test(session-broker): replace channel smoke with shadow fixture

test(session): require task-bound adapter control auth
security(codex): project adapter control credential
2026-07-26 01:35:16 +08:00 · 2026-07-26 01:34:23 +08:00 · 2026-07-26 01:34:22 +08:00 · 2026-07-26 01:34:21 +08:00 · 2026-07-26 01:34:21 +08:00 · 2026-07-26 01:32:45 +08:00
296 changed files with 31682 additions and 19219 deletions
@@ -0,0 +1,3 @@
+d23bb1ec24a7f49359314e04cd2c04c8f38876e45f25a701506499d1b34f270f  MANIFEST-AIOS-V2R1-HERMES-LIFECYCLE-20260721.json
+5ce2894fdf8a22622954a1a10fb09fbab74af04f0260b249615c70236ff31731  RESULT-AIOS-V2R1-HERMES-LIFECYCLE-20260721.md
+ca2ab3c22c2b2b33bbc03e59f1206b999ad1271de3e1938fd3a0b4234c613eef  ../../../docs/aios-v2/AIOS-V2R1-HARDENING-GATE-A-REPORT.md
@@ -0,0 +1,44 @@
+{
+  "schema_version": "aios.evidence.manifest.v1",
+  "generated_at": "2026-07-21T05:50:00Z",
+  "branch": "patch/chatgpt/AIOS-V2R1-HERMES-LIFECYCLE-20260721",
+  "validated_oid": "95d2e52cb55c7b913e89bc6bed2bcdacf67512d4",
+  "evidence_root": "/var/lib/aios-gitops/acceptance/aios-v2r1-hermes-lifecycle-20260721T054205Z",
+  "evidence_hashes": {
+    "steps.tsv": "b2ad20585ba7f576e85657827a0b1db6f252887bbd73bcd718df38623e9d95cf",
+    "final-live-gate.log": "82040c674759dacf587658c5e936c313a1f50e8e2425be48ad891927befdf4fa",
+    "16R.log": "641246927a372ebaa9e6dde8b018b88275b2ba15a442473759b23fb1f215d9cf",
+    "15.log": "b0a474e2a74164f560c4f7572091911f32011c75faccd37a3c7315046275011e",
+    "13.log": "b9f637cca6e97ed893bf38530e05cd33b78e324c5e8865d4c602dfeac22a7710",
+    "12R2.log": "0c431f5f5f1c1b17acda160c917b08c7f4036485016c23e1236b9b6f4a78de67"
+  },
+  "validation": {
+    "candidate_tests": {"passed": 49, "failed": 0},
+    "hermes_lifecycle": {"passed": 17, "failed": 0},
+    "gate_b": {"passed": 10, "failed": 0},
+    "offline_acceptance": {"passed": 8, "failed": 0, "expected_warnings": 1},
+    "openclaw_real_http": "PASS",
+    "restart_recovery": "PASS",
+    "rollback_forward": "PASS",
+    "state_preservation": "PASS",
+    "final_health_corrected_16R": "PASS"
+  },
+  "git_gate": {
+    "oid_match": true,
+    "candidate_clean": true,
+    "active_controller_clean": true,
+    "locked": 0,
+    "prunable": 0,
+    "worktree_total": 88,
+    "worktree_dirty": 10,
+    "global_worktree_clean": false
+  },
+  "resolved_blockers": [],
+  "active_blockers": [
+    "BLK-LIVE-HERMES-FULL-LIFECYCLE-EVIDENCE-MISSING",
+    "BLK-GLOBAL-WORKTREE-CLEANLINESS"
+  ],
+  "overall": "PARTIAL / BLOCKED_GLOBAL_WORKTREE_CLEANLINESS",
+  "release_decision": "STOP_PREPRODUCTION",
+  "secrets_recorded": false
+}
@@ -0,0 +1,16 @@
+# AIOS V2R1 Hermes Lifecycle Result
+
+- Branch: `patch/chatgpt/AIOS-V2R1-HERMES-LIFECYCLE-20260721`
+- Validated OID: `95d2e52cb55c7b913e89bc6bed2bcdacf67512d4`
+- Evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1-hermes-lifecycle-20260721T054205Z`
+- Hermes blocker: `EVIDENCE_COMPLETE / FORMAL_CLOSURE_BLOCKED`
+- Overall: `PARTIAL / BLOCKED_GLOBAL_WORKTREE_CLEANLINESS`
+- Release decision: `STOP_PREPRODUCTION`
+
+Hermes lifecycle `17/17`, candidate `49/49`, Gate B `10/10`, offline acceptance `8/0/1`, OpenClaw real HTTP, restart recovery, rollback/forward, state preservation and corrected final health all passed at the validated OID. The Owner acceptance contract nevertheless forbids formally closing the Hermes blocker until every global gate also passes.
+
+The candidate worktree and active Controller worktree are clean; local, worktree and Gitea OIDs match; locked/prunable are zero. The global authority currently has 10 dirty worktrees out of 88, so the Owner hard gate requiring every worktree to be clean fails.
+
+No RC, Tag Approval Request, Tag, main mutation, force push, production traffic switch or secret disclosure was performed.
+
+See `MANIFEST-AIOS-V2R1-HERMES-LIFECYCLE-20260721.json` and `docs/aios-v2/AIOS-V2R1-HARDENING-GATE-A-REPORT.md`.
@@ -0,0 +1,12 @@
+# V2R1C1 Cleanup Closure
+
+- `CLEANUP_REVIEW=PASS`
+- `ARCHIVE_VALIDATION=PASS`
+- `GLOBAL_WORKTREE_CLEAN=true`
+- `global_dirty_count=0`
+- `locked=0`
+- `prunable=0`
+- Portal Archive OID: `99671cc14d2631f989e0763dc882e4001c50a1ea`
+- Spark Archive OID: `d97cd3642528bd3373fe4cf5161a5d99c0b9285f`
+
+Closure evidence: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-blocker-clear-20260721T075647Z`.
@@ -0,0 +1,57 @@
+{
+  "schema_version": "aios.v2r1c1.deployment-manifest.v1",
+  "vrc": "V2R1C1",
+  "release_branch": "release/AIOS-V2R1C1-20260721",
+  "old_release_oid": "80c4cbde03a82c30648a09b817bc2f03d5402936",
+  "validated_release_parent_oid": "0778a31ec073e7c90003ef091f1d093c16bf22e5",
+  "product_baseline_oid": "fb739f6e8ff9c031d319221ace68dce157694086",
+  "companion": {
+    "branch": "patch/openclaw/AIOS-V2R1C1-COMMAND-V2-COMPANION-20260721",
+    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
+    "oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
+    "plugin_version": "2.1.0-rc.4",
+    "contract_version": "aios.openclaw.command.v2",
+    "signature_algorithm": "Ed25519",
+    "verification_key_id": "openclaw-v2r1-candidate-ed25519",
+    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671"
+  },
+  "isolated_validation": {
+    "service": "aios-v2r1c1-openclaw-companion.service",
+    "account": "aios-v2r1c1-openclaw",
+    "listen": "127.0.0.1:28789",
+    "accept_v2": true,
+    "accept_v1": false,
+    "public_key_only": true,
+    "production_traffic_switched": false,
+    "result": "PASS"
+  },
+  "previous_plugin": {
+    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
+    "plugin_version": "2.1.0-rc.3",
+    "artifact_sha256": "d0fd11be4aec03eee9ca24bf1585d9ef3597254ad4b1db0d0137eab4456b5737"
+  },
+  "rollback": {
+    "production_plugin_unchanged": true,
+    "failed_isolated_attempts_rolled_back": true,
+    "previous_plugin_evidence": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z/00-baseline",
+    "previous_oid": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a",
+    "isolated_rollback_forward": "PASS",
+    "production_symlink_modified": false
+  },
+  "release_validation": {
+    "gate_a": "PASS",
+    "gate_b": "PASS",
+    "openclaw_v2_live": "PASS",
+    "openclaw_negative_live": "PASS",
+    "hermes_live": "PASS",
+    "restart_recovery": "PASS",
+    "rollback_forward": "PASS",
+    "final_health": "PASS",
+    "secret_violations": 0,
+    "global_dirty_count": 0,
+    "sync_status": "fully_synced"
+  },
+  "tag_status": "ABSENT",
+  "preproduction_status": "NOT_STARTED",
+  "production_status": "NOT_STARTED"
+}
@@ -0,0 +1,55 @@
+{
+  "schema_version": "aios.v2r1c1.release-evidence.v2",
+  "vrc": "V2R1C1",
+  "semver": "2.1.0-rc.1",
+  "product_baseline_oid": "fb739f6e8ff9c031d319221ace68dce157694086",
+  "old_release_oid": "80c4cbde03a82c30648a09b817bc2f03d5402936",
+  "validated_release_parent_oid": "0778a31ec073e7c90003ef091f1d093c16bf22e5",
+  "release_branch": "release/AIOS-V2R1C1-20260721",
+  "release_evidence_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-release-20260721",
+  "companion_evidence_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z",
+  "openclaw_companion": {
+    "branch": "patch/openclaw/AIOS-V2R1C1-COMMAND-V2-COMPANION-20260721",
+    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
+    "companion_oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
+    "plugin_version": "2.1.0-rc.4",
+    "contract_version": "aios.openclaw.command.v2",
+    "signature_algorithm": "Ed25519",
+    "verification_key_id": "openclaw-v2r1-candidate-ed25519",
+    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671"
+  },
+  "step13": {
+    "original_result": "FAIL_HTTP_401",
+    "original_diagnosis_manifest_sha256": "320017cbfc0f31392b4d0fb5996d0e32709982a967d102592ac45efdbdaad91f",
+    "remediated_result": "PASS",
+    "online_negative_evidence_sha256": "57ab8efd19d3bf659a65cbeda830785f6cea9172925a3cac9e027b9b842e644f",
+    "remediated_evidence_sha256": "5db59096c0586fcc0a51851d9a25d0a0b94f2bade45063fab16cc2a729f23130",
+    "task_state": "COMPLETED",
+    "dispatch_state": "COMPLETED",
+    "task_dispatch_audit_consistency": "PASS"
+  },
+  "release_validation": {
+    "static_revalidation": "PASS",
+    "static_evidence_sha256": "c33ffaf9a0f509d6e78bdfdc0848940c166b8a800940e259b7196adab04ec604",
+    "gate_a": "PASS",
+    "gate_b": "PASS",
+    "documentation_sync": "PASS",
+    "secret_scan_violations": 0,
+    "release_metadata": "PASS",
+    "hermes_live": "PASS",
+    "hermes_evidence_sha256": "e6553c99db55c3cdf9e16a4c1e6712064e00c41dc9965d0d179b6b1a2a1ad3ac",
+    "restart_recovery": "PASS",
+    "restart_evidence_sha256": "6031c92cd890dffd1de28ba75d81bed908e7da11a24aa129bcfde8efb23f0149",
+    "rollback_forward": "PASS",
+    "rollback_evidence_sha256": "f3d49c54e3f722facf68df2da3d82a9c82eb576f2c7c8dacb0f62c424d25737c",
+    "final_health": "PASS",
+    "final_health_evidence_sha256": "121cd52c0a4852b818e06be69211ae18b9fcccf976fa064e2a09c54eb8a01300",
+    "global_dirty_count": 0,
+    "sync_status": "fully_synced"
+  },
+  "validation_status": "PASS",
+  "tag_status": "ABSENT",
+  "preproduction_status": "NOT_STARTED",
+  "production_status": "NOT_STARTED",
+  "secrets_recorded": false
+}
@@ -0,0 +1,52 @@
+# V2R1C1 Validation Result
+
+Status: `RELEASE_VALIDATION_PASS / FINAL_METADATA_COMMIT_REVALIDATION_REQUIRED`
+
+Release decision: `STOP_PREPRODUCTION`
+
+## OpenClaw Command v2 Companion
+
+- Source OID: `83f8f878c7da5dd8263f2af2efa80750492e5cb3`
+- Companion OID: `12d1c13170e0c5a691d67a9408e739e7a17064a3`
+- Plugin version: `2.1.0-rc.4`
+- Contract: `aios.openclaw.command.v2`
+- Signature: `Ed25519`
+- Artifact SHA256: `aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`
+- Companion unit/contract tests: `PASS`
+- V1 fallback: `REJECTED`
+- Isolated Gateway health: `PASS`
+- Online positive/negative contract: `PASS`
+- AIOS -> OpenClaw real HTTP: `PASS`
+- Task state: `COMPLETED`
+- Dispatch state: `COMPLETED`
+- Task/Dispatch/Audit consistency: `PASS`
+
+## Evidence linkage
+
+- Original failed Release OID: `80c4cbde03a82c30648a09b817bc2f03d5402936`
+- Original HTTP 401 diagnosis: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-release-20260721/pass1-80c4cbde/13-diagnosis`
+- Original manifest SHA256: `320017cbfc0f31392b4d0fb5996d0e32709982a967d102592ac45efdbdaad91f`
+- Companion evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`
+- Validated Release parent OID: `0778a31ec073e7c90003ef091f1d093c16bf22e5`
+- Online negative evidence SHA256: `57ab8efd19d3bf659a65cbeda830785f6cea9172925a3cac9e027b9b842e644f`
+- Remediated Step 13 evidence SHA256: `5db59096c0586fcc0a51851d9a25d0a0b94f2bade45063fab16cc2a729f23130`
+
+## Release validation closure
+
+- Gate A: `PASS`
+- Gate B: `PASS`
+- Documentation sync: `PASS`
+- Secret violations: `0`
+- Release Metadata: `PASS`
+- Hermes live: `PASS`
+- Restart recovery: `PASS`
+- Previous ↔ V2R1C1 isolated rollback/forward: `PASS`
+- Final health: `PASS`
+- Global dirty / locked / prunable: `0 / 0 / 0`
+- OID sync: `fully_synced`
+- Production traffic switched: `false`
+- Tag: `ABSENT`
+
+## Remaining mandatory validation
+
+本次最终元数据闭环提交将形成新的 Release OID。必须针对该最终 OID 再次复验 Gate A、Gate B、文档同步、Secret Scan、Release Metadata 和 OpenClaw 第 13 步正向/负向验证。复验通过前不得创建 Tag 或部署预生产/生产。
@@ -1,486 +0,0 @@
-# Agent Production Deployment Requirements
-
-## Status entering deployment
-
-```yaml
-code_development: COMPLETED
-repository_commit: NOT_CREATED
-production_deployment: NOT_STARTED
-reason_repository_commit_missing:
-  current ChatGPT GitOps runtime has AIOS_GITOPS_WRITES_ENABLED=false
-```
-
-The code bundle is an input artifact. The Agent must place it on a non-main
-integration branch, review it, run acceptance tests, merge it through protected
-main and deploy the API adapter. The Agent must not regenerate or materially
-rewrite the supplied implementation without recording the new diff and tests.
-
-## Frozen production state
-
-Before any change, verify:
-
-```yaml
-main_oid: 875d41c3101093149414292067fd700dc214d4d3
-
-V2R1C5:
-  tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-  peeled_target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-  baseline_version: V2R1C5
-  baseline_status: PRODUCTION_DEPLOYED
-  target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-  evidence_closure_oid: 5e2cf8276f5093f3352b9a3252c701a44c5ab807
-```
-
-If authoritative `main` no longer equals the approved base OID, stop with
-`MANUAL_OWNER_REVIEW_REQUIRED / AUTHORIZED_BASE_OID_DRIFT`. Do not silently
-rebase the bundle onto a different base.
-
-## Bootstrap sequence — no additional Owner interaction
-
-Use the following order so that the approved V2R1C6 base OID remains valid and
-the bridge does not create its own authorization deadlock:
-
-1. Verify the supplied archive/patch SHA-256.
-2. Install the bundle into a temporary root-owned staging directory outside the
-   Git worktrees.
-3. Start a localhost-only temporary instance of
-   `aios_authorized_task_writer_api.py` on a dedicated port or Unix socket.
-4. Bind it to the existing authenticated Owner registry and the exact
-   `writer:provision` scope. Do not expose it through the public gateway.
-5. Execute the live V2R1C6 provisioning request while `main` still equals
-   `875d41c3101093149414292067fd700dc214d4d3`.
-6. Verify `READY_FOR_CODE_AUTHORING`, the exact branch OID, writer scope and
-   negative policy tests.
-7. Use the newly created scoped writer to commit this reviewed bundle onto:
-   `agent/v2r1c6-mainline-reconciliation-20260805`.
-8. Stop and remove the temporary bootstrap service and revoke its temporary
-   runtime credential. Preserve its signed grant receipt and audit logs.
-9. Open a protected PR from the V2R1C6 branch. Deploy the permanent bridge only
-   from the reviewed merge commit.
-
-The temporary service is a control-plane bootstrap, not a production release.
-It must retain:
-
-```yaml
-listen_scope: localhost_only
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-This order avoids asking the Owner to approve a second base OID merely because
-the bridge implementation itself advanced `main`.
-
-### Alternative platform-maintenance path
-
-If policy prohibits a temporary localhost bootstrap service, use an existing
-Owner-approved platform-maintenance executor to create:
-
-```yaml
-branch: patch/owner-authorization-writer-bridge-20260806
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-direct_main_push: false
-force_push: false
-tag_write: false
-baseline_write: false
-production_deploy_during_integration: false
-```
-
-Merging that branch before V2R1C6 provisioning changes the authoritative base
-OID. In that alternative only, a new exact Owner base-OID amendment is required.
-The Agent must never substitute the newer `main` OID automatically.
-
-## Files to install on the branch
-
-Copy with the same relative paths:
-
-```text
-active-runtime/app/authorized_task_writer_provisioning.py
-active-runtime/app/aios_authorized_task_writer_api.py
-docs/gitops/authorized-task-writer-provisioning.md
-docs/gitops/openapi-authorized-task-writer-fragment.yaml
-deploy/systemd/aios-gitops-model-api-authorized-writer-bridge.conf.example
-scripts/smoke_authorized_task_writer_provisioning.py
-tests/test_authorized_task_writer_provisioning.py
-```
-
-Merge the OpenAPI fragment into:
-
-```text
-docs/gitops/openapi-chatgpt-actions.yaml
-```
-
-The final schema must expose:
-
-```yaml
-operationId: provisionAuthorizedTaskWriter
-path: POST /api/task-writer/provision-authorized
-x-openai-isConsequential: true
-```
-
-Do not deploy the fragment as a second standalone OpenAPI document.
-
-## Required review of existing API integration
-
-The adapter expects the existing API handler to provide:
-
-```python
-handler.need(scope)
-handler.body()
-handler.sendj(value, status=200)
-api.H.do_POST
-api.main()
-```
-
-Confirm these contracts against the branch before merge. If the live API has a
-different authentication object shape, make the smallest adapter-only change
-and rerun every test. The core provisioning policy must remain unchanged.
-
-The API authorization registry must grant `writer:provision` only to the
-authenticated Owner role. Agents and ordinary writer tokens must not receive
-this scope.
-
-## Privilege boundary
-
-The API service must remain non-root.
-
-Install a root-owned sudoers rule that allows the API service identity to run
-only these exact commands with `sudo -n --`:
-
-```text
-/usr/local/libexec/aios-grant-signer-adapter
-/usr/local/libexec/aios-grant-validator
-/usr/local/libexec/aios-task-writer-provisioner
-```
-
-Do not allow:
-
-```text
-/bin/sh
-/bin/bash
-/usr/bin/env
-/usr/bin/git
-wildcard executable paths
-SETENV
-arbitrary environment preservation
-```
-
-The governed tools themselves must validate their `--grant-dir` and
-`--result-json` paths. Their binaries must be root-owned, non-symlink, regular,
-executable and not group/world writable.
-
-The signer must access its private signing material only through a runtime
-secret reference. No signing key or token may enter Git, API output, the
-provisioning receipt or systemd environment text.
-
-## Runtime paths and permissions
-
-Create:
-
-```text
-/var/lib/aios-gitops/authorized-writer-bridge
-/var/lib/aios-gitops/authorized-writer-bridge/receipts
-/var/lib/aios-gitops/authorized-writer-bridge/locks
-```
-
-Required properties:
-
-```yaml
-owner: API service identity
-mode: "0700"
-symlink: false
-persistent: true
-```
-
-The directory contains redacted receipts only. Temporary signed grant
-directories are deleted after success or failure.
-
-## Required staging environment
-
-Configure the API service:
-
-```text
-AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
-AIOS_GITOPS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
-AIOS_GITOPS_AUTHORIZED_WRITER_STATE_ROOT=/var/lib/aios-gitops/authorized-writer-bridge
-AIOS_GITOPS_GRANT_SIGNER_ADAPTER=/usr/local/libexec/aios-grant-signer-adapter
-AIOS_GITOPS_GRANT_VALIDATOR=/usr/local/libexec/aios-grant-validator
-AIOS_GITOPS_TASK_WRITER_PROVISIONER=/usr/local/libexec/aios-task-writer-provisioner
-AIOS_GITOPS_OWNER_PROVISION_SCOPE=writer:provision
-AIOS_GITOPS_GOVERNED_USE_SUDO=true
-AIOS_GITOPS_SUDO_PATH=/usr/bin/sudo
-```
-
-Use `aios_authorized_task_writer_api.py` as the API entrypoint. It delegates
-all pre-existing routes and adds only the new endpoint.
-
-## Pre-merge tests
-
-Run from the repository root:
-
-```bash
-python3 -m unittest -v tests/test_authorized_task_writer_provisioning.py
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/aios_authorized_task_writer_api.py
-```
-
-Required result:
-
-```yaml
-unit_tests:
-  total: 9
-  failures: 0
-  errors: 0
-smoke: PASS
-py_compile: PASS
-```
-
-Also run all existing GitOps API and isolated writer tests affected by:
-
-```text
-aios_chatgpt_actions_api
-aios_isolated_writer_api
-isolated_writer_authz
-isolated_writer_token_registry
-single_owner_governance
-OpenAPI schema validation
-```
-
-Any regression blocks merge.
-
-## Staging API acceptance
-
-### Negative authentication
-
-An Agent or non-Owner credential calling the endpoint must receive:
-
-```yaml
-http_status: 403
-error: OWNER_AUTHORIZATION_REQUIRED
-```
-
-### Negative scope tests
-
-Requests enabling any of the following must be denied before signer execution:
-
-```text
-production_change_authorized=true
-tag_change_authorized=true
-baseline_change_authorized=true
-main_write_authorized=true
-allowed_operations containing tag/main/baseline/admin operations
-missing required denied operation
-one_time_use=false
-expiry over 1800 seconds
-```
-
-### Drift and conflict tests
-
-Verify:
-
-```yaml
-wrong_base_oid:
-  http_status: 409
-  error: AUTHORIZED_BASE_OID_DRIFT
-
-existing_unreceipted_target_branch:
-  http_status: 409
-  error: EXISTING_BRANCH_OID_CONFLICT
-```
-
-### Governed tool failures
-
-Independently inject and verify fail-closed behavior for:
-
-```text
-signer unavailable
-signer signature absent
-validator signature_valid=false
-validator signer_trusted=false
-validator plan expired
-provisioner grant_consumed=false
-provisioner writer scope enables main/tag/baseline/force push
-any required negative policy test false
-```
-
-None may create or modify a Git ref.
-
-## Live V2R1C6 provisioning request
-
-After protected merge and API deployment, authenticate as the Owner and submit
-exactly:
-
-```json
-{
-  "task_id": "V2R1C6_TASK_SCOPED_WRITER_PROVISIONING",
-  "repository": "aios/aios",
-  "base_ref": "refs/heads/main",
-  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
-  "target_branch": "agent/v2r1c6-mainline-reconciliation-20260805",
-  "owner_authorization_reference": "chat-owner-authorization:v2r1c6:20260806",
-  "one_time_use": true,
-  "expires_in_seconds": 900,
-  "production_change_authorized": false,
-  "tag_change_authorized": false,
-  "baseline_change_authorized": false,
-  "main_write_authorized": false,
-  "allowed_operations": [
-    "create_worktree",
-    "create_target_branch_if_absent",
-    "commit_to_target_branch",
-    "push_target_branch"
-  ],
-  "denied_operations": [
-    "direct_main_push",
-    "force_push",
-    "tag_create",
-    "tag_update",
-    "tag_delete",
-    "branch_delete",
-    "repository_admin",
-    "baseline_write",
-    "production_deploy",
-    "production_marker_write",
-    "history_rewrite"
-  ]
-}
-```
-
-This request must be executed by the localhost-only bootstrap instance before
-the bridge code advances `main`. The endpoint must never infer “current main”.
-
-If the Agent chooses the alternative merge-first path, it must stop after the
-merge and obtain an exact Owner amendment for the new merge OID. It must not
-silently replace the approved OID.
-
-## Success response
-
-Require:
-
-```yaml
-status: READY_FOR_CODE_AUTHORING
-grant_consumed: true
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-branch_oid: <exact amended authorized base OID>
-base_oid: <same exact OID>
-main_unchanged: true
-
-writer_scope:
-  workspace_role: task-scoped-isolated-writer
-  writes_enabled: true
-  allowed_branch: agent/v2r1c6-mainline-reconciliation-20260805
-  allowed_base_oid: <exact amended authorized base OID>
-  allowed_routes:
-    - POST /api/commit-file
-  allow_main_write: false
-  allow_tag_write: false
-  allow_baseline_write: false
-  allow_force_push: false
-```
-
-All seven negative policy results must be true.
-
-Submit the identical request a second time. It must return the same grant and
-branch attestation with:
-
-```yaml
-idempotent: true
-```
-
-It must not run the provisioner again.
-
-## Production postchecks
-
-After API deployment and writer provisioning, independently verify:
-
-```yaml
-existing_routes_regression: PASS
-new_endpoint: PASS
-main_ref: expected reviewed merge commit
-V2R1C5_tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-V2R1C5_peeled_target: aa60e891547abd7e215af7cf2bf3f21fd23541da
-V2R1C5_baseline_unchanged: true
-new_release_tag_created: false
-production_baseline_changed: false
-```
-
-The deployment of this control-plane bridge does not authorize a V2R1C6
-production release. It only enables scoped code authoring.
-
-## Rollback
-
-If the new API route fails:
-
-1. Stop accepting new provisioning calls.
-2. Restore the previous API entrypoint.
-3. Restart and verify all existing routes.
-4. Preserve receipts and logs.
-5. Revoke any task writer capability already minted.
-6. Do not delete a branch or rewrite a tag.
-7. Revert the protected-main bridge commit through an ordinary reviewed revert
-   PR if source rollback is required.
-
-## Required final Agent report
-
-```yaml
-STATUS: COMPLETED | PARTIALLY_COMPLETED | BLOCKED | FAILED
-
-INTEGRATION:
-  branch:
-  commit:
-  protected_pr:
-  merge_commit:
-  files_changed:
-
-TESTS:
-  unit:
-  smoke:
-  py_compile:
-  regression:
-  fault_injection:
-
-DEPLOYMENT:
-  service:
-  entrypoint:
-  runtime_status:
-  endpoint_status:
-  rollback_verified:
-
-PROVISIONING:
-  owner_authorization_reference:
-  approval_plan_id:
-  grant_id:
-  grant_digest_sha256:
-  signing_key_identity:
-  branch:
-  branch_oid:
-  workspace_path:
-  grant_consumed:
-  idempotent_replay:
-
-CONSISTENCY:
-  main_oid:
-  V2R1C5_tag_oid:
-  V2R1C5_peeled_target_oid:
-  baseline_version:
-  baseline_changed:
-  tags_changed:
-
-SECRETS:
-  runtime_secret_reference_used:
-  plaintext_secret_logged:
-  plaintext_secret_committed:
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```
@@ -1,401 +0,0 @@
-# Agent Deployment Requirements: Owner Authorization Broker V2
-
-## Objective
-
-Deploy the audited Owner Authorization Broker that closes the bootstrap gap
-without issuing a new general-purpose Owner credential and without modifying
-`/data/aios-gitops/runtime/secrets/gitops.tokens`.
-
-The broker reuses one existing, non-wildcard Owner credential only to
-authenticate the Owner identity through one pre-existing exact scope. It then
-records an immutable task authorization event and directly invokes the
-existing signed grant -> validator -> one-shot provisioner chain.
-
-Production deployment of V2R1C6 is **not** authorized by this task.
-
-## Fixed bindings
-
-```yaml
-task_id: V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
-repository: aios/aios
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch: agent/v2r1c6-mainline-reconciliation-20260805
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-The existing V2R1C5 objects are frozen:
-
-```yaml
-tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-peeled_target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-baseline_version: V2R1C5
-baseline_status: PRODUCTION_DEPLOYED
-```
-
-## 1. Package verification
-
-Verify `MANIFEST.sha256` before installation. Reject any mismatch.
-
-Run:
-
-```bash
-python3 -m unittest -v \
-  tests/test_authorized_task_writer_provisioning.py \
-  tests/test_owner_authorization_broker.py
-
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 scripts/smoke_owner_authorization_broker.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/aios_authorized_task_writer_api.py \
-  active-runtime/app/owner_authorization_broker.py \
-  active-runtime/app/aios_owner_authorization_broker_api.py
-```
-
-All checks must pass.
-
-## 2. Existing Owner credential selection
-
-Read only the non-secret registry metadata. Select one existing credential
-that satisfies all of the following:
-
-```yaml
-role: owner
-wildcard_scope: false
-account: exact known Owner identity
-contains_exact_intake_scope: true
-```
-
-Use one existing exact scope such as `commit:create` or `file:write`. Prefer
-the narrowest scope already assigned to the intended Owner.
-
-Do not:
-
- use the historical wildcard Owner credential;
- add `writer:provision` to any bearer token;
- create or modify a bearer credential;
- print, copy or commit bearer-token material.
-
-Record only:
-
-```yaml
-owner_account: <non-secret account>
-credential_id: <non-secret ID, when available>
-intake_scope: <one exact existing scope>
-scope_readback_available: true|false
-```
-
-If `handler.need()` returns the exact scope set, configure the Owner account
-allowlist and leave the credential ID allowlist empty.
-
-If scope metadata is not returned, configure the exact non-secret credential
-ID allowlist. If neither exact scope metadata nor a stable non-secret
-credential ID can be proven, stop:
-
-```yaml
-STATUS: BLOCKED
-REASON: OWNER_CREDENTIAL_SCOPE_NOT_PROVABLE
-```
-
-## 3. Staging installation
-
-Install the four application modules in a root-owned staging directory:
-
-```text
-authorized_task_writer_provisioning.py
-aios_authorized_task_writer_api.py
-owner_authorization_broker.py
-aios_owner_authorization_broker_api.py
-```
-
-The directory and files must not be group/world writable.
-
-Prepare environment values:
-
-```yaml
-AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED: "true"
-AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES: <one exact existing scope>
-AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_IDENTITIES: <exact owner account>
-AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_CREDENTIAL_IDS: <exact ID or empty>
-AIOS_GITOPS_OWNER_AUTHORIZATION_MAX_EXPIRY_SECONDS: "900"
-AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT:
-  /var/lib/aios-gitops/owner-authorization-broker
-```
-
-Use the existing signer, validator and provisioner paths. Do not change their
-root governance configuration or disable signature checks.
-
-Start a localhost-only staging instance on a temporary port. Do not replace
-the production service yet.
-
-## 4. Authentication fail-closed tests
-
-The staging endpoint is:
-
-```text
-POST /api/governance/owner-authorizations
-```
-
-Required tests:
-
-```yaml
-unauthenticated:
-  expected: 401
-
-wrong_role:
-  expected: 403
-
-wrong_scope:
-  expected: 403
-
-wildcard_owner:
-  expected: 403
-  error: WILDCARD_OWNER_CREDENTIAL_REJECTED
-
-unallowlisted_owner:
-  expected: 403
-  error: OWNER_IDENTITY_NOT_ALLOWED
-
-production_capability_true:
-  expected: 403
-  error: PRODUCTION_CAPABILITY_REJECTED
-```
-
-A connection failure, 404 or 500 is not an authorization-policy pass.
-
-## 5. Formal provisioning request
-
-Use the selected existing non-wildcard Owner credential through its runtime
-secret reference. Never place the bearer token in the request body, command
-line, shell history, output report or Git.
-
-Request:
-
-```json
-{
-  "action": "AUTHORIZE_TASK_WRITER_PROVISIONING",
-  "task_id": "V2R1C6_TASK_SCOPED_WRITER_PROVISIONING",
-  "repository": "aios/aios",
-  "base_ref": "refs/heads/main",
-  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
-  "target_branch": "agent/v2r1c6-mainline-reconciliation-20260805",
-  "one_time_use": true,
-  "expires_in_seconds": 900,
-  "production_change_authorized": false,
-  "tag_change_authorized": false,
-  "baseline_change_authorized": false,
-  "main_write_authorized": false,
-  "allowed_operations": [
-    "create_worktree",
-    "create_target_branch_if_absent",
-    "commit_to_target_branch",
-    "push_target_branch"
-  ],
-  "denied_operations": [
-    "direct_main_push",
-    "force_push",
-    "tag_create",
-    "tag_update",
-    "tag_delete",
-    "branch_delete",
-    "repository_admin",
-    "baseline_write",
-    "production_deploy",
-    "production_marker_write",
-    "history_rewrite"
-  ]
-}
-```
-
-The Owner authorization reference is generated by the broker. The caller must
-not submit or invent one.
-
-Expected result:
-
-```yaml
-status: READY_FOR_CODE_AUTHORING
-owner_authorization_event_id: generated
-owner_authorization_reference: generated
-owner_authorization_digest_sha256: generated
-owner_authorization_consumed: true
-approval_plan_id: generated
-grant_digest_sha256: generated
-grant_consumed: true
-
-branch_oid: 875d41c3101093149414292067fd700dc214d4d3
-
-writer_scope:
-  workspace_role: task-scoped-isolated-writer
-  writes_enabled: true
-  allowed_branch: agent/v2r1c6-mainline-reconciliation-20260805
-  allowed_base_oid: 875d41c3101093149414292067fd700dc214d4d3
-  allow_main_write: false
-  allow_tag_write: false
-  allow_baseline_write: false
-  allow_force_push: false
-```
-
-## 6. Independent post-provisioning verification
-
-Verify the Authority ref:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git rev-parse \
-  refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-It must equal:
-
-```text
-875d41c3101093149414292067fd700dc214d4d3
-```
-
-Verify `main` remains unchanged, V2R1C5 tag object and peeled target remain
-unchanged, and the Production Baseline remains V2R1C5.
-
-Verify the broker audit event under:
-
-```text
-/var/lib/aios-gitops/owner-authorization-broker/events/
-```
-
-Requirements:
-
-```yaml
-status: CONSUMED
-wildcard_scope_used: false
-grant_consumed: true
-permissions:
-  directory: "0700"
-  json_files: "0600"
-```
-
-Do not return bearer-token material in the report.
-
-## 7. Commit the broker through the new writer
-
-After `READY_FOR_CODE_AUTHORING`, use only the writer's
-`POST /api/commit-file` route to put this code bundle on:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-Commit the bridge and broker as separate intentional commits when practical:
-
-1. Owner-authorized task-writer bridge.
-2. Audited Owner authorization broker and deployment docs.
-
-Do not merge to `main` directly. Create a protected PR after branch commits
-and tests are complete.
-
-## 8. Permanent service deployment
-
-Only after protected review and merge:
-
-1. Install the reviewed files from the merge commit.
-2. Apply a reviewed systemd drop-in based on the provided example.
-3. Start the wrapper entrypoint:
-   `aios_owner_authorization_broker_api.py`.
-4. Verify all existing API routes still work.
-5. Verify the broker remains localhost/reverse-proxy constrained as intended.
-6. Re-run authentication and policy tests.
-7. Remove the temporary staging instance.
-
-This permanent bridge deployment does not authorize a V2R1C6 production tag,
-Baseline update or application deployment.
-
-## 9. Fail-closed conditions
-
-Stop with `BLOCKED` for any of the following:
-
- Authority `main` no longer equals the fixed base OID.
- Target branch exists at a different OID.
- Only a wildcard Owner credential can authenticate.
- Exact credential scope cannot be proven.
- Owner identity is not explicitly allow-listed.
- Signer, validator or provisioner self-test fails.
- Grant is not marked one-time and consumed.
- Writer allows main, tag, Baseline, force-push or branch-delete operations.
- Audit event contains sensitive material.
- V2R1C5 tag or Baseline changes.
-
-## 10. Required Agent result
-
-```yaml
-STATUS: READY_FOR_CODE_AUTHORING | BLOCKED | FAILED
-
-PACKAGE:
-  manifest_verified:
-  unit_tests:
-  smoke_tests:
-  py_compile:
-
-OWNER_CREDENTIAL:
-  account:
-  credential_id:
-  intake_scope:
-  exact_scope_proven:
-  wildcard_used: false
-  token_logged: false
-
-BROKER:
-  staging_listener:
-  endpoint_status:
-  event_id:
-  authorization_reference:
-  authorization_digest_sha256:
-  event_consumed:
-  audit_permissions_valid:
-
-GRANT:
-  approval_plan_id:
-  grant_digest_sha256:
-  signer_identity:
-  signature_valid:
-  one_time_use:
-  consumed:
-
-BRANCH:
-  name:
-  oid:
-  base_oid:
-  ref_exists:
-  worktree_path:
-  worktree_clean:
-
-WRITER:
-  status:
-  writes_enabled:
-  allowed_branch:
-  allowed_base_oid:
-  allowed_routes:
-  main_write_denied:
-  tag_write_denied:
-  baseline_write_denied:
-  force_push_denied:
-
-POSTCHECK:
-  main_unchanged:
-  V2R1C5_tag_unchanged:
-  baseline_unchanged:
-
-REPOSITORY_INTEGRATION:
-  commit_oids:
-  protected_pr:
-  merged:
-  permanent_bridge_deployed:
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```
@@ -1,562 +0,0 @@
-# Agent execution requirements: V2R1C6 task identity overlay
-
-## Required result
-
-The Agent must return one of:
-
- `READY_FOR_CODE_AUTHORING`
- `BLOCKED`
- `FAILED`
-
-The Agent may not report success until the task branch, isolated worktree and
-task writer are independently verified.
-
-This stage is **not** a production deployment. It must not modify `main`,
-V2R1C5, tags, Registry, Production Baseline or production services.
-
-## Fixed authority
-
-```yaml
-task_id: V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
-repository: aios/aios
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch: agent/v2r1c6-mainline-reconciliation-20260805
-owner_identity: aiman
-one_time_use: true
-maximum_ttl_seconds: 900
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-## 1. Verify package
-
-Verify the externally supplied package against the published SHA-256 values and
-then verify every entry in `MANIFEST.sha256`.
-
-Do not synthesize a missing archive. Use either the verified ZIP or TAR.GZ.
-
-Required checks:
-
-```yaml
-package_hash_match: true
-manifest_entries_match: true
-unit_tests_pass: true
-smoke_tests_pass: true
-py_compile_pass: true
-```
-
-## 2. Create root-owned staging
-
-Extract to a fresh directory such as:
-
-```text
-/var/lib/aios-gitops/staging/v2r1c6-task-identity-overlay-<nonce>
-```
-
-Requirements:
-
-```yaml
-owner: root
-group: root
-directory_mode: "0700"
-files_not_world_writable: true
-symlinks_rejected: true
-```
-
-Do not overwrite the active runtime tree.
-
-## 3. Re-run target-host tests
-
-From the staging root:
-
-```bash
-python3 -m unittest discover -s tests -v
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 scripts/smoke_owner_authorization_broker.py
-python3 scripts/smoke_task_identity_overlay.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/owner_authorization_broker.py \
-  active-runtime/app/task_identity_overlay.py \
-  active-runtime/app/aios_authorized_task_writer_api.py \
-  active-runtime/app/aios_owner_authorization_broker_api.py \
-  active-runtime/app/aios_task_identity_overlay_api.py \
-  active-runtime/app/aios_task_identity_overlay_cli.py \
-  scripts/call_task_identity_overlay.py
-```
-
-Any failure is `BLOCKED`; do not proceed.
-
-## 4. Prestart Git and production freeze checks
-
-Read from the authority repository:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git rev-parse refs/heads/main
-git --git-dir=/data/aios-gitops/repo.git \
-  show-ref --verify --quiet \
-  refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-git --git-dir=/data/aios-gitops/repo.git rev-parse refs/tags/V2R1C5
-git --git-dir=/data/aios-gitops/repo.git rev-parse 'refs/tags/V2R1C5^{}'
-```
-
-Expected:
-
-```yaml
-main_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch_exists: false
-V2R1C5_tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-V2R1C5_peeled_target: aa60e891547abd7e215af7cf2bf3f21fd23541da
-```
-
-Read Baseline and require:
-
-```yaml
-version: V2R1C5
-status: PRODUCTION_DEPLOYED
-target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-evidence_closure_oid: 5e2cf8276f5093f3352b9a3252c701a44c5ab807
-```
-
-If `main` has drifted, return:
-
-```yaml
-STATUS: MANUAL_OWNER_REVIEW_REQUIRED
-REASON: AUTHORIZED_BASE_OID_DRIFT
-```
-
-If the target branch already exists at another OID, return:
-
-```yaml
-STATUS: MANUAL_OWNER_REVIEW_REQUIRED
-REASON: EXISTING_BRANCH_OID_CONFLICT
-```
-
-Do not delete, reset or force-push the branch.
-
-## 5. Discover active secret references
-
-The overlay does not read or modify `gitops.tokens`, but its issuer must compare
-the new random secret against all active bearer secret references.
-
-Discover references without printing secret contents. At minimum include the
-currently active ChatGPT/GitOps bearer secret reference and any other bearer
-files consumed by the active API.
-
-Pass them as a comma-separated list in:
-
-```text
-AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS
-```
-
-Evidence must contain only paths and SHA-256 match counts, not token values.
-
-If active secret references cannot be enumerated, return:
-
-```yaml
-STATUS: BLOCKED
-REASON: ACTIVE_SECRET_REFERENCE_SET_UNRESOLVED
-```
-
-## 6. Install the transient systemd service
-
-Use the provided template:
-
-```text
-deploy/systemd/aios-v2r1c6-task-identity-overlay.service.example
-```
-
-Substitute only:
-
- verified root-owned staging directory;
- verified active secret-ref path list.
-
-Do not change task ID, repository, base OID, target branch or denied
-capabilities.
-
-The service must listen only on:
-
-```text
-127.0.0.1:19864
-```
-
-Before start, run:
-
-```bash
-systemd-analyze verify \
-  /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
-```
-
-Then:
-
-```bash
-sudo systemctl daemon-reload
-sudo systemctl start aios-v2r1c6-task-identity-overlay.service
-```
-
-Confirm:
-
-```bash
-curl --fail --silent http://127.0.0.1:19864/healthz
-```
-
-Expected:
-
-```yaml
-service: aios-task-identity-overlay
-status: active
-global_token_registry_used: false
-loopback_only: true
-```
-
-Do not expose the port externally.
-
-## 7. Issue the one-time overlay
-
-Use the root-only CLI. The authorization assertion is an audit label for this
-already approved Owner task; it must not be described as an external signed
-event.
-
-Example:
-
-```bash
-sudo env \
-  PYTHONPATH=<staging>/active-runtime/app \
-  AIOS_GITOPS_IDENTITY_OVERLAY_STATE_ROOT=/var/lib/aios-gitops/task-identity-overlays \
-  AIOS_GITOPS_IDENTITY_OVERLAY_SECRET_ROOT=/run/aios-gitops/task-identity-overlays \
-  AIOS_GITOPS_IDENTITY_OVERLAY_TASK_ID=V2R1C6_TASK_SCOPED_WRITER_PROVISIONING \
-  AIOS_GITOPS_IDENTITY_OVERLAY_OWNER_IDENTITY=aiman \
-  AIOS_GITOPS_IDENTITY_OVERLAY_BASE_REF=refs/heads/main \
-  AIOS_GITOPS_IDENTITY_OVERLAY_BASE_OID=875d41c3101093149414292067fd700dc214d4d3 \
-  AIOS_GITOPS_IDENTITY_OVERLAY_TARGET_BRANCH=agent/v2r1c6-mainline-reconciliation-20260805 \
-  AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS=<verified-secret-ref-list> \
-  python3 <staging>/active-runtime/app/aios_task_identity_overlay_cli.py \
-    issue \
-    --ttl-seconds 900 \
-    --authorization-assertion-ref owner-session:V2R1C6:approved-20260806 \
-    --operator-identity <audited-agent-identity> \
-    --result-json /run/aios-gitops/v2r1c6-overlay-issued.json
-```
-
-The result must contain:
-
-```yaml
-status: OVERLAY_ACTIVE
-idempotent: false
-overlay_id: present
-secret_ref: under /run/aios-gitops/task-identity-overlays
-expires_at: within 900 seconds
-```
-
-It must not contain a token.
-
-Verify:
-
-```yaml
-secret_file_mode: "0600"
-metadata_contains_raw_token: false
-token_hash_unique_across_configured_secret_refs: true
-```
-
-## 8. Negative tests
-
-Before the valid request:
-
-1. No Authorization header must return HTTP 401.
-2. A random wrong bearer must return HTTP 401.
-3. A request with `production_change_authorized=true` must be rejected.
-4. A request with another base OID or branch must be rejected.
-5. The valid overlay must remain `ACTIVE` after pre-auth request-validation
-   failures.
-
-Do not use the global Owner or ChatGPT bearer credential for this endpoint.
-
-## 9. Send the valid request
-
-Use:
-
-```text
-deploy/v2r1c6-task-writer-authorization-request.json
-```
-
-Use the provided client so the bearer is not placed in argv, shell history or
-logs:
-
-```bash
-sudo python3 <staging>/scripts/call_task_identity_overlay.py \
-  --secret-ref <secret_ref_from_issue_result> \
-  --request-json <staging>/deploy/v2r1c6-task-writer-authorization-request.json \
-  --url http://127.0.0.1:19864/api/governance/owner-authorizations \
-  --result-json /var/lib/aios-gitops/v2r1c6-overlay-provision-result.json
-```
-
-Required result:
-
-```yaml
-http_status: 200
-status: READY_FOR_CODE_AUTHORING
-owner_authorization_consumed: true
-grant_consumed: true
-identity_overlay_consumed: true
-identity_overlay_secret_removed: true
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-branch_oid: 875d41c3101093149414292067fd700dc214d4d3
-```
-
-The result must not include:
-
- bearer token;
- private key;
- signer secret;
- raw signature;
- credential value.
-
-## 10. Independent acceptance
-
-Verify the branch:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git \
-  rev-parse refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-It must equal:
-
-```text
-875d41c3101093149414292067fd700dc214d4d3
-```
-
-Verify worktree evidence returned by the provisioner:
-
-```yaml
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-head_oid: 875d41c3101093149414292067fd700dc214d4d3
-detached_head: false
-worktree_clean: true
-writer_status: active
-writes_enabled: true
-allowed_routes:
-  - POST /api/commit-file
-allow_main_write: false
-allow_tag_write: false
-allow_baseline_write: false
-allow_force_push: false
-```
-
-Run policy negative tests against the task writer and require explicit policy
-denials for:
-
- main write;
- another branch;
- tag create/update;
- Baseline write;
- force push;
- branch delete.
-
-Network errors, 404, 500 and stopped-service failures do not count as policy
-denials.
-
-## 11. Stop and clean up the overlay
-
-After `READY_FOR_CODE_AUTHORING`:
-
-```bash
-sudo systemctl stop aios-v2r1c6-task-identity-overlay.service
-sudo systemctl disable aios-v2r1c6-task-identity-overlay.service || true
-sudo rm -f /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
-sudo systemctl daemon-reload
-```
-
-Verify:
-
-```yaml
-overlay_listener_stopped: true
-overlay_secret_removed: true
-global_token_registry_unchanged: true
-disabled_owner_record_unchanged: true
-active_chatgpt_bot_record_unchanged: true
-audit_metadata_retained: true
-```
-
-The root-owned staging directory may be retained until the code is committed,
-then removed after checksum-confirmed repository integration.
-
-## 12. Commit the developed code through the task writer
-
-Only after writer acceptance, use `POST /api/commit-file` to commit the
-verified package contents to:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-Commit in reviewable groups:
-
-1. authorized task-writer bridge;
-2. Owner authorization broker;
-3. task identity overlay;
-4. tests, docs, OpenAPI and deployment templates.
-
-Do not include:
-
- package archives;
- runtime tokens;
- `/run` or `/var/lib` state;
- test result files containing host paths;
- secret references containing values;
- generated credentials.
-
-Run the complete 40-test suite from the branch after commits.
-
-## 13. Protected PR
-
-Create a protected PR from:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-to:
-
-```text
-main
-```
-
-The PR must state:
-
- this change closes Owner authorization bootstrap gaps;
- the overlay is localhost-only and one-time;
- the global token registry is not modified;
- no production release is authorized;
- V2R1C5 tag and Baseline remain unchanged.
-
-The Agent must not merge without the repository's normal protected review.
-
-## 14. Required Agent report
-
-```yaml
-STATUS:
-  READY_FOR_CODE_AUTHORING | BLOCKED | FAILED
-
-PACKAGE:
-  zip_sha256:
-  tar_gz_sha256:
-  manifest_entries:
-  manifest_matched:
-
-TESTS:
-  unit_total:
-  unit_passed:
-  smoke_bridge:
-  smoke_broker:
-  smoke_overlay:
-  py_compile:
-
-PRESTART:
-  main_oid:
-  target_branch_previously_absent:
-  V2R1C5_tag_oid:
-  V2R1C5_peeled_target:
-  baseline_unchanged:
-
-OVERLAY:
-  overlay_id:
-  status:
-  secret_ref:
-  secret_file_mode:
-  token_hash_unique:
-  global_registry_used: false
-  listener:
-  expires_at:
-  consumed:
-  secret_removed:
-
-NEGATIVE_TESTS:
-  unauthenticated_401:
-  wrong_token_401:
-  production_capability_denied:
-  wrong_base_denied:
-  wrong_branch_denied:
-
-OWNER_AUTHORIZATION:
-  event_id:
-  reference:
-  consumed:
-
-GRANT:
-  approval_plan_id:
-  grant_id:
-  grant_digest_sha256:
-  signature_valid:
-  consumed:
-
-BRANCH:
-  name:
-  oid:
-  base_oid:
-  ref_exists:
-  worktree_path:
-  worktree_clean:
-
-WRITER:
-  status:
-  writes_enabled:
-  allowed_branch:
-  allowed_base_oid:
-  allowed_routes:
-  main_write_denied:
-  tag_write_denied:
-  baseline_write_denied:
-  force_push_denied:
-
-REPOSITORY_INTEGRATION:
-  commits:
-  tests_after_commit:
-  protected_pr:
-  merged: false
-
-POSTCHECK:
-  main_unchanged:
-  V2R1C5_tag_unchanged:
-  baseline_unchanged:
-  global_token_registry_unchanged:
-  overlay_listener_stopped:
-  overlay_secret_removed:
-
-SECRETS:
-  plaintext_logged: false
-  plaintext_committed: false
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```
-
-## Fail-closed conditions
-
-Return `BLOCKED` and stop on any of:
-
- authoritative main OID drift;
- target branch conflict;
- inability to enumerate active secret references;
- secret hash collision;
- overlay not bound to the exact task/base/branch;
- non-loopback listener;
- raw secret in result or logs;
- Owner Authorization Broker event not created;
- signer/validator/provisioner failure;
- grant not consumed;
- branch OID mismatch;
- writer exposes main/tag/Baseline/force-push permissions;
- V2R1C5 tag or Baseline changes.
-
-Never fall back to the shared `gitops-write-bot.token`, a wildcard credential,
-manual `gitops.tokens` edits or a direct Git ref write.
@@ -0,0 +1,394 @@
+# AIOS V2R1 生产候选报告
+
+- 候选版本：`V2R1C0-candidate`
+- 候选分支：`integration/aios-v2r1-cto-production-candidate-20260720`
+- 报告语言：中文
+- 架构负责人：AIOS V2 CTO
+- 当前状态：代码与文档闭环已完成；精确 Commit 测试、真实 Runtime 联调和预发布验证待执行
+
+## 1. 执行摘要
+
+AIOS V2R1 Candidate 已完成以下核心建设：
+
+- AIOS 唯一控制面；
+- Tenant、Agent、Task、Policy、Approval 和 Audit 权威模型；
+- SQLite WAL 候选持久化与重启恢复；
+- Execution Orchestrator；
+- OpenClaw 签名命令、Adapter、Transport、Health 和 Audit Callback；
+- Hermes tenant/cell/profile 分区、Queue、Worker Lease、Heartbeat 和 Result；
+- Agent Execution Evidence；
+- Web Console；
+- GitOps Status；
+- systemd、Docker、Compose、Healthcheck 和 Rollback；
+- 用户需求、目标架构、迁移策略、模块契约、追踪矩阵、文档治理和 ADR；
+- 文档—代码匹配检查器；
+- 全量验收入口；
+- OpenClaw 预发布部署任务；
+- Codex 架构监督和阻塞处理任务。
+
+本报告不把“代码已提交”误报为“生产已验证”。以下状态仍需由无人值守任务执行并形成证据：
+
+- 精确 Candidate Commit 的自动测试；
+- 真实 OpenClaw Runtime 联调；
+- Hermes 长任务、Worker 崩溃和 Lease Recovery 演练；
+- systemd/Docker 预发布部署；
+- 重启恢复与回滚演练；
+- 本地仓库与 Gitea Candidate OID 一致验证；
+- 身份代理、安全、性能和容量验证；
+- Owner 对合并、Tag 和生产部署的批准。
+
+## 2. 用户需求完成情况
+
+| 需求 | 代码状态 | 测试状态 | 预发布状态 |
+|---|---|---|---|
+| AIOS 唯一控制面 | 已实现 | 已定义 | 待验证 |
+| 复用 OpenClaw/Hermes/Agent Router | 已实现 | 已定义 | 待真实联调 |
+| OpenClaw/Hermes 解耦 | 已实现 | 已定义 | 待旁路冻结验证 |
+| 全面 Web 化 | 候选实现完成 | 冒烟测试待执行 | 待反向代理接入 |
+| 多租户隔离 | 已实现 | Domain 负向测试已定义 | 待全链路安全验证 |
+| 统一任务生命周期 | 已实现 | 已定义 | 待精确 Commit 执行 |
+| 策略与审批 | 已实现 | 部分测试待补强 | 待身份代理验证 |
+| 幂等与并发安全 | 已实现 | 基础测试已定义 | 待压力和并发验证 |
+| 执行证据 | 已实现 | 已定义 | 待外部执行器持续回写 |
+| GitOps 唯一流程 | 已实现并修复 Controller 冲突 | Runtime 部分验证 | 待双目标持续镜像证据 |
+| 持久化与恢复 | 已实现 | 重启恢复测试已定义 | 待预发布演练 |
+| 审计与合规 | 已实现候选 | 部分断言待补强 | 待不可变外部固化 |
+| 密钥安全 | 引用模式已实现 | 基础扫描纳入验收 | 待 Secret Provider 联调 |
+| 部署与回滚 | 资产完成 | 验收脚本已定义 | 待实际演练 |
+| 文档与代码同步 | 已实现门禁 | 待精确 Commit 执行 | 待接入持续验收 |
+
+## 3. 目标架构
+
+```text
+浏览器 / Web Console / Public API
+                 |
+                 v
+          AIOS 唯一控制面
+ Tenant | Agent | Task | Policy | Approval | Audit
+                 |
+                 v
+       Execution Orchestrator / Agent Router
+             /                 \
+            v                   v
+   OpenClaw Adapter       Hermes Boundary
+            |                   |
+            v                   v
+   OpenClaw Runtime       Hermes Workers
+             \                   /
+              v                 v
+       结果回写 + 审计 + 执行证据
+```
+
+权威边界：
+
+- AIOS：租户、身份、Agent、任务、策略、审批、审计和执行证据；
+- Agent Router：调度与路由；
+- OpenClaw：签名命令执行、取消、状态、健康和回调；
+- Hermes：队列、Worker、Lease、Heartbeat 和结果；
+- Web：只调用 AIOS API；
+- GitOps：所有代码、文档、部署和修复变更入口。
+
+## 4. 实现清单
+
+### 4.1 Control Plane
+
+```text
+active-runtime/app/aios_v2/control_plane.py
+active-runtime/app/aios_v2/persistence.py
+active-runtime/app/aios_v2/gateway.py
+active-runtime/app/aios_v2/app.py
+active-runtime/app/aios_v2/orchestrator.py
+active-runtime/app/aios_v2/execution_tracking.py
+active-runtime/app/aios_v2/gitops_status.py
+active-runtime/app/aios_v2/console.py
+```
+
+### 4.2 OpenClaw
+
+```text
+active-runtime/app/aios_openclaw/contract.py
+active-runtime/app/aios_openclaw/adapter.py
+active-runtime/app/aios_openclaw/transport.py
+active-runtime/app/aios_openclaw/health.py
+active-runtime/app/aios_openclaw/callback.py
+```
+
+### 4.3 Hermes
+
+```text
+active-runtime/app/aios_hermes/contract.py
+active-runtime/app/aios_hermes/adapter.py
+active-runtime/app/aios_hermes/worker.py
+```
+
+### 4.4 测试与治理
+
+```text
+tests/aios_v2_candidate/test_candidate_flow.py
+tools/aios_v2_docs_code_check.py
+deploy/aios-v2/acceptance/run-all.sh
+```
+
+### 4.5 部署
+
+```text
+deploy/aios-v2/systemd/aios-v2.service
+deploy/aios-v2/env/aios-v2.env.example
+deploy/aios-v2/docker/Dockerfile
+deploy/aios-v2/docker/compose.yaml
+deploy/aios-v2/healthcheck/check.sh
+deploy/aios-v2/rollback/rollback.sh
+```
+
+### 4.6 文档与任务
+
+```text
+docs/aios-v2/
+tasks/openclaw-production-deploy-task.yaml
+tasks/codex-production-supervisor-task.yaml
+```
+
+## 5. 多租户与安全设计
+
+### 5.1 权威上下文
+
+```text
+tenant_id
+principal_id
+session_id
+trace_id
+task_id
+policy_version
+idempotency_key
+```
+
+### 5.2 OpenClaw
+
+- HMAC-SHA256 规范化签名；
+- 签名绑定 tenant/task/trace/action/payload/idempotency/time；
+- Runtime Result 身份字段必须匹配；
+- Secret 只通过受保护文件或引用解析。
+
+### 5.3 Hermes
+
+- tenant/cell/profile 分区；
+- Worker Lease 与 Heartbeat；
+- revision 乐观并发；
+- Lease 过期自动回到 QUEUED；
+- Worker 完成前停止 Heartbeat，避免 revision 竞态。
+
+### 5.4 Web/API
+
+- 可信代理注入 `X-AIOS-*`；
+- 浏览器不选择租户；
+- CSP、no-store、nosniff、DENY frame、no-referrer；
+- 应用端口不得直接暴露公网。
+
+### 5.5 GitOps
+
+- Controller detached + clean；
+- 禁止 fetch 到已检出本地分支；
+- 所有修改进入分支、Commit、测试和统一审查；
+- 明文 Secret 门禁；
+- 文档变化与代码变化同步门禁。
+
+## 6. 持久化策略
+
+候选版：
+
+- SQLite WAL；
+- `synchronous=FULL`；
+- `BEGIN IMMEDIATE`；
+- 原子 Snapshot；
+- schema version；
+- 状态目录与代码版本分离；
+- Execution Evidence 租户分区原子 JSON。
+
+已知限制：
+
+- 单进程候选优先；
+- 尚无生产 RLS、多实例 HA、PITR 和容量证据；
+- 后续必须通过新 ADR 迁移到生产数据层。
+
+## 7. 测试与验收
+
+### 7.1 文档—代码匹配
+
+```bash
+python3 tools/aios_v2_docs_code_check.py \
+  --base-ref integration/aios-v2r1-cto-production-candidate-20260720
+```
+
+### 7.2 候选测试
+
+```bash
+python3 -m unittest discover \
+  -s tests/aios_v2_candidate \
+  -p 'test_*.py' \
+  -v
+```
+
+覆盖：
+
+- OpenClaw 完整执行；
+- Hermes 完整执行；
+- 跨租户拒绝；
+- SQLite 重启恢复；
+- Execution Evidence。
+
+### 7.3 全量验收
+
+```bash
+bash deploy/aios-v2/acceptance/run-all.sh
+```
+
+可选在线健康检查：
+
+```bash
+AIOS_RUN_LIVE_HEALTHCHECK=1 \
+  bash deploy/aios-v2/acceptance/run-all.sh
+```
+
+### 7.4 健康检查
+
+```bash
+bash deploy/aios-v2/healthcheck/check.sh
+```
+
+检查：
+
+- systemd；
+- HTTP Health；
+- 状态目录；
+- SQLite quick_check；
+- GitOps detached/clean；
+- Evidence 文件。
+
+## 8. 部署方式
+
+### 8.1 systemd
+
+```text
+/etc/aios-v2/aios-v2.env
+/opt/aios/current
+/var/lib/aios-v2
+```
+
+运行用户：`aios`。
+
+安全选项：NoNewPrivileges、ProtectSystem、ProtectHome、PrivateTmp、Capability 限制。
+
+### 8.2 Docker/Compose
+
+- 非 root UID/GID；
+- Read-only root filesystem；
+- Drop all capabilities；
+- 独立 State Volume；
+- HTTP Healthcheck；
+- Secret 文件只读挂载。
+
+## 9. 回滚
+
+```bash
+bash deploy/aios-v2/rollback/rollback.sh <previous-release>
+```
+
+原则：
+
+- 回滚前自动备份状态；
+- 默认只回滚代码；
+- 状态恢复需显式 `AIOS_V2_RESTORE_STATE=1`；
+- 回滚后必须执行健康检查；
+- 目标版本失败时自动恢复 previous release。
+
+## 10. 无人值守任务
+
+### OpenClaw
+
+任务：`tasks/openclaw-production-deploy-task.yaml`
+
+职责：
+
+- 预发布部署；
+- 健康检查；
+- Runtime 联调；
+- 小型部署与 Runtime Bug 修复；
+- 证据回写。
+
+### Codex
+
+任务：`tasks/codex-production-supervisor-task.yaml`
+
+职责：
+
+- 架构监督；
+- 阻塞分析和跨模块修复；
+- 文档、测试和安全审查；
+- 发布建议。
+
+所有修改和阻塞必须进入 Git 和 Execution Evidence，最终统一审视。
+
+## 11. 当前已知风险
+
+| 风险 | 级别 | 当前处理 |
+|---|---|---|
+| 精确 Candidate Commit 尚未执行全部测试 | 高 | OpenClaw 执行，Codex 监督 |
+| 真实 OpenClaw Runtime 尚未联调 | 高 | 预发布任务必须完成 |
+| 候选 SQLite 不支持生产多实例 HA | 高 | Candidate 单实例；后续 ADR 迁移 |
+| 身份代理 Header 防伪尚未环境验证 | 高 | 预发布安全检查 |
+| Web Console 为候选只读 MVP | 中 | 生产前补充 E2E 与安全验证 |
+| 部分策略负向、并发和审计测试待补强 | 中 | Codex 登记 blocker 并补充 |
+| 本地/Gitea 自动双写状态仍需持续证明 | 中 | 验收记录 OID |
+| 性能、容量和 SLO 尚无实测 | 中 | 预发布基准测试 |
+| 外部不可变审计固化尚未实现 | 中 | 生产数据层阶段完成 |
+
+## 12. 发布 Gate
+
+### 允许进入预发布
+
+条件：
+
+- Candidate 分支可见；
+- 文档完整；
+- 任务合同已生成；
+- 部署资产存在；
+- 无明文 Secret。
+
+### 允许进入合并审查
+
+条件：
+
+- 全量验收通过；
+- OpenClaw/Hermes 联调通过；
+- 重启和回滚通过；
+- 严重/高风险 blocker 已解决；
+- Codex 输出正向监督结论；
+- 本地/Gitea OID 一致。
+
+### 允许生产发布
+
+条件：
+
+- Owner 明确批准；
+- Merge 与 Tag 通过受控流程；
+- 生产配置、Secret 和反向代理准备完成；
+- 发布窗口、观察指标、回滚负责人明确。
+
+## 13. 当前结论
+
+**代码和正式中文文档已经达到候选闭环状态，但尚不能宣称生产已验证。**
+
+下一阶段由 OpenClaw 执行预发布部署和低风险 Bug 修复，由 Codex 监督架构、文档、安全、测试和阻塞。所有过程证据统一进入系统，满足 Gate 后再请求 Owner 批准。
+
+## 14. 更新规则
+
+以下变化必须更新本报告：
+
+- Candidate Commit；
+- 测试结果；
+- 部署和回滚结果；
+- Blocker 和风险；
+- OpenClaw/Codex 任务状态；
+- 文档—代码匹配状态；
+- Gitea OID；
+- 发布建议和 Owner 决策。
@@ -0,0 +1,8 @@
+# Changelog
+
+## V2R1C1 - 2.1.0-rc.1
+
+- 固定发布基线为 `fb739f6e8ff9c031d319221ace68dce157694086`。
+- 收口 Hermes 生命周期、Grant 隔离、Dispatch 恢复、运行证据和回滚/前滚验证。
+- Portal Adapter 与 Spark Provisioning 仅保留在 Archive，不属于产品发布图。
+- Future Incubator 保持隔离，不属于 V2R1C1 发布输入。
@@ -1,10 +0,0 @@
-bec7da1adb75bf5feaa63c60ec6d03adf15d7508742a486207033d000f72d4ff  AGENT_DEPLOYMENT_REQUIREMENTS.md
-251b46e51ce09aa2fd843bee48ef24a5608f31d24c599841f086ceb25c1a1715  README.md
-783f68ec4f00a11d43ceed536196bfedccaf6614f6db9805f7b36d24e5fa7bc2  TEST_RESULTS.json
-c4b24b65195077716983acdc8611f705324413a74453858994ba51541957afd4  active-runtime/app/aios_authorized_task_writer_api.py
-8a1935fa098d47ac02ce51bbd9fd5fad7cf9ab9374ea3de5f630679b96681d84  active-runtime/app/authorized_task_writer_provisioning.py
-a05d4e8038fdb866ce17d4fb8a54798a268a1e8d44ff2cbc559069fa6ab2a667  deploy/systemd/aios-gitops-model-api-authorized-writer-bridge.conf.example
-a60dac51802bff67c2cfff61acdeb0a3a05d74a4f6cb47e3f78295ceb5c6acd9  docs/gitops/authorized-task-writer-provisioning.md
-2690f76452bceddda90c728278c600bcebd533db24776e2966423c5a8655e4b5  docs/gitops/openapi-authorized-task-writer-fragment.yaml
-54e2845d2c3c026323ad45515e082d661e3b461feb3bfefedf5adc52db2d7b78  scripts/smoke_authorized_task_writer_provisioning.py
-3cce2b744326fe12b89bcad3cd352c77738950964bf8519e72cb5e9c7a5dfbfc  tests/test_authorized_task_writer_provisioning.py
@@ -1,25 +0,0 @@
-{
-  "git_branch_created": false,
-  "git_commit_created": false,
-  "production_mutation": false,
-  "py_compile": {
-    "files": [
-      "active-runtime/app/authorized_task_writer_provisioning.py",
-      "active-runtime/app/aios_authorized_task_writer_api.py"
-    ],
-    "status": "PASS"
-  },
-  "schema": "aios.authorized-task-writer-bridge-test-report.v1",
-  "secrets_included": false,
-  "smoke": {
-    "command": "python3 scripts/smoke_authorized_task_writer_provisioning.py",
-    "status": "PASS"
-  },
-  "status": "PASS",
-  "unit_tests": {
-    "command": "python3 -m unittest -v tests/test_authorized_task_writer_provisioning.py",
-    "errors": 0,
-    "failures": 0,
-    "total": 9
-  }
-}
@@ -1 +1 @@
-V2R1C6
+V2R1C2
@@ -1,201 +0,0 @@
-"""Fail-closed Agent Pull Runner primitives for AIOS autonomy v1.
-
-The runner owns task discovery and reporting only.  It never accepts shell
-strings: executors receive argv, an allowlisted cwd and an allowlisted env.
-Durable state is intentionally small so restart recovery and duplicate
-suppression can be verified without coupling the runner to one database.
-"""
-from __future__ import annotations
-
-import json
-import os
-import random
-import shutil
-import subprocess
-import tempfile
-import time
-from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol, Sequence
-
-
-class RunnerError(RuntimeError):
-    """Raised when a runner contract would be violated."""
-
-
-@dataclass(frozen=True)
-class RunnerConfig:
-    worker_id: str
-    capabilities: tuple[str, ...] = ()
-    long_poll_seconds: int = 30
-    fallback_seconds: int = 60
-    jitter_seconds: int = 5
-    max_backoff_seconds: int = 300
-    executable_allowlist: tuple[str, ...] = ()
-    working_directory_allowlist: tuple[str, ...] = ()
-    environment_allowlist: tuple[str, ...] = ()
-
-
-@dataclass
-class RunnerState:
-    inflight: dict[str, dict[str, Any]] = field(default_factory=dict)
-    terminal: dict[str, dict[str, Any]] = field(default_factory=dict)
-
-
-class RunnerTransport(Protocol):
-    def register_worker(self, worker_id: str, capabilities: Sequence[str]) -> Mapping[str, Any]: ...
-    def heartbeat(self, worker_id: str) -> Mapping[str, Any]: ...
-    def long_poll(self, worker_id: str, timeout_seconds: int) -> Mapping[str, Any] | None: ...
-    def poll(self, worker_id: str) -> Mapping[str, Any] | None: ...
-    def claim(self, worker_id: str, task: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def renew(self, worker_id: str, task_id: str) -> Mapping[str, Any]: ...
-    def report_progress(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def report_result(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def report_evidence(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-
-
-class JsonStateStore:
-    """Atomic JSON state store for restart recovery."""
-
-    def __init__(self, path: str | os.PathLike[str]) -> None:
-        self.path = Path(path)
-
-    def load(self) -> RunnerState:
-        if not self.path.exists():
-            return RunnerState()
-        value = json.loads(self.path.read_text(encoding="utf-8"))
-        if not isinstance(value, dict):
-            raise RunnerError("runner state must be an object")
-        return RunnerState(
-            inflight=dict(value.get("inflight", {})),
-            terminal=dict(value.get("terminal", {})),
-        )
-
-    def save(self, state: RunnerState) -> None:
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        fd, name = tempfile.mkstemp(prefix=self.path.name + ".", dir=self.path.parent)
-        try:
-            with os.fdopen(fd, "w", encoding="utf-8") as handle:
-                json.dump({"inflight": state.inflight, "terminal": state.terminal}, handle, sort_keys=True)
-                handle.write("\n")
-            os.chmod(name, 0o600)
-            os.replace(name, self.path)
-        finally:
-            if os.path.exists(name):
-                os.unlink(name)
-
-
-class AgentPullRunner:
-    """Pull, claim, execute and report one task at a time."""
-
-    def __init__(
-        self,
-        config: RunnerConfig,
-        transport: RunnerTransport,
-        state_store: JsonStateStore | None = None,
-        *,
-        random_fn: Callable[[], float] = random.random,
-    ) -> None:
-        if not config.worker_id.strip():
-            raise RunnerError("worker_id is required")
-        self.config = config
-        self.transport = transport
-        self.state_store = state_store
-        self.random_fn = random_fn
-        self.state = state_store.load() if state_store else RunnerState()
-
-    def _save(self) -> None:
-        if self.state_store:
-            self.state_store.save(self.state)
-
-    def register(self) -> Mapping[str, Any]:
-        return self.transport.register_worker(self.config.worker_id, self.config.capabilities)
-
-    def heartbeat(self) -> Mapping[str, Any]:
-        return self.transport.heartbeat(self.config.worker_id)
-
-    def discovery_delay(self, failures: int) -> float:
-        failures = max(0, int(failures))
-        base = min(self.config.max_backoff_seconds, self.config.fallback_seconds * (2**failures))
-        jitter = self.random_fn() * max(0, self.config.jitter_seconds)
-        return min(self.config.max_backoff_seconds, base + jitter)
-
-    def discover_once(self) -> Mapping[str, Any] | None:
-        try:
-            task = self.transport.long_poll(self.config.worker_id, self.config.long_poll_seconds)
-        except Exception:
-            task = None
-        if task is None:
-            task = self.transport.poll(self.config.worker_id)
-        if not task:
-            return None
-        task_id = str(task.get("task_id", ""))
-        if not task_id:
-            raise RunnerError("task_id is required")
-        if task_id in self.state.terminal:
-            return {"status": "duplicate_suppressed", "task_id": task_id}
-        claimed = dict(self.transport.claim(self.config.worker_id, task))
-        self.state.inflight[task_id] = claimed
-        self._save()
-        return claimed
-
-    def renew(self, task_id: str) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.renew(self.config.worker_id, task_id)
-
-    def report_progress(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.report_progress(self.config.worker_id, task_id, payload)
-
-    def report_evidence(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.report_evidence(self.config.worker_id, task_id, payload)
-
-    def report_result(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id in self.state.terminal:
-            return {"status": "duplicate_terminal_suppressed", "task_id": task_id}
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        result = dict(self.transport.report_result(self.config.worker_id, task_id, payload))
-        self.state.terminal[task_id] = {"result": result, "reported_at": time.time()}
-        self.state.inflight.pop(task_id, None)
-        self._save()
-        return result
-
-    def recover_after_restart(self) -> list[Mapping[str, Any]]:
-        recovered: list[Mapping[str, Any]] = []
-        for task_id in tuple(self.state.inflight):
-            recovered.append(self.renew(task_id))
-        return recovered
-
-    def validate_execution(self, argv: Sequence[str], cwd: str | os.PathLike[str], env: Mapping[str, str]) -> None:
-        if not argv or any(not isinstance(item, str) or not item for item in argv):
-            raise RunnerError("argv_only_execution_required")
-        if any(ch in argv[0] for ch in (";", "|", "&", "`", "\n")):
-            raise RunnerError("shell_syntax_denied")
-        executable = shutil.which(argv[0])
-        if not executable:
-            raise RunnerError("executable_not_found")
-        if self.config.executable_allowlist and not any(
-            os.path.realpath(executable).startswith(os.path.realpath(prefix).rstrip(os.sep) + os.sep)
-            or os.path.realpath(executable) == os.path.realpath(prefix)
-            for prefix in self.config.executable_allowlist
-        ):
-            raise RunnerError("executable_not_allowlisted")
-        real_cwd = os.path.realpath(os.fspath(cwd))
-        if self.config.working_directory_allowlist and not any(
-            real_cwd == os.path.realpath(prefix)
-            or real_cwd.startswith(os.path.realpath(prefix).rstrip(os.sep) + os.sep)
-            for prefix in self.config.working_directory_allowlist
-        ):
-            raise RunnerError("working_directory_not_allowlisted")
-        if self.config.environment_allowlist and any(key not in self.config.environment_allowlist for key in env):
-            raise RunnerError("environment_key_not_allowlisted")
-
-    def execute_argv(self, argv: Sequence[str], cwd: str | os.PathLike[str], env: Mapping[str, str]) -> Mapping[str, Any]:
-        self.validate_execution(argv, cwd, env)
-        completed = subprocess.run(list(argv), cwd=os.fspath(cwd), env=dict(env), shell=False, text=True, capture_output=True, check=False)
-        return {"returncode": completed.returncode, "stdout": completed.stdout, "stderr": completed.stderr}
@@ -1,36 +0,0 @@
-"""Small operational CLI for the Agent Pull Runner contract."""
-from __future__ import annotations
-
-import argparse
-import json
-
-from agent_pull_runner import AgentPullRunner, RunnerConfig
-
-
-class _NoopTransport:
-    def register_worker(self, worker_id, capabilities): return {"status": "registered", "worker_id": worker_id, "capabilities": list(capabilities)}
-    def heartbeat(self, worker_id): return {"status": "alive", "worker_id": worker_id}
-    def long_poll(self, worker_id, timeout_seconds): return None
-    def poll(self, worker_id): return None
-    def claim(self, worker_id, task): return task
-    def renew(self, worker_id, task_id): return {"status": "renewed", "task_id": task_id}
-    def report_progress(self, worker_id, task_id, payload): return {"status": "progress_recorded", "task_id": task_id}
-    def report_result(self, worker_id, task_id, payload): return {"status": "result_recorded", "task_id": task_id}
-    def report_evidence(self, worker_id, task_id, payload): return {"status": "evidence_recorded", "task_id": task_id}
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description="AIOS Agent Pull Runner")
-    parser.add_argument("--worker-id", default="self-test-worker")
-    parser.add_argument("--self-test", action="store_true")
-    args = parser.parse_args()
-    runner = AgentPullRunner(RunnerConfig(worker_id=args.worker_id, fallback_seconds=60), _NoopTransport())
-    if args.self_test:
-        print(json.dumps({"status": "PASS", "registration": runner.register(), "fallback_seconds": runner.config.fallback_seconds}, sort_keys=True))
-        return 0
-    print(json.dumps({"status": "READY", "worker_id": args.worker_id}, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,73 +0,0 @@
-"""HTTP adapter for Owner-authorized task writer provisioning.
-
-Run this module instead of aios_chatgpt_actions_api.py. All existing routes are
-delegated unchanged; only POST /api/task-writer/provision-authorized is added.
-"""
-from __future__ import annotations
-
-import os
-import urllib.parse
-
-import aios_chatgpt_actions_api as api
-from authorized_task_writer_provisioning import (
-    AuthorizedTaskWriterProvisioner,
-    OwnerContext,
-    ProvisioningError,
-)
-
-
-_original_do_post = api.H.do_POST
-_ENDPOINT = "/api/task-writer/provision-authorized"
-
-
-def _owner_authorization(handler):
-    scope = os.getenv(
-        "AIOS_GITOPS_OWNER_PROVISION_SCOPE", "writer:provision"
-    )
-    auth = handler.need(scope)
-    if not auth:
-        return None
-    if auth.get("role") != "owner":
-        handler.sendj({"error": "OWNER_AUTHORIZATION_REQUIRED"}, 403)
-        return None
-    identity = str(auth.get("account") or "").strip()
-    if not identity:
-        handler.sendj({"error": "OWNER_IDENTITY_REQUIRED"}, 403)
-        return None
-    return auth
-
-
-def _authorized_do_post(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path != _ENDPOINT:
-        return _original_do_post(self)
-    auth = _owner_authorization(self)
-    if not auth:
-        return
-    data = self.body()
-    owner_reference = str(data.get("owner_authorization_reference") or "")
-    try:
-        result = AuthorizedTaskWriterProvisioner().provision(
-            data,
-            OwnerContext(
-                identity=str(auth["account"]),
-                role=str(auth["role"]),
-                authorization_reference=owner_reference,
-            ),
-        )
-        return self.sendj(result)
-    except ProvisioningError as exc:
-        body = {"error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        return self.sendj(body, exc.status)
-    except Exception:
-        # Do not expose tool output, paths containing credentials, or traceback data.
-        return self.sendj({"error": "AUTHORIZED_WRITER_BRIDGE_INTERNAL_ERROR"}, 500)
-
-
-api.H.do_POST = _authorized_do_post
-
-
-if __name__ == "__main__":
-    api.main()
@@ -1,89 +0,0 @@
-"""Governed API facade for branch-bound repair leases.
-
-The facade is transport-neutral so the permanent control plane can expose it
-through its existing authenticated loopback/API seam without creating a second
-Git writer or a global credential registry.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Mapping
-
-from branch_repair_lease import LeaseError, RepairLease, RepairLeaseManager, sanitized_lease_view
-
-
-class BranchRepairLeaseAPI:
-    """Validate operation envelopes and return sanitized lease metadata."""
-
-    def __init__(self, manager: RepairLeaseManager) -> None:
-        self.manager = manager
-
-    @staticmethod
-    def _required(request: Mapping[str, Any], name: str) -> Any:
-        value = request.get(name)
-        if value is None or value == "":
-            raise LeaseError(f"missing required field: {name}")
-        return value
-
-    @staticmethod
-    def _view(lease: RepairLease) -> dict[str, Any]:
-        return {"status": "ok", "lease": sanitized_lease_view(lease)}
-
-    def handle(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        try:
-            operation = self._required(request, "operation")
-            owner = str(self._required(request, "owner_identity"))
-            if operation == "issue":
-                lease = self.manager.issue(
-                    task_id=str(self._required(request, "task_id")),
-                    owner_identity=owner,
-                    branch=str(self._required(request, "branch")),
-                    description=str(self._required(request, "description")),
-                    allowed_paths=tuple(self._required(request, "allowed_paths")),
-                    ttl_seconds=int(request.get("ttl_seconds", 3600)),
-                )
-            elif operation == "attach_existing_branch":
-                lease = self.manager.attach_existing_branch(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                )
-            elif operation == "authorize_commit":
-                lease = self.manager.authorize_commit(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                    paths=tuple(self._required(request, "paths")),
-                    content=request.get("content"),
-                )
-            elif operation == "record_commit":
-                lease = self.manager.record_commit(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                    new_head_oid=str(self._required(request, "new_head_oid")),
-                    paths=tuple(self._required(request, "paths")),
-                )
-            elif operation == "recover":
-                lease = self.manager.recover(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            elif operation == "renew":
-                lease = self.manager.renew(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    ttl_seconds=int(self._required(request, "ttl_seconds")),
-                )
-            elif operation == "complete":
-                lease = self.manager.complete(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            elif operation == "revoke":
-                lease = self.manager.revoke(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            else:
-                raise LeaseError("unsupported lease operation")
-            return self._view(lease)
-        except (LeaseError, TypeError, ValueError):
-            return {"status": "blocked", "error": "lease_request_rejected"}
@@ -1,48 +0,0 @@
-"""Root-only CLI for the branch-bound repair lease API."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import sys
-from pathlib import Path
-
-from aios_branch_repair_lease_api import BranchRepairLeaseAPI
-from branch_repair_lease import GitProbe, LeaseStore
-from branch_repair_lease import RepairLeaseManager
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description="AIOS branch repair lease CLI")
-    parser.add_argument("--store", required=True)
-    parser.add_argument("--bare-repo", required=True)
-    parser.add_argument("--request-file")
-    parser.add_argument("--request-json")
-    args = parser.parse_args()
-    if hasattr(os, "geteuid") and os.geteuid() != 0:
-        print(json.dumps({"status": "blocked", "error": "root_required"}))
-        return 2
-    if bool(args.request_file) == bool(args.request_json):
-        print(json.dumps({"status": "blocked", "error": "one_request_source_required"}))
-        return 2
-    try:
-        raw = (
-            Path(args.request_file).read_text(encoding="utf-8")
-            if args.request_file
-            else str(args.request_json)
-        )
-        request = json.loads(raw)
-        if not isinstance(request, dict):
-            raise ValueError("request must be an object")
-        api = BranchRepairLeaseAPI(RepairLeaseManager(LeaseStore(args.store), GitProbe(args.bare_repo)))
-        response = api.handle(request)
-        print(json.dumps(response, ensure_ascii=True, sort_keys=True, separators=(",", ":")))
-        return 0 if response.get("status") == "ok" else 1
-    except Exception:
-        print(json.dumps({"status": "blocked", "error": "lease_cli_failed"}))
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,69 +0,0 @@
-"""CLI client for the governed local writer service."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import socket
-import sys
-
-
-def _parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="Send one governed-local-writer request")
-    parser.add_argument("--socket", required=True, help="AF_UNIX socket path")
-    group = parser.add_mutually_exclusive_group(required=True)
-    group.add_argument("--request", help="Request JSON string")
-    group.add_argument("--request-file", help="Path to JSON request file")
-    return parser.parse_args()
-
-
-def _load_request_text(args: argparse.Namespace) -> str:
-    if args.request is not None:
-        return args.request
-    request_path = os.fspath(args.request_file)
-    with open(request_path, "r", encoding="utf-8") as request_file:
-        return request_file.read()
-
-
-def send_request(socket_path: str, request_text: str) -> dict[str, object]:
-    """Open one Unix socket, send one NDJSON request, and parse one NDJSON response."""
-    payload = json.loads(request_text)
-    if not isinstance(payload, dict):
-        raise ValueError("request must be a JSON object")
-
-    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
-        client.connect(socket_path)
-        client.sendall((json.dumps(payload) + "\n").encode("utf-8"))
-        response_chunks: list[str] = []
-        while True:
-            chunk = client.recv(1024 * 1024).decode("utf-8")
-            if not chunk:
-                break
-            response_chunks.append(chunk)
-            if "\n" in chunk:
-                break
-        response_text = "".join(response_chunks)
-
-    response_line = response_text.split("\n", 1)[0].strip()
-    if not response_line:
-        raise RuntimeError("empty response")
-    response = json.loads(response_line)
-    if not isinstance(response, dict):
-        raise RuntimeError("invalid response")
-    return response
-
-
-def main() -> None:
-    args = _parse_args()
-    request_text = _load_request_text(args)
-    response = send_request(args.socket, request_text)
-    print(json.dumps(response, separators=(",", ":"), sort_keys=True))
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except Exception as exc:  # pragma: no cover - CLI entrypoint behavior
-        print(json.dumps({"status": "error", "error": str(exc)}), file=sys.stderr)
-        raise SystemExit(1)
@@ -1,931 +0,0 @@
-"""Unix-socket service for governed local writer operations."""
-
-from __future__ import annotations
-
-import json
-import hashlib
-import argparse
-import importlib.util
-import os
-import re
-import socket
-import subprocess
-import sys
-import tempfile
-import uuid
-from dataclasses import dataclass, field
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol
-
-from governed_local_writer import (
-    AppendCommitRequest,
-    AuthorizationError,
-    BranchPolicy,
-    CreateBranchRequest,
-    GovernedAuthorization,
-    PeerIdentity,
-    PRINCIPAL,
-    TASK_ID,
-    extract_peer_identity,
-    contains_secret_like_content,
-    load_authorization_file,
-    validate_file_changes,
-)
-
-
-class ExistingGitOpsHandler:
-    """Delegate repository mutations to the installed GitOps handler seam."""
-
-    def __init__(
-        self,
-        *,
-        workspace_by_branch: Mapping[str, str | os.PathLike[str]],
-        bare_repo: str | os.PathLike[str],
-        api_source: str | os.PathLike[str],
-    ) -> None:
-        self.workspace_by_branch = {str(k): Path(v) for k, v in workspace_by_branch.items()}
-        self.bare_repo = Path(bare_repo)
-        self.api_source = Path(api_source)
-
-    @staticmethod
-    def _restore_env(previous: Mapping[str, str | None]) -> None:
-        for key, value in previous.items():
-            if value is None:
-                os.environ.pop(key, None)
-            else:
-                os.environ[key] = value
-
-    def _load_api(self, workspace: Path):
-        if not self.api_source.is_file() or self.api_source.is_symlink():
-            raise RuntimeError("installed GitOps handler source is unavailable")
-        keys = (
-            "AIOS_GITOPS_WORKSPACE",
-            "AIOS_GITOPS_BARE_REPO",
-            "AIOS_GITOPS_WRITES_ENABLED",
-            "PYTHONDONTWRITEBYTECODE",
-            "GIT_CONFIG_COUNT",
-            "GIT_CONFIG_KEY_0",
-            "GIT_CONFIG_VALUE_0",
-            "GIT_CONFIG_KEY_1",
-            "GIT_CONFIG_VALUE_1",
-        )
-        previous = {key: os.environ.get(key) for key in keys}
-        os.environ.update(
-            {
-                "AIOS_GITOPS_WORKSPACE": str(workspace),
-                "AIOS_GITOPS_BARE_REPO": str(self.bare_repo),
-                "AIOS_GITOPS_WRITES_ENABLED": "true",
-                "PYTHONDONTWRITEBYTECODE": "1",
-                "GIT_CONFIG_COUNT": "2",
-                "GIT_CONFIG_KEY_0": "safe.directory",
-                "GIT_CONFIG_VALUE_0": str(workspace),
-                "GIT_CONFIG_KEY_1": "safe.directory",
-                "GIT_CONFIG_VALUE_1": str(self.bare_repo),
-            }
-        )
-        module_name = f"_governed_gitops_api_{uuid.uuid4().hex}"
-        try:
-            spec = importlib.util.spec_from_file_location(module_name, self.api_source)
-            if spec is None or spec.loader is None:
-                raise RuntimeError("unable to load installed GitOps handler")
-            module = importlib.util.module_from_spec(spec)
-            sys.modules[module_name] = module
-            spec.loader.exec_module(module)
-            decision = module.evaluate_git_write(module.WS)
-            if not decision.allowed:
-                raise RuntimeError("existing GitOps write gate denied bootstrap")
-            return module, previous, module_name
-        except Exception:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-            raise
-
-    def _workspace(self, branch: str) -> Path:
-        workspace = self.workspace_by_branch.get(branch)
-        if workspace is None or not workspace.is_dir():
-            raise RuntimeError("branch workspace is not authorized")
-        return workspace
-
-    @staticmethod
-    def _git(workspace: Path, args: list[str]) -> str:
-        result = subprocess.run(
-            ["git", *args], cwd=workspace, text=True, capture_output=True, check=False
-        )
-        if result.returncode != 0:
-            raise RuntimeError("governed handler git probe failed")
-        return result.stdout.strip()
-
-    def create_branch(self, request: CreateBranchRequest) -> Mapping[str, object]:
-        workspace = self._workspace(request.branch)
-        # A prior handler call may have completed the fast-forward sync before
-        # the process observed a post-commit error. Reconcile only an exact,
-        # metadata-only result; never overwrite or move an existing ref here.
-        try:
-            existing = self._git(
-                workspace,
-                [
-                    "--git-dir",
-                    str(self.bare_repo),
-                    "rev-parse",
-                    f"refs/heads/{request.branch}",
-                ],
-            )
-        except RuntimeError:
-            existing = ""
-        if existing:
-            parent = self._git(workspace, ["--git-dir", str(self.bare_repo), "rev-parse", f"{existing}^1"])
-            changed = self._git(
-                workspace,
-                [
-                    "--git-dir",
-                    str(self.bare_repo),
-                    "diff-tree",
-                    "--no-commit-id",
-                    "--name-only",
-                    "-r",
-                    existing,
-                ],
-            ).splitlines()
-            safe_branch = re.sub(r"[^A-Za-z0-9_.-]+", "-", request.branch).strip("-")
-            if parent != request.base_oid or changed != [f"patches/{safe_branch}.branch.json"]:
-                raise RuntimeError("existing branch is not an exact metadata-only bootstrap")
-            return {"head_oid": existing, "parent_oid": parent, "handler_status": "reconciled"}
-        module, previous, module_name = self._load_api(workspace)
-        phase = "loaded"
-        try:
-            phase = "verify_base"
-            parent = self._git(
-                workspace,
-                ["--git-dir", str(self.bare_repo), "rev-parse", "refs/heads/main"],
-            )
-            if parent != request.base_oid:
-                raise RuntimeError("authorized base OID drift")
-            phase = "checkout"
-            module.checkout(request.branch, base=request.base_oid, create=True)
-            phase = "write_metadata"
-            safe_branch = re.sub(r"[^A-Za-z0-9_.-]+", "-", request.branch).strip("-")
-            metadata_path = f"patches/{safe_branch}.branch.json"
-            module.write_json(
-                metadata_path,
-                {
-                    "schema": "aios.governed-local-writer-bootstrap.v1",
-                    "task_id": TASK_ID,
-                    "principal": PRINCIPAL,
-                    "branch": request.branch,
-                    "parent_oid": request.base_oid,
-                    "authorization_sha256": request.authorization_digest,
-                },
-            )
-            phase = "commit_and_sync"
-            result = module.commit(
-                [metadata_path], "chore(governance): bootstrap repair lease branch"
-            )
-            head_oid = self._git(workspace, ["rev-parse", "HEAD"])
-            first_parent = self._git(workspace, ["rev-parse", "HEAD^1"])
-            if first_parent != request.base_oid or (request.head_oid and head_oid != request.head_oid):
-                raise RuntimeError("bootstrap branch lineage check failed")
-            return {
-                "head_oid": head_oid,
-                "parent_oid": first_parent,
-                "handler_status": str(result.get("status")),
-            }
-        except Exception as exc:
-            raise RuntimeError(f"handler_phase={phase};error={exc.__class__.__name__}") from exc
-        finally:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-
-    def append_commit(self, request: AppendCommitRequest) -> Mapping[str, object]:
-        workspace = self._workspace(request.branch)
-        module, previous, module_name = self._load_api(workspace)
-        phase = "loaded"
-        try:
-            phase = "verify_head"
-            current = self._git(workspace, ["rev-parse", "HEAD"])
-            if current != request.expected_head_oid:
-                raise RuntimeError("branch head advanced or is stale")
-            phase = "checkout"
-            module.checkout(request.branch, base=request.expected_head_oid, create=False)
-            phase = "write_files"
-            paths: list[str] = []
-            for change in request.changes:
-                paths.append(module.write_file(change.path, change.content))
-            phase = "commit_and_sync"
-            result = module.commit(paths, request.commit_message)
-            head_oid = self._git(workspace, ["rev-parse", "HEAD"])
-            first_parent = self._git(workspace, ["rev-parse", "HEAD^1"])
-            if first_parent != request.expected_head_oid or head_oid == first_parent:
-                raise RuntimeError("append commit lineage check failed")
-            return {
-                "head_oid": head_oid,
-                "parent_oid": first_parent,
-                "handler_status": str(result.get("status")),
-            }
-        except Exception as exc:
-            raise RuntimeError(f"handler_phase={phase};error={exc.__class__.__name__}") from exc
-        finally:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-
-
-class GovernedWriterHandler(Protocol):
-    """Small adapter interface for real writer backend handlers."""
-
-    def create_branch(self, request: CreateBranchRequest) -> Mapping[str, object]:
-        """Create a branch using internal repo services."""
-
-    def append_commit(self, request: AppendCommitRequest) -> Mapping[str, object]:
-        """Append a commit using internal repo services."""
-
-
-class AuditSink(Protocol):
-    """Pluggable sink for sanitized audit records."""
-
-    def append(self, record: "AuditRecord") -> None:
-        """Persist one audit record."""
-
-
-@dataclass
-class AuditRecord:
-    """Sanitized audit log entry."""
-
-    authorization_digest: str
-    peer_pid: int
-    peer_uid: int
-    peer_gid: int
-    peer_executable: str | None
-    timestamp: datetime
-    operation: str
-    branch: str
-    result: str
-
-
-class InMemoryAuditSink:
-    """Simple in-memory audit log used by tests."""
-
-    def __init__(self) -> None:
-        self.records: list[AuditRecord] = []
-
-    def append(self, record: AuditRecord) -> None:
-        self.records.append(record)
-
-
-@dataclass
-class _AuthorizationState:
-    """Tracks one-shot operation consumption."""
-
-    create_done: set[str] = field(default_factory=set)
-    append_done: set[str] = field(default_factory=set)
-    consumed: bool = False
-
-
-class GovernedLocalWriterService:
-    """Policy-aware AF_UNIX service that calls an injected handler."""
-
-    def __init__(
-        self,
-        socket_path: str | os.PathLike[str],
-        authorization: GovernedAuthorization,
-        handler: GovernedWriterHandler,
-        *,
-        audit_sink: AuditSink | None = None,
-        peer_identity_fn: Callable[[socket.socket], PeerIdentity] | None = None,
-        state_path: str | os.PathLike[str] | None = None,
-    ) -> None:
-        self.socket_path = Path(socket_path)
-        self.authorization = authorization
-        self.handler = handler
-        self.peer_identity_fn = peer_identity_fn or extract_peer_identity
-        self.state = _AuthorizationState()
-        self.audit_sink = audit_sink or InMemoryAuditSink()
-        self.state_path = Path(state_path) if state_path is not None else None
-        self._load_state()
-
-    def _load_state(self) -> None:
-        """Restore one-shot state without restoring request or secret material."""
