AIOS V2R1C4 Dormant Shadow-Only Release Execution

Purpose

Deploy verified V2R1C4 code while keeping autonomous execution capabilities disabled.

This release separates code deployment from capability activation. Capability activation requires a later, independently approved release.

Deployment mode

deployment_mode=dormant_shadow_only

Required production flags:

AIOS_GITOPS_WRITES_ENABLED=false
AIOS_TASK_PLANE_EXECUTION_ENABLED=false
AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false

Required dispatch transport:

protectedDispatchTransport=sandbox

Disabled capabilities:

native_openclaw_enabled=false
native_codex_enabled=false
automatic_release_enabled=false
production_side_effects=false
activation_deferred=true

Release flow

Integration verification
        |
        v
Owner dormant release approval
        |
        v
Merge PR
        |
        v
Read final main merge OID
        |
        v
Rebuild production artifact
        |
        v
Deploy dormant runtime
        |
        v
Create V2R1C4 tag
        |
        v
Verify Registry and Baseline consistency

Two-stage approval model

Pre-merge approval

The pre-merge approval binds:

version
PR number
integration OID and tree OID
candidate artifact and evidence hashes
deployment mode
all production execution flags remaining false

It authorizes the governed merge and production artifact rebuild. It does not predeclare the final production target OID.

Final release approval

After the governed merge, the final approval binds:

final main merge OID
final main tree OID
production artifact, manifest, package closure, and evidence closure
rollback artifact and production configuration hashes
V2R1C4 tag target

The integration OID must never be used as the final production target OID.

Deferred activation

The following are separate activation gates and must not block dormant code deployment:

OpenClaw native session provider
Codex app-server provider
Gitea Admin API automation
Secret Manager V2
autonomous production execution

They require a later activation release with separate evidence and approval.

Hard restrictions

Never:

write main directly
force push
rewrite tags
export secrets
enable autonomous production execution without approval
treat integration OID as production target OID
update Registry or Baseline before remote and Gitea tag verification

Dormant production acceptance

A dormant deployment is acceptable only when:

deployment_mode=dormant_shadow_only
production_side_effects=false
protectedDispatchTransport=sandbox
native_openclaw_enabled=false
native_codex_enabled=false
automatic_release_enabled=false
AIOS_GITOPS_WRITES_ENABLED=false
AIOS_TASK_PLANE_EXECUTION_ENABLED=false
AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false

The release report must preserve deferred activation blockers rather than falsely marking native-agent or automatic-release capabilities as enabled.

3.0 KiB Raw Blame History