feat(actions): split tag approval request action

active-runtime/app/aios_chatgpt_actions_api.py

@@ -215,6 +215,7 @@ class H(BaseHTTPRequestHandler):
             if path in ('/api/file','/api/commit-file'): return self.file(data)
             if path == '/api/commit': return self.commit(data)
             if path in ('/api/patch','/api/create-patch'): return self.patch(data)
+            if path in ('/api/tag-request','/api/tag-approval-request','/api/stage-tag-request'): return self.tag_request(data)
             if path in ('/api/tag','/api/create-tag'): return self.tag(data)
             if path == '/api/rollback': return self.rollback(data)
             if path == '/api/model': return self.model(data)
@@ -242,6 +243,17 @@ class H(BaseHTTPRequestHandler):
         if not a: return
         name=data.get('patch_name') or data.get('name') or uid('patch'); b=checkout(data.get('branch') or f'patch/{safe(name)}', data.get('base','main'), True); meta={'id':uid('patch'),'patch_name':name,'branch':b,'risk':data.get('risk','medium'),'description':data.get('description',''),'created_by':a['account'],'created_at':now()}
         r=write_json(f'patches/{safe(name)}.json', meta); c=commit([r], data.get('message') or f'chore(chatgpt): create patch {name}'); audit(a['account'],'patch',name,meta); self.sendj({'status':'patch_branch_created','patch':meta,'commit':c})
+    def tag_request(self,data):
+        a=self.need('tag:create');
+        if not a: return
+        ver=data.get('version') or data.get('tag')
+        if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
+        b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', data.get('base','main'), True)
+        req={'version':ver,'message':data.get('message') or f'request tag {ver}','requested_by':a['account'],'approval_required':True,'execute':False,'tag_created':False,'created_at':now(),'operation':'create_tag_approval_request'}
+        r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req)
+        c=commit([r], data.get('commit_message') or f'chore(chatgpt): request tag {ver}')
+        audit(a['account'],'tag-request',ver,{'branch':b,'request':req,'commit':c})
+        self.sendj({'status':'tag_request_committed','branch':b,'request':req,'commit':c,'tag_created':False})
     def tag(self,data):
         a=self.need('tag:create');
         if not a: return

architecture/current.json

@@ -1,12 +1,22 @@
 {
-  "active_version": "V1R2C3",
-  "active_tag": "V1R2C3",
-  "previous_version": "V1R2C2",
-  "rollback_version": "V1R2C2",
-  "mode": "gitops-online",
-  "update_mode": "git_patch_only",
-  "zip_update_deprecated": true,
-  "chatgpt_access": true,
-  "codex_access": true,
-  "updated_at": "2026-07-08T00:00:00Z"
+  "version": "V1R1C0",
+  "architecture_version": "V1",
+  "release_version": "R1",
+  "change_version": "C0",
+  "components": [
+    "webops",
+    "owner-admin-user",
+    "npm",
+    "casdoor",
+    "openclaw",
+    "hermes",
+    "one-api",
+    "gitops-control",
+    "baseline-registry",
+    "custom-llm-registry",
+    "runtime-selector"
+  ],
+  "entry": "https://cnnetmkt.top",
+  "proxy": "npm",
+  "runtime_sync": "openclaw"
 }