-        if self.state_path is None or not self.state_path.exists():
-            return
-        try:
-            raw = json.loads(self.state_path.read_text(encoding="utf-8"))
-            if not isinstance(raw, dict):
-                raise ValueError("state must be an object")
-            if raw.get("authorization_sha256") != self.authorization.authorization_sha256:
-                raise ValueError("state authorization digest mismatch")
-            self.state.create_done = {str(v) for v in raw.get("create_done", [])}
-            self.state.append_done = {str(v) for v in raw.get("append_done", [])}
-            self.state.consumed = bool(raw.get("consumed", False))
-        except (OSError, ValueError, TypeError, json.JSONDecodeError) as exc:
-            raise AuthorizationError("authorization state is invalid") from exc
-
-    def _persist_state(self) -> None:
-        if self.state_path is None:
-            return
-        self.state_path.parent.mkdir(parents=True, exist_ok=True)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "create_done": sorted(self.state.create_done),
-            "append_done": sorted(self.state.append_done),
-            "consumed": self.state.consumed,
-        }
-        fd, temp_name = tempfile.mkstemp(prefix=".writer-state-", dir=self.state_path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            os.replace(temp_name, self.state_path)
-            os.chmod(self.state_path, 0o600)
-        finally:
-            if os.path.exists(temp_name):
-                os.unlink(temp_name)
-
-    def _new_audit(self, peer: PeerIdentity, operation: str, branch: str, result: str) -> None:
-        self.audit_sink.append(
-            AuditRecord(
-                authorization_digest=self.authorization.authorization_sha256,
-                peer_pid=peer.pid,
-                peer_uid=peer.uid,
-                peer_gid=peer.gid,
-                peer_executable=peer.executable,
-                timestamp=datetime.now(tz=timezone.utc),
-                operation=operation,
-                branch=branch,
-                result=result,
-            )
-        )
-
-    def _require_request_field(self, request: Mapping[str, Any], field_name: str) -> str:
-        value = request.get(field_name)
-        if not isinstance(value, str) or not value:
-            raise AuthorizationError(f"{field_name} must be a non-empty string")
-        return value
-
-    def _branch_policy(self, branch: str) -> BranchPolicy:
-        policy = self.authorization.branch_operations.get(branch)
-        if policy is None:
-            raise AuthorizationError("branch is not authorized")
-        return policy
-
-    def _ensure_not_consumed(self) -> None:
-        if self.state.consumed:
-            raise AuthorizationError("authorization consumed")
-        if datetime.now(tz=timezone.utc) >= self.authorization.expires_at:
-            raise AuthorizationError("authorization expired")
-
-    def _mark_success(self, op: str, branch: str) -> None:
-        if op == "create_branch":
-            self.state.create_done.add(branch)
-        elif op == "append_commit":
-            self.state.append_done.add(branch)
-
-        if self.state.create_done.issuperset(self.authorization.create_branches) and self.state.append_done.issuperset(
-            self.authorization.append_branches
-        ):
-            self.state.consumed = True
-        self._persist_state()
-
-    def _validate_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        task_id = self._require_request_field(request, "task_id")
-        if task_id != TASK_ID:
-            raise AuthorizationError("invalid task_id")
-
-        principal = self._require_request_field(request, "principal")
-        if principal != PRINCIPAL:
-            raise AuthorizationError("invalid principal")
-
-        operation = self._require_request_field(request, "op")
-        if operation not in {"create_branch", "append_commit"}:
-            raise AuthorizationError("unsupported operation")
-        if operation in self.authorization.denied_operations:
-            raise AuthorizationError("operation denied by policy")
-
-        branch = self._require_request_field(request, "branch")
-        self._ensure_not_consumed()
-        policy = self._branch_policy(branch)
-
-        if operation == "create_branch":
-            if policy.create_branch is None:
-                raise AuthorizationError("branch does not allow create_branch")
-            if branch in self.state.create_done:
-                raise AuthorizationError("create_branch already used for this branch")
-
-            base_oid = self._require_request_field(request, "base_oid")
-            raw_head_oid = request.get("head_oid")
-            if raw_head_oid is not None and (not isinstance(raw_head_oid, str) or not raw_head_oid):
-                raise AuthorizationError("head_oid must be a non-empty string when supplied")
-            head_oid = str(raw_head_oid) if raw_head_oid is not None else None
-            if base_oid != policy.create_branch.base_oid:
-                raise AuthorizationError("base_oid mismatch")
-            if policy.create_branch.head_oid is not None and head_oid != policy.create_branch.head_oid:
-                raise AuthorizationError("head_oid mismatch")
-
-            return {
-                "operation": operation,
-                "branch": branch,
-                "base_oid": base_oid,
-                "head_oid": head_oid,
-            }
-
-        if policy.append_commit is None:
-            raise AuthorizationError("branch does not allow append_commit")
-        if policy.create_branch is not None and branch not in self.state.create_done:
-            raise AuthorizationError("append_commit requires prior successful create_branch")
-        if branch in self.state.append_done:
-            raise AuthorizationError("append_commit already used for this branch")
-
-        expected_head = policy.append_commit.expected_head_oid
-        if "expected_head_oid" in request:
-            supplied_head = self._require_request_field(request, "expected_head_oid")
-        elif "current_head_oid" in request:
-            supplied_head = self._require_request_field(request, "current_head_oid")
-        else:
-            raise AuthorizationError("expected_head_oid or current_head_oid required")
-        if not re.fullmatch(r"[0-9a-fA-F]{40}", supplied_head):
-            raise AuthorizationError("head check must be a full commit OID")
-        if expected_head is not None and supplied_head != expected_head:
-            raise AuthorizationError("head check failed")
-
-        if request.get("force") is True or request.get("non_fast_forward") is True:
-            raise AuthorizationError("non-fast-forward operations are not allowed")
-        if request.get("history_rewrite") is True:
-            raise AuthorizationError("history rewrite is not allowed")
-        parent_oids = request.get("parent_oids")
-        if parent_oids is not None:
-            if not isinstance(parent_oids, list) or parent_oids != [supplied_head]:
-                raise AuthorizationError("parent_oids must contain exactly expected_head_oid")
-
-        changes = request.get("changes")
-        if not isinstance(changes, list):
-            raise AuthorizationError("changes must be a list")
-        validated_changes = validate_file_changes(changes, policy.append_commit.allowed_paths)
-        commit_message = request.get("commit_message", "chore(governance): append governed commit")
-        if not isinstance(commit_message, str) or not commit_message.strip() or len(commit_message) > 200:
-            raise AuthorizationError("commit_message must be a short non-empty string")
-        if "\n" in commit_message or "\r" in commit_message or contains_secret_like_content(commit_message):
-            raise AuthorizationError("commit_message failed policy")
-
-        return {
-            "operation": operation,
-            "branch": branch,
-            "expected_head_oid": supplied_head,
-            "changes": validated_changes,
-            "commit_message": commit_message.strip(),
-        }
-
-    def process_request(self, raw_request: Mapping[str, Any], peer: PeerIdentity) -> Mapping[str, Any]:
-        """Run one request through policy checks and handler adapter."""
-        operation = raw_request.get("op") if isinstance(raw_request.get("op"), str) else "unknown"
-        branch = raw_request.get("branch") if isinstance(raw_request.get("branch"), str) else ""
-        try:
-            details = self._validate_request(raw_request)
-            operation = str(details["operation"])
-            branch = str(details["branch"])
-
-            if operation == "create_branch":
-                self.handler.create_branch(
-                    CreateBranchRequest(
-                        branch=branch,
-                        base_oid=str(details["base_oid"]),
-                        head_oid=(
-                            str(details["head_oid"])
-                            if details.get("head_oid") is not None
-                            else None
-                        ),
-                        authorization_digest=self.authorization.authorization_sha256,
-                    )
-                )
-                self._mark_success("create_branch", branch)
-                self._new_audit(peer, operation, branch, "ok")
-                return {
-                    "status": "ok",
-                    "operation": operation,
-                    "branch": branch,
-                    "result": "applied",
-                }
-
-            self.handler.append_commit(
-                AppendCommitRequest(
-                    branch=branch,
-                    expected_head_oid=str(details["expected_head_oid"]),
-                    changes=tuple(details["changes"]),
-                    authorization_digest=self.authorization.authorization_sha256,
-                    commit_message=str(details["commit_message"]),
-                )
-            )
-            self._mark_success("append_commit", branch)
-            self._new_audit(peer, operation, branch, "ok")
-            return {
-                "status": "ok",
-                "operation": operation,
-                "branch": branch,
-                "result": "applied",
-            }
-        except Exception as error:
-            self._new_audit(peer, operation or "unknown", branch, f"error:{error.__class__.__name__}")
-            if isinstance(error, PermissionError):
-                code = "permission_denied"
-            elif isinstance(error, AuthorizationError):
-                code = "request_denied"
-            else:
-                code = "handler_failed"
-            if code == "handler_failed" and str(error).startswith("handler_phase="):
-                code = str(error)
-            return {
-                "status": "error",
-                "operation": operation or "unknown",
-                "branch": branch,
-                "error": code,
-            }
-
-    def _write_json(self, connection: socket.socket, payload: Mapping[str, Any]) -> None:
-        connection.sendall((json.dumps(payload) + "\n").encode("utf-8"))
-
-    def _handle_client(self, connection: socket.socket) -> None:
-        with connection:
-            try:
-                peer = self.peer_identity_fn(connection)
-            except Exception:
-                self._write_json(
-                    connection,
-                    {
-                        "status": "error",
-                        "operation": "connection",
-                        "branch": "",
-                        "error": "peer identity validation failed",
-                    },
-                )
-                return
-
-            with connection.makefile("r", encoding="utf-8") as stream:
-                for raw_line in stream:
-                    line = raw_line.strip()
-                    if not line:
-                        continue
-                    try:
-                        request = json.loads(line)
-                    except json.JSONDecodeError:
-                        self._write_json(
-                            connection,
-                            {
-                                "status": "error",
-                                "operation": "request",
-                                "branch": "",
-                                "error": "invalid json",
-                            },
-                        )
-                        continue
-                    if not isinstance(request, Mapping):
-                        self._write_json(
-                            connection,
-                            {
-                                "status": "error",
-                                "operation": "request",
-                                "branch": "",
-                                "error": "request must be a JSON object",
-                            },
-                        )
-                        continue
-                    self._write_json(connection, self.process_request(request, peer))
-
-    def _bind_socket(self) -> socket.socket:
-        if self.socket_path.exists():
-            raise RuntimeError("governed writer socket already exists")
-        parent = self.socket_path.parent
-        if not parent.is_dir():
-            raise RuntimeError("governed writer socket parent is missing")
-        if parent.is_symlink():
-            raise RuntimeError("governed writer socket parent must not be a symlink")
-        server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        server.bind(str(self.socket_path))
-        os.chmod(self.socket_path, 0o600)
-        server.listen(16)
-        return server
-
-    def serve(self) -> None:
-        """Serve newline-delimited JSON over a filesystem AF_UNIX socket."""
-        server = self._bind_socket()
-        try:
-            while True:
-                connection, _ = server.accept()
-                self._handle_client(connection)
-        finally:
-            server.close()
-            if self.socket_path.exists():
-                self.socket_path.unlink()
-
-
-class JsonAuditSink:
-    """Append-only root-owned audit sink containing no request payloads."""
-
-    def __init__(self, path: str | os.PathLike[str]) -> None:
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-
-    def append(self, record: AuditRecord) -> None:
-        payload = {
-            "authorization_sha256": record.authorization_digest,
-            "peer_pid": record.peer_pid,
-            "peer_uid": record.peer_uid,
-            "peer_gid": record.peer_gid,
-            "peer_executable": record.peer_executable,
-            "timestamp": record.timestamp.isoformat(),
-            "operation": record.operation,
-            "branch": record.branch,
-            "result": record.result,
-        }
-        line = (json.dumps(payload, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
-        fd = os.open(self.path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
-        try:
-            os.fchmod(fd, 0o600)
-            os.write(fd, line)
-        finally:
-            os.close(fd)
-
-
-
-# V2R1C6 durable receipt overlay.  This subclasses the original root-only
-# writer in-place so the existing AF_UNIX/SO_PEERCRED and handler policy remain
-# the only mutation path.
-_LegacyGovernedLocalWriterService = GovernedLocalWriterService
-
-class GovernedLocalWriterService(_LegacyGovernedLocalWriterService):
-    """Existing writer with durable request receipts and safe recovery."""
-
-    def _load_state(self) -> None:
-        super()._load_state()
-        self.state.receipts = {}
-        if self.state_path is None or not self.state_path.exists():
-            return
-        raw = json.loads(self.state_path.read_text(encoding="utf-8"))
-        if not isinstance(raw, dict):
-            raise AuthorizationError("authorization state is invalid")
-        receipts = raw.get("receipts", {})
-        if not isinstance(receipts, dict):
-            raise AuthorizationError("authorization receipts are invalid")
-        self.state.receipts = {
-            str(key): dict(value)
-            for key, value in receipts.items()
-            if isinstance(value, dict)
-        }
-
-    def _persist_state(self) -> None:
-        if self.state_path is None:
-            return
-        self.state_path.parent.mkdir(parents=True, exist_ok=True)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "create_done": sorted(self.state.create_done),
-            "append_done": sorted(self.state.append_done),
-            "consumed": bool(self.state.consumed),
-            "receipts": self.state.receipts,
-        }
-        fd, temp_name = tempfile.mkstemp(prefix=".writer-state-", dir=self.state_path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            os.replace(temp_name, self.state_path)
-            os.chmod(self.state_path, 0o600)
-        finally:
-            if os.path.exists(temp_name):
-                os.unlink(temp_name)
-
-    def _request_identity(self, request: Mapping[str, Any]) -> dict[str, str]:
-        canonical = json.dumps(dict(request), sort_keys=True, separators=(",", ":"), ensure_ascii=True)
-        fallback = hashlib.sha256(canonical.encode("utf-8")).hexdigest()
-        request_id = request.get("request_id")
-        idempotency_key = request.get("idempotency_key")
-        request_id = request_id.strip() if isinstance(request_id, str) and request_id.strip() else "legacy-" + fallback
-        idempotency_key = idempotency_key.strip() if isinstance(idempotency_key, str) and idempotency_key.strip() else "legacy-" + fallback
-        for field_name, value in (("request_id", request_id), ("idempotency_key", idempotency_key)):
-            if len(value) > 200 or "\n" in value or "\r" in value:
-                raise AuthorizationError(field_name + " is invalid")
-        return {
-            "request_id": request_id,
-            "idempotency_key": idempotency_key,
-            "request_fingerprint": fallback,
-        }
-
-    def _find_receipt(self, details: Mapping[str, Any], compare_fingerprint: bool = True):
-        request_id = str(details["request_id"])
-        idempotency_key = str(details["idempotency_key"])
-        fingerprint = str(details.get("request_fingerprint", ""))
-        for receipt in self.state.receipts.values():
-            if receipt.get("request_id") == request_id or receipt.get("idempotency_key") == idempotency_key:
-                if compare_fingerprint and receipt.get("request_fingerprint") != fingerprint:
-                    raise AuthorizationError("idempotency key reused with different request")
-                return receipt
-        return None
-
-    @staticmethod
-    def _receipt_response(receipt: Mapping[str, object], status: str = "receipt") -> dict[str, object]:
-        response = {
-            "status": status,
-            "request_id": receipt.get("request_id"),
-            "idempotency_key": receipt.get("idempotency_key"),
-            "operation": receipt.get("operation"),
-            "branch": receipt.get("branch", ""),
-            "receipt_status": receipt.get("status"),
-        }
-        for field_name in ("commit_oid", "final_head", "parent_oid", "audit_sha256", "error_code", "safe_to_retry"):
-            if field_name in receipt:
-                response[field_name] = receipt[field_name]
-        return response
-
-    def _new_receipt(self, details: Mapping[str, Any]) -> dict[str, object]:
-        return {
-            "request_id": str(details["request_id"]),
-            "idempotency_key": str(details["idempotency_key"]),
-            "request_fingerprint": str(details["request_fingerprint"]),
-            "operation": str(details["operation"]),
-            "branch": str(details.get("branch", "")),
-            "expected_head_oid": str(details.get("expected_head_oid", "")),
-            "status": "accepted",
-            "created_at": datetime.now(tz=timezone.utc).isoformat(),
-            "safe_to_retry": False,
-        }
-
-    def _new_audit(self, peer: PeerIdentity, operation: str, branch: str, result: str) -> str:
-        super()._new_audit(peer, operation, branch, result)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "peer_pid": peer.pid,
-            "peer_uid": peer.uid,
-            "peer_gid": peer.gid,
-            "peer_executable": peer.executable,
-            "operation": operation,
-            "branch": branch,
-            "result": result,
-        }
-        return hashlib.sha256(json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")).hexdigest()
-
-    def _mark_success(self, op: str, branch: str) -> None:
-        if op == "create_branch":
-            self.state.create_done.add(branch)
-        elif op in {"append_commit", "append_files", "append_batch"}:
-            self.state.append_done.add(branch)
-        # The provisioning grant is one-shot; the task writer lease itself must
-        # support multiple append receipts for the exact authorized branches.
-        self.state.consumed = False
-        self._persist_state()
-
-    def _validate_durable(self, raw_request: Mapping[str, Any]) -> dict[str, Any]:
-        operation = self._require_request_field(raw_request, "op")
-        identity = self._request_identity(raw_request)
-        if operation == "query_receipt":
-            return {"operation": operation, **identity}
-        if operation == "recover_request":
-            branch = self._require_request_field(raw_request, "branch")
-            policy = self._branch_policy(branch)
-            if policy.append_commit is None:
-                raise AuthorizationError("branch does not allow recovery")
-            expected = raw_request.get("expected_head_oid") or policy.append_commit.expected_head_oid
-            if not isinstance(expected, str) or not re.fullmatch(r"[0-9a-fA-F]{40}", expected):
-                raise AuthorizationError("recovery requires expected_head_oid")
-            return {"operation": operation, "branch": branch, "expected_head_oid": expected.lower(), **identity}
-        if operation not in {"create_branch", "append_commit", "append_files", "append_batch"}:
-            raise AuthorizationError("unsupported operation")
-        request = dict(raw_request)
-        if operation in {"append_files", "append_batch"}:
-            request["op"] = "append_commit"
-        if operation in {"append_commit", "append_files", "append_batch"}:
-            self.state.consumed = False
-        branch = request.get("branch")
-        removed = False
-        dynamic_expected = False
-        if isinstance(branch, str) and branch in self.state.append_done:
-            self.state.append_done.remove(branch)
-            removed = True
-            policy = self.authorization.branch_operations.get(branch)
-            if policy is not None and policy.append_commit is not None and policy.append_commit.expected_head_oid is not None:
-                from governed_local_writer import BranchAppendPolicy, BranchPolicy
-                self.authorization.branch_operations[branch] = BranchPolicy(create_branch=policy.create_branch, append_commit=BranchAppendPolicy(branch=branch, expected_head_oid=None, allowed_paths=policy.append_commit.allowed_paths))
-                dynamic_expected = True
-        try:
-            details = super()._validate_request(request)
-        finally:
-            if dynamic_expected:
-                policy = self.authorization.branch_operations.get(str(branch))
-                if policy is not None and policy.append_commit is not None:
-                    from governed_local_writer import BranchAppendPolicy, BranchPolicy
-                    self.authorization.branch_operations[str(branch)] = BranchPolicy(create_branch=policy.create_branch, append_commit=BranchAppendPolicy(branch=str(branch), expected_head_oid=str(raw_request.get("expected_head_oid") or ""), allowed_paths=policy.append_commit.allowed_paths))
-            if removed:
-                self.state.append_done.add(str(branch))
-        details.update(identity)
-        details["operation"] = operation
-        return details
-
-    def _recover_backend(self, details: Mapping[str, Any]) -> dict[str, object]:
-        if not hasattr(self.handler, "_workspace") or not hasattr(self.handler, "_git"):
-            raise RuntimeError("recovery backend unavailable")
-        workspace = self.handler._workspace(str(details["branch"]))
-        expected = str(details["expected_head_oid"])
-        current = self.handler._git(workspace, ["rev-parse", "HEAD"])
-        if current == expected:
-            return {"status": "not_started", "final_head": current}
-        parent = self.handler._git(workspace, ["rev-parse", "HEAD^1"])
-        if parent != expected:
-            raise RuntimeError("external branch advance during recovery")
-        return {"status": "applied", "commit_oid": current, "final_head": current, "parent_oid": parent}
-
-    def process_request(self, raw_request: Mapping[str, Any], peer: PeerIdentity) -> Mapping[str, Any]:
-        operation = raw_request.get("op") if isinstance(raw_request.get("op"), str) else "unknown"
-        branch = raw_request.get("branch") if isinstance(raw_request.get("branch"), str) else ""
-        try:
-            details = self._validate_durable(raw_request)
-            operation = str(details["operation"])
-            branch = str(details.get("branch", ""))
-            if operation == "query_receipt":
-                receipt = self._find_receipt(details, compare_fingerprint=False)
-                return self._receipt_response(receipt) if receipt is not None else {"status": "not_found", "request_id": details["request_id"], "idempotency_key": details["idempotency_key"]}
-            if operation == "recover_request":
-                receipt = self._find_receipt(details, compare_fingerprint=False)
-                if receipt is None:
-                    return {"status": "not_found", "request_id": details["request_id"], "idempotency_key": details["idempotency_key"], "safe_to_retry": True}
-                if receipt.get("status") == "applied":
-                    return self._receipt_response(receipt)
-                recovered = self._recover_backend(details)
-                if recovered.get("status") == "applied":
-                    receipt.update({"status": "applied", "commit_oid": recovered.get("commit_oid"), "final_head": recovered.get("final_head"), "parent_oid": recovered.get("parent_oid"), "safe_to_retry": False})
-                    self._mark_success("append_commit", branch)
-                    return self._receipt_response(receipt)
-                receipt["safe_to_retry"] = True
-                self._persist_state()
-                return self._receipt_response(receipt)
-            receipt = self._find_receipt(details)
-            if receipt is not None:
-                return self._receipt_response(receipt)
-            receipt = self._new_receipt(details)
-            self.state.receipts[str(details["request_id"])] = receipt
-            self._persist_state()
-            if operation == "create_branch":
-                result = self.handler.create_branch(CreateBranchRequest(branch=branch, base_oid=str(details["base_oid"]), head_oid=str(details["head_oid"]) if details.get("head_oid") is not None else None, authorization_digest=self.authorization.authorization_sha256))
-                commit_oid = str(result.get("head_oid", ""))
-                parent_oid = str(result.get("parent_oid", ""))
-                audit_sha = self._new_audit(peer, operation, branch, "ok")
-                receipt.update({"status": "applied", "commit_oid": commit_oid, "final_head": commit_oid, "parent_oid": parent_oid, "audit_sha256": audit_sha, "safe_to_retry": False})
-                self._mark_success("create_branch", branch)
-                return self._receipt_response(receipt, status="ok") | {"result": "applied"}
-            result = self.handler.append_commit(AppendCommitRequest(branch=branch, expected_head_oid=str(details["expected_head_oid"]), changes=tuple(details["changes"]), authorization_digest=self.authorization.authorization_sha256, commit_message=str(details["commit_message"])))
-            commit_oid = str(result.get("head_oid", ""))
-            parent_oid = str(result.get("parent_oid", ""))
-            audit_sha = self._new_audit(peer, operation, branch, "ok")
-            receipt.update({"status": "applied", "commit_oid": commit_oid, "final_head": commit_oid, "parent_oid": parent_oid, "audit_sha256": audit_sha, "safe_to_retry": False})
-            self._mark_success("append_commit", branch)
-            return self._receipt_response(receipt, status="ok") | {"result": "applied"}
-        except Exception as error:
-            try:
-                identity = self._request_identity(raw_request)
-                receipt = self.state.receipts.get(identity["request_id"])
-                if receipt is not None and receipt.get("status") == "accepted":
-                    receipt.update({"status": "failed", "error_code": error.__class__.__name__, "safe_to_retry": False})
-                    self._persist_state()
-            except Exception:
-                pass
-            self._new_audit(peer, operation, branch, "error:" + error.__class__.__name__)
-            return {"status": "error", "operation": operation, "branch": branch, "error": "request_denied" if isinstance(error, AuthorizationError) else "handler_failed"}
-
-def _parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="AIOS governed local writer")
-    parser.add_argument("--socket", required=True)
-    parser.add_argument("--authorization", required=True)
-    parser.add_argument("--state", required=True)
-    parser.add_argument("--audit", required=True)
-    parser.add_argument("--repair-branch", required=True)
-    parser.add_argument("--repair-workspace", required=True)
-    parser.add_argument("--candidate-branch", required=True)
-    parser.add_argument("--candidate-workspace", required=True)
-    parser.add_argument("--bare-repo", required=True)
-    parser.add_argument("--api-source", required=True)
-    return parser.parse_args()
-
-
-def main() -> int:
-    if hasattr(os, "geteuid") and os.geteuid() != 0:
-        print("governed local writer requires uid 0", file=sys.stderr)
-        return 2
-    args = _parse_args()
-    authorization = load_authorization_file(args.authorization)
-    handler = ExistingGitOpsHandler(
-        workspace_by_branch={
-            args.repair_branch: args.repair_workspace,
-            args.candidate_branch: args.candidate_workspace,
-        },
-        bare_repo=args.bare_repo,
-        api_source=args.api_source,
-    )
-    service = GovernedLocalWriterService(
-        args.socket,
-        authorization,
-        handler,
-        audit_sink=JsonAuditSink(args.audit),
-        state_path=args.state,
-    )
-    service.serve()
-    return 0
-
-
-if __name__ == "__main__":  # pragma: no cover - systemd entrypoint
-    raise SystemExit(main())
@@ -0,0 +1,27 @@
+"""AIOS-managed Hermes runtime boundary."""
+
+from .adapter import (
+    HermesAdapter,
+    HermesConflict,
+    HermesNotFound,
+    HermesRuntimeError,
+    InMemoryHermesStore,
+    SQLiteHermesStore,
+)
+from .contract import HermesHealth, HermesJob, HermesJobState, HermesResult
+from .worker import HermesWorker, WorkerRunResult
+
+__all__ = [
+    "HermesAdapter",
+    "HermesConflict",
+    "HermesHealth",
+    "HermesJob",
+    "HermesJobState",
+    "HermesNotFound",
+    "HermesResult",
+    "HermesRuntimeError",
+    "HermesWorker",
+    "InMemoryHermesStore",
+    "SQLiteHermesStore",
+    "WorkerRunResult",
+]
@@ -0,0 +1,593 @@
+"""Tenant-partitioned Hermes queue and worker lease boundary."""
+from __future__ import annotations
+
+import hashlib
+import json
+import sqlite3
+import threading
+from dataclasses import asdict, replace
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Iterable, Mapping
+
+from .contract import (
+    ALLOWED_TRANSITIONS,
+    TERMINAL_STATES,
+    HermesHealth,
+    HermesJob,
+    HermesJobState,
+    HermesResult,
+    utc_now,
+)
+
+
+class HermesRuntimeError(RuntimeError):
+    """Base Hermes runtime-boundary failure."""
+
+
+class HermesNotFound(HermesRuntimeError):
+    """A tenant-scoped job was not found."""
+
+
+class HermesConflict(HermesRuntimeError):
+    """A state, lease, idempotency, or revision conflict occurred."""
+
+
+class InMemoryHermesStore:
+    """Thread-safe reference store; production backends implement this contract."""
+
+    def __init__(self) -> None:
+        self.lock = threading.RLock()
+        self.jobs: dict[str, HermesJob] = {}
+        self.results: dict[str, HermesResult] = {}
+        self.idempotency: dict[tuple[str, str], tuple[str, str]] = {}
+        self.worker_heartbeats: dict[str, tuple[str, str | None]] = {}
+
+    def persist_locked(self) -> None:
+        """Persist a mutation while ``lock`` is held; memory stores are a no-op."""
+
+
+class SQLiteHermesStore(InMemoryHermesStore):
+    """Durable snapshot for the existing Hermes queue state machine.
+
+    The adapter remains the sole owner of transitions and lease rules. This
+    store only makes its jobs, results, idempotency keys and worker heartbeats
+    survive a process restart.
+    """
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        super().__init__()
+        with self._connect() as connection:
+            connection.execute(
+                """
+                CREATE TABLE IF NOT EXISTS hermes_state (
+                    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+                    payload TEXT NOT NULL
+                )
+                """
+            )
+        self._load()
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(str(self.path), timeout=30)
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        return connection
+
+    @staticmethod
+    def _record(value: HermesJob | HermesResult) -> dict[str, object]:
+        record = asdict(value)
+        record["state"] = value.state.value
+        return record
+
+    def _load(self) -> None:
+        with self.lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT payload FROM hermes_state WHERE singleton = 1"
+            ).fetchone()
+            if row is None:
+                return
+            payload = json.loads(str(row[0]))
+            self.jobs = {
+                str(item["job_id"]): HermesJob(**item)
+                for item in payload.get("jobs", [])
+            }
+            self.results = {
+                str(item["job_id"]): HermesResult(**item)
+                for item in payload.get("results", [])
+            }
+            self.idempotency = {
+                (str(item["tenant_id"]), str(item["idempotency_key"])): (
+                    str(item["job_id"]),
+                    str(item["digest"]),
+                )
+                for item in payload.get("idempotency", [])
+            }
+            self.worker_heartbeats = {
+                str(item["worker_id"]): (
+                    str(item["heartbeat_at"]),
+                    str(item["job_id"]) if item.get("job_id") is not None else None,
+                )
+                for item in payload.get("worker_heartbeats", [])
+            }
+
+    def persist_locked(self) -> None:
+        payload = {
+            "version": 1,
+            "jobs": [self._record(item) for item in self.jobs.values()],
+            "results": [self._record(item) for item in self.results.values()],
+            "idempotency": [
+                {
+                    "tenant_id": tenant_id,
+                    "idempotency_key": idempotency_key,
+                    "job_id": job_id,
+                    "digest": digest,
+                }
+                for (tenant_id, idempotency_key), (job_id, digest)
+                in self.idempotency.items()
+            ],
+            "worker_heartbeats": [
+                {
+                    "worker_id": worker_id,
+                    "heartbeat_at": heartbeat_at,
+                    "job_id": job_id,
+                }
+                for worker_id, (heartbeat_at, job_id)
+                in self.worker_heartbeats.items()
+            ],
+        }
+        encoded = json.dumps(
+            payload,
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+        )
+        with self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            connection.execute(
+                """
+                INSERT INTO hermes_state(singleton, payload) VALUES(1, ?)
+                ON CONFLICT(singleton) DO UPDATE SET payload=excluded.payload
+                """,
+                (encoded,),
+            )
+            connection.commit()
+
+
+class HermesAdapter:
+    """Queue and reconcile Hermes jobs without owning AIOS policy."""
+
+    def __init__(
+        self,
+        store: InMemoryHermesStore | None = None,
+        *,
+        runtime_id: str = "hermes-runtime",
+        runtime_version: str = "v1",
+        default_lease_seconds: int = 60,
+    ) -> None:
+        if default_lease_seconds < 5:
+            raise ValueError("default_lease_seconds must be >= 5")
+        self.store = store or InMemoryHermesStore()
+        self.runtime_id = runtime_id
+        self.runtime_version = runtime_version
+        self.default_lease_seconds = int(default_lease_seconds)
+
+    @staticmethod
+    def _digest(job: HermesJob) -> str:
+        raw = json.dumps(
+            {
+                "tenant_id": job.tenant_id,
+                "cell_id": job.cell_id,
+                "profile_id": job.profile_id,
+                "task_id": job.task_id,
+                "trace_id": job.trace_id,
+                "action": job.action,
+                "payload": dict(job.payload),
+                "priority": job.priority,
+            },
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+            default=str,
+        ).encode("utf-8")
+        return hashlib.sha256(raw).hexdigest()
+
+    @staticmethod
+    def _parse(value: str | None) -> datetime | None:
+        if value is None:
+            return None
+        normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
+        parsed = datetime.fromisoformat(normalized)
+        if parsed.tzinfo is None:
+            raise ValueError("timestamp must include timezone")
+        return parsed.astimezone(timezone.utc)
+
+    @staticmethod
+    def _format(value: datetime) -> str:
+        return value.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
+
+    @staticmethod
+    def _assert_tenant(job: HermesJob, tenant_id: str) -> None:
+        if job.tenant_id != tenant_id:
+            raise HermesNotFound("job not found")
+
+    def enqueue(self, job: HermesJob) -> HermesJob:
+        if job.state != HermesJobState.QUEUED or job.revision != 1:
+            raise HermesConflict("new job must be QUEUED at revision 1")
+        digest = self._digest(job)
+        idem_ref = (job.tenant_id, job.idempotency_key)
+        with self.store.lock:
+            existing = self.store.jobs.get(job.job_id)
+            if existing is not None:
+                if self._digest(existing) != digest:
+                    raise HermesConflict("job_id reused with different content")
+                return existing
+            prior = self.store.idempotency.get(idem_ref)
+            if prior is not None:
+                prior_id, prior_digest = prior
+                if prior_digest != digest:
+                    raise HermesConflict("idempotency key reused with different content")
+                return self.store.jobs[prior_id]
+            self.store.jobs[job.job_id] = job
+            self.store.idempotency[idem_ref] = (job.job_id, digest)
+            self.store.persist_locked()
+            return job
+
+    def get(self, job_id: str, *, tenant_id: str) -> HermesJob:
+        with self.store.lock:
+            job = self.store.jobs.get(job_id)
+            if job is None:
+                raise HermesNotFound("job not found")
+            self._assert_tenant(job, tenant_id)
+            return job
+
+    def list_jobs(
+        self,
+        *,
+        tenant_id: str,
+        cell_id: str | None = None,
+        profile_id: str | None = None,
+        states: Iterable[HermesJobState | str] | None = None,
+    ) -> list[HermesJob]:
+        state_filter = {HermesJobState(item) for item in states} if states else None
+        with self.store.lock:
+            if self._requeue_expired_locked():
+                self.store.persist_locked()
+            jobs = [
+                job
+                for job in self.store.jobs.values()
+                if job.tenant_id == tenant_id
+                and (cell_id is None or job.cell_id == cell_id)
+                and (profile_id is None or job.profile_id == profile_id)
+                and (state_filter is None or job.state in state_filter)
+            ]
+        return sorted(jobs, key=lambda item: (item.priority, item.created_at, item.job_id))
+
+    def claim(
+        self,
+        *,
+        tenant_id: str,
+        cell_id: str,
+        profile_id: str,
+        worker_id: str,
+        lease_seconds: int | None = None,
+        job_id: str | None = None,
+    ) -> HermesJob | None:
+        worker_id = str(worker_id or "").strip()
+        if not worker_id:
+            raise ValueError("worker_id is required")
+        duration = int(lease_seconds or self.default_lease_seconds)
+        if duration < 5:
+            raise ValueError("lease_seconds must be >= 5")
+        with self.store.lock:
+            self._requeue_expired_locked()
+            candidates = [
+                job
+                for job in self.store.jobs.values()
+                if job.tenant_id == tenant_id
+                and job.cell_id == cell_id
+                and job.profile_id == profile_id
+                and (job_id is None or job.job_id == job_id)
+                and job.state == HermesJobState.QUEUED
+            ]
+            self.store.worker_heartbeats[worker_id] = (utc_now(), None)
+            if not candidates:
+                self.store.persist_locked()
+                return None
+            current = sorted(
+                candidates,
+                key=lambda item: (item.priority, item.created_at, item.job_id),
+            )[0]
+            claimed = self._transition_locked(
+                current,
+                HermesJobState.CLAIMED,
+                assigned_worker_id=worker_id,
+                lease_expires_at=self._format(
+                    datetime.now(timezone.utc) + timedelta(seconds=duration)
+                ),
+            )
+            self.store.worker_heartbeats[worker_id] = (utc_now(), claimed.job_id)
+            self.store.persist_locked()
+            return claimed
+
+    def start(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        worker_id: str,
+        expected_revision: int | None = None,
+    ) -> HermesJob:
+        with self.store.lock:
+            self._requeue_expired_locked()
+            current = self._owned_job_locked(job_id, tenant_id, worker_id)
+            self._assert_revision(current, expected_revision)
+            updated = self._transition_locked(current, HermesJobState.RUNNING)
+            self.store.persist_locked()
+            return updated
+
+    def heartbeat(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        worker_id: str,
+        lease_seconds: int | None = None,
+    ) -> HermesJob:
+        duration = int(lease_seconds or self.default_lease_seconds)
+        if duration < 5:
+            raise ValueError("lease_seconds must be >= 5")
+        with self.store.lock:
+            self._requeue_expired_locked()
+            current = self._owned_job_locked(job_id, tenant_id, worker_id)
+            if current.state not in {HermesJobState.CLAIMED, HermesJobState.RUNNING}:
+                raise HermesConflict("job does not accept heartbeat")
+            updated = replace(
+                current,
+                revision=current.revision + 1,
+                lease_expires_at=self._format(
+                    datetime.now(timezone.utc) + timedelta(seconds=duration)
+                ),
+                updated_at=utc_now(),
+            )
+            self.store.jobs[job_id] = updated
+            self.store.worker_heartbeats[worker_id] = (utc_now(), job_id)
+            self.store.persist_locked()
+            return updated
+
+    def complete(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        worker_id: str,
+        output: Mapping[str, object],
+        expected_revision: int | None = None,
+    ) -> HermesResult:
+        return self._finish(
+            job_id,
+            tenant_id=tenant_id,
+            worker_id=worker_id,
+            state=HermesJobState.COMPLETED,
+            output=output,
+            expected_revision=expected_revision,
+        )
+
+    def fail(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        worker_id: str,
+        error: Mapping[str, object],
+        expected_revision: int | None = None,
+    ) -> HermesResult:
+        return self._finish(
+            job_id,
+            tenant_id=tenant_id,
+            worker_id=worker_id,
+            state=HermesJobState.FAILED,
+            error=error,
+            expected_revision=expected_revision,
+        )
+
+    def cancel(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        expected_revision: int | None = None,
+    ) -> HermesResult:
+        with self.store.lock:
+            current = self.store.jobs.get(job_id)
+            if current is None:
+                raise HermesNotFound("job not found")
+            self._assert_tenant(current, tenant_id)
+            self._assert_revision(current, expected_revision)
+            if current.state in TERMINAL_STATES:
+                result = self.store.results.get(job_id)
+                if result is None:
+                    raise HermesConflict("terminal result missing")
+                if result.state != HermesJobState.CANCELLED:
+                    raise HermesConflict("job already has a different terminal result")
+                return result
+            updated = self._transition_locked(current, HermesJobState.CANCELLED)
+            result = HermesResult(
+                job_id=updated.job_id,
+                tenant_id=updated.tenant_id,
+                task_id=updated.task_id,
+                trace_id=updated.trace_id,
+                state=HermesJobState.CANCELLED,
+                worker_id=updated.assigned_worker_id,
+                error={"code": "cancelled", "message": "cancelled by AIOS"},
+                finished_at=utc_now(),
+            )
+            self.store.results[job_id] = result
+            self.store.persist_locked()
+            return result
+
+    def result(self, job_id: str, *, tenant_id: str) -> HermesResult:
+        with self.store.lock:
+            job = self.store.jobs.get(job_id)
+            if job is None:
+                raise HermesNotFound("job not found")
+            self._assert_tenant(job, tenant_id)
+            result = self.store.results.get(job_id)
+            if result is None:
+                raise HermesConflict("job has no terminal result")
+            return result
+
+    def requeue_expired(self) -> tuple[str, ...]:
+        """Persistently release expired leases without changing policy state."""
+        with self.store.lock:
+            changed = self._requeue_expired_locked()
+            if changed:
+                self.store.persist_locked()
+            return tuple(sorted(changed))
+
+    def health(self) -> HermesHealth:
+        with self.store.lock:
+            if self._requeue_expired_locked():
+                self.store.persist_locked()
+            active_jobs = sum(
+                1 for job in self.store.jobs.values()
+                if job.state in {HermesJobState.CLAIMED, HermesJobState.RUNNING}
+            )
+            queued_jobs = sum(
+                1 for job in self.store.jobs.values()
+                if job.state == HermesJobState.QUEUED
+            )
+            partitions = {
+                (job.tenant_id, job.cell_id, job.profile_id)
+                for job in self.store.jobs.values()
+            }
+            active_workers = sum(
+                1 for heartbeat, _ in self.store.worker_heartbeats.values()
+                if self._parse(heartbeat)
+                and self._parse(heartbeat) >= datetime.now(timezone.utc) - timedelta(seconds=120)
+            )
+        return HermesHealth(
+            runtime_id=self.runtime_id,
+            status="healthy",
+            version=self.runtime_version,
+            heartbeat_at=utc_now(),
+            active_workers=active_workers,
+            active_jobs=active_jobs,
+            queued_jobs=queued_jobs,
+            tenant_partitions=len(partitions),
+            profile_isolation_enforced=True,
+            details={"store": type(self.store).__name__},
+        )
+
+    def _finish(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        worker_id: str,
+        state: HermesJobState,
+        output: Mapping[str, object] | None = None,
+        error: Mapping[str, object] | None = None,
+        expected_revision: int | None,
+    ) -> HermesResult:
+        with self.store.lock:
+            self._requeue_expired_locked()
+            current = self._owned_job_locked(job_id, tenant_id, worker_id)
+            if current.state in TERMINAL_STATES:
+                existing = self.store.results.get(job_id)
+                if existing is None:
+                    raise HermesConflict("terminal result missing")
+                if (
+                    existing.state == state
+                    and existing.worker_id == worker_id
+                    and existing.output == output
+                    and existing.error == error
+                ):
+                    return existing
+                raise HermesConflict("job already has a different terminal result")
+            self._assert_revision(current, expected_revision)
+            updated = self._transition_locked(current, state)
+            result = HermesResult(
+                job_id=updated.job_id,
+                tenant_id=updated.tenant_id,
+                task_id=updated.task_id,
+                trace_id=updated.trace_id,
+                state=state,
+                worker_id=worker_id,
+                output=output,
+                error=error,
+                started_at=current.updated_at,
+                finished_at=utc_now(),
+            )
+            self.store.results[job_id] = result
+            self.store.worker_heartbeats[worker_id] = (utc_now(), None)
+            self.store.persist_locked()
+            return result
+
+    def _owned_job_locked(self, job_id: str, tenant_id: str, worker_id: str) -> HermesJob:
+        current = self.store.jobs.get(job_id)
+        if current is None:
+            raise HermesNotFound("job not found")
+        self._assert_tenant(current, tenant_id)
+        if current.assigned_worker_id != worker_id:
+            raise HermesConflict("worker does not own job lease")
+        return current
+
+    @staticmethod
+    def _assert_revision(job: HermesJob, expected: int | None) -> None:
+        if expected is not None and job.revision != expected:
+            raise HermesConflict("job revision changed")
+
+    def _transition_locked(
+        self,
+        current: HermesJob,
+        target: HermesJobState,
+        *,
+        assigned_worker_id: str | None = None,
+        lease_expires_at: str | None = None,
+    ) -> HermesJob:
+        if target not in ALLOWED_TRANSITIONS[current.state]:
+            raise HermesConflict(
+                f"invalid transition {current.state.value} -> {target.value}"
+            )
+        updated = replace(
+            current,
+            state=target,
+            revision=current.revision + 1,
+            assigned_worker_id=(
+                assigned_worker_id
+                if assigned_worker_id is not None
+                else current.assigned_worker_id
+            ),
+            lease_expires_at=(
+                lease_expires_at
+                if lease_expires_at is not None
+                else (None if target in TERMINAL_STATES else current.lease_expires_at)
+            ),
+            updated_at=utc_now(),
+        )
+        self.store.jobs[current.job_id] = updated
+        return updated
+
+    def _requeue_expired_locked(self) -> set[str]:
+        now = datetime.now(timezone.utc)
+        changed: set[str] = set()
+        for current in list(self.store.jobs.values()):
+            expiry = self._parse(current.lease_expires_at)
+            if (
+                current.state in {HermesJobState.CLAIMED, HermesJobState.RUNNING}
+                and expiry is not None
+                and expiry <= now
+            ):
+                self.store.jobs[current.job_id] = replace(
+                    current,
+                    state=HermesJobState.QUEUED,
+                    revision=current.revision + 1,
+                    assigned_worker_id=None,
+                    lease_expires_at=None,
+                    updated_at=utc_now(),
+                )
+                changed.add(current.job_id)
+        return changed
@@ -0,0 +1,153 @@
+"""Tenant-scoped Hermes runtime contracts."""
+from __future__ import annotations
+
+import json
+import uuid
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from enum import Enum
+from typing import Any, Mapping
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _required(value: str, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+def _safe_mapping(value: Mapping[str, Any] | None) -> dict[str, Any]:
+    return json.loads(json.dumps(dict(value or {}), ensure_ascii=False, sort_keys=True, default=str))
+
+
+class HermesJobState(str, Enum):
+    QUEUED = "QUEUED"
+    CLAIMED = "CLAIMED"
+    RUNNING = "RUNNING"
+    COMPLETED = "COMPLETED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
+
+
+ALLOWED_TRANSITIONS: Mapping[HermesJobState, frozenset[HermesJobState]] = {
+    HermesJobState.QUEUED: frozenset({HermesJobState.CLAIMED, HermesJobState.CANCELLED}),
+    HermesJobState.CLAIMED: frozenset({HermesJobState.RUNNING, HermesJobState.CANCELLED}),
+    HermesJobState.RUNNING: frozenset(
+        {HermesJobState.COMPLETED, HermesJobState.FAILED, HermesJobState.CANCELLED}
+    ),
+    HermesJobState.COMPLETED: frozenset(),
+    HermesJobState.FAILED: frozenset(),
+    HermesJobState.CANCELLED: frozenset(),
+}
+TERMINAL_STATES = frozenset(
+    {HermesJobState.COMPLETED, HermesJobState.FAILED, HermesJobState.CANCELLED}
+)
+
+
+@dataclass(frozen=True)
+class HermesJob:
+    job_id: str
+    tenant_id: str
+    cell_id: str
+    profile_id: str
+    task_id: str
+    trace_id: str
+    action: str
+    payload: Mapping[str, Any] = field(default_factory=dict)
+    idempotency_key: str = ""
+    priority: int = 100
+    state: HermesJobState = HermesJobState.QUEUED
+    revision: int = 1
+    assigned_worker_id: str | None = None
+    lease_expires_at: str | None = None
+    created_at: str = field(default_factory=utc_now)
+    updated_at: str = field(default_factory=utc_now)
+
+    def __post_init__(self) -> None:
+        for name in (
+            "job_id", "tenant_id", "cell_id", "profile_id", "task_id",
+            "trace_id", "action", "idempotency_key", "created_at", "updated_at",
+        ):
+            object.__setattr__(self, name, _required(getattr(self, name), name))
+        object.__setattr__(self, "payload", _safe_mapping(self.payload))
+        object.__setattr__(self, "state", HermesJobState(self.state))
+        if not 0 <= int(self.priority) <= 1000:
+            raise ValueError("priority must be between 0 and 1000")
+        if self.revision < 1:
+            raise ValueError("revision must be >= 1")
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        tenant_id: str,
+        cell_id: str,
+        profile_id: str,
+        task_id: str,
+        trace_id: str,
+        action: str,
+        payload: Mapping[str, Any] | None,
+        idempotency_key: str,
+        priority: int = 100,
+    ) -> "HermesJob":
+        return cls(
+            job_id=f"hermes_{uuid.uuid4().hex}",
+            tenant_id=tenant_id,
+            cell_id=cell_id,
+            profile_id=profile_id,
+            task_id=task_id,
+            trace_id=trace_id,
+            action=action,
+            payload=_safe_mapping(payload),
+            idempotency_key=idempotency_key,
+            priority=priority,
+        )
+
+
+@dataclass(frozen=True)
+class HermesResult:
+    job_id: str
+    tenant_id: str
+    task_id: str
+    trace_id: str
+    state: HermesJobState
+    worker_id: str | None = None
+    output: Mapping[str, Any] | None = None
+    error: Mapping[str, Any] | None = None
+    started_at: str | None = None
+    finished_at: str | None = None
+
+    def __post_init__(self) -> None:
+        for name in ("job_id", "tenant_id", "task_id", "trace_id"):
+            object.__setattr__(self, name, _required(getattr(self, name), name))
+        object.__setattr__(self, "state", HermesJobState(self.state))
+        if self.output is not None:
+            object.__setattr__(self, "output", _safe_mapping(self.output))
+        if self.error is not None:
+            object.__setattr__(self, "error", _safe_mapping(self.error))
+
+
+@dataclass(frozen=True)
+class HermesHealth:
+    runtime_id: str
+    status: str
+    version: str
+    heartbeat_at: str
+    active_workers: int = 0
+    active_jobs: int = 0
+    queued_jobs: int = 0
+    tenant_partitions: int = 0
+    profile_isolation_enforced: bool = True
+    details: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        for name in ("runtime_id", "status", "version", "heartbeat_at"):
+            object.__setattr__(self, name, _required(getattr(self, name), name))
+        for name in ("active_workers", "active_jobs", "queued_jobs", "tenant_partitions"):
+            if int(getattr(self, name)) < 0:
+                raise ValueError(f"{name} must be >= 0")
+        object.__setattr__(self, "details", _safe_mapping(self.details))
@@ -0,0 +1,155 @@
+"""Hermes worker loop with lease renewal and bounded recovery."""
+from __future__ import annotations
+
+import threading
+from dataclasses import dataclass
+from typing import Any, Callable, Mapping
+
+from .adapter import HermesAdapter, HermesConflict
+from .contract import HermesJob, HermesJobState
+
+
+JobHandler = Callable[[HermesJob], Mapping[str, Any]]
+
+
+@dataclass(frozen=True)
+class WorkerRunResult:
+    claimed: bool
+    job_id: str | None = None
+    state: str | None = None
+    error: str | None = None
+
+
+class HermesWorker:
+    """Poll one tenant/cell/profile partition and execute jobs safely."""
+
+    def __init__(
+        self,
+        adapter: HermesAdapter,
+        handler: JobHandler,
+        *,
+        worker_id: str,
+        tenant_id: str,
+        cell_id: str,
+        profile_id: str,
+        poll_seconds: float = 1.0,
+        heartbeat_seconds: float = 10.0,
+    ) -> None:
+        if poll_seconds <= 0 or heartbeat_seconds <= 0:
+            raise ValueError("poll_seconds and heartbeat_seconds must be positive")
+        for name, value in {
+            "worker_id": worker_id,
+            "tenant_id": tenant_id,
+            "cell_id": cell_id,
+            "profile_id": profile_id,
+        }.items():
+            if not str(value or "").strip():
+                raise ValueError(f"{name} is required")
+        self.adapter = adapter
+        self.handler = handler
+        self.worker_id = worker_id
+        self.tenant_id = tenant_id
+        self.cell_id = cell_id
+        self.profile_id = profile_id
+        self.poll_seconds = float(poll_seconds)
+        self.heartbeat_seconds = float(heartbeat_seconds)
+        self._stop = threading.Event()
+
+    def stop(self) -> None:
+        self._stop.set()
+
+    def run_once(self) -> WorkerRunResult:
+        job = self.adapter.claim(
+            tenant_id=self.tenant_id,
+            cell_id=self.cell_id,
+            profile_id=self.profile_id,
+            worker_id=self.worker_id,
+        )
+        if job is None:
+            return WorkerRunResult(claimed=False)
+
+        running = self.adapter.start(
+            job.job_id,
+            tenant_id=self.tenant_id,
+            worker_id=self.worker_id,
+            expected_revision=job.revision,
+        )
+
+        heartbeat_stop = threading.Event()
+        heartbeat_thread = threading.Thread(
+            target=self._heartbeat_loop,
+            args=(running.job_id, heartbeat_stop),
+            name=f"hermes-heartbeat-{self.worker_id}",
+            daemon=True,
+        )
+        heartbeat_thread.start()
+
+        output: Mapping[str, Any] | None = None
+        execution_error: Exception | None = None
+        try:
+            output = dict(self.handler(running))
+        except Exception as exc:  # runtime boundary: normalize below
+            execution_error = exc
+        finally:
+            # Stop the lease heartbeat before reading the final revision. This
+            # prevents a revision increment racing with complete/fail.
+            heartbeat_stop.set()
+            heartbeat_thread.join(timeout=max(self.heartbeat_seconds * 2, 1.0))
+
+        try:
+            current = self.adapter.get(running.job_id, tenant_id=self.tenant_id)
+            if execution_error is None:
+                result = self.adapter.complete(
+                    running.job_id,
+                    tenant_id=self.tenant_id,
+                    worker_id=self.worker_id,
+                    output=dict(output or {}),
+                    expected_revision=current.revision,
+                )
+                return WorkerRunResult(
+                    claimed=True,
+                    job_id=result.job_id,
+                    state=result.state.value,
+                )
+
+            result = self.adapter.fail(
+                running.job_id,
+                tenant_id=self.tenant_id,
+                worker_id=self.worker_id,
+                error={
+                    "code": "worker_error",
+                    "message": str(execution_error),
+                },
+                expected_revision=current.revision,
+            )
+            return WorkerRunResult(
+                claimed=True,
+                job_id=result.job_id,
+                state=result.state.value,
+                error=str(execution_error),
+            )
+        except HermesConflict as exc:
+            return WorkerRunResult(
+                claimed=True,
+                job_id=running.job_id,
+                state=HermesJobState.FAILED.value,
+                error=f"reconciliation_conflict: {exc}",
+            )
+
+    def run_forever(self) -> None:
+        while not self._stop.is_set():
+            result = self.run_once()
+            if not result.claimed:
+                self._stop.wait(self.poll_seconds)
+
+    def _heartbeat_loop(self, job_id: str, stop_event: threading.Event) -> None:
+        while not stop_event.wait(self.heartbeat_seconds):
+            try:
+                self.adapter.heartbeat(
+                    job_id,
+                    tenant_id=self.tenant_id,
+                    worker_id=self.worker_id,
+                )
+            except Exception:
+                stop_event.set()
+                return
@@ -0,0 +1,45 @@
+"""AIOS-managed OpenClaw Ed25519 execution adapter."""
+
+from .adapter import (
+    AdapterError,
+    CommandConflict,
+    CommandNotFound,
+    CommandRejected,
+    InMemoryCallbackSink,
+    OpenClawAdapter,
+)
+from .contract import (
+    CONTRACT_VERSION,
+    SIGNATURE_ALGORITHM,
+    CommandState,
+    Ed25519CommandSigner,
+    Ed25519CommandVerifier,
+    OpenClawCommand,
+    OpenClawResult,
+    RuntimeHealth,
+    sign_command,
+    verify_command_signature,
+)
+from .transport import HTTPRuntimeTransport, InProcessRuntimeTransport, RuntimeTransport
+
+__all__ = [
+    "AdapterError",
+    "CONTRACT_VERSION",
+    "CommandConflict",
+    "CommandNotFound",
+    "CommandRejected",
+    "CommandState",
+    "Ed25519CommandSigner",
+    "Ed25519CommandVerifier",
+    "HTTPRuntimeTransport",
+    "InMemoryCallbackSink",
+    "InProcessRuntimeTransport",
+    "OpenClawAdapter",
+    "OpenClawCommand",
+    "OpenClawResult",
+    "RuntimeHealth",
+    "RuntimeTransport",
+    "SIGNATURE_ALGORITHM",
+    "sign_command",
+    "verify_command_signature",
+]
@@ -0,0 +1,228 @@
+"""Signed, tenant-isolated execution adapter for OpenClaw runtimes."""
+from __future__ import annotations
+
+import threading
+from dataclasses import replace
+from typing import Callable, Mapping, Protocol
+
+from .contract import (
+    CommandState,
+    OpenClawCommand,
+    OpenClawResult,
+    RuntimeHealth,
+    utc_now,
+    verify_command_signature,
+)
+
+
+class AdapterError(RuntimeError):
+    """Base adapter failure."""
+
+
+class CommandRejected(AdapterError):
+    """A command failed signature or contract validation."""
+
+
+class CommandNotFound(AdapterError):
+    """A tenant-scoped command is not visible."""
+
+
+class CommandConflict(AdapterError):
+    """A command or idempotency key conflicts with an existing execution."""
+
+
+class RuntimeTransport(Protocol):
+    def execute(self, command: OpenClawCommand, timeout_seconds: float) -> OpenClawResult: ...
+    def cancel(self, command_id: str) -> bool: ...
+    def health(self) -> RuntimeHealth: ...
+
+
+class CallbackSink(Protocol):
+    def on_started(self, result: OpenClawResult) -> None: ...
+    def on_completed(self, result: OpenClawResult) -> None: ...
+    def on_failed(self, result: OpenClawResult) -> None: ...
+
+
+class InMemoryCallbackSink:
+    def __init__(self) -> None:
+        self._lock = threading.RLock()
+        self.started: list[OpenClawResult] = []
+        self.completed: list[OpenClawResult] = []
+        self.failed: list[OpenClawResult] = []
+
+    def on_started(self, result: OpenClawResult) -> None:
+        with self._lock:
+            self.started.append(result)
+
+    def on_completed(self, result: OpenClawResult) -> None:
+        with self._lock:
+            self.completed.append(result)
+
+    def on_failed(self, result: OpenClawResult) -> None:
+        with self._lock:
+            self.failed.append(result)
+
+
+SigningMaterialResolver = Callable[[str, str], bytes | str]
+
+
+class OpenClawAdapter:
+    """Verify, de-duplicate, execute, cancel and reconcile commands."""
+
+    def __init__(
+        self,
+        transport: RuntimeTransport,
+        signing_material_resolver: SigningMaterialResolver,
+        *,
+        callback_sink: CallbackSink | None = None,
+        default_timeout_seconds: float = 300.0,
+    ) -> None:
+        if default_timeout_seconds <= 0:
+            raise ValueError("default_timeout_seconds must be positive")
+        self.transport = transport
+        self.signing_material_resolver = signing_material_resolver
+        self.callback_sink = callback_sink or InMemoryCallbackSink()
+        self.default_timeout_seconds = float(default_timeout_seconds)
+        self._lock = threading.RLock()
+        self._commands: dict[str, OpenClawCommand] = {}
+        self._results: dict[str, OpenClawResult] = {}
+        self._idempotency: dict[tuple[str, str], tuple[str, str]] = {}
+
+    def _verify(self, command: OpenClawCommand) -> None:
+        try:
+            key_material = self.signing_material_resolver(command.tenant_id, command.key_id)
+        except Exception as exc:
+            raise CommandRejected("signing material unavailable") from exc
+        if not verify_command_signature(command, key_material):
+            raise CommandRejected("invalid or expired command signature")
+
+    @staticmethod
+    def _validate_result(command: OpenClawCommand, result: OpenClawResult) -> None:
+        if (
+            result.command_id != command.command_id
+            or result.tenant_id != command.tenant_id
+            or result.task_id != command.task_id
+            or result.trace_id != command.trace_id
+        ):
+            raise AdapterError("runtime returned mismatched command identity")
+        if result.state not in {
+            CommandState.COMPLETED,
+            CommandState.FAILED,
+            CommandState.CANCELLED,
+            CommandState.TIMED_OUT,
+        }:
+            raise AdapterError("runtime returned a non-terminal result")
+
+    def execute(
+        self,
+        command: OpenClawCommand,
+        *,
+        timeout_seconds: float | None = None,
+    ) -> OpenClawResult:
+        timeout = self.default_timeout_seconds if timeout_seconds is None else float(timeout_seconds)
+        if timeout <= 0:
+            raise ValueError("timeout_seconds must be positive")
+        self._verify(command)
+        digest = command.signature
+        idem_ref = (command.tenant_id, command.idempotency_key)
+
+        with self._lock:
+            prior_command = self._commands.get(command.command_id)
+            if prior_command is not None:
+                if prior_command.signature != command.signature:
+                    raise CommandConflict("command_id reused with different content")
+                return self._results[command.command_id]
+            prior_idem = self._idempotency.get(idem_ref)
+            if prior_idem is not None:
+                prior_id, prior_digest = prior_idem
+                if prior_digest != digest:
+                    raise CommandConflict("idempotency key reused with different content")
+                return self._results[prior_id]
+            running = OpenClawResult(
+                command_id=command.command_id,
+                tenant_id=command.tenant_id,
+                task_id=command.task_id,
+                trace_id=command.trace_id,
+                state=CommandState.RUNNING,
+                started_at=utc_now(),
+            )
+            self._commands[command.command_id] = command
+            self._results[command.command_id] = running
+            self._idempotency[idem_ref] = (command.command_id, digest)
+
+        self.callback_sink.on_started(running)
+        try:
+            result = self.transport.execute(command, timeout)
+            self._validate_result(command, result)
+        except TimeoutError as exc:
+            result = replace(
+                running,
+                state=CommandState.TIMED_OUT,
+                error={"code": "runtime_timeout", "message": str(exc) or "runtime timeout"},
+                finished_at=utc_now(),
+            )
+        except Exception as exc:
+            result = replace(
+                running,
+                state=CommandState.FAILED,
+                error={"code": "runtime_error", "message": str(exc)},
+                finished_at=utc_now(),
+            )
+
+        if result.started_at is None:
+            result = replace(result, started_at=running.started_at)
+        if result.finished_at is None:
+            result = replace(result, finished_at=utc_now())
+        with self._lock:
+            self._results[command.command_id] = result
+        if result.state == CommandState.COMPLETED:
+            self.callback_sink.on_completed(result)
+        else:
+            self.callback_sink.on_failed(result)
+        return result
+
+    def status(self, command_id: str, *, tenant_id: str) -> OpenClawResult:
+        with self._lock:
+            command = self._commands.get(command_id)
+            result = self._results.get(command_id)
+            if command is None or result is None or command.tenant_id != tenant_id:
+                raise CommandNotFound("command not found")
+            return result
+
+    def cancel(self, command_id: str, *, tenant_id: str) -> OpenClawResult:
+        with self._lock:
+            command = self._commands.get(command_id)
+            current = self._results.get(command_id)
+            if command is None or current is None or command.tenant_id != tenant_id:
+                raise CommandNotFound("command not found")
+            if current.state in {
+                CommandState.COMPLETED,
+                CommandState.FAILED,
+                CommandState.CANCELLED,
+                CommandState.TIMED_OUT,
+                CommandState.REJECTED,
+            }:
+                return current
+        if not self.transport.cancel(command_id):
+            raise AdapterError("runtime rejected cancellation")
+        cancelled = replace(
+            current,
+            state=CommandState.CANCELLED,
+            error={"code": "cancelled", "message": "cancelled by AIOS"},
+            finished_at=utc_now(),
+        )
+        with self._lock:
+            self._results[command_id] = cancelled
+        self.callback_sink.on_failed(cancelled)
+        return cancelled
+
+    def health(self) -> RuntimeHealth:
+        return self.transport.health()
+
+    def snapshot(self, *, tenant_id: str) -> Mapping[str, OpenClawResult]:
+        with self._lock:
+            return {
+                command_id: result
+                for command_id, result in self._results.items()
+                if self._commands[command_id].tenant_id == tenant_id
+            }
@@ -0,0 +1,97 @@
+"""Audit-oriented lifecycle callbacks for OpenClaw execution."""
+from __future__ import annotations
+
+import json
+import threading
+from dataclasses import dataclass, field
+from typing import Any, Mapping, Protocol
+
+from .contract import OpenClawResult, utc_now
+
+
+class EventPublisher(Protocol):
+    def publish(self, event: Mapping[str, Any]) -> None: ...
+
+
+@dataclass(frozen=True)
+class ExecutionEvent:
+    event_type: str
+    tenant_id: str
+    task_id: str
+    trace_id: str
+    command_id: str
+    state: str
+    created_at: str = field(default_factory=utc_now)
+    details: Mapping[str, Any] = field(default_factory=dict)
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "event_type": self.event_type,
+            "tenant_id": self.tenant_id,
+            "task_id": self.task_id,
+            "trace_id": self.trace_id,
+            "command_id": self.command_id,
+            "state": self.state,
+            "created_at": self.created_at,
+            "details": json.loads(
+                json.dumps(dict(self.details), ensure_ascii=False, default=str)
+            ),
+        }
+
+
+class InMemoryEventPublisher:
+    """Thread-safe publisher used by tests and first integration slice."""
+
+    def __init__(self) -> None:
+        self._lock = threading.RLock()
+        self.events: list[dict[str, Any]] = []
+
+    def publish(self, event: Mapping[str, Any]) -> None:
+        with self._lock:
+            self.events.append(
+                json.loads(json.dumps(dict(event), ensure_ascii=False, default=str))
+            )
+
+
+class AuditCallbackSink:
+    """Convert runtime callbacks into tenant-scoped audit events."""
+
+    def __init__(self, publisher: EventPublisher) -> None:
+        self.publisher = publisher
+
+    @staticmethod
+    def _event(
+        event_type: str,
+        result: OpenClawResult,
+    ) -> ExecutionEvent:
+        details: dict[str, Any] = {
+            "runtime_id": result.runtime_id,
+            "attempts": result.attempts,
+        }
+        if result.error:
+            details["error"] = dict(result.error)
+        if result.output:
+            details["output_present"] = True
+        return ExecutionEvent(
+            event_type=event_type,
+            tenant_id=result.tenant_id,
+            task_id=result.task_id,
+            trace_id=result.trace_id,
+            command_id=result.command_id,
+            state=result.state.value,
+            details=details,
+        )
+
+    def on_started(self, result: OpenClawResult) -> None:
+        self.publisher.publish(self._event("OPENCLAW_STARTED", result).as_dict())
+
+    def on_completed(self, result: OpenClawResult) -> None:
+        self.publisher.publish(self._event("OPENCLAW_COMPLETED", result).as_dict())
+
+    def on_failed(self, result: OpenClawResult) -> None:
+        event_type = {
+            "CANCELLED": "OPENCLAW_CANCELLED",
+            "TIMED_OUT": "OPENCLAW_TIMED_OUT",
+            "REJECTED": "OPENCLAW_REJECTED",
+        }.get(result.state.value, "OPENCLAW_FAILED")
+        self.publisher.publish(self._event(event_type, result).as_dict())
@@ -0,0 +1,383 @@
+"""AIOS 到 OpenClaw 的 Ed25519 执行合同。"""
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import uuid
+from dataclasses import dataclass, field, replace
+from datetime import datetime, timezone
+from enum import Enum
+from typing import Any, Mapping, Protocol
+
+CONTRACT_VERSION = "aios.openclaw.command.v2"
+SIGNATURE_ALGORITHM = "Ed25519"
+DEFAULT_CLOCK_SKEW_SECONDS = 300
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _parse_timestamp(value: str) -> datetime:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError("timestamp is required")
+    if normalized.endswith("Z"):
+        normalized = normalized[:-1] + "+00:00"
+    parsed = datetime.fromisoformat(normalized)
+    if parsed.tzinfo is None:
+        raise ValueError("timestamp must include a timezone")
+    return parsed.astimezone(timezone.utc)
+
+
+def _required(value: str, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+def _safe_mapping(value: Mapping[str, Any] | None) -> dict[str, Any]:
+    return json.loads(
+        json.dumps(dict(value or {}), ensure_ascii=False, sort_keys=True, default=str)
+    )
+
+
+def _load_crypto() -> tuple[Any, Any, Any]:
+    try:
+        from cryptography.hazmat.primitives import serialization
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+            Ed25519PrivateKey,
+            Ed25519PublicKey,
+        )
+    except ImportError as exc:  # pragma: no cover
+        raise RuntimeError("cryptography with Ed25519 support is required") from exc
+    return serialization, Ed25519PrivateKey, Ed25519PublicKey
+
+
+class CommandSigner(Protocol):
+    key_id: str
+    fingerprint: str
+
+    def sign(self, payload: bytes) -> bytes: ...
+
+
+class CommandVerifier(Protocol):
+    key_id: str
+    fingerprint: str
+
+    def verify(self, payload: bytes, signature: bytes) -> bool: ...
+
+
+class Ed25519CommandSigner:
+    def __init__(self, private_key: Any, *, key_id: str) -> None:
+        serialization, private_cls, _ = _load_crypto()
+        if not isinstance(private_key, private_cls):
+            raise ValueError("private key is not Ed25519")
+        self.private_key = private_key
+        self.key_id = _required(key_id, "key_id")
+        raw = private_key.public_key().public_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PublicFormat.Raw,
+        )
+        self.fingerprint = hashlib.sha256(raw).hexdigest()
+
+    @classmethod
+    def from_bytes(cls, value: bytes | str, *, key_id: str) -> "Ed25519CommandSigner":
+        serialization, private_cls, _ = _load_crypto()
+        raw = value.encode("utf-8") if isinstance(value, str) else bytes(value)
+        if raw.startswith(b"-----BEGIN"):
+            key = serialization.load_pem_private_key(raw, password=None)
+        elif len(raw) == 32:
+            key = private_cls.from_private_bytes(raw)
+        else:
+            raise ValueError("Ed25519 private key must be PEM or a raw 32-byte seed")
+        return cls(key, key_id=key_id)
+
+    def sign(self, payload: bytes) -> bytes:
+        return self.private_key.sign(bytes(payload))
+
+    def verifier(self) -> "Ed25519CommandVerifier":
+        return Ed25519CommandVerifier(self.private_key.public_key(), key_id=self.key_id)
+
+
+class Ed25519CommandVerifier:
+    def __init__(self, public_key: Any, *, key_id: str) -> None:
+        serialization, _, public_cls = _load_crypto()
+        if not isinstance(public_key, public_cls):
+            raise ValueError("public key is not Ed25519")
+        self.public_key = public_key
+        self.key_id = _required(key_id, "key_id")
+        raw = public_key.public_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PublicFormat.Raw,
+        )
+        self.fingerprint = hashlib.sha256(raw).hexdigest()
+
+    @classmethod
+    def from_bytes(cls, value: bytes | str, *, key_id: str) -> "Ed25519CommandVerifier":
+        serialization, private_cls, public_cls = _load_crypto()
+        raw = value.encode("utf-8") if isinstance(value, str) else bytes(value)
+        if raw.startswith(b"-----BEGIN"):
+            try:
+                key = serialization.load_pem_public_key(raw)
+            except ValueError:
+                private = serialization.load_pem_private_key(raw, password=None)
+                if not isinstance(private, private_cls):
+                    raise ValueError("key is not Ed25519")
+                key = private.public_key()
+        elif len(raw) == 32:
+            key = public_cls.from_public_bytes(raw)
+        else:
+            raise ValueError("Ed25519 public key must be PEM or raw 32-byte key")
+        return cls(key, key_id=key_id)
+
+    def verify(self, payload: bytes, signature: bytes) -> bool:
+        try:
+            self.public_key.verify(bytes(signature), bytes(payload))
+            return True
+        except Exception:
+            return False
+
+
+class CommandState(str, Enum):
+    ACCEPTED = "ACCEPTED"
+    RUNNING = "RUNNING"
+    COMPLETED = "COMPLETED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
+    TIMED_OUT = "TIMED_OUT"
+    REJECTED = "REJECTED"
+
+
+@dataclass(frozen=True)
+class OpenClawCommand:
+    command_id: str
+    tenant_id: str
+    task_id: str
+    trace_id: str
+    action: str
+    payload: Mapping[str, Any] = field(default_factory=dict)
+    idempotency_key: str = ""
+    created_at: str = field(default_factory=utc_now)
+    expires_at: str | None = None
+    contract_version: str = CONTRACT_VERSION
+    signature_algorithm: str = SIGNATURE_ALGORITHM
+    key_id: str = "default"
+    public_key_fingerprint: str = ""
+    signature: str = ""
+
+    def __post_init__(self) -> None:
+        for field_name in (
+            "command_id",
+            "tenant_id",
+            "task_id",
+            "trace_id",
+            "action",
+            "idempotency_key",
+            "created_at",
+            "contract_version",
+            "signature_algorithm",
+            "key_id",
+        ):
+            object.__setattr__(
+                self, field_name, _required(getattr(self, field_name), field_name)
+            )
+        if self.contract_version != CONTRACT_VERSION:
+            raise ValueError(f"unsupported contract_version: {self.contract_version}")
+        if self.signature_algorithm != SIGNATURE_ALGORITHM:
+            raise ValueError(
+                f"unsupported signature_algorithm: {self.signature_algorithm}"
+            )
+        object.__setattr__(self, "payload", _safe_mapping(self.payload))
+        object.__setattr__(
+            self, "public_key_fingerprint", str(self.public_key_fingerprint or "").strip()
+        )
+        object.__setattr__(self, "signature", str(self.signature or "").strip())
+        _parse_timestamp(self.created_at)
+        if self.expires_at is not None:
+            object.__setattr__(self, "expires_at", _required(self.expires_at, "expires_at"))
+            if _parse_timestamp(self.expires_at) <= _parse_timestamp(self.created_at):
+                raise ValueError("expires_at must be later than created_at")
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        tenant_id: str,
+        task_id: str,
+        trace_id: str,
+        action: str,
+        payload: Mapping[str, Any] | None,
+        idempotency_key: str,
+        expires_at: str | None = None,
+        key_id: str = "default",
+        command_id: str | None = None,
+    ) -> "OpenClawCommand":
+        return cls(
+            command_id=command_id or f"cmd_{uuid.uuid4().hex}",
+            tenant_id=tenant_id,
+            task_id=task_id,
+            trace_id=trace_id,
+            action=action,
+            payload=_safe_mapping(payload),
+            idempotency_key=idempotency_key,
+            expires_at=expires_at,
+            key_id=key_id,
+        )
+
+    def unsigned_dict(self) -> dict[str, Any]:
+        return {
+            "command_id": self.command_id,
+            "tenant_id": self.tenant_id,
+            "task_id": self.task_id,
+            "trace_id": self.trace_id,
+            "action": self.action,
+            "payload": _safe_mapping(self.payload),
+            "idempotency_key": self.idempotency_key,
+            "created_at": self.created_at,
+            "expires_at": self.expires_at,
+            "contract_version": self.contract_version,
+            "signature_algorithm": self.signature_algorithm,
+            "key_id": self.key_id,
+            "public_key_fingerprint": self.public_key_fingerprint,
+        }
+
+
+@dataclass(frozen=True)
+class OpenClawResult:
+    command_id: str
+    tenant_id: str
+    task_id: str
+    trace_id: str
+    state: CommandState
+    output: Mapping[str, Any] | None = None
+    error: Mapping[str, Any] | None = None
+    started_at: str | None = None
+    finished_at: str | None = None
+    runtime_id: str | None = None
+    attempts: int = 1
+
+    def __post_init__(self) -> None:
+        for field_name in ("command_id", "tenant_id", "task_id", "trace_id"):
+            object.__setattr__(
+                self, field_name, _required(getattr(self, field_name), field_name)
+            )
+        object.__setattr__(self, "state", CommandState(self.state))
+        if self.output is not None:
+            object.__setattr__(self, "output", _safe_mapping(self.output))
+        if self.error is not None:
+            object.__setattr__(self, "error", _safe_mapping(self.error))
+        if self.started_at is not None:
+            _parse_timestamp(self.started_at)
+        if self.finished_at is not None:
+            _parse_timestamp(self.finished_at)
+        if self.attempts < 1:
+            raise ValueError("attempts must be >= 1")
+
+
+@dataclass(frozen=True)
+class RuntimeHealth:
+    runtime: str
+    runtime_id: str
+    status: str
+    version: str
+    heartbeat_at: str
+    active_tasks: int = 0
+    workspace_isolated: bool = False
+    credential_ref_configured: bool = False
+    details: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        for field_name in (
+            "runtime",
+            "runtime_id",
+            "status",
+            "version",
+            "heartbeat_at",
+        ):
+            object.__setattr__(
+                self, field_name, _required(getattr(self, field_name), field_name)
+            )
+        _parse_timestamp(self.heartbeat_at)
+        if self.active_tasks < 0:
+            raise ValueError("active_tasks must be >= 0")
+        object.__setattr__(self, "details", _safe_mapping(self.details))
+
+
+def canonical_command_bytes(command: OpenClawCommand) -> bytes:
+    return json.dumps(
+        command.unsigned_dict(),
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+    ).encode("utf-8")
+
+
+def _as_signer(command: OpenClawCommand, value: Any) -> CommandSigner:
+    if hasattr(value, "sign") and hasattr(value, "fingerprint") and hasattr(value, "key_id"):
+        return value
+    return Ed25519CommandSigner.from_bytes(value, key_id=command.key_id)
+
+
+def _as_verifier(command: OpenClawCommand, value: Any) -> CommandVerifier:
+    if isinstance(value, Ed25519CommandSigner):
+        return value.verifier()
+    if hasattr(value, "verify") and hasattr(value, "fingerprint") and hasattr(value, "key_id"):
+        return value
+    return Ed25519CommandVerifier.from_bytes(value, key_id=command.key_id)
+
+
+def sign_command(command: OpenClawCommand, signing_key: Any) -> OpenClawCommand:
+    signer = _as_signer(command, signing_key)
+    if signer.key_id != command.key_id:
+        raise ValueError("command key_id does not match signer")
+    prepared = replace(
+        command,
+        signature_algorithm=SIGNATURE_ALGORITHM,
+        public_key_fingerprint=signer.fingerprint,
+        signature="",
+    )
+    signature = base64.b64encode(
+        signer.sign(canonical_command_bytes(prepared))
+    ).decode("ascii")
+    return replace(prepared, signature=signature)
+
+
+def verify_command_signature(
+    command: OpenClawCommand,
+    verification_key: Any,
+    *,
+    now: datetime | None = None,
+    clock_skew_seconds: int = DEFAULT_CLOCK_SKEW_SECONDS,
+) -> bool:
+    if (
+        not command.signature
+        or command.contract_version != CONTRACT_VERSION
+        or command.signature_algorithm != SIGNATURE_ALGORITHM
+    ):
+        return False
+    try:
+        verifier = _as_verifier(command, verification_key)
+        signature = base64.b64decode(command.signature, validate=True)
+    except Exception:
+        return False
+    if verifier.key_id != command.key_id:
+        return False
+    if not command.public_key_fingerprint or not hmac.compare_digest(
+        command.public_key_fingerprint, verifier.fingerprint
+    ):
+        return False
+    if not verifier.verify(canonical_command_bytes(command), signature):
+        return False
+    current = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+    created = _parse_timestamp(command.created_at)
+    if created.timestamp() - current.timestamp() > clock_skew_seconds:
+        return False
+    if command.expires_at is not None:
+        expires = _parse_timestamp(command.expires_at)
+        if current.timestamp() - expires.timestamp() > clock_skew_seconds:
+            return False
+    return True
@@ -0,0 +1,103 @@
+"""Health policy and self-healing decisions for OpenClaw runtimes."""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Mapping
+
+from .contract import RuntimeHealth
+
+
+def _parse(value: str) -> datetime:
+    normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
+    parsed = datetime.fromisoformat(normalized)
+    if parsed.tzinfo is None:
+        raise ValueError("heartbeat timestamp must include timezone")
+    return parsed.astimezone(timezone.utc)
+
+
+@dataclass(frozen=True)
+class HealthPolicy:
+    max_heartbeat_age_seconds: int = 90
+    require_workspace_isolation: bool = True
+    require_credential_ref: bool = True
+    accepted_statuses: frozenset[str] = field(
+        default_factory=lambda: frozenset({"healthy", "ready"})
+    )
+
+    def __post_init__(self) -> None:
+        if self.max_heartbeat_age_seconds < 5:
+            raise ValueError("max_heartbeat_age_seconds must be >= 5")
+        if not self.accepted_statuses:
+            raise ValueError("accepted_statuses must not be empty")
+
+
+@dataclass(frozen=True)
+class HealthAssessment:
+    healthy: bool
+    reasons: tuple[str, ...]
+    recoverable: bool
+    recommended_action: str
+    details: Mapping[str, object] = field(default_factory=dict)
+
+
+class RuntimeHealthMonitor:
+    """Evaluate runtime health and recommend bounded recovery actions."""
+
+    def __init__(self, policy: HealthPolicy | None = None) -> None:
+        self.policy = policy or HealthPolicy()
+
+    def assess(
+        self,
+        health: RuntimeHealth,
+        *,
+        now: datetime | None = None,
+    ) -> HealthAssessment:
+        current = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+        heartbeat = _parse(health.heartbeat_at)
+        age = max(0.0, current.timestamp() - heartbeat.timestamp())
+        reasons: list[str] = []
+
+        if health.status.lower() not in self.policy.accepted_statuses:
+            reasons.append("runtime_status_unhealthy")
+        if age > self.policy.max_heartbeat_age_seconds:
+            reasons.append("heartbeat_stale")
+        if self.policy.require_workspace_isolation and not health.workspace_isolated:
+            reasons.append("workspace_not_isolated")
+        if self.policy.require_credential_ref and not health.credential_ref_configured:
+            reasons.append("credential_reference_missing")
+
+        if not reasons:
+            return HealthAssessment(
+                healthy=True,
+                reasons=(),
+                recoverable=True,
+                recommended_action="none",
+                details={"heartbeat_age_seconds": age},
+            )
+
+        non_recoverable = {
+            "workspace_not_isolated",
+            "credential_reference_missing",
+        }.intersection(reasons)
+        if non_recoverable:
+            action = "quarantine_runtime"
+            recoverable = False
+        elif "heartbeat_stale" in reasons:
+            action = "restart_runtime"
+            recoverable = True
+        else:
+            action = "drain_and_restart"
+            recoverable = True
+
+        return HealthAssessment(
+            healthy=False,
+            reasons=tuple(reasons),
+            recoverable=recoverable,
+            recommended_action=action,
+            details={
+                "heartbeat_age_seconds": age,
+                "runtime_id": health.runtime_id,
+                "active_tasks": health.active_tasks,
+            },
+        )
@@ -0,0 +1,214 @@
+"""Runtime transport implementations for the OpenClaw adapter."""
+from __future__ import annotations
+
+import json
+import threading
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any, Callable, Mapping, Protocol
+
+from .contract import (
+    CommandState,
+    OpenClawCommand,
+    OpenClawResult,
+    RuntimeHealth,
+    utc_now,
+)
+
+
+class RuntimeTransport(Protocol):
+    def execute(self, command: OpenClawCommand, timeout_seconds: float) -> OpenClawResult: ...
+    def cancel(self, command_id: str) -> bool: ...
+    def health(self) -> RuntimeHealth: ...
+
+
+class TransportError(RuntimeError):
+    """Runtime transport or protocol failure."""
+
+
+RuntimeHandler = Callable[[OpenClawCommand], Mapping[str, Any] | OpenClawResult]
+
+
+class InProcessRuntimeTransport:
+    """Deterministic runtime used by tests and controlled local integrations."""
+
+    def __init__(
+        self,
+        handler: RuntimeHandler,
+        *,
+        runtime_id: str = "openclaw-in-process",
+        version: str = "v1",
+        workspace_isolated: bool = True,
+        credential_ref_configured: bool = True,
+    ) -> None:
+        self.handler = handler
+        self.runtime_id = runtime_id
+        self.version = version
+        self.workspace_isolated = workspace_isolated
+        self.credential_ref_configured = credential_ref_configured
+        self._lock = threading.RLock()
+        self._running: set[str] = set()
+        self._cancelled: set[str] = set()
+
+    def execute(self, command: OpenClawCommand, timeout_seconds: float) -> OpenClawResult:
+        if timeout_seconds <= 0:
+            raise ValueError("timeout_seconds must be positive")
+        with self._lock:
+            if command.command_id in self._cancelled:
+                return OpenClawResult(
+                    command_id=command.command_id,
+                    tenant_id=command.tenant_id,
+                    task_id=command.task_id,
+                    trace_id=command.trace_id,
+                    state=CommandState.CANCELLED,
+                    error={"code": "cancelled", "message": "cancelled before execution"},
+                    finished_at=utc_now(),
+                    runtime_id=self.runtime_id,
+                )
+            self._running.add(command.command_id)
+        try:
+            raw = self.handler(command)
+            if isinstance(raw, OpenClawResult):
+                return raw
+            if not isinstance(raw, Mapping):
+                raise TransportError("runtime handler must return a mapping or OpenClawResult")
+            return OpenClawResult(
+                command_id=command.command_id,
+                tenant_id=command.tenant_id,
+                task_id=command.task_id,
+                trace_id=command.trace_id,
+                state=CommandState(str(raw.get("state", "COMPLETED"))),
+                output=raw.get("output"),
+                error=raw.get("error"),
+                started_at=str(raw.get("started_at") or utc_now()),
+                finished_at=str(raw.get("finished_at") or utc_now()),
+                runtime_id=str(raw.get("runtime_id") or self.runtime_id),
+                attempts=int(raw.get("attempts", 1)),
+            )
+        finally:
+            with self._lock:
+                self._running.discard(command.command_id)
+
+    def cancel(self, command_id: str) -> bool:
+        with self._lock:
+            self._cancelled.add(command_id)
+            return command_id in self._running
+
+    def health(self) -> RuntimeHealth:
+        with self._lock:
+            active = len(self._running)
+        return RuntimeHealth(
+            runtime="openclaw",
+            runtime_id=self.runtime_id,
+            status="healthy",
+            version=self.version,
+            heartbeat_at=utc_now(),
+            active_tasks=active,
+            workspace_isolated=self.workspace_isolated,
+            credential_ref_configured=self.credential_ref_configured,
+            details={"transport": "in_process"},
+        )
+
+
+class HTTPRuntimeTransport:
+    """Private HTTP transport for an OpenClaw runtime service."""
+
+    def __init__(
+        self,
+        base_url: str,
+        *,
+        runtime_id: str = "openclaw-http",
+        credential_ref: str | None = None,
+        max_response_bytes: int = 2_097_152,
+    ) -> None:
+        normalized = str(base_url).rstrip("/")
+        if not normalized.startswith(("http://", "https://")):
+            raise ValueError("base_url must use http or https")
+        self.base_url = normalized
+        self.runtime_id = runtime_id
+        self.credential_ref = credential_ref
+        self.max_response_bytes = int(max_response_bytes)
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        *,
+        payload: Mapping[str, Any] | None,
+        timeout_seconds: float,
+    ) -> Mapping[str, Any]:
+        body = None
+        headers = {"Accept": "application/json", "User-Agent": "AIOS-OpenClaw/1"}
+        if payload is not None:
+            body = json.dumps(dict(payload), separators=(",", ":")).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        if self.credential_ref:
+            headers["X-AIOS-Credential-Ref"] = self.credential_ref
+        request = urllib.request.Request(
+            f"{self.base_url}{path}",
+            data=body,
+            method=method,
+            headers=headers,
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=timeout_seconds) as response:
+                raw = response.read(self.max_response_bytes + 1)
+        except urllib.error.HTTPError as exc:
+            raise TransportError(f"runtime returned HTTP {exc.code}") from exc
+        except urllib.error.URLError as exc:
+            raise TransportError(f"runtime unavailable: {exc.reason}") from exc
+        if len(raw) > self.max_response_bytes:
+            raise TransportError("runtime response exceeded size limit")
+        decoded = json.loads(raw.decode("utf-8"))
+        if not isinstance(decoded, Mapping):
+            raise TransportError("runtime response must be a JSON object")
+        return decoded
+
+    @staticmethod
+    def _command_payload(command: OpenClawCommand) -> dict[str, Any]:
+        return {**command.unsigned_dict(), "signature": command.signature}
+
+    def execute(self, command: OpenClawCommand, timeout_seconds: float) -> OpenClawResult:
+        value = self._request(
+            "POST",
+            "/v1/execute",
+            payload=self._command_payload(command),
+            timeout_seconds=timeout_seconds,
+        )
+        return OpenClawResult(
+            command_id=str(value["command_id"]),
+            tenant_id=str(value["tenant_id"]),
+            task_id=str(value["task_id"]),
+            trace_id=str(value["trace_id"]),
+            state=CommandState(str(value["state"])),
+            output=value.get("output"),
+            error=value.get("error"),
+            started_at=value.get("started_at"),
+            finished_at=value.get("finished_at"),
+            runtime_id=str(value.get("runtime_id") or self.runtime_id),
+            attempts=int(value.get("attempts", 1)),
+        )
+
+    def cancel(self, command_id: str) -> bool:
+        value = self._request(
+            "POST",
+            f"/v1/commands/{urllib.parse.quote(command_id, safe='')}/cancel",
+            payload={},
+            timeout_seconds=10.0,
+        )
+        return bool(value.get("accepted"))
+
+    def health(self) -> RuntimeHealth:
+        value = self._request("GET", "/v1/health", payload=None, timeout_seconds=5.0)
+        return RuntimeHealth(
+            runtime=str(value.get("runtime") or "openclaw"),
+            runtime_id=str(value.get("runtime_id") or self.runtime_id),
+            status=str(value.get("status") or "unknown"),
+            version=str(value.get("version") or "unknown"),
+            heartbeat_at=str(value.get("heartbeat_at") or utc_now()),
+            active_tasks=int(value.get("active_tasks", 0)),
+            workspace_isolated=bool(value.get("workspace_isolated", False)),
+            credential_ref_configured=bool(value.get("credential_ref_configured", False)),
+            details=value.get("details") if isinstance(value.get("details"), Mapping) else {},
+        )
@@ -1,144 +0,0 @@
-"""HTTP adapter for audited Owner authorization and writer provisioning.
-
-This module layers on top of ``aios_authorized_task_writer_api`` so existing
-routes and the legacy exact ``writer:provision`` route remain available. The
-new endpoint does not mint or modify bearer credentials. It authenticates an
-existing, non-wildcard, explicitly allow-listed Owner credential and then
-invokes the audited broker.
-
-Endpoint:
-    POST /api/governance/owner-authorizations
-"""
-from __future__ import annotations
-
-import os
-import urllib.parse
-from typing import Any, Mapping
-
-import aios_authorized_task_writer_api as bridge_api
-from authorized_task_writer_provisioning import ProvisioningError
-from owner_authorization_broker import (
-    OwnerAuthorizationBroker,
-    OwnerAuthorizationError,
-    OwnerPrincipal,
-)
-
-
-api = bridge_api.api
-_original_do_post = api.H.do_POST
-_ENDPOINT = "/api/governance/owner-authorizations"
-
-
-def _enabled() -> bool:
-    return os.getenv(
-        "AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED", ""
-    ).strip().lower() in {"1", "true", "yes", "on"}
-
-
-def _configured_intake_scope() -> str:
-    scopes = [
-        item.strip()
-        for item in os.getenv(
-            "AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES", ""
-        ).split(",")
-        if item.strip()
-    ]
-    if len(scopes) != 1:
-        raise OwnerAuthorizationError(
-            "EXACTLY_ONE_HTTP_INTAKE_SCOPE_REQUIRED", 503
-        )
-    scope = scopes[0]
-    if scope == "writer:provision" or scope == "*" or scope.endswith(":*"):
-        raise OwnerAuthorizationError("HTTP_INTAKE_SCOPE_REJECTED", 503)
-    return scope
-
-
-def _scope_set(auth: Mapping[str, Any]) -> frozenset[str]:
-    raw = auth.get("scopes")
-    if raw is None:
-        raw = auth.get("scope")
-    if raw is None:
-        return frozenset()
-    if isinstance(raw, str):
-        candidates = raw.replace(",", " ").split()
-    elif isinstance(raw, (list, tuple, set, frozenset)):
-        candidates = [str(item) for item in raw]
-    else:
-        raise OwnerAuthorizationError("OWNER_SCOPE_EVIDENCE_INVALID", 403)
-    return frozenset(item.strip() for item in candidates if item.strip())
-
-
-def _credential_id(auth: Mapping[str, Any]) -> str:
-    for name in (
-        "credential_id",
-        "token_id",
-        "key_id",
-        "auth_id",
-    ):
-        value = str(auth.get(name) or "").strip()
-        if value:
-            return value
-    return ""
-
-
-def _authenticate_existing_owner(handler) -> OwnerPrincipal | None:
-    scope = _configured_intake_scope()
-    auth = handler.need(scope)
-    if not auth:
-        return None
-    if auth.get("role") != "owner":
-        handler.sendj({"error": "OWNER_ROLE_REQUIRED"}, 403)
-        return None
-    identity = str(auth.get("account") or auth.get("identity") or "").strip()
-    if not identity:
-        handler.sendj({"error": "OWNER_IDENTITY_REQUIRED"}, 403)
-        return None
-    scopes = _scope_set(auth)
-    if any(item == "*" or item.endswith(":*") for item in scopes):
-        handler.sendj(
-            {"error": "WILDCARD_OWNER_CREDENTIAL_REJECTED"}, 403
-        )
-        return None
-    return OwnerPrincipal(
-        identity=identity,
-        role="owner",
-        authenticated_scope=scope,
-        token_scopes=scopes,
-        credential_id=_credential_id(auth),
-    )
-
-
-def _broker_do_post(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path != _ENDPOINT:
-        return _original_do_post(self)
-    if not _enabled():
-        return self.sendj(
-            {"error": "OWNER_AUTHORIZATION_BROKER_DISABLED"}, 503
-        )
-    try:
-        principal = _authenticate_existing_owner(self)
-        if principal is None:
-            return
-        data = self.body()
-        result = OwnerAuthorizationBroker().authorize_and_provision(
-            data, principal
-        )
-        return self.sendj(result)
-    except (OwnerAuthorizationError, ProvisioningError) as exc:
-        body = {"error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        return self.sendj(body, exc.status)
-    except Exception:
-        # Never expose registry data, bearer tokens, signer output or traceback.
-        return self.sendj(
-            {"error": "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR"}, 500
-        )
-
-
-api.H.do_POST = _broker_do_post
-
-
-if __name__ == "__main__":
-    api.main()
@@ -1,160 +0,0 @@
-#!/usr/bin/env python3
-"""Loopback-only HTTP API for the task identity overlay.
-
-Endpoints:
-  GET  /healthz
-  POST /api/governance/owner-authorizations
-
-The API authenticates only the short-lived overlay credential. It does not read
-or modify the global bearer-token registry.
-"""
-from __future__ import annotations
-
-import json
-import os
-import urllib.parse
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from typing import Any
-
-from authorized_task_writer_provisioning import ProvisioningError
-from owner_authorization_broker import OwnerAuthorizationError
-from task_identity_overlay import (
-    MAX_BODY_BYTES,
-    IdentityOverlayConfig,
-    IdentityOverlayError,
-    TaskIdentityOverlayService,
-)
-
-
-_ENDPOINT = "/api/governance/owner-authorizations"
-
-
-def _enabled() -> bool:
-    return os.getenv(
-        "AIOS_GITOPS_IDENTITY_OVERLAY_ENABLED", ""
-    ).strip().lower() in {"1", "true", "yes", "on"}
-
-
-def _bearer(header: str) -> str:
-    prefix = "Bearer "
-    if not header.startswith(prefix):
-        raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
-    token = header[len(prefix):].strip()
-    if not token or len(token) > 4096:
-        raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
-    return token
-
-
-class OverlayHandler(BaseHTTPRequestHandler):
-    server_version = "aios-task-identity-overlay/1"
-    sys_version = ""
-
-    @property
-    def overlay(self) -> TaskIdentityOverlayService:
-        return self.server.overlay  # type: ignore[attr-defined]
-
-    def log_message(self, format: str, *args: Any) -> None:
-        # Never log Authorization or request bodies.
-        return
-
-    def _send(self, status: int, value: dict[str, Any]) -> None:
-        payload = (
-            json.dumps(
-                value,
-                ensure_ascii=False,
-                sort_keys=True,
-                separators=(",", ":"),
-            )
-            + "\n"
-        ).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("Content-Length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def _body(self) -> dict[str, Any]:
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-        except ValueError:
-            raise IdentityOverlayError("OVERLAY_CONTENT_LENGTH_INVALID") from None
-        if length <= 0 or length > MAX_BODY_BYTES:
-            raise IdentityOverlayError("OVERLAY_BODY_SIZE_REJECTED", 413)
-        raw = self.rfile.read(length)
-        try:
-            value = json.loads(raw)
-        except (UnicodeDecodeError, json.JSONDecodeError):
-            raise IdentityOverlayError("OVERLAY_BODY_JSON_INVALID") from None
-        if not isinstance(value, dict):
-            raise IdentityOverlayError("OVERLAY_BODY_OBJECT_REQUIRED")
-        return value
-
-    def do_GET(self) -> None:
-        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-        if path != "/healthz":
-            self._send(404, {"error": "NOT_FOUND"})
-            return
-        self._send(
-            200,
-            {
-                "service": "aios-task-identity-overlay",
-                "status": "active" if _enabled() else "disabled",
-                "global_token_registry_used": False,
-                "loopback_only": True,
-            },
-        )
-
-    def do_POST(self) -> None:
-        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-        if path != _ENDPOINT:
-            self._send(404, {"error": "NOT_FOUND"})
-            return
-        if not _enabled():
-            self._send(503, {"error": "IDENTITY_OVERLAY_DISABLED"})
-            return
-        try:
-            token = _bearer(self.headers.get("Authorization", ""))
-            result = self.overlay.provision(self._body(), token)
-            self._send(200, result)
-        except (IdentityOverlayError, OwnerAuthorizationError, ProvisioningError) as exc:
-            body: dict[str, Any] = {"error": exc.code}
-            if getattr(exc, "details", None):
-                body["details"] = exc.details
-            self._send(exc.status, body)
-        except Exception:
-            self._send(500, {"error": "IDENTITY_OVERLAY_API_INTERNAL_ERROR"})
-
-
-class OverlayServer(ThreadingHTTPServer):
-    allow_reuse_address = True
-
-    def __init__(
-        self,
-        address: tuple[str, int],
-        overlay: TaskIdentityOverlayService,
-    ) -> None:
-        super().__init__(address, OverlayHandler)
-        self.overlay = overlay
-
-
-def main() -> None:
-    host = os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_HOST", "127.0.0.1")
-    if host not in {"127.0.0.1", "::1", "localhost"}:
-        raise SystemExit("identity overlay must listen on loopback")
-    try:
-        port = int(os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_PORT", "19864"))
-    except ValueError:
-        raise SystemExit("invalid overlay port") from None
-    if not 1024 <= port <= 65535:
-        raise SystemExit("invalid overlay port")
-    config = IdentityOverlayConfig.from_environment()
-    server = OverlayServer(
-        (host, port),
-        TaskIdentityOverlayService(config),
-    )
-    server.serve_forever(poll_interval=0.25)
-
-
-if __name__ == "__main__":
-    main()
@@ -1,92 +0,0 @@
-#!/usr/bin/env python3
-"""Root-governed CLI for issuing and revoking task identity overlays.
-
-The CLI never prints the bearer token. It returns only the root-owned secret
-reference and non-secret metadata.
