Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 openclaw
|
bfd13bbed0 | ||
|
openclaw
|
502ef30642 | ||
|
openclaw
|
b9e1f9db66 | ||
|
openclaw
|
7b82ae11f6 |
@@ -0,0 +1,95 @@
|
||||
status: PASS
|
||||
commit: 7b82ae11f685b77628308ba46b9cfdf5bcdf78d3
|
||||
tests:
|
||||
v2r1: "29 passed, exit code 0"
|
||||
integration: "3 passed, exit code 0"
|
||||
cleanup_scan:
|
||||
status: PASS
|
||||
findings: "No remaining conflict markers, unexplained worktree changes, unapproved temporary/cache/build artifacts, or scanner-detected secrets. Runtime SQLite was removed and its sidecars are ignored with exact root-anchored rules; tracked dist/ZIP artifacts are documented exceptions."
|
||||
risk: MEDIUM
|
||||
recommendation: "Push the controlled work branch, then request independent OpenClaw Gate Review; do not merge or release from this result alone."
|
||||
|
||||
# V2R1 Gate 1 Codex Cleanup Result
|
||||
|
||||
## Scope and Git Baseline
|
||||
|
||||
- Task: `V2R1-G1-CODEX-CLEANUP-20260713`
|
||||
- Branch: `work/v2r1-g1-cleanup-remediation-20260713`
|
||||
- Cleanup implementation commit: `7b82ae11f685b77628308ba46b9cfdf5bcdf78d3`
|
||||
- Integration commit: `a6878d30b8690e55f1bf9819da5aac189dabf89e`
|
||||
- Locked integration result baseline: `d6ba7e8fa859407ec55acf49b5468bba5eac96da`
|
||||
- `git merge-base --is-ancestor a6878d30b8690e55f1bf9819da5aac189dabf89e HEAD`: exit code `0`
|
||||
- `git merge-base --is-ancestor d6ba7e8fa859407ec55acf49b5468bba5eac96da HEAD`: exit code `0`
|
||||
- Tree before this result-only commit: `94146e05f700921b12ef023eb4d8be771bae4047`
|
||||
|
||||
The locked integration artifacts were not modified by cleanup:
|
||||
|
||||
- `tests/integration/test_runtime_ingress_flow.py`: blob `6b6732a4c73bbb7fb5273a05b897adce9da39a9a`
|
||||
- `.agent/results/codex/RESULT-V2R1-202607132000-CODEX.md`: blob `e2d6ce3b037339385831f51cb0db42c86b2ae827`
|
||||
|
||||
## Cleanup Changes Verified
|
||||
|
||||
Commit `7b82ae11f685b77628308ba46b9cfdf5bcdf78d3`:
|
||||
|
||||
- removed the tracked runtime database `data/webops.sqlite3`;
|
||||
- added exact root-anchored ignore rules for `/data/webops.sqlite3`, `/data/webops.sqlite3-wal`, `/data/webops.sqlite3-shm`, and `/data/webops.sqlite3-journal`;
|
||||
- resolved tracked merge-conflict residue in `agents/registry.yaml` and `docs/architecture/AIOS_AGENT_AUDIT_PLANE.md`;
|
||||
- left the locked integration test and prior Codex result blobs unchanged.
|
||||
|
||||
`git grep -n -E '^(<<<<<<<|=======|>>>>>>>)' -- . ':!source-baseline/*.zip'` returned no matches (exit code `1`, the expected no-match result).
|
||||
|
||||
The repository scan found no unapproved `__pycache__`, `*.pyc`, `*.pyo`, `.pytest_cache`, `.mypy_cache`, `.ruff_cache`, `*.tmp`, `*.swp`, backup-suffix, or `.DS_Store` artifacts after verification cleanup. The following tracked artifacts are expected baseline exceptions, not unexplained generated files:
|
||||
|
||||
- `openclaw/plugins/aios-tenant-boundary/dist/` (2 tracked plugin distribution files);
|
||||
- `source-baseline/current_actual_deployment_source.zip`;
|
||||
- `source-baseline/previous_current_actual_deployment_source_from_webops_delta.zip`.
