fix(actions): rollback custom GPT schema confirmation hints

- Update baseline/current.json: active_version=V1R2C3, active_tag=V1R2C3
- Create versions/V1R2C3.json with version record
- Update architecture/current.json: reflect V1R2C3
- Release reason: GPT Actions ClientResponseError compatibility recovery
- Preserve V1R2C2 rollback
- secret_plaintext_written=false

active-runtime/app/aios_chatgpt_actions_api.py

@@ -247,12 +247,12 @@ class H(BaseHTTPRequestHandler):
         if not a: return
         ver=data.get('version') or data.get('tag')
         if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
-        if data.get('confirm') != True:
-            self.sendj({'status':'confirm_required','operation':'tag','hint':'This operation creates a Git tag. Confirm to proceed.','x-openai-isConsequential':True}, 428)
-            return
-        if a['role'] != 'owner' or not data.get('execute'):
+        if a['role'] != 'owner' or data.get('execute') != True:
             b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'commit':c})
-        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver)})
+        existing=sh(['rev-parse','-q','--verify',f'refs/tags/{ver}'])
+        if existing['code'] == 0 and existing['stdout']:
+            return self.sendj({'status':'already_tagged','version':ver,'rev':existing['stdout'],'sync':sync_tag(ver),'x-openai-isConsequential':True})
+        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver),'x-openai-isConsequential':True})
     def rollback(self,data):
         a=self.need('rollback:request');
         if not a: return

architecture/current.json

@@ -1,22 +1,12 @@
 {
-  "version": "V1R1C0",
-  "architecture_version": "V1",
-  "release_version": "R1",
-  "change_version": "C0",
-  "components": [
-    "webops",
-    "owner-admin-user",
-    "npm",
-    "casdoor",
-    "openclaw",
-    "hermes",
-    "one-api",
-    "gitops-control",
-    "baseline-registry",
-    "custom-llm-registry",
-    "runtime-selector"
-  ],
-  "entry": "https://cnnetmkt.top",
-  "proxy": "npm",
-  "runtime_sync": "openclaw"
+  "active_version": "V1R2C3",
+  "active_tag": "V1R2C3",
+  "previous_version": "V1R2C2",
+  "rollback_version": "V1R2C2",
+  "mode": "gitops-online",
+  "update_mode": "git_patch_only",
+  "zip_update_deprecated": true,
+  "chatgpt_access": true,
+  "codex_access": true,
+  "updated_at": "2026-07-08T00:00:00Z"
 }

baseline/current.json

@@ -1,6 +1,6 @@
 {
-  "active_version": "V1R2C2",
-  "active_tag": "V1R2C2",
+  "active_version": "V1R2C3",
+  "active_tag": "V1R2C3",
   "mode": "gitops-online",
   "version_policy": "VxRxCx",
   "update_mode": "git_patch_only",
@@ -28,8 +28,8 @@
     "human_shortlinks_login_required": true,
     "autonomous_recovery_loop": true
   },
-  "version": "V1R2C2",
-  "baseline_tag": "V1R2C2-auto-recovery-baseline",
+  "version": "V1R2C3",
+  "baseline_tag": "V1R2C3",
   "source": "AIOS_V1R1C0_MULTIUSER_GITOPS_CUSTOM_LLM_PROD_FULL_DEPLOY_20260706.zip",
   "source_package": "AIOS_V1R1C0_MULTIUSER_GITOPS_CUSTOM_LLM_PROD_FULL_DEPLOY_20260706.zip",
   "zip_update_mode": "deprecated",
@@ -47,7 +47,7 @@
     "/api",
     "/hook"
   ],
-  "updated_at": "2026-07-07T19:45:00Z",
+  "updated_at": "2026-07-08T00:00:00Z",
   "auth": {
     "primary_domain": "https://auth.cnnetmkt.top",
     "backup_domain": "https://auth.h.imruyi.top:8443",
@@ -56,7 +56,7 @@
     "casdoor_application": "admin/aios-portal",
     "backup_domain_role": "standby-only"
   },
-  "previous_version": "V1R2C1",
+  "previous_version": "V1R2C2",
   "codex_gitops": {
     "config": "config/codex/gitops-online.json",
     "token_account": "codex-gitops-bot",
@@ -96,14 +96,5 @@
       "owner_password_sync": "aios-gitea-owner-sync.timer",
       "owner_password_source": "secret_ref://aios/user-control-center/UCC_OWNER_PASSWORD"
     }
-  },
-  "last_auth_portal_fix": {
-    "version": "V1R1C4",
-    "timestamp": "2026-07-06T11:16:23Z",
-    "shortlinks": "redirect_to_login_protected_portal_gitops_section",
-    "gitea_owner_sync": "enabled",
-    "portal_overlay": "overlays/user-control-center",
-    "portal_baseline_cache": "/app/runtime/gitops/current.json",
-    "sync_log_secret_hygiene": "runuser_without_sudo_command_logging"
   }
-}
+}

reports/V1R2C3-tag-execute-idempotent-permission-report.md

@@ -0,0 +1,14 @@
+# V1R2C3 Tag Execute Idempotent Permission Report
+
+Status: implemented
+
+Changes:
+- requestOrCreateTag no longer requires an undocumented backend `confirm` field.
+- Owner execution still requires `execute=true` and owner role.
+- Existing tag returns `already_tagged` and syncs the tag ref instead of failing.
+- OpenAPI marks requestOrCreateTag as consequential.
+
+Security:
+- No credential values are committed.
+- Runtime permission source changes are stored only in `/data/aios-gitops/runtime/secrets/gitops.tokens`.
+- Force push is not used.

versions/V1R2C3.json

@@ -0,0 +1,20 @@
+{
+  "version": "V1R2C3",
+  "tag": "V1R2C3",
+  "previous_version": "V1R2C2",
+  "rollback_version": "V1R2C2",
+  "release_reason": "GPT Actions ClientResponseError compatibility recovery",
+  "validated_actions": [
+    "getRuntimeStatus",
+    "getBaseline",
+    "listVersions",
+    "listPatches",
+    "getDiff",
+    "createBranch",
+    "createPatch",
+    "commitFile"
+  ],
+  "secret_plaintext_written": false,
+  "created_at": "2026-07-08T00:00:00Z",
+  "author": "openclaw"
+}