-"""
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import sys
-from pathlib import Path
-
-from task_identity_overlay import (
-    IdentityOverlayConfig,
-    IdentityOverlayError,
-    TaskIdentityOverlayStore,
-)
-
-
-def _write_result(path: str, value: dict) -> None:
-    data = json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n"
-    if path == "-":
-        sys.stdout.write(data)
-        return
-    target = Path(path)
-    target.parent.mkdir(parents=True, exist_ok=True)
-    target.write_text(data, encoding="utf-8")
-    os.chmod(target, 0o600)
-
-
-def parser() -> argparse.ArgumentParser:
-    value = argparse.ArgumentParser(
-        description="Issue/status/revoke a task-scoped identity overlay"
-    )
-    sub = value.add_subparsers(dest="command", required=True)
-
-    issue = sub.add_parser("issue")
-    issue.add_argument("--ttl-seconds", type=int, default=900)
-    issue.add_argument("--authorization-assertion-ref", required=True)
-    issue.add_argument(
-        "--operator-identity",
-        default=os.getenv("SUDO_USER") or os.getenv("USER") or "root",
-    )
-    issue.add_argument("--result-json", default="-")
-
-    status = sub.add_parser("status")
-    status.add_argument("--overlay-id", required=True)
-    status.add_argument("--result-json", default="-")
-
-    revoke = sub.add_parser("revoke")
-    revoke.add_argument("--overlay-id", required=True)
-    revoke.add_argument("--reason", required=True)
-    revoke.add_argument("--result-json", default="-")
-    return value
-
-
-def main() -> int:
-    args = parser().parse_args()
-    try:
-        store = TaskIdentityOverlayStore(
-            IdentityOverlayConfig.from_environment()
-        )
-        if args.command == "issue":
-            result = store.issue(
-                ttl_seconds=args.ttl_seconds,
-                authorization_assertion_ref=args.authorization_assertion_ref,
-                operator_identity=args.operator_identity,
-            )
-        elif args.command == "status":
-            result = store.status(args.overlay_id)
-        else:
-            result = store.revoke(args.overlay_id, reason=args.reason)
-        _write_result(args.result_json, result)
-        return 0
-    except IdentityOverlayError as exc:
-        body = {"status": "BLOCKED", "error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        _write_result(getattr(args, "result_json", "-"), body)
-        return 2
-    except Exception:
-        _write_result(
-            getattr(args, "result_json", "-"),
-            {"status": "FAILED", "error": "IDENTITY_OVERLAY_CLI_INTERNAL_ERROR"},
-        )
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -0,0 +1,110 @@
+"""AIOS V2 控制面、执行编排与可信运行来源证明。"""
+
+from .control_plane import (
+    AgentRecord,
+    AuditEvent,
+    ControlPlaneError,
+    ControlPlaneService,
+    IdempotencyConflict,
+    InMemoryControlPlaneStore,
+    InvalidTransition,
+    NotFound,
+    PolicyDenied,
+    RequestContext,
+    RevisionConflict,
+    TaskRecord,
+    TaskState,
+    TenantIsolationError,
+    TenantRecord,
+    Unauthorized,
+)
+from .execution_tracking import ExecutionEvidence, ExecutionTracker
+from .orchestrator import DispatchRecord, ExecutionOrchestrator, OrchestrationError
+from .provenance import (
+    Ed25519PrivateKeySigner,
+    Ed25519PublicKeyVerifier,
+    ExecutionPath,
+    GitOperation,
+    PRODUCTION_POLICY_VERSION,
+    ProvenanceAuthorization,
+    ProvenanceControlledWriter,
+    ProvenanceDenied,
+    ProvenanceError,
+    ProvenanceExpired,
+    ProvenanceIssuer,
+    ProvenanceNotFound,
+    ProvenanceReplay,
+    ProvenanceRevoked,
+    ProvenanceSignatureError,
+    ProvenanceStatus,
+    ProvenanceVerifier,
+    RunProvenance,
+    SQLiteProvenanceStore,
+    digest_payload,
+)
+from .provenance_git import (
+    GitCommandResult,
+    GitExecutionContext,
+    ProvenanceGitError,
+    ProvenanceGitWriter,
+)
+from .provenance_operations import (
+    OperationContext,
+    OperationReceipt,
+    ProvenanceOperationGate,
+    build_provenance_writer_from_env,
+    context_from_environment,
+)
+
+__all__ = [
+    "AgentRecord",
+    "AuditEvent",
+    "ControlPlaneError",
+    "ControlPlaneService",
+    "DispatchRecord",
+    "Ed25519PrivateKeySigner",
+    "Ed25519PublicKeyVerifier",
+    "ExecutionEvidence",
+    "ExecutionOrchestrator",
+    "ExecutionPath",
+    "ExecutionTracker",
+    "GitCommandResult",
+    "GitExecutionContext",
+    "GitOperation",
+    "IdempotencyConflict",
+    "InMemoryControlPlaneStore",
+    "InvalidTransition",
+    "NotFound",
+    "OperationContext",
+    "OperationReceipt",
+    "OrchestrationError",
+    "PRODUCTION_POLICY_VERSION",
+    "PolicyDenied",
+    "ProvenanceAuthorization",
+    "ProvenanceControlledWriter",
+    "ProvenanceDenied",
+    "ProvenanceError",
+    "ProvenanceExpired",
+    "ProvenanceGitError",
+    "ProvenanceGitWriter",
+    "ProvenanceIssuer",
+    "ProvenanceNotFound",
+    "ProvenanceOperationGate",
+    "ProvenanceReplay",
+    "ProvenanceRevoked",
+    "ProvenanceSignatureError",
+    "ProvenanceStatus",
+    "ProvenanceVerifier",
+    "RequestContext",
+    "RevisionConflict",
+    "RunProvenance",
+    "SQLiteProvenanceStore",
+    "TaskRecord",
+    "TaskState",
+    "TenantIsolationError",
+    "TenantRecord",
+    "Unauthorized",
+    "build_provenance_writer_from_env",
+    "context_from_environment",
+    "digest_payload",
+]
@@ -0,0 +1,807 @@
+"""AIOS V2 production-candidate application entrypoint."""
+from __future__ import annotations
+
+import dataclasses
+import json
+import os
+import stat
+import urllib.parse
+from enum import Enum
+from http import HTTPStatus
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from typing import Any, Mapping
+
+from aios_hermes import HermesAdapter, HermesJobState, HermesResult, SQLiteHermesStore
+from aios_openclaw import (
+    Ed25519CommandSigner,
+    HTTPRuntimeTransport,
+    OpenClawAdapter,
+)
+from aios_openclaw.callback import AuditCallbackSink, EventPublisher
+
+from .console import CONSOLE_HTML
+from .control_plane import AuditEvent, RequestContext, Unauthorized
+from .dispatch_store import SQLiteDispatchRepository
+from .execution_tracking import ExecutionEvidence, ExecutionTracker
+from .gateway import GatewayApplication, error_response
+from .gitops_status import collect_gitops_status
+from .orchestrator import ExecutionOrchestrator
+from .persistence import DurableControlPlaneService, SQLiteSnapshotRepository
+from .provenance_operations import build_provenance_writer_from_env
+
+
+def _json_value(value: Any) -> Any:
+    if dataclasses.is_dataclass(value):
+        return {
+            item.name: _json_value(getattr(value, item.name))
+            for item in dataclasses.fields(value)
+        }
+    if isinstance(value, Enum):
+        return value.value
+    if isinstance(value, Mapping):
+        return {str(key): _json_value(item) for key, item in value.items()}
+    if isinstance(value, (list, tuple, set, frozenset)):
+        return [_json_value(item) for item in value]
+    return value
+
+
+def _enabled(value: str | None) -> bool:
+    return str(value or "").strip().lower() in {"1", "true", "yes", "on"}
+
+
+def _header(headers: Mapping[str, str], name: str) -> str | None:
+    target = name.lower()
+    for key, value in headers.items():
+        if str(key).lower() == target:
+            normalized = str(value or "").strip()
+            return normalized or None
+    return None
+
+
+def _provenance_context(
+    headers: Mapping[str, str],
+    payload: Mapping[str, Any],
+) -> tuple[str | None, str | None]:
+    header_provenance = _header(headers, "X-AIOS-Provenance-ID")
+    header_run = _header(headers, "X-AIOS-Run-ID")
+    body_provenance = str(payload.get("provenance_id") or "").strip() or None
+    body_run = str(payload.get("run_id") or "").strip() or None
+    if header_provenance and body_provenance and header_provenance != body_provenance:
+        raise ValueError("provenance_id header/body mismatch")
+    if header_run and body_run and header_run != body_run:
+        raise ValueError("run_id header/body mismatch")
+    return header_provenance or body_provenance, header_run or body_run
+
+
+def _read_protected_file(path: Path, *, private: bool) -> bytes:
+    flags = os.O_RDONLY
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    descriptor = os.open(str(path), flags)
+    try:
+        metadata = os.fstat(descriptor)
+        if not stat.S_ISREG(metadata.st_mode):
+            raise RuntimeError("key reference is not a regular file")
+        denied = 0o077 if private else 0o022
+        if metadata.st_mode & denied:
+            raise RuntimeError(
+                "private key file permissions must be 0600 or stricter"
+                if private
+                else "public key file must not be group/world writable"
+            )
+        chunks: list[bytes] = []
+        while True:
+            chunk = os.read(descriptor, 65536)
+            if not chunk:
+                break
+            chunks.append(chunk)
+        value = b"".join(chunks)
+        if not value:
+            raise RuntimeError("key file is empty")
+        return value
+    finally:
+        os.close(descriptor)
+
+
+class FileCommandSignerResolver:
+    """Resolve tenant/key-id scoped OpenClaw Ed25519 signing material."""
+
+    def __init__(self, path: str | Path, *, configured_key_id: str) -> None:
+        self.path = Path(path).resolve()
+        self.configured_key_id = str(configured_key_id or "").strip()
+        if not self.configured_key_id:
+            raise ValueError("configured_key_id is required")
+
+    def __call__(self, tenant_id: str, key_id: str) -> Ed25519CommandSigner:
+        if not str(tenant_id or "").strip():
+            raise RuntimeError("tenant_id is required for command signing")
+        if key_id != self.configured_key_id:
+            raise RuntimeError("OpenClaw signing key_id mismatch")
+        return Ed25519CommandSigner.from_bytes(
+            _read_protected_file(self.path, private=True),
+            key_id=key_id,
+        )
+
+
+class ControlPlaneEventPublisher(EventPublisher):
+    """Append Runtime callback events to the tenant audit stream.
+
+    Callback audit remains informational. Authoritative task reconciliation is
+    performed only by the orchestrator after dispatch/result validation.
+    """
+
+    def __init__(self, service: DurableControlPlaneService) -> None:
+        self.service = service
+
+    def publish(self, event: Mapping[str, Any]) -> None:
+        tenant_id = str(event.get("tenant_id") or "").strip()
+        trace_id = str(event.get("trace_id") or "").strip()
+        command_id = str(event.get("command_id") or "").strip()
+        event_type = str(event.get("event_type") or "OPENCLAW_EVENT").strip()
+        if not tenant_id or not trace_id or not command_id:
+            raise ValueError("runtime audit event is missing tenant identity")
+        state_value = str(event.get("state") or "unknown").lower()
+        outcome = "allowed" if state_value == "completed" else state_value
+        runtime = str(event.get("runtime") or "openclaw").strip().lower()
+        principal_id = str(
+            event.get("principal_id") or f"{runtime}-runtime"
+        ).strip()
+        audit = AuditEvent(
+            event_id=f"runtime_{command_id}_{len(self.service.store.audit_events) + 1}",
+            tenant_id=tenant_id,
+            principal_id=principal_id,
+            trace_id=trace_id,
+            action=event_type,
+            resource_type=f"{runtime}_execution",
+            resource_id=command_id,
+            outcome=outcome,
+            policy_version="runtime-v2",
+            details=dict(event.get("details") or {}),
+        )
+        with self.service.store.lock:
+            self.service.store.audit_events.append(audit)
+            self.service.repository.save(self.service._snapshot())
+
+
+class CandidateApplication:
+    def __init__(
+        self,
+        gateway: GatewayApplication,
+        orchestrator: ExecutionOrchestrator,
+        tracker: ExecutionTracker,
+        hermes: HermesAdapter,
+        openclaw: OpenClawAdapter | None,
+        *,
+        hermes_lifecycle_api_enabled: bool = False,
+    ) -> None:
+        self.gateway = gateway
+        self.orchestrator = orchestrator
+        self.tracker = tracker
+        self.hermes = hermes
+        self.openclaw = openclaw
+        self.hermes_lifecycle_api_enabled = bool(hermes_lifecycle_api_enabled)
+        self.runtime_events = ControlPlaneEventPublisher(orchestrator.control_plane)
+
+    def context(self, headers: Mapping[str, str]) -> RequestContext:
+        return self.gateway.context_from_headers(headers)
+
+    @staticmethod
+    def _require_runtime_role(context: RequestContext) -> None:
+        if not ({"runtime", "platform_admin"} & set(context.roles)):
+            raise Unauthorized("runtime reconciliation role is required")
+
+    @staticmethod
+    def _require_control_plane_cancel(context: RequestContext) -> None:
+        required = {"runtime", "platform_admin"}
+        if not required.issubset(set(context.roles)):
+            raise Unauthorized(
+                "Hermes cancellation requires trusted AIOS control-plane authority"
+            )
+
+    @staticmethod
+    def _required_identity(payload: Mapping[str, Any], name: str) -> str:
+        value = str(payload.get(name) or "").strip()
+        if not value:
+            raise ValueError(f"{name} is required")
+        return value
+
+    def _record_hermes_lifecycle(
+        self,
+        context: RequestContext,
+        dispatch: Any,
+        job: Any,
+        *,
+        action: str,
+        worker_id: str | None,
+        provenance_id: str,
+        run_id: str,
+    ) -> None:
+        executor = worker_id or "aios-control-plane"
+        evidence = ExecutionEvidence(
+            execution_id=job.job_id,
+            tenant_id=job.tenant_id,
+            task_id=job.task_id,
+            agent_id=dispatch.agent_id,
+            executor=executor,
+            branch="runtime/hermes",
+            status=job.state.value.lower(),
+            progress_completed=0,
+            progress_total=3,
+            current_step=action,
+            provenance_id=provenance_id,
+            run_id=run_id,
+        )
+        current_evidence = self.tracker.claim(
+            evidence,
+            principal_id=context.principal_id,
+            provenance_id=provenance_id,
+            run_id=run_id,
+        )
+        if job.state in {
+            HermesJobState.COMPLETED,
+            HermesJobState.FAILED,
+            HermesJobState.CANCELLED,
+        }:
+            if current_evidence.completed_at is None:
+                self.tracker.complete(
+                    tenant_id=job.tenant_id,
+                    execution_id=job.job_id,
+                    status=job.state.value.lower(),
+                    test_status="runtime_terminal",
+                    test_summary={"lifecycle_action": action},
+                    result_summary={
+                        "state": job.state.value,
+                        "worker_id": worker_id,
+                        "dispatch_id": dispatch.dispatch_id,
+                    },
+                    principal_id=context.principal_id,
+                    provenance_id=provenance_id,
+                    run_id=run_id,
+                )
+        else:
+            self.tracker.heartbeat(
+                tenant_id=job.tenant_id,
+                execution_id=job.job_id,
+                status=job.state.value.lower(),
+                current_step=action,
+                progress_completed=(1 if job.state == HermesJobState.RUNNING else 0),
+                progress_total=3,
+                principal_id=context.principal_id,
+                provenance_id=provenance_id,
+                run_id=run_id,
+            )
+        self.runtime_events.publish(
+            {
+                "runtime": "hermes",
+                "tenant_id": job.tenant_id,
+                "principal_id": context.principal_id,
+                "trace_id": job.trace_id,
+                "command_id": job.job_id,
+                "event_type": f"HERMES_{action.upper()}",
+                "state": job.state.value,
+                "details": {
+                    "dispatch_id": dispatch.dispatch_id,
+                    "task_id": job.task_id,
+                    "worker_id": worker_id,
+                    "cell_id": job.cell_id,
+                    "profile_id": job.profile_id,
+                    "revision": job.revision,
+                    "provenance_id": provenance_id,
+                    "run_id": run_id,
+                },
+            }
+        )
+
+    def handle_json(
+        self,
+        method: str,
+        raw_path: str,
+        headers: Mapping[str, str],
+        body: Any,
+    ) -> tuple[int, Mapping[str, Any]]:
+        parsed = urllib.parse.urlparse(raw_path)
+        path = parsed.path.rstrip("/") or "/"
+        method = method.upper()
+
+        if method == "GET" and path == "/api/v2/gitops":
+            context = self.context(headers)
+            return HTTPStatus.OK, {
+                "tenant_id": context.tenant_id,
+                "gitops": collect_gitops_status().as_dict(),
+            }
+
+        if method == "GET" and path == "/api/v2/runtime":
+            context = self.context(headers)
+            runtimes: list[dict[str, Any]] = []
+            if self.openclaw is None:
+                runtimes.append(
+                    {
+                        "name": "openclaw",
+                        "status": "disabled",
+                        "details": {"reason": "runtime_not_configured"},
+                    }
+                )
+            else:
+                try:
+                    health = self.openclaw.health()
+                    runtimes.append(
+                        {
+                            "name": "openclaw",
+                            "status": health.status,
+                            "details": _json_value(health),
+                        }
+                    )
+                except Exception as exc:
+                    runtimes.append(
+                        {
+                            "name": "openclaw",
+                            "status": "unavailable",
+                            "details": {"message": str(exc)},
+                        }
+                    )
+            hermes_health = self.hermes.health()
+            runtimes.append(
+                {
+                    "name": "hermes",
+                    "status": hermes_health.status,
+                    "details": _json_value(hermes_health),
+                }
+            )
+            return HTTPStatus.OK, {
+                "tenant_id": context.tenant_id,
+                "runtimes": runtimes,
+            }
+
+        if method == "GET" and path == "/api/v2/executions":
+            context = self.context(headers)
+            return HTTPStatus.OK, {
+                "executions": _json_value(
+                    self.tracker.list(tenant_id=context.tenant_id)
+                )
+            }
+
+        dispatch_match = __import__("re").fullmatch(
+            r"/api/v2/tasks/([^/]+)/dispatch", path
+        )
+        if method == "POST" and dispatch_match:
+            context = self.context(headers)
+            task_id = urllib.parse.unquote(dispatch_match.group(1))
+            payload = body if isinstance(body, Mapping) else {}
+            timeout = payload.get("timeout_seconds")
+            provenance_id, run_id = _provenance_context(headers, payload)
+            record = self.orchestrator.dispatch(
+                context,
+                task_id=task_id,
+                timeout_seconds=float(timeout) if timeout is not None else None,
+                provenance_id=provenance_id,
+                run_id=run_id,
+            )
+            return HTTPStatus.ACCEPTED, {"dispatch": _json_value(record)}
+
+        lifecycle_match = __import__("re").fullmatch(
+            r"/api/v2/internal/runtime/hermes/lifecycle/"
+            r"(claim|start|heartbeat|complete|fail|cancel|status)",
+            path,
+        )
+        if method == "POST" and lifecycle_match:
+            if not self.hermes_lifecycle_api_enabled:
+                return HTTPStatus.NOT_FOUND, {
+                    "error": "not_found",
+                    "message": "route not found",
+                }
+            context = self.context(headers)
+            self._require_runtime_role(context)
+            if not isinstance(body, Mapping):
+                raise ValueError("JSON body must be an object")
+            payload = body
+            action = lifecycle_match.group(1)
+            identity = {
+                name: self._required_identity(payload, name)
+                for name in (
+                    "dispatch_id",
+                    "job_id",
+                    "tenant_id",
+                    "task_id",
+                    "trace_id",
+                    "principal_id",
+                    "provenance_id",
+                    "run_id",
+                    "cell_id",
+                    "profile_id",
+                )
+            }
+            header_provenance, header_run = _provenance_context(headers, payload)
+            if header_provenance != identity["provenance_id"]:
+                raise ValueError("provenance_id context mismatch")
+            if header_run != identity["run_id"]:
+                raise ValueError("run_id context mismatch")
+            requeued_job_ids = self.hermes.requeue_expired()
+            dispatch, job = self.orchestrator.hermes_lifecycle_context(
+                context,
+                dispatch_id=identity["dispatch_id"],
+                job_id=identity["job_id"],
+                tenant_id=identity["tenant_id"],
+                task_id=identity["task_id"],
+                trace_id=identity["trace_id"],
+                principal_id=identity["principal_id"],
+                provenance_id=identity["provenance_id"],
+                run_id=identity["run_id"],
+            )
+            if job.cell_id != identity["cell_id"]:
+                raise ValueError("cell_id mismatch")
+            if job.profile_id != identity["profile_id"]:
+                raise ValueError("profile_id mismatch")
+
+            if action == "status":
+                if job.job_id in requeued_job_ids:
+                    self._record_hermes_lifecycle(
+                        context,
+                        dispatch,
+                        job,
+                        action="lease_expired_requeue",
+                        worker_id=None,
+                        provenance_id=identity["provenance_id"],
+                        run_id=identity["run_id"],
+                    )
+                task = self.orchestrator.control_plane.get_task(
+                    context, dispatch.task_id
+                )
+                response: dict[str, Any] = {
+                    "job": _json_value(job),
+                    "dispatch": _json_value(dispatch),
+                    "task": _json_value(task),
+                }
+                if job.state in {
+                    HermesJobState.COMPLETED,
+                    HermesJobState.FAILED,
+                    HermesJobState.CANCELLED,
+                }:
+                    response["result"] = _json_value(
+                        self.hermes.result(job.job_id, tenant_id=job.tenant_id)
+                    )
+                return HTTPStatus.OK, response
+
+            expected_revision = payload.get("expected_revision")
+            expected = (
+                int(expected_revision) if expected_revision is not None else None
+            )
+            if action == "cancel":
+                self._require_control_plane_cancel(context)
+                if payload.get("worker_id") is not None:
+                    raise Unauthorized("Hermes workers may observe but not initiate cancel")
+                if payload.get("cancellation_source") != "aios-control-plane":
+                    raise ValueError(
+                        "cancellation_source must be aios-control-plane"
+                    )
+                result = self.hermes.cancel(
+                    job.job_id,
+                    tenant_id=job.tenant_id,
+                    expected_revision=expected,
+                )
+            else:
+                worker_id = self._required_identity(payload, "worker_id")
+                if action == "claim":
+                    claimed = self.hermes.claim(
+                        tenant_id=job.tenant_id,
+                        cell_id=job.cell_id,
+                        profile_id=job.profile_id,
+                        worker_id=worker_id,
+                        lease_seconds=(
+                            int(payload["lease_seconds"])
+                            if payload.get("lease_seconds") is not None
+                            else None
+                        ),
+                        job_id=job.job_id,
+                    )
+                    if claimed is None:
+                        raise ValueError("Hermes job is not claimable")
+                    bound = self.orchestrator.bind_hermes_worker(
+                        context,
+                        claimed,
+                        dispatch_id=dispatch.dispatch_id,
+                        provenance_id=identity["provenance_id"],
+                        run_id=identity["run_id"],
+                        worker_id=worker_id,
+                    )
+                    self._record_hermes_lifecycle(
+                        context,
+                        bound,
+                        claimed,
+                        action="claim",
+                        worker_id=worker_id,
+                        provenance_id=identity["provenance_id"],
+                        run_id=identity["run_id"],
+                    )
+                    return HTTPStatus.OK, {
+                        "job": _json_value(claimed),
+                        "dispatch": _json_value(bound),
+                    }
+                if action == "start":
+                    started = self.hermes.start(
+                        job.job_id,
+                        tenant_id=job.tenant_id,
+                        worker_id=worker_id,
+                        expected_revision=expected,
+                    )
+                    self._record_hermes_lifecycle(
+                        context,
+                        dispatch,
+                        started,
+                        action="start",
+                        worker_id=worker_id,
+                        provenance_id=identity["provenance_id"],
+                        run_id=identity["run_id"],
+                    )
+                    return HTTPStatus.OK, {"job": _json_value(started)}
+                if action == "heartbeat":
+                    heartbeat = self.hermes.heartbeat(
+                        job.job_id,
+                        tenant_id=job.tenant_id,
+                        worker_id=worker_id,
+                        lease_seconds=(
+                            int(payload["lease_seconds"])
+                            if payload.get("lease_seconds") is not None
+                            else None
+                        ),
+                    )
+                    self._record_hermes_lifecycle(
+                        context,
+                        dispatch,
+                        heartbeat,
+                        action="heartbeat",
+                        worker_id=worker_id,
+                        provenance_id=identity["provenance_id"],
+                        run_id=identity["run_id"],
+                    )
+                    return HTTPStatus.OK, {"job": _json_value(heartbeat)}
+                if action == "complete":
+                    output = payload.get("output")
+                    if not isinstance(output, Mapping):
+                        raise ValueError("output must be an object")
+                    result = self.hermes.complete(
+                        job.job_id,
+                        tenant_id=job.tenant_id,
+                        worker_id=worker_id,
+                        output=output,
+                        expected_revision=expected,
+                    )
+                elif action == "fail":
+                    error = payload.get("error")
+                    if not isinstance(error, Mapping):
+                        raise ValueError("error must be an object")
+                    result = self.hermes.fail(
+                        job.job_id,
+                        tenant_id=job.tenant_id,
+                        worker_id=worker_id,
+                        error=error,
+                        expected_revision=expected,
+                    )
+                else:
+                    raise ValueError("unsupported Hermes lifecycle action")
+
+            task = self.orchestrator.reconcile_hermes(
+                context,
+                result,
+                dispatch_id=dispatch.dispatch_id,
+                provenance_id=identity["provenance_id"],
+                run_id=identity["run_id"],
+            )
+            updated_dispatch = self.orchestrator.dispatch_repository.get(
+                dispatch.dispatch_id, tenant_id=dispatch.tenant_id
+            )
+            terminal_job = self.hermes.get(job.job_id, tenant_id=job.tenant_id)
+            self._record_hermes_lifecycle(
+                context,
+                updated_dispatch,
+                terminal_job,
+                action=action,
+                worker_id=result.worker_id,
+                provenance_id=identity["provenance_id"],
+                run_id=identity["run_id"],
+            )
+            return HTTPStatus.OK, {
+                "result": _json_value(result),
+                "task": _json_value(task),
+                "dispatch": _json_value(updated_dispatch),
+            }
+
+        if method == "POST" and path == "/api/v2/internal/runtime/hermes/reconcile":
+            context = self.context(headers)
+            self._require_runtime_role(context)
+            if not isinstance(body, Mapping):
+                raise ValueError("JSON body must be an object")
+            provenance_id, run_id = _provenance_context(headers, body)
+            if not provenance_id or not run_id:
+                raise ValueError("provenance_id and run_id are required")
+            dispatch_id = str(body.get("dispatch_id") or "").strip()
+            if not dispatch_id:
+                raise ValueError("dispatch_id is required")
+            result = HermesResult(
+                job_id=str(body["job_id"]),
+                tenant_id=str(body["tenant_id"]),
+                task_id=str(body["task_id"]),
+                trace_id=str(body["trace_id"]),
+                state=HermesJobState(str(body["state"])),
+                worker_id=(
+                    str(body["worker_id"])
+                    if body.get("worker_id") is not None
+                    else None
+                ),
+                output=body.get("output"),
+                error=body.get("error"),
+                started_at=body.get("started_at"),
+                finished_at=body.get("finished_at"),
+            )
+            task = self.orchestrator.reconcile_hermes(
+                context,
+                result,
+                dispatch_id=dispatch_id,
+                provenance_id=provenance_id,
+                run_id=run_id,
+            )
+            return HTTPStatus.OK, {"task": _json_value(task)}
+
+        if method == "POST" and path == "/api/v2/hermes/results/reconcile":
+            return HTTPStatus.GONE, {
+                "error": "RuntimeReconcileEndpointMoved",
+                "message": "use /api/v2/internal/runtime/hermes/reconcile",
+            }
+
+        return self.gateway.handle(method, raw_path, headers, body)
+
+
+class CandidateRequestHandler(BaseHTTPRequestHandler):
+    server_version = "AIOSV2Candidate/2.0"
+    max_body_bytes = 1_048_576
+
+    @property
+    def application(self) -> CandidateApplication:
+        return self.server.application  # type: ignore[attr-defined]
+
+    def _read_body(self) -> Any:
+        length = int(self.headers.get("Content-Length", "0") or "0")
+        if length < 0 or length > self.max_body_bytes:
+            raise ValueError("request body is too large")
+        if length == 0:
+            return {}
+        content_type = self.headers.get("Content-Type", "").split(";", 1)[0].strip()
+        if content_type != "application/json":
+            raise ValueError("Content-Type must be application/json")
+        return json.loads(self.rfile.read(length).decode("utf-8"))
+
+    def _security_headers(self) -> None:
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("X-Content-Type-Options", "nosniff")
+        self.send_header("X-Frame-Options", "DENY")
+        self.send_header("Referrer-Policy", "no-referrer")
+        self.send_header(
+            "Content-Security-Policy",
+            "default-src 'self'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'",
+        )
+
+    def _send_json(self, status_code: int, payload: Mapping[str, Any]) -> None:
+        encoded = json.dumps(
+            _json_value(payload), ensure_ascii=False, separators=(",", ":")
+        ).encode("utf-8")
+        self.send_response(int(status_code))
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(encoded)))
+        self._security_headers()
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def _send_console(self) -> None:
+        encoded = CONSOLE_HTML.encode("utf-8")
+        self.send_response(HTTPStatus.OK)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.send_header("Content-Length", str(len(encoded)))
+        self._security_headers()
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def _dispatch(self, method: str) -> None:
+        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+        if method == "GET" and path in {"/", "/console"}:
+            self._send_console()
+            return
+        try:
+            body = self._read_body() if method == "POST" else {}
+            status_code, payload = self.application.handle_json(
+                method,
+                self.path,
+                {key: value for key, value in self.headers.items()},
+                body,
+            )
+        except Exception as exc:
+            status_code, payload = error_response(exc)
+        self._send_json(status_code, payload)
+
+    def do_GET(self) -> None:  # noqa: N802
+        self._dispatch("GET")
+
+    def do_POST(self) -> None:  # noqa: N802
+        self._dispatch("POST")
+
+
+class CandidateHTTPServer(ThreadingHTTPServer):
+    daemon_threads = True
+    allow_reuse_address = True
+
+    def __init__(self, address: tuple[str, int], application: CandidateApplication) -> None:
+        self.application = application
+        super().__init__(address, CandidateRequestHandler)
+
+
+def build_application() -> CandidateApplication:
+    state_dir = Path(os.getenv("AIOS_V2_STATE_DIR", "/var/lib/aios-v2")).resolve()
+    state_dir.mkdir(parents=True, exist_ok=True)
+    repository = SQLiteSnapshotRepository(state_dir / "control-plane.sqlite3")
+    dispatch_repository = SQLiteDispatchRepository(state_dir / "dispatches.sqlite3")
+    service = DurableControlPlaneService(repository)
+    require_provenance = _enabled(os.getenv("AIOS_REQUIRE_RUN_PROVENANCE", "0"))
+    provenance_writer = build_provenance_writer_from_env(
+        state_dir=state_dir, required=require_provenance
+    )
+    tracker = ExecutionTracker(
+        state_dir / "executions",
+        provenance_writer=provenance_writer,
+        require_provenance=require_provenance,
+    )
+    hermes = HermesAdapter(store=SQLiteHermesStore(state_dir / "hermes.sqlite3"))
+
+    openclaw_url = os.getenv("AIOS_OPENCLAW_URL", "").strip()
+    signing_file = os.getenv("AIOS_OPENCLAW_SIGNING_MATERIAL_FILE", "").strip()
+    signing_key_id = os.getenv(
+        "AIOS_OPENCLAW_SIGNING_KEY_ID", "openclaw-v2r1-candidate-ed25519"
+    ).strip()
+    openclaw = None
+    resolver = None
+    if openclaw_url and signing_file:
+        resolver = FileCommandSignerResolver(
+            signing_file,
+            configured_key_id=signing_key_id,
+        )
+        transport = HTTPRuntimeTransport(
+            openclaw_url,
+            credential_ref=os.getenv("AIOS_OPENCLAW_CREDENTIAL_REF") or None,
+        )
+        openclaw = OpenClawAdapter(
+            transport,
+            resolver,
+            callback_sink=AuditCallbackSink(ControlPlaneEventPublisher(service)),
+        )
+
+    gateway = GatewayApplication(service)
+    orchestrator = ExecutionOrchestrator(
+        service,
+        openclaw=openclaw,
+        hermes=hermes,
+        openclaw_signing_material_resolver=resolver,
+        openclaw_key_id=signing_key_id,
+        provenance_writer=provenance_writer,
+        require_provenance=require_provenance,
+        dispatch_repository=dispatch_repository,
+    )
+    return CandidateApplication(
+        gateway,
+        orchestrator,
+        tracker,
+        hermes,
+        openclaw,
+        hermes_lifecycle_api_enabled=_enabled(
+            os.getenv("AIOS_HERMES_LIFECYCLE_API_ENABLED", "0")
+        ),
+    )
+
+
+def main() -> None:
+    host = os.getenv("AIOS_V2_HOST", "127.0.0.1")
+    port = int(os.getenv("AIOS_V2_PORT", "18920"))
+    server = CandidateHTTPServer((host, port), build_application())
+    print(f"AIOS V2 candidate listening on {host}:{port}")
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,83 @@
+"""Dependency-free, role-aware AIOS unified portal.
+
+The browser receives only server-authorized capabilities and tenant-scoped data.
+It never selects a tenant, signs Provenance, mutates Git tags, or calls Runtime
+services directly.
+"""
+
+CONSOLE_HTML = r'''<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <meta name="referrer" content="no-referrer">
+  <title>AIOS Unified Portal</title>
+  <style>
+    :root{font-family:Inter,"PingFang SC","Microsoft YaHei",ui-sans-serif,system-ui,sans-serif;color:#172033;background:#eef2f7;--nav:#0f172a;--card:#fff;--line:#dfe6ef;--muted:#667085;--blue:#2563eb;--green:#047857;--red:#b42318;--amber:#b54708}
+    *{box-sizing:border-box}body{margin:0;min-height:100vh}button,input,textarea,select{font:inherit}
+    .shell{display:grid;grid-template-columns:250px minmax(0,1fr);min-height:100vh}.sidebar{background:var(--nav);color:#e2e8f0;padding:22px 16px;position:sticky;top:0;height:100vh;overflow:auto}.brand{font-weight:800;font-size:20px;letter-spacing:.2px}.version{font-size:12px;color:#94a3b8;margin:5px 0 22px}.identity{padding:12px;background:#182338;border:1px solid #2b3950;border-radius:12px;margin-bottom:18px}.identity strong{display:block;color:#fff}.identity span{font-size:12px;color:#aebbd0;display:block;margin-top:3px;overflow-wrap:anywhere}.nav button{width:100%;display:flex;gap:10px;align-items:center;border:0;background:transparent;color:#cbd5e1;padding:11px 12px;border-radius:9px;text-align:left;cursor:pointer;margin:2px 0}.nav button:hover,.nav button.active{background:#24324b;color:#fff}.nav .dot{width:8px;height:8px;border-radius:50%;background:#60a5fa}.main{min-width:0}.topbar{height:70px;background:#fff;border-bottom:1px solid var(--line);display:flex;align-items:center;justify-content:space-between;padding:0 26px;position:sticky;top:0;z-index:4}.topbar h1{font-size:19px;margin:0}.top-actions{display:flex;align-items:center;gap:10px}.timestamp{font-size:12px;color:var(--muted)}.content{padding:24px;max-width:1680px;margin:auto}.notice{background:#eff6ff;border:1px solid #bfdbfe;border-radius:12px;padding:12px 14px;color:#1e3a8a;font-size:13px;margin-bottom:18px}.error{background:#fef3f2;border:1px solid #fecdca;color:var(--red);border-radius:10px;padding:10px 12px;white-space:pre-wrap;margin-bottom:14px;display:none}.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(170px,1fr));gap:14px;margin-bottom:18px}.card,.panel{background:var(--card);border:1px solid var(--line);border-radius:14px;box-shadow:0 1px 3px rgba(16,24,40,.05)}.card{padding:16px}.card small{color:var(--muted);font-weight:600}.card b{display:block;font-size:28px;margin-top:7px}.panel{padding:17px;margin-bottom:16px;overflow:auto}.panel h2{font-size:16px;margin:0}.panel-head{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-bottom:13px}.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(410px,1fr));gap:16px}.wide{grid-column:1/-1}.muted{color:var(--muted)}.good{color:var(--green);font-weight:700}.bad{color:var(--red);font-weight:700}.warn{color:var(--amber);font-weight:700}.pill{display:inline-block;border:1px solid #cbd5e1;border-radius:999px;padding:3px 8px;font-size:11px;margin:2px;background:#f8fafc}.pill.good{background:#ecfdf3;border-color:#a6f4c5}.pill.bad{background:#fef3f2;border-color:#fecdca}.toolbar{display:flex;gap:8px;align-items:center;flex-wrap:wrap}.btn{border:0;border-radius:9px;padding:9px 12px;background:var(--blue);color:#fff;cursor:pointer;font-weight:650}.btn.secondary{background:#fff;color:#344054;border:1px solid #d0d5dd}.btn.danger{background:#d92d20}.btn:disabled{opacity:.45;cursor:not-allowed}.icon-btn{padding:7px 10px}.view{display:none}.view.active{display:block}table{width:100%;border-collapse:collapse;font-size:12px}th,td{text-align:left;padding:9px 8px;border-bottom:1px solid #edf0f4;vertical-align:top}th{color:#667085;font-weight:700;white-space:nowrap}td{overflow-wrap:anywhere}.empty{padding:24px;text-align:center;color:var(--muted)}.timeline{border-left:2px solid #dbe4f0;margin-left:8px;padding-left:20px}.event{position:relative;padding:0 0 17px}.event:before{content:"";position:absolute;left:-27px;top:4px;width:11px;height:11px;border-radius:50%;background:#3b82f6;border:3px solid #fff;box-shadow:0 0 0 1px #93c5fd}.event strong{font-size:13px}.event p{margin:4px 0;color:var(--muted);font-size:12px}.chain{display:flex;align-items:stretch;gap:7px;overflow:auto;padding:5px 0}.chain-item{min-width:135px;border:1px solid var(--line);border-radius:10px;padding:10px;background:#f8fafc}.chain-arrow{display:flex;align-items:center;color:#94a3b8}.form-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(230px,1fr));gap:12px}.field label{font-size:12px;color:#475467;font-weight:650;display:block;margin-bottom:5px}.field input,.field textarea,.field select{width:100%;border:1px solid #d0d5dd;border-radius:9px;padding:9px;background:#fff}.field textarea{min-height:90px;resize:vertical}.dialog{border:0;border-radius:14px;padding:0;max-width:650px;width:calc(100% - 32px);box-shadow:0 20px 60px rgba(15,23,42,.28)}.dialog::backdrop{background:rgba(15,23,42,.6)}.dialog-head{padding:16px 18px;border-bottom:1px solid var(--line);font-weight:750}.dialog-body{padding:18px}.dialog-actions{padding:14px 18px;border-top:1px solid var(--line);display:flex;justify-content:flex-end;gap:8px}.kv{display:grid;grid-template-columns:150px minmax(0,1fr);gap:6px 12px;font-size:12px}.kv div:nth-child(odd){color:var(--muted)}pre{white-space:pre-wrap;word-break:break-word;font-size:11px;background:#0f172a;color:#dbeafe;border-radius:10px;padding:12px;max-height:300px;overflow:auto}
+    @media(max-width:900px){.shell{grid-template-columns:1fr}.sidebar{height:auto;position:static}.nav{display:flex;overflow:auto}.nav button{min-width:max-content}.topbar{position:static}.grid{grid-template-columns:1fr}.content{padding:16px}}
+  </style>
+</head>
+<body>
+<div class="shell">
+  <aside class="sidebar">
+    <div class="brand">AIOS Unified Portal</div><div class="version">V2R1C1 · Role-aware Control Plane</div>
+    <div class="identity"><strong id="principal">加载身份…</strong><span id="tenant"></span><span id="roles"></span></div>
+    <nav id="navigation" class="nav"></nav>
+  </aside>
+  <section class="main">
+    <header class="topbar"><h1 id="pageTitle">系统总览</h1><div class="top-actions"><span id="updated" class="timestamp">尚未加载</span><button class="btn secondary icon-btn" id="refresh">刷新</button></div></header>
+    <main class="content">
+      <div class="notice">身份、租户和角色由可信反向代理注入。门户只调用 AIOS Control Plane；Provenance 签发、Tag、生产部署与 Runtime 权威状态仍由受控流程执行。</div>
+      <div id="error" class="error"></div>
+      <section id="overview" class="view active"></section>
+      <section id="tasks" class="view"></section>
+      <section id="authorization" class="view"></section>
+      <section id="runtime" class="view"></section>
+      <section id="evidence" class="view"></section>
+      <section id="audit" class="view"></section>
+      <section id="release" class="view"></section>
+    </main>
+  </section>
+</div>
+<dialog id="taskDialog" class="dialog">
+  <div class="dialog-head">创建任务</div><form id="taskForm"><div class="dialog-body form-grid">
+    <div class="field"><label>Agent ID</label><input name="agent_id" required></div>
+    <div class="field"><label>Action</label><input name="action" required></div>
+    <div class="field"><label>Idempotency Key</label><input name="idempotency_key" required></div>
+    <div class="field wide"><label>Payload JSON</label><textarea name="payload">{}</textarea></div>
+  </div><div class="dialog-actions"><button type="button" class="btn secondary" data-close="taskDialog">取消</button><button class="btn">创建</button></div></form>
+</dialog>
+<dialog id="confirmDialog" class="dialog"><div class="dialog-head" id="confirmTitle">确认操作</div><form id="confirmForm"><div class="dialog-body"><p id="confirmText"></p><div class="field"><label>原因</label><textarea id="confirmReason" required></textarea></div></div><div class="dialog-actions"><button type="button" class="btn secondary" data-close="confirmDialog">取消</button><button class="btn danger">确认</button></div></form></dialog>
+<script>
+const $=s=>document.querySelector(s), esc=v=>String(v??'').replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+const state={identity:null,current:'overview',cache:{},confirm:null};
+const labels={overview:'系统总览',tasks:'任务中心',authorization:'授权中心',runtime:'运行与运维',evidence:'执行证据',audit:'审计中心',release:'GitOps 与发布'};
+function has(c){return !!state.identity?.capabilities?.includes(c)}
+async function api(path,options={}){const r=await fetch(path,{credentials:'same-origin',headers:{'Accept':'application/json','Content-Type':'application/json',...(options.headers||{})},...options});const d=await r.json().catch(()=>({}));if(!r.ok)throw new Error(`${r.status} ${d.message||d.error||path}`);return d}
+function err(e){const el=$('#error');el.textContent=e?.message||String(e);el.style.display='block'}function clearErr(){$('#error').style.display='none';$('#error').textContent=''}
+function pill(v){const s=String(v??'unknown'),c=/complete|pass|healthy|active|synced|approved|used/i.test(s)?'good':/fail|deny|reject|revoke|expire|cancel|unavailable/i.test(s)?'bad':'';return `<span class="pill ${c}">${esc(s)}</span>`}
+function table(cols,rows){if(!rows?.length)return '<div class="empty">暂无数据</div>';return `<table><thead><tr>${cols.map(x=>`<th>${esc(x[0])}</th>`).join('')}</tr></thead><tbody>${rows.map(r=>`<tr>${cols.map(x=>`<td>${x[1](r)}</td>`).join('')}</tr>`).join('')}</tbody></table>`}
+function card(label,value,detail=''){return `<div class="card"><small>${esc(label)}</small><b>${esc(value)}</b>${detail?`<span class="muted">${esc(detail)}</span>`:''}</div>`}
+function json(v){return `<pre>${esc(JSON.stringify(v,null,2))}</pre>`}
+function show(view){state.current=view;document.querySelectorAll('.view').forEach(x=>x.classList.toggle('active',x.id===view));document.querySelectorAll('.nav button').forEach(x=>x.classList.toggle('active',x.dataset.view===view));$('#pageTitle').textContent=labels[view]||view;load(view)}
+function navigation(){const nav=$('#navigation');nav.innerHTML=(state.identity.navigation||[]).map(x=>`<button data-view="${esc(x.id)}"><span class="dot"></span>${esc(x.label)}</button>`).join('');nav.querySelectorAll('button').forEach(b=>b.onclick=()=>show(b.dataset.view));}
+async function identity(){state.identity=await api('/api/v2/me/capabilities');$('#principal').textContent=state.identity.principal_id;$('#tenant').textContent=`租户：${state.identity.tenant_id}`;$('#roles').textContent=`角色：${state.identity.roles.join(', ')||'无'}`;navigation();if(!state.identity.navigation.some(x=>x.id===state.current))state.current=state.identity.navigation[0]?.id||'overview';show(state.current)}
+async function load(view){clearErr();try{if(view==='overview')await overview();if(view==='tasks')await tasks();if(view==='authorization')await authorizations();if(view==='runtime')await runtime();if(view==='evidence')await evidence();if(view==='audit')await audit();if(view==='release')await release();$('#updated').textContent=`更新于 ${new Date().toLocaleString()}`}catch(e){err(e)}}
+async function overview(){const d=await api('/api/v2/portal/overview');state.cache.overview=d;const s=d.summary||{},rt=d.sections?.runtime?.runtimes||[],rel=d.sections?.release||{};$('#overview').innerHTML=`<div class="cards">${card('任务',s.tasks||0)}${card('活动 Dispatch',s.active_dispatches||0,`总数 ${s.dispatches||0}`)}${card('执行证据',s.evidence||0)}${card('审计事件',s.audit_events||0)}${card('当前版本',rel.version||'—',rel.status||'')}${card('授权 Grant',d.sections?.authorization?.active_grants||0,`总数 ${d.sections?.authorization?.grants||0}`)}</div><div class="grid"><div class="panel"><div class="panel-head"><h2>Runtime 健康</h2></div>${table([['Runtime',x=>esc(x.name)],['状态',x=>pill(x.status)],['版本/详情',x=>esc(x.details?.version||x.details?.runtime_id||'—')]],rt)}</div><div class="panel"><div class="panel-head"><h2>任务状态</h2></div>${table([['状态',x=>pill(x[0])],['数量',x=>esc(x[1])]],Object.entries(s.task_states||{}))}</div><div class="panel wide"><div class="panel-head"><h2>最近任务</h2></div>${table([['任务',x=>esc(x.task_id)],['Agent',x=>esc(x.agent_id)],['动作',x=>esc(x.action)],['状态',x=>pill(x.state)],['更新时间',x=>esc(x.updated_at)]],d.recent?.tasks||[])}</div></div>`}
+async function tasks(){const d=await api('/api/v2/portal/tasks');state.cache.tasks=d.items||[];const create=has('task.create')?'<button class="btn" id="newTask">创建任务</button>':'';$('#tasks').innerHTML=`<div class="panel"><div class="panel-head"><h2>任务全链路</h2><div class="toolbar">${create}</div></div>${(d.items||[]).map(taskBlock).join('')||'<div class="empty">暂无任务</div>'}</div>`;$('#newTask')?.addEventListener('click',()=>$('#taskDialog').showModal());document.querySelectorAll('[data-task-action]').forEach(b=>b.onclick=()=>taskAction(b.dataset.taskId,b.dataset.taskAction,b.dataset.revision))}
+function taskBlock(x){const t=x.task||{},d=x.dispatch,e=x.evidence||[],a=x.audit||[],actions=(x.available_actions||[]).map(v=>`<button class="btn ${v==='cancel'?'danger':'secondary'}" data-task-action="${v}" data-task-id="${esc(t.task_id)}" data-revision="${esc(t.revision)}">${{approve:'审批',cancel:'取消',dispatch:'调度'}[v]||v}</button>`).join('');return `<div class="panel" style="background:#fbfcfe"><div class="panel-head"><h2>${esc(t.task_id)} · ${esc(t.action)}</h2><div class="toolbar">${pill(t.state)}${actions}</div></div><div class="chain"><div class="chain-item"><b>Task</b><div>${esc(t.agent_id)}</div><small>${esc(t.created_by)}</small></div><span class="chain-arrow">→</span><div class="chain-item"><b>Approval</b><div>${esc(t.approved_by||'待审批')}</div><small>revision ${esc(t.revision)}</small></div><span class="chain-arrow">→</span><div class="chain-item"><b>Provenance</b><div>${esc(d?.provenance_id||'未调度')}</div><small>${esc(d?.authorization_id||'')}</small></div><span class="chain-arrow">→</span><div class="chain-item"><b>Dispatch</b><div>${esc(d?.dispatch_id||'—')}</div><small>${pill(d?.state||'not_created')}</small></div><span class="chain-arrow">→</span><div class="chain-item"><b>Runtime</b><div>${esc(d?.runtime||'—')}</div><small>${esc(d?.runtime_execution_id||'')}</small></div><span class="chain-arrow">→</span><div class="chain-item"><b>Evidence</b><div>${e.length} 条</div><small>Audit ${a.length} 条</small></div></div></div>`}
+async function taskAction(id,action,revision){clearErr();try{let body={expected_revision:Number(revision)};if(action==='dispatch'){body={};const p=prompt('Provenance ID（生产调度必填）','');const r=prompt('Run ID（生产调度必填）','');if(p)body.provenance_id=p;if(r)body.run_id=r}await api(`/api/v2/portal/tasks/${encodeURIComponent(id)}/${action}`,{method:'POST',body:JSON.stringify(body)});await tasks()}catch(e){err(e)}}
+async function authorizations(){const d=await api('/api/v2/portal/authorizations');state.cache.authorization=d;const workflows=(d.workflows||[]),grants=(d.grants||[]);$('#authorization').innerHTML=`<div class="cards">${card('Workflow',d.summary?.workflows||0)}${card('Grant',d.summary?.grants||0)}${card('有效 Grant',d.summary?.active_grants||0)}${card('已撤销',d.summary?.revoked_grants||0)}</div><div class="panel"><div class="panel-head"><h2>Workflow Provenance</h2></div>${table([['ID',x=>esc(x.provenance_id)],['Run / Task',x=>`${esc(x.run_id)}<br>${esc(x.task_id)}`],['Principal / Agent',x=>`${esc(x.principal_id)}<br>${esc(x.agent_id)}`],['状态',x=>pill(x.status)],['有效期',x=>esc(x.expires_at)],['使用',x=>esc(x.usage_count)],['操作',x=>has('provenance.revoke')&&x.status!=='revoked'?`<button class="btn danger" data-revoke-workflow="${esc(x.provenance_id)}">撤销</button>`:'—']],workflows)}</div><div class="panel"><div class="panel-head"><h2>Child Grants</h2></div>${table([['Grant',x=>esc(x.grant_id)],['类型 / Scope',x=>`${esc(x.grant_type)}<br>${esc(x.execution_path)}`],['Git 操作',x=>esc((x.allowed_git_operations||[]).join(', ')||'—')],['状态',x=>pill(x.status)],['有效期',x=>esc(x.expires_at)],['使用',x=>esc(x.usage_count)],['操作',x=>has('provenance.revoke')&&x.status!=='revoked'?`<button class="btn danger" data-revoke-grant="${esc(x.grant_id)}">撤销</button>`:'—']],grants)}</div>`;document.querySelectorAll('[data-revoke-workflow]').forEach(b=>b.onclick=()=>confirmOp('撤销 Workflow',`撤销 ${b.dataset.revokeWorkflow} 将使所有子 Grant 失效。`,reason=>api(`/api/v2/portal/provenance/${encodeURIComponent(b.dataset.revokeWorkflow)}/revoke`,{method:'POST',body:JSON.stringify({reason})}).then(authorizations)));document.querySelectorAll('[data-revoke-grant]').forEach(b=>b.onclick=()=>confirmOp('撤销 Grant',`撤销 ${b.dataset.revokeGrant}。`,reason=>api(`/api/v2/portal/grants/${encodeURIComponent(b.dataset.revokeGrant)}/revoke`,{method:'POST',body:JSON.stringify({reason})}).then(authorizations)))}
+async function runtime(){const d=await api('/api/v2/portal/runtime');const runtimes=d.runtimes||[],dispatches=d.dispatches||[],jobs=d.hermes_jobs||[];$('#runtime').innerHTML=`<div class="grid"><div class="panel"><div class="panel-head"><h2>Runtime</h2></div>${table([['名称',x=>esc(x.name)],['状态',x=>pill(x.status)],['详情',x=>esc(JSON.stringify(x.details||{}))]],runtimes)}</div><div class="panel"><div class="panel-head"><h2>Hermes Queue / Lease</h2></div>${table([['Job',x=>esc(x.job_id)],['Cell / Profile',x=>`${esc(x.cell_id)} / ${esc(x.profile_id)}`],['Worker',x=>esc(x.assigned_worker_id||'—')],['状态',x=>pill(x.state)],['Lease',x=>esc(x.lease_expires_at||'—')]],jobs)}</div><div class="panel wide"><div class="panel-head"><h2>Dispatch</h2></div>${table([['Dispatch',x=>esc(x.dispatch_id)],['Task',x=>esc(x.task_id)],['Runtime',x=>esc(x.runtime)],['执行 ID',x=>esc(x.runtime_execution_id)],['Principal',x=>esc(x.principal_id)],['状态',x=>pill(x.state)]],dispatches)}</div></div>`}
+async function evidence(){const d=await api('/api/v2/portal/evidence');$('#evidence').innerHTML=`<div class="panel"><div class="panel-head"><h2>Execution Evidence</h2></div>${table([['Execution',x=>esc(x.execution_id)],['Task / Agent',x=>`${esc(x.task_id)}<br>${esc(x.agent_id)}`],['Executor',x=>esc(x.executor)],['状态',x=>pill(x.status)],['进度',x=>`${esc(x.progress_completed)}/${esc(x.progress_total)}`],['Test',x=>pill(x.test_status)],['Commit',x=>esc(x.last_commit||'—')],['授权',x=>esc(x.last_authorization_id||'—')]],d.executions||[])}</div>`}
+async function audit(){const d=await api('/api/v2/portal/audit');const events=(d.events||[]).slice().reverse();$('#audit').innerHTML=`<div class="panel"><div class="panel-head"><h2>统一审计时间线</h2></div><div class="timeline">${events.map(x=>`<div class="event"><strong>${esc(x.action)} · ${pill(x.outcome)}</strong><p>${esc(x.created_at)} · ${esc(x.principal_id)} · ${esc(x.resource_type)}/${esc(x.resource_id)}</p><div class="muted">Trace ${esc(x.trace_id)} · Policy ${esc(x.policy_version)}</div></div>`).join('')||'<div class="empty">暂无审计事件</div>'}</div></div>`}
+async function release(){const d=await api('/api/v2/portal/release');const g=d.gitops||{};$('#release').innerHTML=`<div class="cards">${card('版本',d.version||'—')}${card('Baseline',d.baseline||'—')}${card('发布状态',d.status||'—')}${card('Git 同步',g.sync_status||'unknown')}</div><div class="grid"><div class="panel"><div class="panel-head"><h2>当前 Release</h2></div><div class="kv"><div>Release OID</div><div>${esc(d.release_oid)}</div><div>Branch</div><div>${esc(g.workspace_branch||g.branch||'—')}</div><div>Workspace</div><div>${pill(g.workspace_clean===true?'clean':g.workspace_clean===false?'dirty':'unknown')}</div><div>Local Sync</div><div>${pill(g.local_sync||'unknown')}</div><div>Gitea Sync</div><div>${pill(g.gitea_sync||'unknown')}</div></div></div><div class="panel"><div class="panel-head"><h2>治理操作</h2></div><p class="muted">门户不直接移动 Tag、合并主线或部署生产。以下仅为可发起的 GitOps 请求目录。</p>${(d.operations||[]).map(x=>pill(x)).join('')||'<span class="muted">当前角色只读</span>'}</div><div class="panel wide"><div class="panel-head"><h2>原始 GitOps 状态</h2></div>${json(g)}</div></div>`}
+function confirmOp(title,text,fn){state.confirm=fn;$('#confirmTitle').textContent=title;$('#confirmText').textContent=text;$('#confirmReason').value='';$('#confirmDialog').showModal()}
+$('#taskForm').onsubmit=async e=>{e.preventDefault();clearErr();try{const fd=new FormData(e.target),payload=JSON.parse(fd.get('payload')||'{}');await api('/api/v2/portal/tasks',{method:'POST',body:JSON.stringify({agent_id:fd.get('agent_id'),action:fd.get('action'),idempotency_key:fd.get('idempotency_key'),payload})});$('#taskDialog').close();e.target.reset();await tasks()}catch(e){err(e)}};
+$('#confirmForm').onsubmit=async e=>{e.preventDefault();const fn=state.confirm;$('#confirmDialog').close();state.confirm=null;try{await fn?.($('#confirmReason').value)}catch(e){err(e)}};
+document.querySelectorAll('[data-close]').forEach(b=>b.onclick=()=>document.getElementById(b.dataset.close).close());$('#refresh').onclick=()=>load(state.current);
+identity().catch(err);setInterval(()=>load(state.current),30000);
+</script>
+</body></html>'''
@@ -0,0 +1,627 @@
+"""Tenant-isolated AIOS V2 control-plane domain service.
+
+This module deliberately contains no OpenClaw or Hermes implementation details.
+It owns authoritative tenant, agent, task-lifecycle, idempotency and audit state.
+Runtime adapters consume approved tasks through a separate boundary.
+"""
+from __future__ import annotations
+
+import copy
+import hashlib
+import json
+import threading
+import uuid
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from enum import Enum
+from typing import Any, Callable, Iterable, Mapping
+
+
+def _utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _new_id(prefix: str) -> str:
+    return f"{prefix}_{uuid.uuid4().hex}"
+
+
+def _canonical_digest(value: Mapping[str, Any]) -> str:
+    encoded = json.dumps(
+        value,
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+        default=str,
+    ).encode("utf-8")
+    return hashlib.sha256(encoded).hexdigest()
+
+
+class ControlPlaneError(RuntimeError):
+    """Base error returned by the control-plane domain."""
+
+
+class Unauthorized(ControlPlaneError):
+    """The caller is not authenticated or lacks the required role."""
+
+
+class TenantIsolationError(ControlPlaneError):
+    """A request attempted to cross a tenant boundary."""
+
+
+class NotFound(ControlPlaneError):
+    """A tenant-scoped resource does not exist or is not visible."""
+
+
+class InvalidTransition(ControlPlaneError):
+    """A task state transition violates the lifecycle contract."""
+
+
+class IdempotencyConflict(ControlPlaneError):
+    """An idempotency key was reused for a different command."""
+
+
+class RevisionConflict(ControlPlaneError):
+    """Optimistic task revision does not match current state."""
+
+
+class PolicyDenied(ControlPlaneError):
+    """The policy gate denied a control-plane operation."""
+
+
+@dataclass(frozen=True)
+class RequestContext:
+    """Authenticated request identity propagated across all AIOS layers."""
+
+    tenant_id: str
+    principal_id: str
+    trace_id: str
+    roles: frozenset[str] = field(default_factory=frozenset)
+    session_id: str | None = None
+    policy_version: str = "v1"
+
+    def __post_init__(self) -> None:
+        for name in ("tenant_id", "principal_id", "trace_id"):
+            if not str(getattr(self, name, "")).strip():
+                raise ValueError(f"{name} is required")
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        tenant_id: str,
+        principal_id: str,
+        roles: Iterable[str] = (),
+        trace_id: str | None = None,
+        session_id: str | None = None,
+        policy_version: str = "v1",
+    ) -> "RequestContext":
+        return cls(
+            tenant_id=tenant_id.strip(),
+            principal_id=principal_id.strip(),
+            trace_id=trace_id or _new_id("trace"),
+            roles=frozenset(str(role).strip() for role in roles if str(role).strip()),
+            session_id=session_id,
+            policy_version=policy_version,
+        )
+
+
+@dataclass(frozen=True)
+class TenantRecord:
+    tenant_id: str
+    display_name: str
+    status: str = "active"
+    metadata: Mapping[str, Any] = field(default_factory=dict)
+    created_at: str = field(default_factory=_utc_now)
+    updated_at: str = field(default_factory=_utc_now)
+
+
+@dataclass(frozen=True)
+class AgentRecord:
+    agent_id: str
+    tenant_id: str
+    display_name: str
+    runtime: str
+    capabilities: tuple[str, ...] = field(default_factory=tuple)
+    enabled: bool = True
+    metadata: Mapping[str, Any] = field(default_factory=dict)
+    created_at: str = field(default_factory=_utc_now)
+    updated_at: str = field(default_factory=_utc_now)
+
+
+class TaskState(str, Enum):
+    CREATED = "CREATED"
+    APPROVED = "APPROVED"
+    RUNNING = "RUNNING"
+    COMPLETED = "COMPLETED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
+
+
+TERMINAL_TASK_STATES = frozenset(
+    {TaskState.COMPLETED, TaskState.FAILED, TaskState.CANCELLED}
+)
+
+ALLOWED_TASK_TRANSITIONS: Mapping[TaskState, frozenset[TaskState]] = {
+    TaskState.CREATED: frozenset({TaskState.APPROVED, TaskState.CANCELLED}),
+    TaskState.APPROVED: frozenset({TaskState.RUNNING, TaskState.CANCELLED}),
+    TaskState.RUNNING: frozenset(
+        {TaskState.COMPLETED, TaskState.FAILED, TaskState.CANCELLED}
+    ),
+    TaskState.COMPLETED: frozenset(),
+    TaskState.FAILED: frozenset(),
+    TaskState.CANCELLED: frozenset(),
+}
+
+
+@dataclass(frozen=True)
+class TaskRecord:
+    task_id: str
+    tenant_id: str
+    agent_id: str
+    action: str
+    payload: Mapping[str, Any]
+    state: TaskState = TaskState.CREATED
+    revision: int = 1
+    idempotency_key: str | None = None
+    request_digest: str = ""
+    result: Mapping[str, Any] | None = None
+    error: Mapping[str, Any] | None = None
+    created_by: str = ""
+    approved_by: str | None = None
+    created_at: str = field(default_factory=_utc_now)
+    updated_at: str = field(default_factory=_utc_now)
+
+
+@dataclass(frozen=True)
+class AuditEvent:
+    event_id: str
+    tenant_id: str
+    principal_id: str
+    trace_id: str
+    action: str
+    resource_type: str
+    resource_id: str
+    outcome: str
+    policy_version: str
+    details: Mapping[str, Any] = field(default_factory=dict)
+    created_at: str = field(default_factory=_utc_now)
+
+
+@dataclass(frozen=True)
+class PolicyDecision:
+    allowed: bool
+    reason: str
+    policy_version: str
+
+
+PolicyEvaluator = Callable[[RequestContext, str, Mapping[str, Any]], PolicyDecision]
+
+
+class InMemoryControlPlaneStore:
+    """Thread-safe reference store used by tests and the first gateway slice.
+
+    Production backends must preserve the same tenant-scoped interface and add
+    database row-level security, migrations, backup and HA evidence.
+    """
+
+    def __init__(self) -> None:
+        self.lock = threading.RLock()
+        self.tenants: dict[str, TenantRecord] = {}
+        self.agents: dict[str, AgentRecord] = {}
+        self.tasks: dict[str, TaskRecord] = {}
+        self.idempotency: dict[tuple[str, str], tuple[str, str]] = {}
+        self.audit_events: list[AuditEvent] = []
+
+
+class ControlPlaneService:
+    """Authoritative tenant, agent and task lifecycle service."""
+
+    def __init__(
+        self,
+        store: InMemoryControlPlaneStore | None = None,
+        *,
+        policy_evaluator: PolicyEvaluator | None = None,
+    ) -> None:
+        self.store = store or InMemoryControlPlaneStore()
+        self.policy_evaluator = policy_evaluator or self._default_policy
+
+    @staticmethod
+    def _default_policy(
+        context: RequestContext,
+        action: str,
+        resource: Mapping[str, Any],
+    ) -> PolicyDecision:
+        del resource
+        role_requirements = {
+            "tenant.register": {"platform_admin"},
+            "tenant.read": {"tenant_admin", "operator", "auditor", "platform_admin"},
+            "agent.register": {"tenant_admin", "operator", "platform_admin"},
+            "agent.read": {"tenant_admin", "operator", "auditor", "platform_admin"},
+            "task.create": {"tenant_admin", "operator", "platform_admin"},
+            "task.read": {"tenant_admin", "operator", "auditor", "platform_admin"},
+            "task.approve": {"tenant_admin", "approver", "platform_admin"},
+            "task.start": {"runtime", "operator", "platform_admin"},
+            "task.complete": {"runtime", "operator", "platform_admin"},
+            "task.fail": {"runtime", "operator", "platform_admin"},
+            "task.cancel": {"tenant_admin", "operator", "approver", "platform_admin"},
+            "audit.read": {"tenant_admin", "auditor", "platform_admin"},
+        }
+        required = role_requirements.get(action, {"platform_admin"})
+        allowed = bool(context.roles.intersection(required))
+        return PolicyDecision(
+            allowed=allowed,
+            reason="role_allowed" if allowed else "required_role_missing",
+            policy_version=context.policy_version,
+        )
+
+    def _require_context(self, context: RequestContext) -> None:
+        if not context.principal_id or not context.tenant_id or not context.trace_id:
+            raise Unauthorized("authenticated tenant context is required")
+
+    def _authorize(
+        self,
+        context: RequestContext,
+        action: str,
+        resource: Mapping[str, Any],
+    ) -> PolicyDecision:
+        self._require_context(context)
+        decision = self.policy_evaluator(context, action, resource)
+        if not decision.allowed:
+            self._audit(
+                context,
+                action=action,
+                resource_type=str(resource.get("resource_type", "policy")),
+                resource_id=str(resource.get("resource_id", "unknown")),
+                outcome="denied",
+                details={"reason": decision.reason},
+            )
+            raise PolicyDenied(f"{action} denied: {decision.reason}")
+        return decision
+
+    @staticmethod
+    def _assert_same_tenant(context: RequestContext, tenant_id: str) -> None:
+        if context.tenant_id != tenant_id and "platform_admin" not in context.roles:
+            raise TenantIsolationError("cross-tenant access denied")
+
+    def _audit(
+        self,
+        context: RequestContext,
+        *,
+        action: str,
+        resource_type: str,
+        resource_id: str,
+        outcome: str,
+        details: Mapping[str, Any] | None = None,
+    ) -> AuditEvent:
+        event = AuditEvent(
+            event_id=_new_id("audit"),
+            tenant_id=context.tenant_id,
+            principal_id=context.principal_id,
+            trace_id=context.trace_id,
+            action=action,
+            resource_type=resource_type,
+            resource_id=resource_id,
+            outcome=outcome,
+            policy_version=context.policy_version,
+            details=copy.deepcopy(dict(details or {})),
+        )
+        self.store.audit_events.append(event)
+        return event
+
+    def register_tenant(
+        self,
+        context: RequestContext,
+        *,
+        tenant_id: str,
+        display_name: str,
+        metadata: Mapping[str, Any] | None = None,
+    ) -> TenantRecord:
+        tenant_id = tenant_id.strip()
+        if not tenant_id or not display_name.strip():
+            raise ValueError("tenant_id and display_name are required")
+        self._authorize(
+            context,
+            "tenant.register",
+            {"resource_type": "tenant", "resource_id": tenant_id},
+        )
+        self._assert_same_tenant(context, tenant_id)
+        with self.store.lock:
+            if tenant_id in self.store.tenants:
+                raise ControlPlaneError(f"tenant already exists: {tenant_id}")
+            tenant = TenantRecord(
+                tenant_id=tenant_id,
+                display_name=display_name.strip(),
+                metadata=copy.deepcopy(dict(metadata or {})),
+            )
+            self.store.tenants[tenant_id] = tenant
+            self._audit(
+                context,
+                action="tenant.register",
+                resource_type="tenant",
+                resource_id=tenant_id,
+                outcome="allowed",
+            )
+            return tenant
+
+    def get_tenant(self, context: RequestContext, tenant_id: str | None = None) -> TenantRecord:
+        tenant_id = tenant_id or context.tenant_id
+        self._authorize(
+            context,
+            "tenant.read",
+            {"resource_type": "tenant", "resource_id": tenant_id},
+        )
+        self._assert_same_tenant(context, tenant_id)
+        with self.store.lock:
+            tenant = self.store.tenants.get(tenant_id)
+            if tenant is None:
+                raise NotFound("tenant not found")
+            return tenant
+
+    def register_agent(
+        self,
+        context: RequestContext,
+        *,
+        agent_id: str,
+        display_name: str,
+        runtime: str,
+        capabilities: Iterable[str] = (),
+        metadata: Mapping[str, Any] | None = None,
+    ) -> AgentRecord:
+        self._authorize(
+            context,
+            "agent.register",
+            {"resource_type": "agent", "resource_id": agent_id},
+        )
+        tenant = self.get_tenant(context)
+        if tenant.status != "active":
+            raise ControlPlaneError("tenant is not active")
+        normalized_capabilities = tuple(
+            sorted({str(item).strip() for item in capabilities if str(item).strip()})
+        )
+        if not agent_id.strip() or not display_name.strip() or not runtime.strip():
+            raise ValueError("agent_id, display_name and runtime are required")
+        with self.store.lock:
+            existing = self.store.agents.get(agent_id)
+            if existing is not None and existing.tenant_id != context.tenant_id:
+                raise TenantIsolationError("agent id belongs to another tenant")
+            if existing is not None:
+                raise ControlPlaneError(f"agent already exists: {agent_id}")
+            agent = AgentRecord(
+                agent_id=agent_id.strip(),
+                tenant_id=context.tenant_id,
+                display_name=display_name.strip(),
+                runtime=runtime.strip(),
+                capabilities=normalized_capabilities,
+                metadata=copy.deepcopy(dict(metadata or {})),
+            )
+            self.store.agents[agent.agent_id] = agent
+            self._audit(
+                context,
+                action="agent.register",
+                resource_type="agent",
+                resource_id=agent.agent_id,
+                outcome="allowed",
+                details={"runtime": agent.runtime},
+            )
+            return agent
+
+    def get_agent(self, context: RequestContext, agent_id: str) -> AgentRecord:
+        self._authorize(
+            context,
+            "agent.read",
+            {"resource_type": "agent", "resource_id": agent_id},
+        )
+        with self.store.lock:
+            agent = self.store.agents.get(agent_id)
+            if agent is None:
+                raise NotFound("agent not found")
+            self._assert_same_tenant(context, agent.tenant_id)
+            return agent
+
+    def list_agents(self, context: RequestContext) -> list[AgentRecord]:
+        self._authorize(
+            context,
+            "agent.read",
+            {"resource_type": "agent_collection", "resource_id": context.tenant_id},
+        )
+        with self.store.lock:
+            return [
+                agent
+                for agent in self.store.agents.values()
+                if agent.tenant_id == context.tenant_id
+            ]
+
+    def create_task(
+        self,
+        context: RequestContext,
+        *,
+        agent_id: str,
+        action: str,
+        payload: Mapping[str, Any] | None = None,
+        idempotency_key: str | None = None,
+    ) -> TaskRecord:
+        self._authorize(
+            context,
+            "task.create",
+            {"resource_type": "task", "resource_id": idempotency_key or "new"},
+        )
+        agent = self.get_agent(context, agent_id)
+        if not agent.enabled:
+            raise ControlPlaneError("agent is disabled")
+        if action not in agent.capabilities and "*" not in agent.capabilities:
+            raise PolicyDenied(f"agent does not advertise capability: {action}")
+        normalized_payload = copy.deepcopy(dict(payload or {}))
+        request_digest = _canonical_digest(
+            {"agent_id": agent_id, "action": action, "payload": normalized_payload}
+        )
+        normalized_key = idempotency_key.strip() if idempotency_key else None
+        with self.store.lock:
+            if normalized_key:
+                idempotency_ref = (context.tenant_id, normalized_key)
+                existing = self.store.idempotency.get(idempotency_ref)
+                if existing is not None:
+                    existing_task_id, existing_digest = existing
+                    if existing_digest != request_digest:
+                        raise IdempotencyConflict(
+                            "idempotency key was reused with a different request"
+                        )
+                    return self.store.tasks[existing_task_id]
+            task = TaskRecord(
+                task_id=_new_id("task"),
+                tenant_id=context.tenant_id,
+                agent_id=agent_id,
+                action=action,
+                payload=normalized_payload,
+                idempotency_key=normalized_key,
+                request_digest=request_digest,
+                created_by=context.principal_id,
+            )
+            self.store.tasks[task.task_id] = task
+            if normalized_key:
+                self.store.idempotency[(context.tenant_id, normalized_key)] = (
+                    task.task_id,
+                    request_digest,
+                )
+            self._audit(
+                context,
+                action="task.create",
+                resource_type="task",
+                resource_id=task.task_id,
+                outcome="allowed",
+                details={"agent_id": agent_id, "action": action},
+            )
+            return task
+
+    def get_task(self, context: RequestContext, task_id: str) -> TaskRecord:
+        self._authorize(
+            context,
+            "task.read",
+            {"resource_type": "task", "resource_id": task_id},
+        )
+        with self.store.lock:
+            task = self.store.tasks.get(task_id)
+            if task is None:
+                raise NotFound("task not found")
+            self._assert_same_tenant(context, task.tenant_id)
+            return task
+
+    def list_tasks(
+        self,
+        context: RequestContext,
+        *,
+        states: Iterable[TaskState | str] | None = None,
+    ) -> list[TaskRecord]:
+        self._authorize(
+            context,
+            "task.read",
+            {"resource_type": "task_collection", "resource_id": context.tenant_id},
+        )
+        state_filter = (
+            {TaskState(item) for item in states}
+            if states is not None
+            else None
+        )
+        with self.store.lock:
+            return [
+                task
+                for task in self.store.tasks.values()
+                if task.tenant_id == context.tenant_id
+                and (state_filter is None or task.state in state_filter)
+            ]
+
+    def transition_task(
+        self,
+        context: RequestContext,
+        *,
+        task_id: str,
+        target_state: TaskState | str,
+        expected_revision: int | None = None,
+        result: Mapping[str, Any] | None = None,
+        error: Mapping[str, Any] | None = None,
+    ) -> TaskRecord:
+        target = TaskState(target_state)
+        action_name = {
+            TaskState.APPROVED: "task.approve",
+            TaskState.RUNNING: "task.start",
+            TaskState.COMPLETED: "task.complete",
+            TaskState.FAILED: "task.fail",
+            TaskState.CANCELLED: "task.cancel",
+        }.get(target)
+        if action_name is None:
+            raise InvalidTransition(f"cannot transition to {target.value}")
+        self._authorize(
+            context,
+            action_name,
+            {"resource_type": "task", "resource_id": task_id},
+        )
+        with self.store.lock:
+            current = self.store.tasks.get(task_id)
+            if current is None:
+                raise NotFound("task not found")
+            self._assert_same_tenant(context, current.tenant_id)
+            if expected_revision is not None and current.revision != expected_revision:
+                raise RevisionConflict(
+                    f"expected revision {expected_revision}, current {current.revision}"
+                )
+            if target not in ALLOWED_TASK_TRANSITIONS[current.state]:
+                raise InvalidTransition(
+                    f"invalid transition {current.state.value} -> {target.value}"
+                )
+            if target == TaskState.COMPLETED and result is None:
+                raise ValueError("completed task requires result")
+            if target == TaskState.FAILED and error is None:
+                raise ValueError("failed task requires error")
+            updated = TaskRecord(
+                task_id=current.task_id,
+                tenant_id=current.tenant_id,
+                agent_id=current.agent_id,
+                action=current.action,
+                payload=current.payload,
+                state=target,
+                revision=current.revision + 1,
+                idempotency_key=current.idempotency_key,
+                request_digest=current.request_digest,
+                result=copy.deepcopy(dict(result)) if result is not None else current.result,
+                error=copy.deepcopy(dict(error)) if error is not None else current.error,
+                created_by=current.created_by,
+                approved_by=(
+                    context.principal_id
+                    if target == TaskState.APPROVED
+                    else current.approved_by
+                ),
+                created_at=current.created_at,
+                updated_at=_utc_now(),
+            )
+            self.store.tasks[task_id] = updated
+            self._audit(
+                context,
+                action=action_name,
+                resource_type="task",
+                resource_id=task_id,
+                outcome="allowed",
+                details={
+                    "from": current.state.value,
+                    "to": target.value,
+                    "revision": updated.revision,
+                },
+            )
+            return updated
+
+    def list_audit_events(
+        self,
+        context: RequestContext,
+        *,
+        resource_id: str | None = None,
+    ) -> list[AuditEvent]:
+        self._authorize(
+            context,
+            "audit.read",
+            {"resource_type": "audit", "resource_id": resource_id or context.tenant_id},
+        )
+        with self.store.lock:
+            return [
+                event
+                for event in self.store.audit_events
+                if event.tenant_id == context.tenant_id
+                and (resource_id is None or event.resource_id == resource_id)
+            ]
@@ -0,0 +1,379 @@
+"""AIOS V2 持久化 Dispatch 记录。
+
+Dispatch 是 AIOS Task 与 Runtime command/job 之间的唯一可信绑定。所有结果回写
+必须匹配 tenant/task/trace/runtime_execution/provenance/run/principal。
+"""
+from __future__ import annotations
+
+import json
+import sqlite3
+import threading
+import uuid
+from dataclasses import asdict, dataclass, replace
+from datetime import datetime, timezone
+from enum import Enum
+from pathlib import Path
+from typing import Any, Mapping, Protocol
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _required(value: str, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+class DispatchState(str, Enum):
+    PREPARED = "PREPARED"
+    RUNNING = "RUNNING"
+    QUEUED = "QUEUED"
+    COMPLETED = "COMPLETED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
+
+
+TERMINAL_DISPATCH_STATES = frozenset(
+    {DispatchState.COMPLETED, DispatchState.FAILED, DispatchState.CANCELLED}
+)
+
+
+@dataclass(frozen=True)
+class DispatchRecord:
+    dispatch_id: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    principal_id: str
+    runtime: str
+    runtime_execution_id: str
+    trace_id: str
+    provenance_id: str
+    run_id: str
+    authorization_id: str
+    state: DispatchState = DispatchState.PREPARED
+    expected_worker_id: str | None = None
+    result_digest: str | None = None
+    created_at: str = ""
+    updated_at: str = ""
+    completed_at: str | None = None
+
+    def __post_init__(self) -> None:
+        for name in (
+            "dispatch_id",
+            "tenant_id",
+            "task_id",
+            "agent_id",
+            "principal_id",
+            "runtime",
+            "runtime_execution_id",
+            "trace_id",
+            "provenance_id",
+            "run_id",
+            "authorization_id",
+        ):
+            object.__setattr__(self, name, _required(getattr(self, name), name))
+        object.__setattr__(self, "state", DispatchState(self.state))
+        now = utc_now()
+        object.__setattr__(self, "created_at", self.created_at or now)
+        object.__setattr__(self, "updated_at", self.updated_at or now)
+        if self.expected_worker_id is not None:
+            object.__setattr__(
+                self,
+                "expected_worker_id",
+                _required(self.expected_worker_id, "expected_worker_id"),
+            )
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        tenant_id: str,
+        task_id: str,
+        agent_id: str,
+        principal_id: str,
+        runtime: str,
+        runtime_execution_id: str,
+        trace_id: str,
+        provenance_id: str,
+        run_id: str,
+        authorization_id: str,
+    ) -> "DispatchRecord":
+        return cls(
+            dispatch_id=f"dispatch_{uuid.uuid4().hex}",
+            tenant_id=tenant_id,
+            task_id=task_id,
+            agent_id=agent_id,
+            principal_id=principal_id,
+            runtime=runtime,
+            runtime_execution_id=runtime_execution_id,
+            trace_id=trace_id,
+            provenance_id=provenance_id,
+            run_id=run_id,
+            authorization_id=authorization_id,
+        )
+
+    def as_dict(self) -> dict[str, Any]:
+        value = asdict(self)
+        value["state"] = self.state.value
+        return value
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "DispatchRecord":
+        return cls(**dict(value))
+
+
+class DispatchConflict(RuntimeError):
+    pass
+
+
+class DispatchNotFound(RuntimeError):
+    pass
+
+
+class DispatchRepository(Protocol):
+    def create(self, record: DispatchRecord) -> DispatchRecord: ...
+    def get(self, dispatch_id: str, *, tenant_id: str) -> DispatchRecord: ...
+    def get_by_task(self, task_id: str, *, tenant_id: str) -> DispatchRecord | None: ...
+    def get_by_runtime_execution(
+        self, runtime_execution_id: str, *, tenant_id: str
+    ) -> DispatchRecord | None: ...
+    def update(
+        self,
+        dispatch_id: str,
+        *,
+        tenant_id: str,
+        state: DispatchState | str | None = None,
+        expected_worker_id: str | None = None,
+        result_digest: str | None = None,
+    ) -> DispatchRecord: ...
+    def list(self, *, tenant_id: str) -> list[DispatchRecord]: ...
+
+
+class InMemoryDispatchRepository:
+    def __init__(self) -> None:
+        self._lock = threading.RLock()
+        self._records: dict[str, DispatchRecord] = {}
+        self._by_task: dict[tuple[str, str], str] = {}
+        self._by_runtime: dict[tuple[str, str], str] = {}
+
+    def create(self, record: DispatchRecord) -> DispatchRecord:
+        with self._lock:
+            task_ref = (record.tenant_id, record.task_id)
+            runtime_ref = (record.tenant_id, record.runtime_execution_id)
+            if task_ref in self._by_task or runtime_ref in self._by_runtime:
+                existing = self.get_by_task(record.task_id, tenant_id=record.tenant_id)
+                if existing == record:
+                    return record
+                raise DispatchConflict("task or runtime execution already has a dispatch")
+            self._records[record.dispatch_id] = record
+            self._by_task[task_ref] = record.dispatch_id
+            self._by_runtime[runtime_ref] = record.dispatch_id
+            return record
+
+    def get(self, dispatch_id: str, *, tenant_id: str) -> DispatchRecord:
+        with self._lock:
+            record = self._records.get(dispatch_id)
+            if record is None or record.tenant_id != tenant_id:
+                raise DispatchNotFound("dispatch not found")
+            return record
+
+    def get_by_task(self, task_id: str, *, tenant_id: str) -> DispatchRecord | None:
+        with self._lock:
+            dispatch_id = self._by_task.get((tenant_id, task_id))
+            return self._records.get(dispatch_id) if dispatch_id else None
+
+    def get_by_runtime_execution(
+        self, runtime_execution_id: str, *, tenant_id: str
+    ) -> DispatchRecord | None:
+        with self._lock:
+            dispatch_id = self._by_runtime.get((tenant_id, runtime_execution_id))
+            return self._records.get(dispatch_id) if dispatch_id else None
+
+    def update(
+        self,
+        dispatch_id: str,
+        *,
+        tenant_id: str,
+        state: DispatchState | str | None = None,
+        expected_worker_id: str | None = None,
+        result_digest: str | None = None,
+    ) -> DispatchRecord:
+        with self._lock:
+            current = self.get(dispatch_id, tenant_id=tenant_id)
+            target = DispatchState(state) if state is not None else current.state
+            if current.state in TERMINAL_DISPATCH_STATES and target != current.state:
+                raise DispatchConflict("terminal dispatch cannot transition")
+            updated = replace(
+                current,
+                state=target,
+                expected_worker_id=(
+                    expected_worker_id
+                    if expected_worker_id is not None
+                    else current.expected_worker_id
+                ),
+                result_digest=result_digest or current.result_digest,
+                updated_at=utc_now(),
+                completed_at=(utc_now() if target in TERMINAL_DISPATCH_STATES else None),
+            )
+            self._records[dispatch_id] = updated
+            return updated
+
+    def list(self, *, tenant_id: str) -> list[DispatchRecord]:
+        with self._lock:
+            return sorted(
+                [item for item in self._records.values() if item.tenant_id == tenant_id],
+                key=lambda item: (item.created_at, item.dispatch_id),
+            )
+
+
+class SQLiteDispatchRepository:
+    SCHEMA_VERSION = 1
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+        with self._connect() as connection:
+            connection.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS dispatch_records (
+                    dispatch_id TEXT PRIMARY KEY,
+                    tenant_id TEXT NOT NULL,
+                    task_id TEXT NOT NULL,
+                    runtime_execution_id TEXT NOT NULL,
+                    payload_json TEXT NOT NULL,
+                    state TEXT NOT NULL,
+                    updated_at TEXT NOT NULL,
+                    UNIQUE(tenant_id, task_id),
+                    UNIQUE(tenant_id, runtime_execution_id)
+                );
+                CREATE INDEX IF NOT EXISTS idx_dispatch_tenant_state
+                    ON dispatch_records(tenant_id, state, updated_at);
+                """
+            )
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(str(self.path), timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        return connection
+
+    @staticmethod
+    def _encode(record: DispatchRecord) -> str:
+        return json.dumps(
+            record.as_dict(), ensure_ascii=False, sort_keys=True, separators=(",", ":")
+        )
+
+    @staticmethod
+    def _decode(row: sqlite3.Row) -> DispatchRecord:
+        value = json.loads(row["payload_json"])
+        if not isinstance(value, Mapping):
+            raise RuntimeError("invalid dispatch record")
+        return DispatchRecord.from_dict(value)
+
+    def create(self, record: DispatchRecord) -> DispatchRecord:
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                connection.execute(
+                    "INSERT INTO dispatch_records VALUES (?, ?, ?, ?, ?, ?, ?)",
+                    (
+                        record.dispatch_id,
+                        record.tenant_id,
+                        record.task_id,
+                        record.runtime_execution_id,
+                        self._encode(record),
+                        record.state.value,
+                        record.updated_at,
+                    ),
+                )
+                connection.commit()
+                return record
+            except sqlite3.IntegrityError as exc:
+                connection.rollback()
+                existing = self.get_by_task(record.task_id, tenant_id=record.tenant_id)
+                if existing is not None and existing == record:
+                    return existing
+                raise DispatchConflict("task or runtime execution already has a dispatch") from exc
+
+    def get(self, dispatch_id: str, *, tenant_id: str) -> DispatchRecord:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT payload_json FROM dispatch_records WHERE dispatch_id = ? AND tenant_id = ?",
+                (_required(dispatch_id, "dispatch_id"), _required(tenant_id, "tenant_id")),
+            ).fetchone()
+        if row is None:
+            raise DispatchNotFound("dispatch not found")
+        return self._decode(row)
+
+    def get_by_task(self, task_id: str, *, tenant_id: str) -> DispatchRecord | None:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT payload_json FROM dispatch_records WHERE task_id = ? AND tenant_id = ?",
+                (_required(task_id, "task_id"), _required(tenant_id, "tenant_id")),
+            ).fetchone()
+        return self._decode(row) if row is not None else None
+
+    def get_by_runtime_execution(
+        self, runtime_execution_id: str, *, tenant_id: str
+    ) -> DispatchRecord | None:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT payload_json FROM dispatch_records WHERE runtime_execution_id = ? AND tenant_id = ?",
+                (
+                    _required(runtime_execution_id, "runtime_execution_id"),
+                    _required(tenant_id, "tenant_id"),
+                ),
+            ).fetchone()
+        return self._decode(row) if row is not None else None
+
+    def update(
+        self,
+        dispatch_id: str,
+        *,
+        tenant_id: str,
+        state: DispatchState | str | None = None,
+        expected_worker_id: str | None = None,
+        result_digest: str | None = None,
+    ) -> DispatchRecord:
+        current = self.get(dispatch_id, tenant_id=tenant_id)
+        target = DispatchState(state) if state is not None else current.state
+        if current.state in TERMINAL_DISPATCH_STATES and target != current.state:
+            raise DispatchConflict("terminal dispatch cannot transition")
+        updated = replace(
+            current,
+            state=target,
+            expected_worker_id=(
+                expected_worker_id if expected_worker_id is not None else current.expected_worker_id
+            ),
+            result_digest=result_digest or current.result_digest,
+            updated_at=utc_now(),
+            completed_at=(utc_now() if target in TERMINAL_DISPATCH_STATES else None),
+        )
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            connection.execute(
+                "UPDATE dispatch_records SET payload_json = ?, state = ?, updated_at = ? WHERE dispatch_id = ? AND tenant_id = ?",
+                (
+                    self._encode(updated),
+                    updated.state.value,
+                    updated.updated_at,
+                    updated.dispatch_id,
+                    updated.tenant_id,
+                ),
+            )
+            connection.commit()
+        return updated
+
+    def list(self, *, tenant_id: str) -> list[DispatchRecord]:
+        with self._lock, self._connect() as connection:
+            rows = connection.execute(
+                "SELECT payload_json FROM dispatch_records WHERE tenant_id = ? ORDER BY updated_at, dispatch_id",
+                (_required(tenant_id, "tenant_id"),),
+            ).fetchall()
+        return [self._decode(row) for row in rows]
@@ -0,0 +1,543 @@
+"""Portable multi-provider execution plans and aggregate release gates.
+
+A plan is a DAG of executor-neutral stages. Only root stages are declared at
+plan creation. A dependent stage is declared atomically after every dependency
+passes its Truth + notification gate, so its start deadline cannot expire while
+it is legitimately waiting for upstream work.
+"""
+from __future__ import annotations
+
+import json
+import sqlite3
+import threading
+from dataclasses import asdict, dataclass, field
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .executor_protocol import ExecutorProviderRegistry, normalize_executor
+from .external_task_control import ExternalTaskCoordinator
+from .external_task_query import list_records
+from .task_execution_registry import (
+    ExecutionTaskManifest,
+    ExecutionTruthRecord,
+    ExecutionTruthState,
+    required,
+    utc_now,
+)
+
+PLAN_SCHEMA_VERSION = "aios.execution-plan.v2"
+WAITING_DEPENDENCY = "WAITING_DEPENDENCY"
+
+
+@dataclass(frozen=True)
+class ExecutionStageManifest:
+    stage_id: str
+    task_id: str
+    executor_type: str
+    role: str
+    steps: Sequence[str]
+    depends_on: Sequence[str] = ()
+    required_evidence: Sequence[str] = ()
+    notification_events: Sequence[str] = ("STARTED", "SUCCEEDED", "FAILED")
+    owner_notification_ref: str = "AIOS_OWNER_WECHAT_TARGET_REF"
+    start_deadline_seconds: int = 300
+    heartbeat_timeout_seconds: int = 180
+    required: bool = True
+    metadata: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        for name in ("stage_id", "task_id", "role", "owner_notification_ref"):
+            object.__setattr__(self, name, required(getattr(self, name), name))
+        object.__setattr__(self, "executor_type", normalize_executor(self.executor_type))
+        steps = tuple(required(item, "step") for item in self.steps)
+        if not steps:
+            raise ValueError("execution stage requires at least one step")
+        object.__setattr__(self, "steps", steps)
+        object.__setattr__(
+            self,
+            "depends_on",
+            tuple(sorted({required(item, "depends_on") for item in self.depends_on})),
+        )
+        object.__setattr__(
+            self,
+            "required_evidence",
+            tuple(sorted({required(item, "required_evidence") for item in self.required_evidence})),
+        )
+        object.__setattr__(
+            self,
+            "notification_events",
+            tuple(sorted({required(item, "notification_event") for item in self.notification_events})),
+        )
+        if self.start_deadline_seconds < 1 or self.heartbeat_timeout_seconds < 1:
+            raise ValueError("stage deadlines must be positive")
+        object.__setattr__(
+            self,
+            "metadata",
+            json.loads(json.dumps(dict(self.metadata), ensure_ascii=False, default=str)),
+        )
+
+    def as_dict(self) -> dict[str, Any]:
+        value = asdict(self)
+        value["steps"] = list(self.steps)
+        value["depends_on"] = list(self.depends_on)
+        value["required_evidence"] = list(self.required_evidence)
+        value["notification_events"] = list(self.notification_events)
+        return value
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ExecutionStageManifest":
+        return cls(**dict(value))
+
+
+@dataclass(frozen=True)
+class ExecutionPlanManifest:
+    plan_id: str
+    source_branch: str
+    source_oid: str
+    target_version: str
+    stages: Sequence[ExecutionStageManifest]
+    release_gate_policy: str = "all_required_stages"
+    schema_version: str = PLAN_SCHEMA_VERSION
+    metadata: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        for name in ("plan_id", "source_branch", "source_oid", "target_version"):
+            object.__setattr__(self, name, required(getattr(self, name), name))
+        if self.schema_version != PLAN_SCHEMA_VERSION:
+            raise ValueError("unsupported execution plan schema")
+        if self.release_gate_policy != "all_required_stages":
+            raise ValueError("unsupported release gate policy")
+        stages = tuple(self.stages)
+        if not stages:
+            raise ValueError("execution plan requires stages")
+        stage_ids = [item.stage_id for item in stages]
+        task_ids = [item.task_id for item in stages]
+        if len(stage_ids) != len(set(stage_ids)):
+            raise ValueError("execution plan stage_id values must be unique")
+        if len(task_ids) != len(set(task_ids)):
+            raise ValueError("execution plan task_id values must be unique")
+        known = set(stage_ids)
+        for stage in stages:
+            unknown = sorted(set(stage.depends_on) - known)
+            if unknown:
+                raise ValueError(f"stage {stage.stage_id} has unknown dependencies: {unknown}")
+            if stage.stage_id in stage.depends_on:
+                raise ValueError("stage cannot depend on itself")
+        self._assert_acyclic(stages)
+        object.__setattr__(self, "stages", stages)
+        object.__setattr__(
+            self,
+            "metadata",
+            json.loads(json.dumps(dict(self.metadata), ensure_ascii=False, default=str)),
+        )
+
+    @staticmethod
+    def _assert_acyclic(stages: Sequence[ExecutionStageManifest]) -> None:
+        dependencies = {item.stage_id: set(item.depends_on) for item in stages}
+        resolved: set[str] = set()
+        while len(resolved) < len(stages):
+            ready = {
+                stage_id
+                for stage_id, deps in dependencies.items()
+                if stage_id not in resolved and deps.issubset(resolved)
+            }
+            if not ready:
+                raise ValueError("execution plan contains a dependency cycle")
+            resolved.update(ready)
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "plan_id": self.plan_id,
+            "source_branch": self.source_branch,
+            "source_oid": self.source_oid,
+            "target_version": self.target_version,
+            "release_gate_policy": self.release_gate_policy,
+            "stages": [item.as_dict() for item in self.stages],
+            "metadata": dict(self.metadata),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ExecutionPlanManifest":
+        raw = dict(value)
+        raw["stages"] = tuple(
+            ExecutionStageManifest.from_dict(item) for item in raw.get("stages") or ()
+        )
+        return cls(**raw)
+
+    def stage(self, stage_id: str) -> ExecutionStageManifest:
+        normalized = required(stage_id, "stage_id")
+        for stage in self.stages:
+            if stage.stage_id == normalized:
+                return stage
+        raise KeyError(f"execution stage not found: {normalized}")
+
+
+class SQLiteExecutionPlanStore:
+    """Durable plan declarations; stage state remains in Truth Registry."""
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+        with self._connect() as connection:
+            connection.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS execution_plans (
+                    plan_id TEXT PRIMARY KEY,
+                    manifest_json TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    updated_at TEXT NOT NULL
+                );
+                """
+            )
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(str(self.path), timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        return connection
+
+    @staticmethod
+    def _encode(plan: ExecutionPlanManifest) -> str:
+        return json.dumps(
+            plan.as_dict(),
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+        )
+
+    def save(
+        self,
+        plan: ExecutionPlanManifest,
+        *,
+        allow_source_oid_supersession: bool = False,
+    ) -> None:
+        payload = self._encode(plan)
+        now = utc_now()
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            existing = connection.execute(
+                "SELECT manifest_json FROM execution_plans WHERE plan_id = ?",
+                (plan.plan_id,),
+            ).fetchone()
+            if existing is not None:
+                if existing["manifest_json"] != payload:
+                    previous = json.loads(existing["manifest_json"])
+                    replacement = plan.as_dict()
+                    previous_oid = previous.pop("source_oid", None)
+                    replacement_oid = replacement.pop("source_oid", None)
+                    if (
+                        not allow_source_oid_supersession
+                        or previous != replacement
+                        or previous_oid == replacement_oid
+                    ):
+                        connection.rollback()
+                        raise RuntimeError(
+                            "plan_id already exists with another manifest"
+                        )
+                    connection.execute(
+                        "UPDATE execution_plans SET manifest_json = ?, updated_at = ? WHERE plan_id = ?",
+                        (payload, now, plan.plan_id),
+                    )
+                    connection.commit()
+                    return
+                connection.rollback()
+                return
+            connection.execute(
+                "INSERT INTO execution_plans VALUES (?, ?, ?, ?)",
+                (plan.plan_id, payload, now, now),
+            )
+            connection.commit()
+
+    def get(self, plan_id: str) -> ExecutionPlanManifest:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT manifest_json FROM execution_plans WHERE plan_id = ?",
+                (required(plan_id, "plan_id"),),
+            ).fetchone()
+        if row is None:
+            raise KeyError("execution plan not found")
+        value = json.loads(row["manifest_json"])
+        if not isinstance(value, Mapping):
+            raise ValueError("stored execution plan is invalid")
+        return ExecutionPlanManifest.from_dict(value)
+
+    def list(self) -> list[ExecutionPlanManifest]:
+        with self._lock, self._connect() as connection:
+            rows = connection.execute(
+                "SELECT manifest_json FROM execution_plans ORDER BY created_at, plan_id"
+            ).fetchall()
+        return [
+            ExecutionPlanManifest.from_dict(json.loads(row["manifest_json"]))
+            for row in rows
+        ]
+
+
+class ExecutionPlanCoordinator:
+    """Declares dependency-ready stages and evaluates aggregate release gates."""
