aios/ops/openclaw/CMD-20260711-v1r4c6-integrate-deploy-verify.md

CMD-20260711-v1r4c6-integrate-deploy-verify

Goal

Perform the actual controlled integration, deployment, and verification for V1R4C6.

V1R4C6 includes:

1. Admin Workbench / Portal AIOS read-only rollout.
2. SR-03 Search Gateway real provider binding.
3. Agent Platform Integration.

Stop before V1R4C6 Git tag creation and baseline promotion. Those operations require owner confirmation.

Hard Constraints

AIOS_MEMORY_ENABLED=false
memory search remains disabled
no global vector index
no force-push
no V1R4C5 tag movement
no Gitea DB mutation
no secret plaintext in Git, logs, or reports

If any mandatory security or reliability check fails, stop deployment and report the blocker. Do not bypass the gate.

Verified Base

Required before starting:

current_baseline = V1R4C5
previous_baseline = V1R4C3
baseline_git = a32c76a3c1baa49562e53fb8adce10a5ed0e6704
AIOS_GITOPS_BARE_REPO = /data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git
runtime = active

Phase 0 — Preflight and Backup

set -euo pipefail

ROOT=/data/aios-gitops/workspace
SOURCE_RELEASE=release/v1r4c6-admin-search-agent-integration-20260711
EXEC_BRANCH=release/v1r4c6-integration-exec-20260711

cd "$ROOT"
git fetch origin --tags --prune

git status --short

test -f baseline/current.json
python3 - <<'PY'
import json
from pathlib import Path
p = Path('baseline/current.json')
d = json.loads(p.read_text(encoding='utf-8'))
assert d['current_baseline'] == 'V1R4C5', d
assert d['previous_baseline'] == 'V1R4C3', d
assert d['git'] == 'a32c76a3c1baa49562e53fb8adce10a5ed0e6704', d
assert d.get('constraints', {}).get('memory_search_enabled') is False, d
print('baseline preflight: PASS')
PY

test -d /data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git

BACKUP=/data/aios-gitops/runtime/backups/v1r4c6-predeploy-$(date +%Y%m%d-%H%M%S)
mkdir -p "$BACKUP"
cp -a baseline/current.json "$BACKUP/current.json"
cp -a versions/V1R4C5.json "$BACKUP/V1R4C5.json"

if git show-ref --verify --quiet "refs/heads/$EXEC_BRANCH"; then
  git checkout "$EXEC_BRANCH"
  git pull --ff-only origin "$EXEC_BRANCH"
else
  git checkout -b "$EXEC_BRANCH" "origin/$SOURCE_RELEASE"
  git push -u origin "$EXEC_BRANCH"
fi

Never use git push --force or git tag -f.

Phase 1 — Merge Group A: Admin Workbench / Portal AIOS

Merge in this order:

git merge --no-ff origin/feature/v1r4c4-sr04-admin-workbench-visibility-20260711 \
  -m 'merge(v1r4c6): admin workbench visibility preparation'

git merge --no-ff origin/feature/v1r4c4-sr04-portal-aios-visibility-20260710 \
  -m 'merge(v1r4c6): portal AIOS visibility preparation'

git merge --no-ff origin/patch/user-portal-me-route-diagnostics-20260709 \
  -m 'merge(v1r4c6): portal AIOS routes and RBAC manifest'

git merge --no-ff origin/patch/user-portal-rbac-ops-dashboard \
  -m 'merge(v1r4c6): portal RBAC operations dashboard'

git merge --no-ff origin/patch/agent-observability-webui \
  -m 'merge(v1r4c6): agent observability web UI'

Before merging patch/web-ui-complete-gitops-dashboard-20260706, compare overlap:

git diff --stat HEAD..origin/patch/web-ui-complete-gitops-dashboard-20260706

Merge only if it adds required functionality not already present. Otherwise record it as superseded.

Conflict Policy

Do not auto-resolve conflicts in:

auth/RBAC configuration
user/session/tenant isolation
search provider configuration
safe-mode/controller dispatch
systemd units
baseline/current.json
versions/*.json

For those files, stop and report conflict paths.

Group A Tests

Run at minimum:

python3 -m pytest -q \
  tests/test_portal_aios_frontend_contract.py \
  tests/test_portal_aios_module_registry.py \
  tests/test_portal_aios_navigation.py \
  tests/test_portal_integration_health.py \
  tests/test_portal_system_health_adapter.py

Run any additional portal/RBAC/dashboard tests discovered under tests/.

Phase 2 — Merge Group B: SR-03 Search Gateway

git merge --no-ff origin/feature/v1r4c4-sr02-search-gateway-resilience-20260710 \
  -m 'merge(v1r4c6): search gateway resilience metadata'

git merge --no-ff origin/patch/search-gateway-governed-general-capability \
  -m 'merge(v1r4c6): governed search gateway provider binding'

git merge --no-ff origin/patch/gitops-change-archive-audit \
  -m 'merge(v1r4c6): search and GitOps audit evidence'

Group B Security Review

Verify before deployment:

scope filtering occurs before ranking
provenance is attached to accepted results
out-of-scope records never reach ranking or summarization
fallback is text-only, no-memory, or scoped-only
global memory/vector index is disabled
memory search remains disabled
provider credentials are secret references only

Reject any code path that silently broadens search scope.

Group B Tests

Discover and run all search/provider/isolation tests:

find tests -maxdepth 2 -type f \
  \( -iname '*search*' -o -iname '*provider*' -o -iname '*scope*' -o -iname '*isolation*' \) \
  -print

Then run the discovered files with python3 -m pytest -q.

Also run:

bash ops/ci/run-user-data-isolation-acceptance.sh

If that script is not present after merge, stop: the data-isolation gate is mandatory.