|
||||
|
||||
Before creating this result file, `git status --porcelain=v1 --untracked-files=all` was empty with exit code `0`.
|
||||
|
||||
## Secret Scan
|
||||
|
||||
Scanner: Gitleaks `8.30.1`, official Linux x64 release asset.
|
||||
|
||||
- Asset: `/tmp/gitleaks_8.30.1_linux_x64.tar.gz.codex`
|
||||
- SHA-256: `551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb`
|
||||
- `/tmp/gitleaks-codex-8.30.1/gitleaks git --no-banner --no-color --redact --report-format json --report-path /tmp/v2r1-cleanup-audit-git.json --log-opts=7b82ae11f685b77628308ba46b9cfdf5bcdf78d3 /data/aios-gitops/worktrees/v2r1-g1-cleanup-remediation-20260713`: exit code `0`; Gitleaks reported `312 commits scanned`, approximately `1,384,427 bytes (1.38 MB)` scanned, and `no leaks found` (`0` findings in the JSON report).
|
||||
- `git rev-list --count 7b82ae11f685b77628308ba46b9cfdf5bcdf78d3`: exit code `0`, `327` reachable commits. This Git reachability count is recorded separately and is not the Gitleaks scanned-commit count.
|
||||
- `/tmp/gitleaks-codex-8.30.1/gitleaks dir --no-banner --no-color --redact --report-format json --report-path /tmp/v2r1-cleanup-audit-tree.json /data/aios-gitops/worktrees/v2r1-g1-cleanup-remediation-20260713`: exit code `0`; Gitleaks reported approximately `1,214,737 bytes (1.21 MB)` scanned and `no leaks found` (`0` findings in the JSON report).
|
||||
|
||||
No secret content is reproduced in this report.
|
||||
|
||||
## Tests
|
||||
|
||||
Command:
|
||||
|
||||
```bash
|
||||
PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=active-runtime/app /usr/bin/python3 -m pytest tests/v2r1
|
||||
```
|
||||
|
||||
Output summary:
|
||||
|
||||
```text
|
||||
collected 29 items
|
||||
29 passed in 0.97s
|
||||
exit code: 0
|
||||
```
|
||||
|
||||
Command:
|
||||
|
||||
```bash
|
||||
PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=active-runtime/app /usr/bin/python3 -m pytest tests/integration
|
||||
```
|
||||
|
||||
Output summary:
|
||||
|
||||
```text
|
||||
collected 3 items
|
||||
3 passed in 0.18s
|
||||
exit code: 0
|
||||
```
|
||||
|
||||
Environment: Linux, Python `3.12.3`, pytest `9.1.1`, pluggy `1.6.0`.
|
||||
|
||||
## Disposition
|
||||
|
||||
The cleanup and requested test verification pass at the stated implementation commit. Risk remains `MEDIUM` until the controlled branch is pushed and independently fetched and reviewed by OpenClaw. This result does not authorize merge, tag creation, baseline update, staging, or production deployment.