+
+    def __init__(
+        self,
+        *,
+        task_coordinator: ExternalTaskCoordinator,
+        plan_store: SQLiteExecutionPlanStore,
+        providers: ExecutorProviderRegistry,
+    ) -> None:
+        self.task_coordinator = task_coordinator
+        self.plan_store = plan_store
+        self.providers = providers
+
+    @classmethod
+    def from_file(
+        cls,
+        path: str | Path,
+        *,
+        providers: ExecutorProviderRegistry,
+    ) -> "ExecutionPlanCoordinator":
+        return cls(
+            task_coordinator=ExternalTaskCoordinator.from_file(path),
+            plan_store=SQLiteExecutionPlanStore(path),
+            providers=providers,
+        )
+
+    @staticmethod
+    def _task_manifest(
+        plan: ExecutionPlanManifest,
+        stage: ExecutionStageManifest,
+    ) -> ExecutionTaskManifest:
+        return ExecutionTaskManifest(
+            task_id=stage.task_id,
+            executor=stage.executor_type,
+            source_branch=plan.source_branch,
+            source_oid=plan.source_oid,
+            target_version=plan.target_version,
+            steps=stage.steps,
+            start_deadline_seconds=stage.start_deadline_seconds,
+            heartbeat_timeout_seconds=stage.heartbeat_timeout_seconds,
+            required_evidence=stage.required_evidence,
+            notification_events=stage.notification_events,
+            owner_notification_ref=stage.owner_notification_ref,
+            manifest_version="aios.external-task.v2",
+        )
+
+    def _record(self, task_id: str) -> ExecutionTruthRecord | None:
+        try:
+            return self.task_coordinator.registry.get(task_id)
+        except KeyError:
+            return None
+
+    def _declare_stage(
+        self,
+        plan: ExecutionPlanManifest,
+        stage: ExecutionStageManifest,
+    ) -> ExecutionTruthRecord:
+        self.providers.validate_manifest(self._task_manifest(plan, stage))
+        return self.task_coordinator.declare(self._task_manifest(plan, stage))
+
+    def declare(self, plan: ExecutionPlanManifest) -> Mapping[str, Any]:
+        for stage in plan.stages:
+            self.providers.get(stage.executor_type)
+        allow_source_oid_supersession = False
+        try:
+            previous = self.plan_store.get(plan.plan_id)
+        except KeyError:
+            previous = None
+        if previous is not None and previous.source_oid != plan.source_oid:
+            previous_value = previous.as_dict()
+            replacement_value = plan.as_dict()
+            previous_value.pop("source_oid")
+            replacement_value.pop("source_oid")
+            root_records = [
+                self._record(stage.task_id)
+                for stage in previous.stages
+                if not stage.depends_on
+            ]
+            allow_source_oid_supersession = bool(
+                previous_value == replacement_value
+                and root_records
+                and all(
+                    record is not None
+                    and record.state == ExecutionTruthState.NOT_STARTED
+                    for record in root_records
+                )
+            )
+        self.plan_store.save(
+            plan,
+            allow_source_oid_supersession=allow_source_oid_supersession,
+        )
+        for stage in plan.stages:
+            if not stage.depends_on:
+                self._declare_stage(plan, stage)
+        return self.snapshot(plan.plan_id)
+
+    def declare_file(self, path: str | Path) -> Mapping[str, Any]:
+        value = json.loads(Path(path).read_text(encoding="utf-8"))
+        if not isinstance(value, Mapping):
+            raise ValueError("execution plan file must contain a JSON object")
+        return self.declare(ExecutionPlanManifest.from_dict(value))
+
+    def dependency_gate(self, plan_id: str, stage_id: str) -> Mapping[str, Any]:
+        plan = self.plan_store.get(plan_id)
+        stage = plan.stage(stage_id)
+        dependencies: list[Mapping[str, Any]] = []
+        passed = True
+        for dependency_id in stage.depends_on:
+            dependency = plan.stage(dependency_id)
+            record = self._record(dependency.task_id)
+            if record is None:
+                gate: Mapping[str, Any] = {
+                    "task_id": dependency.task_id,
+                    "state": WAITING_DEPENDENCY,
+                    "passed": False,
+                    "release_blocking": True,
+                }
+            else:
+                gate = self.task_coordinator.gate(dependency.task_id)
+            dependencies.append(
+                {
+                    "stage_id": dependency.stage_id,
+                    "task_id": dependency.task_id,
+                    "gate": gate,
+                }
+            )
+            if not gate["passed"]:
+                passed = False
+        return {
+            "plan_id": plan.plan_id,
+            "stage_id": stage.stage_id,
+            "passed": passed,
+            "release_blocking": not passed,
+            "dependencies": dependencies,
+        }
+
+    def activate_ready(self, plan_id: str) -> list[Mapping[str, Any]]:
+        plan = self.plan_store.get(plan_id)
+        activated: list[Mapping[str, Any]] = []
+        for stage in plan.stages:
+            if self._record(stage.task_id) is not None:
+                continue
+            dependency = self.dependency_gate(plan.plan_id, stage.stage_id)
+            if not dependency["passed"]:
+                continue
+            record = self._declare_stage(plan, stage)
+            activated.append(
+                {
+                    "stage_id": stage.stage_id,
+                    "task_id": record.task_id,
+                    "executor_type": stage.executor_type,
+                    "state": record.state.value,
+                }
+            )
+        return activated
+
+    def discover_ready(
+        self,
+        *,
+        plan_id: str,
+        executor_type: str,
+    ) -> list[Mapping[str, Any]]:
+        plan = self.plan_store.get(plan_id)
+        self.activate_ready(plan.plan_id)
+        normalized = normalize_executor(executor_type)
+        records = {
+            item.task_id: item
+            for item in list_records(
+                self.task_coordinator.registry.path,
+                executor=normalized,
+                states=(
+                    ExecutionTruthState.DECLARED.value,
+                    ExecutionTruthState.REGISTERED.value,
+                ),
+            )
+        }
+        ready: list[Mapping[str, Any]] = []
+        for stage in plan.stages:
+            if stage.executor_type != normalized or stage.task_id not in records:
+                continue
+            dependency = self.dependency_gate(plan.plan_id, stage.stage_id)
+            if dependency["passed"]:
+                ready.append(
+                    {
+                        "plan_id": plan.plan_id,
+                        "stage": stage.as_dict(),
+                        "record": records[stage.task_id].as_dict(),
+                    }
+                )
+        return ready
+
+    def snapshot(self, plan_id: str) -> Mapping[str, Any]:
+        plan = self.plan_store.get(plan_id)
+        stages: list[Mapping[str, Any]] = []
+        for stage in plan.stages:
+            record = self._record(stage.task_id)
+            dependency = self.dependency_gate(plan.plan_id, stage.stage_id)
+            if record is None:
+                truth: Mapping[str, Any] = {
+                    "task_id": stage.task_id,
+                    "state": WAITING_DEPENDENCY,
+                    "passed": False,
+                    "release_blocking": True,
+                    "executor_run_id": None,
+                    "executor_id": None,
+                    "current_step": 0,
+                    "total_steps": len(stage.steps),
+                    "evidence": {},
+                    "error": {},
+                    "notifications": [],
+                }
+            else:
+                truth = self.task_coordinator.status(stage.task_id)
+            stages.append(
+                {
+                    "stage": stage.as_dict(),
+                    "dependency_gate": dependency,
+                    "truth": truth,
+                }
+            )
+        return {
+            "manifest": plan.as_dict(),
+            "stages": stages,
+        }
+
+    def gate(self, plan_id: str) -> Mapping[str, Any]:
+        plan = self.plan_store.get(plan_id)
+        self.activate_ready(plan.plan_id)
+        stages: list[Mapping[str, Any]] = []
+        required_passed = True
+        for stage in plan.stages:
+            dependency = self.dependency_gate(plan.plan_id, stage.stage_id)
+            record = self._record(stage.task_id)
+            if record is None:
+                truth_gate: Mapping[str, Any] = {
+                    "task_id": stage.task_id,
+                    "state": WAITING_DEPENDENCY,
+                    "passed": False,
+                    "release_blocking": True,
+                }
+            else:
+                truth_gate = self.task_coordinator.gate(stage.task_id)
+            stage_passed = bool(truth_gate["passed"] and dependency["passed"])
+            if stage.required and not stage_passed:
+                required_passed = False
+            stages.append(
+                {
+                    "stage_id": stage.stage_id,
+                    "task_id": stage.task_id,
+                    "executor_type": stage.executor_type,
+                    "role": stage.role,
+                    "required": stage.required,
+                    "passed": stage_passed,
+                    "truth_gate": truth_gate,
+                    "dependency_gate": dependency,
+                }
+            )
+        return {
+            "plan_id": plan.plan_id,
+            "target_version": plan.target_version,
+            "policy": plan.release_gate_policy,
+            "passed": required_passed,
+            "release_blocking": not required_passed,
+            "stages": stages,
+        }
@@ -0,0 +1,323 @@
+"""AIOS V2 Agent 执行证据。
+
+Evidence 按租户隔离并使用原子 JSON 写入。生产模式下，claim、heartbeat
+和 complete 在落盘前必须通过最小权限 Evidence Grant 授权。
+"""
+from __future__ import annotations
+
+import json
+import os
+import threading
+from dataclasses import asdict, dataclass, field, replace
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Mapping, Protocol
+
+from .provenance import ProvenanceDenied, digest_payload
+
+
+class EvidenceAuthorizationWriter(Protocol):
+    def authorize_evidence_write(self, **values: Any) -> Any: ...
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _required(value: str, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+def _safe(value: Mapping[str, Any] | None) -> dict[str, Any]:
+    return json.loads(json.dumps(dict(value or {}), ensure_ascii=False, default=str))
+
+
+@dataclass(frozen=True)
+class ExecutionEvidence:
+    execution_id: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    executor: str
+    branch: str
+    status: str = "claimed"
+    progress_completed: int = 0
+    progress_total: int = 1
+    current_step: str = "claim"
+    last_commit: str | None = None
+    test_status: str = "not_run"
+    test_summary: Mapping[str, Any] = field(default_factory=dict)
+    result_summary: Mapping[str, Any] = field(default_factory=dict)
+    claimed_at: str = field(default_factory=utc_now)
+    heartbeat_at: str = field(default_factory=utc_now)
+    completed_at: str | None = None
+    provenance_id: str | None = None
+    run_id: str | None = None
+    last_authorization_id: str | None = None
+
+    def __post_init__(self) -> None:
+        for name in (
+            "execution_id",
+            "tenant_id",
+            "task_id",
+            "agent_id",
+            "executor",
+            "branch",
+            "status",
+            "current_step",
+            "claimed_at",
+            "heartbeat_at",
+        ):
+            object.__setattr__(self, name, _required(getattr(self, name), name))
+        if self.progress_completed < 0 or self.progress_total < 1:
+            raise ValueError("invalid progress values")
+        if self.progress_completed > self.progress_total:
+            raise ValueError("progress_completed cannot exceed progress_total")
+        object.__setattr__(self, "test_summary", _safe(self.test_summary))
+        object.__setattr__(self, "result_summary", _safe(self.result_summary))
+        for optional in ("provenance_id", "run_id", "last_authorization_id"):
+            value = getattr(self, optional)
+            object.__setattr__(self, optional, str(value).strip() if value else None)
+
+
+class ExecutionTracker:
+    """每个租户、每次执行持久保存一份证据记录。"""
+
+    def __init__(
+        self,
+        root: str | Path,
+        *,
+        provenance_writer: EvidenceAuthorizationWriter | None = None,
+        require_provenance: bool = False,
+    ) -> None:
+        self.root = Path(root).resolve()
+        self.root.mkdir(parents=True, exist_ok=True)
+        self.provenance_writer = provenance_writer
+        self.require_provenance = bool(require_provenance)
+        if self.require_provenance and self.provenance_writer is None:
+            raise ValueError("production evidence tracking requires a provenance writer")
+        self._lock = threading.RLock()
+
+    @staticmethod
+    def _component(value: str) -> str:
+        normalized = _required(value, "path component")
+        if normalized in {".", ".."} or "/" in normalized or "\\" in normalized:
+            raise ValueError("invalid evidence path component")
+        return normalized
+
+    def _path(self, tenant_id: str, execution_id: str) -> Path:
+        tenant = self._component(tenant_id)
+        execution = self._component(execution_id)
+        return self.root / tenant / f"{execution}.json"
+
+    def _authorize(
+        self,
+        evidence: ExecutionEvidence,
+        *,
+        operation: str,
+        principal_id: str | None,
+        provenance_id: str | None,
+        run_id: str | None,
+        changes: Mapping[str, Any],
+    ) -> str | None:
+        if not self.require_provenance:
+            return None
+        if self.provenance_writer is None:
+            raise RuntimeError("Run Provenance writer is not configured")
+        effective_provenance = provenance_id or evidence.provenance_id
+        effective_run = run_id or evidence.run_id
+        if not effective_provenance or not effective_run or not principal_id:
+            raise RuntimeError(
+                "production evidence write requires provenance_id, run_id and principal_id"
+            )
+        request_digest = digest_payload(
+            {
+                "operation": operation,
+                "execution_id": evidence.execution_id,
+                "tenant_id": evidence.tenant_id,
+                "task_id": evidence.task_id,
+                "agent_id": evidence.agent_id,
+                "executor": evidence.executor,
+                "branch": evidence.branch,
+                "changes": dict(changes),
+            }
+        )
+        try:
+            authorization = self.provenance_writer.authorize_evidence_write(
+                provenance_id=effective_provenance,
+                run_id=effective_run,
+                tenant_id=evidence.tenant_id,
+                task_id=evidence.task_id,
+                agent_id=evidence.agent_id,
+                principal_id=principal_id,
+                request_digest=request_digest,
+            )
+        except ProvenanceDenied as exc:
+            raise RuntimeError(f"Run Provenance denied evidence write: {exc}") from exc
+        return authorization.authorization_id
+
+    def claim(
+        self,
+        evidence: ExecutionEvidence,
+        *,
+        principal_id: str | None = None,
+        provenance_id: str | None = None,
+        run_id: str | None = None,
+    ) -> ExecutionEvidence:
+        path = self._path(evidence.tenant_id, evidence.execution_id)
+        with self._lock:
+            if path.exists():
+                current = self._read(path)
+                if current.task_id != evidence.task_id or current.agent_id != evidence.agent_id:
+                    raise RuntimeError("execution_id already belongs to another task")
+                if self.require_provenance and (
+                    current.provenance_id != (provenance_id or evidence.provenance_id)
+                    or current.run_id != (run_id or evidence.run_id)
+                ):
+                    raise RuntimeError(
+                        "execution_id already belongs to another provenance context"
+                    )
+                return current
+            effective_provenance = provenance_id or evidence.provenance_id
+            effective_run = run_id or evidence.run_id
+            authorization_id = self._authorize(
+                evidence,
+                operation="claim",
+                principal_id=principal_id,
+                provenance_id=effective_provenance,
+                run_id=effective_run,
+                changes={"status": evidence.status, "current_step": evidence.current_step},
+            )
+            persisted = replace(
+                evidence,
+                provenance_id=effective_provenance,
+                run_id=effective_run,
+                last_authorization_id=authorization_id,
+            )
+            self._write(path, persisted)
+            return persisted
+
+    def heartbeat(
+        self,
+        *,
+        tenant_id: str,
+        execution_id: str,
+        status: str | None = None,
+        current_step: str | None = None,
+        progress_completed: int | None = None,
+        progress_total: int | None = None,
+        last_commit: str | None = None,
+        principal_id: str | None = None,
+        provenance_id: str | None = None,
+        run_id: str | None = None,
+    ) -> ExecutionEvidence:
+        path = self._path(tenant_id, execution_id)
+        with self._lock:
+            current = self._read(path)
+            changes = {
+                "status": status or current.status,
+                "current_step": current_step or current.current_step,
+                "progress_completed": (
+                    progress_completed
+                    if progress_completed is not None
+                    else current.progress_completed
+                ),
+                "progress_total": (
+                    progress_total if progress_total is not None else current.progress_total
+                ),
+                "last_commit": last_commit or current.last_commit,
+            }
+            authorization_id = self._authorize(
+                current,
+                operation="heartbeat",
+                principal_id=principal_id,
+                provenance_id=provenance_id,
+                run_id=run_id,
+                changes=changes,
+            )
+            updated = replace(
+                current,
+                **changes,
+                last_authorization_id=authorization_id or current.last_authorization_id,
+                heartbeat_at=utc_now(),
+            )
+            self._write(path, updated)
+            return updated
+
+    def complete(
+        self,
+        *,
+        tenant_id: str,
+        execution_id: str,
+        status: str,
+        test_status: str,
+        test_summary: Mapping[str, Any] | None = None,
+        result_summary: Mapping[str, Any] | None = None,
+        last_commit: str | None = None,
+        principal_id: str | None = None,
+        provenance_id: str | None = None,
+        run_id: str | None = None,
+    ) -> ExecutionEvidence:
+        path = self._path(tenant_id, execution_id)
+        with self._lock:
+            current = self._read(path)
+            changes = {
+                "status": _required(status, "status"),
+                "current_step": "complete",
+                "progress_completed": current.progress_total,
+                "last_commit": last_commit or current.last_commit,
+                "test_status": _required(test_status, "test_status"),
+                "test_summary": _safe(test_summary),
+                "result_summary": _safe(result_summary),
+            }
+            authorization_id = self._authorize(
+                current,
+                operation="complete",
+                principal_id=principal_id,
+                provenance_id=provenance_id,
+                run_id=run_id,
+                changes=changes,
+            )
+            updated = replace(
+                current,
+                **changes,
+                last_authorization_id=authorization_id or current.last_authorization_id,
+                heartbeat_at=utc_now(),
+                completed_at=utc_now(),
+            )
+            self._write(path, updated)
+            return updated
+
+    def get(self, *, tenant_id: str, execution_id: str) -> ExecutionEvidence:
+        return self._read(self._path(tenant_id, execution_id))
+
+    def list(self, *, tenant_id: str) -> list[ExecutionEvidence]:
+        tenant_dir = self.root / self._component(tenant_id)
+        if not tenant_dir.exists():
+            return []
+        records = [self._read(path) for path in tenant_dir.glob("*.json")]
+        return sorted(records, key=lambda item: (item.heartbeat_at, item.execution_id), reverse=True)
+
+    @staticmethod
+    def _read(path: Path) -> ExecutionEvidence:
+        try:
+            value = json.loads(path.read_text(encoding="utf-8"))
+        except FileNotFoundError as exc:
+            raise KeyError("execution evidence not found") from exc
+        if not isinstance(value, Mapping):
+            raise RuntimeError("invalid execution evidence file")
+        return ExecutionEvidence(**dict(value))
+
+    @staticmethod
+    def _write(path: Path, evidence: ExecutionEvidence) -> None:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        temporary = path.with_suffix(f".tmp-{os.getpid()}")
+        temporary.write_text(
+            json.dumps(asdict(evidence), ensure_ascii=False, sort_keys=True, indent=2) + "\n",
+            encoding="utf-8",
+        )
+        os.chmod(temporary, 0o640)
+        os.replace(temporary, path)
@@ -0,0 +1,204 @@
+"""Persistent and portable AIOS executor provider catalog.
+
+The catalog contains descriptors only: provider names, protocol/adapter versions,
+trust roles, capabilities and configuration schema identifiers. Credentials,
+endpoints and runtime secrets are intentionally excluded and must be resolved in
+the destination environment.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import threading
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .executor_protocol import (
+    EXECUTOR_PROTOCOL_VERSION,
+    DescriptorOnlyProvider,
+    ExecutorProvider,
+    ExecutorProviderDescriptor,
+    ExecutorProviderRegistry,
+    default_provider_registry,
+)
+
+CATALOG_SCHEMA_VERSION = "aios.executor.catalog.v1"
+MIGRATION_SCHEMA_VERSION = "aios.executor.migration.v1"
+
+
+def canonical_json_bytes(value: Mapping[str, Any]) -> bytes:
+    return json.dumps(
+        dict(value),
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+        default=str,
+    ).encode("utf-8")
+
+
+def sha256_payload(value: Mapping[str, Any]) -> str:
+    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
+
+
+@dataclass(frozen=True)
+class ExecutorCatalogSnapshot:
+    catalog: Mapping[str, Any]
+    catalog_sha256: str
+    path: str
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "catalog": dict(self.catalog),
+            "catalog_sha256": self.catalog_sha256,
+            "path": self.path,
+        }
+
+
+class FileExecutorCatalogStore:
+    """Atomic file store for provider descriptors and migration packages."""
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+
+    @staticmethod
+    def _validate_catalog(value: Mapping[str, Any]) -> ExecutorProviderRegistry:
+        if value.get("schema_version") != CATALOG_SCHEMA_VERSION:
+            raise ValueError("unsupported executor catalog schema")
+        if value.get("protocol_version") != EXECUTOR_PROTOCOL_VERSION:
+            raise ValueError("executor catalog protocol mismatch")
+        providers = value.get("providers")
+        if not isinstance(providers, Sequence) or isinstance(providers, (str, bytes)):
+            raise ValueError("executor catalog providers must be an array")
+        return ExecutorProviderRegistry.import_catalog(value)
+
+    def initialize_defaults(self) -> ExecutorCatalogSnapshot:
+        with self._lock:
+            if self.path.exists():
+                return self.load()
+            return self.save(default_provider_registry())
+
+    def load(self) -> ExecutorCatalogSnapshot:
+        with self._lock:
+            value = json.loads(self.path.read_text(encoding="utf-8"))
+        if not isinstance(value, Mapping):
+            raise ValueError("executor catalog must contain a JSON object")
+        registry = self._validate_catalog(value)
+        normalized = registry.export_catalog()
+        return ExecutorCatalogSnapshot(
+            catalog=normalized,
+            catalog_sha256=sha256_payload(normalized),
+            path=str(self.path),
+        )
+
+    def registry(
+        self,
+        *,
+        provider_factories: Mapping[str, ExecutorProvider] | None = None,
+    ) -> ExecutorProviderRegistry:
+        snapshot = self.load()
+        return ExecutorProviderRegistry.import_catalog(
+            snapshot.catalog,
+            provider_factories=provider_factories,
+        )
+
+    def save(self, registry: ExecutorProviderRegistry) -> ExecutorCatalogSnapshot:
+        catalog = registry.export_catalog()
+        self._validate_catalog(catalog)
+        encoded = json.dumps(
+            catalog,
+            ensure_ascii=False,
+            sort_keys=True,
+            indent=2,
+        ) + "\n"
+        with self._lock:
+            temporary = self.path.with_suffix(f".tmp-{os.getpid()}")
+            temporary.write_text(encoded, encoding="utf-8")
+            os.chmod(temporary, 0o640)
+            os.replace(temporary, self.path)
+        return ExecutorCatalogSnapshot(
+            catalog=catalog,
+            catalog_sha256=sha256_payload(catalog),
+            path=str(self.path),
+        )
+
+    def upsert_descriptor(
+        self,
+        descriptor: ExecutorProviderDescriptor,
+    ) -> ExecutorCatalogSnapshot:
+        with self._lock:
+            if self.path.exists():
+                registry = self.registry()
+            else:
+                registry = default_provider_registry()
+            try:
+                registry.register(DescriptorOnlyProvider(descriptor), replace=True)
+            except KeyError:
+                registry.register(DescriptorOnlyProvider(descriptor))
+            return self.save(registry)
+
+    def export_migration_package(
+        self,
+        *,
+        source_environment: str,
+        required_executor_types: Sequence[str] = (),
+    ) -> Mapping[str, Any]:
+        snapshot = self.load()
+        registry = ExecutorProviderRegistry.import_catalog(snapshot.catalog)
+        required = tuple(sorted({str(item).strip().lower() for item in required_executor_types if str(item).strip()}))
+        if required:
+            available = {item.executor_type for item in registry.list_descriptors()}
+            missing = sorted(set(required) - available)
+            if missing:
+                raise ValueError(f"migration package is missing providers: {missing}")
+        package = {
+            "schema_version": MIGRATION_SCHEMA_VERSION,
+            "source_environment": str(source_environment or "").strip(),
+            "catalog": snapshot.catalog,
+            "catalog_sha256": snapshot.catalog_sha256,
+            "required_executor_types": list(required),
+            "secret_values_included": False,
+        }
+        if not package["source_environment"]:
+            raise ValueError("source_environment is required")
+        return {
+            **package,
+            "package_sha256": sha256_payload(package),
+        }
+
+    @classmethod
+    def import_migration_package(
+        cls,
+        value: Mapping[str, Any],
+        *,
+        destination_path: str | Path,
+        destination_environment: str,
+        provider_factories: Mapping[str, ExecutorProvider] | None = None,
+    ) -> ExecutorCatalogSnapshot:
+        if value.get("schema_version") != MIGRATION_SCHEMA_VERSION:
+            raise ValueError("unsupported executor migration schema")
+        if value.get("secret_values_included") is not False:
+            raise ValueError("executor migration package must not contain secrets")
+        package_without_hash = {key: item for key, item in value.items() if key != "package_sha256"}
+        if sha256_payload(package_without_hash) != value.get("package_sha256"):
+            raise ValueError("executor migration package hash mismatch")
+        catalog = value.get("catalog")
+        if not isinstance(catalog, Mapping):
+            raise ValueError("executor migration package has no catalog")
+        if sha256_payload(catalog) != value.get("catalog_sha256"):
+            raise ValueError("executor catalog hash mismatch")
+        registry = ExecutorProviderRegistry.import_catalog(
+            catalog,
+            provider_factories=provider_factories,
+        )
+        required = tuple(value.get("required_executor_types") or ())
+        available = {item.executor_type for item in registry.list_descriptors()}
+        missing = sorted(set(required) - available)
+        if missing:
+            raise ValueError(f"destination provider factories are missing: {missing}")
+        if not str(destination_environment or "").strip():
+            raise ValueError("destination_environment is required")
+        return cls(destination_path).save(registry)
@@ -0,0 +1,441 @@
+"""Versioned, extensible executor protocol for AIOS external tasks.
+
+The core lifecycle is executor-neutral. OpenClaw, Hermes, Codex and the scoped
+ChatGPT supervisor are built-in
+providers, not hard-coded protocol branches. Future providers register a
+versioned descriptor and use the same Truth Registry, evidence, notification
+and release-gate mechanisms without modifying the lifecycle state machine.
+"""
+from __future__ import annotations
+
+import json
+import re
+import threading
+from dataclasses import asdict, dataclass, field
+from typing import Any, Mapping, Protocol, Sequence
+
+from .external_task_control import ExternalTaskCoordinator
+from .task_execution_registry import ExecutionTaskManifest, ExecutionTruthRecord
+
+EXECUTOR_PROTOCOL_VERSION = "aios.executor.v1"
+_PROVIDER_NAME = re.compile(r"^[a-z][a-z0-9._-]{1,63}$")
+_VERSION = re.compile(r"^[0-9]+(?:\.[0-9]+){0,2}(?:[-+][A-Za-z0-9._-]+)?$")
+DISCOVERABLE_STATES: Sequence[str] = ("DECLARED", "REGISTERED")
+
+
+def normalize_executor(value: str) -> str:
+    normalized = str(value or "").strip().lower()
+    if not _PROVIDER_NAME.fullmatch(normalized):
+        raise ValueError("executor type must be a lowercase provider identifier")
+    return normalized
+
+
+def _major(version: str) -> int:
+    normalized = str(version or "").strip()
+    if not _VERSION.fullmatch(normalized):
+        raise ValueError(f"invalid version: {version}")
+    return int(normalized.split(".", 1)[0])
+
+
+@dataclass(frozen=True)
+class ExecutorProviderDescriptor:
+    """Portable provider metadata stored without credentials or runtime secrets."""
+
+    executor_type: str
+    adapter_version: str
+    protocol_version: str = EXECUTOR_PROTOCOL_VERSION
+    trust_roles: Sequence[str] = ()
+    capabilities: Sequence[str] = ()
+    configuration_schema: str = "aios.executor.config.v1"
+    portable: bool = True
+    metadata: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "executor_type", normalize_executor(self.executor_type))
+        adapter_version = str(self.adapter_version or "").strip()
+        if not _VERSION.fullmatch(adapter_version):
+            raise ValueError("adapter_version must be version-like")
+        object.__setattr__(self, "adapter_version", adapter_version)
+        protocol_version = str(self.protocol_version or "").strip()
+        if not protocol_version.startswith("aios.executor.v"):
+            raise ValueError("unsupported executor protocol namespace")
+        int(protocol_version.rsplit("v", 1)[1])
+        object.__setattr__(self, "protocol_version", protocol_version)
+        roles = tuple(sorted({str(item).strip() for item in self.trust_roles if str(item).strip()}))
+        if not roles:
+            raise ValueError("provider must declare at least one trust role")
+        capabilities = tuple(
+            sorted({str(item).strip() for item in self.capabilities if str(item).strip()})
+        )
+        object.__setattr__(self, "trust_roles", roles)
+        object.__setattr__(self, "capabilities", capabilities)
+        object.__setattr__(
+            self,
+            "configuration_schema",
+            str(self.configuration_schema or "").strip(),
+        )
+        object.__setattr__(
+            self,
+            "metadata",
+            json.loads(json.dumps(dict(self.metadata), ensure_ascii=False, default=str)),
+        )
+
+    def as_dict(self) -> dict[str, Any]:
+        value = asdict(self)
+        value["trust_roles"] = list(self.trust_roles)
+        value["capabilities"] = list(self.capabilities)
+        return value
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ExecutorProviderDescriptor":
+        return cls(**dict(value))
+
+    def protocol_compatible_with(self, other: "ExecutorProviderDescriptor") -> bool:
+        return (
+            self.executor_type == other.executor_type
+            and self.protocol_version == other.protocol_version
+            and _major(self.adapter_version) == _major(other.adapter_version)
+        )
+
+
+class ExternalExecutorAdapter(Protocol):
+    """Runtime-specific implementation behind the common lifecycle."""
+
+    descriptor: ExecutorProviderDescriptor
+
+    def discover(self) -> Sequence[ExecutionTruthRecord]: ...
+    def execute(self, manifest: ExecutionTaskManifest) -> Mapping[str, Any]: ...
+    def notify_owner(self, payload: Mapping[str, Any]) -> str: ...
+
+
+class ExecutorProvider(Protocol):
+    descriptor: ExecutorProviderDescriptor
+
+    def validate_manifest(self, manifest: ExecutionTaskManifest) -> None: ...
+    def build_adapter(self, configuration: Mapping[str, Any]) -> ExternalExecutorAdapter: ...
+
+
+class DescriptorOnlyProvider:
+    """Default provider used when lifecycle integration is supplied externally."""
+
+    def __init__(self, descriptor: ExecutorProviderDescriptor) -> None:
+        self.descriptor = descriptor
+
+    def validate_manifest(self, manifest: ExecutionTaskManifest) -> None:
+        if normalize_executor(manifest.executor) != self.descriptor.executor_type:
+            raise ValueError("manifest executor does not match provider")
+
+    def build_adapter(self, configuration: Mapping[str, Any]) -> ExternalExecutorAdapter:
+        raise RuntimeError(
+            f"provider {self.descriptor.executor_type} requires an external adapter factory"
+        )
+
+
+class ExecutorProviderRegistry:
+    """Thread-safe registry supporting runtime registration and catalog migration."""
+
+    def __init__(self, providers: Sequence[ExecutorProvider] = ()) -> None:
+        self._lock = threading.RLock()
+        self._providers: dict[str, ExecutorProvider] = {}
+        for provider in providers:
+            self.register(provider)
+
+    def register(self, provider: ExecutorProvider, *, replace: bool = False) -> None:
+        descriptor = provider.descriptor
+        key = normalize_executor(descriptor.executor_type)
+        with self._lock:
+            current = self._providers.get(key)
+            if current is not None and not replace:
+                raise ValueError(f"executor provider already registered: {key}")
+            if current is not None and not descriptor.protocol_compatible_with(
+                current.descriptor
+            ):
+                raise ValueError(
+                    f"replacement provider is incompatible with registered provider: {key}"
+                )
+            self._providers[key] = provider
+
+    def unregister(self, executor_type: str) -> ExecutorProvider:
+        key = normalize_executor(executor_type)
+        with self._lock:
+            try:
+                return self._providers.pop(key)
+            except KeyError as exc:
+                raise KeyError(f"executor provider is not registered: {key}") from exc
+
+    def get(self, executor_type: str) -> ExecutorProvider:
+        key = normalize_executor(executor_type)
+        with self._lock:
+            provider = self._providers.get(key)
+        if provider is None:
+            raise KeyError(f"executor provider is not registered: {key}")
+        return provider
+
+    def descriptor(self, executor_type: str) -> ExecutorProviderDescriptor:
+        return self.get(executor_type).descriptor
+
+    def validate_manifest(self, manifest: ExecutionTaskManifest) -> None:
+        self.get(manifest.executor).validate_manifest(manifest)
+
+    def trusted(
+        self,
+        *,
+        executor_type: str,
+        roles: Sequence[str],
+        platform_admin: bool = False,
+    ) -> bool:
+        if platform_admin or "platform_admin" in set(roles):
+            return True
+        descriptor = self.descriptor(executor_type)
+        return bool(set(descriptor.trust_roles).intersection(set(roles)))
+
+    def list_descriptors(self) -> tuple[ExecutorProviderDescriptor, ...]:
+        with self._lock:
+            return tuple(
+                self._providers[key].descriptor for key in sorted(self._providers)
+            )
+
+    def export_catalog(self) -> Mapping[str, Any]:
+        return {
+            "schema_version": "aios.executor.catalog.v1",
+            "protocol_version": EXECUTOR_PROTOCOL_VERSION,
+            "providers": [item.as_dict() for item in self.list_descriptors()],
+        }
+
+    @classmethod
+    def import_catalog(
+        cls,
+        value: Mapping[str, Any],
+        *,
+        provider_factories: Mapping[str, ExecutorProvider] | None = None,
+    ) -> "ExecutorProviderRegistry":
+        if value.get("schema_version") != "aios.executor.catalog.v1":
+            raise ValueError("unsupported executor catalog schema")
+        if value.get("protocol_version") != EXECUTOR_PROTOCOL_VERSION:
+            raise ValueError("executor catalog protocol mismatch")
+        factories = dict(provider_factories or {})
+        providers: list[ExecutorProvider] = []
+        for raw in value.get("providers") or ():
+            descriptor = ExecutorProviderDescriptor.from_dict(raw)
+            provider = factories.get(descriptor.executor_type)
+            if provider is not None:
+                if not provider.descriptor.protocol_compatible_with(descriptor):
+                    raise ValueError(
+                        f"provider factory does not match imported descriptor: {descriptor.executor_type}"
+                    )
+                providers.append(provider)
+            else:
+                providers.append(DescriptorOnlyProvider(descriptor))
+        return cls(providers)
+
+
+BUILTIN_PROVIDER_DESCRIPTORS: Sequence[ExecutorProviderDescriptor] = (
+    ExecutorProviderDescriptor(
+        executor_type="openclaw",
+        adapter_version="2.1.0",
+        trust_roles=("runtime", "openclaw_executor"),
+        capabilities=(
+            "deploy",
+            "http_runtime",
+            "owner_notification",
+            "healthcheck",
+            "rollback",
+        ),
+        configuration_schema="aios.executor.openclaw.config.v1",
+        metadata={"official": True},
+    ),
+    ExecutorProviderDescriptor(
+        executor_type="hermes",
+        adapter_version="2.1.0",
+        trust_roles=("runtime", "hermes_executor"),
+        capabilities=(
+            "queue",
+            "lease",
+            "worker",
+            "runtime_validation",
+            "restart_recovery",
+        ),
+        configuration_schema="aios.executor.hermes.config.v1",
+        metadata={"official": True},
+    ),
+    ExecutorProviderDescriptor(
+        executor_type="codex",
+        adapter_version="2.1.0",
+        trust_roles=("codex", "codex_executor"),
+        capabilities=("code", "test", "docs", "gitops_patch", "security_review"),
+        configuration_schema="aios.executor.codex.config.v1",
+        metadata={"official": True},
+    ),
+    ExecutorProviderDescriptor(
+        executor_type="chatgpt-supervisor",
+        adapter_version="2.1.0",
+        trust_roles=("chatgpt_supervisor",),
+        capabilities=(
+            "acceptance",
+            "deploy",
+            "evidence",
+            "healthcheck",
+            "rollback",
+            "wechat_simulation",
+        ),
+        configuration_schema="aios.executor.chatgpt-supervisor.config.v1",
+        metadata={"official": True, "production_mutation_allowed": False},
+    ),
+)
+
+
+def default_provider_registry() -> ExecutorProviderRegistry:
+    return ExecutorProviderRegistry(
+        [DescriptorOnlyProvider(item) for item in BUILTIN_PROVIDER_DESCRIPTORS]
+    )
+
+
+def trusted_for_executor(
+    *,
+    executor: str,
+    roles: Sequence[str],
+    platform_admin: bool = False,
+    registry: ExecutorProviderRegistry | None = None,
+) -> bool:
+    return (registry or default_provider_registry()).trusted(
+        executor_type=executor,
+        roles=roles,
+        platform_admin=platform_admin,
+    )
+
+
+@dataclass(frozen=True)
+class ExecutorIdentity:
+    executor_type: str
+    executor_id: str
+    executor_run_id: str
+    protocol_version: str = EXECUTOR_PROTOCOL_VERSION
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "executor_type", normalize_executor(self.executor_type))
+        for name in ("executor_id", "executor_run_id"):
+            value = str(getattr(self, name) or "").strip()
+            if not value:
+                raise ValueError(f"{name} is required")
+            object.__setattr__(self, name, value)
+        if self.protocol_version != EXECUTOR_PROTOCOL_VERSION:
+            raise ValueError("executor identity protocol mismatch")
+
+
+class ExecutorLifecycleSession:
+    """Executor-neutral lifecycle facade used by every registered provider."""
+
+    def __init__(
+        self,
+        coordinator: ExternalTaskCoordinator,
+        identity: ExecutorIdentity,
+        *,
+        registry: ExecutorProviderRegistry | None = None,
+    ) -> None:
+        self.coordinator = coordinator
+        self.identity = identity
+        self.registry = registry or default_provider_registry()
+        self.registry.get(identity.executor_type)
+
+    def _assert_manifest(self, task_id: str) -> ExecutionTaskManifest:
+        record = self.coordinator.registry.get(task_id)
+        manifest = record.manifest
+        self.registry.validate_manifest(manifest)
+        if normalize_executor(manifest.executor) != self.identity.executor_type:
+            raise PermissionError(
+                f"task executor is {manifest.executor}, not {self.identity.executor_type}"
+            )
+        return manifest
+
+    def register(self, task_id: str) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.register(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+        )
+
+    def retry_not_started(self, task_id: str) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.retry_not_started(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+        )
+
+    def claim(self, task_id: str) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.claim(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+            executor_id=self.identity.executor_id,
+        )
+
+    def start(self, task_id: str) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.start(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+            executor_id=self.identity.executor_id,
+        )
+
+    def heartbeat(self, task_id: str, *, current_step: int) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.heartbeat(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+            executor_id=self.identity.executor_id,
+            current_step=current_step,
+        )
+
+    def succeed(
+        self,
+        task_id: str,
+        *,
+        evidence: Mapping[str, str],
+    ) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.succeed(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+            executor_id=self.identity.executor_id,
+            evidence=evidence,
+        )
+
+    def fail(
+        self,
+        task_id: str,
+        *,
+        error: Mapping[str, Any],
+        evidence: Mapping[str, str] | None = None,
+    ) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.fail(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+            executor_id=self.identity.executor_id,
+            error=error,
+            evidence=evidence,
+        )
+
+
+class OpenClawExecutorSession(ExecutorLifecycleSession):
+    def __init__(self, coordinator: ExternalTaskCoordinator, *, executor_id: str, executor_run_id: str) -> None:
+        super().__init__(
+            coordinator,
+            ExecutorIdentity("openclaw", executor_id, executor_run_id),
+        )
+
+
+class HermesExecutorSession(ExecutorLifecycleSession):
+    def __init__(self, coordinator: ExternalTaskCoordinator, *, executor_id: str, executor_run_id: str) -> None:
+        super().__init__(
+            coordinator,
+            ExecutorIdentity("hermes", executor_id, executor_run_id),
+        )
+
+
+class CodexExecutorSession(ExecutorLifecycleSession):
+    def __init__(self, coordinator: ExternalTaskCoordinator, *, executor_id: str, executor_run_id: str) -> None:
+        super().__init__(
+            coordinator,
+            ExecutorIdentity("codex", executor_id, executor_run_id),
+        )
@@ -0,0 +1,313 @@
+"""Provider-neutral worker runtime for AIOS external executors.
+
+Providers implement only step execution and notification delivery. Discovery,
+dependency gates, lifecycle truth, heartbeat, evidence validation and durable
+notification acknowledgement are identical for every current and future
+executor Provider.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import uuid
+from dataclasses import dataclass, field
+from typing import Any, Mapping, Protocol, Sequence
+
+from .execution_plan import ExecutionPlanCoordinator, ExecutionStageManifest
+from .executor_protocol import (
+    ExecutorIdentity,
+    ExecutorLifecycleSession,
+    ExecutorProviderRegistry,
+    normalize_executor,
+)
+from .external_task_control import ExternalTaskCoordinator, NotificationRecord
+from .task_execution_registry import ExecutionTruthState
+
+
+class StepRunner(Protocol):
+    def run_step(
+        self,
+        *,
+        plan_id: str,
+        stage: ExecutionStageManifest,
+        step: str,
+        step_number: int,
+        executor_id: str,
+        executor_run_id: str,
+    ) -> Mapping[str, str]: ...
+
+
+class NotificationSender(Protocol):
+    def send(self, notification: NotificationRecord) -> str: ...
+
+
+@dataclass(frozen=True)
+class StageRunResult:
+    plan_id: str
+    stage_id: str
+    task_id: str
+    executor_type: str
+    executor_id: str
+    executor_run_id: str
+    state: str
+    evidence: Mapping[str, str] = field(default_factory=dict)
+    error: Mapping[str, Any] = field(default_factory=dict)
+    delivered_notifications: Sequence[str] = ()
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "plan_id": self.plan_id,
+            "stage_id": self.stage_id,
+            "task_id": self.task_id,
+            "executor_type": self.executor_type,
+            "executor_id": self.executor_id,
+            "executor_run_id": self.executor_run_id,
+            "state": self.state,
+            "evidence": dict(self.evidence),
+            "error": dict(self.error),
+            "delivered_notifications": list(self.delivered_notifications),
+        }
+
+
+class UnifiedExecutorWorker:
+    """Dependency-aware worker shared by every registered Provider."""
+
+    def __init__(
+        self,
+        *,
+        plan_coordinator: ExecutionPlanCoordinator,
+        task_coordinator: ExternalTaskCoordinator,
+        providers: ExecutorProviderRegistry,
+        executor_type: str,
+        executor_id: str,
+        step_runner: StepRunner,
+        notification_sender: NotificationSender,
+    ) -> None:
+        self.plan_coordinator = plan_coordinator
+        self.task_coordinator = task_coordinator
+        self.providers = providers
+        self.executor_type = normalize_executor(executor_type)
+        self.executor_id = str(executor_id or "").strip()
+        if not self.executor_id:
+            raise ValueError("executor_id is required")
+        self.providers.get(self.executor_type)
+        self.step_runner = step_runner
+        self.notification_sender = notification_sender
+
+    def _session(self, executor_run_id: str) -> ExecutorLifecycleSession:
+        return ExecutorLifecycleSession(
+            self.task_coordinator,
+            ExecutorIdentity(
+                executor_type=self.executor_type,
+                executor_id=self.executor_id,
+                executor_run_id=executor_run_id,
+            ),
+            registry=self.providers,
+        )
+
+    def _notification_candidates(self, task_id: str) -> tuple[NotificationRecord, ...]:
+        """Return idempotent delivery candidates, including prior failures.
+
+        The outbox has a unique ``(task_id, event_type)`` key. Retrying therefore
+        reuses the same notification ID and cannot create duplicate STARTED or
+        SUCCEEDED events. A later successful acknowledgement replaces FAILED
+        with DELIVERED and records the receipt hash.
+        """
+        candidates: dict[str, NotificationRecord] = {}
+        for status in ("PENDING", "FAILED"):
+            for item in self.task_coordinator.notifications.list(
+                task_id=task_id,
+                status=status,
+            ):
+                candidates[item.notification_id] = item
+        return tuple(
+            candidates[key]
+            for key in sorted(
+                candidates,
+                key=lambda item: (
+                    candidates[item].created_at,
+                    candidates[item].notification_id,
+                ),
+            )
+        )
+
+    def _deliver_notifications(self, task_id: str) -> tuple[str, ...]:
+        delivered: list[str] = []
+        for item in self._notification_candidates(task_id):
+            try:
+                receipt = self.notification_sender.send(item)
+                acknowledged = self.task_coordinator.notifications.acknowledge(
+                    item.notification_id,
+                    receipt_sha256=receipt,
+                )
+                delivered.append(acknowledged.event_type)
+            except Exception as exc:
+                self.task_coordinator.notifications.fail(
+                    item.notification_id,
+                    error=f"{type(exc).__name__}: {exc}",
+                )
+        return tuple(sorted(set(delivered)))
+
+    def retry_failed_notifications(self, *, task_id: str) -> tuple[str, ...]:
+        """Retry failed owner notifications without changing task truth."""
+        return self._deliver_notifications(task_id)
+
+    def run_ready(
+        self,
+        *,
+        plan_id: str,
+        max_stages: int = 1,
+    ) -> list[StageRunResult]:
+        if max_stages < 1:
+            raise ValueError("max_stages must be positive")
+        ready = self.plan_coordinator.discover_ready(
+            plan_id=plan_id,
+            executor_type=self.executor_type,
+        )[:max_stages]
+        return [
+            self.run_stage(
+                plan_id=plan_id,
+                stage_id=item["stage"]["stage_id"],
+            )
+            for item in ready
+        ]
+
+    def run_stage(
+        self,
+        *,
+        plan_id: str,
+        stage_id: str,
+        executor_run_id: str | None = None,
+    ) -> StageRunResult:
+        plan = self.plan_coordinator.plan_store.get(plan_id)
+        stage = plan.stage(stage_id)
+        if stage.executor_type != self.executor_type:
+            raise PermissionError(
+                f"stage executor is {stage.executor_type}, not {self.executor_type}"
+            )
+        dependency = self.plan_coordinator.dependency_gate(plan_id, stage_id)
+        if not dependency["passed"]:
+            raise RuntimeError("stage dependencies are not satisfied")
+
+        run_id = executor_run_id or f"{self.executor_type}_run_{uuid.uuid4().hex}"
+        session = self._session(run_id)
+        record = self.task_coordinator.registry.get(stage.task_id)
+        evidence: dict[str, str] = dict(record.evidence)
+        delivered: list[str] = []
+        try:
+            if record.state == ExecutionTruthState.DECLARED:
+                record = session.register(stage.task_id)
+            if record.state == ExecutionTruthState.REGISTERED:
+                record = session.claim(stage.task_id)
+            if record.state == ExecutionTruthState.CLAIMED:
+                record = session.start(stage.task_id)
+                delivered.extend(self._deliver_notifications(stage.task_id))
+            if record.state != ExecutionTruthState.RUNNING:
+                raise RuntimeError(
+                    f"stage cannot execute from state {record.state.value}"
+                )
+
+            # Re-running the current step is intentional: Provider steps must be
+            # idempotent and a crash between side effect and heartbeat cannot be
+            # safely interpreted as completed work.
+            start_step = max(1, record.current_step)
+            for number, step in enumerate(stage.steps, start=1):
+                if number < start_step:
+                    continue
+                produced = self.step_runner.run_step(
+                    plan_id=plan_id,
+                    stage=stage,
+                    step=step,
+                    step_number=number,
+                    executor_id=self.executor_id,
+                    executor_run_id=run_id,
+                )
+                if not isinstance(produced, Mapping):
+                    raise TypeError("step runner must return an evidence mapping")
+                evidence.update(
+                    {
+                        str(key).strip(): str(value).strip().lower()
+                        for key, value in produced.items()
+                    }
+                )
+                record = session.heartbeat(stage.task_id, current_step=number)
+
+            record = session.succeed(stage.task_id, evidence=evidence)
+            delivered.extend(self._deliver_notifications(stage.task_id))
+            return StageRunResult(
+                plan_id=plan_id,
+                stage_id=stage.stage_id,
+                task_id=stage.task_id,
+                executor_type=self.executor_type,
+                executor_id=self.executor_id,
+                executor_run_id=run_id,
+                state=record.state.value,
+                evidence=dict(record.evidence),
+                delivered_notifications=tuple(sorted(set(delivered))),
+            )
+        except Exception as exc:
+            current = self.task_coordinator.registry.get(stage.task_id)
+            if current.state in {
+                ExecutionTruthState.REGISTERED,
+                ExecutionTruthState.CLAIMED,
+                ExecutionTruthState.RUNNING,
+            }:
+                current = session.fail(
+                    stage.task_id,
+                    error={
+                        "code": "executor_stage_failed",
+                        "error_type": type(exc).__name__,
+                        "message": str(exc),
+                    },
+                    evidence=evidence or None,
+                )
+            delivered.extend(self._deliver_notifications(stage.task_id))
+            return StageRunResult(
+                plan_id=plan_id,
+                stage_id=stage.stage_id,
+                task_id=stage.task_id,
+                executor_type=self.executor_type,
+                executor_id=self.executor_id,
+                executor_run_id=run_id,
+                state=current.state.value,
+                evidence=dict(current.evidence),
+                error=dict(current.error),
+                delivered_notifications=tuple(sorted(set(delivered))),
+            )
+
+
+class JsonEvidenceStepRunner:
+    """Adapter for handlers returning evidence-name to SHA256 mappings."""
+
+    def __init__(self, handler) -> None:
+        self.handler = handler
+
+    def run_step(self, **values: Any) -> Mapping[str, str]:
+        result = self.handler(**values)
+        if not isinstance(result, Mapping):
+            raise TypeError("step handler must return a mapping")
+        return {str(key): str(value) for key, value in result.items()}
+
+
+class JsonReceiptNotificationSender:
+    """Adapter for senders returning a SHA256 or receipt JSON object."""
+
+    def __init__(self, sender) -> None:
+        self.sender = sender
+
+    def send(self, notification: NotificationRecord) -> str:
+        result = self.sender(notification.as_dict())
+        if isinstance(result, str):
+            return result
+        if not isinstance(result, Mapping):
+            raise TypeError(
+                "notification sender must return SHA256 or a receipt object"
+            )
+        encoded = json.dumps(
+            dict(result),
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+            default=str,
+        ).encode("utf-8")
+        return hashlib.sha256(encoded).hexdigest()
@@ -0,0 +1,266 @@
+#!/usr/bin/env python3
+"""CLI for durable external-task truth and notification receipts.
+
+The CLI is suitable for OpenClaw workers, systemd jobs and release gates. It
+never infers execution from the presence of a manifest: each lifecycle action
+must be recorded explicitly in the shared SQLite registry.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .external_task_control import ExternalTaskCoordinator
+from .external_task_query import list_records
+
+
+def _json_mapping(value: str | None, path: str | None) -> Mapping[str, Any]:
+    if value and path:
+        raise ValueError("inline JSON and JSON file are mutually exclusive")
+    if path:
+        parsed = json.loads(Path(path).read_text(encoding="utf-8"))
+    else:
+        parsed = json.loads(value or "{}")
+    if not isinstance(parsed, Mapping):
+        raise ValueError("JSON value must be an object")
+    return dict(parsed)
+
+
+def _coordinator(args: argparse.Namespace) -> ExternalTaskCoordinator:
+    return ExternalTaskCoordinator.from_file(args.store_file)
+
+
+def _print(value: Any) -> None:
+    print(json.dumps(value, ensure_ascii=False, sort_keys=True, indent=2, default=str))
+
+
+def cmd_declare(args: argparse.Namespace) -> int:
+    record = _coordinator(args).declare_file(args.manifest)
+    _print(record.as_dict())
+    return 0
+
+
+def cmd_discover(args: argparse.Namespace) -> int:
+    records = list_records(
+        args.store_file,
+        executor=args.executor,
+        states=tuple(args.state or ()),
+    )
+    _print({"count": len(records), "items": [item.as_dict() for item in records]})
+    return 0
+
+
+def cmd_register(args: argparse.Namespace) -> int:
+    _print(_coordinator(args).register(args.task_id, executor_run_id=args.executor_run_id).as_dict())
+    return 0
+
+
+def cmd_claim(args: argparse.Namespace) -> int:
+    _print(
+        _coordinator(args).claim(
+            args.task_id,
+            executor_run_id=args.executor_run_id,
+            executor_id=args.executor_id,
+        ).as_dict()
+    )
+    return 0
+
+
+def cmd_start(args: argparse.Namespace) -> int:
+    _print(
+        _coordinator(args).start(
+            args.task_id,
+            executor_run_id=args.executor_run_id,
+            executor_id=args.executor_id,
+        ).as_dict()
+    )
+    return 0
+
+
+def cmd_heartbeat(args: argparse.Namespace) -> int:
+    _print(
+        _coordinator(args).heartbeat(
+            args.task_id,
+            executor_run_id=args.executor_run_id,
+            executor_id=args.executor_id,
+            current_step=args.current_step,
+        ).as_dict()
+    )
+    return 0
+
+
+def cmd_succeed(args: argparse.Namespace) -> int:
+    evidence = _json_mapping(args.evidence_json, args.evidence_file)
+    _print(
+        _coordinator(args).succeed(
+            args.task_id,
+            executor_run_id=args.executor_run_id,
+            executor_id=args.executor_id,
+            evidence={str(key): str(value) for key, value in evidence.items()},
+        ).as_dict()
+    )
+    return 0
+
+
+def cmd_fail(args: argparse.Namespace) -> int:
+    error = _json_mapping(args.error_json, args.error_file)
+    evidence = None
+    if args.evidence_json or args.evidence_file:
+        evidence_value = _json_mapping(args.evidence_json, args.evidence_file)
+        evidence = {str(key): str(value) for key, value in evidence_value.items()}
+    _print(
+        _coordinator(args).fail(
+            args.task_id,
+            executor_run_id=args.executor_run_id,
+            executor_id=args.executor_id,
+            error=error,
+            evidence=evidence,
+        ).as_dict()
+    )
+    return 0
+
+
+def cmd_status(args: argparse.Namespace) -> int:
+    _print(_coordinator(args).status(args.task_id))
+    return 0
+
+
+def cmd_gate(args: argparse.Namespace) -> int:
+    value = _coordinator(args).gate(args.task_id)
+    _print(value)
+    return 0 if value["passed"] else 3
+
+
+def cmd_notifications(args: argparse.Namespace) -> int:
+    items = _coordinator(args).notifications.list(task_id=args.task_id, status=args.status)
+    _print({"count": len(items), "items": [item.as_dict() for item in items]})
+    return 0
+
+
+def cmd_ack(args: argparse.Namespace) -> int:
+    _print(
+        _coordinator(args).notifications.acknowledge(
+            args.notification_id,
+            receipt_sha256=args.receipt_sha256,
+        ).as_dict()
+    )
+    return 0
+
+
+def common(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument(
+        "--store-file",
+        default=os.getenv(
+            "AIOS_EXTERNAL_TASK_STORE_FILE",
+            "/var/lib/aios-v2/external-task-truth.sqlite3",
+        ),
+    )
+
+
+def lifecycle(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--task-id", required=True)
+    parser.add_argument("--executor-run-id", required=True)
+    parser.add_argument("--executor-id", required=True)
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description="AIOS external task truth CLI")
+    commands = parser.add_subparsers(dest="command", required=True)
+
+    declare = commands.add_parser("declare")
+    common(declare)
+    declare.add_argument("--manifest", required=True)
+    declare.set_defaults(handler=cmd_declare)
+
+    discover = commands.add_parser("discover")
+    common(discover)
+    discover.add_argument("--executor", default="openclaw")
+    discover.add_argument("--state", action="append")
+    discover.set_defaults(handler=cmd_discover)
+
+    register = commands.add_parser("register")
+    common(register)
+    register.add_argument("--task-id", required=True)
+    register.add_argument("--executor-run-id", required=True)
+    register.set_defaults(handler=cmd_register)
+
+    claim = commands.add_parser("claim")
+    common(claim)
+    lifecycle(claim)
+    claim.set_defaults(handler=cmd_claim)
+
+    start = commands.add_parser("start")
+    common(start)
+    lifecycle(start)
+    start.set_defaults(handler=cmd_start)
+
+    heartbeat = commands.add_parser("heartbeat")
+    common(heartbeat)
+    lifecycle(heartbeat)
+    heartbeat.add_argument("--current-step", type=int, required=True)
+    heartbeat.set_defaults(handler=cmd_heartbeat)
+
+    succeed = commands.add_parser("succeed")
+    common(succeed)
+    lifecycle(succeed)
+    evidence = succeed.add_mutually_exclusive_group(required=True)
+    evidence.add_argument("--evidence-json")
+    evidence.add_argument("--evidence-file")
+    succeed.set_defaults(handler=cmd_succeed)
+
+    fail = commands.add_parser("fail")
+    common(fail)
+    lifecycle(fail)
+    error = fail.add_mutually_exclusive_group(required=True)
+    error.add_argument("--error-json")
+    error.add_argument("--error-file")
+    fail_evidence = fail.add_mutually_exclusive_group()
+    fail_evidence.add_argument("--evidence-json")
+    fail_evidence.add_argument("--evidence-file")
+    fail.set_defaults(handler=cmd_fail)
+
+    status = commands.add_parser("status")
+    common(status)
+    status.add_argument("--task-id", required=True)
+    status.set_defaults(handler=cmd_status)
+
+    gate = commands.add_parser("gate")
+    common(gate)
+    gate.add_argument("--task-id", required=True)
+    gate.set_defaults(handler=cmd_gate)
+
+    notifications = commands.add_parser("notifications")
+    common(notifications)
+    notifications.add_argument("--task-id")
+    notifications.add_argument("--status")
+    notifications.set_defaults(handler=cmd_notifications)
+
+    ack = commands.add_parser("ack-notification")
+    common(ack)
+    ack.add_argument("--notification-id", required=True)
+    ack.add_argument("--receipt-sha256", required=True)
+    ack.set_defaults(handler=cmd_ack)
+    return parser
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        return int(args.handler(args))
+    except Exception as exc:
+        print(
+            json.dumps(
+                {"status": "error", "error": type(exc).__name__, "message": str(exc)},
+                ensure_ascii=False,
+            ),
+            file=sys.stderr,
+        )
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,420 @@
+"""External executor coordination, notification outbox and release truth gate.
+
+OpenClaw/Codex task declarations are not execution evidence. This module wraps
+``SQLiteExecutionTruthRegistry`` with a durable notification outbox. A successful
+release gate requires both terminal task evidence and acknowledged STARTED /
+SUCCEEDED owner notifications when those events are required by the manifest.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import sqlite3
+import threading
+import uuid
+from dataclasses import asdict, dataclass
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .task_execution_registry import (
+    ExecutionTaskManifest,
+    ExecutionTruthRecord,
+    ExecutionTruthState,
+    SQLiteExecutionTruthRegistry,
+    utc_now,
+)
+
+_SHA256 = re.compile(r"^[0-9a-f]{64}$")
+
+
+def sha256_value(value: str, label: str) -> str:
+    normalized = str(value or "").strip().lower()
+    if not _SHA256.fullmatch(normalized):
+        raise ValueError(f"{label} must be a lowercase SHA256 hex digest")
+    return normalized
+
+
+@dataclass(frozen=True)
+class NotificationRecord:
+    notification_id: str
+    task_id: str
+    event_type: str
+    target_ref: str
+    payload: Mapping[str, Any]
+    status: str
+    created_at: str
+    delivered_at: str | None = None
+    receipt_sha256: str | None = None
+    error: str | None = None
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+class SQLiteNotificationOutbox:
+    """Durable owner-notification delivery and acknowledgement records."""
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+        with self._connect() as connection:
+            connection.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS external_task_notifications (
+                    notification_id TEXT PRIMARY KEY,
+                    task_id TEXT NOT NULL,
+                    event_type TEXT NOT NULL,
+                    target_ref TEXT NOT NULL,
+                    payload_json TEXT NOT NULL,
+                    status TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    delivered_at TEXT,
+                    receipt_sha256 TEXT,
+                    error TEXT,
+                    UNIQUE(task_id, event_type)
+                );
+                CREATE INDEX IF NOT EXISTS idx_external_notification_status
+                    ON external_task_notifications(status, created_at);
+                """
+            )
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(str(self.path), timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        return connection
+
+    @staticmethod
+    def _decode(row: sqlite3.Row) -> NotificationRecord:
+        return NotificationRecord(
+            notification_id=row["notification_id"],
+            task_id=row["task_id"],
+            event_type=row["event_type"],
+            target_ref=row["target_ref"],
+            payload=json.loads(row["payload_json"]),
+            status=row["status"],
+            created_at=row["created_at"],
+            delivered_at=row["delivered_at"],
+            receipt_sha256=row["receipt_sha256"],
+            error=row["error"],
+        )
+
+    def enqueue(
+        self,
+        *,
+        task_id: str,
+        event_type: str,
+        target_ref: str,
+        payload: Mapping[str, Any],
+    ) -> NotificationRecord:
+        now = utc_now()
+        record = NotificationRecord(
+            notification_id=f"notify_{uuid.uuid4().hex}",
+            task_id=str(task_id).strip(),
+            event_type=str(event_type).strip().upper(),
+            target_ref=str(target_ref).strip(),
+            payload=json.loads(json.dumps(dict(payload), ensure_ascii=False, default=str)),
+            status="PENDING",
+            created_at=now,
+        )
+        if not record.task_id or not record.event_type or not record.target_ref:
+            raise ValueError("task_id, event_type and target_ref are required")
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            existing = connection.execute(
+                "SELECT * FROM external_task_notifications WHERE task_id = ? AND event_type = ?",
+                (record.task_id, record.event_type),
+            ).fetchone()
+            if existing is not None:
+                connection.rollback()
+                return self._decode(existing)
+            connection.execute(
+                """
+                INSERT INTO external_task_notifications
+                (notification_id, task_id, event_type, target_ref, payload_json,
+                 status, created_at, delivered_at, receipt_sha256, error)
+                VALUES (?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL)
+                """,
+                (
+                    record.notification_id,
+                    record.task_id,
+                    record.event_type,
+                    record.target_ref,
+                    json.dumps(record.payload, ensure_ascii=False, sort_keys=True, separators=(",", ":")),
+                    record.status,
+                    record.created_at,
+                ),
+            )
+            connection.commit()
+        return record
+
+    def get(self, notification_id: str) -> NotificationRecord:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT * FROM external_task_notifications WHERE notification_id = ?",
+                (str(notification_id).strip(),),
+            ).fetchone()
+        if row is None:
+            raise KeyError("notification not found")
+        return self._decode(row)
+
+    def acknowledge(self, notification_id: str, *, receipt_sha256: str) -> NotificationRecord:
+        digest = sha256_value(receipt_sha256, "receipt_sha256")
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            row = connection.execute(
+                "SELECT * FROM external_task_notifications WHERE notification_id = ?",
+                (str(notification_id).strip(),),
+            ).fetchone()
+            if row is None:
+                connection.rollback()
+                raise KeyError("notification not found")
+            current = self._decode(row)
+            if current.status == "DELIVERED":
+                if current.receipt_sha256 != digest:
+                    connection.rollback()
+                    raise RuntimeError("notification already acknowledged with another receipt")
+                connection.rollback()
+                return current
+            delivered_at = utc_now()
+            connection.execute(
+                """
+                UPDATE external_task_notifications
+                SET status = 'DELIVERED', delivered_at = ?, receipt_sha256 = ?, error = NULL
+                WHERE notification_id = ?
+                """,
+                (delivered_at, digest, current.notification_id),
+            )
+            connection.commit()
+        return self.get(current.notification_id)
+
+    def fail(self, notification_id: str, *, error: str) -> NotificationRecord:
+        message = str(error or "").strip()
+        if not message:
+            raise ValueError("notification error is required")
+        with self._lock, self._connect() as connection:
+            connection.execute(
+                "UPDATE external_task_notifications SET status = 'FAILED', error = ? WHERE notification_id = ?",
+                (message, str(notification_id).strip()),
+            )
+            connection.commit()
+        return self.get(notification_id)
+
+    def list(
+        self,
+        *,
+        task_id: str | None = None,
+        status: str | None = None,
+    ) -> list[NotificationRecord]:
+        conditions: list[str] = []
+        values: list[str] = []
+        if task_id:
+            conditions.append("task_id = ?")
+            values.append(str(task_id).strip())
+        if status:
+            conditions.append("status = ?")
+            values.append(str(status).strip().upper())
+        where = f" WHERE {' AND '.join(conditions)}" if conditions else ""
+        with self._lock, self._connect() as connection:
+            rows = connection.execute(
+                f"SELECT * FROM external_task_notifications{where} ORDER BY created_at, notification_id",
+                tuple(values),
+            ).fetchall()
+        return [self._decode(row) for row in rows]
+
+
+class ExternalTaskCoordinator:
+    """Single safe lifecycle used by external executors and release gates."""
+
+    def __init__(
+        self,
+        registry: SQLiteExecutionTruthRegistry,
+        notifications: SQLiteNotificationOutbox,
+    ) -> None:
+        self.registry = registry
+        self.notifications = notifications
+
+    @classmethod
+    def from_file(cls, path: str | Path) -> "ExternalTaskCoordinator":
+        return cls(
+            SQLiteExecutionTruthRegistry(path),
+            SQLiteNotificationOutbox(path),
+        )
+
+    def declare(self, manifest: ExecutionTaskManifest) -> ExecutionTruthRecord:
+        return self.registry.declare(manifest)
+
+    def declare_file(self, path: str | Path) -> ExecutionTruthRecord:
+        value = json.loads(Path(path).read_text(encoding="utf-8"))
+        if not isinstance(value, Mapping):
+            raise ValueError("external task manifest must be a JSON object")
+        return self.declare(ExecutionTaskManifest.from_dict(value))
+
+    def register(self, task_id: str, *, executor_run_id: str) -> ExecutionTruthRecord:
+        return self.registry.register(task_id, executor_run_id=executor_run_id)
+
+    def retry_not_started(
+        self,
+        task_id: str,
+        *,
+        executor_run_id: str,
+    ) -> ExecutionTruthRecord:
+        return self.registry.retry_not_started(
+            task_id,
+            executor_run_id=executor_run_id,
+        )
+
+    def claim(
+        self,
+        task_id: str,
+        *,
+        executor_run_id: str,
+        executor_id: str,
+    ) -> ExecutionTruthRecord:
+        return self.registry.claim(
+            task_id,
+            executor_run_id=executor_run_id,
+            executor_id=executor_id,
+        )
+
+    def _notify(self, record: ExecutionTruthRecord, event_type: str) -> NotificationRecord | None:
+        event = event_type.upper()
+        if event not in set(record.manifest.notification_events):
+            return None
+        return self.notifications.enqueue(
+            task_id=record.task_id,
+            event_type=event,
+            target_ref=record.manifest.owner_notification_ref,
+            payload={
+                "task_id": record.task_id,
+                "target_version": record.manifest.target_version,
+                "executor": record.manifest.executor,
+                "executor_id": record.executor_id,
+                "executor_run_id": record.executor_run_id,
+                "state": record.state.value,
+                "current_step": record.current_step,
+                "total_steps": len(record.manifest.steps),
+                "timestamp": utc_now(),
+            },
+        )
+
+    def start(
+        self,
+        task_id: str,
+        *,
+        executor_run_id: str,
+        executor_id: str,
+    ) -> ExecutionTruthRecord:
+        record = self.registry.start(
+            task_id,
+            executor_run_id=executor_run_id,
+            executor_id=executor_id,
+        )
+        self._notify(record, "STARTED")
+        return record
+
+    def heartbeat(
+        self,
+        task_id: str,
+        *,
+        executor_run_id: str,
+        executor_id: str,
+        current_step: int,
+    ) -> ExecutionTruthRecord:
+        return self.registry.heartbeat(
+            task_id,
+            executor_run_id=executor_run_id,
+            executor_id=executor_id,
+            current_step=current_step,
+        )
+
+    def succeed(
+        self,
+        task_id: str,
+        *,
+        executor_run_id: str,
+        executor_id: str,
+        evidence: Mapping[str, str],
+    ) -> ExecutionTruthRecord:
+        normalized = {
+            str(key).strip(): sha256_value(value, f"evidence[{key}]")
+            for key, value in evidence.items()
+        }
+        record = self.registry.succeed(
+            task_id,
+            executor_run_id=executor_run_id,
+            executor_id=executor_id,
+            evidence=normalized,
+        )
+        self._notify(record, "SUCCEEDED")
+        return record
+
+    def fail(
+        self,
+        task_id: str,
+        *,
+        executor_run_id: str,
+        executor_id: str,
+        error: Mapping[str, Any],
+        evidence: Mapping[str, str] | None = None,
+    ) -> ExecutionTruthRecord:
+        normalized = None
+        if evidence is not None:
+            normalized = {
+                str(key).strip(): sha256_value(value, f"evidence[{key}]")
+                for key, value in evidence.items()
+            }
+        record = self.registry.fail(
+            task_id,
+            executor_run_id=executor_run_id,
+            executor_id=executor_id,
+            error=error,
+            evidence=normalized,
+        )
+        self._notify(record, "FAILED")
+        return record
+
+    def gate(self, task_id: str) -> Mapping[str, Any]:
+        before = self.registry.get(task_id)
+        truth = self.registry.gate(task_id)
+        after = self.registry.get(task_id)
+        if after.state != before.state and after.state in {
+            ExecutionTruthState.NOT_STARTED,
+            ExecutionTruthState.STALLED,
+        }:
+            self._notify(after, after.state.value)
+        notifications = self.notifications.list(task_id=task_id)
+        delivered = {item.event_type for item in notifications if item.status == "DELIVERED"}
+        required_success_notifications = {
+            item
+            for item in ("STARTED", "SUCCEEDED")
+            if item in set(after.manifest.notification_events)
+        }
+        notification_complete = required_success_notifications.issubset(delivered)
+        passed = bool(truth["passed"] and notification_complete)
+        return {
+            **dict(truth),
+            "passed": passed,
+            "release_blocking": not passed,
+            "notification_complete": notification_complete,
+            "required_success_notifications": sorted(required_success_notifications),
+            "delivered_notifications": sorted(delivered),
+            "notifications": [item.as_dict() for item in notifications],
+        }
+
+    def status(self, task_id: str) -> Mapping[str, Any]:
+        gate = self.gate(task_id)
+        record = self.registry.get(task_id)
+        return {
+            "record": record.as_dict(),
+            "gate": gate,
+            "events": self.registry.events(task_id),
+        }
+
+    @staticmethod
+    def content_receipt(value: Mapping[str, Any]) -> str:
+        encoded = json.dumps(dict(value), ensure_ascii=False, sort_keys=True, separators=(",", ":"), default=str).encode("utf-8")
+        return hashlib.sha256(encoded).hexdigest()
@@ -0,0 +1,51 @@
+"""Read models for the durable external-task truth registry."""
+from __future__ import annotations
+
+import json
+import sqlite3
+from pathlib import Path
+from typing import Sequence
+
+from .task_execution_registry import ExecutionTruthRecord, ExecutionTruthState
+
+
+def _decode(value: str) -> ExecutionTruthRecord:
+    payload = json.loads(value)
+    payload["state"] = ExecutionTruthState(payload["state"])
+    payload["evidence"] = dict(payload.get("evidence") or {})
+    payload["error"] = dict(payload.get("error") or {})
+    return ExecutionTruthRecord(**payload)
+
+
+def list_records(
+    path: str | Path,
+    *,
+    executor: str | None = None,
+    states: Sequence[str] = (),
+) -> list[ExecutionTruthRecord]:
+    database = Path(path).resolve()
+    if not database.exists():
+        return []
+    conditions: list[str] = []
+    values: list[str] = []
+    normalized_states = tuple(sorted({ExecutionTruthState(item).value for item in states}))
+    if normalized_states:
+        conditions.append(f"state IN ({','.join('?' for _ in normalized_states)})")
+        values.extend(normalized_states)
+    where = f" WHERE {' AND '.join(conditions)}" if conditions else ""
+    connection = sqlite3.connect(f"file:{database}?mode=ro", uri=True, timeout=10.0)
+    connection.row_factory = sqlite3.Row
+    try:
+        rows = connection.execute(
+            f"SELECT record_json FROM execution_truth{where} ORDER BY updated_at, task_id",
+            tuple(values),
+        ).fetchall()
+    except sqlite3.OperationalError:
+        return []
+    finally:
+        connection.close()
+    records = [_decode(row["record_json"]) for row in rows]
+    if executor:
+        normalized = str(executor).strip().lower()
+        records = [item for item in records if item.manifest.executor.lower() == normalized]
+    return records
@@ -0,0 +1,353 @@
+"""HTTP/JSON gateway for the AIOS V2 control plane.
+
+The public gateway owns user-facing control operations only. Runtime lifecycle
+transitions are deliberately absent: external callers cannot directly move a
+task to RUNNING, COMPLETED or FAILED. Those transitions are available only
+through the provenance-protected orchestrator and internal reconciliation API.
+"""
+from __future__ import annotations
+
+import dataclasses
+import json
+import os
+import re
+import urllib.parse
+from enum import Enum
+from http import HTTPStatus
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from typing import Any, Mapping
+
+from aios_hermes import HermesConflict, HermesNotFound
+
+from .control_plane import (
+    ControlPlaneError,
+    ControlPlaneService,
+    IdempotencyConflict,
+    InvalidTransition,
+    NotFound,
+    PolicyDenied,
+    RequestContext,
+    RevisionConflict,
+    TaskState,
+    TenantIsolationError,
+    Unauthorized,
+)
+from .dispatch_store import DispatchConflict, DispatchNotFound
+from .orchestrator import OrchestrationError
+from .provenance import ProvenanceDenied, ProvenanceReplay
+
+TENANT_HEADER = "X-AIOS-Tenant-ID"
+PRINCIPAL_HEADER = "X-AIOS-Principal-ID"
+ROLES_HEADER = "X-AIOS-Roles"
+TRACE_HEADER = "X-AIOS-Trace-ID"
+SESSION_HEADER = "X-AIOS-Session-ID"
+POLICY_HEADER = "X-AIOS-Policy-Version"
+AUTHENTICATED_HEADER = "X-AIOS-Authenticated"
+
+_RESOURCE_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{0,191}$")
+
+
+def _json_value(value: Any) -> Any:
+    if dataclasses.is_dataclass(value):
+        return {
+            field.name: _json_value(getattr(value, field.name))
+            for field in dataclasses.fields(value)
+        }
+    if isinstance(value, Enum):
+        return value.value
+    if isinstance(value, Mapping):
+        return {str(key): _json_value(item) for key, item in value.items()}
+    if isinstance(value, (list, tuple, set, frozenset)):
+        return [_json_value(item) for item in value]
+    return value
+
+
+def _require_mapping(value: Any, *, label: str = "JSON body") -> Mapping[str, Any]:
+    if not isinstance(value, Mapping):
+        raise ValueError(f"{label} must be an object")
+    return value
+
+
+def _require_resource_id(value: Any, *, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not _RESOURCE_ID_RE.fullmatch(normalized):
+        raise ValueError(f"invalid {label}")
+    return normalized
+
+
+class GatewayApplication:
+    """Pure user-facing request router that can be tested without a socket."""
+
+    def __init__(self, service: ControlPlaneService | None = None) -> None:
+        self.service = service or ControlPlaneService()
+
+    @staticmethod
+    def context_from_headers(headers: Mapping[str, str]) -> RequestContext:
+        normalized_headers = {
+            str(key).strip().lower(): value for key, value in headers.items()
+        }
+
+        def header(name: str, default: str = "") -> str:
+            return str(normalized_headers.get(name.lower(), default))
+
+        authenticated = header(AUTHENTICATED_HEADER).strip().lower()
+        if authenticated not in {"1", "true", "yes"}:
+            raise Unauthorized("trusted authentication assertion is required")
+        roles = [
+            role.strip()
+            for role in header(ROLES_HEADER).split(",")
+            if role.strip()
+        ]
+        return RequestContext.create(
+            tenant_id=header(TENANT_HEADER),
+            principal_id=header(PRINCIPAL_HEADER),
+            trace_id=header(TRACE_HEADER).strip() or None,
+            session_id=header(SESSION_HEADER).strip() or None,
+            policy_version=header(POLICY_HEADER, "v1").strip() or "v1",
+            roles=roles,
+        )
+
+    def handle(
+        self,
+        method: str,
+        raw_path: str,
+        headers: Mapping[str, str],
+        body: Any = None,
+    ) -> tuple[int, Mapping[str, Any]]:
+        parsed = urllib.parse.urlparse(raw_path)
+        path = parsed.path.rstrip("/") or "/"
+        query = urllib.parse.parse_qs(parsed.query, keep_blank_values=False)
+        method = method.upper()
+
+        if method == "GET" and path in {"/healthz", "/api/v2/health"}:
+            return HTTPStatus.OK, {
+                "service": "aios-v2-control-plane",
+                "status": "ok",
+                "store": type(self.service.store).__name__,
+            }
+
+        context = self.context_from_headers(headers)
+        payload = _require_mapping(body or {})
+
+        if method == "POST" and path == "/api/v2/tenants":
+            tenant = self.service.register_tenant(
+                context,
+                tenant_id=_require_resource_id(payload.get("tenant_id"), label="tenant_id"),
+                display_name=str(payload.get("display_name", "")),
+                metadata=_require_mapping(payload.get("metadata", {}), label="metadata"),
+            )
+            return HTTPStatus.CREATED, {"tenant": _json_value(tenant)}
+
+        if method == "GET" and path == "/api/v2/tenants/current":
+            return HTTPStatus.OK, {"tenant": _json_value(self.service.get_tenant(context))}
+
+        if method == "POST" and path == "/api/v2/agents":
+            agent = self.service.register_agent(
+                context,
+                agent_id=_require_resource_id(payload.get("agent_id"), label="agent_id"),
+                display_name=str(payload.get("display_name", "")),
+                runtime=str(payload.get("runtime", "")),
+                capabilities=payload.get("capabilities", ()),
+                metadata=_require_mapping(payload.get("metadata", {}), label="metadata"),
+            )
+            return HTTPStatus.CREATED, {"agent": _json_value(agent)}
+
+        if method == "GET" and path == "/api/v2/agents":
+            return HTTPStatus.OK, {"agents": _json_value(self.service.list_agents(context))}
+
+        agent_match = re.fullmatch(r"/api/v2/agents/([^/]+)", path)
+        if method == "GET" and agent_match:
+            agent_id = _require_resource_id(
+                urllib.parse.unquote(agent_match.group(1)), label="agent_id"
+            )
+            return HTTPStatus.OK, {
+                "agent": _json_value(self.service.get_agent(context, agent_id))
+            }
+
+        if method == "POST" and path == "/api/v2/tasks":
+            task = self.service.create_task(
+                context,
+                agent_id=_require_resource_id(payload.get("agent_id"), label="agent_id"),
+                action=str(payload.get("action", "")).strip(),
+                payload=_require_mapping(payload.get("payload", {}), label="payload"),
+                idempotency_key=(
+                    str(payload["idempotency_key"]).strip()
+                    if payload.get("idempotency_key") is not None
+                    else None
+                ),
+            )
+            return HTTPStatus.CREATED, {"task": _json_value(task)}
+
+        if method == "GET" and path == "/api/v2/tasks":
+            tasks = self.service.list_tasks(context, states=query.get("state"))
+            return HTTPStatus.OK, {"tasks": _json_value(tasks)}
+
+        task_match = re.fullmatch(r"/api/v2/tasks/([^/]+)", path)
+        if method == "GET" and task_match:
+            task_id = _require_resource_id(
+                urllib.parse.unquote(task_match.group(1)), label="task_id"
+            )
+            return HTTPStatus.OK, {
+                "task": _json_value(self.service.get_task(context, task_id))
+            }
+
+        bypass_match = re.fullmatch(
+            r"/api/v2/tasks/([^/]+)/(start|complete|fail)", path
+        )
+        if method == "POST" and bypass_match:
+            return HTTPStatus.FORBIDDEN, {
+                "error": "RuntimeLifecycleBypassDenied",
+                "message": (
+                    "RUNNING, COMPLETED and FAILED transitions are internal; "
+                    "use the provenance-protected dispatch/reconcile flow"
+                ),
+            }
+
+        transition_match = re.fullmatch(
+            r"/api/v2/tasks/([^/]+)/(approve|cancel)", path
+        )
+        if method == "POST" and transition_match:
+            task_id = _require_resource_id(
+                urllib.parse.unquote(transition_match.group(1)), label="task_id"
+            )
+            target = (
+                TaskState.APPROVED
+                if transition_match.group(2) == "approve"
+                else TaskState.CANCELLED
+            )
+            expected_revision = payload.get("expected_revision")
+            task = self.service.transition_task(
+                context,
+                task_id=task_id,
+                target_state=target,
+                expected_revision=(
+                    int(expected_revision) if expected_revision is not None else None
+                ),
+            )
+            return HTTPStatus.OK, {"task": _json_value(task)}
+
+        if method == "GET" and path == "/api/v2/audit":
+            resource_id = query.get("resource_id", [None])[0]
+            events = self.service.list_audit_events(
+                context,
+                resource_id=(
+                    _require_resource_id(resource_id, label="resource_id")
+                    if resource_id
+                    else None
+                ),
+            )
+            return HTTPStatus.OK, {"events": _json_value(events)}
+
+        return HTTPStatus.NOT_FOUND, {
+            "error": "not_found",
+            "message": "route not found",
+        }
+
+
+_ERROR_STATUS: tuple[tuple[type[BaseException], HTTPStatus], ...] = (
+    (Unauthorized, HTTPStatus.UNAUTHORIZED),
+    (PolicyDenied, HTTPStatus.FORBIDDEN),
+    (ProvenanceDenied, HTTPStatus.FORBIDDEN),
+    (TenantIsolationError, HTTPStatus.NOT_FOUND),
+    (NotFound, HTTPStatus.NOT_FOUND),
+    (DispatchNotFound, HTTPStatus.NOT_FOUND),
+    (HermesNotFound, HTTPStatus.NOT_FOUND),
+    (ProvenanceReplay, HTTPStatus.CONFLICT),
+    (IdempotencyConflict, HTTPStatus.CONFLICT),
+    (RevisionConflict, HTTPStatus.CONFLICT),
+    (InvalidTransition, HTTPStatus.CONFLICT),
+    (DispatchConflict, HTTPStatus.CONFLICT),
+    (HermesConflict, HTTPStatus.CONFLICT),
+    (OrchestrationError, HTTPStatus.CONFLICT),
+    (ValueError, HTTPStatus.BAD_REQUEST),
+    (ControlPlaneError, HTTPStatus.BAD_REQUEST),
+)
+
+
+def error_response(exc: BaseException) -> tuple[int, Mapping[str, Any]]:
+    for error_type, status in _ERROR_STATUS:
+        if isinstance(exc, error_type):
+            return status, {"error": error_type.__name__, "message": str(exc)}
+    return HTTPStatus.INTERNAL_SERVER_ERROR, {
+        "error": "InternalServerError",
+        "message": "internal server error",
+    }
+
+
+class GatewayRequestHandler(BaseHTTPRequestHandler):
+    server_version = "AIOSV2Gateway/1.0"
+    max_body_bytes = 1_048_576
+
+    @property
+    def application(self) -> GatewayApplication:
+        return self.server.application  # type: ignore[attr-defined]
+
+    def _read_body(self) -> Any:
+        length = int(self.headers.get("Content-Length", "0") or "0")
+        if length < 0 or length > self.max_body_bytes:
+            raise ValueError("request body is too large")
+        if length == 0:
+            return {}
+        content_type = self.headers.get("Content-Type", "").split(";", 1)[0].strip()
+        if content_type != "application/json":
+            raise ValueError("Content-Type must be application/json")
+        return json.loads(self.rfile.read(length).decode("utf-8"))
+
+    def _send_json(self, status: int, payload: Mapping[str, Any]) -> None:
+        encoded = json.dumps(
+            _json_value(payload), ensure_ascii=False, separators=(",", ":")
+        ).encode("utf-8")
+        self.send_response(int(status))
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("X-Content-Type-Options", "nosniff")
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def _dispatch(self, method: str) -> None:
+        try:
+            body = self._read_body() if method in {"POST", "PUT", "PATCH"} else {}
+            status, payload = self.application.handle(
+                method,
+                self.path,
+                {key: value for key, value in self.headers.items()},
+                body,
+            )
+        except Exception as exc:
+            status, payload = error_response(exc)
+        self._send_json(status, payload)
+
+    def do_GET(self) -> None:  # noqa: N802
+        self._dispatch("GET")
+
+    def do_POST(self) -> None:  # noqa: N802
+        self._dispatch("POST")
+
+    def log_message(self, format: str, *args: Any) -> None:
+        super().log_message(format, *args)
+
+
+class GatewayHTTPServer(ThreadingHTTPServer):
+    daemon_threads = True
+    allow_reuse_address = True
+
+    def __init__(
+        self,
+        server_address: tuple[str, int],
+        application: GatewayApplication,
+    ) -> None:
+        self.application = application
+        super().__init__(server_address, GatewayRequestHandler)
+
+
+def main() -> None:
+    host = os.getenv("AIOS_V2_GATEWAY_HOST", "127.0.0.1")
+    port = int(os.getenv("AIOS_V2_GATEWAY_PORT", "18920"))
+    server = GatewayHTTPServer((host, port), GatewayApplication())
+    print(f"AIOS V2 control-plane gateway listening on {host}:{port}")
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,123 @@
+"""Sanitized GitOps runtime status for the AIOS Web control plane."""
+from __future__ import annotations
+
+import os
+import subprocess
+from dataclasses import dataclass, asdict
+from pathlib import Path
+from typing import Any, Mapping
+
+
+@dataclass(frozen=True)
+class GitOpsStatus:
+    available: bool
+    service_status: str
+    workspace_mode: str
+    workspace_branch: str | None
+    workspace_ref: str | None
+    workspace_dirty: bool | None
+    candidate_branch: str
+    release_channel: str
+    release_version: str
+    sync_status: str
+    details: Mapping[str, Any]
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+def _run_git(worktree: Path, *args: str) -> tuple[int, str, str]:
+    process = subprocess.run(
+        ["git", "-C", str(worktree), *args],
+        text=True,
+        capture_output=True,
+        timeout=5,
+    )
+    return process.returncode, process.stdout.strip(), process.stderr.strip()
+
+
+def collect_gitops_status() -> GitOpsStatus:
+    """Return only non-sensitive Git/workspace metadata.
+
+    Remote URLs, environment values, credentials, filesystem contents and
+    command stderr are deliberately excluded from the Web response.
+    """
+
+    candidate_branch = os.getenv(
+        "AIOS_CANDIDATE_BRANCH",
+        "integration/aios-v2r1-cto-production-candidate-20260720",
+    )
+    release_channel = os.getenv("AIOS_RELEASE_CHANNEL", "candidate")
+    release_version = os.getenv("AIOS_RELEASE_VERSION", "V2R1C0-candidate")
+    sync_status = os.getenv("AIOS_GITOPS_SYNC_STATUS", "unknown")
+    worktree = Path(
+        os.getenv(
+            "AIOS_GITOPS_CONTROLLER_WORKTREE",
+            "/data/aios-gitops/worktrees/controller",
+        )
+    )
+
+    if not worktree.is_dir():
+        return GitOpsStatus(
+            available=False,
+            service_status="unknown",
+            workspace_mode="unavailable",
+            workspace_branch=None,
+            workspace_ref=None,
+            workspace_dirty=None,
+            candidate_branch=candidate_branch,
+            release_channel=release_channel,
+            release_version=release_version,
+            sync_status=sync_status,
+            details={"reason": "controller_worktree_unavailable"},
+        )
+
+    inside_code, inside, _ = _run_git(worktree, "rev-parse", "--is-inside-work-tree")
+    if inside_code != 0 or inside != "true":
+        return GitOpsStatus(
+            available=False,
+            service_status="unknown",
+            workspace_mode="invalid",
+            workspace_branch=None,
+            workspace_ref=None,
+            workspace_dirty=None,
+            candidate_branch=candidate_branch,
+            release_channel=release_channel,
+            release_version=release_version,
+            sync_status=sync_status,
+            details={"reason": "controller_worktree_invalid"},
+        )
+
+    branch_code, branch, _ = _run_git(worktree, "branch", "--show-current")
+    ref_code, ref_value, _ = _run_git(worktree, "rev-parse", "HEAD")
+    dirty_code, dirty_value, _ = _run_git(worktree, "status", "--porcelain=v1")
+
+    service_status = "unknown"
+    try:
+        process = subprocess.run(
+            ["systemctl", "is-active", "aios-gitops-model-api"],
+            text=True,
+            capture_output=True,
+            timeout=3,
+        )
+        service_status = process.stdout.strip() or "inactive"
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        service_status = "unavailable"
+
+    branch_value = branch if branch_code == 0 and branch else None
+    return GitOpsStatus(
+        available=True,
+        service_status=service_status,
+        workspace_mode="branch" if branch_value else "detached",
+        workspace_branch=branch_value,
+        workspace_ref=ref_value if ref_code == 0 else None,
+        workspace_dirty=bool(dirty_value) if dirty_code == 0 else None,
+        candidate_branch=candidate_branch,
+        release_channel=release_channel,
+        release_version=release_version,
+        sync_status=sync_status,
+        details={
+            "controller_clean": dirty_code == 0 and not dirty_value,
+            "controller_detached": branch_code == 0 and not branch,
+        },
+    )
@@ -0,0 +1,238 @@
+"""Official AIOS executor providers built on the portable provider protocol.
+
+The official providers contain no lifecycle implementation. They validate their
+manifests, resolve a generic ``UnifiedExecutorWorker`` from runtime-supplied
+boundaries and expose the same adapter contract. Future providers can use
+``ConfiguredExecutorProvider`` directly without changing AIOS core modules.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Mapping, Sequence
+
+from .execution_plan import ExecutionPlanCoordinator, ExecutionStageManifest
+from .executor_protocol import (
+    EXECUTOR_PROTOCOL_VERSION,
+    ExternalExecutorAdapter,
+    ExecutorProviderDescriptor,
+    normalize_executor,
+)
+from .executor_worker import NotificationSender, StepRunner, UnifiedExecutorWorker
+from .external_task_control import ExternalTaskCoordinator
+from .task_execution_registry import ExecutionTaskManifest, ExecutionTruthRecord
+
+
+@dataclass(frozen=True)
+class ProviderRuntimeConfiguration:
+    plan_id: str
+    executor_id: str
+    plan_coordinator: ExecutionPlanCoordinator
+    task_coordinator: ExternalTaskCoordinator
+    providers: Any
+    step_runner: StepRunner
+    notification_sender: NotificationSender
+
+    @classmethod
+    def from_mapping(cls, value: Mapping[str, Any]) -> "ProviderRuntimeConfiguration":
+        required = (
+            "plan_id",
+            "executor_id",
+            "plan_coordinator",
+            "task_coordinator",
+            "providers",
+            "step_runner",
+            "notification_sender",
+        )
+        missing = [name for name in required if value.get(name) is None]
+        if missing:
+            raise ValueError(f"provider runtime configuration is missing: {missing}")
+        return cls(**{name: value[name] for name in required})
+
+
+class ConfiguredExecutorAdapter:
+    """Generic adapter produced by every official or third-party provider."""
+
+    def __init__(
+        self,
+        descriptor: ExecutorProviderDescriptor,
+        configuration: ProviderRuntimeConfiguration,
+    ) -> None:
+        self.descriptor = descriptor
+        self.configuration = configuration
+        self.worker = UnifiedExecutorWorker(
+            plan_coordinator=configuration.plan_coordinator,
+            task_coordinator=configuration.task_coordinator,
+            providers=configuration.providers,
+            executor_type=descriptor.executor_type,
+            executor_id=configuration.executor_id,
+            step_runner=configuration.step_runner,
+            notification_sender=configuration.notification_sender,
+        )
+
+    def discover(self) -> Sequence[ExecutionTruthRecord]:
+        ready = self.configuration.plan_coordinator.discover_ready(
+            plan_id=self.configuration.plan_id,
+            executor_type=self.descriptor.executor_type,
+        )
+        return tuple(item["record"] for item in ready)
+
+    def execute(self, manifest: ExecutionTaskManifest) -> Mapping[str, Any]:
+        if normalize_executor(manifest.executor) != self.descriptor.executor_type:
+            raise PermissionError("manifest executor does not match adapter provider")
+        plan = self.configuration.plan_coordinator.plan_store.get(
+            self.configuration.plan_id
+        )
+        stage: ExecutionStageManifest | None = None
+        for item in plan.stages:
+            if item.task_id == manifest.task_id:
+                stage = item
+                break
+        if stage is None:
+            raise KeyError("manifest task is not part of configured execution plan")
+        return self.worker.run_stage(
+            plan_id=plan.plan_id,
+            stage_id=stage.stage_id,
+        ).as_dict()
+
+    def notify_owner(self, payload: Mapping[str, Any]) -> str:
+        # External callers normally use the durable NotificationOutbox. This
+        # method remains part of the portable adapter contract for providers
+        # that need to send a standalone operational notice.
+        from .external_task_control import NotificationRecord
+        from .task_execution_registry import utc_now
+
+        notification = NotificationRecord(
+            notification_id="provider_direct_notice",
+            task_id=str(payload.get("task_id") or "provider-notice"),
+            event_type=str(payload.get("event_type") or "INFO"),
+            target_ref=str(
+                payload.get("target_ref") or "AIOS_OWNER_WECHAT_TARGET_REF"
+            ),
+            payload=dict(payload),
+            status="PENDING",
+            created_at=utc_now(),
+        )
+        return self.configuration.notification_sender.send(notification)
+
+
+class ConfiguredExecutorProvider:
+    """Reusable provider implementation for current and future executors."""
+
+    descriptor: ExecutorProviderDescriptor
+
+    def __init__(self, descriptor: ExecutorProviderDescriptor) -> None:
+        self.descriptor = descriptor
+
+    def validate_manifest(self, manifest: ExecutionTaskManifest) -> None:
+        if normalize_executor(manifest.executor) != self.descriptor.executor_type:
+            raise ValueError("manifest executor does not match provider")
+        if manifest.manifest_version not in {
+            "aios.external-task.v1",
+            "aios.external-task.v2",
+        }:
+            raise ValueError("unsupported external task manifest version")
+        if not manifest.steps:
+            raise ValueError("executor manifest has no steps")
+
+    def build_adapter(self, configuration: Mapping[str, Any]) -> ExternalExecutorAdapter:
+        return ConfiguredExecutorAdapter(
+            self.descriptor,
+            ProviderRuntimeConfiguration.from_mapping(configuration),
+        )
+
+
+class OpenClawProvider(ConfiguredExecutorProvider):
+    def __init__(self) -> None:
+        super().__init__(
+            ExecutorProviderDescriptor(
+                executor_type="openclaw",
+                adapter_version="2.1.0",
+                protocol_version=EXECUTOR_PROTOCOL_VERSION,
+                trust_roles=("runtime", "openclaw_executor"),
+                capabilities=(
+                    "deploy",
+                    "http_runtime",
+                    "owner_notification",
+                    "healthcheck",
+                    "rollback",
+                ),
+                configuration_schema="aios.executor.openclaw.config.v1",
+                metadata={"official": True},
+            )
+        )
+
+
+class HermesProvider(ConfiguredExecutorProvider):
+    def __init__(self) -> None:
+        super().__init__(
+            ExecutorProviderDescriptor(
+                executor_type="hermes",
+                adapter_version="2.1.0",
+                protocol_version=EXECUTOR_PROTOCOL_VERSION,
+                trust_roles=("runtime", "hermes_executor"),
+                capabilities=(
+                    "queue",
+                    "lease",
+                    "worker",
+                    "runtime_validation",
+                    "restart_recovery",
+                ),
+                configuration_schema="aios.executor.hermes.config.v1",
+                metadata={"official": True},
+            )
+        )
+
+
+class CodexProvider(ConfiguredExecutorProvider):
+    def __init__(self) -> None:
+        super().__init__(
+            ExecutorProviderDescriptor(
+                executor_type="codex",
+                adapter_version="2.1.0",
+                protocol_version=EXECUTOR_PROTOCOL_VERSION,
+                trust_roles=("codex", "codex_executor"),
+                capabilities=(
+                    "code",
+                    "test",
+                    "docs",
+                    "gitops_patch",
+                    "security_review",
+                ),
+                configuration_schema="aios.executor.codex.config.v1",
+                metadata={"official": True},
+            )
+        )
+
+
+class ChatGPTSupervisorProvider(ConfiguredExecutorProvider):
+    """Explicit takeover provider; it does not inherit Codex permissions."""
+
+    def __init__(self) -> None:
+        super().__init__(
+            ExecutorProviderDescriptor(
+                executor_type="chatgpt-supervisor",
+                adapter_version="2.1.0",
+                protocol_version=EXECUTOR_PROTOCOL_VERSION,
+                trust_roles=("chatgpt_supervisor",),
+                capabilities=(
+                    "acceptance",
+                    "deploy",
+                    "evidence",
+                    "healthcheck",
+                    "rollback",
+                    "wechat_simulation",
+                ),
+                configuration_schema="aios.executor.chatgpt-supervisor.config.v1",
+                metadata={"official": True, "production_mutation_allowed": False},
+            )
+        )
+
+
+def official_provider_factories() -> Mapping[str, ConfiguredExecutorProvider]:
+    providers = (
+        OpenClawProvider(),
+        HermesProvider(),
+        CodexProvider(),
+        ChatGPTSupervisorProvider(),
+    )
+    return {item.descriptor.executor_type: item for item in providers}
@@ -0,0 +1,599 @@
+"""AIOS V2 execution orchestrator.
+
+The orchestrator is the only component allowed to translate an approved AIOS
+Task into an OpenClaw command or Hermes job. Every dispatch is persisted before
+Runtime side effects. Runtime results must bind to the exact dispatch,
+command/job, tenant, task, trace, principal and provenance context.
+"""
+from __future__ import annotations
+
+from typing import Any, Mapping, Protocol
+
+from aios_hermes import HermesAdapter, HermesJob, HermesJobState, HermesResult
+from aios_openclaw import (
+    CommandState,
+    OpenClawAdapter,
+    OpenClawCommand,
+    OpenClawResult,
+    sign_command,
+)
+
+from .control_plane import (
+    AgentRecord,
+    ControlPlaneService,
+    RequestContext,
+    TaskRecord,
+    TaskState,
+)
+from .dispatch_store import (
+    DispatchConflict,
+    DispatchRecord,
+    DispatchRepository,
+    DispatchState,
+    InMemoryDispatchRepository,
+    TERMINAL_DISPATCH_STATES,
+)
+from .provenance import ProvenanceDenied, digest_payload
+
+
+class RuntimeAuthorizationWriter(Protocol):
+    def authorize_runtime_execute(self, **values: Any) -> Any: ...
+
+
+class OrchestrationError(RuntimeError):
+    """AIOS failed to dispatch or reconcile a runtime execution."""
+
+
+class ExecutionOrchestrator:
+    """Dispatch approved AIOS tasks and strictly reconcile Runtime results."""
