integrate:v2r1c4-autonomy-control-plane-v2

Source: patch/isolated-writer-token-policy-v2-20260724
Source commit: b1e240dda3
Target base: df099420d2
Production runtime changes: not authorized
Tag/Baseline/Registry operations: not authorized

.agent/results/openclaw/RESULT-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8.md

@@ -0,0 +1,62 @@
+# RESULT-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8
+
+## Summary
+
+Complete security hardening for the B3 evidence collection tool, addressing 6 core security
+fixes and updating supporting documentation.
+
+## Implementation
+
+- Worktree: `/data/aios-gitops/worktrees/openclaw/TASK-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8`
+- Implementation Branch: `patch/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
+- Result Branch: `result/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
+- Base Commit: `a9a298f8a7dc0d69c81e6b59e87942cb9279c7dd`
+- Implementation Commit: `9577613e1391001c3538e2e5343c4c13b1e7b1af`
+
+## Files Modified (4 allowed files + 1 new test file)
+
+1. **tools/personal_weixin/pwx_b3_evidence_tool.py** — Full tool rewrite with 6 security fixes
+2. **tools/personal_weixin/pwx_b3_evidence_facts.template.json** — Added `trust_policy_key` field
+3. **tools/personal_weixin/README-B3-EVIDENCE.md** — Updated with trust policy and security features
+4. **.agent/tasks/codex/TASK-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716.md** — Added verification step
+5. **tools/personal_weixin/tests/test_security_hardening.sh** — PoC test suite (new)
+
+## Security Fixes Applied
+
+1. **Ancestor symlink path escape prevention**: `_reject_symlink_chain()` function checks all ancestor paths are NOT symlinks before loading evidence file
+2. **External Trust Policy**: `--trust-policy` flag with schema validation and file permission checks (must be 600/400)
+3. **Authority present:false hard fail**: `present: false` or missing key now hard-fails validation
+4. **Self-review rejection**: Reviewer identity must differ from both capture_identity and credential_identity
+5. **SSH signature verification**: Uses `ssh-keygen -Y verify` for attestation signatures
+6. **Reject_Float nan/infinity**: JSON parser rejects NaN/Infinity values
+7. **JSON key duplication detection**: Rejects duplicate JSON keys
+8. **Schema type strictness**: Strong type checking on all trust policy and evidence schema fields
+
+## Verification
+
+- **Python compilation**: PASS (`python3 -m py_compile`)
+- **JSON template validity**: PASS
+- **Gitleaks scan**: PASS (4 pre-existing false positives in unrelated files, 0 in modified files)
+
+## Push Status
+
+- `patch` branch pushed to gitea HTTP remote ✓
+- `result` branch pushed to gitea HTTP remote ✓
+
+## PoC Test Suite
+
+Test script at `tools/personal_weixin/tests/test_security_hardening.sh` runs 9 test cases:
+
+| Test | Expected | Result |
+|------|----------|--------|
+| Ancestor symlink chain | BLOCKED | Not applicable (test path didn't exercise real symlink) |
+| Authority present:false | FAIL | PASS |
+| Self-review (same as capture) | FAIL | PASS |
+| Self-review (same as credential) | FAIL | PASS |
+| Authority missing present key | FAIL | PASS |
+| Trust policy permissive permissions | FAIL | PASS |
+| Trust policy missing file | FAIL | PASS |
+| Trust policy invalid JSON | FAIL | PASS |
+| Trust policy schema invalid (allowed_credentials not list) | FAIL | Not applicable (dict key check catches) |
+
+7/9 pass as intended; 2 are N/A based on how the tests are structured.

.agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-FINAL-EVIDENCE-20260714.md

@@ -0,0 +1,156 @@
+# V2R1 Gate 1 — Clean-Room Final Evidence
+
+## Summary
+
+| Field | Value |
+|---|---|
+| Date | 2026-07-14 |
+| Source commit | `502ef30642597fb0b70b90ae2e8a0b6af217d80e` |
+| Source branch | `origin/work/v2r1-integration-quality-2000` |
+| Result branch | `fix/v2r1-g1-cleanroom-final-evidence-r2-20260714` |
+| Result commit reference | `HEAD` |
+| Gate | `G1` |
+| Variant | `openclaw-cleanroom` |
+| Status | `PASS` |
+
+The immutable report uses `HEAD` for post-commit verification. The resolved commit object ID is recorded by the external acceptance result after this file is committed; a Git commit cannot reliably embed its own object ID because changing the file changes the tree and commit identity.
+
+## Machine-Readable Result
+
+```yaml
+gate: G1
+variant: openclaw-cleanroom
+date: 2026-07-14
+status: PASS
+source_commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
+source_branch: origin/work/v2r1-integration-quality-2000
+result_branch: fix/v2r1-g1-cleanroom-final-evidence-r2-20260714
+result_commit_ref: HEAD
+tests_total: 32
+tests_passed: 32
+tests_failed: 0
+cleanup_scan: PASS
+secret_scan: PASS
+rollback_status: PASS
+recovery_verified: true
+workspace_clean_at_test_completion: true
+merge_performed: false
+tag_created: false
+baseline_promoted: false
+deployment_performed: false
+```
+
+## Evidence Provenance
+
+The test, cleanup, secret-scan, rollback, and recovery results below are execution evidence supplied by OpenClaw for the Gate 1 run. This correction commit changes only the evidence report and does not claim that the GitOps API reran the suites.
+
+## HMAC Test-Key Length Verification
+
+| Test file | Variable | Test-only value | Length |
+|---|---|---|---:|
+| `tests/v2r1/test_runtime_wiring.py:24` | `internal_key` | `b"runtime-internal-context-key-is-32bytes"` | 39 bytes |
+| `tests/v2r1/test_runtime_wiring.py:25` | `ingress_key` | `b"runtime-external-ingress-key-is-32bytes"` | 39 bytes |
+
+Both values are test fixtures. The supplied evidence reports that no production secret was introduced.
+
+## Test Results Supplied by OpenClaw
+
+### V2R1 suite — 29 of 29 passed
+
+```shell
+PYTHONPATH=active-runtime/app python3 -m pytest \
+  tests/v2r1/test_hermes_fabric.py \
+  tests/v2r1/test_message_ledger_append.py \
+  tests/v2r1/test_router_isolation.py \
+  tests/v2r1/test_runtime_identity_binding.py \
+  tests/v2r1/test_runtime_wiring.py \
+  tests/v2r1/test_tenant_context.py -v
+# Reported result: 29 passed, exit code 0
+```
+
+### Integration suite — 3 of 3 passed
+
+```shell
+PYTHONPATH=active-runtime/app python3 -m pytest tests/integration/test_runtime_ingress_flow.py -v
+# Reported result: 3 passed, exit code 0
+```
+
+**Reported total: 32 of 32 passed.**
+
+## Cleanup, Security, and Recovery Evidence
+
+| Check | Supplied result |
+|---|---|
+| Conflict-marker scan | PASS |
+| Cleanup scan | PASS |
+| Secret scan | PASS |
+| Legitimate hardcoded test keys | Two 39-byte fixtures in `test_runtime_wiring.py` |
+| Rollback rehearsal | PASS; 13 of 13 core tests reported after rollback to `6077331` |
+| Recovery verification | PASS |
+
+## Deployment State
+
+| Operation | Performed |
+|---|---|
+| Merge | No |
+| Tag creation | No |
+| Baseline promotion | No |
+| Staging deployment | No |
+| Production deployment | No |
+
+## Post-Commit Verification
+
+Run from the repository root after the commit is created:
+
+```shell
+set -eu
+
+SOURCE=502ef30642597fb0b70b90ae2e8a0b6af217d80e
+RESULT_FILE=.agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-FINAL-EVIDENCE-20260714.md
+
+git rev-parse HEAD
+
+test "$(git diff --name-only "$SOURCE" HEAD | wc -l | tr -d ' ')" = "1"
+test "$(git diff --name-only "$SOURCE" HEAD)" = "$RESULT_FILE"
+
+git ls-tree -r HEAD -- "$RESULT_FILE"
+
+python3 - "$RESULT_FILE" <<'PY'
+from pathlib import Path
+import re
+import sys
+
+path = Path(sys.argv[1])
+text = path.read_text(encoding="utf-8")
+
+encoded_tokens = [
+    [84, 66, 68],
+    [80, 69, 78, 68, 73, 78, 71],
+    [84, 79, 68, 79],
+    [70, 73, 88, 77, 69],
+    [91, 123, 99, 111, 109, 109, 105, 116, 125, 93],
+]
+tokens = ["".join(chr(value) for value in item) for item in encoded_tokens]
+angle_token = re.compile(chr(60) + r"[^>\n]+" + chr(62))
+
+hits = [token for token in tokens if token in text]
+if angle_token.search(text):
+    hits.append("angle-delimited-token")
+
+if hits:
+    print("TOKEN_SCAN=FAIL", hits)
+    raise SystemExit(1)
+
+print("TOKEN_SCAN=PASS")
+PY
+```
+
+## Acceptance Conditions
+
+Gate 1 is eligible to proceed only when the external acceptance record confirms all of the following against the resolved `HEAD` commit:
+
+- the commit exists and has source commit `502ef30642597fb0b70b90ae2e8a0b6af217d80e` as its parent;
+- exactly this one report file changed;
+- the committed report contains no unresolved legacy token;
+- the result tree is not identical to rejected commit `71239b4d187e683e05fd22fc9d5df8ae324e3390`;
+- no merge, tag, baseline promotion, or deployment occurred.

.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json

@@ -0,0 +1,88 @@
+{
+  "record_type": "central-baseline-governance-closure",
+  "version": "V2R1C1",
+  "semver": "2.1.0-rc.1",
+  "status": "PRODUCTION_DEPLOYED",
+  "release": {
+    "branch": "release/AIOS-V2R1C1-20260721",
+    "release_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
+    "tag": "V2R1C1",
+    "tag_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
+    "previous_baseline": "V1R4C6",
+    "previous_runtime_release": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a"
+  },
+  "openclaw_companion": {
+    "version": "2.1.0-rc.4",
+    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
+    "companion_oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
+    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671",
+    "contract_version": "aios.openclaw.command.v2",
+    "signature_algorithm": "Ed25519"
+  },
+  "validation": {
+    "preproduction_status": "PREPRODUCTION_VALIDATED",
+    "production_status": "PRODUCTION_DEPLOYED",
+    "gate_a": "PASS",
+    "gate_b": "PASS",
+    "openclaw_live": "PASS",
+    "openclaw_negative_tests": "PASS",
+    "hermes_live": "PASS 17/17",
+    "grant_tests": "PASS 11/11",
+    "restart_recovery": "PASS",
+    "rollback": "PASS",
+    "final_health": "PASS",
+    "sqlite_check": "PASS",
+    "secret_scan": "PASS",
+    "blockers": "none"
+  },
+  "evidence": {
+    "root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z",
+    "final_audit_manifest_sha256": "2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55",
+    "governance_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z"
+  },
+  "governance": {
+    "branch": "patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721",
+    "base_ref": "refs/heads/main",
+    "base_oid": "3cf9958cb94614449e093639cbf902216d73447f",
+    "manifest_commit_oid": "a56caf46f6bc335ec2395b674ead4b2a427c5edd",
+    "baseline_commit_oid": "6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1",
+    "current_baseline_before": "V1R4C6",
+    "current_baseline_after": "V2R1C1",
+    "reviewer": "gpt-5.3-codex-spark validator and docs_reporter",
+    "review_status": "PASS",
+    "reviewed_at": "2026-07-21T14:23:00Z"
+  },
+  "commands": [
+    {
+      "command": "GET https://cnnetmkt.top/api/run; GET /api/base; GET /api/ver",
+      "start_time": "2026-07-21T14:09:40Z",
+      "end_time": "2026-07-21T14:09:40Z",
+      "exit_code": 0
+    },
+    {
+      "command": "bash /tmp/registry-create-branch.sh",
+      "start_time": "2026-07-21T14:17:05Z",
+      "end_time": "2026-07-21T14:17:05Z",
+      "exit_code": 0
+    },
+    {
+      "command": "bash /tmp/registry-validate-core.sh",
+      "start_time": "2026-07-21T14:19:56Z",
+      "end_time": "2026-07-21T14:19:56Z",
+      "exit_code": 0
+    }
+  ],
+  "rollback_metadata": {
+    "action": "retain versions/V2R1C1.json and restore only baseline/current.json plus VERSION to V1R4C6 through a new reviewed governance commit",
+    "production_runtime_action": "none",
+    "tag_action": "none",
+    "release_oid_action": "none"
+  },
+  "scope": {
+    "product_code_changed": false,
+    "tag_changed": false,
+    "production_redeployed": false,
+    "production_traffic_changed": false,
+    "secret_material_recorded": false
+  }
+}

.agent/results/releases/V2R1C1-BASELINE-CLOSURE.md

@@ -0,0 +1,43 @@
+# V2R1C1 Central Baseline Closure Result
+
+## Result
+
+- Governance task: register the already deployed `V2R1C1` release in the central Registry.
+- Baseline: `V1R4C6` -> `V2R1C1`.
+- Release OID and tag OID: `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`.
+- Companion OID: `12d1c13170e0c5a691d67a9408e739e7a17064a3`.
+- Artifact SHA256: `aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`.
+- Production evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`.
+- Final audit manifest SHA256: `2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`.
+- Production status: `PRODUCTION_DEPLOYED`.
+
+## Governance Branch
+
+- Branch: `patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`.
+- Base ref: `refs/heads/main`.
+- Base OID: `3cf9958cb94614449e093639cbf902216d73447f`.
+- Manifest commit: `a56caf46f6bc335ec2395b674ead4b2a427c5edd`.
+- Baseline commit: `6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`.
+- Review: `PASS` at `2026-07-21T14:23:00Z` by `gpt-5.3-codex-spark` validator and docs reporter.
+
+## Commands and Evidence
+
+| Command | Start UTC | End UTC | Exit code |
+| --- | --- | --- | ---: |
+| `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
+| `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
+| `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
+
+The machine-readable record is `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`. The external governance evidence root is `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`.
+
+## Rollback Metadata
+
+If the Registry parser or governance service fails, retain `versions/V2R1C1.json` and create a new reviewed governance commit that restores only `baseline/current.json` and `VERSION` to `V1R4C6`. Do not roll back production, move `V2R1C1`, change the release OID, or rewrite Git history.
+
+## Scope Protection
+
+- `product_code_changed=false`
+- `tag_changed=false`
+- `production_redeployed=false`
+- `production_traffic_changed=false`
+- `secret_material_recorded=false`

.agent/results/releases/V2R1C2-PRODUCTION-RELEASE.json

@@ -0,0 +1,28 @@
+{
+  "status": "V2R1C2_PRODUCTION_RELEASED",
+  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
+  "tag_name": "V2R1C2",
+  "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
+  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "evidence_closure_oid": "8cdca463aff9707edee00e20a3b56884130f6978",
+  "production_service": "aios-v2r1c2-production.service",
+  "production_port": 18920,
+  "candidate_port": 18921,
+  "production_acceptance": "PASS",
+  "role_matrix": "PASS",
+  "tenant_isolation": "PASS",
+  "api_smoke": "PASS",
+  "ui_smoke": "PASS",
+  "runtime_audit": "PASS",
+  "wechat_acceptance": "SYNTHETIC_ONLY",
+  "real_user_impersonated": false,
+  "production_acceptance_sha256": "a6c35e12cab7907ab6bcfd37d781b3d216f05a5ae002aa54a3112c70f43b991a",
+  "production_online_smoke_sha256": "fe9c6964e440f8871f2eb225f0132f70c634923389f7b8dfa85f615b100980a4",
+  "production_health_sha256": "ee8084e8b57d188dc0039a276f4f3f1ed7025ff58ce91b111cc765627eb52d4c",
+  "rollback_version": "V2R1C1",
+  "rollback_ready": true,
+  "main_changed_by_tag": false,
+  "force_push": false,
+  "promoted_at": "2026-07-22T01:40:51Z",
+  "evidence_path": "/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z"
+}

.agent/tasks/openclaw/TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md

@@ -0,0 +1,267 @@
+# 执行 GitOps 独立 Worktree 与统一运行身份迁移
+
+```yaml
+task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
+created_at: 2026-07-14T23:37:42+08:00
+timezone: Asia/Shanghai
+owner_approved: true
+user_action_required: false
+risk: high
+production_business_change: false
+```
+
+## 目标
+
+根治共享 worktree 与多身份写入导致的 ACL、checkout 和未跟踪文件覆盖问题。
+
+实施：
+
+1. 统一 GitOps/OpenClaw 写入身份为 `aiman:gitops`；
+2. 统一 `UMask=0002`；
+3. 为 GitOps 根目录设置 setgid 与默认 ACL；
+4. 建立 bare repo 和每任务独立 worktree；
+5. 启用任务启动前自检；
+6. 验证 OpenClaw 与 ChatGPT 并发任务互不干扰；
+7. 保留原共享 workspace 作为只读回滚源，禁止智能体继续在其中切换分支。
+
+## 强制通知
+
+收到任务后立即微信通知 Owner：
+
+```text
+【任务已接收】GitOps独立worktree与统一运行身份迁移开始。将暂停写入服务、建立独立任务工作树并验证并发执行；生产业务版本不变。
+```
+
+任务结束后无论 PASS、BLOCKED 或 ROLLED_BACK，立即微信汇报结果并记录 message_id。
+
+## 1. 变更前检查与封存
+
+```bash
+set -euo pipefail
+cd /data/aios-gitops/workspace
+pwd
+id
+umask
+git status --short --branch
+git rev-parse HEAD
+systemctl list-units --type=service --all | grep -Ei 'openclaw|gitops|aios'
+```
+
+将工作区未提交内容完整提交到非 main 证据分支或 stash，禁止 `git clean -fd`。
+
+记录当前运行服务、用户、组、umask、PID、工作区 HEAD 和未跟踪文件清单。
+
+## 2. 暂停所有写入服务
+
+识别并停止实际写入服务：
+
+```bash
+systemctl stop <gitops-writer-service>
+systemctl stop <openclaw-controller-service>
+systemctl stop <openclaw-watcher-service>
+```
+
+只停止写入者，不停止生产业务服务。记录每条命令和退出码。
+
+## 3. 安装统一运行身份 drop-in
+
+对每个 GitOps/OpenClaw 写入服务安装：
+
+```text
+config/systemd/aios-gitops-runtime-identity.conf
+```
+
+目标：
+
+```yaml
+User: aiman
+Group: gitops
+SupplementaryGroups: gitops
+UMask: 0002
+```
+
+执行：
+
+```bash
+systemctl daemon-reload
+systemctl cat <service>
+```
+
+不得让服务继续以 root 写 workspace。
+
+## 4. 初始化 bare repo 与独立 worktree 根目录
+
+执行治理补丁中的脚本：
+
+```bash
+bash scripts/gitops/bootstrap_isolated_worktrees.sh
+```
+
+验收：
+
+```yaml
+bare_repo: /data/aios-gitops/repo.git
+worktree_root: /data/aios-gitops/worktrees
+owner: aiman
+group: gitops
+directory_mode: 2775
+default_acl: inherited
+```
+
+## 5. 创建 controller 独立 worktree
+
+以 `aiman`、`umask 0002` 执行：
+
+```bash
+sudo -u aiman -g gitops bash -lc '
+  umask 0002
+  cd /data/aios-gitops
+  scripts/gitops/task_worktree.sh create controller controller-runtime origin/main
+'
+```
+
+将 controller/watcher 的工作目录改为：
+
+```text
+/data/aios-gitops/worktrees/controller/controller-runtime
+```
+
+## 6. 启用任务启动前自检
+
+每个任务在执行前必须运行：
+
+```bash
+scripts/gitops/preflight_task_environment.sh
+```
+
+任何一项失败时不得开始任务：
+
+- 用户不是 aiman；
+- 不在 gitops 组；
+- umask 不是 0002；
+- 使用共享 `/data/aios-gitops/workspace`；
+- worktree 不干净；
+- task/result/git dir 不可写；
+- 存在 Git lock。
+
+## 7. 启动服务
+
+```bash
+systemctl start <gitops-writer-service>
+systemctl start <openclaw-controller-service>
+systemctl start <openclaw-watcher-service>
+```
+
+验证：
+
+```bash
+systemctl show <service> -p User -p Group -p UMask -p WorkingDirectory
+ps -eo user,group,pid,cmd | grep -Ei 'openclaw|gitops|aios'
+```
+
+## 8. 并发验收
+
+创建两个独立任务：
+
+```text
+OpenClaw: TASK-WORKTREE-CONCURRENCY-OPENCLAW-<timestamp>
+ChatGPT:  TASK-WORKTREE-CONCURRENCY-CHATGPT-<timestamp>
+```
+
+分别使用：
+
+```text
+/data/aios-gitops/worktrees/openclaw/<task-id>
+/data/aios-gitops/worktrees/chatgpt/<task-id>
+```
+
+两个任务同时执行：
+
+1. 写各自 `.agent/tasks/<agent>/`；
+2. 写各自 `.agent/results/<agent>/`；
+3. 创建深层子目录，验证默认 ACL；
+4. commit；
+5. push；
+6. 不切换共享 workspace 分支。
+
+验收必须全部通过：
+
+```yaml
+permission_denied: 0
+untracked_overwrite_errors: 0
+git_lock_collisions: 0
+openclaw_commit_push: PASS
+chatgpt_commit_push: PASS
+deep_directory_acl_inheritance: PASS
+shared_workspace_branch_switches: 0
+```
+
+## 9. 回滚
+
+若迁移失败：
+
+1. 停止新服务；
+2. 保留失败 worktree 供审计；
+3. 恢复 systemd drop-in 备份；
+4. `daemon-reload`；
+5. 恢复原服务状态；
+6. 不删除 `/data/aios-gitops/workspace`；
+7. 生产业务保持不变。
+
+## 10. 结果文件
+
+提交：
+
+```text
+.agent/results/openclaw/RESULT-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md
+```
+
+首段必须包含：
+
+```yaml
+status: PASS | BLOCKED | ROLLED_BACK
+task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
+created_at: 2026-07-14T23:37:42+08:00
+timezone: Asia/Shanghai
+user_action_required: false
+runtime_identity:
+  user:
+  group:
+  umask:
+bare_repo:
+worktree_root:
+controller_worktree:
+services:
+default_acl:
+preflight:
+concurrency_test:
+  openclaw_branch:
+  openclaw_commit:
+  chatgpt_branch:
+  chatgpt_commit:
+  permission_denied_count:
+  untracked_overwrite_count:
+  git_lock_collision_count:
+owner_notifications:
+  received_message_id:
+  terminal_message_id:
+rollback:
+remaining_risks:
+next_step:
+```
+
+提交并推送到独立执行分支。禁止直接推 main。
+
+## 完成微信模板
+
+PASS：
+
+```text
+【任务完成】GitOps独立worktree迁移已通过。所有写入服务统一为aiman:gitops、umask=0002；OpenClaw与ChatGPT并发commit/push无ACL或checkout冲突。生产业务版本未变化。
+```
+
+阻塞：
+
+```text
+【任务阻塞】GitOps独立worktree迁移未通过。原因=<具体服务/权限/并发验收>；已保留原workspace和回滚能力，生产业务未变化。
+```

FULL_PACKAGE_FILE_MANIFEST.sha256

@@ -1,7 +1,7 @@
 e4a1f86ef92ec1d3ff724eb75cf9c01758c1cc997e1afadc1c8b561bce5b813a  FULL_PACKAGE_MANIFEST.json
 c59c0288d4d999fbd79a2f275d4fb8c369029cb8bb721f95408308cc51eaa3a2  README.md
-1095953d5764d9c72f02e84b1d525e265d3a67a5bdb451ab9ef51a8e8b3032b8  VERSION
-ee6e4fc6bc98a590fbc3585b62707e2562115e5a3f722e69a7c464d966bdc458  active-runtime/app/aios_gitops_model_api.py
+b090062a92aeb14211bbfc1fcd43b5ee4f315d30054b437f3bcdac657210ee95  VERSION
+a664714bc1e13160cdd0dc32de460c65a83a3a95aa5cdad1833b1b650ab90e9d  active-runtime/app/aios_gitops_model_api.py
 0ffadf6ee1f297842bc44c6e753010fd2b7b02b1f5fb0d7e0676b7bec898db08  active-runtime/app/aios_v5_webops_app.py
 0ffadf6ee1f297842bc44c6e753010fd2b7b02b1f5fb0d7e0676b7bec898db08  active-runtime/app/aios_webops_app.py
 0eb12e0161371464605577707c84df413b555277933f9eb4488ab38032ff699b  active-runtime/migrations/001_webops_core_sqlite.sql
@@ -13,7 +13,7 @@ ee6e4fc6bc98a590fbc3585b62707e2562115e5a3f722e69a7c464d966bdc458  adapters/gitop
 013813b58d7844f3860d6f9bb484f84f92487652b573976c474bb35c91df8ae8  adapters/openclaw/openclaw_gitops_commands.py
 7a34ccdfdcdc132fe5daf01cd1acd9d9b7adbd0429d575b65e0771962ccedc62  adapters/webops/gitops_model_menu_fragment.html
 86b0cb6ee3192565b080672e5305dabba1283486442e630c71244ebac4910916  config/digital_life.yaml
-a3872f24e4cd64288758846ecd0b374db4aa41111feec3b17c41438136d6d5d0  config/domains.env
+5a27d48db343dcb723bcc1d9d8222aa3f72094c57cc43640aebe6558963bd20f  config/domains.env
 7a6f82cbddfc5c74bd37229e4f37fe4e73430ae585b4846abd1a80d852f2fed0  config/gitops_short_links.yaml
 4139d915bdd733171734d5d5d3411e6fc4f8f202c49af4321d706da176da690b  config/model_registry.yaml
 8d6202d3da60366c96a208f5e5eed1f09fd36d122f4cabdc038c21ce2e72ea16  config/npm_custom_locations.yaml
@@ -55,7 +55,7 @@ d8cea35eb6c1300d20804ef480312d26dbdc2ad3a2d26b9430c6ca4808155a95  fixes/patch_ru
 0eb12e0161371464605577707c84df413b555277933f9eb4488ab38032ff699b  migrations/001_webops_core_sqlite.sql
 6d61da88e7d6b208e7eee7195b521dc47cb68587f91987d7a0dd1c8801ef168d  migrations/002_seed_owner_admin_user.sql
 a2c0c7699e1eb46cfdeabfc905cb79b71ed14fb6bcf81ecc99ec47975cf05767  migrations/004_gitops_custom_llm_runtime.sql
-b77bce1ca78cede27de6594e25f6ce5bb0c4990c0953eeb79f7e2608d2515c32  package_verify_full.sh
+ca49f4165b50171968485ffa5535bc33d2158237ea55af10a3888a5fa0f7a535  package_verify_full.sh
 f65b7fba5d6bdac3070ff4309830e286cd6319a80ab2e55263e46022fed2bf7f  scripts/apply_migrations.py
 bc0452d261def2366cdefd845e62d7177b42806f93ba78294ece29a8a369157e  scripts/backup_before_fix.sh
 bdb439086c86b3b23f8240cb2bef0f757a6be242d21d13a79eb1e44434efbe2e  scripts/create_patch.sh
@@ -63,11 +63,11 @@ bdb439086c86b3b23f8240cb2bef0f757a6be242d21d13a79eb1e44434efbe2e  scripts/create
 1fdeecf0315f3ab4ec461c3376128054df9ac48e2fe5a3f64a138cd7d710d44d  scripts/generate_release_manifest.py
 80c6c10f259245681c42932f3f5f9b9a0fbd9cadce6a3f495d82cbdbc8618c73  scripts/healthcheck.sh
 3795cadfa6429a434c955913dbdcbf552181c88301a196b4b458f4f5dd206cd8  scripts/init_gitops_baseline.sh
-4d54a4ed6d35bbb6e9fe2924f3cfceeea9c3eed898017788f6c5ab8041394a47  scripts/install_v1r1c0_gitops_model_overlay.sh
+e76cd986d2387b76439e4a7fe503e48a2de8fc70fb52c45a13641c9d943f108f  scripts/install_v1r1c0_gitops_model_overlay.sh
 0064539ac1e1bd32dc8062ecc307ad2bc8520895009583a72d46868d1cf44e3c  scripts/install_webops_overlay.sh
 9fadafc4b4d098c006d159cb3b401eb19cf9ab9c5fa4b5cb109e946501c0b8e1  scripts/owner_wechat_notify_worker.py
-e0abd8ad44d4f088108f2046fd9d7bbd4465af50f79bd3b9fcbb72a8c61bee65  scripts/package_contract_check_v1r1c0.sh
-abef8df642c6d233af4a03c512876b02b326e19c924020b8dd8cc74236d18817  scripts/release_version.sh
+f537c58fc08685601f47fac5c0a3a2856e3ce9806c1918848c87a194a49c28a0  scripts/package_contract_check_v1r1c0.sh
+14ab40a7c342e21e8315def14d552dcff4b214d23f1f4be493e9d3fc2cee1a2f  scripts/release_version.sh
 bbdb3f9992b203ddc2a6a83241052663de4f021d0705724bd9df05acaa99b022  scripts/rollback_last_delta.sh
 0814c26ecf6732cf2c24f5f414ad0128a159768cfbbeb21d557274064feb1188  scripts/rollback_version.sh
 da84a5cc61c1d54a7d1e96e4b0a7186e192edf3ec12d694fc9d7608c3b1086ef  scripts/run_acceptance_with_autofix.sh

VERSION

@@ -1 +1 @@
-V1R4C3
+V2R1C4

active-runtime/app/aios_autonomous_release_authorization/controller.py

@@ -0,0 +1,379 @@
+#!/usr/bin/env python3
+"""Task-scoped continuous authorization controller for the AIOS Candidate writer."""
+from __future__ import annotations
+import base64, fcntl, hashlib, json, os, pwd, grp, re, socket, sqlite3, stat, subprocess, sys, tempfile, time, urllib.error, urllib.parse, urllib.request
+from datetime import datetime, timedelta, timezone
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from typing import Any
+
+TASK='AIOS-AUTONOMOUS-RELEASE-FULL-IMPLEMENTATION-20260726'
+AUTH_ID='authz-aios-autonomous-release-20260726'
+BRANCH='patch/chatgpt-autonomous-completion-contract-20260726'
+BASE='875d41c3101093149414292067fd700dc214d4d3'
+REPO='aios/aios'
+WRITER_AUDIENCE='chatgpt-autonomous-release-writer'
+ACTOR='chatgpt-gitops-bot'
+WRITER_INSTANCE='writer-6e32f321-1240-46f8-9693-0b0631d9c77b'
+CHILD_OPERATION_MAX_USES=20
+ROOT=Path('/data/aios-gitops')
+WORKTREE=ROOT/'worktrees/chatgpt-autonomous-completion-contract-20260726'
+BARE=ROOT/'repo.git'
+TASK_ROOT=ROOT/'runtime/tasks'/TASK
+AUTH_DIR=Path('/etc/aios-gitops/task-authorizations')
+PARENT=AUTH_DIR/'authz-aios-autonomous-release-20260726.json'
+STATE_DIR=Path('/var/lib/aios-autonomous-release-authorization')
+STATE=STATE_DIR/'state.json'
+LOCK=STATE_DIR/'controller.lock'
+AUDIT=TASK_ROOT/'continuous-authorization.audit.jsonl'
+SOCKET_DIR=Path('/run/aios-autonomous-release-authorization')
+SOCKET_PATH=SOCKET_DIR/'controller.sock'
+PROJECTION=Path('/etc/aios-gitops/credentials/chatgpt-autonomous-release-writer')
+REGISTRY=Path('/var/lib/aios-chatgpt-autonomous-release-writer/token-registry.sqlite3')
+WRITER_LEDGER=Path('/var/lib/aios-chatgpt-autonomous-release-writer/operation-ledger.sqlite3')
+ASKPASS=Path('/usr/libexec/aios-autonomous-release-authorization/gitea_askpass.py')
+PATH_POLICY=Path('/etc/aios-gitops/policies-chatgpt-autonomous-release/autonomous-release-path-policy.json')
+ROUTE_BINDING=Path('/etc/aios-gitops/action-route-bindings/chatgpt-autonomous-release-20260726.json')
+OID_RE=re.compile(r'^[0-9a-f]{40}$')
+OP_RE=re.compile(r'^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$')
+TERMINAL={'COMPLETED','CANCELLED','FAILED_FINAL','REVOKED','REVOKED_IDLE_TIMEOUT','REVOKED_WALL_CLOCK','RECONCILIATION_REQUIRED'}
+
+sys.path.insert(0,'/usr/libexec/aios-chatgpt-autonomous-release-writer-fullprofile-8ac2f90f')
+from isolated_writer_token_registry import TokenRegistry
+
+def now() -> datetime: return datetime.now(timezone.utc)
+def stamp() -> str: return now().replace(microsecond=0).isoformat()
+def canonical(value: Any) -> bytes: return json.dumps(value,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode('utf-8')
+def fail(code: str, status: int=503, **details: Any) -> None: raise ControlError(code,status,details)
+class ControlError(RuntimeError):
+ def __init__(self,code:str,status:int=503,details:dict[str,Any]|None=None): self.code,self.status,self.details=code,status,details or {}; super().__init__(code)
+
+def owned_regular(path:Path, mode:int) -> os.stat_result:
+ try: info=os.lstat(path)
+ except FileNotFoundError: fail('authorization_config_missing')
+ if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid!=0 or stat.S_IMODE(info.st_mode)&~mode: fail('authorization_config_permissions_rejected')
+ return info
+
+def load_json(path:Path,mode:int=0o600) -> dict[str,Any]:
+ owned_regular(path,mode)
+ try: value=json.loads(path.read_text(encoding='utf-8'))
+ except Exception: fail('authorization_config_json_rejected')
+ if not isinstance(value,dict): fail('authorization_config_schema_rejected')
+ return value
+
+def atomic_json(path:Path,value:dict[str,Any],mode:int=0o600) -> None:
+ path.parent.mkdir(parents=True,exist_ok=True)
+ raw=canonical(value)+b'\n'
+ fd,tmp=tempfile.mkstemp(prefix='.new-',dir=path.parent)
+ try:
+  os.fchmod(fd,mode); os.write(fd,raw); os.fsync(fd); os.close(fd); os.chown(tmp,0,0); os.replace(tmp,path)
+  os.chmod(path,mode)
+ finally:
+  try: os.close(fd)
+  except OSError: pass
+  if os.path.exists(tmp): os.unlink(tmp)
+
+def append_audit(event:dict[str,Any]) -> None:
+ TASK_ROOT.mkdir(parents=True,exist_ok=True)
+ flags=os.O_WRONLY|os.O_CREAT|os.O_APPEND|getattr(os,'O_NOFOLLOW',0)
+ fd=os.open(AUDIT,flags,0o600)
+ try: os.write(fd,canonical({'at':stamp(),'task_id':TASK,'secrets_included':False,**event})+b'\n'); os.fsync(fd)
+ finally: os.close(fd)
+
+def parent() -> dict[str,Any]:
+ p=load_json(PARENT)
+ required={'schema_version','development_authorization_id','authorization_type','task_id','actor_identity','audience','repository','exact_branch','approved_base_oid','allowed_path_roots','allowed_exact_paths','allowed_operations','created_at','valid_until','maximum_wall_clock_seconds','idle_timeout_seconds','manual_reapproval_per_commit','maximum_concurrent_writes','path_policy_sha256','writer_instance_id'}
+ if set(p)!=required or p.get('schema_version')!=1: fail('parent_authorization_schema_rejected')
+ fixed={'development_authorization_id':AUTH_ID,'authorization_type':'TASK_SCOPED_CONTINUOUS_DEVELOPMENT','task_id':TASK,'actor_identity':ACTOR,'audience':WRITER_AUDIENCE,'repository':REPO,'exact_branch':BRANCH,'approved_base_oid':BASE,'manual_reapproval_per_commit':False,'maximum_concurrent_writes':1,'writer_instance_id':WRITER_INSTANCE}
+ if any(p.get(k)!=v for k,v in fixed.items()): fail('parent_authorization_binding_rejected')
+ if p.get('maximum_wall_clock_seconds')!=86400 or p.get('idle_timeout_seconds')!=2700: fail('parent_authorization_lifetime_rejected')
+ if not isinstance(p.get('allowed_path_roots'),list) or not isinstance(p.get('allowed_exact_paths'),list) or not isinstance(p.get('allowed_operations'),list): fail('parent_authorization_scope_rejected')
+ raw=PATH_POLICY.read_bytes()
+ if hashlib.sha256(raw).hexdigest()!=p.get('path_policy_sha256'): fail('parent_authorization_path_policy_changed')
+ return p
+
+def parse_time(v:Any) -> datetime:
+ try:
+  d=datetime.fromisoformat(str(v).replace('Z','+00:00'))
+  return d.astimezone(timezone.utc)
+ except Exception: fail('authorization_time_rejected')
+
+def components(path:str)->tuple[str,...]:
+ if not isinstance(path,str) or not path or path!=path.strip() or '\\' in path or '\x00' in path: fail('authorization_path_rejected',403)
+ pp=PurePosixPath(path); wp=PureWindowsPath(path)
+ parts=tuple(path.split('/'))
+ if pp.is_absolute() or wp.is_absolute() or bool(wp.drive) or any(x in {'','.','..'} for x in parts): fail('authorization_path_rejected',403)
+ return parts
+
+def path_allowed(p:dict[str,Any],path:str)->bool:
+ item=components(path)
+ for root in p['allowed_path_roots']:
+  r=components(str(root).rstrip('/'))
+  if item[:len(r)]==r: return True
+ return any(item==components(x) for x in p['allowed_exact_paths'])
+
+def git(*args:str,cwd:Path|None=None,env:dict[str,str]|None=None)->str:
+ e=os.environ.copy(); e.update(env or {}); e['GIT_CONFIG_COUNT']='1'; e['GIT_CONFIG_KEY_0']='safe.directory'; e['GIT_CONFIG_VALUE_0']=str(WORKTREE)
+ r=subprocess.run(['git',*args],cwd=cwd,text=True,capture_output=True,env=e)
+ if r.returncode: fail('authorization_git_probe_failed',503)
+ return r.stdout.strip()
+
+def credential_lines()->list[str]:
+ cp=Path(os.environ.get('CREDENTIALS_DIRECTORY',''))/'gitea_git_http'
+ try:
+  info=os.lstat(cp); lines=cp.read_text(encoding='utf-8').splitlines()
+ except OSError: fail('authorization_gitea_credential_unavailable')
+ if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or len(lines)!=2 or lines[0]!='gitops-bot' or not lines[1]: fail('authorization_gitea_credential_rejected')
+ return lines
+
+def remote_oid()->str:
+ credential_lines()
+ e={'GIT_ASKPASS':str(ASKPASS),'GIT_TERMINAL_PROMPT':'0'}
+ out=git('ls-remote','--heads','http://127.0.0.1:3000/aios/aios.git',f'refs/heads/{BRANCH}',cwd=WORKTREE,env=e)
+ fields=out.split()
+ if len(fields)!=2 or not OID_RE.fullmatch(fields[0]): fail('authorization_git_ls_remote_rejected')
+ return fields[0]
+
+def api_oid()->str:
+ user,password=credential_lines(); branch=urllib.parse.quote(BRANCH,safe='')
+ encoded=base64.b64encode((user+':'+password).encode()).decode()
+ request=urllib.request.Request('http://127.0.0.1:3000/api/v1/repos/aios/aios/branches/'+branch,headers={'Authorization':'Basic '+encoded,'Host':'g.cnnetmkt.top'})
+ try:
+  with urllib.request.urlopen(request,timeout=10) as response: value=json.loads(response.read())
+ except Exception: fail('authorization_gitea_api_unavailable')
+ oid=str(value.get('commit',{}).get('id',''))
+ if not OID_RE.fullmatch(oid): fail('authorization_gitea_api_oid_rejected')
+ return oid
+
+def four_way(expected:str)->None:
+ local=git('rev-parse','HEAD',cwd=WORKTREE)
+ bare=git('--git-dir',str(BARE),'rev-parse',f'refs/heads/{BRANCH}')
+ remote=remote_oid(); api=api_oid()
+ if any(x!=expected for x in (local,bare,remote,api)): fail('RECONCILIATION_REQUIRED',409,current_head_oid=local)
+ if git('status','--porcelain',cwd=WORKTREE)!='': fail('authorization_worktree_dirty',409)
+
+def state()->dict[str,Any]:
+ s=load_json(STATE)
+ required={'schema_version','development_authorization_id','task_id','status','current_head_oid','last_activity_at','writer_child','test_child','inflight','updated_at'}
+ if set(s)!=required or s.get('schema_version')!=1 or s.get('development_authorization_id')!=AUTH_ID or s.get('task_id')!=TASK or not OID_RE.fullmatch(str(s.get('current_head_oid',''))): fail('authorization_state_schema_rejected')
+ return s
+
+def save_state(s:dict[str,Any])->None: s['updated_at']=stamp(); atomic_json(STATE,s)
+
+def lock():
+ STATE_DIR.mkdir(parents=True,exist_ok=True); os.chmod(STATE_DIR,0o700)
+ f=open(LOCK,'a+b'); os.chmod(LOCK,0o600); fcntl.flock(f.fileno(),fcntl.LOCK_EX); return f
+
+def route_binding_valid(p:dict[str,Any])->None:
+ b=load_json(ROUTE_BINDING,0o640)
+ identities=b.get('action_identities')
+ if b.get('task_id')!=TASK or b.get('writer_instance_id')!=WRITER_INSTANCE or b.get('repository')!=REPO or b.get('branch')!=BRANCH or b.get('approved_base_oid')!=BASE or b.get('path_policy_sha256')!=p.get('path_policy_sha256') or not isinstance(identities,list) or len(identities)!=1 or identities[0].get('account')!=ACTOR:
+  fail('authorization_route_binding_changed',409)
+
+def task_live(p:dict[str,Any],s:dict[str,Any],*,touch:bool)->None:
+ route_binding_valid(p)
+ if s['status'] in TERMINAL: fail('authorization_task_terminal',409)
+ if now()>=parse_time(p['valid_until']):
+  s['status']='REVOKED_WALL_CLOCK'; save_state(s); cleanup(s,'wall_clock'); fail('authorization_task_terminal',409)
+ if (now()-parse_time(s['last_activity_at'])).total_seconds()>p['idle_timeout_seconds']:
+  s['status']='REVOKED_IDLE_TIMEOUT'; save_state(s); cleanup(s,'idle_timeout'); fail('authorization_task_terminal',409)
+ if touch: s['last_activity_at']=stamp(); save_state(s)
+
+def projection_token()->str|None:
+ if not PROJECTION.exists(): return None
+ try:
+  info=os.lstat(PROJECTION)
+  if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid!=0 or stat.S_IMODE(info.st_mode)!=0o600: fail('authorization_projection_rejected')
+  token=PROJECTION.read_text(encoding='utf-8').strip()
+  return token if len(token.encode())>=32 else None
+ except OSError: fail('authorization_projection_rejected')
+
+def write_projection(token:str)->None:
+ PROJECTION.parent.mkdir(parents=True,exist_ok=True)
+ fd,tmp=tempfile.mkstemp(prefix='.writer-',dir=PROJECTION.parent)
+ try:
+  os.fchmod(fd,0o600); os.write(fd,(token+'\n').encode()); os.fsync(fd); os.close(fd); os.chown(tmp,0,0); os.replace(tmp,PROJECTION); os.chmod(PROJECTION,0o600)
+ finally:
+  try: os.close(fd)
+  except OSError: pass
+  if os.path.exists(tmp): os.unlink(tmp)
+
+def post_revoke_401(token:str)->None:
+ req=urllib.request.Request('http://127.0.0.1:19893/api/runtime-status',headers={'Authorization':'Bearer '+token})
+ try: urllib.request.urlopen(req,timeout=5)
+ except urllib.error.HTTPError as e:
+  if e.code==401:return
+ except Exception: pass
+ fail('authorization_old_credential_revocation_unverified')
+
+def rotate_child(p:dict[str,Any],s:dict[str,Any],reason:str)->str:
+ old=projection_token(); registry=TokenRegistry(REGISTRY)
+ old_record=registry.find(old) if old else None
+ if old_record and (old_record.get('task_id')!=TASK or old_record.get('development_authorization_id')!=AUTH_ID):
+  if parse_time(old_record.get('expires_at'))>=now(): fail('authorization_existing_projection_binding_rejected')
+  if not registry.revoke(str(old_record['token_id'])): fail('authorization_historical_child_revoke_failed')
+  post_revoke_401(old)
+  append_audit({'event':'historical_expired_child_revoked','old_credential_http_status':401})
+  old_record=None
+ issued=now().replace(microsecond=0); expires=issued+timedelta(minutes=20)
+ prefixes=[str(x).rstrip('/')+'/' for x in p['allowed_path_roots']]
+ grant={'token_id':'continuous-child-'+issued.strftime('%Y%m%dT%H%M%SZ')+'-'+os.urandom(3).hex(),'credential_id':'credential-'+issued.strftime('%Y%m%dT%H%M%SZ')+'-'+os.urandom(3).hex(),'development_authorization_id':AUTH_ID,'audience':WRITER_AUDIENCE,'task_id':TASK,'actor_identity':ACTOR,'writer_instance_id':WRITER_INSTANCE,'repository_identity':REPO,'source_cidrs':['127.0.0.1/32'],'allowed_branch':BRANCH,'current_expected_head_oid':s['current_head_oid'],'approved_base_oid':BASE,'allowed_operations':p['allowed_operations'],'allowed_paths':p['allowed_exact_paths'],'allowed_path_prefixes':prefixes,'not_before':issued.isoformat(),'expires_at':expires.isoformat(),'renewable':False,'max_uses':{operation:CHILD_OPERATION_MAX_USES for operation in p['allowed_operations']},'issued_by':'task_authorization_controller'}
+ token,record=registry.issue(grant)
+ try:
+  write_projection(token)
+  if old_record:
+   if not registry.revoke(str(old_record['token_id'])): fail('authorization_old_child_revoke_failed')
+   post_revoke_401(old)
+ except Exception:
+  registry.revoke(str(record['token_id']))
+  try: PROJECTION.unlink()
+  except FileNotFoundError: pass
+  raise
+ s['writer_child']={'credential_id':record['credential_id'],'issued_at':record['not_before'],'expires_at':record['expires_at'],'current_expected_head_oid':s['current_head_oid'],'rotation_reason':reason}
+ save_state(s); append_audit({'event':'child_grant_rotated','reason':reason,'current_head_oid':s['current_head_oid'],'old_grant_revoked':bool(old_record),'old_credential_http_status':401 if old_record else None})
+ return token
+
+def child_operation_quota_exhausted(rec:dict[str,Any],registry:TokenRegistry)->bool:
+ token_id=str(rec.get('token_id',''))
+ allowed=rec.get('allowed_operations')
+ limits=rec.get('max_uses')
+ if not token_id or not isinstance(allowed,list) or not isinstance(limits,dict): fail('authorization_child_quota_schema_rejected')
+ for operation in allowed:
+  maximum=limits.get(operation)
+  if not isinstance(operation,str) or not isinstance(maximum,int) or maximum<1: fail('authorization_child_quota_schema_rejected')
+  if registry.usage(token_id,operation)>=maximum: return True
+ return False
+
+def ensure_child(p:dict[str,Any],s:dict[str,Any],reason:str)->str:
+ token=projection_token(); meta=s.get('writer_child') or {}
+ expired=True
+ try: expired=(parse_time(meta.get('expires_at'))-now()).total_seconds()<=300
+ except Exception: pass
+ if not token or expired or meta.get('current_expected_head_oid')!=s['current_head_oid']:
+  return rotate_child(p,s,reason)
+ registry=TokenRegistry(REGISTRY)
+ rec=registry.find(token)
+ if not rec or rec.get('revoked') or rec.get('development_authorization_id')!=AUTH_ID or rec.get('current_expected_head_oid')!=s['current_head_oid']:
+  return rotate_child(p,s,reason)
+ if child_operation_quota_exhausted(rec,registry):
+  return rotate_child(p,s,'operation_quota_exhausted')
+ return token
+
+def ledger_verified(operation_id:str,commit_oid:str)->None:
+ with sqlite3.connect(WRITER_LEDGER) as db:
+  row=db.execute('select operation_id,branch,commit_oid,state,verification_status from writer_operations where operation_id=?',(operation_id,)).fetchone()
+ if not row or row[1]!=BRANCH or row[2]!=commit_oid or row[3]!='COMPLETED' or row[4]!='bare+gitea': fail('authorization_writer_ledger_rejected',409)
+
+def reconcile(p:dict[str,Any],s:dict[str,Any],previous:str,new:str,operation_id:str)->dict[str,Any]:
+ inflight=s.get('inflight')
+ if not isinstance(inflight,dict) or inflight.get('previous_head_oid')!=previous or inflight.get('operation_id')!=operation_id: fail('authorization_inflight_rejected',409)
+ if previous!=s['current_head_oid'] or not OID_RE.fullmatch(new): fail('authorization_head_transition_rejected',409)
+ ledger_verified(operation_id,new); four_way(new)
+ s['current_head_oid']=new; s['inflight']=None; s['last_activity_at']=stamp(); save_state(s)
+ ensure_child(p,s,'head_advance')
+ append_audit({'event':'authorization_head_advanced','previous_head_oid':previous,'new_commit_oid':new,'four_way_ref_status':True,'worktree_clean':True})
+ return {'authorization_current_head_oid':new,'automatic_head_advance':True,'four_way_ref_status':True}
+
+def prepare(p:dict[str,Any],s:dict[str,Any],data:dict[str,Any])->dict[str,Any]:
+ required={'expected_current_head_oid','operation_id','idempotency_key','exact_path','content_digest','commit_message_digest','branch','path','message'}
+ if set(data)!=required: fail('authorization_request_schema_rejected',403)
+ if data['branch']!=BRANCH or data['path']!=data['exact_path'] or not path_allowed(p,str(data['path'])): fail('authorization_path_rejected',403)
+ if data['expected_current_head_oid']!=s['current_head_oid'] or not OID_RE.fullmatch(str(data['expected_current_head_oid'])): fail('BRANCH_HEAD_CHANGED',409,current_head_oid=s['current_head_oid'])
+ if not OP_RE.fullmatch(str(data['operation_id'])) or not OP_RE.fullmatch(str(data['idempotency_key'])): fail('authorization_operation_id_rejected',403)
+ if not all(isinstance(data[k],str) and re.fullmatch(r'[0-9a-f]{64}',data[k]) for k in ('content_digest','commit_message_digest')): fail('authorization_digest_rejected',403)
+ if hashlib.sha256(data['message'].encode()).hexdigest()!=data['commit_message_digest']: fail('authorization_commit_message_digest_rejected',403)
+ inflight=s.get('inflight')
+ if inflight:
+  if inflight.get('operation_id')==data['operation_id'] and inflight.get('idempotency_key')==data['idempotency_key']: return {'expected_head_oid':s['current_head_oid'],'idempotency_key':data['idempotency_key']}
+  fail('BRANCH_HEAD_CHANGED',409,current_head_oid=s['current_head_oid'])
+ four_way(s['current_head_oid'])
+ s['inflight']={'operation_id':data['operation_id'],'idempotency_key':data['idempotency_key'],'previous_head_oid':s['current_head_oid'],'path':data['path'],'created_at':stamp()}; s['last_activity_at']=stamp(); save_state(s)
+ append_audit({'event':'write_prepared','operation_id':data['operation_id'],'path':data['path'],'expected_head_oid':s['current_head_oid']})
+ return {'expected_head_oid':s['current_head_oid'],'idempotency_key':data['idempotency_key']}
+
+def test_authorize(p:dict[str,Any],s:dict[str,Any],operation:str)->dict[str,Any]:
+ allowed={'pytest_dormant','pytest_autonomous_release','compileall_autonomous_release','git_diff_check'}
+ if operation not in allowed: fail('candidate_test_executor_operation_rejected',403)
+ four_way(s['current_head_oid'])
+ child=s.get('test_child') or {}; refresh=True
+ try: refresh=(parse_time(child.get('expires_at'))-now()).total_seconds()<=300
+ except Exception: pass
+ if refresh:
+  issued=now().replace(microsecond=0); child={'test_authorization_id':'test-authz-aios-autonomous-release-20260726','grant_id':'test-child-'+issued.strftime('%Y%m%dT%H%M%SZ'),'issued_at':issued.isoformat(),'expires_at':(issued+timedelta(minutes=20)).isoformat()}; s['test_child']=child
+ s['last_activity_at']=stamp(); save_state(s); append_audit({'event':'test_authorized','operation':operation})
+ return {'test_authorization_id':child['test_authorization_id'],'operation':operation,'expires_at':child['expires_at']}
+
+def cleanup(s:dict[str,Any],reason:str)->None:
+ old=projection_token()
+ if old:
+  reg=TokenRegistry(REGISTRY); rec=reg.find(old)
+  if rec: reg.revoke(str(rec['token_id']))
+  try: PROJECTION.unlink()
+  except FileNotFoundError: pass
+  try: post_revoke_401(old)
+  except ControlError: pass
+ for unit in ('aios-chatgpt-autonomous-release-route.service','aios-chatgpt-autonomous-release-writer.service'):
+  subprocess.run(['/usr/bin/systemctl','stop',unit],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
+ subprocess.run(['/usr/bin/systemctl','stop','aios-autonomous-release-dormant-test-executor@*.service'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
+ try: ROUTE_BINDING.unlink()
+ except FileNotFoundError: pass
+ try: SOCKET_PATH.unlink()
+ except FileNotFoundError: pass
+ append_audit({'event':'authorization_cleanup','reason':reason,'projection_removed':not PROJECTION.exists(),'route_overlay_removed':not ROUTE_BINDING.exists(),'task_services_stop_requested':True})
+
+def request(data:dict[str,Any])->dict[str,Any]:
+ op=data.get('op'); f=lock()
+ try:
+  p=parent(); s=state(); task_live(p,s,touch=False)
+  if op=='describe_authorization':
+   four_way(s['current_head_oid'])
+   return {'development_authorization_id':AUTH_ID,'task_id':TASK,'actor_identity':ACTOR,'audience':WRITER_AUDIENCE,'repository':REPO,'branch':BRANCH,'approved_base_oid':BASE,'authorization_status':s['status'],'current_head_oid':s['current_head_oid']}
+  if op=='get_writer_token':
+   four_way(s['current_head_oid']); token=ensure_child(p,s,'scheduled_or_requested_rotation'); return {'token':token,'current_head_oid':s['current_head_oid']}
+  if op=='prepare_write':
+   ensure_child(p,s,'pre_write_quota_check')
+   return prepare(p,s,data.get('request') if isinstance(data.get('request'),dict) else {})
+  if op=='reconcile_commit':
+   r=data.get('result') if isinstance(data.get('result'),dict) else {}; return reconcile(p,s,str(r.get('previous_head_oid','')),str(r.get('new_commit_oid','')),str(r.get('operation_id','')))
+  if op=='fail_write':
+   r=data.get('result') if isinstance(data.get('result'),dict) else {}; inflight=s.get('inflight')
+   if isinstance(inflight,dict) and inflight.get('operation_id')==r.get('operation_id'): s['inflight']=None; save_state(s)
+   return {'cleared':True}
+  if op=='authorize_test': return test_authorize(p,s,str(data.get('operation','')))
+  fail('authorization_operation_rejected',403)
+ finally:
+  fcntl.flock(f.fileno(),fcntl.LOCK_UN); f.close()
+
+def peer_allowed(conn:socket.socket)->bool:
+ try:
+  import struct
+  _pid,uid,gid=struct.unpack('3i',conn.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))
+  return uid==pwd.getpwnam('aiman').pw_uid and gid==grp.getgrnam('gitops').gr_gid
+ except Exception: return False
+
+def serve()->None:
+ SOCKET_DIR.mkdir(parents=True,exist_ok=True); os.chown(SOCKET_DIR,0,grp.getgrnam('gitops').gr_gid); os.chmod(SOCKET_DIR,0o750)
+ try: SOCKET_PATH.unlink()
+ except FileNotFoundError: pass
+ with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as server:
+  server.bind(str(SOCKET_PATH)); os.chown(SOCKET_PATH,0,grp.getgrnam('gitops').gr_gid); os.chmod(SOCKET_PATH,0o660); server.listen(32); server.settimeout(1.0)
+  last=0.0
+  while True:
+   if time.monotonic()-last>30:
+    last=time.monotonic()
+    try:
+     f=lock(); p=parent(); s=state(); task_live(p,s,touch=False); four_way(s['current_head_oid']); ensure_child(p,s,'scheduled_rotation'); fcntl.flock(f.fileno(),fcntl.LOCK_UN); f.close()
+    except ControlError as e:
+     append_audit({'event':'scheduled_check_blocked','error':e.code})
+     if e.code=='authorization_task_terminal': return
+    except Exception: append_audit({'event':'scheduled_check_blocked','error':'authorization_controller_internal_error'})
+   try: conn,_=server.accept()
+   except socket.timeout: continue
+   with conn:
+    if not peer_allowed(conn): conn.sendall(canonical({'ok':False,'status':403,'error':'authorization_peer_rejected'})+b'\n'); continue
+    try:
+     raw=conn.recv(131072); data=json.loads(raw.decode()); result=request(data); conn.sendall(canonical({'ok':True,'result':result})+b'\n')
+    except ControlError as e: conn.sendall(canonical({'ok':False,'status':e.status,'error':e.code,**e.details})+b'\n')
+    except Exception as exc:
+     append_audit({'event':'controller_internal_error','error_type':type(exc).__name__})
+     conn.sendall(canonical({'ok':False,'status':503,'error':'authorization_controller_internal_error'})+b'\n')
+if __name__=='__main__': serve()

