# CMD-20260711-v1r4c6-integrate-deploy-verify

## Goal

Perform the actual controlled integration, deployment, and verification for V1R4C6.

V1R4C6 includes:

1. Admin Workbench / Portal AIOS read-only rollout.
2. SR-03 Search Gateway real provider binding.
3. Agent Platform Integration.

Stop before V1R4C6 Git tag creation and baseline promotion. Those operations require owner confirmation.

## Hard Constraints

```text
AIOS_MEMORY_ENABLED=false
memory search remains disabled
no global vector index
no force-push
no V1R4C5 tag movement
no Gitea DB mutation
no secret plaintext in Git, logs, or reports
```

If any mandatory security or reliability check fails, stop deployment and report the blocker. Do not bypass the gate.

## Verified Base

Required before starting:

```text
current_baseline = V1R4C5
previous_baseline = V1R4C3
baseline_git = a32c76a3c1baa49562e53fb8adce10a5ed0e6704
AIOS_GITOPS_BARE_REPO = /data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git
runtime = active
```

## Phase 0 — Preflight and Backup

```bash
set -euo pipefail

ROOT=/data/aios-gitops/workspace
SOURCE_RELEASE=release/v1r4c6-admin-search-agent-integration-20260711
EXEC_BRANCH=release/v1r4c6-integration-exec-20260711

cd "$ROOT"
git fetch origin --tags --prune

git status --short

test -f baseline/current.json
python3 - <<'PY'
import json
from pathlib import Path
p = Path('baseline/current.json')
d = json.loads(p.read_text(encoding='utf-8'))
assert d['current_baseline'] == 'V1R4C5', d
assert d['previous_baseline'] == 'V1R4C3', d
assert d['git'] == 'a32c76a3c1baa49562e53fb8adce10a5ed0e6704', d
assert d.get('constraints', {}).get('memory_search_enabled') is False, d
print('baseline preflight: PASS')
PY

test -d /data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git

BACKUP=/data/aios-gitops/runtime/backups/v1r4c6-predeploy-$(date +%Y%m%d-%H%M%S)
mkdir -p "$BACKUP"
cp -a baseline/current.json "$BACKUP/current.json"
cp -a versions/V1R4C5.json "$BACKUP/V1R4C5.json"

if git show-ref --verify --quiet "refs/heads/$EXEC_BRANCH"; then
  git checkout "$EXEC_BRANCH"
  git pull --ff-only origin "$EXEC_BRANCH"
else
  git checkout -b "$EXEC_BRANCH" "origin/$SOURCE_RELEASE"
  git push -u origin "$EXEC_BRANCH"
fi
```

Never use `git push --force` or `git tag -f`.

## Phase 1 — Merge Group A: Admin Workbench / Portal AIOS

Merge in this order:

```bash
git merge --no-ff origin/feature/v1r4c4-sr04-admin-workbench-visibility-20260711 \
  -m 'merge(v1r4c6): admin workbench visibility preparation'

git merge --no-ff origin/feature/v1r4c4-sr04-portal-aios-visibility-20260710 \
  -m 'merge(v1r4c6): portal AIOS visibility preparation'

git merge --no-ff origin/patch/user-portal-me-route-diagnostics-20260709 \
  -m 'merge(v1r4c6): portal AIOS routes and RBAC manifest'

git merge --no-ff origin/patch/user-portal-rbac-ops-dashboard \
  -m 'merge(v1r4c6): portal RBAC operations dashboard'

git merge --no-ff origin/patch/agent-observability-webui \
  -m 'merge(v1r4c6): agent observability web UI'
```

Before merging `patch/web-ui-complete-gitops-dashboard-20260706`, compare overlap:

```bash
git diff --stat HEAD..origin/patch/web-ui-complete-gitops-dashboard-20260706
```

Merge only if it adds required functionality not already present. Otherwise record it as superseded.

