw	b12ff086bf	feat(v2r1): add OpenClaw tenant boundary plugin manifest	2026-07-12 23:26:00 +08:00
openclaw	57a668d87e	feat(v2r1): add OpenClaw tenant boundary policy runtime	2026-07-12 23:25:57 +08:00
openclaw	bab319575b	feat(v2r1): add Tenant Cell manager lifecycle registry	2026-07-12 23:22:54 +08:00
openclaw	c172953a3c	feat(v2r1): add Hermes profile isolation primitives	2026-07-12 23:22:47 +08:00
openclaw	c7617fa548	feat(v2r1): add tenant-scoped memory namespace policy	2026-07-12 23:22:41 +08:00
openclaw	2eba23d274	feat(v2r1): add tenant secret scope references	2026-07-12 23:17:56 +08:00
openclaw	f2e0406a20	feat(v2r1): add append-only tenant audit chain	2026-07-12 23:17:50 +08:00
openclaw	ccb02640ac	feat(v2r1): add tenant-scoped exact message ledger	2026-07-12 23:17:43 +08:00
openclaw	5c52f6c82c	feat(v2r1): add tenant partitioned Hermes fabric scheduler	2026-07-12 23:10:55 +08:00
openclaw	429c6875bc	feat(v2r1): add fail-closed Tenant Router and registry	2026-07-12 23:10:47 +08:00
openclaw	f10d0d5b17	feat(v2r1): add OpenClaw Tenant Cell lifecycle adapter	2026-07-12 23:04:34 +08:00
openclaw	c9974f3e47	feat(v2r1): add signed tenant context and canonical message contract	2026-07-12 23:04:24 +08:00
openclaw	c72450aeb0	docs: add V1R5 to V2R1 migration plan	2026-07-12 22:39:32 +08:00
openclaw	f95be48a42	docs: add AIOS V2R1 architecture baseline	2026-07-12 22:39:28 +08:00
openclaw	ba989d7340	Start AIOS V2R1C0 Tenant Cell and Hermes Shared Agent Fabric release train	2026-07-12 22:39:23 +08:00