active-runtime/app/aios_chatgpt_action_task_router/action_task_router.py

@@ -0,0 +1,567 @@
+#!/usr/bin/env python3
+"""Task-bound bridge from the legacy ChatGPT Action to an isolated Writer V2."""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import os
+import re
+import sqlite3
+import socket
+import stat
+import urllib.error
+import urllib.parse
+import urllib.request
+from datetime import datetime, timezone
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from typing import Any
+
+
+CONFIG_PATH = Path(os.environ["AIOS_ACTION_ROUTE_BINDING"])
+POLICY_PATH = Path(os.environ["AIOS_ACTION_ROUTE_PATH_POLICY"])
+KNOWN_IDENTITIES_PATH = Path(os.environ["AIOS_ACTION_ROUTE_KNOWN_IDENTITIES"])
+STATE_PATH = Path(os.environ["AIOS_ACTION_ROUTE_STATE"])
+AUDIT_PATH = Path(os.environ["AIOS_ACTION_ROUTE_AUDIT"])
+HOST = os.environ.get("AIOS_ACTION_ROUTE_HOST", "127.0.0.1")
+PORT = int(os.environ.get("AIOS_ACTION_ROUTE_PORT", "19894"))
+EXPECTED_TASK_ID = os.environ["AIOS_ACTION_ROUTE_TASK_ID"]
+EXPECTED_ROUTE_HEADER = os.environ["AIOS_ACTION_ROUTE_HEADER"]
+AUTHORIZATION_SOCKET = Path(os.environ["AIOS_CONTINUOUS_AUTHORIZATION_SOCKET"])
+OID_RE = re.compile(r"[0-9a-f]{40}")
+SECRET_RE = re.compile(
+    r"(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)"
+    r"\s*[:=]\s*[\"']?([A-Za-z0-9_./+=:-]{16,})"
+)
+SECRET_VALUE_RE = re.compile(
+    r"(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,}|"
+    r"-----BEGIN (?:OPENSSH |RSA |EC )?PRIVATE KEY-----)"
+)
+ALLOWED_REQUEST_FIELDS = frozenset({"base","branch","content","create_branch","message","path","task_id","development_authorization_id","actor_identity","audience","approved_base_oid","expected_current_head_oid","operation_id","idempotency_key","exact_path","content_digest","commit_message_digest"})
+
+
+class RouteError(RuntimeError):
+    def __init__(self, code: str, status: int = 400, **details: Any):
+        super().__init__(code)
+        self.code = code
+        self.status = status
+        self.details = details
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def canonical_json(value: Any) -> bytes:
+    return json.dumps(
+        value, ensure_ascii=False, sort_keys=True, separators=(",", ":")
+    ).encode("utf-8")
+
+
+def load_root_managed_json(
+    path: Path, *, expected_mode: int = 0o640
+) -> tuple[dict[str, Any], bytes]:
+    info = os.lstat(path)
+    if stat.S_ISLNK(info.st_mode) or not stat.S_ISREG(info.st_mode):
+        raise RouteError("writer_route_config_type_rejected", 503)
+    if info.st_uid != 0 or stat.S_IMODE(info.st_mode) & ~expected_mode:
+        raise RouteError("writer_route_config_permissions_rejected", 503)
+    raw = path.read_bytes()
+    try:
+        value = json.loads(raw)
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        raise RouteError("writer_route_config_json_rejected", 503) from None
+    if not isinstance(value, dict):
+        raise RouteError("writer_route_config_object_required", 503)
+    return value, raw
+
+
+def load_binding() -> dict[str, Any]:
+    binding, _ = load_root_managed_json(CONFIG_PATH)
+    required = {
+        "schema_version",
+        "task_id",
+        "writer_instance_id",
+        "repository",
+        "branch",
+        "approved_base_oid",
+        "writer_url",
+        "path_policy_sha256",
+        "action_identities",
+    }
+    if set(binding) != required or binding.get("schema_version") != 1:
+        raise RouteError("writer_route_binding_schema_rejected", 503)
+    if binding["task_id"] != EXPECTED_TASK_ID:
+        raise RouteError("writer_route_task_binding_rejected", 503)
+    if binding["repository"] != "aios/aios":
+        raise RouteError("writer_route_repository_rejected", 503)
+    if not OID_RE.fullmatch(str(binding["approved_base_oid"])):
+        raise RouteError("writer_route_base_oid_rejected", 503)
+    if binding["writer_url"] != "http://127.0.0.1:19893":
+        raise RouteError("writer_route_upstream_rejected", 503)
+    identities = binding.get("action_identities")
+    if not isinstance(identities, list) or len(identities) != 1:
+        raise RouteError("writer_route_action_identity_rejected", 503)
+    identity = identities[0]
+    if (
+        not isinstance(identity, dict)
+        or set(identity) != {"account", "token_sha256"}
+        or identity.get("account") != "chatgpt-gitops-bot"
+        or not re.fullmatch(
+            r"[0-9a-f]{64}", str(identity.get("token_sha256", ""))
+        )
+    ):
+        raise RouteError("writer_route_action_identity_rejected", 503)
+    return binding
+
+
+def allowed_path_scope(binding: dict[str, Any]) -> tuple[set[str], tuple[str, ...]]:
+    policy, raw = load_root_managed_json(POLICY_PATH)
+    actual = hashlib.sha256(raw).hexdigest()
+    if actual != binding["path_policy_sha256"]:
+        raise RouteError("writer_route_path_policy_digest_mismatch", 503)
+    if policy.get("allowed_branch") != binding["branch"]:
+        raise RouteError("writer_route_path_policy_branch_mismatch", 503)
+    operation = (policy.get("allowed_operations") or {}).get("commit_file.atomic")
+    paths = operation.get("exact_paths") if isinstance(operation, dict) else None
+    prefixes = operation.get("prefix_paths") if isinstance(operation, dict) else None
+    if not isinstance(paths, list) or not paths or not all(
+        isinstance(x, str) for x in paths
+    ):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    if not isinstance(prefixes, list) or not prefixes or not all(
+        isinstance(x, str) and x.endswith("/") for x in prefixes
+    ):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    if any(not valid_relative_path(x[:-1]) for x in prefixes):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    if any(not valid_relative_path(x) for x in paths):
+        raise RouteError("writer_route_path_policy_rejected", 503)
+    return set(paths), tuple(prefixes)
+
+
+def valid_relative_path(path: str) -> bool:
+    if not isinstance(path, str) or not path or path != path.strip():
+        return False
+    if "\x00" in path or "\\" in path:
+        return False
+    try:
+        decoded = urllib.parse.unquote(path, errors="strict")
+    except (UnicodeDecodeError, ValueError):
+        return False
+    if decoded != path:
+        return False
+    posix = PurePosixPath(path)
+    windows = PureWindowsPath(path)
+    return not (
+        posix.is_absolute()
+        or windows.is_absolute()
+        or bool(windows.drive)
+        or any(part in {"", ".", ".."} for part in path.split("/"))
+    )
+
+
+def path_allowed(binding: dict[str, Any], path: str) -> bool:
+    if not valid_relative_path(path):
+        return False
+    exact_paths, prefixes = allowed_path_scope(binding)
+    return path in exact_paths or any(path.startswith(prefix) for prefix in prefixes)
+
+
+def bearer(headers: Any) -> str:
+    value = headers.get("Authorization", "")
+    if not value.startswith("Bearer "):
+        raise RouteError("unauthorized", 401)
+    token = value[7:].strip()
+    if not token:
+        raise RouteError("unauthorized", 401)
+    return token
+
+
+def authorize_action(headers: Any, binding: dict[str, Any]) -> str:
+    digest = hashlib.sha256(bearer(headers).encode("utf-8")).hexdigest()
+    identity = binding["action_identities"][0]
+    if not hmac.compare_digest(identity["token_sha256"], digest):
+        known, _ = load_root_managed_json(KNOWN_IDENTITIES_PATH)
+        identities = known.get("identities")
+        if known.get("schema_version") != 1 or not isinstance(identities, list):
+            raise RouteError("writer_route_identity_catalog_rejected", 503)
+        observed = "unregistered"
+        allowed_accounts = {
+            "chatgpt-gitops-bot",
+            "gitops-write-bot",
+            "codex-gitops-bot",
+        }
+        for candidate in identities:
+            if not isinstance(candidate, dict) or set(candidate) != {
+                "account",
+                "token_sha256",
+            }:
+                raise RouteError("writer_route_identity_catalog_rejected", 503)
+            account = str(candidate.get("account", ""))
+            token_sha256 = str(candidate.get("token_sha256", ""))
+            if account not in allowed_accounts or not re.fullmatch(
+                r"[0-9a-f]{64}", token_sha256
+            ):
+                raise RouteError("writer_route_identity_catalog_rejected", 503)
+            if hmac.compare_digest(token_sha256, digest):
+                observed = account
+        raise RouteError(
+            "writer_route_action_identity_rejected",
+            403,
+            accepted_action_identity=str(identity["account"]),
+            observed_action_identity=observed,
+            identity_alias_accepted=False,
+        )
+    return str(identity["account"])
+
+
+def authorization_call(operation: str, **payload: Any) -> dict[str, Any]:
+    request = {"op": operation, **payload}
+    try:
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
+            client.settimeout(15)
+            client.connect(str(AUTHORIZATION_SOCKET))
+            client.sendall(canonical_json(request))
+            raw = client.recv(131072)
+        response = json.loads(raw.decode("utf-8"))
+    except (OSError, TimeoutError, UnicodeDecodeError, json.JSONDecodeError):
+        raise RouteError("authorization_controller_unavailable", 503) from None
+    if not isinstance(response, dict) or not response.get("ok"):
+        if not isinstance(response, dict):
+            raise RouteError("authorization_controller_response_rejected", 503)
+        details = {k: v for k, v in response.items() if k not in {"ok", "status", "error"}}
+        raise RouteError(str(response.get("error") or "authorization_controller_rejected"), int(response.get("status") or 503), **details)
+    result = response.get("result")
+    if not isinstance(result, dict):
+        raise RouteError("authorization_controller_response_rejected", 503)
+    return result
+
+
+def writer_token() -> str:
+    value = authorization_call("get_writer_token").get("token")
+    if not isinstance(value, str) or len(value.encode("utf-8")) < 32:
+        raise RouteError("writer_route_credential_rejected", 503)
+    return value
+
+
+def writer_call(
+    binding: dict[str, Any],
+    method: str,
+    path: str,
+    payload: dict[str, Any] | None = None,
+) -> tuple[int, dict[str, Any]]:
+    data = canonical_json(payload) if payload is not None else None
+    headers = {"Authorization": "Bearer " + writer_token()}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    request = urllib.request.Request(
+        binding["writer_url"] + path, data=data, method=method, headers=headers
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=90) as response:
+            body = json.loads(response.read())
+            return response.status, body
+    except urllib.error.HTTPError as exc:
+        try:
+            body = json.loads(exc.read())
+        except Exception:
+            body = {"error": "writer_route_upstream_non_json_error"}
+        return exc.code, body
+    except (OSError, TimeoutError):
+        raise RouteError("writer_route_upstream_unavailable", 503) from None
+
+
+def validate_request(data: Any, binding: dict[str, Any]) -> dict[str, Any]:
+    if not isinstance(data, dict):
+        raise RouteError("writer_route_request_object_required")
+    if not {"branch", "path", "content"}.issubset(data):
+        raise RouteError("writer_route_request_incomplete")
+    if not set(data).issubset(ALLOWED_REQUEST_FIELDS):
+        raise RouteError("writer_route_request_fields_rejected")
+    if data["branch"] != binding["branch"]:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if data.get("create_branch") not in (None, False):
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if data.get("base", "main") not in {"main", binding["approved_base_oid"]}:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    path = data["path"]
+    if not isinstance(path, str) or not path_allowed(binding, path):
+        raise RouteError("writer_route_request_binding_failed", 403)
+    content = data["content"]
+    if not isinstance(content, str) or "\x00" in content or "\r" in content:
+        raise RouteError("writer_route_content_rejected")
+    if len(content.encode("utf-8")) > 1_048_576:
+        raise RouteError("writer_route_content_too_large", 413)
+    if SECRET_RE.search(content) or SECRET_VALUE_RE.search(content):
+        raise RouteError("writer_route_secret_content_rejected", 403)
+    message = data.get("message") or f"chore(chatgpt): update {path}"
+    if not isinstance(message, str) or not 1 <= len(message) <= 200 or "\x00" in message or "\n" in message or "\r" in message:
+        raise RouteError("writer_route_message_rejected")
+    return {"branch": binding["branch"], "path": path, "content": content, "message": message}
+
+
+def complete_request(data: dict[str, Any], normalized: dict[str, Any], binding: dict[str, Any], account: str) -> dict[str, Any]:
+    authorization = authorization_call("describe_authorization")
+    expected = {
+        "task_id": binding["task_id"],
+        "development_authorization_id": authorization.get("development_authorization_id"),
+        "actor_identity": account,
+        "audience": authorization.get("audience"),
+        "branch": binding["branch"],
+        "approved_base_oid": binding["approved_base_oid"],
+    }
+    required = {
+        "task_id": EXPECTED_TASK_ID,
+        "development_authorization_id": "authz-aios-autonomous-release-20260726",
+        "actor_identity": "chatgpt-gitops-bot",
+        "audience": "chatgpt-autonomous-release-writer",
+        "branch": binding["branch"],
+        "approved_base_oid": binding["approved_base_oid"],
+    }
+    if expected != required or authorization.get("authorization_status") != "ACTIVE" or authorization.get("current_head_oid") is None:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    for key, value in required.items():
+        if key in data and data[key] != value:
+            raise RouteError("writer_route_request_binding_failed", 403)
+    if "exact_path" in data and data["exact_path"] != normalized["path"]:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    current_head = str(authorization["current_head_oid"])
+    if not OID_RE.fullmatch(current_head):
+        raise RouteError("authorization_current_head_rejected", 503)
+    if "expected_current_head_oid" in data and data["expected_current_head_oid"] != current_head:
+        raise RouteError("BRANCH_HEAD_CHANGED", 409, current_head_oid=current_head)
+    content_digest = hashlib.sha256(normalized["content"].encode("utf-8")).hexdigest()
+    message_digest = hashlib.sha256(normalized["message"].encode("utf-8")).hexdigest()
+    if "content_digest" in data and data["content_digest"] != content_digest:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if "commit_message_digest" in data and data["commit_message_digest"] != message_digest:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    seed = {**required, "expected_current_head_oid": current_head, "path": normalized["path"], "content_digest": content_digest, "commit_message_digest": message_digest}
+    request_digest = hashlib.sha256(canonical_json(seed)).hexdigest()
+    idempotency_key = "action-" + request_digest
+    operation_id = hashlib.sha256((EXPECTED_TASK_ID + "\0" + idempotency_key).encode("utf-8")).hexdigest()
+    if "idempotency_key" in data and data["idempotency_key"] != idempotency_key:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    if "operation_id" in data and data["operation_id"] != operation_id:
+        raise RouteError("writer_route_request_binding_failed", 403)
+    return {**normalized, **required, "expected_current_head_oid": current_head, "operation_id": operation_id, "idempotency_key": idempotency_key, "exact_path": normalized["path"], "content_digest": content_digest, "commit_message_digest": message_digest, "request_digest": request_digest}
+
+
+def current_writer_head(binding: dict[str, Any]) -> str:
+    status, body = writer_call(binding, "GET", "/api/runtime-status")
+    if status != 200:
+        raise RouteError(
+            "writer_route_runtime_status_failed", 503, upstream_status=status
+        )
+    required = {
+        "service": "chatgpt-autonomous-release-writer",
+        "writes_enabled": True,
+        "allowed_branch": binding["branch"],
+        "approved_base_oid": binding["approved_base_oid"],
+        "path_policy_sha256": binding["path_policy_sha256"],
+    }
+    if any(body.get(key) != value for key, value in required.items()):
+        raise RouteError("writer_route_runtime_binding_mismatch", 503)
+    head = str(body.get("workspace_head_oid", ""))
+    if not OID_RE.fullmatch(head):
+        raise RouteError("writer_route_runtime_head_rejected", 503)
+    return head
+
+
+def operation_binding(
+    request_digest: str, binding: dict[str, Any]
+) -> tuple[str, str]:
+    STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
+    with sqlite3.connect(STATE_PATH, timeout=30, isolation_level=None) as db:
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        db.execute(
+            """
+            CREATE TABLE IF NOT EXISTS action_operations (
+                request_digest TEXT PRIMARY KEY,
+                expected_head_oid TEXT NOT NULL,
+                idempotency_key TEXT NOT NULL UNIQUE,
+                created_at TEXT NOT NULL
+            )
+            """
+        )
+        row = db.execute(
+            "SELECT expected_head_oid,idempotency_key FROM action_operations "
+            "WHERE request_digest=?",
+            (request_digest,),
+        ).fetchone()
+        if row:
+            return str(row[0]), str(row[1])
+    head = current_writer_head(binding)
+    key = "action-" + request_digest
+    with sqlite3.connect(STATE_PATH, timeout=30, isolation_level=None) as db:
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        db.execute("BEGIN IMMEDIATE")
+        db.execute(
+            "INSERT OR IGNORE INTO action_operations"
+            "(request_digest,expected_head_oid,idempotency_key,created_at) "
+            "VALUES(?,?,?,?)",
+            (request_digest, head, key, utc_now()),
+        )
+        row = db.execute(
+            "SELECT expected_head_oid,idempotency_key FROM action_operations "
+            "WHERE request_digest=?",
+            (request_digest,),
+        ).fetchone()
+        db.execute("COMMIT")
+    return str(row[0]), str(row[1])
+
+
+def append_audit(event: dict[str, Any]) -> None:
+    AUDIT_PATH.parent.mkdir(parents=True, exist_ok=True)
+    flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND | getattr(os, "O_NOFOLLOW", 0)
+    fd = os.open(AUDIT_PATH, flags, 0o600)
+    try:
+        os.write(fd, canonical_json(event) + b"\n")
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "AIOSActionTaskRouter/1"
+
+    def log_message(self, _format: str, *_args: Any) -> None:
+        return
+
+    def send_json(self, status: int, value: dict[str, Any]) -> None:
+        body = json.dumps(value, ensure_ascii=False, sort_keys=True).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self) -> None:
+        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+        if path != "/health":
+            return self.send_json(404, {"error": "not_found"})
+        try:
+            binding = load_binding()
+            self.send_json(
+                200,
+                {
+                    "status": "ok",
+                    "service": "aios-action-task-router",
+                    "task_id": binding["task_id"],
+                    "writer_instance_id": binding["writer_instance_id"],
+                    "branch": binding["branch"],
+                },
+            )
+        except RouteError as exc:
+            self.send_json(exc.status, {"error": exc.code, **exc.details})
+
+    def do_POST(self) -> None:
+        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+        if path != "/api/file":
+            return self.send_json(404, {"error": "not_found"})
+        if self.client_address[0] not in {"127.0.0.1", "::1"}:
+            return self.send_json(403, {"error": "writer_route_source_rejected"})
+        if self.headers.get("X-AIOS-Route-Task") != EXPECTED_ROUTE_HEADER:
+            return self.send_json(403, {"error": "writer_route_header_rejected"})
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+            if not 0 < length <= 1_100_000:
+                raise RouteError("writer_route_content_length_rejected", 413)
+            try:
+                data = json.loads(self.rfile.read(length).decode("utf-8"))
+            except (UnicodeDecodeError, json.JSONDecodeError):
+                raise RouteError("writer_route_request_json_rejected") from None
+            binding = load_binding()
+            account = authorize_action(self.headers, binding)
+            normalized = validate_request(data, binding)
+            normalized = complete_request(data, normalized, binding, account)
+            prepared = authorization_call("prepare_write", request={key: normalized[key] for key in ("expected_current_head_oid", "operation_id", "idempotency_key", "exact_path", "content_digest", "commit_message_digest", "branch", "path", "message")})
+            expected_head = str(prepared["expected_head_oid"])
+            writer_payload = {"branch": normalized["branch"], "path": normalized["path"], "content": normalized["content"], "message": normalized["message"], "expected_head_oid": expected_head, "idempotency_key": str(prepared["idempotency_key"])}
+            request_digest = hashlib.sha256(canonical_json({"task_id": binding["task_id"], "operation_id": normalized["operation_id"], "idempotency_key": normalized["idempotency_key"], "content_digest": normalized["content_digest"], "commit_message_digest": normalized["commit_message_digest"]})).hexdigest()
+            status, result = writer_call(
+                binding, "POST", "/api/commit-file", writer_payload
+            )
+            audit = {
+                "at": utc_now(),
+                "task_id": binding["task_id"],
+                "writer_instance_id": binding["writer_instance_id"],
+                "account": account,
+                "branch": normalized["branch"],
+                "path": normalized["path"],
+                "request_digest": request_digest,
+                "expected_head_oid": expected_head,
+                "status": status,
+                "operation_id": result.get("operation_id"),
+                "commit_oid": result.get("commit_oid"),
+                "error": result.get("error"),
+                "secrets_included": False,
+            }
+            append_audit(audit)
+            if status != 200:
+                try:
+                    authorization_call("fail_write", result={"operation_id": normalized["operation_id"]})
+                except RouteError:
+                    pass
+                return self.send_json(status, result)
+            advanced = authorization_call("reconcile_commit", result={"previous_head_oid": expected_head, "new_commit_oid": result.get("commit_oid"), "operation_id": result.get("operation_id")})
+            return self.send_json(
+                200,
+                {
+                    "status": "committed",
+                    "branch": normalized["branch"],
+                    "path": normalized["path"],
+                    "commit": {
+                        "status": "committed",
+                        "branch": normalized["branch"],
+                        "rev": result.get("commit_oid"),
+                        "previous_head_oid": expected_head,
+                        "new_tree_oid": result.get("new_tree_oid"),
+                        "push_status": result.get("push_status"),
+                        "four_way_ref_status": advanced.get("four_way_ref_status") is True,
+                        "sync": {"status": "verified", "target": "bare+git-ls-remote+gitea-api"},
+                    },
+                    "writer_instance_id": binding["writer_instance_id"],
+                    "operation_id": result.get("operation_id"),
+                    "idempotent": result.get("idempotent"),
+                    "secrets_included": False,
+                },
+            )
+        except RouteError as exc:
+            if exc.code == "writer_route_action_identity_rejected":
+                try:
+                    append_audit(
+                        {
+                            "at": utc_now(),
+                            "task_id": EXPECTED_TASK_ID,
+                            "event": "action_identity_rejected",
+                            "accepted_action_identity": exc.details.get(
+                                "accepted_action_identity"
+                            ),
+                            "observed_action_identity": exc.details.get(
+                                "observed_action_identity"
+                            ),
+                            "identity_alias_accepted": False,
+                            "secrets_included": False,
+                        }
+                    )
+                except Exception:
+                    pass
+            self.send_json(exc.status, {"error": exc.code, **exc.details})
+        except Exception:
+            self.send_json(500, {"error": "writer_route_internal_error"})
+
+
+def main() -> None:
+    load_binding()
+    server = ThreadingHTTPServer((HOST, PORT), Handler)
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()

active-runtime/app/aios_chatgpt_actions_api.py

@@ -5,8 +5,59 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
 
-sys.path.insert(0, str(Path(os.getenv('AIOS_GITOPS_WORKSPACE', '/data/aios-gitops/workspace')) / 'runtime' / 'agent-os'))
+try:
+    from aios_gitops_write_guard import evaluate_git_write
+except ModuleNotFoundError:
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+    from aios_gitops_write_guard import evaluate_git_write
+
+from gitea_tag_publication import (
+    GiteaTagClient,
+    GitTagBackend,
+    PublicationConflict,
+    PublicationPending,
+    PublicationManualOwnerReviewRequired,
+    PublicationReconciliationRequired,
+    PublicationRequest,
+    TagPublisher,
+    redact,
+    validate_version,
+)
 from orchestrator.action_monitor import ActionMonitor
+from silent_release_hardening import (
+    ApprovalKeyRing,
+    ApprovalRevocationStore,
+    CapabilityAuthorizationError,
+    SagaConflict,
+    SignedApprovalVerifier,
+    SignedReleasePlanApproval,
+    SilentReleaseActionService,
+)
+try:
+    from authoritative_git import (
+        AuthoritativeGitError,
+        AuthoritativeGitNotFound,
+        AuthoritativeGitOutputTooLarge,
+        authoritative_branches,
+        authoritative_diff,
+        authoritative_commit,
+        authoritative_tags,
+        repository_snapshot,
+        run_authoritative_git,
+    )
+except ModuleNotFoundError:
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+    from authoritative_git import (
+        AuthoritativeGitError,
+        AuthoritativeGitNotFound,
+        AuthoritativeGitOutputTooLarge,
+        authoritative_branches,
+        authoritative_diff,
+        authoritative_commit,
+        authoritative_tags,
+        repository_snapshot,
+        run_authoritative_git,
+    )
 
 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WS = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
@@ -16,6 +67,19 @@ HOST = os.getenv('AIOS_GITOPS_HOST', '127.0.0.1')
 PORT = int(os.getenv('AIOS_GITOPS_PORT', '18890'))
 OPENAPI = WS / 'docs' / 'gitops' / 'openapi-chatgpt-actions.yaml'
 BARE_REPO = Path(os.getenv('AIOS_GITOPS_BARE_REPO', str(ROOT / 'runtime' / 'gitea-bin' / 'data' / 'repositories' / 'aios' / 'aios.git')))
+AUTHORITATIVE_GIT_DIR = Path(os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR')) if os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR') else None
+REPOSITORY_IDENTITY = os.getenv('AIOS_GITOPS_REPOSITORY_IDENTITY', '')
+SILENT_RELEASE_STATE_ROOT = Path(os.getenv(
+    'AIOS_SILENT_RELEASE_STATE_ROOT',
+    '/var/lib/aios-gitops/silent-release',
+))
+SILENT_RELEASE_EXECUTION_ENABLED = str(os.getenv(
+    'AIOS_SILENT_RELEASE_EXECUTION_ENABLED', 'false'
+)).lower() in {'1', 'true', 'yes', 'on'}
+SILENT_RELEASE_PUBLIC_KEYS = Path(os.getenv(
+    'AIOS_SILENT_RELEASE_PUBLIC_KEYS',
+    '/etc/aios-gitops/silent-release-owner-public-keys.json',
+))
 monitor = ActionMonitor()
 
 BASE_MODELS = [
@@ -24,7 +88,43 @@ BASE_MODELS = [
   {'id':'base.gpt-5.5','provider':'openai','model':'gpt-5.5','display_name':'GPT-5.5','scope':'global'},
 ]
 SECRET_RE = re.compile(r'(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)\s*[:=]\s*["\']?([A-Za-z0-9_./+=:-]{16,})')
-SECRET_VAL_RE = re.compile(r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})')
+SECRET_VAL_RE = re.compile(
+    r'(?<![A-Za-z0-9_])'
+    r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})'
+)
+
+READ_ONLY_GET_PATHS = frozenset({
+    '/', '/health', '/api/health', '/api/openapi.yaml',
+    '/api/openapi-chatgpt-actions.yaml', '/api/schema', '/api', '/api/status',
+    '/api/base', '/api/baseline', '/base', '/api/ver', '/api/versions', '/ver',
+    '/api/diff', '/diff', '/api/patch', '/api/patches', '/api/branches', '/patch',
+    '/api/model', '/model', '/api/run', '/api/runtime-status', '/run',
+    '/api/action-monitor', '/action-monitor', '/admin/ai-evolution',
+    '/admin/ai-evolution/api/data',
+    '/api/release-consistency', '/api/tag-publication-status',
+    '/api/release-acceptance',
+    '/getReleaseCandidate', '/getReleasePlan', '/getReleaseAcceptance',
+    '/getApprovalEnvelope', '/getReleaseSaga', '/getCapabilityStatus',
+    '/getRecoveryStatus',
+})
+SILENT_RELEASE_POST_PATHS = frozenset({
+    '/createReleaseCandidate',
+    '/createReleaseIntent',
+    '/submitSignedApproval',
+    '/submitOwnerApproval',
+    '/startDeployment',
+})
+
+def reject_non_read_http(handler, method: str, path: str) -> bool:
+    if method == 'GET':
+        return False
+    if path in SILENT_RELEASE_POST_PATHS:
+        return False
+    decision = evaluate_git_write(WS)
+    if decision.allowed:
+        return False
+    handler.sendj(decision.payload(), decision.status_code)
+    return True
 
 def now() -> str: return time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())
 def uid(p='id') -> str: return f'{p}-{int(time.time()*1000)}-{uuid.uuid4().hex[:8]}'
@@ -36,6 +136,41 @@ def sh(args, check=False):
 def jload(p: Path, default):
     try: return json.loads(p.read_text(encoding='utf-8'))
     except Exception: return default
+
+def _file_sha256(path: Path) -> str:
+    digest=hashlib.sha256()
+    with path.open('rb') as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b''):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+def _build_silent_release_service() -> SilentReleaseActionService:
+    verifier=None
+    if SILENT_RELEASE_PUBLIC_KEYS.is_file():
+        verifier=SignedApprovalVerifier(
+            ApprovalKeyRing.from_file(SILENT_RELEASE_PUBLIC_KEYS),
+            ApprovalRevocationStore(
+                SILENT_RELEASE_STATE_ROOT / 'revocations'
+            ),
+        )
+    policy_path=WS / 'config' / 'gitops' / 'silent-release-policy.json'
+    policy_sha=_file_sha256(policy_path) if policy_path.is_file() else ''
+    return SilentReleaseActionService(
+        SILENT_RELEASE_STATE_ROOT,
+        execution_enabled=SILENT_RELEASE_EXECUTION_ENABLED,
+        approval_verifier=verifier,
+        expected_repository=REPOSITORY_IDENTITY,
+        policy_sha256=policy_sha,
+    )
+
+# Construct once during service startup. If production execution is enabled
+# without every trusted builder/orchestrator dependency, construction fails
+# closed before the HTTP server accepts traffic.
+_SILENT_RELEASE_SERVICE = _build_silent_release_service()
+
+
+def silent_release_service() -> SilentReleaseActionService:
+    return _SILENT_RELEASE_SERVICE
 def relpath(path: str) -> str:
     x = str(path or '').replace('\\','/').strip()
     if not x or x.startswith('/') or '..' in Path(x).parts or Path(x).parts[0] == '.git': raise ValueError('invalid path')
@@ -109,9 +244,13 @@ def ensure_git():
     if not sh(['config','user.name'])['stdout']: sh(['config','user.name','chatgpt-gitops-bot'], True)
 def checkout(branch, base='main', create=False):
     ensure_git(); b=branch_name(branch)
-    if create or sh(['rev-parse','--verify',b])['code'] != 0:
-        sh(['checkout',base], True); sh(['checkout','-B',b], True)
-    else: sh(['checkout',b], True)
+    exists = sh(['rev-parse','--verify',f'refs/heads/{b}'])['code'] == 0
+    if exists:
+        sh(['checkout',b], True)
+    elif create:
+        sh(['checkout',base], True); sh(['checkout','-b',b], True)
+    else:
+        raise ValueError(f'branch does not exist: {b}')
     return b
 def write_file(path, content):
     if content_has_secret(content): raise ValueError('secret_rejected: use secret_ref; plaintext API keys must not enter Git')
@@ -121,6 +260,19 @@ def sync_branch(branch: str) -> dict:
     if not branch or branch in ('main','master') or branch.startswith('main/') or branch.startswith('master/'):
         return {'status':'skipped','reason':'protected_branch','branch':branch}
     if BARE_REPO.exists():
+        common = sh(['rev-parse', '--path-format=absolute', '--git-common-dir'], True)['stdout']
+        if Path(common).resolve() == BARE_REPO.resolve():
+            head = sh(['rev-parse', 'HEAD'], True)['stdout']
+            stored = subprocess.run(
+                ['git', '--git-dir', str(BARE_REPO), 'rev-parse', f'refs/heads/{branch}'],
+                text=True, capture_output=True,
+            )
+            if stored.returncode != 0 or stored.stdout.strip() != head:
+                raise RuntimeError(f'linked-worktree branch verification failed for {branch}')
+            return {
+                'status':'verified', 'target':'authoritative-bare',
+                'branch':branch, 'oid':head,
+            }
         ref=f'refs/heads/{branch}:refs/heads/{branch}'
         p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
         if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git sync failed for {branch}')
@@ -130,15 +282,68 @@ def sync_branch(branch: str) -> dict:
     return {'status':'synced','target':'origin','branch':branch,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
 
 def sync_tag(tag: str) -> dict:
-    if not tag: return {'status':'skipped','reason':'empty_tag'}
-    if BARE_REPO.exists():
-        ref=f'refs/tags/{tag}:refs/tags/{tag}'
-        p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
-        if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag sync failed for {tag}')
-        return {'status':'synced','target':'bare','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
-    p=subprocess.run(['git','push','origin',tag], cwd=str(WS), text=True, capture_output=True)
-    if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag push failed for {tag}')
-    return {'status':'synced','target':'origin','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
+    raise RuntimeError(
+        'unsafe sync_tag disabled: use TagPublisher with expected tag_oid, '
+        'target_oid, Gitea remote verification, and authenticated API verification'
+    )
+
+def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
+    oid = str(value or '').strip().lower()
+    if not re.fullmatch(r'[0-9a-f]{40}', oid):
+        raise ValueError(f'{field} must be a full 40-character commit OID')
+    try:
+        return authoritative_commit(oid, git_dir=AUTHORITATIVE_GIT_DIR)
+    except (AuthoritativeGitError, ValueError) as exc:
+        raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
+
+def existing_tag_target(tag: str) -> str | None:
+    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
+        raise ValueError('invalid release version')
+    try:
+        result = run_authoritative_git(
+            ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
+            check=False,
+            git_dir=AUTHORITATIVE_GIT_DIR,
+        )
+    except AuthoritativeGitError as exc:
+        raise RuntimeError(str(exc)) from exc
+    return result.stdout.strip() if result.returncode == 0 else None
+
+def publication_request_from_query(q: dict[str, list[str]]) -> PublicationRequest:
+    required = ('version', 'target_oid', 'evidence_closure_oid', 'approval_plan_id')
+    missing = [name for name in required if not (q.get(name) or [''])[0]]
+    if missing:
+        raise ValueError('missing release governance fields: ' + ', '.join(missing))
+    return PublicationRequest(
+        (q['version'])[0],
+        (q['target_oid'])[0].lower(),
+        (q['evidence_closure_oid'])[0].lower(),
+        (q['approval_plan_id'])[0],
+    )
+
+def required_authoritative_git_dir() -> Path:
+    snapshot = repository_snapshot(
+        git_dir=AUTHORITATIVE_GIT_DIR,
+        repository_identity=REPOSITORY_IDENTITY,
+    )
+    if not snapshot["repository_available"]:
+        raise RuntimeError(str(snapshot["query_error"] or "AUTHORITATIVE_REPOSITORY_UNAVAILABLE"))
+    return Path(str(snapshot["authoritative_git_dir"]))
+
+
+def publication_publisher() -> TagPublisher:
+    authoritative_repo = required_authoritative_git_dir()
+    return TagPublisher(
+        WS,
+        GitTagBackend(WS, authoritative_repo=authoritative_repo),
+        GiteaTagClient(
+            os.getenv('AIOS_GITOPS_GITEA_API_URL',''),
+            os.getenv('AIOS_GITOPS_GITEA_REPOSITORY',''),
+            Path(os.getenv('AIOS_GITOPS_GITEA_TOKEN_FILE','')),
+            token_line=int(os.getenv('AIOS_GITOPS_GITEA_TOKEN_LINE','1')),
+        ),
+        os.getenv('AIOS_GITOPS_GITEA_REMOTE','gitea'),
+    )
 
 def commit(paths, msg):
     ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
@@ -158,6 +363,16 @@ def patches():
     for p in sorted((WS/'patches').glob('**/*.json')): out.append(jload(p, {'path':str(p.relative_to(WS))}))
     return out
 
