feat(online-agent): add durable checkpoint and retry-safe resume

active-runtime/app/agent_event_bus.py

@@ -13,6 +13,7 @@ from hashlib import sha256
 from pathlib import Path
 import json
 from typing import Any
+from message_handoff import stable_event_id
 
 
 def utc_now() -> str:
@@ -55,13 +56,19 @@ class AgentEventBus:
         payload: dict[str, Any],
         correlation_id: str | None = None,
     ) -> dict[str, Any]:
-        event_id = "evt_" + sha256(
-            json.dumps(
-                {"kind": kind, "source": source, "summary": summary, "payload": payload},
-                sort_keys=True,
-                ensure_ascii=False,
-            ).encode("utf-8")
-        ).hexdigest()[:16]
+        event_id = stable_event_id(
+            source=source, target=target, message_type=kind, payload=payload,
+            tenant_id=(payload.get('tenant_id') if isinstance(payload, dict) else None),
+            user_id=(payload.get('user_id') if isinstance(payload, dict) else None),
+            project_id=(payload.get('project_id') if isinstance(payload, dict) else None),
+            conversation_id=(payload.get('conversation_id') if isinstance(payload, dict) else None),
+            task_id=(payload.get('task_id') if isinstance(payload, dict) else None),
+            run_id=(payload.get('run_id') if isinstance(payload, dict) else None),
+            correlation_id=(payload.get('correlation_id') if isinstance(payload, dict) else None),
+            causation_id=(payload.get('causation_id') if isinstance(payload, dict) else None),
+            sequence=(payload.get('sequence') if isinstance(payload, dict) else None),
+            idempotency_key=(payload.get('idempotency_key') if isinstance(payload, dict) else None),
+        )
         event = AgentEvent(event_id, kind, source, target, summary, payload, correlation_id=correlation_id)
         self._write("pending", event.to_dict())
         self._audit("created", event.to_dict())

active-runtime/app/agent_event_observability_bridge.py

@@ -7,7 +7,7 @@ class AgentEventObservabilityBridge:
     def __init__(self, hooks: AgentObservabilityHooks | None = None):
         self.hooks = hooks or AgentObservabilityHooks()
 
-    def consume(self, event: dict):
+    def consume(self, event: dict, *, actor=None, trace=None):
         kind = event.get("kind")
         payload = event.get("payload", {})
         if kind == "agent_started":
@@ -16,6 +16,8 @@ class AgentEventObservabilityBridge:
                 visible_scope=payload.get("scope", "self"),
                 entry_agent=payload.get("agent", "unknown"),
                 execution_id=event.get("id"),
+                actor=actor,
+                trace=trace,
             )
         if kind == "agent_delegated":
             return self.hooks.delegate(event["execution_id"], payload.get("agent", "unknown"))

active-runtime/app/agent_observability.py

@@ -31,6 +31,18 @@ class AgentExecutionRecord:
     status: str = "completed"
     started_at: str = field(default_factory=utc_now)
     ended_at: str = field(default_factory=utc_now)
+    trace_id: str | None = None
+    span_id: str | None = None
+    parent_span_id: str | None = None
+    correlation_id: str | None = None
+    causation_id: str | None = None
+    tenant_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    task_id: str | None = None
+    claim_id: str | None = None
+    run_id: str | None = None
+    message_id: str | None = None
 
     def to_dict(self):
         return asdict(self)

active-runtime/app/agent_observability_api.py

@@ -9,25 +9,49 @@ try:
 except Exception:
     APIRouter = None
 
-from .agent_observability import AgentExecutionRecord
+from .agent_observability import AgentExecutionRecord, AgentObservability
 from .agent_observability_dashboard import AgentObservabilityDashboard
 from .agent_observability_store import AgentObservabilityStore
+from .trace_tool_credential_governance import GovernanceActor, TraceContext, authorize_scope
 
 store = AgentObservabilityStore()
 dashboard = AgentObservabilityDashboard(store.load())
 
 
-def record_agent_execution(payload: dict[str, Any]):
-    record = AgentExecutionRecord(**payload)
+def record_agent_execution(payload: dict[str, Any], *, actor: GovernanceActor | dict[str, Any] | None = None, trace: TraceContext | None = None):
+    scoped = any(payload.get(name) is not None for name in (
+        "trace_id", "span_id", "tenant_id", "project_id", "conversation_id", "task_id", "run_id"
+    ))
+    values = dict(payload)
+    if scoped:
+        if actor is None or trace is None:
+            raise RuntimeError("TRACE_ACTOR_CONTEXT_REQUIRED")
+        trusted = GovernanceActor.from_value(actor)
+        authorize_scope(trusted, trace.scope)
+        bound = {
+            "trace_id": trace.trace_id, "span_id": trace.span_id,
+            "parent_span_id": trace.parent_span_id, "correlation_id": trace.correlation_id,
+            "causation_id": trace.causation_id, "tenant_id": trace.scope.tenant_id,
+            "user_id": trace.scope.user_id, "project_id": trace.scope.project_id,
+            "conversation_id": trace.scope.conversation_id, "task_id": trace.task_id,
+            "claim_id": trace.claim_id, "run_id": trace.scope.run_id, "message_id": trace.message_id,
+        }
+        for name, authoritative in bound.items():
+            if values.get(name) not in (None, authoritative):
+                raise RuntimeError("TRACE_SCOPE_MISMATCH_DENY:" + name)
+            values[name] = authoritative
+    record = AgentExecutionRecord(**values)
     return {"status": "ok", "record": store.append(record)}
 
 
-def get_agent_observability(user_id: str | None = None, group_id: str | None = None, role: str = "user"):
-    records = store.query(user_id, group_id, role)
+def get_agent_observability(user_id: str | None = None, group_id: str | None = None, role: str = "user", *, actor: GovernanceActor | dict[str, Any] | None = None):
+    records = store.query(user_id, group_id, role, actor=actor)
+    visible = AgentObservability()
+    visible.records = [AgentExecutionRecord(**record) for record in records]
     return {
         "status": "ok",
         "records": records,
-        "summary": store.load().summary(user_id if role != "owner" else None),
+        "summary": visible.summary(None),
     }
 
 

active-runtime/app/agent_observability_hooks.py

@@ -14,6 +14,11 @@ from uuid import uuid4
 
 from .agent_observability import AgentExecutionRecord
 from .agent_observability_store import AgentObservabilityStore
+from .trace_tool_credential_governance import (
+    GovernanceActor,
+    TraceContext,
+    authorize_scope,
+)
 
 
 def utc_now() -> str:
@@ -36,6 +41,7 @@ class AgentRunContext:
     input_tokens: int = 0
     output_tokens: int = 0
     status: str = "running"
+    trace: TraceContext | None = None
 
     def delegate(self, agent_name: str) -> None:
         if agent_name not in self.path:
@@ -59,7 +65,19 @@ class AgentObservabilityHooks:
         visible_scope: str,
         entry_agent: str,
         execution_id: str | None = None,
+        *,
+        actor: GovernanceActor | dict[str, Any] | None = None,
+        trace: TraceContext | None = None,
     ) -> dict[str, Any]:
+        if execution_id is not None and execution_id in self.active:
+            raise RuntimeError("OBSERVABILITY_EXECUTION_CONFLICT")
+        if trace is not None:
+            if actor is None:
+                raise RuntimeError("TRACE_ACTOR_CONTEXT_REQUIRED")
+            trusted_actor = GovernanceActor.from_value(actor)
+            authorize_scope(trusted_actor, trace.scope)
+            if trace.scope.user_id is not None and trace.scope.user_id != user_id:
+                raise RuntimeError("TRACE_SCOPE_MISMATCH_DENY:user_id")
         run = AgentRunContext(
             execution_id=execution_id or f"exec_{uuid4().hex[:12]}",
             user_id=user_id,
@@ -67,6 +85,7 @@ class AgentObservabilityHooks:
             entry_agent=entry_agent,
             path=[entry_agent],
             used_hermes=entry_agent.lower() == "hermes",
+            trace=trace,
         )
         self.active[run.execution_id] = run
         return {"status": "started", "execution_id": run.execution_id, "run": run.__dict__}
@@ -106,6 +125,18 @@ class AgentObservabilityHooks:
             status=status,
             started_at=run.started_at,
             ended_at=ended_at,
+            trace_id=run.trace.trace_id if run.trace else None,
+            span_id=run.trace.span_id if run.trace else None,
+            parent_span_id=run.trace.parent_span_id if run.trace else None,
+            correlation_id=run.trace.correlation_id if run.trace else None,
+            causation_id=run.trace.causation_id if run.trace else None,
+            tenant_id=run.trace.scope.tenant_id if run.trace else None,
+            project_id=run.trace.scope.project_id if run.trace else None,
+            conversation_id=run.trace.scope.conversation_id if run.trace else None,
+            task_id=run.trace.task_id if run.trace else None,
+            claim_id=run.trace.claim_id if run.trace else None,
+            run_id=run.trace.scope.run_id if run.trace else None,
+            message_id=run.trace.message_id if run.trace else None,
         )
         return {"status": "stored", "record": self.store.append(record)}
 

active-runtime/app/agent_observability_store.py

@@ -12,6 +12,12 @@ from pathlib import Path
 from typing import Any
 
 from .agent_observability import AgentExecutionRecord, AgentObservability
+from .trace_tool_credential_governance import (
+    GovernanceActor,
+    GovernanceError,
+    GovernanceScope,
+    authorize_scope,
+)
 
 
 class AgentObservabilityStore:
@@ -23,6 +29,11 @@ class AgentObservabilityStore:
     def append(self, record: AgentExecutionRecord) -> dict[str, Any]:
         path = self.records_dir / f"{record.execution_id}.json"
         data = record.to_dict()
+        if path.exists():
+            existing = json.loads(path.read_text(encoding="utf-8"))
+            if existing == data:
+                return existing
+            raise RuntimeError("OBSERVABILITY_EXECUTION_CONFLICT")
         path.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
         return data
 
@@ -33,8 +44,36 @@ class AgentObservabilityStore:
             observability.records.append(AgentExecutionRecord(**raw))
         return observability
 
-    def query(self, user_id: str | None = None, group_id: str | None = None, role: str = "user") -> list[dict[str, Any]]:
+    def query(self, user_id: str | None = None, group_id: str | None = None, role: str = "user", *, actor: GovernanceActor | dict[str, Any] | None = None) -> list[dict[str, Any]]:
         records = [record.to_dict() for record in self.load().records]
+        scoped = [record for record in records if record.get("tenant_id") is not None]
+        legacy = [record for record in records if record.get("tenant_id") is None]
+        if actor is not None:
+            trusted = GovernanceActor.from_value(actor)
+            visible: list[dict[str, Any]] = []
+            for record in scoped:
+                try:
+                    authorize_scope(
+                        trusted,
+                        GovernanceScope(
+                            "tenant",
+                            tenant_id=record.get("tenant_id"),
+                            user_id=record.get("user_id"),
+                            project_id=record.get("project_id"),
+                            conversation_id=record.get("conversation_id"),
+                            run_id=record.get("run_id"),
+                        ),
+                    )
+                except GovernanceError:
+                    continue
+                visible.append(record)
+            if trusted.privileged:
+                visible.extend(legacy)
+            else:
+                visible.extend(record for record in legacy if record.get("user_id") == trusted.scope.user_id)
+            return visible
+        # Caller-supplied role remains a legacy compatibility path only.
+        records = legacy
         if role == "owner":
             return records
         if role == "group_admin" and group_id:

active-runtime/app/aios_agent_task_retry_extension.py

@@ -0,0 +1,427 @@
+"""Owner-controlled, CAS-bound retry extension for exhausted Online Agent Tasks."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import hashlib
+import hmac
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import json
+import os
+from pathlib import Path
+import re
+import sqlite3
+from typing import Any, Mapping
+
+TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
+KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
+MAX_BODY = 64 * 1024
+AUTHORIZE_EXTENSION_ID_ENV = "AIOS_AGENT_TASK_AUTHORIZATION_ID"
+
+
+class RetryExtensionError(RuntimeError):
+    def __init__(self, code: str, status: int = 409) -> None:
+        super().__init__(code)
+        self.code = code
+        self.status = status
+
+
+def _canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def _sha(value: object) -> str:
+    return hashlib.sha256(_canonical(value)).hexdigest()
+
+
+def _required_authorization_id() -> str:
+    value = os.environ.get(AUTHORIZE_EXTENSION_ID_ENV, "").strip()
+    if not value:
+        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_MISSING")
+    if KEY_RE.fullmatch(value) is None:
+        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_INVALID")
+    return value
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _require_string(value: object, code: str, pattern: re.Pattern[str] | None = None) -> str:
+    if not isinstance(value, str) or not value.strip():
+        raise RetryExtensionError(code, 400)
+    value = value.strip()
+    if pattern is not None and pattern.fullmatch(value) is None:
+        raise RetryExtensionError(code, 400)
+    return value
+
+
+@dataclass(frozen=True)
+class RetryExtensionRequest:
+    expected_status: str
+    expected_revision: int
+    expected_attempt: int
+    expected_max_attempts: int
+    next_max_attempts: int
+    previous_verification_sha256: str
+    authorization_id: str
+    idempotency_key: str
+
+    @classmethod
+    def from_mapping(cls, value: Mapping[str, Any]) -> "RetryExtensionRequest":
+        allowed = {
+            "expected_status", "expected_revision", "expected_attempt", "expected_max_attempts",
+            "next_max_attempts", "previous_verification_sha256", "authorization_id", "idempotency_key",
+        }
+        if set(value) != allowed:
+            raise RetryExtensionError("RETRY_EXTENSION_FIELDS_INVALID", 400)
+        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
+        if status != "FAILED":
+            raise RetryExtensionError("EXPECTED_STATUS_INVALID", 400)
+        ints: dict[str, int] = {}
+        for field in ("expected_revision", "expected_attempt", "expected_max_attempts", "next_max_attempts"):
+            item = value[field]
+            if not isinstance(item, int) or isinstance(item, bool) or item < 0:
+                raise RetryExtensionError("RETRY_EXTENSION_INTEGER_INVALID", 400)
+            ints[field] = item
+        if ints["expected_attempt"] != ints["expected_max_attempts"]:
+            raise RetryExtensionError("RETRY_EXTENSION_NOT_EXHAUSTED", 409)
+        if ints["next_max_attempts"] != ints["expected_max_attempts"] + 1:
+            raise RetryExtensionError("RETRY_EXTENSION_MUST_BE_BOUNDED_ONE_STEP", 400)
+        if ints["next_max_attempts"] > 50:
+            raise RetryExtensionError("RETRY_EXTENSION_LIMIT_EXCEEDED", 400)
+        verification = _require_string(value["previous_verification_sha256"], "VERIFICATION_SHA256_INVALID")
+        if re.fullmatch(r"[0-9a-f]{64}", verification) is None:
+            raise RetryExtensionError("VERIFICATION_SHA256_INVALID", 400)
+        authorization = _require_string(value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE)
+        key = _require_string(value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE)
+        return cls(
+            status,
+            ints["expected_revision"],
+            ints["expected_attempt"],
+            ints["expected_max_attempts"],
+            ints["next_max_attempts"],
+            verification,
+            authorization,
+            key,
+        )
+
+    def public(self) -> dict[str, Any]:
+        return {
+            "expected_status": self.expected_status,
+            "expected_revision": self.expected_revision,
+            "expected_attempt": self.expected_attempt,
+            "expected_max_attempts": self.expected_max_attempts,
+            "next_max_attempts": self.next_max_attempts,
+            "previous_verification_sha256": self.previous_verification_sha256,
+            "authorization_id": self.authorization_id,
+            "idempotency_key": self.idempotency_key,
+        }
+
+
+class RetryExtensionStore:
+    """Owns the official mutation. Direct/manual DB edits remain forbidden."""
+
+    def __init__(self, db_path: Path) -> None:
+        self.db_path = Path(db_path)
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(self.db_path, timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA foreign_keys=ON")
+        connection.execute("PRAGMA busy_timeout=30000")
+        return connection
+
+    @staticmethod
+    def _columns(connection: sqlite3.Connection, table: str) -> dict[str, sqlite3.Row]:
+        return {str(row["name"]): row for row in connection.execute(f'PRAGMA table_info("{table}")')}
+
+    @staticmethod
+    def _event_table(connection: sqlite3.Connection) -> tuple[str, dict[str, sqlite3.Row]]:
+        tables = {
+            row["name"]
+            for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")
+        }
+        for name in ("task_events", "events"):
+            if name not in tables:
+                continue
+            columns = RetryExtensionStore._columns(connection, name)
+            if "task_id" in columns and ("event_type" in columns or "type" in columns):
+                return name, columns
+        raise RetryExtensionError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
+
+    @staticmethod
+    def _verification_hash(raw: object) -> str:
+        if raw in (None, ""):
+            value: object = {}
+        elif isinstance(raw, str):
+            try:
+                value = json.loads(raw)
+            except json.JSONDecodeError as exc:
+                raise RetryExtensionError("TASK_VERIFICATION_INVALID", 409) from exc
+        else:
+            value = raw
+        return _sha(value)
+
+    @staticmethod
+    def _ensure_extension_table(connection: sqlite3.Connection) -> None:
+        connection.execute(
+            """
+            CREATE TABLE IF NOT EXISTS task_retry_extensions (
+              task_id TEXT NOT NULL,
+              idempotency_key TEXT NOT NULL,
+              request_sha256 TEXT NOT NULL,
+              authorization_id TEXT NOT NULL,
+              previous_verification_sha256 TEXT NOT NULL,
+              previous_max_attempts INTEGER NOT NULL,
+              next_max_attempts INTEGER NOT NULL,
+              expected_revision INTEGER NOT NULL,
+              applied_revision INTEGER NOT NULL,
+              created_at TEXT NOT NULL,
+              PRIMARY KEY(task_id, idempotency_key)
+            )
+            """
+        )
+
+    @staticmethod
+    def _insert_event(
+        connection: sqlite3.Connection,
+        task_id: str,
+        payload: Mapping[str, Any],
+    ) -> None:
+        table, columns = RetryExtensionStore._event_table(connection)
+        values: dict[str, Any] = {"task_id": task_id}
+        if "event_type" in columns:
+            values["event_type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
+        else:
+            values["type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
+        payload_text = json.dumps(payload, sort_keys=True, separators=(",", ":"))
+        if "payload_json" in columns:
+            values["payload_json"] = payload_text
+        elif "payload" in columns:
+            values["payload"] = payload_text
+        else:
+            raise RetryExtensionError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
+        if "created_at" in columns:
+            values["created_at"] = _now()
+        if "agent_id" in columns:
+            values["agent_id"] = "owner-control"
+        if "actor_id" in columns:
+            values["actor_id"] = "owner-control"
+        names = list(values)
+        sql = f'INSERT INTO "{table}" ({",".join(f"""\"{name}\"""" for name in names)}) VALUES ({",".join("?" for _ in names)})'
+        connection.execute(sql, tuple(values[name] for name in names))
+
+    def extend(self, task_id: str, request: RetryExtensionRequest) -> dict[str, Any]:
+        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
+        required_authorization_id = _required_authorization_id()
+        if request.authorization_id != required_authorization_id:
+            raise RetryExtensionError("RETRY_EXTENSION_AUTHORIZATION_ID_MISMATCH", 403)
+        request_payload = request.public()
+        request_sha = _sha(request_payload)
+        with self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            self._ensure_extension_table(connection)
+            replay = connection.execute(
+                "SELECT * FROM task_retry_extensions WHERE task_id=? AND idempotency_key=?",
+                (task_id, request.idempotency_key),
+            ).fetchone()
+            if replay is not None:
+                if replay["request_sha256"] != request_sha:
+                    raise RetryExtensionError("RETRY_EXTENSION_IDEMPOTENCY_CONFLICT", 409)
+                connection.commit()
+                return {
+                    "task_id": task_id,
+                    "status": "QUEUED",
+                    "attempt": request.expected_attempt,
+                    "max_attempts": int(replay["next_max_attempts"]),
+                    "revision": int(replay["applied_revision"]),
+                    "idempotent": True,
+                    "authorization_id": replay["authorization_id"],
+                    "previous_verification_sha256": replay["previous_verification_sha256"],
+                }
+
+            columns = self._columns(connection, "tasks")
+            required = {
+                "task_id", "status", "attempt", "max_attempts", "revision", "claimed_by",
+                "lease_token_hash", "lease_expires_at", "verification_json",
+            }
+            if not required.issubset(columns):
+                raise RetryExtensionError("TASK_SCHEMA_RETRY_EXTENSION_UNSUPPORTED", 503)
+            task = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
+            if task is None:
+                raise RetryExtensionError("TASK_NOT_FOUND", 404)
+            actual_verification_sha = self._verification_hash(task["verification_json"])
+            if actual_verification_sha != request.previous_verification_sha256:
+                raise RetryExtensionError("RETRY_EXTENSION_VERIFICATION_DRIFT", 409)
+            if (
+                task["status"] != request.expected_status
+                or int(task["revision"]) != request.expected_revision
+                or int(task["attempt"]) != request.expected_attempt
+                or int(task["max_attempts"]) != request.expected_max_attempts
+            ):
+                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
+            for lease_field in ("lease_token_hash", "lease_expires_at"):
+                if lease_field in columns and task[lease_field] not in (None, ""):
+                    raise RetryExtensionError("RETRY_EXTENSION_ACTIVE_LEASE_DENY", 409)
+
+            previous_claimed_by = task["claimed_by"]
+            applied_revision = request.expected_revision + 1
+            cursor = connection.execute(
+                """
+                UPDATE tasks
+                   SET status='QUEUED', max_attempts=?, revision=?, claimed_by=NULL,
+                       lease_token_hash=NULL, lease_expires_at=NULL
+                 WHERE task_id=? AND status=? AND revision=? AND attempt=? AND max_attempts=?
+                   AND claimed_by IS ?
+                   AND lease_token_hash IS NULL AND lease_expires_at IS NULL
+                """,
+                (
+                    request.next_max_attempts,
+                    applied_revision,
+                    task_id,
+                    request.expected_status,
+                    request.expected_revision,
+                    request.expected_attempt,
+                    request.expected_max_attempts,
+                    previous_claimed_by,
+                ),
+            )
+            if cursor.rowcount != 1:
+                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
+
+            event_payload = {
+                "schema": "aios.task-retry-extension.event.v1",
+                "task_id": task_id,
+                "authorization_id": request.authorization_id,
+                "idempotency_key": request.idempotency_key,
+                "previous_verification_sha256": request.previous_verification_sha256,
+                "previous_max_attempts": request.expected_max_attempts,
+                "next_max_attempts": request.next_max_attempts,
+                "previous_revision": request.expected_revision,
+                "applied_revision": applied_revision,
+                "request_sha256": request_sha,
+                "previous_claimed_by": previous_claimed_by,
+                "stale_terminal_claim_normalized": previous_claimed_by not in (None, ""),
+            }
+            self._insert_event(connection, task_id, event_payload)
+            connection.execute(
+                """
+                INSERT INTO task_retry_extensions(
+                  task_id,idempotency_key,request_sha256,authorization_id,previous_verification_sha256,
+                  previous_max_attempts,next_max_attempts,expected_revision,applied_revision,created_at
+                ) VALUES (?,?,?,?,?,?,?,?,?,?)
+                """,
+                (
+                    task_id,
+                    request.idempotency_key,
+                    request_sha,
+                    request.authorization_id,
+                    request.previous_verification_sha256,
+                    request.expected_max_attempts,
+                    request.next_max_attempts,
+                    request.expected_revision,
+                    applied_revision,
+                    _now(),
+                ),
+            )
+            connection.commit()
+            return {
+                "task_id": task_id,
+                "status": "QUEUED",
+                "attempt": request.expected_attempt,
+                "max_attempts": request.next_max_attempts,
+                "revision": applied_revision,
+                "idempotent": False,
+                "authorization_id": request.authorization_id,
+                "previous_verification_sha256": request.previous_verification_sha256,
+            }
+
+
+class RetryExtensionHandler(BaseHTTPRequestHandler):
+    store: RetryExtensionStore | None = None
+    control_token: str = ""
+
+    def log_message(self, *_args: Any) -> None:
+        return
+
+    def _json(self, value: Mapping[str, Any], status: int) -> None:
+        data = json.dumps(dict(value), sort_keys=True, separators=(",", ":")).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def _authorized(self) -> bool:
+        header = self.headers.get("Authorization", "")
+        return (
+            header.startswith("Bearer ")
+            and bool(self.control_token)
+            and hmac.compare_digest(header[7:], self.control_token)
+        )
+
+    def do_GET(self) -> None:
+        if self.path == "/health":
+            self._json({"status": "ok", "service": "aios-agent-task-retry-extension"}, 200)
+        else:
+            self._json({"error": "NOT_FOUND"}, 404)
+
+    def do_POST(self) -> None:
+        match = re.fullmatch(r"/v1/tasks/([^/]+)/retry-extension", self.path)
+        if match is None:
+            self._json({"error": "NOT_FOUND"}, 404)
+            return
+        if not self._authorized():
+            self._json({"error": "UNAUTHORIZED"}, 401)
+            return
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+        except ValueError:
+            self._json({"error": "CONTENT_LENGTH_INVALID"}, 400)
+            return
+        if length < 1 or length > MAX_BODY:
+            self._json({"error": "REQUEST_SIZE_INVALID"}, 413)
+            return
+        try:
+            value = json.loads(self.rfile.read(length).decode("utf-8"))
+            if not isinstance(value, Mapping):
+                raise ValueError
+            request = RetryExtensionRequest.from_mapping(value)
+            if self.store is None:
+                raise RetryExtensionError("RUNTIME_UNAVAILABLE", 503)
+            result = self.store.extend(match.group(1), request)
+            self._json(result, 200 if result["idempotent"] else 201)
+        except RetryExtensionError as exc:
+            self._json({"error": exc.code}, exc.status)
+        except (UnicodeDecodeError, json.JSONDecodeError, ValueError):
+            self._json({"error": "REQUEST_INVALID"}, 400)
+
+
+def load_control_token(path: Path) -> str:
+    if path.is_symlink() or not path.is_file():
+        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_UNAVAILABLE")
+    value = path.read_text(encoding="utf-8").strip()
+    if len(value) < 32:
+        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_INVALID")
+    return value
+
+
+def serve() -> None:
+    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
+    _required_authorization_id()
+    token_path = Path(
+        os.environ.get(
+            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
+            str(Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials")) / "agent_task_control_token"),
+        )
+    )
+    host = os.environ.get("AIOS_TASK_RETRY_HOST", "127.0.0.1")
+    port = int(os.environ.get("AIOS_TASK_RETRY_PORT", "18941"))
+    RetryExtensionHandler.store = RetryExtensionStore(db)
+    RetryExtensionHandler.control_token = load_control_token(token_path)
+    ThreadingHTTPServer((host, port), RetryExtensionHandler).serve_forever()
+
+
+if __name__ == "__main__":
+    serve()

active-runtime/app/aios_authority_git_executor.py

@@ -94,6 +94,91 @@ class AuthorityGitExecutor:
         self._git(["worktree", "add", "--detach", str(path), base_oid])
         return path
 
+    def recover_failed_detached_worktree_exact(
+        self,
+        *,
+        path: Path,
+        expected_oid: str,
+        stale_oid: str,
+        target_ref: str,
+    ) -> str:
+        """Recreate one exact clean, detached, single-attempt worktree at its durable head."""
+        _oid(expected_oid, "expected_oid")
+        _oid(stale_oid, "stale_oid")
+        if not TASK_BRANCH_RE.fullmatch(target_ref):
+            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
+        if self.read_ref(target_ref) is not None:
+            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
+        if (
+            not path.is_absolute()
+            or path.parent != self.worktree_root
+            or path.name in {"", ".", ".."}
+            or path.is_symlink()
+            or not path.is_dir()
+        ):
+            raise AuthorityGitError("WORKTREE_RECOVERY_PATH_INVALID")
+        head = subprocess.run(
+            ["git", "-C", str(path), "rev-parse", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if head.returncode != 0 or head.stdout.strip() != stale_oid or stale_oid == expected_oid:
+            raise AuthorityGitError("WORKTREE_RECOVERY_HEAD_INVALID")
+        symbolic = subprocess.run(
+            ["git", "-C", str(path), "symbolic-ref", "-q", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if symbolic.returncode != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_DETACHED")
+        status = subprocess.run(
+            ["git", "-C", str(path), "status", "--porcelain=v1", "--untracked-files=all"],
+            text=True, capture_output=True, check=False,
+        )
+        if status.returncode != 0 or status.stdout:
+            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_CLEAN")
+        parents = self._git(["rev-list", "--parents", "-n", "1", stale_oid]).split()
+        if parents != [stale_oid, expected_oid]:
+            raise AuthorityGitError("WORKTREE_RECOVERY_LINEAGE_INVALID")
+        registered = [
+            line.removeprefix("worktree ")
+            for line in self._git(["worktree", "list", "--porcelain"]).splitlines()
+            if line.startswith("worktree ")
+        ]
+        if registered.count(str(path)) != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_REGISTRATION_INVALID")
+        self._git(["worktree", "remove", "--force", str(path)])
+        if path.exists() or path.is_symlink():
+            raise AuthorityGitError("WORKTREE_RECOVERY_REMOVE_FAILED")
+        recreated = self.create_detached_worktree(expected_oid, path.name, path.parent)
+        readback = subprocess.run(
+            ["git", "-C", str(recreated), "rev-parse", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        detached = subprocess.run(
+            ["git", "-C", str(recreated), "symbolic-ref", "-q", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if readback.returncode != 0 or readback.stdout.strip() != expected_oid or detached.returncode != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_READBACK_MISMATCH")
+        return stale_oid
+
+    def create_task_branch_CAS(self, branch: str, expected_base_oid: str, new_oid: str) -> str:
+        if not TASK_BRANCH_RE.fullmatch(branch):
+            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
+        _oid(expected_base_oid, "expected_base_oid")
+        _oid(new_oid, "new_oid")
+        current = self.read_ref(branch)
+        if current is not None:
+            if current == new_oid:
+                return new_oid
+            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
+        if not self.ancestry_check(expected_base_oid, new_oid):
+            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
+        self._git(["update-ref", branch, new_oid, "0" * 40])
+        readback = self.read_ref(branch)
+        if readback != new_oid:
+            raise AuthorityGitError("AUTHORITY_CREATE_READBACK_MISMATCH")
+        return readback
+
     def advance_task_branch_CAS(self, branch: str, expected_oid: str, new_oid: str) -> str:
         if not TASK_BRANCH_RE.fullmatch(branch):
             raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")

active-runtime/app/aios_chatgpt_actions_api.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 from __future__ import annotations
-import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, uuid
+import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, urllib.request, uuid
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
@@ -404,6 +404,51 @@ class H(BaseHTTPRequestHandler):
         if not a['ok']: self.sendj({'error':'unauthorized','hint':'Bearer token required'},401); return None
         if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
         return a
+    def bridge_release(self, path, data):
+        route = {
+            '/createTagApprovalRequest': '/v2/tag/approval-request',
+            '/requestOrCreateTag': '/v2/tag/publish',
+            '/getTagPublicationStatus': '/v2/tag/status',
+            '/buildProductionArtifact': '/v2/release/artifact',
+            '/executeApprovedProductionRelease': '/v2/release/execute',
+            '/getReleaseConsistency': '/v2/release/consistency',
+            '/runReleaseAcceptance': '/v2/release/acceptance',
+        }.get(path)
+        if route is None:
+            raise ValueError('governed_release_route_invalid')
+        base = os.getenv('AIOS_BRIDGE_V2_URL', 'http://127.0.0.1:18892').rstrip('/')
+        request = urllib.request.Request(
+            base + route,
+            data=json.dumps(data, sort_keys=True, separators=(',', ':')).encode('utf-8'),
+            headers={'Content-Type': 'application/json'},
+            method='POST',
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=30) as response:
+                result = json.loads(response.read().decode('utf-8'))
+                return self.sendj(result, response.status)
+        except urllib.error.HTTPError as exc:
+            try:
+                body = json.loads(exc.read().decode('utf-8'))
+            except Exception:
+                body = {'error': 'bridge_http_error'}
+            return self.sendj(body, exc.code)
+        except (urllib.error.URLError, TimeoutError) as exc:
+            return self.sendj({'error': 'GOVERNED_BRIDGE_UNAVAILABLE', 'detail': type(exc).__name__}, 503)
+    def do_POST(self):
+        path = urllib.parse.urlparse(self.path).path
+        if path in {
+            '/createTagApprovalRequest', '/requestOrCreateTag', '/getTagPublicationStatus',
+            '/buildProductionArtifact', '/executeApprovedProductionRelease',
+            '/getReleaseConsistency', '/runReleaseAcceptance',
+        }:
+            actor = self.need('tag:create')
+            if not actor:
+                return
+            return self.bridge_release(path, self.body())
+        if reject_non_read_http(self, 'POST', path):
+            return
+        return self.sendj({'error': 'not_found', 'path': path}, 404)
     def do_GET(self):
         u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
         if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
@@ -905,3 +950,4 @@ def main():
     print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
     ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()
+

active-runtime/app/aios_chatgpt_bridge_v2.py

@@ -1,4 +1,4 @@
-"""ChatGPT GitOps Bridge v2 contract and immutable runtime identity."""
+"""ChatGPT GitOps Bridge v2 contract and governed release operations."""
 from __future__ import annotations
 
 from dataclasses import dataclass
@@ -6,19 +6,93 @@ import hashlib
 from pathlib import Path
 from typing import Any, Callable, Mapping
 
+
 BRIDGE_SCHEMA_VERSION = "aios.chatgpt-gitops-bridge.v2"
-BRIDGE_OPERATIONS = ("getRuntimeStatus", "getGovernedWriteCapabilities", "createGovernedTask", "acquireWriterLease", "commitFileGoverned", "commitFilesGoverned", "getGitOpsJob", "resumeGitOpsJob", "reconcileGitOpsJob", "getControlPlaneSnapshot")
+BRIDGE_OPERATIONS = (
+    "getRuntimeStatus",
+    "getGovernedWriteCapabilities",
+    "createGovernedTask",
+    "acquireWriterLease",
+    "bootstrapWriterLease",
+    "renewWriterLease",
+    "commitFileGoverned",
+    "commitFilesGoverned",
+    "getGitOpsJob",
+    "resumeGitOpsJob",
+    "reconcileGitOpsJob",
+    "createTagApprovalRequest",
+    "requestOrCreateTag",
+    "getTagPublicationStatus",
+    "buildProductionArtifact",
+    "executeApprovedProductionRelease",
+    "getReleaseConsistency",
+    "runReleaseAcceptance",
+    "getControlPlaneSnapshot",
+)
+
 OPERATION_REQUIRED_FIELDS = {
     "createGovernedTask": ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key"),
     "acquireWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
+    "bootstrapWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
+    "renewWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
     "commitFileGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "path", "content_base64", "message"),
     "commitFilesGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "files", "message"),
     "getGitOpsJob": ("job_id",),
     "resumeGitOpsJob": ("job_id", "expected_revision"),
     "reconcileGitOpsJob": ("job_id", "expected_revision"),
+    "createTagApprovalRequest": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "owner_approval", "execute"),
+    "requestOrCreateTag": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
+    "getTagPublicationStatus": ("version",),
+    "buildProductionArtifact": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
+    "executeApprovedProductionRelease": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
+    "getReleaseConsistency": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
+    "runReleaseAcceptance": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
     "getControlPlaneSnapshot": (),
 }
 
+BRIDGE_OPERATION_CONTRACTS = {
+    "acquireWriterLease": {
+        "method": "POST",
+        "path": "/v2/writer-lease",
+        "required_fields": OPERATION_REQUIRED_FIELDS["acquireWriterLease"],
+        "response_fields": (
+            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
+            "create_target_branch", "worktree_mode", "cas_ref_update_required",
+        ),
+    },
+    "bootstrapWriterLease": {
+        "method": "POST",
+        "path": "/v2/writer-lease/bootstrap",
+        "required_fields": OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"],
+        "response_fields": (
+            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
+            "create_target_branch", "worktree_mode", "cas_ref_update_required",
+            "recovered", "bootstrapped", "runtime_rehydrated",
+            "durable_branch_lease_present", "idempotent",
+        ),
+    },
+    "renewWriterLease": {
+        "method": "POST",
+        "path": "/v2/writer-lease/renew",
+        "required_fields": OPERATION_REQUIRED_FIELDS["renewWriterLease"],
+        "response_fields": (
+            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
+            "recovered", "bootstrapped", "runtime_rehydrated",
+            "durable_branch_lease_present", "idempotent",
+        ),
+    },
+    "commitFileGoverned": {
+        "method": "POST", "path": "/v2/commit-file",
+        "required_fields": OPERATION_REQUIRED_FIELDS["commitFileGoverned"],
+        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
+    },
+    "commitFilesGoverned": {
+        "method": "POST", "path": "/v2/commit-files",
+        "required_fields": OPERATION_REQUIRED_FIELDS["commitFilesGoverned"],
+        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
+    },
+}
+
 
 class RuntimeDriftError(RuntimeError):
     pass
@@ -40,37 +114,90 @@ class ControlPlaneReleaseManifest:
     deployment_state: str
 
     def as_dict(self) -> dict[str, object]:
-        return {"control_plane_release_version": self.control_plane_release_version, "control_plane_target_oid": self.control_plane_target_oid, "artifact_sha256": self.artifact_sha256, "runtime_path": str(self.runtime_path), "bridge_schema_version": self.bridge_schema_version, "repository_identity": self.repository_identity, "authoritative_git_dir": str(self.authoritative_git_dir), "deployment_state": self.deployment_state}
+        return {
+            "control_plane_release_version": self.control_plane_release_version,
+            "control_plane_target_oid": self.control_plane_target_oid,
+            "artifact_sha256": self.artifact_sha256,
+            "runtime_path": str(self.runtime_path),
+            "bridge_schema_version": self.bridge_schema_version,
+            "repository_identity": self.repository_identity,
+            "authoritative_git_dir": str(self.authoritative_git_dir),
+            "deployment_state": self.deployment_state,
+        }
 
     def validate(self, artifact: Path, *, observed_oid: str, approved_root: Path = Path("/opt/aios/gitops-control-plane")) -> dict[str, object]:
         try:
-            runtime = self.runtime_path.resolve(strict=True); root = approved_root.resolve(strict=True); artifact_path = artifact.resolve(strict=True); runtime.relative_to(root); artifact_path.relative_to(runtime)
+            runtime = self.runtime_path.resolve(strict=True)
+            root = approved_root.resolve(strict=True)
+            artifact_path = artifact.resolve(strict=True)
+            runtime.relative_to(root)
+            artifact_path.relative_to(runtime)
         except (OSError, ValueError):
             raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT") from None
-        if any(marker in {"workspace", "workspaces", "worktree", "worktrees"} for marker in (part.lower() for part in runtime.parts)):
+        mutable_markers = {"workspace", "workspaces", "worktree", "worktrees"}
+        if mutable_markers.intersection(part.lower() for part in runtime.parts):
             raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
-        valid = len(self.control_plane_target_oid) == 40 and observed_oid == self.control_plane_target_oid and len(self.artifact_sha256) == 64 and hashlib.sha256(artifact_path.read_bytes()).hexdigest() == self.artifact_sha256 and self.bridge_schema_version == BRIDGE_SCHEMA_VERSION and self.repository_identity == "aios/aios" and self.authoritative_git_dir == Path("/data/aios-gitops/repo.git") and self.deployment_state == "STAGING"
+        valid = (
+            len(self.control_plane_target_oid) == 40
+            and observed_oid == self.control_plane_target_oid
+            and len(self.artifact_sha256) == 64
+            and hashlib.sha256(artifact_path.read_bytes()).hexdigest() == self.artifact_sha256
+            and self.bridge_schema_version == BRIDGE_SCHEMA_VERSION
+            and self.repository_identity == "aios/aios"
+            and self.authoritative_git_dir == Path("/data/aios-gitops/repo.git")
+            and self.authoritative_git_dir.is_absolute()
+            and self.deployment_state == "STAGING"
+        )
         if not valid:
             raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
         return {**self.as_dict(), "drift_status": "PASS"}
 
 
 class BridgeV2Adapter:
+    """Thin operation adapter; all mutating handlers are injected seams."""
+
     def __init__(self, *, runtime_status: Mapping[str, Any], handlers: Mapping[str, Callable[[Mapping[str, Any]], Any]] | None = None) -> None:
-        self.runtime_status = dict(runtime_status); self.handlers = dict(handlers or {})
+        self.runtime_status = dict(runtime_status)
+        self.handlers = dict(handlers or {})
 
     def getRuntimeStatus(self) -> dict[str, Any]:
         return {"bridge_schema_version": BRIDGE_SCHEMA_VERSION, **self.runtime_status}
 
     def getGovernedWriteCapabilities(self) -> dict[str, Any]:
-        return {"bridge_schema_version": BRIDGE_SCHEMA_VERSION, "legacy_writes_enabled": False, "governed_writes_enabled": True, "operations": list(BRIDGE_OPERATIONS), "force_push": False, "main_write": False, "tag_write": False, "baseline_write": False, "production_write": False}
+        return {
+            "bridge_schema_version": BRIDGE_SCHEMA_VERSION,
+            "legacy_writes_enabled": False,
+            "governed_writes_enabled": True,
+            "operations": list(BRIDGE_OPERATIONS),
+            "operation_contracts": {
+                operation: {
+                    **contract,
+                    "required_fields": list(contract["required_fields"]),
+                    "response_fields": list(contract["response_fields"]),
+                }
+                for operation, contract in BRIDGE_OPERATION_CONTRACTS.items()
+            },
+            "force_push": False,
+            "main_write": False,
+            "tag_write": False,
+            "baseline_write": False,
+            "production_write": False,
+            "approved_release_operations": True,
+            "approved_release_scope": {
+                "version": "V2R2C1",
+                "target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
+                "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
+                "approval_plan_id": "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e",
+            },
+        }
 
     @staticmethod
     def legacy_write_disabled() -> dict[str, object]:
         return {"error": "LEGACY_WRITE_DISABLED", "replacement": "createGovernedTask", "governed_writes_available": True}
 
     def _call(self, operation: str, request: Mapping[str, Any]) -> Any:
-        if tuple(key for key in OPERATION_REQUIRED_FIELDS[operation] if key not in request):
+        required = OPERATION_REQUIRED_FIELDS[operation]
+        if any(key not in request for key in required):
             raise BridgeV2Error("BRIDGE_REQUEST_FIELDS_MISSING")
         handler = self.handlers.get(operation)
         if handler is None:
@@ -79,9 +206,19 @@ class BridgeV2Adapter:
 
     def createGovernedTask(self, request: Mapping[str, Any]) -> Any: return self._call("createGovernedTask", request)
     def acquireWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("acquireWriterLease", request)
+    def bootstrapWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("bootstrapWriterLease", request)
+    def renewWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("renewWriterLease", request)
     def commitFileGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFileGoverned", request)
     def commitFilesGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFilesGoverned", request)
     def getGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("getGitOpsJob", request)
     def resumeGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("resumeGitOpsJob", request)
     def reconcileGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("reconcileGitOpsJob", request)
+    def createTagApprovalRequest(self, request: Mapping[str, Any]) -> Any: return self._call("createTagApprovalRequest", request)
+    def requestOrCreateTag(self, request: Mapping[str, Any]) -> Any: return self._call("requestOrCreateTag", request)
+    def getTagPublicationStatus(self, request: Mapping[str, Any]) -> Any: return self._call("getTagPublicationStatus", request)
+    def buildProductionArtifact(self, request: Mapping[str, Any]) -> Any: return self._call("buildProductionArtifact", request)
+    def executeApprovedProductionRelease(self, request: Mapping[str, Any]) -> Any: return self._call("executeApprovedProductionRelease", request)
+    def getReleaseConsistency(self, request: Mapping[str, Any]) -> Any: return self._call("getReleaseConsistency", request)
+    def runReleaseAcceptance(self, request: Mapping[str, Any]) -> Any: return self._call("runReleaseAcceptance", request)
+
     def getControlPlaneSnapshot(self, request: Mapping[str, Any] | None = None) -> Any: return self._call("getControlPlaneSnapshot", request or {})

active-runtime/app/aios_continuation_executor.py

@@ -51,11 +51,13 @@ class AuthorityPort(Protocol):
     def branch_exists(self, branch: str) -> bool: ...
     def branch_head(self, branch: str) -> str: ...
     def is_ancestor(self, older: str, newer: str) -> bool: ...
+    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str: ...
     def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
 
 
 class RemotePort(Protocol):
     def repository_identity(self) -> str: ...
+    def push_new_exact(self, branch: str, new: str) -> None: ...
     def push_exact(self, branch: str, expected: str, new: str) -> None: ...
     def read_git_ref(self, branch: str) -> str | None: ...
     def read_api_branch(self, branch: str) -> str | None: ...
@@ -103,6 +105,9 @@ class AuthorityGitAdapter:
     def is_ancestor(self, older: str, newer: str) -> bool:
         return self.executor.ancestry_check(older, newer)
 
+    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str:
+        return self.executor.create_task_branch_CAS(self._ref(branch), expected_base, new)
+
     def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str:
         return self.executor.advance_task_branch_CAS(self._ref(branch), expected, new)
 
@@ -258,6 +263,15 @@ class GiteaContinuationRemote:
             raise ContinuationExecutionError("GITEA_GIT_READBACK_INVALID")
         return oid
 
+    def push_new_exact(self, branch: str, new: str) -> None:
+        self._require_projected()
+        self.repository_identity()
+        if self.read_git_ref(branch) is not None:
+            raise ContinuationExecutionError("GITEA_TARGET_BRANCH_ALREADY_EXISTS")
+        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
+        if self.read_git_ref(branch) != new:
+            raise ContinuationExecutionError("GITEA_CREATE_READBACK_MISMATCH")
+
     def push_exact(self, branch: str, expected: str, new: str) -> None:
         self._require_projected()
         self.repository_identity()
@@ -284,13 +298,24 @@ class GiteaContinuationRemote:
 
     def read_api_branch(self, branch: str) -> str | None:
         owner, name = self.repository.split("/", 1)
-        value = self._api(f"/repos/{quote(owner)}/{quote(name)}/branches/{quote(branch, safe='/')}")
-        if value is None:
-            return None
-        oid = value.get("commit", {}).get("id") if isinstance(value, dict) else None
-        if not isinstance(oid, str) or not OID_RE.fullmatch(oid):
-            raise ContinuationExecutionError("GITEA_API_BRANCH_INVALID")
-        return oid
+        page = 1
+        while page <= 100:
+            value = self._api(f"/repos/{quote(owner)}/{quote(name)}/branches?page={page}&limit=50")
+            if value is None:
+                return None
+            if not isinstance(value, list):
+                raise ContinuationExecutionError("GITEA_API_BRANCH_COLLECTION_INVALID")
+            for item in value:
+                if not isinstance(item, dict) or item.get("name") != branch:
+                    continue
+                oid = item.get("commit", {}).get("id")
+                if not isinstance(oid, str) or not OID_RE.fullmatch(oid):
+                    raise ContinuationExecutionError("GITEA_API_BRANCH_INVALID")
+                return oid
+            if len(value) < 50:
+                return None
+            page += 1
+        raise ContinuationExecutionError("GITEA_API_BRANCH_PAGINATION_LIMIT")
 
     def commit_visible(self, oid: str) -> bool:
         owner, name = self.repository.split("/", 1)
@@ -318,6 +343,7 @@ class ContinuationPermissions:
 @dataclass(frozen=True, slots=True)
 class ContinuationRuntimeBinding:
     request: WriterLeaseRequestV2
+    job_id: str
     workspace_path: Path
     lease_not_before: datetime
     lease_expires_at: datetime
@@ -378,13 +404,20 @@ class ContinuationExecutor:
     def observe_generation(self, branch: str, generation: int) -> None:
         self._observed_generations[branch] = max(generation, self._observed_generations.get(branch, 0))
 
-    def _max_generation(self, branch: str) -> int:
+    def _max_generation(self, branch: str, *, exclude_job_id: str | None = None) -> int:
         observed = self._observed_generations.get(branch, 0)
         with self.controller.store._connect() as connection:
-            row = connection.execute(
-                "SELECT MAX(generation) AS generation FROM branch_leases WHERE branch=?",
-                (branch,),
-            ).fetchone()
+            if exclude_job_id is None:
+                row = connection.execute(
+                    "SELECT MAX(generation) AS generation FROM branch_leases WHERE branch=?",
+                    (branch,),
+                ).fetchone()
+            else:
+                row = connection.execute(
+                    "SELECT MAX(generation) AS generation FROM branch_leases "
+                    "WHERE branch=? AND job_id!=?",
+                    (branch, exclude_job_id),
+                ).fetchone()
         durable = int(row["generation"] or 0)
         return max(observed, durable)
 
@@ -393,6 +426,7 @@ class ContinuationExecutor:
         return {
             "schema": WriterLeaseRequestV2.schema,
             "task_id": request.task_id,
+            "job_id": request.job_id,
             "repository": request.repository,
             "branch_mode": request.branch_mode,
             "base_oid": request.base_oid,
@@ -402,10 +436,21 @@ class ContinuationExecutor:
             "lease_seconds": request.lease_seconds,
         }
 
-    def _validate_preflight(self, binding: ContinuationRuntimeBinding) -> None:
+    def _validate_preflight(self, binding: ContinuationRuntimeBinding, *, job_id: str | None = None) -> None:
         request = binding.request
-        normalized = validate_writer_lease_request_v2(self._request_mapping(request), self.authority)
-        if normalized != {**self._request_mapping(request), "create_target_branch": False, "worktree_mode": "detached_at_expected_head", "cas_ref_update_required": True}:
+        request_mapping = self._request_mapping(request)
+        normalized = validate_writer_lease_request_v2(request_mapping, self.authority)
+        expected_normalized = {
+            **request_mapping,
+            "create_target_branch": request.branch_mode == "CREATE_NEW",
+            "worktree_mode": (
+                "detached_at_base_oid"
+                if request.branch_mode == "CREATE_NEW"
+                else "detached_at_expected_head"
+            ),
+            "cas_ref_update_required": True,
+        }
+        if normalized != expected_normalized:
             raise ContinuationExecutionError("CONTINUATION_NORMALIZATION_INVALID")
         if not binding.original_receipt_valid or not binding.original_grant_consumed:
             raise ContinuationExecutionError("ORIGINAL_GRANT_LINEAGE_INVALID")
@@ -415,7 +460,7 @@ class ContinuationExecutor:
             raise ContinuationExecutionError("LEASE_NOT_ACTIVE")
         if now >= binding.lease_expires_at:
             raise ContinuationExecutionError("LEASE_EXPIRED")
-        if request.generation <= self._max_generation(request.target_branch):
+        if request.generation <= self._max_generation(request.target_branch, exclude_job_id=job_id):
             raise ContinuationExecutionError("GENERATION_NOT_MONOTONIC")
         if not self.workspace.is_detached():
             raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
@@ -441,57 +486,102 @@ class ContinuationExecutor:
             "generation": request.generation,
         }
 
-    def execute(self, binding: ContinuationRuntimeBinding, commit: ContinuationCommit) -> dict[str, object]:
-        payload = commit.payload()
-        submitted = self.controller.submit(self._job_request(binding, commit, payload), payload=payload)
-        current = self.controller.store.read(submitted.job_id)
-        if JobState(current["state"]) == JobState.COMPLETED:
+    def execute(
+        self,
+        binding: ContinuationRuntimeBinding,
+        commit: ContinuationCommit,
+        *,
+        before_complete: Callable[[str], None] | None = None,
+    ) -> dict[str, object]:
+        commit.payload()
+        if not binding.job_id or binding.request.job_id != binding.job_id:
+            raise ContinuationExecutionError("RUNTIME_LINEAGE_MISSING_JOB_ID")
+        current = self.controller.store.read(binding.job_id)
+        current_state = JobState(current["state"])
+        if current_state == JobState.COMPLETED:
             return self.controller.store._receipt(current, duplicate=True).as_dict()
-        self._validate_preflight(binding)
+        if current_state == JobState.REMOTE_VERIFIED:
+            receipt = json.loads(str(current["receipt_json"] or "{}"))
+            commit_oid = str(receipt.get("authority_oid") or "")
+            if not OID_RE.fullmatch(commit_oid):
+                raise ContinuationExecutionError("GOVERNED_COMMIT_OID_INVALID")
+            if before_complete is not None:
+                before_complete(commit_oid)
+            return self.controller.advance(
+                binding.job_id,
+                JobState.COMPLETED,
+                side_effect_state="REMOTE_VERIFIED",
+                receipt=receipt,
+            ).as_dict()
+        self._validate_preflight(binding, job_id=binding.job_id)
         request = binding.request
         projected = False
         try:
             self.credential.project()
             projected = True
-            row = self.controller.store.read(submitted.job_id)
-            if JobState(row["state"]) == JobState.REQUESTED:
+            row = self.controller.store.read(binding.job_id)
+            state = JobState(row["state"])
+            if state == JobState.REQUESTED:
                 self.controller.advance(
-                    submitted.job_id,
+                    binding.job_id,
                     JobState.AUTHORIZED,
                     side_effect_state="AUTHORIZED",
                     receipt={"task_id": request.task_id, "original_grant_consumed": True},
+                    expected_revision=int(row["revision"]),
                 )
-                row = self.controller.store.read(submitted.job_id)
-            if JobState(row["state"]) == JobState.AUTHORIZED:
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.AUTHORIZED:
                 self.controller.lease_job(
-                    submitted.job_id,
-                    lease_id=f"lease-{submitted.job_id}",
+                    binding.job_id,
+                    lease_id=f"lease-{binding.job_id}",
                     lineage_anchor_oid=request.base_oid,
                     current_head_oid=request.expected_branch_oid,
                     generation=request.generation,
                     lease_expires_at=binding.lease_expires_at.astimezone(timezone.utc).isoformat(),
                     expected_revision=int(row["revision"]),
                 )
-            self.controller.advance(submitted.job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY")
-            self.controller.advance(submitted.job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.LEASED:
+                self.controller.advance(binding.job_id, JobState.WORKTREE_READY,
+                                        side_effect_state="WORKTREE_READY", expected_revision=int(row["revision"]))
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.WORKTREE_READY:
+                self.controller.advance(binding.job_id, JobState.EXECUTING,
+                                        side_effect_state="IN_PROGRESS", expected_revision=int(row["revision"]))
+            elif state != JobState.EXECUTING:
+                raise ContinuationExecutionError("JOB_EXECUTION_STATE_INVALID")
             new_oid = self.workspace.commit_files(commit.files, commit.message)
             if not OID_RE.fullmatch(new_oid) or not self.authority.is_ancestor(request.expected_branch_oid, new_oid):
                 raise ContinuationExecutionError("NON_FAST_FORWARD_COMMIT")
-            authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
+            if request.branch_mode == "CREATE_NEW":
+                authority_oid = self.authority.create_task_branch_cas(request.target_branch, request.base_oid, new_oid)
+            else:
+                authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
             if authority_oid != new_oid:
                 raise ContinuationExecutionError("AUTHORITY_CAS_READBACK_MISMATCH")
             self.controller.advance(
-                submitted.job_id,
+                binding.job_id,
                 JobState.LOCAL_VERIFIED,
                 side_effect_state="LOCAL_VERIFIED",
                 receipt={"authority_oid": authority_oid, "force_push": False},
             )
             try:
-                self.controller.advance(submitted.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
-                self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
+                self.controller.advance(binding.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
+                if request.branch_mode == "CREATE_NEW":
+                    self.remote.push_new_exact(request.target_branch, new_oid)
+                else:
+                    self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
             except Exception:
-                return self._remote_pending(submitted.job_id, authority_oid, new_oid)
-            return self._finish_remote_verification(submitted.job_id, authority_oid, new_oid)
+                return self._remote_pending(binding.job_id, authority_oid, new_oid)
+            return self._finish_remote_verification(
+                binding.job_id,
+                authority_oid,
+                new_oid,
+                before_complete=before_complete,
+            )
         finally:
             if projected:
                 self.credential.revoke()
@@ -514,7 +604,14 @@ class ContinuationExecutor:
         )
         return result.as_dict()
 