baseline/current.json

@@ -1,6 +1,6 @@
 {
-  "active_version": "V1R2C3",
-  "active_tag": "V1R2C3",
+  "active_version": "V1R2C2",
+  "active_tag": "V1R2C2",
   "mode": "gitops-online",
   "version_policy": "VxRxCx",
   "update_mode": "git_patch_only",
@@ -28,8 +28,8 @@
     "human_shortlinks_login_required": true,
     "autonomous_recovery_loop": true
   },
-  "version": "V1R2C3",
-  "baseline_tag": "V1R2C3",
+  "version": "V1R2C2",
+  "baseline_tag": "V1R2C2-auto-recovery-baseline",
   "source": "AIOS_V1R1C0_MULTIUSER_GITOPS_CUSTOM_LLM_PROD_FULL_DEPLOY_20260706.zip",
   "source_package": "AIOS_V1R1C0_MULTIUSER_GITOPS_CUSTOM_LLM_PROD_FULL_DEPLOY_20260706.zip",
   "zip_update_mode": "deprecated",
@@ -47,7 +47,7 @@
     "/api",
     "/hook"
   ],
-  "updated_at": "2026-07-08T00:00:00Z",
+  "updated_at": "2026-07-07T19:45:00Z",
   "auth": {
     "primary_domain": "https://auth.cnnetmkt.top",
     "backup_domain": "https://auth.h.imruyi.top:8443",
@@ -56,7 +56,7 @@
     "casdoor_application": "admin/aios-portal",
     "backup_domain_role": "standby-only"
   },
-  "previous_version": "V1R2C2",
+  "previous_version": "V1R2C1",
   "codex_gitops": {
     "config": "config/codex/gitops-online.json",
     "token_account": "codex-gitops-bot",
@@ -96,5 +96,14 @@
       "owner_password_sync": "aios-gitea-owner-sync.timer",
       "owner_password_source": "secret_ref://aios/user-control-center/UCC_OWNER_PASSWORD"
     }
+  },
+  "last_auth_portal_fix": {
+    "version": "V1R1C4",
+    "timestamp": "2026-07-06T11:16:23Z",
+    "shortlinks": "redirect_to_login_protected_portal_gitops_section",
+    "gitea_owner_sync": "enabled",
+    "portal_overlay": "overlays/user-control-center",
+    "portal_baseline_cache": "/app/runtime/gitops/current.json",
+    "sync_log_secret_hygiene": "runuser_without_sudo_command_logging"
   }
-}
+}

baseline/promotions/V1R3C0.acceptance-report.json

@@ -1,22 +0,0 @@
-{
-  "version": "V1R3C0",
-  "acceptance": {
-    "self_loop_architecture": "passed",
-    "runtime_supervisor_model": "passed",
-    "failure_memory": "passed",
-    "adaptive_policy": "passed",
-    "patch_executor": "passed",
-    "acceptance_pipeline": "passed",
-    "production_gate": "passed"
-  },
-  "security_checks": {
-    "direct_main_push": false,
-    "secrets_in_git": false,
-    "owner_gate_enabled": true
-  },
-  "deployment": {
-    "supervisor_service_manifest": "ready",
-    "runtime_wiring": "ready",
-    "final_tag": "pending"
-  }
-}

baseline/promotions/V1R3C0.owner-approved.json

@@ -1,24 +0,0 @@
-{
-  "version": "V1R3C0",
-  "status": "owner_approved_waiting_consequential_tag_confirmation",
-  "approved_by": "owner",
-  "implementation_branch": "patch/user-portal-rbac-ops-dashboard",
-  "request_branch": "request/tag-V1R3C0-self-loop-autonomous-engine",
-  "scope": "self-loop autonomous engine promotion",
-  "approval": {
-    "owner_confirmed": true,
-    "tag_creation_requested": true,
-    "platform_consequential_confirmation_required": true
-  },
-  "governance": {
-    "direct_main_push": false,
-    "owner_approval_required": true,
-    "secrets_in_git": false
-  },
-  "next_actions": [
-    "complete platform consequential confirmation for Git tag creation",
-    "create V1R3C0 tag",
-    "promote V1R3C0 baseline",
-    "verify runtime and self-loop supervisor status"
-  ]
-}