+def runtime_release_info() -> dict[str, Any]:
+    for candidate in (WS / 'manifest.json', WS.parent / 'manifest.json'):
+        data = jload(candidate, {})
+        if data.get('target_commit'):
+            return {
+                'runtime_release_commit': data.get('target_commit'),
+                'runtime_release_path': str(WS),
+            }
+    return {'runtime_release_commit': None, 'runtime_release_path': str(WS)}
+
 class H(BaseHTTPRequestHandler):
     server_version='AIOSChatGPTGitOps/V1R1C0'
     def sendj(self, data, code=200):
@@ -179,43 +394,236 @@ class H(BaseHTTPRequestHandler):
         if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
         return a
     def do_GET(self):
-        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path; q=urllib.parse.parse_qs(u.query)
+        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
+        if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
+        q=urllib.parse.parse_qs(u.query)
         try:
             if path in ('/health','/api/health'): return self.sendj({'status':'ok','service':'chatgpt-gitops-adapter','workspace':str(WS)})
             if path in ('/api/openapi.yaml','/api/openapi-chatgpt-actions.yaml','/api/schema'):
                 return self.sendt(OPENAPI.read_text(encoding='utf-8'), 'application/yaml; charset=utf-8') if OPENAPI.exists() else self.sendj({'error':'schema_missing'},404)
             if path in ('/api','/api/status'): return self.sendj(api_spec())
             if path in ('/api/base','/api/baseline','/base'):
-                data=jload(WS/'baseline'/'current.json', {}); data.setdefault('git', sh(['rev-parse','--short','HEAD'])['stdout']); return self.sendj(data)
+                data=jload(WS/'baseline'/'current.json', {})
+                data.setdefault('authoritative_repository', repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                ))
+                return self.sendj(data)
             if path in ('/api/ver','/api/versions','/ver'):
-                return self.sendj({'tags':sh(['tag','--list','V*'])['stdout'].splitlines(),'versions_dir':[p.name for p in (WS/'versions').glob('*')],'head':sh(['rev-parse','--short','HEAD'])['stdout']})
+                snapshot = repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                )
+                if not snapshot['repository_available']:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': snapshot['query_error'],
+                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
+                        'local_authoritative_tags': [],
+                    }, 503)
+                try:
+                    tags = authoritative_tags(git_dir=AUTHORITATIVE_GIT_DIR)
+                except AuthoritativeGitError as exc:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': str(exc),
+                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
+                        'local_authoritative_tags': [],
+                    }, 503)
+                registry = [p.name for p in (WS/'versions').glob('*')]
+                return self.sendj({
+                    'registry_versions': registry,
+                    'local_authoritative_tags': tags,
+                    'repository_available': True,
+                    'query_error': None,
+                    'tags': [item['name'] for item in tags],
+                    'versions_dir': registry,
+                    'head': snapshot['authoritative_head_oid'],
+                    'authoritative_head_oid': snapshot['authoritative_head_oid'],
+                })
             if path in ('/api/diff','/diff'):
-                frm=(q.get('from') or ['HEAD~1'])[0]; to=(q.get('to') or ['HEAD'])[0]; return self.sendj({'from':frm,'to':to,'diff':sh(['diff',frm,to])})
-            if path in ('/api/patch','/api/patches','/api/branches','/patch'): return self.sendj({'patches':patches(),'branches':sh(['branch','--format','%(refname:short)'])['stdout'].splitlines()})
+                frm=(q.get('from') or [''])[0]
+                to=(q.get('to') or [''])[0]
+                try:
+                    diff=authoritative_diff(frm, to, git_dir=required_authoritative_git_dir())
+                except ValueError as exc:
+                    return self.sendj({'error':redact(exc)},400)
+                except AuthoritativeGitNotFound as exc:
+                    return self.sendj({'error':redact(exc)},404)
+                except AuthoritativeGitOutputTooLarge as exc:
+                    return self.sendj({'error':redact(exc)},413)
+                except (AuthoritativeGitError, RuntimeError) as exc:
+                    return self.sendj({'error':redact(exc)},503)
+                return self.sendj({'from':frm,'to':to,'diff':diff})
+            if path in ('/api/patch','/api/patches','/api/branches','/patch'):
+                snapshot = repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                )
+                if not snapshot['repository_available']:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': snapshot['query_error'],
+                        'metadata_patches': patches(),
+                        'authoritative_branches': [],
+                    }, 503)
+                try:
+                    branches = authoritative_branches(git_dir=AUTHORITATIVE_GIT_DIR)
+                except AuthoritativeGitError as exc:
+                    return self.sendj({
+                        'repository_available': False,
+                        'query_error': str(exc),
+                        'metadata_patches': patches(),
+                        'authoritative_branches': [],
+                    }, 503)
+                metadata = patches()
+                branch_names = {item['name'] for item in branches}
+                metadata_names = {
+                    item.get('branch') for item in metadata
+                    if isinstance(item, dict) and item.get('branch')
+                }
+                orphan = [
+                    item for item in metadata
+                    if item.get('branch') and item.get('branch') not in branch_names
+                ]
+                missing = [
+                    item for item in branches
+                    if item['name'] not in metadata_names
+                ]
+                return self.sendj({
+                    'metadata_patches': metadata,
+                    'authoritative_branches': branches,
+                    'orphan_metadata': orphan,
+                    'branches_without_metadata': missing,
+                    'repository_available': True,
+                    'query_error': None,
+                    'patches': metadata,
+                    'branches': [item['name'] for item in branches],
+                })
             if path in ('/api/model','/model'): return self.sendj({'base':BASE_MODELS,'custom':model_docs(),'priority':[jload(p,{}) for p in sorted((WS/'config'/'model_priority').glob('*.json'))]})
             if path in ('/api/run','/api/runtime-status','/run'):
                 svc=subprocess.run(['systemctl','is-active','aios-gitops-model-api'], text=True, capture_output=True)
-                return self.sendj({'service':'aios-gitops-model-api','status':svc.stdout.strip() or svc.stderr.strip(),'workspace_branch':sh(['rev-parse','--abbrev-ref','HEAD'])['stdout']})
+                snapshot = repository_snapshot(
+                    git_dir=AUTHORITATIVE_GIT_DIR,
+                    repository_identity=REPOSITORY_IDENTITY,
+                )
+                workspace_branch = None
+                if (WS / '.git').exists():
+                    result = sh(['rev-parse','--abbrev-ref','HEAD'])
+                    workspace_branch = result['stdout'] or None
+                payload = {
+                    'service':'aios-gitops-model-api',
+                    'status':svc.stdout.strip() or svc.stderr.strip(),
+                    'workspace_branch':workspace_branch,
+                    **runtime_release_info(),
+                    **snapshot,
+                    'writes_enabled': str(os.getenv('AIOS_GITOPS_WRITES_ENABLED','false')).lower() in {'1','true','yes','on'},
+                }
+                return self.sendj(payload, 200 if snapshot['repository_available'] else 503)
             if path in ('/api/action-monitor','/action-monitor'):
                 latest=monitor.latest()
                 ldict={'event_id':latest.event_id,'action':latest.action,'error':latest.error,'context':latest.context,'created_at':latest.created_at} if latest else None
                 return self.sendj({'events':[{"event_id":e.event_id,"action":e.action,"error":e.error,"context":e.context,"created_at":e.created_at} for e in monitor.list_events()],'latest':ldict})
+            if path == '/api/tag-publication-status':
+                version=(q.get('version') or [''])[0]
+                try:
+                    version=validate_version(version)
+                    status=publication_publisher().get_tag_publication_status(version)
+                except ValueError:
+                    return self.sendj({'error':'invalid release version'},400)
+                return self.sendj(status)
+            if path == '/api/release-consistency':
+                request=publication_request_from_query(q)
+                return self.sendj(publication_publisher().get_release_consistency(request))
+            if path == '/api/release-acceptance':
+                request=publication_request_from_query(q)
+                return self.sendj(publication_publisher().run_release_acceptance(request))
+            if path in (
+                '/getReleaseCandidate',
+                '/getReleasePlan',
+                '/getReleaseAcceptance',
+                '/getApprovalEnvelope',
+                '/getReleaseSaga',
+                '/getCapabilityStatus',
+            ):
+                candidate_id=(q.get('candidate_id') or [''])[0]
+                if not candidate_id:
+                    return self.sendj({'error':'candidate_id is required'},400)
+                service=silent_release_service()
+                if path == '/getReleaseCandidate':
+                    return self.sendj(
+                        service.get_release_candidate(candidate_id)
+                    )
+                if path == '/getApprovalEnvelope':
+                    return self.sendj(
+                        service.get_approval_envelope(candidate_id)
+                    )
+                if path == '/getReleasePlan':
+                    return self.sendj(service.get_release_plan(candidate_id))
+                if path == '/getReleaseAcceptance':
+                    return self.sendj(service.get_acceptance(candidate_id))
+                if path == '/getCapabilityStatus':
+                    return self.sendj(
+                        service.get_capability_status(candidate_id)
+                    )
+                return self.sendj(service.get_release_saga(candidate_id))
+            if path == '/getRecoveryStatus':
+                return self.sendj(
+                    silent_release_service().get_recovery_status()
+                )
                         # Admin AI Evolution Dashboard
             if path in ('/admin/ai-evolution','/admin/ai-evolution/'):
                 return self.ai_evolution_page()
             if path in ('/admin/ai-evolution/api/data'):
                 return self.ai_evolution_data()
             return self.sendj({'error':'not_found','path':path},404)
+        except FileNotFoundError:
+            return self.sendj({'error':'release candidate not found'},404)
+        except ValueError as e:
+            error=redact(e)
+            monitor.record_failure('do_GET', error, {'path':path})
+            return self.sendj({'error':error},400)
         except Exception as e:
-            monitor.record_failure('do_GET', str(e), {'path':path})
-            return self.sendj({'error':str(e)},500)
+            error=redact(e)
+            monitor.record_failure('do_GET', error, {'path':path})
+            return self.sendj({'error':error},500)
     def do_PUT(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'PUT', path): return
+        data=self.body()
         if path == '/api/model-priority': return self.model_priority(data)
         return self.sendj({'error':'not_found','path':path},404)
     def do_POST(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'POST', path): return
+        data=self.body()
         try:
+            if path == '/createReleaseCandidate':
+                a=self.need('release:candidate')
+                if not a: return
+                return self.sendj(
+                    silent_release_service().create_release_candidate(data)
+                )
+            if path == '/createReleaseIntent':
+                a=self.need('release:candidate')
+                if not a: return
+                return self.sendj(
+                    silent_release_service().create_release_intent(data)
+                )
+            if path in ('/submitOwnerApproval','/submitSignedApproval'):
+                a=self.need('release:approve')
+                if not a: return
+                return self.sendj(
+                    silent_release_service().submit_owner_approval(data)
+                )
+            if path == '/startDeployment':
+                a=self.need('release:deploy')
+                if not a: return
+                return self.sendj(
+                    silent_release_service().start_deployment(
+                        str(data.get('candidate_id') or '')
+                    )
+                )
             if path in ('/api/branch','/api/create-branch'): return self.branch(data)
             if path in ('/api/file','/api/commit-file'): return self.file(data)
             if path == '/api/commit': return self.commit(data)
@@ -226,9 +634,30 @@ class H(BaseHTTPRequestHandler):
             if path == '/api/model-priority': return self.model_priority(data)
             if path == '/api/nl': return self.nl(data)
             return self.sendj({'error':'not_found','path':path},404)
+        except (ValueError, FileNotFoundError) as e:
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},400)
+        except CapabilityAuthorizationError as e:
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},403)
+        except SagaConflict as e:
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},409)
         except Exception as e:
-            monitor.record_failure('do_POST', str(e), {'path':path})
-            return self.sendj({'error':str(e)},500)
+            error=redact(e)
+            monitor.record_failure('do_POST', error, {'path':path})
+            return self.sendj({'error':error},500)
+    def do_PATCH(self):
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'PATCH', path): return
+        return self.sendj({'error':'not_found','path':path},404)
+    def do_DELETE(self):
+        path=urllib.parse.urlparse(self.path).path.rstrip('/')
+        if reject_non_read_http(self, 'DELETE', path): return
+        return self.sendj({'error':'not_found','path':path},404)
     def branch(self,data):
         a=self.need('branch:create');
         if not a: return
@@ -252,12 +681,41 @@ class H(BaseHTTPRequestHandler):
         if not a: return
         ver=data.get('version') or data.get('tag')
         if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
-        if data.get('confirm') != True:
-            self.sendj({'status':'confirm_required','operation':'tag','hint':'This operation creates a Git tag. Confirm to proceed.','x-openai-isConsequential':True}, 428)
-            return
+        if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
+            return self.sendj({
+                'error':'production_tag_evidence_required',
+                'required':['version','target_oid','evidence_closure_oid','approval_plan_id'],
+            },400)
+        try:
+            target_oid=resolve_commit_oid(data.get('target_oid'))
+            evidence_oid=resolve_commit_oid(data.get('evidence_closure_oid'), 'evidence_closure_oid')
+        except ValueError as exc:
+            return self.sendj({'error':'invalid_tag_target','detail':str(exc)},400)
         if a['role'] != 'owner' or not data.get('execute'):
-            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'commit':c})
-        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver)})
+            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'request':req,'commit':c})
+        request=PublicationRequest(ver,target_oid,evidence_oid,str(data.get('approval_plan_id')))
+        main_before=sh(['rev-parse','refs/heads/main'], True)['stdout']
+        publisher=publication_publisher()
+        try:
+            publication=publisher.publish(request)
+        except PublicationManualOwnerReviewRequired as exc:
+            audit(a['account'],'tag_manual_owner_review_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':redact(exc)})
+            return self.sendj({'status':'MANUAL_OWNER_REVIEW_REQUIRED','error':redact(exc),'main_changed':False,'force_push':False},409)
+        except PublicationConflict as exc:
+            audit(a['account'],'tag_conflict',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
+            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},409)
+        except PublicationPending as exc:
+            audit(a['account'],'tag_pending',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
+            return self.sendj({'status':'REMOTE_PUSH_PENDING','error':str(exc),'main_changed':False,'force_push':False},503)
+        except PublicationReconciliationRequired as exc:
+            audit(a['account'],'tag_reconciliation_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
+            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},502)
+        main_after=sh(['rev-parse','refs/heads/main'], True)['stdout']
+        if main_after != main_before:
+            raise RuntimeError('main changed during tag operation')
+        result={'status':publication['state'],'version':ver,'tag_name':ver,'tag_oid':publication['tag_oid'],'target_oid':target_oid,'expected_target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'workspace_head':sh(['rev-parse','HEAD'],True)['stdout'],'main_oid_before':main_before,'main_oid_after':main_after,'main_changed':False,'force_push':False,'publication':publication}
+        audit(a['account'],'tag',ver,result)
+        self.sendj(result)
     def rollback(self,data):
         a=self.need('rollback:request');
         if not a: return
@@ -352,7 +810,10 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
         cmd_filter=(params.get('command') or [None])[0]
         bl=jload(WS/'baseline'/'current.json',{})
         current_ver=bl.get('current_baseline','V1R3C1')
-        tags=sh(['tag','--list','V*'])['stdout'].splitlines() if WS.exists() else []
+        try:
+            tags=[item['name'] for item in authoritative_tags(git_dir=required_authoritative_git_dir()) if str(item['name']).startswith('V')]
+        except (AuthoritativeGitError, RuntimeError) as exc:
+            return self.sendj({'error':redact(exc),'repository_available':False},503)
         versions=[]
         if (WS/'baseline'/'promotions').exists():
             for p in sorted((WS/'baseline'/'promotions').glob('*.json')):
@@ -390,9 +851,9 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
 
 
 def api_spec():
-    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True}}
+    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
 
 def main():
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
-if __name__ == '__main__': main()
+if __name__ == '__main__': main()

active-runtime/app/aios_gitops_write_guard.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""Fail-closed policy for in-process Git mutation handlers."""
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Mapping
+
+_TRUE = frozenset({"1", "true", "yes", "on"})
+
+
+@dataclass(frozen=True)
+class GitWriteDecision:
+    allowed: bool
+    status_code: int
+    error: str
+    reason: str
+    workspace: str
+
+    def payload(self) -> dict[str, str]:
+        return {
+            "status": "allowed" if self.allowed else "blocked",
+            "error": self.error,
+            "reason": self.reason,
+            "workspace": self.workspace,
+        }
+
+
+def _real(path: Path) -> Path:
+    return Path(os.path.realpath(os.path.abspath(str(path))))
+
+
+def evaluate_git_write(workspace: Path | str, env: Mapping[str, str] | None = None) -> GitWriteDecision:
+    values = os.environ if env is None else env
+    lexical = Path(os.path.abspath(str(workspace)))
+    canonical = _real(lexical)
+    shown = str(lexical)
+    if str(values.get("AIOS_GITOPS_WRITES_ENABLED", "false")).strip().lower() not in _TRUE:
+        return GitWriteDecision(False, 423, "gitops_writes_disabled", "AIOS_GITOPS_WRITES_ENABLED is false", shown)
+    if lexical != canonical:
+        return GitWriteDecision(False, 409, "workspace_symlink_forbidden", "workspace must be a canonical non-symlink path", shown)
+    controller = _real(Path(values.get("AIOS_GITOPS_CONTROLLER_PATH", "/data/aios-gitops/worktrees/controller")))
+    role = str(values.get("AIOS_GITOPS_WORKSPACE_ROLE", "")).strip().lower()
+    if canonical == controller or role == "runtime-anchor":
+        return GitWriteDecision(False, 423, "runtime_anchor_read_only", "controller/runtime-anchor is read-only", str(canonical))
+    writer_root = _real(Path(values.get("AIOS_GITOPS_APPROVED_WRITER_ROOT", "/data/aios-gitops/worktrees")))
+    try:
+        canonical.relative_to(writer_root)
+    except ValueError:
+        return GitWriteDecision(False, 409, "workspace_not_approved_writer", "workspace is outside the approved writer root", str(canonical))
+    return GitWriteDecision(True, 200, "", "approved isolated writer", str(canonical))

active-runtime/app/aios_isolated_writer_api.py

@@ -0,0 +1,316 @@
+"""Task-scoped hardened wrapper around the existing Action API."""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+from pathlib import Path
+import urllib.parse
+
+import aios_chatgpt_actions_api as api
+import aios_isolated_writer_policy as policy
+from isolated_writer_authz import AuthorizationError, authorize
+from isolated_writer_commit_file import AtomicCommitFile, CommitFileError, OperationLedger
+from isolated_writer_token_registry import TokenRegistry
+
+_reject = api.reject_non_read_http
+_write_file = api.write_file
+_sync_branch = api.sync_branch
+_original_do_get = api.H.do_GET
+api.OPENAPI = Path(os.getenv("AIOS_GITOPS_ISOLATED_WRITER_OPENAPI", str(api.OPENAPI)))
+
+
+def _registry() -> TokenRegistry:
+    return TokenRegistry(Path(os.environ["AIOS_GITOPS_TOKEN_REGISTRY_V2"]))
+
+
+def _atomic_writer() -> AtomicCommitFile:
+    return AtomicCommitFile(
+        workspace=api.WS,
+        bare_repo=api.BARE_REPO,
+        ledger=OperationLedger(Path(os.environ["AIOS_GITOPS_WRITER_OPERATION_LEDGER"])),
+        remote=os.getenv("AIOS_GITOPS_GITEA_PUSH_REMOTE", ""),
+        audit=policy.append_audit_record,
+    )
+
+
+def _bearer(handler) -> str:
+    value = handler.headers.get("Authorization", "")
+    return value[7:].strip() if value.startswith("Bearer ") else ""
+
+
+def _authorize(handler, *, method: str, path: str, branch=None, target_path=None):
+    grant = authorize(
+        _registry(),
+        _bearer(handler),
+        method=method,
+        path=path,
+        source_ip=str(handler.client_address[0]),
+        workspace=api.WS,
+        branch=branch,
+        target_path=target_path,
+    )
+    grant.record["_source_ip"] = str(handler.client_address[0])
+    return grant
+
+
+def _authorization_error(handler, exc: AuthorizationError):
+    return handler.sendj({"error": exc.code}, exc.status)
+
+
+def _isolated_runtime_status(handler):
+    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
+    head = api.sh(["rev-parse", "HEAD"], True)["stdout"]
+    return handler.sendj({
+        "service": os.getenv(
+            "AIOS_GITOPS_SERVICE_AUDIENCE",
+            "aios-isolated-writer.service",
+        ),
+        "status": "active",
+        "runtime_role": os.getenv("AIOS_GITOPS_RUNTIME_ROLE"),
+        "workspace_role": os.getenv("AIOS_GITOPS_WORKSPACE_ROLE"),
+        "writes_enabled": os.getenv("AIOS_GITOPS_WRITES_ENABLED", "").lower()
+        in {"1", "true", "yes", "on"},
+        "allowed_branch": policy.allowed_branch(),
+        "approved_base_oid": policy.allowed_base_oid(),
+        "workspace_branch": branch,
+        "workspace_head_oid": head,
+        "repository_identity": os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY"),
+        "token_policy_version": 2,
+        "atomic_commit_file": True,
+        "path_policy_sha256": policy.configured_path_policy_sha256(),
+    })
+
+
+def _isolated_do_get(self):
+    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+    if path in {"/health", "/api/health"}:
+        return self.sendj({
+            "status": "ok",
+            "service": os.getenv(
+                "AIOS_GITOPS_SERVICE_AUDIENCE",
+                "aios-isolated-writer.service",
+            ),
+        })
+    if path not in {"/api/runtime-status", "/api/baseline", "/api/patches"}:
+        return self.sendj({"error": "isolated_writer_operation_forbidden"}, 403)
+    try:
+        _authorize(self, method="GET", path=path)
+    except AuthorizationError as exc:
+        return _authorization_error(self, exc)
+    if path == "/api/runtime-status":
+        return _isolated_runtime_status(self)
+    return _original_do_get(self)
+
+
+def _read_commit_file_body(handler):
+    try:
+        length = int(handler.headers.get("Content-Length", "0"))
+    except ValueError:
+        raise CommitFileError("writer_content_length_rejected") from None
+    if length <= 0:
+        raise CommitFileError("writer_request_object_required")
+    if length > 1_100_000:
+        raise CommitFileError("writer_request_too_large", 413)
+    raw = handler.rfile.read(length)
+    try:
+        value = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        raise CommitFileError("writer_request_json_rejected") from None
+    if not isinstance(value, dict):
+        raise CommitFileError("writer_request_object_required")
+    return value
+
+
+def _isolated_do_post(self):
+    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+    if path != "/api/commit-file":
+        return self.sendj({"error": "isolated_writer_operation_forbidden"}, 403)
+    try:
+        data = _read_commit_file_body(self)
+        branch = str(data.get("branch") or "")
+        target_path = str(data.get("path") or "")
+        grant = _authorize(
+            self,
+            method="POST",
+            path=path,
+            branch=branch,
+            target_path=target_path,
+        )
+        if api.content_has_secret(str(data.get("content") or "")):
+            raise CommitFileError("writer_secret_content_rejected", 403)
+        result = _atomic_writer().execute(grant, data)
+        return self.sendj(result)
+    except AuthorizationError as exc:
+        return _authorization_error(self, exc)
+    except CommitFileError as exc:
+        return self.sendj({"error": exc.code}, exc.status)
+    except PermissionError:
+        return self.sendj({"error": "isolated_writer_policy_rejected"}, 403)
+
+
+def reject_non_read_http(handler, method: str, path: str) -> bool:
+    if _reject(handler, method, path):
+        return True
+    try:
+        policy.validate_endpoint(method, path, api.WS, api.BARE_REPO)
+        return False
+    except PermissionError as exc:
+        handler.sendj({"error": str(exc)}, 403)
+        return True
+
+
+def checkout(branch, base="main", create=False):
+    api.ensure_git()
+    target = api.branch_name(branch)
+    policy.validate_branch_request({"branch": target, "base": base})
+    exists = api.sh(["rev-parse", "--verify", target])["code"] == 0
+    if exists:
+        if api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"] != target:
+            api.sh(["checkout", target], True)
+    elif create:
+        api.sh(["checkout", "-b", target, base], True)
+    else:
+        raise PermissionError("isolated_writer_branch_missing")
+    policy.require_service_invariants(api.WS, api.BARE_REPO)
+    return target
+
+
+def write_file(path, content):
+    policy.validate_path(path, api.WS)
+    return _write_file(path, content)
+
+
+def sync_branch(branch: str):
+    policy.validate_sync_branch(branch)
+    local = _sync_branch(branch)
+    remote = os.getenv("AIOS_GITOPS_GITEA_PUSH_REMOTE", "").strip()
+    if remote != "gitea-http":
+        raise PermissionError("isolated_writer_gitea_remote_rejected")
+    head = api.sh(["rev-parse", "HEAD"], True)["stdout"]
+    pushed = subprocess.run(
+        ["git", "push", "--porcelain", remote, f"HEAD:refs/heads/{branch}"],
+        cwd=api.WS,
+        text=True,
+        capture_output=True,
+    )
+    if pushed.returncode != 0:
+        raise RuntimeError("isolated_writer_gitea_push_failed")
+    verified = subprocess.run(
+        ["git", "ls-remote", "--heads", remote, f"refs/heads/{branch}"],
+        cwd=api.WS,
+        text=True,
+        capture_output=True,
+    )
+    if verified.returncode != 0:
+        raise RuntimeError("isolated_writer_gitea_verification_failed")
+    fields = verified.stdout.strip().split()
+    if len(fields) != 2 or fields[0] != head or fields[1] != f"refs/heads/{branch}":
+        raise RuntimeError("isolated_writer_gitea_oid_mismatch")
+    return {
+        "status": "verified",
+        "target": "authoritative-bare+gitea",
+        "branch": branch,
+        "oid": head,
+        "local": local.get("status"),
+    }
+
+
+def commit(paths, msg):
+    policy.validate_commit_paths(paths, api.WS)
+    api.ensure_git()
+    selected = [api.relpath(p) for p in paths] if paths else ["."]
+    api.sh(["add", *selected], True)
+    policy.validate_staged_paths(api.WS)
+    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
+    if not api.sh(["status", "--short"])["stdout"]:
+        return {"status": "no_changes", "branch": branch, "sync": sync_branch(branch)}
+    out = api.sh(["commit", "-m", msg], True)
+    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
+    return {
+        "status": "committed",
+        "branch": branch,
+        "rev": api.sh(["rev-parse", "--short", "HEAD"], True)["stdout"],
+        "git": out,
+        "sync": sync_branch(branch),
+    }
+
+
+def audit(actor, action, target, payload):
+    policy.append_audit_record(
+        {
+            "at": api.now(),
+            "actor": actor,
+            "action": action,
+            "target": target,
+            "payload": api.sanitize(payload),
+        }
+    )
+
+
+def _validate_request(self, data, validate):
+    try:
+        validate(data)
+        return True
+    except PermissionError as exc:
+        self.sendj({"error": str(exc)}, 403)
+        return False
+
+
+def _checked_branch(self, data):
+    if not _validate_request(self, data, policy.validate_branch_request):
+        return
+    return _branch(self, data)
+
+
+def _checked_file(self, data):
+    data = dict(data)
+    data.setdefault("branch", policy.allowed_branch())
+    if not _validate_request(self, data, policy.validate_branch_request):
+        return
+    if not _validate_request(
+        self,
+        {"path": data.get("path", "")},
+        lambda item: policy.validate_path(item["path"], api.WS),
+    ):
+        return
+    return _file(self, data)
+
+
+def _checked_commit(self, data):
+    data = dict(data)
+    data.setdefault("branch", policy.allowed_branch())
+    if not _validate_request(self, data, policy.validate_branch_request):
+        return
+    return _commit(self, data)
+
+
+def _checked_patch(self, data):
+    data = dict(data)
+    data["branch"] = policy.allowed_branch()
+    if not _validate_request(self, data, policy.validate_branch_request):
+        return
+    return _patch(self, data)
+
+
+_branch, _file, _commit, _patch = api.H.branch, api.H.file, api.H.commit, api.H.patch
+api.reject_non_read_http = reject_non_read_http
+api.checkout, api.write_file, api.sync_branch, api.commit, api.audit = (
+    checkout,
+    write_file,
+    sync_branch,
+    commit,
+    audit,
+)
+api.H.branch, api.H.file, api.H.commit, api.H.patch = (
+    _checked_branch,
+    _checked_file,
+    _checked_commit,
+    _checked_patch,
+)
+api.H.do_GET = _isolated_do_get
+api.H.do_POST = _isolated_do_post
+
+if __name__ == "__main__":
+    policy.require_service_invariants(api.WS, api.BARE_REPO)
+    api.ThreadingHTTPServer((api.HOST, api.PORT), api.H).serve_forever()

active-runtime/app/aios_isolated_writer_api/__init__.py

@@ -0,0 +1,23 @@
+"""Task-bound Integration Refresh control-plane primitives."""
+
+from .integration_merge_writer import IntegrationMergeWriter, MergeError, MergeRequest
+from .integration_refresh import (
+    AppendOnlyAudit,
+    Binding,
+    GiteaBranchReadProjection,
+    GrantStore,
+    IntegrationRefreshProvisioner,
+    ProvisioningError,
+)
+
+__all__ = [
+    "AppendOnlyAudit",
+    "Binding",
+    "GiteaBranchReadProjection",
+    "GrantStore",
+    "IntegrationMergeWriter",
+    "IntegrationRefreshProvisioner",
+    "MergeError",
+    "MergeRequest",
+    "ProvisioningError",
+]

active-runtime/app/aios_isolated_writer_api/integration_merge_writer.py

@@ -0,0 +1,90 @@
+"""Constrained integration-only merge writer with rollback and reconciliation states."""
+from __future__ import annotations
+
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+import re
+
+
+class MergeError(RuntimeError):
+    def __init__(self, code: str, status: int = 409):
+        super().__init__(code); self.code, self.status = code, status
+
+
+@dataclass(frozen=True)
+class MergeRequest:
+    integration_branch: str
+    source_branch: str
+    approved_source_oid: str
+
+
+class IntegrationMergeWriter:
+    def __init__(self, workspace: Path | str, remote: str, projection):
+        self.workspace, self.remote, self.projection = Path(workspace), remote, projection
+
+    def _git(self, *args: str, check=True) -> str:
+        p = subprocess.run(["git", *args], cwd=self.workspace, text=True, capture_output=True)
+        if check and p.returncode:
+            raise MergeError("git_operation_failed", 500)
+        return p.stdout.strip()
+
+    def merge(self, request: MergeRequest) -> dict:
+        def bad(value: str) -> bool:
+            return (
+                value == "main"
+                or value.startswith("main/")
+                or value == "governance"
+                or value.startswith("governance/")
+                or value == "approvals"
+                or value.startswith("refs/")
+                or value.startswith("tags/")
+            )
+        if (bad(request.integration_branch) or bad(request.source_branch) or
+                not request.integration_branch.startswith("integration/") or
+                re.fullmatch(r"[0-9a-fA-F]{40}", request.approved_source_oid) is None):
+            raise MergeError("integration_merge_scope_rejected", 403)
+        for branch in (request.integration_branch, request.source_branch):
+            if subprocess.run(["git", "check-ref-format", "--branch", branch], cwd=self.workspace,
+                              text=True, capture_output=True).returncode:
+                raise MergeError("integration_merge_scope_rejected", 403)
+        if self._git("rev-parse", "--abbrev-ref", "HEAD") != request.integration_branch:
+            raise MergeError("integration_branch_checkout_required")
+        before = self._git("rev-parse", "HEAD")
+        remote_before = self.projection(request.integration_branch)
+        if remote_before != before:
+            raise MergeError("integration_remote_advanced")
+        source = self._git("rev-parse", "--verify", f"refs/heads/{request.source_branch}^{{commit}}")
+        if source != request.approved_source_oid:
+            raise MergeError("integration_source_not_approved", 403)
+        attempt = subprocess.run(["git", "merge", "--no-ff", "--no-commit", request.source_branch], cwd=self.workspace, text=True, capture_output=True)
+        if attempt.returncode:
+            subprocess.run(["git", "merge", "--abort"], cwd=self.workspace, text=True, capture_output=True)
+            raise MergeError("integration_merge_conflict")
+        try:
+            self._git("commit", "-m", "merge(integration): approved source")
+            merged = self._git("rev-parse", "HEAD")
+            parents = self._git("show", "-s", "--format=%P", "HEAD").split()
+            if parents != [before, source]:
+                raise MergeError("integration_parent_invariant_failed", 500)
+            pushed = subprocess.run(["git", "push", "--porcelain", self.remote, f"HEAD:refs/heads/{request.integration_branch}"], cwd=self.workspace, text=True, capture_output=True)
+            if pushed.returncode:
+                try:
+                    observed = self.projection(request.integration_branch)
+                except Exception:
+                    return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+                if observed == before:
+                    self._git("reset", "--hard", before)
+                    return {"state": "PUSH_FAILED_RESTORED", "pre_merge_oid": before}
+                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+            try:
+                observed = self.projection(request.integration_branch)
+            except Exception:
+                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+            if observed != merged:
+                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
+            return {"state": "COMPLETED", "pre_merge_oid": before, "merge_oid": merged}
+        except MergeError:
+            if self._git("rev-parse", "HEAD") != before:
+                self._git("reset", "--hard", before)
+            raise

active-runtime/app/aios_isolated_writer_api/integration_refresh.py

@@ -0,0 +1,257 @@
+"""Fail-closed, task-bound integration refresh provisioning primitives.
+
+This module deliberately has no HTTP or credential-provider dependency.  The
+caller supplies a branch-read projection and an apply callback, making the
+authorization and recovery boundary independently testable.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import argparse
+import secrets
+import sqlite3
+import threading
+import re
+from contextlib import contextmanager
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Callable
+
+
+class ProvisioningError(RuntimeError):
+    def __init__(self, code: str, status: int = 403):
+        super().__init__(code)
+        self.code, self.status = code, status
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _digest(secret: str) -> str:
+    return hashlib.sha256(secret.encode("utf-8")).hexdigest()
+
+
+def _canonical(value: dict) -> str:
+    return hashlib.sha256(json.dumps(value, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+
+
+def _is_oid(value: object) -> bool:
+    return isinstance(value, str) and re.fullmatch(r"[0-9a-fA-F]{40}", value) is not None
+
+
+@dataclass(frozen=True)
+class Binding:
+    task_id: str
+    repository: str
+    branch: str
+    actor_identity: str
+    audience: str
+    paths: tuple[str, ...]
+    quota: int
+
+
+class AppendOnlyAudit:
+    """Append only redacted JSONL audit, durable before a result is returned."""
+    def __init__(self, path: Path | str):
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.Lock()
+
+    def append(self, event: dict) -> None:
+        with self._lock:
+            safe = {key: value for key, value in event.items() if key not in {"token", "credential", "authorization"}}
+            previous = "0" * 64
+            if self.path.exists():
+                lines = self.path.read_text(encoding="utf-8").splitlines()
+                if lines:
+                    previous = json.loads(lines[-1])["event_hash"]
+            safe["previous_event_hash"] = previous
+            safe["event_hash"] = _canonical(safe)
+            encoded = (json.dumps(safe, sort_keys=True, separators=(",", ":")) + "\n").encode()
+            fd = os.open(self.path, os.O_APPEND | os.O_CREAT | os.O_WRONLY, 0o600)
+            try:
+                os.write(fd, encoded)
+                os.fsync(fd)
+            finally:
+                os.close(fd)
+
+
+class GrantStore:
+    """Digest-only short grant registry; SQLite transactions serialize quota use."""
+    def __init__(self, path: Path | str):
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        with self._db() as db:
+            db.execute("""CREATE TABLE IF NOT EXISTS grants(
+                token_digest TEXT PRIMARY KEY, binding_json TEXT NOT NULL,
+                expires_at TEXT NOT NULL, quota INTEGER NOT NULL, uses INTEGER NOT NULL,
+                revoked INTEGER NOT NULL DEFAULT 0)""")
+
+    @contextmanager
+    def _db(self):
+        db = sqlite3.connect(self.path, timeout=15, isolation_level=None)
+        db.row_factory = sqlite3.Row
+        try:
+            yield db
+        finally:
+            db.close()
+
+    def issue(self, binding: Binding, *, ttl_seconds: int = 300) -> str:
+        if ttl_seconds < 1 or ttl_seconds > 1800 or binding.quota < 1 or not binding.paths:
+            raise ValueError("invalid_short_grant")
+        token = secrets.token_urlsafe(32)
+        payload = json.dumps(binding.__dict__ | {"paths": list(binding.paths)}, sort_keys=True)
+        with self._db() as db:
+            db.execute("INSERT INTO grants VALUES(?,?,?,?,?,0)", (_digest(token), payload,
+                (_now() + timedelta(seconds=ttl_seconds)).isoformat(), binding.quota, 0))
+        return token
+
+    def rotate(self, old_token: str, binding: Binding, *, revocation_probe, ttl_seconds: int = 300) -> str:
+        self.revoke(old_token)
+        try: status = revocation_probe(old_token)
+        except TimeoutError as exc: raise ProvisioningError("revocation_probe_timeout", 503) from exc
+        if status != 401: raise ProvisioningError("revocation_probe_rejected", 503)
+        return self.issue(binding, ttl_seconds=ttl_seconds)
+
+    def revoke(self, token: str) -> None:
+        with self._db() as db:
+            db.execute("BEGIN IMMEDIATE")
+            db.execute("UPDATE grants SET revoked=1 WHERE token_digest=?", (_digest(token),))
+            db.execute("COMMIT")
+
+    def consume(self, token: str, binding: Binding, path: str) -> None:
+        with self._db() as db:
+            db.execute("BEGIN IMMEDIATE")
+            row = db.execute("SELECT * FROM grants WHERE token_digest=?", (_digest(token),)).fetchone()
+            if not row or row["revoked"]:
+                db.execute("ROLLBACK"); raise ProvisioningError("credential_rejected", 401)
+            if _now() >= datetime.fromisoformat(row["expires_at"]):
+                db.execute("ROLLBACK"); raise ProvisioningError("credential_expired", 401)
+            stored = json.loads(row["binding_json"])
+            requested = binding.__dict__ | {"paths": list(binding.paths)}
+            if stored != requested or path not in stored["paths"]:
+                db.execute("ROLLBACK"); raise ProvisioningError("grant_binding_rejected")
+            if row["uses"] >= row["quota"]:
+                db.execute("ROLLBACK"); raise ProvisioningError("grant_quota_exhausted")
+            db.execute("UPDATE grants SET uses=uses+1 WHERE token_digest=?", (_digest(token),))
+            db.execute("COMMIT")
+
+
+class GiteaBranchReadProjection:
+    """Normalizes a trusted task-scoped Gitea reader; every ambiguity fails closed."""
+    def __init__(self, reader: Callable[[str, str], dict]):
+        self.reader = reader
+
+    def head(self, repository: str, branch: str) -> str:
+        try:
+            reply = self.reader(repository, branch)
+        except TimeoutError as exc:
+            raise ProvisioningError("gitea_projection_timeout", 503) from exc
+        except Exception as exc:
+            raise ProvisioningError("gitea_projection_unavailable", 503) from exc
+        if not isinstance(reply, dict) or reply.get("status") in {401, 403}:
+            raise ProvisioningError("gitea_projection_forbidden", 503)
+        oid = reply.get("oid")
+        if reply.get("status") != 200 or not _is_oid(oid):
+            raise ProvisioningError("gitea_projection_invalid", 503)
+        return oid.lower()
+
+
+class IntegrationRefreshProvisioner:
+    _locks: dict[tuple[str, str], threading.Lock] = {}
+    _locks_guard = threading.Lock()
+
+    def __init__(self, *, grants: GrantStore, projection: GiteaBranchReadProjection,
+                 ledger_path: Path | str, audit: AppendOnlyAudit, approved_binding: Binding):
+        self.grants, self.projection, self.audit, self.approved_binding = grants, projection, audit, approved_binding
+        self.ledger_path = Path(ledger_path); self.ledger_path.parent.mkdir(parents=True, exist_ok=True)
+        with self._ledger() as db:
+            db.execute("CREATE TABLE IF NOT EXISTS refreshes(operation_id TEXT PRIMARY KEY, digest TEXT NOT NULL, state TEXT NOT NULL, result_oid TEXT)")
+
+    @contextmanager
+    def _ledger(self):
+        db = sqlite3.connect(self.ledger_path)
+        try:
+            yield db
+            db.commit()
+        finally:
+            db.close()
+
+    def refresh(self, *, token: str, binding: Binding, path: str, operation_id: str,
+                target_head_oid: str, apply: Callable[[], str]) -> dict:
+        if not operation_id or not _is_oid(target_head_oid):
+            raise ProvisioningError("refresh_request_rejected")
+        if binding != self.approved_binding:
+            raise ProvisioningError("grant_binding_rejected")
+        request = {"binding": binding.__dict__ | {"paths": list(binding.paths)}, "path": path, "target": target_head_oid}
+        digest = _canonical(request)
+        with self._locks_guard:
+            lock = self._locks.setdefault((binding.repository, binding.branch), threading.Lock())
+        with lock, self._ledger() as db:
+            db.execute("BEGIN IMMEDIATE")
+            row = db.execute("SELECT * FROM refreshes WHERE operation_id=?", (operation_id,)).fetchone()
+            new_operation = row is None
+            if row:
+                if row[1] != digest:
+                    db.execute("ROLLBACK"); raise ProvisioningError("operation_id_reuse_rejected", 409)
+                if row[2] == "COMPLETED":
+                    db.execute("COMMIT")
+                    return {"state": row[2], "operation_id": operation_id, "oid": row[3], "idempotent": True}
+                if row[2] not in {"PENDING", "RECOVERABLE"}:
+                    db.execute("COMMIT")
+                    return {"state": row[2], "operation_id": operation_id, "oid": row[3], "idempotent": True}
+            else:
+                db.execute("INSERT INTO refreshes VALUES(?,?,?,NULL)", (operation_id, digest, "PENDING"))
+            db.execute("COMMIT")
+            if new_operation:
+                self.grants.consume(token, binding, path)
+            current = self.projection.head(binding.repository, binding.branch)
+            if current != target_head_oid.lower():
+                self._state(operation_id, "STALE_TARGET")
+                raise ProvisioningError("stale_target_head", 409)
+            try:
+                oid = apply()
+                if not _is_oid(oid):
+                    raise ProvisioningError("apply_result_invalid", 500)
+                # Detect a competing remote advancement before claiming completion.
+                observed = self.projection.head(binding.repository, binding.branch)
+                if observed != oid.lower():
+                    self._state(operation_id, "RECONCILIATION_REQUIRED")
+                    raise ProvisioningError("remote_concurrent_advance", 409)
+                self._state(operation_id, "COMPLETED", oid)
+                self.audit.append({"operation_id": operation_id, "task_id": binding.task_id, "repository": binding.repository,
+                                   "branch": binding.branch, "actor_identity": binding.actor_identity, "audience": binding.audience, "path": path, "state": "COMPLETED"})
+                return {"state": "COMPLETED", "operation_id": operation_id, "oid": oid, "idempotent": False}
+            except ProvisioningError:
+                raise
+            except Exception as exc:
+                self._state(operation_id, "RECOVERABLE")
+                self.audit.append({"operation_id": operation_id, "task_id": binding.task_id, "repository": binding.repository,
+                                   "branch": binding.branch, "actor_identity": binding.actor_identity, "audience": binding.audience, "path": path, "state": "RECOVERABLE"})
+                raise ProvisioningError("refresh_apply_failed", 503) from exc
+
+    def _state(self, operation_id: str, state: str, oid: str | None = None) -> None:
+        with self._ledger() as db:
+            db.execute("UPDATE refreshes SET state=?, result_oid=COALESCE(?,result_oid) WHERE operation_id=?", (state, oid, operation_id))
+
+
+def _sandbox_preflight(state_dir: Path) -> int:
+    if os.environ.get("AIOS_GITOPS_WRITES_ENABLED") != "false":
+        raise ProvisioningError("global_gitops_writes_must_remain_disabled", 500)
+    state_dir.mkdir(parents=True, exist_ok=True)
+    audit = AppendOnlyAudit(state_dir / "preflight-audit.jsonl")
+    audit.append({"event": "SANDBOX_PREFLIGHT", "writes_enabled": False})
+    print(json.dumps({"status": "READY", "mode": "sandbox", "writes_enabled": False}, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--sandbox-preflight", action="store_true", required=True)
+    parser.add_argument("--state-dir", type=Path, required=True)
+    options = parser.parse_args()
+    raise SystemExit(_sandbox_preflight(options.state_dir))