-    def _finish_remote_verification(self, job_id: str, authority_oid: str, new_oid: str) -> dict[str, object]:
+    def _finish_remote_verification(
+        self,
+        job_id: str,
+        authority_oid: str,
+        new_oid: str,
+        *,
+        before_complete: Callable[[str], None] | None = None,
+    ) -> dict[str, object]:
         row = self.controller.store.read(job_id)
         branch = row["branch"]
         request = json.loads(row["request_json"])["binding"]
@@ -531,8 +628,20 @@ class ContinuationExecutor:
             "reconciliation_decision": decision.action.value,
             "force_push": False,
         }
-        self.controller.advance(job_id, JobState.REMOTE_VERIFIED, side_effect_state="REMOTE_VERIFIED", receipt=receipt)
-        return self.controller.advance(job_id, JobState.COMPLETED, side_effect_state="REMOTE_VERIFIED", receipt=receipt).as_dict()
+        self.controller.advance(
+            job_id,
+            JobState.REMOTE_VERIFIED,
+            side_effect_state="REMOTE_VERIFIED",
+            receipt=receipt,
+        )
+        if before_complete is not None:
+            before_complete(new_oid)
+        return self.controller.advance(
+            job_id,
+            JobState.COMPLETED,
+            side_effect_state="REMOTE_VERIFIED",
+            receipt=receipt,
+        ).as_dict()
 
     def reconcile(self, job_id: str) -> dict[str, object]:
         row = self.controller.store.read(job_id)

active-runtime/app/aios_continuation_lease.py

@@ -49,6 +49,7 @@ class WriterLeaseRequestV2:
     target_branch: str
     generation: int
     lease_seconds: int = 900
+    job_id: str = ""
 
     schema = "aios.task-writer-lease.v2"
     accepted_schemas = frozenset({"aios.task-writer-lease.v2", "aios.task-writer-lease-request.v2"})
@@ -56,6 +57,8 @@ class WriterLeaseRequestV2:
     def validate(self, probe: BranchProbe) -> None:
         if not self.task_id or self.repository != "aios/aios":
             raise ContinuationError("request_identity_invalid")
+        if not self.job_id or not self.job_id.startswith("job-"):
+            raise ContinuationError("job_id_invalid")
         if self.branch_mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
             raise ContinuationError("branch_mode_invalid")
         _oid(self.base_oid, "base_oid")
@@ -74,6 +77,12 @@ class WriterLeaseRequestV2:
                 raise ContinuationError("EXISTING_BRANCH_OID_CONFLICT")
             if not probe.is_ancestor(self.base_oid, actual):
                 raise ContinuationError("BASE_NOT_ANCESTOR_OF_BRANCH")
+        elif hasattr(probe, "commit_exists") and not probe.commit_exists(self.base_oid):
+            raise ContinuationError("BASE_COMMIT_NOT_FOUND")
+        elif self.branch_mode == "CREATE_NEW" and probe.branch_exists(self.target_branch):
+            raise ContinuationError("TARGET_BRANCH_ALREADY_EXISTS")
+        elif self.branch_mode == "CREATE_NEW" and self.base_oid != self.expected_branch_oid:
+            raise ContinuationError("CREATE_NEW_BASE_EXPECTATION_MISMATCH")
 
 
 @dataclass(frozen=True, slots=True)

active-runtime/app/aios_credential_broker.py

@@ -6,6 +6,7 @@ from datetime import datetime, timedelta, timezone
 import os
 from pathlib import Path
 import secrets
+import re
 from typing import Any, Callable, Mapping
 
 
@@ -21,9 +22,14 @@ class CredentialLease:
     scopes: tuple[str, ...]
     provider: str
     state: str = "ACTIVE"
+    scope_type: str = "system"
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    run_id: str | None = None
 
     def as_dict(self) -> dict[str, Any]:
-        return {"lease_id": self.lease_id, "task_id": self.task_id, "repository": self.repository, "target_branch": self.target_branch, "generation": self.generation, "issued_at": self.issued_at, "expires_at": self.expires_at, "scopes": list(self.scopes), "provider": self.provider, "state": self.state}
+        return {"lease_id": self.lease_id, "task_id": self.task_id, "repository": self.repository, "target_branch": self.target_branch, "generation": self.generation, "issued_at": self.issued_at, "expires_at": self.expires_at, "scopes": list(self.scopes), "provider": self.provider, "state": self.state, "scope_type": self.scope_type, "tenant_id": self.tenant_id, "user_id": self.user_id, "project_id": self.project_id, "run_id": self.run_id}
 
 
 class FileCredentialProvider:
@@ -43,11 +49,19 @@ class CredentialBroker:
         self.now = now or (lambda: datetime.now(timezone.utc))
         self._leases: dict[str, CredentialLease] = {}
 
-    def issue(self, *, task_id: str, repository: str, target_branch: str, generation: int, scopes: tuple[str, ...] = ("git:push", "gitea:read"), lease_seconds: int = 900) -> dict[str, Any]:
+    def issue(self, *, task_id: str, repository: str, target_branch: str, generation: int, scopes: tuple[str, ...] = ("git:push", "gitea:read"), lease_seconds: int = 900, scope_type: str = "system", tenant_id: str | None = None, user_id: str | None = None, project_id: str | None = None, run_id: str | None = None) -> dict[str, Any]:
         if repository != "aios/aios" or not target_branch.startswith("agent/") or generation < 1 or not 1 <= lease_seconds <= 86400:
             raise ValueError("CREDENTIAL_LEASE_BINDING_INVALID")
+        if scope_type == "tenant":
+            if not tenant_id:
+                raise ValueError("CREDENTIAL_SCOPE_DENY")
+        elif scope_type in {"system", "global"}:
+            if any((tenant_id, user_id, project_id, run_id)):
+                raise ValueError("CREDENTIAL_SCOPE_DENY")
+        else:
+            raise ValueError("CREDENTIAL_SCOPE_DENY")
         now = self.now().astimezone(timezone.utc)
-        lease = CredentialLease("lease-" + secrets.token_hex(16), task_id, repository, target_branch, generation, now.isoformat(), (now + timedelta(seconds=lease_seconds)).isoformat(), tuple(scopes), type(self.provider).__name__)
+        lease = CredentialLease("lease-" + secrets.token_hex(16), task_id, repository, target_branch, generation, now.isoformat(), (now + timedelta(seconds=lease_seconds)).isoformat(), tuple(scopes), type(self.provider).__name__, "ACTIVE", scope_type, tenant_id, user_id, project_id, run_id)
         self._leases[lease.lease_id] = lease
         return lease.as_dict()
 
@@ -64,7 +78,39 @@ class CredentialBroker:
         lease = self._get(lease_id)
         if lease.state != "ACTIVE":
             raise RuntimeError("CREDENTIAL_LEASE_NOT_ACTIVE")
-        return self.provider.environment(lease)
+        environment = self.provider.environment(lease)
+        for key, value in environment.items():
+            upper = str(key).upper()
+            if not isinstance(value, str):
+                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
+            sensitive = any(marker in upper for marker in ("CREDENTIAL", "TOKEN", "SECRET", "PASSWORD", "PRIVATE_KEY", "API_KEY"))
+            if re.search(r"(?i)bearer\s+\S+|(?:token|secret|password|api[_-]?key)\s*[:=]", value):
+                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
+            if sensitive and upper.endswith("_FILE"):
+                candidate = Path(value)
+                credential_root = Path("/run/credentials")
+                try:
+                    resolved = candidate.resolve(strict=False)
+                except OSError as exc:
+                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY") from exc
+                if not candidate.is_absolute() or not (resolved == credential_root or credential_root in resolved.parents):
+                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
+            elif sensitive and upper.endswith("_REFERENCE"):
+                if re.fullmatch(r"(?:systemd-credential|vault|secret-manager):[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}", value) is None:
+                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
+            elif sensitive:
+                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
+        return environment
+
+    def authorize(self, lease_id: str, *, task_id: str, operation: str, scope_type: str = "system", tenant_id: str | None = None, user_id: str | None = None, project_id: str | None = None, run_id: str | None = None) -> Mapping[str, str]:
+        lease = self._get(lease_id)
+        if lease.state != "ACTIVE" or lease.task_id != task_id or operation not in lease.scopes:
+            raise RuntimeError("CREDENTIAL_SCOPE_DENY")
+        requested = (scope_type, tenant_id, user_id, project_id, run_id)
+        actual = (lease.scope_type, lease.tenant_id, lease.user_id, lease.project_id, lease.run_id)
+        if requested != actual:
+            raise RuntimeError("CREDENTIAL_SCOPE_DENY")
+        return self.environment(lease_id)
 
     def status(self, lease_id: str) -> dict[str, Any]:
         return self._get(lease_id).as_dict()

active-runtime/app/aios_gitops_job_controller.py

@@ -27,6 +27,19 @@ class ServiceUnavailable(JobError):
     pass
 
 
+@dataclass(frozen=True, slots=True)
+class LeaseRenewalResult:
+    """Durable outcome of one writer-lease recovery attempt."""
+
+    renewed: bool
+    idempotent: bool
+    durable: bool
+    lease_expires_at: str | None
+
+    def __bool__(self) -> bool:
+        return self.renewed or self.idempotent
+
+
 class BindingConflict(JobError):
     pass
 
@@ -66,6 +79,14 @@ def utc_now() -> str:
     return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
 
 
+def parse_utc(value: str) -> datetime:
+    normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
+    parsed = datetime.fromisoformat(normalized)
+    if parsed.tzinfo is None:
+        raise ValueError("LEASE_EXPIRY_INVALID")
+    return parsed.astimezone(timezone.utc)
+
+
 def canonical_json(value: Any) -> bytes:
     return (
         json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n"
@@ -404,13 +425,16 @@ class GitOpsJobController:
         self.store._mirror(result)
         return self.store._receipt(result, duplicate=True)
 
-    def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE") -> None:
+    def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE", lease_expires_at: str | None = None) -> None:
         if len(current_head_oid) != 40 or generation < 1:
             raise JobError("LEASE_BINDING_INVALID")
         try:
             with self.store._connect() as connection:
                 connection.execute("BEGIN IMMEDIATE")
-                updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, state, lease_id, expected_revision))
+                if lease_expires_at is None:
+                    updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, state, lease_id, expected_revision))
+                else:
+                    updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,lease_expires_at=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, lease_expires_at, state, lease_id, expected_revision))
                 if updated.rowcount != 1:
                     raise JobError("LEASE_REVISION_CAS_CONFLICT")
                 connection.commit()
@@ -419,6 +443,94 @@ class GitOpsJobController:
         except sqlite3.Error as exc:
             raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
 
+    def renew_lease(
+        self,
+        *,
+        branch: str,
+        lineage_anchor_oid: str,
+        current_head_oid: str,
+        generation: int,
+        lease_expires_at: str,
+    ) -> LeaseRenewalResult:
+        if (
+            not branch
+            or len(lineage_anchor_oid) != 40
+            or len(current_head_oid) != 40
+            or generation < 1
+            or not lease_expires_at.strip()
+        ):
+            raise JobError("LEASE_BINDING_INVALID")
+        try:
+            with self.store._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
+                rows = connection.execute(
+                    "SELECT lease_id, revision, generation, state, lease_expires_at "
+                    "FROM branch_leases "
+                    "WHERE branch=? AND lineage_anchor_oid=? AND current_head_oid=? "
+                    "AND generation=? AND state='ACTIVE' ORDER BY revision DESC",
+                    (branch, lineage_anchor_oid, current_head_oid, generation),
+                ).fetchall()
+                if not rows:
+                    connection.commit()
+                    return LeaseRenewalResult(False, False, False, None)
+                if len(rows) != 1:
+                    raise JobError("LEASE_BINDING_CONFLICT")
+                row = rows[0]
+                try:
+                    current_expires_at = parse_utc(str(row["lease_expires_at"]))
+                    requested_expires_at = parse_utc(lease_expires_at)
+                except (TypeError, ValueError) as exc:
+                    raise JobError("LEASE_EXPIRY_INVALID") from exc
+                now = datetime.now(timezone.utc)
+                if requested_expires_at <= now:
+                    raise JobError("LEASE_EXPIRY_INVALID")
+                if current_expires_at > now:
+                    connection.commit()
+                    return LeaseRenewalResult(
+                        False,
+                        True,
+                        True,
+                        str(row["lease_expires_at"]),
+                    )
+                updated = connection.execute(
+                    "UPDATE branch_leases SET lease_expires_at=?,revision=revision+1 "
+                    "WHERE lease_id=? AND revision=? AND generation=? "
+                    "AND state='ACTIVE' AND lease_expires_at=?",
+                    (
+                        lease_expires_at,
+                        row["lease_id"],
+                        int(row["revision"]),
+                        generation,
+                        row["lease_expires_at"],
+                    ),
+                )
+                if updated.rowcount != 1:
+                    current = connection.execute(
+                        "SELECT lease_expires_at, generation, state FROM branch_leases "
+                        "WHERE lease_id=?",
+                        (row["lease_id"],),
+                    ).fetchone()
+                    if (
+                        current is not None
+                        and int(current["generation"]) == generation
+                        and current["state"] == "ACTIVE"
+                        and parse_utc(str(current["lease_expires_at"])) > now
+                    ):
+                        connection.commit()
+                        return LeaseRenewalResult(
+                            False,
+                            True,
+                            True,
+                            str(current["lease_expires_at"]),
+                        )
+                    raise JobError("LEASE_REVISION_CAS_CONFLICT")
+                connection.commit()
+                return LeaseRenewalResult(True, False, True, lease_expires_at)
+        except JobError:
+            raise
+        except sqlite3.Error as exc:
+            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
+
     def advance(self, job_id: str, state: JobState, *, side_effect_state: str, receipt: Mapping[str, Any] | None = None, expected_revision: int | None = None) -> JobReceipt:
         return self._advance(
             job_id,

active-runtime/app/aios_isolated_executor.py

@@ -0,0 +1,306 @@
+"""Uncredentialed deterministic executor for governed Online Agent changes.
+
+This process never receives Agent/Owner/Bridge credentials and never writes Git refs.
+It operates only on an exchange bundle and returns hash-bound changed files + test evidence.
+"""
+from __future__ import annotations
+
+import base64
+from dataclasses import dataclass
+import errno
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import socket
+import subprocess
+import tarfile
+import tempfile
+import time
+from typing import Any, Mapping, Sequence
+
+ALLOWED_PROGRAMS = {"/usr/bin/python3", "/usr/bin/git", "/bin/true", "/usr/bin/true"}
+MAX_ARCHIVE_BYTES = 64 * 1024 * 1024
+MAX_FILE_BYTES = 4 * 1024 * 1024
+SECRET_ENV_TOKENS = ("TOKEN", "SECRET", "PASSWORD", "CREDENTIAL", "AUTHORIZATION", "PRIVATE_KEY")
+REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{15,254}$")
+SENSITIVE_VALUE_RE = re.compile(
+    r"(?i)(authorization\s*[:=]\s*bearer\s+\S+|authorization\s+bearer\s+\S+|"
+    r"(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+)"
+)
+
+
+class IsolatedExecutorError(RuntimeError):
+    pass
+
+
+def sha256(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def safe_relative(value: object) -> str:
+    if not isinstance(value, str) or not value or value.startswith("/"):
+        raise IsolatedExecutorError("PATH_INVALID")
+    path = Path(value)
+    if ".." in path.parts or "." in path.parts or any(part in {"", ".git"} for part in path.parts):
+        raise IsolatedExecutorError("PATH_INVALID")
+    return path.as_posix()
+
+
+def resolve_under(root: Path, relative: str) -> Path:
+    root = root.resolve()
+    path = (root / safe_relative(relative)).resolve(strict=False)
+    if path == root or root not in path.parents:
+        raise IsolatedExecutorError("PATH_ESCAPE")
+    return path
+
+
+def _credential_exposure(directory: Path) -> str | None:
+    """Return an exposure code; EACCES is the intended credential isolation proof."""
+    try:
+        if not directory.exists():
+            return None
+        if directory.is_symlink():
+            return "CREDENTIAL_MOUNT_SYMLINK"
+        if os.access(directory, os.R_OK):
+            return "CREDENTIAL_MOUNT_ACCESSIBLE"
+        if directory.is_dir():
+            for child in directory.iterdir():
+                if child.is_file() and os.access(child, os.R_OK):
+                    return "CREDENTIAL_FILE_ACCESSIBLE"
+    except PermissionError:
+        return None
+    return None
+
+
+def assert_uncredentialed() -> None:
+    credentials = Path("/run/credentials")
+    candidates = {credentials}
+    credentials_directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
+    candidates.add(credentials_directory)
+    leaked = sorted(
+        key for key, value in os.environ.items()
+        if value
+        and (any(token in key.upper() for token in SECRET_ENV_TOKENS) or SENSITIVE_VALUE_RE.search(str(value)))
+    )
+    if leaked:
+        raise IsolatedExecutorError("CREDENTIAL_ENV_EXPOSED:" + ",".join(leaked))
+    for directory in candidates:
+        exposure = _credential_exposure(directory)
+        if exposure is not None:
+            raise IsolatedExecutorError(exposure)
+    # In the intended PrivateNetwork namespace host loopback services are unreachable.
+    try:
+        probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    except OSError as exc:
+        if exc.errno in {errno.EACCES, errno.EPERM, errno.EAFNOSUPPORT}:
+            return
+        raise IsolatedExecutorError("NETWORK_ISOLATION_PROBE_FAILED") from exc
+    probe.settimeout(0.15)
+    try:
+        if probe.connect_ex(("127.0.0.1", 18892)) == 0:
+            raise IsolatedExecutorError("GOVERNED_BRIDGE_REACHABLE")
+    finally:
+        probe.close()
+
+
+def extract_source(archive: Path, root: Path) -> None:
+    if archive.is_symlink() or not archive.is_file() or archive.stat().st_size > MAX_ARCHIVE_BYTES:
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_INVALID")
+    with tarfile.open(archive, "r:gz") as tf:
+        for member in tf.getmembers():
+            path = Path(member.name)
+            if path.is_absolute() or ".." in path.parts or ".git" in path.parts:
+                raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
+            if member.issym() or member.islnk():
+                raise IsolatedExecutorError("SOURCE_ARCHIVE_LINK_DENY")
+        tf.extractall(root, filter="data")
+
+
+def run_command(item: Mapping[str, Any], root: Path) -> dict[str, Any]:
+    argv = item.get("argv")
+    if not isinstance(argv, Sequence) or isinstance(argv, (str, bytes)) or not argv:
+        raise IsolatedExecutorError("COMMAND_INVALID")
+    argv = [str(part) for part in argv]
+    if argv[0] not in ALLOWED_PROGRAMS:
+        raise IsolatedExecutorError("COMMAND_PROGRAM_DENY")
+    if argv[0] == "/usr/bin/python3" and "-m" in argv:
+        index = argv.index("-m")
+        if index + 1 >= len(argv) or argv[index + 1] not in {"pytest", "py_compile"}:
+            raise IsolatedExecutorError("PYTHON_MODULE_DENY")
+    if argv[0] == "/usr/bin/git" and any(
+        token in {"push", "update-ref", "commit", "merge", "rebase", "reset", "clean", "branch"}
+        for token in argv[1:]
+    ):
+        raise IsolatedExecutorError("GIT_MUTATION_DENY")
+    timeout = int(item.get("timeout_seconds") or 300)
+    if not 1 <= timeout <= 1800:
+        raise IsolatedExecutorError("COMMAND_TIMEOUT_INVALID")
+    cwd = root if item.get("cwd", ".") == "." else resolve_under(root, str(item.get("cwd")))
+    started = time.monotonic()
+    completed = subprocess.run(
+        argv,
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=timeout,
+        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
+    )
+    result = {
+        "label": str(item.get("label") or "command"),
+        "exit_code": completed.returncode,
+        "stdout_sha256": sha256(completed.stdout.encode("utf-8", "replace")),
+        "stderr_sha256": sha256(completed.stderr.encode("utf-8", "replace")),
+        "duration_ms": int((time.monotonic() - started) * 1000),
+    }
+    if completed.returncode != 0:
+        raise IsolatedExecutorError(
+            "COMMAND_FAILED:" + result["label"] + ":" + str(completed.returncode)
+        )
+    return result
+
+
+def apply_changes(request: Mapping[str, Any], root: Path) -> list[str]:
+    changes = request.get("change_set")
+    if not isinstance(changes, list) or not changes:
+        raise IsolatedExecutorError("CHANGE_SET_INVALID")
+    changed: list[str] = []
+    for change in changes:
+        if not isinstance(change, Mapping):
+            raise IsolatedExecutorError("CHANGE_INVALID")
+        relative = safe_relative(change.get("path"))
+        path = resolve_under(root, relative)
+        current = path.read_bytes() if path.is_file() else None
+        expected = change.get("expected_sha256")
+        if expected is not None and (current is None or sha256(current) != expected):
+            raise IsolatedExecutorError("SOURCE_DRIFT:" + relative)
+        operation = change.get("operation")
+        if operation == "write_file":
+            content = change.get("content")
+            if not isinstance(content, str):
+                raise IsolatedExecutorError("WRITE_CONTENT_INVALID")
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(content, encoding="utf-8")
+        elif operation == "replace_text":
+            if current is None:
+                raise IsolatedExecutorError("REPLACE_SOURCE_MISSING")
+            old = str(change.get("old"))
+            new = str(change.get("new"))
+            count = int(change.get("count", 1))
+            text = current.decode("utf-8")
+            if text.count(old) != count:
+                raise IsolatedExecutorError("REPLACE_COUNT_INVALID:" + relative)
+            path.write_text(text.replace(old, new), encoding="utf-8")
+        elif operation == "delete_file":
+            if path.exists():
+                path.unlink()
+        else:
+            raise IsolatedExecutorError("CHANGE_OPERATION_INVALID")
+        changed.append(relative)
+    return sorted(set(changed))
+
+
+def changed_bundle(root: Path, changed: list[str]) -> list[dict[str, Any]]:
+    files = []
+    for relative in changed:
+        path = resolve_under(root, relative)
+        if path.exists():
+            data = path.read_bytes()
+            if len(data) > MAX_FILE_BYTES:
+                raise IsolatedExecutorError("CHANGED_FILE_TOO_LARGE:" + relative)
+            files.append({
+                "path": relative,
+                "deleted": False,
+                "sha256": sha256(data),
+                "content_b64": base64.b64encode(data).decode("ascii"),
+            })
+        else:
+            files.append({"path": relative, "deleted": True, "sha256": None, "content_b64": None})
+    return files
+
+
+def execute_request(request_path: Path, result_path: Path) -> None:
+    assert_uncredentialed()
+    request = json.loads(request_path.read_text(encoding="utf-8"))
+    if request.get("schema") != "aios.isolated-execution.request.v1":
+        raise IsolatedExecutorError("REQUEST_SCHEMA_INVALID")
+    request_id = request.get("request_id")
+    if not isinstance(request_id, str) or not REQUEST_ID_RE.fullmatch(request_id):
+        raise IsolatedExecutorError("REQUEST_ID_INVALID")
+    source_archive = Path(str(request.get("source_archive") or ""))
+    if not source_archive.is_absolute():
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
+    expected_archive_sha = str(request.get("source_archive_sha256") or "")
+    if sha256(source_archive.read_bytes()) != expected_archive_sha:
+        raise IsolatedExecutorError("SOURCE_ARCHIVE_SHA_MISMATCH")
+    with tempfile.TemporaryDirectory(prefix="aios-isolated-executor-") as temporary:
+        root = Path(temporary) / "workspace"
+        root.mkdir()
+        extract_source(source_archive, root)
+        changed = apply_changes(request, root)
+        commands = [
+            run_command(item, root)
+            for item in request.get("verification", [])
+            if isinstance(item, Mapping)
+        ]
+        result = {
+            "schema": "aios.isolated-execution.result.v1",
+            "request_id": request_id,
+            "request_sha256": sha256(canonical(request)),
+            "changed_files": changed_bundle(root, changed),
+            "verification": commands,
+            "credential_isolation": {
+                "credential_env_absent": True,
+                "credential_mount_inaccessible": True,
+                "governed_bridge_unreachable": True,
+            },
+        }
+        result["result_sha256"] = sha256(canonical(result))
+        temporary_result = result_path.with_suffix(".tmp")
+        temporary_result.write_text(json.dumps(result, sort_keys=True, separators=(",", ":")), encoding="utf-8")
+        os.replace(temporary_result, result_path)
+
+
+def serve(root: Path) -> None:
+    assert_uncredentialed()
+    requests = root / "requests"
+    results = root / "results"
+    failed = root / "failed"
+    for path in (requests, results, failed):
+        path.mkdir(parents=True, exist_ok=True)
+    while True:
+        for request in sorted(requests.glob("*.json")):
+            if request.is_symlink():
+                continue
+            result = results / request.name
+            try:
+                execute_request(request, result)
+                request.unlink()
+            except Exception as exc:
+                (failed / request.name).write_text(
+                    json.dumps({"error": str(exc) or type(exc).__name__}, sort_keys=True),
+                    encoding="utf-8",
+                )
+                request.unlink(missing_ok=True)
+        time.sleep(0.5)
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--root", default="/var/lib/aios-online-agent-executor")
+    parser.add_argument("--request")
+    parser.add_argument("--result")
+    args = parser.parse_args()
+    if args.request and args.result:
+        execute_request(Path(args.request), Path(args.result))
+    else:
+        serve(Path(args.root))

active-runtime/app/aios_online_agent_checkpoint.py

@@ -0,0 +1,301 @@
+"""Durable checkpoint journal for the generic Online Agent worker.
+
+The JSON task state remains a fast cache.  This SQLite journal is the durable,
+append-only evidence used for restart/resume/replay decisions.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import hashlib
+import json
+from pathlib import Path
+import sqlite3
+from typing import Any, Mapping
+
+PHASE_ORDER = {
+    "claimed": 10,
+    "workspace_prepared": 20,
+    "verification_passed": 30,
+    "source_capture_done": 40,
+    "commit_done": 40,
+    "reconciliation_required": 45,
+    "result_pending": 50,
+    "result_submitted": 60,
+}
+
+
+class CheckpointError(RuntimeError):
+    pass
+
+
+def canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str).encode("utf-8")
+
+
+def sha256_json(value: object) -> str:
+    return hashlib.sha256(canonical(value)).hexdigest()
+
+
+def now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+@dataclass(frozen=True)
+class CheckpointBinding:
+    task_id: str
+    attempt: int
+    execution_digest: str
+    job_id: str
+    repository: str
+    base_oid: str
+    expected_branch_oid: str
+    target_branch: str
+    generation: int
+
+    def material(self) -> dict[str, Any]:
+        return {
+            "task_id": self.task_id,
+            "attempt": self.attempt,
+            "execution_digest": self.execution_digest,
+            "job_id": self.job_id,
+            "repository": self.repository,
+            "base_oid": self.base_oid,
+            "expected_branch_oid": self.expected_branch_oid,
+            "target_branch": self.target_branch,
+            "generation": self.generation,
+        }
+
+    @property
+    def binding_sha256(self) -> str:
+        return sha256_json(self.material())
+
+
+class CheckpointStore:
+    def __init__(self, path: Path) -> None:
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        with self._connect() as connection:
+            connection.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS checkpoints(
+                  task_id TEXT NOT NULL,
+                  attempt INTEGER NOT NULL,
+                  sequence INTEGER NOT NULL,
+                  phase TEXT NOT NULL,
+                  phase_order INTEGER NOT NULL,
+                  execution_digest TEXT NOT NULL,
+                  job_id TEXT NOT NULL,
+                  repository TEXT NOT NULL,
+                  base_oid TEXT NOT NULL,
+                  expected_branch_oid TEXT NOT NULL,
+                  target_branch TEXT NOT NULL,
+                  generation INTEGER NOT NULL,
+                  binding_sha256 TEXT NOT NULL,
+                  payload_json TEXT NOT NULL,
+                  payload_sha256 TEXT NOT NULL,
+                  created_at TEXT NOT NULL,
+                  PRIMARY KEY(task_id, attempt, sequence)
+                );
+                CREATE INDEX IF NOT EXISTS idx_checkpoints_task_latest
+                  ON checkpoints(task_id, attempt DESC, sequence DESC);
+                CREATE UNIQUE INDEX IF NOT EXISTS idx_checkpoints_exact_replay
+                  ON checkpoints(task_id, attempt, phase, payload_sha256);
+                CREATE TABLE IF NOT EXISTS checkpoint_heads(
+                  task_id TEXT PRIMARY KEY,
+                  attempt INTEGER NOT NULL,
+                  sequence INTEGER NOT NULL,
+                  phase TEXT NOT NULL,
+                  phase_order INTEGER NOT NULL,
+                  execution_digest TEXT NOT NULL,
+                  binding_sha256 TEXT NOT NULL,
+                  payload_sha256 TEXT NOT NULL,
+                  updated_at TEXT NOT NULL
+                );
+                """
+            )
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(self.path, timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA foreign_keys=ON")
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        connection.execute("PRAGMA busy_timeout=30000")
+        return connection
+
+    @staticmethod
+    def _phase_order(phase: str) -> int:
+        try:
+            return PHASE_ORDER[phase]
+        except KeyError as exc:
+            raise CheckpointError("CHECKPOINT_PHASE_INVALID") from exc
+
+    def append(
+        self,
+        binding: CheckpointBinding,
+        phase: str,
+        payload: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        order = self._phase_order(phase)
+        payload_value = dict(payload)
+        payload_sha = sha256_json(payload_value)
+        with self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            replay = connection.execute(
+                """
+                SELECT * FROM checkpoints
+                 WHERE task_id=? AND attempt=? AND phase=? AND payload_sha256=?
+                """,
+                (binding.task_id, binding.attempt, phase, payload_sha),
+            ).fetchone()
+            if replay is not None:
+                connection.commit()
+                return dict(replay)
+
+            head = connection.execute(
+                "SELECT * FROM checkpoint_heads WHERE task_id=?",
+                (binding.task_id,),
+            ).fetchone()
+            if head is not None:
+                head_attempt = int(head["attempt"])
+                head_order = int(head["phase_order"])
+                if binding.attempt < head_attempt:
+                    raise CheckpointError("CHECKPOINT_ATTEMPT_REGRESSION")
+                if binding.attempt == head_attempt:
+                    if head["execution_digest"] != binding.execution_digest:
+                        raise CheckpointError("CHECKPOINT_EXECUTION_DIGEST_CONFLICT")
+                    if head["binding_sha256"] != binding.binding_sha256:
+                        raise CheckpointError("CHECKPOINT_SCOPE_MISMATCH_DENY")
+                    if order < head_order and phase != "reconciliation_required":
+                        raise CheckpointError("CHECKPOINT_PHASE_REGRESSION")
+                    sequence = int(head["sequence"]) + 1
+                else:
+                    sequence = 1
+            else:
+                sequence = 1
+
+            created_at = now()
+            connection.execute(
+                """
+                INSERT INTO checkpoints(
+                  task_id,attempt,sequence,phase,phase_order,execution_digest,job_id,
+                  repository,base_oid,expected_branch_oid,target_branch,generation,
+                  binding_sha256,payload_json,payload_sha256,created_at
+                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+                """,
+                (
+                    binding.task_id,
+                    binding.attempt,
+                    sequence,
+                    phase,
+                    order,
+                    binding.execution_digest,
+                    binding.job_id,
+                    binding.repository,
+                    binding.base_oid,
+                    binding.expected_branch_oid,
+                    binding.target_branch,
+                    binding.generation,
+                    binding.binding_sha256,
+                    canonical(payload_value).decode("utf-8"),
+                    payload_sha,
+                    created_at,
+                ),
+            )
+            connection.execute(
+                """
+                INSERT INTO checkpoint_heads(
+                  task_id,attempt,sequence,phase,phase_order,execution_digest,
+                  binding_sha256,payload_sha256,updated_at
+                ) VALUES (?,?,?,?,?,?,?,?,?)
+                ON CONFLICT(task_id) DO UPDATE SET
+                  attempt=excluded.attempt,
+                  sequence=excluded.sequence,
+                  phase=excluded.phase,
+                  phase_order=excluded.phase_order,
+                  execution_digest=excluded.execution_digest,
+                  binding_sha256=excluded.binding_sha256,
+                  payload_sha256=excluded.payload_sha256,
+                  updated_at=excluded.updated_at
+                """,
+                (
+                    binding.task_id,
+                    binding.attempt,
+                    sequence,
+                    phase,
+                    order,
+                    binding.execution_digest,
+                    binding.binding_sha256,
+                    payload_sha,
+                    created_at,
+                ),
+            )
+            connection.commit()
+            row = connection.execute(
+                "SELECT * FROM checkpoints WHERE task_id=? AND attempt=? AND sequence=?",
+                (binding.task_id, binding.attempt, sequence),
+            ).fetchone()
+            return dict(row)
+
+    def latest(self, task_id: str) -> dict[str, Any] | None:
+        with self._connect() as connection:
+            row = connection.execute(
+                """
+                SELECT * FROM checkpoints
+                 WHERE task_id=?
+                 ORDER BY attempt DESC, sequence DESC
+                 LIMIT 1
+                """,
+                (task_id,),
+            ).fetchone()
+            if row is None:
+                return None
+            value = dict(row)
+            value["payload"] = json.loads(value.pop("payload_json"))
+            return value
+
+    def latest_for_attempt(self, task_id: str, attempt: int) -> dict[str, Any] | None:
+        with self._connect() as connection:
+            row = connection.execute(
+                """
+                SELECT * FROM checkpoints
+                 WHERE task_id=? AND attempt=?
+                 ORDER BY sequence DESC
+                 LIMIT 1
+                """,
+                (task_id, attempt),
+            ).fetchone()
+            if row is None:
+                return None
+            value = dict(row)
+            value["payload"] = json.loads(value.pop("payload_json"))
+            return value
+
+    def verify_latest_binding(self, binding: CheckpointBinding) -> dict[str, Any] | None:
+        value = self.latest(binding.task_id)
+        if value is None:
+            return None
+        if int(value["attempt"]) > binding.attempt:
+            raise CheckpointError("CHECKPOINT_FUTURE_ATTEMPT")
+        # A previous attempt may be reused only when the immutable execution/scope binding matches.
+        if value["execution_digest"] != binding.execution_digest:
+            return None
+        expected = CheckpointBinding(
+            task_id=value["task_id"],
+            attempt=int(value["attempt"]),
+            execution_digest=value["execution_digest"],
+            job_id=value["job_id"],
+            repository=value["repository"],
+            base_oid=value["base_oid"],
+            expected_branch_oid=value["expected_branch_oid"],
+            target_branch=value["target_branch"],
+            generation=int(value["generation"]),
+        )
+        current_scope = binding.material()
+        historical_scope = expected.material()
+        current_scope.pop("attempt", None)
+        historical_scope.pop("attempt", None)
+        if sha256_json(current_scope) != sha256_json(historical_scope):
+            raise CheckpointError("CHECKPOINT_SCOPE_MISMATCH_DENY")
+        return value

active-runtime/app/aios_online_agent_execution.py

@@ -0,0 +1,397 @@
+"""Canonical governed execution projection for Online Agent Tasks.
+
+The durable governed binding is authoritative.  Natural-language task fields and
+worker configuration are never allowed to invent repository, ref, generation, or
+idempotency coordinates.
+"""
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass
+import hashlib
+import json
+import re
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+import urllib.error
+import urllib.request
+
+
+EXECUTION_SCHEMA = "aios.online-agent.execution.v2"
+PROJECTION_SCHEMA = "aios.online-agent.task-projection.v1"
+OID_RE = re.compile(r"^[0-9a-f]{40}$")
+TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
+BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
+KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
+PROTECTED_PREFIXES = ("main", "master", "refs/", "tags/", "tag/", "release/", "baseline/", "production/")
+MUTATION_ACTIONS = frozenset({"deterministic"})
+SUPPORTED_ACTIONS = frozenset({"deterministic", "source_capture"})
+
+
+class ExecutionProjectionError(RuntimeError):
+    """A canonical fail-closed projection or validation error."""
+
+
+class OnlineTaskProjectionClient:
+    """Official HTTP projection client using only a control credential reference."""
+
+    def __init__(self, api_base: str, control_token_path: Path) -> None:
+        self.api_base = api_base.rstrip("/")
+        self.control_token_path = Path(control_token_path)
+
+    def _token(self) -> str:
+        path = self.control_token_path
+        if path.is_symlink() or not path.is_file():
+            _error("ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE")
+        value = path.read_text(encoding="utf-8").strip()
+        if len(value) < 32:
+            _error("ONLINE_TASK_PROJECTION_CONTROL_INVALID")
+        return value
+
+    def create(
+        self,
+        projected_task: Mapping[str, Any],
+        *,
+        binding: "GovernedExecutionBinding",
+    ) -> dict[str, Any]:
+        body = dict(projected_task)
+        payload = _canonical(body).encode("utf-8")
+        request = urllib.request.Request(
+            self.api_base + "/v1/tasks",
+            method="POST",
+            data=payload,
+            headers={
+                "Authorization": "Bearer " + self._token(),
+                "Content-Type": "application/json",
+                "Accept": "application/json",
+            },
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=15) as response:
+                result = json.loads(response.read().decode("utf-8"))
+                status = response.status
+        except urllib.error.HTTPError as exc:
+            raw = exc.read(8192).decode("utf-8", "replace")
+            try:
+                error = json.loads(raw).get("error")
+            except (AttributeError, json.JSONDecodeError):
+                error = "HTTP_ERROR"
+            raise ExecutionProjectionError(f"ONLINE_TASK_PROJECTION_FAILED:{exc.code}:{error}") from exc
+        except (OSError, urllib.error.URLError, TimeoutError) as exc:
+            raise ExecutionProjectionError("ONLINE_TASK_PROJECTION_UNAVAILABLE") from exc
+        if status not in {200, 201} or not isinstance(result, dict):
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
+        if result.get("task_id") != binding.task_id or result.get("status") not in {"QUEUED", "VERIFYING", "SUCCEEDED"}:
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
+        metadata = result.get("metadata")
+        if not isinstance(metadata, Mapping):
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
+        returned_execution = validate_execution_envelope(
+            _object(metadata.get("execution"), "ONLINE_TASK_PROJECTION_RESPONSE_INVALID"),
+            binding=binding,
+        )
+        submitted_metadata = _object(body.get("metadata"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID")
+        submitted_execution = validate_execution_envelope(
+            _object(submitted_metadata.get("execution"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID"),
+            binding=binding,
+        )
+        if _canonical(returned_execution) != _canonical(submitted_execution):
+            _error("ONLINE_TASK_PROJECTION_RESPONSE_BINDING_INVALID")
+        return result
+
+
+def _error(code: str) -> None:
+    raise ExecutionProjectionError(code)
+
+
+def _object(value: object, code: str) -> dict[str, Any]:
+    if not isinstance(value, Mapping):
+        _error(code)
+    return dict(value)
+
+
+def _string(value: object, code: str) -> str:
+    if not isinstance(value, str) or not value.strip():
+        _error(code)
+    return value.strip()
+
+
+def _task_id(value: object) -> str:
+    value = _string(value, "TASK_ID_INVALID")
+    if TASK_RE.fullmatch(value) is None:
+        _error("TASK_ID_INVALID")
+    return value
+
+
+def _oid(value: object, code: str) -> str:
+    value = _string(value, code)
+    if OID_RE.fullmatch(value) is None:
+        _error(code)
+    return value
+
+
+def _branch(value: object) -> str:
+    value = _string(value, "TARGET_BRANCH_INVALID")
+    if BRANCH_RE.fullmatch(value) is None or value.startswith(PROTECTED_PREFIXES):
+        _error("TARGET_BRANCH_INVALID")
+    return value
+
+
+def _generation(value: object) -> int:
+    if not isinstance(value, int) or isinstance(value, bool) or value < 1:
+        _error("GENERATION_INVALID")
+    return value
+
+
+def _canonical(value: object) -> str:
+    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+
+
+def _digest(value: object) -> str:
+    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
+
+
+def _source_signals(value: object) -> tuple[str, ...]:
+    """Normalize untrusted natural-language hints before they enter a signed envelope."""
+    if value is None:
+        return ()
+    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
+        _error("SOURCE_CAPTURE_SIGNALS_INVALID")
+    result: list[str] = []
+    for item in value:
+        if not isinstance(item, str):
+            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
+        text = " ".join(item.split()).strip()
+        if not text:
+            continue
+        # Projection may accept long task prose, but execution envelopes stay bounded.
+        text = text[:512].rstrip()
+        if text not in result:
+            result.append(text)
+        if len(result) == 16:
+            break
+    return tuple(result)
+
+
+def _capabilities(value: object) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
+        _error("CAPABILITY_SCOPE_INVALID")
+    result = tuple(sorted({_string(item, "CAPABILITY_SCOPE_INVALID") for item in value}))
+    if any(len(item) > 120 for item in result):
+        _error("CAPABILITY_SCOPE_INVALID")
+    return result
+
+
+@dataclass(frozen=True, slots=True)
+class GovernedExecutionBinding:
+    task_id: str
+    job_id: str
+    repository: str
+    base_oid: str
+    expected_branch_oid: str
+    target_branch: str
+    branch_mode: str
+    generation: int
+    idempotency_key: str
+
+    @classmethod
+    def from_mapping(cls, value: Mapping[str, Any]) -> "GovernedExecutionBinding":
+        data = dict(value)
+        task_id = _task_id(data.get("task_id"))
+        job_id = _string(data.get("job_id"), "JOB_ID_REQUIRED")
+        if TASK_RE.fullmatch(job_id) is None:
+            _error("JOB_ID_INVALID")
+        repository = _string(data.get("repository"), "REPOSITORY_INVALID")
+        if repository != "aios/aios":
+            _error("WRONG_REPOSITORY_ENVELOPE_DENY")
+        base_oid = _oid(data.get("base_oid"), "BASE_OID_INVALID")
+        expected = _oid(data.get("expected_branch_oid"), "EXPECTED_BRANCH_OID_INVALID")
+        target = _branch(data.get("target_branch"))
+        mode = _string(data.get("branch_mode"), "BRANCH_MODE_MISSING")
+        if mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
+            _error("BRANCH_MODE_INVALID")
+        generation = _generation(data.get("generation"))
+        if mode == "CREATE_NEW" and expected != base_oid:
+            _error("EXPECTED_BASE_CONFLICT")
+        key = _string(data.get("idempotency_key"), "IDEMPOTENCY_KEY_INVALID")
+        if KEY_RE.fullmatch(key) is None:
+            _error("IDEMPOTENCY_KEY_INVALID")
+        return cls(task_id, job_id, repository, base_oid, expected, target, mode, generation, key)
+
+    def public(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+def binding_from_bootstrap(value: Mapping[str, Any]) -> GovernedExecutionBinding:
+    return GovernedExecutionBinding.from_mapping(value)
+
+
+def validate_execution_envelope(
+    value: Mapping[str, Any],
+    *,
+    binding: GovernedExecutionBinding | None = None,
+    worker_capabilities: Sequence[str] | None = None,
+) -> dict[str, Any]:
+    envelope = dict(value)
+    if envelope.get("schema") != EXECUTION_SCHEMA:
+        _error("EXECUTION_ENVELOPE_SCHEMA_VALIDATION")
+    candidate = GovernedExecutionBinding.from_mapping(envelope)
+    if binding is not None and candidate != binding:
+        comparisons = (
+            (candidate.task_id, binding.task_id, "TASK_BINDING_CONFLICT"),
+            (candidate.job_id, binding.job_id, "JOB_BINDING_CONFLICT"),
+            (candidate.repository, binding.repository, "WRONG_REPOSITORY_ENVELOPE_DENY"),
+            (candidate.base_oid, binding.base_oid, "WRONG_BASE_ENVELOPE_DENY"),
+            (candidate.expected_branch_oid, binding.expected_branch_oid, "WRONG_EXPECTED_HEAD_ENVELOPE_DENY"),
+            (candidate.target_branch, binding.target_branch, "WRONG_BRANCH_ENVELOPE_DENY"),
+            (candidate.generation, binding.generation, "WRONG_GENERATION_ENVELOPE_DENY"),
+            (candidate.branch_mode, binding.branch_mode, "BRANCH_MODE_BINDING_CONFLICT"),
+            (candidate.idempotency_key, binding.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
+        )
+        for actual, expected, code in comparisons:
+            if actual != expected:
+                _error(code)
+    action = _string(envelope.get("action"), "EXECUTION_ACTION_MISSING")
+    if action not in SUPPORTED_ACTIONS:
+        _error("EXECUTION_ACTION_UNSUPPORTED")
+    capability_scope = _capabilities(envelope.get("capability_scope"))
+    if worker_capabilities is not None and not set(capability_scope).issubset(set(worker_capabilities)):
+        _error("CAPABILITY_MISMATCH_DENY")
+    workspace = _object(envelope.get("workspace"), "WORKSPACE_POLICY_REQUIRED")
+    if workspace.get("authority_git_dir") != "/data/aios-gitops/repo.git" or workspace.get("read_only_repository") is not True:
+        _error("WORKSPACE_POLICY_DENY")
+    governance = _object(envelope.get("governance"), "GOVERNANCE_POLICY_REQUIRED")
+    governed_coordinates = (
+        (governance.get("task_id"), candidate.task_id, "TASK_BINDING_CONFLICT"),
+        (governance.get("job_id"), candidate.job_id, "JOB_BINDING_CONFLICT"),
+        (governance.get("idempotency_key"), candidate.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
+    )
+    for actual_coordinate, expected_coordinate, code in governed_coordinates:
+        if actual_coordinate != expected_coordinate:
+            _error(code)
+    commit_key = _string(governance.get("commit_idempotency_key"), "COMMIT_IDEMPOTENCY_KEY_INVALID")
+    if KEY_RE.fullmatch(commit_key) is None:
+        _error("COMMIT_IDEMPOTENCY_KEY_INVALID")
+    if governance.get("writer_lease") is not (action in MUTATION_ACTIONS):
+        _error("WRITER_LEASE_POLICY_DENY")
+    for field in ("main_write", "production_write", "tag_write", "baseline_write", "force_push", "protected_ref_bypass"):
+        if governance.get(field, False) is not False:
+            _error("POLICY_DENY")
+    changes = envelope.get("change_set")
+    verification = envelope.get("verification")
+    if not isinstance(changes, list) or not isinstance(verification, list):
+        _error("EXECUTION_OPERATIONS_INVALID")
+    if action == "source_capture":
+        if changes or verification:
+            _error("SOURCE_CAPTURE_MUTATION_DENY")
+        signals = list(_source_signals(envelope.get("source_signals") or []))
+        if envelope.get("source_signals") != signals:
+            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
+    elif not changes:
+        _error("CHANGE_SET_INVALID")
+    declared = str(envelope.get("execution_digest") or "")
+    material = {key: item for key, item in envelope.items() if key != "execution_digest"}
+    actual = _digest(material)
+    if declared != actual:
+        _error("EXECUTION_DIGEST_INVALID")
+    return {**material, "execution_digest": actual}
+
+
+def project_execution_envelope(
+    binding: GovernedExecutionBinding,
+    execution_request: Mapping[str, Any] | None = None,
+    *,
+    required_capabilities: Sequence[str] = (),
+) -> dict[str, Any]:
+    request = dict(execution_request or {})
+    action = str(request.get("action") or "source_capture")
+    if action not in SUPPORTED_ACTIONS:
+        _error("EXECUTION_ACTION_UNSUPPORTED")
+    capabilities = _capabilities(request.get("capability_scope", required_capabilities))
+    governance = {
+        "task_id": binding.task_id,
+        "job_id": binding.job_id,
+        "idempotency_key": binding.idempotency_key,
+        "commit_idempotency_key": str(request.get("commit_idempotency_key") or f"{binding.task_id}-commit-g{binding.generation}"),
+        "writer_lease": action in MUTATION_ACTIONS,
+        "main_write": False,
+        "production_write": False,
+        "tag_write": False,
+        "baseline_write": False,
+        "force_push": False,
+        "protected_ref_bypass": False,
+    }
+    supplied_governance = request.get("governance")
+    if supplied_governance is not None:
+        governance.update(_object(supplied_governance, "GOVERNANCE_POLICY_REQUIRED"))
+    material: dict[str, Any] = {
+        "schema": EXECUTION_SCHEMA,
+        **binding.public(),
+        "action": action,
+        "adapter": str(request.get("adapter") or ("deterministic" if action == "deterministic" else "source_capture")),
+        "capability_scope": list(capabilities),
+        "change_set": list(request.get("change_set") or []),
+        "verification": list(request.get("verification") or []),
+        "source_signals": list(_source_signals(request.get("source_signals") or [])) if action == "source_capture" else [],
+        "governance": governance,
+        "workspace": {
+            "authority_git_dir": "/data/aios-gitops/repo.git",
+            "read_only_repository": True,
+            "cleanup_policy": "always",
+        },
+    }
+    envelope = {**material, "execution_digest": _digest(material)}
+    return validate_execution_envelope(envelope, binding=binding)
+
+
+def project_online_task(
+    binding: GovernedExecutionBinding,
+    task_request: Mapping[str, Any],
+    execution_request: Mapping[str, Any] | None = None,
+) -> dict[str, Any]:
+    request = dict(task_request)
+    required = _capabilities(request.get("required_capabilities"))
+    execution = project_execution_envelope(binding, execution_request, required_capabilities=required)
+    metadata = dict(request.get("metadata") or {})
+    if "execution" in metadata:
+        validate_execution_envelope(_object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"), binding=binding)
+        if metadata["execution"] != execution:
+            _error("EXECUTION_PROJECTION_CONFLICT")
+    metadata["execution"] = execution
+    metadata["execution_projection"] = {
+        "schema": PROJECTION_SCHEMA,
+        "task_id": binding.task_id,
+        "job_id": binding.job_id,
+        "execution_digest": execution["execution_digest"],
+    }
+    return {
+        **request,
+        "task_id": binding.task_id,
+        "metadata": metadata,
+        "required_capabilities": list(required),
+        "idempotency_key": str(request.get("idempotency_key") or f"online-task:{binding.idempotency_key}"),
+    }
+
+
+def resolve_task_execution(
+    task: Mapping[str, Any],
+    binding: GovernedExecutionBinding,
+    *,
+    worker_capabilities: Sequence[str] | None = None,
+) -> tuple[dict[str, Any], str]:
+    metadata = task.get("metadata")
+    if isinstance(metadata, Mapping) and "execution" in metadata:
+        value = validate_execution_envelope(
+            _object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"),
+            binding=binding,
+            worker_capabilities=worker_capabilities,
+        )
+        return value, "persisted"
+    projected = project_execution_envelope(
+        binding,
+        {"action": "source_capture", "capability_scope": task.get("required_capabilities") or []},
+        required_capabilities=task.get("required_capabilities") or [],
+    )
+    validate_execution_envelope(projected, binding=binding, worker_capabilities=worker_capabilities)
+    return projected, "recovered_projection"

active-runtime/app/aios_online_agent_plan_store.py

@@ -0,0 +1,187 @@
+"""Durable, authority-bound deterministic execution plans for Online Agent Tasks."""
+from __future__ import annotations
+
+from contextlib import contextmanager
+from dataclasses import dataclass
+import fcntl
+import hashlib
+import json
+from pathlib import Path
+from typing import Any, Mapping
+
+from aios_online_agent_execution import (
+    GovernedExecutionBinding,
+    project_execution_envelope,
+)
+
+
+class ExecutionPlanError(RuntimeError):
+    pass
+
+
+def _canonical(value: object) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def _digest(value: object) -> str:
+    return hashlib.sha256(_canonical(value)).hexdigest()
+
+
+def _task_key(task_id: str) -> str:
+    readable = "".join(ch if ch.isalnum() or ch in "._-" else "-" for ch in task_id).strip("-")[:72] or "task"
+    return readable + "-" + hashlib.sha256(task_id.encode("utf-8")).hexdigest()[:24]
+
+
+@dataclass(frozen=True)
+class ExecutionPlanRecord:
+    task_id: str
+    job_id: str
+    source_head_oid: str
+    generation: int
+    idempotency_key: str
+    plan_digest: str
+    execution: dict[str, Any]
+
+    def public(self) -> dict[str, Any]:
+        return {
+            "schema": "aios.online-agent.plan-record.v1",
+            "task_id": self.task_id,
+            "job_id": self.job_id,
+            "source_head_oid": self.source_head_oid,
+            "generation": self.generation,
+            "idempotency_key": self.idempotency_key,
+            "plan_digest": self.plan_digest,
+            "execution": dict(self.execution),
+        }
+
+
+class ExecutionPlanStore:
+    def __init__(self, root: Path) -> None:
+        self.root = Path(root)
+        self.root.mkdir(parents=True, exist_ok=True)
+
+    def _path(self, task_id: str) -> Path:
+        return self.root / (_task_key(task_id) + ".json")
+
+    @contextmanager
+    def _lock(self, task_id: str):
+        path = self.root / (_task_key(task_id) + ".lock")
+        with path.open("a+b") as handle:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+
+    @staticmethod
+    def _source_head(binding: GovernedExecutionBinding) -> str:
+        return binding.expected_branch_oid if binding.branch_mode == "CONTINUE_EXISTING" else binding.base_oid
+
+    def _read(self, task_id: str) -> ExecutionPlanRecord | None:
+        path = self._path(task_id)
+        if not path.is_file() or path.is_symlink():
+            return None
+        value = json.loads(path.read_text(encoding="utf-8"))
+        if not isinstance(value, Mapping) or value.get("schema") != "aios.online-agent.plan-record.v1":
+            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
+        execution = value.get("execution")
+        if not isinstance(execution, Mapping):
+            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
+        return ExecutionPlanRecord(
+            task_id=str(value.get("task_id") or ""),
+            job_id=str(value.get("job_id") or ""),
+            source_head_oid=str(value.get("source_head_oid") or ""),
+            generation=int(value.get("generation") or 0),
+            idempotency_key=str(value.get("idempotency_key") or ""),
+            plan_digest=str(value.get("plan_digest") or ""),
+            execution=dict(execution),
+        )
+
+    def register(
+        self,
+        binding: GovernedExecutionBinding,
+        request: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        with self._lock(binding.task_id):
+            return self._register_locked(binding, request)
+
+    def _register_locked(
+        self,
+        binding: GovernedExecutionBinding,
+        request: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        if request.get("schema") != "aios.online-agent.plan.v1":
+            raise ExecutionPlanError("EXECUTION_PLAN_SCHEMA_INVALID")
+        if request.get("task_id") != binding.task_id or request.get("job_id") != binding.job_id:
+            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
+        if int(request.get("generation") or 0) != binding.generation:
+            raise ExecutionPlanError("EXECUTION_PLAN_GENERATION_CONFLICT")
+        source_head = str(request.get("source_head_oid") or "")
+        if source_head != self._source_head(binding):
+            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_CONFLICT")
+        key = str(request.get("idempotency_key") or "")
+        if len(key) < 8:
+            raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_INVALID")
+        execution_request = request.get("execution")
+        if not isinstance(execution_request, Mapping) or execution_request.get("action") != "deterministic":
+            raise ExecutionPlanError("EXECUTION_PLAN_DETERMINISTIC_REQUIRED")
+        envelope = project_execution_envelope(binding, execution_request)
+        material = {
+            "task_id": binding.task_id,
+            "job_id": binding.job_id,
+            "source_head_oid": source_head,
+            "generation": binding.generation,
+            "idempotency_key": key,
+            "execution": dict(execution_request),
+        }
+        plan_digest = _digest(material)
+        existing = self._read(binding.task_id)
+        expected_previous = request.get("expected_previous_plan_digest")
+        if existing is not None:
+            if existing.idempotency_key == key:
+                if existing.plan_digest != plan_digest:
+                    raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_CONFLICT")
+                return {**existing.public(), "idempotent": True, "execution_digest": envelope["execution_digest"]}
+            if expected_previous != existing.plan_digest:
+                raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
+            if existing.source_head_oid != source_head:
+                raise ExecutionPlanError("EXECUTION_PLAN_STALE_REPLACEMENT_DENY")
+        elif expected_previous not in (None, ""):
+            raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
+
+        record = ExecutionPlanRecord(
+            task_id=binding.task_id,
+            job_id=binding.job_id,
+            source_head_oid=source_head,
+            generation=binding.generation,
+            idempotency_key=key,
+            plan_digest=plan_digest,
+            execution=dict(execution_request),
+        )
+        path = self._path(binding.task_id)
+        temporary = path.with_suffix(".tmp")
+        temporary.write_text(
+            json.dumps(record.public(), sort_keys=True, separators=(",", ":")),
+            encoding="utf-8",
+        )
+        temporary.replace(path)
+        return {**record.public(), "idempotent": False, "execution_digest": envelope["execution_digest"]}
+
+    def resolve(self, binding: GovernedExecutionBinding) -> dict[str, Any] | None:
+        record = self._read(binding.task_id)
+        if record is None:
+            return None
+        if (
+            record.task_id != binding.task_id
+            or record.job_id != binding.job_id
+            or record.generation != binding.generation
+        ):
+            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
+        if record.source_head_oid != self._source_head(binding):
+            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_DRIFT")
+        envelope = project_execution_envelope(binding, record.execution)
+        return {
+            "execution": dict(record.execution),
+            "plan_digest": record.plan_digest,
+            "execution_digest": envelope["execution_digest"],
+        }