|
||||
+124
@@ -0,0 +1,124 @@
|
||||
---
|
||||
status: PASS
|
||||
commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
|
||||
task_id: TASK-CODEX-V2R1-G1-FINAL-VERIFY-RETRY-20260715T010807UTC8
|
||||
executor: CODEX_CANDIDATE_BUILDER
|
||||
recovery_iteration: r2
|
||||
rejected_candidate: 78c22cbfb95cb252b671c5ffe3b34bf4944aee2d
|
||||
source_commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
|
||||
source_branch: work/v2r1-integration-quality-2000
|
||||
candidate_ref: work/codex/v2r1-g1-recovery-candidate-20260715T010807UTC8-r2
|
||||
tests:
|
||||
status: PASS
|
||||
v2r1:
|
||||
command: "PYTHONDONTWRITEBYTECODE=1 PYTEST_ADDOPTS='-p no:cacheprovider' PYTHONPATH=active-runtime/app /usr/bin/python3 -m pytest tests/v2r1 -q"
|
||||
exit_code: 0
|
||||
passed: 29
|
||||
summary: 29 passed in 0.95s
|
||||
integration:
|
||||
command: "PYTHONDONTWRITEBYTECODE=1 PYTEST_ADDOPTS='-p no:cacheprovider' PYTHONPATH=active-runtime/app /usr/bin/python3 -m pytest tests/integration -q"
|
||||
exit_code: 0
|
||||
passed: 3
|
||||
summary: 3 passed in 0.19s
|
||||
commands:
|
||||
- id: v2r1_tests
|
||||
exit_code: 0
|
||||
- id: integration_tests
|
||||
exit_code: 0
|
||||
- id: source_object_conflict_marker_scan
|
||||
exit_code: 1
|
||||
accepted_exit_code: 1
|
||||
- id: tracked_sqlite_object_scan
|
||||
command: "git ls-tree -r --name-only 502ef30642597fb0b70b90ae2e8a0b6af217d80e -- data/webops.sqlite3 data/webops.sqlite3-wal data/webops.sqlite3-shm data/webops.sqlite3-journal"
|
||||
exit_code: 0
|
||||
- id: ordered_webops_ignore_rule_scan
|
||||
exit_code: 0
|
||||
- id: gitleaks_version
|
||||
binary: /tmp/gitleaks-codex-8.30.1/gitleaks
|
||||
exit_code: 0
|
||||
- id: gitleaks_git_source_object_scan
|
||||
exit_code: 0
|
||||
- id: gitleaks_directory_scan
|
||||
exit_code: 0
|
||||
- id: python_ast_key_length_scan
|
||||
exit_code: 0
|
||||
conflict_scan:
|
||||
status: PASS
|
||||
command_name: source_object_conflict_marker_scan
|
||||
source_object: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
|
||||
exit_code: 1
|
||||
stdout_lines: 0
|
||||
conflict_count: 0
|
||||
tracked_sqlite:
|
||||
status: PASS
|
||||
exit_code: 0
|
||||
count: 0
|
||||
checked_paths:
|
||||
- data/webops.sqlite3
|
||||
- data/webops.sqlite3-wal
|
||||
- data/webops.sqlite3-shm
|
||||
- data/webops.sqlite3-journal
|
||||
webops_ignore_rules:
|
||||
status: PASS
|
||||
command_name: ordered_webops_ignore_rule_scan
|
||||
count: 4
|
||||
ordered:
|
||||
- /data/webops.sqlite3
|
||||
- /data/webops.sqlite3-wal
|
||||
- /data/webops.sqlite3-shm
|
||||
- /data/webops.sqlite3-journal
|
||||
gitleaks:
|
||||
status: PASS
|
||||
version: "8.30.1"
|
||||
git:
|
||||
command_name: gitleaks_git_source_object_scan
|
||||
source_object: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
|
||||
exit_code: 0
|
||||
findings: 0
|
||||
report_json: []
|
||||
dir:
|
||||
command_name: gitleaks_directory_scan
|
||||
exit_code: 0
|
||||
findings: 0
|
||||
report_json: []
|
||||
hmac:
|
||||
status: PASS
|
||||
method: AST assignment inspection
|
||||
target: tests/v2r1/test_runtime_wiring.py
|
||||
command_name: python_ast_key_length_scan
|
||||
exit_code: 0
|
||||
internal_key_length: 39
|
||||
ingress_key_length: 39
|
||||
placeholder_scan:
|
||||
status: PASS
|
||||
token_count: 0
|
||||
angle_count: 0
|
||||
total_count: 0
|
||||
placeholder_count: 0
|
||||
mandatory_fields:
|
||||
status: PASS
|
||||
present:
|
||||
- status
|
||||
- commit
|
||||
- tests
|
||||
- cleanup_scan
|
||||
- risk
|
||||
- recommendation
|
||||
cleanup_scan:
|
||||
status: PASS
|
||||
details:
|
||||
temporary_reports_outside_worktree: true
|
||||
temporary_reports_removed: true
|
||||
unexpected_workspace_artifacts: 0
|
||||
secret_scan: PASS
|
||||
rollback:
|
||||
status: PASS
|
||||
required: false
|
||||
deployment: false
|
||||
merge: false
|
||||
tag: false
|
||||
baseline: false
|
||||
workspace_clean_at_test_completion: true
|
||||
risk: LOW
|
||||
recommendation: Advance this r2 candidate commit to independent verification only; do not deploy, merge, tag, or alter baselines.