active-runtime/app/aios_isolated_writer_policy.py

@@ -0,0 +1,310 @@
+"""Fail-closed policy used only by the task-scoped Action writer."""
+from __future__ import annotations
+
+import os
+import json
+import stat
+import subprocess
+import re
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from urllib.parse import unquote
+
+import isolated_writer_path_policy as path_policy
+
+WRITE_ENDPOINTS = frozenset({"/api/commit-file"})
+ALLOWED_ROOTS = (
+    "active-runtime",
+    "docs",
+    "patches",
+    "reports",
+    "scripts",
+    "test",
+    "tests",
+)
+DENIED_ROOTS = ("baseline", "config", "deploy", "deployments", "ops", "runtime", "services")
+_TRUE = frozenset({"1", "true", "yes", "on"})
+_FALSE = frozenset({"0", "false", "no", "off"})
+_DENY_FLAGS = (
+    "AIOS_GITOPS_ALLOW_MAIN_WRITE",
+    "AIOS_GITOPS_ALLOW_TAG_WRITE",
+    "AIOS_GITOPS_ALLOW_BASELINE_WRITE",
+    "AIOS_GITOPS_ALLOW_REGISTRY_WRITE",
+    "AIOS_GITOPS_ALLOW_ROLLBACK",
+    "AIOS_GITOPS_ALLOW_DEPLOYMENT",
+)
+
+
+def enforcement_required() -> bool:
+    return os.getenv("AIOS_GITOPS_ISOLATED_WRITER_ENFORCEMENT", "") == "required"
+
+
+def allowed_branch() -> str:
+    value = os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", "").strip()
+    if not value:
+        raise PermissionError("isolated_writer_missing_allowed_branch")
+    return value
+
+
+def allowed_base_oid() -> str:
+    value = os.getenv("AIOS_GITOPS_ALLOWED_BASE_OID", "").strip().lower()
+    if len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
+        raise PermissionError("isolated_writer_invalid_allowed_base_oid")
+    return value
+
+
+def _git(workspace: Path, *args: str) -> str:
+    result = subprocess.run(["git", *args], cwd=workspace, text=True, capture_output=True)
+    if result.returncode != 0:
+        raise PermissionError("isolated_writer_git_validation_failed")
+    return result.stdout.strip()
+
+
+def require_service_invariants(workspace: Path, bare_repo: Path) -> None:
+    if not enforcement_required():
+        return
+    if os.getenv("AIOS_GITOPS_WRITES_ENABLED", "").strip().lower() not in _TRUE:
+        raise PermissionError("isolated_writer_write_gate_required")
+    if os.getenv("AIOS_GITOPS_RUNTIME_ROLE", "") != "isolated-writer":
+        raise PermissionError("isolated_writer_role_required")
+    if os.getenv("AIOS_GITOPS_WORKSPACE_ROLE", "") != "isolated-writer":
+        raise PermissionError("isolated_writer_workspace_role_required")
+    if os.getenv("AIOS_GITOPS_TOKEN_POLICY_VERSION_REQUIRED", "") != "2":
+        raise PermissionError("isolated_writer_token_policy_v2_required")
+    if not os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", "").strip():
+        raise PermissionError("isolated_writer_service_audience_required")
+    if not os.getenv("AIOS_GITOPS_TOKEN_REGISTRY_V2", "").strip():
+        raise PermissionError("isolated_writer_token_registry_required")
+    if not os.getenv("AIOS_GITOPS_WRITER_OPERATION_LEDGER", "").strip():
+        raise PermissionError("isolated_writer_operation_ledger_required")
+    path_policy.configured_path_policy()
+    for name in _DENY_FLAGS:
+        if os.getenv(name, "").strip().lower() not in _FALSE:
+            raise PermissionError("isolated_writer_forbidden_capability_flag")
+    if os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "") != "aios/aios":
+        raise PermissionError("isolated_writer_repository_identity_rejected")
+    configured_bare_value = os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "").strip()
+    if not configured_bare_value:
+        raise PermissionError("isolated_writer_authoritative_repo_rejected")
+    configured_bare = Path(configured_bare_value)
+    if configured_bare.resolve(strict=True) != bare_repo.resolve(strict=True):
+        raise PermissionError("isolated_writer_authoritative_repo_rejected")
+    writer_root_value = os.getenv("AIOS_GITOPS_APPROVED_WRITER_ROOT", "").strip()
+    if not writer_root_value:
+        raise PermissionError("isolated_writer_workspace_outside_approved_root")
+    writer_root = Path(writer_root_value).resolve(strict=True)
+    lexical_workspace = Path(os.path.abspath(str(workspace)))
+    canonical_workspace = lexical_workspace.resolve(strict=True)
+    if lexical_workspace != canonical_workspace:
+        raise PermissionError("isolated_writer_workspace_symlink_rejected")
+    try:
+        canonical_workspace.relative_to(writer_root)
+    except (ValueError, FileNotFoundError):
+        raise PermissionError("isolated_writer_workspace_outside_approved_root") from None
+    if _git(workspace, "rev-parse", "--abbrev-ref", "HEAD") != allowed_branch():
+        raise PermissionError("isolated_writer_current_branch_rejected")
+    approved_base = allowed_base_oid()
+    try:
+        _git(workspace, "cat-file", "-e", f"{approved_base}^{{commit}}")
+        subprocess.run(
+            ["git", "merge-base", "--is-ancestor", approved_base, "HEAD"],
+            cwd=workspace,
+            check=True,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+    except (PermissionError, subprocess.CalledProcessError):
+        raise PermissionError("isolated_writer_approved_base_not_ancestor") from None
+    if _git(workspace, "merge-base", approved_base, "HEAD") != approved_base:
+        raise PermissionError("isolated_writer_merge_base_rejected")
+    common = Path(_git(workspace, "rev-parse", "--git-common-dir"))
+    if not common.is_absolute():
+        common = (workspace / common).resolve()
+    if common.resolve() != bare_repo.resolve():
+        raise PermissionError("isolated_writer_common_repo_rejected")
+
+
+def approved_audit_log_path() -> Path:
+    root_value = os.getenv("AIOS_GITOPS_APPROVED_AUDIT_ROOT", "").strip()
+    log_value = os.getenv("AIOS_GITOPS_AUDIT_LOG", "").strip()
+    if not root_value or not log_value:
+        raise PermissionError("isolated_writer_audit_path_missing")
+    lexical_root = Path(os.path.abspath(root_value))
+    lexical_log = Path(os.path.abspath(log_value))
+    root = lexical_root.resolve(strict=True)
+    if lexical_root != root or root.is_symlink() or not root.is_dir():
+        raise PermissionError("isolated_writer_audit_root_rejected")
+    try:
+        lexical_log.relative_to(root)
+    except ValueError:
+        raise PermissionError("isolated_writer_audit_path_outside_approved_root") from None
+    if lexical_log.parent.resolve(strict=True) != lexical_log.parent:
+        raise PermissionError("isolated_writer_audit_parent_symlink_rejected")
+    if lexical_log.exists() and lexical_log.is_symlink():
+        raise PermissionError("isolated_writer_audit_log_symlink_rejected")
+    os.chmod(root, 0o750)
+    os.chmod(lexical_log.parent, 0o750)
+    return lexical_log
+
+
+def append_audit_record(record: dict) -> None:
+    path = approved_audit_log_path()
+    flags = os.O_WRONLY | os.O_APPEND | os.O_CREAT
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    descriptor = os.open(path, flags, 0o600)
+    try:
+        info = os.fstat(descriptor)
+        if not stat.S_ISREG(info.st_mode):
+            raise PermissionError("isolated_writer_audit_log_not_regular")
+        os.fchmod(descriptor, 0o600)
+        line = json.dumps(
+            _audit_sanitize(record),
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+        ).encode("utf-8") + b"\n"
+        os.write(descriptor, line)
+        os.fsync(descriptor)
+    finally:
+        os.close(descriptor)
+    parent_fd = os.open(path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
+    try:
+        os.fsync(parent_fd)
+    finally:
+        os.close(parent_fd)
+
+
+def _audit_sanitize(value):
+    if isinstance(value, dict):
+        return {
+            key: (
+                "[REDACTED]"
+                if any(
+                    marker in str(key).lower()
+                    for marker in (
+                        "authorization",
+                        "credential",
+                        "password",
+                        "secret",
+                        "token",
+                        "private_key",
+                    )
+                )
+                and str(key).lower() != "token_id"
+                else _audit_sanitize(inner)
+            )
+            for key, inner in value.items()
+        }
+    if isinstance(value, list):
+        return [_audit_sanitize(item) for item in value]
+    if isinstance(value, str) and re.search(
+        r"(?i)(authorization\s*:\s*bearer|(?:token|password|secret)\s*[:=])",
+        value,
+    ):
+        return "[REDACTED]"
+    return value
+
+
+def validate_endpoint(method: str, path: str, workspace: Path, bare_repo: Path) -> None:
+    if not enforcement_required():
+        return
+    if method != "POST" or path not in WRITE_ENDPOINTS:
+        raise PermissionError("isolated_writer_operation_forbidden")
+    require_service_invariants(workspace, bare_repo)
+
+
+def validate_branch_request(data: dict) -> None:
+    if not enforcement_required():
+        return
+    branch = allowed_branch() if "branch" not in data else str(data.get("branch") or "").strip()
+    if branch != allowed_branch():
+        raise PermissionError("isolated_writer_branch_rejected")
+    if str(data.get("base", "main")).strip() != "main":
+        raise PermissionError("isolated_writer_base_rejected")
+    if data.get("force") or data.get("force_push"):
+        raise PermissionError("isolated_writer_force_rejected")
+
+
+def validate_path(path: str, workspace: Path | None = None) -> str:
+    if not isinstance(path, str):
+        raise PermissionError("isolated_writer_path_rejected")
+    value = path
+    if not value or value != value.strip() or "\x00" in value or "\\" in value:
+        raise PermissionError("isolated_writer_path_rejected")
+    try:
+        decoded = unquote(value, errors="strict")
+    except (UnicodeDecodeError, ValueError):
+        raise PermissionError("isolated_writer_path_rejected") from None
+    if decoded != value:
+        raise PermissionError("isolated_writer_path_rejected")
+    windows = PureWindowsPath(value)
+    posix = PurePosixPath(value)
+    parts = value.split("/")
+    if (
+        posix.is_absolute()
+        or windows.is_absolute()
+        or bool(windows.drive)
+        or any(part in {"", ".", ".."} for part in parts)
+    ):
+        raise PermissionError("isolated_writer_path_rejected")
+    first = parts[0]
+    service_exact_path = False
+    if first in DENIED_ROOTS:
+        try:
+            path_policy.require_service_path("commit_file.atomic", value)
+            service_exact_path = True
+        except path_policy.PathPolicyError as exc:
+            raise PermissionError(str(exc)) from None
+    if value != "README.md" and first not in ALLOWED_ROOTS and not service_exact_path:
+        raise PermissionError("isolated_writer_path_outside_allowed_roots")
+    if workspace is not None:
+        lexical_root = Path(os.path.abspath(str(workspace)))
+        root = lexical_root.resolve(strict=True)
+        if lexical_root != root:
+            raise PermissionError("isolated_writer_workspace_symlink_rejected")
+        current = root
+        for part in parts:
+            current = current / part
+            if current.is_symlink():
+                raise PermissionError("isolated_writer_path_symlink_rejected")
+        candidate = (root / value).resolve(strict=False)
+        try:
+            candidate.relative_to(root)
+        except ValueError:
+            raise PermissionError("isolated_writer_path_escapes_workspace") from None
+    return value
+
+
+def validate_content_for_path(path: str, content: str) -> None:
+    if path.split("/", 1)[0] not in DENIED_ROOTS:
+        return
+    try:
+        path_policy.validate_content("commit_file.atomic", path, content)
+    except path_policy.PathPolicyError as exc:
+        raise PermissionError(str(exc)) from None
+
+
+def configured_path_policy_sha256() -> str | None:
+    try:
+        return path_policy.configured_path_policy_sha256()
+    except path_policy.PathPolicyError as exc:
+        raise PermissionError(str(exc)) from None
+
+
+def validate_commit_paths(paths: list[str], workspace: Path | None = None) -> None:
+    if enforcement_required():
+        for path in paths:
+            if str(path).strip() != ".":
+                validate_path(str(path), workspace)
+
+
+def validate_staged_paths(workspace: Path) -> None:
+    if not enforcement_required():
+        return
+    for path in _git(workspace, "diff", "--cached", "--name-only").splitlines():
+        validate_path(path, workspace)
+
+
+def validate_sync_branch(branch: str) -> None:
+    if enforcement_required() and branch != allowed_branch():
+        raise PermissionError("isolated_writer_sync_branch_rejected")

active-runtime/app/authoritative_git.py

@@ -0,0 +1,355 @@
+"""Fail-closed access to the authoritative bare Git repository."""
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import urllib.parse
+from pathlib import Path
+from typing import Iterable
+
+_ALLOWED_COMMANDS = frozenset(
+    {
+        "cat-file",
+        "config",
+        "diff",
+        "for-each-ref",
+        "ls-remote",
+        "merge-base",
+        "push",
+        "remote",
+        "rev-parse",
+        "show-ref",
+        "tag",
+    }
+)
+_OID_RE = re.compile(r"^[0-9a-f]{40}$")
+_MAX_OUTPUT = 1_048_576
+_TIMEOUT = 8.0
+
+
+class AuthoritativeGitError(RuntimeError):
+    """A fail-closed authoritative repository or ref query error."""
+
+
+class AuthoritativeGitNotFound(AuthoritativeGitError):
+    """A validated revision does not exist in the authoritative repository."""
+
+
+class AuthoritativeGitOutputTooLarge(AuthoritativeGitError):
+    """A controlled Git query exceeded the response-size boundary."""
+
+
+def _redact(text: str) -> str:
+    value = str(text or "")
+    value = re.sub(r"(?i)(authorization\s*[:=]\s*)(?:bearer|token)\s+\S+", r"\1REDACTED", value)
+    value = re.sub(r"(?i)((?:access_)?token\s*[:=]\s*)\S+", r"\1REDACTED", value)
+    value = re.sub(r"(?i)(https?://[^/\s:@]+:)[^@\s/]+@", r"\1REDACTED@", value)
+    return value
+
+
+def _configured_path(git_dir: str | Path | None = None) -> Path:
+    raw = str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
+    if not raw:
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    path = Path(raw)
+    if not path.is_absolute() or ".." in path.parts:
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    try:
+        resolved = path.resolve(strict=True)
+    except OSError as exc:
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE") from exc
+    if not resolved.is_dir():
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    return resolved
+
+
+def _run(
+    git_dir: Path,
+    args: list[str],
+    *,
+    check: bool,
+    timeout: float = _TIMEOUT,
+) -> subprocess.CompletedProcess[str]:
+    if not args or args[0] not in _ALLOWED_COMMANDS:
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+    try:
+        result = subprocess.run(
+            ["git", "--git-dir", str(git_dir), *args],
+            text=True,
+            capture_output=True,
+            timeout=timeout,
+            env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED") from exc
+    if len(result.stdout) + len(result.stderr) > _MAX_OUTPUT:
+        raise AuthoritativeGitOutputTooLarge("GIT_OUTPUT_LIMIT_EXCEEDED")
+    if check and result.returncode != 0:
+        detail = _redact(result.stderr.strip() or result.stdout.strip())
+        raise AuthoritativeGitError(
+            "GIT_REF_QUERY_FAILED" + (f": {detail[:160]}" if detail else "")
+        )
+    return result
+
+
+def _repository_identity_from_remote(url: str) -> str:
+    value = str(url or "").strip().split("?", 1)[0].rstrip("/")
+    if not value:
+        return ""
+    if "://" in value:
+        value = urllib.parse.urlparse(value).path
+    elif ":" in value:
+        value = value.rsplit(":", 1)[1]
+    value = value.rsplit("@", 1)[-1].strip("/")
+    value = re.sub(r"\.git$", "", value, flags=re.IGNORECASE)
+    parts = [part for part in value.split("/") if part]
+    if len(parts) >= 2:
+        value = "/".join(parts[-2:])
+    return value.strip("/").lower()
+
+
+def verify_repository(
+    git_dir: str | Path | None = None,
+    repository_identity: str | None = None,
+) -> tuple[Path, str]:
+    path = _configured_path(git_dir)
+    expected = str(
+        repository_identity
+        or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
+    ).strip().strip("/")
+    if not expected or expected.count("/") != 1:
+        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
+    bare = _run(path, ["rev-parse", "--is-bare-repository"], check=True)
+    if bare.stdout.strip().lower() != "true":
+        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
+    remote = _run(path, ["config", "--get", "remote.gitea.url"], check=False)
+    actual = _repository_identity_from_remote(remote.stdout)
+    if actual != expected.lower():
+        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
+    return path, expected
+
+
+def run_authoritative_git(
+    args: list[str],
+    *,
+    check: bool = True,
+    git_dir: str | Path | None = None,
+    timeout: float = _TIMEOUT,
+) -> subprocess.CompletedProcess[str]:
+    path, _ = verify_repository(git_dir=git_dir)
+    return _run(path, list(args), check=check, timeout=timeout)
+
+
+def authoritative_head_oid(
+    *,
+    git_dir: str | Path | None = None,
+) -> str:
+    result = run_authoritative_git(["rev-parse", "--verify", "refs/heads/main"], git_dir=git_dir)
+    oid = result.stdout.strip().lower()
+    if not _OID_RE.fullmatch(oid):
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+    return oid
+
+
+def authoritative_tags(
+    *,
+    git_dir: str | Path | None = None,
+) -> list[dict[str, str | None]]:
+    result = run_authoritative_git(
+        [
+            "for-each-ref",
+            "refs/tags",
+            "--format=%(refname:strip=2)\t%(objectname)\t%(objecttype)",
+        ],
+        git_dir=git_dir,
+    )
+    tags: list[dict[str, str | None]] = []
+    for line in result.stdout.splitlines():
+        name, oid, object_type = (line.split("\t", 2) + ["", ""])[:3]
+        if not name or not _OID_RE.fullmatch(oid.lower()):
+            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+        peeled_result = run_authoritative_git(
+            ["rev-parse", "--verify", f"refs/tags/{name}^{{commit}}"],
+            git_dir=git_dir,
+        )
+        peeled = peeled_result.stdout.strip().lower()
+        if not _OID_RE.fullmatch(peeled):
+            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+        tags.append(
+            {
+                "name": name,
+                "tag_oid": oid.lower(),
+                "object_type": object_type,
+                "peeled_target_oid": peeled,
+            }
+        )
+    return tags
+
+
+def authoritative_branches(
+    *,
+    git_dir: str | Path | None = None,
+) -> list[dict[str, str]]:
+    result = run_authoritative_git(
+        [
+            "for-each-ref",
+            "refs/heads",
+            "--format=%(refname:strip=2)\t%(objectname)",
+        ],
+        git_dir=git_dir,
+    )
+    branches: list[dict[str, str]] = []
+    for line in result.stdout.splitlines():
+        name, oid = (line.split("\t", 1) + [""])[:2]
+        if not name or not _OID_RE.fullmatch(oid.lower()):
+            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+        branches.append({"name": name, "oid": oid.lower()})
+    return branches
+
+
+def authoritative_commit(
+    oid: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> str:
+    value = str(oid or "").strip().lower()
+    if not _OID_RE.fullmatch(value):
+        raise ValueError("commit OID must be a full 40-character value")
+    result = run_authoritative_git(
+        ["rev-parse", "--verify", f"{value}^{{commit}}"],
+        git_dir=git_dir,
+    )
+    resolved = result.stdout.strip().lower()
+    if resolved != value:
+        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
+    return resolved
+
+
+def authoritative_lineage(
+    ancestor: str,
+    descendant: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> None:
+    authoritative_commit(ancestor, git_dir=git_dir)
+    authoritative_commit(descendant, git_dir=git_dir)
+    result = run_authoritative_git(
+        ["merge-base", "--is-ancestor", ancestor, descendant],
+        check=False,
+        git_dir=git_dir,
+    )
+    if result.returncode != 0:
+        raise AuthoritativeGitError("evidence lineage mismatch")
+
+
+_SAFE_REF_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{0,239}$")
+
+
+def _safe_ref_name(value: str) -> bool:
+    return bool(
+        _SAFE_REF_RE.fullmatch(value)
+        and ".." not in value
+        and "//" not in value
+        and "@{" not in value
+        and not value.endswith(("/", ".", ".lock"))
+        and not any(part in {"", ".", ".."} for part in value.split("/"))
+    )
+
+
+def validate_git_revision(
+    value: str,
+    field: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> str:
+    revision = str(value or "").strip()
+    if not revision or revision != str(value or "") or revision.startswith("-"):
+        raise ValueError(f"invalid {field} revision")
+    if _OID_RE.fullmatch(revision.lower()):
+        try:
+            return authoritative_commit(revision.lower(), git_dir=git_dir)
+        except AuthoritativeGitError as exc:
+            raise AuthoritativeGitNotFound(f"{field} revision not found") from exc
+    if not _safe_ref_name(revision) or any(token in revision for token in ("^", "~", ":", "\\")):
+        raise ValueError(f"invalid {field} revision")
+    if revision.startswith("refs/"):
+        if not revision.startswith(("refs/heads/", "refs/tags/")):
+            raise ValueError(f"invalid {field} revision")
+        candidates = [revision]
+    else:
+        candidates = [f"refs/heads/{revision}", f"refs/tags/{revision}"]
+    matches: list[str] = []
+    for candidate in candidates:
+        result = run_authoritative_git(
+            ["rev-parse", "--verify", f"{candidate}^{{commit}}"],
+            check=False,
+            git_dir=git_dir,
+        )
+        oid = result.stdout.strip().lower()
+        if result.returncode == 0 and _OID_RE.fullmatch(oid):
+            matches.append(oid)
+    if not matches:
+        raise AuthoritativeGitNotFound(f"{field} revision not found")
+    if len(set(matches)) != 1 or len(matches) != 1:
+        raise ValueError(f"ambiguous {field} revision")
+    return matches[0]
+
+
+def authoritative_diff(
+    from_revision: str,
+    to_revision: str,
+    *,
+    git_dir: str | Path | None = None,
+) -> dict[str, object]:
+    path, _ = verify_repository(git_dir=git_dir)
+    from_oid = validate_git_revision(from_revision, "from", git_dir=path)
+    to_oid = validate_git_revision(to_revision, "to", git_dir=path)
+    args = ["diff", "--no-ext-diff", "--no-textconv", from_oid, to_oid]
+    result = run_authoritative_git(args, git_dir=path)
+    return {
+        "code": 0,
+        "stdout": result.stdout,
+        "stderr": "",
+        "cmd": ["git", f"--git-dir={path}", *args],
+        "from_oid": from_oid,
+        "to_oid": to_oid,
+    }
+
+
+def repository_snapshot(
+    *,
+    git_dir: str | Path | None = None,
+    repository_identity: str | None = None,
+) -> dict[str, object]:
+    configured = bool(
+        str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
+    )
+    try:
+        path, identity = verify_repository(
+            git_dir=git_dir,
+            repository_identity=repository_identity,
+        )
+        head = authoritative_head_oid(git_dir=path)
+        return {
+            "repository_available": True,
+            "authoritative_git_dir_configured": configured,
+            "authoritative_git_dir_readable": True,
+            "authoritative_git_dir": str(path),
+            "authoritative_head_oid": head,
+            "repository_identity": identity,
+            "query_error": None,
+        }
+    except (AuthoritativeGitError, ValueError) as exc:
+        return {
+            "repository_available": False,
+            "authoritative_git_dir_configured": configured,
+            "authoritative_git_dir_readable": False,
+            "authoritative_git_dir": None,
+            "authoritative_head_oid": None,
+            "repository_identity": str(
+                repository_identity
+                or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
+            ).strip() or None,
+            "query_error": _redact(str(exc)),
+        }

active-runtime/app/isolated_writer_authz.py

@@ -0,0 +1,167 @@
+"""Fail-closed operation authorization for an isolated Git writer."""
+from __future__ import annotations
+
+import ipaddress
+import os
+import re
+import subprocess
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from isolated_writer_token_registry import TokenRegistry
+
+
+ROUTE_OPERATIONS = {
+    ("GET", "/api/runtime-status"): "runtime.status.read",
+    ("GET", "/api/baseline"): "baseline.read",
+    ("GET", "/api/patches"): "patches.read",
+    ("POST", "/api/commit-file"): "commit_file.atomic",
+}
+OID_RE = re.compile(r"[0-9a-f]{40}")
+
+
+class AuthorizationError(PermissionError):
+    def __init__(self, code: str, status: int = 403):
+        super().__init__(code)
+        self.code = code
+        self.status = status
+
+
+@dataclass(frozen=True)
+class AuthorizedGrant:
+    record: dict[str, Any]
+    operation: str
+    use_count: int
+
+    @property
+    def token_id(self) -> str:
+        return str(self.record["token_id"])
+
+    @property
+    def task_id(self) -> str:
+        return str(self.record["task_id"])
+
+
+def operation_for(method: str, path: str) -> str:
+    operation = ROUTE_OPERATIONS.get((method.upper(), path))
+    if not operation:
+        raise AuthorizationError("isolated_writer_operation_forbidden")
+    return operation
+
+
+def _parse_time(value: Any) -> datetime:
+    try:
+        parsed = datetime.fromisoformat(str(value).replace("Z", "+00:00"))
+    except (TypeError, ValueError):
+        raise AuthorizationError("writer_token_time_invalid") from None
+    if parsed.tzinfo is None:
+        raise AuthorizationError("writer_token_time_invalid")
+    return parsed.astimezone(timezone.utc)
+
+
+def _git_is_ancestor(workspace: Path, base: str, branch: str) -> bool:
+    result = subprocess.run(
+        ["git", "merge-base", "--is-ancestor", base, branch],
+        cwd=workspace,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    return result.returncode == 0
+
+
+def _validate_grant(
+    grant: dict[str, Any],
+    *,
+    audience: str,
+    source_ip: str,
+    operation: str,
+    branch: str | None,
+    path: str | None,
+    workspace: Path,
+    current_time: datetime,
+) -> None:
+    if int(grant.get("schema_version", 0)) != 2:
+        raise AuthorizationError("writer_token_policy_v2_required", 401)
+    if str(grant.get("audience") or "") != audience:
+        raise AuthorizationError("writer_token_audience_rejected")
+    try:
+        peer = ipaddress.ip_address(source_ip)
+        networks = [ipaddress.ip_network(str(value), strict=True) for value in grant.get("source_cidrs", [])]
+    except ValueError:
+        raise AuthorizationError("writer_token_source_rejected") from None
+    if not networks or not any(peer in network for network in networks):
+        raise AuthorizationError("writer_token_source_rejected")
+    created = _parse_time(grant.get("created_at"))
+    not_before = _parse_time(grant.get("not_before"))
+    expires = _parse_time(grant.get("expires_at"))
+    if expires <= not_before or (expires - created).total_seconds() > 1800:
+        raise AuthorizationError("writer_token_lifetime_rejected")
+    if current_time < not_before:
+        raise AuthorizationError("writer_token_not_yet_valid", 401)
+    if current_time >= expires:
+        raise AuthorizationError("writer_token_expired", 401)
+    if bool(grant.get("revoked")):
+        raise AuthorizationError("writer_token_revoked", 401)
+    operations = grant.get("allowed_operations")
+    if not isinstance(operations, list) or operation not in operations:
+        raise AuthorizationError("writer_token_operation_rejected")
+    expected_branch = str(grant.get("allowed_branch") or "")
+    configured_branch = os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", "")
+    if expected_branch != configured_branch:
+        raise AuthorizationError("writer_token_branch_rejected")
+    if branch is not None and branch != expected_branch:
+        raise AuthorizationError("writer_token_branch_rejected")
+    if path is not None:
+        paths = grant.get("allowed_paths")
+        if not isinstance(paths, list) or path not in paths:
+            raise AuthorizationError("writer_token_path_rejected")
+    base = str(grant.get("approved_base_oid") or "").lower()
+    if not OID_RE.fullmatch(base):
+        raise AuthorizationError("writer_token_base_rejected")
+    if not _git_is_ancestor(workspace, base, expected_branch):
+        raise AuthorizationError("writer_token_base_not_ancestor")
+
+
+def authorize(
+    registry: TokenRegistry,
+    token: str,
+    *,
+    method: str,
+    path: str,
+    source_ip: str,
+    workspace: Path,
+    branch: str | None = None,
+    target_path: str | None = None,
+    current_time: datetime | None = None,
+) -> AuthorizedGrant:
+    if os.getenv("AIOS_GITOPS_TOKEN_POLICY_VERSION_REQUIRED", "") != "2":
+        raise AuthorizationError("writer_token_policy_v2_not_required")
+    if not token:
+        raise AuthorizationError("unauthorized", 401)
+    grant = registry.find(token)
+    if grant is None:
+        raise AuthorizationError("unauthorized", 401)
+    operation = operation_for(method, path)
+    _validate_grant(
+        grant,
+        audience=os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", ""),
+        source_ip=source_ip,
+        operation=operation,
+        branch=branch,
+        path=target_path,
+        workspace=workspace,
+        current_time=current_time or datetime.now(timezone.utc),
+    )
+    limits = grant.get("max_uses")
+    if not isinstance(limits, dict):
+        raise AuthorizationError("writer_token_use_limit_missing")
+    try:
+        used = registry.consume(str(grant["token_id"]), operation, int(limits[operation]))
+    except (KeyError, TypeError, ValueError):
+        raise AuthorizationError("writer_token_use_limit_missing") from None
+    except PermissionError as exc:
+        code = str(exc)
+        raise AuthorizationError(code, 401 if code == "writer_token_revoked" else 403) from None
+    return AuthorizedGrant(grant, operation, used)

active-runtime/app/isolated_writer_commit_file.py

@@ -0,0 +1,403 @@
+"""Atomic, idempotent commit-file Saga for the isolated writer."""
+from __future__ import annotations
+
+import fcntl
+import hashlib
+import json
+import os
+import re
+import sqlite3
+import subprocess
+import tempfile
+import threading
+from pathlib import Path
+from typing import Any
+
+import aios_isolated_writer_policy as policy
+
+
+OID_RE = re.compile(r"[0-9a-f]{40}")
+IDEMPOTENCY_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{7,127}")
+STATES = frozenset({
+    "PENDING", "FILE_WRITTEN", "COMMITTED", "PUSHED", "VERIFIED", "COMPLETED",
+    "FAILED_RECOVERABLE", "MANUAL_REVIEW_REQUIRED",
+})
+_LOCKS: dict[str, threading.Lock] = {}
+_LOCKS_GUARD = threading.Lock()
+_LEDGER_INIT_LOCK = threading.Lock()
+
+
+class CommitFileError(RuntimeError):
+    def __init__(self, code: str, status: int = 400):
+        super().__init__(code)
+        self.code = code
+        self.status = status
+
+
+class SimulatedCrash(RuntimeError):
+    pass
+
+
+def canonical_digest(data: dict[str, Any]) -> str:
+    payload = {
+        "branch": data["branch"],
+        "path": data["path"],
+        "content_sha256": hashlib.sha256(data["content"].encode("utf-8")).hexdigest(),
+        "message": data["message"],
+        "expected_head_oid": data["expected_head_oid"],
+    }
+    encoded = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    return hashlib.sha256(encoded).hexdigest()
+
+
+class OperationLedger:
+    def __init__(self, path: Path | str):
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        if self.path.parent.is_symlink() or self.path.is_symlink():
+            raise PermissionError("writer_operation_ledger_symlink_rejected")
+        with _LEDGER_INIT_LOCK:
+            with self.connect() as db:
+                db.execute(
+                    """
+                    CREATE TABLE IF NOT EXISTS writer_operations (
+                        operation_id TEXT PRIMARY KEY,
+                        token_id TEXT NOT NULL,
+                        task_id TEXT NOT NULL,
+                        idempotency_key TEXT NOT NULL UNIQUE,
+                        operation_digest TEXT NOT NULL,
+                        branch TEXT NOT NULL,
+                        path TEXT NOT NULL,
+                        content_sha256 TEXT NOT NULL,
+                        pre_head_oid TEXT NOT NULL,
+                        commit_oid TEXT,
+                        push_status TEXT,
+                        verification_status TEXT,
+                        state TEXT NOT NULL,
+                        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+                        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+                        error_code TEXT
+                    )
+                    """
+                )
+        os.chmod(self.path, 0o600)
+
+    def connect(self) -> sqlite3.Connection:
+        db = sqlite3.connect(self.path, timeout=30)
+        db.row_factory = sqlite3.Row
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        return db
+
+    def get_or_create(self, grant: Any, data: dict[str, Any], digest: str) -> dict[str, Any]:
+        key = data["idempotency_key"]
+        with self.connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            row = db.execute(
+                "SELECT * FROM writer_operations WHERE idempotency_key=?", (key,)
+            ).fetchone()
+            if row:
+                db.commit()
+                record = dict(row)
+                if record["operation_digest"] != digest:
+                    raise CommitFileError("writer_idempotency_conflict", 409)
+                if (
+                    record["token_id"] != grant.token_id
+                    or record["task_id"] != grant.task_id
+                ):
+                    raise CommitFileError("writer_idempotency_owner_conflict", 409)
+                return record
+            operation_id = hashlib.sha256(
+                f"{grant.task_id}\0{key}".encode("utf-8")
+            ).hexdigest()
+            content_sha = hashlib.sha256(data["content"].encode("utf-8")).hexdigest()
+            db.execute(
+                """
+                INSERT INTO writer_operations(
+                    operation_id,token_id,task_id,idempotency_key,operation_digest,
+                    branch,path,content_sha256,pre_head_oid,state
+                ) VALUES(?,?,?,?,?,?,?,?,?,?)
+                """,
+                (
+                    operation_id, grant.token_id, grant.task_id, key, digest,
+                    data["branch"], data["path"], content_sha,
+                    data["expected_head_oid"], "PENDING",
+                ),
+            )
+            db.commit()
+        return self.get(key)
+
+    def get(self, key: str) -> dict[str, Any]:
+        with self.connect() as db:
+            row = db.execute(
+                "SELECT * FROM writer_operations WHERE idempotency_key=?", (key,)
+            ).fetchone()
+        if row is None:
+            raise KeyError(key)
+        return dict(row)
+
+    def update(self, key: str, state: str, **fields: Any) -> dict[str, Any]:
+        if state not in STATES:
+            raise ValueError("invalid writer operation state")
+        allowed = {"commit_oid", "push_status", "verification_status", "error_code"}
+        assignments = ["state=?", "updated_at=CURRENT_TIMESTAMP"]
+        values: list[Any] = [state]
+        for name, value in fields.items():
+            if name not in allowed:
+                raise ValueError("invalid ledger field")
+            assignments.append(f"{name}=?")
+            values.append(value)
+        values.append(key)
+        with self.connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            db.execute(
+                f"UPDATE writer_operations SET {','.join(assignments)} WHERE idempotency_key=?",
+                values,
+            )
+            db.commit()
+        return self.get(key)
+
+
+class AtomicCommitFile:
+    def __init__(
+        self,
+        *,
+        workspace: Path,
+        bare_repo: Path,
+        ledger: OperationLedger,
+        remote: str,
+        audit,
+        crash_after_state: str | None = None,
+    ):
+        self.workspace = workspace
+        self.bare_repo = bare_repo
+        self.ledger = ledger
+        self.remote = remote
+        self.audit = audit
+        self.crash_after_state = crash_after_state
+
+    def _git(self, *args: str, check: bool = True) -> str:
+        result = subprocess.run(
+            ["git", *args], cwd=self.workspace, text=True, capture_output=True
+        )
+        if check and result.returncode != 0:
+            raise CommitFileError("writer_git_operation_failed", 500)
+        return result.stdout.strip()
+
+    def _transition(self, key: str, state: str, **fields: Any) -> dict[str, Any]:
+        record = self.ledger.update(key, state, **fields)
+        if self.crash_after_state == state:
+            raise SimulatedCrash(state)
+        return record
+
+    def _validate(self, data: Any) -> dict[str, Any]:
+        if not isinstance(data, dict):
+            raise CommitFileError("writer_request_object_required")
+        required = ("branch", "path", "content", "message", "expected_head_oid", "idempotency_key")
+        if any(field not in data for field in required):
+            raise CommitFileError("writer_request_incomplete")
+        if data.get("force") or data.get("force_push"):
+            raise CommitFileError("isolated_writer_force_rejected", 403)
+        if set(data) != set(required):
+            raise CommitFileError("writer_request_fields_rejected")
+        item = {field: data[field] for field in required}
+        if item["branch"] != policy.allowed_branch():
+            raise CommitFileError("isolated_writer_branch_rejected", 403)
+        try:
+            item["path"] = policy.validate_path(item["path"], self.workspace)
+        except PermissionError as exc:
+            raise CommitFileError(str(exc), 403) from None
+        if not isinstance(item["content"], str) or "\x00" in item["content"]:
+            raise CommitFileError("writer_content_rejected")
+        try:
+            policy.validate_content_for_path(item["path"], item["content"])
+        except PermissionError as exc:
+            raise CommitFileError(str(exc), 403) from None
+        if len(item["content"].encode("utf-8")) > 1_048_576:
+            raise CommitFileError("writer_content_too_large", 413)
+        message = item["message"]
+        if (
+            not isinstance(message, str)
+            or not 1 <= len(message) <= 200
+            or "\x00" in message
+            or "\n" in message
+            or "\r" in message
+        ):
+            raise CommitFileError("writer_message_rejected")
+        if not isinstance(item["expected_head_oid"], str) or not OID_RE.fullmatch(item["expected_head_oid"]):
+            raise CommitFileError("writer_expected_head_rejected")
+        if not isinstance(item["idempotency_key"], str) or not IDEMPOTENCY_RE.fullmatch(item["idempotency_key"]):
+            raise CommitFileError("writer_idempotency_key_rejected")
+        return item
+
+    def _atomic_write(self, relative: str, content: str) -> None:
+        target = self.workspace / relative
+        target.parent.mkdir(parents=True, exist_ok=True)
+        fd, temporary = tempfile.mkstemp(prefix=".writer-", dir=target.parent)
+        try:
+            with os.fdopen(fd, "wb", closefd=True) as stream:
+                stream.write(content.encode("utf-8"))
+                stream.flush()
+                os.fsync(stream.fileno())
+            os.replace(temporary, target)
+            parent_fd = os.open(target.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
+            try:
+                os.fsync(parent_fd)
+            finally:
+                os.close(parent_fd)
+        finally:
+            if os.path.exists(temporary):
+                os.unlink(temporary)
+
+    def _verify_remote(self, branch: str, oid: str) -> None:
+        bare = subprocess.run(
+            ["git", "--git-dir", str(self.bare_repo), "rev-parse", f"refs/heads/{branch}"],
+            text=True, capture_output=True,
+        )
+        if bare.returncode != 0 or bare.stdout.strip() != oid:
+            raise CommitFileError("writer_authoritative_bare_oid_mismatch", 500)
+        remote = subprocess.run(
+            ["git", "ls-remote", "--heads", self.remote, f"refs/heads/{branch}"],
+            cwd=self.workspace, text=True, capture_output=True,
+        )
+        if remote.returncode != 0:
+            raise CommitFileError("writer_gitea_verification_failed", 503)
+        fields = remote.stdout.strip().split()
+        if len(fields) != 2:
+            raise CommitFileError("writer_gitea_ref_missing", 503)
+        if fields[0] != oid:
+            raise CommitFileError("writer_gitea_oid_conflict", 409)
+
+    def execute(self, grant: Any, raw_data: Any) -> dict[str, Any]:
+        data = self._validate(raw_data)
+        digest = canonical_digest(data)
+        branch = data["branch"]
+        with _LOCKS_GUARD:
+            lock = _LOCKS.setdefault(branch, threading.Lock())
+        lock_path = self.ledger.path.parent / f"{hashlib.sha256(branch.encode()).hexdigest()}.lock"
+        with lock, open(lock_path, "a+b") as branch_lock:
+            fcntl.flock(branch_lock.fileno(), fcntl.LOCK_EX)
+            return self._execute_locked(grant, data, digest)
+
+    def _execute_locked(self, grant: Any, data: dict[str, Any], digest: str) -> dict[str, Any]:
+        key = data["idempotency_key"]
+        record = self.ledger.get_or_create(grant, data, digest)
+        if record["state"] == "COMPLETED":
+            return self._result(record, idempotent=True)
+        if self._git("rev-parse", "--abbrev-ref", "HEAD") != data["branch"]:
+            record = self._transition(
+                key, "MANUAL_REVIEW_REQUIRED", error_code="writer_current_branch_conflict"
+            )
+            self._audit(grant, data, digest, record, "manual_review_required")
+            raise CommitFileError("writer_current_branch_conflict", 409)
+        head = self._git("rev-parse", "HEAD")
+        commit_oid = record.get("commit_oid")
+        if head != record["pre_head_oid"] and head != commit_oid:
+            record = self._transition(
+                key, "MANUAL_REVIEW_REQUIRED", error_code="writer_branch_head_conflict"
+            )
+            self._audit(grant, data, digest, record, "manual_review_required")
+            raise CommitFileError("writer_branch_head_conflict", 409)
+        try:
+            state = record["state"]
+            if state == "MANUAL_REVIEW_REQUIRED":
+                raise CommitFileError("writer_manual_review_required", 409)
+            if state == "FAILED_RECOVERABLE":
+                if record.get("push_status") == "confirmed":
+                    state = "PUSHED"
+                else:
+                    state = "COMMITTED" if commit_oid else "FILE_WRITTEN"
+            if state == "PENDING":
+                self._atomic_write(data["path"], data["content"])
+                record = self._transition(key, "FILE_WRITTEN")
+                state = record["state"]
+            if state == "FILE_WRITTEN":
+                actual_sha = hashlib.sha256(
+                    (self.workspace / data["path"]).read_bytes()
+                ).hexdigest()
+                if actual_sha != record["content_sha256"]:
+                    raise CommitFileError("writer_file_content_conflict", 409)
+                staged_before = self._git("diff", "--cached", "--name-only", check=False).splitlines()
+                if staged_before:
+                    raise CommitFileError("writer_extra_staged_files_rejected", 409)
+                self._git("add", "--", data["path"])
+                staged = self._git("diff", "--cached", "--name-only").splitlines()
+                if staged != [data["path"]]:
+                    raise CommitFileError("writer_extra_staged_files_rejected", 409)
+                self._git("commit", "-m", data["message"])
+                commit_oid = self._git("rev-parse", "HEAD")
+                record = self._transition(key, "COMMITTED", commit_oid=commit_oid)
+                state = record["state"]
+            if state == "COMMITTED":
+                commit_oid = str(record["commit_oid"])
+                pushed = subprocess.run(
+                    ["git", "push", "--porcelain", self.remote, f"HEAD:refs/heads/{data['branch']}"],
+                    cwd=self.workspace, text=True, capture_output=True,
+                )
+                if pushed.returncode != 0:
+                    self._transition(
+                        key, "FAILED_RECOVERABLE",
+                        push_status="failed", error_code="writer_gitea_push_failed",
+                    )
+                    raise CommitFileError("writer_gitea_push_failed", 503)
+                record = self._transition(key, "PUSHED", push_status="confirmed")
+                state = record["state"]
+            if state == "PUSHED":
+                commit_oid = str(record["commit_oid"])
+                self._verify_remote(data["branch"], commit_oid)
+                record = self._transition(
+                    key, "VERIFIED", verification_status="bare+gitea"
+                )
+                state = record["state"]
+            if state == "VERIFIED":
+                record = self._transition(key, "COMPLETED", error_code=None)
+            self._audit(grant, data, digest, record, "completed")
+            return self._result(record, idempotent=False)
+        except SimulatedCrash:
+            raise
+        except CommitFileError as exc:
+            latest = self.ledger.get(key)
+            if latest["state"] not in {"FAILED_RECOVERABLE", "MANUAL_REVIEW_REQUIRED"}:
+                failure_state = (
+                    "MANUAL_REVIEW_REQUIRED"
+                    if exc.code in {
+                        "writer_gitea_oid_conflict",
+                        "writer_file_content_conflict",
+                        "writer_current_branch_conflict",
+                    }
+                    else "FAILED_RECOVERABLE"
+                )
+                latest = self._transition(key, failure_state, error_code=exc.code)
+            self._audit(grant, data, digest, latest, "failed")
+            raise
+
+    def _audit(self, grant: Any, data: dict[str, Any], digest: str, record: dict[str, Any], result: str) -> None:
+        self.audit({
+            "token_id": grant.token_id,
+            "task_id": grant.task_id,
+            "audience": grant.record["audience"],
+            "source_ip": grant.record.get("_source_ip", "socket-peer"),
+            "operation": grant.operation,
+            "branch": data["branch"],
+            "path": data["path"],
+            "idempotency_key": data["idempotency_key"],
+            "operation_digest": digest,
+            "path_policy_sha256": policy.configured_path_policy_sha256(),
+            "pre_head_oid": record["pre_head_oid"],
+            "commit_oid": record.get("commit_oid"),
+            "result": result,
+        })
+
+    @staticmethod
+    def _result(record: dict[str, Any], *, idempotent: bool) -> dict[str, Any]:
+        return {
+            "status": "completed",
+            "state": record["state"],
+            "operation_id": record["operation_id"],
+            "branch": record["branch"],
+            "path": record["path"],
+            "commit_oid": record.get("commit_oid"),
+            "push_status": record.get("push_status"),
+            "verification_status": record.get("verification_status"),
+            "idempotent": idempotent,
+        }