### Conflict Policy

Do not auto-resolve conflicts in:

```text
auth/RBAC configuration
user/session/tenant isolation
search provider configuration
safe-mode/controller dispatch
systemd units
baseline/current.json
versions/*.json
```

For those files, stop and report conflict paths.

### Group A Tests

Run at minimum:

```bash
python3 -m pytest -q \
  tests/test_portal_aios_frontend_contract.py \
  tests/test_portal_aios_module_registry.py \
  tests/test_portal_aios_navigation.py \
  tests/test_portal_integration_health.py \
  tests/test_portal_system_health_adapter.py
```

Run any additional portal/RBAC/dashboard tests discovered under `tests/`.

## Phase 2 — Merge Group B: SR-03 Search Gateway

```bash
git merge --no-ff origin/feature/v1r4c4-sr02-search-gateway-resilience-20260710 \
  -m 'merge(v1r4c6): search gateway resilience metadata'

git merge --no-ff origin/patch/search-gateway-governed-general-capability \
  -m 'merge(v1r4c6): governed search gateway provider binding'

git merge --no-ff origin/patch/gitops-change-archive-audit \
  -m 'merge(v1r4c6): search and GitOps audit evidence'
```

### Group B Security Review

Verify before deployment:

```text
scope filtering occurs before ranking
provenance is attached to accepted results
out-of-scope records never reach ranking or summarization
fallback is text-only, no-memory, or scoped-only
global memory/vector index is disabled
memory search remains disabled
provider credentials are secret references only
```

Reject any code path that silently broadens search scope.

### Group B Tests

Discover and run all search/provider/isolation tests:

```bash
find tests -maxdepth 2 -type f \
  \( -iname '*search*' -o -iname '*provider*' -o -iname '*scope*' -o -iname '*isolation*' \) \
  -print
```

Then run the discovered files with `python3 -m pytest -q`.

Also run:

```bash
bash ops/ci/run-user-data-isolation-acceptance.sh
```

If that script is not present after merge, stop: the data-isolation gate is mandatory.

## Phase 3 — Merge Group C: Agent Platform

```bash
git merge --no-ff origin/patch/agent-event-bus-unified \
  -m 'merge(v1r4c6): unified scoped agent event bus'

git merge --no-ff origin/patch/agent-gpt-message-plane \
  -m 'merge(v1r4c6): scoped agent GPT message plane'

git merge --no-ff origin/patch/autonomous-controller-dispatch-20260709 \
  -m 'merge(v1r4c6): autonomous controller dispatch with gates'

git merge --no-ff origin/patch/self-evolution-agent-orchestration-policy \
  -m 'merge(v1r4c6): self-evolution orchestration policy'
```

Review `patch/aios-autonomous-orchestrator-architecture-review-v1`:

- merge if it contains a current architecture record not already present;
- otherwise mark it superseded in the release report.

### Group C Security Review

Verify:

```text
event envelope includes tenant/group, user, project, session, agent, source and provenance
message plane rejects cross-scope delivery
denied messages never forward body/content
controller dispatch checks autonomous safe mode before mutation
consequential actions remain owner-gated
duplicate dispatch is idempotent or rejected
queue/retry behavior is bounded and observable
```

### Group C Tests

Discover and run agent/event/message/dispatch/controller tests:

```bash
find tests -maxdepth 2 -type f \
  \( -iname '*agent*' -o -iname '*event*' -o -iname '*message*' -o -iname '*dispatch*' -o -iname '*autonomous_controller*' \) \
  -print
```

Run all discovered files with `python3 -m pytest -q`.

Re-run the SR-02 watcher/controller suite and require all tests to pass.

## Phase 4 — Full Test and Static Validation

```bash
python3 -m compileall -q active-runtime scripts tests
python3 -m pytest -q
```

If the full suite has unrelated historical failures, report them separately, but all V1R4C6-touched component tests must pass.

Validate JSON/YAML configuration without printing secrets.