active-runtime/app/authorized_task_writer_provisioning.py

@@ -964,6 +964,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
     required = {
         "schema",
         "task_id",
+        "job_id",
         "repository",
         "branch_mode",
         "base_oid",
@@ -976,6 +977,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
         raise ProvisioningError("LEASE_REQUEST_V2_FIELDS_REJECTED", 409)
     request = WriterLeaseRequestV2(
         task_id=str(raw["task_id"]),
+        job_id=str(raw["job_id"]),
         repository=str(raw["repository"]),
         branch_mode=str(raw["branch_mode"]),
         base_oid=str(raw["base_oid"]),
@@ -988,6 +990,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
     return {
         "schema": WriterLeaseRequestV2.schema,
         "task_id": request.task_id,
+        "job_id": request.job_id,
         "repository": request.repository,
         "branch_mode": request.branch_mode,
         "base_oid": request.base_oid,
@@ -995,7 +998,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
         "target_branch": request.target_branch,
         "generation": request.generation,
         "lease_seconds": request.lease_seconds,
-        "create_target_branch": False,
-        "worktree_mode": "detached_at_expected_head",
+        "create_target_branch": request.branch_mode == "CREATE_NEW",
+        "worktree_mode": "detached_at_base_oid" if request.branch_mode == "CREATE_NEW" else "detached_at_expected_head",
         "cas_ref_update_required": True,
     }

active-runtime/app/baseline_authority.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""Single canonical Production Baseline authority for the GitOps reader.
+
+The API and the one-shot writer import this module.  Workspace and release
+copies are projections only; they are never selected as a fallback source.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from pathlib import Path
+from typing import Any
+
+
+AUTHORITY_PATH = Path(os.getenv(
+    "AIOS_GITOPS_BASELINE_AUTHORITY",
+    "/var/lib/aios-gitops-runtime-anchor/baseline/current.json",
+))
+AUTHORITY_SHA_PATH = AUTHORITY_PATH.with_suffix(".sha256")
+
+
+class BaselineAuthorityError(RuntimeError):
+    """Fail-closed error raised for an unavailable or inconsistent authority."""
+
+
+class BaselineAuthority:
+    def __init__(self, path: Path | str = AUTHORITY_PATH):
+        self.path = Path(path)
+        self.sha_path = self.path.with_suffix(".sha256")
+
+    def _raw(self) -> bytes:
+        try:
+            raw = self.path.read_bytes()
+        except OSError as exc:
+            raise BaselineAuthorityError(f"authority_unavailable:{exc}") from exc
+        if not raw:
+            raise BaselineAuthorityError("authority_empty")
+        return raw
+
+    def read(self) -> dict[str, Any]:
+        raw = self._raw()
+        digest = hashlib.sha256(raw).hexdigest()
+        try:
+            value = json.loads(raw.decode("utf-8"))
+        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+            raise BaselineAuthorityError("authority_invalid_json") from exc
+        if not isinstance(value, dict):
+            raise BaselineAuthorityError("authority_not_object")
+        expected = str(value.get("authority_sha256", ""))
+        if expected and expected != digest:
+            raise BaselineAuthorityError("authority_embedded_digest_mismatch")
+        if self.sha_path.exists():
+            sidecar = self.sha_path.read_text(encoding="utf-8").strip().split()[0]
+            if sidecar != digest:
+                raise BaselineAuthorityError("authority_sidecar_digest_mismatch")
+        required = {
+            "current_baseline", "previous_baseline", "target_oid", "tag_oid",
+            "evidence_closure_oid", "approval_plan_id", "status", "generation",
+            "source_identity",
+        }
+        missing = sorted(required.difference(value))
+        if missing:
+            raise BaselineAuthorityError("authority_missing:" + ",".join(missing))
+        value = dict(value)
+        value["authority_sha256"] = digest
+        value["authority_path"] = str(self.path)
+        return value
+
+    def read_consistent(self, policy: dict[str, Any] | None = None) -> dict[str, Any]:
+        value = self.read()
+        if policy:
+            expected = policy.get("release_binding", policy)
+            for key, field in (("version", "current_baseline"),
+                               ("previous_version", "previous_baseline"),
+                               ("target_oid", "target_oid"),
+                               ("tag_oid", "tag_oid"),
+                               ("evidence_closure_oid", "evidence_closure_oid"),
+                               ("approval_plan_id", "approval_plan_id")):
+                wanted = expected.get(key)
+                if wanted is not None and value.get(field) != wanted:
+                    raise BaselineAuthorityError(f"authority_binding_mismatch:{field}")
+        return value
+

active-runtime/app/governed_production_release.py

@@ -0,0 +1,568 @@
+"""Governed V2R2C1 production release orchestration.
+
+This module is deliberately scoped to the Owner-approved V2R2C1 binding.  It
+uses the existing TagPublisher and metadata adapters; it does not introduce a
+second Git writer, a second durable job store, or an alternate baseline.
+"""
+from __future__ import annotations
+
+import argparse
+import fcntl
+import hashlib
+import json
+import os
+import re
+import subprocess
+import tarfile
+import tempfile
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Mapping
+
+from gitea_tag_publication import (
+    GiteaTagClient,
+    GitTagBackend,
+    PublicationManualOwnerReviewRequired,
+    PublicationPending,
+    PublicationReconciliationRequired,
+    PublicationRequest,
+    TagPublisher,
+)
+
+
+VERSION = "V2R2C1"
+TARGET_OID = "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
+EVIDENCE_CLOSURE_OID = "a8b906d1bc24088c19647e98de6a679268f6d0a2"
+APPROVAL_PLAN_ID = "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e"
+REPOSITORY = "aios/aios"
+SERVICE = "aios-v2r1c7-production.service"
+PORT = 18927
+OID_RE = re.compile(r"^[0-9a-f]{40}$")
+SHA_RE = re.compile(r"^[0-9a-f]{64}$")
+
+
+class ReleaseBlocked(RuntimeError):
+    """A release gate failed and no unsafe recovery is permitted."""
+
+
+class ManualOwnerReviewRequired(ReleaseBlocked):
+    pass
+
+
+class ReconciliationRequired(ReleaseBlocked):
+    pass
+
+
+def canonical(value: object) -> bytes:
+    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode()
+
+
+def sha256_file(path: Path) -> str:
+    if path.is_symlink() or not path.is_file():
+        raise ReleaseBlocked("artifact must be a regular file")
+    digest = hashlib.sha256()
+    with path.open("rb") as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def atomic_json(path: Path, value: Mapping[str, Any], mode: int = 0o600) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    temporary = path.with_name(path.name + ".tmp")
+    temporary.write_bytes(canonical(dict(value)))
+    os.chmod(temporary, mode)
+    os.replace(temporary, path)
+
+
+@dataclass(frozen=True)
+class ReleaseBinding:
+    version: str = VERSION
+    target_oid: str = TARGET_OID
+    evidence_closure_oid: str = EVIDENCE_CLOSURE_OID
+    approval_plan_id: str = APPROVAL_PLAN_ID
+    repository: str = REPOSITORY
+    production_service: str = SERVICE
+    production_port: int = PORT
+
+    def validate(self) -> None:
+        if self.version != VERSION or self.repository != REPOSITORY:
+            raise ManualOwnerReviewRequired("release binding is outside V2R2C1 scope")
+        if not OID_RE.fullmatch(self.target_oid) or self.target_oid != TARGET_OID:
+            raise ManualOwnerReviewRequired("V2R2C1 target_oid mismatch")
+        if not OID_RE.fullmatch(self.evidence_closure_oid) or self.evidence_closure_oid != EVIDENCE_CLOSURE_OID:
+            raise ManualOwnerReviewRequired("V2R2C1 evidence closure mismatch")
+        if self.approval_plan_id != APPROVAL_PLAN_ID:
+            raise ManualOwnerReviewRequired("V2R2C1 approval plan mismatch")
+        if self.production_service != SERVICE or int(self.production_port) != PORT:
+            raise ManualOwnerReviewRequired("production service binding mismatch")
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "version": self.version,
+            "target_oid": self.target_oid,
+            "evidence_closure_oid": self.evidence_closure_oid,
+            "approval_plan_id": self.approval_plan_id,
+            "repository": self.repository,
+            "production_service": self.production_service,
+            "production_port": self.production_port,
+        }
+
+
+class StateLock:
+    def __init__(self, path: Path):
+        self.path = path
+        self.handle = None
+
+    def __enter__(self) -> "StateLock":
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.handle = self.path.open("a+", encoding="utf-8")
+        fcntl.flock(self.handle.fileno(), fcntl.LOCK_EX)
+        return self
+
+    def __exit__(self, exc_type, exc, tb) -> None:
+        if self.handle is not None:
+            fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
+            self.handle.close()
+
+
+class ReleaseState:
+    def __init__(self, root: Path, binding: ReleaseBinding):
+        self.root = root
+        self.path = root / "release-state.json"
+        self.binding = binding
+        root.mkdir(parents=True, exist_ok=True)
+        if self.path.exists():
+            value = json.loads(self.path.read_text(encoding="utf-8"))
+            if value.get("binding") != binding.as_dict():
+                raise ManualOwnerReviewRequired("persisted release binding conflict")
+            self.value = value
+        else:
+            self.value = {
+                "schema": "aios.v2r2c1.governed-production-release-state.v1",
+                "binding": binding.as_dict(),
+                "state": "INITIAL",
+                "completed": {},
+                "history": [],
+            }
+            self.save()
+
+    def save(self) -> None:
+        atomic_json(self.path, self.value)
+
+    def record(self, state: str, step: str, result: Mapping[str, Any]) -> None:
+        safe = json.loads(json.dumps(dict(result)))
+        self.value["state"] = state
+        self.value.setdefault("completed", {})[step] = safe
+        self.value.setdefault("history", []).append(
+            {"at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "state": state, "step": step, "result": safe}
+        )
+        self.save()
+
+    def fail(self, state: str, reason: str) -> None:
+        self.value["state"] = state
+        self.value.setdefault("history", []).append(
+            {"at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "state": state, "reason": str(reason)[:500]}
+        )
+        self.save()
+
+
+def _git(git_dir: Path, *args: str, check: bool = True) -> str:
+    completed = subprocess.run(
+        ["git", f"--git-dir={git_dir}", *args],
+        check=False,
+        capture_output=True,
+        text=True,
+        timeout=45,
+        env={"PATH": os.environ.get("PATH", "")},
+    )
+    if check and completed.returncode != 0:
+        raise ReconciliationRequired(completed.stderr.strip() or "authoritative git query failed")
+    return completed.stdout.strip()
+
+
+def _ancestor(git_dir: Path, ancestor: str, descendant: str) -> bool:
+    return subprocess.run(
+        ["git", f"--git-dir={git_dir}", "merge-base", "--is-ancestor", ancestor, descendant],
+        check=False,
+        capture_output=True,
+        timeout=45,
+        env={"PATH": os.environ.get("PATH", "")},
+    ).returncode == 0
+
+
+def verify_lineage(git_dir: Path, binding: ReleaseBinding) -> dict[str, Any]:
+    binding.validate()
+    if _git(git_dir, "cat-file", "-t", binding.target_oid) != "commit":
+        raise ReleaseBlocked("approved target_oid is not a commit")
+    if _git(git_dir, "cat-file", "-t", binding.evidence_closure_oid) != "commit":
+        raise ReleaseBlocked("evidence closure is not a commit")
+    if not _ancestor(git_dir, binding.target_oid, binding.evidence_closure_oid):
+        raise ManualOwnerReviewRequired("approved target is not an ancestor of evidence closure")
+    return {
+        "target_oid": binding.target_oid,
+        "evidence_closure_oid": binding.evidence_closure_oid,
+        "target_is_ancestor_of_evidence": True,
+        "main_oid": _git(git_dir, "rev-parse", "refs/heads/main"),
+    }
+
+
+def verify_owner_approval(value: Mapping[str, Any], binding: ReleaseBinding) -> dict[str, Any]:
+    approval = value.get("owner_approval")
+    if not isinstance(approval, Mapping):
+        raise ReleaseBlocked("OWNER_APPROVAL_RECEIPT_REQUIRED")
+    if approval.get("approved") is not True or approval.get("status") != "APPROVED":
+        raise ReleaseBlocked("OWNER_APPROVAL_NOT_ACCEPTED")
+    if approval.get("approved_by") != "aiman":
+        raise ManualOwnerReviewRequired("OWNER_APPROVAL_ACTOR_MISMATCH")
+    if approval.get("approval_source") != "explicit_owner_approval_in_chat":
+        raise ManualOwnerReviewRequired("OWNER_APPROVAL_SOURCE_MISMATCH")
+    for key, expected in binding.as_dict().items():
+        if key in {"repository", "production_service", "production_port"}:
+            continue
+        if approval.get(key) != expected:
+            raise ManualOwnerReviewRequired("OWNER_APPROVAL_BINDING_MISMATCH:" + key)
+    return dict(approval)
+
+
+def _payload_file(git_dir: Path, oid: str, path: str) -> bytes:
+    completed = subprocess.run(
+        ["git", f"--git-dir={git_dir}", "show", f"{oid}:{path}"],
+        check=False,
+        capture_output=True,
+        timeout=45,
+        env={"PATH": os.environ.get("PATH", "")},
+    )
+    if completed.returncode != 0:
+        raise ReleaseBlocked("required release source missing:" + path)
+    return completed.stdout
+
+
+def _commit_epoch(git_dir: Path, oid: str) -> int:
+    return int(_git(git_dir, "show", "-s", "--format=%ct", oid))
+
+
+def build_production_artifact(
+    git_dir: Path,
+    binding: ReleaseBinding,
+    output_root: Path,
+) -> dict[str, Any]:
+    """Build a deterministic executable V2R2C1 health artifact from target_oid."""
+    binding.validate()
+    verify_lineage(git_dir, binding)
+    epoch = _commit_epoch(git_dir, binding.target_oid)
+    output_root.mkdir(parents=True, exist_ok=True)
+    stem = f"aios-{VERSION}-{binding.target_oid[:12]}"
+    output = output_root / (stem + ".tar.zst")
+    with tempfile.TemporaryDirectory(prefix="v2r2c1-artifact-") as temp:
+        root = Path(temp) / "payload"
+        root.mkdir(parents=True)
+        source_paths = {
+            "active-runtime/app/deployment_state.py": "active-runtime/app/deployment_state.py",
+            "active-runtime/app/v2r1c6_privacy_tools.py": "active-runtime/app/v2r1c6_privacy_tools.py",
+        }
+        for destination, source in source_paths.items():
+            target = root / destination
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_bytes(_payload_file(git_dir, binding.target_oid, source))
+        generated: dict[str, str] = {
+            "VERSION": VERSION + "\n",
+            "active-runtime/app/v2r2c1_health_service.py": (
+                "from v2r1c6_privacy_tools import main\n\n"
+                "if __name__ == '__main__':\n    raise SystemExit(main())\n"
+            ),
+            "deploy/aios-v2/systemd/aios-v2r1c7-production.service": (
+                "[Unit]\nDescription=AIOS V2R2C1 governed health contract service\n"
+                "After=network.target\n\n[Service]\nType=simple\n"
+                "User=aios-v2r1c7\nGroup=aios-v2r1c7\n"
+                "WorkingDirectory=/opt/aios/v2r2c1\n"
+                "EnvironmentFile=/etc/aios/aios-v2r2c1.env\n"
+                "ExecStart=/usr/bin/python3 /opt/aios/v2r2c1/active-runtime/app/v2r2c1_health_service.py --serve --host 127.0.0.1 --port ${AIOS_V2R1C7_PORT}\n"
+                "Restart=on-failure\nRestartSec=5\nNoNewPrivileges=true\nPrivateTmp=true\n"
+                "ProtectHome=true\nProtectSystem=strict\nProtectKernelLogs=true\n"
+                "ProtectKernelModules=true\nProtectKernelTunables=true\nProtectControlGroups=true\n"
+                "RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6\nIPAddressDeny=any\n"
+                "IPAddressAllow=localhost\nUMask=0077\n\n[Install]\nWantedBy=multi-user.target\n"
+            ),
+            "deploy/aios-v2/v2r2c1-runtime-config.json": json.dumps({
+                "schema": "aios.v2r2c1.production-runtime.v1",
+                "version": VERSION,
+                "target_oid": binding.target_oid,
+                "service": SERVICE,
+                "port": PORT,
+                "health_path": "/health",
+                "deployment_state_source": "environment_and_state_file",
+            }, sort_keys=True, separators=(",", ":")) + "\n",
+            "deploy/aios-v2/v2r2c1-rollback.json": json.dumps({
+                "schema": "aios.v2r2c1.rollback-metadata.v1",
+                "rollback_version": "V2R1C7",
+                "rollback_service": SERVICE,
+                "rollback_target_is_previous_production": True,
+                "automatic_rollback": False,
+            }, sort_keys=True, separators=(",", ":")) + "\n",
+            "scripts/probe_v2r2c1_health.py": (
+                "import json,sys,urllib.request\n"
+                "url=sys.argv[1] if len(sys.argv)>1 else 'http://127.0.0.1:18927/health'\n"
+                "with urllib.request.urlopen(url, timeout=5) as r: print(json.dumps(json.load(r), sort_keys=True))\n"
+            ),
+            "scripts/rollback_v2r2c1_release.sh": "#!/bin/sh\nset -eu\nprintf '%s\\n' 'rollback requires governed owner-approved executor'\nexit 2\n",
+            "release-manifests/V2R2C1.json": json.dumps({
+                "schema": "aios.release-source.v2",
+                "version": VERSION,
+                "repository": REPOSITORY,
+                "target_oid": binding.target_oid,
+                "evidence_closure_oid": binding.evidence_closure_oid,
+                "production_deployed": False,
+                "deployment_state": "STAGING",
+                "artifact_kind": "executable-production-health",
+            }, sort_keys=True, separators=(",", ":")) + "\n",
+        }
+        for rel, text in generated.items():
+            target = root / rel
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_text(text, encoding="utf-8")
+            if rel.startswith("scripts/"):
+                target.chmod(0o755)
+        metadata = {
+            "schema": "aios.release-artifact-build.v3",
+            "version": VERSION,
+            "repository": REPOSITORY,
+            "source_head_oid": binding.target_oid,
+            "evidence_closure_oid": binding.evidence_closure_oid,
+            "source_date_epoch": epoch,
+            "clean_source": True,
+            "executable_payload": True,
+            "production_deployed": False,
+            "tag_created": False,
+            "baseline_changed": False,
+            "secrets_included": False,
+        }
+        (root / "BUILD-METADATA.json").write_bytes(canonical(metadata))
+        (root / "ROLLBACK-METADATA.json").write_bytes(canonical(json.loads((root / "deploy/aios-v2/v2r2c1-rollback.json").read_text(encoding="utf-8"))))
+        names = sorted("payload/" + str(path.relative_to(root)).replace(os.sep, "/") for path in root.rglob("*") if path.is_file())
+        (root / "ARTIFACT-MANIFEST.json").write_bytes(canonical({
+            "schema": "aios.release-artifact-manifest.v3",
+            "version": VERSION,
+            "source_head_oid": binding.target_oid,
+            "evidence_closure_oid": binding.evidence_closure_oid,
+            "repository": REPOSITORY,
+            "files": names + ["payload/ARTIFACT-MANIFEST.json"],
+            "deployable": True,
+            "executable_payload": True,
+            "production_deployed": False,
+            "tag_created": False,
+            "baseline_changed": False,
+        }))
+        tar_path = Path(temp) / "release.tar"
+        with tarfile.open(tar_path, "w") as archive:
+            for path in sorted(root.rglob("*")):
+                relative = str(path.relative_to(root)).replace(os.sep, "/")
+                info = archive.gettarinfo(str(path), arcname="payload/" + relative)
+                info.uid = info.gid = 0
+                info.uname = "root"
+                info.gname = "root"
+                info.mtime = epoch
+                info.mode = 0o755 if path.is_dir() or path.suffix == ".sh" else 0o644
+                if path.is_file():
+                    with path.open("rb") as stream:
+                        archive.addfile(info, stream)
+                else:
+                    archive.addfile(info)
+        subprocess.run(["zstd", "-T1", "-19", "--no-progress", "-q", "-f", str(tar_path), "-o", str(output)], check=True, timeout=120)
+    digest = sha256_file(output)
+    receipt = {
+        "schema": "aios.release-artifact-receipt.v3",
+        "version": VERSION,
+        "repository": REPOSITORY,
+        "source_head_oid": binding.target_oid,
+        "evidence_closure_oid": binding.evidence_closure_oid,
+        "artifact": str(output),
+        "artifact_sha256": digest,
+        "artifact_size": output.stat().st_size,
+        "deployable": True,
+        "executable_payload": True,
+        "production_deployed": False,
+        "tag_created": False,
+        "baseline_changed": False,
+    }
+    atomic_json(output.with_suffix(output.suffix + ".receipt.json"), receipt, mode=0o640)
+    return receipt
+
+
+class GovernedProductionReleaseExecutor:
+    def __init__(self, config: Any):
+        self.config = config
+        self.binding = ReleaseBinding()
+        self.binding.validate()
+        self.root = Path(config.state_root) / "v2r2c1-governed-production-release"
+        self.state = ReleaseState(self.root, self.binding)
+        workspace = self.root / "publication-workspace"
+        workspace.mkdir(parents=True, exist_ok=True)
+        self.publisher = TagPublisher(
+            workspace,
+            GitTagBackend(workspace, authoritative_repo=Path(config.authoritative_git_dir)),
+            GiteaTagClient(config.api_base, REPOSITORY, Path(config.token_path)),
+            config.remote_name,
+            state_root=self.root / "tag-publication",
+        )
+
+    def _request(self, request: Mapping[str, Any]) -> PublicationRequest:
+        binding = self.binding
+        for key, expected in binding.as_dict().items():
+            if key in request and request[key] != expected:
+                raise ManualOwnerReviewRequired("release request binding mismatch:" + key)
+        return PublicationRequest(binding.version, binding.target_oid, binding.evidence_closure_oid, binding.approval_plan_id)
+
+    def approval_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        if request.get("execute") is not False:
+            raise ReleaseBlocked("TAG_APPROVAL_REQUEST_MUST_BE_DRY_RUN")
+        owner = verify_owner_approval(request, self.binding)
+        with StateLock(self.root / "release.lock"):
+            current = self.state.value.get("approval")
+            approval_digest = hashlib.sha256(canonical(owner)).hexdigest()
+            record = {
+                "schema": "aios.v2r2c1.tag-approval-request.v1",
+                "binding": self.binding.as_dict(),
+                "owner_approval": owner,
+                "owner_approval_digest_sha256": approval_digest,
+                "execute": False,
+                "recorded_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+            }
+            if current and current != record:
+                raise ManualOwnerReviewRequired("persisted Owner approval differs")
+            self.state.value["approval"] = record
+            self.state.record("APPROVAL_REQUEST_RECORDED", "tag_approval_request", record)
+            return {"status": "RECORDED", "execute": False, "binding": self.binding.as_dict(), "owner_approval_digest_sha256": approval_digest}
+
+    def _require_approval(self) -> None:
+        approval = self.state.value.get("approval")
+        if not isinstance(approval, Mapping) or approval.get("binding") != self.binding.as_dict():
+            raise ReleaseBlocked("OWNER_APPROVAL_REQUEST_NOT_RECORDED")
+
+    def publish_tag(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        if request.get("execute") is not True:
+            raise ReleaseBlocked("TAG_PUBLICATION_REQUIRES_EXECUTE_TRUE")
+        self._require_approval()
+        publication = self._request(request)
+        with StateLock(self.root / "release.lock"):
+            try:
+                verified = self.publisher._verify_publication(publication, allow_push=True, previously_deployed=False)
+            except PublicationManualOwnerReviewRequired as exc:
+                self.state.fail("MANUAL_OWNER_REVIEW_REQUIRED", str(exc))
+                raise ManualOwnerReviewRequired(str(exc)) from exc
+            except PublicationPending as exc:
+                self.state.fail("REMOTE_PUSH_PENDING", str(exc))
+                raise ReconciliationRequired(str(exc)) from exc
+            except PublicationReconciliationRequired as exc:
+                self.state.fail("RECONCILIATION_REQUIRED", str(exc))
+                raise ReconciliationRequired(str(exc)) from exc
+            result = dict(verified)
+            self.state.record("TAG_VERIFIED", "tag", result)
+            return {"status": "REMOTE_VERIFIED", **result}
+
+    def tag_status(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        self._request(request)
+        return self.publisher.get_tag_publication_status(VERSION)
+
+    def build_artifact(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        self._require_approval()
+        self._request(request)
+        receipt = build_production_artifact(Path(self.config.authoritative_git_dir), self.binding, self.root / "artifacts")
+        self.state.record("ARTIFACT_VERIFIED", "production_artifact", receipt)
+        return {"status": "VERIFIED", **receipt}
+
+    def execute_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        self._require_approval()
+        publication = self._request(request)
+        tag_state = self.state.value.get("completed", {}).get("tag")
+        if not isinstance(tag_state, Mapping) or tag_state.get("state") not in {"GITEA_API_CONFIRMED", "REMOTE_VERIFIED"}:
+            raise ReleaseBlocked("REMOTE_TAG_PROOF_REQUIRED")
+        artifact = self.state.value.get("completed", {}).get("production_artifact")
+        if not isinstance(artifact, Mapping):
+            artifact = self.build_artifact(request)
+        value = {
+            **self.binding.as_dict(),
+            "tag_oid": tag_state.get("tag_oid") or tag_state.get("gitea_tag_oid"),
+            "artifact_path": artifact["artifact"],
+            "artifact_size": int(artifact["artifact_size"]),
+            "artifact_sha256": artifact["artifact_sha256"],
+        }
+        # The production adapter is privileged and is run through the root
+        # approved-release service boundary by the caller.  This handler is
+        # still useful for a root-owned staging invocation and remains
+        # fail-closed when the adapter is not available.
+        import v2r2c1_production_adapter
+        runtime = v2r2c1_production_adapter.execute_request({"schema": "aios.production-executor-request.v1", "operation": "apply", **value})
+        if runtime.get("status") != "ACTIVE_VERIFIED":
+            self.state.fail("RECONCILIATION_REQUIRED", "production health did not verify")
+            raise ReconciliationRequired("production health did not verify")
+        self.state.record("PRODUCTION_VERIFIED", "production", runtime)
+        return {"status": "PRODUCTION_VERIFIED", "runtime": runtime, "artifact": artifact, "tag_oid": value["tag_oid"]}
+
+    def consistency(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        publication = self._request(request)
+        result = self.publisher.get_release_consistency(publication)
+        result["release_binding"] = self.binding.as_dict()
+        result["production_health"] = _health(self.config.health_url, self.binding, self.state.value.get("completed", {}).get("production_artifact", {}))
+        result["registry"] = _read_json(Path(self.config.registry_root) / f"{VERSION}.json")
+        result["baseline"] = _read_json(Path(self.config.baseline_path))
+        return result
+
+    def acceptance(self, request: Mapping[str, Any]) -> dict[str, Any]:
+        result = self.consistency(request)
+        result["accepted"] = result.get("status") == "PASS" and result.get("production_health", {}).get("status") == "ACTIVE_VERIFIED"
+        self.state.record("ACCEPTED" if result["accepted"] else "RECONCILIATION_REQUIRED", "acceptance", result)
+        return result
+
+
+def _read_json(path: Path) -> dict[str, Any]:
+    try:
+        value = json.loads(path.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        return {"status": "MISSING", "path": str(path)}
+    if not isinstance(value, dict):
+        return {"status": "INVALID", "path": str(path)}
+    return {"status": "PRESENT", "path": str(path), **value}
+
+
+def _health(url: str, binding: ReleaseBinding, artifact: Mapping[str, Any]) -> dict[str, Any]:
+    import urllib.request
+    try:
+        with urllib.request.urlopen(url, timeout=5) as response:
+            body = json.loads(response.read().decode("utf-8"))
+            status = response.status
+    except Exception as exc:
+        return {"status": "UNAVAILABLE", "error": type(exc).__name__}
+    expected_artifact = artifact.get("artifact_sha256")
+    exact = (
+        status == 200
+        and body.get("version") == binding.version
+        and body.get("commit_oid") == binding.target_oid
+        and (not expected_artifact or body.get("artifact_sha256") == expected_artifact)
+        and body.get("deployment_state") == "ACTIVE"
+        and body.get("production_deployed") is True
+    )
+    return {"status": "ACTIVE_VERIFIED" if exact else "CONFLICT", "http_status": status, **body}
+
+
+def build_executor_config(config: Any) -> GovernedProductionReleaseExecutor:
+    return GovernedProductionReleaseExecutor(config)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("operation", choices=("build-artifact", "status"))
+    parser.add_argument("--git-dir", type=Path, default=Path("/data/aios-gitops/repo.git"))
+    parser.add_argument("--output-root", type=Path, default=Path("/var/lib/aios-gitops/approved-artifacts/V2R2C1"))
+    args = parser.parse_args()
+    binding = ReleaseBinding()
+    if args.operation == "build-artifact":
+        print(json.dumps(build_production_artifact(args.git_dir, binding, args.output_root), sort_keys=True))
+    else:
+        print(json.dumps({"binding": binding.as_dict(), "status": "READY"}, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

active-runtime/app/message_handoff.py

@@ -0,0 +1,456 @@
+from __future__ import annotations
+
+import dataclasses
+import datetime as dt
+import hashlib
+import json
+import sqlite3
+import re
+from pathlib import Path
+from typing import Any, Iterable, Mapping
+
+UTC = dt.timezone.utc
+_ALLOWED_CONFIDENTIALITY = frozenset({"public", "tenant", "project", "private", "run"})
+_PRIVILEGED = frozenset({"*", "admin", "system.admin", "message.admin", "task.admin"})
+
+
+class HandoffError(RuntimeError):
+    code = "HANDOFF_ERROR"
+
+
+class MessageScopeMismatch(HandoffError):
+    code = "MESSAGE_SCOPE_MISMATCH_DENY"
+
+
+class ConfidentialityScopeDenied(HandoffError):
+    code = "MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"
+
+
+class MessageExpired(HandoffError):
+    code = "MESSAGE_EXPIRED"
+
+
+class SequenceGap(HandoffError):
+    code = "MESSAGE_SEQUENCE_GAP_DETECT"
+
+
+class SequenceConflict(HandoffError):
+    code = "MESSAGE_SEQUENCE_CONFLICT"
+
+
+class IdempotencyConflict(HandoffError):
+    code = "MESSAGE_IDEMPOTENCY_CONFLICT"
+
+
+def _utcnow() -> dt.datetime:
+    return dt.datetime.now(UTC)
+
+
+def _iso(value: dt.datetime | str | None) -> str | None:
+    if value is None:
+        return None
+    parsed = dt.datetime.fromisoformat(value.replace("Z", "+00:00")) if isinstance(value, str) else value
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=UTC)
+    return parsed.astimezone(UTC).isoformat()
+
+
+def _canonical(value: Any) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str)
+
+
+def _sha(value: Any) -> str:
+    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
+
+
+def _clean(value: Any) -> str | None:
+    if value is None:
+        return None
+    text = str(value).strip()
+    return text or None
+
+
+def _tuple_scope(value: Iterable[str] | str | None) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if isinstance(value, str):
+        value = value.split(",")
+    return tuple(sorted({str(item).strip() for item in value if str(item).strip()}))
+
+
+_SECRET_KEY = re.compile(r"(?i)(?:token|secret|password|private[_-]?key|api[_-]?key)")
+_SECRET_VALUE = re.compile(r"(?i)bearer\s+[A-Za-z0-9._~+/-]{8,}|(?:token|secret|password|api[_-]?key)\s*[:=]\s*\S+")
+_SAFE_REFERENCE = re.compile(r"^(?:systemd-credential|vault|secret-manager):[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$")
+
+
+def assert_payload_secret_safe(value: Any, *, key: str = "") -> None:
+    if isinstance(value, Mapping):
+        for child_key, child in value.items():
+            assert_payload_secret_safe(child, key=str(child_key))
+        return
+    if isinstance(value, (list, tuple)):
+        for child in value:
+            assert_payload_secret_safe(child, key=key)
+        return
+    if isinstance(value, (bytes, bytearray)):
+        raise ValueError("CREDENTIAL_SECRET_EXPOSURE_DENY")
+    if isinstance(value, str):
+        if _SECRET_VALUE.search(value):
+            raise ValueError("CREDENTIAL_SECRET_EXPOSURE_DENY")
+        if _SECRET_KEY.search(key) and value and _SAFE_REFERENCE.fullmatch(value) is None:
+            raise ValueError("CREDENTIAL_SECRET_EXPOSURE_DENY")
+
+
+@dataclasses.dataclass(frozen=True)
+class DeliveryContext:
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
+    capabilities: tuple[str, ...] = ()
+
+    @classmethod
+    def from_actor(cls, actor: Any) -> "DeliveryContext":
+        def get(name: str) -> Any:
+            if isinstance(actor, Mapping):
+                return actor.get(name)
+            return getattr(actor, name, None)
+        return cls(
+            tenant_id=_clean(get("tenant_id")),
+            user_id=_clean(get("user_id")),
+            project_id=_clean(get("project_id")),
+            conversation_id=_clean(get("conversation_id")),
+            run_id=_clean(get("run_id")),
+            capabilities=_tuple_scope(get("capabilities") or get("capability_scope")),
+        )
+
+    @property
+    def privileged(self) -> bool:
+        return bool(set(self.capabilities) & _PRIVILEGED)
+
+
+@dataclasses.dataclass(frozen=True)
+class MessageEnvelope:
+    source: str
+    target: str
+    message_type: str
+    payload: Mapping[str, Any]
+    sequence: int
+    idempotency_key: str
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    task_id: str | None = None
+    run_id: str | None = None
+    correlation_id: str | None = None
+    causation_id: str | None = None
+    capability_scope: tuple[str, ...] = ()
+    confidentiality_scope: str = "private"
+    expires_at: str | None = None
+    created_at: str = dataclasses.field(default_factory=lambda: _iso(_utcnow()) or "")
+    envelope_id: str = ""
+
+    def __post_init__(self) -> None:
+        assert_payload_secret_safe(self.payload)
+        for field in ("source", "target", "message_type", "idempotency_key", "tenant_id", "user_id",
+                      "project_id", "conversation_id", "task_id", "run_id", "correlation_id", "causation_id"):
+            object.__setattr__(self, field, _clean(getattr(self, field)) if field not in {
+                "source", "target", "message_type", "idempotency_key"
+            } else (_clean(getattr(self, field)) or ""))
+        object.__setattr__(self, "capability_scope", _tuple_scope(self.capability_scope))
+        object.__setattr__(self, "confidentiality_scope", (_clean(self.confidentiality_scope) or "private").lower())
+        object.__setattr__(self, "expires_at", _iso(self.expires_at))
+        object.__setattr__(self, "created_at", _iso(self.created_at) or "")
+        if not self.source or not self.target or not self.message_type or not self.idempotency_key:
+            raise ValueError("MESSAGE_ENVELOPE_IDENTITY_REQUIRED")
+        if not isinstance(self.sequence, int) or self.sequence < 1:
+            raise ValueError("MESSAGE_SEQUENCE_MUST_BE_POSITIVE")
+        if self.confidentiality_scope not in _ALLOWED_CONFIDENTIALITY:
+            raise ValueError("MESSAGE_CONFIDENTIALITY_SCOPE_INVALID")
+        if self.confidentiality_scope != "public" and self.tenant_id is None:
+            raise ValueError("MESSAGE_TENANT_REQUIRED")
+        if self.confidentiality_scope in {"project", "private", "run"} and self.project_id is None:
+            raise ValueError("MESSAGE_PROJECT_REQUIRED")
+        if self.confidentiality_scope in {"private", "run"} and self.user_id is None:
+            raise ValueError("MESSAGE_USER_REQUIRED")
+        if self.confidentiality_scope == "run" and self.run_id is None:
+            raise ValueError("MESSAGE_RUN_REQUIRED")
+        expected = stable_event_id(
+            source=self.source, target=self.target, message_type=self.message_type, payload=self.payload,
+            tenant_id=self.tenant_id, user_id=self.user_id, project_id=self.project_id,
+            conversation_id=self.conversation_id, task_id=self.task_id, run_id=self.run_id,
+            correlation_id=self.correlation_id, causation_id=self.causation_id,
+            sequence=self.sequence, idempotency_key=self.idempotency_key,
+        )
+        if self.envelope_id and self.envelope_id != expected:
+            raise ValueError("MESSAGE_ENVELOPE_ID_MISMATCH")
+        object.__setattr__(self, "envelope_id", expected)
+
+    @property
+    def payload_sha256(self) -> str:
+        return _sha(self.payload)
+
+    @property
+    def stream_key(self) -> str:
+        return _sha({
+            "tenant_id": self.tenant_id, "source": self.source, "target": self.target,
+            "conversation_id": self.conversation_id, "task_id": self.task_id, "run_id": self.run_id,
+        })
+
+    def is_expired(self, *, now: dt.datetime | None = None) -> bool:
+        if self.expires_at is None:
+            return False
+        return dt.datetime.fromisoformat(self.expires_at) <= (now or _utcnow()).astimezone(UTC)
+
+    def as_record(self) -> dict[str, Any]:
+        return {
+            "envelope_id": self.envelope_id, "stream_key": self.stream_key, "source": self.source,
+            "target": self.target, "message_type": self.message_type, "payload_json": _canonical(self.payload),
+            "payload_sha256": self.payload_sha256, "tenant_id": self.tenant_id, "user_id": self.user_id,
+            "project_id": self.project_id, "conversation_id": self.conversation_id, "task_id": self.task_id,
+            "run_id": self.run_id, "correlation_id": self.correlation_id,
+            "causation_id": self.causation_id, "sequence": self.sequence,
+            "capability_scope_json": _canonical(self.capability_scope),
+            "confidentiality_scope": self.confidentiality_scope, "idempotency_key": self.idempotency_key,
+            "expires_at": self.expires_at, "created_at": self.created_at,
+        }
+
+
+def stable_event_id(*, source: Any, target: Any, message_type: Any, payload: Any,
+                    tenant_id: Any = None, user_id: Any = None, project_id: Any = None,
+                    conversation_id: Any = None, task_id: Any = None, run_id: Any = None,
+                    correlation_id: Any = None, causation_id: Any = None,
+                    sequence: Any = None, idempotency_key: Any = None) -> str:
+    assert_payload_secret_safe(payload)
+    material = {
+        "source": _clean(source), "target": _clean(target), "message_type": _clean(message_type),
+        "payload_sha256": _sha(payload), "tenant_id": _clean(tenant_id), "user_id": _clean(user_id),
+        "project_id": _clean(project_id), "conversation_id": _clean(conversation_id),
+        "task_id": _clean(task_id), "run_id": _clean(run_id), "causation_id": _clean(causation_id),
+        "sequence": sequence, "idempotency_key": _clean(idempotency_key),
+    }
+    # Preserve historical envelope IDs for legacy rows that predate correlation_id.
+    if _clean(correlation_id) is not None:
+        material["correlation_id"] = _clean(correlation_id)
+    return _sha(material)
+
+
+def bind_envelope_scope(envelope: MessageEnvelope, actor: Any) -> MessageEnvelope:
+    ctx = DeliveryContext.from_actor(actor)
+    if ctx.privileged:
+        return envelope
+    if ctx.tenant_id is None:
+        if envelope.tenant_id is not None:
+            raise MessageScopeMismatch(MessageScopeMismatch.code)
+        return envelope
+    updates: dict[str, Any] = {}
+    for field in ("tenant_id", "user_id", "project_id", "conversation_id", "run_id"):
+        trusted = getattr(ctx, field)
+        requested = getattr(envelope, field)
+        if requested is not None and requested != trusted:
+            raise MessageScopeMismatch(f"{MessageScopeMismatch.code}:{field}")
+        if requested is None and trusted is not None:
+            updates[field] = trusted
+    if not updates:
+        return envelope
+    data = dataclasses.asdict(envelope)
+    data.update(updates)
+    data["envelope_id"] = ""
+    return MessageEnvelope(**data)
+
+
+def authorize_delivery(actor: Any, envelope: MessageEnvelope) -> None:
+    ctx = DeliveryContext.from_actor(actor)
+    if ctx.privileged:
+        return
+    if not set(envelope.capability_scope).issubset(set(ctx.capabilities)):
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:capability")
+    if envelope.confidentiality_scope == "public":
+        return
+    if ctx.tenant_id != envelope.tenant_id:
+        raise MessageScopeMismatch(f"{MessageScopeMismatch.code}:tenant_id")
+    if envelope.confidentiality_scope in {"project", "private", "run"} and ctx.project_id != envelope.project_id:
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:project_id")
+    if envelope.confidentiality_scope in {"private", "run"} and ctx.user_id != envelope.user_id:
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:user_id")
+    if envelope.confidentiality_scope == "run" and ctx.run_id != envelope.run_id:
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:run_id")
+
+
+_SCHEMA = """
+CREATE TABLE IF NOT EXISTS message_handoff (
+  envelope_id TEXT PRIMARY KEY,
+  stream_key TEXT NOT NULL,
+  source TEXT NOT NULL,
+  target TEXT NOT NULL,
+  message_type TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  payload_sha256 TEXT NOT NULL,
+  tenant_id TEXT,
+  user_id TEXT,
+  project_id TEXT,
+  conversation_id TEXT,
+  task_id TEXT,
+  run_id TEXT,
+  correlation_id TEXT,
+  causation_id TEXT,
+  sequence INTEGER NOT NULL CHECK(sequence >= 1),
+  capability_scope_json TEXT NOT NULL,
+  confidentiality_scope TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  expires_at TEXT,
+  created_at TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'PENDING',
+  delivered_at TEXT,
+  acked_at TEXT,
+  UNIQUE(stream_key, idempotency_key),
+  UNIQUE(stream_key, sequence)
+);
+CREATE INDEX IF NOT EXISTS idx_message_handoff_target_status
+  ON message_handoff(target, status, created_at);
+CREATE INDEX IF NOT EXISTS idx_message_handoff_scope
+  ON message_handoff(tenant_id, project_id, user_id, conversation_id, run_id);
+"""
+
+
+class DurableHandoffStore:
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        with self._connect() as conn:
+            conn.executescript(_SCHEMA)
+            columns = {str(row[1]) for row in conn.execute("PRAGMA table_info(message_handoff)")}
+            if "correlation_id" not in columns:
+                conn.execute("ALTER TABLE message_handoff ADD COLUMN correlation_id TEXT")
+            conn.execute(
+                "CREATE INDEX IF NOT EXISTS idx_message_handoff_lineage "
+                "ON message_handoff(correlation_id, causation_id)"
+            )
+
+    def _connect(self) -> sqlite3.Connection:
+        conn = sqlite3.connect(self.path, timeout=30.0)
+        conn.row_factory = sqlite3.Row
+        conn.execute("PRAGMA foreign_keys=ON")
+        conn.execute("PRAGMA busy_timeout=30000")
+        return conn
+
+    @staticmethod
+    def _from_row(row: sqlite3.Row) -> MessageEnvelope:
+        return MessageEnvelope(
+            source=row["source"], target=row["target"], message_type=row["message_type"],
+            payload=json.loads(row["payload_json"]), tenant_id=row["tenant_id"], user_id=row["user_id"],
+            project_id=row["project_id"], conversation_id=row["conversation_id"], task_id=row["task_id"],
+            run_id=row["run_id"], correlation_id=row["correlation_id"],
+            causation_id=row["causation_id"], sequence=int(row["sequence"]),
+            capability_scope=tuple(json.loads(row["capability_scope_json"])),
+            confidentiality_scope=row["confidentiality_scope"], idempotency_key=row["idempotency_key"],
+            expires_at=row["expires_at"], created_at=row["created_at"], envelope_id=row["envelope_id"],
+        )
+
+    def put(self, envelope: MessageEnvelope) -> tuple[str, MessageEnvelope]:
+        if envelope.is_expired():
+            raise MessageExpired(MessageExpired.code)
+        record = envelope.as_record()
+        with self._connect() as conn:
+            conn.execute("BEGIN IMMEDIATE")
+            replay = conn.execute(
+                "SELECT * FROM message_handoff WHERE stream_key=? AND idempotency_key=?",
+                (envelope.stream_key, envelope.idempotency_key),
+            ).fetchone()
+            if replay is not None:
+                existing = self._from_row(replay)
+                if existing.envelope_id != envelope.envelope_id or existing.payload_sha256 != envelope.payload_sha256:
+                    raise IdempotencyConflict(IdempotencyConflict.code)
+                conn.commit()
+                return "REPLAY", existing
+            seq = conn.execute(
+                "SELECT * FROM message_handoff WHERE stream_key=? AND sequence=?",
+                (envelope.stream_key, envelope.sequence),
+            ).fetchone()
+            if seq is not None:
+                existing = self._from_row(seq)
+                if existing.envelope_id == envelope.envelope_id:
+                    conn.commit()
+                    return "REPLAY", existing
+                raise SequenceConflict(SequenceConflict.code)
+            maximum = int(conn.execute(
+                "SELECT COALESCE(MAX(sequence),0) FROM message_handoff WHERE stream_key=?",
+                (envelope.stream_key,),
+            ).fetchone()[0])
+            expected = maximum + 1
+            if envelope.sequence != expected:
+                raise SequenceGap(f"{SequenceGap.code}:expected={expected}:actual={envelope.sequence}")
+            columns = tuple(record)
+            placeholders = ",".join("?" for _ in columns)
+            conn.execute(
+                f"INSERT INTO message_handoff ({','.join(columns)}) VALUES ({placeholders})",
+                tuple(record[column] for column in columns),
+            )
+            conn.commit()
+            return "CREATED", envelope
+
+    def get(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
+        with self._connect() as conn:
+            row = conn.execute("SELECT * FROM message_handoff WHERE envelope_id=?", (envelope_id,)).fetchone()
+            if row is None:
+                raise KeyError(envelope_id)
+            envelope = self._from_row(row)
+            if envelope.is_expired():
+                conn.execute("UPDATE message_handoff SET status='EXPIRED' WHERE envelope_id=?", (envelope_id,))
+                conn.commit()
+                raise MessageExpired(MessageExpired.code)
+            authorize_delivery(actor, envelope)
+            return envelope
+
+    def pending(self, *, target: str, actor: Any, limit: int = 100) -> list[MessageEnvelope]:
+        if not 1 <= limit <= 1000:
+            raise ValueError("MESSAGE_PENDING_LIMIT_INVALID")
+        visible: list[MessageEnvelope] = []
+        with self._connect() as conn:
+            rows = conn.execute(
+                "SELECT * FROM message_handoff WHERE target=? AND status='PENDING' ORDER BY created_at, sequence LIMIT ?",
+                (target, limit),
+            ).fetchall()
+            for row in rows:
+                envelope = self._from_row(row)
+                if envelope.is_expired():
+                    conn.execute("UPDATE message_handoff SET status='EXPIRED' WHERE envelope_id=?", (envelope.envelope_id,))
+                    continue
+                try:
+                    authorize_delivery(actor, envelope)
+                except HandoffError:
+                    continue
+                visible.append(envelope)
+            conn.commit()
+        return visible
+
+    def mark_delivered(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
+        envelope = self.get(envelope_id, actor=actor)
+        with self._connect() as conn:
+            conn.execute(
+                "UPDATE message_handoff SET status='DELIVERED', delivered_at=? "
+                "WHERE envelope_id=? AND status='PENDING'",
+                (_iso(_utcnow()), envelope_id),
+            )
+            conn.commit()
+        return envelope
+
+    def acknowledge(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
+        envelope = self.get(envelope_id, actor=actor)
+        with self._connect() as conn:
+            conn.execute(
+                "UPDATE message_handoff SET status='ACKED', acked_at=? WHERE envelope_id=?",
+                (_iso(_utcnow()), envelope_id),
+            )
+            conn.commit()
+        return envelope
+
+
+class HandoffFabric:
+    def __init__(self, store: DurableHandoffStore) -> None:
+        self.store = store
+
+    def publish(self, envelope: MessageEnvelope, *, actor: Any | None = None) -> tuple[str, MessageEnvelope]:
+        return self.store.put(bind_envelope_scope(envelope, actor) if actor is not None else envelope)

active-runtime/app/message_handoff_adapters.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+from message_handoff import MessageEnvelope
+
+
+def _get(value: Any, *names: str, default: Any = None) -> Any:
+    for name in names:
+        if isinstance(value, Mapping) and name in value:
+            return value[name]
+        if hasattr(value, name):
+            return getattr(value, name)
+    return default
+
+
+def agent_event_to_envelope(event: Any, *, target: str | None = None, sequence: int = 1,
+                            idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
+    payload = _get(event, "payload", "data", default={}) or {}
+    target = target or _get(event, "target", "recipient")
+    if not target:
+        raise ValueError("MESSAGE_TARGET_REQUIRED")
+    return MessageEnvelope(
+        source=str(_get(event, "source", "producer", "agent_id", default="agent-event")),
+        target=str(target),
+        message_type=str(_get(event, "event_type", "type", "message_type", default="agent.event")),
+        payload=dict(payload),
+        sequence=sequence,
+        idempotency_key=idempotency_key or str(_get(event, "id", "event_id", default="")) or f"agent-event:{sequence}",
+        causation_id=_get(event, "causation_id"),
+        **scope,
+    )
+
+
+def taskplane_event_to_envelope(event: Any, *, target: str, sequence: int = 1,
+                                idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
+    data = _get(event, "data", "payload", default={}) or {}
+    event_id = str(_get(event, "id", "event_id", default=""))
+    return MessageEnvelope(
+        source=str(_get(event, "source", default="task-plane")),
+        target=target,
+        message_type=str(_get(event, "type", "event_type", default="task.event")),
+        payload=dict(data),
+        sequence=sequence,
+        idempotency_key=idempotency_key or event_id or f"task-event:{sequence}",
+        causation_id=event_id or None,
+        **scope,
+    )
+
+
+def legacy_message_to_envelope(message: Any, *, target: str | None = None, sequence: int = 1,
+                               idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
+    payload = _get(message, "payload", "data", "body", "content", default={})
+    if not isinstance(payload, Mapping):
+        payload = {"value": payload}
+    target = target or _get(message, "target", "recipient", "receiver")
+    if not target:
+        raise ValueError("MESSAGE_TARGET_REQUIRED")
+    source = _get(message, "source", "sender", "agent_id", default="legacy-message-bus")
+    kind = _get(message, "message_type", "type", "kind", default="legacy.message")
+    identifier = _get(message, "id", "message_id", "event_id")
+    return MessageEnvelope(
+        source=str(source), target=str(target), message_type=str(kind), payload=dict(payload),
+        sequence=sequence,
+        idempotency_key=idempotency_key or (str(identifier) if identifier else f"legacy:{sequence}"),
+        causation_id=str(identifier) if identifier else None,
+        **scope,
+    )

active-runtime/app/search_agent_adapter.py

@@ -11,6 +11,7 @@ from dataclasses import asdict, dataclass, field
 from typing import Any
 
 from .search_gateway_orchestrator import SearchGatewayOrchestrator
+from .trace_tool_credential_governance import GovernanceActor, TraceContext
 
 
 @dataclass(frozen=True)
@@ -43,6 +44,9 @@ class SearchGatewayAgentAdapter:
         domain_profiles: list[str] | None = None,
         user_scope: str = "public",
         correlation_id: str | None = None,
+        *,
+        actor: GovernanceActor | dict[str, Any] | None = None,
+        trace: TraceContext | None = None,
     ) -> dict[str, Any]:
         payload = {
             "query": query,
@@ -59,7 +63,11 @@ class SearchGatewayAgentAdapter:
             "session_profile": context.session_profile,
             "correlation_id": correlation_id,
         }
-        return self.orchestrator.execute(payload)
+        if actor is None and trace is None:
+            # Preserve adapter compatibility; the governed orchestrator itself
+            # still fails closed when trusted context is absent.
+            return self.orchestrator.execute(payload)
+        return self.orchestrator.execute(payload, actor=actor, trace=trace)
 
 
 class OpenClawSearchClient(SearchGatewayAgentAdapter):

active-runtime/app/search_gateway.py

@@ -13,10 +13,18 @@ from __future__ import annotations
 
 from dataclasses import asdict, dataclass, field
 from datetime import datetime, timezone
+import hashlib
+import json
 from typing import Any, Protocol
 from uuid import uuid4
 
 from .search_profile_resolver import DomainQueryProfileRegistry, SearchProfile, SearchProfileResolver
+from .trace_tool_credential_governance import (
+    GovernanceActor,
+    GovernanceError,
+    GovernanceStore,
+    TraceContext,
+)
 
 
 def utc_now() -> str:
@@ -156,13 +164,25 @@ class SearchPolicyGuard:
 
 
 class SearchGateway:
-    def __init__(self, providers: list[SearchProvider] | None = None):
+    def __init__(self, providers: list[SearchProvider] | None = None, *, governance_store: GovernanceStore | None = None):
         self.providers = providers or []
+        self.governance_store = governance_store
         self.profile_resolver = SearchProfileResolver()
         self.planner = QueryPlanner()
         self.guard = SearchPolicyGuard()
 