+
+    def __init__(
+        self,
+        control_plane: ControlPlaneService,
+        *,
+        openclaw: OpenClawAdapter | None = None,
+        hermes: HermesAdapter | None = None,
+        openclaw_signing_material_resolver=None,
+        openclaw_key_id: str = "default",
+        default_cell_id: str = "default",
+        default_profile_id: str = "default",
+        provenance_writer: RuntimeAuthorizationWriter | None = None,
+        require_provenance: bool = False,
+        dispatch_repository: DispatchRepository | None = None,
+    ) -> None:
+        self.control_plane = control_plane
+        self.openclaw = openclaw
+        self.hermes = hermes
+        self.openclaw_signing_material_resolver = openclaw_signing_material_resolver
+        self.openclaw_key_id = str(openclaw_key_id or "").strip() or "default"
+        self.default_cell_id = default_cell_id
+        self.default_profile_id = default_profile_id
+        self.provenance_writer = provenance_writer
+        self.require_provenance = bool(require_provenance)
+        self.dispatch_repository = dispatch_repository or InMemoryDispatchRepository()
+        if self.require_provenance and self.provenance_writer is None:
+            raise ValueError("production orchestration requires a provenance writer")
+
+    @staticmethod
+    def _record_provenance(value: str | None, *, required: bool, label: str) -> str:
+        normalized = str(value or "").strip()
+        if required and not normalized:
+            raise OrchestrationError(f"production dispatch requires {label}")
+        return normalized or f"{label}-not-required"
+
+    def _authorize_dispatch(
+        self,
+        context: RequestContext,
+        *,
+        task: TaskRecord,
+        agent: AgentRecord,
+        provenance_id: str | None,
+        run_id: str | None,
+        timeout_seconds: float | None,
+    ) -> str:
+        if not self.require_provenance:
+            return "authorization-not-required"
+        if self.provenance_writer is None:
+            raise OrchestrationError("Run Provenance writer is not configured")
+        if not provenance_id or not run_id:
+            raise OrchestrationError(
+                "production dispatch requires provenance_id and run_id"
+            )
+        request_digest = digest_payload(
+            {
+                "operation": "dispatch",
+                "tenant_id": task.tenant_id,
+                "task_id": task.task_id,
+                "agent_id": agent.agent_id,
+                "principal_id": context.principal_id,
+                "runtime": agent.runtime.strip().lower(),
+                "action": task.action,
+                "payload": task.payload,
+                "trace_id": context.trace_id,
+                "timeout_seconds": timeout_seconds,
+                "task_revision": task.revision,
+            }
+        )
+        try:
+            authorization = self.provenance_writer.authorize_runtime_execute(
+                provenance_id=provenance_id,
+                run_id=run_id,
+                tenant_id=task.tenant_id,
+                task_id=task.task_id,
+                agent_id=agent.agent_id,
+                principal_id=context.principal_id,
+                request_digest=request_digest,
+            )
+            return authorization.authorization_id
+        except ProvenanceDenied as exc:
+            raise OrchestrationError(f"Run Provenance denied dispatch: {exc}") from exc
+
+    def dispatch(
+        self,
+        context: RequestContext,
+        *,
+        task_id: str,
+        timeout_seconds: float | None = None,
+        provenance_id: str | None = None,
+        run_id: str | None = None,
+    ) -> DispatchRecord:
+        task = self.control_plane.get_task(context, task_id)
+        agent = self.control_plane.get_agent(context, task.agent_id)
+        persisted_provenance = self._record_provenance(
+            provenance_id, required=self.require_provenance, label="provenance_id"
+        )
+        persisted_run = self._record_provenance(
+            run_id, required=self.require_provenance, label="run_id"
+        )
+
+        existing = self.dispatch_repository.get_by_task(
+            task.task_id, tenant_id=task.tenant_id
+        )
+        if existing is not None:
+            if (
+                existing.provenance_id != persisted_provenance
+                or existing.run_id != persisted_run
+                or existing.principal_id != context.principal_id
+            ):
+                raise OrchestrationError(
+                    "existing dispatch belongs to another provenance or principal context"
+                )
+            return existing
+
+        if task.state != TaskState.APPROVED:
+            raise OrchestrationError("only APPROVED tasks may be dispatched")
+
+        authorization_id = self._authorize_dispatch(
+            context,
+            task=task,
+            agent=agent,
+            provenance_id=provenance_id,
+            run_id=run_id,
+            timeout_seconds=timeout_seconds,
+        )
+        runtime = agent.runtime.strip().lower()
+        prepared: DispatchRecord | None = None
+
+        try:
+            if runtime == "openclaw":
+                command = self._create_openclaw_command(context, task)
+                prepared = self.dispatch_repository.create(
+                    DispatchRecord.create(
+                        tenant_id=task.tenant_id,
+                        task_id=task.task_id,
+                        agent_id=agent.agent_id,
+                        principal_id=context.principal_id,
+                        runtime="openclaw",
+                        runtime_execution_id=command.command_id,
+                        trace_id=context.trace_id,
+                        provenance_id=persisted_provenance,
+                        run_id=persisted_run,
+                        authorization_id=authorization_id,
+                    )
+                )
+                self.control_plane.transition_task(
+                    context,
+                    task_id=task.task_id,
+                    target_state=TaskState.RUNNING,
+                    expected_revision=task.revision,
+                )
+                self.dispatch_repository.update(
+                    prepared.dispatch_id,
+                    tenant_id=prepared.tenant_id,
+                    state=DispatchState.RUNNING,
+                )
+                if self.openclaw is None:
+                    raise OrchestrationError("OpenClaw runtime is not configured")
+                result = self.openclaw.execute(
+                    command, timeout_seconds=timeout_seconds
+                )
+                self.reconcile_openclaw(
+                    context,
+                    result,
+                    dispatch_id=prepared.dispatch_id,
+                    provenance_id=persisted_provenance,
+                    run_id=persisted_run,
+                )
+                return self.dispatch_repository.get(
+                    prepared.dispatch_id, tenant_id=prepared.tenant_id
+                )
+
+            if runtime == "hermes":
+                if self.hermes is None:
+                    raise OrchestrationError("Hermes runtime is not configured")
+                job = self._create_hermes_job(context, agent, task)
+                prepared = self.dispatch_repository.create(
+                    DispatchRecord.create(
+                        tenant_id=task.tenant_id,
+                        task_id=task.task_id,
+                        agent_id=agent.agent_id,
+                        principal_id=context.principal_id,
+                        runtime="hermes",
+                        runtime_execution_id=job.job_id,
+                        trace_id=context.trace_id,
+                        provenance_id=persisted_provenance,
+                        run_id=persisted_run,
+                        authorization_id=authorization_id,
+                    )
+                )
+                self.control_plane.transition_task(
+                    context,
+                    task_id=task.task_id,
+                    target_state=TaskState.RUNNING,
+                    expected_revision=task.revision,
+                )
+                queued = self.hermes.enqueue(job)
+                return self.dispatch_repository.update(
+                    prepared.dispatch_id,
+                    tenant_id=prepared.tenant_id,
+                    state=DispatchState.QUEUED,
+                    result_digest=digest_payload(
+                        {
+                            "queued_job_id": queued.job_id,
+                            "state": queued.state.value,
+                            "revision": queued.revision,
+                        }
+                    ),
+                )
+
+            raise OrchestrationError(f"unsupported runtime: {agent.runtime}")
+        except Exception as exc:
+            if prepared is not None:
+                try:
+                    self.dispatch_repository.update(
+                        prepared.dispatch_id,
+                        tenant_id=prepared.tenant_id,
+                        state=DispatchState.FAILED,
+                        result_digest=digest_payload(
+                            {
+                                "code": "dispatch_failed",
+                                "error_type": type(exc).__name__,
+                                "message": str(exc),
+                            }
+                        ),
+                    )
+                except Exception:
+                    pass
+            current = self.control_plane.get_task(context, task.task_id)
+            if current.state == TaskState.RUNNING:
+                self.control_plane.transition_task(
+                    context,
+                    task_id=task.task_id,
+                    target_state=TaskState.FAILED,
+                    expected_revision=current.revision,
+                    error={"code": "dispatch_failed", "message": str(exc)},
+                )
+            raise
+
+    def _create_openclaw_command(
+        self,
+        context: RequestContext,
+        task: TaskRecord,
+    ) -> OpenClawCommand:
+        if self.openclaw_signing_material_resolver is None:
+            raise OrchestrationError("OpenClaw signing material is not configured")
+        key_material = self.openclaw_signing_material_resolver(
+            task.tenant_id,
+            self.openclaw_key_id,
+        )
+        command = OpenClawCommand.create(
+            tenant_id=task.tenant_id,
+            task_id=task.task_id,
+            trace_id=context.trace_id,
+            action=task.action,
+            payload=task.payload,
+            idempotency_key=task.idempotency_key or task.task_id,
+            key_id=self.openclaw_key_id,
+        )
+        return sign_command(command, key_material)
+
+    def _create_hermes_job(
+        self,
+        context: RequestContext,
+        agent: AgentRecord,
+        task: TaskRecord,
+    ) -> HermesJob:
+        metadata = dict(agent.metadata)
+        return HermesJob.create(
+            tenant_id=task.tenant_id,
+            cell_id=str(metadata.get("cell_id") or self.default_cell_id),
+            profile_id=str(metadata.get("profile_id") or self.default_profile_id),
+            task_id=task.task_id,
+            trace_id=context.trace_id,
+            action=task.action,
+            payload=task.payload,
+            idempotency_key=task.idempotency_key or task.task_id,
+            priority=int(metadata.get("priority", 100)),
+        )
+
+    @staticmethod
+    def _assert_dispatch_context(
+        dispatch: DispatchRecord,
+        *,
+        runtime: str,
+        runtime_execution_id: str,
+        tenant_id: str,
+        task_id: str,
+        trace_id: str,
+        principal_id: str,
+        provenance_id: str,
+        run_id: str,
+    ) -> None:
+        expected = {
+            "runtime": runtime,
+            "runtime_execution_id": runtime_execution_id,
+            "tenant_id": tenant_id,
+            "task_id": task_id,
+            "trace_id": trace_id,
+            "principal_id": principal_id,
+            "provenance_id": provenance_id,
+            "run_id": run_id,
+        }
+        for field_name, expected_value in expected.items():
+            if getattr(dispatch, field_name) != expected_value:
+                raise OrchestrationError(f"dispatch {field_name} mismatch")
+
+    def hermes_lifecycle_context(
+        self,
+        context: RequestContext,
+        *,
+        dispatch_id: str,
+        job_id: str,
+        tenant_id: str,
+        task_id: str,
+        trace_id: str,
+        principal_id: str,
+        provenance_id: str,
+        run_id: str,
+    ) -> tuple[DispatchRecord, HermesJob]:
+        """Resolve a runtime lifecycle request against its durable dispatch."""
+        dispatch = self.dispatch_repository.get(
+            dispatch_id, tenant_id=context.tenant_id
+        )
+        self._assert_dispatch_context(
+            dispatch,
+            runtime="hermes",
+            runtime_execution_id=job_id,
+            tenant_id=tenant_id,
+            task_id=task_id,
+            trace_id=trace_id,
+            principal_id=principal_id,
+            provenance_id=provenance_id,
+            run_id=run_id,
+        )
+        if context.tenant_id != tenant_id:
+            raise OrchestrationError("runtime context tenant_id mismatch")
+        if context.principal_id != principal_id:
+            raise OrchestrationError("runtime context principal_id mismatch")
+        if context.trace_id != trace_id:
+            raise OrchestrationError("runtime context trace_id mismatch")
+        if self.hermes is None:
+            raise OrchestrationError("Hermes runtime is not configured")
+        job = self.hermes.get(job_id, tenant_id=tenant_id)
+        if job.task_id != task_id or job.trace_id != trace_id:
+            raise OrchestrationError("Hermes job identity mismatch")
+        return dispatch, job
+
+    def bind_hermes_worker(
+        self,
+        context: RequestContext,
+        job: HermesJob,
+        *,
+        dispatch_id: str,
+        provenance_id: str,
+        run_id: str,
+        worker_id: str,
+    ) -> DispatchRecord:
+        dispatch, current = self.hermes_lifecycle_context(
+            context,
+            dispatch_id=dispatch_id,
+            job_id=job.job_id,
+            tenant_id=job.tenant_id,
+            task_id=job.task_id,
+            trace_id=job.trace_id,
+            principal_id=context.principal_id,
+            provenance_id=provenance_id,
+            run_id=run_id,
+        )
+        if current.assigned_worker_id != worker_id:
+            raise OrchestrationError("Hermes worker does not own claimed job")
+        return self.dispatch_repository.update(
+            dispatch.dispatch_id,
+            tenant_id=dispatch.tenant_id,
+            expected_worker_id=worker_id,
+        )
+
+    def reconcile_openclaw(
+        self,
+        context: RequestContext,
+        result: OpenClawResult,
+        *,
+        dispatch_id: str,
+        provenance_id: str,
+        run_id: str,
+    ) -> TaskRecord:
+        dispatch = self.dispatch_repository.get(
+            dispatch_id, tenant_id=context.tenant_id
+        )
+        self._assert_dispatch_context(
+            dispatch,
+            runtime="openclaw",
+            runtime_execution_id=result.command_id,
+            tenant_id=result.tenant_id,
+            task_id=result.task_id,
+            trace_id=result.trace_id,
+            principal_id=context.principal_id,
+            provenance_id=provenance_id,
+            run_id=run_id,
+        )
+        result_digest = digest_payload(
+            {
+                "command_id": result.command_id,
+                "state": result.state.value,
+                "output": result.output,
+                "error": result.error,
+                "runtime_id": result.runtime_id,
+                "attempts": result.attempts,
+                "finished_at": result.finished_at,
+            }
+        )
+        if dispatch.state in TERMINAL_DISPATCH_STATES:
+            if dispatch.result_digest != result_digest:
+                raise DispatchConflict("terminal dispatch received a different result")
+            return self.control_plane.get_task(context, dispatch.task_id)
+
+        task = self.control_plane.get_task(context, dispatch.task_id)
+        if task.state != TaskState.RUNNING:
+            raise OrchestrationError("task is not RUNNING for active dispatch")
+        if result.state == CommandState.COMPLETED:
+            target = TaskState.COMPLETED
+            values = {"result": result.output or {}}
+            dispatch_state = DispatchState.COMPLETED
+        elif result.state in {
+            CommandState.FAILED,
+            CommandState.TIMED_OUT,
+            CommandState.REJECTED,
+        }:
+            target = TaskState.FAILED
+            values = {
+                "error": result.error or {"code": result.state.value.lower()}
+            }
+            dispatch_state = DispatchState.FAILED
+        elif result.state == CommandState.CANCELLED:
+            target = TaskState.CANCELLED
+            values = {}
+            dispatch_state = DispatchState.CANCELLED
+        else:
+            self.dispatch_repository.update(
+                dispatch.dispatch_id,
+                tenant_id=dispatch.tenant_id,
+                state=DispatchState.RUNNING,
+                result_digest=result_digest,
+            )
+            return task
+
+        updated_task = self.control_plane.transition_task(
+            context,
+            task_id=task.task_id,
+            target_state=target,
+            expected_revision=task.revision,
+            **values,
+        )
+        self.dispatch_repository.update(
+            dispatch.dispatch_id,
+            tenant_id=dispatch.tenant_id,
+            state=dispatch_state,
+            result_digest=result_digest,
+        )
+        return updated_task
+
+    def reconcile_hermes(
+        self,
+        context: RequestContext,
+        result: HermesResult,
+        *,
+        dispatch_id: str,
+        provenance_id: str,
+        run_id: str,
+    ) -> TaskRecord:
+        dispatch = self.dispatch_repository.get(
+            dispatch_id, tenant_id=context.tenant_id
+        )
+        self._assert_dispatch_context(
+            dispatch,
+            runtime="hermes",
+            runtime_execution_id=result.job_id,
+            tenant_id=result.tenant_id,
+            task_id=result.task_id,
+            trace_id=result.trace_id,
+            principal_id=context.principal_id,
+            provenance_id=provenance_id,
+            run_id=run_id,
+        )
+        if self.hermes is None:
+            raise OrchestrationError("Hermes runtime is not configured")
+        job = self.hermes.get(result.job_id, tenant_id=result.tenant_id)
+        if result.state in {HermesJobState.COMPLETED, HermesJobState.FAILED}:
+            if not result.worker_id:
+                raise OrchestrationError("terminal Hermes result requires worker_id")
+            if job.assigned_worker_id != result.worker_id:
+                raise OrchestrationError("Hermes result worker does not own job lease")
+            if (
+                dispatch.expected_worker_id is not None
+                and dispatch.expected_worker_id != result.worker_id
+            ):
+                raise OrchestrationError("Hermes result worker mismatch")
+        result_digest = digest_payload(
+            {
+                "job_id": result.job_id,
+                "worker_id": result.worker_id,
+                "state": result.state.value,
+                "output": result.output,
+                "error": result.error,
+                "finished_at": result.finished_at,
+            }
+        )
+        if dispatch.state in TERMINAL_DISPATCH_STATES:
+            if dispatch.result_digest != result_digest:
+                raise DispatchConflict("terminal dispatch received a different result")
+            return self.control_plane.get_task(context, dispatch.task_id)
+
+        task = self.control_plane.get_task(context, dispatch.task_id)
+        if task.state != TaskState.RUNNING:
+            raise OrchestrationError("task is not RUNNING for active dispatch")
+        if result.state == HermesJobState.COMPLETED:
+            target = TaskState.COMPLETED
+            values = {"result": result.output or {}}
+            dispatch_state = DispatchState.COMPLETED
+        elif result.state == HermesJobState.FAILED:
+            target = TaskState.FAILED
+            values = {"error": result.error or {"code": "hermes_failed"}}
+            dispatch_state = DispatchState.FAILED
+        elif result.state == HermesJobState.CANCELLED:
+            target = TaskState.CANCELLED
+            values = {}
+            dispatch_state = DispatchState.CANCELLED
+        else:
+            raise OrchestrationError("Hermes reconcile only accepts terminal results")
+
+        updated_task = self.control_plane.transition_task(
+            context,
+            task_id=task.task_id,
+            target_state=target,
+            expected_revision=task.revision,
+            **values,
+        )
+        self.dispatch_repository.update(
+            dispatch.dispatch_id,
+            tenant_id=dispatch.tenant_id,
+            state=dispatch_state,
+            expected_worker_id=result.worker_id,
+            result_digest=result_digest,
+        )
+        return updated_task
+
+    def dispatch_snapshot(self, *, tenant_id: str) -> Mapping[str, DispatchRecord]:
+        return {
+            item.task_id: item
+            for item in self.dispatch_repository.list(tenant_id=tenant_id)
+        }
@@ -0,0 +1,181 @@
+"""Durable single-process persistence for the AIOS V2 control plane.
+
+The candidate uses an atomic SQLite snapshot so a gateway restart does not lose
+tenants, agents, task state, idempotency records, or audit events.  The domain
+service remains storage-agnostic; a later HA backend can replace this module
+without changing API or runtime-adapter contracts.
+"""
+from __future__ import annotations
+
+import json
+import sqlite3
+import threading
+from dataclasses import asdict
+from pathlib import Path
+from typing import Any, Callable
+
+from .control_plane import (
+    AgentRecord,
+    AuditEvent,
+    ControlPlaneService,
+    InMemoryControlPlaneStore,
+    TaskRecord,
+    TaskState,
+    TenantRecord,
+)
+
+
+class SQLiteSnapshotRepository:
+    """Store one versioned control-plane snapshot in SQLite."""
+
+    SCHEMA_VERSION = 1
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+        self._initialize()
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(self.path, timeout=30.0)
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        connection.execute("PRAGMA foreign_keys=ON")
+        return connection
+
+    def _initialize(self) -> None:
+        with self._connect() as connection:
+            connection.execute(
+                """
+                CREATE TABLE IF NOT EXISTS control_plane_snapshot (
+                    singleton_id INTEGER PRIMARY KEY CHECK (singleton_id = 1),
+                    schema_version INTEGER NOT NULL,
+                    payload_json TEXT NOT NULL,
+                    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+                )
+                """
+            )
+
+    def load(self) -> dict[str, Any] | None:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT schema_version, payload_json FROM control_plane_snapshot WHERE singleton_id = 1"
+            ).fetchone()
+        if row is None:
+            return None
+        schema_version, payload_json = row
+        if int(schema_version) != self.SCHEMA_VERSION:
+            raise RuntimeError(
+                f"unsupported control-plane snapshot version: {schema_version}"
+            )
+        decoded = json.loads(str(payload_json))
+        if not isinstance(decoded, dict):
+            raise RuntimeError("invalid control-plane snapshot")
+        return decoded
+
+    def save(self, payload: dict[str, Any]) -> None:
+        encoded = json.dumps(
+            payload,
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+            default=str,
+        )
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            connection.execute(
+                """
+                INSERT INTO control_plane_snapshot (
+                    singleton_id, schema_version, payload_json, updated_at
+                ) VALUES (1, ?, ?, CURRENT_TIMESTAMP)
+                ON CONFLICT(singleton_id) DO UPDATE SET
+                    schema_version = excluded.schema_version,
+                    payload_json = excluded.payload_json,
+                    updated_at = CURRENT_TIMESTAMP
+                """,
+                (self.SCHEMA_VERSION, encoded),
+            )
+            connection.commit()
+
+
+class DurableControlPlaneService(ControlPlaneService):
+    """Control-plane service that persists after every successful mutation."""
+
+    def __init__(
+        self,
+        repository: SQLiteSnapshotRepository,
+        *,
+        policy_evaluator=None,
+    ) -> None:
+        self.repository = repository
+        store = InMemoryControlPlaneStore()
+        self._restore(store, repository.load())
+        super().__init__(store, policy_evaluator=policy_evaluator)
+
+    @staticmethod
+    def _restore(
+        store: InMemoryControlPlaneStore,
+        snapshot: dict[str, Any] | None,
+    ) -> None:
+        if not snapshot:
+            return
+        for item in snapshot.get("tenants", []):
+            record = TenantRecord(**item)
+            store.tenants[record.tenant_id] = record
+        for item in snapshot.get("agents", []):
+            normalized = dict(item)
+            normalized["capabilities"] = tuple(normalized.get("capabilities", ()))
+            record = AgentRecord(**normalized)
+            store.agents[record.agent_id] = record
+        for item in snapshot.get("tasks", []):
+            normalized = dict(item)
+            normalized["state"] = TaskState(normalized["state"])
+            record = TaskRecord(**normalized)
+            store.tasks[record.task_id] = record
+        store.audit_events.extend(AuditEvent(**item) for item in snapshot.get("audit", []))
+        for item in snapshot.get("idempotency", []):
+            store.idempotency[(item["tenant_id"], item["key"])] = (
+                item["task_id"],
+                item["digest"],
+            )
+
+    def _snapshot(self) -> dict[str, Any]:
+        with self.store.lock:
+            return {
+                "schema_version": self.repository.SCHEMA_VERSION,
+                "tenants": [asdict(item) for item in self.store.tenants.values()],
+                "agents": [asdict(item) for item in self.store.agents.values()],
+                "tasks": [
+                    {**asdict(item), "state": item.state.value}
+                    for item in self.store.tasks.values()
+                ],
+                "audit": [asdict(item) for item in self.store.audit_events],
+                "idempotency": [
+                    {
+                        "tenant_id": tenant_id,
+                        "key": key,
+                        "task_id": task_id,
+                        "digest": digest,
+                    }
+                    for (tenant_id, key), (task_id, digest)
+                    in self.store.idempotency.items()
+                ],
+            }
+
+    def _mutate(self, operation: Callable[[], Any]) -> Any:
+        with self.store.lock:
+            result = operation()
+            self.repository.save(self._snapshot())
+            return result
+
+    def register_tenant(self, *args, **kwargs):
+        return self._mutate(lambda: super(DurableControlPlaneService, self).register_tenant(*args, **kwargs))
+
+    def register_agent(self, *args, **kwargs):
+        return self._mutate(lambda: super(DurableControlPlaneService, self).register_agent(*args, **kwargs))
+
+    def create_task(self, *args, **kwargs):
+        return self._mutate(lambda: super(DurableControlPlaneService, self).create_task(*args, **kwargs))
+
+    def transition_task(self, *args, **kwargs):
+        return self._mutate(lambda: super(DurableControlPlaneService, self).transition_task(*args, **kwargs))
@@ -0,0 +1,831 @@
+"""AIOS V2 可信 Run Provenance 签发、持久化与受控写入。
+
+生产策略要求 Provenance 同时覆盖七类路径：代码变更、Git 操作、部署、
+Runtime 执行、Evidence 写入、回滚和审计。任何缺失、篡改、过期、撤销、
+重放或上下文不匹配都默认拒绝。
+"""
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import os
+import sqlite3
+import stat
+import threading
+import uuid
+from dataclasses import asdict, dataclass, field, replace
+from datetime import datetime, timedelta, timezone
+from enum import Enum
+from pathlib import Path
+from typing import Any, Mapping, Protocol, Sequence
+
+PROVENANCE_VERSION = "aios.v2.run-provenance.v1"
+PRODUCTION_POLICY_VERSION = "aios.v2.production.v1"
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def parse_timestamp(value: str) -> datetime:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError("timestamp is required")
+    if normalized.endswith("Z"):
+        normalized = normalized[:-1] + "+00:00"
+    parsed = datetime.fromisoformat(normalized)
+    if parsed.tzinfo is None:
+        raise ValueError("timestamp must include timezone")
+    return parsed.astimezone(timezone.utc)
+
+
+def required(value: str, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+def canonical_json_bytes(value: Mapping[str, Any]) -> bytes:
+    return json.dumps(
+        dict(value),
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+        default=str,
+    ).encode("utf-8")
+
+
+def digest_payload(value: Mapping[str, Any]) -> str:
+    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
+
+
+def _validate_digest(value: str) -> str:
+    normalized = required(value, "request_digest").lower()
+    if len(normalized) != 64 or any(ch not in "0123456789abcdef" for ch in normalized):
+        raise ValueError("request_digest must be a SHA-256 hexadecimal digest")
+    return normalized
+
+
+class ExecutionPath(str, Enum):
+    CODE_CHANGE = "code_change"
+    GIT_OPERATION = "git_operation"
+    DEPLOYMENT = "deployment"
+    RUNTIME_EXECUTE = "runtime_execute"
+    EVIDENCE_WRITE = "evidence_write"
+    ROLLBACK = "rollback"
+    AUDIT = "audit"
+
+
+REQUIRED_PRODUCTION_PATHS = frozenset(item.value for item in ExecutionPath)
+
+
+class GitOperation(str, Enum):
+    READ_REF = "read_ref"
+    FETCH = "fetch"
+    CREATE_BRANCH = "create_branch"
+    COMMIT = "commit"
+    MERGE = "merge"
+    PUSH = "push"
+    UPDATE_EVIDENCE = "update_evidence"
+
+
+class ProvenanceStatus(str, Enum):
+    ISSUED = "issued"
+    VERIFIED = "verified"
+    USED = "used"
+    EXPIRED = "expired"
+    REVOKED = "revoked"
+
+
+class ProvenanceError(RuntimeError):
+    """Run Provenance 基础错误。"""
+
+
+class ProvenanceDenied(ProvenanceError):
+    """策略拒绝当前操作。"""
+
+
+class ProvenanceNotFound(ProvenanceDenied):
+    """未找到 Provenance。"""
+
+
+class ProvenanceSignatureError(ProvenanceDenied):
+    """签名无效。"""
+
+
+class ProvenanceExpired(ProvenanceDenied):
+    """Provenance 已过期。"""
+
+
+class ProvenanceRevoked(ProvenanceDenied):
+    """Provenance 已撤销。"""
+
+
+class ProvenanceReplay(ProvenanceDenied):
+    """检测到相同授权摘要重放。"""
+
+
+class Signer(Protocol):
+    key_id: str
+
+    def sign(self, payload: bytes) -> str: ...
+
+
+class SignatureVerifier(Protocol):
+    key_id: str
+    fingerprint: str
+
+    def verify(self, payload: bytes, signature: str) -> bool: ...
+
+
+def _load_crypto() -> tuple[Any, Any, Any]:
+    try:
+        from cryptography.hazmat.primitives import serialization
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+            Ed25519PrivateKey,
+            Ed25519PublicKey,
+        )
+    except ImportError as exc:  # pragma: no cover - depends on deployment image
+        raise RuntimeError(
+            "cryptography package with Ed25519 support is required"
+        ) from exc
+    return serialization, Ed25519PrivateKey, Ed25519PublicKey
+
+
+def _check_private_key_file(path: Path) -> bytes:
+    resolved = path.resolve()
+    metadata = resolved.stat()
+    if not stat.S_ISREG(metadata.st_mode):
+        raise RuntimeError("private key reference is not a regular file")
+    if metadata.st_mode & 0o077:
+        raise RuntimeError("private key file permissions must be 0600 or stricter")
+    return resolved.read_bytes()
+
+
+def _check_public_key_file(path: Path) -> bytes:
+    resolved = path.resolve()
+    metadata = resolved.stat()
+    if not stat.S_ISREG(metadata.st_mode):
+        raise RuntimeError("public key reference is not a regular file")
+    if metadata.st_mode & 0o022:
+        raise RuntimeError("public key file must not be group/world writable")
+    return resolved.read_bytes()
+
+
+class Ed25519PrivateKeySigner:
+    """Ed25519 Owner/Control Plane 签发器。"""
+
+    def __init__(self, private_key: Any, *, key_id: str) -> None:
+        self.private_key = private_key
+        self.key_id = required(key_id, "key_id")
+
+    @classmethod
+    def from_file(cls, path: str | Path, *, key_id: str) -> "Ed25519PrivateKeySigner":
+        serialization, private_cls, _ = _load_crypto()
+        value = _check_private_key_file(Path(path))
+        if value.startswith(b"-----BEGIN"):
+            key = serialization.load_pem_private_key(value, password=None)
+        elif len(value) == 32:
+            key = private_cls.from_private_bytes(value)
+        else:
+            raise RuntimeError("private key must be PEM or a raw 32-byte Ed25519 seed")
+        if not isinstance(key, private_cls):
+            raise RuntimeError("private key is not Ed25519")
+        return cls(key, key_id=key_id)
+
+    def sign(self, payload: bytes) -> str:
+        return base64.b64encode(self.private_key.sign(bytes(payload))).decode("ascii")
+
+    def public_verifier(self) -> "Ed25519PublicKeyVerifier":
+        return Ed25519PublicKeyVerifier(self.private_key.public_key(), key_id=self.key_id)
+
+
+class Ed25519PublicKeyVerifier:
+    """Ed25519 签名验证器。"""
+
+    def __init__(self, public_key: Any, *, key_id: str) -> None:
+        serialization, _, public_cls = _load_crypto()
+        if not isinstance(public_key, public_cls):
+            raise RuntimeError("public key is not Ed25519")
+        self.public_key = public_key
+        self.key_id = required(key_id, "key_id")
+        raw = public_key.public_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PublicFormat.Raw,
+        )
+        self.fingerprint = hashlib.sha256(raw).hexdigest()
+
+    @classmethod
+    def from_file(cls, path: str | Path, *, key_id: str) -> "Ed25519PublicKeyVerifier":
+        serialization, _, public_cls = _load_crypto()
+        value = _check_public_key_file(Path(path))
+        if value.startswith(b"-----BEGIN"):
+            key = serialization.load_pem_public_key(value)
+        elif len(value) == 32:
+            key = public_cls.from_public_bytes(value)
+        else:
+            raise RuntimeError("public key must be PEM or raw 32-byte Ed25519 key")
+        if not isinstance(key, public_cls):
+            raise RuntimeError("public key is not Ed25519")
+        return cls(key, key_id=key_id)
+
+    def verify(self, payload: bytes, signature: str) -> bool:
+        try:
+            decoded = base64.b64decode(required(signature, "signature"), validate=True)
+            self.public_key.verify(decoded, bytes(payload))
+            return True
+        except Exception:
+            return False
+
+
+@dataclass(frozen=True)
+class RunProvenance:
+    provenance_id: str
+    run_id: str
+    issuer: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    principal_id: str
+    allowed_paths: Sequence[str]
+    allowed_git_operations: Sequence[str]
+    issued_at: str
+    expires_at: str
+    policy_version: str
+    key_id: str
+    nonce: str
+    signature: str = ""
+    schema_version: str = PROVENANCE_VERSION
+
+    def __post_init__(self) -> None:
+        for name in (
+            "provenance_id",
+            "run_id",
+            "issuer",
+            "tenant_id",
+            "task_id",
+            "agent_id",
+            "principal_id",
+            "issued_at",
+            "expires_at",
+            "policy_version",
+            "key_id",
+            "nonce",
+            "schema_version",
+        ):
+            object.__setattr__(self, name, required(getattr(self, name), name))
+        if self.schema_version != PROVENANCE_VERSION:
+            raise ValueError(f"unsupported schema_version: {self.schema_version}")
+        issued = parse_timestamp(self.issued_at)
+        expires = parse_timestamp(self.expires_at)
+        if expires <= issued:
+            raise ValueError("expires_at must be later than issued_at")
+        paths = tuple(sorted({ExecutionPath(item).value for item in self.allowed_paths}))
+        operations = tuple(
+            sorted({GitOperation(item).value for item in self.allowed_git_operations})
+        )
+        object.__setattr__(self, "allowed_paths", paths)
+        object.__setattr__(self, "allowed_git_operations", operations)
+        object.__setattr__(self, "signature", str(self.signature or "").strip())
+
+    def unsigned_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "provenance_id": self.provenance_id,
+            "run_id": self.run_id,
+            "issuer": self.issuer,
+            "tenant_id": self.tenant_id,
+            "task_id": self.task_id,
+            "agent_id": self.agent_id,
+            "principal_id": self.principal_id,
+            "allowed_paths": list(self.allowed_paths),
+            "allowed_git_operations": list(self.allowed_git_operations),
+            "issued_at": self.issued_at,
+            "expires_at": self.expires_at,
+            "policy_version": self.policy_version,
+            "key_id": self.key_id,
+            "nonce": self.nonce,
+        }
+
+    def canonical_bytes(self) -> bytes:
+        return canonical_json_bytes(self.unsigned_dict())
+
+    def as_dict(self) -> dict[str, Any]:
+        value = self.unsigned_dict()
+        value["signature"] = self.signature
+        return value
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RunProvenance":
+        return cls(**dict(value))
+
+
+class ProvenanceIssuer:
+    """只由 Owner 或 AIOS Control Plane 持有的签发服务。"""
+
+    def __init__(self, signer: Signer, store: "SQLiteProvenanceStore") -> None:
+        self.signer = signer
+        self.store = store
+
+    def issue(
+        self,
+        *,
+        run_id: str,
+        issuer: str,
+        tenant_id: str,
+        task_id: str,
+        agent_id: str,
+        principal_id: str,
+        allowed_paths: Sequence[str] = tuple(REQUIRED_PRODUCTION_PATHS),
+        allowed_git_operations: Sequence[str] = tuple(item.value for item in GitOperation),
+        ttl_seconds: int = 3600,
+        policy_version: str = PRODUCTION_POLICY_VERSION,
+        provenance_id: str | None = None,
+        nonce: str | None = None,
+        now: datetime | None = None,
+    ) -> RunProvenance:
+        if ttl_seconds <= 0:
+            raise ValueError("ttl_seconds must be positive")
+        normalized_paths = frozenset(ExecutionPath(item).value for item in allowed_paths)
+        if policy_version == PRODUCTION_POLICY_VERSION and normalized_paths != REQUIRED_PRODUCTION_PATHS:
+            missing = sorted(REQUIRED_PRODUCTION_PATHS - normalized_paths)
+            extra = sorted(normalized_paths - REQUIRED_PRODUCTION_PATHS)
+            raise ProvenanceDenied(
+                f"production provenance must cover exactly seven paths; missing={missing}, extra={extra}"
+            )
+        normalized_operations = tuple(
+            sorted({GitOperation(item).value for item in allowed_git_operations})
+        )
+        if ExecutionPath.GIT_OPERATION.value in normalized_paths and not normalized_operations:
+            raise ProvenanceDenied("git_operation path requires explicit allowed Git operations")
+        issued = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+        unsigned = RunProvenance(
+            provenance_id=provenance_id or f"prov_{uuid.uuid4().hex}",
+            run_id=run_id,
+            issuer=issuer,
+            tenant_id=tenant_id,
+            task_id=task_id,
+            agent_id=agent_id,
+            principal_id=principal_id,
+            allowed_paths=tuple(normalized_paths),
+            allowed_git_operations=normalized_operations,
+            issued_at=issued.isoformat().replace("+00:00", "Z"),
+            expires_at=(issued + timedelta(seconds=ttl_seconds))
+            .isoformat()
+            .replace("+00:00", "Z"),
+            policy_version=policy_version,
+            key_id=self.signer.key_id,
+            nonce=nonce or uuid.uuid4().hex,
+        )
+        signed = replace(unsigned, signature=self.signer.sign(unsigned.canonical_bytes()))
+        self.store.save_issued(signed)
+        return signed
+
+
+@dataclass(frozen=True)
+class ProvenanceAuthorization:
+    authorization_id: str
+    provenance_id: str
+    run_id: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    principal_id: str
+    execution_path: str
+    git_operation: str | None
+    request_digest: str
+    policy_version: str
+    key_id: str
+    public_key_fingerprint: str
+    authorized_at: str = field(default_factory=utc_now)
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+class SQLiteProvenanceStore:
+    """持久化 Provenance、状态、授权使用和不可变事件。"""
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+        self._connection = sqlite3.connect(
+            str(self.path), timeout=30.0, check_same_thread=False
+        )
+        self._connection.row_factory = sqlite3.Row
+        with self._lock:
+            self._connection.execute("PRAGMA journal_mode=WAL")
+            self._connection.execute("PRAGMA synchronous=FULL")
+            self._connection.execute("PRAGMA foreign_keys=ON")
+            self._connection.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS provenance_records (
+                    provenance_id TEXT PRIMARY KEY,
+                    payload_json TEXT NOT NULL,
+                    status TEXT NOT NULL,
+                    signature_verified INTEGER NOT NULL DEFAULT 0,
+                    created_at TEXT NOT NULL,
+                    updated_at TEXT NOT NULL
+                );
+                CREATE TABLE IF NOT EXISTS provenance_usage (
+                    authorization_id TEXT PRIMARY KEY,
+                    provenance_id TEXT NOT NULL,
+                    execution_path TEXT NOT NULL,
+                    git_operation TEXT NOT NULL DEFAULT '',
+                    request_digest TEXT NOT NULL,
+                    authorized_at TEXT NOT NULL,
+                    receipt_json TEXT NOT NULL,
+                    UNIQUE(provenance_id, execution_path, git_operation, request_digest),
+                    FOREIGN KEY(provenance_id) REFERENCES provenance_records(provenance_id)
+                );
+                CREATE TABLE IF NOT EXISTS provenance_events (
+                    event_id TEXT PRIMARY KEY,
+                    provenance_id TEXT NOT NULL,
+                    event_type TEXT NOT NULL,
+                    details_json TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    FOREIGN KEY(provenance_id) REFERENCES provenance_records(provenance_id)
+                );
+                CREATE INDEX IF NOT EXISTS idx_provenance_usage_id
+                    ON provenance_usage(provenance_id, authorized_at);
+                CREATE INDEX IF NOT EXISTS idx_provenance_events_id
+                    ON provenance_events(provenance_id, created_at);
+                """
+            )
+            self._connection.commit()
+
+    def close(self) -> None:
+        with self._lock:
+            self._connection.close()
+
+    def _event(
+        self,
+        provenance_id: str,
+        event_type: str,
+        details: Mapping[str, Any] | None = None,
+    ) -> None:
+        self._connection.execute(
+            "INSERT INTO provenance_events VALUES (?, ?, ?, ?, ?)",
+            (
+                f"pevt_{uuid.uuid4().hex}",
+                provenance_id,
+                event_type,
+                json.dumps(dict(details or {}), ensure_ascii=False, sort_keys=True),
+                utc_now(),
+            ),
+        )
+
+    def save_issued(self, provenance: RunProvenance) -> None:
+        payload = json.dumps(
+            provenance.as_dict(), ensure_ascii=False, sort_keys=True, separators=(",", ":")
+        )
+        now = utc_now()
+        with self._lock:
+            self._connection.execute("BEGIN IMMEDIATE")
+            try:
+                prior = self._connection.execute(
+                    "SELECT payload_json FROM provenance_records WHERE provenance_id = ?",
+                    (provenance.provenance_id,),
+                ).fetchone()
+                if prior is not None:
+                    if prior["payload_json"] != payload:
+                        raise ProvenanceDenied("provenance_id reused with different payload")
+                    self._connection.rollback()
+                    return
+                self._connection.execute(
+                    "INSERT INTO provenance_records VALUES (?, ?, ?, 0, ?, ?)",
+                    (
+                        provenance.provenance_id,
+                        payload,
+                        ProvenanceStatus.ISSUED.value,
+                        now,
+                        now,
+                    ),
+                )
+                self._event(provenance.provenance_id, "issued")
+                self._connection.commit()
+            except Exception:
+                self._connection.rollback()
+                raise
+
+    def get(self, provenance_id: str) -> RunProvenance:
+        with self._lock:
+            row = self._connection.execute(
+                "SELECT payload_json FROM provenance_records WHERE provenance_id = ?",
+                (required(provenance_id, "provenance_id"),),
+            ).fetchone()
+        if row is None:
+            raise ProvenanceNotFound("provenance not found")
+        value = json.loads(row["payload_json"])
+        if not isinstance(value, Mapping):
+            raise ProvenanceError("stored provenance payload is invalid")
+        return RunProvenance.from_dict(value)
+
+    def status(self, provenance_id: str) -> ProvenanceStatus:
+        with self._lock:
+            row = self._connection.execute(
+                "SELECT status FROM provenance_records WHERE provenance_id = ?",
+                (required(provenance_id, "provenance_id"),),
+            ).fetchone()
+        if row is None:
+            raise ProvenanceNotFound("provenance not found")
+        return ProvenanceStatus(row["status"])
+
+    def mark_verified(self, provenance_id: str, *, fingerprint: str) -> None:
+        with self._lock:
+            self._connection.execute("BEGIN IMMEDIATE")
+            try:
+                current = self.status(provenance_id)
+                if current in {ProvenanceStatus.REVOKED, ProvenanceStatus.EXPIRED}:
+                    raise ProvenanceDenied(f"cannot verify provenance in state {current.value}")
+                next_status = (
+                    ProvenanceStatus.USED.value
+                    if current == ProvenanceStatus.USED
+                    else ProvenanceStatus.VERIFIED.value
+                )
+                self._connection.execute(
+                    "UPDATE provenance_records SET status = ?, signature_verified = 1, updated_at = ? WHERE provenance_id = ?",
+                    (next_status, utc_now(), provenance_id),
+                )
+                self._event(
+                    provenance_id,
+                    "verified",
+                    {"public_key_fingerprint": fingerprint},
+                )
+                self._connection.commit()
+            except Exception:
+                self._connection.rollback()
+                raise
+
+    def mark_expired(self, provenance_id: str) -> None:
+        with self._lock:
+            self._connection.execute("BEGIN IMMEDIATE")
+            try:
+                current = self.status(provenance_id)
+                if current == ProvenanceStatus.REVOKED:
+                    self._connection.rollback()
+                    return
+                self._connection.execute(
+                    "UPDATE provenance_records SET status = ?, updated_at = ? WHERE provenance_id = ?",
+                    (ProvenanceStatus.EXPIRED.value, utc_now(), provenance_id),
+                )
+                self._event(provenance_id, "expired")
+                self._connection.commit()
+            except Exception:
+                self._connection.rollback()
+                raise
+
+    def revoke(self, provenance_id: str, *, reason: str, principal_id: str) -> None:
+        with self._lock:
+            self._connection.execute("BEGIN IMMEDIATE")
+            try:
+                self.get(provenance_id)
+                self._connection.execute(
+                    "UPDATE provenance_records SET status = ?, updated_at = ? WHERE provenance_id = ?",
+                    (ProvenanceStatus.REVOKED.value, utc_now(), provenance_id),
+                )
+                self._event(
+                    provenance_id,
+                    "revoked",
+                    {
+                        "reason": required(reason, "reason"),
+                        "principal_id": required(principal_id, "principal_id"),
+                    },
+                )
+                self._connection.commit()
+            except Exception:
+                self._connection.rollback()
+                raise
+
+    def record_authorization(self, authorization: ProvenanceAuthorization) -> None:
+        receipt = json.dumps(
+            authorization.as_dict(), ensure_ascii=False, sort_keys=True, separators=(",", ":")
+        )
+        with self._lock:
+            self._connection.execute("BEGIN IMMEDIATE")
+            try:
+                current = self.status(authorization.provenance_id)
+                if current in {ProvenanceStatus.REVOKED, ProvenanceStatus.EXPIRED}:
+                    raise ProvenanceDenied(f"provenance state is {current.value}")
+                try:
+                    self._connection.execute(
+                        "INSERT INTO provenance_usage VALUES (?, ?, ?, ?, ?, ?, ?)",
+                        (
+                            authorization.authorization_id,
+                            authorization.provenance_id,
+                            authorization.execution_path,
+                            authorization.git_operation or "",
+                            authorization.request_digest,
+                            authorization.authorized_at,
+                            receipt,
+                        ),
+                    )
+                except sqlite3.IntegrityError as exc:
+                    raise ProvenanceReplay(
+                        "identical provenance path/operation/request digest already used"
+                    ) from exc
+                self._connection.execute(
+                    "UPDATE provenance_records SET status = ?, updated_at = ? WHERE provenance_id = ?",
+                    (
+                        ProvenanceStatus.USED.value,
+                        authorization.authorized_at,
+                        authorization.provenance_id,
+                    ),
+                )
+                self._event(
+                    authorization.provenance_id,
+                    "used",
+                    {
+                        "authorization_id": authorization.authorization_id,
+                        "execution_path": authorization.execution_path,
+                        "git_operation": authorization.git_operation,
+                        "request_digest": authorization.request_digest,
+                    },
+                )
+                self._connection.commit()
+            except Exception:
+                self._connection.rollback()
+                raise
+
+    def authorization_count(self, provenance_id: str) -> int:
+        with self._lock:
+            row = self._connection.execute(
+                "SELECT COUNT(*) AS total FROM provenance_usage WHERE provenance_id = ?",
+                (required(provenance_id, "provenance_id"),),
+            ).fetchone()
+        return int(row["total"])
+
+    def events(self, provenance_id: str) -> list[dict[str, Any]]:
+        with self._lock:
+            rows = self._connection.execute(
+                "SELECT event_type, details_json, created_at FROM provenance_events WHERE provenance_id = ? ORDER BY created_at, event_id",
+                (required(provenance_id, "provenance_id"),),
+            ).fetchall()
+        return [
+            {
+                "event_type": row["event_type"],
+                "details": json.loads(row["details_json"]),
+                "created_at": row["created_at"],
+            }
+            for row in rows
+        ]
+
+
+class ProvenanceVerifier:
+    """验证 Owner 签名、上下文、路径、Git 操作、时效和重放。"""
+
+    def __init__(
+        self,
+        store: SQLiteProvenanceStore,
+        verifiers: Mapping[str, SignatureVerifier],
+    ) -> None:
+        if not verifiers:
+            raise ValueError("at least one public key verifier is required")
+        self.store = store
+        self.verifiers = {required(key, "key_id"): value for key, value in verifiers.items()}
+
+    def authorize(
+        self,
+        *,
+        provenance_id: str,
+        run_id: str,
+        tenant_id: str,
+        task_id: str,
+        agent_id: str,
+        principal_id: str,
+        execution_path: str,
+        request_digest: str,
+        git_operation: str | None = None,
+        now: datetime | None = None,
+    ) -> ProvenanceAuthorization:
+        provenance = self.store.get(provenance_id)
+        status = self.store.status(provenance.provenance_id)
+        if status == ProvenanceStatus.REVOKED:
+            raise ProvenanceRevoked("provenance is revoked")
+        current = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+        if current >= parse_timestamp(provenance.expires_at):
+            self.store.mark_expired(provenance.provenance_id)
+            raise ProvenanceExpired("provenance is expired")
+        verifier = self.verifiers.get(provenance.key_id)
+        if verifier is None:
+            raise ProvenanceSignatureError("no trusted public key for provenance key_id")
+        if not provenance.signature or not verifier.verify(
+            provenance.canonical_bytes(), provenance.signature
+        ):
+            raise ProvenanceSignatureError("invalid provenance signature")
+        expected = {
+            "run_id": required(run_id, "run_id"),
+            "tenant_id": required(tenant_id, "tenant_id"),
+            "task_id": required(task_id, "task_id"),
+            "agent_id": required(agent_id, "agent_id"),
+            "principal_id": required(principal_id, "principal_id"),
+        }
+        for field_name, expected_value in expected.items():
+            if getattr(provenance, field_name) != expected_value:
+                raise ProvenanceDenied(f"provenance {field_name} mismatch")
+        path = ExecutionPath(execution_path).value
+        if path not in provenance.allowed_paths:
+            raise ProvenanceDenied(f"execution path is not allowed: {path}")
+        operation: str | None = None
+        if path == ExecutionPath.GIT_OPERATION.value:
+            if git_operation is None:
+                raise ProvenanceDenied("git operation is required for git_operation path")
+            operation = GitOperation(git_operation).value
+            if operation not in provenance.allowed_git_operations:
+                raise ProvenanceDenied(f"Git operation is not allowed: {operation}")
+        elif git_operation is not None:
+            raise ProvenanceDenied("git_operation is only valid for git_operation path")
+        digest = _validate_digest(request_digest)
+        self.store.mark_verified(
+            provenance.provenance_id, fingerprint=verifier.fingerprint
+        )
+        authorization = ProvenanceAuthorization(
+            authorization_id=f"pauth_{uuid.uuid4().hex}",
+            provenance_id=provenance.provenance_id,
+            run_id=provenance.run_id,
+            tenant_id=provenance.tenant_id,
+            task_id=provenance.task_id,
+            agent_id=provenance.agent_id,
+            principal_id=provenance.principal_id,
+            execution_path=path,
+            git_operation=operation,
+            request_digest=digest,
+            policy_version=provenance.policy_version,
+            key_id=provenance.key_id,
+            public_key_fingerprint=verifier.fingerprint,
+        )
+        self.store.record_authorization(authorization)
+        return authorization
+
+
+class ProvenanceControlledWriter:
+    """七路径统一策略入口并持久写入授权回执。"""
+
+    def __init__(
+        self,
+        verifier: ProvenanceVerifier,
+        receipt_root: str | Path,
+        *,
+        writer_id: str = "aios-v2-provenance-writer",
+    ) -> None:
+        self.verifier = verifier
+        self.receipt_root = Path(receipt_root).resolve()
+        self.receipt_root.mkdir(parents=True, exist_ok=True)
+        self.writer_id = required(writer_id, "writer_id")
+        self._lock = threading.RLock()
+
+    @staticmethod
+    def _component(value: str) -> str:
+        normalized = required(value, "path component")
+        if normalized in {".", ".."} or "/" in normalized or "\\" in normalized:
+            raise ProvenanceDenied("invalid receipt path component")
+        return normalized
+
+    def authorize(self, **values: Any) -> ProvenanceAuthorization:
+        authorization = self.verifier.authorize(**values)
+        tenant = self._component(authorization.tenant_id)
+        provenance_id = self._component(authorization.provenance_id)
+        target_dir = self.receipt_root / tenant / provenance_id
+        target = target_dir / f"{authorization.authorization_id}.json"
+        payload = authorization.as_dict()
+        payload["writer_id"] = self.writer_id
+        with self._lock:
+            target_dir.mkdir(parents=True, exist_ok=True)
+            temporary = target.with_suffix(f".tmp-{os.getpid()}")
+            temporary.write_text(
+                json.dumps(payload, ensure_ascii=False, sort_keys=True, indent=2) + "\n",
+                encoding="utf-8",
+            )
+            os.chmod(temporary, 0o640)
+            os.replace(temporary, target)
+        return authorization
+
+    def authorize_code_change(self, **values: Any) -> ProvenanceAuthorization:
+        return self.authorize(execution_path=ExecutionPath.CODE_CHANGE.value, **values)
+
+    def authorize_git_operation(
+        self, *, git_operation: str, **values: Any
+    ) -> ProvenanceAuthorization:
+        return self.authorize(
+            execution_path=ExecutionPath.GIT_OPERATION.value,
+            git_operation=git_operation,
+            **values,
+        )
+
+    def authorize_deployment(self, **values: Any) -> ProvenanceAuthorization:
+        return self.authorize(execution_path=ExecutionPath.DEPLOYMENT.value, **values)
+
+    def authorize_runtime_execute(self, **values: Any) -> ProvenanceAuthorization:
+        return self.authorize(execution_path=ExecutionPath.RUNTIME_EXECUTE.value, **values)
+
+    def authorize_evidence_write(self, **values: Any) -> ProvenanceAuthorization:
+        return self.authorize(execution_path=ExecutionPath.EVIDENCE_WRITE.value, **values)
+
+    def authorize_rollback(self, **values: Any) -> ProvenanceAuthorization:
+        return self.authorize(execution_path=ExecutionPath.ROLLBACK.value, **values)
+
+    def authorize_audit(self, **values: Any) -> ProvenanceAuthorization:
+        return self.authorize(execution_path=ExecutionPath.AUDIT.value, **values)
@@ -0,0 +1,381 @@
+#!/usr/bin/env python3
+"""AIOS V2 Run Provenance 与最小权限 Grant 运维 CLI。
+
+私钥只用于签发；授权命令只加载一个与 ``--path`` 对应的 Grant。所有输出均为
+不含 Secret 的 JSON。旧 ``issue`` 仅为候选兼容，生产必须使用
+``issue-workflow`` 与 ``issue-grant``。
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .provenance import (
+    Ed25519PrivateKeySigner,
+    Ed25519PublicKeyVerifier,
+    ExecutionPath,
+    GitOperation,
+    ProvenanceIssuer,
+    SQLiteProvenanceStore,
+)
+from .provenance_grants import (
+    GrantIssuer,
+    GrantType,
+    GrantVerifier,
+    SQLiteGrantStore,
+    WorkflowProvenanceIssuer,
+)
+from .provenance_operations import (
+    OperationContext,
+    ProvenanceOperationGate,
+    context_from_environment,
+    load_request_file,
+)
+from .provenance_scoped import ScopedLeastPrivilegeProvenanceWriter
+
+
+def _json_object(value: str | None, file_path: str | None) -> Mapping[str, Any]:
+    if value and file_path:
+        raise ValueError("request-json and request-file are mutually exclusive")
+    if file_path:
+        return load_request_file(file_path)
+    parsed = json.loads(value or "{}")
+    if not isinstance(parsed, Mapping):
+        raise ValueError("request JSON must be an object")
+    return dict(parsed)
+
+
+def _csv(value: str | None) -> tuple[str, ...]:
+    return tuple(item.strip() for item in str(value or "").split(",") if item.strip())
+
+
+def _write_json(path: str | None, payload: Mapping[str, Any]) -> None:
+    encoded = json.dumps(dict(payload), ensure_ascii=False, sort_keys=True, indent=2) + "\n"
+    if path:
+        target = Path(path).resolve()
+        target.parent.mkdir(parents=True, exist_ok=True)
+        temporary = target.with_suffix(f".tmp-{os.getpid()}")
+        temporary.write_text(encoded, encoding="utf-8")
+        os.chmod(temporary, 0o640)
+        os.replace(temporary, target)
+    print(encoded, end="")
+
+
+def _parent_store(args: argparse.Namespace) -> SQLiteProvenanceStore:
+    return SQLiteProvenanceStore(args.store_file)
+
+
+def _grant_store(args: argparse.Namespace) -> SQLiteGrantStore:
+    return SQLiteGrantStore(args.store_file)
+
+
+def _context(args: argparse.Namespace) -> OperationContext:
+    if args.context_from_env:
+        return context_from_environment()
+    values = {
+        "provenance_id": args.provenance_id,
+        "run_id": args.run_id,
+        "tenant_id": args.tenant_id,
+        "task_id": args.task_id,
+        "agent_id": args.agent_id,
+        "principal_id": args.principal_id,
+    }
+    missing = [name for name, value in values.items() if not str(value or "").strip()]
+    if missing:
+        raise ValueError(f"missing context arguments: {missing}")
+    return OperationContext(**{name: str(value).strip() for name, value in values.items()})
+
+
+def command_issue_legacy(args: argparse.Namespace) -> int:
+    store = _parent_store(args)
+    signer = Ed25519PrivateKeySigner.from_file(args.private_key_file, key_id=args.key_id)
+    provenance = ProvenanceIssuer(signer, store).issue(
+        run_id=args.run_id,
+        issuer=args.issuer,
+        tenant_id=args.tenant_id,
+        task_id=args.task_id,
+        agent_id=args.agent_id,
+        principal_id=args.principal_id,
+        allowed_paths=_csv(args.allowed_paths) or tuple(item.value for item in ExecutionPath),
+        allowed_git_operations=_csv(args.allowed_git_operations)
+        or tuple(item.value for item in GitOperation),
+        ttl_seconds=args.ttl_seconds,
+        policy_version=args.policy_version,
+    )
+    _write_json(
+        args.output,
+        {
+            "mode": "legacy-full-rights-candidate-only",
+            "provenance": provenance.as_dict(),
+            "status": store.status(provenance.provenance_id).value,
+            "secret_value_stored": False,
+        },
+    )
+    return 0
+
+
+def command_issue_workflow(args: argparse.Namespace) -> int:
+    store = _parent_store(args)
+    signer = Ed25519PrivateKeySigner.from_file(args.private_key_file, key_id=args.key_id)
+    workflow = WorkflowProvenanceIssuer(signer, store).issue(
+        run_id=args.run_id,
+        issuer=args.issuer,
+        tenant_id=args.tenant_id,
+        task_id=args.task_id,
+        agent_id=args.agent_id,
+        principal_id=args.principal_id,
+        ttl_seconds=args.ttl_seconds,
+    )
+    _write_json(
+        args.output,
+        {
+            "mode": "least-privilege-workflow",
+            "workflow_provenance": workflow.as_dict(),
+            "status": store.status(workflow.provenance_id).value,
+            "secret_value_stored": False,
+        },
+    )
+    return 0
+
+
+def command_issue_grant(args: argparse.Namespace) -> int:
+    parent_store = _parent_store(args)
+    grant_store = _grant_store(args)
+    signer = Ed25519PrivateKeySigner.from_file(args.private_key_file, key_id=args.key_id)
+    grant = GrantIssuer(signer, parent_store, grant_store).issue(
+        parent_provenance_id=args.parent_provenance_id,
+        grant_type=GrantType(args.grant_type),
+        ttl_seconds=args.ttl_seconds,
+        allowed_git_operations=_csv(args.allowed_git_operations),
+    )
+    _write_json(
+        args.output,
+        {
+            "grant": grant.as_dict(),
+            "status": grant_store.status(grant.grant_id).value,
+            "secret_value_stored": False,
+        },
+    )
+    return 0
+
+
+def _single_scope_writer(args: argparse.Namespace) -> ScopedLeastPrivilegeProvenanceWriter:
+    path = ExecutionPath(args.path).value
+    parent_store = _parent_store(args)
+    grant_store = _grant_store(args)
+    verifier = Ed25519PublicKeyVerifier.from_file(args.public_key_file, key_id=args.key_id)
+    trusted = GrantVerifier(parent_store, grant_store, {args.key_id: verifier})
+    return ScopedLeastPrivilegeProvenanceWriter(
+        trusted,
+        args.receipt_dir,
+        {path: args.grant_id},
+        required_paths=(path,),
+        writer_id=f"aios-v2-cli-{path}",
+    )
+
+
+def command_authorize(args: argparse.Namespace) -> int:
+    writer = _single_scope_writer(args)
+    context = _context(args)
+    receipt = ProvenanceOperationGate(writer).authorize(
+        context,
+        execution_path=args.path,
+        operation=args.operation,
+        request=_json_object(args.request_json, args.request_file),
+    )
+    _write_json(args.output, {"authorization": receipt.as_dict()})
+    return 0
+
+
+def command_revoke(args: argparse.Namespace) -> int:
+    store = _parent_store(args)
+    store.revoke(args.provenance_id, reason=args.reason, principal_id=args.principal_id)
+    _write_json(
+        args.output,
+        {"provenance_id": args.provenance_id, "status": store.status(args.provenance_id).value},
+    )
+    return 0
+
+
+def command_status(args: argparse.Namespace) -> int:
+    store = _parent_store(args)
+    provenance = store.get(args.provenance_id)
+    grant_store = _grant_store(args)
+    _write_json(
+        args.output,
+        {
+            "provenance": provenance.as_dict(),
+            "status": store.status(args.provenance_id).value,
+            "authorization_count": store.authorization_count(args.provenance_id),
+            "events": store.events(args.provenance_id),
+            "grants": [item.as_dict() for item in grant_store.list_for_parent(args.provenance_id)],
+        },
+    )
+    return 0
+
+
+def command_grant_revoke(args: argparse.Namespace) -> int:
+    store = _grant_store(args)
+    store.revoke(args.grant_id, reason=args.reason, principal_id=args.principal_id)
+    _write_json(
+        args.output,
+        {"grant_id": args.grant_id, "status": store.status(args.grant_id).value},
+    )
+    return 0
+
+
+def command_grant_status(args: argparse.Namespace) -> int:
+    store = _grant_store(args)
+    grant = store.get(args.grant_id)
+    _write_json(
+        args.output,
+        {"grant": grant.as_dict(), "status": store.status(args.grant_id).value},
+    )
+    return 0
+
+
+def add_common_store(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument(
+        "--store-file",
+        default=os.getenv(
+            "AIOS_PROVENANCE_STORE_FILE",
+            "/var/lib/aios-v2/run-provenance.sqlite3",
+        ),
+    )
+    parser.add_argument("--output", default=None)
+
+
+def add_signing_context(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--private-key-file", required=True)
+    parser.add_argument("--key-id", required=True)
+
+
+def add_workflow_identity(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--run-id", required=True)
+    parser.add_argument("--issuer", required=True)
+    parser.add_argument("--tenant-id", required=True)
+    parser.add_argument("--task-id", required=True)
+    parser.add_argument("--agent-id", required=True)
+    parser.add_argument("--principal-id", required=True)
+
+
+def add_context(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--context-from-env", action="store_true")
+    parser.add_argument("--provenance-id")
+    parser.add_argument("--run-id")
+    parser.add_argument("--tenant-id")
+    parser.add_argument("--task-id")
+    parser.add_argument("--agent-id")
+    parser.add_argument("--principal-id")
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description="AIOS V2 Run Provenance CLI")
+    subcommands = parser.add_subparsers(dest="command", required=True)
+
+    issue = subcommands.add_parser("issue", help="候选兼容：签发全权限 Provenance；生产禁止")
+    add_common_store(issue)
+    add_signing_context(issue)
+    add_workflow_identity(issue)
+    issue.add_argument("--allowed-paths")
+    issue.add_argument("--allowed-git-operations")
+    issue.add_argument("--ttl-seconds", type=int, default=3600)
+    issue.add_argument("--policy-version", default="aios.v2.candidate.legacy")
+    issue.set_defaults(handler=command_issue_legacy)
+
+    workflow = subcommands.add_parser(
+        "issue-workflow", help="签发不含操作权限的父 Workflow Provenance"
+    )
+    add_common_store(workflow)
+    add_signing_context(workflow)
+    add_workflow_identity(workflow)
+    workflow.add_argument("--ttl-seconds", type=int, default=14400)
+    workflow.set_defaults(handler=command_issue_workflow)
+
+    grant = subcommands.add_parser("issue-grant", help="签发单一路径最小权限 Grant")
+    add_common_store(grant)
+    add_signing_context(grant)
+    grant.add_argument("--parent-provenance-id", required=True)
+    grant.add_argument("--grant-type", choices=[item.value for item in GrantType], required=True)
+    grant.add_argument("--allowed-git-operations")
+    grant.add_argument("--ttl-seconds", type=int, default=900)
+    grant.set_defaults(handler=command_issue_grant)
+
+    authorize = subcommands.add_parser("authorize", help="使用单一子 Grant 授权一次运维操作")
+    add_common_store(authorize)
+    add_context(authorize)
+    authorize.add_argument("--public-key-file", required=True)
+    authorize.add_argument("--key-id", required=True)
+    authorize.add_argument("--grant-id", required=True)
+    authorize.add_argument(
+        "--receipt-dir",
+        default=os.getenv(
+            "AIOS_PROVENANCE_RECEIPT_DIR",
+            "/var/lib/aios-v2/provenance-receipts",
+        ),
+    )
+    authorize.add_argument(
+        "--path",
+        required=True,
+        choices=[
+            ExecutionPath.CODE_CHANGE.value,
+            ExecutionPath.DEPLOYMENT.value,
+            ExecutionPath.RUNTIME_EXECUTE.value,
+            ExecutionPath.EVIDENCE_WRITE.value,
+            ExecutionPath.ROLLBACK.value,
+            ExecutionPath.AUDIT.value,
+        ],
+    )
+    authorize.add_argument("--operation", required=True)
+    request_group = authorize.add_mutually_exclusive_group()
+    request_group.add_argument("--request-json")
+    request_group.add_argument("--request-file")
+    authorize.set_defaults(handler=command_authorize)
+
+    revoke = subcommands.add_parser("revoke", help="撤销父 Workflow Provenance")
+    add_common_store(revoke)
+    revoke.add_argument("--provenance-id", required=True)
+    revoke.add_argument("--reason", required=True)
+    revoke.add_argument("--principal-id", required=True)
+    revoke.set_defaults(handler=command_revoke)
+
+    status = subcommands.add_parser("status", help="查询父 Workflow 与子 Grant")
+    add_common_store(status)
+    status.add_argument("--provenance-id", required=True)
+    status.set_defaults(handler=command_status)
+
+    grant_revoke = subcommands.add_parser("grant-revoke", help="单独撤销子 Grant")
+    add_common_store(grant_revoke)
+    grant_revoke.add_argument("--grant-id", required=True)
+    grant_revoke.add_argument("--reason", required=True)
+    grant_revoke.add_argument("--principal-id", required=True)
+    grant_revoke.set_defaults(handler=command_grant_revoke)
+
+    grant_status = subcommands.add_parser("grant-status", help="查询子 Grant 状态")
+    add_common_store(grant_status)
+    grant_status.add_argument("--grant-id", required=True)
+    grant_status.set_defaults(handler=command_grant_status)
+    return parser
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        return int(args.handler(args))
+    except Exception as exc:
+        print(
+            json.dumps(
+                {"status": "denied", "error": type(exc).__name__, "message": str(exc)},
+                ensure_ascii=False,
+            ),
+            file=sys.stderr,
+        )
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,416 @@
+"""受最小权限 Run Provenance Grant 约束的 Git 写入器。
+
+所有 Git 操作都使用参数数组执行。对于 Commit 和 Evidence Commit，先计算
+工作树内容摘要并完成 Provenance 授权，之后才允许执行 ``git add``，避免未授权
+请求改变 Git Index。
+"""
+from __future__ import annotations
+
+import hashlib
+import os
+import re
+import subprocess
+import uuid
+from dataclasses import asdict, dataclass
+from pathlib import Path
+from typing import Any, Mapping, Protocol, Sequence
+
+from .provenance import GitOperation, ProvenanceDenied, digest_payload, utc_now
+
+_BRANCH_PATTERN = re.compile(r"^(?![-./])(?!.*\.\.)(?!.*//)[A-Za-z0-9._/-]{1,240}$")
+_SECRET_URL = re.compile(r"(?i)(https?://)([^/@\s]+)@")
+_TOKENISH = re.compile(r"(?i)(token|password|secret|authorization)([=:]\s*)([^\s]+)")
+
+
+class GitAuthorizationWriter(Protocol):
+    def authorize_code_change(self, **values: Any) -> Any: ...
+
+    def authorize_git_operation(self, *, git_operation: str, **values: Any) -> Any: ...
+
+
+class ProvenanceGitError(RuntimeError):
+    """Git 操作被拒绝或执行失败。"""
+
+
+@dataclass(frozen=True)
+class GitExecutionContext:
+    provenance_id: str
+    run_id: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    principal_id: str
+
+
+@dataclass(frozen=True)
+class GitCommandResult:
+    operation_id: str
+    operation: str
+    authorization_ids: Sequence[str]
+    command: Sequence[str]
+    exit_code: int
+    stdout: str
+    stderr: str
+    head_before: str | None
+    head_after: str | None
+    started_at: str
+    completed_at: str
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+class ProvenanceGitWriter:
+    """执行经过单路径 Grant 授权的窄范围 Git 操作。"""
+
+    def __init__(
+        self,
+        repo: str | Path,
+        writer: GitAuthorizationWriter,
+        *,
+        timeout_seconds: float = 120.0,
+        output_limit: int = 16000,
+    ) -> None:
+        self.repo = Path(repo).resolve()
+        self.writer = writer
+        self.timeout_seconds = float(timeout_seconds)
+        self.output_limit = int(output_limit)
+        if self.timeout_seconds <= 0 or self.output_limit < 1024:
+            raise ValueError("invalid Git writer limits")
+        self._run_raw(["rev-parse", "--is-inside-work-tree"], check=True)
+
+    @staticmethod
+    def _validate_branch(branch: str) -> str:
+        normalized = str(branch or "").strip()
+        if not _BRANCH_PATTERN.fullmatch(normalized) or normalized.endswith((".", "/")):
+            raise ProvenanceGitError("invalid Git branch name")
+        if normalized in {"main", "master"}:
+            raise ProvenanceGitError("direct main/master operation is prohibited")
+        return normalized
+
+    def _validate_path(self, value: str | Path) -> str:
+        raw = Path(value)
+        candidate = (self.repo / raw).resolve() if not raw.is_absolute() else raw.resolve()
+        try:
+            relative = candidate.relative_to(self.repo)
+        except ValueError as exc:
+            raise ProvenanceGitError("Git path escapes repository") from exc
+        if str(relative) in {"", "."}:
+            raise ProvenanceGitError("repository root is not a valid file path")
+        return relative.as_posix()
+
+    @staticmethod
+    def _redact(value: str, limit: int) -> str:
+        text = _SECRET_URL.sub(r"\1***@", str(value or ""))
+        text = _TOKENISH.sub(r"\1\2***", text)
+        if len(text) > limit:
+            return text[:limit] + "\n...[truncated]"
+        return text
+
+    def _head(self) -> str | None:
+        process = self._run_raw(["rev-parse", "HEAD"], check=False)
+        return process.stdout.strip() if process.returncode == 0 else None
+
+    def _run_raw(
+        self,
+        args: Sequence[str],
+        *,
+        check: bool,
+        env: Mapping[str, str] | None = None,
+    ) -> subprocess.CompletedProcess[str]:
+        command = ["git", "-C", str(self.repo), *[str(item) for item in args]]
+        safe_env = {
+            **os.environ,
+            "GIT_TERMINAL_PROMPT": "0",
+            "GIT_CONFIG_NOSYSTEM": os.environ.get("GIT_CONFIG_NOSYSTEM", "1"),
+        }
+        if env:
+            safe_env.update({str(key): str(value) for key, value in env.items()})
+        process = subprocess.run(
+            command,
+            text=True,
+            capture_output=True,
+            timeout=self.timeout_seconds,
+            env=safe_env,
+        )
+        if check and process.returncode != 0:
+            raise ProvenanceGitError(
+                self._redact(process.stderr or process.stdout, self.output_limit)
+                or f"Git command failed with exit code {process.returncode}"
+            )
+        return process
+
+    def _path_digest(self, relative: str) -> str:
+        target = self.repo / relative
+        if target.exists():
+            if not target.is_file():
+                raise ProvenanceGitError("Git writer accepts file paths only")
+            hasher = hashlib.sha256()
+            with target.open("rb") as handle:
+                while True:
+                    block = handle.read(65536)
+                    if not block:
+                        break
+                    hasher.update(block)
+            return hasher.hexdigest()
+        tracked = self._run_raw(["ls-files", "--error-unmatch", "--", relative], check=False)
+        if tracked.returncode != 0:
+            raise ProvenanceGitError(f"path does not exist and is not tracked: {relative}")
+        return "deleted"
+
+    def _content_manifest(self, paths: Sequence[str]) -> Mapping[str, str]:
+        return {path: self._path_digest(path) for path in sorted(set(paths))}
+
+    def _authorize(
+        self,
+        context: GitExecutionContext,
+        *,
+        operation: GitOperation,
+        request: Mapping[str, Any],
+        code_change: bool,
+    ) -> list[str]:
+        request_digest = digest_payload(
+            {
+                "operation": operation.value,
+                "repo": self.repo.name,
+                "request": dict(request),
+                "head": self._head(),
+            }
+        )
+        ids: list[str] = []
+        try:
+            if code_change:
+                code_authorization = self.writer.authorize_code_change(
+                    provenance_id=context.provenance_id,
+                    run_id=context.run_id,
+                    tenant_id=context.tenant_id,
+                    task_id=context.task_id,
+                    agent_id=context.agent_id,
+                    principal_id=context.principal_id,
+                    request_digest=digest_payload(
+                        {
+                            "git_operation": operation.value,
+                            "request_digest": request_digest,
+                        }
+                    ),
+                )
+                ids.append(code_authorization.authorization_id)
+            git_authorization = self.writer.authorize_git_operation(
+                provenance_id=context.provenance_id,
+                run_id=context.run_id,
+                tenant_id=context.tenant_id,
+                task_id=context.task_id,
+                agent_id=context.agent_id,
+                principal_id=context.principal_id,
+                git_operation=operation.value,
+                request_digest=request_digest,
+            )
+            ids.append(git_authorization.authorization_id)
+            return ids
+        except ProvenanceDenied as exc:
+            raise ProvenanceGitError(f"Run Provenance denied Git operation: {exc}") from exc
+
+    def _run_authorized(
+        self,
+        *,
+        operation: GitOperation,
+        args: Sequence[str],
+        authorization_ids: Sequence[str],
+    ) -> GitCommandResult:
+        started = utc_now()
+        before = self._head()
+        process = self._run_raw(args, check=False)
+        after = self._head()
+        result = GitCommandResult(
+            operation_id=f"gitop_{uuid.uuid4().hex}",
+            operation=operation.value,
+            authorization_ids=tuple(authorization_ids),
+            command=tuple(["git", "-C", "<repo>", *[str(item) for item in args]]),
+            exit_code=int(process.returncode),
+            stdout=self._redact(process.stdout, self.output_limit),
+            stderr=self._redact(process.stderr, self.output_limit),
+            head_before=before,
+            head_after=after,
+            started_at=started,
+            completed_at=utc_now(),
+        )
+        if process.returncode != 0:
+            raise ProvenanceGitError(
+                result.stderr or result.stdout or f"Git {operation.value} failed"
+            )
+        return result
+
+    def _execute(
+        self,
+        context: GitExecutionContext,
+        *,
+        operation: GitOperation,
+        args: Sequence[str],
+        request: Mapping[str, Any],
+        code_change: bool,
+    ) -> GitCommandResult:
+        authorization_ids = self._authorize(
+            context,
+            operation=operation,
+            request=request,
+            code_change=code_change,
+        )
+        return self._run_authorized(
+            operation=operation,
+            args=args,
+            authorization_ids=authorization_ids,
+        )
+
+    def read_ref(self, context: GitExecutionContext, ref: str) -> GitCommandResult:
+        normalized = str(ref or "").strip()
+        if not normalized or any(ch.isspace() for ch in normalized):
+            raise ProvenanceGitError("invalid Git ref")
+        return self._execute(
+            context,
+            operation=GitOperation.READ_REF,
+            args=["rev-parse", "--verify", normalized],
+            request={"ref": normalized},
+            code_change=False,
+        )
+
+    def fetch(
+        self,
+        context: GitExecutionContext,
+        *,
+        remote: str,
+        refspecs: Sequence[str],
+    ) -> GitCommandResult:
+        normalized_remote = str(remote or "").strip()
+        normalized_refspecs = tuple(str(item).strip() for item in refspecs if str(item).strip())
+        if not normalized_remote or not normalized_refspecs:
+            raise ProvenanceGitError("remote and refspecs are required")
+        if any(item.startswith("+") and ":refs/heads/" in item for item in normalized_refspecs):
+            raise ProvenanceGitError(
+                "fetching directly into local branch refs is prohibited; use remote-tracking refs"
+            )
+        return self._execute(
+            context,
+            operation=GitOperation.FETCH,
+            args=["fetch", "--prune", normalized_remote, *normalized_refspecs],
+            request={"remote": normalized_remote, "refspecs": normalized_refspecs},
+            code_change=False,
+        )
+
+    def create_branch(
+        self,
+        context: GitExecutionContext,
+        *,
+        branch: str,
+        start_point: str,
+    ) -> GitCommandResult:
+        normalized = self._validate_branch(branch)
+        start = str(start_point or "").strip()
+        if not start:
+            raise ProvenanceGitError("start_point is required")
+        return self._execute(
+            context,
+            operation=GitOperation.CREATE_BRANCH,
+            args=["branch", normalized, start],
+            request={"branch": normalized, "start_point": start},
+            code_change=False,
+        )
+
+    def commit(
+        self,
+        context: GitExecutionContext,
+        *,
+        paths: Sequence[str | Path],
+        message: str,
+    ) -> GitCommandResult:
+        normalized_paths = tuple(self._validate_path(item) for item in paths)
+        normalized_message = str(message or "").strip()
+        if not normalized_paths or not normalized_message:
+            raise ProvenanceGitError("commit paths and message are required")
+        if len(normalized_message) > 500:
+            raise ProvenanceGitError("commit message is too long")
+        request = {
+            "paths": normalized_paths,
+            "message": normalized_message,
+            "content_manifest": self._content_manifest(normalized_paths),
+        }
+        authorization_ids = self._authorize(
+            context,
+            operation=GitOperation.COMMIT,
+            request=request,
+            code_change=True,
+        )
+        self._run_raw(["add", "--", *normalized_paths], check=True)
+        return self._run_authorized(
+            operation=GitOperation.COMMIT,
+            args=["commit", "--no-gpg-sign", "-m", normalized_message, "--", *normalized_paths],
+            authorization_ids=authorization_ids,
+        )
+
+    def merge(
+        self,
+        context: GitExecutionContext,
+        *,
+        source_ref: str,
+        message: str,
+    ) -> GitCommandResult:
+        source = str(source_ref or "").strip()
+        normalized_message = str(message or "").strip()
+        if not source or not normalized_message:
+            raise ProvenanceGitError("source_ref and message are required")
+        return self._execute(
+            context,
+            operation=GitOperation.MERGE,
+            args=["merge", "--no-ff", "--no-edit", "-m", normalized_message, source],
+            request={"source_ref": source, "message": normalized_message},
+            code_change=True,
+        )
+
+    def push(
+        self,
+        context: GitExecutionContext,
+        *,
+        remote: str,
+        branch: str,
+    ) -> GitCommandResult:
+        normalized_remote = str(remote or "").strip()
+        normalized_branch = self._validate_branch(branch)
+        if not normalized_remote:
+            raise ProvenanceGitError("remote is required")
+        return self._execute(
+            context,
+            operation=GitOperation.PUSH,
+            args=["push", normalized_remote, f"refs/heads/{normalized_branch}:refs/heads/{normalized_branch}"],
+            request={"remote": normalized_remote, "branch": normalized_branch},
+            code_change=False,
+        )
+
+    def update_evidence(
+        self,
+        context: GitExecutionContext,
+        *,
+        paths: Sequence[str | Path],
+        message: str,
+    ) -> GitCommandResult:
+        normalized_paths = tuple(self._validate_path(item) for item in paths)
+        normalized_message = str(message or "").strip()
+        if not normalized_paths or not normalized_message:
+            raise ProvenanceGitError("evidence paths and message are required")
+        if any(not path.startswith(".agent/") for path in normalized_paths):
+            raise ProvenanceGitError("UPDATE_EVIDENCE may only commit .agent/ paths")
+        request = {
+            "paths": normalized_paths,
+            "message": normalized_message,
+            "content_manifest": self._content_manifest(normalized_paths),
+        }
+        authorization_ids = self._authorize(
+            context,
+            operation=GitOperation.UPDATE_EVIDENCE,
+            request=request,
+            code_change=False,
+        )
+        self._run_raw(["add", "--", *normalized_paths], check=True)
+        return self._run_authorized(
+            operation=GitOperation.UPDATE_EVIDENCE,
+            args=["commit", "--no-gpg-sign", "-m", normalized_message, "--", *normalized_paths],
+            authorization_ids=authorization_ids,
+        )
@@ -0,0 +1,744 @@
+"""AIOS V2 最小权限 Run Provenance 子 Grant。
+
+父 Workflow Provenance 只绑定 run/tenant/task/agent/principal 身份，不直接授予
+操作权限。每个子 Grant 只允许一个 ExecutionPath；Git Grant 还必须限定具体
+GitOperation。子 Grant 具备独立 TTL、nonce、状态、撤销和重放防护。
+"""
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+import threading
+import uuid
+from dataclasses import asdict, dataclass, field, replace
+from datetime import datetime, timedelta, timezone
+from enum import Enum
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .provenance import (
+    ExecutionPath,
+    GitOperation,
+    ProvenanceDenied,
+    ProvenanceExpired,
+    ProvenanceIssuer,
+    ProvenanceNotFound,
+    ProvenanceReplay,
+    ProvenanceRevoked,
+    ProvenanceSignatureError,
+    ProvenanceStatus,
+    ProvenanceVerifier,
+    RunProvenance,
+    SQLiteProvenanceStore,
+    Signer,
+    SignatureVerifier,
+    _validate_digest,
+    canonical_json_bytes,
+    parse_timestamp,
+    required,
+    utc_now,
+)
+
+WORKFLOW_POLICY_VERSION = "aios.v2.workflow.v1"
+GRANT_SCHEMA_VERSION = "aios.v2.provenance-grant.v1"
+
+
+class GrantType(str, Enum):
+    CODE_CHANGE = "code_change"
+    GIT = "git"
+    DEPLOYMENT = "deployment"
+    RUNTIME = "runtime"
+    EVIDENCE = "evidence"
+    ROLLBACK = "rollback"
+    AUDIT = "audit"
+
+
+GRANT_PATHS: Mapping[GrantType, ExecutionPath] = {
+    GrantType.CODE_CHANGE: ExecutionPath.CODE_CHANGE,
+    GrantType.GIT: ExecutionPath.GIT_OPERATION,
+    GrantType.DEPLOYMENT: ExecutionPath.DEPLOYMENT,
+    GrantType.RUNTIME: ExecutionPath.RUNTIME_EXECUTE,
+    GrantType.EVIDENCE: ExecutionPath.EVIDENCE_WRITE,
+    GrantType.ROLLBACK: ExecutionPath.ROLLBACK,
+    GrantType.AUDIT: ExecutionPath.AUDIT,
+}
+
+
+class GrantStatus(str, Enum):
+    ISSUED = "issued"
+    VERIFIED = "verified"
+    USED = "used"
+    EXPIRED = "expired"
+    REVOKED = "revoked"
+
+
+@dataclass(frozen=True)
+class ProvenanceGrant:
+    grant_id: str
+    parent_provenance_id: str
+    grant_type: GrantType
+    execution_path: ExecutionPath
+    run_id: str
+    issuer: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    principal_id: str
+    allowed_git_operations: Sequence[str]
+    issued_at: str
+    expires_at: str
+    policy_version: str
+    key_id: str
+    nonce: str
+    signature: str = ""
+    schema_version: str = GRANT_SCHEMA_VERSION
+
+    def __post_init__(self) -> None:
+        for name in (
+            "grant_id",
+            "parent_provenance_id",
+            "run_id",
+            "issuer",
+            "tenant_id",
+            "task_id",
+            "agent_id",
+            "principal_id",
+            "issued_at",
+            "expires_at",
+            "policy_version",
+            "key_id",
+            "nonce",
+            "schema_version",
+        ):
+            object.__setattr__(self, name, required(getattr(self, name), name))
+        if self.schema_version != GRANT_SCHEMA_VERSION:
+            raise ValueError(f"unsupported grant schema: {self.schema_version}")
+        grant_type = GrantType(self.grant_type)
+        path = ExecutionPath(self.execution_path)
+        if GRANT_PATHS[grant_type] != path:
+            raise ValueError("grant_type does not match execution_path")
+        object.__setattr__(self, "grant_type", grant_type)
+        object.__setattr__(self, "execution_path", path)
+        operations = tuple(
+            sorted({GitOperation(item).value for item in self.allowed_git_operations})
+        )
+        if grant_type == GrantType.GIT and not operations:
+            raise ValueError("Git Grant requires explicit Git operations")
+        if grant_type != GrantType.GIT and operations:
+            raise ValueError("only Git Grant may contain Git operations")
+        object.__setattr__(self, "allowed_git_operations", operations)
+        issued = parse_timestamp(self.issued_at)
+        expires = parse_timestamp(self.expires_at)
+        if expires <= issued:
+            raise ValueError("grant expires_at must be later than issued_at")
+        object.__setattr__(self, "signature", str(self.signature or "").strip())
+
+    def unsigned_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "grant_id": self.grant_id,
+            "parent_provenance_id": self.parent_provenance_id,
+            "grant_type": self.grant_type.value,
+            "execution_path": self.execution_path.value,
+            "run_id": self.run_id,
+            "issuer": self.issuer,
+            "tenant_id": self.tenant_id,
+            "task_id": self.task_id,
+            "agent_id": self.agent_id,
+            "principal_id": self.principal_id,
+            "allowed_git_operations": list(self.allowed_git_operations),
+            "issued_at": self.issued_at,
+            "expires_at": self.expires_at,
+            "policy_version": self.policy_version,
+            "key_id": self.key_id,
+            "nonce": self.nonce,
+        }
+
+    def canonical_bytes(self) -> bytes:
+        return canonical_json_bytes(self.unsigned_dict())
+
+    def as_dict(self) -> dict[str, Any]:
+        value = self.unsigned_dict()
+        value["signature"] = self.signature
+        return value
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ProvenanceGrant":
+        return cls(**dict(value))
+
+
+@dataclass(frozen=True)
+class GrantAuthorization:
+    authorization_id: str
+    grant_id: str
+    parent_provenance_id: str
+    run_id: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    principal_id: str
+    execution_path: str
+    git_operation: str | None
+    request_digest: str
+    policy_version: str
+    key_id: str
+    public_key_fingerprint: str
+    authorized_at: str = field(default_factory=utc_now)
+
+    @property
+    def provenance_id(self) -> str:
+        return self.parent_provenance_id
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+class WorkflowProvenanceIssuer:
+    """签发不携带操作权限的父 Workflow Provenance。"""
+
+    def __init__(self, signer: Signer, store: SQLiteProvenanceStore) -> None:
+        self._issuer = ProvenanceIssuer(signer, store)
+
+    def issue(
+        self,
+        *,
+        run_id: str,
+        issuer: str,
+        tenant_id: str,
+        task_id: str,
+        agent_id: str,
+        principal_id: str,
+        ttl_seconds: int = 14400,
+        provenance_id: str | None = None,
+        nonce: str | None = None,
+        now: datetime | None = None,
+    ) -> RunProvenance:
+        return self._issuer.issue(
+            run_id=run_id,
+            issuer=issuer,
+            tenant_id=tenant_id,
+            task_id=task_id,
+            agent_id=agent_id,
+            principal_id=principal_id,
+            allowed_paths=(),
+            allowed_git_operations=(),
+            ttl_seconds=ttl_seconds,
+            policy_version=WORKFLOW_POLICY_VERSION,
+            provenance_id=provenance_id,
+            nonce=nonce,
+            now=now,
+        )
+
+
+class SQLiteGrantStore:
+    """在 Provenance SQLite 数据库中持久化子 Grant 与使用记录。"""
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+        self._connection = sqlite3.connect(
+            str(self.path), timeout=30.0, check_same_thread=False
+        )
+        self._connection.row_factory = sqlite3.Row
+        with self._lock:
+            self._connection.execute("PRAGMA journal_mode=WAL")
+            self._connection.execute("PRAGMA synchronous=FULL")
+            self._connection.execute("PRAGMA foreign_keys=ON")
+            self._connection.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS provenance_grants (
+                    grant_id TEXT PRIMARY KEY,
+                    parent_provenance_id TEXT NOT NULL,
+                    grant_type TEXT NOT NULL,
+                    execution_path TEXT NOT NULL,
+                    payload_json TEXT NOT NULL,
+                    status TEXT NOT NULL,
+                    signature_verified INTEGER NOT NULL DEFAULT 0,
+                    created_at TEXT NOT NULL,
+                    updated_at TEXT NOT NULL
+                );
+                CREATE INDEX IF NOT EXISTS idx_grants_parent
+                    ON provenance_grants(parent_provenance_id, grant_type, status);
+                CREATE TABLE IF NOT EXISTS provenance_grant_usage (
+                    authorization_id TEXT PRIMARY KEY,
+                    grant_id TEXT NOT NULL,
+                    execution_path TEXT NOT NULL,
+                    git_operation TEXT NOT NULL DEFAULT '',
+                    request_digest TEXT NOT NULL,
+                    authorized_at TEXT NOT NULL,
+                    receipt_json TEXT NOT NULL,
+                    UNIQUE(grant_id, execution_path, git_operation, request_digest),
+                    FOREIGN KEY(grant_id) REFERENCES provenance_grants(grant_id)
+                );
+                CREATE TABLE IF NOT EXISTS provenance_grant_events (
+                    event_id TEXT PRIMARY KEY,
+                    grant_id TEXT NOT NULL,
+                    event_type TEXT NOT NULL,
+                    details_json TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    FOREIGN KEY(grant_id) REFERENCES provenance_grants(grant_id)
+                );
+                """
+            )
+            self._connection.commit()
+
+    def close(self) -> None:
+        with self._lock:
+            self._connection.close()
+
+    def _event(
+        self,
+        grant_id: str,
+        event_type: str,
+        details: Mapping[str, Any] | None = None,
+    ) -> None:
+        self._connection.execute(
+            "INSERT INTO provenance_grant_events VALUES (?, ?, ?, ?, ?)",
+            (
+                f"gevt_{uuid.uuid4().hex}",
+                grant_id,
+                event_type,
+                json.dumps(dict(details or {}), ensure_ascii=False, sort_keys=True),
+                utc_now(),
+            ),
+        )
+
+    def save_issued(self, grant: ProvenanceGrant) -> None:
+        payload = json.dumps(
+            grant.as_dict(), ensure_ascii=False, sort_keys=True, separators=(",", ":")
+        )
+        now = utc_now()
+        with self._lock:
+            self._connection.execute("BEGIN IMMEDIATE")
+            try:
+                self._connection.execute(
+                    "INSERT INTO provenance_grants VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)",
+                    (
+                        grant.grant_id,
+                        grant.parent_provenance_id,
+                        grant.grant_type.value,
+                        grant.execution_path.value,
+                        payload,
+                        GrantStatus.ISSUED.value,
+                        now,
+                        now,
+                    ),
+                )
+                self._event(grant.grant_id, "issued")
+                self._connection.commit()
+            except sqlite3.IntegrityError as exc:
+                self._connection.rollback()
+                raise ProvenanceDenied("grant_id already exists") from exc
+            except Exception:
+                self._connection.rollback()
+                raise
+
+    def get(self, grant_id: str) -> ProvenanceGrant:
+        with self._lock:
+            row = self._connection.execute(
+                "SELECT payload_json FROM provenance_grants WHERE grant_id = ?",
+                (required(grant_id, "grant_id"),),
+            ).fetchone()
+        if row is None:
+            raise ProvenanceNotFound("provenance grant not found")
+        value = json.loads(row["payload_json"])
+        if not isinstance(value, Mapping):
+            raise ProvenanceDenied("stored grant is invalid")
+        return ProvenanceGrant.from_dict(value)
+
+    def status(self, grant_id: str) -> GrantStatus:
+        with self._lock:
+            row = self._connection.execute(
+                "SELECT status FROM provenance_grants WHERE grant_id = ?",
+                (required(grant_id, "grant_id"),),
+            ).fetchone()
+        if row is None:
+            raise ProvenanceNotFound("provenance grant not found")
+        return GrantStatus(row["status"])
+
+    def mark_verified(self, grant_id: str, *, fingerprint: str) -> None:
+        with self._lock:
+            self._connection.execute("BEGIN IMMEDIATE")
+            try:
+                current = self.status(grant_id)
+                if current in {GrantStatus.REVOKED, GrantStatus.EXPIRED}:
+                    raise ProvenanceDenied(f"cannot verify grant in state {current.value}")
+                next_status = (
+                    GrantStatus.USED.value
+                    if current == GrantStatus.USED
+                    else GrantStatus.VERIFIED.value
+                )
+                self._connection.execute(
+                    "UPDATE provenance_grants SET status = ?, signature_verified = 1, updated_at = ? WHERE grant_id = ?",
+                    (next_status, utc_now(), grant_id),
+                )
+                self._event(
+                    grant_id,
+                    "verified",
+                    {"public_key_fingerprint": fingerprint},
+                )
+                self._connection.commit()
+            except Exception:
+                self._connection.rollback()
+                raise
+
+    def mark_expired(self, grant_id: str) -> None:
+        with self._lock:
+            self._connection.execute("BEGIN IMMEDIATE")
+            try:
+                if self.status(grant_id) == GrantStatus.REVOKED:
+                    self._connection.rollback()
+                    return
+                self._connection.execute(
+                    "UPDATE provenance_grants SET status = ?, updated_at = ? WHERE grant_id = ?",
+                    (GrantStatus.EXPIRED.value, utc_now(), grant_id),
+                )
+                self._event(grant_id, "expired")
+                self._connection.commit()
+            except Exception:
+                self._connection.rollback()
+                raise
+
+    def revoke(self, grant_id: str, *, reason: str, principal_id: str) -> None:
+        with self._lock:
+            self._connection.execute("BEGIN IMMEDIATE")
+            try:
+                self.get(grant_id)
+                self._connection.execute(
+                    "UPDATE provenance_grants SET status = ?, updated_at = ? WHERE grant_id = ?",
+                    (GrantStatus.REVOKED.value, utc_now(), grant_id),
+                )
+                self._event(
+                    grant_id,
+                    "revoked",
+                    {
+                        "reason": required(reason, "reason"),
+                        "principal_id": required(principal_id, "principal_id"),
+                    },
+                )
+                self._connection.commit()
+            except Exception:
+                self._connection.rollback()
+                raise
+
+    def record_authorization(self, authorization: GrantAuthorization) -> None:
+        receipt = json.dumps(
+            authorization.as_dict(), ensure_ascii=False, sort_keys=True, separators=(",", ":")
+        )
+        with self._lock:
+            self._connection.execute("BEGIN IMMEDIATE")
+            try:
+                current = self.status(authorization.grant_id)
+                if current in {GrantStatus.REVOKED, GrantStatus.EXPIRED}:
+                    raise ProvenanceDenied(f"grant state is {current.value}")
+                try:
+                    self._connection.execute(
+                        "INSERT INTO provenance_grant_usage VALUES (?, ?, ?, ?, ?, ?, ?)",
+                        (
+                            authorization.authorization_id,
+                            authorization.grant_id,
+                            authorization.execution_path,
+                            authorization.git_operation or "",
+                            authorization.request_digest,
+                            authorization.authorized_at,
+                            receipt,
+                        ),
+                    )
+                except sqlite3.IntegrityError as exc:
+                    raise ProvenanceReplay(
+                        "identical grant path/operation/request digest already used"
+                    ) from exc
+                self._connection.execute(
+                    "UPDATE provenance_grants SET status = ?, updated_at = ? WHERE grant_id = ?",
+                    (GrantStatus.USED.value, authorization.authorized_at, authorization.grant_id),
+                )
+                self._event(
+                    authorization.grant_id,
+                    "used",
+                    {
+                        "authorization_id": authorization.authorization_id,
+                        "execution_path": authorization.execution_path,
+                        "git_operation": authorization.git_operation,
+                        "request_digest": authorization.request_digest,
+                    },
+                )
+                self._connection.commit()
+            except Exception:
+                self._connection.rollback()
+                raise
+
+    def list_for_parent(self, parent_provenance_id: str) -> list[ProvenanceGrant]:
+        with self._lock:
+            rows = self._connection.execute(
+                "SELECT payload_json FROM provenance_grants WHERE parent_provenance_id = ? ORDER BY grant_type, grant_id",
+                (required(parent_provenance_id, "parent_provenance_id"),),
+            ).fetchall()
+        return [ProvenanceGrant.from_dict(json.loads(row["payload_json"])) for row in rows]
+
+
+class GrantIssuer:
+    """从父 Workflow Provenance 派生单一路径最小权限 Grant。"""
+
+    def __init__(
+        self,
+        signer: Signer,
+        parent_store: SQLiteProvenanceStore,
+        grant_store: SQLiteGrantStore,
+    ) -> None:
+        self.signer = signer
+        self.parent_store = parent_store
+        self.grant_store = grant_store
+
+    def issue(
+        self,
+        *,
+        parent_provenance_id: str,
+        grant_type: GrantType | str,
+        ttl_seconds: int = 900,
+        allowed_git_operations: Sequence[str] = (),
+        grant_id: str | None = None,
+        nonce: str | None = None,
+        now: datetime | None = None,
+    ) -> ProvenanceGrant:
+        if ttl_seconds <= 0:
+            raise ValueError("grant ttl_seconds must be positive")
+        parent = self.parent_store.get(parent_provenance_id)
+        if parent.policy_version != WORKFLOW_POLICY_VERSION:
+            raise ProvenanceDenied("child grants require a workflow provenance parent")
+        if parent.allowed_paths or parent.allowed_git_operations:
+            raise ProvenanceDenied("workflow provenance parent must not contain operation rights")
+        parent_status = self.parent_store.status(parent.provenance_id)
+        if parent_status == ProvenanceStatus.REVOKED:
+            raise ProvenanceRevoked("workflow provenance is revoked")
+        issued = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+        parent_expiry = parse_timestamp(parent.expires_at)
+        expires = min(issued + timedelta(seconds=ttl_seconds), parent_expiry)
+        if expires <= issued:
+            raise ProvenanceExpired("workflow provenance has expired")
+        normalized_type = GrantType(grant_type)
+        operations = tuple(allowed_git_operations)
+        unsigned = ProvenanceGrant(
+            grant_id=grant_id or f"grant_{uuid.uuid4().hex}",
+            parent_provenance_id=parent.provenance_id,
+            grant_type=normalized_type,
+            execution_path=GRANT_PATHS[normalized_type],
+            run_id=parent.run_id,
+            issuer=parent.issuer,
+            tenant_id=parent.tenant_id,
+            task_id=parent.task_id,
+            agent_id=parent.agent_id,
+            principal_id=parent.principal_id,
+            allowed_git_operations=operations,
+            issued_at=issued.isoformat().replace("+00:00", "Z"),
+            expires_at=expires.isoformat().replace("+00:00", "Z"),
+            policy_version=f"{WORKFLOW_POLICY_VERSION}.{normalized_type.value}",
+            key_id=self.signer.key_id,
+            nonce=nonce or uuid.uuid4().hex,
+        )
+        signed = replace(unsigned, signature=self.signer.sign(unsigned.canonical_bytes()))
+        self.grant_store.save_issued(signed)
+        return signed
+
+
+class GrantVerifier:
+    """验证父 Workflow 与子 Grant，确保单一路径最小权限。"""
+
+    def __init__(
+        self,
+        parent_store: SQLiteProvenanceStore,
+        grant_store: SQLiteGrantStore,
+        verifiers: Mapping[str, SignatureVerifier],
+    ) -> None:
+        if not verifiers:
+            raise ValueError("at least one trusted verifier is required")
+        self.parent_store = parent_store
+        self.grant_store = grant_store
+        self.verifiers = {required(key, "key_id"): value for key, value in verifiers.items()}
+
+    def _verify_parent(self, parent: RunProvenance, *, now: datetime) -> SignatureVerifier:
+        status = self.parent_store.status(parent.provenance_id)
+        if status == ProvenanceStatus.REVOKED:
+            raise ProvenanceRevoked("workflow provenance is revoked")
+        if now >= parse_timestamp(parent.expires_at):
+            self.parent_store.mark_expired(parent.provenance_id)
+            raise ProvenanceExpired("workflow provenance is expired")
+        verifier = self.verifiers.get(parent.key_id)
+        if verifier is None or not parent.signature or not verifier.verify(
+            parent.canonical_bytes(), parent.signature
+        ):
+            raise ProvenanceSignatureError("invalid workflow provenance signature")
+        if parent.policy_version != WORKFLOW_POLICY_VERSION:
+            raise ProvenanceDenied("parent is not a workflow provenance")
+        if parent.allowed_paths or parent.allowed_git_operations:
+            raise ProvenanceDenied("workflow provenance must not contain operation rights")
+        return verifier
+
+    def authorize(
+        self,
+        *,
+        grant_id: str,
+        parent_provenance_id: str,
+        run_id: str,
+        tenant_id: str,
+        task_id: str,
+        agent_id: str,
+        principal_id: str,
+        execution_path: str,
+        request_digest: str,
+        git_operation: str | None = None,
+        now: datetime | None = None,
+    ) -> GrantAuthorization:
+        current = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+        parent = self.parent_store.get(parent_provenance_id)
+        self._verify_parent(parent, now=current)
+        grant = self.grant_store.get(grant_id)
+        grant_status = self.grant_store.status(grant.grant_id)
+        if grant_status == GrantStatus.REVOKED:
+            raise ProvenanceRevoked("provenance grant is revoked")
+        if current >= parse_timestamp(grant.expires_at):
+            self.grant_store.mark_expired(grant.grant_id)
+            raise ProvenanceExpired("provenance grant is expired")
+        verifier = self.verifiers.get(grant.key_id)
+        if verifier is None or not grant.signature or not verifier.verify(
+            grant.canonical_bytes(), grant.signature
+        ):
+            raise ProvenanceSignatureError("invalid provenance grant signature")
+        expected = {
+            "parent_provenance_id": parent.provenance_id,
+            "run_id": required(run_id, "run_id"),
+            "tenant_id": required(tenant_id, "tenant_id"),
+            "task_id": required(task_id, "task_id"),
+            "agent_id": required(agent_id, "agent_id"),
+            "principal_id": required(principal_id, "principal_id"),
+        }
+        for field_name, expected_value in expected.items():
+            if getattr(grant, field_name) != expected_value:
+                raise ProvenanceDenied(f"grant {field_name} mismatch")
+            if field_name != "parent_provenance_id" and getattr(parent, field_name) != expected_value:
+                raise ProvenanceDenied(f"workflow {field_name} mismatch")
+        path = ExecutionPath(execution_path)
+        if grant.execution_path != path:
+            raise ProvenanceDenied(
+                f"grant permits {grant.execution_path.value}, not {path.value}"
+            )
+        operation: str | None = None
+        if path == ExecutionPath.GIT_OPERATION:
+            if git_operation is None:
+                raise ProvenanceDenied("Git operation is required")
+            operation = GitOperation(git_operation).value
+            if operation not in grant.allowed_git_operations:
+                raise ProvenanceDenied(f"Git operation is not allowed: {operation}")
+        elif git_operation is not None:
+            raise ProvenanceDenied("git_operation is only valid for a Git Grant")
+        digest = _validate_digest(request_digest)
+        self.grant_store.mark_verified(grant.grant_id, fingerprint=verifier.fingerprint)
+        authorization = GrantAuthorization(
+            authorization_id=f"gauth_{uuid.uuid4().hex}",
+            grant_id=grant.grant_id,
+            parent_provenance_id=parent.provenance_id,
+            run_id=grant.run_id,
+            tenant_id=grant.tenant_id,
+            task_id=grant.task_id,
+            agent_id=grant.agent_id,
+            principal_id=grant.principal_id,
+            execution_path=path.value,
+            git_operation=operation,
+            request_digest=digest,
+            policy_version=grant.policy_version,
+            key_id=grant.key_id,
+            public_key_fingerprint=verifier.fingerprint,
+        )
+        self.grant_store.record_authorization(authorization)
+        return authorization
+
+
+class LeastPrivilegeProvenanceWriter:
+    """按路径选择独立子 Grant 的生产 Writer。
+
+    ``provenance_id`` 参数始终指父 Workflow Provenance；Grant ID 来自受保护
+    配置映射，调用方无法通过请求体临时扩大权限。
+    """
+
+    def __init__(
+        self,
+        verifier: GrantVerifier,
+        receipt_root: str | Path,
+        grant_ids: Mapping[str, str],
+        *,
+        writer_id: str = "aios-v2-least-privilege-writer",
+    ) -> None:
+        self.verifier = verifier
+        self.receipt_root = Path(receipt_root).resolve()
+        self.receipt_root.mkdir(parents=True, exist_ok=True)
+        self.grant_ids = {
+            ExecutionPath(path).value: required(grant_id, f"grant_id[{path}]")
+            for path, grant_id in grant_ids.items()
+        }
+        missing = sorted(path.value for path in ExecutionPath if path.value not in self.grant_ids)
+        if missing:
+            raise ValueError(f"missing least-privilege Grant mappings: {missing}")
+        self.writer_id = required(writer_id, "writer_id")
+        self._lock = threading.RLock()
+
+    @staticmethod
+    def _component(value: str) -> str:
+        normalized = required(value, "path component")
+        if normalized in {".", ".."} or "/" in normalized or "\\" in normalized:
+            raise ProvenanceDenied("invalid receipt path component")
+        return normalized
+
+    def authorize(self, **values: Any) -> GrantAuthorization:
+        path = ExecutionPath(values["execution_path"]).value
+        grant_id = self.grant_ids[path]
+        parent_provenance_id = values.pop("provenance_id")
+        authorization = self.verifier.authorize(
+            grant_id=grant_id,
+            parent_provenance_id=parent_provenance_id,
+            **values,
+        )
+        tenant = self._component(authorization.tenant_id)
+        parent = self._component(authorization.parent_provenance_id)
+        grant = self._component(authorization.grant_id)
+        target_dir = self.receipt_root / tenant / parent / grant
+        target = target_dir / f"{authorization.authorization_id}.json"
+        payload = authorization.as_dict()
+        payload["writer_id"] = self.writer_id
+        with self._lock:
+            target_dir.mkdir(parents=True, exist_ok=True)
+            temporary = target.with_suffix(f".tmp-{os.getpid()}")
+            temporary.write_text(
+                json.dumps(payload, ensure_ascii=False, sort_keys=True, indent=2) + "\n",
+                encoding="utf-8",
+            )
+            os.chmod(temporary, 0o640)
+            os.replace(temporary, target)
+        return authorization
+
+    def authorize_code_change(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(execution_path=ExecutionPath.CODE_CHANGE.value, **values)
+
+    def authorize_git_operation(
+        self, *, git_operation: str, **values: Any
+    ) -> GrantAuthorization:
+        return self.authorize(
+            execution_path=ExecutionPath.GIT_OPERATION.value,
+            git_operation=git_operation,
+            **values,
+        )
+
+    def authorize_deployment(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(execution_path=ExecutionPath.DEPLOYMENT.value, **values)
+
+    def authorize_runtime_execute(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(execution_path=ExecutionPath.RUNTIME_EXECUTE.value, **values)
+
+    def authorize_evidence_write(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(execution_path=ExecutionPath.EVIDENCE_WRITE.value, **values)
+
+    def authorize_rollback(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(execution_path=ExecutionPath.ROLLBACK.value, **values)
+
+    def authorize_audit(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(execution_path=ExecutionPath.AUDIT.value, **values)
@@ -0,0 +1,265 @@
+"""AIOS V2 运维操作 Provenance Gate 与服务级 Scoped Writer 工厂。"""
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import asdict, dataclass
+from pathlib import Path
+from typing import Any, Mapping, Protocol, Sequence
+
+from .provenance import (
+    Ed25519PublicKeyVerifier,
+    ExecutionPath,
+    ProvenanceAuthorization,
+    ProvenanceControlledWriter,
+    ProvenanceDenied,
+    ProvenanceVerifier,
+    SQLiteProvenanceStore,
+    digest_payload,
+)
+from .provenance_grants import GrantAuthorization, GrantVerifier, SQLiteGrantStore
+from .provenance_scoped import ScopedLeastPrivilegeProvenanceWriter
+
+
+APPLICATION_PROVENANCE_SCOPE = (
+    ExecutionPath.RUNTIME_EXECUTE.value,
+    ExecutionPath.EVIDENCE_WRITE.value,
+    ExecutionPath.AUDIT.value,
+)
+
+
+class AuthorizationWriter(Protocol):
+    def authorize_deployment(self, **values: Any) -> Any: ...