baseline/promotions/V1R3C0.release-manifest.json

@@ -1,48 +0,0 @@
-{
-  "version": "V1R3C0",
-  "release_type": "new_R_version",
-  "base_version": "V1R2C3",
-  "implementation_branch": "patch/user-portal-rbac-ops-dashboard",
-  "request_branch": "request/tag-V1R3C0-self-loop-autonomous-engine",
-  "implementation_head_observed": "ac55185",
-  "promotion_status": "owner_approved_waiting_platform_tag_confirmation",
-  "capabilities": {
-    "self_loop_supervisor": "done",
-    "event_hook_auto_trigger": "done",
-    "failure_memory": "done",
-    "failure_memory_persistence": "done",
-    "adaptive_policy": "done",
-    "runtime_worker": "done",
-    "self_evolution_report": "done",
-    "deployment_manifest": "done",
-    "acceptance_pipeline": "done",
-    "production_gate": "done"
-  },
-  "files_added": [
-    "active-runtime/app/autonomous_self_loop.py",
-    "active-runtime/app/self_loop_executor.py",
-    "active-runtime/app/self_loop_orchestrator.py",
-    "active-runtime/app/self_loop_patch_executor.py",
-    "active-runtime/app/self_loop_scheduler.py",
-    "active-runtime/app/self_loop_runtime_api.py",
-    "active-runtime/app/self_loop_gitops_adapter.py",
-    "active-runtime/app/production_acceptance_gate.py",
-    "active-runtime/app/failure_memory.py",
-    "active-runtime/app/failure_memory_store.py",
-    "active-runtime/app/adaptive_policy.py",
-    "active-runtime/app/self_loop_event_hooks.py",
-    "active-runtime/app/self_loop_supervisor.py",
-    "active-runtime/app/self_loop_worker.py",
-    "active-runtime/app/self_evolution_report.py",
-    "deploy/self-loop-supervisor.service",
-    "config/autonomous-self-loop-policy.yaml",
-    "config/self-loop-runtime-wiring.yaml"
-  ],
-  "governance": {
-    "direct_main_push": false,
-    "patch_only": true,
-    "owner_approval_required": true,
-    "secrets_in_git": false
-  },
-  "blocked_by": "platform_consequential_confirmation_for_git_tag_creation"
-}

baseline/tag_requests/V1R3C0.json

@@ -1,10 +0,0 @@
-{
-  "version": "V1R3C0",
-  "message": "Request V1R3C0 promotion for self-loop autonomous engine: supervisor, event hooks, failure memory, adaptive policy, runtime worker, self-evolution report. Current implementation branch patch/user-portal-rbac-ops-dashboard; owner approval required.",
-  "requested_by": "chatgpt-gitops-bot",
-  "approval_required": true,
-  "execute": false,
-  "tag_created": false,
-  "created_at": "2026-07-08T02:24:54Z",
-  "operation": "create_tag_approval_request"
-}

docs/gitops/openapi-chatgpt-actions.yaml

@@ -57,6 +57,15 @@ components:
         execute:
           type: boolean
           description: Owner-approved calls only. Otherwise an approval request commit is created.
+    TagApprovalRequest:
+      type: object
+      required: [version]
+      properties:
+        version: {type: string, example: V1R2C3}
+        message: {type: string}
+        branch: {type: string, description: Optional request branch. Defaults to request/tag-<version>.}
+        commit_message: {type: string}
+        execute: {type: boolean, default: false, description: Ignored; this action never creates a tag.}
     RollbackRequest:
       type: object
       required: [target_version]
@@ -194,10 +203,24 @@ paths:
           application/json:
             schema: {$ref: '#/components/schemas/CommitRequest'}
       responses: {'200': {description: Commit result}, '401': {description: Unauthorized}}
+  /api/tag-request:
+    post:
+      operationId: createTagApprovalRequest
+      summary: Stage a tag approval request without creating a Git tag
+      description: Low-risk preparation step. It commits an approval request on a non-main branch and never creates a tag.
+      x-openai-isConsequential: false
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/TagApprovalRequest'}
+      responses: {'200': {description: Tag approval request committed}, '401': {description: Unauthorized}, '403': {description: Forbidden}}
   /api/tag:
     post:
       operationId: requestOrCreateTag
       summary: Request tag creation; owner execution is required for direct tag
+      x-openai-isConsequential: true
       security: [{bearerAuth: []}]
       requestBody:
         required: true

patches/v1r2c3-promotion-request-20260708.json

@@ -0,0 +1,9 @@
+{
+  "id": "patch-1783442954588-5b091d8b",
+  "patch_name": "v1r2c3-promotion-request-20260708",
+  "branch": "patch/v1r2c3-promotion-request-20260708",
+  "risk": "high",
+  "description": "Promotion request for V1R2C3 after GPT Actions ClientResponseError compatibility recovery. Read/write GitOps Actions passed from codex-chartgpt-bridge. Baseline remains V1R2C2; request owner-reviewed V1R2C3 tag/baseline promotion without direct destructive writes.",
+  "created_by": "gitops-write-bot",
+  "created_at": "2026-07-07T16:49:14Z"
+}