|
||||
---
|
||||
@@ -11,3 +11,7 @@ runtime/tmp/
|
||||
runtime/cache/
|
||||
logs/
|
||||
config/test_write_perms
|
||||
/data/webops.sqlite3
|
||||
/data/webops.sqlite3-wal
|
||||
/data/webops.sqlite3-shm
|
||||
/data/webops.sqlite3-journal
|
||||
|
||||
+18
-29
@@ -1,8 +1,7 @@
|
||||
<<<<<<< HEAD
|
||||
# AIOS Agent Command Plane Registry
|
||||
# Git is the single source of truth for all agent commands.
|
||||
version: 1.0.0
|
||||
created_at: 2026-07-08T15:20:00+08:00
|
||||
created_at: "2026-07-08T15:20:00+08:00"
|
||||
baseline: V1R3C1
|
||||
|
||||
commands:
|
||||
@@ -12,6 +11,22 @@ commands:
|
||||
completed_path: "agents/commands/completed/"
|
||||
failed_path: "agents/commands/failed/"
|
||||
|
||||
directories:
|
||||
commands/active: "New commands pending execution — Git is the only entry point"
|
||||
commands/running: "Commands currently being executed by an agent"
|
||||
commands/completed: "Commands that finished successfully — moved here on success"
|
||||
commands/failed: "Commands that finished with errors — moved here on failure"
|
||||
|
||||
lifecycle:
|
||||
new: active/
|
||||
running: running/
|
||||
success: completed/
|
||||
failure: failed/
|
||||
|
||||
# Command lifecycle state machine:
|
||||
# active/ → locked & moved to running/ → execute → success → completed/
|
||||
# → failure → failed/
|
||||
|
||||
policies:
|
||||
path: "agents/policies/"
|
||||
source: "git"
|
||||
@@ -38,30 +53,4 @@ audit:
|
||||
agent_runs: "audit/agent-runs/"
|
||||
version_history: "audit/version-history/"
|
||||
command_history: "audit/command-history/"
|
||||
=======
|
||||
# AIOS Agent Command Registry
|
||||
# Git is the single source of truth for all agent commands.
|
||||
|
||||
registry_version: 1.0.0
|
||||
created_at: "2026-07-08T15:44:00+08:00"
|
||||
baseline: V1R3C1
|
||||
|
||||
directories:
|
||||
commands/active: "New commands pending execution — Git is the only entry point"
|
||||
commands/running: "Commands currently being executed by an agent"
|
||||
commands/completed: "Commands that finished successfully — moved here on success"
|
||||
commands/failed: "Commands that finished with errors — moved here on failure"
|
||||
|
||||
state: agents/state/
|
||||
policies: agents/policies/
|
||||
|
||||
lifecycle:
|
||||
new: active/
|
||||
running: running/
|
||||
success: completed/
|
||||
failure: failed/
|
||||
|
||||
# Command lifecycle state machine:
|
||||
# active/ → locked & moved to running/ → execute → success → completed/
|
||||
# → failure → failed/
|
||||
>>>>>>> 4d18ee0 (feat(cmd): enable Agent Command Plane, audit plane, and Web UI dashboard)
|
||||
interaction_history: "audit/interaction-history/"
|
||||
|
||||
Binary file not shown.