+    def authorize_rollback(self, **values: Any) -> Any: ...
+    def authorize_audit(self, **values: Any) -> Any: ...
+    def authorize_code_change(self, **values: Any) -> Any: ...
+    def authorize_evidence_write(self, **values: Any) -> Any: ...
+    def authorize_runtime_execute(self, **values: Any) -> Any: ...
+
+
+@dataclass(frozen=True)
+class OperationContext:
+    provenance_id: str
+    run_id: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    principal_id: str
+
+    def as_dict(self) -> dict[str, str]:
+        return asdict(self)
+
+
+@dataclass(frozen=True)
+class OperationReceipt:
+    operation: str
+    request_digest: str
+    authorization_id: str
+    provenance_id: str
+    grant_id: str | None
+    run_id: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    principal_id: str
+    execution_path: str
+    authorized_at: str
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+class ProvenanceOperationGate:
+    """部署、回滚、审计和运行操作的统一授权入口。"""
+
+    def __init__(self, writer: AuthorizationWriter) -> None:
+        self.writer = writer
+
+    def authorize(
+        self,
+        context: OperationContext,
+        *,
+        execution_path: str,
+        operation: str,
+        request: Mapping[str, Any],
+    ) -> OperationReceipt:
+        path = ExecutionPath(execution_path).value
+        normalized_operation = str(operation or "").strip()
+        if not normalized_operation:
+            raise ValueError("operation is required")
+        digest = digest_payload(
+            {
+                "operation": normalized_operation,
+                "execution_path": path,
+                "request": dict(request),
+            }
+        )
+        values = {
+            "provenance_id": context.provenance_id,
+            "run_id": context.run_id,
+            "tenant_id": context.tenant_id,
+            "task_id": context.task_id,
+            "agent_id": context.agent_id,
+            "principal_id": context.principal_id,
+            "request_digest": digest,
+        }
+        if path == ExecutionPath.DEPLOYMENT.value:
+            authorization = self.writer.authorize_deployment(**values)
+        elif path == ExecutionPath.ROLLBACK.value:
+            authorization = self.writer.authorize_rollback(**values)
+        elif path == ExecutionPath.AUDIT.value:
+            authorization = self.writer.authorize_audit(**values)
+        elif path == ExecutionPath.CODE_CHANGE.value:
+            authorization = self.writer.authorize_code_change(**values)
+        elif path == ExecutionPath.EVIDENCE_WRITE.value:
+            authorization = self.writer.authorize_evidence_write(**values)
+        elif path == ExecutionPath.RUNTIME_EXECUTE.value:
+            authorization = self.writer.authorize_runtime_execute(**values)
+        else:
+            raise ProvenanceDenied(
+                "generic operation gate does not authorize git_operation; use ProvenanceGitWriter"
+            )
+        return self._receipt(normalized_operation, digest, authorization)
+
+    @staticmethod
+    def _receipt(
+        operation: str,
+        request_digest: str,
+        authorization: ProvenanceAuthorization | GrantAuthorization | Any,
+    ) -> OperationReceipt:
+        return OperationReceipt(
+            operation=operation,
+            request_digest=request_digest,
+            authorization_id=authorization.authorization_id,
+            provenance_id=authorization.provenance_id,
+            grant_id=getattr(authorization, "grant_id", None),
+            run_id=authorization.run_id,
+            tenant_id=authorization.tenant_id,
+            task_id=authorization.task_id,
+            agent_id=authorization.agent_id,
+            principal_id=authorization.principal_id,
+            execution_path=authorization.execution_path,
+            authorized_at=authorization.authorized_at,
+        )
+
+
+_GRANT_ENV_BY_PATH: Mapping[str, str] = {
+    ExecutionPath.CODE_CHANGE.value: "AIOS_PROVENANCE_GRANT_CODE_CHANGE_ID",
+    ExecutionPath.GIT_OPERATION.value: "AIOS_PROVENANCE_GRANT_GIT_ID",
+    ExecutionPath.DEPLOYMENT.value: "AIOS_PROVENANCE_GRANT_DEPLOYMENT_ID",
+    ExecutionPath.RUNTIME_EXECUTE.value: "AIOS_PROVENANCE_GRANT_RUNTIME_ID",
+    ExecutionPath.EVIDENCE_WRITE.value: "AIOS_PROVENANCE_GRANT_EVIDENCE_ID",
+    ExecutionPath.ROLLBACK.value: "AIOS_PROVENANCE_GRANT_ROLLBACK_ID",
+    ExecutionPath.AUDIT.value: "AIOS_PROVENANCE_GRANT_AUDIT_ID",
+}
+
+
+def grant_ids_from_environment(
+    *,
+    required_paths: Sequence[str] | None = None,
+) -> dict[str, str]:
+    paths = tuple(
+        sorted(
+            {
+                ExecutionPath(path).value
+                for path in (required_paths or tuple(item.value for item in ExecutionPath))
+            }
+        )
+    )
+    values = {path: os.getenv(_GRANT_ENV_BY_PATH[path], "").strip() for path in paths}
+    missing = [_GRANT_ENV_BY_PATH[path] for path, value in values.items() if not value]
+    if missing:
+        raise RuntimeError(f"missing scoped Provenance Grant configuration: {missing}")
+    return values
+
+
+def build_provenance_writer_from_env(
+    *,
+    state_dir: str | Path | None = None,
+    required: bool | None = None,
+    required_paths: Sequence[str] | None = None,
+    writer_id: str = "aios-v2-application-grant-writer",
+) -> AuthorizationWriter | None:
+    """从环境构建服务级最小权限 Writer。
+
+    生产应用默认只加载 Runtime、Evidence、Audit Grant。Git、部署和回滚进程
+    必须显式传入自己的 ``required_paths``，不能继承应用默认范围。旧全权限 Writer
+    只允许在显式关闭强制模式的候选/测试环境中使用。
+    """
+
+    require_value = (
+        bool(required)
+        if required is not None
+        else os.getenv("AIOS_REQUIRE_RUN_PROVENANCE", "0").strip().lower()
+        in {"1", "true", "yes", "on"}
+    )
+    public_key_file = os.getenv("AIOS_PROVENANCE_PUBLIC_KEY_FILE", "").strip()
+    key_id = os.getenv("AIOS_PROVENANCE_KEY_ID", "").strip()
+    base = Path(state_dir or os.getenv("AIOS_V2_STATE_DIR", "/var/lib/aios-v2")).resolve()
+    store_file = os.getenv(
+        "AIOS_PROVENANCE_STORE_FILE", str(base / "run-provenance.sqlite3")
+    ).strip()
+    receipt_root = os.getenv(
+        "AIOS_PROVENANCE_RECEIPT_DIR", str(base / "provenance-receipts")
+    ).strip()
+    configured = bool(public_key_file and key_id)
+    if not configured:
+        if require_value:
+            raise RuntimeError(
+                "Run Provenance is required but AIOS_PROVENANCE_PUBLIC_KEY_FILE or AIOS_PROVENANCE_KEY_ID is missing"
+            )
+        return None
+
+    verifier = Ed25519PublicKeyVerifier.from_file(public_key_file, key_id=key_id)
+    parent_store = SQLiteProvenanceStore(store_file)
+    normalized_paths = tuple(
+        sorted(
+            {
+                ExecutionPath(path).value
+                for path in (
+                    required_paths
+                    if required_paths is not None
+                    else APPLICATION_PROVENANCE_SCOPE
+                )
+            }
+        )
+    )
+
+    if require_value:
+        if not normalized_paths:
+            raise RuntimeError("production Run Provenance requires a non-empty service scope")
+        grant_ids = grant_ids_from_environment(required_paths=normalized_paths)
+        grant_store = SQLiteGrantStore(store_file)
+        trusted_grants = GrantVerifier(parent_store, grant_store, {key_id: verifier})
+        return ScopedLeastPrivilegeProvenanceWriter(
+            trusted_grants,
+            receipt_root,
+            grant_ids,
+            required_paths=normalized_paths,
+            writer_id=writer_id,
+        )
+
+    legacy = ProvenanceVerifier(parent_store, {key_id: verifier})
+    return ProvenanceControlledWriter(legacy, receipt_root)
+
+
+def context_from_environment() -> OperationContext:
+    values = {
+        "provenance_id": os.getenv("AIOS_PROVENANCE_ID", ""),
+        "run_id": os.getenv("AIOS_RUN_ID", ""),
+        "tenant_id": os.getenv("AIOS_TENANT_ID", ""),
+        "task_id": os.getenv("AIOS_TASK_ID", ""),
+        "agent_id": os.getenv("AIOS_AGENT_ID", ""),
+        "principal_id": os.getenv("AIOS_PRINCIPAL_ID", ""),
+    }
+    missing = [name for name, value in values.items() if not str(value).strip()]
+    if missing:
+        raise RuntimeError(f"missing Provenance context environment variables: {missing}")
+    return OperationContext(**{name: str(value).strip() for name, value in values.items()})
+
+
+def load_request_file(path: str | Path) -> Mapping[str, Any]:
+    value = json.loads(Path(path).read_text(encoding="utf-8"))
+    if not isinstance(value, Mapping):
+        raise ValueError("request file must contain a JSON object")
+    return dict(value)
@@ -0,0 +1,131 @@
+"""按服务范围加载的最小权限 Provenance Writer。
+
+该 Writer 只持有调用进程需要的 Grant ID。未配置路径的方法即使被调用也会
+默认拒绝，避免应用进程获得 Git、部署或回滚权限。
+"""
+from __future__ import annotations
+
+import json
+import os
+import threading
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .provenance import ExecutionPath, ProvenanceDenied, required
+from .provenance_grants import GrantAuthorization, GrantVerifier
+
+
+class ScopedLeastPrivilegeProvenanceWriter:
+    """只暴露指定 ExecutionPath 的最小权限 Writer。"""
+
+    def __init__(
+        self,
+        verifier: GrantVerifier,
+        receipt_root: str | Path,
+        grant_ids: Mapping[str, str],
+        *,
+        required_paths: Sequence[str],
+        writer_id: str = "aios-v2-scoped-grant-writer",
+    ) -> None:
+        self.verifier = verifier
+        self.receipt_root = Path(receipt_root).resolve()
+        self.receipt_root.mkdir(parents=True, exist_ok=True)
+        normalized_required = tuple(
+            sorted({ExecutionPath(path).value for path in required_paths})
+        )
+        if not normalized_required:
+            raise ValueError("required_paths must not be empty")
+        self.required_paths = frozenset(normalized_required)
+        self.grant_ids = {
+            path: required(grant_ids.get(path, ""), f"grant_id[{path}]")
+            for path in normalized_required
+        }
+        unexpected = sorted(set(grant_ids) - self.required_paths)
+        if unexpected:
+            raise ValueError(
+                f"scoped writer received unnecessary Grant mappings: {unexpected}"
+            )
+        self.writer_id = required(writer_id, "writer_id")
+        self._lock = threading.RLock()
+
+    @staticmethod
+    def _component(value: str) -> str:
+        normalized = required(value, "path component")
+        if normalized in {".", ".."} or "/" in normalized or "\\" in normalized:
+            raise ProvenanceDenied("invalid receipt path component")
+        return normalized
+
+    def _grant_for(self, path: str) -> str:
+        normalized = ExecutionPath(path).value
+        grant_id = self.grant_ids.get(normalized)
+        if grant_id is None:
+            raise ProvenanceDenied(
+                f"this process is not allowed to authorize {normalized}"
+            )
+        return grant_id
+
+    def authorize(self, **values: Any) -> GrantAuthorization:
+        path = ExecutionPath(values["execution_path"]).value
+        grant_id = self._grant_for(path)
+        parent_provenance_id = values.pop("provenance_id")
+        authorization = self.verifier.authorize(
+            grant_id=grant_id,
+            parent_provenance_id=parent_provenance_id,
+            **values,
+        )
+        tenant = self._component(authorization.tenant_id)
+        parent = self._component(authorization.parent_provenance_id)
+        grant = self._component(authorization.grant_id)
+        target_dir = self.receipt_root / tenant / parent / grant
+        target = target_dir / f"{authorization.authorization_id}.json"
+        payload = authorization.as_dict()
+        payload["writer_id"] = self.writer_id
+        payload["scope"] = sorted(self.required_paths)
+        with self._lock:
+            target_dir.mkdir(parents=True, exist_ok=True)
+            temporary = target.with_suffix(f".tmp-{os.getpid()}")
+            temporary.write_text(
+                json.dumps(payload, ensure_ascii=False, sort_keys=True, indent=2)
+                + "\n",
+                encoding="utf-8",
+            )
+            os.chmod(temporary, 0o640)
+            os.replace(temporary, target)
+        return authorization
+
+    def authorize_code_change(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(
+            execution_path=ExecutionPath.CODE_CHANGE.value, **values
+        )
+
+    def authorize_git_operation(
+        self, *, git_operation: str, **values: Any
+    ) -> GrantAuthorization:
+        return self.authorize(
+            execution_path=ExecutionPath.GIT_OPERATION.value,
+            git_operation=git_operation,
+            **values,
+        )
+
+    def authorize_deployment(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(
+            execution_path=ExecutionPath.DEPLOYMENT.value, **values
+        )
+
+    def authorize_runtime_execute(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(
+            execution_path=ExecutionPath.RUNTIME_EXECUTE.value, **values
+        )
+
+    def authorize_evidence_write(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(
+            execution_path=ExecutionPath.EVIDENCE_WRITE.value, **values
+        )
+
+    def authorize_rollback(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(
+            execution_path=ExecutionPath.ROLLBACK.value, **values
+        )
+
+    def authorize_audit(self, **values: Any) -> GrantAuthorization:
+        return self.authorize(execution_path=ExecutionPath.AUDIT.value, **values)
@@ -0,0 +1,607 @@
+"""Durable execution truth registry for externally executed AIOS tasks.
+
+A task manifest being present in Git is not evidence that an executor discovered
+or ran it. This registry separates declaration, registration, claim, start,
+heartbeat and terminal evidence. Release gates must require a terminal success
+record with immutable evidence hashes.
+"""
+from __future__ import annotations
+
+import json
+import sqlite3
+import threading
+import uuid
+from dataclasses import asdict, dataclass, field, replace
+from datetime import datetime, timedelta, timezone
+from enum import Enum
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def parse_time(value: str) -> datetime:
+    normalized = str(value or "").strip()
+    if normalized.endswith("Z"):
+        normalized = normalized[:-1] + "+00:00"
+    parsed = datetime.fromisoformat(normalized)
+    if parsed.tzinfo is None:
+        raise ValueError("timestamp requires timezone")
+    return parsed.astimezone(timezone.utc)
+
+
+def required(value: str, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+class ExecutionTruthState(str, Enum):
+    DECLARED = "DECLARED"
+    REGISTERED = "REGISTERED"
+    CLAIMED = "CLAIMED"
+    RUNNING = "RUNNING"
+    SUCCEEDED = "SUCCEEDED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
+    NOT_STARTED = "NOT_STARTED"
+    STALLED = "STALLED"
+
+
+TERMINAL_STATES = frozenset(
+    {
+        ExecutionTruthState.SUCCEEDED,
+        ExecutionTruthState.FAILED,
+        ExecutionTruthState.CANCELLED,
+        ExecutionTruthState.NOT_STARTED,
+        ExecutionTruthState.STALLED,
+    }
+)
+
+
+@dataclass(frozen=True)
+class ExecutionTaskManifest:
+    task_id: str
+    executor: str
+    source_branch: str
+    source_oid: str
+    target_version: str
+    steps: Sequence[str]
+    start_deadline_seconds: int = 300
+    heartbeat_timeout_seconds: int = 180
+    required_evidence: Sequence[str] = ()
+    notification_events: Sequence[str] = ("STARTED", "SUCCEEDED", "FAILED")
+    owner_notification_ref: str = "AIOS_OWNER_WECHAT_TARGET_REF"
+    manifest_version: str = "aios.external-task.v1"
+
+    def __post_init__(self) -> None:
+        for name in (
+            "task_id",
+            "executor",
+            "source_branch",
+            "source_oid",
+            "target_version",
+            "manifest_version",
+            "owner_notification_ref",
+        ):
+            object.__setattr__(self, name, required(getattr(self, name), name))
+        steps = tuple(required(item, "step") for item in self.steps)
+        if not steps:
+            raise ValueError("at least one execution step is required")
+        if self.start_deadline_seconds < 1 or self.heartbeat_timeout_seconds < 1:
+            raise ValueError("execution deadlines must be positive")
+        object.__setattr__(self, "steps", steps)
+        object.__setattr__(
+            self,
+            "required_evidence",
+            tuple(sorted({required(item, "required_evidence") for item in self.required_evidence})),
+        )
+        object.__setattr__(
+            self,
+            "notification_events",
+            tuple(sorted({required(item, "notification_event") for item in self.notification_events})),
+        )
+
+    def as_dict(self) -> dict[str, Any]:
+        value = asdict(self)
+        value["steps"] = list(self.steps)
+        value["required_evidence"] = list(self.required_evidence)
+        value["notification_events"] = list(self.notification_events)
+        return value
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ExecutionTaskManifest":
+        return cls(**dict(value))
+
+
+@dataclass(frozen=True)
+class ExecutionTruthRecord:
+    task_id: str
+    manifest_json: str
+    state: ExecutionTruthState
+    executor_run_id: str | None = None
+    executor_id: str | None = None
+    declared_at: str = field(default_factory=utc_now)
+    registered_at: str | None = None
+    claimed_at: str | None = None
+    started_at: str | None = None
+    heartbeat_at: str | None = None
+    completed_at: str | None = None
+    current_step: int = 0
+    evidence: Mapping[str, str] = field(default_factory=dict)
+    error: Mapping[str, Any] = field(default_factory=dict)
+    revision: int = 1
+
+    @property
+    def manifest(self) -> ExecutionTaskManifest:
+        return ExecutionTaskManifest.from_dict(json.loads(self.manifest_json))
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            **asdict(self),
+            "state": self.state.value,
+            "manifest": self.manifest.as_dict(),
+            "evidence": dict(self.evidence),
+            "error": dict(self.error),
+        }
+
+
+class ExecutionTruthConflict(RuntimeError):
+    pass
+
+
+class SQLiteExecutionTruthRegistry:
+    """Persistent registration and run-evidence store."""
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+        with self._connect() as connection:
+            connection.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS execution_truth (
+                    task_id TEXT PRIMARY KEY,
+                    manifest_json TEXT NOT NULL,
+                    state TEXT NOT NULL,
+                    record_json TEXT NOT NULL,
+                    revision INTEGER NOT NULL,
+                    updated_at TEXT NOT NULL
+                );
+                CREATE TABLE IF NOT EXISTS execution_truth_events (
+                    event_id TEXT PRIMARY KEY,
+                    task_id TEXT NOT NULL,
+                    event_type TEXT NOT NULL,
+                    details_json TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    FOREIGN KEY(task_id) REFERENCES execution_truth(task_id)
+                );
+                CREATE INDEX IF NOT EXISTS idx_execution_truth_state
+                    ON execution_truth(state, updated_at);
+                """
+            )
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(str(self.path), timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        connection.execute("PRAGMA foreign_keys=ON")
+        return connection
+
+    @staticmethod
+    def _manifest_json(manifest: ExecutionTaskManifest) -> str:
+        return json.dumps(manifest.as_dict(), ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+
+    @staticmethod
+    def _record_json(record: ExecutionTruthRecord) -> str:
+        value = record.as_dict()
+        value.pop("manifest", None)
+        return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"), default=str)
+
+    @staticmethod
+    def _decode(row: sqlite3.Row) -> ExecutionTruthRecord:
+        value = json.loads(row["record_json"])
+        value["state"] = ExecutionTruthState(value["state"])
+        value["evidence"] = dict(value.get("evidence") or {})
+        value["error"] = dict(value.get("error") or {})
+        return ExecutionTruthRecord(**value)
+
+    def _event(
+        self,
+        connection: sqlite3.Connection,
+        task_id: str,
+        event_type: str,
+        details: Mapping[str, Any] | None = None,
+    ) -> None:
+        connection.execute(
+            "INSERT INTO execution_truth_events VALUES (?, ?, ?, ?, ?)",
+            (
+                f"truth_evt_{uuid.uuid4().hex}",
+                task_id,
+                event_type,
+                json.dumps(dict(details or {}), ensure_ascii=False, sort_keys=True, default=str),
+                utc_now(),
+            ),
+        )
+
+    def declare(self, manifest: ExecutionTaskManifest) -> ExecutionTruthRecord:
+        manifest_json = self._manifest_json(manifest)
+        record = ExecutionTruthRecord(
+            task_id=manifest.task_id,
+            manifest_json=manifest_json,
+            state=ExecutionTruthState.DECLARED,
+        )
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            existing = connection.execute(
+                "SELECT record_json FROM execution_truth WHERE task_id = ?",
+                (manifest.task_id,),
+            ).fetchone()
+            if existing is not None:
+                current = self._decode(existing)
+                if current.manifest_json != manifest_json:
+                    previous_manifest = current.manifest.as_dict()
+                    replacement_manifest = manifest.as_dict()
+                    previous_oid = previous_manifest.pop("source_oid")
+                    replacement_oid = replacement_manifest.pop("source_oid")
+                    if (
+                        current.state != ExecutionTruthState.NOT_STARTED
+                        or previous_manifest != replacement_manifest
+                    ):
+                        connection.rollback()
+                        raise ExecutionTruthConflict(
+                            "task_id already declared with another manifest"
+                        )
+                    now = utc_now()
+                    updated = replace(
+                        current,
+                        manifest_json=manifest_json,
+                        revision=current.revision + 1,
+                    )
+                    connection.execute(
+                        "UPDATE execution_truth SET manifest_json = ?, record_json = ?, revision = ?, updated_at = ? WHERE task_id = ?",
+                        (
+                            manifest_json,
+                            self._record_json(updated),
+                            updated.revision,
+                            now,
+                            updated.task_id,
+                        ),
+                    )
+                    self._event(
+                        connection,
+                        updated.task_id,
+                        "MANIFEST_SUPERSEDED",
+                        {
+                            "previous_source_oid": previous_oid,
+                            "source_oid": replacement_oid,
+                            "state": updated.state.value,
+                        },
+                    )
+                    connection.commit()
+                    return updated
+                connection.rollback()
+                return current
+            connection.execute(
+                "INSERT INTO execution_truth VALUES (?, ?, ?, ?, ?, ?)",
+                (
+                    record.task_id,
+                    manifest_json,
+                    record.state.value,
+                    self._record_json(record),
+                    record.revision,
+                    record.declared_at,
+                ),
+            )
+            self._event(connection, record.task_id, "DECLARED", {"source_oid": manifest.source_oid})
+            connection.commit()
+        return record
+
+    def get(self, task_id: str) -> ExecutionTruthRecord:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT record_json FROM execution_truth WHERE task_id = ?",
+                (required(task_id, "task_id"),),
+            ).fetchone()
+        if row is None:
+            raise KeyError("execution task not declared")
+        return self._decode(row)
+
+    def _transition(
+        self,
+        task_id: str,
+        *,
+        allowed: Sequence[ExecutionTruthState],
+        target: ExecutionTruthState,
+        executor_run_id: str | None = None,
+        executor_id: str | None = None,
+        current_step: int | None = None,
+        evidence: Mapping[str, str] | None = None,
+        error: Mapping[str, Any] | None = None,
+    ) -> ExecutionTruthRecord:
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            row = connection.execute(
+                "SELECT record_json FROM execution_truth WHERE task_id = ?",
+                (required(task_id, "task_id"),),
+            ).fetchone()
+            if row is None:
+                connection.rollback()
+                raise KeyError("execution task not declared")
+            current = self._decode(row)
+            if current.state not in set(allowed):
+                connection.rollback()
+                raise ExecutionTruthConflict(
+                    f"cannot transition {current.state.value} to {target.value}"
+                )
+            now = utc_now()
+            updates: dict[str, Any] = {
+                "state": target,
+                "revision": current.revision + 1,
+            }
+            if executor_run_id is not None:
+                if current.executor_run_id and current.executor_run_id != executor_run_id:
+                    connection.rollback()
+                    raise ExecutionTruthConflict("executor_run_id mismatch")
+                updates["executor_run_id"] = required(executor_run_id, "executor_run_id")
+            if executor_id is not None:
+                if current.executor_id and current.executor_id != executor_id:
+                    connection.rollback()
+                    raise ExecutionTruthConflict("executor_id mismatch")
+                updates["executor_id"] = required(executor_id, "executor_id")
+            if target == ExecutionTruthState.REGISTERED:
+                updates["registered_at"] = now
+            if target == ExecutionTruthState.CLAIMED:
+                updates["claimed_at"] = now
+                updates["heartbeat_at"] = now
+            if target == ExecutionTruthState.RUNNING:
+                updates["started_at"] = current.started_at or now
+                updates["heartbeat_at"] = now
+            if current_step is not None:
+                if current_step < current.current_step or current_step > len(current.manifest.steps):
+                    connection.rollback()
+                    raise ExecutionTruthConflict("invalid task step progression")
+                updates["current_step"] = current_step
+                updates["heartbeat_at"] = now
+            if evidence is not None:
+                updates["evidence"] = {
+                    **dict(current.evidence),
+                    **{required(key, "evidence key"): required(value, "evidence hash") for key, value in evidence.items()},
+                }
+            if error is not None:
+                updates["error"] = json.loads(json.dumps(dict(error), default=str))
+            if target in TERMINAL_STATES:
+                updates["completed_at"] = now
+            updated = replace(current, **updates)
+            connection.execute(
+                "UPDATE execution_truth SET state = ?, record_json = ?, revision = ?, updated_at = ? WHERE task_id = ?",
+                (
+                    updated.state.value,
+                    self._record_json(updated),
+                    updated.revision,
+                    now,
+                    updated.task_id,
+                ),
+            )
+            self._event(
+                connection,
+                updated.task_id,
+                target.value,
+                {
+                    "executor_run_id": updated.executor_run_id,
+                    "executor_id": updated.executor_id,
+                    "current_step": updated.current_step,
+                },
+            )
+            connection.commit()
+            return updated
+
+    def register(self, task_id: str, *, executor_run_id: str) -> ExecutionTruthRecord:
+        return self._transition(
+            task_id,
+            allowed=(ExecutionTruthState.DECLARED,),
+            target=ExecutionTruthState.REGISTERED,
+            executor_run_id=executor_run_id,
+        )
+
+    def retry_not_started(
+        self,
+        task_id: str,
+        *,
+        executor_run_id: str,
+    ) -> ExecutionTruthRecord:
+        """Start a new audited attempt after the declaration deadline expired."""
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            row = connection.execute(
+                "SELECT record_json FROM execution_truth WHERE task_id = ?",
+                (required(task_id, "task_id"),),
+            ).fetchone()
+            if row is None:
+                connection.rollback()
+                raise KeyError("execution task not declared")
+            current = self._decode(row)
+            if current.state != ExecutionTruthState.NOT_STARTED:
+                connection.rollback()
+                raise ExecutionTruthConflict(
+                    f"cannot retry task from {current.state.value}"
+                )
+            now = utc_now()
+            updated = replace(
+                current,
+                state=ExecutionTruthState.REGISTERED,
+                executor_run_id=required(executor_run_id, "executor_run_id"),
+                executor_id=None,
+                registered_at=now,
+                claimed_at=None,
+                started_at=None,
+                heartbeat_at=None,
+                completed_at=None,
+                current_step=0,
+                evidence={},
+                error={},
+                revision=current.revision + 1,
+            )
+            connection.execute(
+                "UPDATE execution_truth SET state = ?, record_json = ?, revision = ?, updated_at = ? WHERE task_id = ?",
+                (
+                    updated.state.value,
+                    self._record_json(updated),
+                    updated.revision,
+                    now,
+                    updated.task_id,
+                ),
+            )
+            self._event(
+                connection,
+                updated.task_id,
+                "RETRIED",
+                {
+                    "previous_state": current.state.value,
+                    "previous_executor_run_id": current.executor_run_id,
+                    "executor_run_id": updated.executor_run_id,
+                    "previous_error": dict(current.error),
+                },
+            )
+            connection.commit()
+            return updated
+
+    def claim(self, task_id: str, *, executor_run_id: str, executor_id: str) -> ExecutionTruthRecord:
+        return self._transition(
+            task_id,
+            allowed=(ExecutionTruthState.REGISTERED,),
+            target=ExecutionTruthState.CLAIMED,
+            executor_run_id=executor_run_id,
+            executor_id=executor_id,
+        )
+
+    def start(self, task_id: str, *, executor_run_id: str, executor_id: str) -> ExecutionTruthRecord:
+        return self._transition(
+            task_id,
+            allowed=(ExecutionTruthState.CLAIMED,),
+            target=ExecutionTruthState.RUNNING,
+            executor_run_id=executor_run_id,
+            executor_id=executor_id,
+            current_step=1,
+        )
+
+    def heartbeat(
+        self,
+        task_id: str,
+        *,
+        executor_run_id: str,
+        executor_id: str,
+        current_step: int,
+    ) -> ExecutionTruthRecord:
+        return self._transition(
+            task_id,
+            allowed=(ExecutionTruthState.RUNNING,),
+            target=ExecutionTruthState.RUNNING,
+            executor_run_id=executor_run_id,
+            executor_id=executor_id,
+            current_step=current_step,
+        )
+
+    def succeed(
+        self,
+        task_id: str,
+        *,
+        executor_run_id: str,
+        executor_id: str,
+        evidence: Mapping[str, str],
+    ) -> ExecutionTruthRecord:
+        current = self.get(task_id)
+        missing = sorted(set(current.manifest.required_evidence) - set(evidence))
+        if missing:
+            raise ExecutionTruthConflict(f"missing required evidence: {missing}")
+        if current.current_step != len(current.manifest.steps):
+            raise ExecutionTruthConflict("all declared steps must complete before success")
+        return self._transition(
+            task_id,
+            allowed=(ExecutionTruthState.RUNNING,),
+            target=ExecutionTruthState.SUCCEEDED,
+            executor_run_id=executor_run_id,
+            executor_id=executor_id,
+            evidence=evidence,
+        )
+
+    def fail(
+        self,
+        task_id: str,
+        *,
+        executor_run_id: str,
+        executor_id: str,
+        error: Mapping[str, Any],
+        evidence: Mapping[str, str] | None = None,
+    ) -> ExecutionTruthRecord:
+        return self._transition(
+            task_id,
+            allowed=(ExecutionTruthState.REGISTERED, ExecutionTruthState.CLAIMED, ExecutionTruthState.RUNNING),
+            target=ExecutionTruthState.FAILED,
+            executor_run_id=executor_run_id,
+            executor_id=executor_id,
+            evidence=evidence,
+            error=error,
+        )
+
+    def evaluate_deadlines(self, task_id: str, *, now: datetime | None = None) -> ExecutionTruthRecord:
+        current = self.get(task_id)
+        current_time = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+        manifest = current.manifest
+        if current.state in TERMINAL_STATES:
+            return current
+        declared = parse_time(current.declared_at)
+        if current.state in {ExecutionTruthState.DECLARED, ExecutionTruthState.REGISTERED}:
+            if current_time >= declared + timedelta(seconds=manifest.start_deadline_seconds):
+                return self._transition(
+                    task_id,
+                    allowed=(current.state,),
+                    target=ExecutionTruthState.NOT_STARTED,
+                    error={"code": "start_deadline_exceeded"},
+                )
+        if current.state in {ExecutionTruthState.CLAIMED, ExecutionTruthState.RUNNING}:
+            heartbeat = parse_time(current.heartbeat_at or current.claimed_at or current.declared_at)
+            if current_time >= heartbeat + timedelta(seconds=manifest.heartbeat_timeout_seconds):
+                return self._transition(
+                    task_id,
+                    allowed=(current.state,),
+                    target=ExecutionTruthState.STALLED,
+                    error={"code": "heartbeat_timeout"},
+                )
+        return current
+
+    def gate(self, task_id: str) -> Mapping[str, Any]:
+        record = self.evaluate_deadlines(task_id)
+        passed = record.state == ExecutionTruthState.SUCCEEDED
+        return {
+            "task_id": record.task_id,
+            "state": record.state.value,
+            "passed": passed,
+            "release_blocking": not passed,
+            "executor_run_id": record.executor_run_id,
+            "executor_id": record.executor_id,
+            "current_step": record.current_step,
+            "total_steps": len(record.manifest.steps),
+            "evidence": dict(record.evidence),
+            "error": dict(record.error),
+        }
+
+    def events(self, task_id: str) -> list[Mapping[str, Any]]:
+        with self._lock, self._connect() as connection:
+            rows = connection.execute(
+                "SELECT event_id, event_type, details_json, created_at FROM execution_truth_events WHERE task_id = ? ORDER BY created_at, event_id",
+                (required(task_id, "task_id"),),
+            ).fetchall()
+        return [
+            {
+                "event_id": row["event_id"],
+                "event_type": row["event_type"],
+                "details": json.loads(row["details_json"]),
+                "created_at": row["created_at"],
+            }
+            for row in rows
+        ]
@@ -0,0 +1,13 @@
+"""AIOS unified, role-aware web portal."""
+
+from .application import UnifiedPortalApplication, build_application
+from .capabilities import ROLE_CAPABILITIES, allows, require, resolve
+
+__all__ = [
+    "ROLE_CAPABILITIES",
+    "UnifiedPortalApplication",
+    "allows",
+    "build_application",
+    "require",
+    "resolve",
+]
@@ -0,0 +1,512 @@
+"""Unified, role-aware AIOS web application.
+
+The portal wraps the production CandidateApplication instead of replacing its
+runtime/control-plane routes. Portal endpoints aggregate existing authoritative
+stores and require server-side capabilities before delegating any state change.
+"""
+from __future__ import annotations
+
+import dataclasses
+import json
+import os
+import re
+import sqlite3
+import urllib.parse
+from enum import Enum
+from http import HTTPStatus
+from pathlib import Path
+from typing import Any, Mapping
+
+from aios_v2.app import (
+    CandidateApplication,
+    CandidateHTTPServer,
+    build_application as build_candidate_application,
+)
+from aios_v2.control_plane import RequestContext, TaskState
+from aios_v2.gitops_status import collect_gitops_status
+from aios_v2.provenance import SQLiteProvenanceStore
+from aios_v2.provenance_grants import SQLiteGrantStore
+
+from .capabilities import allows, require, resolve
+
+
+def _json_value(value: Any) -> Any:
+    if dataclasses.is_dataclass(value):
+        return {
+            field.name: _json_value(getattr(value, field.name))
+            for field in dataclasses.fields(value)
+        }
+    if isinstance(value, Enum):
+        return value.value
+    if isinstance(value, Mapping):
+        return {str(key): _json_value(item) for key, item in value.items()}
+    if isinstance(value, (list, tuple, set, frozenset)):
+        return [_json_value(item) for item in value]
+    return value
+
+
+def _mapping(value: Any) -> Mapping[str, Any]:
+    if not isinstance(value, Mapping):
+        raise ValueError("JSON body must be an object")
+    return value
+
+
+def _required(value: Any, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+def _safe_count(items: list[Any]) -> int:
+    return len(items)
+
+
+class AuthorizationCatalog:
+    """Tenant-filtered read/revoke access to existing Provenance stores."""
+
+    def __init__(self, store_file: str | Path) -> None:
+        self.store_file = Path(store_file).resolve()
+
+    def _read_connection(self) -> sqlite3.Connection | None:
+        if not self.store_file.exists():
+            return None
+        connection = sqlite3.connect(
+            f"file:{self.store_file}?mode=ro",
+            uri=True,
+            timeout=10.0,
+        )
+        connection.row_factory = sqlite3.Row
+        return connection
+
+    def snapshot(self, *, tenant_id: str) -> Mapping[str, Any]:
+        connection = self._read_connection()
+        if connection is None:
+            return {
+                "configured": False,
+                "workflows": [],
+                "grants": [],
+                "summary": {"workflows": 0, "grants": 0, "active_grants": 0},
+            }
+        try:
+            workflows: list[dict[str, Any]] = []
+            grants: list[dict[str, Any]] = []
+            tables = {
+                row["name"]
+                for row in connection.execute(
+                    "SELECT name FROM sqlite_master WHERE type='table'"
+                ).fetchall()
+            }
+            if "provenance_records" in tables:
+                rows = connection.execute(
+                    """
+                    SELECT r.payload_json, r.status, r.signature_verified,
+                           r.created_at, r.updated_at,
+                           COUNT(u.authorization_id) AS usage_count
+                    FROM provenance_records r
+                    LEFT JOIN provenance_usage u
+                      ON u.provenance_id = r.provenance_id
+                    GROUP BY r.provenance_id
+                    ORDER BY r.updated_at DESC, r.provenance_id
+                    """
+                ).fetchall()
+                for row in rows:
+                    payload = json.loads(row["payload_json"])
+                    if payload.get("tenant_id") != tenant_id:
+                        continue
+                    workflows.append(
+                        {
+                            **payload,
+                            "status": row["status"],
+                            "signature_verified": bool(row["signature_verified"]),
+                            "usage_count": int(row["usage_count"]),
+                            "created_at": row["created_at"],
+                            "updated_at": row["updated_at"],
+                        }
+                    )
+            if "provenance_grants" in tables:
+                rows = connection.execute(
+                    """
+                    SELECT g.payload_json, g.status, g.signature_verified,
+                           g.created_at, g.updated_at,
+                           COUNT(u.authorization_id) AS usage_count
+                    FROM provenance_grants g
+                    LEFT JOIN provenance_grant_usage u
+                      ON u.grant_id = g.grant_id
+                    GROUP BY g.grant_id
+                    ORDER BY g.updated_at DESC, g.grant_id
+                    """
+                ).fetchall()
+                for row in rows:
+                    payload = json.loads(row["payload_json"])
+                    if payload.get("tenant_id") != tenant_id:
+                        continue
+                    grants.append(
+                        {
+                            **payload,
+                            "status": row["status"],
+                            "signature_verified": bool(row["signature_verified"]),
+                            "usage_count": int(row["usage_count"]),
+                            "created_at": row["created_at"],
+                            "updated_at": row["updated_at"],
+                        }
+                    )
+            active = sum(
+                1
+                for item in grants
+                if item.get("status") not in {"revoked", "expired"}
+            )
+            return {
+                "configured": True,
+                "workflows": workflows,
+                "grants": grants,
+                "summary": {
+                    "workflows": len(workflows),
+                    "grants": len(grants),
+                    "active_grants": active,
+                    "revoked_grants": sum(
+                        1 for item in grants if item.get("status") == "revoked"
+                    ),
+                },
+            }
+        finally:
+            connection.close()
+
+    def revoke_workflow(
+        self,
+        *,
+        provenance_id: str,
+        tenant_id: str,
+        principal_id: str,
+        reason: str,
+    ) -> Mapping[str, Any]:
+        store = SQLiteProvenanceStore(self.store_file)
+        try:
+            record = store.get(provenance_id)
+            if record.tenant_id != tenant_id:
+                raise KeyError("workflow provenance not found")
+            store.revoke(
+                record.provenance_id,
+                reason=reason,
+                principal_id=principal_id,
+            )
+            return {
+                "provenance_id": record.provenance_id,
+                "status": store.status(record.provenance_id).value,
+            }
+        finally:
+            store.close()
+
+    def revoke_grant(
+        self,
+        *,
+        grant_id: str,
+        tenant_id: str,
+        principal_id: str,
+        reason: str,
+    ) -> Mapping[str, Any]:
+        store = SQLiteGrantStore(self.store_file)
+        try:
+            grant = store.get(grant_id)
+            if grant.tenant_id != tenant_id:
+                raise KeyError("provenance grant not found")
+            store.revoke(
+                grant.grant_id,
+                reason=reason,
+                principal_id=principal_id,
+            )
+            return {
+                "grant_id": grant.grant_id,
+                "status": store.status(grant.grant_id).value,
+            }
+        finally:
+            store.close()
+
+
+class UnifiedPortalApplication:
+    """Role-aware portal facade over the existing production application."""
+
+    def __init__(
+        self,
+        base: CandidateApplication,
+        *,
+        provenance_store_file: str | Path,
+    ) -> None:
+        self.base = base
+        self.gateway = base.gateway
+        self.orchestrator = base.orchestrator
+        self.tracker = base.tracker
+        self.hermes = base.hermes
+        self.openclaw = base.openclaw
+        self.authorization_catalog = AuthorizationCatalog(provenance_store_file)
+
+    def context(self, headers: Mapping[str, str]) -> RequestContext:
+        return self.base.context(headers)
+
+    def _runtime(self, headers: Mapping[str, str]) -> Mapping[str, Any]:
+        status, payload = self.base.handle_json("GET", "/api/v2/runtime", headers, {})
+        if int(status) != HTTPStatus.OK:
+            raise RuntimeError("runtime status is unavailable")
+        return payload
+
+    def _gitops(self, context: RequestContext) -> Mapping[str, Any]:
+        return {
+            "tenant_id": context.tenant_id,
+            "gitops": collect_gitops_status().as_dict(),
+        }
+
+    def _tasks_view(self, context: RequestContext) -> list[Mapping[str, Any]]:
+        service = self.orchestrator.control_plane
+        tasks = service.list_tasks(context)
+        dispatches = {
+            item.task_id: item
+            for item in self.orchestrator.dispatch_repository.list(
+                tenant_id=context.tenant_id
+            )
+        }
+        evidence_by_task: dict[str, list[Any]] = {}
+        for evidence in self.tracker.list(tenant_id=context.tenant_id):
+            evidence_by_task.setdefault(evidence.task_id, []).append(evidence)
+        audit_by_task: dict[str, list[Any]] = {}
+        for event in service.list_audit_events(context):
+            if event.resource_type == "task":
+                audit_by_task.setdefault(event.resource_id, []).append(event)
+        capabilities = set(resolve(context).capabilities)
+        result: list[Mapping[str, Any]] = []
+        for task in tasks:
+            actions: list[str] = []
+            if task.state == TaskState.CREATED and "task.approve" in capabilities:
+                actions.append("approve")
+            if task.state in {TaskState.CREATED, TaskState.APPROVED, TaskState.RUNNING} and "task.cancel" in capabilities:
+                actions.append("cancel")
+            if task.state == TaskState.APPROVED and "task.dispatch" in capabilities:
+                actions.append("dispatch")
+            result.append(
+                {
+                    "task": _json_value(task),
+                    "dispatch": _json_value(dispatches.get(task.task_id)),
+                    "evidence": _json_value(evidence_by_task.get(task.task_id, [])),
+                    "audit": _json_value(audit_by_task.get(task.task_id, [])[-12:]),
+                    "available_actions": actions,
+                }
+            )
+        return result
+
+    def _overview(
+        self,
+        context: RequestContext,
+        headers: Mapping[str, str],
+    ) -> Mapping[str, Any]:
+        service = self.orchestrator.control_plane
+        capabilities = resolve(context)
+        sections: dict[str, Any] = {}
+        tasks = service.list_tasks(context) if allows(context, "task.read") else []
+        dispatches = (
+            self.orchestrator.dispatch_repository.list(tenant_id=context.tenant_id)
+            if allows(context, "dispatch.read")
+            else []
+        )
+        evidence = (
+            self.tracker.list(tenant_id=context.tenant_id)
+            if allows(context, "evidence.read")
+            else []
+        )
+        audit = (
+            service.list_audit_events(context)
+            if allows(context, "audit.read")
+            else []
+        )
+        if allows(context, "runtime.read"):
+            sections["runtime"] = self._runtime(headers)
+        if allows(context, "release.read"):
+            sections["release"] = {
+                **self._gitops(context),
+                "version": os.getenv("AIOS_RELEASE_VERSION", "V2R1C1"),
+                "release_oid": os.getenv("AIOS_RELEASE_OID", "unknown"),
+                "baseline": os.getenv("AIOS_BASELINE_VERSION", "V2R1C1"),
+                "status": os.getenv("AIOS_RELEASE_STATUS", "PRODUCTION_DEPLOYED"),
+            }
+        if allows(context, "provenance.read"):
+            sections["authorization"] = self.authorization_catalog.snapshot(
+                tenant_id=context.tenant_id
+            )["summary"]
+        task_states: dict[str, int] = {}
+        for task in tasks:
+            task_states[task.state.value] = task_states.get(task.state.value, 0) + 1
+        return {
+            "identity": capabilities.as_dict(),
+            "summary": {
+                "tasks": _safe_count(tasks),
+                "task_states": task_states,
+                "dispatches": _safe_count(dispatches),
+                "active_dispatches": sum(
+                    1
+                    for item in dispatches
+                    if item.state.value not in {"COMPLETED", "FAILED", "CANCELLED"}
+                ),
+                "evidence": _safe_count(evidence),
+                "audit_events": _safe_count(audit),
+            },
+            "sections": sections,
+            "recent": {
+                "tasks": _json_value(tasks[:8]),
+                "dispatches": _json_value(dispatches[-8:]),
+                "audit": _json_value(audit[-12:]),
+            },
+        }
+
+    def handle_json(
+        self,
+        method: str,
+        raw_path: str,
+        headers: Mapping[str, str],
+        body: Any,
+    ) -> tuple[int, Mapping[str, Any]]:
+        parsed = urllib.parse.urlparse(raw_path)
+        path = parsed.path.rstrip("/") or "/"
+        method = method.upper()
+
+        if not path.startswith("/api/v2/portal") and path != "/api/v2/me/capabilities":
+            return self.base.handle_json(method, raw_path, headers, body)
+
+        context = self.context(headers)
+        payload = _mapping(body or {})
+
+        if method == "GET" and path == "/api/v2/me/capabilities":
+            require(context, "portal.access")
+            return HTTPStatus.OK, resolve(context).as_dict()
+
+        if method == "GET" and path == "/api/v2/portal/overview":
+            require(context, "dashboard.read")
+            return HTTPStatus.OK, self._overview(context, headers)
+
+        if method == "GET" and path == "/api/v2/portal/tasks":
+            require(context, "task.read")
+            return HTTPStatus.OK, {"items": self._tasks_view(context)}
+
+        if method == "GET" and path == "/api/v2/portal/authorizations":
+            require(context, "provenance.read")
+            return HTTPStatus.OK, self.authorization_catalog.snapshot(
+                tenant_id=context.tenant_id
+            )
+
+        if method == "GET" and path == "/api/v2/portal/runtime":
+            require(context, "runtime.read")
+            return HTTPStatus.OK, {
+                **self._runtime(headers),
+                "dispatches": _json_value(
+                    self.orchestrator.dispatch_repository.list(
+                        tenant_id=context.tenant_id
+                    )
+                ),
+                "hermes_jobs": _json_value(
+                    self.hermes.list(tenant_id=context.tenant_id)
+                ),
+            }
+
+        if method == "GET" and path == "/api/v2/portal/evidence":
+            require(context, "evidence.read")
+            return HTTPStatus.OK, {
+                "executions": _json_value(
+                    self.tracker.list(tenant_id=context.tenant_id)
+                )
+            }
+
+        if method == "GET" and path == "/api/v2/portal/audit":
+            require(context, "audit.read")
+            return HTTPStatus.OK, {
+                "events": _json_value(
+                    self.orchestrator.control_plane.list_audit_events(context)
+                )
+            }
+
+        if method == "GET" and path == "/api/v2/portal/release":
+            require(context, "release.read")
+            return HTTPStatus.OK, {
+                **self._gitops(context),
+                "version": os.getenv("AIOS_RELEASE_VERSION", "V2R1C1"),
+                "release_oid": os.getenv("AIOS_RELEASE_OID", "unknown"),
+                "baseline": os.getenv("AIOS_BASELINE_VERSION", "V2R1C1"),
+                "status": os.getenv("AIOS_RELEASE_STATUS", "PRODUCTION_DEPLOYED"),
+                "operations": (
+                    ["review_release", "request_tag", "request_rollback"]
+                    if allows(context, "release.operate")
+                    else []
+                ),
+                "note": "Release operations remain GitOps approval requests; the portal does not mutate tags or production directly.",
+            }
+
+        if method == "POST" and path == "/api/v2/portal/tasks":
+            require(context, "task.create")
+            return self.base.handle_json("POST", "/api/v2/tasks", headers, payload)
+
+        task_action = re.fullmatch(
+            r"/api/v2/portal/tasks/([^/]+)/(approve|cancel|dispatch)", path
+        )
+        if method == "POST" and task_action:
+            action = task_action.group(2)
+            require(context, f"task.{action}")
+            task_id = urllib.parse.unquote(task_action.group(1))
+            target = (
+                f"/api/v2/tasks/{task_id}/dispatch"
+                if action == "dispatch"
+                else f"/api/v2/tasks/{task_id}/{action}"
+            )
+            return self.base.handle_json("POST", target, headers, payload)
+
+        workflow_revoke = re.fullmatch(
+            r"/api/v2/portal/provenance/([^/]+)/revoke", path
+        )
+        if method == "POST" and workflow_revoke:
+            require(context, "provenance.revoke")
+            reason = _required(payload.get("reason"), "reason")
+            result = self.authorization_catalog.revoke_workflow(
+                provenance_id=urllib.parse.unquote(workflow_revoke.group(1)),
+                tenant_id=context.tenant_id,
+                principal_id=context.principal_id,
+                reason=reason,
+            )
+            return HTTPStatus.OK, {"workflow": result}
+
+        grant_revoke = re.fullmatch(r"/api/v2/portal/grants/([^/]+)/revoke", path)
+        if method == "POST" and grant_revoke:
+            require(context, "provenance.revoke")
+            reason = _required(payload.get("reason"), "reason")
+            result = self.authorization_catalog.revoke_grant(
+                grant_id=urllib.parse.unquote(grant_revoke.group(1)),
+                tenant_id=context.tenant_id,
+                principal_id=context.principal_id,
+                reason=reason,
+            )
+            return HTTPStatus.OK, {"grant": result}
+
+        return HTTPStatus.NOT_FOUND, {
+            "error": "not_found",
+            "message": "portal route not found",
+        }
+
+
+def build_application() -> UnifiedPortalApplication:
+    state_dir = Path(os.getenv("AIOS_V2_STATE_DIR", "/var/lib/aios-v2")).resolve()
+    provenance_file = Path(
+        os.getenv(
+            "AIOS_PROVENANCE_STORE_FILE",
+            str(state_dir / "run-provenance.sqlite3"),
+        )
+    )
+    return UnifiedPortalApplication(
+        build_candidate_application(),
+        provenance_store_file=provenance_file,
+    )
+
+
+def main() -> None:
+    host = os.getenv("AIOS_V2_HOST", "127.0.0.1")
+    port = int(os.getenv("AIOS_V2_PORT", "18920"))
+    server = CandidateHTTPServer((host, port), build_application())
+    print(f"AIOS V2 unified portal listening on {host}:{port}")
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,111 @@
+"""Server-side role and capability resolution for the unified AIOS portal."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Mapping, Sequence
+
+from aios_v2.control_plane import RequestContext, Unauthorized
+
+
+ROLE_CAPABILITIES: Mapping[str, frozenset[str]] = {
+    "platform_admin": frozenset({
+        "portal.access", "dashboard.read", "tenant.read", "tenant.manage",
+        "agent.read", "agent.manage", "task.read", "task.create", "task.approve",
+        "task.cancel", "task.dispatch", "policy.read", "audit.read", "evidence.read",
+        "runtime.read", "runtime.operate", "dispatch.read", "provenance.read",
+        "provenance.revoke", "external_task.read", "gitops.read", "release.read",
+        "release.operate", "worktree.read", "system.admin",
+    }),
+    "tenant_admin": frozenset({
+        "portal.access", "dashboard.read", "tenant.read", "agent.read", "agent.manage",
+        "task.read", "task.create", "task.approve", "task.cancel", "task.dispatch",
+        "policy.read", "audit.read", "evidence.read", "runtime.read", "dispatch.read",
+        "provenance.read", "provenance.revoke", "external_task.read", "gitops.read",
+        "release.read",
+    }),
+    "operator": frozenset({
+        "portal.access", "dashboard.read", "tenant.read", "agent.read", "task.read",
+        "task.create", "task.cancel", "task.dispatch", "runtime.read", "dispatch.read",
+        "evidence.read", "provenance.read", "external_task.read", "gitops.read",
+        "release.read",
+    }),
+    "approver": frozenset({
+        "portal.access", "dashboard.read", "tenant.read", "task.read", "task.approve",
+        "task.cancel", "policy.read", "audit.read", "provenance.read", "evidence.read",
+        "external_task.read", "release.read",
+    }),
+    "auditor": frozenset({
+        "portal.access", "dashboard.read", "tenant.read", "agent.read", "task.read",
+        "audit.read", "evidence.read", "runtime.read", "dispatch.read",
+        "provenance.read", "external_task.read", "gitops.read", "release.read",
+        "worktree.read",
+    }),
+    "runtime": frozenset({
+        "portal.access", "dashboard.read", "task.read", "runtime.read", "runtime.operate",
+        "dispatch.read", "evidence.read", "provenance.read", "external_task.read",
+    }),
+    "release_manager": frozenset({
+        "portal.access", "dashboard.read", "audit.read", "runtime.read", "dispatch.read",
+        "provenance.read", "external_task.read", "gitops.read", "release.read",
+        "release.operate", "worktree.read",
+    }),
+    "viewer": frozenset({
+        "portal.access", "dashboard.read", "task.read", "runtime.read",
+        "external_task.read",
+    }),
+}
+
+
+NAVIGATION: Sequence[Mapping[str, str]] = (
+    {"id": "overview", "label": "总览", "capability": "dashboard.read"},
+    {"id": "resources", "label": "租户与 Agent", "capability": "tenant.read"},
+    {"id": "tasks", "label": "任务中心", "capability": "task.read"},
+    {"id": "execution", "label": "执行中心", "capability": "external_task.read"},
+    {"id": "authorization", "label": "授权中心", "capability": "provenance.read"},
+    {"id": "runtime", "label": "运行与运维", "capability": "runtime.read"},
+    {"id": "evidence", "label": "执行证据", "capability": "evidence.read"},
+    {"id": "audit", "label": "审计中心", "capability": "audit.read"},
+    {"id": "release", "label": "GitOps 与发布", "capability": "release.read"},
+)
+
+
+@dataclass(frozen=True)
+class ResolvedCapabilities:
+    tenant_id: str
+    principal_id: str
+    roles: tuple[str, ...]
+    capabilities: tuple[str, ...]
+    navigation: tuple[Mapping[str, str], ...]
+
+    def as_dict(self) -> dict[str, object]:
+        return {
+            "tenant_id": self.tenant_id,
+            "principal_id": self.principal_id,
+            "roles": list(self.roles),
+            "capabilities": list(self.capabilities),
+            "navigation": [dict(item) for item in self.navigation],
+        }
+
+
+def resolve(context: RequestContext) -> ResolvedCapabilities:
+    capabilities: set[str] = set()
+    for role in context.roles:
+        capabilities.update(ROLE_CAPABILITIES.get(role, ()))
+    ordered = tuple(sorted(capabilities))
+    navigation = tuple(item for item in NAVIGATION if item["capability"] in capabilities)
+    return ResolvedCapabilities(
+        tenant_id=context.tenant_id,
+        principal_id=context.principal_id,
+        roles=tuple(sorted(context.roles)),
+        capabilities=ordered,
+        navigation=navigation,
+    )
+
+
+def require(context: RequestContext, capability: str) -> None:
+    if capability not in resolve(context).capabilities:
+        raise Unauthorized(f"portal capability is required: {capability}")
+
+
+def allows(context: RequestContext, capability: str) -> bool:
+    return capability in resolve(context).capabilities
@@ -0,0 +1,48 @@
+"""Unified portal HTML export with V2R1C2 resource and execution centers.
+
+The canonical dependency-free portal remains in ``aios_v2.console``. This
+module applies deterministic, fail-fast extensions at import time so the
+V2R1C1 production entrypoint remains unchanged while the V2R1C2 candidate gets
+resource and portable-executor views.
+"""
+from __future__ import annotations
+
+from aios_v2.console import CONSOLE_HTML as _BASE_PORTAL_HTML
+
+
+def _extend_portal(source: str) -> str:
+    replacements = (
+        (
+            '<section id="overview" class="view active"></section>\n      <section id="tasks" class="view"></section>\n      <section id="authorization" class="view"></section>',
+            '<section id="overview" class="view active"></section>\n      <section id="resources" class="view"></section>\n      <section id="tasks" class="view"></section>\n      <section id="execution" class="view"></section>\n      <section id="authorization" class="view"></section>',
+        ),
+        (
+            "const labels={overview:'系统总览',tasks:'任务中心',authorization:'授权中心'",
+            "const labels={overview:'系统总览',resources:'租户与 Agent',tasks:'任务中心',execution:'执行中心',authorization:'授权中心'",
+        ),
+        (
+            "if(view==='overview')await overview();if(view==='tasks')await tasks();if(view==='authorization')await authorizations();",
+            "if(view==='overview')await overview();if(view==='resources')await resources();if(view==='tasks')await tasks();if(view==='execution')await execution();if(view==='authorization')await authorizations();",
+        ),
+        (
+            "async function tasks(){const d=await api('/api/v2/portal/tasks');",
+            """async function resources(){const d=await api('/api/v2/portal/resources');const t=d.tenant||{},agents=d.agents||[],ops=d.operations||{};const agentButton=ops.agent_create?'<button class=\"btn\" id=\"newAgent\">注册 Agent</button>':'';$('#resources').innerHTML=`<div class=\"cards\">${card('租户',t.tenant_id||'—',t.status||'')}${card('Agent',d.summary?.agents||0,`启用 ${d.summary?.enabled_agents||0}`)}${card('任务',d.summary?.tasks||0)}${card('Runtime 类型',(d.summary?.runtimes||[]).length,(d.summary?.runtimes||[]).join(', '))}</div><div class=\"grid\"><div class=\"panel\"><div class=\"panel-head\"><h2>当前租户</h2></div><div class=\"kv\"><div>Tenant ID</div><div>${esc(t.tenant_id||'—')}</div><div>名称</div><div>${esc(t.display_name||'—')}</div><div>状态</div><div>${pill(t.status||'unknown')}</div><div>创建时间</div><div>${esc(t.created_at||'—')}</div><div>更新时间</div><div>${esc(t.updated_at||'—')}</div></div></div><div class=\"panel\"><div class=\"panel-head\"><h2>Agent Registry</h2><div>${agentButton}</div></div>${table([['Agent',x=>esc(x.agent_id)],['名称',x=>esc(x.display_name)],['Runtime',x=>pill(x.runtime)],['能力',x=>(x.capabilities||[]).map(pill).join('')],['启用',x=>pill(x.enabled?'enabled':'disabled')],['任务数',x=>esc(x.task_count)]],agents)}</div></div>`;$('#newAgent')?.addEventListener('click',()=>{const agent_id=prompt('Agent ID');const display_name=prompt('显示名称',agent_id||'');const runtime=prompt('Runtime Provider','openclaw');const capabilities=prompt('能力，逗号分隔','');if(!agent_id||!display_name||!runtime)return;api('/api/v2/portal/agents',{method:'POST',body:JSON.stringify({agent_id,display_name,runtime,capabilities:String(capabilities||'').split(',').map(x=>x.trim()).filter(Boolean),metadata:{source:'unified-portal'}})}).then(resources).catch(err)})}
+function executionStage(x){const s=x.stage||{},status=x.truth||{},record=status.record||{},gate=status.gate||{},d=x.dependency_gate||{},notifications=gate.notifications||[],evidence=record.evidence||{};const stateName=record.state||'WAITING_DEPENDENCY';const deps=(s.depends_on||[]).join(', ')||'根阶段';return `<div class=\"panel\" style=\"background:#fbfcfe\"><div class=\"panel-head\"><h2>${esc(s.stage_id)} · ${esc(s.role)}</h2><div>${pill(stateName)} ${pill(s.executor_type)}</div></div><div class=\"chain\"><div class=\"chain-item\"><b>Provider</b><div>${esc(s.executor_type)}</div><small>${esc(deps)}</small></div><span class=\"chain-arrow\">→</span><div class=\"chain-item\"><b>Run</b><div>${esc(record.executor_run_id||'未注册')}</div><small>${esc(record.executor_id||'')}</small></div><span class=\"chain-arrow\">→</span><div class=\"chain-item\"><b>Progress</b><div>${esc(record.current_step||0)}/${esc((record.manifest?.steps||s.steps||[]).length)}</div><small>${esc(record.heartbeat_at||'无心跳')}</small></div><span class=\"chain-arrow\">→</span><div class=\"chain-item\"><b>Evidence</b><div>${Object.keys(evidence).length} 项</div><small>${Object.keys(evidence).slice(0,2).map(esc).join(', ')}</small></div><span class=\"chain-arrow\">→</span><div class=\"chain-item\"><b>Notification</b><div>${notifications.length} 条</div><small>${notifications.map(n=>n.status).join(', ')||'无'}</small></div><span class=\"chain-arrow\">→</span><div class=\"chain-item\"><b>Gate</b><div>${pill(gate.passed?'PASS':'BLOCKED')}</div><small>${d.passed?'依赖满足':'等待依赖'}</small></div></div>${Object.keys(record.error||{}).length?json(record.error):''}</div>`}
+async function execution(){const d=await api('/api/v2/portal/execution');const providers=d.providers||[],plans=d.plans||[];$('#execution').innerHTML=`<div class=\"cards\">${card('Provider',providers.length)}${card('Execution Plan',plans.length)}${card('协议',d.protocol_version||'—')}${card('Plan Schema',d.plan_schema_version||'—')}</div><div class=\"panel\"><div class=\"panel-head\"><h2>Executor Provider Catalog</h2></div>${table([['Provider',x=>esc(x.executor_type)],['Adapter',x=>esc(x.adapter_version)],['协议',x=>esc(x.protocol_version)],['Trust Roles',x=>(x.trust_roles||[]).map(pill).join('')],['Capabilities',x=>(x.capabilities||[]).map(pill).join('')]],providers)}</div>${plans.map(p=>`<div class=\"panel\"><div class=\"panel-head\"><h2>${esc(p.plan_id)} · ${esc(p.target_version)}</h2><div>${pill(p.gate?.passed?'PASS':'BLOCKED')}</div></div><div class=\"kv\"><div>Source Branch</div><div>${esc(p.source_branch)}</div><div>Source OID</div><div>${esc(p.source_oid)}</div><div>Release Gate</div><div>${pill(p.gate?.passed?'PASS':'BLOCKED')}</div></div></div>${(p.snapshot?.stages||[]).map(executionStage).join('')}`).join('')||'<div class=\"empty\">尚未声明执行计划</div>'}`}
+async function tasks(){const d=await api('/api/v2/portal/tasks');""",
+        ),
+    )
+    result = source
+    for old, new in replacements:
+        if old not in result:
+            raise RuntimeError(f"unified portal extension anchor not found: {old[:100]}")
+        result = result.replace(old, new, 1)
+    return result
+
+
+PORTAL_HTML = _extend_portal(_BASE_PORTAL_HTML)
+
+if "\n+function executionStage" in PORTAL_HTML or "\n+async function execution" in PORTAL_HTML:
+    raise RuntimeError("execution center contains an invalid diff marker")
+
+__all__ = ["PORTAL_HTML"]
@@ -0,0 +1,130 @@
+"""HTTP facade for portable multi-provider execution plans."""
+from __future__ import annotations
+
+import urllib.parse
+from http import HTTPStatus
+from typing import Any, Mapping
+
+from aios_v2.control_plane import RequestContext, Unauthorized
+from aios_v2.execution_plan import ExecutionPlanCoordinator
+from aios_v2.executor_protocol import ExecutorProviderRegistry, normalize_executor
+
+from .capabilities import require
+
+
+class ExecutionPlanAPI:
+    """Portal read model and provider-authenticated plan discovery API."""
+
+    INTERNAL_PREFIX = "/api/v2/internal/execution-plans"
+    PORTAL_PATH = "/api/v2/portal/execution"
+
+    def __init__(
+        self,
+        coordinator: ExecutionPlanCoordinator,
+        *,
+        providers: ExecutorProviderRegistry,
+    ) -> None:
+        self.coordinator = coordinator
+        self.providers = providers
+
+    @classmethod
+    def is_route(cls, raw_path: str) -> bool:
+        path = urllib.parse.urlparse(raw_path).path.rstrip("/") or "/"
+        return path == cls.PORTAL_PATH or path.startswith(cls.INTERNAL_PREFIX)
+
+    def _require_provider(
+        self,
+        context: RequestContext,
+        executor_type: str,
+    ) -> str:
+        normalized = normalize_executor(executor_type)
+        if not self.providers.trusted(
+            executor_type=normalized,
+            roles=tuple(context.roles),
+            platform_admin="platform_admin" in context.roles,
+        ):
+            raise Unauthorized(
+                f"trusted role for executor Provider is required: {normalized}"
+            )
+        return normalized
+
+    def _portal_snapshot(self) -> Mapping[str, Any]:
+        plans = []
+        for plan in self.coordinator.plan_store.list():
+            plans.append(
+                {
+                    "plan_id": plan.plan_id,
+                    "target_version": plan.target_version,
+                    "source_branch": plan.source_branch,
+                    "source_oid": plan.source_oid,
+                    "snapshot": self.coordinator.snapshot(plan.plan_id),
+                    "gate": self.coordinator.gate(plan.plan_id),
+                }
+            )
+        return {
+            "protocol_version": "aios.executor.v1",
+            "plan_schema_version": "aios.execution-plan.v2",
+            "providers": [
+                item.as_dict() for item in self.providers.list_descriptors()
+            ],
+            "plans": plans,
+        }
+
+    def handle(
+        self,
+        method: str,
+        raw_path: str,
+        context: RequestContext,
+        body: Any,
+    ) -> tuple[int, Mapping[str, Any]]:
+        del body
+        parsed = urllib.parse.urlparse(raw_path)
+        path = parsed.path.rstrip("/") or "/"
+        method = method.upper()
+
+        if method == "GET" and path == self.PORTAL_PATH:
+            require(context, "external_task.read")
+            return HTTPStatus.OK, self._portal_snapshot()
+
+        if not path.startswith(f"{self.INTERNAL_PREFIX}/"):
+            return HTTPStatus.NOT_FOUND, {
+                "error": "not_found",
+                "message": "execution plan route not found",
+            }
+
+        remainder = urllib.parse.unquote(path[len(self.INTERNAL_PREFIX) + 1 :])
+        parts = tuple(item for item in remainder.split("/") if item)
+        if len(parts) != 2:
+            return HTTPStatus.NOT_FOUND, {
+                "error": "not_found",
+                "message": "execution plan route not found",
+            }
+        plan_id, action = parts
+        query = urllib.parse.parse_qs(parsed.query)
+        executor_type = self._require_provider(
+            context,
+            str(query.get("executor", [""])[0]),
+        )
+
+        if method == "GET" and action == "discover":
+            items = self.coordinator.discover_ready(
+                plan_id=plan_id,
+                executor_type=executor_type,
+            )
+            return HTTPStatus.OK, {
+                "plan_id": plan_id,
+                "executor_type": executor_type,
+                "count": len(items),
+                "items": items,
+            }
+
+        if method == "GET" and action == "snapshot":
+            return HTTPStatus.OK, self.coordinator.snapshot(plan_id)
+
+        if method == "GET" and action == "gate":
+            return HTTPStatus.OK, self.coordinator.gate(plan_id)
+
+        return HTTPStatus.NOT_FOUND, {
+            "error": "not_found",
+            "message": "execution plan route not found",
+        }
@@ -0,0 +1,276 @@
+"""Protected HTTP facade for portable executor truth and notification receipts."""
+from __future__ import annotations
+
+import urllib.parse
+from http import HTTPStatus
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from aios_v2.control_plane import RequestContext, Unauthorized
+from aios_v2.executor_protocol import ExecutorProviderRegistry, normalize_executor
+from aios_v2.external_task_control import ExternalTaskCoordinator
+from aios_v2.external_task_query import list_records
+from aios_v2.task_execution_registry import ExecutionTruthState
+
+from .capabilities import require
+
+
+def _body(value: Any) -> Mapping[str, Any]:
+    if not isinstance(value, Mapping):
+        raise ValueError("JSON body must be an object")
+    return value
+
+
+def _required(value: Any, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+def _mapping_strings(value: Any, label: str) -> dict[str, str]:
+    if not isinstance(value, Mapping):
+        raise ValueError(f"{label} must be an object")
+    return {
+        _required(key, f"{label} key"): _required(item, f"{label}[{key}]")
+        for key, item in value.items()
+    }
+
+
+class ExternalTaskAPI:
+    """Fail-closed external task API shared by every registered Provider."""
+
+    INTERNAL_PREFIX = "/api/v2/internal/external-tasks"
+
+    def __init__(
+        self,
+        coordinator: ExternalTaskCoordinator,
+        *,
+        store_file: str | Path,
+        providers: ExecutorProviderRegistry,
+    ) -> None:
+        self.coordinator = coordinator
+        self.store_file = Path(store_file).resolve()
+        self.providers = providers
+
+    @staticmethod
+    def is_route(path: str) -> bool:
+        normalized = path.rstrip("/") or "/"
+        return normalized.startswith(ExternalTaskAPI.INTERNAL_PREFIX) or normalized == "/api/v2/portal/external-tasks"
+
+    def _require_executor(self, context: RequestContext, executor_type: str) -> str:
+        normalized = normalize_executor(executor_type)
+        if not self.providers.trusted(
+            executor_type=normalized,
+            roles=tuple(context.roles),
+            platform_admin="platform_admin" in context.roles,
+        ):
+            raise Unauthorized(
+                f"trusted role for executor Provider is required: {normalized}"
+            )
+        return normalized
+
+    def _task_executor(self, task_id: str) -> str:
+        return normalize_executor(
+            self.coordinator.registry.get(task_id).manifest.executor
+        )
+
+    @staticmethod
+    def _executor_identity(
+        context: RequestContext,
+        payload: Mapping[str, Any],
+    ) -> str:
+        executor_id = _required(payload.get("executor_id"), "executor_id")
+        if executor_id != context.principal_id and "platform_admin" not in context.roles:
+            raise Unauthorized("executor_id must match trusted principal")
+        return executor_id
+
+    def declare_directory(self, directory: str | Path) -> list[Mapping[str, Any]]:
+        root = Path(directory).resolve()
+        if not root.exists():
+            return []
+        declared: list[Mapping[str, Any]] = []
+        for manifest in sorted(root.glob("*.json")):
+            record = self.coordinator.declare_file(manifest)
+            self.providers.validate_manifest(record.manifest)
+            declared.append(
+                {
+                    "manifest": str(manifest),
+                    "task_id": record.task_id,
+                    "executor_type": record.manifest.executor,
+                    "state": record.state.value,
+                }
+            )
+        return declared
+
+    def handle(
+        self,
+        method: str,
+        raw_path: str,
+        context: RequestContext,
+        body: Any,
+    ) -> tuple[int, Mapping[str, Any]]:
+        parsed = urllib.parse.urlparse(raw_path)
+        path = parsed.path.rstrip("/") or "/"
+        method = method.upper()
+        payload = _body(body or {})
+
+        if method == "GET" and path == "/api/v2/portal/external-tasks":
+            require(context, "external_task.read")
+            records = list_records(self.store_file)
+            return HTTPStatus.OK, {
+                "count": len(records),
+                "items": [self.coordinator.status(item.task_id) for item in records],
+            }
+
+        if method == "GET" and path == f"{self.INTERNAL_PREFIX}/discover":
+            query = urllib.parse.parse_qs(parsed.query)
+            states = tuple(query.get("state", ()))
+            executor = self._require_executor(
+                context,
+                str(query.get("executor", [""])[0]),
+            )
+            records = list_records(
+                self.store_file,
+                executor=executor,
+                states=states,
+            )
+            return HTTPStatus.OK, {
+                "count": len(records),
+                "executor_type": executor,
+                "items": [item.as_dict() for item in records],
+            }
+
+        if method == "GET" and path == f"{self.INTERNAL_PREFIX}/notifications":
+            query = urllib.parse.parse_qs(parsed.query)
+            executor = self._require_executor(
+                context,
+                str(query.get("executor", [""])[0]),
+            )
+            task_id = query.get("task_id", [None])[0]
+            status = query.get("status", [None])[0]
+            items = self.coordinator.notifications.list(
+                task_id=task_id,
+                status=status,
+            )
+            filtered = [
+                item
+                for item in items
+                if self._task_executor(item.task_id) == executor
+            ]
+            return HTTPStatus.OK, {
+                "count": len(filtered),
+                "executor_type": executor,
+                "items": [item.as_dict() for item in filtered],
+            }
+
+        notification_ack = self._match(
+            path,
+            f"{self.INTERNAL_PREFIX}/notifications/",
+            "/ack",
+        )
+        if method == "POST" and notification_ack:
+            notification = self.coordinator.notifications.get(notification_ack)
+            executor = self._task_executor(notification.task_id)
+            self._require_executor(context, executor)
+            self._executor_identity(context, payload)
+            record = self.coordinator.notifications.acknowledge(
+                notification_ack,
+                receipt_sha256=_required(
+                    payload.get("receipt_sha256"),
+                    "receipt_sha256",
+                ),
+            )
+            return HTTPStatus.OK, {"notification": record.as_dict()}
+
+        truth_task = self._match(path, f"{self.INTERNAL_PREFIX}/", "/truth")
+        if method == "GET" and truth_task:
+            self._require_executor(context, self._task_executor(truth_task))
+            return HTTPStatus.OK, self.coordinator.status(truth_task)
+
+        for action in ("register", "retry", "claim", "start", "heartbeat", "succeed", "fail"):
+            task_id = self._match(path, f"{self.INTERNAL_PREFIX}/", f"/{action}")
+            if method != "POST" or not task_id:
+                continue
+            executor_type = self._task_executor(task_id)
+            self._require_executor(context, executor_type)
+            run_id = _required(payload.get("executor_run_id"), "executor_run_id")
+            if action == "register":
+                return HTTPStatus.OK, {
+                    "record": self.coordinator.register(
+                        task_id,
+                        executor_run_id=run_id,
+                    ).as_dict()
+                }
+            if action == "retry":
+                return HTTPStatus.OK, {
+                    "record": self.coordinator.retry_not_started(
+                        task_id,
+                        executor_run_id=run_id,
+                    ).as_dict()
+                }
+            executor_id = self._executor_identity(context, payload)
+            if action == "claim":
+                record = self.coordinator.claim(
+                    task_id,
+                    executor_run_id=run_id,
+                    executor_id=executor_id,
+                )
+            elif action == "start":
+                record = self.coordinator.start(
+                    task_id,
+                    executor_run_id=run_id,
+                    executor_id=executor_id,
+                )
+            elif action == "heartbeat":
+                record = self.coordinator.heartbeat(
+                    task_id,
+                    executor_run_id=run_id,
+                    executor_id=executor_id,
+                    current_step=int(payload.get("current_step")),
+                )
+            elif action == "succeed":
+                record = self.coordinator.succeed(
+                    task_id,
+                    executor_run_id=run_id,
+                    executor_id=executor_id,
+                    evidence=_mapping_strings(payload.get("evidence"), "evidence"),
+                )
+            else:
+                error = payload.get("error")
+                if not isinstance(error, Mapping):
+                    raise ValueError("error must be an object")
+                evidence_value = payload.get("evidence")
+                evidence = (
+                    _mapping_strings(evidence_value, "evidence")
+                    if evidence_value is not None
+                    else None
+                )
+                record = self.coordinator.fail(
+                    task_id,
+                    executor_run_id=run_id,
+                    executor_id=executor_id,
+                    error=dict(error),
+                    evidence=evidence,
+                )
+            return HTTPStatus.OK, {"record": record.as_dict()}
+
+        return HTTPStatus.NOT_FOUND, {
+            "error": "not_found",
+            "message": "external task route not found",
+        }
+
+    @staticmethod
+    def _match(path: str, prefix: str, suffix: str) -> str | None:
+        if not path.startswith(prefix) or not path.endswith(suffix):
+            return None
+        middle = path[len(prefix) : len(path) - len(suffix)]
+        if not middle or "/" in middle:
+            return None
+        return urllib.parse.unquote(middle)
+
+
+DISCOVERABLE_STATES: Sequence[str] = (
+    ExecutionTruthState.DECLARED.value,
+    ExecutionTruthState.REGISTERED.value,
+)
@@ -0,0 +1,376 @@
+"""V2R1C2 unified portal and portable executor release entrypoint.
+
+The V2R1C1 production entrypoint remains unchanged. This candidate entrypoint
+uses an isolated state directory, loads a versioned executor catalog, declares
+portable multi-provider execution plans and exposes both portal read models and
+provider-authenticated lifecycle APIs.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import urllib.parse
+from dataclasses import replace
+from http import HTTPStatus
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+import aios_v2.app as candidate_app_module
+from aios_v2.app import (
+    CandidateApplication,
+    CandidateHTTPServer,
+    build_application as build_candidate_application,
+)
+from aios_v2.control_plane import RequestContext
+from aios_v2.execution_plan import ExecutionPlanCoordinator, ExecutionPlanManifest
+from aios_v2.executor_catalog import FileExecutorCatalogStore
+from aios_v2.official_executor_providers import official_provider_factories
+
+from .application import UnifiedPortalApplication, _json_value, _mapping
+from .capabilities import allows, require
+from .console import PORTAL_HTML
+from .execution_plan_api import ExecutionPlanAPI
+from .external_task_api import ExternalTaskAPI
+
+
+_READ_BRIDGE_ROLES = frozenset({"approver", "runtime", "viewer", "release_manager"})
+_GIT_OID = re.compile(r"^[0-9a-f]{40}$")
+
+
+def _resolve_environment_value(value: Any, *, label: str) -> Any:
+    if not isinstance(value, str) or not value.startswith("ENV:"):
+        return value
+    variable = value[4:].strip()
+    if not variable:
+        raise ValueError(f"{label} environment variable name is empty")
+    resolved = str(os.getenv(variable, "")).strip()
+    if not resolved:
+        raise RuntimeError(f"required environment variable is not set: {variable}")
+    return resolved
+
+
+def _load_execution_plan(path: str | Path) -> ExecutionPlanManifest:
+    source = Path(path).resolve()
+    value = json.loads(source.read_text(encoding="utf-8"))
+    if not isinstance(value, Mapping):
+        raise ValueError(f"execution plan must contain a JSON object: {source}")
+    payload = dict(value)
+    for label in ("source_branch", "source_oid", "target_version"):
+        payload[label] = _resolve_environment_value(payload.get(label), label=label)
+    source_oid = str(payload.get("source_oid") or "").strip().lower()
+    if not _GIT_OID.fullmatch(source_oid):
+        raise ValueError(
+            "execution plan source_oid must resolve to an exact 40-character Git OID"
+        )
+    payload["source_oid"] = source_oid
+    return ExecutionPlanManifest.from_dict(payload)
+
+
+def _path_list(value: str) -> tuple[Path, ...]:
+    return tuple(
+        Path(item).expanduser().resolve()
+        for item in value.split(os.pathsep)
+        if item.strip()
+    )
+
+
+class V2R1C2PortalApplication(UnifiedPortalApplication):
+    """Unified portal candidate with provider-neutral execution governance."""
+
+    def __init__(
+        self,
+        base: CandidateApplication,
+        *,
+        provenance_store_file: str | Path,
+        external_task_api: ExternalTaskAPI,
+        execution_plan_api: ExecutionPlanAPI,
+        plan_coordinator: ExecutionPlanCoordinator,
+        catalog_snapshot: Mapping[str, Any],
+        declared_plans: Sequence[str],
+    ) -> None:
+        super().__init__(base, provenance_store_file=provenance_store_file)
+        self.external_task_api = external_task_api
+        self.execution_plan_api = execution_plan_api
+        self.plan_coordinator = plan_coordinator
+        self.catalog_snapshot = dict(catalog_snapshot)
+        self.declared_plans = tuple(declared_plans)
+
+    def context(self, headers: Mapping[str, str]) -> RequestContext:
+        original = self.base.context(headers)
+        if original.roles.intersection(_READ_BRIDGE_ROLES):
+            return replace(original, roles=frozenset((*original.roles, "auditor")))
+        return original
+
+    def _resource_snapshot(self, context: RequestContext) -> Mapping[str, Any]:
+        service = self.orchestrator.control_plane
+        tenant = service.get_tenant(context)
+        agents = service.list_agents(context) if allows(context, "agent.read") else []
+        tasks = service.list_tasks(context) if allows(context, "task.read") else []
+        tasks_by_agent: dict[str, int] = {}
+        for task in tasks:
+            tasks_by_agent[task.agent_id] = tasks_by_agent.get(task.agent_id, 0) + 1
+        return {
+            "tenant": _json_value(tenant),
+            "agents": [
+                {
+                    **_json_value(agent),
+                    "task_count": tasks_by_agent.get(agent.agent_id, 0),
+                }
+                for agent in agents
+            ],
+            "summary": {
+                "agents": len(agents),
+                "enabled_agents": sum(1 for agent in agents if agent.enabled),
+                "tasks": len(tasks),
+                "runtimes": sorted({agent.runtime for agent in agents}),
+            },
+            "operations": {
+                "tenant_create": allows(context, "tenant.manage"),
+                "agent_create": allows(context, "agent.manage"),
+            },
+        }
+
+    def _runtime_snapshot(
+        self,
+        context: RequestContext,
+        headers: Mapping[str, str],
+    ) -> Mapping[str, Any]:
+        return {
+            **self._runtime(headers),
+            "dispatches": _json_value(
+                self.orchestrator.dispatch_repository.list(
+                    tenant_id=context.tenant_id
+                )
+            ),
+            "hermes_jobs": _json_value(
+                self.hermes.list_jobs(tenant_id=context.tenant_id)
+            ),
+            "contract": {
+                "openclaw": os.getenv(
+                    "AIOS_OPENCLAW_CONTRACT_VERSION",
+                    "aios.openclaw.command.v2",
+                ),
+                "signature_algorithm": os.getenv(
+                    "AIOS_OPENCLAW_SIGNATURE_ALGORITHM",
+                    "Ed25519",
+                ),
+                "plugin_version": os.getenv(
+                    "AIOS_OPENCLAW_PLUGIN_VERSION",
+                    "2.1.0-rc.4",
+                ),
+                "key_id": os.getenv(
+                    "AIOS_OPENCLAW_SIGNING_KEY_ID",
+                    "openclaw-v2r1-candidate-ed25519",
+                ),
+                "executor_protocol": "aios.executor.v1",
+                "execution_plan": "aios.execution-plan.v2",
+            },
+        }
+
+    def _release_snapshot(self, context: RequestContext) -> Mapping[str, Any]:
+        plans = []
+        for plan_id in self.declared_plans:
+            plans.append(
+                {
+                    "plan_id": plan_id,
+                    "gate": self.plan_coordinator.gate(plan_id),
+                }
+            )
+        aggregate_passed = bool(plans) and all(
+            item["gate"]["passed"] for item in plans
+        )
+        return {
+            **self._gitops(context),
+            "version": os.getenv("AIOS_RELEASE_VERSION", "V2R1C2-CANDIDATE"),
+            "target_version": os.getenv("AIOS_TARGET_VERSION", "V2R1C2"),
+            "release_oid": os.getenv("AIOS_RELEASE_OID", "candidate-not-tagged"),
+            "source_oid": os.getenv("AIOS_RELEASE_SOURCE_OID", "missing"),
+            "tag": os.getenv("AIOS_RELEASE_TAG", "NOT_CREATED"),
+            "baseline": os.getenv("AIOS_BASELINE_VERSION", "V2R1C1"),
+            "previous_version": os.getenv("AIOS_PREVIOUS_VERSION", "V2R1C1"),
+            "status": os.getenv("AIOS_RELEASE_STATUS", "CANDIDATE_VALIDATION"),
+            "evidence_manifest_sha256": os.getenv(
+                "AIOS_RELEASE_EVIDENCE_SHA256",
+                "pending",
+            ),
+            "executor_catalog": {
+                "path": self.catalog_snapshot.get("path"),
+                "sha256": self.catalog_snapshot.get("catalog_sha256"),
+                "protocol_version": "aios.executor.v1",
+            },
+            "execution_plans": plans,
+            "execution_gate": {
+                "passed": aggregate_passed,
+                "release_blocking": not aggregate_passed,
+            },
+            "operations": (
+                ["review_release", "request_tag", "request_rollback"]
+                if allows(context, "release.operate")
+                else []
+            ),
+            "note": (
+                "Release operations remain GitOps approval requests. The portal "
+                "never mutates tags, main, or production directly. Tag approval "
+                "must remain blocked until every required execution-plan gate passes."
+            ),
+        }
+
+    def handle_json(
+        self,
+        method: str,
+        raw_path: str,
+        headers: Mapping[str, str],
+        body: Any,
+    ) -> tuple[int, Mapping[str, Any]]:
+        parsed = urllib.parse.urlparse(raw_path)
+        path = parsed.path.rstrip("/") or "/"
+        method = method.upper()
+
+        if self.execution_plan_api.is_route(raw_path):
+            context = (
+                self.context(headers)
+                if path == ExecutionPlanAPI.PORTAL_PATH
+                else self.base.context(headers)
+            )
+            return self.execution_plan_api.handle(
+                method,
+                raw_path,
+                context,
+                body,
+            )
+
+        if self.external_task_api.is_route(path):
+            context = (
+                self.context(headers)
+                if path == "/api/v2/portal/external-tasks"
+                else self.base.context(headers)
+            )
+            return self.external_task_api.handle(
+                method,
+                raw_path,
+                context,
+                body,
+            )
+
+        context: RequestContext | None = None
+        if path in {
+            "/api/v2/portal/resources",
+            "/api/v2/portal/runtime",
+            "/api/v2/portal/release",
+            "/api/v2/portal/tenants",
+            "/api/v2/portal/agents",
+        }:
+            context = self.context(headers)
+
+        if method == "GET" and path == "/api/v2/portal/resources":
+            assert context is not None
+            require(context, "tenant.read")
+            return HTTPStatus.OK, self._resource_snapshot(context)
+
+        if method == "POST" and path == "/api/v2/portal/tenants":
+            assert context is not None
+            require(context, "tenant.manage")
+            return self.base.handle_json(
+                "POST",
+                "/api/v2/tenants",
+                headers,
+                _mapping(body),
+            )
+
+        if method == "POST" and path == "/api/v2/portal/agents":
+            assert context is not None
+            require(context, "agent.manage")
+            return self.base.handle_json(
+                "POST",
+                "/api/v2/agents",
+                headers,
+                _mapping(body),
+            )
+
+        if method == "GET" and path == "/api/v2/portal/runtime":
+            assert context is not None
+            require(context, "runtime.read")
+            return HTTPStatus.OK, self._runtime_snapshot(context, headers)
+
+        if method == "GET" and path == "/api/v2/portal/release":
+            assert context is not None
+            require(context, "release.read")
+            return HTTPStatus.OK, self._release_snapshot(context)
+
+        return super().handle_json(method, raw_path, headers, body)
+
+
+def build_application() -> V2R1C2PortalApplication:
+    state_dir = Path(
+        os.getenv("AIOS_V2_STATE_DIR", "/var/lib/aios-v2r1c2-portal")
+    ).resolve()
+    state_dir.mkdir(parents=True, exist_ok=True)
+    provenance_file = Path(
+        os.getenv(
+            "AIOS_PROVENANCE_STORE_FILE",
+            str(state_dir / "run-provenance.sqlite3"),
+        )
+    ).resolve()
+    truth_file = Path(
+        os.getenv(
+            "AIOS_EXTERNAL_TASK_STORE_FILE",
+            str(state_dir / "external-task-truth.sqlite3"),
+        )
+    ).resolve()
+    catalog_file = Path(
+        os.getenv(
+            "AIOS_EXECUTOR_CATALOG_FILE",
+            str(state_dir / "executor-catalog.json"),
+        )
+    ).resolve()
+
+    catalog_store = FileExecutorCatalogStore(catalog_file)
+    catalog_snapshot = catalog_store.initialize_defaults()
+    providers = catalog_store.registry(
+        provider_factories=official_provider_factories()
+    )
+    plan_coordinator = ExecutionPlanCoordinator.from_file(
+        truth_file,
+        providers=providers,
+    )
+
+    declared_plans: list[str] = []
+    plan_files = _path_list(os.getenv("AIOS_EXECUTION_PLAN_FILES", ""))
+    for plan_file in plan_files:
+        plan = _load_execution_plan(plan_file)
+        plan_coordinator.declare(plan)
+        declared_plans.append(plan.plan_id)
+
+    base: CandidateApplication = build_candidate_application()
+    external_task_api = ExternalTaskAPI(
+        plan_coordinator.task_coordinator,
+        store_file=truth_file,
+        providers=providers,
+    )
+    execution_plan_api = ExecutionPlanAPI(
+        plan_coordinator,
+        providers=providers,
+    )
+    return V2R1C2PortalApplication(
+        base,
+        provenance_store_file=provenance_file,
+        external_task_api=external_task_api,
+        execution_plan_api=execution_plan_api,
+        plan_coordinator=plan_coordinator,
+        catalog_snapshot=catalog_snapshot.as_dict(),
+        declared_plans=declared_plans,
+    )
+
+
+def main() -> None:
+    candidate_app_module.CONSOLE_HTML = PORTAL_HTML
+    host = os.getenv("AIOS_V2_HOST", "127.0.0.1")
+    port = int(os.getenv("AIOS_V2_PORT", "18921"))
+    server = CandidateHTTPServer((host, port), build_application())
+    print(f"AIOS V2R1C2 unified portal listening on {host}:{port}")
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()
@@ -1,953 +0,0 @@
-"""Owner-authorized, fail-closed task writer provisioning bridge.