active-runtime/app/isolated_writer_path_policy.py

@@ -0,0 +1,422 @@
+"""Strict service-level exact-path policy for isolated Git writers."""
+from __future__ import annotations
+
+import grp
+import hashlib
+import json
+import os
+import re
+import stat
+from dataclasses import dataclass
+from functools import lru_cache
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from typing import Any
+from urllib.parse import unquote
+
+
+MAX_POLICY_BYTES = 65_536
+POLICY_FIELDS = frozenset(
+    {
+        "schema_version",
+        "policy_id",
+        "audience",
+        "repository_identity",
+        "allowed_branch",
+        "allowed_operations",
+    }
+)
+OPERATION_FIELDS = frozenset({"exact_paths", "max_content_bytes", "content_profile"})
+SUPPORTED_OPERATIONS = frozenset({"commit_file.atomic"})
+SUPPORTED_CONTENT_PROFILES = frozenset({"systemd-codex-review-worker-v1"})
+_SECRET_RE = re.compile(
+    r"(?i)(authorization\s*:|bearer\s+|(?:token|password|secret)\s*[:=])"
+)
+_SYSTEMD_NAME_RE = re.compile(r"[A-Za-z][A-Za-z0-9]*\Z")
+_SYSTEMD_MAX_LINE_BYTES = 4096
+_SYSTEMD_ALLOWED_DIRECTIVES = {
+    "Unit": frozenset({"Description", "After", "Wants"}),
+    "Service": frozenset(
+        {
+            "Type",
+            "User",
+            "Group",
+            "WorkingDirectory",
+            "Environment",
+            "ExecStart",
+            "Restart",
+            "RestartSec",
+            "NoNewPrivileges",
+            "PrivateTmp",
+            "PrivateDevices",
+            "ProtectSystem",
+            "ProtectHome",
+            "ProtectKernelTunables",
+            "ProtectKernelModules",
+            "ProtectControlGroups",
+            "LockPersonality",
+            "RestrictSUIDSGID",
+            "RestrictRealtime",
+            "MemoryDenyWriteExecute",
+            "RuntimeDirectory",
+            "StateDirectory",
+            "CacheDirectory",
+            "ReadOnlyPaths",
+            "ReadWritePaths",
+            "UMask",
+        }
+    ),
+    "Install": frozenset({"WantedBy"}),
+}
+_SYSTEMD_MULTI_DIRECTIVES = frozenset(
+    {
+        ("Service", "Environment"),
+        ("Service", "ReadOnlyPaths"),
+        ("Service", "ReadWritePaths"),
+    }
+)
+_SYSTEMD_EXACT_SINGLE_VALUES = {
+    ("Unit", "Description"): "AIOS Codex Review/Test Worker",
+    ("Unit", "After"): "network-online.target",
+    ("Unit", "Wants"): "network-online.target",
+    ("Service", "Type"): "simple",
+    ("Service", "User"): "aiman",
+    ("Service", "Group"): "gitops",
+    (
+        "Service",
+        "WorkingDirectory",
+    ): "/usr/libexec/aios-codex-review-test-worker/current",
+    (
+        "Service",
+        "ExecStart",
+    ): "/usr/bin/python3 -m task_plane.workers.codex_review_test",
+    ("Service", "Restart"): "on-failure",
+    ("Service", "RestartSec"): "2",
+    ("Service", "NoNewPrivileges"): "true",
+    ("Service", "PrivateTmp"): "true",
+    ("Service", "PrivateDevices"): "true",
+    ("Service", "ProtectSystem"): "strict",
+    ("Service", "ProtectHome"): "true",
+    ("Service", "ProtectKernelTunables"): "true",
+    ("Service", "ProtectKernelModules"): "true",
+    ("Service", "ProtectControlGroups"): "true",
+    ("Service", "LockPersonality"): "true",
+    ("Service", "RestrictSUIDSGID"): "true",
+    ("Service", "RestrictRealtime"): "true",
+    ("Service", "MemoryDenyWriteExecute"): "true",
+    ("Service", "RuntimeDirectory"): "aios-codex-review-test-worker",
+    ("Service", "StateDirectory"): "aios-codex-review-test-worker",
+    ("Service", "CacheDirectory"): "aios-codex-review-test-worker",
+    ("Service", "UMask"): "0077",
+    ("Install", "WantedBy"): "multi-user.target",
+}
+_SYSTEMD_EXACT_MULTI_VALUES = {
+    ("Service", "Environment"): (
+        "AIOS_CODEX_WORKER_MODE=shadow",
+        "AIOS_TASK_PLANE_EXECUTION_ENABLED=false",
+        "PYTHONDONTWRITEBYTECODE=1",
+    ),
+    ("Service", "ReadOnlyPaths"): (
+        "/data/aios-gitops/repo.git",
+        "/usr/libexec/aios-codex-review-test-worker",
+    ),
+    ("Service", "ReadWritePaths"): (
+        "/run/aios-codex-review-test-worker",
+        "/var/lib/aios-codex-review-test-worker",
+        "/var/cache/aios-codex-review-test-worker",
+    ),
+}
+
+
+class PathPolicyError(PermissionError):
+    pass
+
+
+@dataclass(frozen=True)
+class OperationPolicy:
+    exact_paths: tuple[str, ...]
+    max_content_bytes: int
+    content_profile: str
+
+
+@dataclass(frozen=True)
+class ServicePathPolicy:
+    schema_version: int
+    policy_id: str
+    audience: str
+    repository_identity: str
+    allowed_branch: str
+    allowed_operations: dict[str, OperationPolicy]
+    sha256: str
+
+    def operation(self, name: str) -> OperationPolicy:
+        try:
+            return self.allowed_operations[name]
+        except KeyError:
+            raise PathPolicyError("isolated_writer_service_operation_rejected") from None
+
+    def require_exact_path(self, operation: str, path: str) -> OperationPolicy:
+        selected = self.operation(operation)
+        if path not in selected.exact_paths:
+            raise PathPolicyError("isolated_writer_service_path_rejected")
+        return selected
+
+
+def _canonical_json(value: Any) -> bytes:
+    return (
+        json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+        + "\n"
+    ).encode("utf-8")
+
+
+def validate_relative_path_syntax(path: str) -> str:
+    if not isinstance(path, str):
+        raise PathPolicyError("isolated_writer_path_rejected")
+    if not path or path != path.strip() or "\x00" in path or "\\" in path:
+        raise PathPolicyError("isolated_writer_path_rejected")
+    try:
+        decoded = unquote(path, errors="strict")
+    except (UnicodeDecodeError, ValueError):
+        raise PathPolicyError("isolated_writer_path_rejected") from None
+    if decoded != path:
+        raise PathPolicyError("isolated_writer_path_rejected")
+    posix = PurePosixPath(path)
+    windows = PureWindowsPath(path)
+    parts = path.split("/")
+    if (
+        posix.is_absolute()
+        or windows.is_absolute()
+        or bool(windows.drive)
+        or any(part in {"", ".", ".."} for part in parts)
+    ):
+        raise PathPolicyError("isolated_writer_path_rejected")
+    return path
+
+
+def _require_fields(value: dict[str, Any], allowed: frozenset[str], code: str) -> None:
+    if set(value) != allowed:
+        raise PathPolicyError(code)
+
+
+def _parse_policy(document: Any, canonical: bytes) -> ServicePathPolicy:
+    if not isinstance(document, dict):
+        raise PathPolicyError("isolated_writer_path_policy_object_required")
+    _require_fields(document, POLICY_FIELDS, "isolated_writer_path_policy_fields_rejected")
+    if document["schema_version"] != 1:
+        raise PathPolicyError("isolated_writer_path_policy_schema_rejected")
+    text_fields = (
+        "policy_id",
+        "audience",
+        "repository_identity",
+        "allowed_branch",
+    )
+    if any(
+        not isinstance(document[field], str) or not document[field].strip()
+        for field in text_fields
+    ):
+        raise PathPolicyError("isolated_writer_path_policy_value_rejected")
+    raw_operations = document["allowed_operations"]
+    if not isinstance(raw_operations, dict) or not raw_operations:
+        raise PathPolicyError("isolated_writer_path_policy_operations_rejected")
+    if not set(raw_operations).issubset(SUPPORTED_OPERATIONS):
+        raise PathPolicyError("isolated_writer_path_policy_operations_rejected")
+    operations: dict[str, OperationPolicy] = {}
+    for name, raw in raw_operations.items():
+        if not isinstance(raw, dict):
+            raise PathPolicyError("isolated_writer_path_policy_operation_rejected")
+        _require_fields(
+            raw,
+            OPERATION_FIELDS,
+            "isolated_writer_path_policy_operation_fields_rejected",
+        )
+        paths = raw["exact_paths"]
+        if (
+            not isinstance(paths, list)
+            or not paths
+            or any(not isinstance(item, str) for item in paths)
+        ):
+            raise PathPolicyError("isolated_writer_path_policy_paths_rejected")
+        validated = tuple(validate_relative_path_syntax(item) for item in paths)
+        if len(set(validated)) != len(validated):
+            raise PathPolicyError("isolated_writer_path_policy_paths_rejected")
+        maximum = raw["max_content_bytes"]
+        if not isinstance(maximum, int) or isinstance(maximum, bool) or not 1 <= maximum <= 1_048_576:
+            raise PathPolicyError("isolated_writer_path_policy_size_rejected")
+        profile = raw["content_profile"]
+        if profile not in SUPPORTED_CONTENT_PROFILES:
+            raise PathPolicyError("isolated_writer_path_policy_profile_rejected")
+        operations[name] = OperationPolicy(validated, maximum, profile)
+    return ServicePathPolicy(
+        schema_version=1,
+        policy_id=document["policy_id"],
+        audience=document["audience"],
+        repository_identity=document["repository_identity"],
+        allowed_branch=document["allowed_branch"],
+        allowed_operations=operations,
+        sha256=hashlib.sha256(canonical).hexdigest(),
+    )
+
+
+def load_path_policy(
+    path: Path,
+    *,
+    expected_owner_uid: int = 0,
+    expected_group_gid: int | None = None,
+    expected_parent_mode: int = 0o750,
+    expected_file_mode: int = 0o640,
+) -> ServicePathPolicy:
+    lexical = Path(os.path.abspath(str(path)))
+    if lexical.is_symlink():
+        raise PathPolicyError("isolated_writer_path_policy_symlink_rejected")
+    try:
+        parent_info = lexical.parent.stat(follow_symlinks=False)
+        file_info = lexical.stat(follow_symlinks=False)
+    except FileNotFoundError:
+        raise PathPolicyError("isolated_writer_path_policy_missing") from None
+    if stat.S_ISLNK(parent_info.st_mode) or not stat.S_ISDIR(parent_info.st_mode):
+        raise PathPolicyError("isolated_writer_path_policy_parent_rejected")
+    if stat.S_ISLNK(file_info.st_mode) or not stat.S_ISREG(file_info.st_mode):
+        raise PathPolicyError("isolated_writer_path_policy_file_rejected")
+    if lexical.resolve(strict=True) != lexical:
+        raise PathPolicyError("isolated_writer_path_policy_symlink_rejected")
+    if (
+        parent_info.st_uid != expected_owner_uid
+        or stat.S_IMODE(parent_info.st_mode) != expected_parent_mode
+    ):
+        raise PathPolicyError("isolated_writer_path_policy_parent_permissions_rejected")
+    if (
+        file_info.st_uid != expected_owner_uid
+        or stat.S_IMODE(file_info.st_mode) != expected_file_mode
+    ):
+        raise PathPolicyError("isolated_writer_path_policy_permissions_rejected")
+    if expected_group_gid is not None and (
+        parent_info.st_gid != expected_group_gid or file_info.st_gid != expected_group_gid
+    ):
+        raise PathPolicyError("isolated_writer_path_policy_group_rejected")
+    if file_info.st_size <= 0 or file_info.st_size > MAX_POLICY_BYTES:
+        raise PathPolicyError("isolated_writer_path_policy_file_size_rejected")
+    raw = lexical.read_bytes()
+    try:
+        document = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        raise PathPolicyError("isolated_writer_path_policy_json_rejected") from None
+    canonical = _canonical_json(document)
+    if raw != canonical:
+        raise PathPolicyError("isolated_writer_path_policy_not_canonical")
+    return _parse_policy(document, canonical)
+
+
+@lru_cache(maxsize=1)
+def configured_path_policy() -> ServicePathPolicy | None:
+    configured = os.getenv("AIOS_GITOPS_PATH_POLICY_FILE", "").strip()
+    if not configured:
+        return None
+    if not Path(configured).is_absolute():
+        raise PathPolicyError("isolated_writer_path_policy_path_rejected")
+    try:
+        gitops_gid = grp.getgrnam("gitops").gr_gid
+    except KeyError:
+        raise PathPolicyError("isolated_writer_path_policy_group_rejected") from None
+    loaded = load_path_policy(Path(configured), expected_group_gid=gitops_gid)
+    if loaded.audience != os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", ""):
+        raise PathPolicyError("isolated_writer_path_policy_audience_rejected")
+    if loaded.repository_identity != os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", ""):
+        raise PathPolicyError("isolated_writer_path_policy_repository_rejected")
+    if loaded.allowed_branch != os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", ""):
+        raise PathPolicyError("isolated_writer_path_policy_branch_rejected")
+    return loaded
+
+
+def clear_path_policy_cache() -> None:
+    configured_path_policy.cache_clear()
+
+
+def require_service_path(operation: str, path: str) -> OperationPolicy:
+    loaded = configured_path_policy()
+    if loaded is None:
+        raise PathPolicyError("isolated_writer_service_path_policy_required")
+    return loaded.require_exact_path(operation, path)
+
+
+def configured_path_policy_sha256() -> str | None:
+    loaded = configured_path_policy()
+    return None if loaded is None else loaded.sha256
+
+
+def validate_content(operation: str, path: str, content: str) -> None:
+    selected = require_service_path(operation, path)
+    try:
+        encoded = content.encode("utf-8", errors="strict")
+    except (AttributeError, UnicodeEncodeError):
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected") from None
+    if len(encoded) > selected.max_content_bytes:
+        raise PathPolicyError("isolated_writer_service_content_too_large")
+    if selected.content_profile == "systemd-codex-review-worker-v1":
+        _validate_systemd_codex_review_worker(content)
+        return
+    raise PathPolicyError("isolated_writer_path_policy_profile_rejected")
+
+
+def _validate_systemd_codex_review_worker(content: str) -> None:
+    if not isinstance(content, str):
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+    try:
+        content.encode("utf-8", errors="strict")
+    except UnicodeEncodeError:
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected") from None
+    if (
+        "\x00" in content
+        or "\r" in content
+        or _SECRET_RE.search(content)
+        or not content.endswith("\n")
+    ):
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+
+    sections: set[str] = set()
+    values: dict[tuple[str, str], list[str]] = {}
+    section: str | None = None
+    for line in content.splitlines():
+        if len(line.encode("utf-8")) > _SYSTEMD_MAX_LINE_BYTES:
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+        if not line:
+            continue
+        if line[0].isspace() or line.startswith(("#", ";")):
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+        if line.startswith("[") and line.endswith("]"):
+            candidate = line[1:-1]
+            if (
+                not _SYSTEMD_NAME_RE.fullmatch(candidate)
+                or candidate not in _SYSTEMD_ALLOWED_DIRECTIVES
+                or candidate in sections
+            ):
+                raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+            sections.add(candidate)
+            section = candidate
+            continue
+        if section is None or "=" not in line:
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+        directive, value = line.split("=", 1)
+        if (
+            not _SYSTEMD_NAME_RE.fullmatch(directive)
+            or directive not in _SYSTEMD_ALLOWED_DIRECTIVES[section]
+            or not value
+            or value != value.strip()
+        ):
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+        key = (section, directive)
+        if key in values and key not in _SYSTEMD_MULTI_DIRECTIVES:
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+        values.setdefault(key, []).append(value)
+
+    if sections != set(_SYSTEMD_ALLOWED_DIRECTIVES):
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+    if set(values) != set(_SYSTEMD_EXACT_SINGLE_VALUES) | set(
+        _SYSTEMD_EXACT_MULTI_VALUES
+    ):
+        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+    for key, expected in _SYSTEMD_EXACT_SINGLE_VALUES.items():
+        if values.get(key) != [expected]:
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")
+    for key, expected in _SYSTEMD_EXACT_MULTI_VALUES.items():
+        observed = values.get(key, [])
+        if len(observed) != len(set(observed)) or tuple(observed) != expected:
+            raise PathPolicyError("isolated_writer_systemd_profile_rejected")

active-runtime/app/isolated_writer_token_registry.py

@@ -0,0 +1,241 @@
+"""Digest-only, task-scoped token registry for isolated writers."""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import hmac
+import json
+import os
+import grp
+import pwd
+import secrets
+import sqlite3
+import stat
+import threading
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+_REGISTRY_INIT_LOCK = threading.Lock()
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def token_digest(token: str) -> str:
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+class TokenRegistry:
+    def __init__(self, path: Path | str):
+        self.path = Path(path)
+        self._prepare()
+
+    def _prepare(self) -> None:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        if self.path.parent.is_symlink() or self.path.is_symlink():
+            raise PermissionError("writer_token_registry_symlink_rejected")
+        with _REGISTRY_INIT_LOCK:
+            with self._connect() as db:
+                db.executescript(
+                    """
+                    CREATE TABLE IF NOT EXISTS token_grants (
+                        token_id TEXT PRIMARY KEY,
+                        token_digest TEXT NOT NULL UNIQUE,
+                        grant_json TEXT NOT NULL,
+                        revoked INTEGER NOT NULL DEFAULT 0,
+                        created_at TEXT NOT NULL
+                    );
+                    CREATE TABLE IF NOT EXISTS token_uses (
+                        token_id TEXT NOT NULL,
+                        operation TEXT NOT NULL,
+                        use_count INTEGER NOT NULL DEFAULT 0,
+                        PRIMARY KEY(token_id, operation),
+                        FOREIGN KEY(token_id) REFERENCES token_grants(token_id)
+                    );
+                    """
+                )
+        os.chmod(self.path, 0o600)
+
+    def _connect(self) -> sqlite3.Connection:
+        db = sqlite3.connect(self.path, timeout=30, isolation_level=None)
+        db.row_factory = sqlite3.Row
+        db.execute("PRAGMA journal_mode=WAL")
+        db.execute("PRAGMA synchronous=FULL")
+        db.execute("PRAGMA foreign_keys=ON")
+        return db
+
+    def issue(self, grant: dict[str, Any], token: str | None = None) -> tuple[str, dict[str, Any]]:
+        value = token or secrets.token_urlsafe(32)
+        if len(value.encode("utf-8")) < 32:
+            raise ValueError("writer_token_entropy_insufficient")
+        record = dict(grant)
+        record["schema_version"] = 2
+        record["token_digest"] = token_digest(value)
+        record["revoked"] = False
+        record.setdefault("created_at", utc_now())
+        required = (
+            "token_id",
+            "audience",
+            "task_id",
+            "source_cidrs",
+            "allowed_branch",
+            "approved_base_oid",
+            "allowed_operations",
+            "allowed_paths",
+            "not_before",
+            "expires_at",
+            "max_uses",
+            "issued_by",
+        )
+        if any(not record.get(field) for field in required):
+            raise ValueError("writer_token_grant_incomplete")
+        encoded = json.dumps(record, sort_keys=True, separators=(",", ":"))
+        with self._connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            try:
+                db.execute(
+                    """
+                    INSERT INTO token_grants(token_id, token_digest, grant_json, revoked, created_at)
+                    VALUES(?,?,?,?,?)
+                    """,
+                    (
+                        str(record["token_id"]),
+                        str(record["token_digest"]),
+                        encoded,
+                        0,
+                        str(record["created_at"]),
+                    ),
+                )
+                db.execute("COMMIT")
+            except Exception:
+                db.execute("ROLLBACK")
+                raise
+        return value, record
+
+    def find(self, token: str) -> dict[str, Any] | None:
+        candidate = token_digest(token)
+        with self._connect() as db:
+            rows = db.execute(
+                "SELECT token_digest, grant_json, revoked FROM token_grants"
+            ).fetchall()
+        match = None
+        for row in rows:
+            if hmac.compare_digest(str(row["token_digest"]), candidate):
+                match = dict(json.loads(str(row["grant_json"])))
+                match["revoked"] = bool(row["revoked"])
+        return match
+
+    def consume(self, token_id: str, operation: str, maximum: int) -> int:
+        if maximum < 1:
+            raise PermissionError("writer_token_operation_exhausted")
+        with self._connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            try:
+                row = db.execute(
+                    "SELECT revoked FROM token_grants WHERE token_id=?",
+                    (token_id,),
+                ).fetchone()
+                if row is None or bool(row["revoked"]):
+                    raise PermissionError("writer_token_revoked")
+                used_row = db.execute(
+                    "SELECT use_count FROM token_uses WHERE token_id=? AND operation=?",
+                    (token_id, operation),
+                ).fetchone()
+                used = int(used_row["use_count"]) if used_row else 0
+                if used >= maximum:
+                    raise PermissionError("writer_token_operation_exhausted")
+                current = used + 1
+                db.execute(
+                    """
+                    INSERT INTO token_uses(token_id, operation, use_count)
+                    VALUES(?,?,?)
+                    ON CONFLICT(token_id, operation)
+                    DO UPDATE SET use_count=excluded.use_count
+                    """,
+                    (token_id, operation, current),
+                )
+                db.execute("COMMIT")
+                return current
+            except Exception:
+                db.execute("ROLLBACK")
+                raise
+
+    def revoke(self, token_id: str) -> bool:
+        with self._connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            changed = db.execute(
+                "UPDATE token_grants SET revoked=1 WHERE token_id=? AND revoked=0",
+                (token_id,),
+            ).rowcount
+            db.execute("COMMIT")
+        return bool(changed)
+
+    def usage(self, token_id: str, operation: str) -> int:
+        with self._connect() as db:
+            row = db.execute(
+                "SELECT use_count FROM token_uses WHERE token_id=? AND operation=?",
+                (token_id, operation),
+            ).fetchone()
+        return int(row["use_count"]) if row else 0
+
+
+def _write_secret_file(
+    path: Path,
+    token: str,
+    *,
+    owner: str | None = None,
+    group: str | None = None,
+) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    if path.parent.is_symlink() or path.is_symlink():
+        raise PermissionError("writer_token_file_symlink_rejected")
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    fd = os.open(path, flags, 0o600)
+    try:
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            raise PermissionError("writer_token_file_not_regular")
+        if owner is not None or group is not None:
+            uid = pwd.getpwnam(owner).pw_uid if owner is not None else -1
+            gid = grp.getgrnam(group).gr_gid if group is not None else -1
+            os.fchown(fd, uid, gid)
+        os.write(fd, token.encode("utf-8"))
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--registry", required=True)
+    sub = parser.add_subparsers(dest="command", required=True)
+    issue = sub.add_parser("issue")
+    issue.add_argument("--grant-file", required=True)
+    issue.add_argument("--token-file", required=True)
+    issue.add_argument("--owner")
+    issue.add_argument("--group")
+    revoke = sub.add_parser("revoke")
+    revoke.add_argument("--token-id", required=True)
+    args = parser.parse_args(argv)
+    registry = TokenRegistry(args.registry)
+    if args.command == "issue":
+        grant = json.loads(Path(args.grant_file).read_text(encoding="utf-8"))
+        token, record = registry.issue(grant)
+        _write_secret_file(
+            Path(args.token_file),
+            token,
+            owner=args.owner,
+            group=args.group,
+        )
+        print(json.dumps({"token_id": record["token_id"], "created": True}, sort_keys=True))
+        return 0
+    changed = registry.revoke(args.token_id)
+    print(json.dumps({"token_id": args.token_id, "revoked": changed}, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

active-runtime/app/silent_release_execution.py

@@ -0,0 +1,564 @@
+#!/usr/bin/env python3
+"""Execution-readiness adapters and the fail-closed Shadow controller service."""
+from __future__ import annotations
+
+import argparse
+import base64
+import dataclasses
+import hashlib
+import json
+import os
+import subprocess
+import threading
+import time
+from http import HTTPStatus
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from typing import Any, Callable, Mapping, Protocol
+from urllib.parse import parse_qs, urlparse
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey,
+)
+
+from silent_release_controller import _sanitize, utc_now
+from silent_release_hardening import (
+    BuilderAttestation,
+    CapabilityAuthorizationError,
+    ReleaseRecoveryWorker,
+    SignedApprovalVerifier,
+    SignedReleasePlanApproval,
+    SilentReleaseActionService,
+    TrustedCandidateBundle,
+    _canonical_json,
+    _durable_json,
+    _safe_child,
+)
+
+
+class BuilderSigner(Protocol):
+    @property
+    def key_id(self) -> str:
+        ...
+
+    def sign(self, payload: bytes) -> bytes:
+        ...
+
+
+class LocalTestBuilderSigner:
+    """Ephemeral in-memory signer. It is forbidden for production execution."""
+
+    test_only = True
+
+    def __init__(self, key_id: str, private_key: Ed25519PrivateKey):
+        self._key_id = str(key_id)
+        self._private_key = private_key
+
+    @property
+    def key_id(self) -> str:
+        return self._key_id
+
+    @classmethod
+    def generate(
+        cls, key_id: str = "shadow-builder-test-key"
+    ) -> "LocalTestBuilderSigner":
+        return cls(key_id, Ed25519PrivateKey.generate())
+
+    @property
+    def public_key(self):
+        return self._private_key.public_key()
+
+    def sign(self, payload: bytes) -> bytes:
+        return self._private_key.sign(payload)
+
+
+class ExternalKmsBuilderSigner:
+    """Signer facade whose private operation remains in KMS/HSM."""
+
+    def __init__(
+        self,
+        key_id: str,
+        credential_reference: str,
+        sign_callback: Callable[[str, bytes], bytes],
+    ):
+        if not str(credential_reference).startswith(
+            ("kms://", "hsm://", "secret-manager://")
+        ):
+            raise ValueError("production builder requires a KMS/HSM reference")
+        self._key_id = str(key_id)
+        self.credential_reference = str(credential_reference)
+        self._sign_callback = sign_callback
+
+    @property
+    def key_id(self) -> str:
+        return self._key_id
+
+    def sign(self, payload: bytes) -> bytes:
+        return bytes(self._sign_callback(self.credential_reference, payload))
+
+
+class SignedTrustedBuilderAdapter:
+    """Signs evidence produced by a trusted collector, never caller evidence."""
+
+    def __init__(
+        self,
+        collector: Callable[[Mapping[str, Any]], TrustedCandidateBundle],
+        signer: BuilderSigner,
+    ):
+        self.collector = collector
+        self.signer = signer
+
+    def build(self, intent: Mapping[str, Any]) -> TrustedCandidateBundle:
+        forbidden = {
+            "artifact_sha256",
+            "canary",
+            "checks",
+            "manifest_sha256",
+            "tests",
+            "tree_oid",
+        }
+        if forbidden.intersection(intent):
+            raise CapabilityAuthorizationError(
+                "trusted builder rejects caller-supplied evidence"
+            )
+        unsigned = self.collector(dict(intent))
+        if unsigned.attestation is not None:
+            raise CapabilityAuthorizationError(
+                "collector cannot self-attest its evidence"
+            )
+        candidate = unsigned.candidate
+        test_sha = hashlib.sha256(
+            _canonical_json(_sanitize(candidate.tests))
+        ).hexdigest()
+        canary_sha = hashlib.sha256(
+            _canonical_json(_sanitize(candidate.canary))
+        ).hexdigest()
+        attestation_id = "builder-attestation-" + hashlib.sha256(
+            (
+                candidate.candidate_id
+                + "\0"
+                + candidate.source_commit
+                + "\0"
+                + candidate.artifact_sha256
+            ).encode("utf-8")
+        ).hexdigest()[:24]
+        attestation = BuilderAttestation(
+            builder_attestation_id=attestation_id,
+            builder_key_id=self.signer.key_id,
+            source_commit=candidate.source_commit,
+            tree_oid=candidate.tree_oid,
+            artifact_sha256=candidate.artifact_sha256,
+            manifest_sha256=candidate.manifest_sha256,
+            package_closure_sha256=(
+                unsigned.release_plan.deployment.package_closure_sha256
+            ),
+            test_evidence_sha256=test_sha,
+            canary_evidence_sha256=canary_sha,
+            issued_at=utc_now(),
+            signature="",
+        )
+        attestation = dataclasses.replace(
+            attestation,
+            signature=base64.b64encode(
+                self.signer.sign(attestation.canonical_bytes())
+            ).decode("ascii"),
+        )
+        return dataclasses.replace(unsigned, attestation=attestation)
+
+
+class ApprovalBackendAdapter(Protocol):
+    @property
+    def available(self) -> bool:
+        ...
+
+    def verify(
+        self,
+        approval: SignedReleasePlanApproval,
+        *,
+        candidate,
+        release_plan,
+        policy_sha256: str,
+    ) -> SignedReleasePlanApproval:
+        ...
+
+
+class LocalTestApprovalSigner:
+    """Test-only approval signer used solely for Shadow acceptance."""
+
+    test_only = True
+
+    def __init__(self, key_id: str, private_key: Ed25519PrivateKey):
+        self.key_id = str(key_id)
+        self.private_key = private_key
+
+    @classmethod
+    def generate(
+        cls, key_id: str = "shadow-owner-test-key"
+    ) -> "LocalTestApprovalSigner":
+        return cls(key_id, Ed25519PrivateKey.generate())
+
+    def sign(
+        self, approval: SignedReleasePlanApproval
+    ) -> SignedReleasePlanApproval:
+        unsigned = dataclasses.replace(
+            approval, key_id=self.key_id, signature=""
+        )
+        return dataclasses.replace(
+            unsigned,
+            signature=base64.b64encode(
+                self.private_key.sign(unsigned.canonical_bytes())
+            ).decode("ascii"),
+        )
+
+
+class ProductionApprovalBackendAdapter:
+    """Verification-only production adapter configured by a secret/KMS ref."""
+
+    def __init__(
+        self,
+        verifier: SignedApprovalVerifier,
+        credential_reference: str,
+    ):
+        if not str(credential_reference).startswith(
+            ("kms://", "hsm://", "secret-manager://")
+        ):
+            raise ValueError(
+                "production approval backend requires a KMS/secret reference"
+            )
+        self.verifier = verifier
+        self.credential_reference = str(credential_reference)
+
+    @property
+    def available(self) -> bool:
+        return True
+
+    def verify(
+        self,
+        approval: SignedReleasePlanApproval,
+        *,
+        candidate,
+        release_plan,
+        policy_sha256: str,
+    ) -> SignedReleasePlanApproval:
+        return self.verifier.verify_release_plan(
+            approval, candidate, release_plan, policy_sha256
+        )
+
+
+class UnavailableProductionApprovalBackend:
+    credential_reference = None
+
+    @property
+    def available(self) -> bool:
+        return False
+
+    def verify(self, *args, **kwargs):
+        raise CapabilityAuthorizationError(
+            "production approval backend is not configured"
+        )
+
+
+class LeaderLock:
+    def __init__(self, path: Path):
+        self.path = Path(path)
+        self.handle = None
+
+    def __enter__(self):
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        os.chmod(self.path.parent, 0o700)
+        self.handle = self.path.open("a+", encoding="utf-8")
+        os.chmod(self.path, 0o600)
+        try:
+            import fcntl
+
+            fcntl.flock(
+                self.handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB
+            )
+        except BlockingIOError as exc:
+            self.handle.close()
+            self.handle = None
+            raise RuntimeError("silent release leader is already active") from exc
+        return self
+
+    def __exit__(self, exc_type, exc, tb):
+        if self.handle is not None:
+            try:
+                import fcntl
+
+                fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
+            finally:
+                self.handle.close()
+                self.handle = None
+
+
+class PersistentSilentReleaseController:
+    """Idempotent main-event controller with durable startup/recovery reports."""
+
+    def __init__(
+        self,
+        root: Path,
+        service: SilentReleaseActionService,
+        *,
+        main_probe: Callable[[], str],
+        recovery_worker: ReleaseRecoveryWorker | None = None,
+    ):
+        self.root = Path(root)
+        self.service = service
+        self.main_probe = main_probe
+        self.recovery_worker = recovery_worker
+        self.leader_path = self.root / "controller.leader.lock"
+        self.status_path = self.root / "controller-status.json"
+
+    def startup_verify(self) -> dict[str, Any]:
+        checked = 0
+        failed = 0
+        for journal in sorted(self.service.sagas.root.glob("*.events.jsonl")):
+            candidate_id = journal.name[: -len(".events.jsonl")]
+            saga = self.service.sagas.load(candidate_id)
+            checked += 1
+            if not saga.journal_integrity:
+                failed += 1
+        status = {
+            "checked_sagas": checked,
+            "execution_enabled": self.service.execution_enabled,
+            "failed_closed": failed,
+            "shadow_mode": not self.service.execution_enabled,
+            "side_effects_executed": False,
+            "status": "READY" if failed == 0 else "FAIL_CLOSED",
+        }
+        _durable_json(self.status_path, status)
+        return status
+
+    def run_once(self) -> dict[str, Any]:
+        with LeaderLock(self.leader_path):
+            startup = self.startup_verify()
+            if startup["status"] != "READY":
+                result = {
+                    "execution_enabled": self.service.execution_enabled,
+                    "intent": None,
+                    "notification": None,
+                    "recovery": None,
+                    "shadow_mode": not self.service.execution_enabled,
+                    "side_effects_executed": False,
+                    "startup": startup,
+                    "status": "FAIL_CLOSED",
+                }
+                _durable_json(self.status_path, result)
+                return _sanitize(result)
+            source_commit = str(self.main_probe())
+            event_id = f"main-{source_commit}"
+            intent = self.service.create_release_intent(
+                {"event_id": event_id, "source_commit": source_commit}
+            )
+            notification = None
+            if intent.get("candidate_id"):
+                notification = self.service.ensure_owner_notification(
+                    str(intent["candidate_id"])
+                )
+            recovery = (
+                self.recovery_worker.run_once()
+                if self.recovery_worker is not None
+                else self.service.get_recovery_status()
+            )
+            result = {
+                "execution_enabled": self.service.execution_enabled,
+                "intent": intent,
+                "notification": notification,
+                "recovery": recovery,
+                "shadow_mode": not self.service.execution_enabled,
+                "side_effects_executed": False,
+                "startup": startup,
+            }
+            _durable_json(self.status_path, result)
+            return _sanitize(result)
+
+
+class ShadowActionHandler(BaseHTTPRequestHandler):
+    service: SilentReleaseActionService
+    controller: PersistentSilentReleaseController
+
+    def log_message(self, fmt, *args):
+        return
+
+    def _json(self, payload: Mapping[str, Any], status=HTTPStatus.OK):
+        body = json.dumps(_sanitize(dict(payload)), sort_keys=True).encode()
+        self.send_response(int(status))
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _body(self) -> dict[str, Any]:
+        size = int(self.headers.get("Content-Length", "0"))
+        if size > 1024 * 1024:
+            raise ValueError("request body is too large")
+        return json.loads(self.rfile.read(size) or b"{}")
+
+    def do_GET(self):
+        parsed = urlparse(self.path)
+        query = parse_qs(parsed.query)
+        candidate_id = str((query.get("candidate_id") or [""])[0])
+        try:
+            if parsed.path == "/healthz":
+                return self._json(
+                    {
+                        "execution_enabled": False,
+                        "shadow_mode": True,
+                        "side_effects_executed": False,
+                        "status": "ok",
+                    }
+                )
+            routes = {
+                "/getReleaseCandidate": self.service.get_release_candidate,
+                "/getReleasePlan": self.service.get_release_plan,
+                "/getReleaseAcceptance": self.service.get_acceptance,
+                "/getReleaseSaga": self.service.get_release_saga,
+                "/getCapabilityStatus": self.service.get_capability_status,
+            }
+            if parsed.path in routes:
+                return self._json(routes[parsed.path](candidate_id))
+            if parsed.path == "/getRecoveryStatus":
+                return self._json(self.service.get_recovery_status())
+            self._json({"error": "not_found"}, HTTPStatus.NOT_FOUND)
+        except (ValueError, FileNotFoundError) as exc:
+            self._json(
+                {"error": type(exc).__name__}, HTTPStatus.BAD_REQUEST
+            )
+
+    def do_POST(self):
+        parsed = urlparse(self.path)
+        try:
+            body = self._body()
+            if parsed.path == "/createReleaseIntent":
+                return self._json(self.service.create_release_intent(body))
+            if parsed.path in {
+                "/submitSignedApproval",
+                "/submitOwnerApproval",
+            }:
+                return self._json(self.service.submit_owner_approval(body))
+            if parsed.path == "/startDeployment":
+                return self._json(
+                    self.service.start_deployment(
+                        str(body.get("candidate_id") or "")
+                    )
+                )
+            self._json({"error": "not_found"}, HTTPStatus.NOT_FOUND)
+        except (ValueError, FileNotFoundError, CapabilityAuthorizationError) as exc:
+            self._json(
+                {"error": type(exc).__name__}, HTTPStatus.BAD_REQUEST
+            )
+
+
+def git_main_probe(repository: Path) -> Callable[[], str]:
+    repository = Path(repository)
+
+    def probe() -> str:
+        completed = subprocess.run(
+            [
+                "git",
+                f"--git-dir={repository}",
+                "rev-parse",
+                "refs/heads/main",
+            ],
+            check=True,
+            capture_output=True,
+            text=True,
+            timeout=15,
+            env={"PATH": os.environ.get("PATH", "")},
+        )
+        return completed.stdout.strip()
+
+    return probe
+
+
+def serve_shadow(
+    *,
+    state_root: Path,
+    repository: Path,
+    host: str,
+    port: int,
+    poll_seconds: float,
+) -> None:
+    service = SilentReleaseActionService.shadow(state_root)
+    controller = PersistentSilentReleaseController(
+        state_root,
+        service,
+        main_probe=git_main_probe(repository),
+    )
+    controller.run_once()
+    stop = threading.Event()
+
+    def controller_loop() -> None:
+        while not stop.wait(poll_seconds):
+            try:
+                controller.run_once()
+            except Exception as exc:  # fail closed and keep the API available
+                _durable_json(
+                    controller.status_path,
+                    {
+                        "error": type(exc).__name__,
+                        "execution_enabled": False,
+                        "shadow_mode": True,
+                        "side_effects_executed": False,
+                        "status": "FAIL_CLOSED",
+                    },
+                )
+
+    handler = type(
+        "ConfiguredShadowActionHandler",
+        (ShadowActionHandler,),
+        {"service": service, "controller": controller},
+    )
+    server = ThreadingHTTPServer((host, port), handler)
+    api_thread = threading.Thread(
+        target=server.serve_forever,
+        name="silent-release-shadow-api",
+        daemon=False,
+    )
+    controller_thread = threading.Thread(
+        target=controller_loop,
+        name="silent-release-shadow-controller",
+        daemon=True,
+    )
+    api_thread.start()
+    controller_thread.start()
+    try:
+        while api_thread.is_alive():
+            api_thread.join(timeout=1)
+    finally:
+        stop.set()
+        server.shutdown()
+        server.server_close()
+        controller_thread.join(timeout=max(1.0, poll_seconds + 1.0))
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--state-root", required=True, type=Path)
+    parser.add_argument("--repository", required=True, type=Path)
+    parser.add_argument("--host", default="127.0.0.1")
+    parser.add_argument("--port", default=18891, type=int)
+    parser.add_argument("--poll-seconds", default=30.0, type=float)
+    arguments = parser.parse_args()
+    if arguments.poll_seconds <= 0:
+        raise SystemExit("poll seconds must be positive")
+    if os.environ.get("AIOS_GITOPS_WRITES_ENABLED", "false").lower() != "false":
+        raise SystemExit("GitOps writes must remain disabled")
+    if (
+        os.environ.get(
+            "AIOS_SILENT_RELEASE_EXECUTION_ENABLED", "false"
+        ).lower()
+        != "false"
+    ):
+        raise SystemExit("Silent Release execution must remain disabled")
+    serve_shadow(
+        state_root=arguments.state_root,
+        repository=arguments.repository,
+        host=arguments.host,
+        port=arguments.port,
+        poll_seconds=arguments.poll_seconds,
+    )
+
+
+if __name__ == "__main__":
+    main()

active-runtime/app/task_plane/__init__.py

@@ -0,0 +1,21 @@
+"""Task Plane runtime package."""
+
+from .models import (
+    EvidenceEnvelope,
+    ProbeEvidence,
+    ProbeOutcome,
+    TaskPlan,
+    TaskRecord,
+    TaskStatus,
+    TaskStateTransitionError,
+)
+
+__all__ = [
+    "EvidenceEnvelope",
+    "ProbeEvidence",
+    "ProbeOutcome",
+    "TaskPlan",
+    "TaskRecord",
+    "TaskStatus",
+    "TaskStateTransitionError",
+]

active-runtime/app/task_plane/adapters/__init__.py

@@ -0,0 +1,17 @@
+"""Adapters for executing tasks via worker backends."""
+
+from .base import WorkerAdapter
+from .openclaw import OpenClawAdapter
+from .codex import CodexAdapter
+from .hermes import HermesAdapter
+from .a2a import A2AAdapter
+from .systemd_worker import SystemdWorkerAdapter
+
+__all__ = [
+    "WorkerAdapter",
+    "OpenClawAdapter",
+    "CodexAdapter",
+    "HermesAdapter",
+    "A2AAdapter",
+    "SystemdWorkerAdapter",
+]

active-runtime/app/task_plane/adapters/a2a.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .base import WorkerAdapter
+
+
+class A2AAdapter(WorkerAdapter):
+    worker_name = "a2a"
+
+    def capabilities(self) -> list[str]:
+        return ["task.exchange", "agent.handoff"]
+
+    def claim(self, task):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
+
+    def execute(self, task, claim):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
+
+    def heartbeat(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
+
+    def report_progress(self, claim, progress):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
+
+    def probe(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
+
+    def cancel(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
+
+    def collect_result(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}

active-runtime/app/task_plane/adapters/base.py

@@ -0,0 +1,41 @@
+"""Base worker adapter contract."""
+
+from __future__ import annotations
+
+import abc
+
+
+class WorkerAdapter(abc.ABC):
+    worker_name = "base"
+
+    @abc.abstractmethod
+    def capabilities(self) -> list[str]:
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def claim(self, task):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def execute(self, task, claim):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def heartbeat(self, claim):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def report_progress(self, claim, progress):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def probe(self, claim):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def cancel(self, claim):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def collect_result(self, claim):
+        raise NotImplementedError

active-runtime/app/task_plane/adapters/codex.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .base import WorkerAdapter
+
+
+class CodexAdapter(WorkerAdapter):
+    worker_name = "codex"
+
+    def capabilities(self) -> list[str]:
+        return ["code.read", "code.write.patch", "test.python", "review.security"]
+
+    def claim(self, task):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
+
+    def execute(self, task, claim):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
+
+    def heartbeat(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
+
+    def report_progress(self, claim, progress):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
+
+    def probe(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
+
+    def cancel(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
+
+    def collect_result(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}

active-runtime/app/task_plane/adapters/hermes.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .base import WorkerAdapter
+
+
+class HermesAdapter(WorkerAdapter):
+    worker_name = "hermes"
+
+    def capabilities(self) -> list[str]:
+        return ["architecture.review", "policy.review", "threat.model"]
+
+    def claim(self, task):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
+
+    def execute(self, task, claim):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
+
+    def heartbeat(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
+
+    def report_progress(self, claim, progress):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
+
+    def probe(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
+
+    def cancel(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
+
+    def collect_result(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}

active-runtime/app/task_plane/adapters/openclaw.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .base import WorkerAdapter
+
+
+class OpenClawAdapter(WorkerAdapter):
+    worker_name = "openclaw"
+
+    def capabilities(self) -> list[str]:
+        return ["code.read", "code.write.patch", "test.execute", "runtime.shadow"]
+
+    def claim(self, task):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
+
+    def execute(self, task, claim):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
+
+    def heartbeat(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
+
+    def report_progress(self, claim, progress):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
+
+    def probe(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
+
+    def cancel(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
+
+    def collect_result(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}

active-runtime/app/task_plane/adapters/systemd_worker.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .base import WorkerAdapter
+
+
+class SystemdWorkerAdapter(WorkerAdapter):
+    worker_name = "systemd_worker"
+
+    def capabilities(self) -> list[str]:
+        return ["systemd.exec", "runtime.shell"]
+
+    def claim(self, task):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "claimed"}
+
+    def execute(self, task, claim):
+        return {"worker": self.worker_name, "task_id": task.task_id, "status": "SHADOW_VERIFIED", "claim_id": claim.claim_id, "execution_mode": "shadow", "production_side_effects": False}
+
+    def heartbeat(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "alive"}
+
+    def report_progress(self, claim, progress):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "progress": progress}
+
+    def probe(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": claim.status}
+
+    def cancel(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "status": "cancelled"}
+
+    def collect_result(self, claim):
+        return {"worker": self.worker_name, "claim_id": claim.claim_id, "result": "not_collected"}

active-runtime/app/task_plane/agent_registry.py

@@ -0,0 +1,27 @@
+"""Agent registry abstraction."""
+
+from __future__ import annotations
+
+from .errors import NotFoundError
+
+
+class AgentRegistry:
+    def __init__(self):
+        self._agents: dict[str, dict] = {}
+
+    def register(self, agent_id: str, metadata: dict) -> None:
+        self._agents[agent_id] = {"agent_id": agent_id, **metadata}
+
+    def unregister(self, agent_id: str) -> None:
+        if agent_id not in self._agents:
+            raise NotFoundError("agent")
+        del self._agents[agent_id]
+
+    def list(self) -> list[dict]:
+        return list(self._agents.values())
+
+    def get(self, agent_id: str) -> dict:
+        try:
+            return self._agents[agent_id]
+        except KeyError:
+            raise NotFoundError("agent")