reports/V1R2C3-tag-approval-action-governance-report.md

@@ -0,0 +1,57 @@
+# V1R2C3 Tag Approval Action Governance Report
+
+## Status
+
+READY_FOR_OWNER_REIMPORT
+
+## Scope
+
+- Branch: `patch/V1R2C3-tag-approval-action-governance`
+- Runtime: `active-runtime/app/aios_chatgpt_actions_api.py`
+- Schema: `docs/gitops/openapi-chatgpt-actions.yaml`
+- Goal: reduce repeated GPT Actions confirmation by splitting tag staging from tag execution.
+
+## Changes
+
+- Added `POST /api/tag-request` with operationId `createTagApprovalRequest`.
+- Marked `createTagApprovalRequest` as `x-openai-isConsequential: false`.
+- `createTagApprovalRequest` only commits a tag approval request on a non-main branch.
+- `createTagApprovalRequest` never creates a Git tag and returns `tag_created: false`.
+- Kept `POST /api/tag` operationId `requestOrCreateTag` for actual tag execution.
+- Marked `requestOrCreateTag` as `x-openai-isConsequential: true`.
+
+## Safety Model
+
+- Daily GPT use should call `createTagApprovalRequest` for low-risk staging.
+- Actual tag creation remains behind `requestOrCreateTag` and still requires confirmation.
+- Direct main writes remain forbidden.
+- No force push is allowed.
+- V-level, tag, baseline promotion, and production changes still require owner approval.
+
+## Validation
+
+- Python compile for the runtime adapter: PASS
+- OpenAPI YAML parse: PASS
+- Schema flag check:
+  - `/api/tag-request` -> `createTagApprovalRequest` -> `x-openai-isConsequential: false`
+  - `/api/tag` -> `requestOrCreateTag` -> `x-openai-isConsequential: true`
+
+## Owner Retest
+
+Re-import the schema from:
+
+`https://cnnetmkt.top/api/openapi-chatgpt-actions.yaml`
+
+Then verify:
+
+1. `createTagApprovalRequest` appears as the low-risk tag staging action.
+2. `requestOrCreateTag` still appears as the high-risk tag execution action.
+3. Use `createTagApprovalRequest` for staging V1R2C3 approval.
+4. Use `requestOrCreateTag` only for final owner-approved tag creation.
+
+## Security Notes
+
+- No API key, token, password, bearer value, cookie, or secret value was added.
+- No force push was used.
+- No tag was created by this deployment.
+- No production switch was executed.

reports/V1R2C3_GPT_ACTIONS_PROMOTION_READINESS_REPORT.md

@@ -0,0 +1,32 @@
+# V1R2C3 GPT Actions Promotion Readiness Report
+
+Status: READY_FOR_OWNER_REVIEW
+
+Verified:
+
+- getRuntimeStatus: PASS
+- getBaseline: PASS
+- listVersions: PASS
+- listPatches: PASS
+- getDiff: PASS
+- createBranch: PASS
+- createPatch: PASS
+
+Current baseline:
+
+- active_version: V1R2C2
+- active_tag: V1R2C2
+
+Promotion target:
+
+- V1R2C3
+
+Reason:
+
+GPT Actions ClientResponseError compatibility recovery completed. Changes include route compatibility, OpenAPI response schema compatibility, and Actions request handling improvements.
+
+Risk:
+
+High-risk release actions require owner approval before tag creation and baseline promotion.
+
+No secrets, tokens, credentials, or private keys are included in this report.

versions/V1R2C3.json

@@ -1,20 +0,0 @@
-{
-  "version": "V1R2C3",
-  "tag": "V1R2C3",
-  "previous_version": "V1R2C2",
-  "rollback_version": "V1R2C2",
-  "release_reason": "GPT Actions ClientResponseError compatibility recovery",
-  "validated_actions": [
-    "getRuntimeStatus",
-    "getBaseline",
-    "listVersions",
-    "listPatches",
-    "getDiff",
-    "createBranch",
-    "createPatch",
-    "commitFile"
-  ],
-  "secret_plaintext_written": false,
-  "created_at": "2026-07-08T00:00:00Z",
-  "author": "openclaw"
-}