-    def search(self, request: SearchRequest) -> SearchResponse:
+    def search(self, request: SearchRequest, *, actor: GovernanceActor | dict[str, Any] | None = None, trace: TraceContext | None = None) -> SearchResponse:
+        trusted_actor: GovernanceActor | None = None
+        if self.governance_store is not None:
+            if actor is None or trace is None:
+                raise GovernanceError("TOOL_MCP_AUTHZ_DENY")
+            trusted_actor = GovernanceActor.from_value(actor)
+            if request.requester != trusted_actor.identity:
+                raise GovernanceError("TOOL_MCP_AUTHZ_DENY", field="requester")
+            if request.correlation_id is not None and request.correlation_id not in {
+                trace.trace_id, trace.correlation_id
+            }:
+                raise GovernanceError("TOOL_SCOPE_PROPAGATION", field="correlation_id")
         request_id = request.correlation_id or f"search_{uuid4().hex[:12]}"
         profile = self.profile_resolver.resolve(request.group_profile, request.user_profile, request.session_profile)
         expanded_queries = self.planner.expand(request, profile)
@@ -184,14 +204,60 @@ class SearchGateway:
         attempts: list[SearchProviderAttempt] = []
         providers = self._ordered_providers(profile)
         for provider in providers:
+            if request.authorized_sources and provider.name not in request.authorized_sources:
+                attempts.append(SearchProviderAttempt(provider=provider.name, status="denied", reason="SOURCE_AUTHZ_DENY"))
+                continue
+            if request.user_scope != "public" and provider.name not in request.authorized_sources:
+                attempts.append(SearchProviderAttempt(provider=provider.name, status="denied", reason="SOURCE_AUTHZ_REQUIRED"))
+                continue
             try:
+                if self.governance_store is not None:
+                    assert trusted_actor is not None and trace is not None
+                    input_digest = hashlib.sha256(
+                        json.dumps(
+                            {"query": request.query, "intent": request.intent, "provider": provider.name},
+                            sort_keys=True, separators=(",", ":"), ensure_ascii=False,
+                        ).encode("utf-8")
+                    ).hexdigest()
+                    invocation_key = hashlib.sha256(
+                        f"{trace.trace_id}:{trace.span_id}:{provider.name}:{input_digest}".encode("utf-8")
+                    ).hexdigest()
+                    authorization = self.governance_store.authorize_tool(
+                        actor=trusted_actor,
+                        tool_name=f"search.{provider.name}",
+                        trace=trace,
+                        requested_scope=trace.scope,
+                        input_digest=input_digest,
+                        invocation_key=invocation_key,
+                    )
+                    if authorization.get("idempotent"):
+                        raise GovernanceError("TOOL_INVOCATION_REPLAY")
                 provider_evidence, attempt = provider.search(request, expanded_queries)
+                if self.governance_store is not None:
+                    result_digest = hashlib.sha256(
+                        json.dumps(
+                            {
+                                "evidence": [item.to_dict() for item in provider_evidence],
+                                "attempt": attempt.to_dict(),
+                            },
+                            sort_keys=True, separators=(",", ":"), ensure_ascii=False,
+                        ).encode("utf-8")
+                    ).hexdigest()
+                    self.governance_store.record_tool_receipt(
+                        invocation_key=invocation_key,
+                        result_digest=result_digest,
+                        actor=trusted_actor,
+                        trace=trace,
+                    )
                 evidence.extend(provider_evidence)
                 attempts.append(attempt)
                 if provider_evidence:
                     break
-            except Exception as exc:
-                attempts.append(SearchProviderAttempt(provider=getattr(provider, "name", "unknown"), status="failed", reason=str(exc)))
+            except GovernanceError:
+                raise
+            except Exception:
+                # Provider exceptions may contain URLs, tokens, or local paths.
+                attempts.append(SearchProviderAttempt(provider=getattr(provider, "name", "unknown"), status="failed", reason="PROVIDER_FAILURE"))
 
         if evidence:
             return SearchResponse(

active-runtime/app/search_gateway_api.py

@@ -7,27 +7,29 @@ try:
 except Exception:
     APIRouter = None
 
-from .search_gateway import SearchGateway, SearchRequest
+from .search_gateway import SearchRequest
+from .search_gateway_orchestrator import SearchGatewayOrchestrator
+from .trace_tool_credential_governance import GovernanceActor, TraceContext
 from .search_gateway_dashboard import SearchGatewayDashboard
 
 
-gateway = SearchGateway()
+orchestrator = SearchGatewayOrchestrator()
 dashboard = SearchGatewayDashboard()
 
 
-def search_gateway_request(payload: dict[str, Any]) -> dict[str, Any]:
-    request = SearchRequest(**payload)
-    return gateway.search(request).to_dict()
+def search_gateway_request(payload: dict[str, Any], *, actor: GovernanceActor | dict[str, Any] | None = None, trace: TraceContext | None = None) -> dict[str, Any]:
+    return orchestrator.execute(payload, actor=actor, trace=trace)
 
 
 def get_search_gateway_status() -> dict[str, Any]:
     return {
         "module": "search-gateway",
         "status": "ready",
-        "providers_configured": len(gateway.providers),
+        "providers_configured": len(orchestrator.gateway.providers),
         "policy_guard": "enabled",
         "profile_customization": "enabled",
         "fallback_required_when_provider_unavailable": True,
+        "governance": "required",
     }
 
 

active-runtime/app/search_gateway_orchestrator.py

@@ -3,24 +3,49 @@
 from __future__ import annotations
 
 from typing import Any
+import os
 
 from .search_audit_store import SearchAuditStore
 from .search_event_bridge import SearchEventBridge
 from .search_gateway import SearchGateway, SearchRequest
 from .search_provider_registry import SearchProviderRegistry
+from .trace_tool_credential_governance import (
+    GovernanceActor,
+    GovernanceScope,
+    GovernanceStore,
+    ToolDescriptor,
+    TraceContext,
+)
 
 
 class SearchGatewayOrchestrator:
-    def __init__(self):
+    def __init__(self, *, governance_store: GovernanceStore | None = None):
         self.registry = SearchProviderRegistry()
         self.audit = SearchAuditStore()
         self.events = SearchEventBridge()
-        self.gateway = SearchGateway(self.registry.ordered())
+        self.governance = governance_store or GovernanceStore(
+            os.environ.get("AIOS_SEARCH_GOVERNANCE_DB", "runtime/search-governance.sqlite3")
+        )
+        registrar = GovernanceActor(
+            "search-runtime-bootstrap", GovernanceScope("system"), ("system.admin",)
+        )
+        for provider in self.registry.ordered():
+            self.governance.register_tool(
+                ToolDescriptor(
+                    f"search.{provider.name}", "tool", GovernanceScope("global"), ("tool.search",)
+                ),
+                registrar,
+            )
+        self.gateway = SearchGateway(self.registry.ordered(), governance_store=self.governance)
 
-    def execute(self, payload: dict[str, Any]) -> dict[str, Any]:
+    def execute(self, payload: dict[str, Any], *, actor: GovernanceActor | dict[str, Any] | None = None, trace: TraceContext | None = None) -> dict[str, Any]:
+        if actor is None or trace is None:
+            from .trace_tool_credential_governance import GovernanceError
+            raise GovernanceError("TOOL_MCP_AUTHZ_DENY")
+        self.governance.record_trace(trace, actor)
         request = SearchRequest(**payload)
         self.events.search_started(request.to_dict())
-        response = self.gateway.search(request)
+        response = self.gateway.search(request, actor=actor, trace=trace)
         result = response.to_dict()
         for attempt in result.get("attempts", []):
             self.events.provider_attempted(result["request_id"], attempt)
@@ -35,6 +60,7 @@ class SearchGatewayOrchestrator:
             "registry": self.registry.status(),
             "audit": "enabled",
             "events": "enabled",
+            "governance": "required",
         }
 
 

active-runtime/app/task_plane/api.py

@@ -34,6 +34,7 @@ from .models import (
 )
 from .policy import PolicyEngine
 from .store import TaskPlaneStore
+from .scope import bind_task_scope
 from .worker_registry import WorkerRegistry
 
 
@@ -68,28 +69,54 @@ class TaskPlaneService:
         self.delegation = DelegationEngine(store)
         self.store.probe_attestation_verifier = self.policy.probe_attestation_verifier
 
-    def create_task(self, body: dict[str, Any], idempotency_key: str | None = None) -> dict[str, Any]:
+    def _authorized_task(self, task_id: str, actor: str, action: str) -> TaskRecord:
+        task = self.store.get_task(task_id, self.policy.actor_context(actor))
+        self.policy.assert_allowed(action, actor, task=task)
+        return task
+
+    def create_task(
+        self,
+        body: dict[str, Any],
+        idempotency_key: str | None = None,
+        *,
+        actor_identity: str | None = None,
+    ) -> dict[str, Any]:
         if body.get("parent_task_id"):
             raise ForbiddenError("child tasks must use the delegate endpoint")
         issuer = body.get("issuer", {})
-        actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
+        declared_actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
+        actor = actor_identity or declared_actor
         self.policy.assert_allowed("create", actor)
         try:
             plan = TaskPlan.from_dict(body)
         except (TypeError, ValueError) as exc:
             raise ValidationError("invalid task plan") from exc
+        if actor_identity is not None:
+            plan = bind_task_scope(
+                plan, self.policy.actor_context(actor_identity), public_create=True
+            )
         task = self.store.create_task_with_event(plan, idempotency_key=idempotency_key)
         return task.to_dict()
 
     def list_tasks(self, actor: str | None = None) -> list[dict[str, Any]]:
+        context = None
         if actor is not None:
             self.policy.assert_allowed("read", actor)
-        return [task.to_dict(include_task=False) for task in self.store.list_tasks()]
+            context = self.policy.actor_context(actor)
+        return [
+            task.to_dict(include_task=False)
+            for task in self.store.list_tasks(context)
+        ]
 
     def get_task(self, task_id: str, actor: str | None = None) -> dict[str, Any]:
+        context = None
         if actor is not None:
-            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
-        return self.store.get_task(task_id).to_dict()
+            self.policy.assert_allowed("read", actor)
+            context = self.policy.actor_context(actor)
+        task = self.store.get_task(task_id, context)
+        if actor is not None:
+            self.policy.assert_allowed("read", actor, task=task)
+        return task.to_dict()
 
     def get_worker(self, worker_id: str, actor: str | None = None) -> dict[str, Any]:
         if actor is not None:
@@ -163,9 +190,8 @@ class TaskPlaneService:
         if not worker_id:
             raise ValidationError("worker_id required")
 
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "claim")
         self.policy.assert_readonly_worker_binding(actor, str(worker_id))
-        self.policy.assert_allowed("claim", actor, task=task)
         lease_seconds = _bounded_int(
             body.get("lease_seconds", 30), "lease_seconds", 1, 3600
         )
@@ -184,10 +210,9 @@ class TaskPlaneService:
         if not claim_id:
             raise ValidationError("claim_id required")
         actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "heartbeat")
         claim = self.store.get_claim(claim_id)
         self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("heartbeat", actor, task=task)
         if claim.worker_identity != actor:
             raise ForbiddenError("claim identity mismatch")
         lease_seconds = _bounded_int(
@@ -206,10 +231,9 @@ class TaskPlaneService:
         message = body.get("message")
         if progress is None:
             raise ValidationError("progress required")
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "progress")
         claim = self.store.get_claim(claim_id)
         self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("progress", actor, task=task)
         if task.task_plan.data_classification == "credential-secret":
             if message not in {None, ""} or contains_secret_text(stage):
                 raise ValidationError(
@@ -234,7 +258,7 @@ class TaskPlaneService:
         if not claim_id:
             raise ValidationError("claim_id required")
         actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "result")
 
         status = body.get("status", "COMPLETED")
         outputs = body.get("outputs", [])
@@ -247,7 +271,6 @@ class TaskPlaneService:
             raise ValidationError("evidence items must be objects")
         claim = self.store.get_claim(claim_id)
         self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("result", actor, task=task)
         if claim.worker_identity != actor:
             raise ForbiddenError("claim identity mismatch")
         if task.task_plan.data_classification == "credential-secret":
@@ -326,8 +349,7 @@ class TaskPlaneService:
         reason = body.get("reason", "failed")
         actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
         self.policy.assert_allowed("fail", actor)
-        task = self.store.get_task(task_id)
-        self.policy.assert_allowed("fail", actor, task=task)
+        task = self._authorized_task(task_id, actor, "fail")
         claim = self.store.get_claim(claim_id)
         if claim.worker_identity != actor:
             raise ForbiddenError("claim identity mismatch")
@@ -339,8 +361,7 @@ class TaskPlaneService:
         actor = body.get("actor_identity") or body.get("worker_identity") or "owner"
         self.policy.assert_allowed("cancel", actor)
         reason = body.get("reason", "cancelled")
-        task = self.store.get_task(task_id)
-        self.policy.assert_allowed("cancel", actor, task=task)
+        task = self._authorized_task(task_id, actor, "cancel")
         updated = self.store.cancel_task_with_event(
             task_id, task.revision, reason=reason
         )
@@ -349,8 +370,7 @@ class TaskPlaneService:
     def delegate(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
         actor = body.get("actor_identity") or "owner"
         self.policy.assert_allowed("delegate", actor)
-        parent = self.store.get_task(task_id)
-        self.policy.assert_allowed("delegate", actor, task=parent)
+        parent = self._authorized_task(task_id, actor, "delegate")
         if "task" in body:
             try:
                 child_plan = TaskPlan.from_dict(body["task"])
@@ -364,25 +384,31 @@ class TaskPlaneService:
             except (TypeError, ValueError) as exc:
                 raise ValidationError("invalid child task plan") from exc
         child_plan.parent_task_id = task_id
+        child_plan = bind_task_scope(
+            child_plan, self.policy.actor_context(actor), public_create=False
+        )
         child = self.delegation.delegate(task_id, child_plan, caller=actor)
         return child.to_dict()
 
     def get_events(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
         if actor is not None:
-            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
-        self.store.get_task(task_id)
+            self._authorized_task(task_id, actor, "audit")
+        else:
+            self.store.get_task(task_id)
         return self.store.list_events(task_id)
 
     def get_evidence(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
         if actor is not None:
-            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
-        self.store.get_task(task_id)
+            self._authorized_task(task_id, actor, "audit")
+        else:
+            self.store.get_task(task_id)
         return self.evidence.list(task_id)
 
     def get_children(self, task_id: str, actor: str | None = None) -> list[str]:
         if actor is not None:
-            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
-        self.store.get_task(task_id)
+            self._authorized_task(task_id, actor, "read")
+        else:
+            self.store.get_task(task_id)
         return self.store.list_children(task_id)
 
 
@@ -506,7 +532,11 @@ class TaskPlaneRequestHandler(BaseHTTPRequestHandler):
                 ):
                     raise ForbiddenError("issuer identity mismatch")
                 body["issuer"] = {"type": "authenticated", "id": identity}
-                return 201, self.service.create_task(body or {}, headers.get("idempotency-key"))
+                return 201, self.service.create_task(
+                    body or {},
+                    headers.get("idempotency-key"),
+                    actor_identity=identity,
+                )
             if body.get("actor_identity") not in {None, identity}:
                 raise ForbiddenError("actor identity mismatch")
             body["actor_identity"] = identity

active-runtime/app/task_plane/events.py

@@ -106,3 +106,8 @@ class DurableOutboxDispatcher:
             receipt=str(receipt) if receipt else None,
             error=None if receipt else f"{adapter.name} receipt unavailable",
         )
+
+# R4.2 P0-B compatibility adapter.
+def to_handoff_envelope(event, *, target, sequence=1, idempotency_key=None, **scope):
+    from message_handoff_adapters import taskplane_event_to_envelope
+    return taskplane_event_to_envelope(event, target=target, sequence=sequence, idempotency_key=idempotency_key, **scope)

active-runtime/app/task_plane/models.py

@@ -13,6 +13,8 @@ from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from typing import Any
 
+from .scope import normalize_task_scope
+
 
 SENSITIVE_KEYS = {
     "secret",
@@ -66,6 +68,12 @@ TASK_PLAN_KEYS = {
     "allowed_input_paths",
     "allowed_output_paths",
     "output_policy",
+    "scope_type",
+    "tenant_id",
+    "user_id",
+    "project_id",
+    "conversation_id",
+    "run_id",
 }
 
 
@@ -237,6 +245,12 @@ class TaskPlan:
     schema_version: int = 1
     task_id: str | None = None
     task_type: str = "code.change"
+    scope_type: str = "legacy"
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
     issuer: dict[str, Any] = field(default_factory=dict)
     intent: str | None = None
     required_capabilities: list[str] = field(default_factory=list)
@@ -311,10 +325,17 @@ class TaskPlan:
                 raise ValueError("credential-secret requires metadata-only logging")
             if output_policy != "hash-count-status-only":
                 raise ValueError("credential-secret requires restricted output")
+        scope = normalize_task_scope(data)
         return cls(
             schema_version=schema_version,
             task_id=validate_identifier(data["task_id"], "task_id"),
             task_type=validate_type(data.get("task_type", "code.change"), "task_type"),
+            scope_type=scope.scope_type,
+            tenant_id=scope.tenant_id,
+            user_id=scope.user_id,
+            project_id=scope.project_id,
+            conversation_id=scope.conversation_id,
+            run_id=scope.run_id,
             issuer=issuer,
             intent=data.get("intent"),
             required_capabilities=_normalize_list(data.get("required_capabilities", [])),
@@ -348,6 +369,12 @@ class TaskPlan:
             "schema_version": self.schema_version,
             "task_id": self.task_id,
             "task_type": self.task_type,
+            "scope_type": self.scope_type,
+            "tenant_id": self.tenant_id,
+            "user_id": self.user_id,
+            "project_id": self.project_id,
+            "conversation_id": self.conversation_id,
+            "run_id": self.run_id,
             "issuer": self.issuer,
             "intent": self.intent,
             "required_capabilities": list(self.required_capabilities),

active-runtime/app/task_plane/policy.py

@@ -3,10 +3,11 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
-from typing import Callable
+from typing import Any, Callable, Mapping
 
 from .errors import ForbiddenError, LockedError
 from .models import ProbeEvidence, ResultEnvelope, TaskRecord
+from .scope import TaskActorContext, actor_context as build_actor_context
 
 
 RISK_RANK = {"low": 1, "medium": 2, "high": 3}
@@ -93,6 +94,10 @@ class PolicyEngine:
         result_signature_verifier: Callable[[ResultEnvelope], bool] | None = None,
         probe_attestation_verifier: Callable[[ProbeEvidence], bool] | None = None,
         identity_capabilities: dict[str, set[str]] | None = None,
+        identity_actor_contexts: Mapping[
+            str, TaskActorContext | Mapping[str, Any]
+        ]
+        | None = None,
         admin_identities: set[str] | None = None,
         readonly_worker_execution_enabled: bool = False,
         readonly_worker_profiles: list[ReadonlyWorkerProfile] | None = None,
@@ -109,12 +114,26 @@ class PolicyEngine:
             identity: set(capabilities)
             for identity, capabilities in (identity_capabilities or {}).items()
         }
+        self.identity_actor_contexts = dict(identity_actor_contexts or {})
         self.admin_identities = set(admin_identities or ())
         self.readonly_worker_execution_enabled = readonly_worker_execution_enabled
         self.readonly_worker_profiles = {
             profile.identity: profile for profile in (readonly_worker_profiles or [])
         }
 
+    def actor_context(self, identity: str) -> TaskActorContext:
+        configured = self.identity_actor_contexts.get(
+            identity, self.identity_actor_contexts.get("*")
+        )
+        capabilities = set(
+            self.identity_capabilities.get(
+                identity, self.identity_capabilities.get("*", set())
+            )
+        )
+        if identity in self.admin_identities:
+            capabilities.add("task.admin")
+        return build_actor_context(identity, configured, capabilities)
+
     def _readonly_worker_allows(
         self, action: str, actor: str, task: TaskRecord | None
     ) -> bool:

active-runtime/app/task_plane/scope.py

@@ -0,0 +1,181 @@
+"""Trusted TaskPlane scope model and SQL authorization helpers."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, replace
+from typing import Any, Mapping
+
+from .errors import ForbiddenError, ValidationError
+
+SCOPE_FIELDS = ("tenant_id", "user_id", "project_id", "conversation_id", "run_id")
+PRIVILEGED_CAPABILITIES = frozenset(
+    {"*", "admin", "system.admin", "task.admin", "task.read.all"}
+)
+
+
+def _value(value: Any, field: str) -> Any:
+    if hasattr(value, "task_plan"):
+        value = value.task_plan
+    if isinstance(value, Mapping):
+        return value.get(field)
+    return getattr(value, field, None)
+
+
+def _text(value: Any) -> str | None:
+    if value is None:
+        return None
+    result = str(value).strip()
+    return result or None
+
+
+@dataclass(frozen=True)
+class TaskScope:
+    scope_type: str
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
+
+
+@dataclass(frozen=True)
+class TaskActorContext:
+    identity: str
+    scope_type: str = "legacy"
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
+    capabilities: frozenset[str] = frozenset()
+
+
+def normalize_task_scope(value: Any) -> TaskScope:
+    fields = {field: _text(_value(value, field)) for field in SCOPE_FIELDS}
+    declared = _text(_value(value, "scope_type"))
+    if declared is None:
+        declared = "tenant" if fields["tenant_id"] else "legacy"
+    if declared == "tenant":
+        if fields["tenant_id"] is None:
+            raise ValidationError(
+                "tenant scope requires tenant_id", code="TASK_SCOPE_TENANT_ID_REQUIRED"
+            )
+    elif declared == "legacy":
+        if any(fields.values()):
+            raise ValidationError(
+                "legacy scope cannot contain scoped ownership",
+                code="TASK_SCOPE_LEGACY_WITH_SCOPED_FIELDS",
+            )
+    elif declared == "system":
+        if any(fields[field] for field in ("tenant_id", "user_id", "project_id", "conversation_id")):
+            raise ValidationError(
+                "system scope cannot contain tenant ownership",
+                code="TASK_SCOPE_SYSTEM_WITH_TENANT_FIELDS",
+            )
+    else:
+        raise ValidationError("invalid task scope type", code="TASK_SCOPE_TYPE_INVALID")
+    return TaskScope(declared, **fields)
+
+
+def actor_is_privileged(actor: TaskActorContext) -> bool:
+    return bool(actor.capabilities & PRIVILEGED_CAPABILITIES)
+
+
+def actor_context(
+    identity: str,
+    configured: TaskActorContext | Mapping[str, Any] | None,
+    capabilities: set[str] | frozenset[str],
+) -> TaskActorContext:
+    if isinstance(configured, TaskActorContext):
+        context = configured
+    else:
+        data = dict(configured or {})
+        data.pop("identity", None)
+        data.pop("capabilities", None)
+        context = TaskActorContext(identity=str(identity), **data)
+    scope = normalize_task_scope(context)
+    return replace(
+        context,
+        identity=str(identity),
+        scope_type=scope.scope_type,
+        tenant_id=scope.tenant_id,
+        user_id=scope.user_id,
+        project_id=scope.project_id,
+        conversation_id=scope.conversation_id,
+        run_id=scope.run_id,
+        capabilities=frozenset(str(item) for item in capabilities),
+    )
+
+
+def bind_task_scope(plan: Any, actor: TaskActorContext, *, public_create: bool) -> Any:
+    requested = normalize_task_scope(plan)
+    if actor_is_privileged(actor):
+        trusted = normalize_task_scope(actor)
+        if requested.scope_type == "legacy" and trusted.scope_type != "legacy":
+            plan.scope_type = trusted.scope_type
+            for field in SCOPE_FIELDS:
+                setattr(plan, field, getattr(actor, field))
+        return plan
+    trusted = normalize_task_scope(actor)
+    if public_create and trusted.scope_type == "legacy":
+        raise ForbiddenError(
+            "authenticated identity has no tenant scope",
+            code="TASK_ACTOR_SCOPE_UNAVAILABLE",
+        )
+    if trusted.scope_type != "tenant":
+        if requested.scope_type == "legacy":
+            plan.scope_type = trusted.scope_type
+            for field in SCOPE_FIELDS:
+                setattr(plan, field, getattr(actor, field))
+            return plan
+        if requested.scope_type != trusted.scope_type:
+            raise ForbiddenError("task scope mismatch", code="TASK_SCOPE_MISMATCH_DENY")
+        return plan
+    if requested.scope_type not in {"legacy", "tenant"}:
+        raise ForbiddenError("task scope mismatch", code="TASK_SCOPE_MISMATCH_DENY")
+    updates: dict[str, Any] = {"scope_type": "tenant"}
+    for field in SCOPE_FIELDS:
+        declared = getattr(requested, field)
+        authoritative = getattr(actor, field)
+        if declared is not None and declared != authoritative:
+            raise ForbiddenError(
+                "task scope mismatch",
+                code="TASK_SCOPE_MISMATCH_DENY",
+                details={"field": field},
+            )
+        updates[field] = authoritative
+    for field, item in updates.items():
+        setattr(plan, field, item)
+    return plan
+
+
+def actor_scope_sql(actor: TaskActorContext | None) -> tuple[str, tuple[Any, ...]]:
+    if actor is None or actor_is_privileged(actor):
+        return "", ()
+    scope = normalize_task_scope(actor)
+    if scope.scope_type == "legacy":
+        return "scope_type = 'legacy'", ()
+    if scope.scope_type == "system":
+        return "scope_type = 'system'", ()
+    clauses = ["scope_type = 'tenant'", "tenant_id = ?"]
+    params: list[Any] = [scope.tenant_id]
+    for field in ("user_id", "project_id", "conversation_id", "run_id"):
+        value = getattr(scope, field)
+        if value is None:
+            clauses.append(f"{field} IS NULL")
+        else:
+            clauses.append(f"({field} IS NULL OR {field} = ?)")
+            params.append(value)
+    return " AND ".join(clauses), tuple(params)
+
+
+def task_scope_values(value: Any) -> tuple[str | None, ...]:
+    scope = normalize_task_scope(value)
+    return (
+        scope.scope_type,
+        scope.tenant_id,
+        scope.user_id,
+        scope.project_id,
+        scope.conversation_id,
+        scope.run_id,
+    )

active-runtime/app/task_plane/store.py

@@ -32,6 +32,7 @@ from .models import (
     redact_value,
     validate_identifier,
 )
+from .scope import TaskActorContext, actor_scope_sql, task_scope_values
 
 
 EventEnvelope = tuple[str, str, str, str, str, float]
@@ -134,6 +135,12 @@ class TaskPlaneStore:
                     status TEXT NOT NULL,
                     task_json TEXT NOT NULL,
                     task_type TEXT NOT NULL,
+                    scope_type TEXT NOT NULL DEFAULT 'legacy',
+                    tenant_id TEXT,
+                    user_id TEXT,
+                    project_id TEXT,
+                    conversation_id TEXT,
+                    run_id TEXT,
                     root_task_id TEXT NOT NULL,
                     parent_task_id TEXT,
                     correlation_id TEXT,
@@ -272,6 +279,21 @@ class TaskPlaneStore:
                 )
                 """
             )
+            self._ensure_columns(
+                "tasks",
+                {
+                    "scope_type": "TEXT NOT NULL DEFAULT 'legacy'",
+                    "tenant_id": "TEXT",
+                    "user_id": "TEXT",
+                    "project_id": "TEXT",
+                    "conversation_id": "TEXT",
+                    "run_id": "TEXT",
+                },
+            )
+            self.conn.execute(
+                "UPDATE tasks SET scope_type='legacy' "
+                "WHERE scope_type IS NULL OR TRIM(scope_type)=''"
+            )
             self._ensure_columns(
                 "workers",
                 {
@@ -299,6 +321,14 @@ class TaskPlaneStore:
             )
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_tasks_status ON tasks(status)")
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_tasks_parent ON tasks(parent_task_id)")
+            self.conn.execute(
+                "CREATE INDEX IF NOT EXISTS ix_tasks_scope_tenant_project "
+                "ON tasks(scope_type, tenant_id, project_id)"
+            )
+            self.conn.execute(
+                "CREATE INDEX IF NOT EXISTS ix_tasks_scope_owner "
+                "ON tasks(scope_type, tenant_id, user_id, conversation_id, run_id)"
+            )
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_workers_status ON workers(status)")
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_claims_task ON claims(task_id)")
             self.conn.execute(
@@ -347,6 +377,42 @@ class TaskPlaneStore:
             raise NotFoundError("task")
         task_json = json.loads(row["task_json"])
         task_plan = TaskPlan.from_dict(task_json)
+        stored_scope = tuple(
+            row[field]
+            for field in (
+                "scope_type",
+                "tenant_id",
+                "user_id",
+                "project_id",
+                "conversation_id",
+                "run_id",
+            )
+        )
+        json_has_scope = any(
+            field in task_json
+            for field in (
+                "scope_type",
+                "tenant_id",
+                "user_id",
+                "project_id",
+                "conversation_id",
+                "run_id",
+            )
+        )
+        if json_has_scope and stored_scope != task_scope_values(task_plan):
+            raise ConflictError(
+                "task scope persistence mismatch",
+                code="TASK_SCOPE_PERSISTENCE_MISMATCH",
+            )
+        if not json_has_scope:
+            (
+                task_plan.scope_type,
+                task_plan.tenant_id,
+                task_plan.user_id,
+                task_plan.project_id,
+                task_plan.conversation_id,
+                task_plan.run_id,
+            ) = stored_scope
         task_plan.parent_task_id = row["parent_task_id"]
         task_plan.correlation_id = row["correlation_id"]
         return TaskRecord(
@@ -389,6 +455,7 @@ class TaskPlaneStore:
         task_id = task_plan.task_id or f"task-{uuid.uuid4()}"
         task_plan.task_id = task_id
         task_json = redact_value(task_plan.to_dict(redact=False))
+        scope_values = task_scope_values(task_plan)
         now = _now()
         with self._transaction():
             if idempotency_key:
@@ -397,7 +464,11 @@ class TaskPlaneStore:
                     (idempotency_key,),
                 ).fetchone()
                 if existing:
-                    if _canonical(json.loads(existing["task_json"])) != _canonical(task_json):
+                    existing_plan = TaskPlan.from_dict(
+                        json.loads(existing["task_json"])
+                    )
+                    existing_json = redact_value(existing_plan.to_dict(redact=False))
+                    if _canonical(existing_json) != _canonical(task_json):
                         raise ConflictError("idempotency key payload mismatch")
                     return self.get_task(existing["task_id"])
             root_task_id = task_id
@@ -412,14 +483,18 @@ class TaskPlaneStore:
             self.conn.execute(
                 """
                 INSERT INTO tasks
-                (task_id, revision, status, task_json, task_type, root_task_id, parent_task_id, correlation_id, idempotency_key, created_at, updated_at, failure_reason)
-                VALUES (?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
+                (task_id, revision, status, task_json, task_type,
+                 scope_type, tenant_id, user_id, project_id, conversation_id, run_id,
+                 root_task_id, parent_task_id, correlation_id, idempotency_key,
+                 created_at, updated_at, failure_reason)
+                VALUES (?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
                 """,
                 (
                     task_id,
                     "CREATED",
                     json.dumps(task_json, ensure_ascii=False),
                     task_plan.task_type,
+                    *scope_values,
                     root_task_id,
                     task_plan.parent_task_id,
                     task_plan.correlation_id,
@@ -451,21 +526,30 @@ class TaskPlaneStore:
                 )
             return self.get_task(task.task_id)
 
-    def get_task(self, task_id: str) -> TaskRecord:
+    def get_task(
+        self, task_id: str, actor_context: TaskActorContext | None = None
+    ) -> TaskRecord:
         task_id = _validated_id(task_id, "task_id")
+        predicate, scope_params = actor_scope_sql(actor_context)
+        sql = "SELECT * FROM tasks WHERE task_id=?"
+        if predicate:
+            sql += f" AND ({predicate})"
         with self._lock:
-            row = self.conn.execute(
-                "SELECT * FROM tasks WHERE task_id=?", (task_id,)
-            ).fetchone()
+            row = self.conn.execute(sql, (task_id, *scope_params)).fetchone()
         if row is None:
             raise NotFoundError(f"task {task_id} not found")
         return self._row_to_task(row)
 
-    def list_tasks(self) -> list[TaskRecord]:
+    def list_tasks(
+        self, actor_context: TaskActorContext | None = None
+    ) -> list[TaskRecord]:
+        predicate, scope_params = actor_scope_sql(actor_context)
+        sql = "SELECT * FROM tasks"
+        if predicate:
+            sql += f" WHERE ({predicate})"
+        sql += " ORDER BY created_at DESC"
         with self._lock:
-            rows = self.conn.execute(
-                "SELECT * FROM tasks ORDER BY created_at DESC"
-            ).fetchall()
+            rows = self.conn.execute(sql, scope_params).fetchall()
         return [self._row_to_task(row) for row in rows]
 
     def get_task_budget(self, task_id: str) -> Budget:

active-runtime/app/trace_tool_credential_governance.py

@@ -0,0 +1,759 @@
+"""Scope-bound governance for traces, Tool/MCP calls, and credentials.
+
+This module deliberately stores references and audit metadata only.  Secret
+material remains in the configured credential provider boundary.
+"""
+
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass, field
+from datetime import datetime, timezone
+from contextlib import contextmanager
+import hashlib
+import json
+import re
+import sqlite3
+from pathlib import Path
+from typing import Any, Iterable, Mapping
+
+
+SCOPE_FIELDS = ("tenant_id", "user_id", "project_id", "conversation_id", "run_id")
+PRIVILEGED_CAPABILITIES = frozenset({"*", "admin", "system.admin", "governance.admin"})
+REFERENCE_RE = re.compile(r"^(systemd-credential|vault|secret-manager):[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$")
+IDENTIFIER_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{0,179}$")
+
+
+class GovernanceError(RuntimeError):
+    def __init__(self, code: str, *, field: str | None = None) -> None:
+        super().__init__(code if field is None else f"{code}:{field}")
+        self.code = code
+        self.field = field
+
+
+def _clean(value: Any) -> str | None:
+    if value is None:
+        return None
+    text = str(value).strip()
+    return text or None
+
+
+def _scope_tuple(value: Iterable[str] | str | None) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if isinstance(value, str):
+        value = value.split(",")
+    return tuple(sorted({_clean(item) for item in value if _clean(item)}))
+
+
+def _canonical(value: Any) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str)
+
+
+def _sha(value: Any) -> str:
+    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _identifier(value: Any, code: str) -> str:
+    text = _clean(value)
+    if text is None or IDENTIFIER_RE.fullmatch(text) is None:
+        raise GovernanceError(code)
+    return text
+
+
+@dataclass(frozen=True)
+class GovernanceScope:
+    """Explicit resource scope; system/global resources never get fake tenants."""
+
+    scope_type: str
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "scope_type", (_clean(self.scope_type) or "").lower())
+        for name in SCOPE_FIELDS:
+            object.__setattr__(self, name, _clean(getattr(self, name)))
+        if self.scope_type == "tenant":
+            if self.tenant_id is None:
+                raise GovernanceError("GOVERNANCE_TENANT_ID_REQUIRED")
+        elif self.scope_type in {"system", "global"}:
+            if any(getattr(self, name) is not None for name in SCOPE_FIELDS):
+                raise GovernanceError("GOVERNANCE_NON_TENANT_SCOPE_INVALID")
+        elif self.scope_type == "legacy":
+            if any(getattr(self, name) is not None for name in SCOPE_FIELDS):
+                raise GovernanceError("GOVERNANCE_LEGACY_SCOPE_INVALID")
+        else:
+            raise GovernanceError("GOVERNANCE_SCOPE_TYPE_INVALID")
+
+    @classmethod
+    def from_value(cls, value: Any) -> "GovernanceScope":
+        def get(name: str) -> Any:
+            return value.get(name) if isinstance(value, Mapping) else getattr(value, name, None)
+
+        declared = _clean(get("scope_type"))
+        tenant_id = _clean(get("tenant_id"))
+        return cls(
+            scope_type=declared or ("tenant" if tenant_id else "legacy"),
+            tenant_id=tenant_id,
+            user_id=get("user_id"),
+            project_id=get("project_id"),
+            conversation_id=get("conversation_id"),
+            run_id=get("run_id"),
+        )
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+@dataclass(frozen=True)
+class GovernanceActor:
+    identity: str
+    scope: GovernanceScope
+    capabilities: tuple[str, ...] = ()
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "identity", _identifier(self.identity, "GOVERNANCE_ACTOR_INVALID"))
+        object.__setattr__(self, "capabilities", _scope_tuple(self.capabilities))
+
+    @classmethod
+    def from_value(cls, value: Any) -> "GovernanceActor":
+        if isinstance(value, cls):
+            return value
+        if not isinstance(value, Mapping):
+            raise GovernanceError("GOVERNANCE_ACTOR_INVALID")
+        return cls(
+            identity=value.get("identity") or value.get("actor_id") or value.get("user_id"),
+            scope=GovernanceScope.from_value(value),
+            capabilities=_scope_tuple(value.get("capabilities") or value.get("capability_scope")),
+        )
+
+    @property
+    def privileged(self) -> bool:
+        return bool(set(self.capabilities) & PRIVILEGED_CAPABILITIES)
+
+
+def authorize_scope(actor: GovernanceActor | Mapping[str, Any], resource: GovernanceScope | Mapping[str, Any]) -> None:
+    actor = GovernanceActor.from_value(actor)
+    resource = resource if isinstance(resource, GovernanceScope) else GovernanceScope.from_value(resource)
+    if actor.privileged:
+        return
+    if resource.scope_type in {"system", "global"}:
+        raise GovernanceError("GOVERNANCE_SYSTEM_SCOPE_AUTHZ_DENY")
+    if resource.scope_type == "legacy":
+        if actor.scope.scope_type != "legacy":
+            raise GovernanceError("GOVERNANCE_LEGACY_SCOPE_AUTHZ_DENY")
+        return
+    if actor.scope.scope_type != "tenant":
+        raise GovernanceError("GOVERNANCE_SCOPE_MISMATCH_DENY", field="scope_type")
+    for name in SCOPE_FIELDS:
+        expected = getattr(resource, name)
+        actual = getattr(actor.scope, name)
+        if expected is not None and expected != actual:
+            raise GovernanceError("GOVERNANCE_SCOPE_MISMATCH_DENY", field=name)
+
+
+@dataclass(frozen=True)
+class TraceContext:
+    trace_id: str
+    span_id: str
+    scope: GovernanceScope
+    parent_span_id: str | None = None
+    correlation_id: str | None = None
+    causation_id: str | None = None
+    task_id: str | None = None
+    claim_id: str | None = None
+    message_id: str | None = None
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "trace_id", _identifier(self.trace_id, "TRACE_ID_INVALID"))
+        object.__setattr__(self, "span_id", _identifier(self.span_id, "TRACE_SPAN_ID_INVALID"))
+        for name in ("parent_span_id", "correlation_id", "causation_id", "task_id", "claim_id", "message_id"):
+            value = _clean(getattr(self, name))
+            if value is not None and IDENTIFIER_RE.fullmatch(value) is None:
+                raise GovernanceError("TRACE_LINEAGE_IDENTIFIER_INVALID", field=name)
+            object.__setattr__(self, name, value)
+
+    def child(self, *, span_id: str, actor: GovernanceActor | Mapping[str, Any], **lineage: Any) -> "TraceContext":
+        authorize_scope(actor, self.scope)
+        for name in ("trace_id", "task_id", "claim_id", "message_id", "correlation_id"):
+            supplied = _clean(lineage.get(name))
+            expected = getattr(self, name)
+            if supplied is not None and expected is not None and supplied != expected:
+                raise GovernanceError("TRACE_LINEAGE_CONTINUITY", field=name)
+        requested_scope = lineage.pop("scope", self.scope)
+        requested_scope = requested_scope if isinstance(requested_scope, GovernanceScope) else GovernanceScope.from_value(requested_scope)
+        if requested_scope != self.scope:
+            raise GovernanceError("TRACE_SCOPE_MISMATCH_DENY")
+        return TraceContext(
+            trace_id=self.trace_id,
+            span_id=span_id,
+            parent_span_id=self.span_id,
+            correlation_id=self.correlation_id,
+            causation_id=_clean(lineage.get("causation_id")) or self.span_id,
+            task_id=self.task_id,
+            claim_id=self.claim_id,
+            message_id=self.message_id,
+            scope=self.scope,
+        )
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "trace_id": self.trace_id,
+            "span_id": self.span_id,
+            "parent_span_id": self.parent_span_id,
+            "correlation_id": self.correlation_id,
+            "causation_id": self.causation_id,
+            "task_id": self.task_id,
+            "claim_id": self.claim_id,
+            "message_id": self.message_id,
+            **self.scope.as_dict(),
+        }
+
+
+def bind_trace_lineage(
+    *,
+    actor: GovernanceActor | Mapping[str, Any],
+    task: Any,
+    message: Any,
+    trace_id: str,
+    span_id: str,
+    parent: TraceContext | None = None,
+) -> TraceContext:
+    actor = GovernanceActor.from_value(actor)
+    task_scope = GovernanceScope.from_value(task)
+    message_scope = GovernanceScope.from_value(message)
+    if task_scope != message_scope:
+        raise GovernanceError("TRACE_SCOPE_MISMATCH_DENY")
+    authorize_scope(actor, task_scope)
+
+    def get(value: Any, name: str) -> Any:
+        return value.get(name) if isinstance(value, Mapping) else getattr(value, name, None)
+
+    task_id = _clean(get(task, "task_id"))
+    message_task = _clean(get(message, "task_id"))
+    if task_id and message_task and task_id != message_task:
+        raise GovernanceError("TRACE_LINEAGE_CONTINUITY", field="task_id")
+    context = TraceContext(
+        trace_id=trace_id,
+        span_id=span_id,
+        parent_span_id=parent.span_id if parent else None,
+        correlation_id=_clean(get(task, "correlation_id")) or _clean(get(message, "correlation_id")),
+        causation_id=_clean(get(message, "causation_id")) or (parent.span_id if parent else None),
+        task_id=task_id or message_task,
+        claim_id=_clean(get(task, "claim_id")) or _clean(get(message, "claim_id")),
+        message_id=_clean(get(message, "envelope_id")) or _clean(get(message, "id")),
+        scope=task_scope,
+    )
+    if parent is not None:
+        if parent.trace_id != context.trace_id or parent.scope != context.scope:
+            raise GovernanceError("TRACE_LINEAGE_CONTINUITY")
+        if parent.task_id and context.task_id and parent.task_id != context.task_id:
+            raise GovernanceError("TRACE_LINEAGE_CONTINUITY", field="task_id")
+    return context
+
+
+@dataclass(frozen=True)
+class ToolDescriptor:
+    name: str
+    kind: str
+    scope: GovernanceScope
+    required_capabilities: tuple[str, ...] = ()
+    credential_ref: str | None = None
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "name", _identifier(self.name, "TOOL_NAME_INVALID"))
+        object.__setattr__(self, "kind", (_clean(self.kind) or "").lower())
+        if self.kind not in {"tool", "mcp"}:
+            raise GovernanceError("TOOL_KIND_INVALID")
+        object.__setattr__(self, "required_capabilities", _scope_tuple(self.required_capabilities))
+        if self.credential_ref is not None and REFERENCE_RE.fullmatch(self.credential_ref) is None:
+            raise GovernanceError("CREDENTIAL_SECRET_EXPOSURE_DENY")
+
+
+@dataclass(frozen=True)
+class CredentialGrant:
+    grant_id: str
+    credential_ref: str
+    scope: GovernanceScope
+    operations: tuple[str, ...]
+    task_id: str | None = None
+    tool_name: str | None = None
+    expires_at: str | None = None
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "grant_id", _identifier(self.grant_id, "CREDENTIAL_GRANT_ID_INVALID"))
+        if REFERENCE_RE.fullmatch(self.credential_ref or "") is None:
+            raise GovernanceError("CREDENTIAL_SECRET_EXPOSURE_DENY")
+        object.__setattr__(self, "operations", _scope_tuple(self.operations))
+        if not self.operations:
+            raise GovernanceError("CREDENTIAL_OPERATIONS_REQUIRED")
+        if self.expires_at is not None:
+            parsed = datetime.fromisoformat(self.expires_at.replace("Z", "+00:00"))
+            if parsed.tzinfo is None:
+                raise GovernanceError("CREDENTIAL_EXPIRY_INVALID")
+
+    def authorize(
+        self,
+        actor: GovernanceActor | Mapping[str, Any],
+        *,
+        operation: str,
+        task_id: str | None = None,
+        tool_name: str | None = None,
+        now: datetime | None = None,
+    ) -> str:
+        try:
+            authorize_scope(actor, self.scope)
+        except GovernanceError as exc:
+            raise GovernanceError("CREDENTIAL_SCOPE_DENY", field=exc.field) from exc
+        if operation not in self.operations:
+            raise GovernanceError("CREDENTIAL_SCOPE_DENY", field="operation")
+        if self.task_id is not None and self.task_id != _clean(task_id):
+            raise GovernanceError("CREDENTIAL_SCOPE_DENY", field="task_id")
+        if self.tool_name is not None and self.tool_name != _clean(tool_name):
+            raise GovernanceError("CREDENTIAL_SCOPE_DENY", field="tool_name")
+        if self.expires_at is not None:
+            current = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+            expiry = datetime.fromisoformat(self.expires_at.replace("Z", "+00:00")).astimezone(timezone.utc)
+            if current >= expiry:
+                raise GovernanceError("CREDENTIAL_SCOPE_DENY", field="expires_at")
+        return self.credential_ref
+
+    def public(self) -> dict[str, Any]:
+        return {
+            "grant_id": self.grant_id,
+            "credential_ref": self.credential_ref,
+            "operations": list(self.operations),
+            "task_id": self.task_id,
+            "tool_name": self.tool_name,
+            "expires_at": self.expires_at,
+            **self.scope.as_dict(),
+        }
+
+
+_SCHEMA = """
+CREATE TABLE IF NOT EXISTS governance_schema_metadata (
+  singleton INTEGER PRIMARY KEY CHECK(singleton=1),
+  schema_version INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS governed_tools (
+  name TEXT PRIMARY KEY,
+  kind TEXT NOT NULL,
+  scope_json TEXT NOT NULL,
+  required_capabilities_json TEXT NOT NULL,
+  credential_ref TEXT,
+  descriptor_sha256 TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS governed_trace_spans (
+  trace_id TEXT NOT NULL,
+  span_id TEXT NOT NULL,
+  parent_span_id TEXT,
+  context_json TEXT NOT NULL,
+  context_sha256 TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY(trace_id, span_id)
+);
+CREATE TABLE IF NOT EXISTS governed_credential_grants (
+  grant_id TEXT PRIMARY KEY,
+  grant_json TEXT NOT NULL,
+  grant_sha256 TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS governed_tool_invocations (
+  invocation_key TEXT PRIMARY KEY,
+  request_sha256 TEXT NOT NULL,
+  tool_name TEXT NOT NULL,
+  task_id TEXT NOT NULL,
+  claim_id TEXT NOT NULL,
+  trace_id TEXT NOT NULL,
+  span_id TEXT NOT NULL,
+  status TEXT NOT NULL,
+  receipt_sha256 TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS governance_audit_evidence (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  evidence_id TEXT NOT NULL UNIQUE,
+  action TEXT NOT NULL,
+  actor_identity TEXT NOT NULL,
+  trace_id TEXT,
+  span_id TEXT,
+  resource_id TEXT NOT NULL,
+  outcome TEXT NOT NULL,
+  details_json TEXT NOT NULL,
+  previous_sha256 TEXT NOT NULL,
+  evidence_sha256 TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+"""
+
+
+class GovernanceStore:
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        with self._connection() as connection:
+            has_metadata = connection.execute(
+                "SELECT 1 FROM sqlite_master WHERE type='table' AND name='governance_schema_metadata'"
+            ).fetchone()
+            if has_metadata:
+                row = connection.execute(
+                    "SELECT schema_version FROM governance_schema_metadata WHERE singleton=1"
+                ).fetchone()
+                if row is not None and int(row[0]) != 1:
+                    raise GovernanceError("GOVERNANCE_SCHEMA_VERSION_UNSUPPORTED")
+            connection.executescript(_SCHEMA)
+            row = connection.execute(
+                "SELECT schema_version FROM governance_schema_metadata WHERE singleton=1"
+            ).fetchone()
+            if row is None:
+                connection.execute(
+                    "INSERT INTO governance_schema_metadata(singleton,schema_version) VALUES(1,1)"
+                )
+            connection.commit()
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(self.path, timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA foreign_keys=ON")
+        connection.execute("PRAGMA busy_timeout=30000")
+        return connection
+
+    @contextmanager
+    def _connection(self):
+        connection = self._connect()
+        try:
+            yield connection
+            connection.commit()
+        except Exception:
+            connection.rollback()
+            raise
+        finally:
+            connection.close()
+
+    def _audit(
+        self,
+        connection: sqlite3.Connection,
+        *,
+        action: str,
+        actor: GovernanceActor,
+        resource_id: str,
+        outcome: str,
+        trace: TraceContext | None,
+        details: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        previous = connection.execute(
+            "SELECT evidence_sha256 FROM governance_audit_evidence ORDER BY sequence DESC LIMIT 1"
+        ).fetchone()
+        previous_sha = str(previous[0]) if previous else ""
+        created_at = _now()
+        material = {
+            "action": action,
+            "actor_identity": actor.identity,
+            "trace_id": trace.trace_id if trace else None,
+            "span_id": trace.span_id if trace else None,
+            "resource_id": resource_id,
+            "outcome": outcome,
+            "details": dict(details),
+            "previous_sha256": previous_sha,
+            "created_at": created_at,
+        }
+        digest = _sha(material)
+        evidence_id = "gev-" + digest[:32]
+        connection.execute(
+            """INSERT INTO governance_audit_evidence
+               (evidence_id,action,actor_identity,trace_id,span_id,resource_id,outcome,
+                details_json,previous_sha256,evidence_sha256,created_at)
+               VALUES (?,?,?,?,?,?,?,?,?,?,?)""",
+            (
+                evidence_id, action, actor.identity, material["trace_id"], material["span_id"],
+                resource_id, outcome, _canonical(material["details"]), previous_sha, digest, created_at,
+            ),
+        )
+        return {"evidence_id": evidence_id, "evidence_sha256": digest, **material}
+
+    def record_trace(self, trace: TraceContext, actor: GovernanceActor | Mapping[str, Any]) -> dict[str, Any]:
+        actor = GovernanceActor.from_value(actor)
+        authorize_scope(actor, trace.scope)
+        context = trace.as_dict()
+        digest = _sha(context)
+        with self._connection() as connection:
+            existing = connection.execute(
+                "SELECT context_sha256 FROM governed_trace_spans WHERE trace_id=? AND span_id=?",
+                (trace.trace_id, trace.span_id),
+            ).fetchone()
+            if existing is not None and existing[0] != digest:
+                raise GovernanceError("TRACE_LINEAGE_CONFLICT")
+            if existing is not None:
+                return {"context": context, "context_sha256": digest, "idempotent": True}
+            if trace.parent_span_id:
+                parent = connection.execute(
+                    "SELECT context_json FROM governed_trace_spans WHERE trace_id=? AND span_id=?",
+                    (trace.trace_id, trace.parent_span_id),
+                ).fetchone()
+                if parent is None:
+                    raise GovernanceError("TRACE_LINEAGE_CONTINUITY", field="parent_span_id")
+                parent_context = json.loads(parent[0])
+                if GovernanceScope.from_value(parent_context) != trace.scope:
+                    raise GovernanceError("TRACE_SCOPE_MISMATCH_DENY")
+            connection.execute(
+                "INSERT OR IGNORE INTO governed_trace_spans VALUES (?,?,?,?,?,?)",
+                (trace.trace_id, trace.span_id, trace.parent_span_id, _canonical(context), digest, _now()),
+            )
+            evidence = self._audit(
+                connection, action="TRACE_RECORDED", actor=actor,
+                resource_id=f"{trace.trace_id}:{trace.span_id}", outcome="ALLOW", trace=trace,
+                details={"context_sha256": digest},
+            )
+        return {"context": context, "context_sha256": digest, "evidence": evidence}
+
+    def register_tool(self, descriptor: ToolDescriptor, actor: GovernanceActor | Mapping[str, Any]) -> dict[str, Any]:
+        actor = GovernanceActor.from_value(actor)
+        if not actor.privileged:
+            raise GovernanceError("TOOL_MCP_AUTHZ_DENY")
+        public = {
+            "name": descriptor.name,
+            "kind": descriptor.kind,
+            "required_capabilities": list(descriptor.required_capabilities),
+            "credential_ref": descriptor.credential_ref,
+            **descriptor.scope.as_dict(),
+        }
+        digest = _sha(public)
+        with self._connection() as connection:
+            existing = connection.execute(
+                "SELECT descriptor_sha256 FROM governed_tools WHERE name=?", (descriptor.name,)
+            ).fetchone()
+            if existing is not None and existing[0] != digest:
+                raise GovernanceError("TOOL_DESCRIPTOR_CONFLICT")
+            if existing is not None:
+                return {"descriptor": public, "descriptor_sha256": digest, "idempotent": True}
+            connection.execute(
+                "INSERT OR IGNORE INTO governed_tools VALUES (?,?,?,?,?,?)",
+                (descriptor.name, descriptor.kind, _canonical(descriptor.scope.as_dict()),
+                 _canonical(descriptor.required_capabilities), descriptor.credential_ref, digest),
+            )
+            evidence = self._audit(
+                connection, action="TOOL_REGISTERED", actor=actor, resource_id=descriptor.name,
+                outcome="ALLOW", trace=None, details={"descriptor_sha256": digest},
+            )
+        return {"descriptor": public, "descriptor_sha256": digest, "evidence": evidence}
+
+    def authorize_tool(
+        self,
+        *,
+        actor: GovernanceActor | Mapping[str, Any],
+        tool_name: str,
+        trace: TraceContext,
+        requested_scope: GovernanceScope | Mapping[str, Any],
+        input_digest: str,
+        invocation_key: str,
+    ) -> dict[str, Any]:
+        actor = GovernanceActor.from_value(actor)
+        invocation_key = _identifier(invocation_key, "TOOL_INVOCATION_KEY_INVALID")
+        if not re.fullmatch(r"[0-9a-f]{64}", input_digest):
+            raise GovernanceError("TOOL_INPUT_DIGEST_INVALID")
+        if trace.task_id is None or trace.claim_id is None:
+            raise GovernanceError("TOOL_MCP_AUTHZ_DENY", field="active_claim")
+        requested_scope = requested_scope if isinstance(requested_scope, GovernanceScope) else GovernanceScope.from_value(requested_scope)
+        if requested_scope != trace.scope:
+            raise GovernanceError("TOOL_SCOPE_PROPAGATION")
+        authorize_scope(actor, requested_scope)
+        with self._connection() as connection:
+            persisted_trace = connection.execute(
+                "SELECT context_sha256 FROM governed_trace_spans WHERE trace_id=? AND span_id=?",
+                (trace.trace_id, trace.span_id),
+            ).fetchone()
+            if persisted_trace is None or persisted_trace[0] != _sha(trace.as_dict()):
+                raise GovernanceError("TOOL_MCP_AUTHZ_DENY", field="trace")
+            row = connection.execute("SELECT * FROM governed_tools WHERE name=?", (tool_name,)).fetchone()
+            if row is None:
+                raise GovernanceError("TOOL_MCP_AUTHZ_DENY")
+            descriptor_scope = GovernanceScope.from_value(json.loads(row["scope_json"]))
+            if descriptor_scope.scope_type == "tenant" and descriptor_scope != requested_scope:
+                raise GovernanceError("TOOL_MCP_AUTHZ_DENY")
+            required = set(json.loads(row["required_capabilities_json"]))
+            if not required.issubset(set(actor.capabilities)):
+                raise GovernanceError("TOOL_MCP_AUTHZ_DENY")
+            request_sha = _sha({
+                "tool_name": tool_name, "input_digest": input_digest,
+                "task_id": trace.task_id, "claim_id": trace.claim_id,
+                "trace_id": trace.trace_id, "span_id": trace.span_id,
+                "scope": requested_scope.as_dict(),
+            })
+            replay = connection.execute(
+                "SELECT * FROM governed_tool_invocations WHERE invocation_key=?",
+                (invocation_key,),
+            ).fetchone()
+            if replay is not None:
+                if replay["request_sha256"] != request_sha:
+                    raise GovernanceError("TOOL_INVOCATION_IDEMPOTENCY_CONFLICT")
+                if replay["status"] != "VERIFIED":
+                    raise GovernanceError("TOOL_INVOCATION_RECONCILIATION_REQUIRED")
+                return {
+                    "tool_name": tool_name, "trace_id": trace.trace_id,
+                    "span_id": trace.span_id, "invocation_key": invocation_key,
+                    "status": "VERIFIED", "receipt_sha256": replay["receipt_sha256"],
+                    "idempotent": True,
+                }
+            created_at = _now()
+            connection.execute(
+                """INSERT INTO governed_tool_invocations
+                   (invocation_key,request_sha256,tool_name,task_id,claim_id,trace_id,span_id,
+                    status,receipt_sha256,created_at,updated_at)
+                   VALUES(?,?,?,?,?,?,?,?,?,?,?)""",
+                (invocation_key, request_sha, tool_name, trace.task_id, trace.claim_id,
+                 trace.trace_id, trace.span_id, "AUTHORIZED", None, created_at, created_at),
+            )
+            evidence = self._audit(
+                connection, action="TOOL_AUTHORIZED", actor=actor, resource_id=tool_name,
+                outcome="ALLOW", trace=trace,
+                details={"input_sha256": input_digest, "scope_sha256": _sha(requested_scope.as_dict()),
+                         "invocation_key": invocation_key},
+            )
+        return {
+            "tool_name": tool_name,
+            "trace_id": trace.trace_id,
+            "span_id": trace.span_id,
+            "invocation_key": invocation_key,
+            "status": "AUTHORIZED",
+            "credential_required": row["credential_ref"] is not None,
+            "evidence": evidence,
+        }
+
+    def record_tool_receipt(
+        self,
+        *,
+        invocation_key: str,
+        result_digest: str,
+        actor: GovernanceActor | Mapping[str, Any],
+        trace: TraceContext,
+    ) -> dict[str, Any]:
+        actor = GovernanceActor.from_value(actor)
+        invocation_key = _identifier(invocation_key, "TOOL_INVOCATION_KEY_INVALID")
+        if not re.fullmatch(r"[0-9a-f]{64}", result_digest):
+            raise GovernanceError("TOOL_RECEIPT_DIGEST_INVALID")
+        authorize_scope(actor, trace.scope)
+        with self._connection() as connection:
+            row = connection.execute(
+                "SELECT * FROM governed_tool_invocations WHERE invocation_key=?",
+                (invocation_key,),
+            ).fetchone()
+            if row is None or row["trace_id"] != trace.trace_id or row["span_id"] != trace.span_id:
+                raise GovernanceError("TOOL_RECEIPT_BINDING_INVALID")
+            if row["status"] == "VERIFIED":
+                if row["receipt_sha256"] != result_digest:
+                    raise GovernanceError("TOOL_RECEIPT_CONFLICT")
+                return {"invocation_key": invocation_key, "status": "VERIFIED", "idempotent": True}
+            if row["status"] != "AUTHORIZED":
+                raise GovernanceError("TOOL_INVOCATION_RECONCILIATION_REQUIRED")
+            connection.execute(
+                "UPDATE governed_tool_invocations SET status='VERIFIED',receipt_sha256=?,updated_at=? "
+                "WHERE invocation_key=? AND status='AUTHORIZED'",
+                (result_digest, _now(), invocation_key),
+            )
+            evidence = self._audit(
+                connection, action="TOOL_RESULT_VERIFIED", actor=actor,
+                resource_id=row["tool_name"], outcome="ALLOW", trace=trace,
+                details={"invocation_key": invocation_key, "result_sha256": result_digest},
+            )
+        return {"invocation_key": invocation_key, "status": "VERIFIED", "evidence": evidence}
+
+    def store_grant(self, grant: CredentialGrant, actor: GovernanceActor | Mapping[str, Any]) -> dict[str, Any]:
+        actor = GovernanceActor.from_value(actor)
+        if not actor.privileged:
+            raise GovernanceError("CREDENTIAL_SCOPE_DENY")
+        public = grant.public()
+        digest = _sha(public)
+        with self._connection() as connection:
+            existing = connection.execute(
+                "SELECT grant_sha256 FROM governed_credential_grants WHERE grant_id=?", (grant.grant_id,)
+            ).fetchone()
+            if existing is not None and existing[0] != digest:
+                raise GovernanceError("CREDENTIAL_GRANT_CONFLICT")
+            connection.execute(
+                "INSERT OR IGNORE INTO governed_credential_grants VALUES (?,?,?,?)",
+                (grant.grant_id, _canonical(public), digest, _now()),
+            )
+            evidence = self._audit(
+                connection, action="CREDENTIAL_GRANT_STORED", actor=actor,
+                resource_id=grant.grant_id, outcome="ALLOW", trace=None,
+                details={"grant_sha256": digest},
+            )
+        return {"grant": public, "grant_sha256": digest, "evidence": evidence}
+
+    def authorize_credential(
+        self,
+        *,
+        grant_id: str,
+        actor: GovernanceActor | Mapping[str, Any],
+        trace: TraceContext,
+        operation: str,
+        task_id: str | None,
+        tool_name: str | None,
+        now: datetime | None = None,
+    ) -> dict[str, Any]:
+        actor = GovernanceActor.from_value(actor)
+        with self._connection() as connection:
+            row = connection.execute(
+                "SELECT grant_json FROM governed_credential_grants WHERE grant_id=?", (grant_id,)
+            ).fetchone()
+            if row is None:
+                raise GovernanceError("CREDENTIAL_SCOPE_DENY")
+            raw = json.loads(row[0])
+            grant = CredentialGrant(
+                grant_id=raw["grant_id"], credential_ref=raw["credential_ref"],
+                scope=GovernanceScope.from_value(raw), operations=tuple(raw["operations"]),
+                task_id=raw.get("task_id"), tool_name=raw.get("tool_name"),
+                expires_at=raw.get("expires_at"),
+            )
+            if trace.scope != grant.scope:
+                raise GovernanceError("CREDENTIAL_SCOPE_DENY", field="trace_scope")
+            reference = grant.authorize(
+                actor, operation=operation, task_id=task_id, tool_name=tool_name, now=now
+            )
+            evidence = self._audit(
+                connection, action="CREDENTIAL_AUTHORIZED", actor=actor,
+                resource_id=grant_id, outcome="ALLOW", trace=trace,
+                details={"operation": operation, "task_id": task_id, "tool_name": tool_name,
+                         "credential_ref_sha256": _sha(reference)},
+            )
+        return {"credential_ref": reference, "evidence": evidence}
+
+    def verify_audit_chain(self, required_actions: Iterable[str] = ()) -> bool:
+        ordered_actions: list[str] = []
+        previous = ""
+        with self._connection() as connection:
+            rows = connection.execute("SELECT * FROM governance_audit_evidence ORDER BY sequence").fetchall()
+        for row in rows:
+            details = json.loads(row["details_json"])
+            material = {
+                "action": row["action"], "actor_identity": row["actor_identity"],
+                "trace_id": row["trace_id"], "span_id": row["span_id"],
+                "resource_id": row["resource_id"], "outcome": row["outcome"],
+                "details": details, "previous_sha256": row["previous_sha256"],
+                "created_at": row["created_at"],
+            }
+            if row["previous_sha256"] != previous or row["evidence_sha256"] != _sha(material):
+                return False
+            previous = row["evidence_sha256"]
+            ordered_actions.append(row["action"])
+        position = 0
+        for required in required_actions:
+            try:
+                position = ordered_actions.index(required, position) + 1
+            except ValueError:
+                return False
+        return True
+
+
+__all__ = [
+    "CredentialGrant", "GovernanceActor", "GovernanceError", "GovernanceScope",
+    "GovernanceStore", "ToolDescriptor", "TraceContext", "authorize_scope",
+    "bind_trace_lineage",
+]