@@ -1,4 +1,3 @@
|
||||
<<<<<<< HEAD
|
||||
# AIOS Agent Audit Plane Architecture
|
||||
|
||||
## Overview
|
||||
@@ -28,6 +27,7 @@ Agent Command Plane (agents/commands/)
|
||||
| audit/agent-runs/ (per-agent log)
|
||||
| audit/command-history/ (per-command log)
|
||||
| audit/version-history/ (per-baseline log)
|
||||
| audit/interaction-history/ (agent conversation traces)
|
||||
|
|
||||
+---> Git Commit
|
||||
|
|
||||
@@ -45,8 +45,39 @@ Agent Command Plane (agents/commands/)
|
||||
5. Git commit locks the audit record
|
||||
6. Web UI displays timeline from git history
|
||||
|
||||
## Directory Structure
|
||||
|
||||
```
|
||||
audit/
|
||||
├── agent-runs/ # Per-execution records (JSON)
|
||||
├── command-history/ # Command lifecycle history
|
||||
├── version-history/ # Version/baseline change log
|
||||
└── interaction-history/ # Agent conversation traces
|
||||
```
|
||||
|
||||
## Audit Record Schema
|
||||
|
||||
Current agent-run records use the following fields:
|
||||
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| agent_run_id | Unique execution ID |
|
||||
| command | Command file name |
|
||||
| agent | Executing agent name |
|
||||
| version | Baseline version at execution time |
|
||||
| objective | Human-readable goal |
|
||||
| start_time | ISO-8601 start timestamp |
|
||||
| end_time | ISO-8601 completion timestamp |
|
||||
| interaction_count | Agent-owner interaction turns |
|
||||
| tool_call_count | Tool invocations during execution |
|
||||
| changed_files | Files modified in this run |
|
||||
| commit_sha | Git commit hash |
|
||||
| test_result | Test verification outcome |
|
||||
| final_result | SUCCESS / FAILED / PARTIAL |
|
||||
| evidence_path | Link to evidence directory |
|
||||
|
||||
Legacy records remain valid and may use the following compatibility shape:
|
||||
|
||||
```json
|
||||
{
|
||||
"id": "",
|
||||
@@ -72,51 +103,6 @@ Agent Command Plane (agents/commands/)
|
||||
- Every code change must be traceable to who/what agent created it
|
||||
- No agent-created changes without audit trail
|
||||
|
||||
## Related
|
||||
|
||||
- [Agent Command Plane](../agents/README.md)
|
||||
- [Baseline System](baseline-system.md)
|
||||
=======
|
||||
# AIOS Agent Audit Plane
|
||||
|
||||
## Purpose
|
||||
|
||||
Every agent action is recorded. All code changes are traceable to:
|
||||
- Who made the change
|
||||
- Why the change was made
|
||||
- When it was made
|
||||
- Which version introduced it
|
||||
- What test results showed
|
||||
|
||||
## Directory Structure
|
||||
|
||||
```
|
||||
audit/
|
||||
├── agent-runs/ # Per-execution records (JSON)
|
||||
├── command-history/ # Command lifecycle history
|
||||
├── version-history/ # Version/baseline change log
|
||||
└── interaction-history/ # Agent conversation traces
|
||||
```
|
||||
|
||||
## Agent Run Record
|
||||
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| agent_run_id | Unique execution ID |
|
||||
| command | Command file name |
|
||||
| agent | Executing agent name |
|
||||
| version | Baseline version at execution time |
|
||||
| objective | Human-readable goal |
|
||||
| start_time | ISO-8601 start timestamp |
|
||||
| end_time | ISO-8601 completion timestamp |
|
||||
| interaction_count | Agent-owner interaction turns |
|
||||
| tool_call_count | Tool invocations during execution |
|
||||
| changed_files | Files modified in this run |
|
||||
| commit_sha | Git commit hash |
|
||||
| test_result | Test verification outcome |
|
||||
| final_result | SUCCESS / FAILED / PARTIAL |
|
||||
| evidence_path | Link to evidence directory |
|
||||
|
||||
## Version History
|
||||
|
||||
Records baseline promotions, rollbacks, and version changes.
|
||||
@@ -127,6 +113,9 @@ Conversation logs between agent and owner for each command execution.
|
||||
|
||||
## Audit Trail Requirement
|
||||
|
||||
All changes tracked via Git with signed commits where possible.
|
||||
Every commit message references the originating Command ID.
|
||||
>>>>>>> 4d18ee0 (feat(cmd): enable Agent Command Plane, audit plane, and Web UI dashboard)
|
||||
All changes are tracked via Git with signed commits where possible. Every commit references the originating Command ID.
|
||||
|
||||
## Related
|
||||
|
||||
- [Agent Command Plane](../agents/README.md)
|
||||
- [Baseline System](baseline-system.md)
|
||||
|
||||
Reference in New Issue
Block a user