Phase 3 — Merge Group C: Agent Platform

git merge --no-ff origin/patch/agent-event-bus-unified \
  -m 'merge(v1r4c6): unified scoped agent event bus'

git merge --no-ff origin/patch/agent-gpt-message-plane \
  -m 'merge(v1r4c6): scoped agent GPT message plane'

git merge --no-ff origin/patch/autonomous-controller-dispatch-20260709 \
  -m 'merge(v1r4c6): autonomous controller dispatch with gates'

git merge --no-ff origin/patch/self-evolution-agent-orchestration-policy \
  -m 'merge(v1r4c6): self-evolution orchestration policy'

Review patch/aios-autonomous-orchestrator-architecture-review-v1:

• merge if it contains a current architecture record not already present;
• otherwise mark it superseded in the release report.

Group C Security Review

Verify:

event envelope includes tenant/group, user, project, session, agent, source and provenance
message plane rejects cross-scope delivery
denied messages never forward body/content
controller dispatch checks autonomous safe mode before mutation
consequential actions remain owner-gated
duplicate dispatch is idempotent or rejected
queue/retry behavior is bounded and observable

Group C Tests

Discover and run agent/event/message/dispatch/controller tests:

find tests -maxdepth 2 -type f \
  \( -iname '*agent*' -o -iname '*event*' -o -iname '*message*' -o -iname '*dispatch*' -o -iname '*autonomous_controller*' \) \
  -print

Run all discovered files with python3 -m pytest -q.

Re-run the SR-02 watcher/controller suite and require all tests to pass.

Phase 4 — Full Test and Static Validation

python3 -m compileall -q active-runtime scripts tests
python3 -m pytest -q

If the full suite has unrelated historical failures, report them separately, but all V1R4C6-touched component tests must pass.

Validate JSON/YAML configuration without printing secrets.

Verify:

git diff --check
git status --short

Commit integration result normally:

git add -A
git commit -m 'release: integrate V1R4C6 admin search and agent platform'
git push origin "$EXEC_BRANCH"

If no uncommitted changes remain because merge commits already captured everything, just push normally.

Phase 5 — Deploy to Staging/Production Runtime

Use the existing deployment mechanism for this repository. Do not invent a new deployment path.

Before restart/reload, identify changed services and frontend bundles from the merged diff.

At minimum:

1. Deploy backend modules under active-runtime/app/.
2. Deploy portal frontend/navigation/proxy changes.
3. Deploy Search Gateway provider binding using secret references.
4. Deploy Agent Platform event/message/dispatch changes.
5. Preserve existing Gitea sentinel and user-data isolation systemd controls.
6. Keep AIOS_MEMORY_ENABLED=false.

Restart only affected services. Do not restart Gitea unless it independently fails health checks.

After deployment, verify affected services are active and no restart loop exists.

Phase 6 — Actual Deployment Verification

Global

curl -fsS http://127.0.0.1:18890/api/base | python3 -m json.tool
curl -fsS https://cnnetmkt.top/api/base | python3 -m json.tool

Before V1R4C6 promotion both must still report V1R4C5.

Verify Gitea sentinel remains healthy and memory search remains disabled.

Gate A — Portal/Admin Workbench

Use an existing authenticated test mechanism or secret-backed admin session. Do not log cookies/tokens.

Verify:

/portal/me/aios/manifest
/portal/me/aios/dashboard
/portal/me/aios/health

For user, group_admin/admin, and owner, record only module names/status, not personal data.

Required admin-visible functions:

task progress
process/flow diagram entry
system health
agent observability

Verify forbidden owner modules are hidden from non-owner admins.

Gate B — Search Gateway

Execute scoped test queries using non-sensitive fixtures.

Verify:

real provider selected
scope applied before ranking
provenance returned
out-of-scope fixture denied
safe fallback works
memory search remains disabled

Gate C — Agent Platform

Using synthetic non-sensitive events/messages:

same-scope delivery succeeds
cross-user/project/session delivery is denied
denied payload body is not forwarded
safe-mode blocks controller mutation
owner-gated action remains pending approval
duplicate dispatch is idempotent/rejected

Phase 7 — Release Evidence

Update:

docs/releases/V1R4C6-acceptance-checklist.md
docs/releases/V1R4C6-acceptance-evidence.md
docs/releases/V1R4C6-release-gate-status.md
versions/V1R4C6.json

Set each gate to PASS/FAIL with concrete test commands and results.

Required final state before requesting owner confirmation:

Gate A = PASS
Gate B = PASS
Gate C = PASS
full touched-component tests = PASS
runtime write acceptance = PASS
Gitea sentinel = healthy
memory search = disabled
force-push used = no
V1R4C6 tag = absent
active baseline = V1R4C5

Commit and push evidence normally to $EXEC_BRANCH.

Stop Point — Owner Confirmation Required

Do not create V1R4C6 tag. Do not promote baseline to V1R4C6. Do not enable memory search.

When all gates pass, notify the owner through the configured notification mechanism, preferably WeChat if configured. The notification must contain no secrets and must request confirmation for:

Create V1R4C6 Git tag
Promote active baseline from V1R4C5 to V1R4C6

Required report fields:

Status
Integration branch and HEAD
Merged branches
Skipped/superseded branches
Gate A result
Gate B result
Gate C result
Test totals
Deployment services/build versions
Portal/admin verification result
Search provider verification result
Agent platform verification result
Gitea sentinel status
Memory search status
Active baseline
V1R4C6 tag status
Rollback readiness
Owner confirmation required

If WeChat notification is not configured, write the exact notification message to:

/data/aios-gitops/runtime/state/V1R4C6-owner-confirmation-message.txt

and report that path.