active-runtime/app/v2r2c1_production_adapter.py

@@ -0,0 +1,135 @@
+"""V2R2C1 adapter using the existing V2R1C7 deployment primitives.
+
+The service identity and loopback port remain stable for a safe cutover.  The
+new release is installed under its own immutable directory and keeps the
+previous V2R1C7 release available for an explicit, owner-approved rollback.
+"""
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import sys
+from argparse import Namespace
+from pathlib import Path
+from typing import Any, Mapping
+
+import v2r1c7_production_adapter as base
+
+
+VERSION = "V2R2C1"
+SERVICE = "aios-v2r1c7-production.service"
+PORT = 18927
+RELEASE_ROOT = Path("/opt/aios/releases")
+CURRENT_LINK = Path("/opt/aios/v2r2c1")
+ENV_FILE = Path("/etc/aios/aios-v2r2c1.env")
+STATE_FILE = Path("/var/lib/aios/v2r2c1/deployment-state.json")
+UNIT_FILE = Path("/etc/systemd/system/aios-v2r1c7-production.service")
+ROLLBACK_ROOT = Path("/var/lib/aios/v2r2c1/rollback")
+
+REQUIRED_MEMBERS = {
+    "payload/VERSION",
+    "payload/active-runtime/app/deployment_state.py",
+    "payload/active-runtime/app/v2r1c6_privacy_tools.py",
+    "payload/active-runtime/app/v2r2c1_health_service.py",
+    "payload/deploy/aios-v2/systemd/aios-v2r1c7-production.service",
+    "payload/deploy/aios-v2/v2r2c1-runtime-config.json",
+    "payload/deploy/aios-v2/v2r2c1-rollback.json",
+    "payload/scripts/probe_v2r2c1_health.py",
+    "payload/scripts/rollback_v2r2c1_release.sh",
+    "payload/BUILD-METADATA.json",
+    "payload/ARTIFACT-MANIFEST.json",
+    "payload/ROLLBACK-METADATA.json",
+}
+
+
+def _configure_base() -> None:
+    base.VERSION = VERSION
+    base.SERVICE = SERVICE
+    base.PORT = PORT
+    base.REQUIRED_MEMBERS = REQUIRED_MEMBERS
+
+
+def _args() -> Namespace:
+    return Namespace(
+        release_root=RELEASE_ROOT,
+        current_link=CURRENT_LINK,
+        env_file=ENV_FILE,
+        state_file=STATE_FILE,
+        unit_file=UNIT_FILE,
+        health_timeout=45,
+    )
+
+
+def load_request() -> dict[str, Any]:
+    _configure_base()
+    value = base.load_request()
+    if value.get("version") != VERSION or value.get("production_service") != SERVICE or int(value.get("production_port", -1)) != PORT:
+        raise ValueError("V2R2C1 production binding mismatch")
+    return value
+
+
+def _backup(path: Path, name: str) -> None:
+    if path.is_file() and not path.is_symlink():
+        ROLLBACK_ROOT.mkdir(parents=True, exist_ok=True)
+        destination = ROLLBACK_ROOT / name
+        if not destination.exists():
+            shutil.copy2(path, destination)
+
+
+def execute_request(value: Mapping[str, Any]) -> dict[str, Any]:
+    _configure_base()
+    if value.get("schema") != "aios.production-executor-request.v1":
+        raise ValueError("request_schema_invalid")
+    if value.get("operation") == "apply":
+        _backup(UNIT_FILE, "aios-v2r1c7-production.service.previous")
+        _backup(Path("/etc/aios/aios-v2r1c7.env"), "aios-v2r1c7.env.previous")
+        _backup(Path("/var/lib/aios/v2r1c7/deployment-state.json"), "v2r1c7-deployment-state.previous")
+        return base.install_release(_args(), value)
+    if value.get("operation") == "probe":
+        return base.probe(_args(), value)
+    if value.get("operation") == "rollback":
+        return rollback(value)
+    raise ValueError("unsupported_operation")
+
+
+def rollback(value: Mapping[str, Any]) -> dict[str, Any]:
+    """Explicit rollback only; this adapter never invokes it automatically."""
+    import subprocess
+
+    subprocess.run(["systemctl", "stop", SERVICE], check=False, capture_output=True, text=True, timeout=45)
+    previous_unit = ROLLBACK_ROOT / "aios-v2r1c7-production.service.previous"
+    previous_env = ROLLBACK_ROOT / "aios-v2r1c7.env.previous"
+    previous_state = ROLLBACK_ROOT / "v2r1c7-deployment-state.previous"
+    if not previous_unit.is_file() or not previous_env.is_file():
+        raise RuntimeError("ROLLBACK_RECEIPT_MISSING")
+    UNIT_FILE.parent.mkdir(parents=True, exist_ok=True)
+    ENV_FILE.parent.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(previous_unit, UNIT_FILE)
+    shutil.copy2(previous_env, Path("/etc/aios/aios-v2r1c7.env"))
+    if previous_state.is_file():
+        Path("/var/lib/aios/v2r1c7").mkdir(parents=True, exist_ok=True)
+        shutil.copy2(previous_state, Path("/var/lib/aios/v2r1c7/deployment-state.json"))
+    subprocess.run(["systemctl", "daemon-reload"], check=True, capture_output=True, text=True, timeout=45)
+    subprocess.run(["systemctl", "restart", SERVICE], check=True, capture_output=True, text=True, timeout=45)
+    result = base.health("http://127.0.0.1:18927/health", {
+        "version": "V2R1C7",
+        "target_oid": str(json.loads(Path("/var/lib/aios/v2r1c7/deployment-state.json").read_text(encoding="utf-8")).get("commit_oid")),
+        "artifact_sha256": str(json.loads(Path("/var/lib/aios/v2r1c7/deployment-state.json").read_text(encoding="utf-8")).get("artifact_sha256")),
+    })
+    return {"status": "ROLLED_BACK", "rollback_health": result, "automatic_rollback": False}
+
+
+def main() -> int:
+    try:
+        value = load_request()
+        result = execute_request(value)
+        print(json.dumps(result, sort_keys=True))
+        return 0
+    except Exception as exc:
+        print(json.dumps({"status": "FAIL_CLOSED", "error": type(exc).__name__, "reason": str(exc)}, sort_keys=True))
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

db/migrations/20260817_message_handoff.sql

@@ -0,0 +1,36 @@
+-- R4.2 P0-B durable Message/Handoff Fabric.
+-- Forward-only. The existing 20260707 message_outbox remains a compatibility source.
+
+CREATE TABLE IF NOT EXISTS message_handoff (
+  envelope_id TEXT PRIMARY KEY,
+  stream_key TEXT NOT NULL,
+  source TEXT NOT NULL,
+  target TEXT NOT NULL,
+  message_type TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  payload_sha256 TEXT NOT NULL,
+  tenant_id TEXT,
+  user_id TEXT,
+  project_id TEXT,
+  conversation_id TEXT,
+  task_id TEXT,
+  run_id TEXT,
+  causation_id TEXT,
+  sequence INTEGER NOT NULL CHECK(sequence >= 1),
+  capability_scope_json TEXT NOT NULL,
+  confidentiality_scope TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  expires_at TEXT,
+  created_at TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'PENDING',
+  delivered_at TEXT,
+  acked_at TEXT,
+  UNIQUE(stream_key, idempotency_key),
+  UNIQUE(stream_key, sequence)
+);
+
+CREATE INDEX IF NOT EXISTS idx_message_handoff_target_status
+  ON message_handoff(target, status, created_at);
+
+CREATE INDEX IF NOT EXISTS idx_message_handoff_scope
+  ON message_handoff(tenant_id, project_id, user_id, conversation_id, run_id);

deploy/systemd/aios-agent-task-retry-extension.service

@@ -0,0 +1,36 @@
+[Unit]
+Description=AIOS owner-controlled Task retry-extension API
+After=aios-agent-task-api.service
+Wants=aios-agent-task-api.service
+
+[Service]
+Type=simple
+User=aios-agent-task
+Group=aios-agent-task
+LoadCredential=agent_task_control_token:/etc/aios-gitops/agent-task-control.token
+EnvironmentFile=/etc/aios-gitops/agent-task-retry-extension.env
+Environment=AIOS_AGENT_TASK_DB=/var/lib/aios-agent-task/state.sqlite3
+Environment=AIOS_AGENT_TASK_CONTROL_TOKEN_FILE=%d/agent_task_control_token
+Environment=AIOS_TASK_RETRY_HOST=127.0.0.1
+Environment=AIOS_TASK_RETRY_PORT=18941
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_agent_task_retry_extension.py
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET
+ReadWritePaths=/var/lib/aios-agent-task
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-gitops-model-api-v2r2c1-staging.service

@@ -0,0 +1,51 @@
+[Unit]
+Description=AIOS GitOps Model API V2R2C1 immutable staging runtime
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=aiman
+Group=gitops
+WorkingDirectory=@RUNTIME_ROOT@
+Environment=PYTHONUNBUFFERED=1
+Environment=PYTHONDONTWRITEBYTECODE=1
+Environment=AIOS_GITOPS_ROOT=/var/lib/aios-gitops
+Environment=AIOS_GITOPS_WORKSPACE=@RUNTIME_ROOT@
+Environment=AIOS_GITOPS_REPO=/data/aios-gitops/repo.git
+Environment=AIOS_GITOPS_BARE_REPO=/data/aios-gitops/repo.git
+Environment=AIOS_GITOPS_AUTHORITATIVE_GIT_DIR=/data/aios-gitops/repo.git
+Environment=AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
+Environment=AIOS_GITOPS_BASELINE_AUTHORITY=/var/lib/aios-gitops-runtime-anchor/baseline/current.json
+Environment=AIOS_GITOPS_WRITES_ENABLED=false
+Environment=AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED=false
+Environment=AIOS_GITOPS_JOB_CONTROLLER_ENABLED=false
+Environment=AIOS_GITOPS_WORKSPACE_ROLE=runtime-anchor
+Environment=AIOS_GITOPS_RUNTIME_OID=@SOURCE_OID@
+Environment=AIOS_GITOPS_ARTIFACT_SHA256=@ARTIFACT_SHA256@
+Environment=AIOS_GITOPS_DEPLOYMENT_STATE=STAGING
+Environment=AIOS_GITOPS_MODEL_API_SERVICE=aios-gitops-model-api-v2r2c1-staging.service
+Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
+Environment=AIOS_SILENT_RELEASE_STATE_ROOT=/var/lib/aios-gitops/model-api-staging/silent-release
+Environment=AIOS_BRIDGE_V2_URL=http://127.0.0.1:18892
+Environment=AIOS_GITOPS_HOST=127.0.0.1
+Environment=AIOS_GITOPS_PORT=18893
+Environment=PYTHONPATH=@RUNTIME_ROOT@/app:@RUNTIME_ROOT@/runtime-agent-os
+ExecStart=/usr/bin/python3 @RUNTIME_ROOT@/app/aios_model_api_staging.py
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadOnlyPaths=@RUNTIME_ROOT@ /data/aios-gitops/repo.git /var/lib/aios-gitops-runtime-anchor/baseline
+ReadWritePaths=/var/lib/aios-gitops/model-api-staging
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-online-agent-isolated-executor.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=AIOS uncredentialed deterministic Planner/Executor
+After=local-fs.target
+
+[Service]
+Type=simple
+User=aios-engineering-executor
+Group=aios-executor-exchange
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_isolated_executor.py --root /var/lib/aios-online-agent-executor
+Restart=always
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateNetwork=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET
+IPAddressDeny=any
+IPAddressAllow=localhost
+InaccessiblePaths=/run/credentials
+ReadWritePaths=/var/lib/aios-online-agent-executor
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/aios-online-agent-worker.service

@@ -0,0 +1,46 @@
+[Unit]
+Description=AIOS governed Online Agent Worker
+After=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+Wants=aios-agent-task-api.service aios-chatgpt-bridge-v2-staging.service
+
+[Service]
+Type=simple
+User=aios-engineering-worker
+Group=aios-engineering-worker
+SupplementaryGroups=gitops aios-executor-exchange
+LoadCredentialEncrypted=agent_token:/etc/credstore.encrypted/aios-online-agent-worker-20260815/agent_token
+Environment=PYTHONUNBUFFERED=1
+Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
+Environment=AIOS_GOVERNED_WRITE_API_URL=http://127.0.0.1:18892
+Environment=AIOS_AGENT_ID=online-engineering-worker
+Environment=AIOS_AGENT_TYPE=trusted-online-engineering-worker
+Environment=AIOS_AGENT_VERSION=2026-08-17.2-durable
+Environment=AIOS_WORKER_CAPABILITIES=git.read,git.test,governed.write.branch,governed.write.file
+Environment=AIOS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
+Environment=AIOS_ISOLATED_EXECUTOR_ROOT=/var/lib/aios-online-agent-executor
+Environment=AIOS_WORKER_STATE_ROOT=/var/lib/aios-online-agent-worker
+Environment=AIOS_WORKER_CHECKPOINT_DB=/var/lib/aios-online-agent-worker/checkpoints.sqlite3
+Environment=AIOS_WORKER_WORKSPACE_ROOT=/var/lib/aios-online-agent-worker/workspaces
+ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_online_agent_worker.py
+Restart=always
+RestartSec=5
+TimeoutStopSec=20
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadOnlyPaths=/data/aios-gitops/repo.git
+ReadWritePaths=/var/lib/aios-online-agent-worker
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

deploy/sysusers.d/aios-online-agent-executor.conf

@@ -0,0 +1,4 @@
+g aios-executor-exchange -
+u aios-engineering-executor - "AIOS isolated engineering executor" /var/lib/aios-online-agent-executor /usr/sbin/nologin
+m aios-engineering-executor aios-executor-exchange
+m aios-engineering-worker aios-executor-exchange

deploy/tmpfiles.d/aios-online-agent-executor.conf

@@ -0,0 +1,5 @@
+d /var/lib/aios-online-agent-executor 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/requests 2770 aios-engineering-worker aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/results 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/failed 2770 aios-engineering-executor aios-executor-exchange -
+d /var/lib/aios-online-agent-executor/sources 2770 aios-engineering-worker aios-executor-exchange -

docs/gitops/openapi-authorized-task-writer-fragment.yaml

@@ -1,20 +1,6 @@
 # Merge this fragment into docs/gitops/openapi-chatgpt-actions.yaml.
 components:
   schemas:
-    WriterLeaseRequestV2:
-      type: object
-      additionalProperties: false
-      required: [schema, task_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds]
-      properties:
-        schema: {type: string, const: aios.task-writer-lease.v2}
-        task_id: {type: string}
-        repository: {type: string, const: aios/aios}
-        branch_mode: {type: string, const: CONTINUE_EXISTING}
-        base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
-        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
-        target_branch: {type: string, pattern: '^agent/'}
-        generation: {type: integer, minimum: 1}
-        lease_seconds: {type: integer, minimum: 1, maximum: 86400}
     AuthorizedTaskWriterProvisionRequest:
       type: object
       additionalProperties: false
@@ -104,20 +90,6 @@ components:
               - production_marker_write
               - history_rewrite
 
-  ControlPlaneSnapshot:
-    type: object
-    additionalProperties: false
-    required: [version, runtime, repository, production, task, capabilities, credential_broker, secret_material_exposed]
-    properties:
-      version: {type: object}
-      runtime: {type: object}
-      repository: {type: object}
-      production: {type: object}
-      task: {type: object}
-      capabilities: {type: object}
-      credential_broker: {type: object}
-      secret_material_exposed: {type: boolean, const: false}
-
 paths:
   /api/task-writer/provision-authorized:
     post:
@@ -147,10 +119,3 @@ paths:
           description: Base drift, branch conflict, or idempotency scope conflict
         '503':
           description: Signer, validator, provisioner, or attestation unavailable
-
-  /v2/control-plane-snapshot:
-    get:
-      operationId: getControlPlaneSnapshot
-      responses:
-        '200':
-          description: Non-sensitive control-plane snapshot

docs/gitops/openapi-chatgpt-actions.yaml

@@ -240,6 +240,114 @@ components:
       additionalProperties: false
       properties:
         candidate_id: {type: string}
+    BridgeWriterLeaseRecoveryRequest:
+      type: object
+      additionalProperties: false
+      required: [schema, task_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds]
+      properties:
+        schema:
+          type: string
+          enum: [aios.task-writer-lease.v2, aios.task-writer-lease-request.v2]
+        task_id: {type: string, minLength: 1, maxLength: 256}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
+        base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        lease_seconds: {type: integer, minimum: 1, maximum: 86400}
+    BridgeWriterLeaseResponse:
+      type: object
+      additionalProperties: false
+      required: [schema, task_id, job_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds, create_target_branch, worktree_mode, cas_ref_update_required]
+      properties:
+        schema: {type: string, enum: [aios.task-writer-lease.v2]}
+        task_id: {type: string}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
+        base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        lease_seconds: {type: integer, minimum: 1, maximum: 86400}
+        create_target_branch: {type: boolean}
+        worktree_mode: {type: string, enum: [detached_at_base_oid, detached_at_expected_head]}
+        cas_ref_update_required: {type: boolean, const: true}
+        lease_expires_at: {type: string, format: date-time}
+    BridgeWriterLeaseRecoveryResponse:
+      type: object
+      additionalProperties: false
+      required: [schema, task_id, job_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds, lease_expires_at, create_target_branch, worktree_mode, cas_ref_update_required, recovered, bootstrapped, idempotent, runtime_rehydrated, durable_branch_lease_present]
+      properties:
+        schema: {type: string, enum: [aios.task-writer-lease.v2]}
+        task_id: {type: string}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
+        base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        lease_seconds: {type: integer, minimum: 1, maximum: 86400}
+        lease_expires_at: {type: string, format: date-time}
+        create_target_branch: {type: boolean, const: false}
+        worktree_mode: {type: string, enum: [detached_at_base_oid, detached_at_expected_head]}
+        cas_ref_update_required: {type: boolean, const: true}
+        recovered: {type: boolean}
+        bootstrapped: {type: boolean}
+        idempotent: {type: boolean}
+        runtime_rehydrated: {type: boolean}
+        durable_branch_lease_present: {type: boolean}
+    BridgeCommitFileRequest:
+      type: object
+      additionalProperties: false
+      required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, path, content_base64, message]
+      properties:
+        task_id: {type: string, minLength: 1}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        idempotency_key: {type: string, minLength: 1, maxLength: 256}
+        path: {type: string, minLength: 1, maxLength: 512}
+        content_base64: {type: string, format: byte}
+        message: {type: string, minLength: 1, maxLength: 200}
+    BridgeCommitFilesRequest:
+      type: object
+      additionalProperties: false
+      required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, files, message]
+      properties:
+        task_id: {type: string, minLength: 1}
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        repository: {type: string, const: aios/aios}
+        expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+        idempotency_key: {type: string, minLength: 1, maxLength: 256}
+        files: {type: object, additionalProperties: {type: string, format: byte}, minProperties: 1}
+        message: {type: string, minLength: 1, maxLength: 200}
+    BridgeCommitResponse:
+      type: object
+      additionalProperties: true
+      required: [job_id, commit_oid, commit_visible, branch_mode, target_branch, generation]
+      properties:
+        job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
+        commit_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
+        commit_visible: {type: boolean}
+        branch_mode: {type: string, enum: [CONTINUE_EXISTING]}
+        target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
+        generation: {type: integer, minimum: 1}
+    BridgeGovernedCapabilities:
+      type: object
+      required: [bridge_schema_version, governed_writes_enabled, operations, operation_contracts]
+      properties:
+        bridge_schema_version: {type: string, const: aios.chatgpt-gitops-bridge.v2}
+        governed_writes_enabled: {type: boolean, const: true}
+        operations: {type: array, items: {type: string}}
+        operation_contracts: {type: object, additionalProperties: true}
 paths:
   /createReleaseIntent:
     post:
@@ -567,53 +675,118 @@ paths:
         '200': {description: Safe GitOps plan}
         '401': {description: Unauthorized}
       x-openai-isConsequential: true
-  /api/v2/governed-capabilities:
+  /v2/capabilities:
     get:
       operationId: getGovernedWriteCapabilities
-      responses: {'200': {description: Governed write capabilities with legacy writes disabled}}
-  /api/v2/governed-task:
-    post:
-      operationId: createGovernedTask
-      requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [task_id, repository, base_oid, target_branch, risk, description, idempotency_key], properties: {task_id: {type: string}, repository: {type: string, const: aios/aios}, base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}, target_branch: {type: string, pattern: '^agent/'}, risk: {type: string}, description: {type: string}, idempotency_key: {type: string}}}}}}
-      responses: {'200': {description: Exact governed task binding}}
-      x-openai-isConsequential: true
-  /api/v2/writer-lease:
+      summary: Read the governed Bridge v2 capability contract
+      responses:
+        '200':
+          description: Governed operations and their request/response contracts
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeGovernedCapabilities'}
+  /v2/writer-lease:
     post:
       operationId: acquireWriterLease
-      requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [schema, task_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds], properties: {schema: {type: string}, task_id: {type: string}, repository: {type: string, const: aios/aios}, branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}, base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}, expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}, target_branch: {type: string, pattern: '^agent/'}, generation: {type: integer, minimum: 1}, lease_seconds: {type: integer, minimum: 1, maximum: 86400}}}}}}
-      responses: {'200': {description: Detached CONTINUE_EXISTING lease}}
+      summary: Acquire the exact governed writer lease for a task generation
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
+      responses:
+        '200':
+          description: Exact detached worktree lease binding
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeWriterLeaseResponse'}
+        '400': {description: Invalid lease binding}
+        '409': {description: Branch, base, or generation conflict}
       x-openai-isConsequential: true
-  /api/v2/commit-file:
+  /v2/writer-lease/bootstrap:
+    post:
+      operationId: bootstrapWriterLease
+      summary: Bootstrap a governed writer runtime without creating a durable lease
+      description: >
+        Staging-only runtime recovery. It validates the exact task, repository,
+        base OID, expected branch OID, target branch, and generation. It must
+        not create a branch, insert a branch lease, or consume a generation.
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
+      responses:
+        '200':
+          description: Runtime binding bootstrapped or returned idempotently
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryResponse'}
+        '400': {description: Invalid lease binding}
+        '409': {description: A matching durable lease already exists or binding conflicts}
+        '503': {description: Runtime or durable state unavailable}
+      x-openai-isConsequential: true
+  /v2/writer-lease/renew:
+    post:
+      operationId: renewWriterLease
+      summary: Recover an expired governed writer lease without changing its binding
+      description: >
+        Renews only the current task generation and exact repository, base OID,
+        expected branch OID, and target branch. Durable renewal is revision-CAS
+        protected; runtime rehydration is reported separately.
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
+      responses:
+        '200':
+          description: Lease recovered or idempotently observed as already active
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryResponse'}
+        '400': {description: Invalid schema, generation, or lease duration}
+        '409': {description: Task, base, repository, branch, generation, or durable lease conflict}
+        '503': {description: Durable job store or runtime unavailable}
+      x-openai-isConsequential: true
+  /v2/commit-file:
     post:
       operationId: commitFileGoverned
-      requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, path, content_base64, message], properties: {task_id: {type: string}, repository: {type: string, const: aios/aios}, expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}, target_branch: {type: string, pattern: '^agent/'}, generation: {type: integer, minimum: 1}, idempotency_key: {type: string}, path: {type: string}, content_base64: {type: string}, message: {type: string}}}}}}
-      responses: {'202': {description: Durable governed Job}}
+      summary: Commit one file through the governed writer lease
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeCommitFileRequest'}
+      responses:
+        '200':
+          description: Authority and remote visibility receipt
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeCommitResponse'}
+        '409': {description: Lease, expected-head, idempotency, or repository conflict}
+        '503': {description: Reconciliation required}
       x-openai-isConsequential: true
-  /api/v2/commit-files:
+  /v2/commit-files:
     post:
       operationId: commitFilesGoverned
-      requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, files, message], properties: {task_id: {type: string}, repository: {type: string, const: aios/aios}, expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}, target_branch: {type: string, pattern: '^agent/'}, generation: {type: integer, minimum: 1}, idempotency_key: {type: string}, files: {type: object, additionalProperties: {type: string}}, message: {type: string}}}}}}
-      responses: {'202': {description: One atomic multi-file governed Job}}
+      summary: Atomically commit a bounded set of files through the governed writer lease
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/BridgeCommitFilesRequest'}
+      responses:
+        '200':
+          description: Authority and remote visibility receipt
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/BridgeCommitResponse'}
+        '409': {description: Lease, expected-head, idempotency, or repository conflict}
+        '503': {description: Reconciliation required}
       x-openai-isConsequential: true
-  /api/v2/job:
-    post:
-      operationId: getGitOpsJob
-      requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [job_id], properties: {job_id: {type: string}}}}}}
-      responses: {'200': {description: Non-sensitive Job metadata}}
-  /api/v2/job/resume:
-    post:
-      operationId: resumeGitOpsJob
-      requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [job_id, expected_revision], properties: {job_id: {type: string}, expected_revision: {type: integer, minimum: 0}}}}}}
-      responses: {'202': {description: Revision-CAS resume}}
-      x-openai-isConsequential: true
-  /api/v2/job/reconcile:
-    post:
-      operationId: reconcileGitOpsJob
-      requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [job_id, expected_revision], properties: {job_id: {type: string}, expected_revision: {type: integer, minimum: 0}}}}}}
-      responses: {'202': {description: Observation-first reconciliation}}
-      x-openai-isConsequential: true
-
-  /v2/control-plane-snapshot:
-    get:
-      operationId: getControlPlaneSnapshot
-      responses: {'200': {description: Non-sensitive control-plane snapshot}}

docs/superpowers/specs/2026-08-16-r42-p0a-taskplane-scope-isolation-design.md

@@ -0,0 +1,54 @@
+# R4.2 P0-A TaskPlane Scope Isolation Design
+
+Status: approved candidate design. This document is not evidence of a protected-main merge or production deployment.
+
+## Boundary
+
+- Task: `r42-p0a-taskplane-scope-isolation-20260816`
+- Governed Job: `job-3fd743b51971c6007923699c1233f84c`
+- Repository: `aios/aios`
+- Base: `0eb6e1a864edfdaeef37b438991707a110e21558`
+- Target branch: `agent/r42-p0a-taskplane-scope-isolation-20260816`
+- Generation: `1`
+
+The implementation reuses this exact boundary. It does not create a replacement Task, Job, branch, generation, or idempotency key.
+
+## Model and invariants
+
+`TaskPlan` gains first-class `scope_type`, `tenant_id`, `user_id`, `project_id`, `conversation_id`, and `run_id` fields. The fields participate in accepted-key validation, parsing, serialization, persistence, and authorization.
+
+Historical rows without scope data normalize to `scope_type=legacy`; no tenant is inferred. Tenant-scoped tasks require a non-empty `tenant_id`. System/global resources use an explicit `scope_type=system` invariant and do not receive a fabricated tenant. A task may add user, project, conversation, and run ownership within its tenant.
+
+## Trusted ActorContext
+
+TaskPlane defines a small immutable `TaskActorContext` used only for authorization. The HTTP authenticator returns an identity. `PolicyEngine` resolves that identity through server-owned policy configuration into the effective context and capabilities. Request fields such as `tenant_id`, `user_id`, `group_id`, and `role` are declarations only and never expand authority.
+
+Public create, list, and get paths always use the resolved context. Internal compatibility calls may omit a context and retain explicit legacy behavior, but the HTTP adapter never uses that path.
+
+## Persistence
+
+SQLite remains the current runtime. `_create_schema()` performs an idempotent forward migration that adds the six scope columns and indexes, then backfills only missing `scope_type` values to `legacy`.
+
+New writes persist scope in both the canonical `task_json` representation and first-class columns. Reads accept historical JSON without scope, using legacy columns, but reject a new-row mismatch between JSON and columns. SQL list/get predicates are parameterized and applied before row hydration.
+
+PostgreSQL remains a separate migration target and is not claimed by this change.
+
+## Authorization flow
+
+1. HTTP bearer authentication yields an identity.
+2. `PolicyEngine` verifies capability and resolves the identity to `TaskActorContext`.
+3. Create binds the requested scope to the trusted context and rejects mismatches.
+4. List/get pass the trusted context to `TaskPlaneStore`.
+5. Store applies tenant and ownership predicates in SQL; privileged capabilities may explicitly cross scope.
+
+Tenant actors cannot read legacy tasks, another tenant, or mismatched owned resources. Legacy actors can only read legacy tasks. System actors require explicit privileged capability for cross-scope access.
+
+## Failure behavior
+
+Missing tenant scope, forged scope, unknown scope types, JSON/column divergence, and unauthorized list/get operations fail closed with canonical TaskPlane errors. Public get does not reveal whether an out-of-scope task exists.
+
+## Verification
+
+Tests exercise real model round trips, SQLite migration/restart, Service/Policy/Store wiring, tenant A versus tenant B list/get denial, ownership filtering, forged create payload rejection, legacy isolation, privileged access, and SQL parameterization. Existing TaskPlane API, RBAC, recovery/security, and security-contract suites remain mandatory.
+
+The candidate is complete only after real `TASK_CLAIMED`, `TASK_HEARTBEAT`, exact WriterLease, governed commit, OID convergence, result submission, and `TASK_VERIFIED`. Protected main and production remain unchanged.

docs/superpowers/specs/2026-08-17-r42-p0c-trace-tool-credential-governance.md

@@ -0,0 +1,90 @@
+# R4.2 P0-C Trace / Tool-MCP / Credential Governance
+
+## Status boundary
+
+This change is a candidate implementation on the governed P0-C branch. It does
+not promote protected `main`, deploy Production, or assert that all R4.2 target
+architecture is complete.
+
+## Scope model
+
+Governance resources use an explicit `scope_type`:
+
+- `tenant` requires `tenant_id` and may narrow to user, project,
+  conversation, and run;
+- `system` and `global` prohibit tenant ownership fields;
+- `legacy` preserves unscoped historical records without inventing ownership.
+
+System and global tools therefore never receive a synthetic tenant merely to
+satisfy a tenant-oriented schema.
+
+## Trace lineage
+
+`TaskPlan` and `MessageEnvelope` scope is bound to a `TraceContext`. The trace
+records `trace_id`, `span_id`, parent span, correlation, causation, task,
+message, and the canonical P0-A scope. Child spans must keep the parent's trace,
+task, and scope. Privileged visibility does not permit cross-scope trace
+splicing.
+
+`MessageEnvelope.correlation_id` is persisted and identity-bound. Existing
+handoff databases are upgraded in place with an idempotent column migration;
+legacy rows retain their prior event IDs because a null correlation field is
+not added to the historical identity material.
+
+Observability keeps its legacy presentation fields, but new governed records
+also carry immutable trace and scope fields. Scoped records require a trusted
+server actor for queries. A repeated execution ID is an idempotent replay only
+when the complete record matches; conflicting overwrites are denied.
+
+## Tool and MCP governance
+
+`ToolDescriptor` binds a tool or MCP server to:
+
+- an explicit resource scope;
+- required actor capabilities;
+- an optional credential reference.
+
+Invocation authorization requires exact propagation of the trace scope and a
+capability superset. Unknown tools, cross-tenant calls, scope substitution, and
+non-privileged access to system/global resources fail closed. Every successful
+registration and invocation appends hash-chained audit evidence.
+
+## Credential governance
+
+Credentials are represented only by references whose schemes are
+`systemd-credential`, `vault`, or `secret-manager`. Raw bearer tokens, passwords,
+and arbitrary values are rejected. Grants are bound to scope, operation, task,
+tool, and expiry. Public/audit records contain a reference hash where disclosure
+is unnecessary; secret material is never persisted by this module.
+
+The existing runtime credential broker remains backward compatible for system
+leases, adds explicit tenant/system/global invariants, and rejects providers
+that attempt to return raw token/secret/password environment values instead of
+file/reference indirection.
+
+## Durable evidence
+
+The SQLite governance store is restart-safe and idempotently initializes four
+tables: governed tools, trace spans, credential grants, and audit evidence.
+Audit entries form a SHA-256 chain. Acceptance requires the chain to verify and
+contain the required actions; missing evidence is not treated as success.
+
+## Acceptance tests
+
+The candidate must pass:
+
+- `TRACE_LINEAGE_CONTINUITY`;
+- `TRACE_SCOPE_MISMATCH_DENY`;
+- `TOOL_MCP_AUTHZ_DENY`;
+- `TOOL_SCOPE_PROPAGATION`;
+- `CREDENTIAL_SCOPE_DENY`;
+- `CREDENTIAL_SECRET_EXPOSURE_DENY`;
+- `AUDIT_EVIDENCE_COMPLETENESS`;
+- P0-A scope and P0-B handoff regression suites;
+- Python compilation, `git diff --check`, and a diff-scoped secret scan.
+
+The repository-wide baseline currently has seven unrelated failures in the
+isolated host environment (five stale continuation-contract fixtures and two
+host-permission fixtures). The same seven failures reproduce at the untouched
+`a642b045775b9154a00ae78543037fbef4fb447b` base; they are not suppressed or
+modified by P0-C.

docs/superpowers/specs/2026-08-17-r42-p1-durable-execution.md

@@ -0,0 +1,75 @@
+# R4.2 P1 — Durable Online Agent Execution
+
+Status: candidate implementation. This document does not imply protected-main promotion or Production deployment.
+
+## State model
+
+The generic worker uses two local durable layers:
+
+1. `tasks/<task_id>.json`: atomic fast-state cache for compatibility and quick restart.
+2. `checkpoints.sqlite3`: append-only attempt/phase journal with `synchronous=FULL`.
+
+Checkpoint identity is bound to:
+
+- task_id
+- attempt
+- execution_digest
+- job_id
+- repository
+- base_oid
+- expected_branch_oid
+- target_branch
+- generation
+
+A checkpoint from another repository/branch/generation is never reused.
+
+Phases are monotonic within an attempt:
+
+`claimed → workspace_prepared → verification_passed → source_capture_done|commit_done → result_pending → result_submitted`
+
+`reconciliation_required` is an explicit recovery phase.
+
+## Attempt-aware result idempotency
+
+Result submission idempotency keys include the official Task attempt and the execution digest. The same
+attempt reuses the same key after a timeout/restart; a later official attempt cannot collide with an
+earlier result.
+
+Before submitting a result the worker durably writes `result_pending`, including the result hash and
+idempotency key. After a successful or exact-idempotency-reconciled API response it writes
+`result_submitted`.
+
+A 409 is accepted only if the Task API already contains the exact same result body and the Task is
+VERIFYING/SUCCEEDED. A conflicting result remains a hard failure.
+
+## Resume rules
+
+- `source_capture_done` and `result_pending` may be reused across later official attempts only when the
+  execution/scope binding is identical. This avoids repeating read-only source capture.
+- A deterministic task that crashed before governed commit replays from a new clean detached worktree.
+  This is safe because there is no external side effect yet.
+- `commit_done` is never recommitted. Recovery requires exact Job receipt OID convergence plus exactly
+  one ACTIVE WriterLease whose `current_head_oid` equals the governed commit.
+- delayed Git visibility remains `RECONCILIATION_REQUIRED`, preserving an explicit recovery entry.
+
+## Crash cleanup
+
+On worker startup, stale `task-*` workspaces under the configured workspace root are removed before
+polling begins. The path boundary is verified before deletion.
+
+## Contracts
+
+P1 gates include:
+
+- CHECKPOINT_DURABLE_WRITE
+- RESUME_FROM_CHECKPOINT
+- RETRY_IDEMPOTENT_NO_DUPLICATE_SIDE_EFFECT
+- CRASH_RECOVERY_CONVERGENCE
+- WORKER_RESTART_RESUME
+- CHECKPOINT_SCOPE_ISOLATION
+- RESULT_SUBMISSION_REPLAY_SAFE
+- WORKSPACE_CLEANUP_RECOVERY
+- LEASE_RENEWAL_RECOVERY
+
+WriterLease and governed Job authority remain in the existing Bridge/GitOps durable stores; the worker
+checkpoint DB is not a competing authority for Git state.

docs/task-plane/r42-p0a-scope-isolation.md

@@ -0,0 +1,9 @@
+# R4.2 P0-A TaskPlane Scope Isolation
+
+Status: candidate implementation. This is not proof of protected-main promotion or production deployment.
+
+Task scope is now represented by `scope_type`, `tenant_id`, `user_id`, `project_id`, `conversation_id`, and `run_id` in the model and SQLite persistence. Historical rows become `legacy`; their tenant is never guessed. Tenant tasks require `tenant_id`. System resources use `scope_type=system` without a fabricated tenant.
+
+The HTTP adapter uses the authenticated identity. `PolicyEngine` resolves that identity through server-owned `identity_actor_contexts`; request payload fields do not grant scope. Public create binds the trusted scope, and public list/get apply parameterized scope predicates in `TaskPlaneStore`.
+
+SQLite is the current runtime database. PostgreSQL remains a separate migration and runtime-acceptance gate.

docs/task-plane/r42-p0b-message-handoff-fabric.md

@@ -0,0 +1,38 @@
+# R4.2 P0-B — Durable Message / Handoff Fabric
+
+Status: candidate implementation; not evidence of protected-main merge or Production deployment.
+
+`MessageEnvelope` is the single durable handoff identity and carries source/target/type, tenant/user/
+project/conversation/task/run scope, causation, sequence, capability scope, confidentiality scope,
+idempotency key, expiry and delivery state.
+
+Identity includes **target + scope + sequence + idempotency key + payload hash**, fixing the existing
+AgentEventBus target collision. Server ActorContext is authoritative; caller scope may narrow but may
+not widen/forge trusted tenant/user/project/conversation/run fields.
+
+`DurableHandoffStore` provides SQLite durability in the current runtime. Each logical stream has
+unique `(stream_key, idempotency_key)` and `(stream_key, sequence)`. Exact retry returns `REPLAY`;
+changed payload under the same key is rejected; sequence gaps are rejected; expired messages are not
+delivered.
+
+Confidentiality scopes:
+
+- public: no tenant requirement
+- tenant: same tenant
+- project: same tenant + project
+- private: same tenant + project + user
+- run: same tenant + project + user + run
+
+Required `capability_scope` must be present on the authenticated delivery actor unless the actor is
+explicitly administrative.
+
+Compatibility adapters convert AgentEventBus events, TaskPlane CloudEvents and legacy Agent OS
+MessageBus messages into the durable envelope. Existing message_outbox remains intact as a migration
+source; P0-B does not delete or silently rewrite it.
+
+Required gates:
+`MESSAGE_SCOPE_MISMATCH_DENY`, `MESSAGE_TARGET_COLLISION_DENY`, `MESSAGE_IDEMPOTENCY_REPLAY`,
+`MESSAGE_SEQUENCE_GAP_DETECT`, `MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE`,
+`HANDOFF_CROSS_TENANT_DENY`, plus existing P0-A TaskPlane scope/security regressions.
+
+SQLite remains current runtime persistence. PostgreSQL remains a separate migration gate.

pytest.ini

@@ -0,0 +1,4 @@
+[pytest]
+testpaths = tests
+python_files = test_*.py
+addopts = -ra --import-mode=importlib

reports/V2R2C1-mainline-convergence-acceptance-20260809.json

@@ -0,0 +1,243 @@
+{
+  "authority_proof": {
+    "branch_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+    "commit_visible": true,
+    "main_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
+    "v2r2c1_tag_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
+  },
+  "baseline_authority": {
+    "artifact_sha256": "492338b895b152a55015fd92ea1d9dba2314894ab00c0ba219a78f3cef544b8a",
+    "authority_sha256": "d8e23bad49bdb3e4192ba708c3dfe7fc5b7cdc6a513c2f87acd6412a51867231",
+    "current_baseline": "V2R2C1",
+    "raw_byte_sidecar_verification": "PASS",
+    "target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
+  },
+  "control_plane_source_oid": "b781129bd5a8b53c05ab648361424d2800166ee4",
+  "diff_stat": "active-runtime/app/aios_authority_git_executor.py  |   24 +\n active-runtime/app/aios_chatgpt_actions_api.py     |   48 +-\n active-runtime/app/aios_chatgpt_bridge_v2.py       |  167 ++++\n .../app/aios_chatgpt_bridge_v2_server.py           |  431 +++++++++\n active-runtime/app/aios_continuation_executor.py   |  594 ++++++++++++\n active-runtime/app/aios_continuation_lease.py      |    6 +\n active-runtime/app/aios_control_plane_snapshot.py  |   26 +\n active-runtime/app/aios_credential_broker.py       |   78 ++\n active-runtime/app/aios_gitea_publisher.py         |   93 ++\n active-runtime/app/aios_gitops_job_controller.py   |   16 +-\n .../app/aios_gitops_reconciliation_core.py         |   80 ++\n active-runtime/app/aios_governed_policy.py         |   59 ++\n active-runtime/app/aios_governed_task_bootstrap.py |   84 ++\n active-runtime/app/aios_model_api_staging.py       | 1022 ++++++++++++++++++++\n .../app/authorized_task_writer_provisioning.py     |    4 +-\n active-runtime/app/baseline_authority.py           |   84 ++\n active-runtime/app/governed_production_release.py  |  568 +++++++++++\n active-runtime/app/v2r2c1_production_adapter.py    |  135 +++\n .../systemd/aios-chatgpt-bridge-v2-staging.service |   23 +\n .../aios-gitops-model-api-v2r2c1-staging.service   |   51 +\n ...09-bridge-v2.1-durable-reconciliation-design.md |   15 +\n ...t-bridge-v2-control-plane-convergence-design.md |  150 +++\n pytest.ini                                         |    4 +\n scripts/build_v2r2c1_model_api_staging.py          |  145 +++\n .../aios_release_controller/manifest.py            |    4 +-\n .../test_v2r1c6_release_consistency.py             |    4 +-\n .../aios_v2_candidate/test_v2r1c6_release_ready.py |   16 +-\n tests/conftest.py                                  |   65 ++\n tests/test_bridge_v2_governed_http_bootstrap.py    |   90 ++\n tests/test_governed_local_writer.py                |    6 +-\n tests/test_model_api_immutable_staging.py          |   35 +\n 31 files changed, 4108 insertions(+), 19 deletions(-)",
+  "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
+  "forbidden_operations": [
+    "direct_main_push",
+    "main_merge_without_owner_approval",
+    "force_push",
+    "tag_mutation",
+    "baseline_mutation",
+    "registry_mutation",
+    "production_restart",
+    "production_cutover",
+    "live_model_api_cutover",
+    "history_rewrite",
+    "secret_commit"
+  ],
+  "governance": {
+    "baseline_modified": false,
+    "direct_main_push": false,
+    "force_push_used": false,
+    "history_rewritten": false,
+    "live_model_api_cutover": false,
+    "main_merged": false,
+    "owner_approval_respected": true,
+    "production_changed": false,
+    "production_restarted": false,
+    "registry_modified": false,
+    "secrets_committed": false,
+    "tag_rewritten": false
+  },
+  "included_path_count": 31,
+  "integration_branch": "agent/v2r2c1-post-release-mainline-convergence-20260809",
+  "integration_head_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+  "logical_commits": [
+    {
+      "message": "feat(v2r2c1): converge durable control-plane core",
+      "oid": "40b685d1c70c767c7a79a2b184348e58e3e319ae",
+      "parent_oid": "2e8fa22989808a448065d1d76b5b18948774a637"
+    },
+    {
+      "message": "docs(v2r2c1): converge durable runtime and design sources",
+      "oid": "5f616311bab38b0dac296ed8b0e69660e031a20e",
+      "parent_oid": "40b685d1c70c767c7a79a2b184348e58e3e319ae"
+    },
+    {
+      "message": "feat(v2r2c1): integrate governed release overlay",
+      "oid": "57780e316e320a5128cc2c9f12adbb19ae57aef5",
+      "parent_oid": "5f616311bab38b0dac296ed8b0e69660e031a20e"
+    },
+    {
+      "message": "feat(v2r2c1): wire governed release operations into durable bridge",
+      "oid": "e41b8d323a3e7a40440f5d32221f524074bea5fe",
+      "parent_oid": "57780e316e320a5128cc2c9f12adbb19ae57aef5"
+    },
+    {
+      "message": "test: repair canonical pytest repository entrypoint",
+      "oid": "b20cb8130e4c68267d5d85b02eed51cb8d4f41c0",
+      "parent_oid": "e41b8d323a3e7a40440f5d32221f524074bea5fe"
+    },
+    {
+      "message": "test: make whole-suite collection deterministic",
+      "oid": "c6a1693efaede9dace9b929d884a09e162a02c89",
+      "parent_oid": "b20cb8130e4c68267d5d85b02eed51cb8d4f41c0"
+    },
+    {
+      "message": "test: preserve legacy suite imports under canonical collection",
+      "oid": "91f2ea0591787d3dbf8c2e27ab0460629d86900e",
+      "parent_oid": "c6a1693efaede9dace9b929d884a09e162a02c89"
+    },
+    {
+      "message": "test: expose repository test helpers to canonical collection",
+      "oid": "85897d3f6d708271dff16767265f9d14b2f29801",
+      "parent_oid": "91f2ea0591787d3dbf8c2e27ab0460629d86900e"
+    },
+    {
+      "message": "fix(v2r2c1): close slash-branch and suite contract regressions",
+      "oid": "f1110d24f30d8441f2df04e0774ee230b95c2e02",
+      "parent_oid": "85897d3f6d708271dff16767265f9d14b2f29801"
+    },
+    {
+      "message": "test: align writer regression with durable idempotent replay",
+      "oid": "c10d2a5dfcc394dde7a7022952d7b423725747a3",
+      "parent_oid": "f1110d24f30d8441f2df04e0774ee230b95c2e02"
+    },
+    {
+      "message": "feat(v2r2c1): source baseline authority for model-api staging",
+      "oid": "f969aedaf61501a866435c712be01ff2cfe43fb1",
+      "parent_oid": "c10d2a5dfcc394dde7a7022952d7b423725747a3"
+    },
+    {
+      "message": "feat(v2r2c1): add immutable model api staging runtime",
+      "oid": "4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b",
+      "parent_oid": "f969aedaf61501a866435c712be01ff2cfe43fb1"
+    },
+    {
+      "message": "fix(v2r2c1): avoid builder secret-scan false positives",
+      "oid": "7c4e86bfc1f39e643e672968d1fdedbd72ace56d",
+      "parent_oid": "4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b"
+    },
+    {
+      "message": "fix(v2r2c1): isolate model api staging port",
+      "oid": "7564363a30bfa7fa81ac5c7c545ec704984ec543",
+      "parent_oid": "7c4e86bfc1f39e643e672968d1fdedbd72ace56d"
+    },
+    {
+      "message": "fix(v2r2c1): bind baseline authority and openapi staging path",
+      "oid": "2c6293160ed567a2098715edbb296741577c5bff",
+      "parent_oid": "7564363a30bfa7fa81ac5c7c545ec704984ec543"
+    }
+  ],
+  "main_base_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
+  "mandatory_gates": {
+    "baseline_registry_readback_staging_pass": true,
+    "durable_source_path_manifest_complete": true,
+    "existing_v2r2c1_suite_pass": true,
+    "governed_release_suite_pass": true,
+    "integration_authority_git_api_equal": true,
+    "integration_branch_governed": true,
+    "logical_slice_commits_remote_verified": true,
+    "main_base_exact_before_branch_create": true,
+    "model_api_immutable_runtime_staging_pass": true,
+    "owner_merge_request_generated_execute_false": true,
+    "production_unchanged": true,
+    "pytest_collection_entrypoints_fixed": true,
+    "pytest_tests_results_recorded": true
+  },
+  "model_api_staging": {
+    "artifact_sha256": "492338b895b152a55015fd92ea1d9dba2314894ab00c0ba219a78f3cef544b8a",
+    "baseline": {
+      "authority_sha256": "d8e23bad49bdb3e4192ba708c3dfe7fc5b7cdc6a513c2f87acd6412a51867231",
+      "current_baseline": "V2R2C1",
+      "deployment_state": "ACTIVE",
+      "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
+      "generation": 4,
+      "previous_baseline": "V2R1C7",
+      "production_deployed": true,
+      "status": "PRODUCTION_DEPLOYED",
+      "tag_oid": "07fc2746b688f5f243f29b39de39f32edc3dd9d2",
+      "target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
+    },
+    "baseline_status": 200,
+    "deployment_state": "STAGING",
+    "health": {
+      "artifact_sha256": "492338b895b152a55015fd92ea1d9dba2314894ab00c0ba219a78f3cef544b8a",
+      "commit_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+      "deployment_state": "STAGING",
+      "governed_release_routing": "bridge-v2",
+      "legacy_global_writes_enabled": false,
+      "production_deployed": false,
+      "runtime_mode": "IMMUTABLE_STAGING",
+      "status": "ok",
+      "version": "V2R2C1"
+    },
+    "health_status": 200,
+    "legacy_write_probe": "423_BLOCKED",
+    "port": 18893,
+    "restart_acceptance": "PASS",
+    "runtime_root": "/opt/aios/gitops-model-api/2c6293160ed567a2098715edbb296741577c5bff/runtime",
+    "source_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+    "systemd": "MainPID=788782\nExecStart={ path=/usr/bin/python3 ; argv[]=/usr/bin/python3 /opt/aios/gitops-model-api/2c6293160ed567a2098715edbb296741577c5bff/runtime/app/aios_model_api_staging.py ; ignore_errors=no ; start_time=[Sun 2026-08-09 19:11:19 CST] ; stop_time=[n/a] ; pid=788782 ; code=(null) ; status=0/0 }\nActiveState=active\nSubState=running",
+    "unit": "aios-gitops-model-api-v2r2c1-staging.service",
+    "versions": {
+      "authoritative_head_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
+      "baseline_generation": 4,
+      "baseline_sha256": "d8e23bad49bdb3e4192ba708c3dfe7fc5b7cdc6a513c2f87acd6412a51867231",
+      "baseline_version": "V2R2C1",
+      "query_error": null
+    },
+    "versions_status": 200
+  },
+  "owner_merge_request": {
+    "control_plane_source_oid": "b781129bd5a8b53c05ab648361424d2800166ee4",
+    "execute": false,
+    "integration_head_oid": "b2cf510e11b712bb99f20ded81459b6524257394",
+    "main_expected_old_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
+    "release_target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
+    "report_commit_oid": "b2cf510e11b712bb99f20ded81459b6524257394",
+    "status": "OWNER_APPROVAL_REQUIRED"
+  },
+  "placeholder_fields": [],
+  "production": {
+    "baseline_mutation": false,
+    "health": {
+      "artifact_sha256": "ab4ae257346c82863f05abf5e309381a1c86612957608c3a4f4ab5cc9233f052",
+      "commit_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
+      "deployment_state": "ACTIVE",
+      "health_timestamp": "2026-08-09T11:21:16.872581+00:00",
+      "production_deployed": true,
+      "status": "ok",
+      "version": "V2R2C1"
+    },
+    "health_status": 200,
+    "live_model_api_show": "MainPID=2816107\nActiveState=active\nSubState=running",
+    "live_model_api_unchanged": true,
+    "production_cutover": false,
+    "production_restart": false,
+    "registry_mutation": false,
+    "shadow_service_unchanged": true,
+    "shadow_show": "MainPID=1505658\nActiveState=active\nSubState=running",
+    "tag_mutation": false
+  },
+  "release_target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
+  "remote_proof": {
+    "api_branch_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+    "api_verification": "paginated_exact_name",
+    "commit_visible": true,
+    "git_remote_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+    "main_api_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
+    "main_git_oid": "2e8fa22989808a448065d1d76b5b18948774a637"
+  },
+  "report_commit_parent_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+  "repository": "aios/aios",
+  "schema": "aios.v2r2c1.post-release-mainline-convergence.acceptance.v1",
+  "status": "V2R2C1_MAINLINE_CONVERGENCE_READY_FOR_OWNER_MERGE",
+  "success_status": "V2R2C1_MAINLINE_CONVERGENCE_READY_FOR_OWNER_MERGE",
+  "task_id": "TASK-P0-V2R2C1-POST-RELEASE-MAINLINE-CONVERGENCE-20260809",
+  "tests": {
+    "collection": "PASS",
+    "command": "pytest tests",
+    "failed": 0,
+    "passed": 709,
+    "skipped": 2,
+    "skipped_tests": [
+      "tests/test_gitea_tag_publication_live.py (live opt-in)",
+      "tests/test_signer_contract_compatibility.py (live integration opt-in)"
+    ],
+    "subtests": 154
+  }
+}

