External GPT → Online Task ingress

Scope

This component closes the current architectural gap between an external Custom GPT and AIOS without exposing the internal Task API (18940) or canonical Bridge (18892) directly.

The first supported public-facing capability is intentionally read-only:

authenticated external intent
→ host-side ingress
→ canonical /v2/governed-task
→ canonical /v2/execution-envelope
→ persistent generic worker
→ source_capture result
→ official control-plane verification

The ingress itself never claims, heartbeats, verifies, commits, acquires WriterLease, or writes protected refs.

Security boundary

The service binds only to loopback (127.0.0.1:18945). A future owner-approved TLS reverse proxy or tunnel may expose this service externally. Direct non-loopback binding is denied by code.

Two independent credentials are projected by systemd:

gpt_ingress_token: authenticates the external caller to this ingress.
agent_task_control_token: lets the ingress call the loopback AIOS control plane.

Neither credential is stored in Git, SQLite, task payloads, results, logs, or API responses.

The ingress has no repository filesystem access.

Caller-controlled fields

Allowed:

request_id
goal
instructions
success_criteria
constraints.max_files
constraints.focus_paths
constraints.notes

Not caller-controlled:

repository
base_oid
expected_branch_oid
target_branch
branch_mode
generation
risk
priority
max_attempts
capabilities
action/adapter
WriterLease
worker identity
credentials
verification decision
main/production/tag/baseline permissions

All external tasks are hard-bound to:

repository=aios/aios
capabilities=[git.read, git.test]
action=source_capture
writer_lease=false
repository_mutation=forbidden
control_plane_side_effects=forbidden
credential_access=forbidden

Idempotency

request_id is the durable external idempotency boundary.

The ingress stores only:

request hash
derived AIOS task id
canonical job id
base oid
sanitized receipt
state

An exact retry returns the same receipt. Reusing a request_id with different content returns IDEMPOTENCY_CONFLICT.

A crash after canonical task creation can recover the same binding from the Task API rather than creating a replacement Task.

Status

GET /v1/read-only-tasks/{request_id} returns only sanitized state:

task/job ids
status
attempt
whether claimed
result classification
official verification decision/classification
source snapshot hash/count when available

It does not proxy raw Task metadata, execution envelopes, result text, credentials, or source files.

Public exposure

This candidate does not make AIOS publicly reachable. Public exposure requires a separately approved HTTPS ingress/reverse proxy with:

TLS;
external authentication lifecycle;
rate limiting / abuse controls;
request size limits;
observability;
explicit owner approval for the network exposure.

Until that step is verified:

HOST_SIDE_EXTERNAL_GPT_ADAPTER=implemented/staging-candidate
PUBLIC_CUSTOM_GPT_DIRECT_AI0S_ACCESS=not verified

3.1 KiB Raw Blame History