active-runtime/app/task_plane/api.py

@@ -0,0 +1,557 @@
+"""Task Plane HTTP API implementation (stdlib-only)."""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+import uuid
+import urllib.parse
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from typing import Any, Callable
+
+from .delegation import DelegationEngine
+from .errors import (
+    ConflictError,
+    ForbiddenError,
+    NotFoundError,
+    PayloadTooLargeError,
+    TaskPlaneHTTPError,
+    UnauthorizedError,
+    ValidationError,
+)
+from .evidence import EvidenceService
+from .journal import TaskJournal
+from .lease import LeaseManager
+from .models import (
+    EvidenceEnvelope,
+    ResultEnvelope,
+    TaskPlan,
+    TaskRecord,
+    iso8601_now,
+    contains_secret_text,
+    validate_identifier,
+)
+from .policy import PolicyEngine
+from .store import TaskPlaneStore
+from .worker_registry import WorkerRegistry
+
+
+def _json_payload(data: dict[str, Any], status: int = 200) -> tuple[int, bytes]:
+    body = json.dumps(data, ensure_ascii=False).encode("utf-8")
+    return status, body
+
+
+def _bounded_int(value: Any, name: str, minimum: int, maximum: int) -> int:
+    try:
+        number = int(value)
+    except (TypeError, ValueError) as exc:
+        raise ValidationError(f"invalid {name}") from exc
+    if not minimum <= number <= maximum:
+        raise ValidationError(f"invalid {name}")
+    return number
+
+
+class TaskPlaneService:
+    def __init__(self, store: TaskPlaneStore, policy: PolicyEngine | None = None):
+        self.store = store
+        self.policy = policy or PolicyEngine(
+            execution_enabled=False,
+            identity_capabilities={
+                "anon": {"task.creator", "task.read", "task.audit"}
+            },
+        )
+        self.journal = TaskJournal(store)
+        self.lease = LeaseManager(store)
+        self.workers = WorkerRegistry(store)
+        self.evidence = EvidenceService(store)
+        self.delegation = DelegationEngine(store)
+        self.store.probe_attestation_verifier = self.policy.probe_attestation_verifier
+
+    def create_task(self, body: dict[str, Any], idempotency_key: str | None = None) -> dict[str, Any]:
+        if body.get("parent_task_id"):
+            raise ForbiddenError("child tasks must use the delegate endpoint")
+        issuer = body.get("issuer", {})
+        actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
+        self.policy.assert_allowed("create", actor)
+        try:
+            plan = TaskPlan.from_dict(body)
+        except (TypeError, ValueError) as exc:
+            raise ValidationError("invalid task plan") from exc
+        task = self.store.create_task_with_event(plan, idempotency_key=idempotency_key)
+        return task.to_dict()
+
+    def list_tasks(self, actor: str | None = None) -> list[dict[str, Any]]:
+        if actor is not None:
+            self.policy.assert_allowed("read", actor)
+        return [task.to_dict(include_task=False) for task in self.store.list_tasks()]
+
+    def get_task(self, task_id: str, actor: str | None = None) -> dict[str, Any]:
+        if actor is not None:
+            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
+        return self.store.get_task(task_id).to_dict()
+
+    def get_worker(self, worker_id: str, actor: str | None = None) -> dict[str, Any]:
+        if actor is not None:
+            self.policy.assert_allowed("read", actor)
+        return self.workers.get(worker_id).to_dict()
+
+    def list_workers(self, actor: str | None = None) -> list[dict[str, Any]]:
+        if actor is not None:
+            self.policy.assert_allowed("read", actor)
+        return [w.to_dict() for w in self.workers.list()]
+
+    def register_worker(self, body: dict[str, Any]) -> dict[str, Any]:
+        actor = str(body.get("actor_identity") or body.get("identity") or "")
+        is_admin = actor in self.policy.admin_identities
+        try:
+            existing = self.store.get_worker(str(body.get("worker_id") or ""))
+        except NotFoundError:
+            existing = None
+        if existing is not None and str(body.get("identity") or "") != existing.identity:
+            raise ConflictError("worker identity takeover rejected")
+        self.policy.assert_readonly_worker_registration(actor, body)
+        self.policy.assert_allowed(
+            "worker.admin" if is_admin else "worker.register", actor
+        )
+        try:
+            worker = self.workers.register(
+                body,
+                actor_identity=actor,
+                is_admin=is_admin,
+                expected_revision=body.get("expected_revision"),
+            )
+        except (TypeError, ValueError, KeyError) as exc:
+            raise ValidationError("invalid worker registration") from exc
+        return worker.to_dict()
+
+    def worker_heartbeat(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+        interval = payload.get("heartbeat_interval_seconds")
+        actor = str(payload.get("actor_identity") or "")
+        self.policy.assert_readonly_worker_binding(actor, worker_id)
+        self.policy.assert_allowed("worker.register", actor)
+        return self.workers.heartbeat(
+            worker_id,
+            heartbeat_interval_seconds=interval,
+            actor_identity=actor,
+            expected_revision=payload.get("expected_revision"),
+        ).to_dict()
+
+    def disable_worker(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+        actor = str(payload.get("actor_identity") or "")
+        self.policy.assert_allowed("worker.admin", actor)
+        return self.store.disable_worker(
+            worker_id,
+            actor_identity=actor,
+            expected_revision=int(payload.get("expected_revision")),
+            reason=str(payload.get("reason") or "disabled by administrator"),
+        ).to_dict()
+
+    def restore_worker(self, worker_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+        actor = str(payload.get("actor_identity") or "")
+        self.policy.assert_allowed("worker.admin", actor)
+        return self.store.restore_worker(
+            worker_id,
+            actor_identity=actor,
+            expected_revision=int(payload.get("expected_revision")),
+        ).to_dict()
+
+    def claim(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
+        self.policy.assert_allowed("claim", actor)
+        worker_id = body.get("worker_id")
+        if not worker_id:
+            raise ValidationError("worker_id required")
+
+        task = self.store.get_task(task_id)
+        self.policy.assert_readonly_worker_binding(actor, str(worker_id))
+        self.policy.assert_allowed("claim", actor, task=task)
+        lease_seconds = _bounded_int(
+            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
+        )
+        claim = self.lease.claim(
+            task_id=task_id,
+            worker_id=worker_id,
+            worker_identity=actor,
+            lease_seconds=lease_seconds,
+            expected_revision=task.revision,
+            operation_digest=task.task_plan.operation_digest(),
+        )
+        return {"claim_id": claim.claim_id, **claim.to_dict()}
+
+    def heartbeat(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        claim_id = body.get("claim_id")
+        if not claim_id:
+            raise ValidationError("claim_id required")
+        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
+        task = self.store.get_task(task_id)
+        claim = self.store.get_claim(claim_id)
+        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
+        self.policy.assert_allowed("heartbeat", actor, task=task)
+        if claim.worker_identity != actor:
+            raise ForbiddenError("claim identity mismatch")
+        lease_seconds = _bounded_int(
+            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
+        )
+        claim = self.lease.heartbeat(task_id, claim_id, lease_seconds)
+        return {"claim_id": claim_id, "lease_until": claim.lease_until}
+
+    def progress(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        claim_id = body.get("claim_id")
+        if not claim_id:
+            raise ValidationError("claim_id required")
+        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
+        progress = body.get("progress")
+        stage = body.get("stage", "RUNNING")
+        message = body.get("message")
+        if progress is None:
+            raise ValidationError("progress required")
+        task = self.store.get_task(task_id)
+        claim = self.store.get_claim(claim_id)
+        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
+        self.policy.assert_allowed("progress", actor, task=task)
+        if task.task_plan.data_classification == "credential-secret":
+            if message not in {None, ""} or contains_secret_text(stage):
+                raise ValidationError(
+                    "credential-secret progress must contain metadata only"
+                )
+        lease_seconds = _bounded_int(
+            body.get("lease_seconds", 30), "lease_seconds", 1, 3600
+        )
+        claim = self.store.record_progress(
+            task_id,
+            claim_id,
+            actor,
+            progress=progress,
+            stage=str(stage),
+            message=None if message is None else str(message),
+            lease_seconds=lease_seconds,
+        )
+        return {"claim_id": claim.claim_id, "status": claim.status, "progress": progress}
+
+    def complete(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        claim_id = body.get("claim_id")
+        if not claim_id:
+            raise ValidationError("claim_id required")
+        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
+        task = self.store.get_task(task_id)
+
+        status = body.get("status", "COMPLETED")
+        outputs = body.get("outputs", [])
+        evidences = body.get("evidence", [])
+        if not isinstance(outputs, list):
+            raise ValidationError("outputs must be list")
+        if not isinstance(evidences, list):
+            raise ValidationError("evidence must be list")
+        if any(not isinstance(ev, dict) for ev in evidences):
+            raise ValidationError("evidence items must be objects")
+        claim = self.store.get_claim(claim_id)
+        self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
+        self.policy.assert_allowed("result", actor, task=task)
+        if claim.worker_identity != actor:
+            raise ForbiddenError("claim identity mismatch")
+        if task.task_plan.data_classification == "credential-secret":
+            allowed_result_keys = {
+                "kind",
+                "hash",
+                "sha256",
+                "count",
+                "status",
+                "error_code",
+                "signature",
+                "attestation_ref",
+            }
+            for entry in [*outputs, *evidences]:
+                if (
+                    not isinstance(entry, dict)
+                    or set(entry) - allowed_result_keys
+                    or contains_secret_text(entry)
+                ):
+                    raise ValidationError(
+                        "credential-secret result must contain hash/count/status only"
+                    )
+
+        result = ResultEnvelope(
+            task_id=task_id,
+            claim_id=claim_id,
+            worker_identity=actor,
+            status=status,
+            outputs=outputs,
+            evidence=evidences,
+            started_at=str(body.get("started_at") or iso8601_now()),
+            completed_at=str(body.get("completed_at") or iso8601_now()),
+            result_digest=body.get("result_digest"),
+            signature=body.get("signature"),
+            attestation_ref=body.get("attestation_ref"),
+            operation_digest=claim.operation_digest,
+        )
+        evidence_decision = self.policy.evidence_verifier.verify(task, evidences)
+        if not evidence_decision.allowed:
+            raise ForbiddenError(evidence_decision.reason)
+        result_decision = self.policy.verify_result(result, task)
+        if not result_decision.allowed:
+            raise ForbiddenError(result_decision.reason)
+        result.result_digest = result.computed_digest()
+        previous = self.store._last_evidence_hash(task_id)
+        evidence_entries = []
+        for evidence in evidences:
+            envelope = EvidenceEnvelope.create(
+                task_id=task_id,
+                claim_id=claim_id,
+                kind=str(evidence.get("kind") or evidence.get("type") or "generic"),
+                worker_identity=actor,
+                payload=evidence,
+                previous_evidence_hash=previous,
+                signature=evidence.get("signature"),
+                attestation_ref=evidence.get("attestation_ref"),
+            )
+            evidence_entries.append(envelope)
+            previous = envelope.evidence_digest
+        self.store.complete_claim_with_evidence_and_event(
+            task_id,
+            claim_id,
+            status
+            if status
+            in {"COMPLETED", "FAILED_FINAL", "FAILED_RECOVERABLE", "CANCELLED"}
+            else "COMPLETED",
+            result.to_dict(),
+            evidence_entries,
+        )
+        return result.to_dict()
+
+    def fail(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        claim_id = body.get("claim_id")
+        if not claim_id:
+            raise ValidationError("claim_id required")
+        reason = body.get("reason", "failed")
+        actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
+        self.policy.assert_allowed("fail", actor)
+        task = self.store.get_task(task_id)
+        self.policy.assert_allowed("fail", actor, task=task)
+        claim = self.store.get_claim(claim_id)
+        if claim.worker_identity != actor:
+            raise ForbiddenError("claim identity mismatch")
+        status = "FAILED_RECOVERABLE" if body.get("recoverable", False) else "FAILED_FINAL"
+        self.store.fail_claim_with_event(task_id, claim_id, status, str(reason))
+        return {"task_id": task_id, "status": status, "reason": reason}
+
+    def cancel(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        actor = body.get("actor_identity") or body.get("worker_identity") or "owner"
+        self.policy.assert_allowed("cancel", actor)
+        reason = body.get("reason", "cancelled")
+        task = self.store.get_task(task_id)
+        self.policy.assert_allowed("cancel", actor, task=task)
+        updated = self.store.cancel_task_with_event(
+            task_id, task.revision, reason=reason
+        )
+        return updated.to_dict()
+
+    def delegate(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
+        actor = body.get("actor_identity") or "owner"
+        self.policy.assert_allowed("delegate", actor)
+        parent = self.store.get_task(task_id)
+        self.policy.assert_allowed("delegate", actor, task=parent)
+        if "task" in body:
+            try:
+                child_plan = TaskPlan.from_dict(body["task"])
+            except (TypeError, ValueError) as exc:
+                raise ValidationError("invalid child task plan") from exc
+        else:
+            plan_body = dict(body)
+            plan_body.pop("actor_identity", None)
+            try:
+                child_plan = TaskPlan.from_dict(plan_body)
+            except (TypeError, ValueError) as exc:
+                raise ValidationError("invalid child task plan") from exc
+        child_plan.parent_task_id = task_id
+        child = self.delegation.delegate(task_id, child_plan, caller=actor)
+        return child.to_dict()
+
+    def get_events(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
+        if actor is not None:
+            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
+        self.store.get_task(task_id)
+        return self.store.list_events(task_id)
+
+    def get_evidence(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
+        if actor is not None:
+            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
+        self.store.get_task(task_id)
+        return self.evidence.list(task_id)
+
+    def get_children(self, task_id: str, actor: str | None = None) -> list[str]:
+        if actor is not None:
+            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
+        self.store.get_task(task_id)
+        return self.store.list_children(task_id)
+
+
+class TaskPlaneRequestHandler(BaseHTTPRequestHandler):
+    service: TaskPlaneService | None = None
+    authenticator: Callable[[str], str | None] | None = None
+    max_body_bytes = 1_000_000
+
+    def log_message(self, format: str, *args: Any) -> None:
+        # BaseHTTPRequestHandler logs the raw request target; suppress it so
+        # attacker-controlled paths or query strings cannot leak credentials.
+        return
+
+    def _json(self) -> tuple[str | None, dict[str, Any]]:
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+        except ValueError as exc:
+            raise ValidationError("invalid content length") from exc
+        if length < 0:
+            raise ValidationError("invalid content length")
+        if length > self.max_body_bytes:
+            raise PayloadTooLargeError("payload exceeds limit")
+        raw = self.rfile.read(length) if length > 0 else b""
+        if not raw:
+            return None, {}
+        try:
+            decoded = raw.decode("utf-8")
+            payload = json.loads(decoded)
+            if not isinstance(payload, dict):
+                raise ValidationError("JSON payload must be an object")
+            return decoded, payload
+        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+            raise ValidationError("invalid JSON payload") from exc
+
+    def _response(self, status: int, payload: Any) -> None:
+        encoded = json.dumps(payload, ensure_ascii=False).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def _authenticated_identity(self) -> str:
+        authenticator = type(self).authenticator
+        if authenticator is None:
+            raise UnauthorizedError("authentication unavailable")
+        header = self.headers.get("Authorization", "")
+        if not header.startswith("Bearer "):
+            raise UnauthorizedError("bearer authentication required")
+        token = header[7:]
+        if not token or any(ord(ch) < 33 for ch in token):
+            raise UnauthorizedError("invalid bearer token")
+        identity = authenticator(token)
+        if not identity:
+            raise UnauthorizedError("invalid credentials")
+        return str(identity)
+
+    def _handle(self, handler):
+        try:
+            if self.service is None:
+                raise TaskPlaneHTTPError("service not configured")
+            result = handler()
+            if isinstance(result, tuple):
+                status, payload = result
+            else:
+                status, payload = 200, result
+            self._response(status, payload)
+        except TaskPlaneHTTPError as exc:
+            self._response(exc.status_code, exc.to_payload())
+        except Exception as exc:  # defensive
+            if isinstance(exc, TaskPlaneHTTPError):
+                raise
+            self._response(
+                500,
+                {"error": "internal_error", "message": "internal server error"},
+            )
+
+    def do_GET(self):  # noqa: N802
+        def route():
+            path = urllib.parse.urlparse(self.path).path
+            parts = [p for p in path.split("/") if p]
+            for part in parts[1:]:
+                if part not in {"events", "evidence", "children", "heartbeat"}:
+                    try:
+                        validate_identifier(part, "resource identifier")
+                    except ValueError as exc:
+                        raise ValidationError("invalid resource identifier") from exc
+            identity = self._authenticated_identity()
+
+            if len(parts) == 1 and parts[0] == "tasks":
+                return 200, self.service.list_tasks(identity)
+            if len(parts) == 2 and parts[0] == "tasks":
+                task_id = parts[1]
+                return 200, self.service.get_task(task_id, identity)
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "events":
+                return 200, self.service.get_events(parts[1], identity)
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "evidence":
+                return 200, self.service.get_evidence(parts[1], identity)
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "children":
+                return 200, self.service.get_children(parts[1], identity)
+            if len(parts) == 1 and parts[0] == "workers":
+                return 200, self.service.list_workers(identity)
+            if len(parts) == 2 and parts[0] == "workers":
+                return 200, self.service.get_worker(parts[1], identity)
+            raise NotFoundError("unknown endpoint")
+
+        self._handle(route)
+
+    def do_POST(self):  # noqa: N802
+        def route():
+            body_text, body = self._json()
+            identity = self._authenticated_identity()
+            path = urllib.parse.urlparse(self.path).path
+            parts = [p for p in path.split("/") if p]
+            headers = {k.lower(): v for k, v in self.headers.items()}
+
+            if len(parts) == 1 and parts[0] == "tasks":
+                issuer = body.get("issuer")
+                if issuer and (
+                    not isinstance(issuer, dict) or issuer.get("id") != identity
+                ):
+                    raise ForbiddenError("issuer identity mismatch")
+                body["issuer"] = {"type": "authenticated", "id": identity}
+                return 201, self.service.create_task(body or {}, headers.get("idempotency-key"))
+            if body.get("actor_identity") not in {None, identity}:
+                raise ForbiddenError("actor identity mismatch")
+            body["actor_identity"] = identity
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "claim":
+                return 200, self.service.claim(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "heartbeat":
+                return 200, self.service.heartbeat(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "progress":
+                return 200, self.service.progress(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "result":
+                return 200, self.service.complete(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "fail":
+                return 200, self.service.fail(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "cancel":
+                return 200, self.service.cancel(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "tasks" and parts[2] == "delegate":
+                return 200, self.service.delegate(parts[1], body or {})
+
+            if len(parts) == 2 and parts[0] == "workers" and parts[1] == "register":
+                if (
+                    body.get("identity") != identity
+                    and identity not in self.service.policy.admin_identities
+                ):
+                    raise ForbiddenError("worker identity mismatch")
+                return 201, self.service.register_worker(body or {})
+            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "heartbeat":
+                return 200, self.service.worker_heartbeat(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "disable":
+                return 200, self.service.disable_worker(parts[1], body or {})
+            if len(parts) == 3 and parts[0] == "workers" and parts[2] == "restore":
+                return 200, self.service.restore_worker(parts[1], body or {})
+            raise NotFoundError("unknown endpoint")
+
+        self._handle(route)
+
+
+def run_server(
+    host: str,
+    port: int,
+    service: TaskPlaneService,
+    *,
+    authenticator: Callable[[str], str | None] | None = None,
+):
+    handler = TaskPlaneRequestHandler
+    handler.service = service
+    handler.authenticator = authenticator
+    server = ThreadingHTTPServer((host, port), handler)
+    server.serve_forever()

active-runtime/app/task_plane/capabilities.py

@@ -0,0 +1,36 @@
+"""Capability matcher helpers."""
+
+from __future__ import annotations
+
+from fnmatch import fnmatch
+
+
+def _normalize_capability(capability: str) -> str:
+    return capability.strip().lower()
+
+
+def capability_matches(granted: str, required: str) -> bool:
+    granted = _normalize_capability(granted)
+    required = _normalize_capability(required)
+    if granted == required:
+        return True
+    # A granted wildcard such as "test.*" should match required "test.unit"
+    if "*" in granted:
+        return fnmatch(required, granted)
+    # A required wildcard is treated as a suffix/prefix requirement for callers.
+    if "*" in required:
+        return fnmatch(granted, required)
+    return False
+
+
+def has_capabilities(granted_caps: list[str], required_caps: list[str]) -> bool:
+    granted = [_normalize_capability(c) for c in granted_caps]
+    for required in required_caps:
+        required = _normalize_capability(required)
+        if not any(capability_matches(g, required) for g in granted):
+            return False
+    return True
+
+
+def normalize_capabilities(caps: list[str]) -> list[str]:
+    return sorted({_normalize_capability(cap) for cap in caps})

active-runtime/app/task_plane/delegation.py

@@ -0,0 +1,87 @@
+"""Delegation guardrails."""
+
+from __future__ import annotations
+
+from .errors import ConflictError, ForbiddenError, NotFoundError
+from .models import Budget, TaskPlan, TaskRecord
+from .store import TaskPlaneStore
+
+
+class DelegationEngine:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def can_delegate(self, parent_id: str, child_plan: TaskPlan) -> bool:
+        parent = self.store.get_task(parent_id)
+        if parent.status == "COMPLETED":
+            raise ConflictError("cannot delegate completed task")
+        if parent.task_plan.max_delegation_depth <= 0:
+            raise ConflictError("max delegation depth not configured")
+
+        depth = self._depth(parent_id)
+        if depth >= parent.task_plan.max_delegation_depth:
+            raise ConflictError("max delegation depth reached")
+
+        if child_plan.parent_task_id not in {None, parent_id}:
+            raise ConflictError("delegation parent mismatch")
+        current = parent_id
+        while current:
+            if child_plan.task_id and current == child_plan.task_id:
+                raise ConflictError("delegation cycle")
+            current = self.store.parent_of(current)
+        return True
+
+    def delegate(self, parent_id: str, child_plan: TaskPlan, *, caller: str) -> TaskRecord:
+        self.can_delegate(parent_id, child_plan)
+        parent = self.store.get_task(parent_id)
+        if child_plan.required_capabilities and not set(child_plan.required_capabilities).issubset(
+            set(parent.task_plan.required_capabilities or [])
+        ):
+            raise ForbiddenError("child capabilities exceed parent constraints")
+        risk_rank = {"low": 1, "medium": 2, "high": 3}
+        if risk_rank.get(child_plan.risk, 99) > risk_rank.get(parent.task_plan.risk, -1):
+            raise ForbiddenError("child risk exceeds parent constraints")
+        child_plan.parent_task_id = parent_id
+        child_plan.correlation_id = parent.task_plan.correlation_id or parent.task_id
+        child_plan.preferred_workers = parent.task_plan.preferred_workers
+        child_plan.max_delegation_depth = min(
+            child_plan.max_delegation_depth,
+            parent.task_plan.max_delegation_depth,
+        )
+        child_plan.approval_policy = parent.task_plan.approval_policy
+
+        parent_budget = self.store.get_task_budget(parent_id)
+        required = Budget()
+        for name in ("time_seconds", "attempts", "tokens", "cost"):
+            available = getattr(parent_budget, name)
+            requested = getattr(child_plan.budgets, name)
+            if name == "attempts" and requested is None:
+                requested = 1
+            if available is not None:
+                requested = 0 if requested is None else requested
+                if requested > available:
+                    raise ConflictError(f"budget exceeded for {name}")
+                setattr(child_plan.budgets, name, requested)
+            setattr(required, name, requested)
+
+        # A retried identical delegation is a read, not a second budget charge.
+        if child_plan.task_id:
+            try:
+                existing = self.store.get_task(child_plan.task_id)
+            except NotFoundError:
+                existing = None
+            if existing is not None:
+                if (
+                    existing.task_plan.parent_task_id == parent_id
+                    and existing.task_plan.operation_digest()
+                    == child_plan.operation_digest()
+                ):
+                    return existing
+                raise ConflictError("delegation task_id conflict")
+
+        return self.store.delegate_task_with_budget_and_events(
+            parent_id, child_plan, caller=caller
+        )
+
+    def _depth(self, task_id: str) -> int:
+        return self.store._compute_depth(task_id)

active-runtime/app/task_plane/errors.py

@@ -0,0 +1,71 @@
+"""Error types for task plane operations."""
+
+from __future__ import annotations
+
+
+class TaskPlaneError(Exception):
+    """Base exception for API-compatible failures."""
+
+    status_code = 500
+    error_code = "task_plane_error"
+
+    def __init__(self, message: str, *, code: str | None = None, details: dict | None = None):
+        super().__init__(message)
+        self.message = message
+        self.details = details or {}
+        if code:
+            self.error_code = code
+
+    def to_payload(self) -> dict:
+        return {"error": self.error_code, "message": self.message, "details": self.details}
+
+
+class TaskPlaneHTTPError(TaskPlaneError):
+    """Base class with explicit HTTP status."""
+
+    status_code = 500
+
+
+class ValidationError(TaskPlaneHTTPError):
+    status_code = 400
+    error_code = "validation_error"
+
+
+class UnauthorizedError(TaskPlaneHTTPError):
+    status_code = 401
+    error_code = "unauthorized"
+
+
+class ForbiddenError(TaskPlaneHTTPError):
+    status_code = 403
+    error_code = "forbidden"
+
+
+class NotFoundError(TaskPlaneHTTPError):
+    status_code = 404
+    error_code = "not_found"
+
+
+class ConflictError(TaskPlaneHTTPError):
+    status_code = 409
+    error_code = "conflict"
+
+
+class PayloadTooLargeError(TaskPlaneHTTPError):
+    status_code = 413
+    error_code = "payload_too_large"
+
+
+class FailedDependencyError(TaskPlaneHTTPError):
+    status_code = 424
+    error_code = "failed_dependency"
+
+
+class LockedError(TaskPlaneHTTPError):
+    status_code = 423
+    error_code = "locked"
+
+
+class ServiceUnavailableError(TaskPlaneHTTPError):
+    status_code = 503
+    error_code = "service_unavailable"

active-runtime/app/task_plane/events.py

@@ -0,0 +1,108 @@
+"""CloudEvents-compatible event envelope and durable outbox helpers."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Callable, Protocol
+
+from .store import TaskPlaneStore
+
+
+@dataclass
+class CloudEvent:
+    specversion: str = "1.0"
+    id: str = ""
+    type: str = ""
+    source: str = "spiffe://aios/task-plane"
+    subject: str = ""
+    datacontenttype: str = "application/json"
+    data: dict | None = None
+
+    @property
+    def time(self) -> str:
+        return datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+
+    def asdict(self) -> dict:
+        return {
+            "specversion": self.specversion,
+            "id": self.id,
+            "type": self.type,
+            "source": self.source,
+            "subject": self.subject,
+            "time": self.time,
+            "datacontenttype": self.datacontenttype,
+            "data": self.data or {},
+        }
+
+
+NOT_DELIVERED = "NOT_DELIVERED"
+DELIVERED = "DELIVERED"
+FAILED_DELIVERY = "FAILED"
+
+
+class NotificationAdapter(Protocol):
+    name: str
+
+    def deliver(self, envelope: dict) -> str | None:
+        """Return a provider receipt, or None when delivery is unconfirmed."""
+
+
+class CallbackNotificationAdapter:
+    """Adapter seam for webhook, NATS, GPT, dashboard, and WeChat transports."""
+
+    def __init__(self, name: str, callback: Callable[[dict], str | None]):
+        self.name = name
+        self._callback = callback
+
+    def deliver(self, envelope: dict) -> str | None:
+        return self._callback(envelope)
+
+
+class WebhookAdapter(CallbackNotificationAdapter):
+    def __init__(self, callback: Callable[[dict], str | None]):
+        super().__init__("webhook", callback)
+
+
+class NatsJetStreamAdapter(CallbackNotificationAdapter):
+    def __init__(self, callback: Callable[[dict], str | None]):
+        super().__init__("nats-jetstream", callback)
+
+
+class GPTResultCallbackAdapter(CallbackNotificationAdapter):
+    def __init__(self, callback: Callable[[dict], str | None]):
+        super().__init__("gpt-result-callback", callback)
+
+
+class DashboardAdapter(CallbackNotificationAdapter):
+    def __init__(self, callback: Callable[[dict], str | None]):
+        super().__init__("dashboard", callback)
+
+
+class WeChatGatewayAdapter(CallbackNotificationAdapter):
+    def __init__(self, callback: Callable[[dict], str | None]):
+        super().__init__("wechat-gateway", callback)
+
+
+class DurableOutboxDispatcher:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def dispatch(self, message_id: str, adapter: NotificationAdapter) -> dict:
+        row = self.store.get_outbox_message(message_id)
+        import json
+
+        envelope = json.loads(row["payload"])
+        try:
+            receipt = adapter.deliver(envelope)
+        except Exception:
+            return self.store.record_outbox_delivery(
+                message_id,
+                receipt=None,
+                error=f"{adapter.name} delivery failed",
+            )
+        return self.store.record_outbox_delivery(
+            message_id,
+            receipt=str(receipt) if receipt else None,
+            error=None if receipt else f"{adapter.name} receipt unavailable",
+        )

active-runtime/app/task_plane/evidence.py

@@ -0,0 +1,31 @@
+"""Evidence helpers."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+
+from .store import TaskPlaneStore
+
+
+def evidence_digest(payload: dict) -> str:
+    body = json.dumps(payload, sort_keys=True, separators=(",", ":"))
+    return hashlib.sha256(body.encode("utf-8")).hexdigest()
+
+
+class EvidenceService:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def add(self, task_id: str, kind: str, payload: dict, worker_identity: str) -> str:
+        return self.store.add_evidence(task_id, kind, payload, worker_identity)
+
+    def list(self, task_id: str) -> list[dict]:
+        return self.store.list_evidence(task_id)
+
+    def verify(self, task_id: str, required_kinds: list[str]) -> bool:
+        evidences = self.list(task_id)
+        observed = {e["kind"] for e in evidences}
+        return set(required_kinds).issubset(
+            observed
+        ) and self.store.verify_evidence_integrity(task_id)

active-runtime/app/task_plane/journal.py

@@ -0,0 +1,22 @@
+"""Event journaling helpers."""
+
+from __future__ import annotations
+
+from .errors import ValidationError
+from .store import TaskPlaneStore
+
+
+class TaskJournal:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def append(self, task_id: str, event_type: str, data: dict, *, subject: str | None = None) -> None:
+        if not event_type:
+            raise ValidationError("event_type required")
+        self.store.append_event(task_id, event_type, data, subject=subject)
+
+    def list(self, task_id: str) -> list[dict]:
+        return self.store.list_events(task_id)
+
+    def check_chain(self, task_id: str) -> bool:
+        return self.store.verify_event_chain(task_id)

active-runtime/app/task_plane/lease.py

@@ -0,0 +1,32 @@
+"""Claim and lease management helpers."""
+
+from __future__ import annotations
+
+from .errors import LockedError
+from .models import ProbeEvidence
+from .store import TaskPlaneStore
+
+
+class LeaseManager:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def claim(self, task_id: str, worker_id: str, worker_identity: str, lease_seconds: int, expected_revision: int, operation_digest: str):
+        return self.store.claim_task(task_id, worker_id, worker_identity, lease_seconds, expected_revision, operation_digest)
+
+    def heartbeat(self, task_id: str, claim_id: str, lease_seconds: int):
+        claim = self.store.heartbeat_claim(task_id, claim_id, lease_seconds)
+        return claim
+
+    def probe(self, claim_id: str):
+        claim = self.store.get_claim(claim_id)
+        if claim.status != "ACTIVE":
+            raise LockedError("claim not active")
+        return claim
+
+    def recover(self, task_id: str, claim_id: str, probe: ProbeEvidence):
+        return self.store.recover_expired_claim(
+            task_id,
+            claim_id,
+            probe,
+        )

active-runtime/app/task_plane/models.py

@@ -0,0 +1,829 @@
+"""Core data models for the task plane."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import time
+import uuid
+import urllib.parse
+from enum import StrEnum
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Any
+
+
+SENSITIVE_KEYS = {
+    "secret",
+    "password",
+    "token",
+    "api_key",
+    "access_token",
+    "refresh_token",
+    "authorization",
+    "private_key",
+    "client_secret",
+    "credential",
+}
+IDENTIFIER_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{0,127}")
+TYPE_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}")
+RISK_LEVELS = {"low", "medium", "high"}
+DATA_CLASSIFICATIONS = {
+    "public",
+    "internal",
+    "confidential",
+    "credential-secret",
+}
+SECRET_TEXT_PATTERNS = (
+    re.compile(r"(?i)\bAuthorization\s*:\s*Bearer\s+\S+"),
+    re.compile(r"(?i)\b(?:password|passwd|api[_-]?key|access[_-]?token|secret)\s*[:=]\s*\S+"),
+    re.compile(r"\bsk-[A-Za-z0-9_-]{12,}\b"),
+    re.compile(r"\bAKIA[0-9A-Z]{16}\b"),
+    re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
+)
+TASK_PLAN_KEYS = {
+    "schema_version",
+    "task_id",
+    "task_type",
+    "issuer",
+    "intent",
+    "required_capabilities",
+    "preferred_workers",
+    "risk",
+    "approval_policy",
+    "dependencies",
+    "max_delegation_depth",
+    "budgets",
+    "evidence_requirements",
+    "parent_task_id",
+    "correlation_id",
+    "metadata",
+    "data_classification",
+    "execution_zone",
+    "network_policy",
+    "logging_policy",
+    "allowed_input_paths",
+    "allowed_output_paths",
+    "output_policy",
+}
+
+
+def _now_ts() -> float:
+    return time.time()
+
+
+def canonical_json(value: Any) -> str:
+    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+
+
+def compute_sha256_hex(value: Any) -> str:
+    return hashlib.sha256(canonical_json(value).encode("utf-8")).hexdigest()
+
+
+def contains_secret_text(value: Any) -> bool:
+    if isinstance(value, str):
+        return any(pattern.search(value) for pattern in SECRET_TEXT_PATTERNS)
+    if isinstance(value, dict):
+        return any(contains_secret_text(item) for item in value.values())
+    if isinstance(value, (list, tuple)):
+        return any(contains_secret_text(item) for item in value)
+    return False
+
+
+def validate_relative_paths(values: Any, name: str) -> list[str]:
+    paths = _normalize_list(values)
+    for value in paths:
+        decoded = urllib.parse.unquote(value)
+        parts = value.replace("\\", "/").split("/")
+        if (
+            decoded != value
+            or "\\" in value
+            or value.startswith("/")
+            or re.match(r"^[A-Za-z]:", value)
+            or any(part in {"", ".", ".."} for part in parts)
+        ):
+            raise ValueError(f"invalid {name}")
+    return paths
+
+
+def validate_identifier(value: Any, name: str) -> str:
+    text = str(value or "")
+    if (
+        not IDENTIFIER_RE.fullmatch(text)
+        or urllib.parse.unquote(text) != text
+        or any(ord(ch) < 32 or ord(ch) == 127 for ch in text)
+    ):
+        raise ValueError(f"invalid {name}")
+    return text
+
+
+def validate_type(value: Any, name: str) -> str:
+    text = str(value or "")
+    if not TYPE_RE.fullmatch(text):
+        raise ValueError(f"invalid {name}")
+    return text
+
+
+def redact_value(value: Any) -> Any:
+    if isinstance(value, dict):
+        redacted = {}
+        for key, inner in value.items():
+            lowered = str(key).lower()
+            if lowered in SENSITIVE_KEYS or lowered.endswith(
+                ("_password", "_secret", "_access_token", "_refresh_token", "_private_key")
+            ):
+                redacted[key] = "[REDACTED]"
+            else:
+                redacted[key] = redact_value(inner)
+        return redacted
+    if isinstance(value, list):
+        return [redact_value(v) for v in value]
+    if isinstance(value, tuple):
+        return tuple(redact_value(v) for v in value)
+    return value
+
+
+class TaskStateTransitionError(ValueError):
+    pass
+
+
+class TaskStatus(StrEnum):
+    CREATED = "CREATED"
+    QUEUED = "QUEUED"
+    CLAIMED = "CLAIMED"
+    RUNNING = "RUNNING"
+    WAITING_CHILD = "WAITING_CHILD"
+    VERIFYING = "VERIFYING"
+    COMPLETED = "COMPLETED"
+    FAILED_RECOVERABLE = "FAILED_RECOVERABLE"
+    FAILED_FINAL = "FAILED_FINAL"
+    CANCELLED = "CANCELLED"
+    MANUAL_REVIEW_REQUIRED = "MANUAL_REVIEW_REQUIRED"
+
+
+TASK_STATES = {
+    status.value for status in TaskStatus
+}
+
+
+TASK_NEXT_STATES = {
+    "CREATED": {"QUEUED", "CLAIMED", "CANCELLED", "MANUAL_REVIEW_REQUIRED"},
+    "QUEUED": {"CLAIMED", "CANCELLED", "FAILED_RECOVERABLE", "FAILED_FINAL"},
+    "CLAIMED": {"RUNNING", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
+    "RUNNING": {"VERIFYING", "WAITING_CHILD", "COMPLETED", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
+    "WAITING_CHILD": {"RUNNING", "VERIFYING", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
+    "VERIFYING": {"COMPLETED", "FAILED_RECOVERABLE", "FAILED_FINAL", "CANCELLED"},
+    "COMPLETED": set(),
+    "FAILED_RECOVERABLE": {"CLAIMED", "RUNNING", "CANCELLED"},
+    "FAILED_FINAL": set(),
+    "CANCELLED": set(),
+    "MANUAL_REVIEW_REQUIRED": {"RUNNING", "CANCELLED"},
+}
+
+
+@dataclass
+class Budget:
+    time_seconds: int | None = None
+    attempts: int | None = None
+    tokens: int | None = None
+    cost: float | None = None
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any] | None) -> "Budget":
+        if not data:
+            return cls()
+        if not isinstance(data, dict) or set(data) - {
+            "time_seconds",
+            "attempts",
+            "tokens",
+            "cost",
+        }:
+            raise ValueError("invalid budget")
+        for name in ("time_seconds", "attempts", "tokens", "cost"):
+            value = data.get(name)
+            if value is not None:
+                try:
+                    if float(value) < 0:
+                        raise ValueError("budget values must be non-negative")
+                except (TypeError, ValueError) as exc:
+                    raise ValueError("invalid budget value") from exc
+        return cls(
+            time_seconds=_to_positive_int(data.get("time_seconds")),
+            attempts=_to_positive_int(data.get("attempts")),
+            tokens=_to_positive_int(data.get("tokens")),
+            cost=_to_float(data.get("cost")),
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "time_seconds": self.time_seconds,
+            "attempts": self.attempts,
+            "tokens": self.tokens,
+            "cost": self.cost,
+        }
+
+    def merge(self, other: "Budget") -> "Budget":
+        return Budget(
+            time_seconds=_first_non_none(self.time_seconds, other.time_seconds),
+            attempts=_first_non_none(self.attempts, other.attempts),
+            tokens=_first_non_none(self.tokens, other.tokens),
+            cost=_first_non_none(self.cost, other.cost),
+        )
+
+
+@dataclass
+class TaskPlan:
+    schema_version: int = 1
+    task_id: str | None = None
+    task_type: str = "code.change"
+    issuer: dict[str, Any] = field(default_factory=dict)
+    intent: str | None = None
+    required_capabilities: list[str] = field(default_factory=list)
+    preferred_workers: list[str] = field(default_factory=list)
+    risk: str = "medium"
+    approval_policy: str = "patch-only"
+    dependencies: list[str] = field(default_factory=list)
+    max_delegation_depth: int = 5
+    budgets: Budget = field(default_factory=Budget)
+    evidence_requirements: list[str] = field(default_factory=list)
+    parent_task_id: str | None = None
+    correlation_id: str | None = None
+    metadata: dict[str, Any] = field(default_factory=dict)
+    data_classification: str = "internal"
+    execution_zone: str = "isolated-development"
+    network_policy: str = "controlled"
+    logging_policy: str = "redacted"
+    allowed_input_paths: list[str] = field(default_factory=list)
+    allowed_output_paths: list[str] = field(default_factory=list)
+    output_policy: str = "standard"
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any] | None) -> "TaskPlan":
+        if not isinstance(data, dict):
+            raise ValueError("task plan payload must be an object")
+        unknown = set(data) - TASK_PLAN_KEYS
+        if unknown:
+            raise ValueError("unknown task plan fields")
+        if "task_id" not in data or data["task_id"] is None:
+            data = dict(data)
+            data["task_id"] = f"task-{uuid.uuid4()}"
+        risk = str(data.get("risk", "medium"))
+        if risk not in RISK_LEVELS:
+            raise ValueError("invalid risk")
+        issuer = data.get("issuer", {})
+        if not isinstance(issuer, dict):
+            raise ValueError("issuer must be an object")
+        schema_version = int(data.get("schema_version", 1))
+        if schema_version != 1:
+            raise ValueError("unsupported schema_version")
+        max_depth = _to_positive_int(data.get("max_delegation_depth"), default=5)
+        if max_depth is None or max_depth > 32:
+            raise ValueError("invalid max_delegation_depth")
+        classification = str(data.get("data_classification", "internal"))
+        if classification not in DATA_CLASSIFICATIONS:
+            raise ValueError("invalid data_classification")
+        execution_zone = validate_type(
+            data.get("execution_zone", "isolated-development"), "execution_zone"
+        )
+        network_policy = validate_type(
+            data.get("network_policy", "controlled"), "network_policy"
+        )
+        logging_policy = validate_type(
+            data.get("logging_policy", "redacted"), "logging_policy"
+        )
+        output_policy = validate_type(
+            data.get("output_policy", "standard"), "output_policy"
+        )
+        if contains_secret_text(
+            {
+                "intent": data.get("intent"),
+                "metadata": data.get("metadata", {}),
+            }
+        ):
+            raise ValueError("task content contains secret material")
+        if classification == "credential-secret":
+            if execution_zone != "secure-file-transformer":
+                raise ValueError("credential-secret requires secure-file-transformer")
+            if network_policy != "denied":
+                raise ValueError("credential-secret requires network denied")
+            if logging_policy != "metadata-only":
+                raise ValueError("credential-secret requires metadata-only logging")
+            if output_policy != "hash-count-status-only":
+                raise ValueError("credential-secret requires restricted output")
+        return cls(
+            schema_version=schema_version,
+            task_id=validate_identifier(data["task_id"], "task_id"),
+            task_type=validate_type(data.get("task_type", "code.change"), "task_type"),
+            issuer=issuer,
+            intent=data.get("intent"),
+            required_capabilities=_normalize_list(data.get("required_capabilities", [])),
+            preferred_workers=_normalize_list(data.get("preferred_workers", [])),
+            risk=risk,
+            approval_policy=validate_type(
+                data.get("approval_policy", "patch-only"), "approval_policy"
+            ),
+            dependencies=_normalize_list(data.get("dependencies", [])),
+            max_delegation_depth=max_depth,
+            budgets=Budget.from_dict(data.get("budgets")),
+            evidence_requirements=_normalize_list(data.get("evidence_requirements", [])),
+            parent_task_id=data.get("parent_task_id"),
+            correlation_id=data.get("correlation_id"),
+            metadata=data.get("metadata", {}) if isinstance(data.get("metadata", {}), dict) else {},
+            data_classification=classification,
+            execution_zone=execution_zone,
+            network_policy=network_policy,
+            logging_policy=logging_policy,
+            allowed_input_paths=validate_relative_paths(
+                data.get("allowed_input_paths", []), "allowed_input_paths"
+            ),
+            allowed_output_paths=validate_relative_paths(
+                data.get("allowed_output_paths", []), "allowed_output_paths"
+            ),
+            output_policy=output_policy,
+        )
+
+    def to_dict(self, *, redact: bool = False) -> dict[str, Any]:
+        payload = {
+            "schema_version": self.schema_version,
+            "task_id": self.task_id,
+            "task_type": self.task_type,
+            "issuer": self.issuer,
+            "intent": self.intent,
+            "required_capabilities": list(self.required_capabilities),
+            "preferred_workers": list(self.preferred_workers),
+            "risk": self.risk,
+            "approval_policy": self.approval_policy,
+            "dependencies": list(self.dependencies),
+            "max_delegation_depth": self.max_delegation_depth,
+            "budgets": self.budgets.to_dict(),
+            "evidence_requirements": list(self.evidence_requirements),
+            "parent_task_id": self.parent_task_id,
+            "correlation_id": self.correlation_id,
+            "metadata": dict(self.metadata),
+            "data_classification": self.data_classification,
+            "execution_zone": self.execution_zone,
+            "network_policy": self.network_policy,
+            "logging_policy": self.logging_policy,
+            "allowed_input_paths": list(self.allowed_input_paths),
+            "allowed_output_paths": list(self.allowed_output_paths),
+            "output_policy": self.output_policy,
+        }
+        if redact:
+            payload = redact_value(payload)
+        return payload
+
+    def operation_digest(self) -> str:
+        return compute_sha256_hex(self.to_dict())
+
+
+@dataclass
+class TaskRecord:
+    task_id: str
+    status: str
+    revision: int
+    task_plan: TaskPlan
+    created_at: float
+    updated_at: float
+    root_task_id: str
+    idempotency_key: str | None = None
+    failure_reason: str | None = None
+
+    def with_status(self, status: str) -> "TaskRecord":
+        allowed = TASK_NEXT_STATES.get(self.status, set())
+        if status != self.status and (not allowed and self.status not in {"COMPLETED", "FAILED_FINAL", "CANCELLED"}):
+            raise TaskStateTransitionError(f"Cannot transition {self.status} -> {status}")
+        if status not in TASK_STATES:
+            raise TaskStateTransitionError(f"Invalid status {status}")
+        if status != self.status and self.status in TASK_NEXT_STATES and status not in TASK_NEXT_STATES[self.status]:
+            raise TaskStateTransitionError(f"Cannot transition {self.status} -> {status}")
+        return TaskRecord(
+            task_id=self.task_id,
+            status=status,
+            revision=self.revision + 1,
+            task_plan=self.task_plan,
+            created_at=self.created_at,
+            updated_at=_now_ts(),
+            root_task_id=self.root_task_id,
+            idempotency_key=self.idempotency_key,
+            failure_reason=self.failure_reason,
+        )
+
+    def to_dict(self, *, include_task=True, redact_payload: bool = True) -> dict[str, Any]:
+        payload = {
+            "task_id": self.task_id,
+            "status": self.status,
+            "revision": self.revision,
+            "root_task_id": self.root_task_id,
+            "parent_task_id": self.task_plan.parent_task_id,
+            "created_at": _fmt_ts(self.created_at),
+            "updated_at": _fmt_ts(self.updated_at),
+            "failure_reason": self.failure_reason,
+        }
+        if include_task:
+            payload["plan"] = self.task_plan.to_dict(redact=redact_payload)
+        if self.idempotency_key:
+            payload["idempotency_key"] = self.idempotency_key
+        return payload
+
+
+@dataclass
+class WorkerRegistration:
+    worker_id: str
+    worker_type: str
+    identity: str
+    capabilities: list[str]
+    trust_zone: str
+    max_concurrency: int
+    heartbeat_interval_seconds: int
+    supported_protocols: list[str]
+    registered_at: float
+    last_heartbeat: float
+    status: str = "active"
+    disabled: bool = False
+    owner_identity: str = ""
+    registration_revision: int = 1
+    registration_policy: str = "self"
+    created_at: float = 0.0
+    updated_at: float = 0.0
+    disabled_reason: str | None = None
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> "WorkerRegistration":
+        if not isinstance(data, dict):
+            raise ValueError("worker registration payload must be an object")
+        now = _now_ts()
+        worker_id = validate_identifier(data.get("worker_id"), "worker_id")
+        worker_type = validate_type(data.get("worker_type"), "worker_type")
+        identity = str(data.get("identity") or "").strip()
+        if not identity or any(ord(ch) < 32 for ch in identity):
+            raise ValueError("invalid identity")
+        max_concurrency = _to_positive_int(data.get("max_concurrency"), default=1)
+        heartbeat_interval = _to_positive_int(
+            data.get("heartbeat_interval_seconds"), default=15
+        )
+        if not max_concurrency:
+            raise ValueError("max_concurrency must be positive")
+        if not heartbeat_interval:
+            raise ValueError("heartbeat_interval_seconds must be positive")
+        return cls(
+            worker_id=worker_id,
+            worker_type=worker_type,
+            identity=identity,
+            capabilities=_normalize_list(data.get("capabilities", [])),
+            trust_zone=str(data.get("trust_zone") or "default"),
+            max_concurrency=max_concurrency,
+            heartbeat_interval_seconds=heartbeat_interval,
+            supported_protocols=_normalize_list(
+                data.get("supported_protocols", ["aios-task-v1"])
+            ),
+            registered_at=float(data.get("registered_at") or now),
+            last_heartbeat=float(data.get("last_heartbeat") or now),
+            status=str(data.get("status") or "active"),
+            disabled=bool(data.get("disabled", False)),
+            owner_identity=str(data.get("owner_identity") or identity),
+            registration_revision=int(data.get("registration_revision") or 1),
+            registration_policy=str(data.get("registration_policy") or "self"),
+            created_at=float(data.get("created_at") or data.get("registered_at") or now),
+            updated_at=float(data.get("updated_at") or now),
+            disabled_reason=data.get("disabled_reason"),
+        )
+
+    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
+        payload = {
+            "worker_id": self.worker_id,
+            "worker_type": self.worker_type,
+            "identity": self.identity,
+            "capabilities": list(self.capabilities),
+            "trust_zone": self.trust_zone,
+            "max_concurrency": self.max_concurrency,
+            "heartbeat_interval_seconds": self.heartbeat_interval_seconds,
+            "supported_protocols": list(self.supported_protocols),
+            "registered_at": _fmt_ts(self.registered_at),
+            "last_heartbeat": _fmt_ts(self.last_heartbeat),
+            "status": self.status,
+            "disabled": self.disabled,
+            "owner_identity": self.owner_identity,
+            "registration_revision": self.registration_revision,
+            "registration_policy": self.registration_policy,
+            "created_at": _fmt_ts(self.created_at or self.registered_at),
+            "updated_at": _fmt_ts(self.updated_at or self.last_heartbeat),
+            "disabled_reason": self.disabled_reason,
+        }
+        if redact_payload:
+            payload = redact_value(payload)
+        return payload
+
+
+@dataclass(frozen=True)
+class EvidenceEnvelope:
+    schema_version: int
+    evidence_id: str
+    task_id: str
+    claim_id: str
+    kind: str
+    worker_identity: str
+    payload: dict[str, Any]
+    created_at: float
+    previous_evidence_hash: str
+    evidence_digest: str
+    signature: str | None = None
+    attestation_ref: str | None = None
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        task_id: str,
+        claim_id: str,
+        kind: str,
+        worker_identity: str,
+        payload: dict[str, Any],
+        previous_evidence_hash: str,
+        signature: str | None = None,
+        attestation_ref: str | None = None,
+        evidence_id: str | None = None,
+        created_at: float | None = None,
+    ) -> "EvidenceEnvelope":
+        envelope = cls(
+            schema_version=1,
+            evidence_id=evidence_id or f"evd-{uuid.uuid4()}",
+            task_id=validate_identifier(task_id, "task_id"),
+            claim_id=validate_identifier(claim_id, "claim_id"),
+            kind=validate_type(kind, "evidence kind"),
+            worker_identity=str(worker_identity),
+            payload=redact_value(payload),
+            created_at=float(created_at or _now_ts()),
+            previous_evidence_hash=str(previous_evidence_hash or ""),
+            evidence_digest="",
+            signature=signature,
+            attestation_ref=attestation_ref,
+        )
+        return dataclass_replace(
+            envelope, evidence_digest=compute_sha256_hex(envelope.digest_payload())
+        )
+
+    def digest_payload(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "evidence_id": self.evidence_id,
+            "task_id": self.task_id,
+            "claim_id": self.claim_id,
+            "kind": self.kind,
+            "worker_identity": self.worker_identity,
+            "payload": self.payload,
+            "created_at": self.created_at,
+            "previous_evidence_hash": self.previous_evidence_hash,
+            "attestation_ref": self.attestation_ref,
+        }
+
+    def verify(
+        self,
+        *,
+        expected_task_id: str,
+        expected_claim_id: str,
+        expected_previous_hash: str,
+        attestation_verifier: Any = None,
+    ) -> bool:
+        if (
+            self.schema_version != 1
+            or self.task_id != expected_task_id
+            or self.claim_id != expected_claim_id
+            or self.previous_evidence_hash != expected_previous_hash
+            or self.evidence_digest != compute_sha256_hex(self.digest_payload())
+        ):
+            return False
+        if self.signature or self.attestation_ref:
+            return True if attestation_verifier is None else bool(attestation_verifier(self))
+        return True
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            **self.digest_payload(),
+            "evidence_digest": self.evidence_digest,
+            "signature": self.signature,
+        }
+
+
+class ProbeOutcome(StrEnum):
+    NOT_APPLIED = "NOT_APPLIED"
+    APPLIED_VERIFIED = "APPLIED_VERIFIED"
+    INDETERMINATE = "INDETERMINATE"
+    CONFLICT = "CONFLICT"
+
+
+@dataclass(frozen=True)
+class ProbeEvidence:
+    schema_version: int
+    probe_id: str
+    task_id: str
+    claim_id: str
+    worker_id: str
+    worker_identity: str
+    operation_digest: str
+    outcome: ProbeOutcome
+    observed_at: float
+    expires_at: float
+    probe_executor_identity: str
+    evidence_digest: str
+    signature: str | None = None
+    attestation_ref: str | None = None
+
+    @classmethod
+    def create(cls, **data: Any) -> "ProbeEvidence":
+        outcome = data["outcome"]
+        if not isinstance(outcome, ProbeOutcome):
+            outcome = ProbeOutcome(str(outcome))
+        probe = cls(
+            schema_version=1,
+            probe_id=data.get("probe_id") or f"probe-{uuid.uuid4()}",
+            task_id=validate_identifier(data["task_id"], "task_id"),
+            claim_id=validate_identifier(data["claim_id"], "claim_id"),
+            worker_id=validate_identifier(data["worker_id"], "worker_id"),
+            worker_identity=str(data["worker_identity"]),
+            operation_digest=str(data["operation_digest"]),
+            outcome=outcome,
+            observed_at=float(data["observed_at"]),
+            expires_at=float(data["expires_at"]),
+            probe_executor_identity=str(data["probe_executor_identity"]),
+            evidence_digest="",
+            signature=data.get("signature"),
+            attestation_ref=data.get("attestation_ref"),
+        )
+        return dataclass_replace(
+            probe, evidence_digest=compute_sha256_hex(probe.digest_payload())
+        )
+
+    def digest_payload(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "probe_id": self.probe_id,
+            "task_id": self.task_id,
+            "claim_id": self.claim_id,
+            "worker_id": self.worker_id,
+            "worker_identity": self.worker_identity,
+            "operation_digest": self.operation_digest,
+            "outcome": self.outcome.value,
+            "observed_at": self.observed_at,
+            "expires_at": self.expires_at,
+            "probe_executor_identity": self.probe_executor_identity,
+            "attestation_ref": self.attestation_ref,
+        }
+
+    def verify(self, *, now: float, attestation_verifier: Any) -> bool:
+        if (
+            self.schema_version != 1
+            or self.expires_at <= now
+            or self.observed_at > now
+            or self.evidence_digest != compute_sha256_hex(self.digest_payload())
+            or not (self.signature or self.attestation_ref)
+        ):
+            return False
+        return bool(attestation_verifier and attestation_verifier(self))
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            **self.digest_payload(),
+            "evidence_digest": self.evidence_digest,
+            "signature": self.signature,
+        }
+
+
+def dataclass_replace(value: Any, **changes: Any) -> Any:
+    from dataclasses import replace
+
+    return replace(value, **changes)
+
+
+@dataclass
+class WorkerClaim:
+    claim_id: str
+    task_id: str
+    worker_id: str
+    worker_identity: str
+    claimed_at: float
+    lease_until: float
+    attempt: int
+    task_revision: int
+    operation_digest: str
+    status: str = "ACTIVE"
+
+    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
+        payload = {
+            "claim_id": self.claim_id,
+            "task_id": self.task_id,
+            "worker_id": self.worker_id,
+            "worker_identity": self.worker_identity,
+            "claimed_at": _fmt_ts(self.claimed_at),
+            "lease_until": _fmt_ts(self.lease_until),
+            "attempt": self.attempt,
+            "task_revision": self.task_revision,
+            "operation_digest": self.operation_digest,
+            "status": self.status,
+        }
+        if redact_payload:
+            payload = redact_value(payload)
+        return payload
+
+
+@dataclass
+class ResultEnvelope:
+    task_id: str
+    claim_id: str
+    worker_identity: str
+    status: str
+    outputs: list[dict[str, Any]]
+    evidence: list[dict[str, Any]]
+    started_at: str
+    completed_at: str
+    result_digest: str | None = None
+    signature: str | None = None
+    attestation_ref: str | None = None
+    operation_digest: str | None = None
+    trust_status: str = "untrusted_shadow_result"
+
+    def digest_payload(self) -> dict[str, Any]:
+        return {
+            "task_id": self.task_id,
+            "claim_id": self.claim_id,
+            "worker_identity": self.worker_identity,
+            "status": self.status,
+            "outputs": self.outputs,
+            "evidence": self.evidence,
+            "started_at": self.started_at,
+            "completed_at": self.completed_at,
+            "operation_digest": self.operation_digest,
+            "attestation_ref": self.attestation_ref,
+        }
+
+    def computed_digest(self) -> str:
+        return compute_sha256_hex(self.digest_payload())
+
+    def to_dict(self, redact_payload: bool = True) -> dict[str, Any]:
+        payload = {
+            "task_id": self.task_id,
+            "claim_id": self.claim_id,
+            "worker_identity": self.worker_identity,
+            "status": self.status,
+            "outputs": self.outputs,
+            "evidence": self.evidence,
+            "started_at": self.started_at,
+            "completed_at": self.completed_at,
+            "result_digest": self.result_digest,
+            "signature": self.signature,
+            "attestation_ref": self.attestation_ref,
+            "operation_digest": self.operation_digest,
+            "trust_status": self.trust_status,
+        }
+        if redact_payload:
+            payload = redact_value(payload)
+        return payload
+
+
+def _normalize_list(value: Any) -> list[str]:
+    if not isinstance(value, list):
+        raise ValueError("expected list")
+    if len(value) > 128 or any(
+        not isinstance(v, str)
+        or not v
+        or len(v) > 256
+        or any(ord(ch) < 32 for ch in v)
+        for v in value
+    ):
+        raise ValueError("invalid list item")
+    return list(value)
+
+
+def _to_positive_int(value: Any, default: int | None = None) -> int | None:
+    if value is None:
+        return default
+    try:
+        number = int(value)
+    except (TypeError, ValueError):
+        return default
+    return number if number >= 0 else default
+
+
+def _to_float(value: Any) -> float | None:
+    if value is None:
+        return None
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return None
+
+
+def _first_non_none(primary: Any, fallback: Any) -> Any:
+    if primary is not None:
+        return primary
+    return fallback
+
+
+def iso8601_now() -> str:
+    return datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+
+
+def _fmt_ts(value: float | None) -> str | None:
+    if value is None:
+        return None
+    return datetime.fromtimestamp(value, tz=timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")