reports/V2R2C1-mainline-convergence-diff-summary-20260809.md

@@ -0,0 +1,89 @@
+# V2R2C1 post-release mainline convergence diff summary
+
+- task: `TASK-P0-V2R2C1-POST-RELEASE-MAINLINE-CONVERGENCE-20260809`
+- repository: `aios/aios`
+- main base: `2e8fa22989808a448065d1d76b5b18948774a637`
+- release target: `998d30304787e31e5ae607c0bd86b5edb2b0e5ad`
+- control-plane source: `b781129bd5a8b53c05ab648361424d2800166ee4`
+- implementation integration head before this report commit: `2c6293160ed567a2098715edbb296741577c5bff`
+- branch: `agent/v2r2c1-post-release-mainline-convergence-20260809`
+
+## Logical governed commits
+
+| OID | Parent | Message |
+|---|---|---|
+| `40b685d1c70c767c7a79a2b184348e58e3e319ae` | `2e8fa22989808a448065d1d76b5b18948774a637` | feat(v2r2c1): converge durable control-plane core |
+| `5f616311bab38b0dac296ed8b0e69660e031a20e` | `40b685d1c70c767c7a79a2b184348e58e3e319ae` | docs(v2r2c1): converge durable runtime and design sources |
+| `57780e316e320a5128cc2c9f12adbb19ae57aef5` | `5f616311bab38b0dac296ed8b0e69660e031a20e` | feat(v2r2c1): integrate governed release overlay |
+| `e41b8d323a3e7a40440f5d32221f524074bea5fe` | `57780e316e320a5128cc2c9f12adbb19ae57aef5` | feat(v2r2c1): wire governed release operations into durable bridge |
+| `b20cb8130e4c68267d5d85b02eed51cb8d4f41c0` | `e41b8d323a3e7a40440f5d32221f524074bea5fe` | test: repair canonical pytest repository entrypoint |
+| `c6a1693efaede9dace9b929d884a09e162a02c89` | `b20cb8130e4c68267d5d85b02eed51cb8d4f41c0` | test: make whole-suite collection deterministic |
+| `91f2ea0591787d3dbf8c2e27ab0460629d86900e` | `c6a1693efaede9dace9b929d884a09e162a02c89` | test: preserve legacy suite imports under canonical collection |
+| `85897d3f6d708271dff16767265f9d14b2f29801` | `91f2ea0591787d3dbf8c2e27ab0460629d86900e` | test: expose repository test helpers to canonical collection |
+| `f1110d24f30d8441f2df04e0774ee230b95c2e02` | `85897d3f6d708271dff16767265f9d14b2f29801` | fix(v2r2c1): close slash-branch and suite contract regressions |
+| `c10d2a5dfcc394dde7a7022952d7b423725747a3` | `f1110d24f30d8441f2df04e0774ee230b95c2e02` | test: align writer regression with durable idempotent replay |
+| `f969aedaf61501a866435c712be01ff2cfe43fb1` | `c10d2a5dfcc394dde7a7022952d7b423725747a3` | feat(v2r2c1): source baseline authority for model-api staging |
+| `4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b` | `f969aedaf61501a866435c712be01ff2cfe43fb1` | feat(v2r2c1): add immutable model api staging runtime |
+| `7c4e86bfc1f39e643e672968d1fdedbd72ace56d` | `4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b` | fix(v2r2c1): avoid builder secret-scan false positives |
+| `7564363a30bfa7fa81ac5c7c545ec704984ec543` | `7c4e86bfc1f39e643e672968d1fdedbd72ace56d` | fix(v2r2c1): isolate model api staging port |
+| `2c6293160ed567a2098715edbb296741577c5bff` | `7564363a30bfa7fa81ac5c7c545ec704984ec543` | fix(v2r2c1): bind baseline authority and openapi staging path |
+
+## Exact diff stat
+
+```text
+active-runtime/app/aios_authority_git_executor.py  |   24 +
+ active-runtime/app/aios_chatgpt_actions_api.py     |   48 +-
+ active-runtime/app/aios_chatgpt_bridge_v2.py       |  167 ++++
+ .../app/aios_chatgpt_bridge_v2_server.py           |  431 +++++++++
+ active-runtime/app/aios_continuation_executor.py   |  594 ++++++++++++
+ active-runtime/app/aios_continuation_lease.py      |    6 +
+ active-runtime/app/aios_control_plane_snapshot.py  |   26 +
+ active-runtime/app/aios_credential_broker.py       |   78 ++
+ active-runtime/app/aios_gitea_publisher.py         |   93 ++
+ active-runtime/app/aios_gitops_job_controller.py   |   16 +-
+ .../app/aios_gitops_reconciliation_core.py         |   80 ++
+ active-runtime/app/aios_governed_policy.py         |   59 ++
+ active-runtime/app/aios_governed_task_bootstrap.py |   84 ++
+ active-runtime/app/aios_model_api_staging.py       | 1022 ++++++++++++++++++++
+ .../app/authorized_task_writer_provisioning.py     |    4 +-
+ active-runtime/app/baseline_authority.py           |   84 ++
+ active-runtime/app/governed_production_release.py  |  568 +++++++++++
+ active-runtime/app/v2r2c1_production_adapter.py    |  135 +++
+ .../systemd/aios-chatgpt-bridge-v2-staging.service |   23 +
+ .../aios-gitops-model-api-v2r2c1-staging.service   |   51 +
+ ...09-bridge-v2.1-durable-reconciliation-design.md |   15 +
+ ...t-bridge-v2-control-plane-convergence-design.md |  150 +++
+ pytest.ini                                         |    4 +
+ scripts/build_v2r2c1_model_api_staging.py          |  145 +++
+ .../aios_release_controller/manifest.py            |    4 +-
+ .../test_v2r1c6_release_consistency.py             |    4 +-
+ .../aios_v2_candidate/test_v2r1c6_release_ready.py |   16 +-
+ tests/conftest.py                                  |   65 ++
+ tests/test_bridge_v2_governed_http_bootstrap.py    |   90 ++
+ tests/test_governed_local_writer.py                |    6 +-
+ tests/test_model_api_immutable_staging.py          |   35 +
+ 31 files changed, 4108 insertions(+), 19 deletions(-)
+```
+
+## Included durable source domains
+
+- Bridge v2 adapter/server and governed HTTP contracts.
+- Durable reconciliation core, continuation executor/lease, Authority Git CAS adapter, job controller compatibility.
+- Gitea publisher/verifier, credential broker, governed policy, control-plane snapshot, release routing.
+- Canonical pytest entrypoint/conftest and regression coverage.
+- Source-controlled immutable model-api staging runtime, builder and systemd template.
+- Selected design specifications required for durable mainline context.
+
+## Explicitly excluded
+
+- `main` ref mutation or merge without Owner approval.
+- Production service, Registry, Baseline body/sidecar, production tags and mutable `/var/lib` state.
+- Installed `/opt` artifacts, temporary staging transition state and task-local receipts/credentials.
+- Production cutover/restart, force push, history rewrite and plaintext secrets.
+
+## Verification
+
+- `pytest tests`: **709 passed, 2 skipped, 154 subtests, 0 failed**.
+- Staging model-api: immutable OID/digest bound, port 18893, health/base/ver/OpenAPI readback PASS, restart recovery PASS.
+- Authority/Gitea Git/Gitea API commit equality and commit visibility PASS.
+- Production remains V2R2C1 and was not restarted or cut over.

reports/V2R2C1-mainline-convergence-path-manifest-20260809.json

@@ -0,0 +1,254 @@
+{
+  "control_plane_source_oid": "b781129bd5a8b53c05ab648361424d2800166ee4",
+  "diff_stat": "active-runtime/app/aios_authority_git_executor.py  |   24 +\n active-runtime/app/aios_chatgpt_actions_api.py     |   48 +-\n active-runtime/app/aios_chatgpt_bridge_v2.py       |  167 ++++\n .../app/aios_chatgpt_bridge_v2_server.py           |  431 +++++++++\n active-runtime/app/aios_continuation_executor.py   |  594 ++++++++++++\n active-runtime/app/aios_continuation_lease.py      |    6 +\n active-runtime/app/aios_control_plane_snapshot.py  |   26 +\n active-runtime/app/aios_credential_broker.py       |   78 ++\n active-runtime/app/aios_gitea_publisher.py         |   93 ++\n active-runtime/app/aios_gitops_job_controller.py   |   16 +-\n .../app/aios_gitops_reconciliation_core.py         |   80 ++\n active-runtime/app/aios_governed_policy.py         |   59 ++\n active-runtime/app/aios_governed_task_bootstrap.py |   84 ++\n active-runtime/app/aios_model_api_staging.py       | 1022 ++++++++++++++++++++\n .../app/authorized_task_writer_provisioning.py     |    4 +-\n active-runtime/app/baseline_authority.py           |   84 ++\n active-runtime/app/governed_production_release.py  |  568 +++++++++++\n active-runtime/app/v2r2c1_production_adapter.py    |  135 +++\n .../systemd/aios-chatgpt-bridge-v2-staging.service |   23 +\n .../aios-gitops-model-api-v2r2c1-staging.service   |   51 +\n ...09-bridge-v2.1-durable-reconciliation-design.md |   15 +\n ...t-bridge-v2-control-plane-convergence-design.md |  150 +++\n pytest.ini                                         |    4 +\n scripts/build_v2r2c1_model_api_staging.py          |  145 +++\n .../aios_release_controller/manifest.py            |    4 +-\n .../test_v2r1c6_release_consistency.py             |    4 +-\n .../aios_v2_candidate/test_v2r1c6_release_ready.py |   16 +-\n tests/conftest.py                                  |   65 ++\n tests/test_bridge_v2_governed_http_bootstrap.py    |   90 ++\n tests/test_governed_local_writer.py                |    6 +-\n tests/test_model_api_immutable_staging.py          |   35 +\n 31 files changed, 4108 insertions(+), 19 deletions(-)",
+  "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
+  "excluded_paths": [
+    {
+      "path": "refs/heads/main",
+      "reason": "main merge requires separate Owner approval; unchanged"
+    },
+    {
+      "path": "refs/tags/*",
+      "reason": "formal tags are outside engineering convergence scope; unchanged"
+    },
+    {
+      "path": "baseline/current.json and sidecar",
+      "reason": "production mutable authority and sidecar; read-only verified"
+    },
+    {
+      "path": "/var/lib/aios-gitops/**",
+      "reason": "host runtime state and receipts excluded from repository source"
+    },
+    {
+      "path": "/opt/aios/**",
+      "reason": "installed immutable staging artifacts excluded; digest recorded in reports"
+    },
+    {
+      "path": "credentials and secrets",
+      "reason": "availability-only; no plaintext credential committed"
+    },
+    {
+      "path": "production runtime and Registry",
+      "reason": "production cutover/registry mutation forbidden"
+    }
+  ],
+  "included_paths": [
+    {
+      "path": "active-runtime/app/aios_authority_git_executor.py",
+      "status": "M"
+    },
+    {
+      "path": "active-runtime/app/aios_chatgpt_actions_api.py",
+      "status": "M"
+    },
+    {
+      "path": "active-runtime/app/aios_chatgpt_bridge_v2.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/aios_chatgpt_bridge_v2_server.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/aios_continuation_executor.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/aios_continuation_lease.py",
+      "status": "M"
+    },
+    {
+      "path": "active-runtime/app/aios_control_plane_snapshot.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/aios_credential_broker.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/aios_gitea_publisher.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/aios_gitops_job_controller.py",
+      "status": "M"
+    },
+    {
+      "path": "active-runtime/app/aios_gitops_reconciliation_core.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/aios_governed_policy.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/aios_governed_task_bootstrap.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/aios_model_api_staging.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/authorized_task_writer_provisioning.py",
+      "status": "M"
+    },
+    {
+      "path": "active-runtime/app/baseline_authority.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/governed_production_release.py",
+      "status": "A"
+    },
+    {
+      "path": "active-runtime/app/v2r2c1_production_adapter.py",
+      "status": "A"
+    },
+    {
+      "path": "deploy/systemd/aios-chatgpt-bridge-v2-staging.service",
+      "status": "A"
+    },
+    {
+      "path": "deploy/systemd/aios-gitops-model-api-v2r2c1-staging.service",
+      "status": "A"
+    },
+    {
+      "path": "docs/superpowers/specs/2026-08-09-bridge-v2.1-durable-reconciliation-design.md",
+      "status": "A"
+    },
+    {
+      "path": "docs/superpowers/specs/2026-08-09-chatgpt-bridge-v2-control-plane-convergence-design.md",
+      "status": "A"
+    },
+    {
+      "path": "pytest.ini",
+      "status": "A"
+    },
+    {
+      "path": "scripts/build_v2r2c1_model_api_staging.py",
+      "status": "A"
+    },
+    {
+      "path": "services/aios-release-controller/aios_release_controller/manifest.py",
+      "status": "M"
+    },
+    {
+      "path": "tests/aios_v2_candidate/test_v2r1c6_release_consistency.py",
+      "status": "M"
+    },
+    {
+      "path": "tests/aios_v2_candidate/test_v2r1c6_release_ready.py",
+      "status": "M"
+    },
+    {
+      "path": "tests/conftest.py",
+      "status": "A"
+    },
+    {
+      "path": "tests/test_bridge_v2_governed_http_bootstrap.py",
+      "status": "A"
+    },
+    {
+      "path": "tests/test_governed_local_writer.py",
+      "status": "M"
+    },
+    {
+      "path": "tests/test_model_api_immutable_staging.py",
+      "status": "A"
+    }
+  ],
+  "integration_branch": "agent/v2r2c1-post-release-mainline-convergence-20260809",
+  "integration_head_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+  "logical_commits": [
+    {
+      "message": "feat(v2r2c1): converge durable control-plane core",
+      "oid": "40b685d1c70c767c7a79a2b184348e58e3e319ae",
+      "parent_oid": "2e8fa22989808a448065d1d76b5b18948774a637"
+    },
+    {
+      "message": "docs(v2r2c1): converge durable runtime and design sources",
+      "oid": "5f616311bab38b0dac296ed8b0e69660e031a20e",
+      "parent_oid": "40b685d1c70c767c7a79a2b184348e58e3e319ae"
+    },
+    {
+      "message": "feat(v2r2c1): integrate governed release overlay",
+      "oid": "57780e316e320a5128cc2c9f12adbb19ae57aef5",
+      "parent_oid": "5f616311bab38b0dac296ed8b0e69660e031a20e"
+    },
+    {
+      "message": "feat(v2r2c1): wire governed release operations into durable bridge",
+      "oid": "e41b8d323a3e7a40440f5d32221f524074bea5fe",
+      "parent_oid": "57780e316e320a5128cc2c9f12adbb19ae57aef5"
+    },
+    {
+      "message": "test: repair canonical pytest repository entrypoint",
+      "oid": "b20cb8130e4c68267d5d85b02eed51cb8d4f41c0",
+      "parent_oid": "e41b8d323a3e7a40440f5d32221f524074bea5fe"
+    },
+    {
+      "message": "test: make whole-suite collection deterministic",
+      "oid": "c6a1693efaede9dace9b929d884a09e162a02c89",
+      "parent_oid": "b20cb8130e4c68267d5d85b02eed51cb8d4f41c0"
+    },
+    {
+      "message": "test: preserve legacy suite imports under canonical collection",
+      "oid": "91f2ea0591787d3dbf8c2e27ab0460629d86900e",
+      "parent_oid": "c6a1693efaede9dace9b929d884a09e162a02c89"
+    },
+    {
+      "message": "test: expose repository test helpers to canonical collection",
+      "oid": "85897d3f6d708271dff16767265f9d14b2f29801",
+      "parent_oid": "91f2ea0591787d3dbf8c2e27ab0460629d86900e"
+    },
+    {
+      "message": "fix(v2r2c1): close slash-branch and suite contract regressions",
+      "oid": "f1110d24f30d8441f2df04e0774ee230b95c2e02",
+      "parent_oid": "85897d3f6d708271dff16767265f9d14b2f29801"
+    },
+    {
+      "message": "test: align writer regression with durable idempotent replay",
+      "oid": "c10d2a5dfcc394dde7a7022952d7b423725747a3",
+      "parent_oid": "f1110d24f30d8441f2df04e0774ee230b95c2e02"
+    },
+    {
+      "message": "feat(v2r2c1): source baseline authority for model-api staging",
+      "oid": "f969aedaf61501a866435c712be01ff2cfe43fb1",
+      "parent_oid": "c10d2a5dfcc394dde7a7022952d7b423725747a3"
+    },
+    {
+      "message": "feat(v2r2c1): add immutable model api staging runtime",
+      "oid": "4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b",
+      "parent_oid": "f969aedaf61501a866435c712be01ff2cfe43fb1"
+    },
+    {
+      "message": "fix(v2r2c1): avoid builder secret-scan false positives",
+      "oid": "7c4e86bfc1f39e643e672968d1fdedbd72ace56d",
+      "parent_oid": "4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b"
+    },
+    {
+      "message": "fix(v2r2c1): isolate model api staging port",
+      "oid": "7564363a30bfa7fa81ac5c7c545ec704984ec543",
+      "parent_oid": "7c4e86bfc1f39e643e672968d1fdedbd72ace56d"
+    },
+    {
+      "message": "fix(v2r2c1): bind baseline authority and openapi staging path",
+      "oid": "2c6293160ed567a2098715edbb296741577c5bff",
+      "parent_oid": "7564363a30bfa7fa81ac5c7c545ec704984ec543"
+    }
+  ],
+  "main_base_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
+  "release_target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
+  "remote_proof": {
+    "api_branch_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+    "api_verification": "paginated_exact_name",
+    "commit_visible": true,
+    "git_remote_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+    "main_api_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
+    "main_git_oid": "2e8fa22989808a448065d1d76b5b18948774a637"
+  },
+  "report_commit_parent_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+  "repository": "aios/aios",
+  "schema": "aios.v2r2c1.post-release-mainline-convergence.path-manifest.v1",
+  "task_id": "TASK-P0-V2R2C1-POST-RELEASE-MAINLINE-CONVERGENCE-20260809"
+}

reports/V2R2C1-model-api-runtime-activation-plan-20260809.json

@@ -0,0 +1,37 @@
+{
+  "artifact_sha256": "492338b895b152a55015fd92ea1d9dba2314894ab00c0ba219a78f3cef544b8a",
+  "baseline_authority_path": "/var/lib/aios-gitops-runtime-anchor/baseline/current.json",
+  "checks": {
+    "artifact_sha256": "PASS",
+    "baseline_registry_readback": "PASS",
+    "health_contract": "PASS",
+    "legacy_write_rejection": "PASS",
+    "live_service_unchanged": "PASS",
+    "manifest_binding": "PASS",
+    "openapi_readback": "PASS",
+    "restart_recovery": "PASS"
+  },
+  "current_live_port": 18890,
+  "current_live_service": "aios-gitops-model-api.service",
+  "deployment_state": "STAGING",
+  "execute": false,
+  "governed_release_routing": "bridge-v2",
+  "legacy_global_writes_enabled": false,
+  "live_cutover": false,
+  "owner_actions_required": [
+    "review exact source OID and artifact SHA",
+    "approve a separate future live model-api cutover",
+    "approve any production service transition"
+  ],
+  "production_restart": false,
+  "repository_identity": "aios/aios",
+  "runtime_mode": "IMMUTABLE_STAGING",
+  "schema": "aios.v2r2c1.model-api-runtime-activation-plan.v1",
+  "source_oid": "2c6293160ed567a2098715edbb296741577c5bff",
+  "staging_port": 18893,
+  "staging_runtime_root": "/opt/aios/gitops-model-api/2c6293160ed567a2098715edbb296741577c5bff/runtime",
+  "staging_service": "aios-gitops-model-api-v2r2c1-staging.service",
+  "status": "OWNER_APPROVAL_REQUIRED",
+  "target_version": "V2R2C1",
+  "task_id": "TASK-P0-V2R2C1-POST-RELEASE-MAINLINE-CONVERGENCE-20260809"
+}

reports/bridge-v2-engineering-staging-acceptance-20260809.json

@@ -1,44 +0,0 @@
-{
-  "schema": "aios.bridge-v2-engineering-staging-acceptance.v1",
-  "task_id": "TASK-P0-CHATGPT-BRIDGE-V2-CONTROL-PLANE-CONVERGENCE-20260809",
-  "repository": "aios/aios",
-  "branch": "agent/p0-chatgpt-bridge-v2-control-plane-convergence-20260809",
-  "control_plane_release_version": "bridge-v2-aa0c37b8ab33",
-  "control_plane_target_oid": "aa0c37b8ab333616e1bab9686cf6d10557f2ebda",
-  "artifact_sha256": "08670c78cf760bfe693e3553e676eb751dadd7834116aa6d40e7c094f1357ae4",
-  "runtime_path": "/opt/aios/gitops-control-plane/aa0c37b8ab333616e1bab9686cf6d10557f2ebda",
-  "bridge_schema_version": "aios.chatgpt-gitops-bridge.v2",
-  "deployment_state": "STAGING",
-  "drift_status": "PASS",
-  "restart_acceptance": {
-    "pid_before": 3158850,
-    "pid_after": 3159889,
-    "runtime_response_equal": true
-  },
-  "governed_capabilities": {
-    "legacy_writes_enabled": false,
-    "governed_writes_enabled": true,
-    "force_push": false,
-    "main_write": false,
-    "tag_write": false,
-    "baseline_write": false,
-    "production_write": false
-  },
-  "production_invariants": {
-    "authority_main_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
-    "authority_tags_sha256": "bd2b6e30b76f28e7fcdcb447e7296690f0a65ad855209294c36b0f3f1d96098d",
-    "baseline_current_sha256": "57651eb819584ab7c1d67f01b0ef66d6408cdc322ae5f6d4ff0aacd96f8327e1",
-    "production_service_main_pid": 2816107,
-    "production_service_nrestarts": 0,
-    "production_service_active_enter_timestamp_monotonic": 2919386492273
-  },
-  "bridge_operation_sequence": {
-    "createGovernedTask": "PASS",
-    "acquireWriterLease": "PASS",
-    "commitFilesGoverned": "REAL_GOVERNED_COMMIT",
-    "getGitOpsJob": "PASS",
-    "expected_branch_oid": "8fe3b85c1be592326473e81a502a23eeb9511d30",
-    "generation": 7
-  },
-  "production_changed": false
-}

reports/bridge-v2.1-durable-reconciliation-acceptance-20260809.json

@@ -1,17 +0,0 @@
-{
-  "schema": "aios.bridge-v2.1-durable-reconciliation.bootstrap-acceptance.v1",
-  "task_id": "TASK-P0-BRIDGE-V21-DURABLE-RECONCILIATION-20260809",
-  "repository": "aios/aios",
-  "base_oid": "3f670c387692b8865a10d5b419468d8a0b64d7a4",
-  "target_branch": "agent/p0-bridge-v21-durable-reconciliation-20260809",
-  "branch_mode": "CREATE_NEW",
-  "generation": 1,
-  "implementation": "not_started",
-  "production_changed": false,
-  "required_proofs": [
-    "absent_ref_cas",
-    "observation_first_reconciliation",
-    "authority_gitea_api_commit_equality",
-    "commit_visible"
-  ]
-}

runtime/agent-os/message_bus.py

@@ -48,3 +48,8 @@ class MessageBus:
         messages = list(self.queue)
         self.queue.clear()
         return messages
+
+# R4.2 P0-B compatibility adapter.
+def to_handoff_envelope(message, *, target=None, sequence=1, idempotency_key=None, **scope):
+    from message_handoff_adapters import legacy_message_to_envelope
+    return legacy_message_to_envelope(message, target=target, sequence=sequence, idempotency_key=idempotency_key, **scope)

scripts/build_v2r2c1_model_api_staging.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import tarfile
+import tempfile
+
+SCHEMA = 'aios.v2r2c1.model-api-staging-manifest.v1'
+REQUIRED_APP = (
+    'aios_model_api_staging.py',
+    'aios_gitops_write_guard.py',
+    'authoritative_git.py',
+    'baseline_authority.py',
+    'gitea_tag_publication.py',
+    'silent_release_controller.py',
+    'silent_release_hardening.py',
+    'aios_gitops_job_controller.py',
+)
+OPTIONAL_APP = (
+    'aios_chatgpt_actions_api.py',
+    'aios_continuation_executor.py',
+    'aios_continuation_lease.py',
+    'aios_control_plane_snapshot.py',
+)
+
+def sha256(path: Path) -> str:
+    h = hashlib.sha256()
+    with path.open('rb') as fh:
+        for chunk in iter(lambda: fh.read(1024 * 1024), b''):
+            h.update(chunk)
+    return h.hexdigest()
+
+def private_marker(path: Path) -> bool:
+    import re
+    text = path.read_text(encoding='utf-8', errors='ignore')
+    patterns = (
+        r'-----BEGIN [A-Z ]*PRIVATE KEY-----',
+        r'(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])',
+        r'(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{20,}(?![A-Za-z0-9])',
+        r'(?i)aws_secret_access_key\s*[:=]\s*[A-Za-z0-9/+=]{16,}',
+    )
+    return any(re.search(pattern, text) for pattern in patterns)
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument('--source-root', required=True, type=Path)
+    ap.add_argument('--output-root', required=True, type=Path)
+    ap.add_argument('--source-oid', required=True)
+    args = ap.parse_args()
+    oid = args.source_oid.lower()
+    if len(oid) != 40 or any(c not in '0123456789abcdef' for c in oid):
+        raise SystemExit('source oid must be exact 40 hex')
+    source = args.source_root.resolve(strict=True)
+    output = args.output_root.resolve()
+    app = source / 'active-runtime' / 'app'
+    runtime = source / 'runtime' / 'agent-os'
+    docs = source / 'docs' / 'gitops'
+    if not app.is_dir():
+        raise SystemExit('active-runtime/app missing')
+    paths = []
+    for name in REQUIRED_APP:
+        path = app / name
+        if not path.is_file():
+            raise SystemExit(f'required app dependency missing: {name}')
+        paths.append((Path('app') / name, path))
+    for name in OPTIONAL_APP:
+        path = app / name
+        if path.is_file():
+            paths.append((Path('app') / name, path))
+    for rel in ('orchestrator/__init__.py', 'orchestrator/action_monitor.py'):
+        path = runtime / rel
+        if not path.is_file():
+            raise SystemExit(f'required runtime dependency missing: {rel}')
+        paths.append((Path('runtime-agent-os') / rel, path))
+    openapi = docs / 'openapi-chatgpt-actions.yaml'
+    if openapi.is_file():
+        paths.append((Path('docs') / 'gitops' / 'openapi-chatgpt-actions.yaml', openapi))
+    for folder in ('config/model_registry', 'config/model_priority', 'patches', 'versions'):
+        root = source / folder
+        if root.is_dir():
+            for path in sorted(root.rglob('*')):
+                if path.is_file() and path.suffix.lower() in {'.json', '.yaml', '.yml', '.md'}:
+                    paths.append((Path(folder) / path.relative_to(root), path))
+    for rel, path in paths:
+        if private_marker(path):
+            raise SystemExit(f'private marker rejected: {rel}')
+    included = [str(rel).replace('\\', '/') for rel, _ in paths]
+    manifest = {
+        'schema': SCHEMA,
+        'target_version': 'V2R2C1',
+        'source_oid': oid,
+        'repository_identity': 'aios/aios',
+        'deployment_state': 'STAGING',
+        'runtime_mode': 'IMMUTABLE_STAGING',
+        'runtime_entrypoint': 'app/aios_model_api_staging.py',
+        'legacy_global_writes_enabled': False,
+        'governed_release_routing': 'bridge-v2',
+        'artifact_sha256': 'provided-by-build-receipt-and-install-manifest',
+        'included_paths': included,
+    }
+    output.mkdir(parents=True, exist_ok=True)
+    archive = output / f'aios-v2r2c1-model-api-{oid}.tar.gz'
+    with tempfile.TemporaryDirectory(prefix='v2r2c1-model-api-', dir=str(output)) as tmp:
+        root = Path(tmp) / 'runtime'
+        for rel, path in paths:
+            target = root / rel
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_bytes(path.read_bytes())
+        (root / 'manifest.json').write_text(json.dumps(manifest, ensure_ascii=False, indent=2, sort_keys=True) + '\n', encoding='utf-8')
+        with tarfile.open(archive, 'w:gz', format=tarfile.PAX_FORMAT) as tf:
+            for path in sorted(root.rglob('*')):
+                rel = path.relative_to(root.parent)
+                info = tf.gettarinfo(str(path), arcname=str(rel).replace('\\', '/'))
+                info.mtime = 0
+                info.uid = 0
+                info.gid = 0
+                info.uname = 'root'
+                info.gname = 'root'
+                if path.is_file():
+                    with path.open('rb') as fh:
+                        tf.addfile(info, fh)
+                else:
+                    tf.addfile(info)
+    digest = sha256(archive)
+    receipt = {
+        'schema': 'aios.v2r2c1.model-api-staging-build-receipt.v1',
+        'target_version': 'V2R2C1',
+        'source_oid': oid,
+        'repository_identity': 'aios/aios',
+        'artifact_path': str(archive),
+        'artifact_sha256': digest,
+        'deployment_state': 'STAGING',
+        'manifest_schema': SCHEMA,
+        'included_paths': included,
+    }
+    receipt_path = output / f'aios-v2r2c1-model-api-{oid}.receipt.json'
+    receipt_path.write_text(json.dumps(receipt, ensure_ascii=False, indent=2, sort_keys=True) + '\n', encoding='utf-8')
+    print(json.dumps(receipt, ensure_ascii=False, indent=2, sort_keys=True))
+    return 0
+
+if __name__ == '__main__':
+    raise SystemExit(main())

services/aios-release-controller/aios_release_controller/manifest.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 import hashlib,json,re,tarfile
 from pathlib import Path
 from typing import Any
-OID_RE=re.compile(r"^[0-9a-f]{40}$"); SHA_RE=re.compile(r"^[0-9a-f]{64}$"); VERSION_RE=re.compile(r"^V2R1C[0-9]+$")
+OID_RE=re.compile(r"^[0-9a-f]{40}$"); SHA_RE=re.compile(r"^[0-9a-f]{64}$"); VERSION_RE=re.compile(r"^V[0-9]+R[0-9]+C[0-9]+(?:-[A-Za-z0-9_.-]+)?$")
 REQUIRED_SOURCE={"schema","version","repository","base_ref","base_oid","binding_mode","release_readiness","production_deployed","tag_created","baseline_changed","production_service","production_port","rollback_metadata","controller_schema","required_checks"}
 REQUEST_KEYS={"schema","version","repository","base_oid","target_oid","artifact_uri","artifact_sha256","artifact_size","evidence_closure_oid","approval_plan_id","execute","production_deployed","production_service","production_port","rollback_metadata","current_tag_oid","source_manifest_sha256"}
 class ManifestValidationError(ValueError):
@@ -62,7 +62,7 @@ def validate_release_request(source_manifest:dict[str,Any],request_path:Path,exp
  if not isinstance(request["approval_plan_id"],str) or not request["approval_plan_id"].startswith("sha256:"): raise ManifestValidationError("APPROVAL_PLAN","invalid approval plan")
  if request["execute"] is not False or request["production_deployed"] is not False: raise ManifestValidationError("EXECUTION_NOT_ALLOWED","must be non-executing")
  if request["production_service"]!=source_manifest["production_service"] or request["production_port"]!=source_manifest["production_port"]: raise ManifestValidationError("SERVICE_IDENTITY","request service mismatch")
- if not isinstance(request["current_tag_oid"],str) or request["current_tag_oid"] not in {"V2R1C6","9e65bd59baea392294c0f253046d3ab116f63145"}: raise ManifestValidationError("PROTECTED_TAG","previous tag binding changed")
+ if not isinstance(request["current_tag_oid"],str) or request["current_tag_oid"] not in {"V2R1C7","82792347937c0df59a8e02d6162775252bcad2e2"}: raise ManifestValidationError("PROTECTED_TAG","previous production tag binding changed")
  _sha(request["source_manifest_sha256"],"source_manifest_sha256"); return request
 def build_approval_request(*,source_manifest_path:Path,target_oid:str,artifact_uri:str,artifact_sha256:str,artifact_size:int,evidence_closure_oid:str,rollback_metadata:str,current_tag_oid:str)->dict[str,Any]:
  source=_json_object(source_manifest_path); _oid(target_oid,"target_oid"); _sha(artifact_sha256,"artifact_sha256"); _oid(evidence_closure_oid,"evidence_closure_oid"); request={"schema":"aios.release-request.v2","version":source["version"],"repository":source["repository"],"base_oid":source["base_oid"],"target_oid":target_oid,"artifact_uri":artifact_uri,"artifact_sha256":artifact_sha256,"artifact_size":artifact_size,"evidence_closure_oid":evidence_closure_oid,"execute":False,"production_deployed":False,"production_service":source["production_service"],"production_port":source["production_port"],"rollback_metadata":rollback_metadata,"current_tag_oid":current_tag_oid,"source_manifest_sha256":sha256_file(source_manifest_path)}; request["approval_plan_id"]="sha256:"+sha256_bytes(_canonical(request)); return request

tests/aios_v2_candidate/test_v2r1c6_release_consistency.py

@@ -3,13 +3,13 @@ from __future__ import annotations
 import json
 from pathlib import Path
 
-
 ROOT = Path(__file__).parents[2]
 
 
 def test_version_and_candidate_binding():
-    assert (ROOT / "VERSION").read_text(encoding="utf-8").strip() == "V2R1C6"
+    assert (ROOT / "VERSION").read_text(encoding="utf-8").strip() == "V2R1C7"
     metadata = json.loads((ROOT / "versions/V2R1C6.json").read_text(encoding="utf-8"))
+    assert metadata["version"] == "V2R1C6"
     assert metadata["base_oid"] == "a33e2593967a180c89d44454350ccaeaf3f79b25"
     assert metadata["candidate_branch"] == "agent/v2r1c6-mainline-reconciliation-20260806"
     assert metadata["production_deployed"] is False

tests/aios_v2_candidate/test_v2r1c6_release_ready.py

@@ -7,17 +7,19 @@ import pytest
 
 ROOT = Path(__file__).resolve().parents[2]
 sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
+from deployment_state import RuntimeDeploymentState
 from v2r1c6_privacy_tools import health_payload, serve  # noqa: E402
 
 
 def test_health_is_engineering_only() -> None:
-    result = health_payload()
-    assert result == {
-        "status": "ok",
-        "version": "V2R1C6",
-        "production_deployed": False,
-        "gitops_writes_enabled": False,
-    }
+    result = health_payload(RuntimeDeploymentState("V2R1C7", "a" * 40, "b" * 64, "STAGED"))
+    assert result["status"] == "ok"
+    assert result["version"] == "V2R1C7"
+    assert result["commit_oid"] == "a" * 40
+    assert result["artifact_sha256"] == "b" * 64
+    assert result["deployment_state"] == "STAGED"
+    assert result["production_deployed"] is False
+    assert result["health_timestamp"]
 
 
 def test_listener_rejects_non_loopback() -> None:

tests/conftest.py

@@ -0,0 +1,65 @@
+from __future__ import annotations
+
+import importlib.util
+import sys
+import types
+from pathlib import Path
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+TEST_ROOT = REPOSITORY_ROOT / "tests"
+SERVICE_PACKAGE_ROOT = REPOSITORY_ROOT / "services" / "aios-autonomous-release-candidate"
+ACTIVE_RUNTIME_ROOT = REPOSITORY_ROOT / "active-runtime"
+ACTIVE_RUNTIME_APP = ACTIVE_RUNTIME_ROOT / "app"
+
+for path in (TEST_ROOT, SERVICE_PACKAGE_ROOT, ACTIVE_RUNTIME_APP):
+    value = str(path)
+    if value not in sys.path:
+        sys.path.insert(0, value)
+
+
+def load_module(relative: str):
+    path = REPOSITORY_ROOT / relative
+    spec = importlib.util.spec_from_file_location("v2r1c6_privacy_tools", path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError("module_load_failed")
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+def _install_active_runtime_namespace() -> None:
+    package = sys.modules.get("active_runtime")
+    if package is None:
+        package = types.ModuleType("active_runtime")
+        package.__path__ = [str(ACTIVE_RUNTIME_ROOT)]
+        package.__package__ = "active_runtime"
+        sys.modules["active_runtime"] = package
+
+    app = sys.modules.get("active_runtime.app")
+    if app is None:
+        app = types.ModuleType("active_runtime.app")
+        app.__path__ = [str(ACTIVE_RUNTIME_APP)]
+        app.__package__ = "active_runtime"
+        sys.modules["active_runtime.app"] = app
+    package.app = app
+
+
+def _install_legacy_test_module(name: str, relative: str) -> None:
+    if name in sys.modules:
+        return
+    path = REPOSITORY_ROOT / relative
+    spec = importlib.util.spec_from_file_location(name, path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError("legacy_test_module_load_failed:" + name)
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[name] = module
+    spec.loader.exec_module(module)
+
+
+_install_active_runtime_namespace()
+sys.modules.setdefault("conftest", sys.modules[__name__])
+_install_legacy_test_module(
+    "test_native_adapter_contracts",
+    "tests/autonomous_release/test_native_adapter_contracts.py",
+)

tests/task_plane/public_interface/test_shadow_client_rbac.py

@@ -45,6 +45,9 @@ class ShadowClientRBACPublicInterfaceTests(unittest.TestCase):
             identity_verifier=self.IdentityVerifier({"shadow-client"}),
             execution_enabled=False,
             identity_capabilities={"shadow-client": set(capabilities)},
+            identity_actor_contexts={
+                "shadow-client": {"scope_type": "system"}
+            },
         )
         service = self.TaskPlaneService(store, policy=policy)
 

tests/task_plane/public_interface/test_task_plane_scope_isolation.py

@@ -0,0 +1,298 @@
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+import sys
+import threading
+import urllib.error
+import urllib.request
+from http.server import ThreadingHTTPServer
+
+import pytest
+
+ROOT = os.getcwd()
+if os.path.join(ROOT, "active-runtime") not in sys.path:
+    sys.path.append(os.path.join(ROOT, "active-runtime"))
+
+from app.task_plane.api import TaskPlaneRequestHandler, TaskPlaneService
+from app.task_plane.errors import ForbiddenError, NotFoundError, ValidationError
+from app.task_plane.models import TaskPlan
+from app.task_plane.policy import PolicyEngine
+from app.task_plane.store import TaskPlaneStore
+
+
+def _policy() -> PolicyEngine:
+    return PolicyEngine(
+        identity_capabilities={
+            "actor-a": {"task.creator", "task.read"},
+            "actor-b": {"task.creator", "task.read"},
+            "reader-a": {"task.read"},
+            "reader-b": {"task.read"},
+            "owner": {"task.creator", "task.read", "task.read.all"},
+            "unbound": {"task.creator", "task.read"},
+        },
+        identity_actor_contexts={
+            "actor-a": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-a",
+                "user_id": "user-a",
+                "project_id": "project-a",
+                "conversation_id": "conversation-a",
+                "run_id": "run-a",
+            },
+            "reader-a": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-a",
+                "user_id": "user-a",
+                "project_id": "project-a",
+                "conversation_id": "conversation-a",
+                "run_id": "run-a",
+            },
+            "actor-b": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-b",
+                "user_id": "user-b",
+                "project_id": "project-b",
+            },
+            "reader-b": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-b",
+                "user_id": "user-b",
+                "project_id": "project-b",
+            },
+            "owner": {"scope_type": "system"},
+        },
+    )
+
+
+def _service() -> TaskPlaneService:
+    return TaskPlaneService(TaskPlaneStore(":memory:"), policy=_policy())
+
+
+def test_taskplan_scope_fields_round_trip_as_first_class_values() -> None:
+    plan = TaskPlan.from_dict(
+        {
+            "task_id": "task-scope-roundtrip",
+            "scope_type": "tenant",
+            "tenant_id": "tenant-a",
+            "user_id": "user-a",
+            "project_id": "project-a",
+            "conversation_id": "conversation-a",
+            "run_id": "run-a",
+        }
+    )
+    payload = plan.to_dict()
+    assert TaskPlan.from_dict(payload).to_dict() == payload
+
+
+def test_tenant_scope_requires_tenant_id_and_system_scope_does_not() -> None:
+    with pytest.raises(ValidationError) as exc:
+        TaskPlan.from_dict({"task_id": "task-missing-tenant", "scope_type": "tenant"})
+    assert exc.value.error_code == "TASK_SCOPE_TENANT_ID_REQUIRED"
+    system = TaskPlan.from_dict(
+        {"task_id": "task-system", "scope_type": "system", "run_id": "system-run"}
+    )
+    assert system.tenant_id is None
+
+
+def test_ACTOR_BINDING_AUTHZ_MERGE_uses_server_scope() -> None:
+    service = _service()
+    created = service.create_task(
+        {"task_id": "task-a", "task_type": "code.change"},
+        actor_identity="actor-a",
+    )
+    assert created["plan"]["tenant_id"] == "tenant-a"
+    assert created["plan"]["user_id"] == "user-a"
+    assert created["plan"]["project_id"] == "project-a"
+    declared = service.create_task(
+        {
+            "task_id": "task-a-declared",
+            "tenant_id": "tenant-a",
+            "user_id": "user-a",
+            "project_id": "project-a",
+            "conversation_id": "conversation-a",
+            "run_id": "run-a",
+        },
+        actor_identity="actor-a",
+    )
+    assert declared["plan"]["scope_type"] == "tenant"
+
+
+def test_TASK_SCOPE_MISMATCH_DENY_rejects_forged_client_scope() -> None:
+    service = _service()
+    with pytest.raises(ForbiddenError) as exc:
+        service.create_task(
+            {
+                "task_id": "task-forged",
+                "scope_type": "tenant",
+                "tenant_id": "tenant-b",
+                "user_id": "user-b",
+                "project_id": "project-b",
+            },
+            actor_identity="actor-a",
+        )
+    assert exc.value.error_code == "TASK_SCOPE_MISMATCH_DENY"
+
+
+def test_public_create_fails_closed_without_server_actor_scope() -> None:
+    service = _service()
+    with pytest.raises(ForbiddenError) as exc:
+        service.create_task(
+            {"task_id": "task-unbound"}, actor_identity="unbound"
+        )
+    assert exc.value.error_code == "TASK_ACTOR_SCOPE_UNAVAILABLE"
+
+
+def test_TASKPLANE_LIST_AUTHZ_DENY_and_TASK_OWNERSHIP_FILTER() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    service.create_task({"task_id": "task-b"}, actor_identity="actor-b")
+    assert [item["task_id"] for item in service.list_tasks("reader-a")] == ["task-a"]
+    assert [item["task_id"] for item in service.list_tasks("reader-b")] == ["task-b"]
+
+
+def test_TASKPLANE_GET_AUTHZ_DENY_does_not_disclose_cross_tenant_task() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    with pytest.raises(NotFoundError):
+        service.get_task("task-a", "reader-b")
+
+
+def test_http_authentication_drives_server_scope_and_cross_tenant_404() -> None:
+    service = _service()
+
+    class Handler(TaskPlaneRequestHandler):
+        pass
+
+    Handler.service = service
+    Handler.authenticator = lambda token: {
+        "token-a": "actor-a",
+        "token-b": "reader-b",
+    }.get(token)
+    server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    base = f"http://127.0.0.1:{server.server_port}"
+    try:
+        request = urllib.request.Request(
+            base + "/tasks",
+            data=json.dumps({"task_id": "task-http-a"}).encode(),
+            headers={
+                "Authorization": "Bearer token-a",
+                "Content-Type": "application/json",
+            },
+            method="POST",
+        )
+        with urllib.request.urlopen(request, timeout=3) as response:
+            created = json.loads(response.read())
+        assert created["plan"]["tenant_id"] == "tenant-a"
+
+        denied = urllib.request.Request(
+            base + "/tasks/task-http-a",
+            headers={"Authorization": "Bearer token-b"},
+        )
+        with pytest.raises(urllib.error.HTTPError) as exc:
+            urllib.request.urlopen(denied, timeout=3)
+        assert exc.value.code == 404
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=3)
+
+
+def test_mutating_endpoint_is_scoped_before_cancel() -> None:
+    policy = PolicyEngine(
+        execution_enabled=True,
+        identity_capabilities={
+            "actor-a": {"task.creator", "task.read"},
+            "actor-b": {"task.cancel"},
+        },
+        identity_actor_contexts={
+            "actor-a": {"scope_type": "tenant", "tenant_id": "tenant-a"},
+            "actor-b": {"scope_type": "tenant", "tenant_id": "tenant-b"},
+        },
+    )
+    service = TaskPlaneService(TaskPlaneStore(":memory:"), policy=policy)
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    with pytest.raises(NotFoundError):
+        service.cancel("task-a", {"actor_identity": "actor-b"})
+
+
+def test_privileged_server_actor_can_cross_scope() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    service.create_task({"task_id": "task-b"}, actor_identity="actor-b")
+    assert {item["task_id"] for item in service.list_tasks("owner")} == {
+        "task-a",
+        "task-b",
+    }
+
+
+def test_scope_sql_parameters_do_not_interpolate_tenant_values() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    policy = PolicyEngine(
+        identity_capabilities={"attacker": {"task.read"}},
+        identity_actor_contexts={
+            "attacker": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-a' OR 1=1 --",
+            }
+        },
+    )
+    attacker_service = TaskPlaneService(service.store, policy=policy)
+    assert attacker_service.list_tasks("attacker") == []
+
+
+def test_existing_sqlite_rows_migrate_to_legacy_without_tenant_guess(tmp_path) -> None:
+    path = tmp_path / "legacy.sqlite3"
+    connection = sqlite3.connect(path)
+    connection.execute(
+        """
+        CREATE TABLE tasks (
+            task_id TEXT PRIMARY KEY, revision INTEGER NOT NULL, status TEXT NOT NULL,
+            task_json TEXT NOT NULL, task_type TEXT NOT NULL, root_task_id TEXT NOT NULL,
+            parent_task_id TEXT, correlation_id TEXT, idempotency_key TEXT UNIQUE,
+            created_at REAL NOT NULL, updated_at REAL NOT NULL, failure_reason TEXT
+        )
+        """
+    )
+    connection.execute(
+        "INSERT INTO tasks VALUES (?,?,?,?,?,?,?,?,?,?,?,?)",
+        (
+            "task-legacy",
+            1,
+            "CREATED",
+            json.dumps({"task_id": "task-legacy"}),
+            "code.change",
+            "task-legacy",
+            None,
+            None,
+            "legacy-key",
+            1.0,
+            1.0,
+            None,
+        ),
+    )
+    connection.commit()
+    connection.close()
+
+    store = TaskPlaneStore(str(path))
+    task = store.get_task("task-legacy")
+    assert task.task_plan.scope_type == "legacy"
+    assert task.task_plan.tenant_id is None
+    replay = store.create_task(
+        TaskPlan.from_dict({"task_id": "task-legacy"}),
+        idempotency_key="legacy-key",
+    )
+    assert replay.task_id == "task-legacy"
+    assert tuple(
+        store.conn.execute(
+            "SELECT scope_type,tenant_id FROM tasks WHERE task_id='task-legacy'"
+        ).fetchone()
+    ) == ("legacy", None)
+    tenant_context = _policy().actor_context("reader-a")
+    with pytest.raises(NotFoundError):
+        store.get_task("task-legacy", tenant_context)
+    store.close()

tests/test_agent_event_bus.py

@@ -20,3 +20,12 @@ def test_unified_event_flow():
 
     dashboard = AgentEventDashboard(bus).overview()
     assert dashboard["audit"]["enabled"] is True
+
+
+def test_target_changes_event_identity(tmp_path):
+    bus = AgentEventBus(tmp_path)
+    first = bus.publish('test', 'same', 'user-a', 'same summary', {'value': 1})
+    second = bus.publish('test', 'same', 'user-b', 'same summary', {'value': 1})
+    first_id = first.get('id') if isinstance(first, dict) else getattr(first, 'id', first)
+    second_id = second.get('id') if isinstance(second, dict) else getattr(second, 'id', second)
+    assert first_id != second_id

tests/test_agent_task_retry_extension.py

@@ -0,0 +1,117 @@
+from pathlib import Path
+import hashlib, json, sqlite3, sys
+
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+from aios_agent_task_retry_extension import RetryExtensionRequest, RetryExtensionStore, RetryExtensionError
+
+AUTHORIZATION_ID="owner-scheme-a-20260817"
+
+
+@pytest.fixture(autouse=True)
+def _authorization_id(monkeypatch):
+    monkeypatch.setenv("AIOS_AGENT_TASK_AUTHORIZATION_ID", AUTHORIZATION_ID)
+
+
+def canon(v):
+    return hashlib.sha256(json.dumps(v,sort_keys=True,separators=(",",":")).encode()).hexdigest()
+
+
+def db(tmp_path):
+    p=tmp_path/"state.sqlite3"
+    c=sqlite3.connect(p)
+    c.executescript("""
+    CREATE TABLE tasks(
+      task_id TEXT PRIMARY KEY,status TEXT,attempt INTEGER,max_attempts INTEGER,revision INTEGER,
+      claimed_by TEXT,lease_token_hash TEXT,lease_expires_at TEXT,verification_json TEXT,result_json TEXT
+    );
+    CREATE TABLE task_events(
+      event_id INTEGER PRIMARY KEY AUTOINCREMENT,task_id TEXT,event_type TEXT,agent_id TEXT,
+      payload_json TEXT,created_at TEXT
+    );
+    """)
+    verification={"decision":"NEEDS_REWORK","reason":"BASE_OID_BINDING_INVALID"}
+    c.execute("INSERT INTO tasks VALUES (?,?,?,?,?,?,?,?,?,?)",
+              ("task-a","FAILED",10,10,41,None,None,None,json.dumps(verification),json.dumps({"status":"FAILED"})))
+    c.commit(); c.close()
+    return p,verification
+
+
+def request(v):
+    return RetryExtensionRequest.from_mapping({
+      "expected_status":"FAILED","expected_revision":41,"expected_attempt":10,"expected_max_attempts":10,
+      "next_max_attempts":11,"previous_verification_sha256":canon(v),
+      "authorization_id":AUTHORIZATION_ID,"idempotency_key":"retry-task-a-attempt11",
+    })
+
+
+def test_retry_extension_cas_and_audit(tmp_path):
+    p,v=db(tmp_path)
+    out=RetryExtensionStore(p).extend("task-a",request(v))
+    assert out["status"]=="QUEUED" and out["max_attempts"]==11 and out["revision"]==42
+    c=sqlite3.connect(p)
+    assert c.execute("select status,attempt,max_attempts,revision from tasks").fetchone()==("QUEUED",10,11,42)
+    event=c.execute("select event_type,payload_json from task_events").fetchone()
+    assert event[0]=="TASK_RETRY_EXTENSION_AUTHORIZED"
+    assert json.loads(event[1])["authorization_id"]=="owner-scheme-a-20260817"
+
+
+def test_retry_extension_idempotent_replay(tmp_path):
+    p,v=db(tmp_path); store=RetryExtensionStore(p); req=request(v)
+    first=store.extend("task-a",req); second=store.extend("task-a",req)
+    assert first["idempotent"] is False and second["idempotent"] is True
+    c=sqlite3.connect(p)
+    assert c.execute("select count(*) from task_retry_extensions").fetchone()[0]==1
+
+
+def test_retry_extension_normalizes_stale_terminal_claim_without_active_lease(tmp_path):
+    p,v=db(tmp_path)
+    c=sqlite3.connect(p)
+    c.execute("update tasks set claimed_by='previous-worker'")
+    c.commit(); c.close()
+    out=RetryExtensionStore(p).extend("task-a",request(v))
+    assert out["status"]=="QUEUED"
+    c=sqlite3.connect(p)
+    assert c.execute(
+        "select claimed_by,lease_token_hash,lease_expires_at from tasks"
+    ).fetchone()==(None,None,None)
+    payload=json.loads(c.execute("select payload_json from task_events").fetchone()[0])
+    assert payload["previous_claimed_by"]=="previous-worker"
+    assert payload["stale_terminal_claim_normalized"] is True
+    assert c.execute("select count(*) from task_events").fetchone()[0]==1
+
+
+def test_retry_extension_verification_drift_denied(tmp_path):
+    p,v=db(tmp_path)
+    bad=request({"decision":"NEEDS_REWORK","reason":"other"})
+    with pytest.raises(RetryExtensionError,match="RETRY_EXTENSION_VERIFICATION_DRIFT"):
+        RetryExtensionStore(p).extend("task-a",bad)
+
+
+def test_retry_extension_authorization_id_mismatch_rejected(tmp_path, monkeypatch):
+    p,v=db(tmp_path)
+    monkeypatch.setenv("AIOS_AGENT_TASK_AUTHORIZATION_ID", "other-owner-id")
+    with pytest.raises(RetryExtensionError,match="RETRY_EXTENSION_AUTHORIZATION_ID_MISMATCH"):
+        RetryExtensionStore(p).extend("task-a",request(v))
+
+
+def test_retry_extension_bounded_one_step():
+    v={"decision":"NEEDS_REWORK"}
+    data={
+      "expected_status":"FAILED","expected_revision":41,"expected_attempt":10,"expected_max_attempts":10,
+      "next_max_attempts":12,"previous_verification_sha256":canon(v),
+      "authorization_id":"owner-scheme-a-20260817","idempotency_key":"retry-task-a-attempt11",
+    }
+    with pytest.raises(RetryExtensionError,match="RETRY_EXTENSION_MUST_BE_BOUNDED_ONE_STEP"):
+        RetryExtensionRequest.from_mapping(data)
+
+
+def test_retry_extension_unit_is_unprivileged_and_requires_owner_binding():
+    unit=(ROOT/"deploy/systemd/aios-agent-task-retry-extension.service").read_text()
+    assert "User=aios-agent-task" in unit
+    assert "Group=aios-agent-task" in unit
+    assert "LoadCredential=agent_task_control_token:" in unit
+    assert "EnvironmentFile=/etc/aios-gitops/agent-task-retry-extension.env" in unit
+    assert "User=root" not in unit

