aios/docs/gitops/governed-local-writer.md

Governed local writer

governed-local-writer is a temporary bootstrap seam for a task-scoped recovery when the normal bearer credential is intentionally unavailable.

The service listens only on /run/aios-gitops/governed-local-writer.sock, owned by root:root with mode 0600. It validates Linux SO_PEERCRED and accepts only UID 0. Authorization is a root-owned mode 0600 JSON file with a canonical SHA-256 digest, a short expiry, exact branch/OID/path policy, and one-shot state. Audit records contain only OIDs, task metadata, peer identity, operation, result, and timestamps; they never contain request content or credentials.

The adapter delegates checkout, secret scanning, commit, and fast-forward synchronization to the existing GitOps handler implementation. It does not invoke git update-ref, direct main writes, force pushes, tag writes, Baseline writes, or production deployment.