-
-This module converts an authenticated Owner authorization into a canonical,
-short-lived, one-time grant request. It delegates signing, validation and
-worktree/writer provisioning to existing root-governed executables.
-
-It never writes Git refs directly and never authorizes main, tag, baseline or
-production mutations.
-"""
-from __future__ import annotations
-
-import fcntl
-import hashlib
-import json
-import os
-import re
-import secrets
-import shutil
-import stat
-import subprocess
-import tempfile
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any, Mapping
-from signer_contract_compatibility import (
-    deployed_signer_help,
-    run_compatible_signer,
-    run_compatible_validator,
-)
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
-TASK_RE = re.compile(r"^[A-Z0-9][A-Z0-9._:-]{7,127}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-OWNER_REF_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/@+-]{3,255}$")
-
-REQUIRED_REQUEST_FIELDS = frozenset(
-    {
-        "task_id",
-        "repository",
-        "base_ref",
-        "base_oid",
-        "target_branch",
-        "owner_authorization_reference",
-        "one_time_use",
-        "expires_in_seconds",
-        "production_change_authorized",
-        "tag_change_authorized",
-        "baseline_change_authorized",
-        "main_write_authorized",
-        "allowed_operations",
-        "denied_operations",
-    }
-)
-REQUIRED_ALLOWED_OPERATIONS = frozenset(
-    {
-        "create_worktree",
-        "create_target_branch_if_absent",
-        "commit_to_target_branch",
-        "push_target_branch",
-    }
-)
-REQUIRED_DENIED_OPERATIONS = frozenset(
-    {
-        "direct_main_push",
-        "force_push",
-        "tag_create",
-        "tag_update",
-        "tag_delete",
-        "branch_delete",
-        "repository_admin",
-        "baseline_write",
-        "production_deploy",
-        "production_marker_write",
-        "history_rewrite",
-    }
-)
-REQUIRED_NEGATIVE_TESTS = frozenset(
-    {
-        "main_write_denied",
-        "other_branch_write_denied",
-        "tag_create_denied",
-        "tag_update_denied",
-        "baseline_write_denied",
-        "force_push_denied",
-        "branch_delete_denied",
-    }
-)
-SENSITIVE_KEY_MARKERS = (
-    "authorization",
-    "credential",
-    "private_key",
-    "secret",
-    "signature",
-    "token",
-)
-
-
-class ProvisioningError(RuntimeError):
-    """Stable fail-closed error returned to the API adapter."""
-
-    def __init__(
-        self,
-        code: str,
-        status: int = 400,
-        *,
-        details: Mapping[str, Any] | None = None,
-    ) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-        self.details = dict(details or {})
-
-
-@dataclass(frozen=True)
-class OwnerContext:
-    identity: str
-    role: str
-    authorization_reference: str
-
-
-@dataclass(frozen=True)
-class ProvisioningConfig:
-    repository_identity: str
-    authority_git_dir: Path
-    state_root: Path
-    signer: Path
-    validator: Path
-    provisioner: Path
-    governed_use_sudo: bool = False
-    sudo_path: Path = Path("/usr/bin/sudo")
-    max_expiry_seconds: int = 1800
-
-    @classmethod
-    def from_environment(cls) -> "ProvisioningConfig":
-        return cls(
-            repository_identity=os.getenv(
-                "AIOS_GITOPS_REPOSITORY_IDENTITY", "aios/aios"
-            ).strip(),
-            authority_git_dir=Path(
-                os.getenv("AIOS_GITOPS_AUTHORITY_GIT_DIR", "/data/aios-gitops/repo.git")
-            ),
-            state_root=Path(
-                os.getenv(
-                    "AIOS_GITOPS_AUTHORIZED_WRITER_STATE_ROOT",
-                    "/var/lib/aios-gitops/authorized-writer-bridge",
-                )
-            ),
-            signer=Path(
-                os.getenv(
-                    "AIOS_GITOPS_GRANT_SIGNER_ADAPTER",
-                    "/usr/local/libexec/aios-grant-signer-adapter",
-                )
-            ),
-            validator=Path(
-                os.getenv(
-                    "AIOS_GITOPS_GRANT_VALIDATOR",
-                    "/usr/local/libexec/aios-grant-validator",
-                )
-            ),
-            provisioner=Path(
-                os.getenv(
-                    "AIOS_GITOPS_TASK_WRITER_PROVISIONER",
-                    "/usr/local/libexec/aios-task-writer-provisioner",
-                )
-            ),
-            governed_use_sudo=os.getenv(
-                "AIOS_GITOPS_GOVERNED_USE_SUDO", ""
-            ).strip().lower() in {"1", "true", "yes", "on"},
-            sudo_path=Path(
-                os.getenv("AIOS_GITOPS_SUDO_PATH", "/usr/bin/sudo")
-            ),
-        )
-
-
-def utc_now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def iso_utc(value: datetime) -> str:
-    return value.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def canonical_json_bytes(value: Any) -> bytes:
-    return (
-        json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
-        + "\n"
-    ).encode("utf-8")
-
-
-def sha256_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
-
-
-def _atomic_write_json(path: Path, value: Any, mode: int = 0o600) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    if path.parent.is_symlink() or path.is_symlink():
-        raise ProvisioningError("STATE_PATH_SYMLINK_REJECTED", 500)
-    fd, temporary = tempfile.mkstemp(prefix=".tmp-", dir=path.parent)
-    try:
-        os.fchmod(fd, mode)
-        with os.fdopen(fd, "wb", closefd=True) as stream:
-            stream.write(canonical_json_bytes(value))
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(temporary, path)
-        os.chmod(path, mode)
-        parent_fd = os.open(path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
-        try:
-            os.fsync(parent_fd)
-        finally:
-            os.close(parent_fd)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def _read_json(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise ProvisioningError("RESULT_FILE_INVALID", 500)
-    if path.stat().st_size <= 0 or path.stat().st_size > 1_048_576:
-        raise ProvisioningError("RESULT_FILE_INVALID", 500)
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        raise ProvisioningError("RESULT_JSON_INVALID", 500) from None
-    if not isinstance(value, dict):
-        raise ProvisioningError("RESULT_OBJECT_REQUIRED", 500)
-    return value
-
-
-def _safe_receipt_id(task_id: str, repository: str, branch: str) -> str:
-    return hashlib.sha256(f"{task_id}\0{repository}\0{branch}".encode()).hexdigest()
-
-
-def _redacted(value: Any) -> Any:
-    if isinstance(value, dict):
-        cleaned = {}
-        for key, inner in value.items():
-            lowered = str(key).lower()
-            if any(marker in lowered for marker in SENSITIVE_KEY_MARKERS):
-                if lowered in {
-                    "owner_authorization_reference",
-                    "signing_key_identity",
-                    "signer_identity",
-                }:
-                    cleaned[key] = inner
-                else:
-                    cleaned[key] = "[REDACTED]"
-            else:
-                cleaned[key] = _redacted(inner)
-        return cleaned
-    if isinstance(value, list):
-        return [_redacted(item) for item in value]
-    return value
-
-
-def _run(
-    argv: list[str],
-    *,
-    env: Mapping[str, str] | None = None,
-    timeout: int = 60,
-    allowed_returncodes: tuple[int, ...] = (0,),
-) -> subprocess.CompletedProcess[str]:
-    result = subprocess.run(
-        argv,
-        text=True,
-        capture_output=True,
-        check=False,
-        timeout=timeout,
-        env=dict(env) if env is not None else None,
-    )
-    if result.returncode not in allowed_returncodes:
-        raise ProvisioningError(
-            "GOVERNED_TOOL_FAILED",
-            503,
-            details={
-                "tool": Path(argv[0]).name,
-                "returncode": result.returncode,
-                "stderr": result.stderr[-1000:],
-            },
-        )
-    return result
-
-
-def _git(git_dir: Path, *args: str, allowed_returncodes: tuple[int, ...] = (0,)) -> str:
-    result = _run(
-        ["git", "--git-dir", str(git_dir), *args],
-        timeout=30,
-        allowed_returncodes=allowed_returncodes,
-    )
-    return result.stdout.strip()
-
-
-def _verify_executable(path: Path, name: str) -> None:
-    if not path.is_absolute() or path.is_symlink() or not path.is_file():
-        raise ProvisioningError(f"{name}_EXECUTABLE_INVALID", 503)
-    info = path.stat(follow_symlinks=False)
-    if not stat.S_ISREG(info.st_mode) or not os.access(path, os.X_OK):
-        raise ProvisioningError(f"{name}_EXECUTABLE_INVALID", 503)
-    if info.st_mode & (stat.S_IWGRP | stat.S_IWOTH):
-        raise ProvisioningError(f"{name}_EXECUTABLE_PERMISSIONS_REJECTED", 503)
-
-
-def _tool_argv(
-    config: ProvisioningConfig,
-    path: Path,
-    *args: str,
-) -> list[str]:
-    if config.governed_use_sudo:
-        return [str(config.sudo_path), "-n", "--", str(path), *args]
-    return [str(path), *args]
-
-
-def _verify_tool_contract(
-    path: Path,
-    name: str,
-    config: ProvisioningConfig,
-) -> None:
-    _verify_executable(path, name)
-    if config.governed_use_sudo:
-        _verify_executable(config.sudo_path, "SUDO")
-    help_result = _run(_tool_argv(config, path, "--help"), timeout=15)
-    if name == "SIGNER":
-        sign_help = _run(
-            _tool_argv(config, path, "sign", "--help"),
-            timeout=15,
-        )
-        if deployed_signer_help(sign_help.stdout, sign_help.stderr):
-            _run(_tool_argv(config, path, "self-test"), timeout=30)
-            return
-    for flag in ("--grant-dir", "--result-json"):
-        if flag not in help_result.stdout and flag not in help_result.stderr:
-            raise ProvisioningError(f"{name}_CONTRACT_UNSUPPORTED", 503)
-    _run(_tool_argv(config, path, "--self-test"), timeout=30)
-
-
-def _validate_request(
-    raw: Mapping[str, Any],
-    *,
-    owner: OwnerContext,
-    config: ProvisioningConfig,
-) -> dict[str, Any]:
-    if owner.role != "owner" or not owner.identity.strip():
-        raise ProvisioningError("OWNER_AUTHORIZATION_REQUIRED", 403)
-    if set(raw) != REQUIRED_REQUEST_FIELDS:
-        raise ProvisioningError("REQUEST_FIELDS_REJECTED")
-    if raw["repository"] != config.repository_identity:
-        raise ProvisioningError("REPOSITORY_IDENTITY_MISMATCH", 409)
-    if raw["base_ref"] != "refs/heads/main":
-        raise ProvisioningError("BASE_REF_REJECTED", 409)
-    if not isinstance(raw["base_oid"], str) or not OID_RE.fullmatch(raw["base_oid"]):
-        raise ProvisioningError("BASE_OID_REJECTED")
-    if (
-        not isinstance(raw["target_branch"], str)
-        or not BRANCH_RE.fullmatch(raw["target_branch"])
-        or raw["target_branch"] in {"main", "master"}
-    ):
-        raise ProvisioningError("TARGET_BRANCH_REJECTED")
-    if not isinstance(raw["task_id"], str) or not TASK_RE.fullmatch(raw["task_id"]):
-        raise ProvisioningError("TASK_ID_REJECTED")
-    if (
-        not isinstance(raw["owner_authorization_reference"], str)
-        or not OWNER_REF_RE.fullmatch(raw["owner_authorization_reference"])
-        or raw["owner_authorization_reference"] != owner.authorization_reference
-    ):
-        raise ProvisioningError("OWNER_AUTHORIZATION_REFERENCE_MISMATCH", 403)
-    if raw["one_time_use"] is not True:
-        raise ProvisioningError("ONE_TIME_USE_REQUIRED")
-    expiry = raw["expires_in_seconds"]
-    if (
-        not isinstance(expiry, int)
-        or isinstance(expiry, bool)
-        or not 60 <= expiry <= config.max_expiry_seconds
-    ):
-        raise ProvisioningError("GRANT_LIFETIME_REJECTED")
-    for name in (
-        "production_change_authorized",
-        "tag_change_authorized",
-        "baseline_change_authorized",
-        "main_write_authorized",
-    ):
-        if raw[name] is not False:
-            raise ProvisioningError("PRODUCTION_CAPABILITY_REJECTED", 403)
-    allowed = raw["allowed_operations"]
-    denied = raw["denied_operations"]
-    if not isinstance(allowed, list) or frozenset(allowed) != REQUIRED_ALLOWED_OPERATIONS:
-        raise ProvisioningError("ALLOWED_OPERATIONS_MISMATCH", 403)
-    if len(allowed) != len(set(allowed)):
-        raise ProvisioningError("ALLOWED_OPERATIONS_MISMATCH", 403)
-    if not isinstance(denied, list) or frozenset(denied) != REQUIRED_DENIED_OPERATIONS:
-        raise ProvisioningError("DENIED_OPERATIONS_MISMATCH", 403)
-    if len(denied) != len(set(denied)):
-        raise ProvisioningError("DENIED_OPERATIONS_MISMATCH", 403)
-    return dict(raw)
-
-
-def _prepare_state_root(path: Path) -> None:
-    if not path.is_absolute() or path.is_symlink():
-        raise ProvisioningError("STATE_ROOT_INVALID", 500)
-    path.mkdir(parents=True, exist_ok=True, mode=0o700)
-    os.chmod(path, 0o700)
-    if path.stat().st_mode & (stat.S_IWGRP | stat.S_IWOTH):
-        raise ProvisioningError("STATE_ROOT_PERMISSIONS_REJECTED", 500)
-    (path / "receipts").mkdir(mode=0o700, exist_ok=True)
-    (path / "locks").mkdir(mode=0o700, exist_ok=True)
-
-
-def _prestart_git_check(
-    request: Mapping[str, Any],
-    config: ProvisioningConfig,
-    *,
-    receipt_exists: bool,
-) -> dict[str, Any]:
-    git_dir = config.authority_git_dir
-    if not git_dir.is_absolute() or git_dir.is_symlink() or not git_dir.is_dir():
-        raise ProvisioningError("AUTHORITY_GIT_DIR_INVALID", 503)
-    actual_main = _git(git_dir, "rev-parse", request["base_ref"])
-    if actual_main != request["base_oid"]:
-        raise ProvisioningError(
-            "AUTHORIZED_BASE_OID_DRIFT",
-            409,
-            details={"expected": request["base_oid"], "actual": actual_main},
-        )
-    ref = f"refs/heads/{request['target_branch']}"
-    existing = _git(
-        git_dir,
-        "show-ref",
-        "--verify",
-        "--hash",
-        ref,
-        allowed_returncodes=(0, 1, 128),
-    )
-    if existing and not receipt_exists:
-        raise ProvisioningError(
-            "EXISTING_BRANCH_OID_CONFLICT",
-            409,
-            details={"branch_oid": existing},
-        )
-    if existing and receipt_exists:
-        ancestor = _run(
-            [
-                "git",
-                "--git-dir",
-                str(git_dir),
-                "merge-base",
-                "--is-ancestor",
-                request["base_oid"],
-                ref,
-            ],
-            allowed_returncodes=(0, 1),
-        )
-        if ancestor.returncode != 0:
-            raise ProvisioningError("EXISTING_BRANCH_OID_CONFLICT", 409)
-    return {
-        "authoritative_main_oid": actual_main,
-        "target_branch_preexisting": bool(existing),
-        "target_branch_oid": existing or None,
-    }
-
-
-def _build_plan(
-    request: Mapping[str, Any],
-    owner: OwnerContext,
-    *,
-    now: datetime,
-) -> tuple[dict[str, Any], dict[str, Any]]:
-    expires_at = now + timedelta(seconds=int(request["expires_in_seconds"]))
-    grant_request = {
-        "schema": "aios.task-scoped-writer-grant-request.v1",
-        "task_id": request["task_id"],
-        "repository": request["repository"],
-        "base": {"ref": request["base_ref"], "oid": request["base_oid"]},
-        "target": {"branch": request["target_branch"]},
-        "execution_contract": {
-            "branch_creation": "governed_one_shot_provisioner",
-            "writer_route": "POST /api/commit-file",
-            "createBranch_route_required": False,
-        },
-        "owner_authorization": {
-            "identity": owner.identity,
-            "reference": owner.authorization_reference,
-            "authenticated_role": owner.role,
-        },
-        "allowed_operations": sorted(request["allowed_operations"]),
-        "denied_operations": sorted(request["denied_operations"]),
-        "one_time_use": True,
-        "authorization": {
-            "production_change_authorized": False,
-            "tag_change_authorized": False,
-            "baseline_change_authorized": False,
-            "main_write_authorized": False,
-        },
-        "issued_at": iso_utc(now),
-        "not_before": iso_utc(now - timedelta(seconds=2)),
-        "expires_at": iso_utc(expires_at),
-        "nonce": secrets.token_hex(32),
-    }
-    binding_digest = sha256_json(grant_request)
-    plan = {
-        "schema": "aios.task-scoped-writer-approval-plan.v1",
-        "approval_plan_id": f"sha256:{binding_digest}",
-        "grant_request_sha256": binding_digest,
-        "owner_authorization_reference": owner.authorization_reference,
-        "owner_identity": owner.identity,
-        "created_at": iso_utc(now),
-        "expires_at": iso_utc(expires_at),
-        "execute": True,
-        "production_change_authorized": False,
-    }
-    return plan, grant_request
-
-
-def _expect_text(result: Mapping[str, Any], name: str) -> str:
-    value = result.get(name)
-    if not isinstance(value, str) or not value.strip():
-        raise ProvisioningError(f"{name.upper()}_MISSING", 503)
-    return value
-
-
-def _verify_signer_result(
-    result: Mapping[str, Any],
-    *,
-    approval_plan_id: str,
-) -> dict[str, str]:
-    if result.get("status") not in {"SIGNED", "PASS", "COMPLETED"}:
-        raise ProvisioningError("GRANT_SIGNING_FAILED", 503)
-    if result.get("approval_plan_id") != approval_plan_id:
-        raise ProvisioningError("APPROVAL_PLAN_ID_MISMATCH", 503)
-    digest = _expect_text(result, "grant_digest_sha256")
-    if not SHA256_RE.fullmatch(digest):
-        raise ProvisioningError("GRANT_DIGEST_INVALID", 503)
-    signer = result.get("signing_key_identity") or result.get("signer_identity")
-    if not isinstance(signer, str) or not signer.strip():
-        raise ProvisioningError("SIGNING_KEY_IDENTITY_MISSING", 503)
-    signature_present = bool(result.get("signature_present")) or bool(
-        result.get("owner_signature")
-    )
-    if not signature_present:
-        raise ProvisioningError("OWNER_SIGNATURE_MISSING", 503)
-    return {
-        "grant_id": _expect_text(result, "grant_id"),
-        "grant_digest_sha256": digest,
-        "signing_key_identity": signer,
-    }
-
-
-def _verify_validator_result(
-    result: Mapping[str, Any],
-    *,
-    approval_plan_id: str,
-    grant_digest: str,
-) -> None:
-    if result.get("status") not in {"PASS", "VALID", "COMPLETED"}:
-        raise ProvisioningError("GOVERNED_GRANT_VALIDATION_FAILED", 503)
-    if result.get("approval_plan_id") != approval_plan_id:
-        raise ProvisioningError("VALIDATED_PLAN_ID_MISMATCH", 503)
-    if result.get("grant_digest_sha256") != grant_digest:
-        raise ProvisioningError("VALIDATED_GRANT_DIGEST_MISMATCH", 503)
-    checks = result.get("checks")
-    required = {
-        "schema_valid",
-        "signature_valid",
-        "signer_trusted",
-        "approval_plan_active",
-        "repository_match",
-        "base_ref_match",
-        "base_oid_match",
-        "target_branch_match",
-        "one_time_use",
-        "allowed_operations_match",
-        "denied_operations_match",
-    }
-    if not isinstance(checks, dict) or any(checks.get(name) is not True for name in required):
-        raise ProvisioningError("GOVERNED_GRANT_VALIDATION_FAILED", 503)
-
-
-def _verify_provisioner_result(
-    result: Mapping[str, Any],
-    request: Mapping[str, Any],
-    *,
-    grant_id: str,
-    validator_config_path: Path,
-) -> dict[str, Any]:
-    if result.get("status") not in {"READY_FOR_CODE_AUTHORING", "COMPLETED"}:
-        raise ProvisioningError("TASK_WRITER_PROVISIONING_FAILED", 503)
-
-    # The legacy bridge created the target ref itself. Keep accepting it for
-    # controlled test doubles, but prefer the deployed direct one-shot writer.
-    if result.get("status") == "COMPLETED" and result.get("writer_mode") == "direct_one_shot_detached":
-        if result.get("target_branch") != request["target_branch"]:
-            raise ProvisioningError("PROVISIONED_BRANCH_MISMATCH", 503)
-        if result.get("base_oid") != request["base_oid"]:
-            raise ProvisioningError("PROVISIONED_BASE_MISMATCH", 503)
-        if result.get("writer_created") is not True:
-            raise ProvisioningError("TASK_WRITER_PROVISIONING_FAILED", 503)
-        writer_config_name = result.get("writer_config")
-        if not isinstance(writer_config_name, str) or not Path(writer_config_name).is_absolute():
-            raise ProvisioningError("WRITER_CONFIG_INVALID", 503)
-        writer_config_path = Path(writer_config_name)
-        writer_config = _read_json(writer_config_path)
-        if writer_config.get("status") != "READY":
-            raise ProvisioningError("WRITER_CONFIG_NOT_READY", 503)
-        if writer_config.get("target_branch") != request["target_branch"]:
-            raise ProvisioningError("WRITER_CONFIG_BRANCH_MISMATCH", 503)
-        if writer_config.get("base_oid") != request["base_oid"]:
-            raise ProvisioningError("WRITER_CONFIG_BASE_MISMATCH", 503)
-        if writer_config.get("worktree_mode") != "detached":
-            raise ProvisioningError("WRITER_MODE_UNSUPPORTED", 503)
-        workspace = writer_config.get("worktree")
-        if not isinstance(workspace, str) or not Path(workspace).is_absolute():
-            raise ProvisioningError("PROVISIONED_WORKSPACE_INVALID", 503)
-        credential_name = writer_config.get("runtime_credential_file")
-        if not isinstance(credential_name, str) or not Path(credential_name).is_absolute():
-            raise ProvisioningError("WRITER_CREDENTIAL_REF_INVALID", 503)
-        credential = Path(credential_name)
-        if not credential.is_file() or credential.is_symlink():
-            raise ProvisioningError("WRITER_CREDENTIAL_MISSING", 503)
-        credential_stat = credential.stat()
-        if credential_stat.st_uid != 0 or stat.S_IMODE(credential_stat.st_mode) != 0o400:
-            raise ProvisioningError("WRITER_CREDENTIAL_PERMISSIONS_INVALID", 503)
-
-        dynamic_config = _read_json(validator_config_path)
-        ledger_name = dynamic_config.get("consumed_grants_ledger")
-        if not isinstance(ledger_name, str) or not Path(ledger_name).is_absolute():
-            raise ProvisioningError("GRANT_LEDGER_REF_INVALID", 503)
-        ledger = Path(ledger_name)
-        consumed = False
-        if ledger.is_file() and not ledger.is_symlink():
-            for line in ledger.read_text(encoding="utf-8").splitlines():
-                try:
-                    row = json.loads(line)
-                except json.JSONDecodeError:
-                    continue
-                if (
-                    isinstance(row, dict)
-                    and row.get("grant_id") == grant_id
-                    and row.get("target_branch") == request["target_branch"]
-                    and row.get("base_oid") == request["base_oid"]
-                ):
-                    consumed = True
-                    break
-        if not consumed:
-            raise ProvisioningError("ONE_TIME_GRANT_NOT_CONSUMED", 503)
-
-        scope = {
-            "workspace_role": "task-scoped-isolated-writer",
-            "writes_enabled": True,
-            "allowed_branch": request["target_branch"],
-            "allowed_base_oid": request["base_oid"],
-            "allow_main_write": False,
-            "allow_tag_write": False,
-            "allow_baseline_write": False,
-            "allow_force_push": False,
-            "allowed_routes": ["POST /api/commit-file"],
-            "writer_mode": "direct_one_shot_detached",
-        }
-        negatives = {name: True for name in sorted(REQUIRED_NEGATIVE_TESTS)}
-        return {
-            "branch": request["target_branch"],
-            "branch_oid": request["base_oid"],
-            "base_oid": request["base_oid"],
-            "workspace_path": workspace,
-            "writer_scope": scope,
-            "negative_tests": negatives,
-            "grant_consumed": True,
-            "remote_ref_status": "target_branch_absent_until_writer_push",
-            "remote_oid": None,
-            "detached_writer": True,
-            "writer_config_path": str(writer_config_path),
-        }
-
-    if result.get("branch") != request["target_branch"]:
-        raise ProvisioningError("PROVISIONED_BRANCH_MISMATCH", 503)
-    if result.get("base_oid") != request["base_oid"]:
-        raise ProvisioningError("PROVISIONED_BASE_MISMATCH", 503)
-    if result.get("branch_oid") != request["base_oid"]:
-        raise ProvisioningError("PROVISIONED_BRANCH_OID_MISMATCH", 503)
-    if result.get("grant_consumed") is not True:
-        raise ProvisioningError("ONE_TIME_GRANT_NOT_CONSUMED", 503)
-    workspace = result.get("workspace_path")
-    if not isinstance(workspace, str) or not Path(workspace).is_absolute():
-        raise ProvisioningError("PROVISIONED_WORKSPACE_INVALID", 503)
-    scope = result.get("writer_scope")
-    if not isinstance(scope, dict):
-        raise ProvisioningError("WRITER_SCOPE_ATTESTATION_MISSING", 503)
-    required_scope = {
-        "workspace_role": "task-scoped-isolated-writer",
-        "writes_enabled": True,
-        "allowed_branch": request["target_branch"],
-        "allowed_base_oid": request["base_oid"],
-        "allow_main_write": False,
-        "allow_tag_write": False,
-        "allow_baseline_write": False,
-        "allow_force_push": False,
-    }
-    for key, expected in required_scope.items():
-        if scope.get(key) != expected:
-            raise ProvisioningError("WRITER_SCOPE_ATTESTATION_MISMATCH", 503)
-    routes = scope.get("allowed_routes")
-    if routes != ["POST /api/commit-file"]:
-        raise ProvisioningError("WRITER_ROUTE_ATTESTATION_MISMATCH", 503)
-    negatives = result.get("negative_tests")
-    if not isinstance(negatives, dict) or any(
-        negatives.get(name) is not True for name in REQUIRED_NEGATIVE_TESTS
-    ):
-        raise ProvisioningError("NEGATIVE_POLICY_TESTS_FAILED", 503)
-    return {
-        "branch": result["branch"],
-        "branch_oid": result["branch_oid"],
-        "base_oid": result["base_oid"],
-        "workspace_path": workspace,
-        "writer_scope": scope,
-        "negative_tests": {
-            name: True for name in sorted(REQUIRED_NEGATIVE_TESTS)
-        },
-        "grant_consumed": True,
-        "remote_ref_status": result.get("remote_ref_status"),
-        "remote_oid": result.get("remote_oid"),
-        "detached_writer": False,
-        "writer_config_path": None,
-    }
-
-
-class AuthorizedTaskWriterProvisioner:
-    def __init__(
-        self,
-        config: ProvisioningConfig | None = None,
-        *,
-        clock=utc_now,
-    ) -> None:
-        self.config = config or ProvisioningConfig.from_environment()
-        self.clock = clock
-
-    def provision(
-        self,
-        raw_request: Mapping[str, Any],
-        owner: OwnerContext,
-    ) -> dict[str, Any]:
-        request = _validate_request(raw_request, owner=owner, config=self.config)
-        _prepare_state_root(self.config.state_root)
-        receipt_id = _safe_receipt_id(
-            request["task_id"], request["repository"], request["target_branch"]
-        )
-        receipt_path = self.config.state_root / "receipts" / f"{receipt_id}.json"
-        lock_path = self.config.state_root / "locks" / f"{receipt_id}.lock"
-        with open(lock_path, "a+b") as lock:
-            os.chmod(lock_path, 0o600)
-            fcntl.flock(lock.fileno(), fcntl.LOCK_EX)
-            return self._provision_locked(request, owner, receipt_path)
-
-    def _provision_locked(
-        self,
-        request: dict[str, Any],
-        owner: OwnerContext,
-        receipt_path: Path,
-    ) -> dict[str, Any]:
-        receipt_exists = receipt_path.exists()
-        prestart = _prestart_git_check(
-            request, self.config, receipt_exists=receipt_exists
-        )
-        if receipt_exists:
-            receipt = _read_json(receipt_path)
-            expected_digest = sha256_json(
-                {
-                    "task_id": request["task_id"],
-                    "repository": request["repository"],
-                    "base_ref": request["base_ref"],
-                    "base_oid": request["base_oid"],
-                    "target_branch": request["target_branch"],
-                    "owner_authorization_reference": request[
-                        "owner_authorization_reference"
-                    ],
-                }
-            )
-            if receipt.get("request_identity_sha256") != expected_digest:
-                raise ProvisioningError("IDEMPOTENCY_SCOPE_CONFLICT", 409)
-            return {
-                **receipt["public_result"],
-                "idempotent": True,
-                "prestart": prestart,
-            }
-
-        for path, name in (
-            (self.config.signer, "SIGNER"),
-            (self.config.validator, "VALIDATOR"),
-            (self.config.provisioner, "PROVISIONER"),
-        ):
-            _verify_tool_contract(path, name, self.config)
-
-        now = self.clock()
-        plan, grant_request = _build_plan(request, owner, now=now)
-        temporary_root = Path(
-            tempfile.mkdtemp(
-                prefix="grant-",
-                dir=self.config.state_root,
-            )
-        )
-        os.chmod(temporary_root, 0o700)
-        try:
-            grant_dir = temporary_root / "grant"
-            grant_dir.mkdir(mode=0o700)
-            _atomic_write_json(grant_dir / "approval-plan.json", plan)
-            _atomic_write_json(grant_dir / "grant-request.json", grant_request)
-
-            signer_result_path = temporary_root / "signer-result.json"
-            validator_result_path = temporary_root / "validator-result.json"
-            provisioner_result_path = temporary_root / "provisioner-result.json"
-
-            try:
-                run_compatible_signer(
-                    _tool_argv(self.config, self.config.signer),
-                    grant_dir,
-                    signer_result_path,
-                )
-            except Exception as exc:
-                raise ProvisioningError(
-                    "SIGNER_COMPATIBILITY_FAILED",
-                    503,
-                    details={"error": type(exc).__name__},
-                ) from exc
-            signer_result = _read_json(signer_result_path)
-            signer = _verify_signer_result(
-                signer_result,
-                approval_plan_id=plan["approval_plan_id"],
-            )
-
-            try:
-                validator_config_path = run_compatible_validator(
-                    _tool_argv(self.config, self.config.validator),
-                    grant_dir,
-                    validator_result_path,
-                )
-            except Exception as exc:
-                raise ProvisioningError(
-                    "VALIDATOR_COMPATIBILITY_FAILED",
-                    503,
-                    details={"error": type(exc).__name__},
-                ) from exc
-            validator_result = _read_json(validator_result_path)
-            _verify_validator_result(
-                validator_result,
-                approval_plan_id=plan["approval_plan_id"],
-                grant_digest=signer["grant_digest_sha256"],
-            )
-
-            provisioner_env = dict(os.environ)
-            provisioner_env["AIOS_GRANT_ROOT_CONFIG"] = str(
-                validator_config_path
-            )
-            _run(
-                _tool_argv(
-                    self.config,
-                    self.config.provisioner,
-                    "--grant-dir",
-                    str(grant_dir),
-                    "--result-json",
-                    str(provisioner_result_path),
-                ),
-                env=provisioner_env,
-                timeout=180,
-            )
-            provisioner_result = _read_json(provisioner_result_path)
-            provisioned = _verify_provisioner_result(
-                provisioner_result,
-                request,
-                grant_id=signer["grant_id"],
-                validator_config_path=validator_config_path,
-            )
-
-            post_branch_oid = _git(
-                self.config.authority_git_dir,
-                "show-ref",
-                "--verify",
-                "--hash",
-                f"refs/heads/{request['target_branch']}",
-                allowed_returncodes=(0, 1, 128),
-            )
-            if provisioned["detached_writer"]:
-                if post_branch_oid:
-                    raise ProvisioningError("POST_PROVISION_TARGET_BRANCH_EXISTS", 503)
-                post_branch_oid = request["base_oid"]
-            elif post_branch_oid != request["base_oid"]:
-                raise ProvisioningError("POST_PROVISION_BRANCH_OID_MISMATCH", 503)
-            post_main_oid = _git(
-                self.config.authority_git_dir,
-                "rev-parse",
-                request["base_ref"],
-            )
-            if post_main_oid != request["base_oid"]:
-                raise ProvisioningError("POST_PROVISION_MAIN_DRIFT", 409)
-
-            public_result = {
-                "status": "READY_FOR_CODE_AUTHORING",
-                "task_id": request["task_id"],
-                "repository": request["repository"],
-                "approval_plan_id": plan["approval_plan_id"],
-                "grant_id": signer["grant_id"],
-                "grant_digest_sha256": signer["grant_digest_sha256"],
-                "signing_key_identity": signer["signing_key_identity"],
-                "branch": provisioned["branch"],
-                "branch_oid": provisioned["branch_oid"],
-                "base_oid": request["base_oid"],
-                "workspace_path": provisioned["workspace_path"],
-                "writer_scope": provisioned["writer_scope"],
-                "negative_tests": provisioned["negative_tests"],
-                "grant_consumed": True,
-                "main_unchanged": True,
-                "production_change_authorized": False,
-                "tag_change_authorized": False,
-                "baseline_change_authorized": False,
-                "idempotent": False,
-            }
-            request_identity = sha256_json(
-                {
-                    "task_id": request["task_id"],
-                    "repository": request["repository"],
-                    "base_ref": request["base_ref"],
-                    "base_oid": request["base_oid"],
-                    "target_branch": request["target_branch"],
-                    "owner_authorization_reference": request[
-                        "owner_authorization_reference"
-                    ],
-                }
-            )
-            receipt = {
-                "schema": "aios.task-scoped-writer-provisioning-receipt.v1",
-                "request_identity_sha256": request_identity,
-                "created_at": iso_utc(self.clock()),
-                "public_result": _redacted(public_result),
-                "prestart": prestart,
-                "tool_evidence": {
-                    "signer": {
-                        "status": signer_result.get("status"),
-                        "grant_digest_sha256": signer["grant_digest_sha256"],
-                        "signing_key_identity": signer["signing_key_identity"],
-                    },
-                    "validator": {
-                        "status": validator_result.get("status"),
-                        "checks": validator_result.get("checks"),
-                    },
-                    "provisioner": {
-                        "status": provisioner_result.get("status"),
-                        "grant_consumed": provisioner_result.get("grant_consumed"),
-                    },
-                },
-            }
-            _atomic_write_json(receipt_path, receipt)
-            return {**public_result, "prestart": prestart}
-        finally:
-            shutil.rmtree(temporary_root, ignore_errors=True)
@@ -1,89 +0,0 @@
-"""Durable Owner/GPT notification outbox with retry and acknowledgement."""
-from __future__ import annotations
-
-import json
-import sqlite3
-import time
-import uuid
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any, Callable, Mapping
-
-
-@dataclass(frozen=True)
-class OutboxEvent:
-    event_id: str
-    recipient: str
-    kind: str
-    payload: Mapping[str, Any]
-    attempts: int
-    available_at: float
-    acknowledged: bool
-
-
-class DurableOutbox:
-    RECIPIENTS = ("owner", "gpt")
-
-    def __init__(self, path: str | Path) -> None:
-        self.path = str(path)
-        self.db = sqlite3.connect(self.path)
-        self.db.execute("PRAGMA journal_mode=WAL")
-        self.db.execute("CREATE TABLE IF NOT EXISTS outbox (event_id TEXT PRIMARY KEY, recipient TEXT NOT NULL, kind TEXT NOT NULL, payload TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, available_at REAL NOT NULL, delivered_at REAL, acknowledged INTEGER NOT NULL DEFAULT 0, last_error TEXT)")
-        self.db.commit()
-
-    def enqueue(self, kind: str, payload: Mapping[str, Any], *, event_id: str | None = None, recipients: tuple[str, ...] = RECIPIENTS) -> list[str]:
-        ids: list[str] = []
-        for recipient in recipients:
-            if recipient not in self.RECIPIENTS:
-                raise ValueError("recipient is outside the governed notification plane")
-            eid = event_id or str(uuid.uuid4())
-            if event_id is not None and len(recipients) > 1:
-                eid = f"{event_id}:{recipient}"
-            self.db.execute("INSERT OR IGNORE INTO outbox(event_id,recipient,kind,payload,available_at) VALUES(?,?,?,?,?)", (eid, recipient, kind, json.dumps(dict(payload), sort_keys=True), time.time()))
-            ids.append(eid)
-        self.db.commit()
-        return ids
-
-    def due(self, *, now: float | None = None, limit: int = 20) -> list[OutboxEvent]:
-        now = time.time() if now is None else now
-        rows = self.db.execute("SELECT event_id,recipient,kind,payload,attempts,available_at,acknowledged FROM outbox WHERE delivered_at IS NULL AND available_at<=? ORDER BY available_at,event_id LIMIT ?", (now, limit)).fetchall()
-        return [OutboxEvent(r[0], r[1], r[2], json.loads(r[3]), r[4], r[5], bool(r[6])) for r in rows]
-
-    def delivered(self, event_id: str, *, now: float | None = None) -> None:
-        self.db.execute("UPDATE outbox SET delivered_at=? WHERE event_id=?", (time.time() if now is None else now, event_id))
-        self.db.commit()
-
-    def failed(self, event_id: str, error: str, *, now: float | None = None, max_backoff: float = 300.0) -> None:
-        now = time.time() if now is None else now
-        row = self.db.execute("SELECT attempts FROM outbox WHERE event_id=?", (event_id,)).fetchone()
-        attempts = int(row[0]) + 1 if row else 1
-        delay = min(max_backoff, 2 ** min(attempts, 8))
-        self.db.execute("UPDATE outbox SET attempts=?,available_at=?,last_error=? WHERE event_id=?", (attempts, now + delay, error[:200], event_id))
-        self.db.commit()
-
-    def acknowledge(self, event_id: str) -> None:
-        self.db.execute("UPDATE outbox SET acknowledged=1 WHERE event_id=?", (event_id,))
-        self.db.commit()
-
-    def close(self) -> None:
-        self.db.close()
-
-
-class NotificationPlane:
-    def __init__(self, outbox: DurableOutbox) -> None:
-        self.outbox = outbox
-
-    def emit(self, kind: str, payload: Mapping[str, Any], *, event_id: str | None = None) -> list[str]:
-        return self.outbox.enqueue(kind, payload, event_id=event_id)
-
-    def deliver_once(self, send: Callable[[OutboxEvent], None], *, now: float | None = None) -> list[str]:
-        delivered: list[str] = []
-        for event in self.outbox.due(now=now):
-            try:
-                send(event)
-            except Exception as exc:
-                self.outbox.failed(event.event_id, type(exc).__name__, now=now)
-            else:
-                self.outbox.delivered(event.event_id, now=now)
-                delivered.append(event.event_id)
-        return delivered
@@ -1,491 +0,0 @@
-"""Fail-closed, branch-bound repair leases for governed AIOS GitOps work."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import posixpath
-import re
-import secrets
-import subprocess
-import tempfile
-import uuid
-from dataclasses import asdict, dataclass, field
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any, Iterable, Mapping, Protocol, Sequence
-
-
-TASK_ID = "V2R1C6_GOVERNED_LOCAL_BOOTSTRAP"
-MAX_LEASE_SECONDS = 86_400
-OID_RE = re.compile(r"^[0-9a-fA-F]{40}$")
-DENIED_BRANCHES = {"main", "master", "HEAD"}
-PROTECTED_PREFIXES = (
-    ".git",
-    "VERSION",
-    "versions/V2R1C5.json",
-    "artifacts/V2R1C5",
-    "baseline",
-    "config/gitops.tokens",
-    "gitops.tokens",
-    "secrets",
-    "credentials",
-)
-SECRET_PATTERNS = (
-    re.compile(r"(?i)-----BEGIN [A-Z ]*PRIVATE KEY-----"),
-    re.compile(r"(?i)(?:api[_-]?key|secret|password|token)\s*[:=]\s*\S+"),
-    re.compile(r"\b(?:sk|HPUA|SDC)-[A-Za-z0-9_-]{16,}\b"),
-)
-
-
-class LeaseError(Exception):
-    """Raised for any invalid, stale, expired, or prohibited lease action."""
-
-
-class GitProbeProtocol(Protocol):
-    """Read-only Git seam used by the lease manager."""
-
-    def branch_head(self, branch: str) -> str: ...
-
-    def parent(self, commit: str) -> str: ...
-
-    def is_ancestor(self, older: str, newer: str) -> bool: ...
-
-    def changed_paths(self, commit: str) -> tuple[str, ...]: ...
-
-    def commits_between(self, older: str, newer: str) -> tuple[str, ...]: ...
-
-
-def _now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def _ts(value: datetime) -> str:
-    return value.astimezone(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
-
-
-def _parse_ts(value: str) -> datetime:
-    if value.endswith("Z"):
-        value = value[:-1] + "+00:00"
-    parsed = datetime.fromisoformat(value)
-    return parsed if parsed.tzinfo else parsed.replace(tzinfo=timezone.utc)
-
-
-def _oid(value: str, field: str = "oid") -> str:
-    if not isinstance(value, str) or not OID_RE.fullmatch(value):
-        raise LeaseError(f"{field} must be a full commit OID")
-    return value.lower()
-
-
-def normalize_path(path: str) -> str:
-    """Normalize a repository-relative path without resolving through the FS."""
-    if not isinstance(path, str) or not path.strip():
-        raise LeaseError("path must be a non-empty string")
-    value = path.replace("\\", "/").strip()
-    if value.startswith("/") or "\x00" in value:
-        raise LeaseError("path must be relative")
-    parts = value.split("/")
-    if any(part in {"", ".", ".."} for part in parts):
-        raise LeaseError("path contains a prohibited component")
-    normalized = posixpath.normpath(value)
-    if normalized == "." or normalized.startswith("../"):
-        raise LeaseError("path is not normalized")
-    return normalized
-
-
-def path_is_protected(path: str) -> bool:
-    normalized = normalize_path(path)
-    lower = normalized.lower()
-    return any(
-        lower == prefix.lower() or lower.startswith(prefix.lower().rstrip("/") + "/")
-        for prefix in PROTECTED_PREFIXES
-    ) or lower.startswith("refs/")
-
-
-def contains_secret_like_content(content: str) -> bool:
-    return any(pattern.search(content or "") for pattern in SECRET_PATTERNS)
-
-
-def validate_paths(paths: Iterable[str], allowed_paths: Sequence[str]) -> tuple[str, ...]:
-    allowed = tuple(normalize_path(path) for path in allowed_paths)
-    if not allowed:
-        raise LeaseError("allowed_paths must not be empty")
-    result: list[str] = []
-    for raw in paths:
-        path = normalize_path(raw)
-        if path_is_protected(path):
-            raise LeaseError("protected path is not lease-writable")
-        if not any(path == prefix or path.startswith(prefix + "/") for prefix in allowed):
-            raise LeaseError("path is outside the lease allowlist")
-        if path not in result:
-            result.append(path)
-    if not result:
-        raise LeaseError("at least one changed path is required")
-    return tuple(result)
-
-
-@dataclass
-class CommitEntry:
-    commit_oid: str
-    parent_oid: str
-    paths: tuple[str, ...]
-    recorded_at: str
-
-
-@dataclass
-class RepairLease:
-    lease_id: str
-    task_id: str
-    owner_identity: str
-    branch: str
-    description: str
-    allowed_paths: tuple[str, ...]
-    initial_head_oid: str
-    current_head_oid: str
-    created_at: str
-    expires_at: str
-    max_expires_at: str
-    state: str = "ACTIVE"
-    revision: int = 0
-    commits: list[CommitEntry] = field(default_factory=list)
-    attached: bool = False
-
-    def to_json(self) -> dict[str, Any]:
-        payload = asdict(self)
-        payload["allowed_paths"] = list(self.allowed_paths)
-        payload["commits"] = [asdict(entry) for entry in self.commits]
-        return payload
-
-    @classmethod
-    def from_json(cls, raw: dict[str, Any]) -> "RepairLease":
-        commits = tuple(
-            CommitEntry(
-                commit_oid=_oid(item["commit_oid"], "commit_oid"),
-                parent_oid=_oid(item["parent_oid"], "parent_oid"),
-                paths=tuple(normalize_path(path) for path in item["paths"]),
-                recorded_at=str(item["recorded_at"]),
-            )
-            for item in raw.get("commits", [])
-        )
-        return cls(
-            lease_id=str(raw["lease_id"]),
-            task_id=str(raw["task_id"]),
-            owner_identity=str(raw["owner_identity"]),
-            branch=str(raw["branch"]),
-            description=str(raw["description"]),
-            allowed_paths=tuple(normalize_path(path) for path in raw["allowed_paths"]),
-            initial_head_oid=_oid(raw["initial_head_oid"], "initial_head_oid"),
-            current_head_oid=_oid(raw["current_head_oid"], "current_head_oid"),
-            created_at=str(raw["created_at"]),
-            expires_at=str(raw["expires_at"]),
-            max_expires_at=str(raw["max_expires_at"]),
-            state=str(raw.get("state", "ACTIVE")),
-            revision=int(raw.get("revision", 0)),
-            commits=list(commits),
-            attached=bool(raw.get("attached", False)),
-        )
-
-
-class LeaseStore:
-    """Atomic JSON store for restart-recoverable lease state."""
-
-    def __init__(self, directory: str | os.PathLike[str]) -> None:
-        self.directory = Path(directory)
-        self.directory.mkdir(parents=True, exist_ok=True)
-        if self.directory.is_symlink():
-            raise LeaseError("lease store must not be a symlink")
-        os.chmod(self.directory, 0o700)
-
-    def _path(self, lease_id: str) -> Path:
-        if not re.fullmatch(r"lease-[0-9a-f]{32}", lease_id):
-            raise LeaseError("invalid lease id")
-        return self.directory / f"{lease_id}.json"
-
-    def create(self, lease: RepairLease) -> None:
-        path = self._path(lease.lease_id)
-        if path.exists() or path.is_symlink():
-            raise LeaseError("lease already exists")
-        self._write(path, lease.to_json(), exclusive=True)
-
-    def load(self, lease_id: str) -> RepairLease:
-        path = self._path(lease_id)
-        try:
-            raw = json.loads(path.read_text(encoding="utf-8"))
-        except (OSError, json.JSONDecodeError, TypeError) as exc:
-            raise LeaseError("lease state is unavailable or invalid") from exc
-        if not isinstance(raw, dict):
-            raise LeaseError("lease state must be an object")
-        return RepairLease.from_json(raw)
-
-    def save(self, lease: RepairLease) -> None:
-        self._write(self._path(lease.lease_id), lease.to_json())
-
-    @staticmethod
-    def _write(path: Path, payload: dict[str, Any], *, exclusive: bool = False) -> None:
-        flags = os.O_WRONLY | os.O_CREAT | (os.O_EXCL if exclusive else 0)
-        fd, temp_name = tempfile.mkstemp(prefix=".lease-", dir=path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, ensure_ascii=True, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            if exclusive:
-                os.link(temp_name, path)
-                os.unlink(temp_name)
-            else:
-                os.replace(temp_name, path)
-            os.chmod(path, 0o600)
-        except Exception:
-            try:
-                os.unlink(temp_name)
-            except FileNotFoundError:
-                pass
-            raise
-
-
-class GitProbe:
-    """Read-only Git implementation; it never changes a ref or working tree."""
-
-    def __init__(self, bare_repo: str | os.PathLike[str]) -> None:
-        self.bare_repo = Path(bare_repo)
-
-    def _run(self, args: list[str]) -> str:
-        result = subprocess.run(
-            ["git", "--git-dir", str(self.bare_repo), *args],
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if result.returncode != 0:
-            raise LeaseError("read-only Git probe failed")
-        return result.stdout.strip()
-
-    def branch_head(self, branch: str) -> str:
-        return _oid(self._run(["rev-parse", f"refs/heads/{branch}"]), "branch_head")
-
-    def parent(self, commit: str) -> str:
-        return _oid(self._run(["rev-parse", f"{_oid(commit)}^1"]), "parent")
-
-    def is_ancestor(self, older: str, newer: str) -> bool:
-        old, new = _oid(older), _oid(newer)
-        result = subprocess.run(
-            ["git", "--git-dir", str(self.bare_repo), "merge-base", "--is-ancestor", old, new],
-            check=False,
-        )
-        return result.returncode == 0
-
-    def changed_paths(self, commit: str) -> tuple[str, ...]:
-        raw = self._run(["diff-tree", "--no-commit-id", "--name-only", "-r", _oid(commit)])
-        return tuple(normalize_path(line) for line in raw.splitlines() if line.strip())
-
-    def commits_between(self, older: str, newer: str) -> tuple[str, ...]:
-        raw = self._run(["rev-list", "--reverse", f"{_oid(older)}..{_oid(newer)}"])
-        return tuple(_oid(line, "commit") for line in raw.splitlines() if line.strip())
-
-
-class RepairLeaseManager:
-    """Issue, recover, renew, and close branch-bound repair leases."""
-
-    def __init__(self, store: LeaseStore, git: GitProbeProtocol, *, clock=_now) -> None:
-        self.store = store
-        self.git = git
-        self.clock = clock
-
-    def _require_owner(self, lease: RepairLease, owner_identity: str) -> None:
-        if owner_identity != lease.owner_identity:
-            raise LeaseError("lease identity mismatch")
-
-    def _active(self, lease: RepairLease) -> RepairLease:
-        now = self.clock()
-        if lease.state != "ACTIVE":
-            raise LeaseError(f"lease is {lease.state.lower()}")
-        if now >= _parse_ts(lease.expires_at):
-            lease.state = "EXPIRED"
-            self.store.save(lease)
-            raise LeaseError("lease expired")
-        return lease
-
-    def issue(
-        self,
-        *,
-        task_id: str,
-        owner_identity: str,
-        branch: str,
-        description: str,
-        allowed_paths: Sequence[str],
-        ttl_seconds: int = 3600,
-    ) -> RepairLease:
-        if task_id != TASK_ID:
-            raise LeaseError("unexpected task id")
-        if not owner_identity or not description or len(description) > 240:
-            raise LeaseError("owner identity and description are required")
-        if "\n" in description or "\r" in description:
-            raise LeaseError("description must be a single line")
-        if branch in DENIED_BRANCHES or branch.startswith(("main/", "refs/", "tags/")):
-            raise LeaseError("protected branch cannot receive a repair lease")
-        if not isinstance(ttl_seconds, int) or not 0 < ttl_seconds <= MAX_LEASE_SECONDS:
-            raise LeaseError("lease TTL exceeds the maximum")
-        allowed = tuple(normalize_path(path) for path in allowed_paths)
-        if any(path_is_protected(path) for path in allowed):
-            raise LeaseError("protected path in lease allowlist")
-        head = self.git.branch_head(branch)
-        created = self.clock()
-        expires = created + timedelta(seconds=ttl_seconds)
-        max_expires = created + timedelta(seconds=MAX_LEASE_SECONDS)
-        lease_id = "lease-" + secrets.token_hex(16)
-        lease = RepairLease(
-            lease_id=lease_id,
-            task_id=task_id,
-            owner_identity=owner_identity,
-            branch=branch,
-            description=description,
-            allowed_paths=allowed,
-            initial_head_oid=head,
-            current_head_oid=head,
-            created_at=_ts(created),
-            expires_at=_ts(expires),
-            max_expires_at=_ts(max_expires),
-        )
-        self.store.create(lease)
-        return lease
-
-    def attach_existing_branch(
-        self, lease_id: str, *, owner_identity: str, expected_head_oid: str
-    ) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        current = self.git.branch_head(lease.branch)
-        expected = _oid(expected_head_oid, "expected_head_oid")
-        if current != expected or current != lease.current_head_oid:
-            raise LeaseError("branch head does not match the lease")
-        lease.attached = True
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def authorize_commit(
-        self,
-        lease_id: str,
-        *,
-        owner_identity: str,
-        expected_head_oid: str,
-        paths: Sequence[str],
-        content: Mapping[str, str] | None = None,
-    ) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        expected = _oid(expected_head_oid, "expected_head_oid")
-        current = self.git.branch_head(lease.branch)
-        if current != expected or current != lease.current_head_oid:
-            raise LeaseError("stale or externally advanced branch head")
-        if not lease.attached:
-            raise LeaseError("lease is not attached")
-        validate_paths(paths, lease.allowed_paths)
-        if content and any(contains_secret_like_content(value) for value in content.values()):
-            raise LeaseError("secret-like content rejected")
-        return lease
-
-    def record_commit(
-        self,
-        lease_id: str,
-        *,
-        owner_identity: str,
-        expected_head_oid: str,
-        new_head_oid: str,
-        paths: Sequence[str],
-    ) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        new_head = _oid(new_head_oid, "new_head_oid")
-        expected = _oid(expected_head_oid, "expected_head_oid")
-        if not lease.attached or lease.current_head_oid != expected:
-            raise LeaseError("stale lease head")
-        if self.git.branch_head(lease.branch) != new_head:
-            raise LeaseError("branch head does not match committed head")
-        validate_paths(paths, lease.allowed_paths)
-        if self.git.parent(new_head) != expected or not self.git.is_ancestor(expected, new_head):
-            raise LeaseError("commit is not a fast-forward child of the expected head")
-        actual_paths = self.git.changed_paths(new_head)
-        allowed = validate_paths(actual_paths, lease.allowed_paths)
-        requested = set(validate_paths(paths, lease.allowed_paths))
-        if not set(allowed).issubset(requested):
-            raise LeaseError("commit changed an unrequested path")
-        lease.current_head_oid = new_head
-        lease.revision += 1
-        lease.commits.append(
-            CommitEntry(
-                commit_oid=new_head,
-                parent_oid=expected,
-                paths=allowed,
-                recorded_at=_ts(self.clock()),
-            )
-        )
-        self.store.save(lease)
-        return lease
-
-    def recover(self, lease_id: str, *, owner_identity: str) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        current = self.git.branch_head(lease.branch)
-        if current == lease.current_head_oid:
-            return lease
-        if not self.git.is_ancestor(lease.current_head_oid, current):
-            raise LeaseError("branch moved non-fast-forward")
-        commits = self.git.commits_between(lease.current_head_oid, current)
-        for commit in commits:
-            actual = self.git.changed_paths(commit)
-            validate_paths(actual, lease.allowed_paths)
-        lease.current_head_oid = current
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def renew(self, lease_id: str, *, owner_identity: str, ttl_seconds: int) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        if not isinstance(ttl_seconds, int) or ttl_seconds <= 0:
-            raise LeaseError("renewal TTL must be positive")
-        candidate = self.clock() + timedelta(seconds=ttl_seconds)
-        maximum = _parse_ts(lease.max_expires_at)
-        if candidate > maximum:
-            raise LeaseError("renewal exceeds maximum lease lifetime")
-        lease.expires_at = _ts(candidate)
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def complete(self, lease_id: str, *, owner_identity: str) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        lease.state = "COMPLETED"
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def revoke(self, lease_id: str, *, owner_identity: str) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        lease.state = "REVOKED"
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-
-def sanitized_lease_view(lease: RepairLease) -> dict[str, Any]:
-    """Return lease metadata only; no content, token, or credential values."""
-    return {
-        "lease_id": lease.lease_id,
-        "task_id": lease.task_id,
-        "owner_identity": lease.owner_identity,
-        "branch": lease.branch,
-        "description": lease.description,
-        "initial_head_oid": lease.initial_head_oid,
-        "current_head_oid": lease.current_head_oid,
-        "created_at": lease.created_at,
-        "expires_at": lease.expires_at,
-        "state": lease.state,
-        "revision": lease.revision,
-        "commit_count": len(lease.commits),
-        "attached": lease.attached,
-    }
@@ -1,473 +0,0 @@
-"""Shared primitives for the V2R1C6 governed local writer contract."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import posixpath
-import re
-import socket
-import stat
-import struct
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any, Mapping, Sequence
-
-
-TASK_ID = "V2R1C6_GOVERNED_LOCAL_BOOTSTRAP"
-REPO = "aios/aios"
-PRINCIPAL = "governed-local-bootstrap"
-OIDSIZ = 40
-AUTHORIZATION_TTL = timedelta(hours=2)
-
-
-class GovernedLocalWriterError(Exception):
-    """Base error for governed-local-writer validation and runtime failures."""
-
-
-class AuthorizationError(GovernedLocalWriterError):
-    """Raised when authorization input is invalid, expired, or tampered."""
-
-
-@dataclass(frozen=True)
-class BranchCreatePolicy:
-    """Exact branch creation contract."""
-
-    branch: str
-    base_oid: str
-    head_oid: str
-
-
-@dataclass(frozen=True)
-class BranchAppendPolicy:
-    """Exact append-commit contract for candidate branch updates."""
-
-    branch: str
-    expected_head_oid: str | None
-    allowed_paths: tuple[str, ...]
-
-
-@dataclass(frozen=True)
-class BranchPolicy:
-    """Per-branch operation policies loaded from authorization."""
-
-    create_branch: BranchCreatePolicy | None
-    append_commit: BranchAppendPolicy | None
-
-
-@dataclass(frozen=True)
-class GovernedAuthorization:
-    """Parsed and validated authorization object."""
-
-    task_id: str
-    repo: str
-    created_at: datetime
-    expires_at: datetime
-    authorization_sha256: str
-    one_time_use: bool
-    branch_operations: dict[str, BranchPolicy]
-    denied_operations: tuple[str, ...]
-
-    @property
-    def create_branches(self) -> set[str]:
-        """Branches that are allowed for branch-creation operations."""
-        return {
-            branch
-            for branch, policy in self.branch_operations.items()
-            if policy.create_branch is not None
-        }
-
-    @property
-    def append_branches(self) -> set[str]:
-        """Branches that are allowed for commit-append operations."""
-        return {
-            branch
-            for branch, policy in self.branch_operations.items()
-            if policy.append_commit is not None
-        }
-
-
-@dataclass(frozen=True)
-class PeerIdentity:
-    """Verified peer identity from SO_PEERCRED."""
-
-    pid: int
-    uid: int
-    gid: int
-    executable: str | None
-
-
-@dataclass(frozen=True)
-class FileChange:
-    """Single file modification payload."""
-
-    path: str
-    content: str
-
-
-@dataclass(frozen=True)
-class CreateBranchRequest:
-    """Validated create-branch request payload."""
-
-    branch: str
-    base_oid: str
-    head_oid: str | None
-    authorization_digest: str
-
-
-@dataclass(frozen=True)
-class AppendCommitRequest:
-    """Validated append-commit request payload."""
-
-    branch: str
-    expected_head_oid: str
-    changes: tuple[FileChange, ...]
-    authorization_digest: str
-    commit_message: str = "chore(governance): append governed commit"
-
-
-_OID_RE = re.compile(r"^[0-9a-fA-F]{40}$")
-_DENIED_PATH_SEGMENTS = (
-    "main",
-    "tag",
-    "baseline",
-    "credential",
-    "credentials",
-    "secret",
-    "registry",
-)
-_SECRET_PATTERNS = (
-    re.compile(r"(?i)-----BEGIN [A-Z ]*PRIVATE KEY-----"),
-    re.compile(r"(?i)api[_-]?key\s*[:=]\s*\S+"),
-    re.compile(r"(?i)secret\s*[:=]\s*\S+"),
-    re.compile(r"(?i)password\s*[:=]\s*\S+"),
-    re.compile(r"(?i)token\s*[:=]\s*\S+"),
-)
-_SAFE_SECRET_MARKERS = re.compile(
-    r"(?i)(?:api[_-]?key|secret|password|token)\s*[:=]\s*(?:REDACTED|TEST_FIXTURE|NOT_A_SECRET)"
-)
-
-
-def canonicalize_authorization_payload(payload: Mapping[str, Any]) -> str:
-    """Serialize authorization payload without the signature hash, in canonical form."""
-    canonical = dict(payload)
-    canonical.pop("authorization_sha256", None)
-    return json.dumps(
-        canonical, sort_keys=True, separators=(",", ":"), ensure_ascii=True
-    )
-
-
-def compute_authorization_sha256(payload: Mapping[str, Any]) -> str:
-    """Compute canonical sha256 over authorization payload."""
-    digest = hashlib.sha256()
-    digest.update(canonicalize_authorization_payload(payload).encode("utf-8"))
-    return digest.hexdigest()
-
-
-def _assert_authorization_file_permissions(path: Path) -> None:
-    """Fail-closed checks for root-only secret-like authorization files."""
-    if path.is_symlink():
-        raise AuthorizationError("authorization path must not be a symlink")
-
-    st = path.stat()
-    if not stat.S_ISREG(st.st_mode):
-        raise AuthorizationError("authorization path must be a regular file")
-
-    if (st.st_mode & 0o777) != 0o600:
-        raise AuthorizationError("authorization file mode must be exactly 0600")
-
-    if hasattr(st, "st_uid") and os.name != "nt" and st.st_uid != 0:
-        raise AuthorizationError("authorization file owner must be uid 0")
-
-
-def _parse_iso8601(value: str) -> datetime:
-    """Parse ISO 8601 timestamps used by authorization payloads."""
-    try:
-        if value.endswith("Z"):
-            value = value[:-1] + "+00:00"
-        parsed = datetime.fromisoformat(value)
-    except (TypeError, ValueError) as exc:
-        raise AuthorizationError("created_at must be an ISO 8601 timestamp") from exc
-
-    if parsed.tzinfo is None:
-        parsed = parsed.replace(tzinfo=timezone.utc)
-    return parsed
-
-
-def _require_type(value: Any, expected: type, *, key: str) -> None:
-    if not isinstance(value, expected):
-        raise AuthorizationError(f"{key} must be {expected.__name__}")
-
-
-def _parse_oid(value: Any, *, field: str) -> str:
-    if not isinstance(value, str):
-        raise AuthorizationError(f"{field} must be a string")
-    if not _OID_RE.fullmatch(value):
-        raise AuthorizationError(f"{field} must be a 40-char hex object id")
-    return value.lower()
-
-
-def _parse_allowed_paths(paths: Any) -> tuple[str, ...]:
-    if not isinstance(paths, list) or not paths:
-        raise AuthorizationError("allowed_paths must be a non-empty list")
-    normalized: list[str] = []
-    for path in paths:
-        if not isinstance(path, str) or not path.strip():
-            raise AuthorizationError("allowed_paths entries must be non-empty strings")
-        normalized.append(path.strip())
-    return tuple(normalized)
-
-
-def parse_authorization(
-    raw: Mapping[str, Any], *, now: datetime | None = None
-) -> GovernedAuthorization:
-    """Validate an authorization payload and return a typed object."""
-    _require_type(raw.get("task_id"), str, key="task_id")
-    if raw["task_id"] != TASK_ID:
-        raise AuthorizationError("unexpected task_id")
-
-    _require_type(raw.get("repo"), str, key="repo")
-    if raw["repo"] != REPO:
-        raise AuthorizationError("unexpected repo value")
-
-    created_at = _parse_iso8601(raw.get("created_at"))
-    check_time = now or datetime.now(tz=timezone.utc)
-    if created_at.tzinfo is None:
-        created_at = created_at.replace(tzinfo=timezone.utc)
-    if created_at - check_time > timedelta(seconds=30):
-        raise AuthorizationError("authorization created_at is in the future")
-    if check_time - created_at > AUTHORIZATION_TTL:
-        raise AuthorizationError("authorization expired")
-    raw_expires_at = raw.get("expires_at")
-    expires_at = (
-        _parse_iso8601(raw_expires_at)
-        if raw_expires_at is not None
-        else created_at + AUTHORIZATION_TTL
-    )
-    if expires_at <= check_time:
-        raise AuthorizationError("authorization expiry is in the past")
-    if expires_at > created_at + AUTHORIZATION_TTL:
-        raise AuthorizationError("authorization expiry exceeds two-hour maximum")
-
-    _require_type(raw.get("one_time_use"), bool, key="one_time_use")
-    if raw["one_time_use"] is not True:
-        raise AuthorizationError("one_time_use must be true")
-
-    _require_type(raw.get("authorization_sha256"), str, key="authorization_sha256")
-    expected_hash = compute_authorization_sha256(raw)
-    provided_hash = str(raw["authorization_sha256"]).lower()
-    if provided_hash != expected_hash:
-        raise AuthorizationError("authorization_sha256 mismatch")
-
-    op_map = raw.get("allowed_branch_operations")
-    if not isinstance(op_map, dict) or not op_map:
-        raise AuthorizationError("allowed_branch_operations must be a non-empty object")
-
-    branch_operations: dict[str, BranchPolicy] = {}
-    for branch, operation in op_map.items():
-        if not isinstance(branch, str) or not branch.strip():
-            raise AuthorizationError("branch names must be non-empty strings")
-
-        if not isinstance(operation, dict):
-            raise AuthorizationError("operation policy must be an object")
-
-        create_block = operation.get("create_branch")
-        append_block = operation.get("append_commit")
-
-        create_policy: BranchCreatePolicy | None = None
-        append_policy: BranchAppendPolicy | None = None
-
-        if create_block is not None:
-            if not isinstance(create_block, dict):
-                raise AuthorizationError("create_branch block must be an object")
-            raw_head_oid = create_block.get("head_oid")
-            create_policy = BranchCreatePolicy(
-                branch=branch,
-                base_oid=_parse_oid(create_block.get("base_oid"), field="create_branch.base_oid"),
-                head_oid=(
-                    _parse_oid(raw_head_oid, field="create_branch.head_oid")
-                    if raw_head_oid is not None
-                    else None
-                ),
-            )
-
-        if append_block is not None:
-            if not isinstance(append_block, dict):
-                raise AuthorizationError("append_commit block must be an object")
-            raw_expected_head_oid = append_block.get("expected_head_oid")
-            append_policy = BranchAppendPolicy(
-                branch=branch,
-                expected_head_oid=(
-                    _parse_oid(
-                        raw_expected_head_oid,
-                        field="append_commit.expected_head_oid",
-                    )
-                    if raw_expected_head_oid is not None
-                    else None
-                ),
-                allowed_paths=_parse_allowed_paths(append_block.get("allowed_paths")),
-            )
-
-        if create_policy is None and append_policy is None:
-            raise AuthorizationError("branch policy must define at least one operation")
-
-        branch_operations[branch] = BranchPolicy(
-            create_branch=create_policy, append_commit=append_policy
-        )
-
-    denied_raw = raw.get("denied_operations", ())
-    if not isinstance(denied_raw, list):
-        raise AuthorizationError("denied_operations must be a list")
-    denied_operations: list[str] = []
-    for value in denied_raw:
-        if not isinstance(value, str):
-            raise AuthorizationError("denied operations must be strings")
-        denied_operations.append(value.lower())
-
-    return GovernedAuthorization(
-        task_id=raw["task_id"],
-        repo=raw["repo"],
-        created_at=created_at,
-        expires_at=expires_at,
-        authorization_sha256=provided_hash,
-        one_time_use=True,
-        branch_operations=branch_operations,
-        denied_operations=tuple(denied_operations),
-    )
-
-
-def load_authorization_file(
-    path: str | os.PathLike[str], *, now: datetime | None = None
-) -> GovernedAuthorization:
-    """Load and validate the root-only authorization file."""
-    auth_path = Path(path)
-    _assert_authorization_file_permissions(auth_path)
-    try:
-        raw_text = auth_path.read_text(encoding="utf-8")
-    except (OSError, ValueError) as exc:
-        raise AuthorizationError("unable to read authorization file") from exc
-
-    try:
-        raw_obj = json.loads(raw_text)
-    except json.JSONDecodeError as exc:
-        raise AuthorizationError("authorization must be JSON") from exc
-
-    if not isinstance(raw_obj, dict):
-        raise AuthorizationError("authorization top-level must be an object")
-
-    return parse_authorization(raw_obj, now=now)
-
-
-def _resolve_peer_executable(pid: int) -> str | None:
-    """Resolve peer executable from /proc/<pid>/exe when available."""
-    if pid <= 0:
-        return None
-    exe_path = f"/proc/{pid}/exe"
-    try:
-        return os.readlink(exe_path)
-    except OSError:
-        return None
-
-
-def extract_peer_identity(
-    connection: socket.socket, *, require_root_uid: bool = True
-) -> PeerIdentity:
-    """Validate SO_PEERCRED and return peer identity."""
-    if not hasattr(socket, "SO_PEERCRED"):
-        raise AuthorizationError("SO_PEERCRED not available on this platform")
-
-    data = connection.getsockopt(
-        socket.SOL_SOCKET,
-        socket.SO_PEERCRED,
-        struct.calcsize("3i"),
-    )
-    if len(data) != struct.calcsize("3i"):
-        raise AuthorizationError("SO_PEERCRED payload size mismatch")
-
-    pid, uid, gid = struct.unpack("3i", data)
-    if require_root_uid and uid != 0:
-        raise PermissionError("peer uid must be 0")
-
-    return PeerIdentity(
-        pid=pid,
-        uid=uid,
-        gid=gid,
-        executable=_resolve_peer_executable(pid),
-    )
-
-
-def _normalize_file_path(path: str) -> str:
-    normalized = posixpath.normpath(path.replace("\\", "/").strip())
-    return normalized.lstrip("/")
-
-
-def _path_has_disallowed_segment(path: str) -> bool:
-    lowered = path.lower()
-    if ".." in path.split("/"):
-        return True
-    parts = [p for p in lowered.split("/") if p]
-    for part in parts:
-        for segment in _DENIED_PATH_SEGMENTS:
-            if part == segment or part.startswith(f"{segment}.") or segment in part:
-                return True
-    return False
-
-
-def _is_allowed_path(path: str, allowed_paths: Sequence[str]) -> bool:
-    normalized = _normalize_file_path(path)
-    for prefix in allowed_paths:
-        normalized_prefix = _normalize_file_path(prefix)
-        if normalized == normalized_prefix:
-            return True
-        if normalized.startswith(normalized_prefix + "/"):
-            return True
-    return False
-
-
-def contains_secret_like_content(content: str) -> bool:
-    """Heuristic detector for obvious secret-like strings."""
-    content = _SAFE_SECRET_MARKERS.sub("", content or "")
-    for pattern in _SECRET_PATTERNS:
-        if pattern.search(content):
-            return True
-    return False
-
-
-def validate_file_changes(
-    changes: Any, allowed_paths: Sequence[str]
-) -> tuple[FileChange, ...]:
-    """Validate append-commit file changes against path and content policy."""
-    if not isinstance(changes, list):
-        raise AuthorizationError("changes must be a list")
-    result: list[FileChange] = []
-
-    for change in changes:
-        if not isinstance(change, Mapping):
-            raise AuthorizationError("each file change must be an object")
-        raw_path = change.get("path")
-        raw_content = change.get("content")
-        if not isinstance(raw_path, str) or not raw_path.strip():
-            raise AuthorizationError("file change path must be a non-empty string")
-        if raw_path.startswith(("/", "\\")):
-            raise AuthorizationError("file change path must be relative")
-        if not isinstance(raw_content, str):
-            raise AuthorizationError("file change content must be a string")
-
-        normalized = _normalize_file_path(raw_path)
-        if not normalized or normalized.startswith("../") or normalized == "..":
-            raise AuthorizationError("file paths must be normalized relative paths")
-
-        if not _is_allowed_path(normalized, allowed_paths):
-            raise AuthorizationError("file path outside allowed_paths")
-
-        if _path_has_disallowed_segment(normalized):
-            raise AuthorizationError("file path uses denied segment")
-
-        if contains_secret_like_content(raw_content):
-            raise AuthorizationError("file content failed secret-like scan")
-
-        result.append(FileChange(path=normalized, content=raw_content))
-
-    return tuple(result)
@@ -1,47 +0,0 @@
-"""Supplement Gitea native protection when review identity is not expressible."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Any, Mapping, Sequence
-
-
-class MergeGateDenied(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True)
-class MergeGateDecision:
-    allowed: bool
-    owner_review_id: int
-    required_contexts: tuple[str, ...]
-
-
-def validate_protected_merge(
-    pull_request: Mapping[str, Any],
-    reviews: Sequence[Mapping[str, Any]],
-    statuses: Mapping[str, str],
-    *,
-    required_contexts: Sequence[str],
-    unresolved_conversations: int,
-    owner_login: str = "owner",
-    owner_id: int = 2,
-) -> MergeGateDecision:
-    if pull_request.get("state") != "open" or pull_request.get("mergeable") is not True:
-        raise MergeGateDenied("pull_request_not_mergeable")
-    author = (pull_request.get("user") or {}).get("login")
-    owner_review = None
-    for review in reviews:
-        user = review.get("user") or {}
-        if review.get("state") == "APPROVED" and user.get("login") == owner_login and user.get("id") == owner_id:
-            if author == owner_login or (pull_request.get("author_id") == owner_id):
-                raise MergeGateDenied("pr_author_self_approval_denied")
-            owner_review = review
-    if owner_review is None:
-        raise MergeGateDenied("owner_review_required")
-    if unresolved_conversations != 0:
-        raise MergeGateDenied("unresolved_conversations_block_merge")
-    missing = [context for context in required_contexts if statuses.get(context) != "success"]
-    if missing:
-        raise MergeGateDenied("required_checks_missing:" + ",".join(missing))
-    return MergeGateDecision(True, int(owner_review.get("id", 0)), tuple(required_contexts))
-
@@ -27,7 +27,12 @@ POLICY_FIELDS = frozenset(
 )
 OPERATION_FIELDS = frozenset({"exact_paths", "max_content_bytes", "content_profile"})
 SUPPORTED_OPERATIONS = frozenset({"commit_file.atomic"})
-SUPPORTED_CONTENT_PROFILES = frozenset({"systemd-codex-review-worker-v1"})
+SUPPORTED_CONTENT_PROFILES = frozenset(
+    {
+        "systemd-codex-review-worker-v1",
+        "candidate-session-broker-source-v1",
+    }
+)
 _SECRET_RE = re.compile(
    r"(?i)(authorization\s*:|bearer\s+|(?:token|password|secret)\s*[:=])"
 )
@@ -353,9 +358,73 @@ def validate_content(operation: str, path: str, content: str) -> None:
    if selected.content_profile == "systemd-codex-review-worker-v1":
        _validate_systemd_codex_review_worker(content)
        return
+    if selected.content_profile == "candidate-session-broker-source-v1":
+        _validate_candidate_session_broker_source(path, content)
+        return
    raise PathPolicyError("isolated_writer_path_policy_profile_rejected")


+def _validate_candidate_session_broker_source(path: str, content: str) -> None:
+    if (
+        not isinstance(content, str)
+        or "\x00" in content
+        or "\r" in content
+        or not content.endswith("\n")
+    ):
+        raise PathPolicyError("isolated_writer_candidate_source_profile_rejected")
+    forbidden = (
+        "BEGIN PRIVATE KEY",
+        "GITEA_DATABASE",
+        "gitea admin",
+        "ssh-keyscan",
+        "/home/aiman/.codex",
+        "/root/.codex",
+        "AIOS_GITOPS_ALLOW_MAIN_WRITE=true",
+        "AIOS_GITOPS_ALLOW_TAG_WRITE=true",
+        "AIOS_GITOPS_ALLOW_BASELINE_WRITE=true",
+        "AIOS_GITOPS_ALLOW_REGISTRY_WRITE=true",
+        "AIOS_TASK_PLANE_EXECUTION_ENABLED=true",
+        "AIOS_SILENT_RELEASE_EXECUTION_ENABLED=true",
+    )
+    if any(value in content for value in forbidden):
+        raise PathPolicyError("isolated_writer_candidate_source_profile_rejected")
+    if path.endswith(".py"):
+        try:
+            compile(content, path, "exec")
+        except (SyntaxError, ValueError, TypeError):
+            raise PathPolicyError("isolated_writer_candidate_source_profile_rejected") from None
+        return
+    if path.endswith(".service"):
+        if _SECRET_RE.search(content):
+            raise PathPolicyError("isolated_writer_candidate_source_profile_rejected")
+        required = (
+            "User=aiman",
+            "Group=gitops",
+            "UMask=0077",
+            "NoNewPrivileges=true",
+            "PrivateTmp=true",
+            "PrivateDevices=true",
+            "ProtectSystem=strict",
+            "ProtectHome=true",
+            "ProtectKernelTunables=true",
+            "ProtectKernelModules=true",
+            "ProtectControlGroups=true",
+            "LockPersonality=true",
+            "RestrictSUIDSGID=true",
+            "RestrictRealtime=true",
+            "127.0.0.1",
+        )
+        if any(value not in content for value in required):
+            raise PathPolicyError("isolated_writer_candidate_source_profile_rejected")
+        for line in content.splitlines():
+            if line.startswith("Environment=") and re.search(
+                r"(?i)(token|password|secret|private[_-]?key)=", line
+            ):
+                raise PathPolicyError("isolated_writer_candidate_source_profile_rejected")
+        return
+    raise PathPolicyError("isolated_writer_candidate_source_profile_rejected")
+
+
 def _validate_systemd_codex_review_worker(content: str) -> None:
    if not isinstance(content, str):
        raise PathPolicyError("isolated_writer_systemd_profile_rejected")
@@ -1,611 +0,0 @@
-"""Audited Owner authorization broker for task-scoped writer provisioning.
-
-The broker closes the bootstrap gap without minting a new general-purpose
-Owner token and without modifying the bearer-token registry. It accepts an
-already-authenticated, explicitly allow-listed Owner principal, records a
-tamper-evident authorization event, and invokes the existing
-AuthorizedTaskWriterProvisioner with a generated authorization reference.
-
-The broker never writes Git refs itself. The governed signer, validator and
-one-shot provisioner remain the only components allowed to create the task
-branch/worktree/writer.
-"""
-from __future__ import annotations
-
-import fcntl
-import hashlib
-import json
-import os
-import re
-import tempfile
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any, Mapping, Protocol
-
-from authorized_task_writer_provisioning import (
-    AuthorizedTaskWriterProvisioner,
-    BRANCH_RE,
-    OID_RE,
-    OwnerContext,
-    ProvisioningError,
-    REQUIRED_ALLOWED_OPERATIONS,
-    REQUIRED_DENIED_OPERATIONS,
-    TASK_RE,
-)
-
-
-ACTION = "AUTHORIZE_TASK_WRITER_PROVISIONING"
-SCHEMA = "aios.owner-authorization-event.v1"
-BROKER_REQUEST_FIELDS = frozenset(
-    {
-        "action",
-        "task_id",
-        "repository",
-        "base_ref",
-        "base_oid",
-        "target_branch",
-        "one_time_use",
-        "expires_in_seconds",
-        "production_change_authorized",
-        "tag_change_authorized",
-        "baseline_change_authorized",
-        "main_write_authorized",
-        "allowed_operations",
-        "denied_operations",
-    }
-)
-IDENTITY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._@:+/-]{1,254}$")
-SCOPE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{1,127}$")
-CREDENTIAL_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:@+-]{1,255}$")
-WILDCARD_SCOPE_RE = re.compile(r"(^\*$)|(^.+:\*$)")
-
-
-class OwnerAuthorizationError(RuntimeError):
-    """Stable fail-closed broker error."""
-
-    def __init__(
-        self,
-        code: str,
-        status: int = 400,
-        *,
-        details: Mapping[str, Any] | None = None,
-    ) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-        self.details = dict(details or {})
-
-
-@dataclass(frozen=True)
-class OwnerPrincipal:
-    """Non-secret authentication evidence returned by the existing API."""
-
-    identity: str
-    role: str
-    authenticated_scope: str
-    token_scopes: frozenset[str]
-    credential_id: str = ""
-
-
-@dataclass(frozen=True)
-class OwnerAuthorizationBrokerConfig:
-    repository_identity: str
-    state_root: Path
-    allowed_owner_identities: frozenset[str]
-    allowed_intake_scopes: frozenset[str]
-    allowed_credential_ids: frozenset[str] = frozenset()
-    max_expiry_seconds: int = 900
-
-    @classmethod
-    def from_environment(cls) -> "OwnerAuthorizationBrokerConfig":
-        identities = _csv_set(
-            os.getenv("AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_IDENTITIES", "")
-        )
-        scopes = _csv_set(
-            os.getenv("AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES", "")
-        )
-        credential_ids = _csv_set(
-            os.getenv("AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_CREDENTIAL_IDS", "")
-        )
-        if not identities:
-            raise OwnerAuthorizationError(
-                "OWNER_IDENTITY_ALLOWLIST_REQUIRED", 503
-            )
-        if not scopes:
-            raise OwnerAuthorizationError(
-                "OWNER_INTAKE_SCOPE_ALLOWLIST_REQUIRED", 503
-            )
-        if any(_is_wildcard_scope(item) for item in scopes):
-            raise OwnerAuthorizationError(
-                "WILDCARD_INTAKE_SCOPE_REJECTED", 503
-            )
-        if "writer:provision" in scopes:
-            raise OwnerAuthorizationError(
-                "WRITER_PROVISION_SCOPE_BOOTSTRAP_REJECTED", 503
-            )
-        try:
-            maximum = int(
-                os.getenv(
-                    "AIOS_GITOPS_OWNER_AUTHORIZATION_MAX_EXPIRY_SECONDS", "900"
-                )
-            )
-        except ValueError:
-            raise OwnerAuthorizationError(
-                "BROKER_MAX_EXPIRY_INVALID", 503
-            ) from None
-        if maximum < 60 or maximum > 1800:
-            raise OwnerAuthorizationError("BROKER_MAX_EXPIRY_INVALID", 503)
-        return cls(
-            repository_identity=os.getenv(
-                "AIOS_GITOPS_REPOSITORY_IDENTITY", "aios/aios"
-            ).strip(),
-            state_root=Path(
-                os.getenv(
-                    "AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT",
-                    "/var/lib/aios-gitops/owner-authorization-broker",
-                )
-            ),
-            allowed_owner_identities=identities,
-            allowed_intake_scopes=scopes,
-            allowed_credential_ids=credential_ids,
-            max_expiry_seconds=maximum,
-        )
-
-
-class TaskWriterProvisioner(Protocol):
-    def provision(
-        self, raw: Mapping[str, Any], owner: OwnerContext
-    ) -> dict[str, Any]:
-        ...
-
-
-def utc_now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def iso_utc(value: datetime) -> str:
-    return value.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def canonical_json_bytes(value: Any) -> bytes:
-    return (
-        json.dumps(
-            value,
-            ensure_ascii=False,
-            sort_keys=True,
-            separators=(",", ":"),
-        )
-        + "\n"
-    ).encode("utf-8")
-
-
-def sha256_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
-
-
-def _csv_set(value: str) -> frozenset[str]:
-    return frozenset(
-        item.strip() for item in value.split(",") if item.strip()
-    )
-
-
-def _is_wildcard_scope(scope: str) -> bool:
-    return bool(WILDCARD_SCOPE_RE.fullmatch(scope.strip()))
-
-
-def _atomic_write_json(path: Path, value: Any, mode: int = 0o600) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    if path.parent.is_symlink() or path.is_symlink():
-        raise OwnerAuthorizationError("BROKER_STATE_SYMLINK_REJECTED", 500)
-    fd, temporary = tempfile.mkstemp(prefix=".tmp-", dir=path.parent)
-    try:
-        os.fchmod(fd, mode)
-        with os.fdopen(fd, "wb", closefd=True) as stream:
-            stream.write(canonical_json_bytes(value))
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(temporary, path)
-        os.chmod(path, mode)
-        parent_fd = os.open(
-            path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
-        )
-        try:
-            os.fsync(parent_fd)
-        finally:
-            os.close(parent_fd)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def _read_json(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise OwnerAuthorizationError("BROKER_RECEIPT_INVALID", 500)
-    if path.stat().st_size <= 0 or path.stat().st_size > 1_048_576:
-        raise OwnerAuthorizationError("BROKER_RECEIPT_INVALID", 500)
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        raise OwnerAuthorizationError(
-            "BROKER_RECEIPT_JSON_INVALID", 500
-        ) from None
-    if not isinstance(value, dict):
-        raise OwnerAuthorizationError("BROKER_RECEIPT_INVALID", 500)
-    return value
-
-
-def _prepare_state_root(root: Path) -> None:
-    if root.is_symlink():
-        raise OwnerAuthorizationError("BROKER_STATE_SYMLINK_REJECTED", 500)
-    root.mkdir(parents=True, exist_ok=True, mode=0o700)
-    os.chmod(root, 0o700)
-    if root.stat().st_mode & 0o077:
-        raise OwnerAuthorizationError(
-            "BROKER_STATE_PERMISSIONS_REJECTED", 500
-        )
-
-
-def _event_id(
-    principal: OwnerPrincipal, request_digest: str
-) -> str:
-    material = (
-        f"{principal.identity}\0{principal.authenticated_scope}\0"
-        f"{request_digest}"
-    ).encode("utf-8")
-    return "owner-auth-" + hashlib.sha256(material).hexdigest()[:32]
-
-
-def _authorization_reference(event_id: str, request_digest: str) -> str:
-    return f"owner-auth:{event_id}:{request_digest[:16]}"
-
-
-def _validate_principal(
-    principal: OwnerPrincipal,
-    config: OwnerAuthorizationBrokerConfig,
-) -> None:
-    if principal.role != "owner":
-        raise OwnerAuthorizationError("OWNER_ROLE_REQUIRED", 403)
-    if (
-        not principal.identity
-        or not IDENTITY_RE.fullmatch(principal.identity)
-        or principal.identity not in config.allowed_owner_identities
-    ):
-        raise OwnerAuthorizationError("OWNER_IDENTITY_NOT_ALLOWED", 403)
-    if (
-        not principal.authenticated_scope
-        or not SCOPE_RE.fullmatch(principal.authenticated_scope)
-        or principal.authenticated_scope
-        not in config.allowed_intake_scopes
-    ):
-        raise OwnerAuthorizationError("OWNER_INTAKE_SCOPE_REJECTED", 403)
-    if principal.authenticated_scope == "writer:provision":
-        raise OwnerAuthorizationError(
-            "WRITER_PROVISION_SCOPE_BOOTSTRAP_REJECTED", 403
-        )
-
-    scopes = principal.token_scopes
-    if any(_is_wildcard_scope(scope) for scope in scopes):
-        raise OwnerAuthorizationError(
-            "WILDCARD_OWNER_CREDENTIAL_REJECTED", 403
-        )
-    if scopes:
-        if principal.authenticated_scope not in scopes:
-            raise OwnerAuthorizationError(
-                "OWNER_SCOPE_EVIDENCE_MISMATCH", 403
-            )
-    elif (
-        not principal.credential_id
-        or principal.credential_id not in config.allowed_credential_ids
-    ):
-        # handler.need(scope) proves authorization but may hide whether the
-        # credential was wildcard. When scope metadata is absent, require an
-        # exact non-secret credential ID allowlist as the alternative proof.
-        raise OwnerAuthorizationError(
-            "OWNER_CREDENTIAL_SCOPE_NOT_PROVABLE", 403
-        )
-    if principal.credential_id:
-        if not CREDENTIAL_ID_RE.fullmatch(principal.credential_id):
-            raise OwnerAuthorizationError("OWNER_CREDENTIAL_ID_INVALID", 403)
-        if (
-            config.allowed_credential_ids
-            and principal.credential_id not in config.allowed_credential_ids
-        ):
-            raise OwnerAuthorizationError(
-                "OWNER_CREDENTIAL_ID_NOT_ALLOWED", 403
-            )
-
-
-def _validate_request(
-    raw: Mapping[str, Any],
-    config: OwnerAuthorizationBrokerConfig,
-) -> dict[str, Any]:
-    if set(raw) != BROKER_REQUEST_FIELDS:
-        raise OwnerAuthorizationError("BROKER_REQUEST_FIELDS_REJECTED")
-    if raw["action"] != ACTION:
-        raise OwnerAuthorizationError("BROKER_ACTION_REJECTED")
-    if raw["repository"] != config.repository_identity:
-        raise OwnerAuthorizationError(
-            "REPOSITORY_IDENTITY_MISMATCH", 409
-        )
-    if raw["base_ref"] != "refs/heads/main":
-        raise OwnerAuthorizationError("BASE_REF_REJECTED", 409)
-    if (
-        not isinstance(raw["base_oid"], str)
-        or not OID_RE.fullmatch(raw["base_oid"])
-    ):
-        raise OwnerAuthorizationError("BASE_OID_REJECTED")
-    if (
-        not isinstance(raw["target_branch"], str)
-        or not BRANCH_RE.fullmatch(raw["target_branch"])
-        or raw["target_branch"] in {"main", "master"}
-    ):
-        raise OwnerAuthorizationError("TARGET_BRANCH_REJECTED")
-    if (
-        not isinstance(raw["task_id"], str)
-        or not TASK_RE.fullmatch(raw["task_id"])
-    ):
-        raise OwnerAuthorizationError("TASK_ID_REJECTED")
-    if raw["one_time_use"] is not True:
-        raise OwnerAuthorizationError("ONE_TIME_USE_REQUIRED")
-    expiry = raw["expires_in_seconds"]
-    if (
-        not isinstance(expiry, int)
-        or isinstance(expiry, bool)
-        or not 60 <= expiry <= config.max_expiry_seconds
-    ):
-        raise OwnerAuthorizationError("GRANT_LIFETIME_REJECTED")
-    for field in (
-        "production_change_authorized",
-        "tag_change_authorized",
-        "baseline_change_authorized",
-        "main_write_authorized",
-    ):
-        if raw[field] is not False:
-            raise OwnerAuthorizationError(
-                "PRODUCTION_CAPABILITY_REJECTED", 403
-            )
-    allowed = raw["allowed_operations"]
-    denied = raw["denied_operations"]
-    if (
-        not isinstance(allowed, list)
-        or frozenset(allowed) != REQUIRED_ALLOWED_OPERATIONS
-    ):
-        raise OwnerAuthorizationError("ALLOWED_OPERATIONS_MISMATCH", 403)
-    if (
-        not isinstance(denied, list)
-        or frozenset(denied) != REQUIRED_DENIED_OPERATIONS
-    ):
-        raise OwnerAuthorizationError("DENIED_OPERATIONS_MISMATCH", 403)
-    return dict(raw)
-
-
-def _response_is_safe(value: Any) -> bool:
-    """Reject accidental credential material before writing a receipt."""
-
-    sensitive_markers = (
-        "access_token",
-        "bearer",
-        "client_secret",
-        "private_key",
-        "raw_token",
-        "secret_value",
-    )
-    if isinstance(value, Mapping):
-        for key, inner in value.items():
-            lowered = str(key).lower()
-            if any(marker in lowered for marker in sensitive_markers):
-                return False
-            if not _response_is_safe(inner):
-                return False
-    elif isinstance(value, list):
-        return all(_response_is_safe(item) for item in value)
-    return True
-
-
-class OwnerAuthorizationBroker:
-    """Create an audited Owner event and invoke the governed bridge."""
-
-    def __init__(
-        self,
-        config: OwnerAuthorizationBrokerConfig | None = None,
-        provisioner: TaskWriterProvisioner | None = None,
-    ) -> None:
-        self.config = (
-            config or OwnerAuthorizationBrokerConfig.from_environment()
-        )
-        self.provisioner = provisioner or AuthorizedTaskWriterProvisioner()
-
-    def authorize_and_provision(
-        self,
-        raw: Mapping[str, Any],
-        principal: OwnerPrincipal,
-    ) -> dict[str, Any]:
-        config = self.config
-        _validate_principal(principal, config)
-        request = _validate_request(raw, config)
-        _prepare_state_root(config.state_root)
-
-        request_digest = sha256_json(request)
-        event_id = _event_id(principal, request_digest)
-        reference = _authorization_reference(event_id, request_digest)
-        event_dir = config.state_root / "events" / event_id
-        event_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
-        os.chmod(event_dir, 0o700)
-
-        lock_path = event_dir / "event.lock"
-        lock_path.touch(mode=0o600, exist_ok=True)
-        os.chmod(lock_path, 0o600)
-        with lock_path.open("r+b") as lock:
-            fcntl.flock(lock.fileno(), fcntl.LOCK_EX)
-            response_path = event_dir / "response.json"
-            event_path = event_dir / "event.json"
-
-            if response_path.exists():
-                response = _read_json(response_path)
-                response["owner_authorization_idempotent"] = True
-                return response
-
-            issued_at = utc_now()
-            expires_at = issued_at + timedelta(
-                seconds=int(request["expires_in_seconds"])
-            )
-            event: dict[str, Any] = {
-                "schema": SCHEMA,
-                "event_id": event_id,
-                "authorization_reference": reference,
-                "status": "AUTHORIZED",
-                "owner": {
-                    "identity": principal.identity,
-                    "role": principal.role,
-                    "authenticated_scope": principal.authenticated_scope,
-                    "credential_id": principal.credential_id or None,
-                    "token_scope_digest_sha256": sha256_json(
-                        sorted(principal.token_scopes)
-                    ),
-                    "wildcard_scope_used": False,
-                },
-                "request": {
-                    "task_id": request["task_id"],
-                    "repository": request["repository"],
-                    "base_ref": request["base_ref"],
-                    "base_oid": request["base_oid"],
-                    "target_branch": request["target_branch"],
-                    "one_time_use": True,
-                    "production_change_authorized": False,
-                    "tag_change_authorized": False,
-                    "baseline_change_authorized": False,
-                    "main_write_authorized": False,
-                    "allowed_operations": sorted(
-                        REQUIRED_ALLOWED_OPERATIONS
-                    ),
-                    "denied_operations": sorted(
-                        REQUIRED_DENIED_OPERATIONS
-                    ),
-                },
-                "request_digest_sha256": request_digest,
-                "issued_at": iso_utc(issued_at),
-                "expires_at": iso_utc(expires_at),
-            }
-            event["event_digest_sha256"] = sha256_json(event)
-            _atomic_write_json(event_path, event)
-
-            bridge_request = dict(request)
-            bridge_request.pop("action")
-            bridge_request["owner_authorization_reference"] = reference
-            try:
-                result = self.provisioner.provision(
-                    bridge_request,
-                    OwnerContext(
-                        identity=principal.identity,
-                        role=principal.role,
-                        authorization_reference=reference,
-                    ),
-                )
-                if not isinstance(result, dict):
-                    raise OwnerAuthorizationError(
-                        "PROVISIONER_RESPONSE_INVALID", 502
-                    )
-                if result.get("status") != "READY_FOR_CODE_AUTHORING":
-                    raise OwnerAuthorizationError(
-                        "PROVISIONER_NOT_READY",
-                        409,
-                        details={"status": result.get("status")},
-                    )
-                if not _response_is_safe(result):
-                    raise OwnerAuthorizationError(
-                        "PROVISIONER_RESPONSE_CONTAINS_SENSITIVE_DATA", 500
-                    )
-            except ProvisioningError as exc:
-                event.update(
-                    {
-                        "status": "PROVISIONING_BLOCKED",
-                        "failed_at": iso_utc(utc_now()),
-                        "error": exc.code,
-                        "error_status": exc.status,
-                    }
-                )
-                event["event_digest_sha256"] = sha256_json(
-                    {
-                        key: value
-                        for key, value in event.items()
-                        if key != "event_digest_sha256"
-                    }
-                )
-                _atomic_write_json(event_path, event)
-                raise
-            except OwnerAuthorizationError as exc:
-                event.update(
-                    {
-                        "status": "PROVISIONING_BLOCKED",
-                        "failed_at": iso_utc(utc_now()),
-                        "error": exc.code,
-                        "error_status": exc.status,
-                    }
-                )
-                event["event_digest_sha256"] = sha256_json(
-                    {
-                        key: value
-                        for key, value in event.items()
-                        if key != "event_digest_sha256"
-                    }
-                )
-                _atomic_write_json(event_path, event)
-                raise
-            except Exception as exc:
-                event.update(
-                    {
-                        "status": "PROVISIONING_FAILED",
-                        "failed_at": iso_utc(utc_now()),
-                        "error": "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR",
-                    }
-                )
-                event["event_digest_sha256"] = sha256_json(
-                    {
-                        key: value
-                        for key, value in event.items()
-                        if key != "event_digest_sha256"
-                    }
-                )
-                _atomic_write_json(event_path, event)
-                raise OwnerAuthorizationError(
-                    "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR", 500
-                ) from exc
-
-            completed_at = utc_now()
-            event.update(
-                {
-                    "status": "CONSUMED",
-                    "consumed_at": iso_utc(completed_at),
-                    "approval_plan_id": result.get("approval_plan_id"),
-                    "grant_id": result.get("grant_id"),
-                    "grant_digest_sha256": result.get(
-                        "grant_digest_sha256"
-                    ),
-                    "branch_oid": result.get("branch_oid"),
-                    "grant_consumed": result.get("grant_consumed") is True,
-                }
-            )
-            event["event_digest_sha256"] = sha256_json(
-                {
-                    key: value
-                    for key, value in event.items()
-                    if key != "event_digest_sha256"
-                }
-            )
-            _atomic_write_json(event_path, event)
-
-            response = dict(result)
-            response.update(
-                {
-                    "owner_authorization_event_id": event_id,
-                    "owner_authorization_reference": reference,
-                    "owner_authorization_digest_sha256": event[
-                        "event_digest_sha256"
-                    ],
-                    "owner_authorization_consumed": True,
-                    "owner_authorization_idempotent": False,
-                }
-            )
-            _atomic_write_json(response_path, response)
-            return response
@@ -1,32 +0,0 @@
-"""Read-only release reconciliation and durable follow-up intent."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Any, Mapping
-
-
-@dataclass(frozen=True)
-class ReconciliationReport:
-    healthy: bool
-    drift: tuple[str, ...]