tests/test_bridge_v2_governed_http_bootstrap.py

@@ -0,0 +1,211 @@
+import base64
+from pathlib import Path
+
+from aios_authority_git_executor import AuthorityGitExecutor
+from aios_chatgpt_bridge_v2 import BridgeV2Adapter, OPERATION_REQUIRED_FIELDS
+from aios_chatgpt_bridge_v2_server import BridgeHandler, RuntimeConfig
+from aios_continuation_executor import GiteaContinuationRemote, ServerSideCredentialProjection
+from aios_continuation_lease import WriterLeaseRequestV2
+
+
+class Probe:
+    def __init__(self, present=False):
+        self.present = present
+
+    def branch_exists(self, _branch):
+        return self.present
+
+    def branch_head(self, _branch):
+        return "a" * 40
+
+    def is_ancestor(self, _older, _newer):
+        return True
+
+    def commit_exists(self, _oid):
+        return True
+
+
+def test_create_new_lease_is_exact_base_and_absent():
+    request = WriterLeaseRequestV2(
+        job_id="job-bridge-runtime-lineage-test",
+        task_id="TASK-P0-BRIDGE-V21-DURABLE-RECONCILIATION-20260809",
+        repository="aios/aios",
+        branch_mode="CREATE_NEW",
+        base_oid="a" * 40,
+        expected_branch_oid="a" * 40,
+        target_branch="agent/p0-bridge-v21-durable-reconciliation-20260809",
+        generation=1,
+    )
+    request.validate(Probe())
+
+
+def test_create_new_lease_rejects_existing_target():
+    request = WriterLeaseRequestV2(
+        job_id="job-bridge-runtime-lineage-test",
+        task_id="task",
+        repository="aios/aios",
+        branch_mode="CREATE_NEW",
+        base_oid="a" * 40,
+        expected_branch_oid="a" * 40,
+        target_branch="agent/existing-target",
+        generation=1,
+    )
+    try:
+        request.validate(Probe(True))
+    except Exception as exc:
+        assert str(exc) == "TARGET_BRANCH_ALREADY_EXISTS"
+    else:
+        raise AssertionError("existing CREATE_NEW target must fail")
+
+
+def test_slash_branch_uses_paginated_collection():
+    credential = ServerSideCredentialProjection(Path("/tmp/key"), Path("/tmp/token"), active=True)
+    calls = []
+
+    class FakeRemote(GiteaContinuationRemote):
+        def _api(self, path):
+            calls.append(path)
+            if "page=1" in path:
+                return [{"name": f"agent/other-{i}", "commit": {"id": "b" * 40}} for i in range(50)]
+            return [{"name": "agent/slash/branch", "commit": {"id": "c" * 40}}]
+
+    remote = FakeRemote(Path("/tmp"), credential)
+    assert remote.read_api_branch("agent/slash/branch") == "c" * 40
+    assert calls[0].endswith("branches?page=1&limit=50")
+    assert calls[1].endswith("branches?page=2&limit=50")
+
+
+def test_http_route_contract_is_complete():
+    expected = {
+        "/v2/runtime", "/v2/capabilities", "/v2/governed-task",
+        "/v2/writer-lease", "/v2/writer-lease/bootstrap", "/v2/writer-lease/renew", "/v2/commit-file", "/v2/commit-files",
+        "/v2/job", "/v2/job/resume", "/v2/job/reconcile",
+        "/v2/tag/approval-request",
+        "/v2/tag/publish",
+        "/v2/tag/status",
+        "/v2/release/artifact",
+        "/v2/release/execute",
+        "/v2/release/consistency",
+        "/v2/release/acceptance",
+    }
+    from aios_chatgpt_bridge_v2_server import ROUTES
+
+    assert set(ROUTES) == expected
+
+
+def test_renew_writer_lease_is_exposed_in_action_and_capability_contracts():
+    adapter = BridgeV2Adapter(runtime_status={})
+    capabilities = adapter.getGovernedWriteCapabilities()
+    contract = capabilities["operation_contracts"]["renewWriterLease"]
+
+    assert contract["method"] == "POST"
+    assert contract["path"] == "/v2/writer-lease/renew"
+    assert tuple(contract["required_fields"]) == OPERATION_REQUIRED_FIELDS["renewWriterLease"]
+    assert "runtime_rehydrated" in contract["response_fields"]
+
+    action_schema = Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
+    assert "/v2/writer-lease/renew:" in action_schema
+    assert "operationId: renewWriterLease" in action_schema
+    assert "BridgeWriterLeaseRecoveryRequest" in action_schema
+    assert "BridgeWriterLeaseRecoveryResponse" in action_schema
+    assert {
+        capabilities["operation_contracts"][operation]["path"]
+        for operation in (
+            "acquireWriterLease",
+            "renewWriterLease",
+            "commitFileGoverned",
+            "commitFilesGoverned",
+        )
+    } == {
+        "/v2/writer-lease",
+        "/v2/writer-lease/renew",
+        "/v2/commit-file",
+        "/v2/commit-files",
+    }
+
+
+def test_bootstrap_writer_lease_is_exposed_in_action_and_capability_contracts():
+    adapter = BridgeV2Adapter(runtime_status={})
+    capabilities = adapter.getGovernedWriteCapabilities()
+    contract = capabilities["operation_contracts"]["bootstrapWriterLease"]
+
+    assert contract["method"] == "POST"
+    assert contract["path"] == "/v2/writer-lease/bootstrap"
+    assert tuple(contract["required_fields"]) == OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"]
+    assert "bootstrapped" in contract["response_fields"]
+    assert "durable_branch_lease_present" in contract["response_fields"]
+
+    action_schema = Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
+    assert "/v2/writer-lease/bootstrap:" in action_schema
+    assert "operationId: bootstrapWriterLease" in action_schema
+    assert "bootstrapped: {type: boolean}" in action_schema
+    assert "durable_branch_lease_present: {type: boolean}" in action_schema
+
+
+
+def test_http_allows_explicit_job_id_on_lease_and_commit_requests():
+    handler = BridgeHandler.__new__(BridgeHandler)
+    lease_body = {
+        "schema": WriterLeaseRequestV2.schema,
+        "task_id": "task",
+        "job_id": "job-explicit-runtime-lineage",
+        "repository": "aios/aios",
+        "branch_mode": "CONTINUE_EXISTING",
+        "base_oid": "a" * 40,
+        "expected_branch_oid": "a" * 40,
+        "target_branch": "agent/explicit-runtime-lineage",
+        "generation": 2,
+        "lease_seconds": 120,
+    }
+    handler._allowed("acquireWriterLease", lease_body)
+    handler._allowed(
+        "commitFilesGoverned",
+        {
+            "task_id": "task",
+            "job_id": "job-explicit-runtime-lineage",
+            "repository": "aios/aios",
+            "expected_branch_oid": "a" * 40,
+            "target_branch": "agent/explicit-runtime-lineage",
+            "generation": 2,
+            "idempotency_key": "commit-explicit-runtime-lineage",
+            "files": {"docs/x.txt": "eA=="},
+            "message": "test",
+        },
+    )
+
+
+def test_http_allows_omitted_job_id_for_durable_server_resolution():
+    handler = BridgeHandler.__new__(BridgeHandler)
+    lease_body = {
+        "schema": WriterLeaseRequestV2.schema,
+        "task_id": "task",
+        "repository": "aios/aios",
+        "branch_mode": "CONTINUE_EXISTING",
+        "base_oid": "a" * 40,
+        "expected_branch_oid": "a" * 40,
+        "target_branch": "agent/implicit-runtime-lineage",
+        "generation": 2,
+        "lease_seconds": 120,
+    }
+    handler._allowed("acquireWriterLease", lease_body)
+    handler._allowed(
+        "commitFilesGoverned",
+        {
+            "task_id": "task",
+            "repository": "aios/aios",
+            "expected_branch_oid": "a" * 40,
+            "target_branch": "agent/implicit-runtime-lineage",
+            "generation": 2,
+            "idempotency_key": "commit-implicit-runtime-lineage",
+            "files": {"docs/x.txt": "eA=="},
+            "message": "test",
+        },
+    )
+
+
+def test_capability_contracts_return_exact_job_id_lineage():
+    contracts = BridgeV2Adapter(runtime_status={}).getGovernedWriteCapabilities()["operation_contracts"]
+    for operation in ("acquireWriterLease", "bootstrapWriterLease", "renewWriterLease"):
+        assert "job_id" in contracts[operation]["response_fields"]
+    for operation in ("commitFileGoverned", "commitFilesGoverned"):
+        assert "job_id" in contracts[operation]["response_fields"]

tests/test_chatgpt_bridge_v2.py

@@ -1,90 +0,0 @@
-from __future__ import annotations
-
-import hashlib
-import json
-from pathlib import Path
-import tempfile
-
-import pytest
-import yaml
-
-from aios_chatgpt_bridge_v2 import (
-    BRIDGE_OPERATIONS,
-    BRIDGE_SCHEMA_VERSION,
-    OPERATION_REQUIRED_FIELDS,
-    BridgeV2Adapter,
-    ControlPlaneReleaseManifest,
-    RuntimeDriftError,
-)
-
-
-ROOT = Path(__file__).parents[1]
-
-
-def test_immutable_release_identity_accepts_exact_artifact_and_rejects_workspace_drift():
-    with tempfile.TemporaryDirectory() as directory:
-        approved = Path(directory) / "releases"
-        runtime = approved / "release-1"
-        runtime.mkdir(parents=True)
-        artifact = runtime / "bridge.pyz"
-        artifact.write_bytes(b"bridge-v2")
-        digest = hashlib.sha256(artifact.read_bytes()).hexdigest()
-        manifest = ControlPlaneReleaseManifest(
-            "bridge-v2-test", "a" * 40, digest, runtime, BRIDGE_SCHEMA_VERSION,
-            "aios/aios", Path("/data/aios-gitops/repo.git"), "STAGING",
-        )
-        assert manifest.validate(artifact, observed_oid="a" * 40, approved_root=approved)["drift_status"] == "PASS"
-        with pytest.raises(RuntimeDriftError, match="CONTROL_PLANE_RUNTIME_DRIFT"):
-            manifest.validate(artifact, observed_oid="b" * 40, approved_root=approved)
-        mutable = ControlPlaneReleaseManifest(
-            "bad", "a" * 40, digest, Path("/var/lib/worktrees/dev"), BRIDGE_SCHEMA_VERSION,
-            "aios/aios", Path("/data/aios-gitops/repo.git"), "STAGING",
-        )
-        with pytest.raises(RuntimeDriftError, match="CONTROL_PLANE_RUNTIME_DRIFT"):
-            mutable.validate(artifact, observed_oid="a" * 40, approved_root=approved)
-
-
-def test_bridge_capabilities_keep_legacy_closed_and_expose_exact_operations():
-    adapter = BridgeV2Adapter(runtime_status={"drift_status": "PASS"})
-    assert adapter.getRuntimeStatus()["bridge_schema_version"] == BRIDGE_SCHEMA_VERSION
-    capabilities = adapter.getGovernedWriteCapabilities()
-    assert capabilities["legacy_writes_enabled"] is False
-    assert capabilities["governed_writes_enabled"] is True
-    assert tuple(capabilities["operations"]) == BRIDGE_OPERATIONS
-    assert adapter.legacy_write_disabled() == {
-        "error": "LEGACY_WRITE_DISABLED",
-        "replacement": "createGovernedTask",
-        "governed_writes_available": True,
-    }
-
-
-def test_openapi_runtime_and_fragment_required_fields_are_exactly_converged():
-    canonical = yaml.safe_load((ROOT / "docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8"))
-    fragment = yaml.safe_load((ROOT / "docs/gitops/openapi-authorized-task-writer-fragment.yaml").read_text(encoding="utf-8"))
-    operations = {}
-    for path, methods in canonical["paths"].items():
-        for method, value in methods.items():
-            if isinstance(value, dict) and value.get("operationId") in BRIDGE_OPERATIONS:
-                operations[value["operationId"]] = value
-    assert set(operations) == set(BRIDGE_OPERATIONS)
-    for operation, required in OPERATION_REQUIRED_FIELDS.items():
-        if "requestBody" not in operations[operation]:
-            assert required == ()
-            continue
-        schema = operations[operation]["requestBody"]["content"]["application/json"]["schema"]
-        assert tuple(schema["required"]) == required
-    fragment_required = tuple(fragment["components"]["schemas"]["WriterLeaseRequestV2"]["required"])
-    assert fragment_required == OPERATION_REQUIRED_FIELDS["acquireWriterLease"]
-
-
-def test_release_manifest_round_trip_contains_only_declared_identity_fields():
-    manifest = ControlPlaneReleaseManifest(
-        "v", "a" * 40, "b" * 64, Path("/opt/aios/gitops-control-plane/v"), BRIDGE_SCHEMA_VERSION,
-        "aios/aios", Path("/data/aios-gitops/repo.git"), "STAGING",
-    )
-    value = manifest.as_dict()
-    assert tuple(value) == (
-        "control_plane_release_version", "control_plane_target_oid", "artifact_sha256", "runtime_path",
-        "bridge_schema_version", "repository_identity", "authoritative_git_dir", "deployment_state",
-    )
-    assert "credential" not in json.dumps(value).lower()

tests/test_continuation_runtime_normalization.py

@@ -0,0 +1,304 @@
+from __future__ import annotations
+
+from pathlib import Path
+import re
+import json
+from types import SimpleNamespace
+
+import pytest
+import yaml
+
+from aios_chatgpt_bridge_v2_server import GovernedRuntime
+from aios_continuation_executor import ContinuationExecutor
+from aios_continuation_lease import WriterLeaseRequestV2
+from aios_gitops_job_controller import JobState
+
+
+TASK = "continuation-normalization-test"
+JOB = "job-continuation-normalization-test"
+REPO = "aios/aios"
+BASE = "a" * 40
+BRANCH = "agent/continuation-normalization-test"
+
+
+class Authority:
+    def __init__(self, head: str | None) -> None:
+        self.head = head
+
+    def read_ref(self, ref: str) -> str | None:
+        assert ref == "refs/heads/" + BRANCH
+        return self.head
+
+    def commit_exists(self, oid: str) -> bool:
+        return oid == BASE
+
+    def branch_exists(self, branch: str) -> bool:
+        assert branch == BRANCH
+        return self.head is not None
+
+    def branch_head(self, branch: str) -> str:
+        assert branch == BRANCH and self.head is not None
+        return self.head
+
+    def is_ancestor(self, older: str, newer: str) -> bool:
+        return older == BASE and newer == BASE
+
+
+def lease(**overrides: object) -> WriterLeaseRequestV2:
+    values = {
+        "task_id": TASK,
+        "job_id": JOB,
+        "repository": REPO,
+        "branch_mode": "CREATE_NEW",
+        "base_oid": BASE,
+        "expected_branch_oid": BASE,
+        "target_branch": BRANCH,
+        "generation": 1,
+        "lease_seconds": 120,
+    }
+    values.update(overrides)
+    return WriterLeaseRequestV2(**values)
+
+
+def runtime(*, head: str | None = BASE, **binding_overrides: object) -> GovernedRuntime:
+    value = GovernedRuntime.__new__(GovernedRuntime)
+    value.authority = Authority(head)
+    binding = {
+        "task_id": TASK,
+        "job_id": JOB,
+        "repository": REPO,
+        "base_oid": BASE,
+        "expected_branch_oid": BASE,
+        "target_branch": BRANCH,
+        "generation": 1,
+        "branch_mode": "CREATE_NEW",
+    }
+    binding.update(binding_overrides)
+    value.bindings = {TASK: binding}
+    return value
+
+
+def test_same_lineage_create_new_normalizes_to_continue_existing() -> None:
+    normalized = runtime()._normalize_runtime_lease(lease())
+    assert normalized.branch_mode == "CONTINUE_EXISTING"
+    assert normalized.task_id == TASK
+    assert normalized.job_id == JOB
+    assert normalized.repository == REPO
+    assert normalized.target_branch == BRANCH
+    assert normalized.expected_branch_oid == BASE
+    assert normalized.generation == 1
+
+
+def test_unprovisioned_create_new_stays_create_new() -> None:
+    assert runtime(head=None)._normalize_runtime_lease(lease()).branch_mode == "CREATE_NEW"
+
+
+@pytest.mark.parametrize(
+    ("field", "value"),
+    (
+        ("repository", "other/repo"),
+        ("base_oid", "b" * 40),
+        ("expected_branch_oid", "b" * 40),
+        ("target_branch", "agent/foreign"),
+        ("generation", 2),
+    ),
+)
+def test_binding_mismatch_fails_closed(field: str, value: object) -> None:
+    with pytest.raises(RuntimeError, match="LEASE_BINDING_CONFLICT"):
+        runtime(**{field: value})._normalize_runtime_lease(lease())
+
+
+def test_drifted_existing_head_fails_closed() -> None:
+    with pytest.raises(RuntimeError, match="EXPECTED_BRANCH_OID_CONFLICT"):
+        runtime(head="b" * 40)._normalize_runtime_lease(lease())
+
+
+def test_openapi_contract_parses_and_requires_exact_commit_lineage() -> None:
+    document = yaml.safe_load(
+        Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
+    )
+    schema = document["components"]["schemas"]["BridgeCommitResponse"]
+    assert {
+        "job_id",
+        "commit_oid",
+        "commit_visible",
+        "branch_mode",
+        "target_branch",
+        "generation",
+    } <= set(schema["required"])
+
+
+def test_changed_production_files_pass_secret_scan() -> None:
+    paths = [
+        Path("active-runtime/app/aios_authority_git_executor.py"),
+        Path("active-runtime/app/aios_chatgpt_bridge_v2_server.py"),
+        Path("active-runtime/app/aios_continuation_executor.py"),
+        Path("active-runtime/app/aios_continuation_lease.py"),
+        Path("active-runtime/app/authorized_task_writer_provisioning.py"),
+        Path("active-runtime/app/aios_chatgpt_bridge_v2.py"),
+        Path("docs/gitops/openapi-chatgpt-actions.yaml"),
+    ]
+    expression = re.compile(
+        r"(?i)(BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|"
+        r"authorization:\\s*bearer\\s+[A-Za-z0-9._-]{12,}|"
+        r"api[_-]?key\\s*[:=]\\s*['\\\"][^'\\\"]{12,})"
+    )
+    hits = []
+    for path in paths:
+        for number, line in enumerate(
+            path.read_text(encoding="utf-8", errors="replace").splitlines(), 1
+        ):
+            if expression.search(line):
+                hits.append(f"{path}:{number}")
+    assert hits == []
+
+
+def test_remote_verified_job_is_not_completed_when_head_cas_callback_fails() -> None:
+    class Store:
+        def read(self, _job_id):
+            return {
+                "branch": BRANCH,
+                "request_json": json.dumps(
+                    {"binding": {"expected_branch_oid": BASE}}
+                ),
+            }
+
+    class Controller:
+        def __init__(self):
+            self.store = Store()
+            self.states = []
+
+        def advance(self, _job_id, state, **_kwargs):
+            self.states.append(state)
+            return SimpleNamespace(as_dict=lambda: {"state": state.value})
+
+    executor = ContinuationExecutor.__new__(ContinuationExecutor)
+    executor.controller = Controller()
+    executor._observe_remote = lambda _branch, oid: (oid, oid, True)
+
+    def fail_cas(_oid):
+        raise RuntimeError("LEASE_CAS_CONFLICT")
+
+    with pytest.raises(RuntimeError, match="LEASE_CAS_CONFLICT"):
+        executor._finish_remote_verification(
+            JOB,
+            "b" * 40,
+            "b" * 40,
+            before_complete=fail_cas,
+        )
+
+    assert executor.controller.states == [JobState.REMOTE_VERIFIED]
+
+
+@pytest.mark.parametrize("branch_mode", ("CREATE_NEW", "CONTINUE_EXISTING"))
+def test_executor_preflight_accepts_the_exact_mode_dependent_normalized_shape(
+    branch_mode: str,
+) -> None:
+    from datetime import datetime, timedelta, timezone
+    from aios_continuation_executor import (
+        ContinuationPermissions,
+        ContinuationRuntimeBinding,
+    )
+
+    request = lease(branch_mode=branch_mode)
+    now = datetime.now(timezone.utc)
+    executor = ContinuationExecutor.__new__(ContinuationExecutor)
+    executor.authority = Authority(None if branch_mode == "CREATE_NEW" else BASE)
+    executor.now = lambda: now
+    executor._max_generation = lambda _branch, *, exclude_job_id=None: 0
+    executor.workspace = SimpleNamespace(
+        is_detached=lambda: True,
+        head_oid=lambda: BASE,
+    )
+    executor.remote = SimpleNamespace(repository_identity=lambda: REPO)
+    binding = ContinuationRuntimeBinding(
+        request=request,
+        job_id=JOB,
+        workspace_path=Path("/tmp/continuation-normalization-test"),
+        lease_not_before=now - timedelta(seconds=1),
+        lease_expires_at=now + timedelta(seconds=60),
+        original_receipt_valid=True,
+        original_grant_consumed=True,
+        permissions=ContinuationPermissions(),
+    )
+
+    executor._validate_preflight(binding, job_id=JOB)
+
+
+def test_create_new_executor_resumes_executing_and_uses_absence_bound_writers() -> None:
+    from datetime import datetime, timedelta, timezone
+    from aios_continuation_executor import (
+        ContinuationCommit,
+        ContinuationPermissions,
+        ContinuationRuntimeBinding,
+    )
+
+    new_oid = "b" * 40
+
+    class Store:
+        def read(self, _job_id: str) -> dict[str, object]:
+            return {"state": "EXECUTING", "revision": 4}
+
+    class Controller:
+        def __init__(self) -> None:
+            self.store = Store()
+            self.advanced: list[str] = []
+
+        def advance(self, _job_id: str, state: JobState, **_kwargs: object) -> object:
+            self.advanced.append(state.value)
+            return SimpleNamespace(as_dict=lambda: {"state": state.value})
+
+    class Workspace:
+        def commit_files(self, _files: object, _message: str) -> str:
+            return new_oid
+
+    class CreateAuthority:
+        def __init__(self) -> None:
+            self.created: list[tuple[str, str, str]] = []
+
+        def is_ancestor(self, older: str, newer: str) -> bool:
+            return older == BASE and newer == new_oid
+
+        def create_task_branch_cas(self, branch: str, base: str, new: str) -> str:
+            self.created.append((branch, base, new))
+            return new
+
+        def compare_and_swap_branch(self, *_args: object) -> str:
+            raise AssertionError("existing-branch CAS must not serve CREATE_NEW")
+
+    class CreateRemote:
+        def __init__(self) -> None:
+            self.created: list[tuple[str, str]] = []
+
+        def push_new_exact(self, branch: str, new: str) -> None:
+            self.created.append((branch, new))
+
+        def push_exact(self, *_args: object) -> None:
+            raise AssertionError("existing-branch push must not serve CREATE_NEW")
+
+    class Credential:
+        def project(self) -> None: pass
+        def revoke(self) -> None: pass
+
+    controller=Controller(); authority=CreateAuthority(); remote=CreateRemote()
+    executor=ContinuationExecutor(controller,authority,Workspace(),remote,Credential())
+    executor._validate_preflight=lambda *_args,**_kwargs: None
+    executor._finish_remote_verification=lambda *_args,**_kwargs: {
+        "job_id":JOB,"state":"COMPLETED","receipt":{"authority_oid":new_oid,"commit_visible":True}
+    }
+    now=datetime.now(timezone.utc)
+    binding=ContinuationRuntimeBinding(
+        request=lease(branch_mode="CREATE_NEW"),job_id=JOB,
+        workspace_path=Path("/tmp/create-new-executor-resume"),
+        lease_not_before=now-timedelta(seconds=1),lease_expires_at=now+timedelta(seconds=60),
+        original_receipt_valid=True,original_grant_consumed=True,
+        permissions=ContinuationPermissions(),
+    )
+    result=executor.execute(
+        binding,ContinuationCommit("create-new-test",{"docs/test.txt":b"ok"},"test")
+    )
+
+    assert result["state"]=="COMPLETED"
+    assert authority.created==[(BRANCH,BASE,new_oid)]
+    assert remote.created==[(BRANCH,new_oid)]
+    assert controller.advanced==["LOCAL_VERIFIED","REMOTE_SYNCING"]

tests/test_governed_continuation_executor.py

@@ -1,283 +0,0 @@
-from __future__ import annotations
-
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-import subprocess
-import tempfile
-
-import pytest
-
-from aios_continuation_executor import (
-    ContinuationCommit,
-    ContinuationExecutionError,
-    ContinuationExecutor,
-    ContinuationPermissions,
-    ContinuationRuntimeBinding,
-    DetachedGitWorkspace,
-    GiteaContinuationRemote,
-)
-from aios_continuation_lease import WriterLeaseRequestV2
-from aios_gitops_job_controller import BindingConflict, GitOpsJobController, JobState, JobStore
-
-
-TASK = "TASK-P0-CHATGPT-BRIDGE-V2-CONTROL-PLANE-CONVERGENCE-20260809"
-REPOSITORY = "aios/aios"
-BRANCH = "agent/p0-chatgpt-bridge-v2-control-plane-convergence-20260809"
-BASE = "2" * 40
-HEAD = "8" * 40
-NEW = "9" * 40
-NOW = datetime(2026, 8, 9, 12, 0, tzinfo=timezone.utc)
-
-
-class Authority:
-    def __init__(self, *, head=HEAD, exists=True, descendant=True):
-        self.head = head
-        self.exists = exists
-        self.descendant = descendant
-        self.cas_calls = []
-
-    def branch_exists(self, branch):
-        return self.exists
-
-    def branch_head(self, branch):
-        return self.head
-
-    def is_ancestor(self, older, newer):
-        if (older, newer) == (BASE, HEAD):
-            return True
-        return self.descendant and (older, newer) in {(HEAD, NEW), (BASE, NEW)}
-
-    def compare_and_swap_branch(self, branch, expected, new):
-        self.cas_calls.append((branch, expected, new))
-        if self.head != expected:
-            raise RuntimeError("stale")
-        self.head = new
-        return new
-
-
-class Workspace:
-    def __init__(self, *, detached=True, head=HEAD):
-        self.detached = detached
-        self.head = head
-        self.commits = 0
-
-    def is_detached(self):
-        return self.detached
-
-    def head_oid(self):
-        return self.head
-
-    def commit_files(self, files, message):
-        self.commits += 1
-        self.head = NEW
-        return NEW
-
-
-class Remote:
-    def __init__(self, *, git=HEAD, api=HEAD, visible=True, repository=REPOSITORY, fail_after_push=False, omit_after_push=False):
-        self.git = git
-        self.api = api
-        self.visible = visible
-        self.repository = repository
-        self.fail_after_push = fail_after_push
-        self.omit_after_push = omit_after_push
-        self.pushes = 0
-
-    def repository_identity(self):
-        return self.repository
-
-    def push_exact(self, branch, expected, new):
-        self.pushes += 1
-        if self.git is None:
-            raise RuntimeError("remote branch missing")
-        if self.git != expected:
-            raise RuntimeError("remote conflict")
-        if not self.omit_after_push:
-            self.git = self.api = new
-        else:
-            self.git = self.api = None
-        if self.fail_after_push:
-            raise TimeoutError("response lost")
-
-    def read_git_ref(self, branch):
-        return self.git
-
-    def read_api_branch(self, branch):
-        return self.api
-
-    def commit_visible(self, oid):
-        return self.visible and self.api == oid
-
-
-class Credential:
-    def __init__(self):
-        self.projected = 0
-        self.revoked = 0
-
-    def project(self):
-        self.projected += 1
-
-    def revoke(self):
-        self.revoked += 1
-
-
-def lease_request(**changes):
-    values = dict(task_id=TASK, repository=REPOSITORY, branch_mode="CONTINUE_EXISTING", base_oid=BASE,
-                  expected_branch_oid=HEAD, target_branch=BRANCH, generation=1, lease_seconds=900)
-    values.update(changes)
-    return WriterLeaseRequestV2(**values)
-
-
-def binding(**changes):
-    values = dict(
-        request=lease_request(),
-        workspace_path=Path("/var/lib/aios-task-writer/continuation-worktrees/exact"),
-        lease_not_before=NOW - timedelta(seconds=1),
-        lease_expires_at=NOW + timedelta(minutes=15),
-        original_receipt_valid=True,
-        original_grant_consumed=True,
-        permissions=ContinuationPermissions(),
-    )
-    values.update(changes)
-    return ContinuationRuntimeBinding(**values)
-
-
-def commit(**changes):
-    values = dict(idempotency_key="first-continuation", files={"active-runtime/app/new.py": b"ok\n"},
-                  message="feat(gitops): add governed continuation executor")
-    values.update(changes)
-    return ContinuationCommit(**values)
-
-
-def make_executor(authority=None, workspace=None, remote=None, credential=None):
-    temp = tempfile.TemporaryDirectory()
-    controller = GitOpsJobController(JobStore(Path(temp.name).resolve()))
-    executor = ContinuationExecutor(
-        controller, authority or Authority(), workspace or Workspace(), remote or Remote(), credential or Credential(),
-        now=lambda: NOW,
-    )
-    executor._test_temp = temp
-    return executor
-
-
-def test_exact_existing_branch_completes_only_after_all_remote_proofs():
-    authority, remote, credential = Authority(), Remote(), Credential()
-    result = make_executor(authority, remote=remote, credential=credential).execute(binding(), commit())
-    assert result["state"] == JobState.COMPLETED.value
-    assert result["receipt"]["authority_oid"] == result["receipt"]["git_remote_oid"] == NEW
-    assert result["receipt"]["api_branch_oid"] == NEW
-    assert result["receipt"]["commit_visible"] is True
-    assert authority.cas_calls == [(BRANCH, HEAD, NEW)]
-    assert credential.projected == credential.revoked == 1
-    assert "credential" not in repr(result).lower()
-
-
-@pytest.mark.parametrize(
-    "runtime_binding,authority,workspace,error",
-    [
-        (binding(request=lease_request(expected_branch_oid="7" * 40)), Authority(), Workspace(), "EXISTING_BRANCH_OID_CONFLICT"),
-        (binding(), Authority(exists=False), Workspace(), "EXISTING_BRANCH_MISSING"),
-        (binding(), Authority(), Workspace(detached=False), "WORKTREE_NOT_DETACHED"),
-        (binding(), Authority(), Workspace(head="7" * 40), "WORKTREE_HEAD_MISMATCH"),
-        (binding(lease_expires_at=NOW), Authority(), Workspace(), "LEASE_EXPIRED"),
-        (binding(request=lease_request(repository="other/repo")), Authority(), Workspace(), "request_identity_invalid"),
-        (binding(request=lease_request(target_branch="main")), Authority(), Workspace(), "PROTECTED_BRANCH_REJECTED"),
-        (binding(request=lease_request(generation=1)), Authority(), Workspace(), "GENERATION_NOT_MONOTONIC"),
-    ],
-)
-def test_pre_side_effect_failures_never_create_or_update_a_branch(runtime_binding, authority, workspace, error):
-    executor = make_executor(authority, workspace=workspace)
-    if error == "GENERATION_NOT_MONOTONIC":
-        executor.observe_generation(BRANCH, 1)
-    with pytest.raises(Exception, match=error):
-        executor.execute(runtime_binding, commit())
-    assert authority.cas_calls == []
-    assert workspace.commits == 0
-
-
-@pytest.mark.parametrize("field", ["create_target_branch", "force_push", "tag_write", "baseline_write", "production_write", "main_write"])
-def test_forbidden_capabilities_fail_before_credential_projection(field):
-    credential = Credential()
-    permissions = ContinuationPermissions(**{field: True})
-    with pytest.raises(ContinuationExecutionError, match="MUTATION_PERMISSION_DENIED"):
-        make_executor(credential=credential).execute(binding(permissions=permissions), commit())
-    assert credential.projected == 0
-
-
-def test_non_fast_forward_and_concurrent_movement_are_rejected_cas_only():
-    authority = Authority(descendant=False)
-    with pytest.raises(ContinuationExecutionError, match="NON_FAST_FORWARD_COMMIT"):
-        make_executor(authority).execute(binding(), commit())
-    assert authority.cas_calls == []
-
-
-def test_authority_success_and_gitea_missing_is_never_completed():
-    remote = Remote(omit_after_push=True)
-    result = make_executor(remote=remote).execute(binding(), commit())
-    assert result["state"] == JobState.RECONCILIATION_REQUIRED.value
-    assert result["side_effect_state"] == "REMOTE_PUSH_PENDING"
-    assert result["state"] not in {JobState.REMOTE_VERIFIED.value, JobState.COMPLETED.value}
-
-
-def test_response_loss_after_remote_success_reconciles_by_observation_without_second_push():
-    remote = Remote(fail_after_push=True)
-    executor = make_executor(remote=remote)
-    first = executor.execute(binding(), commit())
-    assert first["state"] == JobState.RECONCILIATION_REQUIRED.value
-    assert remote.pushes == 1
-    recovered = executor.reconcile(first["job_id"])
-    assert recovered["state"] == JobState.COMPLETED.value
-    assert remote.pushes == 1
-
-
-def test_observation_first_reconcile_retries_only_when_remote_is_exact_expected_old_oid():
-    remote = Remote(fail_after_push=True)
-    executor = make_executor(remote=remote)
-    first = executor.execute(binding(), commit())
-    assert first["state"] == JobState.RECONCILIATION_REQUIRED.value
-    remote.git = remote.api = HEAD
-    remote.visible = True
-    remote.fail_after_push = False
-    recovered = executor.reconcile(first["job_id"])
-    assert recovered["state"] == JobState.COMPLETED.value
-    assert remote.pushes == 2
-
-
-def test_duplicate_idempotency_replay_and_conflicting_payload():
-    executor = make_executor()
-    first = executor.execute(binding(), commit())
-    replay = executor.execute(binding(), commit())
-    assert replay["job_id"] == first["job_id"]
-    with pytest.raises(BindingConflict, match="BINDING_CONFLICT"):
-        executor.execute(binding(), commit(files={"active-runtime/app/new.py": b"changed\n"}))
-
-
-def test_secret_like_payload_fails_before_projection():
-    credential = Credential()
-    secret_fixture = b"to" + b"ken=" + b"ghp_" + b"abcdefghijklmnopqrstuvwxyz0123456789"
-    with pytest.raises(ContinuationExecutionError, match="SECRET_LIKE_PAYLOAD_REJECTED"):
-        make_executor(credential=credential).execute(binding(), commit(files={"x": secret_fixture}))
-    assert credential.projected == 0
-
-
-def test_remote_identity_cannot_alias_the_authority_bare_repo():
-    with pytest.raises(ContinuationExecutionError, match="GITEA_REMOTE_IDENTITY_INVALID"):
-        GiteaContinuationRemote.validate_remote_url("/data/aios-gitops/repo.git")
-    GiteaContinuationRemote.validate_remote_url("aiman@g.cnnetmkt.top:aios/aios.git")
-
-
-def test_detached_workspace_preserves_porcelain_leading_status_column():
-    with tempfile.TemporaryDirectory() as directory:
-        root = Path(directory)
-        subprocess.run(["git", "init", "-q", str(root)], check=True)
-        subprocess.run(["git", "-C", str(root), "config", "user.name", "test"], check=True)
-        subprocess.run(["git", "-C", str(root), "config", "user.email", "test@localhost"], check=True)
-        (root / "tracked.py").write_text("one\n", encoding="utf-8")
-        subprocess.run(["git", "-C", str(root), "add", "tracked.py"], check=True)
-        subprocess.run(["git", "-C", str(root), "commit", "-q", "-m", "base"], check=True)
-        subprocess.run(["git", "-C", str(root), "checkout", "-q", "--detach"], check=True)
-        (root / "tracked.py").write_text("two\n", encoding="utf-8")
-        (root / "new.py").write_text("new\n", encoding="utf-8")
-        workspace = DetachedGitWorkspace(root)
-        assert workspace.is_detached()
-        assert workspace._dirty_paths() == {"tracked.py", "new.py"}

tests/test_governed_local_writer.py

@@ -250,7 +250,7 @@ class GovernedLocalWriterTests(unittest.TestCase):
             }
             self.assertEqual(service.process_request(secret_request, peer)["status"], "error")
 
-    def test_one_shot_consumption(self) -> None:
+    def test_idempotent_replay_returns_receipt(self) -> None:
         with tempfile.TemporaryDirectory() as root:
             directory = Path(root)
             auth = self._load_auth(self._make_auth_payload(), directory)
@@ -283,8 +283,8 @@ class GovernedLocalWriterTests(unittest.TestCase):
 
             self.assertEqual(service.process_request(create_request, peer)["status"], "ok")
             self.assertEqual(service.process_request(append_request, peer)["status"], "ok")
-            self.assertEqual(service.process_request(append_request, peer)["status"], "error")
-            self.assertEqual(len(sink.records), 3)
+            self.assertEqual(service.process_request(append_request, peer)["status"], "receipt")
+            self.assertEqual(len(sink.records), 2)
             self.assertEqual(len(handler.create_calls), 1)
             self.assertEqual(len(handler.append_calls), 1)
 

tests/test_isolated_executor.py

@@ -0,0 +1,67 @@
+from pathlib import Path
+import hashlib,json,os,tarfile,sys,tempfile
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+import aios_isolated_executor as mod
+
+def make_archive(tmp_path):
+    root=tmp_path/"src"; root.mkdir()
+    (root/"hello.py").write_text("VALUE = 1\n")
+    archive=tmp_path/"source.tgz"
+    with tarfile.open(archive,"w:gz") as tf: tf.add(root/"hello.py",arcname="hello.py")
+    return archive
+
+def test_isolated_executor_applies_hash_bound_change(tmp_path,monkeypatch):
+    archive=make_archive(tmp_path)
+    monkeypatch.delenv("CREDENTIALS_DIRECTORY",raising=False)
+    monkeypatch.setattr(mod,"assert_uncredentialed",lambda:None)
+    request={
+      "schema":"aios.isolated-execution.request.v1",
+      "request_id":"task-req-0000000000000000",
+      "source_archive":str(archive),
+      "source_archive_sha256":mod.sha256(archive.read_bytes()),
+      "change_set":[{
+        "path":"hello.py","operation":"replace_text","old":"VALUE = 1","new":"VALUE = 2","count":1,
+        "expected_sha256":mod.sha256(b"VALUE = 1\n")
+      }],
+      "verification":[{"label":"compile","argv":["/usr/bin/python3","-m","py_compile","hello.py"],"cwd":".","timeout_seconds":30}]
+    }
+    req=tmp_path/"req.json"; res=tmp_path/"res.json"
+    req.write_text(json.dumps(request))
+    mod.execute_request(req,res)
+    out=json.loads(res.read_text())
+    assert out["request_id"]=="task-req-0000000000000000"
+    assert out["credential_isolation"]["credential_env_absent"] is True
+    changed=out["changed_files"][0]
+    assert changed["path"]=="hello.py" and changed["deleted"] is False
+
+def test_isolated_executor_source_drift_denied(tmp_path,monkeypatch):
+    archive=make_archive(tmp_path); monkeypatch.setattr(mod,"assert_uncredentialed",lambda:None)
+    request={
+      "schema":"aios.isolated-execution.request.v1","request_id":"task-req-0000000000000001",
+      "source_archive":str(archive),
+      "source_archive_sha256":mod.sha256(archive.read_bytes()),
+      "change_set":[{"path":"hello.py","operation":"write_file","content":"x\n","expected_sha256":"0"*64}],
+      "verification":[]
+    }
+    req=tmp_path/"req.json"; res=tmp_path/"res.json"; req.write_text(json.dumps(request))
+    with pytest.raises(mod.IsolatedExecutorError,match="SOURCE_DRIFT"):
+        mod.execute_request(req,res)
+
+def test_credential_boundary_eacces_is_accepted(monkeypatch):
+    class DeniedDirectory:
+        def exists(self): return True
+        def is_symlink(self): return False
+        def is_dir(self): return True
+        def iterdir(self): raise PermissionError(13,"permission denied")
+    monkeypatch.setattr(mod.os,"access",lambda *_args,**_kwargs:False)
+    assert mod._credential_exposure(DeniedDirectory()) is None
+
+def test_systemd_unit_has_no_credentials_and_private_network():
+    unit=(ROOT/"deploy/systemd/aios-online-agent-isolated-executor.service").read_text()
+    assert "PrivateNetwork=true" in unit
+    assert "InaccessiblePaths=/run/credentials" in unit
+    assert "LoadCredential" not in unit
+    assert "SupplementaryGroups=gitops" not in unit

tests/test_message_handoff.py

@@ -0,0 +1,127 @@
+from __future__ import annotations
+
+import datetime as dt
+import pathlib
+import sys
+
+import pytest
+
+APP = pathlib.Path(__file__).resolve().parents[1] / "active-runtime" / "app"
+if str(APP) not in sys.path:
+    sys.path.insert(0, str(APP))
+
+from message_handoff import (
+    ConfidentialityScopeDenied,
+    DeliveryContext,
+    DurableHandoffStore,
+    HandoffFabric,
+    IdempotencyConflict,
+    MessageEnvelope,
+    MessageExpired,
+    MessageScopeMismatch,
+    SequenceGap,
+    authorize_delivery,
+    bind_envelope_scope,
+    stable_event_id,
+)
+
+
+def actor(**overrides):
+    values = dict(
+        tenant_id="tenant-a", user_id="user-a", project_id="project-a",
+        conversation_id="conversation-a", run_id="run-a",
+        capabilities=("task.read", "message.read"),
+    )
+    values.update(overrides)
+    return DeliveryContext(**values)
+
+
+def envelope(**overrides):
+    values = dict(
+        source="agent-a", target="agent-b", message_type="handoff.request", payload={"value": 1},
+        tenant_id="tenant-a", user_id="user-a", project_id="project-a",
+        conversation_id="conversation-a", task_id="task-a", run_id="run-a",
+        sequence=1, idempotency_key="idem-1", capability_scope=("message.read",),
+        confidentiality_scope="private",
+    )
+    values.update(overrides)
+    return MessageEnvelope(**values)
+
+
+def test_MESSAGE_TARGET_COLLISION_DENY():
+    a = stable_event_id(source="a", target="user-a", message_type="event", payload={"x": 1},
+                        tenant_id="tenant-a", sequence=1, idempotency_key="same")
+    b = stable_event_id(source="a", target="user-b", message_type="event", payload={"x": 1},
+                        tenant_id="tenant-a", sequence=1, idempotency_key="same")
+    assert a != b
+
+
+def test_MESSAGE_SCOPE_MISMATCH_DENY():
+    with pytest.raises(MessageScopeMismatch, match="MESSAGE_SCOPE_MISMATCH_DENY"):
+        bind_envelope_scope(envelope(tenant_id="tenant-b"), actor())
+
+
+def test_HANDOFF_CROSS_TENANT_DENY(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    env = envelope()
+    store.put(env)
+    with pytest.raises(MessageScopeMismatch, match="MESSAGE_SCOPE_MISMATCH_DENY"):
+        store.get(env.envelope_id, actor=actor(tenant_id="tenant-b"))
+
+
+def test_MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE():
+    with pytest.raises(ConfidentialityScopeDenied, match="MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"):
+        authorize_delivery(actor(project_id="project-b"), envelope(confidentiality_scope="project"))
+    with pytest.raises(ConfidentialityScopeDenied, match="MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"):
+        authorize_delivery(actor(), envelope(capability_scope=("message.read", "secret.read")))
+
+
+def test_MESSAGE_IDEMPOTENCY_REPLAY(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    env = envelope()
+    assert store.put(env)[0] == "CREATED"
+    status, replay = store.put(env)
+    assert status == "REPLAY"
+    assert replay.envelope_id == env.envelope_id
+    with pytest.raises(IdempotencyConflict, match="MESSAGE_IDEMPOTENCY_CONFLICT"):
+        store.put(envelope(payload={"value": 2}))
+
+
+def test_MESSAGE_SEQUENCE_GAP_DETECT(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    store.put(envelope(sequence=1, idempotency_key="one"))
+    with pytest.raises(SequenceGap, match="MESSAGE_SEQUENCE_GAP_DETECT"):
+        store.put(envelope(sequence=3, idempotency_key="three"))
+
+
+def test_sequence_advances_and_scope_filters_pending(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    store.put(envelope(sequence=1, idempotency_key="one"))
+    store.put(envelope(sequence=2, idempotency_key="two", payload={"value": 2}))
+    assert [item.sequence for item in store.pending(target="agent-b", actor=actor())] == [1, 2]
+    assert store.pending(target="agent-b", actor=actor(tenant_id="tenant-b")) == []
+
+
+def test_expired_message_rejected(tmp_path):
+    expired = (dt.datetime.now(dt.timezone.utc) - dt.timedelta(seconds=1)).isoformat()
+    with pytest.raises(MessageExpired, match="MESSAGE_EXPIRED"):
+        DurableHandoffStore(tmp_path / "handoff.sqlite3").put(envelope(expires_at=expired))
+
+
+def test_server_actor_binding_fills_scope_and_recomputes_identity():
+    public = MessageEnvelope(
+        source="agent-a", target="agent-b", message_type="handoff.request", payload={"value": 1},
+        sequence=1, idempotency_key="bind-1", confidentiality_scope="public",
+    )
+    bound = bind_envelope_scope(public, actor())
+    assert (bound.tenant_id, bound.user_id, bound.project_id, bound.run_id) == (
+        "tenant-a", "user-a", "project-a", "run-a"
+    )
+    assert bound.envelope_id != public.envelope_id
+
+
+def test_handoff_fabric_publish_is_durable(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    status, env = HandoffFabric(store).publish(envelope(), actor=actor())
+    assert status == "CREATED"
+    assert store.get(env.envelope_id, actor=actor()).payload == {"value": 1}

tests/test_model_api_immutable_staging.py

@@ -0,0 +1,35 @@
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_model_api_source_is_immutable_and_authority_bound():
+    source = (ROOT / 'active-runtime' / 'app' / 'aios_model_api_staging.py').read_text(encoding='utf-8')
+    assert 'BaselineAuthority' in source
+    assert 'BASELINE_AUTHORITY = BaselineAuthority()' in source
+    assert 'LEGACY_GIT_WRITE_COMMANDS' in source
+    assert 'BaselineAuthorityError' in source
+    assert 'IMMUTABLE_STAGING' in source
+    assert 'LEGACY_GLOBAL_WRITES_DISABLED' in source
+    assert "'production_deployed': False" in source
+    assert "'governed_release_routing': 'bridge-v2'" in source
+
+
+def test_model_api_staging_unit_is_non_production_and_read_only():
+    unit = (ROOT / 'deploy' / 'systemd' / 'aios-gitops-model-api-v2r2c1-staging.service').read_text(encoding='utf-8')
+    assert 'aios-gitops-model-api-v2r2c1-staging.service' in unit
+    assert 'AIOS_GITOPS_WRITES_ENABLED=false' in unit
+    assert 'AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED=false' in unit
+    assert 'AIOS_GITOPS_PORT=18893' in unit
+    assert 'aios_model_api_staging.py' in unit
+    assert 'production' not in unit.lower().replace('model-api-v2r2c1-staging', '')
+
+
+def test_model_api_builder_manifest_contract():
+    builder = (ROOT / 'scripts' / 'build_v2r2c1_model_api_staging.py').read_text(encoding='utf-8')
+    assert 'aios.v2r2c1.model-api-staging-manifest.v1' in builder
+    assert "'target_version': 'V2R2C1'" in builder
+    assert "'repository_identity': 'aios/aios'" in builder
+    assert "'deployment_state': 'STAGING'" in builder
+    assert "'legacy_global_writes_enabled': False" in builder
+    assert 'private marker rejected' in builder

tests/test_online_agent_durable_checkpoint.py

@@ -0,0 +1,216 @@
+from __future__ import annotations
+
+from pathlib import Path
+import json
+import sys
+
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+APP=ROOT/"active-runtime/app"
+sys.path.insert(0,str(APP))
+
+from aios_online_agent_checkpoint import (
+    CheckpointBinding,
+    CheckpointError,
+    CheckpointStore,
+)
+import aios_online_agent_worker as worker
+
+
+def binding(attempt: int = 1, *, tenant_head: str = "b"*40):
+    return CheckpointBinding(
+        task_id="task-p1-a",
+        attempt=attempt,
+        execution_digest="d"*64,
+        job_id="job-p1-a",
+        repository="aios/aios",
+        base_oid="a"*40,
+        expected_branch_oid=tenant_head,
+        target_branch="agent/task-p1-a",
+        generation=1,
+    )
+
+
+def test_CHECKPOINT_DURABLE_WRITE(tmp_path):
+    store=CheckpointStore(tmp_path/"checkpoints.sqlite3")
+    first=store.append(binding(), "claimed", {"phase":"claimed","attempt":1})
+    second=store.append(binding(), "workspace_prepared", {"phase":"workspace_prepared","attempt":1})
+    assert first["sequence"] == 1
+    assert second["sequence"] == 2
+    latest=store.latest("task-p1-a")
+    assert latest["phase"]=="workspace_prepared"
+    assert latest["payload"]["attempt"]==1
+
+
+def test_CHECKPOINT_SCOPE_ISOLATION(tmp_path):
+    store=CheckpointStore(tmp_path/"checkpoints.sqlite3")
+    store.append(binding(), "claimed", {"phase":"claimed"})
+    changed=CheckpointBinding(
+        task_id="task-p1-a",attempt=1,execution_digest="d"*64,job_id="job-p1-a",
+        repository="aios/other",base_oid="a"*40,expected_branch_oid="b"*40,
+        target_branch="agent/task-p1-a",generation=1,
+    )
+    with pytest.raises(CheckpointError,match="CHECKPOINT_SCOPE_MISMATCH_DENY"):
+        store.append(changed,"workspace_prepared",{"phase":"workspace_prepared"})
+
+
+def test_RESUME_FROM_CHECKPOINT_across_attempt_same_binding(tmp_path):
+    store=CheckpointStore(tmp_path/"checkpoints.sqlite3")
+    store.append(binding(1), "source_capture_done", {
+        "phase":"source_capture_done",
+        "attempt":1,
+        "result":{"status":"SUCCEEDED","classification":"NEEDS_REWORK_SOURCE_CAPTURE"},
+    })
+    resumed=store.verify_latest_binding(binding(2))
+    assert resumed is not None
+    assert resumed["attempt"]==1
+    assert resumed["phase"]=="source_capture_done"
+
+
+def test_checkpoint_new_attempt_can_start_from_claimed(tmp_path):
+    store=CheckpointStore(tmp_path/"checkpoints.sqlite3")
+    store.append(binding(1),"result_submitted",{"phase":"result_submitted"})
+    cp=store.append(binding(2),"claimed",{"phase":"claimed"})
+    assert cp["attempt"]==2
+    assert cp["sequence"]==1
+
+
+def envelope():
+    return worker.ExecutionEnvelope(
+        task_id="task-p1-a",
+        job_id="job-p1-a",
+        repository="aios/aios",
+        base_oid="a"*40,
+        expected_branch_oid="b"*40,
+        target_branch="agent/task-p1-a",
+        branch_mode="CONTINUE_EXISTING",
+        generation=1,
+        idempotency_key="governed-p1-a",
+        action="source_capture",
+        adapter="source_capture",
+        capability_scope=("git.read","git.test"),
+        source_signals=(),
+        change_set=(),
+        verification=(),
+        governance={"task_id":"task-p1-a","job_id":"job-p1-a"},
+        workspace={},
+        digest="d"*64,
+    )
+
+
+def test_RESULT_SUBMISSION_REPLAY_SAFE_attempt_aware_key():
+    env=envelope()
+    result={"status":"SUCCEEDED","execution_digest":env.digest}
+    one=worker.result_idempotency_key(env.task_id,1,env,result)
+    two=worker.result_idempotency_key(env.task_id,2,env,result)
+    assert one != two
+    assert "-a1-result-" in one
+    assert "-a2-result-" in two
+    assert one == worker.result_idempotency_key(env.task_id,1,env,result)
+
+
+class RetryClient:
+    def __init__(self):
+        self.calls=[]
+    def result(self,task_id,lease_token,key,result):
+        self.calls.append((task_id,key,dict(result)))
+        return (599,{"error":"SERVICE_UNAVAILABLE"}) if len(self.calls)==1 else (201,{"status":"VERIFYING"})
+    def get(self,task_id):
+        return 500,{}
+
+
+def test_RETRY_IDEMPOTENT_NO_DUPLICATE_SIDE_EFFECT_reuses_same_key(monkeypatch):
+    client=RetryClient()
+    monkeypatch.setattr(worker.time,"sleep",lambda _:None)
+    status,response=worker.submit_result_replay_safe(
+        client,"task-p1-a","lease-token-"+"x"*32,"stable-key",{"status":"SUCCEEDED"}
+    )
+    assert status==201
+    assert [item[1] for item in client.calls]==["stable-key","stable-key"]
+
+
+class ConflictClient:
+    def __init__(self,result):
+        self.result_value=result
+    def result(self,*args):
+        return 409,{"error":"IDEMPOTENCY_CONFLICT"}
+    def get(self,task_id):
+        return 200,{"status":"VERIFYING","result":dict(self.result_value)}
+
+
+def test_RESULT_SUBMISSION_REPLAY_SAFE_reconciles_exact_result():
+    result={"status":"SUCCEEDED","value":1}
+    status,response=worker.submit_result_replay_safe(
+        ConflictClient(result),"task-p1-a","lease-token-"+"x"*32,"stable-key",result
+    )
+    assert status==200
+    assert response["idempotent"] is True
+    assert response["reconciled"] is True
+
+
+def test_RESULT_SUBMISSION_REPLAY_SAFE_rejects_conflicting_result():
+    status,response=worker.submit_result_replay_safe(
+        ConflictClient({"status":"SUCCEEDED","value":2}),
+        "task-p1-a","lease-token-"+"x"*32,"stable-key",
+        {"status":"SUCCEEDED","value":1},
+    )
+    assert status==409
+    assert response["error"]=="IDEMPOTENCY_CONFLICT"
+
+
+def test_WORKSPACE_CLEANUP_RECOVERY(tmp_path,monkeypatch):
+    root=tmp_path/"workspaces"; root.mkdir()
+    stale=root/"task-old"; stale.mkdir(); (stale/"x").write_text("x")
+    monkeypatch.setattr(worker,"WORKSPACE_ROOT",root)
+    monkeypatch.setattr(worker,"STATE_ROOT",tmp_path/"state")
+    removed=worker.recover_stale_workspaces()
+    assert removed==1
+    assert not stale.exists()
+
+
+class LeaseBridge:
+    def __init__(self):
+        self.calls=0
+    def call(self,route,body):
+        assert route=="/v2/writer-lease"
+        self.calls+=1
+        if self.calls==1:
+            return 599,{"error":"SERVICE_UNAVAILABLE"}
+        return 200,{
+            "lease_id":"lease-p1-a",
+            "job_id":"job-p1-a",
+            "task_id":"task-p1-a",
+            "repository":"aios/aios",
+            "base_oid":"a"*40,
+            "expected_branch_oid":"b"*40,
+            "branch_mode":"CONTINUE_EXISTING",
+            "generation":1,
+            "target_branch":"agent/task-p1-a",
+            "state":"ACTIVE",
+        }
+
+
+class LeaseHeartbeatStub:
+    def ensure(self):
+        return None
+
+
+def test_LEASE_RENEWAL_RECOVERY_retries_same_binding(monkeypatch):
+    env=envelope()
+    env=worker.ExecutionEnvelope(
+        task_id=env.task_id,job_id=env.job_id,repository=env.repository,
+        base_oid=env.base_oid,expected_branch_oid=env.expected_branch_oid,
+        target_branch=env.target_branch,branch_mode=env.branch_mode,generation=env.generation,
+        idempotency_key=env.idempotency_key,action=env.action,adapter=env.adapter,
+        capability_scope=env.capability_scope,source_signals=env.source_signals,
+        change_set=env.change_set,verification=env.verification,
+        governance={"task_id":env.task_id,"job_id":env.job_id,"lease_seconds":900},
+        workspace=env.workspace,digest=env.digest,
+    )
+    bridge=LeaseBridge()
+    monkeypatch.setattr(worker.time,"sleep",lambda _:None)
+    monkeypatch.setattr(worker,"STATE_ROOT",Path("/tmp")/"aios-p1-test-state")
+    response=worker.acquire_writer_lease_replay_safe(env,bridge,LeaseHeartbeatStub())
+    assert response["lease_id"]=="lease-p1-a"
+    assert bridge.calls==2