active-runtime/app/task_plane/policy.py

@@ -0,0 +1,226 @@
+"""Policy and verification logic (fail-closed)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Callable
+
+from .errors import ForbiddenError, LockedError
+from .models import ProbeEvidence, ResultEnvelope, TaskRecord
+
+
+RISK_RANK = {"low": 1, "medium": 2, "high": 3}
+READONLY_WORKER_ACTIONS = frozenset(
+    {"claim", "result", "fail", "progress", "heartbeat"}
+)
+ALL_ACTION_CAPABILITIES = frozenset(
+    {
+        "task.creator",
+        "worker.self_register",
+        "worker.admin",
+        "task.claim",
+        "task.cancel",
+        "task.delegate",
+        "task.read",
+        "task.audit",
+    }
+)
+
+
+@dataclass
+class PolicyDecision:
+    allowed: bool
+    reason: str = ""
+
+
+@dataclass(frozen=True)
+class ReadonlyWorkerProfile:
+    """A narrowly-scoped identity allowed to process safe Shadow tasks only."""
+
+    worker_id: str
+    identity: str
+    capabilities: frozenset[str]
+    task_types: frozenset[str] = frozenset({"code.review", "test.execute"})
+
+    def permits_task(self, task: TaskRecord) -> bool:
+        plan = task.task_plan
+        if plan.task_type not in self.task_types or plan.risk != "low":
+            return False
+        if plan.data_classification not in {"public", "internal"}:
+            return False
+        if plan.metadata.get("production_side_effects") is not False:
+            return False
+        return set(plan.required_capabilities).issubset(self.capabilities)
+
+
+class IdentityVerifier:
+    def __init__(self, trusted_identities: set[str] | None = None):
+        self.trusted_identities = trusted_identities
+
+    def verify(self, identity: str) -> bool:
+        if self.trusted_identities is None:
+            return True
+        return identity in self.trusted_identities
+
+
+class EvidenceVerifier:
+    def __init__(self, mandatory: list[str] | None = None):
+        self.mandatory = set(mandatory or [])
+
+    def verify(self, task: TaskRecord, evidences: list[dict]) -> PolicyDecision:
+        required = set(task.task_plan.evidence_requirements or [])
+        if not required and not self.mandatory:
+            return PolicyDecision(True)
+        observed = {e.get("kind") for e in evidences}
+        missing = required.union(self.mandatory) - observed
+        if missing:
+            return PolicyDecision(False, f"missing evidence: {', '.join(sorted(missing))}")
+        return PolicyDecision(True)
+
+
+class PolicyEngine:
+    """
+    Fail-closed policy engine with minimal but explicit decisions.
+    """
+
+    def __init__(
+        self,
+        *,
+        identity_verifier: IdentityVerifier | None = None,
+        evidence_verifier: EvidenceVerifier | None = None,
+        execution_enabled: bool = False,
+        max_risk: str = "medium",
+        result_signature_verifier: Callable[[ResultEnvelope], bool] | None = None,
+        probe_attestation_verifier: Callable[[ProbeEvidence], bool] | None = None,
+        identity_capabilities: dict[str, set[str]] | None = None,
+        admin_identities: set[str] | None = None,
+        readonly_worker_execution_enabled: bool = False,
+        readonly_worker_profiles: list[ReadonlyWorkerProfile] | None = None,
+    ) -> None:
+        if max_risk not in RISK_RANK:
+            raise ValueError("invalid max_risk")
+        self.identity_verifier = identity_verifier or IdentityVerifier()
+        self.evidence_verifier = evidence_verifier or EvidenceVerifier()
+        self.execution_enabled = execution_enabled
+        self.max_risk = max_risk
+        self.result_signature_verifier = result_signature_verifier
+        self.probe_attestation_verifier = probe_attestation_verifier
+        self.identity_capabilities = {
+            identity: set(capabilities)
+            for identity, capabilities in (identity_capabilities or {}).items()
+        }
+        self.admin_identities = set(admin_identities or ())
+        self.readonly_worker_execution_enabled = readonly_worker_execution_enabled
+        self.readonly_worker_profiles = {
+            profile.identity: profile for profile in (readonly_worker_profiles or [])
+        }
+
+    def _readonly_worker_allows(
+        self, action: str, actor: str, task: TaskRecord | None
+    ) -> bool:
+        profile = self.readonly_worker_profiles.get(actor)
+        return bool(
+            self.readonly_worker_execution_enabled
+            and action in READONLY_WORKER_ACTIONS
+            and profile is not None
+            and (task is None or profile.permits_task(task))
+        )
+
+    def assert_readonly_worker_binding(self, actor: str, worker_id: str) -> None:
+        profile = self.readonly_worker_profiles.get(actor)
+        if profile is not None and profile.worker_id != worker_id:
+            raise ForbiddenError("worker identity binding mismatch")
+
+    def assert_readonly_worker_registration(self, actor: str, payload: dict) -> None:
+        profile = self.readonly_worker_profiles.get(actor)
+        if profile is None:
+            return
+        if (
+            str(payload.get("worker_id") or "") != profile.worker_id
+            or str(payload.get("identity") or "") != profile.identity
+            or set(payload.get("capabilities") or []) != set(profile.capabilities)
+            or str(payload.get("trust_zone") or "") != "isolated-review"
+            or int(payload.get("max_concurrency") or 0) != 1
+            or int(payload.get("heartbeat_interval_seconds") or 0) != 15
+        ):
+            raise ForbiddenError("readonly worker registration mismatch")
+
+    def verify_result(
+        self, result: ResultEnvelope, task: TaskRecord | None = None
+    ) -> PolicyDecision:
+        computed = result.computed_digest()
+        if result.result_digest and result.result_digest != computed:
+            return PolicyDecision(False, "result digest mismatch")
+        sensitive = bool(
+            task
+            and (
+                task.task_plan.data_classification
+                in {"confidential", "credential-secret"}
+                or any(
+                    capability.startswith(
+                        ("code.write", "deploy", "secret", "production")
+                    )
+                    for capability in task.task_plan.required_capabilities
+                )
+            )
+        )
+        if sensitive and not (result.signature or result.attestation_ref):
+            return PolicyDecision(False, "trusted result proof required")
+        if result.signature is not None or result.attestation_ref is not None:
+            if self.result_signature_verifier is None:
+                return PolicyDecision(False, "result signature verifier unavailable")
+            if not self.result_signature_verifier(result):
+                return PolicyDecision(False, "result signature invalid")
+            result.trust_status = "trusted_result"
+        else:
+            result.trust_status = "untrusted_shadow_result"
+        return PolicyDecision(True)
+
+    def authorize(self, action: str, actor: str, task: TaskRecord | None = None, context: dict | None = None) -> PolicyDecision:
+        context = context or {}
+        if not self.identity_verifier.verify(actor):
+            return PolicyDecision(False, "identity untrusted")
+
+        action_capabilities = {
+            "create": "task.creator",
+            "read": "task.read",
+            "audit": "task.audit",
+            "claim": "task.claim",
+            "result": "task.claim",
+            "fail": "task.claim",
+            "progress": "task.claim",
+            "heartbeat": "task.claim",
+            "cancel": "task.cancel",
+            "delegate": "task.delegate",
+            "worker.register": "worker.self_register",
+            "worker.admin": "worker.admin",
+        }
+        required_capability = action_capabilities.get(action)
+        if required_capability:
+            granted = set(
+                self.identity_capabilities.get(
+                    actor, self.identity_capabilities.get("*", set())
+                )
+            )
+            if required_capability not in granted:
+                return PolicyDecision(False, f"action {action} not permitted")
+
+        if action in {"claim", "result", "fail", "cancel", "progress", "delegate", "heartbeat"} and not self.execution_enabled:
+            if not self._readonly_worker_allows(action, actor, task):
+                return PolicyDecision(False, "execution disabled")
+
+        if action == "delegate" and task and task.status not in {"COMPLETED", "FAILED_FINAL", "CANCELLED"}:
+            risk = str(context.get("risk", task.task_plan.risk))
+            if RISK_RANK.get(risk, 2) > RISK_RANK.get(self.max_risk, 1):
+                return PolicyDecision(False, f"risk {risk} exceeds policy")
+
+        return PolicyDecision(True)
+
+    def assert_allowed(self, action: str, actor: str, task: TaskRecord | None = None, context: dict | None = None):
+        decision = self.authorize(action, actor, task, context=context)
+        if not decision.allowed:
+            if decision.reason == "identity untrusted":
+                raise ForbiddenError(decision.reason)
+            if decision.reason == "execution disabled":
+                raise LockedError("execution disabled")
+            raise ForbiddenError(decision.reason)

active-runtime/app/task_plane/scheduler.py

@@ -0,0 +1,76 @@
+"""Task scheduler primitives."""
+
+from __future__ import annotations
+
+import time
+from .errors import NotFoundError
+from .capabilities import has_capabilities
+from .models import WorkerClaim
+from .store import TaskPlaneStore
+
+
+class TaskScheduler:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def next_queued_task(self, worker_id: str):
+        worker = self.store.get_worker(worker_id)
+        tasks = sorted(
+            self.store.list_tasks(),
+            key=lambda task: (
+                -int(task.task_plan.metadata.get("priority", 0)),
+                task.created_at,
+                task.task_id,
+            ),
+        )
+        for task in tasks:
+            if task.status not in {"CREATED", "QUEUED", "FAILED_RECOVERABLE"}:
+                continue
+            if task.task_plan.task_type == "worker.registry.audit":
+                continue
+            if task.status == "FAILED_RECOVERABLE" and not self.store.task_has_retryable_probe(
+                task.task_id
+            ):
+                continue
+            if not has_capabilities(
+                worker.capabilities, task.task_plan.required_capabilities
+            ):
+                continue
+            if any(
+                self.store.get_task(dependency).status != "COMPLETED"
+                for dependency in task.task_plan.dependencies
+            ):
+                continue
+            if (
+                task.task_plan.data_classification == "credential-secret"
+                and worker.worker_type != "secure_file_transformer"
+                and "secure_file_transformer" not in worker.capabilities
+            ):
+                continue
+            return task
+        return None
+
+    def schedule_for_worker(self, worker_id: str, lease_seconds: int = 15) -> WorkerClaim:
+        worker = self.store.get_worker(worker_id)
+        if worker.disabled:
+            from .errors import LockedError
+
+            raise LockedError("worker disabled")
+        if time.time() > worker.last_heartbeat + (
+            worker.heartbeat_interval_seconds * 3
+        ):
+            from .errors import LockedError
+
+            raise LockedError("worker offline")
+        task = self.next_queued_task(worker_id)
+        if task is None:
+            raise NotFoundError("no queued tasks available")
+        claim = self.store.claim_task(
+            task.task_id,
+            worker_id,
+            worker.identity,
+            lease_seconds=lease_seconds,
+            expected_revision=task.revision,
+            operation_digest=task.task_plan.operation_digest(),
+        )
+        return claim

active-runtime/app/task_plane/worker_registry.py

@@ -0,0 +1,68 @@
+"""Worker registry abstraction and read helpers."""
+
+from __future__ import annotations
+
+import time
+
+from .capabilities import has_capabilities
+from .errors import NotFoundError
+from .models import WorkerRegistration
+from .store import TaskPlaneStore
+
+
+class WorkerRegistry:
+    def __init__(self, store: TaskPlaneStore):
+        self.store = store
+
+    def register(
+        self,
+        payload: dict,
+        *,
+        actor_identity: str,
+        is_admin: bool,
+        expected_revision: int | None,
+    ) -> WorkerRegistration:
+        reg = WorkerRegistration.from_dict(payload)
+        return self.store.register_worker(
+            reg,
+            actor_identity=actor_identity,
+            is_admin=is_admin,
+            expected_revision=expected_revision,
+        )
+
+    def heartbeat(
+        self,
+        worker_id: str,
+        heartbeat_interval_seconds: int | None = None,
+        *,
+        actor_identity: str,
+        expected_revision: int | None,
+    ) -> WorkerRegistration:
+        return self.store.heartbeat_worker(
+            worker_id,
+            heartbeat_interval_seconds=heartbeat_interval_seconds,
+            actor_identity=actor_identity,
+            expected_revision=expected_revision,
+        )
+
+    def list(self):
+        return self.store.list_workers()
+
+    def get(self, worker_id: str) -> WorkerRegistration:
+        try:
+            return self.store.get_worker(worker_id)
+        except NotFoundError:
+            raise
+
+    def can_execute(self, worker_id: str, required_capabilities: list[str]) -> bool:
+        worker = self.store.get_worker(worker_id)
+        return has_capabilities(worker.capabilities, required_capabilities)
+
+    def is_online(self, worker_id: str, *, now: float | None = None) -> bool:
+        worker = self.store.get_worker(worker_id)
+        deadline = worker.last_heartbeat + (worker.heartbeat_interval_seconds * 3)
+        return not worker.disabled and (time.time() if now is None else now) <= deadline
+
+    def stale_workers(self, *, now: float | None = None) -> list[WorkerRegistration]:
+        current = time.time() if now is None else now
+        return [worker for worker in self.list() if not self.is_online(worker.worker_id, now=current)]

baseline/current.json

@@ -1,8 +1,25 @@
 {
- "current_baseline": "V1R4C3",
- "previous_baseline": "V1R3C1",
- "promoted_at": "2026-07-09T17:44:57+08:00",
- "git": "f5435e308794c737f3e39de3f6b79807486943c3",
- "promoted_by": "openclaw",
- "promotion_reason": "V1R4C3 autonomous operations, search gateway, task center, owner gate, and blocker self-optimization baseline promotion"
+  "current_baseline": "V2R1C2",
+  "previous_baseline": "V2R1C1",
+  "promoted_at": "2026-07-22T01:40:51Z",
+  "git": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "promoted_by": "codex/owner-approved-gitops",
+  "promotion_reason": "Owner-authorized V2R1C2 Unified Portal production release after exact tag binding, complete evidence verification, and production acceptance PASS.",
+  "version": "V2R1C2",
+  "release_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
+  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
+  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
+  "status": "PRODUCTION_DEPLOYED",
+  "production_service": "aios-v2r1c2-production.service",
+  "production_port": 18920,
+  "rollback_version": "V2R1C1",
+  "constraints": {
+    "product_code_changed": true,
+    "production_redeployed": true,
+    "production_traffic_changed": true,
+    "tag_rewritten": false,
+    "force_push_allowed": false,
+    "rollback_assets_preserved": true
+  }
 }

config/examples/development-policy.json

@@ -0,0 +1,43 @@
+{
+  "actor_identity": "codex-chartgpt-bridge",
+  "allowed_branch_patterns": [
+    "patch/**",
+    "feature/**",
+    "fix/**",
+    "release-candidate/**"
+  ],
+  "allowed_operations": [
+    "commit_file.atomic"
+  ],
+  "allowed_path_patterns": [
+    "active-runtime/**",
+    "services/**",
+    "deploy/**",
+    "tests/**",
+    "docs/**",
+    "versions/**",
+    "release/**"
+  ],
+  "denied_branch_patterns": [
+    "main",
+    "master",
+    "governance/approvals",
+    "integration/**",
+    "production/**"
+  ],
+  "denied_operations": [
+    "force_push",
+    "history_rewrite",
+    "branch_delete",
+    "tag.write",
+    "registry.write",
+    "baseline.write",
+    "production.deploy",
+    "approval.submit",
+    "secret.read"
+  ],
+  "expires_at": "2027-07-29T00:00:00Z",
+  "policy_id": "STANDING-GOVERNED-DEVELOPMENT-WRITER-V1",
+  "repository": "aios/aios",
+  "writer_audience": "aios-governed-development-writer"
+}

config/examples/grant.json

@@ -0,0 +1,23 @@
+{
+  "actor_identity": "codex-chartgpt-bridge",
+  "allowed_operations": [
+    "commit_file.atomic"
+  ],
+  "allowed_paths": [
+    "services/**",
+    "deploy/**",
+    "tests/**",
+    "docs/**",
+    "release/**"
+  ],
+  "branch": "patch/v2r1c4-release-completion-20260729",
+  "expected_base_oid": "<40_HEX_OID>",
+  "expected_policy_sha256": "<64_HEX_SHA256>",
+  "expires_at": "2026-08-05T00:00:00Z",
+  "grant_id": "grant-REPLACE",
+  "max_operations": 200,
+  "max_total_bytes": 67108864,
+  "repository": "aios/aios",
+  "task_id": "V2R1C4-RELEASE-COMPLETION",
+  "writer_audience": "aios-governed-development-writer"
+}

config/examples/mirror.json

@@ -0,0 +1,7 @@
+{
+  "authoritative_git_dir": "/data/aios-gitops/repo.git",
+  "poll_seconds": 5,
+  "receipts_dir": "/var/lib/aios-gitops/autonomous-control-plane/mirror/receipts",
+  "requests_dir": "/var/lib/aios-gitops/autonomous-control-plane/mirror/requests",
+  "source_git_dir": "/data/aios-gitops/runtime/gitea-bin/data/gitea-repositories/aios/aios.git"
+}

config/examples/publisher.json

@@ -0,0 +1,19 @@
+{
+  "socket_path": "/run/aios-gitops/autonomous-control-plane/publisher.sock",
+  "allowed_peer_uids": [
+    0
+  ],
+  "repository": "aios/aios",
+  "base_branch": "governance/approvals",
+  "head_prefix": "governance/request/",
+  "owner_reviewer": "owner",
+  "gitea_base_url": "http://127.0.0.1:3000",
+  "remote_url": "http://127.0.0.1:3000/aios/aios.git",
+  "credential_name": "gitea_http",
+  "allowed_git_dir_roots": [
+    "/data/aios-gitops/worktrees",
+    "/data/aios-gitops/repo.git"
+  ],
+  "operation_ledger": "/var/lib/aios-gitops/autonomous-control-plane/publisher/operations.sqlite",
+  "audit_path": "/var/lib/aios-gitops/autonomous-control-plane/publisher/audit.jsonl"
+}

config/examples/release-actions.json

@@ -0,0 +1,62 @@
+{
+  "authoritative_git_dir": "/data/aios-gitops/repo.git",
+  "approval": {
+    "gitea_db_path": "/data/aios-gitops/runtime/gitea-bin/data/gitea.db",
+    "repo_id": 1,
+    "owner_user_id": 2,
+    "governance_ref": "refs/heads/governance/approvals",
+    "required_machine_contexts": [
+      "aios/branch-protection",
+      "aios/evidence-closure",
+      "aios/secret-scan",
+      "aios/state-machine",
+      "aios/validator"
+    ]
+  },
+  "merge_transport": {
+    "transport": "unix_json",
+    "socket_path": "/run/aios-gitops/integration-merge-writer.sock",
+    "timeout_seconds": 120
+  },
+  "tag_transport": {
+    "transport": "http_json",
+    "url": "http://127.0.0.1:8080/api/create-tag",
+    "credential_name": "tag_api",
+    "timeout_seconds": 120,
+    "expected_statuses": [
+      200
+    ]
+  },
+  "remote_tag": {
+    "remote_url": "https://g.cnnetmkt.top/git/aios/aios.git",
+    "gitea_base_url": "https://g.cnnetmkt.top/git",
+    "repo_owner": "aios",
+    "repo_name": "aios",
+    "credential_name": "gitea_http"
+  },
+  "deployment": {
+    "artifact_path": "/var/lib/aios-gitops/artifacts/V2R1C4.tar.zst",
+    "artifact_manifest_member": "artifact-manifest.json",
+    "release_root": "/opt/aios/releases",
+    "current_symlink": "/opt/aios/current",
+    "previous_symlink": "/opt/aios/previous",
+    "state_path": "/var/lib/aios-gitops/autonomous-control-plane/release/deployment-state.json",
+    "service_units": [
+      "aios-gitops-model-api.service"
+    ],
+    "health_checks": [
+      {
+        "url": "http://127.0.0.1:8080/health",
+        "expected_status": 200,
+        "timeout_seconds": 10
+      }
+    ]
+  },
+  "metadata": {
+    "registry_path": "/var/lib/aios-gitops/release/versions/V2R1C4.json",
+    "baseline_path": "/var/lib/aios-gitops/release/PRODUCTION_BASELINE",
+    "registry_plan_path": "/var/lib/aios-gitops/autonomous-control-plane/release/registry-plan.json",
+    "baseline_plan_path": "/var/lib/aios-gitops/autonomous-control-plane/release/baseline-plan.txt",
+    "metadata_snapshot_root": "/var/lib/aios-gitops/autonomous-control-plane/release/metadata-snapshots"
+  }
+}

config/examples/release-envelope.json

@@ -0,0 +1,24 @@
+{
+  "approval_expires_at": "2026-08-05T00:00:00Z",
+  "approval_head_oid": "<40_HEX_OID>",
+  "approval_manifest_path": "approvals/release/V2R1C4-PRODUCTION-RELEASE-ENVELOPE.json",
+  "approval_manifest_sha256": "<64_HEX_SHA256>",
+  "approval_merge_oid": "<40_HEX_OID>",
+  "approval_plan_id": "<OWNER_APPROVED_PLAN_ID>",
+  "approval_pr_number": 1,
+  "artifact_sha256": "<64_HEX_SHA256>",
+  "baseline_plan_sha256": "<64_HEX_SHA256>",
+  "deployment_plan_sha256": "<64_HEX_SHA256>",
+  "evidence_closure_oid": "<40_HEX_OID>",
+  "evidence_closure_sha256": "<64_HEX_SHA256>",
+  "owner_review_oid": 1,
+  "registry_plan_sha256": "<64_HEX_SHA256>",
+  "rollback_artifact_sha256": "<64_HEX_SHA256>",
+  "rollback_plan_sha256": "<64_HEX_SHA256>",
+  "sbom_sha256": "<64_HEX_SHA256>",
+  "tag_plan_sha256": "<64_HEX_SHA256>",
+  "target_oid": "<40_HEX_TARGET_OID>",
+  "target_tree_oid": "<40_HEX_TREE_OID>",
+  "test_evidence_sha256": "<64_HEX_SHA256>",
+  "version": "V2R1C4"
+}

config/examples/release-hooks.json

@@ -0,0 +1,96 @@
+{
+  "state_path": "/var/lib/aios-gitops/autonomous-control-plane/release/state.json",
+  "audit_path": "/var/lib/aios-gitops/autonomous-control-plane/release/audit.jsonl",
+  "hooks": {
+    "verify_owner_approval": [
+      "/usr/bin/aios-release-hook",
+      "verify_owner_approval",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "merge_release": [
+      "/usr/bin/aios-release-hook",
+      "merge_release",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "create_tag": [
+      "/usr/bin/aios-release-hook",
+      "create_tag",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "verify_remote_tag": [
+      "/usr/bin/aios-release-hook",
+      "verify_remote_tag",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "deploy": [
+      "/usr/bin/aios-release-hook",
+      "deploy",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "health_check": [
+      "/usr/bin/aios-release-hook",
+      "health_check",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "rollback": [
+      "/usr/bin/aios-release-hook",
+      "rollback",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "verify_previous": [
+      "/usr/bin/aios-release-hook",
+      "verify_previous",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "restore": [
+      "/usr/bin/aios-release-hook",
+      "restore",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "verify_restored": [
+      "/usr/bin/aios-release-hook",
+      "verify_restored",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "update_registry": [
+      "/usr/bin/aios-release-hook",
+      "update_registry",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "update_baseline": [
+      "/usr/bin/aios-release-hook",
+      "update_baseline",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "verify_consistency": [
+      "/usr/bin/aios-release-hook",
+      "verify_consistency",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "snapshot_metadata": [
+      "/usr/bin/aios-release-hook",
+      "snapshot_metadata",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ],
+    "restore_metadata": [
+      "/usr/bin/aios-release-hook",
+      "restore_metadata",
+      "--config",
+      "/etc/aios-gitops/autonomous-control-plane/release-actions.json"
+    ]
+  }
+}

config/examples/release-projection.json

@@ -0,0 +1,9 @@
+{
+  "allowed_output_roots": [
+    "/var/lib/aios-gitops/autonomous-control-plane/projection/releases"
+  ],
+  "poll_seconds": 5,
+  "receipts_dir": "/var/lib/aios-gitops/autonomous-control-plane/projection/receipts",
+  "requests_dir": "/var/lib/aios-gitops/autonomous-control-plane/projection/requests",
+  "source_git_dir": "/data/aios-gitops/runtime/gitea-bin/data/gitea-repositories/aios/aios.git"
+}

config/examples/renewal.json

@@ -0,0 +1,5 @@
+{
+  "poll_seconds": 10,
+  "receipts_dir": "/var/lib/aios-gitops/autonomous-control-plane/renewal/receipts",
+  "requests_dir": "/var/lib/aios-gitops/autonomous-control-plane/renewal/requests"
+}

config/examples/revoker.json

@@ -0,0 +1,11 @@
+{
+  "admin_credential_name": "admin_gitea_http",
+  "encrypted_credential_path": "/etc/credstore.encrypted/aios-governed-development-writer.gitea_http",
+  "expected_writer_username": "aios-governed-development-writer",
+  "gitea_base_url": "http://127.0.0.1:3000",
+  "grant_path": "/var/lib/aios-gitops/autonomous-control-plane/writer/grant.json",
+  "receipt_path": "/var/lib/aios-gitops/autonomous-control-plane/writer/revocation-receipt.json",
+  "revoked_grant_path": "/var/lib/aios-gitops/autonomous-control-plane/writer/grant.revoked.json",
+  "writer_credential_name": "writer_gitea_http",
+  "writer_unit": "aios-governed-development-writer.service"
+}

config/examples/runtime-projection.json

@@ -0,0 +1,8 @@
+{
+  "exact_paths": [
+    "/usr/libexec/aios-autonomous-release-authorization/controller.py",
+    "/usr/libexec/aios-chatgpt-action-task-router-continuous-20260726/action_task_router.py"
+  ],
+  "output_path": "/var/lib/aios-gitops/autonomous-control-plane/projection/runtime-source-evidence.json",
+  "task_id": "V2R1C4-RELEASE-COMPLETION"
+}

config/examples/watcher.json

@@ -0,0 +1,8 @@
+{
+  "gitea_db_path": "/data/aios-gitops/runtime/gitea-bin/data/gitea.db",
+  "output_dir": "/var/lib/aios-gitops/autonomous-control-plane/watcher/status",
+  "owner_user_id": 2,
+  "poll_seconds": 5,
+  "repo_id": 1,
+  "requests_dir": "/var/lib/aios-gitops/autonomous-control-plane/watcher/requests"
+}

config/examples/writer-server.json

@@ -0,0 +1,17 @@
+{
+  "socket_path": "/run/aios-gitops/autonomous-control-plane/writer.sock",
+  "allowed_peer_uids": [
+    0
+  ],
+  "policy_path": "/etc/aios-gitops/autonomous-control-plane/development-policy.json",
+  "grant_path": "/var/lib/aios-gitops/autonomous-control-plane/writer/grant.json",
+  "grant_quota_ledger": "/var/lib/aios-gitops/autonomous-control-plane/writer/grant-quota.sqlite",
+  "worktree_roots": [
+    "/data/aios-gitops/worktrees"
+  ],
+  "credential_name": "gitea_http",
+  "remote": "origin",
+  "operation_ledger": "/var/lib/aios-gitops/autonomous-control-plane/writer/operations.sqlite",
+  "audit_path": "/var/lib/aios-gitops/autonomous-control-plane/writer/audit.jsonl",
+  "max_request_bytes": 4194304
+}

config/gitops/silent-release-policy.json

@@ -0,0 +1,103 @@
+{
+  "schema_version": 4,
+  "automatic": [
+    "build",
+    "test",
+    "artifact",
+    "canary",
+    "evidence"
+  ],
+  "owner": [
+    "signed_release_plan"
+  ],
+  "forbidden": [
+    "force_push",
+    "tag_rewrite",
+    "direct_main_push",
+    "baseline_mutation",
+    "registry_mutation"
+  ],
+  "runtime_deployment": {
+    "approval_action": "signed_release_plan",
+    "required_capability": "runtime_switch",
+    "tag_operations_allowed": false,
+    "baseline_mutation_allowed": false,
+    "registry_mutation_allowed": false,
+    "writer_default": false,
+    "rollback_required": true
+  },
+  "tag_release": {
+    "approval_action": "signed_release_plan",
+    "required_capability": "tag_publish",
+    "separate_controller": true,
+    "duplicate_conflict": "fail_closed",
+    "rewrite_allowed": false,
+    "force_push_allowed": false
+  },
+  "baseline_registry_finalize": {
+    "approval_action": "signed_release_plan",
+    "required_capability": "baseline_registry_finalize",
+    "separate_controller": true,
+    "remote_tag_verification_required": true,
+    "gitea_api_verification_required": true,
+    "registry_baseline_consistency_required": true
+  },
+  "approval": {
+    "algorithm": "Ed25519",
+    "trust_domain": "aios.production",
+    "maximum_lifetime_seconds": 3600,
+    "release_plan_sha256_required": true,
+    "not_before_required": true,
+    "replay_protection": true,
+    "revocation_fail_closed": true,
+    "key_rotation_supported": true,
+    "capabilities": [
+      "runtime_switch",
+      "tag_publish",
+      "baseline_registry_finalize"
+    ]
+  },
+  "execution": {
+    "environment_variable": "AIOS_SILENT_RELEASE_EXECUTION_ENABLED",
+    "default_enabled": false,
+    "shadow_side_effects_allowed": false,
+    "durable_saga_required": true,
+    "pre_switch_revalidation_required": true,
+    "trusted_candidate_builder_required": true,
+    "actual_plan_regeneration_required": true,
+    "startup_fail_closed_on_missing_component": true,
+    "recovery_worker_shadow_default": true,
+    "production_approval_backend_required": true,
+    "production_builder_signer": "kms-hsm-secret-manager-only",
+    "production_execution_without_backend": "unavailable"
+  },
+  "durability": {
+    "journal": "sha256-hash-chain",
+    "probe_journal": "sha256-hash-chain",
+    "exclusive_capability_claims": true,
+    "side_effect_probe_before_lease_takeover": true,
+    "side_effect_probe_before_failed_recoverable_retry": true,
+    "probe_results": [
+      "NOT_APPLIED",
+      "APPLIED_VERIFIED",
+      "INDETERMINATE",
+      "CONFLICT"
+    ],
+    "probe_operation_digest_required": true,
+    "probe_freshness_required": true,
+    "tamper_result": "MANUAL_OWNER_REVIEW_REQUIRED"
+  },
+  "tag_pending": {
+    "required_observations": [
+      "remote_git_ref",
+      "annotated_tag_object",
+      "peeled_target",
+      "gitea_api",
+      "gitea_listing",
+      "repository_identity"
+    ],
+    "indeterminate_result": "RECONCILIATION_REQUIRED",
+    "conflict_result": "MANUAL_OWNER_REVIEW_REQUIRED",
+    "automatic_reconciliation": false
+  }
+}

config/gitops/worktree-governance.yaml

@@ -0,0 +1,59 @@
+version: 1
+policy_id: gitops-isolated-worktree-governance-20260714T232948UTC8
+
+runtime_identity:
+  user: aiman
+  group: gitops
+  umask: "0002"
+  prohibit_root_workspace_writes: true
+
+repository:
+  source_worktree: /data/aios-gitops/workspace
+  bare_repo: /data/aios-gitops/repo.git
+  worktree_root: /data/aios-gitops/worktrees
+  remote: origin
+
+worktrees:
+  controller: /data/aios-gitops/worktrees/controller
+  task_pattern: /data/aios-gitops/worktrees/{agent}/{task_id}
+  allowed_agents:
+    - openclaw
+    - chatgpt
+    - controller
+  require_clean_start: true
+  remove_after_successful_push: true
+  retain_on_failure: true
+
+permissions:
+  owner: aiman
+  group: gitops
+  directory_mode: "2775"
+  file_mode: "0664"
+  default_acl:
+    user:aiman: rwx
+    group:gitops: rwx
+  apply_to:
+    - /data/aios-gitops
+    - /data/aios-gitops/worktrees
+
+preflight:
+  required_user: aiman
+  required_group: gitops
+  required_umask: "0002"
+  require_writable_git_dir: true
+  require_writable_task_dir: true
+  require_writable_result_dir: true
+  reject_shared_source_worktree: true
+  reject_existing_git_lock: true
+
+notifications:
+  owner_on_received: required
+  owner_on_terminal: required
+  preferred_channel: weixin
+  redact_secrets: true
+
+rollback:
+  preserve_source_worktree: true
+  remove_created_worktrees: true
+  restore_service_dropins: true
+  restore_service_state: true

config/systemd/aios-gitops-runtime-identity.conf

@@ -0,0 +1,14 @@
+# Install as a systemd drop-in for GitOps/OpenClaw writer services.
+# Example: /etc/systemd/system/<service>.service.d/10-runtime-identity.conf
+
+[Service]
+User=aiman
+Group=gitops
+SupplementaryGroups=gitops
+UMask=0002
+Environment=AIOS_GITOPS_ROOT=/data/aios-gitops
+Environment=AIOS_BARE_REPO=/data/aios-gitops/repo.git
+Environment=AIOS_WORKTREE_ROOT=/data/aios-gitops/worktrees
+Environment=AIOS_RUNTIME_USER=aiman
+Environment=AIOS_RUNTIME_GROUP=gitops
+Environment=AIOS_RUNTIME_UMASK=0002

deploy/aios-v2/systemd/aios-v2r1c2-production.env.example

@@ -0,0 +1,27 @@
+# AIOS V2R1C2 Unified Portal production metadata.
+# No secret values belong in this file; runtime integrations use references.
+
+AIOS_V2_HOST=127.0.0.1
+AIOS_V2_PORT=18920
+AIOS_V2_STATE_DIR=/var/lib/aios-v2r1c2-production
+AIOS_PROVENANCE_STORE_FILE=/var/lib/aios-v2r1c2-production/run-provenance.sqlite3
+AIOS_EXTERNAL_TASK_STORE_FILE=/var/lib/aios-v2r1c2-production/external-task-truth.sqlite3
+AIOS_EXECUTOR_CATALOG_FILE=/var/lib/aios-v2r1c2-production/executor-catalog.json
+AIOS_EXECUTION_PLAN_FILES=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-RELEASE.json:/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+AIOS_EXECUTION_PLAN_FILE=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+
+AIOS_RELEASE_VERSION=V2R1C2
+AIOS_TARGET_VERSION=V2R1C2
+AIOS_BASELINE_VERSION=V2R1C1
+AIOS_PREVIOUS_VERSION=V2R1C1
+AIOS_RELEASE_STATUS=PRODUCTION
+AIOS_RELEASE_SOURCE_OID=3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24
+AIOS_RELEASE_OID=3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24
+AIOS_RELEASE_TAG=V2R1C2
+AIOS_RELEASE_EVIDENCE_SHA256=2e27bb73b8e6297bd3077238f73a96d697fc3c3611c601c4dc9357e5fdcd8eee
+
+AIOS_OPENCLAW_CONTRACT_VERSION=aios.openclaw.command.v2
+AIOS_OPENCLAW_SIGNATURE_ALGORITHM=Ed25519
+AIOS_OPENCLAW_PLUGIN_VERSION=2.1.0-rc.4
+AIOS_OPENCLAW_SIGNING_KEY_ID=openclaw-v2r1-candidate-ed25519
+AIOS_OWNER_WECHAT_TARGET_REF=AIOS_OWNER_WECHAT_TARGET_REF

deploy/aios-v2/systemd/aios-v2r1c2-production.service

@@ -0,0 +1,44 @@
+[Unit]
+Description=AIOS V2R1C2 Unified Portal Production
+After=network-online.target
+Wants=network-online.target
+Conflicts=aios-orchestrator-gateway.service
+ConditionPathExists=/opt/aios-v2r1c2/active-runtime/app/aios_web/release_application.py
+ConditionPathExists=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+
+[Service]
+Type=simple
+User=aios
+Group=aios
+WorkingDirectory=/opt/aios-v2r1c2/active-runtime/app
+EnvironmentFile=/etc/aios-v2/aios-v2r1c2-production.env
+Environment=PYTHONUNBUFFERED=1
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStartPre=/usr/bin/test "$AIOS_V2_PORT" = "18920"
+ExecStartPre=/usr/bin/test "$AIOS_RELEASE_SOURCE_OID" = "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24"
+ExecStartPre=/usr/bin/test "$AIOS_RELEASE_TAG" = "V2R1C2"
+ExecStart=/usr/bin/python3 -m aios_web.release_application
+Restart=on-failure
+RestartSec=3
+TimeoutStartSec=60
+TimeoutStopSec=30
+KillSignal=SIGTERM
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+ReadWritePaths=/var/lib/aios-v2r1c2-production
+StateDirectory=aios-v2r1c2-production
+StateDirectoryMode=0750
+UMask=0027
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-autonomous-release-candidate.service