Verify:

```bash
git diff --check
git status --short
```

Commit integration result normally:

```bash
git add -A
git commit -m 'release: integrate V1R4C6 admin search and agent platform'
git push origin "$EXEC_BRANCH"
```

If no uncommitted changes remain because merge commits already captured everything, just push normally.

## Phase 5 — Deploy to Staging/Production Runtime

Use the existing deployment mechanism for this repository. Do not invent a new deployment path.

Before restart/reload, identify changed services and frontend bundles from the merged diff.

At minimum:

1. Deploy backend modules under `active-runtime/app/`.
2. Deploy portal frontend/navigation/proxy changes.
3. Deploy Search Gateway provider binding using secret references.
4. Deploy Agent Platform event/message/dispatch changes.
5. Preserve existing Gitea sentinel and user-data isolation systemd controls.
6. Keep `AIOS_MEMORY_ENABLED=false`.

Restart only affected services. Do not restart Gitea unless it independently fails health checks.

After deployment, verify affected services are active and no restart loop exists.

## Phase 6 — Actual Deployment Verification

### Global

```bash
curl -fsS http://127.0.0.1:18890/api/base | python3 -m json.tool
curl -fsS https://cnnetmkt.top/api/base | python3 -m json.tool
```

Before V1R4C6 promotion both must still report V1R4C5.

Verify Gitea sentinel remains healthy and memory search remains disabled.

### Gate A — Portal/Admin Workbench

Use an existing authenticated test mechanism or secret-backed admin session. Do not log cookies/tokens.

Verify:

```text
/portal/me/aios/manifest
/portal/me/aios/dashboard
/portal/me/aios/health
```

For `user`, `group_admin/admin`, and `owner`, record only module names/status, not personal data.

Required admin-visible functions:

```text
task progress
process/flow diagram entry
system health
agent observability
```

Verify forbidden owner modules are hidden from non-owner admins.

### Gate B — Search Gateway

Execute scoped test queries using non-sensitive fixtures.

Verify:

```text
real provider selected
scope applied before ranking
provenance returned
out-of-scope fixture denied
safe fallback works
memory search remains disabled
```

### Gate C — Agent Platform

Using synthetic non-sensitive events/messages:

```text
same-scope delivery succeeds
cross-user/project/session delivery is denied
denied payload body is not forwarded
safe-mode blocks controller mutation
owner-gated action remains pending approval
duplicate dispatch is idempotent/rejected
```

## Phase 7 — Release Evidence

Update:

```text
docs/releases/V1R4C6-acceptance-checklist.md
docs/releases/V1R4C6-acceptance-evidence.md
docs/releases/V1R4C6-release-gate-status.md
versions/V1R4C6.json
```

Set each gate to PASS/FAIL with concrete test commands and results.

Required final state before requesting owner confirmation:

```text
Gate A = PASS
Gate B = PASS
Gate C = PASS
full touched-component tests = PASS
runtime write acceptance = PASS
Gitea sentinel = healthy
memory search = disabled
force-push used = no
V1R4C6 tag = absent
active baseline = V1R4C5
```

Commit and push evidence normally to `$EXEC_BRANCH`.

## Stop Point — Owner Confirmation Required

Do not create `V1R4C6` tag.
Do not promote baseline to V1R4C6.
Do not enable memory search.

When all gates pass, notify the owner through the configured notification mechanism, preferably WeChat if configured. The notification must contain no secrets and must request confirmation for:

```text
Create V1R4C6 Git tag
Promote active baseline from V1R4C5 to V1R4C6
```

Required report fields:

```text
Status
Integration branch and HEAD
Merged branches
Skipped/superseded branches
Gate A result
Gate B result
Gate C result
Test totals
Deployment services/build versions
Portal/admin verification result
Search provider verification result
Agent platform verification result
Gitea sentinel status
Memory search status
Active baseline
V1R4C6 tag status
Rollback readiness
Owner confirmation required
```

If WeChat notification is not configured, write the exact notification message to:

```text
/data/aios-gitops/runtime/state/V1R4C6-owner-confirmation-message.txt
```

and report that path.