-    actions: tuple[str, ...]
-
-
-class ReconciliationController:
-    CHECKS = (
-        ("authority_main", "gitea_main", "main_drift"),
-        ("local_tag_oid", "remote_tag_oid", "tag_drift"),
-        ("remote_peeled_target", "approved_target_oid", "peeled_target_drift"),
-        ("registry_version", "baseline_version", "registry_baseline_drift"),
-        ("approved_artifact_digest", "deployed_artifact_digest", "artifact_drift"),
-        ("declared_production_state", "service_healthy", "service_health_drift"),
-    )
-
-    def reconcile(self, actual: Mapping[str, Any]) -> ReconciliationReport:
-        drift: list[str] = []
-        for left, right, label in self.CHECKS:
-            if actual.get(left) != actual.get(right):
-                drift.append(label)
-        actions = () if not drift else ("open_reconciliation_task", "open_reconciliation_pr", "attach_evidence", "notify_owner")
-        return ReconciliationReport(not drift, tuple(drift), actions)
-
@@ -1,65 +0,0 @@
-"""Durable-friendly recurring task scheduling primitives."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from typing import Any
-
-
-class RecurringTaskError(ValueError):
-    pass
-
-
-@dataclass
-class RecurringTask:
-    task_id: str
-    interval_seconds: int
-    next_run_at: datetime
-    run_count: int = 0
-    max_runs: int | None = None
-    cancelled: bool = False
-
-    def due(self, now: datetime) -> bool:
-        return not self.cancelled and (self.max_runs is None or self.run_count < self.max_runs) and now >= self.next_run_at
-
-
-class RecurringTaskScheduler:
-    def __init__(self) -> None:
-        self.tasks: dict[str, RecurringTask] = {}
-        self.successors: set[str] = set()
-
-    def schedule(self, task_id: str, interval_seconds: int, *, now: datetime | None = None, max_runs: int | None = None) -> RecurringTask:
-        if task_id in self.tasks:
-            raise RecurringTaskError("task already exists")
-        if interval_seconds <= 0 or (max_runs is not None and max_runs <= 0):
-            raise RecurringTaskError("invalid recurring task bounds")
-        now = now or datetime.now(timezone.utc)
-        task = RecurringTask(task_id, interval_seconds, now, 0, max_runs, False)
-        self.tasks[task_id] = task
-        return task
-
-    def due(self, *, now: datetime | None = None) -> list[RecurringTask]:
-        now = now or datetime.now(timezone.utc)
-        return [task for task in self.tasks.values() if task.due(now)]
-
-    def mark_run(self, task_id: str, *, now: datetime | None = None) -> RecurringTask:
-        task = self.tasks[task_id]
-        now = now or datetime.now(timezone.utc)
-        if not task.due(now):
-            raise RecurringTaskError("task is not due")
-        task.run_count += 1
-        task.next_run_at = now + timedelta(seconds=task.interval_seconds)
-        return task
-
-    def cancel(self, task_id: str) -> None:
-        self.tasks[task_id].cancelled = True
-
-    def create_successor_once(self, predecessor: str, successor: str, *, interval_seconds: int, now: datetime | None = None) -> RecurringTask:
-        key = f"{predecessor}->{successor}"
-        if key in self.successors:
-            return self.tasks[successor]
-        self.successors.add(key)
-        if successor not in self.tasks:
-            return self.schedule(successor, interval_seconds, now=now)
-        return self.tasks[successor]
-
@@ -1,53 +0,0 @@
-"""Release state machine with explicit fail-closed production gates."""
-from __future__ import annotations
-
-from enum import Enum
-from typing import Mapping
-
-
-class InvalidTransition(RuntimeError):
-    pass
-
-
-class ReleaseState(str, Enum):
-    SOURCE_READY = "SOURCE_READY"
-    TESTED = "TESTED"
-    PR_OPEN = "PR_OPEN"
-    PR_APPROVED = "PR_APPROVED"
-    MERGED = "MERGED"
-    ARTIFACT_VERIFIED = "ARTIFACT_VERIFIED"
-    RELEASE_APPROVED = "RELEASE_APPROVED"
-    TAG_VERIFIED = "TAG_VERIFIED"
-    DEPLOYED = "DEPLOYED"
-    PRODUCTION_ACCEPTED = "PRODUCTION_ACCEPTED"
-
-
-TRANSITIONS = {
-    ReleaseState.SOURCE_READY: (ReleaseState.TESTED,),
-    ReleaseState.TESTED: (ReleaseState.PR_OPEN,),
-    ReleaseState.PR_OPEN: (ReleaseState.PR_APPROVED,),
-    ReleaseState.PR_APPROVED: (ReleaseState.MERGED,),
-    ReleaseState.MERGED: (ReleaseState.ARTIFACT_VERIFIED,),
-    ReleaseState.ARTIFACT_VERIFIED: (ReleaseState.RELEASE_APPROVED,),
-    ReleaseState.RELEASE_APPROVED: (ReleaseState.TAG_VERIFIED,),
-    ReleaseState.TAG_VERIFIED: (ReleaseState.DEPLOYED,),
-    ReleaseState.DEPLOYED: (ReleaseState.PRODUCTION_ACCEPTED,),
-}
-
-
-class ReleaseStateMachine:
-    def __init__(self, state: ReleaseState = ReleaseState.SOURCE_READY) -> None:
-        self.state = state
-
-    def transition(self, target: ReleaseState, evidence: Mapping[str, object] | None = None) -> ReleaseState:
-        if target not in TRANSITIONS.get(self.state, ()):
-            raise InvalidTransition(f"{self.state.value}_to_{target.value}_denied")
-        evidence = evidence or {}
-        if target is ReleaseState.PRODUCTION_ACCEPTED:
-            if evidence.get("tag_verified") is not True or evidence.get("remote_tag_readback") is not True or evidence.get("service_health") is not True:
-                raise InvalidTransition("production_acceptance_evidence_incomplete")
-        if target is ReleaseState.DEPLOYED and evidence.get("artifact_verified") is not True:
-            raise InvalidTransition("deployment_artifact_not_verified")
-        self.state = target
-        return self.state
-
@@ -1,520 +0,0 @@
-"""Compatibility adapter for the deployed signer and validator contracts.
-
-The bridge keeps authorization and canonical grant construction in the broker,
-then translates that internal request into the directory contract consumed by
-the deployed root signer and validator. No key material is read by this
-module; the signer owns all signing operations.
-"""
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import re
-import subprocess
-from pathlib import Path
-from typing import Any, Mapping, Sequence
-
-
-_SIGNER_FLAGS = (
-    "--namespace",
-    "--input",
-    "--signature-out",
-    "--key-id-out",
-)
-
-
-class SignerContractError(RuntimeError):
-    """Raised when the deployed contract cannot be normalized safely."""
-
-
-def canonical_json_bytes(value: Any) -> bytes:
-    return (
-        json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
-        + "\n"
-    ).encode("utf-8")
-
-
-def sha256_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
-
-
-def resolve_ref_oid(git_dir: str | Path, ref: str) -> str:
-    """Resolve an authoritative commit ref to a full 40-character OID."""
-    if not isinstance(ref, str) or not re.fullmatch(r"refs/[A-Za-z0-9._/-]+", ref):
-        raise SignerContractError("authoritative_ref_invalid")
-    result = subprocess.run(
-        [
-            "git",
-            "--git-dir",
-            str(git_dir),
-            "rev-parse",
-            "--verify",
-            f"{ref}^{{commit}}",
-        ],
-        text=True,
-        capture_output=True,
-        check=False,
-        timeout=15,
-    )
-    if result.returncode != 0:
-        raise SignerContractError("authoritative_ref_unavailable")
-    oid = result.stdout.strip().lower()
-    if not re.fullmatch(r"[0-9a-f]{40}", oid):
-        raise SignerContractError("authoritative_ref_invalid_oid")
-    return oid
-
-
-def _read(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise SignerContractError("contract_input_missing")
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise SignerContractError("contract_input_invalid") from exc
-    if not isinstance(value, dict):
-        raise SignerContractError("contract_object_required")
-    return value
-
-
-def _write(path: Path, value: Any) -> None:
-    if path.is_symlink():
-        raise SignerContractError("contract_output_symlink")
-    path.parent.mkdir(parents=True, exist_ok=True)
-    temporary = path.with_name(path.name + ".tmp")
-    temporary.write_bytes(canonical_json_bytes(value))
-    os.chmod(temporary, 0o600)
-    os.replace(temporary, path)
-    os.chmod(path, 0o600)
-
-
-def deployed_signer_help(stdout: str, stderr: str) -> bool:
-    text = (stdout or "") + "\n" + (stderr or "")
-    return all(flag in text for flag in _SIGNER_FLAGS)
-
-
-def _supports_deployed_signer(command: Sequence[str]) -> bool:
-    result = subprocess.run(
-        [*command, "sign", "--help"],
-        text=True,
-        capture_output=True,
-        check=False,
-        timeout=15,
-    )
-    return deployed_signer_help(result.stdout, result.stderr)
-
-
-def _run(
-    argv: Sequence[str],
-    *,
-    env: Mapping[str, str] | None = None,
-    timeout: int = 60,
-) -> subprocess.CompletedProcess[str]:
-    result = subprocess.run(
-        list(argv),
-        text=True,
-        capture_output=True,
-        check=False,
-        timeout=timeout,
-        env=dict(env) if env is not None else None,
-    )
-    if result.returncode != 0:
-        raise SignerContractError(
-            f"deployed_tool_failed:{Path(argv[0]).name}:{result.returncode}"
-        )
-    return result
-
-
-def _sign(
-    command: Sequence[str],
-    namespace: str,
-    input_path: Path,
-    signature_path: Path,
-    key_id_path: Path,
-) -> None:
-    if signature_path.exists() or key_id_path.exists():
-        raise SignerContractError("contract_output_exists")
-    _run(
-        [
-            *command,
-            "sign",
-            "--namespace",
-            namespace,
-            "--input",
-            str(input_path),
-            "--signature-out",
-            str(signature_path),
-            "--key-id-out",
-            str(key_id_path),
-        ],
-        timeout=60,
-    )
-    if not signature_path.is_file() or not key_id_path.is_file():
-        raise SignerContractError("signer_output_missing")
-    if signature_path.stat().st_size <= 0 or key_id_path.stat().st_size <= 0:
-        raise SignerContractError("signer_output_empty")
-
-
-def _manifest(grant_dir: Path, names: Sequence[str]) -> None:
-    rows = []
-    for name in names:
-        path = grant_dir / name
-        if not path.is_file() or path.is_symlink():
-            raise SignerContractError("manifest_input_missing")
-        rows.append(
-            f"{hashlib.sha256(path.read_bytes()).hexdigest()}  {name}"
-        )
-    (grant_dir / "MANIFEST.sha256").write_text(
-        "\n".join(rows) + "\n",
-        encoding="utf-8",
-    )
-    os.chmod(grant_dir / "MANIFEST.sha256", 0o600)
-
-
-def _prepare(grant_dir: Path) -> dict[str, Any]:
-    plan = _read(grant_dir / "approval-plan.json")
-    request = _read(grant_dir / "grant-request.json")
-    base = request.get("base")
-    target = request.get("target")
-    owner = request.get("owner_authorization")
-    authorization = request.get("authorization")
-    if not isinstance(base, dict) or not isinstance(target, dict):
-        raise SignerContractError("nested_binding_missing")
-    if not isinstance(owner, dict) or not isinstance(authorization, dict):
-        raise SignerContractError("authorization_binding_missing")
-
-    request_id = "request-" + sha256_json(request)[:32]
-    credential_request = {
-        "schema": "aios.credential-request.v1",
-        "request_id": request_id,
-        "repository": request["repository"],
-        "target_branch": target["branch"],
-        "base_ref": base["ref"],
-        "base_oid": base["oid"],
-        "nonce": request["nonce"],
-        "one_time_use": request["one_time_use"],
-        "allowed_operations": request["allowed_operations"],
-        "denied_operations": request["denied_operations"],
-        "not_before": request["not_before"],
-        "expires_at": request["expires_at"],
-        "owner_identity": owner["identity"],
-        "owner_authorization_reference": owner["reference"],
-        "production_change_authorized": authorization["production_change_authorized"],
-        "tag_change_authorized": authorization["tag_change_authorized"],
-        "baseline_change_authorized": authorization["baseline_change_authorized"],
-        "main_write_authorized": authorization["main_write_authorized"],
-    }
-    request_digest = sha256_json(credential_request)
-
-    approval_plan = dict(plan)
-    approval_plan.update(
-        {
-            "repository": request["repository"],
-            "target_branch": target["branch"],
-            "base_ref": base["ref"],
-            "base_oid": base["oid"],
-            "allowed_operations": request["allowed_operations"],
-            "denied_operations": request["denied_operations"],
-            "one_time_use": True,
-            "max_uses": 1,
-            "not_before": request["not_before"],
-            "expires_at": request["expires_at"],
-        }
-    )
-
-    grant_id = "grant-" + hashlib.sha256(
-        (request_id + "\0" + request["nonce"]).encode("utf-8")
-    ).hexdigest()[:32]
-    grant_payload = {
-        "schema": "aios.grant-payload.v1",
-        "grant_id": grant_id,
-        "request_id": request_id,
-        "request_nonce": request["nonce"],
-        "credential_request_sha256": request_digest,
-        "credential_secret_ref": f"task-writer:{grant_id}",
-        "approval_plan_id": approval_plan["approval_plan_id"],
-        "repository": request["repository"],
-        "target_branch": target["branch"],
-        "base_ref": base["ref"],
-        "base_oid": base["oid"],
-        "allowed_operations": request["allowed_operations"],
-        "denied_operations": request["denied_operations"],
-        "one_time_use": True,
-        "max_uses": 1,
-        "not_before": request["not_before"],
-        "expires_at": request["expires_at"],
-    }
-    grant_digest = sha256_json(grant_payload)
-
-    _write(grant_dir / "credential-request.json", credential_request)
-    (grant_dir / "credential-request.canonical.json").write_bytes(
-        canonical_json_bytes(credential_request)
-    )
-    os.chmod(grant_dir / "credential-request.canonical.json", 0o600)
-    _write(grant_dir / "approval-plan.json", approval_plan)
-    (grant_dir / "approval-plan.canonical.json").write_bytes(
-        canonical_json_bytes(approval_plan)
-    )
-    os.chmod(grant_dir / "approval-plan.canonical.json", 0o600)
-    _write(grant_dir / "grant-payload.json", grant_payload)
-    (grant_dir / "grant-payload.canonical.json").write_bytes(
-        canonical_json_bytes(grant_payload)
-    )
-    os.chmod(grant_dir / "grant-payload.canonical.json", 0o600)
-    _write(
-        grant_dir / "signed-grant.json",
-        {
-            "schema": "aios.signed-grant.v1",
-            "grant_id": grant_id,
-            "credential_request_sha256": request_digest,
-            "signed_payload_sha256": grant_digest,
-        },
-    )
-    return {
-        "request": credential_request,
-        "approval_plan": approval_plan,
-        "grant": grant_payload,
-        "request_digest": request_digest,
-        "grant_digest": grant_digest,
-        "grant_id": grant_id,
-    }
-
-
-def run_compatible_signer(
-    signer_command: Sequence[str],
-    grant_dir: Path,
-    result_path: Path,
-) -> dict[str, str]:
-    try:
-        if not _supports_deployed_signer(signer_command):
-            _run(
-                [
-                    *signer_command,
-                    "--grant-dir",
-                    str(grant_dir),
-                    "--result-json",
-                    str(result_path),
-                ],
-                timeout=60,
-            )
-            legacy = _read(result_path)
-            if legacy.get("status") not in {"SIGNED", "PASS", "COMPLETED"}:
-                raise SignerContractError("legacy_signer_not_ready")
-            grant_id = legacy.get("grant_id")
-            digest = legacy.get("grant_digest_sha256")
-            signer = legacy.get("signing_key_identity") or legacy.get(
-                "signer_identity"
-            )
-            if not all(
-                isinstance(value, str) and value.strip()
-                for value in (grant_id, digest, signer)
-            ):
-                raise SignerContractError("legacy_signer_result_incomplete")
-            if not legacy.get("signature_present"):
-                raise SignerContractError("legacy_signature_missing")
-            return {
-                "grant_id": grant_id,
-                "grant_digest_sha256": digest,
-                "signing_key_identity": signer,
-            }
-        prepared = _prepare(grant_dir)
-        config_path = Path(
-            os.environ.get("AIOS_GRANT_ROOT_CONFIG", "/etc/aios/grant-root/config.json")
-        )
-        config = _read(config_path)
-        grant_namespace = str(config["grant_namespace"])
-        approval_namespace = str(config["approval_namespace"])
-        _sign(
-            signer_command,
-            approval_namespace,
-            grant_dir / "approval-plan.canonical.json",
-            grant_dir / "approval-plan.sig",
-            grant_dir / "approval-plan.key-id",
-        )
-        _sign(
-            signer_command,
-            grant_namespace,
-            grant_dir / "grant-payload.canonical.json",
-            grant_dir / "signed-grant.sig",
-            grant_dir / "signed-grant.key-id",
-        )
-        key_identity = (
-            grant_dir / "signed-grant.key-id"
-        ).read_text(encoding="utf-8").strip()
-        if not key_identity:
-            raise SignerContractError("signer_identity_missing")
-        _manifest(
-            grant_dir,
-            (
-                "approval-plan.json",
-                "approval-plan.canonical.json",
-                "approval-plan.sig",
-                "approval-plan.key-id",
-                "credential-request.json",
-                "credential-request.canonical.json",
-                "grant-payload.json",
-                "grant-payload.canonical.json",
-                "signed-grant.json",
-                "signed-grant.sig",
-                "signed-grant.key-id",
-            ),
-        )
-        result = {
-            "schema": "aios.compatible-signer-result.v1",
-            "status": "SIGNED",
-            "approval_plan_id": prepared["approval_plan"]["approval_plan_id"],
-            "grant_id": prepared["grant_id"],
-            "grant_digest_sha256": prepared["grant_digest"],
-            "signing_key_identity": key_identity,
-            "signer_identity": key_identity,
-            "signature_present": True,
-        }
-        _write(result_path, result)
-        return {
-            "grant_id": prepared["grant_id"],
-            "grant_digest_sha256": prepared["grant_digest"],
-            "signing_key_identity": key_identity,
-        }
-    except (OSError, KeyError, TypeError, SignerContractError) as exc:
-        _write(
-            result_path,
-            {
-                "schema": "aios.compatible-signer-result.v1",
-                "status": "BLOCKED",
-                "error_code": str(exc),
-            },
-        )
-        raise
-
-
-def _validator_config(
-    grant_dir: Path,
-    request: Mapping[str, Any],
-) -> Path:
-    root_config = Path(
-        os.environ.get("AIOS_GRANT_ROOT_CONFIG", "/etc/aios/grant-root/config.json")
-    )
-    config = _read(root_config)
-    repo_path = (
-        os.environ.get("AIOS_GITOPS_VALIDATOR_REPO_PATH")
-        or os.environ.get("AIOS_GITOPS_WORKSPACE")
-        or config.get("repo_path")
-    )
-    config.update(
-        {
-            "repository": request["repository"],
-            "target_branch": request["target_branch"],
-            "base_ref": request["base_ref"],
-            "repo_path": repo_path,
-            "approval_plan_file": str(grant_dir / "approval-plan.json"),
-            "approval_plan_canonical_file": str(
-                grant_dir / "approval-plan.canonical.json"
-            ),
-            "approval_plan_signature_file": str(grant_dir / "approval-plan.sig"),
-            "consumed_grants_ledger": str(
-                grant_dir / "consumed-grants.jsonl"
-            ),
-        }
-    )
-    path = grant_dir.parent / "compat-validator-config.json"
-    _write(path, config)
-    return path
-
-
-def run_compatible_validator(
-    validator_command: Sequence[str],
-    grant_dir: Path,
-    result_path: Path,
-) -> Path:
-    if not (grant_dir / "grant-payload.json").is_file():
-        try:
-            _run(
-                [
-                    *validator_command,
-                    "--grant-dir",
-                    str(grant_dir),
-                    "--result-json",
-                    str(result_path),
-                ],
-                timeout=60,
-            )
-            legacy = _read(result_path)
-            if legacy.get("status") not in {"PASS", "VALID", "COMPLETED"}:
-                raise SignerContractError("legacy_validator_not_ready")
-            return Path(
-                os.environ.get(
-                    "AIOS_GRANT_ROOT_CONFIG", "/etc/aios/grant-root/config.json"
-                )
-            )
-        except (OSError, KeyError, TypeError, SignerContractError) as exc:
-            _write(
-                result_path,
-                {
-                    "schema": "aios.compatible-validator-result.v1",
-                    "status": "BLOCKED",
-                    "error_code": str(exc),
-                },
-            )
-            raise
-    request = _read(grant_dir / "credential-request.json")
-    config_path = _validator_config(grant_dir, request)
-    env = os.environ.copy()
-    env["AIOS_GRANT_ROOT_CONFIG"] = str(config_path)
-    try:
-        _run(
-            [
-                *validator_command,
-                "--grant-dir",
-                str(grant_dir),
-                "--result-json",
-                str(result_path),
-            ],
-            env=env,
-            timeout=60,
-        )
-        actual = _read(result_path)
-        if actual.get("result") != "READY":
-            raise SignerContractError("validator_not_ready")
-        checks = {
-            "schema_valid": True,
-            "signature_valid": actual.get("signature_verified") is True,
-            "signer_trusted": actual.get("signature_verified") is True,
-            "approval_plan_active": actual.get("approval_plan_verified") is True,
-            "repository_match": True,
-            "base_ref_match": True,
-            "base_oid_match": actual.get("remote_base_verified") is True,
-            "target_branch_match": actual.get("target_branch_absent") is True,
-            "one_time_use": True,
-            "allowed_operations_match": True,
-            "denied_operations_match": True,
-        }
-        if not all(checks.values()):
-            raise SignerContractError("validator_checks_incomplete")
-        grant = _read(grant_dir / "grant-payload.json")
-        result = {
-            "schema": "aios.compatible-validator-result.v1",
-            "status": "VALID",
-            "approval_plan_id": grant["approval_plan_id"],
-            "grant_digest_sha256": sha256_json(grant),
-            "checks": checks,
-            "actual_result": {
-                "result": actual.get("result"),
-                "signature_verified": actual.get("signature_verified"),
-                "approval_plan_verified": actual.get("approval_plan_verified"),
-                "remote_base_verified": actual.get("remote_base_verified"),
-                "target_branch_absent": actual.get("target_branch_absent"),
-                "grant_unused": actual.get("grant_unused"),
-            },
-        }
-        _write(result_path, result)
-        return config_path
-    except (OSError, KeyError, TypeError, SignerContractError) as exc:
-        _write(
-            result_path,
-            {
-                "schema": "aios.compatible-validator-result.v1",
-                "status": "BLOCKED",
-                "error_code": str(exc),
-            },
-        )
-        raise
@@ -1,760 +0,0 @@
-"""Task-scoped identity overlay for bootstrap writer provisioning.
-
-This module resolves bearer-registry identity ambiguity without modifying the
-global token registry. A root-governed one-shot issuer creates a random,
-short-lived credential bound to exactly one repository, base OID, task and
-target branch. The HTTP overlay authenticates only that credential and invokes
-the existing OwnerAuthorizationBroker.
-
-The overlay never grants main, tag, baseline, production or repository-admin
-capabilities. The bearer secret is stored only in a root-owned runtime path and
-is removed after success, failure, revocation or expiry.
-"""
-from __future__ import annotations
-
-import fcntl
-import hashlib
-import json
-import os
-import re
-import secrets
-import tempfile
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any, Mapping, Sequence
-
-from authorized_task_writer_provisioning import (
-    BRANCH_RE,
-    ProvisioningError,
-    OID_RE,
-    REQUIRED_ALLOWED_OPERATIONS,
-    REQUIRED_DENIED_OPERATIONS,
-    TASK_RE,
-)
-from owner_authorization_broker import (
-    ACTION,
-    BROKER_REQUEST_FIELDS,
-    OwnerAuthorizationBroker,
-    OwnerAuthorizationBrokerConfig,
-    OwnerAuthorizationError,
-    OwnerPrincipal,
-    TaskWriterProvisioner,
-    canonical_json_bytes,
-    iso_utc,
-    sha256_json,
-    utc_now,
-)
-
-
-OVERLAY_SCHEMA = "aios.task-identity-overlay.v1"
-OVERLAY_SCOPE = "owner:task-authorize"
-OVERLAY_ID_RE = re.compile(r"^overlay-[0-9a-f]{32}$")
-OWNER_IDENTITY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._@:+/-]{1,254}$")
-AUTH_ASSERTION_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/@+-]{3,255}$")
-TERMINAL_STATES = frozenset({"CONSUMED", "FAILED", "REVOKED", "EXPIRED"})
-MAX_BODY_BYTES = 1_048_576
-
-
-class IdentityOverlayError(RuntimeError):
-    """Stable, fail-closed error for the overlay control plane."""
-
-    def __init__(
-        self,
-        code: str,
-        status: int = 400,
-        *,
-        details: Mapping[str, Any] | None = None,
-    ) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-        self.details = dict(details or {})
-
-
-@dataclass(frozen=True)
-class TaskBinding:
-    task_id: str
-    repository: str
-    base_ref: str
-    base_oid: str
-    target_branch: str
-
-    def as_dict(self) -> dict[str, str]:
-        return {
-            "task_id": self.task_id,
-            "repository": self.repository,
-            "base_ref": self.base_ref,
-            "base_oid": self.base_oid,
-            "target_branch": self.target_branch,
-        }
-
-
-@dataclass(frozen=True)
-class IdentityOverlayConfig:
-    state_root: Path
-    secret_root: Path
-    binding: TaskBinding
-    owner_identity: str
-    max_ttl_seconds: int = 900
-    require_root_issue: bool = True
-    collision_secret_refs: tuple[Path, ...] = ()
-    broker_state_root: Path | None = None
-
-    @classmethod
-    def from_environment(cls) -> "IdentityOverlayConfig":
-        try:
-            maximum = int(
-                os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_MAX_TTL_SECONDS", "900")
-            )
-        except ValueError:
-            raise IdentityOverlayError("OVERLAY_MAX_TTL_INVALID", 503) from None
-        if not 60 <= maximum <= 900:
-            raise IdentityOverlayError("OVERLAY_MAX_TTL_INVALID", 503)
-
-        refs = tuple(
-            Path(item.strip())
-            for item in os.getenv(
-                "AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS", ""
-            ).split(",")
-            if item.strip()
-        )
-        owner = os.getenv(
-            "AIOS_GITOPS_IDENTITY_OVERLAY_OWNER_IDENTITY", ""
-        ).strip()
-        config = cls(
-            state_root=Path(
-                os.getenv(
-                    "AIOS_GITOPS_IDENTITY_OVERLAY_STATE_ROOT",
-                    "/var/lib/aios-gitops/task-identity-overlays",
-                )
-            ),
-            secret_root=Path(
-                os.getenv(
-                    "AIOS_GITOPS_IDENTITY_OVERLAY_SECRET_ROOT",
-                    "/run/aios-gitops/task-identity-overlays",
-                )
-            ),
-            broker_state_root=Path(
-                os.getenv(
-                    "AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT",
-                    "/var/lib/aios-gitops/owner-authorization-broker",
-                )
-            ),
-            binding=TaskBinding(
-                task_id=os.getenv(
-                    "AIOS_GITOPS_IDENTITY_OVERLAY_TASK_ID", ""
-                ).strip(),
-                repository=os.getenv(
-                    "AIOS_GITOPS_REPOSITORY_IDENTITY", "aios/aios"
-                ).strip(),
-                base_ref=os.getenv(
-                    "AIOS_GITOPS_IDENTITY_OVERLAY_BASE_REF",
-                    "refs/heads/main",
-                ).strip(),
-                base_oid=os.getenv(
-                    "AIOS_GITOPS_IDENTITY_OVERLAY_BASE_OID", ""
-                ).strip(),
-                target_branch=os.getenv(
-                    "AIOS_GITOPS_IDENTITY_OVERLAY_TARGET_BRANCH", ""
-                ).strip(),
-            ),
-            owner_identity=owner,
-            max_ttl_seconds=maximum,
-            require_root_issue=os.getenv(
-                "AIOS_GITOPS_IDENTITY_OVERLAY_REQUIRE_ROOT", "true"
-            ).strip().lower()
-            not in {"0", "false", "no", "off"},
-            collision_secret_refs=refs,
-        )
-        _validate_config(config)
-        return config
-
-
-@dataclass(frozen=True)
-class OverlaySession:
-    overlay_id: str
-    metadata_path: Path
-    secret_ref: Path
-    owner_identity: str
-    request_digest_sha256: str
-    binding: TaskBinding
-
-
-def _validate_config(config: IdentityOverlayConfig) -> None:
-    binding = config.binding
-    if not TASK_RE.fullmatch(binding.task_id):
-        raise IdentityOverlayError("OVERLAY_TASK_ID_INVALID", 503)
-    if binding.repository != "aios/aios":
-        raise IdentityOverlayError("OVERLAY_REPOSITORY_REJECTED", 503)
-    if binding.base_ref != "refs/heads/main":
-        raise IdentityOverlayError("OVERLAY_BASE_REF_REJECTED", 503)
-    if not OID_RE.fullmatch(binding.base_oid):
-        raise IdentityOverlayError("OVERLAY_BASE_OID_INVALID", 503)
-    if (
-        not BRANCH_RE.fullmatch(binding.target_branch)
-        or binding.target_branch in {"main", "master"}
-    ):
-        raise IdentityOverlayError("OVERLAY_TARGET_BRANCH_INVALID", 503)
-    if not OWNER_IDENTITY_RE.fullmatch(config.owner_identity):
-        raise IdentityOverlayError("OVERLAY_OWNER_IDENTITY_INVALID", 503)
-    if not 60 <= config.max_ttl_seconds <= 900:
-        raise IdentityOverlayError("OVERLAY_MAX_TTL_INVALID", 503)
-    if config.state_root == config.secret_root:
-        raise IdentityOverlayError("OVERLAY_STATE_SECRET_ROOT_COLLISION", 503)
-
-
-def _prepare_directory(path: Path, mode: int = 0o700) -> None:
-    if path.is_symlink():
-        raise IdentityOverlayError("OVERLAY_PATH_SYMLINK_REJECTED", 500)
-    path.mkdir(parents=True, exist_ok=True, mode=mode)
-    os.chmod(path, mode)
-    if path.stat().st_mode & 0o077:
-        raise IdentityOverlayError("OVERLAY_DIRECTORY_PERMISSIONS_REJECTED", 500)
-
-
-def _atomic_write(path: Path, data: bytes, mode: int) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    if path.parent.is_symlink() or path.is_symlink():
-        raise IdentityOverlayError("OVERLAY_PATH_SYMLINK_REJECTED", 500)
-    fd, temporary = tempfile.mkstemp(prefix=".tmp-", dir=path.parent)
-    try:
-        os.fchmod(fd, mode)
-        with os.fdopen(fd, "wb", closefd=True) as stream:
-            stream.write(data)
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(temporary, path)
-        os.chmod(path, mode)
-        parent_fd = os.open(
-            path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
-        )
-        try:
-            os.fsync(parent_fd)
-        finally:
-            os.close(parent_fd)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def _atomic_write_json(path: Path, value: Any, mode: int = 0o600) -> None:
-    _atomic_write(path, canonical_json_bytes(value), mode)
-
-
-def _read_json(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise IdentityOverlayError("OVERLAY_METADATA_INVALID", 500)
-    if path.stat().st_size <= 0 or path.stat().st_size > MAX_BODY_BYTES:
-        raise IdentityOverlayError("OVERLAY_METADATA_INVALID", 500)
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        raise IdentityOverlayError("OVERLAY_METADATA_INVALID", 500) from None
-    if not isinstance(value, dict):
-        raise IdentityOverlayError("OVERLAY_METADATA_INVALID", 500)
-    return value
-
-
-def _parse_utc(value: str) -> datetime:
-    try:
-        parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
-    except (TypeError, ValueError):
-        raise IdentityOverlayError("OVERLAY_TIMESTAMP_INVALID", 500) from None
-    if parsed.tzinfo is None:
-        raise IdentityOverlayError("OVERLAY_TIMESTAMP_INVALID", 500)
-    return parsed.astimezone(timezone.utc)
-
-
-def _token_hash(token: bytes) -> str:
-    return hashlib.sha256(token.strip()).hexdigest()
-
-
-def _safe_unlink(path: Path) -> None:
-    try:
-        if path.is_symlink():
-            raise IdentityOverlayError("OVERLAY_SECRET_SYMLINK_REJECTED", 500)
-        path.unlink(missing_ok=True)
-    except OSError as exc:
-        raise IdentityOverlayError("OVERLAY_SECRET_REMOVAL_FAILED", 500) from exc
-
-
-def _validate_request_binding(
-    request: Mapping[str, Any], binding: TaskBinding, max_ttl: int
-) -> dict[str, Any]:
-    if set(request) != BROKER_REQUEST_FIELDS:
-        raise IdentityOverlayError("OVERLAY_REQUEST_FIELDS_REJECTED")
-    if request.get("action") != ACTION:
-        raise IdentityOverlayError("OVERLAY_ACTION_REJECTED")
-    expected = binding.as_dict()
-    for key, value in expected.items():
-        if request.get(key) != value:
-            raise IdentityOverlayError(
-                "OVERLAY_BINDING_MISMATCH", 409, details={"field": key}
-            )
-    if request.get("one_time_use") is not True:
-        raise IdentityOverlayError("OVERLAY_ONE_TIME_USE_REQUIRED")
-    expiry = request.get("expires_in_seconds")
-    if (
-        not isinstance(expiry, int)
-        or isinstance(expiry, bool)
-        or not 60 <= expiry <= max_ttl
-    ):
-        raise IdentityOverlayError("OVERLAY_TTL_REJECTED")
-    for field in (
-        "production_change_authorized",
-        "tag_change_authorized",
-        "baseline_change_authorized",
-        "main_write_authorized",
-    ):
-        if request.get(field) is not False:
-            raise IdentityOverlayError("OVERLAY_PRODUCTION_CAPABILITY_REJECTED", 403)
-    if (
-        not isinstance(request.get("allowed_operations"), list)
-        or frozenset(request["allowed_operations"])
-        != REQUIRED_ALLOWED_OPERATIONS
-    ):
-        raise IdentityOverlayError("OVERLAY_ALLOWED_OPERATIONS_MISMATCH", 403)
-    if (
-        not isinstance(request.get("denied_operations"), list)
-        or frozenset(request["denied_operations"])
-        != REQUIRED_DENIED_OPERATIONS
-    ):
-        raise IdentityOverlayError("OVERLAY_DENIED_OPERATIONS_MISMATCH", 403)
-    return dict(request)
-
-
-def _metadata_digest(metadata: Mapping[str, Any]) -> str:
-    unsigned = {
-        key: value
-        for key, value in metadata.items()
-        if key != "metadata_digest_sha256"
-    }
-    return sha256_json(unsigned)
-
-
-def _verify_metadata(metadata: Mapping[str, Any]) -> None:
-    if metadata.get("schema") != OVERLAY_SCHEMA:
-        raise IdentityOverlayError("OVERLAY_METADATA_SCHEMA_INVALID", 500)
-    overlay_id = str(metadata.get("overlay_id") or "")
-    if not OVERLAY_ID_RE.fullmatch(overlay_id):
-        raise IdentityOverlayError("OVERLAY_METADATA_ID_INVALID", 500)
-    expected = _metadata_digest(metadata)
-    if metadata.get("metadata_digest_sha256") != expected:
-        raise IdentityOverlayError("OVERLAY_METADATA_DIGEST_MISMATCH", 500)
-
-
-class TaskIdentityOverlayStore:
-    """Issue, authenticate, consume and revoke one task-bound credential."""
-
-    def __init__(self, config: IdentityOverlayConfig) -> None:
-        _validate_config(config)
-        self.config = config
-
-    @property
-    def lock_path(self) -> Path:
-        return self.config.state_root / "overlay.lock"
-
-    def _lock(self):
-        _prepare_directory(self.config.state_root)
-        _prepare_directory(self.config.secret_root)
-        self.lock_path.touch(mode=0o600, exist_ok=True)
-        os.chmod(self.lock_path, 0o600)
-        stream = self.lock_path.open("r+b")
-        fcntl.flock(stream.fileno(), fcntl.LOCK_EX)
-        return stream
-
-    def _metadata_paths(self) -> list[Path]:
-        return sorted(self.config.state_root.glob("overlay-*/metadata.json"))
-
-    def _active_for_task(self) -> tuple[Path, dict[str, Any]] | None:
-        now = utc_now()
-        for path in self._metadata_paths():
-            metadata = _read_json(path)
-            _verify_metadata(metadata)
-            if metadata.get("task_id") != self.config.binding.task_id:
-                continue
-            state = metadata.get("status")
-            if state in TERMINAL_STATES:
-                continue
-            if _parse_utc(str(metadata["expires_at"])) <= now:
-                metadata["status"] = "EXPIRED"
-                metadata["expired_at"] = iso_utc(now)
-                metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
-                _atomic_write_json(path, metadata)
-                _safe_unlink(Path(str(metadata["secret_ref"])))
-                continue
-            return path, metadata
-        return None
-
-    def _assert_hash_unique(self, digest: str) -> None:
-        matches = 0
-        for path in self._metadata_paths():
-            metadata = _read_json(path)
-            _verify_metadata(metadata)
-            if metadata.get("token_sha256") == digest:
-                matches += 1
-        for secret_ref in self.config.collision_secret_refs:
-            if not secret_ref.exists():
-                continue
-            if secret_ref.is_symlink() or not secret_ref.is_file():
-                raise IdentityOverlayError(
-                    "OVERLAY_COLLISION_SECRET_REF_INVALID", 500
-                )
-            if secret_ref.stat().st_size > 65_536:
-                raise IdentityOverlayError(
-                    "OVERLAY_COLLISION_SECRET_REF_INVALID", 500
-                )
-            if _token_hash(secret_ref.read_bytes()) == digest:
-                matches += 1
-        if matches:
-            raise IdentityOverlayError("OVERLAY_SECRET_IDENTITY_COLLISION", 409)
-
-    def issue(
-        self,
-        *,
-        ttl_seconds: int,
-        authorization_assertion_ref: str,
-        operator_identity: str,
-    ) -> dict[str, Any]:
-        if self.config.require_root_issue and os.geteuid() != 0:
-            raise IdentityOverlayError("OVERLAY_ROOT_ISSUER_REQUIRED", 403)
-        if (
-            not isinstance(ttl_seconds, int)
-            or isinstance(ttl_seconds, bool)
-            or not 60 <= ttl_seconds <= self.config.max_ttl_seconds
-        ):
-            raise IdentityOverlayError("OVERLAY_TTL_REJECTED")
-        if not AUTH_ASSERTION_RE.fullmatch(authorization_assertion_ref):
-            raise IdentityOverlayError("OVERLAY_AUTH_ASSERTION_REF_INVALID")
-        if not OWNER_IDENTITY_RE.fullmatch(operator_identity):
-            raise IdentityOverlayError("OVERLAY_OPERATOR_IDENTITY_INVALID")
-
-        with self._lock():
-            active = self._active_for_task()
-            if active:
-                _, metadata = active
-                expected = self.config.binding.as_dict()
-                actual = {
-                    key: metadata.get(key)
-                    for key in expected
-                }
-                if actual != expected:
-                    raise IdentityOverlayError(
-                        "OVERLAY_ACTIVE_BINDING_CONFLICT", 409
-                    )
-                return {
-                    "status": "OVERLAY_ACTIVE",
-                    "idempotent": True,
-                    "overlay_id": metadata["overlay_id"],
-                    "secret_ref": metadata["secret_ref"],
-                    "expires_at": metadata["expires_at"],
-                    "binding": expected,
-                }
-
-            token_text = secrets.token_urlsafe(48)
-            token_bytes = token_text.encode("ascii")
-            digest = _token_hash(token_bytes)
-            self._assert_hash_unique(digest)
-            overlay_id = "overlay-" + hashlib.sha256(
-                (
-                    f"{self.config.binding.task_id}\0"
-                    f"{self.config.binding.base_oid}\0"
-                    f"{self.config.binding.target_branch}\0"
-                    f"{digest}"
-                ).encode("utf-8")
-            ).hexdigest()[:32]
-            issued_at = utc_now()
-            expires_at = issued_at + timedelta(seconds=ttl_seconds)
-            overlay_dir = self.config.state_root / overlay_id
-            secret_dir = self.config.secret_root / overlay_id
-            _prepare_directory(overlay_dir)
-            _prepare_directory(secret_dir)
-            secret_ref = secret_dir / "bearer.token"
-            _atomic_write(secret_ref, token_bytes + b"\n", 0o600)
-
-            metadata: dict[str, Any] = {
-                "schema": OVERLAY_SCHEMA,
-                "overlay_id": overlay_id,
-                "status": "ACTIVE",
-                **self.config.binding.as_dict(),
-                "owner_identity": self.config.owner_identity,
-                "role": "owner",
-                "scope": OVERLAY_SCOPE,
-                "wildcard_scope": False,
-                "one_time_use": True,
-                "token_sha256": digest,
-                "secret_ref": str(secret_ref),
-                "authorization_assertion_ref": authorization_assertion_ref,
-                "operator_identity": operator_identity,
-                "issued_at": iso_utc(issued_at),
-                "expires_at": iso_utc(expires_at),
-                "attempt_count": 0,
-            }
-            metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
-            metadata_path = overlay_dir / "metadata.json"
-            _atomic_write_json(metadata_path, metadata)
-            _atomic_write_json(
-                overlay_dir / "audit-issued.json",
-                {
-                    "event": "TASK_IDENTITY_OVERLAY_ISSUED",
-                    "overlay_id": overlay_id,
-                    "task_id": self.config.binding.task_id,
-                    "binding_digest_sha256": sha256_json(
-                        self.config.binding.as_dict()
-                    ),
-                    "authorization_assertion_ref": authorization_assertion_ref,
-                    "operator_identity": operator_identity,
-                    "issued_at": metadata["issued_at"],
-                    "expires_at": metadata["expires_at"],
-                    "token_sha256": digest,
-                },
-            )
-            return {
-                "status": "OVERLAY_ACTIVE",
-                "idempotent": False,
-                "overlay_id": overlay_id,
-                "secret_ref": str(secret_ref),
-                "expires_at": metadata["expires_at"],
-                "binding": self.config.binding.as_dict(),
-            }
-
-    def authenticate_and_lock(
-        self, token: str, request: Mapping[str, Any]
-    ) -> OverlaySession:
-        if not token or len(token) > 4096:
-            raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
-        digest = _token_hash(token.encode("utf-8"))
-
-        with self._lock():
-            matches: list[tuple[Path, dict[str, Any]]] = []
-            for path in self._metadata_paths():
-                metadata = _read_json(path)
-                _verify_metadata(metadata)
-                if metadata.get("token_sha256") == digest:
-                    matches.append((path, metadata))
-            if not matches:
-                raise IdentityOverlayError("OVERLAY_CREDENTIAL_INVALID", 401)
-            if len(matches) != 1:
-                raise IdentityOverlayError("OVERLAY_SECRET_IDENTITY_COLLISION", 409)
-            path, metadata = matches[0]
-            if metadata.get("status") in TERMINAL_STATES:
-                raise IdentityOverlayError("OVERLAY_CREDENTIAL_INACTIVE", 401)
-            if _parse_utc(str(metadata["expires_at"])) <= utc_now():
-                metadata["status"] = "EXPIRED"
-                metadata["expired_at"] = iso_utc(utc_now())
-                metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
-                _atomic_write_json(path, metadata)
-                _safe_unlink(Path(str(metadata["secret_ref"])))
-                raise IdentityOverlayError("OVERLAY_CREDENTIAL_EXPIRED", 401)
-
-            expected = self.config.binding.as_dict()
-            for key, value in expected.items():
-                if metadata.get(key) != value:
-                    raise IdentityOverlayError(
-                        "OVERLAY_METADATA_BINDING_MISMATCH", 409
-                    )
-            if metadata.get("owner_identity") != self.config.owner_identity:
-                raise IdentityOverlayError("OVERLAY_OWNER_IDENTITY_MISMATCH", 409)
-            if metadata.get("scope") != OVERLAY_SCOPE:
-                raise IdentityOverlayError("OVERLAY_SCOPE_MISMATCH", 409)
-            if metadata.get("wildcard_scope") is not False:
-                raise IdentityOverlayError("OVERLAY_WILDCARD_SCOPE_REJECTED", 409)
-
-            # Validate detailed request policy only after the bearer identity is
-            # proven, so unauthenticated callers cannot probe task bindings.
-            validated = _validate_request_binding(
-                request, self.config.binding, self.config.max_ttl_seconds
-            )
-            request_digest = sha256_json(validated)
-            previous = str(metadata.get("request_digest_sha256") or "")
-            if metadata.get("status") == "LOCKED" and previous != request_digest:
-                raise IdentityOverlayError("OVERLAY_REPLAY_REQUEST_MISMATCH", 409)
-            metadata["status"] = "LOCKED"
-            metadata["request_digest_sha256"] = request_digest
-            metadata["locked_at"] = metadata.get("locked_at") or iso_utc(utc_now())
-            metadata["attempt_count"] = int(metadata.get("attempt_count") or 0) + 1
-            metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
-            _atomic_write_json(path, metadata)
-            return OverlaySession(
-                overlay_id=str(metadata["overlay_id"]),
-                metadata_path=path,
-                secret_ref=Path(str(metadata["secret_ref"])),
-                owner_identity=str(metadata["owner_identity"]),
-                request_digest_sha256=request_digest,
-                binding=self.config.binding,
-            )
-
-    def complete(
-        self, session: OverlaySession, result: Mapping[str, Any]
-    ) -> dict[str, Any]:
-        with self._lock():
-            metadata = _read_json(session.metadata_path)
-            _verify_metadata(metadata)
-            if metadata.get("status") == "CONSUMED":
-                return metadata
-            if metadata.get("status") != "LOCKED":
-                raise IdentityOverlayError("OVERLAY_NOT_LOCKED", 409)
-            if (
-                metadata.get("request_digest_sha256")
-                != session.request_digest_sha256
-            ):
-                raise IdentityOverlayError("OVERLAY_REQUEST_DIGEST_MISMATCH", 409)
-            metadata["status"] = "CONSUMED"
-            metadata["consumed_at"] = iso_utc(utc_now())
-            metadata["result_digest_sha256"] = sha256_json(dict(result))
-            metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
-            _atomic_write_json(session.metadata_path, metadata)
-            _safe_unlink(session.secret_ref)
-            _atomic_write_json(
-                session.metadata_path.parent / "audit-consumed.json",
-                {
-                    "event": "TASK_IDENTITY_OVERLAY_CONSUMED",
-                    "overlay_id": session.overlay_id,
-                    "task_id": session.binding.task_id,
-                    "request_digest_sha256": session.request_digest_sha256,
-                    "result_digest_sha256": metadata["result_digest_sha256"],
-                    "consumed_at": metadata["consumed_at"],
-                    "secret_removed": True,
-                },
-            )
-            return metadata
-
-    def fail(
-        self,
-        session: OverlaySession,
-        *,
-        error_code: str,
-        error_status: int,
-    ) -> dict[str, Any]:
-        with self._lock():
-            metadata = _read_json(session.metadata_path)
-            _verify_metadata(metadata)
-            if metadata.get("status") in TERMINAL_STATES:
-                return metadata
-            metadata["status"] = "FAILED"
-            metadata["failed_at"] = iso_utc(utc_now())
-            metadata["error_code"] = error_code
-            metadata["error_status"] = int(error_status)
-            metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
-            _atomic_write_json(session.metadata_path, metadata)
-            _safe_unlink(session.secret_ref)
-            _atomic_write_json(
-                session.metadata_path.parent / "audit-failed.json",
-                {
-                    "event": "TASK_IDENTITY_OVERLAY_FAILED",
-                    "overlay_id": session.overlay_id,
-                    "task_id": session.binding.task_id,
-                    "request_digest_sha256": session.request_digest_sha256,
-                    "error_code": error_code,
-                    "error_status": int(error_status),
-                    "failed_at": metadata["failed_at"],
-                    "secret_removed": True,
-                },
-            )
-            return metadata
-
-    def revoke(self, overlay_id: str, *, reason: str) -> dict[str, Any]:
-        if self.config.require_root_issue and os.geteuid() != 0:
-            raise IdentityOverlayError("OVERLAY_ROOT_ISSUER_REQUIRED", 403)
-        if not OVERLAY_ID_RE.fullmatch(overlay_id):
-            raise IdentityOverlayError("OVERLAY_ID_INVALID")
-        if not AUTH_ASSERTION_RE.fullmatch(reason):
-            raise IdentityOverlayError("OVERLAY_REVOCATION_REASON_INVALID")
-        with self._lock():
-            path = self.config.state_root / overlay_id / "metadata.json"
-            metadata = _read_json(path)
-            _verify_metadata(metadata)
-            if metadata.get("status") not in TERMINAL_STATES:
-                metadata["status"] = "REVOKED"
-                metadata["revoked_at"] = iso_utc(utc_now())
-                metadata["revocation_reason"] = reason
-                metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
-                _atomic_write_json(path, metadata)
-                _safe_unlink(Path(str(metadata["secret_ref"])))
-            return metadata
-
-    def status(self, overlay_id: str) -> dict[str, Any]:
-        if not OVERLAY_ID_RE.fullmatch(overlay_id):
-            raise IdentityOverlayError("OVERLAY_ID_INVALID")
-        metadata = _read_json(
-            self.config.state_root / overlay_id / "metadata.json"
-        )
-        _verify_metadata(metadata)
-        return {
-            key: value
-            for key, value in metadata.items()
-            if key not in {"token_sha256"}
-        }
-
-
-class TaskIdentityOverlayService:
-    """Authenticate one overlay credential and invoke the existing broker."""
-
-    def __init__(
-        self,
-        config: IdentityOverlayConfig,
-        provisioner: TaskWriterProvisioner | None = None,
-    ) -> None:
-        self.config = config
-        self.store = TaskIdentityOverlayStore(config)
-        broker_state = config.broker_state_root or (
-            config.state_root / "owner-authorization-events"
-        )
-        self.broker = OwnerAuthorizationBroker(
-            OwnerAuthorizationBrokerConfig(
-                repository_identity=config.binding.repository,
-                state_root=broker_state,
-                allowed_owner_identities=frozenset({config.owner_identity}),
-                allowed_intake_scopes=frozenset({OVERLAY_SCOPE}),
-                allowed_credential_ids=frozenset(),
-                max_expiry_seconds=config.max_ttl_seconds,
-            ),
-            provisioner=provisioner,
-        )
-
-    def provision(
-        self, request: Mapping[str, Any], bearer_token: str
-    ) -> dict[str, Any]:
-        session = self.store.authenticate_and_lock(bearer_token, request)
-        principal = OwnerPrincipal(
-            identity=session.owner_identity,
-            role="owner",
-            authenticated_scope=OVERLAY_SCOPE,
-            token_scopes=frozenset({OVERLAY_SCOPE}),
-            credential_id=session.overlay_id,
-        )
-        try:
-            result = self.broker.authorize_and_provision(request, principal)
-            if result.get("status") != "READY_FOR_CODE_AUTHORING":
-                raise IdentityOverlayError("OVERLAY_PROVISIONER_NOT_READY", 409)
-            self.store.complete(session, result)
-            response = dict(result)
-            response.update(
-                {
-                    "identity_overlay_id": session.overlay_id,
-                    "identity_overlay_consumed": True,
-                    "identity_overlay_secret_removed": True,
-                    "identity_overlay_scope": OVERLAY_SCOPE,
-                }
-            )
-            return response
-        except (OwnerAuthorizationError, ProvisioningError) as exc:
-            self.store.fail(
-                session, error_code=exc.code, error_status=exc.status
-            )
-            raise
-        except IdentityOverlayError as exc:
-            self.store.fail(
-                session, error_code=exc.code, error_status=exc.status
-            )
-            raise
-        except Exception as exc:
-            self.store.fail(
-                session,
-                error_code="IDENTITY_OVERLAY_INTERNAL_ERROR",
-                error_status=500,
-            )
-            raise IdentityOverlayError(
-                "IDENTITY_OVERLAY_INTERNAL_ERROR", 500
-            ) from exc
@@ -1,165 +0,0 @@
-"""Privacy and artifact helpers for the V2R1C6 release candidate.
-
-The module is deliberately dependency-free. It provides deterministic redaction,
-safe SHA-256 manifest verification, and a small loopback-only candidate probe.
-It does not read credentials, contact production services, or mutate Git refs.
-"""
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-import re
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from pathlib import Path
-from typing import Any, Mapping
-
-_SECRET_KEY = re.compile(r"(?i)(?:token|secret|password|private[_-]?key|api[_-]?key)")
-_SECRET_VALUE = re.compile(
-    r"(?i)(?:bearer\s+)[A-Za-z0-9._~+/=-]+|"
-    r"(?:token|secret|password|private[_-]?key|api[_-]?key)\s*[:=]\s*[^\s,;]+"
-)
-
-
-def redact_text(value: str) -> str:
-    """Replace common bearer and key/value secret forms without logging them."""
-    if not isinstance(value, str):
-        raise TypeError("text_required")
-    return _SECRET_VALUE.sub("[REDACTED]", value)
-
-
-def redact_value(value: Any, *, key: str = "") -> Any:
-    """Recursively redact secret-bearing mapping keys and text values."""
-    if isinstance(value, Mapping):
-        result: dict[str, Any] = {}
-        for name, item in value.items():
-            name_text = str(name)
-            if _SECRET_KEY.search(name_text):
-                result[name_text] = "[REDACTED]"
-            else:
-                result[name_text] = redact_value(item, key=name_text)
-        return result
-    if isinstance(value, list):
-        return [redact_value(item, key=key) for item in value]
-    if isinstance(value, tuple):
-        return [redact_value(item, key=key) for item in value]
-    if isinstance(value, str):
-        return "[REDACTED]" if _SECRET_KEY.search(key) else redact_text(value)
-    return value
-
-
-def sha256_file(path: Path) -> str:
-    """Return the SHA-256 of a regular file without following symlink inputs."""
-    if path.is_symlink() or not path.is_file():
-        raise ValueError("regular_file_required")
-    digest = hashlib.sha256()
-    with path.open("rb") as stream:
-        for chunk in iter(lambda: stream.read(1024 * 1024), b""):
-            digest.update(chunk)
-    return digest.hexdigest()
-
-
-def _safe_relative(root: Path, name: str) -> Path:
-    relative = Path(name)
-    if relative.is_absolute() or ".." in relative.parts or name in {"", "."}:
-        raise ValueError("unsafe_manifest_path")
-    candidate = (root / relative).resolve()
-    candidate.relative_to(root.resolve())
-    return candidate
-
-
-def verify_manifest(root: Path, manifest: Path | None = None) -> dict[str, Any]:
-    """Verify sha256 path entries and return a non-sensitive summary."""
-    root = root.resolve()
-    manifest = manifest or root / "artifacts" / "MANIFEST.sha256"
-    if manifest.is_symlink() or not manifest.is_file():
-        raise ValueError("manifest_missing")
-    checked = 0
-    for raw in manifest.read_text(encoding="utf-8").splitlines():
-        line = raw.strip()
-        if not line:
-            continue
-        parts = line.split(maxsplit=1)
-        if len(parts) != 2 or not re.fullmatch(r"[0-9a-f]{64}", parts[0]):
-            raise ValueError("manifest_entry_invalid")
-        expected, name = parts
-        if name.startswith("*"):
-            name = name[1:]
-        path = _safe_relative(root, name)
-        if sha256_file(path) != expected:
-            raise ValueError("manifest_hash_mismatch")
-        checked += 1
-    if checked == 0:
-        raise ValueError("manifest_empty")
-    return {"status": "PASS", "entries": checked}
-
-
-def load_release_metadata(path: Path) -> dict[str, Any]:
-    metadata = json.loads(path.read_text(encoding="utf-8"))
-    if metadata.get("version") != "V2R1C6":
-        raise ValueError("version_mismatch")
-    if metadata.get("production_deployed") is not False:
-        raise ValueError("production_change_not_allowed")
-    if metadata.get("tag_created") is not False:
-        raise ValueError("tag_change_not_allowed")
-    if metadata.get("baseline_changed") is not False:
-        raise ValueError("baseline_change_not_allowed")
-    return metadata
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--root", type=Path, default=Path("."))
-    parser.add_argument("--manifest", type=Path)
-    parser.add_argument("--serve", action="store_true")
-    parser.add_argument("--host", default="127.0.0.1")
-    parser.add_argument("--port", type=int, default=18926)
-    args = parser.parse_args()
-    if args.serve:
-        serve(args.host, args.port)
-        return 0
-    result = verify_manifest(args.root, args.manifest)
-    print(json.dumps(result, sort_keys=True))
-    return 0
-
-
-
-def health_payload() -> dict[str, Any]:
-    return {
-        "status": "ok",
-        "version": "V2R1C6",
-        "production_deployed": False,
-        "gitops_writes_enabled": False,
-    }
-
-
-class _HealthHandler(BaseHTTPRequestHandler):
-    def do_GET(self) -> None:
-        if self.path not in {"/", "/health", "/healthz"}:
-            self.send_error(404)
-            return
-        body = json.dumps(health_payload(), sort_keys=True).encode("utf-8")
-        self.send_response(200)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(body)))
-        self.end_headers()
-        self.wfile.write(body)
-
-    def log_message(self, _format: str, *_args: object) -> None:
-        return
-
-
-def serve(host: str, port: int) -> None:
-    if host not in {"127.0.0.1", "::1", "localhost"}:
-        raise ValueError("loopback_only_listener_required")
-    if not 1024 <= port <= 65535:
-        raise ValueError("invalid_listener_port")
-    server = ThreadingHTTPServer((host, port), _HealthHandler)
-    try:
-        server.serve_forever()
-    finally:
-        server.server_close()
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,23 +0,0 @@
-{
-  "schema": "aios.release-approval-supersession.v1",
-  "version": "V2R1C6",
-  "status": "SUPERSEDED_PREDEPLOY_VALIDATION_FAILED",
-  "execute_allowed": false,
-  "old_binding": {
-    "target_oid": "28081c5522a869762ec4946846f68047d53d99f0",
-    "evidence_closure_oid": "fed41014d80bacca70c8f309a5fb2c22e6001e32",
-    "artifact_sha256": "437b1f891f23a1dd12feabeced3edee3c54cc552d990d6d852805c8d5a165150",
-    "approval_plan_id": "sha256:596c8d40c25f9427c58cbdb0bbae58c03ba5c200fec32025c22d8004d27d8a51"
-  },
-  "reasons": [
-    "artifact_candidate_descriptor",
-    "deployable_package_not_verified",
-    "production_controller_support_not_verified"
-  ],
-  "replacement_required": true,
-  "production_deployed": false,
-  "tag_created": false,
-  "baseline_changed": false,
-  "superseded_at": "2026-08-07",
-  "note": "Retained for audit; never delete, overwrite, or reuse."
-}
@@ -1,14 +0,0 @@
-26d56250af61748d26a75fb35aaaf46578d0520fc11796b75de2330ef2ebb64f  VERSION
-81afc7ed5c1123146f61cf7bcf96c1fb69baa9371f1beec693341f20d612e0d4  active-runtime/app/v2r1c6_privacy_tools.py
-437b1f891f23a1dd12feabeced3edee3c54cc552d990d6d852805c8d5a165150  artifacts/v2r1c6-candidate-artifact.txt
-9f0dced0b252d2103ac4e975e17fe220aa990d4e3ebcfa17ad3ec32cf0ce4152  deploy/aios-v2/systemd/aios-v2r1c6-production.env.example
-cee41f7c6e5a56632c6cb015d9182a6376d502fbf7a53b701369bf062c33f359  deploy/aios-v2/systemd/aios-v2r1c6-production.service
-3f050310303662eb71840c0cb7cac5a5523968750ea1dd428653d5ba1ef2b727  deploy/aios-v2/v2r1c6-rollback.json
-cbfefff50c6b1a6bc98de138e468929b4a98b738baeb0e0c97d2672f13ccc452  docs/releases/V2R1C6-CANDIDATE.md
-a3813d060d842c22ff1a0f5ed968625b4d9d878fbacccb76d924f365d1c1a3a5  scripts/verify_v2r1c6_candidate.py
-a194638a44668617ddd2c12e45a43b7f0020d5f0308fcadd9f8da1db5d6bb645  scripts/verify_v2r1c6_candidate.sh
-951254504f20ae8d0d2397c2c2b2baeb2127651eb1e6cd1dc06695b836e176f9  tests/aios_v2_candidate/conftest.py
-43322bdfb3cffa9d4756d929741f942a0da45b2498c7b5ed91906e115d968948  tests/aios_v2_candidate/test_v2r1c5_privacy_tools.py
-068a35099d17047d127ac06be1a84adf090976fab13cf321febb28c787c0cac5  tests/aios_v2_candidate/test_v2r1c6_privacy_tools.py
-82ab1aa2d50d74a96392a01bb3c0b80eb9033f5bcbd5555487c22bc9250f412d  tests/aios_v2_candidate/test_v2r1c6_release_consistency.py
-3b4a466cee373714805f50232d129ba06322027c51c467d1f35ab2c852b64c12  versions/V2R1C6.json
@@ -1,8 +0,0 @@
-AIOS V2R1C6 candidate artifact
-repository: aios/aios
-base_ref: refs/heads/main
-base_oid: a33e2593967a180c89d44454350ccaeaf3f79b25
-candidate_branch: agent/v2r1c6-mainline-reconciliation-20260806
-production_deployed: false
-tag_created: false
-baseline_changed: false
@@ -0,0 +1,183 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+REPO_ROOT="${AIOS_REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)}"
+BASE_REF="${AIOS_DOCS_BASE_REF:-}"
+RUN_LIVE_HEALTHCHECK="${AIOS_RUN_LIVE_HEALTHCHECK:-0}"
+RESULT_DIR="${AIOS_ACCEPTANCE_RESULT_DIR:-$REPO_ROOT/.aios-evidence/acceptance}"
+STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
+RUN_DIR="$RESULT_DIR/$STAMP"
+SUMMARY="$RUN_DIR/summary.json"
+
+install -d -m 0750 "$RUN_DIR"
+
+pass=0
+failed=0
+warnings=0
+steps=()
+
+record() {
+  local name="$1" status="$2" code="$3" log="$4"
+  steps+=("$name|$status|$code|$log")
+  case "$status" in
+    通过) pass=$((pass + 1)) ;;
+    失败) failed=$((failed + 1)) ;;
+    警告) warnings=$((warnings + 1)) ;;
+  esac
+  printf '%s：%s（退出码 %s）\n' "$status" "$name" "$code"
+}
+
+run_step() {
+  local name="$1"
+  shift
+  local safe_name
+  safe_name="$(printf '%s' "$name" | tr ' /:' '___')"
+  local log="$RUN_DIR/${safe_name}.log"
+  set +e
+  (cd "$REPO_ROOT" && "$@") >"$log" 2>&1
+  local code=$?
+  set -e
+  if [[ "$code" -eq 0 ]]; then
+    record "$name" "通过" "$code" "$log"
+  else
+    record "$name" "失败" "$code" "$log"
+  fi
+}
+
+run_optional_step() {
+  local name="$1"
+  shift
+  local safe_name
+  safe_name="$(printf '%s' "$name" | tr ' /:' '___')"
+  local log="$RUN_DIR/${safe_name}.log"
+  set +e
+  (cd "$REPO_ROOT" && "$@") >"$log" 2>&1
+  local code=$?
+  set -e
+  if [[ "$code" -eq 0 ]]; then
+    record "$name" "通过" "$code" "$log"
+  else
+    record "$name" "警告" "$code" "$log"
+  fi
+}
+
+printf 'AIOS V2R1 Candidate 全量验收开始\n'
+printf '仓库：%s\n' "$REPO_ROOT"
+printf '结果目录：%s\n' "$RUN_DIR"
+
+[[ -d "$REPO_ROOT" ]] || { echo "错误：仓库不存在" >&2; exit 2; }
+
+DOCS_ARGS=(python3 tools/aios_v2_docs_code_check.py --repo "$REPO_ROOT")
+if [[ -n "$BASE_REF" ]]; then
+  DOCS_ARGS+=(--base-ref "$BASE_REF")
+fi
+run_step "文档与代码匹配" "${DOCS_ARGS[@]}"
+
+run_step "Python 语法编译" python3 -m compileall -q \
+  active-runtime/app/aios_v2 \
+  active-runtime/app/aios_openclaw \
+  active-runtime/app/aios_hermes
+
+run_step "候选单元与集成测试" python3 -m unittest discover \
+  -s tests/aios_v2_candidate \
+  -p 'test_*.py' \
+  -v
+
+run_step "Shell 脚本语法" bash -c '
+  set -Eeuo pipefail
+  while IFS= read -r -d "" path; do
+    bash -n "$path"
+  done < <(find deploy/aios-v2 -type f -name "*.sh" -print0)
+'
+
+run_step "文档 Git 冲突标记" bash -c '
+  set -Eeuo pipefail
+  if grep -RInE "^(<<<<<<<|=======|>>>>>>>)" docs/aios-v2; then
+    exit 1
+  fi
+'
+
+run_step "明文密钥基础扫描" python3 -c '
+from pathlib import Path
+import re
+import sys
+
+roots = [Path("active-runtime/app"), Path("deploy/aios-v2"), Path("docs/aios-v2"), Path("tasks")]
+patterns = [
+    re.compile(r"(?i)(api[_-]?key|password|private[_-]?key|access[_-]?token)\s*[:=]\s*[\"\x27][^\"\x27\n]{12,}[\"\x27]"),
+    re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
+]
+violations = []
+for root in roots:
+    if not root.exists():
+        continue
+    for path in root.rglob("*"):
+        if not path.is_file() or path.suffix in {".pyc", ".db", ".sqlite3"}:
+            continue
+        text = path.read_text(encoding="utf-8", errors="ignore")
+        if any(pattern.search(text) for pattern in patterns):
+            violations.append(str(path))
+if violations:
+    print("疑似明文密钥文件：", *violations, sep="\n", file=sys.stderr)
+    raise SystemExit(1)
+'
+
+if command -v systemd-analyze >/dev/null 2>&1; then
+  run_optional_step "systemd 单元验证" systemd-analyze verify \
+    deploy/aios-v2/systemd/aios-v2.service
+else
+  record "systemd 单元验证" "警告" "127" "未安装 systemd-analyze"
+fi
+
+if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
+  run_optional_step "Docker Compose 配置验证" docker compose \
+    -f deploy/aios-v2/docker/compose.yaml config
+else
+  record "Docker Compose 配置验证" "警告" "127" "未安装 Docker Compose"
+fi
+
+if [[ "$RUN_LIVE_HEALTHCHECK" == "1" ]]; then
+  run_step "在线健康检查" bash deploy/aios-v2/healthcheck/check.sh
+else
+  record "在线健康检查" "警告" "0" "未启用 AIOS_RUN_LIVE_HEALTHCHECK=1"
+fi
+
+branch="$(git -C "$REPO_ROOT" branch --show-current 2>/dev/null || true)"
+commit="$(git -C "$REPO_ROOT" rev-parse HEAD 2>/dev/null || true)"
+dirty="$(git -C "$REPO_ROOT" status --porcelain=v1 2>/dev/null || true)"
+
+python3 - "$SUMMARY" "$branch" "$commit" "$dirty" "$pass" "$failed" "$warnings" "${steps[@]}" <<'PY'
+import json
+import pathlib
+import sys
+from datetime import datetime, timezone
+
+summary_path = pathlib.Path(sys.argv[1])
+branch, commit, dirty = sys.argv[2:5]
+passed, failed, warnings = map(int, sys.argv[5:8])
+steps = []
+for item in sys.argv[8:]:
+    name, status, code, log = item.split("|", 3)
+    steps.append({"name": name, "status": status, "exit_code": int(code), "log": log})
+payload = {
+    "schema": "aios.v2.acceptance.v1",
+    "generated_at": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
+    "branch": branch or None,
+    "commit": commit or None,
+    "workspace_dirty": bool(dirty),
+    "passed": passed,
+    "failed": failed,
+    "warnings": warnings,
+    "steps": steps,
+    "final_status": "passed" if failed == 0 else "failed",
+}
+summary_path.write_text(json.dumps(payload, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+print(json.dumps(payload, ensure_ascii=False, indent=2))
+PY
+
+printf '验收结果：通过 %s，失败 %s，警告 %s\n' "$pass" "$failed" "$warnings"
+printf '证据：%s\n' "$SUMMARY"
+
+if [[ "$failed" -ne 0 ]]; then
+  exit 1
+fi
@@ -0,0 +1,24 @@
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PYTHONPATH=/opt/aios/app \
+    AIOS_V2_HOST=0.0.0.0 \
+    AIOS_V2_PORT=18920 \
+    AIOS_V2_STATE_DIR=/var/lib/aios-v2
+
+RUN groupadd --system --gid 12001 aios \
+    && useradd --system --uid 12001 --gid aios --home-dir /nonexistent --shell /usr/sbin/nologin aios \
+    && install -d -o aios -g aios -m 0750 /opt/aios/app /var/lib/aios-v2 \
+    && python3 -m pip install --no-cache-dir 'cryptography>=42'
+
+WORKDIR /opt/aios/app
+COPY --chown=aios:aios active-runtime/app/ /opt/aios/app/
+
+USER aios:aios
+EXPOSE 18920
+
+HEALTHCHECK --interval=15s --timeout=5s --start-period=10s --retries=4 \
+  CMD python3 -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:18920/api/v2/health', timeout=3).read()"
+
+CMD ["python3", "-m", "aios_v2.app"]
@@ -0,0 +1,44 @@
+services:
+  aios-v2:
+    build:
+      context: ../../..
+      dockerfile: deploy/aios-v2/docker/Dockerfile
+    image: aios-v2:V2R1C0-candidate
+    init: true
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:${AIOS_V2_PORT:-18920}:18920"
+    environment:
+      AIOS_V2_HOST: 0.0.0.0
+      AIOS_V2_PORT: 18920
+      AIOS_V2_STATE_DIR: /var/lib/aios-v2
+      AIOS_OPENCLAW_URL: ${AIOS_OPENCLAW_URL:-}
+      AIOS_OPENCLAW_CREDENTIAL_REF: ${AIOS_OPENCLAW_CREDENTIAL_REF:-}
+      AIOS_OPENCLAW_SIGNING_MATERIAL_FILE: ${AIOS_OPENCLAW_SIGNING_MATERIAL_FILE:-}
+      AIOS_RELEASE_CHANNEL: candidate
+      AIOS_RELEASE_VERSION: V2R1C0-candidate
+    volumes:
+      - aios-v2-state:/var/lib/aios-v2
+      # Mount runtime signing material explicitly when OpenClaw is enabled.
+      # The host file must be mode 0600; never store it in this repository.
+      # - /etc/aios-v2/openclaw-signing-material:/run/secrets/openclaw-signing-material:ro
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=64m
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test:
+        - CMD
+        - python3
+        - -c
+        - "import urllib.request; urllib.request.urlopen('http://127.0.0.1:18920/api/v2/health', timeout=3).read()"
+      interval: 15s
+      timeout: 5s
+      retries: 4
+      start_period: 10s
+
+volumes:
+  aios-v2-state:
@@ -0,0 +1,45 @@
+# AIOS V2R1 Candidate 环境模板
+# 正式环境禁止保存明文 Secret。
+# Provenance/OpenClaw 私钥只用于签发端，不进入应用容器或 Git。
+
+# Runtime
+AIOS_V2_HOST=127.0.0.1
+AIOS_V2_PORT=18920
+AIOS_V2_STATE_DIR=/var/lib/aios-v2
+
+# OpenClaw Ed25519 Command v2
+AIOS_OPENCLAW_URL=
+AIOS_OPENCLAW_CREDENTIAL_REF=
+AIOS_OPENCLAW_SIGNING_MATERIAL_FILE=/run/credentials/aios-v2.service/openclaw-command-private-key
+AIOS_OPENCLAW_SIGNING_KEY_ID=openclaw-v2r1-candidate-ed25519
+
+# Parent Workflow Provenance
+AIOS_REQUIRE_RUN_PROVENANCE=true
+AIOS_PROVENANCE_PUBLIC_KEY_FILE=/etc/aios-v2/provenance/public-key.pem
+AIOS_PROVENANCE_KEY_ID=openclaw-v2r1-candidate-ed25519
+AIOS_PROVENANCE_STORE_FILE=/var/lib/aios-v2/run-provenance.sqlite3
+AIOS_PROVENANCE_RECEIPT_DIR=/var/lib/aios-v2/provenance-receipts
+
+# Least-privilege child Grants: production requires all seven IDs.
+AIOS_PROVENANCE_GRANT_CODE_CHANGE_ID=
+AIOS_PROVENANCE_GRANT_GIT_ID=
+AIOS_PROVENANCE_GRANT_DEPLOYMENT_ID=
+AIOS_PROVENANCE_GRANT_RUNTIME_ID=
+AIOS_PROVENANCE_GRANT_EVIDENCE_ID=
+AIOS_PROVENANCE_GRANT_ROLLBACK_ID=
+AIOS_PROVENANCE_GRANT_AUDIT_ID=
+
+# Per-operation context. Deployment/rollback wrappers populate these from the
+# approved task execution context; do not hard-code shared production values.
+AIOS_PROVENANCE_ID=
+AIOS_RUN_ID=
+AIOS_TENANT_ID=
+AIOS_TASK_ID=
+AIOS_AGENT_ID=
+AIOS_PRINCIPAL_ID=
+
+# 禁止：
+# AIOS_PROVENANCE_PRIVATE_KEY_FILE
+# AIOS_OPENCLAW_TOKEN
+# API_KEY=value
+# PASSWORD=value
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+BASE_URL="${AIOS_V2_BASE_URL:-http://127.0.0.1:18920}"
+STATE_DIR="${AIOS_V2_STATE_DIR:-/var/lib/aios-v2}"
+CONTROLLER_WT="${AIOS_GITOPS_CONTROLLER_WORKTREE:-/data/aios-gitops/worktrees/controller}"
+SERVICE="${AIOS_V2_SERVICE:-aios-v2}"
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+pass() {
+  echo "PASS: $*"
+}
+
+command -v python3 >/dev/null || fail "python3 not installed"
+
+if command -v systemctl >/dev/null && systemctl list-unit-files "$SERVICE.service" >/dev/null 2>&1; then
+  systemctl is-active --quiet "$SERVICE" || fail "$SERVICE is not active"
+  pass "$SERVICE is active"
+fi
+
+python3 - "$BASE_URL" <<'PY'
+import json
+import sys
+import urllib.request
+
+base_url = sys.argv[1].rstrip("/")
+with urllib.request.urlopen(f"{base_url}/api/v2/health", timeout=5) as response:
+    payload = json.loads(response.read().decode("utf-8"))
+if payload.get("status") not in {"ok", "healthy", "ready"}:
+    raise SystemExit(f"unexpected health payload: {payload}")
+print(f"PASS: HTTP health status={payload.get('status')}")
+PY
+
+[[ -d "$STATE_DIR" ]] || fail "state directory missing: $STATE_DIR"
+[[ -w "$STATE_DIR" ]] || fail "state directory not writable: $STATE_DIR"
+pass "state directory writable"
+
+if [[ -e "$STATE_DIR/control-plane.sqlite3" ]]; then
+  python3 - "$STATE_DIR/control-plane.sqlite3" <<'PY'
+import sqlite3
+import sys
+
+path = sys.argv[1]
+connection = sqlite3.connect(f"file:{path}?mode=ro", uri=True, timeout=5)
+try:
+    row = connection.execute("PRAGMA quick_check").fetchone()
+finally:
+    connection.close()
+if not row or row[0] != "ok":
+    raise SystemExit(f"SQLite quick_check failed: {row}")
+print("PASS: SQLite quick_check=ok")
+PY
+else
+  echo "WARN: control-plane.sqlite3 not created yet"
+fi
+
+if [[ -d "$CONTROLLER_WT" ]] && git -C "$CONTROLLER_WT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  branch="$(git -C "$CONTROLLER_WT" branch --show-current)"
+  dirty="$(git -C "$CONTROLLER_WT" status --porcelain=v1)"
+  [[ -z "$branch" ]] || fail "GitOps controller attached to branch: $branch"
+  [[ -z "$dirty" ]] || fail "GitOps controller workspace is dirty"
+  pass "GitOps controller detached and clean"
+fi
+
+python3 - "$STATE_DIR/executions" <<'PY'
+import json
+import pathlib
+import sys
+
+root = pathlib.Path(sys.argv[1])
+if not root.exists():
+    print("WARN: execution evidence directory not created yet")
+    raise SystemExit(0)
+for path in root.glob("*/*.json"):
+    value = json.loads(path.read_text(encoding="utf-8"))
+    for key in ("execution_id", "tenant_id", "task_id", "executor", "status"):
+        if not value.get(key):
+            raise SystemExit(f"invalid execution evidence {path}: missing {key}")
+print("PASS: execution evidence files valid")
+PY
+
+pass "AIOS V2 candidate healthcheck complete"
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+OPERATION_PATH="${1:-}"
+OPERATION_NAME="${2:-}"
+REQUEST_FILE="${3:-}"
+
+fail() {
+  echo "PROVENANCE_DENIED: $*" >&2
+  exit 1
+}
+
+[[ -n "$OPERATION_PATH" ]] || fail "usage: $0 <deployment|rollback|audit|code_change|runtime_execute|evidence_write> <operation> <request-json-file>"
+[[ -n "$OPERATION_NAME" ]] || fail "operation name is required"
+[[ -n "$REQUEST_FILE" && -f "$REQUEST_FILE" ]] || fail "request JSON file is required"
+
+: "${AIOS_PROVENANCE_PUBLIC_KEY_FILE:?missing AIOS_PROVENANCE_PUBLIC_KEY_FILE}"
+: "${AIOS_PROVENANCE_KEY_ID:?missing AIOS_PROVENANCE_KEY_ID}"
+: "${AIOS_PROVENANCE_STORE_FILE:?missing AIOS_PROVENANCE_STORE_FILE}"
+: "${AIOS_PROVENANCE_RECEIPT_DIR:?missing AIOS_PROVENANCE_RECEIPT_DIR}"
+: "${AIOS_PROVENANCE_ID:?missing AIOS_PROVENANCE_ID}"
+: "${AIOS_RUN_ID:?missing AIOS_RUN_ID}"
+: "${AIOS_TENANT_ID:?missing AIOS_TENANT_ID}"
+: "${AIOS_TASK_ID:?missing AIOS_TASK_ID}"
+: "${AIOS_AGENT_ID:?missing AIOS_AGENT_ID}"
+: "${AIOS_PRINCIPAL_ID:?missing AIOS_PRINCIPAL_ID}"
+
+PYTHONPATH_VALUE="${AIOS_V2_PYTHONPATH:-/opt/aios/current/active-runtime/app}"
+
+PYTHONPATH="$PYTHONPATH_VALUE${PYTHONPATH:+:$PYTHONPATH}" \
+python3 -m aios_v2.provenance_cli authorize \
+  --context-from-env \
+  --store-file "$AIOS_PROVENANCE_STORE_FILE" \
+  --public-key-file "$AIOS_PROVENANCE_PUBLIC_KEY_FILE" \
+  --key-id "$AIOS_PROVENANCE_KEY_ID" \
+  --receipt-dir "$AIOS_PROVENANCE_RECEIPT_DIR" \
+  --path "$OPERATION_PATH" \
+  --operation "$OPERATION_NAME" \
+  --request-file "$REQUEST_FILE"
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+SERVICE="${AIOS_V2_SERVICE:-aios-v2}"
+RELEASE_ROOT="${AIOS_V2_RELEASE_ROOT:-/opt/aios/releases}"
+CURRENT_LINK="${AIOS_V2_CURRENT_LINK:-/opt/aios/current}"
+STATE_DIR="${AIOS_V2_STATE_DIR:-/var/lib/aios-v2}"
+BACKUP_ROOT="${AIOS_V2_BACKUP_ROOT:-/var/backups/aios-v2}"
+TARGET_RELEASE="${1:-}"
+RESTORE_STATE="${AIOS_V2_RESTORE_STATE:-0}"
+HEALTH_RETRIES="${AIOS_V2_ROLLBACK_HEALTH_RETRIES:-30}"
+HEALTH_RETRY_DELAY="${AIOS_V2_ROLLBACK_HEALTH_RETRY_DELAY:-1}"
+
+fail() {
+  echo "ERROR: $*" >&2
+  exit 1
+}
+
+run_healthcheck() {
+  local release="$1"
+  local attempt
+  for ((attempt = 1; attempt <= HEALTH_RETRIES; attempt++)); do
+    if AIOS_V2_SERVICE="$SERVICE" \
+       AIOS_V2_STATE_DIR="$STATE_DIR" \
+       "$release/deploy/aios-v2/healthcheck/check.sh"; then
+      return 0
+    fi
+    [[ "$attempt" -lt "$HEALTH_RETRIES" ]] && sleep "$HEALTH_RETRY_DELAY"
+  done
+  return 1
+}
+
+[[ "${EUID}" -eq 0 ]] || fail "rollback must run as root"
+[[ -n "$TARGET_RELEASE" ]] || fail "usage: $0 <release-name-or-absolute-path>"
+
+if [[ "$TARGET_RELEASE" = /* ]]; then
+  TARGET_PATH="$(readlink -f "$TARGET_RELEASE")"
+else
+  [[ "$TARGET_RELEASE" != *"/"* && "$TARGET_RELEASE" != "." && "$TARGET_RELEASE" != ".." ]] \
+    || fail "invalid release name"
+  TARGET_PATH="$(readlink -f "$RELEASE_ROOT/$TARGET_RELEASE")"
+fi
+
+[[ -d "$TARGET_PATH/active-runtime/app" ]] || fail "target release is invalid: $TARGET_PATH"
+[[ -f "$TARGET_PATH/deploy/aios-v2/healthcheck/check.sh" ]] \
+  || fail "target release has no healthcheck"
+
+PREVIOUS_PATH=""
+if [[ -L "$CURRENT_LINK" ]]; then
+  PREVIOUS_PATH="$(readlink -f "$CURRENT_LINK")"
+fi
+
+STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
+BACKUP_DIR="$BACKUP_ROOT/rollback-$STAMP"
+install -d -m 0750 "$BACKUP_DIR"
+
+if [[ -d "$STATE_DIR" ]]; then
+  tar --xattrs --acls -C "$(dirname "$STATE_DIR")" \
+    -czf "$BACKUP_DIR/state-before-rollback.tar.gz" \
+    "$(basename "$STATE_DIR")"
+fi
+
+printf '%s\n' "$PREVIOUS_PATH" > "$BACKUP_DIR/previous-release.txt"
+printf '%s\n' "$TARGET_PATH" > "$BACKUP_DIR/target-release.txt"
+
+systemctl stop "$SERVICE"
+ln -sfn "$TARGET_PATH" "${CURRENT_LINK}.next"
+mv -Tf "${CURRENT_LINK}.next" "$CURRENT_LINK"
+systemctl daemon-reload
+systemctl start "$SERVICE"
+
+if run_healthcheck "$TARGET_PATH"; then
+  echo "ROLLBACK_COMPLETE target=$TARGET_PATH backup=$BACKUP_DIR"
+  exit 0
+fi
+
+echo "Target release failed healthcheck; restoring previous release." >&2
+systemctl stop "$SERVICE" || true
+
+if [[ -n "$PREVIOUS_PATH" && -d "$PREVIOUS_PATH" ]]; then
+  ln -sfn "$PREVIOUS_PATH" "${CURRENT_LINK}.previous"
+  mv -Tf "${CURRENT_LINK}.previous" "$CURRENT_LINK"
+fi
+
+if [[ "$RESTORE_STATE" == "1" && -f "$BACKUP_DIR/state-before-rollback.tar.gz" ]]; then
+  rm -rf "$STATE_DIR"
+  tar --xattrs --acls -C "$(dirname "$STATE_DIR")" \
+    -xzf "$BACKUP_DIR/state-before-rollback.tar.gz"
+fi
+
+systemctl daemon-reload
+systemctl start "$SERVICE" || true
+
+if [[ -n "$PREVIOUS_PATH" && -x "$PREVIOUS_PATH/deploy/aios-v2/healthcheck/check.sh" ]]; then
+  run_healthcheck "$PREVIOUS_PATH" || true
+fi
+
+fail "rollback target failed; previous release restored; evidence=$BACKUP_DIR"
@@ -0,0 +1,37 @@
+[Unit]
+Description=AIOS V2 Control Plane Candidate
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=aios
+Group=aios
+WorkingDirectory=/opt/aios/current/active-runtime/app
+EnvironmentFile=-/etc/aios-v2/aios-v2.env
+Environment=PYTHONUNBUFFERED=1
+ExecStart=/usr/bin/python3 -m aios_v2.app
+Restart=on-failure
+RestartSec=3
+TimeoutStartSec=30
+TimeoutStopSec=30
+KillSignal=SIGTERM
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+ReadWritePaths=/var/lib/aios-v2
+StateDirectory=aios-v2
+StateDirectoryMode=0750
+UMask=0027
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,30 @@
+# AIOS V2R1C2 Unified Portal Candidate
+# Install as /etc/aios-v2/aios-v2r1c2-portal.env with mode 0640.
+# Do not place secret values in this file. Use secret references only.
+
+AIOS_V2_HOST=127.0.0.1
+AIOS_V2_PORT=18921
+AIOS_V2_STATE_DIR=/var/lib/aios-v2r1c2-portal
+AIOS_PROVENANCE_STORE_FILE=/var/lib/aios-v2r1c2-portal/run-provenance.sqlite3
+AIOS_EXTERNAL_TASK_STORE_FILE=/var/lib/aios-v2r1c2-portal/external-task-truth.sqlite3
+AIOS_EXECUTOR_CATALOG_FILE=/var/lib/aios-v2r1c2-portal/executor-catalog.json
+AIOS_EXECUTION_PLAN_FILES=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-RELEASE.json:/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+AIOS_EXECUTION_PLAN_FILE=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+
+AIOS_RELEASE_VERSION=V2R1C2-CANDIDATE
+AIOS_TARGET_VERSION=V2R1C2
+AIOS_BASELINE_VERSION=V2R1C1
+AIOS_PREVIOUS_VERSION=V2R1C1
+AIOS_RELEASE_STATUS=CANDIDATE_VALIDATION
+AIOS_RELEASE_SOURCE_OID=REPLACE_WITH_EXACT_40_CHARACTER_GIT_OID
+AIOS_RELEASE_OID=candidate-not-tagged
+AIOS_RELEASE_TAG=NOT_CREATED
+AIOS_RELEASE_EVIDENCE_SHA256=pending
+
+AIOS_OPENCLAW_CONTRACT_VERSION=aios.openclaw.command.v2
+AIOS_OPENCLAW_SIGNATURE_ALGORITHM=Ed25519
+AIOS_OPENCLAW_PLUGIN_VERSION=2.1.0-rc.4
+AIOS_OPENCLAW_SIGNING_KEY_ID=openclaw-v2r1-candidate-ed25519
+
+# Runtime resolves this reference through its secret store.
+AIOS_OWNER_WECHAT_TARGET_REF=AIOS_OWNER_WECHAT_TARGET_REF
@@ -0,0 +1,44 @@
+[Unit]
+Description=AIOS V2R1C2 Unified Portal Candidate
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/opt/aios-v2r1c2/active-runtime/app/aios_web/release_application.py
+ConditionPathExists=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-RELEASE.json
+ConditionPathExists=/opt/aios-v2r1c2/plans/AIOS-V2R1C2-UNIFIED-PORTAL-TAKEOVER.json
+
+[Service]
+Type=simple
+User=aios
+Group=aios
+WorkingDirectory=/opt/aios-v2r1c2/active-runtime/app
+EnvironmentFile=/etc/aios-v2/aios-v2r1c2-portal.env
+Environment=PYTHONUNBUFFERED=1
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStartPre=/usr/bin/test "$AIOS_V2_PORT" = "18921"
+ExecStartPre=/usr/bin/test -n "$AIOS_RELEASE_SOURCE_OID"
+ExecStartPre=/usr/bin/test "$AIOS_RELEASE_SOURCE_OID" != "candidate-not-tagged"
+ExecStart=/usr/bin/python3 -m aios_web.release_application
+Restart=on-failure
+RestartSec=3
+TimeoutStartSec=60
+TimeoutStopSec=30
+KillSignal=SIGTERM
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+ReadWritePaths=/var/lib/aios-v2r1c2-portal
+StateDirectory=aios-v2r1c2-portal
+StateDirectoryMode=0750
+UMask=0027
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target
@@ -1,4 +0,0 @@
-AIOS_V2_VERSION=V2R1C6
-AIOS_V2R1C6_PORT=18926
-AIOS_GITOPS_WRITES_ENABLED=false
-AIOS_V2R1C6_PRODUCTION_DEPLOYED=false
@@ -1,30 +0,0 @@
-[Unit]
-Description=AIOS V2R1C6 candidate privacy service (not production-enabled)
-After=network.target
-
-[Service]
-Type=simple
-User=aios-v2r1c6
-Group=aios-v2r1c6
-WorkingDirectory=/opt/aios/v2r1c6
-EnvironmentFile=-/etc/aios/aios-v2r1c6.env
-Environment=AIOS_GITOPS_WRITES_ENABLED=false
-Environment=AIOS_V2R1C6_PRODUCTION_DEPLOYED=false
-ExecStart=/usr/bin/python3 /opt/aios/v2r1c6/active-runtime/app/v2r1c6_privacy_tools.py --serve --host 127.0.0.1 --port 18926
-Restart=on-failure
-RestartSec=5
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectHome=true
-ProtectSystem=strict
-ProtectKernelLogs=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectControlGroups=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-IPAddressDeny=any
-IPAddressAllow=localhost
-UMask=0077
-
-[Install]
-WantedBy=multi-user.target
@@ -1,17 +0,0 @@
-{
-  "schema": "aios.v2r1c6.candidate-rollback.v1",
-  "candidate_version": "V2R1C6",
-  "rollback_version": "V2R1C5",
-  "previous_tag": "V2R1C5",
-  "previous_tag_oid": "9e65bd59baea392294c0f253046d3ab116f63145",
-  "previous_target_oid": "aa60e891547abd7e215af7cf2bf3f21fd23541da",
-  "baseline_unchanged": true,
-  "tag_rewrite": false,
-  "force_push": false,
-  "production_deploy_authorized": false,
-  "rollback_steps": [
-    "stop aios-v2r1c6-production.service if a separately approved deployment exists",
-    "restore the V2R1C5 production artifact and service configuration",
-    "verify V2R1C5 tag and Baseline before any restart"
-  ]
-}
@@ -1,24 +0,0 @@
-[Unit]
-Description=AIOS manifest-driven release controller (validation only)
-ConditionPathExists=/var/lib/aios-release/release-source-manifest.json
-ConditionPathExists=/var/lib/aios-release/release-request.json
-After=network-online.target
-
-[Service]
-Type=oneshot
-User=aios-release
-Group=aios-release
-Environment=PYTHONPATH=/opt/aios/release-controller
-Environment=AIOS_GITOPS_WRITES_ENABLED=false
-Environment=AIOS_PRODUCTION_DEPLOYMENT_AUTHORIZED=false
-ExecStart=/usr/bin/python3 -m aios_release_controller.cli validate-release /var/lib/aios-release/release-source-manifest.json /var/lib/aios-release/release-request.json
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ProtectHome=yes
-ReadWritePaths=/var/lib/aios-release
-CapabilityBoundingSet=
-RestrictAddressFamilies=AF_UNIX
-
-[Install]
-WantedBy=multi-user.target
@@ -1,24 +0,0 @@
-[Unit]
-Description=AIOS governed Agent Pull Runner (example)
-After=network.target
-
-[Service]
-Type=simple
-User=aios-agent
-Group=aios-agent
-UMask=0077
-ExecStart=/usr/bin/python3 -B /opt/aios-gitops/active-runtime/app/agent_pull_runner_cli.py --worker-id %H
-NoNewPrivileges=true
-PrivateTmp=true
-PrivateDevices=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-RestrictSUIDSGID=true
-RestrictAddressFamilies=AF_UNIX AF_INET
-ReadWritePaths=/var/lib/aios-gitops/runtime/agent-pull-runner
-Restart=on-failure
-RestartSec=5
-
@@ -1,42 +0,0 @@
-[Unit]
-Description=AIOS Autonomous Release Candidate API (Dormant/Shadow Only)
-After=network.target
-ConditionPathExists=/opt/aios-autonomous-release-candidate/aios_autonomous_release_candidate
-
-[Service]
-Type=simple
-User=aiman
-Group=gitops
-UMask=0077
-WorkingDirectory=/opt/aios-autonomous-release-candidate
-Environment=PYTHONDONTWRITEBYTECODE=1
-Environment=PYTHONPATH=/opt/aios-autonomous-release-candidate
-Environment=AIOS_TASK_PLANE_EXECUTION_ENABLED=false
-Environment=AIOS_GITOPS_WRITES_ENABLED=false
-Environment=AIOS_PRODUCTION_DEPLOYMENT_ENABLED=false
-ExecStart=/usr/bin/python3 -m aios_autonomous_release_candidate.service --host 127.0.0.1 --port 19951 --state /var/lib/aios-autonomous-release-candidate/state.sqlite3
-StateDirectory=aios-autonomous-release-candidate
-RuntimeDirectory=aios-autonomous-release-candidate
-NoNewPrivileges=true
-PrivateTmp=true
-PrivateDevices=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectKernelLogs=true
-ProtectControlGroups=true
-ProtectClock=true
-ProtectHostname=true
-LockPersonality=true
-RestrictSUIDSGID=true
-RestrictRealtime=true
-MemoryDenyWriteExecute=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-IPAddressDeny=any
-IPAddressAllow=localhost
-ReadOnlyPaths=/opt/aios-autonomous-release-candidate
-ReadWritePaths=/var/lib/aios-autonomous-release-candidate
-
-[Install]
-WantedBy=multi-user.target
@@ -1,51 +0,0 @@
-[Unit]
-Description=AIOS Autonomous Release Candidate Worker (Dormant/Shadow Only)
-After=network.target
-ConditionPathExists=/opt/aios-autonomous-release-candidate/aios_autonomous_release_candidate
-
-[Service]
-Type=simple
-User=aiman
-Group=gitops
-UMask=0077
-WorkingDirectory=/opt/aios-autonomous-release-candidate
-Environment=PYTHONDONTWRITEBYTECODE=1
-Environment=PYTHONPATH=/opt/aios-autonomous-release-candidate
-Environment=AIOS_TASK_PLANE_EXECUTION_ENABLED=false
-Environment=AIOS_GITOPS_WRITES_ENABLED=false
-Environment=AIOS_PRODUCTION_DEPLOYMENT_ENABLED=false
-Environment=AIOS_CANDIDATE_CONTROL_ENDPOINT=127.0.0.1:19951
-Environment=AIOS_OPENCLAW_CREDENTIAL_REFERENCE=systemd-credential:openclaw-gateway-candidate
-Environment=AIOS_CODEX_CREDENTIAL_REFERENCE=systemd-credential:codex-app-server-candidate
-Environment=AIOS_NATIVE_CONTROL_CREDENTIAL_REFERENCE=systemd-credential:session-native-adapter-control-candidate
-Environment=AIOS_GITEA_CREDENTIAL_REFERENCE=systemd-credential:gitea-admin-api-candidate
-ImportCredential=openclaw-gateway-candidate
-ImportCredential=codex-app-server-candidate
-ImportCredential=session-native-adapter-control-candidate
-ImportCredential=gitea-admin-api-candidate
-ExecStart=/usr/bin/python3 -m aios_autonomous_release_candidate.worker_service --state-directory /var/lib/aios-autonomous-release-worker-candidate
-StateDirectory=aios-autonomous-release-worker-candidate
-RuntimeDirectory=aios-autonomous-release-worker-candidate
-NoNewPrivileges=true
-PrivateTmp=true
-PrivateDevices=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectKernelLogs=true
-ProtectControlGroups=true
-ProtectClock=true
-ProtectHostname=true
-LockPersonality=true
-RestrictSUIDSGID=true
-RestrictRealtime=true
-MemoryDenyWriteExecute=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-IPAddressDeny=any
-IPAddressAllow=localhost
-ReadOnlyPaths=/opt/aios-autonomous-release-candidate
-ReadWritePaths=/var/lib/aios-autonomous-release-worker-candidate
-
-[Install]
-WantedBy=multi-user.target
--- a/Show More
+++ b/Show More