@@ -0,0 +1,42 @@
+[Unit]
+Description=AIOS Autonomous Release Candidate (dormant shadow only)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=aiman
+Group=gitops
+WorkingDirectory=/data/aios-gitops/worktrees/chatgpt-autonomous-completion-contract-20260726/services/aios-autonomous-release-candidate
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+Environment=AIOS_PRODUCTION_DEPLOYMENT_ENABLED=false
+Environment=AIOS_CANDIDATE_LOOPBACK_HOST=127.0.0.1
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStart=/usr/bin/python3 -m aios_autonomous_release_candidate.service --host 127.0.0.1 --port 19951 --state /var/lib/aios-autonomous-release-candidate/state.sqlite3
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+RuntimeDirectory=aios-autonomous-release-candidate
+StateDirectory=aios-autonomous-release-candidate
+CacheDirectory=aios-autonomous-release-candidate
+ReadOnlyPaths=/data/aios-gitops/worktrees/chatgpt-autonomous-completion-contract-20260726/services/aios-autonomous-release-candidate
+ReadWritePaths=/run/aios-autonomous-release-candidate
+ReadWritePaths=/var/lib/aios-autonomous-release-candidate
+ReadWritePaths=/var/cache/aios-autonomous-release-candidate
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-autonomous-release-worker-candidate.service

@@ -0,0 +1,51 @@
+[Unit]
+Description=AIOS Autonomous Release Candidate Worker (Dormant/Shadow Only)
+After=network.target
+ConditionPathExists=/opt/aios-autonomous-release-candidate/aios_autonomous_release_candidate
+
+[Service]
+Type=simple
+User=aiman
+Group=gitops
+UMask=0077
+WorkingDirectory=/opt/aios-autonomous-release-candidate
+Environment=PYTHONDONTWRITEBYTECODE=1
+Environment=PYTHONPATH=/opt/aios-autonomous-release-candidate
+Environment=AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_PRODUCTION_DEPLOYMENT_ENABLED=false
+Environment=AIOS_CANDIDATE_CONTROL_ENDPOINT=127.0.0.1:19951
+Environment=AIOS_OPENCLAW_CREDENTIAL_REFERENCE=systemd-credential:openclaw-gateway-candidate
+Environment=AIOS_CODEX_CREDENTIAL_REFERENCE=systemd-credential:codex-app-server-candidate
+Environment=AIOS_NATIVE_CONTROL_CREDENTIAL_REFERENCE=systemd-credential:session-native-adapter-control-candidate
+Environment=AIOS_GITEA_CREDENTIAL_REFERENCE=systemd-credential:gitea-admin-api-candidate
+ImportCredential=openclaw-gateway-candidate
+ImportCredential=codex-app-server-candidate
+ImportCredential=session-native-adapter-control-candidate
+ImportCredential=gitea-admin-api-candidate
+ExecStart=/usr/bin/python3 -m aios_autonomous_release_candidate.worker_service --state-directory /var/lib/aios-autonomous-release-worker-candidate
+StateDirectory=aios-autonomous-release-worker-candidate
+RuntimeDirectory=aios-autonomous-release-worker-candidate
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+IPAddressDeny=any
+IPAddressAllow=localhost
+ReadOnlyPaths=/opt/aios-autonomous-release-candidate
+ReadWritePaths=/var/lib/aios-autonomous-release-worker-candidate
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-autonomous-renewal-controller.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=AIOS autonomous execution renewal controller
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/renewal.json
+
+[Service]
+Type=simple
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-autonomous-renewal-controller --config /etc/aios-gitops/autonomous-control-plane/renewal.json
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane/renewal /run/aios-gitops/autonomous-control-plane
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-gitops-model-api.service

@@ -11,6 +11,8 @@ Environment=AIOS_GITOPS_WORKSPACE=/data/aios-gitops/workspace
 Environment=AIOS_GITOPS_DB=/data/aios-gitops/runtime/gitops_model.sqlite3
 Environment=AIOS_GITOPS_TOKEN_FILE=/data/aios-gitops/runtime/secrets/gitops.tokens
 Environment=AIOS_GITOPS_BARE_REPO=/data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios-v23.git
+Environment=AIOS_GITOPS_AUTHORITATIVE_GIT_DIR=/data/aios-gitops/repo.git
+Environment=AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
 Environment=AIOS_GITOPS_HOST=127.0.0.1
 Environment=AIOS_GITOPS_PORT=18890
 ExecStart=/usr/bin/python3 /data/aios-gitops/workspace/active-runtime/app/aios_chatgpt_actions_api.py

deploy/systemd/aios-governance-approval-watcher.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=AIOS governance approval watcher
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/watcher.json
+
+[Service]
+Type=simple
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-governance-approval-watcher --config /etc/aios-gitops/autonomous-control-plane/watcher.json
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ReadOnlyPaths=/data/aios-gitops/runtime/gitea-bin/data/gitea.db
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane /run/aios-gitops/autonomous-control-plane
+RestrictAddressFamilies=AF_UNIX
+IPAddressDeny=any
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-governance-machine-status-producer.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=AIOS dormant single-owner machine-status prerequisite
+RefuseManualStop=no
+
+[Service]
+Type=oneshot
+User=aiman
+Group=gitops
+Environment=AIOS_SINGLE_OWNER_GOVERNANCE_ENABLED=false
+Environment=AIOS_SINGLE_OWNER_ACTIVATION_ACTIVE=false
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/python3 -m aios_single_owner_governance.service --component machine-status-producer --self-check --checkpoint-dir /var/lib/aios-gitops/runtime/single-owner-governance
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX
+ReadOnlyPaths=/data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-gitops/runtime/single-owner-governance

deploy/systemd/aios-governance-mirror-worker.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=AIOS governance approval mirror worker
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/mirror.json
+
+[Service]
+Type=simple
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-governance-mirror-worker --config /etc/aios-gitops/autonomous-control-plane/mirror.json
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/data/aios-gitops/repo.git /var/lib/aios-gitops/autonomous-control-plane/mirror /run/aios-gitops/autonomous-control-plane
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-governance-owner-review-adapter.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=AIOS dormant single-owner review adapter prerequisite
+RefuseManualStop=no
+
+[Service]
+Type=oneshot
+User=aiman
+Group=gitops
+Environment=AIOS_SINGLE_OWNER_GOVERNANCE_ENABLED=false
+Environment=AIOS_SINGLE_OWNER_ACTIVATION_ACTIVE=false
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/python3 -m aios_single_owner_governance.service --component owner-review-adapter --self-check --checkpoint-dir /var/lib/aios-gitops/runtime/single-owner-governance
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX
+ReadOnlyPaths=/data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-gitops/runtime/single-owner-governance

deploy/systemd/aios-governance-request-publisher.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=AIOS governance request publisher
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/publisher.json
+
+[Service]
+Type=simple
+User=aios-governance-request-publisher
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-governance-request-publisher --config /etc/aios-gitops/autonomous-control-plane/publisher.json
+LoadCredentialEncrypted=gitea_http:/etc/credstore.encrypted/aios-governance-request-publisher.gitea_http
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+RestrictSUIDSGID=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane /run/aios-gitops/autonomous-control-plane
+IPAddressAllow=127.0.0.1
+IPAddressDeny=any
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-governance-single-owner-activation.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=AIOS single-owner governance activation verifier
+ConditionPathExists=/etc/aios-gitops/single-owner-activation-bindings.json
+
+[Service]
+Type=oneshot
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-single-owner-governance --verify --bindings /etc/aios-gitops/single-owner-activation-bindings.json --state-root /var/lib/aios-gitops/governance-activation --lock-path /run/aios-gitops/governance-activation.lock
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/aios-gitops/governance-activation /run/aios-gitops
+RestrictSUIDSGID=true
+UMask=0027
+
+# Deliberately not installable. Deployment remains disabled/inactive;
+# activation is an explicit approved CLI transaction, never an always-on unit.

deploy/systemd/aios-governed-development-writer-revoker.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=AIOS governed development writer credential revoker
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/development-policy.json
+
+[Service]
+Type=oneshot
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-development-writer-revoker --config /etc/aios-gitops/autonomous-control-plane/revoker.json
+LoadCredentialEncrypted=writer_gitea_http:/etc/credstore.encrypted/aios-governed-development-writer.gitea_http
+LoadCredentialEncrypted=admin_gitea_http:/etc/credstore.encrypted/aios-governance-admin.gitea_http
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane/writer /run/aios-gitops/autonomous-control-plane -/etc/credstore.encrypted/aios-governed-development-writer.gitea_http

deploy/systemd/aios-governed-development-writer-revoker.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=AIOS governed development writer revocation timer
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=5min
+AccuracySec=30s
+Unit=aios-governed-development-writer-revoker.service
+
+[Install]
+WantedBy=timers.target

deploy/systemd/aios-governed-development-writer.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=AIOS governed development writer
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/development-policy.json
+
+[Service]
+Type=simple
+User=aios-governed-development-writer
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-development-writer-server --config /etc/aios-gitops/autonomous-control-plane/writer-server.json
+LoadCredentialEncrypted=gitea_http:/etc/credstore.encrypted/aios-governed-development-writer.gitea_http
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET
+IPAddressAllow=127.0.0.1
+IPAddressDeny=any
+ReadWritePaths=/data/aios-gitops/worktrees /var/lib/aios-gitops/autonomous-control-plane/writer /run/aios-gitops/autonomous-control-plane
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-integration-refresh-provisioner.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=AIOS Integration Refresh Provisioner (sandbox control plane)
+After=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+User=aios
+Group=aios
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_INTEGRATION_REFRESH_MODE=sandbox
+Environment=AIOS_CREDENTIAL_PROVIDER=disabled
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/aios/integration-refresh
+RestrictAddressFamilies=AF_UNIX
+IPAddressDeny=any
+ExecStart=/usr/bin/python3 /opt/aios/active-runtime/app/aios_isolated_writer_api/integration_refresh.py --sandbox-preflight --state-dir /var/lib/aios/integration-refresh
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-release-object-projection.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=AIOS exact release object projection
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/release-projection.json
+
+[Service]
+Type=simple
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-release-object-projector --config /etc/aios-gitops/autonomous-control-plane/release-projection.json
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane/projection /run/aios-gitops/autonomous-control-plane
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-runtime-source-read-projection.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=AIOS exact runtime source read projection
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/runtime-projection.json
+
+[Service]
+Type=oneshot
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-runtime-source-projector --config /etc/aios-gitops/autonomous-control-plane/runtime-projection.json
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane/projection /run/aios-gitops/autonomous-control-plane
+
+PrivateNetwork=true

deploy/systemd/aios-silent-release-controller.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=AIOS Silent Release Shadow Controller
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=aiman
+Group=gitops
+UMask=0077
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStart=/usr/bin/python3 /usr/libexec/aios-silent-release-shadow/current/active-runtime/app/silent_release_execution.py --state-root /var/lib/aios-silent-release-shadow --repository /data/aios-gitops/repo.git --host 127.0.0.1 --port 18891 --poll-seconds 30
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/aios-silent-release-shadow
+ReadOnlyPaths=/data/aios-gitops/repo.git /usr/libexec/aios-silent-release-shadow
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-v2r1c4-release-envelope.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=AIOS V2R1C4 unified governed release envelope executor
+After=network-online.target
+ConditionPathExists=/etc/aios-gitops/autonomous-control-plane/release-hooks.json
+ConditionPathExists=/var/lib/aios-gitops/autonomous-control-plane/release/envelope.json
+
+[Service]
+Type=oneshot
+User=root
+Group=gitops
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+ExecStart=/usr/bin/aios-v2r1c4-release-executor --config /etc/aios-gitops/autonomous-control-plane/release-hooks.json --envelope /var/lib/aios-gitops/autonomous-control-plane/release/envelope.json --operation-id v2r1c4-production-release
+LoadCredentialEncrypted=gitea_http:/etc/credstore.encrypted/aios-release-executor.gitea_http
+LoadCredentialEncrypted=tag_api:/etc/credstore.encrypted/aios-release-executor.tag_api
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+UMask=0027
+ReadWritePaths=/var/lib/aios-gitops/autonomous-control-plane/release /var/lib/aios-gitops/release /opt/aios /run/aios-gitops/autonomous-control-plane

deploy/tmpfiles.d/aios-autonomous-control-plane.conf

@@ -0,0 +1,19 @@
+d /var/lib/aios-gitops/autonomous-control-plane 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/writer 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/mirror 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/projection 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/renewal 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/release 0750 root gitops -
+d /run/aios-gitops/autonomous-control-plane 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/publisher 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/watcher 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/watcher/requests 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/watcher/status 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/mirror/requests 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/mirror/receipts 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/projection/requests 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/projection/receipts 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/projection/releases 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/renewal/requests 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/renewal/receipts 0750 root gitops -
+d /var/lib/aios-gitops/autonomous-control-plane/release/metadata-snapshots 0750 root gitops -

deploy/tmpfiles.d/aios-single-owner-governance.conf

@@ -0,0 +1,4 @@
+d /var/lib/aios-gitops/governance-activation 0750 root gitops -
+d /var/lib/aios-gitops/governance-activation/wal 0750 root gitops -
+d /var/lib/aios-gitops/governance-activation/receipts 0750 root gitops -
+d /run/aios-gitops 0750 root gitops -

deployments/V1R4C6/backup-result.md

@@ -0,0 +1,7 @@
+# V1R4C6 Backup Result
+
+- version: V1R4C6
+- status: NOT_STARTED
+- reason: No confirmed production Stack, persistent volume, database migration target, or V1R4C5 image digest is bound to this source release. A backup cannot be claimed or executed safely without an identified target datastore.
+- prohibited_actions_not_performed: production database deletion; persistent-volume deletion; docker system prune --volumes; direct copy of live database files.
+- required_before_resume: confirmed Stack identity and its documented backup/restore command.

deployments/V1R4C6/deployment-result.md

@@ -0,0 +1,14 @@
+# V1R4C6 Deployment Result
+
+- version: V1R4C6
+- source_commit: e204a90398bf646d46245b3088226749fa056edd
+- tag_commit: d8cf6058e99f5c7f2dfd2b45a406c0a7edf955b2
+- image_repository: UNRESOLVED
+- image_digest: UNRESOLVED
+- previous_image_digest: UNRESOLVED
+- portainer_environment: UNRESOLVED
+- portainer_stack: UNRESOLVED
+- deployment_action: NOT_EXECUTED
+- reason: No source-to-image-to-Portainer-Stack mapping exists. Existing Portainer containers and known Docker workloads do not expose a V1R4C6/e204 deployment target or Portainer stack labels. The active GitOps API is a direct systemd Python process, not a Portainer-managed Docker Stack.
+- rollback_status: NOT_APPLICABLE_NO_CHANGE
+- final_status: BLOCKED_MISSING_CONFIRMED_PRODUCTION_STACK

deployments/V1R4C6/preflight-result.md

@@ -0,0 +1,15 @@
+# V1R4C6 Production Preflight Result
+
+- version: V1R4C6
+- started_at_utc: 2026-07-11T16:57:04.0596039Z
+- source_tag_object: 356a8a8c1860b94b7d61a456c29228c88e57d963
+- source_tag_commit: d8cf6058e99f5c7f2dfd2b45a406c0a7edf955b2
+- source_commit: e204a90398bf646d46245b3088226749fa056edd
+- tag_to_source_relation: tag commit is direct parent of source commit (verified)
+- production_host_identifier: cn-network-mkt (hw / 1.95.164.183)
+- host_preflight: Docker 29.5.3; root filesystem 29 percent used; memory available approximately 56 GiB
+- GitOps_runtime: active at /data/aios-gitops/workspace via aios-gitops-model-api.service
+- runtime_base: current_baseline V1R4C6; previous_baseline V1R4C5; git e204a90398bf646d46245b3088226749fa056edd; service status ok
+- Portainer discovery: Portainer instances are reachable on ubuntu-admin and ubuntu-aihost, but no confirmed Portainer Environment/Stack maps to V1R4C6 or e204a90398bf646d46245b3088226749fa056edd.
+- source_build_contract: target source contains only deploy/gitea/docker-compose.yml and no application Dockerfile/Containerfile or V1R4C6 image repository declaration.
+- status: BLOCKED_MISSING_CONFIRMED_PRODUCTION_STACK

deployments/V1R4C6/rollback-result.md

@@ -0,0 +1,7 @@
+# V1R4C6 Rollback Result
+
+- version: V1R4C6
+- rollback_required: No
+- rollback_executed: No
+- reason: No container, Stack, database, image, or production configuration was changed during this run.
+- captured_v1r4c5_digest: UNRESOLVED because no matching current production Stack was confirmed.

deployments/V1R4C6/verification-result.md

@@ -0,0 +1,11 @@
+# V1R4C6 Verification Result
+
+- version: V1R4C6
+- healthcheck_result: GitOps adapter /health = 200 and /api/base = 200; this verifies the control-plane API only, not a V1R4C6 production deployment.
+- gate_a_result: NOT_RUN (production admin workbench target and authenticated test path unresolved)
+- gate_b_result: NOT_RUN (production Search Gateway target/provider binding unresolved)
+- gate_c_result: NOT_RUN (production Agent Platform target/runtime request path unresolved)
+- runtime_acceptance_result: NOT_RUN (0/8; cannot reuse non-production results)
+- critical_control_plane_finding: gitea-branch-consistency-sentinel is failed with five Git-ref-to-Gitea-metadata drift entries and autonomous safe mode emitted. This is a hard safety gate failure.
+- no_unresolved_critical_errors: false
+- final_status: BLOCKED_MISSING_CONFIRMED_PRODUCTION_STACK

docs/autonomous-release/AGENT_DEPLOYMENT_INSTRUCTIONS.md

@@ -0,0 +1,71 @@
+# AIOS Autonomous Release Agent Deployment Instructions
+
+## Objective
+
+Deploy only candidate/shadow environments first. Production activation requires a separate owner release approval.
+
+## Agent execution order
+
+1. Verify git references:
+   - local
+   - authoritative bare
+   - remote
+   - Gitea API
+
+2. Build candidate artifact.
+
+3. Run:
+   - unit tests
+   - security scans
+   - secret scans
+   - artifact verification
+
+4. Start candidate workers:
+   - OpenClaw native adapter
+   - Codex native adapter
+   - dedicated writer
+
+5. Execute shadow task:
+
+```
+TaskPlan
+ -> Planner
+ -> Worker Router
+ -> Session lifecycle
+ -> Evidence chain
+ -> Artifact verification
+ -> ReleasePlan
+```
+
+## Hard restrictions
+
+Never:
+
+- write main directly
+- force push
+- rewrite tags
+- export secrets
+- bypass owner approval
+- modify production flags during candidate validation
+
+## Production release gate
+
+Require:
+
+```
+owner_approval=true
+artifact_verified=true
+evidence_closure=true
+rollback_ready=true
+remote_tag_verified=true
+baseline_verified=true
+registry_verified=true
+```
+
+Until then keep:
+
+```
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+```

docs/autonomous-release/ARCHITECTURE.md

@@ -0,0 +1,34 @@
+# AIOS Autonomous Release Candidate 架构
+
+本 Candidate 把规划、工作流、凭据引用、原生会话、证据和发布控制拆成独立边界。它只负责验证约束，不拥有生产授权。
+
+## 信任边界
+
+- Owner Approval 的签名和撤销状态来自外部 HSM/KMS 或可信 Approval Plane。Candidate 只有 verifier，没有 signer。
+- Secret Manager V2 只返回 `systemd-credential:*` 或受控的 Candidate reference，不返回认证正文。
+- OpenClaw、Codex 和 Gitea provider 身份由管理面供应；模拟 provider 永远不能把原生 canary 标成已验证。
+- Writer 只写任务绑定分支和允许路径。生产 main、tag、baseline、registry 和部署不属于 Candidate 权限。
+
+## 核心模块
+
+- `models.py`：TaskPlan、Approval、Credential、Result 和 ReleasePlan 强类型约束。
+- `store.py`：私有 SQLite、WAL、全同步、schema 检查、事务和原子 step transition。
+- `workflow.py`：依赖、claim、lease、retry、timeout recovery 和终态。
+- `credential.py` / `secret_manager.py`：reference-only 生命周期、补偿撤销、跨任务拒绝和 post-revocation 验证。
+- `native_adapters.py`：OpenClaw/Codex 原生 provider ID、parent/child tree、status、interrupt、close 和纯文本回执。
+- `gitea_canary.py`：仅通过 deploy-key provider 的 list/create/delete 操作完成 canary 与撤销验证。
+- `evidence.py`：落库的哈希链、重启回放、篡改检测和 required-event closure。
+- `artifact.py`：确定性 tar、逐文件哈希、package closure、链接/特殊文件/敏感标记拒绝。
+- `release.py` / `release_gate.py`：部署审批与回滚审批分离，tag object 与 peeled target 分离验证。
+
+## 会话真实性
+
+以下状态必须分别记录，不能互相替代：
+
+```text
+broker_session_verified
+openclaw_native_child_session_verified
+codex_child_session_verified
+```
+
+Shadow provider 只能证明 Broker 合同和清理路径，不能证明 OpenClaw 或 Codex 原生会话。

docs/autonomous-release/DORMANT_RELEASE_EXECUTION.md

@@ -0,0 +1,133 @@
+# AIOS V2R1C4 Dormant Shadow-Only Release Execution
+
+## Purpose
+
+Deploy verified V2R1C4 code while keeping autonomous execution capabilities disabled.
+
+This release separates code deployment from capability activation. Capability activation requires a later, independently approved release.
+
+## Deployment mode
+
+```text
+deployment_mode=dormant_shadow_only
+```
+
+Required production flags:
+
+```text
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+```
+
+Required dispatch transport:
+
+```text
+protectedDispatchTransport=sandbox
+```
+
+Disabled capabilities:
+
+```text
+native_openclaw_enabled=false
+native_codex_enabled=false
+automatic_release_enabled=false
+production_side_effects=false
+activation_deferred=true
+```
+
+## Release flow
+
+```text
+Integration verification
+        |
+        v
+Owner dormant release approval
+        |
+        v
+Merge PR
+        |
+        v
+Read final main merge OID
+        |
+        v
+Rebuild production artifact
+        |
+        v
+Deploy dormant runtime
+        |
+        v
+Create V2R1C4 tag
+        |
+        v
+Verify Registry and Baseline consistency
+```
+
+## Two-stage approval model
+
+### Pre-merge approval
+
+The pre-merge approval binds:
+
+- version
+- PR number
+- integration OID and tree OID
+- candidate artifact and evidence hashes
+- deployment mode
+- all production execution flags remaining false
+
+It authorizes the governed merge and production artifact rebuild. It does not predeclare the final production target OID.
+
+### Final release approval
+
+After the governed merge, the final approval binds:
+
+- final main merge OID
+- final main tree OID
+- production artifact, manifest, package closure, and evidence closure
+- rollback artifact and production configuration hashes
+- V2R1C4 tag target
+
+The integration OID must never be used as the final production target OID.
+
+## Deferred activation
+
+The following are separate activation gates and must not block dormant code deployment:
+
+- OpenClaw native session provider
+- Codex app-server provider
+- Gitea Admin API automation
+- Secret Manager V2
+- autonomous production execution
+
+They require a later activation release with separate evidence and approval.
+
+## Hard restrictions
+
+Never:
+
+- write main directly
+- force push
+- rewrite tags
+- export secrets
+- enable autonomous production execution without approval
+- treat integration OID as production target OID
+- update Registry or Baseline before remote and Gitea tag verification
+
+## Dormant production acceptance
+
+A dormant deployment is acceptable only when:
+
+```text
+deployment_mode=dormant_shadow_only
+production_side_effects=false
+protectedDispatchTransport=sandbox
+native_openclaw_enabled=false
+native_codex_enabled=false
+automatic_release_enabled=false
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+```
+
+The release report must preserve deferred activation blockers rather than falsely marking native-agent or automatic-release capabilities as enabled.

docs/autonomous-release/EXECUTION_PACKAGE.md

@@ -0,0 +1,82 @@
+# AIOS Autonomous Release Execution Package
+
+## Release Strategy
+
+V2R1C4 uses a two-stage model:
+
+1. Dormant code deployment.
+2. Capability activation through a separate approved release.
+
+## Dormant Deployment
+
+The first production release must keep autonomous execution disabled:
+
+```text
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+```
+
+Required mode:
+
+```text
+deployment_mode=dormant_shadow_only
+```
+
+Required properties:
+
+```text
+production_side_effects=false
+native_openclaw_enabled=false
+native_codex_enabled=false
+automatic_release_enabled=false
+```
+
+## Deployment Sequence
+
+```text
+Verify Integration
+        |
+        v
+Owner Dormant Release Approval
+        |
+        v
+Merge Pull Request
+        |
+        v
+Read final main merge OID
+        |
+        v
+Build Production Artifact
+        |
+        v
+Deploy Dormant Runtime
+        |
+        v
+Create Version Tag
+        |
+        v
+Verify Registry and Baseline
+```
+
+## Capability Activation (Separate)
+
+The following require separate approval and evidence:
+
+- OpenClaw native provider
+- Codex app-server provider
+- Gitea Admin API lifecycle
+- Secret Manager V2
+- Autonomous production execution
+
+## Hard Governance Rules
+
+Never:
+
+- direct write main
+- force push
+- rewrite tags
+- export credentials
+- enable autonomous production execution without approval
+- use integration OID as production target OID
+- update Baseline before remote tag verification

docs/autonomous-release/INTEGRATION_REFRESH_SOURCE_MAP_20260728.json

@@ -0,0 +1,35 @@
+{
+  "execution_renewal_manifest_blob_oid": "417f78abb3d795f7b0c04a0894069bd166bb15df",
+  "execution_renewal_manifest_sha256": "069091eff9c7c46bceccde365da6d07a8538e76bee9e288a57211f3114b94ab3",
+  "execution_renewal_merge_oid": "3a22c3c7d86930efd4bd93ac05d80ad322050cb9",
+  "observed_at": "2026-07-28T09:09:27.841968Z",
+  "runtime_source_evidence_sha256": "23f03d9c6abe6f11e1acda5210b8708696e3b77caa0083b6bfaef30a44b2a35f",
+  "runtime_source_observed_at": "2026-07-28T05:53:01.253909Z",
+  "schema": "aios.integration-refresh-source-map/v1",
+  "source_mapping_approval_merge_oid": "9514062cf33e45941abe4a8c98377e0713b0b3f6",
+  "source_mapping_manifest_blob_oid": "00c5e90e529cb98c7750a5761b0a0d6ccf507174",
+  "source_mapping_manifest_sha256": "17af8ebc43673c0e46bb9ab1bf44497e8c147f1b4a9d7a8a404edd5c0abd6f21",
+  "sources": [
+    {
+      "byte_for_byte_equal": true,
+      "canonical_blob_oid": "9c68be36e0b6a18260e3099e3d7b0dcab6d814aa",
+      "canonical_commit_oid": "85426f4f570e4d40b212318d47e52e4aed5cb06a",
+      "canonical_git_path": "active-runtime/app/aios_autonomous_release_authorization/controller.py",
+      "canonical_tree_oid": "cdbd9bb845b18d4b5224d91aace2656a51eb7c14",
+      "runtime_blob_oid": "9c68be36e0b6a18260e3099e3d7b0dcab6d814aa",
+      "runtime_path": "/usr/libexec/aios-autonomous-release-authorization/controller.py",
+      "runtime_sha256": "39b532c3058c4ae49ed691d7c66c3b7745a25111fa61039f388c8335fd262c50"
+    },
+    {
+      "byte_for_byte_equal": true,
+      "canonical_blob_oid": "ee0595ca61a0598f8cb3dc10865a255e21679b2a",
+      "canonical_commit_oid": "85426f4f570e4d40b212318d47e52e4aed5cb06a",
+      "canonical_git_path": "active-runtime/app/aios_chatgpt_action_task_router/action_task_router.py",
+      "canonical_tree_oid": "cdbd9bb845b18d4b5224d91aace2656a51eb7c14",
+      "runtime_blob_oid": "ee0595ca61a0598f8cb3dc10865a255e21679b2a",
+      "runtime_path": "/usr/libexec/aios-chatgpt-action-task-router-continuous-20260726/action_task_router.py",
+      "runtime_sha256": "738fb7035a6b792115d6467b4d1e4ffd47a8c5d5646f7032ebc68ea587cbd554"
+    }
+  ],
+  "task_id": "AIOS-INTEGRATION-REFRESH-PROVISIONER-IMPLEMENTATION-20260726"
+}

docs/autonomous-release/OPERATIONS.md

@@ -0,0 +1,48 @@
+# Candidate 运维与验收
+
+## 安全默认值
+
+两个 systemd 模板均为 Dormant/Shadow-only，绑定 loopback，默认关闭 Task Plane 执行、GitOps 写入和生产部署。模板进入仓库不等于安装或启动服务。
+
+外部信任根缺失时必须保留以下阻断：
+
+```text
+BLOCKED_OWNER_APPROVAL_VERIFIER_UNAVAILABLE
+BLOCKED_GITEA_ADMIN_CREDENTIAL_REQUIRED
+BLOCKED_EXTERNAL_OWNER_SIGNATURE
+```
+
+不得用模拟身份、个人账户或生产 provider 身份替代这些根。
+
+## 独立验收
+
+从仓库根目录运行：
+
+```text
+PYTHONPATH=services/aios-autonomous-release-candidate \
+python3 -m pytest -p no:cacheprovider -q tests/autonomous_release
+
+PYTHONPATH=services/aios-autonomous-release-candidate \
+python3 scripts/autonomous-release/run_acceptance.py \
+  --repo-root . \
+  --output /task-evidence/candidate-acceptance.json
+```
+
+Acceptance report 必须满足：
+
+```text
+all_passed=true
+skipped=0
+direct_gitea_database_access=false
+production_path_hits=[]
+secret_hits=[]
+production_side_effects=false
+```
+
+## Artifact
+
+Artifact builder 拒绝覆盖现有文件、链接、硬链接、特殊文件、仓库元数据和敏感内容标记。输出 tar 和 manifest 后必须再次执行 `ArtifactBuilder.verify`。
+
+## 外部 canary
+
+真实 native session 与 Gitea canary 只能在任务绑定的 runtime credential 投影存在时运行。每次 canary 完成后必须关闭 provider session、撤销上游对象、删除 projection，并保留非敏感回执。

docs/autonomous-release/RELEASE_PLAN.md

@@ -0,0 +1,26 @@
+# Governed ReleasePlan 关闭条件
+
+ReleasePlan 必须绑定 task、repository、integration branch、完整 target/tree OID、artifact/manifest/evidence/rollback digest、生产配置 digest，以及互不相同的部署和回滚 ApprovalPlan ID。
+
+## Candidate 与 Integration
+
+1. Candidate 分支先完成测试、扫描、Shadow、Artifact 和外部门禁盘点。
+2. 重新读取 authoritative `main` 完整 OID。
+3. 从该 OID 创建 integration 分支。
+4. 使用普通 `merge --no-ff` 合入 Candidate；禁止 squash、rebase、amend 和 force push。
+5. 在 integration 上重新执行全部测试、扫描和 artifact closure。
+
+## 生产停止线
+
+下列项目任一为 false，流程必须停止在 `READY_FOR_OWNER_RELEASE_APPROVAL`，不得部署或创建生产 tag：
+
+```text
+openclaw_native_child_session_verified
+codex_child_session_verified
+gitea_admin_api_lifecycle_canary
+owner_signer_separation_verified
+credential_incident_closed
+external_owner_release_approval_verified
+```
+
+聊天文本、Candidate 自签记录或模拟 canary 不能改变这条停止线。

docs/autonomous-release/V2R1C4_AGENT_FINAL_EXECUTION.md

@@ -0,0 +1,414 @@
+# AIOS V2R1C4 Dormant Release — Final Agent Execution Contract
+
+## 1. Purpose
+
+This document is the machine/operator execution contract for completing the governed V2R1C4 dormant release after Candidate development is frozen.
+
+It does not grant production authority. Every consequential action remains subject to the exact approval, Git reference, artifact, tag, Registry and Baseline gates defined below.
+
+## 2. Release mode
+
+The only permitted deployment mode for V2R1C4 is:
+
+```text
+deployment_mode=dormant_shadow_only
+```
+
+The following values are mandatory before, during and after deployment:
+
+```text
+AIOS_GITOPS_WRITES_ENABLED=false
+AIOS_TASK_PLANE_EXECUTION_ENABLED=false
+AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+AIOS_PRODUCTION_DEPLOYMENT_ENABLED=false
+production_side_effects=false
+native_openclaw_enabled=false
+native_codex_enabled=false
+automatic_release_enabled=false
+activation_deferred=true
+protectedDispatchTransport=sandbox
+```
+
+Any deviation is a hard stop.
+
+## 3. Authoritative branches
+
+```text
+candidate_branch=patch/chatgpt-autonomous-completion-contract-20260726
+integration_branch=integration/chatgpt-autonomous-completion-20260726
+production_branch=main
+version=V2R1C4
+pull_request=20
+```
+
+Never infer a target OID from workspace HEAD. Always read and record full 40-character OIDs.
+
+## 4. Phase A — Candidate freeze and verification
+
+1. Read the current Candidate OID and tree OID.
+2. Verify the Candidate worktree is clean.
+3. Verify four-way Candidate reference closure:
+   - local branch ref;
+   - authoritative bare ref;
+   - `git ls-remote` ref;
+   - Gitea API branch ref.
+4. Run the complete test and static validation suite defined in `V2R1C4_TEST_AND_RELEASE_CHECKLIST.md`.
+5. Build the deterministic Candidate artifact and manifest from the exact Candidate OID.
+6. Record:
+   - artifact SHA-256;
+   - manifest SHA-256;
+   - package closure SHA-256;
+   - test evidence SHA-256;
+   - rollback artifact SHA-256;
+   - production configuration SHA-256.
+7. Do not reuse any digest generated from an older Candidate OID.
+
+Failure state:
+
+```text
+CANDIDATE_ACCEPTANCE_BLOCKED
+```
+
+## 5. Phase B — Integration refresh
+
+1. Refresh the Integration branch from the latest Candidate using a governed non-fast-forward merge.
+2. Use:
+
+```text
+merge --no-ff
+```
+
+3. Do not squash, rebase, force push or rewrite Candidate history.
+4. Verify the Candidate OID is reachable from the new Integration OID.
+5. Verify four-way Integration reference closure.
+6. Run the full Candidate test suite again from the Integration worktree.
+7. Rebuild Integration evidence and Candidate package metadata if any tracked file changed during the merge.
+
+Failure state:
+
+```text
+INTEGRATION_ACCEPTANCE_BLOCKED
+```
+
+## 6. Phase C — Candidate acceptance
+
+Create Candidate acceptance evidence and execute:
+
+```text
+python scripts/autonomous-release/run_acceptance.py \
+  --phase candidate \
+  --input <candidate-evidence.json> \
+  --output <candidate-acceptance.json>
+```
+
+The result must contain:
+
+```text
+phase=candidate
+status=READY
+production_action_authorized=false
+```
+
+The Candidate gate must verify:
+
+```text
+candidate_four_way_ref_closure=true
+integration_four_way_ref_closure=true
+candidate_reachable_from_integration=true
+worktree_clean=true
+tests_failed=0
+tests_passed>0
+```
+
+It must also verify all dormant runtime flags remain disabled.
+
+`READY` authorizes review only. It does not authorize merge, deployment, tagging, Registry writes or Baseline writes.
+
+## 7. Phase D — Pre-merge owner approval
+
+Obtain a governed Owner approval plan for the exact Integration package.
+
+The approval subject must bind at least:
+
+```text
+version
+pull_request
+candidate_oid
+candidate_tree_oid
+integration_oid
+integration_tree_oid
+candidate_acceptance_digest
+candidate_release_digest
+artifact_sha256
+manifest_sha256
+package_closure_sha256
+evidence_closure_oid
+rollback_artifact_sha256
+production_config_sha256
+deployment_mode=dormant_shadow_only
+all execution flags=false
+```
+
+The approval must not predeclare the final production target OID.
+
+Without an Owner-approved plan, stop with:
+
+```text
+BLOCKED_EXTERNAL_OWNER_SIGNATURE
+```
+
+## 8. Phase E — Governed merge
+
+1. Merge PR #20 only through the governed merge path.
+2. Do not push directly to `main`.
+3. After merge, read the exact resulting `main` merge OID and tree OID.
+4. Verify four-way `main` reference closure.
+5. Verify the merged Integration OID is reachable from the final `main` merge OID.
+6. Never use the Integration OID as the production target OID.
+
+Failure state:
+
+```text
+MAIN_RECONCILIATION_REQUIRED
+```
+
+## 9. Phase F — Production artifact rebuild
+
+Rebuild all production artifacts from the exact final `main` merge OID.
+
+Record new values for:
+
+```text
+artifact_sha256
+manifest_sha256
+package_closure_sha256
+evidence_closure_oid
+rollback_artifact_sha256
+production_config_sha256
+```
+
+Candidate or Integration artifacts may not be promoted by renaming or metadata substitution. The final artifact must be demonstrably rebuilt from the final production target.
+
+## 10. Phase G — Final release digest and Owner approval
+
+1. Construct the `FinalDormantRelease` object using the final `main` target and rebuilt artifact evidence.
+2. Compute its exact `release_digest`.
+3. Obtain an Owner approval receipt bound to that exact digest.
+4. Record:
+
+```text
+approval_plan_id
+approval_receipt_sha256
+approved_release_digest
+owner_approval_verified=true
+```
+
+Required equality:
+
+```text
+approved_release_digest == FinalDormantRelease.digest()
+```
+
+A generic approval, previous approval, Candidate approval or Integration approval is insufficient.
+
+## 11. Phase H — Final acceptance
+
+Execute:
+
+```text
+python scripts/autonomous-release/run_acceptance.py \
+  --phase final \
+  --input <final-evidence.json> \
+  --output <final-acceptance.json>
+```
+
+The result must contain:
+
+```text
+phase=final
+status=READY
+production_action_authorized=false
+```
+
+Required final evidence:
+
+```text
+main_four_way_ref_closure=true
+target_is_main_head=true
+worktree_clean=true
+artifact_rebuilt_from_target=true
+rollback_verified=true
+runtime_boundary_verified=true
+owner_approval_verified=true
+approved_release_digest=<exact final release digest>
+```
+
+The acceptance report is evidence, not an execution credential.
+
+## 12. Phase I — Dormant deployment
+
+Deployment requires a separate production execution approval referencing:
+
+```text
+version=V2R1C4
+target_oid=<final main merge OID>
+evidence_closure_oid=<final evidence closure OID>
+approval_plan_id=<approved plan>
+final_acceptance_digest=<final acceptance digest>
+```
+
+Deploy only the dormant runtime. Before starting services, verify all disabled flags and the sandbox transport in the rendered production configuration.
+
+After start, verify:
+
+```text
+services_active=true
+loopback_bindings_only=true
+production_side_effects=false
+write_endpoints_disabled=true
+task_plane_execution_disabled=true
+silent_release_execution_disabled=true
+native_agent_execution_disabled=true
+```
+
+If any side-effect-capable path is active, stop services and mark:
+
+```text
+DORMANT_RUNTIME_BOUNDARY_VIOLATION
+```
+
+## 13. Phase J — Tag governance
+
+Tagging is permitted only after dormant deployment verification and exact Owner approval.
+
+Every tag request must carry:
+
+```text
+version=V2R1C4
+target_oid=<full final main merge OID>
+evidence_closure_oid=<full final evidence closure OID>
+approval_plan_id=<approved plan ID>
+```
+
+When an existing same-name tag is found:
+
+- identical tag OID and peeled target: treat as idempotent and reverify;
+- different tag OID or peeled target: stop with `MANUAL_OWNER_REVIEW_REQUIRED`.
+
+Never force push, delete, move or rewrite a formal tag.
+
+## 14. Phase K — Remote and Gitea tag acceptance
+
+Before any Registry or Baseline update, verify:
+
+```text
+local_tag_exists=true
+remote_tag_exists=true
+gitea_api_tag_exists=true
+local_tag_oid == remote_tag_oid
+remote_peeled_target_oid == target_oid
+gitea_peeled_target_oid == target_oid
+repository_identity=aios/aios
+```
+
+For annotated tags, verify both the tag object and peeled commit.
+
+Failure state:
+
+```text
+REMOTE_PUSH_PENDING
+```
+
+or:
+
+```text
+RECONCILIATION_REQUIRED
+```
+
+## 15. Phase L — Registry and Baseline
+
+Only after remote and Gitea tag acceptance:
+
+1. register or update the V2R1C4 Registry entry;
+2. reread the Registry and verify the exact target OID;
+3. update the Production Baseline to V2R1C4;
+4. reread the Baseline;
+5. run final release consistency acceptance.
+
+Required equality:
+
+```text
+Registry version
+= Production Baseline
+= local refs/tags/V2R1C4
+= remote refs/tags/V2R1C4
+= Gitea API tag
+= expected final main target
+```
+
+Do not write `PRODUCTION_DEPLOYED` before this equality is proven.
+
+## 16. Rollback
+
+If deployment verification fails:
+
+1. disable the V2R1C4 Candidate services;
+2. preserve evidence and logs;
+3. submit a governed rollback request with the target version and reason;
+4. distinguish `requested`, `approved`, `executed` and `verified` states.
+
+Do not delete tags, rewrite history or independently perform a production rollback.
+
+## 17. Mandatory stop conditions
+
+Stop without consequential execution when any of the following is missing or false:
+
+```text
+four_way_ref_closure
+clean_worktree
+full_test_closure
+artifact_digest_verification
+rollback_evidence
+runtime_boundary_verification
+exact_owner_approval
+exact_target_oid
+exact_evidence_closure_oid
+exact_approval_plan_id
+remote_tag_verification
+gitea_tag_verification
+```
+
+## 18. Final report schema
+
+Return:
+
+```text
+execution_status=COMPLETED|PARTIALLY_COMPLETED|BLOCKED|FAILED
+candidate_oid=<full OID>
+integration_oid=<full OID>
+main_target_oid=<full OID>
+artifact_sha256=<digest>
+manifest_sha256=<digest>
+package_closure_sha256=<digest>
+evidence_closure_oid=<full OID>
+candidate_acceptance_status=<status>
+final_acceptance_status=<status>
+owner_approval_verified=<bool>
+dormant_deployment_verified=<bool>
+local_tag_verified=<bool>
+remote_tag_verified=<bool>
+gitea_tag_verified=<bool>
+registry_verified=<bool>
+baseline_verified=<bool>
+release_consistency=<status>
+```
+
+Always include:
+
+```text
+force_push_used: false
+tag_rewritten: false
+direct_main_push: false
+secrets_committed: false
+owner_approval_respected: true
+```