tests/test_online_agent_plan_store.py

@@ -0,0 +1,60 @@
+from pathlib import Path
+import sys
+import pytest
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/"active-runtime/app"))
+
+from aios_online_agent_execution import GovernedExecutionBinding
+from aios_online_agent_plan_store import ExecutionPlanStore, ExecutionPlanError
+
+BASE="a642b045775b9154a00ae78543037fbef4fb447b"
+HEAD="71523aef6e48b1e2fa516c456ca189b7a039104b"
+
+def binding(head=HEAD):
+    return GovernedExecutionBinding.from_mapping({
+      "task_id":"task-plan-a","job_id":"job-plan-a","repository":"aios/aios","base_oid":BASE,
+      "expected_branch_oid":head,"target_branch":"agent/task-plan-a","branch_mode":"CONTINUE_EXISTING",
+      "generation":1,"idempotency_key":"governed-plan-a",
+    })
+
+def request():
+    return {
+      "schema":"aios.online-agent.plan.v1","task_id":"task-plan-a","job_id":"job-plan-a",
+      "source_head_oid":HEAD,"generation":1,"idempotency_key":"plan-task-a-v1",
+      "execution":{
+        "action":"deterministic",
+        "change_set":[{"path":"x.py","operation":"write_file","content":"x=1\n"}],
+        "verification":[{"label":"compile","argv":["/usr/bin/python3","-m","py_compile","x.py"],"cwd":".","timeout_seconds":30}],
+        "capability_scope":["git.read","git.test"],
+      }
+    }
+
+def test_plan_register_and_resolve(tmp_path):
+    store=ExecutionPlanStore(tmp_path)
+    created=store.register(binding(),request())
+    assert created["idempotent"] is False
+    resolved=store.resolve(binding())
+    assert resolved["plan_digest"]==created["plan_digest"]
+    assert resolved["execution"]["action"]=="deterministic"
+
+def test_plan_is_idempotent(tmp_path):
+    store=ExecutionPlanStore(tmp_path); req=request()
+    first=store.register(binding(),req); second=store.register(binding(),req)
+    assert second["idempotent"] is True
+    assert first["plan_digest"]==second["plan_digest"]
+
+def test_plan_source_head_drift_denied(tmp_path):
+    store=ExecutionPlanStore(tmp_path); store.register(binding(),request())
+    with pytest.raises(ExecutionPlanError,match="SOURCE_HEAD_DRIFT"):
+        store.resolve(binding("b"*40))
+
+def test_plan_replacement_requires_cas(tmp_path):
+    store=ExecutionPlanStore(tmp_path); first=store.register(binding(),request())
+    changed=request(); changed["idempotency_key"]="plan-task-a-v2"
+    changed["execution"]["change_set"][0]["content"]="x=2\n"
+    with pytest.raises(ExecutionPlanError,match="REPLACEMENT_CAS_MISMATCH"):
+        store.register(binding(),changed)
+    changed["expected_previous_plan_digest"]=first["plan_digest"]
+    second=store.register(binding(),changed)
+    assert second["plan_digest"]!=first["plan_digest"]

tests/test_trace_tool_credential_governance.py

@@ -0,0 +1,487 @@
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import pytest
+
+from active_runtime.app.aios_credential_broker import CredentialBroker
+from active_runtime.app.agent_observability_hooks import AgentObservabilityHooks
+from active_runtime.app.message_handoff import DurableHandoffStore, MessageEnvelope
+from active_runtime.app.search_gateway import (
+    SearchEvidence,
+    SearchGateway,
+    SearchProviderAttempt,
+    SearchRequest,
+)
+from active_runtime.app.search_gateway_orchestrator import SearchGatewayOrchestrator
+from active_runtime.app.trace_tool_credential_governance import (
+    CredentialGrant,
+    GovernanceActor,
+    GovernanceError,
+    GovernanceScope,
+    GovernanceStore,
+    ToolDescriptor,
+    TraceContext,
+    bind_trace_lineage,
+)
+
+
+TENANT_SCOPE = GovernanceScope(
+    "tenant",
+    tenant_id="tenant-a",
+    user_id="user-a",
+    project_id="project-a",
+    conversation_id="conversation-a",
+    run_id="run-a",
+)
+
+
+def actor(*capabilities: str, tenant_id: str = "tenant-a") -> GovernanceActor:
+    return GovernanceActor(
+        "actor-a",
+        GovernanceScope(
+            "tenant",
+            tenant_id=tenant_id,
+            user_id="user-a",
+            project_id="project-a",
+            conversation_id="conversation-a",
+            run_id="run-a",
+        ),
+        tuple(capabilities),
+    )
+
+
+def owner() -> GovernanceActor:
+    return GovernanceActor("owner-control", GovernanceScope("system"), ("system.admin",))
+
+
+def message(**changes):
+    values = dict(
+        source="task-plane",
+        target="worker-a",
+        message_type="tool.invoke",
+        payload={"query": "safe"},
+        sequence=1,
+        idempotency_key="message-a-1",
+        tenant_id="tenant-a",
+        user_id="user-a",
+        project_id="project-a",
+        conversation_id="conversation-a",
+        task_id="task-a",
+        run_id="run-a",
+        confidentiality_scope="run",
+    )
+    values.update(changes)
+    return MessageEnvelope(**values)
+
+
+def task(**changes):
+    value = {
+        "task_id": "task-a",
+        "claim_id": "claim-a",
+        "correlation_id": "correlation-a",
+        "scope_type": "tenant",
+        "tenant_id": "tenant-a",
+        "user_id": "user-a",
+        "project_id": "project-a",
+        "conversation_id": "conversation-a",
+        "run_id": "run-a",
+    }
+    value.update(changes)
+    return value
+
+
+def root_trace():
+    return bind_trace_lineage(
+        actor=actor("tool.search"),
+        task=task(),
+        message=message(),
+        trace_id="trace-a",
+        span_id="span-root",
+    )
+
+
+def test_trace_lineage_continuity_and_durable_restart(tmp_path: Path) -> None:
+    store = GovernanceStore(tmp_path / "governance.sqlite3")
+    root = root_trace()
+    child = root.child(span_id="span-tool", actor=actor("tool.search"))
+    store.record_trace(root, actor("tool.search"))
+    store.record_trace(child, actor("tool.search"))
+
+    reopened = GovernanceStore(tmp_path / "governance.sqlite3")
+    assert reopened.verify_audit_chain(("TRACE_RECORDED",))
+    assert child.trace_id == root.trace_id
+    assert child.parent_span_id == root.span_id
+    assert child.task_id == "task-a"
+    assert child.claim_id == "claim-a"
+
+
+def test_trace_lineage_continuity_rejects_task_change() -> None:
+    with pytest.raises(GovernanceError, match="TRACE_LINEAGE_CONTINUITY"):
+        bind_trace_lineage(
+            actor=actor("tool.search"),
+            task=task(task_id="task-b"),
+            message=message(),
+            trace_id="trace-a",
+            span_id="span-root",
+        )
+
+
+def test_trace_scope_mismatch_deny() -> None:
+    with pytest.raises(GovernanceError, match="TRACE_SCOPE_MISMATCH_DENY"):
+        bind_trace_lineage(
+            actor=actor("tool.search"),
+            task=task(),
+            message=message(tenant_id="tenant-b"),
+            trace_id="trace-a",
+            span_id="span-root",
+        )
+
+
+def test_message_correlation_is_identity_bound() -> None:
+    first = message(correlation_id="correlation-a")
+    second = message(correlation_id="correlation-b")
+    assert first.envelope_id != second.envelope_id
+    assert first.as_record()["correlation_id"] == "correlation-a"
+
+
+def test_message_handoff_legacy_schema_migrates_without_changing_id(tmp_path: Path) -> None:
+    import sqlite3
+
+    path = tmp_path / "legacy.sqlite3"
+    legacy = message()
+    record = legacy.as_record()
+    record.pop("correlation_id")
+    with sqlite3.connect(path) as connection:
+        connection.executescript(
+            """
+            CREATE TABLE message_handoff (
+              envelope_id TEXT PRIMARY KEY, stream_key TEXT NOT NULL, source TEXT NOT NULL,
+              target TEXT NOT NULL, message_type TEXT NOT NULL, payload_json TEXT NOT NULL,
+              payload_sha256 TEXT NOT NULL, tenant_id TEXT, user_id TEXT, project_id TEXT,
+              conversation_id TEXT, task_id TEXT, run_id TEXT, causation_id TEXT,
+              sequence INTEGER NOT NULL, capability_scope_json TEXT NOT NULL,
+              confidentiality_scope TEXT NOT NULL, idempotency_key TEXT NOT NULL,
+              expires_at TEXT, created_at TEXT NOT NULL, status TEXT NOT NULL DEFAULT 'PENDING',
+              delivered_at TEXT, acked_at TEXT,
+              UNIQUE(stream_key,idempotency_key), UNIQUE(stream_key,sequence)
+            );
+            """
+        )
+        columns = tuple(record)
+        connection.execute(
+            f"INSERT INTO message_handoff ({','.join(columns)}) VALUES ({','.join('?' for _ in columns)})",
+            tuple(record[name] for name in columns),
+        )
+    store = DurableHandoffStore(path)
+    loaded = store.get(
+        legacy.envelope_id,
+        actor={
+            "tenant_id": "tenant-a", "user_id": "user-a", "project_id": "project-a",
+            "conversation_id": "conversation-a", "run_id": "run-a",
+            "capabilities": [],
+        },
+    )
+    assert loaded.envelope_id == legacy.envelope_id
+    assert loaded.correlation_id is None
+
+
+def test_message_handoff_rejects_raw_credential_material(tmp_path: Path) -> None:
+    with pytest.raises(ValueError, match="CREDENTIAL_SECRET_EXPOSURE_DENY"):
+        message(payload={"value": "Bearer " + "x" * 24})
+    DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    import sqlite3
+    with sqlite3.connect(tmp_path / "handoff.sqlite3") as connection:
+        assert connection.execute("SELECT count(*) FROM message_handoff").fetchone()[0] == 0
+
+
+def test_tool_mcp_authz_deny_and_scope_propagation(tmp_path: Path) -> None:
+    store = GovernanceStore(tmp_path / "governance.sqlite3")
+    store.register_tool(
+        ToolDescriptor("mcp.search", "mcp", TENANT_SCOPE, ("tool.search",)),
+        owner(),
+    )
+    trace = root_trace()
+    store.record_trace(trace, actor("tool.search"))
+
+    with pytest.raises(GovernanceError, match="TOOL_MCP_AUTHZ_DENY"):
+        store.authorize_tool(
+            actor=actor(), tool_name="mcp.search", trace=trace,
+            requested_scope=TENANT_SCOPE, input_digest="a" * 64,
+            invocation_key="invoke-deny-capability",
+        )
+    with pytest.raises(GovernanceError, match="TOOL_SCOPE_PROPAGATION"):
+        store.authorize_tool(
+            actor=actor("tool.search"), tool_name="mcp.search", trace=trace,
+            requested_scope=GovernanceScope("tenant", tenant_id="tenant-b"),
+            input_digest="a" * 64, invocation_key="invoke-deny-scope",
+        )
+
+    invocation = store.authorize_tool(
+        actor=actor("tool.search"), tool_name="mcp.search", trace=trace,
+        requested_scope=TENANT_SCOPE, input_digest="a" * 64,
+        invocation_key="invoke-search-a",
+    )
+    assert invocation["trace_id"] == "trace-a"
+    assert invocation["evidence"]["action"] == "TOOL_AUTHORIZED"
+
+
+def test_tool_requires_recorded_trace_and_receipt_is_idempotent(tmp_path: Path) -> None:
+    store = GovernanceStore(tmp_path / "governance.sqlite3")
+    store.register_tool(
+        ToolDescriptor(
+            "mcp.search", "mcp", TENANT_SCOPE, ("tool.search",),
+            credential_ref="systemd-credential:search-provider-a",
+        ),
+        owner(),
+    )
+    trace = root_trace()
+    with pytest.raises(GovernanceError, match="TOOL_MCP_AUTHZ_DENY:trace"):
+        store.authorize_tool(
+            actor=actor("tool.search"), tool_name="mcp.search", trace=trace,
+            requested_scope=TENANT_SCOPE, input_digest="a" * 64,
+            invocation_key="invoke-unrecorded",
+        )
+    store.record_trace(trace, actor("tool.search"))
+    authorized = store.authorize_tool(
+        actor=actor("tool.search"), tool_name="mcp.search", trace=trace,
+        requested_scope=TENANT_SCOPE, input_digest="a" * 64,
+        invocation_key="invoke-replay-a",
+    )
+    assert authorized["credential_required"] is True
+    assert "credential_ref" not in authorized
+    receipt = store.record_tool_receipt(
+        invocation_key="invoke-replay-a", result_digest="b" * 64,
+        actor=actor("tool.search"), trace=trace,
+    )
+    assert receipt["status"] == "VERIFIED"
+    replay = store.authorize_tool(
+        actor=actor("tool.search"), tool_name="mcp.search", trace=trace,
+        requested_scope=TENANT_SCOPE, input_digest="a" * 64,
+        invocation_key="invoke-replay-a",
+    )
+    assert replay["idempotent"] is True
+    assert replay["receipt_sha256"] == "b" * 64
+    assert store.verify_audit_chain(
+        ("TRACE_RECORDED", "TOOL_AUTHORIZED", "TOOL_RESULT_VERIFIED")
+    )
+
+
+def test_system_and_global_resources_do_not_use_fake_tenants(tmp_path: Path) -> None:
+    with pytest.raises(GovernanceError, match="GOVERNANCE_NON_TENANT_SCOPE_INVALID"):
+        GovernanceScope("system", tenant_id="fake-tenant")
+
+    store = GovernanceStore(tmp_path / "governance.sqlite3")
+    descriptor = ToolDescriptor("system.health", "tool", GovernanceScope("global"), ("system.admin",))
+    registered = store.register_tool(descriptor, owner())
+    assert registered["descriptor"]["scope_type"] == "global"
+    assert registered["descriptor"]["tenant_id"] is None
+
+
+def test_credential_scope_and_secret_exposure_deny(tmp_path: Path) -> None:
+    store = GovernanceStore(tmp_path / "governance.sqlite3")
+    grant = CredentialGrant(
+        "grant-search-a",
+        "systemd-credential:search-provider-a",
+        TENANT_SCOPE,
+        ("search.invoke",),
+        task_id="task-a",
+        tool_name="mcp.search",
+        expires_at=(datetime.now(timezone.utc) + timedelta(minutes=5)).isoformat(),
+    )
+    stored = store.store_grant(grant, owner())
+    assert "secret" not in stored["grant"]
+    trace = root_trace()
+    store.record_trace(trace, actor("tool.search"))
+
+    with pytest.raises(GovernanceError, match="CREDENTIAL_SCOPE_DENY"):
+        store.authorize_credential(
+            grant_id=grant.grant_id,
+            actor=actor("tool.search", tenant_id="tenant-b"),
+            trace=trace,
+            operation="search.invoke",
+            task_id="task-a",
+            tool_name="mcp.search",
+        )
+    with pytest.raises(GovernanceError, match="CREDENTIAL_SECRET_EXPOSURE_DENY"):
+        CredentialGrant("grant-raw", "Bearer raw-secret", TENANT_SCOPE, ("search.invoke",))
+
+    authorized = store.authorize_credential(
+        grant_id=grant.grant_id,
+        actor=actor("tool.search"),
+        trace=trace,
+        operation="search.invoke",
+        task_id="task-a",
+        tool_name="mcp.search",
+    )
+    assert authorized["credential_ref"] == "systemd-credential:search-provider-a"
+    assert "credential_ref" not in authorized["evidence"]["details"]
+
+
+def test_audit_evidence_completeness_and_tamper_detection(tmp_path: Path) -> None:
+    path = tmp_path / "governance.sqlite3"
+    store = GovernanceStore(path)
+    trace = root_trace()
+    store.record_trace(trace, actor("tool.search"))
+    store.register_tool(
+        ToolDescriptor("mcp.search", "mcp", TENANT_SCOPE, ("tool.search",)), owner()
+    )
+    store.authorize_tool(
+        actor=actor("tool.search"), tool_name="mcp.search", trace=trace,
+        requested_scope=TENANT_SCOPE, input_digest="a" * 64,
+        invocation_key="invoke-audit-a",
+    )
+    assert store.verify_audit_chain(("TRACE_RECORDED", "TOOL_REGISTERED", "TOOL_AUTHORIZED"))
+    assert not store.verify_audit_chain(("CREDENTIAL_AUTHORIZED",))
+
+    import sqlite3
+
+    with sqlite3.connect(path) as connection:
+        connection.execute(
+            "UPDATE governance_audit_evidence SET outcome='DENY' WHERE sequence=1"
+        )
+    assert not GovernanceStore(path).verify_audit_chain()
+
+
+def test_observability_record_carries_governed_trace(tmp_path: Path) -> None:
+    from active_runtime.app.agent_observability_store import AgentObservabilityStore
+
+    hooks = AgentObservabilityHooks(AgentObservabilityStore(tmp_path / "observability"))
+    trace = root_trace()
+    started = hooks.start(
+        "user-a", "project-a", "openclaw",
+        actor=actor("tool.search"), trace=trace,
+    )
+    record = hooks.finish(started["execution_id"])["record"]
+    assert record["trace_id"] == "trace-a"
+    assert record["tenant_id"] == "tenant-a"
+    assert record["task_id"] == "task-a"
+    assert record["message_id"] == message().envelope_id
+
+
+def test_active_runtime_credential_broker_scope_and_raw_secret_deny() -> None:
+    class Provider:
+        def environment(self, lease):
+            return {"ACCESS_TOKEN": "raw-secret"}
+
+    broker = CredentialBroker(Provider())
+    lease = broker.issue(
+        task_id="task-a", repository="aios/aios", target_branch="agent/task-a",
+        generation=1, scopes=("tool.invoke",), scope_type="tenant",
+        tenant_id="tenant-a", user_id="user-a", project_id="project-a", run_id="run-a",
+    )
+    with pytest.raises(RuntimeError, match="CREDENTIAL_SCOPE_DENY"):
+        broker.authorize(
+            lease["lease_id"], task_id="task-a", operation="tool.invoke",
+            scope_type="tenant", tenant_id="tenant-b", user_id="user-a",
+            project_id="project-a", run_id="run-a",
+        )
+    with pytest.raises(RuntimeError, match="CREDENTIAL_SECRET_EXPOSURE_DENY"):
+        broker.authorize(
+            lease["lease_id"], task_id="task-a", operation="tool.invoke",
+            scope_type="tenant", tenant_id="tenant-a", user_id="user-a",
+            project_id="project-a", run_id="run-a",
+        )
+
+
+def test_search_gateway_uses_governed_tool_boundary(tmp_path: Path) -> None:
+    class Provider:
+        name = "official_site"
+        called = False
+
+        def search(self, request, queries):
+            self.called = True
+            return (
+                [SearchEvidence("Official", "https://example.test", self.name, "safe")],
+                SearchProviderAttempt(self.name, "ok", 1),
+            )
+
+    store = GovernanceStore(tmp_path / "governance.sqlite3")
+    store.register_tool(
+        ToolDescriptor("search.official_site", "tool", TENANT_SCOPE, ("tool.search",)),
+        owner(),
+    )
+    provider = Provider()
+    gateway = SearchGateway([provider], governance_store=store)
+    trace = root_trace()
+    store.record_trace(trace, actor("tool.search"))
+    response = gateway.search(
+        SearchRequest(
+            query="AIOS", requester="actor-a", correlation_id="trace-a",
+            authorized_sources=["official_site"],
+        ),
+        actor=actor("tool.search"),
+        trace=trace,
+    )
+    assert response.status == "found"
+    assert provider.called is True
+    assert store.verify_audit_chain(
+        ("TOOL_REGISTERED", "TRACE_RECORDED", "TOOL_AUTHORIZED", "TOOL_RESULT_VERIFIED")
+    )
+
+    with pytest.raises(GovernanceError, match="TOOL_MCP_AUTHZ_DENY"):
+        gateway.search(
+            SearchRequest(query="AIOS", requester="forged", correlation_id="trace-a"),
+            actor=actor("tool.search"),
+            trace=trace,
+        )
+
+
+def test_search_gateway_redacts_provider_exception() -> None:
+    class Provider:
+        name = "general_web"
+
+        def search(self, request, queries):
+            raise RuntimeError("Bearer should-not-leak")
+
+    response = SearchGateway([Provider()]).search(SearchRequest(query="AIOS", requester="legacy"))
+    assert response.attempts[0].reason == "PROVIDER_FAILURE"
+    assert "should-not-leak" not in str(response.to_dict())
+
+
+def test_search_runtime_default_path_requires_governance(tmp_path: Path) -> None:
+    orchestrator = SearchGatewayOrchestrator(
+        governance_store=GovernanceStore(tmp_path / "search-governance.sqlite3")
+    )
+    assert orchestrator.status()["governance"] == "required"
+    with pytest.raises(GovernanceError, match="TOOL_MCP_AUTHZ_DENY"):
+        orchestrator.execute({"query": "AIOS", "requester": "actor-a"})
+
+
+def test_governance_newer_schema_fails_closed(tmp_path: Path) -> None:
+    import sqlite3
+    path = tmp_path / "newer.sqlite3"
+    with sqlite3.connect(path) as connection:
+        connection.execute(
+            "CREATE TABLE governance_schema_metadata(singleton INTEGER PRIMARY KEY, schema_version INTEGER NOT NULL)"
+        )
+        connection.execute(
+            "INSERT INTO governance_schema_metadata(singleton,schema_version) VALUES(1,999)"
+        )
+    with pytest.raises(GovernanceError, match="GOVERNANCE_SCHEMA_VERSION_UNSUPPORTED"):
+        GovernanceStore(path)
+
+
+def test_changed_production_files_have_no_embedded_secret_material() -> None:
+    import re
+    root = Path(__file__).resolve().parents[1]
+    paths = (
+        "active-runtime/app/agent_event_bus.py",
+        "active-runtime/app/agent_event_observability_bridge.py",
+        "active-runtime/app/agent_observability.py",
+        "active-runtime/app/agent_observability_api.py",
+        "active-runtime/app/agent_observability_hooks.py",
+        "active-runtime/app/agent_observability_store.py",
+        "active-runtime/app/aios_credential_broker.py",
+        "active-runtime/app/message_handoff.py",
+        "active-runtime/app/search_agent_adapter.py",
+        "active-runtime/app/search_gateway.py",
+        "active-runtime/app/search_gateway_api.py",
+        "active-runtime/app/search_gateway_orchestrator.py",
+        "active-runtime/app/trace_tool_credential_governance.py",
+    )
+    patterns = (
+        re.compile(r"BEGIN (?:RSA|OPENSSH|EC) PRIVATE KEY"),
+        re.compile(r"Bearer\s+[A-Za-z0-9._~+/-]{24,}"),
+    )
+    hits = [path for path in paths for pattern in patterns if pattern.search((root / path).read_text(encoding="utf-8"))]
+    assert hits == []

tests/test_v2r2c1_durable_reconciliation.py

@@ -1,51 +0,0 @@
-from __future__ import annotations
-
-from datetime import datetime, timedelta, timezone
-
-from aios_control_plane_snapshot import build_control_plane_snapshot
-from aios_credential_broker import CredentialBroker
-from aios_gitops_reconciliation_core import ReconciliationAction, RemoteObservation, decide_reconciliation
-from aios_governed_policy import GovernedPolicyInput, evaluate_policy
-
-
-OID = "a" * 40
-OLD = "b" * 40
-
-
-def test_authority_desired_remote_missing_never_completes():
-    decision = decide_reconciliation(RemoteObservation("aios/aios", "agent/example", OID, OID, None, None, False, "now", OLD))
-    assert decision.action == ReconciliationAction.MARK_RECONCILIATION_REQUIRED
-    assert decision.state != "COMPLETED"
-
-
-def test_response_loss_observes_desired_remote_before_retry():
-    decision = decide_reconciliation(RemoteObservation("aios/aios", "agent/example", OID, OID, OID, OID, True, "now", OLD))
-    assert decision.action == ReconciliationAction.MARK_REMOTE_VERIFIED
-
-
-def test_conflicting_remote_fails_closed():
-    decision = decide_reconciliation(RemoteObservation("aios/aios", "agent/example", OID, OID, "c" * 40, "c" * 40, True, "now", OLD))
-    assert decision.action == ReconciliationAction.FAIL_CONFLICT
-
-
-def test_policy_denies_production_and_force_capabilities():
-    request = GovernedPolicyInput("owner", "task", "aios/aios", "commitFilesGoverned", OID, OID, "agent/example", 2, requested_capabilities=("production_write", "force_push"))
-    assert evaluate_policy(request).decision == "DENY"
-
-
-def test_credential_metadata_does_not_include_secret_and_revoke_is_idempotent():
-    class Provider:
-        def environment(self, lease):
-            return {"CREDENTIAL_FILE": "/run/credential"}
-    broker = CredentialBroker(Provider())
-    metadata = broker.issue(task_id="task", repository="aios/aios", target_branch="agent/example", generation=1)
-    assert "token" not in str(metadata).lower()
-    revoked = broker.revoke(metadata["lease_id"])
-    assert broker.revoke(metadata["lease_id"])["state"] == "REVOKED"
-    assert revoked["state"] == "REVOKED"
-
-
-def test_snapshot_marks_secret_material_false_and_preserves_partial_observation():
-    snapshot = build_control_plane_snapshot(target_version="V2R2C1", task={"gitea_git_oid": None, "gitea_api_oid": None})
-    assert snapshot["secret_material_exposed"] is False
-    assert snapshot["task"]["gitea_git_oid"] is None

tests/test_writer_lease_recovery.py

@@ -0,0 +1,763 @@
+from __future__ import annotations
+
+from concurrent.futures import ThreadPoolExecutor
+from datetime import datetime, timedelta, timezone
+import hashlib
+from dataclasses import asdict
+from pathlib import Path
+import sqlite3
+import json
+from types import SimpleNamespace
+import threading
+
+import pytest
+
+from aios_chatgpt_bridge_v2_server import GovernedRuntime
+from aios_continuation_executor import ContinuationPermissions, ContinuationRuntimeBinding
+from aios_continuation_lease import WriterLeaseRequestV2
+from aios_gitops_job_controller import GitOpsJobController, JobError, JobStore
+from aios_governed_task_bootstrap import GovernedTaskBootstrap
+
+
+TASK_ID = "gov-writer-lease-recovery-test"
+BRANCH = "agent/writer-lease-recovery-test"
+BASE = "a" * 40
+JOB_ID_PREFIX = "writer-lease-runtime-lineage"
+
+
+class LocalAuthority:
+    def __init__(self, head: str | None = None) -> None:
+        self.head = head
+
+    def read_ref(self, _ref: str) -> str | None:
+        return self.head
+
+    def commit_exists(self, _oid: str) -> bool:
+        return True
+
+    def ancestry_check(self, _older: str, _newer: str) -> bool:
+        return True
+
+
+def writer_request(task_id: str = TASK_ID, **overrides: object) -> dict[str, object]:
+    request: dict[str, object] = {
+        "schema": WriterLeaseRequestV2.schema,
+        "task_id": task_id,
+        "repository": "aios/aios",
+        "branch_mode": "CREATE_NEW",
+        "base_oid": BASE,
+        "expected_branch_oid": BASE,
+        "target_branch": BRANCH,
+        "generation": 1,
+        "lease_seconds": 120,
+    }
+    request.update(overrides)
+    return request
+
+
+def make_runtime(tmp_path: Path, task_id: str = TASK_ID, *, authority_head: str | None = None) -> GovernedRuntime:
+    runtime = GovernedRuntime.__new__(GovernedRuntime)
+    runtime.config = SimpleNamespace(repository="aios/aios", state_root=tmp_path)
+    runtime.authority = LocalAuthority(authority_head)
+    runtime.bindings = {
+        task_id: {
+            "task_id": task_id,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "expected_branch_oid": BASE,
+            "target_branch": BRANCH,
+            "branch_mode": "CREATE_NEW",
+            "generation": 1,
+        }
+    }
+    runtime.runtimes = {}
+    runtime.controllers = {}
+    runtime.bootstrap = GovernedTaskBootstrap(
+        runtime.authority,
+        tmp_path,
+        remote_name="test",
+        token_path=tmp_path / "token",
+        ssh_key_path=tmp_path / "key",
+    )
+    runtime.bindings = {}
+    runtime.create_task(
+        {
+            "task_id": task_id,
+            "repository": "aios/aios",
+            "base_oid": BASE,
+            "expected_branch_oid": BASE,
+            "target_branch": BRANCH,
+            "risk": "engineering",
+            "description": "governed runtime lineage test",
+            "idempotency_key": JOB_ID_PREFIX + "-" + task_id,
+        }
+    )
+    job_root = runtime._job_root(task_id)
+    runtime.controllers[task_id] = GitOpsJobController(
+        JobStore(job_root, payload_root=job_root / "payloads")
+    )
+
+    def build(
+        lease: WriterLeaseRequestV2,
+        *,
+        job_id: str,
+        lease_not_before: datetime | None = None,
+        lease_expires_at: datetime | None = None,
+    ) -> tuple[ContinuationRuntimeBinding, GitOpsJobController, object]:
+        controller = runtime.controllers.get(lease.task_id)
+        if controller is None:
+            root = runtime._job_root(lease.task_id)
+            controller = GitOpsJobController(JobStore(root, payload_root=root / "payloads"))
+        now = datetime.now(timezone.utc)
+        return (
+            ContinuationRuntimeBinding(
+                request=lease,
+                job_id=job_id,
+                workspace_path=tmp_path / "worktrees" / lease.task_id,
+                lease_not_before=lease_not_before or now - timedelta(seconds=1),
+                lease_expires_at=lease_expires_at or now + timedelta(seconds=lease.lease_seconds),
+                original_receipt_valid=True,
+                original_grant_consumed=True,
+                permissions=ContinuationPermissions(),
+            ),
+            controller,
+            object(),
+        )
+
+    runtime._build_runtime = build
+    return runtime
+
+
+def create_durable_lease(
+    runtime: GovernedRuntime,
+    *,
+    expires_at: str = "2020-01-01T00:00:00+00:00",
+) -> GitOpsJobController:
+    root = runtime._job_root(TASK_ID)
+    controller = GitOpsJobController(JobStore(root, payload_root=root / "payloads"))
+    receipt = SimpleNamespace(job_id=runtime.bindings[TASK_ID]["job_id"])
+    controller.lease_job(
+        receipt.job_id,
+        lease_id="writer-lease-recovery",
+        lineage_anchor_oid=BASE,
+        current_head_oid=BASE,
+        generation=1,
+        lease_expires_at=expires_at,
+        expected_revision=0,
+    )
+    runtime.controllers[TASK_ID] = controller
+    return controller
+
+
+def durable_row(runtime: GovernedRuntime) -> tuple[str, int]:
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        row = connection.execute(
+            "SELECT lease_expires_at, revision FROM branch_leases WHERE lease_id=?",
+            ("writer-lease-recovery",),
+        ).fetchone()
+    assert row is not None
+    return row
+
+
+def test_first_bootstrap_refreshes_only_runtime_without_durable_lease(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    result = runtime.bootstrap_writer_lease(writer_request())
+
+    assert result["bootstrapped"] is True
+    assert result["runtime_rehydrated"] is False
+    assert result["durable_branch_lease_present"] is False
+    assert result["idempotent"] is False
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        assert connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0] == 0
+
+
+def test_duplicate_bootstrap_is_idempotent_without_consuming_generation(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    first = runtime.bootstrap_writer_lease(writer_request())
+    second = runtime.bootstrap_writer_lease(writer_request())
+
+    assert first["bootstrapped"] is True
+    assert first["generation"] == 1
+    assert second["bootstrapped"] is False
+    assert second["idempotent"] is True
+    assert second["generation"] == 1
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        assert connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0] == 0
+
+
+def test_commit_after_bootstrap_reuses_the_exact_runtime_binding(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    class RecordingWorkspace:
+
+        def __init__(self) -> None:
+            self.files: dict[str, bytes] = {}
+
+        def materialize_files(self, files: dict[str, bytes]) -> None:
+            self.files = dict(files)
+
+    class RecordingExecutor:
+
+        def __init__(self) -> None:
+            self.workspace = RecordingWorkspace()
+            self.binding = None
+            self.commit = None
+
+        def execute(self, binding: object, commit: object) -> dict[str, object]:
+            self.binding = binding
+            self.commit = commit
+            return {'task_id': binding.request.task_id, 'generation': binding.request.generation, 'files': sorted(self.workspace.files)}
+    executor = RecordingExecutor()
+    original_build = runtime._build_runtime
+
+    def build(lease: WriterLeaseRequestV2, *, job_id: str, lease_not_before: datetime | None=None, lease_expires_at: datetime | None=None) -> tuple[ContinuationRuntimeBinding, GitOpsJobController, object]:
+        binding, controller, _ = original_build(lease, job_id=job_id, lease_not_before=lease_not_before, lease_expires_at=lease_expires_at)
+        return (binding, controller, executor)
+    runtime._build_runtime = build
+    runtime.bootstrap_writer_lease(writer_request())
+    lease_response = runtime.acquire_lease(writer_request())
+    binding, controller, executor = runtime.runtimes[TASK_ID, 1]
+    assert lease_response['job_id'] == binding.job_id
+    assert lease_response['durable_branch_lease_present'] is True
+    _original_execute = executor.execute
+
+    def _execute_with_governed_commit_contract(*args, **kwargs):
+        _before_complete = kwargs.pop('before_complete', None)
+        _legacy = dict(_original_execute(*args, **kwargs))
+        _result = {**_legacy, 'job_id': binding.job_id, 'state': 'COMPLETED', 'side_effect_state': 'REMOTE_VERIFIED', 'receipt': {'authority_oid': 'b' * 40, 'git_remote_oid': 'b' * 40, 'api_branch_oid': 'b' * 40, 'commit_visible': True, 'remote_verified': True, 'force_push': False}}
+        if _before_complete is not None:
+            _before_complete('b' * 40)
+        return _result
+    executor.execute = _execute_with_governed_commit_contract
+    _bound_job_id = binding.job_id
+    result = runtime.commit_files({'task_id': TASK_ID, 'repository': 'aios/aios', 'generation': 1, 'target_branch': BRANCH, 'expected_branch_oid': BASE, 'idempotency_key': 'commit-after-bootstrap-v1', 'path': 'docs/recovery.txt', 'content_base64': 'YQ==', 'message': 'test commit after bootstrap'})
+    assert result['task_id'] == TASK_ID
+    assert result['generation'] == 1
+    assert result['files'] == ['docs/recovery.txt']
+    assert executor.binding.request.task_id == TASK_ID
+    assert executor.binding.request.generation == 1
+    database = runtime._job_root(TASK_ID) / 'state.sqlite3'
+    with sqlite3.connect(f'file:{database}?mode=ro', uri=True) as connection:
+        assert connection.execute('SELECT COUNT(*) FROM branch_leases').fetchone()[0] == 1
+        assert connection.execute('PRAGMA foreign_key_check(branch_leases)').fetchall() == []
+    assert result['commit_oid'] == 'b' * 40
+    assert result['commit_visible'] is True
+    assert result['branch_mode'] == 'CONTINUE_EXISTING'
+    assert result['target_branch'] == BRANCH
+    assert int(result['generation']) == 1
+    with controller.store._connect() as connection:
+        _persisted = connection.execute('SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?', ('lease-' + str(_bound_job_id),)).fetchone()
+    assert _persisted is not None
+    assert _persisted[0] == 'b' * 40
+    assert int(_persisted[1]) == 1
+    fresh_runtime = make_runtime(tmp_path, authority_head='b' * 40)
+    fresh_response = fresh_runtime.bootstrap_writer_lease(writer_request(branch_mode='CONTINUE_EXISTING', expected_branch_oid='b' * 40))
+    fresh_binding, _, _ = fresh_runtime.runtimes[TASK_ID, 1]
+    assert fresh_response['job_id'] == str(_bound_job_id)
+    assert fresh_response['runtime_rehydrated'] is True
+    assert fresh_binding.job_id == str(_bound_job_id)
+    assert fresh_binding.request.expected_branch_oid == 'b' * 40
+    with fresh_runtime.controllers[TASK_ID].store._connect() as connection:
+        _fresh_lease = connection.execute('SELECT job_id,current_head_oid,revision FROM branch_leases WHERE lease_id=?', ('lease-' + str(_bound_job_id),)).fetchone()
+    assert tuple(_fresh_lease) == (str(_bound_job_id), 'b' * 40, 1)
+
+
+
+@pytest.mark.parametrize(
+    ("field", "value", "error"),
+    (
+        ("repository", "other/repository", "LEASE_BINDING_CONFLICT"),
+        ("base_oid", "b" * 40, "LEASE_BINDING_CONFLICT"),
+        ("expected_branch_oid", "b" * 40, "LEASE_BINDING_CONFLICT"),
+        ("target_branch", "agent/wrong-target", "LEASE_BINDING_CONFLICT"),
+        ("generation", 2, "GENERATION_BINDING_CONFLICT"),
+    ),
+)
+def test_bootstrap_rejects_any_nonmatching_binding_field(
+    tmp_path: Path, field: str, value: object, error: str
+) -> None:
+    runtime = make_runtime(tmp_path)
+
+    with pytest.raises(RuntimeError, match=error):
+        runtime.bootstrap_writer_lease(writer_request(**{field: value}))
+
+
+def test_bootstrap_rejects_unknown_task_ownership(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    with pytest.raises(RuntimeError, match="TASK_OWNERSHIP_INVALID"):
+        runtime.bootstrap_writer_lease(writer_request(task_id="unknown-task"))
+
+
+def test_renew_missing_durable_lease_is_not_bootstrap(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    with pytest.raises(RuntimeError, match="LEASE_NOT_FOUND"):
+        runtime.renew_writer_lease(writer_request())
+
+
+def test_renew_is_generation_scoped_before_durable_lookup(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    create_durable_lease(runtime)
+
+    with pytest.raises(RuntimeError, match="GENERATION_BINDING_CONFLICT"):
+        runtime.renew_writer_lease(writer_request(generation=2))
+    assert durable_row(runtime) == ("2020-01-01T00:00:00+00:00", 0)
+
+
+def test_restart_rehydrates_only_from_matching_durable_lease(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    create_durable_lease(runtime)
+    runtime.runtimes.clear()
+
+    result = runtime.renew_writer_lease(writer_request())
+
+    expires_at, revision = durable_row(runtime)
+    assert result["recovered"] is True
+    assert result["runtime_rehydrated"] is True
+    assert result["durable_branch_lease_present"] is True
+    assert revision == 1
+    assert datetime.fromisoformat(expires_at) > datetime.now(timezone.utc)
+
+
+def test_duplicate_renewal_is_idempotent_after_first_durable_recovery(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    create_durable_lease(runtime)
+
+    first = runtime.renew_writer_lease(writer_request())
+    second = runtime.renew_writer_lease(writer_request())
+
+    assert first["recovered"] is True
+    assert first["idempotent"] is False
+    assert second["recovered"] is False
+    assert second["idempotent"] is True
+    assert durable_row(runtime)[1] == 1
+
+
+def test_update_lease_keeps_expiry_without_optional_argument_and_keeps_cas(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    controller = create_durable_lease(runtime)
+
+    controller.update_lease(
+        "writer-lease-recovery",
+        expected_revision=0,
+        current_head_oid=BASE,
+        generation=1,
+    )
+    assert durable_row(runtime) == ("2020-01-01T00:00:00+00:00", 1)
+    with pytest.raises(JobError, match="LEASE_REVISION_CAS_CONFLICT"):
+        controller.update_lease(
+            "writer-lease-recovery",
+            expected_revision=0,
+            current_head_oid=BASE,
+            generation=1,
+        )
+
+
+def test_two_runtime_connections_resolve_renewal_cas_race_idempotently(tmp_path: Path) -> None:
+    first = make_runtime(tmp_path)
+    first_controller = create_durable_lease(first)
+    second = make_runtime(tmp_path)
+    second_controller = GitOpsJobController(
+        JobStore(second._job_root(TASK_ID), payload_root=second._job_root(TASK_ID) / "payloads")
+    )
+    second.controllers[TASK_ID] = second_controller
+    gate = threading.Barrier(2)
+
+    def gate_update(controller: GitOpsJobController) -> None:
+        original = controller.update_lease
+
+        def update(*args: object, **kwargs: object) -> None:
+            gate.wait(timeout=5)
+            original(*args, **kwargs)
+
+        controller.update_lease = update
+
+    gate_update(first_controller)
+    gate_update(second_controller)
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        results = list(pool.map(lambda runtime: runtime.renew_writer_lease(writer_request()), (first, second)))
+
+    assert sorted((item["recovered"], item["idempotent"]) for item in results) == [
+        (False, True),
+        (True, False),
+    ]
+    assert durable_row(first)[1] == 1
+
+
+def test_bootstrap_preserves_exact_governed_job_lineage(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+
+    response = runtime.bootstrap_writer_lease(writer_request())
+    binding, _, _ = runtime.runtimes[(TASK_ID, 1)]
+
+    assert response["job_id"] == expected_job_id
+    assert binding.job_id == expected_job_id
+    assert binding.request.job_id == expected_job_id
+
+
+def test_restart_rehydrate_preserves_exact_governed_job_lineage(tmp_path: Path) -> None:
+    first = make_runtime(tmp_path)
+    expected_job_id = first.bindings[TASK_ID]["job_id"]
+    first.acquire_lease(writer_request())
+
+    runtime = make_runtime(tmp_path)
+    assert runtime is not first
+    assert runtime.runtimes == {}
+    response = runtime.bootstrap_writer_lease(writer_request())
+    binding, _, _ = runtime.runtimes[(TASK_ID, 1)]
+
+    assert response["job_id"] == expected_job_id
+    assert binding.job_id == expected_job_id
+    assert binding.request.job_id == expected_job_id
+
+
+def test_wrong_governed_job_id_is_denied_before_runtime_or_lease_side_effect(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+
+    with pytest.raises(RuntimeError, match="LEASE_BINDING_CONFLICT"):
+        runtime.bootstrap_writer_lease(writer_request(job_id="job-wrong-lineage"))
+
+    assert runtime.runtimes == {}
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        assert connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0] == 0
+        assert connection.execute("PRAGMA foreign_key_check(branch_leases)").fetchall() == []
+
+
+def test_acquire_creates_exact_governed_writer_lease_with_fk_and_cas(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+
+    response = runtime.acquire_lease(writer_request())
+
+    assert response["job_id"] == expected_job_id
+    assert response["durable_branch_lease_present"] is True
+    assert response["idempotent"] is False
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        foreign_keys = connection.execute(
+            "PRAGMA foreign_key_list(branch_leases)"
+        ).fetchall()
+        row = connection.execute(
+            "SELECT job_id,branch,lineage_anchor_oid,current_head_oid,generation,state,revision "
+            "FROM branch_leases"
+        ).fetchone()
+        job = connection.execute(
+            "SELECT state,side_effect_state,revision FROM jobs WHERE job_id=?",
+            (expected_job_id,),
+        ).fetchone()
+        assert connection.execute("PRAGMA foreign_key_check(branch_leases)").fetchall() == []
+    assert any(
+        fk[2] == "jobs" and fk[3] == "job_id" and fk[4] == "job_id"
+        for fk in foreign_keys
+    )
+    assert row == (expected_job_id, BRANCH, BASE, BASE, 1, "ACTIVE", 0)
+    assert job == ("LEASED", "LEASED", 2)
+
+
+def test_duplicate_acquire_observes_same_durable_writer_lease(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+
+    first = runtime.acquire_lease(writer_request())
+    second = runtime.acquire_lease(writer_request())
+
+    assert first["job_id"] == expected_job_id
+    assert second["job_id"] == expected_job_id
+    assert second["idempotent"] is True
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        leases = connection.execute(
+            "SELECT lease_id,job_id,revision FROM branch_leases"
+        ).fetchall()
+        job = connection.execute(
+            "SELECT state,revision FROM jobs WHERE job_id=?",
+            (expected_job_id,),
+        ).fetchone()
+    assert leases == [("lease-" + expected_job_id, expected_job_id, 0)]
+    assert job == ("LEASED", 2)
+
+
+def test_wrong_job_acquire_is_denied_before_authorize_or_lease(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+
+    with pytest.raises(RuntimeError, match="LEASE_BINDING_CONFLICT"):
+        runtime.acquire_lease(writer_request(job_id="job-wrong-lineage"))
+
+    database = runtime._job_root(TASK_ID) / "state.sqlite3"
+    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
+        job = connection.execute(
+            "SELECT state,side_effect_state,revision FROM jobs WHERE job_id=?",
+            (expected_job_id,),
+        ).fetchone()
+        lease_count = connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0]
+    assert job == ("REQUESTED", "NONE", 0)
+    assert lease_count == 0
+
+
+def test_omitted_request_job_id_resolves_the_exact_durable_parent(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+    raw = dict(writer_request())
+
+    response = runtime.acquire_lease(raw)
+    binding, _, _ = runtime.runtimes[(TASK_ID, 1)]
+
+    assert response["job_id"] == expected_job_id
+    assert binding.job_id == expected_job_id
+    assert binding.request.job_id == expected_job_id
+
+
+def test_durable_job_expected_head_mismatch_is_denied(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    expected_job_id = runtime.bindings[TASK_ID]["job_id"]
+    controller = runtime.controllers[TASK_ID]
+    with controller.store._connect() as connection:
+        row = connection.execute(
+            "SELECT request_json FROM jobs WHERE job_id=?", (expected_job_id,)
+        ).fetchone()
+        request = json.loads(row[0])
+        request["expected_branch_oid"] = "c" * 40
+        request["binding"]["expected_branch_oid"] = "c" * 40
+        connection.execute(
+            "UPDATE jobs SET request_json=? WHERE job_id=?",
+            (json.dumps(request, sort_keys=True, separators=(",", ":")), expected_job_id),
+        )
+        connection.commit()
+
+    with pytest.raises(RuntimeError, match="RUNTIME_GOVERNED_JOB_UNRESOLVED"):
+        runtime.bootstrap_writer_lease(writer_request())
+
+    assert runtime.runtimes == {}
+
+
+def _commit_ready_runtime(tmp_path: Path):
+    runtime = make_runtime(tmp_path)
+    runtime.bootstrap_writer_lease(writer_request())
+    binding, controller, _ = runtime.runtimes[(TASK_ID, 1)]
+
+    class Workspace:
+        def materialize_files(self, _files):
+            return None
+
+    class Executor:
+        def __init__(self):
+            self.workspace = Workspace()
+            self.calls = 0
+
+        def execute(self, _binding, _commit, *, before_complete=None):
+            self.calls += 1
+            result = {
+                "job_id": binding.job_id,
+                "state": "COMPLETED",
+                "side_effect_state": "REMOTE_VERIFIED",
+                "receipt": {
+                    "authority_oid": "b" * 40,
+                    "git_remote_oid": "b" * 40,
+                    "api_branch_oid": "b" * 40,
+                    "commit_visible": True,
+                    "remote_verified": True,
+                    "force_push": False,
+                },
+            }
+            if before_complete is not None:
+                before_complete("b" * 40)
+            return result
+
+    executor = Executor()
+    runtime.runtimes[(TASK_ID, 1)] = (binding, controller, executor)
+    runtime.acquire_lease(writer_request())
+    return runtime, binding, controller, executor
+
+
+def _commit_request():
+    return {
+        "task_id": TASK_ID,
+        "repository": "aios/aios",
+        "generation": 1,
+        "target_branch": BRANCH,
+        "expected_branch_oid": BASE,
+        "idempotency_key": "commit-cas-test-v1",
+        "path": "docs/cas.txt",
+        "content_base64": "YQ==",
+        "message": "test commit cas",
+    }
+
+
+def test_commit_lease_revision_cas_conflict_is_preserved(tmp_path: Path) -> None:
+    runtime, _binding, controller, _executor = _commit_ready_runtime(tmp_path)
+
+    def conflict(*_args, **_kwargs):
+        raise JobError("LEASE_REVISION_CAS_CONFLICT")
+
+    controller.update_lease = conflict
+    with pytest.raises(RuntimeError, match="LEASE_CAS_CONFLICT"):
+        runtime.commit_files(_commit_request())
+
+
+def test_commit_divergent_durable_head_fails_before_executor(tmp_path: Path) -> None:
+    runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
+    controller.update_lease(
+        "lease-" + binding.job_id,
+        expected_revision=0,
+        current_head_oid="c" * 40,
+        generation=1,
+    )
+
+    with pytest.raises(RuntimeError, match="LEASE_HEAD_RECONCILIATION_REQUIRED"):
+        runtime.commit_files(_commit_request())
+    assert executor.calls == 0
+
+
+def test_remote_pending_never_advances_durable_head(tmp_path: Path) -> None:
+    runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
+
+    def pending(_binding, _commit, **_kwargs):
+        executor.calls += 1
+        return {
+            "job_id": binding.job_id,
+            "state": "RECONCILIATION_REQUIRED",
+            "side_effect_state": "REMOTE_PUSH_PENDING",
+            "receipt": {
+                "authority_oid": "b" * 40,
+                "desired_remote_oid": "b" * 40,
+                "remote_verified": False,
+            },
+        }
+
+    executor.execute = pending
+    with pytest.raises(RuntimeError, match="RECONCILIATION_REQUIRED"):
+        runtime.commit_files(_commit_request())
+    with controller.store._connect() as connection:
+        row = connection.execute(
+            "SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?",
+            ("lease-" + binding.job_id,),
+        ).fetchone()
+    assert tuple(row) == (BASE, 0)
+
+
+def test_retry_accepts_exact_head_already_advanced_at_remote_verified_boundary(tmp_path: Path) -> None:
+    runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
+    commit_oid = "b" * 40
+    controller.update_lease(
+        "lease-" + binding.job_id,
+        expected_revision=0,
+        current_head_oid=commit_oid,
+        generation=1,
+    )
+    receipt = {
+        "authority_oid": commit_oid,
+        "git_remote_oid": commit_oid,
+        "api_branch_oid": commit_oid,
+        "commit_visible": True,
+        "remote_verified": True,
+        "force_push": False,
+    }
+    with controller.store._connect() as connection:
+        connection.execute(
+            "UPDATE jobs SET state='REMOTE_VERIFIED',side_effect_state='REMOTE_VERIFIED',"
+            "receipt_json=? WHERE job_id=?",
+            (json.dumps(receipt, sort_keys=True, separators=(",", ":")), binding.job_id),
+        )
+        connection.commit()
+
+    result = runtime.commit_files(_commit_request())
+
+    assert result["commit_oid"] == commit_oid
+    assert executor.calls == 1
+    with controller.store._connect() as connection:
+        row = connection.execute(
+            "SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?",
+            ("lease-" + binding.job_id,),
+        ).fetchone()
+    assert tuple(row) == (commit_oid, 1)
+
+
+def test_completed_response_with_invalid_oid_uses_canonical_oid_error(tmp_path: Path) -> None:
+    runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
+
+    def invalid_oid(_binding, _commit, **_kwargs):
+        executor.calls += 1
+        return {
+            "job_id": binding.job_id,
+            "state": "COMPLETED",
+            "side_effect_state": "REMOTE_VERIFIED",
+            "receipt": {
+                "authority_oid": "not-an-oid",
+                "commit_visible": True,
+                "remote_verified": True,
+            },
+        }
+
+    executor.execute = invalid_oid
+    with pytest.raises(RuntimeError, match="GOVERNED_COMMIT_OID_INVALID"):
+        runtime.commit_files(_commit_request())
+    with controller.store._connect() as connection:
+        row = connection.execute(
+            "SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?",
+            ("lease-" + binding.job_id,),
+        ).fetchone()
+    assert tuple(row) == (BASE, 0)
+
+
+def test_acquire_renews_an_expired_matching_durable_lease_with_revision_cas(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    create_durable_lease(runtime)
+    runtime.runtimes.clear()
+
+    result = runtime.acquire_lease(writer_request())
+
+    expires_at, revision = durable_row(runtime)
+    assert result["recovered"] is True
+    assert result["runtime_rehydrated"] is False
+    assert result["durable_branch_lease_present"] is True
+    assert revision == 1
+    assert datetime.fromisoformat(expires_at) > datetime.now(timezone.utc)
+
+
+def test_authority_recovers_only_clean_detached_single_attempt_worktree(tmp_path: Path) -> None:
+    import subprocess
+    from aios_authority_git_executor import AuthorityGitExecutor
+
+    bare = tmp_path / "authority.git"
+    seed = tmp_path / "seed"
+    subprocess.run(["git", "init", "--bare", str(bare)], check=True, capture_output=True)
+    subprocess.run(["git", "init", str(seed)], check=True, capture_output=True)
+    (seed / "base.txt").write_text("base\n", encoding="utf-8")
+    subprocess.run(["git", "-C", str(seed), "add", "base.txt"], check=True)
+    subprocess.run(
+        ["git", "-C", str(seed), "-c", "user.name=test", "-c", "user.email=test@example.invalid",
+         "commit", "-m", "base"], check=True, capture_output=True,
+    )
+    base = subprocess.check_output(["git", "-C", str(seed), "rev-parse", "HEAD"], text=True).strip()
+    subprocess.run(["git", "-C", str(seed), "push", str(bare), "HEAD:refs/heads/main"], check=True, capture_output=True)
+    root = tmp_path / "worktrees"
+    authority = AuthorityGitExecutor(bare, root)
+    worktree = authority.create_detached_worktree(base, "task")
+    (worktree / "attempt.txt").write_text("attempt\n", encoding="utf-8")
+    subprocess.run(["git", "-C", str(worktree), "add", "attempt.txt"], check=True)
+    subprocess.run(
+        ["git", "-C", str(worktree), "-c", "user.name=test", "-c", "user.email=test@example.invalid",
+         "commit", "-m", "failed attempt"], check=True, capture_output=True,
+    )
+    stale = subprocess.check_output(["git", "-C", str(worktree), "rev-parse", "HEAD"], text=True).strip()
+
+    recovered = authority.recover_failed_detached_worktree_exact(
+        path=worktree,
+        expected_oid=base,
+        stale_oid=stale,
+        target_ref="refs/heads/agent/recovery-test",
+    )
+
+    assert recovered == stale
+    assert subprocess.check_output(["git", "-C", str(worktree), "rev-parse", "HEAD"], text=True).strip() == base
+    assert subprocess.run(["git", "-C", str(worktree), "symbolic-ref", "-q", "HEAD"]).returncode == 1
+    assert subprocess.check_output(["git", "-C", str(worktree), "status", "--porcelain"], text=True) == ""